From ac8d4b692a85cc59562aabb96624f5511f0bdba6 Mon Sep 17 00:00:00 2001 From: Hector Arvayo Date: Tue, 9 Jun 2026 16:04:17 -0700 Subject: [PATCH 01/11] Veeam Custom tables added to Veeam_CCF --- .../Veeam_CCF/Veeam_ConnectorDefinition.json | 295 ++++++++++++++ .../Data Connectors/Veeam_CCF/Veeam_DCR.json | 385 ++++++++++++++++++ .../Veeam_CCF/Veeam_PollerConfig.json | 302 ++++++++++++++ .../table_VeeamAuthorizationEvents.json | 74 ++++ .../table_VeeamCovewareFindings.json | 109 +++++ .../Veeam_CCF/table_VeeamMalwareEvents.json | 89 ++++ .../table_VeeamOneTriggeredAlarms.json | 104 +++++ ...table_VeeamSecurityComplianceAnalyzer.json | 49 +++ .../Veeam_CCF/table_VeeamSessions.json | 129 ++++++ 9 files changed, 1536 insertions(+) create mode 100644 Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json create mode 100644 Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json create mode 100644 Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json create mode 100644 Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamAuthorizationEvents.json create mode 100644 Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamCovewareFindings.json create mode 100644 Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamMalwareEvents.json create mode 100644 Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamOneTriggeredAlarms.json create mode 100644 Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSecurityComplianceAnalyzer.json create mode 100644 Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSessions.json diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json new file mode 100644 index 00000000000..30b8893ad2b --- /dev/null +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json @@ -0,0 +1,295 @@ +{ + "name": "VeeamConnector", + "apiVersion": "2023-04-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "location": "{{location}}", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "VeeamConnector", + "title": "Veeam Data Connector (via Codeless Connector Framework)", + "publisher": "Microsoft", + "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEvents_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzer_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEvents_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarms_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindings_CL**: Security findings from Coveware solution\n- **VeeamSessions_CL**: Veeam sessions", + "graphQueries": [ + { + "metricName": "Total malware logs received", + "legend": "Malware events", + "baseQuery": "VeeamMalwareEvents_CL" + }, + { + "metricName": "Critical malware events", + "legend": "Critical malware events", + "baseQuery": "VeeamMalwareEvents_CL\n| where Severity == \"Critical\"" + }, + { + "metricName": "Total security & compliance analyzer logs received", + "legend": "Security & Compliance Analyzer results", + "baseQuery": "VeeamSecurityComplianceAnalyzer_CL" + }, + { + "metricName": "Total veeam ONE alarms logs received", + "legend": "Veeam ONE alarms", + "baseQuery": "VeeamOneTriggeredAlarms_CL" + }, + { + "metricName": "Total authorization events logs received", + "legend": "Authorization events", + "baseQuery": "VeeamAuthorizationEvents_CL" + }, + { + "metricName": "Total coveware findings logs received", + "legend": "Coveware findings", + "baseQuery": "VeeamCovewareFindings_CL" + }, + { + "metricName": "Total session logs received", + "legend": "Session logs", + "baseQuery": "VeeamSessions_CL" + } + ], + "sampleQueries": [ + { + "description": "Malware Events", + "query": "VeeamMalwareEvents_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Critical Malware Events", + "query": "VeeamMalwareEvents_CL\n | where Severity == \"Critical\"\n | sort by TimeGenerated desc" + }, + { + "description": "Security Compliance Results", + "query": "VeeamSecurityComplianceAnalyzer_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Veeam ONE Alarms", + "query": "VeeamOneTriggeredAlarms_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Authorization Events", + "query": "VeeamAuthorizationEvents_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Coveware Security Findings", + "query": "VeeamCovewareFindings_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Session events", + "query": "VeeamSessions_CL\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "VeeamMalwareEvents_CL", + "lastDataReceivedQuery": "VeeamMalwareEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamSecurityComplianceAnalyzer_CL", + "lastDataReceivedQuery": "VeeamSecurityComplianceAnalyzer_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamOneTriggeredAlarms_CL", + "lastDataReceivedQuery": "VeeamOneTriggeredAlarms_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamAuthorizationEvents_CL", + "lastDataReceivedQuery": "VeeamAuthorizationEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamCovewareFindings_CL", + "lastDataReceivedQuery": "VeeamCovewareFindings_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamSessions_CL", + "lastDataReceivedQuery": "VeeamSessions_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true, + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true, + "action": false + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "read": true + } + } + ], + "customs": [ + { + "name": "Veeam Data Access", + "description": "Access to Veeam systems is required to collect security and operational data. The connector supports data ingestion from Veeam Backup & Replication, Veeam ONE, and Coveware platforms." + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description": "Follow the instructions to configure the Veeam Data Connector.", + "instructions": [ + { + "type": "InfoMessage", + "parameters": { + "text": "**Note:** This data connector depends on parsers based on Kusto Functions to work as expected. These parsers are installed with the Microsoft Sentinel Solution for Veeam." + } + } + ] + }, + { + "title": "1. Configuration steps for Veeam Data Connector", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "1. Configure your Veeam systems to export security and operational data.\n2. Set up data collection endpoints to ingest data into the custom Log Analytics tables.\n3. Ensure proper permissions are configured for data access.\n4. Verify connectivity and data flow to Microsoft Sentinel." + } + } + ] + }, + { + "title": "2. Coveware API Configuration", + "description": "Configure Coveware API credentials for security findings data collection.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### 2.1 Obtain Coveware API Credentials\n1. Log in to your Coveware management console\n2. Navigate to API settings or integrations section\n3. Create or configure an API application\n4. Generate or obtain a Bearer token for API access\n5. Note your Coveware API base URL" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Coveware API URL", + "placeholder": "https://api.coveware.com", + "type": "text", + "name": "covewareApiUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Coveware Bearer Token", + "placeholder": "Your Coveware API Bearer Token", + "type": "password", + "name": "covewareBearerToken", + "validations": { + "required": true + } + } + } + ] + }, + { + "title": "3. Veeam API Configuration", + "description": "Configure Veeam API credentials for all Veeam services (Malware Events, Security Analyzer, and Authorization Events).", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### 3.1 Obtain Veeam API Access Token\n1. Access your Veeam Backup & Replication management console\n2. Navigate to the REST API settings or authentication section\n3. Generate or obtain a Bearer token for API access\n4. Ensure the token has appropriate permissions for:\n - Malware Detection API (v1.3-rev1)\n - Security & Compliance Analyzer API (v1.3-rev1)\n - Authorization Events API (v1.3-rev1)\n - Sessions API (v1.3-rev1)\n5. Note the API base URL (typically https://your-veeam-server.com:9419)\n6. This token will be used for both on-premises and CDN-hosted APIs" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam API URL", + "placeholder": "https://your-veeam-server.com:9419", + "type": "text", + "name": "veeamApiUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Bearer Token", + "placeholder": "Your Veeam API Bearer Token", + "type": "password", + "name": "veeamBearerToken", + "validations": { + "required": true + } + } + } + ] + }, + { + "title": "4. Veeam ONE API Configuration", + "description": "Configure Veeam ONE API credentials for triggered alarms data collection.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### 4.1 Obtain Veeam ONE API Access Key\n1. Access your Veeam ONE management console\n2. Navigate to Administration -> Users and Roles\n3. Create or use an existing user with API access permissions\n4. Generate or obtain a Bearer token for API access\n5. Note the Veeam ONE server URL and port (typically https://your-veeam-one-server:1239)" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE API URL", + "placeholder": "https://your-veeam-one-server:1239", + "type": "text", + "name": "veeamOneApiUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE API Bearer Token", + "placeholder": "Your Veeam ONE API Bearer Token", + "type": "password", + "name": "veeamOneBearerToken", + "validations": { + "required": true + } + } + } + ] + }, + { + "title": "5. Connect", + "description": "Enable the Veeam Data Connector.", + "instructions": [ + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "disconnectLabel": "Disconnect", + "name": "toggle" + } + } + ] + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json new file mode 100644 index 00000000000..755a443aa9c --- /dev/null +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json @@ -0,0 +1,385 @@ +{ + "name": "VeeamBackupReplicationDCR", + "apiVersion": "2021-09-01-preview", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", + "streamDeclarations": { + "Custom-VeeamCovewareFindings_CL": { + "columns": [ + { + "name": "covewareHostName", + "type": "string" + }, + { + "name": "artifact", + "type": "string" + }, + { + "name": "eventType", + "type": "string" + }, + { + "name": "techniqueId", + "type": "string" + }, + { + "name": "eventTime", + "type": "datetime" + }, + { + "name": "firstRunOrAccessed", + "type": "datetime" + }, + { + "name": "hostname", + "type": "string" + }, + { + "name": "eventActivity", + "type": "string" + }, + { + "name": "country", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "machineId", + "type": "string" + }, + { + "name": "riskLevel", + "type": "string" + }, + { + "name": "scanTime", + "type": "datetime" + }, + { + "name": "username", + "type": "string" + }, + { + "name": "fileHashes", + "type": "dynamic" + } + ] + }, + "Custom-VeeamMalwareEvents_CL": { + "columns": [ + { + "name": "vbrHostName", + "type": "string" + }, + { + "name": "type", + "type": "string" + }, + { + "name": "state", + "type": "string" + }, + { + "name": "source", + "type": "string" + }, + { + "name": "severity", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "detectionTimeUtc", + "type": "datetime" + }, + { + "name": "details", + "type": "string" + }, + { + "name": "createdBy", + "type": "string" + }, + { + "name": "engine", + "type": "string" + }, + { + "name": "machine", + "type": "dynamic" + } + ] + }, + "Custom-VeeamOneTriggeredAlarms_CL": { + "columns": [ + { + "name": "voneHostName", + "type": "string" + }, + { + "name": "triggeredAlarmId", + "type": "int" + }, + { + "name": "name", + "type": "string" + }, + { + "name": "alarmTemplateId", + "type": "int" + }, + { + "name": "predefinedAlarmId", + "type": "int" + }, + { + "name": "triggeredTime", + "type": "datetime" + }, + { + "name": "status", + "type": "string" + }, + { + "name": "description", + "type": "string" + }, + { + "name": "comment", + "type": "string" + }, + { + "name": "repeatCount", + "type": "int" + }, + { + "name": "childAlarmsCount", + "type": "int" + }, + { + "name": "alarmSource", + "type": "dynamic" + }, + { + "name": "remediation", + "type": "dynamic" + } + ] + }, + "Custom-VeeamSecurityComplianceAnalyzer_CL": { + "columns": [ + { + "name": "vbrHostName", + "type": "string" + }, + { + "name": "status", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "bestPractice", + "type": "string" + }, + { + "name": "note", + "type": "string" + } + ] + }, + "Custom-VeeamSessions_CL": { + "columns": [ + { + "name": "vbrHostName", + "type": "string" + }, + { + "name": "sessionType", + "type": "string" + }, + { + "name": "state", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "name", + "type": "string" + }, + { + "name": "jobId", + "type": "string" + }, + { + "name": "creationTime", + "type": "datetime" + }, + { + "name": "endTime", + "type": "datetime" + }, + { + "name": "progressPercent", + "type": "int" + }, + { + "name": "resourceId", + "type": "string" + }, + { + "name": "resourceReference", + "type": "string" + }, + { + "name": "parentSessionId", + "type": "string" + }, + { + "name": "platformName", + "type": "string" + }, + { + "name": "platformId", + "type": "string" + }, + { + "name": "usn", + "type": "long" + }, + { + "name": "result", + "type": "dynamic" + } + ] + }, + "Custom-VeeamAuthorizationEvents_CL": { + "columns": [ + { + "name": "vbrHostName", + "type": "string" + }, + { + "name": "createdBy", + "type": "string" + }, + { + "name": "creationTime", + "type": "datetime" + }, + { + "name": "description", + "type": "string" + }, + { + "name": "expirationTime", + "type": "datetime" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "name", + "type": "string" + }, + { + "name": "processedBy", + "type": "string" + }, + { + "name": "processedTime", + "type": "datetime" + }, + { + "name": "state", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-VeeamMalwareEvents_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamMalwareEvents_CL", + "transformKql": "source | extend TimeGenerated = now() , VbrHostName = ['vbrHostName'] , MalwareEventType = ['type'] , MalwareState = ['state'] , Source = ['source'] , Severity = ['severity'] , Id = ['id'] , DetectionTimeUtc = ['detectionTimeUtc'] , MachineDisplayName = tostring(machine.displayName) , MachineUuid = tostring(machine.uuid) , MachineBackupObjectId = tostring(machine.backupObjectId) , Details = ['details'] , CreatedBy = ['createdBy'] , Engine = ['engine'] | project TimeGenerated , VbrHostName , MalwareEventType , MalwareState , Source , Severity , Id , DetectionTimeUtc , MachineDisplayName , MachineUuid , MachineBackupObjectId , Details , CreatedBy , Engine" + }, + { + "streams": [ + "Custom-VeeamSecurityComplianceAnalyzer_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamSecurityComplianceAnalyzer_CL", + "transformKql": "source | extend TimeGenerated = now() , VbrHostName = ['vbrHostName'] , Status = ['status'] , Id = ['id'] , BestPractice = ['bestPractice'] , Note = ['note'] | project TimeGenerated , VbrHostName , Status , Id , BestPractice , Note" + }, + { + "streams": [ + "Custom-VeeamOneTriggeredAlarms_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamOneTriggeredAlarms_CL", + "transformKql": "source | extend TimeGenerated = now() , VoneHostName = ['voneHostName'] , TriggeredAlarmId = ['triggeredAlarmId'] , Name = ['name'] , AlarmTemplateId = ['alarmTemplateId'] , PredefinedAlarmId = ['predefinedAlarmId'] , TriggeredTime = ['triggeredTime'] , Status = ['status'] , Description = ['description'] , Comment = ['comment'] , RepeatCount = ['repeatCount'] , ObjectId = toint(alarmSource.objectId) , ObjectName = tostring(alarmSource.objectName) , ObjectType = tostring(alarmSource.objectType) , ChildAlarmsCount = ['childAlarmsCount'] , RemediationDescription = tostring(remediation.description) , RemediationMode = tostring(remediation.mode) | project TimeGenerated , VoneHostName , TriggeredAlarmId , Name , AlarmTemplateId , PredefinedAlarmId , TriggeredTime , Status , Description , Comment , RepeatCount , ObjectId , ObjectName , ObjectType , ChildAlarmsCount , RemediationDescription , RemediationMode" + }, + { + "streams": [ + "Custom-VeeamAuthorizationEvents_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamAuthorizationEvents_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" + }, + { + "streams": [ + "Custom-VeeamCovewareFindings_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamCovewareFindings_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(eventTime), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" + }, + { + "streams": [ + "Custom-VeeamSessions_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamSessions_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" + } + ] + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json new file mode 100644 index 00000000000..1a0eb412b23 --- /dev/null +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json @@ -0,0 +1,302 @@ +[ + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "MalwareEventsPoller", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/malwareDetection/events')]", + "httpMethod": "GET", + "rateLimitQPS": 5, + "queryWindowInMin": 5, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json", + "x-api-version": "1.3-rev1" + }, + "queryParameters": { + "detectedAfterTimeUtcFilter": "{_QueryWindowStartTime}", + "detectedBeforeTimeUtcFilter": "{_QueryWindowEndTime}", + "orderColumn": "detectionTimeUtc", + "orderAsc": "true" + } + }, + "response": { + "eventsJsonPaths": [ + "$.data" + ], + "format": "json" + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "skip", + "pageSize": 1000, + "pageSizeParameterName": "limit" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamMalwareEvents_CL", + "dcrConfig": { + "streamName": "Custom-VeeamMalwareEvents_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "CovewareFindingPoller", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('covewareBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('covewareApiUrl'),'/recon/v1/findings')]", + "httpMethod": "GET", + "rateLimitQPS": 5, + "queryWindowInMin": 360, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json" + }, + "queryParameters": { + "earliest-event-time": "{_QueryWindowStartTime}" + } + }, + "response": { + "eventsJsonPaths": [ + "$.data" + ], + "format": "json" + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "offset", + "pageSize": 250, + "pageSizeParameterName": "page-size" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamCovewareFindings_CL", + "dcrConfig": { + "streamName": "Custom-VeeamCovewareFindings_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "OneTriggeredAlarmsPoller", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('veeamOneBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/v2.3/alarms/triggeredAlarms')]", + "httpMethod": "GET", + "rateLimitQPS": 5, + "queryWindowInMin": 5, + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json" + } + }, + "response": { + "eventsJsonPaths": [ + "$.items" + ], + "format": "json" + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "Offset", + "pageSize": 1000, + "pageSizeParameterName": "Limit" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamOneTriggeredAlarms_CL", + "dcrConfig": { + "streamName": "Custom-VeeamOneTriggeredAlarms_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "SecurityComplianceAnalyzerPoller", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/securityAnalyzer/bestPractices')]", + "httpMethod": "GET", + "rateLimitQPS": 2, + "queryWindowInMin": 60, + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json", + "x-api-version": "1.3-rev1" + } + }, + "response": { + "eventsJsonPaths": [ + "$.items" + ], + "format": "json" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamSecurityComplianceAnalyzer_CL", + "dcrConfig": { + "streamName": "Custom-VeeamSecurityComplianceAnalyzer_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "AuthorizationEventsPoller", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/authorization/events')]", + "httpMethod": "GET", + "rateLimitQPS": 2, + "queryWindowInMin": 5, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json", + "x-api-version": "1.3-rev1" + }, + "queryParameters": { + "createdAfterFilter": "{_QueryWindowStartTime}", + "createdBeforeFilter": "{_QueryWindowEndTime}", + "orderColumn": "creationTime", + "orderAsc": "true" + } + }, + "response": { + "eventsJsonPaths": [ + "$.data" + ], + "format": "json" + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "skip", + "pageSize": 1000, + "pageSizeParameterName": "limit" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamAuthorizationEvents_CL", + "dcrConfig": { + "streamName": "Custom-VeeamAuthorizationEvents_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "SessionsPoller", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/sessions')]", + "httpMethod": "GET", + "rateLimitQPS": 2, + "queryWindowInMin": 15, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json", + "x-api-version": "1.3-rev1" + }, + "queryParameters": { + "createdAfterFilter": "{_QueryWindowStartTime}", + "createdBeforeFilter": "{_QueryWindowEndTime}", + "orderColumn": "creationTime", + "orderAsc": "true", + "skip": "0" + } + }, + "response": { + "eventsJsonPaths": [ + "$.data" + ], + "format": "json" + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "skip", + "pageSize": 1000, + "pageSizeParameterName": "limit" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamSessions_CL", + "dcrConfig": { + "streamName": "Custom-VeeamSessions_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + } + } + } +] \ No newline at end of file diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamAuthorizationEvents.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamAuthorizationEvents.json new file mode 100644 index 00000000000..3c45e1f325b --- /dev/null +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamAuthorizationEvents.json @@ -0,0 +1,74 @@ +{ + "name": "VeeamAuthorizationEvents_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "tags": { + "StreamName": "Custom-VeeamAuthorizationEvents_CL", + "DataSource": "VeeamConnector", + "Category": "Security" + }, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "VeeamAuthorizationEvents_CL", + "description": "Veeam authorization and authentication events for security monitoring and access control.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "VbrHostName", + "type": "string", + "description": "Veeam Backup & Replication server hostname" + }, + { + "name": "CreatedBy", + "type": "string", + "description": "User who created the authorization request" + }, + { + "name": "CreationTime", + "type": "datetime", + "description": "Timestamp when authorization was created" + }, + { + "name": "Description", + "type": "string", + "description": "Description of authorization request" + }, + { + "name": "ExpirationTime", + "type": "datetime", + "description": "Timestamp when authorization expires" + }, + { + "name": "Id", + "type": "string", + "description": "Unique authorization event identifier" + }, + { + "name": "Name", + "type": "string", + "description": "Name of authorization request" + }, + { + "name": "ProcessedBy", + "type": "string", + "description": "User who processed the authorization" + }, + { + "name": "ProcessedTime", + "type": "datetime", + "description": "Timestamp when authorization was processed" + }, + { + "name": "State", + "type": "string", + "description": "Current authorization state" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamCovewareFindings.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamCovewareFindings.json new file mode 100644 index 00000000000..d30321baccc --- /dev/null +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamCovewareFindings.json @@ -0,0 +1,109 @@ +{ + "name": "VeeamCovewareFindings_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "tags": { + "StreamName": "Custom-VeeamCovewareFindings_CL", + "DataSource": "VeeamConnector", + "Category": "Security" + }, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "VeeamCovewareFindings_CL", + "description": "Coveware security findings and threat intelligence from Veeam backup systems.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "CovewareHostName", + "type": "string", + "description": "Coveware server hostname" + }, + { + "name": "Artifact", + "type": "string", + "description": "File or process path" + }, + { + "name": "EventType", + "type": "string", + "description": "Type of security event" + }, + { + "name": "TechniqueId", + "type": "string", + "description": "MITRE ATT&CK technique identifier" + }, + { + "name": "EventTime", + "type": "datetime", + "description": "Timestamp when event occurred" + }, + { + "name": "FirstRunOrAccessed", + "type": "datetime", + "description": "First time artifact was run or accessed" + }, + { + "name": "Hostname", + "type": "string", + "description": "Machine hostname where event occurred" + }, + { + "name": "EventActivity", + "type": "string", + "description": "Description of security activity" + }, + { + "name": "Country", + "type": "string", + "description": "Geographic location of the event" + }, + { + "name": "Id", + "type": "string", + "description": "Unique finding identifier" + }, + { + "name": "Md5Hash", + "type": "string", + "description": "MD5 hash of the file" + }, + { + "name": "Sha1Hash", + "type": "string", + "description": "SHA1 hash of the file" + }, + { + "name": "Sha256Hash", + "type": "string", + "description": "SHA256 hash of the file" + }, + { + "name": "MachineId", + "type": "string", + "description": "Unique machine identifier" + }, + { + "name": "RiskLevel", + "type": "string", + "description": "Security risk level assessment" + }, + { + "name": "ScanTime", + "type": "datetime", + "description": "Timestamp when scan was performed" + }, + { + "name": "Username", + "type": "string", + "description": "User account associated with event" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamMalwareEvents.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamMalwareEvents.json new file mode 100644 index 00000000000..c9bd2c3aa5c --- /dev/null +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamMalwareEvents.json @@ -0,0 +1,89 @@ +{ + "name": "VeeamMalwareEvents_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "tags": { + "StreamName": "Custom-VeeamMalwareEvents_CL", + "DataSource": "VeeamConnector", + "Category": "Security" + }, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "VeeamMalwareEvents_CL", + "description": "Veeam Backup & Replication malware detection events and security threats.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "VbrHostName", + "type": "string", + "description": "Veeam Backup & Replication server hostname" + }, + { + "name": "MalwareEventType", + "type": "string", + "description": "Type of malware detection event" + }, + { + "name": "MalwareState", + "type": "string", + "description": "Current state of malware event" + }, + { + "name": "Source", + "type": "string", + "description": "Source that triggered the detection" + }, + { + "name": "Severity", + "type": "string", + "description": "Severity level of malware threat" + }, + { + "name": "Id", + "type": "string", + "description": "Unique malware event identifier" + }, + { + "name": "DetectionTimeUtc", + "type": "datetime", + "description": "UTC timestamp of malware detection" + }, + { + "name": "MachineDisplayName", + "type": "string", + "description": "Display name of affected machine" + }, + { + "name": "MachineUuid", + "type": "string", + "description": "Unique identifier of affected machine" + }, + { + "name": "MachineBackupObjectId", + "type": "string", + "description": "Backup object ID for affected machine" + }, + { + "name": "Details", + "type": "string", + "description": "Detailed information about malware detection" + }, + { + "name": "CreatedBy", + "type": "string", + "description": "User or system that created the event" + }, + { + "name": "Engine", + "type": "string", + "description": "Antivirus engine that detected malware" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamOneTriggeredAlarms.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamOneTriggeredAlarms.json new file mode 100644 index 00000000000..aeb6c3af3d9 --- /dev/null +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamOneTriggeredAlarms.json @@ -0,0 +1,104 @@ +{ + "name": "VeeamOneTriggeredAlarms_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "tags": { + "StreamName": "Custom-VeeamOneTriggeredAlarms_CL", + "DataSource": "VeeamConnector", + "Category": "Security" + }, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "VeeamOneTriggeredAlarms_CL", + "description": "Veeam ONE triggered alarms and monitoring alerts from Veeam infrastructure.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "VoneHostName", + "type": "string", + "description": "Veeam ONE server hostname" + }, + { + "name": "TriggeredAlarmId", + "type": "int", + "description": "Unique identifier for triggered alarm" + }, + { + "name": "Name", + "type": "string", + "description": "Name of the alarm" + }, + { + "name": "AlarmTemplateId", + "type": "int", + "description": "Template identifier for alarm type" + }, + { + "name": "PredefinedAlarmId", + "type": "int", + "description": "Predefined alarm rule identifier" + }, + { + "name": "TriggeredTime", + "type": "datetime", + "description": "Timestamp when alarm was triggered" + }, + { + "name": "Status", + "type": "string", + "description": "Current alarm status" + }, + { + "name": "Description", + "type": "string", + "description": "Detailed alarm description" + }, + { + "name": "Comment", + "type": "string", + "description": "Additional comments or notes" + }, + { + "name": "RepeatCount", + "type": "int", + "description": "Number of times alarm has repeated" + }, + { + "name": "ObjectId", + "type": "int", + "description": "Identifier of object that triggered alarm" + }, + { + "name": "ObjectName", + "type": "string", + "description": "Name of object that triggered alarm" + }, + { + "name": "ObjectType", + "type": "string", + "description": "Type of object that triggered alarm" + }, + { + "name": "ChildAlarmsCount", + "type": "int", + "description": "Number of child alarms" + }, + { + "name": "RemediationDescription", + "type": "string", + "description": "Detailed description of the alarm event" + }, + { + "name": "RemediationMode", + "type": "string", + "description": "Recommended remediation mode for the alarm event" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSecurityComplianceAnalyzer.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSecurityComplianceAnalyzer.json new file mode 100644 index 00000000000..f29020fe21b --- /dev/null +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSecurityComplianceAnalyzer.json @@ -0,0 +1,49 @@ +{ + "name": "VeeamSecurityComplianceAnalyzer_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "tags": { + "StreamName": "Custom-VeeamSecurityComplianceAnalyzer_CL", + "DataSource": "VeeamConnector", + "Category": "Security" + }, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "VeeamSecurityComplianceAnalyzer_CL", + "description": "Veeam Security & Compliance Analyzer best practice assessments and compliance results.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "VbrHostName", + "type": "string", + "description": "Veeam Backup & Replication server hostname" + }, + { + "name": "Status", + "type": "string", + "description": "Assessment status of security best practice" + }, + { + "name": "Id", + "type": "string", + "description": "Unique identifier for best practice assessment" + }, + { + "name": "BestPractice", + "type": "string", + "description": "Security best practice being evaluated" + }, + { + "name": "Note", + "type": "string", + "description": "Additional notes and recommendations" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSessions.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSessions.json new file mode 100644 index 00000000000..a27c96c1643 --- /dev/null +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSessions.json @@ -0,0 +1,129 @@ +{ + "name": "VeeamSessions_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "tags": { + "StreamName": "Custom-VeeamSessions_CL", + "DataSource": "VeeamConnector", + "Category": "Security" + }, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "VeeamSessions_CL", + "description": "Veeam comprehensive session data including backup, restore, and other operations with detailed status and progress information.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "VbrHostName", + "type": "string", + "description": "Veeam Backup & Replication server hostname" + }, + { + "name": "SessionType", + "type": "string", + "description": "Type of Veeam session operation" + }, + { + "name": "State", + "type": "string", + "description": "Current state of the session" + }, + { + "name": "Id", + "type": "string", + "description": "Unique session identifier" + }, + { + "name": "Name", + "type": "string", + "description": "Display name of the session" + }, + { + "name": "JobId", + "type": "string", + "description": "Associated job identifier" + }, + { + "name": "CreationTime", + "type": "datetime", + "description": "Timestamp when session was created" + }, + { + "name": "EndTime", + "type": "datetime", + "description": "Timestamp when session completed" + }, + { + "name": "ProgressPercent", + "type": "int", + "description": "Session completion percentage" + }, + { + "name": "ResultStatus", + "type": "string", + "description": "Session result status" + }, + { + "name": "ResultMessage", + "type": "string", + "description": "Session result message" + }, + { + "name": "ResultIsCanceled", + "type": "boolean", + "description": "Whether session was canceled" + }, + { + "name": "VeeamResourceId", + "type": "string", + "description": "Veeam resource identifier" + }, + { + "name": "ResourceReference", + "type": "string", + "description": "Reference to associated resource" + }, + { + "name": "ParentSessionId", + "type": "string", + "description": "Parent session identifier if applicable" + }, + { + "name": "PlatformName", + "type": "string", + "description": "Platform name associated with the session" + }, + { + "name": "PlatformId", + "type": "string", + "description": "Platform identifier associated with the session" + }, + { + "name": "Usn", + "type": "long", + "description": "Update sequence number" + }, + { + "name": "Result", + "type": "string", + "description": "Session result status" + }, + { + "name": "Message", + "type": "string", + "description": "Session result message" + }, + { + "name": "IsCanceled", + "type": "boolean", + "description": "Whether session was canceled" + } + ] + } + } +} \ No newline at end of file From f74c0b830b540506aaf6b6ecde6064813cf2e45b Mon Sep 17 00:00:00 2001 From: Hector Arvayo Date: Wed, 10 Jun 2026 15:57:06 -0700 Subject: [PATCH 02/11] Add Veeam data connector - Public Preview- CCF connector with 6 data streams (VeeamAuthorizationEvents, VeeamCovewareFindings,VeeamMalwareEvents,VeeamOneTriggeredAlarms,VeeamSecurityComplianceAnalyzer,VeeamSessions)- Includes DCR, polling configs, table definitions, and parsers- Version 3.0.3 --- Solutions/Veeam/Data/Solution_Veeam.json | 2 +- Solutions/Veeam/Package/3.0.3.zip | Bin 0 -> 54624 bytes .../Veeam/Package/createUiDefinition.json | 1850 +- Solutions/Veeam/Package/mainTemplate.json | 16416 +--------------- .../Veeam/Parsers/Veeam_ParseResourceId.yaml | 58 + ...er_Veeam_VeeamSessions_AliasFunctions.json | 14 + Solutions/Veeam/ReleaseNotes.md | 1 + Solutions/Veeam/SolutionMetadata.json | 18 +- 8 files changed, 413 insertions(+), 17946 deletions(-) create mode 100644 Solutions/Veeam/Package/3.0.3.zip create mode 100644 Solutions/Veeam/Parsers/Veeam_ParseResourceId.yaml create mode 100644 Solutions/Veeam/Parsers/parser_Veeam_VeeamSessions_AliasFunctions.json diff --git a/Solutions/Veeam/Data/Solution_Veeam.json b/Solutions/Veeam/Data/Solution_Veeam.json index b26a21b3fc9..a753d4d82dc 100644 --- a/Solutions/Veeam/Data/Solution_Veeam.json +++ b/Solutions/Veeam/Data/Solution_Veeam.json @@ -186,7 +186,7 @@ "WatchlistDescription": [], "dependentDomainSolutionIds": [], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Veeam", - "Version": "3.0.1", + "Version": "3.0.3", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/Veeam/Package/3.0.3.zip b/Solutions/Veeam/Package/3.0.3.zip new file mode 100644 index 0000000000000000000000000000000000000000..4bb41792f85d3e45c29eabedc1726e89ce394290 GIT binary patch literal 54624 zcmV)IK)kMtB zX>V>WYIARH?OW?^8^;y?U!d4CU5Ut}KR;ZP=4b;8O(S{>Ei=7+JeQLZyrp8OX*83~(5PtO8( zayjjdv>O+L!m1o6I^q!VhAHtsyT^E_QCxDQzrQ|9&(fWp?~PMWc6P*@L`kbeu7)ZX&ImVFVrY`YOm#XE12r_c z5<0a`CJ8;Eb!(D>Xn7(C)_?!~A92J?Tv!yRN6N#dqwM>3MXD$Ba@t(3R7K!%39KZt zUxH+ay-B=H=L1e!?)gLwl$VTNaBs`6oxh-fwd@?+9@5krY176ZY^mCZmXB#SjL z+X^#m!f6W82q~Up|^E|cJYb|?PzJ{V;CB+zaI)u4dw`1P`tW@m$Ti7qq|6fZ_n?7#PDPiTx-tMS5Lu*1zR}sQ?TH zO3toJBrN@fj#L*m-@_ROI56irBJ*)wSfr;B7@w7(Ms-kPA4)KDa7?$9FMf1o1*5wl zk)0hjUI!*kS@@Q`%3eq8?7TDi`M{WSe)5Q)NEeM0O}a>%co(eREbQ8QOdwAW2{$nz zvnmIsa1FL<#jG>dm2KY^{}QWEf;YMP<=_}%6K(szp!DOm7}Onk&BbF808Eib>J6Jf zA3~hgcZhm`^18a6_Em_8`r+jIsh7Pdlb5AE>`%dIo5@I7QV4%~Um_@SM+MC470?zy zuo$k`%u2~Shvd6j^^Nc6e|)I3EHRO6WEa9LNoHetfg(B`!>&@K^qu!56_AdYDlt+p zdrk~!Jr?-xMi>Ys?dT$7TF4Mo|lZ(p1&Y9?ZJH|7&@KGdUKznnNo$DOU( zZMg0Q`YU`_x6BfrKH7b>+ui-LySujqgqx(>xk`%DYYOndOkiz$&vTPKM<}|mJCOsG z(Dr6+KtvX)u}MH9Z8~Q8Ah5aQ=p`+PabirN@>C~@Aj6C>D5R)akR6| z7e~c!Wdf1204FkQdxdQK>(Sm?yZ~Fq%gHygXFh6 zqI%Y-f7{s5)=o_r4w62r+NBn4{d(qke%5+&*4pa8)Tjx+)e&1~tPO$qKT*3LuD~2!qimG{VbVjA{m8q<AV5+N+wr`2T`<->Bvq7^`{ z0}B8GD#vjUctE_lBphjFNMsh@dv4OYum5nlCO2bvQymVN-M#kO745B%X`^z1vcOm+ z8L6Wf!7he$8NZZ;9mmAFd?w0V4K)T*o)z8wsK(-P?vP(sD-|NQ)5Xrs7!Q2TH_doH zqhX=0^78~^88q)h(V|`eMK)m@^Q|iH=(_@UTqEZ%bFVI0mM#a$%iuq(jh%bf=j5?3 z*Q~q{7}8YCD$5KMBrm^r+0|=6yBYPyD|kz7_?Sj4T}LIZCKi_4jt2%cVqwQr=z|xL zBLv4IM8{OwLb(*Bq@T<{NN^REE-pc_FY%C{aY;@5839+8XrBNf+R7<7UA|5YDzWn5 z{q1$+(b{$7xT@*xd*V?;Tf2HZdI0LtK<70zBUC-r1u?k-n?yhA z_~{#T7O*Q&`Xkqaf2=n}ZxmMCJYxvu-b+%3=Ji|W42|G^Ytqn+%nrbu{!@Cp#R#Q8{&x_>nKAz!xDEjZBVyo_9Ok-6Jriueu^BR_TS#P09lR z;x%Qj-d4mNPFyJ2M%S*6Wd#g9!aN#xYOPH+B`EdymggAF8(5;wV#hP9+6z4~7o{M_ zM;#oW|9muoCx=Or>~ie~1tVShSb`HtOfSUD6B5Y;%tA2}ITq@S6clobPMcv<1({ED z8%xsBLQKqzc!6fMutfysT69~9rqEFa>>4+?Qim3!ypTF!@s(w{8g;C}qM-Ju*m^aq zEp7EyP0$8x*ixsxb}=`Q$5g=AnaKPNVfhK(w&6X9n4T#N&>;7_yOGvzHseQTuscrU#eR}UAyU$zp*&5{)I%eW~9J4uzeRgjW zYo_q7W%hWDGCM{jLG&Ec*wE%g_W0gJ)=1!8OYHM?7RH_(i5EV8-juXHzc*=>)iA*2 zqEln>YJvE>mgE;}lqA*qKo1(_7&qITG{3kvX*Lpg*An}3?M3NEtvpta(#kcKrvm}^ zSf56^8Svo24}0CRa!B(9Az4l%bMc@jP7F<>(gZQTfHq;KB0ZdiVmLiz7t5fY(J=K7 zM~8TEtSFuLnJjO{Jh&^ea_)fR-fB>gcZa+lM*;Vx62>r*BgTwoDflQ~WUvBLpgc7C zGDcy6CwXU_#G|t5C@ZHa-l?`2=fH>=3K1SOr~Q@-6y-#bC%dXXeK#BAIu>CiBu zO2zyfc;59D`D&e4ggObEy9{4F#LG}?p7?SPYnC61iu{zFEic1d`ySRc`2Q_%d%J7A z2BB}ZxvQ|Z`%vyeOkZBX@CBm1LX)yF?OgP%8i>`b()=D&(^Ijw^UpqN`iW_#5)y0f zfnS-Q_Du!3Qe>Xiy=x=7xBdx-4x}~#ZR1f&^TnZ-|rnrJ} z4~_7EesiBJd?K-yHd*6gzp+c!jNwh2WC62>(g?4}ns>g#lpTK}$DJGQ9)&rN*XU7U zlHKcdN9?0lJMlVBT76WtrP{}@_m8&c-)McjrS3mEtJ*)lbA;RAyF3BWlYnU17OElO z+d`Mj`yrT^v9Sj55ZL-J5d9~+@%)R6rp`UVr4J8?Bi|K+H8k?)+VHz?37@9Uz#;Hh0BV?`ThA94c*#zJ+0Fr`k}6U%Q1ea7!BXwc9g$^@p|}%>J6U7uZ|Ds z(p>(+%s@6aWAK2mm&H z%3Q;ep(S?5000(93IGuR003=aX>L?yZE$R1bY(7Tb8l|!y?b}tII=JL|6S{R2VU)m z>>SJQN4oFK>~`#=iz<=AG@?H_n~oMVt1Yi@@2O z_;=*HaBFva=cm#3{%Ct=YwFBr{sX%1(z%<@?8w>tXXtzXGT6W!Onfhb?>;&~==vV& zXJ>O8{f~Tq=S23@j*tZ3(FgF6y@+o80A2dgaqK(m!oQBb+JR$@tUGrS_#ymm&*$M{ zKKFy@mwR*(k}hr$_j!lp2~iUl{%jFJ&sIdFv#$NX!VM453S94o_KBXv^?q}_o9Gt4-AO;5I@k7M7Jam53w+P)T3x8`;jT6S_iv<=(Z#L5m`z7;>*$3udTj^Oi4V8^_oik2?pUrDMvgs2tyP z?TIs@V*a=F_12x-T5f1foxr_^F0TXs4qyJ;v6b9_M;HD4i2o4}G(1GUNwx9K4y5*Q zeF9yC4%dd~&JETG--?yj3aOINcN1Epkrg^fE0D&Z=cB^H$1`Vw{x#f4wPtNdzaOrz ze=dJ^?vW)=R;+DGkNi9B&+v$8J0Zd}iqq1PKa z(PCcwD0Vctow;GOGjgZZ-rzs|t1-Gb9M63J3-ncLOlnX4!E^s-0m?kZ4~!Hu5w`qs zb}K*5%$+!1=!~7IizMmQQ|;A$s@}b*{mPHz&mFL9kYS9hqE`=fQ2C)kCqygkIE-M* z>eVwHR(_`Yt6=Qhqour0&vR7yd2GCHjA505PkZ%D&uhISSSeuDxCwjlC_hzy6yJ0D z^(;Hvl^@>%E&R*7dGv4`1oi{I4{hkzhMzvOmoD5B z-@A5i&Zaxb!<{U`$iKV9T_9zKD?Bh+*vuyqWo~0dV!mQKnz9X@#Nh=k7v_0x|4)|4wLQG<~!jci5eG!P9LFw0*+o6p=Twzc`#Atj%p4Y$M5s8^h^j zi2q^54{#Ab0BNJ}c6=+R?r|$h4<7ed^m^&TX9frx+vw!h_HLY$WG%jQnaNH3Z8CK7 z7FcyFzLHfuP_zd$-)G)d?t8(cQ6j1MPFBMF6(Y&#jpEq=LNV?H+yC{<|C+H|Q3rw^ zmSS)7natjVlC!cWjivKtZj|n%bLQ_Vb0#yrQIVRk*ZHiny}l=6U(Bb zuV%LQB_tyW*G```rqUB5p)F1MG@tfZfJsfL)~-V7G@e0FqqEAa{Ffkh|punSDx5<>)A%`0%=1 z+nYEz3je1Qz$^%RrkswJ-XJzRm3|7%uk2=t8Sa&u;a-hL6gMU{$33w*?loqPdrIcG z*F$sMQ#HrE-kRfHxjAN^l2g4m_6$YG3YI$lTd|?#S}3$C?n;RX?U$O+zN)0+JEiur zFSeKc#_VNZ$zJw*XfOM!_Ojnwd)Y6ym+VvW9uvgIk7tlnAn*&*uL?Xt?%rbGFS$%& zBL}56a-bxj_%^A59Ec6%pfLkEP%@B%9vaAjs(~Ez)<6!*4J7-NoRXc8^OjexH^oO1 zSuM<6AT}0JJB22by;x#6hoy#ds3EfWW~uocip}S+G4nZ8GM~d9n$MxC`5gAvd=AUa zC;OBcRYRfwMI7mQVNc*-Tx3Fmi;B!h+@8dg@;6A#>8RA4jx@y=Hy|~sBe6*xHD*#r zN+xyGLz6mEHL0WCn$%IbNoAihRyQ-z&A8=VHrw-k9Y)SF)VvJ+z$Xs+RM-x0ds~+;Xx{8Ee{mCqTIu7ZaPz zmTzslH)@ZP+seo``!pL%E@KdBnXPrWse zpUMp+`;?rL!RSV|7kzwl?w~xg0H=wRTp>0WVM~Qple=1W9K2nA9=xq1cfsxQQ{nA` zW8v-Q&V{$t4u-dTXi8XiwUgTI-Wn5nh|;s#?1RQihYrAJ_s(VD-rP8WGsRJ=R42t> zXAG&Zjl2~JFO`{)LQ2JsvbY8J%I&8pt)jua3dO{VUS?M8DBDkuQyo-t9mLs47m*!E zP7zbpEW0pcQwr_ot*hiFnVpsAFvOQ=K1@L?a*HcSV<5LSVsUDT45Y`NS)6hz122BR zEKVVrA@`u1n@g-HBt)MBnDHfzK zkXsuuMYSXb(qqp|Q8|r)7r$SosF28zdr)Q>_|Jtq`I3!QD86Gf~K2$UP`gHdMw=lG{;PHtm&B z$D%8;W+Q1yU_J#`%gm@eyCJ?rRqle@<>pk7=Rj_4#GKSJ9Y~KoGbiO-2VVSsnUg}c zL+(NU?q6A#2nE3U4X%n;jofF+sEDp+^)CB8t8~A`m;=^Jf~3GSQS?>PujF2~`-00v zQe>Y(_<62>*|UqTVS7$W9xP-AY%2xdB)u2k$@VY4ik09ZMia0uFq#0|Zl*JS$z}XosG)Rlg z(;9PBQN{TVv;}zy8&}1OF3&9ec{#Y1pMJfRDz>jzvV~tLIk)bM$C!PqqBaB#G*OlI z^{TSpKwo{{ZxG3!a~rbCC@A)0zTQ>P)il&eUuy~+Akov^CiQezNl$lssHeFArFeX$ zdb+Emr@Ot?Q&D^~tBBcQq8(dYN)8ou+=VZom-AJl>BA-H7r4Q{7M8yLXB&*_uFD+0kV z*oqWFC3Zc~U|SP9+SXS$x=kT7ArAsO>>NG`ZtKo=J^E_+ZaM%LO*+bhj27xqx=Jxx z5RVrJ0s4dgGHFimoxrl_4>umXqSsqAGyy&s0dhvUGuqx08f9`zjoE=mCK0q<)o_yr zzCdy)y7^bfa{_nr;Y@H%ktwhW6pQ$QV9WI-cnsZWmW6ss2F6-j zgs?(b$H*3}R|_wW=dBmCHD6rK-0+q;-!8b2vGg}~@MY?M^$JC>XDD!IJ@^X*j0(~q z+}QZa$eDqyM!`coOJF$EJJ`;;bJ(9uF#L`c;n9Hm;O0D>=;j~ZAKv9HT%Ghs@Rjf_ z&J77i;Ay9LE4o3xL;FVCn_9`XZcg?yA%?$=wGaBb1D(D_v-rJZ-6dNcd}~NCscedc zx@jQ+@e{fs+>Ezk2vGMn@E13?*_RWyg3^(v@CbAmcyv`VDEO(S&J;ZbTulZ(+3KCc zHZQc+PEXF)aiiJqUwYFy&Ui-Gyj;g)`RrK?dt}A9M;077&KA(c&(EIy;f<_k&+tHT z#i8Sq-=01D*&?5TJP~O>Mp%qrYw_4K%@(H~kUkQ?uYb4FYb<&ZLfOT^kaUchzOUlG zUGF-u!QBNH3=KPam%fMOWaJP4I1mB2Z}6ZZP-&!$B&HERGt<^PFO#=Kn@TV zvLZbUod7M5OjFsasqCO!lh5Op5*?;1IycZbP)1vbJ0(D$VS&xt(>S7O&(59yS-1gS zWnb7}c6ho#I(`k~?tev=0M2Ouvmzd$WM>5L2j6Jf$a8_`gLe|b^TV+H11TM{F?6vN zPph*BupA#lMpLmL!kK>)zmSi+&z`}^xi&m5Sbf~Ubz($dIYJpW;4vNRQ*;Zah(M{4 z9>5Ks*Qg_5e*rHd+)5D8F!0%kHoR^Xj1EjR^V|Q7d(1D_^hY@LyFq{tWn}_@vSrG20YDV{>|E^_+iIjf~S{eqm=}di8r1PiN5XoC=XEc~4n5(HSe{SI%tM$C%7TS4Eehtyp zeDT_(^{@p^v}EdZ8KSF``lAZgJFVvw-QT9_$`?@46Ef?trg^6K6+DsX<8%|xwIAAG zDwCmC*JlUw|YH$OT1LLq35GGM)ZI$UvEsaxN)dDqss?H+UkmpkoJ5i z9~yCUD>f#&>!Ex|gsrXEi0CaP^6?O~wPK^8w(OM6AxRsZKfT710i=5zkuWOQHRe?*zJ>bgS@w ze*+bP$Q0EOrB@A``+vglSgZ3d|z^ z2-1lbA%`NLxxx+KlOXrc*0ntg9np1Sqa8q`JJ+HN9Us z>|U(my!fYXh*JG7;e-n{A0Wan9DG4`XE7I|h!4fpk6EP927yF}rknEq$ODkhs0W?^ z_eyULClFXtznn_+UgZ^$d+@`;RS;QnByHo??Wxj*QwWnMZ5CfC)O`HKMpv4$72d*| zoc_aksHHTlsz6jPZq)h$t#XtM0@blTT|jsbT`=`03lyP@ciGU&%&`LxqV*{Lc;zo5 zrU}$?8Uchm!_5>X8l52Gv&8tnBNFf5qDKQ;aNy`gBM5uKF-Z6?{#67=m!tHQ$(@eC z2u9GydL_*+9n21tI_4Lup@HHr#M3fbwecB*WSy3)E_HTNwf)_>+6uuiLsqw>!<0G9 zJ};ikK)13-IPlQ~G#M_mlTWSVIh;O()pRw}fwHnD0r4$RzGmkK&ZC5LBJNn_cmlJ5 z)&R$Mpof=ajGn)|xU`PnpW!!=#tWGvIBJ#rNMFX`eteV_lH-N!$ql?PR9WZ3@{ODK zoCqIAupXpj3=1?|!x3PPBQ7FmUdc<%4C>#WJ$w7^@+BPJ#Y2#ulESG4aTGIhY{REE#gyFv^hlE@cV_? zmN~4!IUc3ot)l#yKu7hk)x+3#@vE$@(A zoIEaGROOc!ElNpauw!sAOA|kc(q@aNSZ;H9;?EzD_56mrsIbs}Zb_*>VBTJ2&kpP~ zV-_=*Km9wbqO5XXW5p5Xe#N;cplQeFZ>%Km3aRtXrgZ|7{1<%hvuCHV3e$xZ^!sWN zMPM^9D*o3^3*GWZ^y&ZoL@vA}7v@fJW5FUH&l7PQ>*+-(O~fXYS9t39mw3@;GNh=K zTd)P+!uS2#-toWfzJfo2{dMyO6mW3`b15b4LCwH-SQ`5Gh)$630i>aUe#1X#I%Wv} z#)AcaBV+xy-GkljG_eUj#p1;e66gPqVM-p;`2d^>oVf=_#5y-i3F0ddJ&5zP3!1;lsl(|3t_L3?8B ze_JPbT;s0kzhyH@lGGGWeu=biaC#r4HGu}LCn}^BCdz-9yDsxV)_A@*na7r}(J3U< z6=u0ModihvtT`Gelo*Ucf@`olartcHJc$?dz^6g$B+a1}3S}DNCs}z8H15&JG?Ayx zD{e{L5Y0{$64P;4-q%T9C2hpRU6{K_g`tyL!SNusV<@B~EnUI_@rfk%Zh-4?0ij+>aCw>5T#JQ{`l2K|&&LJ+$8_k4v3a*>E z-WM*>I_`sax(5|zRrXhAR%S;HW&)g}{ttF00f?qr|9<(xU1Ul%$lXc=9SO9crTV zr?lk9l=_%bA5-e{G)jF+idgb-Fa4qw{W=c)B9-!ZUBzOQR)p6sKGA)=szoL>i%V)2 zmFPZYdGScaqLGTlBD(Uc6@^qS2B}&EqHRj$#U7Q4JSr7;R8yhiA`Y$M4XvULJ{Feo zzlv)ria`KWr>B0_PL#j6IyDljP#d8+0?N}spKBj9pILSK?s08{<`b*Ul)bH8(6(yX z?Ap891lbg>Sc6b}u3TPoAgeVnH3r%>2A|bmZr$R^k|KoS;sbfnK?X`lT4bP9Tp&EC zZ>X4{t0IC*#RH1@)jE0Ad`SF+t%WUWy~iam?Wpp zwGHRZA4#}U@&W`mCyBJ;x{=Jg#m*Y3N2AYetzkkjwC!6*+aBb`;VFGuw#mqP9fM>p zz`2RvOP^GD3+;y!O$% zQwq7}6b9Q!g3e0!iK5yF&Cx>uwrCPYYJo6kDbj?%b4a%zZXAP5l*(GeyWX$hk6X?+ zH;iC&f-4?j`<#vjx(#+82&+0R%v;wUYxeE}CDb0?Pi&)W>zjNZpKFhD>>IJIg0gBq zISp9j>c!@C>l4>5JU!Bf&y7w*v>WvoVw1ll7sLqm;5`k3|68W@*&$v%K3yS}l& ztU>(^W>#Xf#HUVbsK0*M(c~6#f1~E?hv2S*IOCAejE%z#iCH67l*rB+P};jid$*F_ zbw`Ih8k`j_g1~_+kTX;X4X3QljMUC%{7Ep5fykSWZD;TGp(32K4|MRIRi9TqS6G=N9 zZNs0PMA=g@M3FQ}L=Dl5W=i&TPwf7counmbSBcKPyF#eBnxJK6L8{`-op|NUVHy+& z8xvFN3ahlMR}?wdR-1yC2Vx{r>jqpJlDTyIr>YxlJ8cfKc1T0<0i^A=`9O*h2*t+` zwAO_1I_LXwBE4+ZgSmSl-a_ZZLL_4jY{iNnfL2w%hV?;mnd{9LQ3;~pAX#nX2!&KQ zKc0*?q!*X1mE6UFQlOzoC-Ul07{3tvqv}|NoUGFQe+^-ib`_+Ref^_3tYRHYh%+o@ zhVVO`HN){}{Hqg`e1QoM!=l8lkF zTP0J5i}AI^1BEhobMf%&2Sdi{@vt*wLXLT%703Gk5B@sxg%M>BRi5jRbw}(@z zwzJ&9M3u;-vvKZDuH&djG9e79H~ti-fA;Dn@`Cm3O|rrruhN3JtZ1<8YygFDPq5n) zjejRuN#oPf?5Ny`%8$VHqKb=+E)kU0m-+#xviD$0G% zBr>9w1Oehqe3&T|C|NMX>Ue z^2X+f%JW1fv0dY?s>7!v_?PeC=&ntCd**}_XRXq4fuO<;9Tn{CqAD5a zpeKN1jUCOPc=NQjc=q7B@deN)5kY2 zq3f5BRud=hpv!$`8fj@_S|qJ0&WULprHQ^tYbC{)Y6H{2g2Am2y>L`zhk`wKQDfJ1 zOc?*@BbelaCzO2f{zG~4!L4JXr&e;lPhvlEL_w?|uaxr1Y$2?jx)20taPizh=B2e^ z@jgr8sQZ!TRY>=qJ(!f*E0oQZk@u(~7E-6?u#7un+-s;-!bpdNI-E(R}*2l zU@+e+hk&(Rx;hSB>o8LSLsJ0joH}zj%@5xdczZ1=Wo`Dh8dOXPQh0taa#T#a2=iDC z_E?Y#&wxp93>o{lK!GOEmqgCt2DL!CqZ`41qAH5D5cWjTnt+`LvwA_ZFrGp)FNa}8 zyoKaEQpo=!;teCWk|Tipy<>Va+1yFmpwN8uk%brCSEMK+x5t`WxS~)IF8r7)ssOB& zBT_B6h64m=2P7nIi{Wz%Rzox~75iKnX4ebQsju)Z3nZhM2)tPMQw@p2#eD7uh1r~W z#$M~h58#e?W-XD7H2w=mhg)zHC^XMJU2q+&DPK5b;J6Q-a#w{}@`pMJUoi>6V0`0v zXo3>I)nxdtU^x*~>9BUNy}5U|xpQ>1xx0UGC?bp^aL}*q5JMmx?Em!qaBuhM=%=H@ z{e$hD=g;>`7+F)6LUmy3JX4Y@;)+U1w(RLY7hx0}X zce=r&JWDcyk(9n6N6rZIrGt5iG0U`QH5}}0ik>JX%9@aDI3ctAV0Y7En70|GX@;r= zG1c-kP@$-)yww7Y$|z5O%#v-4kh#icHX7zjR(K|X+h zUv!#K1s3UgjD0WRH%nd`Qah@3$!i^k@ykPMK^$act_96Wb#a#yMyxoxGVs<>U}g06 zIT|xd%mqm)&Qr@l3qz^a2F}cZiS4Z)&q3d13xN>iKb^bT<^F1BdtV>~Ch`+K(wE5l zKSPmVdqxSSO8s{BSLPRXfdO@$e1SLe4~g$ZuPGp?OnfRahBduA*|3Xl6>QMyeWgwu zdk^u1(fn{{Gx8$pPww^9@tNtp|B$%MSwa)FrJJ@4o95|aA`>oqVNON?1F`bG8gBmM zV(H!GMuO)!5pE@uunB)-!8U&I$@vCPgv3s1Jl4cJdif}2Hu%ie7R7BOdt3VMW82Em z9yQO>8*4iLt1XLJdll_W zzKUz+W5%$o7&1A#9^0%|j-41+hsiK^!?8m^2}{dZRk6CMNsKv@prAewCiKTe$9b1X zl<|p@eWz6IAGzqX#|850xq2 zW)48PgrB&sntl{+K^)_FHWR$zLx+)1EmEeL`kJH*fYyjPH9${t_iA|aj|=o<&w!q^0eV8AS5P#6=GxxG!BB61Iste<_ZfS>TX z)i(G^*^nC$6n=U#ASiWUCX%98NWiexe*JKEx=v9i3VaUWmG_D+8*Q#pQfYVxfo z0Z1wNF#sue6rM=UdEpL9bB}8PQu1SB08$JZAJgtr;1qNL{hoepkW(HHa!T1buK`gZLu^1)|+67rQoAi;i1T9kXSx24+j{UX6{yA96A`4aEWJHpbM^Bz zL^jYXWUxi!Cw>D1cxg8`a+o7n2ZD$3&Uk7UtXRpbj1xn3AWn9a5l&8__pSj>T9=O6 z4kKLsS6W(^Vc<;+yorG~5s^-QuS;cF1{}0pR!jWMe}@wY$#Skzrb~S~)F!D6kUqG9 zH!<)g2HwQLn`q5i!ik6G_K*+-VO!EEtnOUoly2<39fq*2np$V4Dc}gB3%>C>@2lC>tki=1#yL7lG=BMiU(!&e`+P?gItxOg7mt6 zQlpS2L_WEjgd0jyQc7(xc^LodpD<&Vv(=YYqDXEq$R>{y*`)e1Yw$}9eo2uQR>v>7 zi}i7gS%y1r}Ll}^fx*#RW=0sft1uJS%ubgjlIAS9y7G;`cVU;M4w%GeIz$Em?0F#h$ z$g86PCW&p(0F$suU>n0NQX+Xgcf&27S3w!#<-PL$d|)pi&l}oL^3}>_>m=hY785yc zE=v6%iE35d`NFfRnpW0AhM{upSdyn-o`bl%iweg?wPSq%CfRQtm?U4Tqz_E8-vKa5 zVIKyV!~m1@8JI+xsoNY12?@JcIP9W@G-9`oHNsbb((QYSBtgPLM5ql58g)X{G;RQm zHhdKM)?^XFvs)3KA#&gZFdI53-^&eQyC8;}*x8ig9WYo01<(iYo#4*J+beiD5C~3F zBBod?#Ls^G{)`rMp$kP#?d6)XaSpi^`0!}xcl6}vB=OS1sX(H3_BY83!T@y^4OQX7 zvAD7oh84dL>60C779lw>=nbwX7(7vHhnv>xhpWJyGNXWn=sB(kQB#8((tq5L%(ma4 zgYctm&_RgzdV$Yk8Hax_ODJ2%&#jFPQs^60hXUEJ0R@t~SHm@bTu>kf1`4DNC=mS1 zySFcoXLfM+G_XK;O==qpgdbo72EtE01`LE(B?AUxz(5KEvT9|2`Eoz*wzc(5wCsNF z)+nh6)(w&Y?Ia>tIA}aUwsR@1i)Vl3M{JO+0fJeb%VLOA9jK6J)3ssh6aDU7ZQ=L@ z1c#-ysrhKA0RxGL!GM8Cl$2_nAZ(&?0)y0(1z;%pEpfC`y^K!gt_|6k&5J{IyW zCEE?y)UdyvP1}QB`RIENlk}~Qx^fRU?$j1bnCoLeN(@K|(V{$}0P;k};EJ$-3g1h$ z5K`{a<+(2K!7bQJY4%;}G$>@=(T&P4taHKg)D71^4f%}0&!2{Deq~8gc-3+nkmc6L zei-CxNK+K&c7&@wx6)U(#ZF@3)-T^3Z{km#59enHtRChMk56^u=R9zrer$2E9)%_Z z=uglJbLLap0tb18?oA&@c<&HRgiL8Ga|bSEEk*>=oT*72ZKD6}B9@5E>ewYYpKBQi zCK^w&L>!Zhlm^X2VKUGLUBNfys_T1%%+X^s6a8h^pqLmGljc!OY@~;sp_iaA?>JU{ z0$lE-3rYElN)Yx#TiN_I9T6yMFZ8C3z>wAeacu7l$uHK_OBF1QTuJ zGB_r+aZI$wocDeVib?rIq#8PxgyokTFMmaLvpOfQx(Q!}3-y3Kyeb|+NNJ6alZ!Xy z+^JW2WS_~vX(EMA&~$lvZS{O1nFJX>V3;{w8*WH52#|A-);sa?(iAn+h+1}|!7|DG z7%Y<>V3{1Wj%AXswbHNgJm>(+q_7WzWn!>Q`ix~FPc+W+AG@Ix&!hm#B;MXbHx`b< z_YQj{k41vYd?a`zX>`Sak@ORcBzdnrfh1w%SpqN#H9Nsqg@wMvVo^sW zvZ8hS!yM)T=hBUxgWc`jgVFZ$(eA@Od3Pv%&>e(S=iA*PzflJ5^-vE~IV{HISS^+FMXd1Aj*a4`HSaMJUu_Sk| zh6Db%5K9gXVo4i_B`5y9gCKfdfyLlC|0!UW@VeACW=VF44QdHL{TS2|UYQJPi9sz% zehg}fK`qfdL$MSOQ7k<~_yLE{kgJW)f;VLEHmD`+fEd&ggIZ!xOCC3BNx9!|a7zqs z$@R?t3fo85bCJS}_O^+x7~B$rTViladVyO)=XTWsm|TR2HW1%0f{)Xbv<)be!|^Q~ ziI$Z3qvRP#T$z*<06`)zMAsnU4lX;CC7N9$jtgiHt?Pr=(0?(6LGhS5D6D-CKIZVogtd&nLt%Q6HzZu2hSw;^ajqvz?nQj zI1^p3ap?#gRSKy)7m}tPC8L`JT>31v0XL~K#_AUvaFe#dO_)`^GPa4pGw2-JMB_P@ zhisA&(g2&Z25eGyk$$?^Cbbq|19M_vPKp$6scs41AJ36kKWe z6B@0FXG$puN^boshYZM1!>bB|l6~oq9S0@vQ5hJNc41Jo&C8&m)I~w5FryW?Nd^z4 zX*`tvh1(4rih)Bha42u$d}B0Yy68}lB=B_=(h?q~SAZPY&?gpDuB=O{Kgy{GcXv@) zov5;|4{#`lt;3<@%eeF_NDn)JLn-XTz@b#VLzE_6*R`9rZQHhO-)Y;nZL`w0ZQE8= z8kM$HdGdL`aT@;^(TGMwbRuHRz1N!aT3B4E0>g!=W=x#mk;$GTY%;2`k;%GKphZ#x zO3vtYt{!Y=lI5fwnHSs}^8x-$;CVBbWb zR#d;LS-W&B!zIs1UvNm1)&9+0UGq3!DP!*GWj*|MsOdBmK)Cckwvp%A5sGGsr`yB8`$3$Kq#@Un2iy!(SL1?IEZ~LX7YKHn^}JAedk?j%_-Ej8VKg( z)-5XsV%p;mr~U)_;B#D0hAq~??Y>9Wthdar;HU9z)L?xt&{Hbow#St7u{`bD8OmEM zO2cRf2-!UyllBpE2FHbugI;HVgVC0{KooE4?h&5Vu25#d%K;C{Fz^y03p|l=A2BkH z#Zow4yShMugHC{&$%LJF6?u?iHYNL6r3TJ2N1$8P?nlmOcyKi5IB@X9ScuX`3H(*GE*Bi-d8n#I$2DKJB8m>5Hq zdkP7A$gDa^Xypb~VC?i+!HBdAO`1)DK~10K=@t#!Qi)uoa_gQGxnqCs53F0P=f zTZ~lEwDyqNDLvoTbd=9)QVa}^I0BX2U&f)%MdRU#fSwXdSk(u}H@6+2ewk8hk`fx^ z;Qm4eWnF^(mGn_vz#EEO@@ka5M}j@=&C@}08G&1BaG0+_ zO~cZKXv5U!9XutE9xjf5r>5jl%Ml}`W2hRzUu1dBoBFVG#f-luYBvkFiIjMKWQ>*Y zWIrz+D2cZgyDxjEJ8+2iK;3qyD*0avW;+pg?V&P`i?Fpt!ohAq9XG3OMRwntmoQOx zL?HTE@mpqgQ!m)I!y5)W^v|DtP@VoD(XZQH(DL_0m^8glEf;vAUduKg%@X-$|r+{%VT0e%--MGfuR=7IDXLu8r=o~(w2 zGClmXY5zx})O%o-ato77nu3DD6Uo~c!Tf6KJnvg11Ncd1%*Nf4-bIZBENe*iDlr7! z7=o(qCR?u94DvUKn83cl?M~Iw(~|U)I^5D4Xk)n+X;O~O3a2WtwhoPgnrH9DsU9cl zFv?cZR2d@~H@`}hx*GHCp$0P^Lu=+K7^f*SI|bTNx^7oz+7ZT#%VYH@GloH@8vJ$L z;F%LLiO56U-6HhF4uu8Br~`FaA`T))LJqVp;ZgE=PIi#k=?!fS7!C$erLTcQ6u34S zBxh)2br>lI;W?hcN%BY?R;5n3YHK10O|$4){@FFOzM#T7mMyoC%qO?5rj;jNf?ND3dkr)S1$HzO**}@^%S+84WN)NYx;ZQ*mi73D-E-?|0GMX#B zRocopq!nY|D>W5=g0Xh-_7@8k8q`;%=J%1@jGe#xB^5ld1y44f>b{PZ_1p9qmWq;{ zE*#D-1}{NMaZ2wo4#M=ko+|h+mwpQjdvCH`m_b;MA?c?Ft8HiO``$t=kUJ2Eq1(Z1 zsx7oY-LxU8tD_DpQwWcdPmmIGf`ryU(04I!k=TlkyKrtD>?FNQ^=TkjAY6*O#{5=P zQktf?0vlgN(igxUnl4_0W_%zcd8d<*#7EM{cs7D!gx@#ohi07ia%qx-A6FTZmGd52 z)(=+1r0{iXl*K!Q(Ii6)JYzhhm!%7Nx>@T4MOEziM9Px!1;`{tL6IiwJLFKMwhts* zkjzDbVOx-0;zDn-^wyeX>kw3{$6Ei+1Gufq3-gqjGM{lQ*@n?=O3d1*(V!5`PKh7ImuP4spjtZHf9EIdeVZ zHLgdHt&k7jZ5^)h?XU6h?XIs0@uE8dBMExiL}QhoKY#M9AGel1g#R8sPaRKAZ!MK% zj!mf~8?EH~0wFLRFXKc7&8f+DEjDQWBf`^{aK#Z%W z*QBhsBxWZd4X-XPnpGi`WvPkC`jhF9hjS5OUXjjis4(7&%qwxBq7lKHZ^A)3E*-?d)M zlohhnLnwb>Qb8h_y^orOaMd#oS2_JWA^<%WVz4u@qDYht5cO*}NnZA}^v~u1F zgsg9zCrrMNS9QX3MTmcq;betj7ti;o>Ey|<MOCCl9^`upfI_17WyM8F8#+{9i|6@3RdlEbP(hE z3%kkIdA;!4v50vaJ&v7nKb34VD9~n0Vi};hf@mtP+6b9tmrGeTRBzrPpjkRZcu@9O zyh2IcL;CwqWNoZRc5C|Q!DjlRnoe1F3w}`OJ4H(y4Ms|Kh{l}t@9J&t2g7y4`7J@% zm9}*=K5+O3#L|vHa{jXR^gjjKWMolH>2YP&Kw>8Q%XcmQYF=SkjDIyK-{G6^T$ByY zsu!z7rX_IGYx+ymPOW)LG`;ewxh#tQ)HG`b7cjkgQd$c)1lDQjodax!Yyu%p5-`xB z2XGHl`4MuMkE90z>~4(sgqvbRG=JUk37jTk{Ie3P=`jC5?uwT6h^g^AJ~h~{f!39` zM)Ur#beo|l)#JBvuVmTUWEFdN4cd>$pqC2^OmN;1mIlH{8c!E1fYBzNS*{@hAYtjC zkTYOuzeid&YP3;7;<3FMB;ytqvRe(Ca6f28+9na;c8>kS5q>L}0VFB>(7{JIH zwv&bmZe}5BoAPA(pZB+zJyrFSrnozvwLCdb_T_Kq0(IL3-1n6iwJQIV!|d=EP;QT# zE~XG*nJ`s5_cMuWZK+_o&VgkpzY|?{=?6;(Qq2D_AS@}+c~sA^E!ml2nzcr=xG&!zQ>VARn7G| zgMQ_6*Z)nw#p^@4HlWT9LnoqH29MP&<8J?iFkmz5yOtqbFS*!JVn?^bO{6TdidDx) zm|6Ol2zwq;zQDqO!Y;iGoU!BG=xCtNeYO7Jng1bjtn(wo>M57L8J}SD2SCrXYIa`R z$?2H8Ylv=pm2VqvuVTlxmf4`4)udg}qW|fwlc%LmL~6WC!h>dR_1L9+sk)LYV9gP) zS`H_A!kMPRxpdLdV77iqIQLMi7{*uwESiHtUqyBK>*}j1Mxgxx;{vRHzRo76`!qL5 zovZc$(LEjauR)L~=@;s*SuTE*0ERD>H$6<}R&?eTME1Pl1GcRI_-A!2I>!2mfSGOI zNv+Al@$}WxzCfNw;H<_*#Nc1n4d338zpB+LD2b0cB4n6U$6>|RfX%mOUon$x^N*=w8ZXLA@&%|@H5uXAC!j35-vL~7E! zSR{cQJ)m)muUj@ws8E@(95#1lnJpH}I)$y&;oy(L^zANYeFihsRr) zuSC}&z`s>Ne$#qYLNwUhd9pY6G9neAd)YCSqub3}2?dJq9Lu(n)1p62BLdUmfg5xa zX*!aec9g?tzVt8;bln5`dDOQba5UXIeb~3I$HM?GDT7ruXw}!fs0CqIM25Yt2}*r8oT8zdfN$?UQrO69^*CP?RE_VU4SVTQj##f0*pJgJLI z&`zWqn3bU8EPx8pKz1Pt=l*wF4>?D$Qu$sRI;Yvd*#;q~!a4!hw$^LF9*dQ~{MfPt z80N7RJ)>_xSvE*0i_W|qV)+qu4C}^Q7wM$4d=j#0CRG?oWqP1RSXV!cyEf_+5KNhg z5fFGb5ZcT>w15JaaA`2ls;@|DmVyGwc+z~4IRj^*QX!Ylto26GC0Y9uNmB@wyJez{ z%crt_Vy$LuEg-TM5Xvw0V3(%i|5ODnE309Tk2~7oqY~>+16Aj)E9;HDq3?MGR-Caj zl3x^_K|9ZVU3kB(k*OLn9y$x zL@$O-Gur__oMc#P(1zp(Qp5a8x3-u6Z*>V+$Qx`HIe9E`Y!N0|oLUPIJm%+iip zt-M)ARU3Se2DGvQUbSpX-GB_f!2&*N>vrUs0)Zy5o&@d4xqyxlP}wz7suiklu$Clw zb~!~t&_i2+@k}-Dz4EYt#!QGi;x}{UP+{{cs^_j_>TKMM3B2?VA3#kC0UL#yie}=y z?<)i{kj#Ne!tZGAk#!;IqBOX@(4-vUD4D%8VA4MJy*1=*+r79<4piP{u$NyIOkLZM z(4=1X1v9Y?pVHJ5_V%EA$83G9c2aU819j}LBN0UZ2oju4a3`6ts$+OQr#sp5vfvN+(|4q=A%+cEfa+A6Avop9Nws! z;?w)QRvVs=<$DZQl%#rQs8ewJRhr8F=Kii2Bd;;fa#7ha%_Q!K*_?%I)MJmO2GZut z#^P_~depL0@@}*ia#!M2a90~s#8PVo__W=8jsEj5Ii)G7$4e%qPP}eXcTF36%SALF z8*qS4fP3<>_SBov{n+)#xDSQE_LPOAhQO{h-C08B(rT_R=;xp3mfH4Gt*gv#*-tC} zn>isRPGI3)?cbV8x@`I%9ql`zEP2b14ae4bB=ixL_tkQ3h3ZHfOoQP(tz&nRv|yBA zq>|2ZSR~_T5pFgSP);lG4!LJ#Zs%fcys!b`yfOEn2W(Pw97$HMZ{rjsYgC1wj^EFi zCk#H|RY*9U$Z`j$9pOz@hLv@AkR}=L%{~@gMqzzVdyI6CmMNKpJn6W?^>f?1|C+$* zr@i=BVCYsm`CL!(OzkW9r=@JT(|I2T3WCn4u2RD?ZFAhuD16W|;@1eA7a>+=?xssL ztGrjvi_^_88vijEoNA4ccn@R=9`?ks6O$Xj#?Y6{e%VVf@?f^(VS=(6(Sc zj6l`CTcb6V7N=sAvWyhkJH{nJVpe-*1{e)`Or*mBOQC`h1+ltZE_lg$GTgtmzTia{ zLM`RYxnCC9aj~mMs~(n*aj}=g=(+L46Q1he6;K zyVI(2xZ{q#~uWZA0|LB1iTQ z-oXjn8LD0XpbFq~NIw7WcA#En8O+1=N=!fE!0hNa#e|!Md@}BDR$S06n}25sPXk?!GJcJ6Rl~7C9i|M48CARwwCj= zKp4~GqkuM+RoecXnW#Y+*DAxaAlXbE8UYo-38e;Uvz{uo1~!}OtnXej@d*2po*_0B0tuJ*p~h26g*qWk zGv$#IkNrd^Y)c%qCr8vwqMiMO*tC~DVpwEiVi*}1(lQL5rreQ(l!wXSnj6SM3t_6q>v? zs)7`n1))V~GQU>{N<^$uSUJl0pI^x%$M<@aM1$|;RXKxClE>!|B-WeAsc%V)C-SEx zj7}bg!)TCz3R3WEN6!vpb9bk{Iyf%hB&~QgNAKbq%eWyc5WB;C08JLZ@tB~SW&yg= z4mlKWycC8y%t@)3f9(Kjm8W>A?0K~$TrD@7_vU3T&##qOJWXLc7q(!`q{agW@SFNh zy!%=`;iY+h&Mhh$_ga8K)nF>6dBjie#crNx5!=0`MMQai3~k=SZO*-w+b)3Z{=i^R zp(hP6Ba;2EM3N-qQU4eL+fKj>+clMPPdrG1m-dP| z5e{ta+2Z^BlEsx|7h21Xsb~ zwRsi}RAi8${*ljRa|TqUFYsVfh#DQ3+*5aibx_lbR$0Ne%q_Gc%QLjT*MaN}igR=> zP=o`th|DrS<=l7n*Dq_^0&{&7uW}gXAnoeh8J3Phx>b693MC1%4{_isBbxBdzoY9#YHD6im#!X;Z4T*TaQ0+Sj??fg_;~}x>ehgP`(=+7E>S6f{ly@nxCd^y(&_&8;TZni{O~1&n z0XUVUiX3lH9EpkQ$XH}O>3lM;SYE;M*C0~JQB!q2BC}aQRKKy?!tkF|4>_e zk~(h{ns|&klO#f7OI~NUs4xNM!4YpH2iQx^GpEosYrz;g!q{S&CwzNDo_L-_`xod7j4ew8NWfnr1~pge zvUH&vf|;y^DWv!ns!R?zI}>~GS7IW`60}gvP-JDX0?h%9^aiTr8`x7!)TY$5V!IhH z>sBw^Qd_pzP=oX@zoY`4!1$+5jiEw?2fZewDMX$nQUkzFX8WYE6h?wQJ!y_5%d z0_aJ^z)Z0mA)2+7CPW}g!l1zNYVaaP_A zADqXy9-3B(T`D}I;cY4$rr~YN4qR0qmaVw(Zsm@^zrijcN7Js0@yjinX@49!)rp1K zw&KKDRn{z+w&KvW_^nI}_H2Xfl^6&_Zp97*#W=U(qU&^=T*5n&zL-biP!1%7BN=!H zu?{5I(mtMVQt zD1HE1*tpTJ|EeuhfWq4JKBHf(S*@dSBy-zSa3TC*YAkrPyrr$#ly}U8y=M>B=yP`p z!r+=Ik}{aji!V9lVhro!Jn_x+%l9)Lm3oie@+R#FtiHa0q3OU&B~lqxtsFyzc$iwImp`1 zc5sk6o1Wkzai;*x1e-a%&TT9D{Mf@qxnkoQX>`?lS_I$@J=a+khk27vY5F z8lJLB?t=kS6Cu-0{<~!mE)2N=yo#g&!4$=um!9PTQnJcAfNU5i#<@<$=@@1E+!5@e zEFGLeu<$qCpuQ4ZUBUS*(wP%hRdOJp5J)wlrD7?-DkZ>8^b3GluAlHIn|WUiKg9U7 zG|ANtQ?8bqdk>!S#!b$U(c_FaPZI6bD@1)GY#XhbDlyGII8P>%YIux?y?Q#34$7|7 zLWRRHBBL9*-tan1X2^vMPidTy6NyeCJ)dw8rQ&7ZGKY^FFYd2!p{B&26!s&U_(HOa zB!P6G)6aC2P@e@ia51xU9SM}}(y<4F&+gU58|?LkrzW6~jUbLlEeig$ zKYord+0cF?6=b+~-B2`%zBxsc-i#p%ALe zkpf{Xwn+UVVX9Jki)rA5QZ6J&Q=Ckqw)ykbpxF_u=JI-;dHCE?`fAjM zcO)qNMDh>sp9sl6AGi4@k`cU;5t7(O%^&^3dox4=M?Fu6&=;i{$P&q8U_rNj5^Vmn%W(6WcY1Xo4)3 zQF@^Ci&QOOe-}${F^~?!;mfb&b4)y65Cei)U&w?gJWH+NO^Zxx^1-%3L9)bR5b1Ag zk`8gZw||+C1}m6-Gp1|j{_ zka_UD^GlyTicQD-om;;*)NhSFe;k7>u=>u5?)!g!I-kS&_({Cd5lOg`?#^CCC(`C%f$+(>*)T%o>a26hW3^5x3I6LExJvV_!N+OReI*|j|i!1)K!n-vb;_XDK$xK>PMNsnBIlZUngMdl zJ+G|(IZqaNWKQOkzcU2v!nkc&Gx90wX|u50Z@G^~+tym!*2>uG;lthy&elNwbusy{R`m98IJwT#No3W(l5mHILZ976SV z(wq>ztV^|yyjx>xELMw^M{D9tE*T5-;P74s8UOj#btFYe6Z$CFbbgh=)R$@p?bIV+ zC5lLNtuaW~lPNm2mvoxY7*K1)F|-zCsWzQU)XbUF`K7^p)M>MJ*@>w8^-^ zRIN= zAqp$9B1v2?+Z6Gn9IOP2kq;b~WJ=B(oNURo{d(^l4IP`(q&xy@mc}}#o{LMeEy_Q$ zRS5O*U-U*T;)K~Es~sy^BHo-^6>1e-fBXxr1%lc|$Or8)!>Yn^e~AE8D}GOl0A@|) z?4IvaUvbf?QSuzLOJzPrcT011r2Rm&T0|~(TIo~6C1UjDrL72MWSrh^nrLJUgw*#x zfbjL?!LApCR6K&vD#yu7xwYiz$*}*F&$jgb(WEaKD={dhac)-tm|mOXBVHx}#IG}} zCM2p!pcg-(wPtQ@0)Wl?e)T_4k?k#0#T~I%w=PMg0SBNwB_*WBXOCOh{GAk(X5JH6 zC-?EwN30tX!kfM-)9fq)WdKuc(zDghn{9=*7Km`0_;@xu2cUwY zn>#Xof;FS@obbEoM?@`P7u7;kI}UrmgA}G}J&@G)zl9L_SWbb{10>I={^{ieY)X^+ zvxJ*eMVLf4R+7<5CYql9=`M8m7H}Cp4fTB|{#9H1U7?+uucW@vE>Lu~GWzsGprK~^ zjH;r-q8%xy`0>#xdW-xW)ujT)KTQd^XY}m^3!^QNJG0Sb21GxM8=IamL%62bC(xZV zg|<`0Z5|pVSlq&Xx+t~FB^3``3rk}cN?^p2FksL8EKG8ZzsK`(MIvDWTv1G{Q5hDT zqci-|im4f3MJg|e0z=(fK`{Ads`yW_GZl=)s{!!nxsVg{E{zp@s(g!!nHgI4c(RAolYFg5FB`rvFCd)$K;Wq-Vm%8*}4@IiG7MaUS)%JRvRe66<7}b{!%@~tt?t3D&$&a}ued(o`4>b*j50&YMgaAe z833OvPhp(O%9vS_ia_{Cj(Gky9!-h^6MV{2yMHA}cGF6R*q)fC60OLH<@8BGj4KDg zQEuIVP@Zj@{_pmo+~}SER9!2zQDBRG!tLS^ikhaIo*iN}cRA4f7>`uqxGBVed!@-x zi}2IzA14Eo#b}!m@*knghJYZz){FhW=joRsrpJVS+a#NVWDeuywav5ngKpGi!<(<^ zwNHmuqbDmC)Y)#hc7;f{cIHgAVZSxL1~o{@I!FJ)0D(%U_(G5LLJXw6yW~-xRkc9C ziD!xGjOizs-MpnX)>Ia(DL9Z=EuhJ@RBah}+XcnXrYa7p)=Ox~jZERAp(JJ^@bBPc zvIuBb1Qq^uj}3l>D;1?tB z-;@M;Fy$Wai-nD6d7-XUS)x)na7!KHKEf5qgi3w%zMHih!tJbv7hKivT;Cs?&8M$6$dM)naUg{%TX zy#->$1u~@tN@Y!AYlJgmWx+Y;M=szL7j|@KAwaMYf3i@R#lagA?by+L5AMc&$}4u2 ztIu6xX!t4(5F1)455CYzgg>qFypq5-JJR=!xRzLD7DFXlaOS(=RQ7yMy21otMr}NB ziv1+*YA%(b=k>rCmZ2ZTj=lWG@Y!b9cQ&)v@YMSE8!2zI;w9i^#edoR*!y`Vx_$97 z)2~txd3We5MQ{<)C`wNU3VX4uRrF%YiEnxo6$lDep(=qH9yPUUHm?k%MUs{bLPS%+ zs+=|DA*7m;ac^|wVVsH`3Y;CVo@Bk8xAs?xTdz`NNJWEMmgWz2T9mj2$_fvTl?lm= ze3)y~`!)jKFI9g9m!zF{4Ay+GlT-^wGQtbtDD#@q=LK z$I->DA6byF_?gxQTW;2N5teS}q{^^PEc_k*QLv3mNn$ujOwrR&FIfiJ|Z}y1-j{ ztr1KuFgINGk>TpWj?}Pjs7ze5Q$EOcifrQ2R0CG5(~xeLmXH?y5?pRb$ro zYE(>3oWWZMthnXQtGO)K3Z(iZuMeSB8YDK)$HvP#MQ_B0q=;h@lp0n3Dmm4$-cMzS z&rJecCcl?K3L2J|xg<0^wIQP<6!2=?)bryM(H=Toi>J$8m?Pd>gMvQ5eihCQla?y=5T(YGKul0h z^LDOd-IQE+>4*3_*CV|Bw=PipNJ>(?#=W1En51N$*$H6Sn#4T76o4+0){oI9&6+`| zBTm!RQ<o>Dy^y zPS0~&yx$#^MT`q(Dt1pqc|a$8ddVeJ8hFM@NHl_EyA0fJ2K_q$49~fTx(}f?X87nk ze}()~^EwCO{BBcOy=g%R=xXAZ%L0 zA#0JTcRH(dTsGLg-r#nsSg!Xwa>u^t*Axe9X!VeJcD|X$oaS#@pLB2__2hMo9gYto zMglY@3pGetqw20BW?J!I%CMGHB-3o6G^`y{)&%RxV=bh505xVaYr_dxc0~lzVm({+ zlGi)$a)^V9!dvmN7F}@-p%9H_R}OEK5BSk~W$oJv2%!3~h03rA?$^_*1EdSPMj0ak zft^ZwL+vwPX?zXm=asIyu2oxWib;aa@9lnTTWItd74ylO22+Z)IR}ql9gOjid(|?W zygA_0xN>!BmTI-arDI&XLQ8nf{TG!PN~XH_UeJ{72zaU%VOaSYL!8w(9j5n6?5>?O zNJyP)4Q%g0aYgZ7Lk(+a7Z^VowkSh2A%FMw_KQp3Y(HL^L9C4_1!dqmRM4>@9$pD? z%&Cbeh`;r(CzC^;S}B?M;Q?PJdver?E!HA!r|l6ZHifdpce=swoUe{ z2_W0_LxkL-p7e)55xhdR$8=_WTMsHB>aLRpR@tqWq_lFWtH6iGzOWh(Xu=AiBt~B^ zTcGosW~}^L8Y_$=>UJBc4hSJ*A;Z;{^hy_gD^wM$6eTMZMSvls%2fFhS=y4Kvr4i^K2sHlwAzKO zSagY^-RyP(O9`W)bSG80v<6&HiRq+?S^lB2b0Jj2`ylApB4>|=7O)DM9m%6Q3TbQP zJiAK}7T`*QK&d(ncyg2Dr`r3pw#Rm3m|H*4`e)6!ezfvWI#QQT9EVwDqQ-8`Ve#<# zpJXWQo*w#1rLcf@a%GzP%eK-&bPs4AzOJ-a7uwsu>SSDizk2lp2|96@8d^oxd>!a- z4!ERt0A*Qt|37W(N$Nk@3!O0zUpew6oiA@V_@+M!z0=OlI&R}C5i1viYeRe2Z% z;g!pdG(w|fK)w?<-u9lbQM_xFsDnWPudGMlWYQjuzePlZHuw8oA8GJj*Ud;#goCix z>IIto*@Hu?q~6WA`mJGC+ps#I3qHjQ=wJf>siuZTT1Bb~F*VSEKOpj+1UNazBdZt<40?jrxL|jRG+g0+xb$=5ugC_AFh|G0=e3tsHSssQ*Qql(=CR6>{ zWH0VTpmw_{DN2nn&cq)kjS{A{?7 zBu6T=jxHI=>IhSPgB-|95zcZDdOnYXQyW43KooGL5YObBC(%4oWoCZtbijvlN~v59 zd=nVB0+e1&v#QP2I-*7S#beT-Ypsc9B;n5pg)+8YCnO+wZ>Ep%;M@-4>I-BoJ$2Bx z<~Vb>tCYvjBNsdTIJ*Qp^wicNHq;1*0QgVwJCvgDTix#4M@#qDtp8vy$wB zy-@!?)3(&!xtQpAL+lL&JKIuzFzOXqtD@TcgW&wJ7a3)ivOl{r5*hvsl;Q7_eBdu% z_eQ*b(!LY!8?Sl0_2gIkLOAU=cpJnz)=UuW^Z9VbJJ5g&5I^L_L~!cKZj?C^7Q)r& zxkgtOHwGr!3$Fk*=178zdDh^~+M3$~`h;^LnSxOOV8hmpx4kfpIapqLAC`csxhUir zY_6v&YgjI7?8STufe(s+cgW^Wf*8#8CT|?ZXl_sR{F0whgf6e}Bn&ZFjuOl+^o~Ew z#Gf!g-ED0Dg-(n>72;GeSjSgpq_d4ID%zmVLw5$uuSY=KIUK7%THJgS}hJCn;j0m$v1=i*4j&oq8N1de-g(}X>QULCx0)1Y> zJCRamw2eiT8iwLs03i;ei)Udw-c2kk)ub^AJi%UV8*X`G?8o(8i_L9mGqwGY2a7S( ztN%gzI^6t8^zTpb^3$nNtrMk{-!RG532__Fnc=XAsxIUr$t`wnn3zLv9t;RX05PVIHk|W4LcP7!aM)_YfSy3ghnn%yd2v;oLkEL_vge zt(g|hgU#E zH>&&Ue=E-|sGq1g6>AA;1&z5wG0<|8r16!jJ>E=Ph*lH{R*Pp0%vj{`0}d1|@o@C1 zelP7mU=IqZ+JZDJp#B(^Rx*QV+GMUus8MUvu4joBmzs8<#3W8fMG-3@4V#?Pnj(0D z-`0umPK9z_!7CJj*~QLTIMUkF^=ZnL!{gI}{yaS@5sL}W_sOBleKs?a92*z;A=gl? zEeXE8Iv$ehfi46|Ki>Wa|8ka(p6MfQ%$exZ;s`l!@*5{$%1lzvpcZ*W8gh2khC*yu zNt62Xv!`2=F*E=8er1f1~M*Z&Jk`k+pyBe+SEOdmD6`Aw< zmMv?S_)jS7x6(>$A4-0Qf|dm}x8^0sc5mDWgt-rv=lX7&rjP-Dr7gC7slqY;%Bi`U zgPoefka-^e>Mq&s3FT83u~mLNz3|xI$QhwI zqnllANA|g=M6K^$FP-$$oE&dP(|h4-viQ~4N4>w}&a!y_{s;)z-%|*#p_0&UWrAZn zvVYo)EZVH*TC~43X=gN8fizfi76+bNfiu*WwN{)D+3@M)*UOVti`*5dL#LK!$CVYZ z&lasby<@)*d^;VG4nD|E znxcK*^~qY#1@he$G&T?MgPm$zy$!*uo#vsY<%aI;%)&fa39(;@I-;a^&Q=8@s`tLttP-3bE7 z{NwN?vxPo!jMc{W=kb9I@$3XOQvxkG8;Esw6G5~%7eqm_x4i|2_jz1JgYOXD=OyK0+N|QDTT!fvd<^;7iCb3mn|?vTNRsre#$ypt^>vCc_!WZ;!G1@G9|f`tZ^S zhclL!pxnHIO<$eaBrl^9DKigBWkfe#4#d>zwZt!pYTSU~gS*i@h zyoLsH387I}i< zfmqd%4UTz&gC-b5n|N~X6b)TA>{}Qdhd$KW=x*-2N85!F{VvR*M{w4prX)|wA?^2Y zUN@s<@!CcOWtAxeIr<*GgND$C<~7!t8&Kpr6h2(SbKKTL`MG~}HmzadV32pdVFuQ?Q!QR18^h$t$2MHZ83>|h$E300 zjH5kBU)T?IKn>B88bQ1JT_lbSJbBspkU&{ELzZW+xYEkzk5I%3Tl8@riUUuZt_7i% z0n9!wI*$l&PhBDYHrQln8i-$H~6@5*`8>$h;ifDkBWkM)) zg3=fy&OzN?@8XWVv<$iff|6B|GTt7m^*y&Q-P%6y*4gwk)bti=Y+^q6ABG5DbY&={ z1YJ||1D$Lxrk%vd*gdP^TNg|L52ZI`0SOaaUpFjeAonn7Qi1<6W8`o%7#ojKr61y- zab9=GNBW%RFg@2;kB2gu%|#q9^yflyF7APUo;B}9w(fM`I< zQg^&tlKFsB!8AnF!KLrA{3ZZyfcwkj_JI(|D}T<9E92Xw;Z73obDS__=rsn4-q~i@ zcpbuGu;2(Xw(+5POr9zNc=vI9Z`|V8>k2xwv0EQZdq*PG%hGRG%91Xyf6#?H4>fik zlXaZVpY|xoe)Cc;M&F==-K}nMC$~?nS>V~&&(*>Hu1(hK_dxq7qjJcmj@7%6pgFg8 z=5d8-Mo}NqS*TTdD~4X6j)i)WWGl*O{Ys4}Z4W}BhNXHTWiNHIEjqy@%p)xxM$$1P z%gn66DRZrW4pc1aj`hYV%j5MB*p&|}J2c-o4Qh(_N%Q@5OsLOAiD=p*z{e3=DkCt8w1aghdCzKCz zMR$8q)XmqW6AMlkW1F&O5I^Se?x$gh(~{I+w9g`so~pF9Oti?0+%fB?Ak3x1y=zcu zTjzSKLC@HN0>{sYZufFH2h>ggMwOZU(v1{jE5{u%j{F9^5qvOsWZU#reHGgyGpHW1 z<_VN$n2!Y{;%(;NY=py*E6f>T-b)eV|QyIOM*d_s;p%qz7$H1yg z-L`f~r)f$T%r^K5>Wp0^BRX*SeCJ`z1XtIs$({8Q9-;demS3jmRv+gd_`fc~iMOL~ z(L%QR;Ifh%beO`phN_j)ZocwifA?oX%?I~Lg4uPm|mvaCr2RBUIf2ZU^J zEahWMOfLt3Y|>}sAvBu<2C^PuL#p4<_R=y!tE1M##}TXFMlyszt2$|xg{BL##t`62 z%%je+G;WoN{n*)^l)XFZ|fwv%@?hF)YJnj(Kk}uQj_+9r95Bfz zEx$^clY_@%uqyL|(9JA8z=4K!o~x!U40@6+r(&%y&B&RXqgcgoTU}wTCi9-zLarq9 zVqKvvCqLGJTTN~kZ_BF&rn4`Zb&oZd)UOX{MF+q=9WQ;+uGXsTB3}J}0D?e$zn6ml zP>h|hnpwYNu9~cOaF(2KdVrQ{sABMoh2N${JF?DBRiG=I8Tu5{p@&1y2-oh=(~cB} zzAaoA&JI@BoH^{%zUdSrTpKzi0tsB2K5@pqy86^tsN+k$tmdC)r)Lm#*Vsv?Ky)b(tcB40j0H(A5Kit z?#d4wl2lB#1mIuOCc@$Rr#O8b67Jxso!Rj7r(yd28Ke~s+Bl<0b8T-N>3Tkx+YzQB z+)7_s2E6T;?~XU|r_P7-Gt4*S!K19n;M~@KWYOG8n-ElPKr66;_(IAoN?S;-B@!g( z5C!)R@2>(l2%q6p#9}JY_8pS<{{F;Jh(o5W0H_I|yt=5RUjz?&CUP60*`+;9-C%9!g4Yg@E>Yr&0p|uJR=-&J z(jN`)?+E~=a%QA_S?OEl!OHFNRrjC0bFM$Wd;7A#UNtA(xbOb7+G&K|%v73WtQ!7r zxLdP#Sb@Dm<)qDeYpD8)-#{AYGDOu)>|BP7+NqwE6F%!mshRw_jDgfl2VI7Um5w-< z79Y?~8SQ)zqMJ9^xqwyDN_)C5s$-KYqVPtYdah0;#%f}$X^d}X2RcUsPc%lhdU43! zOgEL1IIE^|Y7459*4de}tDflDnMnGpdIv)3B!hM)lzw{XQr)$RyQz+6)XFKO%aT+t z3$b%4tEZVRS=8RY|LUoz4T$;#j`H$R-bUiD^&+D+W0tjoiM7IfH3M)p!x;^1UmI{q zHJwE*H%`;R(sX?)IVEcMnA7jVu`D^a?bo??xv(Zl+$4!FFG(E!UQU+ynde5XJ#+tr ztPlzw+;`J8)g7j~9)@>}mUPJV;;6u@~54b{Z;d2jItbpRdN#MSVy>t#_pxgmxcnpzwfBM93 zwvJI-7o;to^l-Q?WqD$n#_5pIFx~r|P1lAz{UQsKz>_FS1t^igCH+F{6B{;y888Fr ziTz-0eUnEoknu&%d}vWXPMd5_NA!x3>&-y+nELS!GZ#*e=We*gV?ihn=6mJy^8up8 zMeWCeDAdW&DLy7xoT5r$7rn0d5TY_VMO%iJ{V4N6)(~?~pFVH$Zr{P!;?c5aXI_Z8 z(%Ildst%x^Hk=LF`L{N(=kCXtwiC4-Gk5NwKl8x3cb%_-TPS!4RaIfU15{|ps3EQ2 zP2?PIP(^<~vmdT}|H}xJ6CLudh4YyktucB!Cs&+JcMfp7U`#@DD&26QsSWgl*mz+V zLiMKm|NPBkdiM#vqPUSSu7~fZPc6KN5UCakNnTiSC-KZxIC)bUF8tY|7@sDkctDl- z1=r9yGB+e4X&c48L{Krpg(s%QE|i-S$hrW%LS^g)lF|AAUM&2nhD70FPB;bSA|;w` zo%jLV5l>5>&t@Ph&LKwN0M|1c8i;)BGFUj4du>tAe=|39Fk#~_ zF*~%#=^X5AiiR_pveTi=w+?sjZd&i10E7LYF$9_7XR&_sZ`_G>JfFwUe*FFnj360o zQB!-lreJ&O-gs8vgPEe=!52V~4tRF4aQI!+&i*EOjo9(BD48CT#hN2>N)xy$M?QXtXbAK zOe)Ww;ow2KuDGEE5e3-D;Thz5F`GR+d$wUc_zTN}2mli0#-{?Mqe~VC{OOzq^3aD1 z8Y4ps8iHoS(?`5;!K2SYpKsjt!U!!eF>NqAOIz_SDu7GiI=Cl*nHaUfVX?rLUxU*LFDv<2`;UxJtmJ>#@!uh~mJ zOMD*Y7uHjR$z$>bM(!UHpPF97Oe;cPnS7slE_!zo^AO!Ch;h*SN}Y4|9VVI!DQQI|WAv{eW?OcxWGWZ4Vz0+MJqHsSC@9lj(T+U(djIZUSt#o`go)Vy!aD*fqTlh%wNXQZ zfBIKrBx*RGWc+?3D+M>P59p&7?!yKwT*9?I3mv{M%zA#hAiG1P z_&eL%+y6(T#3UboaOr%DwoWoqdyBg(CwO=L8?5}{rGN3oox`=;oFph+5`H{M)W7ytPiTKX+sx`X|VcY!^Dp7Y-wZg0GP4-PeWF3vlIK_}?(a8K0Z;eqJW zqhw&YPxm+8gOhm!@noTdN6$B2f(K>8_A&DfsMN*@aqVNFvfuA#zDMcHR|vrHjSb5` z%DsoDqF4X)d;^a#%v%3{d*8O)Hj*XyJ`wW|2z6~+?j9Y&t0`;qVeA5Obsh!-w zE)|Ai?6coAMdV}B*=C-SO?^q)c2KgF5hhMOtcvY{rU=t{F`D0iMLjzIP|Q>ni!ZX- z!toFcU?2V-erQP_#1$~fghfDg@EvYi5DARSi8b|aT~Hs`kNT_0=w2*q#>>V5Hsgh) zen63Sya-?KOOSyX;+tKva6qh_JKMMdTUWF-C}7G3G+>%Rsb}uz$;h>a(Go2g&gK1N zaO=4fo{v#zv90WqG(;%XkxS7B(6z-fN41N2A2`^p@yzi*MSIk(y&`854L(;uQe04z zT<>1jy(X-2v-a~GCc$`hX^^d;n2{FQK?3=`MC$6oV)L)2_G>7cgzQ}9F6e^0U~e7b zOLO_+i*~&EC7hSwotgl;KOZ_&cyfgqDrE)LmTB{ z%u8@Ej*M&ArAflh427LReql!zW7urf*uSC}GpU=kUtNRG>lxLD?IB7x)K>Op0*LJS z&{@ECmU@#Asuk;=ySu3MvC9_HU-!t0+UP2A@hPjj!Itq;=!&>>Dg0Tz4cALbI$K3bnC1d{5OI>HQxau`;)KMf;6C~U+~&~{Q2yve z2WX?Czs{k{1T9d_BYq|1#b{_j8qli!W_c6X{>Wy}CWu*JQo=Hzk=m0X`C_(er$1d8 zV|SRwWP?^yFhMzw>qUg4twIF!`d3n7`3fe$;i05q_(mIR2IjLz)mY0qceiw0uu)V^Ue)vWC_u?{x{f6Uj41{_S|@JR&=bQt()_$;xpGW+coG8 ziB6ihOj4@_0YBmH1WJKX)uZ4C*6qaW8vAUNkF!E)nIaUAc3D+<3>J&|nEitln~IA0 z+iy3~N8&pum3r31cgKYOS>PJJL&=l&Gp#9XiiITMJO z!+;?miEPe&=MOtGFxh?d`r=jQnmus8%zf0w!GT~5nRuUNslYphr_<*c$5L#s9Us-s zzgitu8aVAwkQ!qUAOx}rh$eY%7ii)brZML2Ee@_}HX(>1j99{m1y)^f^1TFC ze=lsC!2tu%Cg)faeaB z5qFqN2aI>|IE4Dr89UfPdd#;Vyso?&ukA5J(i9l335vrNNw67a1vn)fwqVapK)%zF zJ0BW91Hb?frI01jn2t5vf5hZWc{lnl1lWLB5UTQph~9(AwH;n41ty)M0u48M3sK`M+yE0?p= zd)*k|MYnkm87!bWHzX2AVA)gKGndcm_IbFjQF5UJBmO{W)~T0Ey!`+4N{ z0qn0Vqr#PET|=yk@p_KgZpxuSP23w7o_%e5n9zkaRTlK42E+)Wl?g;gP*V>B3NduNSEew86j z&63nMIWU%=Vqr^1wUg1v{S4@SGJ{avDWijlt>y7SsRvkU6dU>m1NsON2hhLKoMr_p zB<7%JPy=rPdW9}R4b*~M65WFdV$LEH+KmA&ak+>%`plkLpn-uPNvrzhSaZ?MCmcI3 zRa!vU;c4{+nL2vh8nts4r$pjWF!l+i1!R$hz?y*xDUrYk z6n3PBfybMx^=`v%Vb>1XVpm-a*}Elle`i_XpjUSB+oX@2Yvvi5W^aR zu*fRZ41a15oa=iAn@I&YEdz5?E`GlmNMd<2Gni%Fo(o;rqp_8oSSWT6c ze1=)cNrG*b*8CIR9}akMHuN!DIn=v1P^d!P;QqiMXYW5dfawMV#Lj)2f+p9*_#{;= z+Y)rxEI+j>U#&75yPg1@&OzuNZw>W{t!Dxiij}SLbq6y5S+YPfr-y)p*MWwHlX4hg z1pSNNT!T&_D1xCMK0Wg*61)EeQWvKEWCx_91u)K;K_cWSWcRGK7aTIDRz#TE8Bt7F z^(Mma+677=I86cUKHwV;uY#({g?XE2!^j8T zZ0rMV`D{zbNx2#CKWEAU)T%e|QoX{8E!#arogILg4x&b~lOSI8qtB|QQzLzqoP>$^ zIk-?GDhEiAIB+VMdANX{joJsMAooBc^ie+~$1LbH2qcLMO+FRXAn@UywnCh-ek~$` zQ6FtMjd(dw0Aq&;6(1j$FjGmDsse`ju%$R-D^bGq~o>}*? zGUP$h921LkR1Wn~u8uNWTS6-!?lT!oU5Hbzfc)x;37eHGvO&>w!}J0ah3^h_5mg#p zX)AB)3`uC@vR7PV4*C*Q8eDHvy1itN-vmplD@ku~S*%=fXix3Q(0?_N@7~#a2OHdm zF}su3;f=cL%XO1yDRS4YzzXoT+5}#}FKmH@1k)_S(cOh3+{f}E3$<3HVZ*x=0G(#& z7zsT}23mHBnnyCQ%-9<6i--)oUZ*9YD$4nMspMwi<9A3r$Ch-@BYAT`Z?3`|LkHx_ zUS#p?n|}zgTs^vH4(aW9SdKSx@OR&x{7LLXNUSs$7x68{FSLnW$P~FrTE1a(FMy=@ z#y5!KCZ{Yn<4W6ya0AcpQ{G?`$A`#050n&(Z$ zy=w5yY6!b^X!*B&*8L68_&K$PpyH(#&EAm=A$4r7Hnd2YgoFKJ9=rD z>gLt-i+m%JQfv)y5zRU-vG$T&8&-Yf{9zAq9uUaa_x$Rn_j^y?@8PXw203sTCYNDS_kftf)%=%)|%p5$HX(4>Tk!#cr2ED`|u4{AD4!%mkvGw!gf{59+<;c z2k3sM+pV`-!(qMOvOD!-yKnWIX0J17Hwx^kTi2g`oMCV-c|WrH_K18)AOVEpTvEy| zZpJ439Ant(CE0)QhA6G?_x>>lBqUHDk@7=(gt=5~kGz8yqznY5hb@2n*`9$vmIpPw z2bt~t0c7sR0Wsqv4kGA?j0#`@Cf6)jBQChSA~clX1Y3kBPplCP z`a_Ll4g};9#39{*2Lc<3C`&pD?}^@k%QyqHBz)$}OtF}aNRby1Vil~20g3dqKefGlRnMk|kmX5^D$3Px9pZWYa+) z38Sj;OD1OI8dWCL(l=mEnU5#uXspo>j)r$pf@9*ejO^=KA{eqtALEsq!HbZJLiMQy z<`hQZr*jV+6%3Pz1>^;(KuhBNJA|3TS62iP5~3kE>BbNgh>ee}FV1*Ae&NyZrf0D4 zXM{(F-!7e-3CTG;nFXI)-+*;eiv1IqK}p}Kp$A^VI-i1OiE<;^7}9`Ay#X;9{pJj3 zbT&E>o=LU<5QffH6NU&)z?0+#Ah!;cu|Z_#{4+5K4Dl4)#HYvAe(nPX&)lIq2Qs`* z%TXyE%Hj&{{}nqb)p&|;@c;dH|HXfP_{(GdlTsS9W?bI;Blm`FYSu-=cpRrMR}d08 zigpSA` z)3h1z*USYO%>tV6RrU76#*;fb(n2IoGdD81Q&W+AL<0UN8Ca!%RxSN(Ep2-G6lfCG zmtQqf1dcT7#3_=JAiWO>()*Agy-y%WtotJBH;SOXEU8FsB#J4tBpC>v9fn0JUsSn) z;5`{X16<*oEsA6D0f^|;0X_Je3T4_6?9fW?6uvR04LmXED*XQY@ASvl*tC2LODIKs z6V)Pu-7feR=zP3&e23&N2QwBMXJ$%^X|#ba@%}nK;PUf-013Qu*%;%X;__PzN(kbE zI0!-#;&MqvT{b`^iYq&mMt+sv67rcy+H`~lI3?Kw?1mWPp!huk{CASeeeP46%VJto zUfQ%g6>4>KsZo$FsmW5fW;PX_ zqD~G%n_x2PJCl7hn9?*&cvR0Yhu}C?+l~GSW5&djnB!BdWLW-ymw*rnEP})k;!eDo zp(e20aYk3HBavKgB&R{doT%e)vVB4${t@OosFab`txD zbHg^P42L-b^1#AW&~raQ%amKl2ORbaVM03itI=24MxkU7e?@(79#G|%ICa8@cfprn zknG49rKTg7dINyM{see>3*gCgMe6VaXmTakn&`e!Rp5uz^HLk-B6Th<6BIZ7ffEn%|s@OQqX(3!LSUP<+7;U z$%wcc)R@6)Q9`?Ov{b$`X|u>@*td{sW~6gTlvDzLo`8WI*saN=k zYQ{kgrYZX~52L~#y@NQuM_<$U{WmQ20V4YX%fDg#(-_~?0i%)FgVTNtJ%#>?-C>g?sP?0~asJh9U+= z2AF-NJMHoJqVoRmWO}v|>M51jNdW2ZF7y$@>z+Cj_-5?0UHTYf)HtA;@g3Uv4^+mL z?}!)$aiq8a5#LSSBDc>3Q1~yj>k8%dR+a=o!+7RFB*oDEOshXU+X?fr{&dfy;(+o% za67doh-*!!7mB`OT0ThdL|$B|cAA$qtJP*9qfKEuvQ`*KFu16tf^-Ef*&HO9aWd}r zisfZyc^aYZp>evRn$2?fwPF|cnBiH&4%0TkdQi?ER}LPF-} zQKS3zxefT81?MF1Dp1is8|04KHFyvb2r$zL46;m635U+VG19yQ0-R>8$`CAS7*c#z z^mC1Z6)ja$N3i8eAzPe`zCAY*%u(5B=Yr;_B-_#3^Mx!&V)fPAjds&6)Pitv5t*Yq zXdNisVJN-jn45&9(w*s>h^W}X%wDoI0GnXsm5Ap~<1)$=7tTZoA{Vhcy7N|z;GJG` zhw*xoQF$#%#gqeVp?=U zBUuSHfl@(wd3~IBMMC`3JVLUVzbhf>VU5_wcsmasxDl{fAo z%A@pKykb*1*wjN|Q6!G7Vo{r;KWzYasyLHMcUm1+DvcxM*Lar2l~NhfDtrV-X5)c* z?f+x$3_cm>&J9aey`e4y(#@ckg`Ej;FqJ!hImbM-TWi%QO~Umb5K5DDlq6hgLvfiT zNXPya#bOCSg}+O}-`GB?l*1g#VFIJsIW>_8O_c$2L$pH`*Ik>UD3R*Qj43FKs+n1$ z!k8#O7g8N{Y&@&VXJpu`70b!aa@11M&M_O|1a8H2HpCMP#llU>-sh0b=#05&el{9y!mEB0AMb3&SP z{E%qQt3K5tX0V5DHkP^$I(kheUYNa?-Ay z+~iCln+BjFF3TY<$thK<6KjcfOpQ3cb9PLk;(Cc%uD2rE?VgVu)7Kz8BeSjvm~1( zS&|br$I>qE(3*dW_%zeixq{gx7dTUxg!z?Nk=Z?(re9a`#X95*uxnNF#U{uXdV9#a zBn=J1R>DSMVdL9UnSb(nEsg&dVA+{7d6sc5CcAv1;s4n%vyudI-l4Gjhd0|P28Pxq z7#P65TnPZ1AONJ?&ag7JFJouL?KhO$E0<|$OupdF4CQg;C726T`M%XhU}d9?B4}&- zBF|2y(~$!_8I5ctV;gY7JBOJ4)_Fy!;*te^kI$0xAC%z^^|E*ra<*|UwK98nbatg~k&2ongV zq7N$*A=uukET%avrm3uL=PanJQ~;|4;yEpqN$h^T#!DTdROt_*_QRB!TG}Dh%<_K` z`(hsbqF^|YRs_juZ_J8A6|c<9E3<2YJIgLtVHT;_Wma~XQA1uA%S^?Wife{kGwWn+ zAmdyfV_O0j)~AXnfK3(iEUaismXV$0mz!fBtT^fd3MjEDZHm^3SW|ILy{;+D&jVnT ztJ7H1G|U*1Y^qOYV~$^TAF4}8BW7);TS$RE1wBI=NR@MFrOxBZK~#d#s}kKG3>&F5 zhi%myG<2z|h$WD%AR*{}ng1x0B6Mh)kf~y33@4p`W<=;>r z%&)BLn9jrWuPs@;s&wP5x^a|AuS+M6pvQLU!bxf2NTPt;$>b7iE$vPc^&%|ITc?-g zSCu?Q@|`82LKRI?C3;z#W>ImoZR2LEN~cmWvyyYAtb&)7$H?>nlX^seK_cjw5n5-r z-98KSl{MYGj3#EU{h)17xG0-xPsW}VG$iw?l?8b@1}9rC_N5W%v$}AU zTe@OIxfs#zr|4guVqY<%T+C?gY4FAUUvVXwE3L|tl7%yEDqGS!Wc2&HVo$l)lUA+Y zNj9|_vsJ~WaiUScB~gBH#o% zFlH`2n1Htkl;hgDnN!mSjmo%$JxeY|F2)5;VUg#s8T1T*^D`t)KidL2FeNMwl1t$QfDafhRy)^woOC>UgRd|k(S_+3*Y9!#d(G;GJh2PA( zK}!kmTjFn?)x0JpZGF64={_fMm!Ps@+&%rwp20p`-qnejI7A$slej~Kk*|j<(7y1l zU{B(OC6{)7eh_bBM>s@II=s+fo#;M~9>6hEj_qWq|IqkA9RJFo|I1enDh~5dIZPy{ zlTd^5;IC?GPWZGw0851q>#`fgOKyqV9f`sPAr#lv$hXtTO=N!an;?pM@l%-b(u_~} zwa+5vsRU^zPfqV;EZD}gg>_naC_oL>3#eP(Jw)kVsfMJ?93k1{luC@1I%-9fODD=% z=6Q9*d7DUamNe2isBtnWUdl36a&$?@2l~!LCfPN^L~}@70OsJxnqXC_nqm2a$ngOb zJc&|jh$ItvsdWQt;tkj3I}#C>2M zKsMr#0+EOaq`%N2o(&u4)eOW3B08~lchF{`-_jdR_d=^Q%}UYe(&)w|8yoILvXuo0niAed(6(JBT8SHbcXa8IJu|MI5u%jwG>podf>Jxf z@IE<;&$Fi^*bw_cWFZeWTri(s0`Fc&BqAu+_N&S09x4KR@MiAy(7K0;LwJugjRz)v zd5j*krG+i7%V!F6?|#NUESKZ4HBwKu+KQYQTgd^{jPFJ^(6l&n#NK{KNX`LWwJo%{ zXYnJz=}n#OKICY7FM@D zTlWGS{tGYLq2<$ghEDXY_{W3eA4_8%dRJzyZ5RoZ&lDfC(UI~*Q4S+KmlrCJil0ws z_9GB2@L7Bu!NBHIAY!PX{DxxH$nojbUdob$z+5~0b9{8J?Js~E zJ{cXeZjtUci0{7vKWavL*~hhTw#gr6!%Aq3Te&i|7AYJ<9X@TeS2f;z%!th9UYaLX5v%J-t~NByggs+jLDJ=#$q4ep0gg(uO%3YmCy?q zh?Q_wZy1gTDbJCZ4L;dJ*bawZsKPU0lD=@mlhFY=RJ&`P|%3oN?M4K-YnW9W& zZih@nt;Y(vDEzQQ*(hwJl8EP~<rqTnt#|Ix&6bj<--ggQjo-QiXRW?Uit=mW3pHK*MA9u8`vLiJllI>?19Zp zS%jKw&xTm$-5o3iTIc-zM}c(~NDeFV=T42<&;=SForVewgA?#+O*{nBA{BP>ncaHs8 zQ3baWnH|6_6d;2QFV51V$F)b{ngXjC%+ZY(^z%`T)qccRwhm(G2$prRzx7@j=^Bs(y_Hwc$~nmip)iV>FAHvH|}*%#LA zHfd1^wto*E$UcRS-J?66*7|lJF1HF%VdnyRs&PHoa2gz^EG%C4Bd^RNLlR)1;D*)t z?n)zBsxC6*)wV%tl^Pv{E?h$7if)<&lqd75DWfBtAAJU!63lqrDCr~6toiKL^|bw# zIt23P_3SgOrKV@VBAijITjXty9{KYr`YBVp6c9b&zaG>eXqnbC2K=v~hY)z8rV`LM zPijb04m^vWupDQ$tc?S?jf|ro3Uom`1=OoamTm9k*Jql30ZIb1a4abGPE|m`{M2Yi zB|>#8((Zo7D4}Aox&be%8v&)&^+omigJO}=k3gk~$bI80)9AK;0ZXhu32Jjc>02brum@SwFeL;fH;Ui>P zvjnoTM(hSh^rHm1o3A~^FNC8*E@5#$gd@|5*iq4%FlOHR36)>bf6np6_zbFFAo6j6 z(Lh{nNqZ4EubB>p9Ga-h&ix@rQi-lv58O~k+N%4(u4*d2mzltbr9il%cDRhb<1%xm@ zsD)4@#vFZ!WwM7^G*nPeyRdYMqJf^9N&5>`G`>#_VWVc#&U{{z9QW}JG>~Lf(E#L- z6?^sTbN;qwSibSu9*ywdQ}@nB!4_h9z>EdfnS;0;p@1>{3(EdK`$7bMvYhq zL=*cI#3m_Xn|dj+O+i4Q6yy|kmiua{A*$auyVs3t+#S7Ey?xvp*1N51yWSfNtk#j; zYW3Un%Ii$6gg4+wk&LY8ZT2&olx75?9U@Q=;)wklvQ&KMBxJvVe~6(_df(H$H@lh- zts`BHc3bnM-D+ySbdPj(%;To62hC1T2k)rS*3~kbjh?RS&9b_4m0XTj_zPoNWYC$bL-W2I3I zXrLtkreNKrM%xmDO(pwqh+bepJ_@bKq6t4{!xvHNC8(VeDuulV+@PID)ii>>!%nBy z?KQ6J&7&hg-=1|;x31frdTV$+Ft4p+h|Qzm20$Cb8FhR-tQ!Emvb-C6CJ!X|NFrMW zR|D9Imffiz+kKpsUT4s56d=!`SCmdlFd+&2SMXV~P(9lC=R`J$pP1<1%f8Z}FEU%PhTMb2m4@&>rFSw-p;6q} z`4e$V!2{g~Ajv$VG>NDAT_g1?m4byEt$B3aw=AnsZ}owiv^$NXdbiu@*L&B)?qJwG zwg+~vz(%`sC-%pb-G*Y^sx}w-0S%svEN`sdTyLSve}f(e&c$kP71>)W;=n3THLkhR zr7SQBy~kLPFbHQ$;PXqR{C%_2864U5cC!tfeE^Dg_vjcnd#_=(&35moH@q%_kbRHh zBYjgkrp+hFE5dl9eS&f4)(90cO42``zBG7f4@9;=V^9T&;G5aN`0=UnH6Vyj$N__I zMCFT>{6Q)ShNExd>3rJm3Gs)p(?Ido!Ip=?0QQjFaH4HmE|#TT&ciUp|H#2JkteW0 z@BgqpXr2}3osbj0YC9npQ*H=|<#?*R95JyVGja zLCo&e+wFd<-aE3|^&>z-t9jhA&2E1o&bTB@q^xdYUxBc60~>8fc^>Y6A+|2~nv4Q+ zvH0%WOg6gSeHNE%c7!RKNlX#C&d)M#M2046wJ@%Th1Q@vz<32cKx5?6?>1KAUnI0O z3}Fqfp^=HhHy+Fa-Wqf|h4vRXGp)G6#Eq>SZ3dBLyOMdQoChu=l{eDw(Ov9tbDvNQRfXrC zhh?-!q1A_!n;n^l@?crSg1SW(sqVAQP!J>i(#%*@38>3RGByf z_Oe_d>G&HY6)AwhY#KQM7TYZqZ>8nhE<8P(T*EZy%@A-pvaN{*Q}bcbm`+{Y4;H2@ z98#-cOTr|P1(u}XWn+PMCJty9LLX@cMI;LDkS`5`6pKY#Sv@kvQ;KU(n@TGfJ8;@e zIjfpldqK=TnPPZO46_p$D$oKqGc$c{|2>Ux4k37K#+4H6Hl@rtJT!jutf?`BNTFcEAX>ir0Jvq46AYH|@0YKB z#l$q$z471w=l=p4je$ba1EdBqbU~yK3;>hZSc6-`C8s1Hg2;lRH})4&iKL4`n8SOR zRA)e5veY-u1m1fXgA|q|kTA0i43ZWgy`Z(o$yMVKUG7I1M?_qE>&gO@O#xlU3G@6H z=xD4U-f|5g-ZE?3i}Ro+zw=0BeJ-)0qe*Ij54& z00ZN}yTD}nm}^|Q%4T2jmSJKMfzn(R*gDL^04=+m!%9BwvGvLR=-ab>I&Hy9h4U#j zTNB3yOpV;^JN)UM{bY932+Mr_W$Jjs$B+vLun|INh*5I8MEgy}=JK<-Rr0ukd?^Db zF2+42HmBTKVLpqB%ROv0QjG`O!P?@kw^cEc=u-Rgav3=Rj5m{q*W51eLjJ>?F2Td_Yy{U zMhMR#`*|D^u^+jb~*7L(32ryd3XW=~hcQr=i4CxZx3b zfVgC!Hj(gE9qrHSA1j_?a3`3@IyuL})P8Y>q|bLOL&5FiJ31y(g?6U6#pzjr6sI^d zr<5Jm8AOgR{URI%t|VT3qba|Iv7x6xaUD=W^7+g2N0eeb3uZlyyXN&_E$S%LdmGQ9 zYklmkR(gmi{a9K5AF^E}6AEvWrk?-9hXJlZq(k&ySB zoId0ti(HPpf^q%i4(~$&c6JM0y>*GmNMtmg>XYrnpNaj{ySim@{?h66sMtmYqb!n< z!{)LM#Fa%IuJrO=eo|aGHmyFbS~9P})7n{%rk9FaOFQqL{jmE|##7=6`mD$2mop$y zrYY$_zC0$LllLV!vahp=$J0tZw^Bk8EE z;KHEkp2=j?AUxJZjG7NG}C`m^o;fLmCpWQ(U^~Jye*vAkY?)aZxf(kH-UB({N zwZhxj8FHXwCx#ue>xdFkC5~W|25qy{LsGo4U`X3#_r)On`8bCGm)Kl08g6f)yZH>t z1GO1?I`?3ew6@-34ThPeU>HPMU(W2QVLmY~s3G(g63TXMn0W8Dt z0945kdszvVM_i6O!=Eo4&!4@XPhNQ^#3h6=2j|1i-z@(Y;tg&sGx*i)9N}+0tI!Hk z%MCEg8wrpubrp#wOJQ1B!?QS@ZC7-5bLeb*O}Bx_s%6HRJB0Tr_;H&11#jpmN|FB^ zFtvt#gCO%tgzMRsu@{L0#3r=*5?Z982Lh5zMI zcV(WE;ELD4r0K(*1F(rw4(W9G1pgS&SXQRDQknDm=%{SRQ|35<;!< zc%|;I-3i@DvkUc|$$lgh!yFP6#$sPES$BB{0Pl@+wu7Dpl0la*47e zS+P8zW=a;(lzMr!>+F(b5mRs)Q_O1%Znk!f^lwh)gl!=B$+;Sql20LpFh?O3q|HLa za-ywt=W;Qq#QM#0k}W_XODB)%hR9~CbW7y!=T%32Hj=|DupQa5CM!2qRE>QB8@T@b z9w?|PvC?XERqO+HL9x8MrMYfuUUajeRCVRF=)0-#X4!kYB?D#7qF8dK!xZsF0#jVC zv{MC_6{koHFCHvRg;y_yXpa=;qu1FF8ODSGyAwq02KANVNv8{5!fgA@GpLEr$Mn(u ztV~L_JH{W$?Q-NMmoS86>5rS_>0I3u~t&I zRzfB~-_dU}?25trQY-*Lza_}Of3|1b z?9AlYD8>dF%FO*_PZDr8LAjw-GaT+GXZg8|BM^Oj{Xu;^IhqMTS34mW0Fo2^f#p!< z7bN|4+-4^))I-S5S0vZox#~PMUgDR40UCc{m+*&@t zKUk<4GL*9+M?!VEX`qmQByorz9hRnuHo=T{AvC~AmgR0=ZssYm%i^Em|9nghuVzhd z^sx~npyy`NcbjVk8jm4Y6da(H5Ufv4xh@ zmzH@fJxMUlp4jU~v(Xlw#1`5Ov4wUcGTI~QNf<-B*=jVy5w#jUVSKH&I7{tDSDcBa zG%wN&c6(yIZVx0J;YozjGsTiUm?q`R(y_RO>sA0Cm zzDPZjRtUD7w6enffG1%L*cItX-2b=*#rCAVb0k86r*Q1}B<{H*;1>c+Y0sIaF!r`7 zLcyh#o&=ciB*FxQ6Q9H}z_f@@;+(;gL?y%>((H&>+w6!~3)m(-iMZH2lIk7F^~4?D zJeDx*xFtQwt0}c`EJ5i?z3xiwbpdUKr=B>UJ#nAGlklwtn?QV$DON+qOzBCYiA}K{ zF1vsa(!R!p7BL4ZhERGGQwSe#9nsCg9(uw<&lJCib=YR04{W#52e#Q*F^co-;W&H% zbP)lF#n_Id4_y%&qeHA6u~<9Y@2%r5{uAZfs4)Q3MtymX5;gl8%ct0gW$g;IZFcyJ zMBL;P*4LPNk!YzWHxM##6PEuKbSP3@k%N(mnG}{ojS*uKeu@Gzn0!$o#ne9V{uZoh zV{3Y0frB2eF5s~VuSuRooFnVz3bPmo5gnvEFJRU#@faB$JM;|CSY{B3la^zp=h9Ha z_utHH#QBgXv%C zITnrDN_%)R845j=m!;BYH%^~z>Ckm-eG%<@|AP>P?Yx0@4be#&JI-#!B9#}9t+G*i z%QaJGzho#**7M#tM2wa&dW-pZdHzy4_=1!YLJ3$QYFMDh-oyBA6}OQ)5TppV z9`Up6Qn?}b9Fw9D>2c?{b3Zr$O^c#DGWS2aBR;&-xd%*brY<(IKeJ-gK`jlC-sT{7 zj}^MGfc(gXrtm6aJ<-dHQLAq8JD4^&<9xA<9`P=T89F+QiKJzN)cZFmd}GWSAn5V? z@4wR@U!~T+gT^hJb{{5Mx6SnPAe-N*K-<~GTS2j}C#Io7{o&U)q?Rj<6I zXjn_-$yu4Q)XSP-yaCY%UeDp5WbP?(;xta3i-l#;{VL{GF}K{zEz6z0dH7o*bIZGn zml*)D66GR23_^%BLn0C-S*kM0IoXXgGmg_b`7GlwrZMSk>kU6xCq+riO*XNYb-x0*eHk_jt0IV7djPpKs0tD?4}qqK?33w*P2X)a9m~( zA~Ys;3H!I*j~Lc$v{eNQ7d>^i>_c>V>c9@zL^>d2eLReQEkqZsZ z+LB@aRdhx}XZT^xZJ;wD54oKCQ)hs&sjC%N!ged7vg1TWyV-J+l8rqtkx6seDk*6> zWN8~rO)1WkTzN`&BRalJbIg=6Rgq+6>@^8M~KJJ$X#~D0L>T_~eoOJXk z*pfyb^1!I?no=KUzh7<#Qz9p!Ycleclt4L!CS*f#?FQNk{cjT8Ak=(Hy=hHv8zUcROsf&&f(6 zTGe7oRgq+Y(gnuLv-lU)vflpmdg-x#X*R0@Q?&JV=}IEnq@>ibTgDeLyB9`9*ehFW z^vH$dTDx>n;VMeSqViSlVW|yZ>KD!`y zjMTxvK18`U|76g``mm7KK7d9=2DNKr^?@`Aac>(II-_)6m|NsJUYN?zzc<4Ron_xt ze&?9cy!t9U!Gq;tKwvq zKvFa}p+AJBvy}7e(795z85EtaLBzYV$H1Ovs10B}A3i%1dsHWe2(Ge4?n(X5AKcnw zi&VIs&8Gg7!^0bAc02DMKz9$%`CdIdnFc1x`Wf4-_1|E#q7398_D632a10n~dxsPx z*~$3vfbNcOu-ucq+Q0q_5<>A07kc)d7<(Y=D2q@OIvZk{cXu#}hy?!rqX1iAl39^Q zk3T3uK;P{f*Skj$d}{Wh<-W-;zC{3ijg}`Efe?d<3dyK7I*TLqA<)k|2ZCn(L)a%4 zP%|su+dXUQybUL%*=RQF4HN&H;$?XDXGIm_l;v9zCu-3fJ_2?}?zF zk7}&;BfheAkk3Z2touGJ|7<@p^;qI;*d$;v5xHvW_h7^@CAj0Df3X>a0>jYNfFt

}?ItNPf0QBmDQ& zy|X`CpgLaz%SNhx07HNsf~>=TW=}ENdNP3SJ_Sk&s=)y@3BUV5i-EQ`fk)R%Da$s| z*%+v>&!oZNi040H^I2M$8rz)V}k!rLfi+^s7aOtTe^YQehx>0GfKV$Sz zF?QYf^Y%(1J8n$hUQO&PP|I$>z&fOErH$ztC-SHYjvQ3#PCy2_|HJk+ri+}xzF_=y z6FNqfq79iJ;@P|+RQ8!DQDp31SbqIemD(58>kkTwnx-R&k3xNMtRSomK7q9LO9IE{ zWdy-r$%)zbh|IuiqbR4XiXS!gQdz%Phb_t_(es4QTBC06wC*2Ev*u}Ue z+Nw9&N=BG+A2>gRFSfGAnZw&J4hePW}sYjrWL+8g9 z_&9AvSFBIg!Pr0Kh8o^!|I-AbWF6lp9?BodlR+P`1q1hy5Zd?G=x9`ECX<(|;`4py!kOiDV*SoPMOb+%b zWX~QEBE^7tF6$$B^k5Qzc==Fd0AiL0CV6Zf)O~9d8cw*KJDg>{_ut@A^3grE8xHFV z{IwGom_FKQAd+<$Vn+br3RgMU)idi86t#>%=eb8;hm1Kh0V?gK56glR3guvmMSaPz zVc4)=*iHq1iej@On#igdSJ)0mU_u%JsU-+l$G0PU42xxr>VQVD#bFy?(63|%V{9OF z1scS8!es}yJT_|$xzQP(fJl?kVk~h;)=)x5!tE^`~iRyI$@mCa>iNEy_1VG0r3x^0}0(w z&Ek}DPXF+FJ|X+eKm3y$B%ERGzTn?VYU`7IU%#_p+7E*!z!GV^#aAUY0d&9vP8&9G zNne0HjYNNx)eO!Q@ZJ9051T^s+Y9KO6z;OY=QH-*pK-78fW>H}xEkJdLkAr;hd zKr(#J24RRVaiWYd@+_7r;^s+YZM6_TA zQ9E;0C_tnwXMAJ$-awcZ&-#2oMISsX!2s!{ASM8zmw^dC+~EM>Y@abI7+@cFreEOk z)mULmYbvTn%IJ-4iYEfhT&13b=W$jI~ z^5(YgN~1}#<|bQl6Rfv!&!*az5_j+Ecd_J?3iNza>Fv;I!V(Oo$Poy69kqNooDSz2 z3E7kN(_4&~Jf*S^^aG<%at#L6M?tM$+c@Y5bhhqAhSXf|kn|>Khz|hiZIPk1);l!G zRkFx9+H2l*?!=~!i$w;}S??gCeuPDaatg+v7%{Bpk_(Ngx!$d&AY`v5XCNhmsJsy4H(TpmtpAuhgHMao0drk!9|Dx; zQzpTq8G(aZXfO-0|G-p}Yc&7v_6-t;2j(RV_D}6U^;oU8lP|&8hdzSm)Kt6`eckv; z4G(0HILS@!>LvJJu%no6V6%Jr_NUi8KivlR65~~2I;rxw(LGH}C_;~jY-YbP7J8$5 z7zAZ+bT8@phqfsLLm!6o(dxRbjf2h;1eDJ>7zvYENT@ES|LRcgB4IwP|5<{|t{u;x zUC=NUJk-Y`b&l$dqq-?ay96OWQ427$^M|iKNS+FMc1C4z9=c!{pTyw7m*9**9fCbb zL<2ZySh#>ROmSTNXE?yJPPQ02M@2B{q;Wd#J#c-&c}6l^cn$yke^5&S0u%rg00008 z05*NfTz`2%Q0xo<02x0302crN0000000000000000001Ea%Ew3WmRcJWoBt^X>@6C zZZ2wbZ*EXa0Rj{N6aWAK2mm&H%3Q;ep(S?5000(93IGuR000000000000000Aq@Zk qZDDC{RAp^&Y+-a|E^2dcZcs}F1^@s600IC40E7Sl0LIh+0002EtIqcT literal 0 HcmV?d00001 diff --git a/Solutions/Veeam/Package/createUiDefinition.json b/Solutions/Veeam/Package/createUiDefinition.json index 329551f7ef3..041d59c4c42 100644 --- a/Solutions/Veeam/Package/createUiDefinition.json +++ b/Solutions/Veeam/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Veeam/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nVeeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/products/functions/#overview)\n\nc. [Azure Key Vault](https://azure.microsoft.com/products/key-vault/)\n\nd. [Azure Storage Account](https://azure.microsoft.com/products/storage/)\n\ne. [Azure Relays](https://azure.microsoft.com/products/service-bus/)\n\nf. [Azure Logic Apps](https://azure.microsoft.com/products/logic-apps/)\n\ng. [Azure Log Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview)\n\n**Data Connectors:** 1, **Parsers:** 4, **Workbooks:** 2, **Analytic Rules:** 132, **Watchlists:** 11, **Playbooks:** 15\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Veeam/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nVeeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/products/functions/#overview)\n\nc. [Azure Key Vault](https://azure.microsoft.com/products/key-vault/)\n\nd. [Azure Storage Account](https://azure.microsoft.com/products/storage/)\n\ne. [Azure Relays](https://azure.microsoft.com/products/service-bus/)\n\nf. [Azure Logic Apps](https://azure.microsoft.com/products/logic-apps/)\n\ng. [Azure Log Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview)\n\n**Data Connectors:** 1, **Workbooks:** 2, **Watchlists:** 11, **Playbooks:** 15\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -146,1854 +146,6 @@ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" } } - }, - { - "name": "analytic1", - "type": "Microsoft.Common.Section", - "label": "Adding User or Group Failed", - "elements": [ - { - "name": "analytic1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects failed attempts to add a user or user group to Veeam Backup & Replication." - } - } - ] - }, - { - "name": "analytic2", - "type": "Microsoft.Common.Section", - "label": "Application Group Deleted", - "elements": [ - { - "name": "analytic2-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when an application group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic3", - "type": "Microsoft.Common.Section", - "label": "Application Group Settings Updated", - "elements": [ - { - "name": "analytic3-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when application group settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic4", - "type": "Microsoft.Common.Section", - "label": "Archive Repository Deleted", - "elements": [ - { - "name": "analytic4-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when an archive repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic5", - "type": "Microsoft.Common.Section", - "label": "Archive Repository Settings Updated", - "elements": [ - { - "name": "analytic5-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when archive repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic6", - "type": "Microsoft.Common.Section", - "label": "Attempt to Delete Backup Failed", - "elements": [ - { - "name": "analytic6-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects failed backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure." - } - } - ] - }, - { - "name": "analytic7", - "type": "Microsoft.Common.Section", - "label": "Attempt to Update Security Object Failed", - "elements": [ - { - "name": "analytic7-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects failed attempts to update security objects in Veeam Backup & Replication. Security objects include users and roles, credential records, certificates, or passwords." - } - } - ] - }, - { - "name": "analytic8", - "type": "Microsoft.Common.Section", - "label": "Backup Proxy Deleted", - "elements": [ - { - "name": "analytic8-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a backup proxy is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic9", - "type": "Microsoft.Common.Section", - "label": "Backup Repository Deleted", - "elements": [ - { - "name": "analytic9-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a backup repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic10", - "type": "Microsoft.Common.Section", - "label": "Backup Repository Settings Updated", - "elements": [ - { - "name": "analytic10-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when backup repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic11", - "type": "Microsoft.Common.Section", - "label": "Cloud Gateway Deleted", - "elements": [ - { - "name": "analytic11-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a cloud gateway is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic12", - "type": "Microsoft.Common.Section", - "label": "Cloud Gateway Pool Deleted", - "elements": [ - { - "name": "analytic12-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a cloud gateway pool is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic13", - "type": "Microsoft.Common.Section", - "label": "Cloud Gateway Pool Settings Updated", - "elements": [ - { - "name": "analytic13-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when cloud gateway pool settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic14", - "type": "Microsoft.Common.Section", - "label": "Cloud Gateway Settings Updated", - "elements": [ - { - "name": "analytic14-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when cloud gateway settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic15", - "type": "Microsoft.Common.Section", - "label": "Cloud Replica Permanent Failover Performed by Tenant", - "elements": [ - { - "name": "analytic15-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects permanent failover of a cloud replica initiated by a tenant. This might indicate disaster recovery activity or issues with primary systems." - } - } - ] - }, - { - "name": "analytic16", - "type": "Microsoft.Common.Section", - "label": "Configuration Backup Job Failed", - "elements": [ - { - "name": "analytic16-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure." - } - } - ] - }, - { - "name": "analytic17", - "type": "Microsoft.Common.Section", - "label": "Configuration Backup Job Settings Updated", - "elements": [ - { - "name": "analytic17-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when configuration backup job settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic18", - "type": "Microsoft.Common.Section", - "label": "Connection to Backup Repository Lost", - "elements": [ - { - "name": "analytic18-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a backup server fails to connect to a backup repository." - } - } - ] - }, - { - "name": "analytic19", - "type": "Microsoft.Common.Section", - "label": "Credential Record Deleted", - "elements": [ - { - "name": "analytic19-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a credential record is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic20", - "type": "Microsoft.Common.Section", - "label": "Credential Record Updated", - "elements": [ - { - "name": "analytic20-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a credential record is updated in Veeam Backup & Replication." - } - } - ] - }, - { - "name": "analytic21", - "type": "Microsoft.Common.Section", - "label": "Detaching Backups Started", - "elements": [ - { - "name": "analytic21-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a backup file is detached from a backup job." - } - } - ] - }, - { - "name": "analytic22", - "type": "Microsoft.Common.Section", - "label": "Encryption Password Added", - "elements": [ - { - "name": "analytic22-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when an encryption password is added to Veeam Backup & Replication." - } - } - ] - }, - { - "name": "analytic23", - "type": "Microsoft.Common.Section", - "label": "Encryption Password Changed", - "elements": [ - { - "name": "analytic23-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when an encryption password is updated in Veeam Backup & Replication." - } - } - ] - }, - { - "name": "analytic24", - "type": "Microsoft.Common.Section", - "label": "Encryption Password Deleted", - "elements": [ - { - "name": "analytic24-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when an encryption password is deleted in Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic25", - "type": "Microsoft.Common.Section", - "label": "External Repository Deleted", - "elements": [ - { - "name": "analytic25-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when an external repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic26", - "type": "Microsoft.Common.Section", - "label": "External Repository Settings Updated", - "elements": [ - { - "name": "analytic26-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when external repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic27", - "type": "Microsoft.Common.Section", - "label": "Failover Plan Deleted", - "elements": [ - { - "name": "analytic27-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a failover plan is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic28", - "type": "Microsoft.Common.Section", - "label": "Failover Plan Failed", - "elements": [ - { - "name": "analytic28-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems." - } - } - ] - }, - { - "name": "analytic29", - "type": "Microsoft.Common.Section", - "label": "Failover Plan Settings Updated", - "elements": [ - { - "name": "analytic29-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when failover plan settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic30", - "type": "Microsoft.Common.Section", - "label": "Failover Plan Started", - "elements": [ - { - "name": "analytic30-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a failover plan starts. This might indicate disaster recovery activity or issues with primary systems." - } - } - ] - }, - { - "name": "analytic31", - "type": "Microsoft.Common.Section", - "label": "Failover Plan Stopped", - "elements": [ - { - "name": "analytic31-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a failover plan stops. This might indicate disaster recovery activity or issues with primary systems." - } - } - ] - }, - { - "name": "analytic32", - "type": "Microsoft.Common.Section", - "label": "File Server Deleted", - "elements": [ - { - "name": "analytic32-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a file server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic33", - "type": "Microsoft.Common.Section", - "label": "File Server Settings Updated", - "elements": [ - { - "name": "analytic33-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when file server settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic34", - "type": "Microsoft.Common.Section", - "label": "File Share Deleted", - "elements": [ - { - "name": "analytic34-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a file share is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic35", - "type": "Microsoft.Common.Section", - "label": "Four-Eyes Authorization Disabled", - "elements": [ - { - "name": "analytic35-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when four-eyes authorization is disabled." - } - } - ] - }, - { - "name": "analytic36", - "type": "Microsoft.Common.Section", - "label": "Four-Eyes Authorization Request Created", - "elements": [ - { - "name": "analytic36-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a four-eyes authorization request is created." - } - } - ] - }, - { - "name": "analytic37", - "type": "Microsoft.Common.Section", - "label": "Four-Eyes Authorization Request Expired", - "elements": [ - { - "name": "analytic37-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a four-eyes authorization request is expired." - } - } - ] - }, - { - "name": "analytic38", - "type": "Microsoft.Common.Section", - "label": "Four-Eyes Authorization Request Rejected", - "elements": [ - { - "name": "analytic38-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a four-eyes authorization request is rejected." - } - } - ] - }, - { - "name": "analytic39", - "type": "Microsoft.Common.Section", - "label": "General Settings Updated", - "elements": [ - { - "name": "analytic39-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when Veeam Backup & Replication general settings are updated. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic40", - "type": "Microsoft.Common.Section", - "label": "Global Network Traffic Rules Deleted", - "elements": [ - { - "name": "analytic40-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a global network traffic rule is deleted in Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic41", - "type": "Microsoft.Common.Section", - "label": "Global VM Exclusions Added", - "elements": [ - { - "name": "analytic41-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when global VM exclusion are added in Veeam Backup & Replication." - } - } - ] - }, - { - "name": "analytic42", - "type": "Microsoft.Common.Section", - "label": "Global VM Exclusions Changed", - "elements": [ - { - "name": "analytic42-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when global VM exclusions are updated in Veeam Backup & Replication." - } - } - ] - }, - { - "name": "analytic43", - "type": "Microsoft.Common.Section", - "label": "Global VM Exclusions Deleted", - "elements": [ - { - "name": "analytic43-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a VM is removed from global exclusions in Veeam Backup & Replication. This might indicate unauthorized changes." - } - } - ] - }, - { - "name": "analytic44", - "type": "Microsoft.Common.Section", - "label": "Host Deleted", - "elements": [ - { - "name": "analytic44-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a host is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic45", - "type": "Microsoft.Common.Section", - "label": "Host Settings Updated", - "elements": [ - { - "name": "analytic45-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when host settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic46", - "type": "Microsoft.Common.Section", - "label": "Hypervisor Host Deleted", - "elements": [ - { - "name": "analytic46-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a hypervisor host is deleted from Veeam Backup & Replication. This might indicate unauthorized changes to the virtualization environment." - } - } - ] - }, - { - "name": "analytic47", - "type": "Microsoft.Common.Section", - "label": "Hypervisor Host Settings Updated", - "elements": [ - { - "name": "analytic47-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when hypervisor host settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic48", - "type": "Microsoft.Common.Section", - "label": "Invalid Code for Multi-Factor Authentication Entered", - "elements": [ - { - "name": "analytic48-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects failed multi-factor authentication attempts. This might indicate credential stuffing or brute-force attacks." - } - } - ] - }, - { - "name": "analytic49", - "type": "Microsoft.Common.Section", - "label": "Job Deleted", - "elements": [ - { - "name": "analytic49-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a job is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic50", - "type": "Microsoft.Common.Section", - "label": "Job No Longer Used as Second Destination", - "elements": [ - { - "name": "analytic50-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a job used as a secondary destination is removed." - } - } - ] - }, - { - "name": "analytic51", - "type": "Microsoft.Common.Section", - "label": "KMS Key Rotation Job Finished", - "elements": [ - { - "name": "analytic51-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a KMS key rotation job is finished." - } - } - ] - }, - { - "name": "analytic52", - "type": "Microsoft.Common.Section", - "label": "KMS Server Deleted", - "elements": [ - { - "name": "analytic52-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a KMS server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic53", - "type": "Microsoft.Common.Section", - "label": "KMS Server Settings Updated", - "elements": [ - { - "name": "analytic53-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when KMS server settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic54", - "type": "Microsoft.Common.Section", - "label": "License Expired", - "elements": [ - { - "name": "analytic54-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a Veeam license is expired. This could impact backup operations and data protection." - } - } - ] - }, - { - "name": "analytic55", - "type": "Microsoft.Common.Section", - "label": "License Expiring", - "elements": [ - { - "name": "analytic55-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a Veeam license expires shortly." - } - } - ] - }, - { - "name": "analytic56", - "type": "Microsoft.Common.Section", - "label": "License Grace Period Started", - "elements": [ - { - "name": "analytic56-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a Veeam license grace period starts. This might indicate potential licensing issues that need attention." - } - } - ] - }, - { - "name": "analytic57", - "type": "Microsoft.Common.Section", - "label": "License Limit Exceeded", - "elements": [ - { - "name": "analytic57-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when the Veeam license limit is exceeded." - } - } - ] - }, - { - "name": "analytic58", - "type": "Microsoft.Common.Section", - "label": "License Removed", - "elements": [ - { - "name": "analytic58-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when the Veeam license is removed from Veeam Backup & Replication." - } - } - ] - }, - { - "name": "analytic59", - "type": "Microsoft.Common.Section", - "label": "License Support Expired", - "elements": [ - { - "name": "analytic59-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when the Veeam support contract is expired. This might impact backup operations and data protection." - } - } - ] - }, - { - "name": "analytic60", - "type": "Microsoft.Common.Section", - "label": "License Support Expiring", - "elements": [ - { - "name": "analytic60-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when the Veeam support contract expires shortly." - } - } - ] - }, - { - "name": "analytic61", - "type": "Microsoft.Common.Section", - "label": "Malware Activity Detected", - "elements": [ - { - "name": "analytic61-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when restore points marked as suspicious. This might indicate potential compromise of backup data." - } - } - ] - }, - { - "name": "analytic62", - "type": "Microsoft.Common.Section", - "label": "Malware Detection Exclusions List Updated", - "elements": [ - { - "name": "analytic62-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when malware detection exclusions are updated. This might indicate potential compromise of backup data." - } - } - ] - }, - { - "name": "analytic63", - "type": "Microsoft.Common.Section", - "label": "Malware Detection Session Finished", - "elements": [ - { - "name": "analytic63-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when malware detection session finishes." - } - } - ] - }, - { - "name": "analytic64", - "type": "Microsoft.Common.Section", - "label": "Malware Detection Settings Updated", - "elements": [ - { - "name": "analytic64-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when malware detection settings are updated." - } - } - ] - }, - { - "name": "analytic65", - "type": "Microsoft.Common.Section", - "label": "Malware Event Detected", - "elements": [ - { - "name": "analytic65-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when restore points are marked as infected. This might indicate potential compromise of backup data." - } - } - ] - }, - { - "name": "analytic66", - "type": "Microsoft.Common.Section", - "label": "Multi-Factor Authentication Disabled", - "elements": [ - { - "name": "analytic66-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when multi-factor authentication is disabled for all users." - } - } - ] - }, - { - "name": "analytic67", - "type": "Microsoft.Common.Section", - "label": "Multi-Factor Authentication for User Disabled", - "elements": [ - { - "name": "analytic67-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when multi-factor authentication is disabled for a specific user." - } - } - ] - }, - { - "name": "analytic68", - "type": "Microsoft.Common.Section", - "label": "Multi-Factor Authentication Token Revoked", - "elements": [ - { - "name": "analytic68-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a multi-factor authentication token is revoked." - } - } - ] - }, - { - "name": "analytic69", - "type": "Microsoft.Common.Section", - "label": "Multi-Factor Authentication User Locked", - "elements": [ - { - "name": "analytic69-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when the allowed number of multi-factor authentication attempts is exceeded for a user." - } - } - ] - }, - { - "name": "analytic70", - "type": "Microsoft.Common.Section", - "label": "NDMP Server Deleted", - "elements": [ - { - "name": "analytic70-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when an NDMP server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic71", - "type": "Microsoft.Common.Section", - "label": "Object Marked as Clean", - "elements": [ - { - "name": "analytic71-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when an object is marked as clean." - } - } - ] - }, - { - "name": "analytic72", - "type": "Microsoft.Common.Section", - "label": "Object Storage Deleted", - "elements": [ - { - "name": "analytic72-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when an object storage is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic73", - "type": "Microsoft.Common.Section", - "label": "Object Storage Settings Updated", - "elements": [ - { - "name": "analytic73-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when object storage settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic74", - "type": "Microsoft.Common.Section", - "label": "Objects Added to Malware Detection Exclusions", - "elements": [ - { - "name": "analytic74-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when an object is added to malware detection exclusions." - } - } - ] - }, - { - "name": "analytic75", - "type": "Microsoft.Common.Section", - "label": "Objects Deleted from Malware Detection Exclusions", - "elements": [ - { - "name": "analytic75-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when an object is deleted from malware detection exclusions." - } - } - ] - }, - { - "name": "analytic76", - "type": "Microsoft.Common.Section", - "label": "Objects for Job Deleted", - "elements": [ - { - "name": "analytic76-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when objects are deleted from the job. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic77", - "type": "Microsoft.Common.Section", - "label": "Objects for Protection Group Changed", - "elements": [ - { - "name": "analytic77-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when protection group objects are updated." - } - } - ] - }, - { - "name": "analytic78", - "type": "Microsoft.Common.Section", - "label": "Objects for Protection Group Deleted", - "elements": [ - { - "name": "analytic78-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when objects are deleted from a protection group. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic79", - "type": "Microsoft.Common.Section", - "label": "Preferred Networks Deleted", - "elements": [ - { - "name": "analytic79-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a preferred network is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic80", - "type": "Microsoft.Common.Section", - "label": "Protection Group Deleted", - "elements": [ - { - "name": "analytic80-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a protection group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic81", - "type": "Microsoft.Common.Section", - "label": "Protection Group Settings Updated", - "elements": [ - { - "name": "analytic81-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when protection group settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic82", - "type": "Microsoft.Common.Section", - "label": "Recovery Token Deleted", - "elements": [ - { - "name": "analytic82-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a recovery token is deleted. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic83", - "type": "Microsoft.Common.Section", - "label": "Restore Point Marked as Clean", - "elements": [ - { - "name": "analytic83-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a restore point is marked as clean." - } - } - ] - }, - { - "name": "analytic84", - "type": "Microsoft.Common.Section", - "label": "Restore Point Marked as Infected", - "elements": [ - { - "name": "analytic84-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a restore point is marked as infected." - } - } - ] - }, - { - "name": "analytic85", - "type": "Microsoft.Common.Section", - "label": "Scale-Out Backup Repository Deleted", - "elements": [ - { - "name": "analytic85-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a scale-out backup repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic86", - "type": "Microsoft.Common.Section", - "label": "Scale-Out Backup Repository Settings Updated", - "elements": [ - { - "name": "analytic86-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when scale-out backup repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic87", - "type": "Microsoft.Common.Section", - "label": "Service Provider Deleted", - "elements": [ - { - "name": "analytic87-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a service provider is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic88", - "type": "Microsoft.Common.Section", - "label": "Service Provider Updated", - "elements": [ - { - "name": "analytic88-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when service provider settings are updated in Veeam Backup & Replication." - } - } - ] - }, - { - "name": "analytic89", - "type": "Microsoft.Common.Section", - "label": "SSH Credentials Changed", - "elements": [ - { - "name": "analytic89-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when SSH credentials are updated." - } - } - ] - }, - { - "name": "analytic90", - "type": "Microsoft.Common.Section", - "label": "Storage Deleted", - "elements": [ - { - "name": "analytic90-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when storage is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic91", - "type": "Microsoft.Common.Section", - "label": "Storage Settings Updated", - "elements": [ - { - "name": "analytic91-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when storage settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic92", - "type": "Microsoft.Common.Section", - "label": "Subtenant Deleted", - "elements": [ - { - "name": "analytic92-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a subtenant is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic93", - "type": "Microsoft.Common.Section", - "label": "Subtenant Updated", - "elements": [ - { - "name": "analytic93-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when subtenant settings are updated in Veeam Backup & Replication." - } - } - ] - }, - { - "name": "analytic94", - "type": "Microsoft.Common.Section", - "label": "SureBackup Job Failed", - "elements": [ - { - "name": "analytic94-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects failed SureBackup job operations. This might indicate malware issues, storage problems, or potential sabotage of backup infrastructure." - } - } - ] - }, - { - "name": "analytic95", - "type": "Microsoft.Common.Section", - "label": "Tape Erase Job Started", - "elements": [ - { - "name": "analytic95-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when tape erase operations start. This might indicate data destruction activity." - } - } - ] - }, - { - "name": "analytic96", - "type": "Microsoft.Common.Section", - "label": "Tape Library Deleted", - "elements": [ - { - "name": "analytic96-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a tape library is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic97", - "type": "Microsoft.Common.Section", - "label": "Tape Media Pool Deleted", - "elements": [ - { - "name": "analytic97-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a tape media pool is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic98", - "type": "Microsoft.Common.Section", - "label": "Tape Media Vault Deleted", - "elements": [ - { - "name": "analytic98-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a tape media vault is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic99", - "type": "Microsoft.Common.Section", - "label": "Tape Medium Deleted", - "elements": [ - { - "name": "analytic99-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a tape medium is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic100", - "type": "Microsoft.Common.Section", - "label": "Tape Server Deleted", - "elements": [ - { - "name": "analytic100-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a tape server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic101", - "type": "Microsoft.Common.Section", - "label": "Tenant Password Changed", - "elements": [ - { - "name": "analytic101-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a tenant password is updated." - } - } - ] - }, - { - "name": "analytic102", - "type": "Microsoft.Common.Section", - "label": "Tenant Quota Changed", - "elements": [ - { - "name": "analytic102-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a tenant quota is updated." - } - } - ] - }, - { - "name": "analytic103", - "type": "Microsoft.Common.Section", - "label": "Tenant Quota Deleted", - "elements": [ - { - "name": "analytic103-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a tenant quota is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic104", - "type": "Microsoft.Common.Section", - "label": "Tenant Replica Started", - "elements": [ - { - "name": "analytic104-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a tenant replica starts." - } - } - ] - }, - { - "name": "analytic105", - "type": "Microsoft.Common.Section", - "label": "Tenant Replica Stopped", - "elements": [ - { - "name": "analytic105-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a tenant replica stops." - } - } - ] - }, - { - "name": "analytic106", - "type": "Microsoft.Common.Section", - "label": "Tenant State Changed", - "elements": [ - { - "name": "analytic106-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when tenant state is updated." - } - } - ] - }, - { - "name": "analytic107", - "type": "Microsoft.Common.Section", - "label": "User or Group Added", - "elements": [ - { - "name": "analytic107-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a user or user group is added to Veeam Backup & Replication." - } - } - ] - }, - { - "name": "analytic108", - "type": "Microsoft.Common.Section", - "label": "User or Group Deleted", - "elements": [ - { - "name": "analytic108-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a user or user group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic109", - "type": "Microsoft.Common.Section", - "label": "Best Practice Compliance Check Not Passed", - "elements": [ - { - "name": "analytic109-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a security best practice does not pass a compliance check in Veeam Security & Compliance Analyzer." - } - } - ] - }, - { - "name": "analytic110", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Application with No Recent Data Backup Sessions", - "elements": [ - { - "name": "analytic110-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects applications with no recent backup sessions." - } - } - ] - }, - { - "name": "analytic111", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Backup Copy RPO", - "elements": [ - { - "name": "analytic111-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects Veeam ONE Backup Copy RPO violation alerts." - } - } - ] - }, - { - "name": "analytic112", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Backup Server Security and Compliance State", - "elements": [ - { - "name": "analytic112-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects backup server security and compliance state issues." - } - } - ] - }, - { - "name": "analytic113", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Computer with No Backup", - "elements": [ - { - "name": "analytic113-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects computers with no backup." - } - } - ] - }, - { - "name": "analytic114", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Immutability Change Tracking", - "elements": [ - { - "name": "analytic114-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects changes in Veeam ONE immutability tracking configuration." - } - } - ] - }, - { - "name": "analytic115", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Immutability State", - "elements": [ - { - "name": "analytic115-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects changes in the immutability state of Veeam Backup & Replication repositories. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic116", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)", - "elements": [ - { - "name": "analytic116-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when Veeam Backup for Microsoft 365 jobs are disabled." - } - } - ] - }, - { - "name": "analytic117", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Job Disabled", - "elements": [ - { - "name": "analytic117-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a Veeam ONE job is disabled." - } - } - ] - }, - { - "name": "analytic118", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Possible Ransomware Activity (Hyper-V)", - "elements": [ - { - "name": "analytic118-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects Veeam ONE possible ransomware activity alerts for Microsoft Hyper-V." - } - } - ] - }, - { - "name": "analytic119", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Possible Ransomware Activity (vSphere)", - "elements": [ - { - "name": "analytic119-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects Veeam ONE possible ransomware activity alerts for VMware vSphere." - } - } - ] - }, - { - "name": "analytic120", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Suspicious Incremental Backup Size", - "elements": [ - { - "name": "analytic120-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects suspiciously large incremental backup sizes." - } - } - ] - }, - { - "name": "analytic121", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)", - "elements": [ - { - "name": "analytic121-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects Veeam Backup for Microsoft 365 jobs with unusual execution duration." - } - } - ] - }, - { - "name": "analytic122", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Unusual Job Duration", - "elements": [ - { - "name": "analytic122-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects Veeam ONE unusual job duration alerts." - } - } - ] - }, - { - "name": "analytic123", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE Malware Detection Change Tracking", - "elements": [ - { - "name": "analytic123-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects changes in Veeam ONE malware detection tracking." - } - } - ] - }, - { - "name": "analytic124", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE VM with No Backup (Hyper-V)", - "elements": [ - { - "name": "analytic124-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects Veeam ONE VMs with no backup (Hyper-V)." - } - } - ] - }, - { - "name": "analytic125", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE VM with No Backup", - "elements": [ - { - "name": "analytic125-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects Veeam ONE VMs with no backup." - } - } - ] - }, - { - "name": "analytic126", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE VM with No Replica (Hyper-V)", - "elements": [ - { - "name": "analytic126-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects Hyper-V VMs with no replica configured." - } - } - ] - }, - { - "name": "analytic127", - "type": "Microsoft.Common.Section", - "label": "Veeam ONE VM with No Replica", - "elements": [ - { - "name": "analytic127-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects Veeam ONE VMs with no replica configuration." - } - } - ] - }, - { - "name": "analytic128", - "type": "Microsoft.Common.Section", - "label": "Virtual Lab Deleted", - "elements": [ - { - "name": "analytic128-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a virtual lab is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic129", - "type": "Microsoft.Common.Section", - "label": "Virtual Lab Settings Updated", - "elements": [ - { - "name": "analytic129-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when virtual lab settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic130", - "type": "Microsoft.Common.Section", - "label": "WAN Accelerator Deleted", - "elements": [ - { - "name": "analytic130-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when a WAN accelerator is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." - } - } - ] - }, - { - "name": "analytic131", - "type": "Microsoft.Common.Section", - "label": "WAN Accelerator Settings Updated", - "elements": [ - { - "name": "analytic131-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects when WAN accelerator settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." - } - } - ] - }, - { - "name": "analytic132", - "type": "Microsoft.Common.Section", - "label": "Configuration Backup Failed", - "elements": [ - { - "name": "analytic132-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure." - } - } - ] } ] }, diff --git a/Solutions/Veeam/Package/mainTemplate.json b/Solutions/Veeam/Package/mainTemplate.json index ec853e471ba..1ada40cefb2 100644 --- a/Solutions/Veeam/Package/mainTemplate.json +++ b/Solutions/Veeam/Package/mainTemplate.json @@ -137,8 +137,8 @@ "email": "microsoftappsupport@veeam.com", "_email": "[variables('email')]", "_solutionName": "Veeam", - "_solutionVersion": "3.0.2", - "solutionId": "veeamsoftware.azure-sentinel-solution-veeamapp", + "_solutionVersion": "3.0.3", + "solutionId": "azuresentinel.azure-sentinel-solution-veeam", "_solutionId": "[variables('solutionId')]", "TemplateEmptyArray": "[json('[]')]", "uiConfigId1": "VeeamCustomTablesDataConnector", @@ -294,958 +294,6 @@ "_Coveware Settings": "[variables('Coveware Settings')]", "Veeam Collection Schedule Settings": "Veeam Collection Schedule Settings", "_Veeam Collection Schedule Settings": "[variables('Veeam Collection Schedule Settings')]", - "parserObject1": { - "_parserName1": "[concat(parameters('workspace'),'/','Veeam_GetJobFinished')]", - "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetJobFinished')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('Veeam_GetJobFinished-Parser')))]", - "parserVersion1": "1.0.0", - "parserContentId1": "Veeam_GetJobFinished-Parser" - }, - "parserObject2": { - "_parserName2": "[concat(parameters('workspace'),'/','Veeam_GetVeeamONEAlarms')]", - "_parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetVeeamONEAlarms')]", - "parserTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('Veeam_GetVeeamONEAlarms-Parser')))]", - "parserVersion2": "1.0.0", - "parserContentId2": "Veeam_GetVeeamONEAlarms-Parser" - }, - "parserObject3": { - "_parserName3": "[concat(parameters('workspace'),'/','Veeam_GetFinishedConfigurationBackupSessions')]", - "_parserId3": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetFinishedConfigurationBackupSessions')]", - "parserTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('Veeam_GetFinishedConfigurationBackupSessions-Parser')))]", - "parserVersion3": "1.0.0", - "parserContentId3": "Veeam_GetFinishedConfigurationBackupSessions-Parser" - }, - "parserObject4": { - "_parserName4": "[concat(parameters('workspace'),'/','Veeam_GetSecurityEvents')]", - "_parserId4": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetSecurityEvents')]", - "parserTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('Veeam_GetSecurityEvents-Parser')))]", - "parserVersion4": "1.0.0", - "parserContentId4": "Veeam_GetSecurityEvents-Parser" - }, - "analyticRuleObject1": { - "analyticRuleVersion1": "1.0.1", - "_analyticRulecontentId1": "6d1a5478-e613-44f4-a48f-12cc18568522", - "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6d1a5478-e613-44f4-a48f-12cc18568522')]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6d1a5478-e613-44f4-a48f-12cc18568522')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6d1a5478-e613-44f4-a48f-12cc18568522','-', '1.0.1')))]" - }, - "analyticRuleObject2": { - "analyticRuleVersion2": "1.0.1", - "_analyticRulecontentId2": "fa8d692d-5b00-4a6c-99b3-30b4710efa59", - "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'fa8d692d-5b00-4a6c-99b3-30b4710efa59')]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('fa8d692d-5b00-4a6c-99b3-30b4710efa59')))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fa8d692d-5b00-4a6c-99b3-30b4710efa59','-', '1.0.1')))]" - }, - "analyticRuleObject3": { - "analyticRuleVersion3": "1.0.1", - "_analyticRulecontentId3": "ff3ceb7d-bed0-4ed2-8dbf-1feb9047810f", - "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ff3ceb7d-bed0-4ed2-8dbf-1feb9047810f')]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ff3ceb7d-bed0-4ed2-8dbf-1feb9047810f')))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ff3ceb7d-bed0-4ed2-8dbf-1feb9047810f','-', '1.0.1')))]" - }, - "analyticRuleObject4": { - "analyticRuleVersion4": "1.0.1", - "_analyticRulecontentId4": "6a90f177-dcaa-44ec-b6e6-723ee8408cb2", - "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6a90f177-dcaa-44ec-b6e6-723ee8408cb2')]", - "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6a90f177-dcaa-44ec-b6e6-723ee8408cb2')))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6a90f177-dcaa-44ec-b6e6-723ee8408cb2','-', '1.0.1')))]" - }, - "analyticRuleObject5": { - "analyticRuleVersion5": "1.0.1", - "_analyticRulecontentId5": "74c3bda5-cdae-4af3-ab54-daddfbe8bc70", - "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '74c3bda5-cdae-4af3-ab54-daddfbe8bc70')]", - "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('74c3bda5-cdae-4af3-ab54-daddfbe8bc70')))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','74c3bda5-cdae-4af3-ab54-daddfbe8bc70','-', '1.0.1')))]" - }, - "analyticRuleObject6": { - "analyticRuleVersion6": "1.0.1", - "_analyticRulecontentId6": "4595192f-671b-4724-aa62-093a9724c2f3", - "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4595192f-671b-4724-aa62-093a9724c2f3')]", - "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4595192f-671b-4724-aa62-093a9724c2f3')))]", - "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4595192f-671b-4724-aa62-093a9724c2f3','-', '1.0.1')))]" - }, - "analyticRuleObject7": { - "analyticRuleVersion7": "1.0.1", - "_analyticRulecontentId7": "54c9a609-60db-47b0-82ee-86895c89bd89", - "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '54c9a609-60db-47b0-82ee-86895c89bd89')]", - "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('54c9a609-60db-47b0-82ee-86895c89bd89')))]", - "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','54c9a609-60db-47b0-82ee-86895c89bd89','-', '1.0.1')))]" - }, - "analyticRuleObject8": { - "analyticRuleVersion8": "1.0.1", - "_analyticRulecontentId8": "b8527d36-4cba-49c1-9cab-de9cdc3de879", - "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b8527d36-4cba-49c1-9cab-de9cdc3de879')]", - "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b8527d36-4cba-49c1-9cab-de9cdc3de879')))]", - "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b8527d36-4cba-49c1-9cab-de9cdc3de879','-', '1.0.1')))]" - }, - "analyticRuleObject9": { - "analyticRuleVersion9": "1.0.1", - "_analyticRulecontentId9": "73b4d1d5-c357-4350-bb58-924684a4792a", - "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '73b4d1d5-c357-4350-bb58-924684a4792a')]", - "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('73b4d1d5-c357-4350-bb58-924684a4792a')))]", - "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','73b4d1d5-c357-4350-bb58-924684a4792a','-', '1.0.1')))]" - }, - "analyticRuleObject10": { - "analyticRuleVersion10": "1.0.1", - "_analyticRulecontentId10": "f78e0bb9-2878-4e36-b9c9-6141bff8d3dd", - "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f78e0bb9-2878-4e36-b9c9-6141bff8d3dd')]", - "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f78e0bb9-2878-4e36-b9c9-6141bff8d3dd')))]", - "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f78e0bb9-2878-4e36-b9c9-6141bff8d3dd','-', '1.0.1')))]" - }, - "analyticRuleObject11": { - "analyticRuleVersion11": "1.0.1", - "_analyticRulecontentId11": "72239d5b-ef96-4f15-896f-6cdcd9c53ca7", - "analyticRuleId11": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '72239d5b-ef96-4f15-896f-6cdcd9c53ca7')]", - "analyticRuleTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('72239d5b-ef96-4f15-896f-6cdcd9c53ca7')))]", - "_analyticRulecontentProductId11": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','72239d5b-ef96-4f15-896f-6cdcd9c53ca7','-', '1.0.1')))]" - }, - "analyticRuleObject12": { - "analyticRuleVersion12": "1.0.1", - "_analyticRulecontentId12": "73e1d89b-79a6-4ab0-b3bb-5e564fcf10f1", - "analyticRuleId12": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '73e1d89b-79a6-4ab0-b3bb-5e564fcf10f1')]", - "analyticRuleTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('73e1d89b-79a6-4ab0-b3bb-5e564fcf10f1')))]", - "_analyticRulecontentProductId12": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','73e1d89b-79a6-4ab0-b3bb-5e564fcf10f1','-', '1.0.1')))]" - }, - "analyticRuleObject13": { - "analyticRuleVersion13": "1.0.1", - "_analyticRulecontentId13": "2b3b59eb-ea7c-45f6-9df8-8dbaed632317", - "analyticRuleId13": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2b3b59eb-ea7c-45f6-9df8-8dbaed632317')]", - "analyticRuleTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2b3b59eb-ea7c-45f6-9df8-8dbaed632317')))]", - "_analyticRulecontentProductId13": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2b3b59eb-ea7c-45f6-9df8-8dbaed632317','-', '1.0.1')))]" - }, - "analyticRuleObject14": { - "analyticRuleVersion14": "1.0.1", - "_analyticRulecontentId14": "9f0d4171-9a9f-42e4-acbf-9093dd4203de", - "analyticRuleId14": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9f0d4171-9a9f-42e4-acbf-9093dd4203de')]", - "analyticRuleTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9f0d4171-9a9f-42e4-acbf-9093dd4203de')))]", - "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9f0d4171-9a9f-42e4-acbf-9093dd4203de','-', '1.0.1')))]" - }, - "analyticRuleObject15": { - "analyticRuleVersion15": "1.0.1", - "_analyticRulecontentId15": "1f1634e5-585e-4187-ac5b-6d0e157bd2ea", - "analyticRuleId15": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1f1634e5-585e-4187-ac5b-6d0e157bd2ea')]", - "analyticRuleTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1f1634e5-585e-4187-ac5b-6d0e157bd2ea')))]", - "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1f1634e5-585e-4187-ac5b-6d0e157bd2ea','-', '1.0.1')))]" - }, - "analyticRuleObject16": { - "analyticRuleVersion16": "1.0.1", - "_analyticRulecontentId16": "18833d01-703a-438d-8ac6-84faa82e9b52", - "analyticRuleId16": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '18833d01-703a-438d-8ac6-84faa82e9b52')]", - "analyticRuleTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('18833d01-703a-438d-8ac6-84faa82e9b52')))]", - "_analyticRulecontentProductId16": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','18833d01-703a-438d-8ac6-84faa82e9b52','-', '1.0.1')))]" - }, - "analyticRuleObject17": { - "analyticRuleVersion17": "1.0.1", - "_analyticRulecontentId17": "90039769-0c32-442b-bb12-5b61224a77a0", - "analyticRuleId17": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '90039769-0c32-442b-bb12-5b61224a77a0')]", - "analyticRuleTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('90039769-0c32-442b-bb12-5b61224a77a0')))]", - "_analyticRulecontentProductId17": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','90039769-0c32-442b-bb12-5b61224a77a0','-', '1.0.1')))]" - }, - "analyticRuleObject18": { - "analyticRuleVersion18": "1.0.1", - "_analyticRulecontentId18": "8777f9e1-db58-4078-a381-4e47a3a2ee01", - "analyticRuleId18": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '8777f9e1-db58-4078-a381-4e47a3a2ee01')]", - "analyticRuleTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('8777f9e1-db58-4078-a381-4e47a3a2ee01')))]", - "_analyticRulecontentProductId18": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8777f9e1-db58-4078-a381-4e47a3a2ee01','-', '1.0.1')))]" - }, - "analyticRuleObject19": { - "analyticRuleVersion19": "1.0.1", - "_analyticRulecontentId19": "1edb50b5-fee1-4826-86f9-abaf0e4ce5a5", - "analyticRuleId19": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1edb50b5-fee1-4826-86f9-abaf0e4ce5a5')]", - "analyticRuleTemplateSpecName19": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1edb50b5-fee1-4826-86f9-abaf0e4ce5a5')))]", - "_analyticRulecontentProductId19": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1edb50b5-fee1-4826-86f9-abaf0e4ce5a5','-', '1.0.1')))]" - }, - "analyticRuleObject20": { - "analyticRuleVersion20": "1.0.1", - "_analyticRulecontentId20": "860e201a-deea-4129-8646-fcf8bdd976b0", - "analyticRuleId20": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '860e201a-deea-4129-8646-fcf8bdd976b0')]", - "analyticRuleTemplateSpecName20": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('860e201a-deea-4129-8646-fcf8bdd976b0')))]", - "_analyticRulecontentProductId20": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','860e201a-deea-4129-8646-fcf8bdd976b0','-', '1.0.1')))]" - }, - "analyticRuleObject21": { - "analyticRuleVersion21": "1.0.1", - "_analyticRulecontentId21": "e0d937ca-4582-4c3b-b95b-82fff33ed610", - "analyticRuleId21": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e0d937ca-4582-4c3b-b95b-82fff33ed610')]", - "analyticRuleTemplateSpecName21": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e0d937ca-4582-4c3b-b95b-82fff33ed610')))]", - "_analyticRulecontentProductId21": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e0d937ca-4582-4c3b-b95b-82fff33ed610','-', '1.0.1')))]" - }, - "analyticRuleObject22": { - "analyticRuleVersion22": "1.0.1", - "_analyticRulecontentId22": "cfc967be-0428-4ab0-8c15-06c85649078f", - "analyticRuleId22": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'cfc967be-0428-4ab0-8c15-06c85649078f')]", - "analyticRuleTemplateSpecName22": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('cfc967be-0428-4ab0-8c15-06c85649078f')))]", - "_analyticRulecontentProductId22": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cfc967be-0428-4ab0-8c15-06c85649078f','-', '1.0.1')))]" - }, - "analyticRuleObject23": { - "analyticRuleVersion23": "1.0.1", - "_analyticRulecontentId23": "58fcb721-35ec-4ea2-9f29-c99acde676b8", - "analyticRuleId23": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '58fcb721-35ec-4ea2-9f29-c99acde676b8')]", - "analyticRuleTemplateSpecName23": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('58fcb721-35ec-4ea2-9f29-c99acde676b8')))]", - "_analyticRulecontentProductId23": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','58fcb721-35ec-4ea2-9f29-c99acde676b8','-', '1.0.1')))]" - }, - "analyticRuleObject24": { - "analyticRuleVersion24": "1.0.1", - "_analyticRulecontentId24": "a2c6fe48-0d3d-416b-991c-a750ec50d7eb", - "analyticRuleId24": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a2c6fe48-0d3d-416b-991c-a750ec50d7eb')]", - "analyticRuleTemplateSpecName24": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a2c6fe48-0d3d-416b-991c-a750ec50d7eb')))]", - "_analyticRulecontentProductId24": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a2c6fe48-0d3d-416b-991c-a750ec50d7eb','-', '1.0.1')))]" - }, - "analyticRuleObject25": { - "analyticRuleVersion25": "1.0.1", - "_analyticRulecontentId25": "cc47b9d6-a10e-4c5e-94a1-c73a68273e2d", - "analyticRuleId25": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'cc47b9d6-a10e-4c5e-94a1-c73a68273e2d')]", - "analyticRuleTemplateSpecName25": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('cc47b9d6-a10e-4c5e-94a1-c73a68273e2d')))]", - "_analyticRulecontentProductId25": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cc47b9d6-a10e-4c5e-94a1-c73a68273e2d','-', '1.0.1')))]" - }, - "analyticRuleObject26": { - "analyticRuleVersion26": "1.0.1", - "_analyticRulecontentId26": "d035188d-d856-4a74-8226-f3bdf65033c4", - "analyticRuleId26": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd035188d-d856-4a74-8226-f3bdf65033c4')]", - "analyticRuleTemplateSpecName26": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d035188d-d856-4a74-8226-f3bdf65033c4')))]", - "_analyticRulecontentProductId26": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d035188d-d856-4a74-8226-f3bdf65033c4','-', '1.0.1')))]" - }, - "analyticRuleObject27": { - "analyticRuleVersion27": "1.0.1", - "_analyticRulecontentId27": "5f6f5a46-42d3-4961-94db-68b6229bc84e", - "analyticRuleId27": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5f6f5a46-42d3-4961-94db-68b6229bc84e')]", - "analyticRuleTemplateSpecName27": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5f6f5a46-42d3-4961-94db-68b6229bc84e')))]", - "_analyticRulecontentProductId27": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5f6f5a46-42d3-4961-94db-68b6229bc84e','-', '1.0.1')))]" - }, - "analyticRuleObject28": { - "analyticRuleVersion28": "1.0.1", - "_analyticRulecontentId28": "8f339b13-02f0-400f-be18-491ec0ba71f1", - "analyticRuleId28": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '8f339b13-02f0-400f-be18-491ec0ba71f1')]", - "analyticRuleTemplateSpecName28": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('8f339b13-02f0-400f-be18-491ec0ba71f1')))]", - "_analyticRulecontentProductId28": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8f339b13-02f0-400f-be18-491ec0ba71f1','-', '1.0.1')))]" - }, - "analyticRuleObject29": { - "analyticRuleVersion29": "1.0.1", - "_analyticRulecontentId29": "a053e7ba-e60c-482a-bbd8-89a25c53d905", - "analyticRuleId29": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a053e7ba-e60c-482a-bbd8-89a25c53d905')]", - "analyticRuleTemplateSpecName29": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a053e7ba-e60c-482a-bbd8-89a25c53d905')))]", - "_analyticRulecontentProductId29": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a053e7ba-e60c-482a-bbd8-89a25c53d905','-', '1.0.1')))]" - }, - "analyticRuleObject30": { - "analyticRuleVersion30": "1.0.1", - "_analyticRulecontentId30": "e06ec6d7-d9f6-4675-89bf-03fa8a0e0be0", - "analyticRuleId30": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e06ec6d7-d9f6-4675-89bf-03fa8a0e0be0')]", - "analyticRuleTemplateSpecName30": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e06ec6d7-d9f6-4675-89bf-03fa8a0e0be0')))]", - "_analyticRulecontentProductId30": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e06ec6d7-d9f6-4675-89bf-03fa8a0e0be0','-', '1.0.1')))]" - }, - "analyticRuleObject31": { - "analyticRuleVersion31": "1.0.1", - "_analyticRulecontentId31": "de4cc05b-2e4e-4104-9559-101b4c41c35e", - "analyticRuleId31": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'de4cc05b-2e4e-4104-9559-101b4c41c35e')]", - "analyticRuleTemplateSpecName31": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('de4cc05b-2e4e-4104-9559-101b4c41c35e')))]", - "_analyticRulecontentProductId31": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','de4cc05b-2e4e-4104-9559-101b4c41c35e','-', '1.0.1')))]" - }, - "analyticRuleObject32": { - "analyticRuleVersion32": "1.0.1", - "_analyticRulecontentId32": "d7f23105-6756-43ae-973c-48b7441559d5", - "analyticRuleId32": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd7f23105-6756-43ae-973c-48b7441559d5')]", - "analyticRuleTemplateSpecName32": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d7f23105-6756-43ae-973c-48b7441559d5')))]", - "_analyticRulecontentProductId32": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d7f23105-6756-43ae-973c-48b7441559d5','-', '1.0.1')))]" - }, - "analyticRuleObject33": { - "analyticRuleVersion33": "1.0.1", - "_analyticRulecontentId33": "62008da4-627e-47fe-b78a-62e1e23b3eb9", - "analyticRuleId33": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '62008da4-627e-47fe-b78a-62e1e23b3eb9')]", - "analyticRuleTemplateSpecName33": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('62008da4-627e-47fe-b78a-62e1e23b3eb9')))]", - "_analyticRulecontentProductId33": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','62008da4-627e-47fe-b78a-62e1e23b3eb9','-', '1.0.1')))]" - }, - "analyticRuleObject34": { - "analyticRuleVersion34": "1.0.1", - "_analyticRulecontentId34": "7ddaf8ef-b726-408b-b1a7-a7a4f92cbf6d", - "analyticRuleId34": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7ddaf8ef-b726-408b-b1a7-a7a4f92cbf6d')]", - "analyticRuleTemplateSpecName34": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7ddaf8ef-b726-408b-b1a7-a7a4f92cbf6d')))]", - "_analyticRulecontentProductId34": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7ddaf8ef-b726-408b-b1a7-a7a4f92cbf6d','-', '1.0.1')))]" - }, - "analyticRuleObject35": { - "analyticRuleVersion35": "1.0.1", - "_analyticRulecontentId35": "57a8ff3a-d4aa-456f-9c13-186026bae52e", - "analyticRuleId35": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '57a8ff3a-d4aa-456f-9c13-186026bae52e')]", - "analyticRuleTemplateSpecName35": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('57a8ff3a-d4aa-456f-9c13-186026bae52e')))]", - "_analyticRulecontentProductId35": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','57a8ff3a-d4aa-456f-9c13-186026bae52e','-', '1.0.1')))]" - }, - "analyticRuleObject36": { - "analyticRuleVersion36": "1.0.1", - "_analyticRulecontentId36": "fe6226cd-fee7-4d0d-88d2-160311207b57", - "analyticRuleId36": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'fe6226cd-fee7-4d0d-88d2-160311207b57')]", - "analyticRuleTemplateSpecName36": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('fe6226cd-fee7-4d0d-88d2-160311207b57')))]", - "_analyticRulecontentProductId36": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fe6226cd-fee7-4d0d-88d2-160311207b57','-', '1.0.1')))]" - }, - "analyticRuleObject37": { - "analyticRuleVersion37": "1.0.1", - "_analyticRulecontentId37": "a641dbe1-9590-46f8-a6d7-b5f24db6e126", - "analyticRuleId37": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a641dbe1-9590-46f8-a6d7-b5f24db6e126')]", - "analyticRuleTemplateSpecName37": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a641dbe1-9590-46f8-a6d7-b5f24db6e126')))]", - "_analyticRulecontentProductId37": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a641dbe1-9590-46f8-a6d7-b5f24db6e126','-', '1.0.1')))]" - }, - "analyticRuleObject38": { - "analyticRuleVersion38": "1.0.1", - "_analyticRulecontentId38": "dfd1d756-623d-4951-84a5-ce51f726d322", - "analyticRuleId38": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'dfd1d756-623d-4951-84a5-ce51f726d322')]", - "analyticRuleTemplateSpecName38": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('dfd1d756-623d-4951-84a5-ce51f726d322')))]", - "_analyticRulecontentProductId38": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','dfd1d756-623d-4951-84a5-ce51f726d322','-', '1.0.1')))]" - }, - "analyticRuleObject39": { - "analyticRuleVersion39": "1.0.1", - "_analyticRulecontentId39": "14003a45-da0b-47dc-8e20-9711ba7b5112", - "analyticRuleId39": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '14003a45-da0b-47dc-8e20-9711ba7b5112')]", - "analyticRuleTemplateSpecName39": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('14003a45-da0b-47dc-8e20-9711ba7b5112')))]", - "_analyticRulecontentProductId39": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','14003a45-da0b-47dc-8e20-9711ba7b5112','-', '1.0.1')))]" - }, - "analyticRuleObject40": { - "analyticRuleVersion40": "1.0.1", - "_analyticRulecontentId40": "0995ccd8-16d4-4764-83b2-511235ca4e4b", - "analyticRuleId40": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '0995ccd8-16d4-4764-83b2-511235ca4e4b')]", - "analyticRuleTemplateSpecName40": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('0995ccd8-16d4-4764-83b2-511235ca4e4b')))]", - "_analyticRulecontentProductId40": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','0995ccd8-16d4-4764-83b2-511235ca4e4b','-', '1.0.1')))]" - }, - "analyticRuleObject41": { - "analyticRuleVersion41": "1.0.1", - "_analyticRulecontentId41": "c9faf1ee-57dd-4f54-8cd1-fcf35a1aa424", - "analyticRuleId41": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c9faf1ee-57dd-4f54-8cd1-fcf35a1aa424')]", - "analyticRuleTemplateSpecName41": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c9faf1ee-57dd-4f54-8cd1-fcf35a1aa424')))]", - "_analyticRulecontentProductId41": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c9faf1ee-57dd-4f54-8cd1-fcf35a1aa424','-', '1.0.1')))]" - }, - "analyticRuleObject42": { - "analyticRuleVersion42": "1.0.1", - "_analyticRulecontentId42": "2034c441-2850-4167-80ed-b4438155836d", - "analyticRuleId42": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2034c441-2850-4167-80ed-b4438155836d')]", - "analyticRuleTemplateSpecName42": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2034c441-2850-4167-80ed-b4438155836d')))]", - "_analyticRulecontentProductId42": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2034c441-2850-4167-80ed-b4438155836d','-', '1.0.1')))]" - }, - "analyticRuleObject43": { - "analyticRuleVersion43": "1.0.1", - "_analyticRulecontentId43": "141d7e3c-a72b-49f7-9e64-57f60c2fa927", - "analyticRuleId43": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '141d7e3c-a72b-49f7-9e64-57f60c2fa927')]", - "analyticRuleTemplateSpecName43": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('141d7e3c-a72b-49f7-9e64-57f60c2fa927')))]", - "_analyticRulecontentProductId43": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','141d7e3c-a72b-49f7-9e64-57f60c2fa927','-', '1.0.1')))]" - }, - "analyticRuleObject44": { - "analyticRuleVersion44": "1.0.1", - "_analyticRulecontentId44": "5601e894-2d3c-42fd-bc71-f0350b1b0bc6", - "analyticRuleId44": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5601e894-2d3c-42fd-bc71-f0350b1b0bc6')]", - "analyticRuleTemplateSpecName44": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5601e894-2d3c-42fd-bc71-f0350b1b0bc6')))]", - "_analyticRulecontentProductId44": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5601e894-2d3c-42fd-bc71-f0350b1b0bc6','-', '1.0.1')))]" - }, - "analyticRuleObject45": { - "analyticRuleVersion45": "1.0.1", - "_analyticRulecontentId45": "ac1a85f1-0e3f-4ae8-9f59-a240fc04b03f", - "analyticRuleId45": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ac1a85f1-0e3f-4ae8-9f59-a240fc04b03f')]", - "analyticRuleTemplateSpecName45": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ac1a85f1-0e3f-4ae8-9f59-a240fc04b03f')))]", - "_analyticRulecontentProductId45": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ac1a85f1-0e3f-4ae8-9f59-a240fc04b03f','-', '1.0.1')))]" - }, - "analyticRuleObject46": { - "analyticRuleVersion46": "1.0.1", - "_analyticRulecontentId46": "4e41c85f-d495-4a23-a218-41b938140dce", - "analyticRuleId46": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4e41c85f-d495-4a23-a218-41b938140dce')]", - "analyticRuleTemplateSpecName46": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4e41c85f-d495-4a23-a218-41b938140dce')))]", - "_analyticRulecontentProductId46": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4e41c85f-d495-4a23-a218-41b938140dce','-', '1.0.1')))]" - }, - "analyticRuleObject47": { - "analyticRuleVersion47": "1.0.1", - "_analyticRulecontentId47": "580da4d1-8e39-4420-855d-3d4f653fe127", - "analyticRuleId47": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '580da4d1-8e39-4420-855d-3d4f653fe127')]", - "analyticRuleTemplateSpecName47": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('580da4d1-8e39-4420-855d-3d4f653fe127')))]", - "_analyticRulecontentProductId47": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','580da4d1-8e39-4420-855d-3d4f653fe127','-', '1.0.1')))]" - }, - "analyticRuleObject48": { - "analyticRuleVersion48": "1.0.1", - "_analyticRulecontentId48": "5220a0b0-ab15-43cf-a77e-2273d35cfe8e", - "analyticRuleId48": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5220a0b0-ab15-43cf-a77e-2273d35cfe8e')]", - "analyticRuleTemplateSpecName48": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5220a0b0-ab15-43cf-a77e-2273d35cfe8e')))]", - "_analyticRulecontentProductId48": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5220a0b0-ab15-43cf-a77e-2273d35cfe8e','-', '1.0.1')))]" - }, - "analyticRuleObject49": { - "analyticRuleVersion49": "1.0.1", - "_analyticRulecontentId49": "b4ea5da0-77a8-400e-ae2b-3ca8fdb779ef", - "analyticRuleId49": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b4ea5da0-77a8-400e-ae2b-3ca8fdb779ef')]", - "analyticRuleTemplateSpecName49": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b4ea5da0-77a8-400e-ae2b-3ca8fdb779ef')))]", - "_analyticRulecontentProductId49": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b4ea5da0-77a8-400e-ae2b-3ca8fdb779ef','-', '1.0.1')))]" - }, - "analyticRuleObject50": { - "analyticRuleVersion50": "1.0.1", - "_analyticRulecontentId50": "61c576ae-f81a-4151-8524-b08c86f206a8", - "analyticRuleId50": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '61c576ae-f81a-4151-8524-b08c86f206a8')]", - "analyticRuleTemplateSpecName50": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('61c576ae-f81a-4151-8524-b08c86f206a8')))]", - "_analyticRulecontentProductId50": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','61c576ae-f81a-4151-8524-b08c86f206a8','-', '1.0.1')))]" - }, - "analyticRuleObject51": { - "analyticRuleVersion51": "1.0.1", - "_analyticRulecontentId51": "f11f245e-f77e-4dc5-95f1-ce602c2a36ba", - "analyticRuleId51": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f11f245e-f77e-4dc5-95f1-ce602c2a36ba')]", - "analyticRuleTemplateSpecName51": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f11f245e-f77e-4dc5-95f1-ce602c2a36ba')))]", - "_analyticRulecontentProductId51": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f11f245e-f77e-4dc5-95f1-ce602c2a36ba','-', '1.0.1')))]" - }, - "analyticRuleObject52": { - "analyticRuleVersion52": "1.0.1", - "_analyticRulecontentId52": "9b5ab4b6-7cca-4779-9784-761b48a58e78", - "analyticRuleId52": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9b5ab4b6-7cca-4779-9784-761b48a58e78')]", - "analyticRuleTemplateSpecName52": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9b5ab4b6-7cca-4779-9784-761b48a58e78')))]", - "_analyticRulecontentProductId52": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9b5ab4b6-7cca-4779-9784-761b48a58e78','-', '1.0.1')))]" - }, - "analyticRuleObject53": { - "analyticRuleVersion53": "1.0.1", - "_analyticRulecontentId53": "594dafa1-e2d5-4f83-b32e-c629cb629b6f", - "analyticRuleId53": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '594dafa1-e2d5-4f83-b32e-c629cb629b6f')]", - "analyticRuleTemplateSpecName53": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('594dafa1-e2d5-4f83-b32e-c629cb629b6f')))]", - "_analyticRulecontentProductId53": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','594dafa1-e2d5-4f83-b32e-c629cb629b6f','-', '1.0.1')))]" - }, - "analyticRuleObject54": { - "analyticRuleVersion54": "1.0.1", - "_analyticRulecontentId54": "94724029-6ec3-4bf7-a0e9-c4e4cba0479f", - "analyticRuleId54": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '94724029-6ec3-4bf7-a0e9-c4e4cba0479f')]", - "analyticRuleTemplateSpecName54": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('94724029-6ec3-4bf7-a0e9-c4e4cba0479f')))]", - "_analyticRulecontentProductId54": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','94724029-6ec3-4bf7-a0e9-c4e4cba0479f','-', '1.0.1')))]" - }, - "analyticRuleObject55": { - "analyticRuleVersion55": "1.0.1", - "_analyticRulecontentId55": "79adb08a-8218-492d-acf0-f8aa596f3444", - "analyticRuleId55": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '79adb08a-8218-492d-acf0-f8aa596f3444')]", - "analyticRuleTemplateSpecName55": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('79adb08a-8218-492d-acf0-f8aa596f3444')))]", - "_analyticRulecontentProductId55": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','79adb08a-8218-492d-acf0-f8aa596f3444','-', '1.0.1')))]" - }, - "analyticRuleObject56": { - "analyticRuleVersion56": "1.0.1", - "_analyticRulecontentId56": "e4828d99-bb06-40b3-8f9d-0f68fb61e9ee", - "analyticRuleId56": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e4828d99-bb06-40b3-8f9d-0f68fb61e9ee')]", - "analyticRuleTemplateSpecName56": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e4828d99-bb06-40b3-8f9d-0f68fb61e9ee')))]", - "_analyticRulecontentProductId56": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e4828d99-bb06-40b3-8f9d-0f68fb61e9ee','-', '1.0.1')))]" - }, - "analyticRuleObject57": { - "analyticRuleVersion57": "1.0.1", - "_analyticRulecontentId57": "31ffa231-72da-49f0-88cd-de08eaf3bc52", - "analyticRuleId57": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '31ffa231-72da-49f0-88cd-de08eaf3bc52')]", - "analyticRuleTemplateSpecName57": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('31ffa231-72da-49f0-88cd-de08eaf3bc52')))]", - "_analyticRulecontentProductId57": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','31ffa231-72da-49f0-88cd-de08eaf3bc52','-', '1.0.1')))]" - }, - "analyticRuleObject58": { - "analyticRuleVersion58": "1.0.1", - "_analyticRulecontentId58": "8e4986ac-7388-4782-b389-0b0288123dbc", - "analyticRuleId58": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '8e4986ac-7388-4782-b389-0b0288123dbc')]", - "analyticRuleTemplateSpecName58": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('8e4986ac-7388-4782-b389-0b0288123dbc')))]", - "_analyticRulecontentProductId58": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8e4986ac-7388-4782-b389-0b0288123dbc','-', '1.0.1')))]" - }, - "analyticRuleObject59": { - "analyticRuleVersion59": "1.0.1", - "_analyticRulecontentId59": "7a6f7e95-b574-44ab-b215-f5c32a2378d1", - "analyticRuleId59": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7a6f7e95-b574-44ab-b215-f5c32a2378d1')]", - "analyticRuleTemplateSpecName59": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7a6f7e95-b574-44ab-b215-f5c32a2378d1')))]", - "_analyticRulecontentProductId59": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7a6f7e95-b574-44ab-b215-f5c32a2378d1','-', '1.0.1')))]" - }, - "analyticRuleObject60": { - "analyticRuleVersion60": "1.0.1", - "_analyticRulecontentId60": "3caa6e6d-a3e2-4776-be97-15d20e2675ed", - "analyticRuleId60": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3caa6e6d-a3e2-4776-be97-15d20e2675ed')]", - "analyticRuleTemplateSpecName60": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3caa6e6d-a3e2-4776-be97-15d20e2675ed')))]", - "_analyticRulecontentProductId60": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3caa6e6d-a3e2-4776-be97-15d20e2675ed','-', '1.0.1')))]" - }, - "analyticRuleObject61": { - "analyticRuleVersion61": "1.0.2", - "_analyticRulecontentId61": "9a7c80ef-8dc2-4b07-834d-b9ca18d603f7", - "analyticRuleId61": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9a7c80ef-8dc2-4b07-834d-b9ca18d603f7')]", - "analyticRuleTemplateSpecName61": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9a7c80ef-8dc2-4b07-834d-b9ca18d603f7')))]", - "_analyticRulecontentProductId61": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9a7c80ef-8dc2-4b07-834d-b9ca18d603f7','-', '1.0.2')))]" - }, - "analyticRuleObject62": { - "analyticRuleVersion62": "1.0.1", - "_analyticRulecontentId62": "401e91cb-b53f-41a5-b066-1c028b3b51db", - "analyticRuleId62": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '401e91cb-b53f-41a5-b066-1c028b3b51db')]", - "analyticRuleTemplateSpecName62": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('401e91cb-b53f-41a5-b066-1c028b3b51db')))]", - "_analyticRulecontentProductId62": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','401e91cb-b53f-41a5-b066-1c028b3b51db','-', '1.0.1')))]" - }, - "analyticRuleObject63": { - "analyticRuleVersion63": "1.0.1", - "_analyticRulecontentId63": "88b9223c-29ff-48a9-a745-c553aa0dbae2", - "analyticRuleId63": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '88b9223c-29ff-48a9-a745-c553aa0dbae2')]", - "analyticRuleTemplateSpecName63": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('88b9223c-29ff-48a9-a745-c553aa0dbae2')))]", - "_analyticRulecontentProductId63": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','88b9223c-29ff-48a9-a745-c553aa0dbae2','-', '1.0.1')))]" - }, - "analyticRuleObject64": { - "analyticRuleVersion64": "1.0.1", - "_analyticRulecontentId64": "effd8410-3119-41c8-a228-9c0c8ce10d67", - "analyticRuleId64": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'effd8410-3119-41c8-a228-9c0c8ce10d67')]", - "analyticRuleTemplateSpecName64": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('effd8410-3119-41c8-a228-9c0c8ce10d67')))]", - "_analyticRulecontentProductId64": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','effd8410-3119-41c8-a228-9c0c8ce10d67','-', '1.0.1')))]" - }, - "analyticRuleObject65": { - "analyticRuleVersion65": "1.0.1", - "_analyticRulecontentId65": "b42424a6-10f4-447b-92a0-55ac38f4a475", - "analyticRuleId65": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b42424a6-10f4-447b-92a0-55ac38f4a475')]", - "analyticRuleTemplateSpecName65": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b42424a6-10f4-447b-92a0-55ac38f4a475')))]", - "_analyticRulecontentProductId65": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b42424a6-10f4-447b-92a0-55ac38f4a475','-', '1.0.1')))]" - }, - "analyticRuleObject66": { - "analyticRuleVersion66": "1.0.1", - "_analyticRulecontentId66": "6881f4f5-f58e-43d7-a05e-b5d05a4c09f9", - "analyticRuleId66": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6881f4f5-f58e-43d7-a05e-b5d05a4c09f9')]", - "analyticRuleTemplateSpecName66": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6881f4f5-f58e-43d7-a05e-b5d05a4c09f9')))]", - "_analyticRulecontentProductId66": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6881f4f5-f58e-43d7-a05e-b5d05a4c09f9','-', '1.0.1')))]" - }, - "analyticRuleObject67": { - "analyticRuleVersion67": "1.0.1", - "_analyticRulecontentId67": "3fefd6c5-bbe9-49a9-95b2-d4b8a5591d9c", - "analyticRuleId67": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3fefd6c5-bbe9-49a9-95b2-d4b8a5591d9c')]", - "analyticRuleTemplateSpecName67": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3fefd6c5-bbe9-49a9-95b2-d4b8a5591d9c')))]", - "_analyticRulecontentProductId67": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3fefd6c5-bbe9-49a9-95b2-d4b8a5591d9c','-', '1.0.1')))]" - }, - "analyticRuleObject68": { - "analyticRuleVersion68": "1.0.1", - "_analyticRulecontentId68": "4d8f5244-cb56-4e95-ba65-0a7bec114a13", - "analyticRuleId68": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4d8f5244-cb56-4e95-ba65-0a7bec114a13')]", - "analyticRuleTemplateSpecName68": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4d8f5244-cb56-4e95-ba65-0a7bec114a13')))]", - "_analyticRulecontentProductId68": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4d8f5244-cb56-4e95-ba65-0a7bec114a13','-', '1.0.1')))]" - }, - "analyticRuleObject69": { - "analyticRuleVersion69": "1.0.1", - "_analyticRulecontentId69": "ebdd9cf8-c41c-460e-95d8-e5bc3cd9763e", - "analyticRuleId69": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ebdd9cf8-c41c-460e-95d8-e5bc3cd9763e')]", - "analyticRuleTemplateSpecName69": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ebdd9cf8-c41c-460e-95d8-e5bc3cd9763e')))]", - "_analyticRulecontentProductId69": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ebdd9cf8-c41c-460e-95d8-e5bc3cd9763e','-', '1.0.1')))]" - }, - "analyticRuleObject70": { - "analyticRuleVersion70": "1.0.1", - "_analyticRulecontentId70": "e92ba6bb-53ea-4347-b1a6-2e015298bbdc", - "analyticRuleId70": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e92ba6bb-53ea-4347-b1a6-2e015298bbdc')]", - "analyticRuleTemplateSpecName70": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e92ba6bb-53ea-4347-b1a6-2e015298bbdc')))]", - "_analyticRulecontentProductId70": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e92ba6bb-53ea-4347-b1a6-2e015298bbdc','-', '1.0.1')))]" - }, - "analyticRuleObject71": { - "analyticRuleVersion71": "1.0.1", - "_analyticRulecontentId71": "56d70592-077e-4e7b-9d8a-b5d8b0a6a52b", - "analyticRuleId71": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '56d70592-077e-4e7b-9d8a-b5d8b0a6a52b')]", - "analyticRuleTemplateSpecName71": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('56d70592-077e-4e7b-9d8a-b5d8b0a6a52b')))]", - "_analyticRulecontentProductId71": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','56d70592-077e-4e7b-9d8a-b5d8b0a6a52b','-', '1.0.1')))]" - }, - "analyticRuleObject72": { - "analyticRuleVersion72": "1.0.1", - "_analyticRulecontentId72": "6e4d1832-2cf9-410d-a5e2-c12b33c7d9f7", - "analyticRuleId72": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6e4d1832-2cf9-410d-a5e2-c12b33c7d9f7')]", - "analyticRuleTemplateSpecName72": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6e4d1832-2cf9-410d-a5e2-c12b33c7d9f7')))]", - "_analyticRulecontentProductId72": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6e4d1832-2cf9-410d-a5e2-c12b33c7d9f7','-', '1.0.1')))]" - }, - "analyticRuleObject73": { - "analyticRuleVersion73": "1.0.1", - "_analyticRulecontentId73": "1f6897bf-a05a-47b2-a5f9-4ba6fd34f715", - "analyticRuleId73": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1f6897bf-a05a-47b2-a5f9-4ba6fd34f715')]", - "analyticRuleTemplateSpecName73": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1f6897bf-a05a-47b2-a5f9-4ba6fd34f715')))]", - "_analyticRulecontentProductId73": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1f6897bf-a05a-47b2-a5f9-4ba6fd34f715','-', '1.0.1')))]" - }, - "analyticRuleObject74": { - "analyticRuleVersion74": "1.0.1", - "_analyticRulecontentId74": "a8ebf22b-a050-434c-8095-2267f206257a", - "analyticRuleId74": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a8ebf22b-a050-434c-8095-2267f206257a')]", - "analyticRuleTemplateSpecName74": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a8ebf22b-a050-434c-8095-2267f206257a')))]", - "_analyticRulecontentProductId74": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a8ebf22b-a050-434c-8095-2267f206257a','-', '1.0.1')))]" - }, - "analyticRuleObject75": { - "analyticRuleVersion75": "1.0.1", - "_analyticRulecontentId75": "f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca", - "analyticRuleId75": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca')]", - "analyticRuleTemplateSpecName75": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca')))]", - "_analyticRulecontentProductId75": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca','-', '1.0.1')))]" - }, - "analyticRuleObject76": { - "analyticRuleVersion76": "1.0.1", - "_analyticRulecontentId76": "5367e8fc-a150-468f-84f2-90ac1dabef15", - "analyticRuleId76": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5367e8fc-a150-468f-84f2-90ac1dabef15')]", - "analyticRuleTemplateSpecName76": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5367e8fc-a150-468f-84f2-90ac1dabef15')))]", - "_analyticRulecontentProductId76": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5367e8fc-a150-468f-84f2-90ac1dabef15','-', '1.0.1')))]" - }, - "analyticRuleObject77": { - "analyticRuleVersion77": "1.0.1", - "_analyticRulecontentId77": "af97a601-8fac-4628-bdad-5fc0511236b2", - "analyticRuleId77": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'af97a601-8fac-4628-bdad-5fc0511236b2')]", - "analyticRuleTemplateSpecName77": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('af97a601-8fac-4628-bdad-5fc0511236b2')))]", - "_analyticRulecontentProductId77": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','af97a601-8fac-4628-bdad-5fc0511236b2','-', '1.0.1')))]" - }, - "analyticRuleObject78": { - "analyticRuleVersion78": "1.0.1", - "_analyticRulecontentId78": "88a61215-b3e6-4c78-8acd-9078d9bcfdc3", - "analyticRuleId78": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '88a61215-b3e6-4c78-8acd-9078d9bcfdc3')]", - "analyticRuleTemplateSpecName78": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('88a61215-b3e6-4c78-8acd-9078d9bcfdc3')))]", - "_analyticRulecontentProductId78": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','88a61215-b3e6-4c78-8acd-9078d9bcfdc3','-', '1.0.1')))]" - }, - "analyticRuleObject79": { - "analyticRuleVersion79": "1.0.1", - "_analyticRulecontentId79": "e06b913f-7698-4b2c-96e6-d47a9f4f5de8", - "analyticRuleId79": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e06b913f-7698-4b2c-96e6-d47a9f4f5de8')]", - "analyticRuleTemplateSpecName79": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e06b913f-7698-4b2c-96e6-d47a9f4f5de8')))]", - "_analyticRulecontentProductId79": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e06b913f-7698-4b2c-96e6-d47a9f4f5de8','-', '1.0.1')))]" - }, - "analyticRuleObject80": { - "analyticRuleVersion80": "1.0.1", - "_analyticRulecontentId80": "5fda37e0-d67c-4e8d-b277-90e5eac2172c", - "analyticRuleId80": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5fda37e0-d67c-4e8d-b277-90e5eac2172c')]", - "analyticRuleTemplateSpecName80": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5fda37e0-d67c-4e8d-b277-90e5eac2172c')))]", - "_analyticRulecontentProductId80": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5fda37e0-d67c-4e8d-b277-90e5eac2172c','-', '1.0.1')))]" - }, - "analyticRuleObject81": { - "analyticRuleVersion81": "1.0.1", - "_analyticRulecontentId81": "e9b9efa5-4e19-4716-840b-51ef2feeaad1", - "analyticRuleId81": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e9b9efa5-4e19-4716-840b-51ef2feeaad1')]", - "analyticRuleTemplateSpecName81": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e9b9efa5-4e19-4716-840b-51ef2feeaad1')))]", - "_analyticRulecontentProductId81": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e9b9efa5-4e19-4716-840b-51ef2feeaad1','-', '1.0.1')))]" - }, - "analyticRuleObject82": { - "analyticRuleVersion82": "1.0.1", - "_analyticRulecontentId82": "9f37ded4-f27a-4ef6-b5e6-de6430070808", - "analyticRuleId82": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9f37ded4-f27a-4ef6-b5e6-de6430070808')]", - "analyticRuleTemplateSpecName82": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9f37ded4-f27a-4ef6-b5e6-de6430070808')))]", - "_analyticRulecontentProductId82": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9f37ded4-f27a-4ef6-b5e6-de6430070808','-', '1.0.1')))]" - }, - "analyticRuleObject83": { - "analyticRuleVersion83": "1.0.1", - "_analyticRulecontentId83": "c4c6cb50-9fc3-4ca9-a2df-22d527240309", - "analyticRuleId83": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c4c6cb50-9fc3-4ca9-a2df-22d527240309')]", - "analyticRuleTemplateSpecName83": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c4c6cb50-9fc3-4ca9-a2df-22d527240309')))]", - "_analyticRulecontentProductId83": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c4c6cb50-9fc3-4ca9-a2df-22d527240309','-', '1.0.1')))]" - }, - "analyticRuleObject84": { - "analyticRuleVersion84": "1.0.1", - "_analyticRulecontentId84": "bad9d4b8-41cb-41ba-82c8-e20e771b3440", - "analyticRuleId84": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'bad9d4b8-41cb-41ba-82c8-e20e771b3440')]", - "analyticRuleTemplateSpecName84": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('bad9d4b8-41cb-41ba-82c8-e20e771b3440')))]", - "_analyticRulecontentProductId84": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bad9d4b8-41cb-41ba-82c8-e20e771b3440','-', '1.0.1')))]" - }, - "analyticRuleObject85": { - "analyticRuleVersion85": "1.0.1", - "_analyticRulecontentId85": "4dc85727-573c-4722-8173-026e2a1d20db", - "analyticRuleId85": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4dc85727-573c-4722-8173-026e2a1d20db')]", - "analyticRuleTemplateSpecName85": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4dc85727-573c-4722-8173-026e2a1d20db')))]", - "_analyticRulecontentProductId85": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4dc85727-573c-4722-8173-026e2a1d20db','-', '1.0.1')))]" - }, - "analyticRuleObject86": { - "analyticRuleVersion86": "1.0.1", - "_analyticRulecontentId86": "12006091-95a7-4f21-b474-f74b0480a138", - "analyticRuleId86": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '12006091-95a7-4f21-b474-f74b0480a138')]", - "analyticRuleTemplateSpecName86": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('12006091-95a7-4f21-b474-f74b0480a138')))]", - "_analyticRulecontentProductId86": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','12006091-95a7-4f21-b474-f74b0480a138','-', '1.0.1')))]" - }, - "analyticRuleObject87": { - "analyticRuleVersion87": "1.0.1", - "_analyticRulecontentId87": "cbe9fcb2-8767-4965-887e-350710145386", - "analyticRuleId87": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'cbe9fcb2-8767-4965-887e-350710145386')]", - "analyticRuleTemplateSpecName87": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('cbe9fcb2-8767-4965-887e-350710145386')))]", - "_analyticRulecontentProductId87": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cbe9fcb2-8767-4965-887e-350710145386','-', '1.0.1')))]" - }, - "analyticRuleObject88": { - "analyticRuleVersion88": "1.0.1", - "_analyticRulecontentId88": "35fb4771-9b8f-47f7-bd5b-3085d584f7ce", - "analyticRuleId88": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '35fb4771-9b8f-47f7-bd5b-3085d584f7ce')]", - "analyticRuleTemplateSpecName88": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('35fb4771-9b8f-47f7-bd5b-3085d584f7ce')))]", - "_analyticRulecontentProductId88": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','35fb4771-9b8f-47f7-bd5b-3085d584f7ce','-', '1.0.1')))]" - }, - "analyticRuleObject89": { - "analyticRuleVersion89": "1.0.1", - "_analyticRulecontentId89": "40b8e739-1077-42d8-9501-b68736c2c4d2", - "analyticRuleId89": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '40b8e739-1077-42d8-9501-b68736c2c4d2')]", - "analyticRuleTemplateSpecName89": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('40b8e739-1077-42d8-9501-b68736c2c4d2')))]", - "_analyticRulecontentProductId89": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','40b8e739-1077-42d8-9501-b68736c2c4d2','-', '1.0.1')))]" - }, - "analyticRuleObject90": { - "analyticRuleVersion90": "1.0.1", - "_analyticRulecontentId90": "7cf8c19b-6cd2-4d0c-814b-45d34e68568b", - "analyticRuleId90": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7cf8c19b-6cd2-4d0c-814b-45d34e68568b')]", - "analyticRuleTemplateSpecName90": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7cf8c19b-6cd2-4d0c-814b-45d34e68568b')))]", - "_analyticRulecontentProductId90": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7cf8c19b-6cd2-4d0c-814b-45d34e68568b','-', '1.0.1')))]" - }, - "analyticRuleObject91": { - "analyticRuleVersion91": "1.0.1", - "_analyticRulecontentId91": "be47e508-e35b-4c63-979b-a75b72102344", - "analyticRuleId91": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'be47e508-e35b-4c63-979b-a75b72102344')]", - "analyticRuleTemplateSpecName91": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('be47e508-e35b-4c63-979b-a75b72102344')))]", - "_analyticRulecontentProductId91": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','be47e508-e35b-4c63-979b-a75b72102344','-', '1.0.1')))]" - }, - "analyticRuleObject92": { - "analyticRuleVersion92": "1.0.1", - "_analyticRulecontentId92": "1c23715c-3a28-4b98-b135-fece6e7dcb8b", - "analyticRuleId92": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1c23715c-3a28-4b98-b135-fece6e7dcb8b')]", - "analyticRuleTemplateSpecName92": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1c23715c-3a28-4b98-b135-fece6e7dcb8b')))]", - "_analyticRulecontentProductId92": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1c23715c-3a28-4b98-b135-fece6e7dcb8b','-', '1.0.1')))]" - }, - "analyticRuleObject93": { - "analyticRuleVersion93": "1.0.1", - "_analyticRulecontentId93": "e1d0d9ce-b7c9-4e28-883d-04429f80d6d7", - "analyticRuleId93": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e1d0d9ce-b7c9-4e28-883d-04429f80d6d7')]", - "analyticRuleTemplateSpecName93": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e1d0d9ce-b7c9-4e28-883d-04429f80d6d7')))]", - "_analyticRulecontentProductId93": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e1d0d9ce-b7c9-4e28-883d-04429f80d6d7','-', '1.0.1')))]" - }, - "analyticRuleObject94": { - "analyticRuleVersion94": "1.0.1", - "_analyticRulecontentId94": "b7409bbb-6f0c-43c4-bb63-b20add5eb717", - "analyticRuleId94": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b7409bbb-6f0c-43c4-bb63-b20add5eb717')]", - "analyticRuleTemplateSpecName94": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b7409bbb-6f0c-43c4-bb63-b20add5eb717')))]", - "_analyticRulecontentProductId94": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b7409bbb-6f0c-43c4-bb63-b20add5eb717','-', '1.0.1')))]" - }, - "analyticRuleObject95": { - "analyticRuleVersion95": "1.0.1", - "_analyticRulecontentId95": "06ba509c-606e-4967-baee-21815ae61f8e", - "analyticRuleId95": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '06ba509c-606e-4967-baee-21815ae61f8e')]", - "analyticRuleTemplateSpecName95": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('06ba509c-606e-4967-baee-21815ae61f8e')))]", - "_analyticRulecontentProductId95": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','06ba509c-606e-4967-baee-21815ae61f8e','-', '1.0.1')))]" - }, - "analyticRuleObject96": { - "analyticRuleVersion96": "1.0.1", - "_analyticRulecontentId96": "ecf98b4a-3986-4739-879d-dd446e839153", - "analyticRuleId96": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ecf98b4a-3986-4739-879d-dd446e839153')]", - "analyticRuleTemplateSpecName96": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ecf98b4a-3986-4739-879d-dd446e839153')))]", - "_analyticRulecontentProductId96": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ecf98b4a-3986-4739-879d-dd446e839153','-', '1.0.1')))]" - }, - "analyticRuleObject97": { - "analyticRuleVersion97": "1.0.1", - "_analyticRulecontentId97": "ceb625a3-a8d7-4a42-9ea1-40f01c337ecd", - "analyticRuleId97": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ceb625a3-a8d7-4a42-9ea1-40f01c337ecd')]", - "analyticRuleTemplateSpecName97": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ceb625a3-a8d7-4a42-9ea1-40f01c337ecd')))]", - "_analyticRulecontentProductId97": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ceb625a3-a8d7-4a42-9ea1-40f01c337ecd','-', '1.0.1')))]" - }, - "analyticRuleObject98": { - "analyticRuleVersion98": "1.0.1", - "_analyticRulecontentId98": "19ed623e-1b1c-45e0-ac74-c1e629fbf117", - "analyticRuleId98": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '19ed623e-1b1c-45e0-ac74-c1e629fbf117')]", - "analyticRuleTemplateSpecName98": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('19ed623e-1b1c-45e0-ac74-c1e629fbf117')))]", - "_analyticRulecontentProductId98": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','19ed623e-1b1c-45e0-ac74-c1e629fbf117','-', '1.0.1')))]" - }, - "analyticRuleObject99": { - "analyticRuleVersion99": "1.0.1", - "_analyticRulecontentId99": "d92b2d65-1037-41e2-8d04-c18b8403d895", - "analyticRuleId99": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd92b2d65-1037-41e2-8d04-c18b8403d895')]", - "analyticRuleTemplateSpecName99": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d92b2d65-1037-41e2-8d04-c18b8403d895')))]", - "_analyticRulecontentProductId99": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d92b2d65-1037-41e2-8d04-c18b8403d895','-', '1.0.1')))]" - }, - "analyticRuleObject100": { - "analyticRuleVersion100": "1.0.1", - "_analyticRulecontentId100": "fda79d00-9e6a-46f8-b7a2-2bdccd5f598e", - "analyticRuleId100": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'fda79d00-9e6a-46f8-b7a2-2bdccd5f598e')]", - "analyticRuleTemplateSpecName100": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('fda79d00-9e6a-46f8-b7a2-2bdccd5f598e')))]", - "_analyticRulecontentProductId100": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fda79d00-9e6a-46f8-b7a2-2bdccd5f598e','-', '1.0.1')))]" - }, - "analyticRuleObject101": { - "analyticRuleVersion101": "1.0.1", - "_analyticRulecontentId101": "afec0070-2b46-4366-a272-e2d9cc8a50f2", - "analyticRuleId101": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'afec0070-2b46-4366-a272-e2d9cc8a50f2')]", - "analyticRuleTemplateSpecName101": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('afec0070-2b46-4366-a272-e2d9cc8a50f2')))]", - "_analyticRulecontentProductId101": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','afec0070-2b46-4366-a272-e2d9cc8a50f2','-', '1.0.1')))]" - }, - "analyticRuleObject102": { - "analyticRuleVersion102": "1.0.1", - "_analyticRulecontentId102": "da25b390-b97a-4ea4-abe3-5bbd7f90642c", - "analyticRuleId102": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'da25b390-b97a-4ea4-abe3-5bbd7f90642c')]", - "analyticRuleTemplateSpecName102": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('da25b390-b97a-4ea4-abe3-5bbd7f90642c')))]", - "_analyticRulecontentProductId102": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','da25b390-b97a-4ea4-abe3-5bbd7f90642c','-', '1.0.1')))]" - }, - "analyticRuleObject103": { - "analyticRuleVersion103": "1.0.1", - "_analyticRulecontentId103": "16183d97-c348-4f72-a943-27e80c9dfbd5", - "analyticRuleId103": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '16183d97-c348-4f72-a943-27e80c9dfbd5')]", - "analyticRuleTemplateSpecName103": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('16183d97-c348-4f72-a943-27e80c9dfbd5')))]", - "_analyticRulecontentProductId103": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','16183d97-c348-4f72-a943-27e80c9dfbd5','-', '1.0.1')))]" - }, - "analyticRuleObject104": { - "analyticRuleVersion104": "1.0.1", - "_analyticRulecontentId104": "c4d891cd-4b22-419c-8f40-7603eb1cc3a3", - "analyticRuleId104": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c4d891cd-4b22-419c-8f40-7603eb1cc3a3')]", - "analyticRuleTemplateSpecName104": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c4d891cd-4b22-419c-8f40-7603eb1cc3a3')))]", - "_analyticRulecontentProductId104": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c4d891cd-4b22-419c-8f40-7603eb1cc3a3','-', '1.0.1')))]" - }, - "analyticRuleObject105": { - "analyticRuleVersion105": "1.0.1", - "_analyticRulecontentId105": "ef029652-d004-44e9-a70a-48dd71818aaa", - "analyticRuleId105": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ef029652-d004-44e9-a70a-48dd71818aaa')]", - "analyticRuleTemplateSpecName105": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ef029652-d004-44e9-a70a-48dd71818aaa')))]", - "_analyticRulecontentProductId105": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ef029652-d004-44e9-a70a-48dd71818aaa','-', '1.0.1')))]" - }, - "analyticRuleObject106": { - "analyticRuleVersion106": "1.0.1", - "_analyticRulecontentId106": "71711b77-486c-41d0-9de0-dcc411fa7b05", - "analyticRuleId106": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '71711b77-486c-41d0-9de0-dcc411fa7b05')]", - "analyticRuleTemplateSpecName106": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('71711b77-486c-41d0-9de0-dcc411fa7b05')))]", - "_analyticRulecontentProductId106": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','71711b77-486c-41d0-9de0-dcc411fa7b05','-', '1.0.1')))]" - }, - "analyticRuleObject107": { - "analyticRuleVersion107": "1.0.1", - "_analyticRulecontentId107": "25111c10-44b5-4275-996d-d62f15a7d072", - "analyticRuleId107": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '25111c10-44b5-4275-996d-d62f15a7d072')]", - "analyticRuleTemplateSpecName107": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('25111c10-44b5-4275-996d-d62f15a7d072')))]", - "_analyticRulecontentProductId107": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','25111c10-44b5-4275-996d-d62f15a7d072','-', '1.0.1')))]" - }, - "analyticRuleObject108": { - "analyticRuleVersion108": "1.0.1", - "_analyticRulecontentId108": "d297961f-f8a3-4f84-865d-ec3a07641699", - "analyticRuleId108": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd297961f-f8a3-4f84-865d-ec3a07641699')]", - "analyticRuleTemplateSpecName108": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d297961f-f8a3-4f84-865d-ec3a07641699')))]", - "_analyticRulecontentProductId108": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d297961f-f8a3-4f84-865d-ec3a07641699','-', '1.0.1')))]" - }, - "analyticRuleObject109": { - "analyticRuleVersion109": "1.0.1", - "_analyticRulecontentId109": "f920ac64-dfd0-4dea-9b7c-acecf1ea2b28", - "analyticRuleId109": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f920ac64-dfd0-4dea-9b7c-acecf1ea2b28')]", - "analyticRuleTemplateSpecName109": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f920ac64-dfd0-4dea-9b7c-acecf1ea2b28')))]", - "_analyticRulecontentProductId109": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f920ac64-dfd0-4dea-9b7c-acecf1ea2b28','-', '1.0.1')))]" - }, - "analyticRuleObject110": { - "analyticRuleVersion110": "1.0.1", - "_analyticRulecontentId110": "73e36985-d65d-4852-b3cc-5e8f4b64b39c", - "analyticRuleId110": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '73e36985-d65d-4852-b3cc-5e8f4b64b39c')]", - "analyticRuleTemplateSpecName110": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('73e36985-d65d-4852-b3cc-5e8f4b64b39c')))]", - "_analyticRulecontentProductId110": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','73e36985-d65d-4852-b3cc-5e8f4b64b39c','-', '1.0.1')))]" - }, - "analyticRuleObject111": { - "analyticRuleVersion111": "1.0.1", - "_analyticRulecontentId111": "7fb6d1b6-48e4-442b-ba4d-1b5fb5fa379b", - "analyticRuleId111": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7fb6d1b6-48e4-442b-ba4d-1b5fb5fa379b')]", - "analyticRuleTemplateSpecName111": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7fb6d1b6-48e4-442b-ba4d-1b5fb5fa379b')))]", - "_analyticRulecontentProductId111": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7fb6d1b6-48e4-442b-ba4d-1b5fb5fa379b','-', '1.0.1')))]" - }, - "analyticRuleObject112": { - "analyticRuleVersion112": "1.0.1", - "_analyticRulecontentId112": "7ad4b9ff-8089-4b70-b98e-a2ca995611e9", - "analyticRuleId112": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7ad4b9ff-8089-4b70-b98e-a2ca995611e9')]", - "analyticRuleTemplateSpecName112": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7ad4b9ff-8089-4b70-b98e-a2ca995611e9')))]", - "_analyticRulecontentProductId112": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7ad4b9ff-8089-4b70-b98e-a2ca995611e9','-', '1.0.1')))]" - }, - "analyticRuleObject113": { - "analyticRuleVersion113": "1.0.1", - "_analyticRulecontentId113": "c0ead324-d8e8-484d-b590-9639f5ac5d93", - "analyticRuleId113": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c0ead324-d8e8-484d-b590-9639f5ac5d93')]", - "analyticRuleTemplateSpecName113": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c0ead324-d8e8-484d-b590-9639f5ac5d93')))]", - "_analyticRulecontentProductId113": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c0ead324-d8e8-484d-b590-9639f5ac5d93','-', '1.0.1')))]" - }, - "analyticRuleObject114": { - "analyticRuleVersion114": "1.0.1", - "_analyticRulecontentId114": "21ef1e12-75ac-43be-a77e-d2cee4c69225", - "analyticRuleId114": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '21ef1e12-75ac-43be-a77e-d2cee4c69225')]", - "analyticRuleTemplateSpecName114": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('21ef1e12-75ac-43be-a77e-d2cee4c69225')))]", - "_analyticRulecontentProductId114": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','21ef1e12-75ac-43be-a77e-d2cee4c69225','-', '1.0.1')))]" - }, - "analyticRuleObject115": { - "analyticRuleVersion115": "1.0.1", - "_analyticRulecontentId115": "b5785a66-3722-4bdc-9d12-bb40f2cf4824", - "analyticRuleId115": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b5785a66-3722-4bdc-9d12-bb40f2cf4824')]", - "analyticRuleTemplateSpecName115": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b5785a66-3722-4bdc-9d12-bb40f2cf4824')))]", - "_analyticRulecontentProductId115": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b5785a66-3722-4bdc-9d12-bb40f2cf4824','-', '1.0.1')))]" - }, - "analyticRuleObject116": { - "analyticRuleVersion116": "1.0.1", - "_analyticRulecontentId116": "176abf3c-392a-47bd-b565-a4ecfd0ff7ec", - "analyticRuleId116": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '176abf3c-392a-47bd-b565-a4ecfd0ff7ec')]", - "analyticRuleTemplateSpecName116": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('176abf3c-392a-47bd-b565-a4ecfd0ff7ec')))]", - "_analyticRulecontentProductId116": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','176abf3c-392a-47bd-b565-a4ecfd0ff7ec','-', '1.0.1')))]" - }, - "analyticRuleObject117": { - "analyticRuleVersion117": "1.0.1", - "_analyticRulecontentId117": "1a9e31d6-2116-4ff1-8ee7-abc957c34350", - "analyticRuleId117": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1a9e31d6-2116-4ff1-8ee7-abc957c34350')]", - "analyticRuleTemplateSpecName117": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1a9e31d6-2116-4ff1-8ee7-abc957c34350')))]", - "_analyticRulecontentProductId117": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1a9e31d6-2116-4ff1-8ee7-abc957c34350','-', '1.0.1')))]" - }, - "analyticRuleObject118": { - "analyticRuleVersion118": "1.0.1", - "_analyticRulecontentId118": "d48f9671-adc0-45e5-a477-670ef38bc132", - "analyticRuleId118": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd48f9671-adc0-45e5-a477-670ef38bc132')]", - "analyticRuleTemplateSpecName118": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d48f9671-adc0-45e5-a477-670ef38bc132')))]", - "_analyticRulecontentProductId118": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d48f9671-adc0-45e5-a477-670ef38bc132','-', '1.0.1')))]" - }, - "analyticRuleObject119": { - "analyticRuleVersion119": "1.0.1", - "_analyticRulecontentId119": "37d97c4d-a42f-495b-a523-376416b278b5", - "analyticRuleId119": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '37d97c4d-a42f-495b-a523-376416b278b5')]", - "analyticRuleTemplateSpecName119": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('37d97c4d-a42f-495b-a523-376416b278b5')))]", - "_analyticRulecontentProductId119": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','37d97c4d-a42f-495b-a523-376416b278b5','-', '1.0.1')))]" - }, - "analyticRuleObject120": { - "analyticRuleVersion120": "1.0.1", - "_analyticRulecontentId120": "8bb38c66-ca2a-4ad0-9b49-1e60368f8a19", - "analyticRuleId120": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '8bb38c66-ca2a-4ad0-9b49-1e60368f8a19')]", - "analyticRuleTemplateSpecName120": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('8bb38c66-ca2a-4ad0-9b49-1e60368f8a19')))]", - "_analyticRulecontentProductId120": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8bb38c66-ca2a-4ad0-9b49-1e60368f8a19','-', '1.0.1')))]" - }, - "analyticRuleObject121": { - "analyticRuleVersion121": "1.0.1", - "_analyticRulecontentId121": "cab7396a-9a18-45e7-b685-945e8bf825cb", - "analyticRuleId121": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'cab7396a-9a18-45e7-b685-945e8bf825cb')]", - "analyticRuleTemplateSpecName121": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('cab7396a-9a18-45e7-b685-945e8bf825cb')))]", - "_analyticRulecontentProductId121": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cab7396a-9a18-45e7-b685-945e8bf825cb','-', '1.0.1')))]" - }, - "analyticRuleObject122": { - "analyticRuleVersion122": "1.0.1", - "_analyticRulecontentId122": "04530ba4-b26e-4a83-8057-a4fc286de848", - "analyticRuleId122": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '04530ba4-b26e-4a83-8057-a4fc286de848')]", - "analyticRuleTemplateSpecName122": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('04530ba4-b26e-4a83-8057-a4fc286de848')))]", - "_analyticRulecontentProductId122": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','04530ba4-b26e-4a83-8057-a4fc286de848','-', '1.0.1')))]" - }, - "analyticRuleObject123": { - "analyticRuleVersion123": "1.0.1", - "_analyticRulecontentId123": "2a860019-0eda-4b49-bc62-8f683aed4929", - "analyticRuleId123": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2a860019-0eda-4b49-bc62-8f683aed4929')]", - "analyticRuleTemplateSpecName123": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2a860019-0eda-4b49-bc62-8f683aed4929')))]", - "_analyticRulecontentProductId123": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2a860019-0eda-4b49-bc62-8f683aed4929','-', '1.0.1')))]" - }, - "analyticRuleObject124": { - "analyticRuleVersion124": "1.0.1", - "_analyticRulecontentId124": "ae880194-5766-46d3-a17b-c8c53e9ca96c", - "analyticRuleId124": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ae880194-5766-46d3-a17b-c8c53e9ca96c')]", - "analyticRuleTemplateSpecName124": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ae880194-5766-46d3-a17b-c8c53e9ca96c')))]", - "_analyticRulecontentProductId124": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ae880194-5766-46d3-a17b-c8c53e9ca96c','-', '1.0.1')))]" - }, - "analyticRuleObject125": { - "analyticRuleVersion125": "1.0.1", - "_analyticRulecontentId125": "0e76e420-fa55-4718-adc6-40a1a76411af", - "analyticRuleId125": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '0e76e420-fa55-4718-adc6-40a1a76411af')]", - "analyticRuleTemplateSpecName125": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('0e76e420-fa55-4718-adc6-40a1a76411af')))]", - "_analyticRulecontentProductId125": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','0e76e420-fa55-4718-adc6-40a1a76411af','-', '1.0.1')))]" - }, - "analyticRuleObject126": { - "analyticRuleVersion126": "1.0.1", - "_analyticRulecontentId126": "6117e317-4b90-4bcc-a71f-0c1f29d82ce3", - "analyticRuleId126": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6117e317-4b90-4bcc-a71f-0c1f29d82ce3')]", - "analyticRuleTemplateSpecName126": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6117e317-4b90-4bcc-a71f-0c1f29d82ce3')))]", - "_analyticRulecontentProductId126": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6117e317-4b90-4bcc-a71f-0c1f29d82ce3','-', '1.0.1')))]" - }, - "analyticRuleObject127": { - "analyticRuleVersion127": "1.0.1", - "_analyticRulecontentId127": "128ea2a4-1047-4f28-ad55-b1b88357d172", - "analyticRuleId127": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '128ea2a4-1047-4f28-ad55-b1b88357d172')]", - "analyticRuleTemplateSpecName127": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('128ea2a4-1047-4f28-ad55-b1b88357d172')))]", - "_analyticRulecontentProductId127": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','128ea2a4-1047-4f28-ad55-b1b88357d172','-', '1.0.1')))]" - }, - "analyticRuleObject128": { - "analyticRuleVersion128": "1.0.1", - "_analyticRulecontentId128": "384e92a7-103c-4a47-945d-381ae9653f91", - "analyticRuleId128": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '384e92a7-103c-4a47-945d-381ae9653f91')]", - "analyticRuleTemplateSpecName128": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('384e92a7-103c-4a47-945d-381ae9653f91')))]", - "_analyticRulecontentProductId128": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','384e92a7-103c-4a47-945d-381ae9653f91','-', '1.0.1')))]" - }, - "analyticRuleObject129": { - "analyticRuleVersion129": "1.0.1", - "_analyticRulecontentId129": "a21eccd5-0148-4f88-a5d7-a8f86e9e4d8e", - "analyticRuleId129": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a21eccd5-0148-4f88-a5d7-a8f86e9e4d8e')]", - "analyticRuleTemplateSpecName129": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a21eccd5-0148-4f88-a5d7-a8f86e9e4d8e')))]", - "_analyticRulecontentProductId129": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a21eccd5-0148-4f88-a5d7-a8f86e9e4d8e','-', '1.0.1')))]" - }, - "analyticRuleObject130": { - "analyticRuleVersion130": "1.0.1", - "_analyticRulecontentId130": "5b19f19b-d92c-486f-be98-ba2c5945e240", - "analyticRuleId130": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5b19f19b-d92c-486f-be98-ba2c5945e240')]", - "analyticRuleTemplateSpecName130": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5b19f19b-d92c-486f-be98-ba2c5945e240')))]", - "_analyticRulecontentProductId130": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5b19f19b-d92c-486f-be98-ba2c5945e240','-', '1.0.1')))]" - }, - "analyticRuleObject131": { - "analyticRuleVersion131": "1.0.1", - "_analyticRulecontentId131": "2e4fe360-ce67-433b-930e-42f83058dfd0", - "analyticRuleId131": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2e4fe360-ce67-433b-930e-42f83058dfd0')]", - "analyticRuleTemplateSpecName131": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2e4fe360-ce67-433b-930e-42f83058dfd0')))]", - "_analyticRulecontentProductId131": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2e4fe360-ce67-433b-930e-42f83058dfd0','-', '1.0.1')))]" - }, - "analyticRuleObject132": { - "analyticRuleVersion132": "1.0.2", - "_analyticRulecontentId132": "259ef474-836d-4662-86ef-70cb7a38e765", - "analyticRuleId132": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '259ef474-836d-4662-86ef-70cb7a38e765')]", - "analyticRuleTemplateSpecName132": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('259ef474-836d-4662-86ef-70cb7a38e765')))]", - "_analyticRulecontentProductId132": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','259ef474-836d-4662-86ef-70cb7a38e765','-', '1.0.2')))]" - }, "workbookVersion1": "1.0.1", "workbookContentId1": "VeeamDataPlatformMonitoringWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", @@ -1270,7 +318,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam data connector with template version 3.0.2", + "description": "Veeam data connector with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -1445,10 +493,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -1490,10 +538,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } }, @@ -1655,7 +703,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-ChangeCollectionTime Playbook with template version 3.0.2", + "description": "Veeam-ChangeCollectionTime Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -2214,10 +1262,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -2282,7 +1330,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectVeeamAuthorizationEvents Playbook with template version 3.0.2", + "description": "Veeam-CollectVeeamAuthorizationEvents Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -2586,10 +1634,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -2648,7 +1696,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectSecurityComplianceAnalyzerResult Playbook with template version 3.0.2", + "description": "Veeam-CollectSecurityComplianceAnalyzerResult Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -2952,10 +2000,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -3015,7 +2063,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectMalwareEvents Playbook with template version 3.0.2", + "description": "Veeam-CollectMalwareEvents Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -3315,10 +2363,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -3377,7 +2425,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectVeeamONEAlarms Playbook with template version 3.0.2", + "description": "Veeam-CollectVeeamONEAlarms Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion5')]", @@ -3681,10 +2729,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -3744,7 +2792,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectCovewareFindings Playbook with template version 3.0.2", + "description": "Veeam-CollectCovewareFindings Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion6')]", @@ -4048,10 +3096,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -4109,7 +3157,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectConfigurationBackups Playbook with template version 3.0.2", + "description": "Veeam-CollectConfigurationBackups Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion7')]", @@ -4636,10 +3684,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -4704,7 +3752,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-FindCleanRestorePoints Playbook with template version 3.0.2", + "description": "Veeam-FindCleanRestorePoints Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion8')]", @@ -5074,10 +4122,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -5140,7 +4188,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-PerformScanBackup Playbook with template version 3.0.2", + "description": "Veeam-PerformScanBackup Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion9')]", @@ -5645,10 +4693,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -5706,7 +4754,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-PerformInstantVMRecovery Playbook with template version 3.0.2", + "description": "Veeam-PerformInstantVMRecovery Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion10')]", @@ -6291,10 +5339,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -6351,7 +5399,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-ResolveTriggeredAlarm Playbook with template version 3.0.2", + "description": "Veeam-ResolveTriggeredAlarm Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion11')]", @@ -6653,10 +5701,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -6719,7 +5767,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-StartSecurityComplianceAnalyzer Playbook with template version 3.0.2", + "description": "Veeam-StartSecurityComplianceAnalyzer Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion12')]", @@ -6997,10 +6045,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -7056,7 +6104,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-PerformConfigurationBackupOnIncident Playbook with template version 3.0.2", + "description": "Veeam-PerformConfigurationBackupOnIncident Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion13')]", @@ -7608,10 +6656,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -7674,7 +6722,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-StartQuickBackup Playbook with template version 3.0.2", + "description": "Veeam-StartQuickBackup Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion14')]", @@ -8228,10 +7276,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -8294,7 +7342,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-SetupConnections Playbook with template version 3.0.2", + "description": "Veeam-SetupConnections Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion15')]", @@ -10358,10 +9406,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } } @@ -10615,55 +9663,49 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('parserObject1').parserTemplateSpecName1]", + "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_GetJobFinished Data Parser with template version 3.0.2", + "description": "VeeamDataPlatformMonitoring Workbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserObject1').parserVersion1]", + "contentVersion": "[variables('workbookVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[variables('parserObject1')._parserName1]", - "apiVersion": "2022-10-01", - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "The Veeam Data Platform Monitoring dashboard shows an aggregated view of job activity on your Veeam Backup & Replication servers." + }, "properties": { - "eTag": "*", - "displayName": "Parser for Veeam Job Finished Events", - "category": "Microsoft Sentinel Parser", - "functionAlias": "Veeam_GetJobFinished", - "query": "let vbr_events_lookup = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nlet action_results_lookup = union isfuzzy=true \n (datatable(JobResult:string, JobResultMessage:string)[]),\n (_GetWatchlist(\"action_results_lookup\")); \nlet job_types_lookup = union isfuzzy=true \n (datatable(JobType:string, JobTypeDescription:string)[]),\n (_GetWatchlist(\"job_types_lookup\")); \nSyslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId in (\"150\", \"151\", \"190\", \"194\", \"198\", \"200\", \"250\", \"251\", \"290\", \"390\", \"450\", \"451\", \"490\", \"590\", \"592\", \"610\", \"790\", \"36022\", \"36026\", \"40290\", \"40800\")\n| lookup kind=leftouter (vbr_events_lookup) \n on $left.instanceId == $right.ID\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend event_module = Type1, original_host = Computer \n| extend Result = extract(\"Result=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend Status = extract(\"Status=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend JobResultCode = case(\n instanceId in (\"198\", \"290\", \"40290\", \"42210\", \"42500\"), Result,\n instanceId in (\"150\", \"151\", \"450\", \"451\"), Status,\n extract(\"JobResult=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n)\n| lookup kind=leftouter (action_results_lookup)\n on $left.JobResultCode == $right.JobResult\n| extend Platform = extract(\"Platform=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend Version = extract(\"Version=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend JobSessionID = extract(\"JobSessionID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend JobID = extract(\"JobID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend JobType = case ( \n instanceId == \"198\", \"198\",\n instanceId == \"290\", \"198\",\n instanceId == \"40800\", \"40800\",\n instanceId == \"40290\", \"290\",\n extract(\"JobType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n)\n| lookup kind=leftouter (job_types_lookup)\n on $left.JobType == $right.JobType\n| extend Allowance = Severity != 'disabled'\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult = JobResultCode, JobResultMessage, JobType, JobTypeDescription, Allowance, SyslogMessage\n", - "functionParameters": "", - "version": 2, - "tags": [ - { - "name": "description", - "value": "" - } - ] + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0b767a3f-72a6-495b-a08e-198348d4efb9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}]},\"value\":{\"durationMs\":2592000000}},{\"id\":\"3ec1d354-0588-43dd-b3e5-7ebab2195c40\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"host_token\",\"label\":\"Veeam Backup & Replication Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetJobFinished\\r\\n| summarize by original_host\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# All Jobs\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where not (instanceId in (\\\"40290\\\", \\\"40800\\\", \\\"150\\\", \\\"450\\\", \\\"151\\\", \\\"451\\\"))\\r\\n| where Allowance\\r\\n| summarize count() by JobResultMessage = JobResultMessage\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":86400000},\"exportFieldName\":\"JobResultMessage\",\"exportParameterName\":\"ResultMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"JobResultMessage\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"purple\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"sortCriteriaField\":\"count_\"}},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (150, 151)\\r\\n| where Allowance == true\\r\\n| extend TransferredGb = todouble(\\r\\n extract(@\\\"TransferredGb=\\\"\\\"([^\\\"\\\"]*)\\\"\\\"\\\", 1, SyslogMessage)\\r\\n )\\r\\n| summarize TotalTransferredGb = sum(TransferredGb)\\r\\n| extend Name = \\\"Transferred Data (Gb)\\\"\\r\\n| project Name, TotalTransferredGb\",\"size\":3,\"timeContext\":{\"durationMs\":604800000},\"exportedParameters\":[{\"fieldName\":\"TotalTransferredGb\",\"parameterName\":\"TotalTransferredGb\",\"parameterType\":1},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Name\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalTransferredGb\",\"formatter\":12},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 5 - Copy - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId==151 or instanceId==150\\r\\n| where Allowance\\r\\n| extend TransferredGb = todouble(extract(\\\"TransferredGb=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage))\\r\\n\",\"size\":0,\"timeContext\":{\"durationMs\":604800000},\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogTransefered\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 4\"},{\"type\":1,\"content\":{\"json\":\"Syslog message: \\r\\n```\\r\\n{SyslogTransefered}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TotalTransferredGb\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"ResultMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where not (instanceId in (\\\"40290\\\", \\\"40800\\\", \\\"150\\\", \\\"450\\\", \\\"151\\\", \\\"451\\\"))\\r\\n| where JobResultMessage == \\\"{ResultMessage}\\\"\\r\\n| where Allowance\\r\\n\\r\\n\",\"size\":0,\"title\":\"Events with `{ResultMessage}` status:\",\"timeContext\":{\"durationMs\":86400000},\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ResultMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TotalTransferredGb\",\"comparison\":\"isEqualTo\"}],\"name\":\"group - 5\"}]},\"name\":\"All Jobs\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Weekly Reports\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (\\\"190\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobResultMessage\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \\r\\n\",\"size\":0,\"aggregation\":5,\"title\":\" Backup and Backup Copy Jobs\",\"timeContext\":{\"durationMs\":604800000},\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"BackupAndBackupCopyJobsTime\"},{\"fieldName\":\"label\",\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"parameterType\":1},{\"fieldName\":\"\",\"parameterName\":\"BackupAndBackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}],\"xSettings\":{\"dateFormatSettings\":{\"formatName\":\"shortDatePattern\",\"showUtcTime\":true},\"scale\":\"time\",\"label\":\"Label\"},\"ySettings\":{\"label\":\"\"}}},\"customWidth\":\"50\",\"name\":\" Backup and Backup Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId == \\\"390\\\"\\r\\n| where Allowance\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobResultMessage\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \\r\\n\",\"size\":0,\"aggregation\":5,\"title\":\"SureBackup Jobs\",\"timeContext\":{\"durationMs\":604800000},\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"SureBackupJobsTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"SureBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"SureBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"SureBackup Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupAndBackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (\\\"190\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobResultMessage == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\\r\\n\",\"size\":0,\"title\":\"Backup and Backup Copy Jobs Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"name\":\"query - 5\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"SureBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Backup and Backup Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{SureBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"390\\\"\\r\\n| where Allowance\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobResultMessage == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\",\"size\":0,\"title\":\"SureBackup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 5\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"SureBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup and Backup Copy Jobs Drilldown - Copy\"}]},\"name\":\"Weekly Reports\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Virtual Machines & Agents\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == \\\"190\\\" and JobType == \\\"0\\\"\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"VM Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"VM Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == \\\"590\\\" \\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\",\"size\":3,\"title\":\"VM File Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMFileCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMFileCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"showPin\":false,\"name\":\"VM File Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 592\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\",\"size\":3,\"title\":\"VM Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"JobResult\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"JobResult\",\"sortOrder\":2}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"VM Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" and JobType == \\\"0\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMBackupJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMBackupJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMFileCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"590\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM File Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMFileCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMFileCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM File Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"592\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM Copy Jobs Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 610\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"VM Quick Migration Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMQuickMigrationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMQuickMigrationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"VM Quick Migration Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 790\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam Agent Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VeeamAgentJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VeeamAgentJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Veeam Agent Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMQuickMigrationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 610\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Quick Migration Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VeeamAgentJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VeeamAgentJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMQuickMigrationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamAgentJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\" VM Quick Migration Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamAgentJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"790\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Veeam Agent Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VeeamAgentJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VeeamAgentJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMQuickMigrationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamAgentJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam Agent Jobs Drilldown\"}]},\"name\":\"Virtual Machines & Agents\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Unstructured Data\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 190\\n| where JobType == 13000\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 3\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\" File Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"FileBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"FileBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\" File Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 190\\n| where JobType == 13000\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 7\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Object Storage Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"ObjectStorageBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Object Storage Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 490\\n| where JobType == 13003\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 5\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Backup Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FileBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 190\\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 3\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"File Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"FileBackupJobsSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Job Type\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Job Type\",\"sortOrder\":2}]},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{FileBackupJobsSyslogMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"File Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{ObjectStorageBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 190\\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 7\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Object Storage Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"ObjectStorageBackupJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{ObjectStorageBackupJobsMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Object Storage Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 490\\r\\n| where JobType == 13003\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 5\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Copy Jobs Drilldown\"}]},\"name\":\"Unstructured Data\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Applications and Services\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"36022\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Jobs for Enterprise Plug-ins\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupJobsForEnterprisePlugInsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Jobs for Enterprise Plug-ins\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"36026\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Log Backup Jobs for Enterprise Plug-ins\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"parameterType\":1},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Log Backup Jobs for Enterprise Plug-ins\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == \\\"78\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Jobs for Entra ID\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupJobsForEntraIDStatus\",\"parameterType\":1},{\"parameterName\":\"BackupJobsForEntraIDAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Jobs for Entra ID\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupJobsForEnterprisePlugInsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"36022\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Enterprise Plug-ins Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupJobsForEnterprisePlugInsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupJobsForEnterprisePlugInsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Jobs for Enterprise Plug-ins Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{LogBackupJobsForEnterprisePlugInsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"36026\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Log Backup Jobs for Enterprise Plug-ins Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"LogBackupJobsForEnterprisePlugInsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LogBackupJobsForEnterprisePlugInsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Log Backup Jobs for Enterprise Plug-ins Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupJobsForEntraIDAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == \\\"78\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Entra ID Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupJobsForEntraIDMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupJobsForEntraIDMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Jobs for Entra ID Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 8\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Log Backup Jobs for Entra ID\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"LogBackupJobsForEntraIDStatus\",\"parameterType\":1},{\"parameterName\":\"LogBackupJobsForEntraIDAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Log Backup Jobs for Entra ID\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{LogBackupJobsForEntraIDAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 8\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Entra ID Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"LogBackupJobsForEntraIDMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LogBackupJobsForEntraIDMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"LogBackupJobsForEntraIDStatus\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Log Backup Jobs for Entra ID\"}]},\"name\":\"Applications and Services\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Backup Copy & Replicas\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 1\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Replication Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"ReplicationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"ReplicationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Replication Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"490\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{ReplicationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 1\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Replication Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"ReplicationJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{ReplicationJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ReplicationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Replication Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"490\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Replication Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ReplicationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Replication Jobs Drilldown - Copy\"}]},\"name\":\"Backup Copy & Replicas\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Tapes\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"194\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"200\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"198\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Verification Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeVerificationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeVerificationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Verification Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"194\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Tape Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"200\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Tape Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeVerificationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"198\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Verification Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeVerificationJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeVerificationJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Tape Verification Jobs Drilldown\"}]},\"name\":\"Tapes - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Finished Jobs\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetFinishedConfigurationBackupSessions\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = Computer, User = user, State = Result, SyslogMessage, StringTime = tostring(TimeGenerated), Description\\r\\n\",\"size\":0,\"title\":\"Latest Configuration Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"StringTime\",\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\"},{\"fieldName\":\"SyslogMessage\",\"parameterName\":\"SyslogMessage\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"State\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"12ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5},{\"columnMatch\":\"StringTime\",\"formatter\":5},{\"columnMatch\":\"Description\",\"formatter\":5}]},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Latest Configuration Backups\",\"styleSettings\":{\"margin\":\"3px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, StringTime = tostring(TimeGenerated), SyslogMessage\",\"size\":0,\"title\":\"Latest Finished Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"StringTime\",\"parameterName\":\"LatestFinishedJobsTime\",\"parameterType\":1},{\"fieldName\":\"SyslogMessage\",\"parameterName\":\"LatestFinishedJobsSyslogMessage\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"StringTime\",\"formatter\":5},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Latest Finished Jobs\",\"styleSettings\":{\"margin\":\"3px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, StringTime = tostring(TimeGenerated)\\r\\n| where StringTime == \\\"{LatestFinishedJobsTime}\\\"\",\"size\":3,\"title\":\"Latest Finished Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"showPin\":false,\"name\":\"Latest Finished Jobs Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LatestFinishedJobsSyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"LatestFinishedJobsTime\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Latest Finished Jobs Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetFinishedConfigurationBackupSessions\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| where tostring(TimeGenerated) == \\\"{Veeam_GetFinishedConfigurationBackupSessionsTime}\\\"\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = Computer, User = user, [\\\"Message Details\\\"] = Description, State = Result, SyslogMessage\",\"size\":3,\"title\":\"Latest Configuration Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"showPin\":false,\"name\":\"Latest Configuration Backups Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LatestFinishedJobsTime\",\"comparison\":\"isEqualTo\"}],\"name\":\"Latest Configuration Backups Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobTypeDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":2,\"aggregation\":5,\"title\":\"Finished Jobs by Type\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"FinishedJobsByTypeTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"FinishedJobsByTypeStatus\",\"parameterType\":1},{\"parameterName\":\"FinishedJobsByTypeAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"group\":\"*\",\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Finished Jobs by Type\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"40290\\\", \\\"40800\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobTypeDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":2,\"aggregation\":5,\"title\":\"Finished Restore Sessions by Type\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"FinishedRestoreSessionsByTypeTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"parameterType\":1},{\"parameterName\":\"FinishedRestoreSessionsByTypeAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Finished Restore Sessions by Type\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FinishedJobsByTypeAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobTypeDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\",\"size\":0,\"title\":\"Finished Jobs by Type Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FinishedJobsByTypeStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Finished Jobs by Type Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FinishedRestoreSessionsByTypeAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId in (\\\"40290\\\", \\\"40800\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobTypeDescription == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\",\"size\":0,\"title\":\"Finished Restore Sessions by Type Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FinishedJobsByTypeStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Finished Restore Sessions by Type Drilldown\"}]},\"name\":\"Finished Jobs\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Failed Backups\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"150\\\", \\\"450\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend VmName = extract(\\\"VmName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| summarize Total = count() by VmName, JobResultMessage\\r\\n| evaluate pivot(JobResultMessage, sum(Total))\\r\\n| extend Failed = iff(column_ifexists(\\\"Failed\\\", 0) == 0, 0, column_ifexists(\\\"Failed\\\", 0)),\\r\\n Warning = iff(column_ifexists(\\\"Warning\\\", 0) == 0, 0, column_ifexists(\\\"Warning\\\", 0))\\r\\n| project VmName, Failed, Warning\\r\\n| order by Failed desc\\r\\n| take 15\\r\\n| render barchart\",\"size\":2,\"title\":\" Unsuccessful VM Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"UnsuccessfulVMBackupsName\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"parameterType\":1},{\"parameterName\":\"UnsuccessfulVMBackupsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"VmName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"VmName\",\"yAxis\":[\"Warning\",\"Failed\"],\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Successful\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\" Unsuccessful VM Backups\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"151\\\", \\\"451\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend SourceName = extract(\\\"SourceName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| summarize Total = count() by SourceName, JobResultMessage\\r\\n| evaluate pivot(JobResultMessage, sum(Total))\\r\\n| extend Failed = iff(column_ifexists(\\\"Failed\\\", 0) == 0, 0, column_ifexists(\\\"Failed\\\", 0)),\\r\\n Warning = iff(column_ifexists(\\\"Warning\\\", 0) == 0, 0, column_ifexists(\\\"Warning\\\", 0))\\r\\n| project SourceName, Failed, Warning\\r\\n| order by Failed desc\\r\\n| take 15\\r\\n| render barchart\",\"size\":2,\"title\":\"Unsuccessful Unstructured Data Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"chartSettings\":{\"xAxis\":\"SourceName\",\"yAxis\":[\"Failed\",\"Warning\"],\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Successful\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Unsuccessful Unstructured Data Backups\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{UnsuccessfulUnstructuredDataBackupAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series), X = tostring(parsed.x);\\r\\nlet session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"151\\\", \\\"451\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend SourceName = extract(\\\"SourceName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series, $left.SourceName == $right.X\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SourceName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"title\":\"Unsuccessful Unstructured Data Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"SourceName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"SourceName\",\"sortOrder\":1}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Unsuccessful Unstructured Data Backups Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{UnsuccessfulVMBackupsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series), X = tostring(parsed.x);\\r\\nlet session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"150\\\", \\\"450\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend VmName = extract(\\\"VmName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series, $left.VmName == $right.X\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, VmName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"title\":\"Unsuccessful VM Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\",\"comparison\":\"isEqualTo\"}],\"name\":\"Unsuccessful VM Backups Drilldown - Copy\"}]},\"name\":\"Failed Backups\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"sentinel-VeeamDataPlatformMonitoring\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", - "dependsOn": [ - "[variables('parserObject1')._parserId1]" - ], + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetJobFinished')]", - "contentId": "[variables('parserObject1').parserContentId1]", - "kind": "Parser", - "version": "[variables('parserObject1').parserVersion1]", + "description": "@{workbookKey=VeeamDataPlatformMonitoringWorkbook; logoFileName=VeeamLogo.svg; description=The Veeam Data Platform Monitoring dashboard shows an aggregated view of job activity on your Veeam Backup & Replication servers.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Veeam Data Platform Monitoring; templateRelativePath=VeeamDataPlatformMonitoring.json; subtitle=; provider=Veeam}.description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", "source": { - "name": "Veeam", "kind": "Solution", + "name": "Veeam", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -10671,10 +9713,23 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "Syslog", + "kind": "DataType" + }, + { + "contentId": "Syslog", + "kind": "DataConnector" + } + ] } } } @@ -10685,117 +9740,60 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('parserObject1').parserContentId1]", - "contentKind": "Parser", - "displayName": "Parser for Veeam Job Finished Events", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", - "version": "[variables('parserObject1').parserVersion1]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", - "name": "[variables('parserObject1')._parserName1]", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "Parser for Veeam Job Finished Events", - "category": "Microsoft Sentinel Parser", - "functionAlias": "Veeam_GetJobFinished", - "query": "let vbr_events_lookup = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nlet action_results_lookup = union isfuzzy=true \n (datatable(JobResult:string, JobResultMessage:string)[]),\n (_GetWatchlist(\"action_results_lookup\")); \nlet job_types_lookup = union isfuzzy=true \n (datatable(JobType:string, JobTypeDescription:string)[]),\n (_GetWatchlist(\"job_types_lookup\")); \nSyslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId in (\"150\", \"151\", \"190\", \"194\", \"198\", \"200\", \"250\", \"251\", \"290\", \"390\", \"450\", \"451\", \"490\", \"590\", \"592\", \"610\", \"790\", \"36022\", \"36026\", \"40290\", \"40800\")\n| lookup kind=leftouter (vbr_events_lookup) \n on $left.instanceId == $right.ID\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend event_module = Type1, original_host = Computer \n| extend Result = extract(\"Result=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend Status = extract(\"Status=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend JobResultCode = case(\n instanceId in (\"198\", \"290\", \"40290\", \"42210\", \"42500\"), Result,\n instanceId in (\"150\", \"151\", \"450\", \"451\"), Status,\n extract(\"JobResult=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n)\n| lookup kind=leftouter (action_results_lookup)\n on $left.JobResultCode == $right.JobResult\n| extend Platform = extract(\"Platform=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend Version = extract(\"Version=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend JobSessionID = extract(\"JobSessionID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend JobID = extract(\"JobID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend JobType = case ( \n instanceId == \"198\", \"198\",\n instanceId == \"290\", \"198\",\n instanceId == \"40800\", \"40800\",\n instanceId == \"40290\", \"290\",\n extract(\"JobType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n)\n| lookup kind=leftouter (job_types_lookup)\n on $left.JobType == $right.JobType\n| extend Allowance = Severity != 'disabled'\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult = JobResultCode, JobResultMessage, JobType, JobTypeDescription, Allowance, SyslogMessage\n", - "functionParameters": "", - "version": 2, - "tags": [ - { - "name": "description", - "value": "" - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", - "dependsOn": [ - "[variables('parserObject1')._parserId1]" - ], - "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetJobFinished')]", - "contentId": "[variables('parserObject1').parserContentId1]", - "kind": "Parser", - "version": "[variables('parserObject1').parserVersion1]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('parserObject2').parserTemplateSpecName2]", + "name": "[variables('workbookTemplateSpecName2')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam_GetVeeamONEAlarms Data Parser with template version 3.0.2", + "description": "VeeamSecurityActivities Workbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserObject2').parserVersion2]", + "contentVersion": "[variables('workbookVersion2')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[variables('parserObject2')._parserName2]", - "apiVersion": "2022-10-01", - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId2')]", "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "The Veeam Security Activities dashboard shows an aggregated view of security events from your Veeam Backup & Replication servers and Veeam ONE servers, as well as Coveware findings." + }, "properties": { - "eTag": "*", - "displayName": "Parser for Veeam ONE Events", - "category": "Microsoft Sentinel Parser", - "functionAlias": "Veeam_GetVeeamONEAlarms", - "query": "let watchlist = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nSyslog\n| where SyslogMessage has \"predefined_alarm_id\"\n| extend predefined_alarm_id = extract(\"predefined_alarm_id=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| where predefined_alarm_id in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\n| lookup kind=leftouter (watchlist) \n on $left.predefined_alarm_id == $right.ID\n| extend alarm_details = extract(\"alarm_details=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend alarm_name = extract(\"alarm_name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend alarm_type = extract(\"alarm_type=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend event_module = extract(\"event_module=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend eventtype = extract(\"eventtype=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend object_name = extract(\"object_name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend object_path = extract(\"object_path=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend original_host = extract(\"original_host=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend predefined_alarm_id = extract(\"predefined_alarm_id=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend severity = extract(\"severity=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend status_new = extract(\"status_new=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend status_old = extract(\"status_old=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend VoneHostName=Computer\n| extend SeverityDescription = case(Severity==\"critical\",\"Critical\",\n Severity==\"high\",\"High\",\n Severity==\"medium\",\"Medium\",\n Severity==\"information\",\"Information\", \n \"Unknown\")\n| project [\"Event Name\"], TimeGenerated, alarm_details, alarm_name, alarm_type, object_name, object_path, predefined_alarm_id, Severity, status_new, status_old, VoneHostName, SeverityDescription, SyslogMessage\n", - "functionParameters": "", - "version": 2, - "tags": [ - { - "name": "description", - "value": "" - } - ] + "displayName": "[parameters('workbook2-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"bb18f0f1-0893-479d-83fe-9cca36e33b43\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"value\":{\"durationMs\":2592000000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"d559890f-2663-49a6-af45-3dfc1fa7fda0\",\"cellValue\":\"isRest\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Syslog\",\"subTarget\":\"0\",\"preText\":\"d\",\"postText\":\"d\",\"style\":\"secondary\"},{\"id\":\"aee69a87-0e6f-4aab-ab21-14423e4d2d3d\",\"cellValue\":\"isRest\",\"linkTarget\":\"parameter\",\"linkLabel\":\"REST\",\"subTarget\":\"1\",\"style\":\"link\"}]},\"name\":\"links - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"3ec1d354-0588-43dd-b3e5-7ebab2195c40\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"host_token\",\"label\":\"Veeam Backup & Replication Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| summarize by original_host\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"26fbaaa0-3b0f-4506-885b-9fd8cd87ece9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vone_host_token\",\"label\":\"Veeam ONE Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| summarize by VoneHostName\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"parameters - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"3b155c6e-4243-4c04-8675-3901414969df\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vbr_host_name\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union \\r\\n (VeeamMalwareEvents_CL | where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}),\\r\\n (VeeamAuthorizationEvents_CL | where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}),\\r\\n (VeeamSecurityComplianceAnalyzer_CL\\r\\n | where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end})\\r\\n \\r\\n | summarize by VbrHostName\\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Veeam Backup & Replication Data Sources\"},{\"id\":\"f3074530-90f9-44b3-96a4-6141a273e18b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vone_host_name\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"VeeamOneTriggeredAlarms_CL \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize by VoneHostName\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Veeam ONE Data Sources\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"parameters - rest\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Custom Tables Events Overview\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by Status\\n| top 20 by Count\\n| project Status, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam ONE Triggered Alarms by Status\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Resolved\",\"color\":\"blue\"},{\"seriesName\":\"Error\",\"color\":\"redBright\"}]}},\"customWidth\":\"25\",\"name\":\"query - vone-alarms-status\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| summarize Count = count() by Severity\\n| top 20 by Count\\n| project Severity, Count\\n| render piechart\",\"size\":3,\"title\":\"Malware Events by Severity\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"MalwareEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Infected\",\"color\":\"redBright\"},{\"seriesName\":\"Clean\",\"color\":\"green\"}]}},\"customWidth\":\"25\",\"name\":\"query - malware-severity\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n| summarize Count = count() by State\\n| top 20 by Count\\n| project State, Count\\n| render piechart\",\"size\":3,\"title\":\"Authorization Events by State\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"ProcessedTime\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"ProcessedTime\",\"sortOrder\":2}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Approved\",\"color\":\"green\"},{\"seriesName\":\"Info\",\"color\":\"blue\"},{\"seriesName\":\"Rejected\",\"color\":\"redBright\"}]}},\"customWidth\":\"25\",\"name\":\"query - authorization-state\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamSecurityComplianceAnalyzer_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\n| summarize Count = count() by Status\\n| top 20 by Count\\n| project Status, Count\\n| render piechart\",\"size\":3,\"title\":\"Security & Compliance Analyzer Results by Status\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"BestPracticesAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Violation\",\"color\":\"redBright\"},{\"seriesName\":\"OK\",\"color\":\"green\"},{\"seriesName\":\"UnableToCheck\",\"color\":\"orange\"}]}},\"customWidth\":\"25\",\"name\":\"query - best-practices-status\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VoneTriggeredAlarmsStatusRestAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamOneTriggeredAlarms_CL\\r\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\r\\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| join kind=inner (filters) on $left.Status == $right.Series\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"title\":\"Veeam ONE Triggered Alarms by Status Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"VeeamONETriggeredAlarmsDrilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{AuthorizationEventsStateAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamAuthorizationEvents_CL\\r\\n| where \\\"'All'\\\" == \\\"{vbr_host_name}\\\" or VbrHostName in ({vbr_host_name}) \\r\\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\r\\n| where State in (toscalar(filters | summarize make_set(Series)))\\r\\n| project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\",\"size\":0,\"title\":\"Authorization Events by State Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Authorization Events Drilldown \"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{MalwareEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamMalwareEvents_CL\\r\\n| where \\\"'All'\\\" == \\\"{vbr_host_name}\\\" or VbrHostName in ({vbr_host_name}) \\r\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\r\\n| where Severity in (toscalar(filters | summarize make_set(Series)))\\r\\n| project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\",\"size\":0,\"title\":\"Malware Events by Severity Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"MalwareEventsDrilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BestPracticesAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\n\\r\\nVeeamSecurityComplianceAnalyzer_CL\\r\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\r\\n| join kind=inner (filters) on $left.Status == $right.Series\\r\\n| project TimeGenerated, VbrHostName, Status, Id, BestPractice, Note\",\"size\":0,\"title\":\"Security & Compliance Analyzer Results by Status Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"BestPracticesAnalysisDrilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by Name\\n| top 20 by Count\\n| project Name, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam ONE Triggered Alarms by Name\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VoneTriggeredAlarmsName\"},{\"parameterName\":\"VoneTriggeredAlarmsNamesRestAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Success\",\"color\":\"yellow\"}]}},\"customWidth\":\"33\",\"name\":\"query - vone-alarms-name\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VoneTriggeredAlarmsNamesRestAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| where Name in (toscalar(filters | summarize make_set(Series)))\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"title\":\"Veeam ONE Triggered Alarms by Name Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"VoneTriggeredAlarmsName\",\"comparison\":\"isNotEqualTo\"},\"name\":\"VeeamONETriggeredAlarmsDrilldown - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| where Severity == \\\"Infected\\\"\\n| count\",\"size\":2,\"title\":\"Infected Files Detected\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"stat\",\"statSettings\":{\"showBorder\":false,\"colorSettings\":{\"colorizeBody\":true,\"thresholds\":[{\"criteria\":\"isGreaterThan\",\"value\":\"0\",\"color\":\"red\"}]}}},\"customWidth\":\"33\",\"name\":\"infected-files-stat\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union \\n (VeeamOneTriggeredAlarms_CL | where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}),\\n (VeeamMalwareEvents_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) | where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}),\\n (VeeamAuthorizationEvents_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) | where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}),\\n (VeeamSecurityComplianceAnalyzer_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}),\\n (VeeamCovewareFindings_CL | where EventTime >= {TimeRange:start} and EventTime <= {TimeRange:end})\\n| summarize Count = count() by Type\\n| project [\\\"Event Type\\\"] = Type, Count\\n| render piechart\",\"size\":3,\"title\":\"All Custom Table Events by Type\",\"exportFieldName\":\"Event Type\",\"exportParameterName\":\"CustomTableEventType\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"33\",\"name\":\"query - custom-tables-distribution\"},{\"type\":1,\"content\":{\"json\":\"## Daily Trends\"},\"name\":\"text - daily-trends\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Coveware Findings\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| summarize Count = count() by EventType\\r\\n| top 20 by Count\\r\\n| project EventType, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Coveware Findings by Name\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"CovewareFindingsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"yAxis\":[\"Count\"],\"group\":\"EventType\",\"createOtherGroup\":0,\"showMetrics\":true,\"showLegend\":false}},\"customWidth\":\"30\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| summarize Count = count() by DateOnly = startofday(EventTime), RiskLevel\\r\\n| order by DateOnly asc\\r\\n| render timechart\",\"size\":0,\"title\":\"Daily Coveware Findings by Risk Level\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"CovewareRiskLevelAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"medium\",\"color\":\"orange\"},{\"seriesName\":\"low\",\"color\":\"blue\"},{\"seriesName\":\"high\",\"color\":\"redBright\"},{\"seriesName\":\"critical\",\"color\":\"purple\"}]}},\"customWidth\":\"70\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Step 1: Parse the Sentinel widget export into a filter table\\r\\nlet filters =\\r\\n print arr = parse_json(\\r\\n replace(\\r\\n @\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", \\r\\n @\\\"\\\\1\\\", \\r\\n strcat('[', '{CovewareFindingsNameAllFields}', ']')\\r\\n )\\r\\n )\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Filter main table by matching series\\r\\nVeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| where EventType in (toscalar(filters | summarize make_set(Series)))\\r\\n| project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings by Name Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibilities\":[{\"parameterName\":\"CovewareFindingsNameAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"CovewareRiskLevelAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Step 1: Parse the Sentinel widget export into a filter table\\r\\nlet filters =\\r\\n print arr = parse_json(\\r\\n replace(\\r\\n @\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", \\r\\n @\\\"\\\\1\\\", \\r\\n strcat('[', '{CovewareRiskLevelAllFields}', ']')\\r\\n )\\r\\n )\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n | extend DateOnly = startofday(EventTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.RiskLevel == $right.Series\\r\\n| project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings by Risk Level Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventTime\",\"formatter\":6},{\"columnMatch\":\"EventActivity\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"92.8571ch\"}}]}},\"conditionalVisibilities\":[{\"parameterName\":\"CovewareFindingsNameAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"CovewareRiskLevelAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"query - 4 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n | order by EventTime desc | project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings Details\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 2\"}]},\"name\":\"group - 17\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by bin(TriggeredTime, 1d), Status\\n| order by TriggeredTime asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Veeam ONE Triggered Alarms\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Error\",\"color\":\"redBright\"}]}},\"customWidth\":\"50\",\"name\":\"daily-vone-alarms\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| summarize Count = count() by bin(DetectionTimeUtc, 1d), Severity\\n| order by DetectionTimeUtc asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Malware Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyMalwareEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Infected\",\"color\":\"redBright\"},{\"seriesName\":\"Clean\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"daily-malware-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamONETriggeredAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(TriggeredTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.Status == $right.Series\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"Comment\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Comment\",\"sortOrder\":1}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"DailyMalwareEventsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"query - 23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyMalwareEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamMalwareEvents_CL\\r\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(DetectionTimeUtc)\\r\\n| join kind=inner (filters) on DateOnly, $left.Severity == $right.Series\\r\\n| project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\",\"size\":0,\"title\":\"Daily Malware Events Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"DailyMalwareEventsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"query - 23 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n| summarize Count = count() by bin(ProcessedTime, 1d), State\\n| order by ProcessedTime asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Four-Eyes Authorization Events\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyFourEyesAuthorizationEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Approved\",\"color\":\"green\"},{\"seriesName\":\"Info\",\"color\":\"blue\"},{\"seriesName\":\"Rejected\",\"color\":\"redBright\"}]}},\"customWidth\":\"100\",\"name\":\"daily-authorization-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyFourEyesAuthorizationEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeamAuthorizationEvents_CL\\r\\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(ProcessedTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.State == $right.Series\\r\\n| project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\\r\\n\",\"size\":0,\"title\":\"Daily Four-Eyes Authorization Events Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"DailyFourEyesAuthorizationEventsAllFields\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 23 - Copy - Copy\"},{\"type\":1,\"content\":{\"json\":\"## Latest Events\"},\"name\":\"text - latest-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n | order by TriggeredTime desc | project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\\n| top 15 by TriggeredTime desc\",\"size\":0,\"title\":\"Latest Veeam ONE Triggered Alarms\",\"exportFieldName\":\"Alarm Name\",\"exportParameterName\":\"SelectedVoneAlarm\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-vone-alarms\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n | order by DetectionTimeUtc desc | project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\\n| top 15 by DetectionTime desc\",\"size\":0,\"title\":\"Latest Malware Events\",\"exportFieldName\":\"Machine\",\"exportParameterName\":\"SelectedMalwareMachine\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-malware-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n | order by ProcessedTime desc | project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\\n\",\"size\":0,\"title\":\"Latest Authorization Events\",\"exportFieldName\":\"Event Name\",\"exportParameterName\":\"SelectedAuthEvent\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-authorization-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamSecurityComplianceAnalyzer_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n | order by TimeGenerated desc | project TimeGenerated, VbrHostName, Status, Id, BestPractice, Note\\n| top 15 by TimeGenerated desc\",\"size\":0,\"title\":\"Latest Security & Compliance Analysis\",\"exportFieldName\":\"Best Practice\",\"timeContextFromParameter\":\"TimeRange\",\"exportParameterName\":\"SelectedBestPractice\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-best-practices\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"REST Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Overview\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\n| summarize Count = count() by [\\\"SeverityDescription\\\"]\\n| top 20 by Count\\n| project [\\\"SeverityDescription\\\"], Count\\n| render piechart \\n\",\"size\":3,\"title\":\"Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\" or SyslogMessage has \\\"predefined_alarm_id\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| extend predefined_alarm_id = extract(\\\"predefined_alarm_id=\\\\\\\"(\\\\\\\\d+)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| extend eventId = strcat(\\r\\n tostring(extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage)), \\r\\n tostring(extract(\\\"predefined_alarm_id=\\\\\\\"(\\\\\\\\d+)\\\\\\\"\\\", 1, SyslogMessage))\\r\\n)\\r\\n| where eventId in (\\\"41600\\\",\\\"42220\\\",\\\"25500\\\",\\\"26100\\\",\\\"28100\\\",\\\"28970\\\",\\\"29800\\\",\\\"30100\\\",\\\"30400\\\",\\\"31500\\\",\\\"31600\\\",\\\"31700\\\",\\\"31800\\\",\\\"31900\\\",\\\"40204\\\",\\\"40400\\\",\\\"40500\\\",\\\"40600\\\",\\\"42260\\\",\\\"42270\\\",\\\"42302\\\",\\\"23090\\\",\\\"23420\\\",\\\"24080\\\",\\\"28200\\\",\\\"28500\\\",\\\"28920\\\",\\\"28950\\\",\\\"28980\\\",\\\"29120\\\",\\\"29150\\\",\\\"29900\\\",\\\"30200\\\",\\\"30500\\\",\\\"32120\\\",\\\"32200\\\",\\\"41402\\\",\\\"115\\\",\\\"31210\\\",\\\"31400\\\",\\\"40201\\\",\\\"40205\\\",\\\"40206\\\",\\\"41610\\\",\\\"42230\\\",\\\"42301\\\",\\\"42401\\\",\\\"42402\\\",\\\"42404\\\",\\\"42405\\\",\\\"21224\\\",\\\"26110\\\",\\\"31200\\\",\\\"36013\\\",\\\"42210\\\",\\\"42500\\\",\\\"27000\\\",\\\"24060\\\",\\\"24030\\\",\\\"24050\\\",\\\"24070\\\",\\\"24040\\\",\\\"42290\\\",\\\"23630\\\",\\\"23631\\\",\\\"23632\\\",\\\"23633\\\",\\\"24020\\\",\\\"24114\\\",\\\"24131\\\",\\\"24140\\\",\\\"24142\\\",\\\"24143\\\",\\\"24160\\\",\\\"24170\\\",\\\"25000\\\",\\\"25210\\\",\\\"25220\\\",\\\"25400\\\",\\\"25700\\\",\\\"25800\\\",\\\"26000\\\",\\\"26600\\\",\\\"26700\\\",\\\"26800\\\",\\\"26900\\\",\\\"27200\\\",\\\"27300\\\",\\\"27500\\\",\\\"27600\\\",\\\"27900\\\",\\\"28400\\\",\\\"28800\\\",\\\"28850\\\",\\\"28940\\\",\\\"29110\\\",\\\"29140\\\",\\\"30700\\\",\\\"30800\\\",\\\"31000\\\",\\\"32100\\\",\\\"32400\\\",\\\"32800\\\",\\\"40202\\\",\\\"41200\\\",\\\"41401\\\",\\\"42280\\\",\\\"395\\\", \\\"364\\\", \\\"369\\\", \\\"391\\\", \\\"365\\\", \\\"370\\\", \\\"314\\\", \\\"331\\\", \\\"376\\\", \\\"377\\\", \\\"403\\\", \\\"316\\\", \\\"342\\\", \\\"381\\\", \\\"315\\\", \\\"332\\\", \\\"344\\\",\\\"378\\\")\\r\\n| extend host = Computer\\r\\n| count\",\"size\":0,\"title\":\"All Security Activities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"stat\",\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"All Security Activities\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by SeverityDescription\\n| top 20 by Count\\n| render piechart\\n\",\"size\":3,\"title\":\"Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamONEAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| join kind=inner (filters) on $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Veeam ONE Alarms Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam ONE Alarms by Severity Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamBackupAndReplicationSecurityEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Veeam Backup & Replication Security Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Veeam Backup & Replication Security Events Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| summarize Count = count() by [\\\"Event Name\\\"]\\r\\n| project [\\\"Event Name\\\"], Count\\r\\n| render piechart \",\"size\":3,\"title\":\"Veeam ONE Alarms by Name\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by [\\\"Event Name\\\"]\\r\\n| top 20 by Count\\r\\n| render piechart\\r\\n\",\"size\":3,\"title\":\"Veeam Backup & Replication Security Events by Name\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamONEAlarmsNameAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| join kind=inner (filters) on $left.[\\\"Event Name\\\"] == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Veeam ONE Alarms Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam ONE Alarms by Name Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamBackupAndReplicationSecurityEventsNameAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.[\\\"Event Name\\\"] == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Veeam Backup & Replication Security Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Veeam Backup & Replication Security Events Drilldown - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where instanceId == \\\"42220\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Marked as Infected\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"MarkedAsInfectedCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Marked as Infected\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| extend original_host = Computer\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Four-Eyes Authorization Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"FourEyesAuthorizationEventsCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Four-Eyes Authorization Events\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"41600\\\"\\r\\n| extend original_host = Computer\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Marked as Suspicious\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"MarkedAsSuspiciousCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Marked as Suspicious\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Four-Eyes Authorization Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Four-Eyes Authorization Events Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42220\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Marked as Infected Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Marked as Infected Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"41600\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Four-Eyes Authorization Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Four-Eyes Authorization Events Drilldown\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Overview\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Daily Security Activities\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription\",\"size\":0,\"aggregation\":5,\"title\":\"Daily Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Critical\",\"color\":\"purple\"},{\"seriesName\":\"High\",\"color\":\"redBright\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Daily Veeam Backup & Replication Security Events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":0,\"aggregation\":5,\"title\":\" Daily Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"purple\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"High\",\"color\":\"redBright\"}]}},\"customWidth\":\"50\",\"name\":\" Daily Veeam ONE Alarms\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamBackupReplicationSecurityEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Daily Veeam Backup & Replication Security Events Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Daily Veeam Backup & Replication Security Events Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamONEAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Daily Veeam ONE Alarms Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Daily Veeam ONE Alarms Drilldown - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Daily Security Activities\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Latest Security Activities\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Latest Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VBRSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"Latest Veeam Backup & Replication Security Events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Latest Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VoneSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"customWidth\":\"50\",\"name\":\"Latest Veeam ONE Alarms\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VBRSyslogMessage}\\r\\n```\"},\"conditionalVisibilities\":[{\"parameterName\":\"VBRSyslogMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VoneSyslogMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"text - 3\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VoneSyslogMessage}\\r\\n```\"},\"conditionalVisibilities\":[{\"parameterName\":\"VoneSyslogMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VBRSyslogMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"text - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Latest Security Activities\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Four-Eyes Authorization Events\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let watchlist = _GetWatchlist(\\\"operation_names_lookup\\\"); \\r\\nSyslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| extend OperationId = extract(\\\"OperationId=\\\\\\\"(?[^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| lookup kind=inner (watchlist) \\r\\n on $left.OperationId == $right.[\\\"Operation Id\\\"]\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), OperationName\\r\\n\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"FourEyesAuthorizationEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"query - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let watchlist = _GetWatchlist(\\\"operation_names_lookup\\\"); \\r\\n\\r\\nlet filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FourEyesAuthorizationEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nSyslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| extend OperationId = extract(\\\"OperationId=\\\\\\\"(?[^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| lookup kind=inner (watchlist) \\r\\n on $left.OperationId == $right.[\\\"Operation Id\\\"]\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.OperationName == $right.Series\\r\\n| project TimeGenerated, Computer, EventTime, Facility, HostName, SeverityLevel, instanceId, OperationId, LastUpdatedTime = LastUpdatedTimeUTC, SearchKey, OperationName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"FourEyesAuthorizationEventsAllFields\",\"comparison\":\"isNotEqualTo\"},\"name\":\"group - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Four-Eyes Authorization Events\"}],\"fromTemplateId\":\"sentinel-VeeamSecurityActivities\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]", - "dependsOn": [ - "[variables('parserObject2')._parserId2]" - ], + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]", "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetVeeamONEAlarms')]", - "contentId": "[variables('parserObject2').parserContentId2]", - "kind": "Parser", - "version": "[variables('parserObject2').parserVersion2]", + "description": "@{workbookKey=VeeamSecurityActivitiesWorkbook; logoFileName=VeeamLogo.svg; description=The Veeam Security Activities dashboard shows an aggregated view of security events from your Veeam Backup & Replication servers and Veeam ONE servers, as well as Coveware findings.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Veeam Security Activities; templateRelativePath=VeeamSecurityActivities.json; subtitle=; provider=Veeam}.description", + "parentId": "[variables('workbookId2')]", + "contentId": "[variables('_workbookContentId2')]", + "kind": "Workbook", + "version": "[variables('workbookVersion2')]", "source": { - "name": "Veeam", "kind": "Solution", + "name": "Veeam", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -10803,14989 +9801,234 @@ "email": "[variables('_email')]" }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('parserObject2').parserContentId2]", - "contentKind": "Parser", - "displayName": "Parser for Veeam ONE Events", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '1.0.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '1.0.0')))]", - "version": "[variables('parserObject2').parserVersion2]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", - "name": "[variables('parserObject2')._parserName2]", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "Parser for Veeam ONE Events", - "category": "Microsoft Sentinel Parser", - "functionAlias": "Veeam_GetVeeamONEAlarms", - "query": "let watchlist = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nSyslog\n| where SyslogMessage has \"predefined_alarm_id\"\n| extend predefined_alarm_id = extract(\"predefined_alarm_id=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| where predefined_alarm_id in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\n| lookup kind=leftouter (watchlist) \n on $left.predefined_alarm_id == $right.ID\n| extend alarm_details = extract(\"alarm_details=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend alarm_name = extract(\"alarm_name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend alarm_type = extract(\"alarm_type=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend event_module = extract(\"event_module=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend eventtype = extract(\"eventtype=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend object_name = extract(\"object_name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend object_path = extract(\"object_path=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend original_host = extract(\"original_host=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend predefined_alarm_id = extract(\"predefined_alarm_id=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend severity = extract(\"severity=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend status_new = extract(\"status_new=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend status_old = extract(\"status_old=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend VoneHostName=Computer\n| extend SeverityDescription = case(Severity==\"critical\",\"Critical\",\n Severity==\"high\",\"High\",\n Severity==\"medium\",\"Medium\",\n Severity==\"information\",\"Information\", \n \"Unknown\")\n| project [\"Event Name\"], TimeGenerated, alarm_details, alarm_name, alarm_type, object_name, object_path, predefined_alarm_id, Severity, status_new, status_old, VoneHostName, SeverityDescription, SyslogMessage\n", - "functionParameters": "", - "version": 2, - "tags": [ - { - "name": "description", - "value": "" - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]", - "dependsOn": [ - "[variables('parserObject2')._parserId2]" - ], - "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetVeeamONEAlarms')]", - "contentId": "[variables('parserObject2').parserContentId2]", - "kind": "Parser", - "version": "[variables('parserObject2').parserVersion2]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('parserObject3').parserTemplateSpecName3]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_GetFinishedConfigurationBackupSessions Data Parser with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserObject3').parserVersion3]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "name": "[variables('parserObject3')._parserName3]", - "apiVersion": "2022-10-01", - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "Parser for Veeam Configuration Backup Session Finished Events", - "category": "Microsoft Sentinel Parser", - "functionAlias": "Veeam_GetFinishedConfigurationBackupSessions", - "query": "Syslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId == \"40700\"\n| extend UserName = extract(\"UserName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend fullName = extract(\"fullName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param3 = extract(\"param3=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param6 = extract(\"param6=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Result = extract(\"Result=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = extract(\"user=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend InitiatorName = extract(\"InitiatorName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend src = extract(\"src=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = case(\n isnotnull(user) and user != \"\", \n user, \n instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), \n iff(isnull(fullName) or fullName == \"\", \"unknown\", fullName), \n instanceId in (\"36013\"), \n iff(isnull(InitiatorName) or InitiatorName == \"\", \"unknown\", InitiatorName), \n instanceId in (\"41800\",\"41810\"), \n iff(isnull(param3) or param3 == \"\", \"unknown\", param3), \n instanceId in (\"23090\",\"23420\",\"41402\"), \n iff(isnull(param6) or param6 == \"\", \"unknown\", param6), \n instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\",\"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), \n iff(isnull(UserName) or UserName == \"\", \"unknown\", UserName),\n \"unknown\" \n)\n| extend Result = extract(\"Result:\\\\s*([^\\\\.]*)\", 1, Description)\n| project TimeGenerated, Computer, user, Description, Result, SyslogMessage, instanceId\n", - "functionParameters": "", - "version": 2, - "tags": [ - { - "name": "description", - "value": "" - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject3')._parserId3,'/'))))]", - "dependsOn": [ - "[variables('parserObject3')._parserId3]" - ], - "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetFinishedConfigurationBackupSessions')]", - "contentId": "[variables('parserObject3').parserContentId3]", - "kind": "Parser", - "version": "[variables('parserObject3').parserVersion3]", - "source": { - "name": "Veeam", - "kind": "Solution", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('parserObject3').parserContentId3]", - "contentKind": "Parser", - "displayName": "Parser for Veeam Configuration Backup Session Finished Events", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject3').parserContentId3,'-', '1.0.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject3').parserContentId3,'-', '1.0.0')))]", - "version": "[variables('parserObject3').parserVersion3]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", - "name": "[variables('parserObject3')._parserName3]", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "Parser for Veeam Configuration Backup Session Finished Events", - "category": "Microsoft Sentinel Parser", - "functionAlias": "Veeam_GetFinishedConfigurationBackupSessions", - "query": "Syslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId == \"40700\"\n| extend UserName = extract(\"UserName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend fullName = extract(\"fullName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param3 = extract(\"param3=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param6 = extract(\"param6=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Result = extract(\"Result=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = extract(\"user=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend InitiatorName = extract(\"InitiatorName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend src = extract(\"src=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = case(\n isnotnull(user) and user != \"\", \n user, \n instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), \n iff(isnull(fullName) or fullName == \"\", \"unknown\", fullName), \n instanceId in (\"36013\"), \n iff(isnull(InitiatorName) or InitiatorName == \"\", \"unknown\", InitiatorName), \n instanceId in (\"41800\",\"41810\"), \n iff(isnull(param3) or param3 == \"\", \"unknown\", param3), \n instanceId in (\"23090\",\"23420\",\"41402\"), \n iff(isnull(param6) or param6 == \"\", \"unknown\", param6), \n instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\",\"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), \n iff(isnull(UserName) or UserName == \"\", \"unknown\", UserName),\n \"unknown\" \n)\n| extend Result = extract(\"Result:\\\\s*([^\\\\.]*)\", 1, Description)\n| project TimeGenerated, Computer, user, Description, Result, SyslogMessage, instanceId\n", - "functionParameters": "", - "version": 2, - "tags": [ - { - "name": "description", - "value": "" - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject3')._parserId3,'/'))))]", - "dependsOn": [ - "[variables('parserObject3')._parserId3]" - ], - "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetFinishedConfigurationBackupSessions')]", - "contentId": "[variables('parserObject3').parserContentId3]", - "kind": "Parser", - "version": "[variables('parserObject3').parserVersion3]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('parserObject4').parserTemplateSpecName4]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_GetSecurityEvents Data Parser with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserObject4').parserVersion4]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "name": "[variables('parserObject4')._parserName4]", - "apiVersion": "2022-10-01", - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "Parser for Veeam Security VBR Events", - "category": "Microsoft Sentinel Parser", - "functionAlias": "Veeam_GetSecurityEvents", - "query": "let watchlist = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nSyslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId in (\"115\", \"21224\", \"23090\", \"23420\", \"23630\", \"23631\", \"23632\", \"23633\", \"24020\", \"24030\", \"24040\", \"24050\", \"24060\", \"24070\", \"24080\", \"24114\", \"24131\", \"24140\", \"24142\", \"24143\", \"24160\", \"24170\", \"25000\", \"25210\", \"25220\", \"25400\", \"25500\", \"25700\", \"25800\", \"26000\", \"26100\", \"26110\", \"26600\", \"26700\", \"26800\", \"26900\", \"27000\", \"27200\", \"27300\", \"27500\", \"27600\", \"27900\", \"28100\", \"28200\", \"28400\", \"28500\", \"28800\", \"28850\", \"28920\", \"28940\", \"28950\", \"28970\", \"28980\", \"29110\", \"29120\", \"29140\", \"29150\", \"29800\", \"29900\", \"30100\", \"30200\", \"30400\", \"30500\", \"30700\", \"30800\", \"31000\", \"31200\", \"31210\", \"31400\", \"31500\", \"31600\", \"31700\", \"31800\", \"31900\", \"32100\", \"32120\", \"32200\", \"32400\", \"32800\", \"36013\", \"40201\", \"40202\", \"40204\", \"40205\", \"40206\", \"40400\", \"40500\", \"40600\", \"41200\", \"41401\", \"41402\", \"41600\", \"41610\", \"41800\", \"41810\", \"42210\", \"42220\", \"42230\", \"42260\", \"42270\", \"42280\", \"42290\", \"42301\", \"42302\", \"42401\", \"42402\", \"42404\", \"42405\", \"42500\")\n| lookup kind=leftouter (watchlist) \n on $left.instanceId == $right.ID\n| extend UserName = extract(\"UserName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend fullName = extract(\"fullName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param3 = extract(\"param3=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param6 = extract(\"param6=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Result = extract(\"Result=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = extract(\"user=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend InitiatorName = extract(\"InitiatorName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend src = extract(\"src=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = case(\n isnotnull(user) and user != \"\", \n user, \n instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), \n iff(isnull(fullName) or fullName == \"\", \"unknown\", fullName), \n instanceId in (\"36013\"), \n iff(isnull(InitiatorName) or InitiatorName == \"\", \"unknown\", InitiatorName), \n instanceId in (\"41800\",\"41810\"), \n iff(isnull(param3) or param3 == \"\", \"unknown\", param3), \n instanceId in (\"23090\",\"23420\",\"41402\"), \n iff(isnull(param6) or param6 == \"\", \"unknown\", param6), \n instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\",\"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), \n iff(isnull(UserName) or UserName == \"\", \"unknown\", UserName),\n \"unknown\" \n)\n| extend src = iff(isnull(src) or src == \"\", \n iff(isnull(Description) or Description == \"\", \"unknown\", Description), \n src)\n| extend SeverityDescription = case(Severity==\"critical\",\"Critical\",\n Severity==\"high\",\"High\",\n Severity==\"medium\",\"Medium\",\n Severity==\"information\",\"Information\", \n \"Unknown\")\n| extend event_module = Type1, original_host = Computer \n| project TimeGenerated, Description, event_module, instanceId, original_host, Severity, src, user, SeverityDescription, [\"Event Name\"], SyslogMessage\n", - "functionParameters": "", - "version": 2, - "tags": [ - { - "name": "description", - "value": "" - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject4')._parserId4,'/'))))]", - "dependsOn": [ - "[variables('parserObject4')._parserId4]" - ], - "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetSecurityEvents')]", - "contentId": "[variables('parserObject4').parserContentId4]", - "kind": "Parser", - "version": "[variables('parserObject4').parserVersion4]", - "source": { - "name": "Veeam", - "kind": "Solution", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('parserObject4').parserContentId4]", - "contentKind": "Parser", - "displayName": "Parser for Veeam Security VBR Events", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", - "version": "[variables('parserObject4').parserVersion4]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", - "name": "[variables('parserObject4')._parserName4]", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "Parser for Veeam Security VBR Events", - "category": "Microsoft Sentinel Parser", - "functionAlias": "Veeam_GetSecurityEvents", - "query": "let watchlist = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nSyslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId in (\"115\", \"21224\", \"23090\", \"23420\", \"23630\", \"23631\", \"23632\", \"23633\", \"24020\", \"24030\", \"24040\", \"24050\", \"24060\", \"24070\", \"24080\", \"24114\", \"24131\", \"24140\", \"24142\", \"24143\", \"24160\", \"24170\", \"25000\", \"25210\", \"25220\", \"25400\", \"25500\", \"25700\", \"25800\", \"26000\", \"26100\", \"26110\", \"26600\", \"26700\", \"26800\", \"26900\", \"27000\", \"27200\", \"27300\", \"27500\", \"27600\", \"27900\", \"28100\", \"28200\", \"28400\", \"28500\", \"28800\", \"28850\", \"28920\", \"28940\", \"28950\", \"28970\", \"28980\", \"29110\", \"29120\", \"29140\", \"29150\", \"29800\", \"29900\", \"30100\", \"30200\", \"30400\", \"30500\", \"30700\", \"30800\", \"31000\", \"31200\", \"31210\", \"31400\", \"31500\", \"31600\", \"31700\", \"31800\", \"31900\", \"32100\", \"32120\", \"32200\", \"32400\", \"32800\", \"36013\", \"40201\", \"40202\", \"40204\", \"40205\", \"40206\", \"40400\", \"40500\", \"40600\", \"41200\", \"41401\", \"41402\", \"41600\", \"41610\", \"41800\", \"41810\", \"42210\", \"42220\", \"42230\", \"42260\", \"42270\", \"42280\", \"42290\", \"42301\", \"42302\", \"42401\", \"42402\", \"42404\", \"42405\", \"42500\")\n| lookup kind=leftouter (watchlist) \n on $left.instanceId == $right.ID\n| extend UserName = extract(\"UserName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend fullName = extract(\"fullName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param3 = extract(\"param3=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param6 = extract(\"param6=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Result = extract(\"Result=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = extract(\"user=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend InitiatorName = extract(\"InitiatorName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend src = extract(\"src=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = case(\n isnotnull(user) and user != \"\", \n user, \n instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), \n iff(isnull(fullName) or fullName == \"\", \"unknown\", fullName), \n instanceId in (\"36013\"), \n iff(isnull(InitiatorName) or InitiatorName == \"\", \"unknown\", InitiatorName), \n instanceId in (\"41800\",\"41810\"), \n iff(isnull(param3) or param3 == \"\", \"unknown\", param3), \n instanceId in (\"23090\",\"23420\",\"41402\"), \n iff(isnull(param6) or param6 == \"\", \"unknown\", param6), \n instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\",\"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), \n iff(isnull(UserName) or UserName == \"\", \"unknown\", UserName),\n \"unknown\" \n)\n| extend src = iff(isnull(src) or src == \"\", \n iff(isnull(Description) or Description == \"\", \"unknown\", Description), \n src)\n| extend SeverityDescription = case(Severity==\"critical\",\"Critical\",\n Severity==\"high\",\"High\",\n Severity==\"medium\",\"Medium\",\n Severity==\"information\",\"Information\", \n \"Unknown\")\n| extend event_module = Type1, original_host = Computer \n| project TimeGenerated, Description, event_module, instanceId, original_host, Severity, src, user, SeverityDescription, [\"Event Name\"], SyslogMessage\n", - "functionParameters": "", - "version": 2, - "tags": [ - { - "name": "description", - "value": "" - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject4')._parserId4,'/'))))]", - "dependsOn": [ - "[variables('parserObject4')._parserId4]" - ], - "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetSecurityEvents')]", - "contentId": "[variables('parserObject4').parserContentId4]", - "kind": "Parser", - "version": "[variables('parserObject4').parserVersion4]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Adding_User_or_Group_Failed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects failed attempts to add a user or user group to Veeam Backup & Replication.", - "displayName": "Adding User or Group Failed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 31210\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 1", - "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", - "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", - "contentKind": "AnalyticsRule", - "displayName": "Adding User or Group Failed", - "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", - "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", - "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Application_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when an application group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Application Group Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 30500\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Application Group Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 2", - "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", - "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", - "contentKind": "AnalyticsRule", - "displayName": "Application Group Deleted", - "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", - "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", - "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Application_Group_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when application group settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Application Group Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 30400\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Application Group Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 3", - "parentId": "[variables('analyticRuleObject3').analyticRuleId3]", - "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject3').analyticRuleVersion3]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", - "contentKind": "AnalyticsRule", - "displayName": "Application Group Settings Updated", - "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", - "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", - "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Archive_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when an archive repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Archive Repository Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 29900\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 4", - "parentId": "[variables('analyticRuleObject4').analyticRuleId4]", - "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject4').analyticRuleVersion4]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", - "contentKind": "AnalyticsRule", - "displayName": "Archive Repository Deleted", - "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", - "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", - "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Archive_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when archive repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Archive Repository Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 29800\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 5", - "parentId": "[variables('analyticRuleObject5').analyticRuleId5]", - "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject5').analyticRuleVersion5]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", - "contentKind": "AnalyticsRule", - "displayName": "Archive Repository Settings Updated", - "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", - "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", - "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Attempt_to_Delete_Backup_Failed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects failed backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.", - "displayName": "Attempt to Delete Backup Failed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 41800\n| extend Endpoint = extract(\"param2=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Endpoint\"] = Endpoint,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 6", - "parentId": "[variables('analyticRuleObject6').analyticRuleId6]", - "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject6').analyticRuleVersion6]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", - "contentKind": "AnalyticsRule", - "displayName": "Attempt to Delete Backup Failed", - "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", - "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", - "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject7').analyticRuleTemplateSpecName7]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Attempt_to_Update_Security_Object_Failed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject7')._analyticRulecontentId7]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects failed attempts to update security objects in Veeam Backup & Replication. Security objects include users and roles, credential records, certificates, or passwords.", - "displayName": "Attempt to Update Security Object Failed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 41810\n| extend Endpoint = extract(\"param2=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Endpoint\"] = Endpoint,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject7').analyticRuleId7,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 7", - "parentId": "[variables('analyticRuleObject7').analyticRuleId7]", - "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject7').analyticRuleVersion7]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", - "contentKind": "AnalyticsRule", - "displayName": "Attempt to Update Security Object Failed", - "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", - "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", - "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject8').analyticRuleTemplateSpecName8]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Backup_Proxy_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject8')._analyticRulecontentId8]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a backup proxy is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Backup Proxy Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 27900\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject8').analyticRuleId8,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 8", - "parentId": "[variables('analyticRuleObject8').analyticRuleId8]", - "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject8').analyticRuleVersion8]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", - "contentKind": "AnalyticsRule", - "displayName": "Backup Proxy Deleted", - "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", - "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", - "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject9').analyticRuleTemplateSpecName9]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Backup_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject9')._analyticRulecontentId9]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a backup repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Backup Repository Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 28200\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject9').analyticRuleId9,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 9", - "parentId": "[variables('analyticRuleObject9').analyticRuleId9]", - "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject9').analyticRuleVersion9]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", - "contentKind": "AnalyticsRule", - "displayName": "Backup Repository Deleted", - "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", - "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", - "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject10').analyticRuleTemplateSpecName10]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Backup_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject10')._analyticRulecontentId10]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when backup repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Backup Repository Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 28100\n| extend RepositoryName = extract(\"RepositoryName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Object Name\"] = RepositoryName,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject10').analyticRuleId10,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 10", - "parentId": "[variables('analyticRuleObject10').analyticRuleId10]", - "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject10').analyticRuleVersion10]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", - "contentKind": "AnalyticsRule", - "displayName": "Backup Repository Settings Updated", - "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", - "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", - "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject11').analyticRuleTemplateSpecName11]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Cloud_Gateway_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject11')._analyticRulecontentId11]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a cloud gateway is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Cloud Gateway Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 24140\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject11').analyticRuleId11,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 11", - "parentId": "[variables('analyticRuleObject11').analyticRuleId11]", - "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject11').analyticRuleVersion11]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]", - "contentKind": "AnalyticsRule", - "displayName": "Cloud Gateway Deleted", - "contentProductId": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]", - "id": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]", - "version": "[variables('analyticRuleObject11').analyticRuleVersion11]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject12').analyticRuleTemplateSpecName12]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Cloud_Gateway_Pool_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject12')._analyticRulecontentId12]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a cloud gateway pool is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Cloud Gateway Pool Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 24143\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject12').analyticRuleId12,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 12", - "parentId": "[variables('analyticRuleObject12').analyticRuleId12]", - "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject12').analyticRuleVersion12]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]", - "contentKind": "AnalyticsRule", - "displayName": "Cloud Gateway Pool Deleted", - "contentProductId": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]", - "id": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]", - "version": "[variables('analyticRuleObject12').analyticRuleVersion12]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject13').analyticRuleTemplateSpecName13]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Cloud_Gateway_Pool_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject13')._analyticRulecontentId13]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when cloud gateway pool settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Cloud Gateway Pool Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 24142\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject13').analyticRuleId13,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 13", - "parentId": "[variables('analyticRuleObject13').analyticRuleId13]", - "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject13').analyticRuleVersion13]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]", - "contentKind": "AnalyticsRule", - "displayName": "Cloud Gateway Pool Settings Updated", - "contentProductId": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]", - "id": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]", - "version": "[variables('analyticRuleObject13').analyticRuleVersion13]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject14').analyticRuleTemplateSpecName14]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Cloud_Gateway_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject14')._analyticRulecontentId14]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when cloud gateway settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Cloud Gateway Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 24131\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject14').analyticRuleId14,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 14", - "parentId": "[variables('analyticRuleObject14').analyticRuleId14]", - "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject14').analyticRuleVersion14]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]", - "contentKind": "AnalyticsRule", - "displayName": "Cloud Gateway Settings Updated", - "contentProductId": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]", - "id": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]", - "version": "[variables('analyticRuleObject14').analyticRuleVersion14]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject15').analyticRuleTemplateSpecName15]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Cloud_Replica_Permanent_Failover_Performed_by_Tenant_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject15')._analyticRulecontentId15]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects permanent failover of a cloud replica initiated by a tenant. This might indicate disaster recovery activity or issues with primary systems.", - "displayName": "Cloud Replica Permanent Failover Performed by Tenant", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 27000\n| extend VmRef = extract(\"VmRef=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend HostID = extract(\"HostID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Replica Name\"] = VmRef,\n [\"Tenant ID\"] = TenantID,\n [\"Data SourceID\"] = HostID,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject15').analyticRuleId15,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 15", - "parentId": "[variables('analyticRuleObject15').analyticRuleId15]", - "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject15').analyticRuleVersion15]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]", - "contentKind": "AnalyticsRule", - "displayName": "Cloud Replica Permanent Failover Performed by Tenant", - "contentProductId": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]", - "id": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]", - "version": "[variables('analyticRuleObject15').analyticRuleVersion15]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject16').analyticRuleTemplateSpecName16]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Configuration_Backup_Job_Failed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject16')._analyticRulecontentId16]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.", - "displayName": "Configuration Backup Job Failed", - "enabled": false, - "query": "Veeam_GetFinishedConfigurationBackupSessions\r\n| where Result == \"Failed\"\r\n| project\r\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\r\n DataSource = Computer,\r\n EventId = instanceId,\r\n UserName = user,\r\n [\"State\"] = Result,\r\n MessageDetails = Description", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "MessageDetails": "MessageDetails", - "DataSource": "DataSource" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject16').analyticRuleId16,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 16", - "parentId": "[variables('analyticRuleObject16').analyticRuleId16]", - "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject16').analyticRuleVersion16]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]", - "contentKind": "AnalyticsRule", - "displayName": "Configuration Backup Job Failed", - "contentProductId": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]", - "id": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]", - "version": "[variables('analyticRuleObject16').analyticRuleVersion16]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject17').analyticRuleTemplateSpecName17]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Configuration_Backup_Job_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject17')._analyticRulecontentId17]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when configuration backup job settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Configuration Backup Job Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 31500\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject17').analyticRuleId17,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 17", - "parentId": "[variables('analyticRuleObject17').analyticRuleId17]", - "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject17').analyticRuleVersion17]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]", - "contentKind": "AnalyticsRule", - "displayName": "Configuration Backup Job Settings Updated", - "contentProductId": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]", - "id": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]", - "version": "[variables('analyticRuleObject17').analyticRuleVersion17]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject18').analyticRuleTemplateSpecName18]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Connection_to_Backup_Repository_Lost_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject18')._analyticRulecontentId18]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a backup server fails to connect to a backup repository.", - "displayName": "Connection to Backup Repository Lost", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 21224\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject18').analyticRuleId18,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 18", - "parentId": "[variables('analyticRuleObject18').analyticRuleId18]", - "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject18').analyticRuleVersion18]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]", - "contentKind": "AnalyticsRule", - "displayName": "Connection to Backup Repository Lost", - "contentProductId": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]", - "id": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]", - "version": "[variables('analyticRuleObject18').analyticRuleVersion18]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject19').analyticRuleTemplateSpecName19]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Credential_Record_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject19')._analyticRulecontentId19]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a credential record is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Credential Record Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 25500\n| extend AccountName = extract(\"AccountName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Credential Record\"] = AccountName,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject19').analyticRuleId19,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 19", - "parentId": "[variables('analyticRuleObject19').analyticRuleId19]", - "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject19').analyticRuleVersion19]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]", - "contentKind": "AnalyticsRule", - "displayName": "Credential Record Deleted", - "contentProductId": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]", - "id": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]", - "version": "[variables('analyticRuleObject19').analyticRuleVersion19]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject20').analyticRuleTemplateSpecName20]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Credential_Record_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject20').analyticRuleVersion20]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject20')._analyticRulecontentId20]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a credential record is updated in Veeam Backup & Replication.", - "displayName": "Credential Record Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 25400\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject20').analyticRuleId20,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 20", - "parentId": "[variables('analyticRuleObject20').analyticRuleId20]", - "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject20').analyticRuleVersion20]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]", - "contentKind": "AnalyticsRule", - "displayName": "Credential Record Updated", - "contentProductId": "[variables('analyticRuleObject20')._analyticRulecontentProductId20]", - "id": "[variables('analyticRuleObject20')._analyticRulecontentProductId20]", - "version": "[variables('analyticRuleObject20').analyticRuleVersion20]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject21').analyticRuleTemplateSpecName21]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Detaching_Backups_Started_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject21').analyticRuleVersion21]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject21')._analyticRulecontentId21]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a backup file is detached from a backup job.", - "displayName": "Detaching Backups Started", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 41200\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject21').analyticRuleId21,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 21", - "parentId": "[variables('analyticRuleObject21').analyticRuleId21]", - "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject21').analyticRuleVersion21]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]", - "contentKind": "AnalyticsRule", - "displayName": "Detaching Backups Started", - "contentProductId": "[variables('analyticRuleObject21')._analyticRulecontentProductId21]", - "id": "[variables('analyticRuleObject21')._analyticRulecontentProductId21]", - "version": "[variables('analyticRuleObject21').analyticRuleVersion21]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject22').analyticRuleTemplateSpecName22]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Encryption_Password_Added_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject22').analyticRuleVersion22]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject22')._analyticRulecontentId22]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when an encryption password is added to Veeam Backup & Replication.", - "displayName": "Encryption Password Added", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 31600\n| extend Hint = extract(\"Hint=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Hint\"] = Hint,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject22').analyticRuleId22,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 22", - "parentId": "[variables('analyticRuleObject22').analyticRuleId22]", - "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject22').analyticRuleVersion22]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]", - "contentKind": "AnalyticsRule", - "displayName": "Encryption Password Added", - "contentProductId": "[variables('analyticRuleObject22')._analyticRulecontentProductId22]", - "id": "[variables('analyticRuleObject22')._analyticRulecontentProductId22]", - "version": "[variables('analyticRuleObject22').analyticRuleVersion22]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject23').analyticRuleTemplateSpecName23]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Encryption_Password_Changed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject23').analyticRuleVersion23]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject23')._analyticRulecontentId23]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when an encryption password is updated in Veeam Backup & Replication.", - "displayName": "Encryption Password Changed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 31700\n| extend Hint = extract(\"Hint=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Hint\"] = Hint,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject23').analyticRuleId23,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 23", - "parentId": "[variables('analyticRuleObject23').analyticRuleId23]", - "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject23').analyticRuleVersion23]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]", - "contentKind": "AnalyticsRule", - "displayName": "Encryption Password Changed", - "contentProductId": "[variables('analyticRuleObject23')._analyticRulecontentProductId23]", - "id": "[variables('analyticRuleObject23')._analyticRulecontentProductId23]", - "version": "[variables('analyticRuleObject23').analyticRuleVersion23]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject24').analyticRuleTemplateSpecName24]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Encryption_Password_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject24').analyticRuleVersion24]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject24')._analyticRulecontentId24]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when an encryption password is deleted in Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Encryption Password Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 31800\n| extend Hint = extract(\"Hint=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Hint\"] = Hint,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject24').analyticRuleId24,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 24", - "parentId": "[variables('analyticRuleObject24').analyticRuleId24]", - "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject24').analyticRuleVersion24]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]", - "contentKind": "AnalyticsRule", - "displayName": "Encryption Password Deleted", - "contentProductId": "[variables('analyticRuleObject24')._analyticRulecontentProductId24]", - "id": "[variables('analyticRuleObject24')._analyticRulecontentProductId24]", - "version": "[variables('analyticRuleObject24').analyticRuleVersion24]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject25').analyticRuleTemplateSpecName25]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "External_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject25').analyticRuleVersion25]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject25')._analyticRulecontentId25]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when an external repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "External Repository Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 32200\n| extend RepositoryName = extract(\"RepositoryName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = RepositoryName,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject25').analyticRuleId25,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 25", - "parentId": "[variables('analyticRuleObject25').analyticRuleId25]", - "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject25').analyticRuleVersion25]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]", - "contentKind": "AnalyticsRule", - "displayName": "External Repository Deleted", - "contentProductId": "[variables('analyticRuleObject25')._analyticRulecontentProductId25]", - "id": "[variables('analyticRuleObject25')._analyticRulecontentProductId25]", - "version": "[variables('analyticRuleObject25').analyticRuleVersion25]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject26').analyticRuleTemplateSpecName26]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "External_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject26').analyticRuleVersion26]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject26')._analyticRulecontentId26]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when external repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "External Repository Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 32100\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject26').analyticRuleId26,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 26", - "parentId": "[variables('analyticRuleObject26').analyticRuleId26]", - "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject26').analyticRuleVersion26]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]", - "contentKind": "AnalyticsRule", - "displayName": "External Repository Settings Updated", - "contentProductId": "[variables('analyticRuleObject26')._analyticRulecontentProductId26]", - "id": "[variables('analyticRuleObject26')._analyticRulecontentProductId26]", - "version": "[variables('analyticRuleObject26').analyticRuleVersion26]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject27').analyticRuleTemplateSpecName27]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Failover_Plan_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject27').analyticRuleVersion27]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject27')._analyticRulecontentId27]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a failover plan is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Failover Plan Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 26100\n| extend FailoverPlanName = extract(\"FailoverPlanName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Failover Plan Name\"] = FailoverPlanName,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject27').analyticRuleId27,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 27", - "parentId": "[variables('analyticRuleObject27').analyticRuleId27]", - "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject27').analyticRuleVersion27]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]", - "contentKind": "AnalyticsRule", - "displayName": "Failover Plan Deleted", - "contentProductId": "[variables('analyticRuleObject27')._analyticRulecontentProductId27]", - "id": "[variables('analyticRuleObject27')._analyticRulecontentProductId27]", - "version": "[variables('analyticRuleObject27').analyticRuleVersion27]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject28').analyticRuleTemplateSpecName28]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Failover_Plan_Failed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject28').analyticRuleVersion28]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject28')._analyticRulecontentId28]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems.", - "displayName": "Failover Plan Failed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 26110\n| extend FailoverPlanName = extract(\"FailoverPlanName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Failover Plan Name\"] = FailoverPlanName,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject28').analyticRuleId28,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 28", - "parentId": "[variables('analyticRuleObject28').analyticRuleId28]", - "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject28').analyticRuleVersion28]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]", - "contentKind": "AnalyticsRule", - "displayName": "Failover Plan Failed", - "contentProductId": "[variables('analyticRuleObject28')._analyticRulecontentProductId28]", - "id": "[variables('analyticRuleObject28')._analyticRulecontentProductId28]", - "version": "[variables('analyticRuleObject28').analyticRuleVersion28]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject29').analyticRuleTemplateSpecName29]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Failover_Plan_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject29').analyticRuleVersion29]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject29')._analyticRulecontentId29]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when failover plan settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Failover Plan Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 26000\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject29').analyticRuleId29,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 29", - "parentId": "[variables('analyticRuleObject29').analyticRuleId29]", - "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject29').analyticRuleVersion29]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]", - "contentKind": "AnalyticsRule", - "displayName": "Failover Plan Settings Updated", - "contentProductId": "[variables('analyticRuleObject29')._analyticRulecontentProductId29]", - "id": "[variables('analyticRuleObject29')._analyticRulecontentProductId29]", - "version": "[variables('analyticRuleObject29').analyticRuleVersion29]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject30').analyticRuleTemplateSpecName30]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Failover_Plan_Started_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject30').analyticRuleVersion30]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject30')._analyticRulecontentId30]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a failover plan starts. This might indicate disaster recovery activity or issues with primary systems.", - "displayName": "Failover Plan Started", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 26600\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject30').analyticRuleId30,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 30", - "parentId": "[variables('analyticRuleObject30').analyticRuleId30]", - "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject30').analyticRuleVersion30]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]", - "contentKind": "AnalyticsRule", - "displayName": "Failover Plan Started", - "contentProductId": "[variables('analyticRuleObject30')._analyticRulecontentProductId30]", - "id": "[variables('analyticRuleObject30')._analyticRulecontentProductId30]", - "version": "[variables('analyticRuleObject30').analyticRuleVersion30]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject31').analyticRuleTemplateSpecName31]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Failover_Plan_Stopped_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject31').analyticRuleVersion31]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject31')._analyticRulecontentId31]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a failover plan stops. This might indicate disaster recovery activity or issues with primary systems.", - "displayName": "Failover Plan Stopped", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 26700\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject31').analyticRuleId31,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 31", - "parentId": "[variables('analyticRuleObject31').analyticRuleId31]", - "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject31').analyticRuleVersion31]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]", - "contentKind": "AnalyticsRule", - "displayName": "Failover Plan Stopped", - "contentProductId": "[variables('analyticRuleObject31')._analyticRulecontentProductId31]", - "id": "[variables('analyticRuleObject31')._analyticRulecontentProductId31]", - "version": "[variables('analyticRuleObject31').analyticRuleVersion31]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject32').analyticRuleTemplateSpecName32]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "File_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject32').analyticRuleVersion32]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject32')._analyticRulecontentId32]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a file server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "File Server Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 28950\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject32').analyticRuleId32,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 32", - "parentId": "[variables('analyticRuleObject32').analyticRuleId32]", - "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject32').analyticRuleVersion32]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]", - "contentKind": "AnalyticsRule", - "displayName": "File Server Deleted", - "contentProductId": "[variables('analyticRuleObject32')._analyticRulecontentProductId32]", - "id": "[variables('analyticRuleObject32')._analyticRulecontentProductId32]", - "version": "[variables('analyticRuleObject32').analyticRuleVersion32]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject33').analyticRuleTemplateSpecName33]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "File_Server_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject33').analyticRuleVersion33]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject33')._analyticRulecontentId33]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when file server settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "File Server Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 28940\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject33').analyticRuleId33,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 33", - "parentId": "[variables('analyticRuleObject33').analyticRuleId33]", - "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject33').analyticRuleVersion33]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]", - "contentKind": "AnalyticsRule", - "displayName": "File Server Settings Updated", - "contentProductId": "[variables('analyticRuleObject33')._analyticRulecontentProductId33]", - "id": "[variables('analyticRuleObject33')._analyticRulecontentProductId33]", - "version": "[variables('analyticRuleObject33').analyticRuleVersion33]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject34').analyticRuleTemplateSpecName34]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "File_Share_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject34').analyticRuleVersion34]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject34')._analyticRulecontentId34]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a file share is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "File Share Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 28920\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Data SourceName\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject34').analyticRuleId34,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 34", - "parentId": "[variables('analyticRuleObject34').analyticRuleId34]", - "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject34').analyticRuleVersion34]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]", - "contentKind": "AnalyticsRule", - "displayName": "File Share Deleted", - "contentProductId": "[variables('analyticRuleObject34')._analyticRulecontentProductId34]", - "id": "[variables('analyticRuleObject34')._analyticRulecontentProductId34]", - "version": "[variables('analyticRuleObject34').analyticRuleVersion34]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject35').analyticRuleTemplateSpecName35]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Four_Eyes_Authorization_Disabled_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject35').analyticRuleVersion35]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject35')._analyticRulecontentId35]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when four-eyes authorization is disabled.", - "displayName": "Four-Eyes Authorization Disabled", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42401\n| extend Operation = extract(\"Operation=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Operation\"] = Operation,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject35').analyticRuleId35,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 35", - "parentId": "[variables('analyticRuleObject35').analyticRuleId35]", - "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject35').analyticRuleVersion35]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]", - "contentKind": "AnalyticsRule", - "displayName": "Four-Eyes Authorization Disabled", - "contentProductId": "[variables('analyticRuleObject35')._analyticRulecontentProductId35]", - "id": "[variables('analyticRuleObject35')._analyticRulecontentProductId35]", - "version": "[variables('analyticRuleObject35').analyticRuleVersion35]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject36').analyticRuleTemplateSpecName36]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Four_Eyes_Authorization_Request_Created_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject36').analyticRuleVersion36]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject36')._analyticRulecontentId36]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a four-eyes authorization request is created.", - "displayName": "Four-Eyes Authorization Request Created", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42402\n| extend Operation = extract(\"Operation=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Operation Name\"] = Operation,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject36').analyticRuleId36,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 36", - "parentId": "[variables('analyticRuleObject36').analyticRuleId36]", - "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject36').analyticRuleVersion36]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]", - "contentKind": "AnalyticsRule", - "displayName": "Four-Eyes Authorization Request Created", - "contentProductId": "[variables('analyticRuleObject36')._analyticRulecontentProductId36]", - "id": "[variables('analyticRuleObject36')._analyticRulecontentProductId36]", - "version": "[variables('analyticRuleObject36').analyticRuleVersion36]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject37').analyticRuleTemplateSpecName37]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Four_Eyes_Authorization_Request_Expired_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject37').analyticRuleVersion37]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject37')._analyticRulecontentId37]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a four-eyes authorization request is expired.", - "displayName": "Four-Eyes Authorization Request Expired", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42405\n| extend Operation = extract(\"Operation=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Operation\"] = Operation,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject37').analyticRuleId37,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 37", - "parentId": "[variables('analyticRuleObject37').analyticRuleId37]", - "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject37').analyticRuleVersion37]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]", - "contentKind": "AnalyticsRule", - "displayName": "Four-Eyes Authorization Request Expired", - "contentProductId": "[variables('analyticRuleObject37')._analyticRulecontentProductId37]", - "id": "[variables('analyticRuleObject37')._analyticRulecontentProductId37]", - "version": "[variables('analyticRuleObject37').analyticRuleVersion37]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject38').analyticRuleTemplateSpecName38]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Four_Eyes_Authorization_Request_Rejected_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject38').analyticRuleVersion38]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject38')._analyticRulecontentId38]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a four-eyes authorization request is rejected.", - "displayName": "Four-Eyes Authorization Request Rejected", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42404\n| extend Operation = extract(\"Operation=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Operation Name\"] = Operation,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject38').analyticRuleId38,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 38", - "parentId": "[variables('analyticRuleObject38').analyticRuleId38]", - "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject38').analyticRuleVersion38]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]", - "contentKind": "AnalyticsRule", - "displayName": "Four-Eyes Authorization Request Rejected", - "contentProductId": "[variables('analyticRuleObject38')._analyticRulecontentProductId38]", - "id": "[variables('analyticRuleObject38')._analyticRulecontentProductId38]", - "version": "[variables('analyticRuleObject38').analyticRuleVersion38]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject39').analyticRuleTemplateSpecName39]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "General_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject39').analyticRuleVersion39]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject39')._analyticRulecontentId39]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when Veeam Backup & Replication general settings are updated. This might indicate configuration changes that require review.", - "displayName": "General Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 31000\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject39').analyticRuleId39,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 39", - "parentId": "[variables('analyticRuleObject39').analyticRuleId39]", - "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject39').analyticRuleVersion39]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]", - "contentKind": "AnalyticsRule", - "displayName": "General Settings Updated", - "contentProductId": "[variables('analyticRuleObject39')._analyticRulecontentProductId39]", - "id": "[variables('analyticRuleObject39')._analyticRulecontentProductId39]", - "version": "[variables('analyticRuleObject39').analyticRuleVersion39]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject40').analyticRuleTemplateSpecName40]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Global_Network_Traffic_Rules_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject40').analyticRuleVersion40]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject40')._analyticRulecontentId40]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a global network traffic rule is deleted in Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Global Network Traffic Rules Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 32400\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject40').analyticRuleId40,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 40", - "parentId": "[variables('analyticRuleObject40').analyticRuleId40]", - "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject40').analyticRuleVersion40]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]", - "contentKind": "AnalyticsRule", - "displayName": "Global Network Traffic Rules Deleted", - "contentProductId": "[variables('analyticRuleObject40')._analyticRulecontentProductId40]", - "id": "[variables('analyticRuleObject40')._analyticRulecontentProductId40]", - "version": "[variables('analyticRuleObject40').analyticRuleVersion40]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject41').analyticRuleTemplateSpecName41]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Global_VM_Exclusions_Added_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject41').analyticRuleVersion41]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject41')._analyticRulecontentId41]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when global VM exclusion are added in Veeam Backup & Replication.", - "displayName": "Global VM Exclusions Added", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 40400\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject41').analyticRuleId41,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 41", - "parentId": "[variables('analyticRuleObject41').analyticRuleId41]", - "contentId": "[variables('analyticRuleObject41')._analyticRulecontentId41]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject41').analyticRuleVersion41]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject41')._analyticRulecontentId41]", - "contentKind": "AnalyticsRule", - "displayName": "Global VM Exclusions Added", - "contentProductId": "[variables('analyticRuleObject41')._analyticRulecontentProductId41]", - "id": "[variables('analyticRuleObject41')._analyticRulecontentProductId41]", - "version": "[variables('analyticRuleObject41').analyticRuleVersion41]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject42').analyticRuleTemplateSpecName42]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Global_VM_Exclusions_Changed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject42').analyticRuleVersion42]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject42')._analyticRulecontentId42]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when global VM exclusions are updated in Veeam Backup & Replication.", - "displayName": "Global VM Exclusions Changed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 40600\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject42').analyticRuleId42,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 42", - "parentId": "[variables('analyticRuleObject42').analyticRuleId42]", - "contentId": "[variables('analyticRuleObject42')._analyticRulecontentId42]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject42').analyticRuleVersion42]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject42')._analyticRulecontentId42]", - "contentKind": "AnalyticsRule", - "displayName": "Global VM Exclusions Changed", - "contentProductId": "[variables('analyticRuleObject42')._analyticRulecontentProductId42]", - "id": "[variables('analyticRuleObject42')._analyticRulecontentProductId42]", - "version": "[variables('analyticRuleObject42').analyticRuleVersion42]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject43').analyticRuleTemplateSpecName43]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Global_VM_Exclusions_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject43').analyticRuleVersion43]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject43')._analyticRulecontentId43]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a VM is removed from global exclusions in Veeam Backup & Replication. This might indicate unauthorized changes.", - "displayName": "Global VM Exclusions Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 40500\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject43').analyticRuleId43,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 43", - "parentId": "[variables('analyticRuleObject43').analyticRuleId43]", - "contentId": "[variables('analyticRuleObject43')._analyticRulecontentId43]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject43').analyticRuleVersion43]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject43')._analyticRulecontentId43]", - "contentKind": "AnalyticsRule", - "displayName": "Global VM Exclusions Deleted", - "contentProductId": "[variables('analyticRuleObject43')._analyticRulecontentProductId43]", - "id": "[variables('analyticRuleObject43')._analyticRulecontentProductId43]", - "version": "[variables('analyticRuleObject43').analyticRuleVersion43]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject44').analyticRuleTemplateSpecName44]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Host_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject44').analyticRuleVersion44]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject44')._analyticRulecontentId44]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a host is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Host Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 28500\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Data SourceName\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject44').analyticRuleId44,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 44", - "parentId": "[variables('analyticRuleObject44').analyticRuleId44]", - "contentId": "[variables('analyticRuleObject44')._analyticRulecontentId44]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject44').analyticRuleVersion44]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject44')._analyticRulecontentId44]", - "contentKind": "AnalyticsRule", - "displayName": "Host Deleted", - "contentProductId": "[variables('analyticRuleObject44')._analyticRulecontentProductId44]", - "id": "[variables('analyticRuleObject44')._analyticRulecontentProductId44]", - "version": "[variables('analyticRuleObject44').analyticRuleVersion44]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject45').analyticRuleTemplateSpecName45]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Host_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject45').analyticRuleVersion45]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject45')._analyticRulecontentId45]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when host settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Host Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 28400\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject45').analyticRuleId45,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 45", - "parentId": "[variables('analyticRuleObject45').analyticRuleId45]", - "contentId": "[variables('analyticRuleObject45')._analyticRulecontentId45]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject45').analyticRuleVersion45]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject45')._analyticRulecontentId45]", - "contentKind": "AnalyticsRule", - "displayName": "Host Settings Updated", - "contentProductId": "[variables('analyticRuleObject45')._analyticRulecontentProductId45]", - "id": "[variables('analyticRuleObject45')._analyticRulecontentProductId45]", - "version": "[variables('analyticRuleObject45').analyticRuleVersion45]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject46').analyticRuleTemplateSpecName46]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Hypervisor_Host_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject46').analyticRuleVersion46]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject46')._analyticRulecontentId46]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a hypervisor host is deleted from Veeam Backup & Replication. This might indicate unauthorized changes to the virtualization environment.", - "displayName": "Hypervisor Host Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 24070 \n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n [\"DataSource\"] = original_host,\n EventId = instanceId,\n UserName = user,\n [\"MessageDetails\"] = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "entityMappings": [ - { - "entityType": "Host", - "fieldMappings": [ - { - "identifier": "FullName", - "columnName": "DataSource" - } - ] - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "messageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject46').analyticRuleId46,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 46", - "parentId": "[variables('analyticRuleObject46').analyticRuleId46]", - "contentId": "[variables('analyticRuleObject46')._analyticRulecontentId46]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject46').analyticRuleVersion46]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject46')._analyticRulecontentId46]", - "contentKind": "AnalyticsRule", - "displayName": "Hypervisor Host Deleted", - "contentProductId": "[variables('analyticRuleObject46')._analyticRulecontentProductId46]", - "id": "[variables('analyticRuleObject46')._analyticRulecontentProductId46]", - "version": "[variables('analyticRuleObject46').analyticRuleVersion46]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject47').analyticRuleTemplateSpecName47]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Hypervisor_Host_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject47').analyticRuleVersion47]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject47')._analyticRulecontentId47]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when hypervisor host settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Hypervisor Host Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 25800\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject47').analyticRuleId47,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 47", - "parentId": "[variables('analyticRuleObject47').analyticRuleId47]", - "contentId": "[variables('analyticRuleObject47')._analyticRulecontentId47]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject47').analyticRuleVersion47]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject47')._analyticRulecontentId47]", - "contentKind": "AnalyticsRule", - "displayName": "Hypervisor Host Settings Updated", - "contentProductId": "[variables('analyticRuleObject47')._analyticRulecontentProductId47]", - "id": "[variables('analyticRuleObject47')._analyticRulecontentProductId47]", - "version": "[variables('analyticRuleObject47').analyticRuleVersion47]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject48').analyticRuleTemplateSpecName48]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Invalid_Code_for_Multi_Factor_Authentication_Entered_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject48').analyticRuleVersion48]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject48')._analyticRulecontentId48]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects failed multi-factor authentication attempts. This might indicate credential stuffing or brute-force attacks.", - "displayName": "Invalid Code for Multi-Factor Authentication Entered", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 40205\n| extend SID = extract(\"SID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Endpoint = extract(\"Endpoint=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Endpoint\"] = Endpoint,\n [\"User SID\"] = SID,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject48').analyticRuleId48,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 48", - "parentId": "[variables('analyticRuleObject48').analyticRuleId48]", - "contentId": "[variables('analyticRuleObject48')._analyticRulecontentId48]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject48').analyticRuleVersion48]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject48')._analyticRulecontentId48]", - "contentKind": "AnalyticsRule", - "displayName": "Invalid Code for Multi-Factor Authentication Entered", - "contentProductId": "[variables('analyticRuleObject48')._analyticRulecontentProductId48]", - "id": "[variables('analyticRuleObject48')._analyticRulecontentProductId48]", - "version": "[variables('analyticRuleObject48').analyticRuleVersion48]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject49').analyticRuleTemplateSpecName49]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Job_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject49').analyticRuleVersion49]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject49')._analyticRulecontentId49]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a job is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Job Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 23090\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Job Name\"] = \"\",\n MessageDetails = Description,\n Severity = SeverityDescription\n| project Date, DataSource, EventId, UserName, [\"Job Name\"],MessageDetails,Severity", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject49').analyticRuleId49,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 49", - "parentId": "[variables('analyticRuleObject49').analyticRuleId49]", - "contentId": "[variables('analyticRuleObject49')._analyticRulecontentId49]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject49').analyticRuleVersion49]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject49')._analyticRulecontentId49]", - "contentKind": "AnalyticsRule", - "displayName": "Job Deleted", - "contentProductId": "[variables('analyticRuleObject49')._analyticRulecontentProductId49]", - "id": "[variables('analyticRuleObject49')._analyticRulecontentProductId49]", - "version": "[variables('analyticRuleObject49').analyticRuleVersion49]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject50').analyticRuleTemplateSpecName50]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Job_No_Longer_Used_as_Second_Destination_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject50').analyticRuleVersion50]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject50')._analyticRulecontentId50]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a job used as a secondary destination is removed.", - "displayName": "Job No Longer Used as Second Destination", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 23420\n| extend JobName = extract(\"JobName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Job Name\"] = JobName,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject50').analyticRuleId50,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 50", - "parentId": "[variables('analyticRuleObject50').analyticRuleId50]", - "contentId": "[variables('analyticRuleObject50')._analyticRulecontentId50]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject50').analyticRuleVersion50]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject50')._analyticRulecontentId50]", - "contentKind": "AnalyticsRule", - "displayName": "Job No Longer Used as Second Destination", - "contentProductId": "[variables('analyticRuleObject50')._analyticRulecontentProductId50]", - "id": "[variables('analyticRuleObject50')._analyticRulecontentProductId50]", - "version": "[variables('analyticRuleObject50').analyticRuleVersion50]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject51').analyticRuleTemplateSpecName51]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "KMS_Key_Rotation_Job_Finished_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject51').analyticRuleVersion51]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject51')._analyticRulecontentId51]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a KMS key rotation job is finished.", - "displayName": "KMS Key Rotation Job Finished", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42500\n| extend ResultMessage = extract(\"ResultMessage=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"StateMessage\"] = ResultMessage,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject51').analyticRuleId51,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 51", - "parentId": "[variables('analyticRuleObject51').analyticRuleId51]", - "contentId": "[variables('analyticRuleObject51')._analyticRulecontentId51]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject51').analyticRuleVersion51]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject51')._analyticRulecontentId51]", - "contentKind": "AnalyticsRule", - "displayName": "KMS Key Rotation Job Finished", - "contentProductId": "[variables('analyticRuleObject51')._analyticRulecontentProductId51]", - "id": "[variables('analyticRuleObject51')._analyticRulecontentProductId51]", - "version": "[variables('analyticRuleObject51').analyticRuleVersion51]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject52').analyticRuleTemplateSpecName52]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "KMS_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject52').analyticRuleVersion52]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject52')._analyticRulecontentId52]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a KMS server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "KMS Server Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42301\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject52').analyticRuleId52,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 52", - "parentId": "[variables('analyticRuleObject52').analyticRuleId52]", - "contentId": "[variables('analyticRuleObject52')._analyticRulecontentId52]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject52').analyticRuleVersion52]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject52')._analyticRulecontentId52]", - "contentKind": "AnalyticsRule", - "displayName": "KMS Server Deleted", - "contentProductId": "[variables('analyticRuleObject52')._analyticRulecontentProductId52]", - "id": "[variables('analyticRuleObject52')._analyticRulecontentProductId52]", - "version": "[variables('analyticRuleObject52').analyticRuleVersion52]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject53').analyticRuleTemplateSpecName53]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "KMS_Server_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject53').analyticRuleVersion53]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject53')._analyticRulecontentId53]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when KMS server settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "KMS Server Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42302\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Obeject Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject53').analyticRuleId53,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 53", - "parentId": "[variables('analyticRuleObject53').analyticRuleId53]", - "contentId": "[variables('analyticRuleObject53')._analyticRulecontentId53]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject53').analyticRuleVersion53]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject53')._analyticRulecontentId53]", - "contentKind": "AnalyticsRule", - "displayName": "KMS Server Settings Updated", - "contentProductId": "[variables('analyticRuleObject53')._analyticRulecontentProductId53]", - "id": "[variables('analyticRuleObject53')._analyticRulecontentProductId53]", - "version": "[variables('analyticRuleObject53').analyticRuleVersion53]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject54').analyticRuleTemplateSpecName54]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "License_Expired_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject54').analyticRuleVersion54]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject54')._analyticRulecontentId54]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a Veeam license is expired. This could impact backup operations and data protection.", - "displayName": "License Expired", - "enabled": false, - "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24030\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject54').analyticRuleId54,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 54", - "parentId": "[variables('analyticRuleObject54').analyticRuleId54]", - "contentId": "[variables('analyticRuleObject54')._analyticRulecontentId54]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject54').analyticRuleVersion54]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject54')._analyticRulecontentId54]", - "contentKind": "AnalyticsRule", - "displayName": "License Expired", - "contentProductId": "[variables('analyticRuleObject54')._analyticRulecontentProductId54]", - "id": "[variables('analyticRuleObject54')._analyticRulecontentProductId54]", - "version": "[variables('analyticRuleObject54').analyticRuleVersion54]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject55').analyticRuleTemplateSpecName55]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "License_Expiring_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject55').analyticRuleVersion55]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject55')._analyticRulecontentId55]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a Veeam license expires shortly.", - "displayName": "License Expiring", - "enabled": false, - "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24020\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject55').analyticRuleId55,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 55", - "parentId": "[variables('analyticRuleObject55').analyticRuleId55]", - "contentId": "[variables('analyticRuleObject55')._analyticRulecontentId55]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject55').analyticRuleVersion55]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject55')._analyticRulecontentId55]", - "contentKind": "AnalyticsRule", - "displayName": "License Expiring", - "contentProductId": "[variables('analyticRuleObject55')._analyticRulecontentProductId55]", - "id": "[variables('analyticRuleObject55')._analyticRulecontentProductId55]", - "version": "[variables('analyticRuleObject55').analyticRuleVersion55]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject56').analyticRuleTemplateSpecName56]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "License_Grace_Period_Started_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject56').analyticRuleVersion56]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject56')._analyticRulecontentId56]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a Veeam license grace period starts. This might indicate potential licensing issues that need attention.", - "displayName": "License Grace Period Started", - "enabled": false, - "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24060\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject56').analyticRuleId56,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 56", - "parentId": "[variables('analyticRuleObject56').analyticRuleId56]", - "contentId": "[variables('analyticRuleObject56')._analyticRulecontentId56]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject56').analyticRuleVersion56]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject56')._analyticRulecontentId56]", - "contentKind": "AnalyticsRule", - "displayName": "License Grace Period Started", - "contentProductId": "[variables('analyticRuleObject56')._analyticRulecontentProductId56]", - "id": "[variables('analyticRuleObject56')._analyticRulecontentProductId56]", - "version": "[variables('analyticRuleObject56').analyticRuleVersion56]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject57').analyticRuleTemplateSpecName57]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "License_Limit_Exceeded_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject57').analyticRuleVersion57]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject57')._analyticRulecontentId57]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when the Veeam license limit is exceeded.", - "displayName": "License Limit Exceeded", - "enabled": false, - "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24070\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject57').analyticRuleId57,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 57", - "parentId": "[variables('analyticRuleObject57').analyticRuleId57]", - "contentId": "[variables('analyticRuleObject57')._analyticRulecontentId57]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject57').analyticRuleVersion57]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject57')._analyticRulecontentId57]", - "contentKind": "AnalyticsRule", - "displayName": "License Limit Exceeded", - "contentProductId": "[variables('analyticRuleObject57')._analyticRulecontentProductId57]", - "id": "[variables('analyticRuleObject57')._analyticRulecontentProductId57]", - "version": "[variables('analyticRuleObject57').analyticRuleVersion57]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject58').analyticRuleTemplateSpecName58]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "License_Removed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject58').analyticRuleVersion58]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject58')._analyticRulecontentId58]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when the Veeam license is removed from Veeam Backup & Replication.", - "displayName": "License Removed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 24080\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject58').analyticRuleId58,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 58", - "parentId": "[variables('analyticRuleObject58').analyticRuleId58]", - "contentId": "[variables('analyticRuleObject58')._analyticRulecontentId58]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject58').analyticRuleVersion58]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject58')._analyticRulecontentId58]", - "contentKind": "AnalyticsRule", - "displayName": "License Removed", - "contentProductId": "[variables('analyticRuleObject58')._analyticRulecontentProductId58]", - "id": "[variables('analyticRuleObject58')._analyticRulecontentProductId58]", - "version": "[variables('analyticRuleObject58').analyticRuleVersion58]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject59').analyticRuleTemplateSpecName59]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "License_Support_Expired_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject59').analyticRuleVersion59]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject59')._analyticRulecontentId59]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when the Veeam support contract is expired. This might impact backup operations and data protection.", - "displayName": "License Support Expired", - "enabled": false, - "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24050\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject59').analyticRuleId59,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 59", - "parentId": "[variables('analyticRuleObject59').analyticRuleId59]", - "contentId": "[variables('analyticRuleObject59')._analyticRulecontentId59]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject59').analyticRuleVersion59]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject59')._analyticRulecontentId59]", - "contentKind": "AnalyticsRule", - "displayName": "License Support Expired", - "contentProductId": "[variables('analyticRuleObject59')._analyticRulecontentProductId59]", - "id": "[variables('analyticRuleObject59')._analyticRulecontentProductId59]", - "version": "[variables('analyticRuleObject59').analyticRuleVersion59]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject60').analyticRuleTemplateSpecName60]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "License_Support_Expiring_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject60').analyticRuleVersion60]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject60')._analyticRulecontentId60]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when the Veeam support contract expires shortly.", - "displayName": "License Support Expiring", - "enabled": false, - "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24040\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject60').analyticRuleId60,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 60", - "parentId": "[variables('analyticRuleObject60').analyticRuleId60]", - "contentId": "[variables('analyticRuleObject60')._analyticRulecontentId60]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject60').analyticRuleVersion60]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject60')._analyticRulecontentId60]", - "contentKind": "AnalyticsRule", - "displayName": "License Support Expiring", - "contentProductId": "[variables('analyticRuleObject60')._analyticRulecontentProductId60]", - "id": "[variables('analyticRuleObject60')._analyticRulecontentProductId60]", - "version": "[variables('analyticRuleObject60').analyticRuleVersion60]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject61').analyticRuleTemplateSpecName61]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Malware_Activity_Detected_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject61').analyticRuleVersion61]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject61')._analyticRulecontentId61]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when restore points marked as suspicious. This might indicate potential compromise of backup data.", - "displayName": "Malware Activity Detected", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 41600\n| extend ActivityType = extract(\"ActivityType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend MachineDisplayName = extract(\"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\\\s*\\\\(([^)]+)\\\\)\", 1, Description)\n| extend MachineUuid = extract(\"([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\", 1, Description)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Malware Detection Method\"] = ActivityType,\n MessageDetails = Description,\n Severity = SeverityDescription,\n MachineDisplayName,\n MachineUuid\n", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "MessageDetails": "MessageDetails", - "VbrHostName": "DataSource", - "MachineDisplayName": "MachineDisplayName", - "MachineUuid": "MachineUuid", - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject61').analyticRuleId61,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 61", - "parentId": "[variables('analyticRuleObject61').analyticRuleId61]", - "contentId": "[variables('analyticRuleObject61')._analyticRulecontentId61]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject61').analyticRuleVersion61]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject61')._analyticRulecontentId61]", - "contentKind": "AnalyticsRule", - "displayName": "Malware Activity Detected", - "contentProductId": "[variables('analyticRuleObject61')._analyticRulecontentProductId61]", - "id": "[variables('analyticRuleObject61')._analyticRulecontentProductId61]", - "version": "[variables('analyticRuleObject61').analyticRuleVersion61]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject62').analyticRuleTemplateSpecName62]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Malware_Detection_Exclusions_List_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject62').analyticRuleVersion62]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject62')._analyticRulecontentId62]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when malware detection exclusions are updated. This might indicate potential compromise of backup data.", - "displayName": "Malware Detection Exclusions List Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42280\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription\n| project Date, DataSource, EventId, UserName,MessageDetails,Severity", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject62').analyticRuleId62,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 62", - "parentId": "[variables('analyticRuleObject62').analyticRuleId62]", - "contentId": "[variables('analyticRuleObject62')._analyticRulecontentId62]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject62').analyticRuleVersion62]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject62')._analyticRulecontentId62]", - "contentKind": "AnalyticsRule", - "displayName": "Malware Detection Exclusions List Updated", - "contentProductId": "[variables('analyticRuleObject62')._analyticRulecontentProductId62]", - "id": "[variables('analyticRuleObject62')._analyticRulecontentProductId62]", - "version": "[variables('analyticRuleObject62').analyticRuleVersion62]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject63').analyticRuleTemplateSpecName63]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Malware_Detection_Session_Finished_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject63').analyticRuleVersion63]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject63')._analyticRulecontentId63]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when malware detection session finishes.", - "displayName": "Malware Detection Session Finished", - "enabled": false, - "query": "let action_results_lookup = union isfuzzy=true (datatable(JobResult:string, JobResultMessage:string)[]), (_GetWatchlist(\"action_results_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 42210\n| extend Result = extract(\"Result=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SessionID = extract(\"SessionID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (action_results_lookup)\n on $left.Result == $right.JobResult\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Session ID\"] = SessionID,\n [\"StateMessage\"] = JobResultMessage,\n MessageDetails = Description,\n Severity = SeverityDescription\n", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject63').analyticRuleId63,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 63", - "parentId": "[variables('analyticRuleObject63').analyticRuleId63]", - "contentId": "[variables('analyticRuleObject63')._analyticRulecontentId63]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject63').analyticRuleVersion63]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject63')._analyticRulecontentId63]", - "contentKind": "AnalyticsRule", - "displayName": "Malware Detection Session Finished", - "contentProductId": "[variables('analyticRuleObject63')._analyticRulecontentProductId63]", - "id": "[variables('analyticRuleObject63')._analyticRulecontentProductId63]", - "version": "[variables('analyticRuleObject63').analyticRuleVersion63]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject64').analyticRuleTemplateSpecName64]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Malware_Detection_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject64').analyticRuleVersion64]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject64')._analyticRulecontentId64]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when malware detection settings are updated.", - "displayName": "Malware Detection Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42290\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject64').analyticRuleId64,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 64", - "parentId": "[variables('analyticRuleObject64').analyticRuleId64]", - "contentId": "[variables('analyticRuleObject64')._analyticRulecontentId64]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject64').analyticRuleVersion64]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject64')._analyticRulecontentId64]", - "contentKind": "AnalyticsRule", - "displayName": "Malware Detection Settings Updated", - "contentProductId": "[variables('analyticRuleObject64')._analyticRulecontentProductId64]", - "id": "[variables('analyticRuleObject64')._analyticRulecontentProductId64]", - "version": "[variables('analyticRuleObject64').analyticRuleVersion64]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject65').analyticRuleTemplateSpecName65]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Malware_Event_Detected_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject65').analyticRuleVersion65]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject65')._analyticRulecontentId65]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when restore points are marked as infected. This might indicate potential compromise of backup data.", - "displayName": "Malware Event Detected", - "enabled": false, - "query": "VeeamMalwareEvents_CL", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamMalwareEvents_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "entityMappings": [ - { - "entityType": "Host", - "fieldMappings": [ - { - "identifier": "HostName", - "columnName": "VbrHostName" - } - ] - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "BackupObjectId": "MachineBackupObjectId", - "MachineUuid": "MachineUuid", - "MachineDisplayName": "MachineDisplayName", - "VbrHostName": "VbrHostName" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject65').analyticRuleId65,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 65", - "parentId": "[variables('analyticRuleObject65').analyticRuleId65]", - "contentId": "[variables('analyticRuleObject65')._analyticRulecontentId65]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject65').analyticRuleVersion65]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject65')._analyticRulecontentId65]", - "contentKind": "AnalyticsRule", - "displayName": "Malware Event Detected", - "contentProductId": "[variables('analyticRuleObject65')._analyticRulecontentProductId65]", - "id": "[variables('analyticRuleObject65')._analyticRulecontentProductId65]", - "version": "[variables('analyticRuleObject65').analyticRuleVersion65]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject66').analyticRuleTemplateSpecName66]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Multi_Factor_Authentication_Disabled_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject66').analyticRuleVersion66]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject66')._analyticRulecontentId66]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when multi-factor authentication is disabled for all users.", - "displayName": "Multi-Factor Authentication Disabled", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 40201\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject66').analyticRuleId66,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 66", - "parentId": "[variables('analyticRuleObject66').analyticRuleId66]", - "contentId": "[variables('analyticRuleObject66')._analyticRulecontentId66]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject66').analyticRuleVersion66]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject66')._analyticRulecontentId66]", - "contentKind": "AnalyticsRule", - "displayName": "Multi-Factor Authentication Disabled", - "contentProductId": "[variables('analyticRuleObject66')._analyticRulecontentProductId66]", - "id": "[variables('analyticRuleObject66')._analyticRulecontentProductId66]", - "version": "[variables('analyticRuleObject66').analyticRuleVersion66]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject67').analyticRuleTemplateSpecName67]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Multi_Factor_Authentication_for_User_Disabled_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject67').analyticRuleVersion67]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject67')._analyticRulecontentId67]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when multi-factor authentication is disabled for a specific user.", - "displayName": "Multi-Factor Authentication for User Disabled", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 40204\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject67').analyticRuleId67,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 67", - "parentId": "[variables('analyticRuleObject67').analyticRuleId67]", - "contentId": "[variables('analyticRuleObject67')._analyticRulecontentId67]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject67').analyticRuleVersion67]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject67')._analyticRulecontentId67]", - "contentKind": "AnalyticsRule", - "displayName": "Multi-Factor Authentication for User Disabled", - "contentProductId": "[variables('analyticRuleObject67')._analyticRulecontentProductId67]", - "id": "[variables('analyticRuleObject67')._analyticRulecontentProductId67]", - "version": "[variables('analyticRuleObject67').analyticRuleVersion67]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject68').analyticRuleTemplateSpecName68]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Multi_Factor_Authentication_Token_Revoked_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject68').analyticRuleVersion68]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject68')._analyticRulecontentId68]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a multi-factor authentication token is revoked.", - "displayName": "Multi-Factor Authentication Token Revoked", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 40202\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject68').analyticRuleId68,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 68", - "parentId": "[variables('analyticRuleObject68').analyticRuleId68]", - "contentId": "[variables('analyticRuleObject68')._analyticRulecontentId68]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject68').analyticRuleVersion68]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject68')._analyticRulecontentId68]", - "contentKind": "AnalyticsRule", - "displayName": "Multi-Factor Authentication Token Revoked", - "contentProductId": "[variables('analyticRuleObject68')._analyticRulecontentProductId68]", - "id": "[variables('analyticRuleObject68')._analyticRulecontentProductId68]", - "version": "[variables('analyticRuleObject68').analyticRuleVersion68]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject69').analyticRuleTemplateSpecName69]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Multi_Factor_Authentication_User_Locked_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject69').analyticRuleVersion69]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject69')._analyticRulecontentId69]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when the allowed number of multi-factor authentication attempts is exceeded for a user.", - "displayName": "Multi-Factor Authentication User Locked", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 40206\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription\n| project Date, DataSource, EventId, UserName,MessageDetails,Severity", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject69').analyticRuleId69,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 69", - "parentId": "[variables('analyticRuleObject69').analyticRuleId69]", - "contentId": "[variables('analyticRuleObject69')._analyticRulecontentId69]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject69').analyticRuleVersion69]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject69')._analyticRulecontentId69]", - "contentKind": "AnalyticsRule", - "displayName": "Multi-Factor Authentication User Locked", - "contentProductId": "[variables('analyticRuleObject69')._analyticRulecontentProductId69]", - "id": "[variables('analyticRuleObject69')._analyticRulecontentProductId69]", - "version": "[variables('analyticRuleObject69').analyticRuleVersion69]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject70').analyticRuleTemplateSpecName70]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "NDMP_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject70').analyticRuleVersion70]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject70')._analyticRulecontentId70]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when an NDMP server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "NDMP Server Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 28850\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject70').analyticRuleId70,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 70", - "parentId": "[variables('analyticRuleObject70').analyticRuleId70]", - "contentId": "[variables('analyticRuleObject70')._analyticRulecontentId70]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject70').analyticRuleVersion70]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject70')._analyticRulecontentId70]", - "contentKind": "AnalyticsRule", - "displayName": "NDMP Server Deleted", - "contentProductId": "[variables('analyticRuleObject70')._analyticRulecontentProductId70]", - "id": "[variables('analyticRuleObject70')._analyticRulecontentProductId70]", - "version": "[variables('analyticRuleObject70').analyticRuleVersion70]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject71').analyticRuleTemplateSpecName71]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Object_Marked_as_Clean_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject71').analyticRuleVersion71]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject71')._analyticRulecontentId71]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when an object is marked as clean.", - "displayName": "Object Marked as Clean", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 41610\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject71').analyticRuleId71,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 71", - "parentId": "[variables('analyticRuleObject71').analyticRuleId71]", - "contentId": "[variables('analyticRuleObject71')._analyticRulecontentId71]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject71').analyticRuleVersion71]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject71')._analyticRulecontentId71]", - "contentKind": "AnalyticsRule", - "displayName": "Object Marked as Clean", - "contentProductId": "[variables('analyticRuleObject71')._analyticRulecontentProductId71]", - "id": "[variables('analyticRuleObject71')._analyticRulecontentProductId71]", - "version": "[variables('analyticRuleObject71').analyticRuleVersion71]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject72').analyticRuleTemplateSpecName72]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Object_Storage_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject72').analyticRuleVersion72]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject72')._analyticRulecontentId72]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when an object storage is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Object Storage Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 28980\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Data SourceName\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject72').analyticRuleId72,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 72", - "parentId": "[variables('analyticRuleObject72').analyticRuleId72]", - "contentId": "[variables('analyticRuleObject72')._analyticRulecontentId72]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject72').analyticRuleVersion72]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject72')._analyticRulecontentId72]", - "contentKind": "AnalyticsRule", - "displayName": "Object Storage Deleted", - "contentProductId": "[variables('analyticRuleObject72')._analyticRulecontentProductId72]", - "id": "[variables('analyticRuleObject72')._analyticRulecontentProductId72]", - "version": "[variables('analyticRuleObject72').analyticRuleVersion72]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject73').analyticRuleTemplateSpecName73]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Object_Storage_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject73').analyticRuleVersion73]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject73')._analyticRulecontentId73]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when object storage settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Object Storage Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 28970\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Data SourceName\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject73').analyticRuleId73,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 73", - "parentId": "[variables('analyticRuleObject73').analyticRuleId73]", - "contentId": "[variables('analyticRuleObject73')._analyticRulecontentId73]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject73').analyticRuleVersion73]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject73')._analyticRulecontentId73]", - "contentKind": "AnalyticsRule", - "displayName": "Object Storage Settings Updated", - "contentProductId": "[variables('analyticRuleObject73')._analyticRulecontentProductId73]", - "id": "[variables('analyticRuleObject73')._analyticRulecontentProductId73]", - "version": "[variables('analyticRuleObject73').analyticRuleVersion73]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject74').analyticRuleTemplateSpecName74]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Objects_Added_to_Malware_Detection_Exclusions_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject74').analyticRuleVersion74]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject74')._analyticRulecontentId74]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when an object is added to malware detection exclusions.", - "displayName": "Objects Added to Malware Detection Exclusions", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42260\n| extend AddedObjectNames = extract(\"AddedObjectNames=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Object Names\"] = AddedObjectNames,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject74').analyticRuleId74,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 74", - "parentId": "[variables('analyticRuleObject74').analyticRuleId74]", - "contentId": "[variables('analyticRuleObject74')._analyticRulecontentId74]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject74').analyticRuleVersion74]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject74')._analyticRulecontentId74]", - "contentKind": "AnalyticsRule", - "displayName": "Objects Added to Malware Detection Exclusions", - "contentProductId": "[variables('analyticRuleObject74')._analyticRulecontentProductId74]", - "id": "[variables('analyticRuleObject74')._analyticRulecontentProductId74]", - "version": "[variables('analyticRuleObject74').analyticRuleVersion74]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject75').analyticRuleTemplateSpecName75]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Objects_Deleted_from_Malware_Detection_Exclusions_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject75').analyticRuleVersion75]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject75')._analyticRulecontentId75]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when an object is deleted from malware detection exclusions.", - "displayName": "Objects Deleted from Malware Detection Exclusions", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42270\n| extend RemovedObjectNames = extract(\"RemovedObjectNames=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Object Names\"] = RemovedObjectNames,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject75').analyticRuleId75,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 75", - "parentId": "[variables('analyticRuleObject75').analyticRuleId75]", - "contentId": "[variables('analyticRuleObject75')._analyticRulecontentId75]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject75').analyticRuleVersion75]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject75')._analyticRulecontentId75]", - "contentKind": "AnalyticsRule", - "displayName": "Objects Deleted from Malware Detection Exclusions", - "contentProductId": "[variables('analyticRuleObject75')._analyticRulecontentProductId75]", - "id": "[variables('analyticRuleObject75')._analyticRulecontentProductId75]", - "version": "[variables('analyticRuleObject75').analyticRuleVersion75]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject76').analyticRuleTemplateSpecName76]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Objects_for_Job_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject76').analyticRuleVersion76]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject76')._analyticRulecontentId76]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when objects are deleted from the job. This might indicate unauthorized removal of critical components.", - "displayName": "Objects for Job Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 32120\n| extend JobName = extract(\"JobName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Job Name\"] = JobName,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject76').analyticRuleId76,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 76", - "parentId": "[variables('analyticRuleObject76').analyticRuleId76]", - "contentId": "[variables('analyticRuleObject76')._analyticRulecontentId76]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject76').analyticRuleVersion76]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject76')._analyticRulecontentId76]", - "contentKind": "AnalyticsRule", - "displayName": "Objects for Job Deleted", - "contentProductId": "[variables('analyticRuleObject76')._analyticRulecontentProductId76]", - "id": "[variables('analyticRuleObject76')._analyticRulecontentProductId76]", - "version": "[variables('analyticRuleObject76').analyticRuleVersion76]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject77').analyticRuleTemplateSpecName77]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Objects_for_Protection_Group_Changed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject77').analyticRuleVersion77]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject77')._analyticRulecontentId77]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when protection group objects are updated.", - "displayName": "Objects for Protection Group Changed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 29140\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject77').analyticRuleId77,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 77", - "parentId": "[variables('analyticRuleObject77').analyticRuleId77]", - "contentId": "[variables('analyticRuleObject77')._analyticRulecontentId77]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject77').analyticRuleVersion77]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject77')._analyticRulecontentId77]", - "contentKind": "AnalyticsRule", - "displayName": "Objects for Protection Group Changed", - "contentProductId": "[variables('analyticRuleObject77')._analyticRulecontentProductId77]", - "id": "[variables('analyticRuleObject77')._analyticRulecontentProductId77]", - "version": "[variables('analyticRuleObject77').analyticRuleVersion77]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject78').analyticRuleTemplateSpecName78]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Objects_for_Protection_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject78').analyticRuleVersion78]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject78')._analyticRulecontentId78]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when objects are deleted from a protection group. This might indicate unauthorized removal of critical components.", - "displayName": "Objects for Protection Group Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 29150\n| extend ProtectionGroupName = extract(\"ProtectionGroupName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Protection Group Name\"] = ProtectionGroupName,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject78').analyticRuleId78,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 78", - "parentId": "[variables('analyticRuleObject78').analyticRuleId78]", - "contentId": "[variables('analyticRuleObject78')._analyticRulecontentId78]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject78').analyticRuleVersion78]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject78')._analyticRulecontentId78]", - "contentKind": "AnalyticsRule", - "displayName": "Objects for Protection Group Deleted", - "contentProductId": "[variables('analyticRuleObject78')._analyticRulecontentProductId78]", - "id": "[variables('analyticRuleObject78')._analyticRulecontentProductId78]", - "version": "[variables('analyticRuleObject78').analyticRuleVersion78]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject79').analyticRuleTemplateSpecName79]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Preferred_Networks_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject79').analyticRuleVersion79]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject79')._analyticRulecontentId79]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a preferred network is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Preferred Networks Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 32800\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject79').analyticRuleId79,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 79", - "parentId": "[variables('analyticRuleObject79').analyticRuleId79]", - "contentId": "[variables('analyticRuleObject79')._analyticRulecontentId79]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject79').analyticRuleVersion79]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject79')._analyticRulecontentId79]", - "contentKind": "AnalyticsRule", - "displayName": "Preferred Networks Deleted", - "contentProductId": "[variables('analyticRuleObject79')._analyticRulecontentProductId79]", - "id": "[variables('analyticRuleObject79')._analyticRulecontentProductId79]", - "version": "[variables('analyticRuleObject79').analyticRuleVersion79]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject80').analyticRuleTemplateSpecName80]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Protection_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject80').analyticRuleVersion80]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject80')._analyticRulecontentId80]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a protection group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Protection Group Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 29120\n| extend ProtectionGroupName = extract(\"ProtectionGroupName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Protection Group Name\"] = ProtectionGroupName,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject80').analyticRuleId80,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 80", - "parentId": "[variables('analyticRuleObject80').analyticRuleId80]", - "contentId": "[variables('analyticRuleObject80')._analyticRulecontentId80]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject80').analyticRuleVersion80]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject80')._analyticRulecontentId80]", - "contentKind": "AnalyticsRule", - "displayName": "Protection Group Deleted", - "contentProductId": "[variables('analyticRuleObject80')._analyticRulecontentProductId80]", - "id": "[variables('analyticRuleObject80')._analyticRulecontentProductId80]", - "version": "[variables('analyticRuleObject80').analyticRuleVersion80]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject81').analyticRuleTemplateSpecName81]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Protection_Group_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject81').analyticRuleVersion81]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject81')._analyticRulecontentId81]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when protection group settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Protection Group Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 29110\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject81').analyticRuleId81,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 81", - "parentId": "[variables('analyticRuleObject81').analyticRuleId81]", - "contentId": "[variables('analyticRuleObject81')._analyticRulecontentId81]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject81').analyticRuleVersion81]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject81')._analyticRulecontentId81]", - "contentKind": "AnalyticsRule", - "displayName": "Protection Group Settings Updated", - "contentProductId": "[variables('analyticRuleObject81')._analyticRulecontentProductId81]", - "id": "[variables('analyticRuleObject81')._analyticRulecontentProductId81]", - "version": "[variables('analyticRuleObject81').analyticRuleVersion81]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject82').analyticRuleTemplateSpecName82]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Recovery_Token_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject82').analyticRuleVersion82]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject82')._analyticRulecontentId82]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a recovery token is deleted. This might indicate unauthorized removal of critical components.", - "displayName": "Recovery Token Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 36013\n| extend TokenID = extract(\"TokenID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Token ID\"] = TokenID,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject82').analyticRuleId82,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 82", - "parentId": "[variables('analyticRuleObject82').analyticRuleId82]", - "contentId": "[variables('analyticRuleObject82')._analyticRulecontentId82]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject82').analyticRuleVersion82]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject82')._analyticRulecontentId82]", - "contentKind": "AnalyticsRule", - "displayName": "Recovery Token Deleted", - "contentProductId": "[variables('analyticRuleObject82')._analyticRulecontentProductId82]", - "id": "[variables('analyticRuleObject82')._analyticRulecontentProductId82]", - "version": "[variables('analyticRuleObject82').analyticRuleVersion82]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject83').analyticRuleTemplateSpecName83]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Restore_Point_Marked_as_Clean_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject83').analyticRuleVersion83]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject83')._analyticRulecontentId83]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a restore point is marked as clean.", - "displayName": "Restore Point Marked as Clean", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42230\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject83').analyticRuleId83,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 83", - "parentId": "[variables('analyticRuleObject83').analyticRuleId83]", - "contentId": "[variables('analyticRuleObject83')._analyticRulecontentId83]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject83').analyticRuleVersion83]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject83')._analyticRulecontentId83]", - "contentKind": "AnalyticsRule", - "displayName": "Restore Point Marked as Clean", - "contentProductId": "[variables('analyticRuleObject83')._analyticRulecontentProductId83]", - "id": "[variables('analyticRuleObject83')._analyticRulecontentProductId83]", - "version": "[variables('analyticRuleObject83').analyticRuleVersion83]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject84').analyticRuleTemplateSpecName84]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Restore_Point_Marked_as_Infected_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject84').analyticRuleVersion84]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject84')._analyticRulecontentId84]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a restore point is marked as infected.", - "displayName": "Restore Point Marked as Infected", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 42220\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject84').analyticRuleId84,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 84", - "parentId": "[variables('analyticRuleObject84').analyticRuleId84]", - "contentId": "[variables('analyticRuleObject84')._analyticRulecontentId84]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject84').analyticRuleVersion84]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject84')._analyticRulecontentId84]", - "contentKind": "AnalyticsRule", - "displayName": "Restore Point Marked as Infected", - "contentProductId": "[variables('analyticRuleObject84')._analyticRulecontentProductId84]", - "id": "[variables('analyticRuleObject84')._analyticRulecontentProductId84]", - "version": "[variables('analyticRuleObject84').analyticRuleVersion84]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject85').analyticRuleTemplateSpecName85]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Scale_Out_Backup_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject85').analyticRuleVersion85]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject85')._analyticRulecontentId85]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a scale-out backup repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Scale-Out Backup Repository Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 30200\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject85').analyticRuleId85,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 85", - "parentId": "[variables('analyticRuleObject85').analyticRuleId85]", - "contentId": "[variables('analyticRuleObject85')._analyticRulecontentId85]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject85').analyticRuleVersion85]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject85')._analyticRulecontentId85]", - "contentKind": "AnalyticsRule", - "displayName": "Scale-Out Backup Repository Deleted", - "contentProductId": "[variables('analyticRuleObject85')._analyticRulecontentProductId85]", - "id": "[variables('analyticRuleObject85')._analyticRulecontentProductId85]", - "version": "[variables('analyticRuleObject85').analyticRuleVersion85]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject86').analyticRuleTemplateSpecName86]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Scale_Out_Backup_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject86').analyticRuleVersion86]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject86')._analyticRulecontentId86]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when scale-out backup repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Scale-Out Backup Repository Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 30100\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject86').analyticRuleId86,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 86", - "parentId": "[variables('analyticRuleObject86').analyticRuleId86]", - "contentId": "[variables('analyticRuleObject86')._analyticRulecontentId86]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject86').analyticRuleVersion86]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject86')._analyticRulecontentId86]", - "contentKind": "AnalyticsRule", - "displayName": "Scale-Out Backup Repository Settings Updated", - "contentProductId": "[variables('analyticRuleObject86')._analyticRulecontentProductId86]", - "id": "[variables('analyticRuleObject86')._analyticRulecontentProductId86]", - "version": "[variables('analyticRuleObject86').analyticRuleVersion86]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject87').analyticRuleTemplateSpecName87]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Service_Provider_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject87').analyticRuleVersion87]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject87')._analyticRulecontentId87]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a service provider is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Service Provider Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 27600\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject87').analyticRuleId87,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 87", - "parentId": "[variables('analyticRuleObject87').analyticRuleId87]", - "contentId": "[variables('analyticRuleObject87')._analyticRulecontentId87]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject87').analyticRuleVersion87]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject87')._analyticRulecontentId87]", - "contentKind": "AnalyticsRule", - "displayName": "Service Provider Deleted", - "contentProductId": "[variables('analyticRuleObject87')._analyticRulecontentProductId87]", - "id": "[variables('analyticRuleObject87')._analyticRulecontentProductId87]", - "version": "[variables('analyticRuleObject87').analyticRuleVersion87]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject88').analyticRuleTemplateSpecName88]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Service_Provider_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject88').analyticRuleVersion88]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject88')._analyticRulecontentId88]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when service provider settings are updated in Veeam Backup & Replication.", - "displayName": "Service Provider Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 27500\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject88').analyticRuleId88,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 88", - "parentId": "[variables('analyticRuleObject88').analyticRuleId88]", - "contentId": "[variables('analyticRuleObject88')._analyticRulecontentId88]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject88').analyticRuleVersion88]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject88')._analyticRulecontentId88]", - "contentKind": "AnalyticsRule", - "displayName": "Service Provider Updated", - "contentProductId": "[variables('analyticRuleObject88')._analyticRulecontentProductId88]", - "id": "[variables('analyticRuleObject88')._analyticRulecontentProductId88]", - "version": "[variables('analyticRuleObject88').analyticRuleVersion88]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject89').analyticRuleTemplateSpecName89]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "SSH_Credentials_Changed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject89').analyticRuleVersion89]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject89')._analyticRulecontentId89]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when SSH credentials are updated.", - "displayName": "SSH Credentials Changed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 31900\n| extend RelatedCredsName = extract(\"RelatedCredsName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Credential Record\"] = RelatedCredsName,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject89').analyticRuleId89,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 89", - "parentId": "[variables('analyticRuleObject89').analyticRuleId89]", - "contentId": "[variables('analyticRuleObject89')._analyticRulecontentId89]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject89').analyticRuleVersion89]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject89')._analyticRulecontentId89]", - "contentKind": "AnalyticsRule", - "displayName": "SSH Credentials Changed", - "contentProductId": "[variables('analyticRuleObject89')._analyticRulecontentProductId89]", - "id": "[variables('analyticRuleObject89')._analyticRulecontentProductId89]", - "version": "[variables('analyticRuleObject89').analyticRuleVersion89]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject90').analyticRuleTemplateSpecName90]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Storage_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject90').analyticRuleVersion90]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject90')._analyticRulecontentId90]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when storage is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Storage Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 41402\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject90').analyticRuleId90,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 90", - "parentId": "[variables('analyticRuleObject90').analyticRuleId90]", - "contentId": "[variables('analyticRuleObject90')._analyticRulecontentId90]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject90').analyticRuleVersion90]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject90')._analyticRulecontentId90]", - "contentKind": "AnalyticsRule", - "displayName": "Storage Deleted", - "contentProductId": "[variables('analyticRuleObject90')._analyticRulecontentProductId90]", - "id": "[variables('analyticRuleObject90')._analyticRulecontentProductId90]", - "version": "[variables('analyticRuleObject90').analyticRuleVersion90]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject91').analyticRuleTemplateSpecName91]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Storage_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject91').analyticRuleVersion91]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject91')._analyticRulecontentId91]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when storage settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Storage Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 41401\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject91').analyticRuleId91,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 91", - "parentId": "[variables('analyticRuleObject91').analyticRuleId91]", - "contentId": "[variables('analyticRuleObject91')._analyticRulecontentId91]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject91').analyticRuleVersion91]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject91')._analyticRulecontentId91]", - "contentKind": "AnalyticsRule", - "displayName": "Storage Settings Updated", - "contentProductId": "[variables('analyticRuleObject91')._analyticRulecontentProductId91]", - "id": "[variables('analyticRuleObject91')._analyticRulecontentProductId91]", - "version": "[variables('analyticRuleObject91').analyticRuleVersion91]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject92').analyticRuleTemplateSpecName92]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Subtenant_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject92').analyticRuleVersion92]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject92')._analyticRulecontentId92]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a subtenant is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Subtenant Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 25210\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject92').analyticRuleId92,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 92", - "parentId": "[variables('analyticRuleObject92').analyticRuleId92]", - "contentId": "[variables('analyticRuleObject92')._analyticRulecontentId92]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject92').analyticRuleVersion92]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject92')._analyticRulecontentId92]", - "contentKind": "AnalyticsRule", - "displayName": "Subtenant Deleted", - "contentProductId": "[variables('analyticRuleObject92')._analyticRulecontentProductId92]", - "id": "[variables('analyticRuleObject92')._analyticRulecontentProductId92]", - "version": "[variables('analyticRuleObject92').analyticRuleVersion92]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject93').analyticRuleTemplateSpecName93]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Subtenant_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject93').analyticRuleVersion93]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject93')._analyticRulecontentId93]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when subtenant settings are updated in Veeam Backup & Replication.", - "displayName": "Subtenant Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 25220\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject93').analyticRuleId93,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 93", - "parentId": "[variables('analyticRuleObject93').analyticRuleId93]", - "contentId": "[variables('analyticRuleObject93')._analyticRulecontentId93]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject93').analyticRuleVersion93]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject93')._analyticRulecontentId93]", - "contentKind": "AnalyticsRule", - "displayName": "Subtenant Updated", - "contentProductId": "[variables('analyticRuleObject93')._analyticRulecontentProductId93]", - "id": "[variables('analyticRuleObject93')._analyticRulecontentProductId93]", - "version": "[variables('analyticRuleObject93').analyticRuleVersion93]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject94').analyticRuleTemplateSpecName94]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "SureBackup_Job_Failed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject94').analyticRuleVersion94]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject94')._analyticRulecontentId94]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects failed SureBackup job operations. This might indicate malware issues, storage problems, or potential sabotage of backup infrastructure.", - "displayName": "SureBackup Job Failed", - "enabled": false, - "query": "Veeam_GetJobFinished\n| where instanceId == 390\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"StateMessage\"] = JobTypeDescription,\n [\"State\"] = JobResultMessage,\n Severity = Severity,\n MessageDetails = Description", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject94').analyticRuleId94,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 94", - "parentId": "[variables('analyticRuleObject94').analyticRuleId94]", - "contentId": "[variables('analyticRuleObject94')._analyticRulecontentId94]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject94').analyticRuleVersion94]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject94')._analyticRulecontentId94]", - "contentKind": "AnalyticsRule", - "displayName": "SureBackup Job Failed", - "contentProductId": "[variables('analyticRuleObject94')._analyticRulecontentProductId94]", - "id": "[variables('analyticRuleObject94')._analyticRulecontentProductId94]", - "version": "[variables('analyticRuleObject94').analyticRuleVersion94]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject95').analyticRuleTemplateSpecName95]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tape_Erase_Job_Started_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject95').analyticRuleVersion95]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject95')._analyticRulecontentId95]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when tape erase operations start. This might indicate data destruction activity.", - "displayName": "Tape Erase Job Started", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 115\n| extend JobName = extract(\"JobName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Job Name\"] = JobName,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject95').analyticRuleId95,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 95", - "parentId": "[variables('analyticRuleObject95').analyticRuleId95]", - "contentId": "[variables('analyticRuleObject95')._analyticRulecontentId95]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject95').analyticRuleVersion95]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject95')._analyticRulecontentId95]", - "contentKind": "AnalyticsRule", - "displayName": "Tape Erase Job Started", - "contentProductId": "[variables('analyticRuleObject95')._analyticRulecontentProductId95]", - "id": "[variables('analyticRuleObject95')._analyticRulecontentProductId95]", - "version": "[variables('analyticRuleObject95').analyticRuleVersion95]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject96').analyticRuleTemplateSpecName96]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tape_Library_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject96').analyticRuleVersion96]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject96')._analyticRulecontentId96]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a tape library is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Tape Library Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 23633\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject96').analyticRuleId96,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 96", - "parentId": "[variables('analyticRuleObject96').analyticRuleId96]", - "contentId": "[variables('analyticRuleObject96')._analyticRulecontentId96]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject96').analyticRuleVersion96]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject96')._analyticRulecontentId96]", - "contentKind": "AnalyticsRule", - "displayName": "Tape Library Deleted", - "contentProductId": "[variables('analyticRuleObject96')._analyticRulecontentProductId96]", - "id": "[variables('analyticRuleObject96')._analyticRulecontentProductId96]", - "version": "[variables('analyticRuleObject96').analyticRuleVersion96]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject97').analyticRuleTemplateSpecName97]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tape_Media_Pool_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject97').analyticRuleVersion97]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject97')._analyticRulecontentId97]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a tape media pool is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Tape Media Pool Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 23630\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject97').analyticRuleId97,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 97", - "parentId": "[variables('analyticRuleObject97').analyticRuleId97]", - "contentId": "[variables('analyticRuleObject97')._analyticRulecontentId97]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject97').analyticRuleVersion97]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject97')._analyticRulecontentId97]", - "contentKind": "AnalyticsRule", - "displayName": "Tape Media Pool Deleted", - "contentProductId": "[variables('analyticRuleObject97')._analyticRulecontentProductId97]", - "id": "[variables('analyticRuleObject97')._analyticRulecontentProductId97]", - "version": "[variables('analyticRuleObject97').analyticRuleVersion97]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject98').analyticRuleTemplateSpecName98]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tape_Media_Vault_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject98').analyticRuleVersion98]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject98')._analyticRulecontentId98]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a tape media vault is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Tape Media Vault Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 23631\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject98').analyticRuleId98,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 98", - "parentId": "[variables('analyticRuleObject98').analyticRuleId98]", - "contentId": "[variables('analyticRuleObject98')._analyticRulecontentId98]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject98').analyticRuleVersion98]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject98')._analyticRulecontentId98]", - "contentKind": "AnalyticsRule", - "displayName": "Tape Media Vault Deleted", - "contentProductId": "[variables('analyticRuleObject98')._analyticRulecontentProductId98]", - "id": "[variables('analyticRuleObject98')._analyticRulecontentProductId98]", - "version": "[variables('analyticRuleObject98').analyticRuleVersion98]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject99').analyticRuleTemplateSpecName99]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tape_Medium_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject99').analyticRuleVersion99]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject99')._analyticRulecontentId99]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a tape medium is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Tape Medium Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 23632\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject99').analyticRuleId99,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 99", - "parentId": "[variables('analyticRuleObject99').analyticRuleId99]", - "contentId": "[variables('analyticRuleObject99')._analyticRulecontentId99]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject99').analyticRuleVersion99]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject99')._analyticRulecontentId99]", - "contentKind": "AnalyticsRule", - "displayName": "Tape Medium Deleted", - "contentProductId": "[variables('analyticRuleObject99')._analyticRulecontentProductId99]", - "id": "[variables('analyticRuleObject99')._analyticRulecontentProductId99]", - "version": "[variables('analyticRuleObject99').analyticRuleVersion99]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject100').analyticRuleTemplateSpecName100]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tape_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject100').analyticRuleVersion100]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject100')._analyticRulecontentId100]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a tape server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Tape Server Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 28800\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject100').analyticRuleId100,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 100", - "parentId": "[variables('analyticRuleObject100').analyticRuleId100]", - "contentId": "[variables('analyticRuleObject100')._analyticRulecontentId100]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject100').analyticRuleVersion100]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject100')._analyticRulecontentId100]", - "contentKind": "AnalyticsRule", - "displayName": "Tape Server Deleted", - "contentProductId": "[variables('analyticRuleObject100')._analyticRulecontentProductId100]", - "id": "[variables('analyticRuleObject100')._analyticRulecontentProductId100]", - "version": "[variables('analyticRuleObject100').analyticRuleVersion100]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject101').analyticRuleTemplateSpecName101]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tenant_Password_Changed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject101').analyticRuleVersion101]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject101')._analyticRulecontentId101]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a tenant password is updated.", - "displayName": "Tenant Password Changed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 24114\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject101').analyticRuleId101,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 101", - "parentId": "[variables('analyticRuleObject101').analyticRuleId101]", - "contentId": "[variables('analyticRuleObject101')._analyticRulecontentId101]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject101').analyticRuleVersion101]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject101')._analyticRulecontentId101]", - "contentKind": "AnalyticsRule", - "displayName": "Tenant Password Changed", - "contentProductId": "[variables('analyticRuleObject101')._analyticRulecontentProductId101]", - "id": "[variables('analyticRuleObject101')._analyticRulecontentProductId101]", - "version": "[variables('analyticRuleObject101').analyticRuleVersion101]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject102').analyticRuleTemplateSpecName102]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tenant_Quota_Changed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject102').analyticRuleVersion102]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject102')._analyticRulecontentId102]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a tenant quota is updated.", - "displayName": "Tenant Quota Changed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 24160\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject102').analyticRuleId102,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 102", - "parentId": "[variables('analyticRuleObject102').analyticRuleId102]", - "contentId": "[variables('analyticRuleObject102')._analyticRulecontentId102]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject102').analyticRuleVersion102]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject102')._analyticRulecontentId102]", - "contentKind": "AnalyticsRule", - "displayName": "Tenant Quota Changed", - "contentProductId": "[variables('analyticRuleObject102')._analyticRulecontentProductId102]", - "id": "[variables('analyticRuleObject102')._analyticRulecontentProductId102]", - "version": "[variables('analyticRuleObject102').analyticRuleVersion102]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject103').analyticRuleTemplateSpecName103]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tenant_Quota_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject103').analyticRuleVersion103]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject103')._analyticRulecontentId103]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a tenant quota is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Tenant Quota Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 24170\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject103').analyticRuleId103,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 103", - "parentId": "[variables('analyticRuleObject103').analyticRuleId103]", - "contentId": "[variables('analyticRuleObject103')._analyticRulecontentId103]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject103').analyticRuleVersion103]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject103')._analyticRulecontentId103]", - "contentKind": "AnalyticsRule", - "displayName": "Tenant Quota Deleted", - "contentProductId": "[variables('analyticRuleObject103')._analyticRulecontentProductId103]", - "id": "[variables('analyticRuleObject103')._analyticRulecontentProductId103]", - "version": "[variables('analyticRuleObject103').analyticRuleVersion103]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject104').analyticRuleTemplateSpecName104]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tenant_Replica_Started_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject104').analyticRuleVersion104]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject104')._analyticRulecontentId104]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a tenant replica starts.", - "displayName": "Tenant Replica Started", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 26800\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject104').analyticRuleId104,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 104", - "parentId": "[variables('analyticRuleObject104').analyticRuleId104]", - "contentId": "[variables('analyticRuleObject104')._analyticRulecontentId104]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject104').analyticRuleVersion104]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject104')._analyticRulecontentId104]", - "contentKind": "AnalyticsRule", - "displayName": "Tenant Replica Started", - "contentProductId": "[variables('analyticRuleObject104')._analyticRulecontentProductId104]", - "id": "[variables('analyticRuleObject104')._analyticRulecontentProductId104]", - "version": "[variables('analyticRuleObject104').analyticRuleVersion104]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject105').analyticRuleTemplateSpecName105]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tenant_Replica_Stopped_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject105').analyticRuleVersion105]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject105')._analyticRulecontentId105]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a tenant replica stops.", - "displayName": "Tenant Replica Stopped", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 26900\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject105').analyticRuleId105,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 105", - "parentId": "[variables('analyticRuleObject105').analyticRuleId105]", - "contentId": "[variables('analyticRuleObject105')._analyticRulecontentId105]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject105').analyticRuleVersion105]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject105')._analyticRulecontentId105]", - "contentKind": "AnalyticsRule", - "displayName": "Tenant Replica Stopped", - "contentProductId": "[variables('analyticRuleObject105')._analyticRulecontentProductId105]", - "id": "[variables('analyticRuleObject105')._analyticRulecontentProductId105]", - "version": "[variables('analyticRuleObject105').analyticRuleVersion105]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject106').analyticRuleTemplateSpecName106]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Tenant_State_Changed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject106').analyticRuleVersion106]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject106')._analyticRulecontentId106]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when tenant state is updated.", - "displayName": "Tenant State Changed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 25000\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject106').analyticRuleId106,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 106", - "parentId": "[variables('analyticRuleObject106').analyticRuleId106]", - "contentId": "[variables('analyticRuleObject106')._analyticRulecontentId106]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject106').analyticRuleVersion106]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject106')._analyticRulecontentId106]", - "contentKind": "AnalyticsRule", - "displayName": "Tenant State Changed", - "contentProductId": "[variables('analyticRuleObject106')._analyticRulecontentProductId106]", - "id": "[variables('analyticRuleObject106')._analyticRulecontentProductId106]", - "version": "[variables('analyticRuleObject106').analyticRuleVersion106]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject107').analyticRuleTemplateSpecName107]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "User_or_Group_Added_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject107').analyticRuleVersion107]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject107')._analyticRulecontentId107]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a user or user group is added to Veeam Backup & Replication.", - "displayName": "User or Group Added", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 31200\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject107').analyticRuleId107,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 107", - "parentId": "[variables('analyticRuleObject107').analyticRuleId107]", - "contentId": "[variables('analyticRuleObject107')._analyticRulecontentId107]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject107').analyticRuleVersion107]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject107')._analyticRulecontentId107]", - "contentKind": "AnalyticsRule", - "displayName": "User or Group Added", - "contentProductId": "[variables('analyticRuleObject107')._analyticRulecontentProductId107]", - "id": "[variables('analyticRuleObject107')._analyticRulecontentProductId107]", - "version": "[variables('analyticRuleObject107').analyticRuleVersion107]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject108').analyticRuleTemplateSpecName108]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "User_or_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject108').analyticRuleVersion108]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject108')._analyticRulecontentId108]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a user or user group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "User or Group Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 31400\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject108').analyticRuleId108,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 108", - "parentId": "[variables('analyticRuleObject108').analyticRuleId108]", - "contentId": "[variables('analyticRuleObject108')._analyticRulecontentId108]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject108').analyticRuleVersion108]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject108')._analyticRulecontentId108]", - "contentKind": "AnalyticsRule", - "displayName": "User or Group Deleted", - "contentProductId": "[variables('analyticRuleObject108')._analyticRulecontentProductId108]", - "id": "[variables('analyticRuleObject108')._analyticRulecontentProductId108]", - "version": "[variables('analyticRuleObject108').analyticRuleVersion108]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject109').analyticRuleTemplateSpecName109]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Best_Practice_Compliance_Check_Not_Passed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject109').analyticRuleVersion109]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject109')._analyticRulecontentId109]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a security best practice does not pass a compliance check in Veeam Security & Compliance Analyzer.", - "displayName": "Best Practice Compliance Check Not Passed", - "enabled": false, - "query": "VeeamSecurityComplianceAnalyzer_CL\r\n| where Status != \"OK\"", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamSecurityComplianceAnalyzer_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "VbrHostName": "VbrHostName", - "Note": "Note", - "Status": "Status", - "Id": "Id", - "TenantId": "TenantId", - "BestPracticeName": "BestPractice" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject109').analyticRuleId109,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 109", - "parentId": "[variables('analyticRuleObject109').analyticRuleId109]", - "contentId": "[variables('analyticRuleObject109')._analyticRulecontentId109]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject109').analyticRuleVersion109]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject109')._analyticRulecontentId109]", - "contentKind": "AnalyticsRule", - "displayName": "Best Practice Compliance Check Not Passed", - "contentProductId": "[variables('analyticRuleObject109')._analyticRulecontentProductId109]", - "id": "[variables('analyticRuleObject109')._analyticRulecontentProductId109]", - "version": "[variables('analyticRuleObject109').analyticRuleVersion109]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject110').analyticRuleTemplateSpecName110]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Application_with_no_recent_data_backup_sessions_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject110').analyticRuleVersion110]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject110')._analyticRulecontentId110]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects applications with no recent backup sessions.", - "displayName": "Veeam ONE Application with No Recent Data Backup Sessions", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 391", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject110').analyticRuleId110,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 110", - "parentId": "[variables('analyticRuleObject110').analyticRuleId110]", - "contentId": "[variables('analyticRuleObject110')._analyticRulecontentId110]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject110').analyticRuleVersion110]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject110')._analyticRulecontentId110]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Application with No Recent Data Backup Sessions", - "contentProductId": "[variables('analyticRuleObject110')._analyticRulecontentProductId110]", - "id": "[variables('analyticRuleObject110')._analyticRulecontentProductId110]", - "version": "[variables('analyticRuleObject110').analyticRuleVersion110]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject111').analyticRuleTemplateSpecName111]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Backup_Copy_RPO_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject111').analyticRuleVersion111]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject111')._analyticRulecontentId111]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects Veeam ONE Backup Copy RPO violation alerts.", - "displayName": "Veeam ONE Backup Copy RPO", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 365", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject111').analyticRuleId111,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 111", - "parentId": "[variables('analyticRuleObject111').analyticRuleId111]", - "contentId": "[variables('analyticRuleObject111')._analyticRulecontentId111]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject111').analyticRuleVersion111]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject111')._analyticRulecontentId111]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Backup Copy RPO", - "contentProductId": "[variables('analyticRuleObject111')._analyticRulecontentProductId111]", - "id": "[variables('analyticRuleObject111')._analyticRulecontentProductId111]", - "version": "[variables('analyticRuleObject111').analyticRuleVersion111]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject112').analyticRuleTemplateSpecName112]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Backup_server_security_&_compliance_state_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject112').analyticRuleVersion112]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject112')._analyticRulecontentId112]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects backup server security and compliance state issues.", - "displayName": "Veeam ONE Backup Server Security and Compliance State", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 395", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject112').analyticRuleId112,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 112", - "parentId": "[variables('analyticRuleObject112').analyticRuleId112]", - "contentId": "[variables('analyticRuleObject112')._analyticRulecontentId112]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject112').analyticRuleVersion112]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject112')._analyticRulecontentId112]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Backup Server Security and Compliance State", - "contentProductId": "[variables('analyticRuleObject112')._analyticRulecontentProductId112]", - "id": "[variables('analyticRuleObject112')._analyticRulecontentProductId112]", - "version": "[variables('analyticRuleObject112').analyticRuleVersion112]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject113').analyticRuleTemplateSpecName113]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Computer_with_no_backup_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject113').analyticRuleVersion113]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject113')._analyticRulecontentId113]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects computers with no backup.", - "displayName": "Veeam ONE Computer with No Backup", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 370", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject113').analyticRuleId113,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 113", - "parentId": "[variables('analyticRuleObject113').analyticRuleId113]", - "contentId": "[variables('analyticRuleObject113')._analyticRulecontentId113]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject113').analyticRuleVersion113]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject113')._analyticRulecontentId113]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Computer with No Backup", - "contentProductId": "[variables('analyticRuleObject113')._analyticRulecontentProductId113]", - "id": "[variables('analyticRuleObject113')._analyticRulecontentProductId113]", - "version": "[variables('analyticRuleObject113').analyticRuleVersion113]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject114').analyticRuleTemplateSpecName114]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Immutability_change_tracking_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject114').analyticRuleVersion114]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject114')._analyticRulecontentId114]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects changes in Veeam ONE immutability tracking configuration.", - "displayName": "Veeam ONE Immutability Change Tracking", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 377", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject114').analyticRuleId114,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 114", - "parentId": "[variables('analyticRuleObject114').analyticRuleId114]", - "contentId": "[variables('analyticRuleObject114')._analyticRulecontentId114]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject114').analyticRuleVersion114]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject114')._analyticRulecontentId114]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Immutability Change Tracking", - "contentProductId": "[variables('analyticRuleObject114')._analyticRulecontentProductId114]", - "id": "[variables('analyticRuleObject114')._analyticRulecontentProductId114]", - "version": "[variables('analyticRuleObject114').analyticRuleVersion114]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject115').analyticRuleTemplateSpecName115]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Immutability_state_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject115').analyticRuleVersion115]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject115')._analyticRulecontentId115]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects changes in the immutability state of Veeam Backup & Replication repositories. This might indicate configuration changes that require review.", - "displayName": "Veeam ONE Immutability State", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 376", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject115').analyticRuleId115,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 115", - "parentId": "[variables('analyticRuleObject115').analyticRuleId115]", - "contentId": "[variables('analyticRuleObject115')._analyticRulecontentId115]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject115').analyticRuleVersion115]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject115')._analyticRulecontentId115]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Immutability State", - "contentProductId": "[variables('analyticRuleObject115')._analyticRulecontentProductId115]", - "id": "[variables('analyticRuleObject115')._analyticRulecontentProductId115]", - "version": "[variables('analyticRuleObject115').analyticRuleVersion115]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject116').analyticRuleTemplateSpecName116]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Job_disabled_Veeam_Backup_for_Microsoft_365_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject116').analyticRuleVersion116]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject116')._analyticRulecontentId116]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when Veeam Backup for Microsoft 365 jobs are disabled.", - "displayName": "Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 378", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject116').analyticRuleId116,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 116", - "parentId": "[variables('analyticRuleObject116').analyticRuleId116]", - "contentId": "[variables('analyticRuleObject116')._analyticRulecontentId116]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject116').analyticRuleVersion116]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject116')._analyticRulecontentId116]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)", - "contentProductId": "[variables('analyticRuleObject116')._analyticRulecontentProductId116]", - "id": "[variables('analyticRuleObject116')._analyticRulecontentProductId116]", - "version": "[variables('analyticRuleObject116').analyticRuleVersion116]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject117').analyticRuleTemplateSpecName117]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Job_disabled_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject117').analyticRuleVersion117]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject117')._analyticRulecontentId117]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a Veeam ONE job is disabled.", - "displayName": "Veeam ONE Job Disabled", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 316", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject117').analyticRuleId117,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 117", - "parentId": "[variables('analyticRuleObject117').analyticRuleId117]", - "contentId": "[variables('analyticRuleObject117')._analyticRulecontentId117]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject117').analyticRuleVersion117]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject117')._analyticRulecontentId117]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Job Disabled", - "contentProductId": "[variables('analyticRuleObject117')._analyticRulecontentProductId117]", - "id": "[variables('analyticRuleObject117')._analyticRulecontentProductId117]", - "version": "[variables('analyticRuleObject117').analyticRuleVersion117]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject118').analyticRuleTemplateSpecName118]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Possible_ransomware_activity_Hyper_V_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject118').analyticRuleVersion118]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject118')._analyticRulecontentId118]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects Veeam ONE possible ransomware activity alerts for Microsoft Hyper-V.", - "displayName": "Veeam ONE Possible Ransomware Activity (Hyper-V)", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 344", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject118').analyticRuleId118,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 118", - "parentId": "[variables('analyticRuleObject118').analyticRuleId118]", - "contentId": "[variables('analyticRuleObject118')._analyticRulecontentId118]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject118').analyticRuleVersion118]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject118')._analyticRulecontentId118]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Possible Ransomware Activity (Hyper-V)", - "contentProductId": "[variables('analyticRuleObject118')._analyticRulecontentProductId118]", - "id": "[variables('analyticRuleObject118')._analyticRulecontentProductId118]", - "version": "[variables('analyticRuleObject118').analyticRuleVersion118]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject119').analyticRuleTemplateSpecName119]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Possible_ransomware_activity_vSphere_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject119').analyticRuleVersion119]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject119')._analyticRulecontentId119]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects Veeam ONE possible ransomware activity alerts for VMware vSphere.", - "displayName": "Veeam ONE Possible Ransomware Activity (vSphere)", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 342", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject119').analyticRuleId119,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 119", - "parentId": "[variables('analyticRuleObject119').analyticRuleId119]", - "contentId": "[variables('analyticRuleObject119')._analyticRulecontentId119]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject119').analyticRuleVersion119]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject119')._analyticRulecontentId119]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Possible Ransomware Activity (vSphere)", - "contentProductId": "[variables('analyticRuleObject119')._analyticRulecontentProductId119]", - "id": "[variables('analyticRuleObject119')._analyticRulecontentProductId119]", - "version": "[variables('analyticRuleObject119').analyticRuleVersion119]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject120').analyticRuleTemplateSpecName120]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Suspicious_incremental_backup_size_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject120').analyticRuleVersion120]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject120')._analyticRulecontentId120]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects suspiciously large incremental backup sizes.", - "displayName": "Veeam ONE Suspicious Incremental Backup Size", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 364", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject120').analyticRuleId120,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 120", - "parentId": "[variables('analyticRuleObject120').analyticRuleId120]", - "contentId": "[variables('analyticRuleObject120')._analyticRulecontentId120]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject120').analyticRuleVersion120]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject120')._analyticRulecontentId120]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Suspicious Incremental Backup Size", - "contentProductId": "[variables('analyticRuleObject120')._analyticRulecontentProductId120]", - "id": "[variables('analyticRuleObject120')._analyticRulecontentProductId120]", - "version": "[variables('analyticRuleObject120').analyticRuleVersion120]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject121').analyticRuleTemplateSpecName121]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Unusual_job_duration_Veeam_Backup_for_Microsoft_365_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject121').analyticRuleVersion121]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject121')._analyticRulecontentId121]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects Veeam Backup for Microsoft 365 jobs with unusual execution duration.", - "displayName": "Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 381", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject121').analyticRuleId121,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 121", - "parentId": "[variables('analyticRuleObject121').analyticRuleId121]", - "contentId": "[variables('analyticRuleObject121')._analyticRulecontentId121]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject121').analyticRuleVersion121]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject121')._analyticRulecontentId121]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)", - "contentProductId": "[variables('analyticRuleObject121')._analyticRulecontentProductId121]", - "id": "[variables('analyticRuleObject121')._analyticRulecontentProductId121]", - "version": "[variables('analyticRuleObject121').analyticRuleVersion121]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject122').analyticRuleTemplateSpecName122]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Unusual_job_duration_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject122').analyticRuleVersion122]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject122')._analyticRulecontentId122]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects Veeam ONE unusual job duration alerts.", - "displayName": "Veeam ONE Unusual Job Duration", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 369", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject122').analyticRuleId122,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 122", - "parentId": "[variables('analyticRuleObject122').analyticRuleId122]", - "contentId": "[variables('analyticRuleObject122')._analyticRulecontentId122]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject122').analyticRuleVersion122]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject122')._analyticRulecontentId122]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Unusual Job Duration", - "contentProductId": "[variables('analyticRuleObject122')._analyticRulecontentProductId122]", - "id": "[variables('analyticRuleObject122')._analyticRulecontentProductId122]", - "version": "[variables('analyticRuleObject122').analyticRuleVersion122]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject123').analyticRuleTemplateSpecName123]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_Veeam_malware_detection_change_tracking_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject123').analyticRuleVersion123]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject123')._analyticRulecontentId123]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects changes in Veeam ONE malware detection tracking.", - "displayName": "Veeam ONE Malware Detection Change Tracking", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 403", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject123').analyticRuleId123,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 123", - "parentId": "[variables('analyticRuleObject123').analyticRuleId123]", - "contentId": "[variables('analyticRuleObject123')._analyticRulecontentId123]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject123').analyticRuleVersion123]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject123')._analyticRulecontentId123]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE Malware Detection Change Tracking", - "contentProductId": "[variables('analyticRuleObject123')._analyticRulecontentProductId123]", - "id": "[variables('analyticRuleObject123')._analyticRulecontentProductId123]", - "version": "[variables('analyticRuleObject123').analyticRuleVersion123]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject124').analyticRuleTemplateSpecName124]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_VM_with_no_backup_Hyper_V_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject124').analyticRuleVersion124]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject124')._analyticRulecontentId124]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects Veeam ONE VMs with no backup (Hyper-V).", - "displayName": "Veeam ONE VM with No Backup (Hyper-V)", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 315", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject124').analyticRuleId124,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 124", - "parentId": "[variables('analyticRuleObject124').analyticRuleId124]", - "contentId": "[variables('analyticRuleObject124')._analyticRulecontentId124]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject124').analyticRuleVersion124]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject124')._analyticRulecontentId124]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE VM with No Backup (Hyper-V)", - "contentProductId": "[variables('analyticRuleObject124')._analyticRulecontentProductId124]", - "id": "[variables('analyticRuleObject124')._analyticRulecontentProductId124]", - "version": "[variables('analyticRuleObject124').analyticRuleVersion124]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject125').analyticRuleTemplateSpecName125]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_VM_with_no_backup_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject125').analyticRuleVersion125]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject125')._analyticRulecontentId125]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects Veeam ONE VMs with no backup.", - "displayName": "Veeam ONE VM with No Backup", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 314", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject125').analyticRuleId125,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 125", - "parentId": "[variables('analyticRuleObject125').analyticRuleId125]", - "contentId": "[variables('analyticRuleObject125')._analyticRulecontentId125]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject125').analyticRuleVersion125]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject125')._analyticRulecontentId125]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE VM with No Backup", - "contentProductId": "[variables('analyticRuleObject125')._analyticRulecontentProductId125]", - "id": "[variables('analyticRuleObject125')._analyticRulecontentProductId125]", - "version": "[variables('analyticRuleObject125').analyticRuleVersion125]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject126').analyticRuleTemplateSpecName126]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_VM_with_no_replica_Hyper_V_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject126').analyticRuleVersion126]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject126')._analyticRulecontentId126]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects Hyper-V VMs with no replica configured.", - "displayName": "Veeam ONE VM with No Replica (Hyper-V)", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 332", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject126').analyticRuleId126,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 126", - "parentId": "[variables('analyticRuleObject126').analyticRuleId126]", - "contentId": "[variables('analyticRuleObject126')._analyticRulecontentId126]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject126').analyticRuleVersion126]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject126')._analyticRulecontentId126]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE VM with No Replica (Hyper-V)", - "contentProductId": "[variables('analyticRuleObject126')._analyticRulecontentProductId126]", - "id": "[variables('analyticRuleObject126')._analyticRulecontentProductId126]", - "version": "[variables('analyticRuleObject126').analyticRuleVersion126]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject127').analyticRuleTemplateSpecName127]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam_One_VM_with_no_replica_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject127').analyticRuleVersion127]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject127')._analyticRulecontentId127]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects Veeam ONE VMs with no replica configuration.", - "displayName": "Veeam ONE VM with No Replica", - "enabled": false, - "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 331", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamOneTriggeredAlarms_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "ObjectName": "ObjectName", - "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", - "Description": "Description", - "Name": "Name", - "ObjectType": "ObjectType", - "Status": "Status", - "TriggeredTime": "TriggeredTime", - "ObjectId": "ObjectId", - "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject127').analyticRuleId127,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 127", - "parentId": "[variables('analyticRuleObject127').analyticRuleId127]", - "contentId": "[variables('analyticRuleObject127')._analyticRulecontentId127]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject127').analyticRuleVersion127]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject127')._analyticRulecontentId127]", - "contentKind": "AnalyticsRule", - "displayName": "Veeam ONE VM with No Replica", - "contentProductId": "[variables('analyticRuleObject127')._analyticRulecontentProductId127]", - "id": "[variables('analyticRuleObject127')._analyticRulecontentProductId127]", - "version": "[variables('analyticRuleObject127').analyticRuleVersion127]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject128').analyticRuleTemplateSpecName128]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Virtual_Lab_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject128').analyticRuleVersion128]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject128')._analyticRulecontentId128]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a virtual lab is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Virtual Lab Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 30800\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject128').analyticRuleId128,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 128", - "parentId": "[variables('analyticRuleObject128').analyticRuleId128]", - "contentId": "[variables('analyticRuleObject128')._analyticRulecontentId128]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject128').analyticRuleVersion128]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject128')._analyticRulecontentId128]", - "contentKind": "AnalyticsRule", - "displayName": "Virtual Lab Deleted", - "contentProductId": "[variables('analyticRuleObject128')._analyticRulecontentProductId128]", - "id": "[variables('analyticRuleObject128')._analyticRulecontentProductId128]", - "version": "[variables('analyticRuleObject128').analyticRuleVersion128]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject129').analyticRuleTemplateSpecName129]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Virtual_Lab_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject129').analyticRuleVersion129]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject129')._analyticRulecontentId129]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when virtual lab settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "Virtual Lab Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 30700\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject129').analyticRuleId129,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 129", - "parentId": "[variables('analyticRuleObject129').analyticRuleId129]", - "contentId": "[variables('analyticRuleObject129')._analyticRulecontentId129]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject129').analyticRuleVersion129]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject129')._analyticRulecontentId129]", - "contentKind": "AnalyticsRule", - "displayName": "Virtual Lab Settings Updated", - "contentProductId": "[variables('analyticRuleObject129')._analyticRulecontentProductId129]", - "id": "[variables('analyticRuleObject129')._analyticRulecontentProductId129]", - "version": "[variables('analyticRuleObject129').analyticRuleVersion129]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject130').analyticRuleTemplateSpecName130]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "WAN_Accelerator_Deleted_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject130').analyticRuleVersion130]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject130')._analyticRulecontentId130]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when a WAN accelerator is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "WAN Accelerator Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 27300\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject130').analyticRuleId130,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 130", - "parentId": "[variables('analyticRuleObject130').analyticRuleId130]", - "contentId": "[variables('analyticRuleObject130')._analyticRulecontentId130]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject130').analyticRuleVersion130]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject130')._analyticRulecontentId130]", - "contentKind": "AnalyticsRule", - "displayName": "WAN Accelerator Deleted", - "contentProductId": "[variables('analyticRuleObject130')._analyticRulecontentProductId130]", - "id": "[variables('analyticRuleObject130')._analyticRulecontentProductId130]", - "version": "[variables('analyticRuleObject130').analyticRuleVersion130]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject131').analyticRuleTemplateSpecName131]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "WAN_Accelerator_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject131').analyticRuleVersion131]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject131')._analyticRulecontentId131]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects when WAN accelerator settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", - "displayName": "WAN Accelerator Settings Updated", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 27200\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "Syslog" - }, - { - "dataTypes": [ - "Syslog" - ], - "connectorId": "SyslogAma" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Date": "Date", - "Severity": "Severity", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject131').analyticRuleId131,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 131", - "parentId": "[variables('analyticRuleObject131').analyticRuleId131]", - "contentId": "[variables('analyticRuleObject131')._analyticRulecontentId131]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject131').analyticRuleVersion131]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject131')._analyticRulecontentId131]", - "contentKind": "AnalyticsRule", - "displayName": "WAN Accelerator Settings Updated", - "contentProductId": "[variables('analyticRuleObject131')._analyticRulecontentProductId131]", - "id": "[variables('analyticRuleObject131')._analyticRulecontentProductId131]", - "version": "[variables('analyticRuleObject131').analyticRuleVersion131]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject132').analyticRuleTemplateSpecName132]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Configuration_Backup_Failed_AnalyticalRules Analytics Rule with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject132').analyticRuleVersion132]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject132')._analyticRulecontentId132]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.", - "displayName": "Configuration Backup Failed", - "enabled": false, - "query": "VeeamSessions_CL | where SessionType == \"ConfigurationBackup\" and ResultStatus == \"Failed\" | project TimeGenerated, VbrHostName, SessionId = Id, SessionType, Name, Result = ResultStatus", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "VeeamSessions_CL" - ], - "connectorId": "VeeamCustomTablesDataConnector" - } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "Result": "Result", - "SessionId": "SessionId", - "Name": "Name", - "VbrHostName": "VbrHostName", - "SessionType": "SessionType" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject132').analyticRuleId132,'/'))))]", - "properties": { - "description": "Veeam Analytics Rule 132", - "parentId": "[variables('analyticRuleObject132').analyticRuleId132]", - "contentId": "[variables('analyticRuleObject132')._analyticRulecontentId132]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject132').analyticRuleVersion132]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject132')._analyticRulecontentId132]", - "contentKind": "AnalyticsRule", - "displayName": "Configuration Backup Failed", - "contentProductId": "[variables('analyticRuleObject132')._analyticRulecontentProductId132]", - "id": "[variables('analyticRuleObject132')._analyticRulecontentProductId132]", - "version": "[variables('analyticRuleObject132').analyticRuleVersion132]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('workbookTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "VeeamDataPlatformMonitoring Workbook with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('workbookVersion1')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.Insights/workbooks", - "name": "[variables('workbookContentId1')]", - "location": "[parameters('workspace-location')]", - "kind": "shared", - "apiVersion": "2021-08-01", - "metadata": { - "description": "The Veeam Data Platform Monitoring dashboard shows an aggregated view of job activity on your Veeam Backup & Replication servers." - }, - "properties": { - "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0b767a3f-72a6-495b-a08e-198348d4efb9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}]},\"value\":{\"durationMs\":2592000000}},{\"id\":\"3ec1d354-0588-43dd-b3e5-7ebab2195c40\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"host_token\",\"label\":\"Veeam Backup & Replication Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetJobFinished\\r\\n| summarize by original_host\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# All Jobs\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where not (instanceId in (\\\"40290\\\", \\\"40800\\\", \\\"150\\\", \\\"450\\\", \\\"151\\\", \\\"451\\\"))\\r\\n| where Allowance\\r\\n| summarize count() by JobResultMessage = JobResultMessage\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":86400000},\"exportFieldName\":\"JobResultMessage\",\"exportParameterName\":\"ResultMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"JobResultMessage\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"purple\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"sortCriteriaField\":\"count_\"}},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (150, 151)\\r\\n| where Allowance == true\\r\\n| extend TransferredGb = todouble(\\r\\n extract(@\\\"TransferredGb=\\\"\\\"([^\\\"\\\"]*)\\\"\\\"\\\", 1, SyslogMessage)\\r\\n )\\r\\n| summarize TotalTransferredGb = sum(TransferredGb)\\r\\n| extend Name = \\\"Transferred Data (Gb)\\\"\\r\\n| project Name, TotalTransferredGb\",\"size\":3,\"timeContext\":{\"durationMs\":604800000},\"exportedParameters\":[{\"fieldName\":\"TotalTransferredGb\",\"parameterName\":\"TotalTransferredGb\",\"parameterType\":1},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Name\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalTransferredGb\",\"formatter\":12},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 5 - Copy - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId==151 or instanceId==150\\r\\n| where Allowance\\r\\n| extend TransferredGb = todouble(extract(\\\"TransferredGb=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage))\\r\\n\",\"size\":0,\"timeContext\":{\"durationMs\":604800000},\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogTransefered\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 4\"},{\"type\":1,\"content\":{\"json\":\"Syslog message: \\r\\n```\\r\\n{SyslogTransefered}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TotalTransferredGb\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"ResultMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where not (instanceId in (\\\"40290\\\", \\\"40800\\\", \\\"150\\\", \\\"450\\\", \\\"151\\\", \\\"451\\\"))\\r\\n| where JobResultMessage == \\\"{ResultMessage}\\\"\\r\\n| where Allowance\\r\\n\\r\\n\",\"size\":0,\"title\":\"Events with `{ResultMessage}` status:\",\"timeContext\":{\"durationMs\":86400000},\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ResultMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TotalTransferredGb\",\"comparison\":\"isEqualTo\"}],\"name\":\"group - 5\"}]},\"name\":\"All Jobs\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Weekly Reports\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (\\\"190\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobResultMessage\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \\r\\n\",\"size\":0,\"aggregation\":5,\"title\":\" Backup and Backup Copy Jobs\",\"timeContext\":{\"durationMs\":604800000},\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"BackupAndBackupCopyJobsTime\"},{\"fieldName\":\"label\",\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"parameterType\":1},{\"fieldName\":\"\",\"parameterName\":\"BackupAndBackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}],\"xSettings\":{\"dateFormatSettings\":{\"formatName\":\"shortDatePattern\",\"showUtcTime\":true},\"scale\":\"time\",\"label\":\"Label\"},\"ySettings\":{\"label\":\"\"}}},\"customWidth\":\"50\",\"name\":\" Backup and Backup Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId == \\\"390\\\"\\r\\n| where Allowance\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobResultMessage\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \\r\\n\",\"size\":0,\"aggregation\":5,\"title\":\"SureBackup Jobs\",\"timeContext\":{\"durationMs\":604800000},\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"SureBackupJobsTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"SureBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"SureBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"SureBackup Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupAndBackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (\\\"190\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobResultMessage == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\\r\\n\",\"size\":0,\"title\":\"Backup and Backup Copy Jobs Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"name\":\"query - 5\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"SureBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Backup and Backup Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{SureBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"390\\\"\\r\\n| where Allowance\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobResultMessage == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\",\"size\":0,\"title\":\"SureBackup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 5\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"SureBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup and Backup Copy Jobs Drilldown - Copy\"}]},\"name\":\"Weekly Reports\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Virtual Machines & Agents\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == \\\"190\\\" and JobType == \\\"0\\\"\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"VM Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"VM Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == \\\"590\\\" \\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\",\"size\":3,\"title\":\"VM File Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMFileCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMFileCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"showPin\":false,\"name\":\"VM File Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 592\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\",\"size\":3,\"title\":\"VM Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"JobResult\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"JobResult\",\"sortOrder\":2}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"VM Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" and JobType == \\\"0\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMBackupJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMBackupJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMFileCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"590\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM File Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMFileCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMFileCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM File Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"592\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM Copy Jobs Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 610\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"VM Quick Migration Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMQuickMigrationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMQuickMigrationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"VM Quick Migration Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 790\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam Agent Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VeeamAgentJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VeeamAgentJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Veeam Agent Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMQuickMigrationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 610\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Quick Migration Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VeeamAgentJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VeeamAgentJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMQuickMigrationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamAgentJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\" VM Quick Migration Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamAgentJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"790\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Veeam Agent Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VeeamAgentJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VeeamAgentJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMQuickMigrationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamAgentJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam Agent Jobs Drilldown\"}]},\"name\":\"Virtual Machines & Agents\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Unstructured Data\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 190\\n| where JobType == 13000\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 3\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\" File Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"FileBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"FileBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\" File Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 190\\n| where JobType == 13000\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 7\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Object Storage Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"ObjectStorageBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Object Storage Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 490\\n| where JobType == 13003\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 5\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Backup Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FileBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 190\\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 3\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"File Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"FileBackupJobsSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Job Type\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Job Type\",\"sortOrder\":2}]},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{FileBackupJobsSyslogMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"File Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{ObjectStorageBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 190\\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 7\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Object Storage Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"ObjectStorageBackupJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{ObjectStorageBackupJobsMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Object Storage Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 490\\r\\n| where JobType == 13003\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 5\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Copy Jobs Drilldown\"}]},\"name\":\"Unstructured Data\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Applications and Services\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"36022\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Jobs for Enterprise Plug-ins\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupJobsForEnterprisePlugInsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Jobs for Enterprise Plug-ins\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"36026\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Log Backup Jobs for Enterprise Plug-ins\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"parameterType\":1},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Log Backup Jobs for Enterprise Plug-ins\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == \\\"78\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Jobs for Entra ID\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupJobsForEntraIDStatus\",\"parameterType\":1},{\"parameterName\":\"BackupJobsForEntraIDAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Jobs for Entra ID\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupJobsForEnterprisePlugInsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"36022\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Enterprise Plug-ins Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupJobsForEnterprisePlugInsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupJobsForEnterprisePlugInsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Jobs for Enterprise Plug-ins Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{LogBackupJobsForEnterprisePlugInsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"36026\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Log Backup Jobs for Enterprise Plug-ins Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"LogBackupJobsForEnterprisePlugInsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LogBackupJobsForEnterprisePlugInsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Log Backup Jobs for Enterprise Plug-ins Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupJobsForEntraIDAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == \\\"78\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Entra ID Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupJobsForEntraIDMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupJobsForEntraIDMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Jobs for Entra ID Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 8\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Log Backup Jobs for Entra ID\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"LogBackupJobsForEntraIDStatus\",\"parameterType\":1},{\"parameterName\":\"LogBackupJobsForEntraIDAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Log Backup Jobs for Entra ID\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{LogBackupJobsForEntraIDAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 8\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Entra ID Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"LogBackupJobsForEntraIDMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LogBackupJobsForEntraIDMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"LogBackupJobsForEntraIDStatus\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Log Backup Jobs for Entra ID\"}]},\"name\":\"Applications and Services\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Backup Copy & Replicas\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 1\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Replication Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"ReplicationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"ReplicationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Replication Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"490\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{ReplicationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 1\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Replication Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"ReplicationJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{ReplicationJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ReplicationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Replication Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"490\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Replication Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ReplicationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Replication Jobs Drilldown - Copy\"}]},\"name\":\"Backup Copy & Replicas\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Tapes\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"194\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"200\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"198\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Verification Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeVerificationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeVerificationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Verification Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"194\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Tape Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"200\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Tape Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeVerificationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"198\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Verification Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeVerificationJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeVerificationJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Tape Verification Jobs Drilldown\"}]},\"name\":\"Tapes - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Finished Jobs\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetFinishedConfigurationBackupSessions\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = Computer, User = user, State = Result, SyslogMessage, StringTime = tostring(TimeGenerated), Description\\r\\n\",\"size\":0,\"title\":\"Latest Configuration Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"StringTime\",\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\"},{\"fieldName\":\"SyslogMessage\",\"parameterName\":\"SyslogMessage\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"State\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"12ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5},{\"columnMatch\":\"StringTime\",\"formatter\":5},{\"columnMatch\":\"Description\",\"formatter\":5}]},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Latest Configuration Backups\",\"styleSettings\":{\"margin\":\"3px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, StringTime = tostring(TimeGenerated), SyslogMessage\",\"size\":0,\"title\":\"Latest Finished Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"StringTime\",\"parameterName\":\"LatestFinishedJobsTime\",\"parameterType\":1},{\"fieldName\":\"SyslogMessage\",\"parameterName\":\"LatestFinishedJobsSyslogMessage\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"StringTime\",\"formatter\":5},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Latest Finished Jobs\",\"styleSettings\":{\"margin\":\"3px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, StringTime = tostring(TimeGenerated)\\r\\n| where StringTime == \\\"{LatestFinishedJobsTime}\\\"\",\"size\":3,\"title\":\"Latest Finished Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"showPin\":false,\"name\":\"Latest Finished Jobs Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LatestFinishedJobsSyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"LatestFinishedJobsTime\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Latest Finished Jobs Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetFinishedConfigurationBackupSessions\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| where tostring(TimeGenerated) == \\\"{Veeam_GetFinishedConfigurationBackupSessionsTime}\\\"\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = Computer, User = user, [\\\"Message Details\\\"] = Description, State = Result, SyslogMessage\",\"size\":3,\"title\":\"Latest Configuration Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"showPin\":false,\"name\":\"Latest Configuration Backups Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LatestFinishedJobsTime\",\"comparison\":\"isEqualTo\"}],\"name\":\"Latest Configuration Backups Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobTypeDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":2,\"aggregation\":5,\"title\":\"Finished Jobs by Type\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"FinishedJobsByTypeTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"FinishedJobsByTypeStatus\",\"parameterType\":1},{\"parameterName\":\"FinishedJobsByTypeAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"group\":\"*\",\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Finished Jobs by Type\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"40290\\\", \\\"40800\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobTypeDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":2,\"aggregation\":5,\"title\":\"Finished Restore Sessions by Type\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"FinishedRestoreSessionsByTypeTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"parameterType\":1},{\"parameterName\":\"FinishedRestoreSessionsByTypeAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Finished Restore Sessions by Type\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FinishedJobsByTypeAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobTypeDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\",\"size\":0,\"title\":\"Finished Jobs by Type Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FinishedJobsByTypeStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Finished Jobs by Type Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FinishedRestoreSessionsByTypeAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId in (\\\"40290\\\", \\\"40800\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobTypeDescription == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\",\"size\":0,\"title\":\"Finished Restore Sessions by Type Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FinishedJobsByTypeStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Finished Restore Sessions by Type Drilldown\"}]},\"name\":\"Finished Jobs\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Failed Backups\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"150\\\", \\\"450\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend VmName = extract(\\\"VmName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| summarize Total = count() by VmName, JobResultMessage\\r\\n| evaluate pivot(JobResultMessage, sum(Total))\\r\\n| extend Failed = iff(column_ifexists(\\\"Failed\\\", 0) == 0, 0, column_ifexists(\\\"Failed\\\", 0)),\\r\\n Warning = iff(column_ifexists(\\\"Warning\\\", 0) == 0, 0, column_ifexists(\\\"Warning\\\", 0))\\r\\n| project VmName, Failed, Warning\\r\\n| order by Failed desc\\r\\n| take 15\\r\\n| render barchart\",\"size\":2,\"title\":\" Unsuccessful VM Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"UnsuccessfulVMBackupsName\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"parameterType\":1},{\"parameterName\":\"UnsuccessfulVMBackupsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"VmName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"VmName\",\"yAxis\":[\"Warning\",\"Failed\"],\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Successful\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\" Unsuccessful VM Backups\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"151\\\", \\\"451\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend SourceName = extract(\\\"SourceName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| summarize Total = count() by SourceName, JobResultMessage\\r\\n| evaluate pivot(JobResultMessage, sum(Total))\\r\\n| extend Failed = iff(column_ifexists(\\\"Failed\\\", 0) == 0, 0, column_ifexists(\\\"Failed\\\", 0)),\\r\\n Warning = iff(column_ifexists(\\\"Warning\\\", 0) == 0, 0, column_ifexists(\\\"Warning\\\", 0))\\r\\n| project SourceName, Failed, Warning\\r\\n| order by Failed desc\\r\\n| take 15\\r\\n| render barchart\",\"size\":2,\"title\":\"Unsuccessful Unstructured Data Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"chartSettings\":{\"xAxis\":\"SourceName\",\"yAxis\":[\"Failed\",\"Warning\"],\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Successful\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Unsuccessful Unstructured Data Backups\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{UnsuccessfulUnstructuredDataBackupAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series), X = tostring(parsed.x);\\r\\nlet session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"151\\\", \\\"451\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend SourceName = extract(\\\"SourceName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series, $left.SourceName == $right.X\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SourceName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"title\":\"Unsuccessful Unstructured Data Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"SourceName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"SourceName\",\"sortOrder\":1}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Unsuccessful Unstructured Data Backups Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{UnsuccessfulVMBackupsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series), X = tostring(parsed.x);\\r\\nlet session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"150\\\", \\\"450\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend VmName = extract(\\\"VmName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series, $left.VmName == $right.X\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, VmName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"title\":\"Unsuccessful VM Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\",\"comparison\":\"isEqualTo\"}],\"name\":\"Unsuccessful VM Backups Drilldown - Copy\"}]},\"name\":\"Failed Backups\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"sentinel-VeeamDataPlatformMonitoring\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", - "version": "1.0", - "sourceId": "[variables('workspaceResourceId')]", - "category": "sentinel" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", - "properties": { - "description": "@{workbookKey=VeeamDataPlatformMonitoringWorkbook; logoFileName=VeeamLogo.svg; description=The Veeam Data Platform Monitoring dashboard shows an aggregated view of job activity on your Veeam Backup & Replication servers.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Veeam Data Platform Monitoring; templateRelativePath=VeeamDataPlatformMonitoring.json; subtitle=; provider=Veeam}.description", - "parentId": "[variables('workbookId1')]", - "contentId": "[variables('_workbookContentId1')]", - "kind": "Workbook", - "version": "[variables('workbookVersion1')]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "Syslog", - "kind": "DataType" - }, - { - "contentId": "Syslog", - "kind": "DataConnector" - } - ] - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_workbookContentId1')]", - "contentKind": "Workbook", - "displayName": "[parameters('workbook1-name')]", - "contentProductId": "[variables('_workbookcontentProductId1')]", - "id": "[variables('_workbookcontentProductId1')]", - "version": "[variables('workbookVersion1')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('workbookTemplateSpecName2')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "VeeamSecurityActivities Workbook with template version 3.0.2", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('workbookVersion2')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.Insights/workbooks", - "name": "[variables('workbookContentId2')]", - "location": "[parameters('workspace-location')]", - "kind": "shared", - "apiVersion": "2021-08-01", - "metadata": { - "description": "The Veeam Security Activities dashboard shows an aggregated view of security events from your Veeam Backup & Replication servers and Veeam ONE servers, as well as Coveware findings." - }, - "properties": { - "displayName": "[parameters('workbook2-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"bb18f0f1-0893-479d-83fe-9cca36e33b43\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"value\":{\"durationMs\":2592000000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"d559890f-2663-49a6-af45-3dfc1fa7fda0\",\"cellValue\":\"isRest\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Syslog\",\"subTarget\":\"0\",\"preText\":\"d\",\"postText\":\"d\",\"style\":\"secondary\"},{\"id\":\"aee69a87-0e6f-4aab-ab21-14423e4d2d3d\",\"cellValue\":\"isRest\",\"linkTarget\":\"parameter\",\"linkLabel\":\"REST\",\"subTarget\":\"1\",\"style\":\"link\"}]},\"name\":\"links - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"3ec1d354-0588-43dd-b3e5-7ebab2195c40\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"host_token\",\"label\":\"Veeam Backup & Replication Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| summarize by original_host\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"26fbaaa0-3b0f-4506-885b-9fd8cd87ece9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vone_host_token\",\"label\":\"Veeam ONE Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| summarize by VoneHostName\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"parameters - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"3b155c6e-4243-4c04-8675-3901414969df\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vbr_host_name\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union \\r\\n (VeeamMalwareEvents_CL | where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}),\\r\\n (VeeamAuthorizationEvents_CL | where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}),\\r\\n (VeeamSecurityComplianceAnalyzer_CL\\r\\n | where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end})\\r\\n \\r\\n | summarize by VbrHostName\\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Veeam Backup & Replication Data Sources\"},{\"id\":\"f3074530-90f9-44b3-96a4-6141a273e18b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vone_host_name\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"VeeamOneTriggeredAlarms_CL \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize by VoneHostName\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Veeam ONE Data Sources\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"parameters - rest\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Custom Tables Events Overview\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by Status\\n| top 20 by Count\\n| project Status, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam ONE Triggered Alarms by Status\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Resolved\",\"color\":\"blue\"},{\"seriesName\":\"Error\",\"color\":\"redBright\"}]}},\"customWidth\":\"25\",\"name\":\"query - vone-alarms-status\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| summarize Count = count() by Severity\\n| top 20 by Count\\n| project Severity, Count\\n| render piechart\",\"size\":3,\"title\":\"Malware Events by Severity\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"MalwareEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Infected\",\"color\":\"redBright\"},{\"seriesName\":\"Clean\",\"color\":\"green\"}]}},\"customWidth\":\"25\",\"name\":\"query - malware-severity\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n| summarize Count = count() by State\\n| top 20 by Count\\n| project State, Count\\n| render piechart\",\"size\":3,\"title\":\"Authorization Events by State\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"ProcessedTime\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"ProcessedTime\",\"sortOrder\":2}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Approved\",\"color\":\"green\"},{\"seriesName\":\"Info\",\"color\":\"blue\"},{\"seriesName\":\"Rejected\",\"color\":\"redBright\"}]}},\"customWidth\":\"25\",\"name\":\"query - authorization-state\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamSecurityComplianceAnalyzer_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\n| summarize Count = count() by Status\\n| top 20 by Count\\n| project Status, Count\\n| render piechart\",\"size\":3,\"title\":\"Security & Compliance Analyzer Results by Status\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"BestPracticesAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Violation\",\"color\":\"redBright\"},{\"seriesName\":\"OK\",\"color\":\"green\"},{\"seriesName\":\"UnableToCheck\",\"color\":\"orange\"}]}},\"customWidth\":\"25\",\"name\":\"query - best-practices-status\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VoneTriggeredAlarmsStatusRestAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamOneTriggeredAlarms_CL\\r\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\r\\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| join kind=inner (filters) on $left.Status == $right.Series\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"title\":\"Veeam ONE Triggered Alarms by Status Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"VeeamONETriggeredAlarmsDrilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{AuthorizationEventsStateAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamAuthorizationEvents_CL\\r\\n| where \\\"'All'\\\" == \\\"{vbr_host_name}\\\" or VbrHostName in ({vbr_host_name}) \\r\\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\r\\n| where State in (toscalar(filters | summarize make_set(Series)))\\r\\n| project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\",\"size\":0,\"title\":\"Authorization Events by State Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Authorization Events Drilldown \"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{MalwareEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamMalwareEvents_CL\\r\\n| where \\\"'All'\\\" == \\\"{vbr_host_name}\\\" or VbrHostName in ({vbr_host_name}) \\r\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\r\\n| where Severity in (toscalar(filters | summarize make_set(Series)))\\r\\n| project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\",\"size\":0,\"title\":\"Malware Events by Severity Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"MalwareEventsDrilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BestPracticesAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\n\\r\\nVeeamSecurityComplianceAnalyzer_CL\\r\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\r\\n| join kind=inner (filters) on $left.Status == $right.Series\\r\\n| project TimeGenerated, VbrHostName, Status, Id, BestPractice, Note\",\"size\":0,\"title\":\"Security & Compliance Analyzer Results by Status Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"BestPracticesAnalysisDrilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by Name\\n| top 20 by Count\\n| project Name, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam ONE Triggered Alarms by Name\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VoneTriggeredAlarmsName\"},{\"parameterName\":\"VoneTriggeredAlarmsNamesRestAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Success\",\"color\":\"yellow\"}]}},\"customWidth\":\"33\",\"name\":\"query - vone-alarms-name\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VoneTriggeredAlarmsNamesRestAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| where Name in (toscalar(filters | summarize make_set(Series)))\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"title\":\"Veeam ONE Triggered Alarms by Name Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"VoneTriggeredAlarmsName\",\"comparison\":\"isNotEqualTo\"},\"name\":\"VeeamONETriggeredAlarmsDrilldown - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| where Severity == \\\"Infected\\\"\\n| count\",\"size\":2,\"title\":\"Infected Files Detected\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"stat\",\"statSettings\":{\"showBorder\":false,\"colorSettings\":{\"colorizeBody\":true,\"thresholds\":[{\"criteria\":\"isGreaterThan\",\"value\":\"0\",\"color\":\"red\"}]}}},\"customWidth\":\"33\",\"name\":\"infected-files-stat\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union \\n (VeeamOneTriggeredAlarms_CL | where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}),\\n (VeeamMalwareEvents_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) | where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}),\\n (VeeamAuthorizationEvents_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) | where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}),\\n (VeeamSecurityComplianceAnalyzer_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}),\\n (VeeamCovewareFindings_CL | where EventTime >= {TimeRange:start} and EventTime <= {TimeRange:end})\\n| summarize Count = count() by Type\\n| project [\\\"Event Type\\\"] = Type, Count\\n| render piechart\",\"size\":3,\"title\":\"All Custom Table Events by Type\",\"exportFieldName\":\"Event Type\",\"exportParameterName\":\"CustomTableEventType\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"33\",\"name\":\"query - custom-tables-distribution\"},{\"type\":1,\"content\":{\"json\":\"## Daily Trends\"},\"name\":\"text - daily-trends\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Coveware Findings\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| summarize Count = count() by EventType\\r\\n| top 20 by Count\\r\\n| project EventType, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Coveware Findings by Name\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"CovewareFindingsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"yAxis\":[\"Count\"],\"group\":\"EventType\",\"createOtherGroup\":0,\"showMetrics\":true,\"showLegend\":false}},\"customWidth\":\"30\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| summarize Count = count() by DateOnly = startofday(EventTime), RiskLevel\\r\\n| order by DateOnly asc\\r\\n| render timechart\",\"size\":0,\"title\":\"Daily Coveware Findings by Risk Level\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"CovewareRiskLevelAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"medium\",\"color\":\"orange\"},{\"seriesName\":\"low\",\"color\":\"blue\"},{\"seriesName\":\"high\",\"color\":\"redBright\"},{\"seriesName\":\"critical\",\"color\":\"purple\"}]}},\"customWidth\":\"70\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Step 1: Parse the Sentinel widget export into a filter table\\r\\nlet filters =\\r\\n print arr = parse_json(\\r\\n replace(\\r\\n @\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", \\r\\n @\\\"\\\\1\\\", \\r\\n strcat('[', '{CovewareFindingsNameAllFields}', ']')\\r\\n )\\r\\n )\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Filter main table by matching series\\r\\nVeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| where EventType in (toscalar(filters | summarize make_set(Series)))\\r\\n| project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings by Name Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibilities\":[{\"parameterName\":\"CovewareFindingsNameAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"CovewareRiskLevelAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Step 1: Parse the Sentinel widget export into a filter table\\r\\nlet filters =\\r\\n print arr = parse_json(\\r\\n replace(\\r\\n @\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", \\r\\n @\\\"\\\\1\\\", \\r\\n strcat('[', '{CovewareRiskLevelAllFields}', ']')\\r\\n )\\r\\n )\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n | extend DateOnly = startofday(EventTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.RiskLevel == $right.Series\\r\\n| project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings by Risk Level Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventTime\",\"formatter\":6},{\"columnMatch\":\"EventActivity\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"92.8571ch\"}}]}},\"conditionalVisibilities\":[{\"parameterName\":\"CovewareFindingsNameAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"CovewareRiskLevelAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"query - 4 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n | order by EventTime desc | project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings Details\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 2\"}]},\"name\":\"group - 17\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by bin(TriggeredTime, 1d), Status\\n| order by TriggeredTime asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Veeam ONE Triggered Alarms\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Error\",\"color\":\"redBright\"}]}},\"customWidth\":\"50\",\"name\":\"daily-vone-alarms\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| summarize Count = count() by bin(DetectionTimeUtc, 1d), Severity\\n| order by DetectionTimeUtc asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Malware Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyMalwareEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Infected\",\"color\":\"redBright\"},{\"seriesName\":\"Clean\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"daily-malware-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamONETriggeredAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(TriggeredTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.Status == $right.Series\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"Comment\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Comment\",\"sortOrder\":1}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"DailyMalwareEventsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"query - 23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyMalwareEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamMalwareEvents_CL\\r\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(DetectionTimeUtc)\\r\\n| join kind=inner (filters) on DateOnly, $left.Severity == $right.Series\\r\\n| project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\",\"size\":0,\"title\":\"Daily Malware Events Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"DailyMalwareEventsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"query - 23 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n| summarize Count = count() by bin(ProcessedTime, 1d), State\\n| order by ProcessedTime asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Four-Eyes Authorization Events\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyFourEyesAuthorizationEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Approved\",\"color\":\"green\"},{\"seriesName\":\"Info\",\"color\":\"blue\"},{\"seriesName\":\"Rejected\",\"color\":\"redBright\"}]}},\"customWidth\":\"100\",\"name\":\"daily-authorization-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyFourEyesAuthorizationEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeamAuthorizationEvents_CL\\r\\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(ProcessedTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.State == $right.Series\\r\\n| project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\\r\\n\",\"size\":0,\"title\":\"Daily Four-Eyes Authorization Events Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"DailyFourEyesAuthorizationEventsAllFields\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 23 - Copy - Copy\"},{\"type\":1,\"content\":{\"json\":\"## Latest Events\"},\"name\":\"text - latest-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n | order by TriggeredTime desc | project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\\n| top 15 by TriggeredTime desc\",\"size\":0,\"title\":\"Latest Veeam ONE Triggered Alarms\",\"exportFieldName\":\"Alarm Name\",\"exportParameterName\":\"SelectedVoneAlarm\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-vone-alarms\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n | order by DetectionTimeUtc desc | project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\\n| top 15 by DetectionTime desc\",\"size\":0,\"title\":\"Latest Malware Events\",\"exportFieldName\":\"Machine\",\"exportParameterName\":\"SelectedMalwareMachine\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-malware-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n | order by ProcessedTime desc | project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\\n\",\"size\":0,\"title\":\"Latest Authorization Events\",\"exportFieldName\":\"Event Name\",\"exportParameterName\":\"SelectedAuthEvent\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-authorization-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamSecurityComplianceAnalyzer_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n | order by TimeGenerated desc | project TimeGenerated, VbrHostName, Status, Id, BestPractice, Note\\n| top 15 by TimeGenerated desc\",\"size\":0,\"title\":\"Latest Security & Compliance Analysis\",\"exportFieldName\":\"Best Practice\",\"timeContextFromParameter\":\"TimeRange\",\"exportParameterName\":\"SelectedBestPractice\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-best-practices\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"REST Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Overview\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\n| summarize Count = count() by [\\\"SeverityDescription\\\"]\\n| top 20 by Count\\n| project [\\\"SeverityDescription\\\"], Count\\n| render piechart \\n\",\"size\":3,\"title\":\"Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\" or SyslogMessage has \\\"predefined_alarm_id\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| extend predefined_alarm_id = extract(\\\"predefined_alarm_id=\\\\\\\"(\\\\\\\\d+)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| extend eventId = strcat(\\r\\n tostring(extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage)), \\r\\n tostring(extract(\\\"predefined_alarm_id=\\\\\\\"(\\\\\\\\d+)\\\\\\\"\\\", 1, SyslogMessage))\\r\\n)\\r\\n| where eventId in (\\\"41600\\\",\\\"42220\\\",\\\"25500\\\",\\\"26100\\\",\\\"28100\\\",\\\"28970\\\",\\\"29800\\\",\\\"30100\\\",\\\"30400\\\",\\\"31500\\\",\\\"31600\\\",\\\"31700\\\",\\\"31800\\\",\\\"31900\\\",\\\"40204\\\",\\\"40400\\\",\\\"40500\\\",\\\"40600\\\",\\\"42260\\\",\\\"42270\\\",\\\"42302\\\",\\\"23090\\\",\\\"23420\\\",\\\"24080\\\",\\\"28200\\\",\\\"28500\\\",\\\"28920\\\",\\\"28950\\\",\\\"28980\\\",\\\"29120\\\",\\\"29150\\\",\\\"29900\\\",\\\"30200\\\",\\\"30500\\\",\\\"32120\\\",\\\"32200\\\",\\\"41402\\\",\\\"115\\\",\\\"31210\\\",\\\"31400\\\",\\\"40201\\\",\\\"40205\\\",\\\"40206\\\",\\\"41610\\\",\\\"42230\\\",\\\"42301\\\",\\\"42401\\\",\\\"42402\\\",\\\"42404\\\",\\\"42405\\\",\\\"21224\\\",\\\"26110\\\",\\\"31200\\\",\\\"36013\\\",\\\"42210\\\",\\\"42500\\\",\\\"27000\\\",\\\"24060\\\",\\\"24030\\\",\\\"24050\\\",\\\"24070\\\",\\\"24040\\\",\\\"42290\\\",\\\"23630\\\",\\\"23631\\\",\\\"23632\\\",\\\"23633\\\",\\\"24020\\\",\\\"24114\\\",\\\"24131\\\",\\\"24140\\\",\\\"24142\\\",\\\"24143\\\",\\\"24160\\\",\\\"24170\\\",\\\"25000\\\",\\\"25210\\\",\\\"25220\\\",\\\"25400\\\",\\\"25700\\\",\\\"25800\\\",\\\"26000\\\",\\\"26600\\\",\\\"26700\\\",\\\"26800\\\",\\\"26900\\\",\\\"27200\\\",\\\"27300\\\",\\\"27500\\\",\\\"27600\\\",\\\"27900\\\",\\\"28400\\\",\\\"28800\\\",\\\"28850\\\",\\\"28940\\\",\\\"29110\\\",\\\"29140\\\",\\\"30700\\\",\\\"30800\\\",\\\"31000\\\",\\\"32100\\\",\\\"32400\\\",\\\"32800\\\",\\\"40202\\\",\\\"41200\\\",\\\"41401\\\",\\\"42280\\\",\\\"395\\\", \\\"364\\\", \\\"369\\\", \\\"391\\\", \\\"365\\\", \\\"370\\\", \\\"314\\\", \\\"331\\\", \\\"376\\\", \\\"377\\\", \\\"403\\\", \\\"316\\\", \\\"342\\\", \\\"381\\\", \\\"315\\\", \\\"332\\\", \\\"344\\\",\\\"378\\\")\\r\\n| extend host = Computer\\r\\n| count\",\"size\":0,\"title\":\"All Security Activities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"stat\",\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"All Security Activities\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by SeverityDescription\\n| top 20 by Count\\n| render piechart\\n\",\"size\":3,\"title\":\"Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamONEAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| join kind=inner (filters) on $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Veeam ONE Alarms Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam ONE Alarms by Severity Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamBackupAndReplicationSecurityEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Veeam Backup & Replication Security Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Veeam Backup & Replication Security Events Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| summarize Count = count() by [\\\"Event Name\\\"]\\r\\n| project [\\\"Event Name\\\"], Count\\r\\n| render piechart \",\"size\":3,\"title\":\"Veeam ONE Alarms by Name\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by [\\\"Event Name\\\"]\\r\\n| top 20 by Count\\r\\n| render piechart\\r\\n\",\"size\":3,\"title\":\"Veeam Backup & Replication Security Events by Name\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamONEAlarmsNameAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| join kind=inner (filters) on $left.[\\\"Event Name\\\"] == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Veeam ONE Alarms Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam ONE Alarms by Name Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamBackupAndReplicationSecurityEventsNameAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.[\\\"Event Name\\\"] == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Veeam Backup & Replication Security Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Veeam Backup & Replication Security Events Drilldown - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where instanceId == \\\"42220\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Marked as Infected\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"MarkedAsInfectedCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Marked as Infected\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| extend original_host = Computer\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Four-Eyes Authorization Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"FourEyesAuthorizationEventsCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Four-Eyes Authorization Events\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"41600\\\"\\r\\n| extend original_host = Computer\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Marked as Suspicious\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"MarkedAsSuspiciousCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Marked as Suspicious\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Four-Eyes Authorization Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Four-Eyes Authorization Events Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42220\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Marked as Infected Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Marked as Infected Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"41600\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Four-Eyes Authorization Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Four-Eyes Authorization Events Drilldown\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Overview\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Daily Security Activities\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription\",\"size\":0,\"aggregation\":5,\"title\":\"Daily Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Critical\",\"color\":\"purple\"},{\"seriesName\":\"High\",\"color\":\"redBright\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Daily Veeam Backup & Replication Security Events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":0,\"aggregation\":5,\"title\":\" Daily Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"purple\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"High\",\"color\":\"redBright\"}]}},\"customWidth\":\"50\",\"name\":\" Daily Veeam ONE Alarms\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamBackupReplicationSecurityEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Daily Veeam Backup & Replication Security Events Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Daily Veeam Backup & Replication Security Events Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamONEAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Daily Veeam ONE Alarms Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Daily Veeam ONE Alarms Drilldown - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Daily Security Activities\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Latest Security Activities\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Latest Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VBRSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"Latest Veeam Backup & Replication Security Events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Latest Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VoneSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"customWidth\":\"50\",\"name\":\"Latest Veeam ONE Alarms\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VBRSyslogMessage}\\r\\n```\"},\"conditionalVisibilities\":[{\"parameterName\":\"VBRSyslogMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VoneSyslogMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"text - 3\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VoneSyslogMessage}\\r\\n```\"},\"conditionalVisibilities\":[{\"parameterName\":\"VoneSyslogMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VBRSyslogMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"text - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Latest Security Activities\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Four-Eyes Authorization Events\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let watchlist = _GetWatchlist(\\\"operation_names_lookup\\\"); \\r\\nSyslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| extend OperationId = extract(\\\"OperationId=\\\\\\\"(?[^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| lookup kind=inner (watchlist) \\r\\n on $left.OperationId == $right.[\\\"Operation Id\\\"]\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), OperationName\\r\\n\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"FourEyesAuthorizationEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"query - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let watchlist = _GetWatchlist(\\\"operation_names_lookup\\\"); \\r\\n\\r\\nlet filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FourEyesAuthorizationEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nSyslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| extend OperationId = extract(\\\"OperationId=\\\\\\\"(?[^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| lookup kind=inner (watchlist) \\r\\n on $left.OperationId == $right.[\\\"Operation Id\\\"]\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.OperationName == $right.Series\\r\\n| project TimeGenerated, Computer, EventTime, Facility, HostName, SeverityLevel, instanceId, OperationId, LastUpdatedTime = LastUpdatedTimeUTC, SearchKey, OperationName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"FourEyesAuthorizationEventsAllFields\",\"comparison\":\"isNotEqualTo\"},\"name\":\"group - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Four-Eyes Authorization Events\"}],\"fromTemplateId\":\"sentinel-VeeamSecurityActivities\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", - "version": "1.0", - "sourceId": "[variables('workspaceResourceId')]", - "category": "sentinel" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]", - "properties": { - "description": "@{workbookKey=VeeamSecurityActivitiesWorkbook; logoFileName=VeeamLogo.svg; description=The Veeam Security Activities dashboard shows an aggregated view of security events from your Veeam Backup & Replication servers and Veeam ONE servers, as well as Coveware findings.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Veeam Security Activities; templateRelativePath=VeeamSecurityActivities.json; subtitle=; provider=Veeam}.description", - "parentId": "[variables('workbookId2')]", - "contentId": "[variables('_workbookContentId2')]", - "kind": "Workbook", - "version": "[variables('workbookVersion2')]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "VeeamMalwareEvents_CL", - "kind": "DataType" - }, - { - "contentId": "VeeamAuthorizationEvents_CL", - "kind": "DataType" - }, - { - "contentId": "VeeamOneTriggeredAlarms_CL", - "kind": "DataType" - }, - { - "contentId": "VeeamSecurityComplianceAnalyzer_CL", - "kind": "DataType" - }, - { - "contentId": "VeeamCovewareFindings_CL", - "kind": "DataType" - }, - { - "contentId": "Syslog", - "kind": "DataType" - }, - { - "contentId": "VeeamCustomTablesDataConnector", - "kind": "DataConnector" - }, - { - "contentId": "Syslog", - "kind": "DataConnector" - } - ] - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_workbookContentId2')]", - "contentKind": "Workbook", - "displayName": "[parameters('workbook2-name')]", - "contentProductId": "[variables('_workbookcontentProductId2')]", - "id": "[variables('_workbookcontentProductId2')]", - "version": "[variables('workbookVersion2')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", - "apiVersion": "2023-04-01-preview", - "location": "[parameters('workspace-location')]", - "properties": { - "version": "3.0.2", - "kind": "Solution", - "contentSchemaVersion": "3.0.0", - "displayName": "Veeam", - "publisherDisplayName": "Veeam Software", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Veeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor Ingestion API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n

  3. Azure Key Vault

    \n
    4. \n

  4. Azure Storage Account

    \n
    5. \n

  5. Azure Relays

    \n
    6. \n

  6. Azure Logic Apps

    \n
    7. \n

  7. Azure Log Analytics

    \n
    8. \n
\n

Data Connectors: 1, Parsers: 4, Workbooks: 2, Analytic Rules: 132, Watchlists: 11, Playbooks: 15

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", - "contentKind": "Solution", - "contentProductId": "[variables('_solutioncontentProductId')]", - "id": "[variables('_solutioncontentProductId')]", - "icon": "", - "contentId": "[variables('_solutionId')]", - "parentId": "[variables('_solutionId')]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId1')]", - "version": "[variables('dataConnectorVersion1')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-ChangeCollectionTime')]", - "version": "[variables('playbookVersion1')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectVeeamAuthorizationEvents')]", - "version": "[variables('playbookVersion2')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectSecurityComplianceAnalyzerResult')]", - "version": "[variables('playbookVersion3')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectMalwareEvents')]", - "version": "[variables('playbookVersion4')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectVoneAlarms')]", - "version": "[variables('playbookVersion5')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectCovewareFindings')]", - "version": "[variables('playbookVersion6')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectConfigurationBackups')]", - "version": "[variables('playbookVersion7')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-FindCleanRestorePoints')]", - "version": "[variables('playbookVersion8')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-PerformScanBackup')]", - "version": "[variables('playbookVersion9')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-PerformInstantVMRecovery')]", - "version": "[variables('playbookVersion10')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-ResolveTriggeredAlarm')]", - "version": "[variables('playbookVersion11')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-StartSecurityComplianceAnalyzer')]", - "version": "[variables('playbookVersion12')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-PerformConfigurationBackupOnIncident')]", - "version": "[variables('playbookVersion13')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-StartQuickBackup')]", - "version": "[variables('playbookVersion14')]" - }, - { - "kind": "Playbook", - "contentId": "[variables('_Veeam-SetupConnectionsPlaybook')]", - "version": "[variables('playbookVersion15')]" - }, - { - "kind": "Watchlist", - "contentId": "[variables('_Job Types Lookup')]", - "version": "3.0.2" - }, - { - "kind": "Watchlist", - "contentId": "[variables('_License Editions Lookup')]", - "version": "3.0.2" - }, - { - "kind": "Watchlist", - "contentId": "[variables('_License Types Lookup')]", - "version": "3.0.2" - }, - { - "kind": "Watchlist", - "contentId": "[variables('_Operation Names Lookup')]", - "version": "3.0.2" - }, - { - "kind": "Watchlist", - "contentId": "[variables('_Session States Lookup')]", - "version": "3.0.2" - }, - { - "kind": "Watchlist", - "contentId": "[variables('_VBR Events Lookup')]", - "version": "3.0.2" - }, - { - "kind": "Watchlist", - "contentId": "[variables('_Action Results Lookup')]", - "version": "3.0.2" - }, - { - "kind": "Watchlist", - "contentId": "[variables('_Veeam Backup & Replication Settings')]", - "version": "3.0.2" - }, - { - "kind": "Watchlist", - "contentId": "[variables('_VONE Settings')]", - "version": "3.0.2" - }, - { - "kind": "Watchlist", - "contentId": "[variables('_Coveware Settings')]", - "version": "3.0.2" - }, - { - "kind": "Watchlist", - "contentId": "[variables('_Veeam Collection Schedule Settings')]", - "version": "3.0.2" - }, - { - "kind": "Parser", - "contentId": "[variables('parserObject1').parserContentId1]", - "version": "[variables('parserObject1').parserVersion1]" - }, - { - "kind": "Parser", - "contentId": "[variables('parserObject2').parserContentId2]", - "version": "[variables('parserObject2').parserVersion2]" - }, - { - "kind": "Parser", - "contentId": "[variables('parserObject3').parserContentId3]", - "version": "[variables('parserObject3').parserVersion3]" - }, - { - "kind": "Parser", - "contentId": "[variables('parserObject4').parserContentId4]", - "version": "[variables('parserObject4').parserVersion4]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", - "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", - "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", - "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", - "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", - "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", - "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", - "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", - "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", - "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", - "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]", - "version": "[variables('analyticRuleObject11').analyticRuleVersion11]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]", - "version": "[variables('analyticRuleObject12').analyticRuleVersion12]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]", - "version": "[variables('analyticRuleObject13').analyticRuleVersion13]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]", - "version": "[variables('analyticRuleObject14').analyticRuleVersion14]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]", - "version": "[variables('analyticRuleObject15').analyticRuleVersion15]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]", - "version": "[variables('analyticRuleObject16').analyticRuleVersion16]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]", - "version": "[variables('analyticRuleObject17').analyticRuleVersion17]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]", - "version": "[variables('analyticRuleObject18').analyticRuleVersion18]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]", - "version": "[variables('analyticRuleObject19').analyticRuleVersion19]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]", - "version": "[variables('analyticRuleObject20').analyticRuleVersion20]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]", - "version": "[variables('analyticRuleObject21').analyticRuleVersion21]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]", - "version": "[variables('analyticRuleObject22').analyticRuleVersion22]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]", - "version": "[variables('analyticRuleObject23').analyticRuleVersion23]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]", - "version": "[variables('analyticRuleObject24').analyticRuleVersion24]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]", - "version": "[variables('analyticRuleObject25').analyticRuleVersion25]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]", - "version": "[variables('analyticRuleObject26').analyticRuleVersion26]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]", - "version": "[variables('analyticRuleObject27').analyticRuleVersion27]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]", - "version": "[variables('analyticRuleObject28').analyticRuleVersion28]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]", - "version": "[variables('analyticRuleObject29').analyticRuleVersion29]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]", - "version": "[variables('analyticRuleObject30').analyticRuleVersion30]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]", - "version": "[variables('analyticRuleObject31').analyticRuleVersion31]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]", - "version": "[variables('analyticRuleObject32').analyticRuleVersion32]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]", - "version": "[variables('analyticRuleObject33').analyticRuleVersion33]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]", - "version": "[variables('analyticRuleObject34').analyticRuleVersion34]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]", - "version": "[variables('analyticRuleObject35').analyticRuleVersion35]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]", - "version": "[variables('analyticRuleObject36').analyticRuleVersion36]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]", - "version": "[variables('analyticRuleObject37').analyticRuleVersion37]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]", - "version": "[variables('analyticRuleObject38').analyticRuleVersion38]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]", - "version": "[variables('analyticRuleObject39').analyticRuleVersion39]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]", - "version": "[variables('analyticRuleObject40').analyticRuleVersion40]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject41')._analyticRulecontentId41]", - "version": "[variables('analyticRuleObject41').analyticRuleVersion41]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject42')._analyticRulecontentId42]", - "version": "[variables('analyticRuleObject42').analyticRuleVersion42]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject43')._analyticRulecontentId43]", - "version": "[variables('analyticRuleObject43').analyticRuleVersion43]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject44')._analyticRulecontentId44]", - "version": "[variables('analyticRuleObject44').analyticRuleVersion44]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject45')._analyticRulecontentId45]", - "version": "[variables('analyticRuleObject45').analyticRuleVersion45]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject46')._analyticRulecontentId46]", - "version": "[variables('analyticRuleObject46').analyticRuleVersion46]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject47')._analyticRulecontentId47]", - "version": "[variables('analyticRuleObject47').analyticRuleVersion47]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject48')._analyticRulecontentId48]", - "version": "[variables('analyticRuleObject48').analyticRuleVersion48]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject49')._analyticRulecontentId49]", - "version": "[variables('analyticRuleObject49').analyticRuleVersion49]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject50')._analyticRulecontentId50]", - "version": "[variables('analyticRuleObject50').analyticRuleVersion50]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject51')._analyticRulecontentId51]", - "version": "[variables('analyticRuleObject51').analyticRuleVersion51]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject52')._analyticRulecontentId52]", - "version": "[variables('analyticRuleObject52').analyticRuleVersion52]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject53')._analyticRulecontentId53]", - "version": "[variables('analyticRuleObject53').analyticRuleVersion53]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject54')._analyticRulecontentId54]", - "version": "[variables('analyticRuleObject54').analyticRuleVersion54]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject55')._analyticRulecontentId55]", - "version": "[variables('analyticRuleObject55').analyticRuleVersion55]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject56')._analyticRulecontentId56]", - "version": "[variables('analyticRuleObject56').analyticRuleVersion56]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject57')._analyticRulecontentId57]", - "version": "[variables('analyticRuleObject57').analyticRuleVersion57]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject58')._analyticRulecontentId58]", - "version": "[variables('analyticRuleObject58').analyticRuleVersion58]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject59')._analyticRulecontentId59]", - "version": "[variables('analyticRuleObject59').analyticRuleVersion59]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject60')._analyticRulecontentId60]", - "version": "[variables('analyticRuleObject60').analyticRuleVersion60]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject61')._analyticRulecontentId61]", - "version": "[variables('analyticRuleObject61').analyticRuleVersion61]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject62')._analyticRulecontentId62]", - "version": "[variables('analyticRuleObject62').analyticRuleVersion62]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject63')._analyticRulecontentId63]", - "version": "[variables('analyticRuleObject63').analyticRuleVersion63]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject64')._analyticRulecontentId64]", - "version": "[variables('analyticRuleObject64').analyticRuleVersion64]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject65')._analyticRulecontentId65]", - "version": "[variables('analyticRuleObject65').analyticRuleVersion65]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject66')._analyticRulecontentId66]", - "version": "[variables('analyticRuleObject66').analyticRuleVersion66]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject67')._analyticRulecontentId67]", - "version": "[variables('analyticRuleObject67').analyticRuleVersion67]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject68')._analyticRulecontentId68]", - "version": "[variables('analyticRuleObject68').analyticRuleVersion68]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject69')._analyticRulecontentId69]", - "version": "[variables('analyticRuleObject69').analyticRuleVersion69]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject70')._analyticRulecontentId70]", - "version": "[variables('analyticRuleObject70').analyticRuleVersion70]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject71')._analyticRulecontentId71]", - "version": "[variables('analyticRuleObject71').analyticRuleVersion71]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject72')._analyticRulecontentId72]", - "version": "[variables('analyticRuleObject72').analyticRuleVersion72]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject73')._analyticRulecontentId73]", - "version": "[variables('analyticRuleObject73').analyticRuleVersion73]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject74')._analyticRulecontentId74]", - "version": "[variables('analyticRuleObject74').analyticRuleVersion74]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject75')._analyticRulecontentId75]", - "version": "[variables('analyticRuleObject75').analyticRuleVersion75]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject76')._analyticRulecontentId76]", - "version": "[variables('analyticRuleObject76').analyticRuleVersion76]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject77')._analyticRulecontentId77]", - "version": "[variables('analyticRuleObject77').analyticRuleVersion77]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject78')._analyticRulecontentId78]", - "version": "[variables('analyticRuleObject78').analyticRuleVersion78]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject79')._analyticRulecontentId79]", - "version": "[variables('analyticRuleObject79').analyticRuleVersion79]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject80')._analyticRulecontentId80]", - "version": "[variables('analyticRuleObject80').analyticRuleVersion80]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject81')._analyticRulecontentId81]", - "version": "[variables('analyticRuleObject81').analyticRuleVersion81]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject82')._analyticRulecontentId82]", - "version": "[variables('analyticRuleObject82').analyticRuleVersion82]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject83')._analyticRulecontentId83]", - "version": "[variables('analyticRuleObject83').analyticRuleVersion83]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject84')._analyticRulecontentId84]", - "version": "[variables('analyticRuleObject84').analyticRuleVersion84]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject85')._analyticRulecontentId85]", - "version": "[variables('analyticRuleObject85').analyticRuleVersion85]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject86')._analyticRulecontentId86]", - "version": "[variables('analyticRuleObject86').analyticRuleVersion86]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject87')._analyticRulecontentId87]", - "version": "[variables('analyticRuleObject87').analyticRuleVersion87]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject88')._analyticRulecontentId88]", - "version": "[variables('analyticRuleObject88').analyticRuleVersion88]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject89')._analyticRulecontentId89]", - "version": "[variables('analyticRuleObject89').analyticRuleVersion89]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject90')._analyticRulecontentId90]", - "version": "[variables('analyticRuleObject90').analyticRuleVersion90]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject91')._analyticRulecontentId91]", - "version": "[variables('analyticRuleObject91').analyticRuleVersion91]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject92')._analyticRulecontentId92]", - "version": "[variables('analyticRuleObject92').analyticRuleVersion92]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject93')._analyticRulecontentId93]", - "version": "[variables('analyticRuleObject93').analyticRuleVersion93]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject94')._analyticRulecontentId94]", - "version": "[variables('analyticRuleObject94').analyticRuleVersion94]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject95')._analyticRulecontentId95]", - "version": "[variables('analyticRuleObject95').analyticRuleVersion95]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject96')._analyticRulecontentId96]", - "version": "[variables('analyticRuleObject96').analyticRuleVersion96]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject97')._analyticRulecontentId97]", - "version": "[variables('analyticRuleObject97').analyticRuleVersion97]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject98')._analyticRulecontentId98]", - "version": "[variables('analyticRuleObject98').analyticRuleVersion98]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject99')._analyticRulecontentId99]", - "version": "[variables('analyticRuleObject99').analyticRuleVersion99]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject100')._analyticRulecontentId100]", - "version": "[variables('analyticRuleObject100').analyticRuleVersion100]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject101')._analyticRulecontentId101]", - "version": "[variables('analyticRuleObject101').analyticRuleVersion101]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject102')._analyticRulecontentId102]", - "version": "[variables('analyticRuleObject102').analyticRuleVersion102]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject103')._analyticRulecontentId103]", - "version": "[variables('analyticRuleObject103').analyticRuleVersion103]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject104')._analyticRulecontentId104]", - "version": "[variables('analyticRuleObject104').analyticRuleVersion104]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject105')._analyticRulecontentId105]", - "version": "[variables('analyticRuleObject105').analyticRuleVersion105]" - }, + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "VeeamMalwareEvents_CL", + "kind": "DataType" + }, + { + "contentId": "VeeamAuthorizationEvents_CL", + "kind": "DataType" + }, + { + "contentId": "VeeamOneTriggeredAlarms_CL", + "kind": "DataType" + }, + { + "contentId": "VeeamSecurityComplianceAnalyzer_CL", + "kind": "DataType" + }, + { + "contentId": "VeeamCovewareFindings_CL", + "kind": "DataType" + }, + { + "contentId": "Syslog", + "kind": "DataType" + }, + { + "contentId": "VeeamCustomTablesDataConnector", + "kind": "DataConnector" + }, + { + "contentId": "Syslog", + "kind": "DataConnector" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId2')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook2-name')]", + "contentProductId": "[variables('_workbookcontentProductId2')]", + "id": "[variables('_workbookcontentProductId2')]", + "version": "[variables('workbookVersion2')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", + "location": "[parameters('workspace-location')]", + "properties": { + "version": "3.0.3", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "Veeam", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Veeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor Ingestion API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n

  3. Azure Key Vault

    \n
    4. \n

  4. Azure Storage Account

    \n
    5. \n

  5. Azure Relays

    \n
    6. \n

  6. Azure Logic Apps

    \n
    7. \n

  7. Azure Log Analytics

    \n
    8. \n
\n

Data Connectors: 1, Workbooks: 2, Watchlists: 11, Playbooks: 15

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "operator": "AND", + "criteria": [ { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject106')._analyticRulecontentId106]", - "version": "[variables('analyticRuleObject106').analyticRuleVersion106]" + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId1')]", + "version": "[variables('dataConnectorVersion1')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject107')._analyticRulecontentId107]", - "version": "[variables('analyticRuleObject107').analyticRuleVersion107]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-ChangeCollectionTime')]", + "version": "[variables('playbookVersion1')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject108')._analyticRulecontentId108]", - "version": "[variables('analyticRuleObject108').analyticRuleVersion108]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectVeeamAuthorizationEvents')]", + "version": "[variables('playbookVersion2')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject109')._analyticRulecontentId109]", - "version": "[variables('analyticRuleObject109').analyticRuleVersion109]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectSecurityComplianceAnalyzerResult')]", + "version": "[variables('playbookVersion3')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject110')._analyticRulecontentId110]", - "version": "[variables('analyticRuleObject110').analyticRuleVersion110]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectMalwareEvents')]", + "version": "[variables('playbookVersion4')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject111')._analyticRulecontentId111]", - "version": "[variables('analyticRuleObject111').analyticRuleVersion111]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectVoneAlarms')]", + "version": "[variables('playbookVersion5')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject112')._analyticRulecontentId112]", - "version": "[variables('analyticRuleObject112').analyticRuleVersion112]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectCovewareFindings')]", + "version": "[variables('playbookVersion6')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject113')._analyticRulecontentId113]", - "version": "[variables('analyticRuleObject113').analyticRuleVersion113]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectConfigurationBackups')]", + "version": "[variables('playbookVersion7')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject114')._analyticRulecontentId114]", - "version": "[variables('analyticRuleObject114').analyticRuleVersion114]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-FindCleanRestorePoints')]", + "version": "[variables('playbookVersion8')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject115')._analyticRulecontentId115]", - "version": "[variables('analyticRuleObject115').analyticRuleVersion115]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-PerformScanBackup')]", + "version": "[variables('playbookVersion9')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject116')._analyticRulecontentId116]", - "version": "[variables('analyticRuleObject116').analyticRuleVersion116]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-PerformInstantVMRecovery')]", + "version": "[variables('playbookVersion10')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject117')._analyticRulecontentId117]", - "version": "[variables('analyticRuleObject117').analyticRuleVersion117]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-ResolveTriggeredAlarm')]", + "version": "[variables('playbookVersion11')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject118')._analyticRulecontentId118]", - "version": "[variables('analyticRuleObject118').analyticRuleVersion118]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-StartSecurityComplianceAnalyzer')]", + "version": "[variables('playbookVersion12')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject119')._analyticRulecontentId119]", - "version": "[variables('analyticRuleObject119').analyticRuleVersion119]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-PerformConfigurationBackupOnIncident')]", + "version": "[variables('playbookVersion13')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject120')._analyticRulecontentId120]", - "version": "[variables('analyticRuleObject120').analyticRuleVersion120]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-StartQuickBackup')]", + "version": "[variables('playbookVersion14')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject121')._analyticRulecontentId121]", - "version": "[variables('analyticRuleObject121').analyticRuleVersion121]" + "kind": "Playbook", + "contentId": "[variables('_Veeam-SetupConnectionsPlaybook')]", + "version": "[variables('playbookVersion15')]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject122')._analyticRulecontentId122]", - "version": "[variables('analyticRuleObject122').analyticRuleVersion122]" + "kind": "Watchlist", + "contentId": "[variables('_Job Types Lookup')]", + "version": "3.0.3" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject123')._analyticRulecontentId123]", - "version": "[variables('analyticRuleObject123').analyticRuleVersion123]" + "kind": "Watchlist", + "contentId": "[variables('_License Editions Lookup')]", + "version": "3.0.3" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject124')._analyticRulecontentId124]", - "version": "[variables('analyticRuleObject124').analyticRuleVersion124]" + "kind": "Watchlist", + "contentId": "[variables('_License Types Lookup')]", + "version": "3.0.3" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject125')._analyticRulecontentId125]", - "version": "[variables('analyticRuleObject125').analyticRuleVersion125]" + "kind": "Watchlist", + "contentId": "[variables('_Operation Names Lookup')]", + "version": "3.0.3" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject126')._analyticRulecontentId126]", - "version": "[variables('analyticRuleObject126').analyticRuleVersion126]" + "kind": "Watchlist", + "contentId": "[variables('_Session States Lookup')]", + "version": "3.0.3" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject127')._analyticRulecontentId127]", - "version": "[variables('analyticRuleObject127').analyticRuleVersion127]" + "kind": "Watchlist", + "contentId": "[variables('_VBR Events Lookup')]", + "version": "3.0.3" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject128')._analyticRulecontentId128]", - "version": "[variables('analyticRuleObject128').analyticRuleVersion128]" + "kind": "Watchlist", + "contentId": "[variables('_Action Results Lookup')]", + "version": "3.0.3" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject129')._analyticRulecontentId129]", - "version": "[variables('analyticRuleObject129').analyticRuleVersion129]" + "kind": "Watchlist", + "contentId": "[variables('_Veeam Backup & Replication Settings')]", + "version": "3.0.3" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject130')._analyticRulecontentId130]", - "version": "[variables('analyticRuleObject130').analyticRuleVersion130]" + "kind": "Watchlist", + "contentId": "[variables('_VONE Settings')]", + "version": "3.0.3" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject131')._analyticRulecontentId131]", - "version": "[variables('analyticRuleObject131').analyticRuleVersion131]" + "kind": "Watchlist", + "contentId": "[variables('_Coveware Settings')]", + "version": "3.0.3" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject132')._analyticRulecontentId132]", - "version": "[variables('analyticRuleObject132').analyticRuleVersion132]" + "kind": "Watchlist", + "contentId": "[variables('_Veeam Collection Schedule Settings')]", + "version": "3.0.3" }, { "kind": "Workbook", @@ -25799,13 +10042,12 @@ } ] }, - "firstPublishDate": "2025-08-26", + "firstPublishDate": "2026-06-10", "providers": [ "Veeam" ], "categories": { "domains": [ - "IT Operations", "Security - Threat Protection" ] } diff --git a/Solutions/Veeam/Parsers/Veeam_ParseResourceId.yaml b/Solutions/Veeam/Parsers/Veeam_ParseResourceId.yaml new file mode 100644 index 00000000000..da5863c20ab --- /dev/null +++ b/Solutions/Veeam/Parsers/Veeam_ParseResourceId.yaml @@ -0,0 +1,58 @@ +id: 36f4d36f-8e4a-4a1a-b5c6-2c9a3b4d5e6f +Function: + Title: Parser for Veeam Resource ID + Version: '1.0.0' + LastUpdated: '2024-08-12' +Category: Microsoft Sentinel Parser +FunctionName: Veeam_ParseResourceId +FunctionAlias: Veeam_ParseResourceId +FunctionQuery: | + VeeamSessions_CL + | extend + ResourceId = VeeamResourceId, + ResourceType = extract("^([^:]+)", 1, VeeamResourceId), + ResourceValue = extract("^[^:]+:(.+)$", 1, VeeamResourceId), + SessionId = Id, + SessionName = Name, + SessionType = SessionType, + SessionState = State, + VbrHost = VbrHostName, + JobIdentifier = JobId, + SessionCreated = CreationTime, + SessionEnded = EndTime, + ExecutionStatus = ResultStatus, + ExecutionMessage = ResultMessage, + WasCanceled = ResultIsCanceled, + ParentSessionRef = ParentSessionId, + PlatformType = PlatformName, + PlatformIdentifier = PlatformId, + ResourceRef = ResourceReference, + UpdateSequenceNumber = Usn, + SessionResult = Result, + SessionMessage = Message, + IsCanceledStatus = IsCanceled + | project + TimeGenerated, + ResourceId, + ResourceType, + ResourceValue, + SessionId, + SessionName, + SessionType, + SessionState, + VbrHost, + JobIdentifier, + SessionCreated, + SessionEnded, + ExecutionStatus, + ExecutionMessage, + WasCanceled, + ParentSessionRef, + PlatformType, + PlatformIdentifier, + ResourceRef, + UpdateSequenceNumber, + SessionResult, + SessionMessage, + IsCanceledStatus, + SourceSystem diff --git a/Solutions/Veeam/Parsers/parser_Veeam_VeeamSessions_AliasFunctions.json b/Solutions/Veeam/Parsers/parser_Veeam_VeeamSessions_AliasFunctions.json new file mode 100644 index 00000000000..ce5de5d4462 --- /dev/null +++ b/Solutions/Veeam/Parsers/parser_Veeam_VeeamSessions_AliasFunctions.json @@ -0,0 +1,14 @@ +{ + "name": "Veeam_VeeamSessions_AliasFunctions", + "apiVersion": "2026-06-10", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "properties": { + "eTag": "*", + "displayName": "Veeam_VeeamSessions", + "category": "Microsoft Sentinel Parser", + "functionAlias": "Veeam_VeeamSessions", + "query": "VeeamSessions_CL\n| extend\n ResourceId = VeeamResourceId,\n ResourceType = extract(\"^([^:]+)\", 1, VeeamResourceId),\n ResourceValue = extract(\"^[^:]+:(.+)$\", 1, VeeamResourceId),\n SessionId = Id,\n SessionName = Name,\n SessionType = SessionType,\n SessionState = State,\n VbrHost = VbrHostName,\n JobIdentifier = JobId,\n SessionCreated = CreationTime,\n SessionEnded = EndTime,\n ExecutionStatus = ResultStatus,\n ExecutionMessage = ResultMessage,\n WasCanceled = ResultIsCanceled,\n ParentSessionRef = ParentSessionId,\n PlatformType = PlatformName,\n PlatformIdentifier = PlatformId,\n ResourceRef = ResourceReference,\n UpdateSequenceNumber = Usn,\n SessionResult = Result,\n SessionMessage = Message,\n IsCanceledStatus = IsCanceled\n| project\n TimeGenerated,\n ResourceId,\n ResourceType,\n ResourceValue,\n SessionId,\n SessionName,\n SessionType,\n SessionState,\n VbrHost,\n JobIdentifier,\n SessionCreated,\n SessionEnded,\n ExecutionStatus,\n ExecutionMessage,\n WasCanceled,\n ParentSessionRef,\n PlatformType,\n PlatformIdentifier,\n ResourceRef,\n UpdateSequenceNumber,\n SessionResult,\n SessionMessage,\n IsCanceledStatus,\n SourceSystem", + "functionParameters": "", + "version": 2 + } +} diff --git a/Solutions/Veeam/ReleaseNotes.md b/Solutions/Veeam/ReleaseNotes.md index dc1d14dfc6a..a46aae70999 100644 --- a/Solutions/Veeam/ReleaseNotes.md +++ b/Solutions/Veeam/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|-------------------------------------------------------------------------------------| +| 3.0.3 | 10-06-2026 | Added Veeam Data Connector (CCF) with support for multiple data tables: VeeamMalwareEvents_CL, VeeamSecurityComplianceAnalyzer_CL, VeeamAuthorizationEvents_CL, VeeamOneTriggeredAlarms_CL, VeeamCovewareFindings_CL, VeeamSessions_CL; Added Veeam_ParseResourceId parser for VeeamSessions resource identifier parsing | | 3.0.2 | 15-10-2025 | Updated author to Veeam Software | | 3.0.1 | 03-10-2025 | Updated Coveware security findings integration; Removed irrelevant mappings from all analytic rules; Updated Workbooks' drilldown capabilities | | 3.0.0 | 26-08-2025 | Initial Solution Release | \ No newline at end of file diff --git a/Solutions/Veeam/SolutionMetadata.json b/Solutions/Veeam/SolutionMetadata.json index b8603f916b8..fcd37d26b78 100644 --- a/Solutions/Veeam/SolutionMetadata.json +++ b/Solutions/Veeam/SolutionMetadata.json @@ -1,16 +1,16 @@ { - "publisherId": "veeamsoftware", - "offerId": "azure-sentinel-solution-veeamapp", - "firstPublishDate": "2025-08-26", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-veeam", + "firstPublishDate": "2026-06-10", "providers": [ "Veeam" ], "categories": { - "domains": [ "IT Operations", "Security - Threat Protection" ] + "domains": [ "Security - Threat Protection" ] }, "support": { - "name": "Veeam Software", - "email": "microsoftappsupport@veeam.com", - "tier": "Partner", - "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" }, - "version": "3.0.2" + "version": "1.0.0" } \ No newline at end of file From f73d9a6d93e8034a80326e34ce2c5f680ee45031 Mon Sep 17 00:00:00 2001 From: Hector Arvayo Date: Thu, 11 Jun 2026 09:45:45 -0700 Subject: [PATCH 03/11] Veeam - fix KQL error --- .../Veeam_CCF/Veeam_ConnectorDefinition.json | 4 +- Solutions/Veeam/Data/Solution_Veeam.json | 6 +- Solutions/Veeam/Package/3.0.3.zip | Bin 54624 -> 110703 bytes .../Veeam/Package/createUiDefinition.json | 1867 +- Solutions/Veeam/Package/mainTemplate.json | 30873 ++++++++++++---- Solutions/Veeam/Package/testParameters.json | 14 + .../Veeam/Parsers/Veeam_ParseResourceId.yaml | 58 - ...er_Veeam_VeeamSessions_AliasFunctions.json | 14 - Solutions/Veeam/ReleaseNotes.md | 2 +- 9 files changed, 26229 insertions(+), 6609 deletions(-) delete mode 100644 Solutions/Veeam/Parsers/Veeam_ParseResourceId.yaml delete mode 100644 Solutions/Veeam/Parsers/parser_Veeam_VeeamSessions_AliasFunctions.json diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json index 30b8893ad2b..8145dc64f84 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json @@ -8,6 +8,7 @@ "connectorUiConfig": { "id": "VeeamConnector", "title": "Veeam Data Connector (via Codeless Connector Framework)", + "graphQueriesTableName": "VeeamMalwareEvents_CL", "publisher": "Microsoft", "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEvents_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzer_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEvents_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarms_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindings_CL**: Security findings from Coveware solution\n- **VeeamSessions_CL**: Veeam sessions", "graphQueries": [ @@ -289,7 +290,8 @@ } ] } - ] + ], + "isConnectivityCriteriasMatchSome": false } } } \ No newline at end of file diff --git a/Solutions/Veeam/Data/Solution_Veeam.json b/Solutions/Veeam/Data/Solution_Veeam.json index a753d4d82dc..45e7fb7fa0a 100644 --- a/Solutions/Veeam/Data/Solution_Veeam.json +++ b/Solutions/Veeam/Data/Solution_Veeam.json @@ -3,8 +3,9 @@ "Author": "Veeam Software - microsoftappsupport@veeam.com", "Logo": "", "Description": "Veeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/products/functions/#overview)\n\nc. [Azure Key Vault](https://azure.microsoft.com/products/key-vault/)\n\nd. [Azure Storage Account](https://azure.microsoft.com/products/storage/)\n\ne. [Azure Relays](https://azure.microsoft.com/products/service-bus/)\n\nf. [Azure Logic Apps](https://azure.microsoft.com/products/logic-apps/)\n\ng. [Azure Log Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview)", - "DataConnectors": [ - "Data Connectors/Veeam_API_FunctionApp.json" + "Data Connectors": [ + "Data Connectors/Veeam_API_FunctionApp.json", + "Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json" ], "Playbooks": [ "Playbooks/Veeam-ChangeCollectionTime/ChangeCollectionTime.json", @@ -187,6 +188,7 @@ "dependentDomainSolutionIds": [], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Veeam", "Version": "3.0.3", + "DataConnectorCCFVersion": "3.0.3", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/Veeam/Package/3.0.3.zip b/Solutions/Veeam/Package/3.0.3.zip index 4bb41792f85d3e45c29eabedc1726e89ce394290..2d712d83b1b7318653037b0c510085ab33d84f5f 100644 GIT binary patch literal 110703 zcmafaWmuluk}U4-?iL(A+#Q0uySux)1PSgC+}$;}ySs$oP6#f!gzTBSXXc!<|MEP| z>Q&uU)xBPjmjVSt0|Ekq0_v3<(}rd;3nn1|0{S2i421diQzJ(c17{Nz3lS4j3tJ0k z3p-nSOD8+qGo2U5HIDdSzsk<>#+y;y`FR-)m_{5rqyz8 zc*we%I^caeIBRN~O`r3ZUC9J@hFAE+C1{vL<-gsW((=RPxu262=Ccw5T{1)FJ6U%kp}!}y#UE>er8~^9(;&+s?(jG= zc>EqK<~(WG0)2i@sT&xHfJm{)(gl>lbJg>dBu1~DDX&)}b~};^Gxfn+OV>Hgo`fOl zCgImchFnB=CLy26YQ&+A)$u^RaV8W-5312T(y^Fi-m8snk0^t_FK!}umi3pb5140n zQ8S#ct0>KLa@@O!?+jX&IvWSB-9Nou5Sz-pq_T$L<#aAI0NfY5ZZzGVj{_f7u@T6 zf?lH9p^}}61O=arrdOYogmlKgkPjI^twu>eNXLKr zxUK6;8QyjQ9{nLTaL^v$J=R$m(5DSDOo54<;Wd)U5fT1?7aM^Hu@{|-UV0h3Rcju9 z->(ssdkyI4aRBa*VF7JIW;fc3^c93KdCYMlQ={95?qqNBzo zK8@y_0sVn!eF%6|*>Bq(Ir5+ca+QQ|&!6-FFOz!xj_YamYT%@!9q5Ki{iq5}@MSHt zyt-LXFfSUyhAW4Qk?M0g%g^0uJTpYEG_cwE9RnXAiuL{oQLp&Ttyk0?-~|#b=Q<2O zQ`jHbfd~XEJMda8c2}=W*25DxZGi-Ri6SxhVU#^a8K}ovWlYJe5D1^>324aNAGM|o zWG)}dvOX>%v^Y%(-d!y>Ar&J~@y*M~M9Rb&0rilCMjUaU!Tw^gSQT>`A(_hlc;M0- zB!Hv0T`_ADYc@r14u&$?^>lv+Nw5*c*)?(@(Jo4liuK~&I+sA`ol^_A<^`kEJssW` zs9#y)2KBxj0-yzs&-|KYlG{NkZrcA<=zc_2Blj9v(Ht+sjp)ajA*g+RS`H;7cTa+i zY4$8c3q&Xc$`gU-O6*hkiIorIf@nZu--at{zypJ;v7Qq1i{}<*=`T(0$y@wXf#7)q zkhuKp%_1b;fmsm5hNk&omOfB+sh^|VlpG^xXm-z;zpk_tO!(Z)OWTMD@(=Y?`Mam5 zoO*zbByJ>SxGYHF9fyV!1N@>!$aXjknC|T*nUNBt(WN?RT%r3!<=hz!3Jo@Sb>!e5 zmHHFxD}OoW@xOrRhZ6J_J0zmvO8PBy6~G?^7(+xGieL+*esTjxCX<;m`|~$OYzD_@Xx3kVL})W2<@3Tt;5bQt zPTXRUefmatgUa->nw!r`*qP#9e6U4V)^;Bwyq@S1?YkUmetDEeguj6HHnhNz0b;)0 zPs$Z9jSUCq@MVus_Fe-Mcn$PGBmP()v^8MiaRquor)VwGm3^M(JtSa36q^W|q<3x^ zZ;KAAaKDoP&A#Mp*;|YZ4`U!Q)oEKRHroGwwrB1?Jz)Si4~lZ1OKLzA5xC>=1P7<* znHflZoV@l4jKSU^?*fVdA?arq66!|=Td$=edd+0G30f{FFAbU!_#NA%x# zS)|+CBzpYn^P^9X=rKS7CUB@T^@{;dIX~#w1-pc2C7R!peP1?aeXBL3YFOZz1=`u` zb;9gJan`{XS6AF^%VllfazR)AGZwzH;p{}e$2EGE&S2|k8wL>Y%7^g0LB|y3j*p;c zPRG3ZH)y^K9yw|*bsp__GBgQKvoc0s+D=y^P3#CdP^CX#FRn^AA5V{YEd~(XOLeeq zt#k8LeLE*Kpl;E4f=LPTg|{r@^cI7;pI0dw<8t=!+=#!Csyf|$tQ376MBSMdnB=tl zSiETEI2)%IBv=dNpG4oTc;7U91?KOu<=HNXh901RUnQK>`VSKUJ$FDxHZ3I5QQP=Zm)y!X1)tGNPmiTFmk9Up}@XGt{(n+m5liYYxZ<#R zt!Udo4h2=5pQ_s+Tkr;GBqNnTZ}Fezg&P z%9vmA=%A=Z%WAs~ktQ}Vt}g<1uxWejdHV{r|Y=sxx=w!qD6)@Nw&N)S}K4~Co$<;i}DiR=%63MZj0r4CS9 zM-pw+DuiMbi3*+j=NGIa)tI>QL??dLUeF;OPM*>He$Q_TBnPB%aVF%;bku?~(w~FF zqE_Z@?6xwC)QCrb01!doY|lKv@i#HO*08N|1x?ic^X%ei*cz$?3dRMFx~QPJps9%tnO5Sm<*i@$ynGIbTlqY%?4f;H z99a%@0UgPOnmO<&4+rBQmZpFs2w9576X(25&ZFg^H@rfkr}l4 zA`+?M2veO@;!lnxUm8cnTe-$F0cgB=`x3mUNs{iVI_Nb<+eeih3P;mTx}rEDuzr=b z-qeI6tw79sJy`rbA-n1n>{QW62X;UW7~4teiYvd9I=Q1VQCMyI4~9}-IMJH0CXt#l zQ$RH;+8!1XtOUgrQ_TXaU0Y34KuS&&Y8i*Yw;-4FSha{NCl!*krVH={s4@>yDy6>1 zM$Z6d7ErW31;^XNv-=BmSpz60VcaF2(ehmutQ2Y_y=!K*lRIwToxqe{O+l5)@qmC> zypZy^5S5;|$fX>`i3|yC>gNz;sBP4Zw&E&DzFfPxFKD0Oz{D01Q2dz#tw4c*)6-2v3D`)*Nj;)bo7I9 zKV%y_v`%%~1_c~}O?vlZXB$yJ5W{p1*dL{ZL_Qo1que%wv1;)X-b5P=@mN2y^_rd_ z14{6iG%qWW z$GU@<$Wsvrx+LZg-2{6R@_X^N%cEjiaLIS>;EQc$8t&44>{~skqW1WfP)M8~w(2Lq zn^QUpVHN((#Oz8uCxW|=%iqWs0auebED0D&%A(nqt2`ca(GF?kg_=Wy(seS2xy}=6 zMGUQcNBt=M=OU#dP2H(w){oM)O_kXWN{`;}iWEHKbd{CgJeJ~lv^wg}39!H;OFtHR z>9eX6ut&~YA5nW~$b*D{AX3$+#6vrVFu0}FG_bB$+@7F9i6;pQpcfDXV32%jgV!QY z@xNV209YTRVmIP2x=y(oX&u!) zg-+O12z<3`Z=JJ0=U(){fOJwpNh#Lz*Y5Lqw4}N^L^$n{qP``}8_)ML$6^{hDm>4{ zpZ?G{(FBm%pvE5MA>Qd@WZAc%H6XRfhJaSsq;q8=H6mh4{COC2+86G&QN`1&rWtOH%BU`)6l@n}`@P{)HS_A1wj+ICCd_7K0(-LZ<&3=q@m3$GH z_JPR)NzWT{+d20(pmjnkhXr$YV5N)Y{<0=B=pin_9&8xd6fp61^OcjP69ahHPUSE# zq{f6~;A;ZS@37}gHGCAn@Rd!Tn%tyDmu_$k=lz{(YikQd#8SJwKO6cgxV{%Q* zoV0QBC)%tC>ZrdN!r5>ux;>5R4IV0~y-2?bs3=YTHRBZBAv z5FpjLnD?KAQ?20;7Hj+gXii=aU9UNo5?FecKk0~H$e5dWeWt79#l69| zqHKAAA5`l%`*1exlclsfNk`=K5E|QV@;GvRM~!QM=r4iLHP}rX53P4shG$y!NH>6azA(Q8Hr5jQPs8aJ8Lr zr`tJ(0v+FWqk^2GF1ztDr(lAruYk4~`$+c}m^4)KP3-kiHBsm|2F{8Fohv>$IUT{m z?zKhhkOw_nKcGLP(G8P-PEvQgCT6(oAMZDSNRCZS%vonAa!VYo#P1i0)NPh2-=$Vy z>vQ=WR3#I-{#Z98I0eTu{zcaix=}-5q^X)5LIowuEV~b+CrYIYuHqY4(t{73UGAbN z_SUxuM8>qRni%!1N?C#r#E9;Q20{vwm20P9l33H!uCiR9%-iK|bj5fz8>kTx1^<@xi`{{p_ZxJXHb(RaP zo$29(IEI5CI}S!dn~M^MuR9pb0G>jiJEGgnDh^TMQJS2$kl|olj;)5eu!u$i7X!C^ zM-45U8b1zhDBiT9VIDy|8QRMd-nMASeAaswJ%WHJP1+-3?dq=2i^hgqgs=LsJ4@*o zf?D3t5p1g@B*kQKL$Eh!pCC1aFg;=cu@lY)RgnrA$xpn`lzP!KvEjg9E_&>Ne8mub z@J?JvbFF}&B{i5iQ!sV1JYpeO2WIg!d-o?AA=afq_guo{AP9K#FIxrIBgG3-Gu9wgC(o!n_`1A$L^_pk zmDk;poY#d#IR-b8`5S_hy-Fa8FSA=JRP(-8Pg+#1t@fo?L<;{a_Jlt z_UtRmz_Rg^Flf^ddF+T=ZD_K6z-Wghy*e`^J^58bXE6pN9DKkx5*n=l99aZFLFt)k zX!3N3M;5}oOwo#w2@k33qm8+j4L5`%*6^S7#hG3jl8%n zd_0>PR2yJjtV!#*4nDZpaUV@E$jh z)WmI7{6$BbXNZ~kQ8dQHSt);A@TrK$bu>A9+8Re$d^n2^jEgb!ua*~Zd2yBam_`*o ze2re#R|U!Jn6d(_>Uf875Nf?xz%E~f0j4O$2}XNtHnKg|HGXnzG$%_1BJk(30^;iU zaEr9v^Lodv^W)0(W)txrfgLR;)?ZCz9ysJ+x8_}qqpd#$fcIfJgQ(?Xllgh6PBVSJ zx_;i!&}Si~-l1|Zba&p6FO6U7C?X~;CW1?lXKKvah$B}vjoJa>x|BKeHX?2Pti!3g z>nq+O#k#8b)uymHsdViyOa=F499O&rytx*t2W2vjI{!&?oelvdR7H3rtq8XDYD=4T8 z+3?=S?yyz`Y31>*lN(Y6C1=S}&`&VLzs+<>-4oQ)23|UG*npZD%MSn@Gbz~YDfMaw zQf?Jwda7wU=qKU9Zr+#u0XO}6nODoErIEf}k5{6BFUmoB+G0!}#UkQ{6WV3XUVk=} z2QGTqUcVCFL%j={#^fbYfbqHeE;YlBF85`&|8t^iP`yo3LFW1|I7ifD7t+=*A;6%T zeZ%CM+7AFPR=TzJ-t={y1AXK1;eErhxDC_I)!{Npu`_WAX+ZP`(w!t6)wjH79{l3b+Pk@F~JNa@`AU*tSlNXB>*$8jruIZMLUG(FyVk zx)#6s85S#%=N5r^KkX;tg{`C#yXo@up++#Ik+RPW;uRBUd%`{+-}M2vvLRrlp9oNq zgW+w-ijW_Uf8B)aa&4YI!m4d+I)+BX-2Jgr30!WQP2R4i>3HIxcM*474`0#Er7~+` zWoRlsX?YPc1VDdIiMocz^1k-gWK+Jmst137mF0_mt{p6P?YoP@BB;#hCvrOOMn{3e z^0*Gp$Tyk5Z)Em5D>}tx+BbXIa@vBWwf(Xs`AiJNOHJqC4Zt0gDbCjQgeEE$|2x5qg3hII>N&Nj#=+vegrm@I!gpY6wuRn^ybz#s`d#ZL3T%@AXeiJrWY1iGdDDTtSuimZ0F9=`OLoQ)qKTuNEl`v+VnY&_Fo z$z&pRLaEsHW=mGxMZ!`;M`bGPsQ7B5u^tLhz&qHiZnB6!mod_>RU=`4*f~XO-3=p& zL|u4->okMXh!$8sEvjYdCRwkAeP{13F{Q#C}#Z`)I;IXe@`KQy|+oz;Q!Hk)KrntZn;*tW{Bi3kZ_!8>`n&f;5W()tnn z_`{~D#c z`gDK6^4{mZ3kPHdzbo*T?LfXyq=sgvN+~*CwNnI#-+h)l>{#}EXhL?~y03_-Oc}=k z5NhE`{tw`E$Qb&${_|OVK6*-@fk;|iQZj$#;A8Z-E2e|vgh)OR(jj3R; z_1P+XIDEyhr}^N)153pB9hkaWbaPY7)SB$Zy+w$Af?bx4+$0eLO+Pl7?s+ZqKA&OPdaToL+EqV|v%8`q-W@;4US z)Yh&#w~N+u_k?fY5(#5D%`4{Vgs_=5StGy8^Vl^X!P`uTYMF~-KMS(mi(qvx+t!(L+ zRH^khFv`EKcc3MGsMqLxVN20UuvS_`%u|g0B@#08PzG(?2FR{eF~`7Yk#GM*|CUZR@eBC4WnxKEMMo>Nr<@Sc+d|GQNdHq( zcQdQWh>w)#X43A#KEn6Rc zXFx)vq-d{BPa;r=FuJf`cBNP?(qZ=-O}~fTRW85qcS|$9o*d9dh1WC_8X1aFYHOpQ zZ^MH<{v?>Sa^!Vr9}pKmlb*x!Vmba?VTF73L+ekng>~$;OM^2QhYx|by{l!$&}IXE zm5r4?wEhm1buBcDYU{8^7*9eU6VzoPq}CPJn_VLJqqtLAOE!Qf_iM>X zNb)+~Lf1hKdD1uV_@Qp2jDDpd44#jpye>)uQCK??<}y@jxZgI>knQ&*?1d3Piu40e z>mo}OG--)SyMN?g!wdW6X6Mb8M57m%!Av;OXnSpcnqy;&r5bC~%chjl@nyBBn+|*_xd{eQAm)2jh{ngV+j8X?pLa7#N*C5vkOCS(4ory5M++I+!xK4aUmD!G1 zJj85Mf}CyG0p+^Y*8^1EC#|UPwrZ0=@0_8~|1)I^e}u2^G3uP}NEFikfb*lcNsK;A z39a1X%t=K)7oGB&%%XA1DKY-Y^a+wDB~?{qSuXOrH#7Sr-^zsCAnxOI`MDZ=MntWokm zgA+G}^{{{+UJN`(Z3%)NUnd`&gZ{W-osJ*pA3MXpyVZh9e0hOD8|q$<^#x^Mn;kOS z*w_gBwOva9XZ#@lT$nUk)Afs!{ctkg_=wO;s@eE#)Jrn^Rzpkp80|IS*Dpl*|M6Kl zly0U$E)Ezd@&yYB`R%i^je&)&vWbno_1nkg_YcaaonCJ1Y;_EezjRJ~AqgfnNmrH< z@2%rCtZuP~Tq!mqP(SaHo!||P;gSiK4prL9)N92sCtUc#0&Pu*2TWib6*%3d8?i>} zqhHeG$g5C2pZt39L)+Ws-`P&zj7?xjOgNd?XM5e*5qfs?6;9s$v^l-EpZVOTGk2}; zlE4$m04H;&JfXEixxkz6C1q!eX)HYT3%NSkkISQ%AE_c4*Zr1MXXtt%-bb8& zY5A8__SQ5!^hl_~CBrS~vq)3M$wGSEtHg&^1$woaeN+u4Q5D<$9#8bXt=(I;&CSiK z#f+{^CX&G{^Ekij&@0q>3VOB3Gl;Jh)+pzR=8dZEeUwqp>^*~Y8mRifphh z8Na~zZO`pKSaEDt9E_F!%#ew^mdwySK`0{jhtD7R_L(~=+N*`G@!g^qIpT0PWK15Jon{?!o8COzgSd~3b6)!v* zc}szm64Ny_z$QMi&{a;)@@%j6wEIz)E zhci#MD^euQ5{pr6iNpMbTT02@RAH~pSU1v%=~ij9i&f_D2-ZTfw< za}&2s3W+FDT|tXa(K|6*jADB##5SU>h7(X0Ph%K%FNP;R{hG1vP8eJC`GxlS4OreFe_h~2-wA#;;QV!f zQIr?kmn1`jUB9t|)j6Os4%!xV1c@_=O_>lsx~^3=0-v~`Rj@!8qJiyx-`(J?D74ZU z^2uWSG#~K_0weR|2+IlGTvpesz(p!C8@Wg3<`1N=$A12W5WZQ7(&xHHU^L(rIBHj9 zB3F-*b(*slBY9SxA<(LBiDw=Z6!Lyn#Oib?^$(zHBB5&oBF3PwE08jaDoyD>6J)HF zzJU6TS}hy)4%sEDmG61i_u3%GwRg@39t4tGyN#Nh(k+q0H=R7}>w3WSxj_yhM-!?R z^s>FgR2=l{P4Cd-Im@M5+lZK*^3ij!N!wec zVv9;%#(x-xcFXOL@Sw+|wtOs3k1un(*+P;*TbcNR<{^vE$Y5*BekZqNv2 z=XMcUu=Y^Dz?`nv33nsiVz%a9-{vvK-_s3;CMB<7KVXcfqDxb!?5_MQuWo&qW)Jbv zx1lhC1Qgyldb~hpTF*Z|`dfxE;sY~}RCB`R)SR`K%d3y2NBn@4`}bo{R6S$v$NQfV zia#NZ5%r59aldvXDSxS>kkqa&@aj^3;L{z4lNVT*4;vVOy)H!D8&kWUq zU%`T&2|N5=8ypI3Q0Xr}GR2(KrM~HqeqnVrjnKpbK(RMopA)rIJmKI*P?%JH9p*t~ zHN?oyBcDv?Dk*rTF@Xm6u{`fo4{a{z^vdraKN6iu8`zH^@ftAm4*lQ(T|UoUCGk3X z=IO!?iRq%9noaFwn>1wEcQbs8Y5c$>+W_gwn`2hYcNl#CWoLa9Qo+YnCRvT;*Xo)_ zPhN>%dO%@k$PV6?w8k#fa;KS?s>!Ey58Zl2H+#)rrg42bpSUJxF;7zTFLkFtzaEN3 zE)Ud7)tYY5dsb^yqq4cClyf1ws+LhdQ!7$%phA83 z=~}OB~hM^ePd|~S7ZtyIS~b2 zmKLA_FsidObuQOX8AaKh)%9%({Fa_zBH-bCsn!M|h1>zmjdkXot9!<{Wue?vm7+C2 zeX1<%gou2CYo#JyuZus?Ge09zn$Icd!cu!|E~|<^Ve3*MsS&tIQ>X8{6z^l^u+MG#Bbg>A=0m6s-j_)oQ-_o_VuS z#V;#h3ud7zUsjA4%oZ#8R6fwi8wplcUWWR81d(_sQOd>1qhKwws}@ai)iYP1ELO_G z`*?eTYp(L4Shp~K`MUF(6p zwY#oD!M>`iOG$QhPsXB9#wPL_wPyv3vVNYIam(Ioj7?B?zB9T}o|A6|7uK)(opO-KJF%zO{e5 zxt%UwMDkh)h5c&Ta#+qLsIt@XeW!ZWI4J^p20NesXrW{9 z8qFfePUf!2s?IPo=T)vQ9rHzI8=P=~B8sV@s;jJ3#L>haE=bXRxw>lhE{$hjUX{2YDFsU5)?F87n2CA*;jdfw zx>whYB8AsHdS4Yp#Ef!7HVCheT4TPlkg7p{(la`!48ViJpBt_I;6Zjc8Lnmy(ZneqUjO68>23rmOQr?pKgx=~~NxtqIJet&g_ z1-yGAf{%F3feV3t&wX2m5c|gAjZ;SV&flCo>d(vuS3le6_3y@nrX*Gf)+Ogx%AtYr z2WB}Sq*j*i3(<8QTTL1s^_vd5fA2Yp%G=l0e}R;xzM=Xw&6u8JFf1JO3-qT8rC@V7 z!gs-$nL$Nffv8$wMN{k`WYB=Pb=LL!XtvZ;8Ahf(gZRAqL7L=>N10_NLNxAK??up2 zJY0DwPDUyKGS!&Q7e_+dpzH-OUMT`ki=}hC`VV>Ip7M!}waSQ8R@MSZ8iV>nLi&_< zFRZ@#FsSkKvOb_<@>zvS-nu$+H#^gq&_T0xT(B;NS~2CbX|`p_=o-|u>kUY}=B3N>?c@yrDmhH&PJ@fW?-M}IpB{X%Swu0!YJG?4o$VD9ftA^*yzm<-Pd056 zDkK=bi#7x%eDuCd1eJwahBnBD?S&xd&1505<+zTLZ}gE-qGN_tp1PJ0TQEo%vNP%M=2i|@qN(Iyf(1+o4$tiZw`q)LcTYdT0xS4jH> zG3cqj64tCx&>?#yZ_>P$j1$io<$e4Zkk2Z#yh+%b`aAeDm_a5Q3R2Th7^7qn0aCV$ zpnGT-BW0uY)FLmbqFKy&d9soJjI3#BnFqzyc6E37xER#bZ5ZSJlRMOuSRkV;3^df# z;GbaEHlovQ;_;6*G?&BD*Yjx@%wj$=F7T2nZu_3D+n&CMY<35kFT_y~Z#SNlKpOmg zV>554eB)zagJ#%X`ZuKKA-BR&(*X-G-ZkzW0&1Q9_m&c!L~!G=ZL)yijlW{g|B7|{ zE4CW8m*96SlMl_jaE-h4ngZS2qViU=&H|t!%?f$!3T_t4zz#?Y>&k~GxU<&UAo1IX`j!|6^t zQ;_G{0V^{R2Q0vnrihwB!J8Es9Mb`Q05NgHfuaZy(3ppz3PTK|hOg!ZAA{~r*66sx zAcGpqo``CiA0b$aL|~RC3-&N!2?Wo8PU&N5hC;N@{!YC0PvSyue-dB*EAdT}10W^= zjD|Qq0G(xdla+9+m>d2!dPSZ_iNc2K^K{MxedJ<-j|7nsRxHpDbzq)MEM|dh0Wd^z zWkMpi&`S<*jN!mV7a733^TLd@JxaQ5NgG*eX%#v$2!Y*Hvz8+>WcZH3d#u4TclN_}!?|>RXc207rV?Y2b04T~Wg3jG&=R7sy85%}oDfUxK~$8!z|Q=TdK~W? zVncisNGrn73y{NEalEnt;LOE^nulq!K-R1Dse-X)FbWdOscm9tqD9b~LY?5lpdz<_ z4j=y8;fS&Ah~Gvsd%rgbqPYWxipxx~tDrVpfP+aIHMWKB2SM9Q9^ewp4f+2n)%(G3 zr852lx7h6;xLxzR-QaXsZD4wECE*q#^`W78K7$cw^&Ed=1NHD9CI|(FCi;xN(icGt zx(h9GD=%~d>}Y2ESxG-&+#&*boW!!V45Cz8A7a9L;rgclc}(R@_o7hPI zAj3wYxAum^Kpr4*yovHY{_EH)-_g{GoK}fy@U~#hsApKAHo=g3u4wbh1B~L+tOQoW zXEFyr{Qo+Wc>Sr>@Sj>moxa!ErX-CG%wC8UtQ>NjXb41!V4XJZC~RhYQ5sN_{>Ch0 z#CK+WI{m{e60bkZsvG)HBY+Y1Gf%@9)xK0+%)Bg_JqQk&CfL61WD2hD8g$8076(P< z)Pj`scaNG6{gnT|xknBYv?%cCv8zmkvp{W{#~llM!?i404*o|$Y3z!?`3hv${ZXfj3Mo&fn!oQ{p0Vy=8`;Upl!QfntrkO3TFsQw3c z<-YX)RdKf9SdSdR28g;MjnPum(rg>AvZ|x6=<1$8^!>kuVdW1+{tfJhBB7;LO)$q0 zl4dBEH5?RL;@(4b&idTeY;+>1ULe>#zxC{Yq24}RB%LH9%MDH;BP;w#=qrOB1pG%Wu+g8kRo zxC-_*Q-QI2vfO3pmboywc)|;2>7^&3`}eL+oIr19CxyP5$eTF)>(r%8lL-P-aGUZ8 z?mNul%2D?1ug-@3i6*0tk!WndegMVs{!#L}zm)v+kCOjZ7Lc^LP=%5(YdJ1}dSHUt zNtsnG%H;eaX-$;=-MaTDO_ti?C6IrGIp9yHHz2vQM3|HlgG0N*$ns1xVxP%Kn zve6R1F?47APpi3_B9e!~#Zta&66mn%JHPFqzBQyDtOx=bi2Gn@cAvnZWJ+(zV}CBf zM~c*(co@!$c=3-i5ZH-{t$ptmdg!$O-D#I3C`XB9Z1MDr^TLUR;c#2Ciz z>>&T7E$|b;`uT)l+y23+5${$tG<`?G6(d{B>_EAqjMWFCmty2r9gD_pi@-@m zf=v7%HmQE|k$)}ae|4HeA;IZq5Pgii*lhR?9EzF|1mMH3kgleQz@c*@FfEZ%r0)h2 z{qVGDL921{Tdn&&->$7z{Ktlz+#bRHhn(*>#8nAXB*1snvG&1$;won8f5DNL;Dm=W z6k4?a#6pIj{+T!ajR9WU>}b78yMUYQ6D&5BTO&2o$AYO?>`7aQ6n9APscU!xh$A*_)_(2Tw zk>$7)_#O%Li+S?*Mj(%HuiJM~Y4E!J7aruKIYdgld@kbBTD%4jN&<_6*ykl~Vvm%D zH7tz&C-2p~?7*=-^eDTqI?buDE3@4VDZ`jpAO3PQpFiRIJMaIjXI94wV7cNtE>TFQ z9*93DLNb+D3(}=N8b1n-g~a_O3;)jdBP}zLgze49PLuvQc`Y4_-U~r_>8g9PZYNe zasSr^AY;wm$1JcnT`(t2o55DUqF_xew=a5}cT(O!fRDxj3>8gKio6+EItCQPrGP94 zPEUhC1TpY#9T{mF#``+(TTnS-qiu?YqR9p&FNCjvoAn=OHVd?n zszR%>(vw*3O2{fnxIUFm0oZl_V@(b#COU|J;7T*xy&qUIES({)(vTW2D6_mx23QfU zM!#b^tWPAx?S%Nb>Ax4oRqT6EQW`^gbWG-(@z{_#Vuz__;Ry=W91jJjT)Vffdl>!? zk{*64$^v5+YknML1Rlt)58=^dSMv5{KRf&ED0c}D30da!$oD^uU6tr=4b+<17}03ByIQ^gQlHKO`T?A|Lw#! z_j_WKAcECA#?CSRTD?jU(t$MRxXg+SSjb7Y#mzo>GN`wBTWC<Di)JU+ydo^ks2KU2S{`sv4riIz}Sau^vJ$DgMB zbpR1o+4nB}*XkxKrF|?O`VFAVY6<~fR^D?y@4rr=+R|NzF3M9k7W>lx)=B(CSNtyTMg?iT_v{%J(5w3);^76ZNRE0`d!f0HH%kw13uwg>%oZ{oTz ztWc82EX*X5(AHYNUn>6NKDEF> zItOiGUK;n!e=0)^03}ej5Hv}vG>12_kS+uJ#_TY;cU5k%%zWR70{+)7rwYVB_lFCK&tn zI)q@n3*L4hY^e*C=9vrep|}lPOBolX_-MS*%=X&!t=-HtG{8XJi74@Sd14(5C4gFK zMK|G7Ph+wmE>=!)u)^U6PLG_tU^1Y1zV;Z;@?RQTn3+o3q$7jASUI6|P5-dAT|fx-9JyuUv; z5C|+bPEKbN2?}u%#|VLheug-ja~4y!!U$-dCJwc{H$Vz@HTI%=>MV%njcg#|=nmpE zIr=sel^_fH-`#;=@Mf~o-D4B7)j)n2ShxGuMJRntL=iYV5dpC6 zOC_8~Bo;IZMYd1m_3g;yfmy( z0x}iB6|E90-mzr>rdaIw6379ur85afY{0d-D3^kxM2`muGJm3S=k_}G4^%R94kts2 zStnjzC=C;YVV~I^rgO36A}+v0K}|Hg^z5mj?CSEJz9l;(vpoULX;^|V%p_{~Q*OaA z_`ziN7b3yFG}Ji>Ku4NQiT-(g`yy5Qi(-(;0K70H2@gH-#2!}y+ij;}UB-Lr&wo-E z`SmCD``@XLM-Z1(o$!rSxteV&1RJ9)z-mCJ6V*8LlEffpt->7ullWsH7;p2aLLpIx zp=DAcfr@-wfSt?|6c7vy1yHhC>nwrlfDT;SEHL9~-E?3F)0&Ba^|(>aXR=KV0yzl4 zy(f+o{wHy;y!XWAbKVmVgD_ST?hVIjMe1xISyJ3c!!JXNBAH0jc!bM*n6M`x!U_K- z05NG40_yM%+m*l{*pSeE!?rUVr2SRjwA29XBph8a&oj0OhDln2b>>4rs=O0^z+21o zQ9-?@F8^2R=x?b*PI|g2$0q2%)eJu&9Wd2sa08T8ug&=A1AtP_=!IDPqOt8{eZ?Kg zcH5AJj3?2}XkI2pp$XPT z|7}X22xRp_7(|Q~B4v9kUnQ;kz?34u8GZU3UYaVm zffNM)H2U9b1!|VhO+Eav#vY@;>LSAysK{3!)kZ{pFwxGVOqMv;WnZX(fU6OCGB29f zPDj+92>2klFf0rpi-66MB8q*qsS@>DB>sTrwBvstb2LGOBIkTbv#O8r0C=nSrQFhI z?LGv}yui0#@$w&gZIO0up2)iN5rSq?L>qO7pDp!K6%Fg0wxDVuK9Fp6x!xJ`kG!Gx z|I2pSnPhqUYsKi$n$#MXenivIV==%I8A}6C{=_mC5%nLM{>y4R84BrOwlpfQ0fUaD zhZIRV52=B&*T@_T>iaIfx0*&OP)`6{=FlgYo!!{LYp}dPs#4FM*5AlY+hdprl>+jU zb4!tHZCnxS#*Bwa8L_* z+f~BY)zYV0Zn*xsF}_1q+=@8NS43vL+r_5;KA-*{DEa@cHmoCu_1+ZEtU-+cKxiw| zjWyZ=M*wF!J|!vp#8gy&5L=?^X}W63xkrmR(O+7B)r!Qc88l^$xa<%6{UIF81)DilBiCX5k#%TrLb<56Sqx3TCYw+%2xHGr(hr z8nw?497b z2Gtp2gqg2Xr~cNo=)!2@LNh+XC^DdZS@>&35hCR*pYS0t4u~nre8x zVt*tMUu>E;HhH{Eu$;_?h82P`m`xn+b*#>GPF04TyQ34Gl}ya55{?zPPk16|!n zgBgcD#m*v5;%#oATPNV8|D3`L(*T=qIu!H>?3cx#4hz>aiJAXW%ry5PMA99VAT7V} zkE&EbA&Yt&l#GKv)crHqH6E&eH7R zA(C(JXSKZ3*e~~u0+STx1Bzuj@}LE~stc`@!$<=mVg#pxHZ1+s6rfXF{t%+S2V{4t zaNJb-aqZAq*4j_~&}fKLnrUIKMxIasz)fgukZ15#nSGQO)@;=DW{j@5<~FYgY0f=r zn0_+r`e}1C2x0!i3N_me>{6$tLGAli6(Nqo8H6-AFMOC~#4eU%og4LRk6Ym?AvQe0 z0~|aZ`h0Gk!_kgV3%CpxhJmw_`RNXIK|JsJUESS!HJl$9-sE#+0D`-DMx*VGZJGe} z?LK@atRJ39eD7bKSg=~*eV+uMVg-}-$)B=Qo(gl&I~}0128~)DaWtH3>Jh!Tlsu3D zWSvbeVa#LXIit7tU@ZxF{~+p%Cu<)!Jp%lB*rp$34`%BKJGF-Bip=ms}19#PA@?jm1~4n}8(pm(Abx^$sp=zaHNM&kqY zD<=*{yNdM_AusZi{Fg*dnpK&*hfnU4>Yx#Hg51)-A502aRw?q*h5G}sq{ zmb51_8Rl2F36c6@I1x2MH#pk#)zi)}mPh)^40axdJm({4_gUAGpc&V z7@*`o)Aj*86xs^Rp1JK_;0cg+Q}U6CIEx)XouU-$+H7{IPU(80$Nx2Rk4qZ!@zyLQ zy&6t|SaN>Gl2R-0sbsUvOU-?;ElB3Nfi=ei19wqh;(dI>E~)zB(i6qlOoXQBoW-bL zswdeY=zHKRQ_3-t&6jYt-uK z0zU91o!a_{UScq_DhOVHtcxr)CS=r@ivQDoau^RKs$N0#HgkHFyRd$4 zu`IgqVC1v%m-8j_DeBUDb(_4o#?PFev^AyaMM6#|U&~=PEw`4N%;uoKG+lE8wHF!g zev8$IaG7ht#!K2SmGNMxIn`a#1$sMiIE^D9W>JV3`gh-YDUFkKv-~oQ+-G$vU-iId4XjI=6Tq0(|jd=0#~A-yAaf4 zi7^Q;9{rj&x^ec+p7Uo-m@sa3L_%ZOdjVwVGgtr*>7WEJ-##0FX};nr6v-W8*vZw7 z41}aWn)a?>sa$gpKJ>2UKyn#=_XxbwJt7und0(TL&iZjpGO{>!a5kS!V`c*;@S{ID zLS#bR7vU$4zv#^im>det?h;xo4N;-m^@UAP-2FA`rq6F;T}YkdLiA2sOEckdZ-cfHp8H@%Xg;8@6xy7sD$J|fs;UyBnvLZ`~p z#j+2IkmQPcc=6sOosFzSAb&%71z&^=KSSQEGHcfPpynIoTSYn9-JMsz#6DxN(ODUc ztD3WE`Y$=BlW`2Ia0i0&!Gu_llP)!m&gjL6_Wd<$d_fSFr%3!kck$f)skBm%DQUvg z@}QXTB;D#gLtu9BX_U9S+I*|{{63T7#jY9YLU)yG=w2Rm_O4F~tGQqpRey3a8IruC zr8#VWB-wj16I^FgjWk{!HJ(J-C|PtE^V=UaC&}asPiYw{>hF5dxP#i3V&B(GZPvMM zxw{KnYeBBw<0dqFrA$fK2SvLh?V&0MG2lIx0=1D-#j4s%(Kf@7mn}O&Y$zFW?Mhd_%YXCpuwJykVB7{ zRj~6fFo;9$O(~*1Res~nM1^=0jo<%E)mEcB^K_iI~DO$}RD$*NE zkZ$h^q<@7BxDlK#`?m6h{BEVlpQ!^0)FC=va7&^d$qKT_$$tFSScF0K4`gHOTr>k-I+hXD^KitmJ%NXrrVht_WcQ=K|Q2Hxj2HH^dc8Yz~9PeZp2AYk($i|#= zFtq8Zao+di73L%9n2;tQ1V2RwQz}C0p?oZP?uS$ z$#~De^U%b18Q;MtjX>^Kr`@mdq^zOCbf@>|vKL`(G~!bwC=zPU`RjOI*Hog)iHACp zhgG5cA1Y|FB6=oi7jsg9;~Qo02{@Qq#!N0SdHvU>`ZF91Y*hOC3PwB~KN>Mh4-x^wt z&Iu(WUdn%?KO{Xg9X^v^hi1Oc(aZU!w=$(OeN17k_u-Tv&tmb~-WiZ{NjISJYE4jX zSX8lhkvMDda>?L++l&+2PvO)7@1(Bw(teG2AOh5Yb>rb_HbU;pG6r&nnMIBX$#k7IzIAAHXu6Bp3hhmtYCg3k zFG|@X;MBc>qQ>8ug^P}>qlT7D=sfVD9D_pJ#8mXePf#G%d!vl6rHmYOw=8g-e}lK1 z6J!{7d)?&2ObFPMxQtyRi^V@F%hQU*rjs>J<_k&UzFY}`+=Ng6Ge8skr!%ghhKrXZ z!6wpxIMJ^J>DJ!b6Qh(6CPu$kG4-yV2-#;o-G-AwR4wXGr1(cZwuOiKNV@MfQ4&9- zkVk$9(i-Wl2!3yZ`%|~JVxrJ2BqvFN?F61CrROlU%erG$jA?O@`o%@IS$S8aO#urs zfrv(wB>uoWD1h&?u(J8(BmZ6_LK5nM`NVjhUc&Nu%bJ_B1=>2m@en8UxXt+`Go+;v zYLpdf!2*8!0NP_`Fqt3%ISYxXiHN5>1=X70G>}JE5wD!+l&N2ofb`VO6C~4sK3QYS zPqN^_QD~(waO?IWSv1yCV&R*4Eg+ukTQsolXJ#+0qrr5%t;}*=$SUDDFd($VHz)5| zw&y#SY)b=Wt>M;IUIN zr(Wv1*G=o7ftZ(~jwpErDZi`7V8MF>Q>B6J^pCQEa)km#nHf)5<%>+EQpdS2Yqf=- zKpArR9_78J(Zh&GKEF?H`nQ1k=(Prc4u?yff5P^p#m)BgTK<&5Kf&YcT?5_#UMv31 z3^BkRqa%juD|h9zb`-JJwzbfDdobl{CX?3^)In(udq8{63`uE_7pAExXZ&ntD|ulp z9G+0WAIJ-=^ghbzt9>9DRo?xd35fjYTh{`t9Roz4i_ zhS~qMmYM^zCRg?J>+U91Sp*G&dw*APDX!tjN|Jef1&~NKjhQ)s`T%e-1D2^epJ6*6 z#e`*C%@430$;Xk1d0nRu8JcWgP{F3o9OG;+Wa7{(_$8fi@%#i_&J4fi(*v{pu+uYU z1!H937P$Xxf|CX*an_PpU}UbpLAUknvR+j|Q?Gw#K2L+|-QQ+D&-62LzRJFv-P$1j zx`2*4s=lrl&QGOBxc8OYSB7U2@T%{4ABK2Iqd5yh2l509YOj6LQ9qaEmaLkjegeL# zDgL&)`Z0%e+|@$g?ffDA{x?B1_gFI#kNrDbPp@!)u0P?1Mqilea-En@bkUhkJiak+ zj1Wm;xUwz1l#HFoU8ZyAQ!5V%G_bI0WBnH#9Uc#9M=YX#&{HUzk@f6H&G4PHXDsEU z#798Dq;9 z9vgS8-Cl& z#jn{*CaTED1!n8Y`RlLuq0>=fJmWy>aHJ4zvq3U;rtXdRfKNZCeVwP1jB@iTs-mV! zt-YZ zV-?`pfd2tdDMP6_qvd_@W{=od>#RPb?U@9vw-}kUy0R3OPV~90uFYy-^&l_nzJ)*T zn=9u}gcbAUla-SrJw z2U22AO+Q;Gk!%e*ce|GBZ(q5au`FIn?C#vo{#pN3$|K3%l7HLsz}1YCVJR*n%niO< zZ<{&Xom3ldJEWSYTORFe+#>0}r_}+CFr9SpRumvGEv)7{!4QS^+|?U=b!f5W#9wOjW|3!{-3V#1r2PWPq~unCfIel=*x2ELEMj?Zl>#3_Vi3Y1 z!?9O94WBc|DTzaaU6EtSgt+&irdy4jYavd`_P4{SU&wg>#Vj$$^WL;CcSIaYO!b?= z1kyk{Y}E>$CrRz)xly;tyVo0B*WmejeavTQ6?-dH^vFOS@8_m?9?|_?6=$z~s@KPQ z`rT3z#l<*Qhmp738hCFE23Ob!QU+u(~yjFTRcVvBEHV@m|l>&-7}2j4$roo&9&zGg!_H|EO6kFl?4(Wz7xy^yv4Yx*;r5H~A zJK{n$UGcQLvc66CGD9u*v(`YAEI6OdL55mR7z7L~WV#|#;dw8zFGDT53EDi#$9BGT`UyUQ$^vd1wv^(%q`;~j6l7tUmgRXw`n?JVS zJL__7#DY@OE7G}vZrF(+8Q?&NON0hBi8PAdw$A!p)pKm>bn?!dCA zz#thrY2E458HsTwM3gX}YMp`C;swdRZ4-ELwo3Q$v)H8{(OEtSVJ{9lKfVNH<~2vw zs0L<{j*g@Gs~!fx)Jd^o_r$p{|cC)_ zkcCi)-r=Ct%<#k^w19=+lj0W`2pbBQhu?Oq5>O1)Vlk$Gd@x?$wDuvL_T0&Xyg^sdK`#mUBhMH&AB0B1Wez8rhb{Ey zp8~O*bt~2AQ|Qmp)p37`b>VCHykKetGb(?Km!bG&Mw*zxTJs|CeiP9Kz{FO#(xg72z#LXv9gvg-dP&qAb`dVaL zE=tL!ew^YM(E`RSk$`sT*#g>DEX!TqM;me|4kz>0-?*p+kv@;yd-7CY@UJF=pGcjf z00rVWtSbHEjvFMIXGFO*Q;7NQC3+0%8d{kx0yvXeGuHl!MOp0Hq6>KjIdWMsyay`P zH`$818=MK_Z%f8c6-vhdH)YeNmfGa2GhzhrtvS3UVcRcD9}D)D-gSHX)@&IDjEe{L z?QGn&>Twox_dU+mjG@w3l8bijR*)6=yp;eBtO1}emBqxG`T z02mSiWmqE`HwSIurG?b)YnNmDeep*rQOiSpoHtxA)|eRB`@cNm?ggWb!L1B>d?*NA zHt|vRXLchkV)>xzOup$cO2Bil#0C%?#WTX-d%BXX!JPJ|CSiM)Qzg7S2XPqlZm#~~ zN^`FEbrYax9Fj3QD_Xq@=V|dx>srjqPy0Bd$p-gs2SrF(&b1pmPO!>#iDU{;>KcTaY0%$FDdGf($fyO~&^xS69DHF+ zj{JSx+dFQu^`S-bJe{AePI{}7hhf}zQZ+zI_M^&XpTVtz4))D7)1lA;{r8s^IXVMb z#YaYD%5d0ZcamQzGPeMu>)+!0$vSlsJMRmqJbvqJ(dfCVel4(aJ@lo$(&(6h5><32 zqQm=oOsGF>vZc)BXS*YLn`fmc0HF$A4N7k4i7h#Dewdl!Q(M9q-r(r#atVc@k5`Dm zT>JD%hz$1j=_X%wOS*uZkHD;I{S-d20ZIB#RTI!l`MEk5gI_F1<^k#X7DUwC_zmMN zT^oJt2;wnKe}Af#*8IrE#+9NK$En1p+>9;oeeDdOtnfm8$-63bUvui$&YjG^KdN!Y zXV)s96ol>k$xT56A9sjU$Wa>W;vT7@i3#MEHqtl@z}lW}qW_E$e78O+A)#F74;-t& zX_STLmh;AE`u^oj%J?n+CSzQ7YvLUB`mw`4@kP_LmRPWVo^D z=Okjj+W4>Ro9c2NO}|0ZcHmrcHW7xE=2K>hbiAK|Igu>jma@85cUkK!vuat(9GVJJ z44p)g@O~d;1<}%Ivl2WNNt%VTwA3iVd0MLh1x1w z{m$(0H{~|&9mDkrp4hJ?}rzGtJ`SVW5p1bYAxS3lQYUS`^sMfw@PZ&vF4*gY`jHr4}6_p z*3@GNqopHuDZm()*lB;eOQf1!%hv_KV(OUl(vsrdiGl7qsN2xg@@v}Fp7Hcr(O@<^ zid%viGHj|BY1C|5`Av+UM0 ziI0h5&g59SbzwES3S7}2OGv?*IroOA*EHJa4>a@@Fc4q+Bmf)4VTniw@QW6-;?K6& za2&ZT?ScIXE{Wm_ftydeUeO6AdQ~UG3+ApfB>dB0FWMMDOd$17^7APHj|XXGMO*KOfY6qx33ynwZ2z-$AUCVShejMSVIGlknW+5=cjzGP)5n z!}`S7ORXNqqDEyi`*#2~hv=;QHuTLI7puA`c{6~i*NaHp^f#9jNW^kIDqGd)Np)Nm zzJm&8t19^2;;07Y%=&#nY5IFGcoTc%q6E-qjOq(r^;WQ=sd{LBRN#~ziulUa16=$i zj=PS+lEX-qyVEB+<|-hQhGMKs+V&0~gHuQ~61o&Uq5jV?Cy!~SGtYhqmeDY}Yd$5olIjQ4DA=jWHJ~W+*4Jlx7LV&J^*> zuZqiDJmPLIGlqA@_C^v?Xq!FTx~w`NMOSzonp1Ucv?SVf_DLWWk;k-meqDu}ck>^$ zIC<7zMWMc$6v)&N3V;gE}@_FMls{xf9M%IBlV@3KL3v zKuGkv{}n`r-9KJ!2nxRc8dvT?vdT5H8bLAw{h{N6(f6YUss8i^AVnlb^@S7GU0ibZ zv6-diU~~YUck#F(8k0`pO9bXY`pui&zUtWT>%MzOQ(8mhFOfA3Pxg7ZTN_f#8{!>v z&j~vp;OxVXl){$FJZ;52#pf}GU}?OE@2o8o$A>SXmbWp%&dZ+YD#+`}^6^a0UFHt>=u5QgAm2mzW#PokK%rk%X8fGUsQsOsLdiDs6UBmI5ir4w0y%`R!@; z+OM?awYMCIqjyWcS5jbunIq8mmQGN?lOO>@hvLuFg)8Hr$2{Vs;kv@Y^F|YXueN*s zO9~>(UM%FYFOUi|(?51wWI}2^}pk1?VAfh8j=>=&wKV5DKQx=mm>;dU<^Q<+vdhlNoyIE^sTL`wj zV3*%WH}imJRW=M_Gb`2KKA%8vIf?;vI2M5we9}NW#fqAB!wJsv# zjEW+l6X=acTSQlmED4VQO-NK_W%r!01QE~MQ|RuCdW3iJg18g#QuMD2sVKnMLqir? zZ;pKubGmqu$*mde4H#m4)${0aindF3*{hrjJ3V)uNNx-9;i?|$u5ALc47g<$I@ zd)}cN@(8UNO$1?V)6u!7qY?V{;T-B!${M~l-~&7g`+~ki4Byd3l?L^V7{*hV?s#$L z@t8Qu1Dbm=+ics31ksi7Yz}83N{-%?N`PQ9__`yzwYMK9+(oG@A{WDgC@PbCy3&O%i$E}8)WQfrKAs^Yi{c!)CV^Cdhq|Fat)!pU@^>7wY2TA~iX~ZtQec+` zcne0bs`8ltrdB0JBp>T(cVp_{7#LMh+weqkayoEBu5u-W7;GJOy+`gNI_yhuU;MeY zVhD$&Y$SUihCgaS>@_?*@4=+Y%yZT$e(q7IRXdiS+C@)pCu@WiDD>>)tR|5sM*0CS z{1whM@Av!Xcj5jR^oBa$bYNN?Ov}%^8kHq4t!sNR=k^8Ec~wn7V*Y z(}&53^MOoxLpDp>thv|<99nv$VKmhBipL-X!S2UqSBN zy^S)qiO2@x1S|vtt#*ExhQsBCGcQ(iqYj^gViY*M_9} zqgdq6&gQVR+Bec8R*(lJ&mSKe`fD@+o2r8u!a}zXgZP>;#~NxO30sZX4DUD(M{8H6 ztUG-xEC+$qp-J;J79K9o7LrB@`vW%y%x4+8@ifzSqKE-IB9#cSJ1oLIgBA>VoA#f> zd_7Pac1{U2Vqw&;7+L}F8u@9lm&uTwA*%nd1T8DJ42;#HpH!U0sPJ=d`skX+N_BYk zGAFIOY>2OtR7IBTyj|_eEbe`X;bC4#5Pt&Pw)!_FkjcWFP$)^?a_B`|6c6!9D2XMGbsdxg_f`GIux(7dL2F(6=YO9x;xN@=lA~* z_r^Q62eTo`&{}y3GuLUAy2K;c$T!tcIX&1i={fSGA(Ht)1eOmea6Spf43)P(@rk}( ziGbG#*j5+qhtz*CH2G7J^)O#5KaR-%kaiE=JpQJ3ep=1NV^gR~#bci-=RTQm*Ayt+JMvQZ z!y=b`*|PUbmHCUGGGFw8P*Tgbb)mYQnnwAAy}t%W!(4TfwAs4mHIo} z&8l1J<9&jF{Ze$n&j7)tZ1EP^wq>>-I*lw_6;7p+N@JZ~?t;$Su;)QadCEO^YFR!3 z+Ps19g@jpI@P+_)?yNd(k0iH(2UwH2ju@xK9LCN-@ok&cM}}jQxwC2?BOa~fl6^@s z0eMNZs(&uWQfPA3)*$v>nozZrX|F42jDGig48_OX3rlmvXej*Utp4wso9#J1^E`R~ z0D|7M>qFt<;H!O)DIT;NI9qi$A0jqcbF_24i<^p0g(nN?iSkGy;*M7~~r||qxuH*L z9rV&@f0q$TXW%1PboG_>-C#)18ccNDE{_g*xbH7YKGjfo9vei&j6%m-lNm!kqc|Iw zfLnWEYdL|;KUG_+p(^aTph`Wz4H2VfsFQ0KR0b2$NZ}&bgZ&5N{e~mG6+hKt^V1QF zcC)^gbJD0?Hu6lCjCsaCr&b>(w9K&SWPJ75gir+cjV08#q!g@1M3Ow53z-%HLC|;5 zQ7^KypGbC^YhNKrN!PJe>jg+WBCs;ElDrEOiDv|qst8FLO<(QFRPqE zLp$`jX9yN8%@lK^c|QGIS)5yNyqmNPx+dE^QB!tv_~_~&0$R#N-be+O-wiF|{W6{# zJkW{D52yOnxPNqEQOHi#b@AYcKn>?&)?8m7pC(z>|MmR&(#h07T%zOrfDBgv?x)ZZ zE8;Xhoc(-JxXm}txtMs_EGl=^VYr=@>EjZ`oaG`PC!lCAE=~66qtB;0it#Pl03NuK@GyPmCI~wgiI|4 zM1^Mpc`<)VjMj?l9XI-TSbzc;YS-4!QmsB#ecS?Yt1Y1}(AI)XTFQFg%<`Q=KJoNY z@aulNjkt+w@58Kufp+WDqfYX$3y?6w(#g+5vGU{XC}f^YYNIJxYnRdsbmxB8+tW#T zf@S7Buz@xxEeBhzS+Z~(OUrw7p}O{%oem+cf3JbkR;H@P>HG^of|H6N!ggM>WL#0M29a8Uk}Nhgk|;l4>i)+*rR%%A5HuFqru1wfcBnOU{oe$Bn+kko8yU* zkMhq2fQUsGpBCxXYNp%%Uk|`>k%-)tz>4OHaY?xJ&u3_B?&w+8m>6ws=mZW(n0PYQ zi*$#5J&KA~QZ&td-|GHdn8g_(8yhc{55c@({&4}AfLe>K&R{%swV_UfcEhI5X*n6m z*V@C4s(U?z*MFU{3=0=fbaJr+Hj5W}WQ9@PSZ4hT z@chgYTJ6w_QTNBc;(^KlnnnJGPx??T$!(+=K^VER_ zyB7K#Z39d#qef1)wCP)G1W#i|m!1H(HaC#kBje8lTd}~a)vttXCPL;i_`-aym#!Pb zHA9J6^+`^tywS;9IyqoqK%TKz(3kb;w}e860{PLR}l&oGFp|(XPy~9QE1X8x-~`OVw{t zJ_V`ef0l(N2vwGy>waFKbrJ2W`Xqhbem205!Bmr2O~WX;6?V9ypNtF)-4l8c2T-LN z0<@XKYyua7)IK{+Ra$ol8Nf8^EO&~W@3Bh7qeh(XBfb~OoCh(^yjP06VXSa~j|e*h z2az6(P^AUyO;QAza5{vjCR-l+ro-dw?kpTF z9d~5)=>A+SlX7#xuD+P``0J#S{zSz_?B)$f#lXf}dMvtJOP(>;1dT}NF}U?^u8w5f79Mux{akih<>b07z8qS(UQ zc|Z$o!v2y}gk$GaO_(&TpSyk}h#$O{#&%@eT&LBB0#H-1sSYdrtDDNR&)soAomjnp zo8ZoO1^-5jSYEwEaq;HjC^_sGUTn^W_^11N+i<0uC9teuUa&bm-x?_ZW5i(zlhpRs zL<-n=_^Dlk&;Hu}_S)$U?5_W++xD-QeIvkY^xLw@jJr5KxMzUh3*n|GXb+hFec)!s zFy4~()S-XD&4S4BufMvg!=#m;K)|hW3W^SYp3;xP8(?xWxfTQx=31?#s$#RCFp8?SP^ z$cz8t@&qN-^CM@|4bt>_f_c*C7`GWR)Qqgs$egurNp|1Iz=pth5v`>p9(yfInCrZ~ zuv3iW=!?IyfejquuGSsHy@vR`8xVcv#h)F8S9AV8Y(4(ry0D&(o)l#1;{tO3JVN{( z6b#w4x_#^aBQbp``Xz4!)F+CZ=`xvd=ozfl(3M?>Q)KuHFZ_{xO_$RY(Q)FN>x9E; zYw>)1^$@|SnKC&<6l(mQzTNn}ks^Hf0DWRd0_9MblWIL$(3DHMZ0z;mqlLM2FIs;l zz|6D*V09&i!?75SW$XSgSbW)GTNAERvHMdgqiiyMl-ke$KGsZ}5GW;p@foD9VBqC9 zsmblbm3&<{5ie0hugUHc~bjzxV1e^sEoW#e1-2rw>b<`kXIkS%sJ}b1^ zziJ;DXkcvd9~Vm#i&n+m`E4NIWo}l&=FRLj^{Au^QJRyze&nJ)RyK=o*~!qGURxoB z3Ad29&ERlJeymGLs;}V7kI^ehckl-1tGqPuH(H5}y}1@qm%^iBggcxyDOqys@Aan;sOAGEFU}hE~Jf^x%78RN(n|{B8wsotOM(~7&o90e^D`<`MkdM z@X~5}Ptb+!0P)5O1*0XdWn-Ek%?h)(|t(UJe#DBi?@5ToR5n! zJ)Wn4!B-HC!e4nKkhxf7wW4>A$`)qyFYf13BSsyt{lr?ysfHZ6gn6$~6>qhe-kP#Q zRF@vZMNlP3-UwOrrn1F;c;0B!&{YIv8@VC$%XRg4j?rL&kPhY#D_r=vJZCD6lqO6M z`l}a6eU&@{E2p1B+F^?&VB@av9k+ z18_-=BD+r0sYVOk_bI|$e!K?q;o$HqiCn&Y17KfG;XFR+T#79aZv{zp)ZQ!@;3vJBG`J|W#B7lWfZf(Ltvt_D~;_8^6>FFmvz z-p{99AF(e!FD#=HQuZKKO@~%@3IFYP->ZMB{mURZdwc6Y7e)0M>^v-xSV>5`V=#cy ztDUg5=8X58m2-M;-=j~zW}T=VTKCG+XipPBwxbp1Af!<xs>C{C?Ou&>uyn1wrQdYXYqCm$d`Bc`2B5gAc6<@F`~LOurAEJ?HDt z>_mVGoFa555PXbDraBHx_qbbtw~{W3mtut*L3oCW5qQ>(RzT60cn4m!I?;9weDO>=T)joc z&EBJkt*A%_!a+<@tQs0E7qFgIYENc3!p(uxS=lu$=bCN=h8eDney6oH+YazYP58m% z0o6>T);PBzTm3}H++PFscj_9=676=Y^;YdlFbVO^cZXK%dGef|n#(#Z&e7h2aX?GP z+Y@_)w12b*mu1gQa-tsfWEas!(IhT^=K}<#IFW`LXoCL5Zy5m+0O4sF-HI7Zw{xq{ zzG?^NAcJ8Wb3cL3<-R4lVb*lEcL91gRD?LxR0LCP_WDsd@h5pN{0BAHc3s-PKmTd@ z+&~1Sozo}2(7H{oiLet1cYpd{*>??AXDT3LUEw8P#pyRPqaU zD_o@+pFOphE6t;v<8?%r1uYs&k7hN>eq$5>+4mwsw(TU{jl_TV+vZcB4(gCBA^ zc}9wfHRg@DG_^{HQVv{pN1{ev01rYh1~ijoq)Woc%X_y@doy`BT(r*d+ICAd6l6h4 zBHj8ST!_N0`FeG3HO>5y4Ov_Qgju#SeI={!*ETnZb^YST&0Oftg&;x^04 z{9Xy#3DTtk1IwIluUp0&+>1HdY59>O;O(LP%-I#7aZ4OHJRcX>LShff;zC0%6{jH= z@rgE}Be`MhiUllC+hh;;#4>clSRmT&GL5)UmpMjdgw@sm+YfoWAwDi7%%)^ACqx?- z8ajh1t&Z=*iB^9*p0 zR$g4pf^z~iHH{(5uq+gR7M)QSgm_oTAGEJ9Y@aw+ccetaoQzZD`scaYJV)4a!5w)}e)X z>%!VJJJQ1K_jurMHz#7uB=u2KlH(}cOR5csGF2-RASgxUZ_3QrhrzoiS5}fdOtS4R z?J&Mi7v&I5b6ew|TBg@$Cr!k0M+o*Y2uxVltoF~g0v{=+ITf_QS;ZnIYk7BdRHB_!$$P*KrRS$@3Un3^nd0#MBbSBDf z_By{i6}he$G30F?7(2S_Ik%eCVgFV?6E^;Bu$Ah%QHNLcgaJI|gn=ZBjr$4hAadzS z7BA;-BQwFr#Su z(I=t`u~lqdUNj$vZVZ3{lprh4I5>7oz<{QQG|qh*Jdlr`;}h6;a$fOtg74g^LfJw6EPT^C-08 zEeXMn#LG3=W@ng5Krv4T9?}cH=2-FP?tXbT9!?HlV4(+GEYyQegJ*&&G@V8RjApM# zz^P$vp*_;sP_8&%KH;XgVB}@0z;;ndRH3i<@ZfSO{<=0Nil^8j);f!Y#|g9U#u;2> z3;Dw;GiBn-rWmFIb#X}z8O6!YK>$UKn}_(|pF>bhD$eM`64Oz{e(`PMB=9wam2o)7 zn$3XMi{8FDemHeg;e)`uCs?e%IrS!mU|WV|rn_+O&3P1gw;WntIg1j#Qq@~PDgKHu z>YATJ5fAlxWP8rzm9J!b6+!QAx3TDB?Peki|_RvIB~CaIo^5VieC#5MlU{JE%A&hc1gqE`)* zO_G<#(r&oizFJSXp3j74Ys;q>h4j?wEh#5()IcyMLNu?UD`Tg8b%xriiFLoWTz1hx zS8`PKfnbI@jui_(q|cVjG-wFpz1IhHl2_wy{hCqm0)9G>UQ!pw$6L}md_Vp^iDX1> zppCH|)~qUc_3MLrwhOEwDgiTD(sMg$74J+GU4+L#%ipWv3F%T(o(|UUW5rYvo2=TZ zpBtLB&Bn{kEOY(B+UbuE)l8dnnRW9FhE~b;L?PF^W&mq+1f^=$l2+vD_+E$lXGDmJ z^N8&mgJMiS3>9^1-&R)lT4NT?X%pSGgDlloh1Yi@6$Dui*Gpx3_vn4PaDJsTfx5@E ztn|W}?5%E1IGu0|%_A&tr|0Y*MT1K&7|_4ETd6%cdRWV=zqGR$G1}8kYfmu5$1lLz zV`(Qw(>nL8M>5jS>*U{@I$N z zax%?qIxe&+2|T#^j9U`uWV?M-7P_u$%RiFnQNK*^9QF?fvU4w}js0VyKs@_J6b#}q z^82n8jDGnv^vm36S$7(e_4e%fN`Pb>Xx&;8hK$xM<2e@PuSlgBq+pP(IkIh95o~kJ zq^`L7v0`a>H6TPvb~5TOiKH1F;g+}6QoEE<4_u_sUSL>qzGu6MxpO1F$lbT#)xK7~ zhr1!_vKgc)_vn+OWFz$3BP})C=VM(D8ruweUpuUsX|+POV}rE`kJ;O61xeb>usXiHkKdhen|}|>86kRgLOvky{j*Qj)Pm$Rv6^pmt~n>6V*44y^*E}_{$TS##S96V zpRdp9(qhJO9D&K6X~&!|*uPVe zx_{_?lQ3M;n^*_J`QTk2*xj5D8kqU)cKQ@wB`IXip?6pis#`ksA8EkkZ<0=M%Gv&O zQ?v1KkMZwn@r<;Id1*`aG@SGGU%@(LED?JTAXiiP;XklrezVg&Nnt^xks%?Nkm)Lah?y6PZ?~vAd4|wC$kSD|5 z{+Z^}rR<`tVNLoRH%9yJZd(Vw{p{HV{pg8gNzdZ{xMCnWCW$-Y@uj_kS39`PK#k~z zyBuMYF}hI(a@jw&uOvBWEu&1ED{mUHmQ^QabIpFn8iF)M^v1OnnfICbJ*$KD$4fFc*CoXAI<&D12@ z-Icw?COacS%$WFN$}M%PYtSp6Sfo32}42-@3?@>5^>0SGO% z1R2vk8uQSHb*EYHKD9>ci)IhZAA-^4pMqj~xx(S^ykCOJMWMN4nhhe8I7z=9UT6t))Ry>`sMs(VQx6a$$Udg%LLZ$xG;@CX zKNO+zW#~s>!D+d2%dN7-DlM%@~>D43UH(k zIpUWUzsD~ngi>uoQTkNP-W5sZ2V$b?3)2JBsN@i5a*0?HJf?|a2B|wIpQ=wSFOjB& zW?0UF41$LR(uwsim$2OWNq!HpE^SF`sPD#pxk5*fs<{D8G%=+Ojtl9|;?szZjG8jC zo1)MGN?70E(JPT|E_ReF#XV`5Rwmbo#{H%-!dgUWks4GcT{cRZ5g5HQb$;#|;QHL} zbcX^7DC#6;9*y4K*VV^*&(3(JBpy=}SUqS>TGsqRA;-bQyZ%yT=}5b}^o2fx=-d^N z`LBX!MSZ|wGe8Rb#84hh94Y^SIWRKh_D;LYM=%QGD0*5|7x501Dy%}`x6Z0d;QC){ zxLsZ6MpI)xb?%8k&uUi^E2LYca|j2KCkAihE2SsXQ#}})uUECFVO|VAF46hq=4z_P z6NVF0Y(@Qx>u=*CxX7{ee;^|YlWW|r_sO;N0vJNn3JPN+RDV)3#}RwJ#kibb+6eXe z15(s;Evc@4%#Ksk2r0Emq|yI&0t7n)f|V0yOpsGdkkLS6zt;yPUf+i>MX%6{D{Mbs zdZG?BA&xa6#M=2^>4Hi6kSxFY8?dDB`%IWp!uc3qO;<6ezFl<9MaPV(z6Z~g<#gDu z2wE-`c@-cac`@t3l`}74M3F+(_DB=Hv{fg5L{XlwhlkF9==E#ciYcLq^t)s*k@wkY zIu2$fciv5o>tFvwLRc-WZed54bfBx3_uxqlTzHDJEHdx3c$Rt)RI-5kpLhMgOJJ4R zbY%twc_{&U-hEn^TFO%0VB?1&k0T&);kyG$5cW1qU_A426hGyN;8m08_@BkCUi&6{ zn(cmH@RZMrBsU>>Oi5mc6h*Yz7&oebI53wD_0M6jsN^7%m?OwSt9j65<}F2^o!2TVT@p_}+s2S!KFn6sZQ^Ae|kh z=DMAnT*zn9aYaKm3P?95Z_YJyZ&J86m!_FR+({j@>oqc9x}v={H9$s|#O8tnCr4nA z`QxRPf($*h43x>i(UA^gIH1^aY&pwbOYP8h{SAD`p$mb{p{uZ9V~4#QS$8(%)XCbj z^|DLo8~n;}MzezulJO;Clbb`aF&G*}(cle_Bj*RgKUASbpDNyry~9&u9w>k1M4r4KXs|!VUS$6{P+SoN-qX;fHE8 zP3qa&Ui(ASB%1uEb?5$u|8q5Yi#v&6C?>qITf(bt(c;^MaeQ*0QEOD1Fnm=2vOcV^ zdIBiQVMQ3(xuyvl>o3wnGAod5ODWPLJQ`i7e}9SS@I=_yn zu~6SAj?PBF3(2)$@#gl?D&7$PEVX(F&zK|P@lFuwW*`?fX9)dDXX6!Vc zNcWkZE_RCXi6VSwcrJS!DF3C#mTHFVH0Ru;4fObe&JjEUoYEL|Zv7f!)-n~miNW%^=lY{SxN?QTa5Zr7I5y7U}Nm15&?~_QJkM4ZSy>C_~xjFTcp!7kPDLGFzJ4P)# zsP`@>W~5Lufs(@HGP%f=@T9TuWNzp;H=x`HlL<4rUU&8H4RpT=v?M;t(?}}`dF%01 zs7s?#81!a}!oun)!=4(yG4D(Z2$^75R58SgPI&b*W>-@-Nxhq`+@)iE0jrfX^ZJgG z;>U<5n7bJ_P}t$ZT`_*Rk~f4j%I#6ZU{+2S&~o7>nCQteOT_d}aMdkPh3WNb6@{yz zXG(_+{|qlFp^=Jua6O<19t2oB>T>P=avUDj1w@Od$pzzV467AwZ8%?!{Y<_S2+s&@ z5%K24F-GBrMqr9MgIL-29u+2={bhd#$kPzYJUGsM`06&99hk+PMEbiN-RySeBrzg7 zG%dD@bW*Oqk~7O&RmnMpbH}I}j}Q0vDaP;TA3u1!D3v0jeh)`!rQ0A7aB}M2onqPV+J0?3zP?m6|a_+gwIM<8SXAVOpRcuC0E@K++X1wC4ak#qwM;O zprhJaji8NIF44JS(BZ#?m4U$VB`ZA=unmA2NGg zG^QlS9O#t5cBEtq2@5%d@#0AzZ1=pk=^o+U$03@(U}Au}xabe-#8^{fBSPhCo_&6PwORoId;B9Y2un7jUrDOz{#IA5f5x{MGZ`L~8Tm(`je%Abw;1_azlBXA~LA}7RT zLw{6z4nq}E{~jzhiJpgnY|h}tHtx$wOwW1^EkH$G0x>lc8M!T5DK_LB3U)9x2@1`p z8Yk?)F}-$P6$&A5zc2MuZ%ix{)9RqzLExxk^sjX$Y+Qjs!I z-2xAV8pokUk{~54J!D=~0N*U7F)mVZ_JP6V(ws3Z8nDg=_%7p>_+y~rj_nVw$^1OQ zUnra{m)QgR+q;oM?)1h@dL__8We4vv!Dja2F5XvUQ?B|?=lh3rTaGH1hsw*l)DA_D;i0N442X1f@0^?- z>V#ZxbkaY;(DL~7uE3(0ZJVh-aK}=K_28{2Wi~q7x=3KGh((@d?cG~q2yjY|_N=-T zQ3BypC6Kxl5pgb=B_=gbCcH?P{boR|h<#=zT?)Gs<_Qm0`BMS+5MBOccpB8so(O9| z@L-9gG(CPGQ7%Kgr$tT-#E`G^nf4I0YaFSw4F;xp4^A3d;YzawWT^WbKBdn>@Vj z$o|SN?7Eo8$*F(prFCDE>A!=+cWKSRZK0R$%ODwO!ozR{vr}h>tmJmVlSh_sAQDB8 z#9wE;;PJF=kf4Hl<8WsU6ONg( z$wFC&DdLc`RrN|Z(l<*Mz-%q$;isim1OW;zD3#MZ>|~hYUMMTSDZ$D4r3heaS^vUF z*p&bJO)ex=V=$5eYQ@%F$x1aLZ{R_Y(ky0XshCwNG@qv*4p~YACk+#qW<-I_pVIlR zxB=aU%Z(-yVSJ{juM%LgltE7b%M9HsCZxSE^n{WEuJ?C1crwY&=t;uqV!)qp=)yF~ z&8|R%%Q^><9DlTwP{_L(ggfOoH#~lHp@%P%UI>G|*e>fyhS1P89k|BXX;}R5Az6qa@(b zRjbMtS=i8+$0#CRSNHu{xBRA$0qnwW@eegtRQu7FBbFS`$=}5=RWfOS7cdjZE2e}A zg&LG_+Y;o)q~gvA@rSh42Uk)F^fPhgS!=BJOEC^-+cWX3Lfk^@tf!BBP@l9I7n?tA zub8Ji-RK2FH7ttf3iY$#E_B^aFNUZp{!mRCt#V8Dsoy_uzC$6N0@b9|&XTf$x;Bd(Jey{Uj>vTjrL9k@mIUTEeHBFt zuo~$*cFvAEnt|0kkmC>Q3=I$~oe-;pE(mh%YzwSlQyu7=h*0a)nzu4+vSH6)EN?MU z|7;A^|6%Sbvgg zEFPS$gS=)bLUz$ON=Q4`Kup_Cv@&Jf=LHFeQ0RgH7Rj;%KSyBb66siO0|bNAzXA$l zV5wuA@7wdjTr5^rlKNb%Z^u367-KNFfF)3ujH!t|LPONoNrc*%N{l^GnJkq?w=I;_ zwdV23`!VW=W8jE_(k7r|AB`!805Ay_JJZfLRHreAt;jgXGOl?kvd-55H2$S_w?rkcN|GKGVKH!Sl|>bL&mXkXk?X& z62MP-qLzS7(w>qb60f9yFT)F!lT4P1@RVTyr-*fB84E{Mu}0Wc#xLV6%i#l6mi4gv z9X@|+hX#vTT9jmezIjrLkzoE!|GAbgvtx1oBUi{$Zf$=SE@{ips)0!W|ZW>b* z@dkNWz<_OfwYVKx#)#52b6*8}%v%>rM?N1wQF2+QZ?$@R4&J82+GJFsRH?X)-4Y4+ zrgcerU%Lt^gTWYA>`$3TvH2Cf5IYKA80w&%-Q$36Uxditym}B9FyAe?UJ5( z4GH)bp*ZI8{lPgAHx>2Jp@YWIzMsfl^Rtaau_IPX4ID~Sd_-Nn2|cW?uwshULyfWNBZHpK zjm@wL%28#Lfcif0<%t^9eT8W%n|W#j_E+T|+v&`jzcosk6qs-oi%3^|HfRn21MZ5PM#x8*K zCN4s+iCI@wZjQZWPgYk?9%51m4wXtY7p@Kap%tgy-1Qu5hRdDZInbm@SkZRGW5(HJ zGHZdP=|3K#;yoGU6S5Ho)dhN5r2VuYff6`Fo6@2Qo;L77>x z58yZ?m-0qY@PT31`*~7TOu=-FUXO()xL~kA2bVhV!Ew0&IwF!znDz^}gyC!KiKG2HQiE&ad1xYjzo7Z4QCdT_YC{T$0Od6t z9@Va(%m6JjJ`8qtPdymrJ>;u)WDgM9CQ)Ufht6 zMew>H@3}p9GoHhijs$x&#G*xjgJbh55C6_3As)emGiZa;-6Y}zle}{i(p8r6; zxViW*@CorfU{$y>Q;JQkxBbJBbCOIPusm61i2v|q_5k_tZ$`}$q}_KvxuUqH^R*Qx z=MO(r;!kinj~C+!G$eVlywy#z8}zLt6l6E%wHM=!t+!9lx?N$QRq}4TANM|uS(xKT zBa}_BC64KAfpN9=jY``kQ5)}MY>hNoB~h?asB$Yqp@sP~yHw>9rVnjLceA`6KaGxS zROMCOS@wo?k`>;M!=ZvEyfuHkXIDp1Toz7vQ|XkE`qsFvh^TGSb#-$tls=ede2Yw) zHj?gAbyWQ}kzGJB6y!-(x?>-j?J9hHFcqUXH5z3PD=2ulSE{Fjarns2pwl2n*wn!} zX-)(s>ANU#A%ibCJAE zt<2=>I9bFhz)g7mLUGy}7~wK)ltp;Dt?jw5~V$NBaR%R7Qw^OXlwvRgGg|@}_LS9v7h7}Tg9G2MFc;ZSeBUQ;f= zkpo>7_6{UFzXe9hGcpVU))hNezZa}VStmakqvT@1y zJ3eYw>1c$U-k&%?qn&Xe#2p+CP`=?l7sy#pyp0aelID~KUV-dMPnGk)#%u-^S<*ZP z`RJ6PswCB}Z)lmzhP&?}v8ZeyU!X$mG|cNv>0-ZJ=F**yG*w8c*k|e=Z6!&T3xu_5 zn2naW-c3$tofv!2Q`FnkkKOb!huc*Rc{0QPG>~=zg|mqzpvw!fmXwTS#Ax|N15(s* zcdn_uJLOtvKK6O?+aH=?4DBL&lTBO6QmWZ#;;@YoMb8eNT0F0eWCqezhZO@33yqtQ zz>HiHV=lK*rpH>=6LMkiX+Bu^r>7m4*{rX{4}X-qHa;($og#opJ}gVlLP-2pzW~B8 zjk+yQ0WD5vHru8K{a@M~wxEg$%CH@N?c63QD~;J`y-N6m7p!D{J>-vlGdLBnJEd^^ z6o@%uCtFDfenFXj-e*|l@Sp}_CCmP~1szdZAF~kWexc;oW$dt-F(Fz|A^hO3+ZM!> z^qV!S=H!hZ@_BLMBC*`j*+2LCU&g^gzA7=BrL}3UHzLO32QC|Z}<*_LDsJe^^6fXmREuL*@Q`gOB<5p5E8U?yx(xOh~J9v=TKf9h@0G^|n%WE5M)q zrJFiL|D@Dz$cM@6GqWVCHNApIl?JX-egN}+0gmhbcs5@m!Y-_{E}9X zdj+4rqP!}`txS0}WhoyWevDaKBuPs?Os)1O!gudE4gN}p=Sn&JRkYIl!my0>(39c6 zg0o)=(@)0ecOM6}gB>wD*p^X?m2U$x&PHG8oU981_j)VqNmq?WMb$cJz8&a%9S9ux z`zI`0zObJfQCb=J`CSuRzLaq;kEKJ`&*%K|82!`f-$=rLSJWJxsKh8Q6(7S%RlNOL zGxpi1H@oTz;ij(I=7eJaM+$Fl9n2lGho+!EB5prZnDncs!6KX2P-CxGw&lYn>s*5~4Ug&rh+@cg|E)#9mn5zh{xA(a;w^iT=7o=_45G*sZo8=nB(AB^eUW}z$y3p|7ra`N* z%`+x}*;u8M&BS64A*bhy#wMBQh`o5jH zg_^swvbVBv0G6E}5cA`#b|a@H!q*a~?be8rm!N3HJ=~r#H2GnF`8R2yty@xFy?r^0 z_&bM%yO<1qD?PgxlP%rnvqoG&7(%!*PMbM53iDYyooMzC8+d`3<@Yj=CReaT45g<2 z&)zXkp+F6XRN=sE{6bcf=2o=Ii|Q0CnxKm=d9vYT_hZ-ZsiMM5z9B zWLRIWxhWa7O0kE9-yu>uD@iS^?vFnc+NsN-e9&C@F0?G8a}wAd_+P_r|V_5QN$%OK##`X3%dFj zqQP&X=%F-HbL!-G_TW7)VRt2zI6UYFK>eZ%+%oO+USt#|TrjsQMAQ_y$$VzDW!cgSeX_}~NGFR=PU|x#& z)F-FWv&9Yw*!jY66qtT7{FOGxFlnOt+e*uptXye-Orhc;nJUH8DrGemZI5K}Z#bJ% zMnO5vIbnL_dWm`@rhZ^rTJ5DUPt}Y=iX4}g+AQK2^QF|!Yxby2#|r6Y;Z&!E>n{wA z-u5`haGzY2T@T%~waty#gTkejM|f~2BJ9O7P8{}t*w8gnNG>$oN)brA6%M)9#`gNfMkyEV`}f}=_to{r)^D;+FN+fH}jyqU*@ zg4;w5X9S~m2l;rjp^`2}oql*!aC{xacB=1b zDePZbI{WJ*wSdSx>k@Q!QZ6B+w#eE8#+=!ZSaD?WOLH5S zlIhqxU32*wMI>lBI&8tMT|b#s0I7TzTc-F5&D3WI0Z`t(qi(9wq8!*ik!iZ zI(o4Mmra&cAhACwNsJm!t~iq_B*&zKAf&L4v>5wfCTK$}BBMpgN}Pg52_B-8yS#Vv z%}`4Qgc(vgdYUM|fqb*Xp!)@n?Fp=CYTu-CuN~@$VArenE6|Y=HEKMb&{*RqyQJRD zk(ohZb1D6+lLKM3GOY)o6umM@$GFwugxCUE#mCa`GB`>4Z^&4R-WV9u%-kVKJfI7# zdjA+eh*pUSEKK_iFqX4Y1O4Q5>1+SuEx^d-Fq)t^lZs|TV#JJagjj4jP_)nhiVqiA zXere^DNbd1VZ7h$@HITVR>Ni855WLBpJ9hfNO&0}4N-ywPqRgdoGY(b_(RG2_H~(I z1TQ2(4tPw)5OX*Hvtn6&FEX(sisDu?ExGNM**Q40sVaxftvNUyF?#Q=IA!PyRwa4M zjI67)x#AAHM~jvu`A|=f@PJyRIxpwSILWFcEIGN;Wl6S1sXAgCmSp{*lGVsxDN=QX zP*?6XHF!^JC98X5pvXnW3pS>B?&Eh_{5xk{5gUnsuty5p2Z4X8{KZKjm4=b#xsst{ z>_rF!xq(+NqJOw#NXe(68e^HF`)1a$YGn)5dcVt2)|_H*+g%Ztz)(1`i#K#X~e3z9|9aq z=-HSmMpP^CBihBP4_Qb2N7y0_t?P6qR4YXkOlUS)A=8T0)HQ4Uu(!*L_I;*?ahA()Jak|`l^w&JMydKOU2mIX>Qn2u|iauW9+L8#v!C{SF z0dp?IX~?8(FJM`CCQJ}Qr+KLG4oabg3T9aHN|A++(+JiuIqF%)l^Mogp8c%a#chv8 zDHz|A85ElQ@5#*O2!uErr4bf1raIOx7X)=?tjoG}a~^q}YEpjnR{UuNZ4F$P#Z4f`t; zqqF5#i`DplXTkX~U|1DG3RzhTVZTeF%jjUQN?@%D+QFjqd&Q4IYh1+^qEMlbfjsmE zuP8|}c|N{%S-g}QKFJ`l)?`k3K$7b@c>ZW`@**4t{e&S1LDrtGEDWwSfpTsL8-Xzz z^Qw;a#cd|VMjQjncJFaCIE02{f-ag8ROL+)Nf$g!#Bp65=$7U&Z7$)Knet|pKi0p( zRhOsX>R#sw0$K*dQmbyl;0n^lG;die>y^!8=sUH0y7SpIYO~ARPcE!7K9qNKWw+YS zIXKD`T<>ONhbTY-5;d0M(BL^k|(5Q{P ztVhbDKg)8lqCWH8#?KSMA~|*u`n?u=xrIiIJ!fZlmK_!QC$qa(*lFg}3~ypK1Cb6c zRR>8y$Qb%EgvfD?sFN{E4XLQw7^(AZx^_;2q*4)7iaCp62*fMbd`4YlRE04(`d^@C zK8+z*s(M#+wKQmDAllh9!g&;Kz~2L-+DH_DWp-^eRtid4ilo_m zh}ha+ZOK6r2xSR$nkymIuz4XY45E09jd~ETNg^b;pH*bA4UzMDMu&C9MbcFjKw))D z?%WgF7}XR)7g6s2kV9Tg*0~rOlQw!mb1h5BJU`Ey{+$~6E=DWI)+y%C{~|ng7-#e+ z!;9ubbr#L39`1>rY`n{{ClVy+58`AUQZu5+REF^+rQvv7yf_&gK@|Do))Iy20u5zVl@(&IR_446%OR=^L zvM3p$@ND_$DU|)4H@p5&vvfJ{k>6%6#xb>*2Y2`9+jpOr77Xq;Ln34q{`_^kIMkl-U&6O3yD;Q zrI!bgrfv8sa&UVf&keyX6l~q)4aV?E$A=ec2-VzAFq8N$YwBTEDxz+T4?LH*yor-rqs0QtxRSWYBQS|UBPJzyBQd& zqyZ)$M)*AL)6AT}YVP@_hGAinbUE$@#ZMv4WW0L(9SZqU?f~xHy;Q}UDXQz_3{dHo zOv6?3ROlDYJsgbG!Sw9?u}Gz(3mnoq zYe)7eY#9^Vmd+gFj}u4stR1+eaF(z+m!SgUG3;)O7#jA;T@A7*qRCxM-|@x{>U+;r zT_GOcG>7gEVRBgoB#jD^3?sQqY2I~;eum5*?O(=l99I-B`Azww+T=VFdqEOLJ#Ec?*D#JX?X1&q*Tv`Sl(3jLK(!(o?7 zB8(m9L)>zveO0|0J?d7y2>S}T9f(|gl{03~UpD6ZS*TEj&WXtZD?OK0ZPi(iv@^V3 za^!3md+2%oE~2U?vMq$O=tMl^RN^)Md-OO|cF*)YO#WB2>gUl<_cRp$@%_YBvp-TT zjg!1ED)G)@S?g9E>+BopyfHP3*RanM3Kqrug|5xnJEkZywO%AqVr}jyBigMS5Z?i> zQZ|n_x5wF~qQjG!IL19PzRtR_I@Uugru)9rrYPPkO+a3ad`XE@dm$CuB#Tr6QFcXK zG;Isj0b`&+6m(27j_gIN_uvzS1Lpux|88^1%9X_r&q>2 zdiI-Ym(4j&;ErW#+8XXm&mV7>sW^q&H#d+RWQkIfYdXcpI-mEaiLfQMP-W>xmO2yf z3>+Xy_aBL}av@`8qBevAb39opsZ!mF-Okq>0S_W*Wx@BN7>HiJ8xcTr7s76MfR8a( z@9n$YY`tdPs9y1t?}A!kD)xIP?tFB_pFeS}2StxKlk~XUk>~{>drl9t!S8ZdSjfDa z7ty*xeSzY~`tMD+Y&Kr9^lYOW9DEPb)4?W0R6Tkn#*H-E(6Dri7l2)spBYfY(I5P>NB=8QUyW5@Ihk^4F>k1g@w#c{svgy-+g{ zL3qNB3mefhZ3{y5}CJwh}xp=1DzFoRsck-g=2;P!VoC8EFPVdm=h8_n%D?HDP0 zGzP#jlI1Z9z$x8>7P4~sco5g)K{OUYRTSCcBqR*H;7-gqj=l+)O8QU;fOjAcNj|8k zvzoh(8~(t(AhN~U;X#E@e<`7|_oQ+HA3auGz#r7^>EqzsxWp&CeMUk|Fm-AMyd0$B z|13B@^6YC1aP1BN3CP7Ge2!0uM;)Yi4Zz>U2IoKOzAq1cqgBYs`|TjGFkWQl#L`Nc zzwaq#t}^h&cX^jf`1*KvxzzbUZGp^mg>t-3?%mQLgH}6^UQX_J8qh@-HdVt!9X24KVL zTd^+ZEUP%8@pjR$%){^O+zl~;K_jj{u|gSCL6M~yUhK|XD6337mNghX;SWLd4J)g* zv%RO__VwXfU&Y1zrF01cgnO9WR@Lu?&5~jE{x6>}Gr1ev4rYk z#A~H-CI&{G;(0{uTFR5TNdeL|U2~lY2LEXAz^Azj>EH996JZpwj&F8cp}M9iGiLUi zsLc67_uZ@`^U*tog||2?HG2yLzr}9YSXDF?UrEv{bO_R;_aPEzInKtA#_H;Ac;qVA z0K7}h$4t#(a6$yI_>rW5PbN6!`AI{V(4tSW}2^rjo7UwIqOprLTyUhFa@9;!tgbHB?fX1NQ< z!f<&d=;B(tYl-UriNyP&OJyNGDE?ln;Hlii%v7{}WWzQpvnnX?)lclp+~XU(rOS3g zqH7UmaPCPzMw*h{&Lsdg(zlXf~{sHsj=;x^D^H-Cma(r=RgiV%9U)$n!Wg&X`Ql?E$l+4ZNZ^bU`Uacw{rk^SSs!9TlrHsT+Ds%sbsIP+F_(I& zP|;>fQiT&!44}xnC0Jt}6Q$StV%Ok_QtA5?!KoTSONXRF3>0&=o=E4V?vJhXwrn*! z{oMDq(3Lbj_Ml4EB`(VIZS^+Q0_(na!R2OfhbYP5FA^{{7FwpDN(#l6)S$|&nT(C~ zsp8>Xtdj8u-$yDneTH|s$}QMK)U_gXO#|IcVGdS;Cu?Ep&7aEBg8}L2N*}bI=)I5k zXBXGrBO<%h;Recv&BT?Wt5L= z7n5iey`S1Lk#2v{%09k7U5BcG*^676`kJy~;8ZN^;UW`u{5o$x{Iq@Ue$Vf~bIhmV z_?@aqu#n^L=UCu02qFw;7&RBUVxOq_Wad{)jJ_N-CHeg8$AryIgC-oD*)%dPZT%wc zHzmV1=$Tb6w#`Aq(6nxYbCuCaGA7VH16scQHp$j|-Dd!SzSIWBZOWM>UM!*Q?MX<| z;FFC_ALhhBq2GB4v#SSeLxR@8m~BHMxzTTNuoYFbl*VWiaH7U#yIEq3i3C4_pTpU6 z4DC;0=0ke_w;tnvDo4m>teVUL2ShYKOb+Y@JISeztZ8N zhLJWM$H(>)U2JJ4aAXoq7upyoz9lwHI5PMwG-%#XZqb23=?y##l(O;r-THxk}Q*X3!o2oa{vf zbg?(#2;$jb6?Okhc!>EXLk_}jkm3SscV^t9BG0<}rgABD$PU}K#|&SQ5ot$fG#vHU z%|dIsEo=Ez_z z)?XKn>i|JKI{j?Oah32xb5P^dqb{xCvsyu>;{PuNnu=2K|7|6s5l>hKCV`lw_`Gt< zhGc;-lS9*FlRIx6>Yo}9pha#&D|Uw4J)s?1zQFbS+cfs0V8*-yzTuy6=TxJ~o-Hd* z(c-XgG=SjiH+E3|J}F#cH4>zBY_mH;M8=f79{2&Mq7-?g_+7y&4|3Ffbu_=44v%9e zwfDJ$--iqB2mYu!@}y?&4bGAG-4EetqqeYQA-B_|eSI#A45f~@I*KH4YwPkz8VEnN85*CC5L5`vY9%SI>XKcO#IPPSo-0AKdM9n3ZS z9_9!B=>tutw(cB-vXl4xHUyfL$)xF=eRBf&OPphKJX4C`5C^^!4@_#9{gp1fjfyj- z4^VP8taONG(~yl2phYV*TJ6e}aiH5SD1X;gGl{hy15M{8b6$)lND@J(Lz2mbz&j(T z;I_OpxD~YuasVP*^q~8F)7ms<>&Y?Xk>vr=N=oBqg>>AMxH1b!yvqj0L5Y0GV+)lY;+`YS2aU&Hcg?uXt~PGYBhP)%D8!D zV48qlh3BAf$#TbEACX1D$Klco_?pcnt0^gY#$p&Z;-!)oX6?vhTah*RtEB--+sDJ8#$QX>MSt zFehP5cu4s{1jt^+U?$Z@ayQ)OoEdhG0s}D`kbM48W;CwcvZ|~Rc(MRH5%n_-b>lqt z@iC-|haqvq^Z;R=?T3)uvRg^c#^MGZbr)@_qo#Js6mZgATCCxWN~oqdi2}_?8r|9K zIpSJDu$%~Vwjl{wN?BhagVGgnG% zEuGL1p-}0^@s6puXq52Su)URMd8m}t=L@hcs->PK-85TXxN`Bbq;`;0=%2aeh|myK z?gu+zF2Dc6VAimjXRh7qlw^M-le{w3h!N!~rrV_^q;aNDq)9-npf#bleb$K>!xU2qOc+{V^_w^OmUp^RUUM`h()3H zgNl)q&d`dIlC}h*v@%m0W%@ErbR$@FSix8zz5H&}+TbFy_iF@!h(y^M83JIjKA@`; znRlEhZT~mh?L2U@2o5ua3q0ut{BkCuC)~Gbv6OlL zhE$=Je(IisV8~k9;S@!sd5lcPR-{qXbWdBqb$Cq|Xr@9YBK;u3xx10g$VBeqFk969 zz?G?ONU$p?@{xvA%aE}}o>p&0Tc4q4A!#H20j`KZ(Zyx2PUcuUsn!o=7{d9BoUE<;AzCkl*A~~DD zMOxgN82*cLNt^jow=U*oVtOsl7s^)7JafQbAjTMd`Ns3_C#ytp-&1MX=J)yb5?f3XP6}xd0xTXS;#_@QxBER~Zw+25ZbcKKY~&{G0gEqEtAWHz*d*(7Lwy0IF9cVHK>06IZUQy1dez=yj4P44UA9ZbjuzN zu}Sq*9C3SRYbWZLKj3v|FB=nY+o5~(ubts&zL6{HU8|F+s@A!YXQF46-CFnUoq3*^ zf7eh4&UEwM*cFXyUITK)9)%S|&=ul5z1U_E{oFdoxr*Ad$K}nkEeF*m%(GV-X*smA z;CyDlLDZS+=$=~NNc#Ax9cRkf(+1VuChXM58H=GTshFphhG`Z%q~g0ZrEsh%J=Bzr zQ!4t28SuT{S(!Hm%(cMtYdx&V;&H(FZJ6mi3TW#Gs^VOc`3l`d+&R8AU@MXPZJ1oG znVjAE+bem8y>+UEvl5UJDseN!X$+J{N@Mw2DyQt(E*HoqNdE+Qa^(&*$T=;gKcN zl2;dZ2*f$^>&JPXq(KY8mNy&9a#+(V;uFssvbEff^P&cv0-LLwjj)EsWy22vdCY{)iVoyIInFXRD@atI(=FK$?Xq&3q<)a72mgTx}cOWC;vvz{W(G zZMp7bPniYfR~De^JC8y&TK>+XfK~tHQT>(wdCl2X`Vm`R!TzT+1|BBSc&G4zt9si0@;v_YSzr_B+oK|i+v$*R3dOpm(!_OH;n zZEIF)8JNBgZv?_z-yVdhg4FajV(iJIT|3DXpqG0#P9eDm47Zo7%<(K;5=Wb9u*z}w zCHcc)+Eh#xK&gYbo&0fkC9PS_Ow;`EQG`QOSg7&WHz^oe)1TY!u{Ggsf_(I>Yh|EWgSNVh0= zScurs=VbNp(dYLW?aarjNC6wjcKw&9^s( zUZVg5;es+q*zpdx+X6}87aYvyVd0ojm=GX!HJ;2PL-g}*pD*SQH#8tZBk<`~_{P}y z6_TO}6FwGU_9`|1<{&!$JZD(Ho+~r>{S-hwpb?$AO7_MK(<>WXCr0tcT~0Tku|uLy zoVhBLYO4R8kjb90$(*=Z0=<^Ae@|sjmnC)lv=wKrd!wo(&P;dzwtK%^&03||lD3VY z&U9ytyc}(aM2Z8ji5nZFu-c-mCzQw)CRSC|w`gblzHE9Fl|B0i7X<&-m;TtOJ1s5- z!H`VxtulB(5hFjJh^*eI!=X2Gc1R?L-(xI{adWb_`}gv7;2Y7$EUR}3k8x0z>4Ph3 zv=)Nh=n_?rs&d!I z|dvtaidC+r$54<+YN`4h7XB4ad9MTJ|=1m@~1g{5dx zl9R`&ze{jWeXZ18MOsP{DM_;!EzzaDu~uWNgu)zKAYA;I0^^Y7w=Fys_#1AzjdK@K z?bjB`=+Wg|yKO!Gdt^cC`!g%CU67=IQDDx5<;8dPSnx6RcQKb!uReF13n5~TA$}b1 zF?WwYEJDoop9N?Ey0^eu8_}&la*`T z%e!Q7V8CQX1%qOw8v~-__?~JA67#CRvnO6HR7BP$=oi+@zBb-8OLv zRXf#abSj&Lv8T@gs~Nbcd1Pf{+du7dm10s5`u^whRL#m774ClquCCBI)lI>tPykL_ zPUICdgf4&v8ZEs-uBgLK&%-Tto(HU{2%4S~dM$_Zkf%MnTpawg}&i2B_(L) z+y5;l;3CbmZ0%pD0h({V?%umH*&VfbuLZl+;CN^`OJPf#&^s9zO}+HQ;~4 zSv(kF#M6cPnGJ}e!#R?@2%{bfCbH3aZ%s&{N`e6N!YYH$+7Lz1tm|K`T@7Hs_0ltt z8|n3yTMY+xdmYVO6nHHH3aP5-B3XxP>yL{WYA9DmC|KH z?8qZx1;)=3zET{bq#qdbvNK(G7zdoco{@idWbY!$9~{vR{FyMru&&0rSU1j_G1&Ut z3>!qiAALMQPT&@}ni{7gIb>861TmQ!Yvl{ghq5&&rz^#fT06Skxb}kZv(n@sxY&sDNwYqQMf5jnBJe>8QWmnJSHe0hNy0xQG^UKz$ zN`vY`t8M~StgWvTs$RN`@oO{V+nFvc>*1!h7p`_FAs5ccO*2?o-2_K_VV&Pkt|Rfz ze4b<~kSn0qV0(^SU}|IDsM>`?ij4+_YD`{Q)-D)7vG5HdHPO0+-?e997}dQL2v?G2 z5t0BvPxTP=0Y6RXI~*UyWWS`L2Ln3RfB;yGXlv_xb&Y*(?B^WUWhNMayf}Kobgc=o= z=dhUW*UeX1lHh4AV+CkHf4wjEF9PRP>X6>#gU)?kklbnbb2I`kstSN6phd_Qn@dxJ zmtw*|0emi);{Spe@hyz3n?3WL5)u7%+Kz*~*tfb(3i> zbd%L(XZ-28gsGTl#?_7=i%w~mK@2PfNG*Jj@$xUO7FlQe0%}yFNSglkb#%&^(jq~2 z%ISU>$c~ow9AB0Dy!3{YG9^rWB+%y+Yq@`VW+g>gwhV9=n5~M zMp*dlXjxn|XIi|-BcLlLY=u`&Cp@U+FJn2BT&7zy%`{TIl&MmqDV@_rtJBLQ-oOe` z?)&f(GC78dd27beENn*?BTH|l*-Sb*IJem7oSGqI3|4Ls>EI# zn>~TYV+~#54AI44tp26pWk_^Za}JFlb#m%uD0GHzM(=7%+m@wOD@OZgw~I#dX<7!I z&h${kCdj#WxUD~`Soqz9OHDvv|O-pv3Gu5I&>F!i#-bST_P4% zukW-mGPLKpsBki@gyhzkPWS7-Sj3+ZuRBmM*I6OJns`Z^W$%gHXc`h!jE?8S<@_;` zAJFjoVq^fd6|uRQ<6W$ijvpf5)GOP)bnY_Ig`pP7X;aX*MqUZ4CEHG(pVkxj>8q2y zA>C~0n-{= ze~t9AOESlcsLC@d4u@;9%Zpb3+8-gOgwv(ajw;V*AK0%4H5roc!0zuso5MuGDaaBj z2T41DeJuC?Nn+jc@st}!5>#KMT|1m$d~=fN&ffI2xIZfU{7qn4<%{MLWcYAq(l!&0 zCCS_>m6O?c-zJWw6|Omu>BkBY|K^eD%lVL``*21o4B2x43sRd#6d&0;0)&5!O#-xrXqr^`PA56~)cA>iMM;GhWIY5|*%&PLL-Bi8A zzgC=|{zfd)_WBtVcK&xE83X)ziCNtIUWT`~g7}foa}P4L+Mhr!(NdH^uI-b`es1Jt z1S-B2WzUSSR0@ocjTCeDFWx6S*f!h4$3TqQ5!0L^+P7n$@xRb}h0*U_7xRdRh_TkpBuG6YzL>zv z>TKxb%t=2q#8>Z@B7|O_c0xl z?SK3JsDB9g8-~fC`(i&^oNwmb$W4;@p)LLzFh;B)S~@wM^lT`*qo-nQ3jMfrx+`2_ zkU(yKTn#ndD?j7-1382SwWzK)NxvU7@z&ksAXdlFd4(x?X~4RvdhDr-QVsdzohyO396k}W~D z#Ax^5>}2@`NbXWz3aA8eo>z|evruHPcJ?2woG$`iT z^4K=7LP6Y}l#B5zC_<9rSQkRhKVQeCTDG@IPnDGxIoI%O4L-h1tCLI z0r{ctyptb)N-QAEh~nXky!n2e+$f{;6wc2Sb%JT(P%rU6F6KO9wMNI-mN&?FlAex8 zb4IVDr5oMDy`f7QJhj!lwT1-oGqGUzh5hrStP*^lSTSrA!N##lI@9v&>$~sT7yf&L zhd|pBkgDP%(rNlzYPX>IBUisVPkuo%{CkzhKnB|HV2;tPY56E zes*N~MSk4N7TDlYlpYAyo;Z@GvDu!41+8~yuPZy^0G|HDc!b86+9ZIlK~y$s3!Mj> z)4kRGB*$ubM6ELJ`U`l?jq)GtJ;s$t%;dJzIq*;Vk%eh$VW4j0yHFAE0*y6oJ5a-P zrHFMC(i|P@#Vk~f@M?$|>iVgy;$-0yQaF$oIWY0QhdsviftTu?fW zX!40x<0`nA+^U6b3u{rQu0c-;KX*R^I8ybs$HWa%?0*{y39vO?t!~WZ&0;yG(df>d z+PG}JNlJ1`w^7@76{*_h7zEYsSpQVPH6>;~M_wlD#<~sw50V81_g>>vu402bWiRJ= z%G5k0dWd*e)@MV@mJHebSs~B}^z3Z>R7>*UA)R?Dzud%(?Q@CE4og`?mH$6bIRo zb0lgVixN6gA+2IH4OqT)GfY)S*fl-%_C+lWTV7JxDh;i2z4}NQ5GK%nq(v+Kbf}PF zOI0V=?X1;a^==E7tZW@TjPFcYt)A9yjM+1o1ba1U)IxQh2lP3H4H_V}fwIL!OK+^G zkwJd)@Lm&zD=?xu^lq|Ko{cb0vaEQ>u!#o(2@G(4n!6peyqzEYX?RsWrxu(V5hS z3ctbw)7&u{nkpLm3!6k592*hsTWYh%^_IhFoWdn-!zP(#Pk+#j1chmOEt{S(er8z1ESO-%SQn(AaA-vrXaUnr_CLS~hqRqn zNLd+FMr0;FXkks6uq4?urY9|fHfRmYab*!UMdL=(B`+i{Rf<|-dW&^rwnNZTw@%Py z&Lq0m6tUCl z{i-BY3+ZagFNkNu(b{+kwwh(-su!(3%HFjP9`~KgonX9JZVV?A=pY+Qi6ON%-l1e| z{^QPFmvY6CTppCr;)`)KB5QE~piLR#AUUxHk8qs6sOSv95~QI##RuewIBBUq4?g!V zFisGyTo>S!oN<{I5O3$RK!O1aWpz&ZBZTO?X zg)crgi&g~Mr)!ZUW?OWJ097P5wJ5k??s-NHCI?1WCCm5zU2$(J-sGvdIzus~EjO@6 zn#fptk!DNWGSxogLK71vs#Qv(6uL#}?e~)_JlSYIw!XH=W+Kz8AQ{t{(NEK2+XQgxmJ#(Wzvk)I z@7w38sAsJu#XnPkrYmvzuBV@348ftfggzC)6G=_G#1bii_1Y z7|bSJUTJP0wFISwH)l-P@-w)07({7YM><&iSvO4GS3Hpwdxt%sR7Yytv+lC-Y@Gx^ z`%vYHu%tc>*kLR~ALEUcUvf<$+UCh&bh#``NiN$|m$M0U$?-xbz3$)jX&Xbrqxusl zMDYPkJ462CmT;O?b;_nJtwv$08=-D$k(XXLbXt99)>)#c?Vq1CchM@rMOcn;>Hp6L z%vi36d82-Jvsw3Kd#E3a-0^^H$``Bvv_!Snp1(7u^VuQgEo6JtQ`b}mtG-6{l{$YNJJ82uBc4g3(1-qs0(*t(R zbWC)u!`&!gbN=NzTnBJ126_IEx%L@jVt^5_&Zu$t!p98%(9|+!s_W2rBsuTq`qiLVby2DG@jGP?)bNuYw=r2F{E39d|3)RD3v%Dzc!WGN(? zI0ogVk^7u*`1~b`tZd_9@nFcIh)ma?$8N)&?vQ5ED$_W6GQhDEx!w&eqCKZxEYHa&@ zOcfYs{ldz|=Hs}?qwRr?A%>TjiFdF5tr~|Fp(1@g<4#b=Q7Ex47i}j4$SM)262nkG zM~vBIEqZFg1L@DksHU6X=O4`5FAQ0-LHN16#;%t`7Zmw_2W$Qsxw;EIC0dapc(cX6 z+oTm;Bh?p^>lZLP^|QkMhk~~bd+E9(3UAF7(lll$vqre=SoKn3v{enk}*hu;^6sune@pz^67_FcD zw2wn~And@;!;2SGHW-F626#QphQjbrY3+Bdah)?n`_rYe5YSJ?pLjXTRM@bvk;H0V zR$o{mlLjaM@>1y@D?jR63oA(WPPcrs-Q{haBU}2oHM6bTO9Fwdt+q&@iee+b^$~I8 z%^-Wny$U38CeRoqy6djV3GQ8q9kFM6XW~T>#p+aId^3iLm~p>z=@5sC;41a#|Fo3D ztFb!|APs$r=%J52`9x4#vc1|hG?iR5NUXO{YPQg*AYI0C$JjYjlQzpb7C=0HAV<a6md|abjk=B>T z`KxfSwRNL^^WwXD^HbaNvvZa)0Gn=og6PsaiAYnhz5TuI`wmH;o|6O^8qw82wt+GyZv&<;Z$C2P?jR=|R3F&{E&* z1rh;da}o*KoEkYO?fL1l{uNKK27&;Hbh>d2C|EX)0&e3v62Q~Tc8-QYXDKoxJ`bYP zxjjGVjY7Yc3&f;jVEK&|Sxnm=b-#z!3ZHwomya1+Uis@YQuw(HnHp!Bx` z_v#$`2J;zYCHdnx_Sm22Yj=&eAnTj+2JR5=7vsddj?on3j~4ja_*!@Ac2{?w59+Mq zeq7z>8_z|yU(0sV*L6*vf&r@k-#hObZ%8zRfs5B6zMiu-_CNdR;9Jxho(J-OU4ERe zw|&8+k8|0;J=@_;!CKr@HU(dbrB_a^z0ZTwauulyILrYHBL~{e0r4 z`BKwu?FqhA+3yHVo$bW_W^4xt!lp(&pmCm(u;Rg*u;Ss4SL21jVt07W{s9*|=G`4r zf{c@Ir|%7{H~dI{1r1es;bgulR~XxYN9rm3xQ9i;=x#QA6W{Unp!R(^lT2%5u%LaR zTdV!xeJ`ZoOy69MTIHE57JT_KIn+!q*c{MhweVR#DE%1A0`Drket2+S=HArj-Ae&Z zC)sN7#whOpr?GL#TpYeh*#GQ$eQCZUc>#Cx>rx*f3*WW>TB{sACvD5$Y0cB&rcIQoAbReMFrjK)hRamW?;D=fzNbzALxb76A1 zR(OaTWi*+yQssK1W}>f_B4s-kr763-xS})6sWQBtpK` zLc%t;ZwpE_6l9xt!fzU}62^D!?w2J@tYKe6!-PUY%S1pdq0pmVrptS3^KDK4urkUP zk?OqW*awM&?viTQ{g}nB&$Oey)BlDmS4zgPr5~-+ew2v81?fz3fT;VAq&{r8u{VDJ zYLYEVMJ7eZI_%d~H+^T%-_d5Pk7A11&CKF*^BkMokvX(UE$xdslQC&a?d07&Rv(a|;$GGlRD>0{%&iE%dxIhr50uQ{8?;sK&Qs1Aa+}PkY`Se?~+@(axWT zUx{$8Q=oqSkgax)8NnA&ui)7bnochWYK6mb1YQ2?e!LIH%5DRw;%7D}FJYCO2;rgP z>GGhIOyzt66in50)qC=BdTTs-dkHzMda|MW)S}anK4tRHK>9f4OVZJ%3m!q?Szrgd zbKcbe*8>h@=w=gkn|0J}=$rw2u!*>H+>6k3caQQB`WV9&MBVF$iBE;_RIDwA)7*tX zK{MDN16t5#fsMFn+=#JiRz$m;c(O4043PUJ zQ98K8P}KZ_vkOCnqD}TrI@v*<5e&F&M2x0u?)&`nT|jM)dA(jjFm_S;{*bfWMI6V_ z8hH>15l}s=RRgyA5Gy=2f=O zsoWLCFkVKKe5jhwx5NZ!58}`8e5+|ZW%@sY_%jkf=v7KPxggubbAD_%uzrFQ_8${V zC|f9t&^#0r3hMpD{yissD4&Boy@8vM9+UY42xTJ6#{nPo;%&9BcXLM_E#vaJ{dW^Q zy$X%^e00V3_4jfKh zq46eP#-IM?)uCKRRbH*C46NaLDhp!Yl!d#^C$U-3ng*qYnEHzGJ0ayariN zl06jfd-=p`#Jy1|7mr#fR_8YgQ^Y`MNNb7+uPDqb+VgwP>ld?dH1Z4EM$7r{j*`hV zu8!G;P{rnBDwlR0MP0nS?+zk((&Uc-dFyZ-e&EKwr^v{TaooT^3z{S+22377bDb^( zB0M}9jK5)oKv#zX9`8K#!Xwlg_9_hy39m6-!^eV63V6eM{RUIMAJ!rQ_C0)CtkU?D ziMoyuRc;wuAHQCxFMnU4V!QhW)|$P!j^?{Ylj2_%<|Sh?yO-pl;uJ1PNY#-Oy7>hWZ{PmJyP>V1QrzNtMV!ur5y{B)NR zAmC^tu&gq;j9xm5J?KUm{8_Qwx{j91{_Ep-n5Z(o1;@Jd#tMix;F(g{^KRasKIT4RZ%Q=3!*;bVOG8rGtQ?Sg+%IMk{==7K1M1FmTt1KP1#0WNnVMx3&d0 zfBsEGatKz%Z!e^r&mJyvo=HzsSDeW^@LCCh|J_}k)ngwVa}-JjwM#0qcGb-RNp$_S z!27B@*OmSWZP(!?uuy%kl85);ROxL0IC^Bz^Ys+$qmuEUUSXb>msbK+$2~4>?d?}N z5g_7(sO+$m_x>YEYP#`)^1{`KNg*#-ap+Zfq|8%3SylRoy$f=TcjtOBu%PU@hblg9 zfbaT>>f`3NGc9~tQ}HO&00U4wR+E2EohOIh_f01D0T7R_N!w(x0BAtA8+P@+Xua57 zuKSuK^7a%S<7>LLlMSh%>1qrP48wm;gkAvZoZS4hW}#yAX}GG0jyKes?BRLzg5v;| zlURMuFr1e^`P#IujXpJn?m+V)@+VGMK&C6k8H#_JLPtDkr2Uqpuy@=xR_p2fJO$Md zO3;$h5@nN}g8_`bVw{Sl!*kDsv^($&FJLhE+8jc+$&yj--^a#kM}W}|gII|5PB*YV z`h`=h4g1q+9$##Xd$;q+tHf!4Ma93z!aui&BFT_4;;YYIe{-Zp!IM|ui9_l(YCi@= zi>n8CDk)%wV7ol)t(62w>#4bB%gWZNaa|AU3Sv}4&854ptvO_!-Sq>pVbqWhEC(IL z&Usax0u5llHnC1EI$XMYdy2)d)g0rsLD}#%ht55)9~-`m;vjp*!<8Bimt=v4A6e0s zT^4z<jmcrYg^Y683a ziTk6Kq^lD>c+!oJRV-(dRQg!m&>6*Nax!4K85l^;3I%yB=_^#E+eAGberI=gKFf= z&RidVxuia!taJ*6%XpW6qEIs0j!%1eB$a`(B;$daZJC`fKn@HwJ`QyNlWinyz(aq> zN7Ps+PXO9GR=(g(GUmW_ix0pRNa{MzfeMC62}9@^@@{C*lr+{bgjR|s=jn5P2oF(f zk5tfj3ljwmNe!?EG?mIx;kVMDCVE^P_*7Q-47yR4Rp)2U0C4F?cL}$JcV`5pRGZi$ zi|8S6IymUVF{DA!XxX(cTX`ofEc6wK;V!*Iy;!0(ZpnoI@+HkAkae|$Q^-;+X4Vx; z65*y4GX4=`1)>^67iNaE$ATYw43Ur(N_qx|!Fv|I7;~3fXBMtsQfn2WvcSh9&qaP4 zwWrL)U4gHbXq4He=2y$9jYqCfCGjMUoFxLm4>r%b54ZtDF}i$@Q+EE$i>AvH_bPd3-TYB*n@+`e(-d2YQ7C<6-=a%1v3ND zwG^tUW?{sv=tAGIK^Vxl7uE|UXOj4;XTQg@b+12}#rNglJ& zgoO23CxWF>nnXX-Vq_Oetw+5n&$Cth1vb}3Ttgy=&AP$CbyYUR&Z~62mdn;s6dTNq zH~e&p#xI`0OE0PpygsfJon`<92`0)43OY<*&?!3>|71eJ+o0k+s!`}OIm6;X_0gWb zBhIGlE3SQ^Yv@XRi~$uTvFH6|rj95pwP-VM>N+HKwiS&oZ(BtRuHWd$uw90& z2_6@zAct}tf2fO!!dRl{RG4|x0phwE|5Dn z?fj`21Y%j;8Y%KBW^cB6jK8|1?RD8@EvOEBEgbOY)vAoC$DdP?Im`~iX5BvqKt-a@ z#xmn`%e&dV2BsYSvx*4T%1>g5)`$s`G8j|hpJ}!GdMjd07*;39ZWuVnyk3UM$f=+) zj73TH?Yr4eqoP_5K06iWIs|$VLC3c0EimF3+dx)4Qy)XR0r}j1@~nK0cTd{vJlT~a ze`LWw-ckr-Jy8xi`Nu41%zi(UTBS#`1u`hb-ef>KD&PzXDlqlTQC9u6V<1Uc#yZNABX%B(-k z!vSidIiQ-Wjr;f@lX2AyGLmMxnK?pMy~WLgT%m)~CHj9kmOPn#ar^mnNWOy5n*rIps>?6Yf)012;DxH({ z?veSQTwe~`h+0K#(rJ_#SWF}eT5u7U>%IiGWe&wc1|ERuH+rvE zGjTcL?zhG#$RCC$GxFTJYBW-~*SszKCGy<-ZfSv8`QqQJgl{*qwU~b{ zcXLcQ`!CZznK~hK9`XV6N>1^d)Tp{;&;Mjaz?EQK`bIss4? zxHm^eZiVCia2%=2!M}zfzXNVwtb%{5{N)Gbqk0_h_v6@o!MXK@dzBBH3*-9&=r(;E zaMXbFG8D&;(?C4k8{-e$z-XlJ#=EeP!TnlTZOifuMzrH*jd#~*88CRo-fkghyOv+x z@mUP^u9c6;)IasJ@XH4d#`g_;zOniFi0d!@`}6s8w_nVt97~$TiKgs2JPzV@1$#_vXRBC#l+#2&am1s}^3nOoB5vR5EOCm-`Dx*~}c z=_G0-y*nd6spStz4SVYGt#9TCIzroqImW%K7^>og9@u&iTmq%;cxcKWe5N;+F5T?Sd zI_R*rpzV@Y3*F&5dD{icjqKj6+gaCv@stO)Iz9rhqc94SO!WCBUyMbRPH;Jbl*LFv zCsm>ih8ST_(Qt?8FK+TdafZjV{#xpMHvaOdIIi#MSVmuXWzttk8^=f@XnW=Y2To}T z|Hc9bnp*5Cx1^G8$@yjDB$qUAp@+)aRv0bnGzM_%I6_%BstOwcG+w7cq0~6wcl~xN zGR~?&hDrUIHsVkQtdVkuAd_zsrnJ{x$Nh#AG-QG6eaA&&uU`~2R1?_GM%ibrj8=ZQ zOR1}fnw>}vWgay(`F&|)F1vTV$48@8i(o7J=M`F=1b`2~zMZIbh>e=~!SS8~HI1)& zPNK2B3eU`FgjF`P)~89opy;~hM}Q1CM^zyBAHd8JybeOk0NY{%TcAh<)&meC5p>eL>0dUA2#4(=EF^?*-!l*48xC%7Ss^^1ULnW!VB4)jR zgtZZOz0huIF*7AbeoGWSB~!i?RNJX}hn5!m78VB+@LR1L#fLBH%!!BYt}B#Osg+Pr zWiWE^Z5PB3eK^>!*7^A?&C;uyM6g=WfdwfB>6yJ2*BxZbucJGMRU3Bg&ic1V1a$)u0 z)C1R}R0hOiNQAm|>ICXk8gpf-5c&*IC(@%NK3e9;NEr&P{W z!iE8v$aU*g0M}WhDc*0aUMBiUS}ET78_w49>G6hN%6I-B_pYy>QOGAzO^DwLP3G${ z9QpK$$KKvi?dz>nIaH@(XIsHU1k`S%9w>fiL=a`D1LjABw@sAYa;5IR@6n)W=Fj7T zJU%yJ7{P0>TQ0PIxDx6O35b`+3iUIgD>yOKu(w_qzOs9SiJ!-X=q2~UF+TSV`CsyF z_0~pWE-y0m8@u@@=90oUbs<2)G6@0L!ZlpqK1&Du3{+U_VEe&^(myun; zgH_Cy*JxvNND9T(51r_DSq`^hYYoGZ>DS!CM0<1o7{2GM$19r6h=zh_`_j8BmhK$J zb119@J&1qOa0KychjVBO#3GN+PjOUGDWb65IZhCzUvxS3&6=EPa$ji_<@f62#mwL- zwlUJ?%Z=r8NzB-1ED)uF9I*YC2y#IVSiuVf**Gud6^KBZ4Id2fZA8%NMVsTaBcjH8dVZ%$ww3Nj@WLWm22*}AL_;O?_x{W<%oe)ji`NOoJwnkE*nPg>pRsod zos_*A)1-KWq=o-|8t+K=KSr~hqRK8&_T z8x+Bw)!Vx@yyGTu4dAr$)6a?Kskn#VIo(sLK?DD62uiA_K_YAW3fbjwM*cWk{8DF~ zUXlBUNG9WOLGd+0#{Svnk+K4~Gtgb+ZnLAq)&tiEoe$Z)w@Wd-V~^VP7>D63l>f%0 zdwtiUCrw$?1|$Is*;ql#_OtxbY)IzdF@=%VqZvg-I{v&(EMa-#dZMzHf3>tR_Vz4q z<{uevruLJf%9Enrk~rrLlrS+CiFl>ecteyfpFs}%AHRMPp8U`5*9iFh?=ebbY(7LH zRg;R#JL}S9J5>IhdU7xY?4Lnt%*Qw6AYY9ULlyBjKdz%M;O(5(vvHlB;U}RH({s;MF^VHVaFk+HK0;@D-HE zw+cxvPA&7|Eu8HM9<~tte1~GtBk)G3z#irI**NdAtuiy@MGKg78Gx+Kh^7e_H5jc! zmrh4k%FsaU3Yh~%O|TM_XL+7dyE{$A;i>sn zO)U0_)HY2tswk{Ynh7J}EBC?VrtNV~qw^k-F;T-}97bn=y=4xg)V~_6?N(NSm0&uo zyA^=yu&q|Ts=(D)4om+3vY@N6%%@|Vk7-0Cn{qfC6y}z>oX-pYx&mS@@$f(^$Q|ri z^6+Ty?s>+a?RgsT@LW9I9!dj+sI&EFFk|UnnmH;o{f6fwh}|MBPL}67n8e(V^s&&! z_wCYYoH6s!vPBv>>SvBL1~QYwgXH7?GmJI1l~*|mAL+wGl*@ccEKdT5k9k4jYhsgf z3OaHFYTk5uAo$2QDH-c)zb7siJNA`5I)Z0D9vo*l6pkx`-v)Ebm<*^B*dJ%uwkv|- z3$vg)Fru(6e6A$IrxZtgpU}>l5NFtI;9wT{ngcKKoEZq}-<^9Ac zw&TYW!6$Z%Ep&=2L`pYDd&5X^K5~wbf4cb=ZjDaS8DXYL5v$WG@N7&r|i5$M_Y|CDUkf-5nU?ujL)tbT^Af0Q@jg44s+0Ypf0*5_@Z1F>xCQ|C%LCqxZoYp#j!QQ3nZGgB8O(hnJ7yJx2*tYD3J9&p&>oWvY-I%c!SJ`6kh zg5sQ5D#RJYHTy3XAlcfL|{Xp|ngy7ly+PlY-%Ni4f)jWf%FsOrx@f%kjpdUJW5cN>|u@EBg-!83*j zLHohec>Pla^b`qB;H`k;4h^#|{r7LN+I0itV+)5W$(=q{l0AhUTw2ZHg}K~!x66Gg z8WYcgSZQ;@VQzhBeEWvH5nZU3&7=1C9B~hf% ze{mPg4Gt`TM&y?#s-$wvt>nx|oOP+O3{Bee_Xwl7w^lMoDrd@#>co3A)ZAy0SN=NcHVXCe8eHt`#XiS^&%KDpaS zr(UkTZmB+&-4!a>$GhkaR1ai(y!DS>CQBLQAv^~-ja~9gpY>3;ehNG&{Du3zcrpA3 zx1W4y-q?2n=pJhDZ9KVa#jEl2Qo-$`hi;@n2{YbC5x#-G{0k%|2GCspm6`yxYsPv=rxyPCB40n@h^r@c%&c*RM(6gv zPhM`;Qf;o=-^!?R!vzdfAp&K$v1cDq?|0W@l%xZArhBw(M{%bn? zC(J9d$ns5XD+r}DJA90P#O{rHKy7Rs_e8Netc_ou&x{0qYXEGP7pTHt@pXkVI zMj&G0RDhZoBZ`t`Z_s|oNqmtBcMb~;{phOD!cj7-y@F>&z`sdaAYZ|;hn?8)cUdSN3i~fRw zLhVTPZ5<98@wdk!v4m$Z8Hz?SO^u1PBj|lwgj=tZPk`5h@=;<$-X~H5Cd0NwaFoFf z8^%ErSR(TTiC_sbRxm*l%drwm6=2k|CU4MH;w;CFclcJaSV$8tec9aEgtP3XernL2G z$H9P!6OK7isD_k*b9C`2XbO-_xy+>ZI1E&*gSFHdsdJJ1>2`q^NH z<~YxE&W$=k_TJN`&a=}a9trpgM#54+>VS<>hWvmHlP$zCi^VP}VyI-9V5U~($zbL- zq1iuK@J-c8G)NURdN@ zQh8${E4Ud}vlQ6Me2tt#&e#-xm%+l9G;BWqDno`Ea+gtw8!LmA2})UP6+jG6)t`Wr zK|PS*C1%d-P*gBCgD!i(Z0SQ5Gh>3iC-GZ*yjYcWj}(8x1`_xvj@dB6{{}$68XCq^ z13(xLt8}cyK;nQkgB@Xw0exg=eLo>AW1Z*i-8x#lq;E8}UA9Dh*z`m8SzexP+MWqK zMF)ezGMyB*q3CslK^h8qm_d46YluO*xlfeI(k3u}iG$2j12HLiR0lI@k(no}j|3Ig zPpz_#1eVN_VNA{FzZoGXQ*VYpR;dmV#jyxZ{$F(*tD!kORRHAhFdgdg91_jOFs6Bq zu{n!&BPEH5F@tTwqm1os1I7wvQgVI1T;+(Ig%iYRf>e-34TpCr{VjvDM*u5jYe|CG zO&Qz+e;wwl%EM?+0^v;zc08CradC*v;o<0aayH*;{q77E1?GWBX%gjhCJlti>BL3T zlDv=e&_@XMWyF+cawd&@6N`X9tj{RNcGA9wdoa}{lWvDeIvEo-$eg(ACeuf+0>9wW zHDd-6#Ze9aoB4*4ybTSQ8cK7Q=0jK-^Sy~+sWzlE`ll zYM90dXN;ic%lx(|Uxt^u36nzEF|Bun9r?+&pj&p)9Xns zd?n@DX0Yqdx(riEKr#=52ANF;nUm#6Vu$R)LX^0kHabzjcD8pDNiwFttzD**Zf)-Z5Y6qPL4d1K02#IH_pNb|Hjb+`G(@hM)y?6BJpjS#el|)Q#efu9Nhp{x=X-=i6dbWut8$pOLVlzW~upkCvV1C94!Zyb`tSZ`dv z0OM_80R9FPKiQQ`Z5>t^zC3k*+<%{BoEMup^KD_l)J!Dne??$FSEXJRRWnpV@U3Sg zlSn-@2Fv-t{_DbXCtZfoZC^l$wGDO(6Jd%XNvR}mq&0y!*xn{klCg~mRIduaW%NWD z;KZv*=_EazwA|F=BJ=@r;<xXNI5^=Sr zvtHJuJH&)UcO=wcxxN+cyR)sqv>xK*8Z(1AEyKw}9Xmd(Ur@=HRo1BW+wK9f436_f zl+AO!t5^MRJ=Yqmw6igmd2=wToEu3NmW>wNEag(cyMU4XZ1-zGRZVdS?qZ) z+KyS%^JSEU|E0sMR`tRpJ>zTfO&N!FRs7z)JWtOr;ao*9E3-;$2!u7WU=R+%Y({2Q zQKKkk9O$1?#7wVMhd6zb>J45mUM^r-0VBIa?+g9|jLZgr-2KqWC>_R&b#G}IR|g(g zr2Ft6?8&@LkA~fiRuL~~W5BqnfpaQ2@4|t z^+D^gymON?Pxx#D0ul2P{BkGt{Eg|6^phj-xO$2jT7C?1*dT-BaS?_3+~De256A{i zo!x(F!D$eV?2%En_kU!)Wl$Ym6D^Fp6WrY$0tAN>+}+*X0>RzgJ!l9LJi(oVdvFad z!6gthcTS%7`>Jl;sucObP&Ko6@71f<>Yg#x%Ev}`C>{M}j-#0ew?HrPLGlUs|9vLq zs`zAS?`c^fv2>$Rh0@OZpP&Uo|3OPQctLid&aB>Ywsj07~{JF z(0N~r?kT_+ih+pm&JpDuZ_0d|REi3}8(b|%q`=7H=_rD(37T3cWiwB@exp3QNG37V zU^ny|CE{$^Fd}}?v&A}A0tvNp6ej;GivZF#v+z4+F6U?`FDb>`2wN;ZOvWMQ{c)&R z?uKgE*j#OMso;{T&r>LGgG->_pcgGGi>v7s&m%J~l643(f}s%UlHZ@HJE#>ogt3yp zp^8I9&~t>+<1I2jXWZjaBK1E(WhS?DxVMCLM5$;+`Dl(>1eU1#ZD)+1IXJkN`gYV1 zE!tKbq=|_DijRjiC;EyIoy`k73uR9Z60Sg@9s}26P}}QA03Rc)$`oW-4vt0u@lu)# zNr0>()N!MA`2#jh=whSJ&;7z%tr%zo(&?F8&HGnuN$TrqKPWnRLCpA+kJilOGL_+nE zOuPD|b1i^pTe_1k)SA0h-uCKCb|c;P%j0@KTKe=ffZVB)OFQ0Fzo+HT_7VO16K(cv zhi)y`cR9IMq#5REC~x~Bn0}g^)VN!y?FO3s&a9@l6oYQ${%^zm`Gyn8XvxK2o0=yw z*Y7q;r){ZHmy;7ypRPufPYW2Y8s1Fnu}mFAf@F8XX}>}LNKD(k2&|@nB1v#AxuPz% zwwnawkVi`*-Q2 zxl-`O6R!4~;M`(a&h4aFG#*XWi5t_0dT1rNsVZ#i3c0uFxV%1XkqpBIZfV|f%IAtQ zB4CU)f>+0Gy(*41;b5{K(>I|(JoJkJ8Qw4B{%qTGQ+mAE;h^i5V$9$8#uAy|uAv1q z3SLc9D+lGu+d5V&TyV=PzcAFW7;B2sk|neB(^hew+0IGP0bOT z3yjf3($Gdu;z;F(cWY2tl;ZxLG4>MpA>`8r!}=-wlYNxH$`ipiDYk;7T8FooB79wk z7`i34)nCeY_dFj{Qb^RlfaX3de2mg1Kib6mXc=)*+k78?9U?z9X#P`+zU%to$68QB z6JkqB3?-55z5R<5p(8o#VdPam-fa`Or4WzO*V{P3!bme1qw? zWh@Kcgyl9<%lHw(6t3npE@GkdMX*aU|a(-zMJJ?h@Kr7=26e zR70{iMC5XUW5)q`9JTo824ZgfrYX!4U0lwq2)zp(YS^3`$1~-yy)|z|VvQ{uO`CYX z6$}j>4)!0Z8|5=I7b(|FHlR%DCuy&Ne+P!S7xh>_^Lna*31wTBd9rsk%ao~TQ=Xvl zhmVZa3pe~7raIn%lEPOOl0#7zA`8p4%Skeja`f4USfExOR%@_U85T9t6Ma^Eu09u4 znmC#l%g$8DuBbt(QW6&RL+V&?uN!+KNfuN{#OK8wi5lpTG+`_O2`pVqB(xWzJZ|Ja z7xYLr8r@PaDRVtBLnENBrmR<`+fPQdPqO^`X|TM zzFt5B^b$uhh{zvmrH@V6PFV?kWapZSGR}jrR;G=OipQkL^xH>2nJCy#3L{zO{(&C2 zj@q7Ky1g#_q4E95&CI($UyTHADUuu$q(AgitBy}Zncb>?)G`dlZX!;xFxRHB<~u+X z8W#1?Pm~7Uy&ycCueqOHWv+9W4IefaDNt^Q7=kLD7(@3kYZ%ESc)2e!zCIlk%+@Fx1u1olFT6i&@+AGgJke9!( zdRZ;&@Mb$8+z}zp8*=uGh6f-$=_5Z)kjW?1*L`9dUoBza-s9&C2^a*{{cTN1fHV22 z2lm|p%+m;{C-3RuSE7neVtJMW2Wa`wK3;KN$j_{>+WXKQei`lQ59!{TVE8q!Ovj=epe4>x?&NWf|sOyv?x<_rq^d_{kB!R|5&d=wq97UZO`HmbrJYI~Su?y7@E75j5Jk0V9V6O0h z6S(#b;p)Q;mI(p230w5V{xAAx(BItds}iJcVaw}DYnj67r3J#A3hz7W?%K@);Pi3r z7zhTMlTE?4VDvunO?|M{Rosm5LUN^I6zN&t(N4N7@V*>9%o_m0da4Z{3oIpKEIjN` zWN?Yy3^~6i(i?0>YE?%%RR9J*hm@!tR->t&9+dPrBNstn(0PuyXn7nqRs=3K0eaA* zz2Kxl1^e7?LUCT$FU4HtVrCyjK)Ou#C##uO#}K;fUtKp#Chc{upRFiH;4_WZp_*-v z^#`grI@@dTD1hN6yqz#wqAPCW3nCx;o=hd)w3nX#uIc(6Nq8}OgLz37ea*6e9DeX#~-#s*Ev0O8x(aP9BQRL&nr>yTb=+-Hf6Eg z{bo0+4Yt^ey;@}IXxlM5i@ z7?dAL$|C%Cqg-BWn{@N0P6mADkZ4a3Qr$h}cB&3SEPI%fHSs#$C9@JbzJ;Szf(>LR z455XQgG)VwOC7@atWBvmt<1RE?=oxF1DE{2XG$jBgC2#38TAdOEecEaoM_1_rAgMT zGIg{rIaooZMfA;L*9qPbPhCSS8dw(9Z^`m-9M~ImBf^ZJ?bvvex}F)m+sT%%SlEcF z!A*m6%{<2uCnT^7=d|8OG)m|EE3`7*XHOkNN)BpKxQ$ekE(-`AhAjBfACV)U?WTiK zrQKupa7L|!Mn3~Urouk?&csS{ZE z;cCqohYQX>d9}fuzRzY3BywYMqs-^eZ>-tNRxNC~=|K1BpF%I7z!E(1b2+=T`+`y3 z_Tvpt^P!Xz_Qpv&+nTg=2I zFOn>U+FqnNvE`Xvvb(sfWbuL7PCc_CWR(?J2`S#f;VM~pvJ;w7_k+S?&cb6LtDN0h zounDbjN$R{vmQmC9D#k>P;=R`9Z-E-WiYv6|GiFew>Z8Rr=GC|r>ywq_E=DQ{L)V~l zlkaYrp-~lURG@*6CQGuDUS0shPAEv{F29$4wwDg<2)%O7+4qdT^j*Uu0rn6kRE3&B z3;i%A2A^#A(CkKN#h9CBZ+kOGyOQe_R8|IGZy?~idbtx=)&wntHkiqMYrVXe?N$uW z$krTo^PMK#Kwi-XOGgI^!@XE5+p`y+*$~5M(d<8wDOWX00SnnQ5ZYiSbvnZ z&$5Y5w&#nvK{!zkwNmS{9G~YDT)Ja>@=4_jo|#Gl8TZ$YQ*0FeTzkLbq@U&7KhfV7 zZonx7vOhMixiKhqbmv2VMHWpt*@+T<(s}dsRY}s{&)-&FEWc%#?OH>$83tX9b6hnd?M`ytnAGHZ5}N zoP?)A0})1Z)@N|etQXJ2!#2GXUZN*{9oR0 zOzqP74tI`h&}d+At{IZAfOI1k>T4^Hux#Bu@+OX)O_jP)(H*PSBQD)jIRAz+Tu9gO zlLj~Y^Tl}C5=;(hZeDL^|9lwl65BzwiH0D}Dbe(gX-2M0>Q|<(?N@rxtKDnGCRcp9 zo@pSLKR!g`R~@@ECO#~JE5>k;*pLd&c~vEXJ38op*8&Fv0gWs>bePivs$O>LUSF&& z|7{hHmt3c9F4WXYUfE5sI& zK#IY_p(=BvMxr{2N_O{`qpm)nvTR`vhd^F9E1~mSI4UKn*VcglF0^E!Dg%HUlgit> zXN+>hnVt1CQ#={Mw>fJhlDmZAR;1wcghIg!Xx_g}9c@Z}t&CIq`Im#d4$CkzBE$WdBM*Fh)g* z9GE*CQJM10-Kq+t@YZ@$&@vV~Z^GEF^&7~A;D{P<1aR!}4Rvo&B3FO7Ae+>|@k5q$ z+76u`NZ|vb?gPYa+ah4v?6!*e&gFJcL{k?2-S1k%TBs);f*7rDylyG@XRbbR8#I#! zw31}>cpd~iDDUZULp*3Ux2(D!Yqs+sltk?4TWy+)6osh6M|jp3%V9R1`^z^IMiYgF z+ODv6hEiMxDtWeKtPg}?Ubz%kTHo-f{#G$;Zbve=MwXPjNSRk3m;pIE9k&l7 zW`W6WrzCYFYLqcSxlxf}RWp!Xn5j2aUB=?&MW1Lh4Ua@Z#|8v4Vt`0p&(w=ARijCg z?)7&|AcsR>Z*z_~Twp>fS_%}MKn-rOBscl?>C+rI)q){LDq%E6-_VM;E4w6CVIo3-qzeu3?Cp0*-(NDdZ4*rg3pc4%D8kET{wyNm<~iSm>~kgBg_k#fk5+?z%?|0M0g z?Ka-+YlEN~`k7U{MHldHpRExhi;>CC_#=dCn^cSzKLf}9*j|&m)e#zg!k#00KsmFY zPB>0vwt@K$updWC>JM;wd!o8!q++Qfl|J}_wPV!4Elp9QMy8=R$j&8yLY2mkVa3t2 z6w(7=z%KrMRlB{F>7D=qNuomU2yjbRC5ycya^&&(l<{BTr5la^!rbR>)&w;q#Ms+# z_~#!LbQnV4^~<~tfU^sIo%p|unuFpk0Q}TjrWhb^b zKKwzEes7-CMaC~-yLTr@%7(J0M zSlAuP9QqaUx~2J0b#3iw;t)fq1z!rnfUxRbek(!!YN`+Pg71kw*wF z$T}x!C2UPrqQVj`NN-T;@}9A;khCkM^|R0Ap*DOFq2{77S_aMM|5ka1rLP{@0{_=vqXBeTiGO|{On6CgsU}eyt6bX^Z_VL=mN>@ z+>c)A#{ zLLyq063^yJ%TxM>k-1hQH2?G|*$w5_^k|QL_OJ}`h}ISG@=$Cn{ca|A`b8Qw<(ptm zJo+r?aLB@j!%OuV9HnG~KfY*e@VBx+=5ewALLB1aT z`<psLJPcxo(UCf+ZBF(z)nYGIO?tsM4>|&)5$ZLJt7EF-=l@ zAgkx@Y$#Mfc%u7g0aP6y2g=4FFSentr-NI_$zFNGB46Yd%vUQaHGgn}KIEh8Z?xCg3v z9HghWFX)PQt?=FhsA55WcD6LEPb@M68WbLkRbkXgLQD4FDaMkXP}sg$Np~9iR<>Uf zO$1K`YQvQx8_72Cjb-AQSh@rHQIvcI3L~`q-*>2Xq{KSg5nH?|Sfj5$q!$41=Gw#p zUPk{R z>0$afQ+z67QCi1e06G5HrjM|N>d|g>dMh*~kopDmxT5@Mcd9xzH~p+^O!O)^L6RuueP$1K-JZDe?^pFtPW8lfxw^rNC-h(G|>IAEI?R zMIDi-bBB%$IVC~i(MZ^9$k+*F@=jO{=Z<4)?Dr%YMKKWQ5UDAS*%i(ekj~XbRr2q8 zgpxCCI`-kb`7$$JXe{0;S{S&SvN?7uSQeDx79{WO2E$BJ~ajklD8Z zp^wh2GoqGhYk-a`t;xWiJ~4|Mci159JJMoGBy}h}@HLqT+#3FtmYGawLXX;k$yG5} zR5*16n4%DVgQpaddMUJQ(|1wCmqa|K3{Jfm{96H~gMnYxh>#pW#@&I?y3QSvw9k|H z(YyvksR}-Axgu~k3-9QdMRh^O4#8iTkJHR&{?rh{C;Uz2WSXZI!t5dB5LxN}&fw<)9(YQXnljbh0K;3o#ecZ}SsRb}AN;bmHw{Wsb9fWQtF&-0ciGovHE_9T9 zfOH6Lw?J-6WczMvFmD%U<{Jd1s`zF+QxTOIkdz!k%Ks7>?tT)G&xo6ppXc?{I|5y- z0q5Ok^`R&9WYH-Gmfp8saKCG+>_(uKy7IG=7v1}^Tf>E0`R%jgxI&acu>=L*-1HMo z=5f2nhcBZDow77?@5;XnH9DxGC@z6Ll@yoC4ld8%(LPX@rycDRZ3-MdaT;uoVAI8X z&i#^-R>i9hAOmlsY48eG0x$YCpctme(xgZ?r%3}u_Xn@~+!Zq{5ks4Rt2zuf#5^he z2G5Q0PB7VRMq)&l#PXRcJCNdQkp_Q6?X}~t_Zrb{p$lk77I1PitSmPb{KKP1G(9|@ zBNuUGAMfmgK2<`kA=4(;6GVHW@hIgk9CHJx>oeUo}%T@3}-VB^^6`G(I??WQb&)DT;e3^e1_| zl*8uE%r#8#=x=F{@aV_pZvN17rZ^+p|9OaNmvX_01DYsfuojIdZYX(DTzXdkV0t6b z$=FmDEL5d!Qk8H-ab8pMSh8n%wA_0H+*HYfKv=)8p-Ofp5AjS9UzDWm>1fRlJPgY1 zMqiBQ#i4ze^yfTjpU{~2^UNP z2uU{w*MMkSPubDRuds51%oEf;lIgPR$;mhS?!!>+%3{_fmA|oNB%uaJhs#W~gX#`( z`Ur^|y8I3~XQdm7)C|;)+oiOiKCPSjP3LUQ7zrfPkf0(Yp^RQ8QqEPVvNUbi5cQVffJX|LmAQ(HT=N(|^Cf!y1{ zky}}-X{1CdMSwL4DdQ$w9(>U--5bj@L!L|7Pco=*{y57d+vwqi*bU*J+#-;3GzLF- z><`w^!H#$KW0N4;x+gYVS!?oqi#e+LrgPxmm${`A*IgkM*~+CoXcgnelb%>gC8rPG zzb<Y+b-f3mH*W=hZVclmf; zII=LEs_uXGjC}bkz#YWMRN0`(H5x)Z&ZzBN9(=kjcRW&PJ}dscZ?=rzDhV@lIp-zf zp6QXCJTH}if|cq5htmP8mWMiGHz}irAu;L%b!|(;;%bHDh@nhJp}e&#eZEzSIm(D2 z23=*h3t0FpKA|R3s}%2mYvC?htE9LNi}NHSce-y(bezPia*C)G z(*JyZ-Yrh{P`1`#f`ioLqI%m z;6s`5pIs`-4}ACd&)T+MD5r&2!PP-u{Tm|=bB#4QtqS$423QxiGh?M-*vN4RcaotF zE-YTV2OplgbRHFQN;iFsz!b{tzVK(Vn?Hm&{)DP4R>Ud%Mp}SV8$(&WptKASGpzbD zgCYeKK4u#n9VtRW&I+)qG@ceN~9ObNL-9DncyP8W%I zri>Up=MUZN3eUSl1!D+y>4L7^aA_3^`%&Ue(M4DY+NQYiM6MI^(RonSwHwvt4Ho6x%)g- zzzst7tk4d9km6A7nM?gypXt>Au+9a1{lyluGb^0#cAgqG!^ZJk75|X;28?`#IPLqj zN}_SD0nTn2A%Sj+BIn$pY8I?JA@RL1Z2E{hJn)RHVh9>IkrnB z2OAJs^2vsXiLZU={2qJJ$nP>{P%S~!k68n;Okip1)|nk+?3LP5xK+t(PoZkr=*5ptd`b ze$}%1d0h;0*Ltpgl%)OJoEFq(AoGrQGVQON)^#1gJg-gavzD+P_|NP-`ea{Io@pLj z7#{e&7&AuyVo<7E!0hpO}q~6(!=A2ov+D)eK zOS`fjhcP=yaVL4+{H_O{-nc>ksF8Y2ZGHV8aSG{!(`iMXvtb8 zi`?OET^VU;3mV+tQ^rLXzq;B0?Fc5|kN61`A-+LQcOG=y68W&bbDzTe+;0#)&_*qxVeIn(OPETjy|C}Cv zIIiXcdd@n|-;|Rd;vRl2X^N$b?CL!d(G59+#Uc_&L|J+_y@hUBx~1nLlx`ynv$!aG zgwC}XUFaCr;z)sF&}vV&qFM_Qk3?ea(cR{b_WYdC zxj}NBNogAXG_(qW|CS|kcN=I7G#QvDVK-qPX0FI;;*h&*c$jNcE20y;u7+qTn0FUx zm0*~Nn4uGiiZylQ`9+HHBb*3XpXmDB?nA_&~;k3_YkerXj=K9PC9 zn$yi%0YYih3NLjPNmy&=&FCzhvQ0hkK5|Vy(gAS5EL%H#JFT{yI0%~V3CfOIkyOjx+|j87W);=t$rq7Br`N5|z?!D=+iW9LR@^(o)x)y6 zx8}0f9AxS?@$mEyg<5lBm?X)jm4Os^nm01hKm~GH@}KXie~5rikeI^mIL*jEzdcqAd*H5Efc^Swhkiw}hus5> z)1x0laTc1<$fa( zTK=b?B#mq~-Onk3D<19bKk@i3(mj7qFqU{p3vE;^NC&iWV%sBbV6CxiOMtx=3)wrP z5OMbLYEswQdb0O7I;EiS++odbQZvlbA{lefM*EIXTyIdi#K2_UOyo;V*k?UsSzU3v2myOoN{B*~nC33jr%lXykD zOHy-eSNAE+DIw|EJ5LPTa-k548^kkilRhubX5Yj8w z^LN~5VC%1eUocdnA&?%xbeJKdLA)#Sd15qyv4LP3aBzZ!crdXBcMFD3kv@~f0Pcrb zV{(BXetvB*-;}poKNjJJw1kEilElKZXh=|}DSr^5B|jAlWvgSUdyK*jq6ny^De04T z=UB^s6Kz{B`_+{6Uh3%=cB=Ca@Z4R14Q?SE3F$c*8v0ltDY8YbOjv1^Eku~Ktv7XC z!XoBPsB1F?g+(J^qc`KC1M-9P%+}N=bs}kjvClrGIPnmP*RYZ=-Zg(1X?O&Q#3o#) zukO|Uaq%zIUvj_hEnN%G67tn?#9`ko4#11`pIMVbS_11LF`(siX-bFAKax5JMD+rr z9lO0Red0^5uvn8HTK#yc5y2r$;SZ#_?OhB4)EMbiSUm7-!y)dc(j}P(ZdWw*2fNFc8@?K|c(J!H3Z`l(F9J zjjRTI52iB~obrFx8KrB9_Z<)ns4#upBjH2(Ue<^-Bwi(x#~0)VrzUy@eP_Z}HIxNJ10Jse}mP>#@yf`iH#w zr7fa)TG zZ#2^!6BXouvg5XB{vJ?vS^#Couc4&HJ=#cMW+d2mj%j#;Hy^ME-mzZV#BB)$MN)Ab z#n(4hv{0{nMGA-Wy%Ul}da=6fGr&?tp8ldO?ahd+9ezf1C8Ph=x+!?tw(o9|xMTOK z$Vli7i|uZ=7rmDW;b&TVc3d7DlRDjv*#q5x-v`jFEYt}1<^#m%8xM(VCng8gu!upd z^hie-#6MT-8BnJ*hQQ#jsarUa0xEjAw<)e)+_VMce|Ia?O9GBlQ-2AUDbLp#0Sv%# z!lPyZX)nub1CEn?Q-40Y8ZvtYn|bRDZ8H+Uv<7+co7SH<+xtr2=bAC^$BwS)%pcvyl;o~;+ST6 z3oe=#`xj@W0lVBGUXy|==9>vN@Vev#+r+b}Gt~k9uXpcgN9;ezc~x`E0f~ucG&IFV zO7REpBe3*x)M+646=ixr;I85xCF`o^R&2~u!0e#Qwge24KZ*|7mK;fPcgb>Z`)GF~ zBFn`@l0W@zP?0#dQ&gH4_1m^oxtN7mB+BxZ+&c(6;?L)f*(p%N%!-V~%r1w(yMrq{ zJT7X^d)pW9H&?fDImoo_to~R!4q~+Izy^<{Y!tc6q*^L$+=N^Twydpk}|7o}UM;C$dyVbL)2Bhs$~3Ke}l&Noic+PPkc zt)^uevMedu&1u>Ie6`!|*NW;9Ij)Su$9Lf@H$vq4FMP|5g;8uz(QFRj%-P!qM}%Z| zGDVKgK^Y|V^7xJ97d_)wucqbXBoZ<~@Tmiu%KUpjDr=LABVfx?M}Lqv5ZRCkC|L6( z+mAX$I)eM1%AvgA{9@_cS>ST<6xQ{(H*K`NJEX8Be@Hgsq+R14HSecf%MH;}P^9lk zAO;{JknQsigpcwzf(Hrlq?b;;#=m4VFrDKR)Oi<$7O4^R_bXcR>0!x0 zATp&M5Q??)#FT;~u&Jv_De?fB6dMh`i`R?@xUlW$l{i{__c!(M^G9T^)gm-dRj(9oAXwg)yrn zT}lbZl23&TQH!Y@;QCC~eIrd&v3A5SK*`9JVop8i$S?>r@MbVsS56rcr3#K%C5GY9 zLX4C3Np=#rb!BKKrT{dq7lW>2T|gS_gh{-GAKl ze#JAq@L(E?h7v}cxKVXbyK8sWfy-8XBRcMeoSRXV`(zIhYiNo>G_VTdLn}y?SgPRsdhvvaKxih;RnVei^}Yx z0a-E~#2BO6SfKg?&>kXFh1$)mW_CFVa4-~#AUdgA?qbof8o4himG4(Fkx=I$p0WRGnmxl@c_kX^_7ubJ5JWg;>eAcxYS1)B)uZfR$W^ zDMyjo?Uf3#l2MO&j_ES`0!t0W`I$prASHR2e%Q;9&$3JWa-Gj9fl7s_^C|y-BNgU7 z4V$BYIud>yWgLlgE{4lB$4PDhNnkW-ueAi9Q%rxolI-wG;g zT`w7n&5`M)qxPmBi`h;-f{LNiaLB7WPj>$CPNMyR@wl8cJ2m;MPrG2PJU<`{D)XZb zRie)-&2_^N#Czf%)Bl+C`k@4*JG70jOqFi=<5a_RN081>pqt?6fHuilIoWwplK*G; zYYjzYFlW%^(rpLLoTmN%S_ya=e3u|CUW#c&3eIFxv3fGrTq7ky4oeAwxKAIb>V@uo|bj{GA)R6>fBidEqgDNs3v1rhME zP=_MWxj=Kv`KZ#7|Nc&hs03maV@>+XT8(VeW?d=CCl5d>hrH(G0XK#y(nKLy3NFT=`(8rNSBA-^Y7KLt*hMl8dfz3m`jmSei=XpICIY^}GR=2L> z!y>U$zLJg2^p|qd(ui2putXwVmM2Xa6@*4EN7)=_ZQZYdlg+2hGt4Ba8fwiPXOv@& zpP-#roHHbXz)omK|3k4Xr=~0ikUC%{9cfY34X#0v&oK0?O|A3#o#lM2bCVW1?2QxF zy4J#Hc8|CQ4d<;4A8p=ny?v|p_cS86cC#8XOfx@0IT@W7-C9pG)75W_%Y5S%IEts~DwOf@Y(Dj!h{l zq6-tX_Pfppc1q~Tyf;R6Psiz9IB`)yj1KKAksl^=`!~qca4GlITE90h}owN#c zMoxt=-}5=*)a6N<7$e%4@5$hnqU<8y!g2_yL^)Jv`OeYIsdjui7-iI@0+ILqkD$R8 zncH7utdNLOo<={$qt6vb`qaz)7)V^hy(Y6WGwzYCc^pa7Yx_Y{{k+7n3_$|pnTGo@ zM+^JO4?9EiKM_$pz^CsYWVYFC`9c^BLpBkRD6mDT{U?$%63IlzLTHhTbEA?rsxBcl z|7C-z;R=>NZ^9YSeU=2duo+hrV#-}|_26np3V3;}n6|*VL5giai*!5P#~vof8P1Ki zfFolJdZf>;Tbx7Xc*gsI*JbP5ec82;a>#ba`_HD@YWQ*wnM^?^uM82u1dAhi8>*AI zb&j-Ay)}=<%)zp^ntD$iqQBD3WZtuO_FeP~R!cE`A>kJ~jr(Ad?-j_50LlC+3Fo&W zo)FGB8P=s4Z-8(LzysMSUi=y{j9+;J4?(;sW*>QImsh9=01wcoL|#c_mtDr}F((;Y z|Ej2WHQRnK!reO_nb+W@B|o4GKJm@fWLu7AiGM>48Px5E zHO$Am=*L@18y%KlZb-5+lw25UP8MX9}>q*y93#iPqKRbA^caQ zrq4f2c!FPiLI?GrBm9j>(BrPPh?T+@rJs+O61<3UPvK3`8C8UNc@-gdsof!)JwRCV z9LGiH~tV z+nc^n$$mlNNgZ_=VdLV*W+0Om%9RR|G5VEr;!;FSz(4F0*oQ-kQyXJKa4%f=g2+!sL{7L!?qQ5FN%p{gt;FQp6EDK81((npb*O3 zFRb{1{T!LdyZ8+4T5&I@O;{sQLhg1!c$!puKL^50bKs?ZM1Cx{YXJryfChV9A8R2W zV1mmo+-9*WXPlEj0z)Bq5`tf4i@}p>UtpS1=Kr5&Ec!RinEn4uGfMoeK;tIe@9$DWwuAtH@f@+Gz?4*^1t@Zo zQVL@y$)6^(VQ2{Sy@`M*@%I$OcStcqAk38YVjXU;V*t zLba%R;vG0b{76Y#b>(z45QSPtIeYhC>ufqO%>(vMhu8BvLFcMXJEWitNqh62DT(1~ ziqkEbT{bu-j0nAL1$1IMdK0{`NsNmaL7_-Gp+cG-CVdJxP3Yf0?jop)*3OC&5=xiAJ2Qpi=^eys_(slGtxEK==@Wu7QE$O5A zrPbk#RsN^BmCRv`XL@2>-0xGyzwFmnJXRCwYy zCEiTgB&gfy5*rVn+ zFXg9jqa~UQoz+FvytHu-mTHOka{2SZdik1kaX_#z#KDIRM~;-(K>-{`57ZcK*-&5! zSg+{}aSuk{xlP?t4uaG<>b(;)kDb>rHaKkU z*UkC4B>WkIFze*B?NDQZ!q6{oT-UL1W+Ln z5mh=AeOqGA7GMy<(I2s{Oogr>^P=&H4x4Y@8(g!^dMLQ|Lk?i>qHDi1Im0P6!`CQW z=i2RR-)cU3dS*P1x9n;^PvOIjx(FbrZ$s6*)Yin^T)k21EQtH4y%mF6Sz`zu3ma*3 zu()+~lp0HO?kLTZo5yK$P6i99KYEtH=bjh$zO7y1lk`RIleD?6E%MUZlzg=Gt(jZEN5uWkh4+5(r@H$b@VQtOdj2_uAH^U zm_6bo!}MQLVy`g+l2Y@MOtTK|8fpLn6Qn9o=?PIgu=qJgTk78s67$Z6wD)@$R_0OywcNU>MG+$RZjl_{KoI`h^^qvu- zgF89*Ywe20LG>CI&KpTvvgoNiiT<*9(@qSY%|~&nk!S1fT$#(1Z+Yd4`ol;ZOP5fe z-VSJ^hTl`-3iF`C(gTBL4Q>AN5tD!wF~CoMGyH&Qe2t8bu6wjCTpdI0@U{`CNsfFMMH z?!dEfYzrL7{s+j!|N6?fYx-isg!2W&^L0^`JFm%~j}^8EMF(SMIxvb`g7$>niW(p^ zZ9fLKivoz=P5(Z=MAFjRf1<>w!T~`XbwBU-=Un;GS?lPt3%ly5y{iH)qb7niiTt!1 zchsE^8SRk`85Z!9G#6+iqy|0u)ufW8wn;ePmHgLnG!1%U zs!7$%@sb>ShTy&$byk$LU&qndzPM1r)#e(3^vp+V{yGkD7_!+e0{}l50)ILXblE-* z#>u93s%K@Cx3WA6Klnw_>5jenhup`pf`CwRO%#XIDv7|{W_MZ*a<%ciJwi|cQWcAulatrlj}}XB0WTg zh$5oX%HB*lNqQ0tQL2=;uV*th6&186*_Z_poP4RU5YX^Mdi-njL=>mkK7hABf&MU% zsBn#FaKHlML{V`ao2D0>vSrUk*&q6As;{>`2)Z>>9tkCoHU?%v0)p`!1p_5C=ht(y zL$UM3FN&cJz4O7kpZa{55q~Y}1!NCM4N$pX{j)J+5Xje1O} z4E$0u!o}r7GEle;Xt@ngi7ECN8xq$g6^+` zN#M%v?;^3quGYg%`lmmS(Ps7OoK0wfOGVI^J6h-fZOiz0K49C@LYXX z*78A{=!((pg$CF9Mb~wovMF8oB-C~Xy;SlKi^|?U0cH4ba zLDD(=Mq0fpNJZqj2PRA4R=zeHTT+XW9W3TSW zBh^x|n&fgi$csHET@`6uRBkl8P%W+Hv*s+pSUNobZ??g$R@b(X%bF#sUL1w=os-?{B zCIvjMcTfsxA0|ee-;)GT^3;OCt(w#h<)FbvVHHMzH+Z1U7AHamkVMjwMjFqQ=G&{T zgzf6^`nO0cf)qYlG3>Y^g7n(5R~@}qE$=YYGkE849yEl+`jV`X`qu@kuJ_~1I(ks6 zdt)>K;B$0zP!G*I+-sE&Q4hh*A;d-C4#fV7(QhPkB7Y^uKyx>C13etf#YN)y1Ur08 z{ua}@BPv#zS1(}9u_C3lmO|f4z;)S)y{z zp?(kWK96zzj;(D_6)@-@v_NcVSkAe$J-1K8MN^K=n^52}SN@=IPeH$$mJg}oZNIw# zj7D=6`Dd12(MaCV>jShCTuIKPf9J)!*+=gtz|qS->e44Ciy&qCk1?{Mts?Hpmxa#J z;+3*P-baWWH0So*zuLX?Yj;&;Do(DI%t7C?@D(U4+QuMnLYd@zndq~;XU+x__6Z{D z$vo^mNJ5pjcBevxcj$k=)eQcH-LV7aQurO$)c1s5#uhi?hSC7~4bCHy>0avQJmMZJ zzMFt$kCY1FORBpkGHc8t$eOM;M%K60!2Qo#mT2*+*&!byz|9!&fc*fVJ^Ec zEX}&aOB-|;@cZB=^?3B}FYIxj_ju%Mmvai2tHUpRPh|xPb^G8$r2~#{ml4qK#eblq zJ5Lyva;|Jo?$ZDXx$bP?2oBRrU9NrnFzdG=piznU`dzX|9nRro|Vy#OgMv}U6U4-~Y_Cyu-A@E~;*HtKtLP2zW<1weUp3V3bj;PA^{P9zkq zr@nXoNV$UM4W5SHG*cz@f*FCl;l`^$zcAF6~t>g81O*t zdd)>;A`?ID6Q`BV6+itm{bS7h)Gx$7v`)+!`re~-59tTBS-nNks)e*=sZMl2iih;K8;;x=t9p;*bDSOr^#JQRm^c!tjbm} z;zB#qe?OmJe!@(cAlsyiZkOaRl(8dH9G0~;Dlw>?Ug?>PXEEXD>&Cqobw)IYEQy5J zeCID}LDYusNcgY}1P1zf&T4M{vxc}$%%2p*aY#cyf6tKN0h*>l+(eD6jr1Mngtboj zn5v~rpo)O*j!gx4}iIryAn3 zOL-lT&%&_;_^7B8X}+8Q%Vv=`1;)bHFN(ZC6+ze+MIMQ6o@(m*WKs?hkRmVrIQHs| z{xS(7dgVBsydK44@Z)J8AuhvTVXyUxbn*ievdlML154djC_22<+$w~6ygoU8`f-sB zGL@z}F5X?sGc={K3Jic7(QDNoYTXaxQbRNlEzs@+A!F?C3qztA4M!pSZDOl!Z|2lb zZwst)X-~%Y!D~Bc6ecGS9leUvZmuh{>WMo`n$sRxs8iREr#pJ{*ro)q z?5|@zI?n$tq%F2O9$n1fwah|?w8nYyUKJO4A2M$ zPuliMfmUo2UFTEY6?4xfyRhT6{kt)Z?7m_2>o<}+(GBmOyT3Qdq^B3GcdB`~IIicG zyNyZKSFYf#GJl)Lm}HF#XffY&AG(b>Y)Ci+8V{b^MwE{{weI18BYP7<)tB)+S|C@Q z9^AAt+_ajy>Ffb=qOOqPM~i&3Yz~j)j)}4ddg2f_lS@fF2n8USl3fFD2WK3^vmfIxcKRkW}ptDaI z-Yl+ee|(+xZQZVIX=2GFSSjYR{~)oTu&(IBj?T6q3lNy<+5U~m5!q~qLd}oWUW$H8 zR$Du)3O0^%P=l>;34B;a>~Epu7ZQnS&r?!YA)DlS+0TpJBOMlrTU3q%B9Y%D?ojWU z%5#;;3X2{le|5f&rsVloM<99SK6YhZ_FR`SIlaM^4?uM~dv~y*wf;Qo3{%9Rw@%2@ zdU{$euPPEgt>X*m0>(XgCy8^?6&ofYyrLF;W_c?b!DqFmTb|B)A)$K8l^jR;>|<^F z9_T&K?_=|~J^ue_pT3Qh3jPBGGAcolc@<#AT#;^D`dxj?$Ue zqp1=&$t4MdP{2=!{99E1_us+2iq^A~Q>wC~cVA4H^u7|avM19f3HB`_$}M~7vz>UQ zFg&^zdg7#EGY~VJ0N*6xMaAVi+k(-pU4T~9yPMi`c4pIui~G`)FHGL^518%Y$&9jB z_dU8{S1>C zR(hcTEmn3RR@J5)PuV^97-P}@{Hb}y7Vq1D>o@XPW;g8Y&T#!iGEu{RSunE^TwJ|5 zU~0f3f(BL0D56;PNtI@wnQgz(Hb)VJyk{=`h1=n)mN+BlZy?V#G+ro2SDxOun0ofZ0IF+t;?WP?BZ zu!D5=Uh~LpLO$+DmVzBV?!0Y?;@bHzmOy4~hTnRoZ@D^zh>3*rU9~Bh_C{bt&%2I&mFS{C*A*<5HXomRq0N`Jf3Y~`t>1)>KS56 zz5z?eYaq!N;yON`6)*A3?^txifWE52zAxk`_!j2s zD_zrV&tHe1Y~c3=*nXZH_{D2uaS35HD_}is-}qhqF*5T*&%6&kF=vL)I5UUZqnUaM z-Zk{QWH_R>5p3`mWVnqXsSYPWX?hsqq7fQIfuQ*5M-np!<}V20C-+B?n=PMom`HG| zfCc8u@=!F`G%VpD@Sw-F*}gsj1EvKB2DH3g625ObX;1H!!4D-ex|t7{QNwt7-Ul_z*pc701 zH}>bt6I6b)vji!-T!hk`eE4*BTfSIKS-13^S*<1X{wBVucGM@n7fP$Mt(75UEJ>4c zBZ_!CqMaw_9Zp*_35kR7Uf>X{y$JH!)NVDthw(plyrMHd^wvb~FBEC_FAr2(C1Z*! z1{jafzfp?HFDc7^p~$Vk#8;8RsoeDFr!|(NFC3Xs&UaLu9*)!&g7oNz6wOOtT~^1T z^iF3QuufRxwgfd!Q(%p=N01I7i=Yl63QO~ua zjn0iw(1te+!H6lY4F31n%te3NBZ+___SE<47>W2wtT=kp)#cO!W&}io6)cfX4X5N} zu_S}|G`PZ7(gNxK3HCX~b#M}9I$CU)dMot$3*5j1`>^COf8~LF*tW6%>%)rfq?2eL zVp*hvIs>WL0GBfjy8lG`440-ZXVxIpu!@KZT5Op0-qTLDYs`3M1VpYMZb**>PbT#m zeZACT{!g{9$T8&zQGn5r)5n!yhZZ=}tu^*EmMM)GQKdLpjB$0kAJC$UyY*G!Ak7nP zElxuEctiL&gLj2f`#I14M5)>Vc)rpkGBa~4LDP$Sy%XB#0b>*DW}}jaYtP|%rN7&I zr*T<{zwzZdWc-~7%3*$!{-mz!A6ew4lkSQicGsP^`cmSfA)KMUKV4UuY>{st()59} z7P0(DJ|mZwYhN(v?1qT*|P-lD!(Pn$d_2Vxb*j6Dst{j*Aa8fx8;fddGh4uNc=wl`5=2M+qhf_Fbk#~ycW~?oCVnKAj4redYrP-qe zE{f__UfkWprDL4K3fkE1Kx<{k!>z~PD>ABfwH7F^lxILWDd2Vs`Rp(fM*i~$fbkkk z*f;mY7*V0^Qd&FOlu$sb+kX$} ziN5&n40sl2e%p~WtY6<^xj}Fir{Rs6d z6L-0ZQ!E4rcUMv+CL%Nej`&bA6L(KENWM|&WMNksWuDC*Qv4C%wo*v16Q=!1l3Abs zr-<6qQvn`b91MkH_l#1WlZ5!#xo-kq=iI!!5b#m7`Esh!q3c7k@7@*Gv*`tC_ghRY zvZ$|$^}=aL>aS@Y*QL5B0m%2w=QJyZuDb;l5Rng$&bw^w9^cM;^@5sfv*HQty5+j? zaI@^KLHGNUvVF9dpyBro@&?2huzP1tXt9h9=;<^)L3lA~5)4503-yhNvXGq(c-Krm zwhx9MkDmfO6TLsH@MFfN%kbmkpZM!4L*k8?->r-h9M4nQ6c^Xm|52N4u9d(nbbZ3G z{2a1Vz>ebJm9nw1<~KU1+fv}oylC!h&L?-aA?f*Lhw0oc z#9LGJ4QSYzmMvVpFDnSM-uJ8VXd@7e@Lie_ zFS7}wehnb``uGZ8<%;}1eII7*NBM>(n$8I;?jHidTt+5|Vt*{4BM}%3>_vvek3c8^ zqd1J=bWSz3zd1pM_F8-cF* zJPAcZ8*=)5`9BR_-VUISc+bfVXL5gm8nMb8XLex3c6JRknU!|yh8=P16Gb(#M=y{Q z#ofRjc>dk%z4!|NscFIJTcm|Du;7Ut4hcbH#zl=sHHr2c4!NJyndtLl`>-G)e^6e( zVWCn2*2GjbcE(F6(rnRFyAKKbA184M@%jlW7;U6)X7sg2O4#5O8--b zJHqvXAfHY^xSITbav#P!BLAtw-TnL@XNctgafb52QELt;s%!s$&d}T#$A7}G36hss zpBOif0$~-wc&^Y~*CmEW zJb_Ct`(HL0Hgp9<1FJ;oS~r<-LBl_b5rk-=cY*~_fazlMb4E~KZd5kisox?#M)lYE zDh@-AL}1GCjziKB?Wg*36C$NMFB{SOlj=>RP9DPMOhY3%6i&=0Bh0(TMcT+3?GPvu z8yaihf{4G<)}!V<@$0~;g*;M5HKlP|f!53X=tGa?BM z1IVL`;R4MqxRMCPh@ag-th8@NkV}wAm@G&vklUM3W3i|~?%0;3pvbG~Cc667#GEn$Vx<^JAcpeefa z{ixAp3a4 z$B(Ojso*GE-}lBVGMdrhU?RBi!TtireMQpNJwE*Qe)*yK`ZG3uFGiZV63)AvWLdA9 zH1U8thN8Pg9FlOF9HLZP5RjYpuj(X050v6VA@yyKP6z&EdL07Kpw$GZw}r3eK*r_W z`!K;7hrfzIZ;vyfjF426j@pQ^ z9iUI|J#JnLm*b{pi+sLz95+=Rr$Lr|KM8YQik-gwR*tEscB@;?fc$R1b@Tl`caGvo;^~Ce7L@UQ z)WV8;5*z+ES3TDibfR3w5&Y*u0CwPRLRI{vB$|Z<&+Y23Yi6Dq^3A{=mgjG9by+pg zR@n?#OqJxq*CAFvI@EdP;EWal3L*wCeTSG zGPLC(?s?Xw0B;V`#8buihUC7j;MW;X03N%3*1PE98P?qD9*LXw@@1g%#Qe*!ieaZB zYQ*Smc`5)aRb{_6OJWwMJOb!ly`Coj219MpG+m?I)B}vkWq9ilkKSjE-9I zQ<4b}B5TPfVMZfq=ym6dpW99KtXh+c@DB$y7wdvuW-YB(3!INH$wn5RW82LIzpy^e zJ&JK&5{s78+lKuru!B~K+aVL;wVo-wNYo_hE$Z4IdToyo&qfeMi|d&Ib$(Qary-^v z<6g(iu1$A7>5QDCw!&z+P-WOTkCrRqHo#nVsdlSno~CxX=XA-+mN{nh`5h)#hKR?? z0j2Yn`;Ja(O%n6_{l7bYj(<0k&sO8VjYt|&RUx~X5r`U$V!XgK-b%m+Dp*Z!1ZOe^ zi>XmkxYcu;!ff7AS_L+B10bscG^;^5-vV_8^PHNKym}~oDIw+7ui3eUKR)*kKf`?A z_Zby-^-_!N4YX5ipay^{Dbw~@rthPe5$%k7!ac{7B}NK`O< z$d+}}$7i=;?zE(WksUDtGH;4&!Rtl5DF>-iufM%WA2qkoKNJby3-2$YIxMKMi%Zh$ z+f;yR;qqV~zC^q+dO^Mqgzvn+Ht+5ix8jH1k3}*w{(PV0=_ispj@hs!oO!Jf@#yL$ zz1|5g+N3smIhG{9kH|EDYm4g)K?c4+yWdUgZFc-Jt7e9@HMPSWN#3B-?NC$5ALT5m zoyLSKLz%;_NoSyX+-J0JkG`Lrulv!m4PG0%xd`_6 z(Q`^C{I0DWnfZQ6aVH?@gkw-tA6jT1n@BQGhGT`l7)$@!{;q^?5a^ntK2Dyqv3MPJ zZ7s0TOg7$gL=E+ z!KR4=r|~DI5nlma7Oes0c9ZI?5Af7v)Za_+E6Xjoy_j-B=#nx!@{?12gqgQK^&7tosQL7AQU<2=Xg(^{gj~LYYkKp@Sp1 zSa?CYAp7uDMI^i-8RRuxk?IVoWX~qjmF>uuaw5n2h36TWA(!p! zO6Lnlt;UK)wmZi*UW;E=mEhy(f8=XjC@uE9SkhjpTDO>NcGo7bofIEV>1%!eK;$*- z29Y)+C^ipe#~op#eUNA!0vi{4qK0IGUY~RdsK6P*`#qd4*Suzb>fh?_!pnQ+;|NM9_a^G+ za4zE;&j&F@pP9U>q0F$>CfXJ3jB4Gm;$P1=$o_5hMVA4XinlM=l)%jqjIPacq^dNlPECF1a~7j3>`CIGtnNs zK`A8thQHnV@7`mi_WP8bZeWZQGdzFoYIJnw74w3xS6JOn_pR3S z@i#X-MzvNR+k}OL72p<;Lhf1)oF!20IVB+%oPY#Pemg zS$Y0W7wJ`DsqMdWG?+t@yq!>Ix6JI{p+rE)f5p*^4{?ZmThAJudcQ`*?|XIBb>n=z z#dMn%;F-KUGVJsu7Fyc=Sj^Y#t9+rBH&4TY7zPHsx^f`^(=jOLv4l-a zTlpRS6!d$w7Cb^C#*|wEoq`}fiS3B{FY8gVA~#k&SgE}{=h3t#TX168R;*R$bh*|z z?xux=IvpDN7#V(Zr~zk3#f=Fb>qpAGM<9QafN4c)GQsbZbV+lUi|!)wn8!#CtR~Z` zj9@nGF)vmb*@uE0odRpN{dLTg^{n&mbbpN!8X3=_(j5a#tI!aj$vL|ivqG>pVqRU8q~ZCaoJWp zy4q1A$FVs-x27^(GJpaih5neZ^w)ZTGlohf9&^!@rs}+G0O3I9wPQ(TekCsF`3*Nz zYnWV=dwhOWSh=NDAa3*0Q9Xo|bZ*{xMWkU(x^dCyciCriXBkyJ)`IN%HW}Z-mY+PP z6nvc)Y62B;a!Jc*6R&y;db@iTEZNOu#u*cbaqAj=)PLzT7nxUwn+el%av{0w#CYRLsi^3N#ZuNp2)qX zvGDH2vf-0F z&1yH1_cR6Dh$!29#g}!oPcmnV2<|~)b$i_Y?Dk_n3!t7C>qgVak-oxXLMORP?NNm{}NUdliSEX;W zavH|>`Kw_#l8eR*4UnG|4`0_2Z6PXT3uKb{wO*>BBH6lct3Di6% zz*0_87>*^4BqJbLIo)DLLYW8YU~&>jGllR(if%Z}snI&)JrlKYz9*K1&>}-%ioO|N zZFaJGj;cQ!Og3UTnEPCIKb=*#)bV%sG27F41$hf^a8;qn{X?F-8%L&}u_>F8JzoHh z%aa)wnwr(zt!oqxOFa0yr@4FMRRGu|vMmtMXs@fZbc%BHs@T4QdmSk9Hfo9GSIyR7 zi5{HC-e{mB(4oq?GIZd%{B5Oxb}wOWRWDCGd}(=|GPktMpwexHrhT-p&j)WcPNZeo zShcTO&0OYQk>Fi#a?fu35-8O{+AV`NjSEw;+ZY`!sOOG+t~K44c^91~6dOGwpCv1; zhDJ8n^i9YHiVIfSk)-ZCPSxLtbM?XBNVy&EwKk+FACc3%H;qs8VdaD9@i*}uYkR<@ z=jut1jd~7N+%V=M05)#~bK73&H7)BEL^nEUsX8A*Ocr<$( zeY+}UR-}Y-_VbD=d&7SnmHUoFI+FB&zhgo zP13J;Qp^^qD=T!z(8hN!k>e`42U4pQO|_{j$c_I@OBGoY{Rjb8mByakrnKu;7AJ$H z2cy;bY7IsWDwl;$U_W58_waZ-$^4guD4FW6js2fOx43N%UGalCG}H#jkLcEMTC{2H zkci#EM{;aIb{-ekW25j7-L z3WqIbgySSa5KT{F6%_i~8Wq#sh`)W8Ce|J4Id__tFjrf)wADa8aDSZ~q zn7Dp74T`dLuATjfW4z@icnk9ZTzw<{W9peR#G@=Pcwqt!k14t_^CiP9F)RrLN{&?C zq*n&HtES9_1L+lqn_@#bWz0bu-G@hKyDIjIhj?9I9d^)j=kmJrptwX#E1Ls<9oy-G zy5z0a&Fv+q3yROm=2SEv>zn07+b`%6QUTer?h!QXpae2c``?mnZk{pTf#md}LITRanZVr*_-}xf^jVi**?$UI03!DJ zXNl3qOPO3joO4QR9^pfij-1NxSQ02E64#D+y8~M)*BfTIyba&esB4Q{(TU6N$N!O1 zBcuPl_6T*QEfpENoQI2x&e=ZZ=84~8DnWe_ebi7wa{cIWh6G0vGgP&Bt0`I7IgvNK5@u2XXD;jcFV z3FvZ7YkSOh;l%plpr_2Haw2SDzEf9?C@#zFN~E-{eQZJHF>12PIjE?Kci1jcM*%x; z&B0fG!SZh{SS;`z(oHLu)+KCOiFvH1%aK5NHHni-5;bk;0<%f2O|>=#-KFMoM0e(W z6&fzK!gjSMj`Yk0`ToXY#*VASiE}R@*^y_D^u$My%oTR2OBu84ppRZKj2)>sO&m&m zHSI}TiB<0qS@9I~qJPeIJh%Kkk*r+uUcWL@o>o;@{1-GB%2V|a3M ztXc_B8Jp>qAlxt^YRNuJRGt{LX*BDs5rP?_yZ@EfdQGclz07}k zox)y?&bJi6v*f)KNe!A)luqCriMDVq;ytIb1@1kTNu(s~3YkB{$iRxwl*PU>Ooz5J zEC{$!KvSbXKwVvtaVK}K_H~x^F-gBlNlR*#};@CRgURcHGEG4t?3O-s!iLhp2k4sT{mlbn%d+ zdjj=g-=8G$tQ3UAT+boJ+DBYx?Hy;Nto39gl@U#e(gC-y@eNUO89Xrh z+t1oh(2#G(Dtu!C5T}&OKA4ie!utcFB<`d(aaZln=jZ4Phba@b@0;Bm-(FlYY^HZy zkCuF)eYl-(s=Pf~E3997aTlTh{RyK-7Bl_0v!P{?i6?A6UQpj|f28>74jwLSRCVqm zk)?T^2cWVs(T-^`;`u`%9~y#FJf5Z|nf|y_q_?AA+XwL2npw7&9Q2n1 zm0Segf{9EXZPXlZ(s}&r{J8W?kKZ};Y?6|1+b}a5n|^iuc`zcphDyo)2zKLbrsiIJ zM-ce!_Oa?%t@8ZNe;puDZ0|BQY0-I4l*2$+&HT9~z^<-EaEqkB5{{mr1MOE&|Z<6?!EtBo=WaM5si}G{7)%D!kdhdZdx~o=S zEoInq=~{VJHuvk7tI?>9e$zpiJVBbYL%9AsfU?@QV@8nFU-gk9QtPH#^P8)Y5VHH} zv^h>2eoz?7y)yA1X}pGHVPz|#@IEiG(U};LFMQ79h#naIuihn?MC=|wM%7zCuJzdv zZGQkKHYkFHKkF9ArNZ=hN7vnv+~euJ$lZLh-an1~_k$PQ_Pb@SNZ-<8Rd5B|SQQkOb&qDLd_!M^n9#LM1 z4?ZON=|vOG&;MA*g0LvL)g*PgdA#&LqzkJ!){*wQNpW{^?YsJ-`YyA=h+to7W{X}u zFDew2QmVISwW!kN29}lz_;Ci)kUk*pkIs>3Gp%xb-$VTPkf6hR@zA?e+-i>S4HDdA zc!Ht}5r?>oy4)VBJL+B6BNTdBRDU$i)!`a{p{S8Gqn%B4pMH1V0d(~w`-WAi%kaGj%@nIOp(Bi$$}>z`vV;JQ*&Lg z-wV+O=Kvd zzuHIn-E?=;AtYQfyYEedD~X4-s$zQsW!_M?KYu%-gxSHS(zgCalg(NvJHX4_%@Eh- za7ij9 zy2H&^UA7W1xpH%B5FhkkO80~jbRW`{;rLn~UrP~jI^Sil;8$q$^V9Btd&WMugNn5E zwO?Uj(Joi0@c9n8K42)08*idz*v!SnO4NHxCw`_>E1AG%?@X+D*&xO7xgx!~N zT|RAGx;$OPFB2HzT&mnGI0TB?*iDA?PD%Qr3vWD)SAvaTn~rc-+1dJWP;7jKW}ZuRL#rH_YHs37fQVOKC_e6pIl&T zyutEfpZH);DWEbY8rE?x)_vr8bBbNm08vv*aTe@%#OTtue%)mDAhvfDA@kJSWwj}b zZ8)0CZk@7QEMRs`iz^U)-v11v(?zxy4lWK@`psAvJ|$eaGfBqDYoEsp!0@;r}m+>k~!$|JTb&H^Q-S&^Q~rx zrvN`AUNmk;yPQC&v4QRQTahZ@A=}mY2%{>2>))BoPnKBOT^u2XcmdYqT;WG2glu_x zi$Gu@N+VN6swB`B!gNj;L1&?UYj^+V{La z%G#;M!Gw7X1*O8iQ*TBv_PYwHJn-xR{Qu2ehaNQZEMy!ZI=kMzrm?>3symwU&aLl8 zwYH);L8E838x&Wyjh?$uwC1_KR;n4_u=Th2@m!ovM2dfZXhtGWAsYVVFQyJ)UY0$q ztyL(YcgSsDO!YnOxq_I7@<|7&0e~$q$~3S`9-q@dc+XW$WD=7^mMh* z{)Ys)2}4u#2{)KAZSHaETsC#4@lGGV{Hnl`CiT*aDJ6n3bG7cm4(5R8I@oN(+ShI& zeSM?3X#>XLHl-Q=DsmMsQ^L5`=G)x}{N%P$ViX~7B>TJxwlB(O=9`>>!b2rWZTJ?ELZOX9g$N=sFm~QcTLxY^!W#I zTRmM}>W#s~Fln0+1lXx6P(6=~kFopK!z|z32@i0XR;b-;%`VRLOr6KKp5>t~iUyYd zZmiaBT~rf(N-LA{tmqkx#TD1qVN(pZ%fuDBBF`=4u;(jxZMk%$Fv9lb49XX- zts2h>Akpg1ERpaS?YyXXl(SLGv}#_PUc;!ZSu9-?-#M-nSJT-jKON>t_Ylh>lf=3A zcqzA!U4nM#RS;Q~nXhl3HypZW)@`u6#ed|m^5REBFPg=#EE0* zNvulZG%@byb#;ShGq&56s8zZu?x`#87~7#bmqpl|mq4mTs>a(^5-4Ng!M=yopcqUg zSxfM2{ypq+feuK|^hZn3I$3^C;rR z+r`Bo>d~WaO*)fI4Hugrlu;l1V6|wlv()I$2W@BTX|+2d#%Va}wt5=z5}NLuulc%$Cj)lWGw7f*?SsjIL-7jxkBVFQ7Z>U0M;)28P&P4Ov z(u~zZgKuEChGEG z4mOL!EA9zfOzW`1CTVPb>y3KMvdmjifgb@s-0WHj9bzhWV$(9@7HJsrltC-Aw)dWbzJUg5*_h}F<8g6jk`kiWwq(5Eu1IG3aEKitKIolCL z93ow4>OJBdTw`oRc8xU+Aaf&TdxkLld=M{JlRTR_v=)GKT2lFRz(aGPdFphONXT9$MPQeh@@^SXm)9|IDt2% z$Z&ByC_UKFnXb(ih`Gy%Fu62W?7@Z@h&a>!x@ZSP9L})$P=HN8x0IC)^vxTB_ljJ z3sO?j55j+3SCymMYonZ_jBV>{Cy~Xbd*Y@Tq_yM3V&WdTN=K@A1&K(bU9!m5`I^W6 z%r@H%?Z*_2k^{Y#nJ?w|qqVr$6Dd~sIIzd$`GK&U9w5*3G?C5V`+|x-`{X*Y`FZGT zfV=J=hyg80=-?z&fXwtq%IXbR`{k;jp$P4X%${zkdxXsNlZN(i+{W?A zHb78bh@&zv#n)G6%h3%fKH4k274*7*#*q-!@?0GOQym9cAAr4mfpo%Q9I~p5idm-c zB283436K7%+avC?Tk~(JCLamUvQB>Lp4|a3WwUpZt=>@`T`KTxuT!rH-9}AIG0Z*5%-ApxVfp8oT-*(mK*U~6K^Y2 zl`2OEezJd#SfMjurT!iI>1PYD$H_6{oUR_pdZ_qhb|Z$o1sE>PFeXM8->ev=aw`5- zU3Pt1*Lj;&Rd0=-`Bbc1mK?CDI!W)ii4v0d zvM{Anc_qfbJ3kJpO)@uQj~Jz=^=ho7(~|LT)<{DZD_{UOvZAbL*3vUfz$I9P4PGQT z1DuOuckvkm^EGLMf^1VBcyRDNkkB|G&yFNd zJnJ-xzR}nawSRV*bx9VITk$onWwS!DJjm%;9}#h%Rn&PnXEzZn#mkqcF}hC7EvYY1 zd@lK+!%T=rlk8<=+e6RBxT4KZMdVQGnKN5l>SL`_`M482wI2WQ$4R2}fcm5wdX+0i zMjy&+%+LN)bxG0NhR{7>n^VS#?jI329jBUoEeljwS1_}++2Qitck&==gwH`DosYi@H`rLV zt_b{@MnOus_0V4aM=E*^p9+`1Ci?mGCku}*26SvSY9bfj0!{wXX~p*7=Einv<>ri9?iAIiiMByi8POHr zpBL)7x-#IMKG3+k_@l_Y8`Zhxbu6ZM*eR+lnh4zcF*)Qhuvw}R2rx$PY=C1SONt9N zuxxeE@^e47tfyTWySNB|MI~&-(GdBYKF#adWZo1ul>9Ki|JD`L%M+UHpJ`?0hdWJy zvH>DSq_ri@UxX(Mu_y&A?EY0weLRaEk~Hp`BQrM7-prD|_FBDuGW?5SQLFezHhh2^ z!OP$*2GgrV4L#drO@oVHYB-{rdJ_R9yFTaIFcL?Ic-47KvA5g=x+2DnDa`+tj|c5n zq7=(4Ku=FF`|F^dKhZd;Ho-p2F3Bn+Co5)tIagzyME2E;pc~sPpM=O!gg>&kQrMyC zL%A@cD0h*u#_| z^ny>3_0Horh1`ae*_%C09&Xd6b?HXR-ceT4fe~y>I zVM$tZbeG%we~q1WR9oA&#&IiNiWG<9UJ6AE#T|-MycCDvZpF2vxJ!XR@uI;YXwej> zI3c)O(UzB<`wr*b`^Ou1XCxUrbI))6*0<)$$jG*5lES-hnKCP6Y<2LUN^plgI_rak zy5SXfvakvo{xKHmE9ziV2DhL-9O`lC%^&s%OV=Vx>G z?DyKkbRM8@RbdL6wSqZpAaj#e?pglhPT`%ZQLV&OZ&l-)q;Z&MwobUJyk{wcL*#pK zW5DxxW$25EJ0OOMjJ!B9pE2fx)E@EnU}{3%xC-7fu1w!NXzA4i4rr7+ZD z(|gp3zq(~}s?hK|ER|}i zc;@U6v$nx3Zr$8icQ7M7%E1y1hV-*!-Q-ctUf0jn?nkbC+h*;?S?@83T@PS2i$psD zvxm`(_iej2&`nowP)DI;!~5y9O1u77k=XvHzo->7jNgH7YjkP|=FmsCmUxDzXWF&_ z()PP$w&RzRtCi0$e?CIh87pYoREcCdmZh(2F{VgHN%K=nNPj|OWPr0GfnyFNnMsam2+Eci>L{NV17Efr4a6m#;QR?AZ*qK)FE10tM4d1+H&w zqisB)?!yd+1|R{Vq-5G3W8HII_~RY=ou~5}SzDz20ipFSJ8@imK#vkJj##%MRiJ~* z3}9q#;Vls-3xQoS>WGgfKn{R08wdIwqGyr$3uW=J{>$ftQPx*ni;(*;Q;PRyILLr9`+l|%c1d_UdtS+IM&jCHF<)~gt zJ@ld0>)0*T`&H#WeWZAqiPvmdH=bB+bd9G9;!y>c8?n7u>R8;1n6**VJEeS!ca2vm z7rzki%5?JmG!u_!{mYMSpAu9?I=0kC&k>jumTE^>AQf z=l!s&GsDxC*uiOJd4#&zmMSKiV!}~4VcVqI%%cQN=0Vd^yRMzM`@j*6xgX=o1P#g# zIlWD8o=hn1(&-m98FZ^cy^$&?9TA>Q@pfu{{^YKHC`IOR)%(n^t8k7COmfm|B^v%F z&7v?d>9)o;yLQCWyn#*c^zFIGkQ?=duus3Av1PbN)=# z9a9=;hZuBKsbw}yk)BI@`Zm{9NSu;s17 ziL7bMcIzqib%yuzs95jD=veRCzR})HAWzE=bWXC24~v|+39tedt=J8XJDO$#j;y0m z0Kxsxo?|_^q-|k)o1_f&it$j%oc_>!%G-sLHJ+HJQp_1}x^F_oRLLyibLX6fdm;x` zyXrv*d5_9#4wA7bLmUa&54hZ>FBJG12<`$=m+K7?M=kYWh^KNZynAe-l`Bidcz=Uu z#izz7@RpXeD78jA*Q?$eguwjd34Bs9DmFB+&bLD z5c+lcEhtVnOC6*G$i}&UC6s}#uejetvlZ(%#Z;q&)$p)?iE*B{A1Or;}*@zt`YH`6*5D$uTO6&Lpt0jJ3pijnBL#$od8#o!9jzEc3`Q+l)Z^+ z6s29gD)!^K*{D|2%yJch!BG6Fl2Cj9`%u@-6u0HJOvm2t`7df!WyvWfG@@frq=3~e z^gEpj@h7TA#ijP8U)dX1UN=)G8#-?2f{LA}f9ZZ%+#Q3dVn{B=y1b#mpqI`3OgI?J zX`BVi-dD?@RFoyRjaxwMm1s;VHGX{5#iS<@_PRnG_Z`RayA7Q|ZB>2OjjNcF?haZ8IB{UpI^oLz6u{~5-yVl4PhsjZn^B|#lqCuRx*luVc{!NPz7nn%CjMG}bb4t^PcaQz&T8G= zG@Wv4GZH|3{HJsh;CDK-@Gayt8t2j)x=OnAS$1Xn)rngLC#C+_sdi4_mmENJ0o9iR z{|Ldz5%FiT4V&MQQ>gUDt2I##)L4^HKX<@v?CYlcD#vJ&bmSf{)w2eTL~zj0z7pz! z>*pYTaALF5QnM-!mWk(RoHf1vH3(iA__bScl1`I!lWo_>CJ#iM!8JuhP;1XY~1WR z6NbV|;eCc0t)KF3l@I5h1m6!mfzKukcfT*7Az8GLch*&8$rr zcweSF!?V)9>|J4+0ksRKpZDoJM<)7_oa|dV)D*oCumQqyv$W2kX_yh(OEY<5v;oqm zF`a$|s7#9Cpa#tZPL=^a>KneC6;Qe!BPY-jI4q0P0wMFz6wjm*zT>;9MQ2E*?pvTz z=~c~vvZ~3^=jco4+@`@Z3+^-_vIXM45+N@7Dko!wPOwiMITFl9kMURrZj>%X0+sp! z(M&sPy7#9m9izKyVm`NdgGWcdL3Ro1CypdMZ*E*_UU}DAr)|c+5lO#^4Ew1D5QbT_ z^UpV^mtud*Uzu;Zm&^=ldO0j*U7tmEi0?>EsZ4QFLf!gZXLHni#bHP}WQ)6V;30=OxmUL!Y07>x{W zHVq7Pi=VptvAPLGZj;*S2s|?_XF2fvZJ(@Prctpny|UPWWDnDpqhm_VnxfU*aT&UH zoHGK=;7XMcAe}6uf%9{>Z17gyh!*h&AlqS7MA3t(}E=?xl*`-!L;C$sRt27OP-(kr5Z3+l?p;k)~!x;DI`kDu8xua9c+iFR~t z(a=)guS?|9CEqJcLdR#vh|H)RAJ>GL;MR;TsPjfOVHHFYOiZJMQoZy!-p)xyI~Q-t z9Xb3Y^ZbSUwWsM6Z3i6dSE`db2MSv;YD)B*p!0V=Z}Nig?ntD*JGf(<^ zmWS9G7zz^*J1Sa(-D`11konJug-nLaVOp^;l)Ezz6`rq-pM>sb@qZs1Nc-^_o#Dl?cAj8zHI*;<73a=32y{C+g%EajA;&ing<9I6nAFUNRy>wn62 zwI8~3hpa8AbfIO2Y=u=8ziq(VXR~*L)N)Jyj4d6bq?_sPXO0cV%rZGQOI>2)$unP< zN18%P5o(j%CTT$PH@Ph)d!INY*2E2sD2H;cgtGL1>Zfb^TAe}@}JOh=uE+f&}>EutN9jN=PP!PYl63D zpNhwjYV|sSjFl`IEBYwJUUM{6So57oyzj!-W;r7q`IT|XP)v=~4V>d1A3PCNoA%O% z2eL+^dSaoGgP@-0=L6O%oo0$5YS;lb7rL{Og^U-&@vnY!1cl|9&}Ce1@m%oeFyGec z)7W`$T~#k|;Ca>;J4t*DeQB0z92)Au+L%(Y^OgZVPC^xKGbN6W>wXC~vr;8{jD9ON zQ!VJOLN1#cM{wZKLCH0k1||!L~!LDpA0=Dj!@u-#@|Ny zHA#ZR$Fp{@t3Z7IXX=c}7PNg?BW|EF(?I6mtZDDJ6n{CQXlU=hd|Z?wcDsd=@9_c` z!hLe2S#_pM@M<+D-_!bw=?HUAU;dZS>j>pvxOlmh$b?BHuS9N`S zB$^4GN~O?li)+UoP-F8?c3h&}1f$V*=DfNlZIotS-(zViIlll~pQO0);oPx0TR||z z-ix|ynso=Jnny8qRAPq6>yx%mdh7`Vd? zwTRZ9T0;H4F&!NSMO-GR?wS*em__~h{x}8R4+`>tIRiMININ>gRMHh$WZ=!uk)VQe ztPz*(yGjDT?BHUK-}3k8f+EUP0*WPtK#QnEyuv6?*1Yd2jNB)9_+yL`RFh__-r+=Z zWUz4y>lU$W@Nl7brl-~%%j#9g>paC3K?(v)8cEY&8+qgmGPCOf`Dq`KyD%&p1>O5T z&L%uEa6A^3lqpghwH$?~7wQf3*( z(ji1I`aA9Cok{Dfi1;HJ`VYJ{7Rki&w8*$pi#^wPZR@@$VO1fb$2KDAyY779<_t9- zq=hn!Z`a8&5z6 z66?&m?A+T{Dn9_ zZ*{qkR&MPv)e-2hr#Ahg+Y(D^ZypOc$puSj7Z-z5q~|CQWdVn=TbCuD_JhzM_Ew6` zR+~cWb9VH~tynX-*ed|{Q0>(<@4od8 zN7v(>yAX-WohNjdR{6GdWJWQxU3qfjw0pjI@g&QY6AV_d0?#vgNSkrD@5Tt917CF(K(t@ zwS#tMa&A5qkSf^j%(i=`wIP;`>kilY@+lyeA>R~j+q)^(onhrG%G>HY))#bLq{}9v z;|_Fq!z1_p?B5^LfTOTaB-#5ln%)qtm%N9fFu-0}nDKo-Y%J;Q-cbDzL)RXtIo<)Q zd^zS~avZfxWDNVj?J73wCB(5=zYH-NtT9^pT+x=`LO1I|HS0>ACLCig8ubJaL)G0E zzlwr+e7gB%nYyk``Wy6}r6GsMlcssR$7AWbHoc8>Z@#q7wz7G`Of{r@%iTN!1L>P1 zbT_!h`5NX5E<9ZWLy&irN?}n-F*z`eWfYRU$o3Z9Ay#_1mWRN9n4> zwjVvHE#7~YaXdbMT9FlpT2pP&E#ud!0tXwY=IMklRs?F=?=|Vx`?@~Bv9d!(>2r>-|1#Y@_Ev3#! zULEvlKSv_glp7&0y`RF)`5$ZApqbsSmOb7`Y~WPZ_46aZ4^xGZ!2f(na8eD{bf zY^rsut2ov@axm)WH4L@IvR{pWY{^Y+@ zfF&3XKlD%#xH$iZ&z@YqR*-j$5#0FTk|RR>FPHvONANj5@MXyZ93S}R(Fcfdp^VO$ z#0aGSItkIKtOwKA5)23aAmObm%wY5*T;h9hsfQ69|A0hI)9mrk;l1N;l@`v;^nd4TZ)QVV*iB(7Vq^PnWcrT-@hQK;g7k_6%y4JgUC5)2<|7>t-Jz7I$j z-td`+!mk`)1pias;xx?{|G0!Gi-$R3__z9>X}Rc&9=(Xm-|SMlh(P-HB*bVt{pm-9 z%QJh_b%Zhhj1>ZD<)M6D0T*xnK|;9n^1&r2Be>(ir2qudKQ8^P{^vWyFi##3@Zi!7 zx~(_f*|BT1H)7xbg{)7iZMjVZDXOWrM;%Fu)*Z<=*O}(uZXQTF0}APwoO*a!c*bX* zJ7LDSQKH-WP)7LpL^r1Thvm4;$aUtKF9Lq^sTgdYUXo^Gp8-bw(flz)yB)8`s9nZzxQ%*y4AJx+qUpUq zO>@2WmhB@|Dd+mSL0VA?*3fo_)Wc8=T_MC_dfM)g`dt)5Pe^LZBiV2=6%L-SATo#2 zb`5QRNc|0pVIU;+=8-Hqxe5pGS0-|YQiz6j7^EHt)i45*DuOE;jtKC51t9``8rpG? z`lqOd@sLzsTv>Dq6^`d$nJ73*2Ukf+EI;@~Os5EiSt}Z2fb)4#7x~}kN_(eHSvfz7 zL7eX{z4@d2Z7N+`2nwDv^pg+%nt^5^go||o=@K_%i!hhTNDpl(w^)*5hOvmM+dSD|?PvPOIENHIy%OmjZhGeFvRMtB zX>V>WYIARH?OW?^8^;y?U!d4CU5Ut}KR;ZP=4b;8O(S{>Ei=7+JeQLZyrp8OX*83~(5PtO8( zayjjdv>O+L!m1o6I^q!VhAHtsyT^E_QCxDQzrQ|9&(fWp?~PMWc6P*@L`kbeu7)ZX&ImVFVrY`YOm#XE12r_c z5<0a`CJ8;Eb!(D>Xn7(C)_?!~A92J?Tv!yRN6N#dqwM>3MXD$Ba@t(3R7K!%39KZt zUxH+ay-B=H=L1e!?)gLwl$VTNaBs`6oxh-fwd@?+9@5krY176ZY^mCZmXB#SjL z+X^#m!f6W82q~Up|^E|cJYb|?PzJ{V;CB+zaI)u4dw`1P`tW@m$Ti7qq|6fZ_n?7#PDPiTx-tMS5Lu*1zR}sQ?TH zO3toJBrN@fj#L*m-@_ROI56irBJ*)wSfr;B7@w7(Ms-kPA4)KDa7?$9FMf1o1*5wl zk)0hjUI!*kS@@Q`%3eq8?7TDi`M{WSe)5Q)NEeM0O}a>%co(eREbQ8QOdwAW2{$nz zvnmIsa1FL<#jG>dm2KY^{}QWEf;YMP<=_}%6K(szp!DOm7}Onk&BbF808Eib>J6Jf zA3~hgcZhm`^18a6_Em_8`r+jIsh7Pdlb5AE>`%dIo5@I7QV4%~Um_@SM+MC470?zy zuo$k`%u2~Shvd6j^^Nc6e|)I3EHRO6WEa9LNoHetfg(B`!>&@K^qu!56_AdYDlt+p zdrk~!Jr?-xMi>Ys?dT$7TF4Mo|lZ(p1&Y9?ZJH|7&@KGdUKznnNo$DOU( zZMg0Q`YU`_x6BfrKH7b>+ui-LySujqgqx(>xk`%DYYOndOkiz$&vTPKM<}|mJCOsG z(Dr6+KtvX)u}MH9Z8~Q8Ah5aQ=p`+PabirN@>C~@Aj6C>D5R)akR6| z7e~c!Wdf1204FkQdxdQK>(Sm?yZ~Fq%gHygXFh6 zqI%Y-f7{s5)=o_r4w62r+NBn4{d(qke%5+&*4pa8)Tjx+)e&1~tPO$qKT*3LuD~2!qimG{VbVjA{m8q<AV5+N+wr`2T`<->Bvq7^`{ z0}B8GD#vjUctE_lBphjFNMsh@dv4OYum5nlCO2bvQymVN-M#kO745B%X`^z1vcOm+ z8L6Wf!7he$8NZZ;9mmAFd?w0V4K)T*o)z8wsK(-P?vP(sD-|NQ)5Xrs7!Q2TH_doH zqhX=0^78~^88q)h(V|`eMK)m@^Q|iH=(_@UTqEZ%bFVI0mM#a$%iuq(jh%bf=j5?3 z*Q~q{7}8YCD$5KMBrm^r+0|=6yBYPyD|kz7_?Sj4T}LIZCKi_4jt2%cVqwQr=z|xL zBLv4IM8{OwLb(*Bq@T<{NN^REE-pc_FY%C{aY;@5839+8XrBNf+R7<7UA|5YDzWn5 z{q1$+(b{$7xT@*xd*V?;Tf2HZdI0LtK<70zBUC-r1u?k-n?yhA z_~{#T7O*Q&`Xkqaf2=n}ZxmMCJYxvu-b+%3=Ji|W42|G^Ytqn+%nrbu{!@Cp#R#Q8{&x_>nKAz!xDEjZBVyo_9Ok-6Jriueu^BR_TS#P09lR z;x%Qj-d4mNPFyJ2M%S*6Wd#g9!aN#xYOPH+B`EdymggAF8(5;wV#hP9+6z4~7o{M_ zM;#oW|9muoCx=Or>~ie~1tVShSb`HtOfSUD6B5Y;%tA2}ITq@S6clobPMcv<1({ED z8%xsBLQKqzc!6fMutfysT69~9rqEFa>>4+?Qim3!ypTF!@s(w{8g;C}qM-Ju*m^aq zEp7EyP0$8x*ixsxb}=`Q$5g=AnaKPNVfhK(w&6X9n4T#N&>;7_yOGvzHseQTuscrU#eR}UAyU$zp*&5{)I%eW~9J4uzeRgjW zYo_q7W%hWDGCM{jLG&Ec*wE%g_W0gJ)=1!8OYHM?7RH_(i5EV8-juXHzc*=>)iA*2 zqEln>YJvE>mgE;}lqA*qKo1(_7&qITG{3kvX*Lpg*An}3?M3NEtvpta(#kcKrvm}^ zSf56^8Svo24}0CRa!B(9Az4l%bMc@jP7F<>(gZQTfHq;KB0ZdiVmLiz7t5fY(J=K7 zM~8TEtSFuLnJjO{Jh&^ea_)fR-fB>gcZa+lM*;Vx62>r*BgTwoDflQ~WUvBLpgc7C zGDcy6CwXU_#G|t5C@ZHa-l?`2=fH>=3K1SOr~Q@-6y-#bC%dXXeK#BAIu>CiBu zO2zyfc;59D`D&e4ggObEy9{4F#LG}?p7?SPYnC61iu{zFEic1d`ySRc`2Q_%d%J7A z2BB}ZxvQ|Z`%vyeOkZBX@CBm1LX)yF?OgP%8i>`b()=D&(^Ijw^UpqN`iW_#5)y0f zfnS-Q_Du!3Qe>Xiy=x=7xBdx-4x}~#ZR1f&^TnZ-|rnrJ} z4~_7EesiBJd?K-yHd*6gzp+c!jNwh2WC62>(g?4}ns>g#lpTK}$DJGQ9)&rN*XU7U zlHKcdN9?0lJMlVBT76WtrP{}@_m8&c-)McjrS3mEtJ*)lbA;RAyF3BWlYnU17OElO z+d`Mj`yrT^v9Sj55ZL-J5d9~+@%)R6rp`UVr4J8?Bi|K+H8k?)+VHz?37@9Uz#;Hh0BV?`ThA94c*#zJ+0Fr`k}6U%Q1ea7!BXwc9g$^@p|}%>J6U7uZ|Ds z(p>(+%s@6aWAK2mm&H z%3Q;ep(S?5000(93IGuR003=aX>L?yZE$R1bY(7Tb8l|!y?b}tII=JL|6S{R2VU)m z>>SJQN4oFK>~`#=iz<=AG@?H_n~oMVt1Yi@@2O z_;=*HaBFva=cm#3{%Ct=YwFBr{sX%1(z%<@?8w>tXXtzXGT6W!Onfhb?>;&~==vV& zXJ>O8{f~Tq=S23@j*tZ3(FgF6y@+o80A2dgaqK(m!oQBb+JR$@tUGrS_#ymm&*$M{ zKKFy@mwR*(k}hr$_j!lp2~iUl{%jFJ&sIdFv#$NX!VM453S94o_KBXv^?q}_o9Gt4-AO;5I@k7M7Jam53w+P)T3x8`;jT6S_iv<=(Z#L5m`z7;>*$3udTj^Oi4V8^_oik2?pUrDMvgs2tyP z?TIs@V*a=F_12x-T5f1foxr_^F0TXs4qyJ;v6b9_M;HD4i2o4}G(1GUNwx9K4y5*Q zeF9yC4%dd~&JETG--?yj3aOINcN1Epkrg^fE0D&Z=cB^H$1`Vw{x#f4wPtNdzaOrz ze=dJ^?vW)=R;+DGkNi9B&+v$8J0Zd}iqq1PKa z(PCcwD0Vctow;GOGjgZZ-rzs|t1-Gb9M63J3-ncLOlnX4!E^s-0m?kZ4~!Hu5w`qs zb}K*5%$+!1=!~7IizMmQQ|;A$s@}b*{mPHz&mFL9kYS9hqE`=fQ2C)kCqygkIE-M* z>eVwHR(_`Yt6=Qhqour0&vR7yd2GCHjA505PkZ%D&uhISSSeuDxCwjlC_hzy6yJ0D z^(;Hvl^@>%E&R*7dGv4`1oi{I4{hkzhMzvOmoD5B z-@A5i&Zaxb!<{U`$iKV9T_9zKD?Bh+*vuyqWo~0dV!mQKnz9X@#Nh=k7v_0x|4)|4wLQG<~!jci5eG!P9LFw0*+o6p=Twzc`#Atj%p4Y$M5s8^h^j zi2q^54{#Ab0BNJ}c6=+R?r|$h4<7ed^m^&TX9frx+vw!h_HLY$WG%jQnaNH3Z8CK7 z7FcyFzLHfuP_zd$-)G)d?t8(cQ6j1MPFBMF6(Y&#jpEq=LNV?H+yC{<|C+H|Q3rw^ zmSS)7natjVlC!cWjivKtZj|n%bLQ_Vb0#yrQIVRk*ZHiny}l=6U(Bb zuV%LQB_tyW*G```rqUB5p)F1MG@tfZfJsfL)~-V7G@e0FqqEAa{Ffkh|punSDx5<>)A%`0%=1 z+nYEz3je1Qz$^%RrkswJ-XJzRm3|7%uk2=t8Sa&u;a-hL6gMU{$33w*?loqPdrIcG z*F$sMQ#HrE-kRfHxjAN^l2g4m_6$YG3YI$lTd|?#S}3$C?n;RX?U$O+zN)0+JEiur zFSeKc#_VNZ$zJw*XfOM!_Ojnwd)Y6ym+VvW9uvgIk7tlnAn*&*uL?Xt?%rbGFS$%& zBL}56a-bxj_%^A59Ec6%pfLkEP%@B%9vaAjs(~Ez)<6!*4J7-NoRXc8^OjexH^oO1 zSuM<6AT}0JJB22by;x#6hoy#ds3EfWW~uocip}S+G4nZ8GM~d9n$MxC`5gAvd=AUa zC;OBcRYRfwMI7mQVNc*-Tx3Fmi;B!h+@8dg@;6A#>8RA4jx@y=Hy|~sBe6*xHD*#r zN+xyGLz6mEHL0WCn$%IbNoAihRyQ-z&A8=VHrw-k9Y)SF)VvJ+z$Xs+RM-x0ds~+;Xx{8Ee{mCqTIu7ZaPz zmTzslH)@ZP+seo``!pL%E@KdBnXPrWse zpUMp+`;?rL!RSV|7kzwl?w~xg0H=wRTp>0WVM~Qple=1W9K2nA9=xq1cfsxQQ{nA` zW8v-Q&V{$t4u-dTXi8XiwUgTI-Wn5nh|;s#?1RQihYrAJ_s(VD-rP8WGsRJ=R42t> zXAG&Zjl2~JFO`{)LQ2JsvbY8J%I&8pt)jua3dO{VUS?M8DBDkuQyo-t9mLs47m*!E zP7zbpEW0pcQwr_ot*hiFnVpsAFvOQ=K1@L?a*HcSV<5LSVsUDT45Y`NS)6hz122BR zEKVVrA@`u1n@g-HBt)MBnDHfzK zkXsuuMYSXb(qqp|Q8|r)7r$SosF28zdr)Q>_|Jtq`I3!QD86Gf~K2$UP`gHdMw=lG{;PHtm&B z$D%8;W+Q1yU_J#`%gm@eyCJ?rRqle@<>pk7=Rj_4#GKSJ9Y~KoGbiO-2VVSsnUg}c zL+(NU?q6A#2nE3U4X%n;jofF+sEDp+^)CB8t8~A`m;=^Jf~3GSQS?>PujF2~`-00v zQe>Y(_<62>*|UqTVS7$W9xP-AY%2xdB)u2k$@VY4ik09ZMia0uFq#0|Zl*JS$z}XosG)Rlg z(;9PBQN{TVv;}zy8&}1OF3&9ec{#Y1pMJfRDz>jzvV~tLIk)bM$C!PqqBaB#G*OlI z^{TSpKwo{{ZxG3!a~rbCC@A)0zTQ>P)il&eUuy~+Akov^CiQezNl$lssHeFArFeX$ zdb+Emr@Ot?Q&D^~tBBcQq8(dYN)8ou+=VZom-AJl>BA-H7r4Q{7M8yLXB&*_uFD+0kV z*oqWFC3Zc~U|SP9+SXS$x=kT7ArAsO>>NG`ZtKo=J^E_+ZaM%LO*+bhj27xqx=Jxx z5RVrJ0s4dgGHFimoxrl_4>umXqSsqAGyy&s0dhvUGuqx08f9`zjoE=mCK0q<)o_yr zzCdy)y7^bfa{_nr;Y@H%ktwhW6pQ$QV9WI-cnsZWmW6ss2F6-j zgs?(b$H*3}R|_wW=dBmCHD6rK-0+q;-!8b2vGg}~@MY?M^$JC>XDD!IJ@^X*j0(~q z+}QZa$eDqyM!`coOJF$EJJ`;;bJ(9uF#L`c;n9Hm;O0D>=;j~ZAKv9HT%Ghs@Rjf_ z&J77i;Ay9LE4o3xL;FVCn_9`XZcg?yA%?$=wGaBb1D(D_v-rJZ-6dNcd}~NCscedc zx@jQ+@e{fs+>Ezk2vGMn@E13?*_RWyg3^(v@CbAmcyv`VDEO(S&J;ZbTulZ(+3KCc zHZQc+PEXF)aiiJqUwYFy&Ui-Gyj;g)`RrK?dt}A9M;077&KA(c&(EIy;f<_k&+tHT z#i8Sq-=01D*&?5TJP~O>Mp%qrYw_4K%@(H~kUkQ?uYb4FYb<&ZLfOT^kaUchzOUlG zUGF-u!QBNH3=KPam%fMOWaJP4I1mB2Z}6ZZP-&!$B&HERGt<^PFO#=Kn@TV zvLZbUod7M5OjFsasqCO!lh5Op5*?;1IycZbP)1vbJ0(D$VS&xt(>S7O&(59yS-1gS zWnb7}c6ho#I(`k~?tev=0M2Ouvmzd$WM>5L2j6Jf$a8_`gLe|b^TV+H11TM{F?6vN zPph*BupA#lMpLmL!kK>)zmSi+&z`}^xi&m5Sbf~Ubz($dIYJpW;4vNRQ*;Zah(M{4 z9>5Ks*Qg_5e*rHd+)5D8F!0%kHoR^Xj1EjR^V|Q7d(1D_^hY@LyFq{tWn}_@vSrG20YDV{>|E^_+iIjf~S{eqm=}di8r1PiN5XoC=XEc~4n5(HSe{SI%tM$C%7TS4Eehtyp zeDT_(^{@p^v}EdZ8KSF``lAZgJFVvw-QT9_$`?@46Ef?trg^6K6+DsX<8%|xwIAAG zDwCmC*JlUw|YH$OT1LLq35GGM)ZI$UvEsaxN)dDqss?H+UkmpkoJ5i z9~yCUD>f#&>!Ex|gsrXEi0CaP^6?O~wPK^8w(OM6AxRsZKfT710i=5zkuWOQHRe?*zJ>bgS@w ze*+bP$Q0EOrB@A``+vglSgZ3d|z^ z2-1lbA%`NLxxx+KlOXrc*0ntg9np1Sqa8q`JJ+HN9Us z>|U(my!fYXh*JG7;e-n{A0Wan9DG4`XE7I|h!4fpk6EP927yF}rknEq$ODkhs0W?^ z_eyULClFXtznn_+UgZ^$d+@`;RS;QnByHo??Wxj*QwWnMZ5CfC)O`HKMpv4$72d*| zoc_aksHHTlsz6jPZq)h$t#XtM0@blTT|jsbT`=`03lyP@ciGU&%&`LxqV*{Lc;zo5 zrU}$?8Uchm!_5>X8l52Gv&8tnBNFf5qDKQ;aNy`gBM5uKF-Z6?{#67=m!tHQ$(@eC z2u9GydL_*+9n21tI_4Lup@HHr#M3fbwecB*WSy3)E_HTNwf)_>+6uuiLsqw>!<0G9 zJ};ikK)13-IPlQ~G#M_mlTWSVIh;O()pRw}fwHnD0r4$RzGmkK&ZC5LBJNn_cmlJ5 z)&R$Mpof=ajGn)|xU`PnpW!!=#tWGvIBJ#rNMFX`eteV_lH-N!$ql?PR9WZ3@{ODK zoCqIAupXpj3=1?|!x3PPBQ7FmUdc<%4C>#WJ$w7^@+BPJ#Y2#ulESG4aTGIhY{REE#gyFv^hlE@cV_? zmN~4!IUc3ot)l#yKu7hk)x+3#@vE$@(A zoIEaGROOc!ElNpauw!sAOA|kc(q@aNSZ;H9;?EzD_56mrsIbs}Zb_*>VBTJ2&kpP~ zV-_=*Km9wbqO5XXW5p5Xe#N;cplQeFZ>%Km3aRtXrgZ|7{1<%hvuCHV3e$xZ^!sWN zMPM^9D*o3^3*GWZ^y&ZoL@vA}7v@fJW5FUH&l7PQ>*+-(O~fXYS9t39mw3@;GNh=K zTd)P+!uS2#-toWfzJfo2{dMyO6mW3`b15b4LCwH-SQ`5Gh)$630i>aUe#1X#I%Wv} z#)AcaBV+xy-GkljG_eUj#p1;e66gPqVM-p;`2d^>oVf=_#5y-i3F0ddJ&5zP3!1;lsl(|3t_L3?8B ze_JPbT;s0kzhyH@lGGGWeu=biaC#r4HGu}LCn}^BCdz-9yDsxV)_A@*na7r}(J3U< z6=u0ModihvtT`Gelo*Ucf@`olartcHJc$?dz^6g$B+a1}3S}DNCs}z8H15&JG?Ayx zD{e{L5Y0{$64P;4-q%T9C2hpRU6{K_g`tyL!SNusV<@B~EnUI_@rfk%Zh-4?0ij+>aCw>5T#JQ{`l2K|&&LJ+$8_k4v3a*>E z-WM*>I_`sax(5|zRrXhAR%S;HW&)g}{ttF00f?qr|9<(xU1Ul%$lXc=9SO9crTV zr?lk9l=_%bA5-e{G)jF+idgb-Fa4qw{W=c)B9-!ZUBzOQR)p6sKGA)=szoL>i%V)2 zmFPZYdGScaqLGTlBD(Uc6@^qS2B}&EqHRj$#U7Q4JSr7;R8yhiA`Y$M4XvULJ{Feo zzlv)ria`KWr>B0_PL#j6IyDljP#d8+0?N}spKBj9pILSK?s08{<`b*Ul)bH8(6(yX z?Ap891lbg>Sc6b}u3TPoAgeVnH3r%>2A|bmZr$R^k|KoS;sbfnK?X`lT4bP9Tp&EC zZ>X4{t0IC*#RH1@)jE0Ad`SF+t%WUWy~iam?Wpp zwGHRZA4#}U@&W`mCyBJ;x{=Jg#m*Y3N2AYetzkkjwC!6*+aBb`;VFGuw#mqP9fM>p zz`2RvOP^GD3+;y!O$% zQwq7}6b9Q!g3e0!iK5yF&Cx>uwrCPYYJo6kDbj?%b4a%zZXAP5l*(GeyWX$hk6X?+ zH;iC&f-4?j`<#vjx(#+82&+0R%v;wUYxeE}CDb0?Pi&)W>zjNZpKFhD>>IJIg0gBq zISp9j>c!@C>l4>5JU!Bf&y7w*v>WvoVw1ll7sLqm;5`k3|68W@*&$v%K3yS}l& ztU>(^W>#Xf#HUVbsK0*M(c~6#f1~E?hv2S*IOCAejE%z#iCH67l*rB+P};jid$*F_ zbw`Ih8k`j_g1~_+kTX;X4X3QljMUC%{7Ep5fykSWZD;TGp(32K4|MRIRi9TqS6G=N9 zZNs0PMA=g@M3FQ}L=Dl5W=i&TPwf7counmbSBcKPyF#eBnxJK6L8{`-op|NUVHy+& z8xvFN3ahlMR}?wdR-1yC2Vx{r>jqpJlDTyIr>YxlJ8cfKc1T0<0i^A=`9O*h2*t+` zwAO_1I_LXwBE4+ZgSmSl-a_ZZLL_4jY{iNnfL2w%hV?;mnd{9LQ3;~pAX#nX2!&KQ zKc0*?q!*X1mE6UFQlOzoC-Ul07{3tvqv}|NoUGFQe+^-ib`_+Ref^_3tYRHYh%+o@ zhVVO`HN){}{Hqg`e1QoM!=l8lkF zTP0J5i}AI^1BEhobMf%&2Sdi{@vt*wLXLT%703Gk5B@sxg%M>BRi5jRbw}(@z zwzJ&9M3u;-vvKZDuH&djG9e79H~ti-fA;Dn@`Cm3O|rrruhN3JtZ1<8YygFDPq5n) zjejRuN#oPf?5Ny`%8$VHqKb=+E)kU0m-+#xviD$0G% zBr>9w1Oehqe3&T|C|NMX>Ue z^2X+f%JW1fv0dY?s>7!v_?PeC=&ntCd**}_XRXq4fuO<;9Tn{CqAD5a zpeKN1jUCOPc=NQjc=q7B@deN)5kY2 zq3f5BRud=hpv!$`8fj@_S|qJ0&WULprHQ^tYbC{)Y6H{2g2Am2y>L`zhk`wKQDfJ1 zOc?*@BbelaCzO2f{zG~4!L4JXr&e;lPhvlEL_w?|uaxr1Y$2?jx)20taPizh=B2e^ z@jgr8sQZ!TRY>=qJ(!f*E0oQZk@u(~7E-6?u#7un+-s;-!bpdNI-E(R}*2l zU@+e+hk&(Rx;hSB>o8LSLsJ0joH}zj%@5xdczZ1=Wo`Dh8dOXPQh0taa#T#a2=iDC z_E?Y#&wxp93>o{lK!GOEmqgCt2DL!CqZ`41qAH5D5cWjTnt+`LvwA_ZFrGp)FNa}8 zyoKaEQpo=!;teCWk|Tipy<>Va+1yFmpwN8uk%brCSEMK+x5t`WxS~)IF8r7)ssOB& zBT_B6h64m=2P7nIi{Wz%Rzox~75iKnX4ebQsju)Z3nZhM2)tPMQw@p2#eD7uh1r~W z#$M~h58#e?W-XD7H2w=mhg)zHC^XMJU2q+&DPK5b;J6Q-a#w{}@`pMJUoi>6V0`0v zXo3>I)nxdtU^x*~>9BUNy}5U|xpQ>1xx0UGC?bp^aL}*q5JMmx?Em!qaBuhM=%=H@ z{e$hD=g;>`7+F)6LUmy3JX4Y@;)+U1w(RLY7hx0}X zce=r&JWDcyk(9n6N6rZIrGt5iG0U`QH5}}0ik>JX%9@aDI3ctAV0Y7En70|GX@;r= zG1c-kP@$-)yww7Y$|z5O%#v-4kh#icHX7zjR(K|X+h zUv!#K1s3UgjD0WRH%nd`Qah@3$!i^k@ykPMK^$act_96Wb#a#yMyxoxGVs<>U}g06 zIT|xd%mqm)&Qr@l3qz^a2F}cZiS4Z)&q3d13xN>iKb^bT<^F1BdtV>~Ch`+K(wE5l zKSPmVdqxSSO8s{BSLPRXfdO@$e1SLe4~g$ZuPGp?OnfRahBduA*|3Xl6>QMyeWgwu zdk^u1(fn{{Gx8$pPww^9@tNtp|B$%MSwa)FrJJ@4o95|aA`>oqVNON?1F`bG8gBmM zV(H!GMuO)!5pE@uunB)-!8U&I$@vCPgv3s1Jl4cJdif}2Hu%ie7R7BOdt3VMW82Em z9yQO>8*4iLt1XLJdll_W zzKUz+W5%$o7&1A#9^0%|j-41+hsiK^!?8m^2}{dZRk6CMNsKv@prAewCiKTe$9b1X zl<|p@eWz6IAGzqX#|850xq2 zW)48PgrB&sntl{+K^)_FHWR$zLx+)1EmEeL`kJH*fYyjPH9${t_iA|aj|=o<&w!q^0eV8AS5P#6=GxxG!BB61Iste<_ZfS>TX z)i(G^*^nC$6n=U#ASiWUCX%98NWiexe*JKEx=v9i3VaUWmG_D+8*Q#pQfYVxfo z0Z1wNF#sue6rM=UdEpL9bB}8PQu1SB08$JZAJgtr;1qNL{hoepkW(HHa!T1buK`gZLu^1)|+67rQoAi;i1T9kXSx24+j{UX6{yA96A`4aEWJHpbM^Bz zL^jYXWUxi!Cw>D1cxg8`a+o7n2ZD$3&Uk7UtXRpbj1xn3AWn9a5l&8__pSj>T9=O6 z4kKLsS6W(^Vc<;+yorG~5s^-QuS;cF1{}0pR!jWMe}@wY$#Skzrb~S~)F!D6kUqG9 zH!<)g2HwQLn`q5i!ik6G_K*+-VO!EEtnOUoly2<39fq*2np$V4Dc}gB3%>C>@2lC>tki=1#yL7lG=BMiU(!&e`+P?gItxOg7mt6 zQlpS2L_WEjgd0jyQc7(xc^LodpD<&Vv(=YYqDXEq$R>{y*`)e1Yw$}9eo2uQR>v>7 zi}i7gS%y1r}Ll}^fx*#RW=0sft1uJS%ubgjlIAS9y7G;`cVU;M4w%GeIz$Em?0F#h$ z$g86PCW&p(0F$suU>n0NQX+Xgcf&27S3w!#<-PL$d|)pi&l}oL^3}>_>m=hY785yc zE=v6%iE35d`NFfRnpW0AhM{upSdyn-o`bl%iweg?wPSq%CfRQtm?U4Tqz_E8-vKa5 zVIKyV!~m1@8JI+xsoNY12?@JcIP9W@G-9`oHNsbb((QYSBtgPLM5ql58g)X{G;RQm zHhdKM)?^XFvs)3KA#&gZFdI53-^&eQyC8;}*x8ig9WYo01<(iYo#4*J+beiD5C~3F zBBod?#Ls^G{)`rMp$kP#?d6)XaSpi^`0!}xcl6}vB=OS1sX(H3_BY83!T@y^4OQX7 zvAD7oh84dL>60C779lw>=nbwX7(7vHhnv>xhpWJyGNXWn=sB(kQB#8((tq5L%(ma4 zgYctm&_RgzdV$Yk8Hax_ODJ2%&#jFPQs^60hXUEJ0R@t~SHm@bTu>kf1`4DNC=mS1 zySFcoXLfM+G_XK;O==qpgdbo72EtE01`LE(B?AUxz(5KEvT9|2`Eoz*wzc(5wCsNF z)+nh6)(w&Y?Ia>tIA}aUwsR@1i)Vl3M{JO+0fJeb%VLOA9jK6J)3ssh6aDU7ZQ=L@ z1c#-ysrhKA0RxGL!GM8Cl$2_nAZ(&?0)y0(1z;%pEpfC`y^K!gt_|6k&5J{IyW zCEE?y)UdyvP1}QB`RIENlk}~Qx^fRU?$j1bnCoLeN(@K|(V{$}0P;k};EJ$-3g1h$ z5K`{a<+(2K!7bQJY4%;}G$>@=(T&P4taHKg)D71^4f%}0&!2{Deq~8gc-3+nkmc6L zei-CxNK+K&c7&@wx6)U(#ZF@3)-T^3Z{km#59enHtRChMk56^u=R9zrer$2E9)%_Z z=uglJbLLap0tb18?oA&@c<&HRgiL8Ga|bSEEk*>=oT*72ZKD6}B9@5E>ewYYpKBQi zCK^w&L>!Zhlm^X2VKUGLUBNfys_T1%%+X^s6a8h^pqLmGljc!OY@~;sp_iaA?>JU{ z0$lE-3rYElN)Yx#TiN_I9T6yMFZ8C3z>wAeacu7l$uHK_OBF1QTuJ zGB_r+aZI$wocDeVib?rIq#8PxgyokTFMmaLvpOfQx(Q!}3-y3Kyeb|+NNJ6alZ!Xy z+^JW2WS_~vX(EMA&~$lvZS{O1nFJX>V3;{w8*WH52#|A-);sa?(iAn+h+1}|!7|DG z7%Y<>V3{1Wj%AXswbHNgJm>(+q_7WzWn!>Q`ix~FPc+W+AG@Ix&!hm#B;MXbHx`b< z_YQj{k41vYd?a`zX>`Sak@ORcBzdnrfh1w%SpqN#H9Nsqg@wMvVo^sW zvZ8hS!yM)T=hBUxgWc`jgVFZ$(eA@Od3Pv%&>e(S=iA*PzflJ5^-vE~IV{HISS^+FMXd1Aj*a4`HSaMJUu_Sk| zh6Db%5K9gXVo4i_B`5y9gCKfdfyLlC|0!UW@VeACW=VF44QdHL{TS2|UYQJPi9sz% zehg}fK`qfdL$MSOQ7k<~_yLE{kgJW)f;VLEHmD`+fEd&ggIZ!xOCC3BNx9!|a7zqs z$@R?t3fo85bCJS}_O^+x7~B$rTViladVyO)=XTWsm|TR2HW1%0f{)Xbv<)be!|^Q~ ziI$Z3qvRP#T$z*<06`)zMAsnU4lX;CC7N9$jtgiHt?Pr=(0?(6LGhS5D6D-CKIZVogtd&nLt%Q6HzZu2hSw;^ajqvz?nQj zI1^p3ap?#gRSKy)7m}tPC8L`JT>31v0XL~K#_AUvaFe#dO_)`^GPa4pGw2-JMB_P@ zhisA&(g2&Z25eGyk$$?^Cbbq|19M_vPKp$6scs41AJ36kKWe z6B@0FXG$puN^boshYZM1!>bB|l6~oq9S0@vQ5hJNc41Jo&C8&m)I~w5FryW?Nd^z4 zX*`tvh1(4rih)Bha42u$d}B0Yy68}lB=B_=(h?q~SAZPY&?gpDuB=O{Kgy{GcXv@) zov5;|4{#`lt;3<@%eeF_NDn)JLn-XTz@b#VLzE_6*R`9rZQHhO-)Y;nZL`w0ZQE8= z8kM$HdGdL`aT@;^(TGMwbRuHRz1N!aT3B4E0>g!=W=x#mk;$GTY%;2`k;%GKphZ#x zO3vtYt{!Y=lI5fwnHSs}^8x-$;CVBbWb zR#d;LS-W&B!zIs1UvNm1)&9+0UGq3!DP!*GWj*|MsOdBmK)Cckwvp%A5sGGsr`yB8`$3$Kq#@Un2iy!(SL1?IEZ~LX7YKHn^}JAedk?j%_-Ej8VKg( z)-5XsV%p;mr~U)_;B#D0hAq~??Y>9Wthdar;HU9z)L?xt&{Hbow#St7u{`bD8OmEM zO2cRf2-!UyllBpE2FHbugI;HVgVC0{KooE4?h&5Vu25#d%K;C{Fz^y03p|l=A2BkH z#Zow4yShMugHC{&$%LJF6?u?iHYNL6r3TJ2N1$8P?nlmOcyKi5IB@X9ScuX`3H(*GE*Bi-d8n#I$2DKJB8m>5Hq zdkP7A$gDa^Xypb~VC?i+!HBdAO`1)DK~10K=@t#!Qi)uoa_gQGxnqCs53F0P=f zTZ~lEwDyqNDLvoTbd=9)QVa}^I0BX2U&f)%MdRU#fSwXdSk(u}H@6+2ewk8hk`fx^ z;Qm4eWnF^(mGn_vz#EEO@@ka5M}j@=&C@}08G&1BaG0+_ zO~cZKXv5U!9XutE9xjf5r>5jl%Ml}`W2hRzUu1dBoBFVG#f-luYBvkFiIjMKWQ>*Y zWIrz+D2cZgyDxjEJ8+2iK;3qyD*0avW;+pg?V&P`i?Fpt!ohAq9XG3OMRwntmoQOx zL?HTE@mpqgQ!m)I!y5)W^v|DtP@VoD(XZQH(DL_0m^8glEf;vAUduKg%@X-$|r+{%VT0e%--MGfuR=7IDXLu8r=o~(w2 zGClmXY5zx})O%o-ato77nu3DD6Uo~c!Tf6KJnvg11Ncd1%*Nf4-bIZBENe*iDlr7! z7=o(qCR?u94DvUKn83cl?M~Iw(~|U)I^5D4Xk)n+X;O~O3a2WtwhoPgnrH9DsU9cl zFv?cZR2d@~H@`}hx*GHCp$0P^Lu=+K7^f*SI|bTNx^7oz+7ZT#%VYH@GloH@8vJ$L z;F%LLiO56U-6HhF4uu8Br~`FaA`T))LJqVp;ZgE=PIi#k=?!fS7!C$erLTcQ6u34S zBxh)2br>lI;W?hcN%BY?R;5n3YHK10O|$4){@FFOzM#T7mMyoC%qO?5rj;jNf?ND3dkr)S1$HzO**}@^%S+84WN)NYx;ZQ*mi73D-E-?|0GMX#B zRocopq!nY|D>W5=g0Xh-_7@8k8q`;%=J%1@jGe#xB^5ld1y44f>b{PZ_1p9qmWq;{ zE*#D-1}{NMaZ2wo4#M=ko+|h+mwpQjdvCH`m_b;MA?c?Ft8HiO``$t=kUJ2Eq1(Z1 zsx7oY-LxU8tD_DpQwWcdPmmIGf`ryU(04I!k=TlkyKrtD>?FNQ^=TkjAY6*O#{5=P zQktf?0vlgN(igxUnl4_0W_%zcd8d<*#7EM{cs7D!gx@#ohi07ia%qx-A6FTZmGd52 z)(=+1r0{iXl*K!Q(Ii6)JYzhhm!%7Nx>@T4MOEziM9Px!1;`{tL6IiwJLFKMwhts* zkjzDbVOx-0;zDn-^wyeX>kw3{$6Ei+1Gufq3-gqjGM{lQ*@n?=O3d1*(V!5`PKh7ImuP4spjtZHf9EIdeVZ zHLgdHt&k7jZ5^)h?XU6h?XIs0@uE8dBMExiL}QhoKY#M9AGel1g#R8sPaRKAZ!MK% zj!mf~8?EH~0wFLRFXKc7&8f+DEjDQWBf`^{aK#Z%W z*QBhsBxWZd4X-XPnpGi`WvPkC`jhF9hjS5OUXjjis4(7&%qwxBq7lKHZ^A)3E*-?d)M zlohhnLnwb>Qb8h_y^orOaMd#oS2_JWA^<%WVz4u@qDYht5cO*}NnZA}^v~u1F zgsg9zCrrMNS9QX3MTmcq;betj7ti;o>Ey|<MOCCl9^`upfI_17WyM8F8#+{9i|6@3RdlEbP(hE z3%kkIdA;!4v50vaJ&v7nKb34VD9~n0Vi};hf@mtP+6b9tmrGeTRBzrPpjkRZcu@9O zyh2IcL;CwqWNoZRc5C|Q!DjlRnoe1F3w}`OJ4H(y4Ms|Kh{l}t@9J&t2g7y4`7J@% zm9}*=K5+O3#L|vHa{jXR^gjjKWMolH>2YP&Kw>8Q%XcmQYF=SkjDIyK-{G6^T$ByY zsu!z7rX_IGYx+ymPOW)LG`;ewxh#tQ)HG`b7cjkgQd$c)1lDQjodax!Yyu%p5-`xB z2XGHl`4MuMkE90z>~4(sgqvbRG=JUk37jTk{Ie3P=`jC5?uwT6h^g^AJ~h~{f!39` zM)Ur#beo|l)#JBvuVmTUWEFdN4cd>$pqC2^OmN;1mIlH{8c!E1fYBzNS*{@hAYtjC zkTYOuzeid&YP3;7;<3FMB;ytqvRe(Ca6f28+9na;c8>kS5q>L}0VFB>(7{JIH zwv&bmZe}5BoAPA(pZB+zJyrFSrnozvwLCdb_T_Kq0(IL3-1n6iwJQIV!|d=EP;QT# zE~XG*nJ`s5_cMuWZK+_o&VgkpzY|?{=?6;(Qq2D_AS@}+c~sA^E!ml2nzcr=xG&!zQ>VARn7G| zgMQ_6*Z)nw#p^@4HlWT9LnoqH29MP&<8J?iFkmz5yOtqbFS*!JVn?^bO{6TdidDx) zm|6Ol2zwq;zQDqO!Y;iGoU!BG=xCtNeYO7Jng1bjtn(wo>M57L8J}SD2SCrXYIa`R z$?2H8Ylv=pm2VqvuVTlxmf4`4)udg}qW|fwlc%LmL~6WC!h>dR_1L9+sk)LYV9gP) zS`H_A!kMPRxpdLdV77iqIQLMi7{*uwESiHtUqyBK>*}j1Mxgxx;{vRHzRo76`!qL5 zovZc$(LEjauR)L~=@;s*SuTE*0ERD>H$6<}R&?eTME1Pl1GcRI_-A!2I>!2mfSGOI zNv+Al@$}WxzCfNw;H<_*#Nc1n4d338zpB+LD2b0cB4n6U$6>|RfX%mOUon$x^N*=w8ZXLA@&%|@H5uXAC!j35-vL~7E! zSR{cQJ)m)muUj@ws8E@(95#1lnJpH}I)$y&;oy(L^zANYeFihsRr) zuSC}&z`s>Ne$#qYLNwUhd9pY6G9neAd)YCSqub3}2?dJq9Lu(n)1p62BLdUmfg5xa zX*!aec9g?tzVt8;bln5`dDOQba5UXIeb~3I$HM?GDT7ruXw}!fs0CqIM25Yt2}*r8oT8zdfN$?UQrO69^*CP?RE_VU4SVTQj##f0*pJgJLI z&`zWqn3bU8EPx8pKz1Pt=l*wF4>?D$Qu$sRI;Yvd*#;q~!a4!hw$^LF9*dQ~{MfPt z80N7RJ)>_xSvE*0i_W|qV)+qu4C}^Q7wM$4d=j#0CRG?oWqP1RSXV!cyEf_+5KNhg z5fFGb5ZcT>w15JaaA`2ls;@|DmVyGwc+z~4IRj^*QX!Ylto26GC0Y9uNmB@wyJez{ z%crt_Vy$LuEg-TM5Xvw0V3(%i|5ODnE309Tk2~7oqY~>+16Aj)E9;HDq3?MGR-Caj zl3x^_K|9ZVU3kB(k*OLn9y$x zL@$O-Gur__oMc#P(1zp(Qp5a8x3-u6Z*>V+$Qx`HIe9E`Y!N0|oLUPIJm%+iip zt-M)ARU3Se2DGvQUbSpX-GB_f!2&*N>vrUs0)Zy5o&@d4xqyxlP}wz7suiklu$Clw zb~!~t&_i2+@k}-Dz4EYt#!QGi;x}{UP+{{cs^_j_>TKMM3B2?VA3#kC0UL#yie}=y z?<)i{kj#Ne!tZGAk#!;IqBOX@(4-vUD4D%8VA4MJy*1=*+r79<4piP{u$NyIOkLZM z(4=1X1v9Y?pVHJ5_V%EA$83G9c2aU819j}LBN0UZ2oju4a3`6ts$+OQr#sp5vfvN+(|4q=A%+cEfa+A6Avop9Nws! z;?w)QRvVs=<$DZQl%#rQs8ewJRhr8F=Kii2Bd;;fa#7ha%_Q!K*_?%I)MJmO2GZut z#^P_~depL0@@}*ia#!M2a90~s#8PVo__W=8jsEj5Ii)G7$4e%qPP}eXcTF36%SALF z8*qS4fP3<>_SBov{n+)#xDSQE_LPOAhQO{h-C08B(rT_R=;xp3mfH4Gt*gv#*-tC} zn>isRPGI3)?cbV8x@`I%9ql`zEP2b14ae4bB=ixL_tkQ3h3ZHfOoQP(tz&nRv|yBA zq>|2ZSR~_T5pFgSP);lG4!LJ#Zs%fcys!b`yfOEn2W(Pw97$HMZ{rjsYgC1wj^EFi zCk#H|RY*9U$Z`j$9pOz@hLv@AkR}=L%{~@gMqzzVdyI6CmMNKpJn6W?^>f?1|C+$* zr@i=BVCYsm`CL!(OzkW9r=@JT(|I2T3WCn4u2RD?ZFAhuD16W|;@1eA7a>+=?xssL ztGrjvi_^_88vijEoNA4ccn@R=9`?ks6O$Xj#?Y6{e%VVf@?f^(VS=(6(Sc zj6l`CTcb6V7N=sAvWyhkJH{nJVpe-*1{e)`Or*mBOQC`h1+ltZE_lg$GTgtmzTia{ zLM`RYxnCC9aj~mMs~(n*aj}=g=(+L46Q1he6;K zyVI(2xZ{q#~uWZA0|LB1iTQ z-oXjn8LD0XpbFq~NIw7WcA#En8O+1=N=!fE!0hNa#e|!Md@}BDR$S06n}25sPXk?!GJcJ6Rl~7C9i|M48CARwwCj= zKp4~GqkuM+RoecXnW#Y+*DAxaAlXbE8UYo-38e;Uvz{uo1~!}OtnXej@d*2po*_0B0tuJ*p~h26g*qWk zGv$#IkNrd^Y)c%qCr8vwqMiMO*tC~DVpwEiVi*}1(lQL5rreQ(l!wXSnj6SM3t_6q>v? zs)7`n1))V~GQU>{N<^$uSUJl0pI^x%$M<@aM1$|;RXKxClE>!|B-WeAsc%V)C-SEx zj7}bg!)TCz3R3WEN6!vpb9bk{Iyf%hB&~QgNAKbq%eWyc5WB;C08JLZ@tB~SW&yg= z4mlKWycC8y%t@)3f9(Kjm8W>A?0K~$TrD@7_vU3T&##qOJWXLc7q(!`q{agW@SFNh zy!%=`;iY+h&Mhh$_ga8K)nF>6dBjie#crNx5!=0`MMQai3~k=SZO*-w+b)3Z{=i^R zp(hP6Ba;2EM3N-qQU4eL+fKj>+clMPPdrG1m-dP| z5e{ta+2Z^BlEsx|7h21Xsb~ zwRsi}RAi8${*ljRa|TqUFYsVfh#DQ3+*5aibx_lbR$0Ne%q_Gc%QLjT*MaN}igR=> zP=o`th|DrS<=l7n*Dq_^0&{&7uW}gXAnoeh8J3Phx>b693MC1%4{_isBbxBdzoY9#YHD6im#!X;Z4T*TaQ0+Sj??fg_;~}x>ehgP`(=+7E>S6f{ly@nxCd^y(&_&8;TZni{O~1&n z0XUVUiX3lH9EpkQ$XH}O>3lM;SYE;M*C0~JQB!q2BC}aQRKKy?!tkF|4>_e zk~(h{ns|&klO#f7OI~NUs4xNM!4YpH2iQx^GpEosYrz;g!q{S&CwzNDo_L-_`xod7j4ew8NWfnr1~pge zvUH&vf|;y^DWv!ns!R?zI}>~GS7IW`60}gvP-JDX0?h%9^aiTr8`x7!)TY$5V!IhH z>sBw^Qd_pzP=oX@zoY`4!1$+5jiEw?2fZewDMX$nQUkzFX8WYE6h?wQJ!y_5%d z0_aJ^z)Z0mA)2+7CPW}g!l1zNYVaaP_A zADqXy9-3B(T`D}I;cY4$rr~YN4qR0qmaVw(Zsm@^zrijcN7Js0@yjinX@49!)rp1K zw&KKDRn{z+w&KvW_^nI}_H2Xfl^6&_Zp97*#W=U(qU&^=T*5n&zL-biP!1%7BN=!H zu?{5I(mtMVQt zD1HE1*tpTJ|EeuhfWq4JKBHf(S*@dSBy-zSa3TC*YAkrPyrr$#ly}U8y=M>B=yP`p z!r+=Ik}{aji!V9lVhro!Jn_x+%l9)Lm3oie@+R#FtiHa0q3OU&B~lqxtsFyzc$iwImp`1 zc5sk6o1Wkzai;*x1e-a%&TT9D{Mf@qxnkoQX>`?lS_I$@J=a+khk27vY5F z8lJLB?t=kS6Cu-0{<~!mE)2N=yo#g&!4$=um!9PTQnJcAfNU5i#<@<$=@@1E+!5@e zEFGLeu<$qCpuQ4ZUBUS*(wP%hRdOJp5J)wlrD7?-DkZ>8^b3GluAlHIn|WUiKg9U7 zG|ANtQ?8bqdk>!S#!b$U(c_FaPZI6bD@1)GY#XhbDlyGII8P>%YIux?y?Q#34$7|7 zLWRRHBBL9*-tan1X2^vMPidTy6NyeCJ)dw8rQ&7ZGKY^FFYd2!p{B&26!s&U_(HOa zB!P6G)6aC2P@e@ia51xU9SM}}(y<4F&+gU58|?LkrzW6~jUbLlEeig$ zKYord+0cF?6=b+~-B2`%zBxsc-i#p%ALe zkpf{Xwn+UVVX9Jki)rA5QZ6J&Q=Ckqw)ykbpxF_u=JI-;dHCE?`fAjM zcO)qNMDh>sp9sl6AGi4@k`cU;5t7(O%^&^3dox4=M?Fu6&=;i{$P&q8U_rNj5^Vmn%W(6WcY1Xo4)3 zQF@^Ci&QOOe-}${F^~?!;mfb&b4)y65Cei)U&w?gJWH+NO^Zxx^1-%3L9)bR5b1Ag zk`8gZw||+C1}m6-Gp1|j{_ zka_UD^GlyTicQD-om;;*)NhSFe;k7>u=>u5?)!g!I-kS&_({Cd5lOg`?#^CCC(`C%f$+(>*)T%o>a26hW3^5x3I6LExJvV_!N+OReI*|j|i!1)K!n-vb;_XDK$xK>PMNsnBIlZUngMdl zJ+G|(IZqaNWKQOkzcU2v!nkc&Gx90wX|u50Z@G^~+tym!*2>uG;lthy&elNwbusy{R`m98IJwT#No3W(l5mHILZ976SV z(wq>ztV^|yyjx>xELMw^M{D9tE*T5-;P74s8UOj#btFYe6Z$CFbbgh=)R$@p?bIV+ zC5lLNtuaW~lPNm2mvoxY7*K1)F|-zCsWzQU)XbUF`K7^p)M>MJ*@>w8^-^ zRIN= zAqp$9B1v2?+Z6Gn9IOP2kq;b~WJ=B(oNURo{d(^l4IP`(q&xy@mc}}#o{LMeEy_Q$ zRS5O*U-U*T;)K~Es~sy^BHo-^6>1e-fBXxr1%lc|$Or8)!>Yn^e~AE8D}GOl0A@|) z?4IvaUvbf?QSuzLOJzPrcT011r2Rm&T0|~(TIo~6C1UjDrL72MWSrh^nrLJUgw*#x zfbjL?!LApCR6K&vD#yu7xwYiz$*}*F&$jgb(WEaKD={dhac)-tm|mOXBVHx}#IG}} zCM2p!pcg-(wPtQ@0)Wl?e)T_4k?k#0#T~I%w=PMg0SBNwB_*WBXOCOh{GAk(X5JH6 zC-?EwN30tX!kfM-)9fq)WdKuc(zDghn{9=*7Km`0_;@xu2cUwY zn>#Xof;FS@obbEoM?@`P7u7;kI}UrmgA}G}J&@G)zl9L_SWbb{10>I={^{ieY)X^+ zvxJ*eMVLf4R+7<5CYql9=`M8m7H}Cp4fTB|{#9H1U7?+uucW@vE>Lu~GWzsGprK~^ zjH;r-q8%xy`0>#xdW-xW)ujT)KTQd^XY}m^3!^QNJG0Sb21GxM8=IamL%62bC(xZV zg|<`0Z5|pVSlq&Xx+t~FB^3``3rk}cN?^p2FksL8EKG8ZzsK`(MIvDWTv1G{Q5hDT zqci-|im4f3MJg|e0z=(fK`{Ads`yW_GZl=)s{!!nxsVg{E{zp@s(g!!nHgI4c(RAolYFg5FB`rvFCd)$K;Wq-Vm%8*}4@IiG7MaUS)%JRvRe66<7}b{!%@~tt?t3D&$&a}ued(o`4>b*j50&YMgaAe z833OvPhp(O%9vS_ia_{Cj(Gky9!-h^6MV{2yMHA}cGF6R*q)fC60OLH<@8BGj4KDg zQEuIVP@Zj@{_pmo+~}SER9!2zQDBRG!tLS^ikhaIo*iN}cRA4f7>`uqxGBVed!@-x zi}2IzA14Eo#b}!m@*knghJYZz){FhW=joRsrpJVS+a#NVWDeuywav5ngKpGi!<(<^ zwNHmuqbDmC)Y)#hc7;f{cIHgAVZSxL1~o{@I!FJ)0D(%U_(G5LLJXw6yW~-xRkc9C ziD!xGjOizs-MpnX)>Ia(DL9Z=EuhJ@RBah}+XcnXrYa7p)=Ox~jZERAp(JJ^@bBPc zvIuBb1Qq^uj}3l>D;1?tB z-;@M;Fy$Wai-nD6d7-XUS)x)na7!KHKEf5qgi3w%zMHih!tJbv7hKivT;Cs?&8M$6$dM)naUg{%TX zy#->$1u~@tN@Y!AYlJgmWx+Y;M=szL7j|@KAwaMYf3i@R#lagA?by+L5AMc&$}4u2 ztIu6xX!t4(5F1)455CYzgg>qFypq5-JJR=!xRzLD7DFXlaOS(=RQ7yMy21otMr}NB ziv1+*YA%(b=k>rCmZ2ZTj=lWG@Y!b9cQ&)v@YMSE8!2zI;w9i^#edoR*!y`Vx_$97 z)2~txd3We5MQ{<)C`wNU3VX4uRrF%YiEnxo6$lDep(=qH9yPUUHm?k%MUs{bLPS%+ zs+=|DA*7m;ac^|wVVsH`3Y;CVo@Bk8xAs?xTdz`NNJWEMmgWz2T9mj2$_fvTl?lm= ze3)y~`!)jKFI9g9m!zF{4Ay+GlT-^wGQtbtDD#@q=LK z$I->DA6byF_?gxQTW;2N5teS}q{^^PEc_k*QLv3mNn$ujOwrR&FIfiJ|Z}y1-j{ ztr1KuFgINGk>TpWj?}Pjs7ze5Q$EOcifrQ2R0CG5(~xeLmXH?y5?pRb$ro zYE(>3oWWZMthnXQtGO)K3Z(iZuMeSB8YDK)$HvP#MQ_B0q=;h@lp0n3Dmm4$-cMzS z&rJecCcl?K3L2J|xg<0^wIQP<6!2=?)bryM(H=Toi>J$8m?Pd>gMvQ5eihCQla?y=5T(YGKul0h z^LDOd-IQE+>4*3_*CV|Bw=PipNJ>(?#=W1En51N$*$H6Sn#4T76o4+0){oI9&6+`| zBTm!RQ<o>Dy^y zPS0~&yx$#^MT`q(Dt1pqc|a$8ddVeJ8hFM@NHl_EyA0fJ2K_q$49~fTx(}f?X87nk ze}()~^EwCO{BBcOy=g%R=xXAZ%L0 zA#0JTcRH(dTsGLg-r#nsSg!Xwa>u^t*Axe9X!VeJcD|X$oaS#@pLB2__2hMo9gYto zMglY@3pGetqw20BW?J!I%CMGHB-3o6G^`y{)&%RxV=bh505xVaYr_dxc0~lzVm({+ zlGi)$a)^V9!dvmN7F}@-p%9H_R}OEK5BSk~W$oJv2%!3~h03rA?$^_*1EdSPMj0ak zft^ZwL+vwPX?zXm=asIyu2oxWib;aa@9lnTTWItd74ylO22+Z)IR}ql9gOjid(|?W zygA_0xN>!BmTI-arDI&XLQ8nf{TG!PN~XH_UeJ{72zaU%VOaSYL!8w(9j5n6?5>?O zNJyP)4Q%g0aYgZ7Lk(+a7Z^VowkSh2A%FMw_KQp3Y(HL^L9C4_1!dqmRM4>@9$pD? z%&Cbeh`;r(CzC^;S}B?M;Q?PJdver?E!HA!r|l6ZHifdpce=swoUe{ z2_W0_LxkL-p7e)55xhdR$8=_WTMsHB>aLRpR@tqWq_lFWtH6iGzOWh(Xu=AiBt~B^ zTcGosW~}^L8Y_$=>UJBc4hSJ*A;Z;{^hy_gD^wM$6eTMZMSvls%2fFhS=y4Kvr4i^K2sHlwAzKO zSagY^-RyP(O9`W)bSG80v<6&HiRq+?S^lB2b0Jj2`ylApB4>|=7O)DM9m%6Q3TbQP zJiAK}7T`*QK&d(ncyg2Dr`r3pw#Rm3m|H*4`e)6!ezfvWI#QQT9EVwDqQ-8`Ve#<# zpJXWQo*w#1rLcf@a%GzP%eK-&bPs4AzOJ-a7uwsu>SSDizk2lp2|96@8d^oxd>!a- z4!ERt0A*Qt|37W(N$Nk@3!O0zUpew6oiA@V_@+M!z0=OlI&R}C5i1viYeRe2Z% z;g!pdG(w|fK)w?<-u9lbQM_xFsDnWPudGMlWYQjuzePlZHuw8oA8GJj*Ud;#goCix z>IIto*@Hu?q~6WA`mJGC+ps#I3qHjQ=wJf>siuZTT1Bb~F*VSEKOpj+1UNazBdZt<40?jrxL|jRG+g0+xb$=5ugC_AFh|G0=e3tsHSssQ*Qql(=CR6>{ zWH0VTpmw_{DN2nn&cq)kjS{A{?7 zBu6T=jxHI=>IhSPgB-|95zcZDdOnYXQyW43KooGL5YObBC(%4oWoCZtbijvlN~v59 zd=nVB0+e1&v#QP2I-*7S#beT-Ypsc9B;n5pg)+8YCnO+wZ>Ep%;M@-4>I-BoJ$2Bx z<~Vb>tCYvjBNsdTIJ*Qp^wicNHq;1*0QgVwJCvgDTix#4M@#qDtp8vy$wB zy-@!?)3(&!xtQpAL+lL&JKIuzFzOXqtD@TcgW&wJ7a3)ivOl{r5*hvsl;Q7_eBdu% z_eQ*b(!LY!8?Sl0_2gIkLOAU=cpJnz)=UuW^Z9VbJJ5g&5I^L_L~!cKZj?C^7Q)r& zxkgtOHwGr!3$Fk*=178zdDh^~+M3$~`h;^LnSxOOV8hmpx4kfpIapqLAC`csxhUir zY_6v&YgjI7?8STufe(s+cgW^Wf*8#8CT|?ZXl_sR{F0whgf6e}Bn&ZFjuOl+^o~Ew z#Gf!g-ED0Dg-(n>72;GeSjSgpq_d4ID%zmVLw5$uuSY=KIUK7%THJgS}hJCn;j0m$v1=i*4j&oq8N1de-g(}X>QULCx0)1Y> zJCRamw2eiT8iwLs03i;ei)Udw-c2kk)ub^AJi%UV8*X`G?8o(8i_L9mGqwGY2a7S( ztN%gzI^6t8^zTpb^3$nNtrMk{-!RG532__Fnc=XAsxIUr$t`wnn3zLv9t;RX05PVIHk|W4LcP7!aM)_YfSy3ghnn%yd2v;oLkEL_vge zt(g|hgU#E zH>&&Ue=E-|sGq1g6>AA;1&z5wG0<|8r16!jJ>E=Ph*lH{R*Pp0%vj{`0}d1|@o@C1 zelP7mU=IqZ+JZDJp#B(^Rx*QV+GMUus8MUvu4joBmzs8<#3W8fMG-3@4V#?Pnj(0D z-`0umPK9z_!7CJj*~QLTIMUkF^=ZnL!{gI}{yaS@5sL}W_sOBleKs?a92*z;A=gl? zEeXE8Iv$ehfi46|Ki>Wa|8ka(p6MfQ%$exZ;s`l!@*5{$%1lzvpcZ*W8gh2khC*yu zNt62Xv!`2=F*E=8er1f1~M*Z&Jk`k+pyBe+SEOdmD6`Aw< zmMv?S_)jS7x6(>$A4-0Qf|dm}x8^0sc5mDWgt-rv=lX7&rjP-Dr7gC7slqY;%Bi`U zgPoefka-^e>Mq&s3FT83u~mLNz3|xI$QhwI zqnllANA|g=M6K^$FP-$$oE&dP(|h4-viQ~4N4>w}&a!y_{s;)z-%|*#p_0&UWrAZn zvVYo)EZVH*TC~43X=gN8fizfi76+bNfiu*WwN{)D+3@M)*UOVti`*5dL#LK!$CVYZ z&lasby<@)*d^;VG4nD|E znxcK*^~qY#1@he$G&T?MgPm$zy$!*uo#vsY<%aI;%)&fa39(;@I-;a^&Q=8@s`tLttP-3bE7 z{NwN?vxPo!jMc{W=kb9I@$3XOQvxkG8;Esw6G5~%7eqm_x4i|2_jz1JgYOXD=OyK0+N|QDTT!fvd<^;7iCb3mn|?vTNRsre#$ypt^>vCc_!WZ;!G1@G9|f`tZ^S zhclL!pxnHIO<$eaBrl^9DKigBWkfe#4#d>zwZt!pYTSU~gS*i@h zyoLsH387I}i< zfmqd%4UTz&gC-b5n|N~X6b)TA>{}Qdhd$KW=x*-2N85!F{VvR*M{w4prX)|wA?^2Y zUN@s<@!CcOWtAxeIr<*GgND$C<~7!t8&Kpr6h2(SbKKTL`MG~}HmzadV32pdVFuQ?Q!QR18^h$t$2MHZ83>|h$E300 zjH5kBU)T?IKn>B88bQ1JT_lbSJbBspkU&{ELzZW+xYEkzk5I%3Tl8@riUUuZt_7i% z0n9!wI*$l&PhBDYHrQln8i-$H~6@5*`8>$h;ifDkBWkM)) zg3=fy&OzN?@8XWVv<$iff|6B|GTt7m^*y&Q-P%6y*4gwk)bti=Y+^q6ABG5DbY&={ z1YJ||1D$Lxrk%vd*gdP^TNg|L52ZI`0SOaaUpFjeAonn7Qi1<6W8`o%7#ojKr61y- zab9=GNBW%RFg@2;kB2gu%|#q9^yflyF7APUo;B}9w(fM`I< zQg^&tlKFsB!8AnF!KLrA{3ZZyfcwkj_JI(|D}T<9E92Xw;Z73obDS__=rsn4-q~i@ zcpbuGu;2(Xw(+5POr9zNc=vI9Z`|V8>k2xwv0EQZdq*PG%hGRG%91Xyf6#?H4>fik zlXaZVpY|xoe)Cc;M&F==-K}nMC$~?nS>V~&&(*>Hu1(hK_dxq7qjJcmj@7%6pgFg8 z=5d8-Mo}NqS*TTdD~4X6j)i)WWGl*O{Ys4}Z4W}BhNXHTWiNHIEjqy@%p)xxM$$1P z%gn66DRZrW4pc1aj`hYV%j5MB*p&|}J2c-o4Qh(_N%Q@5OsLOAiD=p*z{e3=DkCt8w1aghdCzKCz zMR$8q)XmqW6AMlkW1F&O5I^Se?x$gh(~{I+w9g`so~pF9Oti?0+%fB?Ak3x1y=zcu zTjzSKLC@HN0>{sYZufFH2h>ggMwOZU(v1{jE5{u%j{F9^5qvOsWZU#reHGgyGpHW1 z<_VN$n2!Y{;%(;NY=py*E6f>T-b)eV|QyIOM*d_s;p%qz7$H1yg z-L`f~r)f$T%r^K5>Wp0^BRX*SeCJ`z1XtIs$({8Q9-;demS3jmRv+gd_`fc~iMOL~ z(L%QR;Ifh%beO`phN_j)ZocwifA?oX%?I~Lg4uPm|mvaCr2RBUIf2ZU^J zEahWMOfLt3Y|>}sAvBu<2C^PuL#p4<_R=y!tE1M##}TXFMlyszt2$|xg{BL##t`62 z%%je+G;WoN{n*)^l)XFZ|fwv%@?hF)YJnj(Kk}uQj_+9r95Bfz zEx$^clY_@%uqyL|(9JA8z=4K!o~x!U40@6+r(&%y&B&RXqgcgoTU}wTCi9-zLarq9 zVqKvvCqLGJTTN~kZ_BF&rn4`Zb&oZd)UOX{MF+q=9WQ;+uGXsTB3}J}0D?e$zn6ml zP>h|hnpwYNu9~cOaF(2KdVrQ{sABMoh2N${JF?DBRiG=I8Tu5{p@&1y2-oh=(~cB} zzAaoA&JI@BoH^{%zUdSrTpKzi0tsB2K5@pqy86^tsN+k$tmdC)r)Lm#*Vsv?Ky)b(tcB40j0H(A5Kit z?#d4wl2lB#1mIuOCc@$Rr#O8b67Jxso!Rj7r(yd28Ke~s+Bl<0b8T-N>3Tkx+YzQB z+)7_s2E6T;?~XU|r_P7-Gt4*S!K19n;M~@KWYOG8n-ElPKr66;_(IAoN?S;-B@!g( z5C!)R@2>(l2%q6p#9}JY_8pS<{{F;Jh(o5W0H_I|yt=5RUjz?&CUP60*`+;9-C%9!g4Yg@E>Yr&0p|uJR=-&J z(jN`)?+E~=a%QA_S?OEl!OHFNRrjC0bFM$Wd;7A#UNtA(xbOb7+G&K|%v73WtQ!7r zxLdP#Sb@Dm<)qDeYpD8)-#{AYGDOu)>|BP7+NqwE6F%!mshRw_jDgfl2VI7Um5w-< z79Y?~8SQ)zqMJ9^xqwyDN_)C5s$-KYqVPtYdah0;#%f}$X^d}X2RcUsPc%lhdU43! zOgEL1IIE^|Y7459*4de}tDflDnMnGpdIv)3B!hM)lzw{XQr)$RyQz+6)XFKO%aT+t z3$b%4tEZVRS=8RY|LUoz4T$;#j`H$R-bUiD^&+D+W0tjoiM7IfH3M)p!x;^1UmI{q zHJwE*H%`;R(sX?)IVEcMnA7jVu`D^a?bo??xv(Zl+$4!FFG(E!UQU+ynde5XJ#+tr ztPlzw+;`J8)g7j~9)@>}mUPJV;;6u@~54b{Z;d2jItbpRdN#MSVy>t#_pxgmxcnpzwfBM93 zwvJI-7o;to^l-Q?WqD$n#_5pIFx~r|P1lAz{UQsKz>_FS1t^igCH+F{6B{;y888Fr ziTz-0eUnEoknu&%d}vWXPMd5_NA!x3>&-y+nELS!GZ#*e=We*gV?ihn=6mJy^8up8 zMeWCeDAdW&DLy7xoT5r$7rn0d5TY_VMO%iJ{V4N6)(~?~pFVH$Zr{P!;?c5aXI_Z8 z(%Ildst%x^Hk=LF`L{N(=kCXtwiC4-Gk5NwKl8x3cb%_-TPS!4RaIfU15{|ps3EQ2 zP2?PIP(^<~vmdT}|H}xJ6CLudh4YyktucB!Cs&+JcMfp7U`#@DD&26QsSWgl*mz+V zLiMKm|NPBkdiM#vqPUSSu7~fZPc6KN5UCakNnTiSC-KZxIC)bUF8tY|7@sDkctDl- z1=r9yGB+e4X&c48L{Krpg(s%QE|i-S$hrW%LS^g)lF|AAUM&2nhD70FPB;bSA|;w` zo%jLV5l>5>&t@Ph&LKwN0M|1c8i;)BGFUj4du>tAe=|39Fk#~_ zF*~%#=^X5AiiR_pveTi=w+?sjZd&i10E7LYF$9_7XR&_sZ`_G>JfFwUe*FFnj360o zQB!-lreJ&O-gs8vgPEe=!52V~4tRF4aQI!+&i*EOjo9(BD48CT#hN2>N)xy$M?QXtXbAK zOe)Ww;ow2KuDGEE5e3-D;Thz5F`GR+d$wUc_zTN}2mli0#-{?Mqe~VC{OOzq^3aD1 z8Y4ps8iHoS(?`5;!K2SYpKsjt!U!!eF>NqAOIz_SDu7GiI=Cl*nHaUfVX?rLUxU*LFDv<2`;UxJtmJ>#@!uh~mJ zOMD*Y7uHjR$z$>bM(!UHpPF97Oe;cPnS7slE_!zo^AO!Ch;h*SN}Y4|9VVI!DQQI|WAv{eW?OcxWGWZ4Vz0+MJqHsSC@9lj(T+U(djIZUSt#o`go)Vy!aD*fqTlh%wNXQZ zfBIKrBx*RGWc+?3D+M>P59p&7?!yKwT*9?I3mv{M%zA#hAiG1P z_&eL%+y6(T#3UboaOr%DwoWoqdyBg(CwO=L8?5}{rGN3oox`=;oFph+5`H{M)W7ytPiTKX+sx`X|VcY!^Dp7Y-wZg0GP4-PeWF3vlIK_}?(a8K0Z;eqJW zqhw&YPxm+8gOhm!@noTdN6$B2f(K>8_A&DfsMN*@aqVNFvfuA#zDMcHR|vrHjSb5` z%DsoDqF4X)d;^a#%v%3{d*8O)Hj*XyJ`wW|2z6~+?j9Y&t0`;qVeA5Obsh!-w zE)|Ai?6coAMdV}B*=C-SO?^q)c2KgF5hhMOtcvY{rU=t{F`D0iMLjzIP|Q>ni!ZX- z!toFcU?2V-erQP_#1$~fghfDg@EvYi5DARSi8b|aT~Hs`kNT_0=w2*q#>>V5Hsgh) zen63Sya-?KOOSyX;+tKva6qh_JKMMdTUWF-C}7G3G+>%Rsb}uz$;h>a(Go2g&gK1N zaO=4fo{v#zv90WqG(;%XkxS7B(6z-fN41N2A2`^p@yzi*MSIk(y&`854L(;uQe04z zT<>1jy(X-2v-a~GCc$`hX^^d;n2{FQK?3=`MC$6oV)L)2_G>7cgzQ}9F6e^0U~e7b zOLO_+i*~&EC7hSwotgl;KOZ_&cyfgqDrE)LmTB{ z%u8@Ej*M&ArAflh427LReql!zW7urf*uSC}GpU=kUtNRG>lxLD?IB7x)K>Op0*LJS z&{@ECmU@#Asuk;=ySu3MvC9_HU-!t0+UP2A@hPjj!Itq;=!&>>Dg0Tz4cALbI$K3bnC1d{5OI>HQxau`;)KMf;6C~U+~&~{Q2yve z2WX?Czs{k{1T9d_BYq|1#b{_j8qli!W_c6X{>Wy}CWu*JQo=Hzk=m0X`C_(er$1d8 zV|SRwWP?^yFhMzw>qUg4twIF!`d3n7`3fe$;i05q_(mIR2IjLz)mY0qceiw0uu)V^Ue)vWC_u?{x{f6Uj41{_S|@JR&=bQt()_$;xpGW+coG8 ziB6ihOj4@_0YBmH1WJKX)uZ4C*6qaW8vAUNkF!E)nIaUAc3D+<3>J&|nEitln~IA0 z+iy3~N8&pum3r31cgKYOS>PJJL&=l&Gp#9XiiITMJO z!+;?miEPe&=MOtGFxh?d`r=jQnmus8%zf0w!GT~5nRuUNslYphr_<*c$5L#s9Us-s zzgitu8aVAwkQ!qUAOx}rh$eY%7ii)brZML2Ee@_}HX(>1j99{m1y)^f^1TFC ze=lsC!2tu%Cg)faeaB z5qFqN2aI>|IE4Dr89UfPdd#;Vyso?&ukA5J(i9l335vrNNw67a1vn)fwqVapK)%zF zJ0BW91Hb?frI01jn2t5vf5hZWc{lnl1lWLB5UTQph~9(AwH;n41ty)M0u48M3sK`M+yE0?p= zd)*k|MYnkm87!bWHzX2AVA)gKGndcm_IbFjQF5UJBmO{W)~T0Ey!`+4N{ z0qn0Vqr#PET|=yk@p_KgZpxuSP23w7o_%e5n9zkaRTlK42E+)Wl?g;gP*V>B3NduNSEew86j z&63nMIWU%=Vqr^1wUg1v{S4@SGJ{avDWijlt>y7SsRvkU6dU>m1NsON2hhLKoMr_p zB<7%JPy=rPdW9}R4b*~M65WFdV$LEH+KmA&ak+>%`plkLpn-uPNvrzhSaZ?MCmcI3 zRa!vU;c4{+nL2vh8nts4r$pjWF!l+i1!R$hz?y*xDUrYk z6n3PBfybMx^=`v%Vb>1XVpm-a*}Elle`i_XpjUSB+oX@2Yvvi5W^aR zu*fRZ41a15oa=iAn@I&YEdz5?E`GlmNMd<2Gni%Fo(o;rqp_8oSSWT6c ze1=)cNrG*b*8CIR9}akMHuN!DIn=v1P^d!P;QqiMXYW5dfawMV#Lj)2f+p9*_#{;= z+Y)rxEI+j>U#&75yPg1@&OzuNZw>W{t!Dxiij}SLbq6y5S+YPfr-y)p*MWwHlX4hg z1pSNNT!T&_D1xCMK0Wg*61)EeQWvKEWCx_91u)K;K_cWSWcRGK7aTIDRz#TE8Bt7F z^(Mma+677=I86cUKHwV;uY#({g?XE2!^j8T zZ0rMV`D{zbNx2#CKWEAU)T%e|QoX{8E!#arogILg4x&b~lOSI8qtB|QQzLzqoP>$^ zIk-?GDhEiAIB+VMdANX{joJsMAooBc^ie+~$1LbH2qcLMO+FRXAn@UywnCh-ek~$` zQ6FtMjd(dw0Aq&;6(1j$FjGmDsse`ju%$R-D^bGq~o>}*? zGUP$h921LkR1Wn~u8uNWTS6-!?lT!oU5Hbzfc)x;37eHGvO&>w!}J0ah3^h_5mg#p zX)AB)3`uC@vR7PV4*C*Q8eDHvy1itN-vmplD@ku~S*%=fXix3Q(0?_N@7~#a2OHdm zF}su3;f=cL%XO1yDRS4YzzXoT+5}#}FKmH@1k)_S(cOh3+{f}E3$<3HVZ*x=0G(#& z7zsT}23mHBnnyCQ%-9<6i--)oUZ*9YD$4nMspMwi<9A3r$Ch-@BYAT`Z?3`|LkHx_ zUS#p?n|}zgTs^vH4(aW9SdKSx@OR&x{7LLXNUSs$7x68{FSLnW$P~FrTE1a(FMy=@ z#y5!KCZ{Yn<4W6ya0AcpQ{G?`$A`#050n&(Z$ zy=w5yY6!b^X!*B&*8L68_&K$PpyH(#&EAm=A$4r7Hnd2YgoFKJ9=rD z>gLt-i+m%JQfv)y5zRU-vG$T&8&-Yf{9zAq9uUaa_x$Rn_j^y?@8PXw203sTCYNDS_kftf)%=%)|%p5$HX(4>Tk!#cr2ED`|u4{AD4!%mkvGw!gf{59+<;c z2k3sM+pV`-!(qMOvOD!-yKnWIX0J17Hwx^kTi2g`oMCV-c|WrH_K18)AOVEpTvEy| zZpJ439Ant(CE0)QhA6G?_x>>lBqUHDk@7=(gt=5~kGz8yqznY5hb@2n*`9$vmIpPw z2bt~t0c7sR0Wsqv4kGA?j0#`@Cf6)jBQChSA~clX1Y3kBPplCP z`a_Ll4g};9#39{*2Lc<3C`&pD?}^@k%QyqHBz)$}OtF}aNRby1Vil~20g3dqKefGlRnMk|kmX5^D$3Px9pZWYa+) z38Sj;OD1OI8dWCL(l=mEnU5#uXspo>j)r$pf@9*ejO^=KA{eqtALEsq!HbZJLiMQy z<`hQZr*jV+6%3Pz1>^;(KuhBNJA|3TS62iP5~3kE>BbNgh>ee}FV1*Ae&NyZrf0D4 zXM{(F-!7e-3CTG;nFXI)-+*;eiv1IqK}p}Kp$A^VI-i1OiE<;^7}9`Ay#X;9{pJj3 zbT&E>o=LU<5QffH6NU&)z?0+#Ah!;cu|Z_#{4+5K4Dl4)#HYvAe(nPX&)lIq2Qs`* z%TXyE%Hj&{{}nqb)p&|;@c;dH|HXfP_{(GdlTsS9W?bI;Blm`FYSu-=cpRrMR}d08 zigpSA` z)3h1z*USYO%>tV6RrU76#*;fb(n2IoGdD81Q&W+AL<0UN8Ca!%RxSN(Ep2-G6lfCG zmtQqf1dcT7#3_=JAiWO>()*Agy-y%WtotJBH;SOXEU8FsB#J4tBpC>v9fn0JUsSn) z;5`{X16<*oEsA6D0f^|;0X_Je3T4_6?9fW?6uvR04LmXED*XQY@ASvl*tC2LODIKs z6V)Pu-7feR=zP3&e23&N2QwBMXJ$%^X|#ba@%}nK;PUf-013Qu*%;%X;__PzN(kbE zI0!-#;&MqvT{b`^iYq&mMt+sv67rcy+H`~lI3?Kw?1mWPp!huk{CASeeeP46%VJto zUfQ%g6>4>KsZo$FsmW5fW;PX_ zqD~G%n_x2PJCl7hn9?*&cvR0Yhu}C?+l~GSW5&djnB!BdWLW-ymw*rnEP})k;!eDo zp(e20aYk3HBavKgB&R{doT%e)vVB4${t@OosFab`txD zbHg^P42L-b^1#AW&~raQ%amKl2ORbaVM03itI=24MxkU7e?@(79#G|%ICa8@cfprn zknG49rKTg7dINyM{see>3*gCgMe6VaXmTakn&`e!Rp5uz^HLk-B6Th<6BIZ7ffEn%|s@OQqX(3!LSUP<+7;U z$%wcc)R@6)Q9`?Ov{b$`X|u>@*td{sW~6gTlvDzLo`8WI*saN=k zYQ{kgrYZX~52L~#y@NQuM_<$U{WmQ20V4YX%fDg#(-_~?0i%)FgVTNtJ%#>?-C>g?sP?0~asJh9U+= z2AF-NJMHoJqVoRmWO}v|>M51jNdW2ZF7y$@>z+Cj_-5?0UHTYf)HtA;@g3Uv4^+mL z?}!)$aiq8a5#LSSBDc>3Q1~yj>k8%dR+a=o!+7RFB*oDEOshXU+X?fr{&dfy;(+o% za67doh-*!!7mB`OT0ThdL|$B|cAA$qtJP*9qfKEuvQ`*KFu16tf^-Ef*&HO9aWd}r zisfZyc^aYZp>evRn$2?fwPF|cnBiH&4%0TkdQi?ER}LPF-} zQKS3zxefT81?MF1Dp1is8|04KHFyvb2r$zL46;m635U+VG19yQ0-R>8$`CAS7*c#z z^mC1Z6)ja$N3i8eAzPe`zCAY*%u(5B=Yr;_B-_#3^Mx!&V)fPAjds&6)Pitv5t*Yq zXdNisVJN-jn45&9(w*s>h^W}X%wDoI0GnXsm5Ap~<1)$=7tTZoA{Vhcy7N|z;GJG` zhw*xoQF$#%#gqeVp?=U zBUuSHfl@(wd3~IBMMC`3JVLUVzbhf>VU5_wcsmasxDl{fAo z%A@pKykb*1*wjN|Q6!G7Vo{r;KWzYasyLHMcUm1+DvcxM*Lar2l~NhfDtrV-X5)c* z?f+x$3_cm>&J9aey`e4y(#@ckg`Ej;FqJ!hImbM-TWi%QO~Umb5K5DDlq6hgLvfiT zNXPya#bOCSg}+O}-`GB?l*1g#VFIJsIW>_8O_c$2L$pH`*Ik>UD3R*Qj43FKs+n1$ z!k8#O7g8N{Y&@&VXJpu`70b!aa@11M&M_O|1a8H2HpCMP#llU>-sh0b=#05&el{9y!mEB0AMb3&SP z{E%qQt3K5tX0V5DHkP^$I(kheUYNa?-Ay z+~iCln+BjFF3TY<$thK<6KjcfOpQ3cb9PLk;(Cc%uD2rE?VgVu)7Kz8BeSjvm~1( zS&|br$I>qE(3*dW_%zeixq{gx7dTUxg!z?Nk=Z?(re9a`#X95*uxnNF#U{uXdV9#a zBn=J1R>DSMVdL9UnSb(nEsg&dVA+{7d6sc5CcAv1;s4n%vyudI-l4Gjhd0|P28Pxq z7#P65TnPZ1AONJ?&ag7JFJouL?KhO$E0<|$OupdF4CQg;C726T`M%XhU}d9?B4}&- zBF|2y(~$!_8I5ctV;gY7JBOJ4)_Fy!;*te^kI$0xAC%z^^|E*ra<*|UwK98nbatg~k&2ongV zq7N$*A=uukET%avrm3uL=PanJQ~;|4;yEpqN$h^T#!DTdROt_*_QRB!TG}Dh%<_K` z`(hsbqF^|YRs_juZ_J8A6|c<9E3<2YJIgLtVHT;_Wma~XQA1uA%S^?Wife{kGwWn+ zAmdyfV_O0j)~AXnfK3(iEUaismXV$0mz!fBtT^fd3MjEDZHm^3SW|ILy{;+D&jVnT ztJ7H1G|U*1Y^qOYV~$^TAF4}8BW7);TS$RE1wBI=NR@MFrOxBZK~#d#s}kKG3>&F5 zhi%myG<2z|h$WD%AR*{}ng1x0B6Mh)kf~y33@4p`W<=;>r z%&)BLn9jrWuPs@;s&wP5x^a|AuS+M6pvQLU!bxf2NTPt;$>b7iE$vPc^&%|ITc?-g zSCu?Q@|`82LKRI?C3;z#W>ImoZR2LEN~cmWvyyYAtb&)7$H?>nlX^seK_cjw5n5-r z-98KSl{MYGj3#EU{h)17xG0-xPsW}VG$iw?l?8b@1}9rC_N5W%v$}AU zTe@OIxfs#zr|4guVqY<%T+C?gY4FAUUvVXwE3L|tl7%yEDqGS!Wc2&HVo$l)lUA+Y zNj9|_vsJ~WaiUScB~gBH#o% zFlH`2n1Htkl;hgDnN!mSjmo%$JxeY|F2)5;VUg#s8T1T*^D`t)KidL2FeNMwl1t$QfDafhRy)^woOC>UgRd|k(S_+3*Y9!#d(G;GJh2PA( zK}!kmTjFn?)x0JpZGF64={_fMm!Ps@+&%rwp20p`-qnejI7A$slej~Kk*|j<(7y1l zU{B(OC6{)7eh_bBM>s@II=s+fo#;M~9>6hEj_qWq|IqkA9RJFo|I1enDh~5dIZPy{ zlTd^5;IC?GPWZGw0851q>#`fgOKyqV9f`sPAr#lv$hXtTO=N!an;?pM@l%-b(u_~} zwa+5vsRU^zPfqV;EZD}gg>_naC_oL>3#eP(Jw)kVsfMJ?93k1{luC@1I%-9fODD=% z=6Q9*d7DUamNe2isBtnWUdl36a&$?@2l~!LCfPN^L~}@70OsJxnqXC_nqm2a$ngOb zJc&|jh$ItvsdWQt;tkj3I}#C>2M zKsMr#0+EOaq`%N2o(&u4)eOW3B08~lchF{`-_jdR_d=^Q%}UYe(&)w|8yoILvXuo0niAed(6(JBT8SHbcXa8IJu|MI5u%jwG>podf>Jxf z@IE<;&$Fi^*bw_cWFZeWTri(s0`Fc&BqAu+_N&S09x4KR@MiAy(7K0;LwJugjRz)v zd5j*krG+i7%V!F6?|#NUESKZ4HBwKu+KQYQTgd^{jPFJ^(6l&n#NK{KNX`LWwJo%{ zXYnJz=}n#OKICY7FM@D zTlWGS{tGYLq2<$ghEDXY_{W3eA4_8%dRJzyZ5RoZ&lDfC(UI~*Q4S+KmlrCJil0ws z_9GB2@L7Bu!NBHIAY!PX{DxxH$nojbUdob$z+5~0b9{8J?Js~E zJ{cXeZjtUci0{7vKWavL*~hhTw#gr6!%Aq3Te&i|7AYJ<9X@TeS2f;z%!th9UYaLX5v%J-t~NByggs+jLDJ=#$q4ep0gg(uO%3YmCy?q zh?Q_wZy1gTDbJCZ4L;dJ*bawZsKPU0lD=@mlhFY=RJ&`P|%3oN?M4K-YnW9W& zZih@nt;Y(vDEzQQ*(hwJl8EP~<rqTnt#|Ix&6bj<--ggQjo-QiXRW?Uit=mW3pHK*MA9u8`vLiJllI>?19Zp zS%jKw&xTm$-5o3iTIc-zM}c(~NDeFV=T42<&;=SForVewgA?#+O*{nBA{BP>ncaHs8 zQ3baWnH|6_6d;2QFV51V$F)b{ngXjC%+ZY(^z%`T)qccRwhm(G2$prRzx7@j=^Bs(y_Hwc$~nmip)iV>FAHvH|}*%#LA zHfd1^wto*E$UcRS-J?66*7|lJF1HF%VdnyRs&PHoa2gz^EG%C4Bd^RNLlR)1;D*)t z?n)zBsxC6*)wV%tl^Pv{E?h$7if)<&lqd75DWfBtAAJU!63lqrDCr~6toiKL^|bw# zIt23P_3SgOrKV@VBAijITjXty9{KYr`YBVp6c9b&zaG>eXqnbC2K=v~hY)z8rV`LM zPijb04m^vWupDQ$tc?S?jf|ro3Uom`1=OoamTm9k*Jql30ZIb1a4abGPE|m`{M2Yi zB|>#8((Zo7D4}Aox&be%8v&)&^+omigJO}=k3gk~$bI80)9AK;0ZXhu32Jjc>02brum@SwFeL;fH;Ui>P zvjnoTM(hSh^rHm1o3A~^FNC8*E@5#$gd@|5*iq4%FlOHR36)>bf6np6_zbFFAo6j6 z(Lh{nNqZ4EubB>p9Ga-h&ix@rQi-lv58O~k+N%4(u4*d2mzltbr9il%cDRhb<1%xm@ zsD)4@#vFZ!WwM7^G*nPeyRdYMqJf^9N&5>`G`>#_VWVc#&U{{z9QW}JG>~Lf(E#L- z6?^sTbN;qwSibSu9*ywdQ}@nB!4_h9z>EdfnS;0;p@1>{3(EdK`$7bMvYhq zL=*cI#3m_Xn|dj+O+i4Q6yy|kmiua{A*$auyVs3t+#S7Ey?xvp*1N51yWSfNtk#j; zYW3Un%Ii$6gg4+wk&LY8ZT2&olx75?9U@Q=;)wklvQ&KMBxJvVe~6(_df(H$H@lh- zts`BHc3bnM-D+ySbdPj(%;To62hC1T2k)rS*3~kbjh?RS&9b_4m0XTj_zPoNWYC$bL-W2I3I zXrLtkreNKrM%xmDO(pwqh+bepJ_@bKq6t4{!xvHNC8(VeDuulV+@PID)ii>>!%nBy z?KQ6J&7&hg-=1|;x31frdTV$+Ft4p+h|Qzm20$Cb8FhR-tQ!Emvb-C6CJ!X|NFrMW zR|D9Imffiz+kKpsUT4s56d=!`SCmdlFd+&2SMXV~P(9lC=R`J$pP1<1%f8Z}FEU%PhTMb2m4@&>rFSw-p;6q} z`4e$V!2{g~Ajv$VG>NDAT_g1?m4byEt$B3aw=AnsZ}owiv^$NXdbiu@*L&B)?qJwG zwg+~vz(%`sC-%pb-G*Y^sx}w-0S%svEN`sdTyLSve}f(e&c$kP71>)W;=n3THLkhR zr7SQBy~kLPFbHQ$;PXqR{C%_2864U5cC!tfeE^Dg_vjcnd#_=(&35moH@q%_kbRHh zBYjgkrp+hFE5dl9eS&f4)(90cO42``zBG7f4@9;=V^9T&;G5aN`0=UnH6Vyj$N__I zMCFT>{6Q)ShNExd>3rJm3Gs)p(?Ido!Ip=?0QQjFaH4HmE|#TT&ciUp|H#2JkteW0 z@BgqpXr2}3osbj0YC9npQ*H=|<#?*R95JyVGja zLCo&e+wFd<-aE3|^&>z-t9jhA&2E1o&bTB@q^xdYUxBc60~>8fc^>Y6A+|2~nv4Q+ zvH0%WOg6gSeHNE%c7!RKNlX#C&d)M#M2046wJ@%Th1Q@vz<32cKx5?6?>1KAUnI0O z3}Fqfp^=HhHy+Fa-Wqf|h4vRXGp)G6#Eq>SZ3dBLyOMdQoChu=l{eDw(Ov9tbDvNQRfXrC zhh?-!q1A_!n;n^l@?crSg1SW(sqVAQP!J>i(#%*@38>3RGByf z_Oe_d>G&HY6)AwhY#KQM7TYZqZ>8nhE<8P(T*EZy%@A-pvaN{*Q}bcbm`+{Y4;H2@ z98#-cOTr|P1(u}XWn+PMCJty9LLX@cMI;LDkS`5`6pKY#Sv@kvQ;KU(n@TGfJ8;@e zIjfpldqK=TnPPZO46_p$D$oKqGc$c{|2>Ux4k37K#+4H6Hl@rtJT!jutf?`BNTFcEAX>ir0Jvq46AYH|@0YKB z#l$q$z471w=l=p4je$ba1EdBqbU~yK3;>hZSc6-`C8s1Hg2;lRH})4&iKL4`n8SOR zRA)e5veY-u1m1fXgA|q|kTA0i43ZWgy`Z(o$yMVKUG7I1M?_qE>&gO@O#xlU3G@6H z=xD4U-f|5g-ZE?3i}Ro+zw=0BeJ-)0qe*Ij54& z00ZN}yTD}nm}^|Q%4T2jmSJKMfzn(R*gDL^04=+m!%9BwvGvLR=-ab>I&Hy9h4U#j zTNB3yOpV;^JN)UM{bY932+Mr_W$Jjs$B+vLun|INh*5I8MEgy}=JK<-Rr0ukd?^Db zF2+42HmBTKVLpqB%ROv0QjG`O!P?@kw^cEc=u-Rgav3=Rj5m{q*W51eLjJ>?F2Td_Yy{U zMhMR#`*|D^u^+jb~*7L(32ryd3XW=~hcQr=i4CxZx3b zfVgC!Hj(gE9qrHSA1j_?a3`3@IyuL})P8Y>q|bLOL&5FiJ31y(g?6U6#pzjr6sI^d zr<5Jm8AOgR{URI%t|VT3qba|Iv7x6xaUD=W^7+g2N0eeb3uZlyyXN&_E$S%LdmGQ9 zYklmkR(gmi{a9K5AF^E}6AEvWrk?-9hXJlZq(k&ySB zoId0ti(HPpf^q%i4(~$&c6JM0y>*GmNMtmg>XYrnpNaj{ySim@{?h66sMtmYqb!n< z!{)LM#Fa%IuJrO=eo|aGHmyFbS~9P})7n{%rk9FaOFQqL{jmE|##7=6`mD$2mop$y zrYY$_zC0$LllLV!vahp=$J0tZw^Bk8EE z;KHEkp2=j?AUxJZjG7NG}C`m^o;fLmCpWQ(U^~Jye*vAkY?)aZxf(kH-UB({N zwZhxj8FHXwCx#ue>xdFkC5~W|25qy{LsGo4U`X3#_r)On`8bCGm)Kl08g6f)yZH>t z1GO1?I`?3ew6@-34ThPeU>HPMU(W2QVLmY~s3G(g63TXMn0W8Dt z0945kdszvVM_i6O!=Eo4&!4@XPhNQ^#3h6=2j|1i-z@(Y;tg&sGx*i)9N}+0tI!Hk z%MCEg8wrpubrp#wOJQ1B!?QS@ZC7-5bLeb*O}Bx_s%6HRJB0Tr_;H&11#jpmN|FB^ zFtvt#gCO%tgzMRsu@{L0#3r=*5?Z982Lh5zMI zcV(WE;ELD4r0K(*1F(rw4(W9G1pgS&SXQRDQknDm=%{SRQ|35<;!< zc%|;I-3i@DvkUc|$$lgh!yFP6#$sPES$BB{0Pl@+wu7Dpl0la*47e zS+P8zW=a;(lzMr!>+F(b5mRs)Q_O1%Znk!f^lwh)gl!=B$+;Sql20LpFh?O3q|HLa za-ywt=W;Qq#QM#0k}W_XODB)%hR9~CbW7y!=T%32Hj=|DupQa5CM!2qRE>QB8@T@b z9w?|PvC?XERqO+HL9x8MrMYfuUUajeRCVRF=)0-#X4!kYB?D#7qF8dK!xZsF0#jVC zv{MC_6{koHFCHvRg;y_yXpa=;qu1FF8ODSGyAwq02KANVNv8{5!fgA@GpLEr$Mn(u ztV~L_JH{W$?Q-NMmoS86>5rS_>0I3u~t&I zRzfB~-_dU}?25trQY-*Lza_}Of3|1b z?9AlYD8>dF%FO*_PZDr8LAjw-GaT+GXZg8|BM^Oj{Xu;^IhqMTS34mW0Fo2^f#p!< z7bN|4+-4^))I-S5S0vZox#~PMUgDR40UCc{m+*&@t zKUk<4GL*9+M?!VEX`qmQByorz9hRnuHo=T{AvC~AmgR0=ZssYm%i^Em|9nghuVzhd z^sx~npyy`NcbjVk8jm4Y6da(H5Ufv4xh@ zmzH@fJxMUlp4jU~v(Xlw#1`5Ov4wUcGTI~QNf<-B*=jVy5w#jUVSKH&I7{tDSDcBa zG%wN&c6(yIZVx0J;YozjGsTiUm?q`R(y_RO>sA0Cm zzDPZjRtUD7w6enffG1%L*cItX-2b=*#rCAVb0k86r*Q1}B<{H*;1>c+Y0sIaF!r`7 zLcyh#o&=ciB*FxQ6Q9H}z_f@@;+(;gL?y%>((H&>+w6!~3)m(-iMZH2lIk7F^~4?D zJeDx*xFtQwt0}c`EJ5i?z3xiwbpdUKr=B>UJ#nAGlklwtn?QV$DON+qOzBCYiA}K{ zF1vsa(!R!p7BL4ZhERGGQwSe#9nsCg9(uw<&lJCib=YR04{W#52e#Q*F^co-;W&H% zbP)lF#n_Id4_y%&qeHA6u~<9Y@2%r5{uAZfs4)Q3MtymX5;gl8%ct0gW$g;IZFcyJ zMBL;P*4LPNk!YzWHxM##6PEuKbSP3@k%N(mnG}{ojS*uKeu@Gzn0!$o#ne9V{uZoh zV{3Y0frB2eF5s~VuSuRooFnVz3bPmo5gnvEFJRU#@faB$JM;|CSY{B3la^zp=h9Ha z_utHH#QBgXv%C zITnrDN_%)R845j=m!;BYH%^~z>Ckm-eG%<@|AP>P?Yx0@4be#&JI-#!B9#}9t+G*i z%QaJGzho#**7M#tM2wa&dW-pZdHzy4_=1!YLJ3$QYFMDh-oyBA6}OQ)5TppV z9`Up6Qn?}b9Fw9D>2c?{b3Zr$O^c#DGWS2aBR;&-xd%*brY<(IKeJ-gK`jlC-sT{7 zj}^MGfc(gXrtm6aJ<-dHQLAq8JD4^&<9xA<9`P=T89F+QiKJzN)cZFmd}GWSAn5V? z@4wR@U!~T+gT^hJb{{5Mx6SnPAe-N*K-<~GTS2j}C#Io7{o&U)q?Rj<6I zXjn_-$yu4Q)XSP-yaCY%UeDp5WbP?(;xta3i-l#;{VL{GF}K{zEz6z0dH7o*bIZGn zml*)D66GR23_^%BLn0C-S*kM0IoXXgGmg_b`7GlwrZMSk>kU6xCq+riO*XNYb-x0*eHk_jt0IV7djPpKs0tD?4}qqK?33w*P2X)a9m~( zA~Ys;3H!I*j~Lc$v{eNQ7d>^i>_c>V>c9@zL^>d2eLReQEkqZsZ z+LB@aRdhx}XZT^xZJ;wD54oKCQ)hs&sjC%N!ged7vg1TWyV-J+l8rqtkx6seDk*6> zWN8~rO)1WkTzN`&BRalJbIg=6Rgq+6>@^8M~KJJ$X#~D0L>T_~eoOJXk z*pfyb^1!I?no=KUzh7<#Qz9p!Ycleclt4L!CS*f#?FQNk{cjT8Ak=(Hy=hHv8zUcROsf&&f(6 zTGe7oRgq+Y(gnuLv-lU)vflpmdg-x#X*R0@Q?&JV=}IEnq@>ibTgDeLyB9`9*ehFW z^vH$dTDx>n;VMeSqViSlVW|yZ>KD!`y zjMTxvK18`U|76g``mm7KK7d9=2DNKr^?@`Aac>(II-_)6m|NsJUYN?zzc<4Ron_xt ze&?9cy!t9U!Gq;tKwvq zKvFa}p+AJBvy}7e(795z85EtaLBzYV$H1Ovs10B}A3i%1dsHWe2(Ge4?n(X5AKcnw zi&VIs&8Gg7!^0bAc02DMKz9$%`CdIdnFc1x`Wf4-_1|E#q7398_D632a10n~dxsPx z*~$3vfbNcOu-ucq+Q0q_5<>A07kc)d7<(Y=D2q@OIvZk{cXu#}hy?!rqX1iAl39^Q zk3T3uK;P{f*Skj$d}{Wh<-W-;zC{3ijg}`Efe?d<3dyK7I*TLqA<)k|2ZCn(L)a%4 zP%|su+dXUQybUL%*=RQF4HN&H;$?XDXGIm_l;v9zCu-3fJ_2?}?zF zk7}&;BfheAkk3Z2touGJ|7<@p^;qI;*d$;v5xHvW_h7^@CAj0Df3X>a0>jYNfFt

}?ItNPf0QBmDQ& zy|X`CpgLaz%SNhx07HNsf~>=TW=}ENdNP3SJ_Sk&s=)y@3BUV5i-EQ`fk)R%Da$s| z*%+v>&!oZNi040H^I2M$8rz)V}k!rLfi+^s7aOtTe^YQehx>0GfKV$Sz zF?QYf^Y%(1J8n$hUQO&PP|I$>z&fOErH$ztC-SHYjvQ3#PCy2_|HJk+ri+}xzF_=y z6FNqfq79iJ;@P|+RQ8!DQDp31SbqIemD(58>kkTwnx-R&k3xNMtRSomK7q9LO9IE{ zWdy-r$%)zbh|IuiqbR4XiXS!gQdz%Phb_t_(es4QTBC06wC*2Ev*u}Ue z+Nw9&N=BG+A2>gRFSfGAnZw&J4hePW}sYjrWL+8g9 z_&9AvSFBIg!Pr0Kh8o^!|I-AbWF6lp9?BodlR+P`1q1hy5Zd?G=x9`ECX<(|;`4py!kOiDV*SoPMOb+%b zWX~QEBE^7tF6$$B^k5Qzc==Fd0AiL0CV6Zf)O~9d8cw*KJDg>{_ut@A^3grE8xHFV z{IwGom_FKQAd+<$Vn+br3RgMU)idi86t#>%=eb8;hm1Kh0V?gK56glR3guvmMSaPz zVc4)=*iHq1iej@On#igdSJ)0mU_u%JsU-+l$G0PU42xxr>VQVD#bFy?(63|%V{9OF z1scS8!es}yJT_|$xzQP(fJl?kVk~h;)=)x5!tE^`~iRyI$@mCa>iNEy_1VG0r3x^0}0(w z&Ek}DPXF+FJ|X+eKm3y$B%ERGzTn?VYU`7IU%#_p+7E*!z!GV^#aAUY0d&9vP8&9G zNne0HjYNNx)eO!Q@ZJ9051T^s+Y9KO6z;OY=QH-*pK-78fW>H}xEkJdLkAr;hd zKr(#J24RRVaiWYd@+_7r;^s+YZM6_TA zQ9E;0C_tnwXMAJ$-awcZ&-#2oMISsX!2s!{ASM8zmw^dC+~EM>Y@abI7+@cFreEOk z)mULmYbvTn%IJ-4iYEfhT&13b=W$jI~ z^5(YgN~1}#<|bQl6Rfv!&!*az5_j+Ecd_J?3iNza>Fv;I!V(Oo$Poy69kqNooDSz2 z3E7kN(_4&~Jf*S^^aG<%at#L6M?tM$+c@Y5bhhqAhSXf|kn|>Khz|hiZIPk1);l!G zRkFx9+H2l*?!=~!i$w;}S??gCeuPDaatg+v7%{Bpk_(Ngx!$d&AY`v5XCNhmsJsy4H(TpmtpAuhgHMao0drk!9|Dx; zQzpTq8G(aZXfO-0|G-p}Yc&7v_6-t;2j(RV_D}6U^;oU8lP|&8hdzSm)Kt6`eckv; z4G(0HILS@!>LvJJu%no6V6%Jr_NUi8KivlR65~~2I;rxw(LGH}C_;~jY-YbP7J8$5 z7zAZ+bT8@phqfsLLm!6o(dxRbjf2h;1eDJ>7zvYENT@ES|LRcgB4IwP|5<{|t{u;x zUC=NUJk-Y`b&l$dqq-?ay96OWQ427$^M|iKNS+FMc1C4z9=c!{pTyw7m*9**9fCbb zL<2ZySh#>ROmSTNXE?yJPPQ02M@2B{q;Wd#J#c-&c}6l^cn$yke^5&S0u%rg00008 z05*NfTz`2%Q0xo<02x0302crN0000000000000000001Ea%Ew3WmRcJWoBt^X>@6C zZZ2wbZ*EXa0Rj{N6aWAK2mm&H%3Q;ep(S?5000(93IGuR000000000000000Aq@Zk qZDDC{RAp^&Y+-a|E^2dcZcs}F1^@s600IC40E7Sl0LIh+0002EtIqcT diff --git a/Solutions/Veeam/Package/createUiDefinition.json b/Solutions/Veeam/Package/createUiDefinition.json index 041d59c4c42..6fa122a6d7d 100644 --- a/Solutions/Veeam/Package/createUiDefinition.json +++ b/Solutions/Veeam/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Veeam/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nVeeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/products/functions/#overview)\n\nc. [Azure Key Vault](https://azure.microsoft.com/products/key-vault/)\n\nd. [Azure Storage Account](https://azure.microsoft.com/products/storage/)\n\ne. [Azure Relays](https://azure.microsoft.com/products/service-bus/)\n\nf. [Azure Logic Apps](https://azure.microsoft.com/products/logic-apps/)\n\ng. [Azure Log Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview)\n\n**Data Connectors:** 1, **Workbooks:** 2, **Watchlists:** 11, **Playbooks:** 15\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Veeam/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nVeeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/products/functions/#overview)\n\nc. [Azure Key Vault](https://azure.microsoft.com/products/key-vault/)\n\nd. [Azure Storage Account](https://azure.microsoft.com/products/storage/)\n\ne. [Azure Relays](https://azure.microsoft.com/products/service-bus/)\n\nf. [Azure Logic Apps](https://azure.microsoft.com/products/logic-apps/)\n\ng. [Azure Log Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview)\n\n**Data Connectors:** 2, **Parsers:** 4, **Workbooks:** 2, **Analytic Rules:** 132, **Watchlists:** 11, **Playbooks:** 15\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -62,6 +62,23 @@ "options": { "text": "This Solution installs the data connector for Veeam. You can get Veeam custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } + }, + { + "name": "dataconnectors2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for Veeam Data Connector (via Codeless Connector Framework). You can get Veeam Data Connector (via Codeless Connector Framework) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-link2", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } } ] }, @@ -146,6 +163,1854 @@ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" } } + }, + { + "name": "analytic1", + "type": "Microsoft.Common.Section", + "label": "Adding User or Group Failed", + "elements": [ + { + "name": "analytic1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects failed attempts to add a user or user group to Veeam Backup & Replication." + } + } + ] + }, + { + "name": "analytic2", + "type": "Microsoft.Common.Section", + "label": "Application Group Deleted", + "elements": [ + { + "name": "analytic2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when an application group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic3", + "type": "Microsoft.Common.Section", + "label": "Application Group Settings Updated", + "elements": [ + { + "name": "analytic3-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when application group settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic4", + "type": "Microsoft.Common.Section", + "label": "Archive Repository Deleted", + "elements": [ + { + "name": "analytic4-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when an archive repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic5", + "type": "Microsoft.Common.Section", + "label": "Archive Repository Settings Updated", + "elements": [ + { + "name": "analytic5-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when archive repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic6", + "type": "Microsoft.Common.Section", + "label": "Attempt to Delete Backup Failed", + "elements": [ + { + "name": "analytic6-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects failed backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure." + } + } + ] + }, + { + "name": "analytic7", + "type": "Microsoft.Common.Section", + "label": "Attempt to Update Security Object Failed", + "elements": [ + { + "name": "analytic7-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects failed attempts to update security objects in Veeam Backup & Replication. Security objects include users and roles, credential records, certificates, or passwords." + } + } + ] + }, + { + "name": "analytic8", + "type": "Microsoft.Common.Section", + "label": "Backup Proxy Deleted", + "elements": [ + { + "name": "analytic8-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a backup proxy is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic9", + "type": "Microsoft.Common.Section", + "label": "Backup Repository Deleted", + "elements": [ + { + "name": "analytic9-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a backup repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic10", + "type": "Microsoft.Common.Section", + "label": "Backup Repository Settings Updated", + "elements": [ + { + "name": "analytic10-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when backup repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic11", + "type": "Microsoft.Common.Section", + "label": "Cloud Gateway Deleted", + "elements": [ + { + "name": "analytic11-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a cloud gateway is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic12", + "type": "Microsoft.Common.Section", + "label": "Cloud Gateway Pool Deleted", + "elements": [ + { + "name": "analytic12-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a cloud gateway pool is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic13", + "type": "Microsoft.Common.Section", + "label": "Cloud Gateway Pool Settings Updated", + "elements": [ + { + "name": "analytic13-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when cloud gateway pool settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic14", + "type": "Microsoft.Common.Section", + "label": "Cloud Gateway Settings Updated", + "elements": [ + { + "name": "analytic14-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when cloud gateway settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic15", + "type": "Microsoft.Common.Section", + "label": "Cloud Replica Permanent Failover Performed by Tenant", + "elements": [ + { + "name": "analytic15-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects permanent failover of a cloud replica initiated by a tenant. This might indicate disaster recovery activity or issues with primary systems." + } + } + ] + }, + { + "name": "analytic16", + "type": "Microsoft.Common.Section", + "label": "Configuration Backup Job Failed", + "elements": [ + { + "name": "analytic16-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure." + } + } + ] + }, + { + "name": "analytic17", + "type": "Microsoft.Common.Section", + "label": "Configuration Backup Job Settings Updated", + "elements": [ + { + "name": "analytic17-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when configuration backup job settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic18", + "type": "Microsoft.Common.Section", + "label": "Connection to Backup Repository Lost", + "elements": [ + { + "name": "analytic18-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a backup server fails to connect to a backup repository." + } + } + ] + }, + { + "name": "analytic19", + "type": "Microsoft.Common.Section", + "label": "Credential Record Deleted", + "elements": [ + { + "name": "analytic19-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a credential record is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic20", + "type": "Microsoft.Common.Section", + "label": "Credential Record Updated", + "elements": [ + { + "name": "analytic20-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a credential record is updated in Veeam Backup & Replication." + } + } + ] + }, + { + "name": "analytic21", + "type": "Microsoft.Common.Section", + "label": "Detaching Backups Started", + "elements": [ + { + "name": "analytic21-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a backup file is detached from a backup job." + } + } + ] + }, + { + "name": "analytic22", + "type": "Microsoft.Common.Section", + "label": "Encryption Password Added", + "elements": [ + { + "name": "analytic22-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when an encryption password is added to Veeam Backup & Replication." + } + } + ] + }, + { + "name": "analytic23", + "type": "Microsoft.Common.Section", + "label": "Encryption Password Changed", + "elements": [ + { + "name": "analytic23-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when an encryption password is updated in Veeam Backup & Replication." + } + } + ] + }, + { + "name": "analytic24", + "type": "Microsoft.Common.Section", + "label": "Encryption Password Deleted", + "elements": [ + { + "name": "analytic24-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when an encryption password is deleted in Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic25", + "type": "Microsoft.Common.Section", + "label": "External Repository Deleted", + "elements": [ + { + "name": "analytic25-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when an external repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic26", + "type": "Microsoft.Common.Section", + "label": "External Repository Settings Updated", + "elements": [ + { + "name": "analytic26-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when external repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic27", + "type": "Microsoft.Common.Section", + "label": "Failover Plan Deleted", + "elements": [ + { + "name": "analytic27-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a failover plan is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic28", + "type": "Microsoft.Common.Section", + "label": "Failover Plan Failed", + "elements": [ + { + "name": "analytic28-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems." + } + } + ] + }, + { + "name": "analytic29", + "type": "Microsoft.Common.Section", + "label": "Failover Plan Settings Updated", + "elements": [ + { + "name": "analytic29-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when failover plan settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic30", + "type": "Microsoft.Common.Section", + "label": "Failover Plan Started", + "elements": [ + { + "name": "analytic30-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a failover plan starts. This might indicate disaster recovery activity or issues with primary systems." + } + } + ] + }, + { + "name": "analytic31", + "type": "Microsoft.Common.Section", + "label": "Failover Plan Stopped", + "elements": [ + { + "name": "analytic31-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a failover plan stops. This might indicate disaster recovery activity or issues with primary systems." + } + } + ] + }, + { + "name": "analytic32", + "type": "Microsoft.Common.Section", + "label": "File Server Deleted", + "elements": [ + { + "name": "analytic32-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a file server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic33", + "type": "Microsoft.Common.Section", + "label": "File Server Settings Updated", + "elements": [ + { + "name": "analytic33-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when file server settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic34", + "type": "Microsoft.Common.Section", + "label": "File Share Deleted", + "elements": [ + { + "name": "analytic34-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a file share is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic35", + "type": "Microsoft.Common.Section", + "label": "Four-Eyes Authorization Disabled", + "elements": [ + { + "name": "analytic35-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when four-eyes authorization is disabled." + } + } + ] + }, + { + "name": "analytic36", + "type": "Microsoft.Common.Section", + "label": "Four-Eyes Authorization Request Created", + "elements": [ + { + "name": "analytic36-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a four-eyes authorization request is created." + } + } + ] + }, + { + "name": "analytic37", + "type": "Microsoft.Common.Section", + "label": "Four-Eyes Authorization Request Expired", + "elements": [ + { + "name": "analytic37-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a four-eyes authorization request is expired." + } + } + ] + }, + { + "name": "analytic38", + "type": "Microsoft.Common.Section", + "label": "Four-Eyes Authorization Request Rejected", + "elements": [ + { + "name": "analytic38-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a four-eyes authorization request is rejected." + } + } + ] + }, + { + "name": "analytic39", + "type": "Microsoft.Common.Section", + "label": "General Settings Updated", + "elements": [ + { + "name": "analytic39-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when Veeam Backup & Replication general settings are updated. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic40", + "type": "Microsoft.Common.Section", + "label": "Global Network Traffic Rules Deleted", + "elements": [ + { + "name": "analytic40-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a global network traffic rule is deleted in Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic41", + "type": "Microsoft.Common.Section", + "label": "Global VM Exclusions Added", + "elements": [ + { + "name": "analytic41-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when global VM exclusion are added in Veeam Backup & Replication." + } + } + ] + }, + { + "name": "analytic42", + "type": "Microsoft.Common.Section", + "label": "Global VM Exclusions Changed", + "elements": [ + { + "name": "analytic42-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when global VM exclusions are updated in Veeam Backup & Replication." + } + } + ] + }, + { + "name": "analytic43", + "type": "Microsoft.Common.Section", + "label": "Global VM Exclusions Deleted", + "elements": [ + { + "name": "analytic43-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a VM is removed from global exclusions in Veeam Backup & Replication. This might indicate unauthorized changes." + } + } + ] + }, + { + "name": "analytic44", + "type": "Microsoft.Common.Section", + "label": "Host Deleted", + "elements": [ + { + "name": "analytic44-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a host is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic45", + "type": "Microsoft.Common.Section", + "label": "Host Settings Updated", + "elements": [ + { + "name": "analytic45-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when host settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic46", + "type": "Microsoft.Common.Section", + "label": "Hypervisor Host Deleted", + "elements": [ + { + "name": "analytic46-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a hypervisor host is deleted from Veeam Backup & Replication. This might indicate unauthorized changes to the virtualization environment." + } + } + ] + }, + { + "name": "analytic47", + "type": "Microsoft.Common.Section", + "label": "Hypervisor Host Settings Updated", + "elements": [ + { + "name": "analytic47-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when hypervisor host settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic48", + "type": "Microsoft.Common.Section", + "label": "Invalid Code for Multi-Factor Authentication Entered", + "elements": [ + { + "name": "analytic48-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects failed multi-factor authentication attempts. This might indicate credential stuffing or brute-force attacks." + } + } + ] + }, + { + "name": "analytic49", + "type": "Microsoft.Common.Section", + "label": "Job Deleted", + "elements": [ + { + "name": "analytic49-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a job is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic50", + "type": "Microsoft.Common.Section", + "label": "Job No Longer Used as Second Destination", + "elements": [ + { + "name": "analytic50-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a job used as a secondary destination is removed." + } + } + ] + }, + { + "name": "analytic51", + "type": "Microsoft.Common.Section", + "label": "KMS Key Rotation Job Finished", + "elements": [ + { + "name": "analytic51-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a KMS key rotation job is finished." + } + } + ] + }, + { + "name": "analytic52", + "type": "Microsoft.Common.Section", + "label": "KMS Server Deleted", + "elements": [ + { + "name": "analytic52-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a KMS server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic53", + "type": "Microsoft.Common.Section", + "label": "KMS Server Settings Updated", + "elements": [ + { + "name": "analytic53-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when KMS server settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic54", + "type": "Microsoft.Common.Section", + "label": "License Expired", + "elements": [ + { + "name": "analytic54-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a Veeam license is expired. This could impact backup operations and data protection." + } + } + ] + }, + { + "name": "analytic55", + "type": "Microsoft.Common.Section", + "label": "License Expiring", + "elements": [ + { + "name": "analytic55-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a Veeam license expires shortly." + } + } + ] + }, + { + "name": "analytic56", + "type": "Microsoft.Common.Section", + "label": "License Grace Period Started", + "elements": [ + { + "name": "analytic56-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a Veeam license grace period starts. This might indicate potential licensing issues that need attention." + } + } + ] + }, + { + "name": "analytic57", + "type": "Microsoft.Common.Section", + "label": "License Limit Exceeded", + "elements": [ + { + "name": "analytic57-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when the Veeam license limit is exceeded." + } + } + ] + }, + { + "name": "analytic58", + "type": "Microsoft.Common.Section", + "label": "License Removed", + "elements": [ + { + "name": "analytic58-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when the Veeam license is removed from Veeam Backup & Replication." + } + } + ] + }, + { + "name": "analytic59", + "type": "Microsoft.Common.Section", + "label": "License Support Expired", + "elements": [ + { + "name": "analytic59-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when the Veeam support contract is expired. This might impact backup operations and data protection." + } + } + ] + }, + { + "name": "analytic60", + "type": "Microsoft.Common.Section", + "label": "License Support Expiring", + "elements": [ + { + "name": "analytic60-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when the Veeam support contract expires shortly." + } + } + ] + }, + { + "name": "analytic61", + "type": "Microsoft.Common.Section", + "label": "Malware Activity Detected", + "elements": [ + { + "name": "analytic61-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when restore points marked as suspicious. This might indicate potential compromise of backup data." + } + } + ] + }, + { + "name": "analytic62", + "type": "Microsoft.Common.Section", + "label": "Malware Detection Exclusions List Updated", + "elements": [ + { + "name": "analytic62-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when malware detection exclusions are updated. This might indicate potential compromise of backup data." + } + } + ] + }, + { + "name": "analytic63", + "type": "Microsoft.Common.Section", + "label": "Malware Detection Session Finished", + "elements": [ + { + "name": "analytic63-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when malware detection session finishes." + } + } + ] + }, + { + "name": "analytic64", + "type": "Microsoft.Common.Section", + "label": "Malware Detection Settings Updated", + "elements": [ + { + "name": "analytic64-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when malware detection settings are updated." + } + } + ] + }, + { + "name": "analytic65", + "type": "Microsoft.Common.Section", + "label": "Malware Event Detected", + "elements": [ + { + "name": "analytic65-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when restore points are marked as infected. This might indicate potential compromise of backup data." + } + } + ] + }, + { + "name": "analytic66", + "type": "Microsoft.Common.Section", + "label": "Multi-Factor Authentication Disabled", + "elements": [ + { + "name": "analytic66-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when multi-factor authentication is disabled for all users." + } + } + ] + }, + { + "name": "analytic67", + "type": "Microsoft.Common.Section", + "label": "Multi-Factor Authentication for User Disabled", + "elements": [ + { + "name": "analytic67-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when multi-factor authentication is disabled for a specific user." + } + } + ] + }, + { + "name": "analytic68", + "type": "Microsoft.Common.Section", + "label": "Multi-Factor Authentication Token Revoked", + "elements": [ + { + "name": "analytic68-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a multi-factor authentication token is revoked." + } + } + ] + }, + { + "name": "analytic69", + "type": "Microsoft.Common.Section", + "label": "Multi-Factor Authentication User Locked", + "elements": [ + { + "name": "analytic69-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when the allowed number of multi-factor authentication attempts is exceeded for a user." + } + } + ] + }, + { + "name": "analytic70", + "type": "Microsoft.Common.Section", + "label": "NDMP Server Deleted", + "elements": [ + { + "name": "analytic70-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when an NDMP server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic71", + "type": "Microsoft.Common.Section", + "label": "Object Marked as Clean", + "elements": [ + { + "name": "analytic71-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when an object is marked as clean." + } + } + ] + }, + { + "name": "analytic72", + "type": "Microsoft.Common.Section", + "label": "Object Storage Deleted", + "elements": [ + { + "name": "analytic72-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when an object storage is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic73", + "type": "Microsoft.Common.Section", + "label": "Object Storage Settings Updated", + "elements": [ + { + "name": "analytic73-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when object storage settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic74", + "type": "Microsoft.Common.Section", + "label": "Objects Added to Malware Detection Exclusions", + "elements": [ + { + "name": "analytic74-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when an object is added to malware detection exclusions." + } + } + ] + }, + { + "name": "analytic75", + "type": "Microsoft.Common.Section", + "label": "Objects Deleted from Malware Detection Exclusions", + "elements": [ + { + "name": "analytic75-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when an object is deleted from malware detection exclusions." + } + } + ] + }, + { + "name": "analytic76", + "type": "Microsoft.Common.Section", + "label": "Objects for Job Deleted", + "elements": [ + { + "name": "analytic76-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when objects are deleted from the job. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic77", + "type": "Microsoft.Common.Section", + "label": "Objects for Protection Group Changed", + "elements": [ + { + "name": "analytic77-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when protection group objects are updated." + } + } + ] + }, + { + "name": "analytic78", + "type": "Microsoft.Common.Section", + "label": "Objects for Protection Group Deleted", + "elements": [ + { + "name": "analytic78-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when objects are deleted from a protection group. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic79", + "type": "Microsoft.Common.Section", + "label": "Preferred Networks Deleted", + "elements": [ + { + "name": "analytic79-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a preferred network is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic80", + "type": "Microsoft.Common.Section", + "label": "Protection Group Deleted", + "elements": [ + { + "name": "analytic80-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a protection group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic81", + "type": "Microsoft.Common.Section", + "label": "Protection Group Settings Updated", + "elements": [ + { + "name": "analytic81-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when protection group settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic82", + "type": "Microsoft.Common.Section", + "label": "Recovery Token Deleted", + "elements": [ + { + "name": "analytic82-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a recovery token is deleted. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic83", + "type": "Microsoft.Common.Section", + "label": "Restore Point Marked as Clean", + "elements": [ + { + "name": "analytic83-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a restore point is marked as clean." + } + } + ] + }, + { + "name": "analytic84", + "type": "Microsoft.Common.Section", + "label": "Restore Point Marked as Infected", + "elements": [ + { + "name": "analytic84-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a restore point is marked as infected." + } + } + ] + }, + { + "name": "analytic85", + "type": "Microsoft.Common.Section", + "label": "Scale-Out Backup Repository Deleted", + "elements": [ + { + "name": "analytic85-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a scale-out backup repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic86", + "type": "Microsoft.Common.Section", + "label": "Scale-Out Backup Repository Settings Updated", + "elements": [ + { + "name": "analytic86-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when scale-out backup repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic87", + "type": "Microsoft.Common.Section", + "label": "Service Provider Deleted", + "elements": [ + { + "name": "analytic87-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a service provider is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic88", + "type": "Microsoft.Common.Section", + "label": "Service Provider Updated", + "elements": [ + { + "name": "analytic88-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when service provider settings are updated in Veeam Backup & Replication." + } + } + ] + }, + { + "name": "analytic89", + "type": "Microsoft.Common.Section", + "label": "SSH Credentials Changed", + "elements": [ + { + "name": "analytic89-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when SSH credentials are updated." + } + } + ] + }, + { + "name": "analytic90", + "type": "Microsoft.Common.Section", + "label": "Storage Deleted", + "elements": [ + { + "name": "analytic90-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when storage is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic91", + "type": "Microsoft.Common.Section", + "label": "Storage Settings Updated", + "elements": [ + { + "name": "analytic91-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when storage settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic92", + "type": "Microsoft.Common.Section", + "label": "Subtenant Deleted", + "elements": [ + { + "name": "analytic92-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a subtenant is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic93", + "type": "Microsoft.Common.Section", + "label": "Subtenant Updated", + "elements": [ + { + "name": "analytic93-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when subtenant settings are updated in Veeam Backup & Replication." + } + } + ] + }, + { + "name": "analytic94", + "type": "Microsoft.Common.Section", + "label": "SureBackup Job Failed", + "elements": [ + { + "name": "analytic94-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects failed SureBackup job operations. This might indicate malware issues, storage problems, or potential sabotage of backup infrastructure." + } + } + ] + }, + { + "name": "analytic95", + "type": "Microsoft.Common.Section", + "label": "Tape Erase Job Started", + "elements": [ + { + "name": "analytic95-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when tape erase operations start. This might indicate data destruction activity." + } + } + ] + }, + { + "name": "analytic96", + "type": "Microsoft.Common.Section", + "label": "Tape Library Deleted", + "elements": [ + { + "name": "analytic96-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a tape library is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic97", + "type": "Microsoft.Common.Section", + "label": "Tape Media Pool Deleted", + "elements": [ + { + "name": "analytic97-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a tape media pool is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic98", + "type": "Microsoft.Common.Section", + "label": "Tape Media Vault Deleted", + "elements": [ + { + "name": "analytic98-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a tape media vault is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic99", + "type": "Microsoft.Common.Section", + "label": "Tape Medium Deleted", + "elements": [ + { + "name": "analytic99-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a tape medium is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic100", + "type": "Microsoft.Common.Section", + "label": "Tape Server Deleted", + "elements": [ + { + "name": "analytic100-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a tape server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic101", + "type": "Microsoft.Common.Section", + "label": "Tenant Password Changed", + "elements": [ + { + "name": "analytic101-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a tenant password is updated." + } + } + ] + }, + { + "name": "analytic102", + "type": "Microsoft.Common.Section", + "label": "Tenant Quota Changed", + "elements": [ + { + "name": "analytic102-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a tenant quota is updated." + } + } + ] + }, + { + "name": "analytic103", + "type": "Microsoft.Common.Section", + "label": "Tenant Quota Deleted", + "elements": [ + { + "name": "analytic103-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a tenant quota is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic104", + "type": "Microsoft.Common.Section", + "label": "Tenant Replica Started", + "elements": [ + { + "name": "analytic104-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a tenant replica starts." + } + } + ] + }, + { + "name": "analytic105", + "type": "Microsoft.Common.Section", + "label": "Tenant Replica Stopped", + "elements": [ + { + "name": "analytic105-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a tenant replica stops." + } + } + ] + }, + { + "name": "analytic106", + "type": "Microsoft.Common.Section", + "label": "Tenant State Changed", + "elements": [ + { + "name": "analytic106-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when tenant state is updated." + } + } + ] + }, + { + "name": "analytic107", + "type": "Microsoft.Common.Section", + "label": "User or Group Added", + "elements": [ + { + "name": "analytic107-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a user or user group is added to Veeam Backup & Replication." + } + } + ] + }, + { + "name": "analytic108", + "type": "Microsoft.Common.Section", + "label": "User or Group Deleted", + "elements": [ + { + "name": "analytic108-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a user or user group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic109", + "type": "Microsoft.Common.Section", + "label": "Best Practice Compliance Check Not Passed", + "elements": [ + { + "name": "analytic109-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a security best practice does not pass a compliance check in Veeam Security & Compliance Analyzer." + } + } + ] + }, + { + "name": "analytic110", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Application with No Recent Data Backup Sessions", + "elements": [ + { + "name": "analytic110-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects applications with no recent backup sessions." + } + } + ] + }, + { + "name": "analytic111", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Backup Copy RPO", + "elements": [ + { + "name": "analytic111-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects Veeam ONE Backup Copy RPO violation alerts." + } + } + ] + }, + { + "name": "analytic112", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Backup Server Security and Compliance State", + "elements": [ + { + "name": "analytic112-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects backup server security and compliance state issues." + } + } + ] + }, + { + "name": "analytic113", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Computer with No Backup", + "elements": [ + { + "name": "analytic113-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects computers with no backup." + } + } + ] + }, + { + "name": "analytic114", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Immutability Change Tracking", + "elements": [ + { + "name": "analytic114-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects changes in Veeam ONE immutability tracking configuration." + } + } + ] + }, + { + "name": "analytic115", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Immutability State", + "elements": [ + { + "name": "analytic115-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects changes in the immutability state of Veeam Backup & Replication repositories. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic116", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)", + "elements": [ + { + "name": "analytic116-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when Veeam Backup for Microsoft 365 jobs are disabled." + } + } + ] + }, + { + "name": "analytic117", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Job Disabled", + "elements": [ + { + "name": "analytic117-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a Veeam ONE job is disabled." + } + } + ] + }, + { + "name": "analytic118", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Possible Ransomware Activity (Hyper-V)", + "elements": [ + { + "name": "analytic118-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects Veeam ONE possible ransomware activity alerts for Microsoft Hyper-V." + } + } + ] + }, + { + "name": "analytic119", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Possible Ransomware Activity (vSphere)", + "elements": [ + { + "name": "analytic119-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects Veeam ONE possible ransomware activity alerts for VMware vSphere." + } + } + ] + }, + { + "name": "analytic120", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Suspicious Incremental Backup Size", + "elements": [ + { + "name": "analytic120-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects suspiciously large incremental backup sizes." + } + } + ] + }, + { + "name": "analytic121", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)", + "elements": [ + { + "name": "analytic121-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects Veeam Backup for Microsoft 365 jobs with unusual execution duration." + } + } + ] + }, + { + "name": "analytic122", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Unusual Job Duration", + "elements": [ + { + "name": "analytic122-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects Veeam ONE unusual job duration alerts." + } + } + ] + }, + { + "name": "analytic123", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE Malware Detection Change Tracking", + "elements": [ + { + "name": "analytic123-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects changes in Veeam ONE malware detection tracking." + } + } + ] + }, + { + "name": "analytic124", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE VM with No Backup (Hyper-V)", + "elements": [ + { + "name": "analytic124-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects Veeam ONE VMs with no backup (Hyper-V)." + } + } + ] + }, + { + "name": "analytic125", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE VM with No Backup", + "elements": [ + { + "name": "analytic125-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects Veeam ONE VMs with no backup." + } + } + ] + }, + { + "name": "analytic126", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE VM with No Replica (Hyper-V)", + "elements": [ + { + "name": "analytic126-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects Hyper-V VMs with no replica configured." + } + } + ] + }, + { + "name": "analytic127", + "type": "Microsoft.Common.Section", + "label": "Veeam ONE VM with No Replica", + "elements": [ + { + "name": "analytic127-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects Veeam ONE VMs with no replica configuration." + } + } + ] + }, + { + "name": "analytic128", + "type": "Microsoft.Common.Section", + "label": "Virtual Lab Deleted", + "elements": [ + { + "name": "analytic128-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a virtual lab is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic129", + "type": "Microsoft.Common.Section", + "label": "Virtual Lab Settings Updated", + "elements": [ + { + "name": "analytic129-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when virtual lab settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic130", + "type": "Microsoft.Common.Section", + "label": "WAN Accelerator Deleted", + "elements": [ + { + "name": "analytic130-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when a WAN accelerator is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components." + } + } + ] + }, + { + "name": "analytic131", + "type": "Microsoft.Common.Section", + "label": "WAN Accelerator Settings Updated", + "elements": [ + { + "name": "analytic131-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects when WAN accelerator settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review." + } + } + ] + }, + { + "name": "analytic132", + "type": "Microsoft.Common.Section", + "label": "Configuration Backup Failed", + "elements": [ + { + "name": "analytic132-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure." + } + } + ] } ] }, diff --git a/Solutions/Veeam/Package/mainTemplate.json b/Solutions/Veeam/Package/mainTemplate.json index 1ada40cefb2..253a66d55d2 100644 --- a/Solutions/Veeam/Package/mainTemplate.json +++ b/Solutions/Veeam/Package/mainTemplate.json @@ -28,6 +28,20 @@ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + }, "watchlist1-id": { "type": "string", "defaultValue": "job_types_lookup", @@ -150,6 +164,14 @@ "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "dataConnectorCCPVersion": "3.0.3", + "_dataConnectorContentIdConnectorDefinition2": "VeeamConnector", + "dataConnectorTemplateNameConnectorDefinition2": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition2')))]", + "_dataConnectorContentIdConnections2": "VeeamConnectorConnections", + "dataConnectorTemplateNameConnections2": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections2')))]", + "dataCollectionEndpointId2": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", + "blanks": "[replace('b', 'b', '')]", "Veeam-ChangeCollectionTime": "Veeam-ChangeCollectionTime", "_Veeam-ChangeCollectionTime": "[variables('Veeam-ChangeCollectionTime')]", "playbookVersion1": "1.0", @@ -157,9 +179,7 @@ "_playbookContentId1": "[variables('playbookContentId1')]", "playbookId1": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId1'))]", "playbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId1'))))]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_playbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId1'),'-', variables('playbookVersion1'))))]", - "blanks": "[replace('b', 'b', '')]", "Veeam-CollectVeeamAuthorizationEvents": "Veeam-CollectVeeamAuthorizationEvents", "_Veeam-CollectVeeamAuthorizationEvents": "[variables('Veeam-CollectVeeamAuthorizationEvents')]", "playbookVersion2": "1.0", @@ -294,6 +314,958 @@ "_Coveware Settings": "[variables('Coveware Settings')]", "Veeam Collection Schedule Settings": "Veeam Collection Schedule Settings", "_Veeam Collection Schedule Settings": "[variables('Veeam Collection Schedule Settings')]", + "parserObject1": { + "_parserName1": "[concat(parameters('workspace'),'/','Veeam_GetJobFinished')]", + "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetJobFinished')]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('Veeam_GetJobFinished-Parser')))]", + "parserVersion1": "1.0.0", + "parserContentId1": "Veeam_GetJobFinished-Parser" + }, + "parserObject2": { + "_parserName2": "[concat(parameters('workspace'),'/','Veeam_GetVeeamONEAlarms')]", + "_parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetVeeamONEAlarms')]", + "parserTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('Veeam_GetVeeamONEAlarms-Parser')))]", + "parserVersion2": "1.0.0", + "parserContentId2": "Veeam_GetVeeamONEAlarms-Parser" + }, + "parserObject3": { + "_parserName3": "[concat(parameters('workspace'),'/','Veeam_GetFinishedConfigurationBackupSessions')]", + "_parserId3": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetFinishedConfigurationBackupSessions')]", + "parserTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('Veeam_GetFinishedConfigurationBackupSessions-Parser')))]", + "parserVersion3": "1.0.0", + "parserContentId3": "Veeam_GetFinishedConfigurationBackupSessions-Parser" + }, + "parserObject4": { + "_parserName4": "[concat(parameters('workspace'),'/','Veeam_GetSecurityEvents')]", + "_parserId4": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetSecurityEvents')]", + "parserTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('Veeam_GetSecurityEvents-Parser')))]", + "parserVersion4": "1.0.0", + "parserContentId4": "Veeam_GetSecurityEvents-Parser" + }, + "analyticRuleObject1": { + "analyticRuleVersion1": "1.0.1", + "_analyticRulecontentId1": "6d1a5478-e613-44f4-a48f-12cc18568522", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6d1a5478-e613-44f4-a48f-12cc18568522')]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6d1a5478-e613-44f4-a48f-12cc18568522')))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6d1a5478-e613-44f4-a48f-12cc18568522','-', '1.0.1')))]" + }, + "analyticRuleObject2": { + "analyticRuleVersion2": "1.0.1", + "_analyticRulecontentId2": "fa8d692d-5b00-4a6c-99b3-30b4710efa59", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'fa8d692d-5b00-4a6c-99b3-30b4710efa59')]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('fa8d692d-5b00-4a6c-99b3-30b4710efa59')))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fa8d692d-5b00-4a6c-99b3-30b4710efa59','-', '1.0.1')))]" + }, + "analyticRuleObject3": { + "analyticRuleVersion3": "1.0.1", + "_analyticRulecontentId3": "ff3ceb7d-bed0-4ed2-8dbf-1feb9047810f", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ff3ceb7d-bed0-4ed2-8dbf-1feb9047810f')]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ff3ceb7d-bed0-4ed2-8dbf-1feb9047810f')))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ff3ceb7d-bed0-4ed2-8dbf-1feb9047810f','-', '1.0.1')))]" + }, + "analyticRuleObject4": { + "analyticRuleVersion4": "1.0.1", + "_analyticRulecontentId4": "6a90f177-dcaa-44ec-b6e6-723ee8408cb2", + "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6a90f177-dcaa-44ec-b6e6-723ee8408cb2')]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6a90f177-dcaa-44ec-b6e6-723ee8408cb2')))]", + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6a90f177-dcaa-44ec-b6e6-723ee8408cb2','-', '1.0.1')))]" + }, + "analyticRuleObject5": { + "analyticRuleVersion5": "1.0.1", + "_analyticRulecontentId5": "74c3bda5-cdae-4af3-ab54-daddfbe8bc70", + "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '74c3bda5-cdae-4af3-ab54-daddfbe8bc70')]", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('74c3bda5-cdae-4af3-ab54-daddfbe8bc70')))]", + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','74c3bda5-cdae-4af3-ab54-daddfbe8bc70','-', '1.0.1')))]" + }, + "analyticRuleObject6": { + "analyticRuleVersion6": "1.0.1", + "_analyticRulecontentId6": "4595192f-671b-4724-aa62-093a9724c2f3", + "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4595192f-671b-4724-aa62-093a9724c2f3')]", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4595192f-671b-4724-aa62-093a9724c2f3')))]", + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4595192f-671b-4724-aa62-093a9724c2f3','-', '1.0.1')))]" + }, + "analyticRuleObject7": { + "analyticRuleVersion7": "1.0.1", + "_analyticRulecontentId7": "54c9a609-60db-47b0-82ee-86895c89bd89", + "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '54c9a609-60db-47b0-82ee-86895c89bd89')]", + "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('54c9a609-60db-47b0-82ee-86895c89bd89')))]", + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','54c9a609-60db-47b0-82ee-86895c89bd89','-', '1.0.1')))]" + }, + "analyticRuleObject8": { + "analyticRuleVersion8": "1.0.1", + "_analyticRulecontentId8": "b8527d36-4cba-49c1-9cab-de9cdc3de879", + "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b8527d36-4cba-49c1-9cab-de9cdc3de879')]", + "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b8527d36-4cba-49c1-9cab-de9cdc3de879')))]", + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b8527d36-4cba-49c1-9cab-de9cdc3de879','-', '1.0.1')))]" + }, + "analyticRuleObject9": { + "analyticRuleVersion9": "1.0.1", + "_analyticRulecontentId9": "73b4d1d5-c357-4350-bb58-924684a4792a", + "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '73b4d1d5-c357-4350-bb58-924684a4792a')]", + "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('73b4d1d5-c357-4350-bb58-924684a4792a')))]", + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','73b4d1d5-c357-4350-bb58-924684a4792a','-', '1.0.1')))]" + }, + "analyticRuleObject10": { + "analyticRuleVersion10": "1.0.1", + "_analyticRulecontentId10": "f78e0bb9-2878-4e36-b9c9-6141bff8d3dd", + "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f78e0bb9-2878-4e36-b9c9-6141bff8d3dd')]", + "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f78e0bb9-2878-4e36-b9c9-6141bff8d3dd')))]", + "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f78e0bb9-2878-4e36-b9c9-6141bff8d3dd','-', '1.0.1')))]" + }, + "analyticRuleObject11": { + "analyticRuleVersion11": "1.0.1", + "_analyticRulecontentId11": "72239d5b-ef96-4f15-896f-6cdcd9c53ca7", + "analyticRuleId11": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '72239d5b-ef96-4f15-896f-6cdcd9c53ca7')]", + "analyticRuleTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('72239d5b-ef96-4f15-896f-6cdcd9c53ca7')))]", + "_analyticRulecontentProductId11": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','72239d5b-ef96-4f15-896f-6cdcd9c53ca7','-', '1.0.1')))]" + }, + "analyticRuleObject12": { + "analyticRuleVersion12": "1.0.1", + "_analyticRulecontentId12": "73e1d89b-79a6-4ab0-b3bb-5e564fcf10f1", + "analyticRuleId12": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '73e1d89b-79a6-4ab0-b3bb-5e564fcf10f1')]", + "analyticRuleTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('73e1d89b-79a6-4ab0-b3bb-5e564fcf10f1')))]", + "_analyticRulecontentProductId12": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','73e1d89b-79a6-4ab0-b3bb-5e564fcf10f1','-', '1.0.1')))]" + }, + "analyticRuleObject13": { + "analyticRuleVersion13": "1.0.1", + "_analyticRulecontentId13": "2b3b59eb-ea7c-45f6-9df8-8dbaed632317", + "analyticRuleId13": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2b3b59eb-ea7c-45f6-9df8-8dbaed632317')]", + "analyticRuleTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2b3b59eb-ea7c-45f6-9df8-8dbaed632317')))]", + "_analyticRulecontentProductId13": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2b3b59eb-ea7c-45f6-9df8-8dbaed632317','-', '1.0.1')))]" + }, + "analyticRuleObject14": { + "analyticRuleVersion14": "1.0.1", + "_analyticRulecontentId14": "9f0d4171-9a9f-42e4-acbf-9093dd4203de", + "analyticRuleId14": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9f0d4171-9a9f-42e4-acbf-9093dd4203de')]", + "analyticRuleTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9f0d4171-9a9f-42e4-acbf-9093dd4203de')))]", + "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9f0d4171-9a9f-42e4-acbf-9093dd4203de','-', '1.0.1')))]" + }, + "analyticRuleObject15": { + "analyticRuleVersion15": "1.0.1", + "_analyticRulecontentId15": "1f1634e5-585e-4187-ac5b-6d0e157bd2ea", + "analyticRuleId15": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1f1634e5-585e-4187-ac5b-6d0e157bd2ea')]", + "analyticRuleTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1f1634e5-585e-4187-ac5b-6d0e157bd2ea')))]", + "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1f1634e5-585e-4187-ac5b-6d0e157bd2ea','-', '1.0.1')))]" + }, + "analyticRuleObject16": { + "analyticRuleVersion16": "1.0.1", + "_analyticRulecontentId16": "18833d01-703a-438d-8ac6-84faa82e9b52", + "analyticRuleId16": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '18833d01-703a-438d-8ac6-84faa82e9b52')]", + "analyticRuleTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('18833d01-703a-438d-8ac6-84faa82e9b52')))]", + "_analyticRulecontentProductId16": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','18833d01-703a-438d-8ac6-84faa82e9b52','-', '1.0.1')))]" + }, + "analyticRuleObject17": { + "analyticRuleVersion17": "1.0.1", + "_analyticRulecontentId17": "90039769-0c32-442b-bb12-5b61224a77a0", + "analyticRuleId17": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '90039769-0c32-442b-bb12-5b61224a77a0')]", + "analyticRuleTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('90039769-0c32-442b-bb12-5b61224a77a0')))]", + "_analyticRulecontentProductId17": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','90039769-0c32-442b-bb12-5b61224a77a0','-', '1.0.1')))]" + }, + "analyticRuleObject18": { + "analyticRuleVersion18": "1.0.1", + "_analyticRulecontentId18": "8777f9e1-db58-4078-a381-4e47a3a2ee01", + "analyticRuleId18": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '8777f9e1-db58-4078-a381-4e47a3a2ee01')]", + "analyticRuleTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('8777f9e1-db58-4078-a381-4e47a3a2ee01')))]", + "_analyticRulecontentProductId18": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8777f9e1-db58-4078-a381-4e47a3a2ee01','-', '1.0.1')))]" + }, + "analyticRuleObject19": { + "analyticRuleVersion19": "1.0.1", + "_analyticRulecontentId19": "1edb50b5-fee1-4826-86f9-abaf0e4ce5a5", + "analyticRuleId19": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1edb50b5-fee1-4826-86f9-abaf0e4ce5a5')]", + "analyticRuleTemplateSpecName19": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1edb50b5-fee1-4826-86f9-abaf0e4ce5a5')))]", + "_analyticRulecontentProductId19": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1edb50b5-fee1-4826-86f9-abaf0e4ce5a5','-', '1.0.1')))]" + }, + "analyticRuleObject20": { + "analyticRuleVersion20": "1.0.1", + "_analyticRulecontentId20": "860e201a-deea-4129-8646-fcf8bdd976b0", + "analyticRuleId20": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '860e201a-deea-4129-8646-fcf8bdd976b0')]", + "analyticRuleTemplateSpecName20": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('860e201a-deea-4129-8646-fcf8bdd976b0')))]", + "_analyticRulecontentProductId20": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','860e201a-deea-4129-8646-fcf8bdd976b0','-', '1.0.1')))]" + }, + "analyticRuleObject21": { + "analyticRuleVersion21": "1.0.1", + "_analyticRulecontentId21": "e0d937ca-4582-4c3b-b95b-82fff33ed610", + "analyticRuleId21": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e0d937ca-4582-4c3b-b95b-82fff33ed610')]", + "analyticRuleTemplateSpecName21": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e0d937ca-4582-4c3b-b95b-82fff33ed610')))]", + "_analyticRulecontentProductId21": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e0d937ca-4582-4c3b-b95b-82fff33ed610','-', '1.0.1')))]" + }, + "analyticRuleObject22": { + "analyticRuleVersion22": "1.0.1", + "_analyticRulecontentId22": "cfc967be-0428-4ab0-8c15-06c85649078f", + "analyticRuleId22": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'cfc967be-0428-4ab0-8c15-06c85649078f')]", + "analyticRuleTemplateSpecName22": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('cfc967be-0428-4ab0-8c15-06c85649078f')))]", + "_analyticRulecontentProductId22": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cfc967be-0428-4ab0-8c15-06c85649078f','-', '1.0.1')))]" + }, + "analyticRuleObject23": { + "analyticRuleVersion23": "1.0.1", + "_analyticRulecontentId23": "58fcb721-35ec-4ea2-9f29-c99acde676b8", + "analyticRuleId23": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '58fcb721-35ec-4ea2-9f29-c99acde676b8')]", + "analyticRuleTemplateSpecName23": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('58fcb721-35ec-4ea2-9f29-c99acde676b8')))]", + "_analyticRulecontentProductId23": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','58fcb721-35ec-4ea2-9f29-c99acde676b8','-', '1.0.1')))]" + }, + "analyticRuleObject24": { + "analyticRuleVersion24": "1.0.1", + "_analyticRulecontentId24": "a2c6fe48-0d3d-416b-991c-a750ec50d7eb", + "analyticRuleId24": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a2c6fe48-0d3d-416b-991c-a750ec50d7eb')]", + "analyticRuleTemplateSpecName24": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a2c6fe48-0d3d-416b-991c-a750ec50d7eb')))]", + "_analyticRulecontentProductId24": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a2c6fe48-0d3d-416b-991c-a750ec50d7eb','-', '1.0.1')))]" + }, + "analyticRuleObject25": { + "analyticRuleVersion25": "1.0.1", + "_analyticRulecontentId25": "cc47b9d6-a10e-4c5e-94a1-c73a68273e2d", + "analyticRuleId25": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'cc47b9d6-a10e-4c5e-94a1-c73a68273e2d')]", + "analyticRuleTemplateSpecName25": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('cc47b9d6-a10e-4c5e-94a1-c73a68273e2d')))]", + "_analyticRulecontentProductId25": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cc47b9d6-a10e-4c5e-94a1-c73a68273e2d','-', '1.0.1')))]" + }, + "analyticRuleObject26": { + "analyticRuleVersion26": "1.0.1", + "_analyticRulecontentId26": "d035188d-d856-4a74-8226-f3bdf65033c4", + "analyticRuleId26": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd035188d-d856-4a74-8226-f3bdf65033c4')]", + "analyticRuleTemplateSpecName26": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d035188d-d856-4a74-8226-f3bdf65033c4')))]", + "_analyticRulecontentProductId26": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d035188d-d856-4a74-8226-f3bdf65033c4','-', '1.0.1')))]" + }, + "analyticRuleObject27": { + "analyticRuleVersion27": "1.0.1", + "_analyticRulecontentId27": "5f6f5a46-42d3-4961-94db-68b6229bc84e", + "analyticRuleId27": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5f6f5a46-42d3-4961-94db-68b6229bc84e')]", + "analyticRuleTemplateSpecName27": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5f6f5a46-42d3-4961-94db-68b6229bc84e')))]", + "_analyticRulecontentProductId27": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5f6f5a46-42d3-4961-94db-68b6229bc84e','-', '1.0.1')))]" + }, + "analyticRuleObject28": { + "analyticRuleVersion28": "1.0.1", + "_analyticRulecontentId28": "8f339b13-02f0-400f-be18-491ec0ba71f1", + "analyticRuleId28": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '8f339b13-02f0-400f-be18-491ec0ba71f1')]", + "analyticRuleTemplateSpecName28": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('8f339b13-02f0-400f-be18-491ec0ba71f1')))]", + "_analyticRulecontentProductId28": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8f339b13-02f0-400f-be18-491ec0ba71f1','-', '1.0.1')))]" + }, + "analyticRuleObject29": { + "analyticRuleVersion29": "1.0.1", + "_analyticRulecontentId29": "a053e7ba-e60c-482a-bbd8-89a25c53d905", + "analyticRuleId29": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a053e7ba-e60c-482a-bbd8-89a25c53d905')]", + "analyticRuleTemplateSpecName29": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a053e7ba-e60c-482a-bbd8-89a25c53d905')))]", + "_analyticRulecontentProductId29": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a053e7ba-e60c-482a-bbd8-89a25c53d905','-', '1.0.1')))]" + }, + "analyticRuleObject30": { + "analyticRuleVersion30": "1.0.1", + "_analyticRulecontentId30": "e06ec6d7-d9f6-4675-89bf-03fa8a0e0be0", + "analyticRuleId30": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e06ec6d7-d9f6-4675-89bf-03fa8a0e0be0')]", + "analyticRuleTemplateSpecName30": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e06ec6d7-d9f6-4675-89bf-03fa8a0e0be0')))]", + "_analyticRulecontentProductId30": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e06ec6d7-d9f6-4675-89bf-03fa8a0e0be0','-', '1.0.1')))]" + }, + "analyticRuleObject31": { + "analyticRuleVersion31": "1.0.1", + "_analyticRulecontentId31": "de4cc05b-2e4e-4104-9559-101b4c41c35e", + "analyticRuleId31": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'de4cc05b-2e4e-4104-9559-101b4c41c35e')]", + "analyticRuleTemplateSpecName31": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('de4cc05b-2e4e-4104-9559-101b4c41c35e')))]", + "_analyticRulecontentProductId31": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','de4cc05b-2e4e-4104-9559-101b4c41c35e','-', '1.0.1')))]" + }, + "analyticRuleObject32": { + "analyticRuleVersion32": "1.0.1", + "_analyticRulecontentId32": "d7f23105-6756-43ae-973c-48b7441559d5", + "analyticRuleId32": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd7f23105-6756-43ae-973c-48b7441559d5')]", + "analyticRuleTemplateSpecName32": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d7f23105-6756-43ae-973c-48b7441559d5')))]", + "_analyticRulecontentProductId32": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d7f23105-6756-43ae-973c-48b7441559d5','-', '1.0.1')))]" + }, + "analyticRuleObject33": { + "analyticRuleVersion33": "1.0.1", + "_analyticRulecontentId33": "62008da4-627e-47fe-b78a-62e1e23b3eb9", + "analyticRuleId33": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '62008da4-627e-47fe-b78a-62e1e23b3eb9')]", + "analyticRuleTemplateSpecName33": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('62008da4-627e-47fe-b78a-62e1e23b3eb9')))]", + "_analyticRulecontentProductId33": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','62008da4-627e-47fe-b78a-62e1e23b3eb9','-', '1.0.1')))]" + }, + "analyticRuleObject34": { + "analyticRuleVersion34": "1.0.1", + "_analyticRulecontentId34": "7ddaf8ef-b726-408b-b1a7-a7a4f92cbf6d", + "analyticRuleId34": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7ddaf8ef-b726-408b-b1a7-a7a4f92cbf6d')]", + "analyticRuleTemplateSpecName34": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7ddaf8ef-b726-408b-b1a7-a7a4f92cbf6d')))]", + "_analyticRulecontentProductId34": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7ddaf8ef-b726-408b-b1a7-a7a4f92cbf6d','-', '1.0.1')))]" + }, + "analyticRuleObject35": { + "analyticRuleVersion35": "1.0.1", + "_analyticRulecontentId35": "57a8ff3a-d4aa-456f-9c13-186026bae52e", + "analyticRuleId35": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '57a8ff3a-d4aa-456f-9c13-186026bae52e')]", + "analyticRuleTemplateSpecName35": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('57a8ff3a-d4aa-456f-9c13-186026bae52e')))]", + "_analyticRulecontentProductId35": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','57a8ff3a-d4aa-456f-9c13-186026bae52e','-', '1.0.1')))]" + }, + "analyticRuleObject36": { + "analyticRuleVersion36": "1.0.1", + "_analyticRulecontentId36": "fe6226cd-fee7-4d0d-88d2-160311207b57", + "analyticRuleId36": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'fe6226cd-fee7-4d0d-88d2-160311207b57')]", + "analyticRuleTemplateSpecName36": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('fe6226cd-fee7-4d0d-88d2-160311207b57')))]", + "_analyticRulecontentProductId36": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fe6226cd-fee7-4d0d-88d2-160311207b57','-', '1.0.1')))]" + }, + "analyticRuleObject37": { + "analyticRuleVersion37": "1.0.1", + "_analyticRulecontentId37": "a641dbe1-9590-46f8-a6d7-b5f24db6e126", + "analyticRuleId37": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a641dbe1-9590-46f8-a6d7-b5f24db6e126')]", + "analyticRuleTemplateSpecName37": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a641dbe1-9590-46f8-a6d7-b5f24db6e126')))]", + "_analyticRulecontentProductId37": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a641dbe1-9590-46f8-a6d7-b5f24db6e126','-', '1.0.1')))]" + }, + "analyticRuleObject38": { + "analyticRuleVersion38": "1.0.1", + "_analyticRulecontentId38": "dfd1d756-623d-4951-84a5-ce51f726d322", + "analyticRuleId38": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'dfd1d756-623d-4951-84a5-ce51f726d322')]", + "analyticRuleTemplateSpecName38": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('dfd1d756-623d-4951-84a5-ce51f726d322')))]", + "_analyticRulecontentProductId38": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','dfd1d756-623d-4951-84a5-ce51f726d322','-', '1.0.1')))]" + }, + "analyticRuleObject39": { + "analyticRuleVersion39": "1.0.1", + "_analyticRulecontentId39": "14003a45-da0b-47dc-8e20-9711ba7b5112", + "analyticRuleId39": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '14003a45-da0b-47dc-8e20-9711ba7b5112')]", + "analyticRuleTemplateSpecName39": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('14003a45-da0b-47dc-8e20-9711ba7b5112')))]", + "_analyticRulecontentProductId39": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','14003a45-da0b-47dc-8e20-9711ba7b5112','-', '1.0.1')))]" + }, + "analyticRuleObject40": { + "analyticRuleVersion40": "1.0.1", + "_analyticRulecontentId40": "0995ccd8-16d4-4764-83b2-511235ca4e4b", + "analyticRuleId40": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '0995ccd8-16d4-4764-83b2-511235ca4e4b')]", + "analyticRuleTemplateSpecName40": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('0995ccd8-16d4-4764-83b2-511235ca4e4b')))]", + "_analyticRulecontentProductId40": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','0995ccd8-16d4-4764-83b2-511235ca4e4b','-', '1.0.1')))]" + }, + "analyticRuleObject41": { + "analyticRuleVersion41": "1.0.1", + "_analyticRulecontentId41": "c9faf1ee-57dd-4f54-8cd1-fcf35a1aa424", + "analyticRuleId41": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c9faf1ee-57dd-4f54-8cd1-fcf35a1aa424')]", + "analyticRuleTemplateSpecName41": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c9faf1ee-57dd-4f54-8cd1-fcf35a1aa424')))]", + "_analyticRulecontentProductId41": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c9faf1ee-57dd-4f54-8cd1-fcf35a1aa424','-', '1.0.1')))]" + }, + "analyticRuleObject42": { + "analyticRuleVersion42": "1.0.1", + "_analyticRulecontentId42": "2034c441-2850-4167-80ed-b4438155836d", + "analyticRuleId42": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2034c441-2850-4167-80ed-b4438155836d')]", + "analyticRuleTemplateSpecName42": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2034c441-2850-4167-80ed-b4438155836d')))]", + "_analyticRulecontentProductId42": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2034c441-2850-4167-80ed-b4438155836d','-', '1.0.1')))]" + }, + "analyticRuleObject43": { + "analyticRuleVersion43": "1.0.1", + "_analyticRulecontentId43": "141d7e3c-a72b-49f7-9e64-57f60c2fa927", + "analyticRuleId43": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '141d7e3c-a72b-49f7-9e64-57f60c2fa927')]", + "analyticRuleTemplateSpecName43": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('141d7e3c-a72b-49f7-9e64-57f60c2fa927')))]", + "_analyticRulecontentProductId43": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','141d7e3c-a72b-49f7-9e64-57f60c2fa927','-', '1.0.1')))]" + }, + "analyticRuleObject44": { + "analyticRuleVersion44": "1.0.1", + "_analyticRulecontentId44": "5601e894-2d3c-42fd-bc71-f0350b1b0bc6", + "analyticRuleId44": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5601e894-2d3c-42fd-bc71-f0350b1b0bc6')]", + "analyticRuleTemplateSpecName44": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5601e894-2d3c-42fd-bc71-f0350b1b0bc6')))]", + "_analyticRulecontentProductId44": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5601e894-2d3c-42fd-bc71-f0350b1b0bc6','-', '1.0.1')))]" + }, + "analyticRuleObject45": { + "analyticRuleVersion45": "1.0.1", + "_analyticRulecontentId45": "ac1a85f1-0e3f-4ae8-9f59-a240fc04b03f", + "analyticRuleId45": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ac1a85f1-0e3f-4ae8-9f59-a240fc04b03f')]", + "analyticRuleTemplateSpecName45": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ac1a85f1-0e3f-4ae8-9f59-a240fc04b03f')))]", + "_analyticRulecontentProductId45": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ac1a85f1-0e3f-4ae8-9f59-a240fc04b03f','-', '1.0.1')))]" + }, + "analyticRuleObject46": { + "analyticRuleVersion46": "1.0.1", + "_analyticRulecontentId46": "4e41c85f-d495-4a23-a218-41b938140dce", + "analyticRuleId46": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4e41c85f-d495-4a23-a218-41b938140dce')]", + "analyticRuleTemplateSpecName46": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4e41c85f-d495-4a23-a218-41b938140dce')))]", + "_analyticRulecontentProductId46": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4e41c85f-d495-4a23-a218-41b938140dce','-', '1.0.1')))]" + }, + "analyticRuleObject47": { + "analyticRuleVersion47": "1.0.1", + "_analyticRulecontentId47": "580da4d1-8e39-4420-855d-3d4f653fe127", + "analyticRuleId47": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '580da4d1-8e39-4420-855d-3d4f653fe127')]", + "analyticRuleTemplateSpecName47": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('580da4d1-8e39-4420-855d-3d4f653fe127')))]", + "_analyticRulecontentProductId47": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','580da4d1-8e39-4420-855d-3d4f653fe127','-', '1.0.1')))]" + }, + "analyticRuleObject48": { + "analyticRuleVersion48": "1.0.1", + "_analyticRulecontentId48": "5220a0b0-ab15-43cf-a77e-2273d35cfe8e", + "analyticRuleId48": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5220a0b0-ab15-43cf-a77e-2273d35cfe8e')]", + "analyticRuleTemplateSpecName48": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5220a0b0-ab15-43cf-a77e-2273d35cfe8e')))]", + "_analyticRulecontentProductId48": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5220a0b0-ab15-43cf-a77e-2273d35cfe8e','-', '1.0.1')))]" + }, + "analyticRuleObject49": { + "analyticRuleVersion49": "1.0.1", + "_analyticRulecontentId49": "b4ea5da0-77a8-400e-ae2b-3ca8fdb779ef", + "analyticRuleId49": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b4ea5da0-77a8-400e-ae2b-3ca8fdb779ef')]", + "analyticRuleTemplateSpecName49": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b4ea5da0-77a8-400e-ae2b-3ca8fdb779ef')))]", + "_analyticRulecontentProductId49": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b4ea5da0-77a8-400e-ae2b-3ca8fdb779ef','-', '1.0.1')))]" + }, + "analyticRuleObject50": { + "analyticRuleVersion50": "1.0.1", + "_analyticRulecontentId50": "61c576ae-f81a-4151-8524-b08c86f206a8", + "analyticRuleId50": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '61c576ae-f81a-4151-8524-b08c86f206a8')]", + "analyticRuleTemplateSpecName50": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('61c576ae-f81a-4151-8524-b08c86f206a8')))]", + "_analyticRulecontentProductId50": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','61c576ae-f81a-4151-8524-b08c86f206a8','-', '1.0.1')))]" + }, + "analyticRuleObject51": { + "analyticRuleVersion51": "1.0.1", + "_analyticRulecontentId51": "f11f245e-f77e-4dc5-95f1-ce602c2a36ba", + "analyticRuleId51": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f11f245e-f77e-4dc5-95f1-ce602c2a36ba')]", + "analyticRuleTemplateSpecName51": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f11f245e-f77e-4dc5-95f1-ce602c2a36ba')))]", + "_analyticRulecontentProductId51": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f11f245e-f77e-4dc5-95f1-ce602c2a36ba','-', '1.0.1')))]" + }, + "analyticRuleObject52": { + "analyticRuleVersion52": "1.0.1", + "_analyticRulecontentId52": "9b5ab4b6-7cca-4779-9784-761b48a58e78", + "analyticRuleId52": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9b5ab4b6-7cca-4779-9784-761b48a58e78')]", + "analyticRuleTemplateSpecName52": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9b5ab4b6-7cca-4779-9784-761b48a58e78')))]", + "_analyticRulecontentProductId52": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9b5ab4b6-7cca-4779-9784-761b48a58e78','-', '1.0.1')))]" + }, + "analyticRuleObject53": { + "analyticRuleVersion53": "1.0.1", + "_analyticRulecontentId53": "594dafa1-e2d5-4f83-b32e-c629cb629b6f", + "analyticRuleId53": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '594dafa1-e2d5-4f83-b32e-c629cb629b6f')]", + "analyticRuleTemplateSpecName53": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('594dafa1-e2d5-4f83-b32e-c629cb629b6f')))]", + "_analyticRulecontentProductId53": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','594dafa1-e2d5-4f83-b32e-c629cb629b6f','-', '1.0.1')))]" + }, + "analyticRuleObject54": { + "analyticRuleVersion54": "1.0.1", + "_analyticRulecontentId54": "94724029-6ec3-4bf7-a0e9-c4e4cba0479f", + "analyticRuleId54": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '94724029-6ec3-4bf7-a0e9-c4e4cba0479f')]", + "analyticRuleTemplateSpecName54": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('94724029-6ec3-4bf7-a0e9-c4e4cba0479f')))]", + "_analyticRulecontentProductId54": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','94724029-6ec3-4bf7-a0e9-c4e4cba0479f','-', '1.0.1')))]" + }, + "analyticRuleObject55": { + "analyticRuleVersion55": "1.0.1", + "_analyticRulecontentId55": "79adb08a-8218-492d-acf0-f8aa596f3444", + "analyticRuleId55": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '79adb08a-8218-492d-acf0-f8aa596f3444')]", + "analyticRuleTemplateSpecName55": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('79adb08a-8218-492d-acf0-f8aa596f3444')))]", + "_analyticRulecontentProductId55": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','79adb08a-8218-492d-acf0-f8aa596f3444','-', '1.0.1')))]" + }, + "analyticRuleObject56": { + "analyticRuleVersion56": "1.0.1", + "_analyticRulecontentId56": "e4828d99-bb06-40b3-8f9d-0f68fb61e9ee", + "analyticRuleId56": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e4828d99-bb06-40b3-8f9d-0f68fb61e9ee')]", + "analyticRuleTemplateSpecName56": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e4828d99-bb06-40b3-8f9d-0f68fb61e9ee')))]", + "_analyticRulecontentProductId56": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e4828d99-bb06-40b3-8f9d-0f68fb61e9ee','-', '1.0.1')))]" + }, + "analyticRuleObject57": { + "analyticRuleVersion57": "1.0.1", + "_analyticRulecontentId57": "31ffa231-72da-49f0-88cd-de08eaf3bc52", + "analyticRuleId57": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '31ffa231-72da-49f0-88cd-de08eaf3bc52')]", + "analyticRuleTemplateSpecName57": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('31ffa231-72da-49f0-88cd-de08eaf3bc52')))]", + "_analyticRulecontentProductId57": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','31ffa231-72da-49f0-88cd-de08eaf3bc52','-', '1.0.1')))]" + }, + "analyticRuleObject58": { + "analyticRuleVersion58": "1.0.1", + "_analyticRulecontentId58": "8e4986ac-7388-4782-b389-0b0288123dbc", + "analyticRuleId58": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '8e4986ac-7388-4782-b389-0b0288123dbc')]", + "analyticRuleTemplateSpecName58": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('8e4986ac-7388-4782-b389-0b0288123dbc')))]", + "_analyticRulecontentProductId58": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8e4986ac-7388-4782-b389-0b0288123dbc','-', '1.0.1')))]" + }, + "analyticRuleObject59": { + "analyticRuleVersion59": "1.0.1", + "_analyticRulecontentId59": "7a6f7e95-b574-44ab-b215-f5c32a2378d1", + "analyticRuleId59": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7a6f7e95-b574-44ab-b215-f5c32a2378d1')]", + "analyticRuleTemplateSpecName59": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7a6f7e95-b574-44ab-b215-f5c32a2378d1')))]", + "_analyticRulecontentProductId59": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7a6f7e95-b574-44ab-b215-f5c32a2378d1','-', '1.0.1')))]" + }, + "analyticRuleObject60": { + "analyticRuleVersion60": "1.0.1", + "_analyticRulecontentId60": "3caa6e6d-a3e2-4776-be97-15d20e2675ed", + "analyticRuleId60": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3caa6e6d-a3e2-4776-be97-15d20e2675ed')]", + "analyticRuleTemplateSpecName60": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3caa6e6d-a3e2-4776-be97-15d20e2675ed')))]", + "_analyticRulecontentProductId60": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3caa6e6d-a3e2-4776-be97-15d20e2675ed','-', '1.0.1')))]" + }, + "analyticRuleObject61": { + "analyticRuleVersion61": "1.0.2", + "_analyticRulecontentId61": "9a7c80ef-8dc2-4b07-834d-b9ca18d603f7", + "analyticRuleId61": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9a7c80ef-8dc2-4b07-834d-b9ca18d603f7')]", + "analyticRuleTemplateSpecName61": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9a7c80ef-8dc2-4b07-834d-b9ca18d603f7')))]", + "_analyticRulecontentProductId61": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9a7c80ef-8dc2-4b07-834d-b9ca18d603f7','-', '1.0.2')))]" + }, + "analyticRuleObject62": { + "analyticRuleVersion62": "1.0.1", + "_analyticRulecontentId62": "401e91cb-b53f-41a5-b066-1c028b3b51db", + "analyticRuleId62": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '401e91cb-b53f-41a5-b066-1c028b3b51db')]", + "analyticRuleTemplateSpecName62": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('401e91cb-b53f-41a5-b066-1c028b3b51db')))]", + "_analyticRulecontentProductId62": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','401e91cb-b53f-41a5-b066-1c028b3b51db','-', '1.0.1')))]" + }, + "analyticRuleObject63": { + "analyticRuleVersion63": "1.0.1", + "_analyticRulecontentId63": "88b9223c-29ff-48a9-a745-c553aa0dbae2", + "analyticRuleId63": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '88b9223c-29ff-48a9-a745-c553aa0dbae2')]", + "analyticRuleTemplateSpecName63": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('88b9223c-29ff-48a9-a745-c553aa0dbae2')))]", + "_analyticRulecontentProductId63": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','88b9223c-29ff-48a9-a745-c553aa0dbae2','-', '1.0.1')))]" + }, + "analyticRuleObject64": { + "analyticRuleVersion64": "1.0.1", + "_analyticRulecontentId64": "effd8410-3119-41c8-a228-9c0c8ce10d67", + "analyticRuleId64": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'effd8410-3119-41c8-a228-9c0c8ce10d67')]", + "analyticRuleTemplateSpecName64": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('effd8410-3119-41c8-a228-9c0c8ce10d67')))]", + "_analyticRulecontentProductId64": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','effd8410-3119-41c8-a228-9c0c8ce10d67','-', '1.0.1')))]" + }, + "analyticRuleObject65": { + "analyticRuleVersion65": "1.0.1", + "_analyticRulecontentId65": "b42424a6-10f4-447b-92a0-55ac38f4a475", + "analyticRuleId65": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b42424a6-10f4-447b-92a0-55ac38f4a475')]", + "analyticRuleTemplateSpecName65": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b42424a6-10f4-447b-92a0-55ac38f4a475')))]", + "_analyticRulecontentProductId65": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b42424a6-10f4-447b-92a0-55ac38f4a475','-', '1.0.1')))]" + }, + "analyticRuleObject66": { + "analyticRuleVersion66": "1.0.1", + "_analyticRulecontentId66": "6881f4f5-f58e-43d7-a05e-b5d05a4c09f9", + "analyticRuleId66": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6881f4f5-f58e-43d7-a05e-b5d05a4c09f9')]", + "analyticRuleTemplateSpecName66": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6881f4f5-f58e-43d7-a05e-b5d05a4c09f9')))]", + "_analyticRulecontentProductId66": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6881f4f5-f58e-43d7-a05e-b5d05a4c09f9','-', '1.0.1')))]" + }, + "analyticRuleObject67": { + "analyticRuleVersion67": "1.0.1", + "_analyticRulecontentId67": "3fefd6c5-bbe9-49a9-95b2-d4b8a5591d9c", + "analyticRuleId67": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3fefd6c5-bbe9-49a9-95b2-d4b8a5591d9c')]", + "analyticRuleTemplateSpecName67": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3fefd6c5-bbe9-49a9-95b2-d4b8a5591d9c')))]", + "_analyticRulecontentProductId67": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3fefd6c5-bbe9-49a9-95b2-d4b8a5591d9c','-', '1.0.1')))]" + }, + "analyticRuleObject68": { + "analyticRuleVersion68": "1.0.1", + "_analyticRulecontentId68": "4d8f5244-cb56-4e95-ba65-0a7bec114a13", + "analyticRuleId68": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4d8f5244-cb56-4e95-ba65-0a7bec114a13')]", + "analyticRuleTemplateSpecName68": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4d8f5244-cb56-4e95-ba65-0a7bec114a13')))]", + "_analyticRulecontentProductId68": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4d8f5244-cb56-4e95-ba65-0a7bec114a13','-', '1.0.1')))]" + }, + "analyticRuleObject69": { + "analyticRuleVersion69": "1.0.1", + "_analyticRulecontentId69": "ebdd9cf8-c41c-460e-95d8-e5bc3cd9763e", + "analyticRuleId69": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ebdd9cf8-c41c-460e-95d8-e5bc3cd9763e')]", + "analyticRuleTemplateSpecName69": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ebdd9cf8-c41c-460e-95d8-e5bc3cd9763e')))]", + "_analyticRulecontentProductId69": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ebdd9cf8-c41c-460e-95d8-e5bc3cd9763e','-', '1.0.1')))]" + }, + "analyticRuleObject70": { + "analyticRuleVersion70": "1.0.1", + "_analyticRulecontentId70": "e92ba6bb-53ea-4347-b1a6-2e015298bbdc", + "analyticRuleId70": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e92ba6bb-53ea-4347-b1a6-2e015298bbdc')]", + "analyticRuleTemplateSpecName70": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e92ba6bb-53ea-4347-b1a6-2e015298bbdc')))]", + "_analyticRulecontentProductId70": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e92ba6bb-53ea-4347-b1a6-2e015298bbdc','-', '1.0.1')))]" + }, + "analyticRuleObject71": { + "analyticRuleVersion71": "1.0.1", + "_analyticRulecontentId71": "56d70592-077e-4e7b-9d8a-b5d8b0a6a52b", + "analyticRuleId71": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '56d70592-077e-4e7b-9d8a-b5d8b0a6a52b')]", + "analyticRuleTemplateSpecName71": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('56d70592-077e-4e7b-9d8a-b5d8b0a6a52b')))]", + "_analyticRulecontentProductId71": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','56d70592-077e-4e7b-9d8a-b5d8b0a6a52b','-', '1.0.1')))]" + }, + "analyticRuleObject72": { + "analyticRuleVersion72": "1.0.1", + "_analyticRulecontentId72": "6e4d1832-2cf9-410d-a5e2-c12b33c7d9f7", + "analyticRuleId72": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6e4d1832-2cf9-410d-a5e2-c12b33c7d9f7')]", + "analyticRuleTemplateSpecName72": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6e4d1832-2cf9-410d-a5e2-c12b33c7d9f7')))]", + "_analyticRulecontentProductId72": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6e4d1832-2cf9-410d-a5e2-c12b33c7d9f7','-', '1.0.1')))]" + }, + "analyticRuleObject73": { + "analyticRuleVersion73": "1.0.1", + "_analyticRulecontentId73": "1f6897bf-a05a-47b2-a5f9-4ba6fd34f715", + "analyticRuleId73": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1f6897bf-a05a-47b2-a5f9-4ba6fd34f715')]", + "analyticRuleTemplateSpecName73": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1f6897bf-a05a-47b2-a5f9-4ba6fd34f715')))]", + "_analyticRulecontentProductId73": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1f6897bf-a05a-47b2-a5f9-4ba6fd34f715','-', '1.0.1')))]" + }, + "analyticRuleObject74": { + "analyticRuleVersion74": "1.0.1", + "_analyticRulecontentId74": "a8ebf22b-a050-434c-8095-2267f206257a", + "analyticRuleId74": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a8ebf22b-a050-434c-8095-2267f206257a')]", + "analyticRuleTemplateSpecName74": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a8ebf22b-a050-434c-8095-2267f206257a')))]", + "_analyticRulecontentProductId74": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a8ebf22b-a050-434c-8095-2267f206257a','-', '1.0.1')))]" + }, + "analyticRuleObject75": { + "analyticRuleVersion75": "1.0.1", + "_analyticRulecontentId75": "f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca", + "analyticRuleId75": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca')]", + "analyticRuleTemplateSpecName75": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca')))]", + "_analyticRulecontentProductId75": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f4cad1aa-a1e2-46dc-bf09-6cf8dc67f0ca','-', '1.0.1')))]" + }, + "analyticRuleObject76": { + "analyticRuleVersion76": "1.0.1", + "_analyticRulecontentId76": "5367e8fc-a150-468f-84f2-90ac1dabef15", + "analyticRuleId76": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5367e8fc-a150-468f-84f2-90ac1dabef15')]", + "analyticRuleTemplateSpecName76": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5367e8fc-a150-468f-84f2-90ac1dabef15')))]", + "_analyticRulecontentProductId76": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5367e8fc-a150-468f-84f2-90ac1dabef15','-', '1.0.1')))]" + }, + "analyticRuleObject77": { + "analyticRuleVersion77": "1.0.1", + "_analyticRulecontentId77": "af97a601-8fac-4628-bdad-5fc0511236b2", + "analyticRuleId77": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'af97a601-8fac-4628-bdad-5fc0511236b2')]", + "analyticRuleTemplateSpecName77": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('af97a601-8fac-4628-bdad-5fc0511236b2')))]", + "_analyticRulecontentProductId77": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','af97a601-8fac-4628-bdad-5fc0511236b2','-', '1.0.1')))]" + }, + "analyticRuleObject78": { + "analyticRuleVersion78": "1.0.1", + "_analyticRulecontentId78": "88a61215-b3e6-4c78-8acd-9078d9bcfdc3", + "analyticRuleId78": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '88a61215-b3e6-4c78-8acd-9078d9bcfdc3')]", + "analyticRuleTemplateSpecName78": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('88a61215-b3e6-4c78-8acd-9078d9bcfdc3')))]", + "_analyticRulecontentProductId78": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','88a61215-b3e6-4c78-8acd-9078d9bcfdc3','-', '1.0.1')))]" + }, + "analyticRuleObject79": { + "analyticRuleVersion79": "1.0.1", + "_analyticRulecontentId79": "e06b913f-7698-4b2c-96e6-d47a9f4f5de8", + "analyticRuleId79": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e06b913f-7698-4b2c-96e6-d47a9f4f5de8')]", + "analyticRuleTemplateSpecName79": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e06b913f-7698-4b2c-96e6-d47a9f4f5de8')))]", + "_analyticRulecontentProductId79": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e06b913f-7698-4b2c-96e6-d47a9f4f5de8','-', '1.0.1')))]" + }, + "analyticRuleObject80": { + "analyticRuleVersion80": "1.0.1", + "_analyticRulecontentId80": "5fda37e0-d67c-4e8d-b277-90e5eac2172c", + "analyticRuleId80": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5fda37e0-d67c-4e8d-b277-90e5eac2172c')]", + "analyticRuleTemplateSpecName80": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5fda37e0-d67c-4e8d-b277-90e5eac2172c')))]", + "_analyticRulecontentProductId80": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5fda37e0-d67c-4e8d-b277-90e5eac2172c','-', '1.0.1')))]" + }, + "analyticRuleObject81": { + "analyticRuleVersion81": "1.0.1", + "_analyticRulecontentId81": "e9b9efa5-4e19-4716-840b-51ef2feeaad1", + "analyticRuleId81": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e9b9efa5-4e19-4716-840b-51ef2feeaad1')]", + "analyticRuleTemplateSpecName81": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e9b9efa5-4e19-4716-840b-51ef2feeaad1')))]", + "_analyticRulecontentProductId81": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e9b9efa5-4e19-4716-840b-51ef2feeaad1','-', '1.0.1')))]" + }, + "analyticRuleObject82": { + "analyticRuleVersion82": "1.0.1", + "_analyticRulecontentId82": "9f37ded4-f27a-4ef6-b5e6-de6430070808", + "analyticRuleId82": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9f37ded4-f27a-4ef6-b5e6-de6430070808')]", + "analyticRuleTemplateSpecName82": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9f37ded4-f27a-4ef6-b5e6-de6430070808')))]", + "_analyticRulecontentProductId82": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9f37ded4-f27a-4ef6-b5e6-de6430070808','-', '1.0.1')))]" + }, + "analyticRuleObject83": { + "analyticRuleVersion83": "1.0.1", + "_analyticRulecontentId83": "c4c6cb50-9fc3-4ca9-a2df-22d527240309", + "analyticRuleId83": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c4c6cb50-9fc3-4ca9-a2df-22d527240309')]", + "analyticRuleTemplateSpecName83": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c4c6cb50-9fc3-4ca9-a2df-22d527240309')))]", + "_analyticRulecontentProductId83": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c4c6cb50-9fc3-4ca9-a2df-22d527240309','-', '1.0.1')))]" + }, + "analyticRuleObject84": { + "analyticRuleVersion84": "1.0.1", + "_analyticRulecontentId84": "bad9d4b8-41cb-41ba-82c8-e20e771b3440", + "analyticRuleId84": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'bad9d4b8-41cb-41ba-82c8-e20e771b3440')]", + "analyticRuleTemplateSpecName84": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('bad9d4b8-41cb-41ba-82c8-e20e771b3440')))]", + "_analyticRulecontentProductId84": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bad9d4b8-41cb-41ba-82c8-e20e771b3440','-', '1.0.1')))]" + }, + "analyticRuleObject85": { + "analyticRuleVersion85": "1.0.1", + "_analyticRulecontentId85": "4dc85727-573c-4722-8173-026e2a1d20db", + "analyticRuleId85": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4dc85727-573c-4722-8173-026e2a1d20db')]", + "analyticRuleTemplateSpecName85": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4dc85727-573c-4722-8173-026e2a1d20db')))]", + "_analyticRulecontentProductId85": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4dc85727-573c-4722-8173-026e2a1d20db','-', '1.0.1')))]" + }, + "analyticRuleObject86": { + "analyticRuleVersion86": "1.0.1", + "_analyticRulecontentId86": "12006091-95a7-4f21-b474-f74b0480a138", + "analyticRuleId86": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '12006091-95a7-4f21-b474-f74b0480a138')]", + "analyticRuleTemplateSpecName86": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('12006091-95a7-4f21-b474-f74b0480a138')))]", + "_analyticRulecontentProductId86": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','12006091-95a7-4f21-b474-f74b0480a138','-', '1.0.1')))]" + }, + "analyticRuleObject87": { + "analyticRuleVersion87": "1.0.1", + "_analyticRulecontentId87": "cbe9fcb2-8767-4965-887e-350710145386", + "analyticRuleId87": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'cbe9fcb2-8767-4965-887e-350710145386')]", + "analyticRuleTemplateSpecName87": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('cbe9fcb2-8767-4965-887e-350710145386')))]", + "_analyticRulecontentProductId87": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cbe9fcb2-8767-4965-887e-350710145386','-', '1.0.1')))]" + }, + "analyticRuleObject88": { + "analyticRuleVersion88": "1.0.1", + "_analyticRulecontentId88": "35fb4771-9b8f-47f7-bd5b-3085d584f7ce", + "analyticRuleId88": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '35fb4771-9b8f-47f7-bd5b-3085d584f7ce')]", + "analyticRuleTemplateSpecName88": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('35fb4771-9b8f-47f7-bd5b-3085d584f7ce')))]", + "_analyticRulecontentProductId88": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','35fb4771-9b8f-47f7-bd5b-3085d584f7ce','-', '1.0.1')))]" + }, + "analyticRuleObject89": { + "analyticRuleVersion89": "1.0.1", + "_analyticRulecontentId89": "40b8e739-1077-42d8-9501-b68736c2c4d2", + "analyticRuleId89": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '40b8e739-1077-42d8-9501-b68736c2c4d2')]", + "analyticRuleTemplateSpecName89": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('40b8e739-1077-42d8-9501-b68736c2c4d2')))]", + "_analyticRulecontentProductId89": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','40b8e739-1077-42d8-9501-b68736c2c4d2','-', '1.0.1')))]" + }, + "analyticRuleObject90": { + "analyticRuleVersion90": "1.0.1", + "_analyticRulecontentId90": "7cf8c19b-6cd2-4d0c-814b-45d34e68568b", + "analyticRuleId90": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7cf8c19b-6cd2-4d0c-814b-45d34e68568b')]", + "analyticRuleTemplateSpecName90": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7cf8c19b-6cd2-4d0c-814b-45d34e68568b')))]", + "_analyticRulecontentProductId90": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7cf8c19b-6cd2-4d0c-814b-45d34e68568b','-', '1.0.1')))]" + }, + "analyticRuleObject91": { + "analyticRuleVersion91": "1.0.1", + "_analyticRulecontentId91": "be47e508-e35b-4c63-979b-a75b72102344", + "analyticRuleId91": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'be47e508-e35b-4c63-979b-a75b72102344')]", + "analyticRuleTemplateSpecName91": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('be47e508-e35b-4c63-979b-a75b72102344')))]", + "_analyticRulecontentProductId91": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','be47e508-e35b-4c63-979b-a75b72102344','-', '1.0.1')))]" + }, + "analyticRuleObject92": { + "analyticRuleVersion92": "1.0.1", + "_analyticRulecontentId92": "1c23715c-3a28-4b98-b135-fece6e7dcb8b", + "analyticRuleId92": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1c23715c-3a28-4b98-b135-fece6e7dcb8b')]", + "analyticRuleTemplateSpecName92": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1c23715c-3a28-4b98-b135-fece6e7dcb8b')))]", + "_analyticRulecontentProductId92": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1c23715c-3a28-4b98-b135-fece6e7dcb8b','-', '1.0.1')))]" + }, + "analyticRuleObject93": { + "analyticRuleVersion93": "1.0.1", + "_analyticRulecontentId93": "e1d0d9ce-b7c9-4e28-883d-04429f80d6d7", + "analyticRuleId93": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e1d0d9ce-b7c9-4e28-883d-04429f80d6d7')]", + "analyticRuleTemplateSpecName93": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e1d0d9ce-b7c9-4e28-883d-04429f80d6d7')))]", + "_analyticRulecontentProductId93": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e1d0d9ce-b7c9-4e28-883d-04429f80d6d7','-', '1.0.1')))]" + }, + "analyticRuleObject94": { + "analyticRuleVersion94": "1.0.1", + "_analyticRulecontentId94": "b7409bbb-6f0c-43c4-bb63-b20add5eb717", + "analyticRuleId94": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b7409bbb-6f0c-43c4-bb63-b20add5eb717')]", + "analyticRuleTemplateSpecName94": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b7409bbb-6f0c-43c4-bb63-b20add5eb717')))]", + "_analyticRulecontentProductId94": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b7409bbb-6f0c-43c4-bb63-b20add5eb717','-', '1.0.1')))]" + }, + "analyticRuleObject95": { + "analyticRuleVersion95": "1.0.1", + "_analyticRulecontentId95": "06ba509c-606e-4967-baee-21815ae61f8e", + "analyticRuleId95": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '06ba509c-606e-4967-baee-21815ae61f8e')]", + "analyticRuleTemplateSpecName95": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('06ba509c-606e-4967-baee-21815ae61f8e')))]", + "_analyticRulecontentProductId95": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','06ba509c-606e-4967-baee-21815ae61f8e','-', '1.0.1')))]" + }, + "analyticRuleObject96": { + "analyticRuleVersion96": "1.0.1", + "_analyticRulecontentId96": "ecf98b4a-3986-4739-879d-dd446e839153", + "analyticRuleId96": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ecf98b4a-3986-4739-879d-dd446e839153')]", + "analyticRuleTemplateSpecName96": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ecf98b4a-3986-4739-879d-dd446e839153')))]", + "_analyticRulecontentProductId96": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ecf98b4a-3986-4739-879d-dd446e839153','-', '1.0.1')))]" + }, + "analyticRuleObject97": { + "analyticRuleVersion97": "1.0.1", + "_analyticRulecontentId97": "ceb625a3-a8d7-4a42-9ea1-40f01c337ecd", + "analyticRuleId97": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ceb625a3-a8d7-4a42-9ea1-40f01c337ecd')]", + "analyticRuleTemplateSpecName97": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ceb625a3-a8d7-4a42-9ea1-40f01c337ecd')))]", + "_analyticRulecontentProductId97": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ceb625a3-a8d7-4a42-9ea1-40f01c337ecd','-', '1.0.1')))]" + }, + "analyticRuleObject98": { + "analyticRuleVersion98": "1.0.1", + "_analyticRulecontentId98": "19ed623e-1b1c-45e0-ac74-c1e629fbf117", + "analyticRuleId98": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '19ed623e-1b1c-45e0-ac74-c1e629fbf117')]", + "analyticRuleTemplateSpecName98": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('19ed623e-1b1c-45e0-ac74-c1e629fbf117')))]", + "_analyticRulecontentProductId98": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','19ed623e-1b1c-45e0-ac74-c1e629fbf117','-', '1.0.1')))]" + }, + "analyticRuleObject99": { + "analyticRuleVersion99": "1.0.1", + "_analyticRulecontentId99": "d92b2d65-1037-41e2-8d04-c18b8403d895", + "analyticRuleId99": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd92b2d65-1037-41e2-8d04-c18b8403d895')]", + "analyticRuleTemplateSpecName99": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d92b2d65-1037-41e2-8d04-c18b8403d895')))]", + "_analyticRulecontentProductId99": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d92b2d65-1037-41e2-8d04-c18b8403d895','-', '1.0.1')))]" + }, + "analyticRuleObject100": { + "analyticRuleVersion100": "1.0.1", + "_analyticRulecontentId100": "fda79d00-9e6a-46f8-b7a2-2bdccd5f598e", + "analyticRuleId100": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'fda79d00-9e6a-46f8-b7a2-2bdccd5f598e')]", + "analyticRuleTemplateSpecName100": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('fda79d00-9e6a-46f8-b7a2-2bdccd5f598e')))]", + "_analyticRulecontentProductId100": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fda79d00-9e6a-46f8-b7a2-2bdccd5f598e','-', '1.0.1')))]" + }, + "analyticRuleObject101": { + "analyticRuleVersion101": "1.0.1", + "_analyticRulecontentId101": "afec0070-2b46-4366-a272-e2d9cc8a50f2", + "analyticRuleId101": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'afec0070-2b46-4366-a272-e2d9cc8a50f2')]", + "analyticRuleTemplateSpecName101": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('afec0070-2b46-4366-a272-e2d9cc8a50f2')))]", + "_analyticRulecontentProductId101": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','afec0070-2b46-4366-a272-e2d9cc8a50f2','-', '1.0.1')))]" + }, + "analyticRuleObject102": { + "analyticRuleVersion102": "1.0.1", + "_analyticRulecontentId102": "da25b390-b97a-4ea4-abe3-5bbd7f90642c", + "analyticRuleId102": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'da25b390-b97a-4ea4-abe3-5bbd7f90642c')]", + "analyticRuleTemplateSpecName102": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('da25b390-b97a-4ea4-abe3-5bbd7f90642c')))]", + "_analyticRulecontentProductId102": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','da25b390-b97a-4ea4-abe3-5bbd7f90642c','-', '1.0.1')))]" + }, + "analyticRuleObject103": { + "analyticRuleVersion103": "1.0.1", + "_analyticRulecontentId103": "16183d97-c348-4f72-a943-27e80c9dfbd5", + "analyticRuleId103": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '16183d97-c348-4f72-a943-27e80c9dfbd5')]", + "analyticRuleTemplateSpecName103": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('16183d97-c348-4f72-a943-27e80c9dfbd5')))]", + "_analyticRulecontentProductId103": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','16183d97-c348-4f72-a943-27e80c9dfbd5','-', '1.0.1')))]" + }, + "analyticRuleObject104": { + "analyticRuleVersion104": "1.0.1", + "_analyticRulecontentId104": "c4d891cd-4b22-419c-8f40-7603eb1cc3a3", + "analyticRuleId104": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c4d891cd-4b22-419c-8f40-7603eb1cc3a3')]", + "analyticRuleTemplateSpecName104": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c4d891cd-4b22-419c-8f40-7603eb1cc3a3')))]", + "_analyticRulecontentProductId104": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c4d891cd-4b22-419c-8f40-7603eb1cc3a3','-', '1.0.1')))]" + }, + "analyticRuleObject105": { + "analyticRuleVersion105": "1.0.1", + "_analyticRulecontentId105": "ef029652-d004-44e9-a70a-48dd71818aaa", + "analyticRuleId105": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ef029652-d004-44e9-a70a-48dd71818aaa')]", + "analyticRuleTemplateSpecName105": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ef029652-d004-44e9-a70a-48dd71818aaa')))]", + "_analyticRulecontentProductId105": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ef029652-d004-44e9-a70a-48dd71818aaa','-', '1.0.1')))]" + }, + "analyticRuleObject106": { + "analyticRuleVersion106": "1.0.1", + "_analyticRulecontentId106": "71711b77-486c-41d0-9de0-dcc411fa7b05", + "analyticRuleId106": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '71711b77-486c-41d0-9de0-dcc411fa7b05')]", + "analyticRuleTemplateSpecName106": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('71711b77-486c-41d0-9de0-dcc411fa7b05')))]", + "_analyticRulecontentProductId106": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','71711b77-486c-41d0-9de0-dcc411fa7b05','-', '1.0.1')))]" + }, + "analyticRuleObject107": { + "analyticRuleVersion107": "1.0.1", + "_analyticRulecontentId107": "25111c10-44b5-4275-996d-d62f15a7d072", + "analyticRuleId107": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '25111c10-44b5-4275-996d-d62f15a7d072')]", + "analyticRuleTemplateSpecName107": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('25111c10-44b5-4275-996d-d62f15a7d072')))]", + "_analyticRulecontentProductId107": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','25111c10-44b5-4275-996d-d62f15a7d072','-', '1.0.1')))]" + }, + "analyticRuleObject108": { + "analyticRuleVersion108": "1.0.1", + "_analyticRulecontentId108": "d297961f-f8a3-4f84-865d-ec3a07641699", + "analyticRuleId108": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd297961f-f8a3-4f84-865d-ec3a07641699')]", + "analyticRuleTemplateSpecName108": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d297961f-f8a3-4f84-865d-ec3a07641699')))]", + "_analyticRulecontentProductId108": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d297961f-f8a3-4f84-865d-ec3a07641699','-', '1.0.1')))]" + }, + "analyticRuleObject109": { + "analyticRuleVersion109": "1.0.1", + "_analyticRulecontentId109": "f920ac64-dfd0-4dea-9b7c-acecf1ea2b28", + "analyticRuleId109": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f920ac64-dfd0-4dea-9b7c-acecf1ea2b28')]", + "analyticRuleTemplateSpecName109": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f920ac64-dfd0-4dea-9b7c-acecf1ea2b28')))]", + "_analyticRulecontentProductId109": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f920ac64-dfd0-4dea-9b7c-acecf1ea2b28','-', '1.0.1')))]" + }, + "analyticRuleObject110": { + "analyticRuleVersion110": "1.0.1", + "_analyticRulecontentId110": "73e36985-d65d-4852-b3cc-5e8f4b64b39c", + "analyticRuleId110": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '73e36985-d65d-4852-b3cc-5e8f4b64b39c')]", + "analyticRuleTemplateSpecName110": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('73e36985-d65d-4852-b3cc-5e8f4b64b39c')))]", + "_analyticRulecontentProductId110": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','73e36985-d65d-4852-b3cc-5e8f4b64b39c','-', '1.0.1')))]" + }, + "analyticRuleObject111": { + "analyticRuleVersion111": "1.0.1", + "_analyticRulecontentId111": "7fb6d1b6-48e4-442b-ba4d-1b5fb5fa379b", + "analyticRuleId111": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7fb6d1b6-48e4-442b-ba4d-1b5fb5fa379b')]", + "analyticRuleTemplateSpecName111": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7fb6d1b6-48e4-442b-ba4d-1b5fb5fa379b')))]", + "_analyticRulecontentProductId111": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7fb6d1b6-48e4-442b-ba4d-1b5fb5fa379b','-', '1.0.1')))]" + }, + "analyticRuleObject112": { + "analyticRuleVersion112": "1.0.1", + "_analyticRulecontentId112": "7ad4b9ff-8089-4b70-b98e-a2ca995611e9", + "analyticRuleId112": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7ad4b9ff-8089-4b70-b98e-a2ca995611e9')]", + "analyticRuleTemplateSpecName112": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7ad4b9ff-8089-4b70-b98e-a2ca995611e9')))]", + "_analyticRulecontentProductId112": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7ad4b9ff-8089-4b70-b98e-a2ca995611e9','-', '1.0.1')))]" + }, + "analyticRuleObject113": { + "analyticRuleVersion113": "1.0.1", + "_analyticRulecontentId113": "c0ead324-d8e8-484d-b590-9639f5ac5d93", + "analyticRuleId113": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c0ead324-d8e8-484d-b590-9639f5ac5d93')]", + "analyticRuleTemplateSpecName113": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c0ead324-d8e8-484d-b590-9639f5ac5d93')))]", + "_analyticRulecontentProductId113": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c0ead324-d8e8-484d-b590-9639f5ac5d93','-', '1.0.1')))]" + }, + "analyticRuleObject114": { + "analyticRuleVersion114": "1.0.1", + "_analyticRulecontentId114": "21ef1e12-75ac-43be-a77e-d2cee4c69225", + "analyticRuleId114": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '21ef1e12-75ac-43be-a77e-d2cee4c69225')]", + "analyticRuleTemplateSpecName114": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('21ef1e12-75ac-43be-a77e-d2cee4c69225')))]", + "_analyticRulecontentProductId114": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','21ef1e12-75ac-43be-a77e-d2cee4c69225','-', '1.0.1')))]" + }, + "analyticRuleObject115": { + "analyticRuleVersion115": "1.0.1", + "_analyticRulecontentId115": "b5785a66-3722-4bdc-9d12-bb40f2cf4824", + "analyticRuleId115": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b5785a66-3722-4bdc-9d12-bb40f2cf4824')]", + "analyticRuleTemplateSpecName115": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b5785a66-3722-4bdc-9d12-bb40f2cf4824')))]", + "_analyticRulecontentProductId115": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b5785a66-3722-4bdc-9d12-bb40f2cf4824','-', '1.0.1')))]" + }, + "analyticRuleObject116": { + "analyticRuleVersion116": "1.0.1", + "_analyticRulecontentId116": "176abf3c-392a-47bd-b565-a4ecfd0ff7ec", + "analyticRuleId116": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '176abf3c-392a-47bd-b565-a4ecfd0ff7ec')]", + "analyticRuleTemplateSpecName116": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('176abf3c-392a-47bd-b565-a4ecfd0ff7ec')))]", + "_analyticRulecontentProductId116": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','176abf3c-392a-47bd-b565-a4ecfd0ff7ec','-', '1.0.1')))]" + }, + "analyticRuleObject117": { + "analyticRuleVersion117": "1.0.1", + "_analyticRulecontentId117": "1a9e31d6-2116-4ff1-8ee7-abc957c34350", + "analyticRuleId117": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1a9e31d6-2116-4ff1-8ee7-abc957c34350')]", + "analyticRuleTemplateSpecName117": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1a9e31d6-2116-4ff1-8ee7-abc957c34350')))]", + "_analyticRulecontentProductId117": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1a9e31d6-2116-4ff1-8ee7-abc957c34350','-', '1.0.1')))]" + }, + "analyticRuleObject118": { + "analyticRuleVersion118": "1.0.1", + "_analyticRulecontentId118": "d48f9671-adc0-45e5-a477-670ef38bc132", + "analyticRuleId118": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd48f9671-adc0-45e5-a477-670ef38bc132')]", + "analyticRuleTemplateSpecName118": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d48f9671-adc0-45e5-a477-670ef38bc132')))]", + "_analyticRulecontentProductId118": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d48f9671-adc0-45e5-a477-670ef38bc132','-', '1.0.1')))]" + }, + "analyticRuleObject119": { + "analyticRuleVersion119": "1.0.1", + "_analyticRulecontentId119": "37d97c4d-a42f-495b-a523-376416b278b5", + "analyticRuleId119": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '37d97c4d-a42f-495b-a523-376416b278b5')]", + "analyticRuleTemplateSpecName119": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('37d97c4d-a42f-495b-a523-376416b278b5')))]", + "_analyticRulecontentProductId119": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','37d97c4d-a42f-495b-a523-376416b278b5','-', '1.0.1')))]" + }, + "analyticRuleObject120": { + "analyticRuleVersion120": "1.0.1", + "_analyticRulecontentId120": "8bb38c66-ca2a-4ad0-9b49-1e60368f8a19", + "analyticRuleId120": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '8bb38c66-ca2a-4ad0-9b49-1e60368f8a19')]", + "analyticRuleTemplateSpecName120": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('8bb38c66-ca2a-4ad0-9b49-1e60368f8a19')))]", + "_analyticRulecontentProductId120": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8bb38c66-ca2a-4ad0-9b49-1e60368f8a19','-', '1.0.1')))]" + }, + "analyticRuleObject121": { + "analyticRuleVersion121": "1.0.1", + "_analyticRulecontentId121": "cab7396a-9a18-45e7-b685-945e8bf825cb", + "analyticRuleId121": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'cab7396a-9a18-45e7-b685-945e8bf825cb')]", + "analyticRuleTemplateSpecName121": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('cab7396a-9a18-45e7-b685-945e8bf825cb')))]", + "_analyticRulecontentProductId121": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cab7396a-9a18-45e7-b685-945e8bf825cb','-', '1.0.1')))]" + }, + "analyticRuleObject122": { + "analyticRuleVersion122": "1.0.1", + "_analyticRulecontentId122": "04530ba4-b26e-4a83-8057-a4fc286de848", + "analyticRuleId122": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '04530ba4-b26e-4a83-8057-a4fc286de848')]", + "analyticRuleTemplateSpecName122": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('04530ba4-b26e-4a83-8057-a4fc286de848')))]", + "_analyticRulecontentProductId122": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','04530ba4-b26e-4a83-8057-a4fc286de848','-', '1.0.1')))]" + }, + "analyticRuleObject123": { + "analyticRuleVersion123": "1.0.1", + "_analyticRulecontentId123": "2a860019-0eda-4b49-bc62-8f683aed4929", + "analyticRuleId123": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2a860019-0eda-4b49-bc62-8f683aed4929')]", + "analyticRuleTemplateSpecName123": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2a860019-0eda-4b49-bc62-8f683aed4929')))]", + "_analyticRulecontentProductId123": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2a860019-0eda-4b49-bc62-8f683aed4929','-', '1.0.1')))]" + }, + "analyticRuleObject124": { + "analyticRuleVersion124": "1.0.1", + "_analyticRulecontentId124": "ae880194-5766-46d3-a17b-c8c53e9ca96c", + "analyticRuleId124": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ae880194-5766-46d3-a17b-c8c53e9ca96c')]", + "analyticRuleTemplateSpecName124": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ae880194-5766-46d3-a17b-c8c53e9ca96c')))]", + "_analyticRulecontentProductId124": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ae880194-5766-46d3-a17b-c8c53e9ca96c','-', '1.0.1')))]" + }, + "analyticRuleObject125": { + "analyticRuleVersion125": "1.0.1", + "_analyticRulecontentId125": "0e76e420-fa55-4718-adc6-40a1a76411af", + "analyticRuleId125": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '0e76e420-fa55-4718-adc6-40a1a76411af')]", + "analyticRuleTemplateSpecName125": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('0e76e420-fa55-4718-adc6-40a1a76411af')))]", + "_analyticRulecontentProductId125": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','0e76e420-fa55-4718-adc6-40a1a76411af','-', '1.0.1')))]" + }, + "analyticRuleObject126": { + "analyticRuleVersion126": "1.0.1", + "_analyticRulecontentId126": "6117e317-4b90-4bcc-a71f-0c1f29d82ce3", + "analyticRuleId126": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6117e317-4b90-4bcc-a71f-0c1f29d82ce3')]", + "analyticRuleTemplateSpecName126": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6117e317-4b90-4bcc-a71f-0c1f29d82ce3')))]", + "_analyticRulecontentProductId126": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6117e317-4b90-4bcc-a71f-0c1f29d82ce3','-', '1.0.1')))]" + }, + "analyticRuleObject127": { + "analyticRuleVersion127": "1.0.1", + "_analyticRulecontentId127": "128ea2a4-1047-4f28-ad55-b1b88357d172", + "analyticRuleId127": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '128ea2a4-1047-4f28-ad55-b1b88357d172')]", + "analyticRuleTemplateSpecName127": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('128ea2a4-1047-4f28-ad55-b1b88357d172')))]", + "_analyticRulecontentProductId127": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','128ea2a4-1047-4f28-ad55-b1b88357d172','-', '1.0.1')))]" + }, + "analyticRuleObject128": { + "analyticRuleVersion128": "1.0.1", + "_analyticRulecontentId128": "384e92a7-103c-4a47-945d-381ae9653f91", + "analyticRuleId128": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '384e92a7-103c-4a47-945d-381ae9653f91')]", + "analyticRuleTemplateSpecName128": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('384e92a7-103c-4a47-945d-381ae9653f91')))]", + "_analyticRulecontentProductId128": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','384e92a7-103c-4a47-945d-381ae9653f91','-', '1.0.1')))]" + }, + "analyticRuleObject129": { + "analyticRuleVersion129": "1.0.1", + "_analyticRulecontentId129": "a21eccd5-0148-4f88-a5d7-a8f86e9e4d8e", + "analyticRuleId129": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a21eccd5-0148-4f88-a5d7-a8f86e9e4d8e')]", + "analyticRuleTemplateSpecName129": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a21eccd5-0148-4f88-a5d7-a8f86e9e4d8e')))]", + "_analyticRulecontentProductId129": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a21eccd5-0148-4f88-a5d7-a8f86e9e4d8e','-', '1.0.1')))]" + }, + "analyticRuleObject130": { + "analyticRuleVersion130": "1.0.1", + "_analyticRulecontentId130": "5b19f19b-d92c-486f-be98-ba2c5945e240", + "analyticRuleId130": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5b19f19b-d92c-486f-be98-ba2c5945e240')]", + "analyticRuleTemplateSpecName130": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5b19f19b-d92c-486f-be98-ba2c5945e240')))]", + "_analyticRulecontentProductId130": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5b19f19b-d92c-486f-be98-ba2c5945e240','-', '1.0.1')))]" + }, + "analyticRuleObject131": { + "analyticRuleVersion131": "1.0.1", + "_analyticRulecontentId131": "2e4fe360-ce67-433b-930e-42f83058dfd0", + "analyticRuleId131": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2e4fe360-ce67-433b-930e-42f83058dfd0')]", + "analyticRuleTemplateSpecName131": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2e4fe360-ce67-433b-930e-42f83058dfd0')))]", + "_analyticRulecontentProductId131": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2e4fe360-ce67-433b-930e-42f83058dfd0','-', '1.0.1')))]" + }, + "analyticRuleObject132": { + "analyticRuleVersion132": "1.0.2", + "_analyticRulecontentId132": "259ef474-836d-4662-86ef-70cb7a38e765", + "analyticRuleId132": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '259ef474-836d-4662-86ef-70cb7a38e765')]", + "analyticRuleTemplateSpecName132": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('259ef474-836d-4662-86ef-70cb7a38e765')))]", + "_analyticRulecontentProductId132": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','259ef474-836d-4662-86ef-70cb7a38e765','-', '1.0.2')))]" + }, "workbookVersion1": "1.0.1", "workbookContentId1": "VeeamDataPlatformMonitoringWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", @@ -697,565 +1669,331 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName1')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition2'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-ChangeCollectionTime Playbook with template version 3.0.3", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition2')]", + "displayName": "Veeam Data Connector (via Codeless Connector Framework)", + "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion1')]", - "parameters": { - "PlaybookName": { - "type": "string", - "defaultValue": "Veeam-ChangeCollectionTime", - "metadata": { - "description": "Name of the playbook (Logic App) to be created" - } - }, - "workspaceId": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" - } - }, - "AzureSentinelConnectionName": { - "type": "string", - "defaultValue": "azuresentinel-connection", - "metadata": { - "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" - } - }, - "subscriptionId": { - "type": "string", - "defaultValue": "[subscription().subscriptionId]", - "metadata": { - "description": "Azure subscription ID" - } - }, - "resourceGroupName": { - "type": "string", - "defaultValue": "[resourceGroup().name]", - "metadata": { - "description": "Name of the resource group containing the Logic Apps to be updated" - } - }, - "environmentResourceManagerUrl": { - "type": "string", - "defaultValue": "[environment().resourceManager]", - "metadata": { - "description": "Resource Manager URL for the Azure environment" - } - }, - "logicAppsApiVersion": { - "type": "string", - "defaultValue": "2019-05-01", - "metadata": { - "description": "API version to use for Logic Apps operations" - } - }, - "watchlistName": { - "type": "string", - "defaultValue": "collection_schedule_settings", - "metadata": { - "description": "Name of the watchlist containing collection schedule settings" - } - }, - "defaultRecurrenceInterval": { - "type": "string", - "defaultValue": "12", - "metadata": { - "description": "Default recurrence interval to use when not specified in watchlist" - } - }, - "defaultRecurrenceFrequency": { - "type": "string", - "defaultValue": "Hour", - "metadata": { - "description": "Default recurrence frequency to use when not specified in watchlist" - } - } - }, - "variables": { - "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", - "_connection-1": "[[variables('connection-1')]", - "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", - "workspace-name": "[parameters('workspace')]", - "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" - }, + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, "resources": [ { - "type": "Microsoft.Web/connections", - "apiVersion": "2018-07-01-preview", - "name": "[[parameters('AzureSentinelConnectionName')]", - "location": "[[variables('workspace-location-inline')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition2'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", "properties": { - "displayName": "[[parameters('AzureSentinelConnectionName')]", - "api": { - "id": "[[variables('_connection-1')]" - }, - "parameterValueType": "Alternative" - } - }, - { - "type": "Microsoft.Logic/workflows", - "apiVersion": "2019-05-01", - "name": "[[parameters('PlaybookName')]", - "location": "[[variables('workspace-location-inline')]", - "identity": { - "type": "SystemAssigned" - }, - "tags": { - "hidden-SentinelTemplateName": "Veeam-ChangeCollectionTime", - "hidden-SentinelTemplateVersion": "1.0", - "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" - }, - "properties": { - "state": "Enabled", - "definition": { - "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "$connections": { - "type": "Object" + "connectorUiConfig": { + "id": "VeeamConnector", + "title": "Veeam Data Connector (via Codeless Connector Framework)", + "graphQueriesTableName": "VeeamMalwareEvents_CL", + "publisher": "Microsoft", + "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEvents_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzer_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEvents_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarms_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindings_CL**: Security findings from Coveware solution\n- **VeeamSessions_CL**: Veeam sessions", + "graphQueries": [ + { + "metricName": "Total malware logs received", + "legend": "Malware events", + "baseQuery": "VeeamMalwareEvents_CL" }, - "workspaceId": { - "defaultValue": "[[parameters('workspaceId')]", - "type": "String" + { + "metricName": "Critical malware events", + "legend": "Critical malware events", + "baseQuery": "VeeamMalwareEvents_CL\n| where Severity == \"Critical\"" }, - "resourceGroupName": { - "defaultValue": "[[parameters('resourceGroupName')]", - "type": "String" + { + "metricName": "Total security & compliance analyzer logs received", + "legend": "Security & Compliance Analyzer results", + "baseQuery": "VeeamSecurityComplianceAnalyzer_CL" }, - "subscriptionId": { - "defaultValue": "[[subscription().subscriptionId]", - "type": "String" + { + "metricName": "Total veeam ONE alarms logs received", + "legend": "Veeam ONE alarms", + "baseQuery": "VeeamOneTriggeredAlarms_CL" }, - "watchlistName": { - "defaultValue": "[[parameters('watchlistName')]", - "type": "String" + { + "metricName": "Total authorization events logs received", + "legend": "Authorization events", + "baseQuery": "VeeamAuthorizationEvents_CL" }, - "environmentResourceManagerUrl": { - "defaultValue": "[[parameters('environmentResourceManagerUrl')]", - "type": "String" + { + "metricName": "Total coveware findings logs received", + "legend": "Coveware findings", + "baseQuery": "VeeamCovewareFindings_CL" }, - "logicAppsApiVersion": { - "defaultValue": "[[parameters('logicAppsApiVersion')]", - "type": "String" + { + "metricName": "Total session logs received", + "legend": "Session logs", + "baseQuery": "VeeamSessions_CL" + } + ], + "sampleQueries": [ + { + "description": "Malware Events", + "query": "VeeamMalwareEvents_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Critical Malware Events", + "query": "VeeamMalwareEvents_CL\n | where Severity == \"Critical\"\n | sort by TimeGenerated desc" + }, + { + "description": "Security Compliance Results", + "query": "VeeamSecurityComplianceAnalyzer_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Veeam ONE Alarms", + "query": "VeeamOneTriggeredAlarms_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Authorization Events", + "query": "VeeamAuthorizationEvents_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Coveware Security Findings", + "query": "VeeamCovewareFindings_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Session events", + "query": "VeeamSessions_CL\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "VeeamMalwareEvents_CL", + "lastDataReceivedQuery": "VeeamMalwareEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamSecurityComplianceAnalyzer_CL", + "lastDataReceivedQuery": "VeeamSecurityComplianceAnalyzer_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamOneTriggeredAlarms_CL", + "lastDataReceivedQuery": "VeeamOneTriggeredAlarms_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamAuthorizationEvents_CL", + "lastDataReceivedQuery": "VeeamAuthorizationEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamCovewareFindings_CL", + "lastDataReceivedQuery": "VeeamCovewareFindings_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamSessions_CL", + "lastDataReceivedQuery": "VeeamSessions_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" } + ], + "availability": { + "isPreview": true, + "status": 1 }, - "triggers": { - "manual": { - "type": "Request", - "kind": "Http", - "inputs": { - "schema": { - "type": "object", - "properties": { - "recurrenceInterval": { - "default": "[[parameters('defaultRecurrenceInterval')]" - }, - "recurrenceFrequency": { - "default": "[[parameters('defaultRecurrenceFrequency')]" - } - } + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true, + "action": false + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "read": true } } - } + ], + "customs": [ + { + "name": "Veeam Data Access", + "description": "Access to Veeam systems is required to collect security and operational data. The connector supports data ingestion from Veeam Backup & Replication, Veeam ONE, and Coveware platforms." + } + ] }, - "actions": { - "Watchlists_-_Get_all_Collection_Times": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" + "instructionSteps": [ + { + "title": "", + "description": "Follow the instructions to configure the Veeam Data Connector.", + "instructions": [ + { + "type": "InfoMessage", + "parameters": { + "text": "**Note:** This data connector depends on parsers based on Kusto Functions to work as expected. These parsers are installed with the Microsoft Sentinel Solution for Veeam." + } + } + ] + }, + { + "title": "1. Configuration steps for Veeam Data Connector", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "1. Configure your Veeam systems to export security and operational data.\n2. Set up data collection endpoints to ingest data into the custom Log Analytics tables.\n3. Ensure proper permissions are configured for data access.\n4. Verify connectivity and data flow to Microsoft Sentinel." + } + } + ] + }, + { + "title": "2. Coveware API Configuration", + "description": "Configure Coveware API credentials for security findings data collection.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### 2.1 Obtain Coveware API Credentials\n1. Log in to your Coveware management console\n2. Navigate to API settings or integrations section\n3. Create or configure an API application\n4. Generate or obtain a Bearer token for API access\n5. Note your Coveware API base URL" } }, - "method": "get", - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent(parameters('watchlistName'))}/watchlistItems" - } + { + "type": "Textbox", + "parameters": { + "label": "Coveware API URL", + "placeholder": "https://api.coveware.com", + "type": "text", + "name": "covewareApiUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Coveware Bearer Token", + "placeholder": "Your Coveware API Bearer Token", + "type": "password", + "name": "covewareBearerToken", + "validations": { + "required": true + } + } + } + ] }, - "Parse_settings": { - "type": "ParseJson", - "inputs": { - "content": "@body('Watchlists_-_Get_all_Collection_Times')", - "schema": { - "type": "object", - "properties": { - "properties": { - "type": "object", - "properties": { - "watchlistItems": { - "type": "array" - } - } + { + "title": "3. Veeam API Configuration", + "description": "Configure Veeam API credentials for all Veeam services (Malware Events, Security Analyzer, and Authorization Events).", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### 3.1 Obtain Veeam API Access Token\n1. Access your Veeam Backup & Replication management console\n2. Navigate to the REST API settings or authentication section\n3. Generate or obtain a Bearer token for API access\n4. Ensure the token has appropriate permissions for:\n - Malware Detection API (v1.3-rev1)\n - Security & Compliance Analyzer API (v1.3-rev1)\n - Authorization Events API (v1.3-rev1)\n - Sessions API (v1.3-rev1)\n5. Note the API base URL (typically https://your-veeam-server.com:9419)\n6. This token will be used for both on-premises and CDN-hosted APIs" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam API URL", + "placeholder": "https://your-veeam-server.com:9419", + "type": "text", + "name": "veeamApiUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Bearer Token", + "placeholder": "Your Veeam API Bearer Token", + "type": "password", + "name": "veeamBearerToken", + "validations": { + "required": true } } } - }, - "runAfter": { - "Watchlists_-_Get_all_Collection_Times": [ - "Succeeded" - ] - } + ] }, - "For_each": { - "type": "Foreach", - "foreach": "@body('Parse_settings')?['properties']?['watchlistItems']", - "actions": { - "Parse_setting": { - "type": "ParseJson", - "inputs": { - "content": "@items('For_each')", - "schema": { - "type": "object", - "properties": { - "properties.watchlistItemType": { - "type": "string" - }, - "properties.watchlistItemId": { - "type": "string" - }, - "properties.tenantId": { - "type": "string" - }, - "properties.isDeleted": { - "type": "boolean" - }, - "properties.created": { - "type": "string" - }, - "properties.updated": { - "type": "string" - }, - "properties.createdBy": { - "type": "object", - "properties": { - "email": { - "type": "string" - }, - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } - }, - "properties.updatedBy": { - "type": "object", - "properties": { - "email": { - "type": "string" - }, - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } - }, - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "CollectionPlaybookName": { - "type": "string" - }, - "RecurrenceInterval": { - "type": "string" - }, - "TimeUnit": { - "type": "string" - } - } - }, - "properties.entityMapping": { - "type": "object" - }, - "etag": { - "type": "string" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "type": "string" - }, - "systemData": { - "type": "object", - "properties": { - "createdBy": { - "type": "string" - }, - "createdByType": { - "type": "string" - }, - "createdAt": { - "type": "string" - }, - "lastModifiedBy": { - "type": "string" - }, - "lastModifiedByType": { - "type": "string" - }, - "lastModifiedAt": { - "type": "string" - } - } - } - } - } - } - }, - "Get_Current_Workflow_Definition": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('environmentResourceManagerUrl'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Logic/workflows/', body('Parse_setting')?['properties.itemsKeyValue']?['CollectionPlaybookName'], '?api-version=', parameters('logicAppsApiVersion'))", - "method": "GET", - "authentication": { - "type": "ManagedServiceIdentity" - } - }, - "runAfter": { - "Parse_setting": [ - "Succeeded" - ] - } - }, - "Parse_Workflow_Definition": { - "type": "ParseJson", - "inputs": { - "content": "@body('Get_Current_Workflow_Definition')", - "schema": { - "type": "object", - "properties": { - "properties": { - "type": "object", - "properties": { - "provisioningState": { - "type": "string" - }, - "createdTime": { - "type": "string" - }, - "changedTime": { - "type": "string" - }, - "state": { - "type": "string" - }, - "version": { - "type": "string" - }, - "accessEndpoint": { - "type": "string" - }, - "definition": { - "type": "object", - "properties": { - "$schema": { - "type": "string" - }, - "contentVersion": { - "type": "string" - }, - "parameters": { - "type": "object" - }, - "triggers": { - "type": "object" - }, - "actions": { - "type": "object" - }, - "outputs": { - "type": "object" - } - } - }, - "parameters": { - "type": "object" - }, - "endpointsConfiguration": { - "type": "object" - } - } - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "type": "string" - }, - "location": { - "type": "string" - }, - "tags": { - "type": "object" - }, - "identity": { - "type": "object", - "properties": { - "type": { - "type": "string" - }, - "principalId": { - "type": "string" - }, - "tenantId": { - "type": "string" - } - } - } - } - } - }, - "runAfter": { - "Get_Current_Workflow_Definition": [ - "Succeeded" - ] + { + "title": "4. Veeam ONE API Configuration", + "description": "Configure Veeam ONE API credentials for triggered alarms data collection.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### 4.1 Obtain Veeam ONE API Access Key\n1. Access your Veeam ONE management console\n2. Navigate to Administration -> Users and Roles\n3. Create or use an existing user with API access permissions\n4. Generate or obtain a Bearer token for API access\n5. Note the Veeam ONE server URL and port (typically https://your-veeam-one-server:1239)" } }, - "Compose_Updated_Definition": { - "type": "Compose", - "inputs": { - "location": "@body('Parse_Workflow_Definition')?['location']", - "identity": "@body('Parse_Workflow_Definition')?['identity']", - "properties": { - "state": "Enabled", - "definition": { - "$schema": "@body('Parse_Workflow_Definition')?['properties']?['definition']?['$schema']", - "contentVersion": "@body('Parse_Workflow_Definition')?['properties']?['definition']?['contentVersion']", - "parameters": "@body('Parse_Workflow_Definition')?['properties']?['definition']?['parameters']", - "triggers": { - "Every_@{int(coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['RecurrenceInterval'], '12'))}_@{coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['TimeUnit'], 'Hour')}": { - "recurrence": { - "interval": "@int(coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['RecurrenceInterval'], '12'))", - "frequency": "@coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['TimeUnit'], 'Hour')" - }, - "evaluatedRecurrence": { - "interval": "@int(coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['RecurrenceInterval'], '12'))", - "frequency": "@coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['TimeUnit'], 'Hour')" - }, - "type": "Recurrence" - } - }, - "actions": "@body('Parse_Workflow_Definition')?['properties']?['definition']?['actions']", - "outputs": "@body('Parse_Workflow_Definition')?['properties']?['definition']?['outputs']" - }, - "parameters": "@body('Parse_Workflow_Definition')?['properties']?['parameters']" + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE API URL", + "placeholder": "https://your-veeam-one-server:1239", + "type": "text", + "name": "veeamOneApiUrl", + "validations": { + "required": true } - }, - "runAfter": { - "Parse_Workflow_Definition": [ - "Succeeded" - ] } }, - "Update_Events_Workflow": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('environmentResourceManagerUrl'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Logic/workflows/', body('Parse_setting')?['properties.itemsKeyValue']?['CollectionPlaybookName'], '?api-version=', parameters('logicAppsApiVersion'))", - "method": "PUT", - "headers": { - "Content-Type": "application/json" - }, - "body": "@outputs('Compose_Updated_Definition')", - "authentication": { - "type": "ManagedServiceIdentity" + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE API Bearer Token", + "placeholder": "Your Veeam ONE API Bearer Token", + "type": "password", + "name": "veeamOneBearerToken", + "validations": { + "required": true } - }, - "runAfter": { - "Compose_Updated_Definition": [ - "Succeeded" - ] } } - }, - "runAfter": { - "Parse_settings": [ - "Succeeded" - ] - } + ] }, - "Response_Success": { - "type": "Response", - "inputs": { - "statusCode": 200, - "body": { - "message": "Successfully updated collection schedule", - "processedWorkflows": "@length(body('Parse_settings')?['properties']?['watchlistItems'])" + { + "title": "5. Connect", + "description": "Enable the Veeam Data Connector.", + "instructions": [ + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "disconnectLabel": "Disconnect", + "name": "toggle" + } } - }, - "runAfter": { - "For_each": [ - "Succeeded" - ] - } - }, - "Response_Error": { - "type": "Response", - "inputs": { - "statusCode": 500, - "body": { - "message": "Failed to update collection schedule", - "error": "@actions('For_each')?['error']" - } - }, - "runAfter": { - "For_each": [ - "Failed" - ] - } - } - } - }, - "parameters": { - "$connections": { - "value": { - "azuresentinel": { - "connectionName": "[[parameters('AzureSentinelConnectionName')]", - "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", - "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", - "connectionProperties": { - "authentication": { - "type": "ManagedServiceIdentity" - } - } - } + ] } - } + ], + "isConnectivityCriteriasMatchSome": false } - }, - "dependsOn": [ - "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" - ] + } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition2')))]", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId1'),'/'))))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { - "parentId": "[variables('playbookId1')]", - "contentId": "[variables('_playbookContentId1')]", - "kind": "Playbook", - "version": "[variables('playbookVersion1')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition2'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" }, "author": { "name": "Veeam Software", @@ -1266,1257 +2004,1823 @@ "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" - } - } - } - ], - "metadata": { - "_generator": { - "name": "bicep", - "version": "0.36.177.2456", - "templateHash": "5498632779764501884" - }, - "title": "Veeam-ChangeCollectionTime", - "description": "This Microsoft Sentinel playbook adjusts the recurrence intervals for Veeam collection playbooks based on settings in the collection_schedule_settings watchlist.", - "prerequisites": [ - "1. Microsoft Sentinel workspace configured.", - "2. Permissions to create Logic Apps and API Connections.", - "3. Permissions to assign roles to the Resource Group and Log Analytics workspace.", - "4. Collection schedule settings watchlist configured in Microsoft Sentinel.", - "5. Logic App Contributor permissions for managing other workflows." - ], - "tags": [ - "Automation", - "Veeam", - "Schedule", - "Collection", - "Configuration" - ], - "lastUpdateTime": "2025-08-20T00:00:01Z", - "parameterTemplateVersion": "1.0.0", - "postDeployment": [ - "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", - "2. Assign the Logic App Contributor role to the Logic App's managed identity on the Resource Group.", - "3. Configure the collection_schedule_settings watchlist with required schedule data." - ], - "releaseNotes": { - "version": "1.0", - "title": "[variables('blanks')]", - "notes": [ - "Initial version" - ] - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId1')]", - "contentKind": "Playbook", - "displayName": "Veeam-ChangeCollectionTime", - "contentProductId": "[variables('_playbookcontentProductId1')]", - "id": "[variables('_playbookcontentProductId1')]", - "version": "[variables('playbookVersion1')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName2')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam-CollectVeeamAuthorizationEvents Playbook with template version 3.0.3", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion2')]", - "parameters": { - "PlaybookName": { - "defaultValue": "Veeam-CollectVeeamAuthorizationEvents", - "type": "string", - "metadata": { - "description": "Name of the playbook (Logic App) to be created" - } - }, - "functionAppName": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Name of the Azure Function App for Veeam integration" - } - }, - "workspaceId": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" - } - }, - "AzureSentinelConnectionName": { - "defaultValue": "azuresentinel-connection", - "type": "string", - "metadata": { - "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" - } - }, - "resourceGroupName": { - "defaultValue": "[resourceGroup().name]", - "type": "string", - "metadata": { - "description": "Name of the resource group containing the Microsoft Sentinel workspace" - } - } - }, - "variables": { - "functionAppId": "[[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]", - "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", - "_connection-1": "[[variables('connection-1')]", - "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", - "workspace-name": "[parameters('workspace')]", - "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" - }, - "resources": [ - { - "type": "Microsoft.Web/connections", - "apiVersion": "2016-06-01", - "name": "[[parameters('AzureSentinelConnectionName')]", - "location": "[[variables('workspace-location-inline')]", - "properties": { - "displayName": "[[parameters('AzureSentinelConnectionName')]", - "api": { - "id": "[[variables('_connection-1')]" }, - "parameterValueType": "Alternative" + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections2')]", + "kind": "ResourcesDataConnector" + } + ] + } } }, { - "type": "Microsoft.Logic/workflows", - "apiVersion": "2017-07-01", - "name": "[[parameters('PlaybookName')]", - "location": "[[variables('workspace-location-inline')]", - "identity": { - "type": "SystemAssigned" - }, - "tags": { - "hidden-SentinelTemplateName": "Veeam-CollectVeeamAuthorizationEvents", - "hidden-SentinelTemplateVersion": "1.0", - "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" - }, - "dependsOn": [ - "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" - ], + "name": "VeeamBackupReplicationDCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", "properties": { - "state": "Enabled", - "definition": { - "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "$connections": { - "type": "Object" - }, - "functionAppName": { - "defaultValue": "[[parameters('functionAppName')]", - "type": "String" - }, - "workspaceId": { - "defaultValue": "[[parameters('workspaceId')]", - "type": "String" - }, - "resourceGroupName": { - "defaultValue": "[[parameters('resourceGroupName')]", - "type": "String" - }, - "subscriptionId": { - "defaultValue": "[[subscription().subscriptionId]", - "type": "String" - }, - "VbrHostName": { - "defaultValue": "vbr1", - "type": "String" - } - }, - "triggers": { - "Every_24_hours": { - "recurrence": { - "interval": 24, - "frequency": "Hour" + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId2')]", + "streamDeclarations": { + "Custom-VeeamCovewareFindings_CL": { + "columns": [ + { + "name": "covewareHostName", + "type": "string" }, - "evaluatedRecurrence": { - "interval": 24, - "frequency": "Hour" + { + "name": "artifact", + "type": "string" }, - "type": "Recurrence" - } - }, - "actions": { - "Watchlists_-_Get_VBR_Settings": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "get", - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItems" - } - }, - "Parse_VBR_settings": { - "runAfter": { - "Watchlists_-_Get_VBR_Settings": [ - "Succeeded" - ] + { + "name": "eventType", + "type": "string" }, - "type": "ParseJson", - "inputs": { - "content": "@body('Watchlists_-_Get_VBR_Settings')", - "schema": { - "type": "object", - "properties": { - "properties": { - "type": "object", - "properties": { - "watchlistItems": { - "type": "array", - "items": { - "type": "object", - "properties": { - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Authorization Events": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - } - } - } - } - } - } - } - } - } - } + { + "name": "techniqueId", + "type": "string" + }, + { + "name": "eventTime", + "type": "datetime" + }, + { + "name": "firstRunOrAccessed", + "type": "datetime" + }, + { + "name": "hostname", + "type": "string" + }, + { + "name": "eventActivity", + "type": "string" + }, + { + "name": "country", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "machineId", + "type": "string" + }, + { + "name": "riskLevel", + "type": "string" + }, + { + "name": "scanTime", + "type": "datetime" + }, + { + "name": "username", + "type": "string" + }, + { + "name": "fileHashes", + "type": "dynamic" } - }, - "For_each_VBR": { - "foreach": "@body('Parse_VBR_settings')?['properties']?['watchlistItems']", - "actions": { - "Parse_current_VBR": { - "type": "ParseJson", - "inputs": { - "content": "@items('For_each_VBR')", - "schema": { - "type": "object", - "properties": { - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Authorization Events": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - } - } - } - } - } - } - }, - "If_authorization_events_collection_is_enabled": { - "actions": { - "Collect_Authorization_Events_into_VeeamAuthorizationEventsTable_CL": { - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Veeam Server Name']" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetAllAuthorizationEventsAsync')]" - } - } - } - }, - "runAfter": { - "Parse_current_VBR": [ - "Succeeded" - ] - }, - "else": { - "actions": { - "Print_baseUrl": { - "type": "Compose", - "inputs": "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Base URL']" - } - } - }, - "expression": { - "and": [ - { - "equals": [ - "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Collect Authorization Events']", - "true" - ] - } - ] - }, - "type": "If" - } + ] + }, + "Custom-VeeamMalwareEvents_CL": { + "columns": [ + { + "name": "vbrHostName", + "type": "string" }, - "runAfter": { - "Parse_VBR_settings": [ - "Succeeded" - ] + { + "name": "type", + "type": "string" }, - "type": "Foreach" - } - } - }, - "parameters": { - "$connections": { - "value": { - "azuresentinel": { - "connectionName": "[[parameters('AzureSentinelConnectionName')]", - "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", - "id": "[[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/',variables('workspace-location-inline'),'/managedApis/azuresentinel')]", - "connectionProperties": { - "authentication": { - "type": "ManagedServiceIdentity" - } - } + { + "name": "state", + "type": "string" + }, + { + "name": "source", + "type": "string" + }, + { + "name": "severity", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "detectionTimeUtc", + "type": "datetime" + }, + { + "name": "details", + "type": "string" + }, + { + "name": "createdBy", + "type": "string" + }, + { + "name": "engine", + "type": "string" + }, + { + "name": "machine", + "type": "dynamic" } - } - } - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId2'),'/'))))]", - "properties": { - "parentId": "[variables('playbookId2')]", - "contentId": "[variables('_playbookContentId2')]", - "kind": "Playbook", - "version": "[variables('playbookVersion2')]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - } - ], - "metadata": { - "title": "Veeam-CollectVeeamAuthorizationEvents", - "description": "This Microsoft Sentinel playbook automatically collects Veeam authorization events Veeam Backup & Replication servers on schedule. The playbook gets Veeam Backup & Replication settings from watchlist and calls the GetAllAuthorizationEventsAsync function for each enabled server, ingesting the data into custom tables.", - "prerequisites": [ - "1. Microsoft Sentinel workspace configured.", - "2. Permissions to create Logic Apps and API Connections.", - "3. Permissions to assign roles to the Resource Group.", - "4. Veeam Azure Function App deployed and configured.", - "5. VBR Settings watchlist configured in Microsoft Sentinel.", - "6. Hybrid Connection and Key Vault secrets configured for each VBR Server." - ], - "tags": [ - "Automation", - "Veeam", - "Authorization", - "Collection" - ], - "lastUpdateTime": "2025-08-25T00:00:00Z", - "parameterTemplateVersion": "1.0.0", - "postDeployment": [ - "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", - "2. Ensure the VBR Settings watchlist is properly configured with the 'Collect Authorization Events' flag set to true on servers from which you want to collect data." - ], - "releaseNotes": { - "version": "1.0", - "title": "[variables('blanks')]", - "notes": [ - "Initial version" - ] - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId2')]", - "contentKind": "Playbook", - "displayName": "Veeam-CollectVeeamAuthorizationEvents", - "contentProductId": "[variables('_playbookcontentProductId2')]", - "id": "[variables('_playbookcontentProductId2')]", - "version": "[variables('playbookVersion2')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName3')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam-CollectSecurityComplianceAnalyzerResult Playbook with template version 3.0.3", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion3')]", - "parameters": { - "PlaybookName": { - "defaultValue": "Veeam-CollectSecurityComplianceAnalyzerResult", - "type": "string", - "metadata": { - "description": "Name of the playbook (Logic App) to be created" - } - }, - "functionAppName": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Name of the Azure Function App for Veeam integration" - } - }, - "workspaceId": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" - } - }, - "AzureSentinelConnectionName": { - "defaultValue": "azuresentinel-connection", - "type": "string", - "metadata": { - "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" - } - }, - "resourceGroupName": { - "defaultValue": "[resourceGroup().name]", - "type": "string", - "metadata": { - "description": "Name of the resource group containing the Microsoft Sentinel workspace" - } - } - }, - "variables": { - "functionAppId": "[[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]", - "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", - "_connection-1": "[[variables('connection-1')]", - "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", - "workspace-name": "[parameters('workspace')]", - "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" - }, - "resources": [ - { - "type": "Microsoft.Web/connections", - "apiVersion": "2016-06-01", - "name": "[[parameters('AzureSentinelConnectionName')]", - "location": "[[variables('workspace-location-inline')]", - "properties": { - "displayName": "[[parameters('AzureSentinelConnectionName')]", - "api": { - "id": "[[variables('_connection-1')]" + ] + }, + "Custom-VeeamOneTriggeredAlarms_CL": { + "columns": [ + { + "name": "voneHostName", + "type": "string" + }, + { + "name": "triggeredAlarmId", + "type": "int" + }, + { + "name": "name", + "type": "string" + }, + { + "name": "alarmTemplateId", + "type": "int" + }, + { + "name": "predefinedAlarmId", + "type": "int" + }, + { + "name": "triggeredTime", + "type": "datetime" + }, + { + "name": "status", + "type": "string" + }, + { + "name": "description", + "type": "string" + }, + { + "name": "comment", + "type": "string" + }, + { + "name": "repeatCount", + "type": "int" + }, + { + "name": "childAlarmsCount", + "type": "int" + }, + { + "name": "alarmSource", + "type": "dynamic" + }, + { + "name": "remediation", + "type": "dynamic" + } + ] + }, + "Custom-VeeamSecurityComplianceAnalyzer_CL": { + "columns": [ + { + "name": "vbrHostName", + "type": "string" + }, + { + "name": "status", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "bestPractice", + "type": "string" + }, + { + "name": "note", + "type": "string" + } + ] + }, + "Custom-VeeamSessions_CL": { + "columns": [ + { + "name": "vbrHostName", + "type": "string" + }, + { + "name": "sessionType", + "type": "string" + }, + { + "name": "state", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "name", + "type": "string" + }, + { + "name": "jobId", + "type": "string" + }, + { + "name": "creationTime", + "type": "datetime" + }, + { + "name": "endTime", + "type": "datetime" + }, + { + "name": "progressPercent", + "type": "int" + }, + { + "name": "resourceId", + "type": "string" + }, + { + "name": "resourceReference", + "type": "string" + }, + { + "name": "parentSessionId", + "type": "string" + }, + { + "name": "platformName", + "type": "string" + }, + { + "name": "platformId", + "type": "string" + }, + { + "name": "usn", + "type": "long" + }, + { + "name": "result", + "type": "dynamic" + } + ] + }, + "Custom-VeeamAuthorizationEvents_CL": { + "columns": [ + { + "name": "vbrHostName", + "type": "string" + }, + { + "name": "createdBy", + "type": "string" + }, + { + "name": "creationTime", + "type": "datetime" + }, + { + "name": "description", + "type": "string" + }, + { + "name": "expirationTime", + "type": "datetime" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "name", + "type": "string" + }, + { + "name": "processedBy", + "type": "string" + }, + { + "name": "processedTime", + "type": "datetime" + }, + { + "name": "state", + "type": "string" + } + ] + } }, - "parameterValueType": "Alternative" + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-VeeamMalwareEvents_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamMalwareEvents_CL", + "transformKql": "source | extend TimeGenerated = now() , VbrHostName = ['vbrHostName'] , MalwareEventType = ['type'] , MalwareState = ['state'] , Source = ['source'] , Severity = ['severity'] , Id = ['id'] , DetectionTimeUtc = ['detectionTimeUtc'] , MachineDisplayName = tostring(machine.displayName) , MachineUuid = tostring(machine.uuid) , MachineBackupObjectId = tostring(machine.backupObjectId) , Details = ['details'] , CreatedBy = ['createdBy'] , Engine = ['engine'] | project TimeGenerated , VbrHostName , MalwareEventType , MalwareState , Source , Severity , Id , DetectionTimeUtc , MachineDisplayName , MachineUuid , MachineBackupObjectId , Details , CreatedBy , Engine" + }, + { + "streams": [ + "Custom-VeeamSecurityComplianceAnalyzer_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamSecurityComplianceAnalyzer_CL", + "transformKql": "source | extend TimeGenerated = now() , VbrHostName = ['vbrHostName'] , Status = ['status'] , Id = ['id'] , BestPractice = ['bestPractice'] , Note = ['note'] | project TimeGenerated , VbrHostName , Status , Id , BestPractice , Note" + }, + { + "streams": [ + "Custom-VeeamOneTriggeredAlarms_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamOneTriggeredAlarms_CL", + "transformKql": "source | extend TimeGenerated = now() , VoneHostName = ['voneHostName'] , TriggeredAlarmId = ['triggeredAlarmId'] , Name = ['name'] , AlarmTemplateId = ['alarmTemplateId'] , PredefinedAlarmId = ['predefinedAlarmId'] , TriggeredTime = ['triggeredTime'] , Status = ['status'] , Description = ['description'] , Comment = ['comment'] , RepeatCount = ['repeatCount'] , ObjectId = toint(alarmSource.objectId) , ObjectName = tostring(alarmSource.objectName) , ObjectType = tostring(alarmSource.objectType) , ChildAlarmsCount = ['childAlarmsCount'] , RemediationDescription = tostring(remediation.description) , RemediationMode = tostring(remediation.mode) | project TimeGenerated , VoneHostName , TriggeredAlarmId , Name , AlarmTemplateId , PredefinedAlarmId , TriggeredTime , Status , Description , Comment , RepeatCount , ObjectId , ObjectName , ObjectType , ChildAlarmsCount , RemediationDescription , RemediationMode" + }, + { + "streams": [ + "Custom-VeeamAuthorizationEvents_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamAuthorizationEvents_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" + }, + { + "streams": [ + "Custom-VeeamCovewareFindings_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamCovewareFindings_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(eventTime), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" + }, + { + "streams": [ + "Custom-VeeamSessions_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-VeeamSessions_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" + } + ] } }, { - "type": "Microsoft.Logic/workflows", - "apiVersion": "2017-07-01", - "name": "[[parameters('PlaybookName')]", - "location": "[[variables('workspace-location-inline')]", - "identity": { - "type": "SystemAssigned" - }, - "tags": { - "hidden-SentinelTemplateName": "Veeam-CollectSecurityComplianceAnalyzerResult", - "hidden-SentinelTemplateVersion": "1.0", - "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" - }, - "dependsOn": [ - "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" - ], + "name": "VeeamSessions_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, "properties": { - "state": "Enabled", - "definition": { - "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "$connections": { - "type": "Object" + "retentionInDays": 180, + "schema": { + "name": "VeeamSessions_CL", + "description": "Veeam comprehensive session data including backup, restore, and other operations with detailed status and progress information.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true }, - "functionAppName": { - "defaultValue": "[[parameters('functionAppName')]", - "type": "String" + { + "name": "VbrHostName", + "type": "string", + "description": "Veeam Backup & Replication server hostname" }, - "workspaceId": { - "defaultValue": "[[parameters('workspaceId')]", - "type": "String" + { + "name": "SessionType", + "type": "string", + "description": "Type of Veeam session operation" }, - "resourceGroupName": { - "defaultValue": "[[parameters('resourceGroupName')]", - "type": "String" + { + "name": "State", + "type": "string", + "description": "Current state of the session" }, - "subscriptionId": { - "defaultValue": "[[subscription().subscriptionId]", - "type": "String" + { + "name": "Id", + "type": "string", + "description": "Unique session identifier" }, - "VbrHostName": { - "defaultValue": "vbr1", - "type": "String" - } - }, - "triggers": { - "Every_24_hours": { - "recurrence": { - "interval": 24, - "frequency": "Hour" - }, - "evaluatedRecurrence": { - "interval": 24, - "frequency": "Hour" - }, - "type": "Recurrence" - } - }, - "actions": { - "Watchlists_-_Get_VBR_Settings": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "get", - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItems" - } + { + "name": "Name", + "type": "string", + "description": "Display name of the session" }, - "Parse_VBR_settings": { - "runAfter": { - "Watchlists_-_Get_VBR_Settings": [ - "Succeeded" - ] - }, - "type": "ParseJson", - "inputs": { - "content": "@body('Watchlists_-_Get_VBR_Settings')", - "schema": { - "type": "object", - "properties": { - "properties": { - "type": "object", - "properties": { - "watchlistItems": { - "type": "array", - "items": { - "type": "object", - "properties": { - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Security and Compliance Analyzer Results": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - } - } - } - } - } - } - } - } - } - } - } + { + "name": "JobId", + "type": "string", + "description": "Associated job identifier" }, - "For_each_VBR": { - "foreach": "@body('Parse_VBR_settings')?['properties']?['watchlistItems']", - "actions": { - "Parse_current_VBR": { - "type": "ParseJson", - "inputs": { - "content": "@items('For_each_VBR')", - "schema": { - "type": "object", - "properties": { - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Security and Compliance Analyzer Results": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - } - } - } - } - } - } - }, - "If_best_practice_analysis_collection_is_enabled": { - "actions": { - "Collect_Best_Practice_Analysis_into_VeeamBestPracticeAnalysisTable_CL": { - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Veeam Server Name']" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetSecurityComplianceAnalyzerResultsAsync')]" - } - } - } - }, - "runAfter": { - "Parse_current_VBR": [ - "Succeeded" - ] - }, - "else": { - "actions": { - "Print_baseUrl": { - "type": "Compose", - "inputs": "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Base URL']" - } - } - }, - "expression": { - "and": [ - { - "equals": [ - "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results']", - "true" - ] - } - ] - }, - "type": "If" - } - }, - "runAfter": { - "Parse_VBR_settings": [ - "Succeeded" - ] - }, - "type": "Foreach" - } - } - }, - "parameters": { - "$connections": { - "value": { - "azuresentinel": { - "connectionName": "[[parameters('AzureSentinelConnectionName')]", - "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", - "id": "[[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/',variables('workspace-location-inline'),'/managedApis/azuresentinel')]", - "connectionProperties": { - "authentication": { - "type": "ManagedServiceIdentity" - } - } - } + { + "name": "CreationTime", + "type": "datetime", + "description": "Timestamp when session was created" + }, + { + "name": "EndTime", + "type": "datetime", + "description": "Timestamp when session completed" + }, + { + "name": "ProgressPercent", + "type": "int", + "description": "Session completion percentage" + }, + { + "name": "ResultStatus", + "type": "string", + "description": "Session result status" + }, + { + "name": "ResultMessage", + "type": "string", + "description": "Session result message" + }, + { + "name": "ResultIsCanceled", + "type": "boolean", + "description": "Whether session was canceled" + }, + { + "name": "VeeamResourceId", + "type": "string", + "description": "Veeam resource identifier" + }, + { + "name": "ResourceReference", + "type": "string", + "description": "Reference to associated resource" + }, + { + "name": "ParentSessionId", + "type": "string", + "description": "Parent session identifier if applicable" + }, + { + "name": "PlatformName", + "type": "string", + "description": "Platform name associated with the session" + }, + { + "name": "PlatformId", + "type": "string", + "description": "Platform identifier associated with the session" + }, + { + "name": "Usn", + "type": "long", + "description": "Update sequence number" + }, + { + "name": "Result", + "type": "string", + "description": "Session result status" + }, + { + "name": "Message", + "type": "string", + "description": "Session result message" + }, + { + "name": "IsCanceled", + "type": "boolean", + "description": "Whether session was canceled" } - } + ] } } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId3'),'/'))))]", + "name": "VeeamAuthorizationEvents_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, "properties": { - "parentId": "[variables('playbookId3')]", - "contentId": "[variables('_playbookContentId3')]", - "kind": "Playbook", - "version": "[variables('playbookVersion3')]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" + "retentionInDays": 180, + "schema": { + "name": "VeeamAuthorizationEvents_CL", + "description": "Veeam authorization and authentication events for security monitoring and access control.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "VbrHostName", + "type": "string", + "description": "Veeam Backup & Replication server hostname" + }, + { + "name": "CreatedBy", + "type": "string", + "description": "User who created the authorization request" + }, + { + "name": "CreationTime", + "type": "datetime", + "description": "Timestamp when authorization was created" + }, + { + "name": "Description", + "type": "string", + "description": "Description of authorization request" + }, + { + "name": "ExpirationTime", + "type": "datetime", + "description": "Timestamp when authorization expires" + }, + { + "name": "Id", + "type": "string", + "description": "Unique authorization event identifier" + }, + { + "name": "Name", + "type": "string", + "description": "Name of authorization request" + }, + { + "name": "ProcessedBy", + "type": "string", + "description": "User who processed the authorization" + }, + { + "name": "ProcessedTime", + "type": "datetime", + "description": "Timestamp when authorization was processed" + }, + { + "name": "State", + "type": "string", + "description": "Current authorization state" + } + ] } } - } - ], - "metadata": { - "title": "Veeam-CollectSecurityComplianceAnalyzerResult", - "description": "A Microsoft Sentinel playbook that automatically collects Veeam Security Compliance Analyzer results from Veeam Backup & Replication servers on schedule. The playbook gets Veeam Backup & Replication settings from watchlist and calls the GetSecurityComplianceAnalyzerResults function for each enabled server, ingesting the data into custom tables.", - "prerequisites": [ - "1. Microsoft Sentinel workspace configured.", - "2. Permissions to create Logic Apps and API Connections.", - "3. Permissions to assign roles to the Resource Group.", - "4. Veeam Azure Function App deployed and configured.", - "5. VBR Settings watchlist configured in Microsoft Sentinel.", - "6. Hybrid Connection and Key Vault secrets configured for each VBR Server." - ], - "tags": [ - "Automation", - "Veeam", - "BestPractice", - "Analysis", - "Collection" - ], - "lastUpdateTime": "2025-08-25T00:00:00Z", - "parameterTemplateVersion": "1.0.0", - "postDeployment": [ - "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", - "2. Ensure the VBR Settings watchlist is properly configured with the 'Collect Security and Compliance Analyzer Results' flag set to true on servers from which you want to collect data." - ], - "releaseNotes": { - "version": "1.0", - "title": "[variables('blanks')]", - "notes": [ - "Initial version" - ] - } - } - }, + }, + { + "name": "VeeamCovewareFindings_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "VeeamCovewareFindings_CL", + "description": "Coveware security findings and threat intelligence from Veeam backup systems.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "CovewareHostName", + "type": "string", + "description": "Coveware server hostname" + }, + { + "name": "Artifact", + "type": "string", + "description": "File or process path" + }, + { + "name": "EventType", + "type": "string", + "description": "Type of security event" + }, + { + "name": "TechniqueId", + "type": "string", + "description": "MITRE ATT&CK technique identifier" + }, + { + "name": "EventTime", + "type": "datetime", + "description": "Timestamp when event occurred" + }, + { + "name": "FirstRunOrAccessed", + "type": "datetime", + "description": "First time artifact was run or accessed" + }, + { + "name": "Hostname", + "type": "string", + "description": "Machine hostname where event occurred" + }, + { + "name": "EventActivity", + "type": "string", + "description": "Description of security activity" + }, + { + "name": "Country", + "type": "string", + "description": "Geographic location of the event" + }, + { + "name": "Id", + "type": "string", + "description": "Unique finding identifier" + }, + { + "name": "Md5Hash", + "type": "string", + "description": "MD5 hash of the file" + }, + { + "name": "Sha1Hash", + "type": "string", + "description": "SHA1 hash of the file" + }, + { + "name": "Sha256Hash", + "type": "string", + "description": "SHA256 hash of the file" + }, + { + "name": "MachineId", + "type": "string", + "description": "Unique machine identifier" + }, + { + "name": "RiskLevel", + "type": "string", + "description": "Security risk level assessment" + }, + { + "name": "ScanTime", + "type": "datetime", + "description": "Timestamp when scan was performed" + }, + { + "name": "Username", + "type": "string", + "description": "User account associated with event" + } + ] + } + } + }, + { + "name": "VeeamMalwareEvents_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "VeeamMalwareEvents_CL", + "description": "Veeam Backup & Replication malware detection events and security threats.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "VbrHostName", + "type": "string", + "description": "Veeam Backup & Replication server hostname" + }, + { + "name": "MalwareEventType", + "type": "string", + "description": "Type of malware detection event" + }, + { + "name": "MalwareState", + "type": "string", + "description": "Current state of malware event" + }, + { + "name": "Source", + "type": "string", + "description": "Source that triggered the detection" + }, + { + "name": "Severity", + "type": "string", + "description": "Severity level of malware threat" + }, + { + "name": "Id", + "type": "string", + "description": "Unique malware event identifier" + }, + { + "name": "DetectionTimeUtc", + "type": "datetime", + "description": "UTC timestamp of malware detection" + }, + { + "name": "MachineDisplayName", + "type": "string", + "description": "Display name of affected machine" + }, + { + "name": "MachineUuid", + "type": "string", + "description": "Unique identifier of affected machine" + }, + { + "name": "MachineBackupObjectId", + "type": "string", + "description": "Backup object ID for affected machine" + }, + { + "name": "Details", + "type": "string", + "description": "Detailed information about malware detection" + }, + { + "name": "CreatedBy", + "type": "string", + "description": "User or system that created the event" + }, + { + "name": "Engine", + "type": "string", + "description": "Antivirus engine that detected malware" + } + ] + } + } + }, + { + "name": "VeeamOneTriggeredAlarms_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "VeeamOneTriggeredAlarms_CL", + "description": "Veeam ONE triggered alarms and monitoring alerts from Veeam infrastructure.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "VoneHostName", + "type": "string", + "description": "Veeam ONE server hostname" + }, + { + "name": "TriggeredAlarmId", + "type": "int", + "description": "Unique identifier for triggered alarm" + }, + { + "name": "Name", + "type": "string", + "description": "Name of the alarm" + }, + { + "name": "AlarmTemplateId", + "type": "int", + "description": "Template identifier for alarm type" + }, + { + "name": "PredefinedAlarmId", + "type": "int", + "description": "Predefined alarm rule identifier" + }, + { + "name": "TriggeredTime", + "type": "datetime", + "description": "Timestamp when alarm was triggered" + }, + { + "name": "Status", + "type": "string", + "description": "Current alarm status" + }, + { + "name": "Description", + "type": "string", + "description": "Detailed alarm description" + }, + { + "name": "Comment", + "type": "string", + "description": "Additional comments or notes" + }, + { + "name": "RepeatCount", + "type": "int", + "description": "Number of times alarm has repeated" + }, + { + "name": "ObjectId", + "type": "int", + "description": "Identifier of object that triggered alarm" + }, + { + "name": "ObjectName", + "type": "string", + "description": "Name of object that triggered alarm" + }, + { + "name": "ObjectType", + "type": "string", + "description": "Type of object that triggered alarm" + }, + { + "name": "ChildAlarmsCount", + "type": "int", + "description": "Number of child alarms" + }, + { + "name": "RemediationDescription", + "type": "string", + "description": "Detailed description of the alarm event" + }, + { + "name": "RemediationMode", + "type": "string", + "description": "Recommended remediation mode for the alarm event" + } + ] + } + } + }, + { + "name": "VeeamSecurityComplianceAnalyzer_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 180, + "schema": { + "name": "VeeamSecurityComplianceAnalyzer_CL", + "description": "Veeam Security & Compliance Analyzer best practice assessments and compliance results.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "isDefaultDisplay": true + }, + { + "name": "VbrHostName", + "type": "string", + "description": "Veeam Backup & Replication server hostname" + }, + { + "name": "Status", + "type": "string", + "description": "Assessment status of security best practice" + }, + { + "name": "Id", + "type": "string", + "description": "Unique identifier for best practice assessment" + }, + { + "name": "BestPractice", + "type": "string", + "description": "Security best practice being evaluated" + }, + { + "name": "Note", + "type": "string", + "description": "Additional notes and recommendations" + } + ] + } + } + } + ] + }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition2'),'-', variables('dataConnectorCCPVersion'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId3')]", - "contentKind": "Playbook", - "displayName": "Veeam-CollectSecurityComplianceAnalyzerResult", - "contentProductId": "[variables('_playbookcontentProductId3')]", - "id": "[variables('_playbookcontentProductId3')]", - "version": "[variables('playbookVersion3')]" + "version": "[variables('dataConnectorCCPVersion')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName4')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition2'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], + "kind": "Customizable", "properties": { - "description": "Veeam-CollectMalwareEvents Playbook with template version 3.0.3", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion4')]", - "parameters": { - "PlaybookName": { - "defaultValue": "Veeam-CollectMalwareEvents", - "type": "string", - "metadata": { - "description": "Name of the playbook (Logic App) to be created" - } + "connectorUiConfig": { + "id": "VeeamConnector", + "title": "Veeam Data Connector (via Codeless Connector Framework)", + "graphQueriesTableName": "VeeamMalwareEvents_CL", + "publisher": "Microsoft", + "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEvents_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzer_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEvents_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarms_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindings_CL**: Security findings from Coveware solution\n- **VeeamSessions_CL**: Veeam sessions", + "graphQueries": [ + { + "metricName": "Total malware logs received", + "legend": "Malware events", + "baseQuery": "VeeamMalwareEvents_CL" }, - "functionAppName": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Name of the Azure Function App for Veeam integration" - } + { + "metricName": "Critical malware events", + "legend": "Critical malware events", + "baseQuery": "VeeamMalwareEvents_CL\n| where Severity == \"Critical\"" }, - "workspaceId": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" - } + { + "metricName": "Total security & compliance analyzer logs received", + "legend": "Security & Compliance Analyzer results", + "baseQuery": "VeeamSecurityComplianceAnalyzer_CL" }, - "AzureSentinelConnectionName": { - "defaultValue": "azuresentinel-connection", - "type": "string", - "metadata": { - "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" - } + { + "metricName": "Total veeam ONE alarms logs received", + "legend": "Veeam ONE alarms", + "baseQuery": "VeeamOneTriggeredAlarms_CL" }, - "resourceGroupName": { - "defaultValue": "[resourceGroup().name]", - "type": "string", - "metadata": { - "description": "Name of the resource group containing the Microsoft Sentinel workspace" - } + { + "metricName": "Total authorization events logs received", + "legend": "Authorization events", + "baseQuery": "VeeamAuthorizationEvents_CL" + }, + { + "metricName": "Total coveware findings logs received", + "legend": "Coveware findings", + "baseQuery": "VeeamCovewareFindings_CL" + }, + { + "metricName": "Total session logs received", + "legend": "Session logs", + "baseQuery": "VeeamSessions_CL" } - }, - "variables": { - "functionAppId": "[[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]", - "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", - "_connection-1": "[[variables('connection-1')]", - "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", - "workspace-name": "[parameters('workspace')]", - "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" - }, - "resources": [ + ], + "sampleQueries": [ { - "type": "Microsoft.Web/connections", - "apiVersion": "2016-06-01", - "name": "[[parameters('AzureSentinelConnectionName')]", - "location": "[[variables('workspace-location-inline')]", - "properties": { - "displayName": "[[parameters('AzureSentinelConnectionName')]", - "api": { - "id": "[[variables('_connection-1')]" - }, - "parameterValueType": "Alternative" - } + "description": "Malware Events", + "query": "VeeamMalwareEvents_CL\n | sort by TimeGenerated desc" }, { - "type": "Microsoft.Logic/workflows", - "apiVersion": "2017-07-01", - "name": "[[parameters('PlaybookName')]", - "location": "[[variables('workspace-location-inline')]", - "identity": { - "type": "SystemAssigned" - }, - "tags": { - "hidden-SentinelTemplateName": "Veeam-CollectMalwareEvents", - "hidden-SentinelTemplateVersion": "1.0", - "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" - }, - "dependsOn": [ - "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" - ], - "properties": { - "state": "Enabled", - "definition": { - "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "$connections": { - "type": "Object" - }, - "functionAppName": { - "defaultValue": "[[parameters('functionAppName')]", - "type": "String" - }, - "workspaceId": { - "defaultValue": "[[parameters('workspaceId')]", - "type": "String" - }, - "resourceGroupName": { - "defaultValue": "[[parameters('resourceGroupName')]", - "type": "String" - }, - "subscriptionId": { - "defaultValue": "[[subscription().subscriptionId]", - "type": "String" - } - }, - "triggers": { - "Every_1_day": { - "recurrence": { - "interval": 1, - "frequency": "Day" - }, - "evaluatedRecurrence": { - "interval": 1, - "frequency": "Day" - }, - "type": "Recurrence" - } - }, - "actions": { - "Watchlists_-_Get_VBR_Settings": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "get", - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItems" - } - }, - "Parse_VBR_settings": { - "runAfter": { - "Watchlists_-_Get_VBR_Settings": [ - "Succeeded" - ] - }, - "type": "ParseJson", - "inputs": { - "content": "@body('Watchlists_-_Get_VBR_Settings')", - "schema": { - "type": "object", - "properties": { - "properties": { - "type": "object", - "properties": { - "watchlistItems": { - "type": "array", - "items": { - "type": "object", - "properties": { - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Malware Events": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - } - } - } - } - } - } - } - } - } - } - } - }, - "For_each_VBR_server": { - "foreach": "@body('Parse_VBR_settings')?['properties']?['watchlistItems']", - "actions": { - "Parse_current_VBR_server": { - "type": "ParseJson", - "inputs": { - "content": "@items('For_each_VBR_server')", - "schema": { - "type": "object", - "properties": { - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Malware Events": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - } - } - } - } - } - } - }, - "If_malware_event_collection_is_enabled": { - "actions": { - "Collect_Malware_Events_into_VeeamMalwareEventsTable_CL": { - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetAllMalwareEventsAsync')]" - } - } - } - }, - "runAfter": { - "Parse_current_VBR_server": [ - "Succeeded" - ] - }, - "else": { - "actions": { - "Print_baseUrl": { - "type": "Compose", - "inputs": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Base URL']" - } - } - }, - "expression": { - "and": [ - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events']", - "true" - ] - } - ] - }, - "type": "If" - } - }, - "runAfter": { - "Parse_VBR_settings": [ - "Succeeded" - ] - }, - "type": "Foreach" - } - } - }, - "parameters": { - "$connections": { - "value": { - "azuresentinel": { - "connectionName": "[[parameters('AzureSentinelConnectionName')]", - "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", - "id": "[[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/',variables('workspace-location-inline'),'/managedApis/azuresentinel')]", - "connectionProperties": { - "authentication": { - "type": "ManagedServiceIdentity" - } - } - } - } - } - } - } + "description": "Critical Malware Events", + "query": "VeeamMalwareEvents_CL\n | where Severity == \"Critical\"\n | sort by TimeGenerated desc" }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId4'),'/'))))]", - "properties": { - "parentId": "[variables('playbookId4')]", - "contentId": "[variables('_playbookContentId4')]", - "kind": "Playbook", - "version": "[variables('playbookVersion4')]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } + "description": "Security Compliance Results", + "query": "VeeamSecurityComplianceAnalyzer_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Veeam ONE Alarms", + "query": "VeeamOneTriggeredAlarms_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Authorization Events", + "query": "VeeamAuthorizationEvents_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Coveware Security Findings", + "query": "VeeamCovewareFindings_CL\n | sort by TimeGenerated desc" + }, + { + "description": "Session events", + "query": "VeeamSessions_CL\n | sort by TimeGenerated desc" } ], - "metadata": { - "title": "Veeam-CollectMalwareEvents", - "description": "A Microsoft Sentinel playbook that automatically collects malware events from Veeam Backup & Replication servers on a schedule. The playbook gets Veeam Backup & Replication settings from watchlist and calls the GetMalwareEvents function for each enabled server, ingesting the data into custom tables.", - "prerequisites": [ - "1. Microsoft Sentinel workspace configured.", - "2. Permissions to create Logic Apps and API Connections.", - "3. Permissions to assign roles to the Resource Group.", - "4. Veeam Azure Function App deployed and configured.", - "5. VBR Settings watchlist configured in Microsoft Sentinel.", - "6. Hybrid Connection and Key Vault secrets configured for each VBR Server." - ], - "tags": [ - "Automation", - "Veeam", - "Malware", - "Collection" - ], - "lastUpdateTime": "2025-08-25T00:00:00Z", - "parameterTemplateVersion": "1.0.0", - "postDeployment": [ - "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", - "2. Ensure the VBR Settings watchlist is properly configured with the 'Collect Malware Events' flag set to true on servers from which you want to collect data." - ], - "releaseNotes": { - "version": "1.0", - "title": "[variables('blanks')]", - "notes": [ - "Initial version" - ] - } - } + "dataTypes": [ + { + "name": "VeeamMalwareEvents_CL", + "lastDataReceivedQuery": "VeeamMalwareEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamSecurityComplianceAnalyzer_CL", + "lastDataReceivedQuery": "VeeamSecurityComplianceAnalyzer_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamOneTriggeredAlarms_CL", + "lastDataReceivedQuery": "VeeamOneTriggeredAlarms_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamAuthorizationEvents_CL", + "lastDataReceivedQuery": "VeeamAuthorizationEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamCovewareFindings_CL", + "lastDataReceivedQuery": "VeeamCovewareFindings_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "VeeamSessions_CL", + "lastDataReceivedQuery": "VeeamSessions_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true, + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true, + "action": false + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "read": true + } + } + ], + "customs": [ + { + "name": "Veeam Data Access", + "description": "Access to Veeam systems is required to collect security and operational data. The connector supports data ingestion from Veeam Backup & Replication, Veeam ONE, and Coveware platforms." + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description": "Follow the instructions to configure the Veeam Data Connector.", + "instructions": [ + { + "type": "InfoMessage", + "parameters": { + "text": "**Note:** This data connector depends on parsers based on Kusto Functions to work as expected. These parsers are installed with the Microsoft Sentinel Solution for Veeam." + } + } + ] + }, + { + "title": "1. Configuration steps for Veeam Data Connector", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "1. Configure your Veeam systems to export security and operational data.\n2. Set up data collection endpoints to ingest data into the custom Log Analytics tables.\n3. Ensure proper permissions are configured for data access.\n4. Verify connectivity and data flow to Microsoft Sentinel." + } + } + ] + }, + { + "title": "2. Coveware API Configuration", + "description": "Configure Coveware API credentials for security findings data collection.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### 2.1 Obtain Coveware API Credentials\n1. Log in to your Coveware management console\n2. Navigate to API settings or integrations section\n3. Create or configure an API application\n4. Generate or obtain a Bearer token for API access\n5. Note your Coveware API base URL" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Coveware API URL", + "placeholder": "https://api.coveware.com", + "type": "text", + "name": "covewareApiUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Coveware Bearer Token", + "placeholder": "Your Coveware API Bearer Token", + "type": "password", + "name": "covewareBearerToken", + "validations": { + "required": true + } + } + } + ] + }, + { + "title": "3. Veeam API Configuration", + "description": "Configure Veeam API credentials for all Veeam services (Malware Events, Security Analyzer, and Authorization Events).", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### 3.1 Obtain Veeam API Access Token\n1. Access your Veeam Backup & Replication management console\n2. Navigate to the REST API settings or authentication section\n3. Generate or obtain a Bearer token for API access\n4. Ensure the token has appropriate permissions for:\n - Malware Detection API (v1.3-rev1)\n - Security & Compliance Analyzer API (v1.3-rev1)\n - Authorization Events API (v1.3-rev1)\n - Sessions API (v1.3-rev1)\n5. Note the API base URL (typically https://your-veeam-server.com:9419)\n6. This token will be used for both on-premises and CDN-hosted APIs" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam API URL", + "placeholder": "https://your-veeam-server.com:9419", + "type": "text", + "name": "veeamApiUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam Bearer Token", + "placeholder": "Your Veeam API Bearer Token", + "type": "password", + "name": "veeamBearerToken", + "validations": { + "required": true + } + } + } + ] + }, + { + "title": "4. Veeam ONE API Configuration", + "description": "Configure Veeam ONE API credentials for triggered alarms data collection.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "#### 4.1 Obtain Veeam ONE API Access Key\n1. Access your Veeam ONE management console\n2. Navigate to Administration -> Users and Roles\n3. Create or use an existing user with API access permissions\n4. Generate or obtain a Bearer token for API access\n5. Note the Veeam ONE server URL and port (typically https://your-veeam-one-server:1239)" + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE API URL", + "placeholder": "https://your-veeam-one-server:1239", + "type": "text", + "name": "veeamOneApiUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Veeam ONE API Bearer Token", + "placeholder": "Your Veeam ONE API Bearer Token", + "type": "password", + "name": "veeamOneBearerToken", + "validations": { + "required": true + } + } + } + ] + }, + { + "title": "5. Connect", + "description": "Enable the Veeam Data Connector.", + "instructions": [ + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "disconnectLabel": "Disconnect", + "name": "toggle" + } + } + ] + } + ], + "isConnectivityCriteriasMatchSome": false + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition2')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition2'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId4')]", - "contentKind": "Playbook", - "displayName": "Veeam-CollectMalwareEvents", - "contentProductId": "[variables('_playbookcontentProductId4')]", - "id": "[variables('_playbookcontentProductId4')]", - "version": "[variables('playbookVersion4')]" + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections2')]", + "kind": "ResourcesDataConnector" + } + ] + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName5')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections2'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectVeeamONEAlarms Playbook with template version 3.0.3", + "contentId": "[variables('_dataConnectorContentIdConnections2')]", + "displayName": "Veeam Data Connector (via Codeless Connector Framework)", + "contentKind": "ResourcesDataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion5')]", + "contentVersion": "[variables('dataConnectorCCPVersion')]", "parameters": { - "PlaybookName": { - "defaultValue": "Veeam-CollectVeeamONEAlarms", - "type": "string", - "metadata": { - "description": "Name of the playbook (Logic App) to be created" - } + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" }, - "functionAppName": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Name of the Azure Function App for Veeam integration" - } + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" }, - "workspaceId": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" - } + "connectorDefinitionName": { + "defaultValue": "Veeam Data Connector (via Codeless Connector Framework)", + "type": "securestring", + "minLength": 1 }, - "AzureSentinelConnectionName": { - "defaultValue": "azuresentinel-connection", - "type": "string", - "metadata": { - "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" - } + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" }, - "resourceGroupName": { - "defaultValue": "[resourceGroup().name]", - "type": "string", - "metadata": { - "description": "Name of the resource group containing the Microsoft Sentinel workspace" - } + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + }, + "covewareApiUrl": { + "defaultValue": "covewareApiUrl", + "type": "securestring", + "minLength": 1 + }, + "covewareBearerToken": { + "defaultValue": "covewareBearerToken", + "type": "securestring", + "minLength": 1 + }, + "veeamApiUrl": { + "defaultValue": "veeamApiUrl", + "type": "securestring", + "minLength": 1 + }, + "veeamBearerToken": { + "defaultValue": "veeamBearerToken", + "type": "securestring", + "minLength": 1 + }, + "veeamOneApiUrl": { + "defaultValue": "veeamOneApiUrl", + "type": "securestring", + "minLength": 1 + }, + "veeamOneBearerToken": { + "defaultValue": "veeamOneBearerToken", + "type": "securestring", + "minLength": 1 } }, "variables": { - "functionAppId": "[[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]", - "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", - "_connection-1": "[[variables('connection-1')]", - "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", - "workspace-name": "[parameters('workspace')]", - "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + "_dataConnectorContentIdConnections2": "[variables('_dataConnectorContentIdConnections2')]" }, "resources": [ { - "type": "Microsoft.Web/connections", - "apiVersion": "2016-06-01", - "name": "[[parameters('AzureSentinelConnectionName')]", - "location": "[[variables('workspace-location-inline')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections2')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { - "displayName": "[[parameters('AzureSentinelConnectionName')]", - "api": { - "id": "[[variables('_connection-1')]" + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections2'))]", + "contentId": "[variables('_dataConnectorContentIdConnections2')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" }, - "parameterValueType": "Alternative" + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } } }, { - "type": "Microsoft.Logic/workflows", - "apiVersion": "2017-07-01", - "name": "[[parameters('PlaybookName')]", - "location": "[[variables('workspace-location-inline')]", - "identity": { - "type": "SystemAssigned" - }, - "tags": { - "hidden-SentinelTemplateName": "Veeam-CollectVeeamONEAlarms", - "hidden-SentinelTemplateVersion": "1.0", - "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" - }, - "dependsOn": [ - "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" - ], + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'MalwareEventsPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", "properties": { - "state": "Enabled", - "definition": { - "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "$connections": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/malwareDetection/events')]", + "httpMethod": "GET", + "rateLimitQPS": 5, + "queryWindowInMin": 5, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json", + "x-api-version": "1.3-rev1" + }, + "queryParameters": { + "detectedAfterTimeUtcFilter": "{_QueryWindowStartTime}", + "detectedBeforeTimeUtcFilter": "{_QueryWindowEndTime}", + "orderColumn": "detectionTimeUtc", + "orderAsc": "true" + } + }, + "response": { + "eventsJsonPaths": [ + "$.data" + ], + "format": "json" + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "skip", + "pageSize": 1000, + "pageSizeParameterName": "limit" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamMalwareEvents_CL", + "dcrConfig": { + "streamName": "Custom-VeeamMalwareEvents_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + } + } + }, + { + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'CovewareFindingPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('covewareBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('covewareApiUrl'),'/recon/v1/findings')]", + "httpMethod": "GET", + "rateLimitQPS": 5, + "queryWindowInMin": 360, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json" + }, + "queryParameters": { + "earliest-event-time": "{_QueryWindowStartTime}" + } + }, + "response": { + "eventsJsonPaths": [ + "$.data" + ], + "format": "json" + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "offset", + "pageSize": 250, + "pageSizeParameterName": "page-size" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamCovewareFindings_CL", + "dcrConfig": { + "streamName": "Custom-VeeamCovewareFindings_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + } + } + }, + { + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'OneTriggeredAlarmsPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('veeamOneBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/v2.3/alarms/triggeredAlarms')]", + "httpMethod": "GET", + "rateLimitQPS": 5, + "queryWindowInMin": 5, + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json" + } + }, + "response": { + "eventsJsonPaths": [ + "$.items" + ], + "format": "json" + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "Offset", + "pageSize": 1000, + "pageSizeParameterName": "Limit" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamOneTriggeredAlarms_CL", + "dcrConfig": { + "streamName": "Custom-VeeamOneTriggeredAlarms_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + } + } + }, + { + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'SecurityComplianceAnalyzerPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/securityAnalyzer/bestPractices')]", + "httpMethod": "GET", + "rateLimitQPS": 2, + "queryWindowInMin": 60, + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json", + "x-api-version": "1.3-rev1" + } + }, + "response": { + "eventsJsonPaths": [ + "$.items" + ], + "format": "json" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamSecurityComplianceAnalyzer_CL", + "dcrConfig": { + "streamName": "Custom-VeeamSecurityComplianceAnalyzer_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + } + } + }, + { + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'AuthorizationEventsPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/authorization/events')]", + "httpMethod": "GET", + "rateLimitQPS": 2, + "queryWindowInMin": 5, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json", + "x-api-version": "1.3-rev1" + }, + "queryParameters": { + "createdAfterFilter": "{_QueryWindowStartTime}", + "createdBeforeFilter": "{_QueryWindowEndTime}", + "orderColumn": "creationTime", + "orderAsc": "true" + } + }, + "response": { + "eventsJsonPaths": [ + "$.data" + ], + "format": "json" + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "skip", + "pageSize": 1000, + "pageSizeParameterName": "limit" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamAuthorizationEvents_CL", + "dcrConfig": { + "streamName": "Custom-VeeamAuthorizationEvents_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + } + } + }, + { + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'SessionsPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Bearer" + }, + "request": { + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/sessions')]", + "httpMethod": "GET", + "rateLimitQPS": 2, + "queryWindowInMin": 15, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "retryCount": 3, + "timeoutInSeconds": 30, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json", + "x-api-version": "1.3-rev1" + }, + "queryParameters": { + "createdAfterFilter": "{_QueryWindowStartTime}", + "createdBeforeFilter": "{_QueryWindowEndTime}", + "orderColumn": "creationTime", + "orderAsc": "true", + "skip": "0" + } + }, + "response": { + "eventsJsonPaths": [ + "$.data" + ], + "format": "json" + }, + "paging": { + "pagingType": "Offset", + "offsetParaName": "skip", + "pageSize": 1000, + "pageSizeParameterName": "limit" + }, + "connectorDefinitionName": "VeeamConnector", + "dataType": "VeeamSessions_CL", + "dcrConfig": { + "streamName": "Custom-VeeamSessions_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections2'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam-ChangeCollectionTime Playbook with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion1')]", + "parameters": { + "PlaybookName": { + "type": "string", + "defaultValue": "Veeam-ChangeCollectionTime", + "metadata": { + "description": "Name of the playbook (Logic App) to be created" + } + }, + "workspaceId": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" + } + }, + "AzureSentinelConnectionName": { + "type": "string", + "defaultValue": "azuresentinel-connection", + "metadata": { + "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" + } + }, + "subscriptionId": { + "type": "string", + "defaultValue": "[subscription().subscriptionId]", + "metadata": { + "description": "Azure subscription ID" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "Name of the resource group containing the Logic Apps to be updated" + } + }, + "environmentResourceManagerUrl": { + "type": "string", + "defaultValue": "[environment().resourceManager]", + "metadata": { + "description": "Resource Manager URL for the Azure environment" + } + }, + "logicAppsApiVersion": { + "type": "string", + "defaultValue": "2019-05-01", + "metadata": { + "description": "API version to use for Logic Apps operations" + } + }, + "watchlistName": { + "type": "string", + "defaultValue": "collection_schedule_settings", + "metadata": { + "description": "Name of the watchlist containing collection schedule settings" + } + }, + "defaultRecurrenceInterval": { + "type": "string", + "defaultValue": "12", + "metadata": { + "description": "Default recurrence interval to use when not specified in watchlist" + } + }, + "defaultRecurrenceFrequency": { + "type": "string", + "defaultValue": "Hour", + "metadata": { + "description": "Default recurrence frequency to use when not specified in watchlist" + } + } + }, + "variables": { + "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "_connection-1": "[[variables('connection-1')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "type": "Microsoft.Web/connections", + "apiVersion": "2018-07-01-preview", + "name": "[[parameters('AzureSentinelConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "properties": { + "displayName": "[[parameters('AzureSentinelConnectionName')]", + "api": { + "id": "[[variables('_connection-1')]" + }, + "parameterValueType": "Alternative" + } + }, + { + "type": "Microsoft.Logic/workflows", + "apiVersion": "2019-05-01", + "name": "[[parameters('PlaybookName')]", + "location": "[[variables('workspace-location-inline')]", + "identity": { + "type": "SystemAssigned" + }, + "tags": { + "hidden-SentinelTemplateName": "Veeam-ChangeCollectionTime", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "properties": { + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { "type": "Object" }, - "functionAppName": { - "defaultValue": "[[parameters('functionAppName')]", - "type": "String" - }, "workspaceId": { "defaultValue": "[[parameters('workspaceId')]", "type": "String" @@ -2529,26 +3833,40 @@ "defaultValue": "[[subscription().subscriptionId]", "type": "String" }, - "VoneHostName": { - "defaultValue": "vone1", + "watchlistName": { + "defaultValue": "[[parameters('watchlistName')]", + "type": "String" + }, + "environmentResourceManagerUrl": { + "defaultValue": "[[parameters('environmentResourceManagerUrl')]", + "type": "String" + }, + "logicAppsApiVersion": { + "defaultValue": "[[parameters('logicAppsApiVersion')]", "type": "String" } }, "triggers": { - "Every_1_day": { - "recurrence": { - "interval": 1, - "frequency": "Day" - }, - "evaluatedRecurrence": { - "interval": 1, - "frequency": "Day" - }, - "type": "Recurrence" + "manual": { + "type": "Request", + "kind": "Http", + "inputs": { + "schema": { + "type": "object", + "properties": { + "recurrenceInterval": { + "default": "[[parameters('defaultRecurrenceInterval')]" + }, + "recurrenceFrequency": { + "default": "[[parameters('defaultRecurrenceFrequency')]" + } + } + } + } } }, "actions": { - "Watchlists_-_Get_Veeam_ONE_Settings": { + "Watchlists_-_Get_all_Collection_Times": { "type": "ApiConnection", "inputs": { "host": { @@ -2557,18 +3875,13 @@ } }, "method": "get", - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vone_settings')}/watchlistItems" + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent(parameters('watchlistName'))}/watchlistItems" } }, - "Parse_Veeam_ONE_settings": { - "runAfter": { - "Watchlists_-_Get_Veeam_ONE_Settings": [ - "Succeeded" - ] - }, + "Parse_settings": { "type": "ParseJson", "inputs": { - "content": "@body('Watchlists_-_Get_Veeam_ONE_Settings')", + "content": "@body('Watchlists_-_Get_all_Collection_Times')", "schema": { "type": "object", "properties": { @@ -2576,65 +3889,124 @@ "type": "object", "properties": { "watchlistItems": { - "type": "array", - "items": { - "type": "object", - "properties": { - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Alarms": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - } - } - } - } - } + "type": "array" } } } } } + }, + "runAfter": { + "Watchlists_-_Get_all_Collection_Times": [ + "Succeeded" + ] } }, - "For_each_Veeam_ONE_server": { - "foreach": "@body('Parse_Veeam_ONE_settings')?['properties']?['watchlistItems']", + "For_each": { + "type": "Foreach", + "foreach": "@body('Parse_settings')?['properties']?['watchlistItems']", "actions": { - "Parse_current_Veeam_ONE_server": { + "Parse_setting": { "type": "ParseJson", "inputs": { - "content": "@items('For_each_Veeam_ONE_server')", + "content": "@items('For_each')", "schema": { "type": "object", "properties": { + "properties.watchlistItemType": { + "type": "string" + }, + "properties.watchlistItemId": { + "type": "string" + }, + "properties.tenantId": { + "type": "string" + }, + "properties.isDeleted": { + "type": "boolean" + }, + "properties.created": { + "type": "string" + }, + "properties.updated": { + "type": "string" + }, + "properties.createdBy": { + "type": "object", + "properties": { + "email": { + "type": "string" + }, + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, + "properties.updatedBy": { + "type": "object", + "properties": { + "email": { + "type": "string" + }, + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, "properties.itemsKeyValue": { "type": "object", "properties": { - "Veeam Server Name": { + "CollectionPlaybookName": { "type": "string" }, - "Base URL": { + "RecurrenceInterval": { "type": "string" }, - "Collect Alarms": { + "TimeUnit": { + "type": "string" + } + } + }, + "properties.entityMapping": { + "type": "object" + }, + "etag": { + "type": "string" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "type": "string" + }, + "systemData": { + "type": "object", + "properties": { + "createdBy": { "type": "string" }, - "Key Vault Password ID": { + "createdByType": { "type": "string" }, - "Key Vault Username ID": { + "createdAt": { + "type": "string" + }, + "lastModifiedBy": { + "type": "string" + }, + "lastModifiedByType": { + "type": "string" + }, + "lastModifiedAt": { "type": "string" } } @@ -2643,52 +4015,209 @@ } } }, - "If_alarm_collection_is_enabled": { - "actions": { - "Collect_Vone_Alarms_into_VoneAlarmsTable_CL": { - "type": "Function", - "inputs": { - "queries": { - "voneHostName": "@body('Parse_current_Veeam_ONE_server')?['properties.itemsKeyValue']?['Veeam Server Name']" + "Get_Current_Workflow_Definition": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('environmentResourceManagerUrl'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Logic/workflows/', body('Parse_setting')?['properties.itemsKeyValue']?['CollectionPlaybookName'], '?api-version=', parameters('logicAppsApiVersion'))", + "method": "GET", + "authentication": { + "type": "ManagedServiceIdentity" + } + }, + "runAfter": { + "Parse_setting": [ + "Succeeded" + ] + } + }, + "Parse_Workflow_Definition": { + "type": "ParseJson", + "inputs": { + "content": "@body('Get_Current_Workflow_Definition')", + "schema": { + "type": "object", + "properties": { + "properties": { + "type": "object", + "properties": { + "provisioningState": { + "type": "string" + }, + "createdTime": { + "type": "string" + }, + "changedTime": { + "type": "string" + }, + "state": { + "type": "string" + }, + "version": { + "type": "string" + }, + "accessEndpoint": { + "type": "string" + }, + "definition": { + "type": "object", + "properties": { + "$schema": { + "type": "string" + }, + "contentVersion": { + "type": "string" + }, + "parameters": { + "type": "object" + }, + "triggers": { + "type": "object" + }, + "actions": { + "type": "object" + }, + "outputs": { + "type": "object" + } + } + }, + "parameters": { + "type": "object" + }, + "endpointsConfiguration": { + "type": "object" + } + } }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetAllTriggeredAlarmsAsync')]" + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "type": "string" + }, + "location": { + "type": "string" + }, + "tags": { + "type": "object" + }, + "identity": { + "type": "object", + "properties": { + "type": { + "type": "string" + }, + "principalId": { + "type": "string" + }, + "tenantId": { + "type": "string" + } + } } } } }, "runAfter": { - "Parse_current_Veeam_ONE_server": [ + "Get_Current_Workflow_Definition": [ "Succeeded" ] - }, - "else": { - "actions": { - "Print_baseUrl": { - "type": "Compose", - "inputs": "@body('Parse_current_Veeam_ONE_server')?['properties.itemsKeyValue']?['Base URL']" - } + } + }, + "Compose_Updated_Definition": { + "type": "Compose", + "inputs": { + "location": "@body('Parse_Workflow_Definition')?['location']", + "identity": "@body('Parse_Workflow_Definition')?['identity']", + "properties": { + "state": "Enabled", + "definition": { + "$schema": "@body('Parse_Workflow_Definition')?['properties']?['definition']?['$schema']", + "contentVersion": "@body('Parse_Workflow_Definition')?['properties']?['definition']?['contentVersion']", + "parameters": "@body('Parse_Workflow_Definition')?['properties']?['definition']?['parameters']", + "triggers": { + "Every_@{int(coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['RecurrenceInterval'], '12'))}_@{coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['TimeUnit'], 'Hour')}": { + "recurrence": { + "interval": "@int(coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['RecurrenceInterval'], '12'))", + "frequency": "@coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['TimeUnit'], 'Hour')" + }, + "evaluatedRecurrence": { + "interval": "@int(coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['RecurrenceInterval'], '12'))", + "frequency": "@coalesce(body('Parse_setting')?['properties.itemsKeyValue']?['TimeUnit'], 'Hour')" + }, + "type": "Recurrence" + } + }, + "actions": "@body('Parse_Workflow_Definition')?['properties']?['definition']?['actions']", + "outputs": "@body('Parse_Workflow_Definition')?['properties']?['definition']?['outputs']" + }, + "parameters": "@body('Parse_Workflow_Definition')?['properties']?['parameters']" } }, - "expression": { - "and": [ - { - "equals": [ - "@body('Parse_current_Veeam_ONE_server')?['properties.itemsKeyValue']?['Collect Alarms']", - "true" - ] - } + "runAfter": { + "Parse_Workflow_Definition": [ + "Succeeded" ] + } + }, + "Update_Events_Workflow": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('environmentResourceManagerUrl'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Logic/workflows/', body('Parse_setting')?['properties.itemsKeyValue']?['CollectionPlaybookName'], '?api-version=', parameters('logicAppsApiVersion'))", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": "@outputs('Compose_Updated_Definition')", + "authentication": { + "type": "ManagedServiceIdentity" + } }, - "type": "If" + "runAfter": { + "Compose_Updated_Definition": [ + "Succeeded" + ] + } } }, "runAfter": { - "Parse_Veeam_ONE_settings": [ + "Parse_settings": [ "Succeeded" ] + } + }, + "Response_Success": { + "type": "Response", + "inputs": { + "statusCode": 200, + "body": { + "message": "Successfully updated collection schedule", + "processedWorkflows": "@length(body('Parse_settings')?['properties']?['watchlistItems'])" + } }, - "type": "Foreach" + "runAfter": { + "For_each": [ + "Succeeded" + ] + } + }, + "Response_Error": { + "type": "Response", + "inputs": { + "statusCode": 500, + "body": { + "message": "Failed to update collection schedule", + "error": "@actions('For_each')?['error']" + } + }, + "runAfter": { + "For_each": [ + "Failed" + ] + } } } }, @@ -2698,7 +4227,7 @@ "azuresentinel": { "connectionName": "[[parameters('AzureSentinelConnectionName')]", "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", - "id": "[[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/',variables('workspace-location-inline'),'/managedApis/azuresentinel')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" @@ -2708,17 +4237,20 @@ } } } - } + }, + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" + ] }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId5'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId1'),'/'))))]", "properties": { - "parentId": "[variables('playbookId5')]", - "contentId": "[variables('_playbookContentId5')]", + "parentId": "[variables('playbookId1')]", + "contentId": "[variables('_playbookContentId1')]", "kind": "Playbook", - "version": "[variables('playbookVersion5')]", + "version": "[variables('playbookVersion1')]", "source": { "kind": "Solution", "name": "Veeam", @@ -2738,28 +4270,33 @@ } ], "metadata": { - "title": "Veeam-CollectVeeamONEAlarms", - "description": "This Microsoft Sentinel playbook automatically collects Veeam ONE alarms on a schedule. Retrieves Veeam ONE settings from the watchlist and calls the GetVoneAlarms function for each enabled server, ingesting the data into custom tables.", + "_generator": { + "name": "bicep", + "version": "0.36.177.2456", + "templateHash": "5498632779764501884" + }, + "title": "Veeam-ChangeCollectionTime", + "description": "This Microsoft Sentinel playbook adjusts the recurrence intervals for Veeam collection playbooks based on settings in the collection_schedule_settings watchlist.", "prerequisites": [ "1. Microsoft Sentinel workspace configured.", "2. Permissions to create Logic Apps and API Connections.", - "3. Permissions to assign roles to the Resource Group.", - "4. Veeam Azure Function App deployed and configured.", - "5. Veeam ONE Settings watchlist configured in Microsoft Sentinel.", - "6. Hybrid Connection and Key Vault secrets configured for each Veeam ONE Server." + "3. Permissions to assign roles to the Resource Group and Log Analytics workspace.", + "4. Collection schedule settings watchlist configured in Microsoft Sentinel.", + "5. Logic App Contributor permissions for managing other workflows." ], "tags": [ "Automation", "Veeam", - "VeeamONE", - "Alarms", - "Collection" + "Schedule", + "Collection", + "Configuration" ], - "lastUpdateTime": "2025-08-25T00:00:00Z", + "lastUpdateTime": "2025-08-20T00:00:01Z", "parameterTemplateVersion": "1.0.0", "postDeployment": [ "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", - "2. Ensure the Veeam ONE Settings watchlist is properly configured with the 'Collect Alarms' flag set to true on servers from which you want to collect data." + "2. Assign the Logic App Contributor role to the Logic App's managed identity on the Resource Group.", + "3. Configure the collection_schedule_settings watchlist with required schedule data." ], "releaseNotes": { "version": "1.0", @@ -2775,30 +4312,30 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId5')]", + "contentId": "[variables('_playbookContentId1')]", "contentKind": "Playbook", - "displayName": "Veeam-CollectVeeamONEAlarms", - "contentProductId": "[variables('_playbookcontentProductId5')]", - "id": "[variables('_playbookcontentProductId5')]", - "version": "[variables('playbookVersion5')]" + "displayName": "Veeam-ChangeCollectionTime", + "contentProductId": "[variables('_playbookcontentProductId1')]", + "id": "[variables('_playbookcontentProductId1')]", + "version": "[variables('playbookVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName6')]", + "name": "[variables('playbookTemplateSpecName2')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectCovewareFindings Playbook with template version 3.0.3", + "description": "Veeam-CollectVeeamAuthorizationEvents Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion6')]", + "contentVersion": "[variables('playbookVersion2')]", "parameters": { "PlaybookName": { - "defaultValue": "Veeam-CollectCovewareFindings", + "defaultValue": "Veeam-CollectVeeamAuthorizationEvents", "type": "string", "metadata": { "description": "Name of the playbook (Logic App) to be created" @@ -2864,7 +4401,7 @@ "type": "SystemAssigned" }, "tags": { - "hidden-SentinelTemplateName": "Veeam-CollectCovewareFindings", + "hidden-SentinelTemplateName": "Veeam-CollectVeeamAuthorizationEvents", "hidden-SentinelTemplateVersion": "1.0", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, @@ -2896,26 +4433,26 @@ "defaultValue": "[[subscription().subscriptionId]", "type": "String" }, - "Coveware Server Name": { - "defaultValue": "CovewareServer01", + "VbrHostName": { + "defaultValue": "vbr1", "type": "String" } }, "triggers": { - "Every_6_hours": { + "Every_24_hours": { "recurrence": { - "interval": 6, + "interval": 24, "frequency": "Hour" }, "evaluatedRecurrence": { - "interval": 6, + "interval": 24, "frequency": "Hour" }, "type": "Recurrence" } }, "actions": { - "Watchlists_-_Get_Coveware_Settings": { + "Watchlists_-_Get_VBR_Settings": { "type": "ApiConnection", "inputs": { "host": { @@ -2924,18 +4461,18 @@ } }, "method": "get", - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('coveware_settings')}/watchlistItems" + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItems" } }, - "Parse_Coveware_Settings": { + "Parse_VBR_settings": { "runAfter": { - "Watchlists_-_Get_Coveware_Settings": [ + "Watchlists_-_Get_VBR_Settings": [ "Succeeded" ] }, "type": "ParseJson", "inputs": { - "content": "@body('Watchlists_-_Get_Coveware_Settings')", + "content": "@body('Watchlists_-_Get_VBR_Settings')", "schema": { "type": "object", "properties": { @@ -2950,13 +4487,13 @@ "properties.itemsKeyValue": { "type": "object", "properties": { - "Coveware Server Name": { + "Veeam Server Name": { "type": "string" }, "Base URL": { "type": "string" }, - "Collect Coveware Findings": { + "Collect Authorization Events": { "type": "string" }, "Key Vault Password ID": { @@ -2976,26 +4513,26 @@ } } }, - "For_each_Coveware_Server": { - "foreach": "@body('Parse_Coveware_Settings')?['properties']?['watchlistItems']", + "For_each_VBR": { + "foreach": "@body('Parse_VBR_settings')?['properties']?['watchlistItems']", "actions": { - "Parse_current_Coveware_Server": { + "Parse_current_VBR": { "type": "ParseJson", "inputs": { - "content": "@items('For_each_Coveware_Server')", + "content": "@items('For_each_VBR')", "schema": { "type": "object", "properties": { "properties.itemsKeyValue": { "type": "object", "properties": { - "Coveware Server Name": { + "Veeam Server Name": { "type": "string" }, "Base URL": { "type": "string" }, - "Collect Coveware Findings": { + "Collect Authorization Events": { "type": "string" }, "Key Vault Password ID": { @@ -3010,22 +4547,22 @@ } } }, - "If_Coveware_findings_collection_is_enabled": { + "If_authorization_events_collection_is_enabled": { "actions": { - "Collect_Coveware_Findings_into_CovewareFindingsTable_CL": { + "Collect_Authorization_Events_into_VeeamAuthorizationEventsTable_CL": { "type": "Function", "inputs": { "queries": { - "covewareServerName": "@body('Parse_current_Coveware_Server')?['properties.itemsKeyValue']?['Coveware Server Name']" + "vbrHostName": "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Veeam Server Name']" }, "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetAllCovewareFindingsAsync')]" + "id": "[[concat(variables('functionAppId'), '/functions/GetAllAuthorizationEventsAsync')]" } } } }, "runAfter": { - "Parse_current_Coveware_Server": [ + "Parse_current_VBR": [ "Succeeded" ] }, @@ -3033,7 +4570,7 @@ "actions": { "Print_baseUrl": { "type": "Compose", - "inputs": "@body('Parse_current_Coveware_Server')?['properties.itemsKeyValue']?['Base URL']" + "inputs": "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Base URL']" } } }, @@ -3041,7 +4578,7 @@ "and": [ { "equals": [ - "@body('Parse_current_Coveware_Server')?['properties.itemsKeyValue']?['Collect Coveware Findings']", + "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Collect Authorization Events']", "true" ] } @@ -3051,7 +4588,7 @@ } }, "runAfter": { - "Parse_Coveware_Settings": [ + "Parse_VBR_settings": [ "Succeeded" ] }, @@ -3080,12 +4617,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId6'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId2'),'/'))))]", "properties": { - "parentId": "[variables('playbookId6')]", - "contentId": "[variables('_playbookContentId6')]", + "parentId": "[variables('playbookId2')]", + "contentId": "[variables('_playbookContentId2')]", "kind": "Playbook", - "version": "[variables('playbookVersion6')]", + "version": "[variables('playbookVersion2')]", "source": { "kind": "Solution", "name": "Veeam", @@ -3105,26 +4642,27 @@ } ], "metadata": { - "title": "Veeam-CollectCovewareFindings", - "description": "This Microsoft Sentinel playbook automatically collects Coveware findings on a schedule. Retrieves Coveware settings from watchlist and calls the GetCovewareFindings function for each enabled server, ingesting the data into custom tables.", + "title": "Veeam-CollectVeeamAuthorizationEvents", + "description": "This Microsoft Sentinel playbook automatically collects Veeam authorization events Veeam Backup & Replication servers on schedule. The playbook gets Veeam Backup & Replication settings from watchlist and calls the GetAllAuthorizationEventsAsync function for each enabled server, ingesting the data into custom tables.", "prerequisites": [ "1. Microsoft Sentinel workspace configured.", "2. Permissions to create Logic Apps and API Connections.", "3. Permissions to assign roles to the Resource Group.", "4. Veeam Azure Function App deployed and configured.", - "5. Coveware Settings watchlist configured in Microsoft Sentinel." + "5. VBR Settings watchlist configured in Microsoft Sentinel.", + "6. Hybrid Connection and Key Vault secrets configured for each VBR Server." ], "tags": [ "Automation", "Veeam", - "Coveware", + "Authorization", "Collection" ], "lastUpdateTime": "2025-08-25T00:00:00Z", "parameterTemplateVersion": "1.0.0", "postDeployment": [ "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", - "2. Ensure the Coveware Settings watchlist is properly configured with 'Collect Coveware Findings' flag set to true." + "2. Ensure the VBR Settings watchlist is properly configured with the 'Collect Authorization Events' flag set to true on servers from which you want to collect data." ], "releaseNotes": { "version": "1.0", @@ -3140,38 +4678,38 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId6')]", + "contentId": "[variables('_playbookContentId2')]", "contentKind": "Playbook", - "displayName": "Veeam-CollectCovewareFindings", - "contentProductId": "[variables('_playbookcontentProductId6')]", - "id": "[variables('_playbookcontentProductId6')]", - "version": "[variables('playbookVersion6')]" + "displayName": "Veeam-CollectVeeamAuthorizationEvents", + "contentProductId": "[variables('_playbookcontentProductId2')]", + "id": "[variables('_playbookcontentProductId2')]", + "version": "[variables('playbookVersion2')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName7')]", + "name": "[variables('playbookTemplateSpecName3')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-CollectConfigurationBackups Playbook with template version 3.0.3", + "description": "Veeam-CollectSecurityComplianceAnalyzerResult Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion7')]", + "contentVersion": "[variables('playbookVersion3')]", "parameters": { "PlaybookName": { - "defaultValue": "Veeam-CollectConfigurationBackups", + "defaultValue": "Veeam-CollectSecurityComplianceAnalyzerResult", "type": "string", "metadata": { "description": "Name of the playbook (Logic App) to be created" } }, "functionAppName": { - "type": "string", "defaultValue": "", + "type": "string", "metadata": { "description": "Name of the Azure Function App for Veeam integration" } @@ -3183,30 +4721,23 @@ "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" } }, - "subscriptionId": { + "AzureSentinelConnectionName": { + "defaultValue": "azuresentinel-connection", "type": "string", - "defaultValue": "[subscription().subscriptionId]", "metadata": { - "description": "Subscription ID where resources are deployed" + "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" } }, "resourceGroupName": { - "type": "string", "defaultValue": "[resourceGroup().name]", - "metadata": { - "description": "Resource group name where Function App is deployed" - } - }, - "AzureSentinelConnectionName": { - "defaultValue": "azuresentinel-connection", "type": "string", "metadata": { - "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" + "description": "Name of the resource group containing the Microsoft Sentinel workspace" } } }, "variables": { - "functionAppId": "[[resourceId(parameters('subscriptionId'), parameters('resourceGroupName'), 'Microsoft.Web/sites', parameters('functionAppName'))]", + "functionAppId": "[[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]", "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "_connection-1": "[[variables('connection-1')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", @@ -3236,7 +4767,7 @@ "type": "SystemAssigned" }, "tags": { - "hidden-SentinelTemplateName": "Veeam-StartConfigurationBackup", + "hidden-SentinelTemplateName": "Veeam-CollectSecurityComplianceAnalyzerResult", "hidden-SentinelTemplateVersion": "1.0", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, @@ -3265,17 +4796,25 @@ "type": "String" }, "subscriptionId": { - "defaultValue": "[[parameters('subscriptionId')]", + "defaultValue": "[[subscription().subscriptionId]", + "type": "String" + }, + "VbrHostName": { + "defaultValue": "vbr1", "type": "String" } }, "triggers": { - "Every_24_Hours": { - "type": "Recurrence", + "Every_24_hours": { "recurrence": { "interval": 24, "frequency": "Hour" - } + }, + "evaluatedRecurrence": { + "interval": 24, + "frequency": "Hour" + }, + "type": "Recurrence" } }, "actions": { @@ -3320,7 +4859,7 @@ "Base URL": { "type": "string" }, - "Collect Configuration Backups": { + "Collect Security and Compliance Analyzer Results": { "type": "string" }, "Key Vault Password ID": { @@ -3340,13 +4879,13 @@ } } }, - "For_each_VBR_server": { + "For_each_VBR": { "foreach": "@body('Parse_VBR_settings')?['properties']?['watchlistItems']", "actions": { - "Parse_current_VBR_server": { + "Parse_current_VBR": { "type": "ParseJson", "inputs": { - "content": "@items('For_each_VBR_server')", + "content": "@items('For_each_VBR')", "schema": { "type": "object", "properties": { @@ -3359,7 +4898,7 @@ "Base URL": { "type": "string" }, - "Collect Configuration Backups": { + "Collect Security and Compliance Analyzer Results": { "type": "string" }, "Key Vault Password ID": { @@ -3374,263 +4913,39 @@ } } }, - "If_configuration_backup_collection_is_enabled": { + "If_best_practice_analysis_collection_is_enabled": { "actions": { - "StartConfigurationBackupAsync": { + "Collect_Best_Practice_Analysis_into_VeeamBestPracticeAnalysisTable_CL": { "type": "Function", "inputs": { "queries": { - "vbrHostName": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']" + "vbrHostName": "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Veeam Server Name']" }, "function": { - "id": "[[concat(variables('functionAppId'), '/functions/StartConfigurationBackupAsync')]" + "id": "[[concat(variables('functionAppId'), '/functions/GetSecurityComplianceAnalyzerResultsAsync')]" } } - }, - "Parse_sessionId": { - "runAfter": { - "StartConfigurationBackupAsync": [ - "Succeeded" - ] - }, - "type": "ParseJson", - "inputs": { - "content": "@outputs('StartConfigurationBackupAsync')", - "schema": { - "type": "object", - "properties": { - "statusCode": { - "type": "integer" - }, - "headers": { - "type": "object", - "properties": { - "Date": { - "type": "string" - }, - "Transfer-Encoding": { - "type": "string" - }, - "Strict-Transport-Security": { - "type": "string" - }, - "x-ms-middleware-request-id": { - "type": "string" - }, - "Content-Type": { - "type": "string" - }, - "Content-Length": { - "type": "string" - } - } - }, - "body": { - "type": "object", - "properties": { - "sessionType": { - "type": "integer" - }, - "state": { - "type": "integer" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "jobId": { - "type": "string" - }, - "creationTime": { - "type": "string" - }, - "progressPercent": { - "type": "integer" - }, - "result": { - "type": "object", - "properties": { - "result": { - "type": "integer" - }, - "message": { - "type": "string" - }, - "isCanceled": { - "type": "boolean" - } - } - }, - "usn": { - "type": "integer" - } - } - } - } - } - } - }, - "Until_state_is_not_stopped": { - "actions": { - "GetSession": { - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']", - "sessionId": "@body('Parse_sessionId')?['body']?['id']" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetSessionAsync')]" - } - } - }, - "Parse_session": { - "runAfter": { - "GetSession": [ - "Succeeded" - ] - }, - "type": "ParseJson", - "inputs": { - "content": "@outputs('GetSession')", - "schema": { - "type": "object", - "properties": { - "statusCode": { - "type": "integer" - }, - "headers": { - "type": "object", - "properties": { - "Date": { - "type": "string" - }, - "Transfer-Encoding": { - "type": "string" - }, - "Request-Context": { - "type": "string" - }, - "Content-Type": { - "type": "string" - }, - "Content-Length": { - "type": "string" - } - } - }, - "body": { - "type": "object", - "properties": { - "sessionType": { - "type": "integer" - }, - "state": { - "type": "integer" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "jobId": { - "type": "string" - }, - "creationTime": { - "type": "string" - }, - "progressPercent": { - "type": "integer" - }, - "result": { - "type": "object", - "properties": { - "result": { - "type": "integer" - }, - "message": { - "type": "string" - }, - "isCanceled": { - "type": "boolean" - } - } - }, - "usn": { - "type": "integer" - } - } - } - } - } - } - }, - "Delay": { - "runAfter": { - "Parse_session": [ - "Succeeded" - ] - }, - "type": "Wait", - "inputs": { - "interval": { - "count": 1, - "unit": "Minute" - } - } - } - }, - "runAfter": { - "Parse_sessionId": [ - "Succeeded" - ] - }, - "expression": "@equals(body('Parse_session')?['body']?['state'],1)", - "limit": { - "timeout": "PT30M" - }, - "type": "Until" - }, - "IngestSessionDataBySessionIdAsync": { - "runAfter": { - "Until_state_is_not_stopped": [ - "Succeeded" - ] - }, - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']", - "sessionId": "@body('Parse_sessionId')?['body']?['id']" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/IngestSessionDataBySessionIdAsync')]" - } - } - } - }, - "runAfter": { - "Parse_current_VBR_server": [ - "Succeeded" - ] - }, - "else": { - "actions": { - "Print_server_info": { - "type": "Compose", - "inputs": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']" - } - } - }, - "expression": { - "and": [ - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups']", - "true" + } + }, + "runAfter": { + "Parse_current_VBR": [ + "Succeeded" + ] + }, + "else": { + "actions": { + "Print_baseUrl": { + "type": "Compose", + "inputs": "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Base URL']" + } + } + }, + "expression": { + "and": [ + { + "equals": [ + "@body('Parse_current_VBR')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results']", + "true" ] } ] @@ -3668,12 +4983,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId7'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId3'),'/'))))]", "properties": { - "parentId": "[variables('playbookId7')]", - "contentId": "[variables('_playbookContentId7')]", + "parentId": "[variables('playbookId3')]", + "contentId": "[variables('_playbookContentId3')]", "kind": "Playbook", - "version": "[variables('playbookVersion7')]", + "version": "[variables('playbookVersion3')]", "source": { "kind": "Solution", "name": "Veeam", @@ -3693,8 +5008,8 @@ } ], "metadata": { - "title": "Veeam-CollectConfigurationBackups", - "description": "A Microsoft Sentinel playbook that automatically runs configuration backup sessions on Veeam Backup & Replication servers on schedule. The playbook gets Veeam Backup & Replication settings from the watchlist, runs the configuration backup session, and collects the session result.", + "title": "Veeam-CollectSecurityComplianceAnalyzerResult", + "description": "A Microsoft Sentinel playbook that automatically collects Veeam Security Compliance Analyzer results from Veeam Backup & Replication servers on schedule. The playbook gets Veeam Backup & Replication settings from watchlist and calls the GetSecurityComplianceAnalyzerResults function for each enabled server, ingesting the data into custom tables.", "prerequisites": [ "1. Microsoft Sentinel workspace configured.", "2. Permissions to create Logic Apps and API Connections.", @@ -3706,21 +5021,16 @@ "tags": [ "Automation", "Veeam", - "Configuration", - "Backup", - "Scheduled" + "BestPractice", + "Analysis", + "Collection" ], "lastUpdateTime": "2025-08-25T00:00:00Z", "parameterTemplateVersion": "1.0.0", "postDeployment": [ "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", - "2. Ensure the VBR Settings watchlist is properly configured with the 'Collect Configuration Backups' flag set to true on servers from which you want to collect data." + "2. Ensure the VBR Settings watchlist is properly configured with the 'Collect Security and Compliance Analyzer Results' flag set to true on servers from which you want to collect data." ], - "_generator": { - "name": "bicep", - "version": "0.36.177.2456", - "templateHash": "8701067040678761767" - }, "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", @@ -3735,48 +5045,62 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId7')]", + "contentId": "[variables('_playbookContentId3')]", "contentKind": "Playbook", - "displayName": "Veeam-CollectConfigurationBackups", - "contentProductId": "[variables('_playbookcontentProductId7')]", - "id": "[variables('_playbookcontentProductId7')]", - "version": "[variables('playbookVersion7')]" + "displayName": "Veeam-CollectSecurityComplianceAnalyzerResult", + "contentProductId": "[variables('_playbookcontentProductId3')]", + "id": "[variables('_playbookcontentProductId3')]", + "version": "[variables('playbookVersion3')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName8')]", + "name": "[variables('playbookTemplateSpecName4')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-FindCleanRestorePoints Playbook with template version 3.0.3", + "description": "Veeam-CollectMalwareEvents Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion8')]", + "contentVersion": "[variables('playbookVersion4')]", "parameters": { "PlaybookName": { - "defaultValue": "Veeam-FindCleanRestorePoints", + "defaultValue": "Veeam-CollectMalwareEvents", "type": "string", "metadata": { "description": "Name of the playbook (Logic App) to be created" } }, "functionAppName": { - "type": "string", "defaultValue": "", + "type": "string", "metadata": { "description": "Name of the Azure Function App for Veeam integration" } }, - "AzureSentinelConnectionName": { + "workspaceId": { + "defaultValue": "", "type": "string", + "metadata": { + "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" + } + }, + "AzureSentinelConnectionName": { "defaultValue": "azuresentinel-connection", + "type": "string", "metadata": { "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" } + }, + "resourceGroupName": { + "defaultValue": "[resourceGroup().name]", + "type": "string", + "metadata": { + "description": "Name of the resource group containing the Microsoft Sentinel workspace" + } } }, "variables": { @@ -3810,7 +5134,7 @@ "type": "SystemAssigned" }, "tags": { - "hidden-SentinelTemplateName": "Veeam-FindCleanRestorePoints", + "hidden-SentinelTemplateName": "Veeam-CollectMalwareEvents", "hidden-SentinelTemplateVersion": "1.0", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, @@ -3825,263 +5149,179 @@ "parameters": { "$connections": { "type": "Object" + }, + "functionAppName": { + "defaultValue": "[[parameters('functionAppName')]", + "type": "String" + }, + "workspaceId": { + "defaultValue": "[[parameters('workspaceId')]", + "type": "String" + }, + "resourceGroupName": { + "defaultValue": "[[parameters('resourceGroupName')]", + "type": "String" + }, + "subscriptionId": { + "defaultValue": "[[subscription().subscriptionId]", + "type": "String" } }, "triggers": { - "Microsoft_Sentinel_incident": { - "type": "ApiConnectionWebhook", + "Every_1_day": { + "recurrence": { + "interval": 1, + "frequency": "Day" + }, + "evaluatedRecurrence": { + "interval": 1, + "frequency": "Day" + }, + "type": "Recurrence" + } + }, + "actions": { + "Watchlists_-_Get_VBR_Settings": { + "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, - "body": { - "callback_url": "@{listCallbackUrl()}" - }, - "path": "/incident-creation" + "method": "get", + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItems" } - } - }, - "actions": { - "Parse_custom_fields": { - "foreach": "@triggerBody()?['object']?['properties']?['Alerts']", - "actions": { - "Parse_JSON": { - "type": "ParseJson", - "inputs": { - "content": "@items('Parse_custom_fields')?['properties']?['additionalData']?['Custom Details']", - "schema": { + }, + "Parse_VBR_settings": { + "runAfter": { + "Watchlists_-_Get_VBR_Settings": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Watchlists_-_Get_VBR_Settings')", + "schema": { + "type": "object", + "properties": { + "properties": { "type": "object", "properties": { - "VbrHostName": { - "type": "array", - "items": { - "type": "string" - } - }, - "MachineDisplayName": { - "type": "array", - "items": { - "type": "string" - } - }, - "MachineUuid": { - "type": "array", - "items": { - "type": "string" - } - }, - "BackupObjectId": { + "watchlistItems": { "type": "array", "items": { - "type": "string" + "type": "object", + "properties": { + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Malware Events": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + } + } + } + } } } } } } - }, - "For_each_alert": { - "foreach": "@outputs('Parse_JSON')?['body']?['VbrHostName']", - "actions": { - "Set_variable_VbrHostName": { - "type": "SetVariable", - "inputs": { - "name": "VbrHostName", - "value": "@items('For_each_alert')" - } - } - }, - "runAfter": { - "Parse_JSON": [ - "Succeeded" - ] - }, - "type": "Foreach" - }, - "For_each_alert_2": { - "foreach": "@outputs('Parse_JSON')?['body']?['MachineDisplayName']", - "actions": { - "Set_variable_MachineDisplayName": { - "type": "SetVariable", - "inputs": { - "name": "MachineDisplayName", - "value": "@item()" - } - } - }, - "runAfter": { - "For_each_alert": [ - "Succeeded" - ] - }, - "type": "Foreach" - } - }, - "runAfter": { - "Initialize_MachineDisplayName": [ - "Succeeded" - ] - }, - "type": "Foreach" - }, - "Initialize_VbrHostName": { - "type": "InitializeVariable", - "inputs": { - "variables": [ - { - "name": "VbrHostName", - "type": "string" - } - ] - } - }, - "GetLastCleanRestorePoint": { - "runAfter": { - "Parse_custom_fields": [ - "Succeeded" - ] - }, - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@variables('VbrHostName')", - "VmName": "@variables('MachineDisplayName')" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetCleanRestorePointsAsync')]" } } }, - "Are_there_any_clean_restore_points": { + "For_each_VBR_server": { + "foreach": "@body('Parse_VBR_settings')?['properties']?['watchlistItems']", "actions": { - "Parse_restore_point": { + "Parse_current_VBR_server": { "type": "ParseJson", "inputs": { - "content": "@body('GetLastCleanRestorePoint')", + "content": "@items('For_each_VBR_server')", "schema": { "type": "object", "properties": { - "platformName": { - "type": "integer" - }, - "type": { - "type": "integer" - }, - "malwareStatus": { - "type": "integer" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "platformId": { - "type": "string" - }, - "creationTime": { - "type": "string" - }, - "backupId": { - "type": "string" - }, - "sessionId": { - "type": "string" - }, - "allowedOperations": { - "type": "array", - "items": { - "type": "integer" + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Malware Events": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + } } - }, - "backupFileId": { - "type": "string" } } } } }, - "Add_last_restore_point_comment": { + "If_malware_event_collection_is_enabled": { + "actions": { + "Collect_Malware_Events_into_VeeamMalwareEventsTable_CL": { + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/GetAllMalwareEventsAsync')]" + } + } + } + }, "runAfter": { - "Parse_restore_point": [ + "Parse_current_VBR_server": [ "Succeeded" ] }, - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" + "else": { + "actions": { + "Print_baseUrl": { + "type": "Compose", + "inputs": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Base URL']" } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Last clean restore point was created on @{variables('VbrHostName')} on @{body('Parse_restore_point')?['creationTime']}

" - }, - "path": "/Incidents/Comment" - } - } - }, - "runAfter": { - "GetLastCleanRestorePoint": [ - "Succeeded", - "TimedOut", - "Skipped", - "Failed" - ] - }, - "else": { - "actions": { - "Add_no_restore_points_comment": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

No restore points were found on @{variables('VbrHostName')}

" - }, - "path": "/Incidents/Comment" } - } + }, + "expression": { + "and": [ + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events']", + "true" + ] + } + ] + }, + "type": "If" } }, - "expression": { - "and": [ - { - "not": { - "equals": [ - "@outputs('GetLastCleanRestorePoint')?['statusCode']", - 404 - ] - } - } - ] - }, - "type": "If" - }, - "Initialize_MachineDisplayName": { "runAfter": { - "Initialize_VbrHostName": [ + "Parse_VBR_settings": [ "Succeeded" ] }, - "type": "InitializeVariable", - "inputs": { - "variables": [ - { - "name": "MachineDisplayName", - "type": "string" - } - ] - } + "type": "Foreach" } } }, @@ -4106,12 +5346,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId8'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId4'),'/'))))]", "properties": { - "parentId": "[variables('playbookId8')]", - "contentId": "[variables('_playbookContentId8')]", + "parentId": "[variables('playbookId4')]", + "contentId": "[variables('_playbookContentId4')]", "kind": "Playbook", - "version": "[variables('playbookVersion8')]", + "version": "[variables('playbookVersion4')]", "source": { "kind": "Solution", "name": "Veeam", @@ -4131,32 +5371,28 @@ } ], "metadata": { - "title": "Veeam-FindCleanRestorePoints", - "description": "A Microsoft Sentinel playbook with the incident trigger, that finds the last clean restore point for VM, specified in the incident by VbrHostName and MachineDisplayName. If finds a clean restore point, adds its date as incident's comment, and if a clean restore point is not found, adds a comment indicating that.", + "title": "Veeam-CollectMalwareEvents", + "description": "A Microsoft Sentinel playbook that automatically collects malware events from Veeam Backup & Replication servers on a schedule. The playbook gets Veeam Backup & Replication settings from watchlist and calls the GetMalwareEvents function for each enabled server, ingesting the data into custom tables.", "prerequisites": [ "1. Microsoft Sentinel workspace configured.", "2. Permissions to create Logic Apps and API Connections.", "3. Permissions to assign roles to the Resource Group.", "4. Veeam Azure Function App deployed and configured.", - "5. Hybrid Connection and Key Vault secrets configured for each VBR Server." + "5. VBR Settings watchlist configured in Microsoft Sentinel.", + "6. Hybrid Connection and Key Vault secrets configured for each VBR Server." ], "tags": [ "Automation", "Veeam", - "Backup", - "RestorePoints", - "Recovery" + "Malware", + "Collection" ], "lastUpdateTime": "2025-08-25T00:00:00Z", "parameterTemplateVersion": "1.0.0", "postDeployment": [ - "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace." + "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", + "2. Ensure the VBR Settings watchlist is properly configured with the 'Collect Malware Events' flag set to true on servers from which you want to collect data." ], - "_generator": { - "name": "bicep", - "version": "0.36.177.2456", - "templateHash": "8701067040678761767" - }, "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", @@ -4171,47 +5407,61 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId8')]", + "contentId": "[variables('_playbookContentId4')]", "contentKind": "Playbook", - "displayName": "Veeam-FindCleanRestorePoints", - "contentProductId": "[variables('_playbookcontentProductId8')]", - "id": "[variables('_playbookcontentProductId8')]", - "version": "[variables('playbookVersion8')]" + "displayName": "Veeam-CollectMalwareEvents", + "contentProductId": "[variables('_playbookcontentProductId4')]", + "id": "[variables('_playbookcontentProductId4')]", + "version": "[variables('playbookVersion4')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName9')]", + "name": "[variables('playbookTemplateSpecName5')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-PerformScanBackup Playbook with template version 3.0.3", + "description": "Veeam-CollectVeeamONEAlarms Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion9')]", + "contentVersion": "[variables('playbookVersion5')]", "parameters": { "PlaybookName": { - "defaultValue": "Veeam-PerformScanBackup", + "defaultValue": "Veeam-CollectVeeamONEAlarms", "type": "string", "metadata": { "description": "Name of the playbook (Logic App) to be created" } }, "functionAppName": { - "type": "string", "defaultValue": "", + "type": "string", "metadata": { "description": "Name of the Azure Function App for Veeam integration" } }, - "AzureSentinelConnectionName": { + "workspaceId": { + "defaultValue": "", "type": "string", - "defaultValue": "azuresentinel-connection", "metadata": { - "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" + "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" + } + }, + "AzureSentinelConnectionName": { + "defaultValue": "azuresentinel-connection", + "type": "string", + "metadata": { + "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" + } + }, + "resourceGroupName": { + "defaultValue": "[resourceGroup().name]", + "type": "string", + "metadata": { + "description": "Name of the resource group containing the Microsoft Sentinel workspace" } } }, @@ -4246,7 +5496,7 @@ "type": "SystemAssigned" }, "tags": { - "hidden-SentinelTemplateName": "Veeam-PerformScanBackup", + "hidden-SentinelTemplateName": "Veeam-CollectVeeamONEAlarms", "hidden-SentinelTemplateVersion": "1.0", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, @@ -4259,79 +5509,98 @@ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", "contentVersion": "1.0.0.0", "parameters": { - "IsYara": { - "defaultValue": true, - "type": "Bool" + "$connections": { + "type": "Object" }, - "TimeRange": { - "defaultValue": "1w1d", + "functionAppName": { + "defaultValue": "[[parameters('functionAppName')]", "type": "String" }, - "VbrHostName": { - "defaultValue": "vbr1", + "workspaceId": { + "defaultValue": "[[parameters('workspaceId')]", "type": "String" }, - "$connections": { - "type": "Object" + "resourceGroupName": { + "defaultValue": "[[parameters('resourceGroupName')]", + "type": "String" + }, + "subscriptionId": { + "defaultValue": "[[subscription().subscriptionId]", + "type": "String" + }, + "VoneHostName": { + "defaultValue": "vone1", + "type": "String" } }, "triggers": { - "Microsoft_Sentinel_incident": { - "type": "ApiConnectionWebhook", + "Every_1_day": { + "recurrence": { + "interval": 1, + "frequency": "Day" + }, + "evaluatedRecurrence": { + "interval": 1, + "frequency": "Day" + }, + "type": "Recurrence" + } + }, + "actions": { + "Watchlists_-_Get_Veeam_ONE_Settings": { + "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, - "body": { - "callback_url": "@listCallbackUrl()" - }, - "path": "/incident-creation" + "method": "get", + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vone_settings')}/watchlistItems" } - } - }, - "actions": { - "Parse_sessionId": { + }, + "Parse_Veeam_ONE_settings": { "runAfter": { - "Add_comment_to_incident": [ + "Watchlists_-_Get_Veeam_ONE_Settings": [ "Succeeded" ] }, "type": "ParseJson", "inputs": { - "content": "@outputs('StartBackupScanAV')", + "content": "@body('Watchlists_-_Get_Veeam_ONE_Settings')", "schema": { "type": "object", "properties": { - "statusCode": { - "type": "integer" - }, - "headers": { - "type": "object", - "properties": { - "Date": { - "type": "string" - }, - "Transfer-Encoding": { - "type": "string" - }, - "Request-Context": { - "type": "string" - }, - "Content-Type": { - "type": "string" - }, - "Content-Length": { - "type": "string" - } - } - }, - "body": { + "properties": { "type": "object", "properties": { - "sessionId": { - "type": "string" + "watchlistItems": { + "type": "array", + "items": { + "type": "object", + "properties": { + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Alarms": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + } + } + } + } + } } } } @@ -4339,320 +5608,86 @@ } } }, - "Until_state_is_not_Stopped": { + "For_each_Veeam_ONE_server": { + "foreach": "@body('Parse_Veeam_ONE_settings')?['properties']?['watchlistItems']", "actions": { - "Parse_session": { - "runAfter": { - "GetSession_": [ - "Succeeded" - ] - }, + "Parse_current_Veeam_ONE_server": { "type": "ParseJson", "inputs": { - "content": "@body('GetSession_')", + "content": "@items('For_each_Veeam_ONE_server')", "schema": { "type": "object", "properties": { - "sessionType": { - "type": "integer" - }, - "state": { - "type": "integer" - }, - "platformName": { - "type": "integer" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "jobId": { - "type": "string" - }, - "creationTime": { - "type": "string" - }, - "progressPercent": { - "type": "integer" - }, - "result": { + "properties.itemsKeyValue": { "type": "object", "properties": { - "result": { - "type": "integer" + "Veeam Server Name": { + "type": "string" }, - "message": { + "Base URL": { "type": "string" }, - "isCanceled": { - "type": "boolean" + "Collect Alarms": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" } } - }, - "usn": { - "type": "integer" - }, - "platformId": { - "type": "string" } } } } }, - "GetSession_": { - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@variables('VbrHostName')", - "sessionId": "@body('Parse_sessionId')?['body']?['sessionId']" - }, - "function": { - "id": "[[format('{0}/functions/GetSessionAsync', variables('functionAppId'))]" + "If_alarm_collection_is_enabled": { + "actions": { + "Collect_Vone_Alarms_into_VoneAlarmsTable_CL": { + "type": "Function", + "inputs": { + "queries": { + "voneHostName": "@body('Parse_current_Veeam_ONE_server')?['properties.itemsKeyValue']?['Veeam Server Name']" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/GetAllTriggeredAlarmsAsync')]" + } + } } - } - }, - "Delay": { + }, "runAfter": { - "Parse_session": [ + "Parse_current_Veeam_ONE_server": [ "Succeeded" ] }, - "type": "Wait", - "inputs": { - "interval": { - "count": 3, - "unit": "Minute" + "else": { + "actions": { + "Print_baseUrl": { + "type": "Compose", + "inputs": "@body('Parse_current_Veeam_ONE_server')?['properties.itemsKeyValue']?['Base URL']" + } } - } + }, + "expression": { + "and": [ + { + "equals": [ + "@body('Parse_current_Veeam_ONE_server')?['properties.itemsKeyValue']?['Collect Alarms']", + "true" + ] + } + ] + }, + "type": "If" } }, "runAfter": { - "Parse_sessionId": [ - "Succeeded" - ] - }, - "expression": "@equals(body('Parse_session')?['state'],1)", - "limit": { - "timeout": "PT3H" - }, - "type": "Until" - }, - "Get_variables_from_custom_fields": { - "foreach": "@triggerBody()?['object']?['properties']?['Alerts']", - "actions": { - "Parse_custom_fields": { - "type": "ParseJson", - "inputs": { - "content": "@items('Get_variables_from_custom_fields')?['properties']?['additionalData']?['Custom Details']", - "schema": { - "type": "object", - "properties": { - "VbrHostName": { - "type": "array", - "items": { - "type": "string" - } - }, - "MachineDisplayName": { - "type": "array", - "items": { - "type": "string" - } - }, - "MachineUuid": { - "type": "array", - "items": { - "type": "string" - } - }, - "BackupObjectId": { - "type": "array", - "items": { - "type": "string" - } - } - } - } - } - }, - "Get_VbrHostName": { - "foreach": "@outputs('Parse_custom_fields')?['body']?['VbrHostName']", - "actions": { - "Set_VbrHostName": { - "type": "SetVariable", - "inputs": { - "name": "VbrHostName", - "value": "@items('Get_VbrHostName')" - } - } - }, - "runAfter": { - "Parse_custom_fields": [ - "Succeeded" - ] - }, - "type": "Foreach" - }, - "Get_BackupObjectId": { - "foreach": "@outputs('Parse_custom_fields')?['body']?['BackupObjectId']", - "actions": { - "Set_BackupObjectId": { - "type": "SetVariable", - "inputs": { - "name": "BackupObjectId", - "value": "@items('Get_BackupObjectId')" - } - } - }, - "runAfter": { - "Get_VbrHostName": [ - "Succeeded" - ] - }, - "type": "Foreach" - }, - "Get_MachineDispalyName": { - "foreach": "@body('Parse_custom_fields')?['MachineDisplayName']", - "actions": { - "Set_MachineDispalyName": { - "type": "SetVariable", - "inputs": { - "name": "MachineDisplayName", - "value": "@items('Get_MachineDispalyName')" - } - } - }, - "runAfter": { - "Get_BackupObjectId": [ - "Succeeded" - ] - }, - "type": "Foreach" - } - }, - "runAfter": { - "Initialize_MachineDisplayName": [ + "Parse_Veeam_ONE_settings": [ "Succeeded" ] }, "type": "Foreach" - }, - "Initialize_VbrHostName": { - "type": "InitializeVariable", - "inputs": { - "variables": [ - { - "name": "VbrHostName", - "type": "string", - "value": "none" - } - ] - } - }, - "StartBackupScanAV": { - "runAfter": { - "Get_variables_from_custom_fields": [ - "Succeeded" - ] - }, - "type": "Function", - "inputs": { - "queries": { - "VbrHostName": "@variables('VbrHostName')", - "backupObjectId": "@variables('BackupObjectId')", - "vmName": "@variables('MachineDisplayName')" - }, - "function": { - "id": "[[format('{0}/functions/StartBackupScanAV', variables('functionAppId'))]" - } - } - }, - "Initialize_BackupObjectId": { - "runAfter": { - "Initialize_VbrHostName": [ - "Succeeded" - ] - }, - "type": "InitializeVariable", - "inputs": { - "variables": [ - { - "name": "BackupObjectId", - "type": "string", - "value": "none" - } - ] - } - }, - "Initialize_MachineDisplayName": { - "runAfter": { - "Initialize_BackupObjectId": [ - "Succeeded" - ] - }, - "type": "InitializeVariable", - "inputs": { - "variables": [ - { - "name": "MachineDisplayName", - "type": "string", - "value": "none" - } - ] - } - }, - "Add_comment_to_incident_(V3)": { - "runAfter": { - "Result": [ - "Succeeded" - ] - }, - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

AV scan for @{variables('MachineDisplayName')} has finished. Details: @{body('Parse_session')?['result']?['message']}.

Incident has been resolved, so you can close it.

" - }, - "path": "/Incidents/Comment" - } - }, - "Result": { - "runAfter": { - "Until_state_is_not_Stopped": [ - "Succeeded" - ] - }, - "type": "Compose", - "inputs": "@body('Parse_session')?['result']" - }, - "Add_comment_to_incident": { - "runAfter": { - "StartBackupScanAV": [ - "Succeeded" - ] - }, - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

AV scan for @{variables('MachineDisplayName')} has been started.

" - }, - "path": "/Incidents/Comment" - } } } }, @@ -4662,7 +5697,7 @@ "azuresentinel": { "connectionName": "[[parameters('AzureSentinelConnectionName')]", "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", - "id": "[[format('/subscriptions/{0}/providers/Microsoft.Web/locations/{1}/managedApis/azuresentinel', subscription().subscriptionId, variables('workspace-location-inline'))]", + "id": "[[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/',variables('workspace-location-inline'),'/managedApis/azuresentinel')]", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" @@ -4677,12 +5712,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId9'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId5'),'/'))))]", "properties": { - "parentId": "[variables('playbookId9')]", - "contentId": "[variables('_playbookContentId9')]", + "parentId": "[variables('playbookId5')]", + "contentId": "[variables('_playbookContentId5')]", "kind": "Playbook", - "version": "[variables('playbookVersion9')]", + "version": "[variables('playbookVersion5')]", "source": { "kind": "Solution", "name": "Veeam", @@ -4702,26 +5737,28 @@ } ], "metadata": { - "title": "Veeam-PerformScanBackup", - "description": "This Microsoft Sentinel playbook with an incident trigger performs antivirus scan on Veeam backup using VbrHostName, BackupObjectId, MachineDisplayName custom incident fields to identify backup. Indicates results as incident comments.", + "title": "Veeam-CollectVeeamONEAlarms", + "description": "This Microsoft Sentinel playbook automatically collects Veeam ONE alarms on a schedule. Retrieves Veeam ONE settings from the watchlist and calls the GetVoneAlarms function for each enabled server, ingesting the data into custom tables.", "prerequisites": [ "1. Microsoft Sentinel workspace configured.", "2. Permissions to create Logic Apps and API Connections.", "3. Permissions to assign roles to the Resource Group.", "4. Veeam Azure Function App deployed and configured.", - "5. Hybrid Connection and Key Vault secrets configured for each VBR Server." + "5. Veeam ONE Settings watchlist configured in Microsoft Sentinel.", + "6. Hybrid Connection and Key Vault secrets configured for each Veeam ONE Server." ], "tags": [ "Automation", "Veeam", - "Backup", - "Antivirus", - "Scan" + "VeeamONE", + "Alarms", + "Collection" ], "lastUpdateTime": "2025-08-25T00:00:00Z", "parameterTemplateVersion": "1.0.0", "postDeployment": [ - "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace." + "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", + "2. Ensure the Veeam ONE Settings watchlist is properly configured with the 'Collect Alarms' flag set to true on servers from which you want to collect data." ], "releaseNotes": { "version": "1.0", @@ -4737,47 +5774,61 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId9')]", + "contentId": "[variables('_playbookContentId5')]", "contentKind": "Playbook", - "displayName": "Veeam-PerformScanBackup", - "contentProductId": "[variables('_playbookcontentProductId9')]", - "id": "[variables('_playbookcontentProductId9')]", - "version": "[variables('playbookVersion9')]" + "displayName": "Veeam-CollectVeeamONEAlarms", + "contentProductId": "[variables('_playbookcontentProductId5')]", + "id": "[variables('_playbookcontentProductId5')]", + "version": "[variables('playbookVersion5')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName10')]", + "name": "[variables('playbookTemplateSpecName6')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-PerformInstantVMRecovery Playbook with template version 3.0.3", + "description": "Veeam-CollectCovewareFindings Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion10')]", + "contentVersion": "[variables('playbookVersion6')]", "parameters": { "PlaybookName": { - "defaultValue": "Veeam-PerformInstantVMRecovery", + "defaultValue": "Veeam-CollectCovewareFindings", "type": "string", "metadata": { "description": "Name of the playbook (Logic App) to be created" } }, "functionAppName": { - "type": "string", "defaultValue": "", + "type": "string", "metadata": { "description": "Name of the Azure Function App for Veeam integration" } }, - "AzureSentinelConnectionName": { + "workspaceId": { + "defaultValue": "", "type": "string", - "defaultValue": "azuresentinel-connection", "metadata": { - "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" + "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" + } + }, + "AzureSentinelConnectionName": { + "defaultValue": "azuresentinel-connection", + "type": "string", + "metadata": { + "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" + } + }, + "resourceGroupName": { + "defaultValue": "[resourceGroup().name]", + "type": "string", + "metadata": { + "description": "Name of the resource group containing the Microsoft Sentinel workspace" } } }, @@ -4812,7 +5863,7 @@ "type": "SystemAssigned" }, "tags": { - "hidden-SentinelTemplateName": "Veeam-PerformInstantVMRecovery", + "hidden-SentinelTemplateName": "Veeam-CollectCovewareFindings", "hidden-SentinelTemplateVersion": "1.0", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, @@ -4823,329 +5874,464 @@ "state": "Enabled", "definition": { "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", - "contentVersion": "1.0.1.0", + "contentVersion": "1.0.0.0", "parameters": { "$connections": { "type": "Object" + }, + "functionAppName": { + "defaultValue": "[[parameters('functionAppName')]", + "type": "String" + }, + "workspaceId": { + "defaultValue": "[[parameters('workspaceId')]", + "type": "String" + }, + "resourceGroupName": { + "defaultValue": "[[parameters('resourceGroupName')]", + "type": "String" + }, + "subscriptionId": { + "defaultValue": "[[subscription().subscriptionId]", + "type": "String" + }, + "Coveware Server Name": { + "defaultValue": "CovewareServer01", + "type": "String" } }, "triggers": { - "Microsoft_Sentinel_incident": { - "type": "ApiConnectionWebhook", + "Every_6_hours": { + "recurrence": { + "interval": 6, + "frequency": "Hour" + }, + "evaluatedRecurrence": { + "interval": 6, + "frequency": "Hour" + }, + "type": "Recurrence" + } + }, + "actions": { + "Watchlists_-_Get_Coveware_Settings": { + "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, - "body": { - "callback_url": "@listCallbackUrl()" - }, - "path": "/incident-creation" - } - } - }, - "actions": { - "Initialize_VbrHostName": { - "type": "InitializeVariable", - "inputs": { - "variables": [ - { - "name": "VbrHostName", - "type": "string", - "value": "none" - } - ] + "method": "get", + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('coveware_settings')}/watchlistItems" } }, - "Initialize_MachineDisplayName": { + "Parse_Coveware_Settings": { "runAfter": { - "Initialize_VbrHostName": [ + "Watchlists_-_Get_Coveware_Settings": [ "Succeeded" ] }, - "type": "InitializeVariable", + "type": "ParseJson", "inputs": { - "variables": [ - { - "name": "MachineDisplayName", - "type": "string", - "value": "none" + "content": "@body('Watchlists_-_Get_Coveware_Settings')", + "schema": { + "type": "object", + "properties": { + "properties": { + "type": "object", + "properties": { + "watchlistItems": { + "type": "array", + "items": { + "type": "object", + "properties": { + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Coveware Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Coveware Findings": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + } + } + } + } + } + } + } + } } - ] + } } }, - "Get_variables_from_custom_fields": { - "foreach": "@triggerBody()?['object']?['properties']?['Alerts']", + "For_each_Coveware_Server": { + "foreach": "@body('Parse_Coveware_Settings')?['properties']?['watchlistItems']", "actions": { - "Parse_custom_fields": { + "Parse_current_Coveware_Server": { "type": "ParseJson", "inputs": { - "content": "@items('Get_variables_from_custom_fields')?['properties']?['additionalData']?['Custom Details']", + "content": "@items('For_each_Coveware_Server')", "schema": { "type": "object", "properties": { - "VbrHostName": { - "type": "array", - "items": { - "type": "string" - } - }, - "MachineDisplayName": { - "type": "array", - "items": { - "type": "string" - } - }, - "MachineUuid": { - "type": "array", - "items": { - "type": "string" - } - }, - "BackupObjectId": { - "type": "array", - "items": { - "type": "string" + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Coveware Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Coveware Findings": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + } } } } } } }, - "Get_VbrHostName": { - "foreach": "@outputs('Parse_custom_fields')?['body']?['VbrHostName']", + "If_Coveware_findings_collection_is_enabled": { "actions": { - "Set_VbrHostName": { - "type": "SetVariable", + "Collect_Coveware_Findings_into_CovewareFindingsTable_CL": { + "type": "Function", "inputs": { - "name": "VbrHostName", - "value": "@items('Get_VbrHostName')" + "queries": { + "covewareServerName": "@body('Parse_current_Coveware_Server')?['properties.itemsKeyValue']?['Coveware Server Name']" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/GetAllCovewareFindingsAsync')]" + } } } }, "runAfter": { - "Parse_custom_fields": [ + "Parse_current_Coveware_Server": [ "Succeeded" ] }, - "type": "Foreach" - }, - "Get_MachineDispalyName": { - "foreach": "@body('Parse_custom_fields')?['MachineDisplayName']", - "actions": { - "Set_MachineDispalyName": { - "type": "SetVariable", - "inputs": { - "name": "MachineDisplayName", - "value": "@items('Get_MachineDispalyName')" + "else": { + "actions": { + "Print_baseUrl": { + "type": "Compose", + "inputs": "@body('Parse_current_Coveware_Server')?['properties.itemsKeyValue']?['Base URL']" } } }, - "runAfter": { - "Get_VbrHostName": [ - "Succeeded" + "expression": { + "and": [ + { + "equals": [ + "@body('Parse_current_Coveware_Server')?['properties.itemsKeyValue']?['Collect Coveware Findings']", + "true" + ] + } ] }, - "type": "Foreach" + "type": "If" } }, "runAfter": { - "Initialize_MachineDisplayName": [ + "Parse_Coveware_Settings": [ "Succeeded" ] }, "type": "Foreach" - }, - "GetLastCleanRestorePointForVMAsync": { - "runAfter": { - "Get_variables_from_custom_fields": [ - "Succeeded" - ] - }, - "type": "Function", - "inputs": { - "queries": { - "VbrHostName": "@variables('VbrHostName')", - "vmName": "@variables('MachineDisplayName')" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetCleanRestorePointsAsync')]" + } + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionName": "[[parameters('AzureSentinelConnectionName')]", + "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", + "id": "[[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/',variables('workspace-location-inline'),'/managedApis/azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } } } - }, - "Does_clean_restore_point_exist": { - "runAfter": { - "GetLastCleanRestorePointForVMAsync": [ - "Succeeded", - "TimedOut", - "Skipped", - "Failed" - ] - }, - "else": { - "actions": { - "Add_comment": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

No clean restore points were found for @{variables('MachineDisplayName')}.

" - }, - "path": "/Incidents/Comment" - } - }, - "Terminate": { - "runAfter": { - "Add_comment": [ - "Succeeded" - ] - }, - "type": "Terminate", - "inputs": { - "runStatus": "Cancelled" - } + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId6'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId6')]", + "contentId": "[variables('_playbookContentId6')]", + "kind": "Playbook", + "version": "[variables('playbookVersion6')]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ], + "metadata": { + "title": "Veeam-CollectCovewareFindings", + "description": "This Microsoft Sentinel playbook automatically collects Coveware findings on a schedule. Retrieves Coveware settings from watchlist and calls the GetCovewareFindings function for each enabled server, ingesting the data into custom tables.", + "prerequisites": [ + "1. Microsoft Sentinel workspace configured.", + "2. Permissions to create Logic Apps and API Connections.", + "3. Permissions to assign roles to the Resource Group.", + "4. Veeam Azure Function App deployed and configured.", + "5. Coveware Settings watchlist configured in Microsoft Sentinel." + ], + "tags": [ + "Automation", + "Veeam", + "Coveware", + "Collection" + ], + "lastUpdateTime": "2025-08-25T00:00:00Z", + "parameterTemplateVersion": "1.0.0", + "postDeployment": [ + "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", + "2. Ensure the Coveware Settings watchlist is properly configured with 'Collect Coveware Findings' flag set to true." + ], + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId6')]", + "contentKind": "Playbook", + "displayName": "Veeam-CollectCovewareFindings", + "contentProductId": "[variables('_playbookcontentProductId6')]", + "id": "[variables('_playbookcontentProductId6')]", + "version": "[variables('playbookVersion6')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName7')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam-CollectConfigurationBackups Playbook with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion7')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Veeam-CollectConfigurationBackups", + "type": "string", + "metadata": { + "description": "Name of the playbook (Logic App) to be created" + } + }, + "functionAppName": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Name of the Azure Function App for Veeam integration" + } + }, + "workspaceId": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" + } + }, + "subscriptionId": { + "type": "string", + "defaultValue": "[subscription().subscriptionId]", + "metadata": { + "description": "Subscription ID where resources are deployed" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "Resource group name where Function App is deployed" + } + }, + "AzureSentinelConnectionName": { + "defaultValue": "azuresentinel-connection", + "type": "string", + "metadata": { + "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" + } + } + }, + "variables": { + "functionAppId": "[[resourceId(parameters('subscriptionId'), parameters('resourceGroupName'), 'Microsoft.Web/sites', parameters('functionAppName'))]", + "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "_connection-1": "[[variables('connection-1')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[parameters('AzureSentinelConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "properties": { + "displayName": "[[parameters('AzureSentinelConnectionName')]", + "api": { + "id": "[[variables('_connection-1')]" + }, + "parameterValueType": "Alternative" + } + }, + { + "type": "Microsoft.Logic/workflows", + "apiVersion": "2017-07-01", + "name": "[[parameters('PlaybookName')]", + "location": "[[variables('workspace-location-inline')]", + "identity": { + "type": "SystemAssigned" + }, + "tags": { + "hidden-SentinelTemplateName": "Veeam-StartConfigurationBackup", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" + ], + "properties": { + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "type": "Object" + }, + "functionAppName": { + "defaultValue": "[[parameters('functionAppName')]", + "type": "String" + }, + "workspaceId": { + "defaultValue": "[[parameters('workspaceId')]", + "type": "String" + }, + "resourceGroupName": { + "defaultValue": "[[parameters('resourceGroupName')]", + "type": "String" + }, + "subscriptionId": { + "defaultValue": "[[parameters('subscriptionId')]", + "type": "String" + } + }, + "triggers": { + "Every_24_Hours": { + "type": "Recurrence", + "recurrence": { + "interval": 24, + "frequency": "Hour" + } + } + }, + "actions": { + "Watchlists_-_Get_VBR_Settings": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" } - } - }, - "expression": { - "and": [ - { - "not": { - "equals": [ - "@outputs('GetLastCleanRestorePointForVMAsync')?['statusCode']", - 404 - ] - } - } - ] - }, - "type": "If" - }, - "Parse_restorePointId": { - "runAfter": { - "Does_clean_restore_point_exist": [ - "Succeeded" - ] - }, - "type": "ParseJson", - "inputs": { - "content": "@body('GetLastCleanRestorePointForVMAsync')", - "schema": { - "type": "object", - "properties": { - "platformName": { - "type": "integer" - }, - "type": { - "type": "integer" - }, - "malwareStatus": { - "type": "integer" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "platformId": { - "type": "string" - }, - "creationTime": { - "type": "string" - }, - "backupId": { - "type": "string" - }, - "sessionId": { - "type": "string" - }, - "allowedOperations": { - "type": "array", - "items": { - "type": "integer" - } - }, - "backupFileId": { - "type": "string" - } - } - } - } - }, - "StartInstantVMRecoveryAsync": { - "runAfter": { - "Parse_restorePointId": [ - "Succeeded" - ] - }, - "type": "Function", - "inputs": { - "queries": { - "VbrHostName": "@variables('VbrHostName')", - "restorePointId": "@body('Parse_restorePointId')?['id']" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/StartInstantVMRecoveryAsync')]" - } - } - }, - "Parse_sessionId": { - "runAfter": { - "StartInstantVMRecoveryAsync": [ - "Succeeded" - ] + }, + "method": "get", + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItems" + } + }, + "Parse_VBR_settings": { + "runAfter": { + "Watchlists_-_Get_VBR_Settings": [ + "Succeeded" + ] }, "type": "ParseJson", "inputs": { - "content": "@body('StartInstantVMRecoveryAsync')", + "content": "@body('Watchlists_-_Get_VBR_Settings')", "schema": { "type": "object", "properties": { - "data": { + "properties": { "type": "object", "properties": { - "sessionType": { - "type": "integer" - }, - "state": { - "type": "integer" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "jobId": { - "type": "string" - }, - "creationTime": { - "type": "string" - }, - "progressPercent": { - "type": "integer" - }, - "result": { - "type": "object", - "properties": { - "result": { - "type": "integer" - }, - "message": { - "type": "string" + "watchlistItems": { + "type": "array", + "items": { + "type": "object", + "properties": { + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Configuration Backups": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + } + } + } } } - }, - "usn": { - "type": "integer" } } } @@ -5153,90 +6339,33 @@ } } }, - "Add_comment_to_incident": { - "runAfter": { - "Parse_sessionId": [ - "Succeeded" - ] - }, - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Instant VM recovery has started for @{variables('MachineDisplayName')} and restore point @{body('Parse_restorePointId')?['id']}.

" - }, - "path": "/Incidents/Comment" - } - }, - "Until_state_is_not_Stopped": { + "For_each_VBR_server": { + "foreach": "@body('Parse_VBR_settings')?['properties']?['watchlistItems']", "actions": { - "GetSession_": { - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@variables('VbrHostName')", - "sessionId": "@body('Parse_sessionId')?['data']?['id']" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetSessionAsync')]" - } - } - }, - "Parse_session": { - "runAfter": { - "GetSession_": [ - "Succeeded" - ] - }, + "Parse_current_VBR_server": { "type": "ParseJson", "inputs": { - "content": "@body('GetSession_')", + "content": "@items('For_each_VBR_server')", "schema": { "type": "object", "properties": { - "data": { + "properties.itemsKeyValue": { "type": "object", "properties": { - "sessionType": { - "type": "integer" - }, - "state": { - "type": "integer" - }, - "id": { + "Veeam Server Name": { "type": "string" }, - "name": { + "Base URL": { "type": "string" }, - "jobId": { + "Collect Configuration Backups": { "type": "string" }, - "creationTime": { + "Key Vault Password ID": { "type": "string" }, - "progressPercent": { - "type": "integer" - }, - "result": { - "type": "object", - "properties": { - "result": { - "type": "integer" - }, - "message": { - "type": "string" - } - } - }, - "usn": { - "type": "integer" + "Key Vault Username ID": { + "type": "string" } } } @@ -5244,423 +6373,276 @@ } } }, - "Delay": { - "runAfter": { - "Parse_session": [ - "Succeeded" - ] - }, - "type": "Wait", - "inputs": { - "interval": { - "count": 3, - "unit": "Minute" - } - } - } - }, - "runAfter": { - "Add_comment_to_incident": [ - "Succeeded" - ] - }, - "expression": "@equals(body('Parse_session')?['state'],1)", - "limit": { - "timeout": "PT3H" - }, - "type": "Until" - }, - "Result": { - "runAfter": { - "Until_state_is_not_Stopped": [ - "Succeeded" - ] - }, - "type": "Compose", - "inputs": "@body('Parse_session')?['result']" - }, - "Add_comment_to_incident_(V3)": { - "runAfter": { - "Result": [ - "Succeeded" - ] - }, - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Instant VM recovery for @{variables('MachineDisplayName')} has finished. Details: @{body('Parse_session')?['result']}.


" - }, - "path": "/Incidents/Comment" - } - } - } - }, - "parameters": { - "$connections": { - "value": { - "azuresentinel": { - "connectionName": "[[parameters('AzureSentinelConnectionName')]", - "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", - "id": "[[format('/subscriptions/{0}/providers/Microsoft.Web/locations/{1}/managedApis/azuresentinel', subscription().subscriptionId, variables('workspace-location-inline'))]", - "connectionProperties": { - "authentication": { - "type": "ManagedServiceIdentity" - } - } - } - } - } - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId10'),'/'))))]", - "properties": { - "parentId": "[variables('playbookId10')]", - "contentId": "[variables('_playbookContentId10')]", - "kind": "Playbook", - "version": "[variables('playbookVersion10')]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - } - ], - "metadata": { - "title": "Veeam-PerformInstantVMRecovery", - "description": "This Microsoft Sentinel playbook performs instant VM recovery on the vm specified by MachineDisplayName custom field of Microsoft Sentinel's incident custom fields. The playbook automatically finds the latest clean restore point, initiates the instant recovery monitor for its state and indicates results as incident comments.", - "prerequisites": [ - "1. Microsoft Sentinel workspace configured.", - "2. Permissions to create Logic Apps and API Connections.", - "3. Permissions to assign roles to the Resource Group.", - "4. Veeam Azure Function App deployed and configured.", - "5. Hybrid Connection and Key Vault secrets configured for each VBR Server." - ], - "tags": [ - "Security", - "Veeam", - "Recovery", - "Incident Response" - ], - "lastUpdateTime": "2025-08-25T00:00:00Z", - "parameterTemplateVersion": "1.0.0", - "postDeployment": [ - "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace." - ], - "releaseNotes": { - "version": "1.0", - "title": "[variables('blanks')]", - "notes": [ - "Initial version" - ] - } - } - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId10')]", - "contentKind": "Playbook", - "displayName": "Veeam-PerformInstantVMRecovery", - "contentProductId": "[variables('_playbookcontentProductId10')]", - "id": "[variables('_playbookcontentProductId10')]", - "version": "[variables('playbookVersion10')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName11')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "Veeam-ResolveTriggeredAlarm Playbook with template version 3.0.3", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion11')]", - "parameters": { - "PlaybookName": { - "defaultValue": "Veeam-ResolveTriggeredAlarm", - "type": "string", - "metadata": { - "description": "Name of the playbook (Logic App) to be created" - } - }, - "functionAppName": { - "type": "string", - "defaultValue": "", - "metadata": { - "description": "Name of the Azure Function App for Veeam integration" - } - }, - "AzureSentinelConnectionName": { - "type": "string", - "defaultValue": "azuresentinel-connection", - "metadata": { - "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" - } - } - }, - "variables": { - "functionAppId": "[[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]", - "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", - "_connection-1": "[[variables('connection-1')]", - "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", - "workspace-name": "[parameters('workspace')]", - "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" - }, - "resources": [ - { - "type": "Microsoft.Web/connections", - "apiVersion": "2016-06-01", - "name": "[[parameters('AzureSentinelConnectionName')]", - "location": "[[variables('workspace-location-inline')]", - "properties": { - "displayName": "[[parameters('AzureSentinelConnectionName')]", - "api": { - "id": "[[variables('_connection-1')]" - }, - "parameterValueType": "Alternative" - } - }, - { - "type": "Microsoft.Logic/workflows", - "apiVersion": "2017-07-01", - "name": "[[parameters('PlaybookName')]", - "location": "[[variables('workspace-location-inline')]", - "identity": { - "type": "SystemAssigned" - }, - "tags": { - "hidden-SentinelTemplateName": "Veeam-ResolveTriggeredAlarm", - "hidden-SentinelTemplateVersion": "1.0", - "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" - }, - "dependsOn": [ - "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" - ], - "properties": { - "state": "Enabled", - "definition": { - "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "$connections": { - "type": "Object" - } - }, - "triggers": { - "Microsoft_Sentinel_incident": { - "type": "ApiConnectionWebhook", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "body": { - "callback_url": "@listCallbackUrl()" - }, - "path": "/incident-creation" - } - } - }, - "actions": { - "Parse_Alarm_Details": { - "foreach": "@triggerBody()?['object']?['properties']?['Alerts']", - "actions": { - "Parse_JSON": { - "type": "ParseJson", - "inputs": { - "content": "@items('Parse_Alarm_Details')?['properties']?['additionalData']?['Custom Details']", - "schema": { - "type": "object", - "properties": { - "TriggeredAlarmId": { - "type": "array", - "items": { - "type": "string" - } + "If_configuration_backup_collection_is_enabled": { + "actions": { + "StartConfigurationBackupAsync": { + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']" }, - "VoneHostName": { - "type": "array", - "items": { - "type": "string" - } + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/StartConfigurationBackupAsync')]" } } - } - } - }, - "For_each_TriggeredAlarmId": { - "foreach": "@outputs('Parse_JSON')?['body']?['TriggeredAlarmId']", - "actions": { - "Set_TriggeredAlarmId_variable": { - "type": "SetVariable", + }, + "Parse_sessionId": { + "runAfter": { + "StartConfigurationBackupAsync": [ + "Succeeded" + ] + }, + "type": "ParseJson", "inputs": { - "name": "TriggeredAlarmId", - "value": "@items('For_each_TriggeredAlarmId')" + "content": "@outputs('StartConfigurationBackupAsync')", + "schema": { + "type": "object", + "properties": { + "statusCode": { + "type": "integer" + }, + "headers": { + "type": "object", + "properties": { + "Date": { + "type": "string" + }, + "Transfer-Encoding": { + "type": "string" + }, + "Strict-Transport-Security": { + "type": "string" + }, + "x-ms-middleware-request-id": { + "type": "string" + }, + "Content-Type": { + "type": "string" + }, + "Content-Length": { + "type": "string" + } + } + }, + "body": { + "type": "object", + "properties": { + "sessionType": { + "type": "integer" + }, + "state": { + "type": "integer" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "jobId": { + "type": "string" + }, + "creationTime": { + "type": "string" + }, + "progressPercent": { + "type": "integer" + }, + "result": { + "type": "object", + "properties": { + "result": { + "type": "integer" + }, + "message": { + "type": "string" + }, + "isCanceled": { + "type": "boolean" + } + } + }, + "usn": { + "type": "integer" + } + } + } + } + } + } + }, + "Until_state_is_not_stopped": { + "actions": { + "GetSession": { + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']", + "sessionId": "@body('Parse_sessionId')?['body']?['id']" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/GetSessionAsync')]" + } + } + }, + "Parse_session": { + "runAfter": { + "GetSession": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@outputs('GetSession')", + "schema": { + "type": "object", + "properties": { + "statusCode": { + "type": "integer" + }, + "headers": { + "type": "object", + "properties": { + "Date": { + "type": "string" + }, + "Transfer-Encoding": { + "type": "string" + }, + "Request-Context": { + "type": "string" + }, + "Content-Type": { + "type": "string" + }, + "Content-Length": { + "type": "string" + } + } + }, + "body": { + "type": "object", + "properties": { + "sessionType": { + "type": "integer" + }, + "state": { + "type": "integer" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "jobId": { + "type": "string" + }, + "creationTime": { + "type": "string" + }, + "progressPercent": { + "type": "integer" + }, + "result": { + "type": "object", + "properties": { + "result": { + "type": "integer" + }, + "message": { + "type": "string" + }, + "isCanceled": { + "type": "boolean" + } + } + }, + "usn": { + "type": "integer" + } + } + } + } + } + } + }, + "Delay": { + "runAfter": { + "Parse_session": [ + "Succeeded" + ] + }, + "type": "Wait", + "inputs": { + "interval": { + "count": 1, + "unit": "Minute" + } + } + } + }, + "runAfter": { + "Parse_sessionId": [ + "Succeeded" + ] + }, + "expression": "@equals(body('Parse_session')?['body']?['state'],1)", + "limit": { + "timeout": "PT30M" + }, + "type": "Until" + }, + "IngestSessionDataBySessionIdAsync": { + "runAfter": { + "Until_state_is_not_stopped": [ + "Succeeded" + ] + }, + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']", + "sessionId": "@body('Parse_sessionId')?['body']?['id']" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/IngestSessionDataBySessionIdAsync')]" + } } } }, "runAfter": { - "Parse_JSON": [ + "Parse_current_VBR_server": [ "Succeeded" ] }, - "type": "Foreach" - }, - "For_each_VoneHostName": { - "foreach": "@outputs('Parse_JSON')?['body']?['VoneHostName']", - "actions": { - "Set_VoneHostName_variable": { - "type": "SetVariable", - "inputs": { - "name": "VoneHostName", - "value": "@items('For_each_VoneHostName')" + "else": { + "actions": { + "Print_server_info": { + "type": "Compose", + "inputs": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']" } } }, - "runAfter": { - "For_each_TriggeredAlarmId": [ - "Succeeded" + "expression": { + "and": [ + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups']", + "true" + ] + } ] }, - "type": "Foreach" + "type": "If" } }, "runAfter": { - "Initialize_variables": [ + "Parse_VBR_settings": [ "Succeeded" ] }, "type": "Foreach" - }, - "Initialize_variables": { - "type": "InitializeVariable", - "inputs": { - "variables": [ - { - "name": "TriggeredAlarmId", - "type": "string" - }, - { - "name": "VoneHostName", - "type": "string" - } - ] - } - }, - "ResolveTriggeredAlarm": { - "runAfter": { - "Parse_Alarm_Details": [ - "Succeeded" - ] - }, - "type": "Function", - "inputs": { - "queries": { - "TriggeredAlarmId": "@variables('TriggeredAlarmId')", - "voneHostName": "@variables('VoneHostName')" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/ResolveTriggeredAlarmAsync')]" - } - } - }, - "Check_Alarm_Resolution_Result": { - "actions": { - "Add_success_comment": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Alarm with ID @{variables('TriggeredAlarmId')} has been successfully resolved on @{variables('VoneHostName')}.

" - }, - "path": "/Incidents/Comment" - } - } - }, - "runAfter": { - "ResolveTriggeredAlarm": [ - "Succeeded", - "TimedOut", - "Skipped", - "Failed" - ] - }, - "else": { - "actions": { - "Add_failure_comment": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Alarm with ID @{variables('TriggeredAlarmId')} has not been resolved on @{variables('VoneHostName')}. Reason: Function call failed or returned an error.

" - }, - "path": "/Incidents/Comment" - } - } - } - }, - "expression": { - "and": [ - { - "not": { - "equals": [ - "@outputs('ResolveTriggeredAlarm')?['statusCode']", - 404 - ] - } - }, - { - "not": { - "equals": [ - "@outputs('ResolveTriggeredAlarm')?['statusCode']", - 500 - ] - } - } - ] - }, - "type": "If" } } }, @@ -5685,12 +6667,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId11'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId7'),'/'))))]", "properties": { - "parentId": "[variables('playbookId11')]", - "contentId": "[variables('_playbookContentId11')]", + "parentId": "[variables('playbookId7')]", + "contentId": "[variables('_playbookContentId7')]", "kind": "Playbook", - "version": "[variables('playbookVersion11')]", + "version": "[variables('playbookVersion7')]", "source": { "kind": "Solution", "name": "Veeam", @@ -5710,26 +6692,28 @@ } ], "metadata": { - "title": "Veeam-ResolveTriggeredAlarm", - "description": "A Microsoft Sentinel playbook with an incident trigger that resolves Veeam ONE alarms (identified by TriggeredAlarmId custom incident field) on the Veeam ONE server specified by the VoneHostName custom incident field.", + "title": "Veeam-CollectConfigurationBackups", + "description": "A Microsoft Sentinel playbook that automatically runs configuration backup sessions on Veeam Backup & Replication servers on schedule. The playbook gets Veeam Backup & Replication settings from the watchlist, runs the configuration backup session, and collects the session result.", "prerequisites": [ "1. Microsoft Sentinel workspace configured.", "2. Permissions to create Logic Apps and API Connections.", "3. Permissions to assign roles to the Resource Group.", "4. Veeam Azure Function App deployed and configured.", - "5. Hybrid Connection and Key Vault secrets configured for each VBR Server." + "5. VBR Settings watchlist configured in Microsoft Sentinel.", + "6. Hybrid Connection and Key Vault secrets configured for each VBR Server." ], "tags": [ "Automation", "Veeam", - "VeeamONE", - "Alarm", - "Resolution" + "Configuration", + "Backup", + "Scheduled" ], "lastUpdateTime": "2025-08-25T00:00:00Z", "parameterTemplateVersion": "1.0.0", "postDeployment": [ - "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace." + "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", + "2. Ensure the VBR Settings watchlist is properly configured with the 'Collect Configuration Backups' flag set to true on servers from which you want to collect data." ], "_generator": { "name": "bicep", @@ -5750,50 +6734,72 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId11')]", + "contentId": "[variables('_playbookContentId7')]", "contentKind": "Playbook", - "displayName": "Veeam-ResolveTriggeredAlarm", - "contentProductId": "[variables('_playbookcontentProductId11')]", - "id": "[variables('_playbookcontentProductId11')]", - "version": "[variables('playbookVersion11')]" + "displayName": "Veeam-CollectConfigurationBackups", + "contentProductId": "[variables('_playbookcontentProductId7')]", + "id": "[variables('_playbookcontentProductId7')]", + "version": "[variables('playbookVersion7')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName12')]", + "name": "[variables('playbookTemplateSpecName8')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-StartSecurityComplianceAnalyzer Playbook with template version 3.0.3", + "description": "Veeam-FindCleanRestorePoints Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion12')]", + "contentVersion": "[variables('playbookVersion8')]", "parameters": { "PlaybookName": { - "defaultValue": "Veeam-StartSecurityComplianceAnalyzer", + "defaultValue": "Veeam-FindCleanRestorePoints", "type": "string", "metadata": { "description": "Name of the playbook (Logic App) to be created" } }, "functionAppName": { - "defaultValue": "", "type": "string", + "defaultValue": "", "metadata": { "description": "Name of the Azure Function App for Veeam integration" } + }, + "AzureSentinelConnectionName": { + "type": "string", + "defaultValue": "azuresentinel-connection", + "metadata": { + "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" + } } }, "variables": { "functionAppId": "[[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]", + "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "_connection-1": "[[variables('connection-1')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", "workspace-name": "[parameters('workspace')]", "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" }, "resources": [ + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[parameters('AzureSentinelConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "properties": { + "displayName": "[[parameters('AzureSentinelConnectionName')]", + "api": { + "id": "[[variables('_connection-1')]" + }, + "parameterValueType": "Alternative" + } + }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2017-07-01", @@ -5803,136 +6809,166 @@ "type": "SystemAssigned" }, "tags": { - "hidden-SentinelTemplateName": "Veeam-StartSecurityComplianceAnalyzer", + "hidden-SentinelTemplateName": "Veeam-FindCleanRestorePoints", "hidden-SentinelTemplateVersion": "1.0", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" + ], "properties": { "state": "Enabled", "definition": { "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", "contentVersion": "1.0.0.0", "parameters": { - "functionAppName": { - "defaultValue": "[[parameters('functionAppName')]", - "type": "String" - }, - "VbrHostName": { - "defaultValue": "DefaultVbrHostName", - "type": "String" + "$connections": { + "type": "Object" } }, "triggers": { - "When_a_HTTP_request_is_received": { - "type": "Request", - "kind": "Http" - } - }, - "actions": { - "StartSecurityComplianceAnalyzer": { - "type": "Function", + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", "inputs": { - "queries": { - "vbrHostName": "@parameters('VbrHostName')" + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/StartSecurityComplianceAnalyzerAsync')]" - } + "body": { + "callback_url": "@{listCallbackUrl()}" + }, + "path": "/incident-creation" } - }, - "Parse_sessionId": { - "type": "ParseJson", - "inputs": { - "content": "@body('StartSecurityComplianceAnalyzer')", - "schema": { - "type": "object", - "properties": { - "sessionType": { - "type": "integer" - }, - "state": { - "type": "integer" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "jobId": { - "type": "string" - }, - "creationTime": { - "type": "string" - }, - "progressPercent": { - "type": "integer" - }, - "result": { + } + }, + "actions": { + "Parse_custom_fields": { + "foreach": "@triggerBody()?['object']?['properties']?['Alerts']", + "actions": { + "Parse_JSON": { + "type": "ParseJson", + "inputs": { + "content": "@items('Parse_custom_fields')?['properties']?['additionalData']?['Custom Details']", + "schema": { "type": "object", "properties": { - "result": { - "type": "integer" - }, - "message": { - "type": "string" + "VbrHostName": { + "type": "array", + "items": { + "type": "string" + } }, - "isCanceled": { - "type": "boolean" + "MachineDisplayName": { + "type": "array", + "items": { + "type": "string" + } + }, + "MachineUuid": { + "type": "array", + "items": { + "type": "string" + } + }, + "BackupObjectId": { + "type": "array", + "items": { + "type": "string" + } } } - }, - "usn": { - "type": "integer" } } + }, + "For_each_alert": { + "foreach": "@outputs('Parse_JSON')?['body']?['VbrHostName']", + "actions": { + "Set_variable_VbrHostName": { + "type": "SetVariable", + "inputs": { + "name": "VbrHostName", + "value": "@items('For_each_alert')" + } + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "For_each_alert_2": { + "foreach": "@outputs('Parse_JSON')?['body']?['MachineDisplayName']", + "actions": { + "Set_variable_MachineDisplayName": { + "type": "SetVariable", + "inputs": { + "name": "MachineDisplayName", + "value": "@item()" + } + } + }, + "runAfter": { + "For_each_alert": [ + "Succeeded" + ] + }, + "type": "Foreach" } }, "runAfter": { - "StartSecurityComplianceAnalyzer": [ + "Initialize_MachineDisplayName": [ "Succeeded" ] + }, + "type": "Foreach" + }, + "Initialize_VbrHostName": { + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "VbrHostName", + "type": "string" + } + ] } }, - "Compose": { - "type": "Compose", - "inputs": "@body('Parse_sessionId')?['id']", + "GetLastCleanRestorePoint": { "runAfter": { - "Parse_sessionId": [ + "Parse_custom_fields": [ "Succeeded" ] + }, + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@variables('VbrHostName')", + "VmName": "@variables('MachineDisplayName')" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/GetCleanRestorePointsAsync')]" + } } }, - "Until_state_is_not_stopped": { - "type": "Until", - "expression": "@equals(body('Parse_session')?['state'],1)", - "limit": { - "timeout": "PT30M" - }, + "Are_there_any_clean_restore_points": { "actions": { - "GetSession": { - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@parameters('VbrHostName')", - "sessionId": "@body('Parse_sessionId')?['id']" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetSessionAsync')]" - } - } - }, - "Parse_session": { + "Parse_restore_point": { "type": "ParseJson", "inputs": { - "content": "@outputs('GetSession')", + "content": "@body('GetLastCleanRestorePoint')", "schema": { "type": "object", "properties": { - "sessionType": { + "platformName": { "type": "integer" }, - "state": { + "type": { + "type": "integer" + }, + "malwareStatus": { "type": "integer" }, "id": { @@ -5941,100 +6977,140 @@ "name": { "type": "string" }, - "jobId": { + "platformId": { "type": "string" }, "creationTime": { "type": "string" }, - "progressPercent": { - "type": "integer" + "backupId": { + "type": "string" }, - "result": { - "type": "object", - "properties": { - "result": { - "type": "integer" - }, - "message": { - "type": "string" - }, - "isCanceled": { - "type": "boolean" - } + "sessionId": { + "type": "string" + }, + "allowedOperations": { + "type": "array", + "items": { + "type": "integer" } }, - "usn": { - "type": "integer" + "backupFileId": { + "type": "string" } } } - }, - "runAfter": { - "GetSession": [ - "Succeeded" - ] } }, - "Delay": { - "type": "Wait", - "inputs": { - "interval": { - "count": 1, - "unit": "Minute" - } - }, + "Add_last_restore_point_comment": { "runAfter": { - "Parse_session": [ + "Parse_restore_point": [ "Succeeded" ] + }, + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Last clean restore point was created on @{variables('VbrHostName')} on @{body('Parse_restore_point')?['creationTime']}

" + }, + "path": "/Incidents/Comment" } } }, "runAfter": { - "Compose": [ - "Succeeded" + "GetLastCleanRestorePoint": [ + "Succeeded", + "TimedOut", + "Skipped", + "Failed" ] - } - }, - "GetSecurityComplianceAnalyzerResultsAsync": { - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@parameters('VbrHostName')" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetSecurityComplianceAnalyzerResultsAsync')]" + }, + "else": { + "actions": { + "Add_no_restore_points_comment": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

No restore points were found on @{variables('VbrHostName')}

" + }, + "path": "/Incidents/Comment" + } + } } }, - "runAfter": { - "Until_state_is_not_stopped": [ - "Succeeded" + "expression": { + "and": [ + { + "not": { + "equals": [ + "@outputs('GetLastCleanRestorePoint')?['statusCode']", + 404 + ] + } + } ] - } + }, + "type": "If" }, - "Compose_output": { - "type": "Compose", - "inputs": "@body('Parse_session')", + "Initialize_MachineDisplayName": { "runAfter": { - "GetSecurityComplianceAnalyzerResultsAsync": [ + "Initialize_VbrHostName": [ "Succeeded" ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "MachineDisplayName", + "type": "string" + } + ] } } } - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId12'),'/'))))]", - "properties": { - "parentId": "[variables('playbookId12')]", - "contentId": "[variables('_playbookContentId12')]", - "kind": "Playbook", - "version": "[variables('playbookVersion12')]", + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionName": "[[parameters('AzureSentinelConnectionName')]", + "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", + "id": "[[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/',variables('workspace-location-inline'),'/managedApis/azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + } + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId8'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId8')]", + "contentId": "[variables('_playbookContentId8')]", + "kind": "Playbook", + "version": "[variables('playbookVersion8')]", "source": { "kind": "Solution", "name": "Veeam", @@ -6054,25 +7130,32 @@ } ], "metadata": { - "title": "Veeam-StartSecurityComplianceAnalyzer", - "description": "This Microsoft Sentinel playbook initiates and monitors Veeam Security and Compliance Analyzer sessions via HTTP trigger.", + "title": "Veeam-FindCleanRestorePoints", + "description": "A Microsoft Sentinel playbook with the incident trigger, that finds the last clean restore point for VM, specified in the incident by VbrHostName and MachineDisplayName. If finds a clean restore point, adds its date as incident's comment, and if a clean restore point is not found, adds a comment indicating that.", "prerequisites": [ "1. Microsoft Sentinel workspace configured.", "2. Permissions to create Logic Apps and API Connections.", "3. Permissions to assign roles to the Resource Group.", "4. Veeam Azure Function App deployed and configured.", - "5. Hybrid Connection and Key Vault secrets configured for the VBR Server." + "5. Hybrid Connection and Key Vault secrets configured for each VBR Server." ], "tags": [ "Automation", "Veeam", - "BestPractice", - "Analyzer", - "HTTP" + "Backup", + "RestorePoints", + "Recovery" ], "lastUpdateTime": "2025-08-25T00:00:00Z", "parameterTemplateVersion": "1.0.0", - "postDeployment": [], + "postDeployment": [ + "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace." + ], + "_generator": { + "name": "bicep", + "version": "0.36.177.2456", + "templateHash": "8701067040678761767" + }, "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", @@ -6087,30 +7170,30 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId12')]", + "contentId": "[variables('_playbookContentId8')]", "contentKind": "Playbook", - "displayName": "Veeam-StartSecurityComplianceAnalyzer", - "contentProductId": "[variables('_playbookcontentProductId12')]", - "id": "[variables('_playbookcontentProductId12')]", - "version": "[variables('playbookVersion12')]" + "displayName": "Veeam-FindCleanRestorePoints", + "contentProductId": "[variables('_playbookcontentProductId8')]", + "id": "[variables('_playbookcontentProductId8')]", + "version": "[variables('playbookVersion8')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName13')]", + "name": "[variables('playbookTemplateSpecName9')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-PerformConfigurationBackupOnIncident Playbook with template version 3.0.3", + "description": "Veeam-PerformScanBackup Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion13')]", + "contentVersion": "[variables('playbookVersion9')]", "parameters": { "PlaybookName": { - "defaultValue": "Veeam-PerformConfigurationBackupOnIncident", + "defaultValue": "Veeam-PerformScanBackup", "type": "string", "metadata": { "description": "Name of the playbook (Logic App) to be created" @@ -6123,31 +7206,17 @@ "description": "Name of the Azure Function App for Veeam integration" } }, - "subscriptionId": { - "type": "string", - "defaultValue": "[subscription().subscriptionId]", - "metadata": { - "description": "Subscription ID where resources are deployed" - } - }, - "resourceGroupName": { - "type": "string", - "defaultValue": "[resourceGroup().name]", - "metadata": { - "description": "Resource group name where Function App is deployed" - } - }, "AzureSentinelConnectionName": { "type": "string", "defaultValue": "azuresentinel-connection", "metadata": { - "description": "The name to use for the Microsoft Sentinel Connector in the Logic App" + "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" } } }, "variables": { - "functionAppId": "[[resourceId(parameters('subscriptionId'), parameters('resourceGroupName'), 'Microsoft.Web/sites', parameters('functionAppName'))]", - "connection-1": "[[concat('/subscriptions/', parameters('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "functionAppId": "[[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]", + "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "_connection-1": "[[variables('connection-1')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", "workspace-name": "[parameters('workspace')]", @@ -6172,23 +7241,35 @@ "apiVersion": "2017-07-01", "name": "[[parameters('PlaybookName')]", "location": "[[variables('workspace-location-inline')]", - "dependsOn": [ - "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" - ], "identity": { "type": "SystemAssigned" }, "tags": { - "hidden-SentinelTemplateName": "Veeam-StartConfigurationBackup-Incident", + "hidden-SentinelTemplateName": "Veeam-PerformScanBackup", "hidden-SentinelTemplateVersion": "1.0", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" + ], "properties": { "state": "Enabled", "definition": { "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", "contentVersion": "1.0.0.0", "parameters": { + "IsYara": { + "defaultValue": true, + "type": "Bool" + }, + "TimeRange": { + "defaultValue": "1w1d", + "type": "String" + }, + "VbrHostName": { + "defaultValue": "vbr1", + "type": "String" + }, "$connections": { "type": "Object" } @@ -6203,419 +7284,374 @@ } }, "body": { - "callback_url": "@{listCallbackUrl()}" + "callback_url": "@listCallbackUrl()" }, "path": "/incident-creation" } } }, "actions": { - "Initialize_VbrHostName": { - "type": "InitializeVariable", - "inputs": { - "variables": [ - { - "name": "VbrHostName", - "type": "string" - } - ] - } - }, - "Initialize_SessionId": { + "Parse_sessionId": { "runAfter": { - "Initialize_VbrHostName": [ + "Add_comment_to_incident": [ "Succeeded" ] }, - "type": "InitializeVariable", + "type": "ParseJson", "inputs": { - "variables": [ - { - "name": "SessionId", - "type": "string" - } - ] - } - }, - "Parse_custom_fields": { - "foreach": "@triggerBody()?['object']?['properties']?['Alerts']", - "actions": { - "Parse_JSON": { - "type": "ParseJson", - "inputs": { - "content": "@items('Parse_custom_fields')?['properties']?['additionalData']?['Custom Details']", - "schema": { + "content": "@outputs('StartBackupScanAV')", + "schema": { + "type": "object", + "properties": { + "statusCode": { + "type": "integer" + }, + "headers": { "type": "object", "properties": { - "VbrHostName": { - "type": "array", - "items": { - "type": "string" - } + "Date": { + "type": "string" + }, + "Transfer-Encoding": { + "type": "string" + }, + "Request-Context": { + "type": "string" + }, + "Content-Type": { + "type": "string" + }, + "Content-Length": { + "type": "string" } } - } - } - }, - "Get_VbrHostName": { - "foreach": "@outputs('Parse_JSON')?['body']?['VbrHostName']", - "actions": { - "Set_variable_VbrHostName": { - "type": "SetVariable", - "inputs": { - "name": "VbrHostName", - "value": "@items('Get_VbrHostName')" + }, + "body": { + "type": "object", + "properties": { + "sessionId": { + "type": "string" + } } } - }, - "runAfter": { - "Parse_JSON": [ - "Succeeded" - ] - }, - "type": "Foreach" + } } - }, - "runAfter": { - "Initialize_SessionId": [ - "Succeeded" - ] - }, - "type": "Foreach" + } }, - "Check_if_VbrHostName_found": { + "Until_state_is_not_Stopped": { "actions": { - "StartConfigurationBackupAsync": { - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@variables('VbrHostName')" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/StartConfigurationBackupAsync')]" - } - } - }, - "Parse_sessionId": { + "Parse_session": { "runAfter": { - "StartConfigurationBackupAsync": [ + "GetSession_": [ "Succeeded" ] }, "type": "ParseJson", "inputs": { - "content": "@outputs('StartConfigurationBackupAsync')", + "content": "@body('GetSession_')", "schema": { "type": "object", "properties": { - "statusCode": { + "sessionType": { "type": "integer" }, - "headers": { + "state": { + "type": "integer" + }, + "platformName": { + "type": "integer" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "jobId": { + "type": "string" + }, + "creationTime": { + "type": "string" + }, + "progressPercent": { + "type": "integer" + }, + "result": { "type": "object", "properties": { - "Date": { - "type": "string" - }, - "Transfer-Encoding": { - "type": "string" + "result": { + "type": "integer" }, - "Strict-Transport-Security": { + "message": { "type": "string" }, - "x-ms-middleware-request-id": { - "type": "string" - }, - "Content-Type": { - "type": "string" - }, - "Content-Length": { - "type": "string" + "isCanceled": { + "type": "boolean" } } }, - "body": { - "type": "object", - "properties": { - "sessionType": { - "type": "integer" - }, - "state": { - "type": "integer" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "jobId": { - "type": "string" - }, - "creationTime": { - "type": "string" - }, - "progressPercent": { - "type": "integer" - }, - "result": { - "type": "object", - "properties": { - "result": { - "type": "integer" - }, - "message": { - "type": "string" - }, - "isCanceled": { - "type": "boolean" - } - } - }, - "usn": { - "type": "integer" - } - } + "usn": { + "type": "integer" + }, + "platformId": { + "type": "string" } } } } }, - "Set_SessionId": { - "runAfter": { - "Parse_sessionId": [ - "Succeeded" - ] - }, - "type": "SetVariable", + "GetSession_": { + "type": "Function", "inputs": { - "name": "SessionId", - "value": "@body('Parse_sessionId')?['body']?['id']" + "queries": { + "vbrHostName": "@variables('VbrHostName')", + "sessionId": "@body('Parse_sessionId')?['body']?['sessionId']" + }, + "function": { + "id": "[[format('{0}/functions/GetSessionAsync', variables('functionAppId'))]" + } } }, - "Add_backup_started_comment": { + "Delay": { "runAfter": { - "Set_SessionId": [ + "Parse_session": [ "Succeeded" ] }, - "type": "ApiConnection", + "type": "Wait", "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Configuration backup started on @{variables('VbrHostName')} with session ID: @{variables('SessionId')}

" - }, - "path": "/Incidents/Comment" + "interval": { + "count": 3, + "unit": "Minute" + } } - }, - "Until_state_is_not_stopped": { - "actions": { - "GetSession": { - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@variables('VbrHostName')", - "sessionId": "@variables('SessionId')" + } + }, + "runAfter": { + "Parse_sessionId": [ + "Succeeded" + ] + }, + "expression": "@equals(body('Parse_session')?['state'],1)", + "limit": { + "timeout": "PT3H" + }, + "type": "Until" + }, + "Get_variables_from_custom_fields": { + "foreach": "@triggerBody()?['object']?['properties']?['Alerts']", + "actions": { + "Parse_custom_fields": { + "type": "ParseJson", + "inputs": { + "content": "@items('Get_variables_from_custom_fields')?['properties']?['additionalData']?['Custom Details']", + "schema": { + "type": "object", + "properties": { + "VbrHostName": { + "type": "array", + "items": { + "type": "string" + } }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetSessionAsync')]" - } - } - }, - "Parse_session": { - "runAfter": { - "GetSession": [ - "Succeeded" - ] - }, - "type": "ParseJson", - "inputs": { - "content": "@outputs('GetSession')", - "schema": { - "type": "object", - "properties": { - "statusCode": { - "type": "integer" - }, - "headers": { - "type": "object", - "properties": { - "Date": { - "type": "string" - }, - "Transfer-Encoding": { - "type": "string" - }, - "Request-Context": { - "type": "string" - }, - "Content-Type": { - "type": "string" - }, - "Content-Length": { - "type": "string" - } - } - }, - "body": { - "type": "object", - "properties": { - "sessionType": { - "type": "integer" - }, - "state": { - "type": "integer" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "jobId": { - "type": "string" - }, - "creationTime": { - "type": "string" - }, - "progressPercent": { - "type": "integer" - }, - "result": { - "type": "object", - "properties": { - "result": { - "type": "integer" - }, - "message": { - "type": "string" - }, - "isCanceled": { - "type": "boolean" - } - } - }, - "usn": { - "type": "integer" - } - } - } + "MachineDisplayName": { + "type": "array", + "items": { + "type": "string" + } + }, + "MachineUuid": { + "type": "array", + "items": { + "type": "string" + } + }, + "BackupObjectId": { + "type": "array", + "items": { + "type": "string" } } } - }, - "Delay": { - "runAfter": { - "Parse_session": [ - "Succeeded" - ] - }, - "type": "Wait", + } + } + }, + "Get_VbrHostName": { + "foreach": "@outputs('Parse_custom_fields')?['body']?['VbrHostName']", + "actions": { + "Set_VbrHostName": { + "type": "SetVariable", "inputs": { - "interval": { - "count": 1, - "unit": "Minute" - } + "name": "VbrHostName", + "value": "@items('Get_VbrHostName')" } } }, "runAfter": { - "Add_backup_started_comment": [ + "Parse_custom_fields": [ "Succeeded" ] }, - "expression": "@equals(body('Parse_session')?['body']?['state'],1)", - "limit": { - "timeout": "PT30M" - }, - "type": "Until" + "type": "Foreach" }, - "IngestSessionDataBySessionIdAsync": { + "Get_BackupObjectId": { + "foreach": "@outputs('Parse_custom_fields')?['body']?['BackupObjectId']", + "actions": { + "Set_BackupObjectId": { + "type": "SetVariable", + "inputs": { + "name": "BackupObjectId", + "value": "@items('Get_BackupObjectId')" + } + } + }, "runAfter": { - "Until_state_is_not_stopped": [ + "Get_VbrHostName": [ "Succeeded" ] }, - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@variables('VbrHostName')", - "sessionId": "@variables('SessionId')" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/IngestSessionDataBySessionIdAsync')]" - } - } + "type": "Foreach" }, - "Add_backup_completed_comment": { + "Get_MachineDispalyName": { + "foreach": "@body('Parse_custom_fields')?['MachineDisplayName']", + "actions": { + "Set_MachineDispalyName": { + "type": "SetVariable", + "inputs": { + "name": "MachineDisplayName", + "value": "@items('Get_MachineDispalyName')" + } + } + }, "runAfter": { - "IngestSessionDataBySessionIdAsync": [ - "Succeeded", - "Failed", - "Skipped", - "TimedOut" + "Get_BackupObjectId": [ + "Succeeded" ] }, - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Configuration backup completed on @{variables('VbrHostName')}. Final result: @{body('Parse_session')?['body']?['result']?['result']}

Session data has been ingested into the workspace.

" - }, - "path": "/Incidents/Comment" - } + "type": "Foreach" } }, "runAfter": { - "Parse_custom_fields": [ + "Initialize_MachineDisplayName": [ "Succeeded" ] }, - "else": { - "actions": { - "Add_no_hostname_comment": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Warning: No VbrHostName found in incident custom fields. Configuration backup cannot be started.

Please ensure the incident contains a 'VbrHostName' custom field with the target Veeam server hostname.

" - }, - "path": "/Incidents/Comment" - } + "type": "Foreach" + }, + "Initialize_VbrHostName": { + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "VbrHostName", + "type": "string", + "value": "none" } + ] + } + }, + "StartBackupScanAV": { + "runAfter": { + "Get_variables_from_custom_fields": [ + "Succeeded" + ] + }, + "type": "Function", + "inputs": { + "queries": { + "VbrHostName": "@variables('VbrHostName')", + "backupObjectId": "@variables('BackupObjectId')", + "vmName": "@variables('MachineDisplayName')" + }, + "function": { + "id": "[[format('{0}/functions/StartBackupScanAV', variables('functionAppId'))]" } + } + }, + "Initialize_BackupObjectId": { + "runAfter": { + "Initialize_VbrHostName": [ + "Succeeded" + ] }, - "expression": { - "and": [ + "type": "InitializeVariable", + "inputs": { + "variables": [ { - "not": { - "equals": [ - "@variables('VbrHostName')", - "" - ] - } + "name": "BackupObjectId", + "type": "string", + "value": "none" } ] + } + }, + "Initialize_MachineDisplayName": { + "runAfter": { + "Initialize_BackupObjectId": [ + "Succeeded" + ] }, - "type": "If" + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "MachineDisplayName", + "type": "string", + "value": "none" + } + ] + } + }, + "Add_comment_to_incident_(V3)": { + "runAfter": { + "Result": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

AV scan for @{variables('MachineDisplayName')} has finished. Details: @{body('Parse_session')?['result']?['message']}.

Incident has been resolved, so you can close it.

" + }, + "path": "/Incidents/Comment" + } + }, + "Result": { + "runAfter": { + "Until_state_is_not_Stopped": [ + "Succeeded" + ] + }, + "type": "Compose", + "inputs": "@body('Parse_session')?['result']" + }, + "Add_comment_to_incident": { + "runAfter": { + "StartBackupScanAV": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

AV scan for @{variables('MachineDisplayName')} has been started.

" + }, + "path": "/Incidents/Comment" + } } } }, @@ -6625,7 +7661,7 @@ "azuresentinel": { "connectionName": "[[parameters('AzureSentinelConnectionName')]", "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", - "id": "[[concat('/subscriptions/', parameters('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "id": "[[format('/subscriptions/{0}/providers/Microsoft.Web/locations/{1}/managedApis/azuresentinel', subscription().subscriptionId, variables('workspace-location-inline'))]", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" @@ -6640,12 +7676,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId13'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId9'),'/'))))]", "properties": { - "parentId": "[variables('playbookId13')]", - "contentId": "[variables('_playbookContentId13')]", + "parentId": "[variables('playbookId9')]", + "contentId": "[variables('_playbookContentId9')]", "kind": "Playbook", - "version": "[variables('playbookVersion13')]", + "version": "[variables('playbookVersion9')]", "source": { "kind": "Solution", "name": "Veeam", @@ -6665,8 +7701,8 @@ } ], "metadata": { - "title": "Veeam-PerformConfigurationBackupOnIncident", - "description": "A Microsoft Sentinel playbook that automatically runs configuration backup session when triggered by an incident. The playbook gets Veeam Backup & Replication settings from incident custom fields, runs the configuration backup session, and collects the session result.", + "title": "Veeam-PerformScanBackup", + "description": "This Microsoft Sentinel playbook with an incident trigger performs antivirus scan on Veeam backup using VbrHostName, BackupObjectId, MachineDisplayName custom incident fields to identify backup. Indicates results as incident comments.", "prerequisites": [ "1. Microsoft Sentinel workspace configured.", "2. Permissions to create Logic Apps and API Connections.", @@ -6677,20 +7713,15 @@ "tags": [ "Automation", "Veeam", - "Configuration", "Backup", - "Incident" + "Antivirus", + "Scan" ], "lastUpdateTime": "2025-08-25T00:00:00Z", "parameterTemplateVersion": "1.0.0", "postDeployment": [ "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace." ], - "_generator": { - "name": "bicep", - "version": "0.36.177.2456", - "templateHash": "8701067040678761767" - }, "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", @@ -6705,30 +7736,30 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId13')]", + "contentId": "[variables('_playbookContentId9')]", "contentKind": "Playbook", - "displayName": "Veeam-PerformConfigurationBackupOnIncident", - "contentProductId": "[variables('_playbookcontentProductId13')]", - "id": "[variables('_playbookcontentProductId13')]", - "version": "[variables('playbookVersion13')]" + "displayName": "Veeam-PerformScanBackup", + "contentProductId": "[variables('_playbookcontentProductId9')]", + "id": "[variables('_playbookcontentProductId9')]", + "version": "[variables('playbookVersion9')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName14')]", + "name": "[variables('playbookTemplateSpecName10')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-StartQuickBackup Playbook with template version 3.0.3", + "description": "Veeam-PerformInstantVMRecovery Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion14')]", + "contentVersion": "[variables('playbookVersion10')]", "parameters": { "PlaybookName": { - "defaultValue": "Veeam-StartQuickBackup", + "defaultValue": "Veeam-PerformInstantVMRecovery", "type": "string", "metadata": { "description": "Name of the playbook (Logic App) to be created" @@ -6780,7 +7811,7 @@ "type": "SystemAssigned" }, "tags": { - "hidden-SentinelTemplateName": "Veeam-StartQuickBackup", + "hidden-SentinelTemplateName": "Veeam-PerformInstantVMRecovery", "hidden-SentinelTemplateVersion": "1.0", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, @@ -6791,7 +7822,7 @@ "state": "Enabled", "definition": { "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", - "contentVersion": "1.0.1", + "contentVersion": "1.0.1.0", "parameters": { "$connections": { "type": "Object" @@ -6826,7 +7857,7 @@ ] } }, - "Initialize_BackupObjectId": { + "Initialize_MachineDisplayName": { "runAfter": { "Initialize_VbrHostName": [ "Succeeded" @@ -6836,7 +7867,7 @@ "inputs": { "variables": [ { - "name": "BackupObjectId", + "name": "MachineDisplayName", "type": "string", "value": "none" } @@ -6846,10 +7877,10 @@ "Get_variables_from_custom_fields": { "foreach": "@triggerBody()?['object']?['properties']?['Alerts']", "actions": { - "Parse_JSON": { + "Parse_custom_fields": { "type": "ParseJson", "inputs": { - "content": "@item()?['properties']?['additionalData']?['Custom Details']", + "content": "@items('Get_variables_from_custom_fields')?['properties']?['additionalData']?['Custom Details']", "schema": { "type": "object", "properties": { @@ -6882,31 +7913,31 @@ } }, "Get_VbrHostName": { - "foreach": "@body('Parse_JSON')?['VbrHostName']", + "foreach": "@outputs('Parse_custom_fields')?['body']?['VbrHostName']", "actions": { - "Set_variable": { + "Set_VbrHostName": { "type": "SetVariable", "inputs": { "name": "VbrHostName", - "value": "@{items('Get_VbrHostName')}" + "value": "@items('Get_VbrHostName')" } } }, "runAfter": { - "Parse_JSON": [ + "Parse_custom_fields": [ "Succeeded" ] }, "type": "Foreach" }, - "Get_BackupObjectId": { - "foreach": "@body('Parse_JSON')?['BackupObjectId']", + "Get_MachineDispalyName": { + "foreach": "@body('Parse_custom_fields')?['MachineDisplayName']", "actions": { - "Set_BackupObjectId": { + "Set_MachineDispalyName": { "type": "SetVariable", "inputs": { - "name": "BackupObjectId", - "value": "@items('Get_BackupObjectId')" + "name": "MachineDisplayName", + "value": "@items('Get_MachineDispalyName')" } } }, @@ -6919,13 +7950,13 @@ } }, "runAfter": { - "Initialize_BackupObjectId": [ + "Initialize_MachineDisplayName": [ "Succeeded" ] }, "type": "Foreach" }, - "GetBackupObjectByIdAsync": { + "GetLastCleanRestorePointForVMAsync": { "runAfter": { "Get_variables_from_custom_fields": [ "Succeeded" @@ -6934,101 +7965,26 @@ "type": "Function", "inputs": { "queries": { - "vbrHostName": "@variables('VbrHostName')", - "backupObjectId": "@variables('BackupObjectId')" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetBackupObjectByIdAsync')]" - } - } - }, - "Parse_properties": { - "runAfter": { - "GetBackupObjectByIdAsync": [ - "Succeeded" - ] - }, - "type": "ParseJson", - "inputs": { - "content": "@body('GetBackupObjectByIdAsync')", - "schema": { - "type": "object", - "properties": { - "ViType": { - "type": "string" - }, - "VmHostName": { - "type": "string" - }, - "VmName": { - "type": "string" - }, - "ObjectId": { - "type": "string" - } - } - } - } - }, - "StartQuickBackupJobAsync": { - "runAfter": { - "Parse_properties": [ - "Succeeded" - ] - }, - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@variables('VbrHostName')", - "ViType": "@body('Parse_properties')?['ViType']", - "VmHostName": "@body('Parse_properties')?['VmHostName']", - "VmName": "@body('Parse_properties')?['VmName']", - "ObjectId": "@body('Parse_properties')?['ObjectId']" + "VbrHostName": "@variables('VbrHostName')", + "vmName": "@variables('MachineDisplayName')" }, "function": { - "id": "[[concat(variables('functionAppId'), '/functions/StartQuickBackupJobAsync')]" + "id": "[[concat(variables('functionAppId'), '/functions/GetCleanRestorePointsAsync')]" } } }, - "Check_StartQuickBackup_Result": { + "Does_clean_restore_point_exist": { "runAfter": { - "StartQuickBackupJobAsync": [ + "GetLastCleanRestorePointForVMAsync": [ "Succeeded", + "TimedOut", + "Skipped", "Failed" ] }, - "type": "If", - "expression": { - "and": [ - { - "equals": [ - "@outputs('StartQuickBackupJobAsync')?['statusCode']", - 200 - ] - } - ] - }, - "actions": { - "Indicate_starting_with_comment": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "post", - "body": { - "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Quick backup for @{variables('VbrHostName')} has started.

" - }, - "path": "/Incidents/Comment" - } - } - }, "else": { "actions": { - "Indicate_failure_with_comment": { + "Add_comment": { "type": "ApiConnection", "inputs": { "host": { @@ -7039,33 +7995,57 @@ "method": "post", "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Quick backup for @{variables('VbrHostName')} has failed to start.

" + "message": "

No clean restore points were found for @{variables('MachineDisplayName')}.

" }, "path": "/Incidents/Comment" } + }, + "Terminate": { + "runAfter": { + "Add_comment": [ + "Succeeded" + ] + }, + "type": "Terminate", + "inputs": { + "runStatus": "Cancelled" + } } } - } + }, + "expression": { + "and": [ + { + "not": { + "equals": [ + "@outputs('GetLastCleanRestorePointForVMAsync')?['statusCode']", + 404 + ] + } + } + ] + }, + "type": "If" }, - "Parse_session_ID": { + "Parse_restorePointId": { "runAfter": { - "Check_StartQuickBackup_Result": [ + "Does_clean_restore_point_exist": [ "Succeeded" ] }, "type": "ParseJson", "inputs": { - "content": "@body('StartQuickBackupJobAsync')", + "content": "@body('GetLastCleanRestorePointForVMAsync')", "schema": { "type": "object", "properties": { - "sessionType": { + "platformName": { "type": "integer" }, - "state": { + "type": { "type": "integer" }, - "platformName": { + "malwareStatus": { "type": "integer" }, "id": { @@ -7074,63 +8054,61 @@ "name": { "type": "string" }, - "jobId": { + "platformId": { "type": "string" }, "creationTime": { "type": "string" }, - "progressPercent": { - "type": "integer" + "backupId": { + "type": "string" }, - "result": { - "type": "object", - "properties": { - "result": { - "type": "integer" - }, - "message": { - "type": "string" - }, - "isCanceled": { - "type": "boolean" - } - } + "sessionId": { + "type": "string" }, - "usn": { - "type": "integer" + "allowedOperations": { + "type": "array", + "items": { + "type": "integer" + } }, - "platformId": { + "backupFileId": { "type": "string" } } } } }, - "Until_state_is_not_Stopped": { - "actions": { - "GetSession_": { - "type": "Function", - "inputs": { - "queries": { - "vbrHostName": "@variables('VbrHostName')", - "sessionId": "@body('Parse_session_ID')?['id']" - }, - "function": { - "id": "[[concat(variables('functionAppId'), '/functions/GetSessionAsync')]" - } - } + "StartInstantVMRecoveryAsync": { + "runAfter": { + "Parse_restorePointId": [ + "Succeeded" + ] + }, + "type": "Function", + "inputs": { + "queries": { + "VbrHostName": "@variables('VbrHostName')", + "restorePointId": "@body('Parse_restorePointId')?['id']" }, - "Parse_session": { - "runAfter": { - "GetSession_": [ - "Succeeded" - ] - }, - "type": "ParseJson", - "inputs": { - "content": "@body('GetSession_')", - "schema": { + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/StartInstantVMRecoveryAsync')]" + } + } + }, + "Parse_sessionId": { + "runAfter": { + "StartInstantVMRecoveryAsync": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('StartInstantVMRecoveryAsync')", + "schema": { + "type": "object", + "properties": { + "data": { "type": "object", "properties": { "sessionType": { @@ -7139,9 +8117,6 @@ "state": { "type": "integer" }, - "platformName": { - "type": "integer" - }, "id": { "type": "string" }, @@ -7165,39 +8140,126 @@ }, "message": { "type": "string" - }, - "isCanceled": { - "type": "boolean" } } }, "usn": { "type": "integer" - }, - "platformId": { - "type": "string" } } } } - }, - "Delay": { - "runAfter": { - "Parse_session": [ - "Succeeded" - ] - }, - "type": "Wait", - "inputs": { - "interval": { - "count": 3, - "unit": "Minute" - } + } + } + }, + "Add_comment_to_incident": { + "runAfter": { + "Parse_sessionId": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Instant VM recovery has started for @{variables('MachineDisplayName')} and restore point @{body('Parse_restorePointId')?['id']}.

" + }, + "path": "/Incidents/Comment" + } + }, + "Until_state_is_not_Stopped": { + "actions": { + "GetSession_": { + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@variables('VbrHostName')", + "sessionId": "@body('Parse_sessionId')?['data']?['id']" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/GetSessionAsync')]" + } + } + }, + "Parse_session": { + "runAfter": { + "GetSession_": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('GetSession_')", + "schema": { + "type": "object", + "properties": { + "data": { + "type": "object", + "properties": { + "sessionType": { + "type": "integer" + }, + "state": { + "type": "integer" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "jobId": { + "type": "string" + }, + "creationTime": { + "type": "string" + }, + "progressPercent": { + "type": "integer" + }, + "result": { + "type": "object", + "properties": { + "result": { + "type": "integer" + }, + "message": { + "type": "string" + } + } + }, + "usn": { + "type": "integer" + } + } + } + } + } + } + }, + "Delay": { + "runAfter": { + "Parse_session": [ + "Succeeded" + ] + }, + "type": "Wait", + "inputs": { + "interval": { + "count": 3, + "unit": "Minute" + } } } }, "runAfter": { - "Parse_session_ID": [ + "Add_comment_to_incident": [ "Succeeded" ] }, @@ -7216,7 +8278,7 @@ "type": "Compose", "inputs": "@body('Parse_session')?['result']" }, - "Show_result_as_a_comment": { + "Add_comment_to_incident_(V3)": { "runAfter": { "Result": [ "Succeeded" @@ -7232,7 +8294,7 @@ "method": "post", "body": { "incidentArmId": "@triggerBody()?['object']?['id']", - "message": "

Quick backup has finished. Details: @{outputs('Result')}.

" + "message": "

Instant VM recovery for @{variables('MachineDisplayName')} has finished. Details: @{body('Parse_session')?['result']}.


" }, "path": "/Incidents/Comment" } @@ -7245,7 +8307,7 @@ "azuresentinel": { "connectionName": "[[parameters('AzureSentinelConnectionName')]", "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", - "id": "[[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/',variables('workspace-location-inline'),'/managedApis/azuresentinel')]", + "id": "[[format('/subscriptions/{0}/providers/Microsoft.Web/locations/{1}/managedApis/azuresentinel', subscription().subscriptionId, variables('workspace-location-inline'))]", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" @@ -7260,12 +8322,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId14'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId10'),'/'))))]", "properties": { - "parentId": "[variables('playbookId14')]", - "contentId": "[variables('_playbookContentId14')]", + "parentId": "[variables('playbookId10')]", + "contentId": "[variables('_playbookContentId10')]", "kind": "Playbook", - "version": "[variables('playbookVersion14')]", + "version": "[variables('playbookVersion10')]", "source": { "kind": "Solution", "name": "Veeam", @@ -7285,8 +8347,8 @@ } ], "metadata": { - "title": "Veeam-StartQuickBackup", - "description": "A Microsoft Sentinel playbook with an incident trigger, that performs quick backup support for affected backupObject (specifided by the BackupObjectId incidents custom field) when triggered by Microsoft Sentinel incidents. Indicates results as incident comments.", + "title": "Veeam-PerformInstantVMRecovery", + "description": "This Microsoft Sentinel playbook performs instant VM recovery on the vm specified by MachineDisplayName custom field of Microsoft Sentinel's incident custom fields. The playbook automatically finds the latest clean restore point, initiates the instant recovery monitor for its state and indicates results as incident comments.", "prerequisites": [ "1. Microsoft Sentinel workspace configured.", "2. Permissions to create Logic Apps and API Connections.", @@ -7295,22 +8357,16 @@ "5. Hybrid Connection and Key Vault secrets configured for each VBR Server." ], "tags": [ - "Automation", + "Security", "Veeam", - "QuickBackup", - "Support", - "IncidentResponse" + "Recovery", + "Incident Response" ], "lastUpdateTime": "2025-08-25T00:00:00Z", - "parameterTemplateVersion": "1.0.1", + "parameterTemplateVersion": "1.0.0", "postDeployment": [ "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace." ], - "_generator": { - "name": "bicep", - "version": "0.36.177.2456", - "templateHash": "8701067040678761767" - }, "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", @@ -7325,61 +8381,40 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId14')]", + "contentId": "[variables('_playbookContentId10')]", "contentKind": "Playbook", - "displayName": "Veeam-StartQuickBackup", - "contentProductId": "[variables('_playbookcontentProductId14')]", - "id": "[variables('_playbookcontentProductId14')]", - "version": "[variables('playbookVersion14')]" + "displayName": "Veeam-PerformInstantVMRecovery", + "contentProductId": "[variables('_playbookcontentProductId10')]", + "id": "[variables('_playbookcontentProductId10')]", + "version": "[variables('playbookVersion10')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('playbookTemplateSpecName15')]", + "name": "[variables('playbookTemplateSpecName11')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Veeam-SetupConnections Playbook with template version 3.0.3", + "description": "Veeam-ResolveTriggeredAlarm Playbook with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('playbookVersion15')]", + "contentVersion": "[variables('playbookVersion11')]", "parameters": { "PlaybookName": { + "defaultValue": "Veeam-ResolveTriggeredAlarm", "type": "string", - "defaultValue": "Veeam-SetupConnections", "metadata": { "description": "Name of the playbook (Logic App) to be created" } }, "functionAppName": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Name of the Azure Function App for Veeam integration" - } - }, - "keyVaultName": { - "type": "string", - "defaultValue": "", - "metadata": { - "description": "Name of the Azure Key Vault" - } - }, - "relayNamespaceName": { "type": "string", "defaultValue": "", "metadata": { - "description": "Name of the Azure Relay namespace" - } - }, - "workspaceId": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" + "description": "Name of the Azure Function App for Veeam integration" } }, "AzureSentinelConnectionName": { @@ -7388,39 +8423,10 @@ "metadata": { "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" } - }, - "subscriptionId": { - "type": "string", - "defaultValue": "[subscription().subscriptionId]", - "metadata": { - "description": "Azure subscription ID" - } - }, - "resourceGroupName": { - "type": "string", - "defaultValue": "[resourceGroup().name]", - "metadata": { - "description": "Name of the resource group containing the Logic Apps to be updated" - } - }, - "keyVaultDomain": { - "type": "string", - "defaultValue": "[environment().suffixes.keyVaultDns]", - "metadata": { - "description": "The domain suffix for Azure Key Vault (dynamically assigned based on Azure environment)" - } - }, - "azureManagementDomain": { - "type": "string", - "defaultValue": "[environment().resourceManager]", - "metadata": { - "description": "The Azure Management API endpoint (dynamically assigned based on Azure environment)" - } } }, "variables": { - "newRecurrenceInterval": "12", - "newRecurrenceFrequency": "Hour", + "functionAppId": "[[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]", "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "_connection-1": "[[variables('connection-1')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", @@ -7450,7 +8456,7 @@ "type": "SystemAssigned" }, "tags": { - "hidden-SentinelTemplateName": "Veeam-SetupConnectionsPlaybook", + "hidden-SentinelTemplateName": "Veeam-ResolveTriggeredAlarm", "hidden-SentinelTemplateVersion": "1.0", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, @@ -7465,1937 +8471,17984 @@ "parameters": { "$connections": { "type": "Object" - }, - "subscriptionId": { - "type": "String", - "defaultValue": "[[parameters('subscriptionId')]" - }, - "resourceGroupName": { - "type": "String", - "defaultValue": "[[parameters('resourceGroupName')]" - }, - "keyVaultName": { - "type": "String", - "defaultValue": "[[parameters('keyVaultName')]" - }, - "relayNamespaceName": { - "type": "String", - "defaultValue": "[[parameters('relayNamespaceName')]" - }, - "functionAppName": { - "type": "String", - "defaultValue": "[[parameters('functionAppName')]" - }, - "workspaceId": { - "type": "String", - "defaultValue": "[[parameters('workspaceId')]" - }, - "keyVaultDomain": { - "type": "String", - "defaultValue": "[[parameters('keyVaultDomain')]" - }, - "azureManagementDomain": { - "type": "String", - "defaultValue": "[[parameters('azureManagementDomain')]" } }, "triggers": { - "manual": { - "type": "Request", - "kind": "Http", + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", "inputs": { - "schema": { - "type": "object", - "properties": { - "recurrenceInterval": { - "default": "[[variables('newRecurrenceInterval')]" - }, - "recurrenceFrequency": { - "default": "[[variables('newRecurrenceFrequency')]" - } + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" } - } + }, + "body": { + "callback_url": "@listCallbackUrl()" + }, + "path": "/incident-creation" } } }, "actions": { - "Initialize_Variables": { - "type": "InitializeVariable", - "inputs": { - "variables": [ - { - "name": "VbrUsernameId", - "type": "string" + "Parse_Alarm_Details": { + "foreach": "@triggerBody()?['object']?['properties']?['Alerts']", + "actions": { + "Parse_JSON": { + "type": "ParseJson", + "inputs": { + "content": "@items('Parse_Alarm_Details')?['properties']?['additionalData']?['Custom Details']", + "schema": { + "type": "object", + "properties": { + "TriggeredAlarmId": { + "type": "array", + "items": { + "type": "string" + } + }, + "VoneHostName": { + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + }, + "For_each_TriggeredAlarmId": { + "foreach": "@outputs('Parse_JSON')?['body']?['TriggeredAlarmId']", + "actions": { + "Set_TriggeredAlarmId_variable": { + "type": "SetVariable", + "inputs": { + "name": "TriggeredAlarmId", + "value": "@items('For_each_TriggeredAlarmId')" + } + } }, - { - "name": "VbrPasswordId", - "type": "string" + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] }, - { - "name": "VbrServerName", - "type": "string", - "value": "[variables('blanks')]" + "type": "Foreach" + }, + "For_each_VoneHostName": { + "foreach": "@outputs('Parse_JSON')?['body']?['VoneHostName']", + "actions": { + "Set_VoneHostName_variable": { + "type": "SetVariable", + "inputs": { + "name": "VoneHostName", + "value": "@items('For_each_VoneHostName')" + } + } }, - { - "name": "VbrBaseUrl", - "type": "string", - "value": "[variables('blanks')]" + "runAfter": { + "For_each_TriggeredAlarmId": [ + "Succeeded" + ] }, + "type": "Foreach" + } + }, + "runAfter": { + "Initialize_variables": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Initialize_variables": { + "type": "InitializeVariable", + "inputs": { + "variables": [ { - "name": "VoneUsernameId", + "name": "TriggeredAlarmId", "type": "string" }, { - "name": "VonePasswordId", + "name": "VoneHostName", "type": "string" - }, - { - "name": "VoneServerName", - "type": "string", - "value": "[variables('blanks')]" - }, - { - "name": "VoneBaseUrl", - "type": "string", - "value": "[variables('blanks')]" } ] } }, - "For_each_VONE_server_set_missing_parameters": { - "type": "Foreach", - "foreach": "@body('Parse_VONE_Settings')?['properties']?['watchlistItems']", + "ResolveTriggeredAlarm": { + "runAfter": { + "Parse_Alarm_Details": [ + "Succeeded" + ] + }, + "type": "Function", + "inputs": { + "queries": { + "TriggeredAlarmId": "@variables('TriggeredAlarmId')", + "voneHostName": "@variables('VoneHostName')" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/ResolveTriggeredAlarmAsync')]" + } + } + }, + "Check_Alarm_Resolution_Result": { "actions": { - "If_any_value_in_watchlist_is_missing": { - "type": "If", - "expression": { - "or": [ - { - "equals": [ - "@body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms']", - "@null" - ] - }, - { - "equals": [ - "@body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms']", - "" - ] - }, - { - "equals": [ - "@item()?['properties.itemsKeyValue']?['Key Vault Password ID']", - "" - ] - }, - { - "equals": [ - "@item()?['properties.itemsKeyValue']?['Key Vault Password ID']", - "@null" - ] + "Add_success_comment": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Alarm with ID @{variables('TriggeredAlarmId')} has been successfully resolved on @{variables('VoneHostName')}.

" + }, + "path": "/Incidents/Comment" + } + } + }, + "runAfter": { + "ResolveTriggeredAlarm": [ + "Succeeded", + "TimedOut", + "Skipped", + "Failed" + ] + }, + "else": { + "actions": { + "Add_failure_comment": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } }, - { - "equals": [ - "@item()?['properties.itemsKeyValue']?['Key Vault Username ID']", - "" - ] + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Alarm with ID @{variables('TriggeredAlarmId')} has not been resolved on @{variables('VoneHostName')}. Reason: Function call failed or returned an error.

" }, - { - "equals": [ - "@item()?['properties.itemsKeyValue']?['Key Vault Username ID']", - "@null" - ] - } - ] - }, - "actions": { - "Update_Watchlist_Item_With_KeyVault_IDs_VONE": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "put", - "body": { - "Veeam Server Name": "@body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Veeam Server Name']", - "Base URL": "@body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Base URL']", - "Collect Alarms": "@if(\r\n or(\r\n empty(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms']), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms'], null), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms'], '')\r\n ),\r\n 'true', \r\n body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms']\r\n)", - "Key Vault Password ID": "@if(\r\n or(\r\n empty(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Password ID']), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Password ID'], null), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Password ID'], '')\r\n ),\r\n concat(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Veeam Server Name'], 'Password'), \r\n body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Password ID']\r\n)", - "Key Vault Username ID": "@if(\r\n or(\r\n empty(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Username ID']), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Username ID'], null), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Username ID'], '')\r\n ),\r\n concat(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Veeam Server Name'], 'Username'), \r\n body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Username ID']\r\n)" - }, - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vone_settings')}/watchlistItem/@{encodeURIComponent(items('For_each_VONE_server_set_missing_parameters')?['name'])}" - } - } - }, - "runAfter": { - "Parse_current_VONE_server": [ - "Succeeded" - ] - } - }, - "Parse_current_VONE_server": { - "type": "ParseJson", - "inputs": { - "content": "@items('For_each_VONE_server_set_missing_parameters')", - "schema": { - "type": "object", - "properties": { - "properties.watchlistItemType": { - "type": "string" - }, - "properties.watchlistItemId": { - "type": "string" - }, - "properties.tenantId": { - "type": "string" - }, - "properties.isDeleted": { - "type": "boolean" - }, - "properties.created": { - "type": "string" - }, - "properties.updated": { - "type": "string" - }, - "properties.createdBy": { - "type": "object", - "properties": { - "email": { - "type": "string" - }, - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } - }, - "properties.updatedBy": { - "type": "object", - "properties": { - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } - }, - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Alarms": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - } - } - }, - "properties.entityMapping": { - "type": "object" - }, - "etag": { - "type": "string" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "type": "string" - }, - "systemData": { - "type": "object", - "properties": { - "createdBy": { - "type": "string" - }, - "createdByType": { - "type": "string" - }, - "createdAt": { - "type": "string" - }, - "lastModifiedBy": { - "type": "string" - }, - "lastModifiedByType": { - "type": "string" - }, - "lastModifiedAt": { - "type": "string" - } - } - } - } + "path": "/Incidents/Comment" } } } }, - "runAfter": { - "Parse_VONE_Settings": [ - "Succeeded" + "expression": { + "and": [ + { + "not": { + "equals": [ + "@outputs('ResolveTriggeredAlarm')?['statusCode']", + 404 + ] + } + }, + { + "not": { + "equals": [ + "@outputs('ResolveTriggeredAlarm')?['statusCode']", + 500 + ] + } + } ] }, - "runtimeConfiguration": { - "concurrency": { - "repetitions": 1 - } - } - }, - "Watchlists_-_Get_Updated_VONE_Settings": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" + "type": "If" + } + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionName": "[[parameters('AzureSentinelConnectionName')]", + "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", + "id": "[[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/',variables('workspace-location-inline'),'/managedApis/azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" } - }, - "method": "get", - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vone_settings')}/watchlistItems" - }, - "runAfter": { - "For_each_VONE_server_set_missing_parameters": [ - "Succeeded" - ] + } } - }, - "Parse_Updated_VONE_Settings": { - "type": "ParseJson", - "inputs": { - "content": "@body('Watchlists_-_Get_Updated_VONE_Settings')", - "schema": { - "type": "object", - "properties": { - "id": { - "type": "string" - }, - "type": { - "type": "string" - }, - "properties": { - "type": "object", - "properties": { - "watchlistItems": { - "type": "array", - "items": { - "type": "object", - "properties": { - "properties.watchlistItemType": { - "type": "string" - }, - "properties.watchlistItemId": { - "type": "string" - }, - "properties.tenantId": { - "type": "string" - }, - "properties.isDeleted": { - "type": "boolean" - }, - "properties.created": { - "type": "string" - }, - "properties.updated": { - "type": "string" - }, - "properties.createdBy": { - "type": "object", - "properties": { - "email": { - "type": "string" - }, - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } - }, - "properties.updatedBy": { - "type": "object", - "properties": { - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } - }, - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Alarms": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - } - } - }, - "properties.entityMapping": { - "type": "object" - }, - "etag": { - "type": "string" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "type": "string" - }, - "systemData": { - "type": "object", - "properties": { - "createdBy": { - "type": "string" - }, - "createdByType": { - "type": "string" - }, - "createdAt": { - "type": "string" - }, - "lastModifiedBy": { - "type": "string" - }, - "lastModifiedByType": { - "type": "string" - }, - "lastModifiedAt": { - "type": "string" - } - } - } - }, - "required": [ - "properties.watchlistItemType", - "properties.watchlistItemId", - "properties.tenantId", - "properties.isDeleted", - "properties.created", - "properties.updated", - "properties.createdBy", - "properties.updatedBy", - "properties.itemsKeyValue", - "properties.entityMapping", - "etag", - "id", - "name", - "type", - "systemData" - ] - } + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId11'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId11')]", + "contentId": "[variables('_playbookContentId11')]", + "kind": "Playbook", + "version": "[variables('playbookVersion11')]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ], + "metadata": { + "title": "Veeam-ResolveTriggeredAlarm", + "description": "A Microsoft Sentinel playbook with an incident trigger that resolves Veeam ONE alarms (identified by TriggeredAlarmId custom incident field) on the Veeam ONE server specified by the VoneHostName custom incident field.", + "prerequisites": [ + "1. Microsoft Sentinel workspace configured.", + "2. Permissions to create Logic Apps and API Connections.", + "3. Permissions to assign roles to the Resource Group.", + "4. Veeam Azure Function App deployed and configured.", + "5. Hybrid Connection and Key Vault secrets configured for each VBR Server." + ], + "tags": [ + "Automation", + "Veeam", + "VeeamONE", + "Alarm", + "Resolution" + ], + "lastUpdateTime": "2025-08-25T00:00:00Z", + "parameterTemplateVersion": "1.0.0", + "postDeployment": [ + "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace." + ], + "_generator": { + "name": "bicep", + "version": "0.36.177.2456", + "templateHash": "8701067040678761767" + }, + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId11')]", + "contentKind": "Playbook", + "displayName": "Veeam-ResolveTriggeredAlarm", + "contentProductId": "[variables('_playbookcontentProductId11')]", + "id": "[variables('_playbookcontentProductId11')]", + "version": "[variables('playbookVersion11')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName12')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam-StartSecurityComplianceAnalyzer Playbook with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion12')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Veeam-StartSecurityComplianceAnalyzer", + "type": "string", + "metadata": { + "description": "Name of the playbook (Logic App) to be created" + } + }, + "functionAppName": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Name of the Azure Function App for Veeam integration" + } + } + }, + "variables": { + "functionAppId": "[[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "type": "Microsoft.Logic/workflows", + "apiVersion": "2017-07-01", + "name": "[[parameters('PlaybookName')]", + "location": "[[variables('workspace-location-inline')]", + "identity": { + "type": "SystemAssigned" + }, + "tags": { + "hidden-SentinelTemplateName": "Veeam-StartSecurityComplianceAnalyzer", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "properties": { + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "functionAppName": { + "defaultValue": "[[parameters('functionAppName')]", + "type": "String" + }, + "VbrHostName": { + "defaultValue": "DefaultVbrHostName", + "type": "String" + } + }, + "triggers": { + "When_a_HTTP_request_is_received": { + "type": "Request", + "kind": "Http" + } + }, + "actions": { + "StartSecurityComplianceAnalyzer": { + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@parameters('VbrHostName')" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/StartSecurityComplianceAnalyzerAsync')]" + } + } + }, + "Parse_sessionId": { + "type": "ParseJson", + "inputs": { + "content": "@body('StartSecurityComplianceAnalyzer')", + "schema": { + "type": "object", + "properties": { + "sessionType": { + "type": "integer" + }, + "state": { + "type": "integer" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "jobId": { + "type": "string" + }, + "creationTime": { + "type": "string" + }, + "progressPercent": { + "type": "integer" + }, + "result": { + "type": "object", + "properties": { + "result": { + "type": "integer" + }, + "message": { + "type": "string" + }, + "isCanceled": { + "type": "boolean" } } + }, + "usn": { + "type": "integer" } } } }, "runAfter": { - "Watchlists_-_Get_Updated_VONE_Settings": [ + "StartSecurityComplianceAnalyzer": [ "Succeeded" ] } }, - "For_each_VBR_server_set_missing_parameters": { - "type": "Foreach", - "foreach": "@body('Parse_VBR_Settings')?['properties']?['watchlistItems']", - "actions": { - "Parse_current_VBR_server": { - "type": "ParseJson", - "inputs": { - "content": "@items('For_each_VBR_server_set_missing_parameters')", - "schema": { - "type": "object", - "properties": { - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Malware Events": { - "type": "string" - }, - "Collect Security and Compliance Analyzer Results": { - "type": "string" - }, - "Collect Authorization Events": { - "type": "string" - }, - "Collect Configuration Backups": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - } - } - } - } - } - } - }, - "Check_If_KeyVault_IDs_Missing": { - "type": "If", - "expression": { - "or": [ - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Password ID']", - "" - ] - }, - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Username ID']", - "" - ] - }, - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Password ID']", - "@null" - ] - }, - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Username ID']", - "@null" - ] - }, - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events']", - "" - ] - }, - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events']", - "@null" - ] - }, - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results']", - "" - ] - }, - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results']", - "@null" - ] - }, - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events']", - "" - ] - }, - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events']", - "@null" - ] - }, - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups']", - "" - ] - }, - { - "equals": [ - "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups']", - "@null" - ] - } - ] - }, - "actions": { - "Update_Watchlist_Item_With_KeyVault_IDs": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "put", - "body": { - "Veeam Server Name": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']", - "Base URL": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Base URL']", - "Collect Malware Events": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events'], null), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events'], '')), 'true', body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events'])", - "Collect Security and Compliance Analyzer Results": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results'], null), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results'], '')), 'true', body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results'])", - "Collect Authorization Events": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events'], null), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events'], '')), 'true', body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events'])", - "Collect Configuration Backups": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups'], null), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups'], '')), 'true', body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups'])", - "Key Vault Username ID": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Username ID']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Username ID'], null)), concat(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name'], 'Username'), body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Username ID'])", - "Key Vault Password ID": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Password ID']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Password ID'], null)), concat(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name'], 'Password'), body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Password ID'])" - }, - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItem/@{encodeURIComponent(items('For_each_VBR_server_set_missing_parameters')?['name'])}" - } - } - }, - "runAfter": { - "Parse_current_VBR_server": [ - "Succeeded" - ] - } - } - }, + "Compose": { + "type": "Compose", + "inputs": "@body('Parse_sessionId')?['id']", "runAfter": { - "Parse_VBR_Settings": [ + "Parse_sessionId": [ "Succeeded" ] - }, - "runtimeConfiguration": { - "concurrency": { - "repetitions": 1 - } } }, - "For_each_updated_VONE_server": { - "type": "Foreach", - "foreach": "@body('Parse_Updated_VONE_Settings')?['properties']?['watchlistItems']", + "Until_state_is_not_stopped": { + "type": "Until", + "expression": "@equals(body('Parse_session')?['state'],1)", + "limit": { + "timeout": "PT30M" + }, "actions": { - "Parse_current_updated_VONE_server": { + "GetSession": { + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@parameters('VbrHostName')", + "sessionId": "@body('Parse_sessionId')?['id']" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/GetSessionAsync')]" + } + } + }, + "Parse_session": { "type": "ParseJson", "inputs": { - "content": "@items('For_each_updated_VONE_server')", + "content": "@outputs('GetSession')", "schema": { "type": "object", "properties": { - "properties.watchlistItemType": { - "type": "string" + "sessionType": { + "type": "integer" }, - "properties.watchlistItemId": { - "type": "string" + "state": { + "type": "integer" }, - "properties.tenantId": { + "id": { "type": "string" }, - "properties.isDeleted": { - "type": "boolean" - }, - "properties.created": { + "name": { "type": "string" }, - "properties.updated": { + "jobId": { "type": "string" }, - "properties.createdBy": { - "type": "object", - "properties": { - "email": { - "type": "string" - }, - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } + "creationTime": { + "type": "string" }, - "properties.updatedBy": { - "type": "object", - "properties": { - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } + "progressPercent": { + "type": "integer" }, - "properties.itemsKeyValue": { + "result": { "type": "object", "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Alarms": { - "type": "string" + "result": { + "type": "integer" }, - "Key Vault Username ID": { + "message": { "type": "string" }, - "Key Vault Password ID": { - "type": "string" + "isCanceled": { + "type": "boolean" } } }, - "properties.entityMapping": { - "type": "object" - }, - "etag": { - "type": "string" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "type": "string" - }, - "systemData": { - "type": "object", - "properties": { - "createdBy": { - "type": "string" - }, - "createdByType": { - "type": "string" - }, - "createdAt": { - "type": "string" - }, - "lastModifiedBy": { - "type": "string" - }, - "lastModifiedByType": { - "type": "string" - }, - "lastModifiedAt": { - "type": "string" - } - } + "usn": { + "type": "integer" } } } + }, + "runAfter": { + "GetSession": [ + "Succeeded" + ] } }, - " Are_there_any_events_collected_from_VONE_server": { - "type": "If", - "expression": { - "and": [ - { - "equals": [ - "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms']", - "true" - ] - }, - { - "not": { - "equals": [ - "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Veeam Server Name']", - "ExampleServerName" - ] - } - } - ] - }, - "actions": { - "Set_VonePasswordId": { - "type": "SetVariable", - "inputs": { - "name": "VonePasswordId", - "value": "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Key Vault Password ID']" - } - }, - "Set_VoneUsernameId": { - "type": "SetVariable", - "inputs": { - "name": "VoneUsernameId", - "value": "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Key Vault Username ID']" - }, - "runAfter": { - "Set_VonePasswordId": [ - "Succeeded" - ] - } - }, - "Set_VoneServerName": { - "type": "SetVariable", - "inputs": { - "name": "VoneServerName", - "value": "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Veeam Server Name']" - }, - "runAfter": { - "Set_VoneUsernameId": [ - "Succeeded" - ] - } - }, - "Extract_Host_and_Port_VONE": { - "type": "Compose", - "inputs": { - "host": "@split(replace(variables('VoneBaseUrl'), 'https://', ''), ':')[0]", - "port": "@if(and(greater(length(split(replace(variables('VoneBaseUrl'), 'https://', ''), ':')), 1), not(equals(last(split(replace(variables('VoneBaseUrl'), 'https://', ''), ':')), ''))), int(last(split(replace(variables('VoneBaseUrl'), 'https://', ''), ':'))), 1239)" - }, - "runAfter": { - "Set_VoneBaseUrl": [ - "Succeeded" - ] - } - }, - "Setup_KeyVault_Secrets_VONE": { - "type": "Scope", - "actions": { - "Check_Username_Secret_Exists_VONE": { - "type": "Http", - "inputs": { - "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VoneUsernameId'), '?api-version=7.4')", - "method": "GET", - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" - } - } - }, - "Create_Username_Secret_VONE": { - "type": "Http", - "inputs": { - "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VoneUsernameId'), '?api-version=7.4')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" - }, - "body": { - "value": "UNDEFINED", - "attributes": { - "enabled": true - }, - "tags": { - "source": "playbook", - "vbrServer": "@variables('VoneServerName')", - "type": "username" - } - }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" - } - }, - "runAfter": { - "Check_Username_Secret_Exists_VONE": [ - "Failed" - ] - } - }, - "Check_Password_Secret_Exists_VONE": { - "type": "Http", - "inputs": { - "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VonePasswordId'), '?api-version=7.4')", - "method": "GET", - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" - } - } - }, - "Create_Password_Secret_VONE": { - "type": "Http", - "inputs": { - "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VonePasswordId'), '?api-version=7.4')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" - }, - "body": { - "value": "UNDEFINED", - "attributes": { - "enabled": true - }, - "tags": { - "source": "playbook", - "vbrServer": "@variables('VoneServerName')", - "type": "password", - "status": "requires_update" - } - }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" - } - }, - "runAfter": { - "Check_Password_Secret_Exists_VONE": [ - "Failed" - ] - } - } - }, - "runAfter": { - "Extract_Host_and_Port_VONE": [ - "Succeeded" - ] - } - }, - "Setup_Hybrid_Connection_VONE": { - "type": "Scope", - "actions": { - "Check_Hybrid_Connection_Exists_VONE": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VoneServerName'), '?api-version=2024-01-01')", - "method": "GET", - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - } - }, - "Create_Hybrid_Connection_VONE": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VoneServerName'), '?api-version=2024-01-01')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" - }, - "body": { - "properties": { - "requiresClientAuthorization": true, - "userMetadata": "@concat('[{\"key\":\"endpoint\",\"value\":\"', outputs('Extract_Host_and_Port_VONE')?['host'], ':', outputs('Extract_Host_and_Port_VONE')?['port'], '\"}]')" - } - }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - }, - "runAfter": { - "Check_Hybrid_Connection_Exists_VONE": [ - "Failed" - ] - } - }, - "Create_Listener_Rule_VONE": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VoneServerName'), '/authorizationRules/defaultListener?api-version=2024-01-01')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" - }, - "body": { - "properties": { - "rights": [ - "Listen" - ] - } - }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - }, - "runAfter": { - "Create_Hybrid_Connection_VONE": [ - "Succeeded" - ] - } - }, - "Create_Sender_Rule_VONE": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VoneServerName'), '/authorizationRules/defaultSender?api-version=2024-01-01')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" - }, - "body": { - "properties": { - "rights": [ - "Send" - ] - } - }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - }, - "runAfter": { - "Create_Listener_Rule_VONE": [ - "Succeeded" - ] - } - }, - "Get_Sender_Key_VONE": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VoneServerName'), '/authorizationRules/defaultSender/listKeys?api-version=2024-01-01')", - "method": "POST", - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - }, - "runAfter": { - "Create_Sender_Rule_VONE": [ - "Succeeded", - "Skipped" - ] - } - }, - "Check_Function_App_Binding_Exists_VONE": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Web/sites/', parameters('functionAppName'), '/hybridConnectionNamespaces/', parameters('relayNamespaceName'), '/relays/', variables('VoneServerName'), '?api-version=2022-03-01')", - "method": "GET", - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - }, - "runAfter": { - "Get_Sender_Key_VONE": [ - "Succeeded", - "Skipped" - ] - } - }, - "Bind_To_Function_App_VONE": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Web/sites/', parameters('functionAppName'), '/hybridConnectionNamespaces/', parameters('relayNamespaceName'), '/relays/', variables('VoneServerName'), '?api-version=2022-03-01')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" - }, - "body": { - "properties": { - "hostname": "@outputs('Extract_Host_and_Port_VONE')?['host']", - "port": "@outputs('Extract_Host_and_Port_VONE')?['port']", - "relayArmUri": "@if(equals(body('Check_Hybrid_Connection_Exists_VONE')?['id'], null), body('Create_Hybrid_Connection_VONE')?['id'], body('Check_Hybrid_Connection_Exists_VONE')?['id'])", - "relayName": "@variables('VoneServerName')", - "sendKeyName": "defaultSender", - "sendKeyValue": "@body('Get_Sender_Key_VONE')?['primaryKey']", - "serviceBusNamespace": "@parameters('relayNamespaceName')", - "serviceBusSuffix": ".servicebus.windows.net" - } - }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - }, - "runAfter": { - "Check_Function_App_Binding_Exists_VONE": [ - "Failed" - ] - } - } - }, - "runAfter": { - "Setup_KeyVault_Secrets_VONE": [ - "Succeeded" - ] - } - }, - "Set_VoneBaseUrl": { - "type": "SetVariable", - "inputs": { - "name": "VoneBaseUrl", - "value": "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Base URL']" - }, - "runAfter": { - "Set_VoneServerName": [ - "Succeeded" - ] - } - } + "Delay": { + "type": "Wait", + "inputs": { + "interval": { + "count": 1, + "unit": "Minute" + } }, "runAfter": { - "Parse_current_updated_VONE_server": [ + "Parse_session": [ "Succeeded" ] } } }, "runAfter": { - "Parse_Updated_VONE_Settings": [ + "Compose": [ "Succeeded" ] - }, - "runtimeConfiguration": { - "concurrency": { - "repetitions": 1 + } + }, + "GetSecurityComplianceAnalyzerResultsAsync": { + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@parameters('VbrHostName')" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/GetSecurityComplianceAnalyzerResultsAsync')]" } + }, + "runAfter": { + "Until_state_is_not_stopped": [ + "Succeeded" + ] } }, - "For_each_updated_VBR_server": { - "type": "Foreach", - "foreach": "@body('Parse_updated_VBR_Settings')?['properties']?['watchlistItems']", - "actions": { - "Are_there_any_events_collected_from_VBR_server": { - "type": "If", - "expression": { - "and": [ - { - "not": { - "equals": [ - "@item()?['properties.itemsKeyValue']?['Veeam Server Name']", - "ExampleServerName" - ] - } - }, - { - "or": [ - { - "equals": [ - "@body('Parse_current_updated_VBR_Server')?['properties.itemsKeyValue']?['Collect Malware Events']", - "true" - ] - }, - { - "equals": [ - "@body('Parse_current_updated_VBR_Server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results']", - "true" - ] - }, - { - "equals": [ - "@body('Parse_current_updated_VBR_Server')?['properties.itemsKeyValue']?['Collect Authorization Events']", - "true" - ] - } - ] - } - ] - }, - "actions": { - "Extract_Host_and_Port_VBR": { - "type": "Compose", - "inputs": { - "host": "@split(replace(variables('VbrBaseUrl'), 'https://', ''), ':')[0]", - "port": "@if(and(greater(length(split(replace(variables('VbrBaseUrl'), 'https://', ''), ':')), 1), not(equals(last(split(replace(variables('VbrBaseUrl'), 'https://', ''), ':')), ''))), int(last(split(replace(variables('VbrBaseUrl'), 'https://', ''), ':'))), 9419)" - }, - "runAfter": { - "Set_VbrBaseUrl": [ - "Succeeded" - ] - } - }, - "Setup_KeyVault_Secrets_VBR": { - "type": "Scope", - "actions": { - "Check_Username_Secret_Exists_VBR": { - "type": "Http", - "inputs": { - "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VbrUsernameId'), '?api-version=7.4')", - "method": "GET", - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" - } - } - }, - "Create_Username_Secret_VBR": { - "type": "Http", - "inputs": { - "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VbrUsernameId'), '?api-version=7.4')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" - }, - "body": { - "value": "UNDEFINED", - "attributes": { - "enabled": true - }, - "tags": { - "source": "playbook", - "vbrServer": "@variables('VbrServerName')", - "type": "username" - } - }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" - } - }, - "runAfter": { - "Check_Username_Secret_Exists_VBR": [ - "Failed" - ] - } - }, - "Check_Password_Secret_Exists_VBR": { - "type": "Http", - "inputs": { - "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VbrPasswordId'), '?api-version=7.4')", - "method": "GET", - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" - } - } - }, - "Create_Password_Secret_VBR": { - "type": "Http", - "inputs": { - "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VbrPasswordId'), '?api-version=7.4')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" - }, - "body": { - "value": "UNDEFINED", - "attributes": { - "enabled": true - }, - "tags": { - "source": "playbook", - "vbrServer": "@variables('VbrServerName')", - "type": "password", - "status": "requires_update" - } - }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" - } - }, - "runAfter": { - "Check_Password_Secret_Exists_VBR": [ - "Failed" - ] + "Compose_output": { + "type": "Compose", + "inputs": "@body('Parse_session')", + "runAfter": { + "GetSecurityComplianceAnalyzerResultsAsync": [ + "Succeeded" + ] + } + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId12'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId12')]", + "contentId": "[variables('_playbookContentId12')]", + "kind": "Playbook", + "version": "[variables('playbookVersion12')]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ], + "metadata": { + "title": "Veeam-StartSecurityComplianceAnalyzer", + "description": "This Microsoft Sentinel playbook initiates and monitors Veeam Security and Compliance Analyzer sessions via HTTP trigger.", + "prerequisites": [ + "1. Microsoft Sentinel workspace configured.", + "2. Permissions to create Logic Apps and API Connections.", + "3. Permissions to assign roles to the Resource Group.", + "4. Veeam Azure Function App deployed and configured.", + "5. Hybrid Connection and Key Vault secrets configured for the VBR Server." + ], + "tags": [ + "Automation", + "Veeam", + "BestPractice", + "Analyzer", + "HTTP" + ], + "lastUpdateTime": "2025-08-25T00:00:00Z", + "parameterTemplateVersion": "1.0.0", + "postDeployment": [], + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId12')]", + "contentKind": "Playbook", + "displayName": "Veeam-StartSecurityComplianceAnalyzer", + "contentProductId": "[variables('_playbookcontentProductId12')]", + "id": "[variables('_playbookcontentProductId12')]", + "version": "[variables('playbookVersion12')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName13')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam-PerformConfigurationBackupOnIncident Playbook with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion13')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Veeam-PerformConfigurationBackupOnIncident", + "type": "string", + "metadata": { + "description": "Name of the playbook (Logic App) to be created" + } + }, + "functionAppName": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Name of the Azure Function App for Veeam integration" + } + }, + "subscriptionId": { + "type": "string", + "defaultValue": "[subscription().subscriptionId]", + "metadata": { + "description": "Subscription ID where resources are deployed" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "Resource group name where Function App is deployed" + } + }, + "AzureSentinelConnectionName": { + "type": "string", + "defaultValue": "azuresentinel-connection", + "metadata": { + "description": "The name to use for the Microsoft Sentinel Connector in the Logic App" + } + } + }, + "variables": { + "functionAppId": "[[resourceId(parameters('subscriptionId'), parameters('resourceGroupName'), 'Microsoft.Web/sites', parameters('functionAppName'))]", + "connection-1": "[[concat('/subscriptions/', parameters('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "_connection-1": "[[variables('connection-1')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[parameters('AzureSentinelConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "properties": { + "displayName": "[[parameters('AzureSentinelConnectionName')]", + "api": { + "id": "[[variables('_connection-1')]" + }, + "parameterValueType": "Alternative" + } + }, + { + "type": "Microsoft.Logic/workflows", + "apiVersion": "2017-07-01", + "name": "[[parameters('PlaybookName')]", + "location": "[[variables('workspace-location-inline')]", + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" + ], + "identity": { + "type": "SystemAssigned" + }, + "tags": { + "hidden-SentinelTemplateName": "Veeam-StartConfigurationBackup-Incident", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "properties": { + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "type": "Object" + } + }, + "triggers": { + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "body": { + "callback_url": "@{listCallbackUrl()}" + }, + "path": "/incident-creation" + } + } + }, + "actions": { + "Initialize_VbrHostName": { + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "VbrHostName", + "type": "string" + } + ] + } + }, + "Initialize_SessionId": { + "runAfter": { + "Initialize_VbrHostName": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "SessionId", + "type": "string" + } + ] + } + }, + "Parse_custom_fields": { + "foreach": "@triggerBody()?['object']?['properties']?['Alerts']", + "actions": { + "Parse_JSON": { + "type": "ParseJson", + "inputs": { + "content": "@items('Parse_custom_fields')?['properties']?['additionalData']?['Custom Details']", + "schema": { + "type": "object", + "properties": { + "VbrHostName": { + "type": "array", + "items": { + "type": "string" } } - }, - "runAfter": { - "Extract_Host_and_Port_VBR": [ - "Succeeded" - ] } + } + } + }, + "Get_VbrHostName": { + "foreach": "@outputs('Parse_JSON')?['body']?['VbrHostName']", + "actions": { + "Set_variable_VbrHostName": { + "type": "SetVariable", + "inputs": { + "name": "VbrHostName", + "value": "@items('Get_VbrHostName')" + } + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + } + }, + "runAfter": { + "Initialize_SessionId": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Check_if_VbrHostName_found": { + "actions": { + "StartConfigurationBackupAsync": { + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@variables('VbrHostName')" }, - "Setup_Hybrid_Connection_VBR": { - "type": "Scope", - "actions": { - "Check_Hybrid_Connection_Exists_VBR": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VbrServerName'), '?api-version=2024-01-01')", - "method": "GET", - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - } + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/StartConfigurationBackupAsync')]" + } + } + }, + "Parse_sessionId": { + "runAfter": { + "StartConfigurationBackupAsync": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@outputs('StartConfigurationBackupAsync')", + "schema": { + "type": "object", + "properties": { + "statusCode": { + "type": "integer" }, - "Create_Hybrid_Connection_VBR": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VbrServerName'), '?api-version=2024-01-01')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" + "headers": { + "type": "object", + "properties": { + "Date": { + "type": "string" }, - "body": { - "properties": { - "requiresClientAuthorization": true, - "userMetadata": "@concat('[{\"key\":\"endpoint\",\"value\":\"', outputs('Extract_Host_and_Port_VBR')?['host'], ':', outputs('Extract_Host_and_Port_VBR')?['port'], '\"}]')" - } + "Transfer-Encoding": { + "type": "string" }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - }, - "runAfter": { - "Check_Hybrid_Connection_Exists_VBR": [ - "Failed" - ] - } - }, - "Create_Listener_Rule_VBR": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VbrServerName'), '/authorizationRules/defaultListener?api-version=2024-01-01')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" + "Strict-Transport-Security": { + "type": "string" }, - "body": { - "properties": { - "rights": [ - "Listen" - ] - } + "x-ms-middleware-request-id": { + "type": "string" }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" + "Content-Type": { + "type": "string" + }, + "Content-Length": { + "type": "string" } - }, - "runAfter": { - "Create_Hybrid_Connection_VBR": [ - "Succeeded" - ] } }, - "Create_Sender_Rule_VBR": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VbrServerName'), '/authorizationRules/defaultSender?api-version=2024-01-01')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" + "body": { + "type": "object", + "properties": { + "sessionType": { + "type": "integer" }, - "body": { - "properties": { - "rights": [ - "Send" - ] - } + "state": { + "type": "integer" }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - }, - "runAfter": { - "Create_Listener_Rule_VBR": [ - "Succeeded" - ] - } - }, - "Get_Sender_Key_VBR": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VbrServerName'), '/authorizationRules/defaultSender/listKeys?api-version=2024-01-01')", - "method": "POST", - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - }, - "runAfter": { - "Create_Sender_Rule_VBR": [ - "Succeeded" - ] - } - }, - "Check_Function_App_Binding_Exists_VBR": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Web/sites/', parameters('functionAppName'), '/hybridConnectionNamespaces/', parameters('relayNamespaceName'), '/relays/', variables('VbrServerName'), '?api-version=2022-03-01')", - "method": "GET", - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" - } - }, - "runAfter": { - "Get_Sender_Key_VBR": [ - "Succeeded" - ] - } - }, - "Bind_To_Function_App_VBR": { - "type": "Http", - "inputs": { - "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Web/sites/', parameters('functionAppName'), '/hybridConnectionNamespaces/', parameters('relayNamespaceName'), '/relays/', variables('VbrServerName'), '?api-version=2022-03-01')", - "method": "PUT", - "headers": { - "Content-Type": "application/json" + "id": { + "type": "string" }, - "body": { + "name": { + "type": "string" + }, + "jobId": { + "type": "string" + }, + "creationTime": { + "type": "string" + }, + "progressPercent": { + "type": "integer" + }, + "result": { + "type": "object", "properties": { - "hostname": "@outputs('Extract_Host_and_Port_VBR')?['host']", - "port": "@outputs('Extract_Host_and_Port_VBR')?['port']", - "relayArmUri": "@if(equals(body('Check_Hybrid_Connection_Exists_VBR')?['id'], null), body('Create_Hybrid_Connection_VBR')?['id'], body('Check_Hybrid_Connection_Exists_VBR')?['id'])", - "relayName": "@variables('VbrServerName')", - "sendKeyName": "defaultSender", - "sendKeyValue": "@body('Get_Sender_Key_VBR')?['primaryKey']", - "serviceBusNamespace": "@parameters('relayNamespaceName')", - "serviceBusSuffix": ".servicebus.windows.net" + "result": { + "type": "integer" + }, + "message": { + "type": "string" + }, + "isCanceled": { + "type": "boolean" + } } }, - "authentication": { - "type": "ManagedServiceIdentity", - "audience": "@parameters('azureManagementDomain')" + "usn": { + "type": "integer" } - }, - "runAfter": { - "Check_Function_App_Binding_Exists_VBR": [ - "Failed" - ] } } - }, - "runAfter": { - "Setup_KeyVault_Secrets_VBR": [ - "Succeeded" - ] - } - }, - "Set_VbrPasswordId": { - "type": "SetVariable", - "inputs": { - "name": "VbrPasswordId", - "value": "@item()?['properties.itemsKeyValue']?['Key Vault Password ID']" } - }, - "Set_VbrUsernameId": { - "type": "SetVariable", - "inputs": { - "name": "VbrUsernameId", - "value": "@item()?['properties.itemsKeyValue']?['Key Vault Username ID']" - }, - "runAfter": { - "Set_VbrPasswordId": [ - "Succeeded" - ] + } + } + }, + "Set_SessionId": { + "runAfter": { + "Parse_sessionId": [ + "Succeeded" + ] + }, + "type": "SetVariable", + "inputs": { + "name": "SessionId", + "value": "@body('Parse_sessionId')?['body']?['id']" + } + }, + "Add_backup_started_comment": { + "runAfter": { + "Set_SessionId": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, - "Set_VbrServerName": { - "type": "SetVariable", + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Configuration backup started on @{variables('VbrHostName')} with session ID: @{variables('SessionId')}

" + }, + "path": "/Incidents/Comment" + } + }, + "Until_state_is_not_stopped": { + "actions": { + "GetSession": { + "type": "Function", "inputs": { - "name": "VbrServerName", - "value": "@item()?['properties.itemsKeyValue']?['Veeam Server Name']" - }, + "queries": { + "vbrHostName": "@variables('VbrHostName')", + "sessionId": "@variables('SessionId')" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/GetSessionAsync')]" + } + } + }, + "Parse_session": { "runAfter": { - "Set_VbrUsernameId": [ + "GetSession": [ "Succeeded" ] + }, + "type": "ParseJson", + "inputs": { + "content": "@outputs('GetSession')", + "schema": { + "type": "object", + "properties": { + "statusCode": { + "type": "integer" + }, + "headers": { + "type": "object", + "properties": { + "Date": { + "type": "string" + }, + "Transfer-Encoding": { + "type": "string" + }, + "Request-Context": { + "type": "string" + }, + "Content-Type": { + "type": "string" + }, + "Content-Length": { + "type": "string" + } + } + }, + "body": { + "type": "object", + "properties": { + "sessionType": { + "type": "integer" + }, + "state": { + "type": "integer" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "jobId": { + "type": "string" + }, + "creationTime": { + "type": "string" + }, + "progressPercent": { + "type": "integer" + }, + "result": { + "type": "object", + "properties": { + "result": { + "type": "integer" + }, + "message": { + "type": "string" + }, + "isCanceled": { + "type": "boolean" + } + } + }, + "usn": { + "type": "integer" + } + } + } + } + } } }, - "Set_VbrBaseUrl": { - "type": "SetVariable", - "inputs": { - "name": "VbrBaseUrl", - "value": "@item()?['properties.itemsKeyValue']?['Base URL']" - }, + "Delay": { "runAfter": { - "Set_VbrServerName": [ + "Parse_session": [ "Succeeded" ] + }, + "type": "Wait", + "inputs": { + "interval": { + "count": 1, + "unit": "Minute" + } } } }, "runAfter": { - "Parse_current_updated_VBR_Server": [ + "Add_backup_started_comment": [ + "Succeeded" + ] + }, + "expression": "@equals(body('Parse_session')?['body']?['state'],1)", + "limit": { + "timeout": "PT30M" + }, + "type": "Until" + }, + "IngestSessionDataBySessionIdAsync": { + "runAfter": { + "Until_state_is_not_stopped": [ "Succeeded" ] + }, + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@variables('VbrHostName')", + "sessionId": "@variables('SessionId')" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/IngestSessionDataBySessionIdAsync')]" + } } }, - "Parse_current_updated_VBR_Server": { - "type": "ParseJson", + "Add_backup_completed_comment": { + "runAfter": { + "IngestSessionDataBySessionIdAsync": [ + "Succeeded", + "Failed", + "Skipped", + "TimedOut" + ] + }, + "type": "ApiConnection", "inputs": { - "content": "@items('For_each_updated_VBR_server')", - "schema": { - "type": "object", - "properties": { - "properties.watchlistItemType": { - "type": "string" - }, - "properties.watchlistItemId": { - "type": "string" - }, - "properties.tenantId": { - "type": "string" - }, - "properties.isDeleted": { - "type": "boolean" - }, - "properties.created": { - "type": "string" - }, - "properties.updated": { - "type": "string" - }, - "properties.createdBy": { - "type": "object", - "properties": { - "email": { - "type": "string" - }, - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } - }, - "properties.updatedBy": { - "type": "object", - "properties": { - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } - }, - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Malware Events": { - "type": "string" - }, - "Collect Security and Compliance Analyzer Results": { - "type": "string" - }, - "Collect Authorization Events": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - } - } - }, - "properties.entityMapping": { - "type": "object" - }, - "etag": { - "type": "string" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "type": "string" - }, - "systemData": { - "type": "object", - "properties": { - "createdBy": { - "type": "string" - }, - "createdByType": { - "type": "string" - }, - "createdAt": { - "type": "string" - }, - "lastModifiedBy": { - "type": "string" - }, - "lastModifiedByType": { - "type": "string" - }, - "lastModifiedAt": { - "type": "string" - } - } - } + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" } - } + }, + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Configuration backup completed on @{variables('VbrHostName')}. Final result: @{body('Parse_session')?['body']?['result']?['result']}

Session data has been ingested into the workspace.

" + }, + "path": "/Incidents/Comment" } } }, "runAfter": { - "Parse_updated_VBR_Settings": [ + "Parse_custom_fields": [ "Succeeded" ] }, - "runtimeConfiguration": { - "concurrency": { - "repetitions": 1 - } - } - }, - "Watchlists_-_Get_Updated_VBR_Settings": { - "type": "ApiConnection", - "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" - } - }, - "method": "get", - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItems" - }, - "runAfter": { - "For_each_VBR_server_set_missing_parameters": [ - "Succeeded" - ] - } - }, - "Parse_updated_VBR_Settings": { - "type": "ParseJson", - "inputs": { - "content": "@body('Watchlists_-_Get_Updated_VBR_Settings')", - "schema": { - "type": "object", - "properties": { - "properties": { - "type": "object", - "properties": { - "watchlistItems": { - "type": "array", - "items": { - "type": "object", - "properties": { - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Malware Events": { - "type": "string" - }, - "Collect Security and Compliance Analyzer Results": { - "type": "string" - }, - "Collect Authorization Events": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - } - } - } - }, - "required": [ - "properties.itemsKeyValue" - ] - } + "else": { + "actions": { + "Add_no_hostname_comment": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" } - } + }, + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Warning: No VbrHostName found in incident custom fields. Configuration backup cannot be started.

Please ensure the incident contains a 'VbrHostName' custom field with the target Veeam server hostname.

" + }, + "path": "/Incidents/Comment" } } } }, - "runAfter": { - "Watchlists_-_Get_Updated_VBR_Settings": [ - "Succeeded" + "expression": { + "and": [ + { + "not": { + "equals": [ + "@variables('VbrHostName')", + "" + ] + } + } ] + }, + "type": "If" + } + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionName": "[[parameters('AzureSentinelConnectionName')]", + "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", + "id": "[[concat('/subscriptions/', parameters('subscriptionId'), '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } } - }, - "Parse_VONE_Settings": { - "type": "ParseJson", - "inputs": { - "content": "@body('Watchlists_-_Get_VONE_Settings_')", - "schema": { - "type": "object", - "properties": { - "id": { - "type": "string" - }, - "type": { - "type": "string" - }, - "properties": { - "type": "object", - "properties": { - "watchlistItems": { - "type": "array", - "items": { - "type": "object", - "properties": { - "properties.watchlistItemType": { - "type": "string" - }, - "properties.watchlistItemId": { - "type": "string" - }, - "properties.tenantId": { - "type": "string" - }, - "properties.isDeleted": { - "type": "boolean" - }, - "properties.created": { - "type": "string" - }, - "properties.updated": { - "type": "string" - }, - "properties.createdBy": { - "type": "object", - "properties": { - "email": { - "type": "string" - }, - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } - }, - "properties.updatedBy": { - "type": "object", - "properties": { - "name": { - "type": "string" - }, - "objectId": { - "type": "string" - } - } - }, - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Alarms": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - } - } - }, - "properties.entityMapping": { - "type": "object" - }, - "etag": { - "type": "string" - }, - "id": { - "type": "string" - }, - "name": { - "type": "string" - }, - "type": { - "type": "string" - }, - "systemData": { - "type": "object", - "properties": { - "createdBy": { - "type": "string" - }, - "createdByType": { - "type": "string" - }, - "createdAt": { - "type": "string" - }, - "lastModifiedBy": { - "type": "string" - }, - "lastModifiedByType": { - "type": "string" - }, - "lastModifiedAt": { - "type": "string" - } - } - } - }, - "required": [ - "properties.watchlistItemType", - "properties.watchlistItemId", - "properties.tenantId", - "properties.isDeleted", - "properties.created", - "properties.updated", - "properties.createdBy", - "properties.updatedBy", - "properties.itemsKeyValue", - "properties.entityMapping", - "etag", - "id", - "name", - "type", - "systemData" - ] - } - } - } - } - } - } - }, - "runAfter": { - "Watchlists_-_Get_VONE_Settings_": [ - "Succeeded" - ] - } - }, - "Watchlists_-_Get_VONE_Settings_": { - "type": "ApiConnection", + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId13'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId13')]", + "contentId": "[variables('_playbookContentId13')]", + "kind": "Playbook", + "version": "[variables('playbookVersion13')]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ], + "metadata": { + "title": "Veeam-PerformConfigurationBackupOnIncident", + "description": "A Microsoft Sentinel playbook that automatically runs configuration backup session when triggered by an incident. The playbook gets Veeam Backup & Replication settings from incident custom fields, runs the configuration backup session, and collects the session result.", + "prerequisites": [ + "1. Microsoft Sentinel workspace configured.", + "2. Permissions to create Logic Apps and API Connections.", + "3. Permissions to assign roles to the Resource Group.", + "4. Veeam Azure Function App deployed and configured.", + "5. Hybrid Connection and Key Vault secrets configured for each VBR Server." + ], + "tags": [ + "Automation", + "Veeam", + "Configuration", + "Backup", + "Incident" + ], + "lastUpdateTime": "2025-08-25T00:00:00Z", + "parameterTemplateVersion": "1.0.0", + "postDeployment": [ + "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace." + ], + "_generator": { + "name": "bicep", + "version": "0.36.177.2456", + "templateHash": "8701067040678761767" + }, + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId13')]", + "contentKind": "Playbook", + "displayName": "Veeam-PerformConfigurationBackupOnIncident", + "contentProductId": "[variables('_playbookcontentProductId13')]", + "id": "[variables('_playbookcontentProductId13')]", + "version": "[variables('playbookVersion13')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName14')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam-StartQuickBackup Playbook with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion14')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Veeam-StartQuickBackup", + "type": "string", + "metadata": { + "description": "Name of the playbook (Logic App) to be created" + } + }, + "functionAppName": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Name of the Azure Function App for Veeam integration" + } + }, + "AzureSentinelConnectionName": { + "type": "string", + "defaultValue": "azuresentinel-connection", + "metadata": { + "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" + } + } + }, + "variables": { + "functionAppId": "[[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]", + "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "_connection-1": "[[variables('connection-1')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[parameters('AzureSentinelConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "properties": { + "displayName": "[[parameters('AzureSentinelConnectionName')]", + "api": { + "id": "[[variables('_connection-1')]" + }, + "parameterValueType": "Alternative" + } + }, + { + "type": "Microsoft.Logic/workflows", + "apiVersion": "2017-07-01", + "name": "[[parameters('PlaybookName')]", + "location": "[[variables('workspace-location-inline')]", + "identity": { + "type": "SystemAssigned" + }, + "tags": { + "hidden-SentinelTemplateName": "Veeam-StartQuickBackup", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" + ], + "properties": { + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.1", + "parameters": { + "$connections": { + "type": "Object" + } + }, + "triggers": { + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, - "method": "get", - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vone_settings')}/watchlistItems" - }, - "runAfter": { - "Initialize_Variables": [ - "Succeeded" - ] + "body": { + "callback_url": "@listCallbackUrl()" + }, + "path": "/incident-creation" } - }, - "Watchlists_-_Get_VBR_Settings": { - "type": "ApiConnection", + } + }, + "actions": { + "Initialize_VbrHostName": { + "type": "InitializeVariable", "inputs": { - "host": { - "connection": { - "name": "@parameters('$connections')['azuresentinel']['connectionId']" + "variables": [ + { + "name": "VbrHostName", + "type": "string", + "value": "none" } - }, - "method": "get", - "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItems" - }, + ] + } + }, + "Initialize_BackupObjectId": { "runAfter": { - "Initialize_Variables": [ + "Initialize_VbrHostName": [ "Succeeded" ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "BackupObjectId", + "type": "string", + "value": "none" + } + ] } }, - "Parse_VBR_Settings": { - "type": "ParseJson", - "inputs": { - "content": "@body('Watchlists_-_Get_VBR_Settings')", - "schema": { - "type": "object", - "properties": { - "properties": { + "Get_variables_from_custom_fields": { + "foreach": "@triggerBody()?['object']?['properties']?['Alerts']", + "actions": { + "Parse_JSON": { + "type": "ParseJson", + "inputs": { + "content": "@item()?['properties']?['additionalData']?['Custom Details']", + "schema": { "type": "object", "properties": { - "watchlistItems": { + "VbrHostName": { "type": "array", "items": { - "type": "object", - "properties": { - "properties.itemsKeyValue": { - "type": "object", - "properties": { - "Veeam Server Name": { - "type": "string" - }, - "Base URL": { - "type": "string" - }, - "Collect Malware Events": { - "type": "string" - }, - "Collect Security and Compliance Analyzer Results": { - "type": "string" - }, - "Collect Authorization Events": { - "type": "string" - }, - "Key Vault Password ID": { - "type": "string" - }, - "Key Vault Username ID": { - "type": "string" - } - } - } - }, - "required": [ - "properties.itemsKeyValue" - ] + "type": "string" + } + }, + "MachineDisplayName": { + "type": "array", + "items": { + "type": "string" + } + }, + "MachineUuid": { + "type": "array", + "items": { + "type": "string" + } + }, + "BackupObjectId": { + "type": "array", + "items": { + "type": "string" } } } } } + }, + "Get_VbrHostName": { + "foreach": "@body('Parse_JSON')?['VbrHostName']", + "actions": { + "Set_variable": { + "type": "SetVariable", + "inputs": { + "name": "VbrHostName", + "value": "@{items('Get_VbrHostName')}" + } + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_BackupObjectId": { + "foreach": "@body('Parse_JSON')?['BackupObjectId']", + "actions": { + "Set_BackupObjectId": { + "type": "SetVariable", + "inputs": { + "name": "BackupObjectId", + "value": "@items('Get_BackupObjectId')" + } + } + }, + "runAfter": { + "Get_VbrHostName": [ + "Succeeded" + ] + }, + "type": "Foreach" } }, "runAfter": { - "Watchlists_-_Get_VBR_Settings": [ + "Initialize_BackupObjectId": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "GetBackupObjectByIdAsync": { + "runAfter": { + "Get_variables_from_custom_fields": [ "Succeeded" ] + }, + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@variables('VbrHostName')", + "backupObjectId": "@variables('BackupObjectId')" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/GetBackupObjectByIdAsync')]" + } } - } + }, + "Parse_properties": { + "runAfter": { + "GetBackupObjectByIdAsync": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('GetBackupObjectByIdAsync')", + "schema": { + "type": "object", + "properties": { + "ViType": { + "type": "string" + }, + "VmHostName": { + "type": "string" + }, + "VmName": { + "type": "string" + }, + "ObjectId": { + "type": "string" + } + } + } + } + }, + "StartQuickBackupJobAsync": { + "runAfter": { + "Parse_properties": [ + "Succeeded" + ] + }, + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@variables('VbrHostName')", + "ViType": "@body('Parse_properties')?['ViType']", + "VmHostName": "@body('Parse_properties')?['VmHostName']", + "VmName": "@body('Parse_properties')?['VmName']", + "ObjectId": "@body('Parse_properties')?['ObjectId']" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/StartQuickBackupJobAsync')]" + } + } + }, + "Check_StartQuickBackup_Result": { + "runAfter": { + "StartQuickBackupJobAsync": [ + "Succeeded", + "Failed" + ] + }, + "type": "If", + "expression": { + "and": [ + { + "equals": [ + "@outputs('StartQuickBackupJobAsync')?['statusCode']", + 200 + ] + } + ] + }, + "actions": { + "Indicate_starting_with_comment": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Quick backup for @{variables('VbrHostName')} has started.

" + }, + "path": "/Incidents/Comment" + } + } + }, + "else": { + "actions": { + "Indicate_failure_with_comment": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Quick backup for @{variables('VbrHostName')} has failed to start.

" + }, + "path": "/Incidents/Comment" + } + } + } + } + }, + "Parse_session_ID": { + "runAfter": { + "Check_StartQuickBackup_Result": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('StartQuickBackupJobAsync')", + "schema": { + "type": "object", + "properties": { + "sessionType": { + "type": "integer" + }, + "state": { + "type": "integer" + }, + "platformName": { + "type": "integer" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "jobId": { + "type": "string" + }, + "creationTime": { + "type": "string" + }, + "progressPercent": { + "type": "integer" + }, + "result": { + "type": "object", + "properties": { + "result": { + "type": "integer" + }, + "message": { + "type": "string" + }, + "isCanceled": { + "type": "boolean" + } + } + }, + "usn": { + "type": "integer" + }, + "platformId": { + "type": "string" + } + } + } + } + }, + "Until_state_is_not_Stopped": { + "actions": { + "GetSession_": { + "type": "Function", + "inputs": { + "queries": { + "vbrHostName": "@variables('VbrHostName')", + "sessionId": "@body('Parse_session_ID')?['id']" + }, + "function": { + "id": "[[concat(variables('functionAppId'), '/functions/GetSessionAsync')]" + } + } + }, + "Parse_session": { + "runAfter": { + "GetSession_": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('GetSession_')", + "schema": { + "type": "object", + "properties": { + "sessionType": { + "type": "integer" + }, + "state": { + "type": "integer" + }, + "platformName": { + "type": "integer" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "jobId": { + "type": "string" + }, + "creationTime": { + "type": "string" + }, + "progressPercent": { + "type": "integer" + }, + "result": { + "type": "object", + "properties": { + "result": { + "type": "integer" + }, + "message": { + "type": "string" + }, + "isCanceled": { + "type": "boolean" + } + } + }, + "usn": { + "type": "integer" + }, + "platformId": { + "type": "string" + } + } + } + } + }, + "Delay": { + "runAfter": { + "Parse_session": [ + "Succeeded" + ] + }, + "type": "Wait", + "inputs": { + "interval": { + "count": 3, + "unit": "Minute" + } + } + } + }, + "runAfter": { + "Parse_session_ID": [ + "Succeeded" + ] + }, + "expression": "@equals(body('Parse_session')?['state'],1)", + "limit": { + "timeout": "PT3H" + }, + "type": "Until" + }, + "Result": { + "runAfter": { + "Until_state_is_not_Stopped": [ + "Succeeded" + ] + }, + "type": "Compose", + "inputs": "@body('Parse_session')?['result']" + }, + "Show_result_as_a_comment": { + "runAfter": { + "Result": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Quick backup has finished. Details: @{outputs('Result')}.

" + }, + "path": "/Incidents/Comment" + } + } + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionName": "[[parameters('AzureSentinelConnectionName')]", + "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", + "id": "[[concat('/subscriptions/',subscription().subscriptionId, '/providers/Microsoft.Web/locations/',variables('workspace-location-inline'),'/managedApis/azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + } + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId14'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId14')]", + "contentId": "[variables('_playbookContentId14')]", + "kind": "Playbook", + "version": "[variables('playbookVersion14')]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ], + "metadata": { + "title": "Veeam-StartQuickBackup", + "description": "A Microsoft Sentinel playbook with an incident trigger, that performs quick backup support for affected backupObject (specifided by the BackupObjectId incidents custom field) when triggered by Microsoft Sentinel incidents. Indicates results as incident comments.", + "prerequisites": [ + "1. Microsoft Sentinel workspace configured.", + "2. Permissions to create Logic Apps and API Connections.", + "3. Permissions to assign roles to the Resource Group.", + "4. Veeam Azure Function App deployed and configured.", + "5. Hybrid Connection and Key Vault secrets configured for each VBR Server." + ], + "tags": [ + "Automation", + "Veeam", + "QuickBackup", + "Support", + "IncidentResponse" + ], + "lastUpdateTime": "2025-08-25T00:00:00Z", + "parameterTemplateVersion": "1.0.1", + "postDeployment": [ + "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace." + ], + "_generator": { + "name": "bicep", + "version": "0.36.177.2456", + "templateHash": "8701067040678761767" + }, + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId14')]", + "contentKind": "Playbook", + "displayName": "Veeam-StartQuickBackup", + "contentProductId": "[variables('_playbookcontentProductId14')]", + "id": "[variables('_playbookcontentProductId14')]", + "version": "[variables('playbookVersion14')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName15')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam-SetupConnections Playbook with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion15')]", + "parameters": { + "PlaybookName": { + "type": "string", + "defaultValue": "Veeam-SetupConnections", + "metadata": { + "description": "Name of the playbook (Logic App) to be created" + } + }, + "functionAppName": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Name of the Azure Function App for Veeam integration" + } + }, + "keyVaultName": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Name of the Azure Key Vault" + } + }, + "relayNamespaceName": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Name of the Azure Relay namespace" + } + }, + "workspaceId": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace ID (GUID) of the Log Analytics workspace that contains Microsoft Sentinel" + } + }, + "AzureSentinelConnectionName": { + "type": "string", + "defaultValue": "azuresentinel-connection", + "metadata": { + "description": "The name to use for the Microsoft Sentinel Connector in the Logic App (This will exist as an API Connection in your subscription)" + } + }, + "subscriptionId": { + "type": "string", + "defaultValue": "[subscription().subscriptionId]", + "metadata": { + "description": "Azure subscription ID" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "Name of the resource group containing the Logic Apps to be updated" + } + }, + "keyVaultDomain": { + "type": "string", + "defaultValue": "[environment().suffixes.keyVaultDns]", + "metadata": { + "description": "The domain suffix for Azure Key Vault (dynamically assigned based on Azure environment)" + } + }, + "azureManagementDomain": { + "type": "string", + "defaultValue": "[environment().resourceManager]", + "metadata": { + "description": "The Azure Management API endpoint (dynamically assigned based on Azure environment)" + } + } + }, + "variables": { + "newRecurrenceInterval": "12", + "newRecurrenceFrequency": "Hour", + "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "_connection-1": "[[variables('connection-1')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[parameters('AzureSentinelConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "properties": { + "displayName": "[[parameters('AzureSentinelConnectionName')]", + "api": { + "id": "[[variables('_connection-1')]" + }, + "parameterValueType": "Alternative" + } + }, + { + "type": "Microsoft.Logic/workflows", + "apiVersion": "2017-07-01", + "name": "[[parameters('PlaybookName')]", + "location": "[[variables('workspace-location-inline')]", + "identity": { + "type": "SystemAssigned" + }, + "tags": { + "hidden-SentinelTemplateName": "Veeam-SetupConnectionsPlaybook", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]" + ], + "properties": { + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "type": "Object" + }, + "subscriptionId": { + "type": "String", + "defaultValue": "[[parameters('subscriptionId')]" + }, + "resourceGroupName": { + "type": "String", + "defaultValue": "[[parameters('resourceGroupName')]" + }, + "keyVaultName": { + "type": "String", + "defaultValue": "[[parameters('keyVaultName')]" + }, + "relayNamespaceName": { + "type": "String", + "defaultValue": "[[parameters('relayNamespaceName')]" + }, + "functionAppName": { + "type": "String", + "defaultValue": "[[parameters('functionAppName')]" + }, + "workspaceId": { + "type": "String", + "defaultValue": "[[parameters('workspaceId')]" + }, + "keyVaultDomain": { + "type": "String", + "defaultValue": "[[parameters('keyVaultDomain')]" + }, + "azureManagementDomain": { + "type": "String", + "defaultValue": "[[parameters('azureManagementDomain')]" + } + }, + "triggers": { + "manual": { + "type": "Request", + "kind": "Http", + "inputs": { + "schema": { + "type": "object", + "properties": { + "recurrenceInterval": { + "default": "[[variables('newRecurrenceInterval')]" + }, + "recurrenceFrequency": { + "default": "[[variables('newRecurrenceFrequency')]" + } + } + } + } + } + }, + "actions": { + "Initialize_Variables": { + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "VbrUsernameId", + "type": "string" + }, + { + "name": "VbrPasswordId", + "type": "string" + }, + { + "name": "VbrServerName", + "type": "string", + "value": "[variables('blanks')]" + }, + { + "name": "VbrBaseUrl", + "type": "string", + "value": "[variables('blanks')]" + }, + { + "name": "VoneUsernameId", + "type": "string" + }, + { + "name": "VonePasswordId", + "type": "string" + }, + { + "name": "VoneServerName", + "type": "string", + "value": "[variables('blanks')]" + }, + { + "name": "VoneBaseUrl", + "type": "string", + "value": "[variables('blanks')]" + } + ] + } + }, + "For_each_VONE_server_set_missing_parameters": { + "type": "Foreach", + "foreach": "@body('Parse_VONE_Settings')?['properties']?['watchlistItems']", + "actions": { + "If_any_value_in_watchlist_is_missing": { + "type": "If", + "expression": { + "or": [ + { + "equals": [ + "@body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms']", + "@null" + ] + }, + { + "equals": [ + "@body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms']", + "" + ] + }, + { + "equals": [ + "@item()?['properties.itemsKeyValue']?['Key Vault Password ID']", + "" + ] + }, + { + "equals": [ + "@item()?['properties.itemsKeyValue']?['Key Vault Password ID']", + "@null" + ] + }, + { + "equals": [ + "@item()?['properties.itemsKeyValue']?['Key Vault Username ID']", + "" + ] + }, + { + "equals": [ + "@item()?['properties.itemsKeyValue']?['Key Vault Username ID']", + "@null" + ] + } + ] + }, + "actions": { + "Update_Watchlist_Item_With_KeyVault_IDs_VONE": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "put", + "body": { + "Veeam Server Name": "@body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Veeam Server Name']", + "Base URL": "@body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Base URL']", + "Collect Alarms": "@if(\r\n or(\r\n empty(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms']), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms'], null), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms'], '')\r\n ),\r\n 'true', \r\n body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms']\r\n)", + "Key Vault Password ID": "@if(\r\n or(\r\n empty(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Password ID']), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Password ID'], null), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Password ID'], '')\r\n ),\r\n concat(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Veeam Server Name'], 'Password'), \r\n body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Password ID']\r\n)", + "Key Vault Username ID": "@if(\r\n or(\r\n empty(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Username ID']), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Username ID'], null), \r\n equals(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Username ID'], '')\r\n ),\r\n concat(body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Veeam Server Name'], 'Username'), \r\n body('Parse_current_VONE_server')?['properties.itemsKeyValue']?['Key Vault Username ID']\r\n)" + }, + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vone_settings')}/watchlistItem/@{encodeURIComponent(items('For_each_VONE_server_set_missing_parameters')?['name'])}" + } + } + }, + "runAfter": { + "Parse_current_VONE_server": [ + "Succeeded" + ] + } + }, + "Parse_current_VONE_server": { + "type": "ParseJson", + "inputs": { + "content": "@items('For_each_VONE_server_set_missing_parameters')", + "schema": { + "type": "object", + "properties": { + "properties.watchlistItemType": { + "type": "string" + }, + "properties.watchlistItemId": { + "type": "string" + }, + "properties.tenantId": { + "type": "string" + }, + "properties.isDeleted": { + "type": "boolean" + }, + "properties.created": { + "type": "string" + }, + "properties.updated": { + "type": "string" + }, + "properties.createdBy": { + "type": "object", + "properties": { + "email": { + "type": "string" + }, + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, + "properties.updatedBy": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Alarms": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + } + } + }, + "properties.entityMapping": { + "type": "object" + }, + "etag": { + "type": "string" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "type": "string" + }, + "systemData": { + "type": "object", + "properties": { + "createdBy": { + "type": "string" + }, + "createdByType": { + "type": "string" + }, + "createdAt": { + "type": "string" + }, + "lastModifiedBy": { + "type": "string" + }, + "lastModifiedByType": { + "type": "string" + }, + "lastModifiedAt": { + "type": "string" + } + } + } + } + } + } + } + }, + "runAfter": { + "Parse_VONE_Settings": [ + "Succeeded" + ] + }, + "runtimeConfiguration": { + "concurrency": { + "repetitions": 1 + } + } + }, + "Watchlists_-_Get_Updated_VONE_Settings": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "get", + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vone_settings')}/watchlistItems" + }, + "runAfter": { + "For_each_VONE_server_set_missing_parameters": [ + "Succeeded" + ] + } + }, + "Parse_Updated_VONE_Settings": { + "type": "ParseJson", + "inputs": { + "content": "@body('Watchlists_-_Get_Updated_VONE_Settings')", + "schema": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "type": { + "type": "string" + }, + "properties": { + "type": "object", + "properties": { + "watchlistItems": { + "type": "array", + "items": { + "type": "object", + "properties": { + "properties.watchlistItemType": { + "type": "string" + }, + "properties.watchlistItemId": { + "type": "string" + }, + "properties.tenantId": { + "type": "string" + }, + "properties.isDeleted": { + "type": "boolean" + }, + "properties.created": { + "type": "string" + }, + "properties.updated": { + "type": "string" + }, + "properties.createdBy": { + "type": "object", + "properties": { + "email": { + "type": "string" + }, + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, + "properties.updatedBy": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Alarms": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + } + } + }, + "properties.entityMapping": { + "type": "object" + }, + "etag": { + "type": "string" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "type": "string" + }, + "systemData": { + "type": "object", + "properties": { + "createdBy": { + "type": "string" + }, + "createdByType": { + "type": "string" + }, + "createdAt": { + "type": "string" + }, + "lastModifiedBy": { + "type": "string" + }, + "lastModifiedByType": { + "type": "string" + }, + "lastModifiedAt": { + "type": "string" + } + } + } + }, + "required": [ + "properties.watchlistItemType", + "properties.watchlistItemId", + "properties.tenantId", + "properties.isDeleted", + "properties.created", + "properties.updated", + "properties.createdBy", + "properties.updatedBy", + "properties.itemsKeyValue", + "properties.entityMapping", + "etag", + "id", + "name", + "type", + "systemData" + ] + } + } + } + } + } + } + }, + "runAfter": { + "Watchlists_-_Get_Updated_VONE_Settings": [ + "Succeeded" + ] + } + }, + "For_each_VBR_server_set_missing_parameters": { + "type": "Foreach", + "foreach": "@body('Parse_VBR_Settings')?['properties']?['watchlistItems']", + "actions": { + "Parse_current_VBR_server": { + "type": "ParseJson", + "inputs": { + "content": "@items('For_each_VBR_server_set_missing_parameters')", + "schema": { + "type": "object", + "properties": { + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Malware Events": { + "type": "string" + }, + "Collect Security and Compliance Analyzer Results": { + "type": "string" + }, + "Collect Authorization Events": { + "type": "string" + }, + "Collect Configuration Backups": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + } + } + } + } + } + } + }, + "Check_If_KeyVault_IDs_Missing": { + "type": "If", + "expression": { + "or": [ + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Password ID']", + "" + ] + }, + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Username ID']", + "" + ] + }, + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Password ID']", + "@null" + ] + }, + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Username ID']", + "@null" + ] + }, + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events']", + "" + ] + }, + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events']", + "@null" + ] + }, + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results']", + "" + ] + }, + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results']", + "@null" + ] + }, + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events']", + "" + ] + }, + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events']", + "@null" + ] + }, + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups']", + "" + ] + }, + { + "equals": [ + "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups']", + "@null" + ] + } + ] + }, + "actions": { + "Update_Watchlist_Item_With_KeyVault_IDs": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "put", + "body": { + "Veeam Server Name": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name']", + "Base URL": "@body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Base URL']", + "Collect Malware Events": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events'], null), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events'], '')), 'true', body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Malware Events'])", + "Collect Security and Compliance Analyzer Results": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results'], null), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results'], '')), 'true', body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results'])", + "Collect Authorization Events": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events'], null), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events'], '')), 'true', body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Authorization Events'])", + "Collect Configuration Backups": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups'], null), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups'], '')), 'true', body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Collect Configuration Backups'])", + "Key Vault Username ID": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Username ID']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Username ID'], null)), concat(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name'], 'Username'), body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Username ID'])", + "Key Vault Password ID": "@if(or(empty(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Password ID']), equals(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Password ID'], null)), concat(body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Veeam Server Name'], 'Password'), body('Parse_current_VBR_server')?['properties.itemsKeyValue']?['Key Vault Password ID'])" + }, + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItem/@{encodeURIComponent(items('For_each_VBR_server_set_missing_parameters')?['name'])}" + } + } + }, + "runAfter": { + "Parse_current_VBR_server": [ + "Succeeded" + ] + } + } + }, + "runAfter": { + "Parse_VBR_Settings": [ + "Succeeded" + ] + }, + "runtimeConfiguration": { + "concurrency": { + "repetitions": 1 + } + } + }, + "For_each_updated_VONE_server": { + "type": "Foreach", + "foreach": "@body('Parse_Updated_VONE_Settings')?['properties']?['watchlistItems']", + "actions": { + "Parse_current_updated_VONE_server": { + "type": "ParseJson", + "inputs": { + "content": "@items('For_each_updated_VONE_server')", + "schema": { + "type": "object", + "properties": { + "properties.watchlistItemType": { + "type": "string" + }, + "properties.watchlistItemId": { + "type": "string" + }, + "properties.tenantId": { + "type": "string" + }, + "properties.isDeleted": { + "type": "boolean" + }, + "properties.created": { + "type": "string" + }, + "properties.updated": { + "type": "string" + }, + "properties.createdBy": { + "type": "object", + "properties": { + "email": { + "type": "string" + }, + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, + "properties.updatedBy": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Alarms": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + } + } + }, + "properties.entityMapping": { + "type": "object" + }, + "etag": { + "type": "string" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "type": "string" + }, + "systemData": { + "type": "object", + "properties": { + "createdBy": { + "type": "string" + }, + "createdByType": { + "type": "string" + }, + "createdAt": { + "type": "string" + }, + "lastModifiedBy": { + "type": "string" + }, + "lastModifiedByType": { + "type": "string" + }, + "lastModifiedAt": { + "type": "string" + } + } + } + } + } + } + }, + " Are_there_any_events_collected_from_VONE_server": { + "type": "If", + "expression": { + "and": [ + { + "equals": [ + "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Collect Alarms']", + "true" + ] + }, + { + "not": { + "equals": [ + "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Veeam Server Name']", + "ExampleServerName" + ] + } + } + ] + }, + "actions": { + "Set_VonePasswordId": { + "type": "SetVariable", + "inputs": { + "name": "VonePasswordId", + "value": "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Key Vault Password ID']" + } + }, + "Set_VoneUsernameId": { + "type": "SetVariable", + "inputs": { + "name": "VoneUsernameId", + "value": "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Key Vault Username ID']" + }, + "runAfter": { + "Set_VonePasswordId": [ + "Succeeded" + ] + } + }, + "Set_VoneServerName": { + "type": "SetVariable", + "inputs": { + "name": "VoneServerName", + "value": "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Veeam Server Name']" + }, + "runAfter": { + "Set_VoneUsernameId": [ + "Succeeded" + ] + } + }, + "Extract_Host_and_Port_VONE": { + "type": "Compose", + "inputs": { + "host": "@split(replace(variables('VoneBaseUrl'), 'https://', ''), ':')[0]", + "port": "@if(and(greater(length(split(replace(variables('VoneBaseUrl'), 'https://', ''), ':')), 1), not(equals(last(split(replace(variables('VoneBaseUrl'), 'https://', ''), ':')), ''))), int(last(split(replace(variables('VoneBaseUrl'), 'https://', ''), ':'))), 1239)" + }, + "runAfter": { + "Set_VoneBaseUrl": [ + "Succeeded" + ] + } + }, + "Setup_KeyVault_Secrets_VONE": { + "type": "Scope", + "actions": { + "Check_Username_Secret_Exists_VONE": { + "type": "Http", + "inputs": { + "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VoneUsernameId'), '?api-version=7.4')", + "method": "GET", + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" + } + } + }, + "Create_Username_Secret_VONE": { + "type": "Http", + "inputs": { + "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VoneUsernameId'), '?api-version=7.4')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "value": "UNDEFINED", + "attributes": { + "enabled": true + }, + "tags": { + "source": "playbook", + "vbrServer": "@variables('VoneServerName')", + "type": "username" + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" + } + }, + "runAfter": { + "Check_Username_Secret_Exists_VONE": [ + "Failed" + ] + } + }, + "Check_Password_Secret_Exists_VONE": { + "type": "Http", + "inputs": { + "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VonePasswordId'), '?api-version=7.4')", + "method": "GET", + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" + } + } + }, + "Create_Password_Secret_VONE": { + "type": "Http", + "inputs": { + "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VonePasswordId'), '?api-version=7.4')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "value": "UNDEFINED", + "attributes": { + "enabled": true + }, + "tags": { + "source": "playbook", + "vbrServer": "@variables('VoneServerName')", + "type": "password", + "status": "requires_update" + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" + } + }, + "runAfter": { + "Check_Password_Secret_Exists_VONE": [ + "Failed" + ] + } + } + }, + "runAfter": { + "Extract_Host_and_Port_VONE": [ + "Succeeded" + ] + } + }, + "Setup_Hybrid_Connection_VONE": { + "type": "Scope", + "actions": { + "Check_Hybrid_Connection_Exists_VONE": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VoneServerName'), '?api-version=2024-01-01')", + "method": "GET", + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + } + }, + "Create_Hybrid_Connection_VONE": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VoneServerName'), '?api-version=2024-01-01')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "properties": { + "requiresClientAuthorization": true, + "userMetadata": "@concat('[{\"key\":\"endpoint\",\"value\":\"', outputs('Extract_Host_and_Port_VONE')?['host'], ':', outputs('Extract_Host_and_Port_VONE')?['port'], '\"}]')" + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Check_Hybrid_Connection_Exists_VONE": [ + "Failed" + ] + } + }, + "Create_Listener_Rule_VONE": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VoneServerName'), '/authorizationRules/defaultListener?api-version=2024-01-01')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "properties": { + "rights": [ + "Listen" + ] + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Create_Hybrid_Connection_VONE": [ + "Succeeded" + ] + } + }, + "Create_Sender_Rule_VONE": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VoneServerName'), '/authorizationRules/defaultSender?api-version=2024-01-01')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "properties": { + "rights": [ + "Send" + ] + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Create_Listener_Rule_VONE": [ + "Succeeded" + ] + } + }, + "Get_Sender_Key_VONE": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VoneServerName'), '/authorizationRules/defaultSender/listKeys?api-version=2024-01-01')", + "method": "POST", + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Create_Sender_Rule_VONE": [ + "Succeeded", + "Skipped" + ] + } + }, + "Check_Function_App_Binding_Exists_VONE": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Web/sites/', parameters('functionAppName'), '/hybridConnectionNamespaces/', parameters('relayNamespaceName'), '/relays/', variables('VoneServerName'), '?api-version=2022-03-01')", + "method": "GET", + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Get_Sender_Key_VONE": [ + "Succeeded", + "Skipped" + ] + } + }, + "Bind_To_Function_App_VONE": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Web/sites/', parameters('functionAppName'), '/hybridConnectionNamespaces/', parameters('relayNamespaceName'), '/relays/', variables('VoneServerName'), '?api-version=2022-03-01')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "properties": { + "hostname": "@outputs('Extract_Host_and_Port_VONE')?['host']", + "port": "@outputs('Extract_Host_and_Port_VONE')?['port']", + "relayArmUri": "@if(equals(body('Check_Hybrid_Connection_Exists_VONE')?['id'], null), body('Create_Hybrid_Connection_VONE')?['id'], body('Check_Hybrid_Connection_Exists_VONE')?['id'])", + "relayName": "@variables('VoneServerName')", + "sendKeyName": "defaultSender", + "sendKeyValue": "@body('Get_Sender_Key_VONE')?['primaryKey']", + "serviceBusNamespace": "@parameters('relayNamespaceName')", + "serviceBusSuffix": ".servicebus.windows.net" + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Check_Function_App_Binding_Exists_VONE": [ + "Failed" + ] + } + } + }, + "runAfter": { + "Setup_KeyVault_Secrets_VONE": [ + "Succeeded" + ] + } + }, + "Set_VoneBaseUrl": { + "type": "SetVariable", + "inputs": { + "name": "VoneBaseUrl", + "value": "@body('Parse_current_updated_VONE_server')?['properties.itemsKeyValue']?['Base URL']" + }, + "runAfter": { + "Set_VoneServerName": [ + "Succeeded" + ] + } + } + }, + "runAfter": { + "Parse_current_updated_VONE_server": [ + "Succeeded" + ] + } + } + }, + "runAfter": { + "Parse_Updated_VONE_Settings": [ + "Succeeded" + ] + }, + "runtimeConfiguration": { + "concurrency": { + "repetitions": 1 + } + } + }, + "For_each_updated_VBR_server": { + "type": "Foreach", + "foreach": "@body('Parse_updated_VBR_Settings')?['properties']?['watchlistItems']", + "actions": { + "Are_there_any_events_collected_from_VBR_server": { + "type": "If", + "expression": { + "and": [ + { + "not": { + "equals": [ + "@item()?['properties.itemsKeyValue']?['Veeam Server Name']", + "ExampleServerName" + ] + } + }, + { + "or": [ + { + "equals": [ + "@body('Parse_current_updated_VBR_Server')?['properties.itemsKeyValue']?['Collect Malware Events']", + "true" + ] + }, + { + "equals": [ + "@body('Parse_current_updated_VBR_Server')?['properties.itemsKeyValue']?['Collect Security and Compliance Analyzer Results']", + "true" + ] + }, + { + "equals": [ + "@body('Parse_current_updated_VBR_Server')?['properties.itemsKeyValue']?['Collect Authorization Events']", + "true" + ] + } + ] + } + ] + }, + "actions": { + "Extract_Host_and_Port_VBR": { + "type": "Compose", + "inputs": { + "host": "@split(replace(variables('VbrBaseUrl'), 'https://', ''), ':')[0]", + "port": "@if(and(greater(length(split(replace(variables('VbrBaseUrl'), 'https://', ''), ':')), 1), not(equals(last(split(replace(variables('VbrBaseUrl'), 'https://', ''), ':')), ''))), int(last(split(replace(variables('VbrBaseUrl'), 'https://', ''), ':'))), 9419)" + }, + "runAfter": { + "Set_VbrBaseUrl": [ + "Succeeded" + ] + } + }, + "Setup_KeyVault_Secrets_VBR": { + "type": "Scope", + "actions": { + "Check_Username_Secret_Exists_VBR": { + "type": "Http", + "inputs": { + "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VbrUsernameId'), '?api-version=7.4')", + "method": "GET", + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" + } + } + }, + "Create_Username_Secret_VBR": { + "type": "Http", + "inputs": { + "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VbrUsernameId'), '?api-version=7.4')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "value": "UNDEFINED", + "attributes": { + "enabled": true + }, + "tags": { + "source": "playbook", + "vbrServer": "@variables('VbrServerName')", + "type": "username" + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" + } + }, + "runAfter": { + "Check_Username_Secret_Exists_VBR": [ + "Failed" + ] + } + }, + "Check_Password_Secret_Exists_VBR": { + "type": "Http", + "inputs": { + "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VbrPasswordId'), '?api-version=7.4')", + "method": "GET", + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" + } + } + }, + "Create_Password_Secret_VBR": { + "type": "Http", + "inputs": { + "uri": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'), '/secrets/', variables('VbrPasswordId'), '?api-version=7.4')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "value": "UNDEFINED", + "attributes": { + "enabled": true + }, + "tags": { + "source": "playbook", + "vbrServer": "@variables('VbrServerName')", + "type": "password", + "status": "requires_update" + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@concat('https://', parameters('keyVaultName'), parameters('keyVaultDomain'))" + } + }, + "runAfter": { + "Check_Password_Secret_Exists_VBR": [ + "Failed" + ] + } + } + }, + "runAfter": { + "Extract_Host_and_Port_VBR": [ + "Succeeded" + ] + } + }, + "Setup_Hybrid_Connection_VBR": { + "type": "Scope", + "actions": { + "Check_Hybrid_Connection_Exists_VBR": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VbrServerName'), '?api-version=2024-01-01')", + "method": "GET", + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + } + }, + "Create_Hybrid_Connection_VBR": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VbrServerName'), '?api-version=2024-01-01')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "properties": { + "requiresClientAuthorization": true, + "userMetadata": "@concat('[{\"key\":\"endpoint\",\"value\":\"', outputs('Extract_Host_and_Port_VBR')?['host'], ':', outputs('Extract_Host_and_Port_VBR')?['port'], '\"}]')" + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Check_Hybrid_Connection_Exists_VBR": [ + "Failed" + ] + } + }, + "Create_Listener_Rule_VBR": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VbrServerName'), '/authorizationRules/defaultListener?api-version=2024-01-01')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "properties": { + "rights": [ + "Listen" + ] + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Create_Hybrid_Connection_VBR": [ + "Succeeded" + ] + } + }, + "Create_Sender_Rule_VBR": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VbrServerName'), '/authorizationRules/defaultSender?api-version=2024-01-01')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "properties": { + "rights": [ + "Send" + ] + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Create_Listener_Rule_VBR": [ + "Succeeded" + ] + } + }, + "Get_Sender_Key_VBR": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Relay/namespaces/', parameters('relayNamespaceName'), '/hybridConnections/', variables('VbrServerName'), '/authorizationRules/defaultSender/listKeys?api-version=2024-01-01')", + "method": "POST", + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Create_Sender_Rule_VBR": [ + "Succeeded" + ] + } + }, + "Check_Function_App_Binding_Exists_VBR": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Web/sites/', parameters('functionAppName'), '/hybridConnectionNamespaces/', parameters('relayNamespaceName'), '/relays/', variables('VbrServerName'), '?api-version=2022-03-01')", + "method": "GET", + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Get_Sender_Key_VBR": [ + "Succeeded" + ] + } + }, + "Bind_To_Function_App_VBR": { + "type": "Http", + "inputs": { + "uri": "@concat(parameters('azureManagementDomain'), '/subscriptions/', parameters('subscriptionId'), '/resourceGroups/', parameters('resourceGroupName'), '/providers/Microsoft.Web/sites/', parameters('functionAppName'), '/hybridConnectionNamespaces/', parameters('relayNamespaceName'), '/relays/', variables('VbrServerName'), '?api-version=2022-03-01')", + "method": "PUT", + "headers": { + "Content-Type": "application/json" + }, + "body": { + "properties": { + "hostname": "@outputs('Extract_Host_and_Port_VBR')?['host']", + "port": "@outputs('Extract_Host_and_Port_VBR')?['port']", + "relayArmUri": "@if(equals(body('Check_Hybrid_Connection_Exists_VBR')?['id'], null), body('Create_Hybrid_Connection_VBR')?['id'], body('Check_Hybrid_Connection_Exists_VBR')?['id'])", + "relayName": "@variables('VbrServerName')", + "sendKeyName": "defaultSender", + "sendKeyValue": "@body('Get_Sender_Key_VBR')?['primaryKey']", + "serviceBusNamespace": "@parameters('relayNamespaceName')", + "serviceBusSuffix": ".servicebus.windows.net" + } + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "@parameters('azureManagementDomain')" + } + }, + "runAfter": { + "Check_Function_App_Binding_Exists_VBR": [ + "Failed" + ] + } + } + }, + "runAfter": { + "Setup_KeyVault_Secrets_VBR": [ + "Succeeded" + ] + } + }, + "Set_VbrPasswordId": { + "type": "SetVariable", + "inputs": { + "name": "VbrPasswordId", + "value": "@item()?['properties.itemsKeyValue']?['Key Vault Password ID']" + } + }, + "Set_VbrUsernameId": { + "type": "SetVariable", + "inputs": { + "name": "VbrUsernameId", + "value": "@item()?['properties.itemsKeyValue']?['Key Vault Username ID']" + }, + "runAfter": { + "Set_VbrPasswordId": [ + "Succeeded" + ] + } + }, + "Set_VbrServerName": { + "type": "SetVariable", + "inputs": { + "name": "VbrServerName", + "value": "@item()?['properties.itemsKeyValue']?['Veeam Server Name']" + }, + "runAfter": { + "Set_VbrUsernameId": [ + "Succeeded" + ] + } + }, + "Set_VbrBaseUrl": { + "type": "SetVariable", + "inputs": { + "name": "VbrBaseUrl", + "value": "@item()?['properties.itemsKeyValue']?['Base URL']" + }, + "runAfter": { + "Set_VbrServerName": [ + "Succeeded" + ] + } + } + }, + "runAfter": { + "Parse_current_updated_VBR_Server": [ + "Succeeded" + ] + } + }, + "Parse_current_updated_VBR_Server": { + "type": "ParseJson", + "inputs": { + "content": "@items('For_each_updated_VBR_server')", + "schema": { + "type": "object", + "properties": { + "properties.watchlistItemType": { + "type": "string" + }, + "properties.watchlistItemId": { + "type": "string" + }, + "properties.tenantId": { + "type": "string" + }, + "properties.isDeleted": { + "type": "boolean" + }, + "properties.created": { + "type": "string" + }, + "properties.updated": { + "type": "string" + }, + "properties.createdBy": { + "type": "object", + "properties": { + "email": { + "type": "string" + }, + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, + "properties.updatedBy": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Malware Events": { + "type": "string" + }, + "Collect Security and Compliance Analyzer Results": { + "type": "string" + }, + "Collect Authorization Events": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + } + } + }, + "properties.entityMapping": { + "type": "object" + }, + "etag": { + "type": "string" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "type": "string" + }, + "systemData": { + "type": "object", + "properties": { + "createdBy": { + "type": "string" + }, + "createdByType": { + "type": "string" + }, + "createdAt": { + "type": "string" + }, + "lastModifiedBy": { + "type": "string" + }, + "lastModifiedByType": { + "type": "string" + }, + "lastModifiedAt": { + "type": "string" + } + } + } + } + } + } + } + }, + "runAfter": { + "Parse_updated_VBR_Settings": [ + "Succeeded" + ] + }, + "runtimeConfiguration": { + "concurrency": { + "repetitions": 1 + } + } + }, + "Watchlists_-_Get_Updated_VBR_Settings": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "get", + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItems" + }, + "runAfter": { + "For_each_VBR_server_set_missing_parameters": [ + "Succeeded" + ] + } + }, + "Parse_updated_VBR_Settings": { + "type": "ParseJson", + "inputs": { + "content": "@body('Watchlists_-_Get_Updated_VBR_Settings')", + "schema": { + "type": "object", + "properties": { + "properties": { + "type": "object", + "properties": { + "watchlistItems": { + "type": "array", + "items": { + "type": "object", + "properties": { + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Malware Events": { + "type": "string" + }, + "Collect Security and Compliance Analyzer Results": { + "type": "string" + }, + "Collect Authorization Events": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + } + } + } + }, + "required": [ + "properties.itemsKeyValue" + ] + } + } + } + } + } + } + }, + "runAfter": { + "Watchlists_-_Get_Updated_VBR_Settings": [ + "Succeeded" + ] + } + }, + "Parse_VONE_Settings": { + "type": "ParseJson", + "inputs": { + "content": "@body('Watchlists_-_Get_VONE_Settings_')", + "schema": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "type": { + "type": "string" + }, + "properties": { + "type": "object", + "properties": { + "watchlistItems": { + "type": "array", + "items": { + "type": "object", + "properties": { + "properties.watchlistItemType": { + "type": "string" + }, + "properties.watchlistItemId": { + "type": "string" + }, + "properties.tenantId": { + "type": "string" + }, + "properties.isDeleted": { + "type": "boolean" + }, + "properties.created": { + "type": "string" + }, + "properties.updated": { + "type": "string" + }, + "properties.createdBy": { + "type": "object", + "properties": { + "email": { + "type": "string" + }, + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, + "properties.updatedBy": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "objectId": { + "type": "string" + } + } + }, + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Alarms": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + } + } + }, + "properties.entityMapping": { + "type": "object" + }, + "etag": { + "type": "string" + }, + "id": { + "type": "string" + }, + "name": { + "type": "string" + }, + "type": { + "type": "string" + }, + "systemData": { + "type": "object", + "properties": { + "createdBy": { + "type": "string" + }, + "createdByType": { + "type": "string" + }, + "createdAt": { + "type": "string" + }, + "lastModifiedBy": { + "type": "string" + }, + "lastModifiedByType": { + "type": "string" + }, + "lastModifiedAt": { + "type": "string" + } + } + } + }, + "required": [ + "properties.watchlistItemType", + "properties.watchlistItemId", + "properties.tenantId", + "properties.isDeleted", + "properties.created", + "properties.updated", + "properties.createdBy", + "properties.updatedBy", + "properties.itemsKeyValue", + "properties.entityMapping", + "etag", + "id", + "name", + "type", + "systemData" + ] + } + } + } + } + } + } + }, + "runAfter": { + "Watchlists_-_Get_VONE_Settings_": [ + "Succeeded" + ] + } + }, + "Watchlists_-_Get_VONE_Settings_": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "get", + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vone_settings')}/watchlistItems" + }, + "runAfter": { + "Initialize_Variables": [ + "Succeeded" + ] + } + }, + "Watchlists_-_Get_VBR_Settings": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "get", + "path": "/Watchlists/subscriptions/@{encodeURIComponent(parameters('subscriptionId'))}/resourceGroups/@{encodeURIComponent(parameters('resourceGroupName'))}/workspaces/@{encodeURIComponent(parameters('workspaceId'))}/watchlists/@{encodeURIComponent('vbr_settings')}/watchlistItems" + }, + "runAfter": { + "Initialize_Variables": [ + "Succeeded" + ] + } + }, + "Parse_VBR_Settings": { + "type": "ParseJson", + "inputs": { + "content": "@body('Watchlists_-_Get_VBR_Settings')", + "schema": { + "type": "object", + "properties": { + "properties": { + "type": "object", + "properties": { + "watchlistItems": { + "type": "array", + "items": { + "type": "object", + "properties": { + "properties.itemsKeyValue": { + "type": "object", + "properties": { + "Veeam Server Name": { + "type": "string" + }, + "Base URL": { + "type": "string" + }, + "Collect Malware Events": { + "type": "string" + }, + "Collect Security and Compliance Analyzer Results": { + "type": "string" + }, + "Collect Authorization Events": { + "type": "string" + }, + "Key Vault Password ID": { + "type": "string" + }, + "Key Vault Username ID": { + "type": "string" + } + } + } + }, + "required": [ + "properties.itemsKeyValue" + ] + } + } + } + } + } + } + }, + "runAfter": { + "Watchlists_-_Get_VBR_Settings": [ + "Succeeded" + ] + } + } + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionName": "[[parameters('AzureSentinelConnectionName')]", + "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + } + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId15'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId15')]", + "contentId": "[variables('_playbookContentId15')]", + "kind": "Playbook", + "version": "[variables('playbookVersion15')]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ], + "metadata": { + "title": "Veeam-SetupConnections", + "description": "A Microsoft Sentinel playbook that configures Key Vault secrets and hybrid connections for Veeam servers. The playbook gets server settings and Key Vault secrets from vbr_settings and vone_settings watchlists, creates Key Vault IDs, and sets all collection flags to True if required.", + "prerequisites": [ + "1. Microsoft Sentinel workspace configured.", + "2. Permissions to create Logic Apps and API Connections.", + "3. Permissions to assign roles to the Resource Group.", + "4. Veeam Azure Function App deployed and configured.", + "5. Azure Key Vault configured with appropriate access policies.", + "6. Azure Relay namespace configured.", + "7. VBR Settings watchlist configured in Microsoft Sentinel.", + "8. Veeam ONE Settings watchlist configured in Microsoft Sentinel." + ], + "tags": [ + "Automation", + "Veeam", + "Setup", + "Connections" + ], + "lastUpdateTime": "2025-09-02T01:02:00Z", + "parameterTemplateVersion": "1.0.0", + "postDeployment": [ + "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", + "2. Assign the Key Vault Administrator role to the Logic App's managed identity on the Key Vault resource.", + "3. Assign the Website Contributor role to the Logic App's managed identity on the Function App resource.", + "4. Assign the Azure Relay Owner role to the Logic App's managed identity on the Relay Namespace resource.", + "5. **After playbook is run successfully**, you need to go to the Key Vault and set the password and username for each VBR server. Also, you need to install Hybrid Connections Manager into your network and set up connection there." + ], + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId15')]", + "contentKind": "Playbook", + "displayName": "Veeam-SetupConnections", + "contentProductId": "[variables('_playbookcontentProductId15')]", + "id": "[variables('_playbookcontentProductId15')]", + "version": "[variables('playbookVersion15')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist1-id'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", + "properties": { + "displayName": "Job Types Lookup", + "watchlistAlias": "job_types_lookup", + "source": "job_types_lookup.csv", + "description": "Job Types Lookup.", + "provider": "Microsoft", + "isDeleted": false, + "defaultDuration": "P1000Y", + "contentType": "Text/Csv", + "numberOfLinesToSkip": 0, + "itemsSearchKey": "JobType", + "rawContent": "JobType,JobTypeDescription\r\n0,Backup Job\r\n1,Replication Job\r\n2,Backup Copy Job\r\n3,SureBackup Job\r\n8,Quick Migration\r\n22,Rescan Job\r\n24,File to Tape Job\r\n28,Backup to Tape Job\r\n50,Replication Job\r\n51,Backup Copy Job\r\n52,MS SQL Log Backup Job\r\n54,Oracle Log Backup Job\r\n60,HPE StoreOnce Replication Job\r\n63,Backup Copy Job\r\n65,Backup Copy Job\r\n70,Backup Copy Job\r\n74,PostgreSQL Log Backup Job\r\n78,Entra ID Backup Job\r\n100,Configuration Backup Job\r\n104,Configuration Database Maintenance Job\r\n198,Tape Verification Job\r\n501,Tape Copy Job\r\n202,Restore Job\r\n203,Undo Failover Plan\r\n290,Restore Job\r\n316,CDP Policy\r\n4000,Agent Backup Job (Backup Server)\r\n12000,Agent Backup Job (Backup Server)\r\n12002,Agent Backup Job (Backup Policy)\r\n12003,Agent Backup Job (Backup Server)\r\n12100,Enterprise Plug-in Backup Job\r\n12101,Enterprise Plug-in Log Backup Job\r\n13000,File Backup job\r\n13003,File Backup Copy Job\r\n14000,Backup Job\r\n15000,Storage Snapshot Snapshot-Only Job\r\n15001,Storage Snapshot Backup Job\r\n15002,Storage Snapshot Copy Job\r\n15004,Storage Snapshot Restore Session\r\n18000,Archive Tier Backup Job\r\n18001,Archive Tier Restore Session\r\n18002,Archive Download Session\r\n18003,Archive Tier Synchronization Job\r\n18004,Archive Tier Backup Copy Job\r\n18005,Archive Tier Archiving Job\r\n18006,Publish Disk Session\r\n18008,Object Storage Repository Synchronization Job\r\n24002,Guest OS File Restore Session\r\n33000,SureBackup Scan only\r\n33001,SureBackup Scan only\r\n" + }, + "apiVersion": "2022-08-01" + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist2-id'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", + "apiVersion": "2022-08-01", + "properties": { + "displayName": "License Editions Lookup", + "description": "License Editions Lookup.", + "provider": "Microsoft", + "source": "license_editions_lookup.csv", + "defaultDuration": "P1000Y", + "isDeleted": false, + "sourceType": "Local file", + "contentType": "text/csv", + "numberOfLinesToSkip": 0, + "rawContent": "Edition,EditionDescription\n-1,No License Installed\n0,Veeam Universal License\n1,Community Edition\n2,Enterprise Edition\n3,Enterprise Plus Edition", + "itemsSearchKey": "Edition", + "watchlistAlias": "license_editions_lookup" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist3-id'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", + "apiVersion": "2022-08-01", + "properties": { + "displayName": "License Types Lookup", + "description": "License Types Lookup.", + "sourceType": "Microsoft", + "isDeleted": false, + "defaultDuration": "P1000Y", + "source": "license_types_lookup.csv", + "contentType": "text/csv", + "rawContent": "Type,TypeDescription\n0,No License Installed\n1,Rental License\n2,NFR License\n3,Perpetual License\n4,Evaluation License\n5,Subscription License\n7,Promo License", + "itemsSearchKey": "Type", + "numberOfLinesToSkip": 0, + "provider": "Veeam Software" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist4-id'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", + "apiVersion": "2022-08-01", + "properties": { + "displayName": "Operation Names Lookup", + "description": "Operation Names Lookup.", + "provider": "Microsoft", + "source": "operation_names_lookup.csv", + "sourceType": "Local file", + "contentType": "text/csv", + "numberOfLinesToSkip": 0, + "rawContent": "Operation Id,OperationName\n0,Four-eyes authorization has been enabled\n1,Four-eyes authorization has been disabled\n100,Delete backup\n101,Delete log backup\n102,Delete configuration backup\n103,Disable four-eyes authorization\n104,Delete snapshot\n105,Delete infrastructure object\n106,Delete service provider\n107,Delete storage\n108,Update Veeam Backup & Replication security settings\n10000,Other operations", + "itemsSearchKey": "Operation Id", + "watchlistAlias": "operation_names_lookup" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist5-id'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", + "apiVersion": "2022-08-01", + "properties": { + "displayName": "Session States Lookup", + "description": "Session States Lookup.", + "provider": "Microsoft", + "source": "session_states_lookup.csv", + "sourceType": "Local file", + "contentType": "text/csv", + "numberOfLinesToSkip": 0, + "rawContent": "JobResult,JobResultMessage\n0,Success\n2,Failed\n3,Warning\n5,In progress\n6,Pending\n13,CBT mode", + "itemsSearchKey": "JobResult", + "watchlistAlias": "session_states_lookup" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist6-id'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", + "apiVersion": "2022-08-01", + "properties": { + "displayName": "VBR Events Lookup", + "description": "Veeam Software Backup & Replication Events Lookup.", + "provider": "Microsoft", + "source": "vbr_events_lookup.csv", + "sourceType": "Local file", + "contentType": "text/csv", + "numberOfLinesToSkip": 0, + "rawContent": "ID,Event Name,Type,Event Group,Severity,Default Severity\n115,Tape Erase Job Started,Veeam Backup & Replication,Security,high,high\n150,Backup Task Finished,Veeam Backup & Replication,Monitoring,none,none\n151,File Backup Job Finished,Veeam Backup & Replication,Monitoring,none,none\n190,Backup Job Finished,Veeam Backup & Replication,Monitoring,none,none\n194,File To Tape Job Finished,Veeam Backup & Replication,Monitoring,none,none\n198,Tape Verification Job,Veeam Backup & Replication,Monitoring,none,none\n200,Tape Copy Job,Veeam Backup & Replication,Monitoring,disabled,none\n251,Restore Task for Hyper-V VM FInished,Veeam Backup & Replication,Monitoring,none,none\n290,Restore Session Finished,Veeam Backup & Replication,Monitoring,none,none\n314,VM with no backup,Veeam ONE,Security,critical,critical\n315,VM with no backup (Hyper-V),Veeam ONE,Security,critical,critical\n331,VM with no replica,Veeam ONE,Security,medium,medium\n332,VM with no replica (Hyper-V),Veeam ONE,Security,critical,critical\n342,Possible ransomware activity (vSphere),Veeam ONE,Security,critical,critical\n344,Possible ransomware activity (Hyper-V),Veeam ONE,Security,critical,critical\n364,Suspicious incremental backup size,Veeam ONE,Security,critical,critical\n365,Backup Copy RPO,Veeam ONE,Security,critical,critical\n369,Unusual job duration,Veeam ONE,Security,medium,medium\n370,Computer with no backup,Veeam ONE,Security,critical,critical\n376,Immutability state,Veeam ONE,Security,medium,medium\n377,Immutability change tracking,Veeam ONE,Security,critical,critical\n378,Job disabled (Veeam Backup for Microsoft 365),Veeam ONE,Security,medium,medium\n381,Unusual job duration (Veeam Backup for Microsoft 365),Veeam ONE,Security,medium,medium\n390,SureBackup Job Finished,Veeam Backup & Replication,Monitoring,none,none\n391,Application with no recent data backup sessions,Veeam ONE,Security,medium,medium\n395,Backup server security & compliance state,Veeam ONE,Security,critical,critical\n403,Veeam malware detection change tracking,Veeam ONE,Security,critical,critical\n450,Backup Copy Task Finished,Veeam Backup & Replication,Monitoring,none,none\n451,File Backup Copy Job Finished,Veeam Backup & Replication,Monitoring,none,none\n490,Backup Copy Job Finished,Veeam Backup & Replication,Monitoring,none,none\n590,File Copy Job Finished,Veeam Backup & Replication,Monitoring,none,none\n592,VM Copy Job Finished,Veeam Backup & Replication,Monitoring,none,none\n610,Quick Migration Finished,Veeam Backup & Replication,Monitoring,none,none\n652,Active Full Backup for Backup Policy Finished,Veeam Backup & Replication,Monitoring,none,none\n790,Agent Backup Job Finished,Veeam Backup & Replication,Monitoring,none,none\n21224,Connection to Backup Repository Lost,Veeam Backup & Replication,Security,critical,critical\n23090,Job Deleted,Veeam Backup & Replication,Security,critical,critical\n23420,Job No Longer Used as Second Destination,Veeam Backup & Replication,Security,high,high\n23630,Tape Media Pool Deleted,Veeam Backup & Replication,Security,information,information\n23631,Tape Media Vault Deleted,Veeam Backup & Replication,Security,information,information\n23632,Tape medium Deleted,Veeam Backup & Replication,Security,high,high\n23633,Tape Library Deleted,Veeam Backup & Replication,Security,information,information\n24020,License Key Expiring,Veeam Backup & Replication,Security,information,information\n24030,License Key Expired,Veeam Backup & Replication,Security,high,high\n24040,License Support Expiring,Veeam Backup & Replication,Security,medium,medium\n24050,License Support Expired,Veeam Backup & Replication,Security,high,high\n24060,License Grace Period Started,Veeam Backup & Replication,Security,medium,medium\n24070,License Limit Exceeded,Veeam Backup & Replication,Security,medium,medium\n24080,License Key Removed,Veeam Backup & Replication,Security,high,high\n24114,Tenant Password Changed,Veeam Backup & Replication,Security,medium,medium\n24131,Cloud Gateway Settings Updated,Veeam Backup & Replication,Security,information,information\n24140,Cloud Gateway Deleted,Veeam Backup & Replication,Security,information,information\n24142,Cloud Gateway Pool Settings Updated,Veeam Backup & Replication,Security,information,information\n24143,Cloud Gateway Pool Deleted,Veeam Backup & Replication,Security,information,information\n24160,Tenant Quota Changed,Veeam Backup & Replication,Security,information,information\n24170,Tenant Quota Deleted,Veeam Backup & Replication,Security,information,information\n25000,Tenant State Changed,Veeam Backup & Replication,Security,information,information\n25210,Subtenant Deleted,Veeam Backup & Replication,Security,high,high\n25220,Subtenant Updated,Veeam Backup & Replication,Security,information,information\n25400,Credential Record Updated,Veeam Backup & Replication,Security,high,high\n25500,Credential Record Deleted,Veeam Backup & Replication,Security,critical,critical\n25700,Hypervisor Host Deleted,Veeam Backup & Replication,Security,information,information\n25800,Hypervisor Host Settings Updated,Veeam Backup & Replication,Security,information,information\n26000,Failover Plan Settings Updated,Veeam Backup & Replication,Security,information,information\n26100,Failover Plan Deleted,Veeam Backup & Replication,Security,medium,medium\n26110,Failover Plan Failed,Veeam Backup & Replication,Security,medium,medium\n26600,Failover Plan Started,Veeam Backup & Replication,Security,high,high\n26700,Failover Plan Stopped,Veeam Backup & Replication,Security,medium,medium\n26800,Tenant Replica Started,Veeam Backup & Replication,Security,information,information\n26900,Tenant Replica Stopped,Veeam Backup & Replication,Security,high,high\n27000,Cloud Replica Permanent Failover Performed by Tenant,Veeam Backup & Replication,Security,high,high\n27200,WAN Accelerator Settings Updated,Veeam Backup & Replication,Security,information,information\n27300,WAN Accelerator Deleted,Veeam Backup & Replication,Security,information,information\n27500,Service Provider Updated,Veeam Backup & Replication,Security,information,information\n27600,Service Provider Deleted,Veeam Backup & Replication,Security,information,information\n27900,Backup Proxy Deleted,Veeam Backup & Replication,Security,information,information\n28100,Backup Repository Settings Updated,Veeam Backup & Replication,Security,medium,medium\n28200,Backup Repository Deleted,Veeam Backup & Replication,Security,critical,critical\n28400,Host Settings Updated,Veeam Backup & Replication,Security,information,information\n28500,Host Deleted,Veeam Backup & Replication,Security,high,high\n28800,Tape Server Deleted,Veeam Backup & Replication,Security,information,information\n28850,NDMP Server Deleted,Veeam Backup & Replication,Security,information,information\n28920,File Share Deleted,Veeam Backup & Replication,Security,high,high\n28940,File Server Settings Updated,Veeam Backup & Replication,Security,information,information\n28950,File Server Deleted,Veeam Backup & Replication,Security,high,high\n28970,Object Storage Settings Updated,Veeam Backup & Replication,Security,medium,medium\n28980,Object Storage Deleted,Veeam Backup & Replication,Security,critical,critical\n29110,Protection Group Settings Updated,Veeam Backup & Replication,Security,information,information\n29120,Protection Group Deleted,Veeam Backup & Replication,Security,high,high\n29140,Objects for Protection Group Changed,Veeam Backup & Replication,Security,information,information\n29150,Objects for Protection Group Deleted,Veeam Backup & Replication,Security,high,high\n29800,Archive Repository Settings Updated,Veeam Backup & Replication,Security,medium,medium\n29900,Archive Repository Deleted,Veeam Backup & Replication,Security,critical,critical\n30100,Scale-Out Backup Repository Settings Updated,Veeam Backup & Replication,Security,high,high\n30200,Scale-Out Backup Repository Deleted,Veeam Backup & Replication,Security,critical,critical\n30400,Application Group Settings Updated,Veeam Backup & Replication,Security,information,information\n30500,Application Group Deleted,Veeam Backup & Replication,Security,information,information\n30700,Virtual Lab Settings Updated,Veeam Backup & Replication,Security,information,information\n30800,Virtual Lab Deleted,Veeam Backup & Replication,Security,information,information\n31000,General Settings Updated,Veeam Backup & Replication,Security,information,information\n31200,User or Group Added,Veeam Backup & Replication,Security,high,high\n31210,Adding User or Group Failed,Veeam Backup & Replication,Security,medium,medium\n31400,User or Group Deleted,Veeam Backup & Replication,Security,critical,critical\n31500,Configuration Backup Job Settings Updated,Veeam Backup & Replication,Security,information,information\n31600,Encryption Password Added,Veeam Backup & Replication,Security,information,information\n31700,Encryption Password Changed,Veeam Backup & Replication,Security,high,high\n31800,Encryption Password Deleted,Veeam Backup & Replication,Security,critical,critical\n31900,SSH Credentials Changed,Veeam Backup & Replication,Security,high,high\n32100,External Repository Settings Updated,Veeam Backup & Replication,Security,information,information\n32120,Objects for Job Deleted,Veeam Backup & Replication,Security,high,high\n32200,External Repository Deleted,Veeam Backup & Replication,Security,critical,critical\n32400,Global Network Traffic Rules Deleted,Veeam Backup & Replication,Security,information,information\n32800,Preferred Networks Deleted,Veeam Backup & Replication,Security,information,information\n36013,Recovery Token Deleted,Veeam Backup & Replication,Security,medium,medium\n36022,Backup Job for Application Backup Policy Finished,Veeam Backup & Replication,Monitoring,none,none\n36023,Backup Task for Application Backup Policy Started,Veeam Backup & Replication,Monitoring,none,none\n36024,Backup Task for Application Backup Policy Finished,Veeam Backup & Replication,Monitoring,none,none\n36026,Log Backup Job for Application Backup Policy Finished,Veeam Backup & Replication,Monitoring,none,none\n40201,Multi-Factor Authentication Disabled,Veeam Backup & Replication,Security,critical,critical\n40202,Multi-Factor Authentication Token Revoked,Veeam Backup & Replication,Security,medium,medium\n40204,Multi-Factor Authentication for User Disabled,Veeam Backup & Replication,Security,critical,critical\n40205,Invalid Code for Multi-Factor Authentication Entered,Veeam Backup & Replication,Security,high,high\n40206,Allowed Attempts for Multi-Factor Authentication Exceeded,Veeam Backup & Replication,Security,critical,critical\n40290,Restore Session Finished,Veeam Backup & Replication,Monitoring,none,none\n40400,Global VM Exclusions Added,Veeam Backup & Replication,Security,high,high\n40500,Global VM Exclusions Deleted,Veeam Backup & Replication,Security,medium,medium\n40600,Global VM Exclusions Changed,Veeam Backup & Replication,Security,high,high\n40700,Configuration Backup Job Finished,Veeam Backup & Replication,Monitoring,none,none\n40800,Configuration Restore Session Finished,Veeam Backup & Replication,Monitoring,none,none\n41200,Detaching Backups Started,Veeam Backup & Replication,Security,information,information\n41401,Storage Settings Updated,Veeam Backup & Replication,Security,information,information\n41402,Storage Deleted,Veeam Backup & Replication,Security,critical,critical\n41600,Malware Activity Detected,Veeam Backup & Replication,Security,critical,critical\n41610,Object Marked as Clean,Veeam Backup & Replication,Security,information,information\n41800,Attempt to Delete Backup Failed,Veeam Backup & Replication,Security,critical,critical\n41810,Attempt to Update Security Object Failed,Veeam Backup & Replication,Security,critical,critical\n42210,Malware Detection Session Finished,Veeam Backup & Replication,Security,information,information\n42220,Restore Point Marked as Infected,Veeam Backup & Replication,Security,critical,critical\n42230,Restore Point Marked as Clean,Veeam Backup & Replication,Security,information,information\n42260,Objects Added to Malware Detection Exclusions,Veeam Backup & Replication,Security,high,high\n42270,Objects Deleted from Malware Detection Exclusions,Veeam Backup & Replication,Security,information,information\n42280,Malware Detection Exclusions List Updated,Veeam Backup & Replication,Security,high,high\n42290,Malware Detection Settings Updated,Veeam Backup & Replication,Security,high,high\n42301,KMS Server Deleted,Veeam Backup & Replication,Security,critical,critical\n42302,KMS Server Settings Updated,Veeam Backup & Replication,Security,high,high\n42401,Four-Eyes Authorization Disabled,Veeam Backup & Replication,Security,critical,critical\n42402,Four-Eyes Authorization Request Created,Veeam Backup & Replication,Security,critical,critical\n42403,Four-Eyes Authorization Request Approved,Veeam Backup & Replication,Monitoring,none,none\n42404,Four-Eyes Authorization Request Rejected,Veeam Backup & Replication,Security,information,information\n42405,Four-Eyes Authorization Request Expired,Veeam Backup & Replication,Security,high,high\n42500,KMS Key Rotation Job Finished,Veeam Backup & Replication,Security,information,information", + "itemsSearchKey": "ID", + "watchlistAlias": "vbr_events_lookup" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist7-id'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", + "properties": { + "displayName": "Action Results Lookup", + "watchlistAlias": "action_results_lookup", + "source": "action_results_lookup.csv", + "description": "Action Results Lookup.", + "provider": "Microsoft", + "isDeleted": false, + "defaultDuration": "P1000Y", + "contentType": "Text/Csv", + "numberOfLinesToSkip": 0, + "itemsSearchKey": "JobResult", + "rawContent": "JobResult,JobResultMessage\r\n-1,None\r\n0,Success\r\n1,Warning\r\n2,Failed\r\n3,Working\r\n" + }, + "apiVersion": "2022-08-01" + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist8-id'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", + "properties": { + "displayName": "Veeam Backup & Replication Settings", + "watchlistAlias": "vbr_settings", + "source": "vbr_settings.csv", + "description": "This watchlist lists Veeam Backup & Replication servers and the event types to collect. To add a server, specify Veeam Server Name and Base URL. Then run the Veeam-SetupConnections Playbook. The playbook sets the collection flags to true and creates keyVaultIds if they are empty. Otherwise, it uses the values you provide to configure Hybrid Connections and Key Vault secrets.", + "provider": "Custom", + "isDeleted": false, + "defaultDuration": "P1000Y", + "contentType": "Text/Csv", + "numberOfLinesToSkip": 0, + "itemsSearchKey": "Veeam Server Name", + "rawContent": "Veeam Server Name,Base URL,Collect Malware Events,Collect Security and Compliance Analyzer Results,Collect Authorization Events,Collect Configuration Backups,Key Vault Username ID,Key Vault Password ID\r\nExampleServerName,https://ExampleServerName.domain.example:9419,true,true,true,true,ExampleServerNameUsername,ExampleServerNamePassword\r\n" + }, + "apiVersion": "2022-08-01" + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist9-id'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", + "properties": { + "displayName": "VONE Settings", + "watchlistAlias": "vone_settings", + "source": "vone_settings.csv", + "description": "This watchlist lists Veeam ONE servers and a flag that controls event collection. To add a server, specify Veeam Server Name and Base URL. Then run the Veeam-SetupConnections Playbook. The playbook sets the collection flag to true and creates keyVaultIds if they are empty. Otherwise, it uses the values you provide to configure Hybrid Connections and Key Vault secrets.", + "provider": "Custom", + "isDeleted": false, + "defaultDuration": "P1000Y", + "contentType": "Text/Csv", + "numberOfLinesToSkip": 0, + "itemsSearchKey": "Veeam Server Name", + "rawContent": "Veeam Server Name,Base URL,Collect Alarms,Key Vault Username ID,Key Vault Password ID\r\nExampleServerName,https://ExampleServerName.domain.example:1239,true,ExampleServerNameUsername,ExampleServerNamePassword\r\n" + }, + "apiVersion": "2022-08-01" + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist10-id'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", + "properties": { + "displayName": "Coveware Settings", + "watchlistAlias": "coveware_settings", + "source": "coveware_settings.csv", + "description": "This watchlist defines Coveware server settings for findings data collection. You can disable data collection by setting the Collect Coveware Findings flag to false.", + "provider": "Custom", + "isDeleted": false, + "defaultDuration": "P1000Y", + "contentType": "Text/Csv", + "numberOfLinesToSkip": 0, + "itemsSearchKey": "Coveware Server Name", + "rawContent": "Coveware Server Name,Collect Coveware Findings,Coveware Base URL,Key Vault Password ID,Key Vault Username ID,Key Vault Client ID\r\nCovewareServer,true,https://api.coveware.com,CovewareServerPasswordId,CovewareServerUsernameId,CovewareServerClientId\r\n" + }, + "apiVersion": "2022-08-01" + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist11-id'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/watchlists", + "apiVersion": "2023-02-01", + "properties": { + "displayName": "Veeam Collection Schedule Settings", + "watchlistAlias": "collection_schedule_settings", + "source": "collection_schedule_settings.csv", + "description": "This watchlist stores the configuration for schedules and recurrence intervals used by Veeam collection playbooks. To apply the changes, run the Veeam-ChangeCollectionTime playbook.", + "provider": "Custom", + "isDeleted": false, + "defaultDuration": "P1000Y", + "contentType": "Text/Csv", + "numberOfLinesToSkip": 0, + "itemsSearchKey": "CollectionPlaybookName", + "rawContent": "CollectionPlaybookName,RecurrenceInterval,TimeUnit\r\nVeeam-CollectMalwareEvents,1,Day\r\nVeeam-CollectVeeamAuthorizationEvents,1,Day\r\nVeeam-CollectSecurityComplianceAnalyzerResult,1,Day\r\nVeeam-CollectVeeamONEAlarms,1,Day\r\nVeeam-CollectCovewareFindings,1,Day\r\nVeeam-CollectConfigurationBackups,1,Day\r\n" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject1').parserTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_GetJobFinished Data Parser with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject1').parserVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject1')._parserName1]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Veeam Job Finished Events", + "category": "Microsoft Sentinel Parser", + "functionAlias": "Veeam_GetJobFinished", + "query": "let vbr_events_lookup = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nlet action_results_lookup = union isfuzzy=true \n (datatable(JobResult:string, JobResultMessage:string)[]),\n (_GetWatchlist(\"action_results_lookup\")); \nlet job_types_lookup = union isfuzzy=true \n (datatable(JobType:string, JobTypeDescription:string)[]),\n (_GetWatchlist(\"job_types_lookup\")); \nSyslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId in (\"150\", \"151\", \"190\", \"194\", \"198\", \"200\", \"250\", \"251\", \"290\", \"390\", \"450\", \"451\", \"490\", \"590\", \"592\", \"610\", \"790\", \"36022\", \"36026\", \"40290\", \"40800\")\n| lookup kind=leftouter (vbr_events_lookup) \n on $left.instanceId == $right.ID\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend event_module = Type1, original_host = Computer \n| extend Result = extract(\"Result=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend Status = extract(\"Status=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend JobResultCode = case(\n instanceId in (\"198\", \"290\", \"40290\", \"42210\", \"42500\"), Result,\n instanceId in (\"150\", \"151\", \"450\", \"451\"), Status,\n extract(\"JobResult=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n)\n| lookup kind=leftouter (action_results_lookup)\n on $left.JobResultCode == $right.JobResult\n| extend Platform = extract(\"Platform=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend Version = extract(\"Version=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend JobSessionID = extract(\"JobSessionID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend JobID = extract(\"JobID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend JobType = case ( \n instanceId == \"198\", \"198\",\n instanceId == \"290\", \"198\",\n instanceId == \"40800\", \"40800\",\n instanceId == \"40290\", \"290\",\n extract(\"JobType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n)\n| lookup kind=leftouter (job_types_lookup)\n on $left.JobType == $right.JobType\n| extend Allowance = Severity != 'disabled'\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult = JobResultCode, JobResultMessage, JobType, JobTypeDescription, Allowance, SyslogMessage\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", + "dependsOn": [ + "[variables('parserObject1')._parserId1]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetJobFinished')]", + "contentId": "[variables('parserObject1').parserContentId1]", + "kind": "Parser", + "version": "[variables('parserObject1').parserVersion1]", + "source": { + "name": "Veeam", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject1').parserContentId1]", + "contentKind": "Parser", + "displayName": "Parser for Veeam Job Finished Events", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "version": "[variables('parserObject1').parserVersion1]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject1')._parserName1]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Veeam Job Finished Events", + "category": "Microsoft Sentinel Parser", + "functionAlias": "Veeam_GetJobFinished", + "query": "let vbr_events_lookup = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nlet action_results_lookup = union isfuzzy=true \n (datatable(JobResult:string, JobResultMessage:string)[]),\n (_GetWatchlist(\"action_results_lookup\")); \nlet job_types_lookup = union isfuzzy=true \n (datatable(JobType:string, JobTypeDescription:string)[]),\n (_GetWatchlist(\"job_types_lookup\")); \nSyslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId in (\"150\", \"151\", \"190\", \"194\", \"198\", \"200\", \"250\", \"251\", \"290\", \"390\", \"450\", \"451\", \"490\", \"590\", \"592\", \"610\", \"790\", \"36022\", \"36026\", \"40290\", \"40800\")\n| lookup kind=leftouter (vbr_events_lookup) \n on $left.instanceId == $right.ID\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend event_module = Type1, original_host = Computer \n| extend Result = extract(\"Result=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend Status = extract(\"Status=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend JobResultCode = case(\n instanceId in (\"198\", \"290\", \"40290\", \"42210\", \"42500\"), Result,\n instanceId in (\"150\", \"151\", \"450\", \"451\"), Status,\n extract(\"JobResult=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n)\n| lookup kind=leftouter (action_results_lookup)\n on $left.JobResultCode == $right.JobResult\n| extend Platform = extract(\"Platform=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend Version = extract(\"Version=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| extend JobSessionID = extract(\"JobSessionID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend JobID = extract(\"JobID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend JobType = case ( \n instanceId == \"198\", \"198\",\n instanceId == \"290\", \"198\",\n instanceId == \"40800\", \"40800\",\n instanceId == \"40290\", \"290\",\n extract(\"JobType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n)\n| lookup kind=leftouter (job_types_lookup)\n on $left.JobType == $right.JobType\n| extend Allowance = Severity != 'disabled'\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult = JobResultCode, JobResultMessage, JobType, JobTypeDescription, Allowance, SyslogMessage\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", + "dependsOn": [ + "[variables('parserObject1')._parserId1]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetJobFinished')]", + "contentId": "[variables('parserObject1').parserContentId1]", + "kind": "Parser", + "version": "[variables('parserObject1').parserVersion1]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject2').parserTemplateSpecName2]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_GetVeeamONEAlarms Data Parser with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject2').parserVersion2]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject2')._parserName2]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Veeam ONE Events", + "category": "Microsoft Sentinel Parser", + "functionAlias": "Veeam_GetVeeamONEAlarms", + "query": "let watchlist = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nSyslog\n| where SyslogMessage has \"predefined_alarm_id\"\n| extend predefined_alarm_id = extract(\"predefined_alarm_id=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| where predefined_alarm_id in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\n| lookup kind=leftouter (watchlist) \n on $left.predefined_alarm_id == $right.ID\n| extend alarm_details = extract(\"alarm_details=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend alarm_name = extract(\"alarm_name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend alarm_type = extract(\"alarm_type=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend event_module = extract(\"event_module=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend eventtype = extract(\"eventtype=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend object_name = extract(\"object_name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend object_path = extract(\"object_path=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend original_host = extract(\"original_host=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend predefined_alarm_id = extract(\"predefined_alarm_id=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend severity = extract(\"severity=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend status_new = extract(\"status_new=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend status_old = extract(\"status_old=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend VoneHostName=Computer\n| extend SeverityDescription = case(Severity==\"critical\",\"Critical\",\n Severity==\"high\",\"High\",\n Severity==\"medium\",\"Medium\",\n Severity==\"information\",\"Information\", \n \"Unknown\")\n| project [\"Event Name\"], TimeGenerated, alarm_details, alarm_name, alarm_type, object_name, object_path, predefined_alarm_id, Severity, status_new, status_old, VoneHostName, SeverityDescription, SyslogMessage\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]", + "dependsOn": [ + "[variables('parserObject2')._parserId2]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetVeeamONEAlarms')]", + "contentId": "[variables('parserObject2').parserContentId2]", + "kind": "Parser", + "version": "[variables('parserObject2').parserVersion2]", + "source": { + "name": "Veeam", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject2').parserContentId2]", + "contentKind": "Parser", + "displayName": "Parser for Veeam ONE Events", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '1.0.0')))]", + "version": "[variables('parserObject2').parserVersion2]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject2')._parserName2]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Veeam ONE Events", + "category": "Microsoft Sentinel Parser", + "functionAlias": "Veeam_GetVeeamONEAlarms", + "query": "let watchlist = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nSyslog\n| where SyslogMessage has \"predefined_alarm_id\"\n| extend predefined_alarm_id = extract(\"predefined_alarm_id=\\\"(\\\\d+)\\\"\", 1, SyslogMessage)\n| where predefined_alarm_id in (\"395\", \"364\", \"369\", \"391\", \"365\", \"370\", \"314\", \"331\", \"376\", \"377\", \"403\", \"316\", \"342\", \"381\", \"315\", \"332\", \"344\", \"378\")\n| lookup kind=leftouter (watchlist) \n on $left.predefined_alarm_id == $right.ID\n| extend alarm_details = extract(\"alarm_details=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend alarm_name = extract(\"alarm_name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend alarm_type = extract(\"alarm_type=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend event_module = extract(\"event_module=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend eventtype = extract(\"eventtype=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend object_name = extract(\"object_name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend object_path = extract(\"object_path=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend original_host = extract(\"original_host=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend predefined_alarm_id = extract(\"predefined_alarm_id=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend severity = extract(\"severity=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend status_new = extract(\"status_new=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend status_old = extract(\"status_old=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend VoneHostName=Computer\n| extend SeverityDescription = case(Severity==\"critical\",\"Critical\",\n Severity==\"high\",\"High\",\n Severity==\"medium\",\"Medium\",\n Severity==\"information\",\"Information\", \n \"Unknown\")\n| project [\"Event Name\"], TimeGenerated, alarm_details, alarm_name, alarm_type, object_name, object_path, predefined_alarm_id, Severity, status_new, status_old, VoneHostName, SeverityDescription, SyslogMessage\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]", + "dependsOn": [ + "[variables('parserObject2')._parserId2]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetVeeamONEAlarms')]", + "contentId": "[variables('parserObject2').parserContentId2]", + "kind": "Parser", + "version": "[variables('parserObject2').parserVersion2]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject3').parserTemplateSpecName3]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_GetFinishedConfigurationBackupSessions Data Parser with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject3').parserVersion3]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject3')._parserName3]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Veeam Configuration Backup Session Finished Events", + "category": "Microsoft Sentinel Parser", + "functionAlias": "Veeam_GetFinishedConfigurationBackupSessions", + "query": "Syslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId == \"40700\"\n| extend UserName = extract(\"UserName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend fullName = extract(\"fullName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param3 = extract(\"param3=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param6 = extract(\"param6=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Result = extract(\"Result=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = extract(\"user=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend InitiatorName = extract(\"InitiatorName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend src = extract(\"src=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = case(\n isnotnull(user) and user != \"\", \n user, \n instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), \n iff(isnull(fullName) or fullName == \"\", \"unknown\", fullName), \n instanceId in (\"36013\"), \n iff(isnull(InitiatorName) or InitiatorName == \"\", \"unknown\", InitiatorName), \n instanceId in (\"41800\",\"41810\"), \n iff(isnull(param3) or param3 == \"\", \"unknown\", param3), \n instanceId in (\"23090\",\"23420\",\"41402\"), \n iff(isnull(param6) or param6 == \"\", \"unknown\", param6), \n instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\",\"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), \n iff(isnull(UserName) or UserName == \"\", \"unknown\", UserName),\n \"unknown\" \n)\n| extend Result = extract(\"Result:\\\\s*([^\\\\.]*)\", 1, Description)\n| project TimeGenerated, Computer, user, Description, Result, SyslogMessage, instanceId\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject3')._parserId3,'/'))))]", + "dependsOn": [ + "[variables('parserObject3')._parserId3]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetFinishedConfigurationBackupSessions')]", + "contentId": "[variables('parserObject3').parserContentId3]", + "kind": "Parser", + "version": "[variables('parserObject3').parserVersion3]", + "source": { + "name": "Veeam", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject3').parserContentId3]", + "contentKind": "Parser", + "displayName": "Parser for Veeam Configuration Backup Session Finished Events", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject3').parserContentId3,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject3').parserContentId3,'-', '1.0.0')))]", + "version": "[variables('parserObject3').parserVersion3]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject3')._parserName3]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Veeam Configuration Backup Session Finished Events", + "category": "Microsoft Sentinel Parser", + "functionAlias": "Veeam_GetFinishedConfigurationBackupSessions", + "query": "Syslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId == \"40700\"\n| extend UserName = extract(\"UserName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend fullName = extract(\"fullName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param3 = extract(\"param3=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param6 = extract(\"param6=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Result = extract(\"Result=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = extract(\"user=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend InitiatorName = extract(\"InitiatorName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend src = extract(\"src=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = case(\n isnotnull(user) and user != \"\", \n user, \n instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), \n iff(isnull(fullName) or fullName == \"\", \"unknown\", fullName), \n instanceId in (\"36013\"), \n iff(isnull(InitiatorName) or InitiatorName == \"\", \"unknown\", InitiatorName), \n instanceId in (\"41800\",\"41810\"), \n iff(isnull(param3) or param3 == \"\", \"unknown\", param3), \n instanceId in (\"23090\",\"23420\",\"41402\"), \n iff(isnull(param6) or param6 == \"\", \"unknown\", param6), \n instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\",\"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), \n iff(isnull(UserName) or UserName == \"\", \"unknown\", UserName),\n \"unknown\" \n)\n| extend Result = extract(\"Result:\\\\s*([^\\\\.]*)\", 1, Description)\n| project TimeGenerated, Computer, user, Description, Result, SyslogMessage, instanceId\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject3')._parserId3,'/'))))]", + "dependsOn": [ + "[variables('parserObject3')._parserId3]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetFinishedConfigurationBackupSessions')]", + "contentId": "[variables('parserObject3').parserContentId3]", + "kind": "Parser", + "version": "[variables('parserObject3').parserVersion3]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject4').parserTemplateSpecName4]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_GetSecurityEvents Data Parser with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject4').parserVersion4]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject4')._parserName4]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Veeam Security VBR Events", + "category": "Microsoft Sentinel Parser", + "functionAlias": "Veeam_GetSecurityEvents", + "query": "let watchlist = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nSyslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId in (\"115\", \"21224\", \"23090\", \"23420\", \"23630\", \"23631\", \"23632\", \"23633\", \"24020\", \"24030\", \"24040\", \"24050\", \"24060\", \"24070\", \"24080\", \"24114\", \"24131\", \"24140\", \"24142\", \"24143\", \"24160\", \"24170\", \"25000\", \"25210\", \"25220\", \"25400\", \"25500\", \"25700\", \"25800\", \"26000\", \"26100\", \"26110\", \"26600\", \"26700\", \"26800\", \"26900\", \"27000\", \"27200\", \"27300\", \"27500\", \"27600\", \"27900\", \"28100\", \"28200\", \"28400\", \"28500\", \"28800\", \"28850\", \"28920\", \"28940\", \"28950\", \"28970\", \"28980\", \"29110\", \"29120\", \"29140\", \"29150\", \"29800\", \"29900\", \"30100\", \"30200\", \"30400\", \"30500\", \"30700\", \"30800\", \"31000\", \"31200\", \"31210\", \"31400\", \"31500\", \"31600\", \"31700\", \"31800\", \"31900\", \"32100\", \"32120\", \"32200\", \"32400\", \"32800\", \"36013\", \"40201\", \"40202\", \"40204\", \"40205\", \"40206\", \"40400\", \"40500\", \"40600\", \"41200\", \"41401\", \"41402\", \"41600\", \"41610\", \"41800\", \"41810\", \"42210\", \"42220\", \"42230\", \"42260\", \"42270\", \"42280\", \"42290\", \"42301\", \"42302\", \"42401\", \"42402\", \"42404\", \"42405\", \"42500\")\n| lookup kind=leftouter (watchlist) \n on $left.instanceId == $right.ID\n| extend UserName = extract(\"UserName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend fullName = extract(\"fullName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param3 = extract(\"param3=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param6 = extract(\"param6=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Result = extract(\"Result=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = extract(\"user=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend InitiatorName = extract(\"InitiatorName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend src = extract(\"src=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = case(\n isnotnull(user) and user != \"\", \n user, \n instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), \n iff(isnull(fullName) or fullName == \"\", \"unknown\", fullName), \n instanceId in (\"36013\"), \n iff(isnull(InitiatorName) or InitiatorName == \"\", \"unknown\", InitiatorName), \n instanceId in (\"41800\",\"41810\"), \n iff(isnull(param3) or param3 == \"\", \"unknown\", param3), \n instanceId in (\"23090\",\"23420\",\"41402\"), \n iff(isnull(param6) or param6 == \"\", \"unknown\", param6), \n instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\",\"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), \n iff(isnull(UserName) or UserName == \"\", \"unknown\", UserName),\n \"unknown\" \n)\n| extend src = iff(isnull(src) or src == \"\", \n iff(isnull(Description) or Description == \"\", \"unknown\", Description), \n src)\n| extend SeverityDescription = case(Severity==\"critical\",\"Critical\",\n Severity==\"high\",\"High\",\n Severity==\"medium\",\"Medium\",\n Severity==\"information\",\"Information\", \n \"Unknown\")\n| extend event_module = Type1, original_host = Computer \n| project TimeGenerated, Description, event_module, instanceId, original_host, Severity, src, user, SeverityDescription, [\"Event Name\"], SyslogMessage\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject4')._parserId4,'/'))))]", + "dependsOn": [ + "[variables('parserObject4')._parserId4]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetSecurityEvents')]", + "contentId": "[variables('parserObject4').parserContentId4]", + "kind": "Parser", + "version": "[variables('parserObject4').parserVersion4]", + "source": { + "name": "Veeam", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject4').parserContentId4]", + "contentKind": "Parser", + "displayName": "Parser for Veeam Security VBR Events", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", + "version": "[variables('parserObject4').parserVersion4]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject4')._parserName4]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Veeam Security VBR Events", + "category": "Microsoft Sentinel Parser", + "functionAlias": "Veeam_GetSecurityEvents", + "query": "let watchlist = union isfuzzy=true \n (datatable(ID:string, Severity:string, Type1:string, [\"Event Name\"]:string)[]),\n (_GetWatchlist(\"vbr_events_lookup\")); \nSyslog\n| where SyslogMessage has \"instanceId\"\n| extend instanceId = extract(\"instanceId=(\\\\d+)\", 1, SyslogMessage) \n| filter instanceId in (\"115\", \"21224\", \"23090\", \"23420\", \"23630\", \"23631\", \"23632\", \"23633\", \"24020\", \"24030\", \"24040\", \"24050\", \"24060\", \"24070\", \"24080\", \"24114\", \"24131\", \"24140\", \"24142\", \"24143\", \"24160\", \"24170\", \"25000\", \"25210\", \"25220\", \"25400\", \"25500\", \"25700\", \"25800\", \"26000\", \"26100\", \"26110\", \"26600\", \"26700\", \"26800\", \"26900\", \"27000\", \"27200\", \"27300\", \"27500\", \"27600\", \"27900\", \"28100\", \"28200\", \"28400\", \"28500\", \"28800\", \"28850\", \"28920\", \"28940\", \"28950\", \"28970\", \"28980\", \"29110\", \"29120\", \"29140\", \"29150\", \"29800\", \"29900\", \"30100\", \"30200\", \"30400\", \"30500\", \"30700\", \"30800\", \"31000\", \"31200\", \"31210\", \"31400\", \"31500\", \"31600\", \"31700\", \"31800\", \"31900\", \"32100\", \"32120\", \"32200\", \"32400\", \"32800\", \"36013\", \"40201\", \"40202\", \"40204\", \"40205\", \"40206\", \"40400\", \"40500\", \"40600\", \"41200\", \"41401\", \"41402\", \"41600\", \"41610\", \"41800\", \"41810\", \"42210\", \"42220\", \"42230\", \"42260\", \"42270\", \"42280\", \"42290\", \"42301\", \"42302\", \"42401\", \"42402\", \"42404\", \"42405\", \"42500\")\n| lookup kind=leftouter (watchlist) \n on $left.instanceId == $right.ID\n| extend UserName = extract(\"UserName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend fullName = extract(\"fullName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param3 = extract(\"param3=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend param6 = extract(\"param6=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Result = extract(\"Result=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = extract(\"user=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend InitiatorName = extract(\"InitiatorName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Description = extract(\"Description=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend src = extract(\"src=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend user = case(\n isnotnull(user) and user != \"\", \n user, \n instanceId in (\"40201\",\"42402\",\"42404\",\"42405\",\"40204\",\"40400\",\"40500\",\"40600\",\"40700\",\"42400\",\"42401\",\"42403\"), \n iff(isnull(fullName) or fullName == \"\", \"unknown\", fullName), \n instanceId in (\"36013\"), \n iff(isnull(InitiatorName) or InitiatorName == \"\", \"unknown\", InitiatorName), \n instanceId in (\"41800\",\"41810\"), \n iff(isnull(param3) or param3 == \"\", \"unknown\", param3), \n instanceId in (\"23090\",\"23420\",\"41402\"), \n iff(isnull(param6) or param6 == \"\", \"unknown\", param6), \n instanceId in (\"40205\",\"40206\",\"41610\",\"42301\",\"24080\",\"28200\",\"28500\",\"28920\",\"28950\",\"29120\",\"29150\",\"29900\",\"30200\",\"30500\",\"32120\",\"32200\",\"25500\",\"28100\",\"29800\",\"31600\",\"31700\",\"31800\",\"31900\",\"42260\",\"42270\",\"42280\",\"42302\",\"30100\",\"30400\",\"31500\",\"31210\",\"31400\",\"41600\",\"31200\",\"28970\",\"28980\",\"42230\",\"42220\",\"42290\"), \n iff(isnull(UserName) or UserName == \"\", \"unknown\", UserName),\n \"unknown\" \n)\n| extend src = iff(isnull(src) or src == \"\", \n iff(isnull(Description) or Description == \"\", \"unknown\", Description), \n src)\n| extend SeverityDescription = case(Severity==\"critical\",\"Critical\",\n Severity==\"high\",\"High\",\n Severity==\"medium\",\"Medium\",\n Severity==\"information\",\"Information\", \n \"Unknown\")\n| extend event_module = Type1, original_host = Computer \n| project TimeGenerated, Description, event_module, instanceId, original_host, Severity, src, user, SeverityDescription, [\"Event Name\"], SyslogMessage\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject4')._parserId4,'/'))))]", + "dependsOn": [ + "[variables('parserObject4')._parserId4]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Veeam_GetSecurityEvents')]", + "contentId": "[variables('parserObject4').parserContentId4]", + "kind": "Parser", + "version": "[variables('parserObject4').parserVersion4]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Adding_User_or_Group_Failed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects failed attempts to add a user or user group to Veeam Backup & Replication.", + "displayName": "Adding User or Group Failed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 31210\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 1", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "contentKind": "AnalyticsRule", + "displayName": "Adding User or Group Failed", + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Application_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an application group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Application Group Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 30500\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Application Group Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 2", + "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "contentKind": "AnalyticsRule", + "displayName": "Application Group Deleted", + "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Application_Group_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when application group settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Application Group Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 30400\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Application Group Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 3", + "parentId": "[variables('analyticRuleObject3').analyticRuleId3]", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "contentKind": "AnalyticsRule", + "displayName": "Application Group Settings Updated", + "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Archive_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an archive repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Archive Repository Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 29900\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 4", + "parentId": "[variables('analyticRuleObject4').analyticRuleId4]", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "contentKind": "AnalyticsRule", + "displayName": "Archive Repository Deleted", + "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Archive_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when archive repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Archive Repository Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 29800\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 5", + "parentId": "[variables('analyticRuleObject5').analyticRuleId5]", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "contentKind": "AnalyticsRule", + "displayName": "Archive Repository Settings Updated", + "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Attempt_to_Delete_Backup_Failed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects failed backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.", + "displayName": "Attempt to Delete Backup Failed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 41800\n| extend Endpoint = extract(\"param2=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Endpoint\"] = Endpoint,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 6", + "parentId": "[variables('analyticRuleObject6').analyticRuleId6]", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "contentKind": "AnalyticsRule", + "displayName": "Attempt to Delete Backup Failed", + "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject7').analyticRuleTemplateSpecName7]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Attempt_to_Update_Security_Object_Failed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject7')._analyticRulecontentId7]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects failed attempts to update security objects in Veeam Backup & Replication. Security objects include users and roles, credential records, certificates, or passwords.", + "displayName": "Attempt to Update Security Object Failed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 41810\n| extend Endpoint = extract(\"param2=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Endpoint\"] = Endpoint,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject7').analyticRuleId7,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 7", + "parentId": "[variables('analyticRuleObject7').analyticRuleId7]", + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", + "contentKind": "AnalyticsRule", + "displayName": "Attempt to Update Security Object Failed", + "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", + "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject8').analyticRuleTemplateSpecName8]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Backup_Proxy_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject8')._analyticRulecontentId8]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a backup proxy is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Backup Proxy Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 27900\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject8').analyticRuleId8,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 8", + "parentId": "[variables('analyticRuleObject8').analyticRuleId8]", + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", + "contentKind": "AnalyticsRule", + "displayName": "Backup Proxy Deleted", + "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", + "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject9').analyticRuleTemplateSpecName9]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Backup_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject9')._analyticRulecontentId9]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a backup repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Backup Repository Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 28200\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject9').analyticRuleId9,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 9", + "parentId": "[variables('analyticRuleObject9').analyticRuleId9]", + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", + "contentKind": "AnalyticsRule", + "displayName": "Backup Repository Deleted", + "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", + "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject10').analyticRuleTemplateSpecName10]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Backup_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject10')._analyticRulecontentId10]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when backup repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Backup Repository Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 28100\n| extend RepositoryName = extract(\"RepositoryName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Object Name\"] = RepositoryName,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject10').analyticRuleId10,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 10", + "parentId": "[variables('analyticRuleObject10').analyticRuleId10]", + "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject10').analyticRuleVersion10]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", + "contentKind": "AnalyticsRule", + "displayName": "Backup Repository Settings Updated", + "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", + "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", + "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject11').analyticRuleTemplateSpecName11]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Cloud_Gateway_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject11')._analyticRulecontentId11]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a cloud gateway is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Cloud Gateway Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 24140\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject11').analyticRuleId11,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 11", + "parentId": "[variables('analyticRuleObject11').analyticRuleId11]", + "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject11').analyticRuleVersion11]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]", + "contentKind": "AnalyticsRule", + "displayName": "Cloud Gateway Deleted", + "contentProductId": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]", + "id": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]", + "version": "[variables('analyticRuleObject11').analyticRuleVersion11]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject12').analyticRuleTemplateSpecName12]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Cloud_Gateway_Pool_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject12')._analyticRulecontentId12]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a cloud gateway pool is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Cloud Gateway Pool Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 24143\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject12').analyticRuleId12,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 12", + "parentId": "[variables('analyticRuleObject12').analyticRuleId12]", + "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject12').analyticRuleVersion12]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]", + "contentKind": "AnalyticsRule", + "displayName": "Cloud Gateway Pool Deleted", + "contentProductId": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]", + "id": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]", + "version": "[variables('analyticRuleObject12').analyticRuleVersion12]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject13').analyticRuleTemplateSpecName13]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Cloud_Gateway_Pool_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject13')._analyticRulecontentId13]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when cloud gateway pool settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Cloud Gateway Pool Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 24142\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject13').analyticRuleId13,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 13", + "parentId": "[variables('analyticRuleObject13').analyticRuleId13]", + "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject13').analyticRuleVersion13]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]", + "contentKind": "AnalyticsRule", + "displayName": "Cloud Gateway Pool Settings Updated", + "contentProductId": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]", + "id": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]", + "version": "[variables('analyticRuleObject13').analyticRuleVersion13]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject14').analyticRuleTemplateSpecName14]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Cloud_Gateway_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject14')._analyticRulecontentId14]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when cloud gateway settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Cloud Gateway Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 24131\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject14').analyticRuleId14,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 14", + "parentId": "[variables('analyticRuleObject14').analyticRuleId14]", + "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject14').analyticRuleVersion14]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]", + "contentKind": "AnalyticsRule", + "displayName": "Cloud Gateway Settings Updated", + "contentProductId": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]", + "id": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]", + "version": "[variables('analyticRuleObject14').analyticRuleVersion14]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject15').analyticRuleTemplateSpecName15]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Cloud_Replica_Permanent_Failover_Performed_by_Tenant_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject15')._analyticRulecontentId15]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects permanent failover of a cloud replica initiated by a tenant. This might indicate disaster recovery activity or issues with primary systems.", + "displayName": "Cloud Replica Permanent Failover Performed by Tenant", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 27000\n| extend VmRef = extract(\"VmRef=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend HostID = extract(\"HostID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Replica Name\"] = VmRef,\n [\"Tenant ID\"] = TenantID,\n [\"Data SourceID\"] = HostID,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject15').analyticRuleId15,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 15", + "parentId": "[variables('analyticRuleObject15').analyticRuleId15]", + "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject15').analyticRuleVersion15]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]", + "contentKind": "AnalyticsRule", + "displayName": "Cloud Replica Permanent Failover Performed by Tenant", + "contentProductId": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]", + "id": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]", + "version": "[variables('analyticRuleObject15').analyticRuleVersion15]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject16').analyticRuleTemplateSpecName16]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Configuration_Backup_Job_Failed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject16')._analyticRulecontentId16]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.", + "displayName": "Configuration Backup Job Failed", + "enabled": false, + "query": "Veeam_GetFinishedConfigurationBackupSessions\r\n| where Result == \"Failed\"\r\n| project\r\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\r\n DataSource = Computer,\r\n EventId = instanceId,\r\n UserName = user,\r\n [\"State\"] = Result,\r\n MessageDetails = Description", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "MessageDetails": "MessageDetails", + "DataSource": "DataSource" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject16').analyticRuleId16,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 16", + "parentId": "[variables('analyticRuleObject16').analyticRuleId16]", + "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject16').analyticRuleVersion16]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]", + "contentKind": "AnalyticsRule", + "displayName": "Configuration Backup Job Failed", + "contentProductId": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]", + "id": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]", + "version": "[variables('analyticRuleObject16').analyticRuleVersion16]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject17').analyticRuleTemplateSpecName17]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Configuration_Backup_Job_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject17')._analyticRulecontentId17]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when configuration backup job settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Configuration Backup Job Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 31500\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject17').analyticRuleId17,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 17", + "parentId": "[variables('analyticRuleObject17').analyticRuleId17]", + "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject17').analyticRuleVersion17]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]", + "contentKind": "AnalyticsRule", + "displayName": "Configuration Backup Job Settings Updated", + "contentProductId": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]", + "id": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]", + "version": "[variables('analyticRuleObject17').analyticRuleVersion17]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject18').analyticRuleTemplateSpecName18]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Connection_to_Backup_Repository_Lost_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject18')._analyticRulecontentId18]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a backup server fails to connect to a backup repository.", + "displayName": "Connection to Backup Repository Lost", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 21224\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject18').analyticRuleId18,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 18", + "parentId": "[variables('analyticRuleObject18').analyticRuleId18]", + "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject18').analyticRuleVersion18]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]", + "contentKind": "AnalyticsRule", + "displayName": "Connection to Backup Repository Lost", + "contentProductId": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]", + "id": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]", + "version": "[variables('analyticRuleObject18').analyticRuleVersion18]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject19').analyticRuleTemplateSpecName19]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Credential_Record_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject19')._analyticRulecontentId19]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a credential record is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Credential Record Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 25500\n| extend AccountName = extract(\"AccountName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Credential Record\"] = AccountName,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject19').analyticRuleId19,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 19", + "parentId": "[variables('analyticRuleObject19').analyticRuleId19]", + "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject19').analyticRuleVersion19]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]", + "contentKind": "AnalyticsRule", + "displayName": "Credential Record Deleted", + "contentProductId": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]", + "id": "[variables('analyticRuleObject19')._analyticRulecontentProductId19]", + "version": "[variables('analyticRuleObject19').analyticRuleVersion19]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject20').analyticRuleTemplateSpecName20]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Credential_Record_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject20').analyticRuleVersion20]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject20')._analyticRulecontentId20]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a credential record is updated in Veeam Backup & Replication.", + "displayName": "Credential Record Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 25400\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject20').analyticRuleId20,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 20", + "parentId": "[variables('analyticRuleObject20').analyticRuleId20]", + "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject20').analyticRuleVersion20]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]", + "contentKind": "AnalyticsRule", + "displayName": "Credential Record Updated", + "contentProductId": "[variables('analyticRuleObject20')._analyticRulecontentProductId20]", + "id": "[variables('analyticRuleObject20')._analyticRulecontentProductId20]", + "version": "[variables('analyticRuleObject20').analyticRuleVersion20]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject21').analyticRuleTemplateSpecName21]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Detaching_Backups_Started_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject21').analyticRuleVersion21]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject21')._analyticRulecontentId21]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a backup file is detached from a backup job.", + "displayName": "Detaching Backups Started", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 41200\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject21').analyticRuleId21,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 21", + "parentId": "[variables('analyticRuleObject21').analyticRuleId21]", + "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject21').analyticRuleVersion21]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]", + "contentKind": "AnalyticsRule", + "displayName": "Detaching Backups Started", + "contentProductId": "[variables('analyticRuleObject21')._analyticRulecontentProductId21]", + "id": "[variables('analyticRuleObject21')._analyticRulecontentProductId21]", + "version": "[variables('analyticRuleObject21').analyticRuleVersion21]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject22').analyticRuleTemplateSpecName22]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Encryption_Password_Added_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject22').analyticRuleVersion22]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject22')._analyticRulecontentId22]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an encryption password is added to Veeam Backup & Replication.", + "displayName": "Encryption Password Added", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 31600\n| extend Hint = extract(\"Hint=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Hint\"] = Hint,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject22').analyticRuleId22,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 22", + "parentId": "[variables('analyticRuleObject22').analyticRuleId22]", + "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject22').analyticRuleVersion22]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]", + "contentKind": "AnalyticsRule", + "displayName": "Encryption Password Added", + "contentProductId": "[variables('analyticRuleObject22')._analyticRulecontentProductId22]", + "id": "[variables('analyticRuleObject22')._analyticRulecontentProductId22]", + "version": "[variables('analyticRuleObject22').analyticRuleVersion22]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject23').analyticRuleTemplateSpecName23]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Encryption_Password_Changed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject23').analyticRuleVersion23]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject23')._analyticRulecontentId23]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an encryption password is updated in Veeam Backup & Replication.", + "displayName": "Encryption Password Changed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 31700\n| extend Hint = extract(\"Hint=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Hint\"] = Hint,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject23').analyticRuleId23,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 23", + "parentId": "[variables('analyticRuleObject23').analyticRuleId23]", + "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject23').analyticRuleVersion23]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]", + "contentKind": "AnalyticsRule", + "displayName": "Encryption Password Changed", + "contentProductId": "[variables('analyticRuleObject23')._analyticRulecontentProductId23]", + "id": "[variables('analyticRuleObject23')._analyticRulecontentProductId23]", + "version": "[variables('analyticRuleObject23').analyticRuleVersion23]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject24').analyticRuleTemplateSpecName24]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Encryption_Password_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject24').analyticRuleVersion24]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject24')._analyticRulecontentId24]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an encryption password is deleted in Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Encryption Password Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 31800\n| extend Hint = extract(\"Hint=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Hint\"] = Hint,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject24').analyticRuleId24,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 24", + "parentId": "[variables('analyticRuleObject24').analyticRuleId24]", + "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject24').analyticRuleVersion24]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]", + "contentKind": "AnalyticsRule", + "displayName": "Encryption Password Deleted", + "contentProductId": "[variables('analyticRuleObject24')._analyticRulecontentProductId24]", + "id": "[variables('analyticRuleObject24')._analyticRulecontentProductId24]", + "version": "[variables('analyticRuleObject24').analyticRuleVersion24]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject25').analyticRuleTemplateSpecName25]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "External_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject25').analyticRuleVersion25]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject25')._analyticRulecontentId25]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an external repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "External Repository Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 32200\n| extend RepositoryName = extract(\"RepositoryName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = RepositoryName,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject25').analyticRuleId25,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 25", + "parentId": "[variables('analyticRuleObject25').analyticRuleId25]", + "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject25').analyticRuleVersion25]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]", + "contentKind": "AnalyticsRule", + "displayName": "External Repository Deleted", + "contentProductId": "[variables('analyticRuleObject25')._analyticRulecontentProductId25]", + "id": "[variables('analyticRuleObject25')._analyticRulecontentProductId25]", + "version": "[variables('analyticRuleObject25').analyticRuleVersion25]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject26').analyticRuleTemplateSpecName26]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "External_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject26').analyticRuleVersion26]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject26')._analyticRulecontentId26]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when external repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "External Repository Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 32100\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject26').analyticRuleId26,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 26", + "parentId": "[variables('analyticRuleObject26').analyticRuleId26]", + "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject26').analyticRuleVersion26]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]", + "contentKind": "AnalyticsRule", + "displayName": "External Repository Settings Updated", + "contentProductId": "[variables('analyticRuleObject26')._analyticRulecontentProductId26]", + "id": "[variables('analyticRuleObject26')._analyticRulecontentProductId26]", + "version": "[variables('analyticRuleObject26').analyticRuleVersion26]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject27').analyticRuleTemplateSpecName27]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Failover_Plan_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject27').analyticRuleVersion27]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject27')._analyticRulecontentId27]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a failover plan is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Failover Plan Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 26100\n| extend FailoverPlanName = extract(\"FailoverPlanName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Failover Plan Name\"] = FailoverPlanName,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject27').analyticRuleId27,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 27", + "parentId": "[variables('analyticRuleObject27').analyticRuleId27]", + "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject27').analyticRuleVersion27]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]", + "contentKind": "AnalyticsRule", + "displayName": "Failover Plan Deleted", + "contentProductId": "[variables('analyticRuleObject27')._analyticRulecontentProductId27]", + "id": "[variables('analyticRuleObject27')._analyticRulecontentProductId27]", + "version": "[variables('analyticRuleObject27').analyticRuleVersion27]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject28').analyticRuleTemplateSpecName28]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Failover_Plan_Failed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject28').analyticRuleVersion28]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject28')._analyticRulecontentId28]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a failover plan fails. This might indicate disaster recovery activity or issues with primary systems.", + "displayName": "Failover Plan Failed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 26110\n| extend FailoverPlanName = extract(\"FailoverPlanName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Failover Plan Name\"] = FailoverPlanName,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject28').analyticRuleId28,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 28", + "parentId": "[variables('analyticRuleObject28').analyticRuleId28]", + "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject28').analyticRuleVersion28]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]", + "contentKind": "AnalyticsRule", + "displayName": "Failover Plan Failed", + "contentProductId": "[variables('analyticRuleObject28')._analyticRulecontentProductId28]", + "id": "[variables('analyticRuleObject28')._analyticRulecontentProductId28]", + "version": "[variables('analyticRuleObject28').analyticRuleVersion28]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject29').analyticRuleTemplateSpecName29]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Failover_Plan_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject29').analyticRuleVersion29]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject29')._analyticRulecontentId29]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when failover plan settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Failover Plan Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 26000\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject29').analyticRuleId29,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 29", + "parentId": "[variables('analyticRuleObject29').analyticRuleId29]", + "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject29').analyticRuleVersion29]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]", + "contentKind": "AnalyticsRule", + "displayName": "Failover Plan Settings Updated", + "contentProductId": "[variables('analyticRuleObject29')._analyticRulecontentProductId29]", + "id": "[variables('analyticRuleObject29')._analyticRulecontentProductId29]", + "version": "[variables('analyticRuleObject29').analyticRuleVersion29]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject30').analyticRuleTemplateSpecName30]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Failover_Plan_Started_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject30').analyticRuleVersion30]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject30')._analyticRulecontentId30]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a failover plan starts. This might indicate disaster recovery activity or issues with primary systems.", + "displayName": "Failover Plan Started", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 26600\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject30').analyticRuleId30,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 30", + "parentId": "[variables('analyticRuleObject30').analyticRuleId30]", + "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject30').analyticRuleVersion30]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]", + "contentKind": "AnalyticsRule", + "displayName": "Failover Plan Started", + "contentProductId": "[variables('analyticRuleObject30')._analyticRulecontentProductId30]", + "id": "[variables('analyticRuleObject30')._analyticRulecontentProductId30]", + "version": "[variables('analyticRuleObject30').analyticRuleVersion30]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject31').analyticRuleTemplateSpecName31]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Failover_Plan_Stopped_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject31').analyticRuleVersion31]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject31')._analyticRulecontentId31]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a failover plan stops. This might indicate disaster recovery activity or issues with primary systems.", + "displayName": "Failover Plan Stopped", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 26700\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject31').analyticRuleId31,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 31", + "parentId": "[variables('analyticRuleObject31').analyticRuleId31]", + "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject31').analyticRuleVersion31]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]", + "contentKind": "AnalyticsRule", + "displayName": "Failover Plan Stopped", + "contentProductId": "[variables('analyticRuleObject31')._analyticRulecontentProductId31]", + "id": "[variables('analyticRuleObject31')._analyticRulecontentProductId31]", + "version": "[variables('analyticRuleObject31').analyticRuleVersion31]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject32').analyticRuleTemplateSpecName32]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "File_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject32').analyticRuleVersion32]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject32')._analyticRulecontentId32]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a file server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "File Server Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 28950\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject32').analyticRuleId32,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 32", + "parentId": "[variables('analyticRuleObject32').analyticRuleId32]", + "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject32').analyticRuleVersion32]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]", + "contentKind": "AnalyticsRule", + "displayName": "File Server Deleted", + "contentProductId": "[variables('analyticRuleObject32')._analyticRulecontentProductId32]", + "id": "[variables('analyticRuleObject32')._analyticRulecontentProductId32]", + "version": "[variables('analyticRuleObject32').analyticRuleVersion32]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject33').analyticRuleTemplateSpecName33]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "File_Server_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject33').analyticRuleVersion33]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject33')._analyticRulecontentId33]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when file server settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "File Server Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 28940\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject33').analyticRuleId33,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 33", + "parentId": "[variables('analyticRuleObject33').analyticRuleId33]", + "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject33').analyticRuleVersion33]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]", + "contentKind": "AnalyticsRule", + "displayName": "File Server Settings Updated", + "contentProductId": "[variables('analyticRuleObject33')._analyticRulecontentProductId33]", + "id": "[variables('analyticRuleObject33')._analyticRulecontentProductId33]", + "version": "[variables('analyticRuleObject33').analyticRuleVersion33]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject34').analyticRuleTemplateSpecName34]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "File_Share_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject34').analyticRuleVersion34]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject34')._analyticRulecontentId34]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a file share is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "File Share Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 28920\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Data SourceName\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject34').analyticRuleId34,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 34", + "parentId": "[variables('analyticRuleObject34').analyticRuleId34]", + "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject34').analyticRuleVersion34]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]", + "contentKind": "AnalyticsRule", + "displayName": "File Share Deleted", + "contentProductId": "[variables('analyticRuleObject34')._analyticRulecontentProductId34]", + "id": "[variables('analyticRuleObject34')._analyticRulecontentProductId34]", + "version": "[variables('analyticRuleObject34').analyticRuleVersion34]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject35').analyticRuleTemplateSpecName35]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Four_Eyes_Authorization_Disabled_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject35').analyticRuleVersion35]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject35')._analyticRulecontentId35]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when four-eyes authorization is disabled.", + "displayName": "Four-Eyes Authorization Disabled", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42401\n| extend Operation = extract(\"Operation=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Operation\"] = Operation,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject35').analyticRuleId35,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 35", + "parentId": "[variables('analyticRuleObject35').analyticRuleId35]", + "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject35').analyticRuleVersion35]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]", + "contentKind": "AnalyticsRule", + "displayName": "Four-Eyes Authorization Disabled", + "contentProductId": "[variables('analyticRuleObject35')._analyticRulecontentProductId35]", + "id": "[variables('analyticRuleObject35')._analyticRulecontentProductId35]", + "version": "[variables('analyticRuleObject35').analyticRuleVersion35]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject36').analyticRuleTemplateSpecName36]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Four_Eyes_Authorization_Request_Created_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject36').analyticRuleVersion36]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject36')._analyticRulecontentId36]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a four-eyes authorization request is created.", + "displayName": "Four-Eyes Authorization Request Created", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42402\n| extend Operation = extract(\"Operation=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Operation Name\"] = Operation,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject36').analyticRuleId36,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 36", + "parentId": "[variables('analyticRuleObject36').analyticRuleId36]", + "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject36').analyticRuleVersion36]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]", + "contentKind": "AnalyticsRule", + "displayName": "Four-Eyes Authorization Request Created", + "contentProductId": "[variables('analyticRuleObject36')._analyticRulecontentProductId36]", + "id": "[variables('analyticRuleObject36')._analyticRulecontentProductId36]", + "version": "[variables('analyticRuleObject36').analyticRuleVersion36]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject37').analyticRuleTemplateSpecName37]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Four_Eyes_Authorization_Request_Expired_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject37').analyticRuleVersion37]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject37')._analyticRulecontentId37]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a four-eyes authorization request is expired.", + "displayName": "Four-Eyes Authorization Request Expired", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42405\n| extend Operation = extract(\"Operation=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Operation\"] = Operation,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject37').analyticRuleId37,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 37", + "parentId": "[variables('analyticRuleObject37').analyticRuleId37]", + "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject37').analyticRuleVersion37]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]", + "contentKind": "AnalyticsRule", + "displayName": "Four-Eyes Authorization Request Expired", + "contentProductId": "[variables('analyticRuleObject37')._analyticRulecontentProductId37]", + "id": "[variables('analyticRuleObject37')._analyticRulecontentProductId37]", + "version": "[variables('analyticRuleObject37').analyticRuleVersion37]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject38').analyticRuleTemplateSpecName38]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Four_Eyes_Authorization_Request_Rejected_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject38').analyticRuleVersion38]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject38')._analyticRulecontentId38]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a four-eyes authorization request is rejected.", + "displayName": "Four-Eyes Authorization Request Rejected", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42404\n| extend Operation = extract(\"Operation=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Operation Name\"] = Operation,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject38').analyticRuleId38,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 38", + "parentId": "[variables('analyticRuleObject38').analyticRuleId38]", + "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject38').analyticRuleVersion38]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]", + "contentKind": "AnalyticsRule", + "displayName": "Four-Eyes Authorization Request Rejected", + "contentProductId": "[variables('analyticRuleObject38')._analyticRulecontentProductId38]", + "id": "[variables('analyticRuleObject38')._analyticRulecontentProductId38]", + "version": "[variables('analyticRuleObject38').analyticRuleVersion38]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject39').analyticRuleTemplateSpecName39]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "General_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject39').analyticRuleVersion39]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject39')._analyticRulecontentId39]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when Veeam Backup & Replication general settings are updated. This might indicate configuration changes that require review.", + "displayName": "General Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 31000\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject39').analyticRuleId39,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 39", + "parentId": "[variables('analyticRuleObject39').analyticRuleId39]", + "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject39').analyticRuleVersion39]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]", + "contentKind": "AnalyticsRule", + "displayName": "General Settings Updated", + "contentProductId": "[variables('analyticRuleObject39')._analyticRulecontentProductId39]", + "id": "[variables('analyticRuleObject39')._analyticRulecontentProductId39]", + "version": "[variables('analyticRuleObject39').analyticRuleVersion39]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject40').analyticRuleTemplateSpecName40]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Global_Network_Traffic_Rules_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject40').analyticRuleVersion40]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject40')._analyticRulecontentId40]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a global network traffic rule is deleted in Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Global Network Traffic Rules Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 32400\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject40').analyticRuleId40,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 40", + "parentId": "[variables('analyticRuleObject40').analyticRuleId40]", + "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject40').analyticRuleVersion40]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]", + "contentKind": "AnalyticsRule", + "displayName": "Global Network Traffic Rules Deleted", + "contentProductId": "[variables('analyticRuleObject40')._analyticRulecontentProductId40]", + "id": "[variables('analyticRuleObject40')._analyticRulecontentProductId40]", + "version": "[variables('analyticRuleObject40').analyticRuleVersion40]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject41').analyticRuleTemplateSpecName41]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Global_VM_Exclusions_Added_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject41').analyticRuleVersion41]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject41')._analyticRulecontentId41]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when global VM exclusion are added in Veeam Backup & Replication.", + "displayName": "Global VM Exclusions Added", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 40400\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject41').analyticRuleId41,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 41", + "parentId": "[variables('analyticRuleObject41').analyticRuleId41]", + "contentId": "[variables('analyticRuleObject41')._analyticRulecontentId41]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject41').analyticRuleVersion41]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject41')._analyticRulecontentId41]", + "contentKind": "AnalyticsRule", + "displayName": "Global VM Exclusions Added", + "contentProductId": "[variables('analyticRuleObject41')._analyticRulecontentProductId41]", + "id": "[variables('analyticRuleObject41')._analyticRulecontentProductId41]", + "version": "[variables('analyticRuleObject41').analyticRuleVersion41]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject42').analyticRuleTemplateSpecName42]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Global_VM_Exclusions_Changed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject42').analyticRuleVersion42]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject42')._analyticRulecontentId42]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when global VM exclusions are updated in Veeam Backup & Replication.", + "displayName": "Global VM Exclusions Changed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 40600\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject42').analyticRuleId42,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 42", + "parentId": "[variables('analyticRuleObject42').analyticRuleId42]", + "contentId": "[variables('analyticRuleObject42')._analyticRulecontentId42]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject42').analyticRuleVersion42]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject42')._analyticRulecontentId42]", + "contentKind": "AnalyticsRule", + "displayName": "Global VM Exclusions Changed", + "contentProductId": "[variables('analyticRuleObject42')._analyticRulecontentProductId42]", + "id": "[variables('analyticRuleObject42')._analyticRulecontentProductId42]", + "version": "[variables('analyticRuleObject42').analyticRuleVersion42]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject43').analyticRuleTemplateSpecName43]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Global_VM_Exclusions_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject43').analyticRuleVersion43]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject43')._analyticRulecontentId43]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a VM is removed from global exclusions in Veeam Backup & Replication. This might indicate unauthorized changes.", + "displayName": "Global VM Exclusions Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 40500\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject43').analyticRuleId43,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 43", + "parentId": "[variables('analyticRuleObject43').analyticRuleId43]", + "contentId": "[variables('analyticRuleObject43')._analyticRulecontentId43]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject43').analyticRuleVersion43]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject43')._analyticRulecontentId43]", + "contentKind": "AnalyticsRule", + "displayName": "Global VM Exclusions Deleted", + "contentProductId": "[variables('analyticRuleObject43')._analyticRulecontentProductId43]", + "id": "[variables('analyticRuleObject43')._analyticRulecontentProductId43]", + "version": "[variables('analyticRuleObject43').analyticRuleVersion43]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject44').analyticRuleTemplateSpecName44]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Host_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject44').analyticRuleVersion44]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject44')._analyticRulecontentId44]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a host is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Host Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 28500\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Data SourceName\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject44').analyticRuleId44,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 44", + "parentId": "[variables('analyticRuleObject44').analyticRuleId44]", + "contentId": "[variables('analyticRuleObject44')._analyticRulecontentId44]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject44').analyticRuleVersion44]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject44')._analyticRulecontentId44]", + "contentKind": "AnalyticsRule", + "displayName": "Host Deleted", + "contentProductId": "[variables('analyticRuleObject44')._analyticRulecontentProductId44]", + "id": "[variables('analyticRuleObject44')._analyticRulecontentProductId44]", + "version": "[variables('analyticRuleObject44').analyticRuleVersion44]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject45').analyticRuleTemplateSpecName45]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Host_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject45').analyticRuleVersion45]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject45')._analyticRulecontentId45]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when host settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Host Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 28400\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject45').analyticRuleId45,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 45", + "parentId": "[variables('analyticRuleObject45').analyticRuleId45]", + "contentId": "[variables('analyticRuleObject45')._analyticRulecontentId45]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject45').analyticRuleVersion45]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject45')._analyticRulecontentId45]", + "contentKind": "AnalyticsRule", + "displayName": "Host Settings Updated", + "contentProductId": "[variables('analyticRuleObject45')._analyticRulecontentProductId45]", + "id": "[variables('analyticRuleObject45')._analyticRulecontentProductId45]", + "version": "[variables('analyticRuleObject45').analyticRuleVersion45]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject46').analyticRuleTemplateSpecName46]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Hypervisor_Host_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject46').analyticRuleVersion46]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject46')._analyticRulecontentId46]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a hypervisor host is deleted from Veeam Backup & Replication. This might indicate unauthorized changes to the virtualization environment.", + "displayName": "Hypervisor Host Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 24070 \n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n [\"DataSource\"] = original_host,\n EventId = instanceId,\n UserName = user,\n [\"MessageDetails\"] = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "entityMappings": [ + { + "fieldMappings": [ + { + "columnName": "DataSource", + "identifier": "FullName" + } + ], + "entityType": "Host" + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "messageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject46').analyticRuleId46,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 46", + "parentId": "[variables('analyticRuleObject46').analyticRuleId46]", + "contentId": "[variables('analyticRuleObject46')._analyticRulecontentId46]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject46').analyticRuleVersion46]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject46')._analyticRulecontentId46]", + "contentKind": "AnalyticsRule", + "displayName": "Hypervisor Host Deleted", + "contentProductId": "[variables('analyticRuleObject46')._analyticRulecontentProductId46]", + "id": "[variables('analyticRuleObject46')._analyticRulecontentProductId46]", + "version": "[variables('analyticRuleObject46').analyticRuleVersion46]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject47').analyticRuleTemplateSpecName47]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Hypervisor_Host_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject47').analyticRuleVersion47]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject47')._analyticRulecontentId47]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when hypervisor host settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Hypervisor Host Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 25800\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject47').analyticRuleId47,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 47", + "parentId": "[variables('analyticRuleObject47').analyticRuleId47]", + "contentId": "[variables('analyticRuleObject47')._analyticRulecontentId47]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject47').analyticRuleVersion47]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject47')._analyticRulecontentId47]", + "contentKind": "AnalyticsRule", + "displayName": "Hypervisor Host Settings Updated", + "contentProductId": "[variables('analyticRuleObject47')._analyticRulecontentProductId47]", + "id": "[variables('analyticRuleObject47')._analyticRulecontentProductId47]", + "version": "[variables('analyticRuleObject47').analyticRuleVersion47]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject48').analyticRuleTemplateSpecName48]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Invalid_Code_for_Multi_Factor_Authentication_Entered_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject48').analyticRuleVersion48]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject48')._analyticRulecontentId48]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects failed multi-factor authentication attempts. This might indicate credential stuffing or brute-force attacks.", + "displayName": "Invalid Code for Multi-Factor Authentication Entered", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 40205\n| extend SID = extract(\"SID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend Endpoint = extract(\"Endpoint=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Endpoint\"] = Endpoint,\n [\"User SID\"] = SID,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject48').analyticRuleId48,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 48", + "parentId": "[variables('analyticRuleObject48').analyticRuleId48]", + "contentId": "[variables('analyticRuleObject48')._analyticRulecontentId48]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject48').analyticRuleVersion48]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject48')._analyticRulecontentId48]", + "contentKind": "AnalyticsRule", + "displayName": "Invalid Code for Multi-Factor Authentication Entered", + "contentProductId": "[variables('analyticRuleObject48')._analyticRulecontentProductId48]", + "id": "[variables('analyticRuleObject48')._analyticRulecontentProductId48]", + "version": "[variables('analyticRuleObject48').analyticRuleVersion48]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject49').analyticRuleTemplateSpecName49]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Job_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject49').analyticRuleVersion49]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject49')._analyticRulecontentId49]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a job is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Job Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 23090\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Job Name\"] = \"\",\n MessageDetails = Description,\n Severity = SeverityDescription\n| project Date, DataSource, EventId, UserName, [\"Job Name\"],MessageDetails,Severity", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject49').analyticRuleId49,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 49", + "parentId": "[variables('analyticRuleObject49').analyticRuleId49]", + "contentId": "[variables('analyticRuleObject49')._analyticRulecontentId49]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject49').analyticRuleVersion49]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject49')._analyticRulecontentId49]", + "contentKind": "AnalyticsRule", + "displayName": "Job Deleted", + "contentProductId": "[variables('analyticRuleObject49')._analyticRulecontentProductId49]", + "id": "[variables('analyticRuleObject49')._analyticRulecontentProductId49]", + "version": "[variables('analyticRuleObject49').analyticRuleVersion49]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject50').analyticRuleTemplateSpecName50]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Job_No_Longer_Used_as_Second_Destination_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject50').analyticRuleVersion50]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject50')._analyticRulecontentId50]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a job used as a secondary destination is removed.", + "displayName": "Job No Longer Used as Second Destination", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 23420\n| extend JobName = extract(\"JobName=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Job Name\"] = JobName,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject50').analyticRuleId50,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 50", + "parentId": "[variables('analyticRuleObject50').analyticRuleId50]", + "contentId": "[variables('analyticRuleObject50')._analyticRulecontentId50]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject50').analyticRuleVersion50]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject50')._analyticRulecontentId50]", + "contentKind": "AnalyticsRule", + "displayName": "Job No Longer Used as Second Destination", + "contentProductId": "[variables('analyticRuleObject50')._analyticRulecontentProductId50]", + "id": "[variables('analyticRuleObject50')._analyticRulecontentProductId50]", + "version": "[variables('analyticRuleObject50').analyticRuleVersion50]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject51').analyticRuleTemplateSpecName51]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "KMS_Key_Rotation_Job_Finished_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject51').analyticRuleVersion51]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject51')._analyticRulecontentId51]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a KMS key rotation job is finished.", + "displayName": "KMS Key Rotation Job Finished", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42500\n| extend ResultMessage = extract(\"ResultMessage=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"StateMessage\"] = ResultMessage,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject51').analyticRuleId51,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 51", + "parentId": "[variables('analyticRuleObject51').analyticRuleId51]", + "contentId": "[variables('analyticRuleObject51')._analyticRulecontentId51]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject51').analyticRuleVersion51]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject51')._analyticRulecontentId51]", + "contentKind": "AnalyticsRule", + "displayName": "KMS Key Rotation Job Finished", + "contentProductId": "[variables('analyticRuleObject51')._analyticRulecontentProductId51]", + "id": "[variables('analyticRuleObject51')._analyticRulecontentProductId51]", + "version": "[variables('analyticRuleObject51').analyticRuleVersion51]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject52').analyticRuleTemplateSpecName52]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "KMS_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject52').analyticRuleVersion52]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject52')._analyticRulecontentId52]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a KMS server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "KMS Server Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42301\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject52').analyticRuleId52,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 52", + "parentId": "[variables('analyticRuleObject52').analyticRuleId52]", + "contentId": "[variables('analyticRuleObject52')._analyticRulecontentId52]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject52').analyticRuleVersion52]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject52')._analyticRulecontentId52]", + "contentKind": "AnalyticsRule", + "displayName": "KMS Server Deleted", + "contentProductId": "[variables('analyticRuleObject52')._analyticRulecontentProductId52]", + "id": "[variables('analyticRuleObject52')._analyticRulecontentProductId52]", + "version": "[variables('analyticRuleObject52').analyticRuleVersion52]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject53').analyticRuleTemplateSpecName53]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "KMS_Server_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject53').analyticRuleVersion53]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject53')._analyticRulecontentId53]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when KMS server settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "KMS Server Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42302\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Obeject Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject53').analyticRuleId53,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 53", + "parentId": "[variables('analyticRuleObject53').analyticRuleId53]", + "contentId": "[variables('analyticRuleObject53')._analyticRulecontentId53]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject53').analyticRuleVersion53]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject53')._analyticRulecontentId53]", + "contentKind": "AnalyticsRule", + "displayName": "KMS Server Settings Updated", + "contentProductId": "[variables('analyticRuleObject53')._analyticRulecontentProductId53]", + "id": "[variables('analyticRuleObject53')._analyticRulecontentProductId53]", + "version": "[variables('analyticRuleObject53').analyticRuleVersion53]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject54').analyticRuleTemplateSpecName54]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "License_Expired_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject54').analyticRuleVersion54]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject54')._analyticRulecontentId54]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a Veeam license is expired. This could impact backup operations and data protection.", + "displayName": "License Expired", + "enabled": false, + "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24030\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject54').analyticRuleId54,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 54", + "parentId": "[variables('analyticRuleObject54').analyticRuleId54]", + "contentId": "[variables('analyticRuleObject54')._analyticRulecontentId54]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject54').analyticRuleVersion54]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject54')._analyticRulecontentId54]", + "contentKind": "AnalyticsRule", + "displayName": "License Expired", + "contentProductId": "[variables('analyticRuleObject54')._analyticRulecontentProductId54]", + "id": "[variables('analyticRuleObject54')._analyticRulecontentProductId54]", + "version": "[variables('analyticRuleObject54').analyticRuleVersion54]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject55').analyticRuleTemplateSpecName55]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "License_Expiring_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject55').analyticRuleVersion55]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject55')._analyticRulecontentId55]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a Veeam license expires shortly.", + "displayName": "License Expiring", + "enabled": false, + "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24020\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject55').analyticRuleId55,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 55", + "parentId": "[variables('analyticRuleObject55').analyticRuleId55]", + "contentId": "[variables('analyticRuleObject55')._analyticRulecontentId55]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject55').analyticRuleVersion55]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject55')._analyticRulecontentId55]", + "contentKind": "AnalyticsRule", + "displayName": "License Expiring", + "contentProductId": "[variables('analyticRuleObject55')._analyticRulecontentProductId55]", + "id": "[variables('analyticRuleObject55')._analyticRulecontentProductId55]", + "version": "[variables('analyticRuleObject55').analyticRuleVersion55]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject56').analyticRuleTemplateSpecName56]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "License_Grace_Period_Started_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject56').analyticRuleVersion56]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject56')._analyticRulecontentId56]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a Veeam license grace period starts. This might indicate potential licensing issues that need attention.", + "displayName": "License Grace Period Started", + "enabled": false, + "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24060\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject56').analyticRuleId56,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 56", + "parentId": "[variables('analyticRuleObject56').analyticRuleId56]", + "contentId": "[variables('analyticRuleObject56')._analyticRulecontentId56]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject56').analyticRuleVersion56]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject56')._analyticRulecontentId56]", + "contentKind": "AnalyticsRule", + "displayName": "License Grace Period Started", + "contentProductId": "[variables('analyticRuleObject56')._analyticRulecontentProductId56]", + "id": "[variables('analyticRuleObject56')._analyticRulecontentProductId56]", + "version": "[variables('analyticRuleObject56').analyticRuleVersion56]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject57').analyticRuleTemplateSpecName57]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "License_Limit_Exceeded_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject57').analyticRuleVersion57]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject57')._analyticRulecontentId57]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when the Veeam license limit is exceeded.", + "displayName": "License Limit Exceeded", + "enabled": false, + "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24070\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject57').analyticRuleId57,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 57", + "parentId": "[variables('analyticRuleObject57').analyticRuleId57]", + "contentId": "[variables('analyticRuleObject57')._analyticRulecontentId57]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject57').analyticRuleVersion57]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject57')._analyticRulecontentId57]", + "contentKind": "AnalyticsRule", + "displayName": "License Limit Exceeded", + "contentProductId": "[variables('analyticRuleObject57')._analyticRulecontentProductId57]", + "id": "[variables('analyticRuleObject57')._analyticRulecontentProductId57]", + "version": "[variables('analyticRuleObject57').analyticRuleVersion57]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject58').analyticRuleTemplateSpecName58]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "License_Removed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject58').analyticRuleVersion58]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject58')._analyticRulecontentId58]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when the Veeam license is removed from Veeam Backup & Replication.", + "displayName": "License Removed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 24080\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject58').analyticRuleId58,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 58", + "parentId": "[variables('analyticRuleObject58').analyticRuleId58]", + "contentId": "[variables('analyticRuleObject58')._analyticRulecontentId58]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject58').analyticRuleVersion58]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject58')._analyticRulecontentId58]", + "contentKind": "AnalyticsRule", + "displayName": "License Removed", + "contentProductId": "[variables('analyticRuleObject58')._analyticRulecontentProductId58]", + "id": "[variables('analyticRuleObject58')._analyticRulecontentProductId58]", + "version": "[variables('analyticRuleObject58').analyticRuleVersion58]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject59').analyticRuleTemplateSpecName59]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "License_Support_Expired_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject59').analyticRuleVersion59]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject59')._analyticRulecontentId59]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when the Veeam support contract is expired. This might impact backup operations and data protection.", + "displayName": "License Support Expired", + "enabled": false, + "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24050\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject59').analyticRuleId59,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 59", + "parentId": "[variables('analyticRuleObject59').analyticRuleId59]", + "contentId": "[variables('analyticRuleObject59')._analyticRulecontentId59]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject59').analyticRuleVersion59]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject59')._analyticRulecontentId59]", + "contentKind": "AnalyticsRule", + "displayName": "License Support Expired", + "contentProductId": "[variables('analyticRuleObject59')._analyticRulecontentProductId59]", + "id": "[variables('analyticRuleObject59')._analyticRulecontentProductId59]", + "version": "[variables('analyticRuleObject59').analyticRuleVersion59]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject60').analyticRuleTemplateSpecName60]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "License_Support_Expiring_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject60').analyticRuleVersion60]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject60')._analyticRulecontentId60]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when the Veeam support contract expires shortly.", + "displayName": "License Support Expiring", + "enabled": false, + "query": "let license_editions_lookup = union isfuzzy=true (datatable(Edition:string, EditionDescription:string)[]), (_GetWatchlist(\"license_editions_lookup\")); \nlet license_types_lookup = union isfuzzy=true (datatable(Type:string, TypeDescription:string)[]), (_GetWatchlist(\"license_types_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 24040\n| extend Edition = extract(\"Edition=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_editions_lookup) \n on $left.Edition == $right.Edition\n| extend Type = extract(\"Type=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (license_types_lookup) \n on $left.Type == $right.Type\n| extend TenantID = extract(\"TenantID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend DaysLeft = extract(\"DaysLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SupportLeft = extract(\"SupportLeft=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"License Edition\"] = EditionDescription,\n [\"License Type\"] = TypeDescription,\n [\"Days Left\"] = DaysLeft,\n [\"Days of Support Left\"] = SupportLeft,\n MessageDetails = Description,\n Severity = SeverityDescription\n", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject60').analyticRuleId60,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 60", + "parentId": "[variables('analyticRuleObject60').analyticRuleId60]", + "contentId": "[variables('analyticRuleObject60')._analyticRulecontentId60]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject60').analyticRuleVersion60]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject60')._analyticRulecontentId60]", + "contentKind": "AnalyticsRule", + "displayName": "License Support Expiring", + "contentProductId": "[variables('analyticRuleObject60')._analyticRulecontentProductId60]", + "id": "[variables('analyticRuleObject60')._analyticRulecontentProductId60]", + "version": "[variables('analyticRuleObject60').analyticRuleVersion60]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject61').analyticRuleTemplateSpecName61]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Malware_Activity_Detected_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject61').analyticRuleVersion61]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject61')._analyticRulecontentId61]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when restore points marked as suspicious. This might indicate potential compromise of backup data.", + "displayName": "Malware Activity Detected", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 41600\n| extend ActivityType = extract(\"ActivityType=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend MachineDisplayName = extract(\"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\\\\s*\\\\(([^)]+)\\\\)\", 1, Description)\n| extend MachineUuid = extract(\"([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\", 1, Description)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Malware Detection Method\"] = ActivityType,\n MessageDetails = Description,\n Severity = SeverityDescription,\n MachineDisplayName,\n MachineUuid\n", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "MessageDetails": "MessageDetails", + "Date": "Date", + "Severity": "Severity", + "MachineDisplayName": "MachineDisplayName", + "MachineUuid": "MachineUuid", + "VbrHostName": "DataSource", + "EventId": "EventId" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject61').analyticRuleId61,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 61", + "parentId": "[variables('analyticRuleObject61').analyticRuleId61]", + "contentId": "[variables('analyticRuleObject61')._analyticRulecontentId61]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject61').analyticRuleVersion61]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject61')._analyticRulecontentId61]", + "contentKind": "AnalyticsRule", + "displayName": "Malware Activity Detected", + "contentProductId": "[variables('analyticRuleObject61')._analyticRulecontentProductId61]", + "id": "[variables('analyticRuleObject61')._analyticRulecontentProductId61]", + "version": "[variables('analyticRuleObject61').analyticRuleVersion61]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject62').analyticRuleTemplateSpecName62]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Malware_Detection_Exclusions_List_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject62').analyticRuleVersion62]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject62')._analyticRulecontentId62]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when malware detection exclusions are updated. This might indicate potential compromise of backup data.", + "displayName": "Malware Detection Exclusions List Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42280\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription\n| project Date, DataSource, EventId, UserName,MessageDetails,Severity", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject62').analyticRuleId62,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 62", + "parentId": "[variables('analyticRuleObject62').analyticRuleId62]", + "contentId": "[variables('analyticRuleObject62')._analyticRulecontentId62]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject62').analyticRuleVersion62]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject62')._analyticRulecontentId62]", + "contentKind": "AnalyticsRule", + "displayName": "Malware Detection Exclusions List Updated", + "contentProductId": "[variables('analyticRuleObject62')._analyticRulecontentProductId62]", + "id": "[variables('analyticRuleObject62')._analyticRulecontentProductId62]", + "version": "[variables('analyticRuleObject62').analyticRuleVersion62]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject63').analyticRuleTemplateSpecName63]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Malware_Detection_Session_Finished_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject63').analyticRuleVersion63]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject63')._analyticRulecontentId63]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when malware detection session finishes.", + "displayName": "Malware Detection Session Finished", + "enabled": false, + "query": "let action_results_lookup = union isfuzzy=true (datatable(JobResult:string, JobResultMessage:string)[]), (_GetWatchlist(\"action_results_lookup\")); \nVeeam_GetSecurityEvents\n| where instanceId == 42210\n| extend Result = extract(\"Result=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| extend SessionID = extract(\"SessionID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| lookup kind=leftouter (action_results_lookup)\n on $left.Result == $right.JobResult\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Session ID\"] = SessionID,\n [\"StateMessage\"] = JobResultMessage,\n MessageDetails = Description,\n Severity = SeverityDescription\n", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject63').analyticRuleId63,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 63", + "parentId": "[variables('analyticRuleObject63').analyticRuleId63]", + "contentId": "[variables('analyticRuleObject63')._analyticRulecontentId63]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject63').analyticRuleVersion63]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject63')._analyticRulecontentId63]", + "contentKind": "AnalyticsRule", + "displayName": "Malware Detection Session Finished", + "contentProductId": "[variables('analyticRuleObject63')._analyticRulecontentProductId63]", + "id": "[variables('analyticRuleObject63')._analyticRulecontentProductId63]", + "version": "[variables('analyticRuleObject63').analyticRuleVersion63]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject64').analyticRuleTemplateSpecName64]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Malware_Detection_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject64').analyticRuleVersion64]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject64')._analyticRulecontentId64]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when malware detection settings are updated.", + "displayName": "Malware Detection Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42290\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject64').analyticRuleId64,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 64", + "parentId": "[variables('analyticRuleObject64').analyticRuleId64]", + "contentId": "[variables('analyticRuleObject64')._analyticRulecontentId64]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject64').analyticRuleVersion64]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject64')._analyticRulecontentId64]", + "contentKind": "AnalyticsRule", + "displayName": "Malware Detection Settings Updated", + "contentProductId": "[variables('analyticRuleObject64')._analyticRulecontentProductId64]", + "id": "[variables('analyticRuleObject64')._analyticRulecontentProductId64]", + "version": "[variables('analyticRuleObject64').analyticRuleVersion64]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject65').analyticRuleTemplateSpecName65]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Malware_Event_Detected_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject65').analyticRuleVersion65]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject65')._analyticRulecontentId65]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when restore points are marked as infected. This might indicate potential compromise of backup data.", + "displayName": "Malware Event Detected", + "enabled": false, + "query": "VeeamMalwareEvents_CL", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamMalwareEvents_CL" + ] + } + ], + "entityMappings": [ + { + "fieldMappings": [ + { + "columnName": "VbrHostName", + "identifier": "HostName" + } + ], + "entityType": "Host" + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "BackupObjectId": "MachineBackupObjectId", + "VbrHostName": "VbrHostName", + "MachineUuid": "MachineUuid", + "MachineDisplayName": "MachineDisplayName" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject65').analyticRuleId65,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 65", + "parentId": "[variables('analyticRuleObject65').analyticRuleId65]", + "contentId": "[variables('analyticRuleObject65')._analyticRulecontentId65]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject65').analyticRuleVersion65]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject65')._analyticRulecontentId65]", + "contentKind": "AnalyticsRule", + "displayName": "Malware Event Detected", + "contentProductId": "[variables('analyticRuleObject65')._analyticRulecontentProductId65]", + "id": "[variables('analyticRuleObject65')._analyticRulecontentProductId65]", + "version": "[variables('analyticRuleObject65').analyticRuleVersion65]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject66').analyticRuleTemplateSpecName66]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Multi_Factor_Authentication_Disabled_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject66').analyticRuleVersion66]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject66')._analyticRulecontentId66]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when multi-factor authentication is disabled for all users.", + "displayName": "Multi-Factor Authentication Disabled", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 40201\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject66').analyticRuleId66,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 66", + "parentId": "[variables('analyticRuleObject66').analyticRuleId66]", + "contentId": "[variables('analyticRuleObject66')._analyticRulecontentId66]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject66').analyticRuleVersion66]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject66')._analyticRulecontentId66]", + "contentKind": "AnalyticsRule", + "displayName": "Multi-Factor Authentication Disabled", + "contentProductId": "[variables('analyticRuleObject66')._analyticRulecontentProductId66]", + "id": "[variables('analyticRuleObject66')._analyticRulecontentProductId66]", + "version": "[variables('analyticRuleObject66').analyticRuleVersion66]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject67').analyticRuleTemplateSpecName67]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Multi_Factor_Authentication_for_User_Disabled_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject67').analyticRuleVersion67]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject67')._analyticRulecontentId67]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when multi-factor authentication is disabled for a specific user.", + "displayName": "Multi-Factor Authentication for User Disabled", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 40204\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject67').analyticRuleId67,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 67", + "parentId": "[variables('analyticRuleObject67').analyticRuleId67]", + "contentId": "[variables('analyticRuleObject67')._analyticRulecontentId67]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject67').analyticRuleVersion67]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject67')._analyticRulecontentId67]", + "contentKind": "AnalyticsRule", + "displayName": "Multi-Factor Authentication for User Disabled", + "contentProductId": "[variables('analyticRuleObject67')._analyticRulecontentProductId67]", + "id": "[variables('analyticRuleObject67')._analyticRulecontentProductId67]", + "version": "[variables('analyticRuleObject67').analyticRuleVersion67]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject68').analyticRuleTemplateSpecName68]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Multi_Factor_Authentication_Token_Revoked_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject68').analyticRuleVersion68]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject68')._analyticRulecontentId68]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a multi-factor authentication token is revoked.", + "displayName": "Multi-Factor Authentication Token Revoked", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 40202\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject68').analyticRuleId68,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 68", + "parentId": "[variables('analyticRuleObject68').analyticRuleId68]", + "contentId": "[variables('analyticRuleObject68')._analyticRulecontentId68]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject68').analyticRuleVersion68]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject68')._analyticRulecontentId68]", + "contentKind": "AnalyticsRule", + "displayName": "Multi-Factor Authentication Token Revoked", + "contentProductId": "[variables('analyticRuleObject68')._analyticRulecontentProductId68]", + "id": "[variables('analyticRuleObject68')._analyticRulecontentProductId68]", + "version": "[variables('analyticRuleObject68').analyticRuleVersion68]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject69').analyticRuleTemplateSpecName69]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Multi_Factor_Authentication_User_Locked_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject69').analyticRuleVersion69]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject69')._analyticRulecontentId69]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when the allowed number of multi-factor authentication attempts is exceeded for a user.", + "displayName": "Multi-Factor Authentication User Locked", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 40206\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription\n| project Date, DataSource, EventId, UserName,MessageDetails,Severity", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject69').analyticRuleId69,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 69", + "parentId": "[variables('analyticRuleObject69').analyticRuleId69]", + "contentId": "[variables('analyticRuleObject69')._analyticRulecontentId69]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject69').analyticRuleVersion69]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject69')._analyticRulecontentId69]", + "contentKind": "AnalyticsRule", + "displayName": "Multi-Factor Authentication User Locked", + "contentProductId": "[variables('analyticRuleObject69')._analyticRulecontentProductId69]", + "id": "[variables('analyticRuleObject69')._analyticRulecontentProductId69]", + "version": "[variables('analyticRuleObject69').analyticRuleVersion69]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject70').analyticRuleTemplateSpecName70]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "NDMP_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject70').analyticRuleVersion70]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject70')._analyticRulecontentId70]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an NDMP server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "NDMP Server Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 28850\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject70').analyticRuleId70,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 70", + "parentId": "[variables('analyticRuleObject70').analyticRuleId70]", + "contentId": "[variables('analyticRuleObject70')._analyticRulecontentId70]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject70').analyticRuleVersion70]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject70')._analyticRulecontentId70]", + "contentKind": "AnalyticsRule", + "displayName": "NDMP Server Deleted", + "contentProductId": "[variables('analyticRuleObject70')._analyticRulecontentProductId70]", + "id": "[variables('analyticRuleObject70')._analyticRulecontentProductId70]", + "version": "[variables('analyticRuleObject70').analyticRuleVersion70]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject71').analyticRuleTemplateSpecName71]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Object_Marked_as_Clean_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject71').analyticRuleVersion71]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject71')._analyticRulecontentId71]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an object is marked as clean.", + "displayName": "Object Marked as Clean", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 41610\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject71').analyticRuleId71,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 71", + "parentId": "[variables('analyticRuleObject71').analyticRuleId71]", + "contentId": "[variables('analyticRuleObject71')._analyticRulecontentId71]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject71').analyticRuleVersion71]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject71')._analyticRulecontentId71]", + "contentKind": "AnalyticsRule", + "displayName": "Object Marked as Clean", + "contentProductId": "[variables('analyticRuleObject71')._analyticRulecontentProductId71]", + "id": "[variables('analyticRuleObject71')._analyticRulecontentProductId71]", + "version": "[variables('analyticRuleObject71').analyticRuleVersion71]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject72').analyticRuleTemplateSpecName72]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Object_Storage_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject72').analyticRuleVersion72]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject72')._analyticRulecontentId72]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an object storage is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Object Storage Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 28980\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Data SourceName\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject72').analyticRuleId72,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 72", + "parentId": "[variables('analyticRuleObject72').analyticRuleId72]", + "contentId": "[variables('analyticRuleObject72')._analyticRulecontentId72]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject72').analyticRuleVersion72]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject72')._analyticRulecontentId72]", + "contentKind": "AnalyticsRule", + "displayName": "Object Storage Deleted", + "contentProductId": "[variables('analyticRuleObject72')._analyticRulecontentProductId72]", + "id": "[variables('analyticRuleObject72')._analyticRulecontentProductId72]", + "version": "[variables('analyticRuleObject72').analyticRuleVersion72]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject73').analyticRuleTemplateSpecName73]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Object_Storage_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject73').analyticRuleVersion73]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject73')._analyticRulecontentId73]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when object storage settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Object Storage Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 28970\n| extend Name = extract(\"Name=\\\"(?[^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Data SourceName\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject73').analyticRuleId73,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 73", + "parentId": "[variables('analyticRuleObject73').analyticRuleId73]", + "contentId": "[variables('analyticRuleObject73')._analyticRulecontentId73]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject73').analyticRuleVersion73]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject73')._analyticRulecontentId73]", + "contentKind": "AnalyticsRule", + "displayName": "Object Storage Settings Updated", + "contentProductId": "[variables('analyticRuleObject73')._analyticRulecontentProductId73]", + "id": "[variables('analyticRuleObject73')._analyticRulecontentProductId73]", + "version": "[variables('analyticRuleObject73').analyticRuleVersion73]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject74').analyticRuleTemplateSpecName74]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Objects_Added_to_Malware_Detection_Exclusions_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject74').analyticRuleVersion74]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject74')._analyticRulecontentId74]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an object is added to malware detection exclusions.", + "displayName": "Objects Added to Malware Detection Exclusions", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42260\n| extend AddedObjectNames = extract(\"AddedObjectNames=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Object Names\"] = AddedObjectNames,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject74').analyticRuleId74,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 74", + "parentId": "[variables('analyticRuleObject74').analyticRuleId74]", + "contentId": "[variables('analyticRuleObject74')._analyticRulecontentId74]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject74').analyticRuleVersion74]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject74')._analyticRulecontentId74]", + "contentKind": "AnalyticsRule", + "displayName": "Objects Added to Malware Detection Exclusions", + "contentProductId": "[variables('analyticRuleObject74')._analyticRulecontentProductId74]", + "id": "[variables('analyticRuleObject74')._analyticRulecontentProductId74]", + "version": "[variables('analyticRuleObject74').analyticRuleVersion74]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject75').analyticRuleTemplateSpecName75]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Objects_Deleted_from_Malware_Detection_Exclusions_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject75').analyticRuleVersion75]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject75')._analyticRulecontentId75]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an object is deleted from malware detection exclusions.", + "displayName": "Objects Deleted from Malware Detection Exclusions", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42270\n| extend RemovedObjectNames = extract(\"RemovedObjectNames=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Object Names\"] = RemovedObjectNames,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject75').analyticRuleId75,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 75", + "parentId": "[variables('analyticRuleObject75').analyticRuleId75]", + "contentId": "[variables('analyticRuleObject75')._analyticRulecontentId75]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject75').analyticRuleVersion75]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject75')._analyticRulecontentId75]", + "contentKind": "AnalyticsRule", + "displayName": "Objects Deleted from Malware Detection Exclusions", + "contentProductId": "[variables('analyticRuleObject75')._analyticRulecontentProductId75]", + "id": "[variables('analyticRuleObject75')._analyticRulecontentProductId75]", + "version": "[variables('analyticRuleObject75').analyticRuleVersion75]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject76').analyticRuleTemplateSpecName76]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Objects_for_Job_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject76').analyticRuleVersion76]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject76')._analyticRulecontentId76]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when objects are deleted from the job. This might indicate unauthorized removal of critical components.", + "displayName": "Objects for Job Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 32120\n| extend JobName = extract(\"JobName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Job Name\"] = JobName,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject76').analyticRuleId76,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 76", + "parentId": "[variables('analyticRuleObject76').analyticRuleId76]", + "contentId": "[variables('analyticRuleObject76')._analyticRulecontentId76]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject76').analyticRuleVersion76]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject76')._analyticRulecontentId76]", + "contentKind": "AnalyticsRule", + "displayName": "Objects for Job Deleted", + "contentProductId": "[variables('analyticRuleObject76')._analyticRulecontentProductId76]", + "id": "[variables('analyticRuleObject76')._analyticRulecontentProductId76]", + "version": "[variables('analyticRuleObject76').analyticRuleVersion76]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject77').analyticRuleTemplateSpecName77]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Objects_for_Protection_Group_Changed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject77').analyticRuleVersion77]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject77')._analyticRulecontentId77]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when protection group objects are updated.", + "displayName": "Objects for Protection Group Changed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 29140\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject77').analyticRuleId77,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 77", + "parentId": "[variables('analyticRuleObject77').analyticRuleId77]", + "contentId": "[variables('analyticRuleObject77')._analyticRulecontentId77]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject77').analyticRuleVersion77]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject77')._analyticRulecontentId77]", + "contentKind": "AnalyticsRule", + "displayName": "Objects for Protection Group Changed", + "contentProductId": "[variables('analyticRuleObject77')._analyticRulecontentProductId77]", + "id": "[variables('analyticRuleObject77')._analyticRulecontentProductId77]", + "version": "[variables('analyticRuleObject77').analyticRuleVersion77]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject78').analyticRuleTemplateSpecName78]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Objects_for_Protection_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject78').analyticRuleVersion78]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject78')._analyticRulecontentId78]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when objects are deleted from a protection group. This might indicate unauthorized removal of critical components.", + "displayName": "Objects for Protection Group Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 29150\n| extend ProtectionGroupName = extract(\"ProtectionGroupName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Protection Group Name\"] = ProtectionGroupName,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject78').analyticRuleId78,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 78", + "parentId": "[variables('analyticRuleObject78').analyticRuleId78]", + "contentId": "[variables('analyticRuleObject78')._analyticRulecontentId78]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject78').analyticRuleVersion78]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject78')._analyticRulecontentId78]", + "contentKind": "AnalyticsRule", + "displayName": "Objects for Protection Group Deleted", + "contentProductId": "[variables('analyticRuleObject78')._analyticRulecontentProductId78]", + "id": "[variables('analyticRuleObject78')._analyticRulecontentProductId78]", + "version": "[variables('analyticRuleObject78').analyticRuleVersion78]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject79').analyticRuleTemplateSpecName79]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Preferred_Networks_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject79').analyticRuleVersion79]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject79')._analyticRulecontentId79]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a preferred network is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Preferred Networks Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 32800\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject79').analyticRuleId79,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 79", + "parentId": "[variables('analyticRuleObject79').analyticRuleId79]", + "contentId": "[variables('analyticRuleObject79')._analyticRulecontentId79]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject79').analyticRuleVersion79]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject79')._analyticRulecontentId79]", + "contentKind": "AnalyticsRule", + "displayName": "Preferred Networks Deleted", + "contentProductId": "[variables('analyticRuleObject79')._analyticRulecontentProductId79]", + "id": "[variables('analyticRuleObject79')._analyticRulecontentProductId79]", + "version": "[variables('analyticRuleObject79').analyticRuleVersion79]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject80').analyticRuleTemplateSpecName80]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Protection_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject80').analyticRuleVersion80]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject80')._analyticRulecontentId80]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a protection group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Protection Group Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 29120\n| extend ProtectionGroupName = extract(\"ProtectionGroupName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Protection Group Name\"] = ProtectionGroupName,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject80').analyticRuleId80,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 80", + "parentId": "[variables('analyticRuleObject80').analyticRuleId80]", + "contentId": "[variables('analyticRuleObject80')._analyticRulecontentId80]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject80').analyticRuleVersion80]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject80')._analyticRulecontentId80]", + "contentKind": "AnalyticsRule", + "displayName": "Protection Group Deleted", + "contentProductId": "[variables('analyticRuleObject80')._analyticRulecontentProductId80]", + "id": "[variables('analyticRuleObject80')._analyticRulecontentProductId80]", + "version": "[variables('analyticRuleObject80').analyticRuleVersion80]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject81').analyticRuleTemplateSpecName81]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Protection_Group_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject81').analyticRuleVersion81]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject81')._analyticRulecontentId81]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when protection group settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Protection Group Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 29110\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject81').analyticRuleId81,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 81", + "parentId": "[variables('analyticRuleObject81').analyticRuleId81]", + "contentId": "[variables('analyticRuleObject81')._analyticRulecontentId81]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject81').analyticRuleVersion81]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject81')._analyticRulecontentId81]", + "contentKind": "AnalyticsRule", + "displayName": "Protection Group Settings Updated", + "contentProductId": "[variables('analyticRuleObject81')._analyticRulecontentProductId81]", + "id": "[variables('analyticRuleObject81')._analyticRulecontentProductId81]", + "version": "[variables('analyticRuleObject81').analyticRuleVersion81]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject82').analyticRuleTemplateSpecName82]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Recovery_Token_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject82').analyticRuleVersion82]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject82')._analyticRulecontentId82]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a recovery token is deleted. This might indicate unauthorized removal of critical components.", + "displayName": "Recovery Token Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 36013\n| extend TokenID = extract(\"TokenID=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Token ID\"] = TokenID,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject82').analyticRuleId82,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 82", + "parentId": "[variables('analyticRuleObject82').analyticRuleId82]", + "contentId": "[variables('analyticRuleObject82')._analyticRulecontentId82]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject82').analyticRuleVersion82]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject82')._analyticRulecontentId82]", + "contentKind": "AnalyticsRule", + "displayName": "Recovery Token Deleted", + "contentProductId": "[variables('analyticRuleObject82')._analyticRulecontentProductId82]", + "id": "[variables('analyticRuleObject82')._analyticRulecontentProductId82]", + "version": "[variables('analyticRuleObject82').analyticRuleVersion82]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject83').analyticRuleTemplateSpecName83]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Restore_Point_Marked_as_Clean_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject83').analyticRuleVersion83]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject83')._analyticRulecontentId83]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a restore point is marked as clean.", + "displayName": "Restore Point Marked as Clean", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42230\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject83').analyticRuleId83,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 83", + "parentId": "[variables('analyticRuleObject83').analyticRuleId83]", + "contentId": "[variables('analyticRuleObject83')._analyticRulecontentId83]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject83').analyticRuleVersion83]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject83')._analyticRulecontentId83]", + "contentKind": "AnalyticsRule", + "displayName": "Restore Point Marked as Clean", + "contentProductId": "[variables('analyticRuleObject83')._analyticRulecontentProductId83]", + "id": "[variables('analyticRuleObject83')._analyticRulecontentProductId83]", + "version": "[variables('analyticRuleObject83').analyticRuleVersion83]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject84').analyticRuleTemplateSpecName84]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Restore_Point_Marked_as_Infected_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject84').analyticRuleVersion84]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject84')._analyticRulecontentId84]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a restore point is marked as infected.", + "displayName": "Restore Point Marked as Infected", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 42220\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject84').analyticRuleId84,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 84", + "parentId": "[variables('analyticRuleObject84').analyticRuleId84]", + "contentId": "[variables('analyticRuleObject84')._analyticRulecontentId84]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject84').analyticRuleVersion84]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject84')._analyticRulecontentId84]", + "contentKind": "AnalyticsRule", + "displayName": "Restore Point Marked as Infected", + "contentProductId": "[variables('analyticRuleObject84')._analyticRulecontentProductId84]", + "id": "[variables('analyticRuleObject84')._analyticRulecontentProductId84]", + "version": "[variables('analyticRuleObject84').analyticRuleVersion84]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject85').analyticRuleTemplateSpecName85]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Scale_Out_Backup_Repository_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject85').analyticRuleVersion85]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject85')._analyticRulecontentId85]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a scale-out backup repository is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Scale-Out Backup Repository Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 30200\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject85').analyticRuleId85,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 85", + "parentId": "[variables('analyticRuleObject85').analyticRuleId85]", + "contentId": "[variables('analyticRuleObject85')._analyticRulecontentId85]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject85').analyticRuleVersion85]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject85')._analyticRulecontentId85]", + "contentKind": "AnalyticsRule", + "displayName": "Scale-Out Backup Repository Deleted", + "contentProductId": "[variables('analyticRuleObject85')._analyticRulecontentProductId85]", + "id": "[variables('analyticRuleObject85')._analyticRulecontentProductId85]", + "version": "[variables('analyticRuleObject85').analyticRuleVersion85]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject86').analyticRuleTemplateSpecName86]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Scale_Out_Backup_Repository_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject86').analyticRuleVersion86]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject86')._analyticRulecontentId86]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when scale-out backup repository settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Scale-Out Backup Repository Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 30100\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject86').analyticRuleId86,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 86", + "parentId": "[variables('analyticRuleObject86').analyticRuleId86]", + "contentId": "[variables('analyticRuleObject86')._analyticRulecontentId86]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject86').analyticRuleVersion86]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject86')._analyticRulecontentId86]", + "contentKind": "AnalyticsRule", + "displayName": "Scale-Out Backup Repository Settings Updated", + "contentProductId": "[variables('analyticRuleObject86')._analyticRulecontentProductId86]", + "id": "[variables('analyticRuleObject86')._analyticRulecontentProductId86]", + "version": "[variables('analyticRuleObject86').analyticRuleVersion86]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject87').analyticRuleTemplateSpecName87]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Service_Provider_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject87').analyticRuleVersion87]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject87')._analyticRulecontentId87]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a service provider is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Service Provider Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 27600\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject87').analyticRuleId87,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 87", + "parentId": "[variables('analyticRuleObject87').analyticRuleId87]", + "contentId": "[variables('analyticRuleObject87')._analyticRulecontentId87]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject87').analyticRuleVersion87]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject87')._analyticRulecontentId87]", + "contentKind": "AnalyticsRule", + "displayName": "Service Provider Deleted", + "contentProductId": "[variables('analyticRuleObject87')._analyticRulecontentProductId87]", + "id": "[variables('analyticRuleObject87')._analyticRulecontentProductId87]", + "version": "[variables('analyticRuleObject87').analyticRuleVersion87]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject88').analyticRuleTemplateSpecName88]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Service_Provider_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject88').analyticRuleVersion88]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject88')._analyticRulecontentId88]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when service provider settings are updated in Veeam Backup & Replication.", + "displayName": "Service Provider Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 27500\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject88').analyticRuleId88,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 88", + "parentId": "[variables('analyticRuleObject88').analyticRuleId88]", + "contentId": "[variables('analyticRuleObject88')._analyticRulecontentId88]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject88').analyticRuleVersion88]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject88')._analyticRulecontentId88]", + "contentKind": "AnalyticsRule", + "displayName": "Service Provider Updated", + "contentProductId": "[variables('analyticRuleObject88')._analyticRulecontentProductId88]", + "id": "[variables('analyticRuleObject88')._analyticRulecontentProductId88]", + "version": "[variables('analyticRuleObject88').analyticRuleVersion88]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject89').analyticRuleTemplateSpecName89]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "SSH_Credentials_Changed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject89').analyticRuleVersion89]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject89')._analyticRulecontentId89]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when SSH credentials are updated.", + "displayName": "SSH Credentials Changed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 31900\n| extend RelatedCredsName = extract(\"RelatedCredsName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Credential Record\"] = RelatedCredsName,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject89').analyticRuleId89,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 89", + "parentId": "[variables('analyticRuleObject89').analyticRuleId89]", + "contentId": "[variables('analyticRuleObject89')._analyticRulecontentId89]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject89').analyticRuleVersion89]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject89')._analyticRulecontentId89]", + "contentKind": "AnalyticsRule", + "displayName": "SSH Credentials Changed", + "contentProductId": "[variables('analyticRuleObject89')._analyticRulecontentProductId89]", + "id": "[variables('analyticRuleObject89')._analyticRulecontentProductId89]", + "version": "[variables('analyticRuleObject89').analyticRuleVersion89]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject90').analyticRuleTemplateSpecName90]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Storage_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject90').analyticRuleVersion90]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject90')._analyticRulecontentId90]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when storage is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Storage Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 41402\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n [\"Object Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject90').analyticRuleId90,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 90", + "parentId": "[variables('analyticRuleObject90').analyticRuleId90]", + "contentId": "[variables('analyticRuleObject90')._analyticRulecontentId90]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject90').analyticRuleVersion90]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject90')._analyticRulecontentId90]", + "contentKind": "AnalyticsRule", + "displayName": "Storage Deleted", + "contentProductId": "[variables('analyticRuleObject90')._analyticRulecontentProductId90]", + "id": "[variables('analyticRuleObject90')._analyticRulecontentProductId90]", + "version": "[variables('analyticRuleObject90').analyticRuleVersion90]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject91').analyticRuleTemplateSpecName91]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Storage_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject91').analyticRuleVersion91]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject91')._analyticRulecontentId91]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when storage settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Storage Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 41401\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject91').analyticRuleId91,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 91", + "parentId": "[variables('analyticRuleObject91').analyticRuleId91]", + "contentId": "[variables('analyticRuleObject91')._analyticRulecontentId91]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject91').analyticRuleVersion91]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject91')._analyticRulecontentId91]", + "contentKind": "AnalyticsRule", + "displayName": "Storage Settings Updated", + "contentProductId": "[variables('analyticRuleObject91')._analyticRulecontentProductId91]", + "id": "[variables('analyticRuleObject91')._analyticRulecontentProductId91]", + "version": "[variables('analyticRuleObject91').analyticRuleVersion91]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject92').analyticRuleTemplateSpecName92]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Subtenant_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject92').analyticRuleVersion92]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject92')._analyticRulecontentId92]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a subtenant is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Subtenant Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 25210\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject92').analyticRuleId92,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 92", + "parentId": "[variables('analyticRuleObject92').analyticRuleId92]", + "contentId": "[variables('analyticRuleObject92')._analyticRulecontentId92]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject92').analyticRuleVersion92]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject92')._analyticRulecontentId92]", + "contentKind": "AnalyticsRule", + "displayName": "Subtenant Deleted", + "contentProductId": "[variables('analyticRuleObject92')._analyticRulecontentProductId92]", + "id": "[variables('analyticRuleObject92')._analyticRulecontentProductId92]", + "version": "[variables('analyticRuleObject92').analyticRuleVersion92]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject93').analyticRuleTemplateSpecName93]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Subtenant_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject93').analyticRuleVersion93]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject93')._analyticRulecontentId93]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when subtenant settings are updated in Veeam Backup & Replication.", + "displayName": "Subtenant Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 25220\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject93').analyticRuleId93,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 93", + "parentId": "[variables('analyticRuleObject93').analyticRuleId93]", + "contentId": "[variables('analyticRuleObject93')._analyticRulecontentId93]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject93').analyticRuleVersion93]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject93')._analyticRulecontentId93]", + "contentKind": "AnalyticsRule", + "displayName": "Subtenant Updated", + "contentProductId": "[variables('analyticRuleObject93')._analyticRulecontentProductId93]", + "id": "[variables('analyticRuleObject93')._analyticRulecontentProductId93]", + "version": "[variables('analyticRuleObject93').analyticRuleVersion93]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject94').analyticRuleTemplateSpecName94]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "SureBackup_Job_Failed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject94').analyticRuleVersion94]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject94')._analyticRulecontentId94]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects failed SureBackup job operations. This might indicate malware issues, storage problems, or potential sabotage of backup infrastructure.", + "displayName": "SureBackup Job Failed", + "enabled": false, + "query": "Veeam_GetJobFinished\n| where instanceId == 390\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"StateMessage\"] = JobTypeDescription,\n [\"State\"] = JobResultMessage,\n Severity = Severity,\n MessageDetails = Description", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject94').analyticRuleId94,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 94", + "parentId": "[variables('analyticRuleObject94').analyticRuleId94]", + "contentId": "[variables('analyticRuleObject94')._analyticRulecontentId94]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject94').analyticRuleVersion94]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject94')._analyticRulecontentId94]", + "contentKind": "AnalyticsRule", + "displayName": "SureBackup Job Failed", + "contentProductId": "[variables('analyticRuleObject94')._analyticRulecontentProductId94]", + "id": "[variables('analyticRuleObject94')._analyticRulecontentProductId94]", + "version": "[variables('analyticRuleObject94').analyticRuleVersion94]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject95').analyticRuleTemplateSpecName95]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tape_Erase_Job_Started_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject95').analyticRuleVersion95]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject95')._analyticRulecontentId95]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when tape erase operations start. This might indicate data destruction activity.", + "displayName": "Tape Erase Job Started", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 115\n| extend JobName = extract(\"JobName=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"Job Name\"] = JobName,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject95').analyticRuleId95,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 95", + "parentId": "[variables('analyticRuleObject95').analyticRuleId95]", + "contentId": "[variables('analyticRuleObject95')._analyticRulecontentId95]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject95').analyticRuleVersion95]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject95')._analyticRulecontentId95]", + "contentKind": "AnalyticsRule", + "displayName": "Tape Erase Job Started", + "contentProductId": "[variables('analyticRuleObject95')._analyticRulecontentProductId95]", + "id": "[variables('analyticRuleObject95')._analyticRulecontentProductId95]", + "version": "[variables('analyticRuleObject95').analyticRuleVersion95]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject96').analyticRuleTemplateSpecName96]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tape_Library_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject96').analyticRuleVersion96]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject96')._analyticRulecontentId96]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a tape library is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Tape Library Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 23633\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject96').analyticRuleId96,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 96", + "parentId": "[variables('analyticRuleObject96').analyticRuleId96]", + "contentId": "[variables('analyticRuleObject96')._analyticRulecontentId96]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject96').analyticRuleVersion96]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject96')._analyticRulecontentId96]", + "contentKind": "AnalyticsRule", + "displayName": "Tape Library Deleted", + "contentProductId": "[variables('analyticRuleObject96')._analyticRulecontentProductId96]", + "id": "[variables('analyticRuleObject96')._analyticRulecontentProductId96]", + "version": "[variables('analyticRuleObject96').analyticRuleVersion96]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject97').analyticRuleTemplateSpecName97]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tape_Media_Pool_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject97').analyticRuleVersion97]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject97')._analyticRulecontentId97]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a tape media pool is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Tape Media Pool Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 23630\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject97').analyticRuleId97,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 97", + "parentId": "[variables('analyticRuleObject97').analyticRuleId97]", + "contentId": "[variables('analyticRuleObject97')._analyticRulecontentId97]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject97').analyticRuleVersion97]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject97')._analyticRulecontentId97]", + "contentKind": "AnalyticsRule", + "displayName": "Tape Media Pool Deleted", + "contentProductId": "[variables('analyticRuleObject97')._analyticRulecontentProductId97]", + "id": "[variables('analyticRuleObject97')._analyticRulecontentProductId97]", + "version": "[variables('analyticRuleObject97').analyticRuleVersion97]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject98').analyticRuleTemplateSpecName98]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tape_Media_Vault_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject98').analyticRuleVersion98]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject98')._analyticRulecontentId98]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a tape media vault is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Tape Media Vault Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 23631\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject98').analyticRuleId98,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 98", + "parentId": "[variables('analyticRuleObject98').analyticRuleId98]", + "contentId": "[variables('analyticRuleObject98')._analyticRulecontentId98]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject98').analyticRuleVersion98]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject98')._analyticRulecontentId98]", + "contentKind": "AnalyticsRule", + "displayName": "Tape Media Vault Deleted", + "contentProductId": "[variables('analyticRuleObject98')._analyticRulecontentProductId98]", + "id": "[variables('analyticRuleObject98')._analyticRulecontentProductId98]", + "version": "[variables('analyticRuleObject98').analyticRuleVersion98]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject99').analyticRuleTemplateSpecName99]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tape_Medium_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject99').analyticRuleVersion99]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject99')._analyticRulecontentId99]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a tape medium is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Tape Medium Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 23632\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject99').analyticRuleId99,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 99", + "parentId": "[variables('analyticRuleObject99').analyticRuleId99]", + "contentId": "[variables('analyticRuleObject99')._analyticRulecontentId99]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject99').analyticRuleVersion99]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject99')._analyticRulecontentId99]", + "contentKind": "AnalyticsRule", + "displayName": "Tape Medium Deleted", + "contentProductId": "[variables('analyticRuleObject99')._analyticRulecontentProductId99]", + "id": "[variables('analyticRuleObject99')._analyticRulecontentProductId99]", + "version": "[variables('analyticRuleObject99').analyticRuleVersion99]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject100').analyticRuleTemplateSpecName100]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tape_Server_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject100').analyticRuleVersion100]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject100')._analyticRulecontentId100]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a tape server is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Tape Server Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 28800\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject100').analyticRuleId100,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 100", + "parentId": "[variables('analyticRuleObject100').analyticRuleId100]", + "contentId": "[variables('analyticRuleObject100')._analyticRulecontentId100]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject100').analyticRuleVersion100]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject100')._analyticRulecontentId100]", + "contentKind": "AnalyticsRule", + "displayName": "Tape Server Deleted", + "contentProductId": "[variables('analyticRuleObject100')._analyticRulecontentProductId100]", + "id": "[variables('analyticRuleObject100')._analyticRulecontentProductId100]", + "version": "[variables('analyticRuleObject100').analyticRuleVersion100]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject101').analyticRuleTemplateSpecName101]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tenant_Password_Changed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject101').analyticRuleVersion101]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject101')._analyticRulecontentId101]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a tenant password is updated.", + "displayName": "Tenant Password Changed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 24114\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject101').analyticRuleId101,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 101", + "parentId": "[variables('analyticRuleObject101').analyticRuleId101]", + "contentId": "[variables('analyticRuleObject101')._analyticRulecontentId101]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject101').analyticRuleVersion101]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject101')._analyticRulecontentId101]", + "contentKind": "AnalyticsRule", + "displayName": "Tenant Password Changed", + "contentProductId": "[variables('analyticRuleObject101')._analyticRulecontentProductId101]", + "id": "[variables('analyticRuleObject101')._analyticRulecontentProductId101]", + "version": "[variables('analyticRuleObject101').analyticRuleVersion101]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject102').analyticRuleTemplateSpecName102]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tenant_Quota_Changed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject102').analyticRuleVersion102]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject102')._analyticRulecontentId102]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a tenant quota is updated.", + "displayName": "Tenant Quota Changed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 24160\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject102').analyticRuleId102,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 102", + "parentId": "[variables('analyticRuleObject102').analyticRuleId102]", + "contentId": "[variables('analyticRuleObject102')._analyticRulecontentId102]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject102').analyticRuleVersion102]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject102')._analyticRulecontentId102]", + "contentKind": "AnalyticsRule", + "displayName": "Tenant Quota Changed", + "contentProductId": "[variables('analyticRuleObject102')._analyticRulecontentProductId102]", + "id": "[variables('analyticRuleObject102')._analyticRulecontentProductId102]", + "version": "[variables('analyticRuleObject102').analyticRuleVersion102]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject103').analyticRuleTemplateSpecName103]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tenant_Quota_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject103').analyticRuleVersion103]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject103')._analyticRulecontentId103]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a tenant quota is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Tenant Quota Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 24170\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject103').analyticRuleId103,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 103", + "parentId": "[variables('analyticRuleObject103').analyticRuleId103]", + "contentId": "[variables('analyticRuleObject103')._analyticRulecontentId103]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject103').analyticRuleVersion103]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject103')._analyticRulecontentId103]", + "contentKind": "AnalyticsRule", + "displayName": "Tenant Quota Deleted", + "contentProductId": "[variables('analyticRuleObject103')._analyticRulecontentProductId103]", + "id": "[variables('analyticRuleObject103')._analyticRulecontentProductId103]", + "version": "[variables('analyticRuleObject103').analyticRuleVersion103]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject104').analyticRuleTemplateSpecName104]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tenant_Replica_Started_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject104').analyticRuleVersion104]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject104')._analyticRulecontentId104]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a tenant replica starts.", + "displayName": "Tenant Replica Started", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 26800\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject104').analyticRuleId104,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 104", + "parentId": "[variables('analyticRuleObject104').analyticRuleId104]", + "contentId": "[variables('analyticRuleObject104')._analyticRulecontentId104]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject104').analyticRuleVersion104]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject104')._analyticRulecontentId104]", + "contentKind": "AnalyticsRule", + "displayName": "Tenant Replica Started", + "contentProductId": "[variables('analyticRuleObject104')._analyticRulecontentProductId104]", + "id": "[variables('analyticRuleObject104')._analyticRulecontentProductId104]", + "version": "[variables('analyticRuleObject104').analyticRuleVersion104]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject105').analyticRuleTemplateSpecName105]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tenant_Replica_Stopped_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject105').analyticRuleVersion105]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject105')._analyticRulecontentId105]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a tenant replica stops.", + "displayName": "Tenant Replica Stopped", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 26900\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject105').analyticRuleId105,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 105", + "parentId": "[variables('analyticRuleObject105').analyticRuleId105]", + "contentId": "[variables('analyticRuleObject105')._analyticRulecontentId105]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject105').analyticRuleVersion105]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject105')._analyticRulecontentId105]", + "contentKind": "AnalyticsRule", + "displayName": "Tenant Replica Stopped", + "contentProductId": "[variables('analyticRuleObject105')._analyticRulecontentProductId105]", + "id": "[variables('analyticRuleObject105')._analyticRulecontentProductId105]", + "version": "[variables('analyticRuleObject105').analyticRuleVersion105]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject106').analyticRuleTemplateSpecName106]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Tenant_State_Changed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject106').analyticRuleVersion106]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject106')._analyticRulecontentId106]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when tenant state is updated.", + "displayName": "Tenant State Changed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 25000\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject106').analyticRuleId106,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 106", + "parentId": "[variables('analyticRuleObject106').analyticRuleId106]", + "contentId": "[variables('analyticRuleObject106')._analyticRulecontentId106]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject106').analyticRuleVersion106]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject106')._analyticRulecontentId106]", + "contentKind": "AnalyticsRule", + "displayName": "Tenant State Changed", + "contentProductId": "[variables('analyticRuleObject106')._analyticRulecontentProductId106]", + "id": "[variables('analyticRuleObject106')._analyticRulecontentProductId106]", + "version": "[variables('analyticRuleObject106').analyticRuleVersion106]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject107').analyticRuleTemplateSpecName107]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "User_or_Group_Added_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject107').analyticRuleVersion107]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject107')._analyticRulecontentId107]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a user or user group is added to Veeam Backup & Replication.", + "displayName": "User or Group Added", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 31200\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject107').analyticRuleId107,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 107", + "parentId": "[variables('analyticRuleObject107').analyticRuleId107]", + "contentId": "[variables('analyticRuleObject107')._analyticRulecontentId107]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject107').analyticRuleVersion107]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject107')._analyticRulecontentId107]", + "contentKind": "AnalyticsRule", + "displayName": "User or Group Added", + "contentProductId": "[variables('analyticRuleObject107')._analyticRulecontentProductId107]", + "id": "[variables('analyticRuleObject107')._analyticRulecontentProductId107]", + "version": "[variables('analyticRuleObject107').analyticRuleVersion107]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject108').analyticRuleTemplateSpecName108]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "User_or_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject108').analyticRuleVersion108]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject108')._analyticRulecontentId108]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a user or user group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "User or Group Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 31400\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject108').analyticRuleId108,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 108", + "parentId": "[variables('analyticRuleObject108').analyticRuleId108]", + "contentId": "[variables('analyticRuleObject108')._analyticRulecontentId108]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject108').analyticRuleVersion108]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject108')._analyticRulecontentId108]", + "contentKind": "AnalyticsRule", + "displayName": "User or Group Deleted", + "contentProductId": "[variables('analyticRuleObject108')._analyticRulecontentProductId108]", + "id": "[variables('analyticRuleObject108')._analyticRulecontentProductId108]", + "version": "[variables('analyticRuleObject108').analyticRuleVersion108]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject109').analyticRuleTemplateSpecName109]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Best_Practice_Compliance_Check_Not_Passed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject109').analyticRuleVersion109]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject109')._analyticRulecontentId109]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a security best practice does not pass a compliance check in Veeam Security & Compliance Analyzer.", + "displayName": "Best Practice Compliance Check Not Passed", + "enabled": false, + "query": "VeeamSecurityComplianceAnalyzer_CL\r\n| where Status != \"OK\"", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamSecurityComplianceAnalyzer_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Id": "Id", + "Status": "Status", + "BestPracticeName": "BestPractice", + "Note": "Note", + "VbrHostName": "VbrHostName", + "TenantId": "TenantId" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject109').analyticRuleId109,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 109", + "parentId": "[variables('analyticRuleObject109').analyticRuleId109]", + "contentId": "[variables('analyticRuleObject109')._analyticRulecontentId109]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject109').analyticRuleVersion109]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject109')._analyticRulecontentId109]", + "contentKind": "AnalyticsRule", + "displayName": "Best Practice Compliance Check Not Passed", + "contentProductId": "[variables('analyticRuleObject109')._analyticRulecontentProductId109]", + "id": "[variables('analyticRuleObject109')._analyticRulecontentProductId109]", + "version": "[variables('analyticRuleObject109').analyticRuleVersion109]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject110').analyticRuleTemplateSpecName110]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Application_with_no_recent_data_backup_sessions_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject110').analyticRuleVersion110]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject110')._analyticRulecontentId110]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects applications with no recent backup sessions.", + "displayName": "Veeam ONE Application with No Recent Data Backup Sessions", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 391", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject110').analyticRuleId110,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 110", + "parentId": "[variables('analyticRuleObject110').analyticRuleId110]", + "contentId": "[variables('analyticRuleObject110')._analyticRulecontentId110]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject110').analyticRuleVersion110]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject110')._analyticRulecontentId110]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Application with No Recent Data Backup Sessions", + "contentProductId": "[variables('analyticRuleObject110')._analyticRulecontentProductId110]", + "id": "[variables('analyticRuleObject110')._analyticRulecontentProductId110]", + "version": "[variables('analyticRuleObject110').analyticRuleVersion110]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject111').analyticRuleTemplateSpecName111]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Backup_Copy_RPO_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject111').analyticRuleVersion111]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject111')._analyticRulecontentId111]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects Veeam ONE Backup Copy RPO violation alerts.", + "displayName": "Veeam ONE Backup Copy RPO", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 365", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject111').analyticRuleId111,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 111", + "parentId": "[variables('analyticRuleObject111').analyticRuleId111]", + "contentId": "[variables('analyticRuleObject111')._analyticRulecontentId111]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject111').analyticRuleVersion111]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject111')._analyticRulecontentId111]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Backup Copy RPO", + "contentProductId": "[variables('analyticRuleObject111')._analyticRulecontentProductId111]", + "id": "[variables('analyticRuleObject111')._analyticRulecontentProductId111]", + "version": "[variables('analyticRuleObject111').analyticRuleVersion111]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject112').analyticRuleTemplateSpecName112]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Backup_server_security_&_compliance_state_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject112').analyticRuleVersion112]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject112')._analyticRulecontentId112]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects backup server security and compliance state issues.", + "displayName": "Veeam ONE Backup Server Security and Compliance State", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 395", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject112').analyticRuleId112,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 112", + "parentId": "[variables('analyticRuleObject112').analyticRuleId112]", + "contentId": "[variables('analyticRuleObject112')._analyticRulecontentId112]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject112').analyticRuleVersion112]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject112')._analyticRulecontentId112]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Backup Server Security and Compliance State", + "contentProductId": "[variables('analyticRuleObject112')._analyticRulecontentProductId112]", + "id": "[variables('analyticRuleObject112')._analyticRulecontentProductId112]", + "version": "[variables('analyticRuleObject112').analyticRuleVersion112]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject113').analyticRuleTemplateSpecName113]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Computer_with_no_backup_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject113').analyticRuleVersion113]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject113')._analyticRulecontentId113]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects computers with no backup.", + "displayName": "Veeam ONE Computer with No Backup", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 370", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject113').analyticRuleId113,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 113", + "parentId": "[variables('analyticRuleObject113').analyticRuleId113]", + "contentId": "[variables('analyticRuleObject113')._analyticRulecontentId113]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject113').analyticRuleVersion113]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject113')._analyticRulecontentId113]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Computer with No Backup", + "contentProductId": "[variables('analyticRuleObject113')._analyticRulecontentProductId113]", + "id": "[variables('analyticRuleObject113')._analyticRulecontentProductId113]", + "version": "[variables('analyticRuleObject113').analyticRuleVersion113]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject114').analyticRuleTemplateSpecName114]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Immutability_change_tracking_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject114').analyticRuleVersion114]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject114')._analyticRulecontentId114]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects changes in Veeam ONE immutability tracking configuration.", + "displayName": "Veeam ONE Immutability Change Tracking", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 377", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject114').analyticRuleId114,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 114", + "parentId": "[variables('analyticRuleObject114').analyticRuleId114]", + "contentId": "[variables('analyticRuleObject114')._analyticRulecontentId114]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject114').analyticRuleVersion114]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject114')._analyticRulecontentId114]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Immutability Change Tracking", + "contentProductId": "[variables('analyticRuleObject114')._analyticRulecontentProductId114]", + "id": "[variables('analyticRuleObject114')._analyticRulecontentProductId114]", + "version": "[variables('analyticRuleObject114').analyticRuleVersion114]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject115').analyticRuleTemplateSpecName115]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Immutability_state_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject115').analyticRuleVersion115]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject115')._analyticRulecontentId115]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects changes in the immutability state of Veeam Backup & Replication repositories. This might indicate configuration changes that require review.", + "displayName": "Veeam ONE Immutability State", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 376", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject115').analyticRuleId115,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 115", + "parentId": "[variables('analyticRuleObject115').analyticRuleId115]", + "contentId": "[variables('analyticRuleObject115')._analyticRulecontentId115]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject115').analyticRuleVersion115]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject115')._analyticRulecontentId115]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Immutability State", + "contentProductId": "[variables('analyticRuleObject115')._analyticRulecontentProductId115]", + "id": "[variables('analyticRuleObject115')._analyticRulecontentProductId115]", + "version": "[variables('analyticRuleObject115').analyticRuleVersion115]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject116').analyticRuleTemplateSpecName116]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Job_disabled_Veeam_Backup_for_Microsoft_365_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject116').analyticRuleVersion116]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject116')._analyticRulecontentId116]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when Veeam Backup for Microsoft 365 jobs are disabled.", + "displayName": "Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 378", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject116').analyticRuleId116,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 116", + "parentId": "[variables('analyticRuleObject116').analyticRuleId116]", + "contentId": "[variables('analyticRuleObject116')._analyticRulecontentId116]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject116').analyticRuleVersion116]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject116')._analyticRulecontentId116]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)", + "contentProductId": "[variables('analyticRuleObject116')._analyticRulecontentProductId116]", + "id": "[variables('analyticRuleObject116')._analyticRulecontentProductId116]", + "version": "[variables('analyticRuleObject116').analyticRuleVersion116]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject117').analyticRuleTemplateSpecName117]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Job_disabled_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject117').analyticRuleVersion117]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject117')._analyticRulecontentId117]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a Veeam ONE job is disabled.", + "displayName": "Veeam ONE Job Disabled", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 316", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject117').analyticRuleId117,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 117", + "parentId": "[variables('analyticRuleObject117').analyticRuleId117]", + "contentId": "[variables('analyticRuleObject117')._analyticRulecontentId117]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject117').analyticRuleVersion117]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject117')._analyticRulecontentId117]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Job Disabled", + "contentProductId": "[variables('analyticRuleObject117')._analyticRulecontentProductId117]", + "id": "[variables('analyticRuleObject117')._analyticRulecontentProductId117]", + "version": "[variables('analyticRuleObject117').analyticRuleVersion117]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject118').analyticRuleTemplateSpecName118]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Possible_ransomware_activity_Hyper_V_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject118').analyticRuleVersion118]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject118')._analyticRulecontentId118]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects Veeam ONE possible ransomware activity alerts for Microsoft Hyper-V.", + "displayName": "Veeam ONE Possible Ransomware Activity (Hyper-V)", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 344", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject118').analyticRuleId118,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 118", + "parentId": "[variables('analyticRuleObject118').analyticRuleId118]", + "contentId": "[variables('analyticRuleObject118')._analyticRulecontentId118]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject118').analyticRuleVersion118]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject118')._analyticRulecontentId118]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Possible Ransomware Activity (Hyper-V)", + "contentProductId": "[variables('analyticRuleObject118')._analyticRulecontentProductId118]", + "id": "[variables('analyticRuleObject118')._analyticRulecontentProductId118]", + "version": "[variables('analyticRuleObject118').analyticRuleVersion118]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject119').analyticRuleTemplateSpecName119]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Possible_ransomware_activity_vSphere_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject119').analyticRuleVersion119]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject119')._analyticRulecontentId119]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects Veeam ONE possible ransomware activity alerts for VMware vSphere.", + "displayName": "Veeam ONE Possible Ransomware Activity (vSphere)", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 342", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject119').analyticRuleId119,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 119", + "parentId": "[variables('analyticRuleObject119').analyticRuleId119]", + "contentId": "[variables('analyticRuleObject119')._analyticRulecontentId119]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject119').analyticRuleVersion119]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject119')._analyticRulecontentId119]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Possible Ransomware Activity (vSphere)", + "contentProductId": "[variables('analyticRuleObject119')._analyticRulecontentProductId119]", + "id": "[variables('analyticRuleObject119')._analyticRulecontentProductId119]", + "version": "[variables('analyticRuleObject119').analyticRuleVersion119]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject120').analyticRuleTemplateSpecName120]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Suspicious_incremental_backup_size_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject120').analyticRuleVersion120]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject120')._analyticRulecontentId120]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects suspiciously large incremental backup sizes.", + "displayName": "Veeam ONE Suspicious Incremental Backup Size", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 364", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject120').analyticRuleId120,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 120", + "parentId": "[variables('analyticRuleObject120').analyticRuleId120]", + "contentId": "[variables('analyticRuleObject120')._analyticRulecontentId120]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject120').analyticRuleVersion120]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject120')._analyticRulecontentId120]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Suspicious Incremental Backup Size", + "contentProductId": "[variables('analyticRuleObject120')._analyticRulecontentProductId120]", + "id": "[variables('analyticRuleObject120')._analyticRulecontentProductId120]", + "version": "[variables('analyticRuleObject120').analyticRuleVersion120]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject121').analyticRuleTemplateSpecName121]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Unusual_job_duration_Veeam_Backup_for_Microsoft_365_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject121').analyticRuleVersion121]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject121')._analyticRulecontentId121]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects Veeam Backup for Microsoft 365 jobs with unusual execution duration.", + "displayName": "Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 381", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject121').analyticRuleId121,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 121", + "parentId": "[variables('analyticRuleObject121').analyticRuleId121]", + "contentId": "[variables('analyticRuleObject121')._analyticRulecontentId121]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject121').analyticRuleVersion121]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject121')._analyticRulecontentId121]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)", + "contentProductId": "[variables('analyticRuleObject121')._analyticRulecontentProductId121]", + "id": "[variables('analyticRuleObject121')._analyticRulecontentProductId121]", + "version": "[variables('analyticRuleObject121').analyticRuleVersion121]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject122').analyticRuleTemplateSpecName122]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Unusual_job_duration_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject122').analyticRuleVersion122]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject122')._analyticRulecontentId122]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects Veeam ONE unusual job duration alerts.", + "displayName": "Veeam ONE Unusual Job Duration", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 369", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject122').analyticRuleId122,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 122", + "parentId": "[variables('analyticRuleObject122').analyticRuleId122]", + "contentId": "[variables('analyticRuleObject122')._analyticRulecontentId122]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject122').analyticRuleVersion122]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject122')._analyticRulecontentId122]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Unusual Job Duration", + "contentProductId": "[variables('analyticRuleObject122')._analyticRulecontentProductId122]", + "id": "[variables('analyticRuleObject122')._analyticRulecontentProductId122]", + "version": "[variables('analyticRuleObject122').analyticRuleVersion122]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject123').analyticRuleTemplateSpecName123]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_Veeam_malware_detection_change_tracking_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject123').analyticRuleVersion123]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject123')._analyticRulecontentId123]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects changes in Veeam ONE malware detection tracking.", + "displayName": "Veeam ONE Malware Detection Change Tracking", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 403", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject123').analyticRuleId123,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 123", + "parentId": "[variables('analyticRuleObject123').analyticRuleId123]", + "contentId": "[variables('analyticRuleObject123')._analyticRulecontentId123]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject123').analyticRuleVersion123]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject123')._analyticRulecontentId123]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE Malware Detection Change Tracking", + "contentProductId": "[variables('analyticRuleObject123')._analyticRulecontentProductId123]", + "id": "[variables('analyticRuleObject123')._analyticRulecontentProductId123]", + "version": "[variables('analyticRuleObject123').analyticRuleVersion123]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject124').analyticRuleTemplateSpecName124]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_VM_with_no_backup_Hyper_V_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject124').analyticRuleVersion124]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject124')._analyticRulecontentId124]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects Veeam ONE VMs with no backup (Hyper-V).", + "displayName": "Veeam ONE VM with No Backup (Hyper-V)", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 315", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject124').analyticRuleId124,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 124", + "parentId": "[variables('analyticRuleObject124').analyticRuleId124]", + "contentId": "[variables('analyticRuleObject124')._analyticRulecontentId124]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject124').analyticRuleVersion124]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject124')._analyticRulecontentId124]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE VM with No Backup (Hyper-V)", + "contentProductId": "[variables('analyticRuleObject124')._analyticRulecontentProductId124]", + "id": "[variables('analyticRuleObject124')._analyticRulecontentProductId124]", + "version": "[variables('analyticRuleObject124').analyticRuleVersion124]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject125').analyticRuleTemplateSpecName125]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_VM_with_no_backup_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject125').analyticRuleVersion125]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject125')._analyticRulecontentId125]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects Veeam ONE VMs with no backup.", + "displayName": "Veeam ONE VM with No Backup", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 314", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject125').analyticRuleId125,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 125", + "parentId": "[variables('analyticRuleObject125').analyticRuleId125]", + "contentId": "[variables('analyticRuleObject125')._analyticRulecontentId125]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject125').analyticRuleVersion125]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject125')._analyticRulecontentId125]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE VM with No Backup", + "contentProductId": "[variables('analyticRuleObject125')._analyticRulecontentProductId125]", + "id": "[variables('analyticRuleObject125')._analyticRulecontentProductId125]", + "version": "[variables('analyticRuleObject125').analyticRuleVersion125]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject126').analyticRuleTemplateSpecName126]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_VM_with_no_replica_Hyper_V_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject126').analyticRuleVersion126]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject126')._analyticRulecontentId126]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects Hyper-V VMs with no replica configured.", + "displayName": "Veeam ONE VM with No Replica (Hyper-V)", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 332", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject126').analyticRuleId126,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 126", + "parentId": "[variables('analyticRuleObject126').analyticRuleId126]", + "contentId": "[variables('analyticRuleObject126')._analyticRulecontentId126]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject126').analyticRuleVersion126]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject126')._analyticRulecontentId126]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE VM with No Replica (Hyper-V)", + "contentProductId": "[variables('analyticRuleObject126')._analyticRulecontentProductId126]", + "id": "[variables('analyticRuleObject126')._analyticRulecontentProductId126]", + "version": "[variables('analyticRuleObject126').analyticRuleVersion126]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject127').analyticRuleTemplateSpecName127]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Veeam_One_VM_with_no_replica_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject127').analyticRuleVersion127]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject127')._analyticRulecontentId127]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects Veeam ONE VMs with no replica configuration.", + "displayName": "Veeam ONE VM with No Replica", + "enabled": false, + "query": "VeeamOneTriggeredAlarms_CL | where PredefinedAlarmId == 331", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamOneTriggeredAlarms_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "ObjectType": "ObjectType", + "ObjectName": "ObjectName", + "TriggeredTime": "TriggeredTime", + "Name": "Name", + "Status": "Status", + "Comment": "Comment", + "PredefinedAlarmId": "PredefinedAlarmId", + "ObjectId": "ObjectId", + "TriggeredAlarmId": "TriggeredAlarmId", + "VoneHostName": "VoneHostName", + "Description": "Description" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject127').analyticRuleId127,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 127", + "parentId": "[variables('analyticRuleObject127').analyticRuleId127]", + "contentId": "[variables('analyticRuleObject127')._analyticRulecontentId127]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject127').analyticRuleVersion127]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject127')._analyticRulecontentId127]", + "contentKind": "AnalyticsRule", + "displayName": "Veeam ONE VM with No Replica", + "contentProductId": "[variables('analyticRuleObject127')._analyticRulecontentProductId127]", + "id": "[variables('analyticRuleObject127')._analyticRulecontentProductId127]", + "version": "[variables('analyticRuleObject127').analyticRuleVersion127]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject128').analyticRuleTemplateSpecName128]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Virtual_Lab_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject128').analyticRuleVersion128]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject128')._analyticRulecontentId128]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a virtual lab is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Virtual Lab Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 30800\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject128').analyticRuleId128,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 128", + "parentId": "[variables('analyticRuleObject128').analyticRuleId128]", + "contentId": "[variables('analyticRuleObject128')._analyticRulecontentId128]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject128').analyticRuleVersion128]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject128')._analyticRulecontentId128]", + "contentKind": "AnalyticsRule", + "displayName": "Virtual Lab Deleted", + "contentProductId": "[variables('analyticRuleObject128')._analyticRulecontentProductId128]", + "id": "[variables('analyticRuleObject128')._analyticRulecontentProductId128]", + "version": "[variables('analyticRuleObject128').analyticRuleVersion128]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject129').analyticRuleTemplateSpecName129]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Virtual_Lab_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject129').analyticRuleVersion129]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject129')._analyticRulecontentId129]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when virtual lab settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "Virtual Lab Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 30700\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" }, - "parameters": { - "$connections": { - "value": { - "azuresentinel": { - "connectionName": "[[parameters('AzureSentinelConnectionName')]", - "connectionId": "[[resourceId('Microsoft.Web/connections', parameters('AzureSentinelConnectionName'))]", - "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", - "connectionProperties": { - "authentication": { - "type": "ManagedServiceIdentity" - } - } - } - } - } + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId15'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject129').analyticRuleId129,'/'))))]", "properties": { - "parentId": "[variables('playbookId15')]", - "contentId": "[variables('_playbookContentId15')]", - "kind": "Playbook", - "version": "[variables('playbookVersion15')]", + "description": "Veeam Analytics Rule 129", + "parentId": "[variables('analyticRuleObject129').analyticRuleId129]", + "contentId": "[variables('analyticRuleObject129')._analyticRulecontentId129]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject129').analyticRuleVersion129]", "source": { "kind": "Solution", "name": "Veeam", @@ -9413,622 +26466,1378 @@ } } } - ], - "metadata": { - "title": "Veeam-SetupConnections", - "description": "A Microsoft Sentinel playbook that configures Key Vault secrets and hybrid connections for Veeam servers. The playbook gets server settings and Key Vault secrets from vbr_settings and vone_settings watchlists, creates Key Vault IDs, and sets all collection flags to True if required.", - "prerequisites": [ - "1. Microsoft Sentinel workspace configured.", - "2. Permissions to create Logic Apps and API Connections.", - "3. Permissions to assign roles to the Resource Group.", - "4. Veeam Azure Function App deployed and configured.", - "5. Azure Key Vault configured with appropriate access policies.", - "6. Azure Relay namespace configured.", - "7. VBR Settings watchlist configured in Microsoft Sentinel.", - "8. Veeam ONE Settings watchlist configured in Microsoft Sentinel." - ], - "tags": [ - "Automation", - "Veeam", - "Setup", - "Connections" - ], - "lastUpdateTime": "2025-09-02T01:02:00Z", - "parameterTemplateVersion": "1.0.0", - "postDeployment": [ - "1. Assign the Microsoft Sentinel Contributor role to the Logic App's managed identity on the Microsoft Sentinel workspace.", - "2. Assign the Key Vault Administrator role to the Logic App's managed identity on the Key Vault resource.", - "3. Assign the Website Contributor role to the Logic App's managed identity on the Function App resource.", - "4. Assign the Azure Relay Owner role to the Logic App's managed identity on the Relay Namespace resource.", - "5. **After playbook is run successfully**, you need to go to the Key Vault and set the password and username for each VBR server. Also, you need to install Hybrid Connections Manager into your network and set up connection there." - ], - "releaseNotes": { - "version": "1.0", - "title": "[variables('blanks')]", - "notes": [ - "Initial version" - ] - } - } + ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_playbookContentId15')]", - "contentKind": "Playbook", - "displayName": "Veeam-SetupConnections", - "contentProductId": "[variables('_playbookcontentProductId15')]", - "id": "[variables('_playbookcontentProductId15')]", - "version": "[variables('playbookVersion15')]" - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist1-id'))]", - "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", - "properties": { - "displayName": "Job Types Lookup", - "watchlistAlias": "job_types_lookup", - "source": "job_types_lookup.csv", - "description": "Job Types Lookup.", - "provider": "Microsoft", - "isDeleted": false, - "defaultDuration": "P1000Y", - "contentType": "Text/Csv", - "numberOfLinesToSkip": 0, - "itemsSearchKey": "JobType", - "rawContent": "JobType,JobTypeDescription\r\n0,Backup Job\r\n1,Replication Job\r\n2,Backup Copy Job\r\n3,SureBackup Job\r\n8,Quick Migration\r\n22,Rescan Job\r\n24,File to Tape Job\r\n28,Backup to Tape Job\r\n50,Replication Job\r\n51,Backup Copy Job\r\n52,MS SQL Log Backup Job\r\n54,Oracle Log Backup Job\r\n60,HPE StoreOnce Replication Job\r\n63,Backup Copy Job\r\n65,Backup Copy Job\r\n70,Backup Copy Job\r\n74,PostgreSQL Log Backup Job\r\n78,Entra ID Backup Job\r\n100,Configuration Backup Job\r\n104,Configuration Database Maintenance Job\r\n198,Tape Verification Job\r\n501,Tape Copy Job\r\n202,Restore Job\r\n203,Undo Failover Plan\r\n290,Restore Job\r\n316,CDP Policy\r\n4000,Agent Backup Job (Backup Server)\r\n12000,Agent Backup Job (Backup Server)\r\n12002,Agent Backup Job (Backup Policy)\r\n12003,Agent Backup Job (Backup Server)\r\n12100,Enterprise Plug-in Backup Job\r\n12101,Enterprise Plug-in Log Backup Job\r\n13000,File Backup job\r\n13003,File Backup Copy Job\r\n14000,Backup Job\r\n15000,Storage Snapshot Snapshot-Only Job\r\n15001,Storage Snapshot Backup Job\r\n15002,Storage Snapshot Copy Job\r\n15004,Storage Snapshot Restore Session\r\n18000,Archive Tier Backup Job\r\n18001,Archive Tier Restore Session\r\n18002,Archive Download Session\r\n18003,Archive Tier Synchronization Job\r\n18004,Archive Tier Backup Copy Job\r\n18005,Archive Tier Archiving Job\r\n18006,Publish Disk Session\r\n18008,Object Storage Repository Synchronization Job\r\n24002,Guest OS File Restore Session\r\n33000,SureBackup Scan only\r\n33001,SureBackup Scan only\r\n" - }, - "apiVersion": "2022-08-01" - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist2-id'))]", - "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", - "apiVersion": "2022-08-01", - "properties": { - "displayName": "License Editions Lookup", - "description": "License Editions Lookup.", - "provider": "Microsoft", - "source": "license_editions_lookup.csv", - "defaultDuration": "P1000Y", - "isDeleted": false, - "sourceType": "Local file", - "contentType": "text/csv", - "numberOfLinesToSkip": 0, - "rawContent": "Edition,EditionDescription\n-1,No License Installed\n0,Veeam Universal License\n1,Community Edition\n2,Enterprise Edition\n3,Enterprise Plus Edition", - "itemsSearchKey": "Edition", - "watchlistAlias": "license_editions_lookup" - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist3-id'))]", - "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", - "apiVersion": "2022-08-01", - "properties": { - "displayName": "License Types Lookup", - "description": "License Types Lookup.", - "sourceType": "Microsoft", - "isDeleted": false, - "defaultDuration": "P1000Y", - "source": "license_types_lookup.csv", - "contentType": "text/csv", - "rawContent": "Type,TypeDescription\n0,No License Installed\n1,Rental License\n2,NFR License\n3,Perpetual License\n4,Evaluation License\n5,Subscription License\n7,Promo License", - "itemsSearchKey": "Type", - "numberOfLinesToSkip": 0, - "provider": "Veeam Software" + "contentId": "[variables('analyticRuleObject129')._analyticRulecontentId129]", + "contentKind": "AnalyticsRule", + "displayName": "Virtual Lab Settings Updated", + "contentProductId": "[variables('analyticRuleObject129')._analyticRulecontentProductId129]", + "id": "[variables('analyticRuleObject129')._analyticRulecontentProductId129]", + "version": "[variables('analyticRuleObject129').analyticRuleVersion129]" } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist4-id'))]", - "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", - "apiVersion": "2022-08-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject130').analyticRuleTemplateSpecName130]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "displayName": "Operation Names Lookup", - "description": "Operation Names Lookup.", - "provider": "Microsoft", - "source": "operation_names_lookup.csv", - "sourceType": "Local file", - "contentType": "text/csv", - "numberOfLinesToSkip": 0, - "rawContent": "Operation Id,OperationName\n0,Four-eyes authorization has been enabled\n1,Four-eyes authorization has been disabled\n100,Delete backup\n101,Delete log backup\n102,Delete configuration backup\n103,Disable four-eyes authorization\n104,Delete snapshot\n105,Delete infrastructure object\n106,Delete service provider\n107,Delete storage\n108,Update Veeam Backup & Replication security settings\n10000,Other operations", - "itemsSearchKey": "Operation Id", - "watchlistAlias": "operation_names_lookup" + "description": "WAN_Accelerator_Deleted_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject130').analyticRuleVersion130]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject130')._analyticRulecontentId130]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when a WAN accelerator is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "WAN Accelerator Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 27300\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n [\"User Name\"] = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject130').analyticRuleId130,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 130", + "parentId": "[variables('analyticRuleObject130').analyticRuleId130]", + "contentId": "[variables('analyticRuleObject130')._analyticRulecontentId130]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject130').analyticRuleVersion130]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject130')._analyticRulecontentId130]", + "contentKind": "AnalyticsRule", + "displayName": "WAN Accelerator Deleted", + "contentProductId": "[variables('analyticRuleObject130')._analyticRulecontentProductId130]", + "id": "[variables('analyticRuleObject130')._analyticRulecontentProductId130]", + "version": "[variables('analyticRuleObject130').analyticRuleVersion130]" } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist5-id'))]", - "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", - "apiVersion": "2022-08-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject131').analyticRuleTemplateSpecName131]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "displayName": "Session States Lookup", - "description": "Session States Lookup.", - "provider": "Microsoft", - "source": "session_states_lookup.csv", - "sourceType": "Local file", - "contentType": "text/csv", - "numberOfLinesToSkip": 0, - "rawContent": "JobResult,JobResultMessage\n0,Success\n2,Failed\n3,Warning\n5,In progress\n6,Pending\n13,CBT mode", - "itemsSearchKey": "JobResult", - "watchlistAlias": "session_states_lookup" + "description": "WAN_Accelerator_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject131').analyticRuleVersion131]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject131')._analyticRulecontentId131]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when WAN accelerator settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", + "displayName": "WAN Accelerator Settings Updated", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 27200\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "SyslogAma", + "dataTypes": [ + "Syslog" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "Severity": "Severity", + "VbrHostName": "DataSource", + "MessageDetails": "MessageDetails" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject131').analyticRuleId131,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 131", + "parentId": "[variables('analyticRuleObject131').analyticRuleId131]", + "contentId": "[variables('analyticRuleObject131')._analyticRulecontentId131]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject131').analyticRuleVersion131]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject131')._analyticRulecontentId131]", + "contentKind": "AnalyticsRule", + "displayName": "WAN Accelerator Settings Updated", + "contentProductId": "[variables('analyticRuleObject131')._analyticRulecontentProductId131]", + "id": "[variables('analyticRuleObject131')._analyticRulecontentProductId131]", + "version": "[variables('analyticRuleObject131').analyticRuleVersion131]" } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist6-id'))]", - "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", - "apiVersion": "2022-08-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject132').analyticRuleTemplateSpecName132]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "displayName": "VBR Events Lookup", - "description": "Veeam Software Backup & Replication Events Lookup.", - "provider": "Microsoft", - "source": "vbr_events_lookup.csv", - "sourceType": "Local file", - "contentType": "text/csv", - "numberOfLinesToSkip": 0, - "rawContent": "ID,Event Name,Type,Event Group,Severity,Default Severity\n115,Tape Erase Job Started,Veeam Backup & Replication,Security,high,high\n150,Backup Task Finished,Veeam Backup & Replication,Monitoring,none,none\n151,File Backup Job Finished,Veeam Backup & Replication,Monitoring,none,none\n190,Backup Job Finished,Veeam Backup & Replication,Monitoring,none,none\n194,File To Tape Job Finished,Veeam Backup & Replication,Monitoring,none,none\n198,Tape Verification Job,Veeam Backup & Replication,Monitoring,none,none\n200,Tape Copy Job,Veeam Backup & Replication,Monitoring,disabled,none\n251,Restore Task for Hyper-V VM FInished,Veeam Backup & Replication,Monitoring,none,none\n290,Restore Session Finished,Veeam Backup & Replication,Monitoring,none,none\n314,VM with no backup,Veeam ONE,Security,critical,critical\n315,VM with no backup (Hyper-V),Veeam ONE,Security,critical,critical\n331,VM with no replica,Veeam ONE,Security,medium,medium\n332,VM with no replica (Hyper-V),Veeam ONE,Security,critical,critical\n342,Possible ransomware activity (vSphere),Veeam ONE,Security,critical,critical\n344,Possible ransomware activity (Hyper-V),Veeam ONE,Security,critical,critical\n364,Suspicious incremental backup size,Veeam ONE,Security,critical,critical\n365,Backup Copy RPO,Veeam ONE,Security,critical,critical\n369,Unusual job duration,Veeam ONE,Security,medium,medium\n370,Computer with no backup,Veeam ONE,Security,critical,critical\n376,Immutability state,Veeam ONE,Security,medium,medium\n377,Immutability change tracking,Veeam ONE,Security,critical,critical\n378,Job disabled (Veeam Backup for Microsoft 365),Veeam ONE,Security,medium,medium\n381,Unusual job duration (Veeam Backup for Microsoft 365),Veeam ONE,Security,medium,medium\n390,SureBackup Job Finished,Veeam Backup & Replication,Monitoring,none,none\n391,Application with no recent data backup sessions,Veeam ONE,Security,medium,medium\n395,Backup server security & compliance state,Veeam ONE,Security,critical,critical\n403,Veeam malware detection change tracking,Veeam ONE,Security,critical,critical\n450,Backup Copy Task Finished,Veeam Backup & Replication,Monitoring,none,none\n451,File Backup Copy Job Finished,Veeam Backup & Replication,Monitoring,none,none\n490,Backup Copy Job Finished,Veeam Backup & Replication,Monitoring,none,none\n590,File Copy Job Finished,Veeam Backup & Replication,Monitoring,none,none\n592,VM Copy Job Finished,Veeam Backup & Replication,Monitoring,none,none\n610,Quick Migration Finished,Veeam Backup & Replication,Monitoring,none,none\n652,Active Full Backup for Backup Policy Finished,Veeam Backup & Replication,Monitoring,none,none\n790,Agent Backup Job Finished,Veeam Backup & Replication,Monitoring,none,none\n21224,Connection to Backup Repository Lost,Veeam Backup & Replication,Security,critical,critical\n23090,Job Deleted,Veeam Backup & Replication,Security,critical,critical\n23420,Job No Longer Used as Second Destination,Veeam Backup & Replication,Security,high,high\n23630,Tape Media Pool Deleted,Veeam Backup & Replication,Security,information,information\n23631,Tape Media Vault Deleted,Veeam Backup & Replication,Security,information,information\n23632,Tape medium Deleted,Veeam Backup & Replication,Security,high,high\n23633,Tape Library Deleted,Veeam Backup & Replication,Security,information,information\n24020,License Key Expiring,Veeam Backup & Replication,Security,information,information\n24030,License Key Expired,Veeam Backup & Replication,Security,high,high\n24040,License Support Expiring,Veeam Backup & Replication,Security,medium,medium\n24050,License Support Expired,Veeam Backup & Replication,Security,high,high\n24060,License Grace Period Started,Veeam Backup & Replication,Security,medium,medium\n24070,License Limit Exceeded,Veeam Backup & Replication,Security,medium,medium\n24080,License Key Removed,Veeam Backup & Replication,Security,high,high\n24114,Tenant Password Changed,Veeam Backup & Replication,Security,medium,medium\n24131,Cloud Gateway Settings Updated,Veeam Backup & Replication,Security,information,information\n24140,Cloud Gateway Deleted,Veeam Backup & Replication,Security,information,information\n24142,Cloud Gateway Pool Settings Updated,Veeam Backup & Replication,Security,information,information\n24143,Cloud Gateway Pool Deleted,Veeam Backup & Replication,Security,information,information\n24160,Tenant Quota Changed,Veeam Backup & Replication,Security,information,information\n24170,Tenant Quota Deleted,Veeam Backup & Replication,Security,information,information\n25000,Tenant State Changed,Veeam Backup & Replication,Security,information,information\n25210,Subtenant Deleted,Veeam Backup & Replication,Security,high,high\n25220,Subtenant Updated,Veeam Backup & Replication,Security,information,information\n25400,Credential Record Updated,Veeam Backup & Replication,Security,high,high\n25500,Credential Record Deleted,Veeam Backup & Replication,Security,critical,critical\n25700,Hypervisor Host Deleted,Veeam Backup & Replication,Security,information,information\n25800,Hypervisor Host Settings Updated,Veeam Backup & Replication,Security,information,information\n26000,Failover Plan Settings Updated,Veeam Backup & Replication,Security,information,information\n26100,Failover Plan Deleted,Veeam Backup & Replication,Security,medium,medium\n26110,Failover Plan Failed,Veeam Backup & Replication,Security,medium,medium\n26600,Failover Plan Started,Veeam Backup & Replication,Security,high,high\n26700,Failover Plan Stopped,Veeam Backup & Replication,Security,medium,medium\n26800,Tenant Replica Started,Veeam Backup & Replication,Security,information,information\n26900,Tenant Replica Stopped,Veeam Backup & Replication,Security,high,high\n27000,Cloud Replica Permanent Failover Performed by Tenant,Veeam Backup & Replication,Security,high,high\n27200,WAN Accelerator Settings Updated,Veeam Backup & Replication,Security,information,information\n27300,WAN Accelerator Deleted,Veeam Backup & Replication,Security,information,information\n27500,Service Provider Updated,Veeam Backup & Replication,Security,information,information\n27600,Service Provider Deleted,Veeam Backup & Replication,Security,information,information\n27900,Backup Proxy Deleted,Veeam Backup & Replication,Security,information,information\n28100,Backup Repository Settings Updated,Veeam Backup & Replication,Security,medium,medium\n28200,Backup Repository Deleted,Veeam Backup & Replication,Security,critical,critical\n28400,Host Settings Updated,Veeam Backup & Replication,Security,information,information\n28500,Host Deleted,Veeam Backup & Replication,Security,high,high\n28800,Tape Server Deleted,Veeam Backup & Replication,Security,information,information\n28850,NDMP Server Deleted,Veeam Backup & Replication,Security,information,information\n28920,File Share Deleted,Veeam Backup & Replication,Security,high,high\n28940,File Server Settings Updated,Veeam Backup & Replication,Security,information,information\n28950,File Server Deleted,Veeam Backup & Replication,Security,high,high\n28970,Object Storage Settings Updated,Veeam Backup & Replication,Security,medium,medium\n28980,Object Storage Deleted,Veeam Backup & Replication,Security,critical,critical\n29110,Protection Group Settings Updated,Veeam Backup & Replication,Security,information,information\n29120,Protection Group Deleted,Veeam Backup & Replication,Security,high,high\n29140,Objects for Protection Group Changed,Veeam Backup & Replication,Security,information,information\n29150,Objects for Protection Group Deleted,Veeam Backup & Replication,Security,high,high\n29800,Archive Repository Settings Updated,Veeam Backup & Replication,Security,medium,medium\n29900,Archive Repository Deleted,Veeam Backup & Replication,Security,critical,critical\n30100,Scale-Out Backup Repository Settings Updated,Veeam Backup & Replication,Security,high,high\n30200,Scale-Out Backup Repository Deleted,Veeam Backup & Replication,Security,critical,critical\n30400,Application Group Settings Updated,Veeam Backup & Replication,Security,information,information\n30500,Application Group Deleted,Veeam Backup & Replication,Security,information,information\n30700,Virtual Lab Settings Updated,Veeam Backup & Replication,Security,information,information\n30800,Virtual Lab Deleted,Veeam Backup & Replication,Security,information,information\n31000,General Settings Updated,Veeam Backup & Replication,Security,information,information\n31200,User or Group Added,Veeam Backup & Replication,Security,high,high\n31210,Adding User or Group Failed,Veeam Backup & Replication,Security,medium,medium\n31400,User or Group Deleted,Veeam Backup & Replication,Security,critical,critical\n31500,Configuration Backup Job Settings Updated,Veeam Backup & Replication,Security,information,information\n31600,Encryption Password Added,Veeam Backup & Replication,Security,information,information\n31700,Encryption Password Changed,Veeam Backup & Replication,Security,high,high\n31800,Encryption Password Deleted,Veeam Backup & Replication,Security,critical,critical\n31900,SSH Credentials Changed,Veeam Backup & Replication,Security,high,high\n32100,External Repository Settings Updated,Veeam Backup & Replication,Security,information,information\n32120,Objects for Job Deleted,Veeam Backup & Replication,Security,high,high\n32200,External Repository Deleted,Veeam Backup & Replication,Security,critical,critical\n32400,Global Network Traffic Rules Deleted,Veeam Backup & Replication,Security,information,information\n32800,Preferred Networks Deleted,Veeam Backup & Replication,Security,information,information\n36013,Recovery Token Deleted,Veeam Backup & Replication,Security,medium,medium\n36022,Backup Job for Application Backup Policy Finished,Veeam Backup & Replication,Monitoring,none,none\n36023,Backup Task for Application Backup Policy Started,Veeam Backup & Replication,Monitoring,none,none\n36024,Backup Task for Application Backup Policy Finished,Veeam Backup & Replication,Monitoring,none,none\n36026,Log Backup Job for Application Backup Policy Finished,Veeam Backup & Replication,Monitoring,none,none\n40201,Multi-Factor Authentication Disabled,Veeam Backup & Replication,Security,critical,critical\n40202,Multi-Factor Authentication Token Revoked,Veeam Backup & Replication,Security,medium,medium\n40204,Multi-Factor Authentication for User Disabled,Veeam Backup & Replication,Security,critical,critical\n40205,Invalid Code for Multi-Factor Authentication Entered,Veeam Backup & Replication,Security,high,high\n40206,Allowed Attempts for Multi-Factor Authentication Exceeded,Veeam Backup & Replication,Security,critical,critical\n40290,Restore Session Finished,Veeam Backup & Replication,Monitoring,none,none\n40400,Global VM Exclusions Added,Veeam Backup & Replication,Security,high,high\n40500,Global VM Exclusions Deleted,Veeam Backup & Replication,Security,medium,medium\n40600,Global VM Exclusions Changed,Veeam Backup & Replication,Security,high,high\n40700,Configuration Backup Job Finished,Veeam Backup & Replication,Monitoring,none,none\n40800,Configuration Restore Session Finished,Veeam Backup & Replication,Monitoring,none,none\n41200,Detaching Backups Started,Veeam Backup & Replication,Security,information,information\n41401,Storage Settings Updated,Veeam Backup & Replication,Security,information,information\n41402,Storage Deleted,Veeam Backup & Replication,Security,critical,critical\n41600,Malware Activity Detected,Veeam Backup & Replication,Security,critical,critical\n41610,Object Marked as Clean,Veeam Backup & Replication,Security,information,information\n41800,Attempt to Delete Backup Failed,Veeam Backup & Replication,Security,critical,critical\n41810,Attempt to Update Security Object Failed,Veeam Backup & Replication,Security,critical,critical\n42210,Malware Detection Session Finished,Veeam Backup & Replication,Security,information,information\n42220,Restore Point Marked as Infected,Veeam Backup & Replication,Security,critical,critical\n42230,Restore Point Marked as Clean,Veeam Backup & Replication,Security,information,information\n42260,Objects Added to Malware Detection Exclusions,Veeam Backup & Replication,Security,high,high\n42270,Objects Deleted from Malware Detection Exclusions,Veeam Backup & Replication,Security,information,information\n42280,Malware Detection Exclusions List Updated,Veeam Backup & Replication,Security,high,high\n42290,Malware Detection Settings Updated,Veeam Backup & Replication,Security,high,high\n42301,KMS Server Deleted,Veeam Backup & Replication,Security,critical,critical\n42302,KMS Server Settings Updated,Veeam Backup & Replication,Security,high,high\n42401,Four-Eyes Authorization Disabled,Veeam Backup & Replication,Security,critical,critical\n42402,Four-Eyes Authorization Request Created,Veeam Backup & Replication,Security,critical,critical\n42403,Four-Eyes Authorization Request Approved,Veeam Backup & Replication,Monitoring,none,none\n42404,Four-Eyes Authorization Request Rejected,Veeam Backup & Replication,Security,information,information\n42405,Four-Eyes Authorization Request Expired,Veeam Backup & Replication,Security,high,high\n42500,KMS Key Rotation Job Finished,Veeam Backup & Replication,Security,information,information", - "itemsSearchKey": "ID", - "watchlistAlias": "vbr_events_lookup" + "description": "Configuration_Backup_Failed_AnalyticalRules Analytics Rule with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject132').analyticRuleVersion132]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject132')._analyticRulecontentId132]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects failed configuration backup operations. This might indicate system or storage issues, or a potential sabotage of the backup infrastructure.", + "displayName": "Configuration Backup Failed", + "enabled": false, + "query": "VeeamSessions_CL | where SessionType == \"ConfigurationBackup\" and ResultStatus == \"Failed\" | project TimeGenerated, VbrHostName, SessionId = Id, SessionType, Name, Result = ResultStatus", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "VeeamCustomTablesDataConnector", + "dataTypes": [ + "VeeamSessions_CL" + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "SessionType": "SessionType", + "Name": "Name", + "Result": "Result", + "VbrHostName": "VbrHostName", + "SessionId": "SessionId" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject132').analyticRuleId132,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 132", + "parentId": "[variables('analyticRuleObject132').analyticRuleId132]", + "contentId": "[variables('analyticRuleObject132')._analyticRulecontentId132]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject132').analyticRuleVersion132]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject132')._analyticRulecontentId132]", + "contentKind": "AnalyticsRule", + "displayName": "Configuration Backup Failed", + "contentProductId": "[variables('analyticRuleObject132')._analyticRulecontentProductId132]", + "id": "[variables('analyticRuleObject132')._analyticRulecontentProductId132]", + "version": "[variables('analyticRuleObject132').analyticRuleVersion132]" } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist7-id'))]", - "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", - "properties": { - "displayName": "Action Results Lookup", - "watchlistAlias": "action_results_lookup", - "source": "action_results_lookup.csv", - "description": "Action Results Lookup.", - "provider": "Microsoft", - "isDeleted": false, - "defaultDuration": "P1000Y", - "contentType": "Text/Csv", - "numberOfLinesToSkip": 0, - "itemsSearchKey": "JobResult", - "rawContent": "JobResult,JobResultMessage\r\n-1,None\r\n0,Success\r\n1,Warning\r\n2,Failed\r\n3,Working\r\n" - }, - "apiVersion": "2022-08-01" - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist8-id'))]", - "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", - "properties": { - "displayName": "Veeam Backup & Replication Settings", - "watchlistAlias": "vbr_settings", - "source": "vbr_settings.csv", - "description": "This watchlist lists Veeam Backup & Replication servers and the event types to collect. To add a server, specify Veeam Server Name and Base URL. Then run the Veeam-SetupConnections Playbook. The playbook sets the collection flags to true and creates keyVaultIds if they are empty. Otherwise, it uses the values you provide to configure Hybrid Connections and Key Vault secrets.", - "provider": "Custom", - "isDeleted": false, - "defaultDuration": "P1000Y", - "contentType": "Text/Csv", - "numberOfLinesToSkip": 0, - "itemsSearchKey": "Veeam Server Name", - "rawContent": "Veeam Server Name,Base URL,Collect Malware Events,Collect Security and Compliance Analyzer Results,Collect Authorization Events,Collect Configuration Backups,Key Vault Username ID,Key Vault Password ID\r\nExampleServerName,https://ExampleServerName.domain.example:9419,true,true,true,true,ExampleServerNameUsername,ExampleServerNamePassword\r\n" - }, - "apiVersion": "2022-08-01" - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist9-id'))]", - "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", - "properties": { - "displayName": "VONE Settings", - "watchlistAlias": "vone_settings", - "source": "vone_settings.csv", - "description": "This watchlist lists Veeam ONE servers and a flag that controls event collection. To add a server, specify Veeam Server Name and Base URL. Then run the Veeam-SetupConnections Playbook. The playbook sets the collection flag to true and creates keyVaultIds if they are empty. Otherwise, it uses the values you provide to configure Hybrid Connections and Key Vault secrets.", - "provider": "Custom", - "isDeleted": false, - "defaultDuration": "P1000Y", - "contentType": "Text/Csv", - "numberOfLinesToSkip": 0, - "itemsSearchKey": "Veeam Server Name", - "rawContent": "Veeam Server Name,Base URL,Collect Alarms,Key Vault Username ID,Key Vault Password ID\r\nExampleServerName,https://ExampleServerName.domain.example:1239,true,ExampleServerNameUsername,ExampleServerNamePassword\r\n" - }, - "apiVersion": "2022-08-01" - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist10-id'))]", - "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "displayName": "Coveware Settings", - "watchlistAlias": "coveware_settings", - "source": "coveware_settings.csv", - "description": "This watchlist defines Coveware server settings for findings data collection. You can disable data collection by setting the Collect Coveware Findings flag to false.", - "provider": "Custom", - "isDeleted": false, - "defaultDuration": "P1000Y", - "contentType": "Text/Csv", - "numberOfLinesToSkip": 0, - "itemsSearchKey": "Coveware Server Name", - "rawContent": "Coveware Server Name,Collect Coveware Findings,Coveware Base URL,Key Vault Password ID,Key Vault Username ID,Key Vault Client ID\r\nCovewareServer,true,https://api.coveware.com,CovewareServerPasswordId,CovewareServerUsernameId,CovewareServerClientId\r\n" - }, - "apiVersion": "2022-08-01" + "description": "VeeamDataPlatformMonitoring Workbook with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('workbookVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", + "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "The Veeam Data Platform Monitoring dashboard shows an aggregated view of job activity on your Veeam Backup & Replication servers." + }, + "properties": { + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0b767a3f-72a6-495b-a08e-198348d4efb9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}]},\"value\":{\"durationMs\":2592000000}},{\"id\":\"3ec1d354-0588-43dd-b3e5-7ebab2195c40\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"host_token\",\"label\":\"Veeam Backup & Replication Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetJobFinished\\r\\n| summarize by original_host\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# All Jobs\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where not (instanceId in (\\\"40290\\\", \\\"40800\\\", \\\"150\\\", \\\"450\\\", \\\"151\\\", \\\"451\\\"))\\r\\n| where Allowance\\r\\n| summarize count() by JobResultMessage = JobResultMessage\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":86400000},\"exportFieldName\":\"JobResultMessage\",\"exportParameterName\":\"ResultMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"JobResultMessage\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"purple\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"sortCriteriaField\":\"count_\"}},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (150, 151)\\r\\n| where Allowance == true\\r\\n| extend TransferredGb = todouble(\\r\\n extract(@\\\"TransferredGb=\\\"\\\"([^\\\"\\\"]*)\\\"\\\"\\\", 1, SyslogMessage)\\r\\n )\\r\\n| summarize TotalTransferredGb = sum(TransferredGb)\\r\\n| extend Name = \\\"Transferred Data (Gb)\\\"\\r\\n| project Name, TotalTransferredGb\",\"size\":3,\"timeContext\":{\"durationMs\":604800000},\"exportedParameters\":[{\"fieldName\":\"TotalTransferredGb\",\"parameterName\":\"TotalTransferredGb\",\"parameterType\":1},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Name\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalTransferredGb\",\"formatter\":12},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 5 - Copy - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId==151 or instanceId==150\\r\\n| where Allowance\\r\\n| extend TransferredGb = todouble(extract(\\\"TransferredGb=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage))\\r\\n\",\"size\":0,\"timeContext\":{\"durationMs\":604800000},\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogTransefered\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 4\"},{\"type\":1,\"content\":{\"json\":\"Syslog message: \\r\\n```\\r\\n{SyslogTransefered}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TotalTransferredGb\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"ResultMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where not (instanceId in (\\\"40290\\\", \\\"40800\\\", \\\"150\\\", \\\"450\\\", \\\"151\\\", \\\"451\\\"))\\r\\n| where JobResultMessage == \\\"{ResultMessage}\\\"\\r\\n| where Allowance\\r\\n\\r\\n\",\"size\":0,\"title\":\"Events with `{ResultMessage}` status:\",\"timeContext\":{\"durationMs\":86400000},\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ResultMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TotalTransferredGb\",\"comparison\":\"isEqualTo\"}],\"name\":\"group - 5\"}]},\"name\":\"All Jobs\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Weekly Reports\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (\\\"190\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobResultMessage\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \\r\\n\",\"size\":0,\"aggregation\":5,\"title\":\" Backup and Backup Copy Jobs\",\"timeContext\":{\"durationMs\":604800000},\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"BackupAndBackupCopyJobsTime\"},{\"fieldName\":\"label\",\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"parameterType\":1},{\"fieldName\":\"\",\"parameterName\":\"BackupAndBackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}],\"xSettings\":{\"dateFormatSettings\":{\"formatName\":\"shortDatePattern\",\"showUtcTime\":true},\"scale\":\"time\",\"label\":\"Label\"},\"ySettings\":{\"label\":\"\"}}},\"customWidth\":\"50\",\"name\":\" Backup and Backup Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId == \\\"390\\\"\\r\\n| where Allowance\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobResultMessage\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \\r\\n\",\"size\":0,\"aggregation\":5,\"title\":\"SureBackup Jobs\",\"timeContext\":{\"durationMs\":604800000},\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"SureBackupJobsTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"SureBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"SureBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"SureBackup Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupAndBackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (\\\"190\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobResultMessage == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\\r\\n\",\"size\":0,\"title\":\"Backup and Backup Copy Jobs Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"name\":\"query - 5\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"SureBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Backup and Backup Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{SureBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"390\\\"\\r\\n| where Allowance\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobResultMessage == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\",\"size\":0,\"title\":\"SureBackup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 5\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"SureBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup and Backup Copy Jobs Drilldown - Copy\"}]},\"name\":\"Weekly Reports\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Virtual Machines & Agents\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == \\\"190\\\" and JobType == \\\"0\\\"\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"VM Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"VM Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == \\\"590\\\" \\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\",\"size\":3,\"title\":\"VM File Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMFileCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMFileCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"showPin\":false,\"name\":\"VM File Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 592\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\",\"size\":3,\"title\":\"VM Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"JobResult\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"JobResult\",\"sortOrder\":2}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"VM Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" and JobType == \\\"0\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMBackupJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMBackupJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMFileCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"590\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM File Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMFileCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMFileCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM File Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"592\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM Copy Jobs Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 610\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"VM Quick Migration Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMQuickMigrationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMQuickMigrationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"VM Quick Migration Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 790\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam Agent Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VeeamAgentJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VeeamAgentJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Veeam Agent Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMQuickMigrationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 610\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Quick Migration Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VeeamAgentJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VeeamAgentJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMQuickMigrationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamAgentJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\" VM Quick Migration Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamAgentJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"790\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Veeam Agent Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VeeamAgentJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VeeamAgentJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMQuickMigrationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamAgentJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam Agent Jobs Drilldown\"}]},\"name\":\"Virtual Machines & Agents\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Unstructured Data\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 190\\n| where JobType == 13000\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 3\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\" File Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"FileBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"FileBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\" File Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 190\\n| where JobType == 13000\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 7\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Object Storage Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"ObjectStorageBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Object Storage Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 490\\n| where JobType == 13003\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 5\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Backup Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FileBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 190\\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 3\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"File Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"FileBackupJobsSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Job Type\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Job Type\",\"sortOrder\":2}]},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{FileBackupJobsSyslogMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"File Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{ObjectStorageBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 190\\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 7\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Object Storage Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"ObjectStorageBackupJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{ObjectStorageBackupJobsMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Object Storage Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 490\\r\\n| where JobType == 13003\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 5\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Copy Jobs Drilldown\"}]},\"name\":\"Unstructured Data\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Applications and Services\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"36022\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Jobs for Enterprise Plug-ins\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupJobsForEnterprisePlugInsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Jobs for Enterprise Plug-ins\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"36026\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Log Backup Jobs for Enterprise Plug-ins\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"parameterType\":1},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Log Backup Jobs for Enterprise Plug-ins\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == \\\"78\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Jobs for Entra ID\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupJobsForEntraIDStatus\",\"parameterType\":1},{\"parameterName\":\"BackupJobsForEntraIDAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Jobs for Entra ID\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupJobsForEnterprisePlugInsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"36022\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Enterprise Plug-ins Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupJobsForEnterprisePlugInsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupJobsForEnterprisePlugInsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Jobs for Enterprise Plug-ins Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{LogBackupJobsForEnterprisePlugInsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"36026\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Log Backup Jobs for Enterprise Plug-ins Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"LogBackupJobsForEnterprisePlugInsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LogBackupJobsForEnterprisePlugInsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Log Backup Jobs for Enterprise Plug-ins Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupJobsForEntraIDAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == \\\"78\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Entra ID Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupJobsForEntraIDMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupJobsForEntraIDMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Jobs for Entra ID Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 8\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Log Backup Jobs for Entra ID\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"LogBackupJobsForEntraIDStatus\",\"parameterType\":1},{\"parameterName\":\"LogBackupJobsForEntraIDAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Log Backup Jobs for Entra ID\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{LogBackupJobsForEntraIDAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 8\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Entra ID Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"LogBackupJobsForEntraIDMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LogBackupJobsForEntraIDMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"LogBackupJobsForEntraIDStatus\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Log Backup Jobs for Entra ID\"}]},\"name\":\"Applications and Services\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Backup Copy & Replicas\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 1\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Replication Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"ReplicationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"ReplicationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Replication Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"490\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{ReplicationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 1\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Replication Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"ReplicationJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{ReplicationJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ReplicationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Replication Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"490\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Replication Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ReplicationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Replication Jobs Drilldown - Copy\"}]},\"name\":\"Backup Copy & Replicas\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Tapes\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"194\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"200\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"198\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Verification Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeVerificationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeVerificationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Verification Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"194\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Tape Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"200\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Tape Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeVerificationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"198\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Verification Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeVerificationJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeVerificationJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Tape Verification Jobs Drilldown\"}]},\"name\":\"Tapes - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Finished Jobs\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetFinishedConfigurationBackupSessions\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = Computer, User = user, State = Result, SyslogMessage, StringTime = tostring(TimeGenerated), Description\\r\\n\",\"size\":0,\"title\":\"Latest Configuration Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"StringTime\",\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\"},{\"fieldName\":\"SyslogMessage\",\"parameterName\":\"SyslogMessage\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"State\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"12ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5},{\"columnMatch\":\"StringTime\",\"formatter\":5},{\"columnMatch\":\"Description\",\"formatter\":5}]},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Latest Configuration Backups\",\"styleSettings\":{\"margin\":\"3px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, StringTime = tostring(TimeGenerated), SyslogMessage\",\"size\":0,\"title\":\"Latest Finished Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"StringTime\",\"parameterName\":\"LatestFinishedJobsTime\",\"parameterType\":1},{\"fieldName\":\"SyslogMessage\",\"parameterName\":\"LatestFinishedJobsSyslogMessage\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"StringTime\",\"formatter\":5},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Latest Finished Jobs\",\"styleSettings\":{\"margin\":\"3px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, StringTime = tostring(TimeGenerated)\\r\\n| where StringTime == \\\"{LatestFinishedJobsTime}\\\"\",\"size\":3,\"title\":\"Latest Finished Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"showPin\":false,\"name\":\"Latest Finished Jobs Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LatestFinishedJobsSyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"LatestFinishedJobsTime\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Latest Finished Jobs Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetFinishedConfigurationBackupSessions\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| where tostring(TimeGenerated) == \\\"{Veeam_GetFinishedConfigurationBackupSessionsTime}\\\"\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = Computer, User = user, [\\\"Message Details\\\"] = Description, State = Result, SyslogMessage\",\"size\":3,\"title\":\"Latest Configuration Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"showPin\":false,\"name\":\"Latest Configuration Backups Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LatestFinishedJobsTime\",\"comparison\":\"isEqualTo\"}],\"name\":\"Latest Configuration Backups Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobTypeDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":2,\"aggregation\":5,\"title\":\"Finished Jobs by Type\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"FinishedJobsByTypeTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"FinishedJobsByTypeStatus\",\"parameterType\":1},{\"parameterName\":\"FinishedJobsByTypeAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"group\":\"*\",\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Finished Jobs by Type\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"40290\\\", \\\"40800\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobTypeDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":2,\"aggregation\":5,\"title\":\"Finished Restore Sessions by Type\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"FinishedRestoreSessionsByTypeTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"parameterType\":1},{\"parameterName\":\"FinishedRestoreSessionsByTypeAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Finished Restore Sessions by Type\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FinishedJobsByTypeAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobTypeDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\",\"size\":0,\"title\":\"Finished Jobs by Type Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FinishedJobsByTypeStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Finished Jobs by Type Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FinishedRestoreSessionsByTypeAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId in (\\\"40290\\\", \\\"40800\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobTypeDescription == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\",\"size\":0,\"title\":\"Finished Restore Sessions by Type Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FinishedJobsByTypeStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Finished Restore Sessions by Type Drilldown\"}]},\"name\":\"Finished Jobs\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Failed Backups\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"150\\\", \\\"450\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend VmName = extract(\\\"VmName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| summarize Total = count() by VmName, JobResultMessage\\r\\n| evaluate pivot(JobResultMessage, sum(Total))\\r\\n| extend Failed = iff(column_ifexists(\\\"Failed\\\", 0) == 0, 0, column_ifexists(\\\"Failed\\\", 0)),\\r\\n Warning = iff(column_ifexists(\\\"Warning\\\", 0) == 0, 0, column_ifexists(\\\"Warning\\\", 0))\\r\\n| project VmName, Failed, Warning\\r\\n| order by Failed desc\\r\\n| take 15\\r\\n| render barchart\",\"size\":2,\"title\":\" Unsuccessful VM Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"UnsuccessfulVMBackupsName\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"parameterType\":1},{\"parameterName\":\"UnsuccessfulVMBackupsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"VmName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"VmName\",\"yAxis\":[\"Warning\",\"Failed\"],\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Successful\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\" Unsuccessful VM Backups\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"151\\\", \\\"451\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend SourceName = extract(\\\"SourceName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| summarize Total = count() by SourceName, JobResultMessage\\r\\n| evaluate pivot(JobResultMessage, sum(Total))\\r\\n| extend Failed = iff(column_ifexists(\\\"Failed\\\", 0) == 0, 0, column_ifexists(\\\"Failed\\\", 0)),\\r\\n Warning = iff(column_ifexists(\\\"Warning\\\", 0) == 0, 0, column_ifexists(\\\"Warning\\\", 0))\\r\\n| project SourceName, Failed, Warning\\r\\n| order by Failed desc\\r\\n| take 15\\r\\n| render barchart\",\"size\":2,\"title\":\"Unsuccessful Unstructured Data Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"chartSettings\":{\"xAxis\":\"SourceName\",\"yAxis\":[\"Failed\",\"Warning\"],\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Successful\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Unsuccessful Unstructured Data Backups\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{UnsuccessfulUnstructuredDataBackupAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series), X = tostring(parsed.x);\\r\\nlet session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"151\\\", \\\"451\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend SourceName = extract(\\\"SourceName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series, $left.SourceName == $right.X\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SourceName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"title\":\"Unsuccessful Unstructured Data Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"SourceName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"SourceName\",\"sortOrder\":1}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Unsuccessful Unstructured Data Backups Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{UnsuccessfulVMBackupsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series), X = tostring(parsed.x);\\r\\nlet session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"150\\\", \\\"450\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend VmName = extract(\\\"VmName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series, $left.VmName == $right.X\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, VmName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"title\":\"Unsuccessful VM Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\",\"comparison\":\"isEqualTo\"}],\"name\":\"Unsuccessful VM Backups Drilldown - Copy\"}]},\"name\":\"Failed Backups\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"sentinel-VeeamDataPlatformMonitoring\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "properties": { + "description": "@{workbookKey=VeeamDataPlatformMonitoringWorkbook; logoFileName=VeeamLogo.svg; description=The Veeam Data Platform Monitoring dashboard shows an aggregated view of job activity on your Veeam Backup & Replication servers.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Veeam Data Platform Monitoring; templateRelativePath=VeeamDataPlatformMonitoring.json; subtitle=; provider=Veeam}.description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "Syslog", + "kind": "DataType" + }, + { + "contentId": "Syslog", + "kind": "DataConnector" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" + } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist11-id'))]", - "type": "Microsoft.OperationalInsights/workspaces/providers/watchlists", - "apiVersion": "2023-02-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName2')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "displayName": "Veeam Collection Schedule Settings", - "watchlistAlias": "collection_schedule_settings", - "source": "collection_schedule_settings.csv", - "description": "This watchlist stores the configuration for schedules and recurrence intervals used by Veeam collection playbooks. To apply the changes, run the Veeam-ChangeCollectionTime playbook.", - "provider": "Custom", - "isDeleted": false, - "defaultDuration": "P1000Y", - "contentType": "Text/Csv", - "numberOfLinesToSkip": 0, - "itemsSearchKey": "CollectionPlaybookName", - "rawContent": "CollectionPlaybookName,RecurrenceInterval,TimeUnit\r\nVeeam-CollectMalwareEvents,1,Day\r\nVeeam-CollectVeeamAuthorizationEvents,1,Day\r\nVeeam-CollectSecurityComplianceAnalyzerResult,1,Day\r\nVeeam-CollectVeeamONEAlarms,1,Day\r\nVeeam-CollectCovewareFindings,1,Day\r\nVeeam-CollectConfigurationBackups,1,Day\r\n" + "description": "VeeamSecurityActivities Workbook with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('workbookVersion2')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId2')]", + "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "The Veeam Security Activities dashboard shows an aggregated view of security events from your Veeam Backup & Replication servers and Veeam ONE servers, as well as Coveware findings." + }, + "properties": { + "displayName": "[parameters('workbook2-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"bb18f0f1-0893-479d-83fe-9cca36e33b43\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"value\":{\"durationMs\":2592000000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"d559890f-2663-49a6-af45-3dfc1fa7fda0\",\"cellValue\":\"isRest\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Syslog\",\"subTarget\":\"0\",\"preText\":\"d\",\"postText\":\"d\",\"style\":\"secondary\"},{\"id\":\"aee69a87-0e6f-4aab-ab21-14423e4d2d3d\",\"cellValue\":\"isRest\",\"linkTarget\":\"parameter\",\"linkLabel\":\"REST\",\"subTarget\":\"1\",\"style\":\"link\"}]},\"name\":\"links - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"3ec1d354-0588-43dd-b3e5-7ebab2195c40\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"host_token\",\"label\":\"Veeam Backup & Replication Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| summarize by original_host\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"26fbaaa0-3b0f-4506-885b-9fd8cd87ece9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vone_host_token\",\"label\":\"Veeam ONE Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| summarize by VoneHostName\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"parameters - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"3b155c6e-4243-4c04-8675-3901414969df\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vbr_host_name\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union \\r\\n (VeeamMalwareEvents_CL | where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}),\\r\\n (VeeamAuthorizationEvents_CL | where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}),\\r\\n (VeeamSecurityComplianceAnalyzer_CL\\r\\n | where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end})\\r\\n \\r\\n | summarize by VbrHostName\\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Veeam Backup & Replication Data Sources\"},{\"id\":\"f3074530-90f9-44b3-96a4-6141a273e18b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vone_host_name\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"VeeamOneTriggeredAlarms_CL \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize by VoneHostName\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Veeam ONE Data Sources\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"parameters - rest\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Custom Tables Events Overview\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by Status\\n| top 20 by Count\\n| project Status, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam ONE Triggered Alarms by Status\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Resolved\",\"color\":\"blue\"},{\"seriesName\":\"Error\",\"color\":\"redBright\"}]}},\"customWidth\":\"25\",\"name\":\"query - vone-alarms-status\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| summarize Count = count() by Severity\\n| top 20 by Count\\n| project Severity, Count\\n| render piechart\",\"size\":3,\"title\":\"Malware Events by Severity\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"MalwareEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Infected\",\"color\":\"redBright\"},{\"seriesName\":\"Clean\",\"color\":\"green\"}]}},\"customWidth\":\"25\",\"name\":\"query - malware-severity\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n| summarize Count = count() by State\\n| top 20 by Count\\n| project State, Count\\n| render piechart\",\"size\":3,\"title\":\"Authorization Events by State\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"ProcessedTime\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"ProcessedTime\",\"sortOrder\":2}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Approved\",\"color\":\"green\"},{\"seriesName\":\"Info\",\"color\":\"blue\"},{\"seriesName\":\"Rejected\",\"color\":\"redBright\"}]}},\"customWidth\":\"25\",\"name\":\"query - authorization-state\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamSecurityComplianceAnalyzer_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\n| summarize Count = count() by Status\\n| top 20 by Count\\n| project Status, Count\\n| render piechart\",\"size\":3,\"title\":\"Security & Compliance Analyzer Results by Status\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"BestPracticesAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Violation\",\"color\":\"redBright\"},{\"seriesName\":\"OK\",\"color\":\"green\"},{\"seriesName\":\"UnableToCheck\",\"color\":\"orange\"}]}},\"customWidth\":\"25\",\"name\":\"query - best-practices-status\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VoneTriggeredAlarmsStatusRestAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamOneTriggeredAlarms_CL\\r\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\r\\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| join kind=inner (filters) on $left.Status == $right.Series\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"title\":\"Veeam ONE Triggered Alarms by Status Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"VeeamONETriggeredAlarmsDrilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{AuthorizationEventsStateAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamAuthorizationEvents_CL\\r\\n| where \\\"'All'\\\" == \\\"{vbr_host_name}\\\" or VbrHostName in ({vbr_host_name}) \\r\\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\r\\n| where State in (toscalar(filters | summarize make_set(Series)))\\r\\n| project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\",\"size\":0,\"title\":\"Authorization Events by State Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Authorization Events Drilldown \"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{MalwareEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamMalwareEvents_CL\\r\\n| where \\\"'All'\\\" == \\\"{vbr_host_name}\\\" or VbrHostName in ({vbr_host_name}) \\r\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\r\\n| where Severity in (toscalar(filters | summarize make_set(Series)))\\r\\n| project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\",\"size\":0,\"title\":\"Malware Events by Severity Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"MalwareEventsDrilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BestPracticesAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\n\\r\\nVeeamSecurityComplianceAnalyzer_CL\\r\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\r\\n| join kind=inner (filters) on $left.Status == $right.Series\\r\\n| project TimeGenerated, VbrHostName, Status, Id, BestPractice, Note\",\"size\":0,\"title\":\"Security & Compliance Analyzer Results by Status Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"BestPracticesAnalysisDrilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by Name\\n| top 20 by Count\\n| project Name, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam ONE Triggered Alarms by Name\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VoneTriggeredAlarmsName\"},{\"parameterName\":\"VoneTriggeredAlarmsNamesRestAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Success\",\"color\":\"yellow\"}]}},\"customWidth\":\"33\",\"name\":\"query - vone-alarms-name\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VoneTriggeredAlarmsNamesRestAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| where Name in (toscalar(filters | summarize make_set(Series)))\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"title\":\"Veeam ONE Triggered Alarms by Name Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"VoneTriggeredAlarmsName\",\"comparison\":\"isNotEqualTo\"},\"name\":\"VeeamONETriggeredAlarmsDrilldown - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| where Severity == \\\"Infected\\\"\\n| count\",\"size\":2,\"title\":\"Infected Files Detected\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"stat\",\"statSettings\":{\"showBorder\":false,\"colorSettings\":{\"colorizeBody\":true,\"thresholds\":[{\"criteria\":\"isGreaterThan\",\"value\":\"0\",\"color\":\"red\"}]}}},\"customWidth\":\"33\",\"name\":\"infected-files-stat\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union \\n (VeeamOneTriggeredAlarms_CL | where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}),\\n (VeeamMalwareEvents_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) | where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}),\\n (VeeamAuthorizationEvents_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) | where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}),\\n (VeeamSecurityComplianceAnalyzer_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}),\\n (VeeamCovewareFindings_CL | where EventTime >= {TimeRange:start} and EventTime <= {TimeRange:end})\\n| summarize Count = count() by Type\\n| project [\\\"Event Type\\\"] = Type, Count\\n| render piechart\",\"size\":3,\"title\":\"All Custom Table Events by Type\",\"exportFieldName\":\"Event Type\",\"exportParameterName\":\"CustomTableEventType\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"33\",\"name\":\"query - custom-tables-distribution\"},{\"type\":1,\"content\":{\"json\":\"## Daily Trends\"},\"name\":\"text - daily-trends\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Coveware Findings\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| summarize Count = count() by EventType\\r\\n| top 20 by Count\\r\\n| project EventType, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Coveware Findings by Name\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"CovewareFindingsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"yAxis\":[\"Count\"],\"group\":\"EventType\",\"createOtherGroup\":0,\"showMetrics\":true,\"showLegend\":false}},\"customWidth\":\"30\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| summarize Count = count() by DateOnly = startofday(EventTime), RiskLevel\\r\\n| order by DateOnly asc\\r\\n| render timechart\",\"size\":0,\"title\":\"Daily Coveware Findings by Risk Level\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"CovewareRiskLevelAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"medium\",\"color\":\"orange\"},{\"seriesName\":\"low\",\"color\":\"blue\"},{\"seriesName\":\"high\",\"color\":\"redBright\"},{\"seriesName\":\"critical\",\"color\":\"purple\"}]}},\"customWidth\":\"70\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Step 1: Parse the Sentinel widget export into a filter table\\r\\nlet filters =\\r\\n print arr = parse_json(\\r\\n replace(\\r\\n @\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", \\r\\n @\\\"\\\\1\\\", \\r\\n strcat('[', '{CovewareFindingsNameAllFields}', ']')\\r\\n )\\r\\n )\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Filter main table by matching series\\r\\nVeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| where EventType in (toscalar(filters | summarize make_set(Series)))\\r\\n| project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings by Name Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibilities\":[{\"parameterName\":\"CovewareFindingsNameAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"CovewareRiskLevelAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Step 1: Parse the Sentinel widget export into a filter table\\r\\nlet filters =\\r\\n print arr = parse_json(\\r\\n replace(\\r\\n @\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", \\r\\n @\\\"\\\\1\\\", \\r\\n strcat('[', '{CovewareRiskLevelAllFields}', ']')\\r\\n )\\r\\n )\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n | extend DateOnly = startofday(EventTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.RiskLevel == $right.Series\\r\\n| project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings by Risk Level Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventTime\",\"formatter\":6},{\"columnMatch\":\"EventActivity\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"92.8571ch\"}}]}},\"conditionalVisibilities\":[{\"parameterName\":\"CovewareFindingsNameAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"CovewareRiskLevelAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"query - 4 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n | order by EventTime desc | project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings Details\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 2\"}]},\"name\":\"group - 17\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by bin(TriggeredTime, 1d), Status\\n| order by TriggeredTime asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Veeam ONE Triggered Alarms\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Error\",\"color\":\"redBright\"}]}},\"customWidth\":\"50\",\"name\":\"daily-vone-alarms\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| summarize Count = count() by bin(DetectionTimeUtc, 1d), Severity\\n| order by DetectionTimeUtc asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Malware Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyMalwareEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Infected\",\"color\":\"redBright\"},{\"seriesName\":\"Clean\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"daily-malware-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamONETriggeredAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(TriggeredTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.Status == $right.Series\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"Comment\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Comment\",\"sortOrder\":1}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"DailyMalwareEventsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"query - 23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyMalwareEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamMalwareEvents_CL\\r\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(DetectionTimeUtc)\\r\\n| join kind=inner (filters) on DateOnly, $left.Severity == $right.Series\\r\\n| project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\",\"size\":0,\"title\":\"Daily Malware Events Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"DailyMalwareEventsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"query - 23 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n| summarize Count = count() by bin(ProcessedTime, 1d), State\\n| order by ProcessedTime asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Four-Eyes Authorization Events\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyFourEyesAuthorizationEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Approved\",\"color\":\"green\"},{\"seriesName\":\"Info\",\"color\":\"blue\"},{\"seriesName\":\"Rejected\",\"color\":\"redBright\"}]}},\"customWidth\":\"100\",\"name\":\"daily-authorization-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyFourEyesAuthorizationEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeamAuthorizationEvents_CL\\r\\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(ProcessedTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.State == $right.Series\\r\\n| project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\\r\\n\",\"size\":0,\"title\":\"Daily Four-Eyes Authorization Events Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"DailyFourEyesAuthorizationEventsAllFields\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 23 - Copy - Copy\"},{\"type\":1,\"content\":{\"json\":\"## Latest Events\"},\"name\":\"text - latest-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n | order by TriggeredTime desc | project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\\n| top 15 by TriggeredTime desc\",\"size\":0,\"title\":\"Latest Veeam ONE Triggered Alarms\",\"exportFieldName\":\"Alarm Name\",\"exportParameterName\":\"SelectedVoneAlarm\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-vone-alarms\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n | order by DetectionTimeUtc desc | project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\\n| top 15 by DetectionTime desc\",\"size\":0,\"title\":\"Latest Malware Events\",\"exportFieldName\":\"Machine\",\"exportParameterName\":\"SelectedMalwareMachine\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-malware-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n | order by ProcessedTime desc | project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\\n\",\"size\":0,\"title\":\"Latest Authorization Events\",\"exportFieldName\":\"Event Name\",\"exportParameterName\":\"SelectedAuthEvent\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-authorization-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamSecurityComplianceAnalyzer_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n | order by TimeGenerated desc | project TimeGenerated, VbrHostName, Status, Id, BestPractice, Note\\n| top 15 by TimeGenerated desc\",\"size\":0,\"title\":\"Latest Security & Compliance Analysis\",\"exportFieldName\":\"Best Practice\",\"timeContextFromParameter\":\"TimeRange\",\"exportParameterName\":\"SelectedBestPractice\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-best-practices\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"REST Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Overview\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\n| summarize Count = count() by [\\\"SeverityDescription\\\"]\\n| top 20 by Count\\n| project [\\\"SeverityDescription\\\"], Count\\n| render piechart \\n\",\"size\":3,\"title\":\"Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\" or SyslogMessage has \\\"predefined_alarm_id\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| extend predefined_alarm_id = extract(\\\"predefined_alarm_id=\\\\\\\"(\\\\\\\\d+)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| extend eventId = strcat(\\r\\n tostring(extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage)), \\r\\n tostring(extract(\\\"predefined_alarm_id=\\\\\\\"(\\\\\\\\d+)\\\\\\\"\\\", 1, SyslogMessage))\\r\\n)\\r\\n| where eventId in (\\\"41600\\\",\\\"42220\\\",\\\"25500\\\",\\\"26100\\\",\\\"28100\\\",\\\"28970\\\",\\\"29800\\\",\\\"30100\\\",\\\"30400\\\",\\\"31500\\\",\\\"31600\\\",\\\"31700\\\",\\\"31800\\\",\\\"31900\\\",\\\"40204\\\",\\\"40400\\\",\\\"40500\\\",\\\"40600\\\",\\\"42260\\\",\\\"42270\\\",\\\"42302\\\",\\\"23090\\\",\\\"23420\\\",\\\"24080\\\",\\\"28200\\\",\\\"28500\\\",\\\"28920\\\",\\\"28950\\\",\\\"28980\\\",\\\"29120\\\",\\\"29150\\\",\\\"29900\\\",\\\"30200\\\",\\\"30500\\\",\\\"32120\\\",\\\"32200\\\",\\\"41402\\\",\\\"115\\\",\\\"31210\\\",\\\"31400\\\",\\\"40201\\\",\\\"40205\\\",\\\"40206\\\",\\\"41610\\\",\\\"42230\\\",\\\"42301\\\",\\\"42401\\\",\\\"42402\\\",\\\"42404\\\",\\\"42405\\\",\\\"21224\\\",\\\"26110\\\",\\\"31200\\\",\\\"36013\\\",\\\"42210\\\",\\\"42500\\\",\\\"27000\\\",\\\"24060\\\",\\\"24030\\\",\\\"24050\\\",\\\"24070\\\",\\\"24040\\\",\\\"42290\\\",\\\"23630\\\",\\\"23631\\\",\\\"23632\\\",\\\"23633\\\",\\\"24020\\\",\\\"24114\\\",\\\"24131\\\",\\\"24140\\\",\\\"24142\\\",\\\"24143\\\",\\\"24160\\\",\\\"24170\\\",\\\"25000\\\",\\\"25210\\\",\\\"25220\\\",\\\"25400\\\",\\\"25700\\\",\\\"25800\\\",\\\"26000\\\",\\\"26600\\\",\\\"26700\\\",\\\"26800\\\",\\\"26900\\\",\\\"27200\\\",\\\"27300\\\",\\\"27500\\\",\\\"27600\\\",\\\"27900\\\",\\\"28400\\\",\\\"28800\\\",\\\"28850\\\",\\\"28940\\\",\\\"29110\\\",\\\"29140\\\",\\\"30700\\\",\\\"30800\\\",\\\"31000\\\",\\\"32100\\\",\\\"32400\\\",\\\"32800\\\",\\\"40202\\\",\\\"41200\\\",\\\"41401\\\",\\\"42280\\\",\\\"395\\\", \\\"364\\\", \\\"369\\\", \\\"391\\\", \\\"365\\\", \\\"370\\\", \\\"314\\\", \\\"331\\\", \\\"376\\\", \\\"377\\\", \\\"403\\\", \\\"316\\\", \\\"342\\\", \\\"381\\\", \\\"315\\\", \\\"332\\\", \\\"344\\\",\\\"378\\\")\\r\\n| extend host = Computer\\r\\n| count\",\"size\":0,\"title\":\"All Security Activities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"stat\",\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"All Security Activities\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by SeverityDescription\\n| top 20 by Count\\n| render piechart\\n\",\"size\":3,\"title\":\"Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamONEAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| join kind=inner (filters) on $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Veeam ONE Alarms Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam ONE Alarms by Severity Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamBackupAndReplicationSecurityEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Veeam Backup & Replication Security Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Veeam Backup & Replication Security Events Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| summarize Count = count() by [\\\"Event Name\\\"]\\r\\n| project [\\\"Event Name\\\"], Count\\r\\n| render piechart \",\"size\":3,\"title\":\"Veeam ONE Alarms by Name\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by [\\\"Event Name\\\"]\\r\\n| top 20 by Count\\r\\n| render piechart\\r\\n\",\"size\":3,\"title\":\"Veeam Backup & Replication Security Events by Name\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamONEAlarmsNameAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| join kind=inner (filters) on $left.[\\\"Event Name\\\"] == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Veeam ONE Alarms Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam ONE Alarms by Name Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamBackupAndReplicationSecurityEventsNameAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.[\\\"Event Name\\\"] == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Veeam Backup & Replication Security Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Veeam Backup & Replication Security Events Drilldown - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where instanceId == \\\"42220\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Marked as Infected\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"MarkedAsInfectedCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Marked as Infected\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| extend original_host = Computer\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Four-Eyes Authorization Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"FourEyesAuthorizationEventsCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Four-Eyes Authorization Events\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"41600\\\"\\r\\n| extend original_host = Computer\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Marked as Suspicious\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"MarkedAsSuspiciousCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Marked as Suspicious\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Four-Eyes Authorization Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Four-Eyes Authorization Events Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42220\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Marked as Infected Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Marked as Infected Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"41600\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Four-Eyes Authorization Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Four-Eyes Authorization Events Drilldown\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Overview\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Daily Security Activities\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription\",\"size\":0,\"aggregation\":5,\"title\":\"Daily Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Critical\",\"color\":\"purple\"},{\"seriesName\":\"High\",\"color\":\"redBright\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Daily Veeam Backup & Replication Security Events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":0,\"aggregation\":5,\"title\":\" Daily Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"purple\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"High\",\"color\":\"redBright\"}]}},\"customWidth\":\"50\",\"name\":\" Daily Veeam ONE Alarms\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamBackupReplicationSecurityEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Daily Veeam Backup & Replication Security Events Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Daily Veeam Backup & Replication Security Events Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamONEAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Daily Veeam ONE Alarms Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Daily Veeam ONE Alarms Drilldown - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Daily Security Activities\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Latest Security Activities\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Latest Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VBRSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"Latest Veeam Backup & Replication Security Events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Latest Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VoneSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"customWidth\":\"50\",\"name\":\"Latest Veeam ONE Alarms\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VBRSyslogMessage}\\r\\n```\"},\"conditionalVisibilities\":[{\"parameterName\":\"VBRSyslogMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VoneSyslogMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"text - 3\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VoneSyslogMessage}\\r\\n```\"},\"conditionalVisibilities\":[{\"parameterName\":\"VoneSyslogMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VBRSyslogMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"text - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Latest Security Activities\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Four-Eyes Authorization Events\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let watchlist = _GetWatchlist(\\\"operation_names_lookup\\\"); \\r\\nSyslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| extend OperationId = extract(\\\"OperationId=\\\\\\\"(?[^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| lookup kind=inner (watchlist) \\r\\n on $left.OperationId == $right.[\\\"Operation Id\\\"]\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), OperationName\\r\\n\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"FourEyesAuthorizationEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"query - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let watchlist = _GetWatchlist(\\\"operation_names_lookup\\\"); \\r\\n\\r\\nlet filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FourEyesAuthorizationEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nSyslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| extend OperationId = extract(\\\"OperationId=\\\\\\\"(?[^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| lookup kind=inner (watchlist) \\r\\n on $left.OperationId == $right.[\\\"Operation Id\\\"]\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.OperationName == $right.Series\\r\\n| project TimeGenerated, Computer, EventTime, Facility, HostName, SeverityLevel, instanceId, OperationId, LastUpdatedTime = LastUpdatedTimeUTC, SearchKey, OperationName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"FourEyesAuthorizationEventsAllFields\",\"comparison\":\"isNotEqualTo\"},\"name\":\"group - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Four-Eyes Authorization Events\"}],\"fromTemplateId\":\"sentinel-VeeamSecurityActivities\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]", + "properties": { + "description": "@{workbookKey=VeeamSecurityActivitiesWorkbook; logoFileName=VeeamLogo.svg; description=The Veeam Security Activities dashboard shows an aggregated view of security events from your Veeam Backup & Replication servers and Veeam ONE servers, as well as Coveware findings.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Veeam Security Activities; templateRelativePath=VeeamSecurityActivities.json; subtitle=; provider=Veeam}.description", + "parentId": "[variables('workbookId2')]", + "contentId": "[variables('_workbookContentId2')]", + "kind": "Workbook", + "version": "[variables('workbookVersion2')]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "VeeamMalwareEvents_CL", + "kind": "DataType" + }, + { + "contentId": "VeeamAuthorizationEvents_CL", + "kind": "DataType" + }, + { + "contentId": "VeeamOneTriggeredAlarms_CL", + "kind": "DataType" + }, + { + "contentId": "VeeamSecurityComplianceAnalyzer_CL", + "kind": "DataType" + }, + { + "contentId": "VeeamCovewareFindings_CL", + "kind": "DataType" + }, + { + "contentId": "Syslog", + "kind": "DataType" + }, + { + "contentId": "VeeamCustomTablesDataConnector", + "kind": "DataConnector" + }, + { + "contentId": "Syslog", + "kind": "DataConnector" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId2')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook2-name')]", + "contentProductId": "[variables('_workbookcontentProductId2')]", + "id": "[variables('_workbookcontentProductId2')]", + "version": "[variables('workbookVersion2')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", - "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], "properties": { - "description": "VeeamDataPlatformMonitoring Workbook with template version 3.0.3", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('workbookVersion1')]", - "parameters": {}, - "variables": {}, - "resources": [ + "version": "3.0.3", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "Veeam", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Veeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor Ingestion API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n

  3. Azure Key Vault

    \n
    4. \n

  4. Azure Storage Account

    \n
    5. \n

  5. Azure Relays

    \n
    6. \n

  6. Azure Logic Apps

    \n
    7. \n

  7. Azure Log Analytics

    \n
    8. \n
\n

Data Connectors: 2, Parsers: 4, Workbooks: 2, Analytic Rules: 132, Watchlists: 11, Playbooks: 15

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId1')]", + "version": "[variables('dataConnectorVersion1')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections2')]", + "version": "[variables('dataConnectorCCPVersion')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-ChangeCollectionTime')]", + "version": "[variables('playbookVersion1')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectVeeamAuthorizationEvents')]", + "version": "[variables('playbookVersion2')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectSecurityComplianceAnalyzerResult')]", + "version": "[variables('playbookVersion3')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectMalwareEvents')]", + "version": "[variables('playbookVersion4')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectVoneAlarms')]", + "version": "[variables('playbookVersion5')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectCovewareFindings')]", + "version": "[variables('playbookVersion6')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-CollectConfigurationBackups')]", + "version": "[variables('playbookVersion7')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-FindCleanRestorePoints')]", + "version": "[variables('playbookVersion8')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-PerformScanBackup')]", + "version": "[variables('playbookVersion9')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-PerformInstantVMRecovery')]", + "version": "[variables('playbookVersion10')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-ResolveTriggeredAlarm')]", + "version": "[variables('playbookVersion11')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-StartSecurityComplianceAnalyzer')]", + "version": "[variables('playbookVersion12')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-PerformConfigurationBackupOnIncident')]", + "version": "[variables('playbookVersion13')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-StartQuickBackup')]", + "version": "[variables('playbookVersion14')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Veeam-SetupConnectionsPlaybook')]", + "version": "[variables('playbookVersion15')]" + }, + { + "kind": "Watchlist", + "contentId": "[variables('_Job Types Lookup')]", + "version": "3.0.3" + }, + { + "kind": "Watchlist", + "contentId": "[variables('_License Editions Lookup')]", + "version": "3.0.3" + }, + { + "kind": "Watchlist", + "contentId": "[variables('_License Types Lookup')]", + "version": "3.0.3" + }, + { + "kind": "Watchlist", + "contentId": "[variables('_Operation Names Lookup')]", + "version": "3.0.3" + }, + { + "kind": "Watchlist", + "contentId": "[variables('_Session States Lookup')]", + "version": "3.0.3" + }, + { + "kind": "Watchlist", + "contentId": "[variables('_VBR Events Lookup')]", + "version": "3.0.3" + }, + { + "kind": "Watchlist", + "contentId": "[variables('_Action Results Lookup')]", + "version": "3.0.3" + }, + { + "kind": "Watchlist", + "contentId": "[variables('_Veeam Backup & Replication Settings')]", + "version": "3.0.3" + }, + { + "kind": "Watchlist", + "contentId": "[variables('_VONE Settings')]", + "version": "3.0.3" + }, + { + "kind": "Watchlist", + "contentId": "[variables('_Coveware Settings')]", + "version": "3.0.3" + }, { - "type": "Microsoft.Insights/workbooks", - "name": "[variables('workbookContentId1')]", - "location": "[parameters('workspace-location')]", - "kind": "shared", - "apiVersion": "2021-08-01", - "metadata": { - "description": "The Veeam Data Platform Monitoring dashboard shows an aggregated view of job activity on your Veeam Backup & Replication servers." - }, - "properties": { - "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0b767a3f-72a6-495b-a08e-198348d4efb9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}]},\"value\":{\"durationMs\":2592000000}},{\"id\":\"3ec1d354-0588-43dd-b3e5-7ebab2195c40\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"host_token\",\"label\":\"Veeam Backup & Replication Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetJobFinished\\r\\n| summarize by original_host\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# All Jobs\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where not (instanceId in (\\\"40290\\\", \\\"40800\\\", \\\"150\\\", \\\"450\\\", \\\"151\\\", \\\"451\\\"))\\r\\n| where Allowance\\r\\n| summarize count() by JobResultMessage = JobResultMessage\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":86400000},\"exportFieldName\":\"JobResultMessage\",\"exportParameterName\":\"ResultMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"JobResultMessage\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"purple\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"sortCriteriaField\":\"count_\"}},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (150, 151)\\r\\n| where Allowance == true\\r\\n| extend TransferredGb = todouble(\\r\\n extract(@\\\"TransferredGb=\\\"\\\"([^\\\"\\\"]*)\\\"\\\"\\\", 1, SyslogMessage)\\r\\n )\\r\\n| summarize TotalTransferredGb = sum(TransferredGb)\\r\\n| extend Name = \\\"Transferred Data (Gb)\\\"\\r\\n| project Name, TotalTransferredGb\",\"size\":3,\"timeContext\":{\"durationMs\":604800000},\"exportedParameters\":[{\"fieldName\":\"TotalTransferredGb\",\"parameterName\":\"TotalTransferredGb\",\"parameterType\":1},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Name\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalTransferredGb\",\"formatter\":12},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 5 - Copy - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId==151 or instanceId==150\\r\\n| where Allowance\\r\\n| extend TransferredGb = todouble(extract(\\\"TransferredGb=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage))\\r\\n\",\"size\":0,\"timeContext\":{\"durationMs\":604800000},\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogTransefered\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 4\"},{\"type\":1,\"content\":{\"json\":\"Syslog message: \\r\\n```\\r\\n{SyslogTransefered}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TotalTransferredGb\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"ResultMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where not (instanceId in (\\\"40290\\\", \\\"40800\\\", \\\"150\\\", \\\"450\\\", \\\"151\\\", \\\"451\\\"))\\r\\n| where JobResultMessage == \\\"{ResultMessage}\\\"\\r\\n| where Allowance\\r\\n\\r\\n\",\"size\":0,\"title\":\"Events with `{ResultMessage}` status:\",\"timeContext\":{\"durationMs\":86400000},\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ResultMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TotalTransferredGb\",\"comparison\":\"isEqualTo\"}],\"name\":\"group - 5\"}]},\"name\":\"All Jobs\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Weekly Reports\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (\\\"190\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobResultMessage\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \\r\\n\",\"size\":0,\"aggregation\":5,\"title\":\" Backup and Backup Copy Jobs\",\"timeContext\":{\"durationMs\":604800000},\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"BackupAndBackupCopyJobsTime\"},{\"fieldName\":\"label\",\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"parameterType\":1},{\"fieldName\":\"\",\"parameterName\":\"BackupAndBackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}],\"xSettings\":{\"dateFormatSettings\":{\"formatName\":\"shortDatePattern\",\"showUtcTime\":true},\"scale\":\"time\",\"label\":\"Label\"},\"ySettings\":{\"label\":\"\"}}},\"customWidth\":\"50\",\"name\":\" Backup and Backup Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId == \\\"390\\\"\\r\\n| where Allowance\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobResultMessage\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \\r\\n\",\"size\":0,\"aggregation\":5,\"title\":\"SureBackup Jobs\",\"timeContext\":{\"durationMs\":604800000},\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"SureBackupJobsTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"SureBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"SureBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"SureBackup Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupAndBackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| where instanceId in (\\\"190\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobResultMessage == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\\r\\n\",\"size\":0,\"title\":\"Backup and Backup Copy Jobs Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"name\":\"query - 5\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"SureBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Backup and Backup Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{SureBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"390\\\"\\r\\n| where Allowance\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobResultMessage == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\",\"size\":0,\"title\":\"SureBackup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 5\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"SureBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupAndBackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup and Backup Copy Jobs Drilldown - Copy\"}]},\"name\":\"Weekly Reports\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Virtual Machines & Agents\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == \\\"190\\\" and JobType == \\\"0\\\"\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"VM Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"VM Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == \\\"590\\\" \\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\",\"size\":3,\"title\":\"VM File Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMFileCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMFileCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"showPin\":false,\"name\":\"VM File Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 592\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\",\"size\":3,\"title\":\"VM Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"JobResult\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"JobResult\",\"sortOrder\":2}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"VM Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" and JobType == \\\"0\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMBackupJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMBackupJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMFileCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"590\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM File Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMFileCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMFileCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM File Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"592\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VMCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VMCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VMFileCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VMBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"VM Copy Jobs Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 610\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"VM Quick Migration Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VMQuickMigrationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VMQuickMigrationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"VM Quick Migration Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 790\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam Agent Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VeeamAgentJobsStatus\",\"parameterType\":1},{\"parameterName\":\"VeeamAgentJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Veeam Agent Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VMQuickMigrationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 610\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"VM Quick Migration Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VeeamAgentJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VeeamAgentJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMQuickMigrationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamAgentJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\" VM Quick Migration Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamAgentJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"790\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Veeam Agent Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VeeamAgentJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VeeamAgentJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VMQuickMigrationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamAgentJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam Agent Jobs Drilldown\"}]},\"name\":\"Virtual Machines & Agents\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Unstructured Data\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 190\\n| where JobType == 13000\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 3\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\" File Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"FileBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"FileBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\" File Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 190\\n| where JobType == 13000\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 7\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Object Storage Backup Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"parameterType\":1},{\"parameterName\":\"ObjectStorageBackupJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Object Storage Backup Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\n| where instanceId == 490\\n| where JobType == 13003\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\n| where SourceType == 5\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\n| project JobResultMessage, Count\\n| render piechart\",\"size\":3,\"title\":\"Backup Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FileBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 190\\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 3\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"File Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"FileBackupJobsSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Job Type\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Job Type\",\"sortOrder\":2}]},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{FileBackupJobsSyslogMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"File Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{ObjectStorageBackupJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 190\\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 7\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Object Storage Backup Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"ObjectStorageBackupJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{ObjectStorageBackupJobsMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Object Storage Backup Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == 490\\r\\n| where JobType == 13003\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 5\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Message Details\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"172ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 1\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 2\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FileBackupJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"ObjectStorageBackupJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Copy Jobs Drilldown\"}]},\"name\":\"Unstructured Data\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Applications and Services\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"36022\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Jobs for Enterprise Plug-ins\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupJobsForEnterprisePlugInsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Jobs for Enterprise Plug-ins\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"36026\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Log Backup Jobs for Enterprise Plug-ins\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"parameterType\":1},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Log Backup Jobs for Enterprise Plug-ins\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == \\\"78\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Jobs for Entra ID\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupJobsForEntraIDStatus\",\"parameterType\":1},{\"parameterName\":\"BackupJobsForEntraIDAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Jobs for Entra ID\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupJobsForEnterprisePlugInsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"36022\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Enterprise Plug-ins Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupJobsForEnterprisePlugInsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupJobsForEnterprisePlugInsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Jobs for Enterprise Plug-ins Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{LogBackupJobsForEnterprisePlugInsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"36026\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Log Backup Jobs for Enterprise Plug-ins Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"LogBackupJobsForEnterprisePlugInsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LogBackupJobsForEnterprisePlugInsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Log Backup Jobs for Enterprise Plug-ins Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupJobsForEntraIDAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == \\\"78\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Entra ID Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupJobsForEntraIDMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupJobsForEntraIDMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"BackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupJobsForEntraIDStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogBackupJobsForEnterprisePlugInsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Backup Jobs for Entra ID Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 8\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Log Backup Jobs for Entra ID\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"LogBackupJobsForEntraIDStatus\",\"parameterType\":1},{\"parameterName\":\"LogBackupJobsForEntraIDAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Log Backup Jobs for Entra ID\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{LogBackupJobsForEntraIDAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 13000\\r\\n| extend SourceType = extract(\\\"SourceType=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where SourceType == 8\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Backup Jobs for Entra ID Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"LogBackupJobsForEntraIDMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LogBackupJobsForEntraIDMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"LogBackupJobsForEntraIDStatus\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Log Backup Jobs for Entra ID\"}]},\"name\":\"Applications and Services\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Backup Copy & Replicas\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 1\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Replication Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"ReplicationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"ReplicationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Replication Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"490\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Backup Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"BackupCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"BackupCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Backup Copy Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{ReplicationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"190\\\" \\r\\n| where JobType == 1\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Replication Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"ReplicationJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{ReplicationJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ReplicationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Replication Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BackupCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"490\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Replication Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"BackupCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"State\",\"sortOrder\":2}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{BackupCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"ReplicationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BackupCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Replication Jobs Drilldown - Copy\"}]},\"name\":\"Backup Copy & Replicas\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Tapes\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"194\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"200\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Copy Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeCopyJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeCopyJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Copy Jobs\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId == \\\"198\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by JobResultMessage = JobResultMessage \\r\\n| project JobResultMessage, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Tape Verification Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"TapeVerificationJobsStatus\",\"parameterType\":1},{\"parameterName\":\"TapeVerificationJobsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"Tape Verification Jobs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"194\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Tape Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeCopyJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"200\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Copy Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeCopyJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeCopyJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Tape Copy Jobs Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{TapeVerificationJobsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId == \\\"198\\\" \\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series\\r\\n| project Date = TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Tape Verification Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"TapeVerificationJobsMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{TapeVerificationJobsMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"TapeJobsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"TapeVerificationJobsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"TapeCopyJobsStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Tape Verification Jobs Drilldown\"}]},\"name\":\"Tapes - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Finished Jobs\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetFinishedConfigurationBackupSessions\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = Computer, User = user, State = Result, SyslogMessage, StringTime = tostring(TimeGenerated), Description\\r\\n\",\"size\":0,\"title\":\"Latest Configuration Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"StringTime\",\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\"},{\"fieldName\":\"SyslogMessage\",\"parameterName\":\"SyslogMessage\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"State\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"12ch\"}},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5},{\"columnMatch\":\"StringTime\",\"formatter\":5},{\"columnMatch\":\"Description\",\"formatter\":5}]},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Latest Configuration Backups\",\"styleSettings\":{\"margin\":\"3px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, StringTime = tostring(TimeGenerated), SyslogMessage\",\"size\":0,\"title\":\"Latest Finished Jobs\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"StringTime\",\"parameterName\":\"LatestFinishedJobsTime\",\"parameterType\":1},{\"fieldName\":\"SyslogMessage\",\"parameterName\":\"LatestFinishedJobsSyslogMessage\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"StringTime\",\"formatter\":5},{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Latest Finished Jobs\",\"styleSettings\":{\"margin\":\"3px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, StringTime = tostring(TimeGenerated)\\r\\n| where StringTime == \\\"{LatestFinishedJobsTime}\\\"\",\"size\":3,\"title\":\"Latest Finished Jobs Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"showPin\":false,\"name\":\"Latest Finished Jobs Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{LatestFinishedJobsSyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"LatestFinishedJobsTime\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Latest Finished Jobs Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetFinishedConfigurationBackupSessions\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| where tostring(TimeGenerated) == \\\"{Veeam_GetFinishedConfigurationBackupSessionsTime}\\\"\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = Computer, User = user, [\\\"Message Details\\\"] = Description, State = Result, SyslogMessage\",\"size\":3,\"title\":\"Latest Configuration Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"showPin\":false,\"name\":\"Latest Configuration Backups Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"Veeam_GetFinishedConfigurationBackupSessionsTime\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LatestFinishedJobsTime\",\"comparison\":\"isEqualTo\"}],\"name\":\"Latest Configuration Backups Drilldown\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobTypeDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":2,\"aggregation\":5,\"title\":\"Finished Jobs by Type\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"FinishedJobsByTypeTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"FinishedJobsByTypeStatus\",\"parameterType\":1},{\"parameterName\":\"FinishedJobsByTypeAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"group\":\"*\",\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Finished Jobs by Type\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetJobFinished\\r\\n| where instanceId in (\\\"40290\\\", \\\"40800\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), JobTypeDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":2,\"aggregation\":5,\"title\":\"Finished Restore Sessions by Type\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"FinishedRestoreSessionsByTypeTime\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"parameterType\":1},{\"parameterName\":\"FinishedRestoreSessionsByTypeAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Finished Restore Sessions by Type\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FinishedJobsByTypeAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId in (\\\"190\\\",\\\"40290\\\",\\\"790\\\",\\\"194\\\",\\\"490\\\",\\\"390\\\",\\\"36022\\\",\\\"36026\\\")\\r\\n| where Allowance\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobTypeDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SyslogMessage\",\"size\":0,\"title\":\"Finished Jobs by Type Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FinishedJobsByTypeStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"comparison\":\"isEqualTo\"}],\"name\":\"Finished Jobs by Type Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FinishedRestoreSessionsByTypeAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where instanceId in (\\\"40290\\\", \\\"40800\\\")\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.JobTypeDescription == $right.Series\\r\\n| project-away DateOnly, DateOnly1, Series\",\"size\":0,\"title\":\"Finished Restore Sessions by Type Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"FinishedJobsByTypeStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FinishedRestoreSessionsByTypeStatus\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Finished Restore Sessions by Type Drilldown\"}]},\"name\":\"Finished Jobs\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Failed Backups\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"150\\\", \\\"450\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend VmName = extract(\\\"VmName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| summarize Total = count() by VmName, JobResultMessage\\r\\n| evaluate pivot(JobResultMessage, sum(Total))\\r\\n| extend Failed = iff(column_ifexists(\\\"Failed\\\", 0) == 0, 0, column_ifexists(\\\"Failed\\\", 0)),\\r\\n Warning = iff(column_ifexists(\\\"Warning\\\", 0) == 0, 0, column_ifexists(\\\"Warning\\\", 0))\\r\\n| project VmName, Failed, Warning\\r\\n| order by Failed desc\\r\\n| take 15\\r\\n| render barchart\",\"size\":2,\"title\":\" Unsuccessful VM Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"UnsuccessfulVMBackupsName\",\"parameterType\":1},{\"fieldName\":\"label\",\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"parameterType\":1},{\"parameterName\":\"UnsuccessfulVMBackupsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"VmName\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"VmName\",\"yAxis\":[\"Warning\",\"Failed\"],\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Successful\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\" Unsuccessful VM Backups\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"151\\\", \\\"451\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend SourceName = extract(\\\"SourceName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| summarize Total = count() by SourceName, JobResultMessage\\r\\n| evaluate pivot(JobResultMessage, sum(Total))\\r\\n| extend Failed = iff(column_ifexists(\\\"Failed\\\", 0) == 0, 0, column_ifexists(\\\"Failed\\\", 0)),\\r\\n Warning = iff(column_ifexists(\\\"Warning\\\", 0) == 0, 0, column_ifexists(\\\"Warning\\\", 0))\\r\\n| project SourceName, Failed, Warning\\r\\n| order by Failed desc\\r\\n| take 15\\r\\n| render barchart\",\"size\":2,\"title\":\"Unsuccessful Unstructured Data Backups\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"chartSettings\":{\"xAxis\":\"SourceName\",\"yAxis\":[\"Failed\",\"Warning\"],\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Successful\",\"color\":\"green\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Unsuccessful Unstructured Data Backups\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{UnsuccessfulUnstructuredDataBackupAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series), X = tostring(parsed.x);\\r\\nlet session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"151\\\", \\\"451\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend SourceName = extract(\\\"SourceName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series, $left.SourceName == $right.X\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, SourceName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"title\":\"Unsuccessful Unstructured Data Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"SourceName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"SourceName\",\"sortOrder\":1}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Unsuccessful Unstructured Data Backups Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{UnsuccessfulVMBackupsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series), X = tostring(parsed.x);\\r\\nlet session_states_lookup = _GetWatchlist(\\\"session_states_lookup\\\"); \\r\\n\\r\\nVeeam_GetJobFinished\\r\\n| project TimeGenerated, Description, event_module, instanceId, original_host, Platform, Severity, Version, JobSessionID, JobID, JobResult, JobType, JobTypeDescription, Allowance, SyslogMessage\\r\\n| where instanceId in (\\\"150\\\", \\\"450\\\")\\r\\n| where JobResult in (\\\"2\\\", \\\"3\\\")\\r\\n| lookup kind=inner (session_states_lookup)\\r\\n on $left.JobResult == $right.JobResult\\r\\n| extend VmName = extract(\\\"VmName=\\\\\\\"([^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.JobResultMessage == $right.Series, $left.VmName == $right.X\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, [\\\"Message Details\\\"] = Description, [\\\"Job Type\\\"] = JobTypeDescription, State = JobResultMessage, VmName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"title\":\"Unsuccessful VM Backups Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"UnsuccessfulVMBackupsStatus\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"UnsuccessfulUnstructuredDataBackupsName\",\"comparison\":\"isEqualTo\"}],\"name\":\"Unsuccessful VM Backups Drilldown - Copy\"}]},\"name\":\"Failed Backups\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"sentinel-VeeamDataPlatformMonitoring\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", - "version": "1.0", - "sourceId": "[variables('workspaceResourceId')]", - "category": "sentinel" - } + "kind": "Watchlist", + "contentId": "[variables('_Veeam Collection Schedule Settings')]", + "version": "3.0.3" }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", - "properties": { - "description": "@{workbookKey=VeeamDataPlatformMonitoringWorkbook; logoFileName=VeeamLogo.svg; description=The Veeam Data Platform Monitoring dashboard shows an aggregated view of job activity on your Veeam Backup & Replication servers.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Veeam Data Platform Monitoring; templateRelativePath=VeeamDataPlatformMonitoring.json; subtitle=; provider=Veeam}.description", - "parentId": "[variables('workbookId1')]", - "contentId": "[variables('_workbookContentId1')]", - "kind": "Workbook", - "version": "[variables('workbookVersion1')]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "Syslog", - "kind": "DataType" - }, - { - "contentId": "Syslog", - "kind": "DataConnector" - } - ] - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_workbookContentId1')]", - "contentKind": "Workbook", - "displayName": "[parameters('workbook1-name')]", - "contentProductId": "[variables('_workbookcontentProductId1')]", - "id": "[variables('_workbookcontentProductId1')]", - "version": "[variables('workbookVersion1')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('workbookTemplateSpecName2')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "VeeamSecurityActivities Workbook with template version 3.0.3", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('workbookVersion2')]", - "parameters": {}, - "variables": {}, - "resources": [ + "kind": "Parser", + "contentId": "[variables('parserObject1').parserContentId1]", + "version": "[variables('parserObject1').parserVersion1]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject2').parserContentId2]", + "version": "[variables('parserObject2').parserVersion2]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject3').parserContentId3]", + "version": "[variables('parserObject3').parserVersion3]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject4').parserContentId4]", + "version": "[variables('parserObject4').parserVersion4]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", + "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]", + "version": "[variables('analyticRuleObject11').analyticRuleVersion11]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]", + "version": "[variables('analyticRuleObject12').analyticRuleVersion12]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]", + "version": "[variables('analyticRuleObject13').analyticRuleVersion13]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]", + "version": "[variables('analyticRuleObject14').analyticRuleVersion14]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]", + "version": "[variables('analyticRuleObject15').analyticRuleVersion15]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]", + "version": "[variables('analyticRuleObject16').analyticRuleVersion16]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]", + "version": "[variables('analyticRuleObject17').analyticRuleVersion17]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]", + "version": "[variables('analyticRuleObject18').analyticRuleVersion18]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject19')._analyticRulecontentId19]", + "version": "[variables('analyticRuleObject19').analyticRuleVersion19]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject20')._analyticRulecontentId20]", + "version": "[variables('analyticRuleObject20').analyticRuleVersion20]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject21')._analyticRulecontentId21]", + "version": "[variables('analyticRuleObject21').analyticRuleVersion21]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject22')._analyticRulecontentId22]", + "version": "[variables('analyticRuleObject22').analyticRuleVersion22]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject23')._analyticRulecontentId23]", + "version": "[variables('analyticRuleObject23').analyticRuleVersion23]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject24')._analyticRulecontentId24]", + "version": "[variables('analyticRuleObject24').analyticRuleVersion24]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject25')._analyticRulecontentId25]", + "version": "[variables('analyticRuleObject25').analyticRuleVersion25]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject26')._analyticRulecontentId26]", + "version": "[variables('analyticRuleObject26').analyticRuleVersion26]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject27')._analyticRulecontentId27]", + "version": "[variables('analyticRuleObject27').analyticRuleVersion27]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject28')._analyticRulecontentId28]", + "version": "[variables('analyticRuleObject28').analyticRuleVersion28]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject29')._analyticRulecontentId29]", + "version": "[variables('analyticRuleObject29').analyticRuleVersion29]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject30')._analyticRulecontentId30]", + "version": "[variables('analyticRuleObject30').analyticRuleVersion30]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject31')._analyticRulecontentId31]", + "version": "[variables('analyticRuleObject31').analyticRuleVersion31]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject32')._analyticRulecontentId32]", + "version": "[variables('analyticRuleObject32').analyticRuleVersion32]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject33')._analyticRulecontentId33]", + "version": "[variables('analyticRuleObject33').analyticRuleVersion33]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject34')._analyticRulecontentId34]", + "version": "[variables('analyticRuleObject34').analyticRuleVersion34]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject35')._analyticRulecontentId35]", + "version": "[variables('analyticRuleObject35').analyticRuleVersion35]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject36')._analyticRulecontentId36]", + "version": "[variables('analyticRuleObject36').analyticRuleVersion36]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject37')._analyticRulecontentId37]", + "version": "[variables('analyticRuleObject37').analyticRuleVersion37]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject38')._analyticRulecontentId38]", + "version": "[variables('analyticRuleObject38').analyticRuleVersion38]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject39')._analyticRulecontentId39]", + "version": "[variables('analyticRuleObject39').analyticRuleVersion39]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject40')._analyticRulecontentId40]", + "version": "[variables('analyticRuleObject40').analyticRuleVersion40]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject41')._analyticRulecontentId41]", + "version": "[variables('analyticRuleObject41').analyticRuleVersion41]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject42')._analyticRulecontentId42]", + "version": "[variables('analyticRuleObject42').analyticRuleVersion42]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject43')._analyticRulecontentId43]", + "version": "[variables('analyticRuleObject43').analyticRuleVersion43]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject44')._analyticRulecontentId44]", + "version": "[variables('analyticRuleObject44').analyticRuleVersion44]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject45')._analyticRulecontentId45]", + "version": "[variables('analyticRuleObject45').analyticRuleVersion45]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject46')._analyticRulecontentId46]", + "version": "[variables('analyticRuleObject46').analyticRuleVersion46]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject47')._analyticRulecontentId47]", + "version": "[variables('analyticRuleObject47').analyticRuleVersion47]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject48')._analyticRulecontentId48]", + "version": "[variables('analyticRuleObject48').analyticRuleVersion48]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject49')._analyticRulecontentId49]", + "version": "[variables('analyticRuleObject49').analyticRuleVersion49]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject50')._analyticRulecontentId50]", + "version": "[variables('analyticRuleObject50').analyticRuleVersion50]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject51')._analyticRulecontentId51]", + "version": "[variables('analyticRuleObject51').analyticRuleVersion51]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject52')._analyticRulecontentId52]", + "version": "[variables('analyticRuleObject52').analyticRuleVersion52]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject53')._analyticRulecontentId53]", + "version": "[variables('analyticRuleObject53').analyticRuleVersion53]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject54')._analyticRulecontentId54]", + "version": "[variables('analyticRuleObject54').analyticRuleVersion54]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject55')._analyticRulecontentId55]", + "version": "[variables('analyticRuleObject55').analyticRuleVersion55]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject56')._analyticRulecontentId56]", + "version": "[variables('analyticRuleObject56').analyticRuleVersion56]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject57')._analyticRulecontentId57]", + "version": "[variables('analyticRuleObject57').analyticRuleVersion57]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject58')._analyticRulecontentId58]", + "version": "[variables('analyticRuleObject58').analyticRuleVersion58]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject59')._analyticRulecontentId59]", + "version": "[variables('analyticRuleObject59').analyticRuleVersion59]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject60')._analyticRulecontentId60]", + "version": "[variables('analyticRuleObject60').analyticRuleVersion60]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject61')._analyticRulecontentId61]", + "version": "[variables('analyticRuleObject61').analyticRuleVersion61]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject62')._analyticRulecontentId62]", + "version": "[variables('analyticRuleObject62').analyticRuleVersion62]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject63')._analyticRulecontentId63]", + "version": "[variables('analyticRuleObject63').analyticRuleVersion63]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject64')._analyticRulecontentId64]", + "version": "[variables('analyticRuleObject64').analyticRuleVersion64]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject65')._analyticRulecontentId65]", + "version": "[variables('analyticRuleObject65').analyticRuleVersion65]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject66')._analyticRulecontentId66]", + "version": "[variables('analyticRuleObject66').analyticRuleVersion66]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject67')._analyticRulecontentId67]", + "version": "[variables('analyticRuleObject67').analyticRuleVersion67]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject68')._analyticRulecontentId68]", + "version": "[variables('analyticRuleObject68').analyticRuleVersion68]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject69')._analyticRulecontentId69]", + "version": "[variables('analyticRuleObject69').analyticRuleVersion69]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject70')._analyticRulecontentId70]", + "version": "[variables('analyticRuleObject70').analyticRuleVersion70]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject71')._analyticRulecontentId71]", + "version": "[variables('analyticRuleObject71').analyticRuleVersion71]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject72')._analyticRulecontentId72]", + "version": "[variables('analyticRuleObject72').analyticRuleVersion72]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject73')._analyticRulecontentId73]", + "version": "[variables('analyticRuleObject73').analyticRuleVersion73]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject74')._analyticRulecontentId74]", + "version": "[variables('analyticRuleObject74').analyticRuleVersion74]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject75')._analyticRulecontentId75]", + "version": "[variables('analyticRuleObject75').analyticRuleVersion75]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject76')._analyticRulecontentId76]", + "version": "[variables('analyticRuleObject76').analyticRuleVersion76]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject77')._analyticRulecontentId77]", + "version": "[variables('analyticRuleObject77').analyticRuleVersion77]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject78')._analyticRulecontentId78]", + "version": "[variables('analyticRuleObject78').analyticRuleVersion78]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject79')._analyticRulecontentId79]", + "version": "[variables('analyticRuleObject79').analyticRuleVersion79]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject80')._analyticRulecontentId80]", + "version": "[variables('analyticRuleObject80').analyticRuleVersion80]" + }, { - "type": "Microsoft.Insights/workbooks", - "name": "[variables('workbookContentId2')]", - "location": "[parameters('workspace-location')]", - "kind": "shared", - "apiVersion": "2021-08-01", - "metadata": { - "description": "The Veeam Security Activities dashboard shows an aggregated view of security events from your Veeam Backup & Replication servers and Veeam ONE servers, as well as Coveware findings." - }, - "properties": { - "displayName": "[parameters('workbook2-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"bb18f0f1-0893-479d-83fe-9cca36e33b43\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"value\":{\"durationMs\":2592000000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"d559890f-2663-49a6-af45-3dfc1fa7fda0\",\"cellValue\":\"isRest\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Syslog\",\"subTarget\":\"0\",\"preText\":\"d\",\"postText\":\"d\",\"style\":\"secondary\"},{\"id\":\"aee69a87-0e6f-4aab-ab21-14423e4d2d3d\",\"cellValue\":\"isRest\",\"linkTarget\":\"parameter\",\"linkLabel\":\"REST\",\"subTarget\":\"1\",\"style\":\"link\"}]},\"name\":\"links - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"3ec1d354-0588-43dd-b3e5-7ebab2195c40\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"host_token\",\"label\":\"Veeam Backup & Replication Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| summarize by original_host\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"26fbaaa0-3b0f-4506-885b-9fd8cd87ece9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vone_host_token\",\"label\":\"Veeam ONE Data Sources\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| summarize by VoneHostName\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":1209600000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"parameters - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"3b155c6e-4243-4c04-8675-3901414969df\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vbr_host_name\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"union \\r\\n (VeeamMalwareEvents_CL | where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}),\\r\\n (VeeamAuthorizationEvents_CL | where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}),\\r\\n (VeeamSecurityComplianceAnalyzer_CL\\r\\n | where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end})\\r\\n \\r\\n | summarize by VbrHostName\\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Veeam Backup & Replication Data Sources\"},{\"id\":\"f3074530-90f9-44b3-96a4-6141a273e18b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"vone_host_name\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"VeeamOneTriggeredAlarms_CL \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize by VoneHostName\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Veeam ONE Data Sources\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"parameters - rest\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Custom Tables Events Overview\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by Status\\n| top 20 by Count\\n| project Status, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam ONE Triggered Alarms by Status\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Success\",\"color\":\"green\"},{\"seriesName\":\"Resolved\",\"color\":\"blue\"},{\"seriesName\":\"Error\",\"color\":\"redBright\"}]}},\"customWidth\":\"25\",\"name\":\"query - vone-alarms-status\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| summarize Count = count() by Severity\\n| top 20 by Count\\n| project Severity, Count\\n| render piechart\",\"size\":3,\"title\":\"Malware Events by Severity\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"MalwareEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Infected\",\"color\":\"redBright\"},{\"seriesName\":\"Clean\",\"color\":\"green\"}]}},\"customWidth\":\"25\",\"name\":\"query - malware-severity\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n| summarize Count = count() by State\\n| top 20 by Count\\n| project State, Count\\n| render piechart\",\"size\":3,\"title\":\"Authorization Events by State\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"ProcessedTime\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"ProcessedTime\",\"sortOrder\":2}],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Approved\",\"color\":\"green\"},{\"seriesName\":\"Info\",\"color\":\"blue\"},{\"seriesName\":\"Rejected\",\"color\":\"redBright\"}]}},\"customWidth\":\"25\",\"name\":\"query - authorization-state\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamSecurityComplianceAnalyzer_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\n| summarize Count = count() by Status\\n| top 20 by Count\\n| project Status, Count\\n| render piechart\",\"size\":3,\"title\":\"Security & Compliance Analyzer Results by Status\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"BestPracticesAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Violation\",\"color\":\"redBright\"},{\"seriesName\":\"OK\",\"color\":\"green\"},{\"seriesName\":\"UnableToCheck\",\"color\":\"orange\"}]}},\"customWidth\":\"25\",\"name\":\"query - best-practices-status\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VoneTriggeredAlarmsStatusRestAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamOneTriggeredAlarms_CL\\r\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\r\\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| join kind=inner (filters) on $left.Status == $right.Series\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"title\":\"Veeam ONE Triggered Alarms by Status Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"VeeamONETriggeredAlarmsDrilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{AuthorizationEventsStateAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamAuthorizationEvents_CL\\r\\n| where \\\"'All'\\\" == \\\"{vbr_host_name}\\\" or VbrHostName in ({vbr_host_name}) \\r\\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\r\\n| where State in (toscalar(filters | summarize make_set(Series)))\\r\\n| project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\",\"size\":0,\"title\":\"Authorization Events by State Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Authorization Events Drilldown \"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{MalwareEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamMalwareEvents_CL\\r\\n| where \\\"'All'\\\" == \\\"{vbr_host_name}\\\" or VbrHostName in ({vbr_host_name}) \\r\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\r\\n| where Severity in (toscalar(filters | summarize make_set(Series)))\\r\\n| project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\",\"size\":0,\"title\":\"Malware Events by Severity Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"MalwareEventsDrilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{BestPracticesAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\n\\r\\nVeeamSecurityComplianceAnalyzer_CL\\r\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name})\\r\\n| join kind=inner (filters) on $left.Status == $right.Series\\r\\n| project TimeGenerated, VbrHostName, Status, Id, BestPractice, Note\",\"size\":0,\"title\":\"Security & Compliance Analyzer Results by Status Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MalwareEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VoneTriggeredAlarmsStatusRestAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"AuthorizationEventsStateAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"BestPracticesAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"BestPracticesAnalysisDrilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by Name\\n| top 20 by Count\\n| project Name, Count\\n| render piechart\",\"size\":3,\"title\":\"Veeam ONE Triggered Alarms by Name\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"label\",\"parameterName\":\"VoneTriggeredAlarmsName\"},{\"parameterName\":\"VoneTriggeredAlarmsNamesRestAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Success\",\"color\":\"yellow\"}]}},\"customWidth\":\"33\",\"name\":\"query - vone-alarms-name\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n// Wrap the parameter in [] to form a JSON array → remove extra quotes around each object via regex → parse to dynamic → expand into rows → parse each element into JSON → extract 'series' as text\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VoneTriggeredAlarmsNamesRestAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\nVeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| where Name in (toscalar(filters | summarize make_set(Series)))\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"title\":\"Veeam ONE Triggered Alarms by Name Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"VoneTriggeredAlarmsName\",\"comparison\":\"isNotEqualTo\"},\"name\":\"VeeamONETriggeredAlarmsDrilldown - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| where Severity == \\\"Infected\\\"\\n| count\",\"size\":2,\"title\":\"Infected Files Detected\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"stat\",\"statSettings\":{\"showBorder\":false,\"colorSettings\":{\"colorizeBody\":true,\"thresholds\":[{\"criteria\":\"isGreaterThan\",\"value\":\"0\",\"color\":\"red\"}]}}},\"customWidth\":\"33\",\"name\":\"infected-files-stat\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union \\n (VeeamOneTriggeredAlarms_CL | where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}),\\n (VeeamMalwareEvents_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) | where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}),\\n (VeeamAuthorizationEvents_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) | where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}),\\n (VeeamSecurityComplianceAnalyzer_CL | where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where TimeGenerated >= {TimeRange:start} and TimeGenerated <= {TimeRange:end}),\\n (VeeamCovewareFindings_CL | where EventTime >= {TimeRange:start} and EventTime <= {TimeRange:end})\\n| summarize Count = count() by Type\\n| project [\\\"Event Type\\\"] = Type, Count\\n| render piechart\",\"size\":3,\"title\":\"All Custom Table Events by Type\",\"exportFieldName\":\"Event Type\",\"exportParameterName\":\"CustomTableEventType\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"33\",\"name\":\"query - custom-tables-distribution\"},{\"type\":1,\"content\":{\"json\":\"## Daily Trends\"},\"name\":\"text - daily-trends\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Coveware Findings\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| summarize Count = count() by EventType\\r\\n| top 20 by Count\\r\\n| project EventType, Count\\r\\n| render piechart\",\"size\":3,\"title\":\"Coveware Findings by Name\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"CovewareFindingsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"yAxis\":[\"Count\"],\"group\":\"EventType\",\"createOtherGroup\":0,\"showMetrics\":true,\"showLegend\":false}},\"customWidth\":\"30\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| summarize Count = count() by DateOnly = startofday(EventTime), RiskLevel\\r\\n| order by DateOnly asc\\r\\n| render timechart\",\"size\":0,\"title\":\"Daily Coveware Findings by Risk Level\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"CovewareRiskLevelAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"medium\",\"color\":\"orange\"},{\"seriesName\":\"low\",\"color\":\"blue\"},{\"seriesName\":\"high\",\"color\":\"redBright\"},{\"seriesName\":\"critical\",\"color\":\"purple\"}]}},\"customWidth\":\"70\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Step 1: Parse the Sentinel widget export into a filter table\\r\\nlet filters =\\r\\n print arr = parse_json(\\r\\n replace(\\r\\n @\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", \\r\\n @\\\"\\\\1\\\", \\r\\n strcat('[', '{CovewareFindingsNameAllFields}', ']')\\r\\n )\\r\\n )\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Filter main table by matching series\\r\\nVeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n| where EventType in (toscalar(filters | summarize make_set(Series)))\\r\\n| project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings by Name Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibilities\":[{\"parameterName\":\"CovewareFindingsNameAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"CovewareRiskLevelAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Step 1: Parse the Sentinel widget export into a filter table\\r\\nlet filters =\\r\\n print arr = parse_json(\\r\\n replace(\\r\\n @\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", \\r\\n @\\\"\\\\1\\\", \\r\\n strcat('[', '{CovewareRiskLevelAllFields}', ']')\\r\\n )\\r\\n )\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n | extend DateOnly = startofday(EventTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.RiskLevel == $right.Series\\r\\n| project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings by Risk Level Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"EventTime\",\"formatter\":6},{\"columnMatch\":\"EventActivity\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"92.8571ch\"}}]}},\"conditionalVisibilities\":[{\"parameterName\":\"CovewareFindingsNameAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"CovewareRiskLevelAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"query - 4 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamCovewareFindings_CL\\r\\n| where EventTime >= {TimeRange:start}\\r\\n| where EventTime <= {TimeRange:end}\\r\\n | order by EventTime desc | project EventTime, RiskLevel, Artifact, EventType, TechniqueId, Hostname, EventActivity, Id, MachineId, FirstRunOrAccessed, Md5Hash, Sha1Hash, Sha256Hash\",\"size\":0,\"title\":\"Coveware Findings Details\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 2\"}]},\"name\":\"group - 17\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n| summarize Count = count() by bin(TriggeredTime, 1d), Status\\n| order by TriggeredTime asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Veeam ONE Triggered Alarms\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Warning\",\"color\":\"orange\"},{\"seriesName\":\"Error\",\"color\":\"redBright\"}]}},\"customWidth\":\"50\",\"name\":\"daily-vone-alarms\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n| summarize Count = count() by bin(DetectionTimeUtc, 1d), Severity\\n| order by DetectionTimeUtc asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Malware Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyMalwareEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Infected\",\"color\":\"redBright\"},{\"seriesName\":\"Clean\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"daily-malware-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamONETriggeredAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(TriggeredTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.Status == $right.Series\\r\\n| project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\",\"size\":0,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"Comment\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Comment\",\"sortOrder\":1}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"DailyMalwareEventsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"query - 23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyMalwareEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeamMalwareEvents_CL\\r\\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(DetectionTimeUtc)\\r\\n| join kind=inner (filters) on DateOnly, $left.Severity == $right.Series\\r\\n| project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\",\"size\":0,\"title\":\"Daily Malware Events Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamONETriggeredAlarmsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"DailyMalwareEventsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"query - 23 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n| summarize Count = count() by bin(ProcessedTime, 1d), State\\n| order by ProcessedTime asc\\n| render timechart\",\"size\":0,\"title\":\"Daily Four-Eyes Authorization Events\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyFourEyesAuthorizationEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Approved\",\"color\":\"green\"},{\"seriesName\":\"Info\",\"color\":\"blue\"},{\"seriesName\":\"Rejected\",\"color\":\"redBright\"}]}},\"customWidth\":\"100\",\"name\":\"daily-authorization-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyFourEyesAuthorizationEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\nVeeamAuthorizationEvents_CL\\r\\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\r\\n| extend DateOnly = startofday(ProcessedTime)\\r\\n| join kind=inner (filters) on DateOnly, $left.State == $right.Series\\r\\n| project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\\r\\n\",\"size\":0,\"title\":\"Daily Four-Eyes Authorization Events Drilldown\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"DailyFourEyesAuthorizationEventsAllFields\",\"comparison\":\"isNotEqualTo\"},\"name\":\"query - 23 - Copy - Copy\"},{\"type\":1,\"content\":{\"json\":\"## Latest Events\"},\"name\":\"text - latest-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamOneTriggeredAlarms_CL\\n| where \\\"'All'\\\" == \\\"{vone_host_name}\\\" or VoneHostName in ({vone_host_name}) \\n| where TriggeredTime >= {TimeRange:start} and TriggeredTime <= {TimeRange:end}\\n | order by TriggeredTime desc | project TriggeredTime, VoneHostName, TriggeredAlarmId, Name, AlarmTemplateId, PredefinedAlarmId, Status, Description, Comment, RepeatCount, ObjectId, ObjectName, ObjectType, ChildAlarmsCount, RemediationDescription, RemediationMode\\n| top 15 by TriggeredTime desc\",\"size\":0,\"title\":\"Latest Veeam ONE Triggered Alarms\",\"exportFieldName\":\"Alarm Name\",\"exportParameterName\":\"SelectedVoneAlarm\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-vone-alarms\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamMalwareEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where DetectionTimeUtc >= {TimeRange:start} and DetectionTimeUtc <= {TimeRange:end}\\n | order by DetectionTimeUtc desc | project DetectionTime = DetectionTimeUtc, MalwareEventType, VbrHostName, MalwareState, Source, Severity, Id, MachineDisplayName, MachineUuid, MachineBackupObjectId, Details, CreatedBy, Engine\\n| top 15 by DetectionTime desc\",\"size\":0,\"title\":\"Latest Malware Events\",\"exportFieldName\":\"Machine\",\"exportParameterName\":\"SelectedMalwareMachine\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-malware-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamAuthorizationEvents_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n| where ProcessedTime >= {TimeRange:start} and ProcessedTime <= {TimeRange:end}\\n | order by ProcessedTime desc | project ProcessedTime, VbrHostName, CreatedBy, CreationTime, Description, ExpirationTime, Id, Name, ProcessedBy, State\\n\",\"size\":0,\"title\":\"Latest Authorization Events\",\"exportFieldName\":\"Event Name\",\"exportParameterName\":\"SelectedAuthEvent\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-authorization-events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"VeeamSecurityComplianceAnalyzer_CL\\n| where \\\"{vbr_host_name}\\\" == \\\"'All'\\\" or VbrHostName in ({vbr_host_name}) \\n | order by TimeGenerated desc | project TimeGenerated, VbrHostName, Status, Id, BestPractice, Note\\n| top 15 by TimeGenerated desc\",\"size\":0,\"title\":\"Latest Security & Compliance Analysis\",\"exportFieldName\":\"Best Practice\",\"timeContextFromParameter\":\"TimeRange\",\"exportParameterName\":\"SelectedBestPractice\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"latest-best-practices\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"REST Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Overview\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\n| summarize Count = count() by [\\\"SeverityDescription\\\"]\\n| top 20 by Count\\n| project [\\\"SeverityDescription\\\"], Count\\n| render piechart \\n\",\"size\":3,\"title\":\"Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\" or SyslogMessage has \\\"predefined_alarm_id\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| extend predefined_alarm_id = extract(\\\"predefined_alarm_id=\\\\\\\"(\\\\\\\\d+)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| extend eventId = strcat(\\r\\n tostring(extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage)), \\r\\n tostring(extract(\\\"predefined_alarm_id=\\\\\\\"(\\\\\\\\d+)\\\\\\\"\\\", 1, SyslogMessage))\\r\\n)\\r\\n| where eventId in (\\\"41600\\\",\\\"42220\\\",\\\"25500\\\",\\\"26100\\\",\\\"28100\\\",\\\"28970\\\",\\\"29800\\\",\\\"30100\\\",\\\"30400\\\",\\\"31500\\\",\\\"31600\\\",\\\"31700\\\",\\\"31800\\\",\\\"31900\\\",\\\"40204\\\",\\\"40400\\\",\\\"40500\\\",\\\"40600\\\",\\\"42260\\\",\\\"42270\\\",\\\"42302\\\",\\\"23090\\\",\\\"23420\\\",\\\"24080\\\",\\\"28200\\\",\\\"28500\\\",\\\"28920\\\",\\\"28950\\\",\\\"28980\\\",\\\"29120\\\",\\\"29150\\\",\\\"29900\\\",\\\"30200\\\",\\\"30500\\\",\\\"32120\\\",\\\"32200\\\",\\\"41402\\\",\\\"115\\\",\\\"31210\\\",\\\"31400\\\",\\\"40201\\\",\\\"40205\\\",\\\"40206\\\",\\\"41610\\\",\\\"42230\\\",\\\"42301\\\",\\\"42401\\\",\\\"42402\\\",\\\"42404\\\",\\\"42405\\\",\\\"21224\\\",\\\"26110\\\",\\\"31200\\\",\\\"36013\\\",\\\"42210\\\",\\\"42500\\\",\\\"27000\\\",\\\"24060\\\",\\\"24030\\\",\\\"24050\\\",\\\"24070\\\",\\\"24040\\\",\\\"42290\\\",\\\"23630\\\",\\\"23631\\\",\\\"23632\\\",\\\"23633\\\",\\\"24020\\\",\\\"24114\\\",\\\"24131\\\",\\\"24140\\\",\\\"24142\\\",\\\"24143\\\",\\\"24160\\\",\\\"24170\\\",\\\"25000\\\",\\\"25210\\\",\\\"25220\\\",\\\"25400\\\",\\\"25700\\\",\\\"25800\\\",\\\"26000\\\",\\\"26600\\\",\\\"26700\\\",\\\"26800\\\",\\\"26900\\\",\\\"27200\\\",\\\"27300\\\",\\\"27500\\\",\\\"27600\\\",\\\"27900\\\",\\\"28400\\\",\\\"28800\\\",\\\"28850\\\",\\\"28940\\\",\\\"29110\\\",\\\"29140\\\",\\\"30700\\\",\\\"30800\\\",\\\"31000\\\",\\\"32100\\\",\\\"32400\\\",\\\"32800\\\",\\\"40202\\\",\\\"41200\\\",\\\"41401\\\",\\\"42280\\\",\\\"395\\\", \\\"364\\\", \\\"369\\\", \\\"391\\\", \\\"365\\\", \\\"370\\\", \\\"314\\\", \\\"331\\\", \\\"376\\\", \\\"377\\\", \\\"403\\\", \\\"316\\\", \\\"342\\\", \\\"381\\\", \\\"315\\\", \\\"332\\\", \\\"344\\\",\\\"378\\\")\\r\\n| extend host = Computer\\r\\n| count\",\"size\":0,\"title\":\"All Security Activities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"stat\",\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"All Security Activities\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\n| summarize Count = count() by SeverityDescription\\n| top 20 by Count\\n| render piechart\\n\",\"size\":3,\"title\":\"Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamONEAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| join kind=inner (filters) on $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Veeam ONE Alarms Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam ONE Alarms by Severity Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamBackupAndReplicationSecurityEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Veeam Backup & Replication Security Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Veeam Backup & Replication Security Events Drilldown\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| summarize Count = count() by [\\\"Event Name\\\"]\\r\\n| project [\\\"Event Name\\\"], Count\\r\\n| render piechart \",\"size\":3,\"title\":\"Veeam ONE Alarms by Name\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by [\\\"Event Name\\\"]\\r\\n| top 20 by Count\\r\\n| render piechart\\r\\n\",\"size\":3,\"title\":\"Veeam Backup & Replication Security Events by Name\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"createOtherGroup\":0,\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Medium\",\"color\":\"yellow\"},{\"seriesName\":\"High\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamONEAlarmsNameAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| join kind=inner (filters) on $left.[\\\"Event Name\\\"] == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Veeam ONE Alarms Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Veeam ONE Alarms by Name Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{VeeamBackupAndReplicationSecurityEventsNameAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| join kind=inner (filters) on $left.[\\\"Event Name\\\"] == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Veeam Backup & Replication Security Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}],\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Message Details\",\"sortOrder\":1}]},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"VeeamBackupAndReplicationSecurityEventsNameAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VeeamONEAlarmsNameAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Veeam Backup & Replication Security Events Drilldown - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where instanceId == \\\"42220\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Marked as Infected\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"MarkedAsInfectedCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Marked as Infected\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| extend original_host = Computer\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Four-Eyes Authorization Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"FourEyesAuthorizationEventsCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Four-Eyes Authorization Events\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Syslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"41600\\\"\\r\\n| extend original_host = Computer\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| count\",\"size\":3,\"title\":\"Marked as Suspicious\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"Count\",\"exportParameterName\":\"MarkedAsSuspiciousCount\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"}},\"showBorder\":false},\"statSettings\":{\"valueAggregation\":\"None\",\"colorSettings\":{\"type\":\"static\",\"mode\":\"background\",\"heatmapPalette\":\"greenRed\"},\"tagText\":\"\",\"valueFontStyle\":\"mega\"}},\"customWidth\":\"33\",\"name\":\"Marked as Suspicious\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Four-Eyes Authorization Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Four-Eyes Authorization Events Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42220\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Marked as Infected Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Marked as Infected Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"41600\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Four-Eyes Authorization Events Drilldown\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"MarkedAsInfectedCount\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"MarkedAsSuspiciousCount\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"FourEyesAuthorizationEventsCount\",\"comparison\":\"isEqualTo\"}],\"name\":\"Four-Eyes Authorization Events Drilldown\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Overview\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Daily Security Activities\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription\",\"size\":0,\"aggregation\":5,\"title\":\"Daily Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"Critical\",\"color\":\"purple\"},{\"seriesName\":\"High\",\"color\":\"redBright\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"}]}},\"customWidth\":\"50\",\"name\":\"Daily Veeam Backup & Replication Security Events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), SeverityDescription\\r\\n| order by TimeGenerated asc\\r\\n| render timechart \",\"size\":0,\"aggregation\":5,\"title\":\" Daily Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"\",\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"purple\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Information\",\"color\":\"blue\"},{\"seriesName\":\"High\",\"color\":\"redBright\"}]}},\"customWidth\":\"50\",\"name\":\" Daily Veeam ONE Alarms\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamBackupReplicationSecurityEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, Severity = SeverityDescription, SyslogMessage\\r\\n\",\"size\":0,\"title\":\"Daily Veeam Backup & Replication Security Events Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"comparison\":\"isEqualTo\"}],\"name\":\"Daily Veeam Backup & Replication Security Events Drilldown\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{DailyVeeamONEAlarmsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nVeeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.SeverityDescription == $right.Series\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Daily Veeam ONE Alarms Drilldown\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"DailyVeeamBackupReplicationSecurityEventsAllFields\",\"comparison\":\"isEqualTo\"},{\"parameterName\":\"DailyVeeamONEAlarmsAllFields\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"Daily Veeam ONE Alarms Drilldown - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Daily Security Activities\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Latest Security Activities\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetSecurityEvents\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or original_host in ({host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = original_host, User = user, [\\\"Message Details\\\"] = Description, SeverityDescription, SyslogMessage\",\"size\":0,\"title\":\"Latest Veeam Backup & Replication Security Events\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VBRSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"Latest Veeam Backup & Replication Security Events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Veeam_GetVeeamONEAlarms\\r\\n| where \\\"{vone_host_token}\\\" == \\\"'All'\\\" or VoneHostName in ({vone_host_token})\\r\\n| project TimeGenerated, [\\\"Data Source\\\"] = VoneHostName, [\\\"Alarm Name\\\"] = alarm_name, Severity = SeverityDescription, [\\\"Alarm Type\\\"] = alarm_name, [\\\"Message Details\\\"] = alarm_details, [\\\"Previous Status\\\"] = status_old, [\\\"Current Status\\\"] = status_new, [\\\"Object Name\\\"] = object_name, [\\\"Object Path\\\"] = object_path, SyslogMessage\",\"size\":0,\"title\":\"Latest Veeam ONE Alarms\",\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"VoneSyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"customWidth\":\"50\",\"name\":\"Latest Veeam ONE Alarms\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VBRSyslogMessage}\\r\\n```\"},\"conditionalVisibilities\":[{\"parameterName\":\"VBRSyslogMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VoneSyslogMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"text - 3\"},{\"type\":1,\"content\":{\"json\":\"Syslog message:\\r\\n```\\r\\n{VoneSyslogMessage}\\r\\n```\"},\"conditionalVisibilities\":[{\"parameterName\":\"VoneSyslogMessage\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"VBRSyslogMessage\",\"comparison\":\"isEqualTo\"}],\"name\":\"text - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Latest Security Activities\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Four-Eyes Authorization Events\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let watchlist = _GetWatchlist(\\\"operation_names_lookup\\\"); \\r\\nSyslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| extend OperationId = extract(\\\"OperationId=\\\\\\\"(?[^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| lookup kind=inner (watchlist) \\r\\n on $left.OperationId == $right.[\\\"Operation Id\\\"]\\r\\n| summarize Count = count() by bin(TimeGenerated, 1d), OperationName\\r\\n\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"exportMultipleValues\":true,\"exportedParameters\":[{\"parameterName\":\"FourEyesAuthorizationEventsAllFields\",\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"query - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let watchlist = _GetWatchlist(\\\"operation_names_lookup\\\"); \\r\\n\\r\\nlet filters =\\r\\n print arr = parse_json(replace(@\\\"\\\\\\\"\\\"(\\\\{.*?\\\\})\\\\\\\"\\\"\\\", @\\\"\\\\1\\\", strcat('[', '{FourEyesAuthorizationEventsAllFields}', ']')))\\r\\n | mv-expand elem = arr\\r\\n | extend parsed = parse_json(tostring(elem))\\r\\n | project DateOnly = startofday(todatetime(parsed.x)), Series = tostring(parsed.series);\\r\\n\\r\\n// Step 2: Join main table with filters on both Date and Series\\r\\nSyslog\\r\\n| where SyslogMessage has \\\"instanceId\\\"\\r\\n| extend instanceId = extract(\\\"instanceId=(\\\\\\\\d+)\\\", 1, SyslogMessage) \\r\\n| where instanceId == \\\"42402\\\"\\r\\n| where \\\"{host_token}\\\" == \\\"'All'\\\" or Computer in ({host_token})\\r\\n| extend OperationId = extract(\\\"OperationId=\\\\\\\"(?[^\\\\\\\"]*)\\\\\\\"\\\", 1, SyslogMessage)\\r\\n| lookup kind=inner (watchlist) \\r\\n on $left.OperationId == $right.[\\\"Operation Id\\\"]\\r\\n| extend DateOnly = startofday(TimeGenerated)\\r\\n| join kind=inner (filters) on DateOnly, $left.OperationName == $right.Series\\r\\n| project TimeGenerated, Computer, EventTime, Facility, HostName, SeverityLevel, instanceId, OperationId, LastUpdatedTime = LastUpdatedTimeUTC, SearchKey, OperationName, SyslogMessage\\r\\n\\r\\n\",\"size\":0,\"exportFieldName\":\"SyslogMessage\",\"exportParameterName\":\"SyslogMessage\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SyslogMessage\",\"formatter\":5}]}},\"name\":\"query - 0\"},{\"type\":1,\"content\":{\"json\":\"Syslog message\\r\\n```\\r\\n{SyslogMessage}\\r\\n```\"},\"name\":\"text - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"FourEyesAuthorizationEventsAllFields\",\"comparison\":\"isNotEqualTo\"},\"name\":\"group - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isRest\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"Four-Eyes Authorization Events\"}],\"fromTemplateId\":\"sentinel-VeeamSecurityActivities\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", - "version": "1.0", - "sourceId": "[variables('workspaceResourceId')]", - "category": "sentinel" - } + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject81')._analyticRulecontentId81]", + "version": "[variables('analyticRuleObject81').analyticRuleVersion81]" }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]", - "properties": { - "description": "@{workbookKey=VeeamSecurityActivitiesWorkbook; logoFileName=VeeamLogo.svg; description=The Veeam Security Activities dashboard shows an aggregated view of security events from your Veeam Backup & Replication servers and Veeam ONE servers, as well as Coveware findings.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Veeam Security Activities; templateRelativePath=VeeamSecurityActivities.json; subtitle=; provider=Veeam}.description", - "parentId": "[variables('workbookId2')]", - "contentId": "[variables('_workbookContentId2')]", - "kind": "Workbook", - "version": "[variables('workbookVersion2')]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "VeeamMalwareEvents_CL", - "kind": "DataType" - }, - { - "contentId": "VeeamAuthorizationEvents_CL", - "kind": "DataType" - }, - { - "contentId": "VeeamOneTriggeredAlarms_CL", - "kind": "DataType" - }, - { - "contentId": "VeeamSecurityComplianceAnalyzer_CL", - "kind": "DataType" - }, - { - "contentId": "VeeamCovewareFindings_CL", - "kind": "DataType" - }, - { - "contentId": "Syslog", - "kind": "DataType" - }, - { - "contentId": "VeeamCustomTablesDataConnector", - "kind": "DataConnector" - }, - { - "contentId": "Syslog", - "kind": "DataConnector" - } - ] - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_workbookContentId2')]", - "contentKind": "Workbook", - "displayName": "[parameters('workbook2-name')]", - "contentProductId": "[variables('_workbookcontentProductId2')]", - "id": "[variables('_workbookcontentProductId2')]", - "version": "[variables('workbookVersion2')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", - "apiVersion": "2023-04-01-preview", - "location": "[parameters('workspace-location')]", - "properties": { - "version": "3.0.3", - "kind": "Solution", - "contentSchemaVersion": "3.0.0", - "displayName": "Veeam", - "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Veeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor Ingestion API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n

  3. Azure Key Vault

    \n
    4. \n

  4. Azure Storage Account

    \n
    5. \n

  5. Azure Relays

    \n
    6. \n

  6. Azure Logic Apps

    \n
    7. \n

  7. Azure Log Analytics

    \n
    8. \n
\n

Data Connectors: 1, Workbooks: 2, Watchlists: 11, Playbooks: 15

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", - "contentKind": "Solution", - "contentProductId": "[variables('_solutioncontentProductId')]", - "id": "[variables('_solutioncontentProductId')]", - "icon": "", - "contentId": "[variables('_solutionId')]", - "parentId": "[variables('_solutionId')]", - "source": { - "kind": "Solution", - "name": "Veeam", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Veeam Software", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - }, - "dependencies": { - "operator": "AND", - "criteria": [ + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject82')._analyticRulecontentId82]", + "version": "[variables('analyticRuleObject82').analyticRuleVersion82]" + }, { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId1')]", - "version": "[variables('dataConnectorVersion1')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject83')._analyticRulecontentId83]", + "version": "[variables('analyticRuleObject83').analyticRuleVersion83]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-ChangeCollectionTime')]", - "version": "[variables('playbookVersion1')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject84')._analyticRulecontentId84]", + "version": "[variables('analyticRuleObject84').analyticRuleVersion84]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectVeeamAuthorizationEvents')]", - "version": "[variables('playbookVersion2')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject85')._analyticRulecontentId85]", + "version": "[variables('analyticRuleObject85').analyticRuleVersion85]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectSecurityComplianceAnalyzerResult')]", - "version": "[variables('playbookVersion3')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject86')._analyticRulecontentId86]", + "version": "[variables('analyticRuleObject86').analyticRuleVersion86]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectMalwareEvents')]", - "version": "[variables('playbookVersion4')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject87')._analyticRulecontentId87]", + "version": "[variables('analyticRuleObject87').analyticRuleVersion87]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectVoneAlarms')]", - "version": "[variables('playbookVersion5')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject88')._analyticRulecontentId88]", + "version": "[variables('analyticRuleObject88').analyticRuleVersion88]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectCovewareFindings')]", - "version": "[variables('playbookVersion6')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject89')._analyticRulecontentId89]", + "version": "[variables('analyticRuleObject89').analyticRuleVersion89]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-CollectConfigurationBackups')]", - "version": "[variables('playbookVersion7')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject90')._analyticRulecontentId90]", + "version": "[variables('analyticRuleObject90').analyticRuleVersion90]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-FindCleanRestorePoints')]", - "version": "[variables('playbookVersion8')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject91')._analyticRulecontentId91]", + "version": "[variables('analyticRuleObject91').analyticRuleVersion91]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-PerformScanBackup')]", - "version": "[variables('playbookVersion9')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject92')._analyticRulecontentId92]", + "version": "[variables('analyticRuleObject92').analyticRuleVersion92]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-PerformInstantVMRecovery')]", - "version": "[variables('playbookVersion10')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject93')._analyticRulecontentId93]", + "version": "[variables('analyticRuleObject93').analyticRuleVersion93]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-ResolveTriggeredAlarm')]", - "version": "[variables('playbookVersion11')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject94')._analyticRulecontentId94]", + "version": "[variables('analyticRuleObject94').analyticRuleVersion94]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-StartSecurityComplianceAnalyzer')]", - "version": "[variables('playbookVersion12')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject95')._analyticRulecontentId95]", + "version": "[variables('analyticRuleObject95').analyticRuleVersion95]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-PerformConfigurationBackupOnIncident')]", - "version": "[variables('playbookVersion13')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject96')._analyticRulecontentId96]", + "version": "[variables('analyticRuleObject96').analyticRuleVersion96]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-StartQuickBackup')]", - "version": "[variables('playbookVersion14')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject97')._analyticRulecontentId97]", + "version": "[variables('analyticRuleObject97').analyticRuleVersion97]" }, { - "kind": "Playbook", - "contentId": "[variables('_Veeam-SetupConnectionsPlaybook')]", - "version": "[variables('playbookVersion15')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject98')._analyticRulecontentId98]", + "version": "[variables('analyticRuleObject98').analyticRuleVersion98]" }, { - "kind": "Watchlist", - "contentId": "[variables('_Job Types Lookup')]", - "version": "3.0.3" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject99')._analyticRulecontentId99]", + "version": "[variables('analyticRuleObject99').analyticRuleVersion99]" }, { - "kind": "Watchlist", - "contentId": "[variables('_License Editions Lookup')]", - "version": "3.0.3" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject100')._analyticRulecontentId100]", + "version": "[variables('analyticRuleObject100').analyticRuleVersion100]" }, { - "kind": "Watchlist", - "contentId": "[variables('_License Types Lookup')]", - "version": "3.0.3" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject101')._analyticRulecontentId101]", + "version": "[variables('analyticRuleObject101').analyticRuleVersion101]" }, { - "kind": "Watchlist", - "contentId": "[variables('_Operation Names Lookup')]", - "version": "3.0.3" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject102')._analyticRulecontentId102]", + "version": "[variables('analyticRuleObject102').analyticRuleVersion102]" }, { - "kind": "Watchlist", - "contentId": "[variables('_Session States Lookup')]", - "version": "3.0.3" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject103')._analyticRulecontentId103]", + "version": "[variables('analyticRuleObject103').analyticRuleVersion103]" }, { - "kind": "Watchlist", - "contentId": "[variables('_VBR Events Lookup')]", - "version": "3.0.3" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject104')._analyticRulecontentId104]", + "version": "[variables('analyticRuleObject104').analyticRuleVersion104]" }, { - "kind": "Watchlist", - "contentId": "[variables('_Action Results Lookup')]", - "version": "3.0.3" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject105')._analyticRulecontentId105]", + "version": "[variables('analyticRuleObject105').analyticRuleVersion105]" }, { - "kind": "Watchlist", - "contentId": "[variables('_Veeam Backup & Replication Settings')]", - "version": "3.0.3" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject106')._analyticRulecontentId106]", + "version": "[variables('analyticRuleObject106').analyticRuleVersion106]" }, { - "kind": "Watchlist", - "contentId": "[variables('_VONE Settings')]", - "version": "3.0.3" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject107')._analyticRulecontentId107]", + "version": "[variables('analyticRuleObject107').analyticRuleVersion107]" }, { - "kind": "Watchlist", - "contentId": "[variables('_Coveware Settings')]", - "version": "3.0.3" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject108')._analyticRulecontentId108]", + "version": "[variables('analyticRuleObject108').analyticRuleVersion108]" }, { - "kind": "Watchlist", - "contentId": "[variables('_Veeam Collection Schedule Settings')]", - "version": "3.0.3" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject109')._analyticRulecontentId109]", + "version": "[variables('analyticRuleObject109').analyticRuleVersion109]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject110')._analyticRulecontentId110]", + "version": "[variables('analyticRuleObject110').analyticRuleVersion110]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject111')._analyticRulecontentId111]", + "version": "[variables('analyticRuleObject111').analyticRuleVersion111]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject112')._analyticRulecontentId112]", + "version": "[variables('analyticRuleObject112').analyticRuleVersion112]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject113')._analyticRulecontentId113]", + "version": "[variables('analyticRuleObject113').analyticRuleVersion113]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject114')._analyticRulecontentId114]", + "version": "[variables('analyticRuleObject114').analyticRuleVersion114]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject115')._analyticRulecontentId115]", + "version": "[variables('analyticRuleObject115').analyticRuleVersion115]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject116')._analyticRulecontentId116]", + "version": "[variables('analyticRuleObject116').analyticRuleVersion116]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject117')._analyticRulecontentId117]", + "version": "[variables('analyticRuleObject117').analyticRuleVersion117]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject118')._analyticRulecontentId118]", + "version": "[variables('analyticRuleObject118').analyticRuleVersion118]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject119')._analyticRulecontentId119]", + "version": "[variables('analyticRuleObject119').analyticRuleVersion119]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject120')._analyticRulecontentId120]", + "version": "[variables('analyticRuleObject120').analyticRuleVersion120]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject121')._analyticRulecontentId121]", + "version": "[variables('analyticRuleObject121').analyticRuleVersion121]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject122')._analyticRulecontentId122]", + "version": "[variables('analyticRuleObject122').analyticRuleVersion122]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject123')._analyticRulecontentId123]", + "version": "[variables('analyticRuleObject123').analyticRuleVersion123]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject124')._analyticRulecontentId124]", + "version": "[variables('analyticRuleObject124').analyticRuleVersion124]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject125')._analyticRulecontentId125]", + "version": "[variables('analyticRuleObject125').analyticRuleVersion125]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject126')._analyticRulecontentId126]", + "version": "[variables('analyticRuleObject126').analyticRuleVersion126]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject127')._analyticRulecontentId127]", + "version": "[variables('analyticRuleObject127').analyticRuleVersion127]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject128')._analyticRulecontentId128]", + "version": "[variables('analyticRuleObject128').analyticRuleVersion128]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject129')._analyticRulecontentId129]", + "version": "[variables('analyticRuleObject129').analyticRuleVersion129]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject130')._analyticRulecontentId130]", + "version": "[variables('analyticRuleObject130').analyticRuleVersion130]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject131')._analyticRulecontentId131]", + "version": "[variables('analyticRuleObject131').analyticRuleVersion131]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject132')._analyticRulecontentId132]", + "version": "[variables('analyticRuleObject132').analyticRuleVersion132]" }, { "kind": "Workbook", diff --git a/Solutions/Veeam/Package/testParameters.json b/Solutions/Veeam/Package/testParameters.json index 018b6b27644..9e7a0480a8f 100644 --- a/Solutions/Veeam/Package/testParameters.json +++ b/Solutions/Veeam/Package/testParameters.json @@ -21,6 +21,20 @@ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + }, "watchlist1-id": { "type": "string", "defaultValue": "job_types_lookup", diff --git a/Solutions/Veeam/Parsers/Veeam_ParseResourceId.yaml b/Solutions/Veeam/Parsers/Veeam_ParseResourceId.yaml deleted file mode 100644 index da5863c20ab..00000000000 --- a/Solutions/Veeam/Parsers/Veeam_ParseResourceId.yaml +++ /dev/null @@ -1,58 +0,0 @@ -id: 36f4d36f-8e4a-4a1a-b5c6-2c9a3b4d5e6f -Function: - Title: Parser for Veeam Resource ID - Version: '1.0.0' - LastUpdated: '2024-08-12' -Category: Microsoft Sentinel Parser -FunctionName: Veeam_ParseResourceId -FunctionAlias: Veeam_ParseResourceId -FunctionQuery: | - VeeamSessions_CL - | extend - ResourceId = VeeamResourceId, - ResourceType = extract("^([^:]+)", 1, VeeamResourceId), - ResourceValue = extract("^[^:]+:(.+)$", 1, VeeamResourceId), - SessionId = Id, - SessionName = Name, - SessionType = SessionType, - SessionState = State, - VbrHost = VbrHostName, - JobIdentifier = JobId, - SessionCreated = CreationTime, - SessionEnded = EndTime, - ExecutionStatus = ResultStatus, - ExecutionMessage = ResultMessage, - WasCanceled = ResultIsCanceled, - ParentSessionRef = ParentSessionId, - PlatformType = PlatformName, - PlatformIdentifier = PlatformId, - ResourceRef = ResourceReference, - UpdateSequenceNumber = Usn, - SessionResult = Result, - SessionMessage = Message, - IsCanceledStatus = IsCanceled - | project - TimeGenerated, - ResourceId, - ResourceType, - ResourceValue, - SessionId, - SessionName, - SessionType, - SessionState, - VbrHost, - JobIdentifier, - SessionCreated, - SessionEnded, - ExecutionStatus, - ExecutionMessage, - WasCanceled, - ParentSessionRef, - PlatformType, - PlatformIdentifier, - ResourceRef, - UpdateSequenceNumber, - SessionResult, - SessionMessage, - IsCanceledStatus, - SourceSystem diff --git a/Solutions/Veeam/Parsers/parser_Veeam_VeeamSessions_AliasFunctions.json b/Solutions/Veeam/Parsers/parser_Veeam_VeeamSessions_AliasFunctions.json deleted file mode 100644 index ce5de5d4462..00000000000 --- a/Solutions/Veeam/Parsers/parser_Veeam_VeeamSessions_AliasFunctions.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "name": "Veeam_VeeamSessions_AliasFunctions", - "apiVersion": "2026-06-10", - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "properties": { - "eTag": "*", - "displayName": "Veeam_VeeamSessions", - "category": "Microsoft Sentinel Parser", - "functionAlias": "Veeam_VeeamSessions", - "query": "VeeamSessions_CL\n| extend\n ResourceId = VeeamResourceId,\n ResourceType = extract(\"^([^:]+)\", 1, VeeamResourceId),\n ResourceValue = extract(\"^[^:]+:(.+)$\", 1, VeeamResourceId),\n SessionId = Id,\n SessionName = Name,\n SessionType = SessionType,\n SessionState = State,\n VbrHost = VbrHostName,\n JobIdentifier = JobId,\n SessionCreated = CreationTime,\n SessionEnded = EndTime,\n ExecutionStatus = ResultStatus,\n ExecutionMessage = ResultMessage,\n WasCanceled = ResultIsCanceled,\n ParentSessionRef = ParentSessionId,\n PlatformType = PlatformName,\n PlatformIdentifier = PlatformId,\n ResourceRef = ResourceReference,\n UpdateSequenceNumber = Usn,\n SessionResult = Result,\n SessionMessage = Message,\n IsCanceledStatus = IsCanceled\n| project\n TimeGenerated,\n ResourceId,\n ResourceType,\n ResourceValue,\n SessionId,\n SessionName,\n SessionType,\n SessionState,\n VbrHost,\n JobIdentifier,\n SessionCreated,\n SessionEnded,\n ExecutionStatus,\n ExecutionMessage,\n WasCanceled,\n ParentSessionRef,\n PlatformType,\n PlatformIdentifier,\n ResourceRef,\n UpdateSequenceNumber,\n SessionResult,\n SessionMessage,\n IsCanceledStatus,\n SourceSystem", - "functionParameters": "", - "version": 2 - } -} diff --git a/Solutions/Veeam/ReleaseNotes.md b/Solutions/Veeam/ReleaseNotes.md index a46aae70999..6e398959253 100644 --- a/Solutions/Veeam/ReleaseNotes.md +++ b/Solutions/Veeam/ReleaseNotes.md @@ -1,6 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|-------------------------------------------------------------------------------------| -| 3.0.3 | 10-06-2026 | Added Veeam Data Connector (CCF) with support for multiple data tables: VeeamMalwareEvents_CL, VeeamSecurityComplianceAnalyzer_CL, VeeamAuthorizationEvents_CL, VeeamOneTriggeredAlarms_CL, VeeamCovewareFindings_CL, VeeamSessions_CL; Added Veeam_ParseResourceId parser for VeeamSessions resource identifier parsing | +| 3.0.3 | 10-06-2026 | Added Veeam Data Connector (CCF) with support for multiple data tables: VeeamMalwareEvents_CL, VeeamSecurityComplianceAnalyzer_CL, VeeamAuthorizationEvents_CL, VeeamOneTriggeredAlarms_CL, VeeamCovewareFindings_CL, VeeamSessions_CL | | 3.0.2 | 15-10-2025 | Updated author to Veeam Software | | 3.0.1 | 03-10-2025 | Updated Coveware security findings integration; Removed irrelevant mappings from all analytic rules; Updated Workbooks' drilldown capabilities | | 3.0.0 | 26-08-2025 | Initial Solution Release | \ No newline at end of file From 1aa83e1480129ebe7b1df0056fbedf892824ccea Mon Sep 17 00:00:00 2001 From: Hector Arvayo Date: Thu, 11 Jun 2026 15:32:09 -0700 Subject: [PATCH 04/11] Fix Internal Review comments --- Solutions/Veeam/SolutionMetadata.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/Solutions/Veeam/SolutionMetadata.json b/Solutions/Veeam/SolutionMetadata.json index fcd37d26b78..01822ea2b90 100644 --- a/Solutions/Veeam/SolutionMetadata.json +++ b/Solutions/Veeam/SolutionMetadata.json @@ -1,16 +1,16 @@ { - "publisherId": "azuresentinel", - "offerId": "azure-sentinel-solution-veeam", - "firstPublishDate": "2026-06-10", + "publisherId": "veeamsoftware", + "offerId": "azure-sentinel-solution-veeamapp", + "firstPublishDate": "2025-08-26", "providers": [ "Veeam" ], "categories": { - "domains": [ "Security - Threat Protection" ] + "domains": [ "IT Operations", "Security - Threat Protection" ] }, "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" }, - "version": "1.0.0" + "version": "3.0.3" } \ No newline at end of file From 14e94de452d879997031a72d4d7e73e9f52bd690 Mon Sep 17 00:00:00 2001 From: Hector Arvayo Date: Thu, 11 Jun 2026 15:51:42 -0700 Subject: [PATCH 05/11] Refactor code structure for improved readability and maintainability --- Solutions/Veeam/Package/3.0.3.zip | Bin 110703 -> 111014 bytes Solutions/Veeam/Package/mainTemplate.json | 3253 +++++++++++---------- 2 files changed, 1627 insertions(+), 1626 deletions(-) diff --git a/Solutions/Veeam/Package/3.0.3.zip b/Solutions/Veeam/Package/3.0.3.zip index 2d712d83b1b7318653037b0c510085ab33d84f5f..0dd03e1f28865dd2a9201299644b4fb752215d22 100644 GIT binary patch delta 101398 zcmaI6Wmug-vn7hVySoQ>cMIG9>xtoVoYRGyivY zRoAMuYW2JOato?x7Yad1790Wt1Ox;IMAf?%L7fO$)q7kINGv@Zk^l;_hKCDuB*F!_ z{FF>!dVY^?*#r%(=lkvoiFO%EZZSQQz`wX!*O<>A<6;Nd41zI2#L@l@Z$0r?8}OK+ z4w(zePNZ$c4!V+=m5PZUE^4vBR9?qgU-x$Z{w5UReBtC+*+DE8Rsq(!|&Ly*qo1gy_$S?*pW?Fho$S~@wtrx=iLkOsPlC( z(DDU*+qu@?5>R|<)}&W+d31>PyZi2mVLdL)4hQ<(M5ss6ti4sc3io)Ema=(lpLN5V z%(kp#?3`YY3H?__g~q6RqfQkUpwm=5ith*6`vJo)wXwV&|+ve^%4ja<5caMxLH!$R(`o=(e?N{OnQnd2|ss zt;=$FQ#jCl+fcMkr*A%ud$aHSSv8fNX=(VRWM^BgIop)rD4<)&pXJ^BlV&YQayrqd zT^TD;l3j&U)?6Y%ob*)Jt^NrH;7pCb-`y=Qly9&>-+U__thvBc`pls%wT))*`_e_? zDW0xgqAriZq>?TJzwG6)c>me7j*L{Djq_di$(0S>AyGSD+*P1GP;uyVpMm=Qp*5kq z=Ud9_A=fqXj~^rhzQC5ZO84)s9__89U(h(;*aJU0dP#R93gcnviuWLA z{110Q)Ri7lBw?UiQYF=^8T#6MN>9!WR#WQLweJ3;Gs_yildkyQ7pD5HRwLTAEN5Kk zaktO?=Uz>%n%VtVfOUT-abPHBX^nh0`6({!K|_lybm)NHlukbnbd~dS&duVK!c%N9 zAMj<5ZVkOi7yk$D?^yU4MD(9{77FpG9TspdeNRRmEQMG|m>i!g-8jhAc`zNj-*JD) z#P6;H$=1@44;IdCT;9DqsUBYh4&r(EUXR7%UHQJ%>J8MN0+!;l#~)2H?2?-=pQv%N z{Y^l1;5Sk;3&w0ElHp<_h$A8pJ5k<9Mq``UmCbVfE8^2CV4vZY>WsZpzK|PAS+2yO zy?Lfz)=YIzM=7!b5FPY3?GhrrRdX^0RU;VvUqJ01jHa7yDOF25!qGG<(gKv^`>;LY zl88=D(whWF0VuAm`K0|_2CiA`(vN3%`4TO2mii9m$|c!?Yd6Qb6Ec=9NHp#u;dJV< z0v_C)cWNiu-t7jGYs{f)W0xV`-zg;{cpoPgaSn^86$-8r-^EbD^x!~eIq?h+tCP1F zbwpqpyO!8H(yo$_#@f9@ZxWzGNMD;UkA+O)HopI20&H+jB_ReJba#BeMo3ouy0kor z_pM%>AqqDrWA*8nrlsOH9)38Ld1co~CNhT!R(3w+R0eO^_m@xRu#i3$*PS}z<@-^c z$|eVQ`A5?xx8m`gJ8Xjei3GvwCjt%>0P{wJjmaL_ER3S!u}t0l+Eqt^x6@WDeFX>w`ck_*in&Hp5L5_8w^VbR^wRxe*-q{UNrx=GKdS{5U4K}`VR*4IN zYVA@!?n*%Y$hM#aq2)^Cy(}|#jU}m}>+aKys(Ee2Z{bO7N$ow2TTaaK{SJ0pGYqi` z?Q+jcj#K-wp*LrB>b?yb^K36=kP)Q5GAy@d-2$a^ zrpBY>AEmmI$jT@9*6M5p29r^}^Ap0QX)GcfY&A9(avGCSUpUHTv;*`O$C;9u_1NlQ zXpvFgWR{F*1H_Dw3$mEz%LxzoqED9Yog?wmvuv!0NKAZ8D^IKz%L{l?dDCg!*r`im zr~n#-lcQw?E0rEsOQ@$la{Ln)6*BS+4a>#0XDKhl*YenU+|HT06$w3qqH^2hp?>JUYWRB)rX(I`~I@Y zCPuTGXTvCcH;;WdBlqB|*5ox+Igdf}fm$Jk^f%ch`r0E_isP3K@a?yPh_3mr_G-Fs zW(+zz9yZ~z|4MQFQ3_%?5pTxCfL|ZAATB3)Gs7IX{8tK*%P%7)w~t(xG_v`6w-6;r z5ngVk_NB_U55PhyR=|PB-K&?okNgt*jzJkA)hY2uj{bAJ7k7I z`)rJ-W4+W8!X9$BAi|E6G7{(OWP%r}U`|sn#1Jh;!FC3#17HQ(=xJ{<88C@TL+D|s z;401EhZrAX<3$fFa;-Jg@CA#+-NjetmAb3jNgGQW5{hFweMUIOrY?#&Vh>^cJ*Ofe zPS&5D8*IMS-Bf>Nx}aJ6`2CA#dB;jkHfG7HS}~uSNSy2S(v?noI=dO;_iChks+OO@ zcai9-=&lcrzP{yppx~625kkIHRX8 zUpw`)@NNiZHKCQM^@_xv2g6Izd6)7g-Wuj%k|{~qs_0GR?RDreBBz>?F6;2=CX0*}51!%dy(J_2 z^hlP?IVtxShx;C03o7mKAl3=-o}s;W^{;)M{LXsWh?>AeA#l>OgE=y-l$9T^c0-pW zpO`e)?Joe8+UM1YEpKn_n&xjZLTB8ivq@dr-dc77<9u|Tt?#C9NjlFvDGx9YQbryd zGOcp9)bj|!pVSNA+jV|kzBO^lM6zmAyT1BdA(Jf1nnPC&kcaPT)aYEr8oow zt^+@Jmg;;ae8qdu=RyhzR6I#^b_7qWD}Z0u1?3Ue4`Y5B-c_wK=r9&e;W2tsW)l+T zIu}GP-vUG`3v@X-&s4LcitC8Na$j`!3FyHX_MCe^)?p|NQ6z*hIfya$D#cdhW|3)| zfNV+ta%Y9@W6TPMvV{Q6*q=QUIXH7a_N*}_t*O6#y9qYQl}1vNJH zhAA*R0X43N@1r8>%Vdw4jDz~}9f}=H(%P)V0K>0pko}57NmM@)pVSTs#CYKGnhk|> zIDlCO4i+W@-H%zahzO;rjl^!7bmBANj&1Eln+*mU*f=EOLQh`I2_98pcA=;73=r%S zIiLzNT}0fDBMK&XpNvx-Z8;e)o+bkP1TwFjLv&e?pfB}um((s6!Z;HH4W(%~lv(Cu zYxg#iv#pP<8P=NJHpA417r+;s5t&!RO-s@p(1_pQqL=N0YFxO3ST={nmT_VGxM?X! z&Z3Zw6XgU*&fGT*_8p=$K*u%9WSyZ5741yI)d{Rc7ARJvnESZO^JZ&FR zZ&msF?v1;`;Nup66plgCr z|71-(jwSgA2>@8r-)bHdM&mU7RXT@D>2U$h4- z+!8V$7%zmq%y5eBaDsdKaTA7s!ji;dmh^{{g73kKpD2mmgF0K5FbXwK z_W~8%Ou-h!vPn_oI1IlmnUJrHc#sG(atZ~H2S~#}LgWkg=NG5LI%da=cH-g0<;fzw zEI6V;KcJ_LFtmXd3?zX4Ll72WtcKc)RIEnzwR%$Nf^Upha2oOG)@se`B&=5T=4l|Qo} zK}K2XXC?vNs|EYU&0^-q?>|B$QzA$$$V>h$6YSeT;G9>CB%(Yu3Qw^S)Nu%MhfWNf zfhbcLnU+?7#hfU+(-v@pkrZPu;|q-4Dp9IPoF$yH^m3|~B*8Ecor#LnnBX}EUrD_l zK@q~C14T4G9o-A1>$;cGMzEhEof}~U2gt&XOT=2-*vXBcC#ET%A$s-EdiSPUqN1DB z#^Qup0v#4WYJL(z1{P83qU2(mxG@NeIP{XP>QFi-`{FlFxFzqbbA#57YUsk`$r9-{2jd@Xp03|&Sp5t z4Q*r2!l{sco{{3jf!t`t3uNN33TF#{Y@>!ulJR#vL-3$=>A}oQxE{w1sr{<6o_ji^ ziUJ247156pteFG9Fsq#zKWQ#-w85I8h_mg1xY7`ge{c(5M4dUo(Z})FLy+F$C&*d|m>NBr1DL!X!@32;mTh`CAfaK*2>={G-cgZ6JUztoVehjMpSU zSk`-b4g7g`lLh47?R+t~oNb7pRmsR`pe!>HAD@uHiCzGViOWvP=gO0>wixZe5%z4^k0eISEi8!>c+N&j zTEIO^-bC$&ki50G)^?&@5yaMbk3&zsEWnkMk0noV)Cfdn#s@$$KoH5Btk{UNYdmnm zsmJ2swP?E%n#B1d%1X1vg>u)28VQ4q6lAT4{gcIq4|0OkE#R)~Vl3l}a#tSwcE=H2 zR`wu+|LR84JBomibZxatT3fP^8B70{BTy6Z1dj-k;Y?N^&RA*(&j{+Nw)`0*8D%Y+bayl?967u;8aTy- z`^hIfdxF6$bJ3kW%d4wU^n@MaM>NhIgRAlVjGQj~oiKc##bd??vVJgs8Udf+a|!x% zjGKCaMTJg~R~fNb06Ggj0}{t4zr@Zzye9rMnB-L>1m~|ECi={IWs}-N#RriKEx0U_ zj1@ddYGWJ5caMS~4dU4#d#?nH7e@cY_AMLgSiT1Rz6W|7j?t#faxLCQQsZpd0--kp z3*R%0?H|8Z(*zQM#)23GoCt^=>*+FJgo#rKrZs1zmeb67=xCaKsa_0hAF@FLfWo5W zg!rO{&6>6RBwB_Br>n*mG*C?AsGrlcJOVEM!2BnC#R!qYe{mf;?tE(GL)8s3r>qGD z8uUYzI38Rz9OHxM?E6)~C*cLCIoU(mQzp>l2~xFUjf8hj?rO>YsOyD7&R@b3lXyrz za6@8^WO6RzyN#ID`D->=XenEXm7$-hiowwq=ZVNk^V$EAH4@Tie|fM^j%r+H`(nn8 zeu*g4D*95$^s&oCZn_qGpk&|vC@7w8$A)sEC5CHIig1fN?OB5aF)nS^IIe8O-ZxXnf3q=%_!GG?jR8G#LT$1dA6) zR1)wzbNzz~+DHHvAU}E_4@v8qiX*jrMj8C1z3hurh$P~0qxCH;>VHNxf1GNJBr}7O zi8M$n{it*iq-2TUKOIFfE5IMgT%`VTWX-P8NdsX3KB+D+7XV=+M9~JlZap-);_v~; zy2IZ=pkekOtMPFHb&xuL$Unq3Q8lvsa6HyEkMm+$Y$OcGea8@ssFO}=0uXF8%;37Q z>59scR7ew2l7C0{-{$(?qnqu<F;$3b7wSy+77pGxk?pspX1|)fyG44u)`>D%)RS zAW9x`+S6_;N^e7Io%1>>9bo2PKyI9YFRhYLh_q$_$}tmu$f>`1&pWCXV?(OF+`8~R z;)rmgJzBbf9qPC};~hgfH#>1_#viJa5ne$LX-w$R5t*H&p~4r7?HCwIrOQ_+-R>TU zZhjp2HXbO#icgNZ5@}7q6K93zX9^j>^&vFwMkVo>!r9s9r}3KvD5xK@3KZcb#`UbV z*Gk5NI!lMSc%_P|v>8CODmlgaG5OaH02mO-l**R_=lKQH7^DhvUE_;Y_+TcPZ}f-l z6!1QX*Rmq^KT1O+?EZI1!Fx&kHa?6VQi=BQ${R1Zrc7Pg2Iu3^^vQ8 zlo1H>USa{NUlf`c*ogUONif#`!uMlNl2@J!r>u14*}Q0Bnd8sFuqyRtKY~Sb4{)Y~ zljVnt$y&Iv0U7x5$;2w9ALYb2`chlrIAAK)P_&TU$eAZ+qF<6x8m)GOt0Di$BrYAj z6{*y!M_}rc`iBTD1JN>^5N%}$(lpLaCVkC3!fZ1CnT8MYeux@6S@Ku*Fhp{r4x0%C zICaIq^-|DQ`3gsWI$YU{s3U7zH*b!a3|ahJTE~l>jKx4N|yCbW=8vQ zkf8km6FAxbG*jRs27g8)$%pSf=O!zX<-n{{GrG?;_zo3v8ZfJzkuWo(U%*pGoz6WY zDaq^y?L77ahLcqW0hT0%5_eQ`=>N21_=Ub(bE(TcRO4ChZqR3*hye+_(b1_YU~7wi zr0(W@2XR_N`B9 zABJsP^{-(A1nABL(i<2qa9p|SO78XYg8jJfxz?M5jh=}}cVQ4m4^5spvG~7e@!tvg zp~Z{AQ5{N;;L?+kB&tlaB>QU3Mv*pRJM3=!YuD*q-#(gPe2fgI2b^dBXxl#u{U2HB zK1Keywtldk!cQ-|1UnsQ1Yerr0N11cFtsFv@T)V-`s+yQ zzz;Amg`K5yGn(+`;&|ty`*Q6ifzwRH6gp*6I(wmNh(A&Kjxlf^_}NrA##vvM=g6pS z1ik6fxtW*1dVxyJctr66OS3N|AZ#>H@FT2ZvWQ?>qF`d=%4Tyt3%Y*%Kpzo8@`Hvr zCmFj*WOXSQ8W+rf&|sx9ytd-CAYQLCj`q!ul7Qj@6`AoF9?ybnFCnp%pi6agK1PMF-9x`QiP3QO5rh#tPf4JOPn_AZHl@DF_5&#M$CfF}3mV zUfm-!F^&Kl1aiKn*W_1&)ggZg9TbAC-pty&E32VVQvZVp8uBFTUg-t+sVq=Ik$?~Y z8#UF|zD2R7pAbC4w>c*@lNKlnQd9Teqq@11g_|m`XgjYeVPqV5QCdS5Brt({RHxGDlUgaq(2Q^EFt^w)Odi-Mfd`U6ywCy#J=Fh z4(#LPWdB?r$z#7e6Ii-VFw)~$QA4bNM9Zy6auJ$PhMma=4hVoiv{aBYoxCDcTT|-& zY3Wg^?EbqDYCHm4f>Hb{zi9fnTai71SD_gfG^-=gr(dDKzv18hg}?ewcqRQM@MQgS zo-O4dGqi(!=f$&&(3MzDQ1_hAdP9=^h?)V6`|NdArk=xEBa0aco^yIjZnR8Ky{8IAK2^{P=nD zu<#>R5L*B+QW_U95w4G>?N2;hR_u8O_X)-l3MC{|+CtiU)7>?zX?ZF?8hkryOBia( zR07h;S-RH~Oj#sRt#j)qA?6;16?f!KHXdcXwV(Z-a@h0N+^_zKEb^Nyugg?aMri6_z6Wn?6euBXgzzbnj5{+BVz{|7w(brv!@ zE6>`?7C@U!KFZHMPV)$8Qm^3!D?2Zdk_-lsFFs)cw$0Ctp!YLlx|UKFZjmtNE`pj<>g?fMQTn=E{<79+>3+2NK*A z{HI#HTtK2h}|Bo(kF`2BBN9;?sF{;7aksDwm zeKQR#br{Us=0Ux$NXDS}G2~y^jsnz|#KTjtLz(`;zOKoE*K5+Z7*FDgunARfFUiARrMf3&zHIoFC4mo(MI{XE{ETD5o+**0bizB& z%FaR6GvlOPVe4$S51fLmNf*$b~W=uGV|E|~nhIt~KlyVGGsC9g-Fwl_2 zPfcUzq_!;B%kEb^bl%h7WQ`q%{)7RrXF}F)D?9dTl~rlK?1&cmz2ZBOnViT#=#vrI!kw$A z&oHN{p@aV|iU%0kpKh{B0n7iZHTeO5wT6#w6OJp20|hoT!7##DujJGqH_6oZ<2N z^Nf9yCT-SuUpd2NTT-7!(8MPa%RPj^;4dqOyA8}{PZClOMvo}DzcJKAGzq44rXo9* zlpL%0zE@itA(sj`KGPmW&)FSGfb08^bg7V=K@G`psT1MDRN(Pw)EoN{eX;PUpNygc zrpXWjPK(Y0)oH)Mq)mK-_e^`MW7;FCRC#1iV#JIYrP7E7$}yqE9a59tPCc)DJZJ*C zK+j)ly2@(>niC#^X?cZ<#tJ2RUsw&JRp|@zKXf{pPDpKz_HM zR@9?MJ8Yrv7wbzpoMNa2Uoczm@rk(YxFF(D4u@h`#8&@Y8e;c^UKCJMyD56SHoZLx zy=e_?kLz#^nMf!(q3~cC&_~udIAD0yKuVe{US*e3)K-IC4_oZr{0$H8RwGrc}ut1?--vm za#MMqbMxd%6R1|a73-SfUd0T6Y7MG~Fv#x5auy>ucd0k{QteO{NUr0Ly+vDPon^X+M89eu;<{;6D|K}VFyDP2?XtD&IJv#9q~ z=dXcN3GU54>aMTPcZb1c{61rRCx~hF7oKj={c(DozaEa~m=f=}wk&~wCdDUHmWoLq zLo3dVSOa0`X-hLy6~>!t*DPOhaz8A0b{Wa`<#=Q`?OKYQI>T zw(2np!h7>?e)(eb(E%?>LG%LKSu$JLP?Dr_bS`<7m)QTFIvDfkOv4J(+S9#bvIo8D z?Imq9=h-&#W2KKN0iG}? z(~oWn3k>?IFSLFlj)b^3LYgtbH9+}tIdq|7n_5QfvPZnW?TP7n@O7W}x8nKy^rq$9 zRuq121zXPa;h24yBAD`h&VKdOF^5+A(~IuHWHOibBU|=mhG7+;*{)<{{1NO54v!6$ z6kzZYdjqQ>0Dvolpc_^@W&$YtPPM)~?MbiuWlUXl&hi3e+?2n`4j)JNp-oVWcl>O0 zsYvX&XCRQ8y1^rhe0gsCEVCR!74!XMg*CBK;j6OkA|EZ!>4p%M>l*e9FD(3N&3CVh z4coYqi^FxQu6bWk;nCwS*L3Hib+6auYnUyvOSaCN9RO@&&Wmr$bN4!+^@tT`FM`mv zG1^U+R?@vhv26#>JLB)*?ZIohC=Z%t9XabN`%E=tug*hnqs=}O6}~Dy67-n$X0>L% zQIi7H09Kqjnb#Q)Nr%hCMGc{PqJ(VZwf3T}*69jGv!(tA#!~xpwo}yB!tb3zHmlDQ zUf|7Vu7F8WPkdy?&VkkB=U}b4%j}ignxS}uan*xz@2u}tl@(&?d{;3O%?(ewnNVOn zMi7gP>ZPh>ZgmRQCzh3W#+7eH(>67k04$cSO)&8uwj@#rj`^BaOHWprJo4>M8`<}~ zxYPYKTn=Lps24}aI6l@4pb=;2g}w6x>u)PDPJk{HUZ-(|qQ&Ui{OD^i8qibp^ynn% z0fL{fxqjZ!?tnBBvO`{A%f7}2qV`J5^0Hw4ViJX^{@pp*uk`CX5t&}a69;9yV;6I$ zDqPUSF1P_3<$F*cCrqga4X?wy0iE!3?F866i*4EcJ_W=uS~mag5rak8tVc_YFl096 zDqxn=AxoU559a5dXU1e=`z(%H}u-Ze3Y zvA1&=Cf~fpoJgj2JVfIlu>yOm((-NCsC6A9-H73m-|x!8**8OWf-H#Ji? z&KWDxP%(EtGZ~ddXb1S-D*+afhEcn)DxYNZ(0(wAP@|5x-J?iKf(!Hct^CFt@<-@* zVvSG4!hswfVTK^TLb8ZuuqX$@WsH*!NhhFG2<#KlD|E7IzHYiX(WVTm&N1b)P%jlj&nKqig5AcC^wMkKG%S5qlE~Q5;(Qyl^bZ- z6so@O9?xBN0p8&PJo4e)l~uyZC>m=pG1{H{Hn3i6S4EXX#aT{GYxl$KSC5{TRYyqFHny#;dSDH{Nwt0xme-$Uj?SP_R^S9EJfEWtQ zZcan5>8L-y9M6qER&UU?z`hv!T`+xX3D9-{YV==&$;|WE+{@IUZ%=s8O!=f zRXb~!CzIAT%hg+kck$TZhyHlsS8xbp&k2m7Lkn0KWA62UCYLa*UP70x`2*i@Jq+R1 zTMvgs{>zA7Z6QsA9*Xz)Zou!mV_DE`J7Y+1=(R~GS12#@r(-?i>X(kEW58=7T9+d1 zV}46O?PS6;?e84JWEv)bU8LUVZ z_dcfFsOE|{h$Q5+UZ8!GlR>7V@SJIzg*%&^^co5AWU*pSFO&8~-VN7?h<2?suN<#p zj&FvAxPZ?X?+Sk?2C5MkVNyD7cLnGU!zX;%2h1jFjW?lv$V<)Z6LL-rjP zR3|MXV+Z+9@p%n{LFC&6r-gdB^5R%1F%E4wHVpzle@$X@OQKZO*K;slZ09~^fyREP zpV%H04Dk%KYybe}0*0cBNDIEbH}r?LHM1?rotK{(_kYW(VeA4bV5abUcJ?rhCoyH} z5gDnB;{7VJRp1F9t19iH9j0!SGRDK*aC5S$^p>|H2xB=~g7hC=EHWAZr8KS_pi*lRaTLCy?re2+Z@x0Az@SD$oFX6y- zAWH07HbRp2RWW&TFnoyZ{Q17f;}qi-^?B#lEK3Z-ea@6l3@wMETh?$w2)D+(XXep0 z&W~M|{9#jZK$NLCA+*_pkIfCV$=-C>2(jPs1LOn$ku%0YA#&45#L^?kxIeTe5`PWZ zC-cYN#B2bxiWiZ1{64YA*7r*hU>CI9clFZWB%iCnDLRp2?gEu=K~YNsNmZal$Fl1q zUKhL#3R-(W+`ZBdTB9!f`SxB04;?Q=>!4@mdJ?DArN^SOx~RRsh^mtb6h^RQAY*|00zyDJg^j)X!0?o9{{ z+1B^6@N>K=5X23IkL3D2Hts5RZZ13gwHp}pMn|TL)pZf{>QjHpBGT;;;M*MiE+s!8 zMX?1~nqEu|`lgmIK-b%K-H;+D>eIi1YX|n~pugBcKSG4QON_o7n}Y+;67^ogQms2X zGR5p^fXkIr7B;Fz)`lVfHn^QuDPvY-iK+_0sEXOC|un>_ABF^A(|s z6ax}t1f`f3eA^l6Nno*ma`LUi{&Fz@wP9^_CVDEeGx)V>+VwE&Zmjvx zJIa%PW4&DcIH+#w{j0O8bXNwG|EU{ZzHPa83iYm;#5rI2oo{ks!~SNLBa1!D{L?)E z9&k|jIu|9LU`{bczO{w7K1Wl<;B{D)FuGhIL{a7%t81YvEob9Q{7srcyZ+l=`kLrn zO*-?6*q5}EbyKXZsl*&6hRz1>$Acg`Ct{sQI8XV= z{Gw3L0!)szp}rT*ggCSJ6sBwdDoYvF{68@d`N*xJcdWnK| z5CjN>EbvivBlZ1W`Hw?DI1B@oiaABsPWTl6VQcC_W^z#|1Z?tKOF6Utl>OH* zvi+ylQHc(3@Ld0(0?zNG^%WkI#h=dSiZ}i5ld&(V)n*mok84eBcBuBhdnGv^TfqrE z2%`nR)$JT&@`$6ScaJL#K8J#IkUN!gpYEi0ELKpgFbO5MXgtLBpiLIjP=ttLGb-x4?t~mW@mSH@F6Wq zF(RHAZrHmeh;-2Bbhp!CLJE>UolVct?ZTQe3k<0?(z$eEn;&|v1t~5c@|WVNOjum| z9BUz`1fUOjbC$MO?YMvd81K9U&+AoHC^2@a7YLzbDlw6zYqKX=;-C>enfko_{t+eA z3&7ab)9gBY^VGC#A{;9uS3_AUsA#k5bEXKt*w}gTYSa(l; z#^%CY;*fmn%9mwGU7Ie#SZh_@`rSR+(VORzY)WqV41QX(o_O(gYUyIc8wxIh<(S9E zV$?nTfl%!2TaQ>7fZ;N&X(V9h{fstV%{DFbQv!uis>JLSiebNxT{@0u3nT{B;tO7R zzvi^Q>Ovtp{ULv+lMh#*wkFRfO9uWmNd5Y-gyp4$;FO$~4GkTa=GhBgmUTB5id#3% z*F2+=MIt;Y`u2&liRonQrA-+kdnd?bLygLxuI8KQ>|8a|fB;B*Ic>)nP4DklZ`d7R zap}bk9YI9$<&eVtmLAWor2(co*hvA)qx*|@{m&^UBn!*FV{03`6Bb7Km<*8n2!8!_ z<_C{5O@ei(s-DhybT{EEWKY2k$Aav8--qud-o4ZP%ODcsIek1gguY0#^y38sYRC3=xfAI2WFnHuebw4f^At07Beg+@#^nl zPa?lmjPJdmnJAL<1u8u3gcJe(9$NbN?$)`EjTiJ0fc#p=Ed{_K*(Tx5b~#t~Sd!<< zYRdI~K+)+acAN3D{0ew?Bqn#@5OcX>;bBY*oEXvKuILN%433q^#llbHNLIf+C;g%7 zab`e~6UhtSi%qWyE-*}{h&cFQgQ>du@J`nE@Vp0};dcN{O~Y>!YMKIV6`y(ftU ztD-)UVo+A8x;Ci$W-+c#_Ok1kKNlKD;CD~ld`Uf#t=0%VIBrF=xMR6ieHpn{7o)RB z*7722oTiLdJ%lapNqAkB>3fPO3Oe@@URLCE08?PZue^^cGI?Rb7=6f0h8<#zHc0d~ zC4&{LgO-A69=aOXCt(Yb5rKFUqdTT5ikq!U$xpsX77*v;#o<*>jUcBuLtB)Hz19mv zLvpeoKoo1FqhI&JH+AY0WcsHMT6TxDKnkU7B>ScNgFrw)WuWuq5cZ)?1lHrAjSU|H zf{16$s7Z${A$RP#B3Fc(?SAA)cTdC_f!^ogOL`Mn?5yyvbgVIU8Nydv>7ECL?nVTI zK6MwfXid)%Zu~k68b3Fw&jul{hozZifOY60$p}!Wwj3RH0R41(t^HZFE_Ljz4~%GT zX7?*+u_17;XctFsgX!^Vho1kyI5PhnQ0FoGeiSmUUy~g(*(b!xi+#3yh_Q?^6?y$6 zJ-#0`J&LiIPBXq@qI!y);Rsi6>t#LkD~r6UH@qtoMB@mogVU9@X%quH2Ycph9D9qk26%ES^+5={|(Y^)%5gBk@dLd(vW&NNZXf^N}Gr`W`G8AEIrP{0PB z?Va4uAxLg}^&2<|-(*aT+fsuzIhW=OcXp+Hfab98&KL`gG{+EaL5Q2W%dmKkIsK-! zHc&d@p}HIk!M@U=U*E@~y8NlGOf}GvrQzlb&i%DlO+s2Q`eR3o~kiq{^e2}z$&?;(1$7*Ha5&mgl58ow6`BCV`n8cQmgyko>|y#r@-3G!-|U-fVx_}q^I4YC8|UJC74U{l65C%^3_YZ* zP1>}#?y1xYI_!6r#!sfxqgi14-YWXC(s!=E05E)ysLC)T-XrU@e0jg+^Q*pf)njcf zXk18Nv!0A3bJ9=<(818<?&pr_cL1Fg6fjqo3l;u}kVJS2 z<95Z)cFCeE)3ZI-p4)T>)a@z0AAb(=o-n)^kf6h!Z9>2MRd-kUkkTmgqk`4g1w=VK zI80S>Pa&!D01`5!URFL4*&iZ{ZxQ;w5^K!GbLiss-i$0nshT_9fYL^R0xs{;yQ6e?gTh`LWFeui*Cf?Z@~O z?bj^Ghak@m%ARarfkB63zWg7kei}K@H@Kh`27bN%>La?SBXlo4BFYwI!D<}6;yu*1 zf!d#5QV#bM;ooW!LVAxkGyp(S?tOy@@wA+~p*S$MvlJ}1udQp_g{Q)A&06r{j`|f4 zJDV>bpX0T-02*OFw}*vEFfWOg!8lh>bu}=seJANHidhVi0fPDmx<|N>1psB(VEE5; zLPcczPTS7adxo^)G1Ksb_upS`GR(y@Hrj$M6;}`9$nI<$lfi6=B>-+;OLy{_X)z&x zB076&!3S#L70u$zyE>XGUfj>ZsOHWiRsu7@_rKI7WJ6dwd2`ARM2kvz%mXb=e7&K1 zrkcjh!6wo_UNLpius40neDh1MFi7GT?~`VDRWk)WQ=D<|=!$Y3n|x;!nif)V=H3I^ zdp7$w;zwXvmr9k%=mJnVIoM}4B3RXU6k72`p02nc6;*C2zI^7BKEK%wXyk4FHumv} z+-cr5kMW)6Eaon?gqeF*C}=g2bLxpy!C3ojN*S)*WqTeJZHlV{uf0t!vJLn zdOey-%q?wc+!|oMrp>+j(^#2o41k%CqDmaJx4#LYPf9L=g6T`6Y!gfHijX0k4%n&B&H`Jk-xv;*sXLtB^z+Qy9T zEY2aY{T0xpL#8}00l|g(we*V?ZX;jWcNY(LZ8h#q)-`R^A7PeoAb@&3Rj1E=&Msn0 z?cYk#lzB9Rs6Y<->?v*5ig>{pSUcbjWx#=1Jf9|w$1C_`T!dw%otd(K%JIq?%%=L; z6oN*5e0o4?8NvZtt0D?$8_f?|K{+e!J$-$CMrH1*o+kfj`yi~YCMY`j`GW|tK2 z4UD7iE(|NbVuJYyBX2lHO?E5~jKnAF)bOUV6=B3x$95C!5+-LoA2QhTqUpoOJaZZO z&QJ_MXl3si>&bR-sa82mo>nriPWE^m$XU*(Yf5*>)0sXD#B=fzd8(*o!|xB{@j*u& zh3+)8vz_zt12kt0ZIs3tTrw0FKYm?@IHT8pzqkLE7ARMJlYM4&pxLA-bkNYzoWUQ! z-kx=0Q5v@%0UYIeQ40|m{Gm&69gMdNNno`C2+pa=BQRi{cZz#6DV&7QC}LK7Dx4i= zb#zCHFpW^hDGtRzB4C6m{Uw6g@zi0$30Z?6$*x*C_`u0M^)ll%V7?=JWZC^y!C{4< zIEIarXXnRf?nIyx6=C6qFKOX7`ZSMfXCLa=2MtE1Zhc0JEpD?a@wbo`?MO^EL#D%6 zKz5H%0yXn=Do@B`_~xd2{e(BT_bb!KBbp)v-K*&hbd}_j)VDZMqB)iq`(S!n$7X>E zqa(}CV4*BDQuV*{F z=Gp^1bDwedN-{^KY`tl039|Cr0R1&z0Zx|2!`A3OyEc9@>w@H; z11SwV_%!NMm)AV{zW{$gfWM>pT{Aq@{L5oZ3cE2puEm`tjvhgVuOQQd-GiJ?$;ygs zZictky6>quICCJ^BW~CXEbd8cT0oF~)IMbk{O^^i>SytH9Nb zk_a^2iU!$%0Z}X{iySf!Ms9TpSH`20;tv%gtd^cS;>N!Lg~t-NS zn+75`a&rUj%e*KKx7G3iI>OnMu8Z^zuyoSGXu`-TjEk7pKC2B_34c<@v^}fkBb`S&c7}9nQwtf2PY1W4yYA-gZ*WG@Ow{RNXT{k^5@t@b zD&5C8VvV@jx1YLy#}DN3S(s@_IwlZPgdAe_(Ie=F#P(B4l-H##b-D$uINpx4%ZlD?BZuhe4A-sTfm)2qCIapgT$cmQDhcD;PNJZy$?BJQ*32W%GE4at8Aod>-MrPx!4s5&VMvNuMXV5tBYMxXDDjEs_E)#P48y( zQ-M^vYVm5lyn~5&om`aI+c8sE(Rx=h&MFwEwdZHQ^2%1b$4xbi83Y7BKg@u&cy?Vi z2-!Wm*|MKAU!L7gHnR%0;h4vM?w)rtJ&errIND)b}%f=3pzjldGYh&J?y#iaZr-& zYPDoRG@_&&ZM$GEEgSVF-EN4ip)QGMWbJ-n`$*!C| zR~Un$gfy%2GM|gEGUPlhx7Rny^Isvbr+l?t@H~Jt;gi*sW_bfyH+;Li7G^$cG3%7H z!gR!>0P3{kdHYQ0ci?+Zl(UyF-aX-sR-eCGL@Rc^8K-&mg!kpsr$Pf14xB`J&3}tt z)98z*Pk&yh%G0N{7<&5ji|jVc{RGxRFte`j3(dA}lh`*pwm<2vrqIXx$9&82R6dpv zJ_J4seAJf(VhlXTmHR2QRU0;DO}(#%f(yLvf{n$dYR*TOIwe2!%v;(Ws7=?eQb*^- z(OCc8 zF*Nyn_2;60fMhC#A2FP6qPjxnPT77^-|eP*p?r8b3oC_i(_$pTTwdBwl9LN>5Px<9 z*lt3@%k!f8E=rj0yWRRKm#8@?qeZ(nkh;=zuTyzfTAtJsh-c5K#H_w|)>+JNV&H2S z{b$GAru+}AOY4mi+*j_XVIPw2`)Zgwn}&yAvwaRevLyMWT9{HrxzcWFT4&KC^SzrS z#cbEfZ0!VjWG2gV9}*+=^WL!moqx@0IUcf^s*~TEsqN^P6;oK_V)DKn=6iz;q*+l^}CYe@&87R3ef1Ho1e`7ZS|o z>5A;7=kMOrUw<|te}+WdZT2G@6{SF^F!P309-YCYS$oVO=dXBT5Ze4P zW2W|{Bm~cWH(B=Ow{1O}(tcvR*AHLb8i`s7m@~hl4HlK<231Vv3B?2@pB-zEFOnM= zo#-2SFFW3>BTAzTZgkO@@)26gQ>OB7m0_U#bV=E1EbuBX!!3)o3x8W3TA5R_W_edY zE>6_#nqVz|IJ?>C^7w~3sew#}QPOb~WJnrIu)zp1|k$L(rAPBhFsGnd8hp@$; zmI0))E!183Xcnn}UlqRbL<*&iop%I)7T|}$P5FoFHO(g?0#SPfWgWmutBZ&^h)Qy` zVpX?fq7*)iZ|aj4MSnS2;3Vq+_Aqtu7lSR)?t(+u_%r)o#9e9vL+NdvED*)O)DfR3 z#D<a>DcbZJc2az zMFjas3k6z*kV*n^AXXY0e)xvrx)67RKbV?BVh^iG&f`ZMLJ7^^WuwmIhnQyZPM!U@ zq>`m~@EMMG?LJ5vQc(7O`XFoI{&Uv-a&klVU)Ek3SPq7);Wl@p2hb{(TL?zh#)!F=Gs{J2mpg#%%{WWZ(ou)DC>Tl&wFf(w6=wFldv*DKZ+)rc zKNVLP`DMe(O(*s}LBmdy!h!^*6gcrJJ|lSl3kVu1ikgRd^J-bV;j=sa+*HBgrawvP zI)Bns>R+mZN@M#eZ+nlkHIa!{TnUvk01AsH&+nCN-C!f8@+1{iYX zci}LLFmL*C1+E{n-plW9$d9x3@=^OEEPuRwADJg%9KQHw%~TiQy^2Pk>DJ7uE~uHn z=^6_D+lD2T5n?uG(d}$81Hr{2qW*`%s;G(C`5nBFRCZ-BpR@fK{RQ4($>m#qzZr8m z?N-dX*)Md%^sCXjNv|;3P#?C+RC-{*ReuKZ z2_6@k_Mtm)!I5gF-=YJ9_(xcGU_MFx$=z$rs|E9!K4|nIZ5&>Izr4Pl(=WH1&GOKN zgthqX&IQpRebxuFr25Ls{HIPRZ8+D1d3sy&7-q?fnk15lkP(w}9H6&Ljc zd4#(lUVg5;pqE89#d(oEHp@}_OBi=v^0xd9dJCyddwlU`F3_*gXIZs>d!0*t^zkT=M)MlQ0r)75Iey@r+N zDre#LC%&;pad<}4xKV$Ekb~P)$0n_CoL(|@b^KW_0s(kVjznt&< z7w0@Jj?aPOS#n`$x-V4Y0w6M9-ZQ%FBj^7}mWw}Crr4D4zaKVfwSU^*Cv4*VJDG3y z#7waqlkI$y5uE(=(}I5b8@zH>JCWtZXBhHmT7ss14+L8gSX*{Udnhg%;6D^g;l3S| z!m*pTL26GlbG}ao?yzs^;(BvaO?Ivk?9-&WISSYH#Xjn|smqZR8j!h2vpNinjcPJd z{_I(2GpyXh>)YEcPk%%bGg`GZQH{AkQ*HFO<_;1CH@gv7N=?9wR#!H|G4NCuf|ud7 z)su4!hKtcA45O{lsiQF{+nwFfn4__}^Qod4ZE?dMlg(b8+U0E=g5j2==6toUS-26V zRZnZIg`vz`l{yeQx|=GMtl}P#c2n&Q`XKJAywxV_`g3q!C4YT}qh>UYvAyozVAs7e zfTy6*n{|*^>j3W-#>>?fP;BseNx7ory2+o1$v2|)GefPP$vE0PU7p?Qj`a3)57o^{8?c8&pY&N4 zm{K<4KkEXB%6~%YMFS||^XwrX?V>1EyRvyg5iMjsn^K-%>l?f4BG`N4Q&`n!p zf4#i~O1qwlSN8akADw)?cr#mcP_kp)U-63(*~jnUKY!|*H)<5U|N84MZg0OxlKGJw<3fM(MV|f8deo9b9f1uSbSYF?9R!*Os*T2&=-*>tUu^+0u`r&i1lNfM>uXrvKx?9aSyZ{ z&|i799gb}~G#7Dxv>`qt8{&@`0n4J#8Gm3eg2H8*!`l!B+J4dbnP#FqrlCBhp$ucxVQ=6$(3-=4=FyBhzNbZ0?|QV|9&NWt+kbA^ z?a(9IYx<+X_Gqv@sKM4m$dh1!NSlru>oK!B|-6chl?Tl24DdqSDy{Q7fwMigWeF4Ov{% z-89DUHGP|QetJV#Is{6JJ%ypt{OqbWWr#{2mx0t>t|{x2#(G3~L5ikQ6o0h^i)sg; zu8u`kzM!EXPkC$^lgcvYm1#4%m9uY`*RxQ0zFIwD^}GYBq@KmD+y9!Y8SzQ3yP`*1 z`HsfI9Z~}4J`3gbOXciuKfHeVB$K~<%h~Rh&CLzr#m-rg@ucQDGU;A<&LEtBX;V)uKA?iHX?&iJJs{5lU_ z^qpNqm|n=W>kalAuRWh^gPeya(tTZgy8(pK-TPCq(X%J#+_K8gO*wp|f9Pw)l*?lmpsDIbwL>G6n^>V>h zi_9W?!`GR0Q?VrZ&MJHZx@uki%;CM3@vWpS@_P(2r4%qKa3I}7bJo?Yr@>3MTPz3Y z7qMj9uw);uEHGCdi6-4!!nBG?UHW!Fp%szo{P zMFlF9$jiQ-UveegJAbKY@0h!PO(9q2HLH?xM+Q<2=9mKm9IhJkI^r2#^z8R)3a#W&RS9RlI#BT zqPQaRpi=8P3^Av|26VS){gDP2*>12}t9ZXMj5=G)!Jc8hhkw%xu?>k}HcT!`Hdaln z;N)swlERmY59{7;#WSwOGc?VmW6uEnqq7;a2(#}>Pk z8U>hU^QImsMX$kekpc4|jO(U$IVwnh$uAmz4vzQhMV)b7vr{KvL)15VGmGG>YKEv{ z6?j<(M{{e10np3N(55%@*(jUH>UwoI+10`Hw;rmOY=4CJE4>z|_F5&j?x#_iMzxak zm(?wX0@(#mnxks)Up)u=j*U7`T8l>whM?+`F7^>7EAHQllXTk^Q5j~xudCeLo}}09 zq-v?OUb}L(6of1>DADRB~pUZliqE!9?ad_`YrSxTkp~=sAd7O1AJe@`p`l)TdcO5 z);X4GaJJgC5bc-If7VLewN{ph*Cb~2=9I6KFa`8?jD8yX4 zah>f5{#qRGqVaS3#WW}*}cj9!v zTYp~Vi*LVfJbKwOJdKMYZj=6Nu#E1{PEl%lT62BQl$I75 zVo64Nv|ltm1$0m^6&NGyHM#Ft6*^Z21i|ntOEW&#+XX)$)qzm#veA%XnznMe4MR$! z8qY`L9kcxv`m5#oijuIgLPBY1ftb@acYhQ+{v}$=bhJEUoId&AKb`IndHMnVEaMH< zlji0-S8h&K`XpMj5%Uy!uG*Wg_yPE{)2z4K=Ol@F>4Bz%-3#ZX(Mp}5auY=D{a<}7 z-B#AxH~J6D7{Gv}mzGR~qgnEj&cS$)X9+yTb4nIR;3>=WnoK8U*&UN%C_80)FMrJv zc50}65&NCO^(aXCKHY`wvf|EWD(r{>z)t}Ou!JG|?P%Ka2+r>RJc9F~!O88fZ|Hr? zg`uO)p1Vy#R}S|`^A|4DY9!|PT_q4I{QXX@B5wYMtX7CE4enam-fTg-*Y(IY5zp!v zlK~m);z%r{t&Yh;!V@*vQML(AsXo%i@&im%IZrYh=ZE9#`DQ{q%}KI(vy6E9=cER) z%-F<6vdG-?&uKv%%NyJl8(=Qn7u@XGT>Y44C0*^#lL~_x0p*h=gCu_+;Jg33P&n-` z6;5mOFS@<3x81c?3e>Fj9<$W)Y)QQDRt!{h38wXog#gn;$wNTj4mey$qt>6^8ooe> zFj~VHhiI)}_Yi$OYA8UUzGG_nd;Re2PBLdTIk`#Yx&`gD~?v(Pu=7`?&L?y9Z;;p{jC)0)Xx$aYB5|dy*l*6hQ zgWZ|1qq2ueau|)f<#vNJdIsYTOZwZub5=hb_Y)M&6iw&$M3ng2ierusz~DnVz8~GY zlW^}Aj{S}5=x#jR_h2E9_JfO~Zf<07@&Jb33K|V(D>8qOR0oqsgdTsiiJ^Q&#lzO6 z9NJnp5qLzi7uqss_vbNO+t~|+Xt%W61-s zP;L~-Ny&~Kf{R^)NDgE-Tqm!lH4jIbp{_1-ijb$-oy5 zYduRm;cc?=IHym3lURSdcPI6v7N)F@5FgItc9De3C9mR>hNlMZ*TFYZAm^4%`8)9+ z2jQUyVRxE1AA^V7XYM>LLrjZlYsfiq=SLah+i7bZhcR&-Gr)pTS|KK3sI~T`<>39ca_l}WI=tS(h^v0Mg{?!C`$US@M;6f*`E8c={KVq#KTK)agWhHBOQrv&%~{_=zip=F5rJ4Z{yaqpzFM!B z>+t|+4-3Gr$P9lRJ-o;(M_&){(X>NO{+e3b#WU3aEB?II=9~hUL`MvXq(iRA>W*_F z%i*1{Ep>abvQjCTj_%xjbErz8HBHymk!>v3S~2Td8R+03t4sQMRv2#R%(rM4u(U~c zh(UMsGE+5*hA7q<(G^7VlkXd>y(59L`k@bp*QiBb#guKnla{OdK+j;1;Lx|GDEJ0Y+`D* zxylSFmwh~~x@ znD?6n{Ii}4mXwdh!oW9lz6t@5bbX$G;38Uv$wiWCBS3e1JzFGKIa9EA5Hr}t^%mxi zi-T_}EV0^hWx>hSH3iWKyL_^y!}HD#VDYIr(^G%c8tvS4&UM#4H!Rz!yIv|S9{n{* zc)=vw@;%2iT-SFU%hq(yvram0e1N5IE?LHU|6Zk8-OW2^^O|u02bG5#M6aBnSqTRJx zVVZwCN29&g;ceqwc}v%~GjZ`J+pdTt{o=(gWD!*^jY{g8GWVJyysEjfUcy|!{$?GK zU!}u6nY`_W3&HBXVVwgP%~z|GFJno?W<#*wLv^j&=Y`v|*vhh=1zUEt)~X;ELjX4) z**z~y5NXX>=FWlh3Wm#?xJ&QaAI0bJom+ol9`5tiuppdVHtr(}H5O_g7Sky^SZ3yd zaN4COB$&ZstD2`8+Ivm=g8f(jzx%+=43zq^@%t6aPryC6d6{1<*o1XaDZk}5w0zJQ z>@w8l!+M&C!DFyU&1t5t4b8P;(I_!f4;)z@%G%MOW!dmiiJ3**9Lc8=rV_d4u!Vo2 z6SZqPr!cX7w-j^GzuFdp+A9Heb9d1=2^iDWE5G>X zZ=c;QzQ?`3_5cezd-t0b1G{?t32y1Gzqz=MxhmlvkE!dS*Siv%g5TGjzK{&_c&Bex z9(jm6eFf6_AJ6%gYxXN2dJ*RSLtKCFTgKD?*ZVfy-rL^Q$G`aY$T$7Q+XbI8p(%9F zJgm^-I?S(9KDkA-+cdF_)OD@h*)96xCC5Wta(uuY#sh=q^Sk62chzt2n|zO`lw-{^mt2Z&c)a9tQkPt&cfUPeZn-yuJzjrqSpteH zZbN;%+*0ClOIiDW`uAK;By`>*^80uJ=cF#+MC=`r7yRwnUPrte^6}Qt$6G^dk@5Fn z{WXM)q@jElto4K8I_zDP;s~f=UERPu-aZ9jk5Lv6P8wEQN?YkHBRl%me1TeXuSuUU zd|>|2hwqMjx8mQwe0OyzbEALU<;3qSgFZ8Yl*|Qqt!S}};#Pk7-^Hw znM3PE%GDHvFMSEQG|CU}zMV9asUt-xIZ>3(l@z-UU(7O8Qs+|2;4=k2K@)%WA>JGt33h~Vsf61Ex^e*C)UThC^--x>!L_n&j-{+!P^l1 zOQaYFlt|foSHkxHeU(TtA4{YhqeMzpvXuG$=QFYhDK8B7D_w&H#G}!FfKn-CY#qB) zN>`UZmP{#6Pmd*24k=2JACZN04dv`_KfHeVB&&Z>(NG2wo{>#fv7&B|EM3Oqv1H0) z$&`9@K9)>*ESVyJ@mMmYIB7nXOsNYw_KN8I|LnaBciYC2E&Nw-dCwY2=c67Z^>S{K ziDKEY&cu(AWM|F9{C!@vEBU!%(Ie$`lHHR;5hQ-v?w@V5n2XKZZIbV-HM_Y&o?~!Jap~$xx>l>Xg(n zDoK{w96?RosY#PmC)Yu$IhhT0N{gsT40VdMSqyc`*3O?>@#J)${@fD1J_|h6%fVDK&2_H}?^N6Uc<0^lT5SPT%w?YvTb&qT&(LqsR35GhwP^TE` z6hob2s8bAeisou5Srxfc5=T^s$6ExeSR7YDuRhog7&?`LKZZ_)w8Dl&sAuk=H21iM zP9@zYhEB!Msi;q(RiaaAVy!h4D~4jFeu|YFCzuVVKC&p>IzwRX;uy&Ay zRm=Q=ihVW|JvKU+Pa;3BN9<^YYw0G5oP zC<2hLSYi0zR+p0v>CmtY8mD1N$83M;)36K{K*N$*hoNCHG%V{w!=mfVoD2jy%jIGr z5ox)EETN?>v$B0^Wm5`*cCfS*f&zxC#c;K>ldDCvr8^1 zYiubMzKC0P!|bAOkXL4Q(J@QPGrSBcFubIm)!0_77sJb;VR&hR;pMeG{tAD)Y07A{ z5p*u`fz&jeORRkjcS~IH819z%NHW|l9J_CRrr^e%|hK_HuV)@2kub zP43%zC%XsmUr%!DM0#j18p?n29_8ImpH)jFA}fc(WEm@c7>xfEz!rvbEK8E;q&+6; z;%+H0`VCQwJhx4UjI%Vco`xi44}&OJZYG^D?1hUQB`14l2LWuWM%Kmoib(t(oJPqh)50ZIzghWKLwQo3 z@&t?|bjHjzk?vSN?#O>ANZVM6=t2@t7`padV5nhUw4hpmdM6drs35(rom49U3X?D2 zOdC=AWQ3i%M3ATgiFA@SviJ>uBe;*o?T)*D>I7=8vV-b)>i)6MI47@G?Og=QuFk^5#xds(~>0@s5(ku;vHwBtSN z)zgjdj)YbqLbRNPgbh=}GSYsQkpxI!xJ2TuZMa03t$RgIZiVf^AepSTid9^hOC-}a zC{G-6Sb;bs^{j>=zh1;4M}|103E~j)`u6hi0 zNPH+6>JUR6k_q3c1qr5u17nYE@9g2S`)RS0l8a#7qYSu{n8Cuq@r1mcOJNkf_%+^Q zop241X!V%S19gnxLSBrvw<4S959el|;1>WT=SH%ou~S1GLYu)*hvW=WKI$Z}iOP8m ze-2ME_k#i>#PROIu?{1IZW@Q$2qFrPUJ^UGs@W&7sj?0UL-#3h+ZHwaZcpwHm46UU zbo4drQ$roHKGY#aR)2PJ!c^_WagnSi|A_G%WK1{?TvHYUg@%Bgmopg!Zzpnpquk|E z&_{_yGj~oJ?vTX3Hf(Ie9b&jc40lMJfAJ)k--O!@*wlz$FGkG~wS4dXOX?Y9C`}Bd2^&Re{sFW^hG2?_^b3C#jzVzIiU>au-Ne~AVA zzx?G)ZoQH7{_+B;?LmJ`;*N1~od*Wg_x%{wqfmr|D+)>x&U^|>h!JGrv(f8FpWQ-5 zCz>h%rRiQzgiTqlO>L`!!`)erYDVpz&* zFoqb86ZJM$Z(_r7qSzj~wo=5xe<7Gl<(W=WHrF!vPBh+RiL56HDGm3Df-=yiXdw@! zV)0wVllnPNY#fIR<2pf@cSwgmBRYW#^!sWPoW$Yl43dDtQ zC)bn*+!@inUVEmKw2@@^P9)Qpz?Xp}5UB*;iT30&tS6OOPqf=SZv7a}f0JTGqzawq z!1Bw*%U`nHtj@`+uESU6LfsJ$ud-VZTw3XIa`vV?cIs7(>XNWuTS8zW$g>0*6F%)EKV^mmvl)vO708OK{QD{B0q5GKrbPdsf3$mW zy4ydxJ~;S+{P*8!ZXRxD$RiKZu?HPMKxXG*Kz0_L4~@3SNx}}3fByzr(I>-mfdnUc zV^W#sgy8{(-Xz}EhTfzRdXuBN=}oc?fb#q%M-})@QqO9b>+8jDa%}ibn&3Bi?tO8P z(B~!07^3qxf#D=RmYQZbNj9hIW1~D8bhU3I=oUAv;NwM8;SWXPf$=%rd3fo6_;^Kgp?QO%c zVpvWL%ZXt*X$8v(*X^p|GAV?J7eJqvk z&^2(+gWHbt+|uqaBLw4!E)Spdwklkhu`T@eiJi2V9e|Wr01?j4HYhe&anw5c% zLc@JxxKCQaeR9hOr`V(0#o5OyRdV52DV#rT6ko-i~YFs*BN13qeg$v1D zkHXds0hcyQZKzPnw6Xflh6<%=DimQ=FU^D^u?!YYgre~t%i}>w2x(|g8lyp}x=3#> z6H288*pQ+ae^QjJfmogtB~+VtY)CGQASJAsPX(!%Q;lDRr}_v=44K)Jq`a@;t1N;-^7 zKZ5jl0pux}br|v#L!PoeNbS-0~5$ysC(d6W(XG$Z{K>&Y#g z!OR3Ie~Ey+{@J?=fiz@A2vh`gs04q?Ldi|IsD{I&c@C4jVUb5+lCw8YF_{z&AKw`} za7gpUqw_j#9eycDVH@dJ(Wtl?+mp|5J}NV&Caf-5BH9a#EU?Esf%ZE!pXbxfASj8Cr{)Pt(#^aP zBqfD!lx((IUs_@W;~s-r$QX`tPkTiB)djD6rNPjAU;h#ASuW14?cd&CobT{ffDX6L zK&3yyJ`c>b@W$DLO-%V2%wE|xQM*;*p<(rm2kr1P&33yI%EPAn`T%=Ii^pZa{tdqI ze~puNgQUVcYHE{MxzH%MkXCPsaCdo+#adV>YmV3q0xQ3CgXEB@E6t-AgT}6quetI0 zbqy1VvY&T#D^%eC;ByTb^VE*u(CvI?AdF|$`P#zU2z-lVIX9wm}MD4Y%Tj&~2> zKS^A1w6Up_%A&(ZWK|lE!h@j1rnqVb4s5C{CxXz;OWgh@nT;ecyR4c}O0qs&f3rS4 z8^e_ew91!s$ZrkDj6|7-yb?+S#4wP^$5EA#(nT_mP+O@q`G{z0ErEALP5R|gjzsbqf3}gv*hVU? z$eTWiHtR$}p04}e*V3tcLBCbwFk@qPj zyLv<-xt+WqDv^TrVCGHWkT9WqoWBIeh|*YB<8x3!wF=QK^iqiTbDads0PfBw#c=YZ9gTJ?#0EsVOF&65Ym#*^VvBIzPQrE#Fnxx^8^ zxjnNED$%+2?MZOw_`5F9MvxKn`*O&zdMur*~0>bRK4|k&Dssku$HSfe`b7C8Z~-rgZ8lD zZcD8cuC@Ar`69Maw10XxYR2voWFyg2I3e8DHXqFOdpOh&-Z^lpPi)v$&I}L{{E|vb zr+>~@>7=i;z!jTR{}>9YdxYKxKg&v@mN?2OA*mZYx4{WZ0l&!=7Tl-Djy=(pR_iRV zp=mG=l%b9~W@z1}e~!v+-&+8sya&(e@sOAb2pUej8GP}kQ?-Go4jz)b!8zuN+D+OU zeRaf88`LO+94-t!R5xWsI4mwp_zMvMe<9VmBPDcF%W~I6DJxPQv(co1P1ZU&Re-Hn z7bp*VJ+v}Cxs>2ZZHQ6{rc@sIFu7?-iNE(JC& zLr{I-aS0Q)3<$XdF-rlGOOUe)IJpFID*~0vm{m1kfMrx{Wi?w-_!^qJOmkNSGpmp3 z(o$CgHfsPkf3@wA5)WukpAuka9kaYCv#hOPstR6n?u_lHCUKf1AhcRg%^$WqYYL?i zV#?Lgm0NF4mdKtut}>s%I}kRT$sCNx|t;()lXwHUo1J&_aSxUJnjle|Kv1&?M(Bor;Gy7bGD712F-h zvVVPIUoJ-KPT88HDfh&vodatV-Okl?bW?{$t#WBEoF;3WAu|^Hx8}()>3a^{$(^^n z1er~Ti!?aMV(V{V_mJ!Yg(FI(7wAH-yn0k__T1P$lOwb49GMBC8IvBfkfiEM5zj}Q z0lJ_Ueb`5_Bxk59Gi9PG^bb771sf{}4+anNA9_A#=N-Rt1 z@^g~J!1419w4_gRye=+-XU15}OWui(6@Uk+B%YR_>S#*f2N%ZQlQ)M-C*(G!e@H^# z!qGUqcP5xS#FOs5Lp$@vy>(=xNHCNRfA$8)d%csBz5e0Ru`F{C8waoKfH0b!o*eWJ zj!zB_;jhz^CZaE#^of6hA( zPCGUuKWTg@HI|=L-ohp|>FTB?)lIReoqbXx2ct=`sE}gOTQ`_Lc@kEhML0IG~1nw16w!EkRwCWCf>(Xn4Vxe8@Ph)ycN>02p(j8-!qd7rQ`k zyX6;gj)?uTwe#mz+;!vALh_@j#3y&~@D0zfhI1d?emcMWg{bv&cJ;kKf8O5t-YF@- z)F!dvoqgWxyF6}kxhea&qaSGZ$Kjppj7NcT77jM-e?^Z$^b4dxhQtdnk%QxG3}5QY zz44E$w{KdNZ9~$EvQ#AYXhf3O+GBK-rtXsD8S5N2`R-W3KT?AuMLYOYJJ_@HA?9nZ zM>=KuzWt;c?L<=asRuiie+a*H*RG!{M`OY3`?F4XLp-<;X+;N_S?eRI1;D`qW;HY|Dk7RIfsjUmN2^;CSi zfNqP%VgcVm=fk6{e+0<_x>I(kSB)UAKrx&?T2KfXuPp=ZnePn2PXhk7Cr`s$lx65s zVTMzB(2*M^sDW6;ifspUMFV}aX8Xz|i-of$Fg5w4(A!6=Gdw9lK&;rM%J689F-6oB zAuC?CFeLyVW!OPU03FK5hD6{4v;@pkuOMak8XFRY1`I8|e?_!%T{b8O95i`fol)p~ z9JCS;)S<)sUh6=4>5iR7JE@J}}jlk1R0guX;hNq@~iXeR%8`ye_Lq z&`05d^<1$3oT-_znyoode=G;4P{kAS)dx20=rSPvDXBjz7>;F>h9VE03I|;w8t$ptRXQAX@f=eb z*cBtLf2C=f)Q0Kd!C}!&pPK2#D&Y0SU4?TOy))1fr&aNTo#n#(D{yF}f8x8Wvm@DM z$wgVWDEM+KdU6{kKf~l_nEVv@uM)E`J3e=lnfy*0XYxyj+w0SPoGyULFS8EA*9`8XUpp8TJ{Kjb77y1G-eh6o4kT8q;n(tRm$Dx-pPwV9xvG1(JeMB z&*qOpX(K`+IJqaUZdm?mW%*l4UcOA;y&^`KOXt=Dai0t=pAs!!L8lseyX~!;u|4?= ze{inM#si&}wVCJe0VjY;2X^PIRKl0<5)wI1)po_0<77m0n@VqYS{uDx@v2{*+3vIg zvt8<04I_QMnC+e!X1iLM?cO;)I-FhI+Kk6>BS`Jyqo^@byHw*EK08@s89qD1XP1RU z#tu-D)6($SX(YQbe0DOkCghPq(k5w=f1!ztrYSKdTGaYfLCZKNz)zp&zV+elW#8xSr&L zN`K*Zs@{j_$j(k8hci#)*j%prp+YFP+N=>nxI<6atC{W3s6m6K&Dn?i@NLD=ZLP3v zt&r_bA(0zAwDqY>kH#EUbt8Kk4&1!4zMY2`vS$Br8 zx(>pVfU6fA;$fovN~h*f3ka+^9fx`%j&`%l-@-jS_mlFgB7c1-IX?@CT7ac`<_}%n6Y7S_S|&G^W4W3K8V#n7(oR|G z$rc-3y3QWip`(?XT($u+80 ztu98;^;xu407i%tk+4{EcAUsmq+_K(f+P&GAIxt;^2%TzQIUv*G=DD8*h5}%a#!#B zel|fGEc8N|+dF&W*NagG85l2p*PV=^n8Fu{n&+KzC`iYi&mK@rT9v}FL&zvb-xle+ zUF<9@WR~Q`ZZ0lVb($qFnN%btQjt7sJQYcrBvqf9`Pl+ek!03kQjwTcBx{h0q>zp- z$?San;0DEsNWiR1=6@lvrnIU6ew?{qTz?)=`_G%O)D-mG#hM40xkEUx=~{7Mv@1zE zV$qYYs8)IeX3ac{e0T4jSowR_11!4*ko<$@uX+xm%P1+DSvGy4s!jj)` zE}3*8b)*aNov~vF&Ks5$Bh7aECB}IuBS7ccPF&(m29A}=z<=?qwhSD(i(UET8_y~v z-$*^HVV15}@{Qhs$-dD<_6_Lg8CYB&Uh`B|8wW+oYjNyZUP zDU*yt4F>L7TRB*>Nyfns4?=XsB;&|B8j+#7e7w<95w#&%3KdS+!FtOs(d6V1|CpQ{IXO9`7*$-yoDnEVd$v0?H%6gk(crff0cbDJH6 zp%JWZA}}^D0>cop8A7&3iRU$`fXFk3kZrSD#t^baO@Cqt*)#{6A!JKTDnrOt>j*N0 zY|8Cn=%fstlp$s_TvC;2w(_>FzuUp=Ic6uhbiiHOciwsKWCq23cui6o7*?Y8vJ$nB zNQi|NWwQjK=Rz!hMr!N@G?m6;=!DKaCm7zM2t%LBFr15ghn*)R?YAPiNiN-;8CBV-pYOc+WTY6m zUKFUV+}I_8)~oN&t{wl;1wR)BFj9leG&Q9Qd4Eh5Pg@kYOcjzwaRm~+e2vNjTIq@; zA18bxB-32J?j<6ZJoorsHPue8_9g)s)hOjWB}Lky`F<1!N<>UvydH#^QxRAHse7F~3;dRaniu3R^*an04! zF!iOpxtQi}(RJHnaCC+pEss#tn`4USyE1yG zPRLVH1Z^?M18gL+Sf-`sgC{Jo%N9b-v@V&9UPS;^GrK_%{^{MQnH>$vplf+IC<@G} zdqlzBIX;qmEqjDgrYdbIR8>eRHBv&bl1-%AObLWvUnC6|P9-PK`aC`7!KBGCSbueI zv+T`9gVfn+4oGRYGkzy@{V~Ch{d@?D7iF zGnbvGAUC@}wl+|5ML-9SE2;^G%3F!zG-z5!h^mf9d_7*n_AFqk}LkKpZW!VFB`#K^_($R!J0M5u>}p z#$QK8l~z+Fg{;tYI?Y!WsVG0@h;*vAey@43XrLEW#%^7J%(BpsJp1t6fq%VQopxc; z;B1#=_=oMz>M{y(6!~B5v65ML3$DGWF$Tp3-FyNv656)O988ZzLuB2m$W}IJwj6{j z=6Krqh5CGMXJy$V_TJW~ZZF5G?~L6?(nopCFoQK8JVwcW{ zk`gPLw7EI6LM6sUE4sxX!+%RbhMP{I%hKlF_-(+1WtUAd#>|#C$rw#C#_ZWteVQdN znPiM5k}+Z`i-xl?O0s3>=jq8Vq{e)V*_D`tj3y!D`Xpp5q$JnQ%NV9#bR|Y2%hvYg z(F&%{t$XK!8^O&}PM$@QUeWUIBvo#S$rOdVgFWjS>Ien0=kODN?ti!TcnoGL=!k#_ zLGn$_WWm>6C>VKKF?A!}$=@V=jYkiD2YVN7UUx=3B4!S8bb!)L&PQysOO`Oh`px&| z(^QhnwaWQ;#iqMNI`W2+>pA(G`0fOoa0-3{PLW)=u)m+ew0GF45++MK+C4bk?H^qq z9Q;83`|s4m4p|@M8Gi=S9P)&F;XF*DC2fk{o^=L$xBJYjjJS;Z?hVXI-}1e&gPBwD zR+5MU`yQq>OG3jks?I{SVUj$iR)Fu4REj)d;T6lDC`-4Pk=-oJxyXLcNY)spR#~|u zk14yZa+b&36|{V^$F!gt*&fpm>sY;OmhX||;EA4%r6CfTZ-3Hhh~f{zn&g1(@HTOV z)%nx;2Csy2Uq(ry#C%bz%>;WisXVYF14pu`6u#VqMey#YlMKsgGT$S<<@k$pO-XW` z(b?GcA2%b}V|*wzmh4g5!Y0$BtiepCN0aF>nolOvqsjCrT|iS%UMKu9TC}NCx43ef zOpj$!CYnr-S$`TSX)~Bik0o<}a%3RmB!X{HuATz0L@6M#m`sm~rdxJ#Ce5Sx$E118 zN%JUy=#mP?qhP2T@IYNrYeY|3=NPj%N63t+b!10V=W#>H7^Eo}{ z;}3mWtuVW|QBZ;eWlfWdeefpECZ(clW7Nk>&mW?y8tM+xn2rnikR#1QW;QM-WCABk zFLX&&BVCsRE)VGSbR9&3M!z|0moBQBpVA&JP@qN#4dp^c`HSQWE^OLR$t<2xo-H28^Iyh*w z6&IZaQFhsoN2~yO1dpoU59T*vU_`LL)fK;Q@9ZUsAGU-5n7F*$*$oR(blu(BXW?!NPn+{(Lq#946bysub9VP?Q2rSS(dzHxFgDN zNA#NKjz|aJlnDRpErL5Dvl7D{VYnmKfIC9T$vGK3c$Ui=L3VGja|#(9*bdT~J=jRR zKq?FvVZhrrFDx7D46JSH3C@WmlKVYQ3=tMf7$SCfKzUSLKqvs>tQ6!9VH+qfEPusG z0Ll&|_@B8Oz$tT(6(ye+%U-~E(BHG(VZwN_+X^s%p0G*_G4uf;KsbAMA#frDvZ4m5 zqHG$ykD>V+$>ngy*g|Bud?uR%xemif@>5pqW^^QB=pE{ycNpF~6AZ5Qq?m7bgmD9= z=v2}j!peTIH#pwwot*6T508#zQGd5AQsb2!5Lo8)!_YP2k>C+)VlI1XAv=6 z6y>=ndbM#;6t2h>h$wnhh$vDI>zL4MMnus!L=?3WQIH(HoD2gHaoC>PlYd+14Ep}* zUtr8_1SLg$P&GzLQP9>KK~AB-J<;GxODtfvBSNQ6&)jK|Na(oKK7AnSJ z$<`-~0VC4DaE z&G@;(D;Uro2I*oX7e=9_Nt95uf zEowo_*gTUOek0AO{<)1wC;-4a*FCjNEcSBnme@SYL#<@)?BY{ zF3_5*FOl=J?opKMtv1Y znhpt3%m%7Es@oUGP;B!x8IPxFprCwSkiVJWJ;LuTo6Qd`wL+hBy+}vVvT9MQl8lf; zVlUt>29EpSi#MGrZe(ae$(E-){~~AO-(*tp#0@UI3qyfVv_O_P7Q7 zTcK}$)I!Arq+J|Zld`%yBsuCdB+}mpmfQ;xsTN5(sJJ&QJ2R?oZF4P>+8Cr_M(?61 zqmvQ4Lju`rlUBPhe_^dOFghni-d49%SZlxeu-3E#Z;42P{vyI!Gb=G+ttPB>4Z>PA zT{pEeqen@_F{F{@5a%(iyk7EKRJj#KGq5Etu)esqg-&ZcMAihLwjltO1Pd=K{`6Py zL44=qLD#Lsc4gB=*nQVn(|CSD5DW>DvjX8{CXQ%J|4?ERa&A!8anBa!pfx$GP9?dGkMW z`Q<)UZkQ{fJfu+l`rtt0gyDu3fEb|>t=%B8Sk3xILn;OomyzmC5mMdUW3d(%%9og(4>QJgbe`JVrMc6-e!0#G(;J!kgUAje>4S>O~`Kc9wfVHLsYP4LOXd;~l=-&31Z<6VRVKf>8QPOw-?@ra# zxkN&CA@H`|eC%8U>&U+FbnNODf;=00qHk6ve-C?1%bLXNMRwOpCSIr6gxx!FfDZ4x zIdM1ntKu@91;!MHd9;>}Kun~lF{4{SACTJ{Z6FgU4tCbjUPXhiT?%b6{0Id@V708y zDBa?+L%|;$8&S{}#)88JqfKGg*S=9>kGqs4-=0C~zV;w(U{lI%E(7~K^JX>?RnX*E?+ z$O=uT(|lzabjpu8ZRyIf=~Q6UArh+IfBL=V;jF>1Q)PCoGg^(%uhNlaC7PFFRBqwh zd}X*=eWR~`_80-w*_@am_FqVjS#}JZjYdOsnwU?K^TVGxBk(hPWC4=(p+Jd|)~?|Y zbJ?kDKs*2{sRYpo9`t%AA~9B0(Wh!_2TnIdFa51ge{My;!`Lc98LN|HgIo_De?dqw z?6z<+sP3FP+$-k{^Dh@2eCHE0OP2M{kJF!Hz??$j zf81yH(2zDZr>%?gALLJmQ$u|A$NlNgl}Y%yGZXi_4ECS1+1-RPDaR76d0?qdrCj3t zLjQbH;~YcpEJF%$U+&G$s07S(X<$sH5bSdbctH4WZ_DwHU@Oh zN%Ut^Wj<-m1Cm7}aoUF^i$Df64^EZ@4d@=CEO6&t=|E+HadYOG#S(bfw}63z1gm_U{c%1I-hcsx!21 zQ>QH_IYl^wQYL~j_<}b1{!$@^;uH(|=z>nF19 z;Qy@%izpnXOA3t;R3E6k>DX!Lgj{8s>P(>Gk@M1a$4WO|eRjzVF1{1DnxnU%{hFV? z=FDEwbQS0Mnw{B)^HulMe$RU8PVBKox6$I6eW5);ABla8pXh_Ie{5b`$c$(`*nxH9 zI1|ey3IK!!Bh@3Eh9OJUUQ1m8noB|?Cqh_GXs0vI&nB+!yg(L{i8n;oAOtm4*O78+ zPiu3e?5?OAfAe`-&_sz>%_wi6`E3F>_ZuvXw$&LlwUW7J*KrQ1fT)HGf5u%@=bKu{T%|?JxN_?v z+02t5v6Edb66K7xe5ZV@)UoHFjG_FHLsivAc}>N{R7EcK7UL+bU2j&LXPU(7skg6^ z+9V`KPxV?lwMifIn#fX{q=}T-NL^$K!$I>Y4AZGIN~H7|EFy(rW+f(tp-Ex51}O~7 zWS2>1c{s~We_}X$uxFOdlGGv1>yrhLL6iZhINs}>ob2@v zkB()jwpe?BzgQu1Do`Mh3L3RFPL?ZhE0`uSZLA<7UrQ8EuCi53${CpU#`{G{-k}a&D~gd zGRA|2J1-{K3R3^uPL#$k+cBW+*#srIVQCAQT!JQ-;No)$rcw!-OoAJdNl=-wapFy! ze>UYEWLPcn9W}`ZmplFveX-U<5L0S}4LHOTbCbNVO7cSD0&db2u2q^s6-VdS;DP`< ziSyXmoE~@GdbiAb@Ov^%LYqW=v0s;gvTm6^#VEos&1du3J=Z6r=U-VVJ@c}@w~0_= zwR3tF%?mvZRXjD~<<&ep^wsGi=ZM~JewzprOb^QxgYG=O#JwVkK#)o!nJLm4T)Le7fGLQ9f!6_^ipa+<~sZ9j`XhMf8N)4cXn88y=}f7q7+Vsm0&f`QWOue-`U) zu?k5+K0K;!U>d1>Nfnne_SC8_yVa~qlO&Jq|KZ)#wuDNwlvy%MESceKk8gJb+?U`1 zbdg9FFZNg;-pg=EjF6Ff(G zs800!p};8T8e`sQ2a}3ALyC~&eJ{nq=44#*bai9K6aduJM;WqbSJy_?dikE&d+3`@o;Sn1IVET zBouuj+0}Y5@zqFc7tY>0(C^?!s5N=ZO)K*b*#=#^u_(ot6Ivimk9f>svahGZy{t+ydjN@nG4YJ`^DCFo?`EtPGze?*qulIc*Dv$U7U zrduwHuChesvgVe|mRnnjSCwI@kqx)$b)-?{RdvhQgpH|`B3C~iLnAfrLaocqWUG?DRwZ|BB5&=hPK862ymYmhC`Wx> zOu2Z;a*vzf91zZ3f0Z~hq=*FRa-LUEw}r1Bystz0@X!v1w#os$YMZy@I8V`mK@AY{4O* z=LRhE;>dLuw@1RJMEDY)0W;XR9cMh7h8SAb;k zLSAHIB?cxBe;5pm4bKCXpB&?gj_I5xe#nd>aX}Hsv-54cA_VF>(`nE zE8I$KhY6f^Fy!mTv53cwERjZHUz9X#61kG3O`(w4f2**yTA2Flv-3nu==z301MeLg z`r5DOqgw$MNR)i5U-A+~CCSW)tlF;{E@g7xktGb^F#U^lac*t@_Wt60hrcpRUF!@M z;-{H=8$?NcDF}c{543L}*@>Ifb}dS6mmGodlaP8Q+Ml_nEuSinQ9Ad;Qem)`P%{+l z{mu90lVr+790ZdiBD6&-AnR^oS+cfAPtY}h3y#N6FvDm*FO$T|FMql@alT$6A`iz? zu#QH4b)8;6g@(oMed&W&7kofRiq0!&Ka*>7x0jz2GjZ5WMj}6rOesEgGaOECO-!!M z*gVhliI7ZOlWSAr4`Om{Dh!m9-2?bflGo4V+RV(gnLt5uoefORO_Ou8TF%YHLBo=> zZf3bG7w-{M6BRyF!#={#({3|c4-*?(i5P5W6m{gZ+f3KSt- zWidrmqb51SA{*o~sl|C*KK=_Sc*GPwJd;$gMv0i;2ab{a($RIISM{AYZEoKFGJuBOhL`g+qS< z$--ZH{t$hvhkqa5zIibWNEgFDv*Du)hd7h_p$hUKNivtc?qwyGBmw~7hKUAf?vX^! z?XULi_F)VM;1`%dF)ut-HNU~#(4IUENe>O($uO({Bh=aZE8CiRi7vE~U67kSUxn{N zh2~2=?*+L%)+N;9n~7s1(J^}@n5U0$QxCS*6 zs=&?EV}G0OhAe4HzETE2s#xV|h&vbS{pIiV$iYifu0C$L5Fy;V?T`M)iRJn9Ukgsx zXHVO;8%aA|i9KkmA7Y8x z7COXu-AxR!*n80-R+G&T(uIZQUyxvp`sFV;^YTW{`^yW$7&t*+>pU-&o$vcG7Z8Oa zBrYRRiV)#iSVHWG9-oa~NBZp67x)(eKL)!APoViLe~5I^_Lc^ANIIE}icdS=i}Sfv zIe%5`)=NJt8LL8GpGsw0sGUe&D%#S?_65OU zq}YsLp(PTz!MQVrq1b35C{3AotaNJ{iHDZ8Mj+Ngzdp4vQ2{6`SIK*5K}i90QhqEz z9NGcuDxiW$i^QhVv!#`T(+q|M4~E#Tr+Bd&Wv#rU=1P0L#&NCOyDXS0Zhj zegRr5lu2iQzc{(hW-XElxlUhuBlpg2StrH?Ygtcsk;S#d>q#(WaA9#edvY zmzHA(M8+IZ&lzblC6LP(A5VX1B#%O}HfQR9fx;YUdS#kh(;qoHei`l#e*-L-dgY8# z?Op7OZ1N73J3NToXYQT+v_t05OnPV*bedB>dj9%NDkaT{O|@qE*{pCNr4~|`PU5Ym zbMlX%mLHm`ws+FA1_}dBRW~a&SAVOwaah24Ut<32?wV}hx1SU@O#~^_*e{jYnU&m| z)pYP##cowMscSh3U52Q-hoj4oQTw>GQi|!aQfeNcE~6nek5rc-VktnTv|>usu2*N7 zW7ld;s@JTg&fXR-V40)Y8iZ88`TIiVHjJiKrr z%O4moT-3@($V-&C0E^#ur}b9B8hq4W>4 zm%6r=+)XW5qn1AKUY4YKXQm66viza=l0|KO|Cc{FZ|S06vtt30Il4YUn3Q-oic#KL z@Yia{XhqDj5|~&C=Bo(6ReyvtYS_NkV3KMYi&|!!rh%nt`jj$C)SfA%P}y969A%f0 z7M+Gi$N0ZqE|+x=>R%}7ULrI#eEpV2rWSS23J0c|kdw6xIeBf5zuLZIz4!uyI%uJQ zSI8s|>%C=9Mi!C^j9q(j>(FGP{{lq$(g^^oYoq9Ab8wCG-G323%YXK^aLgUlqUqw> zB`H8*(yU8sPa0cayKNR5XnpOrfkd;* z9dsMscyhDWOxdOz&I~)P&59Y2%WG0IR5LfHW>_w!`OFZ^1|G~9Tu}RMBptsNu5Ot4 zH}X5x<5QrGI(&QwIQqN89tabI7x6*pTgXbBU~Ls3D}yZoHnYtsSU_lkhjz zVwxSRad6U1m#bUu^>>nb-AxS>9SNElKpO3@o4Z4Pu+_{kl3UvKcbL4MriMpWZOsgY zj5gHl_N;@#X8JwDx~;z}GAe4S=QFEort7nsv5ssTwe@*+hJTHk8b3d^2Go<6<)WH3 zm`HNbR8!TFpr?WUOeW>2y+38yc$)4{F)vP2O=VJ*R83WK<5$j9QtZ#S@`*}Bm&z98 zDQV8}H|@dNu#@iw@$iK+hD8UcCXuPZB{_qAYvI1hns2^5CuNDCE9{nR^5vL(IVN9D z?mRU4a#a49e1AC&wa_9@kW9WD%@*5`=(6*@FXr+molEL%a=!x720>;PKA)9!tTb z7k35tsPk>=J8(u*gr<|5!7E1P$YW7aPEuG_*}sGEfPX6c{-KLOdt$^Uo-)yvW=q%F z)}%?EEU#yJ~~WriQ%h?Spkt3eInyobj>*uHDuj1@?e zln+TnV$4oLIu&@~3nO5zafoHb%~m~F?ke^V_b6#+{|M48y?^4Nxz+Wg#sPlzj8a>D zRFClMh=2W19(jUhY~jcgq+8O+lPx~W8+9=~v4W%S#kZLctJm1n*);fJe}9WO zk-}d;Z0-Dcpk$tOrts?A{|}mC`<~E4`rBh?a(_R2*sdf4{L_Q~!NA*Qet)>ps$3>I z%ECV`cx=^B9tznXJlk2~d}1=L=467Gm`|f1yDR6`cVNG#J)5p>LH{YtC1tZyAQIvV zi%B&FX^A!vt)#Pg$)1Evq_gyjh8i4gInmIPWBFq9fKsnd%wN7R({H!15g0YaPYQDyLL%` zytXIyy)(kK(M9i2N)M~Su4>OmF8I|sb+^2V3-7`YMV}M(o|+J5CNwb<-o00!2@j4v zDj;x8cP4f7+hw%s9eWBZA)QM5|3r7fntx$Zop9T@CH(%)`HPnqZ(f}1%*z>Iy*Klj zZd!znGeHf9J%B)06PYXQ{4}(ZM*?r|QxyYN%F~VKeb!150nY5y_$Nv#p~R!@iTWs| z@4?2+oQ-|;gc>yuEVB%#E(2z1O*K1HfH6fo0a+IR@=?W z#RJ2+2NWxd5x;u6@!io7P>TsTt-w0kE|54a-ipA)qMES(HTN9~i9P}}6hndMH^Hs% zPD#roRgd^1vv~GFgOf$-H{Y92Qyovle&rf#Yafm=zqp8G?Z0+!eJ}9tW_yv$vA^ zz&~a=TAAgjV3(r45b3})%UX-Bz^pSX(ORuUv`fu8w8HBUcA;5?HhNQ(vsGA=73eoO zEMm(Kc$k}g&^oO?`$)zKy&BZI486TFpnYpplf-f?qnOmuuYar0?sVEtRYoDKm-7kT zDV$BG!(ZLW2nnUlIb%Jx^&ig7e&B+`c(RN;*6Psc**fiwwpJw9OPq)FcMk^UP;!+` zFS%W^vAPWv+3?znYd3RZYt&iBcrnMj)nNlXDdi*uzvvyWYPofW0pfb6v08PIh4jpS ze9s)4+&dmHPJbB`6psH$)$T~h+r%EtgKC9`^efVHtqpC6S{-%+Sc6~z;^oHnS7i$N zkf5%RtaFU4!hN*;C%C5B(*Zr${&gON_EZX#k(pa1E4iBA-MQbehCO!iW*+Q)h2_fo z8thG+nei1^KUhq4qt$kIfyMhB=W{u%rsHvfVWV~ALVsMeB{2&LiG!Ci-qQ3>EgWXc z$jl{AD6|17x}+JMieBC1>MEbBOH2XRWU4N)!i8q)QX-^PYK7I{qivQ^71xmMb)`$K zh0)ei($tEjmFgv{$V4Dhuv$WT4d_yla9G`X?yg(oswZnV&0b@(%M+t7vx%FxW*5Wx zoBK?442z~AbuQSRtOqW5nzbk`W6x+;Qx~CS1$Ws+^I7ulHFTEpKPL6%((NnNty0?$?U%y; zkjuLIk)1ie;F9_Fc)ANcH zo4zStm)Ja5-RT_TK5g5W5`=4FOvy+Bmo}balY4c?Q(LKyBgvW=Nz11(PR!&M4xpv7 z7>DG1?I1DEd0mw^P$P&X1^pucC-MB&Rh>{Ba1@7gYQ`pqb6|Tbht9Wn@7)P*AAg)j zTT54XH~$0(K|xLEVnD(Jdoc>&Yg)5j#8@!%VT;tM2?)*-P0bKoj9@S_?8&T661l;- zGlp{`eUWZFZ|vBU24sRgAWoC^G!mP)?GcEz(67qATiU82QKJSJ0?Nu&GHuE?mlo{B zteduoLpwlS1ym4ek;ic9+0x3vX@3U8f(Juv8_>c5k=ow2NLBC+Q;S5B6V10!KvlB# z7K$z-Ja3VhQjoEg@(K9!`mVN=o9DGXouaHI6>LpnIWzly$wsofY%5*I!e~eYR_ZcE z2%Z91_|IwdeB0K1?cLJ?v{opS4wAAsxz1)Sk_j^&y!J-!o!hcbj0@JXo_`dDTS#}- zwIDW%spsI&O()Tlc|r0GP2g3w^XS}mz9-q-3X70LZa^upf%weA zEDB2q?`0B%=MWjsZhg7&;UI{oSri^1X%#!oX`t{(DmscnL57cR5TM&y^i~aPB+Xf! zt2v9OvchSf+B6nV`Ka5flD^45?o&MK)3TJcEM!e{dI9H+i3y>*mw&K*-&Q2?=n$k* zV;50ozfy9?QUjz~N$3iKR|i?E*r0kQas}9R;X+miVwWaz6VU9^UZyHoyKuoP!=p=- zxFq0QgT(4LE8qIP=KVb*z*P2(%wJa87J0C8dwkXXXX}jX4{zVRXs=ZrlWy2{ds^)@ zLQgXlIvK0N|20=@_J0m5uy-i!v{`KpRbTOIaN}HtsJf1w%aBpq)w8t2XB8Ud4mhOwH%*hoQ@Mbu*d^j15)nKd<#y7To zouh#b#mH6Nq<#efPYXr&Y%kuO5Z(nspeYA z-PD3LYH1hJWl5^%g}87j%e$E_S=83|e|cBb8bsZIqr5cATMPbL4H>P7SyloQE5Upf z0l12AMh)B78cb46V^PbD(=@O&O`lRmiP|&f^gFXH3(jrZb?#j(tZ@=IPU6dR5{G}6 z<0XDEac8bQc7Oi`ULl-3xb0KdM0c3zj!lp5X#c!ru4ZkH-!O3-QFEEN4HLIv;x^=( z&%|w*xQz`tFI~Me=?wsTP25JaaU08z*N|P7T$H_gCl<&peeaIQ6_DLHA>DVjl^!D* zC^o=_Jcc;E|NK+jY@K0QSFEgf(!;Ht+$>K*(Zn4R3V-H%zl+iKRy_TpNRtpxqL?c{ zfdnqA7fQdiVI!CzGk}`J3)?$;arT0|e34@hN|Yq04L7H|{El6BG6vac>c>Ztxo~tg zb%Xsl7ld+SzEeIw?_gS7ET0OZ5GTV`JWa4T!bo8kyNez|lxC-BYN91CB`zc<4T{!r-0XyOUrT3N_??%5@7#M_%dBXt z5zq``gj;}SOvd|ot=66ATeN>E=}oX_U4K6~QNj24Ed2@op++AmD_z5#?>$-~#7pjr z9oAS8MBKHgM}R2n#W`HYhv0sAdOQYEiN`Tg3EYisC}8GU*Z$nG+&hc!6ZTR~2kM>t zNODQbOw>+qPu85Ff{&UqT{=A7-?QF1KA{G}HUydIyI8+__wKEA1_PhG#@V|IOMmEM zSy6*jQLveH?n7-V8OJ8g$T3`ysr($eGphvZ|vUU)=N_2F)#5Fb8lLxQ&gJx1m5S@ zOX!;9z!BwfCz4*2m3GQo2hOp}m46v8GCu2Za>Lk^4z#oR%zLC(Us|k;#fK&Vlw23p zMS(zQY|sGvYnN(qFn^AA51#EF^sf(kKOFRbI5_z4^vvPr&b9LhI$-7q_ET@~VDBLP zgcr=t$pFJN;8~OHj1FoX%aVDAriJg`KvVf--1A`{PN%KFVg|eAG8@?PGJlH;r*X#I z6@-a~`Pt~voxoTCqqBq*Q8|2Tl`+|cx?%T%3aZlE$L4un)rYaF#TohbE3CNM71L+m zgtIxXZcr+J|2u&iqIJa$EWjUN+eb9W-F!TL`upFz){{54CV&^9DEA&0C~94{IFPGT z4*TK7IY-oRK|>-pqCV)t1%IzT4!n5bU=+-7fuTu;MJ;X7J(mx+z>*>-gtCLN^gO_#AceL8AAg?H2QAF_T)1hrph)96IPc5q2VW@ z7OypV%cmThNBAPzm7qLsKSRs?M~(%~?-A6B)Usy3C*F%c9U>&MM}H-V2!F27loy|2 zJEAK>nIXtKNUFg~dnf+zf8=bPIwKdhjZxz2Vgr(w3J}F;ew!y*^2W4)47(}!u+CgR; z=aMVO_HQ3xAz|;9bOP`A_E$Dbg*&?J-}9(#KKdUg2i;#mp?|rT$)q~!cVAywSO57tF8x+qx}(GHTi?Egn$y1>A9P>61A`hY7w0W9)=6qS z9>{7uK9XHM34a?lcJ;9P4vfruK%b=&o}6}HfCXj4_A&7b45{vOX4+GslD{7&en)5L z8>BmYZNu`9p8D`s{O)I`UDCp!wcNX8!yfeLkD}yYa$_%I^F)^h-S?A`XJJBf4|mm| z@oA4gJ4oI<=pA>TpTD!-;r{9guN=Z8>7L!gC>37C+J9!BDWT*J5w@>$XFvN+T6cKo zK(S10dgv9$hn*rc=R3e*0Dn)mKit-n-Ing;-T>c+%mDVoKcgQ8u^+@9=#d6X6m^8x zaL|HDU|mh@Y4G5|_JMuaeLERHiTC!>_ofT%r*DeM0k<5cZ{huY1vW67_`OroaiFZ+ zFOGE$z<*e>Hn^b|zagWTet6fp_jNM%>{0TLLA;!+r^)Su?@c&+qfq0aRHWD|!d*x4 zyXY6#Ym4_Bci+u#Uq8&+yT8q$5v;dY z78weX78#HcB&gpj)UFq|F5PlT44s5IlJSVHRT9}lV_M+QVFhNJMJlFBuC+reyDM$yhZ5R z3WrQkpjX7MD_Ec9!*IE(nFWv%-UB;QXEGwc^akDMzg}C9 z-l%Ai4Qnl!3DS04?nF3VsfmE+cr=ZK!X${BE^>7kE3EtkK~EQl6xF`Tad8gjCBk&r zh{Tj----W7_X_03fdcCZF}N*$0VY82h~k(pV1Xh)Bq|gi40g6Flr?FWkAJ-G0}K@M z7lFJu@OEtj(DM?H*B|oBc@5wWtZgtAyA$vmB7b2?y%@lULRBaYaMqd%VvziGguGWO zE(2cHFA8wlI2f&11UHy?G0^TDNF!Z{XX~$EF!{S5tPiiPmltKdgA2ED^B zh(o-SCLXiYx}n2QG&(_3pnnhcIQ)Rm9;KhPw%J?msFpJ5iKX~dWZA=yfLP2Q*+2MT zU-F=S{fB)#BMDrzN_~40c#lN?*>E)c1uehrFIQ7^Q&2DPu%JL)36BB(o(EI#6Y~HI zawp(1hYmxa5?PxE?!O%6!s5qAm+#&xKlu!fU*-Ys#o++K8Zq-;rGKm7bP8kH=jg{$ zZmgXgcP{`wgCiz)Ozd&A36!cni9dMzU{3%WheNMh@OQpfuKyH`rEp(lZO5h>&hE&Y z3fg!_MYPkNv_Wer8?;3HxU`Crcm{_i)5r>lrX0EuTj;bKjzp@F0woc{kr+D3vdz}N z!3Hu+<(1jfl5RSL9e*ah^O5B;8-WE!eT~X>{9&{dllf9{Jw8mV$9$EkQe?C!*HGFK zltu)sr7WVMYbfcscaS{kuTmNu+Ml5|MkhdUWD_P@?BupW6(`V)sng!_#r1oAaAJr& zme6B?JuV#b{SHU{N~We{oc9L@ATmnHK<4rV9ri3;Wmp_dv&G%r-Q9z`LvRo79wbRzg-6aHf&t2Z{{@C4TcYEgPsi~@Ss;0ZjP9oy*E5|+n-sc9Z+Y8Zf z>$3%qu*6}?xU-YzNO%uF2yLC)4kuzRrRrnB3W5~7@;laH2`HAi@5?V+wREz&w_DbF zwZqNu{s+l=p zJs`KQAO=e*(u)N5j<^!wba8{v!2Dd;1g{+Jjg|b=`h1ih$ivWV=~HsK(foz1JE^$u z@15zc%f};rYP6t3%TQKEeRR6b>$(r*`kmch|KSQ3_L@ScoK_#p!-S_uqw;>tB6FnN zfyJ)U>U@FL=k;iZi7{Eo`zLVUl|TDuyvU zC@X-8@%Mq9r*h`LGm_lwEe=f$-UFV!!%YhoRlzpG9_f^SgLe8X2EiJN;pm z0>VkMDJ<3!sqA4zOr0NEes&B{v}{PUs0i}^NkUvsHjlgWpk^GpskdtV(R1|G%5K3sn{0=3;TBt<(K*5 ze*UU6;IqX!T$Fz=0dBSbGn$`K<)}dY`dmTC6F=VuIM~{y&O@#!ubzoV?~=n%r{f?s zTm9?r$wW!6W-JziGvM5NhK-;68|}I_p9AN^&B1WB0%Y<~^^saZzJ1M?wb;QZJ{`hr z*4y7T+dSjz{)o;TdLLuvF?$Ki?zM&ygL!Y<0f*dz)0s!8eTvU9SS4I2$$W z2~!wNyyG&nJ~)}n{lb!?pbhB>DIS4ak+nr}=h8GTO|wWsRTFk`$*7M+#LJrRq^m2T z5QvAn&28}>qyLt*XwPc8tls#wUxrk54efVLS`OBwoWv%*Enck*6YeT9Wy0dme`&vs zg~^5P3XfNlLh zXpyV_d+_r)Y{9OhXQT6)7i>oF5KJptoCYTS`C*Wq%=5+Tq-Lt{7&)B!=fgu1YmxXs z49M2|_E#IoUEOV0-ThD;hlxulIRBJIf0mnxhEJ`xp8*u3F``FIq+)?ok^9>C7`$wV zjDA6o{x)?9JtG4czv-+}0{*<9Q`Q8smed~+CZixRL#`4`Bq~;UA9ZNyy%mLA=K;U( zAg_yRs}loM!jHTq;LtD0pa3+D^71Bi8h?qcrG6iYK0T&d+m>l_`cpGmspnuKSJOr2 znF6!E;17gPH)(!xJb&6{r0q2F7GhXGV*M#4iT%S}j;Ti3L6ENCJ?jlF<{@p5mEI_3 zdQnSmpxWWSl1-Rc^|J?8L*n^@{}RX?k_%9pK4}hck;%8ZGJdQ({uY|4Rz)?;to{v; z@_|Bl^*g#BdM?H&Sy0^&+0lO$dB9a8mdBX7tSMz)qq<|x*#Y{K18hl==%Udyp6T)M zDNVZODMV%gQ929S97<*Z$|dW@gB;FP{;`l~^+3n{i?yUsS==+!>^l}L!1v#LXqt17 z)QPZ*?KDl9vUsWeazbv+_(PeMUy}ykog?gxADZm_?uc!U7I0vjH`i{oaSj2Uz=q7~ zP6R_@jOJy#lseg<*%FH0hngsD$HhT?q&N$B6xofbowh$%hY+Co6JK!&pGzG7Xb0Wf zwkC;$zg_e;^lmh;p$+W;CS~+3G=EH*d6@Hpa+>6!qj9cfe(Q|ICKNgL`!d;n!co$y z=2JH^+lfd!@0P%y{|Wl)@FSbo-qULCqlQ&Ebze7Ziy_cu&e(u!&xJ5+H0aj9P>#vaF*0XK*Vp<2__ z^ZXJrysY5&Wrj}{enB64+sYhz<3Tj8I{huz2B2*YNpwPHiqtVf{E6@Dkmntqso({X zx~{~_v{@G!>w@eu5O2#w=QhzDOXTVvh!lyhg33)UH09-TAB3|fdV&DGMxMxlyn+&} zxFf46{*l+k&pW>aKP@}Yjas=wX|R#mAex#_~KT z=)>b?J_=}NMBbE!+(3BzBb9TU zh@-U-YNtxq{7R2T!#_!0ETf-n$A%8R-zf0Y7vc73I2EDcRpnGZ!q8_BuZ{n^ttrVt zhU|en z^K}N4b36l1PEKCPF`#Hu$c7jdNy(%`XK3S#aSD@=C=^qbD+<|2er7Tl1iKhYG+VA4 zR#%jmo~#3zFD8GP-8%GdgnaEJ<6r8et~T=kGw!FQZlPhfZ_DhDR^FJ+2U5`DAE)f<2fXjIfK4s zJScim^7O)Zp`J$$_tHz*d6=;2J_HCxiQfEyzhEsOSLtz^LKb@R9*Yu3SAD}=8_4ws zE^qbZEb{;43{0$#QOCHfmIbx-{w9U%-Mr`!sdEMD-wq1s)y=j;y8@zUc@R%Jm4QcAQf1nkA3pCXB+sdsU(l{Fk^tKtc^}QNd8E8j z^!{B$uZZ-agzK4|7^H1jJICQ4);0t3RClB?SXD;sJM7>9aQ?tQ ze%xLfYmF?UlTfnSAV`rDlZT^?s(zdC3E^ttR~VpnqIad)!OdfhR235le`RbGuKahK z)YMPN^6SEy<2*u_)p^|Ri1K$%|dzseps|3x&ESO%+QHf zL6zoTMy*?`pE+qL^W9mcTrMtwx`1%9D<~?iN0sE!L=rAsDWeJ-&ECjw{bsaOWf6An zw3OD|aJmz_-d_sO+odB4_Yfv&or|-54lvDQbi(q)}Ih(C;RB>m<9oEvo^{O%O-{w;EzrB)t+3TpR zisJeCpsjXJ7v$|!PMfSKT%=zvsejeD<7k(@oRf80iMS~u7)XnjQdL!k4s1WcavcZ?VSzB3(s*n}!%nb4pMe6*T?`=D6hEkl(sJT=6Zpe5n)-eopx#3>yGI4l3?xu}N zp)k@I`oA4Xc0Eni1o@%vIZ&8DKN1Zsig&^@?R&vH4LCQ5jPleO;QpviF{}50q+2F%L|t-#J1__=IFP7&TCztm zO0pG`GyCfi9@}d7`J0?0&+n!2 zom_j6oTC^TFI~}hRl!|M;+|Xrhc;8Wr3Xi*yUT82zh1Oe?+@$-QUH zYmbqj1^#WO;GY5-A}%9T-6OQ7h?d?1gBhjo?9#@7c8(fIimR$=IK#(4moUZ@FRF!COk?KDEAaCp8o;|p`_AKSO&DJ29ZERF$N&u|kLBB(16 zSrgS2L2UR1_ZOoN3#8MpoE+2qu>-84yF3O^-Z*!n_yqyjDg~EBI!ksu9fzfRA68T? zl3xM3S6O7Qol1t?5B4vzv6~FX_*k@)q@9IZLT{;;hLo1<0&C*INphdMQZfDsO^LxV zYO(S@#EwAb+_grJtXS`_$=sUc??KgRoaGA;I6JJ#G!%b~HO^mdF71{=C9}U!3kfF@ zp4-ZUL+ABAlHJZ5C~(^qWly0&obA6u9rppi9 z!n?9FyD@&Lq}o)(`I^ag!>@BxXPgK7E$QDI^=q;25eY63V}xCEfpytn?1PW(Vqb4V zMvf@iU6)U#m9S`=Yws?%G|!*=)y%*vAl4A{q@^M=Z&c6=~luObq{^dg@Pz)c+Sv`^`vZ0 zzF^m`w;ax7d+Tc0Vz<{ew=29MeP|1Dhlb6>cCz!swaP&SY8?7kf#iN!j51D6xT5)i zoDpZ8u>=(p!r3$%C5a}OvTO$&yY`cgF{I}ZXhk{19JJ>)`EzC^iCb3`d7=KZi59CHjz|o(zXBt8qaZ)HSuG9u%0jpaJN_v;QI1YV-+0Rf z%iq-R=}E@HV(K|{MsE1b%vW_(0I87O4`1Bt`l0bHq^rD5E09WU6}>T0M1YJq;JsFJu8RGs`(B`SBordi551 zb;Pm1(S9+C{ISLn0(qc#5K4(l8c^6_cVn^CF{Tm85E1crwO)xMnR$%=;Mqo*FyJ`&*Z1w!@2gHMVYJJTntThNoLO7uvOJo>UT zG$=36!2C31lJvX@J^}6)$Do+Ty>g0p_5(tFyyKMH56wH!NBJ`gdC{3Svn28u2n$oQiNN?H@GDPJ4a2v#yQ+InjpZXo}aNL1_1d0`f9ln&+W@ zv$*<`0+-}p(AR^s_DAKtVl_KlM?R=L4lr)=?-Q5!?SAisQhDUrk}rj0 zOCTCTzbvKLX1nA^IFEysQ;@;R*@87Uau~H|Em@%V-H|2|ZXTN)ugq*{TGCH<3lj+% z@9*3P2HiA9Qh3&5D4XJ>Xv5}y_kpql$&6#rG7yp?7HfOVuv}}aHKhB@o*K_V^VmOtlLX*42_uU>Rdzx_a!#_oRg^mXkarF z?#b+yye~xi5Sb(?2tCY(HcH10OyzT{JvDQ82lOtqHVg(O5sRgojY^w+y?ns@JskT& z`X}Iuq~u-|&!d(knDAt*3)M|%8@Yv-=(Ihc{T>FW)U65d_Jgrt^4sX3k|I@%e3qOc zj!>g{QoTqo6hoY5?o&-Pw#xYKo^FjEfZa~FJCT1;(AUHzbbM8G-qi`NS~TN#UJYMU z|JfhD=xf2+Gn5YR#!c(JcEF?`()G6~`AlwSL<8${?dezcsBoxe^0m#77WoD5$-zY6 zn)Hb4-&1$WFKFMrCrEprivhitAT5kUAOU5YeF~i+s!`ZcebGynAFT@|yQ}Le;^%j7 z9K|o>%&@;qj>sinA+O|?N!v1d zzg1d;*X-c+Wvl3;0-b){SS}$cmmJD0IeCWMwFKN}M6F4aJF*wugsPv-Dh1z+^}64N zT48zO(;9mJc%vOya-f6~!HrosgIDX6_6HC;F$cWj_&>5;KE1|gP7j?AFS&&k#JqOw zybbMZtIh}rXkLF`6Bss1Qi>$Qn@;+Qv}j-FqPyHv-=R_%Qn#JxT_f@mtOF8=9oI+x zb%QBhHkW$#0P?`YTn2?<2^=*N)=YB3_dZ)yQ83 z7{uBC4$s<7jq-dQ79j{bFG0X@rwdUlCZIGVI(EEN+M4}vFk9-VU_D} zOc_3~o0vA&JV4t}>@r&`FyE`vE4Kn=M|Y~~BRKq(ay)h27;5JGkRjpBT!TzT5D)G> zRHYuY9g+O3c)A0GU3qyn5#@MW`zJ(4?!Tx#RB%sA#m;HGw#y#feCWuvACtZ}(M>A< zyX$`4L4l0Agz`FgR2|^eDDnLn44URTP(`9j6y>dAq(Tjbp!c)n1%{fYqMEo8jR(v_A{L1;3 zIzT@AV6lK|Oouui+^63Z_#+&*TPboZxm!u3pn>p0WBTYY8a$TgeWd$sx03d}CP3Dv zwNji6!P-EB9?d@o&-#83TC0(5eY7A9$Oyy7ip7<7L1`Z_mO1bTH&^n1$fd0aKR!9c z7#HV_ru?=n)*Y~Vw!F*9a?Vt>Mhk1$_dxF#kFI%4O#m zoHx%O?4yO*{Vve%Id0($2@U`k70{`a;6M$w!x-Zg=g`(x%|fsqfBT_dgMsH-h;DV9 zq92lOgwJr@3^5|ir)DjpMmG-2mFY8f?k1l{ki;a%g|Li)Ke(~dlRB8jB=Y$5HNo7KTWN@A=Knuc)_q2H6P8PL3uxd%u4~EM(-IPvdG>x_#be7Gjls| z4?JBqj?!s<2XGICDQ&|x*>gYXa#|=Szn>>{F*%St2$v!FyYD%G++iaIMBquwSadjJg#*xylAp};eMuzSmftG?m$iX_d{*$_Bop4EPPj(>POL^Z9_3S{|sOe%U~ zjpI{T9C5fy@iOj}s{|R-xWC2f+ZULe*yRSTg9P0lm<(6x$gG#v$lX0)Pg3cpgINi@ z+d}1BgFpr(Gp+i;d^n=4?glFYg{@*>CFAFgQviQQo zH8>(P@RWJE$x#s>)j>A@yrA{*ZIM*v?RtVrwR@<~TK1ZW-knK0&%86YwWcv3T8#NO zfI0CnpR*{k?ET__KkjAc2Hd4)itLa>`y*iwi08mPIWpg*)oVabKI3v#c zKGf(!Y0a@U;lZ}@0lDU#2wEq^YITrmmsy9g`cW6t393rIF(Mc=Rk<~1C*A3F0d-3k zO=_Vi=Frd6p7d?ciL$zfpCP9u7>1!g!5t;H%N@P>9%9O_WxukI{XnTjer8=dC%?&_ zru-=eB|PZc^XyIQ`wyjU_@Bxa;CO@7tK|-JrB8>}b}NJT3@rZ^UWUjBVNo&jY$P%6 zLu^xyajj*Fiwkp_*{jyaF}C55J%FcJ>>h}Am7Qa~2c`URvZXFQyij@L^e5+j;bx}+ zIpIo4`GiA6H^iDYNBN7#gv?)^W{mYd`Nx5gc zHMr0duh4*jnt!l8xI`F0_@GYb>G7aGtLTUjpanF|>372g@LUuGkuO39Xz7S~^u&9} zsiPxd_DUd1ei5xQT_`PlSvglPBDR+tQRueqKqUV$3}HTQsWu(v#+K>6f2p`ciM31hF+ z9!P5lM%}Zekb@SehTbc!46qL-`729|j_lgqi)CBjS=MB`(j-9~A2l^V9m2N|!N=uo z`7i;=0U;$6&TfW%)}7j?gn-FkusuF|L8ONC;MxFP6VG*!!%wq_A0j-Wb3Y8Hr-b4* zQi8Dc_y-+-U#Y;g7$?*2V11uG-1moO z_Vg@sDNDe?qn@`>dNn;o+9}aZaGn0&E1t1D2nXB%fniw9Zu|>N6icwFcHTuU#5e8{ zs?Qx=@sv%(oIc+M(0+?h41|}%xVpU2WQt&n?LRKCAS{@g%@yjrIc_I7ed*|Wj0U(G zYFhk1)%kw{y}u_Vay@SdroVbJTuJr>_0nwK7#lyvkKmEx$_)FV zw*I+nIK1NCwL)#zm~!(}J9nU{$o{f(Ky5bwllP38cR?yPX&Jm7f$#~u`Zp>zKEP_C zqi-&8#fFXIZ1mOtCsYhf9}KdTQj!Y8zHc6O}UV=rH zum*_R#u;`Z7C&(_NF@B;nFjdTb_+@OJf)Kmgh?x&$waT33aeRMRWe~X|2ZfU{-Q(U zgXMiIRJsDwenF>1-}$uSK=t#I$IDFC!~*iA-Cx`#N`Ddjmn_b@yNvv66I=(x9Eiz$ z#7X)@lV`TM3;>mIsfTzg(??8biK1WM6$fRH~qmwGh2BAvG&C6#Z%N_v{QKsb3?@OOFV8{CtrCLfRbpl)T zW+K&S5||T%RqLsOh`z$mV_j1M1BVZFx20Ut&Oy@P{%Qapo-HQw+9Qc)>-rfPxKvAE zdw-4Z4|{>A#Op+XsLx$$oKm2Qjzgt;IDG38OkybQ-*9pfnx*>wTR8SXi4;Q8o(z%O z@;5WWLL>`T;rZr^HsQ2Vzr&XD?DfWBslk6ooJ_%ZmYxJ0*Y;`{l`}25=pj6W;ntdg z#rsml2`ss2eM6OtK)p4U+RUmS&VWFs&lV#!X?CZeo29l1rH%yA-cA_m@F)6$mtv%j zA<@^lPHA)a%WI)jGB%+9UAV_9YQS4mvLW4o=6Xh@c{uCwg;?HTU9*$@h|0fbz7MjJ z#95qP`<{@-&cSWamK8EUHmSL%B;S#$+;+>g2Sf%(hSFe*)y~uWd&-HF`gc3Dkb*-m z1+}~Ol{3bJjtmz+t}jLbyz>1o#qF4&d0}?4AR`6^zomS4ZER@$G(%)>dP#P{?>SAa zlc%``OP3XlTdh+Hmu`6x&{wKko}jNxtvSbYnnjwrupV(pd3&W$$1JSc(Mi0p9zQ?9 zmI4jyl5@)#$9s{3gRz3Ya1uHWXf32l}K7D#2;&o)%Jj`%wXZu})%^0QZt z=%Xc03JXC5F-pntq~7{Rz+s|}6nwz?#S;g&3SP(#%frCp>BOVQm+AnA$^<`W$dNB0 z9TEYDDjsrtCPz&)$L(WaaHA)Chp07W>I0M+WL9$8PO(Xb@a0Re+9oIqWUfu7c=_#o z;pjjjC7;e^<*YBD;K?YHHWKjP{ zr$w4thhHEV>k`>jd`0d8+7eoN*-j&_bj4MzOv+g9!e65F0-pwGK3$G!Bf!8W2Ls%N zoVsc=b`;Z!*Wy#v$T05~3ZoR}f(j`y&ykKSOA#TC5tNH4t_C(xxM0QgGA8jUHfb+U zSPDIZay)tm6bwgv$ZkF;30CoodAA)PZ*$;0lOpf~x_{a^IB zOdS!#%HdAcrSMPZ**4Tgg6!_;bD{Z3%B(UVHPJNUagZ>`KN$C+7V8a(L+FKtXeu z|9gaNghbx|wej&v8{)A87@ZzCA{o|d)*F2|KiHPDy4NHWWAd0U-x~C!WN_5&iU-4u zYyH61pbBQd2}OV-idaYCr!}%?%l){%vBY#6w!o7i(yu?E;xNUJGiq4u7n>o^$RyEF zLK6hIbN<%KuhE1#7$Vf{PTcCVNchUq*ZAXalme*beu?hGw<6v^x9?{aoZqx3%imO* z=>~kSb|5#P)dTW`J8+-Bmm(I6JNt9MURl8qjueUlsK9@6qN3YCb8GRl!ii6JC5Pbha4!jD10BBbGx$0jJOf1Vzpfc0-;!l~CB zLKebhumt;`wMtF^r~Z>PWve_TaX~_}P>eh*HMf#|b_-5Dv)7+xa2Eh1LMMzQRZ6dV zk(g4uwOKe$QeRt!0hVN?$OkNA%A?&1^N&(~`W}3ZE{aVIQu~2-`vH)>u|4LW$#D=x zT_b}!?%Hqdf3~%{NexM~Bwb4%o=te2m(s^Q6Bma19X_1{@35(@>4#y0w|AA9f^Hl~ zYGPfWgr&UiF|c8Nfc%^I6>D z7gWc)Q_0|kGr5bputL8qBJ)Gc?WSLU7!SLQU=L*?NYmH29_#-h(xL=5;^l|LRrtVx zAyG7E0Qfr;Hk?(!b%t#EbCof$g%L9xApV~AHq25w9K!%=NDI(gn@^v7mYhgy5`G=S z5TJKcQQ))v4x^Gx`}E0=={~rzWg9@+Vs}$H&EzHyON6NOnOLqE6?kVf0!p$)sIDsW z*^u}#nb_}#V)K`P8O?;i{BJjHew&&EK>m)&WnxC7safBG-=;Id{SM^LHy}_D2kGp} zI@dq6k;r7rc5yQ5@B0&K3^tnz+!lwqj^aT#Q<$wVTP^2TLo2U)&jPqV5klp~1|q8{ znbJTwYM$IYK^C&?O~euAbOGWKm=xH`#QTVpGojR*$Rj`F61-~-7`0H`)cPpk zhbWpjhCb&Fo(7%8ZjNWsTI(YvvvbuJPNX4|!n@UES3$Vv6+qL(5r)Cuwg@-hj0`!l zn*V%OtaQ9T)iSrzV$h&d0Uoegl9x^NJ@-xiar?e>Dl0TAcNToyu(}KK%Jy0IDQMJf zK55&t-rn@hiN<1N=QpS*ZU?E9w9{B zm9@7z{dtW0`;xB4{#a3#R15y3PS@p>$`va{h_Y>dZUYqklbWVWH$L*w#z~Mk<0QN? zQ6*(iqO(=gl?`(Eo_#>jHNJK&9rvV&+DGCtI*pHo>6zq;x{1Q6vKRJlmR3EJu1q{*?5?5vJBiIPpK!ht#22XP_+shOqb*(W!D)uJ6ZoPja{_QA0Nc zVn{lDY{BnBbug+I)>%3(Vc2QKPPUlR#L5$ac+$m*lGo$uW=efG9!e9?;+QxF!5Zvs zpqXk>qTNLz#A+G$kz;V`61>L~WGCpZ@hHKEmG5Il3DDv#8b&vRR1{0_CmadeTO79l zkE`&&CrXV7-wm8v>Ph^IgYz|5hE?~&UrpztIo`-`pIkPam#K@54mHJvHt^kyza$<0 zLu=ayECVTY*S>|NXo&_`DIUhi#NPbrfAgz=ila}$Vn`t;6KA6RFtzU9_ZH+Tt!}(~ zW^H`WHg9dLG@&%n763i+O|!DaL};NKK!=RE@bji+{oykk6*}j*$2c4XtISk-D}=&$=&>HbNqqG)=FLh z0l(mCU5%|O>h=~@GuTaF1J7DXoMI+GH_8^QyPd@0X!GmwY+st!eappBiu&WMER|{` zQAWX3+BB9j%oCHd5k$ZziP8?tA0I{Lv2wm!trCh;3o%&XIWeU^dth`WtQ?*NZEsx! zZC7KVd9clS|534VFvE#;;4K#8uV@)iKEdbUpce!x9BAe!k}pPIx|R2pM0b3NGU`MDMeR(M-O z1Zy+MNUGTJZYL$FkpX4T&lxi)a_xIpv8%+>G#_#}?RyEW=_46ue3y;j+)3I6rcY98 zl?Vm5(AiUHcw!>%m|f2 z3X`%DL|fgHS`h-uqSc->bXx{JUxAst5?j*RmG~lHs>~DNYZBzje@x~_wRcvU@1OS_ zkx_s(4dKyq*gpQ}Oe%V$i|gMI7tC#{9+^`YPGYFUtrDN+RHFMDD17j=(D9XIzoB-^ z%$Ew=%VM%o8A>32CIU9s!-mb@pWJNXFLymB0^KD)>!nK21ETA7XODG zRAbx<6NK|UFr#^q&@B}7Ic>c#cy*vSrx*BPxY=vO!CvoeR|TCO5U1JVx|&)qf@XU| znqM0BaeqQKmFA~CnUUw;d?j%BS1_6g3D`&-Y49E$24fmg{g(b>2lX2~bKdEq%1#|v zJx}Cm^IuT4@6hhW3#WG%6=;PXR77Tq*nWOl!S2iv(A|Qh9d_Bzl4~?Uoin$dv}B<1 z`X9=_Q}vdID?H=LG-Nz;nLQ9K4_4xEtaL07mO$T3<@X|eP|<0+kmo9}o|3f{=PCt} z>fB4VTYw@i%60YNz5}^b`S*cYrCqi!LP(PvKR7~Njj@^A<54s?FM^X8Hu0gvr*Eku zn&4e62$bMLQ7L8TyTI{uUql2ZW&vWvdpIo@Ln~;n9cWR5fqKUT@$MlX3@idIIuZEq zF!}kANH&uQLnQ$I0EHx-xGbSNTDl)|lI|@QCTF`~p8jQ}@SE_=@GnRj8MuTy`Kltk zz`Yb3*U?q@aL0^EN(C%S^V`9(orFv7&l3!)Os=u=)lsR)`n)x2ZDJ?~lFsGhEv?t< zLiVYylfgXx=Z62Bad1;Bg8^|k`rr(rc`8<+wx!w)fg^)Q>f{-*MU zBoU|~kymCb3q80R30j-CVcr_@DH^SmL9W?L`Gs!0%$=i~p86s3*>Sg+SCRnfYj9En zraTppFqb8e7K^MPJtv$%G6$OohHv;p+TOmfz(V^{vZkEoYMN^1$iIq25H!i_sutoJ zQx+9aH1MHEE^3hSDJkXs`$W(*;WFZG5#nz2;#ciT8-vr>!+CuNiT1W^Ad(S(a0)0c zQ~qhqu#sYT=`>;uC*%FIayrUL|dv@A>!(lT!mfRA_O_(aA+Nf&dnky(xi!naW&v$%?iC z+&aiRT`s2Jcf>nJN7PvoEMb^yq4u|!O2ft3AZY_}=2lEuZ0btH+GU+HVAFv6&O}|$mOkE& zGrP!{)j7Bi)?b=&uc-^jg0n(GR9@0&wh&%gUSjht7Q=5^uyBn2QQ+|1OpCzM=YMQ; zhRr;Ik4rua<*Il8VZJ8mF}ET6>Ai7%@36g z!>ir;HmKDY`8$kP`+!jm?KE-Zr}V*Zo<_>=p|7$YSE>U7b~zk4>0mC|_bmePW7oHl zvl2EsmLqxXpb$^Wfd=NT?su-FZ?R?Cih%YLz(nJNhc}rKNE?iUU&RtqD$j25u4Vl% z_+k=HP2XC>q1=OO_LW@{s}+_^l$N(IH-y@TJUb2kl28gc(_Mvrb`mVqYUvN}%xfeR z$wAx(sx9&nT&h-r2b;7iywZRh>a@hXx1ha|G!y=V7JQf*G2QIBdhp9>x)I8hYI2^YirDp^@kg^V83T+9uh3O zY4Q0BAzU|=NU*5a@wpt)1-SM;$z1Ps_VG>cA*@n9)%;UrCBH`($+XntVYWr~jpV%9^2{I| zsw$p99dMd!q)}tRs6vvyHI$_8Q;^F0Tx*D==zV3r)Q5l3AkT`yQzgGfO^6d7t)u^s za78ov0&eG7;5dnsHuQV`YgPpf-|_lu+E4%Iji(loz9L-WwSfK8L|20qmR+Q1{_wAV zL%^m@WiEY6z)AcBuJh>=14bdtcND@@k_|>Rlb*MIX93hyveGfO5VBw_z2(S1SkEcy z-$>{*hRuFw0q_nesweoDeWF*=BEkSBP7ja@n=LlbCs+0)Lzglq=pJcqayImiK|216tG2wFt@q2jLDjqR+9Ma$bn=ZL~7SiZQO5bM4l$o}WTeibRq@HYD}mq*5G9 z&0=K}(kC=66Eh6TFwF}7nrw!ww%#8|KN|E*m>z*^n^n=XlWiqq$lxxp0~56y%XmEO zrbDV<-tfk;km06B+B zTZb56P4G@CK6~hwfs+e>zTGgvFG`*AmC3DOP%;&>jE+4Nv$m($yuO|5k6I+wQ+&7a z09XS9u;B0=P*_QEre`2$W@K#{>C6v~%`6=hZn^O@(Dp<{z|_fnmW4-TDsxPExB32N zY~!L!CvPkbs-t3gU0xZK8kM(Hw%m7eS z69QQbKh#q0l@b+zvmGRu0#t51kl^<6V5ew`*~8%o;|hQ!+9H4LyU6Q%OJuTRizgW& z4FEqJ0ro(@ra-Vu%@o#do=W3=ZW`9+0+jl=lqfV~m@E;QCu3C(g|il221+b=xwRa%2=*3doDYTkE@;B9LcyqZN}TyUC@7YY%!w0~pxTd;%S; zcjC62ZHq5L_;FpCtX=FUx5fq~?c>Ke)teLYM{2H4_Yb0&u3V5Iaf_LOzxl&JP`szI79@l-al z0MeBO$jIL2$8tnspT>B@sJf9SBLIdCPkpW~#|WcxxJN^ddL_#rLu?;Se}G|wtM&Vr z*>Z|ubxL6pZSlnSL}W!V#jtS&guNO9TIPEosrcz^8|=)u3Spq@0$e-wL_Z`jj9#UzMqs7TNOl1ul|v&4uk}>StB;wN zo;AsqAjf5a2`o*`4$aO~-t%W9<8PzUV}X{(W?r$huBXa|LfC(3W)upO;!{+t3uLh9 zc~$98e}B;cldv!KmKRGHSz4%DEvAJ@^7J5;baDE35++!-R!|X4b1La=tNXwE*f>Bj z?1`D^NDU;;h0)X)k~gB$dm;0(*H;(zq>WOpx|x8pXR`v9;#E6a2i{5foFVIr|3}qZ z0L9fc(V`6Q?(P0Z5hbswE`x6bbkcnYa>y%=Mw5M43u;Oxd)tfyoW#qE79#q>5A27Qsq@~Vyx zm|Dsu849ndUN=t;XV6zT6&SS~Ye6F}?TM66cG5qz_*MaAWklO7;{yqrrUzP{+L=$T9V-rT3j3_+u0uspRcHJZam{c`>6V*9L{UY3j#^Z;A7xC7 zH$wF)CXoVbk*MYHDPzdpT*912RM;B)F;`nL-nhhT$$t)QG!MpcuZt3IpV3KgaR7}f zJ=3i1%ye8m5Xr0C@yuV+iYHf~=v=nwB^1k?>k~gFI{hz24fkS;&}bGrT#i)@@?UOBVR{#o;cfMPKfoZtD8U%(RCCFvvaT4XF#*8~Ufr-u($%0wL$GI;lhh#NpH{V4lrrKA!8sJVHH7^)SqH5YFZ~-R2_dt-17lv9Mi?%TDF& zCC$*qs3q9k%3kp&57FP7-2~vsjKDpdN2eRSa$+F#uo6cfR8Fb_i)iWd*iUmr_@H_% zg}rOS9Ghn#OOO0rlJXr?R%$e<_1djmFxaCH4mprqqOTn!DA2dr4g%1%Hyr)`)+&q^ zT7Y8>OLo^4w^4z7&Nhd`nBnIbZ@7;{Z{CA0`KK|EKaV=`m@082C;esMMOLT6F((uv zFuI)E*w(%a2OjJP{=NU#-&k9K8)?29tywJG>xOFEEs8kP(i&-5jq-4vSKMc|R@eu+ zWc6VwfjyDKm^u$@CY%Wrn@gYsiY!haV8xsgDe$?{Sa*=0q_#I|ITN5OChj~bI8fw3 zZW+9TY&3$?Q~26$3y96|VDjX}LphTS473g>DI|%(qig;^W`jZ!`Fw4Xcp%RJ*;po; zM3LoQ{SJ@Q>ibKrdQAvyfSa7UBJH6KjrZ5S9nf-q`MOcd3@DbxB@YsRo$pj3KVJ zMt1nY#wM-}5yL881kCSii#T+rzxtf7xEyT+d@RQC?CG^UUT` z%?Y@KIS*m}T4%-e;%k4LO@|J?MS6fb<JbbMUVZQCIJzb5?|Tb665TL{mOf7K=_24TA$LCyDq4 z&51`)Jo5U+jqA7i7Wn%;Vab{LJYg+c6W%)HP%#nzq+r4(=zJEG95XYM-hrUZpa~$z2j*|cBoc2lnKJoX4#eJ=3`UOBAYHW9{SEd3d}*&g=WMA=~L?x+t1hJDqtGrAbDl*1mV+j@CDUY zFELKiwBpW1Zy~G=!DesWQu7vgnbMf&!n}QP5`pef{x;Z%RO1Vk}~DQ zs8}%S69;y*ui@TWkHiI2J~Yr6qY{%CYMoCG zy|k?6Ldl3nFct^02kJ8KTg12}Bf)158()p!=VJ@L+{vzYTkM~Unl!?P&~si>n+H&W zLROXF5LfxDN1-p@?mmUZv(^-H5mxMwkiLygW)ghR--5@j+(atz0+FY?-ZAmQ=ihOU z*O!nV4eGBmhDJ#?8pBtW?Y+c}JBV_f6ck_D-|>UJrrpf*0v`@yOQ&2X<~eW^Ec1JNRTj~X*BA3qO}V<$3V_ps`UJYQOE!G z_`ngY``g5`cdTL1sP53_3=i)m!%yd4_X4*e$|G~Uqf^K29j=1ksz`9lF{}dsVBii? z0wW_~nw)y$(d1y_VMswuC@@A)X~eA3+9fOe3cJma4+5+yV1NK=M2H&^&H+EJLpA)H zJw%(_aex<^uy_=OyiEWb;S747$aK60b9IzZ<|vo^^16ZMD`S3#wn}^_u5Yg|H-JR( zHKwgu9AX^&BCe7}U)VkCMkBYo(G@M+}-hhvU`64~)2icLR6id+^E(x60V8Ut8*G!mxN ziI}Rn(4|CzUkrDoDz8OB4z-v%w})d)=tM1oUf$Dh#PHivEyru$3ZMz?TPg(w78a7< zb^li=F}UyH#6C}Z^ek9O(EDwJG8%qfG|dG4udMxHm-i#Kl*X9h_3~Awjll2q{90-_ z+zzst9kM+2Zbc8uivzGNV?*)L3mHzj+TT=ccdF z3UNN&;l;4gFjxRf17JEC&fwlD;y`>Qj0-3dNu0uy#3GI*CDw^HcY zrzH;oCNUvT$A^9)Lr20}(N_L!zmdR0rG(pp-)fDU4288AEa&E=XXDgNva^cuT49HN z@Ay0X7l$cisnZO9G@X}kot7->mv0CzaWL1eh$^txo41t+g2hg4BH3Tbu_~uiR3xQO zR6d@{DwzZ{#mSg8F6%Oc^MQzx1Q0kju^>P8=jZ~hpFo@^fwv+xr(xrX5h_ax@*8Fs ze=v$Gl=5Jez>upPOD5ZQ`<}Jo7d~UGg@}r6jIg*H)mXUZ^gRjz&3GFwC#uEMdok`6 zzqBH5p$zbC2Ko>gZBND8r!o@R?bt!0m|D=FK0uVy_xL~Uu$HxIBijlSXt)DJc~>=8 zS*vmQ`_Ab1WYXO<=w)jNS!t|421i#?P#xHhPRGF%0RTUZ_J^BHv9v^QsN3YnvzC&4 zwe(Ibed~AHcf+HWdB#Qp&2OoMKDqa?CS%c3t=>~p$%sVK!Yzb!AKnvHj0#tMcRi1WNP)qn9ntIx5Cz>QWmTGkf4G(*Z8flZd$P= zu(ViNI@bL28}@wGg`UxY6eW9hypyqfsG`O0P-h(5jJPEDWWA~CNGm`b9nj?Yp* zEA5I=Y6IO>omfAXW7*D4=Df0e&VO&TkjE9cn`sxMVRXuUryBsOu^KBXs7sEd`OLJB zLD%onB}bdSmuykXjtk8@;LfYnv(rw==jh``|!(u z&jPIql?RE-`@(Z)CNB`|`NN;dt;Rbk58Kz61CN?{hIva^aY(^c7igpVq#f*cO6N~~Ngm)?i4a&L*q<_&a&3a*Zp^;NB zA0jE{$D%EmPnJ8g*w~|4lULI3nf1m;FH$-j*hR@ly92>3uqA3+Z3mwSf?GrJOHd-B zn@MPs6`9t~@ECol`uR7T^TwqXi)LgCRx)IEnsLLBgu$s_8?eIl1W5z~rW5-zS z$XtR~9)?U4Haf8`&g=JSF&X4Ce@J^fZfl%fLD^>2w_g5M3ULt{vW3gauE7e`GusQT zSbj@letvDjZyjE_dD9AE`8L`83BK^K@4H6e{fvyYBQ!*|NSCXXcg65S=xbs$M{FKy z_3eTCW%+7*GS6pm1esE**PbHkuu+Q-+RJI>#w`AE4`H(nA>_^6mwRKx0nwe7W!zU zg?D&C!ZQ=-F%%T}ijq{fs+&n^`|jXdKI2C}()2yvo*T#eps)VKpjN#YR@iIO-71Z= z3}1=%tY}8<2@2XAk#&^$<=Z3~xv9@%nx?!g008DSs0;>dftM;MHB1kbMc#z1;si<+H!A zOlBjMAp8jsGYtmd*^mkeoYDwDATd!Rg##5xn8kmJ_Q8>DN~U%C6kXLblKB>Cr5-QN zeA?9BA3{Bs@h@~ih-q1k1rVG=(!tyjHM(b`_;t8J6z-9Ax})iErq;I=f6C&uR;<{+ zPmh=3n4pyR_kLI9tGxClL5|H5N3D08k*^TaLyqae+dB5rS17Htz%w;?)t^o}ey9V- z=|`R@XaFo-8UOqmu^P1Cyiw2PAvna0-98=9a3 zW|@Jrk?*;mrVqHk3@5+a+Zjn@QU|2Kkn@*&07JH_gWth#GY0OTJZ#jZ$vTx?c~qqpw?l0(ql51EE-|1r`b*p_D3b}On60C{@Nu=)dFPQ za6RN*#EqK6B})-uWfLnePlHvg@g-&5UY|=n> zC-3A0Y2W6nSlf!V3v*j+^AEYBw5G$Z zFq<j0@iK7ZevjVRm4Z>o3~In$)NrO(#r14ON%{8v3M0V|bxXWFbDOX=qv!p@ii9 zjD&C`Z3nZO{42D~wLQz%*uy;oY1GWI0{<-UWettjRTMDURU%Lg+Gj ziKkaC&95nsTow>Ze*taGDr!ieEUtiF+qKa8sgHOJn&bWOWL^i;0z!FWW;lceN~)>hn%jMlVus|neb zIfFn~Cu0%QHxF+C$XlFXCs4cFS#KMRkx4rVE}#Mc@>;Ij2K{i3578XW+Y=69q}(Bd zIA1!f-A%#hC`Y9-&!#p%8JR;r>QvzW_lR2^KtVh+DarQIliGau0LST1do8o)2zw2s zIJ50bYs?AGmS54Qb)&8}0wSI1MPl&TGRJm7Af&*ko#`U{5~v|DG1D#!N{(S@o;K-N z&J@0bYIOuiR&2aywLN&ce5=791UgNmc&OWEV6RsfNptdB*3`Dum{AMedo1%Fvyv@R zb)NPFo=Z9l?AAMVa_!iKIE1DiF&th`^Ne)&lBx0q*7r53s{9&kQk4`@1k;x9;n?-E z4?vO102_%Je>kVEbO1Xs4kOUyA&Ze(1&UNG_uj5l1dj*NXr1W8q(c({^~1sAk~n4L z)MY;~StSKN3+)0pshhO7#QA~ZK`93=rkg=`*2GCD>ERFb23~J%JA|Jk7|5YoUzPGI zhmFLy8~#{jb8`cCen~n_UUQ{*oE8@TrGunR#?_1ieba<+AdjhDJl{ec=eK{3^R8f7 zIvZ{|KtsiqP0e*u&V^pju>cM8$O{TSz57!@CekJve9?QM$!N4hGVBhpM8LEgwG}B9 zR-n?8<8OCKA}Bx;kYHzYdU8U^0UD`+JurD?bG>G~cmwi#-i-X+O$Q=yvaqpL9OB6gPJq-vK_9LL z?3?y?2Fi96#<2z&Ypx~&`0=NUA5VP2jlEIT3)UfNZFTgx^7IKm);;xFinPR5Zv|hG z+1tj#O5(!usgujUi}?%&h8JT!)>cQeT}GM{)3|sj9xkYN`fZHA z5M~X!DBoJN*yh-pRT<_<65Ol=X*Y#3xX~9>lTWq`x`36T?-QpNY4CROjWd=Xv2-j7 z2dozD3T;3Cv|IY>l}O`s;BdhaL^gJj6-GWbkEJQ1zL5zb_xUQNP|_w#jAl`~t41)| z0c*@43|3G=gm>cKU?mhaDwd(Qxp>s@PA1e;pD?VxrFi};L7zkdPKoXBQJBhuMy8Ro z4EEqD`w8)py=&Y;ZC@pD2cLUHvOmmBfcg-2&!5g%OWziAm=0SXb2&Zs@05DBQ_f_!JEE#yy` zu^Y8-BK~>H)H1*Bsm`~dH8=`hO1ZaZhi%?9gRUs;>}wcO4?IP71r)YAUgU^zz@2zf z+o&FFvxE?=3)5K4y%^3&ys2z)BIa$di8a2W^eYRzP&T!yVAz&ZX)f_eD9bF6>8p7!xqyu zIPiLfPcNx)-8NSfO9sv9lPSwZVrBv6a8w8yId`{R$aCdf_FJK(GqdfA0phc5!@#uB-W`b@e=0xFNg3oF^VYLvrEf*CLJZk=mFw*j)NIk{a{dDQX0=BN?D_%l_~ z=+VR)xMj)MrT*wyA3ZBABmjG6-IwBNEKRJz=d%}z14oM}gYE!}2-q_|&LS)O3RH{} ze6LP51XAea%R8fEoDk0SvCsF(Id1;ieccuHxsZM>{ht~UA=I?p9uUe6wZmQ*m^UXeJ>+gr?QlJGNjw`R{)^Z#ngnF-(9 zbmzgyA@@u3E*c`f-cMwj48ryPJZ7#S#C4AIRh-8>G>zxjEZJ*YDgKHbJEkq?YhHIp z8nj?6tr2WPyn?-}bBYR7j0q)s(eCnwctK5HTBFU^YSe=h0@^V%gjp!T|`L#kG5f_Pt>CC#dIrVk1f6ml4sy~s6}i)>h~^^R6*1Ib|r7*wF4&_N^E zHgFy7<886YJpO~q_KF(urowvGE^e7g><($WWA>#f0{JRPRV$%O z!bPtV()xPaS~jde0VM#BN0IsdY{6 zrIRTQWe}w^&?(8blPW+WV4^s3Tp@Zd1w28ZMyq_9CRW%-mlINkO`O1LF$!42HUn+o zqi!&b{OiG__nh?fHNkNGhci;mJ4X5Q{MMIrK&2$wMg@%brF9?r_Qjsawb!X*h4$o%pDfzfaR%VM9b zEQ}|G+3zAMO~(T=fYJUon38NE&8f*p3JA*o0cZzU6)5(%EZ(a&FJaiY5buQ5g#sxc zSHs#8TV@3&D=((3XzK}SJz|qqd5_O(W@Dll$V0@`vTFt;{^ZW@a7l)?7{rDdel4YQNx|PRgk@Lj!d5kS1O}^3WIhs+=xc3E?nY9y zKTHD$cGW`~BX{K+Lr;GXzx!eHuPB5Uk68OF(hW;m%M~}yWKLbGwxLDC9e900UwhGpdSm$<+)jYXW57V!W$B9S`wDu=ULrmMz07H_@dy$b7 z+{}f3ys;iHYcrRNu&vV{!SkZxw*~YVaPuIYaf;NEQ03T+-Zy^50qKl{|5sU0lY0@l zW(yS7)7$>A7!DJM!1pW{$@V7r6?P1G!{r8hPC-U9nYgw{{y z!U5I~>g4;ZCG9Iw15OC72HX&C|EHP^I3egCp&XEZeQ~*B*uJALA!>q3^@-yQj!e+& zekt`IFI1W++D-+vwC&L}OA!bKTpoCyP=B%`~)w>iBLs8#7;25ME>Z+*s&lK3aL8y8=3)(0D` zBW(Oa+E;TA^f-I_MT|2-vxr{MmvmoE`8_55nIk33-(y-?VE*ZbQo#Kd(h8b<)WH0+ z&}zw)IKXNF^ZzHwN=>~2RpW%HxHkx)2s-~SPUsrs_@E&WtZbmfCD1S-?^1XsmrfhM z!raD6v6?571rrhk40)Jm2!RX38R3g(mO*k(jjW1qq0Qyyo(7%ape{+{LRcmDmm|0_ zs|5sF!>S)#!C<>(nqgam1}lC<`Z@J$8&8c)HmHSW%RomVqm8Yw6e5bV!5O1Xk;NM= z1`M=3;kB@~?&fw8HXJ5v-_Sn;ZN0f&hs=(N!+sPQOO^MBT)?03*xbfiv6&~69dow_ z7?ive5mmG+Ik#EKaHo2Y1D*NcX z)j%^u&}x)R*?-k2J<$O;cf}|H(3oK}c79!lpihuZCgdAxa6Q0&h%FHJ34&Q+PggMPNxS-)Q9UiKi(iwC z3XT68zVaZ%gjY+prUu$8oAxL$PTg^{$ugf*OC>aS-jQUEXAitpD=Y2JODUD3eVE->p5A6Nm+mjPK-0^&Ui@2}tj+=+H8WjhWCdy?0|4S1!Jk5q) z7<+?O0`6FgTsL+dtluV-WRf_OysSxJmYs!Gc=v5%>M{^IfQfj7J5kZtIP_C1`Jxb7 z&8QtPoP@`lofKbnUx-#A(YC;x*pI;Tb3s1XRFnt5g>1@Lxoyrfwt z!SF54;8Y3AF}|ceK%1dWuOakyuQ(Z=7DWcv0UkxiSMr@=QIobV3S3L9r)eiDB6O66 zd`NIUs9Y9ETtz|Xqp7ZmqEvNsjrAq-Byk{NAxu$YgpqI%mh-r0gW~F9-cF6E#B_8X z*H(oG6aJx&1<<<1g*%ByYG*{AhhB&$Km;5ixOXsvO2RQpGT}Y!0pnGtX#=wwMsa6M`x8R1 zVRkRM{JdoAluKRYdE{yoHLMIgvQT7}6SD(JdBorn7S84tyI2;+l!HP89Q;ysJPfemf?*~QomFWh zc8juO<=~@{v2luUkTup2e#!<5QB){l*BPT9cj!`E__ybXR10C(=_7+aAcJy4g4dlQ zuFW7C6V`)Sg%gruIJ*tb4K}K2Msdn z^MD}ZMnXs1puX*lx<;57?9swy2RcIp*}?IUCY`{5{yNb?myo)z;ggXzvWAdN0x7A9 zFZLqE;5#H$iQpr41uEFpBXwP=;BG6O#mZ2aiHV;O$0^C+Cn@+Pc`$q#9tc(s%hbe2 zqbjgIo*{kO0%mE(^KhA!lL*G^Q9di$*mF+ON%w>C+qy-m=cv?>)F5~s5EmXc4`>V- z&JI>=-8H&#iv&a2Cm8h5%vDqeA?37K4z6ZFFC!Q9o{I)S*#ll!xQfoA4q}a!@(Os+ z!%$s~IRb1(X5|=oCI=3L6oKs#jIDtNPj4t>Jww$C?U?}N35MwVLM8`O-q>@(kwb2; zT?n!!U?_4vA^N+WYzSLXg(JKfl&PAXFn*^If%iOEs{O68Z0nR1&*$WCh^3SkOG)VX zE|OKK1>$wRUjA8%-_?rmR{Y%}HZRH_v@z-wN%}AaL@KZl$s{7sEoB)*LjHp>Y#_y% zI?VQ4+n3QIFTp8UIuaS~Xq#DNZs5qWruK)r=`e5#G9&thv0Bu1nW(xgkaG&M!G}r1 zhhYRut|rKo1=S}5#JL5p;H2llGOM5%ub)P4N(tGp=&90teJ7F}u_x^nnP;tYH*6|; zbZHOk0vHJrmpk*tbxH^Kc9`LyYrnA!54z1Eaf$gnc61V?cPGI-n9kmEz!G~5H*i^M z=V=P@?-wWY(AvvPJHXomrxbYRdd-tU#NMHr?Ck!8!&;-~IfjBq|BaF$cGk$1oF0%GayoO=eT0&}_jXkWs0G3Jh6C}k7eB0mh< zPY$;5P0D*~pq_7v3Wcf?afSvrqs_la(HCokMFkeo0RhKZqVfg3Ch}o!x;}p)$$( z2b)#1Nt5f8RQHp^?yi$p&#(q>r>@N0385D6Yy5cIy~nnFq(Z!oS8enhwz=W z1O+k6fvCImQu02UMxwAUsPx0xW6R&Q{ovQP?*0CqwuxDo1?n^*<3KZxShuUkjgZ#I zMD)Auqx{*O23ArMDGM}dMb z0u49)W9z~EbPTcnDfm8)MK)5U5^wZk5+s?Gb7+eD=L&IC2!0BVxs(dNdM6Qp<2}K4 z5&uG1*kL>IOk3{TAW$F)7p_4fE> zN|%5U*^;Avt9!eV&x@CURiZczHN>ALLps~raH+5TTU`hfaHY>Q zPty1H@K4&llB5UbYPDs!YmKoid8QF(>A*2v&XK+WuSC49jelE9(m~WFRz~;uZFcT9 zac9b+V-E#TD-KZn^qsHBftc4l2PS0;VC0%p|8 zd(`r461h(jxf5g5V9!FZ*|yM70Oe(}_dvqrW(uhTC({X}?Zt(FcnpPUm7U)^D%&!x zBqZ5?h~>Ph{1??7S+u>3r5<%H@+2yKb1?YT-kg)fS=4G`P|^cm-%|q@Vf<^Kz9%gl zCx$a7wsyobef}e-j}I*Jy(YX~;*g-xr?|}^z^TFAXdh7MS_R}=5iXVw+>QfI?d_Ch zz?#(XqU`Y3?8|ObwuMjLJYiWU6MkOjZ0D<<2Vv!s2}AW^JvEa@KyftZ!SUYh0~qis zDEDQe@VTzM3g38@4dMv0Q91i}PfrruFEnuB8C_@JE1o-=diQ@Q34xo0d)puS=3kQK!=6;7aNry1;Nv;P6Ex^Sedo3pSdn` z=crNF;teYL`5G_04NqvdF(!)t@I6)a&6%B{@rJ2?KiltswrlU>`yfICw5tM%&9uCo zFDO<4z0ig@Jpp+`6*ZWqtJkaBl2qBW+(Wlvombnd+f|t$@vw&kuuUa=wiTQT7uokY z13M&@di`7$=-62@;;(Y7K90}v6UD3G0N<0P%PI!OK862Bh31R^uh)zq1q!^t&X|fP zL@9$}DKb;^msIOh#FL4|5nRHPi*#Lo9zCnLchq`)PnIJCvvC-k=Pd@8W-cEAXo1TG zD`@-$hjs}ZO`tEn-2Cmn)fdlTR=bY&Gb;*QKV>yqQ28I;7rU9iqbO0MD9L!kRFLpd zltwc|A(}JwuH2`X#t;$=1)n~Yhi0Kq0OSy~T-K;&Q7a?o_MU@YPs_v`idWG|jgeR9 zRa=fLbwc#HCx{>%I%ItpOeu1F+CdQQAR`WVJDF!7WO6*k$)1yr9OCx`MH$HXgDy5O zp@a}zr@oMf&w(igm}i2x`Uum!jLpG3@s50(D%N?9D&koLOE9Mskp{d?OQ2J-A726i z_)rvR8&>nhq0sAMLYD4SdL^o926^S{St#%Ko)u1a4fHicT?@1S;322G0W$bH68W0< zTbHjH_T*-IT%bLPU+fI_dR)Gu;0J1+_>JJb+a0VC%)3bLW95p^{YmawJ14+)poje8 zm3`&LzA$W3HEO~ZrSm?CB&3-C?cY!INO6<%?|a*4Vh_aB+b2c$;CzOTIk%?iyJ(ZJ zQj8?T6e>Y?)K`-Cl446RRFhyidtTOM5Ec2t9u)j+hS}~kf4MF4TAh@o`zN!UMHU0V z5AQ|)Req@w#KS=4Hd1%g61V}NMjGOwqkt)|fa$Avk*Uc@RV46+eXgCI;hIG=?V}-gCd=pkR#PG1%GzmrIRyeTshD#X(Lw zg~H;SrmG7xaPVCW_zj#<$ykx5On9xN2P2~~;`<_x*vmX!n2*?W2O>XPbqQ32VnESs zSbTrvsU8l$ODi^+({QBz|McUW1+SUJO1-B80=^N_pxgCQ2=lJakB|P<8h2plEt%nP zgm0+;_bE6K4>EGUz>1Q-OgH0xvEtIMk1mI2xZ51Qt!hPy2{?>9!U9_UC_Oe=txosS7nxeO?5UvpW!ZNs_e}*|Fb#_oAo*!9V9#v5yLv z4q+%Ml{>n`DW38YC@ZUfC*p$r#g7 zowYDXlM!*tR1kxcSZQ@9-;+Q?cwcFP#w}6|Z667O(-j>}11}7ndKZ{Qd|e&P5^%c% z^pa#&Qb~fJrb&nu2AwxLD7-5}Kr=pAQt0HSOo8H0rDm7pX4}wa{U9t+uG!5DKW8jb zmZlvM8gwl<73p1d!coV>7?b@k?#4(BwkW@&4dK;#sHe8EdQ3@ap|#o3R3n-+VlT3l zP?wcGqz?C4m03?_`+eGQ+s^4 zlAZNw0s-W8)wY+^qegRhOnvxW<$lQ=&0cMhF;DAE zS)Ppetye8!V@59|`66*y+F~jL1#@(2_#^N-DWym3f`qbLfh9Q(pQ@bM-Q88{ekqZ7 z7+tjXpuMm&{l+}6`H*>~z0v+WnY&j&)V3)g5jLjiE)g}vRIOhm3DT?*q%V>>6_DNU zWvyXPxG{J*xRbeZR>52i;1t46g=>@x8w<%IZ_9=BxnRqMB~oDbtGUubH#V&SKb!MM zWY(w=6JA^}kk?dzkEafWx-=ZNpXwFiNWw$Jwb}?+P$d796Nc0o;a3;yry)SuMUK}b zVD^6QD6DOxUW3FsRr#o>U!pE|=P%SEV6XBjQL*2lZ88L1wb`TuT@;(# zz%7j|ozZ{>F%)l+P^fYHfDH^A4eucU&j}`bH|JoD1P}Nu7^vNc$%y}!LmNDP$w?Fs zj}2TaL5B?WSrRY=9~9D;%v-bO-c{E1LXm)(_mX*S($k-$C%)p8yzJ zm}|~b^{V*#DTee}i>}3)%WJ52Ill}k!C&3sw~{nnojwbGqh1--b7Qgqg8Y6rSV_KB zWoCxcHceHIV6qQR)Pt+Jjyisv!>YMngt?xGH051g0$m?3+64jQvIw$;tN)T!=p_Lh z=WFS`sL2`RJz!kFxqDaHwHO{3IfmapvEJ4K!C=86`J({yAQ)~CJhjtHH*-V=w0kQL zK(y|aOsJgE>&LPEW7}_@o*&#w)*^~4{>L@QlS14bthO$vyflWA@1e?j0vQV9$xRht zsxr_jRO#@xVs zeEoXly~P*MS{j)%p@Fs?1ynLC2nIop6(6~rQkX9qYtFY$5d66aMHqxmjE+kiG0#Q8 z|I^OG0I&zmO&tTHXv+#Af2;H;sISY#qJ>bvShUFFaRr0!&-*_TX4KLerigOfiywX7=iwML;IU@jQ21H zKQk@P)_#WP3rWpmf?qbrA7OLMEbCjbKEf9Ucd-9UO-^O_>bnsSh~si7lSX$6Z*+e? z<2r*)B1Ajc{#V5n{TT&k>xbKc`CP_jT!inLo-0_3rY>{GSpeKb4= z@RkCZv!lV*^E@CC!u+EBQ*Mo=Oc{t$=TcbgII$~ThhVg2o zFIb%v2}zC={Ol)X@mbdCcxUXZS09f54vt%1To(?I#TnLGgL6oxurgtl1jQqJg@p=A zYz=yVyMR7m^RxCyU7k9*0#L&xkb!}kyB$B?4={!Qz9>iM2W1Ke$gVqd())JGh_MqY zf=B*sUF$xePaiy`@N4))uuy5FpSYqNyyr;|9_?g0EgG9`{k4h*GoThaKY z<|m+5Ku9UJ$1-f0Ny93E0OI7;yvHfunIyC_N={~(kadw&8&luSKrm}@>#%=&1D$ND z#)C`FRLVw--5xxuUtxbkk`<)C7|?|cLge#Yy6-k^oPj@Nh}jrOj>JuHh>nYPNl?R< zWD7U=g}4OlRYckR)ukJLnHJqsWjy4g&2kuX+?QI_e|>7JG~YVAOd1)T>4a3hstcbf zqEATyq2x@pew0njV8$_A8oHLAk~NaaIH}Tm!~}n!#vKhc0u*kO2P$#C2~<+_EJDs= z#?L7xZO1_E6=P9-&5KA+|J{#V_u z8x=<)M*>E}7?@M7?WOBQDl+Ps z3df(x3ejB*LAuos!GlNIL0Gq<{ye%y(Yf;?Ekg5#&4bkrtgpdkb=FD)3uV1(0lG#U zTz7mom;qB`x3RZ2J;?NVEasTFc(8xIwYjLsScg#bwfVRbL&IfaeSRe;)L|C+N)z4z z!EjIHow#6605x;RX`dMDY}WtVx2fw5BTtDE6ZpUm4Q z94~gbDdq|vPo7cLWjSVA;e9FvFWtH8Kc z?5ojBPqII6JYD1suk-63=<@sduTqQ-D|f_R!->V{u}cry%1KxAH5 zDM9rTR$rVTS!m<)>6!$pIS?fIn-mS2Z^rLJjwL@9s{ekv)3ZNwP7jjp0R4K81YuaQ zhY+A07k&Zv8yBXQkC#wJCvAw!sSb{$ii1V&KwxT09B(&q_dpS$CqHhuPK?d3gs*>M)@+dlqkVbzfa`!rHk; zI`(n>Y(*>iat*%s&xxh}-(MD-7Ol>KPruW<0O10^|Ta6Jt{oQwd6Zx&t z&HjyO=V4oSW5|b{)uvNT_jy;{S=JP)H<;aE^Hl~>%)#0G?^IqUFn_&J|8|SpoYAY)oe~!pKpG z1^pIJiCeblHV7_!!N7jZe4FBIlGMZ^`28>rflhPtitf*+AB?xkx7UUFLL$GvejoKR z15fV%@Nn?lL`zrAJBavj+y^({skAfZOt09{lz+#E-!-YXmj-RL)r%8isJ@KB@2gJ8 zS-}ANJKE)zvbpXN`v-XS{csr7CS~hRT_ThD;dP|>-pRmE7cs1+4Z3nCGO%O5A;s0s zFx;; zD=cT{=rwBQKnsc=d+JAOA;J`)A>cv@oWfZ+PVV&i4=H9Zy#D{EvbT=P^ z8r&U1aF+xK65QP#DuLkc4#C~s-QC^w!`-F%ojcCyem(l#zVFW(Yp=Q1S9{ercCFfb z&ZU~#**qLgMU2OTT_^Iw6^lsC-NohcS{Usf2&-U(h`gC~a~>qCNCHhzKGd53KO3mk*7X<%%ITaXliJS&h6P ze!LVx_cH?Q#tx#>ADjr^NLlL2KiVIw%|cFq&c-k3!1Y-zKLVfOaYJRkG}-mdnT}}R z{PKqYLb7+@=^Bs(e4b`%4i)#!t#HNjS5ocs_Qh*UO;_Ib@cTgrOJBPt6u%8*7-#rS zcn@JlLh~ttK)DPjF=l9K;l{Qb6=@AJP=(Pr4nRQ_Nyu{LN*rwLD!YwtyyC79qF48M zc1|YB`dSrD+3q%_bF7Q20kg`ubmzOS2mO`lcIHn>;mCPz?`z}-N(b*Jr4rIj+AD=< zNp!y4NP@r{`<*DEeI81kmt0Uoagq<8iu4)pTGe1i&_s09dCVa58fr3?Kb0R0Z&{YY~|xS zQpvEnfj|wGmgKHVem#b_wBd||(m2>tmGA2sVD&FYKqs`0=L=qgxb=XomI@cS5EY4U z^Pkg3sJ0Psr{H>i{!z)d3_h7P({jsLfEVA4t_YLq(j?oS@Y6N`dED1bg_ge5DCq&j~1VaE!aL1`K_ghOU56TY2smqa8CZB{c@cky{ zW{Av8mNX}IiLHgySJ3~rAuIP&2lgC^gZ>fu2t4%^UR0`t0@=77gr8d$l}lxCS$S}v zRMRS4Oze&M8%_9);VBalj1GEGyG+=+T}1h!@Qdm+k&(Y=Ra&*M6qz)h^qQTq{K%Fc zxUo@{_F0;a$rH-nAHVWR2`Op-;C@vtryWI(>8Lie6>{4tjqW^BJW zTZO?{T%~6>;Uks6;4YaeZ^N=#10c}IWhKo}OVa#;-5DN1VxI~zAij|Wo&r)G;S#=q z91aMw@z#?@j#wlu)0o?Qt#ICsP{zG&hU+g=LVTDeV)Og3`6kK14=L;TrKt{T@|q&E z5m9!y=1;8@V2wMLNT0DN(fkv3o;TUPY(conW$Q{k_*ta~kMQ`Q2S6?P zU+Sc0{+Qrt_q~tvn=GgS2z>$s+G#p)>h5)iG(L2f{pCNsSJb)jK!#F}6T_V1D5=oe zUb&8gnLieQVBx#wVhD>0c86+ln)l5q4DR-zMB{Mpc0O`wBDGvQxQCAk2UTZsuvSLa8L6oY`0L{SD{Q8 zZTwvuO8xCi5A7fY6*DQji{rkROFLz*81Sh)l}A@W!vO;MxI0iTr072Rr;pdkpUA4W zSJ^l$*o*`I#HQ5Q7Lz%|g114>N3^aPx2pL$@toS?*?jEUqS5HQt}iHdpCqCCh-$qE z~ZEP#hLk ze?c;3t0D|#C&Uj=48M5|_fkvGStRH+6~&behWj+uI@rYlDd(lZIaiBQfg_r`wC;~* zP0`8Pg^-|aX~S`gNg=uB0r{tBEt`yZAHdCve$WlQ&Tq3Ud+MhziC3@z8-Y7wWlo61y zVGf{V7P~b7mfw;vP`r)R-LzDiG(onZn6=C-Gga=WYa-VuIJl4F+{coFz(v!Errkit z$-)7^cOj1(%NB~s?4oCJCbwVDuBVUP*5x3NL%F{9Ux{(ihj5ySx2G>m>|adHRn+ls zg%=H*rVyEK5Byvod(6e9F$^gbgOU~S+4Gn- zUz^ilRLoTQJ3F!quH(*u%uh)T_VVSu8cZjwRKiQ z1jvhPDV&NII-cr7YJF#~CU|1yMaepEx%V~p{sE?VC&&z)fL>@f`DgC0x_y^CXhQ9T zM|(;)#2X~<@%{s(h@pc@c{(y4Xrg9*tAn19VOh-)L}^O0HJkp8UC?4Vks>$qBIpF* zUIY=v?$Bw*x}2Zo@1j?WLrgYt>}X#le(%GxY$E)I9zig`YL2roak}@!fA#94ql+_e zivnI{(jxi%wKRF%r6*L)9Hwju6s0k15z2jPc=kqxC6O-F!5D9jx-7<*O8?Es|qK^xd41HR_)jgqT2P^l# z>?7;NaUia)kPA1TKxByGwJoS4g6stoG%gLS1vE zI18#q++(cSmJWz?monGu+cmt|rQZ>;G33DUV=6@KRr^mh67G2TUi(>z0p)8|+sKG4 zU^ZgQ6AqO)$MKhgMNOt{Jbkj6u_Z5+Hdh1$92*TH1gEd%#;w zea3Ig%mIZVhV&Ge?vJM35S5fbneQ*3Y7ga{Nc2VfODkp3sO8x`BC~OT?+A&}qrQkd zCl|ab?^{JT&d3e(=X?xl(WsbK<+*^$vhOzZbDqBaT!}56kB#g{>IS}$yCJtK(0@@ zYB$ODiTInf`ZKbwFtEv(GLVnjk!6NCaDb1J621n-@rRV25SC;BWsIGjS%KdG&zD?q z5B)$aSYE{K?@jhonieeBbDk9Qr>1vcn9`Qx-1S)wiPaE zDjt^_L2Wy^5OqUcAYpgUtOt3y(nv8Oy}o0hZ5h@ZnPl^Io%m*xiO!@tjuVNW9tOEp z1QN##o1ER)s2)oapO3aSlnJeyP4x%1$r6+;I8}UtY!&3_N7K}Q<)VJG^N~%OTN152z^SCRBpNe50i={l_4q4H zyQ9ke^PGTm%dG_0x0WuoMY(v3{Cd3sq12L6LA{!In|jJy!|&I5i^?S{Rl{@7a(v)K ze8ik}6=bkQyG?%sFi>>!8!F#~LGbMgKznRK$ zuuR~)u!ySdCjTUkqZ>7=^@)?iB|$0Dy>@K&fV>0~sD)xNL$Lo$priRZJU(nq=)&qC z*J^CQHbN)=VEw^<^Ra4uJcQw=w{MMo;n$pd;ixk^t})4Zju{uEiqFJGR@7}IJJfg7 zqWN5hwz8kLz-NSi^;(Ni%Al+)C0(zmfNY*-xq!C6~J*FzU2+4yiNiU04=Q%_1{~dOTA?W3DLI$X`Rs418_w;XCml_SP1BI|A;CsZ z7{t8cDpz=}@=JO^Ltdrqx|qN96jnZ+6(VntGy(^C_Qz*nh0C8xX(Xa>BxZ-b=a!^3 zKvc<%$a5QVyh({lZ2&_{m44-m)EZWANS36>UF)r&*+L&8L3|w~Tf(}C{hS2N<5$(D3J-OX+~LK-1PKt}H677tIvlEK_=%G~iWF;;cmG0G7h| zmIAw?$$7IZv9uL&B#x8GSG75?*>J8RxWWN$q2b?u!RYi-KpgVXacrRY6VNUZ)>aY(zPE7T;Detpf(mOxnI=n*EJyG5-|F53JqfS9f{pH&i5AO?hPBF))dGDSJ9f(>Q|zO+yKi z4=NZ$24>dVCP5n}Gf%w(Y}Q+W(Do?F>066k9xdJ0V4yl2zH1IrV{WO|I60~o)GwIQ znHHR$7u^Lbub-pd;)cV6zPx-{rQGtVSy?G4onXya`yk%1hPnaqtY!Dv0#jA**e~`L zSeef!PTy8;dhpc7$H<5CoEk=lwDK`j3Fzm{ot_zkMvwInJcwSg`8paC)o1R6Y&tvah;J@WIkh&&3hd2q@dUROt!@NKi*Sx0WS`)@n) zB$w)r_rhL`Q8(3@d38;;Uih?1aX$JVRO$5%NX&m<;UL$+t}{ERh*6nB0879>5;x=h z3F3s~*-Q7KD|3d2fBS%A!vl7b2-9LRL2�ZO&>6aWTUeOPWyYjz)ep#W^_B*EL8CbIH&Bb4!l$A$F56QyZ#=E?Q#arF2 zKP5mOu0Idn=d}?Tv)+&`ya6Xql@x5$=`JOHmFh0K1)zlA@R7TZQ7+KD^^+QUSQJ0l zv!^Cisw*$)-VZ(j)MAuhIYe}`&6Y6gT;L0;%$7S?iIC%yk#)R46eLOX*}i!L`*A&& z4m*x}j4+0EGF8i5(|s3mu5JN_L6V#SZjJOl68ai9hmpLLp%Pff0fwo{U|}5*^h0${ z47pJUn)HM!!Tw@LpI1mZQV(*%+6GT;!Ebb05dVskg@r2t?%=J1|Fr(6`XdBXINTgT zT~X9LkSG^#XmV$3{-Vsys6DC|2iK0cC9S#}0)c@-9bt=ykD;oqAkdN)isZx_yj@&n z?dFTg*;*QN8kogHT5#@e+{;56Xj*+Td~XQ!{`}rMg#3chRTC?$MbkO@r+~%i*+pjj z@ey1HIty^@nxSD$hfeHKbiX=@Rf39JYrB4778Cm}NV9a^o{#D^2KOZBDO5*7&RSl0 zAZ$Z=wPGFQg<|up4`a*11MBPrX2H9XCupz6E>tOD)Sz{Gr!hkPuJw47JH+q7^n1o1XyI^& zSQ|aj2VFgDx}|?^Y|GDwzP4PjAE%0umxaq&9zor6XY4348d(3{V<m~Q-v7HoJom{Pk-eL4D7(`e{^ z-VKtY~LrfSrn_v2L6%vod093%OAnC zpG?NfCbcQS6j@s`XdE0e7_RPtx?j?}A4S`ZWmG;`Os9WUt3!1#NO-`rS)JUo+RkrO zXYU%=+2xuj=yh`ZG1GRyMq+sTIv%pT{BhR9fLHcEj0|=M0y<+0Xicy?jY>O(k9-|k ze){Pp^K%?q;<;G;{a-+`LhhG6{=2N5zp@6|VaJ~|oP7TlVG_`VlJvPsFLguTr}_rQ z3)+3_3wo_CWytQygkmlNXrH8f z;wPydrE!NI&1h5|*9fw6;=#d<_yUI4D z$*0umUB9lY@vCCcI7a&Gbtg)NdSa)?v`4v*Yz`PN52U}yWnt3Y6uq_$i6vTV}B-hFzSzYYs%zOq(&U9`ORa^p3~ByH^qc!9eL9CghbTG^ChfX zHgwT~CNFfdlqqKch_iOfCN`^9Hj>O>PNNdofFQnYx+ZWMGhZ3>K^$LU^z6OaBV3YuuB-9=~|bW2iM7J zvuVzU$n_1drf`ry!ZoPYJYv$3_I;g#**)<+`DeEYN){38UmmiUINM>IvzA==H^!^1 zAFR$^l)N^mRKiYA)%49jhnUwCw5~=fnOpjaYmKSQ?j_jVU)9uI;@51#jl^wTt&0X9 zY%YRW$%bc{ z?@0c7DTBbEyIKOIh#eDFB?R^;T1EftET;T=(uYLdTL3T3?|1A=#gy6mNm=>i>HHf# zg3^mznpD;e^9pYK2+ao5Qy-F1*WH_mv=y84Quem=#fEV(w#TGK_=kS^@No#XI&N%_ z(+5|;Cdnu2K{5q46*oyQPiupcX`89vwIccRm!`!}xDUgG%L3RO5G>SN56YaEG!EJg z!VUp`H3=&ng2#O0W66$?WjMHIEjum+r{<=`r@`wT&CS>Xk?C}wo6Ic1ezzmL&Gg(@ z&L3y+pY>+Ac%V7m{;!|IL;(xq*;FSjtkr81qsZ8F|dTZ2EbH0?F8)I}YLG1ETc zM7;N?v-5vBb5t_zS~4cEp$sMs3zFs5cqB;?=yj$R^*nw0#u9G^EwmGyYPRKaF3SsN zDwn)L2epd&yc@X}%rT##b(4s{P&#&bsnpV55VvKjq1G$cy1d`@+XHFy8V4|~(hUno znaF`{sWnrlPCUsduxGtQs!Fx6wx9^a+VDU2EhThiYsw}-5l~$R&yzLa|0E9aa{iOQAb!EMy>23e(NmZw0)?Cm{*!n$+_cVG zzv^Qg>>$PN)S2}3njg5yFFdr(sBNW@GR75Bm~c>+)4i>SN3+(e0^rsZ@5x@=l>qpI$d*4np{Tyy)F5o+=__IZmM)JJ_K>#$k1X;#kfdF`q z`vpCiib#TMg+Y*hU3ye19bfc~h`=_PWqqhd_Tn_{U&g`)&szJEEP^RE9WH_od5)z* z@X@mc&9YFFGGOCUs}3b7>)bi@_eu*(br?a6n8{Ip7v8Tt`Xn<^lWV&-#AvsnHG@x4 zse7iG=_XDs*9?)C#6ikVp<(1s>6u=&y)N1(d% z!7HSv@HKe7cBU$`<*M`+<$7pRajeB{Zg?1?#D4P0=*Y zD3RiALYmdjr`jwd5=B-48k!|&7%Zo*+*(#|9N^`Etxs7V<6#?sy2JdcSbB5N5BNq zF63ZHHFxDPOQo#oip`>0x@}&V{TOrk@T0m(s$Er(n1%_W7k^j}m|)9lw~Xg6ni^X?Xw}+meFB6NADXhuDZ*0h>-D9%|G_}!RkAjpnTfV-J zt&gg5JKme`sMX3+FHtyI|7-3uVm#?&J?~P~YTcK%^>)l+9 ziRR@!c=MuT_#F>}Lpu zP{^d6#f$bfJBYEicTv+D%6B_a&~W`>iq6}9SWGyVIy5kHL8yjj&za zq3o}QZzm4?u1GEC3(|KlHNA-RW!Q3hiW0?cB6@}LdS$^|&jWMuLH-G}WuO^RhV_5* z?q|P5-4#wx|2bg)HVwLAurll{L}EkOsVe>L5T1i_UN_4uOvgl+s+Ottv!<+TX4yC* zze2U1%VoXoMgKnhqNX3?#yE1qHh}EYOeyF~`zVH@%stzt=dy(xkui*>fZQ->AN zgiJ8pVo*pJnsU*o6yX`r&Nr%k6Y^b_T=fXMZ%tJp=4H?O8MGL_gp4<&h zJ?m~Fs=!Mr1*Os#TNn+lU)tc9L`=zUU-0Rn75+;-Y`5EXWJQ-W8!>egbzCt;?1ktz z*uyP2|K>2euXpfJfq_$FmOmiE9P(CTOe9kRPw?$>51;f>xg5v znPq=0Gj=e;fS7FndLFx>1I=lBPvo_-eI??;waJ-2r1qHkg_Sv}q!w&=KicE_YrUgJ z#q@9caBcn23?-0TUdVy!Xvt$HNRBQ~_G$G!qZTS>&0epUwIX-IXE1XOo$tl`(z4Tz zBee-crT#8{{A#yQoDEjay;noqg5nEM3J{~6<0cTrWQ$KgCutG=sCxQIfvsdQV&#UtP*c{H zQ71XE-vI)cXf-%Z(i8(O_#uSL9f2+cq7sW;Vg1$EzmY{jFbhtbeyvHJoOgc&7|$C@ zv-F(^g^EW=or?yU6#n2e%9{*NvsCz@U8_zPy5uCZ8pAjiJ43%h3T^j>%tb33YAPrOH;mf_gg9DeCTC z8=n_ohuC^bNHl+dZoo!WXQkMr|(JpwRK%6COf5cPw_Xa zJ;pU4kRP#d!gXEDMnkgJT(GOUC+;xfPImo_bJcnFbzQ3N?^S7ZY21pYQC-T6)3;CA zc^r>i`vJf zLhqKWTzZ6fmx3yPyAsQ*kAvxBUmg&?`|U?IkW>?=HaqsU*CDIorfbhY>7%R1HH5^m zyF9n!AepO*bYID$1Y!uW9CvDjYL_xn(^ZF&{XHUBASH*0T3+f8 zoRj#QMPjPWEbO7;?SJuW&UKpt`7W?5E4Q*222Tv!Oig*Er<`o@0J+}kP3|V=w^=0Y z`v(N8^&Yf0-Gqu=Dl7I^Riw@7f}4MN+~ugq{Kz7B1szCCeXD&geuUidtBvf@HZ)HJ zO_wue8-I#!qNO4aS!0j?(JM$#g~2KfTt=V5^~1OX5f2}!$00YlOR$^~EcJ6T{EL4CchN zjFE_sf_>0|ep-G|8@bDR-s~4@V28mqa&JL^qJ!a$`z4WP^zw*!nAv-q68^9$mE-+x z6cLj#!#>e=KRlS=$L0R0C;TBAdzB-PbAP_ha{Ln1#tFKI<@RTj<6r?Y9>+qn%dUhK za7AI2zw{H=)ASW<*k|rU>a9mZ>aXQ?bLa5)DacjEHB;yn+Ly@kMa=RI0R2yCj&md_j9k0dwu#Pbas12Oi#E zc)H`I^3FpTpIPL(;|KX~RGMS@XE2I5wq_7snpiA`;*ab7t8TUJbN8lh@U3?K=;lpq zsY?Duoe?Ko$rq@Hz{36V2z)-p(Sg^+E}y;!chr$hOINALQwDLY<}czDnNH*Q($RQp z==*fWcS5>|H=`d2D~McrPp^W4zHffsBdX}-T>$qan~d8}J4R@2(2hp%(FDo-g;yt+ zN8`Da*#!>}Z$%$KDyL*58%L{Plqp-l&cn`?Z$>wsI+mJn-aY8W1J0eP;E%cT=pQX* zY!79=d#F@+PCt8))_1Gw5>B-9Ol-+XfY_zU_}5P=htPFz{6pL6*FR+j(?GTanG&=F(P*uP4S9J@$uob^7K1RTag(SH z&5&Z87rpfCH7Rpy2e?}VU+66x?EAnZ2o^>V#bz(pw1xU4m@L(+mm^RChRTLo}YU3;O3Dsrcg9lCzpr}LQ^Pn9B( zd5CUS-TcEfL591!>H63^l-YjG*XRw zzm|zT;u-rz#50BFc=eohoqw5wYO%(+$v1OG-88oM4+=Lu8f&N#1_vYR9-!jj2giuo ze9z9M(qYz%#@(^T@qCSZdgJ<2N6=dvK$%yWie=V-mY#dLBT)Jy_qNZl#4E05teI{E z2XDCKwiqiA7&M1peZC}Sp3waatE)s$7DsB+ONe-~=!w5kR?USD&#G7~<(p!6{z-U* zsgB?(-OvIdnpn4ch+GEcOHF=|B=*#!QSTDJ#%O2Z*xXou*Fq!S%HITBqdCIfv%YWz zZzW-e9J-gd%Z$TIgZYvc4`k|4_VJ2@DT)m$R#8cQfQx*jTIA@S8`t}Q%LhDoK=h#s@ph*OE%e`Lx18mo=?M9)*Ds1Y>X|Q)T(U#`^%0P z){Ve=fi?!Fgg_CvXp=&*>d&%s`8+f&HKXB_6k(M8*3VTaD?_v8L9UZj>KlO~rGiKX z^cM!kMYG@K2b&yBEwA>M$^MRfbn_jok@SWGj1W*ZUhy5oh0EFKU)B>__}jJPJvR6q ztsVB6c`7{*9J0IhD#M8|^I2 z-1_C?1lV#dnbD56jHyFBpCm_|8#xQnb>?hyp3cSDXMcK-=e^9{Z+fg#qmojYQbA^A zi@oY^wC3y<<~Z8&vRsOv_vpNFr!J43fB}KE2w{m1nex^mWdxFn?S4A8aO0mmd!`3E z73&}Gj5r&!kdr0u4gETaXRSABl&%k3v5`53}LVa%3#lnjO znX6=eE8_tjDzj0ge?B6cZ`YFX)^2ZKg_H}{rY!I4ZpeokmUa5d`)NVpZ~712Fv1Q{!lJVbz$-qfi_s4v_a5RF-zuz0FwoQ);r7%Jn3q6WBwzIvzCEXH&ip zu!rtxoX9rw#ug{A-V%b|5zJU-G@h>u#=Y-^DxRILV(th+mv(xgr zTPk)%T{PF7iZfDEH3=uhG;Ga#?3?10=<`sPe{D z@wn|$1T+_xUuLOYi@`(7sJxb5!heA+)JcoQaPP^gzML5 z?c-N$4;6iKc}ubr=NOFyZW-5(-9`qO24d`J%7Dj;jRI$y4B!d%?fC#;(%OynCK!^9 z^U^Lw9lt+`S!Gp$#dt@nS$|3B5t=v6`T6_@-w)}iEc_WYmoCV&hQUdq$$jf=a=xl6 zK_6JILi}m6esZ7gsBqtw^}vW1B5&&;#g%t-2h*?>h-9?2CVBwm36lzV9OjDWHv%Be z7ePME$v=9t7u$6tW5RM(5{qcT;0?*TLTTxwoB&tj8{IE;sWo-mH~Q1uwQ<1zlPprm zZOc>Y3eF^xy$nSZ6+L&Bu+j8R-1W*2N5-FHq)yFHAG|HAzU~=27GRm7n=U*k5}XcV z7gSpL3P-|Xe#gM(d;x6v!L|8KtxgBR!9r*##i7kBa%Rcxj`?Y0&TN zr#>?W<4@9Dy{}zcz74W#ykcN07)|NMMmGVU$6RBV0ehdU`@xFGLti+0u_8I+E;XI1e z+4FBkdAgQ`6RA-q+7Cuu9-X+q>&y%wnGw0f&rr8)e0awU-GbJ|irjR{n)KuADAAe5^&y!*NQZb!&}pop^@i%qQ&)+p%FXGzr9uS6Y5nmpc zmYmUAb}`oxO%Ej(a4-Nar;An@D5a6Dsu8rSFvBxBrt~0Tyvj-ZIKBfEYMp3Nk~>|y z01OXVZ{N#`KsSjiOBVdC4VqZyE_ITG@kG69LDtDg?dM5gv8==ccWJ_e2OIQ% ze-|PEBnKGw$tK^NSrhC}`IBV6$%aq*-|Ou<_fVR_;H%3Mr27a)8Z66I>}QTyNM-NG zrcd8#9ig4*>x|n^TYA7GP!jGni+89UD%U2F`)D~PqEj9y7F-heyhGFdJ)IRmiY1ZU z2m8BAI9ZdAwb?~r)hB=D%#wnl_Z6llXBYYw*fK(!Ym(v1jKHpZCP=4A=Q~g<_o)Nx zDo!LS$@(i$3)%md-h07Cksc^Ft_tAS_kRBq;?_e z)np=^@Y_-_V8prbw`YprzL-P#EK6SI?>FUr5%HpaqdhlQrM+o@uT;@IP2OaCJ5hwL zJki7L{@mXo+c;hxeF0t(@Z*c7deke7$+RuM}m&(-j=B&M(+l*r7jg!hBHP9QBnI09^U) z_bZFr()8B2DwW2?!OmLULS3M6uR_ior=Zwo4&H@ewt?sKcR#AnWfpxfPA^t_o& z-VeOy5)P4+=3X*|(#1u38kIJJo$o3Ah9dCm401lgfJ0HAHB3S6!0iEAe>{p1yr5>2 zOM8`%Apvd;^1=nzc<}=HFjbC5*KcXhU>E6(=@%p}B7pK1#*0h$q9O$e2#kE&B%uad z^{YV73jI1&P;r4wv=RLEi>4I@9a)48B<`Qaz-vplfjKC+pHQxwyG|_6AOnORvFb=s zp5&j8JGdtjVOI>e(bOTqW7PH}`mv}m;2htfr{&Y-n@j3iUW(?T;#e%XOBFPBJ z+?O!DkRA>pV^?z+!$wjkXq}*)Kbb@>N0)VPQO{Xh2pp{Tp<8`L)IcCF)))oTV{Eja z2gwsWvF?jLrqICUxHCzw0oS-w<_`m4-iBrety6^vhM{=JwW3R*CkX62au^sIjo?L*M{<{uVnb03`q#g zV2M^dU)nUbsN(lYUzD%y!Ff?(l^MA|HfoNucBG$w^=6CVL^VH~&HRk3cRsll-sumS zL$_{~#~oYt>9(eoeY^$QOe!mU1yhqsgh&NZ{Sd;d;Y4fIr5KQMmWY#x(o(_ATi}@= zXG{@%H>ggcAB8K*es>s-mJ4HlDEz*QQ5fYDO3tDCXZa>6&6Rwm5{i=fm6n6F6MJ2U zcgl(sX=L=>qjwS`qcaE|^!s~QmfbmdzoHibr0;IKK`HCxS$#oA=brPg0MaHO9fwbO zy4fHv5Oidr_Y5HGH7(wLcqC+IK300io9J+oaL+1hJNpnv-(KyD+O+7}YMxou>lq!{ zxX7)&i7|d&UM$G*$SCoemU!2Pe*U{;)qbk1f(rlgDvI{|8pAp!|0Q#wV%r=qKQAv< zt9Z#(Kcfm&z0`LLng!fwkM3WTPLMfXpR4>3ZMr^f+k^tB{l9HoJO5DGwlILw@6Z5n zrNuuV``I;Oxf10b%>#<@>=`j#%}x+kR44^D|SII@OO2Kd`lGR^IZ2qOuwkv{1QR zd`s($u?pL=0^3z2tDTio^3dAe#njf_JoOO1*g4nl76V%3TC*>f9tXJ34Ny~~+pMgD z@sQRDKGwfhss#4cj5F`V6xFwC(?K-0E#Ks`2G=8WyAZ$4SGl&FG>y%=?D2@$c0XVX2j>Zae&A z58A+Itb^?dKh<41dG(h$?fv<|+5+R|5W-^6=cKz*z2>5ii?n|(Y&5%^WJjE^c-3Z9 zS*!!)8tUX4!jo)Dl5MoQoFqq_27*8lDWC`}IoCQl*YKpX;^ear55*Cui6Br$3Md0h z?!Hd${=-m`e5TdK!FT6;n5z$?2;k#;O;`F|Li{iZ8gc3zMKKCUh34xYtHe`QW3_?h z>luS0+A(i^RO{8z&NtL->iYvms|=pCtf znEsF3Vf~-TT9K>E|94XVjR`S=0yjf)l1Qo&vZ?NWKMweBY|bCQ+3=spzV?)skUJi` z^Q@vaVj6voM1y5Hk~T#DsT98dsp*?t((DCC(HT$CzafBsSKEJs(fk3=`A_67o|wAd z_JR(_|0Sq>ZxH1C^!3D2-BBb zNY|I>)>PLnq&yAEQ85krNwJA$^vMm7eNExMwXMiKt*v5OL#;$oL;YN1Gf{LE9b{Vdg0{He1+iM*?U%4}t(*kKp1RL*#-zTHT66H)F&-8H#fep*Ut;AePj6^y0E@ZI#ZlfcKw>@Fb#i|AXnLqbOJ9Jism-4F)e?228;p+?|4=`_6C^G0Vs{B9}0YravT9{sGze0I~Zw2q)pHFFDEw2=I{?d(qCt zwULV>Yx3&%t>+iZmr3dFl^hx@x1GrAx1FAq(+<;VKyeDVymIs)yK=U}8_#|OZ5v=p zEHJ;g|Ejpe*J+tQoNJ9(O!os>T~QHsAO9VriN5O^Aic2lZve1K2*Bn_h8U18c+HVe z17fv4UVaa|($!7JSIk*}>w`|sIHEYe`z}3J!~<7_G2WI8=(kngboqT2LHjf(?Q0~8Gj$WkGp9QHNHK*0}Oxaa*HRY?{c0uu}l6ATOt4(yv(;!Xv) hDC#$_5$#wKseynPaIh78yhP4Qa1I!xD)5g%{})4|%)9^q delta 101195 zcmaI7WmH^Ivn`6dyVJN^aCdiicXtTdKyZRKuEE_cAvgqY+zAqb1PSi?Nb=ot&VBd3 zH%9;5)vNZLHD}dYy}Ilt-02n^ikc!c3=RYY1Oi0ALL-Vc8G66MxKSj_Op9tVBt+aZ z0mzMv5a|1zr-|+1)%YkFo(#M}wX&3Y=ai!FctbesL%R`!ow!SVL^3>1Of6nHT+r*c-~}Na>tqBo-ut=)24qqdVL1s?CyweZ)I;Jf!I<(N8ml4 zm+ftdCy!vs^qts^>D|5Drw-$}OEYhfP#hZyQ2AC1tikm=0< z*sAk>fbQcHZ{HA$KDHU`XJ+;$J=pNBoL3l8mlIb8N4|}k{qgFn9Ho@|3&W1iRign- z;aC0=%oSE1(UfoLJ-05(KNoyRr+aF3*VdY4_YZV8@Yhxk(n@Oi^rl>~^HsVHol~8a z2IyjY*69@$B#9Vv(mWKm^(c;ry_@e5fF8rdyTEQ`ks=e5`nEW=2;Bv?$_H-!s6Hf< z#{y63`xwSc>&`-It6Ih!$Ev5P@`VS>Kt-skGN+fsivxc$Bc@9|!~_3e_=1m%)x;_< zzcpzBLT_0gPkGPLXJ!C{E}+jZwLT?YzFpAF{qR#No6}4Q(P@;u)q@OjvyCyhKy7V{ zF||I7fgQ!Hhyr{rvsZzjl;XW(uAtzDUo(#`D~goua*H2%Qb$BfH#O6H>7!oStC@BW zQkYM8F9DH_C7<-_HCi=T#a;IlJIn@%=fF2@>Zw>Cdp;~a#&0JGu*>XfQ#eb1u>d33 zKaS(MK3g0G4H_i9_r%*|-8<`v04|F4^8Y$IfQ^c&N&S|d>i0P+ykLa(v&qEI_`1n~ zV9FQEU7*?EdDJ(DYs~Hie%$TwCv*PSeY~=wq=7VLCc@_RZGx_E`V-I{9}nP(CJE_4 zDP!Lat42{%7Ys`lSR(WZ-{1AN1ZqgEbVbD4PaGGcpTpth%8zm#vCQT5ya2^cGbwmz z{Bk!gFuD(cA*FD^d8tY#CYCTvur)-w=hRZ?4{=Qfv-YD!j$ILmI=-pD{b*^`fQ}S; zELhF=&}&kWYu}`-ppjSLl^3Vi~eEPRNd;`z~+8u%;c|K^I`j8 zG)}%_*2gSMG^lMy_j@LONWcMK_#w=Aa-EWXp67&`{Xx^|ZB|ketV>u&)P0h>q?w*^ z13|%E(fmEy`_U*b)l4U6DcfTaRz4mjH^)puX@#>Ch6zO9!oe6nRuV>shw|){D&Ol( z3}u`ZZ~=~=3Mo6Aiwp0q>XM_!)TZT0X7ilyXgWqO_-Xr-fKOn={fz%a)Xl(ZYhnSghsWBpD0nDHVsLM|B+*be*aEL zu^n_aHRlxI{SxHhm-0>V{m(;xY*Q=2hr6p7jVpL7bhC1J;_l8gt%4?61*1kABnfUr z)9)fW{uR}Zs}I!D)4M|V1%Ux?u|{MC ztr(TVtoFvja;(jrqie?RaD*jT!Mr7I*o_6i@IYuX1!sUc<%xLEEAM>wG|U9)#@Yi(DB`J;fi! zR0Z5VHZcYSoCv(FmnVSFHIGEZF|^jT-6KNi+!lEGMKqJy0u?1sOxB37K@KNfdXeqb z`~k&-69>{WS>N_zC5ieISQ_U!FXym=A_dYsJ@f zq6i0IrF8p8mGyW2(Hfg_)!BsC4mK!dHgF2ykBC)Sq1v35O%66*)%x0FSUa;O!EIqb zvO(5jeqLv~9dL@6osfbAzXJXQV2N z`Nh4t8V~J&DmtWK7w;Mc{jd$DCbQtp$kMu}7Lyqt1H1VuEbBNV{X9l1bN*Ujv$koC ze^4Xb96oX>+ak>MxBkO8ZvCLfj_XoJ>lKTzim5qRYQcr&i2GtV#fB@F=HD5~t-qqz zE2(&5`yQ4Ia0lyjF#_0O8`Y64RMo_tYQmO5+8AGfhT>Hk>0&p`G1S4_rjbI+I?_MT z#Jig2Tjwg?X>a3w%kpNNR0`XD$S_>6)u|V0?whxb)F@biS+I@NE?BWzuwASb(Pm&$ zvlOqbJ&Od&L&@D&XciI`(Q;S0)=Q`PnA)k+m22ja$ln|h+i5eDo0R7EX^n|jrgDm> zc{DHrca?NXb6wJ^6d1OK%8qQ274%AQB@nN;Z@=ujIlVVgFWJ-a@vg{klMec>a_xTp zwAiy&#qZL!_xXc;LfkBgZ&>zE3+~~(n!V5K*_vq@fZyE4%{4{iA=H-;ETQW}|&I;-4u6!8>(-Wc%%H1DWQb2EnuH3`R#RTY0?jG_pJr2{8Q zh;$ck$1}zuupl!cwBT^OyUdsGBV?!=ufaSl$13I+)InB`c2&l>#2N%Cy721KMp%*; z-(o5$1>y@QURty;lSdk;?92)89(~9HYaSSV^5n;sh<3ZzVKTNO9SO=o9xDpw;!k9AI6<@;*mf-HtnuNG29AInDX<(1? zjX?HxMzf_klI8~sCREj?dfp!Wr(j|2#=S4@lH}6c&FI%NbFNI9I z)um)C3nSLaFAu&XbaPSZBF36p?$?GACwmw<6~2hyEDYVon%2>*@_#Ks5R|*;#OQYs zsSNSX%3o8peL`!x@K{*in*?SryePyRo%RH%@6}&PPRgg%U4gd;ERO6q)DOVx&0lbPR?)3fmUmu1JpGz~+YYTJI-3seBt&MU)`&Ny7uTxdzyL+V^4!rfYpeGp zSb7c}CoK*JZHC_e>^t~av}a`Y46nj?O&>eWp8d&uMDoKc^p!WAczZP3Pw|M#4^+ zR|$faQOhgU3^XxTz22V2NBl6`B!KK~VVF=oo8?lKj;qhu_+4%x9x!bju(ukiZdbXi z_LZiElU^0ytIPbf^d}g?EA~E^kV_g*rZISg)yqvI6;g|rK7bV1N_Vv30;-W?`zhTL z29ggvONCZJSVlB2M(&3r>(Aw)bm6=FsMZ>!tjY2YS!?Q2d0{?qe1@9{bImclp;0uP zV{=$?nE)?m82!-<>e0*0MzPbiI!!GKQ)$>HoK&Y)Xpn34%&S3yEVm>T*Q?9%}_-lCY0cV;>pQMv@qXW_k*2~ze(RnYd`^Y_{E z5B|mDx}W<@@$p`StbbAtW9ZLI*#;sMTOC50wdfJKxZnAzS`gI=G`zxUEnghL_KI=d;#jkSe#4o0TCB z&eScGo|u>7ZSe>ynB6JC#SWTp5d%dooVTS>$dR7IYMXc!#>kPN@B!kBpd1}`>Cct~ z^Gp-FN5*&|Jt0cqx{k3c+>lTWQ6c`ajaaS?03D-zfE@t2(+K6w$6*yB6e>rmP$43A zg0f&8#ls=C*ODOb%{~{j0I5kP#9%h?Saw>?(`u`OBegZTm=h`_)`B(=0+Te1wDe;z z3GxDF+nfH+(wt@)c>#kES#w0aS-;iQ1h!$StYtYDkm0E^q-_yUZ9()b05TsWOlT{W zBWVM>12iY882rj~@jea$vG5t_DKi2CkPQm}XuS`?A%@qIEW*j+P~GMznIz*&x`kU) zq+g-F?(;PL3CtR|2nvz|SP~>bTgXI9qXVnUI*PPH3)yn~P4Hvb!I{-0Qqf3a{Ee`0~Ti*sCao;LYauw{^0 ztiTD28>A$ivJR zfSed9qE;ve?5~6)(1X|PC~^>fHN9jiD1-o2KvNV})l^L4y>FN!g@Gg2S1 z0?I<186u)kA`C@d-{B7)XupsVvPh7dAR+05eGKLVrNfshxJo56IB?*?<&_vsLhVfN zqD0gKD1?KO3eZ5ZiEPU_!;P>3gVA@+TvQ!unUduwwi-Q?JH+r8W00{B5gEU8MHUZ? zn*=vZHT(o%7)q1uJ9F|u)Xc=95@$npiYU1SUer~Qz7@7xrJjskRXXnn6ilXYw~nJJ zlz~g=B?lEEEahW+Dylz(+YMi-S&TsVK_v^Pss)97CtUf7qX&o^A^WT@WXh`zj^;wx zuuDFa3`F_7X#eScFmy2aO)QuzAOQgqAj^ysNI*pWKmD0QPIaShS5@@J7{4ZYlS2Tr0130YKOxtul|G(j*F zLwPnKW`>>CrM;(^6j!6GSV<0KjD?=1^o^Uvh}J;1nAN|sl)3p+mZZ5n;Yog<#9QE+ z%Jj!7Z7TDf1FGr{x^eaVAy@}NZUPi0&cCE0D;?XA4&fARvCbO!Xboiphnu|21f6(T zq_6{^2>br1Hum_RYAFN$s`l$hnNpgviXbN!7&WGJ5(PeWGN$5CkTq1a63zYHW=XK8 zG2YBzzBCf(k)N1abF>p80h;8mJHpy88h+u17i)i8q1fU`amK4gh0F& zjQ3nI*3}dN<) z*8k3AE)T^SCDuV|70;c47E@E`5@3GiUSf_`fCA6zJulRMiHLf_9u*vJR$N*g>G(mo zeu`va!LH&V-MRzgt2-D^wCSznC?i3y97GmPpCW=PB`J>ONT4SGY#v&P{a6-)m{vlB znCAeFHq5_h|22-0|6v^HNnhD!KwqR2=TrIWU#P!!{!z!wzO^>6OYxuM%ym2*W^QiIM%*02K=1n^cSYV;@TypY=6` z#bqC^`cz~W;)0zx!?u*;;)MpY{`2evnZkcL9(s}>RX{EjvXzP>aU|S^i!x0&nu0AH zrru3bvn@daVhoeG)OtGMf8hw6un&sEB8K9vg3eMo4y4dVj9{rE6x-JPC72*<=(Gb# z89)F>9U`P-g--WB*!KC$Hk-?>ZChh?wXkv{#vjQSDIet_W3yD>G zP7s+81<9rJw&9DCH^5`_(u?=D47x70-rDwHRg=AL%7+L zY+dC;nfQX4&HGUF*Pm0_&Q@^2lK_?;6LmCN2b&&j)&?ng|f!pA2E*o(67J|xtiQ1*^2U3 z58~qy$^XOw!el1|#yR9-NV?fltC7w{EDX4#HtZX#M!Zk>(a~WZ89a@$Ls8{U`PZ}; z_|*ST)AlronxKr5P>6OF#0#H`segbQq@ogJN1c`#M$H)?i>1A3Nyhv?Y92nxHZNIN zB^0LV6EMP#Dr<&N@0^x9v)ZlfVct_~9St>}h;z6MOeghbm)Up-aA#sFd_;XMVlfnu zJ5AJ7S$KbEtUtW+CB?e{JPi{0LaS%wyayoOUvtZPDUb5X=8hOe5wWWOmKCK1X!Z|*bM4m+ z_c*O@)fH&&=mWG7~SaVoc82X)>a}G=yvHqY(HgZrL?G0G=#O94TVoJh0XeuTPR$Tmd*Aqz*a}@4V z?UGbR;|Lr4!v9XCs_E({dUvME{%nD(@>@tjTi|7^Q+f7-4b0NLP>@RL<{{VHulC&rw|GB+mY!l!H(;{2mW z^Je?EQ4V|LKP*Fz&~s3S7^PcL11!T2p?CfcRZv+}Z|?Z(-5RG>Jo$K$lO>S^9OLq3 zU41fPWBgu7w4KFfivIea_C&2BSgcd=wXBdxe9$O@2xie4p$5L=M~=-_xQSx)|L8rY zcr8g(zxjg)pBUe~=vY1m{5g`F21%L8wt<7K zs_r|P5BW~3^SQSnZ_fjwC`LGrfbwlfBPQl)g2FlsuaL6M@^5BWdzQPLCv?&ofVf)- z!vnbs006bllO%^SkY{75E_)J_`M88t<;h~`F{;Hpa~A)Z;fNScR^o)BCb*2fsrro~ zlCZX;sI`96Pv7OyarW>(D!+A8`%p76sFC7z(54VBFn7gsRLOQ&HxMLoM(bv@KqHQz zu>ZMmA6}h+OZG+z`?1X3hx2XEF*A8w_;=UvznLUnvas`BfIx||Am>!X?+VO{4V2Gl zEK%>7&8bVkG|g{vgp+#P@j&>sjQr~a6irc>Rq#pce`pee(w{b3RhLtWa$vNo>^&4; zSGz_XhAb`Sp$RP%l<~AueM>g}qZtJHPIxh(j1hJ-t50lKAb0pw} zY-QxPvX4^zYd9?qx%41)UTi97GgwZ!**PsX3-3cHALelcsx!Z+wmyaBECWxAuD8m~ zQT;P2k*XYlrY-$ukEPP5>W<8DkDx~8Il0cP54!F34gR(VDkSJ79~9YEQXjfcmIPJR zf@M{NoDLYmTrKH;SP#NJ`br2o8vTbypm+B-<%P$t3c=jk{!MAMT_*mX>=#$0!5 zOa_ValauhAF%XC)E$#?#ZY|`jR2@lNRN6Zx)E%TdOC*BM-%(O33qsL&iX8+-ml&$- zh~doMXlr`@o{k*pnDe--d`o(u{7u{>K-l(A$oif6RgPN+Z6Bv2ykUxtUM9RJ^vz&& zmUA87gw<}P!~3Vr|8KqpX;uHnJd@tGcW72SupRr74kid${)KQ19!;09VD+E2V*NA!&`x7*oc7o-<$EJ@{bIqxP^V;>LkuuKPTW- zeZ3EVvmDhqs6T_e>{r|WF`dG{wUoDx0{dpV>Oh<2L9H0#u<9he$V2s_>U2DNe=`XK z@999o1YRjC^uN(@|73{sHvIhEy#Jk5@Bl4jsJ4;v+UvI7hfYORmDt6@(59g8`!2swnl2gH`GwfOrHqdroCo0~~-DBB7X2m(z+el-Ac6*LAuRlrzO%AfdwxA?bk60Ct6WmV0f#DZDMbcH~NsRmPO*`fS0xG-o!zC_%^fl&(BeZ;{BHI3^qPum97q)$JXqk*;pFm6J!s7lBZ zAWV9)b7oC$l0%13e3_()C8&K02QNy#q|i${X#sT)xjsKAOwm-WuC4Ec7ueKxe4Z9^ zv!24j2>RA&BSEu$949jAWdfYwl7@IxrP*T(mDS~2GY4MycWz`%$59|jq)F`P$HJ0B z*!{`g0)Y5H7WSMRr%q>nydyEZ z?j#Inwv~bD^QD{5<(V3Sa2G@Qn-@m(zr0|I{^q6j>2F?9a8|mK{n12UFuGbOmo(P1 zNULx@Qi8MeA5e1d!ER&#qUaxDaFdo1(C&XxIT!nf3I@&}RJKPx7W~zCThQ1ZW06hYl)s~Qs8U|eyPA(k=u9W-&{G`9HRuahUjTBN) zHs@5U`87mdvl0745GR6GPCwjYf&P}K)45NI#lk4i@Dq)eFbUt!+_a-=%b$d-r zHGtd$Ndhv;EXZ@AfU={OZ$5a=$B4Ete}Q8B4^T*dfjX%G(1{P|r{2!f8zU-1J5gmw z%n!r9fgNq{&p8+8gtdIkWx$ymRdE`#^#)Wi?w!=%;*)|^|5JQ_-t!NCsCi-1^~6=s zo#L@E=&{3fp{Vg88cdmfku%%AZ)+b^NP=EviD>v6T?Olu0jgtG5hN^fkI=mQZl{lU zI|{JLyF_4V&J>;-q19Lrku(ty*}_)lX#_=Uj`L2s!HFZ($=M>5igvzeq|iA(o`Ny> zUoq2&{wrp6@xQc@;_kfBhHSB|u8D421=$7fav`T{tUx*fg(9>T%EdV6Qb(WP(nyz! z`B#J$fPW%njQ%6Suf<`xZz9CRZTUWu1LW^e=!f{e!($x_Pw|jdJTv0;EXHdX_Wc1v zUHmVOEN@Y7LePvxviMVQ|8UI0&OxJYmcRqB+e=mLu5>Fn4Zvu|z_JGoxIeemZb7Jv z|0~x2$pN%&u^{7!e1jX_VBKks3q)D4Sf(>jN^dCD)vrp0qR@L!qJ&JK6?3vEUf9)G z+6@4?A6^<2#i@cu$d@5ac(9@U@sE)Iy}Rdj$X&t#7=Wefb;h)6hIh~T#^aglQlilS znn6+6+gCjQ{}$0A^V&SXsq%psj%iZL2zy(UC-XrEhv0;{q;4T4jCyss*$W@^U5bPd zb$gQQ?W#d1`;ruT`U0_-mm58+R%w4C-iiqokxdtfWt|A|*{&vWZ$O(^Lb< z#t7i{5k%?Hj%(7F^MkU1JPBMf;+!yCMfkN@sBwD6VprnmAM;&of|8%ja-t;c(R z%3T`vZ-F7Hi~kRh-drT z>PLijIEg9~@b1t!jL+s;{;tOIcE9HT%_Nc=kHe1%fhp5kkutIMEN{+OTS5^+aAImo z&c2nT$pC?D^)XWZ9m=uN5+N1yH_&@*%=yW%p+byVZ)ctdH3(#;3;} zU2$EKDTB$l&LuUsI>C~9do%b-VYi3T)A%{BU((RVL4a-zDl4QR1zv43VuTtZLY+DD zAR?zd-%D`r5GYE46nIc}^+B5<0D+LrAK5SKsflR^tybffE14BDVU$)U9`rT|C++7Y z@wW%_+_tBVWFAY9V~gbC_QVOg{r~D?6Qw2_?>GOu%Ody zmQ%Y?cd(ut%$URq`KYZG*`U@J&Dv*RSnI13-Gth#C%!~W4)oWpR&Y?z2<9kh_aYqH zWV>|v(bH4h6QcL=miInfL$tlc7x$y)2M5tG?rv)vId{3R#GTmox$wvdF}2j&FIMbQ zy#zU&agnU}{Ai1pYb{^zq^cVxb;4TO(^N0PtxfU|MqjXtD>B(#@u57Y7g4j=<_Z~r zaAYsCBt~<@{Xh|qu9fdYrbb55rjxF{YF~?Z0UP}H-e1f1`wnUS@JtDWz~PX)P%^fS z9kyNvvXg(Wx-nirkSlalLA1$`>{e?*!WQ*3sau3S=>%tT>t5E#G|#>&JgdV!1jor> zBGKF*qSit|3o2ArXX{s|t}q2mpwVn>XSY2vx-9krhwoEVXMn|u9r^I0oi&B_8WEHs zFma+2p=)-*+N$uWo{eNUkHDNxO`g-LAihmzyE>N%1l^_t^~pAl8jLZ`GUPGcHJVJp zYU`(p!rHakp3LDTue{bJF}>+4U8`pfqaXvGCNaFXD<^tiOr6uf3Xm?n%W5#Yk*s36 zyhi~*4n?V>g?NuV)OjDPUp3ktEZ>()F0(CZeN!alb-lqsXzI??;(vR$YCViIrH0}a=R+@OP zIt{`^|xFFVS4lr}=} zcE}fGT7n}Vp7d&(pUu6)bHDe9WUh24P31>su{SDVg3Zlv`l;XHuRa9JZ`SSW>f#Jt z9)v-prj#|Aic2m}Nt+O&S$5crTNYO00MktSCScs+s`IdDdg9XGp_DWER~B3HsF$-u zCk~A!q6(|I-DlS~nPRC4iWswhl$}1UR#n38-!cPt+i&_6tNEVIWc!4CAoY0UJ;~c=Gep{f^jrNY3P0*Q@|g!CO5* zG3p?`A8Ue6s`GoRXH9D7H4BN%Wx4U^l_rEBlwO-nS)Y zEhJXeN0(ZVvFT1EHh$UPNraQssU&}x{PjC;cJ__crS~=GcFEgQm4M z$VQm5J+{u)(N7^LjqT@PYnqRo zC;Ue8w{#w0+?*Hy{$uZIDWkhWtI8sx@^ej^P|d>Tjy`I7^AzRKtzihl`!bF2Pmx4C zx6GN zBwa%&>KADEcon_PQij0Qy;=~4G(lL7kYjUJ6W;w(A1F#yLP31m3$&&wPo z3q0|iMyc~2hwalIIZ0@I3^yYeEw=y(0_vB!u}!gG8sK83OEn-YjoJ_5M1P8}&79;A z^WlP`w_;|`A0F(pYFCBeW|~ymC3(4hJeFUip5q8`I9V;KTXPuuj(Nc#LbGb3{?Gy_ zv3D3L$GW=*EK=m#!FsiU5U7h26v2>N#6H3F`l%Rnj1k)TaO}i#-VN_RAa0T{YHW0V z4y+amdQM4{I$;Achi_@rGT&Yq{y5n$tl>js)1u;KH=}sOPIujSN^yD5USucUc4ZFT zPlFOF!ME)p=^CJ4nWpkwKb+X}`0^VWVIzihq__k_JI2wRiT=VpWCQQn{cFUh@Mw$0 zVT*ChwURm4k)Z8i8;UHU$kevMqQ1^s-E+7NdG2lFv{pl-v$pf|h?O>snjidR)^~KN zN!yUv=ak*_6%eMvDVtO9YX;g6Pv<|!+u2N*I*P)$m{AzCgcSMIb#hZLHOSd*)xYtX zzmikot@wagiI7a}@_=1k;X& z9kIR6c}<4(T@)|NkEw`F5hqc!TrgN1^j`f&DbLf*lsPl}c`= z@RBqMZ>DuN!M$uly#Eamo=dpM(S~;*yyd!iCh+MF@hN4Gj1l;OB-Id4K1zQ7{HH7E zW5sZyK3&d!5+&3zZLtRD&kSy{PU}+3(eD16!LiqJp`Xu;B6%-gon=N-vIloEfbNg6 z<+tJn*nnT^a1;!@Gbf3HUTNf2W0&<5m&;-W2%6YR62_M4N7M2lqif|TNrZU%7VMsg z`F$r=CX+m@G(TxZpYV6N?6OMu+awy5Bw0s)9W?DK4JfqLXvJFPt7VTwI#hNSatSta zNwuc>K2q1yI!B+lOc*O=$`xQ;tG$FJ7*qIyPUogHd>}c1tRs3Cj3^X4I$P;7f z2GPILsLHaPjW@mBU`U3~q@9K9KFFp~>2GSTbj3QC|NSFfX2=($%x6*2 zRM{-6$Sn!P{M9kA9-A54Xf8+fOAD`dKwZhLdd?6uLyxGW#cNjKoZIrSnH@Wh07^K| zfY=7$?aItG9E8JDu2mZaP%d=_5O#nR7o73sxN zV36+qOd&yKxlfmFVoQY~>t{zG$#^^2*;kGg zU?TOaWJo<#Ru7Y#DLBzdak2ixGTG=oFuWu%H~&Vd`!$bxT^Dnu>CBsM;WXQLnEIhx z{%W1)g`8WTEScI=)X*|zTYdDbg8FUDeAsqgFNu0$6Nnr6F`u*o*cAQ=Ezz2ne`v&L3bq#UE-2i=99`Q?yrfp9=x#;b_V z@QE&|A&+N$aMH%O?db-1rC`GJ?I_~qQ5VG&ML+Su8V%@!+Yv|qlDG7$ZWyi3slCu) zV<7eSWEN1+4$@V9nxNlc+8SMbKoGH|C3o~-ave0g5{W`)(swU-U**4>+go=@F|4um z?*oi}>Rr_@TiFd^$$#)^WuV?<(doSwK%8mSE+0>EpY6ZQOY;&P_gK0(Rr$QtN^p1_ z8!mcz@hC4tDbIT{UuSjB)z6u*u&U~ z!e31}^O&MtDdIOroK^YQR7SdqL4FT^p~K4KqMbqp8{}uazL%A>T*MXS>T8+v(=-hU zY#9FSEwzP&rd@kEj@6~IWNI*8RzKEdnWy!Axt7NPfyZuKMCR|Aey&}W1PUp?lMLXX zndQb2JyP1_9^uAp79opjP|7}^09D!X`&m7TYj^JZ8ms`HnHg@%^GcR2)1J#-YG~)%y@EJCbez}0pKmr& zzP^1z887fBqptck`L6Gf8&95*2ZwJtnDg8@_Kk4Z_kCaSPR-FM;`nmx{M0SnX*|Js zGig;jq`LU{b@9QoZmw55OhdLY2rRT3*3{kGF_S|3UosbRQxl_L5Yt~Wb%CL*`#eHY z6z9j^citIvK~0PGs}s*A=`Z?Sjw(Ffo%@<~S%14`TBrlfzCX^){`{M-&cxS9AiF6j<>tAiKBrPi)ywjocR&+IfnNT=UpS#7UKJG zZ1k2#o$t3A@Wt>_>OKR{As9e~*+s^%OHRb2u_w4?2qkuOy~osa9EeSNc10Ss2^atJ z73I_E?92@$U4C|wRwGVez7|v>;fGO<{3`9NgD!g1sWsZbevy6og(M4}#1q9~|IawN z?Ay)q>uFd8&~AlG&GrR(DU5{#qLq6D^sPEVfN%b9Hi*Yw^YQxrR2Inj0`tl+^rbFv z>Qt-B%X5R{=>;Ov=o2J?JL#C+WuRuHh+Igak$N|k? zq;1MFn_q6p9MA%QrdLAw?#ad@l;xGrYZHuHA*#NQAN7n7OEGp8kw|KPfXFK|^X_wu zl!HxHdvTcQaBm1<4S9g6jFRLNwPNDRew40j&}>>Kc!SrUcN$Bb=?=O!OyE-PyR-NgJU`C`7odIo9nk= zq@Ch zbQ;vkH>!vYv}ltH{-NIij|xut`A`HD0gGz~jf4<=Jcj{>m%Rz@9iIZC?c~(1YR)Pm3^q0jn?``l=*ajKUuIP4NsXTpOn# zP(4A+MY$89tQpRgU&Fqd;Q7HCbxpF-xZXH@ZLPC0sleWUe{}r5eR45AYGkl*{F6JL z`9q6r-4(!~p}?eBe#p+1Kf+UhH~q3hwnwTfm73lHDI%o*?LZ`Hd>$p8Vg5oZt3{J- zJcp(F3h34AFZE6Q`p^HE>dH@z9>xNDlINtB_+CGBAzPm1!fi!5pexaSOPe3^ zqz6}CZ!N8EFyBrxC{xv$N>YavaJecnD2qctL45#MW~tu%i0;jlPNEbMp?g}U5nSUF zVZspqYBKry#d`cs>cKhz2Dt)#oqc%K@vl`;2$ASAHw?cD$M^YX zAFmAA(&;&8gwCnz4 z3L;2Zb$|9iXPf*WNmf9=$|`7ki|+FI`~A_uGV>Evv1cEehe{~wj|75(#1e?fyIdvn zS|H*aGc!-?O9NsV`&Zf}vyYqn+ZH)zriRZ0fs==ASxrwbwm~atMGgrZpx+I8P8vR;A0R)f8O=!&eysn`8^(X zP3aL+_DPzMQ?qZ>ZH*%9fIP2u0*B#rgl*h5x+A~Wo^U{fX)70I=xfQD2m00S~-LalbzCBD?6x*TsUlYj#)^>xV)|rHg3B=I3E5JhqkJy6bfN za#8$LO5S$akl>HpgFhk#_4xLOmaQW;N7FM!oWyVl<{ZFo&T~#P6I#W9)?|Uz9wzW6 zOm^)a8uNXW=_|O3tI39mN{{SIwtE$d3J)NHV+)vPGPl&4XK>O|);$W#7MmTbQ%!h1 z_o_Cwxqs3lKMB)SXUf0a(ks@A`wP!KoQU+LX-jLr2fyn$H%wQ>Of_@Z5bAhz3HvF% zn~I1O((c+1P=MKc2unbs7tx6uTGNkCf@4jKC8v$81QR&RliAu2^fOTTvW3oMPmp`! z%?%_B(>y7WOTCvrfnZ=C2)0*`+P_C*(}!>B`DOqJJF=j`c-`yi8MR!0(xPA7TV%`e9@=DVWqBo%8X9^7BSwH5>$%8FT&U|8%)g{J4o<7lQ7G3(Iqy=%d4a2?gD%aL7m{VY3oEzp_6G`>TvUCEKgY zgQ7+GnWaa}-P0!b*b8IJO7f@e!(1Rawm=V}^I~bnl9X#<><@Pdo8@L72>|`^47N#= zq*MQ)+*C3mC*!l?1m$QSD@QUl@Qkje&S+8pAgg*&-v*u@RtkqgjqG9@VhPR8{CgF2 z8oI(e-qJ49U)vhIc!E{S91#g4H00I=8{YM|)a5LLt>M_sSXc?o43$Z1^9{fbpZddB z@H?|RRUv#hd-qNZM9P>RCeuyRjAm{PrcZZ_$?qR;`IgrYa`{hM0R)w`mOd0TSIAr^2ltu>V(T!%9ilUw6T zksPX)Ddx#j{o#Hs#hpm6QARk~$synb;4G{*pvL13hk6bmD+yu?kUJv`}md z+)N*RWYerpRO*39c!oBDOq4|DQjlA&I*yEW!g|hi2Le6zjCieX(sod0tlxEt44jKN zrzr=j-Rij5SF)OCN!paY7IVS3gj4%&kAh1s@A%^pDs-@V?YfLD6XRkyvUnEGJUPvO zhb)I=SBkz%)OnV9UrEsK_1;F zeNbyjiOjOA&PJX8gv#4~tZ-!=S*=QKbA5jQB+{Z3Q+b=T-M|gZG-ea-WXE;HrN9~2 zkRA8b#|wGB)Cr6+t`cZrmzI2lZ~!4u-QdSOdjKc|PV-0=Vy)P`0USsHaW3-9d+}H? zIUK7@6%4^(D_+Tk7>~X%H5jlH8?5te3gL%s@BVzBwf;2 zrWG6}y`kwQKM;Y$V?SslN#PIJbY?pn?2#nXjIo30q3L|pNHl8t`GiZ{w%o+!zM)rb zf%gq#q&OE0TwI?9CeUkTjcB{WgKy&YuhPNphkTYGssxq(!rbt82lUrB$PDXB zqn!b1$ozgS?H;7}UxY;FxA>M<2CBp zbq|W3kMKLEKG6VGIsGch2T3G9rKq!Z+@_M=^&9pN+A2f-cR#l6T`))=a*aB05tpf7 z2|IlKcCPx|bViN@cbqb4xK1X0qp;aLBL6#^x!7>Qe0JdRDy6L-en*Ij3=m zz{uB6^#>6kIU-$h7!jcH!wZp}iaDGrBxjNinnKWhVb&f|wq#0W=ckkflOSmvf57^e z9jQ8yM+qzuelWZmOK)8<#&K74*D^Z#Du(h^;Oa(61e$I{gY3Y7C>E4P4w(ldv$}*U zHh zB#J;BP@?q4y8}tZiufH4dxad&2b8H?itqr^C9A8bfu+2B&aUHqUB9_s{V`gG~Dkd2nW|>WDTn;bJQ&6V6`Fa~GqAaKoe@F}s2Ob}* zX>In9)dY__zM*z}66G7~_YU8G_o86L@uGiXcUMdYUC=el7R{s6FmZ;Z~cYbX24!zNk5XLKIDu*78wB_n}aA6eQ zi!)+kjH0XrX|Uk zKui&Gh}lOEpc@j~PbpDembTQ%7PR7cJIpeZS0_H;D*5mN9oSR-e~!(m{n^)G3l~yhOyfix$7djU#l_Kg zFkCS@>AOYhccEFX$e)$GEhTMCVHbcv_HlAmN1j9?{0u?ZWvRy@ss zmX5MxJzyc6b8*a*Uq&P?quU9aw7B3{QACH8V=3M*Rg zO2%mg(IS$_;ypO%g6lLfnjRJmVmS!pzw71*L9C^sMy4AA;s6j-DcA(sX@+z zJZ$;Me-0z2b=|?+%MX?_BvxufSBkmh2V~MKXU`SJpeP~Ds=O=~BCHHKPpj?Kwes{= z2<$0eZI?U`AW8USb){L}K-vx8uC9cc&st17C8;nSGAV#M>3H5g6Z#GK-ecwL`Lj2V zc%#+lFP7mgyWWh`ym-X>^6_J#0SX6Bti0q!f3Ioy#pB06FIDC7<5~-atT;Mrp;Rb3ZkbJX%aHGS9GF7SgLKMy zYrEQjVU}jQELOlB*k%+Ir^aqSS6R zq`u3ilOAs(e|iI0KB3{|c~*TFB~16-Zhe(Y)Et!2qWle{t~A~2RNj@AC-oTO*$XN$ ztM8n37W11J_!>t4*)g{%|AuvGy;1!8${jWAL(+X;4Rfc{@DOaa&%prLe z+AU4%EP7zR^GQ<7cAd=DPLKy?vOM=8F;YM89U9Q-f2@|_A)To@`K_7S4vtwdg*7fF z|7@DTBpGX&-`H-8MT${#o9rRV1?(T#Ug}LUp=0g1vPA!-kgL_1Zd^ZN6!G@v20Ssp z3M%Cy|s&8JJ(KJ?)K~Gx^%rTbw9YAEz^JE4dexCn5_n;8^NpusdM^k5|^S9 zvBbB@9pt_cf4*R6D0i|0PUi9J#3wH9Osn)cgui%@7Saxi56Xjj0>0>*dE%|v{X}}_ z#OuU!zAJfcxQ;owQ+l*}zAjEzWG^{?_m=*$e-ZgJB;;~pL945`$ zV-6XA#S??j=1(azwJ*g1c<#H&(l5Vm>)C|%6XU&p__EeW*h;{h`5kSrs4O?ABC?1n zCMfyjP=kCCU&H8x-_U#6@n#)S8f9>!i^i0X&{~!b; ze|2bOLCKosT>-f`QI|KtT7G|az1iHxUtCA!#= z;BupWf+-xr7Jpj#kjl1H^YGC;Q~|##eB+T6N*g=x001q(4}+WX57ld$PecTw_6o{6 zfR$Dk5pxigG%vCoPI{f3m@we{sPTD4wTa+1ewn-I>LOJwSK$GdhHBn>GjJ3qabHSjWc=;v%K`5>o7mH}ZoPnF?5z-VXT z;XQ^rNwcU3L|I6AU706f3}Nh;e+Qv`YWR6+oWo#k6wvkrGFe!ZW?|7hUY$%C@BaKc!4z+)6Ir=6ZBmn3nFG6 zDI&puQBfa&k>u+DS@QRj%iRPi05aX3F=Am5DMa}a3@`xqX7!PZS&qNSVf^#b2Bu(I zuCUK2*z~LX@TMB9Xa?&Of7yX!wx_@PWuI|_{Tp4B9IuRZ#&ttl;tALS0li)=63aR@ zJ|Qs*EKbn|Gd&yMPnqY-S`$%fTBR*My`BHCZY)W70-2oiGy$?v)`Dr-XfihDN=|pY z5_G<0=)?}%|Jea6s+ClZTgV6o10qBZpJ=_k@o~m*xCH_x8nHs}f3-T~O;nc#u*9E-Q(duOxZrB)cb$D87y)KNJk5hT4Oj%L+4l z-n_VcyR*Jj@}G(;jQp};Wu_DRo}gi;Nnt?(Qwp4T6`v8j{{;k%6h+NKy;-#^-tgI- zer~GZaMK?pbRB6bfAufbL8Y<%gtwi?>6*wyE3Smf832VvlNa|&x^A!$Q+bk#D)PYC z;_-!N=^ivRI~RK$(LbN&paMQswrpF&k14ERTe4cR+*|0VBq9FU^Y2u4umot}+w}?Y zlbg+RWcOHlo4atBMVL2zT!HJytoQPp5BXu%UOsAngoT&yexZJ=5w|mqrbpA zEV+Ek?>A#Er+mdME{1#V)N&VKq0$jsofv=Iqtd=iK@xQ`&wimBrdN&DO?rh%hkCzN zrqTlgt}>8Me{fuA+J|n>1xKoxev1wa;vZq%f%zoyCwH$gFP6+_`k>K=q;Yut?ds}k zLBHH?HmiLX64v6kxeKB}`m_(`arKqw*-xEN+HkH1^YpglG0fvYCcbKvBG^0NFX-1HnFdi|de+;3YIQP8oVA)_t&sNJfNuI~c z@GMRFfPbE1d4c|F=>JDgl+%_0XgY_v&j8dOtgShWE7NGX&Gdw42{d~i(k;F%2B11o zBtOd>D=z8@@(6c9yzE?gK`)DJit{2nY?h<;moV<_ z8$X#xf3lvf)<9XaLCL?IH1^k0LdVW=+V<0{i}~_n(S}RfEGLOHNh2c4bQ$buDZ{Nq zuGwB_+fPrJvKsX*rZ7t9mU13kYZ{!)La@iYnaG@0&y3q9Zd28)`iXm>m8h}SK*}Cd z)^e{S>l3^m;#7N*{_y>>49E$rA!*GCQFWoZe{>Y*#=^w%9(N#rD3xHQS}}!dfYbRY zd*8IHS@8{+`Iae~b|#$v$f{7~vl;*8JoiYP^F%kE_$Hpk7lx*LLNzV`B8$~Mqf0+> z{*QRI{8MGlO!)qBze%grqCUCW&ch$cV!I<|g5`*87n_vefSuRFi1te3uLyT;I~=)#kdIzFZ^N zr%82l7_95dchqrHm-Q$#Aa#1Cl@%Bp)%2q5*^|y@SOJHZH#b|JS|nz)YHOmta)GAW z=x@y(BuZ#@Be0ZgfElf>{Dec`sV=B4f5U65Z{`pT7vo15MqA@e2V+pSJG;_#4mJnann zAP%Uk)h6rub8tw-eTJiEG!C)7?%rV6y)uBOpwU0Im!E16e-*}W)fOUb@MB5&f3xKM zTCE&4___M{yL$P(u>P;!ey~jX9UHTK-D{bS>*nL~E)3y=IV~Nzf6a{Jb!9HewwCp} zUh6qB4mR_a=c~G7w>=#`b+gO{EF94%eI|OQW{rqWy8t4mkRH*1GWa}u$Va;r0@t>#2D4ji31O#+S=i^JNDmJ9_;U zzr2ur{2u;OU%gVp@a@-Me{pm3MI8U%CT>_^M{!-k7mC?5Q{B+jcJp!xe`>t~M+{UM`m04_cbQQ zoL)uvGy=lp8rZMq3;2V5`(Gdao{#C}hO9S?V^Ih8Jvh!AjWdx@@h6TdCk9QJAO8kH;xsUkr_9MIQM{e?ArcfmTmnd40=R zIem0q|4!3<-{}OzeyH;5`_I9atJF|AT63R=HCN+C{rwqqWxqB@GrMSD$*j8cXzGY& zoH=Wl&yR-OVazfB-~yCwqjK{?<@ZXq*keZvXD|y#{L*dX7`Cj5!yc$HdwU!+2UUk` zPfG{+jia%1Xk%x$e^B7j-uXQ2otlu`@6X;T$4GM@mT_)gh|^vdn=*W-=fwJ5xS=Lv zIY4@A!^NbZjdP@xd_VUH$L&aV1F~}Mo|XgpD@WVm(6&Q!q2;3u@fq0=f5Zq_TF)y5 z?1f*r@N#$?!a&;)O%9abg%L4OEbDh{b_~2EOW*pu*V5eUe~#&6EaQ+%bWJJz& zn5f!$Mw%gHmo3!ng-rziJ zBr}U!ufW^ee=FD8_8-r9YbqI3U>#7xtHOL!JsMa;(@>BkJABwstSfo@JIQm4>50(S z>s7c7(u1MN0=*$0=~>gs$tQ}f!Ah;3J~>^70sJpJHN0KUVF|tDC$-O#RvH`N@7A9h z70t<>PZd0%iV;1k?>?E+qG{J%@)9(KVKdLQbFD-ve}CTfGpaXL5Qxi>mY15at zl;0n(my0+Zt3M^P1)};>-8JOuvum=vqWLt&?;d@fbbfM+S26@jf<1+y(){e|Fr|n} z9+!dCU4SX=lg0`|S&50J;u5tbh-wF*t};bhkf5Q&PI+t@lgcXM)nik+m9uYGSMxx5 zdVBkbf7RUfsgigWyKd-fu1~}#x$YVrZ3Q_ROL0gEocS!2m(P{6zy0v?`J+_+@=av< zO_-Z&!V8kKLf~=Dm0{Ao@{~b1eLG)Hh64=OkvRE)nqGlcTd-cP_t;&KY!YU$V5Qa5 zn@4Nz?#qi}u{*d#_X6NcR;SbR-QOf2}9n-T6T5heVddYQvdQn^vc~Gf!9fp`wVFQ})S%0GbMYcuLat(+vYS@tKxTed3XGN6D%C6Aw`$$4*McD+@Bg}4x9XG7T~%}1 zD;eeC(qezMnELfKhf02mcQ|Oi?~{>TDa*Vc+oH=FJ-hP+Cq*AuRRNG*>x@f2A*LSa zr!3cH3B7W+d*W2O7Q-%JxG}*Ue_QP0XcS( zDLCG*mUYH;%}$+w4N>3d^*n^Hswtw1b=_qh9L=p220$-6Lz~{rW}|c>tLxQ#va5sX zZ#`5m-U#nka&=Gb)kkdIPogr7Y9;9}t6K~OvJ0NHnX1A6=^5B_HtIZSe=Qz07=o%# zy4XjUthoOuPSS1HIHj2VzOEK?dy-zald7e5dhN>DQsS}1tcY01GK<>PBU#>Q>yV6h zJ7QY6mUXxc#B=BN4~varJBRFKX_p34fYx>oDG<^FffS>rwIP_7NC{3(dbiDbFn4e3 zx6nImy-Bj5ngvJ?@O=&Ie?tq|e0jUww9c_igVWWfg=n`h{*zYXuC=m6yhb@1nlMol zqi^zG)Z3#Nz}E2Ey8qvU*{odzw{4GG9yUJuZGTN5UF-VEPwA`~e^5XCjcz`W#o|M5 z9)4iFxE0K8KP3Ne>%T&FvNzZS>4X#AW$dUsm(e>c2;SMVT!#nFy{ zwjpi-GIJ^=Nsd=dhy4@ETS(htbQk%cRopdy{TE<$71AHxykv*#R!im*FA7{<)WHSt z+eOJhK{Qcg&_FANgoMr(N>&_uHy5Y--SR45eEVhN(aV=-Y)q8sSboF&|j_AA1DbLD7)Ps?lec_>3jIIj5k8ix~;6WZ}cCQF@OO{t|6HSNAvhOU4Zc*&k}fw z7nCdyz*Cy(HJMIIvpXikP+ks{}%Yzu(DK z#LZuk+grqz26s_xZ?+)a>uO}1h-Y<-$$*S?aUd3wR>x!^=7}2YDBA?5RB2=R0Vb-9 zCz*}&!}0ZWGa;T9B;LGQg*^RpQiE7#Y+@r>WbWzbGPEF$5%1)aaf2jE@8P@uyHGgoFBMK}^Dnx+ zus7YcRtnUt_8zm;vTRAb?^X;{cnPNUoP_|BM9F@(PmQZId3h@QiY9Y=EJ}QB#WBYRVDKRw-$(cEB;31&V}Bi^I=UMV_dQt1qy6CGsGA!Z zoIHS`cMFXM^INiblaPcVf24__d_~2>)}Y=0az$EisYnZ#}2_o-XM|#*$vmp3vjL6fB5Ua zz|cJlR%AirfS&aV7u1}vW1#}wV5el@3;VU6CZ6y%S$Uk(N54s|f8F^>J*kB$ts}&T z^RQhc;d05U_$1+}f%|pvjTFeaWmA4G{&5f)vw$lhWZ1%I+K^pU{ceH_44LANW^e+#&b$ zrM(NCz^-@;zWtE3YH0QMPnVUf-AQo+5`Y3Q9us+@?P77CRxYlq%G!Onoi#(lbR`m2 z!h$ZZHrHo;5B;{8mInl4;rR0uA^2jwUaiLipgk-Azan#RfAsJouN-|nz(IBC9*ji7bbA!nV}y#mY*hWIDPt|K?DYLTj3?t0UW3 zuC-#;wKCAbL0Xse^Q^KPl)Lh+_zMNeb*4Rc`nlBZ(mguhM6-CMG0=bPV z%Ey+w;cCX1m+5VwDHQ~7zRL``8nTJ0+2$%Uq+9}~e?GxjHgJ~KL@2Yxf0f`U-rnA> z)|*b2@|$p;t=8~{m{~hGOB(-cUOPQlHFY!qdR_WZ10Ad>A4`>i#W&8&-@r_omAR?- zXMUSl$0YvS)P{MkVE-za}v+fn-~r zJ2MT(fAO4|Wox?YS|=TMIKX1IkSt8SdsEW9?yji(k}VScV;gVcnUP>i-`bu z!9q`8j}@Q5?oVMxd$Pex?^$ZQU?ji3;e1B`nB!USXdZ*dt=1cGqMz4ElwXt;B-wB@ z+-V)&HqMpTbbT`yS9!7xh)BCHUe!XDVdWaAf4HtGbEhf7>y#_&6=*m6n{`BXIS%(t z^0phU_^SJcbq-uKUzSq7UL_Hm4Z&^?)wOP)7w*GiYsGr*Z`oy8w*|Qv0=PlQZf;qD zNNdhA-|nARFkIHeJYj2h6raL(ZW^YgrYZj9vTew*jnRe?=d7q#zO?l;Q@jlnKOT{f(z zu^2oCi^M=?>e|p;D;A9sGxflc<)N${4O*5CAC;I{#9felDq$*-X%1T$I#Ii(3knn4 zcPlXm{i|&us4eoJ&)vo4-d~XA$NC%He@~Xlx9Y6_m&_AP7U>03opyWi&)+_~dwCCg zA?+SEbNcQ#EhcmILKEE5U4IvG9dlK}9Uc>BLa%ov%>3WiExnN5a=fKCEqFY{ExiKi z{Ew%66E**p54{Ln{~<2yEn{kc3ws;x<8ANi!(U~4;JbUH?UGNK&=k679#&{^f5GKf z37^~|$~R4HBXw14cXo?@yta6VYm4`|m3Uy#e16v!<1X**eK+p`m9qWv-nO03p>C8c zOk~}GChq;Hc=IbWVO?11cx|QVhU2xBle)Gtxy|i(UFFUUcD$~#1QbWyZ+g70QsTNw zS^IzbH&;$17~Uh6d%RL}QdepsfA)^ZEBkhAuLIupc)SPncn@eTGJf>eUqi@98p?P6 zTHhP4!`?0_4s{yVhijO}+ou5R!N}rKNW*GNQY)QKWQWINgD7 zOZ@T6Hyx(7VE8&-#vg-w3l8(|a(^Urka@!JdF@EZOT}_N@RZS0xa> z^d;odC_lXUcG65HjufTjL{Sni%9I%g;3_{dgI{?K`G>G5hRVz5p9#l5#B|L=Vh_&o zh(#wqi?U!XR_IW6QhG*?e=X>(7E;qqvPBc?0dJEP8!B#xO!7uq#@OduG=B2;v+cF^ z9=Nz+pOyB&EDg1;9+=I&SJ4OKujiWid#+*G(`E89`ap`P{6IxrokE8BJpMqFqJ*8t zSh2ObQZy75eo}u(Rzp6b6ULfXe?DE5jf5Az)mbvBQuH?Ti zFXe?bwY&7r&J2vGb%iVgmIivzLRAiL7XqNAgdcIPI{hiW06)gl#iC|}pT_sgp#DVQ z!|K#vrEThrriZF%(@{ZU5hE6FnIilruVHT8d|;>Iepn-~MU^WaTUFFO)F?F;FqPsC zha~#TErj!NcUYVde}3|!6Frz-hZqZ4bUIEm^8Vf2W&q&|1oD^~*uveEt=fPX$bGaa zh4IU1oRTZGZufD$;$I~j*M^O8-OtBLEuV9xmO%=&AnUXo%d{N0OiTHPV>J{^H5B9E z)lhcNRmq?1G#;QDO5-<<)liPrP^M80rCMM_E|plm)<{zFe<2{O>SW?%iIanJB}a@R z95KnGFG=umd#n6ec|)_(v%-dBgxtRbA_F-%072RyIM$U21M)CO`&iAtI)w% z6h%?mH|k2dqvwaYn60NI?xKXjCklLm#_U79IW`jPP~b`lwlQ>vvf;DGAFd8cL#-1r zTs0>u#R*;Le^x#^t&-W$%$IMVM+Pa8GCNnkzW3Mjuz0$TF_AlDV+vgdSSvK2p+RuM zknq5zQc8$zub0xl9*UjTL(%@A^-x|c7Ckvc(UY{SDD&no=42UAUh3^vx&{k~$Cv*A#ZSuEI&|@qt}Z_oK`Bp9 z$08{El$pp5y+Q(pa`v|$UOs=6R-I@l>%jwwjW<NID-Si=>{p ze@P~aWyd-bKSq+BH52>ef<#EdF-33y(zZ^n|NE`#2hac-KsO#FNVZpElOWJt=tp(+ z?y6nsHZcS#h9G4<2~wI^YYl0NAx){DH08z#X2YqEya>0>5ZnyMPl3BQ+LT|h`ggqg zGhTf}oPsy--}%pmIc0sAQ;N=c4T%bCe_}(Tl0O0siOQ;xsHhrAhFFFFF~lmY9VB7Z zGJl|ApAAKijSgmr$j{UfI~pq{Mvteutn7FvDcTUL7-E&wA49BSCBy5O%_=>BB_k+` z0OTuH82-1_<@7;1#43ZviB-}uTl&N*g9Q+)WY%GbRSdC8n~7C)-IJ4{J!iS>e<~!# zESF*>w4G&kvrp}2N-EF}-j%{_zF}W6>?`eLUl9>V8956BB@Hi2`*~TE5eLK7l1rQ# zTS|p5;wId1wdkAJmAP7U%#!k)ErSZ2EvaWUHVW&-*>YewTbkf(d2Nrs!v2_Y6m0}S zOMD+EQXDxD5Zm8V>ugx{W*bF`I63dQ$s!mvSg9H+}+swDzikB z`?lWk?mqn2liWIy9>a@)$EhP~m)&RDU+uB48kIus{8WrmY;sD04{Cyh(T=Z+v;^)4-p%P{mN zhTg=`o5+$*{#7-VWf5`Ee{!>0l6U?GoIvC(=PF^k+@`}aS!6)&iyL|qLvLc}O$@z> zme!Ig9`4)2APSakNhh#+;UY)r#@^XM0NbjOb#cBT62AwhQF6+(aEaA#R=(Acn3N|m z0V4^WF>_6%JC-v$nc7~ou@douBtkHB?YqF>!MylCwUF~pDoRm7e|lXzsa8r8CSSgp zL<$OBQVQo{_%hzjKS5&_XR9xaM9F!;Fq^C=vq|}7*6^1Y{*tUwSf0P+k&ee9$uhh! z+7dPkhIAGPbS1HavQ6MA2^Xr(pes2Wk7Hd-GDnNP$vLmmD1}|VS)ztj6`4wf#1Mw0 zq$){?@^s=Rg2F6ne{ftm-==WH##}6lMwU&28rsBFqTJeY>&Fn2@IQu_gtbF@I2vLS zItL9giRc8@-Fn7CB+sU9@GPEJL7C#^o$~&?W6#0Q8_Ey;)rz!r=y6BIM8nNR*AM2X zR@R))JgcfW%Np=7RE`}B{q&1{5c_=$9FxV4wSk!ApmAc7e{`&pJ~7F`0*Fa6>oCM5 zhM1(y#3Z?%y7jS;FxbT+u!|Pch}}5XNIU|RZ{H&(2?h%>p}H0n>I7IcDF9m=F3mja zb{@dHTQi~|Qse}n4IT9Nas${d$mu3}d%1iE0#`u>^}##Ge{{+A3SJHbg42|l5UdrD zcRzb~!2`PRe@0nRgH%yA@gcW-4_*zwdN526rN9JXvW+d)BL`8{ZuXtw4lmIj;yCriM49{k$QGZNFg$iMO_4 z2VvIh6*-F)4E{kfp==d9w=z3OrfpE33gn;y6-eq?e+|=oy{JGA4HZZeR3PNb+cz)H z#I7NW6g!8Ax397&4IfP%>m7h72SVkW~x&ONaZ#9^2m8!)5o=VkadR z!MaBoa3?W?g@fY>c{`WFxOnkvyu~`<8X(c?F)s${>cEA(7;SGwHqjr>%`<{u063f* zo0>*Le+?N3Z3aUIk~2v8sFT1ZDkm^FJjMJB3LFndyZc8v91psw7HXq>C_GF_?BuFu zh`^@GI`#`4qQq@m)bP7KxrbB!(KgZ1*Q`$s8OZvOffQN&*~JM{wHL=lvYz}S#$1pw z;W%(jc?lF60(M@`WE8xe$UTU1mrFq(B^J%xe>rK`Koa}fu(1srh+zXUY#?zClVE-m zZZ}|4BYwRYHAlVj!J9aO)3-Y7$`^RBS6M8nua6-qF(f5y6r~vj&=MJfDIyXo{8cy# z!R0Pmo~sfcJivS@^uCLX1_jSMzESx_G%mzEbz3`sZpA$YKmEBS`d1b>g_jMt0a+eA ze`1G$uSTwm;?$mzsLy9nmpv1eSn%wZznsafH*(%zULaXL=#NR<)h({`z<~PxEQa+c z6d_@Mf>MMtpTZJilvns{^g7aKw@?uZp{>FbB$PFq5lB;0vpCvt{5Q*3BAaF##9NYj zeZyX2*h>t1iD56%(p^&Z!##``ma-Zge;|gnM7@pGo7k|HD7J^LtrYQU2_4?AZ47hCHD&g8MzpWjp1UM%BpC)1$@C@gWgrPee=5OX zqCL3`k4a@76YVySTR(=yq*xKDLgzWK{BrT~muxqybMmU|@Rhkxcf`Z1>=p!`wQhskgx-`5~pih-CPd>G!CM8r?|Y_MGXs4^KLX; zCW$|W%cKQdCWno4nWST_^kX~^e;2@Il39o0GBI2xZRRq`cQj7tKX!v$K9dY86S}>J zYAk}nq)19G9e^O6FOGO;oQnj*d~*0mB6P)&k+hSHB<$CgP?8ApEP(BJPL?(U!L_7AW3_kSS&{dbyehg%NvSb}ske?bQ@joEn^ zVx2|ML*plM5~aiBzkyct$?#ktWl7$cR3>qco7k|H#MO^sEr|~% z!&+ikOTs^fwZyQNXr7^1e~O1FmL4N~C&tf^ij7Z_Hzc1ntR-TD7}gTQT4GpB)|<7Y z*zPyHC5E@;ZtQ)9?V~$!alp&=w&7SYyd{RW#PF81g13b0cGUow6hg!cpwG+b<1{60 zg39D*_y9+u1tI?EJOhp^w*>(};K&Q;8aUj+ZAW>IW_Ot50?Na6f4%bx>d&Sy$Zj(S zJ^Nr`9$mIlJl>^(bk)1HFf1d@v%p88VKXsoCaqvIx#a_LVT>kvQ=lxNiL92*;WJ6S zy`eKPbS4`}XQFF0E}em+Od$2bh2*YBVe5u~OPi%OSp8;0ZqhWliLk1d<~EU7 z1`DS)(Rh#LF`FcWe>B7SU31ZJ}K0LuoS|N|6V1U4$s1Ma)r} zY(|vu);J+b4jD=+!jr`A|S7S_U=NU0a+1B6anuk!HBX@x)Ls` zVI^svl_YOi@knYPpuM$Y@`vgk)yiFM)H=|@^m9de--FPQqO7_xa&nXa%|{EnxPw^ zYMS)=ulDWd`E)ZVN8;nDdCHM=Gj9a#NZ}hLo2}NDmKedf$DkH62AJH_9?^bv!H-^P zFf`xSe}sFMi*sxHxAzz4JG>R3!>uz==})lF19L6BarR&nQ+@`sSGG;mZk2ejS3ToF zJD^Onf8DNx^04W?KER&Q;*l1xe}iv)l`|Ze{dO;ENn4%i4>K6UOwhHm%Su730yDY ztSAJCNpRpNRuLKReJ4$HlF52+)k1r3C|l&`5;-(7Tzkm!Aw1^pFv6t^hlZ4X0w-R~ z?3Il1P-Uk#=_=fnDz~4 zqTy^QVCKj*x|(C=DA+113LFbuZ%$aHe+`?W$P$CNIl+s!-ilHujr{5&H$jBbKNup_ zM?N=zgw!L)ov{QjN&lcGVv?nBjePj^($I_;nvqt}jC{HA7soJy13zezTqH5GHiuV4 zd~ri5Vkkv6kWwU-DqOdOG<2==^m_A&2ylSKPf^<}x#1KsoFejZR3%7sk(?sbe^x3@ zCnB0!OJEXFlYV(5B9VNCKcq4KkV-4^CXRc@sD!Oei1cFTon3G}hG^ z8dOlNLUc=gnCO~s`V&kvv7&a$iHC}}vt1%C zM&j=BF!+|r`)&6z*nI@wmNAJT+9jud!EBeTMr{T zo52@vI#nBZ>fj-{8=PaVsNJN!(N{+dwLy(C$l=1!Lv>SDgu~*pguf6G@E1~@J5oX? zwJdjCl(Hg;F&j-9*krAfQw7+Hb%FA**F!7QlS>Jn)P^XPU`qAze^LgnEH}HQuw~R> zY8Yh+oN`&4(^8n_B8}V<_~nwV+%j0^5)8-6xaJaMzGN67!MVQ8RzTt^py3k5Ee9ah zAaENt6uO||lJ!jmfN>dH>r!CjG6dBJ9+xm-%Ycwe5VI5@xdb_@fRjrQw<1uvj9FC! z23SVLR#vkWg|DHhf6Fv?RWP&qm@X}KHDI#_a8uhJDe-{z^eF*$)-lVQGRxWurmEmI z=g!!EY7(bO0z#_=)%;<*v!+lQA*Ng%UAgth=^+yw2Ete}D*M+b_T^%v?v$-LnsQH!+BvW`(d}GKM>ln7)GC+u z!fCR`IWJ?ee`}uZlD_BAo!oiLOL^IJxJZM8EVlj@b`QxeP&lGgdVwzV%Bx4^X3vf7 zGg&X|&U%?3f0{7~FAGVkz7+9%#2KIqdLg0}t&7=IQnZZkHj`FXlfyAjf`mzsW!TLAr(gDRommij25l-9BdKC(`SEgaJ1Ju zKHlpe93IJX0kLuL$_@xe*~#&KZ~y3c{{a3vIX>zgA02lJQ#qNGqhxB`eufd8kz;Qd zcr;5P`#qVxl06;n#$}I6cHjIti8;-mT2RW- z>!HbdC|jo^e64iWLsi=?ySzBkrSfE$e|?oNWU?dQD7mZ5V@%Q#U_d*QQSdgy&%2@X z@?=FO=V8V+g`lAF@lmiX32*wFm@QW&4cl89=CqJ3ap8a(^3ej$akm6@Rgx9l7^2|? zWAY*6{8cA^(gR@3g^mq^@m=iH!0nb_#5p4N%ht}HTXAQMPYcO-rV?@7!NWH^f5RHi zeRSmM{PGu~*3a41_x^Z$=XoawLB+ppq zu*rAF3LcLdtS8#xoZ8`=oeweZe|bF`Dckq$C)M~Rl5|f!e5pi0WnDpQuVHq8VmpsP z?51U+mU%x{kNaQu!9vehs2y^#5v{VUJXCpWbC~_e#$~E-VG)I7*W20N_f?s5=Ua+kv8JD)WJRTc;CKk*?X=S!PUze|F#xGgI0T z>JtXuvC&)0Tp9N3oh|9bv#Ci_Zkb->+>uDAKZUkeWyYj*@XF1a=3;j)Ca`O;$L_x} zhHb0EcrpqQUrKQS3u}xXEuMpFNJxk<7PY1-0HU$*=~!Cd%XFb;$Nc8Zeg`kd6zZGX zHCj<kn^wEMs z5O{4lWzT$P2!0aqw>^0p-l8l+p9(Xa(u0oNz&{PdDpqVepeq`>n>E{4F8wQWeZaR@KJ^xlmyTracoEge?CAyAa~@tt-WibV!6PO-2Avg}eX8W$9e&b% z#umNY17kvFRcseVe@v^LAE(wWOpM^Cj~xe&RXu+f8yQ@hrw<=HKmQ0`LK7>PJ&hf> z0rkf{xM5C4;7mOB{2wg;{${&>c-Xc0UpxN?o6| z{rC)v|M{1{vNmtu%hew%TjbV>%}Roqip%)cr|&;LoBmvtf5R^HQMh0|7d(5;)J$2; z)*L9715>Et3Hj;+8+P<|UN9j#SD#%%xR-y|OE}%H9l_tfkv9oD&c)~F2Zic!(h#7k=%!E2^kNn8`r@v_xr^Qz zXo=IR_`%L{Vg403G}1ruUDnx=?6TydtXmX(xfMOR4L6_R<}=)U3j9}zS(qK4yUE;q zCyjISrNiy@={`;tz|EIghvDWk+B9W7XNRdb*Z9g5O-&`64ly1yCig zU<(P_$PSdU@ws>MB9NI2Hfwa#%*wO*qfpw2&;m~G$*UXQzFK+vR+4EilS!|Lle}+1ZgfxbsPG;7G%uqJ-ej?4k@go%qL)(=|sVUgnd(V7-83LN+qTo# zwr$(ClLk%yeBb#m&bc~k&6=5a&E;I|{a`;E8dgLd{|7G9bqaW4u5|Ab#7KhP`!i{) z^T!ruqPBey1cQ2x^zB`UafYrF!lP|7U}Cvyxp?iGF7ek)^mQwJ6E%B#d3SkzA2c%; zi2Qz9y`I$+>SKY^a$`uri(jzp7GlR3lz6|lG)aowQCMJ#7OwaDg zWJCAyq#m6Y3?HI|(_+Sr!hD)aCz|=)8crZ`>9xeY!38u9L$RUvqkDu?$WPrKNEY_X z#LH(jZfr&?Kd(%Zq9M|-Bt~yClM326k1P^;t|W@b3= zpA3}LUXE{Kb$dXHZKW!O^hR^$JJ+;`$ckmV=l}i8vB@e!Xz!?Zbn1jGE40ThpN!5t z3>OZD23G&M{tutR&xB7xlfc+q@eTTXG+VeY6U+Dn;ZMTSmmp^swcZr?I^bsRDhsdT z{E6vZDN)Hv!9JYlaXHgxo5^h=b8Ilg;FYSI-a;N7#{e}Pb0_HHn~w&!fuf62Pn9@R zPA&<~kG1`}eNav&poHPRrx_QqzFZ`#)#F1?OXHAb+Wc2bp=XNi*hGE=5`L~&d zEm5i5?ucC3St41Ir&-c+B*G5S{NG?Er?k9Mic{>=(A6T-iJyCa%BG)Vf=v9D_Zw6}DY;Q&!g3V)ybFn(iS1?FcX| z=Sw)z*nMIHSBQbx+>i%k?ugpgqslT9h6Nu|6dMY#-z&NLLcFY^8xYmLiGMeYi8Ad^ z#HysgsuLF)M|?RU$R0Vw!y;F49kOjNHV2Fw+leDx5UzDYmn;J3F^EW#%@ z$=K13II$tJ;>h3?XV)(#(y_O@Wb@UF{G{P%vjMYm`CwM2P3Ak_G{KW^q&kHMAicWD z&XwHO4l%}TJRL(6I0GKEb))hw8Z0WlMIliT8`d3Pa>kcQj7a%|OJW^rGWI}^(FB@@ zMTn9X0gnE|`1cWs9bP-Rrl>`I!VF1mT@4gpl)Gu1|J}U%))-aWjf2oAcxEp|`ZGVCpEF$J*kT5{; z7d*)nC3GskWZ@4Y>)F#`h88@R__ohuJc5wLK|3Rs(eo@FHKZVJIo*`qYLS_RLzAow z95gm(;j~5SzPjL)pwC+tuFzzQ+wUAMSPY}5LvS%>J1dFg#AvEtjUMGbgQcR@wi&FvO5BTTwpYBZSuoy^j4F9`;;qmJ&rc` zf!yX^;GYVAVSHe@L6}*#M9>I(0X%*-;CJ~f`pzXyLN*0iAH@{WGrfjYEt99({Usk+ zafTtIYxAf&;KV!p@tI7Wg=S;Pzw+RDeQlhhHah0N|tBvnZPh^KfO6g>VL;kEX zV&g_^9;qhQrunr_AymwM7vNw*&%{(Vq+Es@(kfKB&p6~i#1^S*UZXRnTrMC7n9!^< z0;d!z$;gxQH7Z=eu_M@yo*BUvLkPzes<7Qkr3N)UwO4ko44!{HMC)+x(qHl1@VYYx z?(=t&OTxg-D0q8@Xi2~i1_al80<+FUDaa&j&!8DUjG4fNPI6G;>=lFZBwBv+sER*AAJ3r)2?R;&_O)Zy6uh=%IvXB{Ra${N8? zME8GM@}F_v_F-0v5@UejQ@6WBF+5#*F<*)KcN&lz35r!FB%hHnA3O;ZMU>FNTo%Dt z=Cy)`>vfACfmFGO&4;5xA}8?B>%XAHOXqm|)MW5dsCy@Vi?Skh%t;`=nuX(!03$2F zVbF^m02gHK>d3(0S`{ee2DcU%p*E{%YhBo4QmDt#w`lbmMT3Q}JHqdvE<#n>AeM0c zfr&7xg9FvnIHJWR+%yf8HY&ec{SHxCnu4u)nZpN~`oxkeu7hFoQbsgxSj%gb%p&RA zwYoZU+0?5uOIwf6Ez{nVwsmASTTa`rm^iryVp4umo=-6iJ?LgP=w4+t?^vJxNv%b- zF9Ne_A!Lh&7N$;hYO02JpR84dEAfP`WLk=FeD41JM zMW;7d+FqS(cH6Y<(NY|iQ3f<)9fGi#9t(d~*n`x!WFw_wHm8WmzegF4p zw>TLCX*%1~iHintyvSEzaP#Az+Sy|M8nRS+d1JAHDpB#G1azMid%P738Itd>cvcz!CH%aFL@bQAZ<|DiTrE5fZ1HRIRL7 z3B>})Br_I+K=2o?xwM+F@G>JX^uGxjxzq-r$!Z;)>B!c=cz<1SDzpk#{go6*xgXl; z6#Q8@F7S8XusRHd)*`by0xJonBuT<_E>LXsua-nVF}TuCbm~hXmEbucEDXXJjP=@Y zp5ugwut*i8Fm+*bx`qceg#}U-WeLJ+7Tnp#G?6Mv1kR$||Kav{HCSgOsf}Cc1U2){=P zi0bWBO=xggwGsN!oq4Z5gn#k3G~6E}d)r?qx1<^`xes5HoE3JOrS)YX;uo3-IPrNb zmHAB}Uka^E%oj=ND3yyQe&;Y(D;;dL5Nk;z4F{x!LNetdCQ$aa|Je2hnWoBm4NazS zoS}a`FV|FlWsotXKSq$v(-=`lhCI+n)tjE4oQ=^J4Z}sQC8wc9k`EbWD$`;lL|L0_ z!J$&Oqcp@G>A&AwKq#LqcRBYl?H*H6I1@{zS$Mi9P`3;|hV^gt<+#GT27#_Q|A97m z1hl<*AqP;+ehCHqG6ON`Os0e^E|* zM&P07e>4y6c&F(2J8<#$FTp7AFFRwE2#5{jH5bf4&+(wl4z;W+lAYUVm^R>W%S|^& z#x&dM^5;6!?&fe~#H8MqQj#{<8E7=KG}VY%)GTF}Ssz}6xz$bh5nn>sX@rez3XR5c zpB$`-wswPkhB;tDMU&dhWLl;=y^+=tkRrd6hM__N7{3|f@wiPfb0$=B&o$Hy0>Z?p zvfOnFA3_?5KWg!|$>oZ<0q&jMWQFSq%B#dQ5UHkggB7x5sAr8`9E{}t)XduN+kagW z47p^@90pr{0FKpV+GQ-CK?35D?5+zK>UN18buuWTKw<~eSMjlh{5qPb$;ZH%WYOKik1r{IOQD1y#YpT> zoO79=pC+|K``(tjXLl+dlgYp71=sP-6rb)q06649j3n%(;! zC>%KZaFXTLOG;Hwn`ORwV(@N&uC@h`UN zr$OXj?$ocGB~vL{K|mo5HQn$IQSO$|Avi)?o~HBwfSCV0&ur zXsbloG03j5j(9&ql!{ElF(%6CtT#o3Ev|_&Lno}*iD6{tqGsSkT zuM|Zz(0Y#53MCl^p0dqA#v^o7A%CuDgX4;tk%hqb*9tWzzzdJra$zHQq)dPbJsa0z z!f@fN=FDdBtx6ONQo~_E^nN*LXmKy#Ds9gdV+9Bp|=dh%Ia@%lw+Z^N2UveI)V)!sm$Z`YjyQ-aIRnA5!^f>0tm4tj*Ya>`^k7nc}IsHJuQGsC-4o( z{z32*6B~otPyPbn?O=oPA9miA2K=Fs&&rv!7nmO{Fm+^UrpVp%5HnNm`{cX0%_ewx zxV>0xzo#-sX1YWR+9z;tpJ)08leXYvqCN_2;>?P(%eX=u`MuauWC2 ziIFl|A)>VMTYfDH4}lfwR%#@ocJPpDp0JY6??9z&!lIO6NRpJca?tXyl-t=l(3dJ+FdGjbQfS5&@sYpsFl1O#bEM z3QfuWuVE*gF9G7qxU`!l&X3RuXN>`FbAls1?U?3Ivc_qtoV;s!crSZN>cqm zD!SqujR$)7!`}ceVH0N&D_LZCu!(KQT6*()(~z(g_#6NWVipAB2Ki_>^C{Z&YWz7#$o@$~!qnDup? z1}v=U6f!PN?E=l0Bf$pne`1x5YOz;0FsWJRTw!#Si1c$ygOY2#iMR1u^X`MEFSdqu zop2(K5sPj4^C%>t|G~zl2YswB-|Mu9+0g~M{*y-Eh;996V*Rg${$^CsVrs(;+GABN zn~fqHOhmXLye!VHBPd^TQ*V;HzqJ_uM=62IC(_an4%)vW2k_%;gxwlm2-n1L&;8j7 z@sS>GDDj4Ria%3f!v_&J97ad>;+$=$$8e$j5*Ty%++_^53aIrObZ_d zlF&O>+}n6u-8yH8OVNTp!pmu~Xp)2!!_y11&!B^2+LVa7XXQV!Z*GssDRun&&|C*1 z;K|Mf#M84wfuLC~;1`-R{mCI+1f%!;lMS5yu5pP~nh`C88?5lShLwpVO+s9sD9h^C zu5{q?j!RJGaNc>mY|6;-vrQP&~x;+ddjHUBI3M}AoY`(f5ea1*Mxr`^KCPCI)hvMIDl zfrFN<5rY?G1e)P#bqBpQ)1a!3^AAi|qy*1~>+{+~T7}A;>@hwNtxSx{>Z{)okV+sm zsd>Iqw~Mp^hQg5zX2_sTR-fk%YqWwt==3rnMwLSj%s`Bi4?8pmPpbu)3jZH?F%hop zJ83Dc9z#$9`V%2u;b|GTVM8>BpU$Fgu+E;d3i3^kp`}4?K`V5E-8rTiSUSi3^|xW< zd)~BJ8(iH#;r5Ao<6Rq8oPvcxp9os~&q-|m+&vQ5xJpC_si;Ob_|UWoIbE=Q5CuuH zF!9^G6&~d9yUGZDRc#)Jb}Fwk`(JO)G;esrYRKan+1EISUbo)?;RwT);6x$Ulf^wf zF7q_Sw$ojnTr17`N_XF^&mUmNwA>uD>>P|dm$9`G-ihzIz$*=G$miz)iyI=mrLpsR zJLf;4PZv(ML36-|{cjs{6~DXLzHe$@!-N50JX9ltfcMtLGhDre8EK<*;v$Slu< z0vPzd&)7YaDrPTG?#x@SFl}-VDQnG2hhRDdQ4bDMuuQGls#G2gvgM5OcTFXoNbAAR zWKJUM*>H?F4rD4YkxU4zJ(Lo5(^H*WK{GFlR%DYNWUpsRi`sN8F_J8-6o^n%95v0S zBIj4X!?m^LeCO} zNxobX)b`wNINU_)>A$&AOFa%d8@KA_qrX@g=D^6C!K&j^I*Xp;k{YgtR94*~&u%mG z=RKb#zNVc9y>?V@n>pJ?4>NrW`PrXF1P2svgtS2B3I;QY7NVQM7U%S!Q#j~1!#;_p z?VC)bFk|6JDX8mbQ4bG+6+8@aLniz1b8O#*WS3lvvep;Ye^7PMBs*wm zB~2uZyGe=Fol*)_6~>dJ8A_o$nLdSH$qSZzAiWZI-O&o|X_9tgy(+h`IvFNe;6TZIB z!HEZdw?F6ZK0!WQoqQH~__?pq%$SHz$8ZrBHpd44qFm6VBk9ycK95bU<^VpBHnL{v zeZB&bj;YEQcW5?eD&Snw@n7N@X$OgXzQ>Rf_c*hloz3=`kgX?$>&g?%7zLDSg8Xm% z<+{cd+SfyWNq$Z1dr9Gjmt5zUXO;$74&phJFZC?Nf_bf#yzKCtJbCjr$$$CzDG=9B z2`iTFBonvS4Lznj&wocZ4A4gOxP-nnmj?H8Pf4_MfPMvab`Hu2@^6#;Ct=1v-%D<2 zK(uX(0%?X9ZK!OD|1UkrKRBICOuA$($p313BGtO7NdR8ox`7EJ$Mx=Z=c^TN4p=N~ zMkPC*;6Jzb_7#+DR$mt;=gAvGX#I2PS9a(}&aoSE2&r;xkmZ3|0?4L=W2;Gb3dwT! z9mVvB>Q_D?4U%daf+5@uZWfVLCd9;Xx@HarS|@ub47t9twG#Hq?en^^myC$FY|}mX zR!?&@UdtAAuhvLcRBB(#G0`*1Y_9oqPd|;#y{fAvOn35L+ZK#!T+wEWJqXK-pvy;l zc(TnP{Bms{uESNGhn@^!M>?6*U&vS{~_+-r*fDsWl!l> za~-o)8)Ynnw4h|3SRABYXp@ZT)R4rnqHtGLJW49-C1Swyd}U=`?=#Z`%dK{|B8|ZT z4(LFUVM6LI7C%113n?zLuev0`#^<8LkJ1qQveD}^&+5o617)5NLu zm4=F=_?pTm?AR{mNykXu0S}HQx_lHm)09aRX*14^gAF{87c!4;Z50j;sF{7Q5Fzf= zXys~oN`_1uge9DYz={$Lk+l=usFcU&ZZDIoQrMm;(XWPc@EJw?a#TKmk`bkCxRrIi zFS=mblh~vR7{k|&a!(=;P$YUiySY(cdtKh(kurd@G5v|ag-`F0R(X>gpFs!+qybj2K_qz_sgP1Pz1;Q%uC(kS89yY5ZJ! zvxZ8u(25p_*kRsQa>K3~3A}C~^wXqW0QqA$M5(~=j4BCn>kb-Ks^aWB9 zD*gjfddsiBFv^7_4^grk3iZ^WGFd$s)vK~4dGfrwlTw1PfT2n_sbaJ_iIU9QV$!vq zG$5g$Kz3BlDceqbi$W%iPrdQOIvrN5e+dzTQD|pW&lDn|z=A^9evnCt=C18GLmZ>Z z#u3z_g^8d?^OSy%hllkct9~!HKJkj3a%7j9+}7`)*)1zpDrxARH!paCY@aUp@Vw;I z79#BN!yQ|Rqy$g5Oq_f&cW7=;7wMxJIv}2-#Uw!asPlsC{vc%{vVvBzjklHTVP`p| zQPot#>afMu3(r!;Q+11(-O!kttZONDWLCnhL*b&Hv#qM#uq<(rUB-fkk{zZgVU3=d zCMLyM`|{FQ5_+&vX`$StNOep+b5!)bTzOA{i~+=!d|WXXQ<+|`e)E8w6Dr7A9Uz;A zqaqe+&oYNuwB4(Ky19ts=WPtkuW}NsSwE)ZnpSopRN$Fc9&;>7-l~4>bTeI1c5V5_ zCYPO|3nIl05+~y8z7L7G+iIN6!@_xs==-h5Z}uz(LEGUwCHKdSZ5ImEr)mT8SZS}! zat*uL-|}E+Ri?Alu~*d_T4_CIE}&=p@Ppfe|3p1ws8f_XI8f~HW4vdXp!S z@CggOagaY^7%W7ayb?p|o+kQnyT=##&J9Hys_yrABYbUS^a4TNfC(1`56oO9=U(qe z#GGXf>eX_k2fUupQuV1vB(ISEVTSIO38)bx|HEBM*QdTstVfi-B9v^R_l4DDPT8c7 zT`dwkmog_O(x*z|+mLL;nQQ(~mJ_9?x_#|FzgWpwq283T38hMRV+^|(t_wqqreza1 z(obTwL0O9}lFg5+sHknyVoIC5Xm}8nIeiNe1p7*1ep|0ODJ=YkA(7-$p?{AeMs_w9 zR=Hk-LvQM2A4dka%b1@CjAPMTdQpA%lR|8?CtM59G;yVqQcL~ef7cN0MZTWfc0!R$ z9jnOwGN@!&o1(yi)}1&sE&-YppNKet1sX!1NHxI#6mmIs>v6X@6Ch+6;6?Kuad-K` zz(;Pq&qE2&{qd_t&Q_oGCHFqIV-T1y-T#vjCF7<>90u$e)LnMYJMwpD1Ks}z%gGxR^7r)XBzsPI%6xVpk-S2qQn!hCbu za-t}wC2|2V&}iuuc10g{dLC}E^E_ZnLDKY`&}%uIk8su#bkqD)!#k!-Zi(xKUgZ_& zr1hDR-ef%)!VRiUt=Ubgvf>??PhaxEZdCXI1dVWKJ~ueLQ9#h3NeHx$8%30g%Q}UK zv5(3rMe?-zd|)P=he>*R*p(VYE79~I{vhZ%H*cQ0nzEDK?*e;7!pKmR9xC(=i~ju^ z!+iUzkozD+m}%MCztDVZzWICi)|J8GsKs|J)UAf-6K9|OlfP3BHuMv89_V@eAbQgP z5WhAmJQ!ic(T4zL13xhl9LZlq&<}+Y*y+8uCZy0M!N2vwD?`oN5Qo#Q>tC&14PYVk zGB8pY>GhUb4F`1Oe_6^B@NwD`4K+Z9vl?F1o7oVV%4y zrAvo6P)EcIjGrZZr8vdN-m&IoXS(hHtOKsEnZ4W{*}Dje2S< zEcQM(!v;~PM;}k{6NClsrpD8HU8mXl|bl(-bp;z8&l5|vaaA`5xTGM8oZgwtv2psb1{{4>jd5%w*3 z&3RJqVmLpQy72`hclzb`iJgo1z|`M5zc!tSgj?M=2>!;RPCT6TU}RO# z&v=^>+D4`b4$xSm_S=|IhdEuPj zPp+fz&3v3>C{QS1*5G=MTwrSh*f*+nVbJ2E0U;WbmzK2)#!syLgD6dOE@5}=nOH`3 zF9jl%ZaECiESSkD{|)QZa+T90IzRJ@u%0c5;Vw1kobmTB8K1goCUN zq3cMzeAvD4&Kk7!clE(PurA4Y{f}!th~~w<+@GsNXC}n zAbp$;`$-t<37@mrKkL^ur17ZSC8<=x(}qSTd@H!F`a3+a*>Oz^;XBbI>R6p2H~ zlWD9Fqr$RmR@42u`6^3Ne63|1e+}5bZ;SnlV0o1~WHA!j|;mRkP@wDT{qLSNXkONA-r4&BMc=;7qi>|Z(1#MKLOq~Ao zb#%&}(jrB5%I;1CHZg#w>h+#Hs96Dh(}2L7DSSqc2$N9*ZD z5U^mb*~f9#mfr$SUw)BIyiZ6C#;0-Y;`NSI^feO{YIhH$wwX{-DoqQYlK%i^Lr z)8a*5L0xeXEBrEgkwGOt8Ox!hQr((q=8@{943!#9>Fh2#onGdj4Q$`bd>>wdC&$pS zZ_PNHd^nT2-*kcVxN;Y)P6t=jV-Jr#;S>Qzz1Gs?*tk?m$1#y3S0#?(n5+qWUTfHL z=kHyN#_E4HybOuYYR+Miq)tw~4291K%otp4>Dn^2YQ^b(?RL>hK26JD(wn}D+>u4D zzkMrf`uk^L&Zn=jV>s_G+M zV#R2hwMa$5g z=b$6Vun|#MV>{iie`)@|M!fDIAYEsLL2BY8e=K`X#QiT;BKyDvul zrnVwJH**Z^;+%B+Blb-0ikO%Rc+IZVMJ}mdbO=-g$RuR+U~a%aMicrj?1#LYTTzWL9cs zCpT5ABlD0>lm^e6#?+ekydlBuOQ*BNcxO+I+A|Eq6iO2N!ZS%d+?F7G`yShTVt*26 zzEVrHadwQNxuPH)JS08g=JUpd6eqjs=cluobSvUzbs`qZ9@L(YxD%Hqem zuFv5f`e9I!Zb;hFcyYt%$tMdRTe+Tr4TEi4x^|@r6+HFm9pb7DsGF!Ps?3+|8&#gqI>~74wQC+ zd|&SWmB_Z^<0&_eBBZ`bw{|$e^y(zjowW&gTHGI%etey9tn$Tj2-AJIGU%F##u8<2 zmCDF%yl)f6QVZ7{$n|4{Nxr_3>&y9&rulG1C=VY_D5^7joxR~;5*bQ{S7k3I-9s9n zpgx-^)lF5>JYE544BczHzDKj6;TL7&fw>uo+j>#X>^~;p z1bUHa1oqSdar!+GV}aUVE8W;MapY7431Ne2*+DMUxBZyny*dX-6A_tJUbUO5mju^} z^V6TmMcQ8f21T4JE+nJDJ}$9=;^wzf{Jjd-FpIVUyaeIT@8I(! zzON0qkzw!V;(s7QZnHnU4@9dSG0!Ptd^+|SSA^UvjDGIAn1?@vkF{nbLhBjvM+aP1 zXKC;F|IK-}X>W)4Tf&%{G$rRR5k^BxzI8jqA^fe3+E`{ zyJFuD{TGoy!!S8)U(81f;CwUZMq!d90BezJz!biQZ0Y25(zBuLj+uhBDg4i+(_P^b zixhhM{c5P`UitZlAE-k}V2kQ{ll0p`6JOm;Hga_|y;rD`mj=9>syDw=U(Iw`$C0Xz z2c|FOTUP1IVh|%set7!rb=RAWhr^{Jh`)6^OIhX)eWB{jsFqJUDw9Dm z@0Q25c@-M+?xb8aP*8*-#k-zU8msh%Z?ieMwyG{)s`${$JmGiFoM+~7x|Tm4lE8iR z@5`Bm-D=S6R16UZbW)7SMhT_Ok|F1r!1c>Ae@{g1#|o021UE*)33Nb*>!-qf*FuD1 z@n)y+`9>?P&|7O~tY+7)nQm{_v{k9Y%b4XYSXYmA_us$-c#x(vzXh1e!Yk15h5f4U zGPLE;@A}R=`EjQtf+9?49=@oXZ`VnUGD=Tj0?d&o*cRjt^%DPeew>G|*60}9@&y`C zGSCxi&ggZtbYptBH*`rurL>wSZZH3U`1{#+?VI>-IR)Tv5R;AE!sNx}a&L7%$+lV^ zQLBu-{tLF|MpXfSk98#)J-ID)4)!nY$ig(GFhDorO}Gebf!3O?9kgM(Qq;N$WsaWh zViu-GWHs0fef?Bcaazq#RxNL5w>FGUVAs&@S?HqijaP(O?sO?{+4S@(8RSa4FoQJ3 z7<;HF#uw22tv%2Tw>u?VZ(aVk`yG$m#}MqVcC#<~tb4uB*fp}jw`DpxTJyGj?;tcfKK+`V!vT?)TGXRkT7msfpo@P+3AvOb@hE)`yiTw?C*0F8Xb$@ z^kl+X#cCSx{Oe}es*dn$dg|?qT3EJxWU^HnT4j3m5i;P+5EW!aD}MCo(4k9JC)e$4 z)n4^(3zux{9lT6$%$cp8)^1E$GuVWCH9#tjaGmD?L$+aq2Doj2Y%%fDD;s)5ARv$E zHBq<%C#J*TCOhTX2e2m=U6t$Vip$X%NN+>yk*cY(r2-{;%)W$_}*a zKEZ=+Y`ylgF$1?797kzNRS^t6(JI5!fRYV1B!&rMWgd++Dg!sA##k~cgT_#S9>9m0 z=84wORMFU9*d*5A+z4;qQky-lw;WF868YUWY?5IHW4DXOs*-^#RQ!5T%%4c^J&a^o z&1W7JVcXozn_;%49q&3*YmtKYTG6Lxrojqd=G^yeB1<`Gq9S32t@YP*RKcS9gV=g()F_Yk4 zli!f^kEx6y)lR?6E_vP8q6h6W)aE*9>G4YqDj3uHX^xF57dxvItqRwz0Tgl2>3xOd zR152B$}jxPLZGwp5^6Qe%uz2|eU!axA3W|mmpj3FvD_F=BGf@OmJ&y4ZM;Lv+^pcq zS(kGCA-Oy#p~WBVXhh!P@Qp5ch?Dfh8YXZP4GyJ5b`aI~|uaGlK znT4Gz3v5H1%cXnB`$o>;9oXev*J|(Yc%=~h4r3*Z35J5d8mahAe<9H-~ z&8xwOUQ#6^f}l~SpMZ_#@D0lC7Hjpk$Pn;eY1CgF6KxTK*mS9a@onY6pz zCJv{Y%@kK7o!XQqponr)xV@noqE1nU4+^m34$q-o(L%nrb2_DR6F)(W0f8FWB6>^e zO672OWbbMy!{s_UB5haZBHp#My+@?5D?E=t{2{C^!vwx-uZZ0DH9@!d3-8DEZdLZ( za*04o!45-jRqetcw(Oy`_swDTNp=|@N!j;YvFsE=`}ZRTz})HLzetaCXBJ$~lqYuD z_QX43s;c(8r{>rpGpa~YUlbN?&G+Y{VnoXk8x8c5O$9j8*1ysg#X7t0f*ft)Dre#EZ3uvBh z{k(miihR~uVmb@4Z7ErjBY9+1&QGkP{?K=BG6QaELA^ug1LPqv5paVQ)QNV|C{9RIj;>Fr~px*x9_126i!=>21X8~m=a zE}`MqtBjN`I@`}&Zk!~Qf^=J3Ec2~e<`bRR!C!IO!MJW>`y z+c#;AD1pZKiA8m3_q+RH$hBJvfA5gUr&Q_=0ZUlBpYianBR@-9 zmw$FA`lj^=!jWNAwq0C_*xEy{MD)S&+RU(vQ z=U)i{{(VXA1He-c`+6xi`tVUz%uy#=t|?rPFi{<3RV{NgW!ic_{9xmoK{*5_zHh!c z;A&DX3981vug6@Db=EJUY-~P`hdSCG;23OpiJfrw$FEi6uslSx&u82T<~R~9#^s{z zWB^qq99?1<=HC%h7I}-Fn#e%fvoX5qCe-;m%k~RnCLkL~ki%!}dO37KnV&mYlWXMa zF8q{WMTX?f9`k0CT6B$4UreE2z~a=;2A|8_P!Mu-Q9e}S&*oigjxjmT^MbEVL9@;a z&Psu02%E+O^B3I0!kB_=7kdT;s#pANZ^>}4oM zzw-Oz6`=JPrJwY)|AYQO#6f_U4?nPUFcfPH9d*s!pX$Yx$zU-(-l6+!;xrP4h{e$=-XUWojSe)(p*%iB6zw&ZbZW?Q$H^gFJ$ z+9IJUnvML{d-#zzqwF2eDyYPnU}L1%uDd1|6yRNn8@^|HXW~T}$>#Li_+|_nIsJa; z(jgWd$yMsn?`bKUPh)rfn>6exvWGtI-5kkLzomeQWDR|K`Pa_2yq~&%d3s^a1!Z>l0*`-brNIg6-|kZQnO& zhP3QNkdW}M2J#JTyhY9wvIm4{h%Z0%@B6XVlL7uLIc@(T8HWi|wW=di3{1I$s5YAK zsPGRBbA>$qb>A*jp{WX-{+Ll2*TcFF_yXYQD#b0aQxBcxh(@ZBEcaI{;f4B4zn*0| zGat?&i|=20P;Uvf)Hi!UMM2n|L<2XcMh;4P{&iV@&B|MYe*YHXbmQn>uxuI$*2aA# zh_9FB90iBTT4Y9Y9!Rfqdw$RxiFqv-fKAWH`n4~xn65qYeh;G+G3RbCA3LV3_8E9p z(GXF@AlU9O5PsVYGl!bSjir}7lbuRkl}ThZwh#<6+x!pV9CDzzhGEcuo?t-#5w)=2 zL~j3@Wc=`5UsM`7Y2?b>qV3;kUD+#NfL8qa_~px>_g#s|q{wqA_`&WBI?l;Hi%qPv zm;@uZCzK?ch9$=!!DnpNl!EzTKOoL1C8ld5c&`NFf;DCTKq|eRh7p&~bcDaW)_pg! zdb=+|lSSov)odK=h?>`OQJ@___zOLWNLc7=CeH0}?D}u0yK(-C^2pSt!%tA}(#?GRxcS~RDAHv8Rjs&GaH1E(Jt7HC3l6kVtHQ=B(eB~>M zEq7+^8VSnR9svIJm;|Q19=KO$+c%icpeo59$8yB{d%kwpcn!3^Id9+z_I@!=$m6^8Mxl|g_J(dVTbZ;M>K_OaZ}k8dMTD(Ikoma4@#ByU<)Te zcrg{mdp1$Rd+w;IsjT?-ftTt_L%+2r^ipNNBRqAs6Z7?9+g}JiCGr7->y(rYAKruw zA8))GKNKFf!)x{zl=v~yd=Z?1rjql5uWNIU$1>Fn%TJ1aETOlP^+U9EHD(_se(92(wL(Q~;%>i9D3!n9a zlJ~JpsIJ26hX?m%o=ttey=1U7(yaz>tm6I(jg3o|;;>Dk{%6UP@W^z?Bziu z_O@rNF6{ONUV**WzPmB|qTE~+-^gOF%I}~hg4uCN?DW6C!`K+G-+5CM9SCZ+>HoOE zsjW7#br50j6%l9pdt2>%b76A1R(OaP=)t8fpSS_Flj*<@i02Q3l}Xg82X!DExX&@v zu3+47op)#M^ujzFWOwwP6p2!7wUDyU?b||74+YvLoCuhPuY~eny91dbBpUWLw9IIv zbj*Y#5(+))rMi5lHlNlE4=bbW;VI5*j(yNSFkMm%yB{+-^qF_mcluxPjxS^c^(gS4O3ex(};l|$l0hmelNEMl69qUlF@u{?(JwHdAtv<>r7B@4C%gu9K z9!HjtCbiVRG#N~ZTY4|i=67ygdGChiLCf$%C(*XB^Uj>^`i0DO z`wbx)pOOs(zk_|+^X>%F!yAfrem#8UNOPZp_6r1WwR_A6y+C*c%?8tUdVQx+I2=dP z6}axle`l)fHh?L9W{2?-QOOP$87iJG3rx;X&L>2}R!vjArx<6j#%HjXkkhIsAG%K| zIt}gvlqo&}7-E$#$wr$lc!fk}!5r+)`Bwd14>(a_n@u=u*3q|Nvj^-UCt}a>E<)1W zJ<3KHq77S+b*~>LJ`}=IaJCpva~1+XtW%@}IZ`T<{MOz)?&9=aDBSsf%>MDqAVQKq z zI(0X`J$4QrJcWKZ>4CL^S>wtKU4wrBA*1>lN(_*<`3mS#U|CJS1F%Q|JffTAhzY;c zr%2E&b_8)6j6QgBJ-9|5sCfy@{k1n5ESb-1sEYyXizBf$cl0{DZo6drHldq5*nOm% zqVN&gCcD#H)M&X`v{O|+1cBX#&@=NY+vgOX@?tnIBPxD$&F5PZLX3x>&xriMYASE3 z{y!mt83|C#Dy5wq@NJSgfc*zNAT(kBKCy(hg|-OGOG&Aq-cRD!bJBbp{loAIE=IBa4i*b-5=7w2IjvwJFBoI=>AtX#L38tA*~VCtBBY~_-!qsWVwx7|S`Pulzu zP;VX1!*{%xw`3XFG0q#rXCafM1pmn+Snkt>0HlW}gYj3aVA$#qkmH?)UPPo?!(OGq zA(1uaYs47HNkMOTufY%?=YCj=7|i$Zb+Jn0LniV%TuixTY<>KCp}y>Gftvm96HIIN z<~rJ5q-KR=w~zl3C-ijA@^Pr8OghAH$q6dKNxJh--=~nuEPC|MIaKDlPr>j|Y_b%T z8%pX+4h`eoLj-n`Z3%0{G>kh=>L>S?IWZ8+H2bl8x&1E3Gu{AzLNZjg**x)!>t*z`metxVr~; zhr!+5-CaX?xH|-QhXnWF?yd<5!3pjz+2PyWKQm|M^qJFryXw}hdOg+D>Q`$E_D}VH z@M5cMV2DH7l<)a%>Eh^ulz>4R<_fk`Po%_gUwW3>qbI-@WjKZ943AfA3Hn>gcY#-s zy65!bNfh5?G-*W3>YT!I;i8b-wBOP(O>9Z~=Z=Mhg*p?op%XF^g_x`I#m1C85NEz{ zA&tIrWbOp`q=aUGov%&L#6>Zi?7XzGNWa_ir5Z$ijEkv)oc&52Vk+_}7O)dsn&7{G z#cod~-DcWt5ee@V{h6AnleWXH{=%vF{PWkz7(Vfuq>aTdM{~PN{D%sYwbh3zuEO>b z@CBP|bH=yw?euQtGb}FAf%h6b^-+#ClXeOXn5wG6$ z|F)+gR5evoaYM8Tvrl^Ibv(GJ;kSh&Ghs^R^?(!L?fqv)@^4-BjYJa)MA>*<(G^pn zGG6~1t@JZQ5}qDQi|rz$DeY$D>C=+KQcso9Ln`R;HYz^Q>i3^qL|s77%K{!6Mf8Xg zuNc-Nt@ZYYt)}^l*_s+2>2P0~uixH1u`66&O6?KbNMX^`L(5MCyy{ z#qM|yB+(gqLz&Rg?-$f1eG^Uz`nN|%UvSKj#O)aDKK$b4V}oO@o?zta^xLwe=?OU` z4ITM`n(RTbq1UNVUrGb_|pSzf_Lnm;K+OXw@@S@-lxao;6e89Ky~%k zo088Ln4mO7MVYlb|AIXEG5EAqbgJ-%_4?-_sj}KZp>Omk!>HYUjSlK!G>uFGbCs1p znMk~L8j9n!B5V}8&m8!aJbX+-h)}e#ckG5-rH_QQ+(S%JUw;t-e{DNGd-{6Iq=~fM zk_=#Z$n=Jfe2H$FUd)3wJT5nbhTKTiJ@#JyR zKO(Oj4M*6776rm2LMOQhReUoon<5q>n4+%>=^3CJh*MXnP4N}VwAk0Qn@iQ~=k~^9 zmzmAWLKS3VqdqJF#D#4?l3pX49kl2p>w15vF?LfM#cq2&bJ(u{y{OIIBWA-oCd&`s zNg(XDoC4*wc(bDk!c|XqmMY3$VEhZ~lL)nQN8rR5c_0eSx0rb%MJ*b5t92E~?peF0 z?KF0DR|po7P?tv+MMX?D{LVlp(Xr!3Eof(Te-R)Dt0k9ob#?P_Ars0j>=YQytVi(8C22quSh42N2&oS6|UBv*zKA%68yY zsT;bEpo&LmD8gCU3eTBw)pdX1ORSboEwJYOqu9l%-_yhuE=dtLqcJ5K)Kjm*LI0hB zG}-IvDx$dxh?w?#SkYRTJ%k`(9owYXkldUVm)C0Hi7918AnxR2jlx%e#bx2uKWP`9 zvb8l)r9wOLm-6R|)4iaTED%YZO{VQ`i=tOzT*_`JlcOa0Qo{aOnj4C72v3p|(S;Cw z{3cvhNh0+Q9)_n9+=mT7KK*w4|YfS&v(J;oL`$^mAoLN~$5w|I|2FIndp| zm@j314)lI!TV!#K%7aH^0rxILM9^X(!n$c85N(O8)1DZ~uL;VZ?f)BSNN}2ZG)v5q z_PuTLnZy)g!K%ngIW%Z+atjTW=-SWQz4aovT|9+e3C(WOxM*b_6Kfb6n*;uRthNTn7x9}CmH9P*# zr)uuAkmBT%mBq!KR`+-eolBpykZl3n8Hz6t%C_HpxBxj&L^g=?nuW}B{;VWm=U3GoA!J~D3;Z>}tf|!q zKQ|reH4J+k{gG$wlh~+RLKAJ-Y-2plI^x~;gFB5Q(kq%)kE!lFl|5V0iMA3Hhe@Cc zcIvZr=(x*vHj`$rUK?WQ7Z=MxgV^9hB*O4SwDhQI**aobPA_Rj%_$M{=fZ)*ej^tL zo5a8a9HV|X_)oob_R{${=^tpc2F%c$RPtIq}^=Lf5- zGLQ()+NKM2CF(TZ&-UfKxTr-7^ceI>`5DG(7m(GrI6EKakHU zx?YWlX6C~zDghQf3p~j4tUsA&g->loK)?28Trho)h0EH~L;i_6H+2EYtg2NVK6XWA zB_Jeq8ue`d-_z=%3e3bQNn4j{xxr$`o)+ip&=jsW7&nKICmiz-J z87~}N2!_{1kcH)cuT<8_wr2nSTYp?T)bDogIw3)}|JOU_7ENp?q4%*1;=`iguhG#9 z$;8imdpgSK50ThUkiU-C;NLV0L}5i3Zw7+^zRi2$i%)0|Dv|S%BCilVRyTugx@i7p zGGvLmn18p%MMKu{n^}8Efn!@mlGnwxjvT)*OlLvvBp=Q&;iP5uJ5KoN8pSzyTBx#Pd*#DTJce=q+ow<~(jH$@lnF&QZ&(8z=vKRrdyY}Ufk z9(E%W`ac9wd=*WW#JDmaNcFrMl7{OBS#48Eio;oUX2Lh5{G~Zf0S4rh4C4T(7h2a= zyTMWT%~rnF;=p*3Vgr(YzOw$ElN;?hTE^f5oud>V#QwzKV01guw;Vn1#|u@Z{FFoK z0SSihuy%cHW^fF#{yT$pOctot8JW3-!4zl2w75PseYq{9UHAaaqUE66w{r+JnI6U& z6AyC8VF-Tsg%?5j3Xu0Q5a;;uvM*EHR!tENUj2n1F9gjmn+Uk5(&EvL`<9+kCxE&r zn`tf&=?>~e!_y;gdjlI=`9k+_H&FITE~|%Y_)&#H_nc}O-WCFNOwEcC=U#(FWLW}6 zB0=MfBxoF0@vqoN!)w$EM8sPHtOggI^T)LMggig}w6_G^0KEC+4Z^amlgYrD3FCNx z`p(@^hvMvx+G_D=zA6}ju9G6&Ks)<0kC#e-AocoyJeP&y0HHPOqtpZd5^RpH`!;hEDw3Lb$bwQHVdPV<>5qFRvPFmi^yY64|N6oen+G;2G@D zAGy$A)62Y+mo+o(_+K5}l~WgNjd8d;O5&v4$007*KSwzI2j_f z^Rms~Ye=olN4b@<>jPR$ic8Px{)y2-=V^(BeTA6aLpS6|q$wqLxqU1_J~|5RfE(f_ zuZ46&1)?0p457CPF;;`x;f9PpW9UG3O+z@9nL0tms6yIsis_l@{Hu~XujLx6hOABh zL()tTKYfR@2r|*iZPt%yT!GEBEUD%$tRkSdhvdkHuRSU$WA{`_NMI}~KC-p_HiB}a z0e`zBAsDNw?BsdK-*9N2;lL4w@neSv_$6at+ z>Qw^eJotzy0vG-vF7eN*xWm+naMy`M`y*f}4SWdH4%uT{y7H zoc*wmMmMwSyS24f|8OB+h1BKN)lobdjkFnK3`^D(9m){lO7I;0$uZV><(tuV;NFl_ z_P?7&6*57JNb-j;?|fvFD0Q53Y8ZdtRi--%FL)}Xkx#~vWEwuvmVocE)QRBYK0qdT zPFFy;q0`<>CE!o1bMCxw%UNFXs3QSMQ7J2iTJnP=u-^_rSK5CmM%SE+bYOPQ>$k2C z=zerld}ocI?IF&>29aKE?b$HyNr}&U#6j0=bmk$yB*n!>G+yK`=jN38S9DWxoJ+;! zDOXP(`wNq1)G)Ts`*q-qC+l(3UNNv0Xq!kP*=jRMeWXdD)%3BA-D-gWp*Ccphic<%XfDA_(WEYAI5$+)4bF%`vT^iT@)o0 zqt3W8`mtRU@NU0Y7|H@@30=l8u+z%Plxa1MntMwJsHc329mz1MsVD`dvpI@*N|)&P zEr-58NS#p+_8xbPy+0YzoPVKY%?4IIV+X24qdrL_D->O0KWZ1xm3S7(G)N@gAhD1; zzuc1@@^(ucR6bZRfAI~^0HO+RCpt5Oc9Mm!A7n9*5?+TKqKuZl+EWPS1Or5@#2>@Z zOx~QTMsR2=Yo@nCml^%e43@@Nms-i`0kPZl zknU!#?7qPvvpWAXrDE3ZqS`~WqRXA*4MR0_SBMYj@>gf4lP^gC9w374)7Pz**}28! zwNK1;7$JIY+4FPLwl_mV&k-h>5Zgjk-|405#Clk9=jIDLi*M@(O@*YR4(a5T$+O9C z^`dJP%?THWg|lC2g|iKA)iiI_jF)Bj&yggl2&rYh*-tdZ8i|Sj9X)9aP}}YMw4iGVU6+Ht<{;M++RVgz>@$PpTJrdtROeR&JdR2V zydVjdg@lk*m3Ox6goF$>xBQY0xBN_ngpO}7b`_w)b$AA{I0=nTtld;wz?Zv`C;X-< zOH&cpnIhPZ39vOF3+y&*p0y6pcfuOo8{mwwfU;I5MFd1dKaUWO|1SJCh8`0jM48Wd zLZw2DMn-T<9cbzJmLmhUAetNJKr6>MHp=cXFaxtEsDX4EQt66Fc*Lls`>! zq8g%%1b|qvCG#Nsf?wt=N(v&Qa!V+2Pb|U8w84GE|Kf_(jp6Zuij0atd6VOx?Ca>? z(fZF>tOT$4t<=|5l;cSyyw)4mHx{~3*FsceB{5le**N?G$%#dOe?7(qph%Iioy%Ua zGdn`ShLM4P^DBOtL42)rID0Sq6+2_bV{LL`GLWRIeUscvd!G#c0mi> z0Xuvy#0T*^U2eI&3D+ZTfw05}cB)CLsD|X+No3o}f&)g|kmwsE$fhYV)FS=JL*G}@ zN%WP~RPKhNVccA^3c~dGE36t8+4p{VKt;v?ljuK7K@4^&c#>!&k@6_~p3#y5kiuQ~ zBwUyi7_G_+U0XEdX|p1JW-exf z2&>6@$A(4Z!A2|HR+PyV{U*n(_aVCA(P8^ehPK9ARR!L*#w!da4wBdID!}y-)c#kg zEu7q+S@c5K;ccb#LPYyp*uHm$ApkPTS7H3G+sl?9<5|$|GFGw=4`F}wB1X+X(E&Pe z-TmnKu;4v9W9vKe^AD*7It=bVQr(BoHBh%P@Z_IViG7e!ekv3clxd$evEQ`uX;ELA z5T?4&8>3~^?H=1Gzx8-tRRFjgLW|NBt;xIjjS)%T*Hz3v=1M-cHT8X`8vN5}!`Hs` zJk@l98BhUpP(MuhZ(~QZ|IgoO5-N;m-eas0swo0yPnDw&seI2RoJl9(rE@^D2tb!5 z3Syt|I(7?wBIfI04jXj37mM12ZfAl!{>{5kPRL)q2WTf%tcm zcfN`JYz|RW{ufyj6_v>o+KXTZ&Gh}5{{`doijQhF??gANsn(8C?6^x6$HOQ zehbe+t2<+y-~Wnz>4N~t{#RlAprMW10Om*DKfxcb>&P7a1nXsL$qLiqUE+q%6<{f{ z9>*}=pk9NDWhV!5y*}H7?LeTcBcd=T+A2h^7J%*>)SVwwmmVM$IO#@WEWgjGdy4zf`)Ql5%DF#FmJ6e@l*tBe1Lhten83b$d+k2|m5MoO z6h1}?gB{xVC<{vCHa+kro$8VS*BHM_3WJuo-k6-kk<{l#_R02m-Sfo0hXd(a`=3F4HU5x@tO|<`C~DF zCRrp#v~|d)y^BLm0K?`eCFK)E$FnQL{2-;jy32V6^lvn|9doO>Uki2C2D5qH9n`*I5W{`zhY8xH$3C4&YXzl+ljC2X(Gpg^!;g&jN>fAgAoZGDsXmif9X; zS?T+INV{3@)~?Q&N&6l9@eBO1VK$e7#Kk4PV>Nbky6Prf?1K_04pFky%oSUjQ&>jv z`hQdWewez2JR4Gpm8Sf3ATMS);zWtY5Z1JA5emo>f)>bA;F1;XQ9@-`5@czelYR8N!&QC2k~G6l<6Ba-6IuZ~iA zfpIaaMJDB^@1r^%H?_SO<02jJMu|ADXutjAYRbWn#+f2fN5jTHwzL;I4N0p}Y1y|Q z3BXEsa#wi3JRW$>kFV=~Uo>!i3-N$=xHFw)-Y>M8_hyP#y7F^u@aytT!h$|Uk+l<( z-{E0Uq}$;k;0brj;c`xm9xh)YpRL!tHJ!akZVgJ4d)COeZ7@#aux`tMV4&g9fn&IJ zoVON}AMS==S_w*nE9D}$VgeU=t< zIWp^~(BqRsoJ@KDSo(LRa-9*t>RIVdMTKX^g#-SJAwIobCJky+>BA_S0uuHJo5FS25at*aYvJM)JYJ&s zB|qTROPSI`GFh5AR1<5=Y-E!m$Sy2*6!M!=J#{Fr6`M~8_#fppRgo+QA?TK-e|$M# zNQkLy(9u}`uhY5MRdGPZfM|m#ivn6X98$o8EW9kx#j?+@y>pwc_EY;<6m!H+jbtu zC^m8VOrVkuKFuK-9k2LEqYT~@b-ZF4OKzPbK*=Z1RFS}3Tu}`}oZDWOUJGGG`aQ6q zPL$d;qo&yvPOU|8baX~5b9HoDy?v(jX&e9TBuh_|&Y)`*FPSxpQ=|x9QjwxCQwssT zhFeD8DldS2>r~vMwB$onqzE=B__V4nus_&YcgyGwHHef~8CawK^e|$ZPK8pu9x}~t zG0mQ;!jj(Qm6Tv0@pCkcg?4tjoJ>`;0&g8R+S7hdqUuE3U4u$v_IQ{P;rTB6PM#qw z>zI_3agO581mG27;RLR)VLO?QT@xw+O|2v1A(T zWgbk+r1W-S5o$o}<$#QkZ*70Rd+Y*1zP6pq^=%)ww3PplX;I|uIq~7~0M!)Gga9a% z)ComytUoA}mPZ}zkiSg(6e>U(H}APJe;Vpb#Bv?)OB@hmzbFYNTSpS5Jyoo4AdDna zVH!w$_sm3p9vjY!lH%#v81DBWs4r{s4{BOjn&D&)vvR34zPdwIB5>~@9=RK_jco)% zBK%nArMHx%FO`!|6~y`>1|*{PwZKx3uTSFmS3|Dgr6@wDoK7jE8WU&ar|*~I4boA~ zFUVTG@FwVu)V+0`MYrtKb=q#orcRGoHevq5XVb`JgPYgce>B$^b6&vvfNUa!#Hd``npDiW-t%Gf~!R`cP8u z$n-^~Eh4(B!QTQWN0~+C{A(E2mG&u3A*j~2Y?7e_t=OEJ+Vo}Yg9FoQ1ex_Z2!C(o z`@(*ftrT;t!qJ}K^@n|i#^!;*?z!$_SBMlQyt1=PY=93bHM)L3GRnEaic8dkTb(5C zXe#>iEX>DbA@1mfguU9 zO4y3c4S?6lT@;}wSjsVH){C)woDqc9q5wY2UyJI=M<0R)4=3P=B*2xt)FGLy!s`Z8 z%NoHqwsJBKr)z?u7DC?2nWo<;|4}%d5MsCo@`Dm#rfetyFX+YM7e+i0rE(-X?;8^z z!WN^D03*9|l#{olVs^MK1~)qWi1OYfL<~m*@D(~HTiaYRsJOap28k!A81e&Z;hM6T znqJWoBK-)+M+iNxLi02FT}~z9fMaAvQcH(> zOK3-=%624QbL7Gy@w!_(W8C!N;oTITaYK|STQQI(Ivgl24%(dH8(dT-7xX-YJt;^C zs6?Wi7^+31wAT*@UuIXG&d;;-VpY|-$j?mEeZ(_hDcaBadL8MYZTO%KXT~KhZRR|j zDq-}w0mMc|%9FAeB~tuwt63 zCsGU3Bx`LM(?lt@n_@`EYjp^TC#p_70Cjs^c}PdEND~w=d9FXX*%uieb!vu4tlPPy z&vo>3vrk5f?;^QB__#kn zV8=Bi>77|kUkMt`*!{nT`?KFpMB~Nh|7>cWNnBfOlukNQBrm3?X7Yi{G3Apy`pbq7 zvwBQ3`w<}7?J(+Q$c2Q|o%6u2WDrF0&c&CMMb>uHLs+EY(k0d3pH`QD2kR>5FCmpH z8q5k@%k@G|ko4cn3nvMmV?9t;rQL7gKK0y|Oq(kOoj+r1e+bGhl4aXUj6vblRGqpu zeXNI6lAEcCIP=d>VOgrYTj!a^)SJKPz3Z%d0BrYM6{Q zMW{)Vm@7F_Xb9j2CXWBAGJt*PvUf@x0# z7Qe5TWI7C8HA8rC)AeJCS|WH7u5EYl?JSI%lRecC>$dd<% zzSqDC3_;zCc>Fr`ey)KEVOf)Tws$p4m#OSfo}vnXjfl|;GrSE|o$N$P<}MA+A}bA+ zg=XJjBN_yf|Cad?^3}>iYYo>bLxZo2N1Yd2tj|W4CXC|3urn33D{PRgl7L3`N|^}i zbNkpxlmQVOUbeC=UIQ7NDulr&j-iW=fbvR^!-4p4PK#ip(Ifeqyx1E(G6w2y%6L<{ z$v3Kn$T|F@WKQhKJ&uurNM$o}GT4C{YPB^rFg*dRe>;Z+YfdZ)fFJqw_Z$^AK zWQmUP(q03Us*_WZW;g1-T82TGO@zr7=Gs)&-23o?qaq&q3DV#`3PPi~ntPem<~j$N zu%WD7; zJ`knirdIbcO!0;5xj!R3UlsFWwQ-?6f3E`0JP_9^n7ysmbht7d;O+?EmkikkM8ZBJ zJnJJqPm##S*VpAUO#UpUC!svU zffclNU>~QrB>2g!;H%GpJM0?D^8@kjI)B&|mrU}Sd~WGqL~=D?8I*!in$3d{=*OSP8x2;95V_dT1Ys}P&y2Xs|aUd>f8ma*iFf{ zWqv~k+EM{v3}pgfCEFt~3heMncuOvMB#xvMQZthmQEv%xNn#!p_OWg}G>;nK?}?V*sf{TzX8sH9myZ4k>wo4>Nuk10>8FGYkZHZ}(OU zM8TRU(@LhsW=G=L$GF$abycP4cX2j{HuM`Jv&k_45|eL$c2M)V_g|fWcv=(cd7?n$ z5$Bh)cGkkKFS(Aa+nnC?WtatO@Kq?=9v)`722htcU`JeUhP(8-#xTLd1WZ_>&i9UJ zUqJt|doGI+dW0;mrmbZPW>=T-vnqY=D0^x*^1x2WzHPuCXihQ%-G(;sBxFu*=@%D+ z_}O5`!+gi1^754E>GqeIJ>%uqM|)H|?{$WuU5Fe($4N)CD{03Nwnx-9;UA2c&YvV+ zu|9fM9>r`)M7EzIDr0DS0cx_2OG2tA+ORQTG~r`lp+_QuitXk|c|8$6VA4~nI?||u z39&4=Snc2|it5RJaj!FC;X5HZFA^56O+v>A!^Ffx4tsphJ8n?HJhPipToU?}Y_4)X zw}-?hU8?(s*-Wc*1l9GQuA3!;_AmB7?MOyLryA`eHCrCP9w~rW8r!R(aWJ2oaCJdx ziTrSzTo(52e>N5W@V(^Zwx;_w0{?vc8vTMK>WXRa(rMHNq{OC#x%h!yslnBI+U^p6 zcPxWs3MQIb$UdL3eEXO~^PLhk8%(FxFtoVh*E>v0V`OoX8Cz2s!IY?9Ra|_p6~T1p zj%Zp3qr=P$wBU}~q3WC*xDAWA50A7{p5+v)_peQXrkgUD?ruLC)dpGY#$2v2bareT z^C+uv$HV^=C_6}CflUp+BEgg$po94wkX2`gK)t*!ond5g(R@X^G;5Zm!VvCDT3^Uy z8)?t#eYeSzhDrTAB-V=>Iz1TR<#SlKdXYF%mr8pGoPE4GucT9cA}S3J*oky`wQbVP znK>TxTSTBfhD&kxl-sV}54P-OOwz>Z6i8ymcjSSgR)P-vh#yQ1B?pso3X?K|R;Ep^ zH>*tlbHHWZtQRJUnfbp(B@ypJjzdC?`v*}Mh9-GVwdIshC23ZhI$9U+|3IdO_s{sK z69oJgOIe3699$F8Z_Ds-9NZmuBR~(Q?)?2BqmZgJzg=}SNjZoWp$=kAnhdZ3(PhAvEJTcz+06zaOS?z!VvSn~j+cQM zP37aXfQ{AI9(e{kntalKjF!8SG-(Eqb`Vo`IK~-{$RV}oHL2rSe8Se6GY;cldiL&s zI+4m`3?y)4awE^>&26mN%~UODyY58w7??rLBg5c7{^W9cVON3nwPWD}XX}Ba6Xx&Z z?=0)m(!s>{U;ag{k8XB3Duxbm$!?Qw7)93gnb1uBq$5?zoAOV&Q{zIAB~#l4BFqUb zPwkT2#bhOl_RY5I85Q4wR%FH}!)3X47si+%?>v;AwLW&|Ue$K#)R z7_E1t(d|*Si1*ZnG1Z6lE4O(u;^7KEE%G9}gl8qm@5Q1jF7bb2-@pCN^SyjL`%LYhGFS{4Gx*+mT4-aI>b{6`iorgWCm%6p=TwR%)s8-gzEg z^}wxe8<{&}g45WVPUT&9rA4ws;?Ba8opjng#_D63N1D_^}$ljg7Tw@X|aSd zG!WKiRW0p`4iNi%=%xvnraTaA<0dk_R@1r`CdCs!CRs=QSwHIZU0x_$>6A*R&Vj`5 zp+BM&m2XC)5`OpKH~G!xXbURo$jWAH-%O?>$K%df7*^=A>YSf24sbrVGI3G20Fh? z_mIp+NX6*uRv&vaN4w&yAIQvf{yt!{@9yJ>XIkgC5CncRlKR(r`>fghFgzt$ci72w znsNhqM;WaC-B%dx!}zf^e_qA{A4-j4pHHG(-6#phvS~1+!A$aGj!WbqB$}`9ZYHuFtHM^3(d(|U{81qh%J&U+8Ysb5)L&oq7=GY(HPQy*r7uUGDVXIzb6P#?% zR@|P@Y*`k6=PfTwvv3%YOLvbMe-uhv(jl#o~&l^_SY1aKS?M=aN7=^%( zPmSwtbc&rlxscxwMUs!VBZZ!IK74yqk_a$#gGFVj40xGIo6$o?KV1L%>Q@exK(~(B zuG#J^{+)_=;OoBPK!VWwXsfRv)-O;`QXpazB{A+EPL9LLdlMvO5B!(5{`Nt-!H@dT$lOLP1%Si($ZxP4WM9Kx0a` zP7BN#qCum9!I@@ot^&d}AR6LtD-XA3-81$fmXt-6vQg0;qt+uf%~L4%nmkNU*Dzm$ z{#O$XeyS6K*@anp_H@cOhHu|5^&o%ttQVPFa%X#{ zf?OW_2qrH(cjip|nD~Df!@S#vWKhz4-AEpp{<-6eWxpDiAujqMz-aySGD--zk;6H4i*t(F}6xEL5MzJmN!-D+dH!{2l z3Ub82?9uS5@I3weO(trVQM>+gig~h-Xf`Xsu>0Hy|1J)YUKc zH`TNOwFC(*jt3qmk`yg=um{z~rd7{V%~lRrq{NE;ZLUpqkt7pw@P%c5wH#&9xxe@@ zWi(Y#pzR86XDG>Tpps)t!u*II>YYt?snv`_@voY0V=IEOJ)*eWMbiB1z8N@#$Gw9a z$BggF14E@03J&3B)B}KQSn_FDGI$x3aZ9&-U~mJ$;AZ?UxU67sLxo`Y#bET%L&Dx} zZuaOzvqcU{!x#r|hJ}jr#;6M9h3D3?D+BMK#)JRUiL6Oo;j=uzAv<5CZD?4RJyJy1K zv;GxMP-GUEO4&4P-|~gjUbJZ^T@^sp=XA7Z>VOhiO;@0xBlBjz$R9R#$WN zVyjR7cCh-9<6W73dj*3 zeeN=Z)UM#M*QLz6A{5^?hpCEQ(r2WQa`r=O>yk_wu6?ykre;L?N-rPFOnctdUCj4s zs0Fu!(Y&YlWC2#t%DPyW&sZNl@HzA`M&j1b$EOI8LFGKuODaE)C;P7w;q;vXa-T`w zE98@ij&!2?nk-cL{`^ioqrWBq-V%Rid?}tVQY9+CkNERc#WJA8Q&1v!N4#&^OJcPn z#LztSw(4Pm-z|&I9yOSF4|5C?Ypfe%ETdOAN$V;xS1f^xmd?JY8^*oV=N3$3{J}R_ zElU#Q9eX4pVrVCHNj&>J+xZLadC1Dq5oDk^t5ykN7E*8GPu?W}FXC)lg5Z;w-xBGMF~U2rR~?%W%i=*EcBWE&c>fJlI|lyVc35+&SEnq?9NKWYmqqi%fTS_dNGFIh>%U?S|37*poC2~Y6YJ==z zQa-XYZZtENo~583m=5gXq^iH$Tbb_i;SnV$^o@b%bXmO8Hzr3KmrEY^4OY6*_#f1L z_C^iR5Fc%C!y1tLH?PwW@@_!p6^?y|gp+U&cj*~ev&<$s?dQ!r>&QcMW{aOo`cD6A zG5m#`3uG%hwe{QU0ZCfQJh7XESKM}OA4Z!0j0#ibdd^iHhY&0YNCl+Z{jAz2IM}@G$LLR>d@`iRDd;AF zwTt|$GOGjs=X17R^B~L5EnKBes`;Y3k~48M%Yz0>W|1Dy(0OR0U#D>IW>EHYy|>Ap zQDUbg6K7vkNAQYKFuFFM!xp2VlUg-~DzLizw9d9BBzBQNoxFmWGBnDEBY=&OqFU*e zvZiu7t&jw=YG6toD!w%1q@L%K1}hF~N;y!66TmZsV>ZZyiHm13p2 zTUCp%szYUQjtq`bX^fZpun*p1M(=NCo?Rm8#e=3F4YL6=wx*6&#oIq7v5dMMz&)t? zjMK;DwmXqW6P-e73H*nI+#$>%-{7y>S`Sp$*Po{j(A0aSb;JW;X=66eg>-BBx$2jNmN0Ru)36@Sh`)5ev=O*S_-l1~@Uzj-=jp8; z4*~3}wO|t+i}$#K{PO)hZ|PHm>|JW!F3%+6?R(YeHJfyQl`ST#sxp@gWchUq<42|j zz5Cf`wy0)ZupG2Or&VN{HGV!(7t(d^b|u2^OJ$~T-BoAs<-Q64>&knaxIMz{&*hg~ zcyV3meq>iY-d7@EBVs+*@Qj_n=ym>>bDT~d_-;h}H57r}Lffm7+pENvJ5^0G$}j$e zg4kNK#@nllf?nW^g(i^H&i(Hj&EzIDM9(^#?g+lBX^<8j@^uT`B=!LGG~AgFoGb#Y z#M&n-X$0<7U`x^T2>Vby2LXX#O;RkAJvB$E87+OiMsVplKgkX0Xm-5UK66xta7^nG z+%6OoL%)Z?opyyvP5C;A4Tm-ZGVC4OFj&dn2#6xP2QaqeAhD>R`n;gIwW1|t1cz+M zUz1XP-B>~O^-KCf72HAf1@H*Z2nY_4VV2>JFhGcWUhJv7CikacQki~vUE1;rOYB= zTYxP67WIPpXd(CrCOU>`GB1*Pj;@9R1-NG#Ukh+L;w$gqyF;GHi#VfOJL6XJR^SO0mpV4-ZStwCzmofX5e2&%a za=TRYLnsr@_LP;PB8W{F2L+fYB181gh7Sc_fcqZYOzTal*D&z8;zxEOlARc8CpDBM zRAxY23}bHJ{$ECJnDb5bOINn+DdQkWi@L1-S568|SO`dFz!lan1W^wm40t&wrvyfO zkcPR!Bd>eNkA(mGoaJd>m|D?+IK`wWEbH;xyyuB~IS;U$^-T|yj>g2jR56QBoJD%M z`;GP*Q#XGD!tUNWu+kkpPk4r$Fc=@d3lRs~Br3{E*J4BKnn5}*y*R>qs$-=ui4f@* z<{A}NPbz_cgc+DABhELx3#xeyC4+^w|Z=$GqIkOlfGp7(_Z02plM@g2?0e zw#wZXjPWo!6A|y zY=?{t!}4FusFn*d@}580SsK}1(?a#JX1G;EBef1Iz~%cxn|}N@iYL3DvzsBwft0VH zryt5sb|pXrJk8&kOCunK#%%vO|_@ zkcW=B7nBqxF)cZyrWIAm=K8K$$)A*N{yD6c&YmxsHe#Pa^Mx(QxKCq4x2f z=u2VrJB0|>6h-d{W%EgA>mn-!0Nqaza)wQZer(qjbCU(eV(lUYfjh|?6F2;&K(ZSk zEmh7c4n0s(kRZIWR#2I8hXt<6Z-EPfG-h4lwG5ksH0-HO2KKZG864Q72B|FwE6EX* zA+X@fTf(txc-z|M(joCZY6qu(ib5m9sKY@O2J;#`Cll36qGXy1L=s*A1e~UHPJL*+ zo1aUD11r`E5F9|pJ%NzA&Ycp}FVnbDTm}Rw3Vt2g!Z6p%0yK;wx*%hRpbEyrRP(uq z8hqIJe<^GXOO%4>z4)xcKL%Rp+Ex(g{#cI-nQwlk7zfwdMn z3;qTVjI2^8zT0uM$CMk8z(2$8LPO3Ct}#N|Et8rO*b2-H=j>q3HNW#!HTRrn3cL~> zf|5gU`9A`~oqRs|FR|0|OI)Ay{({ce!G7=e^RYMNc*Q9in%2Lbf3JI{^qQ}ovZ~C< zn?|bi#&G#Ye(Urwwg72ZG+x0!JMCDLankPTv0@yqOO{Gb04T2*X>?FUQd}MKR8m|m z-M=^!pnjw*PyM?`u)%lm%x17PhDj4$mR*sYTFs>nW(clE)1V(1@m#1^;L>8UELE~} zYpOI@{w{E-FJ3Z26VP?=xvE2PygzR#X@=!M6W~vBn-d??C9-^>$P6U=R;a-nUVG(u zB&8A65wZ-R{I!6Qn`36WuH+pZ|4Y@&Sr)N^CHr(|59C)ttRqq<)nx5RUFd+EhLA-e zQxvDdFytq2UbEQ6UMO5MA2HRX!a1+0_?Xi>f$wYQG0#qt{7nYV*P)lS>o2pTt(UD7 zt-CIf42g$MzQ+5<!>Dho`yvIP>_i&E^OpaEs-c!Xn*@3bV ziXHN0Css&;FT=Gc1hFGY(_+#)d|>rA7L|laVZlUE(ji#|LlEmdBab0_nnTU8i^oBc zGz>OwsTztTXVPHLWU&K^nEPdWyh0^ zdtSh6r1r;3#sx)yv1J6l25YCwT$F?AHeuQrksGS~HYr<`8dE3)2s<5cK;m>=4C2+gg#AuUXcDCkbAmm(=RH{Go`9z`< zlt#Sm^kbLj{xX?joJ4SAE_F&aY%v^*%&khM);IHB_q?1V^S-@CWa`rp&^5Z^F3aCa zt)_KN+-UGc^1aX{iHpKbw4GGGC4v`6jKxpwKIZK%3nu?)$)jgut4#}DJZx`;zR`EV zow3q4YD^k%LJ{zdNMxJmr=S)a52xDoNm-I`H{H9oLtLbTw*boO{i22G?(XhR0g)1< zLqHIvJEaB5Lw9#c3n&fJEl78FcX!7_CAR5bP-k* z!UfyJi5*cO!03sBHy#M8$g}hufu{wZ37M_@K05{i3}15VWiM^*TXyEd#MNj>coQsL zi++0ZJS+38g$g`+dvBD}0Qcv0hz68BqJ@p+-0Z3gho(_pEu@gcZSMjO`Sk`t5^Cl`xI5>oH z0COjoUC8^*j^iFa)yD7aS<7LJsPs7>7rs_N|8UK;_;t>lknU;s?KrDsr7G5@1NL48ZYWW6Lyur470wFe^$zjMW; z!#ZiBJ3!vtGqmYosxdE5v!6_hx=zyyb{b%R=hTlwm*VQ|t*VweQ{Ak|p8Rl|TqzH` z2VEiR9@S-!7b1HX_ddzWtCf<*z|qV#i&ga-02lHwvP&VvjfcetfTycf-9}^E4OhhpR^xV-=v9>4)DP4&51(V7 z>SBy`RaV4D1XGkaXY`OPePp6eg8u{Oo??^2jtwwTh$}1DtPT`KiGt$ZonQ0yZZ`mG zs;~Sv1do~)g;XPN=DUi463?o@oix1dL9zAf=H?4du6;uR&l8z0f)k1dEAN^M)lJK6Kt z&GeW@RN&PLTkKX=kCa{$MQbj6K}{%ITR+a*-t&ohJj}DPU7ly%h959hk3D_oTf@YA zNqi&cG8&&+!E5{E-O>74l5OR88+dI4GD*>FZQt2eW^+E6-MQ1K1+7Orx;+%Z{e@gx zmL>XM${p25ZnekH0P{2Wjt);jcTchDl%%3B*Xs|J%l-rS_KLR@?OwelkWT$pnUZL@ zy_c;+qOZ4uqR8>@FH;VGlDX%pyD8}xBzEHns709>Woz99RiKzuJp5p z`O0~Yl%vLD@%>x6m)dxsL0jfE-%$LEoW^-M2uIKLE0Slh?gWl3ojPQnV;^bn>=^F^ zT$mF3UNETC%-{^-2KE{0rJ(>6u!OLj=Yiom+>C%i6BdLST|{ahJE=__6DwP0uBmoG z@@Z|EPc~;+WeSG+Wz(E$)nX4j>~iradhWS-*L%UfeaBx``{Z@1>V?ix%l^CyL!Qzb zEhu)xIPL{oP0=2^@u)}`>8woBbJvMS#p-(jVv2~1@ax&Mj=Sy_Gk}B0L3G`->#nrx zZX4r=UWUFGs`8gUT;g-ol+(v`FvF!ypLz;J?=uJ@Jk%l&=#l0HV%Rbp}X#fc(7_VFL11P2wNiM|w1Gbjak5zUI29HXYTy3d{>5ESS z5|%kg144Y-?N#5(0I@x7VsvQx1!p73zr~v>3NP1L>^>JAs<#Y2MIEX5Dk}9i1I%bl+<^Cv^gIx9|zE^YhN&*!MbI0lGz* zmk%o-)b#}5TLryGr?t~}O3cd#*p~cd8+g=`gpujq*itYzX~b56t{v;xAu1^;JNJ8~ z8=h88IzK|T;k)eIY)*o7zcl$FkK)|W4^R|Pp!1(7pkQ&xxL?<#zlLWk04@fdjF9x4 zJ#X(O##QKP&sRL$*nChoaxB!{g46hTf2j!o?~7-f-p zks<1xAr7i2Qc*SLmHphbp-E{nQA@viA(DXJN&}=hEJr@{jg9O09M7c?8Judzc_7#D z*&#;he+{CzJR;Wji3q~DvP^DlLja`kslQbv$0f)j--N{J3SP`A@dEWPf zf>CR>M*82^dOv;b>!->BGhcY?y%kPmHG^fN?16|{4>zPOb%ioaXs!wTYKu?YYN`2$ z??VSa>1~zk=XcS|gv)O7vzBjVmmt^sdNSWa0W`^?;re^lJ1S6`Co>~)^R^lotR}_X zukY{S^);xe@yeXQGXq&&FEtkzeS<)zyX;>NAe948GN40x!N96q2?$DuaM*H*kSQS)q z_-mc{o&1ScMzZIedjBi)D_c|k@4c!OJ z%-gGC95FCE&TuK3}#2lI;f$t0+XNu!sQ!~Lxra3wN*uomXQfWtEaGQ{fPCRb82i{!RJ3oaK0L3%5{+zUMiZB_G;k5wnALOT3}t1 z=yI9P;%E*=#M#0xjaz7FOW9g#mW0B0gf+a3Q%=d9Vqru1*0{le6rT->`=mcRh96_R z^V;2)Dk413F*;*R{FUn23D|WSNLsN({j9;gZ*FQDZOa>eg}f#g4||!uwKd&zyD3&w zY;rVa?QkT$7cj;W)v!{2`#QG!K#j%fooGO@gl3SZW3x0(;x_e4Hp?a?jc&3MwerK= zDN0&!5K&XU6%Ft_3h;!a(anh)=YF3S2@XHf1Sk(k8s#m820S|7R0v2_e8imf&-N63 z>Za9g+q)Pd$wo+ZREoc+di$e!wb$GTlmD9GS9VK^U6JbnC@KrTOX`vzw*8qXsMjw~ zM&-e4%S3lIbVh)h=3yo%lrC>}y_0`55_)8JGUr8J!7_NFN#SLG{OE(AKEUTNMmsy5_O(B z47cph%*LI#U&r()1jju*8eo1auhoCc#`Uf93jnf6!{AxfC1~Q6zlzXN9E$m|m$R1N z2jc>iUS+ho9ny}R3mJGJ78SB324pvq5Bu10w&PtB*IwqhS#YFe$K+_}{T*b;#%VJC zdA}?m45meefz1pS314J+gMpNP2m&^GEiO99Pe_lh4ri(nOAGe@aLdDqfY8A@Klyo?awU^MH>X<tUl<6% z8Tr{ChS815-jAum0Z&#Pz75kB3r_jJjvJMIuIn{u5U4O6JiP&{tF&~mWv>RTi6T&J zUH?efDfJ32VtS6g9ChEA%TXAz@A*56N2Kmh%dWkr3H-7Vkmw4aVlPLxF8+MqHBrx3 z*jKGGF(SOg4~;EA9?A;igt>>QtkAtEX@nujey93JT1b>GR`sI7K@I;Er2F)W0F98; zFS3AIm@uLO+mQB8x62=Cm z46vW@n(fp)d{r0-qUPLOd;s(iw|jI}Rx&=i!vYE`Is z3%04M|KxHT@Rp1UVt{Qbd>U3M%~^R(uuUaj{U?J%6`7-m-I+#`qY0UijiZJj*b<%4 z`2wiV4%ew5;OO1=aF=k^{_Z|@>AB`nOe^DG*8NB7M>QdOBSdlJGiAY*Jta}J>cY8B zYD6x58l_R-6uT&oZhg|=cRc!quU)f z849$uMNWWpq(mo35@v=Z-E^hgzUDS7^aeo*_F>0As@0aJNzWBB$;XB|-%=?-1e1;Qn zlYe#t9QW%BF$Ox;*-rLoXIJ4u=&<*>erj{b?ci4{*kj@ivUe@M9b_MTG_a-KCfI-d zny%L>Q_iKBM-I$VynTML=8}rzeD~mAUydeTieXNf0i?r!@$`|mRPZQPr7K`I(WjVz zEtOkE>l72tXu0bcK<-rs-9}(gftW~4=1ZlD#IdEK(xj-znu*HE7^JJBEN{ZIj<7EN zcx;mr3)RD-$dtokw*&4sE^=}@DLrm)oW5C}U&G}j*R(XfHL>}NQMV53(;vH(?I;sx zqSRbfp!?Z9sOh&w8Sai0K*_{LWd3$QOc0l(&Z2`neZm`fySz=}YBM~NonWkj^OawP zRo&2o`14P&g!%l53-3#aW||9Py+MAWENiT0ZM-HJ$QmuS%0xdA+sqBXN3`I~Rzc|f zLjKvRtYG$s5O(XXq_N988-y4~az)POzcNT_1rbXzPoMOjU8-keqDjexx(=<;R3_hf zP@CzW>;mAm#r2I-R1%w$3o4lL##r@z39{+>^Q8dF1W%wFP8w#YR$;3SULV_^MNL2<@b69?S=-XiA zjtQZ{mZ-&*0Kae;QkB$830lnIPHv|+GSw&09?K?4sDyf9<6z<9YGC@l9T4z*!OzKW zFzW7R+|O%y@0jiS1lFL)35rTLW$22nSU+mflnZ$1R^o*A-QT2&JZV914VUz>wG0BS zx0$$14hqDJY6#2>wqi<)u(o1POv$+kl1exx{3_gt8q5V?4Zv*H(OXR&W=Zk{)|1?^ zMl^qI82^I8;6!G#pTj!DaYDVOQT{k|kY3B;PkuV56d9giSsrWpRB@z#ygg5%{8hM; z;^b=&x2^Xlo1kSSf8^2XGXuN}?YHiiU7zuFPMnzgL!jOu4qm*sR=sYt{Ro%x9#3?@ zLxKH{n^l$m=lzk;bHPLAqDVbg`eJE=a>n8l%5MU5*A3B`l+U3*6RYxK7@W*8Ru7NY z->XG2%F#`|Ng&e_$S-F%qWX>J!Dmj;`;|h$Q<);AW&q0dTsmL z;6ap@G>YOmJu_-vS80RLi}%?nC0`PmuP##7A2tq46q^0Q=DSm~xbHtuAqpJ~Zkc?;d?(hj*TixB!dq z6QpAI|Lp(N?KW!{Fe$e#r41?vSN9gE>|PjFFKg&&3r zV@=@HZRP&$&u3y8)=n);xf5ML#RoKe+#>3w^6M9K`@>RY+UaRr8Tv!lVs@cIsnxC1 z%a3Dh$6re{-ZAYJkfp@Ml(;ntmB|Z${GqY{YWGj{F{O!C7{Ul=+&zZzA(wF_F!`Y^ zl`#Kw$QYpRq2Gn5NkKWn?lxVtt#XX*^jm?Ifag-mARjK^bmp>&cH#qI^*=EJAEWyW zL@%ZopRHg^J{nVV#a|(;e}QOEyrjG8aA;}=#oPWbwP`1 zhKQ1O)vYUijC9bgAaO1kQXE#1Tae(-ek=&#kA>PDh|VoFF`I!Z9rW+_go$$@ZDy;e!i$PTClNhg($ z&t3>d*N(?d{al32OS6W^OEcko{x|3^@dtd$6OOB$L@fGp<_d5JvCB(uHKrrvOb1 zo9?7Tdj(ObHD~QM6S@LP8u2b?S;gQFxoGAJ=-5=E!Y)2c!G3f|Ruoi?8qkorDQKgP z-U@0T3zF|n9iSqUibmXqQ5*~gSI}L$&keS`*V% zmz|RBo>c$=nkYMJtTmjq0GI0C;oo5078OW8z;hS6%Q$JRB-9j%IQF6MTLk(OA1>9;Yq8v454J-LF2;?#Bc?oMWn z-GbkjQO9=~0f`b@l*V%~T0M$fwBMHwIVUYRdg<3GgcCTe1PpZMusr!9k3cP3G~~%z zTv13f@07a@S2IY^#c9r<4$c8mi-WAC!{HWo4+Tz7T8J?mITLWtkWxN9fy()aKaSsG z;of@MG8MbSe$DrMzj#CE{7qDsE}U$#)q_~2$=~)o+WSLJm$nB1DJ;VTRuc+BOHQZg8UFa zVu1w4qo9(PFv0+{gTk-H#ZLqb6VQjmF46s`EqWZG2Z^iy3ar@U^hA4vYSzPn~-JX`>f6~{XpYDoQ%>seV!4t4o;0rUPkcRsFW5OHiU!(dBTD>`94wBnFA*fiS6zK5ue={f`KKK!JyD0!q z1i0TY6ERgNR9d;ml;A@Qe+Z}!N&H2Wo?hg89oOo++y)vq?_PLFY6g6Ijnj}O5gIP9 zn)@ChP`Ii&+MkPq(BFa1lyi zDEJIP0$KjF&yXs`EE)A|38KyYTJT+@m{(^TFM|=w6=yBC>d|3f3T=x&=y3Z|fT9^G z9dyjR^g|V=8?^C;$cKJYS3Z+~b8ee)KT?T}xX5~JKINV6y~Vhjp1no47A%|>aDYS`F$sfaa1AWD*TVf*`pk&rq|j{dp($v&RoV|Cue{|XZxed_7=2d>_|B==Nw zzs|nwb_S!CQ;l8!r^rnJr-r&*6W~929H4WT#qUs3`NreDV~%D#8|HF|;gIzS^(RJe zn3Fm%=)3TlS|-6o45S1U$p%%(68r^mTKQBSyEQ_y!1xxb-;q*Ay>3qO5d=FR*+YG1 z&3Fb*a$RA!rNzPZG}zec_}xP0xMqF_-71}jtiXlpi*%iwPhFDT8=ac&jGAU-PRu3s zU_3IA;NsQ{>w$}k9>D(7A-uN%QA~3(QBcU;pg6@MCs7j636?Ot5leDbL1)@oOg#|^ zZ2fFmOj(`@3e3m7nE8x#l<+JY;9TP&&D~ODAzhuFG>|#E;@H-RLC<3{R$v2-eKG27Q2E!N*@81*Dn`;RLqMlDuRUsyo-%Y@-Z31KXoo)?} zfkRw46u?N|ZUkm&K_%_>_565P0!DJU@GGBpvK-Kee(_O>Ry{SZe|(vSfz+ggkebxj zs0%IEi#O7(0fVoj{^VL%m-WWE4>oqH)(zZj9? zP7UiF@9ulmgRHVsPtx)59|hOl?^;Mf&f0;P4z0YyuEX!Xu<%;C^k8@SFYI3&9|Lb+ zqF(=@yJs9C+&uWF6)r9MG${W;1I3KKz%QFqxp+fD=n{N^^ToH((lA6YIz%C&O8cR& zNlaLPkm60qH>@)Q;WNmPY6PP7GTuAwbM`SO1^Yh`KTMmp|6@zRcu2!o5{zqGwpQ$3 z%+J8Ug3tMiLv`g4K0vpH5Td`_UwUtpXQA(Cq*f()1n}%O)??5pt9Qd=VIwX7&8eU7 zqrv(xu^aEq!~11^_CSFL%rUdpRF z8SeV>SQ~Ujxz!}tS2ay?=RT5Ota)}_76LEqg^kaNR}8B3<=eRDIDeun4inY!CN+!M znrF;dQ-O*~8_t?(SK``2@GP|-xst3yj#9fPbhxTSOgwt8=liZB$mP*($_v=q^f&?! z5)J-kD1f8X5KK|EGcvUwaTid%5SSt5f=ZjO>bCL91YMqIrElnKbIz5616}Y^HP2hL ztzd?yxiSFw8I0I>lmtH~?vlWs5Vg+*)BNq2B~LPuJT!kx0IkIC8#wFMEa^>ML~BP1 zp69YT_3h#XEF8SI7UUtr=@NhPBMh1`c$a~Daq8Yjv(_}3)7anX1&W`0kT_>fp)y}} zYN7_*P~pDeMTKPm$J#0zLLSY$V~y^_{eK`vy7KO|@GJ~TIguZmy|seAk?S^vkEhHK zh_LkYki$*bkiwznkH&e>P=%l+RiloIO6mj)lE$7=Ms(iaa{Y1{{mfwu)&dwMd%(@O zPG@F~9=Ge!Ta!3Ius6`l9|sA5NPRpD_>mk^g0X@_unr_c zRz}JtIUfTQFj>BG)^e(D9m0o5{wG)Q+2szXH*gtioIxhd~9ktOZF72&<8?acJml80kP*Jw>$^)v8J?B{&%9)`=7H zPsm%qA7Y;nj3g6+bRZc3&PN?9t-y7_Fz2W}8U4#R@`B?J4h=9Rg#ijiB*U;N(!vtd z{JOy@$JCz;56n1dS-Ymt>7Tl%0QC4@;+i2P@2fCO0^M}6aGv-^P{5WxC{i{qP=nIQ5Y8fcnaM`;1`Jo)FZ7?!c4gAs7KZ z%>#WK)hgcC7{)rU}X7}X~;_d4Rqu4iqBuGO<}L#SkKHX^)N zQfNxB7xi8p@6a5uC3U(g61yPsX9={Lr#zls`wY~ZZu%HQNHMBp9kWJXFVYk6QT#*pd|&0@~^iNp!G?1_*Lplz8~d#20KOpen{}x zD782!U}3TU{{0dmOD8O2!=|m8A0hz&qKMAlfryRYl`*gaSYwc;W#BlUu<)=#vp?U} zI~IN&{>;$3tbf!~tzjU7A5moaJ069nT7(FnEL!+`t$N4P(MLa49HZgv3eI)g#vk?< zO=i+!`tB_JCQ;C6K{l{u7V-hb_DS5sJV_s5%!zkgge|%z1gQedKhOoF#eFmb0{$9z zm@ygpreuUmD~DuY2^q2q8DbZzMdIy0$k5B?w9bacDDEj~84@?}3n_bi%Sj(V)!hud zI(Is`!&@l!m)AyYkj7bZ=Xdm*o?;L{7 zG2rDb>9LJ29ax*Las55xy5wC9jOw8#VK+PKr_w)LmUVWCsiCIa2Ago+b##d-J}$_t z>%S7sbLgY!&D2gkWLD6Fons}bP*VyAJxtr%31}%?}>&f}#Sx_HCkk@jIk;MUg?7+@$d7-XV zjXO{U<*AdTwXFK(@b59Jueq$jkH;(b*2anYck5#(#~@T_oTk%bR6=`yQs@2qQ;7zV zf*jMUvDaFT#nYluw{-hHeQo{CJ-Ejj|EcwjSH!iGZ(Xl`oRoEbT&*+8YPqsWJD3m+ zd)2o`8zvu%DTfGb%JW)2Mf$r~aEipSTaBAcT)Ugce-FUS7$%Q8>VqahSG;b&ZcLoZ ztlH$SXvwA4R<{`ubl%R5J)&NatesJ-H9!9Ft4idHz)!r{gKgM)TjGk3I<`ug6BHFQ z1MnUqa2{9wBAHkohe94A-y=ii&ADd}j_h|G@yT#!t!JbF{YtqvlZq>?!fzczHs9N8 z)XN~)?2*IRLW+?V^`Hv=dE0;|^dYGk!BLBk!6uB1q-R@)FHVv!SQbND z9%JacyvSxn8FE{T=bsr?NsRD;(mtnoNsNbv&5G#F3T4OMj-E@$qrhGa-uq;&)FKyx z>dt3~g#aDc6`e7kf?+4w*buJkb%hqouA{Dl>O&|CU>zy_-bX)DO-dHY3_|BDZv?nI zT1ZRAiHNs&n-&$axuL%=x2TxLo8-kvYp@7#N4mn=uff|-6;Ay1-cE+_C*JhI&PJU# zaS7z_(KVznls2K0v*8alZ~5{Sug88`)w32Z7!A!qFVZX4_o5M3I&*LP7-(3}*Jd7&cEB zIlhx*N}}7Xtd{S%Xd^t!{)jr6MCH>tiI)BtR~hrPIhnH4Snqwz74?BN^8v3b%a2d` z$~{GR`=nd64XVVGkc*C*pqLaGe&=N@<%OOtx>zLn(>pXa^s_nlA?e9Kv!^_?o^m1I z3px{j_up;SrDBPx!B=;<^7ORv)!0 z4qb3`JXt?BRix*&I7UxmUk>P#F`c>GhU%N6g0FURW65ZQq#S3}94(GNSkVN3J(}bm zHuv1%IjpE(Ow%b8Ikb-(z+mjfur>^SInBGeRN7qv#FZW>#H3c?~U&tCQP zVRVrIfGhNJGBf-TPub=HIEH9kb3D#@Ru96ObG|B>Gd9Bh9XbUU)PgfzlE-4-8amx^ z9(IrT$9ZJK`UC#Z2ZFLj7|I{^W`8v9?lq8xO)+iLrPh9Ca}@KVGwc*M)v9u69-Qi% z4rOwY=IO;f6|_dwhs;Wb*wTs?G@$Dswj?|Q)&XG9pAx7L54f!Tz{KeS7aq_M9fe2THoGC&9==NwO7Gx86u)I->4HhN_z3nl+H3`0;+mEA_ zd>GUZ3s*Y7o61KcWaX%1aJ51wbP{&c89bsQEDj8>JWQqh_&S{ zOS{#)cuyibccqJ<0_+1V>519g7Wlijv1Fv!*u!anK(KYaX#6{c)M@~Gkb5kM#@|3WtAF3)fqJidz7JJl?=y`B#fO>DU;*cY1ceP%iwi|y&+-G> zfc+_(NBsSRqqaR`TOKwRz(!riaASpubONAs{H2bEz8Jrz;iitW<0A$+k>?-Y1Wc4VY zH@?Qj`#NqEH?y>M2?oWuP5M2zF11=--IgiEj1iKPVA3y-aZ)F7BCBeiJ~3m;uKuqL zt}}&>4qA8yfaM9D;0w)9B2*^|-dq6Z7n+o|!k?IfE5bp@&8aC7-83GnUQ7MWkSO>~ ze~hV=dD)zd9gKnxF*npF*32hh6udfX&27n6W2;CXIczl5G5`}wgQka;0cSG&bqxIU zAWW#&7pf=)v-9)0CK=^t_t*Zo{G&$aGYf0aTL5_8$0hrw+2L8!Ak~U1N5_glHKo78=haWiUhAT+U}azl9ft~ObgtTN+nTBHj(o2o~Vu2}N?RqXtfB5Xbr-^|R}vDx8RxT|l(Y7996As;J!l7~E;{`Fu-?-2{}TTb9KflHKs(pNO1Q1#I$TwdQtwQV$prlm$^0_=x168MQzEj_z5ol&O|d zo)x`uZ_1?)$`)wmw%FUtY(^EHl8b@8VwveV{_9WdGOc zAJ~yya`adn8u~7BA$u8&#aLL^O~KO$J)wfU%0UXIwQL@G2nv(e;_J5#!y%Db(BV^i zn;#&HtSyfWqOhfeip59Xsr^B{v`0@#&)@z7{e%bYSWDdn}tSxnEg_=4+3v^-*LY zPv2*YP}W5%WOm@&rrfF?3{@~?pSxwBV;-sRB+r94G5c10`?CJSLYsD4sgDpWbO*sg z@17$h%{WN67Wx?Kg^Fy_Eo(U_hz~8LP{({-LS$|xXBDVMD z{0X125`N*4zUt~2@=h{b7~TyQo36blF)K9*zzXR0X?MD& zZv^^#Eb@51m4T_+vry!lZASP`cgT)ax09V8Q(7luYS1zZN)jctL8`mJ!5tz`+YP>j zvY?mi;jC>*wWumNd$-F5`LJFY3~S|5EwlUT_PWi`-_W7IXR<$J##3-=a;jb7`}Ay* zh8K>UGJ8hc{+Lp5nU|LXdLu|ThpYI$U6`TzM)@wSm*Z7HZT*OdSgi~SF zUH1yINc3RAF=+Tw#Z1EZiNpCS`G^bgC7aY%;`@&po$ zHVO=Aej8Npr=FPMVHoe)ZPgIq2$HqqKh_|?xd^*aRV;w3`goC=7o{*S(%mXT3ofRV zWZi)Dx)ip@~-8UpqQM*FP2XzF*@<^^xRyZ3C6ugpt27Eh)!aUB+8sK%<=hSaP5qbZNO_ zuCTc|!$admzd60BdPMDI%dzJadpV_e@BR5pE_!wg5UX*2i;!3URfd{hDMEEpIeaXu zDeqlOal8Dbd6hNd)(WYaPSgvjCsyNEI~ybTSgJa;S}f^ibbAkhOQNQFDk{gfn?OJ> zvV$b%;^;;Nsk_M^ev*PiU);t-Aqcdz|C0-?qnERenAs9El7}0OoD~hXMsXnop`7e=|`slzDR7;FY|2>U9 zJjG5&%)-}!eG)c6$#!qV1&*&{Kfsqg1*?1Gnzl2yYML zt%o>|eYpkPG~Oa_Q~+3Oc_7_j9oOI;gT52As%PplGh}YF#B=!1cZx&~%aR9<-FuI% z%v=xae$-`KKMpZ9Q{5i_-{{_I-r6Yak})$uoLvO&U)gA0#%P1&cERX5$<4u!FmoGb z8+2wHUDs+@hr0F>oH!CYmu|!O$*x@eGbj0Ig6y~Hqrt#OflFjNuuXZduyVWhCgrG^ zLFzzetRk}mi}*}pmSV{ z0Qq+(%Vje!l}Cj)nG4NoQLoK#{O9hQ) zM^DBV;WP;fDDoQsTW@A4u=xWH1p0Ae1BmHQp@SWDuoO>&oU&|^B2A$8hZ}6ZTjT`LOsg_U zx(jN~M8cVu4TAHMi&uA<^fX*t#f^d&zED+48U=S@gnr+=ssoaGiG|pgJxLK)MpxZ< z?T%7^H~j8cn%k~rL{*8ZurR4aG!iIMJWQZ3_npO$Y)GSV>8|7?j0At39H%J>N7$)w z9Imo>a1Y_`&6oE<6Zl|of(2@VC(xaQmav3$oiaG!F5$mnOdL#z~`*Im33$=oz4mRh!|KF7GusFxE2I9a;ATXlD<*V8k?uh*jhU+LK- z88!p=H@=gD#P-m49i3JE4H&|+zrBO4EMUrX5C=o}U&*jwyz(Ca9wde)YHw+r|?$Nn&Sjn~1PXE17(!~Rn!AJ~!bF?^nw z2s;dqBbNFAKl1ylk-f_iR;zL5y?y2wDT%dTtoE!ap~0!&{(T@0cg53kkXRo2u0^u& zLcWK=w|B-B1w@$+Y~c6klne?+EB}E8eht1qr!4VJs-lLZiPWx;JS1^M?Yg1kC?M_l z5wjsZ*t$yQ=w|uqGO*3(+ZUI^cH0tOZa{U14FSxY-nyVs`jQ)zC2j~&rdW#iY|N+1 z3`cwlb|OVk7{0t^!2qJt>B3GkiaqMxy{~O_1F5jY5(VfmHPv&7CmpOEw{F?julUMd#iVvkp*4l0PnGLuUwH? zuHeZ>DKaS9mAf<>j<(BbbtuVa_twiSoerS&>SKQ8nR($bVf9>fc({4iYLDC1e(@I0 zePG|yGJOqt49wM60mOG1%ZOuX`r@eX_SWpVn7^spQrs41M3MFx|`Pc*`=CCWiSx zh0#nbpt>K|wRq#L&~l!`FopeEJr4&Y@#|>u!PuY>lE|#<@Ih8^g`jGOp@NCuO{c!; z_`Q0r&@Z*>j}jDUK-kO&drf=czOUp zh%MB2T0{=04!sDPg@lvtPyC&q%QU7Ct2iCpSv*t zP&ay-BWZQ;)W`W3iv~w3T>x3yF9eRem`)bUVNXm~CLjnTEkok_;Z(tZj$|~JUBT>U zL6+e(CW{5>2H7x6@VT z^u_T0aT{Ux%@MuPc+O{NV_t>5?=5(-t!>?P=D*tY!ghrWD5C24qo?U9;?9w`J&HCv zkBfq#DjV>+W>^snErlcdLPBu3iLv9cO{0DLLas)1hr4|Fo-HZpuhoF1a~>vDuw-Vc zv^SZ>lIM#a-MCKJdftyqh&M=3$5V>4Cli|(DQE~1VNM<;+SaQ6ruyIRx?N&VIQp>! zw9}FQyLZH7UGm@Rx=W4!hLfoN?{HEcEOzBKLq*m98%~-WeD!aOZGtRtLhyojej~=} zv-IC|5-&5yza_RF;1XMf|CZRwv#oxR&y(^8rw77{*zc3B`|J#)uoZes``qRwv6pnh zc4^+(1kf0%t=lRo9x8nh4|m9I>TDa(FyK^9Ffg>~*4m zQHyu#m5*pXFi;wn{I!0+9KAL2v5wl={jCL8Z+|v}Gq-6!_l8M<4yIN!9G1+o)*?+H zB`xc3?A%*XT@=lb8^)-*G$9-4-wLlg5_Jbq5DRf(_GA-OwJZ<$yb0)o#nJwnXN~Ux zgN2X8_IjQv%rBispQFAt5lA#d+u~Fh$W9WY0>36ijglo_H1z)rAQPUgL?q$hfpdE? zg3vknr!t{<@e}LlWe)XdN(nLvBl(H>N}I!)JeHN1Eo-t247ru<6sMo-c=Xgkw{6zs zlea=CCzdG&-IgDG#p2B8uo)0USOU#vv)WAWrW^0zO0 zu5boNl120s=XcBEPjLaM;RgJ{7|3up!(whn+BM;_C2ExpCO!ilT3Yg6fGoDs*hkMN zw{@c_yq`QlVV$kJ6n`}Fcl%R>ol(0__wbS#o>23$?@{V;P)kC~URPGV_NyIk-hF<3 z`X?0@Yn66$s5GM<7X>LokQAl}lo3m&ExAAYZhrQ~0sJ^?X$vvNPv7RAjPNW~kC?in z>>;pSp!do+kMuHXPKzmx0e-GNLucoLGplcgF)PT6^SdWYfVIX*n}c}^ z^zBo}H_z#lAv5zCKm@RVbza_bP$o>gcqvT(J8aWlc?Q&HhEX6Q>~eyydgJhMCriR0 z3GJT^)K6{?+)n=RvWnDhONsG3f)EiS|Kz79c0qVSKWiu(-2v^6-o9`YFV}qlAk6%m zRP4rHZo^!OFPXNe*73`FA`VD@6ocnwoU%4?CG{l$>v)9ux8UgHIISWDfTmMHcofg^D47@yVMwg0sGXN73__sHxOzVV~P!aq;E;IAn#jx!>(vlicriXE< zWioV>;jV<2GW3tzNJZU8vtv#(n=d-ISgGb2bc75^sX7@g zRniAk!|oJcWN+Vc8p|UteLdD#tNYEXJu-uOyhmon3|ydWhEIsszGLvD(v)SltZu&UwA)2L>_?X>{LLL)?aO3z z5MuT`bsv05*LF4^Q3W$|gR{#=T_`g1;VXEOv?8B^7yet>W1Mx&@Pj`4)idi)97UCL{E zEoQ^<^!BJ?q*F3k1`t5Ix4&mX?r|5F9Dz+-@JPp)%)l4l1azzDCjbjC0A_W5OV z=Oqky+Tv8%&`&LNFw{x0Md$_>wv0JsnmrBRM>KP8zU|m!{AsN6qi*#=J%7DYd3l>O_;1Jy1-JJkIf(7@9Yk(2l-Q6L$ySux)ySu~TU+b)_=bU}B zFXqL3YE<>xUw2O#qq{1`cLfc_ylUd$_$tVSnn)nDC4yi2Sz+04C66azH&OD*%#G+y zeI5N(0q-UE<}|FuloB()Ai26p={?W69KylZG}R=3h*%_qHN ztVdl@Ilva@4nENgGmi3F%#_$_fVbG6I^Yy{46eg@O#OTZyspt!if?-e^tI zX3gRW%wiUWJ6)N0@cMh&x2rw#hVs&?rz0=s);C|lSv>5#{r=F5aL;WdYPeMw5>pbO z(;c5dM}z~!XE>P(##1aU=<;2LPk%e)b82Ku&Gw9oIs{9`8-}5H)j)e)LzceR8_xYf zU--w$tn@<-f7>+WLHsnx^l8AUF$bg`Z?G&u#5EBGG6F8$2NKgK4rj6dk)?=#7w;w3KQj!$llop$E zx-kG50W@)`E!pvj9zu*88SmfUlLKq=KrA(ao%c4o%P}of*)wke*GBi)K;ky(mW<0G z76v#D5*W%8O8L|;RQV$5#ywj*NYUV&WC7NJ^Uy;-z;y#5h;Rk#>a_8tO|ww&dlX?Z$7_t-1h0PYN5SE2J|+0gq`ypvtGKjPyyAWo_Z| z6v_BsbwrCBp$*0OcGa^FlhXZ;8|kGEr*;~(C37s-c1=8{KP*ZiN6>%ERXUQJZo4rh zJyA5SGk~_1M=|XcZjWdyf!|PBHCw(!^@s}f{pnHrm}swr8hh_|HgrVvz6!X#^;H3F z&!NxK&2zV(jF7B9#!Yv@*9<83nI*YD7>H945z~EL6V~nvp+AMFaU+Ihy{dCM8 zRqrhMIS4|GE+O48>GrxzZ|~(^&-E1`o&KI=CWj{ZhL92RwdM5a0b!I=zCMnRl+&yt zLupUm=ZascBbI-H0pU_&05+l*G};`#N-ik%jI+_$dE+`*NiuG&?Gqu%_<^r-DLg#& zoN*R#3#!^|zjE7Sc8Y$SEq2|QBygc8Aa?#juhPhE6*C*N_+Aesm$Q-$YaSfXoc<>0 z0c**QETxMp?A}KL|4&B)Rctn(A}E1Wzl>@f9O035+lp z>5nL?k$yH|;+3?a@s|rEobD$(ZD;notIy68{M=(_`+BXv2n6Rhe!HZ%XQso0q-McA zy_Z?p*MDD`#0pma*~+=B+Mdb>WQrvU@pmDHWOFTgK-Vk2RgmI|52HaGW|-WrPTvA? z1MAMxaTW%AT_fn|zEl+p`ZFAWvmc0q8k&l)amHa^$~8V9#(o-ij-inkz#+66bopU9 z^fk|!SqENnJIi4xsm=~hVxO%|G~f0GD~Y7Y~^sU{`<7F{;}*7 zIlb^|43XGIB%$S6*QccezyT+jW(%A^7It({%zOx^+{R3DE9Nv8ztkNq6ikDn!dG!x z#@jN+G`hS`rO;&6ds*z@J8p6T#K?37%Qu#Aq~t%h*XcjTxpaqe4!KXtz898=Qmt;8 z7JeVJjJRbKW3cBIXES?iW4}t)NezC$(?M#;6^5%$kffAGAv5S%2dq7qr+BIhYpkO4 z4j#n~CN0q6qv&Q7HOQcIcBsvJD8WtIkQS`O!prT{GVJQJGb>7yCA`U?5@-+b3V*D4 zJA6_q{lb_xuC6>Iknq7*`esakP(-oDh}S2sxmxeedBjmUUgO;z|yqGaP1&_etU;0(dh z)gQ?brf=K%ayEyzzKOEl$07~Po^FIAenq-)Go&UJR|!2#qmR)PlYMz%2OQZKei++V0z(W+@fw8#vmx>Kfm+O)LwWl)5^Da31j85SyDpu z6DmeSx4ls8DByTjB+7|GTtC^#+9mqXbNS{B)B=fO)7}B4ZsN z;Z}b2cn{1^8wU*X+z=6L5fyCvc(lCEh~F}GezC5)22l0L>;3W&#mziDN6h~FgYuDk zQGR<~W+<`g(S>0eFW{^;oGD8d5n4JAL%ZS6+2i5AOsrfnAk-W#-*rSV&4~LYDKx+@ z7e=%|#VgoGTd2h!C1a}f%BZ4&+ndY$fP<3ql3lQ#mVxr@==+0>QmO#1xTQU=L){_X zI3r^CBEaZ|veBV$kF0RI_##{?WB+la9!{T>Cn7mOHFxH=dthPW{tsT@=96#Q)uZSU zkH5uc=G~(xQU}yW?^j(bBB(jquX)gcrl2V!Ji!%XSX4|@dI>5g);oXScrM|N9TWqP z1SO?VSs~W2x1sYM;+Np41Cd4496~FW8X^noP+&>wDlMaCWQVUDjx9cKBv%*ZK|$82 zwB=_}gC(mhb&)TUu^o~IWJ$S4K>*sUPpI)hm{CxO+JbhiKZ;)Pk4#9ZL`4nP)NZr# zndv)L-$za_KU;uzwi(~3S7MQiY%1v>eoG$@ZPG{m1Q$awL4F{TDD*2X?&8rpBQoj? z7|_CC&!1!j^$R(?W-p^cFzyt@Z@=99-k1M3woQG=3}U>(7)mnUwUI97t^L)TqG3wEA{!{a|>4KC_Pc z_SGl;_Zvx8Is9tPRi)Y7Gsp7DdLno-Oy8 znT0&sjkt+LwH(2~nfXP+^!x&yQo9A3=Kju4-VYWd_!{Q5Wjo5{j72UbG49odH>?Ja zK9Vg&?b2uy*l;CVwc+6cIxZ+D8WY{A*WpQmk>QhaX);nOXkYv4hy_6~9Pm4-RK-qHR_t551rgEvp;Oke2(U zmEdj);W|Zxn=7R+to(KaR81h7^$YQ@Z7N7zP(j^m#UL``Xb3_nz*<~a{y~_ z{TMo;l({RpR8m)&xQJ5QX;i4d9P5eaZ&7OStKEot#lrNkuW)y$JX@tkzeedS*B*ik zE`9q8PwQ8&c|mf9stW_J`@nTh(4G^HADfy=FX=wb3RZ(AwKXz<3*=yi6&SF28^V!q z_40Xx>NVudPn4}`gE{#i#l+-9&oh5ietf*c6Y05X1w9x^O+qPmz;se5N<09`=rB@V zzUQRgc5dEVBST&KJ61ZNW@|v=bgcJ;oCF?1oE{yR$z`8B1z|u?y_Ez*-Zdv^P_JY46g;~ zNF*DB*nG6<2W$Zmzf4j4AR4A`%-3HwW)e-#zardyNNGg``87=|!-|2uODJ4+7stFpUI#OWhpS)b|1uIM4oz$y1I$(tqbN`3u`*AIF9p%%^hrvQK|o zb`9Ibx!0M2^CCWZ|4UXnKDOW(!C^H%7>NGCf9Q<_Y9fK}gx4g}G9Zc|3 z4E%`ENLH972pB)FMRi@}vN?a1K(Z9aX=`P}G4ABM-IH+k_`H>B1p zydsI9g?hABz(eqD^Q{{)cUiW`dHJB0ofP)0VWrh`J_||tL|xHuJMZ*1PWuq%)uty- z{NbA~GGjHHBy%@Gm8E->zM{rGNHWE{ni-c{%~G|Vmaqk3c9j@OVgb@8ocMd?8+ZWm zffDa9KhzQVg2!hGKxn5|gwTZu6m{PGaB_k^yO%HuSiP*Zvk^Z!rhq0ko%ZJeSPxEz z%QAP@#uCfNF6`Mb|DKqkebdPv?5V(_(AYy34>uU%E3O1j?Y_O))w0$t*j*-bdsTUI=olTmu<3x};;))Mr`Fc}X#0Juk9Pr+kpAlD%u`RvIroCdZ|3~E zWLK{A@WOZD&7W`MI6P+BdV`JRMPhlH7I0!a>s*YM44s|!N66>$74dc><+tlgOk zpjw%y`YQ%o!}c3brw<&Fh|)FbWgIV~dA#)(Y1t?CyzETks*Wow_iac!7v=Kv`4k%t zZ40;3`ktS~DpV>%#9D}Bhsa~rh!=l)QJ0!FjdA08%3c$ME1i`q%s6WCpxf_{>Z3G2 z^a;VZl*V=vMXO2VmNp^@?eGxjAB*Axz=w>xK^+L%A6@fsv6vnHDP_++*p|or)IHwp znBa(}Ud-!YXYvyxEp6BPvUf)}!q+qLI-P1eFT0P}&DZgmj5sfs55koP2MgxN;$yGy z)-mPP`$I>f)-OAg!5MyS2E>${q~z(0T91g06m!tD?-Jrw0-E57ZK6qCBJk?pMvF+_Iiyd%fA)= zO7{8YxQ|xEBh|NG$7|`8!Ji(>9sY11eEPC7m-hmH*X?I$|EXi+N>!Nj>mBMN!S1Vg z53NY7$;ofaNHC^v&J}U3&aRI=z-_XSl3f*1m$M{i8^?|l@DW&Gh7-m-S5Fr?f0&cc zDI`~IPHRx6$@D2K%H&Z*uRWNLAYJd#yN7*kIrx=g${tiK=NR@2x9oT?nSpJN{p0T+9lVo;0L0E#)Pr{009zZ2G^X{}iA!SzTxSMT?rh9gNbEQD6@eZ% zB+#eF+A)u2GTFzmw(_B$xW>=`jP7WSCZ#rg2eh~iD@Ey+<1H)J0`pxNvZZ0$surI0 zXD1pf_xrPF@3&r!wX;WnVtVlnfh1y1hK~||%Gq&l&vNnPJ!>|Uj^=yq?BJIvL0Gdt8EYxqR!Ml&>-wArHFFR5E8Vw!Ar z2@Agr=frbel5gBm&4yB`P`lIXj>6ArSxLRg^!{(Lr!12zK%kfMJ)a*3uL&Sr@110* zJy3t%W+e`nDLcIk^-B9srhdE-npdgPU>uFte+oZhwZ6!le^{jYnVod~UPA3{!#7X! zXVkdbFmL^#@eFiOue_xr4Y4vmY3>SrJ-Kpo@u_bzmDr}KgW)&4SJ8{e%T4$T`3;W? zt&X>qXM{B1xd~5>uvH8WEv9#5Od3Sdn#_W}s4*Zp;@+?-((Dh!NPj^`*f|j-i3z$X z)R~W zWH9xHGFdGXw(|LnFQ~Ek!%uo1;I!JlZU;k(`Ollt=LU}pm2QrGW#_R;XPOzDc;7p{ zim(b;!IwP_KjCpLRfi9Zit0FWpZXjO#h>S5bdcL>J)?e6dDU1?Pr+$(fy+S zT+z>+gOd_161AyWjQg#&hUI`bPuc%A-N|A9Q&|j0=dtv6rbwABEJ3{76z155-S)TpaZO45C+P&iPc=Wb>kHOFn zcRcs&(d`(vE@1lLsV;FlaE6T?Fegf?Gkm0I5|bY!<@8a5;U>2ENE;-Bmh&X#KuS@l z2~xI;7;N}OhJ=TYi+F2}pg>0%SL2rn14p*gl}F>~WSlbg>t8KLd`p*$`;<#~){2Qh zNb|P)Yf&@B2!s%~o`7T!3FTS{eUFo%(k=J4zgOqG z&-BVxSYsoaJuG@^vu=J_)6j_{S!0&dQ>lu>mXs8&;Z9Ot+0{*}oUp}Qb zkviABXPVsq;IaT7B1w%pzdFoQtsWsd#_l2MF zswH4Oo4m4GU$+WpdzDa+a~`_%B~{#@5=4AG_~Go?;ZZaynx*PHmf6qTCCv{2yA3A# zqpHm349#OWL_$lGcp12kYs%~JP2*k~ur=xm3D*d-b)nwIo}8+6_uR42 z-$qu$^smQU%U6!dG2f*Wi2&|J9o^xm{K_g!vVmsls2mSTJkC3m>Ddg{Y{j;9$Cd%dM^luL)3V)O7Bc#BR6zD1GA%En2}o=a-gDywt!YX&n9PB`qGF%Z49aBswh|G@s5 z`~QFgr{=cS{N zM{n&t#LnXZ^)_III~lR%bpdsF{3y(|mAkccnu*OIu(&|uK^2u|#WQO}Em{0pr@usc z^pwr>+ED$(+?d%_jd!S*HI60dv{dY45dN5a%4~Zk-e+pXF-x=c3dr5q>UjE@$gTJllwp&B&w_S$giz zqv!CmD0a134IV>DC4!{64r&evV`U7+KPtQ>BOYvz8N1c+=k!)NuRM>`29xj4di;mC zcg+tOmD!sSg>6F}sj6M0Y@H%N!dnLFdeFxBFA~Nd0ad?78Z~6Co#tz0ff9LHOg(x~ zL%~xTf}VM3AX0IB+2<&$wt*~SQkn!+{o~&~d$VSB1!Fh$$JaN97=;b{2;h4k)-+6M zY7#!vs?Vf~4)_-g`Ax5s`_V{RK$st{C$f6Be*3T=&y=o=6eJdNOr(9m*3F?eBdH3V&l*UnGa=`M`f3z_Y#DZAg~B2c*= zNQ_}B3_Oo6GXXy$)3(1`dz`I37X}vuCoZun0~|T)7hhDx%EL_uQs~?4U$I?LM&H&} zYv>v*Y4+X<2Dvk4B_*Y9g?>9NDTXyyhB<^8SXEb!p@>d&M2*u)X-0`gMBQ-|4wmr< z;1h*ArhQ%Etsnk9Rd3zD6OlJW`o4G>c@qv^8}svjAx8=w_;eUP+~O6}`pYrgkG>!O z1Rg)4Pu)9>uD$I6y4WjTKA&JE@NDe`b5Iz5OIkd?|1Zo`LPHhY7M?m>(W4 zz(X|S$ROC7X5YZ_NY_PFoQJi!=i@x8YDlB4w%#A2k9yK`pyLN||2e4JqIbV^D{KcpPqixF2G3y))%mS=+)S9M7 zh9%Y(2I~{b=!?F+JM3#p^?U`19N~uWrp_km<{B~i_Jb@(P@CrSu(_H@SA;>yCCtH{ zYP4>9I&SIa&;Kn$A;!#F6t+;E0`%SINh&kJ&(THKPmaiZ$ghqR+6|a6YZ7`J5geIO zwYw|WQkj(1C5rT#Tz*J(Vsfarq$k&GO=OkgGcR z(pCyF*Kv0~(qAFLHV7fas_zMnSWdJQ|M%eO=V8Zknsmeb^vN|3Z69^Wk1DYXQ8trQ zqGKNXe)T61tOI9gyY@LXc^Y^vN`it3YF@Ns#ns|jUvQY1ofT9IQTo{MQ-8H`(&$A`}$fX+;U^#xFVymL!sxadbqpv1_)Gv%%IOy}@9E*? zjjceN9KepfD}F8fPi1Iq-wU<0-`1ho$Y(XqR5&99z#!R&oho+>In#ct?l7Bk?oQf#y zbEp~vRc*EsR@Q2p*71skh!SR#!ym}gjX{1@?aS(47>yV_U@_~|*1(6Fqs~`2q0sDC zU)xNnSf5hKnV=jt+SI2kEwTuFKULM%mWFKgfW_Xz8A9P%EzbmstC)wk=3irzMFf_Rf5VzeQ*-= z;La!k*l2WlO7j78L19Zc`ygKbOMx@LG&-a6ST!B1cy-;=A1YWP>N=y|1zR2`nsDO# zNMFjc7$UDYakYgFY7-bc7Y_Pt7Q+;ZOu>&1KlfC@JiMW?Q>;O}6`g%8kr*qP{NYfJ zaTwZNF^FyeS~v`lB@4b|Z6vcs`w8R7h^~OxF$)VLsihCJ9@_J}b2Djz;6E7Ph0R{q zLOWDaHqwN6Cfn@jP{i?SLKxydtS>e%JjF?Frssrpuw;rtCg<7UUJN4ImYKA@Nf-_p*DE=>wQZV`vH++|7f z`bRcfn38q)%`F7>Q@UJa1|o>29pXZQ?YbX|eU78SB)2>{&Mm@UMO$iW-4JAG*g41a zcb$O|E9SDs-RW$NyO`#}$Eamn?f#vY4-P+_h^%rvGRf3QL@DcPif3Hqres9}RHC+* z0#H|=lU?Y4hqfP(_SOp-v3fs8P)Ws8nVC0;Y<*Rib`e;KqRAp1o2e-+A{qFu*7W|rBX*)s0`Y|%g7;UZ=Yt{^D zmhCswKoiF?`yt{}^<37E(J=%Iqn-0WJMu)UTHEEKLh>F)ue*1(%|Qq)W4J>;4|T9z zj%>Jv%`9kme(A?Y8gdk~7|3B4g(_FSHe78rSLuUks(vUe-{-Ggr5utvDjx*a^K*vx zFpP75P?_b@Q0(5M=>WikSS7UuXN;SbXzJP#yo{DNP3RT5=>7JJHL zl4K@-)s8aser}|2&8FZ}a}AA5q&HQ(nbxTE&hq`o68?JyJ7o%bzX9Uuy5u~VhhIU$ zZUnuiLEY4Pds<>hvj!4znb{uxSM%s(93s7qo@GY!1pQ~;pQc>aUC`>Lo;+DYW`4uy$ z$F3@=%U0q}UGP*}4+~UZO6_OPB=3@t8Vsu@qRKQMkYsb|W$TJGDOpy4*5xC=ITK0M zOPn7_4@f0qVM}4Qq!;6tNl5fte-`$opIJ37DQdp(x_sp^)QtIfe6zFX>Mp=B87q@} zHc0!#ATt>|%zdrcpx8SVUBI$2CH36EV0I9DRGV9Iqv?_}GjaVzZ|iHrU|LsEm#>+&h4VJfnq{d+IB_JCa}r#z#K9Ynw1!zT?r7}BGk%4K?xE_wCycAbo_^X?3*E>R_ zbc#PsZjFQ`&|HY>H10QD;yolfGX(@Y*9HbVSN4o_Cxz2DE@CjMTgNsHXfB3BCD zQFz90P^V5l8v&sJZ-Ymc)mQ?i*)7ciB6w?BgZcAngNw00mM%8vgX#-lXX_GNBa5f= z=TMofQ)}KnT2Ppk4Rm02$p}(^8V%4u;1~UkNT;bu2t?|D9sSAcTj!r@k zU0W$l6qn@f5y^;Aj)dzE_n7W9-33Pv;g-}KqoJ><2ZF6=sAq!Nl_x3z7 zu75n@ym`%2d6%~1j!NE&j@O=y(GZ%{Jsm$xNQMv?x9LUBVuqJoeH&#v$}843Fi|g_ zE8!54lU`p92kxAspL5O5p=+Xq;5WrOD+t3{j4xKWEVCmbu5t#y{*m0|l^U(2KJgnE zWn}f02$$b5_?QcuA*$3(61@Ln5L52dn&7FJe3TsOJ!ZpPAy~pdQOMc95{#pDPv|i% zrgTra$GdT%w_4QXibNL7JX#hvq2C~F>lfx&EHYRr2wXnlc(vN$wEd3j(|LPTy$D~6 zsRIU1&FX}fV~-}wAfygeOR3K1=K`8^l8R(l2fUF>^S#a8-n?yhW9?R(lPtSC7yrnW z7RJPC<8zOWfw`~mK|g;l=KU z*ybBP3_v8Bl!-bJOrw>&nQ|d{v4w=xNb?at`z_DGGsXB^~y*I*6fZ%TqFN=`Qvw(TGfO-q$~Z+a&uw+5~Y59{5tEIf_?nGHglNKbpcOBe+|m^{B!6!y?K+LS44}wqs-`I_i0|GJ1tQCHe*rV%Dl=0W3%QEF?pPzp6rC#`jB4jw`i@?2L7K~;-Caqkl>4-pT zDMoYRRa9Vbm7|h2`4SMOlh3_-baJon3{W@R=82KIH3#A3OR%aqY$&Iv!Zx__+umrq zDg7c;jbHf!tKN83X>X@!m0Fn?ncKsBNyuNP_nlyS4?G^wkT+G~s$TGApl+@2<*@i70YCaN#jJ-? zJpBE%*z`w~it81{!>z-com&P{+X-7*Z8vkN3{7J6LRuR~h!Y=oQ}MJvkA-K}$Ngan zyPHf$mECOAJ5BVIbX4CbH8@v%djJiErictv>C^eoo^OMnx91{V&q1vMpE_2t@XwjwZ8vNrzOpI&6U_B7H4PR%54^$EzM2(j_>oHXb3RTl!pJSDJ7{x+SVm&PkQOX6U z$IqLML)BxvuY@L!!|PeXmFbpE9ixyFBT7{hPJN2sPRe>#>=4c3b>;W6QIokC&9>T% zXieoO(?mxi?|YQG>2Z>bEd2*2ovY_h+mv*1riPdDXKI2^m)>W1b>g;^9bRU*zL8 zjep-A(Oq*HIPg&T)J85^aUhEQXSCb{lz7#6+=$HIpBJUnNS?ynN?LZ zv3+=qp<=?ojsDe?Y->b`k-N2h51#<8KU~FP;^y5!FOY{mKZN!R^C3%K` zdbliql*t(gZ(Mel^ZnE~sB7N(wBgeT5hfP#2S=T0g4S)gmpH&mo*IHO4>C6J8*r`X z@-5x-`T3L3xP?8;RX42ZF8$qYfBO4VMDI;jp0k{d%{L_)KTNk-92Ut|9bg`%&NMlI-OP#{TSP+l2$cx+id!ej|Qrf9i%kOyuDr zIhoLLz_b~2bUYkXO7?28zwQzXmk}4;O()#X9M-`6ur4wX?Fm=X@qKT(qnp}xzw7nG zsI`z)qCCUv4c3^12eKH+^OM^p<^8eu!85oro79ccPjJ8pt}tw0ouS9%=mMGN%>3C!#&79Dw2RPDuASDO!t98!LAQ*_$#;kw__8rL|sg*=9liC6-5#*V;V z5&5C_3wB!x;C-#y?_1CeDpd7!1ISxb2CIbX(saGL*vEr??6sM)1olgJjMvCf`X25O zOb81*`=WtBHL?YJt&lm6CuE|@>msqkPEraNP{P*%fvv&njqRf+iagrw!^g)b+*2j2HX{?a0dH zSE$1;iI>EAcwn93^K=sf7u<3)PRiRJ6oHVAa8LkN?wI5Cb)T_J+fPX^Ie2%I8R+SuZQ zAH>@epKyImrg@Yg>OAI!_oMU&M;Y5PsShb2S4c- zM5MG5aMbAh&4)OdGW&ysge*z^9?gJCIywy?Yb07s+B^_Hl&o`o!UN8AM{-gG8)jA@ zMjSR@MG3o+_*z5XZ`WuXO@c3puCzV$19#HcbR4#Fb4Uw(pB$xIjO7Z!ZXFasTPoiJ zMy)W}))9Gq{`F0r@kOj1Bf>Le-I;LynBnT{v0 zkruGA+~?J|3AtLJQKqBsG5tLrZ-;@bYq(*X{pS*tUn!n>)UV=i*KAzUxU7=-+2Q&D zQApVVjuh$Ru_SaCNXVlk{J2v;*PVTVkMo$D6Z*!DJSlZU+0IFhO7rCF_g;eOl51?( zD6sefI-Vxt;E9+&AF{+}T)3Wn;7lY`-g;>2kudAR;BbX>z?$*IupONsAIYW$_I}># zGTOp8skVcM`0~T<_26D(dQj$ogSIKpQP9CoJ5&S52{I3+jPL!z&P0fQGgRmUF=*lh z;D|!YT@OgjTdoj3rC!|UCR_=J_Kd!|#1+4VITE#=wybx7y!kPLcH}^)xI1``vx4vCY;I*>rA0Zvjg^_1mPl!WC7I#@V z%!41(Vr1MqvXCVR~iO?TIuzSZYr8IaH`>e50ZvC>s5M0(6QGq2pw|H;SPFLY=A2nvAAUKvYTCUGLN4_r zlyi?gQ`=t+AB>|Tsazy%jYpLv!GHD1O~Tc_{$$xnE;%-8M9Bi!4nnS6!O;}Ww%Br2 zOriWIJ7XKc)@a`_>Qdnq=+228gEgp&!t(zt6qc+;-0jnRiHhkzQ#m%D#f@v54I`^WSQHK-jv z*DoTWk0z*?bk`Do`_nYnMCrJxqafs3WasGNLDb-<7n&Q4W7FP@kNN8 zK_VZ6+eAxR8^uY(4Gy`!1Pnc{`J}S@*FKROM0*Lm`N&CS-ZAhs@qA+OvN$;evZ74C zQ{-2Z%yyl+jM{-ka_oiwxhv6i1Kb&dUVam)!as*)iV9`#K=|)i$Ls<7997%6KNcqO4=D95PYUNj%9OT z=~Q_Nt}?xsz8!!7V{VtYXd1EfC?&-ROA^xF=MPU|G4#gmiP*oNmx+^UJdnLOV{= zUN2XUzPhLPv~*i*W6A0A{8*Xlbfeyc3Qc|KRj?`gl>qb>Yph6LyfClDct;Wm&xbaY zfr3x6x!m*g>zF@=qB!3xYZ~*7bKMI_Qwe@JtL=`d8;+?XR>Cgmo~WhGOB#}4RW+a@ ziLIZn?NK&QESL?FG0Z^&mJVfde>K;a{P3?cIKxUGQtA2iu-8F#BqOi-I^#A{5@{N4 z*f`2HJq64#oTzu$NB{F~W@?6ErP}KNW5_<$p*X)tcQK50#V8Sk!?-fbyi)6RfIMX1 z7jO`kb`bVi#z{S|NleD+M#ib+XJa4J3bS5gzHy^5^ptztLF>mUcit&?>IAVqK7Y9{ zM&~&l>(PFAA(-t*ICe^ENC(h zi^VvEEO{T7abvcxHu>c+xFjdAX)qd){%c0PCmW2l*D6ep7gJHzi?MRKO|G3o|b;SMI zNTaBuG=sG@zw9qD{ZDj_XmOD2U-JKk_#Y9-!k3f&_Jh@BdzR%tv?Vevim(}} zG4!{KY~jm`{{Wg}i362v45K7FB2YqgTvo0AD#D?=>KK% z7YE_}W#WSNmqe0}w(XNV5di(~oB+?|MjqRve@zBm+=0b*j_~Eizk}!S&cyncX^5n* z^e>avJJVmCj^5{q`Cq1Zagf$urbg%j0Yp1b>j8mxo&Kj2@Ym~oy7KJ^*-WO|1kO4d^LyMdY9(EAyPtC;C61B^v4CAa~%eP>;~2&PZ41wt>#?g9pl{_*`a6r_F|4hPOXr`6*}15^Hyh zbn(aTiGVdIn~>D1i-DYeVwTAYHpmVK+SCQd&&4IMHqM1RB4vp}Vq}S7ctpCoW_ZbS zcUer(b=6PTLp!U)a1~i(j}1ZbnhnwJ8qJdS$}t1rs{0m^SErkhA8%rwSO>Y#5bCAe zg4CtiBBC+WjJH4f-uBUZ+eiPjO)Kau+JhleL|eXtQCv``plsbyy$PXV+kxhzs%+m; zeF&l9*b&$GLDUyhhMK-S7t^AkMM2rEqxum-!=oea@q;KdmJBsRIVqM!L5G5}Pe(NZ z0IA{E5yyon>iceCEYE$n^e8BYbX0$V)ClW{b43(|#+IRGDksIJDHvGC_+9To4p{Atj8i;kT=v7vpZ-hCc*9y z6ZcTlNFBZ`dkOtD6?M=86tn-a-Mrhp{@SYE-4_32a==;k>ilbJdN-}Un}#H8;l`pK zkwAjru=U3MJpSi21sm^-Ht&qXc5q`kVO=_8RpF}91ASa>ZEv{z_Gy>5>)()8qxzy> zx4M>2+KeXwKz<5%xYTkax^lQCN)f#Z?wO$o0i``$f$40qHjheX+ikLKpW@0IN6T-Z zYQtKt4pxVIz(c&LxIS?|RDdhAqz!k1r7QKGn{YJTbX}nF*4tqtVpLgs?4@v6fs8!) zo#>3BIb{TJ;ls+d)3Lq9_21&uTtBRVb6r{=j;$-jb21Q#F(f^DuXki`!5Wu!c37av z@(s&JJGEhnZ`_RVaQ%9}dqzN)6oN4yj@bnpJ}HFfcGUuuiG?FBRazD4kM6ntrqs)$)Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Veeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor Ingestion API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n

  3. Azure Key Vault

    \n
    4. \n

  4. Azure Storage Account

    \n
    5. \n

  5. Azure Relays

    \n
    6. \n

  6. Azure Logic Apps

    \n
    7. \n

  7. Azure Log Analytics

    \n
    8. \n
\n

Data Connectors: 2, Parsers: 4, Workbooks: 2, Analytic Rules: 132, Watchlists: 11, Playbooks: 15

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", @@ -27011,10 +27011,10 @@ "email": "[variables('_email')]" }, "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" }, "dependencies": { "operator": "AND", @@ -27851,12 +27851,13 @@ } ] }, - "firstPublishDate": "2026-06-10", + "firstPublishDate": "2025-08-26", "providers": [ "Veeam" ], "categories": { "domains": [ + "IT Operations", "Security - Threat Protection" ] } From 926a4d8b4b5a8d7cca981b5969417054330e7436 Mon Sep 17 00:00:00 2001 From: Hector Arvayo Date: Fri, 12 Jun 2026 11:22:39 -0700 Subject: [PATCH 06/11] PR Comments resolved --- .../Veeam_CCF/Veeam_ConnectorDefinition.json | 4 ++-- .../Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json | 10 +++++----- Solutions/Veeam/Data/Solution_Veeam.json | 6 +++--- Solutions/Veeam/ReleaseNotes.md | 12 ++++++------ Solutions/Veeam/SolutionMetadata.json | 2 +- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json index 8145dc64f84..0e4f24cece8 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json @@ -9,7 +9,7 @@ "id": "VeeamConnector", "title": "Veeam Data Connector (via Codeless Connector Framework)", "graphQueriesTableName": "VeeamMalwareEvents_CL", - "publisher": "Microsoft", + "publisher": "Veeam Software", "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEvents_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzer_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEvents_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarms_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindings_CL**: Security findings from Coveware solution\n- **VeeamSessions_CL**: Veeam sessions", "graphQueries": [ { @@ -146,7 +146,7 @@ }, "instructionSteps": [ { - "title": "", + "title": "Prerequisites", "description": "Follow the instructions to configure the Veeam Data Connector.", "instructions": [ { diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json index 755a443aa9c..bb5c9dd918c 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json @@ -328,7 +328,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamMalwareEvents_CL", - "transformKql": "source | extend TimeGenerated = now() , VbrHostName = ['vbrHostName'] , MalwareEventType = ['type'] , MalwareState = ['state'] , Source = ['source'] , Severity = ['severity'] , Id = ['id'] , DetectionTimeUtc = ['detectionTimeUtc'] , MachineDisplayName = tostring(machine.displayName) , MachineUuid = tostring(machine.uuid) , MachineBackupObjectId = tostring(machine.backupObjectId) , Details = ['details'] , CreatedBy = ['createdBy'] , Engine = ['engine'] | project TimeGenerated , VbrHostName , MalwareEventType , MalwareState , Source , Severity , Id , DetectionTimeUtc , MachineDisplayName , MachineUuid , MachineBackupObjectId , Details , CreatedBy , Engine" + "transformKql": "source | extend TimeGenerated = iff(isnull(detectionTimeUtc), now(), todatetime(detectionTimeUtc)) , VbrHostName = ['vbrHostName'] , MalwareEventType = ['type'] , MalwareState = ['state'] , Source = ['source'] , Severity = ['severity'] , Id = ['id'] , DetectionTimeUtc = ['detectionTimeUtc'] , MachineDisplayName = tostring(machine.displayName) , MachineUuid = tostring(machine.uuid) , MachineBackupObjectId = tostring(machine.backupObjectId) , Details = ['details'] , CreatedBy = ['createdBy'] , Engine = ['engine'] | project TimeGenerated , VbrHostName , MalwareEventType , MalwareState , Source , Severity , Id , DetectionTimeUtc , MachineDisplayName , MachineUuid , MachineBackupObjectId , Details , CreatedBy , Engine" }, { "streams": [ @@ -358,7 +358,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamAuthorizationEvents_CL", - "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" + "transformKql": "source | extend TimeGenerated = iff(isnull(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" }, { "streams": [ @@ -368,7 +368,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamCovewareFindings_CL", - "transformKql": "source | extend TimeGenerated = iff(isempty(eventTime), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" + "transformKql": "source | extend TimeGenerated = iff(isnull(eventTime), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" }, { "streams": [ @@ -378,8 +378,8 @@ "clv2ws1" ], "outputStream": "Custom-VeeamSessions_CL", - "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" + "transformKql": "source | extend TimeGenerated = iff(isnull(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" } ] } -} \ No newline at end of file +} diff --git a/Solutions/Veeam/Data/Solution_Veeam.json b/Solutions/Veeam/Data/Solution_Veeam.json index 45e7fb7fa0a..f430a72d380 100644 --- a/Solutions/Veeam/Data/Solution_Veeam.json +++ b/Solutions/Veeam/Data/Solution_Veeam.json @@ -187,9 +187,9 @@ "WatchlistDescription": [], "dependentDomainSolutionIds": [], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Veeam", - "Version": "3.0.3", - "DataConnectorCCFVersion": "3.0.3", + "Version": "3.1.0", + "DataConnectorCCFVersion": "3.1.0", "Metadata": "SolutionMetadata.json", - "TemplateSpec": true, + "TemplateSpec": false, "Is1Pconnector": false } \ No newline at end of file diff --git a/Solutions/Veeam/ReleaseNotes.md b/Solutions/Veeam/ReleaseNotes.md index 6e398959253..bc9db3b9007 100644 --- a/Solutions/Veeam/ReleaseNotes.md +++ b/Solutions/Veeam/ReleaseNotes.md @@ -1,6 +1,6 @@ -| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | -|-------------|--------------------------------|-------------------------------------------------------------------------------------| -| 3.0.3 | 10-06-2026 | Added Veeam Data Connector (CCF) with support for multiple data tables: VeeamMalwareEvents_CL, VeeamSecurityComplianceAnalyzer_CL, VeeamAuthorizationEvents_CL, VeeamOneTriggeredAlarms_CL, VeeamCovewareFindings_CL, VeeamSessions_CL | -| 3.0.2 | 15-10-2025 | Updated author to Veeam Software | -| 3.0.1 | 03-10-2025 | Updated Coveware security findings integration; Removed irrelevant mappings from all analytic rules; Updated Workbooks' drilldown capabilities | -| 3.0.0 | 26-08-2025 | Initial Solution Release | \ No newline at end of file +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|---|---|---| +| 3.1.0 | 10-06-2026 | Added Veeam Data Connector (CCF) with support for multiple data tables: VeeamMalwareEvents_CL, VeeamSecurityComplianceAnalyzer_CL, VeeamAuthorizationEvents_CL, VeeamOneTriggeredAlarms_CL, VeeamCovewareFindings_CL, VeeamSessions_CL. Added backward-compatibility parsers to unify legacy and new CCF table names. | +| 3.0.2 | 15-10-2025 | Updated author to Veeam Software | +| 3.0.1 | 03-10-2025 | Updated Coveware security findings integration; Removed irrelevant mappings from all analytic rules; Updated Workbooks drilldown capabilities | +| 3.0.0 | 26-08-2025 | Initial Solution Release | \ No newline at end of file diff --git a/Solutions/Veeam/SolutionMetadata.json b/Solutions/Veeam/SolutionMetadata.json index 01822ea2b90..10294c0a70b 100644 --- a/Solutions/Veeam/SolutionMetadata.json +++ b/Solutions/Veeam/SolutionMetadata.json @@ -12,5 +12,5 @@ "tier": "Partner", "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" }, - "version": "3.0.3" + "version": "3.1.0" } \ No newline at end of file From b7e53aba5a54f1e37ae9f7bd5cd8e70d8190d5d7 Mon Sep 17 00:00:00 2001 From: Hector Arvayo Date: Fri, 12 Jun 2026 11:26:38 -0700 Subject: [PATCH 07/11] PR Comment resolved - package --- Solutions/Veeam/Package/3.1.0.zip | Bin 0 -> 111011 bytes Solutions/Veeam/Package/mainTemplate.json | 2266 ++++++++++----------- 2 files changed, 1133 insertions(+), 1133 deletions(-) create mode 100644 Solutions/Veeam/Package/3.1.0.zip diff --git a/Solutions/Veeam/Package/3.1.0.zip b/Solutions/Veeam/Package/3.1.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..21fce54b16446deef81abb8e4f865505d6f4a045 GIT binary patch literal 111011 zcmafaWmp|p(lqYw?jGFT-QC^YA-KEc;!bdPm*DOMcMA}l5Q0lS5@x^MeP?#&FAwK- zpQ`Sv?sGv=1{4ep2nYxY=tg@&7n;c;goFSHh*}XC2=n!)CeCI?u4ZahqGsk+_ExS| z4)*lcE)Mo*de6>loC!aFmY?G*ZdNp9&xT){jh1C@eCM1Z<8a??$S!P7m`4*8Mp;7Z zC70yM=qziuXp`umY_kV?0*La+hvgbh%E=9~iv=E@6XL`ga0L3loOC1AUpe%p*Kuul z%DbC8;YEEtYi^&-mH!cBMV<(U+naI#TX3zaFf8ZZ9iU8W1ii{ zeCB#tMQNE+;MtpU`GVcZhZkb7J&k=;+`#$x$nY^pp|`=p!DAvvz+0T&M;x3KIkPrm zAZvg{oMQdN9AObTY?SWsvcN+W_HEEx#xB2C^`)9bWG&#MmB)>lM0z1F7 z&!&u+n(-!s4jxkqj7JgfoN%*SV*TLa`o{2A)YG2p7$JeLuE2T}gbpBnm`Dl{g?ENt zpx;pK@(7dMRYy7&CLhU6m1KeKsc5YGQOV9kgF{ZnGHOmrLpu|m$%l=gR%0X~WD}yK zw)OoeBib*(W2w`Eh8$UZ#yg7w`*lG^C@_&Ty+^Y+BO~td0Fj6g`>}cGW#0f>b(RTt z16nb8S1bd(PQU|ktf0-vOvpjGhFW)UNpw&jldg{tWJRcuH}S}lwn6GSNMU`avVXLder~=IllycmLn!r30S5|n#t-Z|_|4S=;uuH{rVHt#sGbJ5 z#0;8iCNwqC`Y`aAs{ghla`e|y$W;=;{Q%Ohcv&>-x7?4jmxCvtI)JXJG>@v$gr3*3 zDr#DUgz{q{?6`Be8L2*Gu>RPa!Lva0P6wNv-!<|DqF5h@6!T8l+TvneY&$ZE(;h_7pClTGA5Ph8l8Jh(Q_hsa27wSoPw+RuI|wb$qq4kRIF!@wz)(?pWHf@D?Ttf{nL>H z!G@J39#Ef~VHUKYiO)Z0nG|+WN}3OT7I_?z)hfJ1SGFX`@gVwhWeVw@pH@H#E8LM_ zV_G~3(*h9+gYrh=xfA;qMX~W?To4UP9@ufm40>X4H#JaVe)QVHEc>a=Gj)TXCKxhr z1QK76vssM9H#iG|*w{QD!rBkYA@gI5hmv#j49(#w>*uA8k{SPd%d&PNf`UT>b%CCl zX_sDL6Ul37Ic_Ubc<14fq(J|eQL|8jE5JrbRgi$5;##GAl)OMq%cC zBIl5SI9YUJ6+qy_YH%8O-gj_1H}Iw!jLTxC%=xgxh|S;}3(fYEB?;PsNcFsE5jb8t zfD5+-hL<%DyXL0`I|IXvFX9L-t0jyzW5H=oD?m`tnaRe1`iVEKHdVzz} z^L`#odziZN4T{6wCGQ4`1R)vV5EdRl23xPABIKO#Rq$nOW8KaQ^M(ORfXpN=-8iw+0bSSsU9A5W`%b4 za+NrHUy}Xxqq{rqw)L{EUxkpnz!@w5*+@>3|HB$RYiEdUtQ`Xgc-4JG{*ZI3>L)4C zGnZpN!)r9Z1<4dM&gCNxb2qP6JkIUv>9vt?EmM8E_fRGFGK9K2BRIun zEmg8;<2)O05G+&&6p&2cp?udoatRjTx#iU%goYldgkLS8Nu;6T9N#|6=D2h(ZJyyl zPft~cNE0!lA&fQLlv3Oiw4@EbWdgt0v|(t9U1@r;*e{?*fth!Iohk{L=Xo+=e#=QTs)Tg}y^9}K}>2`gU+FhkJAnZ0gROn;o zQZ#U1&WO#v`uq6#Ak|@{F@%Gk5Q@;c7GG%Q_yk4=L}Jb)4B1d(ZzDzAR)V+-6XB$E z-v&VrB0aV|QUbmc_?^thUsw7Ok}diuuBP)DVgxp4G6@XSDHJ2cnYv;;V2TYdR)9?1p{6?N+e%N$8PzQz&ev37F@QK*QEjCr~mibS6g@JL>nd z5LMdjcZj8O-dzidFy@j-c8?Vm+!DS6^5g+3yL&hma&{Oj>Q|QOGfV^6xSaHZC5PCR zCskU~h;P>rR_nNY#hiZL0b%xc)Sx(GU^cjtsk6*`s3lSJPc|B4G9>~wzUcX2w5#;l zm!a${L!xiD&FsiSXPwlS&_)VQFKVnjCIpTMoZkp)+3&6HPH8OCfVJJu;o7W$PRNo_WPwkoOhyeDa5m z>G5Q_(1mm)7aEqpW4xSeZStjnPCG!f6Ze0mT;3 zmWxQF%A-v6GD$x;m;By2E8i$Ioe4tY%{!Lj#Y~a(OxHuNG1@<Xv!NwF^S+V@s3sOv0|mtAQ@aSYnlgqj?smw&u)g; zB^E#n!vya}n3JA}`?jY7l`63igLxp`bItKt)(9Zpmzz2%_~f+iQ37t`GOif2F==D&1&O&t5va~G-%XL|_c1f>bz$t`&=3Z-dg0mSpd+x1QkLy8HWglJ7G9Iy zsscPf%oM2zgxrz}hOa|>2nD?PIuubct+*9Cck#tHvyAuXr21FCR?~RyBo+}Dgs=Jw z^5vF|LD)p>m|0v(e8=hbIF=$yl}caaSZ@E;=BMKGSe&QMym%GS_=S zt%##l>}nom{8*$^epi2Lo&CLRZBuRb6QyV07i9|G3A(DP9nYl%UY$?%=LA^b(PdIa z-iBmIVQ2P#{mhBbvs!$XaS%DdcJ8kOckTxqM(Z?M=NqhdGVFuG5>o9G6yZPK|jk(v-OCH**zI~|B9#Qo^bTww z88Y`8Rr6`pyOoB}AF8a)QzrHf-&RhrK_c$YKxmC*qd8X|Gz$#4w9QLtOg0BFGSmu0 zVLAq<3Z=cS$?fMn+JV*yZJZV?J%Cj%mIun4Eue?Fg?h1JU)-6{~noo@2-8)so z!H}8~Q-H4sw7q_2ZoRJdh_n9%$Hq-9fEqQIRfPn<{wy;i%&{ z5Na3!AF+spHmsXYyEOMDC59lICp<&&H7zj;;WDawxtkKkr9f3$mjSu|UE=g`ZZZe$ z&~wnJngWxxtfsbolbDu6?~3m2^52Jq%m^hDU1cG_HcEb z@u%Cl#)6-A_F{rvV!rj@V@|^a*IWW^G4_)lEHG)Q6_`01qH3eiaSoo92)R~9xwss` z!tS@n>X8TEU)`hMr_+s)e@NDJz9MG$HZU<@1d#$rOUhm6AbOuPR)s$x8m-?VSFuN< z#NO}rA-GyDZ2h5rSZErKcjBYIF?5rb;AnFVIfNQYwna`qNNb_xXcQE$*v&*m~P}pOj9QI_H+Q zX9D2;qo`QiS_p8Vb3y`r6} zH>&IJlU>(E#5jjGkp&t%x|0YW zY`3k=KDgoft0rF7+{05HBy994fQGe%R23j*@TYJCp0ZU%Hk$d%M;Dy|9|Mi$G*?Nw z5O~?UgN^XWuIjiU&Y9R!#US*(1K{DFjFQndGBLkm7Qb@{OR05XB~o6ms_Dd5AHC_s z|I!7s#~U4~;3Hm9Q;6qY2@I`)QZUGphmY27&*EOe@gv`OKjZzoe6TKg)d2rQ89$#b=u!$xA}&@ zerQBQfa;+uL;IPYVO+T>o{bABsgC9FwU%*o-YgR|`WM@Q5flt(c&4=}iJ0;|ZiYEh z6V>C{wBWkXlZok((eFvCoxEJPO619&W$(P{YwL$SKuqQvAmKx!iYH5$#Gi3&AG9&8 z)f^UIP#JC1i`5&pmM}2lZ2Oz=$v|pQ{)*>jA{zUR0Hqx z@XAcyR3}_~YWE7Yusn*zm^>>Js1G?6^}LED=SW}UEKi7F)q`;}h5p(446Z1lmJrvZ z#*eSn$M&KmofB7Hh*gu|Gyy_m0AShUuQb9Gqd39n0OTM$VqM{<0AjgVD-nS|lot}$ zBt%%H@0~X|Z=D}kt+$v-d=L86dScsUCU?)N0J}BsZW?PF6$svsU(|?tukz@+Ff=7(nP`xNq@iYaG+Us-(C}CK`hKEdze;zK3dl1UtxRO4g?$sz!)R0ylZaaA()lhPmtcCoALIc{(mo&XVz3kv+lSYhan6dm>pyQ^5TD)Xl zEI=x3g3V90&4>IYJvl7{^@XI}G?F8~J0LWM{0#4N_1vaqI?&}k&klS@au05>OD@b>{|V=edhABp_AwL~ zRJ(tKTwC{^#hZ<8t)nkvUGJ-*>BPu^ae4fP`R3|KxwQD1gruyH5#>Q)?ly84xK|$V z3%AJ>yl4M{@CuY)CGjel3rg)tP>d3;Q8|37h@L{vLOZs-i}M+$GLP27Pa3=JX)$zy zg2L{_E`Q?^74p1dFrUYRB)ssIG~)OAy#1(=4C$mCpNH^D2z0$*pN?<)f!o*-urf{r zsmQ_bw&X?04=1`dA-mmMW{$Ax+MAD|5i$3^?^Xd<*yoUUXlOg1I2l~TA2+~P_He7s zn%NkeOH5f`gbuTyKc&W8!DIPc`DnANUSBqV-^0rD$3E2!mALoc#$XXtWeyOz9QUB3 zz+rh_g=7|(P2x8(d!H4b;xg@@-19~rEngwGSu@F36T7xCIRRlq)p>d!OP|ml3)6Xs z(G6%n?W3Hnp7Aj{IH**68YU(?-L{cG(uBiR)IMss+&|_LaGp`Bb#EQv;Q+_2_cHP= z897L~wVr7$vL4|h+`t=-p>SUq_12wgT!a*>sdZe34^=tzv@R<8whd_Z=y8q}y7Q<@ z?e8n=Iclm0@$Mx+1Wl(Rmacn)D@0^m$iZz*Hu$um^r=ECRfjZYY1hoChc&Cqo)K}b z0zui=^kGM*K_lVu2_bzFNF}tYnvV^r#zr}(;Q=InLdcR_MPEL26+(1%yI#Do&v`#S zop+5nP=efbu7f0?HywP}R5RaU?$PpIhy(>mZfeV_R@?u_VpC|gH>YFbyC>0#7++vv ziR1B&8I;)E)VI6|A=OUS~u2^Cr5W6!@BUv#ao)ma71(ru_+uF(<4Qdm_Pc{itj_HS zl4#6@7r0&v=sU4O+s8$XZ2e^0weT+-J>}d1U`S|p5GM9T?+v4MgyOA)_UPQ{UZ>{L zwD%01arkLkViPwVX*67&iR9Ex?r>-I;CwA+nN?SlGVLNmBUbQE9!gEjlKEIeI6%RbRN5&1ig4cF~I@ z5`#W7P`JGRq5r}OnZf@OymdQ>KZ?}Y;#4J7&%17#;P8v@@+Sw@ecyMXd+&QLiK)yP zCs-gfB9a5{!Re4O4D$l!v-^DwR6YQaw7I2b{mjM3==D%e1ydk_{DeY5ibo(Oy970^ zhQZ!%uS9+Lg5mg%+LITSi2n;PO^w**m<9|<7=J^c0WkvnH@g&LhPffIf_N4iG|5@2 zODEO=7TdrH6rX`c;tDNN3d4-hFyW8%Ls?rrSmSckzD>NY{l29&-$yzC!h~f+mZKCC z2hfdDd{or~!-hNvZsu6@0rE3sJ^Km%WFF>-a1O1UspL%_4bvAyRG~sAw2g=KvM@e@ z?L9prWQhEQUTkQWv{Vk*KkRM04~eQc{*WircJi!FN(YlEl2QnlVUoSVi*ty8hBFnX)=`wqqZM$JQ@r6jR03{%*Va+gE_U<@tr7$6 zRqAF4jOe4MP;0u?HL_jpXKH2y7j`(M2^`-8~+U?Yj%5;wHc-0skrc5)( z$CF_+TLx(+`=33eJ1>ltWzMbN25ku{6KmR%ZKIsV}%Xw#UE`T*&f!p&mkSoXaYVI-u||Z8AF#H z_(dKdduaOwDEmry7S-NqpD=-hJ}$W1N?4;izS#>D+d?8$dM~F`;d@D^td4vjZ(djF zNodMC-a_}+T=L`{@Py$Wlgt5?VGLfWF+Mky!5FMvNlQ5@4cwhgG-StpNkj?{vMlqvqJz0aWAd204^6dVXwH^|Rs6 zQ?y#1h}~>bDc6;YcdX$r z5}_8GlH}|oPAFGxex9I;zUjq9H`SX22ImY#0Usz^1tR_Yj#20QMq`i;23;Q{%;F4L zOKBArKc7?t^Phqr>ifz-}iKdJgH0dkHN+&kMlM>U}r4hBAEq#Tuo+ z6F6~mcrPpX;lWH0^?`+w>LUaNzcy^Xv01006$O$_Ss>J zjg5`)pWAf=aHjW)PesXNwcS6tI1Z;0Opge?Wm-(n#=NC-ZnShnj?rEMfBr;N{I9Q- z*>CLZf)jv&xNxz7kYB%6wllJ_S2eS9w0-?@`S%yfr=8x3>+A^(4?kmDw*pHn-nSRM zbH93a95}_+N*LDGX% zNR|fugd%B5f%5ag|0kgs*Zl{wPsJR2d$9X^UJY902D-Wt22&0rLAsxD+n2Kv4O(ox z2^(3||+r@@KwHrB#QQJ#8Jzcx%owBY+u6(AIDGq^z``1T%Ke@zxcl_Dz zs?@cGm4d6&cZ5-PXV=oJ>L}F~6-gzD7b&=AnKOrxD7GA9L9-F!W9DU*k_l9%z6JK| zghJ=01y9p0M-uZbOXFv}$~$V;GUa}9i%P8_OD|t_mHhI@Y~yXIA~h?<4l-zdURkxh zq*Y2vF2qd!RN~j0?z1sVp+eT1w%Es&0#{+P?yy zdPDC5IQm;}!yLztS0^ol`bHxKkzi|!BBquc!mP?Tz{s^^kXzruccpT~ye z2=UOoVqKG2`p=Lai4Xv?r967L-c1Yhd9%dR1bQUW*q~$ZEc*^gI;sYy+n7Y*SWK3$DMC&om#=@&c2s3fAl#@ zb-8#e;W`G)MSHy{Sj3p!qG~4#G?nZ5@l#WS%FCCdDKde!iJOq4MRC`mmoGsk{k)J% z;_~sxpG;v~`tA)sF%@ATptDI;xv`O|aiKeQ|HS?*9sgw`kz_3$@nCS$+U3@@lj8jo z-$6VVkMGYs$@XkM9s1psg>lL0eeY&D_VLX3PpELyf^|Su;104=O8ZSDGNBTKh+>0b zIne%qJqeu*D&`r%#Sz&>uxD_p6~->9mUxDO23rZ}pS+XrHNS3I3{j?chj3I^bBv00 zl_|)7q!LRNd;wzjuKl{!lu)L+DH{21QC6swVkeqsL>ke}O-|>dDU?@7K5>7SzH2tC zGaxS za3T+K?`Hk`h&rV%KX%$@y~72Y^!Jqif=yfUt-3Cg?Z!M(8;b>sqv`5}sZNM`d}_CA6ezIKz+oc6)PZa;+G1}mhVEUAN3Lk z(Kme0HYyEO=LIHvXE%kN;v9-;oxx5wnRqIg#m@O^w90rmtNa^AcKF5cEmoqhWf(bY zEr<vW9K=F*B=`iJUnT|N3(lM@;8cTuxWK8e; zgkV`ZlMowAt+lzV`eckfTZOb%knZC6bPA&`OFa}dBGQZWk|A}Fh#_J@Hp6@c{sB+y z@zS+(G)_jgwIuSp3 zb!3t5Jh{VtN^m+HZ%cboXgk+zANNh^xQ*W*N5mS}zBH+W*PWmb5XcJICIu~{sv_Z5 z5Z#!f51gw5%9F?ed@{k229p@bA6nFuS|t=~Xx+|O%Vm>W#hkL_2c5_?tNq*5e6zf+ zogh>QA&dB@z!rvk%RjJaT|2cel+c)gTho>{p>KX;kb=@8bfZxfnJ*N-K5HtSeSxJr z-g7Tcd^hUn3tC09zgUsPlP29pmF!Ges!Xq5v_4v%v{t38Mh(8c?D}jg4;|eoOcmI5 zz<-O6hnu5;R@Rp6i(g)1r$ktz;>*k1eSOhv9j8&lwP~2~C69GDGxxwlbMlg+f=j>U zK(z=>(pzqcw(ihQa`xU6vhP^}-M7s5y@A@zh<4+^#XJh(py9Jk70m9^y9j}_pgSt? zOUhCres!UzQJRRYDxy~oh=Mma0D}j^8V*!4`MOtNr3g`8Ze@05N;Ws8YsS^u?`PB! zcRF^iZ)PeMk-QheV7sha4=dP()OJ68*{xYMO^$^Aj2&17LnAnx5OUD+W5dhcO>BvE zSHB#e;)L+^K6SCabmioBD#W6jL2>3SI~(rLR%3ctjGn;hos6SDzGZN8MJLkM7aZ|~8mmyPosZ&m|RiBh*%aL*xtoq(%Qdh;QDr}lj=(2!Dv`2x%$WC zZolz~)~3?YBUPfC@X{9K zPaxw?RrhUW-ULp2@Cxvscl%q15C^6aP17iMt~)Lr=4;b2O@wP*k|T7no67YNquO!J z{7OhqQ0_xqhRxL(uuV_pHC)j}sF_?}Vj)XhqB2|puL(KJk_xGW`z?dQh!Npm5NDP; z!8S;^W4y&AaAmH6n1&!E)6L+-;lRY*t9OPR8hZz9gCeOB6XCMi^y^#~9QxusYnI~= z8VD2*mIH)G0)^5e1y`o7sc(1K54GfG8us#1-Oe_dGD*fNy~VU%KQf?x2txJsBi(7i z+}*pnha6OmglE5(IrKo4H@HSkSDcjT<2{fVX=jC95o8}S!1vlOrGNV{~09tJeQFdV-WPE`Q z2X)OMq}GWuglTJ7WEl&(kCU2=$TkMiC`p!&$kttGc|asBai|V^wkLKzK)i=47H%OL zWTq(%q6OvHz7QBULb zI}^jU+&mo4c_qF6!ubYP2Dl7(Xd56AkV{|Qkg7U3=p-~0q-F|3Nkh|PV51J$K6Zk> ztobHkmWYU|Fyy>i-GO3hkTqpe6fq~kP9oPPaj3O$5v;4%!)NhCF^R$;eK&VV;-jyD ze+4#sY(B@WJ8t#L)vg8>=W&8lyOP`OH^@WIj74%s2xmNa^nl_a6~dwn1q;c( zB#ucagACcAhw69*OL+~(ch|D(*b>=>m#nJ@8EiNFGcjOMNmqSuluQ3Nsrqmk#7D7 z>-|UA&OgFF(?h)`9#AA;#bQF&$>W@ob zz9sI&`p6Nm&KRlDvJCL_s8Fn@eptq|a|`346Vr zP5a~Q@vpPsbl?&4GDLjCYvmQMuLBYm zrXN%cr+pl?r$3kG9f6U2MVlbn_!g)!uGA}Y2(APMD>GxO9YKMR6^{%jne~A6u09-9 z=y%B_L2Kz)}bhJnUanU46f%-X9{+5+SmFhURp3{CU_ zeWgE=7<3O>^hWVlf!-4HrmJ{lvB!vPIf0g2r|d*-$6^XoDZ2zg^n&KQ8@RB=LOm zf#A#~pdUvk`Hmf9E2mb?=U_u%&3N=NOn}q^Tzfl0(K8Lg{ol!zxUj1ppawYJ>#<`mPzzmxaYF zm?LP4NUlmq^j`di6C7h?7odMSzz&=mWhPo|eUD%op@|$a*V)4aCjiA)!DS`M>XaKB zWBA&Z1^9C!|B3f+t^;XFytl4|S`}34x_^al7Hk0vup9can`M^L? z1POlE3B(9$#A#m0F|cU^%dg`_wVZSdcsShg72^DbayoJ2@(qGxW#&Tzq&N#8t9VGr za(FmMN9Kb0Sc`90U#O)(`c$ziRl+{Vi=G=(4twhns) zRP=`N?@({6Gdj+w3Th9WO$XzptsY&B?`fjNUyjR=gMCe1Q2cjel6b#0*T`FQ(brR} zm?h3}hZTDw*QpLW3LUMdl?R?6-z6R+QNqgNur8Us=B-(X^b57&|52v)Xz|MhwfJtm zLY7tpd!dH|q1*6v##>Oq%T@>xukFPv7W<1alfN!D?KN@&Q)Z#!oI&g0Rr$&XVoqIG z$sLxg0L3-Sy7<4ZmMr$-?N#@_h<*8va&)VBm^?g@1^mf*HxU=mjyAji%iSJn5vbov z`ahZ^u1I2gKkTd&k>7#xMzs%*J`f)lX~3xzp>9_E)jw9=6zTtf7IXSr&Fs)5yasLx z<9boDd~`JUqLUqqn+bx=z&gGjsLba_f_7s3@6h$Rp*;msv^ud7Lt~rbdB;j3pd8WF zB5=&LM$lFe-;peCem7Vni#OG8=lVq#fnYQDuMYDTfht+>*+LM3;yIQ#1+GCL<4h0C zV*ZVzrD6^nGEr%q%Pa_-X??3Q;*A6`Bdn6-7KA=L>auA#(2pKSo{`!7S}svLc&8GApkE%~ zUPd7OXF+r_pPnP?gm%v-xHHu16_dNRm8P@9RL=0pK7( z>$SpBPhNdfH=AGmS9eWp9K8wRzcU|dM@W}t|2DP=_YTHR(k;l>T9SC5l{Es|s^lL% zNL!#*$`Cy6IIPl#suBZ$va3~oau~ReyjEa89>e=;8ox)Jzf>fQ1y0|0But;xtVIo{ zhjYpxiiH+tn4TB|e!^s#<7%-wZT|sy#Zcs*0oPh@uxQ)fVE0+b%PZ3c7A1}p_hkbk zG{!=jbbiJlLUfw`gX`(P;#&UXfed6VyOiM8^-;VqfpM|t6Xn27_HrYU`YO~vc{ccT z#g1544MgA&!WcyH@t|L!b={Z2zyg(z?2oT)4XKVJ{5SPoRW{5NLg2Q*MpFCLcZLJe zS$-kHnt;3xJA@8X{MEEUng41|`NKEMorK|fT_j7}iyenxyLI%9n7HFo2# z3G4q143L2AUz#EaqBSGj7|%Hm{BE-l!Udh%TF_Tx;cR54bf=Zwj-Qz1ZK@1_bRPQ* zRSYf-2Thbpjy>Ag1NDb<_6FLzf~L#(Pi4Uy>9e(So2I;>8H{LH_l z?f;Co|9{+KiY0|akpp$C6#ND;L9~Sc$5szAGS}eC_dOGoouo}liM$5p@cuJfpdA}Gr0WI0-C|2K1oTPgZcj#a5R7K=t6M4%fk$Vr|(STS~c{1!?+h8*5u)7uvH zmyCha?MXh`Be8VD@EAaOD;u*^8_7kI&PC~Uu6#H}P>MzUJ>dSOw589Xe1NDk0*ldz zO&7{LwyNb}BWj66r)RWnd7GC0&bygQVygh6+{84WwTg34L#>f)x{iCy*zbG>x1Zot!#zAsUq+QKXsIF`cbjD0In4jtQnvR`;m7zm_7HqUC%PY-cbUIb(x zGnx;MGwfF=epr(J!`_;;*l422jG06qAlbe@L@!EwCdkG%9cLR+*+Iwg@znu&eWLzu z337z>0t}v1v_s_Bk4NxoN)WXZaOT)>=OJq=xm1T*?#?7={rTFEfaiZXXgeSt^Vkol z%oEx4SPZ8y>lnjU$xbq>IL?Ac|H@q9wN|yXz(75SO7J!W08W1>nwc5XucwMPEuXLg zwQieV>?tzt%K-KhQMuML%x-nx#%VVXh%Wl4?NbOBr?_G*&l*K?wgE&E0orv=-2_KD zyj=;aaq@pn_5XSc<5zMNEzttj1tBKsYW-3a2=rq60wA^JRGWp+ucXK)!Z#sKO%8$GeT48#Z zcH8_4#pBJm0Ks2Q+^?XKU+0Bl@VBMlF9${Bm4ZN%AW+^kmXveCNlq@Z8C_(vLS{OwGOyk?mL5vU8OMVG zuuto!KVZID1R6PT$4SF21&~>PBMT!q)&Fu(7~L2v@=n*)g$VR(U62naSK&5qAQho> zxxV8$+!ZtmYZjN2C>#%?uN=IOpLDb)4RmSQst{6JT@9D|c;0biET|kj7$mbJ!MpkJ zL=l)N)QIc6!ej8SQ-&Xjg!;9Rc(}nFeKg?ZV1*Nzs0c3URM>Qnt?~#50TW9gUx}?< zNjL$4SC(SjO3sqKo*>8qNvfUO>)78>$t*ctj3sBUeE4EC%@9U>XM35>2UCjMRQZWlPkjX+BySWz zHva+noe*kRO7-vne6C974zC~>Qhy*^)-Vk4?j9iM3d}fw>Nn(2RKFn)t2*&2waN7e ztkMp%spz^89GPV@hU)5wKWO%3hll_*{&jE7K*20LWyc&rG9+>}2F~|kAmGqAQ(2tM zL>)LN;`7VFhehb#DaTyyh02UktV?ySkXiSWjs!$F5j(%~4h41ko%f~S8)`^szfjv< z4%h9Pshg(?a~p`FQu3A53B{r)%s5OElr3$G6I>k%G(vl0j4I-dF_`?qV^E7u9-0xU zT1Sk5YALzlTU$*&!LPK4F)uxEA`8W}f$(^+K5=w@7N3U#n^}TDp*c%vV-0x<_5gt{ zT1oM?7BRng!$;ry%^Sz-pGYGTZGTZ}c3}e<(P<(XVXHH_^EYnyyYei1Et#E|?O*we zfxqRiB=kG~f1OShRo@=2JGLU|=!5A?2M*aGPQXUlYQfhlp=)li{36In`WrhXp*QSQ z->{Pa=X%91|5J&$lqrrOt|wYPKLM4#p@{62fT%V zO;8Tc$_j!adQ;%At}|hrWGfC0G=()zq$wx_(`{aLRV2zkUAiFxMqB@sr@A_U3XG#o zE`3)hV$+EYCsQBk*jxsnLr6js@$1e7V&K0c!zc;;7u9p2rs^XgU=*>MO+Gw|k#=c@ zG<87chOPQD&FFYUG;f9apG5m^+q(YZ3S%m085U#?ws#&8x*-;7JPn4{V1b&fk()sD zI8Oz4=N0a6i)vtyD30=4?f#r!{;0Hby+O(UAPhljJEIFU-XlNQ;4?%6l_OE{QNKVZ z(G47rZ6r(-JHij1zbTe1%?4YQ;MyV_tV&MQOWBB@%ZA4~PL>|>qI?zP;8KlFhDY>o zokH^;odW*#yp)Jis6QPQcff^J?p7^Uyf&@YjSLE3cKyCHRuRzUZf?W+~2yh8BH3f|z-(uF?MLd(CTe^&;Ht%7uE#GfX~#+R+Q zRX4f3q_fRCkR9;5NLPyjsD7JJDba5eii2_fWkO7WaDwVQ3Jb3K`$M2-4Wy0(0paU; z{7ppDP2f|YqTqi{8Zm3~SLEJ4Eu^);^Wjs7))5ZDM_x*G&@p;^5^+lwgEph4LZV1^ zgkYAi--5Owkmck&($hve#_1^jU$Rh&t}^#|9#G$rAjhKUs{$I{hU{Hz?tKd60GkE* zH%x~&1O~jS%KrnHKxe;fpT_Lcde3ws@GCM8xkF>s)xy9frU!nSmJ}q>#-U|nx;c=6 z^H@>;%WPCo^`aheUiXrQYP#8+yB%)nUbrpjXjfmI{NYBsD-!_Dk=wwckS1*gW4 zI5ki>H71BtqZ6ls>kjD=I5j4VQ==QFd)<_MuqtH_A(MG;A>XFI>FYO(P9bZ8ZzF+3IRdZ)fyVfph`buc9)7g$hP=0oK}by|+S?ZJ7BIx;FjL`&v~} zGm`R)5na(mlzhL~bqoLfJ^cm5V!XfEO(^wqOM6$rI5nvDBUs~GW`+!hB>YIOcsosK z$PENV`LL4=h6osAb7s-due>=dRzH4+gvM~w9l1WF^Y=2?wq zW&bJlM;YjcEgD5Al;o>7v^D33qD2vjV|bV z7XI+EhNejsiU1NU{xAb>66J2WRW?fn zxB+8B5tJJ`2VLE)@5C$-ua`H<&33+-t>#n-x5)o>im1jcC}irH~bZPCD0_M9r4jGVcy%Wls_wPU=ElG1UyNfegEAHg)AcA{+50s z&}FN1Ka()tQ}n^NZUEEQY!<(z%1yr2;jbpCPQf4PF6~@l3~~u)3A{XqE#!tq%I12# z++JN*2S>C5Edt4Gk#)njOBlth#jI1fR1uAs6hNJJJa3-~&9;Y$a`yb$n@7CS>hl+i zXtji1;xsQF@xFZg_?h_NJMoE^i*UY$PkizC@y`oYdHk4n)GIP)-SgrWh9S9p_U+@x zUnuEsz|SUapYq3ISeyI4&}=pzJ%bLO&&VRAT;yNrI{ijQ04?ljl#ED$2@}v$?Bl|> z1M%(IB3=_PcfkZ>-Ok2xxnO)2_;|YAT*HX|%K0k^S$e`dmB23yj6#@H=0aQFFX+4V z?COfbcs`vIfKu92{wrt*`?<&~!(l?#YNwrhr^moxxj^S)YFLiXn zChDvO@zEsxu|ela6wSoU{D%H>J6rQr_Dce4$EOR1@fiAj`H5))7^iEP6?qTkJ0ln$ z{-Q#du_C6``5kD^QrRXnXZtRhFR#Ra{AfIW3_Uj^ATDUV zXdup&2sEdbhbJH=Ro-u|K^12UfdhEq!&zoXkdI(RBo|3K!KkBc-8tV4_)F z|6P1>f4R>7Q#6H z$AoVC0$L|wVI7uK&)s_s64m{@+r*dJPY5VE-7Q|FT}ZY+esQw`cjIj0>mlj+u)S;QoBPcAM0P!F?~>Zq zKC>Q?TT0sdqo%FTtT%AWPS+fgw{h>%ORR0FUx)?y?wCCfYaHpdJY~Mhmr3f{$~vUE z18>QEOPjyNX&{gTMquqyl{%$bC+n1^e%4AK*6MHitOm>ZXA$H3EkFc3QyD@~Lk*jI zmM5bWIuhQiw)9^Lxmuo?Q4(m3@2CGI83y*d7KHBZx4DmAi&u0mkig)iI z!o`|jQxXa13)4HLK*&5k;5Ae7Pbh4Ika~xr^Y-th0;C_yEbyPQrdnT4LU1hM$uo{# zV}>YwhYJf-;8~(AZS&Sigd&W|^uhLMcEp?3#?rU(`A>WM~` zkI*Xj^|e4pdH)vNdyF7jhFj*L6uWF_WlqU@0p5D%e+-t}O`!?a^3DSYZzktAxx_4j z$YY7(ztz;=f02a-E+F8z*r?$4gfK|*r)98#(51SIGR-0tlt6`VJnDt)&d$6CP!sO_ zJOF|959+67wrcYjM9Vte4&BVy*}?WF8eAlxm`M>^t=&`!X1{5k%m7=}5Dxql0+NA{ zvWKlw#s1#Ot8p3QK)xqKoCVX?KNO|+(?K|b^ z>z8~acK*Ub2rkpga!D2#v{P?@?-@Sm~o#=vHloX;WNiA#z#cmv+w?%)fwh)vMQOx>SY&l|^ zcKQvuOa0g^B(sYlWi7F2Fz@|kvVnIpjd)*WZ3W&oKE5#97J@ZA$D<7YloC=rU?QF; z7X=mIt4I3#`CwbCN}oS|{Px|8*NU#FAPoyc3Kh>2PLw4l<-F7f%vn@1NtWS^M|CSb z!Q!w#FJNF_zIy%rn|DvYd&friOA5_V9%L6^s%;uFhSn59Z&b;b3WY5*%2`MjO2DF_ zt63H`-4p|QZA(`XxUExm>wL18DAPs?#PMuC{|VyX?H^2ub8-2i+D_iIDCLd8j)Bfg z>#fq+Z1WUb+FU+cuI`xje9J%4W1;8|JUTx z`4s?g8^Bz;PBX<=Gw_Uall`xnO_1;dq@e-6;U8H#W&;1_ody5Pl=VLi+t7B2P4Fvc zPY80!DKBA4zRczWFe-TF8f>$T^Wua9njX_NvzuW;+6MV(K7RZJe#vqVmA^p_%8EtO zVbXd0_}eri>hWXN$>uqvhyc6ksMO5(WepH-S=m^!udqF_^8YE%c)yBIXa8=SQSziF zG5O`(zT)Y9kk$kUdXz&*%1yNY;~rh*hpO`YYsfq{&?myw1d~wLnB_Wj5@7oFDFbAV zMV1)MT!Lq?JDHWUjZ4XRX)^ysISpDSX^yQ>EYpxnGJ3jfIn%I`Ei08Gxl1TbWka=8 z-%ysFSQ?^Q%G*PdSJO5`cQ@uPX3S)hT0?lSv}0(X$p&_>e~Nj@yR_u?CGLco_|Pp) ze3!Q{Z(;bEFSLO(NFkoh_t@gUN^q2BCl1U~ZUK|kD*eJ=dEydVj~Ww4g>UCIS#MYl zS3T8yw)j}gv%aSDRS3|e>+}2rd=m;8Q$lerSM%)^n1q)(QQ< z&%zvD>|>ZWct-m-EojVW8Zx@~Pdj|5dpmQ@)V|6dHoVsf>*710TrfN^2^gfu=czoseXLcMuGjy66hnN=)W<`fN(Pl=-n-8T0q~2UWt;u-v zp!CHCb3pQw63c)4vVZL5{RqU_k z^BTbBW+ za_1h}rf}r>hUS=c_j!i4a|{pX7o^WGe83Oxp$9WN4mdO)Y-m5wP$^T?dVm3SaG^E{ zV4#Bv_jN#_*TDp2?zT+McJ~2<&VvVC2M+dwwNH*Uq8$ec9u5*5aDd<#;OjUj&=uyd z=3cfP1gL}90g3;AgoJ;bp7u=a|D7cCR}tB=@O3Bb@0(o@3Hp5#^t)~RKWZXAA_2dC zw#FpfqY~{=3HFVry<`&V8_v#P6X<{Ivc_dW_K+C=kQjgb#Q4J!;@h^El4VC9ssN@{ z0A+Gorc(s_u%sHLtA;kidj8{c3V|Aa+K&}YZ+!RJv)8-Q;t!R#`&HhS&GV}tq!04B zzPB^>C-WD8slWUED~2zItVjLwj6b{T-$fMv&g*~IV+U6f+)y?DeoBJxm^*55a8WE7 z!dlQ}_fa1_4YahJ_vy~vlhWCS3?5z``aAiGeKk3OU58vAYK=eC8h@xY{)b2stet9_ z{SMgbtnZeaLI&P^30$w!I9*%$yF4Q&t8Cv{s`s<3r!D{Pgez)`q0aAM_%pBXpQa^} zEG80hnHz!n%`_Lj#+43a-*CNZoKn6# z4Jk(Z+BA}+`65$TV%~JFEdP|sFdaj#-C`kTd$cf336x_9QJ(uHG1!>=I*LMNvw4oU zY-UEwQ=jQMj?RcFyK^!AXG;=iAI2r-^UvZ|gltYM_khS^)QxLMTt()${sHbs_)Poi zUTy{WO#9}ZZjty*d*|r4Cw!*;GWb0TqxFNta#nZZpwG&dMS8v_NhuJRoZMSs|6-PV zOBwb;o_rm_AFZx`o*DboUS{k=8ULpKtY+1>bbT?6y74jz@t=p1{|_bqk5ux%a7d&N z{>CZzUkG>~UV%QjOJM0tiizi%;y3LfFn165y% z+hyutbdM-{Mb;mq<)?-ky8R%OCbCro=cg3bmB|jU0hnO!u=e>aEjPYVV9H9NnBOZ; z^Lyo?H8Ix}E{Y zVa#Wfx(h5m2jD`l=W75vH&sG0ep20GpwwFN$Q0|@90Pguurk)?zaP!`6Z}Up&UNK` zeuGn`n|B?_}gXFvzUc>qSTTj$v23GB4oDmM{0;IpkiBNi7>DMa~_0!M53fLX0ZHa$Z^h(7?nh2Qnr4CeP#~U_4RU| z?yd6+CRQ`ZE*5Py7ul{6jxXn3#F;&tec|b9_QQJK`Pwa+&p<&j_C2T1%-T*nzhlUM z4|qtmw>bYyGx^#l& zoaZ{OZ)Y&;Dre;sh9|oSY!+S;o4mSM^P}I}N^9;`+Fd86TX2qKzRspU6b#kcW8{cs zmzkaUY4hUxTS=-duE6rks+F6r?0bUd8unSRV1p?Op7M&r6yE=W*921Y{Fdj?qiOvB zX!z__KQ~qIQtP625If7Ozv!P&Gf7uSkQ~*he?B#SA(|EVAl$n&uGXDJQ8X3~-0AOJ<&~!cdLN`pm zDV5-Nu>xn%7-ki&^xP3wVMxk)ScvZj8UroJy_!30Q3jAatjqXy8RpM44uoHWUo2QG zV-iux^rO(+yXDo@oPNn~!5w&^WnT~_mv&$51Z6Z!s;@rJe?mig!=<{n$c;o2+AOQA zTQ1J~ifqE`w@c1_Lwe8QH_{&a8o1tNBG7dr^rO{@Xt{FtbH19kQ1RlB0UGAsT10`F zBVA?NQi%n3nJw}Pxq6*nNZt(EcI#cuyih03!yUJu%N@6MqbKrq=pt;KbC~uWkY+uI z&Kx!iuqnxCZ#e^hHj|c9!biX0y_8=lA`pe}!}Divkc*lFiyCS%t4#5kPv*^*Rf;-d zJ)`2F26M9bnAFpEE|g`yU!)m9`^agcYg{eBI)*WLPD5~7wTCg&;!JAe5tinxeDH#8 zZx#oqqh|5huOV*152?3hqh=rg0fE8htj;Hga0K( z*sLeO$ZP_NbVI^xFvzB$)9YFC@ms*ke0)}tkSwM$yRd-AH1s&0&FR-9x$ZajbaiT9LfEBs`uMM4yZ8F8hroKwZ@mCxOl22&KDfIx-gap6Ek=U7r zk;K!4vV!TO_X&iCA{JYi${6L4nTmCt7OfZ^HpS5R=*)m8pXG3k&&V45{$%rvZP-T! zF04fJbf%vIJA9UTi??z+m&XH#>4rwLjttE47VGx%XMe11;#B6lDeOlAnrvRLSrwTn z>=juFszJCIT6uQWyZ&IRA|#(i^kpKBl_{w0H0=C;EQ2XH&AHnkb*W6jo`y7ysjvdk z_bW&=OI}m3l18`Kb}4V;gC^tU4UJ(h2KLbSEQyrCbg`L2A7!PZrm+@f+)SZowh7M4 zpD&LI;O%@f#l1#DiQGSyk#qrrJS#0O?vuZH@(Gz8{{B#EYvsq@!yHE5;d7}Kd zGc};e_ooHZWAW)*roj9OS7rW4__M{2{Ga02{Qe>Kd-?}|@{)=4 z{&W`czn)ik<Fe4~Eq7W|-|Pf0ikgX5t5)@E$51mzpF0O9IgRwX_CnVOq-w}TFpQ^yxC+LeD4|{j*9OT}V>-F%>BfDwlgD|4Je3d|v3NN9C7aEhF0W)(t#+)Ha6{ zp;v>m6j1vps>4ea7llcwDBy08%fnh2#L_U8#-OHy8+&rEmqwTZrS5v2C)Obr zd(o9uYps_EFiUcqW%;bo*zR%q18S~%QSvSc8@2RPjRCMfKfm7jLDCsF|GWG=|47MM zko@t9;xbVMcCBNNLwk&P~|w~ZUo)KUpYKU#gn*h?GUZYPa4*$-0mq~ z+$two(`CB+qp&*C6Q;u4NdFL8Q`$D?=RbvAu{(k(tcu;=g?Dph%l_iezS=va$cgsP zE^=zdEK@;Flbs~oeIq-}xBE`^OKPR?6LzWi{NFXY{wlKBX`R`E?XSB2Y5$|jUft@!#-Kyoz z`IO6YZbpeH|5Zp{PMQ#smwyvCgenb0s z3Q)~}SvJH3@b*l(3|aeFs-UKdjT!*#4|3g@?vGt%luAP)Mj-F^UGEmVuzn8S|MA1H zbzWL0w7T*xx`r+9(ow5S+=O(*IxlQS?NQWa4PRUE5?G7pS=Ycuq3>uH>5E_ zD0hi&wYZ|Fs0cnHa8X^e0&KTbN$2kDnyGNUWtOudLJ?0C0RCpVrs8^q<>s2McQ;xk zqUNrMO90G;&q`FqO?3uZWOx;xl?Em|vt614o>_O4=75%9=3XSanRJ#sr!fK5N~0I8 zw|E?I8!{$Gry96!CafLs+KV63GRApDkf8-DOuR=BjL+xGIKL-EU^qwS@Y1yB7W9_m z*>=sQe6BiNAXfM^6=!fE+7bnOOYj5ViR42t;I_sQ zWO$k+%aC1>5-DIkA9E0jR?;vNZB?^@8noeN#qMEW|(w&+kLal$v_?DGpnM z*`3zI3sbRH5kj&2cCtQ#7=Xpf;H>Vt;((HDso25c_ zD^4cg@KYJ~{6}w*#20Fe7x15DSB1ica(Ky52TA&il{PPIn!-@!*HItKz}Yz{jwx1Q zobFRNaJV3(;zwNY=JSf#6u>eV(M+`#+neAx^F!<5n29f;pZ(%Fy=8Np3eechhzBR( zP);G8y_`RI0{=*!z&u~( z7~Us-^V{_@^9}IzzYJJ*4Kr-PKYLF|S*m0DLkd|;$MClma-_iBc0YqvPQ|+a;o?bd z5FPrQT)Gtr*d+fMx_5cx^xkk*$m%=hY?r4q?$39}6KTAOE*JN+i|dqS5hqk9WssvX zCLgTvp{#Lqg6jU=#Nx%Bg&n6&aQk|5&1?aPwr}WsKD*+sgm}HYNdu%Jny(~x$%ft} z59W8x@Kn<;k1;9i#_+fnca}GL1R1`9Ob>R0aylg|E3&yB-dgLv;pX7Xfn1NcVKcZ0 zg&f@@2=VIWyEiYCr|;hV`Pny0p7DK5>nzVQz7GpP*qX}_MreJ6MSnj_`Y1y2&nWC2 zCCldL*35bf8z1moXWt%Lye!}Q7`PMZ-}%hNh70DiBac@pYyJ2;(tKth*(V2g9dz9` z)LWFlQHcJN)%7e?vUJ8Qr{y^F+%Y$xsfBaQX)QhRa12#>ZY$U9&_vq(?A*!l+n4m1 z#xVjTUq99FMS%2h$#F!0#*Z&VekkU6s*oN@I%*0*_f=a5MA_0Ql^vf_=KRnQL~ddI z<2B_6M^)!lT?1xx!MB8yg05L``UvY^exm9~9wo3u_^I$}EWLHb7{^`FT?OgES22{Y z0#|WLBG7ar8e|6sM5UlCa>zUwxz#0H84pg1KU9pcT6gM*8~+9r9!sQqJ2{ZabsTBB z?iJ~88i?G;%{90$^NKj!R?7$I2xn8euHZYs(n+hL2_vU4E@EE$tTtdJNFCGmtk#Y@ zisAOdyJy@RBaFAYnc!GEgF*qkdpN*C;uypMCCcu~JCanag5UA5SIF_aN14iX2#+9L zy1I%2Sjx-iJZtLc(xufDkK#K^4}TU8dMYGXZa4R!UPsR?Vi|2bW+v9BVv^Bumf5tx z1!cOOt+$CHYJv)Z#L#fy@v)lLW)E3P@L|U{)Q(T0c4PhC;rs7i6pT1t@lWjT zis_(px@Os;yXZ7b9cu!B-iDj)nm$CQ>xKt)$?JhTKQ?;D-sn}!B@TT)ao>7i3v30G zpIh!4Px3knb}Yz{5c?gOb9>n)^29C340st|fF33yyA z=F`sg<|v7GM>*4*XWnrkj&vUB*csBPO)X?7J{{bG?z+{tzrh(rGf}69ofT&vNtij! zN^~FNh&AF);C|}<9Y2uAXJMu#>6k!F5psyxM~|Qz65CHHQC^m|)ae$q;&?mGGP5g9 ze8g4q{slU+r}{nxs+Nd8o*MDO-s#@p2ophFS?goY(S_ejrrMDl1l97~!%OytiupR? zNBi@y!4@u}!kEU1IF8Ri@_vg4-@$Oj=%gxgvj7c5NwHV+yASyh*zTm#KK$&M_0t$^r$H zc_8U6nQxC`x${edj=GoP`zJott+RDHEn0o#Ww`if;r(J?ovc9R$rb%ZluCur{(M_C zzcQLa1=!;CgqKPBPWrr3i#2hRaxtllujI=?e@OJs-XRq^~ga6ca-u|VKC5~%5?k%?j3WH{zYv)>t^0t0N z8`=AiBR0iW2Bloha<$4vsynFIf#6K@^XkC;ySmsFb%vtmtD3H^*7SBpKNU!& zs}`@;%UhU;*U3eRy&W@!6|HwAKDrdJd_Gd(4kdnghUoq*JT#qWv@k0)O-$JSlP2Mp< zzQboOo~*XPe3o2;t9EB}!YJ_oXqmDw55FSokJ0keqEQAiXIGdicgroSj|Ni%TX_WK z2IPWKTHlE(%RKaT1IFoW1)k%O4~HTuSF;nGOC<*m7{jnSFX;UI=f%&9cd+rw2SZ7= ztJRW4(%7L-=nrvPn&s^_+h1uRavtenYe;?~F)Qv4E?<7SoWZeDD7sS7Wp_#@yRr6M zVGN2o(yY|Wd@f?kkodIRUR^6se}(9t^3`_1lL6AKPgY!-B@blX@a^(S*!rx+tW(l5 z(-D&bsMC(;?K7d@fCD~J&YnMe^N2TEeg0w*t=I);oaV(N-j|Ob3pG$UdJ^R&uY66T zFCIVsd7&zgAJ+ou@#8PD`!M&jSPK!&y1p+o+qzd`-{{x_rCXaqAMc;_EeBQkSV9aD z_$=^IUmJ)q@Dx|`r_fey?3gw6t{M+6@VbjQ7MrR$Bwgy1{NyulX?LnNUBpTqomWU_ zEtIN7CoNOTel7BSw*yn?S(wc`@0J^|&a#x3`4YGT1C4^>)EMt4b9x1aTOms{?avz0 zfFzW0b=N$*$vRBRoIis;g;Cux-^j|2Yy3Oi?Ek#@cY2I)cdPGTl%Ml&{CsktfMRI! z`RdO_CjrS+3O`~v-9&YT%&oHhq`uuv_d@ybau!w!;j6_+gt@-7pCmQaXk?@*PiPWw zMcqc&Po(S?u-$})m*-jaU6e50*SqyqE>U<;MvHcDAa$kbZm06rv^=RN5Y(PiiCKN` zz_Xa&#K6}u`p=HJP5C#hOY4mi+*K~BVIPw2`)aH^n}&yAvwaRevLyMWT9{Hr&C+gZ zT4&KC^SzrS#cbEfZ0!VjWG2gV9}*+=^WL!moy}@F9vd`Hk(iShyH9x5=KQoWuTs?WNwN6FSz8D@*iW3b|UI>BjXVMv-i9ZonP$tDsW; z0v6;iXQdY&?HZaT%-wmj+T3xHM<@3h8f+K8W7e5?Utm+K+xwtlGMl*U=o-ZB!Z%Hj z6PF%W@U30++PQY(a<|_}*QM))sr%mLY?=O3Zy>Ky!)!G$-3VqS$UM|vlcW@yNF=^Z zZXp4N1hY9iNV%6Ha576?r;c%PaayI%AqK`HwUB#Id{7?L6L3i1%u;X7{wK1FCtj!S z^L@!{V|L8bozbIx^mW0yB75l}ym$1MjYy&)5qF#Y#70Fa5Gu^PVdY0>FlpAFb;$WE z9vg%7YzuW4Lz+b@;8%rjJd#3bW9Jk=UtahICFPlG_A#)?7N>JbuhFO(0eU zLqAIgdIx|A64MtEWGF2ZXcgis2?T{$v1s_=8wT=15DxxeIuEHntVTHxCUHC^G=G;t zfXNR5&f+aQ`$0;GqKXI%pYC|q?jxolDP`}c53<%?juri!jU^xCtn4ztZO2n(xQ{T} zd93(=p-vMoDgsd!UtU)x4H!chJLXPkpC^7^80Rop8wFH9g-jkJrFo2W7rajA5BPzN zcT0d4S~kxi%$hI;MIOPP$&>3H1S=UvS=*unCcJH(gGlRHe5VvGS}ui%m~(Be4UCTf zFzCg6ZhZRsWf^VVlhbZ2ORa?LTp0)jR#5pWl{`978ME{0Bll16AH_J=mG8NEQR%jw zz&|el;|y6q1H;TQp3~kyknW1|)Jtd@qP&y?`8#quyJBYx;RV)QLN^=UP0)9Rl!%0N zqzDTGMn%N{MzUK6$b!G0UiT(Q0g%~NjS&m$NFmCXV2uH|H_MMy%yRrq4&$E}HZTR# za)o_H!KPp3hd0&8MKf5R$POGcM1$oohm0F+=IFfSg=MTWt{V~+Prxt;>Gg7+n%S8p z3aL_Heu_4j9oqPQ#ynrvnuszxD{JxTYWBmru}I+wBPP#XxRBuSdhS!0*_wBfdub=0TCocQS-QOUO$UBe0Hm! zn<{wU^hYUON6t$9OLb6bY(M2~?{T&!GSP}Fp>hU5VWH*uosz8^Y{XQav7(BkFt&Jn z;aj>74LRpxuOs^B(+pG~pvsnQYxu#1C2UKU3zm%w9hIiYKYRY2%8r@<4Sc&kMSgO# z`3~7Vmfq$r9A**bO+T!_^<&n1`P~iqan@cwYJY@jMH0=!q_=ri4# zS=9wK6F6N%!I|5zq%uOx#w@y-EoLCNSVYwSQdnIzF+0D37m~`Z4CZsTAEUp(J1oGbT{c0CL8L*R+&l< z47kcba>2tw(>`C2d9h$V(|e6Rq>aPt@0M3rbNc0W zvsoUxkgyiN-MJtdq|f?bmQ-JPp8wPdr48qLFi&qwQo}5HR+CbZyds#)6UHOv+#&Q6=brZ+EF0_`+H&zGP5O8lon`qS z@Xu2$FVJ5N{r~8Ra@sNgO(!!C8GzcOwl&9dWg0EFnVtD8f#$$tyT!M~08}T6^kjad>2p&2k98;S4Cffjp-@zWA@jL(G*gra|}vKbfa2z6t?G;33Ex>~b57vY{xGn7lDsU3vP!?cR2wo%_=2D)q}DyPu3X3)tj8wbp? zsmxjR&7^IbH&xB5pXLWzw;F2|Wb853F84aJzQKnfPQ|Cm65lV%fSkaJlhv#cRU4`c zO>rhIOhX@V2l|In31-+8v%dy7-Jh}dO}m;E-+<|Ik)dgC!ugN9id8=OiC@ll{)=;- zBgf}J@hrJ8G~E}faRCsSFYg##_L1{{B+JF0DpPFA_m787TCMi?37dF-B=hZ_m?@TH zvYl@-f|K{}7xdHL;FYu5i7YQi!;nYQqBQM$AlQn)+Oo^wLvhgn|Djk4_wAq*j@`Ts zQjMaS^L;XKhkZ*ISDWi<=5vi;pC;AKQMj%z|53+HUBaZ$fXqdj6=h&-RFjeNXHPnt zVYMG#-rQ_?B9fTVs;!Co%mtciqrWwGkSM{~jlfcB0%o+jvKfwnr@9cl46m)8oMSLt zj5c8yZH-PHjX~M&?2g79jn$n`70qai8}^uN_UhCwZ{rXQw`4fyt9{MFjWDfxT4OB? zW#+2X>Cn;LRHs~jjoz$- zyjll%w=iC=wt!-T*GtM3CGQ1m<*30cb|6a1_XNW=gLsGf%z|t)Cfc{Y=Ku=IQe6R(HO)r+cVwPTGJyB>JS!vcQzG5&u~i zKvWh|FB(7zpJxyGXctAP+Lg@{ifAG8*_879THn}RAi>@fpTep>3*AEBHHr>^DQ*dC zfn2cfIf~((i(CC7Ekc$jL0*W89L@4Gb$&%bYCfcYd-1M;jwO|RJG+@}{{H$cP}=oW zyv)Z>{2b-W#jDw(gOZ)`{)%6f$Uc4t|50DPQlseI*I$2ebMr-#{NE;SSOrOOIl~u< z*)*-)(B*dXasg_+1h*!m)EYX0lBhk%n=aZazvcpXEu4_JU=FaxxGhT;T5Y6W`9+1n zgq)Im%E)p^>!ZFc{regdzs@c`d>R8`dg<&}vpM|1zWuMuzwgHM?FNOM1r(r&SFyxM7mH`0gpllnJn-?m-#j?d7d$4c@vv9;O-8PP4 z%bGasfts+l$1!tI14ld&8i8MfgX)X&B_(n@}qdxYb5B)b7wBKJVc0sWN++u_)@Lvuyv z2OHuuvLXJ65wI-!oB{SCC|s{OybWQXZHOiZ%J0I67$}zYJ2pE8UXrEnm_BG}?scQ} zLoDN%OLR@m{fD*rVQrrD+FZK0>{zKO_!apfHD%(dDIqV0BQjI^r=+BVnhQc-xD zX(q};8p=Z&$}mP9_Bx&etvUQ>9?ZDods;;Gt_R!g!FHRp?Ur2?J)*s)KNxHe2HU+F zY)ynb2^NU7>A0~TGK(jfS=@Tp-oakE*0%q6##>W?p#tlG5?({*o9aQr8k&akCHYas zhC*QJ+uuo^a?H+;zFse*ZI~S+O&915`AE;2&RITDYz}giP1FCeCtmit>x<^>WFlhgwnTY=Nj1Rd?UH`s|u4uIO$W{zs1`AfUJ-gzx=3c;E2`zTNm*`#rD&>q{>cOw`;6>lrMTF^vT)W<2ukqUR z$u`J&cqHA|#kU(kDBZp9i;bQ=Ixm0Y!@<4G@llc+z$z_yR%+yL>*aPe9Jbz<+6Czu z9zF~@5oKRcuGl9s)niu!lyJnaEoAq>tfF3%6J6ZS*2@K3Ei#Mn6<=r8O~sPrJFD;w z=&E)3Gl%zD#bA}{-Te#w<|@1&x= zVebAlg z9o{KlabNW!yc?!hz6OOqM!&=vn?rR>&!TBNYem&duKUxA;)=+FO0DZK#GDEn(A}Q( zCmLL2yTNL$;{D1n>TEFwdxrTQPA|kZB!by6xhUCKHL-$|%Y8`-Un)MVd%Ka7qO;_5 zZ!u1ZS-@@ap}pOFGmWhwx_ft5&`iixtZH`C>Kw?;?@BqcGFzqU#)sCp+xJ>91nm01 zZq}{(By>;J-1bUFyKrf-KU+-w`kF%}KgD|-G(Yso$gUJ|K8$VAWsRQQS&EaQkE^Nx zNUwFyC7%#85A;)(>#~4ex!pf;DqV|VA28gQ;EpYJDK!c(&E`!#P>NoI<01p*Lm1ah z?Q&F*{w=>~{3$rzuNHO2b0kNkX`VkIjRQ#ujgRju~Fwq zYw@VT5LA8A#XiDh#r;Qdl5V>qD#Pseb(Ndjlk~csR4tX(Ygf*ef{-Oo;$aHSZoyAIc6tIyEKpjw6=Rpfsh^uq!=}=4Z*xbN^pA8 zyKUBkxqDl`h2CT9O_~MOEI@XE?`v2eTF7RL)ppZ5$1)AhR+|>0{WAJbT8X>X$`bJ! znA^Dvu1LsUjB`4 zF3Eg;xib$hnSF?}3qaj>o0vn@fL$)$sRV_XOE<2w9l>9V<6Sg>Lro;Xz=-Y)n7sSbop}$(LFDVHdD7)Ps{&a`P(+}`x8E>$jG&kS5a&xNEC()XXn5WQl)!ux?55S+D zX1(1$CrQjp_cSH!UN|p}R_X+mn;>fM|LSAuwzAf~(Z65D00tzzv}7V2&64MI4#tB# zOW-ME^L<-cQ#XDM+^Xd z3OIlz4B2l-)0PKtcK_!Aoc9e*Zhw74?^-Sl9d-8HZ4$b2xJR15aG6#kF~{#Jfl%S^ zcXAbR^H*fGLTqVp*UI*03(~!=Mz)D~R>znO$XFLgVj*pHOcoNJsKJi1O>jz;HkR*U zqRM%a**M=HUr#p^;%QEj&8ua^(?2IQh-JnmHj+i=o_!T5J!2%Xt;IYnJSI^4FTGA|0s`ERA?CkGU-j#$Kqz!76XmM7^4FpDT%s ztfd+Uam7Dew%fV4xZYAe{Q%$n--W_yf2nX8;@lbO@t0jB$w83U&|C*Q1641nN7cmd`gpFhNU@ zPe)AS0lsh31lWmLUOeG=LR|5D=&5m)B`;5fpIx1csc=MK+D(!|4VtMi)}2y5*c{P& zo~R_YOT5*$`((PXKG%JUOkxu3hjLi;Vz4_Cc2xFINe-iNx7==UM$cf}VM%`*c+TpF z<9>ponWE|3o`@1(TXD?s9vHk&$M=JKcM|U1!m+zG`|d5|(SC4o)Xj|yPVT|b zTS24YY(?hxlInovN;U!O_wElJ%r(^QA)UChi09LTyXXgzz0${9lr}Mxuc&y~x|Bm( z>m~w^X!b%|=Is7FhHE=}0nxT(9y{hF@`0Pk;wfd6w3Wo<-S_yPX=~kG(Qqtz02a!P zA~`A9u|sgNYY@qS?1t;)1-Mr3F8}&3Fm%ttC7IJCq-VXt1vMw^Sg1fZ*eMzK!eOmv zi6^{GRvzc{(QguK_wJ;g)WVe25#qyn+%A%Ex#U%R((u&4{W|zY3gq0fDSs#a!yw%E zAnZ;P=VNf6`^=rEWr%4pZ4Egm?))f2d^>He<1i+!V+L3-N-M-94Ar)v;KWT-VVYj1 zmk4DdJR~3dfszki|InR$(0M7X%=NS#I@`qy>s&r}r1R3*Y4bh{5$gV(=2f)rJtr_J z9q*v*-ZAnCorryt-WYSqznb6j6HRcF4(JQ)|0;rW#AE_yjpbS^W?d@-9UNqJNk7jD!wsGJ8tnp>Ht7yA=#E}y zsz%We#X2Lpf@ps7eS@`kBv4jA^x^Otwdkvu@=D?Row0Wnlfh~p56@GOWNVztD@b-}Ht0V#jF+pyukX?B)Er zu*NpB(tMf7wM4f)uP91i7szc~Q9icZ4OcV9yi9KcO{pMw^Ic}h)sRh0%{Et=A>}P# z>JyA*17}%Hgfd(FR|$@i?P|4LZw6*5FP08_|MUxg<=4`(g1rqd1ERU{1?K%`0spM0 zf+gi+u`uv8ov%UwBwe59AGnB?VRDhA+6d6yUd2(c|}1q!Y-ez>F~U>16X`&&h!+uMmsm1bKP~%4a;`wu9r%SM}JKcUNFhFe9tir z*Y#b;vNhfFtdou#A7JU5OO~7up+Qf(<}l1T&?fmL_e>SXm_nvnC8yWXs>m6 z+c;NV)Ah|vT>QzlD2OabZ@b|_ zu)1$p=fFkt)hgx7SW>as5bXC*UF-IF;r1-HvaDypmR+s2D#*nUz|BW?&&v`-T631U zbKty!;j$*~(!2IY@hN=gMwo~Dd^IcxCvO|~k%bxywGWHwlpQQH^FTQ5(i0NQV6j!r zQw{B%rhUQwU;n@Rz|9Pl`m*u+70XY+J-B(EUo6;!bx|q5pI0)us@v;8?_mf5Xt-8I!OXfEw^XxjRPAk9o=Wn0gExyOSzV-kM zJA3z=76ZF_{RwXAuD`jsj=3t~9*?Q(q1U?-n}XlhoxYF^^KhqcRvvkXJADPx`5#aD zmTUGaA9@ky{zF{vTgKD?*ZVfy-rL^Q$G`aY$T$7Q+XbI8p(%9F+^^8$I?S(9KDkA- z+cdF_)K#tB*)96RCC5Wta(uuY#sh=q^Sk62chzt2n|zO`lw-`Zmt2Z&c(~+pQkPt&cfUPcZn-yuJzQ>C0*WhcLw&g1QsQz;S^Izb z_gqdSblxNK`)~p0q%Pn9k3ew0MC=`r7yRwnUPrte^5NFdhg(Byk?~`&{u)9?(ont) z*80J49ri9taRk(`F0Wx8Z=V9N$0&;jCk?ADrLA<9ksW<&zCf+H*Q8Gv-ZOvb!*@r% zTk*#)-(0?xxl!)nPQ^xKJlv^x(4C5>FcB7xEgbn8MFxD-Rf>JDpQ~urF;6%=nbbXy zMZq8Le;nifN7M=MlbOsHde?*OSq<{w`(qAb`T)lHt7$eU*b|VAC3~67q4gr=Y6`-a zzJy#F<%c)lPMXQok)o8GC`#%@nKI)5T;)e*@GGw&{}2|%NO}4EGvWA$gsyo=?A|#Z zu|(x(QADi83LVN$%1+d=1-;cmYPxr}Xky*t-Lqmt#qE$u-apG2`+Q5xPyRNygVx?7 zmqP5b(jJ+mq1M$Svw83;dT;#oTr+>q6)$_bOkT#9q=?E(Dyr}lGR$YmB~42hb{=}g zR`$+R;I3xt6&Tnyo780cw;P3z)ic$3qhR zWd-4U+>I9}grB_VL=UFdA;v=HosQF-yni>h89=ylf;^@Mws1FPt2Q78@(^vxVEi&3 zr$9@s+kITG_*d!1wP9mi_wz$tm(RJb%OGW4kX2nCin<)Rs7v{WhuSHa+9}4-Yp3j= ztCBz2Y1~8Yl*Vs7)J}P*o$@)>PN|k7kxM+5uS}8_hzJR*XqmcXlJrzEu9QD3Z)jfjRsok8(^_7rB&`H+uCVi1`RA@^R|{!{fq1>VDU=yt^*k7hqJ&EO zwqD8h|NQ6|vkaBgxs)>aM1fDxgnfuN$3}u3AzUiqHi7O?Hhix6!&OabsEi_ptLFTr zIL`~+%15VFG8>xt@(uLJAO%&NbLH#1U_Fb9XYm*lJNGT9_L^a>(0q;t!3jgcJr`Cf zA-27`O8@F9c2+$_`-4_bd9g^cA|?%(gE>){NPNo60V0mc!)xu%1SOu6D>hScIlyC} z6sA5gZ(Yv-W_Qaid~?Cc(uwthq@?|*7E^%QSdfI{}L(20VPuQ-j%TZe_th1 z%!d*w$0(7Kl`Lhx|M`q8Ldpxn{Yuwh0r6<`AD~o98C%CLmD1Ja4<%E|)6+xAltYSA z(Km+K;g#^jYGm}sx&|PR$S69DX^_DezuxFgH zLbgZNrtvV8DTXpduAPQ5#ZabD#W0j9qR}*zDY7HSQYSizjbGI&ABHl;P^M7mvnpkZ z{yreP14Er6{$r?9GWNg($(B>=6zqA!iwt#&p-xFHqmp8&%@NeZgPJr+b#eownv>a3 zr?iNg#89V5hs98*Z0-EH6)#Tr>CY`O>a!qHy=)#(REim*Kym{>r}m7bq3%a7D-i=K zWgZc2b=>3;;*yy8R%k+E?vc$TIw&e^!BD3d>J&qrVyIILb&8=*(OfMht0E6d;)n`~ zc#B{ai{mO7)d$-FL#I;kkD*f`qp%?v>X|zz%{{K6Q%R4Bp;Iw*D(X{cmFQHOSZfW% zilJDkpJL_431-8ok1Pte&Je;3$4`N~IFglLvHN$t`!n8sM6-ey@Zb5*hG%7ccvgze zc@5eJY1+`R7#fz;KZb_IN~YH_pH+GQOEf6T0OTuHnEtob4&lKFalR8B+&zeIV74Dp}c^FYFxWJvnU3Y8SaJOWPuiwzp;WG{C&_P)wI(d53Zcd~l`|LaLEok$PuMMqiwM)_-} z_o@{Vk+s8NvW%5JOvZl-U<*SzmL)}W(h(DNakmsW{f4MTUfU))PKKz3=!zj~@#Ar{ zO;d;n>F1jKA(=_+%?X>zwyz+vA!=cREgL`i8|c7GyT8vTMS^v}e;W3NBRgZo3ST7+ zBh?{9=_&J}oI~%6rbB65IzD#<;i|vV!YmF$hGNK23>k{7pygjx%VZYO3@x`}CVA$6 zzzIaoa;}op%Y8a*ljRZQKDZ%6F=Qx)48@S4Xjv_(;o-4845DDQnRL>y7cO#Coa~() z1hB0dSr_LkBJq0&8YQPp3zt~^V&zK>u&9{6v?xx8|=rcFenqkyi?wv zckDUDc|-eQyjqd94kPZUnCQ5<82Z5i)ylf_nP*iMXITRghRV5PVVr((3}U~JiDR+A3agWiF9S-=I8k$YBNI zkkq{zj{JHNha4H=kS2&j$RBUtyf_=%{^Mpahr~6hY37jl02}I%xal#}A#qhQ)FFmC zBon?>OA<^c2gYvO-r2)t_tRo0B^SZEM;UM@F@uGJ;|X~?m%=Q1@z3~(b;313V%1|Y z4>T}>3wbfx-imypKb)I=f?oiXoSVs-#!d}&2ptAP9g?G@T=zj6-b%5rs!DiJe^4>JvCrS%-vS_>{P9iw1tTCy$59KL{r_`kK8{Lmjd{ z)FDM)e|B@iR88!)vhMsN#&eJ{;W%(jSqu~g0(M@`WE8xe$m5N2mrKDOB^J%xIcc~< z68qY4unl*J;SMp}A#ui&V15&BH(*mE{&_KKj;Q5>H*tgzadnQCFK}b8vRKl{AVXP1e2LYyAosQe;27h(;(t(`x& z;_-!_{@fCyF$+S-%O>Z5EDs*>!yr~8H=uE9&q$8we)P)rMI#pM|MHhJx%EcQ`^yWY zwg>w$i3i5TZ5}vK-}hr!k3tg?t|(|lIP)oNAx4me_ePH+y>|-@p^ykG+(8mwv-yKG zEj7!!4fVfSeiPX=+aQ*c)Z-hj6T@|4xK0e$iI(k>njaov#ITgrU<@%FC+cIYKE#IO zL~%THeWi$nLvWYMGo7S-u4V9@XgtXhSx*vD8txMXW1vmZLT*as;d!ssD}&VIzgCsNL8N^oxm6L@6{$aiNn_!Bmt>KX=8X!t|XQ%(H`@-_hUFuiVcw}be;ptFBdO=$#%0kC$G8z zUzrPaM?AdB9zh6crN_zHoATJHS240LMBvmBLMLguIJ~xeyilG52|r*fak{qE&5a;H z=OD^=ip$GG)UXk?=tjeQlK96kpR|Da%S`!LKWhWTWDm{0P< zlGC-7-5{6!B!l>bf&tKtMKGHbrOBlOfTi=r5wDChmtay*4tq(2#Te?6c2bvw@3kca zCW1UmpfTaoPV!S`S}>cj*inJ3xXQnuf*o+KUFu5o5Bf*D2dBIJqw9l%AISgyJI&3* z{S0~LK|1%K0|?0MJWR;WqVu8I7CA-OVe;R=DEdS_7f5iDr<2MwCkziT^d|AKHuNTq z(3>39O>dIz0F>u9IjX>KlDb#JU0*MLlVihg(geTBbMK3Tgg!4}#t@so2@EH3U22-) zBss)}<0Ni=497`anGDB?;W!EZF&rm`<3#hs#Zo+SvGmyHJ25tgR3?3r>LGcz;W!Zo z#BiJ#juXRivfdmg#eTnGIWa6JcVq7>Y#-f;iwZB>+lIPgSWXPfiD5Zu1J!THZ0m8yOx@@I*{FMsQRe!C8NgQcb2CjvM`^0dcw1WHOmMi4K_)qkv zKw0_|SudNzev*26Lw;h&Pd1SJMAvIvI$uYbwCjZn$wQCA(G3BYHcM@&P|A$4`o)F{ zrD-Y@VO1~9gd*__7EXks@f^$JK}iT{XiyrXL8-b(Z!Qx`r3KiKq8L(?EJZ9&iV~X5 zJEoEgBS;B*=97Waq$CdoSDGw^qczl0=2E7l)~{lMfwUQ3RnnB?OJ8@^l(a`>NK=|6 zP0^lShBKuqXG#f+mfW~J`8z^Ax~K!@|2=@ z=ep=qLjRd#I@$aw;iYl!b}FGWcrdS-0~5 z&Y#g!OR3IiGV!**}DsYG-O2xR0MRW z1b@mx$xXPZhQp+J4wF2!$fGdH*_)@BObXSq}OM_5w2t>@m;aPpuM$nxqkGlHqSm- zV#rCFAt#|`n!NR2?c2}u>1Gg=#Pz9pf|B$wZv;t6;S(i?t=5N@IKjBbpdK=&qukRs zqW$PX)V-22H2<#u2=^=(=hpUb?=Q}G_$a^&x6Z(%Kfyi^+_mt+*@I17`5DY!*)~yo zRN|>&_2`3k`kCgqT?y^s(0zS?J)_0*GGPA(fANiz_JE|)J8Bw}Si3MNxR6#Kig0&% zkIh=xC>xI03<58|^nm1$sVmK+7=y;HP_Mc1`E?BwiHr!?%sIq|p&iL4m_)JQ0@xhK zm?f=kg2;Sz$79R+M$i#N2oeAR-u47Y&T#7?tF`c$yTb^VE>sOE zSp`nKnAf znDq^3qG5O`;PJ?Hx|-whDA+113LHywZ%$aH4V$9K5{I}s!Hc)vic%+?{OTe%L7UP) z93nADK9hii0wgE+u>^}r|F9++lcg||eE9X!kdhcul2(wCe7W%#$47#SA2dltl9*YW z!$KlHxFH}h1SA_sK$0p$uG>Nyy4JaSz1c?uIKbkksBMuGSKGN7STW9_2_RpJ5wmjBTXSioD5GBNbO$LpNgRM(U>|!1h`2fxW!|TZ?CKGT^)ha}{)YU}Sebb*{q8sPUXL#rKR)NYW(T;>iqiV{%IKK%Gf9Jt-z-mja`Xsy- zw613Nv7>g%iHC}}vt1(Y z)bnQ$FhbLGTPp9j-N#_}5n@}$B!_61oc;x~U9uXrQDBxwwaenB+AQMl&g6dfus|VI zFa2J#bwf9-<))1}ACdQO5s{-4_GW>8%6u4ccbR)EFCe3ef6N()?ZNcE4Qpu0zS`w(YYNz@WYIVB`@ zgXcB`VJYA@xxzyD^w_Z{y3%T$1vWGd=7BQQQO69e+tpFI?0XBKl=l!hJsuKQ0YSrw zH-kUC=~PYe)WJh?H3Y|8QNKxhqpyw_YJ(bOki&(chw84Z2#3XG34b9X;4h>*ccg?) zYI*LuC}l;;W2Q|S*krAfQw7+Hy#i&m*F!7QlS>Jn)P^XPU`lm;DFauQo83~_G8!;7 zjIsnyxvb4;Da>+_PHqYOa>-t987y-Nj$>t9a|tqEGK`SmT;FCZAaNDYaEaoU0}yKv zxD6W$T~Kk!_ND^BxQwlJDX?)Fg6ad0OPH`_K*%MCSqhL`f}B;r$t8$e5vW|otf~P6 zEMsCTo7sxO*D%y&hPx`5SzV_~OI;1vtO4BA_D4$Gpgny`fSq;B@}}Ifwt}fDc+I&p zwx62BX_A1@YC$!B*zT+;lt#!YS4UTFy*XJTd+NB#d;-rv*lZ?qa9Z1j=y&UmWlV=l zwljLs`8GwjhY|YxLThJjOOWh1j!m{6Tc5f;1r)C{b|1;hR~fe%xQl=m5`^-4aPYcQ zV}vF-cj;6-ytyC+0T_r00G0jg6Z_+0q#l&5sZF^jM(tFrO$<9%v(Zf*8nr5ObW zafQrS?%$dh$E43WbSHP-@(N@&oi5U#lEv2F!q-Ep3lwUU%3Gidz4Gc&dDwGv`%I0@ zx@%-6h-OTA%tDf?FGV~baR%suw-C{a*2QcpXEqMLBb_SGa=VPgses_ z+TGe`)rQWdZm=JFN9rT_P8rVZ*z?%~wjZ*f78&i3$JLa_+?ev1CykfKOcxQ+uVQqv zfby7`eVFo?rab04mB%cuvXiXqaF$yilaxq_7s&(gmRJM`Fbg6e1!UgBk0i3JJ}JrB$gUsDTSF(kZB; zmE(I0p}1&iUZa0m2Ij&=`Dcl$@z2M0fp|NVEmN-XzCI1|0#;`EaB z3F#dGVV;LI$+8N|Qo8({A~A6Md;=rtlNzs!tKgZTi+RO6@wNi+AXUWE5=^exoJ;k`4#+995F?;ZM?H}0(?(;~r9I@lW=@AXbj_WFlM$Fj;n zOb=e!0bw*dJvrzd9G@HL4z|Y@(lxz)-+_lCu?1@ zyTiS^>{iKMo!=*MzWH4XDo}b-e}U3`2d8|I(vu2BN>lf0Y)aOvNa?95Qd(<~QY^&# z97CNh;TX&Fop&Cbc5Fs{(zq%$R-aTp!lpFo>Xs(eEwQLweNv+aqbaedP-4;4NK82T z>1vOHnM{_7OR9h7DTN3^Z>1`zvWo##-kN;MZ#Q%ZOpV0C0|HYc(bPyZH4BV#g|D&0vu>(G78>iM1?nWx}NOFR7lL&rVtcV zt{(;4lJKIxiM4fAinhI_Nl^=_DHkf#kZTKs(%ll&RY_I|dWh5ubn+qNv{t9u(gR@3 zg<%ka^IaSQ!TpwB#5p3qm#v*Yx8k82pB7RdO(j3MgNJW;hBch~81~co++&@?Cf^+^#7Amyq-ZC9 zYA1VkKEz_}^+=~|-?yJsvzm;J;ZUCA)(4b z&sV4)qMq!(%2Q}rRjcyW=CD?hjmuQw!Xhq#A>UQBFvU}P1PfVY+;xhDII|(&6%93w za8y#+0l<~EQFqQ3_X9=IRE#H&%}$rGBClp^r?X0FLd;ERM`BQzrpL6mmbo(Q*E?I% zi)T}lrra{U$hjktP=5+-ugZ)`+2EC%HO*!ETuflsV2|B@WvFedlYTN95Fbi$0SkMK zZY`dJYDh?kFcyubDgdIf@acG3-^;v0%@^~VGy5H)98;)o?yJ$tSxce~OV;1Qymd7l zQp{6N<);hiw&*Mt@GW#cJjz;-ETB7OmwMF<@(L8g>7xaOl=0ds(4P6u5aJ}@-}dBb zc#ErgXmy4sB?yQ$yHpt- z?J<^!x*}x7%NC{t;G+yXC<&lL`Ph&MTtQ2~JoO4vhOe<9QE0-@(nmzA)@6foz(JGu z)ft7s$3ZIrK^;20@3kt*OLy!v`jXlRPM(cML(DpgyATk-_Q(>0{;C(WN_r~o+K0!E z!RzvhRL;S*&%zgT9$rV48j$P3BQ889ofW!$s#M<{e$su$7QNg9V?upZ>=#D7teqdH z)-6no;HQrr2aZ)ee-{TCLYk)!A3Hz)2vI^4E0{fv9k>AP$328$PDT(+Jofw_EdTyy zyMJ`lwfMhw{tw)Rt}wI;zOcpSfkozl_0|J zovY6-q36rL>Lr}+*N$KmbA73z<7AbYc!}Mw>LOFlK5OCP$~L-$m0pycu7{pf&suBP z>t-x=^EUg97q``c^%Wo;>kjW!wAID7Q|Z-|w4W6m$1+Akk%vx&gRT$__tg9<9gezq zjj0UmiV@e+GEHh~dU$YHbkV0~-eMK-`r@v_xr^QzXo=IR_`%L{Vg403G}1ruUDnx= z>}$!Fve%*z%dHs6ZJ7KFlb>PoQ{cZ!%);#a+)ZZkJ8hiFFP(0$Pxo=U04Bf8J`9te zVe(r8CO@^DMm-Y0kiv>@p)Iy^?oxigJLr>g;El5&MncW-x@!ef=hlVT7{b>UYx3sF z5{lswpL-{70(rb(Ye%=( ztUa6G3ayO@iQwd(Ji1}|tCi(%C3*QWdH0GKVJ@9p55#>kw0ugmd<8Gn(A#Zq-Hh$Y zXMl5MJ|5V#tj#=!4>$o-I)o{|+i`nj(VYaK4+3ua=W5C(ft<88GH-gkIu0@TJ+NB29@Y%@*%kbG5KD#U= zGIoHHoR)^qPNUe3;j@#uH6f1_k~T?;3{7M-O$jCCtWc7TfeMhGppR03$qk>K;j=S* zcIlZ|3!j~W+m_vwp|TVIF;sTVQQ2Jt{{@%jM&l$rZ7hdT90c>L=Z$p(hAk2 zK4oz_y|2BTnAnI%AunzvQzX@d@uW~+Zv0+jLK*tOXe)>>DfYqjBp*~tzf+Aq z#6Wg-5;>fCBFE-(!w(fwxz%Qkn8F=K!d}g6e?}b|bZyQ)*o@1b-|gZ*SkB4ZrouL~H z;iP>^0Px(fpe;yP~ZQTbIea7;YE-_^U?e!jz$u#jTmVged*8g=iDK zjbU@KI{)-;mQEMaA|e-<-}jhR2=FR~1ut7eX?i@MWhCW+dNec$rz6$Dk!FJ{dMp?P8Z4EAmxaRo#`itCU*)2 zZ$ih;9f&2XbN`au7`1B$^M~!u>Y5s8=KL@ASdoTlPJE0(vF^_yY?}sTOy=OlFM5|< zndK&pkS_1;fsghT07KwY<^b~5mAep}OD_Mt(&7$U#Z{jSyq**FFHW#;3Cm=7v1~;p)*@t=xo82UhY^#-Be+YSZ`Bs`Czy0~C*RNnH*L1{wlu44xfjV+t>@ht!s8_s2e;u zqdn`~nc40*_yO+BiVvV+kVI@I)7Gc&dsv2}pg@TG^N-GB@(Rol+I44O#BbpmUVDQ` zb>ldMyVM(haYkJ$@T@0qZsDWdj=jLK+!^%hJpTOSKD3-)1w<{uQoZtruI&kJLuD(I zo6E6W%L9W3Q%7m1ERAG~X_s!WM|SFHBY5>$v{e8`h!c^pSaWuq$W^4eQXoMR2H6khHz9dtu#c!n zL_!)DXzU@cIJv6#eLtHZ4HkN#&F!5%@z0A<1{oM{eb=3gp_#%5iH7H$awk8t7i%71 zv(3U9aLBy#rHyqlxMp@SbPjaea8rOIdA15srj5HC=@xHOQtI zhiuGDF%DCVBbrjC7>61R+_koHux3+?gC8D*=!z-Ek##g8Lvy*l(NhsMl`Mq{Cw%fh z|5QHFkwdWHh-RH%goiw$4<4PD?Dj2sT%grSkFZZa@7F9X96vKd0QMv3P&ses5mhLCNuN5&AcMMGi;*))~S5V9pE zl_6xSRf7y6oAP)VIw?aZWr*1fmsBO1t-P)4?{+YIj@3yn9SE29op+u)nL%?OUXzjr zhLxzjtVAs&5@M-E*(^aAxe%+LkUQ__%>a$A{>+`RAX}ehNsOFLl;X#?^R3fnDRx!8D#hvbsfl}M}!obx-y;$goE%(?}q4<#67C~AOxlkc)LR~3}3}CpqIcJQ==H?I*k8JJZQ52ZYl1Vqj(Df9@9ls>mhW^oK0)%Kj*&7 zc00~;LY|5uXp2E^V4BEsnU-1)p0L0!TL?ARx@0kW6#-P;>;^^nr+1^~b~Gr1uIJsL zC@`n)5e0ka_(<-xYz?JMRoYUhnvhavq=aB4he&mp5(vM(NE#uWNul3yOUT&e z6`p45)75M62)cEw2lx}1CPkHUup?HB29@FP+I$dDGBa# zBAu^@iK$`(72}fFJ5|60Dy?>TGb1*Xg}S9zH&jsBb`=a&KnnEchV;aZKYp>AE20Do z+NP@_2BpL)B~n@RU=e=57Lu?Cfz(lj3VRS$VRR6N1&E`CHY`A%GRVUM#43qGEJC|0 zZ2WahRB1C+QpgHJr!#zIk&5yT zV=PgO5ldM#T#ZpuEknOfPj(|U)?>`>#1v#S1sT_;AY&mVxprN~u>7JcaS~azwl9xX zFm-O-I~T$TZk}@LERynymUk!Va!V|xC|n)vS=Z1p*?n1-J(~6}V@k;(A;bS~{@H_as=<~WW5)mZfZW_m|e1h8P;#UH=m}8 zT&`8k$1677CDM^6lzg94zlrZoa0sUmH{cY>g$w)pDNK8Zoho6mw4>dF)7}2j^})dp z07=xcCd0PUP=m4 z;Jb%u&5F>limJ2FY?vaCsTJV6q?95rSa`+iC(6n#W>hx|Yc8_iGm15arBzn0$YaW{ zt6b$VcLgn9>@h8$GHF%{_a{R@)rX)Ge=xl8J zkDF2KF|JCD6?>G9u&MMY8!%Jp(Nubj=98)PXevEQ7tj=x*9m`&7Ht~TEw0?A(qoyD ziKfzHmPJbX45rd!$r_*>8OS(^;2V^yrvN-r3P>!b(xam5mff5w^Cd1j9_KwJk#?zJ?7&#eOj$F zySP(Of&^tvi;I2mCe9|6qHAN;$4k#2qNy6{DrwBdg?z}7F+!JpW9kRp#$0(2_{#m}^{1SH>;(SV~Yt>T8kfr*zNG{~( z56JNQ-K*Fzr%dizyUVmDOIaM3{1c zuqMibsV7>}*eViIb#Wd~uT0w%np}C~I1`I0=G`1a-hDb1M;JyMYa(t*lnRIySJWt1 zJZw3{1X+usshn7l!Ba-$%ALPtPy1Q20N#a(ShwCt=WT(#0#XufDs0~ee=Sy zvCqKTrjg*BNFur4{%4AkIobt`N3?^2Sn}1Yqnyg8!Mj0h}@i zSy}RVx$Fgu2mL+k9TtoyyR85d=n1Q|kV7930)(@77Xl|jAZu!nYRabB`4ZbnBEhTfqLdWYe?Gr{C)Pm1}5M;JHYicTf3Ls;1l_6Em$ zy_1u@{^8NFEbEqKYP_-o0?VA99P|#3PYw>@U#BO>y_4gUgs{ooV#jyJfF?O_JZd2R z$`dD%H=VS|q91ZIwkMzAFh=Hq!EQh6sGbK0@MP`Oy7DP!5iwj8<+&(&wQ*4tuE-UL zD0)?hC{j1;xX^1xMA0`y6txmjkQ%+53I z>5wB+VaH@Y0)Q*K7&_dVe9F!C-wiGH#xVtuxk47hyRr9GSn$Gok_%t&WcL96*OR%E zd>CWnC>oayO#s(6ln%&1PIHEHaskO?;xIY-wJyXgC@2B9SxWD24K!S^}T5zlGbYiYPtOk-rZH zALhM{Kj2tvXb)dqU%wk7UgrcetmEoCw~h-DAxdHOm-N1zC*$V|uRx(|c&@^5tWJ>u zQhBUJ$4@7#$BL>RFCW{|Xy<}KUu4{Kx{P@7`&P*MR(s*;vZw_klOGAMn7^%+yRDVC zty_asv!GmIG_7*2(YiZUt0}6NAzj$1YVFXPyH&0cT64d;wLoj`zC_K>y0uKbY~}*! z8T4v+mM9&mM24VQt5ct&KuHQWc#c*YeR*9$VE>1V`YMt%of4v04OCaF+n2{s?DI95 zkEiLNpnP7CznS1~gkM{>njd;QbS8_t5i)$DKk<+u#!WhI!tBueq}l8G$hjB2bSCm5~&tRI;gleEITu* zZf$ctlG+%gVovX(D5FaHQ|AsGE-U*{f7r0MsL6%G*Y1C@$4V~Htv4q&w^!`^%;6l8 z9??(c;7PPXBa&Wg3zVWc*d#(CTC|ZTb21Cbq3ksQ+1Hqpy!`21Ve_am{AG{xDr;>n z($gYEX0vNZcbyA?`|@_Ps>7=@|CTV?vad~AD@}~fDUr9;EtS^VZ$7Ox9l%>6lc2wd zwARc{Oj@f+Yh8o1R?W~&?aJs;QE^OZWHrQjPAl)1{1$a?h1m>ji3_YRu5Dq^8c&fm z38-yIKqbk-%gR6f6=D$I`FPNED{-DWIawO0NG(o4P03<1C)wC;b`|e_ZJCoAM!!N1 zWxq-eW$I=fe{IcjCb}}Tg=F7{}rbBeEN36=>|6=kut7XjU`g54ERQ5 zQ?6;L?>P5cJx~5;F2CHT$^&yHw1*U`UmqM8oG{(c0uUo~qO}JkmaAExHl%VuaT%#T z6d~2kJvM7$qii^0x&k}B(gTviL|D(z#5e(W1-AF9gL4fNhl~hVhk4+H`yR=rmpvC; z;8Jpz(6%fmKUs{Ai%%as01$so=_@%Qs3*NSdKbIB0!m3MUt%>%NmCAf(~`UsB&aG$ z-Yi2_Imz3UgBOn%#T}eDz2(P)rW|}DYyhwpJCjlHHX~x8AJWB3C;cB&>d#>#8AAOVe)U6za@ zNia+dgFPA%|HmGm14Ko>dQKU*S)I}1@-gj7UQ=8aq*B?wZ$Bxf!;oQC?Llvn>7-#a zngdbNd4T9n)z!H~L3SbWw%&T|+yd*!zVLGF>K=l;8hhg1tV|vDn3Xk!*NgnFl`OnY zs|mYzqJj?Zyg3Os`K#hGodw1erg^lMjzBD=s4=5kK_8I&HrhZYP@L?nW4(%$uU!Uh zG5iPxDzI8!XH;%+*{R?Uj*Td23vucYh1b2?V`(kqIjj)6E$c7ZHx3gU$ z;?(nJyF7TZMKXTdeGGOV;jm)te1+hZT}JP^tIn3O03lg4>#h!$$pXdt-I?4IptWhi z>e_CqSRfVfdI{#I1gp&=_$ag(ZWbX>tLCo`^UVUp(PF__fIMXwaTXv}Np_q?XmA69a&bQ zc_~Ka7QW3_hO5;#`ub;&5kQ^Ii5X)5h2)rJb>M6?8e-7Ie2SbO{>&LcoZ%x&kgN{{ zN@!ZU)FBqKQ zzp`NH??3LdYiLRvo72|C`495D!>J+O`{Vxf=gK7fJeY~cT?YHl+3aq@n3Q9Q);zFO zr&2C)exZLpsd0{>cb1_B2*lZy}XqU82@1S-4WF z>45GziT-S=%qOjRK(c5gPW!NA5y*h%!O4=K0o_BC1@62n9jGi&PF7EDmw@o!W-XPn z?8(IvMASdUs3_#J&=#GOjV0NKlBXPt#1FMkJQgXO-s#5zC!6j`$O1*vJ{4J@Y-LYK z7ARtc(~?EbjEaX6x+bua8LS|1#Ua%l)+#3|)pWF!q~%XnDxR~6D-q1AAJaMTy zL+f^R+H#Upgfl2rA}E6|Xp`?R6=EnZv7nDG=#*N}EVrOva$$uEdE_1vwc{*DuYzEB zuBK8-P_>+(UP(cPXNp%(EQ!fqOzvUJ&+s$Mbo=!wgof2J05lY(eDQ#VANs9CK0~qn zs{#LSMOs9mnl33dLNI+`@}^^_p%ZeIX{s}UiZ$n@?T(c$y!z~t8C-lNZZ$`5!TL2n zea)G@Waui+^EErO59h1ysr{by(w*32i*BREGy6h+g5DDQ7(dYmVcER4kQvc>umkJH zaVC~a3;+lVPO3*Z4MUcyy_SXoG*^U3PK2BY#O z%B8aCe6#3$+q2|G)t-P?kL=BCCrFGF^!pBAt-!IINr2SHXuqO%;k3+lCxK;KF_RnX zkg}ruHXN=`L0@0JS!t6rkuuZNMV2reG+)9nT{@#gNuR+YN*HE#VoDgA5{7F~!mvzr znPioRv)m$vvj=--*{nz%(!4%d02xH(@Zw1s3`qG3>l80n2ms0rRyhoJAA1(ol?Xe4 zodvInNF}%a&AN2Jz|mz6+MIz%_knfi!_Gv$HR@8CaIcalSC>@;9FJk`rI&MwDK=zE zE4HDuBJy=DueM@rF3D;y5|xtt5YD&umRC&4+}pD#3w=&q7nsL4Fp$3GL!b-@aR}p zYKx8MD?1wW);uCu%Nq}i;>pAn#7WdnOWJkOo4Fa= zlh1&}$^1A#2eSBiIT0T(*p@C_kh2sCe|(qJg5(7kuUG*{S-r@Otx`FttxBctx?Z7F z<)BKb%GAv|e)*b}sysBMDr+rONl5wrbMD@LW`5yDl%{xdCif;b02}_}zuL^?=)+0Ijw}Sa@eS#R->CT`;$zs3|X)TOyFu z@goCl$_o~vin4B%KE*7;u*_%k)jijzqUT>(B|Y=1zPE``W3_8~7R?Ji z3spQd;_cNuJM_)zBIk(SZX&zzZDI&lrS@&w%C6jGX)Z}R4**!nD!A~r#RvKINr9n8 zb+8n+s!JZTLOvQbKtqv-rX~)W&P`JDVl8Qyo!nJLm4T)L5*!5@mhSITKt`z53VX}vECM|kQC&@qv{5x zk*PVt83d_N+R=bBu@TM9)_RMmg6Q z^F}+ERMZ(#gc>*5y2V&ZY1tSRN}&G1L6x0vy>CYejDfA}2orD}N-qoR>=2VKlzA2n zDPZF}ygh!>25A zTGtkf%6915jYVme(bBB&QMfoNm&mHSW6WB>BzSF1s;2(c0$gfF!cXo6i%U5ZatkNt~Ric)VQiz#m2`c>{CnYKL%S)9gDb;xGBE=F> zP1)|Xg!CmfRj!JQsw)C7QEBC&vd^)Wl~W|l{@?)<^o{IQR-lB6cG>hs0wcA`q-(|k z398zzIG{!|1H!Xy{`ke}tx*Ae0qcB;%Dhc2_F5Hqn-W5ItI?z^CF1Jqb$oQH`!*zk zRu$idWGGXuw;@qVR^@FS4CG@qHkU7M&|`>IpnP$jQiZ6?Z5Ulda=Ub5WdCO8L#b5|wK z3@IW(UOBHTs5`<}58l@yy?JN{LtEv5UUke{a-63aK%jP{r&1A5s}^4KRq)ELr|Mw= zYMeSXhXRxg0w9O{?!*lqAaKVzcV=+lAN&Au0b$S`Ra*!MC_4Pl9la6<{#9!i$*90g zjj%S>2&;t&Rk1{vsSsB0EK7c6Duk7(5O&yng|IY>d5Llghl{8Xmf4A^5N0ZbtwDvb zBFb33YG9=Df>6tg7y0VaI$>Zp5dI3R{}J83U_PCC{*1(c+IM%bm}5;aAuZGbbLHH+ zchDp$7KZfh@kHgY!ys1pYe!OPOd@`G^Pa^cqXSm)D?qY%p)NA<5(85Q3>0I->wx7K z$GD<8ol^!3wlY(27M&%P150uEnsQ*K9GEEww#af|hqaXh%Ui@Nl>R!bQu-@(vyQ{P zW~IN5OzE$BOMf}D`80ADg3T!X71yE~N`Gk=dXkTRtyQqXt;BX%z-b3lzHS_gMBK;< zX(aYVNyjEpD@i&O3YEPIN2`UUzdk!p#D%U;1sZtn(9zd^JRidfut8$vTm6uiC@Lvt zMr74~)Nm=2$BryPfy44I*2THC{oDJC^Bw-kFm&B&I!&iD!t5{1B~KMY8oA9^2PPN2|7_kGw$x(Z%(im z_B9DU)ly(`M1;0z2V~t%EKAn*=m}m8;DY1v6U;DL&kGRB0RD~3HMv|6SAT91XYzIE zTsAn4Tq9^_emz4-M<9})7$9ddntI^8G%$Q6t8Px5ua}6(!|@cXqfuO4r`J!RVX9{3I&RguCkaSs!@}iVUrDVnbZNyDn>el3dyucyiVyOwv*yF&wNUjJP%QkV=MOQ)dide(n-{}? zykhvzZ20KHAQ>>eHg<5_ytx_%u7#I zt#5EQv?otP@`i@)WEggU8S3o$m3_^;LKj-aF3826uflhsLi43w_kvs=dnMH4n~A!S zcrkmVnkAf~l6?$$P0zjY81p&K#Qi>R5aRe!KlfVhYDRU*RL5+eca50V8rn@0aT9U7n1CVM~ zc^cx*#d?4Fdp&aS)|9)CdoDx>_ip>6|8Zh@KK-u+r|Yw)?b@BBovy{&PZM(0(m~fk z6SshFwzhUi7du_@pRJh>m$Gha?+#ntQGB~n7o*XaoZ-~e{t`0!Y3P+__Lg|_EPk#D za{_(wzLBN89^J}#u5v0SI3WvCv6$P_;7gD7)3}NydRwT9@xGf-vDkA_6|2c-2^oOyX8=l$gcVGNvLtaVonM347Ik0ZTz z>kIrB0Y3)233s6TE5C`nqU|jW?2x=aHc`+{JgDK;ZmXo*B_aPEvj6&o!Cr7087 zm2S--@zk=`2*gI{*QXX1Dga~UDn$=1s3?F=$&UqyLtlWp38)~_BC)CTY-y!(8f93p zGQ@U0EmQ~@=-C!iA>f~F5h;aKZw@@#bWy5Uxa!hs?10EvBkDOLO{N5L`Qqd056$FJ zDAwjo9dJ-s08OvVaBIdRN5?P2-QjP51=FaUQEI%4Ly=A0p>l@@QTWWglV5ho9GXcF z&4NyI#z!w+ze%H{IkBnLEI*qS4y4pl>e5BL)of1w5!CWiQ`PoPdfq@`qN(a;rRHw+ zHVz9o?@P>o-CdLI`}ULKrimbh8vCU(JF}8|vziV*tN5+zE_E$Oq010e_i%I>GHM@} zRw^-FR!YqS)MX5$=8@_$L@Wi!lr~I>-u3z{bL?7eNcD!b)Y;p@1uSzkTZ5457k^*K zoLmuwH|o@Kbt-lAyHu5`bQrvFb5-Vec;P~pKQLansFjb9mnd<`L*;ccH>Hl8%N{&y z3#xMny)b82{aAWoBI&Q{3lK`@=z3v7=^th)YS0tTbh|# z^mmJHoMWP>Ys}ZGQPs@N zsZqWqwg6a-8B;Gu-MpB3Iqh*MOud{Mb2qIs-xsZE22ltz%s}&=aJ1@y&+tD~H}pLQhq0{M3B%_F{sw;aFz) z0ghPt3AY;55YBtJ{e$hh_RUyy!E#se{qTsA zcD^4$x~0FLcxrBSJE?JipFN}0Rv*MVj4jkWLAoVro^0`1p4P?e#0qNN zi*GX@R zJ3v_Wy+6hfw5^BPY#RKqzrRI-Na0^UZ0-DcpyZx(rts)I{tt#?`<~E4`rBh?azA_6 zt|SBerw9KB2XC9j{ozKda+??^3;%H;VylMsP{{t^+0GK@6O(Z@Clfrxd>SR$T{*YD z1N%Mg*>rUa_D^9hDZ8Blkq|dnOuFHVZ-f9+RmPZ{uRw`Zi?3-+dve3vcgb92(W|1u zim{NN*ElK1i2p4j)!2-ijzqeCe@tOmQPJs-IcSLf6{@+u*`3qKTn zPRx61LYSG*#7ubiUVSD!IQFQ3z%~6cX_((GqgC(NQ&c;08N z5)ly0PMv>Zq!LCv+McLuDSZy6H*==@>IF4wRxGm&s4fF)j)$Hfs_ZDKQ~tlSU7Udn zW-C`(0LgQ5+{8G930o2YO2#4FB!@6LA&f)V#7r;_p>YUT!6BS7-PgJ~nAx*A;R9e* zf&zwh8@F=P-O7A-tL<*(;(_7Z1B#W!h+jS3`0i*3sKo?=R$v`%7f75IZ$)5Y(M;I? zn)?ogL>~bfilM;so8Z=Wr(|T3rbqmdc|7}I!O0@^oA1r1sXJo7a*MUK5675aTtu?= zU%R)y7kGEGy-Np{xP9DLk_>)HQ}Fv6{&UpU19>CS3y~q%;#!w<)A|Sf!`*`({BQGs zYz3ug@ph!VsUWSGNw_wXaO1a3Wvc^+UikAdScO@P0*pc9I^I2E#IK#14Gz5>^JV}1 z>thF;(~q4WJ_7PSntE_9|FP5kNWp*dH7JZXpW!06y_N0SkSG`oejpq>KWN;9F%0CU zkDc$Il{8ShA|04!S!>Z1xOHYF zTC0_azEZOet?)X8uh6VQ8@(yY*($8b3iKNs7O~|ABFxP`Xq{G{eI(M-cpHtmhJRV3e+I1lOX9t_N({Ar;(DjCT78g(^vr*J&jOp=JDxC3859(b|47&FNT}PyZq0*g zg`4y{(hIE(eTZ5Eb^}<0U;*Oo#`afb8v2l+u8^#AjI6?awEZXePV-F%^kDnfc@X+j zDNsh{Zk6ohYJPX;e#0L2*q1l+VDBp|SKilPZ{o~MtibxgVyYXhwucKWKJGZ5%V9MG zj}r_Vts@uWqAiJ8NGKe<6n#t6KebTJmQk5YUQlQQN_0spIu$*-snu1!R+m@;uE|ne zVuuT@)TKm7t27F$!AILHqbjZ;+v`e~S_`ACr(~%WTPyXJtRfeIOu=de={2BBMZ#fq z@435fgR5Sw-3)t;!!9q3zRV$R-kV(v=W_-~`0M40P;B1#OJ~?D7D1a}Q>jUHeocku z;J?ofd&{HO3`K0`&ay1Krsh0a2Dzr1h-=ENdE*;uO+&3on3T*sFvOY#w#g7{wvSko z|6q7EH-TPxNxYh5ZCHO=%?)1y4XNg;n1O~#HO)LQl$r&qV_dB$t**wzYG}) z&6Qt-429;#*A>X#C9KKvlVtEPOV7G2J%&GXjbWNBr*TcJk^)DIF;r{7g;{u>VW==y z-Bd{(j5RS+a$ZYgnT%zUX^S~&T`;R7* zqWLWO>os(i@_$U}%cc8Qs#~SDAKEX4{~?<@VKt+Ehp}w3*3ntUgwrFmRAUu`KP>V# zE#8rJajrsLSQ3hv_i5X7N)WCIosy9RE=`|e zlY4dbsjXDUkz`G1((-AH6EnGm3ba%f*$VIGp8z2!mBjTMjy-8WCfEbwG-=Nuv3c7bf!GNB zsvNteZ5k3iYJeeNtXw76ru=Ye!CuU}X^S}Y1*n^V3L-7?7%n|qTB)2y85XPzv28#L z6(Y60ZIP+q8>SYCBqy40p@6Dn?JX2tMtI&LF{L15E9DdL=k;A}DL2n+dpbo~OB&dk z#Byf#{gRzzciCRLj)&2Z2&~m*iV!>nu<)PL?D@8>`P#du1z4?6CLJVYadMr_S|k%z zJb3Mm+&i~rFEK7y%ig3Y+(KSwT?=BPn0gNW+;kB=S*^7qc&bg1qgQznsafH*(%zUXXf26L^&E zJUX|X?@2bd!X_k{8_)`DAU?A+i^3MdYncS$IYh?2TVHN`I0)ip7KIx~S;bCs7AQQD zijJaCkl~{n1Q@m!JypXNNpn``TF&CBtZ>?=HjTwoJ{q>FWN-41`xKA*v^-@k4_VWl zUch-{VnXQdC2Zff6-hig1gX^6MU>gEl-#k@0I60Ix`N=Z4 zI_LVs+cz)T>s8038@An_Ry&Q*vrL6S#;Wjt&E1;4!wT#jN(XILTSL`X{2IbImm#Wd zVCOPq)DHD59q?I2O3mQUWelWdIOsA&EOo@WG<-liWOU(s5Z$=Jg$r0FthA;3qAGK8 zMHJqsQ_I!KV5|mXjWE8k?du#3Y$!&ydN^cj%uT5v&a$DL+JfqYbuP@=RS)!Bm`M7o z`T~T~2?kx5Q2ODaOLf;u?xq%OQA>xAE=y9qD8z+JSw75k$)dLY{g)3#twGccILb?- zytUx3)sWGOm}Mm}u@cNz5rC@*XVkELt-&SLbQZPTI86sj)AcFkl&IZfPQNq9vf$jd zUFY7#!kQp)6C}R8AaVHba-zg9Chp9&$L_x%Duj~<*LNvFX_z?Vq4bP& zid}ay2H9!p$464RaCA0xgZ(%cgz{j%Q$9cMU|C#jp9-RoC&NuVEwDJkOko#a7d?b1 z%}&wOL`!~^_#!zGQ%@f~Z}@KC!q}40vd0&bfYeGC!HGy6KtF9b8?w`Htz%E!543D2 zwoNN{_V9mG-}&M?UnRG2@(`}7QoI9HXiHE-p1&K)xz**0{%&kP-FV*TT~JOu|3(M|=TCPmv&1Jaq#`A1`nyADBX5wdD!);`0NCMV2;$AYU80o@8OJirs z9TUj90=>dC_6*5*en4C-@~wtM!FR~pU20!fYKRDy*EvTg9?}Z)gkG$JpKVUNwly`pbPJ&@5)R5cx{rfrC zkNr*wYbO5rDJE(sG)Ad0g=d_Nqv6~og}#K^>d9yBjGS-<#JkR{(BN2n6}I@Kv1SkU z%z`<5=icL5W<^_#fL0JA+yb;>GG51fweCFMqVJcI-UNHr^@9^Ne2@3ipWr{#=_75W zd${wxM@xiw$#t>A8Y_Z`yB3WI5M{kMhp+J_xE}5vk3m!tag0;~cVinGn0eN^4QFWJqoGW<4tMwWtapx2sDW?{K_>bv*6-fEduyG6 z;*-ZXdv{?8uUOX9Ak`FXX5IUV<$Exx@o(@PkN|?%B8!0avUU#l*lQ$in#D`+p)A(O znU1|DXGCPmf3l-J)R0?Tjil>at|sp=;s0H!xH_(R;4;;dI&xEatFVF7tsc zFSEID8fVO1L6}I*&qj~#1atwM&Jt2Y?eMKt#$*@zhTRJqs7g;Co9B65AI7>CXXM+j zu;OZWOz(XY&gQ(n!KnQG?*wXy))hCf0DpjOAF&{J^YQrU?|<)FPu|>`0A7Hi+Ud8+_XjOMp_k|i%p3&^mW zayRR2_V{f~y|`+HGo`M*dF(ds0`zuW3}O(ZuYyTLn5ocS*8V;DdjH|wSQw)mfFbri z#~p!)|L<(<+SpL%pWe+7MGc1I^yT4ZId$3IZSW?` z^(pTr@x#%9OsJ!tOsb=P_w|)^^`F1v(r?A3J38#X_3c~eIsM!5LHE@=aHzp^ao!?h zoutR(fvm^lBiXkn;lReeJ?y>%C-WZAXQ_lIr`;FeLD{ft5bce5PSpG3mAD)U|{p_?$Mi{J?dzT#8gC6}+lpI`ce2X|d(N}}+`^m_&u%Nkz zyK1ob^o>6|NM1bX9e1Cfzq8)q{^|+8IfO~lJ-Y`j6&}UfW}hjc%3b*bo1Vei+1l5Z^$L3|OM6 zBm54P7F+`BYGO}=2M@Ln?8ENc$@odUwwJy(-C#d`QA`fF z+bfHxf@DMnM1utLdxh53gO|;J?PdNN`6khFE<0Q}g~Nr;GTfJb^X^OL^Xhvzzr$J9 z1g86okxRE+5=STDj%3`T>yQDvfJyv@hm>B7j!@DjL^HGSlRmtOk_U*VcA9K=s+~@;~e&m zPy9`wqa#@G@Y_Mct_S?5PQGs@yDIJUX1u-S?jZ&%ISDhj8W}S%ds7hC^TxIX={cOc zuThy;@mWJW|D@Xw(?UL7(D|Rt#97kszIk~W{W<6Y!as%Gx_HfD_XWm}(1k4g_6Sy> zDDWZr{-g_g?8mVCf+>{R+bGx#(R3!x`<6PV4p(YUg@RCIRAE-h?F+gUBIyu_ck-P~MOPw7FqGnrojOfz2N+i+~s% z{q!0{Ces49dE{IP*J1=(&;|^;f7t#6)E}4GiwVvwfRykW*pWJu5&5Mz=sy4T+IsXx zMT>0MYr#yAj^lDC!tqK?1U$#1Wh4|PLELqbo5NURC;~*HLGi(1XS+h#kaoG|bss=c$iE2W z#euhL8-Sjdc)b3Q-_C0QcVKOUso0%B+z|N}w$zIOd?-|f)&OU%sUZf*Uq{G$rRFl= zW&NfAr;UTricN5bi8lk|&Ve-Y3h`|H6)2Ox`@#C~+Io3W_E|-&o3C5tM{dwN?1DHX zI%(oDPpumU{6yLbmI7n2$KeOO_b7d@wauP#N41qfPi)1fBFk=m1jJ(g$o_*j_9Zv! z_kY;OGm^kXuhh3Ef%i!4pAARDU(oa0{&F?NFa`An4+|R9mGBtg?|CqVI57{fAa?>0 za~LoLCXtPK;Qq@|ZY+L$bouVB@}1A%_+=j8UK|b(tPykXRbCaGPGK(l9OGEZ>DtM0 z_X6NEIAU_g#2-hWK&k7K_>H#@_5`qTIP|)Oc;|cN{!h_a3in0Uc5JHQ?2e+TV2pQE zL_6(C2eg*9!AiuBORE@(XK-jTjl6(p%3%nxg+aTaCQ^$OD2W(qVi+XLHe3G&8_2Mf zSLU0Ryrx6gVbUufSuL{>cyKhtm$ZR!#=tlI8C(r$?dKRh^$8oHv%F?vEK)*oo`D5J$v;vGkg z{RV3coZP`?#2abt0n;L$M6LerKDsC%O$sjA-f8@8Tsn^sNmJr+d$4i1CUl$;hrn~P z!j_b*2b1sl*qe{6-(bD}3K7y_vH`1hS5*@spe4~mO;e`_TZnkW#46P<|3KDFT@L~J z%UyeiPBC&P}Y+IAOM-W$qCyA75wzQc(>i5NF>d}BBh}P*o z2kV6S1h8qigyj^bolfI18IPpRRbBs&PM}$`#r@(2h9nk5r_qdOH)x5L^Fp4OG$dx?+KyGKhEA*XK-FK#uEpa5jCso$w1Oa zJ#+a4tq&t-u->u5gSx~%mbG1z+^8&ko9KJr>hdB^(JG|(bfsQsa_XG+rEOQW^ryHU zHDQBKQ8%>L4RLau5@UheBpO;>*GmG)x^K>3zpJ^~XMKjcTs3{NU^`ziedIDvUYeBJi&*)w_L6*XmWfHwRJK0CW_=OOf0ReE7q27uD!_fYu} z(58!Ee-qk10OUp1OD)!P0GJ8HVY@z!8ntg~7ydNSem!DiTv_)wX98YU-PpkZ(~r8y zoM^!urDJ_I8kNvLOgrkrt(ce+Z?F8G1J0mR(p6PsOd86}U#op|(cOFj$Fff}_BaH@ z)W`Rz zfEYnUnZR{~ZLjy)sf2t$d;Ks|7+)K{K5o5;H3R7{zXrAnz6i|umjt(_Cs`g07 z-FU8OW1ZpIQm^|OPSf1omkjdNy3=E#loJByJzFE_Z6o5*$hH;r_2uK_NH?NC4azL zquB6lFtm>laRBm-=adz!l$(PmgBk5ruvd6Qn9*vP!F1m$9zKCd9B_8wjE`wS6tNb#Op{Z4FIUvILpo9_gL(SD)!RH{RCrG_!J7A^5Ymo&ODdvl8tymi&%h-z7RIs)v zmS|jUV!Fb@5i{R|gDz@qBlFfSJ8R7B%9z=+vF$%D(&Y8}gJ=oVK_JVh zqM^HG*B2SP)ODH$4}29=dMlJKS-A!eh2Rnl{Rn8zuW0Q43%o9*{bUK!$qO*fnYBdB zQ?%T(-d^&SxwRtB)Y`aW!dq7{6SB*@nPb)szX^?r)J_!Il;>j?7cpv4c%xJVY9P2x zf!V#s6%I>Bb>kQFJ}*XzA9%N^A85}PD`HOSWxW5Y!~!(fJ-`xtr8l-rd&qY77GOGv z8c{bv{MKQ>ZY{P(*|%sKCUVZfof>g-fCh;-P8~BJU!d>c?gJ^veb^BOxIZLm7IYW{ zlf<2-fVyfB`0zw~A&0R+H{pWOGumhvu{coJ#u^za{(RiSEHqWJ8!*g=y^0I=Cb~Fa z?*SdhInIWZ-pe+YY$w?3p4(5UYseq5on!9hd@4u#QNA5zSX)jn;O;XYOnwo!T%q~R zx=c`3zL5K7Enaz9-uw|uROuC#1*~(M zvo7%BE$~tSrp0!$>f#8sSw5*)ZV4qD7LEpFm>;i@It#F>?Nuo zbHl(%*u8i0OJpb!VSe$;0b-Cwu=4 zyvhF-Wr&PcMgb$aYVk5Ri6TvjTGa6xot>~%$!}ayB-NeLg{4%cz>t2C)cdfF)QmgY zJvfQ2#*2`yN~Wd-~?IC&IKgDx4{v8!{wN+75{5 z+(RI3Y;dBgb+ldSop-FtTjGStoZ~dn;YEC|Mjn@p9qNk zae}vQau-t{zEV$r@!JUiqcPU!~-uVWwh zU44ER#Hi2@1ODNVUvtQ>IpjYbMIZX~1H_im4<}(e7=;~uJZ4Q`geU(9VPi19_;~C^ zW1;Dv#?IZ$BaCp{DMj94uN{=(Z+P9FIJiGqfAi52?!i7a8h+vZ!}tp?K=|P&82`@p zzyBzF_4A+qKYsb??>qP(>6;NcAwmuxJ+gcHiO%4z1up5m3l@6#fGMj#kwXyjV8Wer z_QW)Uenn;CnxP;AvR%xBSWEOP?UuqxO+t)+0{kX$w&}pf6>wYBt?0c*A2F@^@ zyUU)qo7G-QpW}K64bZ1z4MYzcO0D|5d739RQacIdON>*ff8qDSn8GG#hT$x+_rt%` zenZT0h&9H(EAzHlnB&EHtU>Vy+N#!^fZNjzmTd`V6w^d&n;C)l+!s`levn@j>So?W z%rpsBD)YjyJ^DeSlqkCTL+2@Fa&eOABONDE6Y(2iEJ;j1Ifwlz^gOKp^^>*587#N( zVsP(BR4s1JY3d<{pNY1#8?$*`VPq0^uN$g<WW0NfHaD?l; zY{BnFkDC~2*l6c@h3~{&L`QmQRED!J`#Gz6HU1;*`}ug@Bm|Jqo<~_4MH?i3OuC7sUn8U?%txigk9LJV}%-H;48z+D;bC+VU7f64aJX=TJ$>c*v)5D6p)obE>DpO3UeclXIH1M(e7m z$sJWJl1m1Fk2_9@MZVRLD4-mRHH-AfbsG?T*26Dfumwb`GH!-BtY-yU=pPlWj3Ew?BfF%x=t*xmK|HAbPU=l#5t_aGp&DzMk zo!m;rrMGJg676ma;N-mnTmhx!%~$&&O0E?3AKzqPxeEAk6_~pG@l56+h7=O6K7Vu} zV14MxCq2E_O9JZes4%;{3u=R$+#>2EXA|f`@E_Sh~R4s~#?Z=_U zq?GbWXCh)l7!-4j7aRy1pH0QFuu*DGn`2;AB00gx)3nFY(8h-!y77=s$?vg1C&};X zVOdlxSr-(389Y1UVU;Ytb8!5O$8NHixxq2N=7fi1_V~pEe$5Gs$sC-V@K~n-znK4Y z$U`_!`CUEU@__$z$Xh;vh^oB!rBFdqVVu$dmB(|^-$$@}amVp!$Jj4Cq%-!VUQj2! zm1IMvyTPyHec(4`IzR_T(gA)Q?*PB46qXuwA^yNS5x*xw{^nqV#_K}DN7J3nX3HuSh)a$9VdHVMsB|qu)9q^b!u|xhP z?}h)Z*))m!9ZsCD@y5fi!{)bkMl5nUex6HU-)+~YGrqa}bxVefM>>NgQI8t-9+gGS?fj!JQ({WMnDZ!&JQa3{{1 zGI66OZq&q$qJ1G*@;vZM3clly8TS=J_L9R5Bsh7r1&nEcv48r2KJOGFPtrvcCHy@8vP4h2#)BJDEkSm<}gLsq``6>*oB7c== z^f=w!Z{X2XyHHjJ^wq!zIk{6 zD=3NZBIR|%PZ;4#KVkGQy^ei%a7g(P;S*u_B%hAMPh@(td!tWL9}sc8BZ}wV-EG6; z;Ir_VxC5b+!rToXsWa#BN;mv@C-cz;#|OQf&SDxwdQ9k`wA=Vy*~5wz(&-~(IrD5O zsFfhybBiMFmtB|HVSjKy=_ujTVV`$R-e_*u$5GeEd0ijpJS(V1q$J0zYswFduYAB> zKD_%=CgLgOCB{!&h5Dz@nAq@%5WphCW{-dOjMBv7r)TVr0rbW{@m2RkV-bgKU{)xoclTYl4NGWY53-4nPPLu%%&p%OqToRri zYDgqOG%n9rAMh#c13KZK_$$UzPP)R0`o7q><4&MsMYUJoO)< zJsEHmm(W5IDJ$jfKJ$h)ON9&CqTjCG}111 zv8Yrn3KTtzBYjCJ<&(|?iiRj8S8eOVua}FC2aQjwP2%QUc$IZ5O3g_xA)ctu*e-d9 zl@-NUk&nkDDu;dK#ns^>W6Q*kjAaue?D(}12p4@kj6Q~S+A*ds{K!c?c?=c#*y9YJ z@Ge7|MG@!& z8VyB1hV35Hh$r$fYT;OD;aT_*eh)uJkQ41^#jnc$M-$sqGm^AV+YL~^uk&ls(&{p)3KPHdABOjwK zAYhJvq~V#YfINv2WFMK*@{m*ZkxfV*V@N)R?eb7m@-YvQ^??QJ(T_ALl6~ajus~V%QTUdR1B=HcAITG! zW8aMj<;zHSO;ElG$~QszCMe$o<(r^<6O_LKLHRV{NazN>AU%*D;#on$RpN0FUL8x0 zl8PkW!5hTB)|S;;POVS&#ECL^@HIa-vvSVXVrOZ}74`%+7yp(Y%SkC)(sVP1)H)88 z7*gvJM|uK!criL`B26OR!wRQK#KF2s84-u+)4szdGa?GHY}S;?h%gxuCL>~{Ga?F2 zOAQ$j1xF_BPkfLK(#j=1=s!fsm13n5A99XETa)-uIDcx)Z^%AkG)If(Xwe)knxjQ? zv}leN&C#Oa`!alAhVP4=br`-c!}n$QzSf%W%N#A5qs1~uize-F@Fv!U-Nh#I(b(sswrXn4lP-yY)|2rT}0VBz0ul>}IlX^%|VlJFR`?s^e zx+Cgu*)vpb_e3>XsFP=X_H@Q)~Bi&D)(#3t9v{J(3h%eCh^j*?@mNTD0TGI1{|Ql(^d}*Eg~UnH zZ`mg0oR-;x-^8fNc(5q^C<(31&boZ*JMiDhEg8Od*MnEtm%f8my;1IU0qYts`rZ2~ zzh*v#c|vF;&Kb7^ZL{~P==vAMssP~!_xIo~k~QA*vE|=<2VR+f{b0+-f!%Wb0KGhT zV{HCFDhR1RNL2U>yayCT+8&Om>pLUV18{>UpjaNUmXe4uRjd*D@1JB}$8C5ina^OgTe#TiFF#3b3(iDhfxskPIWveoxX&=2X!q~$ zednHNEDtOqix5l<$}1!hQ8s{`+j%ha9@%ux?2efU?1q1oj$?;Ucrxbvv;0!DZN&8B zf902axbb;qO?D--W*OJVjT2e4?)6U%2P*9<(yjH|}(UDd~n9oThLX<-wQj~A9=Tc<}r76I33TyoeYMdP{V*l z%NW0-sU{d|0wYb+53hZYZ@#N#LB@_rK*~GHpf6>ffz@HmfBRV;( zJKuZELjkSp2e|qX-whyKBmCO2<`e2Ly8nU}eCN^oVvjBF&f>Y$7U=lYn;=}L1|td* z(v^_S-GzgQguy2YI!V_7jmm$j70+xr8VR8k>A`1V6>uefS~PCiJ6D1&GcFTROChn| z9vl49;Fku!H27uGVi^3gcKkBwbArFsIDXl$h+j%%u8d#m`Jc_;mx}&BUp)oWscL%4$;$qg97xjo;r;Ny-cH*Jc42Peu_ZB zhQpXiJ*`f=JDboO-%VSkfwn&O-QCNolHn(I20x%(}ZLu7MohrO~Y2z(@w)% z+5%}N{ZDy0$$BBpK}ASYB6DR(Q_mM|2GUgA3$SJlq-h{c18J@Sq^W9pYJ@cN_HHGx z&8#N~n;7V0o4Re*U}e_@+dM45Hce61nj$m(+XwfHGXyBc3*4FKKbg=>nf@)eZ0lk% z&BIJ%ez-Z9Cj5_14L}(A)M#I9CKEB5y~_&Dq$Md+Nah;EWI(f!*Vqhi~P%`nDCLYtoW14u(q@ghJn6-nKNk_Awa8@ngjGLH z6@ZpUCLpsZ(9%R?<|!gmb5Z}+7QH;mwC2gjUt{z#4PCZ0Bs0A-E;}Z(|Lk<*Vls0u z%!NUih7r>+Vv7G5MoeMC7)DIls2E1fHiTa$olS7G8b>gXDk7K?nJXihdX8r^2&SUr z&zdy|ra>?bg1H6=rmE?w6Tz%G{xa(k!X}RNp-kO2YcR9x0%aZ-K$*t|%B%;BPl4J#^x7 z40Smbb`E=S)bhn-H1*ucEEa=FUSNMMqcHjN(%<-BCJfV*^)Y3AOb)rpAx|tbCWpLW zzXNVo;~?g7MG#XWb7c@y&+Tjm#8h2j zV|@Tqx6K+%?79G$Cj|iJi2*R{1~BPC0EA+)8fx@K7$j4ojZD`?C0tu1^CZ)*Cm(-P zihk4ZO9;uNgKl|boPwfo%&YYEx8wQ9Ay60ub^`3@d+-vv)~)Z17~<)}aQh?t4u!uX zcqzq2r*;s)!;chG&7;MW&htnd7CpE$;FFdXH^8R>K4ThX>X{RpXzH2EVh2qT-rB{EkAKJ~oRW`Iw{T>@Xwe~pYym%Xyse`STkAAWWp|uFY|=)Wv)Vm<)U)HO?7d{zkUGY_F!_sWB-_3aAD$@ zTyT>M-qu|3q~`}-PvdCfX+<k14mPb!!VBKFhS;$;aOS z_^`#5cUaFYD7jf0iXDuR^~nJa^pdOl|}V5OqZ&zd!0r2#7q zSh)sZrK;(v3Rc!$c_&Nou!(2-h^20uH5k`*K`eU*1(0R$z+jdQVV0)!POc_0MUN@q z+QOIQ>E#AJH2~`iV5Z^Ac2?g>FOEwuzH{1(p_!3rX=FMl(5EnA4D@NB&$dFJDK8cMv&O;CUJNHFfqqKGu8e=`I<3thpvoHu*08}q z4F+m3&^5q7)y+>-{dH88-}eQK(p?9nyA|m?NOwv%(nxnBNY|koM7mSDySuw2rKC|p z>OSZ5{oQ-tcMQg15P$4v$69mEIoE!G3(qDOeK>Qd?Pwp~G6j_SRW$0XH^NH!Nab2h z2jn*fiRn>__ogeiwn#WA#!7tekRe9P!>@Y`Yzr4 zlIgsMHEd>hr$iE}17|Oy`sbkcS2@ZIEs6h*T*hs2q`wt~sd8xc>IbqjJd6DC&5$AT z(F93@8sRq}oy3;dt&oibj}cT==h8`;lnm1!6?=#MNb7nFapRq@v;VYByycHBFX zI{lG;?)x)diWGMSW!TtI<$TWHtzxTNnQr8@F9j zu}93iHTy`9@A;dkza1kz2)%=j;CbRWZYxZqIcqD-qBCMmB!~*iU8hKRi3)m&Fo#;O zhzjZ+%23TF)|69VNghMvjk^(MN;hp-v^?wshQvTKV0KY6b1qK>_fLv`k+js=qoZ`@aJuY`QR zJTe{(0XOjva2yllODqUJflJXu#s+?1iP(IBVD`q9XMeC=>4`(~$3TGuRc@HSiT*u44bZJO{Jcbb{@qg?Mdfy znSbmBgzhrI6-6v-OOm*abiWFd*0-MDb;QHH6Gf0yNzA+cCa3U57ooRYd?y@kTU`Qf zmnWtqS?Z^65T%(7pUX8$47r<+s3M9c>hAW_y4OEhc5R#w^KbP6LsgUX!sc6Lnr0sm z4yVT_x(;s73UANopr0S*$4-3?eO+e8>^yIrUwXUYhnj!xhf$dLtRLBb?x(Lk^uGH* z%gpZub1mDZu0$fBA-zOBX`%eaUMMfCtL-mpWnHFc^=h@;W|cA(qLU74Vvkb|8Ty+XR%-`2^%O7y^fZL;6bdud{S zr=EnZeX*yNH`FQKwO%0_qoBaE>tB^O^h{&3A!B0~MiRB^V%A0cPb7#mGA7RN^Hf*g zg5+5}A4%q~^P?f084b(ay>RM@hS zGCo(D3xF^NPJ;J&d#Gr;87Gi z_>AGH)Wpa*o%qtiv*=FQ9&2=;bZo;aV&8}$P*{D)<8P^0`Pg*y#5btd$JkSEMS}v_ zua=-ZVd)6MusgGSpY*Rd~l6Yhe1jh~07 zX?2I1OMly=?2}4gbkHx1d&!MW{^*`pP`UCq&usK<4fRneDa5rGg&g#O#;pPNgH3zR z$&70EmPRPsExMd>H=GeO%VI=DV;CD&@M@d=!JK)8piw>G^xmKo`@8>yKTSE zYG^z2k|S$ZJZlr$9$e1Px>mj;FDF2#h+FPyUOr%Gjh84AC;jEH%3{oUpCpyZ@Ja_U z7Z#)oRK1aOQAv{>12&6nYBT{UO=25JfG}DT7ea?CM;cMs^vI!1_i;L%@{QVn7$UE( zUOA}57V|sMD>_PDC#P< z2KR*{*EHX2UWl{Fs5)n-7u*wI;B&ocJweV(j7`~f8o}awi6^HK7_b|fB#M<}o2>6Q zG4Oc%-s7u>4rifl1o=tW;wSbx3G?s~EPLbdweu1z0p`V`@*vFc&;UmrSklx~n}IF8 zU`!dQ6{nDu84O;GXVmW6XH^?Zn@udkMkfg0_) zH^{#9PLPR}3__eFE5u=j%f%2CoMo2NpA{!9N46yRmu#^pyUujEB%3~XKCHCF0XYy| z`UJ9oS5|_#puYaBQIh>3tBtADRRe`y24BU}x=cE=lBKkMlSwq|j39q1OodTdP}pIi zH80?4Ec&Nz)Q98w@y!QmL^AS|h40x0G3w{G^H+vr+tyE|rjpy$lO(dIm{2B%%MK{W4w6@1_KVgA(cX>P8Fc z_eyw-(%t&(8S?8Inba{{h0g9$sOvq8`1L$NkDUvX_!|+cvJG>BIBvh;#B^(a!}lgq zf07VY;fq$vm^H7bdoZoAo)|d}^KFdg9x1v|aK>s^r{MPqX09yzH&GNUsx);}t~f(sQQXRHls{cYFD{#9Xadb0-m)S+=0A>fhU*X_CF5I8 z7Dwd_Vk98@H+3Mo|LrF{#++j8wRfYqBJ%9WtTJxkCn*UfkwL&=d0KsVMoS;`PO)zq zsO}r1&7og8`_8hKo>?#=CD$1J>OhIJ;31L{n5*Skj)vogKAWWvivr!zqk8ZN>r$dM zF`_dlIKK5Qm?E=|dv}I!dcTJ=_m1u#xgxHk(c=A`GNfA3YQOPC)WJX?jLp#tuisx1 z8_AWy2w`4O<rP`5TG2gZ0Kc47*8CZPBWJfD=x4V)7zgaq;W&Eup|HyWhnZ|{ zw+Kp*2#sF@j0g}R$L>`tDzp$qn$X2e+Tr}55i+R}NyH=a(hT{^%`s`v0*|8yG_W*`wL@23rNJIjiw_Ea%^PutZx5fsrFI!OKJA%$k>B}^n4)H+ zI|Day^^;;&i>4?yeRBB=V|YoO4hnUUdyJ?htd6+K?(hw{6HPW^igO$krnU)s7oQFX zc^6;g>Z~+AOeNFxX;(U4wy)rT*t~=_I2pfPIGCB3i+6y^eb0lHh?tI3);ykb@@geh#AxVFoAB;pt1i*Fc&YzT$-9f}qdU zXXUdwAlUPD?cc)Ya@58JuWx;*HE}sCjDCbmKl4B`{-H3ivqkdR!oLpPhLaZ8g|{9% zs$FkS!+B$ogrCvDAlN!XDwB&cED@&Cdup{}od5ISk7<4d=^{*LrOj+u!stvqenuB1 zQgBJrW7!n{-!>Obuw`|;>@Abi)ccxR~`lFgfLmLU7l8a z_345;Ma<@0BX)l8Om)AUDacxst&-z8|A_C}H^q|WgTsFnOeo+BSJ`j#gY!o5)Z1v? z!gK9B&_0zGHo1MQYT%=bQy92d$25}O8Jp6vuX($A?$^C~9D{PQ(CELnBnaklve!x+ zgL7VypM|OD@>Fh)YJs*&AiGiurAA|uipRBad?1WI0?pFq%aG0#0NFK?qWN!WIs1qo zHOr~CaePq`$yM_b`-m7Qn2aizyN{|nXoUx6le9a>8-1cKnaRl1IDcvtogCSw8iX`=gN zu{HbQg7dXUV7lY9V{z^MC->|Y-TUTVHYrGQHNT-HCvd~W;U2cQ`me$)e5 z5p0jI6Tas1rgaC$hqg!PPY~7XO^AU*Cm-!pXPzJXeej|J1ikE+ANF3nFk4) zLdzr)|JaL|Lze3^F9TN;gu`y#5QHG#ma@p1IVF@>@qjv&qurY^A$TXsV^EkO%adSp z9ZHwdQoDegEX%|9;V&9xj{=QdK8|duhJ4Lv=eQBh#1xe^Hj-u-PL!HvGtjFifw4(rdPKuv7ea(I{%aObLfZs- zI214p8cC8UX_69# z)#9yAVcGQQOC{0%KUDDaKU84%|3?KK|6f$_?*E4h==`9lfQHBQnj!*AGB&c_Vt#Pi zG-xzfME_?{+rOQtKS+m3+q@s*ymSN%r?hair1u(B_E1>US^q-?EkoWZn0){$u%XVO z*E#9z4dnR8LJz&kP28=G4(UE1}SleMa=#!}NTGaWhCtH9|Ame-v4wAGE z!e)zMToXzm@8*0~4Uk;Pf{ABOQyXaC_*_MvQ#@UR3=wMKtOu|05f~(uadc_wB+b9^ zfh1E85O#YzZYl;Jsd#D|wf|ff74UD6kvTZ?vNOMO+VQijMy8%R zg9w6k{D98@YTc;d>8VpkU=~1Oj)7PB6zW`o#o)nEp53`$S8)650j(zOQ{=|A=(6z} zl7Y_Z9x$0ZwlK)WQ)BjPRSIeu_@iQoZ?kcujK1|mxMWL&6KKcury12JZfwFEYARH} zjPR(eHYeygbgDI%T*3LY5Hpr!@n(mnPbwsephpVG?g*?ThTf{W|9G%ZHFBe&5xRa! zWyk^a`IP1}w=6LwRS?iQTXsOdM9-AjX;)j}0Ueac`$V0=KnAI~{4+Mjy03-&36iD# zg{Fr4Vd4q8>f0L;d|v96ejFW1J|gB<$XUi7P^e;ySsl=kW7oQW0(&0hoiNDtOWvV8 z##Y2(X`U%En4dC1MG35U8yT1}U~hKK8)Yj(@W)=(Zc(u9bV(`=Kv^Gvtrgj$X?O1CGm~@9piunQzQDKhj`+`dtyCwI3_$7w4rUO}J&XzWk z(Gf&Zb+k9CR1p6Rndr{82HzI*=qXNt*1I-G0uHe6^5)JNYb6fvfX*Dx4amgoG8z+CXq0FgO-_<6p`HakRz5&8_ekA)bi_ORH_}I#~6a+&Uvd4d^D<0N$HH3YXHBAV?UUiz`MSBu^?@1f(1+re?RJ^2;$lYTZ-q z?G#`~Ikzrdj){S)$*8I~P^*1!ekYzHI_-D3-WX-A&mV}w0uo<6?F6{!@#~m%g+*ezF=9XstOy16Pr>1bkF~$)0UM^L4p~WANSvS3!cqcxO~hbL;H+ z*ZH&9b(@{y^$4P}sJ<+~VoxJ289hKI{4>PS1cUx+<+mzv~?61xB}ERGK&)K$S}qT}kq3TX~G#n8+u0n8j+gTJwh7Hp+M+U%%H^rYF5Vrsww~ z1;l*#Tie+B)lZIh_OlNyW=-7f(dndCoA~#}ka~itK1~`|e7KXgh;FRlMcg3I{n!Sj zcmd%-xm8kFYSd7Y!`My5tqwTPWP)~HPi9g|-hT2%GdEVER$3RC{a6AgnXh;1Spuo2 z%9_UUV*!Wf5C;+FA%M|eIaC#cxwSp^$JHbt+FV=iC>buEJK~avUq;7Zj_34?ZF=6>NqhgNBl{MkK7J zsBL4?9b;FgOZ==P?^Causv0iUzo&!2_Kga_!BgGooj^D&Mxo~G+2rbb3H$|0q!U+D z|AmW!?c_*U7%YhykM*-Vq{-n>1@AbwVQf@m-(0@VhLdxymr)M+rk4~|Kcgi0tj!II zE!=9%nU`_M7h+0UjSGWikrS}iM3Di!r~BdUv83is@R@kx@{b;5C~&r{+6m605nd4! zULm90w{Df0LKZ+1z|)*I6kbsk`0IIjL zaWfz^sc_!(Wdsi~d&RqA7!Ut&C)4}{?-(~P0*@F;GPA{mp}FEM*1>N~`Th3xOEF|q zr%@Sx7)2x;D}`iV=}a#TQYpuQFLYzp6pS7xyOID|vNw>JXCwhu<$F2^0x{AkNoHEX zD*>p(!Z|;$btFsta=9!3?|(z@g>2Gfu1IBCAuuMo_kbwn-C1kjt1g}nh8r~EO=|~C z-p8BwLeR<70$MKUu^NSe$GPIkJn*<=4A&h3LH+7L;<2*8jN_Di9-;YG#fB9h=!7s(K?*Cb||zb(tC3K zBTc&6zeG#&7%gcc8xH8SivN#ta-1c5W3sn8=3UL#g{bBtrfskIl zB;5c?--=VhfgIbAKI;Sd%dIS3ykYjPX$_ki7vn`Idsv>$pl+4o*ua_%&{#$3`svXEPP4s3~9*2VI(N2HwGa-UfZ8xWZ%Tr+TBnR4Di!)RRy^mTGVd zXlMZGMMBc`|FYNes6L+#7Q;6x1IM6qg&X@LHa8>JGWc9bsGd)-M)Pg6BJ9@UsRLcH ztl}?~(*+09FC)y@%Y}+BPN|+8E)&QhbZ=}Z__0oCWPl?{JDhlBA~B-MCw&+M;-_(u z+_!>vfffSs1;>h$V$}3x8pd%@)Y`aIGi(C#A*1o(?xWaZp`aGCkeA@=WBMudtC#bgihFw0GIF6ll^uCtp`X^OZqeUIMimAPBAWKPl z}P22w|eh*;r?_$^|k#S2>&%U;g>is~ozU!$2?eaoj!Q{kZk*OUe2zleEV-4M`07 zz_Q$Qw8*mD1t{d8YnSwl_4E6|KP9|19VYS+kvO0>SwF67;PDQsXy|hG*hLteAUyzz zhJtz82&=tu8kA{i*KnIJry5nI79`UYO@zY8iYBU2!wML=TfGRn80yiBpsVIyxV8YZ zBOT=-L+&sX79GU^P3d^!NlxLoFX*|LU-z{w7H0Ge<#G(qr}>zAJPc9E>~_6CzEPzy zUOS91>1E$=vgO_tip&nhY$0NCiS#v=I$8K3WYfENPSdp8J7c@NJv`vue=@GaeBU<#k;F|QI0?|(46VKXZjbViCeS_iuO5R1veMycMoU_d zAEakw`-+AV%-Qf9wM7%>OqZn-KbwtM#20#y0cA|0BppO{4vwzu!q0|!w9cRvtwZgB z4v-Syk1xlr0k-CotydB7!U}`^6lt$te1vIxj!(*a*kThcbg=109|`ACT7Z|!%WIoh z<)5#jzcXkIhvuGmT#SK-)z|%y4bepAaRCQfJ)J}p*!Qlu?`i*x%T?MPx(=;(rjF38 z*12ZVTNL|R`qkS0yrb_x$szm(J37&SPNJ~8_N~Q(VNR|vX+Vf7%Qw-DlaeJ7T;~1Z zc&R7}fFLDF^ufbnM}-bBz*A&Net@{mA$@sDCD5?J`T_Q3U1Xe_lCGb&@9=)?JB-{cfr{m#)BFogTL>6j2y!7FjDVqKT{gV zk7tnavrTNBs_-?1aUJgx{v%^S*Ee01$m9%>|KXLcZtd}#?0CU&;|kgHNiGGg#G4YK zabh@?uG}VDuj#j%0uVpc#}o4`Bo@^8HV%Ul^k^C-ZLHxNf%wr_TGUpeg{awto@d$) zR}LMgXCsoPN2JPUWYr>T4Tye}qh{~Ggydv>ny$w}HW1}+ITZqRC=Pz?ircnaU=E`8 z*sY_ncXwZb)W#kiz*mpc?~IZ;`x)-;q-9%w2ydi*%BMzohYhcG5G;o)&4c|;z@54X zP*bTtkFL~F%a)OD0cz?ykQz;41FV`&J0)KH+-2%i3F zf=O|GD|@=Zt|)gdgO0$BCrh4(7t#c(4beXdka38>;u`?2*pt3av?O{=ddITiMSxJ) z63^aZjBfq2%J1=PKFzu1I?J+ffupszp6~QYL?#}txkbeN-jiB0{`Jq(a87p4hiR1g zrxL;~;fdlIpLSu@jk|yQ4>#T5W%ODr$-%~PsR(7gx7S5(kb!mj!FTO;md%TxlChhy z(etRO*p$Hf4z!3sU;dkmU1LP~3qf^_U#@TYytkaTMB?j>3XAUN9^iXc!v935sHvHK zGfjj?8h@*GE)BanIX{^SFVhuwNmxcc=zrffy4KNG_p#n3*1~goFP)0 z&^_gpfs)wp-{|Xq{Q7tK*mA4mv$MDc|CSXFk*o2acI+eWD+O@78pidtice^ePp;Hk;k2D;2gpcm?#M{ygFi&rRq7O$XL|5uLpFgP+aR+WN&=CwbL%3o{EdK(?XtsJ9mMx zPwdxU_a8^@?6)7+&WAC!rhAi^0=l&$c75<+{Gp|31y4Y?5yJf=%6$ynOEvY^S;~6J zrmN4Vq4B0(`!(Iw|J4|w&tDs9fg0ng=f%gAekxH90-p(vrhUMr8xL4mT=;&ake3xi zc59VVDN%PhDqX}ORJQL1V^fAzuMw`#ghfSm2_sI4jN{}0Glf~>YJe&>PGb zumES2VJps1-67BUlv44KtVd5qh`Dy(-wMkJnN$~&6IRgnfg6_aVLdf^cn9{lq#MS% z&JvvKwDvpAHS#A z2fB?+$nt=S*KaAqIYew0+y^rZijJlA706QFyZUbA2#ojF!Eo4e~%8}?e1$EX(KOG8K7V6IlK2R>uzXIWx@slq-fjbW9m5KCx`_GG&PHgj@48m;XKC1$!NsB1UwOAR?p75kuQ(6X zo2V(D;i|VQJkTz0F^tcij6RVH0&=6RoR2j-Ydy`98-P@Q!mBD-51PI>GFTG7+YSrc z_>m7zcXdr|w**J|psOW~%6Jd49=xWa?ywXEJe0-^yq{F>F)=`c77b`RoDsGWa3@G} zpV-wz3j<_f?Q;VF9Keg1{3oY;yW51ilvJz7ABqF2mbSZ9K`*4#FI>A~M z5C}xik`0Nh%)qM)E*2JE+Bg408DgEt_QB6Q-_7{qTda>3V|x_&;oad@*f*gZMnpHE zEK`I-&TwRmBTt`c+vRP)Z-aX+gm%DUN|SYHDa#+S4Et;2@b=r?3nk{Cz`dpC;6NaL z52MQ8UXze8&YW4h_JWlH_7K2I#{J+xVDg2OY7lcYh}nqn6Q5N>uY#bYl8*im`oF56 zs~|u0Ve|}AHt;_oDZW2(6`s;(mE`QX%4~PPNb#ML;gQ^%2qzm1TPBZ8=3iOo{0m=Y zUs;M@k+e}?dGDqCumq_Z2nxM@J56hOla9MsKD>UsY5+Nf-2q~7-#rywVmH=TtJnSt zWMxC_r^E{67WBT?Q_4PnG1ZR8$C>UDlJB=ma_OjHSN{=vbs3OKIMB=CZ-gCxgZu7T zDcY>0p&fq__z|Waf9qP?{?|I8CX4NEkLqve()V$flsnysmquI9>7lQG`A9TV1yd6I zVaWd(8J2@6Z84ucqmH_x{%oNn?UuvOuR_Qt2F|zK){c-?UZ*=|VI{64EukOYuLt zmkiyCPh%6;(6{XVapaxus>aaQ(zC(BHXNVc#3;d`#(hVgaWH^k0Zs*sLEZEWPQcPx zvvV&>E=ZI%pb1vg76A4zdKChOp`z`fl`B=Exlm5Ryo!3}j0SE~8qPjhv}7Z|PMseh zs)zy0Qs&eZwn7j%HcPe{Uz+hGuT!$E%Hsm6EyzxLqjSrFzUO2_O8Dt;D6C?p8U}YY z_I?;JCU>Y27+yHL9s00>94`O+haZa|<<}PVyoeGxYo&Rg9E%IjHcSWZPB4-~@uBj_ zc;Dn7CvS|2_{nxOgyaL*&%zdTvuZa1fFz;FH0#c*+xP~@pEmQAin=J@e5OBRiZ@a!F7+)ar{B6o z_NMT0k0tF1%io6%SN2ZDnPY`8tLWw@x*3Yt|Cvx6jsUqy9Er}2&#;gWoP*Fj>pf7g zcjeL)bkF^t359Og=)V5Ohv@Nox*{4KVibBcJB^ERKS^M(IHl_5rOvX~y^j1AsCex~ zb<54P5Otc+X91L00|jOCjYv8kkpZ8P13ydjTqjO0lKJx(DAESV$S5%hpxNT#&lsw$ zsy;pdc^R)PIz0yLIU$`NS(@-YBPm_aeh7SHhCBy`JcMxvzSHFjQfVJ-LM(p;ZPX-} zxMfBDK?!$QCoGTu*|;l@A0TYNA(4hpn^ZK0r8zS8OY`O2UHa3PhGs&(RIoC-cZ0ps=ar=$92jrtO{P8EzoyC6HFJq#8p^CwS(tdYw3i0 znk%VYTiB~b4-q8DMbnEj{=)jZkh(0i(qi)1&rjl*s33k{{DaD?v+ zoG`$BMqi7$hnJ&Ko)RQ>I3Nn^0GZFx7L)Q6|EibbTCBh~{&v~KXRa(E4f!tQM?1>?o17O5Y2KK8#aaaqM6k2U%ll~l%}W02Ujs_mxP_ul3w z@$t2sp5z&D=TT|d_3a<#*0p5a5P+<0>%?`Cv}1g6+hIwg8+)%$e`<3LPM(B|*Al+l zT*&ztd0zj^P-BEea>JFRXr7O%veK*V7gI!OZlmKI#F+wvd=!*hPKzYLz*V#Ai=nr6&LDR zz-1=x;t4@;m#|_bN}!?)i^7EnT&g&V!MtlyKy%P{4EGR zqc;GjPkGqLyRZQ4*BS{M7(cqjZGy9FFHacjtK?;5;+T)NhK~4X)BK+!V>?r4bd|gj zcX(U}0#D}DhZ$P9$p6z$`eu#01fo7V@se5j%nx}!6LhUX)C&C;oX&qQdC9m%SVD0y zFzKF+%ee6KTk*g-_?v;%gk7$B3o?$W_z3gsZpY3*}A8Av;G@5l&++-NSf;;G#fs7>v|WXUT2GF z&S=+3(*=_8E3$@+K?5-##Nt~VcC8<~8X?NTn6YqoNVqq>WT<8t$dKSRDyX7I1$Y~l zaby=_s#}c_ASk#Xx-}SFAZpN3Ioo!Zqp6a;sp}R)%!h8pVOva9G6K*bHSXXLWLNXD zzMIG&$f{dr(^6zi(Mk&vKGwS`XV*|U=i{HI>w$D4^t?#w`m{Be1ihU8Do4u8ny;6a zPM$|IiyH@$&J^cXlP9n{CP-dgA;k`dqe&>(9O$Z`T?y9{04-ur9GLOpHgaQQhr93O z0gz?KWK`t`wO1*r5>RqtgD7YO8(=8_dPsUZuTEJLkqiqRv{eHK{=e`>78}{KgVJlV zw;f+h?MJ#n!%Ox~QE5Tkr*=p7>=ZggUW9Qf^`u}Us#&MnjIEv-O{Zpj`Y#+iM@~XB zlCR79TRDaNkB}vlS6NF_gOc2>y2@a&4<#15p<}jLO83sER-BZSi6f=n-2CNH41j_b$Dj}v zg_$R}8J~qN%?+`_oh`()f+}c14ER}fOvWx65jZmVJy72J(+?J7ml-CQq+o&|Ia=fE z_GQA0;WRF$GQX{vI8>y1Io#XW5c?kPPKC{MHm@I;0v$1G%~gjn31xj)^mxwtS7 zSuqZu{SgCTY^(9zu|{ZUDPpbKaFh)EanBIxzUBE+Wexh!S&t4$Di&@R%0&+D$lK4nMHgW5ym4UdOHnk z!+d;LfBgfz+$TL8)KRE#Z4blCyr+V}T*Vy6pftlz>&%IRLAh}u0x?O0Vhn~qLyC4OQ4@2K*xVt(4c8IA{$PKB_H;}-VdiL zw}A2zRtmjO4ws7jpsbM}J$zGGX^z9p1S0KUiIeb!X{3`9fHhL@-tE%BzdR(M`Opk^ z{~pM*;f+X7jZr;Dq`f(Em!7EK2)3o!gH_7ELjD`zy=?_KKpVxvJ^_~%VX;Euo5MC- z?$TtyBx-d>uV^1Q^8~Tu$sb6*G+)*K#&g;KA3*ef#=d?K@qc2wKKp;d#OrqOgU<^> zlQXQJT*wE-lMK^2;;GX&8^?$@1RRba=m&@WXLiTh(gKN~$^%r3cGg~Kgz9A`_U4sj zcQ5c~B|>GuRisPj#Zd$zRGP8FalIyW`kDCB$`4U?XoNDUqE64E30f5kT1DvX__OEL z))F@)!i>rYz8#$*4=sbNS+b3tmI{3VBt)ri{ISH&@Xl0go>~*K0bf!MzNw^m&ie?5 zE&{hh6Wkda{O99CEA3~hLYq{qT-nj;K(6GkA+>do>*1Ecvd z72EY`Ir&#$EzQ@OWbB3@@Rn0{NOR!U$@nvimdWIRWMgIE6_ueqUAPe2_Ztsn7ar|w zGzxmMTBd4#K}Sn}IA3XLzbRvzT;~Q0!%HMTF!q~IFmDe?(G^9Pjk1&$@eQ0=&ru** zKL_mlUluGfr!G`h!a4h7_-1Y2ayJHk7IvZIP`~M^(7}N zO5<*6CbHN50*(P$91DxxR*vWgz2q;(Z@H4bJ_JsrYWGh}=HxIopaX}1Kc$t{9Z1u z8`n2=rAOpFZ8!UFGb1_I+!{Vr#IvGQ_(mh>Q!U`KDoKx=Lq40cGZ@L&b9;UI{#{~n za_6AQ7HyTHb#tlrqNBe4qdR*eNS%}e`T_9~Wxc0sH5N9dt(Cv|3G-nKD!5RY48o|V-pt%>@Gv`;!Ec?0b`enj8o;tkf2}YFN>sLJ&F&aS88$xceg- zprxpo=Z%Ql8|MLAftbMNt%-|{EK4}Pjuli4uHs>K(-;t!84-`EnE~w7hvC#P(-%+a zU7mEgYM6?ZiW-7Gs7JDAYtU>DOP`yhA6{>~R9hSId3AH>qr~ijU)F%%9p9tRij5Gy zECgMF##wSVqQ1`g?jrL}W>;qcpPE|bX24k^4Gf(zaB4IrmH~we;phv zABkP(Yq7C8DHNMNTLj8YG=+!&uKl`+<@W@ZDubOaTLe|c5K_p6ueHoErZcVch6bZ1 z(}u<&jzzX(NC_RgZRS@jF5g_ZN2nR(k(soLw_mu?2LqTgW%Ha7VHV?@f9EAgk9KtZ zYP#1N(l4-XBbMF(;aSPEKhHvw!b^xt=hv?SH;y z&=C?$Oba9eT@4PM8B;uu^P>2U428eh?J9W$LfJu7bM#tSOqHdn&x4VnQ`gVpjV-t! zbYH~Ev54zTTdZeVPG78d&>>u`M-UoBhhjs)*XHgF?Za|58y%^k-Y6x_0!{`gh>ymh z0hSL4#I7yQ`ar9MryDwIo_?SJ^rWxq^^>nlZPdnW%%XTc!9=2#-&yBPG4$8or50h4m|dD6gkSvFlx z(Yq?f0oXaDh^O}=h!c96Q3q0S`oB=xGOt%$(CVSEE?hauU9rLFcI=ew2!YSNDDB{$U!j zY$V+o4?lNDTxkT*B=Fp)0ZW7GBb17bc~=$)RxqUsQJX4@0UPdb;F8XU#3-UPavsv8 zh*sGxPt>kEcwz|~ftn8(s)-n7X_1(Ps(o&@mDR8%P7|;m`mID9CO`g0;Mh(Y2zU^U z0p25I)}v&A0c9;QbT}PsQQ%L8rarNoiVg%sz}ojfSxY3Og;Pb%yud7RhvhO+cqjz0 zs>%!8q#;?6B3XHh>D$~AeCPBhsjwYQA8&CQ=vdM8xdp<(JDf}xuChS{JpFZe0y|1! zf(>e-juV5UUx-XocsFocLHwqs+ZA-3%B`u?3`o4SbF{c(iWnLLS2JE;%tKYjBaDUB zXgTC>B!O}n1$y*QQZY72XoA{$xq!Ym90(Pz7- zmvLgBS!ZwxQ=gbaadLmVDKU@XD-uIivWfki&v(>KoBEiF2SqEam!! z)GN!M;6n4OAxo4=jXNhj_y|E%&rk1QS;sK&}cXF7~_`B2%8Y z5@h}NEly1C&!XV->2gsH6uaioOU#8Gl{hp9piBRQ{J}de!TbZXqH&9he00>EXG2JR zMk8u~3I)p~7$4sD<-!l-TCkT=3M)B2U-`UbbBwB&`$J+NHkNGHWToW3U2v63*XB)P ziRfkaWQG=uY{sS?kMf6h*#Dv}g+r^XoLucb+2DF+iXBCKH#_VQDgH$8S6udKUeJwf zAv6{kPz%frByN)^n3QikO*2Is%xGatWE3pBnf*;J1>2!Ds>hbL)}xfSKW< zB@m(~VWeZv;(Xh`<@F6oHr5leV=YcW#Z9;&%nlvuggRXM4fQ26pBVvm`3U{lmPmsi z+6pz55kwo`O+zE{mM)&-dH#sWYV7@<2`3~p6vMq3O;z|ovCWFz8y(>&hmH%FrHPhD z$7N)(=%o_I_E7uq6y*y?L(-F5@~HpwV+juHoL6P>yg>++5KeE_%}g}F8A!M+@)ibH zjw1ub-88bokQ?Te*k(%xx->xV;5_7F`l_ryr|$)a;o^jc(mCn`VnbuxuwFm1jFhia zi0=#rWrweTAEFSSSH1d?ajem-cg}DuvJ4s?UgMOZAXx438d&})<_$v zdN!PokA$yB3=2ZW8RN(05kz*q)ud!Gt(~F7?sBRiaZn(I%g8fLE#uB#2!v~X^U>{E zYOFHS9@pLx>I4az@CKkg9cY^+t7|dSMwEy}3*0G%3xihOQH{WldWb|W3*s2oND|_^ zXkeVo7iLX?AB)8H^#mewC28%KF=#b}BGMC7SdLR%Y|GijA3Qf5D(rtv@kp)I{Y2tL zdDpsYQdhWIgab5GF~^Q3e*YUXn#j*1A*+k0<}i>JybLxpHPn0J2xlaFlKd9h|d(imI`=k>3pz@%UQDK0&7%_vH3D2y?EavNzD z6)*I>4CPs!$#a^Im%!92zr%LJCNXULdch}=TjZls1F|&SoA@ox&d8Nyai=Mk-tt5E z;zjt+MH#JPf&ZMZ80+PK9nf-0X#2PXOYgbYw1&X5|7KpF&T zn*|d_{|5slNsaRX(13}D>G+(_{E+e5ieG994P2Ex8np(J`0KLxlPZIYm>rsqAhWpw zjVs(e+`p5CnJZd8S3omh=b?h>oA9*z^i(^e_KrVmtUtCQ@QR&xqzA(9tB>KTTI&HFB{)G^#eEttZmz3QW8Px5l>2T5Z00srTBlNaad7phZ^n1F_#x= z%7i}6k)GP#q#Cw=)w#rO_F|~M5@Nu$_(O_^I$z$ylI@J1mU%Z^gctP%lg`dM8^Plw zQ4~m;Nj-_RpCss1__7az5)f!mC2_6bQGuk1B%7Ou(WgXR|67A95L%)9Sc>m)0HL1J zpmIyXN#sz+T!{pIztUz8`g$tRZ1?tm{Z<7wM<|?D?1(uy{elG7n@>#9FWjz=)FbV9mo;QR97hj1 z|K^J<2MaAxb$|3SnHIvg|4b@|i7vM3v%R3faUzEvb(a;U@JllD^5dbPu;c#^Q(qNT zSFmi0LvVL@cPF?zgy8P(?(Po3-7UD=27f86o%3t++TTCeC})Rzw?W zn$S(#*&v-5`#_{@DyebqDoYzsobg_}-xLh|b-}_vdk83Nb3;HB(Zu_9FOB|uN6YL$>Ko(fAE5LEYNwN1_ znIApU8IT{TuGc)NYRv36LR|VbisL0aqvx#u9Dlle2$Td;1mNE>U0N!8hwVrx&(s3G z8rU4`7JG;FP<+lveAvN=YP(7V{lFLc%dSvfc1h|2$;#sS|4YsIo>ja9E1YMO;vo*h z?!9ahfL;Pnnjp`S6EaQtNzlk&gs9e6+j){6l3Lh_=>?*b2`x73@a{Re#~u8JDwxzG zLjd}>WtEN0(1mlaQ;ZMh)y`UAb7y4G&I4VWQDLz;g#>ZoFe&G=EAXPNg!x#NT+1Av zu5VjGOEPbttF=47j=(p`yvSI|S(I

ebV@zEB2NDm*&gZfr*%u*tp)#gptt0?*?M z;7{O1dz-2T7}p{rJkWytXU5LGhWi19I}+k5ujbiTa3{7 zW`q3>Eh$2O$+5KteWYOjwzGcXs=B>yna!8eh?vc%yKqbFsCX*{99X3JaxOHf@KAUn zQ5~Sbj6@10k(5*%FX79%grm3K6<2}``jNbxs)IxU_vN~F5oAypMG2o+i5(i9>1}iY zuLmgzhgH1dg@TgO3Rp^T%zxMe7SnQRrXnr5Wtn692ci~S2#h*j$)lmU!f{7QYsS*& z?R8REs$t2ar7)cr15N77;Y14a4o7$M88yF{Bu#o8R8BEW*M28P>`~Graq?)+1mJLv zN<6*YrJQPDbg&3KcR2{w7mPHj4vg+6ZQ~Yev%qEayHjIZ-`A}9A6%h}U-{Kc6&J!N zfV#$Q(j^t^p64?w4v5Hzwho8ne%eH;CG4H#hhQsoWw88Ydf3I-*nT)5BTqs_NTFq7 z1VltLmHGoU6&L|+$)hvR)CmKEledG0x_~dJ3(#PtwuxZ+2X!d@8Whd6yBpp1R0!## z42;a%(PRGs9Q0y={r?}}paqK|gNQK$-Ls0zi2m_cc0zW6+k0hK>U{VX!vWpKkwZ}D zH;m~TnX(NLx-$7mluz@B3F=+Vp^*MPV-uxt)l~nxwiE-gh*(Ja2MO@E4J{-c=|L)e z{<{cpU?Bnsfg~d+jC;b63+>)=nsOtMQAkKdnm|Z^G4=&UdDFR41W7V9+x}-D;TK%! zUKK&wP^$tV`hzoqGckUOA`Hqiy_GPxp zx9m%u<@0eP71EW;=YBPT}O3eq3q#Zj0_gRG3@gz7&ZOKBa% zUF%gy@Jg0QqE+{Cof;oz#9I>>JEX8CXT-OWqCMU=qe(q3ldr3w?H&Ek)JB&-OhlCq!+VyY+%&CvK^Mi>=;kMArtJ0mZ*Hly2go>b?XJ)SjAV;astP%vl&=KhhB)w1`dlg z!m)HBH^SL&2fQ$r^Fq^KD5)9++Oae`SJn02I3cuad21MSCP20%LS~u-ewt$p5C#dg zKa_9+%WQ+hb=`wyM^)P}LffCnYvod)6}smrpbtoNSXUs(#AXmi62PAq$M3r9bnB$o z$N!n^*0sj1O{Rpxe*O)$-U;rqtNUYex|KQUbH#Q_z(ufW2*1~<~gMp6*_5C-^uu*bbEzhv7dq6e{PtkUz z0~PvBIPj5-B|M&MM;n_++ULOwLR`TAjhqitWbN$?<(tnW(HOx2l0ZsRge^Ixg!Am;RVXqZxTQDWba{L&-xnOuje14424mcdTz^TDYnyhuf*G z;{||?3t$hM;KetvG30?CIUn0``!a#yL1>o039rav0sBZO#H2z-h!G%plwcF#X6)oE zpkQZ<5&?5bctQcD!Of+}`ED~4;$&cA5D_plun^^!LH|g583-z6kn6PJPdikJ4LsY! zzE|@j*QvvRdc%Nb1qSpvMV^H5r=$Qg8y1K&TgQLTwA{2X*z|O)LRM;><^e_EYXSQp zlmvTbL%<}VTw8XPExOx7d_G%G;Ey+PB~7)4jyv)af!wD<3yT@(1r+EZI2&%l83^cu z6`7FbC<1YBLxGkGj1r%T0xs@& zBRn}!TremDxI}EAENBVo;AUU~lXAU29uoaY1O~l+w(!&p?V#`)oCemg;8xI6I_&?= z_p5uq&IKdXPq#{1;a)$M->2$<0S5=TH;oTMy}~3A_{0$GV4%`!Q`|7aU(_d$A5Vq> z>b8)nQQ?&41PHYDnd_7rEs*5-V&95=klF% zTr{`!hd@J-A2h{5V+YViK?aDo^=kYukqSNpFIPi<=wLF7UqVe1K1guHSfwUFN4Mw6 zgP-$bq3HOCgM(L1z7DoYoelO9I?e)OS-S;!uoP4xyp}N3y{?ietHw-hB?J`oAc(yZ zBz$U`^~mHZI8=D3fkT8r9Vm0eTB6inCJt8RQ+kQueg;IK(-{tjLb6gxvgvOt)0O76 zd+dcFQxNl`yL7EiHAq6KU*H;i3CL!-%nBWAe?y-P@*bT~`tRvcM%|B5OlCVI6T*Ey z3t&UEc9sBcvcpgVi=j%kG9TwrVImu;x!9Bir1^roa2R({#k*A4pqPV3DErrU&8~{# zN`@9Yh7`}jSiW@<4emV_xWjRr$LoV0rprs``M&+@>v{Kl(*^1AQVxlXBum+e%(P(f z#kY051#W$YfJ9en4qhF;koAO9w)D2-6lnmN0fWP;t(7$5_lfgqkbdqIIXyIo(dPDg zfnj^U@=&bES>DLms2}CCyar8(Y+7t1EHu|I64I8#wSaEKrME;m6b`Aqq#`GIV=t(}*CP=vXvbs3NzYlX%JTw-J( zKP#s)Ajg-xUznIq!Xj#92FWt-E}RmnSwbj65yeScs#`>hUJZ0MQ%kr}hb>XmnQJ0Z zW+8?36WNzoA5RCY@*KFItg%Ex(FXW0tygo>HL+ZP0v_qT2v^Y}N2A%zn63h9B54#9 zg^8`Kevb8%E(hli^9y;b(bGw2J1YN(a&R(8-)&nMz8fRNe~y>a1ujfoTWSTLV0DoH zJFMS#`;A-)GH=9lR9^3m4i@t>mrP%$858Jr3AvY8O;m5kB({tG@>)7tOX75hyL{fObY{H?@9IOA8{?C9q<7ab1+^8m+SXXf~sXgU0 zwO}I8?tnMU7PU|X!k_Ox=U%Fl%5@|C(`^S7<@E@Ye>v(kOW-dt_z}{W|##` z4k0}~#({GImpy`R-;XQd)M>%Ze**4%0r09dD>YY z(z12|A1SdtnT7tVj?7rGcSt8hbAoioc>p+8q0g4PDB4;6*7QH^s>gc3Fp*u&?^3HP z^|&ham|5VRNEF2TN02@O@6)j>mw~(VHJ6a@(Yi`bX+b)=UEe!;ep)>+Wt~a>oh-E> z*ZGuza(80YB!1iCKz-jo?F=ey7a_#Pv*YM5AshJpiosE}o>~6x_iW+uf1oG%?`-CY zh@=E!yc(H^hsLb9(PsgOE!OkGK&zkWYf#owaZ%#aIxPI}I~I@xK*w@;Y_KArLgBQ` zNa=GxG4j(~6j<^kefG2Kideao!5I!iau_ZIfr!iL zkG37wX?yxYK-b(a_r-Jv|g8D@W{9R{_AUJc2#H4^$6hDaZwNFQYZ@f1R;g`t&o;f-bt zn76i$F96m?GVnS$FEqeL!ogvfgk)Odv*@-@pUE2UWt=#3NEpW5Z%2n;j?7$P6AdOi z!TF6|Snd)_(4)RTE#6t<@85!G?_BNg$7CvEr4g@j+v`T_?huazE4O38&*^bPtb7Jh z-K%oSz^ErzZ}V#jU1cGzrQO0LY6LxzMyn6~UN^zA)WQtbu{QnbzA|9|2xXtOy`_wL z638DC$#E$oKVj^K4E)d;Vpa?Rggd&(aVjY|?l0ZO)0}5jF-i+E(J03L(MMlK8-dch z0@Nh$lgMs*8Lc4z(kEFXfw@7+*s9XlFb~IFhiSaiEn8>LggiUQJS0vc`ynIW646Mh z*4d~gpv~BcS3s%GmJUOJ7;HPlRJ6I2yTEM(h{34D6e6-`U=@HE4Bp|-Sa+!mOuc^0 z%ZniJMogk==!?jDSE8j8L!# zfImvUqVp51JCaw!W?ROv#j2S0W(;x9r+@6o?Lk@S3k(z%3?f==<#V1V12O429i9t^ z_-j+JJ|nIr(VRfBuiA_N5R;}q{0;LAHag}k2fH2n57r9w>=#Mr5=%G7KI}#+w1BNO z!S{-$PX7eknOyFSEsHlPz1E(|c6hs9CfQOl^)2Mpf`1Ov&IWG&?+~BUQj5{aLCvh_ zrPkoT31FSOHOz_7v^!tdSG<>Ky!jmCy-ZTr|F4 zSH7SlIBOI_`-HDiKc|uCdap^p@;BbFW#($wfv^aK6C$I2s5(Od_9Bu|#JZhwPR=i6 z&qnRNdUV-UfX_vdr7Xe&sGJU9I{t7jnv41+LVVQ_|7 zM&9J%n-}{|_a#i}F0+bbM1>f|^Y-dfwtJ8mz-5R+YMlu0%vgq`LD(etKOFovY}bk0 z4p#z#LQMifgP=+9;mWoIgaldq;fettT92Ax@J-T^d2oqwL)db@pAFC$@x(YIY-XT1 zHU2>27z7{i%BZ&G-*_&*F@9=j>C^@3h<+>)G9F_(31hYA8!|ri8(~y~Kzv01W*p(t z9Ym0ksj#$)DRk3!wk1wE(3{*_fr zVN~Zw0rLV7)!!T5l@PcaM#RTzps~Oub{c&M7;+=AumMWxLRx&k`PJVtwkmetm`>i( z+5`p!hUw%5-s<)L%YhkpRkthf#q<~Tp?d==CgntV| z$nW*(65op<$nSNtMgRH~bPY~0YgkAt$v-;mg+gM15n$Cqfxygw1YINRt~okVrxW&s zj%g`jxH`6LaBFao|zarzK%u1;Kgcz%3fRrs(DJE|~w zkQ78UanRTDq0s+TtPFwX8^o?vfkgU(-S4Zx(4C9HjcnaV$B9QG2&WLptuj_Dr<)K+XY;qOqYPuP!u^{DtegPJc~%M}5rh=9 zDG222C_^YUhX0Iwca6r;ZH0aPTGPGe@b`Pz6@8=?{k^lxkz^2WS`}ak*ywO+ZTI+A z)xl+=mhohbY^z^hJmHdLOB4|9gY>-Vm-aa>slnc`47zpt_t5*x{d$`k*OWfxx}A-S zll|wlX;?tnWl-j}cXNeaZ93q-QmOlk^U(G#*Xv36cc1u=L-Jk(#1!O~xkRxhwqi0; z#)4(@)c*P_)j++x4lIUW-{agB(p{Io4CGa;3@YfO~qV&WUUt^=t_}AYCPAtorf&Oj7uafV@XZ9Vu+T(E?|(UQvE8iyQsNp7|3`^uphrdb zO<45aZNlwA`uxh{$YS)vWaA`!Te-nxUqsUXzg~Oa5f2{i4MnV3ZiWT!AUI-$oSdy% z5Q%K{(F)9-kEV|sO_4>wN@46MPtv}c1TfNT+v=TD}6}tDM*igXP94NbSHq-hU zr6AT_NSTw!h%^-$^p%mRF^?lPzWwLtK@KSXgcZx~CiDi?9GM5S%?SM!?B6uIWdv|Q z+k8uSBDro1dOGRMmx$1}o#LWCbPT4=t_32>k43^MF8X~R(S08??k)D1Q9$>W7uS~p zYhmYT{a$y$*nn70Blaai>(jjthDPKgNE8G9w5Lfa=*BNRb6g%YGlD5y>^^C`p1@Sut&lz78Bpz$-2NbG^KjHVF?d_?+H5E~C3vPWVxN_6U_W;k8 zUK;|t7BiupCu>24h0{qgn(2Gez7XaoTyHqmD1~PO>t(A%qJqrGT^*(f?p|5IZHY5h zh%*x*xWvug$-2Kp>htGn_>KWLGmk4ET~1F&r|SvAe`>AOKXN&Xp(FlSb5Jc*mcQt4Wi1HZ z_0E9lalS|b{QpS3ICZr3+!;&tx2bz*&Izr5X&AZ2TVe$?X&7J;y;*QXPfoQRG6t;! z(>FyC>4}_0&l^oY+H32kSmMty#b*yR0Hk0_+i^3MN_L*Bd{gK&VMW4}la@gG%mtXx z?I}w4d?bj)Z4U<+cecwPpDxM0Y=YiFL)*45@7V_Q_%^VNR+76q>|c6XFj&? z&iZC}NmTAoXzqMXP5UJH#hU# z)875Jz*xkJ>eJ-BF;L0}#|J^k#{dy8(Yq(8@5klm z=?zDp_dvr^pj;CWnPGZ2rFRHKAv#nD8reZn$U!DBq0=$tZab`JpIzGZkIdBfu?z4GkV=CLIT=y+vL7_kG4Ez!s;g za-ssNbDEm0h*Qelj!4XaVN}L)R*!{abydT-vBKIFgO6`b>Bf*i6kN?eF$+`-WMmzd zNGGHGZnreBuqg)Fge}ma{pJlM)y3_>Y6NP2^J?l(H(7I z-(4y=hUiV~!^IIx1dApFD)_fWWj`rfX*RO5*_avgKE)aWPa_JvpoCf~+1oX*Hmq92 zDcZ2M9Da+#8byxP_>^gAaGr|Z$$olqoye-C6Vn(@AXC(%KnYrv;xqrY`?Xm|6Ear` z&#t^B#DPG^$w-BvvU;{(;^IH)UAyC+8x@Ftbn>}cEjW@W{R6BktpMl0_lbfbbVQ5c zj?d{4LtuOXj_0e)3czJ!uCe*GfF3g+r`B!};s~>cJfsP_cLyXGvCCFk%LjH=2fKdj zhW4ib5yggpJfftXI~s(beO*forus#!sA$g}R`T(yI47py^Xw-^ZUp)(@K(u7%4t+) zFruEBY6=(=bXgI>@cmSV1@c)qvsp2PU_SEXxN+}t{iGOY6#CK`-@uxHTSdKBweysu z@}EZdcphf<`}9Qu#StC(^gN%c|BMbMDma^Df(DL3gLH5(*O=WOe{+PWQ}J-#CZcnj#72lPHghxtB+>}g)9f1h?J%!T@tigq>mIk8DK=mou08nhUC zFjtD^C46c&0~EgOY!qHQ&2yFP&SIoAPS}_jaAtuv+3bqQj2B z8JPUxK2{pea(~PU*oqAt4@q?`^x+8T|MMk&5Hi|Ao_i930>tiNY_{jHtLb zkOz)GE`B0@BNx=@C1e}O}5 z%b9>HQqBvmKOecEHm)8Ytjbk_ZDV^W zuCna=fN8u{fDcu(nmUQjWm5^N5Hma0h}ffSJd?Qi0|20Kalz7cU|er8Im3l6+-Y5X z=Kf@mlRDQFJR%>TXTzT|0v~r}N28L5mO9wtrP{fUC5PfJ*+*F)2e3mY=FcL1)6=ZO zxktG{)4rn^@sPaJ$0x<~XGtc=*|Dbfo3+`ks9*~NaL>sLNEEiqxfh zba;RC$H}YUv;YbvEN*SS1dpj_1E|J70^JL|QGcjE=I#sfg6^Sv%#1U3=79SO;{^%v zTB$tzAWl%64LPi5NR;(&@c85Hv!Bl89|>@5SUh?zS=pfNmiy?t@b-qtOm6##Y9sgL zgrs{;Xi^GuWzUkhCuOU;yzpJb$i6f&n+|a`D}ryTvjirg-tFmiNW}@oF~xRm4Q2;d zeF3Zu8jO#rdS(xZ2O+^VGZIo1{#@^>HPjObNs7<)t;k(Bt;PRBi2UUIrHNQatIFaG zG3#bQuIl`u`FugHn>w79bZYDhER-)umE>7{$U3+4^x6VQ_ZeY&^O89O7nf^SZjvp% zW0ps8|NdldJ7T7kP3UdGg#!LNrfV;v(5=iaV#SD=K3XAn@jQTF}hsfk~{Uv5ES}F!2VyUO+X4SiUB9(hf+TTH}b;XA?D*_sYq*8+W^Cx3M0E~53NcXugN zsbR6(4L<1Rn~wZZ_%4UB=5M)3YUkvflVo1hK}^X{T=f;OuCi`ptWTViic(>CT|b1l zKjCn6p1~1{h~s~C1*|VmW;{keN+%@wkm{&&>&t7lK;TZDBD2y^_A#B^>={$}#N1!z zCH>~U`o8rvv0<{wQKiRy@4Y!54wE|+-CV`Suk(1EQf{#S)i1az^mozQoDU6h7YM2w1icjq6xB!5`Bj4p2HkFL*9(d@ zOB-vVJUqH@e&8=)Y9#)nIUAOqE4d-1Z8jcj3KPHNh|hYr-1h8vPn^Mt9H>WTXF`Sb zPpG5KV!{()HC+0!OMdq@=b7f`B@b)+S1+ZL!0QnH?;fmxJJJS zzx{aNcd5_OYONogBfL^}+5TF>T#^y>dk3MPKPx;T`MG<<2*KnNtl<&Mom35IcSFD(YAR3|ps zac4CdUh}75)yetv)ZkriZJ1BKC`?njB@G=CrA<`d&YM}OC$*~e5~ck7ef&uAN-7$; z?mr>h4D^K5+DZ&_i2Qd>lO8;;keq(hoPGv`Sl10PTy~P)?+Kd)zyEG%OS0@$q8P*G zh-*%=FB`7o3abC(t;}@XV9YBjs9N4X=Hj_2AL$s9NDqvToeCr#)hV~|wkFd&qs%$E zflv`Z?4V#>g0G-Dx0~NuU$10fOU~V7uOh-cNu99ycC^8CTI+Dbo}s9N$|`;2JZeY3 zi~cheV%Se1ZJJWR{#~>=#VYhQ`tb?1axcOH6^~9}KSQ@Tp!v|v6cS%2_1Tf!L-r2d zcWU(rK5q1=PM(H@8CVw_h1#k5lzYhx@JJ8iD`$!?DQ)!pk3k^sT=#ic>VZc(A%&lj@* zWb2yNjjKY{Fkx#yUK7IRjvM*c^iF^AQ01~|ds)+tV9vy;^4wVpVwLksW>cTjP(1P# z4zZ+GYDwcPcj{}!6qd=|3!TBg6xI_o>t@f`Y8FWGnD@0TfMrP^P#w6vXwe9!h3_W% ziD7>XSeDE2ZG7ySuD3n_xYnO^>?^Buo|)-bMMQbjtN#4s15)|>gs=~an`f9HVN)a^ zP}}3!AowC6N_BkwQI5-wZ)YmimbfVWm7!#@=8S=ogLOGL)tIN_n zADr5={n2@Xtm+jmm$-#$*d65+wmIy0XrfeH!b17Z! zpt`KOZ%(T{nk$(@^D4+hy{RJCz{vq+$CQ27e^MY1E8`JJZq#^ryTHE}xxsIVcwC|9 zfd5)+^QZn5$ykVkRZtz`?SwX3*)*2R{p`y8-Aam&|^*;PIk4&>$#6 z__MANIp`DX!L;Z2VbOv2;TH*|l;7l>f6ibbS0l?k6aC07fsF72qLS(rv)|J8X~ zk9p6`6|=82Y=UU^a&V;)9)fPTXov_WJyEthk|2VLh7|ebVA zHxBQlNm1&J8h1P(H^|VG`&92-!M+Z4`0n|Tb=L|wPJPc+)Av|waBwLIn2R2@?XIlnm)>V8sGsF^CGV*k zG-fq6Uy}oEly)dc>%OP2&j*x?7`}UOaY(NHY@Fc?mN-$KsM; zk6n~t*Lg2Zfx;!lU(>JeFe11!b|L=O2wh{N_A^P#wtR~ zAG6AzY|Ws24=Xwc=b%~DHjO3aL{*tglW|%baevjir%TXggrC@#wofQf$Psx%Gh(UG z$lW2P9l5&oS(^G9SQ&-QPliVRY6YraC8_7b|AQj7oQ`mQS=C3b*;Rb9(=cho6KKqs ziVRz1MDh6d27*9017)=-69s!`>T+>bB5&Pa-vSgy~at&Fy zIaXfK+!*3DQB++ffTdYdOc5Zg5}~qkHFu-#wzxQCh($I$pbeX>sbKlXzKX#I4<_&V z7>ZApdlN;Fswy+j4Aa(k)5b-AuHC%&WWXTWSYk7S!Qj1}rl*ith09c~-(}Gk> zEv7Ce&!RF9YZ`Bb&T6eI4y8T`x0YWVJ@xbhi_>PdmE3zVwua_BpAPx72RH{XOw_k9 zw{zr#&}rbkb*^X4yJ_VFP_TvjIu=c`<&D(wIl^966t&%&CF<|nIo)d$3jZV+WU`3C z3syYv&QrZwNVO=P$lR3gstdNqe314`7YbdH?bg;LF!GzGmYTCeX(1~UF{eK-DpcXT z_~rV~(|zihrrjvVv{=?-@4TihaVf;Hso(^hYhHZOG>@0Dk0cA!fiw<)=45%uIvj21 zJP$3kEzMUFcg!lS{cl4Q2=7kDA6XUH*PN2qX1D<1IFP@G+bnSlmEUs0T1)E2TOwhz z3hCrjmeHM%lhG~2#3tzo!M#fiAI-0W?AP@p*H7qs=|aFhS7|l)Ia%cuw+}K*F=SENFV=N z@^w+3O}q}il8;CWBu=_5KM&f5(cTR{>>aPh58)!+E1A)7Oi+wj9}MHWlzu;_u4Vh4 zC7VJ;&=c|Z3_BY$Ml;6z%AksZn`KV;nd)1W*?ffUIR$?*?{W`!2Y(hpiIEwY31Z`DjbOEQ@~$KfiQo;TO(8kRIYCr+_8P`ekK^wEO_dF+-py`J``D%#x|N_hI4AX zRi3xI>(-Xgw3~8&^UIDW=q>2!&yDKz>enpaNavn&IiqFOEysPcJ;8b19I(>nTmiu^4mm#lo zbN!DT%GRxbkuF5a{H0O*`p3r0wr+fR!1bTl=El_w>i%a#6qW|})=VBErhk(xmN3}S zrf(j7vLk*Rz?pzKIuN6Z?2X`^N%8{>N3&MJS2QK)O(C!Ga2vV_Z6@3xsBv{8@YKsC zHinJk8PVq6c83%qyYB4jYsxIFMvY1Pw<|iYU%H)Ia-&r4AU#mKJ{j$gr!Ig@eT7Rb zm(@*DKZJ8h{A;N6&o_)~4+rHJ?N_$9(Vgd7rapz+>BmT-HImIhQAvM7kldi}{F1Z2r^%@lzt)nAkExSF8 zHoG9_u5Jmr4#!vxs~^X5@FghIBejAf+h*2lfW>^DS4Q?}OE@e0S3QvuB;=LvCw=#* zX7~G&s0ulsbkEmICdivE0pZ7R{aplMo|LJnGGVC$e@e^Vwy4sPNkS}=0AjNZR9@$( z3dSr={>GfRv}|}?PjgfP%<5v0vhkCa;d=)|M`POXLslt9&GN<3I~gZe@WaUQR`Ayj z>Thy?8un-NoPd`$(k>zlFBXAd`xB@qS)XV~kxe(NaTlY(jV`D*3tI?GOX7Jau5E!H zci$WdMH^w`72J?|B+iEl@)gArcov&n9g+r+$U8vcZ@&W-ORkOxyN^lY(q{9frwxDK z7`onq5x%^U8WtTfrJada29wZE#GmbOiEI@*@G*U%@gLr zq$>M7-J08n`bg_-Ocvy$>YXSqV>WrU6PbFxM$v;TaGq^s`oRmw7@l`Cc$-&Dnt%4; zi|j{An)HunH1Cned)rxI=JNTr;vG5CQoQ@g4V;!i}87j^^U0QgDFWif_8Qlbd40$r1Hv$!T0*@F8ZD?wDizTJnVYT z$3(HuE!YP(q=di#EO+DTP$%7e?XLPO-6sj5GiBD|`|8Qxf{aiB-*)l9WY!Nzu*BDGx;kQ9lo>ieC>c}X@M{lu&>d4P;fP4*729bRIcZL_ zocXRe5?3IW0=|)L;vPe`$u1c-b%hUATQKFv5Q*q(ypngZ>L-Zt0 zIwFTrm6;I9W%rfbk_X(wC~1@UhlkCcOOhp?RZk=^DF;*NFuT*8PgovlQAxsREdO&Y zVxdJd`QERv=wFE6yv8Yd`nL!pA?B!Q8KIyhtqviepxk3^!%ocKD$y(O8bfK8=)V1I%p1Q@A=C1 z^lsnM7PF5}Qk>8M_TfEcNui!BA?``@tn8>;aEVg8!*q}&ks#v9H)CQ-+Rs}f(EgCc zko#f68X7VD`b)r7AeR)Y&3vGny0{04WcT>I2hmi*)xzFe`%&>ms)B6Yr(BD&VU}AW;dx)t<)v{ZgWyk9a(3oJRP#&J zDWYy+SzLa(mv1}yj8SqhY4|q!1|mU3_SHPFA6ee%ZsD5r2+N<7>=OV>=!@zsa)>0v zWWdA3Ss|LD&?xb`klL(R0g*&1`eOzAhExPSGC7*n&xCI&rATH!3Kv7=CERdY zI@%q>-K+Tu35upP-I+795%}CcR*oMQPw(Cpj!MTlM;1HAy@0wqn`BI$Y5o&ThHSwz zao9?k$kJn6J8+M>GZ3Gc&qW$6&OXK57l;^wE-#gI9lC=|8w%Rj<8`$iLj+B#6c&#X zw4U#3>aHnkcCkOj?cH@tM(*sAw!ALts$OiFvFp~FsW0!OTAt`K4bmNEY!2zXQ^rWs z#*%WL+zH{$lx*__lQWDz@;>214Khdkmv4U4LkDf^&>DQBPbbj}uBgDt?BZnFo_yzU z#ti&~y2g_Kr+r*vCTFSZRfnMFF_%1b{txr~@VS`d;)U#TAJ*S!XU@vgdGgfV80ar*WxCLL-a^}U zbdOD2^{YvwrK#r+43(mfIg;ED|0D8}_at7Y3!?IBVQYyJzrJ%X&K$G|;rN_GR@Zs_ zK=R)nqQ=3K&lp^J4P;f8nhldtT+&0GNeca5k0nHn0-*;!$$xs#Rbc_l`~gyj9JkV= zg}vT)eiHo4TC=O~op{r?TIM-;SCkuiRsNj#4|Y=$?#VmnCfrx{@5+$k-td?oZ9;2O z*sXL2g+$w7Oy+vrX>?1H)HmAHj=boR9jfB3ZVO=JL(QXnX^28_u_0bQni0$v<1HmQ z_6xULZQYx;TY{%8oihzvBE#OxL_*^NR_(g2eE;Gp-BsalC`}$l;;>tr{suK+oSqe# zFYGdQt$c26-ZQq_l0RNnjPd0^BuUAn%7VSwYmZf{FXl|mS&~(sBgHj@Qxxcm=_H9K zBt7D*9;gr!$0ta3Qc1fbL8XJ5U4@G>hFf>&BniRe&Ig}dY~9_t_=iE_sGOvk*Wwex zKsYjAv3fwHY$J^)-kw$5S{EYs6z;+3Ta2bzKgTYh;!EleG`^j6mo<5#<`Inb5cqgv z^CHJo5Jo-xb!w!&Jm7?f1CtZ^F6;@5c6U+R2c}2Fb(oVd-*3f7!lmLudJ^n0Ai8Ly z9xYa1qAbLxWdCTfwl9<4G(r%fK2nu#X1;d$cB(-qu+$lKD$>Z z#B0x=#is}7Z^9#3T(rJ$rqPB*G@Khw|Je@cm8VsbwkP1s{_~2Uph5R9XTnK8t{W=U zwC9I^S~lUP*slG;R?zBTVj z^J())%oDD+-?HVw{3{a|yneWhht;4^5Sgj47VCxCN+*e-wG}|>aiC%UYzXMn+9iw4 zrxueQe2$e)*fpNjzR*v<`8LvQu2RC3&X@ZyCEJFuw}2$FZk+0<0oe=gx-gk`i*DJFu!?n3+n6}oP3~;Ss zbhexbjo@t7xOKwH@9zN*!U>{p&W)kvBukNl4b>m){E4l*71%>g=XO?iEAxc>isk+7 zm1~^X(+y2wmkCSo7Bj>GKdB~Vllbk!ixctgD5k2-<)Lgn@L}N6YtXHVFK>}2T)R%9 zCTF)8gnpq^)%HO7-h_GU-!%L__(+r!b6pm5T}h*@piR|O>yN>Q z^o@`Jf+53@TwOcE68>}TPh$rh$njyD~5NtMy!;ckkyDDTBnl9*SBzSNxhtnuwrBjD3`O5hR;kT**dzZ<(sH{cPq2u{mmAMzvZ=pANm_T zb#%6AtABZhZKjQcUija6+EP6Apa|lyg9j{w(!`h!V-qxQxTME92a)FQ(q3K z21AYK|IJt8wQzW7b&k#6#f~j5PIamao&hlYI6Z;@|E{0UnaPbZ5eP=oJa?r}^aglN z#1xhv~JL{mhqAlGc!6CTQxCM7hfB+$c zpuyc8x^Z_xfZ*;PEWx#LcZbFu8h4jqkKCD?dUvYct$9<^r>eV7uf2cY>a)K;cAZ+i zj*m5&Vv20ukGf8R*UIfA@l;MZ$VMEK9|Y%z76u3QLWiVh%EVyxzZjEItF-0PW~&x^ zJsi7^I?hpiUGLzGoMMRSo6D_~)zWY*N;TKmtkzt9yxx8vE$+1`DN%{Ox3Hf?{cR(D zR7}rY=zu&*r~0`Z41%s;x$)Pe)eOtY(@FUMDTsB~=92%>1; z^JVGGLL1+LVCA8A!P`j(O_G8`E<%Rv&2PsD*QvEyb>&uBMX&!nNUMlXQ;G?zd5IZV~c^Jspb_(hW0b7ixWZGJRSeP`Q<`B^Q3IH{WR zA+kN{U`fA1ysweuPJ!r#cGs9Gw}TgOOIdDa7a>fgFw_LFwjcroM_Cc)mEq0zd_RQ) z56Hg3xL9y)$qaZtvUD}gjLoC8*_h0dQv*Y4f^4{|8h%#_Pc9E$dyzSg)x;j~_-~Yx zv1ehw5g&PJO|>!pme}c@ZSuME?CLsVs(>|K1f7LbiFEblXLv`m#6e~>5_;SzV+X?w zSNldQlZK!QY*aeD*C)>R2kU{L_`7dqoqJGO#-O(!9Wx7-r0MG)_#6;R*HI?>@IlME zp8?~6$cIT`MLyB19@2m&V)oaI7g!rtuVe78OjvzU!@s8`?{GRdn}Jhi69n&eXN2j> zf3d~B9Ysr7ZHq>7p*a8e3n9Tg!X$r*kGl9Oyj1UZxz6&mvomc&By;^RbDC zdrA2>$0q349dlhH$gcIex@L>1eor_yFAeo>XJZsO>C$RgNF`hbzDa6y(7Ft6SS#ha zAtylml`d)DmGW9Xq>+}J9gx-Qnel^XUPWeWnNL3l63G-@PnbMm zbHGI8MuwQ2mqK2F~=v?P@QZg=?V_(Qdw!!F}PZZ4Zl{60Pn(M%(l(b zm8yiz)lINzg4fzKH;@5xXUNC+)oAxWGybYNjc+R-TyHyRC5p~uuMXxL#R}X6Z`p@ot z%=V*KFMXwX@&$Jq;Z6YRc>!5!jW`ya37>FZ$v5M;`x#=FcXNJamX-KbF~|H@N-CJ`13k6EA+B&*aP3HG$9>L!#}H`)z#?Ka;S zXlL7)?`7KY`yGJSBg8U{Y*H~b`zC{ zcU=v4^g1_=$0t1)Kdh#~%_bqrp;DLM^om--y;cvrfhEZ5?n&;#Db;1<{C5(1^*kboJe7;rnxKFw)b71b)ZDM;A%FgrI`UMx|9Z`S3 zq%*A&_ik>@gRj2#MwH0B#eS5noIqRC5I9Y*&O4~Y9tGGz@)J3|Kz(AW%Z#OCtDdTr z)kvsa?WhNYYXhNb`31Isdo_!t{m~5|;`^ncjof$W;vqZ|bg`*V;Ap@nrR%h|#1P?XWZnxAgJ zgZ9QZvHD!5L2PAeF48U6gcMX2{ZV9Z1gj0bKIrsSQL+WJ-0*DJ%4N;@C{;+~@TX&V zNiaLnkNVjhepry>Gz);+z%!NG78d{=Vo?L)m^+`g)}_#`=@+~a(8@jcL5sn=mkU%P z2620SELV3NzcUzPP=6wW%M?+Sv;j^-@UyJ=+pA(@7MJLv!wr}o^tDtcY7_6s3~lxw zI}L2w|{LrVH zU70EhjGDEF;-&QdVoTqzzQ|TTkt$yav)zZ?oo?2KX3N~@C4m$UfJ*$#B zN`7JfzVMU5te?_|QBxcyozCaA+w;!j&+iEvZ{dk5$^d=OB`YfN3gQYL7N(V~-5!Tc zAWNDkSAo}*WsHN(Y2CCquqqDI&Jd~5!120RaK-)HnQRh#(-&x+Yv@x_?oCC8k+G_KOo5^sy zzVJO=U43?(rp`KC{G^w=2{rPzYc)^WjEoUVz70;k+6I$dSFVsAEigmsubjEEt!OS{_&4&%<-X8*{)igb$l z^L~HCH$S6h@vfZ1=(|{@kGiktJ=_AFyy+{YDhJ%(67<6If^A{E>U&m*IS?d2H^L6q z|Ra_>y24v9`=^DBY2x}@i^?ED+xVE zzxqg;I@*X!@h8a@1N(*e@~g+YH-XvnMJN~DNWkqKPtVPM=AR^SM7*_E1u{@n;_o^^;VCepacW&iiKFkg$ySs9x zd@U(%7jiWl`TlONM-HoL6K@60{7{Nto!ghw<+STk+?^jU$sI&0R9Rse8wlTA;fH4u43{k&tLOJ zg<1(@45P;jK0nbe1z3+?&Z|-JowF6UEk-7l>arYjxcc(lnmMuN$!n(=Q%qDTNhGT6 zHtJ9FGEa8tzU6+1xlCT^3f){I1^Y%U&;?hHgn~qp9JG`6{(~Utade)tR6e0c58|Gh z6ulAAwCU&%BMfizkHAw@b6pP=-O}ZI#2T@7u?GZ?T0f*FtRioLUAmv6(?zrTY;PYK z^8D(QFF0g<$WmzhVrAZsrKHkyk6mQX{6J#TSS`wC>l_m-14dlSYF-b z+MA*SJB%FQBdb;KYeXPy;)WWs z_i`7yGnLK3@qxOom(MAjHHU?mVgadzGUGv~n*zTnsc!XAG2vSB>caEeM^^1GAxWJV z)a5Y1j})+J-uecs?xcn(*)@x2kLaCi3N)t>kx+i#u>?4Tvy|H(%|BFg##i~;KU>zC z2Mpa-uM)Ob{jf(aCVFOD7i#+0iPVf}1dDNX(PPt0g73_+$T2%MzBW%{7b}WC#xK%> zGr_4@f9_M&fR(R1T&}$sp(fP;5>6d{DdxDN+D*V%`9OkrT<8B`{y|v=`PG>?1g{5cfgdz$2ilr?@^d8aWlNsc|ynf_znt$YWP%!J251v5S z8hmC`hMCS+DAaJxom>&f+BI%vPR&_5KCLH-ldNfG z!asAsu915sAnW3Vig*Xv?%vAd!A%;aeL}H!B5kMa7S>s5e_Lk$ewV2po}uvTyn?zT z5q+#TS?B!5LRPN|{Y6~tnmRcBg;a0#qm?zq+e7jj! zp+T?XXTQQB2G`q__)@gF&WzC)ODrM=X!reeqJ717%FIyhvF96D&>F{Lb8L4nk(i$U zKH-WhU@QP0^~fNkM=}N%W|2dGBL!8PC3GOv$RW1z_ZPnnIwMCoy?m5iWt?`zCm|Hj zy765cVhFaZeRA*4A=`)nI$>a0JDPp^X?2&paO(_(qbQG#KRrE&vsqwzlcO-#w42VC z&tCCFLbL-KCMw%$F0j&Y{8fXcAmtcW=5Va{$c6+?!>ZFyQtsgxW6m-e%g@RW8)hSq zA$_(a@;oMKLAwp(SCH;c)H+9Wm!~*E;J6a zYeiNMc2s&t>cLW?97ebT#xb>Z4R8;uV}plP^>cRZlfQk7mgHXXxUnnvXQen5Ne4?Z z8aqsqjevNICX}vroAP1e)E>40UFr)BKgHVP=$p2T6LCkr7+y@v8;^@#Rw z@IT(H9Om)Im1192H*=3J;#+*miC84iq7wrsp{eh}d4UhLmq5QhIe(1*7_F^Dl&>x@ zGs>DO{A^XH#WalkGxyoySBz{p_sgT_H*t%ieZr`D^aB?zlha+P7c1as%O4ndDBB5E z^xjSw(V`D^K6`bJ<7T#ppzQgpgy-0uQ1>c$k-`UTiWrx0jvu@3w6$-^`2|rn_^8=q z=j-S0dF>%Y6?sGGME0oloxCY(YRuH`)0qWbitm&2`K`PLdG$5Bf^`nxuGEcbY_#-C z=^T=>oucfxs!x-rJ`nuy8I`#=`hL@{dR)IdGm8`9=Kcw9A4FgqmT^lsRk-pyJtHFn zZ6(*)9ZK+%K%15+qM9`Pld$o7oJRjIBDHfJ2;enjd)FQ$=zH*6gU(p6cH*VHXGj|i zqfMulC%8m9O@`jf$>rUF8N?5GmCP}*%!)goL5Qp7(PU=&o2pr_@=72KlhdfMjmG6v zIlUv+CUo5fW^;_HW=d8O@$JSYnU4P2kq7@d^u(~U+YT(-oOe3E6;;04OU_5*Ilq9- zP1MYP7eD`tZ^J~r;2H4IZMxb^;Mlle4#BWTEV_@tH4 zyVge$0?&>YY~`rF+F?fEf(H?tTZT}yc@JH@l*Gt{BL%ISgh>^9Y9&{E19VhYuM$~< zoH66FU5h;jT7CD^95^&g&^`HYrh#?yDurWCAlHu0J6O!Dii0U6EhGv?Y5ST}A1PUP z_kw2Ll+V)kQj2BDRy!$HqL|XA~`^vGwTs2JW$7< zDmtN}Q8O{zyt-%Vjwy?jkj%tAA%~)ZVuOY1fW5juC%;}!8i5E904v0KQ$tR@qXxjW zJk7PtYt&e5)@Y3Y5oU!5(-e4G6?m#~EYET+^BXmmn>E@ZK;T&+@H7QTRs~3E9Kusv z!aPPEMP?or2$0>m*_^mU;&+yor_w{Od(jM1sMsK|+;5|aK?J)*{9R@rG<)g+yXgG5 zPT^_m+_@!2ORociNU?-^M>t5nsBwajK6j0vzVwz9h+r%x0>l4o@F?0&HRS!rz?$v- z^;GMi*^sJG`?pwW#lbdZ#AY;uOua|%fo0@%4QBQKF{#1bV{5>7B5{ z#c(v~Kj;n@sOeTgdb}ChBd<5N_hQn_gO>h*i%u()0%a0A{09z{N#5XY*8g8|FUkJ5 zC)Hl{mjeI5tqS{JZ_donfb0I!fx-^fX@Bzj1Ds)-!{J@Rod$+3_%AJZY|ijWfc|ln z`b$ftKtS%zkMXMEi~rM*&(Ai&?8{@bBqDUj};S@_{JnxsUtG~lwo!n!ZQsef~t{(py91tJaH z$i-YKJ6Lz5{2)eq47~x{6d&qB34U4etG_Ne*!ypW^g0Zc zx*&Ot(7gX2#EbCiA7KROry0cF7o*tz(}mjlQA@x78t>|V7D7|L| zjLUwY!5`rOds=IFsK+KB$3LA1%$5Sd|6OIo|AmlZbpHrPTpC+K8leAQ=|L}ap8wmS zq<`JOH$?-^`D+vjVTb?SP*(s?bCA26^LMwS_aIO)BYwFhn;wu$@9lWnBGae7MXupK znVN**MgO%WHL=etiH7oexuqs6ukm*3P$$pp&@aw$fOHowl!9Q@=v1(2a$1rFa|#%K zq@gt6vYEB(q4|UMKr>p|EfYZ=W)?_v9@kH&4f)(*E9SD$6w1rr-M9SveT(kmJ z!WvUTo1aaJDsCM$=K*z>0j#xzp`q-_YWm}e`W5+4;$L79A*kpJIOug#28>Ld23p_5 zw1YYlh0rCx5y>)hTF7wDDTU<}5q-7fMFa{WYVUL6;hS)j_GhyW7)Z+@g0mUnm$*yH z@+906r%dh8P`TTMCAOWB$6^=IL1OlZ_2&J}brp$p$mQAZUj~}!1)s9~oLD2kv-I-} z8a}|vq;n=&3J}Mz8;f=abXMo7ebrVhfjuVXD*pqtegX3R6PStt5}Wu3@b$W;61anv zaS7%IJ!O{aos1QKJwgxZTBaef^dE@N3#9!o#Lf;aRNy}$d68WT)jfU1^M}TOR(8=o z%nZ6_VGpIR{7(WWq9V0^mXMrcefkb&`){wh7S0& zz6Q4~u*=b_3MhY36xf8e`ppI~P~Oq9XkEuWYapZ_{~#q@eSq6!MOjYokMG zJ0tI2HvI;ygRciCnha{R0*BrfuIntZ!1?Z_vzy5zX9~y*mEDOdUq=-@v2s3ed(rJ~ zLmS%s^b^~uNmnh7qXMK9A}M(FgMaj}q>E1! z!7#v(lT`ghFts%CVmcNP-Y4k!nL<$p77h;v4+aJX8RlARSO Date: Fri, 12 Jun 2026 12:08:11 -0700 Subject: [PATCH 08/11] PR Comments solved - remove package --- Solutions/Veeam/Package/3.0.3.zip | Bin 111014 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 Solutions/Veeam/Package/3.0.3.zip diff --git a/Solutions/Veeam/Package/3.0.3.zip b/Solutions/Veeam/Package/3.0.3.zip deleted file mode 100644 index 0dd03e1f28865dd2a9201299644b4fb752215d22..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 111014 zcmafZb9mls(`{_qR@2zF8taMeq)B7jHXAjzZQHh+q%oSt=tEw`@?B-nfiRKbxrU!5JY=q%OO!_sel7Qq7fh&*y5+ zbyry@6I;BnZ>J3{GpVyavdih|8@gdVG?e5Qh zGHqSqyaaU z>OXvq5p$R@Xo5bwqtx*WM?j?5VCe)(=DF;COcbNjN|)EI61y2rfth^gp{e8W*@lEZ z;yV84dYW8lNID^(@k;1{_Q#|CTBCF*jBZrJIiw>o$($D}oo-QjJuln@@C?f@m+vr7 zZzHBTUsg~WXXUteC+xps*YV;7=x$A7Ulr7HJU-HY@ssPWHMMpb%j9<#qw^30Cq+)H z3h7JlV-}-WyS>lAlpaozap?=e3`u$5)9IcBzeP>hvB?>Uupx4A>OoDOA$DI{waE!0%Uszio{DykcbsZtd|IGndn}X09#0wKiE+p?x z&kghf)he4X!AW_jb$4 z*oQ40FUpXXbMVM_DSiVs%pRld`M$kcAVU=}}@fH*h2 zB9q3duxD}aQv6bdAj-ie{I=%FPX+^%l%2s22w5R-ed%h?cjB>zAXBD*egHk|vE!kF z-+f4Cnbb;f@c4lBo$Ax0rQ~zNji^l9krd&FX9_q_pi@3zhyDu(7l>mh6+y0$5bpVqe#1+rUc2RboVn~jZfga)rcyhsKofjk zO)sr%6co&fgs|eu;$onRPG$MAJB4S8=>8dOW^PB{6NqB1FI3b$Ze#NWbq9E!MAM-L z!`lS*d!`=(!SW8gCX4muOM~UmI8KWnL2rUc6n-#ew_zIUk!A^F5-S8k7#+cTGM5L< zNqw1%`;v?g3kXg2lY+OGOASbc2vmG?GBV*Zv4%k1BtfBv+^4WVSkyyM-iJkKpVaK9^_}r9;Jfc4?lCC-lgwX1?MDqt!VX z+83x@UgQS#xEW+d^BbG~Im0NogHqVA|1;m^kgQ7XCA_RLPKF!Nn=?&N>+GZyN=WXG z1RK-zNr(oBPzaPK6wis+Ge3-#596GuUt-^iE27^OgR8!l67!4OCT8(Z4ep5>{1kzJ zIen1W+{}#vB;NiR5X8EMxd4`4P4H0Pw77|H5H8coXv_`hzN2IbXEAf zrY7yXfej_DC1tqGN#X4VhZ20fBZkR#IP@9sY$TbG;-%50+TS}t_lnB7FzDy&Z}4i% z!9OVV#oLtsw9Dat2GI*5=qa>KK*N>vp6|?q|K@815osWTEszps=O1A@NXVoR)*gnL z-A2wX1#!G!%fgSqi&bme_q=Cqd#3A7)gP74M41`A&45jB7YWV!lQ{v}lt}q3e*rjF z(uWhb5M-aO9$vpZwWR7gS_wN{+?@}$;L_6iL#X>BZGugwZPicL;?R(1(4M*`I5Os_ z?YjxN!o|^{fGobuValE>U;_94ZfL~sYXhJ3S$Ld)p3y0q3v^_krg#qsSP;d={U_)g zn#NipgUeiQB|tMTIGgqs!b5`TiA=OxRtpXHzn<=y`Am)LGoSfKxXdQjA&Lmx^03&r`||I(p77;Z~03{b*a@sBeyhF@AvR>F;~3EEJlqpucLq#KW>M%@>DiSDG@ z*f!U=`6{;02=%F()E{Az{k`BVN;o~lVD9Ds1*2RJu5Rmb*HRTHyAS1}F9WDMQvws5 z79R>1KHAO1>iP>-1NkJDumU#ixOSL zY?3PO%PFz(H*XIw52R|06#8KBV?tpXhk|ppOb_31pHR%HxPgz9*jq>;w`CwsLPR)8 zowt6F{Ya0EkCZXr3A~QyVz0}*2+0;aS6dcq%rdMRm&A1MHx9@JmrKgs=?rj z!{#)jZ2{TlRd9w?wm>%F^>=yaf62pV=|r<>z9mZXz+3nRN8k2oVKM&-U$ip_snJXLYqo$ zpfq+QTBsEWg(wnb+ILUSScfW6v84(2{3<=5gW8-tBe{KU+X^J#NMmD-$(LxU1*fH> z1A-%#=d7$Z(+gCIhk=+O{K46tc!1-sqk1f1o8|HvsD0+x#nG_URR|P}^6bcwMGt$u zOhptndaWa=>~>cDLJT;?6P+SO1U7~4fLytOitiqd1nsQ*^LrJgdh}9aKH4Amf+Yr6 zl_ZpzQHyO=5>{y1f5V)7-Ueavwo#=xq-WB-lBzb#eyAb=cqi)jGa3;A8=QAV>+dK` zd(szwqmTFO{5Ui8&|dxFYhWD(hub@>Y(@n3J6r>2iEfa@RI~fN$zo*?52v4&@=7r= z78N5zz$o#{=>=oYAaJchXDSBgX9K66?1pNhf@Xpy#@b|>2}>3?-d%I@Ss>1(bG)(# zHlJh3vY_*5NzPTxfJb;Z7zVI31nfY_lFc7E=d7|GECwVesZ=V|BI?44&V^Fu;e85B zq0JVMNEL?}Yoro>a4dSgw^O{4t3MTh#+$P#!i$(7>6)y8US;_70NA0hGufamh$RB+ z1FZI>#2;$V2qp^JQWIMcY%byE!<$J6Ds{hhh}QUE~=l-DSZ_rbg1eVp2W6<@Va~OYYGS1eA~Y z`o`b|mc|AGx?{r^vlPeEB($iX0+pe*P}f@uD-;5oX2SgJy6E?X(qqZ(0Y~UU?@n(9 z*u>{S^MVBKhL{qbhjA4(+I|@$xnD4sXxeL`M}m= za*WJegvY3Xx$7rtA4Z@&!*n-6qSM2~u-k#Li$hK5*W`w0m5GkPJWN@<%TS+prIvS1 zdaE4c0%9yrMIh*ykUMxC;6cdm&f6-FifPUz-@bz{wvleIOZ%aBvnuTac=O6 zw*YTe@d(7nkZohrOYy8w?p`h*LoWne4W{5kU??f`MlY_?ILrlWq~T|34s}YWi7ciX zH>hPXw9*~5!_*%Ol#1_bPAoFM7q4yrX4)uSd%h}C@Ql%xmv6f+#_?#j)tnJvfrl4= z$amLcRU=>zpR+uqc2$=L2?Rl;sshA8+Xd1)f3B)yT`RjeMuiej6c#|wBk;u_32TAZ zBu{q3;g}XW3f4McVe?hAKnP z1P8ZoiX#OzVk~d@h&Rj45R4_90GPzFvjeB5I!ARTYL61+xL{xb4vs3f+1geT7fzh} zCPn5{scbT-e79U1_(PecVZ!i}^~LfrHb}_*DF}_ebU4TIgIcaGr-n%pwc$n|Mk*jz z1g5orB2Uuon*7tOOAF8%;YZtfGZ$c`^QFF$22c&B#d zU@)Zm_$1&f0*$Y*XN*;R6u|K14Q{3D6TLX69uMRRkNc{hzHOt{Fe^zGtxn{={&Co5 z6bLnlfR|WUTm#lovqh5Yk`hCJ)fJxJ|C)vvg>VVgsl-tMQaCnG^>Py4)&98r|cm? zq%R1N*SSNMVQ9;?0y*Ygm~e_E9Ku4C4>Ov*`+et2mW2eCuEh^p;%73Z242sp$~bWk z@Xd%%yukM=wHv)S8#YN&TJ5C6@;M0gE!R05*|M|ofd$k}>$$!ub0A}4iWrs}T8O`_HsP_pB9BjxygBH=oXGNrrJ z3T(ZO(f$=OL2C~+gMyQAJY!#U44~`P1%?|c$sqtJ8K#-NAl(swPPnpduEcv!TI=iu zQS8m_P(+5$!BtUeo8__u?}!my5cP!=B+FM%K$T1?zt8QrH9D;E-t-S^cUtnTY#_fp({h_ zCxU9u;2~_YBqYT|KwW?bXs;kOgfJaq9nI#mIHjN}JiG^K9jbW8~Fm-B8LATKdQ zPrPGC((I2w(30v*oXMEl8Llx9to<{18a?~t^$=^)pnHzNau5W(xfe|aLP?uAxyOj^ z4Ld?+)2!OM?1b)1?3QZ1btn3pI=xA4S&Fr`kPs2>ZsFqjDQT;aDifzvu6&*D-6HME zH_B_yi4JSRq8tMo$ozEyN$y1ug%_DkWhyxxl@sO_t1G>!WsyQc08yi)F42S;3Q<@n3Wdw8n-xb+@6(4fYE@?6AJz9g=grwnD`^#;C@;RU;xFTMscYAYli z2s~_^{`z=iSJhk)XN;`Lq7XXnKJai)`iW@kX_((I3*K7?B~{t85Gk&eSGHrT4Bxcl zf9-(T*j+XdDWvb?s+_~3lFJ*dFV(ZZgaSyyiTz<3XGbwk|VK$iHIvXKY)qQx5T>0V| zDC}tmOaGG5qcCX0AbHHNb9GRXjqgaC1)Ulb10DHgU3(!0101~XHpzQUUmRHk=Dgxl zlc1!jK-Ua}Ijfv5(IQI5b-NBO{kzU5R~FRH`{@1s2_sixWBwYoug_6#F5`d7=oAruTdc*fNU@raULF8Wzg zL*=8H6#weLjkV3dRc=#h!62A2cv6 z0M-jHs0<%f3RG&1OUckGyDqEtSIJ~eYjF@f36_P3QHb-u5w+71JPD^i^Kg|x3+#i6 zOBIa-+tgh%8YR|IEcChDVYu~K^DgQ+jt!wuqq0XTk^~nIX`Z-XB z^GJ=~RK%UPwYUYEnjJ=BjGq?s*94r1xL!q)vwvRYD2WSU(S~s}g8td`3@$GYh>NNR z@ZqcXu)ZirW=56dVO7T2j)73?#xU>lmFZ)OQXFHn#$+PfU|r!S#YA$llpz8~m*f#w z#)X)F-aV_e+dMleUu!fL|L)h;bZpsSEOXBx2fI1vWE5!`<_q47W!H0&lE_>PDG}rOtiSSffQi2?7Z3rZ*D=8e!ay zXB(NJOYSS~AdznvWJQbt?eWTZ_`i>e4U}k3B(Y{xj*=E2|C}Z~9P3C0Y~F}Tl;Q7R zf^2Z-X?;))Kw5sdZRdsrpkyst2zmS;0#u4CzxdVR>@;#}{EMJ!L+shhiRj%?a(eYNIz3 z!~++(WTRIO@2b`b{oeRFL4e_@>oz6Lnl}4+rY}0d$-mYrF)w}XC!8JXkt1pImq1`p zjou-04Xt}-cUIcf)}GWg?QeQUV?+A}C9&%!8!JO4l47Ug64HYDl>2#ETgV;YZrQ*u zT!s_yuD$a@%TQir#4BL-C{@RP5em5aCGg3@+Hzg6Ok&~k%)I=bxzZe~NkN<9{! zA_v3UlocUA80*-8>~w0JI>f4OX*hyL#N7S9Qx07EDU-ZaRm1MsR`)#is20AgiwiJg z{L#Qfe8S>9aF7}ODLLW_9?Rp(LxWBE`mz@M9#)nw@~L{D(5d$}0*jzLt&hn5s0$qh z4$Ji_AT8H;9KW8){j}f&mvQg-o+tEh=?b~of>E}D*rA!x76==v+SUC?@|fmGh}K1v zwol_}59M^_l$XKUTB*WSFFw)swwe5qIvB3B>QUAH{xOSy|D7WrvT9Ef_?o;d1<`~Iy;#T>v zx2LFWqo(4=vl|EDH<^rBwB`;j7m|7|1GhO|>(PwTqYSN35m1+|Q8}d&)Sx1LO2n}O z1of%12Rl3k8VQeA5UGtnnb5p^F4Ct08|93eJ0`IWAzfkxed)kK5YfT$dg1(2rt|1z z_BCc-A#%r=CKA8)r2k!grep1?xl zN2BXgC{?TF@Td^d9j;zg5z*n=HS%G&oTZu8R&l%QlarKghZ8Vy$ zvtTrqI;K=?d2LG{y9$J*1`kUB?5OyvBQdTD5x_gxtj@BCKbA03uT;Wezgyc!YTgbZ ziA0>cfonH{z8B52d|Xh?&`Gph4gSjBRl?;1hJlHiU;K~1@D?~=e2GzT?XA|w2m!*|k~HF>)k3LQg(;{Q&W&6x!^m^(lMFWvEJ0_?9%)-a$c2P_QlOus_L!ltWBM_Bdgc=24 zu=RdYcz5uEVe|f-D-SFY-&bJjO3{rGRTz>WzFJ>hVg&dLt0V*Z*#WTJSmuvt5;Ihn zwk&@dKOiFA8L&eA}l5{8>SfB zhpzj;OI6V~sK<@qXo5xOBRfUbwHN12=3;^fXWhh+OkVF&J9$n-6)1R2Q+Gfo4ddb4 z($ytQ#!wE$_`xFq8r4(&7Tm-(e5L8iL*h};zi~@F@7|$XO^_>84@%Sq@_hYDbUSx_ zp+$A|vVE&yEqhP+8ZLn_hSRKUj#dbpaf3Ddt2~c&;~~7&xTvO?C7?Ud|y-2kj8HUZIc}^ZDsOK>=XdB8-x0xD<|Zf+u*JirT7Vu;_qLDV*bhsFpt*w3_{{Yb&cj2g6Gm?(0QsBpvEKSxS`0*3n zq6)R%I!0;7S{qv8yIS@3XSQU`cuS=P#2l4K!~=nL`jVu!Wu`BBl)l-!?_7asFa~+W zeuNs*SRf%Y4W`l5tb^=+Ead1PDe&qW@7vVQBz^`Tvq&gPENg3qc9Rn#dR@r51?hfB z>TG0`AIEy5m!b{y6)G(=6Lrqzq74%b!D|k+JL$Fx&`31ENfve!SG!_;Ey1G`an96( z-|3eSDJs~j(UtHMB8<%MlU*)U4Y%Fhe&6S6eVNTK{MEu#w>t~8Ug71l@p~DH5o$|A z|LviHZXXiNYB};6w0DRL(WGavyjXTWmRaFmywUm+Kf&7dSbv7oAA=8s|8!f;grUU- z{3078ePH<&DC0_K2KAHe9$_2_U6g;PxsYmSY=avpwyAis-1owEX-!#Qp6rgI z%b^;BkXphG~6DgBUy?MtB{S`XjJ*B+O)}RB^XA(2#BRBy5BcKnnDH zQES4B6f|gvio3q&Ucn1{XJ_Wj6h)#JmcWeLzt?i#3Y%qPi=i5A(aofk()MCCubByc zo}f{8MeJn#kaS(PfcLqtXsg4`UW`&3O+u*}YF9to9!tOvGnJ7ruGB_Qvam*cS%t}( zSUk{lLxP-b$QI?Q*~=AF-t%)o{!PUOf$kZ7zE3n|6Mv|e*AeQh*Kh>Ve!s(mxN(#o zOA(FS!t`-jE*GuxfsZ6?_w}`MG8_fQjJohw*Td2i7NaVn<}z4=s&RW);zeu~a=lg` zX6X;{s>3dhNS@*bl;Zx<^4Ma+*B=;?xpP=2-5>+`tsdS}u}X#48&=7HK|d9YsId1VKJJ$oFLUQka#cn6oby#m z{wHwahTv`%@PqUIr-)5K(4(uQZ)c$2uUV(!#`s51@o#T5p%R{-ADgum zP1o1ggMV&S6TlhW%Rl8Oj#PF27z~O723p0z210)QtZb!k{z=)`%Et2bK-iYq|3r zz){YFNlhk);&>KTYU*=%qUyFQ9yh6#>}YC2>P+8^18**9bg1T}?EJL& zgGXzlU@{I?c-9k8t1QzQa$wQXX6kT$cxoZb_T!0g*zU40-t-A{+pgNz)VuK5s6ngh z{NNkTW9N^1+Vz+aODxEr2K-%eMy<{271)QH@5mcR_Lw$2NIsSnjhxbG(WBm_m8lFn z)oWC+d$${kL~u`&{M@JgN~tfSMfYtL-a~ykZ|&WsUHL_j9M-+HUnIIZsvdX~4Fi*I zP(XX@Bed7rS|!y-j^#4b@Z*y->A2+`&6cK(wJs&kTYC}1nhfg~*?rBI4Y`l0G>ykG zFIMeq6%(21rn>j?mLDrsXBy&ccs28RGCUgBs8$2SCKL2p6)+OSSQOc$j78%_h>tZL zYww}#C~@~XJ7xHDbT()juOtFh=jn?dSk=Y1QFI>9?M3fnscS`RvdIj}snc*vo^A{G z9t>+phyl!OKQ-?im|?9G)N@1}cw7DD29Eb=DSzHH$8~nOCqI8UBp9{67^C2z!YO-7*ADFLY9#2M;tVq%m~XrX+HGg_+S~FT047k ze;7|m*kVi{x<;bTydqEXGsRO*9Vi#?VUw;h@f$2t=jK=s*g%}0LHqEWWHVU%XWD~w zcxxf{RX{EkIhHqM`7LfgucKbXNU6|5nB90P^2|*#?J`9F!ea<4w|t`4f9uGWP3wJjv>3#QphG3;UlQ?G(39 zy!)}7+|P%?u@2ns)mnYE$BVI`Efhty?6aS|Ob@1WOd`S2QECI-)Bj-UL zdE{bYT(@HjSlsVxI`+SjzFw*J~{5=jb zi1@hy{gB@vW+U&8euHfy5#DdVvn}ruE=kE{acLaKy;g)a0y`jW<^GVWsq7I4HAf*DxTncwyM{>VUPQZs!Tyh&gGqxck=XVfX1?A8ygiVbg#Kc~8fwBo6+4&vdmIS?1|OCd+&cR^*{wU~a^ zbjD}(u#*jD?ouYvGu}$|Vs4Id@7kelK2dzr&thnSl|KUa#s&mDQR zcx@MslbT^+MnGiXX;^+_wosbOnZlJy<;X%=6h)zeKR#TNyIdXxcqcXGF1$Y`HCHv4 z_+{b!iVkd~1|Y{$fw)vDkcOu4+PdK=98gKWp!Z;q{i8oMt3yrAvznrmUZt@^IiE&T z8tKlJFW93Hr`6`Rs2hc*ebw@D&xn@G!1*X7(xB?4UIo1R7`=}`TF^4VZwXZy3AdE! z#t6OdOeLlyfjp*N!ar1Z90NJJ5unf{E?-IGc*;^Do!BI5n=adLOQu%g-3;(dce}QQ zP$GoP=bHeVAM7rPW>&wpZJ95mHU_t#DXK@`xS;<4rB3Kbtt>p3Cw6^WUo`UqOMA5I zR1*Jw*vk{NoO*AeG=V!svY9H;jCF-i=Dp2qeqhoKf2j0@Oz{_*VQ;p_*~Lx(O9_1mU3?LA z+YfMun3M%!2P{EMkF$!RA|$<;S%Jn|oei}YhV!b`w|SpjOWT&KGSQ1xlnc2X1!Ej8 z7cVqgQ(27Y@+uK>D4Ny+e}tndp*q|MeSS7Ch9>dWmzzSfEE5wZ4(EHc0FIJD1Js+F z7mIn~6s^t`akmP_=-q#EY1huc`HnZE3aLP;RUrJ(A6kscwU|BjQa1-3ds;<#;7td* z$NSzk+XGhFV1DV5_B@g6h~%tfGCb>11#M1VC*N2IMuvrVq;vKAr^_pNBS$Ue{Gw;i z^GBp_WSXj+vDOeJgqQA>=APMLkTBuE(w_WmO3OSxkYct=%(`QB+Qn%?emB^UaYVSQYvoaSx2KWQUMm$=<)6S0 zN_?_EOQM#%JpF7ra8C4|UUl8-tX%!HGNI|^rB&7VMUwx7qj)BXZ)8o)?Hj3sT0A6@8?k zUsb9!E~0gxBR}cM2B|&L_{w4OHGXV(9#ea)J`E38n?8t(W0hF2tGoW}wq9=7C^C*1Dhr&e*@d@H#~Jwn#rb6w8-uAErSFG$91I z5oxdyrwX}d#74nM3%^Wq#P+g}w^7Sz3MRZ%BX2*Mz{-~O`jb_L#8tId&#Yd#FsN}! za-NW4@)`L`9y;1`*E>^~(7iJ?M|aE_BsJgW>awCK1N zjR7|hd-v%T>?iG(ZP-4tjGOfS1w%bl3y90X2(n>JK1UFHS-Cex>#J6Ai-*Q-Au2XZ zp@^AwUC_YX#Fh?%OI^Y#@dJI~c$*>0+*2&`B(g;hUV0@37-|(2(`nHv@9p!rnvvs|#s3u%Yr z5?dkw>G$1UBC!qnF-XEdL#3hmFo+cpAT_iQS#A@LeZb%OSbf%FfrbJy3JyQtl^u12 zLy@1E@2Wp#DWL|6g%Wc9mDn=USRyMg#;1xESQvy<2@z^l8>!(EX+N(5JylS|k~IP< zaF2uyfU=Z?6H65adIX+b$||(Phu4$xb~qYLKOGGPsbMgfLGm@QQw!0_)@xwe)keq7 z5WwI(=)4^~!%C=OQK~fx;R{UUl4U@ZJx2iJ=AiHrHgpfiJ2Ik^2t@q^XbNV=GKr1ywo!35)wDY~-J?&VoyW zuVGtE^hDjjFrv*{ON>`ialjf1AAxnJ^y`bU^qJozo`~l!1jX#K@+J_=?_78&Cd<@~ceMDS@aYt)| zP=qNuvSqsJgOE!QV_N+km=w5Vk8y$y#htQdmV*097p&&5@EP{?=R=;R*o1f3KwW(} z@PmM%iK5YqdP9jpccDd&h4irUz;JsEbsxZV5YRF=Cz!B)~gpan@88WDm>_;He206jQ5Zsa^ zeC`s$euD4`Bpl8H{UciD??8;)zt5WeIlJ=vY?Zbb%-h-HK@ForI!lpI!qOzcZbmGj zfN97{Jv8+oh}IbsB1EL-UIrrI-D)9c4n`v%9^WN=$s#_1Gq{btZ$OL!7^uCJ$%PExY_Kngs+FCOvd;$MGXT!5gk3*__c zL#oL`#n(~|Gn|-veXuR+Ie3XddxzetkmI=h0GR1M-vV&IUx<(WLHz1B;vCURdcI@k zyo-*8UydyLc-E63UW5$XxH#ZxlT*O_Vl=`R4SYffezP_6`)uEj-)H6D&eE8@V<-l1 zz){j$`VObYk-ijcNrCcl4yIV<*vF?bnD zB+f!Th{GVnHjOA49U=M<5;ZkHlUX4a+pUNQJ%OFMLA6-kbS$PpJ_@Ae--yNXz9Pm{ zn6I&$_6f>zg&;*R#uP?DVkyN<3~#UidPArkdK(^U!aagR=J^ympI37KvO?g}??ILn?wQ zKHyFI)FJ0`Mk=w`W|{ly34jb4ir&~53<0@<#PTM{d-|+lFMmZ-BeGwSV77wV60rbN zK}->>059NaQa4}@F&JEsX0A*1}0u1WwS z_=f>y19X!z4Ji{~)R{=QFN`St3_MEzPVhi|{DW{#D5#YY*jrhirVvQ}2j1LoT*De6 zFN3m&5grtjU{^zQ3X8G{tbt!0i%~xI?{_hK3O$`D(P>|G%rf zl;O3ayS^v~bExahWHr-;o9%Rw1pY!zbeZ5O`Vyiy$O*MMN(`Ne5;fg8nFm z)hBB&Ao5yX?<{^X_Wtk1wnBGF6c5dGO{0Q4=VUOC*u9-24D)3hEMP?}Jo2B_vR}st zzSw{&M&rB!D3=IVhT6j_IWsG$z)i(n8s7sFL4{Po5&Gq%|D{N5X?Q{C*)7FAFI>5+ z3sLrMpih>3h@ylYLlW6QTz!WAIMV+H&D7|(o8@xMkTy^{!X<6(uC^Shmjy7_Ut`gb zF7dK|$-$7pJE#}<@1enI!3bmwmMuhBRBqT{0MR%&P3jK#1~I0Zv~c{ zu`K+%bG^|8R5SlpVN19|9Oe6uPFO-q3eF_3E{;Uq!*Fnkmu4%()kX8^(KLT-Hfbr7v`s^mMymMuN18}z;%Hq&B&lNvR2W|`Y%PAHr&OEqC#RYiu_aBCsNul`r=Ux!0N5kspZ|Et73Lo>%{-O?AFSTfu?@`a9Az@{Uye$YDTUr$ME z!u}9|?J>Dcd)28A)ZdBx|7QK62z4^b5s+(ArV-#)LMZHq%1A?t!1~@Nq5a?Nv_H|U ziXX;TJw)h%?ZP6Zi-H?03zBb1FbN}YoY>-H2=_J8TMwv{x|aW|A%-)%XF?pxRH0sX zL5{-ES(KQr##)G}oGh8Zb*EwAx`r_SHl^2poKC=E`eQ5q0XQ2ReA{}eBnW=O1e{^j z39;!UgBB`^YEO#W+obW&P7Z-V&Ia~L8Ivhv>0YP=1x8buIiRnQ%0~N3!_wckF36bE ziMKYOlRjaN&s(P*EYEu5pkfmnIBV6b2s#eSOUcF(%#u8YB7>Kr7X8{ckA77Ds;)EH zFTV`&|J|Hz!Ewl_##gn$L`}g=xCHe?Nf_o`VYZ;O1h>_{_Mit}8Iboj%Irpa!us_- z2}qNQ+Tw^b(Mtr5nkKuzB<{aQoWFCVnxcV2P2|wf3Pn;7cfK2GRtETzps4L&;3v5) zmerxx7Q+6g3$V)m4d6SOyrbaf4cny%@G|o-L@*y%j!KE|ka~U0l8zgJTtnP%esk@9 z^EX`EYb;VCFP({8Hx;h3lOzUIL+tYsH=OqsfLG6m{cF#5(SfJ`?#T+p;v~<;0HD7i z1%%_%Bj9B`)Gfc2b=3^gKj~YBH;VX2QE3ITFYmd3hii;|iJ0;gRp>a8Wix{!i!D|R zarm)aFE3X=_)+CVo#uXss8&+l^t_fPeYwyXyq5KtEB@*?maZ>(& z6Ov;nYAc$e5XfphQMxP$D+3V$_G-4d4_k}QoR*5p>%b8CI$`~P0|T$miNl+xpbYt8 zE|wV7sf{Qjpq$&^+sQP~6ABGmlt51zTJp zDjROj_>U9Qex0vz*H2_My1EoA>2-l?_#uIME0k0nOXN{2x*xQu94v&*X}@OjzwcuB z7mx!gV_MV%Mn|8KVGD(Kbo9hiWy<8QzU~WczT$Qji~QeZgS;GWj>j2ehT~%h?#KS> z=}vk@vFHMsnWx9Gn|MgbuU*hf_zkq_*D3F9l?fao_#fV0r_^$E*J>-ZBpis7RH(CO zil}mnK6taDV~pwXe{*C`T6hxq(k1^n9$sZy@!Twj*g{2asBwnx+Jly|IIrf^wEQdZ zZ*O|tq25L<0s*IAdWSX=l=1{kpn+0e&5OY_(4cFj=uv<#Ic(T=7er!B!+1^GH$o2x zaW^3s*(U-;7-Y!!gBS?Y|GN39K=N`&w#AbghB59e6q9^+<}FAhM;}`%C`nGJu#|}- z^VARM{$$8lod9!}wI>Qxa0W*^WTvpDpU|7^5*G7GH7p zPq_!YI{H#PN}4VFM@hWTDkn$dUPjI#7U{nS+`qN9^duLS5O`9(Hj6Ph7=WDrdNFXb zOqq?Ze(UdP=^uMHr~~qq z!2aF_GXJi3?u=!M<7MFMLQBJRr%hceM+YENWgLroAq^-j;Vq-e;H3^MkH79B;@q{t zD8F|6|J;MrMQ&IqFB~P(obWgOPm7RCIzY9=lcYS77*MA7XR`eQWz3VKUJcyuUzZr$JxTz`aT+SNGRE{YzF$Nz|wEi|J+CNy|!jkmbxfLGn^bDPh8>s;fVN^6L_`t@KYzke}w1KaGy=JnMyn zrr2&b7s&K=*QM4hbmUZ6sy(d;YH-rn(O=Sj?V!J=^4AW!5E#)We+w!x9!{i0KSQ*q z+^83BA-u!l$g_Hx%I^NE)zJ|WtS(T_y@PGv2-M$>M*Tkg?Je!k2q23qKbqeFL5GgI z0C$0#T5=9@+*c2}IK>L8Me}dlC+x};gZ4TCApTV}=mK^US!oS8voTzAkv&;fV*j$Z zYLtj;>;@~tuOamuqG8?eFe|c-GCeKLl2BUkc~GZvFf4++DfPd+7sT=|&O8wTF;hXn z4lxN!!Gov?fe4c-7|nLgYx?kr7$N>rdH6~8+gk(L>)81J-WvAnVr(TX#}NVI_Eh%h ze!+qAB{(gGs{veYC#)<6IhTH%>l5OKu#Ua4jCrQ<2uWD1lak^|^DoFN{; zpm8SrmZph)zP4JJX&|LW2wsL*e=gZpl!JYy3Nq@z;6PN!MeX*5OBa7X6B;KBGl3d% zmz{S6{%s=W3z1;&XH?<1%x}l~ebn{>XYmM8w)71w^NuX>J#1_&A8Nxnt-enA7q8sm_5*`Am6bLezrbIW?_M)?E?01R%!e2a!xW_xap4h4 z9d#_Q!gI?vVuxh1A$Wfm9RDl&%kStHf1=B4FM=j%pK@*~1Q?;rN2@`nGSoTnQhWl+ zSb_TnOyYxuV6?@f0)<2wjFwJ`1S<034RS$&Uy!p|YA*_FgZ9H(&NFFgUVB0cB}E|% zU#v&6G>+FY3g992zUDm$1Gcjp<97u{;!9QR*4@mEMkO(2v)>mBygVPnkTXCaLSMdA zt2|jvn&_vH*Bq74y)|YXbOkgm0Qc+Ocp<;<4Vm)`HJ_|ss15S%eh-Yw7h^0VRS^k2 z5?-P1V<4UvDFibR8g~SnVMBn+{mq!5;BUs1k;nmr9LMVlg0g;rwM0%b7F->sy+^=Y zrmlKFAWg7J*aG1#x74=mEibvl*%0b7kntqCIE~H0RoYbLlt*fi|>NK{3nN*zHvX-1bC+hDsjtpfIoH|jsU!TjRwH)`rgtq9Nt z%*ryGTbSK7{a`iqq2N&|65)o)4X$iKMR%cZN#`a$iTo8ZnvhUA8D2YOP&dT2-RcUr zgq9d^tcM0zbLE0{Ed?H{uL2yTze-f$KM4Pyq)DjFT&vHUS|oFj)^^#9!yt*>2ItKz z-2{u$Xazrch7=L~${7RwSLAmh;EexCmJDW`Ix#F#3X8$~_frA#27SNcK9CgOZ8yPH z6&s%-qM*MJ?OQwj#+4cetN}fgG(DISKiL=?35_9jl?R|OX6ncVsW@2HD&Q6FE=|?n zN;}-%j))hAm@rllYjH*={SU%8$b3IOAc*XQB6x}7j^%XurW7Fl{NcC6d{RYDO|`-? zb^Z@xu{Rj6k%8|?ve2vAk?vzAelhefw(if~=0v_OOF|=?9`Ma?Mf&A0MMS^-g*xQT zUs`kh(%<~W5@~XpWnGmOr`w=sA(qGiZay4;l8mLsBX@iWi-Kv8i5p z6&!Tfjzo#P1-B?0bA{rXnBlzcE<+R-5`#j(h6waqb&ekgXWkZ%ZxNAXiH^-#6pS4T zOSue9|lYZH8-Ro`N?3kE3B=-NoWlNrAst_{JT9!v(BrVt%e6L3`|HDDZbCAtY z*V^|A$r*&?O{8YYAUVH0F~{$hCvsB{eR%UkFeV`NQy##qYa%XU-DFf3GAMyv@WY%R z&*EzzK|=5Q%cc2j*nSZOYbt07*+N*0yG61Ibb6Jp22a)M5Q3FG?y(m%ALmE5!T~pd zg+R8IUi0I^=Cy%>eygGS+J*hUY#~cUT1H$+c;rlyZCv151|Dx;?BsLm{{fglXTR;S z1H3J89v~`+;Xnq?V?_mVa!A2>0#QMfRK4Kb9Tnsx9L@#;&Yak=eHyb%>pjznz^}+W z&3PT2hci8;6#S>E=KN&SOOdadJq(c>+;ElvD*c8?|s|ofj;ZA2Xot z&AK_oiyWVf=I@k}+m~cR-ohBi%k}M>%A4CY{Sf#(6#A@eyUX^H6tm%7||77M9KGyUAOSxf1=2?wqW&bJlM;YjcEgD5Al;o>7v^D33qD2vjV|bV7XI+MhNejsiU1NU{xAb>66JomRW?fnxB+8B5tJJ`2VLE)@5L+;ua~#V?RLJIt>#n- zx5)2y@K=*m zr{Irtmv*i&2DyZ@1YVxQ7IH%)WplG$Zm(~ugCkmj7J+28$hzU%C5&R$V%8~Ks)$BR z3ZPCqp1040X4}I=IeYoy-4otu_4%tsv|2(hahg|8cwat!`a*p0z4*lIML6HWC%$<4 z^yh`DJblVL>J6E*?s;_w!;oCP`1a}3FO>8*;AfMzPx)gptj&F2Xf~UVUO)%WXJipl zF7mH*oqi)DfEIQ%N=Br>gbC;=_Hp6cf%x`p5w8iDyI_K`Zf9e;TrfThd_3Q7ZeT=z z<@}X|EIr|!O5hg;Mj=cpbD^#87xevlc707@JfF`AKq+l1{}nWZ{aoag;V_|VwmcS^ z%24?g%uE2cq}nNQ`nzZ;$8ffympVFO6Lr>t_-K;;*r4+yie_SFenH0-ht;g%CrU%_z(ljU`7iOs{pC9QPwmvt-)Ga{j2ob=GoR1r%5ADo z0#Ws!<*&}^HCUSY{9Dz{mN!}VGoJ68U#@?*Y^cb~_X6+=8Z!|ge_s5L@(ETw3aSJu z$5iPre^GwUx%~O$NZo*&&hWj`I)6%aQF}|r>5ak?%qK*=+_iJ8l)UvV97oRb8X}AQ z`n5?)*oG#Kr0Ur+l&wy9QES#aDLL!jKPGhB7tlHh3+u3?dhXt9kf`qG-6p=&enLRW z>2C2V?LxBs@vGYvxJ%b-a^JicVK(l2*wgh|0kaLP?EF3lYmQmA?`TND9*?@_`r^y~ z1G|OWTM+hFs=S}wQspnOBK>m4{>is}%&dM=eMKx4vt+SkevHjMCx0>+vP%8XcSdjT zl-5>1vmTP358Jz@zPZn=Ph{7__AaSy?KA5UxuvANKWf_g%z6X2>~zf`c^eNdy~Ns< z`h{4K@1EK7u*Q*I%Twm7e4V7Ot*k?uJMfOox3u|NoCX3pUSwL= zVXgkA&uXxoe-<&m-vUIyGnF9(HPo=VXL&M8p(EkFYD@p2kn81{88u-52K;bvkUKJ) zlVCQ7?rn0+GW%#lHd_W7y5|EoO+)cet=X1)e3^(l&3ML@2@t+~j$i&6Kss z=MSDe6jCmd8yLyx8+v~bXo^q)ubyaB`3S9YUtbG!l%Foay~hZmWw>P?O0mm^R_2tf z7vQaD{>Nas-4vQ&E$=*l@Mdy;n@h|hh&+}k{#Q-?{TEqi-~s}Ui;W6yPY8n~e_93` z2wkeXDAO!bK?zj&#*<#i?(ED505##x&jS!x|Db+aW~(-jLA0#X?aC^ANfBy=CccKe+QBsJi zB(<;=6uWVN-WL6_+Cor5L^11QvE_(u+Ud9CKJ{a>kjyTIl(od7!MyjE$p+rZG~%Z! zYb)@!@$rS(wh*l0IUZ&Br<9Q50Tb~&xhSXrUp>;_&j;IDRr>tt)64g--YUAHf;21) zDO5a9I8m0Il=D&_FlSN4Bw2ZLt@FuVqD&hp5XZCm z{6~m?w|_7t&c)@6YCCz;qLeoVI|e#0t+z^Nv&~a%X><8vxw>cC^DX~GkA?QbkwE-7VH?^mu?c?V>g$yeEY07eDRT!U@4abBEoK+|Ko zW_B}7NZTME&8JVF!7o|vq4GD#L0Pd#I!roGpMINWL_K}VI@vsj6cJ!I9hI6HzpMe` zEh`&K_7%1#R{lTb1@Bk!>FnQaGfJM+BqqO{+c!MD57L?dK~HiBNx6ykf83+1{7_Y% ze+`+(2Kq#pnqU&@8nax7P6ABdK4pN+vB(mGnM?2tb|Kn?k6H7x>OL=!l@@m?K=us{}`BcH+P+ zt(8jr91{>+ZUXNFEQ z;}G+r!K~;oC)&&idGn#PfYh4{s5KdH9+bY=U=B!rQeydUU-pl^-2c`&agKG2N#gj@ zF^(|q$74i)jAKL{2W0krYVrqSDlA9vuS??IEk2TY_@srw*F zuLC5#4vzGLQ1by1se>U>2SUo8vx@!Id|souzyNl7n&!ET?twex{Ke;R?n1H$(9^(_ z&s9jujGewGd~QNgV%$tQ*>e%nTHQ9gPVU@8+Z2vG-_RVh?mo}Zc8=lk{DSoPg%9|_ zJ@jB^#{q}tgAMHm8Y*RqS`RRw4ldLt0St6d;h_#F^g5V;%-xpB+3r4o(0TBn>%hT& zu=d%pMzrHV!Q(-K0}c=z1AH9^1-iog)!fUrg8+39J0S7@kC5<>)6<@b{lAlh{wg9{ z7QXI;{e83RF+sm?f_}G+|3^*4M)(3ZP6*%XErhAC^?3bk)#iSkHfaNg+_fPy4Z= z>5cEcc=2{uTKuu{cE8HovUz^>gY-c@*Y|G5{$&0FF!gu8f5q^{koBZrp7Cc_{kw?b z-+BG-dhFmzf*Y#lKTJvR9dk!54lar%Ls$#C>>=udr-7E1^FH0Vdr~^vkio;NLw_e< zv9FvHm=AIT@nf0s$1>xOWyb#y`GK{wOtZ@YTbT9za#KjYn=gUubsC~;t9+Ly<77qc zJFE15mZh}i-<@zVZ86mO^$UOIrTx>4M3QAB$|K<58r{<fK`&;LenvFD<>aeD~&rDsdlL|0!F(1mIc( z`)5~jCS*4)*Bd3cS4s&@5adY0V^vbhm!~1cXkVK~k~Cjr3QNqp&Xwh#Qpu%b$hBK6 z#B7firYU!F3?a&Mza$15^Ik_$sBAXR@s`cZXnE?BJjc-)F=cly#{X=|-|WM<#C-l) zT!@g(iRB&;35>dN139b6)Yd=1)d-(yUp>f$0H0~!JkSLapK0$L{o;hrv|k3lLSeLi zkXX*@4jc4Y*|H$d*CZ*$0F#pktLa}%aBr!=UPzIzBlx40^v{!Gf80xoeXQW$)SuOa z`j)OQW>7cYBO(6tSndC@+W(QN{TI%M^ugaawf+mS?!$}EC-(^~ok=n0Togy=_X-#9 zc#a^8IG<>F!DDgVbIpC!m5S#b*CH3Lq<+?LC-vm3(dUT>EhbWBB);N_&OGP2nAMz? zriTOxmj1Y_FkQ}Vc!(n9`MJqOynF+ofrO(rq#?7ccg?3O?bD~HC4KK*D?HV0)||m0T^)|%4v7`rVM?M07JQ=d`IqP z*X%4HJ17XvC3Lgl-3fgRNCf58KtHW2%T~pPi6D;REy>WdvgIQNOD`zb{+XY>-h?3aX)rFUz{N7etbGOp& zIx*dKb0qV1HvOSssMa1DM=ZO{?99)W7uVlP9&K?2mS0w_+;nB%6Erul&w>RTOj&S_ zSA3-K{ujIgkea8oyo4T2s|7&AXLtI!se)r#7nOq8$>rAc!}^!%Al2A@%G=)K%w}Ms z6)gqj41mM3W#;!vwmz~EQ+aZsD)NchBKd`H={_{%q{sC||9qN(ssxl>Kqu_^UElC*rY`K0=nO)b+Xfh15A_Vu0M{E!awzBp&SRsTczLHJT(^?C;{B$Zt~taofbPk(`TSX~=-X`pbm?ktL;v2fr{f9E3K9rEF; zH^0i2dHmX!@#TW1>&X|oVfszk1HX$EID^J8t8k^~j<^a#9@gVR{4mfMXhH7P++m9{ zfaGyq#;?mTf2MID{2Kgf!D1Pch)Sj(h34KbudnCyOMd6=zzZ$=f+(=G`(h_3qghgY z^=1AO8qyms)q_QDB=XK?SsmSSDc(0^6W&}dIrj}2J%`^vd+bZ!dKZO2SB21zRu!V< zg5A&gBHBWIi$exzm|JQQWI~gih~-=$>L*DPv5yvmic~_W(4gcr-`m{wE*iF#^5Cl z!D-bV#!O2wsg0*rniKKC3%0#o9Grog#b>{UxCK9#-j;xxfdB*q2AdN(pB=&x%!9KS z63WNtgdfsmCn3jY1>$Wti`hT7Y|)=czs!(e0rjC9MtmG*;@LXcyxT6mUkk5jTkV90 zBo{r7JKQcNO?AYfN*bvT( z@%c#0<&4kC6xNz3%h_U6>kpf73bSi^X~y`SBd)=TzMKG7=mNYpbTYQd6c?NN!XU?A zaUe)Op(Ur(14t7R{1!)IXBtKlPZP?@qmSMv5E_bDY+)*6ltX4J)^%E^VszLPL*t_} z1D<@A!!_UN<#sNQ2M*IMjbwzqP}^zP`Ttl3 zQ*fGdw?XPsnSwnHX&O^u1)}fQkZ6{?rC=qEZn5oB-o^(_#>+bz!(I&Rq48M~DTC=^ zGlf3Nszps>Ey}o=LeFdyoRvRc9uvUZ`DTiHjfSeYe=N&sLcZ*&t&fxP^Uz;bv-PC9 z=h40_ST7=%XbM`CGcy&O47VMUnf}q)%Iv6WN806ld7T$^>yxpZ=dA9IRaCP^Ye?Gj zi}OiyerJ42^g|PhYx@Q=S-+YuKQ+qSv`&hQ*4A~hJsqTBpc{IlI*835ZSSnc_Ltku zYP-4QQn5a7<-Mtq&6+F{W*2_*Pku5iz1{qO6n^L?suV^4i?UdLI(wo#Q~tiQ7U0*P zP7Bt<=?8dTWPtfUI1$sR;?ql}gZv5CM*c{+q{WZ?pW@g2)*$wK`UijVnsN2h=`7-Z zy{se%@MqPmfs_Rv8cxe>r*dqTLfOyK!0~zED&{Auxx^iZ}xA_t~kyPQ#pT8Nu?%)r?bR zaPk2ui~;ZTn!c{>)N-da_03N3qNtf@wVF{s{ST%5eQpYz5; zsL|ms3r=p=duSPMjOU91G+-~9J?yI41WR)~G`=cSbh{FG;f81VVBum}ml>YBJuoh^%kK3(Qp z=otm0e^CjA3rQ+JrXuBW;c~C!UnxY6&kG&(r2O)mWkj3ax`k&?+UAfV^lEUH0%{*c zb$F@bqA)2H1>6mCc~}dBSQ@6%7}RudV^8k&(g;(a)D5kZoCD=*r zMR(MbXJUSQ2Efj?%Vh%0n%rhuz9=-ddz}7&nyg-xJVe4sE&Wtu0qjrEZ+E_objr>D zE&QS`xV)u99-CWzUzxcDS z_D&jdqWuGioSHGqbdb|z#{qZW$WG+#zLWiu+9~{)Tq-{Qca5^YiEMTxsJJ@sjtQOL zMmFox%NwG%P$lpuP60=BpuuDuN=^y+Ft3sD| zR(9s9b(Yx!N&yi?2$YAsIKZ_7S{S$LK?9v$pWbx~ z_#~$-#3hCkvl3E{^C_v2+tjeScCYIH$ueO0Pdpa}X>q&~2_mV#Yq!3?EoW{+{4i{_mev`qu1JfnVT-hMR2&oc86B}&%VIm9_bAP>hOaGnA*;npa?fuv^|ZQ( zRubOOThbWkle_)4S|U-@MFckyc&Tn!8MQmAq;q$6SyVXRGTT`Z(THaX0DrSwQ*lYc za&tr1yL+h;Q8`zHCIIHbZ6#{kraA*HGQ0}sN&}OfIV;U!%d9&}b3jW-axb3TOgc+m z(wKm1r2&lAyEqQG#u$@nQw={i6V?uR?ez_5G2*{8oZt2#Fq|WE zcxl=*1bWNyV!LKjK35$s5G!AriZi$nZRvi!CHR4FMe-q-@p|Vms{uDO`$y7|RKFFz zM>_Hda9iUDGCWU`Wymf%i4?G&k2wfMD`}XCwyN1c4cc(KVi%|{a$J2P39F{h=l7vy zN=?0o6o;+B>@w=%g{fGp2%%V(I$EB~vHR`%?$P-1hH?|Lr1foknS)HP@}BHy=2x~)KjyT&x0^hI zG`pSZW~q?fij&DV{8WZL#nD?N@r4@W1srJEg`cpY99}ZiaghFErOgYQrZ80brP9YT zaCQ!gV~SN6r-u{{94-i{_(2uC`MhE_1+WZ8G*hj`_BJ@q{Lp&DW#UWdXTNw(Z`mBD zjx#nn;?YSsl#@^<9i`rWA*FjPnRl;peJ79hRxU5UT`p$eIApFw{)V_&ixo3pFXxY* zz(0~FFwdAdhWClz-*&Uid;@&_F9VicrVLx~&)ySKmg<=PkU}2QG5l?XEGcleJh0R%fuy}E2VaI6`+`iu2Fk1kk?Hf9u&#t*EAzm+U(*UW6 z<}1m4vZ1%hqxoGkJk|WmV@wLWF+8rtoh6PQL58m&(}UfEoKDHgifnF%x7NDvsW~`v zAlD;q*bFX0AxZZLLcDqX{@p9(`TO^Oe({Zxr+gpNI?L0HAHo6$m3N?TR;AeG@ltr z_Q}Cr2VHjt^%muC6r%rRbu$Z1ag4yo*U$9_5gn3+d=x91|m0da|7T`I0kV*iLx8-jwBT;;&(jk6>>Zu zP^NMz!XrqRuCAg6mh$=~&zd^AbZJ4wqxjC!!=HtNo(c(;+sy;0*U>YJSVkLusWlvYtjdJ8ELN8B8h ziiAE$0v;EO`LuJrIZEQ)QO@+{nRi@>Bb`S&c7}9nQwtf2PY1W4yYA-gZ*WG@Ow{RN zXT{k^5@t@bD&5C8VvV@jx1YLy#}DN3S(s@_IwlZPgdAe_(Ie=F#P(B4l-H##b-D$u zINpx4%LA65n z@RGfwV!n>}(f<5vu!W1LFs5-Lj^i_syyD`~cQ9NrI_bMb>UW`euE?L2U0X`ln8Gdq zf$Zb-s*YU}iSRRoyEnv%?#DRtA1aP~v~9)n9B5gY!(ygr36!5zh_A9SZ_=*8Wh!2{ zbIgRZvOoc49!Ppe=G&uK?)=`Mqwb~n{)ta@>ujA)t5zR*87}@=c)!?JCo52Sa!tPx zrBWfZKi^i(uZ*Tp0k(L_;8l{olRmH1V$I&>6Iau#ynu1#Jyv)CVElHyjKIsBUTz3K z!nAa@As^{kT|?}G!)J=EJ$ZJjo<2K`!c+baWy@9PQdBTb8)zxtAF$cyD-0p|R2 zEm|qQ5EUQ45UjqA@?TyucM}JIkv6Cl-Y&oV;%(k@@Sobw+rQee#BpuMU2;pHFlgqv zcCM8u@9Iaik-ZN&VpD8oP|DRTSF3EKYU}p0F1gqh2+lM=uMXV5tBYMxXDDjEs_E)# zP48y(Q-M^vYVm5lyn~5&om`aI+c8sE(Rx=h&MFwEwdZHQ^2%1b$4xbi83Y7BKg@u& zcy?Vi2-!Wm*|MKAU!L7gHnRu)+2PHllCuMLFf7aqIzRt;@$=$6?78xB zP?GIxwPZmwcHR@ZLL8K4DZ9<4S6YLd2YJ}?ksn6P>birsmme%=NUYR|t`u|G9gxYc zoIO_wO#N$fHdKg)s<#>16enGySx@=K5H@S zl(fQh#H0Y~wBvdEOz3yudry?JmoMHu;f+?Gzgk2qcD)&=dG&<%<4w`LNK$g?+eYgZj;zII<`OQuBOn(`^S9C@l-yR z5IzJx3w+d<1!4?5$Cdjjv{f56W=*}XhJp*c?t+cQrfSYdmpUas^vqk@9jHy$uTn?n z#nD*{r9#n3%WSe=hJ4@Sz!Z8GW>e1lc8 zF*Nyn_2;60fMhC#A2FP6qPjxnPT77^-|eP*p?r8b3oC_i(_$pTTwdBwlA1y^GSZYM zGzqw(?jr0bQg#E_ZbHM$^P>7LN|^4u-TEq*s5vO3MY}hUy3%y7Q+Zcfp41bFXV0m` ztiE^FS4>x~lJSMI1`ACm6-YM48lhKFFYeGWddB>ALTm{LW# z(r#&5XVD|`y_+P(Y}d(b?F4ybCd+dl5+n8V-mw9l&1yLwvYD!r-y z&!!1XlChTgjqSErq!=}~$sVGd!~TKorQW3zI@XRWOY|QKxn7>>#?2E(k!){o!4vbV zpi=$<7UVByr5B#;8k!}{)5-6zWdR(oycF}9++KJ2EejQzxt{0~62bZ&D`cJ)qyg&`J)xdNkn3W)NPJd03QdA<5 z_%^wN+!qqe=IjjRUUtCAEP0#y#KoOyl|F~?7Z1`x+ClL_c~DQl7kxWRy*2xv$nKnY zn|jXoC9e(FF(-FMk9N=3#p#OdrRVS7(_c0se}+WdZT2G@6{SF^F!P309-YCYS$oVO z=dXBT5Ze4PW2W|{Bm~cWH(B=Ow{1O}(tcvR*AHLb8i`s7m@~hl4HlK<231Vv3B?2@ zpB-zEFOnM=o#-2SFFW3>BTAzTZgkO@@)26gQ>OB7m0_U#bV=E1EbuBX!!3)o3tJsp znNzZ6c~?L#PSow1U@d<*yV-13$rl$F@Mdy;n@b8#t_#9E?&5#d)O~-EdHOFP2)Nj& zpI{1yu*IL20i?1m)Lr;!7O8+=6~6IA3Z;#mcLabI;D^CY`G@K?%_kxPQF{et9l%Pf zi-XQ~lIa%N&>j3sJb?_I1Ez$0RL)iE;`(MOeY63&)ZJsO; z#lX}NpD4tJo;3uA&QH4fv}G=zEkrZ|K6SaFE7Xo94;a=g+0{aO&{fM%T!#u@;$0l_ zfF+B9u%~swyBdTS`E9tCv>ue%+WLACFI%rHIoZW+n-I>LOJ|s;Pg!0Ggr{J%XX)7P z#yo;F^hE^uNDBp8g^)@DaUfP28h-eO;kpoagFl#>Lt+oBNY3L&96|}r-({oD{&Uv-a&klVU)Ek3SPq7);Wl@p2hb{(TL?zh#)!F=Gs{J2mpg#%%{WW zZ(oF z2Vf+-b$~4R`|0Iwf)oIm?ammnFo+bQdOWvz)QGp(`~pRZ;=tQ$)booyy3Gu{oGW+;if-H z={nL>>R+mZN@M#eZ+nlkHIa!{TnUvk01AsH&+nCN-C!f8@+1{iYX zci}LLFmL*C1+E{n-plW9$d9x3@=^OEEWCUlnI~Z!zW8R%R2SgAibkL5*37CdsF}d& z8Vdf~h9#8|Vm4;c?QAgv!Nnq?{)fVRxF(+cd%@*qi4&-yEM<^b##`ce84|XvAjTk zHT3_JXUb{I05qM$JY)cB57yQk#+7Nb+-7#dvjmz059t=)76VY7DAJ#0jujX61bKwJ zAYOj1yr7pwHpO|7JvPfx`%4&iUh=m54SEZyO?!OtUyDbUD_>0G?gxG{&)@)GP}<^O z`MSFAR)@t%Ebwp1dIR=w<>`F3_*gXIZs>d!0*t^zkT=M)MlQ0r)75Iey@r+NDre#< zNrP?|*IQ8MizeAc{FyGoJ)LGKm&i;z2%Cp#6;o}azQqi5*-TW=R7Tr z&w=7ua$#t?FI3|KATnRxGrH^}=l@8Si$7JS*p%bR-PkrWz`xk$4*42+FxGE)BRS!Xk> z+{5eJ+bvH-5;I!0HBpVZKvQk>x8@EK1vk49SV~R6j8<1R!!htw7lN1Jwbhez42Fx* zCJdvk(W#>`DBGRg(U_yLy7Q@`8EtXH9+S;po!aGX9D?DNq~?6JuUWVerd3aCtc9V> zT$MTyI=Y)Gm8{|(k#-uwWUnPBpqh>UYvAyozVAs7efTy6*n{|*^ z>j3W-#>>?fP;BseNx7ory2+o1$v2|)GefPP$vE0PU7p?Qj`a3)57o^{8?c8&pY&N4m{K<4KkEXB z%0lWz11RD1>>(fRq9|3nvUx%gEo45MQl4My8@uZw*n8qrSk-5tTj;w+(E%{UEnzK? z3-&!nF}!ner(dLX$MPh|3sHolS$?L@ZzxF3hxBi+-Z#*(q>^uEx3kTEy}blVyPk?y z_V|$>oqWA`Gh1{}vSZy}@rx1J$M4}k>YF!e6utlY>o0C^zetk*+r$kk8Y!+~_(Cz8 zrnOtT+-_bkK&_YH)?}1gLnlxYwFi0AMO)>US^%$w6A~B90oE9|W$8kzjnpf@s4$q2 zQ<6^^Sq^D^)VHO7-(up|*)@mHV<1egnEh%thd%WS zA<>AoHwPeZZwzuPDA-H$?Je(z2ze2%c<*@ouYrf-OALzx^LGDwzJ1lHYJ=TzZw2IcSL81lIr6m7{LG8|=7 zWb$#gYD|~7rkAr{8JVtWT02pW&8*=$n_aLHHaj|7EA3XQ14$J9>GJw<3fM(MV|f8d zeo9b9f1uSbSYF?9R!*Os*T2&=-*>tUu^+0u`r&i1_AHg`He?o=h(*1ei6b)d*}18cWMH7zdw7Y98ul*u#9u_LYySK z*p%TrJtx-h!VNVU%K?&M8!kQlY@8#l8<16T540T6UwO10j%_-)=1H&3rMt?Gm70QIksni2CZ3uS@?tn5Go^n@O4^FZNEs*+3nCH+H3lw!S-mdJ*dIf zM97n1fk>N<8|yK%c#@gLt=H=v?3HV6`;TY5H5C{tuns8UHDtc29we-xX((TkA60B9 z1eU)2o#ZLU?EL84^)lLq*)h^|f!>gh^sMQeB|-6chl?Tl24DdqSDy{Q7fwMigWeF4Ov{%-89DUHGP|QetJV#Is{6J zJ%ypt{OqbWWr#{2mx0t>t|{x2#(G3~L5ikQ6txA5Y6qaMjzw0!prIg7d2AVz$};Aa zX*0Q%vu~Hzvru`yT0LR)yaTGFp2e=)|C*~A@ky?`qDNc#j>f_rQUd2b3+44o0WuxAe_CuTTX@p4A+tD2)deGuU1 zPDI%klxy~hO!e5+03{spYYW+ZFsrE7<2=9mKm9IhJkI^r2#^z8R)3a#W&RS9RlI#BTqPQaRpi=8P3^Av|26VS){gDP2 z*>12}t9ZXMj5=G)!Jc8hhtmtO4T)ejOfE_`R!ywn)vkUr06U;-CK-P zVis^)d}wbs-%Mj`i0V zbvN17!SuHts+Vkp_ba^?sPlVCM)jWij#EP6;T;xzpty@+@7S@?WAg{v|hV%wiJXcF)Jb#vdp4(^+=ZY z+BzoV-HwIKS=yz66ri=;V+w@yKp@4aX>ADRB~pUZliqE! z9?ad_`YrSxTkp~=sAd7O1AJe@`p`l)TdcO5);X4GaJJgC5bc-If7VLewN{ph*C@o$UzzS{(19@pJm*r_-{(;lob_4+2;m z?FeWa;uat?r&5~ac-?f^Kc!qj+7_d`*bQ36UGvv}0alk0{o&nfcDQc2U@q~Zz~x09 zTmZjalnfL^6Ey}6v{Fb&=xm{6#j$sH;&i`TUge8#zivEw*)lwhiz4KGB?YH3Mg#aO zEWhqh^cQZE{%f#|?$1t9YI<68ea@7Y78znmMtZbgG(81$P%jl2BkMJ}?^qQ&R|W*Z z@GDC*KG)j?KOohCQ0%hNkYSp(a=8sdN~0RjN8=r{{T2GF<@$<}u(3iyX=s6%(>8Y$ zJN_kF%XG9nW1K$u-#?x15PA9m{w(7S)|2MuJ6CQ_Rr(}avk~(Ydal}=ulND@v(v1% z+vg;SdFg?sgxw40rO`^ApmGyL?fqYUEZtVt+Bfz)t}O zu!JG|?P%Ka2+r>RJc9F~!O88fZ|Hr?g`uO)p1Vy#R}S|`^A|4DY9!|PT_q4I{QXX@ zB5wYMtX7CE4enam-fTg-*Y(IY5zp!vlK~m);z%r{t&Yh;!V@*vQML(AsnW*s158vo zPcj?lhvVz{Whe~o7jl1P`gEM*t;|@#u+rV>HKOFZH z6wMS(=k`RD_}YqNjt{`#Lpr`6-Mf=;?-q{zjq2!bJlywSA&>Thi=%FCWN`8ThTaMq z4QDGde~?rMELXA#Sig6F=wPm)ZV&0iokcvK9^6Ggi0qX<-lDXLp?pQf!`7u7+FCae zcto=o+A?SN=P_K{*$araCG*%ZCy@`_L>5meqol1QChxw-|4du!?uv$E$pf%ZZWPH$ z$&MX@i(P|A4rDi6C$GS@a)0&Le}SQU7B0!0CLulR6)vbbVaGxRy1`D#z!wf{Jxe^{ zZL;z>r%!&9Si5&8^`sW2td0;L&f|8Ggv%wb;**A_2JY9vH&P(ymQDFP@gE1_p$B1i znm8YWhumlGJS{^^i)m}fIdSJl8RFY%YaNF%aUCBx_CSj6S%^^g?=-KXb?-TWN$Ge8 zW%rJePv}JKyY$AGEB@64cgQ_^>EJ>quq)nzZ$DzK8e0AR(`6-VcT(Jf1fT$n$5ftp zJD=ZYm5b}DvUVSCXU)(kTZx2~FsF;_&COZgL%(gNJ-o;(M_&){(X>NO{+e3b#WU3aEB?II=9~hUL`MvXq(iRA>W*_F%i*1{Ep>ab zvQjCTj_%xjbErz8HBHymk!>v3S~2Td8R+03t4sQMRv2#R%(rM4u(U~ch(UMsGE+5* zhA7q<(G^7VlkXd>y(59L`k@bp*QiBb#gtbH-|vjQtC$Q{^B7n5xF!|;6aIeKOarqW z9lKPEouW8PU{6%K&nvs7=5?g=X7?}F!j@qLR{4cqoc*RR)E7HWLjW~bcV#c<*M&8< zk(K7lM6M;e>v=^{`no`FR~ zmJOU`H4(~e@n0o4O17)ja=jUtrMy@=?ETX({FPrz%L?{3ybOru#uu3Pn+5!{o(h(f zkHx~kH*~%V0g!Zko`2vXT87C*l4>JBcY8fsBv(08uy+tM*v0i0=8lVlZz?RY+Hz&V z$<;Ll(FnVIvZllH&JJMlsX5bA)Ee#Fbk23xJvS`dsk>e(Egt4T2yDPa!^p9<_Nz&_a_AawX_?;&Ldj)$wdp%JC z0((V;nfU2;FuRqh?K+a(We?|j0>FyELQS&-{ByOwgA@I{PNLnlT49=FWlh z3Wm#?xJ&QaAI0bJom*iZ?(@~KAe>w_?js8|7HS_B(n8+3-<`nMK?j$)^&g61nEEg`pF*YdWVev3<7`bI`xq z7J}L<0d{kD(Kra^Wbv{7{`Zqb`mMUX!fWO?CiCn%s!l7v_~&n*-7UVyy}tGU3p;!F zn-&ARdi@D*>8`)IxQ@9h;U15v>!H`X5}ShG*PXtQ4D)!WZ&n_8h&z1+()l0H`Ic+; zD<66h=Ke!m?_0*y0N49A+}_*X)yKd1_Q*H=#@hv-GNCDS&pfQq;yTQ)Qa-swwA(bX zjns9m-PtYr<0Z#KTylKC9mWHL=JUJc7MKg85Ubo=!aeN9JQ5acg{f0|FP;9tm|42$Y=30{+f@tjq__i*!|__ z=}zlfymgox{d3%_NA13VA5+PMjDbLp=YcaC;jN+?r7uZLi15xo zp3%SY73h1^?3v6@b%} z$hUpD9LbgBlC-=kDa$cz7NejYle?J%^*!OA;@TMG$Inx9VTZ(MT_>cC(5GI*XsP*< zsEt_kZZ!O~{3>HuPnz(R=Q|rkQO`l1bJ2*H?c!A4{}{}!9vNAM-+yl*>H5a&!!^#y z`kJQ!b+zKBPX?;bLhsjHXFdhBdalmdya|mG$>{1UDhAcYS@J2hI2cXVz0WZ9Hu%+| zs*_~RDTDeII(ls2PJ69t^m|3lUvErbIlO{1+8d{ksiCNkbx#x%x|9BO^`v00F5id= z`m(bWv0*j+(8f9wh1cM{Fn|e4Lkk$Dy}Bwt0{g_7JAKST4anPK9{hL=MXpv0#T=|; z&myY&QjqSA@($7Nv5z=6;7m&}Rm^yb&|`tF88eO#i#-8txG$${S}f8|PWpi^Wve6Wnw2RJPzqIh<3NQyGuXq+96Pc*lh8UE@ZK}~X!M%ydL&c!C+h&cX@4hU$azxVHet5%eX>q zSQyAhX@)GHV8`34IFQHPGof6LbCI&lMh8gSBoI~DsstpfQ?H3u@n#~r%f?gy5Zt3% zbP(JpS7-C}?vLE^zqZhNh2RBNrba;}D>DY*Db_&UZ02NeE&`TyV2PD!A0sQO59#7j z(ubGZ#Zb}QK~qE%_ln zWcou}H4p(YCKaLHjH~(yBrUdp1}vdo+vIImGd&sce7*qzuiOMMW_P~SfPf`3l%x|; zXu`_Da49}ibUB@a0KqqPY)Xo1-5JJESjyPk(H zP-j9I$aZ!(Sqv6bRWFTktW>^`}t^S^Qee>Igx*Ph=NXg|=!siDw-sA((@wQ^Vh8zVMeZ-JCF1_3ctET9X6T+&&IAl1cz11-x3qDqWFyFybgf(kq?J+NXV{?7uJ0x4NozU@PVIaDJz zwH@7NU&uJH;u~(({5=w!4_55{HAgKO;@%&K_W~s6HyeTLPU=d$Kq-1kc~_n-e34u# z26_(9!e<0VZ#sylF9ve*IMDol;jYfn#lm{yc0WtB{t_&Lp-}=BTbn* zLv%7bj4LDHMw5!On$zg&%2j!FI3kDAXgg5lvRsA75KvP4T0w)_RZFdoyhqD?66Huu z&@K&9YW~uB*A(|w&3k}|rEnXa=1jcN7P=Xyk@>A1btZ3YW~hD^CU)&O{sT%Ib%Edy-$k8Y8P2sW;)>e^*dLjV$|avD%P})0SML zqMdhrlo&TgIsxcmNkZp>2fAUw98oofHYpf$!eUp=kZ|+j$D0|*Kgh@QP4Lz)((D`b z=@bDqFf(PtInaQMC3K}x4{irkA%hGyPWrsNWlqDR`V7%hX$m2Do5OZRTbnMIWAhnz z!obn6R&gI5JUnzhXvCjUXWz+%O)JtQD>d%*cqJlY0 zmktoTdO%`oDHQc;s+o%uo}gV$z2laxy81m?ydapx#1&CuS%cz{9zN zF=Sx`)gq=_=DG7D?`_xOE>P3bfzRh6`9ySr+A$p+Vf6Oudq4zlkc86g=N<}onX^MN zLxT-$Ov%Gs!;N?6_jd2?8+jGiRESp5WP9c4^+DGIckgGIGqcMi2_npo32qvZ$c{X* zpxb0JaDRq|TT=c_{9`HYtJ8xFwie2t$dOmmawvGYvh?#dE=-d|tR*Kr3{h=}Z80D% z5kkheL*k&;zC$9T)>l%|A^duPB(tV1T0=imj$(<6Mv1^hJD7*!xdur3%W#-f8pu-u zdw}wAe4UMLW%fI83*jW;O~xjRmtve}T400F9#~ zpWp*Al;R!L15kg$vqJCu7o(j24JrjXMD1iiG96ij zx{9Ph$FH00RVQA~^R!w~NVy4LH2JGULH_ymc`WbHoA~(k09JV|8Yq7d=j@yd4YmCG z7iYCtIV_AGP8N064^A!;)qKBs;Zi1lTTGG$Vh~O#p?}Tpi$p2H zRk_yK-V`}@%%f_kVQCRxqe9r`%YKj|mzv(|4IeI;-k|@rSaZt5nN9xSRk9<9fIs9D z&G3|o5F+ObhJX5FgPt?Ie~FM3v|QA}DnPxK0=-jiJ9&N zmVAmYoRefMmV5%vS-+&X*2VaH0bP(sfF&XDeV8S`2Kf=tr{}`g-h_YDly8obugn5c z)d*vmT*T4o2GZcx$8(VDe1e7mH)+Bg)qo>zu&8*E)L^71W=uBT41tF(bWI^_0fcPE zjlskmkFNgwLwg2#x>;H#@vk7T#n-9pw{Vvb&s*^4>#nr}k%QGZIr3s7G@*!y<*A8? z2Uaff&$e;EAX4%_DBT6>A=h9CYHu^u%#*NvP~Z;5&MI)H1l1?Gxa(Y@2{Gv5lS&%% zO+j_eCgbvQ#L>m>O(AQK+xy1fIbr^kavG=Tkvn*wLMScEk_W)mxX%++O+4g`Ml26J z9CpeH3q%-;+UHpiaBjqi*JluHdsmE|A;kpbm-xsC+4Cq4L$MN2|F35a_ZXmY+fiE) zVQOM~{SVx4Y0ra$p!93|p+?jH7Nbmfts$pi*RHGf*=WNeu|@LJ6KAYtHzDpP?(ab3 zB;a8{@0^IY^c~;_!~3tX=Q*9`LVw3SZY|!hkVB6}1F6S$FC2U(FeSi)Q3Ut|( zdiBUbo>zI=nxIH$r3S}~4f&gPDCrLPyG%hJ4ZbNom5JzlpzAPZ4+SLo_=*RZjw^8` zd`hg@=<^v#XEt1h!%rB*53VADrgO>JS13=mG=9tg;YzLPFibR^DrpYvpwx(m|{sNYciFfWRsHwF!ZgP zFydB~6*A>AlXQPY!$K|EcxeFCl5+cQYG|!vCKJjy5}`UZ6*`neI3b7~*+NLPxZcU$gED7Dd~;t$SS5{fhwHb#o`{6P@-)kfU}>3EGl3Y!OhtGue}*tqC1- zRPPidNDlJ97?%@_IRn!WbWuS)UmM-QzC0xc41fMB%=Qav{BL=-8tH83Zv%6jqg*JgYE>Cy}d zO;mjO39RhmOb;prWw>LCU7N0vt|`PJQK;@XPMnL9uf(4f$a>$>fq6fpf2cP)OtZDu zyE{fXw|AOBNbR#CrNRS3$kVNNqZ^?L^6$9Qh8tWe-5LjlCeN|Z*LUnQ9^Gh@LuG$H zKzyZQ#w_~35c}?bCVPaI4D#F9Bx`rh({vD8IF(Py`2j$^3) zxL6`Gj^;y}v4H4*3h8=~Ix`rlOX)gmD+bbpnWe}NN?^Rnof8GzFAW+aUpupj8!I-h zuAy;anC|5@N#(MOCX+)rIDuf^@u8Q^<#?!$*@Cc_{pS=pO!6)dh6a~Fa5{#@K=pSh z>xX>Wp!~!Bnw+?-sSH3@RQBO`)QEr>7U{D9K$kQ;y-9$Dc0Ym$8bwO7Ap(}9j_0zC zwm9E9yL34tMAi?AB`j&*d;|<0W=R+yQ%Ox&lw?a#)~n=rkNjc780;yb@NujXC-H#W zmN>dDMOQnXEzhay+{)=j4s<99=t|Uc)<$w1Z?Ma8rnuyYZji5`sD}Yzs_!vQlcOQ4 zQRz@GM)uvwN0)*)D7dd#+Ij{L=+{AXhbEL^?!*>`3Wai$@yn#%64Cr5`g}{T~iom2cP%wD6Q{Q5w%AEomjbK>Gl!9O$nJOsuW)u{gnn zRLx6f9ERJPb^7Z}6y~fut*)}C zb^Q6FsunnxEeLn(bs`$_52buGV=Kbu9@^%bTH`7>L)V+w>vAgREDDkqUF8|#Hhx>U zQdHB)m4#G2N5!=9Jia=%{C<8EuIved*wr@DkL@mh+@+hO>nB6EK81xVlQ5xQ^IJN< z(J1)i%#v%zR?8ifKu0cPx1|@~>8`oJT~X)7LX-`WkqkX;p5`e|nR25exUnfnLBLr- z3z`D`O^ukOE)+MiifLbmD{{eY(YI$;+}zY6q-tHPnRBRYb4b~-{05wuv=Sj@)A5!$YelRQyu9>CahFQcI*9N_&vX|jQC>aU$T>Q zo3cM0Czvm2{7wpQlemcFt*_uS{Sy%Hz3AmL?S_W>mqCgeUM4F9{iTzRR6*ON-B^-#R7X=t zRhAB8+v{m58USlrr7+Ec`f%n}>F33$G|DsuI`QCtaD9axlLwn+p4CdV6qYN}DUfx( z824JErNrIGkH!uxKtbKWnbszbNKp36&`p&MA$Qsb@P+TwybH$c_PUNxO;pGjwm|PF ziJI|DZ-X+X6mN$vZGSC14-6n5{rab96?KdSYgP0QMUE&_k$3}i*xZBYgknmTLGJv) zHEFp2Ta3A-M9HOxi7C`-RC`)(Cn_E@2)dFYFRkF>hwL6S_ULXhcZ4kU5m#BDjM(nr z0#A=8RR;fX@=dQe|Kn({yLqt;OA68p)R=E?a&qt2{z4;zD+)ez{Z$Z4R&E}_6H=TK z64HMCQu5)>#66&# zgruYqtP~ct?h95E0-OWFDM~A?IJqbR(`s<2 zVLP%G$`;(VDMk)IP%;Rj!l5Ckq>CmJf4ERguAajf(dUw@tawZ@F~_-83gDjD z9K&Z`1@Xv2(mygMw?N>`&zfWO%-q2_p1BF?Bu*q`G%AqNRQUN}*vSoMe^H&RY5+E0 z(x4<6Da!SE3V?nsLG;^2r+E1xk+i;P=9W@+lXQf8Nx=1fqdg$38cHt7|E9*j-uy^$n6&SWwzUa_#qBhLWU>5@J-T-fv;+T@U+xc zI!AjXSIUhJc}ymT12mim14(!_ffDKY1j$JQYMn@S{0D;tWi?o7+EhXieQR9zF*|2| zWef#LZ7!7#-*4Xel*zU z^7)sl>5LR4!%m$g{gSy62oJ=U^}kx94fgKyN>ZQ)a*Fa2wb*Xt&YW*as7h%m2(p84Rt!D(k&b&n!Py+jEqgEQyOR+dpGXbjk%qQYg zRRn8~MB78VNrL+~TmG4(j0tb1V&Qx*ng1g)gla$`DjfE0~ z*kWB2075u929($XZ-JOrt0%E|!^1}lheBZNm27b_;G%&h;P5ueRXOt`XhB0+E*$z} zcq!t29+xY{U-@(IXyXURa7A$kEGUv)JOj&Fy^m;hN$FypztTN5#g(*Q6s%5Pa50l}k&39*;?ZIJ~fRAdC_JxY$okd3AFV0`7ktx)_EbBNhtv$=l*54VnOf25@iV*a&02JX>v zgcqtegfns>Gq54o)O#3ziwokK%x}d1(f*wK^_kl0{l~EGOM8P1UCB-pZCYJ_v|Y&m zpL5`ctHx;ey!3v^vwp+BoXX6mtXf`W2Iw;75%h-@Xs)ZX>mFkqKjusr5}b?HuB zM*JZv)6b>RamgB%2b3Pas$%4M|JH=Z&|jXR>H4VnbP@Te3fk8e)@LuQ&s<({8|rI8 zuWALk)$seNs%T+fDwfvKRtnSO#95>O$&hp5pbbdzZYno4_z2wZ3Dj`cG0E#nt+SSa z=lcUD3kvyJ=Oc7`&m#umuGqco^JwK7_o2DRgP-(HKS}}*x@(%rH!LP3b=qm(Tdp>zwYC-CLxK5(2M7hR8%^_MRKvf#pv30dC-3>qvBucN0WR7D`j8!l>ZoL7axw z)Wx~(3rv8kNq#JcB^F3_PY7d)EBPOd$?emfi5L+g=Jm}5MlSlflXx*}axpTVPU?CG z?JpaPcRhe%pZrcQnN)_{=_;lq zTQk*BqSzvpby8teY#A-93@?3(xmf{N3H4bqhOx_#mDSr7LcW0y)#{*CxpA8XwnfF& zcP41Ej+d@GX7ATto4#XCSn1DmmgrpLfajjZx*?R00mDu7gZ^>`#q!tI^h0#~dzz#7 zTJz`aTxw(>OM!Z@wrg~T`F)L`gMN_ z#c0|$Yf!~I#Ff^oGq2|=L_^DFHX=Un>__J9Ya8rq6Rs7Ha;uL>YOsB^an2t0)+3$U zDct_*gVizdJUnf-QxD`G-u7i|`H(Ysbw22aNb?XZT_w2|I5tzt4Jj6T)K3jRbCXZr z&K~8RJ+%P`SFt45KR@*(-aJ=MY6L|jmOA{A`SK{kn1gpVEw9N$im&l zb5Uo0@ix=zUNpETPRHzf?AQOYabvP$Nm=aROioV_{bfhGDdA|gu3s}N+?!px6y6d! z4teq_D1`~u6YVfCMO4V~tECO2>Y^q^mY!7GdK0tNQWoO$BBn$Xv6eLP8=6zMBLSz< zQQ`b}=cnW}swA7%r$YgHtBI`~9*-#T9kdltz8LJ{7dk(p5fV9@B+6d6w>acU9G$UF z&RkF{MfbUsQpMRu$)mtAhT6aQ-iXR$%mrn5$;_-iV2dVl#Rjr*%ubQsl2$qc0S>X7 zt)cHj9#-xOi0ZCi*uFI~Lmbpxqu)9ya|8C-eCF~e#v{x==?0m{R6i4#p-1ByrQ8Av z!w`R?8KAi^^XTPw^%6WU<95fFI6fE#LX|NFZJGb_6ZBfC1nEbI5Py}wO!ugJ? zhgGGrs#u=;yvfmho+=!K&Y*X@gbexU~3mA|G4^OVWcNOH_4F z5oDwKbQ&>abt}m>Gce13Y@X3JB(YN)0%nq>jUbs_z9>rQ1;f!4I_R2dYBSdypkQB$ z1T`m*Fta5Oh`0p9@swoBnE%S2keW5q{B5J>OjfOOIHpo_l}QDtwgCW>(GJK~|Aw=9 zG?6ynkWo z47SI)IR+G}?Ryz#Y;12Nn=~$UJb?{eNP`zEct3FmB!{k%Lv#6{4kVe0W}R8kc!*_ji;6lI z6Il2LU9&_Rg~h4a`fZ?`d;yuTnUh5B4oz{?n;1_(VQ|4+Gl8Ro&C(?bR$pb$I?^<=49qYbpHepyHYK;RK z3l}rk5K0rSSesPTDQ9KSI6E-GzFBV+rAbo36lQ}1I-As7PM%JDT=No!EzEB6+T^SR zAvcB8l3ial^+(%7TivhU16RD3)SYhq2AiHc-Z$n@BmQ0rs(3h>MK4WgtqC%b;aC>U z5QV2=41rQMSCAa3qo!wJvx3w(J4GZ~K5_d$SmDaTVu zSe9=rL(w4gjb++m&f{zpH&~G1NDwrtWLen^$<0*~r6jVmn;wG_*KC{=kK77kPdJEt z>ar*+akf>FrPijqbOVjM9K1g8kpsf5V@1Vy;u(wRz%Hx7^KX0J%}a1P4KXU}w$>>_ zR;zF4>InZWKni0+vZ#hmb8wczd&^@g>0x{W^&}~0NVHzRpOfIa=g}0z)PCd?OZt5` zlw|1wuWyE&D~fe5RG>I3G{*vzlADF^0T|G-67q&UL=op9KiIrD8C|@bwB2D=1L8EM z?Y|q`y3Gofx%%dvo|T!g@Jy!!Jv3y5O4=k7EG3u-5;{weZ2(EFY|%EkD%R9stMU|; zRoU2vx5a{AHlZ4ZYCkt%7xoP00D}5yfzF|(1FQadm zY8jn9t-6K`EvKqjLy|(traWwzkr4$Vwjw33cFCyStC z8ve8X@pNA-KyFH>b)C&6kuzNIv4~^H_ayq{JGl-?$yinFj?HQOSgE7xSqXWgLB4s zH@a#}((#0^>#bmg8iCsO17kzmY?~mEkC*(`*sL1YuGV4p9>r;oYHvmv|R2kWHs|=s`E_FJ1_ibZ3!4Frp6%Gv)(p1~fR{x~%TxI}^JU zem|v=1E77e?F~Jp1jsCroZW&J6=tRFn&r}1hCXIqPnOh^rdlW8y++EqCHNkINte9u z*>5)x-=jeTz!ekqI~soF54L!&SE5nL@ox(9Y+n-_5EFcgeEqpy9!An3KEj1sBzOq( z-4~EAqO_0R$#aMDZT~Y}6WbB{=LT^au=~*47@DbeubC7H_J^p9Q%-D%t!h@R)g(!v zOf%>XbeQulntprS#?_~)!I8;vgP9~RH?G$<8|<8t=Ti=<0)N(T+B%h zDMB2T>+--FBxp$*zgMHn^gNuYW{Tg&O1!55k2Jw&NpPbj-Vz!Q5w4F3&IA=hXicJd zvfmypIu)L13+Lh|T`BmN-eWLN@G{}#pW%MrX%XzV40gkn5Shx3e;q!5qA;h=%5rJ8`6l7DjI6s#J{=Kt@3d z{o=IZ)XdC6pSqr1xQ&*va=-)rGi+(`_7hdIw#y7UfT623nP#@* zTW&@&AC|XW+|5rz&DNr4O4mGd%>dnfy7|+&imotja3QH~8fS@s*TuMrYqRMn&#UM++u)E~JXbMuKz=h&M!h)h_Z0w~4Vt!><+0Uyip| zlu^WOVIUbDJzE=y@G5TG-&IEY&J9rrFNfWAA+M3Tr@0Rs?*D8GsII2q{O6qtXPj3NAF&1ge}CLQFfLHuG96TG+r zUTIT!q8^S7u5h@7>qv`Pg6lFpB6J8iCjGy;nHlge5o+u&U}vK!lKu!PBA{Z);gETF ziFm8)i_m}^)LV_LQs!e%8TNb4?>6t440<*FhGPlJ zYmkL!eF7yF;qmn(bs~dkDuSvkvcv0*FMP+JICdIc7c=khqsj*FL>iKLP}97!bfYji zBfKc^#M$9TN2q%#$#C=va|SOvQ(q(;oD68-=GnQ-&AEC;j*qiYX=hM9OeI9oK6yGS z@O1KXae@i_=8j(#7{ggSS04npV_@au1{ela7a&io|9DbD>3J+S! zBU*14jVt^@E-rp>BUp5!CKIdF!TnTO+Q2RkwqPYyQt7h6=!pOb5G@aO^^R{s8UOkh zzRlH7GdL30a0cLib%YIj;d2z&eLE93pr32WnaMr4X4f=y>4=CRYnmz7$dJqsj^0u& zvoWxmRL@(I*8pwK<~bC%bnT5oIKrdB1K%EBkblpE&csoqdVbkIJ2bV;*|4+UB;?K) zdyE&H*p9r(tUgrW&iPv*gsgVM$Eu@g1Q!!up+k`$eGZX%R`E86wAR*cfst#x0|<{D zAG5WGA<~gadVeYXnNDZkItS@-<~e(`3i&n5Wk4%?R*U|YCvTXI6cQ;B|5kN84UsY` z*>&an>E#?qFX3P9?#0JwBRX~DJ4iq3XglIyJ7Rx%Lb4)HqjjcGonzZ_6TRXReIY4> ztyz`D-*RG;>KeAHU+=&)pH@j7#M^4=Ma_fQuKf{DynR|kRw~W~{$c(LG z`L4Y((hE&CD%DA`3F4;AdrVMqfA(UybLkw+e~3+_l}`(J8Bkf3>GJG4BFU3L{&TN2 zNHPS;KX3rJj;Z&kMw53rVQHvORN*($Wj9vPW4;)qa`^15Qf9t%Kz`~KItDC@jewUJ z5a?$8X{2K0Jnq#=7OS{k!fV0Mc(p@}F6argRfgK`)ekL7SzqJi6_azQ{y%Wf;w8X> z_kx3BaThvm3m&Z!3&2;=!Og(WUgco#%9yl?Q(`K0TSQYVyQy~iJyVqaw@To8Lwm(U z*r3DfuXQs@^t07$^xWU{TmdIeNPze=YS#t|T~@LrOWJc^-fGF_6AC(hQ5xra79}IiB*V#Hd2sO2zX}tuP3cLQNPne(Y4xPuZtrI>pc-0 zXAm1%EOg$9O^@bguUFfcoMq(?OjDXa8m2UA$d~K3wpil4EUYQ5qsmPbFLN8FQeA(w zGEN@Pf5VpJZ^epCzKz>3B&e1SaFb=ZD5&|5b?#nxKMK3P9}8(XWY8B1lqmoG*b_Mn z+XrF=;S{3QZj&@>&wNOU(?MaRCtfI^s%~$YHDX~+W|4Dg8kcKziMnLKTv})0Q18|C zzZkYU*O?q7V1ZtY$9FW=53?|_|NtVs`>Ql!Z)y|_p#TGAut0e^!06(Km2%cOwgS8}@amEiQUk+GJqbDulE>{P9=c9Ry`Dfc7oGYP0lacjzxLNw{*d2GR zTt+icF*e6l145=`$mr*8_D*UM+oh0|)@}6#k#DLWZCMFcGh6abW_cHeP zd@dF6*2#|k+Kup%-@LIM#zs4aR_kqCsaUFi@G17sPxX*M{FXr+5hb#jerinJ0Hk{M zeq0PUZ33U8cA*6)ofCT;%`Hl|+I(NOk_*ah4)A29W+7xf1D+&F?z|a686yJ4fvlJY zfp|t##Nc#la4upI?9$}t(hU*zkIS|)#X^ZGjil&{R!WjIJ-qEK$BqFYoFZ_nO%YJx zf6yqi|D-64#k1k2B!)$k^-?(wWO)+B;TpOePmVyP~WGOrPwx@-&?OwU#6(5%U; zQpqJH2hja;D?NaPPt-hpxkXd}pFvNrVsCL!D`%wUmE;Lkr3ztt3*mbIQY8f*V8DNz zg(y}*&bYyU&|+)SBud|qs_@UcJh8z5Pi?+mipCP`MJa~5SGm{Aa8kzS$PrQ7CxY;h zOuJFO*bi++FcGtY6eXgDJMmwskybRTft-8)YGGn%2+HK(exj%oSM;2(Tc3sLTV!3x z7aSx$E_#f~avS=4Odv4zp|@uhw-@})%I`awHe7VWJbll~-H3S9cwG*d^Ep?%YLskW zILP!b6ci77YD)G+rNagFNW|EdkXD*W=6GT&xn2Ayb zf>P=m6z|=_K?=5v(}tX08?8(XqZ+{0b?$N^)m<)kYviCY2nTty=83GIyhsV&{O3|^87$m<_h)Mbh0{aJ;av-!**qx0!bkMC9mCFWe^d(gU z>Hv*QAMG(Fqh|Hg2r3PW+DbZD+TFm}?ca0LOk0sHDfcSN+PahGhgldY)!88~L+A*) zzt@l*Kx9n>+HxEnKz?iRtcO4ac#=8@?ln@2R5PMt?dT}F3{sk7PtVZUEW)3Z!BBXA z%7AA-g@m7V0GKn}6Mzb--r7GF;jvB%F&J|#m*Cs@V~pxnR=-O8YiG8#z1T)W!}*!1 z*5OqD{Z>pFW&X`taJ>OR*=b@8pQ#^0mA-f23R|WMnNY z)DYl2I9?Ipe_A;wJB{3NAmhKcFM`#ge6`n|s@pQRW|HAU2GO2i=$QX~@U2c;(yv^+ zsST&MLfNiEO8gVApm1DV4INtHl#2Jkl+wB)cS}PuHMk7yu*dD_IC=I*M41JmU)N5h zijWP$Tg^nvR&ZTEVLjKPLCcK2fCF`(9NO)}?(T96(e^pvu7* zuhI{Ina=jIT*cJAQX`j45r6e>e|xztOtvLOhfR(lbKfrB(Gy}TeGl}gZg57?4(b#e zXQxuRLN{18eB^tM(LvZ>1G(C;nu%5t`u+D%@Udk8DKI_Ue69*zK-#-P@#(X$pXL8iE}`jsINMwi zDdhB5b7M)+>h(HONWPFqP9p!~r-2)F_v`if(AeypdC|R-Jp%Z6AtVKcKiS5L56k_E zj4k%;4*&e^o^%DL_mqMWqrghS?^@VSgIYB_=xX*sZ4$Q5wM3md41^ILIw1C``+AC` z)a9nB$_A7{cO%UVhi(?G5FEDjF@}!2R;&s<4n+M=z>4~>tWdcbnG747+N^2~#cU1N z-Y(iko4P)UuIeu7Odm^{>nDv(+G>s^_0)07k|Wcy%n;e#2><}@?~^K}sw`(-w+ySK zx>}bnBdI??F}3=jSy;Ot!k^qX6;r0LD3_}jbxfv~<2Pnq^u4 z?r{P>-C6s_=6K3d{3TiQ>ZD(ql%Dovj@Q+S;o_-1ZmpR#(*B0>on8|z@!5L>D618xKgDa|jWn_w6WrfuO@U_nYaxe&ILJPcX4^em=Va(t@));r3@)f;X)h1BzlW zcHY6w4DuQ*D)kWz6Do1--ev~x33C|wWYVjKcLWn_tVgtS3?%GCQif)g2apyT4#to^NA&qAYw1nExLu)1A?C1URd<~Li;QTd=gxWh~hNRDHCaKFtl@aa; zH=J^R-OW`4SF%5*GH1#YJ5lVUF6!TCsz{&HJ&LHkFW0gl>9=I-yeC=@1aR5!HhW_(;WKT61-eE>zkZwc`}HtSD|^+2&?Qv9lo9?&Ey zC#EB7HtX@2EL?UIDG~Nq{>HdFJJ|nw`8x26_{An~aEX9*P@d_FF9GnUg$a^HZgC{p zh{|5}V3f5_CkVbzPVk}H%ocHEBpwX2-bt`^}GU$VGlljZKEPOJCnr zYHknNHrzDA2|bJSyz#)T!|_w|3{^a_xgxPd^H)~7{|^AIKvKV)$rso6CTK*Fk#TqD zeshAou&zn)sg?wjBO4R4nd_YHv&MRm?lWTLgm!A_eao9~pB0r5xDL!^H98PXcOs>t?JkRurkW5^Y zYg6J6VsdRN43v}I1Ncvp*U#kI%*?f!KtXby4NT5WlXJ6L&dtO@!;-UZX1OdE?-5fK zT@~a}OB=MYtiSOZvqPveMONC})h%_Z(h`CfVS9DUEY?@5omH^9x`j^HT0(RM0J(0t z6IGTFx&Sb&TVSEO3S&8Y<6F19@fu5rth{BfTXJc|IWHi)EPtyGbCk+kNZP|@n>ei=_aI-Z2R_KR&LbaQuZ2T@0m;H&dj1f7tcM@o zzIibWNEgFDv*Du)hd7h_p$hUKNivtc?qwyGBmw~7hKUAf?vX^!?XULi_F)VM;1`%d zF)ut-HNU~#(4IUENe>O($uO({Bh=aZE8CiRi7vE~U67kSUxn{Nh2~2=?*+L%)+N;9 zn~7s1(J^}@nq=-!sSGNL$bc3hN-1KL#Sx^`O#&wnr_7bO1~n3@z|GWSo9>1zX-d9Q z20*G<O>s`Sf24PSJ6(&FpC;t0 zrGl=7DsBPQY;En3Dt5Z$pRJh>x3X$$uMSJyQS4o*iP2~$XBaiLcS1%z4Rv{DZHb;| z{&P*J6R3;VjV$H$jIE6KDmTOgBV<8CEN1pJ*y*u)8Xsbb+7>#*c->75vDkajAy$*k z5YmN(=3kItjr!#;IP>yG&il&?!WcL~U+X+Cm7VYVF&7YpA|x&&P>K-YT3ABth#sGf zUPt=u)))8}0Y3)22~VK;D}RV|(e{=Gc1SvzjEYY?-;49PRXJ7c)=NJt8LL8GpGsw0sGUe&D%#S?_65OUq}YsLp(PTz!MQVrq1b35 zC{3AotaNJ{iHDZ8Mj+Ngzdp4vQ2{6`SIK*5K}i90QhqEz9NGcuDxiW$i^QhVv!#`T z(+q|M4~E#Tr-cJT270zdRS5WJTSQ7>qHPf@3u|egd~vvOP1gWCFqu8Qwx?4CUz4n9 zUz1qQ%)VcCzSU*hjxET0#!6kL2*FbT%h7ozJ-|{|B5j*~0a`1RNoRk*IJwSdEs_bj zPG5T?_s(ruC&mS9Sx<_>Eu=f^S`Zt>dUN2>rjt^|+*OyBV+TaW98u31X)+~{%NHL{ ze`q9+Lb5hz>VSd59B6uFnp@K!IXZqB?hbzgESP%bj8g4g?22si4wXARh}>uHo&2;z z=Fm)fXclyuQ$BkB`b{b&&52F5X8GBya3G}?QkPERt)_GGkD!(xnyR*U(z6B%15H&o zD>YZEw{cj&d0%4w>+YIt-?yI>H%$a7)YvbT*_oBxo7HsiS;cNuH>qnm3SEY%x`(67 zkWu@%v{H)cvQlaupe~~!HIG!6Az~>&rnF*8)UH=&nPb;#O{&+drOw_KE?}9X*&2jY zzxn$@=H!YDcr%<@KAcJ&{VsJ#RXPk_xVkEHJiKrr%O4moT-3@($V-&C0E^#ur}b9B8hq4W>4m%6r=+)XW5qn1AKUY4YKXQm66 zviza=l0|KO|Cc{FZ|S06vtt30Il4YUn3Q-oic#KL@Yia{XhqDj5|~&C=Bo(6RfIEY z*uK_al4=@@T4tQ4fu(8slrl=xo++eI*<61dWtWi_orXup_`hB*mvs;7UnuEbA~ZF8 z{gy_i7In`G2d0{kleG*vd2Nrs+P-7G_yU7EXrX{t$RrNyy=6~E7Lp2#U3+rt&}5?j z0z~=J2>`2Wqv&UIaEYM;E~fd+5X=T1%otoy`)wp0zZR};nD{r9iC<&K(IgSSh8U%J_)`Y}gh$)+ zw{ys|YuJ$ObaRQUYp5Zl&2GG&t*srXhLi9&)?%6+t8sABOqZ)$?)7()dfiP86CDYf z89*BCubaC=ez4WdFp^u^^>>)Oo~DLJR&C7;g^V`T?DnjK!e;tC!@8}%D>5o-s^>GS zYo_b7nz4>-8@2U$c7~0b8b3d^2Go<6<)WH3m`HNbR8!TFpr?WUOeW>2y+38yc$)4{ zF)vP2O=VJ*R83WK<5$j9QtZ#S@`*}Bm&z98DQV8}H|@dNu#@iw@$iK+hD8UcCXuPZ zB{_qAYvI1hns2^5CuNDCE9{nR^5vL(IVN9D?mRU4a#a49d^ruZ&>~NeOuih=7Tb{I zNhWxyR1>y6c**3;(QG)AFGrz~OuihGFDE_{Ouih&DP!{GsH+!~FQ+{Qg~^vwW9+7N z<~zgLg9Crtlc%9WybXr8)Mf+V@y_=iOTnZUcLn&U^KI%oa7I&vrjwh&D@NtWV^L8~ zQdm~mzk~3AD*OJSi$Qy0#3r6H(UxXQ*V@*l9X&yc7vF4fzjElq#Pw9=!B5QxZ!g9< z8;)g$AK-|UpKz-|4dJ|p$3NJc9 z8|ZMBk9~l!?0bKVE@)d1v)MHGVSj&%IFZ6%KWy#%d7xyTbf)m?-2V@nV*8%ZL;Ble zXL3J#*sdf4{L_Q~!NA*Qet)>ps$3>I%ECV`cx=^B9tznXJlk2~d}1=L=467Gm`|f1 zyDR6`cVNG#J)5p>LH{YtC1tZyAQIvVi%B&FX^A!vt)#Pg$)1Evq_gyj< znfIzVU`1cZ&#bY@La-zM?c95`-3b}x`vL6}EG98KB27;2{C9im?!pp-Tj-xo_7003 zgCxOwzrDCte#)K$Pyo(w@U}|3c1eG{wkP(zGs3meMek5b539khYR^Y5_|-Xex4eoA z@4^p7pA+?-nh<6tG%*w2y;q+J4~{)5AaG50CUx`MWwh!YdkQNdol5)vM0diPVN#uN z+qfnC{>}M|mltndoa@ZX8DPCP^Oo#WPrkj=d=2qLy%Ebf2xd#+0ixIziy7Ar75KxN=IIX}s+AfedE#8X2 z#G;z8|26j=3W+`fG!#RD=QqKv?@md}Bvp_2BeQt+L4%V;>Nnq;Pg76Ce&rf#Yafm= zzqp8G?Z0+!eJ}9tW_yv$vA^z&~a=TAAgjV3(r45b3})%UX-B zz^pSX(ORuUv`fu8w8HBUcA;5?HhNQ(vsGA=73eoOEMm(Kc$k}g&^oO?`$)zKy&BZI z486TFpnYpplf-f?qnOmuudC1QblOf;Mj@=1^9kK4oK2_0U){+F38l?BV?DO@AI{Bw z;DW<=vWz>{>d@%fI_-_NRwUO;oQL#x4+iE?a+OUlxm~icx(yZC@Y;)OH*;cZ)LF)O zF~_^rVFNrV`-~cJXE&?0tph%KIAZO`MtW6<9x5Om(Bxc6Wir`yJu=^v?VbM35kQ3GTzekPc0l~%gD?nPbjnjDY~Q?or+%FQW-4RceLR;G=DpQ5Dya?RBL~t%cFnQ_|FmrIqR>tH?wkQ?Ob>dJX7O zk#JbudhV`UKqG=II+ zXVPTP7$VKJ=ZsOY&DNJk)2w?dvhEoc&9WnZHQ37xi>4uUF4&%|35A)A3dt-(tG^5x z3eA;Ygban|#^)8t-X*Nb@{?rnFiX$6EIo!lbB$q|ETeHvw2}fxi&0c-z=c_Oo?)mk zS6x*}4U9EWQ*vHQqnV6ml8qK~(z;+)%h*Y0Go+TWgVBX@TC$q8C@o{pXjfAgp=AYk z*+uhN^6oWsmhwL)_2ts-E7h%1+YjxR!vB!Xov@l-zr$EGS?lO5W5VeXTB@;%!5544 zro}6=F3we`E9+_ch|{5kO)m)7Y}50K6q~*&UYFQBSl#Iy<34TMm=c6*Vob?M0+%+P zVv~Dy$5UIWjw8vM7)i^gF;2|n77n1LvKWWteC;4H&UsyxH&7#pB?bK>04MSM)>WNQ z9dHzfb85yWhjU&Yg)5j#8@!% zVT;tM2?)*-P0bKoj9@S_?8&T661l;-Glp{`eUWZFZ|vBU24sRgAWoC^G!mP)?GcEz z(67qATiU82QKJSJ0?Nu&GHuE?mlo{BteduoLpwlS1ym4ek;ic9+0x3vX$HfB2SaQd z(82+c+TONERqzc{i$szW&9_iMRkHRLiY_BOZ;_Z%kg=8W3HbB+uC|n$=e0eZqO2tq zY)xW0Gy8tYMzXtXD_zIJXh;NB>M}(Lo&s3-&uR30+tz&T-O~cJRw$DWlCn6t&Sou= z2{RtN_D1fV+peI56wJc;! zb9w>ijfn}NyO*$i-&Q2?=n$k*V;50ozfy9?QUjz~N$3iKR|i?E*r0kQas}9R;X+mi zVwWaz6VU9^UZyHoyKuoP!=p=-xFq0QgT(4LE8qIP=KVb*z*P2(%wJa87J0C8dwkXX zXX}jX4{zVRXs=ZrlWy2{ds^)@LQgXlIvK0N|20=@_6{qscPQ<&S#1qfU-4^j<6MTQ zx{jU8kWt&!v$Vr!6)82HKbO&vn(m;>5V6z|=hE;2ZI{u7??H6^1{W@18Mo4w?u)9- z$rTy!W;nHcI2nx9V5||wH@1D9qk#>@$W{-BY>m1p<-}Rml~Y?#9k*7tvTSJWCr-GHOK zG|F2G{#p$gt%zAx0uw92d=&w>if~2^+t(UQQcYt~%Z$@Bury7dQbvi|Gv@R=vn>nG zZQFJ3T`a6|5;sob%X1Qkf0yGWelc-pu03}D1zsVXJh<&s*F<-i=#EW~?r8tKWv*sz zj^8kG8&PwaxD6AxVd6IAn$N^-n7EA%IWJwkGwBTgdrjO%vvC{CkJpf0mRyv*dnXpi zEq(8f$Q6*?I3eA4wv`?u87MZug*=8hz5o1E+-#j;Sy!yAc+$hIo!l%>Leaz>5(?&f zzl+iKRy_TpNRtpxqL?c{fdnqA7fQdiVI!CzGk}`J3)?$;arT0|e34@hN|Yq04L7H| z{El6BG6vac>c>Ztxo~tgb%Xsl7ld+SzEeIw?_gS7ET0OZ5GTV`JWa4T!bo8kyNez| zlxC-BYN91CB`zc1O5ZV%kA&=h;<=pD>f&Ol6KizoV=Uo__c*wgQ zOvmnQTNtNPcE`o2cSOpC$t0alg&QtZZ7@FA9M7ymI=uP*KmG8KKmDBFkzL4VcS4@$ zZ!NuvB~r~2l66>iB~)`|DsL{sl{cPe^V38r9xxI=;~uUfQ%w@EvJv-^QN>6X9-10E zQ|_2R))kB^3}erbjK>GW#UfWVBnswJmQ%1!kskTHfRj>I!!KX3guPoYtEFL3`wY&S zO|r7)bwGQ6#=9P7vuW_d{{DkAp5DTcbo{-rg8h+q8|(*cM#A8o-@B7w7z#DydVc?Y z4*FxiQ$m}GUq8h}?S#rG)u!-{vvJg%yCl($-~#7pjr9oAS8MBKHgM}R2n#W`HYhv0sAdOQYEiN`Tg3EYisC}8GU*Z$nG z+&hc!6ZTR~2kM>tNODQbOw>+qPu85Ff{&UqT{=A7-?QF1KA{G}HUydIyI8+__wKEA z1_PhG#@V|IOXy-*QG--bu$gu5CzkKQq{i=HIUoT9(M1*k>t*E}?y+tpW}3xQ@1ZQ# z$eE74Cuc-t%73$?Jyt-}DbWMgS9kVc!L){j2(%8ouMNh15Li=h?B3$mOH$%7FYyv{ zZ(68RRGRn%-sjg#=$hof5#@0wl3tXRcFJ1^&aumt880$E>v3|!*pv>mv-!+>q*h;A ztc=BnCIOUO7u7|9Kxk~x0Q+l~YH=`sj&={8?H=^64|+cw^nW-w`0w=0;pWb@^9VX% z<_PvvZ|`95ApL|F%+ARG!!+PolkJQSY8=awd55Nj@7_RD`DEPlVINMXt-xXiyX7() z*zz)q3#W0$+!ch0hWXj((Vf6p0Hd>n6j3>RYn3tCg}Pz)f(okA+sEd4Ue$-Os>K=k z_A9Ko+7;7h--NR{uWnE(fB!py8lrW@4J^PPVB1GD$lZKAe){|0yVjF8w>*>-gtCLN^gO_#AceL8AAg?H2QAF_T)1hrph)9 z6IPc5q2VW@7OypV%cmThNBAPzm7qLsKSRs?M~(%~?-A6B)Usy3C*F%c9U>&MM#Os=-QoC;sq%G=yc-LBlmk%2 z-siX>5b^(=ja?fH>ipBY8KS7caGbt9+$^VV+q(_E#0Ob?zmb$8rr10DRb%ZFA2tHH z!ks-1oOoR%NBa4kHYXYQy@P{;|B?-2=Dpv!cD~K_pC_cA%pY$Y|LxuHu<{4j-qmM! z3ilqwBthqrE64V4A7CM2@0N4|@A&ptHcN#&y6oTcsBJ#_A14RhUqPY3DgZy@_g?oB zEFgyN@r!+a({pe7#4irISFrNNpFZvW=iI&h43^A2Z4UBuAIc1F?WnlJ?n{@h(bx9W z2```WY7##j9ms?_>dB-!>UUpXSy%u0J1+fJT)Lyf?pxo!g__g99UpXGy#s?9EEnf3 zGS*3IJRZnuJU)_LJqa5&cJ;9P4vfruK%b=&o}6}HfCXj4_A&7b45{vOX4+GslD{7& zen)5L8>BmYZNu`9p8D`s{O)I`UDCp!wcNX8!yfeLkD}yYa$_%I^F)^h-S?A`XJJBf z4|mm|@oA4gJ4oI<=pA>TpTD!-;r{9guN=Z8>7L!gC>37C+Gd|Aq2vw`wy$$%Kl@Hv zcX;POu}o}w=oQC@ogy^nJHTN8e^0hQ+}4xbmhR-<0N;nq0QSQ_qaOybAH*K$kp@c? zb%fV&(1J-|T}|w1@ZiDrfqmG0I~hNT_x95FrVH$+Z;HtQw;ZN#;r)FDHZYs`y;IV0 zpsd_4j&%*dSh6;_p%=d)qnLhp*SYs~GWP6I@{U2goU5nF?St=4ID4Z|QLgk?9Op#$E$k8{{N zKJlJFLr2iy;nhJxuLu06PQGm>yDM$@Nu-k|(_xWXhC`3z*ZWwgWX~BRsOC_KiOIAw2Y<;|V#4oy&J0A{cd_c_* zh^OQoc*k-081?wEc;DlXC*hCOHpXkGU3$vH&bOHH`fstFI6n;!4{%9?K$E;h=-LX0 zOi-X##I7q?pXI}FxvJ!7rBn&qxxhY%9FiAn66piw6-hvg8wRAf_URGW{L!=sh|$qc zuR&xoEpVGh&XsU2MxX_Cz@Ynw?N4C%<1%|O!I=e+65azlQfD$Ezw`#(=f7TCkKU+g zkqv7tm(*oefG zW#5VaNcRfl#(@Is2{E`WegP&x?}*}dgA2ED^Bh(o-S zCLXiYx}n2QG&(_3pbz#q{D99MrJuF7*<0?YmNMvxrTA22*~5>3Sj->UKlor@@}PeG zhkZOF30$;FeR~pkk3|33a5Ve{Ex+wAS5tITP%rSXpg>&-j{*Lk2UGA9^8gESC*U!M z4nv?4S(^v$zZ~Vl;>Smq@7^ju`3#O<<^k@-;Q+xJG4o!ftKf7BW7+5E$5L*rog8;B z06v2wCU;EiakL4Psy>N7c>7>a02_xxuUqhUzE`gQ6pf{DUu12^rW(%f$eRkT2@s*wUE5yO!fI?1xl*1y39GEC)_ z+0&A4I)oi2z4MXfG8=&fM}3XTb^Kwp6qET90~69NM3uHby5vaAXrETI}SuLKP>_jH%P!^2POgeQ;ukJeJU7fjur9 z^8F4+{Ys{$WSsX02Ou&^$w21v1s(QjL5TT!Fy(xV*#%d_0JHUZ;0FlUFkmU-;-PFA z_Xo!VW}v+WJz_&od1Eb+0YCD5>Q*d%rbYL}qN&?tZDsdq*;M^$6`Oef0WIiv_r|xO z*Xt4R@Bn&^L-go0`r_NvCBv|4xdTbLC0_jS;4muaiU!B%37J@bpv0q$5=)7992NE( ztTAwM2b&RZq_qc3i+B>1`n&t+qJT6gxMX>!@!q&}9>J5Q#OwB8<8V#rI3o^$=VXN~ zDOnFD-}A9IA6dV_djAzXq{CnXmhGg&# z@(F4mM$TZpV}}QIiG3_9yC%7Du<&i7?|rMwia15Bklxdk>d@rWIqgf!uBz!zaXo56 z2cP2D&|Wvh$#F`Q1#Xk5Yjs_n1d?^%oWFiobFt6*40XABK+vl6TR%JGR3K>KsTU2Z41r?XzBAQc2nNeTI7-+6%(WyYnSdX*>r<~$`=)l`PZQf9Sku1sEf>r z7R*uF)@P$piSdVFM_qUn15@JVmEUu~8FWgzs>2wAhBD*VYHwXMH($W9>=X4p4goRs zHqI&hB%^R04Ib;l(~JTuw>fIntE*R5gee52rKC}C-{8O)yr?Rx(Cp@gla=@irh5bu z6S|)vbk(NCIIZq)WA6rveZv?Pu6_Fsd|j-|IkMfwR`AAsq7nQmW^RS{Y6gTwd$*xHOmB_B>P@|%1uXNmv z$BH&q8J;cmy076h&E0(oZZKF)jMWjt8L9VF$q9lr^mA*VqwUi90{@m8ZCJ%&ZWY*k zWEHF9ZP3s5i#;a%DkDnGl2A~FEbk3mUFIcM= z8=eh@`Vl-1K)&&uvVxT|bMRy^qr3|G3XcdgN-eoc;_+aPnNy`fPg4cg*j>aNJ$Gg{ z?7+Z~q>l#mpt*R=Cxo5XYAs;dQM7u+MIBGv4!W>f4h&IaLzqfx<#+SaBK~0IApjfQp5)*c|?h#onl5Eq&a-@HVGSjbmA7 zOe-{0A5Z`Ie0k@&6R{^QCU@03xDUQMnWfj!&wV%q3vFVeK(Ry8trjUTZN=4xgOacc zHjyX`X60(~-V4CNyz;@t0x;*2*bEf^Og^@%VLpe@-M#LAAj^zC=qepQfFg;b#t^zDWtM*F{0||ofGwx8=oys^3M&EI7|xPPt$66ZR9OC{gY%)f z_5t&yu&$DRPKW4tK?V=;9s++3QmU%8Q6zmq;Mm1^LBv=puxPo_VkhlkMnn688gXFP zE7GH3#DX^&`t+H6jx_1LMMP;*q1KEoO%my-9F6HSsu55jz8IQGc++@DrY}Tl5}LF> zVDPXXT2H=n+MXGbt+v7yQbGIhIPsjwM}AAu?6`h#MWSW$Uiq==goT_?ts==QQG^yD z_#iynln;Clpb*O*fw9OQ=vu+lxpnWJSlP@fz-A#u{ffbi?=OER?B)|fJ&UEwnKaSO zhtN|dxX=kJIX)(1C7&THIU(3)wC0~N+c?aFi&21V+b4W9Na5_|vEg_&-F zL+m_oXwf98OhBk=*^r>G&G@Nhe6>ixl%kx>n4Mkfm(Jdn#yK6iZaD zHc?$+;)t2=!9f?*wvl>km!36hc4gG;+1U0U7pd}k{lT;K)^WXq_9(gMfFO`%R8i60 zvipmaUFtqfg$K3@4tgt;FPXUp4~5_sbo~fu%&(~I{tK)wr2S+8(#adp&zY4()Kj$F zv)W$rlDW1b#?;!FVnVO0s0rEa-OM)YhF3ymBGnUxI_3G;#YK#26kaG5fhq{DQ($)Q z@d1aaqq^~%d7T%d#1FjM)DN`gixp8P^)lXnRbl}e>>gkWzS0|8HhRc*_7-3|@ETE9 zLHyBSz#c8uM%j;ODkgHy!HpVmbASqo7fuZ`A3M-@aQA@} zQ$S5MaC~^8wUEQupqntk=oxL)jF=oKEMtun6@Nc&VHT^-34 zILBF&(r4MmlI;Y0-E;dXbr1Ox+d1am&Zly;ALZLohPCC?0_Hxm!Q?k_%@wNOtlNaa z$~Us%t;N7}1&zW-2TMd%q*o55c|9W)DrO(CeNf@_;I6l|vq!)4imqUTgT3DqH6za< zONx@J;V{i?ECmY8gsC$b1#c(uJUpF0VX!;!{@&y=%Ec>B%bVX~i7dUsvVeJRbJhi( zyahTHU|K9ED=&_ao8^;==9W;hVd7{&hWYUd$+G~fI<`AyVwthl=Lv}{OtUkHOgSe2cNEIbnNWYEO~ezuVn9^fj9Zz zq70GJ%1B@&A6h)kO(IECA{TW$M`tH2Rq`7jD3a_>>BLehQ(#ChB*%SNMry_#?H-)O zR`T#x?I|DFa2!eXw>Zng0?W=l^~AZ(wSAAJ|2_S1+7e--HcFf+o*ObGP+AU%=-h)N zZLD#ktaY?p>63RX%Ufv7$mW#vNjN8^6~a<&r4AOYpRD-=Cz~7G&HweUr=JLj{c(bi zZsX=>hQnq1;{1nTMoxo6qQLM1F5bQH+n*mh5%1u~&L{T6&Yz!lx~y1~I^271e@vft ze(db*{2vekC6*q@DM}q4M1|5NkERr)lL{b8m`tmrE*!R;C|ZJWTtT>G-CVA#r(o>e zf1LbZ>nn1;S@b)5X+n?uu|x9Tp32K>VzzvqzObI5->iazw|2kPHl|(OTmlRHF;$r+0;5UJ@O&dNw0Jp`l74>WM5#8$e$0O3)UG~P^ ztnyOhIX(`d0Qy#}faqmIsa4-MZ{$gp)J|gXCE6(*f8lkZO<@x>LwA-~|L}|2J;V%$ zSYhm1ncik@ju+>#0>vL_sakUa9#0oowj`WUY$RISObNv2zAzN&2l-9m*vz|$sU|^7 zW!@N;M?XjgC5o>8(s_e2xj0G2BW)*fB;pmJEs0M*Ifwlzv^=c;^^>*587#N(W-#xF zS1oSMY3L!kpNYD(8`F7Rp=ArBuC=F*{_H$PDYWyRymt(sMaknQan^uob4MaHE4YAy^((JRT zd*a(6*`}ug@BnRTqot;@4MH?i3OuCRsUn8Up5CIngk9LJV}|c-*qOMq?c$By#i$20 zz*as6_=ZAepcLWne=5}w!31GHme`CzaZxheGKffgLz#__06ZewM@jdP(Z)ZWOIN<< zk5c~1i$i@GZ6^z6ZF!6#32IBHb2vyzd&sA8D6lN8bE>AoOv~wKlXIGsM)Rtu$sJ`Z zl1m1Fk2_9@MXqW{6i|-Ennil#V;c~BR>Ln}umnV_G9HFG7-VX}1rCfOKl4cKc2=30QG=0UOg*lG-2lVhn$fTcQi8mln_ zE7h!00~^i9M4QG!zpuVKY(LW-wr|{F>ve~XyJ>HPM{G2@*v;agYLQ25KMpk}rIb%P z;}ILepcresU`N>aY%2DJjY4zU>;tRf$q7oHhCPmkHopAOjk|P8evdgiNq$#%%c5e* zs-W=8;Moy(t7QJ2gX3r1ca! zpX%|F2mGf)Uh)ZeROR_Eg##qz#wl%3xj!fUeFVD~cO3V2jQzr0I%600oI2^FBpNbZ z4PK7dfmg~@fCh}D0=yir0IyVXOO2`!f8dpf*Gg2AdX4aEtOEU)@W}d+?g!yIuR*v} zs*b4*MuMacyq>57FKO11@CFuY5q}Bm5ijc1R9Zd#`;U^J^y&_{PoY>LzsPIh-!+RS ze!s(s^EF<0csVRSyi%$HZyax~=yIY0xT06V2XEqF`XXG$e&XKXq6;@`m$=V5alht2 z{q)nvPRLIP{-&Mh!WW`c#XAW(AKvwfeMsHGNQm*C*Wt(1T_TYn-g*)H&b0Z*&il#d ziT4#Q?TAjK$<@1?bSsVNX#SPZO9(0wFve(hhhK0S0`id_wIcEujfe0vbX_;r9nt+U zFwr=T#w|YMG+F|96!tzBqka=kqwyM6*l9Gr=cwd2+D~JZ{U-fJ3wPqIDC0M3{6>x6 zDC!pyCC?qdq~JULnDJa8WG^|~K!TG;TfmqQ|2xn>1}Ri6HTaFn0iX7}i^|$&<=jQ} zU!vp!u~P1$IT&th+(omdO^sfn*|?~|Lk%8k@KA$?8a&kCp#~2%c<4sqp~j}GMKwaC+Q5J%~fQp#td@w5yPL}}XOWFpu_`(i3g!h8qK_7PYz0<{yQR}*T( zQ~)IRjaV1I$Q^L_cRlx;yZLyWDw<#9Mf2~PE>}492XQYeaw&AIBHv0BdYmrwI9BMf zUZDkqlmGrB{iavw92I|zT@$bH67jQMc^4CKYO-e@9|=Oiv7dMiv5R_DErcI5@NeUV z!-de9%)c$w*di-uF!5#+7`WT`+YZTjK<@fqIL9InE&PMm`S%q2=HUUXpv1$Aq}L5U zp@%R1gxqq$WdM^zu^RehZEt}ryBL2}Hhru@LzYqMiV#6mw0E-NpJ$~&OrHRE)&)5?KsEvQ(r40J~i9tWC<0z`5$3H#e{WIwC zp*!gDp*skBZ_wklkzDBf6Y;SppV%9bRN71yUdJGuC<73lf1>=j#63S8A&~@8yF6oc zz^AYdsDyvwU5u&5v%8qDnxvDXbynKV;l0coRQM4JS6WbhK&v45JEcASxQE(}YBoWQ z#(>cT49Xp3yG&=rfJjaw99NTKP`aV`G~SwJKuux)bTJw<;jJ03VTHXl6?P?+TsQ}5 zWOUG^3uoaLpA}_XIE@RZap7EP7tTV}QiBU;StP0bPM)&XTRA6B{g)`Ygsha4XAXSa z8Yj>46RSoyP)$hIK(PjjHBhX9Vht2)pjZRN8Yp&ip;+T6x^a%8g_x?gqi7a}+FD0Z zeXO)DAfuZ1XaOc_yhn}q=*oGI9%g!v9vbh_dc8;a0z$!DbhA1Q-+SZ3(FBk0(8lP61#Lcq-Vm_ZpFrJ|428;X7m%RQzZ zPvm1%!m&`ov+yJQ9)66{*`ExekC8YhQMo5k3C!z@e2hvsjb4a3p^=Y~45x6Jf26)? z^kdk*%ukJe3|o@QHu^CvfqAu&k5R?U!_A7E$;ii0bnaM2K8B(XnCB(= z7#22w0>Y0`3CsR zp7;o|k8IF#ms9qUO-SxzNIr(;a#vLHF%- z?ZbJ&o$}~MKC`%sApOY419R4+AE{R)`^d#%jf8Zl)nN_`8422s0J>O8psdvs374k@i++Yjs-_aMG~Lj1!7%m z%W5sB)+c-7L>fG}%+JlNoU^sqS(#9{ih@36^;h(auz6=fnKOhkltTVyZhW+K9{nZ7` zSBvl~IO8)BekQ_iB_jN6sQU@LhAzQ(hK}qWjBN30GTN_aqWx-#_B$Jm;CyO`HssLr zhrjvWd^&t-yJKfGJY(%|kFf^=i+>L+{JvH}fW-rlJt&U51qKABXKiYoKN~}Ti&I4s zTc$DjhT`RLu}i*w=H%~7Cx2?$!xM0Hm>Ws%DQh;VyA&nn!a0!FNi`4jVG^?>$Zx{EeRPF)Fivvo2vg!kocE_oNOtiIYM)1IaE9%O*3>qBBtX zxHG|i!`8dA$AOa@KbT?5L}7aI_z}9vjr<+ye)1fr_fHmeupELJ?99Loay#J*xiuQ? zy?(v-1b?houYP!Z1Y;_E-o7G39ZHG&Led+EP$c?K@S3DQ3DGOWPm*3`o0M~!W)FT7 zy(Z(%qVS`{wK6;E@}=*$W-1`DnHQw~Q_f>w+ddGN+q{DD*ul7Em4 z;V;k+D2lW^Y*E*DMmP?@44%Ni@`$#Scoa%>A1ej7U+Aiv`5?KAZemmZhFM;R?5SHW z6}9Gb3W@9R*2#PZE2&iM^hH_09pb}GG!UqyD`y722lpAu6ZQW6z3<$U5z8Hm$RY$2 zgYpVVWRW#s=XM^jGpj>AMAS6?D{Yp}hZ~<~!DM$b&69C|T#=9kHhx9^7}qGI z;rVCztxUJ!o&2MuQIeO8TQh?!LX#7%kZk0l*n9)iCC|}W*HoZue!?IYT$aS5MeIUX zW=((Ns-~P^nZ;UO#|OEzDXr#@99oXdeJ*3(aYL7MRK`6VMk;XJR8(U2eD**V*uRPe zvaY~{{|W;mLo(RoxZ{*q3yOe~+FTr;p3 zGwvF@lh5Kt@WB~RZ(*!D{$5zY{>ZxpG>@6H!|8Yq=43Dog&GFTV{ZR`4yeU`8Eq?m z{Skp}^$uljh=HQz)>Xsl=17zm`xSpkx!vhX10O!GJ$Euts!pSa-hnn1=#d*AH;_ zBlZm-TqC^fSn~-r7~OwC3BL2_eX+-ucW3cfY755r)SDn&rv@Vm64I5B&E18Ah=jo> zaym)p0gcjsswK~CIT{JB6zRriZWVARep)nc**jN)Ei-NtQA;7P-X0tL(%_e=KL)=v z_@%)w>&7pWHYeCyjpLX7iuk2O=F0e`p8eSjeyM2x^VQSfmj=Hy_~q*3m#V6#JbtON zWh;SRW(gh^(bq>Wb<3&eq-(91M>$vqf`@23b9Y&eXW9ETZ+vey#E z9AxV9!REl2DGW1U^TPrY-=dE$cjHwsnl9|-F#wD|+aMQ3k)x%E1N7@2uChbpoI>~w= z&6wR@0@9SoTp7~TvqhVMG!^#(tXKnS8c5SXnri@Qs;ZtEAkYyp2Kv~h zZkaV`*>%A-4-2qOla#e4&rJXJ!TsV40gCYgcjoy|#x+wm{+64zb+MS{VWu)a+#F03 z{-aX^5Jo;V+UJ|eM2u$dvYaz%O3DPwSbq06~Rl1%$31QJ)^T3@KVv} z=ZmKC$29(!#vgO_!An)uQy#oj+NPBNEwdyKi#XH=Ep^MRLA$OCXn9lsS{@mP%%(s~ zXuo9nq3zt^SA)YJT_2fJy0gi1u~p@%Pt9QN1YNvj zTT>5P&ISLY8=Eo zt_WgEWUdTi>Y1I*fS8JAKP%RNmXuo9 zid`1~^P~X4JTU-f-2f&%2mn`1mP3tpgh4VTqmhkuaS*O8l6jJ;*ORZmDM`Pn`z5$! z(nhyD(oR8BZheT(A@qAuc7dF1TUqy=+q7Z zc=?fHsCl$_(s>?HE$gC-g@aShN!Rn=1(O)T0zl|T-&WDbis z)kh9>%dA1Kt_yPbtN=NDW{|@=kwcSvCx7^{!7YxuwS^C#Woqx_>u&&j*y7APtmYOZ z-Z||n(^dZakNElL4PdQQfGkbw9X|AC6nUhki09)V{LOcuO970u<=`!Q#DJBOz;Xjt z3IoM}l?JSAD_EJdGr`7c9ISj+5v-KRTp6s?vpJgqD-~^iR;&Rl4OnTw$~6EhRaH+_ zu(I~dJ6VEnk& zeF_uCK%WNsY%BDcvQp7LYaIOS#c+ZW=%-Zd%J`?Q(b^0Gs=RSv1se?1V4wyAT>}hM zUH#OEg4Ue9M7;%2Tum1(io3hRz@Wk1T?4@h?gW|OBuJ3pZZi6BtxeFDcXbJS?JdZ7rueLVD+P?ga(1`b_;Ydu3 zbeY-xW=vw?z^lBE&aluk5a*#h%XJM+`{m-u^!4CO^NBBzUf@B12Ml!~RZ#GYLWrwR zuxg17l#LIYJG0R+33WskO5(e!uz^pCZG2XwwE{(9xd$*Q6oow$xC1SC6u_jEVcL!@ zYkfkbx{pY<`i?SHY7XHt@pcIwkRzND<(0M7lP!$-H9;F2&=$kw9!NMS*JQ6H+{9X zO=gdmH;fT+7cxG0$tShpI)=o@$P$x%zoQo!UP$$dk*TSVIQn0gz?pB=GR z&Uf4RYJ_U%+)NwHG{Oku+F(Zc+`b~h7KKHggq<5Lg+!&!xAxb0!+pQNKaWpx7IVekzONH% zP+ZAMQ*?oOim$OgKayFfLP>zDBG`ttoyOmB#&U*Q8GJq~KnNEYVRY;2P69Pj^ZA7j z;I&CH3`CWqc(^}-bEF8y_HO4nG3KqTXNz7xId3JqyzA<|jpMJcZVfc84K#(qpD8f@ z`*pE=ng-pKwE&|IAGeTm7va{=DvRsF5Yr`hwIjcEi=uEPbbMJlV`grq1X>QJKgss> zDzQzOQ<|1*`zWuC=U1?=-s<~g6RRR}z79PEzh-VJ7MqA3q&y${xm}(e`tsI&XQw<{ zl*xkROUh=0pY&?QXp~a_x5+4Vp2Tz^7sIXTiy$6;+vYf`?BGviffMw?Hvoy z#<4-cKyfkT{QH3RP7tBc36s#gLPE+CaFl@Z4zTdXCL{&Dnds`9g)KX9Gn|Y*1~wtZ zqx7L*E2yVvvhDeQCXV?l%V6IVe?)Xb9iE4OEOPL@WH;HiN>Udp;NXfnkw6aH2$71q zb_IWI>iCDqazFJtIfRf|Hiv^%D+5*UYgNgF*_>NQ4EkA@u87@rJ5rV!$6n!gxxUji zD=BSR{;DtqaW?-4x$Dr2X3&)5`e*_Va3+&0p$7#*Y+s77^|Tj{cq(oaafc zW#8@>-#^UcPRwJUJN+SD1O-ZwKjiY&US)r|v?P6tnU65}1#^-WW_iy&oBa`&alYJ#vUos=>v%+9j^$ue;7-!3sGM| zgG>Al7pt*pfl0=vRaXwdl~b8h&B0bajGiL=T!=ZPv-GGRmH7MdD@Q=Br7F@r>5Yw3 znTc5yUx0^pA36FEdG=nMD6O<1h^bKh_vh9k4+fu$B`jWF@s4PLC+g+T$hnj}Z-uX= z)Vgf1jfj5BX~71aF8(qzz3EE`;ly#gi!eWZTWpS@ywECDC zIGxe2kd)3tDT`_XC_m!o-ZSNcWKtJRby3IrVG6A!ldpqYjb>uB!O1URp;~o}Aygkw zScxt{9|sO@YX6n;E4qd#0vF{8lQ|M%uinylx38Vh0WWz8?(DDjPlt%b!Y*NAv2NYk zdY zBe!li8v&a&PlndA#fyRECzC@2Qw)^(--Ov~QJ6pAqsSP;Vy*R=by9wXE4pj52Yn+?vM{}xnw-hQD`3)*8#X{U zskf`H+LfWv@sEEuCNw4jOe|9~2Y$ZGk5PF3H#DC{!m5C@v-*KA{yhsFDS2XFyc%F! z|HJTaOx&g@?~^z?0fVTWYEMl|DM$=)-yzXpNRE&w-o6&CznB7iV*7iCR5bX`Zf94C4%3(F@u8%;>{$< zmYFjWwmPhVA8I8w%7Y6Pav?wKD?CO5UBuV_&@Bc)G@|>MsZ%1uFrn-UDuNmR0;ACg zaYqV8h?)fx(N+K>I;tQWr?-osk#NRaG+Yk!Su@@*a*AQmXt=UrzfV+{sAdKHOicb7 zDPLjgPg(hundDURIZkoQhY5d?<8n;a5X)JeO!EoYe#hH|MN2l0}RCYV=Oev4GVb3oh)@{$1&F_{eNtj)(@zgtRF8ne) zyM1$?JDNU1pX{7zTg8|>qEC5zXVBaHfsMmE@WF`R${9nZ9PL;~f&6%mdtFC5QCmzM z+7ixI^z~HT6R%wlRI=11yymbuvp6C?<5_}bXD;WkB~ThwWQP!9e_3TSUC8`WQ66m) zUx?g^@V$4=T& z`5#g?B{$D6eT6I)Rw?6m$ez<-kk1lsl2(?qmxa9#bui<}EzCHeKnj~$^M@!+FEi4267u$&I$T~rvCA&!PQ%fGtW6ksB(&8zp zZIa79B*^1&h$zAQs>BpUb@$UF45)#P93*vmL)a3eY<57}S*_$FsWVjswX1@t3zJ(U z;#Efx`a7}>aDGycxgoLu9qv@v zyiy1-elOhM{<4uxVK4Y~DhjqYR+&rGkItZg$=7d)3_3!zzF#h$&vKQE>Wz%1xtUAq~N zJdfsy;GoDf*1a6-PnT*{2cmcB2DXA8JTN4U=lb!_P~>oKA^!=sRnrQ4a4S1u)JN*n z%%@?_(&2bEXnkgo(dt~*2^)V=9W~C+0iT0FLX>hSsf*Serba zn#VZ;)R8cRO23Jvicv8*fe}+zF2?oHoXbNbkIx~7f0bCY1RyXIVsmYt2BHqt$*NZz z?h`Y*jV;Euq7L7qy{@2M!UJN3iHNQqT(kW{>o5*S?z5xOK>sGBG1NRp;L@NMwG20g zIg;E(dD{8S_3c7lz4O4;O&FDD>zG{9i1Ri=hM9iKR~^+Z^%5@k-NK`U2qWfuueVvm zL=|YJnZBqfCM5~?^HUSRv`hW|E>_3U0Rv5~ao^8A+k3L6YtjyiVjw>JFq*Ssm?@|t)@jCWC+66Nhu7*dZ=}QN_d3g}8l<@ag|5HE(QX*># z5nCEPoh%2l$kduw-&2T(qK?JRiM_=&_nf_j`h@yKM-cKzxL&oT4Qx9tZF7CSrP*h| z2l)Mddh4~jN^jP{v^DEo=eJ}j7##b9Icp;eWMjA)QrNdZf5_b@l71t1b z$36k+KRs(kXAJqf111j(gl38Pp>J_1Cc^6X>-TtupSC+CEMLi*n?L&ngk6@2U``;@ z%_kaO3Wa~_5#^p04aT-t_X!GWMyv6#cvDfkyP%cLV~HAk(oW+NKLP!#Vav7iojM9{ zZY_!XUCWw(xhzg`f8rZE^=f&XQGhgCC4eHm3HchJ6vFa2opZkrV?J~7!J}0j$EB4T z*y?G0N?B;l>lR~gZY)&Y$pa$a6m@sAa6 z!DInQRP8vH_v;@}75<4IEhZ`ojUy|xbMumrwoCJJQvMb~!7=#Z!c7qZ zLQ+79WI<2>HaISY>%Y8m1ci2j<0aByI0FWvvAf0`1!n~V=O4n4rBzzXR%z?Vfb*YB zTD;EcV=u})_P2YRR%3vz?r4T#Z;cqkm@wYsqOLG9pyBP7J%gjtxqFeYLOl%@$>)Ro zptNU=VW06|GDq{G=@gqjN~=+)6yM64U=KV;;0ZMfsj<1mLel%fnz7UJuZKou%%hJ+ z<#>pn+7dQY?q|33EshhO7&+A=vvGmfjwj1NEO`eBy=eFbrxEPRj)KaWMjs|jNUfH* z72}Svy6YPBxlZONtd`i3(r8iAmP44o^=4FrL35c6Ce1vTp!XL5Wmo4;S-p^5u+k8W z_O}f25dBRTz_@!-`X%slDki%aS0=`-_b?=>X(j_d#@*vjm^7l}t9j?0+IJF5Won)ybFV{xmxY;|Kqq9WV47NixH7^k}ce|eBIEE4xSZa*`5e9LgkDwb}x@xz>#r_R@@ z3OOq%QLoiwC8JIX&+#wqm(s{rdlSkT;3f#2x%Zzh>OhHCI0{2_P&m{TIy?v^G-qs6 zeCLGJ28>&1y14TDYg8j|>}i{3q#8Js`v{>KUBw2!!4D~>v%>5=J+I(#KqpJ2+LT}xRs(S7_6)#04H_2z=iVloq(%tmP!$}C6(8%|J65F`@oo2g7KHii}- zXGwUktfl2{CVD6!WVrsI+bP76mFB;=@!CdQto(EHLbFr3FIqxRfIKu>N1MGx;Qg(1 z=;vrYYE;-wiC^DhMH~fuOHinzMc{&z=emJ{xi31JkgyOl8eTA~#50RS41#T|32?7C z5a4<7#>6(*_B)2?6``mw7R^QqWrUn)kXp*?#9WChW|s6>d9PMm%aa{|kH1?k3YVN2 zZbk$vp(S6bRuz*4@1{9;jIN+ZIcHCT)QIeC{tb?8C!Y(rO|WTkcqFKPi_O3`7OK|n zkiprPcP$@pZNFTTfMj?~h6)CrnmudH{uke73+dDzO@F$F|&#h3-U0OX^85~FS7=l~#}?4H#34G@@S-}pKJ$bW%8 z^unk2h2>)#qdy{zST&8R26tJ+{>4bh>YT%i%^|fN+ve2XQ4e8a2^k(hhu zov%Xj6j&cZQ|bv-8Ixyo#WEAH)f8tXlWAsAVE|mC!hq zk_rL*X-&&kR(Hy_0tt*BapR9_#QCLaFWw-19j zazklG0s(m^F-P@o)vSSGcykNAE zTztb^4_vF{o23$8*cJ^3<>*>FibVn&ecb+5E5-O|3PQfDU^Gy~zf>%$ zIPzaV<7n?+qh`dB)BZ_Zj%l>>wuuUpiJLp>>+b9$UC zzWO)*!d=C>_N~`o-MO{Es*ad4p!i5I`Y4__BKYY0$jr6c4nOImqOk|Y0_C~2K7}1n zp2Laf47W|PFu!Up&c%# zQXfrl4rAdJ?~}xGx5YHUxDaV_&{W(y zfXhwb(`o-Nq}>8L6~(7>z`UAynmWcbYcSl~TmxR*Y8dfnyu~0cM*}nk8~MKQXv|mL z;Ugy{+$@}jssRZG0 zUxmdXnUS@*N&?zNYw=fJl&O)FhbgK;%FU3r5KoRn-zAqK&h%8_pB#lswA%%uy9$|0 z#PCvgKx>Nq#23G*qXV(5g|0r}i90Pf=PM48@^BzuT|)Ko<_pFHYNXD0+EX#*z33|u z;A-;_eE6=Ir22s_p%hRP7EmK54HzPma`3&u-f8+$Ubj{%C$m5{;--J6nxf$2WbBI{ zjO-TZMkx0Kg|AY=C9@i8l*@YJWZ~I7r;wMi8Ivmlk<{^|n^5~I4do_`73Hg-GgEUf zbX;Yl^7wKhHoRn%q$oDN)2E+dhRO;A6g_Ji&LdTCO!=12tS_UcVotQ^G(rv_i2dDG zeB}j|h}f*wLuCEmAj62;l|*afM0Kz=1CWhnqVXfd$(Iat=f?V@%v*`!63k7qT@N$4 zXc20OK!&|USj+S3!y58+srIxdy~FRa_QgV~CI z#)A4tN%(Gc{>queG!Quzdz)n9a;a(0Nmd=r7k`2m5uccu#v>hzAr16Gd8#jC)%MlWEak;wC3bj@GjNN3Y`8 z{XI`}fntb{IU@DTV{Qdl`1jglW>et(`dzD3Uok25YS7*>%)?}va|bIN7DaE5q{U0Z>)_{?I4=}!5W#nOkSuV=%%7Ei0h*8dP7}brViH`A zALE2^YOkUCWi{fSf3gg)mo(UZFV0rH*}k^`rjX!z-lAxg6W4A=1;t0g`vTCV?&t)F$j z{ydh6)K#&xrm6wWi2b}+w$%4G*_iHJjV9(L28U~K0=3mBk~|TXP!bLLduSmr9H{N^ zO$}(bl&TQWGH3|J7(E3M#eg_<8Pf6jx?hk?gvU|yf2qUbPEE8F9#jfqo#d8|pUfak z`~C0N6N-%P8=}zrr5n?zzcK?n42|)-B)pOQL8w%l^pAaKpZlI*98TOxG$XV@K&xXH z+B^kCU2I{n_w-gD@AK5Pw-EywlY(%-V}zX1IY(nv3}zea@}_7M<89{)pZ(FuFwAgK zWRa_z?3qQZ;wX4SK9C7*3fOnQUJmAR?QTbduDx!bQ?GRK`*(%Jux|fG{bqu!N#ArD zrta66^Q~ivUn3?KFAeI$>#Lut{qnQZU;X$@d(ucTTS)~I=!QYsQ>BVEzUUnj!kYSdR3bd4*GH62!m2GipUCNokt)g-S%MLRzfHZSQme#`Uhw?rf1D zS08t?)v72(l@+R)CCdtDT;gS`g%zRTV|iak!~ZQ}!vMpuHzCZK2{s!Et~R4@z-RTr z7UHS~B1Z1(FVs^4s+nf8oDPQ=)))w?nUE6=w5v!&!ea9VM-8GQr56-Nw z#(#uTs%;E30ht$J13WN>k;c=V}}qNCTHc@=Tik=)%h?y;0a_dxcqD zp;drKnJ_jgLY$Bq0bpn>E$%3JjcU+@{n@4+sr>(zRR-R%+HcTxie2?%Oyds9t?ca8 z#s$)iy?68A#UTGEO0DFWc|UR0R+k6~D?+^sNB6_|fRZZvN&8mcX|D5mLNXDES$;$X zo4vjVj9Hi!m0BjIVZZ=aYC&&?7wbT(WmFqpJs9kSz}rOy5p{v=Mw_gAnYarmwJkO! zNLBw+Y9n8J$2q13iw5QR{t*ivK_vk`g6?LTPYKy` zo+|0CjMV+@&w9N-?ABS&?|O$H1JF8~lUQN*L6Uw~M?CX`Z|WQs`#+7o$7LOiV6=Rh z&gR!%D*7h<_^3&Ixa^|CbLRd_z3rP#&T1qZhK;ecl_}G(8B;B0gIk=DSL-6H*Z8|f z2OjKQwND7VSJKijHukbweZFDDgf|+mPhKM~jql7rtB1dYK*9>u-1O;bD{D+2BQBY5 z=v=d5z0rCYR|n2%@$qI-5ao%qSw2xN;CoGKMOhvHlEeHO;U0k5cO zyM3_=jb`^C!^4Rl6llVaRaVoKwM^f7yJ1>gfZHE}NJHV@hqKv@fQOU8%Uf_1#DR~qYn8$ghPWp0yivtVp$%Z|0%Xie zw%U=mASw*;4js9G$$hsFQ7XoTd2W1lIyi6D2dF50m5~>8p`!!hl=n%cHNqWn%lQoiYlN9ruar5kW8`NZ|e8)6?`DkI@#RFvF zF3Y-Yjzp=;5F!HsQ?*dt#X7X3sCH-0m1_uOsWPDo`MKBPnk9s zux>0B?!HLa$2jj)Or3-J&xWi&TG}|M%?XfSUGF6V!7_+^e;WPC=mmtC%-u!?r%ye( zQc~AYz+r+X!W+wTG3VW6$ik;5W%r$=c>|95ybD@j{Lz7yp2GEPSJ z6XDAx^L9+Mx4@CcI(P@eWRS2cpUZv=D8Psja#UnOd6SKdbbpP}%25oh`2l?jS~-l< zwK0m`93u=<#b`=3_B*X(?18SO;-N?UjC=g#d!}oZlcZJ4hY3F+!`M9c=f10K_8fIMM554wC6AHT25${ z^FGUga_RN0p5V(@Gr;?7O?XMqc)2k0u+ffvx^-y%tZieW<^n7l{vI8C(NOLYFYm|1 zD@`{{cU|6?*pmdCnz=k!(n0V|qnb=^wL<><%+)q#Iiu?0C_y-IKzMQRyuG}+p2KFQ zzNjANkty^lE8raAG=#0B#)j|N$Kg*V6RILs^zHZF38Waqtdig#Z6w+NY>?F05iAg( z>f;sxuo0|^2t~@0MFe2O1&i%a#-Qip4|#2o%HZdhfH-TC(DSj7@j*oXp@j7LytTQ- zx>Wm-kyss)+e+aM_SpjZaA-IbXEDEv$cCPRSNx+c-YaA+O9*DMC;3OyJ<)xU8Y3SF zupT297PX`p#B|T;9x<)m>Yf+w@j#+s?e;*jZccpXm_^S@F-OZvK-&H!DmQFlp|FEe zE(OT4@Gl??Vro#ZY6F-ti0OHz_USxS2ed?QK*7TXXmN2uZ#oJ#I4F1yo83DKTF*lZ zH}u}A19!!j%uXyKBH#VBvFtKHR1ve%cJQCp{}ZtiPbd6%%J`^qm-KhT>aN=3(;1)+ zYYrWH|6?Tt2FkGRK9A^ar@NM{lax(3*8O#!nHej z`13FP-skWyqCP%d{whMkCsirD#5g8X)x`74?s!WRFk5 zXY^a&DF~A%)OOCk=OfvXZho&>Y~1>|L}w~+X4$$hhRXDya+7qnfpAlO67;wC`Hni_ zr8?c{kaRHCBM*;3T#``a(~8pH4duJ)h$l<&%SnQ^cuQHLOXPR9gYm(1_jMpsEDB0v z-P5uD=cd(cxYqE1&x7HPwIuisEq>8N^ohsLM?3iGkCjmNSjYPUS4hGpoJt zU!?Bap0QqRlxX)kvA`&y`Xm{k#*E^M)X$g^OybcdDUXG~z)4QQz^NM`4 z9oodt%$(3uOug=}H{hF+^%?s@*|VvEG6OeJ)(BK@((%Y>A9jk1k-k{rv4UG8 z{O-@8lfhpzkMF~EeI_-(>`sV@pVNHx?+ng}>Z07!N7~x;UEdR_`mRa_H~m3!1n3I# zAuKR55}^U|Jpo%8ApwC3u>ljo1a54YdbxJafwIhP*YAyrWDevVz}OJtN=|qvOypRF zBEFAimpuY#KBHC-QoHXGKbjEsc^oOWaq+bk(PgO@t$1F;yN)q`Lz`uPQq;EAmKp6v z3Du{rS^dI2T%o8`!kOPjYxmMvb9Ji<3v@4SIQhL0b5Mxylf|~}q@VTkX1(OseeS+o z>R0l??(x5??0&{And|fD>4V)k#we*}hrfoM0%bE3DAgKfB@3JvP*dUhWh%46P$WVz zgo3^?-?>OuSej_CGN(yZ8S4u}b{EgE*pX%gSjEG4(D=tGvNSbkQg?QmJM*S4s}QI=mhTJE7S z&rg)Ej^h~e$7z1p`p-Ywt=YBC#YxWz@zyTL%L&#Sw_lP5OCQ@sa=%dKQ2#_*p8RRF z;^A27rCC5jyrM<@k^ytL5F&Z92rADe{_gC-G*h7MBO>on;Em+B?&XTTuQ059oI)5Q;pbX2uR=HF2Bbej?!j5j5iXb+HQdK-BHC? z+H4yBp*{KowL&Kdr*sW9Bb8&eZ)h2Y<;eZ}c!V|pP@J*<@l&f67rpN9G@E_WeW_BV zuoDMv{>k`$V8}Yh)I_B59lh9Rw{8w7J|q3=9Rt0hbaa5W1pOGAGg#j#58wOGg&YtT zmp!m^Q-uI+p~yrNt=+I8bSOSmH#*R6eJ#y)s%@|pwk8i-sOmX zOF!YyJc)DXa?E!P^}=2{a1$R5=fb@x_P_LJP+Zcqa=F}o)v>o{7HhuJyBsMq6IO`Y zN#EG9gLoOHlYDnS|CLP!{#dKVamj3saGv!6HX9aA{&`jUMy+xb8K+qfjGwt}h1=nbzJIDo1O6F3Gcy+v?1=5}y2o>ZPZH4l474}~+ zs{`F$K{#T|@ZU_2WxcR|%Kcz6pTifpmu?@VZF03=&1SeDuLc?kDr7ytW$JP6 zP-gtJ54Ec1CW5yQi8v{{gu+n_6dbuJpbU(1ilHnFa)3dH8gt}c$$;0YnqcuChgCOR zYBjRuwfc^Md_{=-yC;~ScXD7uyy#jus1^?~Bzbs4(3)V|n4kD(Z7?bM_nAHHk}LnUBU!_w|hTD}MV{*p*lU z=zLyh9y^mcfgZDdtghd@l5+@rOnHbI*amN=O2zwH^q1c+mmW0zK@Y>MC!~on2Xy1d zwhTBU$f&WCT_9l5$1QKQf~&@a#96_Z03&#>VN|DXfJ$|ReQxm`Nf2HieHTKb!iz1~ zLilXGGetl!lreUp@PY01$j}+A&5>J*W~dWrbrflCwH$sX4Q>u4DZ-41Zlq*{sB4KvPB?g^H(m}2#2V?hX&I&3q2;RjRD?HU;ujj3k0hA z3DvDuC@~mBgy1X$B4A8R41CR&1`%v{SW6oPNILK_?FdD(;l)L76U5l;D4s9h_nRkf zwBw(h)*dk8F)OFfDtI|{%nJpF7`<0G_{@|Vo;~x96MjeHW#DeOn~n zIlgf9Vid#oX|VqneCF=ZeTgbqh=IQ&)=#~_l&za{!8|Kgk`&DomxEPxbLe(nw%Q66 zD3n1}Y;=4(7w;S%)qloI-3~1+_VX33#Kwm=v+&g;J#l*!=G+0RoNx3Q!PaNYGr%e* zh=gApSkAHOZWImpEW6=d=A3VQo9_B3cq$lp)aX%yxaam z3py%;%1+jo+qZ{5a#>=1sXpxsc3nH&1(oMB; zl3d4}S-MG9R30xJ)-e}^>qUab{ASJ=ugW8j0Jox=VoEg2E7=r4FCr9V|CMThm{KSo zE?SQ8p9|LW6=F)*Ys3ti1_BKTVv3BJSr;|XF)!V?>CIKp_t|ZYGc6yi)^N(HC4fnH zE>^i21h*2*7@PEQb2{3|cK+IRu&0`@I_2V=e`WRdpXtYNME=9Jn!0EaGh-giI+Xb< zYSpu~i0jQU%(?J;y%&Y|HNNWdNS_>;xv1-ngIyY|+F4SLw`zQh+J&(fcfWbRZQ@Ct zp#_YN^|Tw@#%t62MgdnJP}4{W!rG1MBPC?gJ-wbPY~F8XB=@7xt(osO_DD=_#ye?z zP^^nq=W#_31g|>faN_B9o?_YQ0LqbFtuxLdj?3@15}qfqp6T` zS;FE7z}+zVO`Z_$Zm>xB9PLf0)Bt6Ke2%W{8cctOzFbQjZ#iM^;J3>#o%UaWf*RAb z8V9g7$K=E5-wZe&^)i>?Mo~n+Z9h4g52WkZg!D;B9>eg$vAPM&PCjL9NH5wplG8j%KUvy5|Z0>EUJpY(Gf# zG5Ic2_AwP0?r+1@^m3%9BY8y!Lxhk2D^h~LdlTNgWxDx^`ScAqX0VE3Pk`0PQ&&?o zlZpMb?5UDh6>N*}5m6u^Or3GJ3e>#%xJQ^6nabJrJv32+eG=JDrR#129B_9YPIJ4z zGnmAx1z2`>PoM7qy4bAs@q_Zyt*<9!sf0{@cYF7AiD_{F^@f=c!dFHetL7kDujgJu zK4v<$OxY|vX4==G1b_4&Yp0+Xj}wo1n}@=8VyH3yg>$r3x$?6aFOdc~LzVXxLk7IZ z)id_1-T;(wEI+^aO_mo9M%D?Sj9kXhCArWgl%9CuAe!d}#+=PXRs|pM*R)w_FCBZ8 zlWBNX7#VXP3#N`no$hM1S4Ntx5S$Dz@5o&{XRn;!T{m72c^`4D>3GgwKvvPfAt+F1 z6K8r(SF_*kT$z~?To&UBS&sW!*g~GL+p&9ebSf2sx|4HsgnnRGBHglV>&(^?*Ep;E z`<=#^*|EoqE3l5?rLzEOlc9Asz|tJDnH8oZ7r#P$g0YpGVw{PWzG6B9rm#bsY(J?M zj^uj1XeJ3#2DmBAtcowW-V{Zw9Yah=egfWIL@lEHu%qtqL@A%e$0TJ(o@Mx5bN}sy zXBd-8o_Wj`^ZRMD-K9?wch0CZ!woJ`i}9o%=0lfoiab2CK`Z0#+3bkyJ$Z~Vt5_j{ zN<<>BTQ0@ckG*ALIGsSoF>1G%Usk3@kCNi;q@}}$!|?8KaCGeRaZ>nx1{0G*$Eavn zY;E{iSZo<mL zH+7~MRPCf^@CH6jHQ!C0VK|R}G*9F9sACuve+U`j*ESpFf%I7wFG72*lRJRafiVPx z&dsO?I#gdu@up^ubOmVHkB(aJUri>FI_%rqxza@o#nO3z)O!>8(_zeu~8 zyZ}SXB+}*T0##OS)0*bCCL311TbFgtLk83;MgMVM93 z4S{A|1S7T*83YL%Xx5F_XurZt`5_MxtL&DCryREg>(7OZWa9E<SBFH5W4xl7!=h*dw2h_1~ka z=50e#TWY{WD&WM~b&uCg1-jC!H=-}79p1zt$q^w5Y0;>>kAb)DVr++7YCzkiRM~(G zMFSOO^biaYg|~$JbgEW9NF{Ouv$4^f{~FST()LdSg*(oFhkiy&R<15X$Td&a0vs zYXUxmKSqzwQc>&^>L;yZ@%63pdu@e;yY6%m-K3%(oApQP*_y3B|O@E;Hv<{G>7>uAo zckgljH8FWQFY7Q-!FdCHxO2MPs|e-|N-s>97K4e!*QT9sB-rNvJ}E)FcLx8^HMs!X z9fUg48jVHXiDhZV3sGfhpFUtsiA!uQ(tbh+QATe?l&2{V4wA3G)n9y4xIEjHWM%u{ zIZ_=2`|Xw|CDypFNg!=tbm;kl1T3e0*)shtjvC&Rr&d>v#NAS!I|R&NtI;il9)*}K zfEn!YM}i-4Mq_oF8yxP9dIFCnhqpLB&g340!k#KztLIW|ET!w|=Z)8K?R~~;^2c$U zoMrF!dk30UOW=Ca;vvF?ZJKpNA3xDjTKn+Vc$}YKB3qk(EkCBMsqN~{^mcTrR=plh zqHL9Cu6SrBKY}MQi|D#bWtV!_VZY(=w(r*{`_Y-ur6gXTutm1gWg%Z%#ZQ&e1O`~C zD8N~w^3->>su**U<<1LAaKnSjC+3}zNbO>XGk_-Liuy67Gbs81ns5}3Y;&8EO0&PX zjs!QoI2-<7rFCOh60PN(tOeOlkvqISxycnVjoeWmd`8s;o`{b!O~xFl{@19p z8A)8t2mUE%4K>_86GCKAs;8VwpC{5=d1pmJVSdo;Nad&zQe&ODz@TgUn%GT%(rQ+A zhfNMc!pbxQ8p&j(0!}oAHc=^*px6&5Bi5tBN*2gsw%srfQw0ibA@BWALS#lXMI1*Y zG$4x!@fO%Plw;u@k$ARiqEf+UUga$g?h)B^H}_1pveV|u9#=bcso?V%0r`LkYZVo|W$VP~;P&8wn;6Yz^Gy}&q+XU&0% z7+Ej>6>;7)mj(`rJ{FN2I21;Q9HW!P8oJh|2ru>&YwR}X2?+IZ^8o%Ds)_=|$dW|? zs(Eilw%;!eLPFQ%0~V?fP~q9^Z9+(BCnMXU0$V96mWAA1zQmIUZQ>HlZRh%A1l!)q z!_r;4UYnH3OC3_sYF5K~eF_}5%fv?O)0pUZ@3>a;iSThz1JCsZC1l3IYDR}rn5DBh zbE-;sr6p@Je1FqT05^-qH`S}4pW^Z$iFGW9$g6PJQdNxal(0lbz%n#d;Ex5=bNgk& z1vf!VOIArvXIm=#5Larw9mO)ip8hcwaEMC`>dCk#7~%;}c)$lGRal2dq>RHBs8ew5 z$mcE2;SqVrgmmb{fE=qUc}hhJbdA|y+H89%{T?7j8S0Xkz6aJPG${+gC;r5lnxo1O zw?pTw+)o&(G+vU_Ya{plNX`8NF0~%{RB|{kzf|x4a`?{u2#4B7PD+@tqKrX1su}N$ z7Tos#svsX;6Wx{hk7fmdYK{!M3*fxEeZXo;ju4HO0c|c!&ivV0*kkbY#(w~;_4!Fj zI89%|3wj`XvI)1nz*y^XVP>i>J7@e7euzvvYlh+u{!It(!%v!W8i+NR*8^Hi;!_9DSMecZ8DEBMER;#ml^@N)jJ zbSk?Xi2^->4e%}U{^!J_LZ*mP3igN&uBGfAs(pmIi2x@JjC7C3P~#O^1>jB2U=M7b z*Q!O8ikR1_{}$=~;>8nfzZPt=OaJo^i}M8o+I6`RNWS!+#DW8E=K=AYFW|x5et4_8 zEj8S_dq;QTc{(0*lUBpki$S)G)R5sM_`d3_PAZ{%n&Ewc{7ezXO^cWyw9oyGzIy?#PPtJVK>sI32VC~4_Z zc0>;&)r&~d8!LcT0y#UtUB3@qWeEM>Sx<$?PWqHrn21Ce-u?}9?zP{MFHlz37R_hI zp{xAY`1U$ypg;qo4Mal2Lm`X!-?S*w`f=YLc;z1JK)zl2r?U;FrgAQtT=CuS6q+IN zvtB1ZwfM1XQxZ?+*QL}=ev=ftJKI;@K@%MUMbPgi4}t2tn7kOWX)B20*?d3+h(4A7!&OoBtv*N%Xk%oS@wqgG*|!brdmFN=Ln_zJt5<{3;|d!cbowx+$LZT z-Afuz{d5JmGN_P-Lr1-xT#hJ79#2Cg2KH1X76r~tl}&)+B)koHcS{K<5;?4ffE?Ij zqzC+I5DZe`>P!B>3kH7+M(+7FDc`tbk~<@8d(H%$Tg2WdNANng?Z(+Y+n2obJa#Jg zS~zK1Rz5M)3+MXdVilGQdqKyd?kX*s*;c@>iBQh-W1*|rLe9pw;Q}h?KmDJj_jmk` z1*#J{;>LHMuz!*y8U*Cy$||Zc$+{v%tFi2Af^(upG{xc#nxBjwUWm&|$aVFD_WB{j4 zK;wm@DX!Fpy6g*Gc}rJF^KVWCjSnOo7ItQ8fdb^LO?wtV15f$%mWZ-{i&=Vrd1Zl{ zr?V;HkH~holUWPlIcT48f{T_BLwPv`=ax2R}* zLi(&=e0Zn^WGr}<_u{TZgah_SYIvx&QvJY{P+F}CTh$g2>8mnRj3uWu)ZG}{i==J6 zp8x`N)m;HMd-(@*S5KF)+porzDAZ^7IEM?W4Qod0WmjG(uK|5ae?34WH_0Yj-hF9V zknK&|SF?g7TyTKlV*%ILaV`*G>L-){z!0K}1Vzb`MFM~Uji{78tVVC>NSss^9$q;W zeBc^WMWl9BBq6Bm#v4`J2mDj}hbn<=`uhnk(-Cq?Bi)0s;t=yzY#@I?1<%s5f*bj8 z{%ou#DA`SCqi*Z>L2vVZ5Uc+L?{eKv=)#1VByV`uYw zJ~Z-t>Dn{oilA|VkTiv(HFIR!py(fFpmLOm0fA&ic@Yaoz z$4-h#!-ps~l%=^44x@jhouTf`6h)^-qA0{{i3B{(L!^OQC3G~|#7ulgmD3%#RRqYq zB(AN&yuN~ZpP8st6`bD%mg#^aVR zaeZA$`LE_vk|5YY{N-LdB1u=mAoEzA(Kk>N$uc7{g_2Wg;VIO7WUBjv1BrGBX-y(V{RA+Kg8HoQH=( zCi*VFC3536O5bal%a|4&d7ITSIeo<~CkEj7#36jm(CArdmM3Q}K7D0so19TV^OwwQE1}ImMbHhKIO|Fhn zX=H9HTf?3~i*yhGT=59|FeEFY9b~CXrgqZLT1f@ZeDj-~BNcL;Ax+$-rO+z2(lhXJ z(i9S{Y z^vcp$cl_#_J9`Bv;7D|R!~c0@vz@(q7$ziCrnB%E;+zKpZf~q}BXcv^7WND#q{ANI znxw_Bi6b2d*bIwDI+c5@$&H4lhT{go2!LGF<)@vaDg zT4cCLfJ(KWe#aj^D+W>XS?0(6bxmUdafEUk0xEHH%TDfa9)ecgh#3^mHhTEl;>efC zJ%h9`Z)a$BX?*U`$L%1`D1!5mPnlb67j|oPlRb|EY4W@g7qX3CRLZHTU0kXR#PD2$ z81h30`W$MK#nCdDhy~FW`YM98H2)MeccO1iN5xv@>cp_B#{M2yP8Y^_kQy{6F`X60 z^bx1;KIfuCTyK@_XFSc^Uaho6Y-#naOeOnRv6wWw>HD<8#ZtvC3RGiqBa7iK(+^CQ z+M*;H5b0zL*VrAC)Z49ZhJpn{*8_H2-lZ5TR9uOuFq3urip36sZlF`(SSy^l30Uy+ z=iAMp3Fd02LBlAQ`#>k9>=j)^4##+HrEn)QYQCXBM-kY{WCmg^FDz5>Mr>A~WWp?j zNFG}L8vY-udoZOR6lGE>!f(!|7p;bqc{ED0&NlCW@(!7pvEsjfhwvQ&1x7|7QxSxEKz9QuPL``MuB; zIBXwUo4LmqXW-i5er}2&m0yKay7lcLX;NZYW3%&j!of2ze@m(2jDT!~*D=P|DNw?C z?p-!KA%VfLGqN|6En&xjXm#@gnlBy%;sd!ME*c|o?Jp6k@n^j&C^87BsT7GNgsD^k zz8LbEQjd9o+gDj|v1R0j&&D(;=|A+Maaphj7X~S)nq#P+2Vn`$ftPs^1kq}jB4RSm znb-&Ht5By<;dMVMN`fGRl|ZwGfYtC6{VrS3tgZSWtdmBtbpM(I245b`vg*vKz}e`?Z21Gm$y0yOqw=7^fP> zK)n=uwnTQZ{ZVOl3SM?UfiRwLd~Gm$dK_%_ zUhG5zFLqoGDlfUK6gkhY-|!2AxZf28uQ2ZVlrU$s4Qr`{?U1Z4uv|x&T%~ezlFX8C zG+|cvWbiuK=;bSO`->a0_ZONpogs?nt(Htc&F&^mL>#|iwN>SY_6acwMOK7wM38_< zK)~>ZXWG(O<5q+XtstZB>@o>uB2HV&G=f8{)Wm@R_gWChB$S;ZsmNhLR*V!xBn%2_ z0V<5jCgfkqAYQ^sIh1-mg!A8;B*xwyKLu)dQR=_JfcnCKW(Nmt*@mIiQ#Umhui+wq z`tm9Ptt1Tz+N~)GB{OaNgy8IMjGsu*S8TR1^}Lmh{@o7N*YYcuXvhKP5>Fx;>e>zM zS0uIkIDyWstd^ixP@tCJ?0AV6AfS)7jYSAcY8q@K&XsI8{2o_qbW*hfT4a7q9KJ18qU3OndH47eqj(3V4F(=INe zyhjk|TMKJJ{Q(|}@oG>FEkZc~kK24C=vQ@s0}Q;fv*0(5%34Jw1nApveXS8BSb9d) z`0P(`Q0Ooe=O7dncnAs|Ub9)^-Y>xdVA+3|qAz%AD4EZS1)SjE`OY3Qa}tE`XCaig zp1W}`%P1VM5Afq8$)XgYGEl_4xKmI-iIP=NT!KZa(1Bz-l2D7m_R_HeSDtA} za$E_vNb@-uHsDdEOX&}B)SzVHp@H%Wr8BPY(pPj`B4FWRfCv?b2t^DM-H4Yc4`@gN zmcorWc&1!VR_SM<`Faj+@HSzc%9Tz3BlUYg3 zSVLF=k0)>{dF{JQ_^^btb{NN(MdyEt<4K1VyZk6tg|`88;{Vw9>|qc7=`qR->NaIn zJS!C7{ZAbWg_8OIDF1Qz+hb!><)ip)>)s&f*-30eTLviNNlxBe>;$ z2Syt{hbxM4JR~9u0LBulK7PUpnz50If9?i2dX@7^!l}W;bx?!j)P;{-GL@===9Qw{ z+MuDkd_H_4en$+XP={Cwe(3FK5Xu8QZ;qz;S0jC~n$IOsErC~)mI+ak3>j)%Bwfp4 zc9)oTQi|r%PS>u$WO?uBE2UVTk<@XdC)Sn_&F^*C@<}#H;7(4Gi7iLWFb!>c6l zdxDnuUIAJkH;;oDpPl->J1r72k@A#DgC~G07%`5wfbHNmKmx+c-dXP4ej^5teyZ#5R#$j=M{dQv#ptQ0C!#~cjHt4_*M`XIc1D@GKPmu zfw@?T2%lC|yeN(QPtv0P`Fylw%)dP2_9Z;@-$ndT-6k2X<36$Se_Kp0-nJq|Gxv<~ z4Q?QQ-wTmcV!BZT+ameKE4h`tP05px|I7E$6vk5G=1}?VkDW_(C#6rZn zanA)i-R>ZqD<`j++jXHqB(lR$#LpX2cIL4`J%8NZz^DC&eNjD2Yhb%Q4)Pjrt*{=X z)Ly^h;1E8MDK3_F_yfybfk)JD{^F6zh5p#~_xau)uMF|xKq!W!hM}h_6;y{H6 z79ADg_em)|j)@h}_a?hP!obrx*V}mWP5oY(7YP_VKSyx01z!51h||LH>6JI=vnb9&Q!-e!XPaH!tpgB$5#!Si*2|N-BY^frKdX|C=_jrf> zh;EYH2I8l7lJTrrs4ouMKkYGb#$l;9n7G^`vP@EogOj|6Y5!GMtP{WBM_NgkXpz*x zOuzg$zS<%)sl31Ap=pEmK^6dPHV94X7X={8_kDs*EH&AgcO za{b5fZ^Pvzv_dp~xFNKscIpgBQD!+gKYD%x1`^oUazTh}2M(D*4tecZ%q%#T{=>_Q zc&BR>Gzcn(IUm`7HU@6}zQw`dQ{e9XApkos@_|YbA{kpyZ;~3QgWxgnQ)q8vZ~+$l z=y?=#Xn}gYZ0Ikn0-cUH^K&nFLKL`51yH<6Zbitw3V>Lp4_uR9Hm$(84QK0nl}JC( zrrw5b1;FMhxJMK?E?7tx$9fTXGd+2_{C=AHjQz7FO=CVdgnyeH5a#S5-Fir{-XpKX zHBVQTI(pj%-u(>se(iT|=dS@++VHn|B0H%$`=zj^e!X83G(CPf!N3Kt130LO63G>Zu4KylTmYopjUR1Am-G&)>WX1U10y}3BdgEwc>B~NMZySWJ922 zLsY1HN$dl`QxnOyRxIQM2VU=ApaLd$$le?z1nU6JwlDbYmw$2|(iIQdH^>sE06_CrxaBYs}70^rk#ZrGDTqy9j2(2x(&Ud|@lqA0tUyEp-g;^`R z3gP(Ev&Q12g0KmtX>9mEP>{t*8|E$?=8j{q%hM2LY9}q$-wM|&W)@{DHdmI%mxMiT zJLu?nA9)n%C7kVCzVcUpqEqJn1#l}+9ISIl(mOIOjp$d8=`%!V_$1;67jd~i7E(aR zPA&NKcFe|{2q||=2_Aua44<>?&QNrbB_b#5iU`S6fxeL3ioS{pt$+|uNm+5wt%4F0 zEFFD8ot;pN{g%?_0@sZxN%H@CBIjU)fKZ3yy8kw}MDD;@Tj4oebIb&|d>~W#z*$2E zNm>TUQx=K1R_g~50Y5Lncr|lHJXFe{suFu*4OoQ}50mTjZt}+vq6|IP0ozj);(8>a z3pn~mzw8iC6wkStGa9QB+1510p1rk{cru~!psIsC4e-F*YjbJa!Qs{pWXoqc`o8Sgif z(7ohktI!g&#_*K_AA6wr@Fjqc%|UQ!4?x-&haU3DX|@;KdvgJp-n8ZP>qGPvKb8rY ztg&51@jD7EnV$c+5>|skd}LQMjd2?cBg)BD*x1L)UUJ}Itno660bM>s7@cp5if)hP zh($;50DR#(t~8Yv8i^~tg}keT9y#$=3j$Es7me5Ck=`U5|V zUgxZw(oW|*Ev5$FZb@1LrQd|I%ur0M-&7BZkr~%!ozno0u~Hic_LVw;O-dOn7K$9o zWX4EgMAD$B7NF7qLk{N;FuRl<57s2RZ>0V}n04EJl-Q$0dU{TB`bXh)#R%R?X_+cV zZBf*C`>Rcw*7dqP|D^SL>T`tG?awF_nFkhuyxzEfP8| z>m(8}OkMM>KonH9nunr5?2=pZxR}yYxX>&2yMZ?fVjOufI-A>9t#F2!21u;~Hzsi+Ap!tV!>eL~T zzYzQT&rs;jFt7R;FBNX0E&}vsZbP5>v(WbK1{GYh6#27)ev$g@{l_m)fU?0MN6hqs zuvdaz!;j-su9*xT&~Ba_a9yPT1imu5azzR{gedzA4NHR72i&`0kr2+@5G?rL=dI14 zA%IZ|&BLfNr1vJ@Wl>H@+5TwWZH_t`|U8xh)QSbQY!u=qi8i__kCS)@AlQRH}3X zzq3Qnt=zCT@$4b#j8po-55xlGj-^DoI<8@wGHuSdYkBtO?kk}Dy9qAF*x2VX6*btH zxeDS_t_tmW(q95Sxc@#>MX+0KXo%WALtFu=f1IENUV9gD4wy%-y;}ykn+!ML*jNF* zJ72a804~cozyiFXG&A2-1bB?^#E&ATW?_zi%erUl-C$Cq1S~U;xWCgq*8vm0yk!Ca zH_cEW_)y^VelPj#89q=_t-=q=tXDL?YF4Ws)#AaT-zY6Ns13hW5KZ{OA;5)D*hy(i zN`7S=HrH8^popxg>x302jmg8oL-%={S}WOrO8y{JCm{2XdX9XFLLz|SMzLT=;%fT+-N*-X zo$6EG56_pyR4aS5c)N90YHu0jW>QL@V_^mK27i(2>*taLSeVt9M&`RR0Dta{_+G@& zEX*G8=i-qDwD4{hWR48>BUFvZ(rz`u=H<_%tu_|t~{ z?!y1c%(w85o*#g?FX{;-nvrqT$G8-9GZo(sOIzKN@T<9%2lU`v7QkwoOmp2-`)~IG z(wh}afRgt@_q?PD>7QWW|2DaT06`ACqcS35!LBJ}?rzChKwp==aVr+Lo?wA9U=5M{ z!RJ9_;?4!vWMCCdWyy8VRcHmTRrf%;+_H#=I75P?^yXmI#;@B=(gD0!#D8;I1a=dA z;tU9*G0WpccJgm`|GHwm0!ze#zu5baSrz#U7ImBtrW=ym^7Jwix#%MYKo6S49gr;U z*cE>OXvQzBae0k|V5XYl`}k5ov^$tOQT`FbpCy(P_hg;Z1m4b5jff3&xFFb*QbCIS zl7})mF;eZ3Ks~D>RA<#qNX>|t7yoiO1sCn9k8sUQQ(%POsOD90(HO&!9>Zv1A1-%d z`LK~R?wcPRPMTUup0HxkCpi3i(V6hrDb}nzSf)u1l}l4{T-i`nBJ>MTMbL~U*-bZ!JiS0rK-pGuoZGu}T z5t{1LiGs$#xQ2%Ci0lqI2X+DVwif2Bpu1c&vbn$f6?Zx!T=rhvL_e?s_}>Sm$i2QQ zfCKnlfePJU2O8{#Y$YhznoPsq5J&6)GDU&m?|#`aw*&sehsr{P zw!vuzhq76=O#Jd^i5B2Pr8vc|1w<`n_T3PxWC$(_6T#8utD!WprFDw`DZf^$y4%@L z>FQo-1Xt77|ClYHNKOWY{W;whEt!x`gQ~MKd?!9FsVk9wQLP0)3iKsG8w=3|_M}an zD8zck6N^#M^4baMeI)C*p92X|R0R#Sp8`GoFN@g_$DmK7`+xlqO)OdB;W?3ZLRJ@Y z^S5h26LY@Z^!_g&N@n|i_)t1z3`=Yuoxuodn~*kUiNDcFN@f#-!aXo?bbz=$-wr9( z9(!O6$RcNCxwSxxh{ct{4TMJ=m{;!FQX5!VO#W@f5@CP*{QQ-7k~&r3nn&&;lE+Dq z38F-@nq5=EY(n<2(Fcvd>pG0(A^@*o<&b!nCdfH?Lt{t#I&Q>n`HMxv|5sSNFy=r! zR8)&Y(Q1XoDwL-^<7(Rww!TsedjZsf ze&#(&(+ZcR(lX$WyOQK3zaBp5Rz4j%Qx8CX7W8J<)Q!wu5NPFH&}kW}v8H1TEU!0{ z8(1puRr1r+WoCWhd_wY@9)FH`Ht&I<$e}etLPH087;Lv!kT44->}&UM!1+pualUcM z*}{#`N>}M~4DkGLf!U7@aslFFwpjHGJ&ir*OH;$8+JW7#gxHaoI)c2d^QOzFRa;Lk zhW=@!u+XSu(&l=fjc`66aPa}BED?=ZNI=}?jTemid>3WQC`v+}MSFvgtmj%TTZ}zb z6qN(zDMPhcNzc#}>~h(8TSUu12gTp{atE`^o0f zV0xs1uPZ5P>WnN}3lrmz)#<;4H&BJ1gQu*l2G?H~EY`r1b5e;(Ta`AqRDr&+?G-QF z0)p!op3_x=S+j!N7t4bm()4k;DFSB%OohDl3x6k6ca@zZVO8(4vnS=2MWA^k`SS~ISM=Z3-G>sv4M9Y z?v&;4N))+WAHyKIkq0~Bf^NUh0t_^&+ngO3tkt!d9Jorbn;oIvga330;y34h=y)!6 z^1A7YKTQ!K@^9`opKoo&mV=aZCPtK5p`1MCQHU)Jb{!aeSaDp9L=*RUZBS5*T=!>z z&mJ6R-_GqM6Pz@U9iQ7gKFhdn5Xl9c+*^Ee?@TuOo!felVPfPFCult>H+L0he*0Qe zdqLN^i8mg-b+x9Jbh8Q3`*30M?Qz|h#kkGR|NTC#%m3DPLrv(SiIl5$GKBR7=4N5_zp}E{Y#IE`v4?GNiIb`U} z@IUlHjAmXVRNM zqzHuq?uCqK@^g6w?#up+ zxf)I#FFISh?7*if=A4B2p7((dxXA5~+fm5=Zq9w-#ORvRI!gUgwCY6-)=^$X6=S?+~@^*C$XLo!*5T9bF9kwHHEe-X^cG#SgT})gipy z9|2##6u>5UasJJ&SUu=@pr=oRy~Tdx#YXI82nyUeI3oH(rO<(4!_Q1TUO8@ zvzql&t4a0e7q1u4(=b|hz)u(w9GEYHnm-55!j`t+n{4>W;l0|_yjX&*tBn3~eBe%2 zzHXbKdyt^+6UwytNdIB`l-x_%yCTT{0{?!?;HFGd{gk!gv~Ewm<%28aFExct7vf@) zXM+STwkm$%V;SJgS@-Ujvd%$TfYF-_D0i~D@|#$?55sQwo{;i9w8FNZ(l)zjO*o`8 z8^Q@|bYi1$TF^PuO$SKxu-s+HX`)VWcLICQ8@^qDrGC1NFjI%i9Bhzn0V-Osd_(Y; z-@lAmzX^`R4x9WoLohL3<9AsXiK!;9%j~HCspkXA?}j)}>oB$ZjhWVTKeF`7ywy3g zQ;(;22J3vdO(;sG`w;TPUuJ!5+UZ+U=ivp`&r%DV&y5#2Me4hiz$d?xWND;qf*(%+ zG@o<|$KvQDA7dXv{DhZdd%VWA6N@#4O0XRqpM*75b3ZU`Kn3IoBfEvG_ySOnK%Io8 zr50G+*!V5v9%#571R1fls27SKFfn7M%9kU*wezPpDWtUaIh=s>Gw}5;P&zQ+^-t4@ z@{x@_j%4Y2woA#8WOKFE`o|&O$m#K_SpTfD`e>d-UdXKfI7R{_pYrKxF~dc&HA+sL zh0}IjPMaJ=c@nm3Sp#wOTK#$|bjk+1qfwgjfe^gkz`vqj`AA!v4b(LUdlcVOJUmUA z)n;V-K8<|nZ>{$74Wxw=mbm@z5T7Yr{a;n8NOov$m6D{<_=*$oBko=H6NQd=C=3C` zr)`y)0eot*o8;UICRPj3F1xZazvDgDyYH<2H2aUVqS5LtjkFSz*cb|)KnG%GDR7$+ zE{x@lw_#mC1-7o}Jumlu41YZPSLyaR&Y*<9a-CwSoaXWFX86dN z$V;zIg}zkN*wO)M1)K%;K^po3aN8suMxFH3xX6Ski9>$>xNL{$o&LMTJD z$R4@aE$8^!6=8tp0-<@BZ$nO_unegzuI#3>h2rFHD5!;bgZ@>Hq2(*m;g8VTIVl;c zK<;hk!)J4U6z`vyM!T@G`1h&}el z8Pbfu<3#Jt&*%WA*_6^@EWSB1&=ZOlep$-nrjm|?B6y^IuBA(RC1{J@RgyPM3Y4() z{kI)9kzFuPg(4%F=TQ6Hs7amxw5TMIoBe;YpZDKxnQsiU^R;JrdP1I3L+8qx2m-G`Tb_)@b$~;N!xT|J>sq{cz+KcwzBF31Po;ESte@XEDr-8TbF7m(}kof|CR#$DRtb_z6_q8J~H(8NLT7 zMpkkB%^6DmxD>^e_1WZZq6An99_qfv9+XRlDAfp~%zWxYeESd?q!}ZpWF}$va69tz z=%FZ<2t=*T<}p&zaRoy>ABa$hu6W8a2=Kf3k|@OL z1*QLwSHsd@$zRQti=|l26;nwi{US)tsM3(bgw1{gsRKOGukng`t|`>8Yw`01Xk*^KR+kizd##n&V~ z$Go%vcp&rKgC9hk5>kVRk{-<&CXxG4Ag6s}`|~+ZNw`Il_LS zW$MLP(YsTg64Lbselx`75-c^tx8(GL;#80#9vnK>^)!pcc@vu7jvzv^o7LN@T9zbT zzO9nA#yUS+;jDkQ*gPs~nB!l79XY;-t~+&)siC{AYapHnS?Y9=P;!1hJ;;{?lq6<9{bge1pTwFR6;6lkr zIZ1I#;oQdi?j&*QzcYUKKGNDitcX$S(TGlStVmUG!SdUeOdJWCuhVoyo3U#aW$~p` zMISYopnvCiF9WyEt+zmX$n{vJv$0E>c=Gybn+AtpY!Hijf4P(txAyt(!TvVpJ8$QH z6)Euv3K*lM{=`Hm?7FElPj8kDk=oz27TG`U@8oPYt%ne@8GI^wRFK7oRkp*lpw_*J ztN+r8Opfa%j#S2AIlj?>#*0Z z9X4UOV`dXPP)QSD;x4aHSninqawCypL#O+>wFZOL8D;fbU?4Ri)G_LwQ~Xx8)B80$ zOD~O`{q#n$>D30;X?!Z(dF#FL1C3faqbklKU``~n?mQb0SdFAwid*zfcWuI0z#pB;q=>b}!B-mUB$G-k; zhQ=_iT?c_WT0H(Js}1(@?B(Gr|LuE#p%M1z0}^P1WvBF;SasHx$6$<>4OGqQX`;@e zZ4CFN+0_Rnrc|y_FJqbw@|pzSFCX2EpxBnGfz+D~_%@lwnkb568fmj^PnjF#G}h_8 zEB)cWly+0JQ%!yd^r;cjF|W%wMi=BgAhlsP!=yvlu0)M>GUBH7IQAMyTs>TC&&R!W zBWs^EoGpwDbjAQ31a7#B13O_stA zxhreL)^^N(igBE`n4Xq%%VgX^@Dk_#F=c(Fg>fV{=fEk1-P$!r?A9r;=D+A$MdhDa zeyup=>-~V^(usV$vGIBbCmby7S&J+;vQbI3rEJGJ$6V~}1d;7UXL8gdD~;FUhe_mYU|Q z>`11YrnQDn-HQ}1eJKO+Z`QNA4IBEHw~^|K--($60$l>(H6k|*MZYaEGo7L|OflO9 z;(G?6h`vY{Ma7ie)e}6kMR>?0vH6RMs3Ip9tS0YA-2nFFJu_V?x~zC&a+m7g@cJ4J zNBY0MAtPKFoqc30`juQ6(Sis5oLOOyAvH&(e>G~V!R>jn?N;!t!w%&oHR`GC1?W9F z)Xj&+9&eqWNm|P}`3h2L3FYciv=Li>-u74)1;iH=ZWtuAlt*+}P(<)ixv~6Vju_>m zpnz>ca?_SE7Q&Pcr$}~owk``Dtr+r{cY`wavTM|f4L5e25DA5TvXx(~42 z12`zIr8NAZ&B{EDg1_Kw&AfK0#)^f%@CUrVd4=Y5Oleus(HvN4qtfu9}7w;Ii_a$Z8>~;aCX@l(+WEqTJlb3p(k_f99)6J;V$zHJ{l8kXggDiT5$k`G zJJb)vdL`~v%~eSlY3Zjb*_1CqvHHCY-gJKjWIG?ExYRrQwN@0;Y)e~>M}@Mhss)Xk z(i~eU9?UfEN>)^>)*B}NzA5m568=bVLnJan6Fn#}%Utzh6LpuqCit3WB96~MzYpi0 z?ij0IgXsm!?2R}<;sjFk7|T<(e3k5s={ey!NS3{Moi**Q#L?`L)Te$qk^Iq(b^j3&nqGsDidN<=VD_0Cm5 z_*=Lhf@S9-8{W`Ojd=_ z48dXz=R${XsQW%KGvPqs!Ro5eWns!TNvrtm0MwfS;?tKCD1LgEt`q>j?q2{$i}iVv z<*&Eo89~ald@Mv|qju606E{6-x)zl6qnu?vbG+O4X1HnwRaF_;R%Inbn+zx9Rwok~ zc+~~u<)76lfA20J2s(||;s+i^myqn&^N~Kc{fIj4#&05`cVvC4bgV}ir-txf_6;m9A9+uhEV;E(Obakh#-{q&tI!wop)X#i?ci1 z%LICx;UeXhB^a#^+qbQeZwQd5l~}w%c0gVxX2o#vt4Mw6Dpm8$+jHiHwZk;cqFCN* z-|ySTnB4%6?w|W$AmF|PDpO_eBwm8>ph<7Tc5r;pI)q4>x(7w`T2QJ;bI&Sf{C-uC z?S=ht=u1oe)3IaR;RJtsFcxgdY=bMVSQU^P-d0jCza{LJ?F`ToPzy22DF7aDaYgMI99)dd zN>!e=tkl9S^#nfRhte2J$2vOFk_yz%k=?NU);#uQOT4H!0=jv|6qB(AFdcz7wUWZkX4BqyT3OLDE7 z9AmfPHqK$MC;YM##4gk|?GIQ2tv1H8~ z46XULGb96jm`_pta~7<%CF5G*%=pu^;?dqCH98BfcoVuj{bnG$_83LL=~b(273X7f z16H;fII2oxhXG>yC0LVU*j^uY+i=bakZ)a(+G&HDz`uE4+Su=F(pHyYKkrlY$iO7- zr|Rn_OZ^=*uwy)3`dJN~(A3&t&oXk`^3UtgD4WA>1f&a6R_^Xfzfb3Y1ITF$Hs2iw zi3PVzSE>SKC$b2JY`!h0@AW|0`a50XN9sgeqzFJ{gJL(JX??w{dX_bB6R3FM0C9iH zvspCkG~e)v1#q#&%zwLZS6{y$#MPRaCYva6Z<`v|D@E7Dr~hl?{>B(Nb#4sjL->xx z*V~@HIXQQLKf0~UUzHopR-K;?O77cs-tn;8xJ8f>9^}#(OU&dAyIO}Q(xBo4DZ-H2 zZl zrszPsz_0|Iyw6v#3ywEGqv!toKRo<<#~j-}&~tK6%T3`ccZTA`V_kXzwWu(OGrDyWj_l)KvE5^rPN4UOo$v*cq_J@--k@D$U#0x{ zk$3?$4llRU{zNJsaHQ)G6osqJFmdMJ$b*{K$9HZxRb58g0ud2Hy|F7NFEN^3r>CoW zNYb+(u+FLV%{u_gtIZtd91z>*oT%c1RKRo2>B6_UxWn<&&$rK^aYO)me^ZLE9(CW; zk1`hXHxId)mlse&$U?XNKh&(bkQsx@-nSPiDiEog-FEeaiRQe?krm{&nx zp%!8?*4px8VMmhNb%#hlB*!-sC?^&k=9~Jz)2RB#y;JSKak0*8_Va8BvYI#ryEBLeTM*>bfz7dqQluj9%r)!4=C)b=-5vNY8BS) zApEeN%R6ExnUs$^Y7e~FeTLntW9*#Cw7p9(ePaCstL>m9!M0D+d9BB6z*$gJ zyP5aDfj}$dD}L&(Szp@4wNEheL~aEkTB1K*9)FjQ$Cnw|H0JbKlpAVBzs6oJ{ctei zk7qi{BIRY1*^y#OXs#Nwh>9MI`{sjuR5f&zNHc(GUOQGvYjWFcNO?R)aLlvQm^HZ3 z!*%{z&H)^d>D$x1Q2{0j@Wu}a_XJAuaiIQR8V1}FJ)2TRhs;f4L6hzcKj1Q0h9s`& zz|`5f*iy;3kK>26zAF|2!-v>R^x7JbhhfSq|NrC=oR0+zrE(co{Zr*q_DHWB<{NdZeOlLGf2oZaiC2E& z#wluV$f>+`%^96IJNagnc}@LovWIBJGNr`HN!;(sA&R(dp&K(gRrCn1-2F8>vSjn$ z=sm@@wD>jAsofI7j0ZAgVtlc3lY0`qCwE3I)<$yy3WXT7kEOGqW)C;{${KdCWOlNN zNP|ntu0{7Jo9u67uI3|YULE;d%2e=UO~E`4?7upDjpvzg9TF~vUl9n0c|>9dBus-Vr5n>O9Ak*(9qu0Lh9-{&z@n9|-_)&ir%|sI_g(ki6z(S`QjfhX*IQZg7Tn*c)_qO9EGMC2ef z|8XC=uIN`;I=XiL=1UIXZNb-Bb_zC27^FMsP++?hNt16H?owTEQD_)VCK^H3!fY%C zCdpiGI7=Z!p;JoMi zO{L?~Nv<)i-;D^A&Gk1;@B2QD-L1dN8ahl)90{MGVEQOyCr^k8ob<;7_a@<)4dBbMlH=3#IqQ_|@0N)Y+`t zHg(*1@w#nRmjT36o(K1{IqQ!9s@c19SK4Mk*j_T*VV_47<7U9vTDY-%E}uOeGXoNz zrGG+a<766_=xtLl?Jov5Fkm&`-Hr>RKWR5 zE#J8_Zx#!}bk3|SOJS2ongovCaDK(uH(+==<9^ImKi$1)PvO^1ZTX-2RsYlDW@QuJ z?c!_ZWI9NrOd=5qw|+mhW}0iF?tCreR@G*Y&&Ls$oF$!Os4m&I<+FUmi0Sof}ochKgGU+J4IpP!Glo*fPp z9f8W4Tc9QKru?XqV1R!H{AFp&o;@wI(Tu*rJn=|mq_C)xjW7#_n>2M^T*J`yBi{wz0kZDwicsv^x z1Uzn;tqDfWA{}lc^#~vk!h~xeOTO85=wv;);)g?mN|ELj2!zA>JS`hT)g|EHDUF?) zwB#mc)AA+Viwf+K+O@{$6s;`K6fl;z`8K;$72?mc8FJwR=US|mgHBy7>(<0r)@l1QVR<&vj~i4%pJ^>_dFT8ApX4>ZX^NVdeQ1@RYw6y3$B(+rRnp+ti|!-fO7SwYmXT1@ne#4VntG1nJGwZv+Y z{u>roNQNHI8drM%+RfxY-}dEkjw)Xul%#@%mt<@?X@6UYe~U>*Zeqe!1J2l?kS&7M z{{vQ+1B)Q1(`QV1lO&~rQB=GKSfh}+X*gkgVpe#8I9O|{SiqhlRDMX$u{U^aE;J`r zW)+~OUWJ6hbnh>2X7$Gg9J39pDxyE{VUWb&RV(8%+{D?>{C310q}oOMJSeW_&v|M; zFvFU46zWhh1OK9=1kznH|*k2j5ve`jf*H#xK2 z^8f`$BK5k7q({AAqFkw1&ds;_Sj-YHR$((yVG#C*T6I0?3jGH-eP0(g!^8iad0GDi zFh|ZaTFZEBERsrNOT2=BXWotw17}6>se__Q2yt}71r$cmbRaAcZ1op}gTJyWrJ~30 zKH-j#lrTo29rc4!>42X>`bN)m@FlDq2mEl6Xl`k%$q_xoDp==9FznulAAx6EuO>Hd zg*B2ny&JhOW32Ne@3~Piy_idaMs%}m+CF6y4D^Bl;Q}$T;=$5&m8Zy&)4FO(5siK&DkpkVbCbmbUajjG-ug9n?*PPAB%3}u0Lm~m$zDXT+zyP zDv5QOX0Dxh`DU5z+z=_DV+rraA3F#l*tszv=eySSq3BEmc{ggmlFXbIUv|GHp2W>! zs{!rxJZJ!zT}k-KnkD?fhG;b~y$DC$oFsM@sjAy4_Bp*ZrOEB~WV5f;EKkXBW4olz z<~EU)X4$)<*RlP`rp5@}X|i^!=k#Q;xYPwnoz?2)X+gN8=)+r*l+5pT5-C2G?wSl6 z>ood?#-Jow%^5Uug*fG*tUY97`*$mU18CTXOEZ3xdl!q@`M~d}c$^ z64PeoN-i4IfH`G*r#!a}$`gERw{)sPmQRna(*#7Q78!#Vd#91zlkNmA3T5^HVS+XI zkTTRH6`axE(~rtGvnneJKa>%(?DRqH^=y0!e-HC4IHi1=McgER>*Hhx7Y{At@lvk~ zB^^&~D>UAon?_zZ9a@HzUpBp=4TaPNF5=oD8tcq;M5@s@44LGdy_|K(cB;~aTaaE@ z2A!i@_DsmA7Tix;pWBT_#i=lQ35>)uxZtR7RCQeL2^UXGEglb~PQ2F2d^Xbn*JFh+ ze+!G-1VWzR9s7G2v5^;CPZn5jYE8sx7@xCAw%bRfqm8(|jM3n_>{`A^6YpxP>x2-7 zUH8{SajXu)cL=|C7Tm285RU*vgYG;ObBfpzb^j6e8{`Aw++2fEmydEwG5hS`v0t1#Fy4-wsLuFbpuSE;;x%U(C;l0W}U)G zQU6q*iu6pOE6Y8x&B#)_4zyaqNwYW<3B2~&6VA#-!K_3^$D*iKOvw;jwGDu#&CBrF z(%bK{Kvs+5ieX2SK#?n^rgT@w<>WAR5DnRtT`NcE+IP;KQcvCV*C56S*)k(=M1Ac> zW}Nmgmr)a;S47h4i!X|W2bMKBCsWe%feLYNT2UqIpLM%$##DB_=A~q8VoWHZi$9Zj z^K5_Pc~Entqx2OjQb@?eh|N2MNT>Xzc#DT`t{>US8>{2vu{;h#S+w#a*V!npM(Zf! zHo27FEpl{lp+LCo*@PVj_ufx}K4Pwv?`lvMt&C6gVYJ81&MnO-Cbtlx1~4C9Ul<=W zs;9r%ecslO%wCGP;e{EZi}Q8F9K+f57bva1XV_Znq}l5M`c3Le;sj-;q4TLk^tJM& z^U$|Min1Wr08yPwB!LE7m)`TiO>wz7BsGNL&QWuO5}Ns6oz%r_!@B85g$@cK5gbyI zvm2JGhHOPQGJEcV*j!x@U*_&izVV$coIH#kM90^`lVlB{7okHSi<_~e4fd1{K;+tJ zw3YJn4_K=hOTIsIZ9;__uU58=3|j)8W>e8PJ}=sS(wkBIv{PjB#j=J$zSP#8aIUtz zEu&6hY_|i#$*d<}o~9mrCW;_Y;q2RmMp0_LEdgAP&x$DyMVSMy2ec-43S0$>ahx`k zWdp(FuS$lfU5dYRss$1?s+#|p`twPtN_JaBG2lN~@mUf!lEspuBE!VK+koLiW+{j^7v3yAy($k4YS9kT$ zcsKWKkXOVmN?R}O8EtVZ@s;-x`Nt-)$8EfB?GM+64IPwf`~AEf<8rWj(xCP^hFFeH zC5R3pC9TPiW)X-<{c7xvYEdpmOu_M6al+NcJ_m3Ve-Pd31Ae5GZe4v9my=SqqwdE8 zdT}8J`^!HPyeQ#iqFQM#+}7Taa~krXxws=b?>v!SRjkW8FN-ZpSbA?-mof!@gPW7j ze=A5U>joUTr~ZW515qa2!uvWyxPA9lv*fKNV2FW~Y4FDmyi1ZPuEDwf%#4c%eN#A_ z`&Z4f1N5sDY}L!9co85Gz7MD(IBNUNyPV|O1fA&->0YPo%AZ|3CK|BWI>A8<{_Vw? zEhmM%IsF!<^Nl_2flFJ)5Zz5twCyit_chu{)m%V?IiFTU%o3$Cu!N2F5u&RU)PrjF z$INW&zP(J-^p~j|iD6`iuT9rg+!_$}aGOzZBT~Dfsg98@in8C3c%h;SI(9`_&?!}r zWemQ~)Z7j>$*yETbDsMI#D9)^QL~k=C~R!t=fs3pddks;uy3BXZj*=k>18$*-|imS za=j<>&u(({F0Ccdc{O!&y7+pQu!jl*O#n@_h`1A#g@29D*}L#7QJtY3=7#36(8&tU z95dY5CT0fO@D;uRRLo zvMbB5o(FJZ<_B^q$ktfq%s_nYS2(ab(KdplOO8ZUnu!lQ#345&{XW|Vec@JTu*J*i^bgrS0yokHQw4_Sb0bP4tJ2st4M@2L05(|@W6G-RLVyU z6uJjYD+q0)bzRM$mSo&wcZ=DX6Qk>3e-ye;Vj6}XQ2yZZ-lRv}Z%XBVx*A5u=g0sh zIqXJ-k-dZN4u3@5$Kk7X7Ix_`FkJkyfV6gm=V`OaYJM0dMkDN8WC`s`T!L4Z(8^*P zyO?CFTp>L1pwMkS7}R~JaGW_sy-vZbHmjY$tJH^LsupvpHn17I=3i-_KMbC;MAh9S zdyfglESC>niUu>Bji0Ara_tl??4#cc05+NHNX0?)VpjTjxJQ?Ld!F8s!rfmK^H0M$ z?zmODzkC<{sns0UKlP%Re`5;mzKPp<@XKL+Q1zugC~s%tC#mgLpi%zVhPFZ$_LLm? zQh``K0s*n)E$cCnA*vB!#pE@-v!QZYx>jYrCWL>vV4kShVv@+8g~?kF=+pV76VX+! z8E;QQO$zEgxeN(?yUw~pQQ0dp2mg^~JYhHO5UsUAKNijBJwz!BRhL#3M;NNK4IeDm ziZ_5!LC--mic`scW6}D45T7Yop|_uk_YatMcRI zohNmDx3&@aSiA7px>Dm@;A?8bLDEthSO54t5*_Ac+T??b6qLhVR1%McOCkJ8H$f{^c4 zsLOXyO0F>@)@McqUq z%U=#BD-o1RbSqfT=5<3`#zwSN1qRzNE6fAfyq?-Xvt)Zm=hpSH1hevXPI|fQm*?Z4 zS8zZ5GKtP~t1lDSp}filgMnZ4?vA6DRvWbi?ai!z=~O!e^_L&8ubRU3wy|?2hDbe+ zH7}B_VO5?f5N2wr9gd=>i=^+jyQ{`p8l0{ObsJ~UT?>&a6UQ)NJ2NpWo_?$Py~)YK z=6rXNCTj>bJMUzNVf-W56b)bu+#edF+eD7ik<*1)C7E0-1Oj@>K1XrpEUR443_xE0V^sR3chV<~=u|jnQUO z`bZy7LA`4!uc~kJjC1Mjg~@J$b@pY`;1}k@zNMNBBO&*){76v=a$KILk$uUi8~Cu) z6GJ?!^6d_d(C~74r2u;ZQYYip$v6eCcW?px3DBfv(89IX&&JQIUp!2FRsm2N?r6)H z*eCHxb|(6%VlA`Em18B`IX`_D#0L3zt+eCEMsRFeTBcMc&ZTL+Q}c$|iqG1LNMBW1 zP@Q#$#hZ8ndI%m6TZxvC?@+2}E!IS%s@&{n;f*pg5Z{Z8Du!E+WFxYQaON5nqtqm8Fd|BO4^GU^>JT-&{HXGtB+6wf=bneG zB2fQ!{S)KB0hlL1UE|k&XIw(rk114w7_zsSUf6eyMg$}=5G$?BH|4^ReNA45bk+l! z*>-@Ew|;y3GNMYDK7B=BcS8Zv4`r~l2=1I(R{A@m#aO12X2=qiXboLLQ{!-RQT2$@ z?W+WQqI_0JdD=<$CP$Hh;`lcPx1;b*-yO8`!|!H5Ud`)Z5OPoBSdOJPp&Xgr#w+A4 z@r*?dv)Q^Z;_Lpq2HVy-ho(yfP?GAvPsMRT{o9}uM}XJWLWvvpyp_>Jf~k(Sc|?hJ z9I_H}q|hGJ$mPo=G{lW8<`S@5`yLqTy2{n2AS=j_KdMb41Zt^d59ii(orP$=?yvKK zXm@GrM3_OfceZ9(%Nr+Q-4o(CoDD5^aW=?JIF5vJf7z-S7XCtdwh6ShL!}`M-~v!@ z*5taU281;hUl7a;GUvUpv2^y`ox|TrV&>F3p16J959H|+Rd0`w`Q`eU>?p@S9COLB za_BxZz&Q}-$W-ooTe()~!j$3r3;XeI&zBRh9q&yxsGQ)XUxqz;eH6FMqxI~?6He{w zePYk6S&LkQyFk(ajDzy1JM27`(2uq3VEHDGjg#@&>gq(G?_xE&f%)pub-J_KbzAlg z2T8c9gOj3Q{=pSW!$t^(>Bfr8UcLminCE_;TtTBRMBrZhCH{Dz@$}hd9o2}0O11nv zP8fW{SEE;H>C^(gf{l+XpL7*hbR8bqj`LPVeS>h7F~Tofex)uEjdOyO=sq*B31v%| zPHrV!EWLB)Fc_f*HzUC|OIh~!$k?)m%Zyle6~>YmaFRV^02HVlNXP~puFn=etJu4+ z`uWYU18r|EB7$z;{sA+y^m5B;GpDRAoXO_cBDpNoFXvaErITg{GAgFIi+r3p@2Z$d z?G~BW3AAft?TLa_8Y+S1iIws4*(a9-)#T@Gq$a8AM#ear&vOQ1@T~l#qEp2@&-Gp- z{G!xXHFs0=#~zWYUlFTCm}*K2N}8c-(|GfQAF+XKL=dwM&YtjF2>Z_ZHEfev+|%iX`Jq6;OO5`)3rsBW z09(LJx?YRxH9LUo^?18AJpLgcEdI;w{^23P=XL_gvN!2)M!pl7@M#EScsw*SM;1{0C-u}?a5O?`=8*b8#HKus3 zE?ug`(In#<%~C3ObZ(h(uq>B9i##Ca+4zb@)@z`ZW3PU9=BrxssztJ%9n<q#(bvb$ls{!yuUymRpHZ;;a1rYr5xl^- z>TRF{=@e~~FbaDi)+s6O=F1asFMaX7N|PYpTVu=eD?+2%dja}t{>FtT5p*n?tn@}X zYCP!Lc-y6i-V%jWSCuT?M?A)4QKfP>bHrLPXE#25@(OT(a|ART1x?y`q9oFj?=;JG z=naW}1{ncg2D9z3i`-a$`#pb;ouqDwkUImYU zVSwdrdHH%q5~w*Nt+ciiCDC2k?KpNjXmhE|FyW4CqmF#~^0D+v$&bGrva|$pM2To* za~!~0U`!A&*kXhyiq6GJ`ZVw<`Q(vwxC}xoG{E)2##Uxv9`8pSG~0WeZ*q`J_Fl8* zqt)Fp_RM5^kvuNE)Gkcp+Dx<~Q3pEq7YVMS?U_=<_f|+giwe+! z-KKm=DKExH=2I(e=AR9yRa)9;qW&9T^jMv-Wo=H;z`sp21fJzmt@C01J|E zqR3GU3l3lM@w?X}q;0GBT|}u@%7Rr0D_S#cIc2SgE)HkS%O|ud0NC;`>czBto_m@_ z3B?9WwWQ%IJS)_BL)uJRrVk7@H`l<@qEaCuTK^gJFh&%fsASB->H8$y!C-v*@bmV% zN`{xjNPNJqpm1$&i){~#f1|lR?5`~5CJNfEDrrkIUJ&X7A%mAh%tT*zczg~+f()i zOYGAL;%u}DzdDd7QcY*i{RSC0`k5TQuy$QgfB7YQ;`0^6Ggo4>`7_M@R23$pfQ22C zZHyDnPl&|mzF3cuBE&5BT8fBbLvPlp7~z%!D)F)-q$dh1&oC+0!lWhN+rD6-iMB^1 z4r~m$uyG%lL3(b0?IiFmg#*60R2^xrXI48FtR_G`RWTTfDKi^Cp@qI{5Lq z(=#y$_*}S$bZ4wll9_REvuAUfj_6cFR5Oy1#^F8uugu)6P(CzLgOLqGw*oUMTo0gi zkDu?dH_-TbKoJ{##f%{$1S52uxACz7o>ae3DUI%d_^$?_qb^jvCW52j%y%Zfv-V6| zIGtJ)DC{L$Zk1hXJ)v-KF(ct{n8Y_)fyZgOudk!kjZpoKLa^|`G6Lam%qeq!?U<-s zu$Mg9$8BeYt=+|~0j65){aY4^sDj%vS`pIXM-}d^R4d`cxe=XH+SkSJ;Pq|sacU~& z))oCgZSQ0urQ;vm8Y-%#X-GTSlhL@~l5B+~+w?XVzU)%pYhHlhMX;Y~atOgzRgUs> zq@PNA^Tr8aTb)d2vJxAgj&DSD1|jCMtlH)a#h2q=*0%DEwjf(7W=AdIzh{u5&_dVU zNAPMm0xY|hD7wfe$bSZC5$Ded&yI4Wh(DRsB(n`aFV1;#`Vp%V$#+xqcKb!qXP*dK zexty}pUG)%v`bY;^jr_j{M4OQ<1aEgLs21qZzHoEPigzry~q&# zx7$t1c*ala3p+Y@Ts{R;H~APk;pQ9VK)fKxF-6`}%3hOl?fVC>EUiY$u0)cYjuNkV zlpUsT64=^n{IQ$n-CC_Ot9w7j#x%|g>94;SJ*_Aa=fCBUe@IKZ>cczrD_sUnlvgs4 zLeD=lzg=Np#TSKg6{)w)h=_`a5VXpbp7(QTG1M!*wPukMRYXkmw>U*Y(|Ys?42R-Eg_3nr=DSlW5as`kS#9q<5i+6)+LM7bEt z!1W_PZg^YYS6vE6VDp$1wlKJ!y-DkgvyI%ah1*uA`8KVh;R)E>#@9DmKlYS3+d2hy z%lfvcwC0>G+ztqxnqa5Kw%OW-kzlNnc@NrZlYweDrk*J2YA$sqLzx^}-l%4OUyU~E zLW4_$mk(aEv%mQ8utZC~oO}rH1~8{W=p=drgztP!!t=rO@kOCFgZ(3alOyveu9u5@ zvWeBx0_EC+>$!lt8mMPSVb^Ufto^-25yX!uT&Aw6^c2X4E*cIYKRSU7P_07meF?Ae zw)}v?3!4)M8H9|sKn2I6Bcc8jz)BDO{>p)2&1vSZ0&)yOlJ3Vg3{PssfE;Imc{tC|3P1FMJPYlpsYPt^@Z5$iBNF<9+unu5rdk9q z|G|AuEmW}2AaVM49IV*?c95#LlTFHR_##UUVw1q-_j0R$(gAN`mQ()J_ZujHUN4Jz zE$fn+<4WC7K-nZP@|o<NZ2ga=M9QYR;om^+Xj405{g~zVe-qdJ z{9bPMwI^qn4aSFvM#HPCcFz){>xxl{hhu?|)LG(6=Tb|pqJTmsOdVP%) z-^+6q>?!`b7_-hoSnC1V!QU^6=C6Ln4fYwm-bLtYa zQlCvqgl=l&9M;cWL9|JzAjSn0&yL~3m0Gw#^K)DSFgZTSlI?2)Vqa5~|F>4mp4L`b zz+fwd;;0>d-mV?-?k>Zk((bXOvwbeLxI+)O1lNQPufww(XEJ0KPqJVU&#?M94^fTu zC1%B`CGO!VF<)unigMk%>IpwCSSl~Ta>PuMa%ipOJsatbQ&0iI?&+xpmXy4yz2H9=_8F0XfPhiMh-kQbHW~_W1l(PwoAo{jLWLw;! z@%B^KH-vzCqyP>9;_z_pWF6pmBCskSOGc9hWl9NSQ46Df+Ju?4-}rr$6d<}Q(Gx=s znM8$+*HW4HomPAo2lEfOYm8Dh2u=or3(2y7H-_WbXAg?*+C0GkfJPep2?=i{N0}LF zHyiUfY~a^98Zl*S{zhau()A3Qi+HhR)tTq(^4pEOdz<_5*WF9GOa$&*F&B?pJxj+O7L&f}6TZ-MXHS}Q z7e|uOoLk7I3BLRs*S*K5N+_ve%k2J4YxI120L1p3fxP=LYlJEGs%wDy%ps`3myn7K zZl-jQ9pg;I3IjVh9ss+%-S0}*wHRHp;=b7He4jv(5OCdP%!9t?rZytdl7alVERwFe z%PkH{1M6S-793GUJ^)N^UU)I=?`{=K1Q_jh(vq!N9$@<`sAEyhtOW)v(5L8+#@w_R zMdh9ycv8+#QM}x=h+@n|zS^2On~2|zA0JvMB3B{2fS9NSz)SQzJz;Ao!z19s;lshf zJ%@YaHKdQqV-ZM82?xib0S`w6`}AKQADqm9U^8tiSu=Ahdn>S&gFUCUvxEJ=L*l6v w2ZH0^;g(2A;BfzipbJCW0j=!cn%Ozp!chM!92w>JC Date: Tue, 16 Jun 2026 15:29:47 -0700 Subject: [PATCH 09/11] Fix internal review comments. Add parsers --- .../Veeam_CCF/Veeam_ConnectorDefinition.json | 62 +- .../Data Connectors/Veeam_CCF/Veeam_DCR.json | 46 +- .../Veeam_CCF/Veeam_PollerConfig.json | 24 +- ... => table_VeeamAuthorizationEventsV2.json} | 6 +- ...son => table_VeeamCovewareFindingsV2.json} | 6 +- ...s.json => table_VeeamMalwareEventsV2.json} | 6 +- ...n => table_VeeamOneTriggeredAlarmsV2.json} | 6 +- ...le_VeeamSecurityComplianceAnalyzerV2.json} | 6 +- ...ssions.json => table_VeeamSessionsV2.json} | 6 +- Solutions/Veeam/Data/Solution_Veeam.json | 8 +- Solutions/Veeam/Package/3.1.0.zip | Bin 111011 -> 112523 bytes .../Veeam/Package/createUiDefinition.json | 2 +- Solutions/Veeam/Package/mainTemplate.json | 3166 +++++++++++------ ...eamAuthorizationEventsV2AliasFunction.json | 14 + ..._VeeamCovewareFindingsV2AliasFunction.json | 14 + ...ser_VeeamMalwareEventsV2AliasFunction.json | 14 + ...eeamOneTriggeredAlarmsV2AliasFunction.json | 14 + ...rityComplianceAnalyzerV2AliasFunction.json | 14 + .../parser_VeeamSessionsV2AliasFunction.json | 14 + Solutions/Veeam/ReleaseNotes.md | 2 +- Solutions/Veeam/SolutionMetadata.json | 2 +- 21 files changed, 2190 insertions(+), 1242 deletions(-) rename Solutions/Veeam/Data Connectors/Veeam_CCF/{table_VeeamAuthorizationEvents.json => table_VeeamAuthorizationEventsV2.json} (92%) rename Solutions/Veeam/Data Connectors/Veeam_CCF/{table_VeeamCovewareFindings.json => table_VeeamCovewareFindingsV2.json} (95%) rename Solutions/Veeam/Data Connectors/Veeam_CCF/{table_VeeamMalwareEvents.json => table_VeeamMalwareEventsV2.json} (94%) rename Solutions/Veeam/Data Connectors/Veeam_CCF/{table_VeeamOneTriggeredAlarms.json => table_VeeamOneTriggeredAlarmsV2.json} (95%) rename Solutions/Veeam/Data Connectors/Veeam_CCF/{table_VeeamSecurityComplianceAnalyzer.json => table_VeeamSecurityComplianceAnalyzerV2.json} (87%) rename Solutions/Veeam/Data Connectors/Veeam_CCF/{table_VeeamSessions.json => table_VeeamSessionsV2.json} (96%) create mode 100644 Solutions/Veeam/Parsers/parser_VeeamAuthorizationEventsV2AliasFunction.json create mode 100644 Solutions/Veeam/Parsers/parser_VeeamCovewareFindingsV2AliasFunction.json create mode 100644 Solutions/Veeam/Parsers/parser_VeeamMalwareEventsV2AliasFunction.json create mode 100644 Solutions/Veeam/Parsers/parser_VeeamOneTriggeredAlarmsV2AliasFunction.json create mode 100644 Solutions/Veeam/Parsers/parser_VeeamSecurityComplianceAnalyzerV2AliasFunction.json create mode 100644 Solutions/Veeam/Parsers/parser_VeeamSessionsV2AliasFunction.json diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json index 0e4f24cece8..2d1018170d8 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json @@ -8,100 +8,99 @@ "connectorUiConfig": { "id": "VeeamConnector", "title": "Veeam Data Connector (via Codeless Connector Framework)", - "graphQueriesTableName": "VeeamMalwareEvents_CL", - "publisher": "Veeam Software", - "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEvents_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzer_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEvents_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarms_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindings_CL**: Security findings from Coveware solution\n- **VeeamSessions_CL**: Veeam sessions", + "publisher": "Microsoft", + "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEventsV2_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzerV2_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEventsV2_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarmsV2_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindingsV2_CL**: Security findings from Coveware solution\n- **VeeamSessionsV2_CL**: Veeam sessions", "graphQueries": [ { "metricName": "Total malware logs received", "legend": "Malware events", - "baseQuery": "VeeamMalwareEvents_CL" + "baseQuery": "VeeamMalwareEventsV2_CL" }, { "metricName": "Critical malware events", "legend": "Critical malware events", - "baseQuery": "VeeamMalwareEvents_CL\n| where Severity == \"Critical\"" + "baseQuery": "VeeamMalwareEventsV2_CL\n| where Severity == \"Critical\"" }, { "metricName": "Total security & compliance analyzer logs received", "legend": "Security & Compliance Analyzer results", - "baseQuery": "VeeamSecurityComplianceAnalyzer_CL" + "baseQuery": "VeeamSecurityComplianceAnalyzerV2_CL" }, { "metricName": "Total veeam ONE alarms logs received", "legend": "Veeam ONE alarms", - "baseQuery": "VeeamOneTriggeredAlarms_CL" + "baseQuery": "VeeamOneTriggeredAlarmsV2_CL" }, { "metricName": "Total authorization events logs received", "legend": "Authorization events", - "baseQuery": "VeeamAuthorizationEvents_CL" + "baseQuery": "VeeamAuthorizationEventsV2_CL" }, { "metricName": "Total coveware findings logs received", "legend": "Coveware findings", - "baseQuery": "VeeamCovewareFindings_CL" + "baseQuery": "VeeamCovewareFindingsV2_CL" }, { "metricName": "Total session logs received", "legend": "Session logs", - "baseQuery": "VeeamSessions_CL" + "baseQuery": "VeeamSessionsV2_CL" } ], "sampleQueries": [ { "description": "Malware Events", - "query": "VeeamMalwareEvents_CL\n | sort by TimeGenerated desc" + "query": "VeeamMalwareEventsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Critical Malware Events", - "query": "VeeamMalwareEvents_CL\n | where Severity == \"Critical\"\n | sort by TimeGenerated desc" + "query": "VeeamMalwareEventsV2_CL\n | where Severity == \"Critical\"\n | sort by TimeGenerated desc" }, { "description": "Security Compliance Results", - "query": "VeeamSecurityComplianceAnalyzer_CL\n | sort by TimeGenerated desc" + "query": "VeeamSecurityComplianceAnalyzerV2_CL\n | sort by TimeGenerated desc" }, { "description": "Veeam ONE Alarms", - "query": "VeeamOneTriggeredAlarms_CL\n | sort by TimeGenerated desc" + "query": "VeeamOneTriggeredAlarmsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Authorization Events", - "query": "VeeamAuthorizationEvents_CL\n | sort by TimeGenerated desc" + "query": "VeeamAuthorizationEventsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Coveware Security Findings", - "query": "VeeamCovewareFindings_CL\n | sort by TimeGenerated desc" + "query": "VeeamCovewareFindingsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Session events", - "query": "VeeamSessions_CL\n | sort by TimeGenerated desc" + "query": "VeeamSessionsV2_CL\n | sort by TimeGenerated desc" } ], "dataTypes": [ { - "name": "VeeamMalwareEvents_CL", - "lastDataReceivedQuery": "VeeamMalwareEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamMalwareEventsV2_CL", + "lastDataReceivedQuery": "VeeamMalwareEventsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamSecurityComplianceAnalyzer_CL", - "lastDataReceivedQuery": "VeeamSecurityComplianceAnalyzer_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamSecurityComplianceAnalyzerV2_CL", + "lastDataReceivedQuery": "VeeamSecurityComplianceAnalyzerV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamOneTriggeredAlarms_CL", - "lastDataReceivedQuery": "VeeamOneTriggeredAlarms_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamOneTriggeredAlarmsV2_CL", + "lastDataReceivedQuery": "VeeamOneTriggeredAlarmsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamAuthorizationEvents_CL", - "lastDataReceivedQuery": "VeeamAuthorizationEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamAuthorizationEventsV2_CL", + "lastDataReceivedQuery": "VeeamAuthorizationEventsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamCovewareFindings_CL", - "lastDataReceivedQuery": "VeeamCovewareFindings_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamCovewareFindingsV2_CL", + "lastDataReceivedQuery": "VeeamCovewareFindingsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamSessions_CL", - "lastDataReceivedQuery": "VeeamSessions_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamSessionsV2_CL", + "lastDataReceivedQuery": "VeeamSessionsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ @@ -146,7 +145,7 @@ }, "instructionSteps": [ { - "title": "Prerequisites", + "title": "", "description": "Follow the instructions to configure the Veeam Data Connector.", "instructions": [ { @@ -290,8 +289,7 @@ } ] } - ], - "isConnectivityCriteriasMatchSome": false + ] } } } \ No newline at end of file diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json index bb5c9dd918c..3029100e6bd 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json @@ -6,7 +6,7 @@ "properties": { "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", "streamDeclarations": { - "Custom-VeeamCovewareFindings_CL": { + "Custom-VeeamCovewareFindingsV2_CL": { "columns": [ { "name": "covewareHostName", @@ -70,7 +70,7 @@ } ] }, - "Custom-VeeamMalwareEvents_CL": { + "Custom-VeeamMalwareEventsV2_CL": { "columns": [ { "name": "vbrHostName", @@ -118,7 +118,7 @@ } ] }, - "Custom-VeeamOneTriggeredAlarms_CL": { + "Custom-VeeamOneTriggeredAlarmsV2_CL": { "columns": [ { "name": "voneHostName", @@ -174,7 +174,7 @@ } ] }, - "Custom-VeeamSecurityComplianceAnalyzer_CL": { + "Custom-VeeamSecurityComplianceAnalyzerV2_CL": { "columns": [ { "name": "vbrHostName", @@ -198,7 +198,7 @@ } ] }, - "Custom-VeeamSessions_CL": { + "Custom-VeeamSessionsV2_CL": { "columns": [ { "name": "vbrHostName", @@ -266,7 +266,7 @@ } ] }, - "Custom-VeeamAuthorizationEvents_CL": { + "Custom-VeeamAuthorizationEventsV2_CL": { "columns": [ { "name": "vbrHostName", @@ -322,64 +322,64 @@ "dataFlows": [ { "streams": [ - "Custom-VeeamMalwareEvents_CL" + "Custom-VeeamMalwareEventsV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamMalwareEvents_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(detectionTimeUtc), now(), todatetime(detectionTimeUtc)) , VbrHostName = ['vbrHostName'] , MalwareEventType = ['type'] , MalwareState = ['state'] , Source = ['source'] , Severity = ['severity'] , Id = ['id'] , DetectionTimeUtc = ['detectionTimeUtc'] , MachineDisplayName = tostring(machine.displayName) , MachineUuid = tostring(machine.uuid) , MachineBackupObjectId = tostring(machine.backupObjectId) , Details = ['details'] , CreatedBy = ['createdBy'] , Engine = ['engine'] | project TimeGenerated , VbrHostName , MalwareEventType , MalwareState , Source , Severity , Id , DetectionTimeUtc , MachineDisplayName , MachineUuid , MachineBackupObjectId , Details , CreatedBy , Engine" + "outputStream": "Custom-VeeamMalwareEventsV2_CL", + "transformKql": "source | extend TimeGenerated = now() , VbrHostName = ['vbrHostName'] , MalwareEventType = ['type'] , MalwareState = ['state'] , Source = ['source'] , Severity = ['severity'] , Id = ['id'] , DetectionTimeUtc = ['detectionTimeUtc'] , MachineDisplayName = tostring(machine.displayName) , MachineUuid = tostring(machine.uuid) , MachineBackupObjectId = tostring(machine.backupObjectId) , Details = ['details'] , CreatedBy = ['createdBy'] , Engine = ['engine'] | project TimeGenerated , VbrHostName , MalwareEventType , MalwareState , Source , Severity , Id , DetectionTimeUtc , MachineDisplayName , MachineUuid , MachineBackupObjectId , Details , CreatedBy , Engine" }, { "streams": [ - "Custom-VeeamSecurityComplianceAnalyzer_CL" + "Custom-VeeamSecurityComplianceAnalyzerV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamSecurityComplianceAnalyzer_CL", + "outputStream": "Custom-VeeamSecurityComplianceAnalyzerV2_CL", "transformKql": "source | extend TimeGenerated = now() , VbrHostName = ['vbrHostName'] , Status = ['status'] , Id = ['id'] , BestPractice = ['bestPractice'] , Note = ['note'] | project TimeGenerated , VbrHostName , Status , Id , BestPractice , Note" }, { "streams": [ - "Custom-VeeamOneTriggeredAlarms_CL" + "Custom-VeeamOneTriggeredAlarmsV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamOneTriggeredAlarms_CL", + "outputStream": "Custom-VeeamOneTriggeredAlarmsV2_CL", "transformKql": "source | extend TimeGenerated = now() , VoneHostName = ['voneHostName'] , TriggeredAlarmId = ['triggeredAlarmId'] , Name = ['name'] , AlarmTemplateId = ['alarmTemplateId'] , PredefinedAlarmId = ['predefinedAlarmId'] , TriggeredTime = ['triggeredTime'] , Status = ['status'] , Description = ['description'] , Comment = ['comment'] , RepeatCount = ['repeatCount'] , ObjectId = toint(alarmSource.objectId) , ObjectName = tostring(alarmSource.objectName) , ObjectType = tostring(alarmSource.objectType) , ChildAlarmsCount = ['childAlarmsCount'] , RemediationDescription = tostring(remediation.description) , RemediationMode = tostring(remediation.mode) | project TimeGenerated , VoneHostName , TriggeredAlarmId , Name , AlarmTemplateId , PredefinedAlarmId , TriggeredTime , Status , Description , Comment , RepeatCount , ObjectId , ObjectName , ObjectType , ChildAlarmsCount , RemediationDescription , RemediationMode" }, { "streams": [ - "Custom-VeeamAuthorizationEvents_CL" + "Custom-VeeamAuthorizationEventsV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamAuthorizationEvents_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" + "outputStream": "Custom-VeeamAuthorizationEventsV2_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" }, { "streams": [ - "Custom-VeeamCovewareFindings_CL" + "Custom-VeeamCovewareFindingsV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamCovewareFindings_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(eventTime), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" + "outputStream": "Custom-VeeamCovewareFindingsV2_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(eventTime), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" }, { "streams": [ - "Custom-VeeamSessions_CL" + "Custom-VeeamSessionsV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamSessions_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" + "outputStream": "Custom-VeeamSessionsV2_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" } ] } -} +} \ No newline at end of file diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json index 1a0eb412b23..e52019664da 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json @@ -45,9 +45,9 @@ "pageSizeParameterName": "limit" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamMalwareEvents_CL", + "dataType": "VeeamMalwareEventsV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamMalwareEvents_CL", + "streamName": "Custom-VeeamMalwareEventsV2_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" } @@ -95,9 +95,9 @@ "pageSizeParameterName": "page-size" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamCovewareFindings_CL", + "dataType": "VeeamCovewareFindingsV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamCovewareFindings_CL", + "streamName": "Custom-VeeamCovewareFindingsV2_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" } @@ -141,9 +141,9 @@ "pageSizeParameterName": "Limit" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamOneTriggeredAlarms_CL", + "dataType": "VeeamOneTriggeredAlarmsV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamOneTriggeredAlarms_CL", + "streamName": "Custom-VeeamOneTriggeredAlarmsV2_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" } @@ -182,9 +182,9 @@ "format": "json" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamSecurityComplianceAnalyzer_CL", + "dataType": "VeeamSecurityComplianceAnalyzerV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamSecurityComplianceAnalyzer_CL", + "streamName": "Custom-VeeamSecurityComplianceAnalyzerV2_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" } @@ -236,9 +236,9 @@ "pageSizeParameterName": "limit" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamAuthorizationEvents_CL", + "dataType": "VeeamAuthorizationEventsV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamAuthorizationEvents_CL", + "streamName": "Custom-VeeamAuthorizationEventsV2_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" } @@ -291,9 +291,9 @@ "pageSizeParameterName": "limit" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamSessions_CL", + "dataType": "VeeamSessionsV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamSessions_CL", + "streamName": "Custom-VeeamSessionsV2_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" } diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamAuthorizationEvents.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamAuthorizationEventsV2.json similarity index 92% rename from Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamAuthorizationEvents.json rename to Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamAuthorizationEventsV2.json index 3c45e1f325b..48141f4c2ad 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamAuthorizationEvents.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamAuthorizationEventsV2.json @@ -1,16 +1,16 @@ { - "name": "VeeamAuthorizationEvents_CL", + "name": "VeeamAuthorizationEventsV2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "tags": { - "StreamName": "Custom-VeeamAuthorizationEvents_CL", + "StreamName": "Custom-VeeamAuthorizationEventsV2_CL", "DataSource": "VeeamConnector", "Category": "Security" }, "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamAuthorizationEvents_CL", + "name": "VeeamAuthorizationEventsV2_CL", "description": "Veeam authorization and authentication events for security monitoring and access control.", "columns": [ { diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamCovewareFindings.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamCovewareFindingsV2.json similarity index 95% rename from Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamCovewareFindings.json rename to Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamCovewareFindingsV2.json index d30321baccc..01ffe321f64 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamCovewareFindings.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamCovewareFindingsV2.json @@ -1,16 +1,16 @@ { - "name": "VeeamCovewareFindings_CL", + "name": "VeeamCovewareFindingsV2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "tags": { - "StreamName": "Custom-VeeamCovewareFindings_CL", + "StreamName": "Custom-VeeamCovewareFindingsV2_CL", "DataSource": "VeeamConnector", "Category": "Security" }, "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamCovewareFindings_CL", + "name": "VeeamCovewareFindingsV2_CL", "description": "Coveware security findings and threat intelligence from Veeam backup systems.", "columns": [ { diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamMalwareEvents.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamMalwareEventsV2.json similarity index 94% rename from Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamMalwareEvents.json rename to Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamMalwareEventsV2.json index c9bd2c3aa5c..13ef85ede7e 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamMalwareEvents.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamMalwareEventsV2.json @@ -1,16 +1,16 @@ { - "name": "VeeamMalwareEvents_CL", + "name": "VeeamMalwareEventsV2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "tags": { - "StreamName": "Custom-VeeamMalwareEvents_CL", + "StreamName": "Custom-VeeamMalwareEventsV2_CL", "DataSource": "VeeamConnector", "Category": "Security" }, "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamMalwareEvents_CL", + "name": "VeeamMalwareEventsV2_CL", "description": "Veeam Backup & Replication malware detection events and security threats.", "columns": [ { diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamOneTriggeredAlarms.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamOneTriggeredAlarmsV2.json similarity index 95% rename from Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamOneTriggeredAlarms.json rename to Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamOneTriggeredAlarmsV2.json index aeb6c3af3d9..f0d24f39385 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamOneTriggeredAlarms.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamOneTriggeredAlarmsV2.json @@ -1,16 +1,16 @@ { - "name": "VeeamOneTriggeredAlarms_CL", + "name": "VeeamOneTriggeredAlarmsV2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "tags": { - "StreamName": "Custom-VeeamOneTriggeredAlarms_CL", + "StreamName": "Custom-VeeamOneTriggeredAlarmsV2_CL", "DataSource": "VeeamConnector", "Category": "Security" }, "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamOneTriggeredAlarms_CL", + "name": "VeeamOneTriggeredAlarmsV2_CL", "description": "Veeam ONE triggered alarms and monitoring alerts from Veeam infrastructure.", "columns": [ { diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSecurityComplianceAnalyzer.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSecurityComplianceAnalyzerV2.json similarity index 87% rename from Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSecurityComplianceAnalyzer.json rename to Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSecurityComplianceAnalyzerV2.json index f29020fe21b..57c315d0166 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSecurityComplianceAnalyzer.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSecurityComplianceAnalyzerV2.json @@ -1,16 +1,16 @@ { - "name": "VeeamSecurityComplianceAnalyzer_CL", + "name": "VeeamSecurityComplianceAnalyzerV2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "tags": { - "StreamName": "Custom-VeeamSecurityComplianceAnalyzer_CL", + "StreamName": "Custom-VeeamSecurityComplianceAnalyzerV2_CL", "DataSource": "VeeamConnector", "Category": "Security" }, "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamSecurityComplianceAnalyzer_CL", + "name": "VeeamSecurityComplianceAnalyzerV2_CL", "description": "Veeam Security & Compliance Analyzer best practice assessments and compliance results.", "columns": [ { diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSessions.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSessionsV2.json similarity index 96% rename from Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSessions.json rename to Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSessionsV2.json index a27c96c1643..ecdfd54539c 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSessions.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/table_VeeamSessionsV2.json @@ -1,16 +1,16 @@ { - "name": "VeeamSessions_CL", + "name": "VeeamSessionsV2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "tags": { - "StreamName": "Custom-VeeamSessions_CL", + "StreamName": "Custom-VeeamSessionsV2_CL", "DataSource": "VeeamConnector", "Category": "Security" }, "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamSessions_CL", + "name": "VeeamSessionsV2_CL", "description": "Veeam comprehensive session data including backup, restore, and other operations with detailed status and progress information.", "columns": [ { diff --git a/Solutions/Veeam/Data/Solution_Veeam.json b/Solutions/Veeam/Data/Solution_Veeam.json index f430a72d380..1a5354e590d 100644 --- a/Solutions/Veeam/Data/Solution_Veeam.json +++ b/Solutions/Veeam/Data/Solution_Veeam.json @@ -41,7 +41,13 @@ "Parsers/Veeam_GetJobFinished.yaml", "Parsers/Veeam_GetVeeamONEAlarms.yaml", "Parsers/Veeam_GetFinishedConfigurationBackupSessions.yaml", - "Parsers/Veeam_GetSecurityEvents.yaml" + "Parsers/Veeam_GetSecurityEvents.yaml", + "Parsers/parser_VeeamAuthorizationEventsV2AliasFunction.json", + "Parsers/parser_VeeamCovewareFindingsV2AliasFunction.json", + "Parsers/parser_VeeamMalwareEventsV2AliasFunction.json", + "Parsers/parser_VeeamOneTriggeredAlarmsV2AliasFunction.json", + "Parsers/parser_VeeamSecurityComplianceAnalyzerV2AliasFunction.json", + "Parsers/parser_VeeamSessionsV2AliasFunction.json" ], "AnalyticsRules": [ "Analytic Rules/Adding_User_or_Group_Failed.yaml", diff --git a/Solutions/Veeam/Package/3.1.0.zip b/Solutions/Veeam/Package/3.1.0.zip index 21fce54b16446deef81abb8e4f865505d6f4a045..a78fb33d01084f8cc1c0f79afac101fcb1ba9d2c 100644 GIT binary patch literal 112523 zcmagFWmKJ8(lv^^ySoK||=_VybQ_W@=_> zXX#>TZ^vlmY;X5f-`9Qxko5DX{}Yl}PG3^tg{;j`t*YL=FsJ-myClxELI$FSfxuJ? zU3~4?NEMayb+CKwvw}71R@_9d+NwfJ&1Bqj1}u59F%0wlp{)xp@~iuI-?2rSe#iq< zISX_ZN9NgMMK2rHG&FVC@TOt2YDw%qZzP5{5(vzEh`2MTm^tR`3t#g%ZSo~x!K-)w z_@TZQ+oN_UXkL4JX#Gk11iL5blP$+?eKEU(FVy5VBF4pf=&B$VAr=$aWK5z zENr4;K_p8tbNbM%&Df1gG(8s&<~yoykS)6r$m{m(PFvgQkAWO@iV|ub3R^2z`D4N8 zo`#hlp3m29M8tOao{}x8^P8(8uoaV($+RF8qm@NV@!v!|HhaQiclv*`Rl;(q^Btwu zYuI3uFn_R?U6m8CP0*c+DVe^@CH4ytEE&&|+c`Za7J&Q^NUgYjk)R3d0sf4dW=u8E_WSv}pUAE8GI|g3J{`bv zTc6~Ij-<%){tn$HfDt|Bg$h@3h|LL=X;f84d(;&5VnD^4Aiv2&f;Kq;1L$W?k{lH2 z%bpv&P3mP4L7K0n@$MB_?$X2g>0ql$YO|r#Qp*ugu$n0xx^v3#-jq+WvArk_xCsd9 z6qrffozEI5t{cvHs?3lvTV@Zb-lE`Ptq}3@ljNM&iMWnvsMok8=)?%4_`-B5Tcn>% zKLai!*ocJ>O2R$2!NLhGp=`*F$RLD!>Mn3;bWsEtPi7d>LzT!naHVKJWpJDsA@?L;TYx@oFOqx4|H)@t_y9=X3gXo9 z9gZQxkga&(f(4Qz1VINjo4cn1elZT7q3jH1TF?sV3|!xAV}P0^9+^20^bqv1#|}UR zcag+snc7No^pMEBtGs%*6#QuWH7e6%E=?fuQ62{hWLY2VFmmhY0$~<36T^p8Afm0> zB{uiXAt$CJ7SgiGV)izKs3D@=HU^exP^`U&7=` zI&=VgSGRW23W;J)_6!U~@;mpti(Y6V{W!pzc*P8M|u;@ zl&I`D$^-#^LCW5pG;DbAMY|lhV|Y-6hGx^iJ6QXC zJDbZyo)b*>J&o=A2sQ}Y4T?ZaLE)m(W5o|jTR1Z2pq+VNY%h`5BX6l=II~(Kk)I+1z(N(P1MNIo5KeApUuB0LVNirUs;N zH88nl05-FGo^81GoL)%PyX@gZzU518=7^z@|`&z^J^z(9QUCUos*m{ zE#qx5Pn8}|Lf}N#xDR{t*WqDPq!#)uD<$OnJ74!K{1+z-RnLN=J!Xm;kb{NX`Mh8u z8TmdBC_}i2x((=MoX=M-^MGr6C54`zrb}x3X_Whw{S3^ICbF+Atyc ze_fkLTwf=7?9#tFg@$=Yk{o#GNWEWzGkrYOebtVbXh1ix!MIwpGhjot60nyCWPs@kvOxw)9c%ClN$iIH5E zxxNaW(DWaAKk^{olq+yLrWIIPy1i|&+*M7}_pCjg=yVS}a$MKRI7%h-@|@y9fqWOC zxu3;5G=#bOom>ubf$r^=)AUCnd5*9tDbNpXqb~YkjEYQpb$%m7@AbMHhXp-F2=Iov zC995R1LYNXuB@49_CadCxN5>}U~%JtGoR}?aD{J^F<16M!ou%5$yBSPwLzWnyd9N8 zn;O8Ryc32*{iXr~-a6llp>?4%w&`8k)7FF^O&^$Yy6W*zGPX<0{^0pvsP&gXRt-`k- zO>tbla_W1xT5|dvH-(H$rU7<6Py@U*4i8bdC5%d9ibrL>1k?HA@f8400CpLx-mL*6 z*SCG2bDfK0^waSkLS?ujS)J9x_-5yS>ob)|8C13n%N?!q=OeHoErIP>(uC`9#S}q#K z#Ep>0aJu~3-Q9$=7iJv-voW(4uy4v3sBQmdyea-!%&G!R%GX&eA;EMHReX?E6HPf; z;8alpV~_uNKAgrAAs9Kn1w20T<3}QjdksAv`UVPwP}o*ZE&(|u z?Zx8Jk;q~rh#!|*I2^Fm3lk0`m#LjgUrmaiN;p4&^oHIWN#=9Yt`d>3wRH(64A&{Hm=eX6`zH1j5|* z5Uy5Q-5N|vP-g!5d@_?norK>5_b@_H*lHXn3OZyIf*i}hE;*Q-TfIK*P&0bGp~q6& z8zsPj8BuP*)7HWwX!Ss(o$ILWFY0|O6#^pgxyt((Pa~YJiiQUI*@&?pSBF)z$bdBY zi=CZ~vlhRQ6-+QPgXqXxGK8~J+=0kT=9YSMXe$kt`XfV!5*e)f#e)c0gTRjF+3c_* z7aK>G*kt$oy*1$d7Y?XIXBu?Qu;l9ZQn1R0h@rAm^m^lplBqSHC`*?fzFBPGxQ+Lj zZAdKI@EJX(kV~8dX4hLtd=8S)fqJXcFRKL=y1J09C%h+$q8V3kTiMhu&~-SZh%u2j96&qIr$rZjMtd|E_I zx!JH{S49zwI#c$0yz~1(DkT})-kK(*GEl?TY0EPr1_aDmph3lGk$0%PFMWXq_~6-+ zoeiD-U6-LVK3)7q^V+H<;GXb=FDj^&HexJ^NvL{D!j~i2!{zC2lM?fZNqPS>KXWwB z&W*}_H_~D9mf1{3kzERcX%5PzAr9U(dumMryJAo<%{f$idLBzWj*OQ}n46KD5z_;7)ppeG8#_b*rTr*qS2(I<>rXotq_>W_X)i5216tS9ypo)qC*;hi;LQV zJelKbNVN7e+In-^=hGz-FIqg^0~Ri>htpdG(EevP&{XDP@oXEP%G$TwI>n{5#_Ro9 znd${%aP2*lg)&~Zkaja3tkA2(mX3249!RR^!~Nw==CDIN54Q5>jUj(_?D$psVYdt2WO0Ei@F#t1oHnao%h}(T(OVV_s4ba!_$287mUB{zsKibaX}N(4u_>cv|X|= zqADV$J37k0IWnks&!v2asn!pxMBW22W-6hKR!>DUAE0he0RCWwtXEzr?KlHtoRmO0 zPLqN!YGX&SvQdG9Vh`Zn+aw_8a~K+^@7=WK>*gB22={cA)0ne3I$sJ-6@yoBe6mC# ztk_=Fd+ZfywKLWn0se4tllC)mcIq*vOkMREhUa79a7+)Nq@bdtx#t)rEON4jW|_}l zu$`f8l}Vm(STp`)okYsjby~Z@29A7PlBOkMi=|X|WF6s`B6d)AP$R@_Jjdi~-J)RX z_jXLT)Kz)V-D4YE&WyB@T*JL0Nm6DQd|fnMDOu%&(|aR%se-SO`@HJCo2CS|2aP?( zlk54-oFFr>FAX&$`eZ<52&03K}^79g;dF5oR7I!`5 z?7XO?&KIk;mfzcA1S>}#G@tP>oO|pxOF;W{d*?rU%M;5IO8rnM&$H7do;R`P9##~t zrJ}b*eG5&Lwb9Frl(-~C2!0=*IYtKlk-r-c>PN0jD&mBehVzcb55@Y2-K6=w)Bo;0OH_)^?7PEfpKIL zm`SOwOd!zb!C&(bmad2eL@8-2GFmWKj61?r%KS&=)*6gCm zj*JI~DSx79jBsyV zb7ZYws@|!6PaL3K&)S&Dpi7zO0UH~}u|eg?lQrjXcs-2;mjLsIANt7ka`Wx>>A{w; zJP0c>Ku1JuH%#tw^VtT2dX zgs43t@`q#%9V>2<$y;-Ddqc!_8dhzt#gLn5|GxC|nqZspJVRd? z4=qYW&kQlSF$(t&DNk;i_Itj%ZWK(zQSFoay7S3#*9{l)wvzM1#W-5b(L&S?kjK(j z&E}AVmpFn`8}A_{*z(C@(WpZu7Z6iuJtye!Se?LnnPD+iSC$BML`(;17<0ilf+x8+ z6Q34SjK$B~gWJ^#s`geiymT|#V*HdEKPz@B2kScEN1@Pf5tOmEeH>WZBr#Ot5SvUt zQI;}u+#ryF(#SKRqC`^OMuZxjMo?Ox>E~+M#?c8+#(#4KCAv2ap_Z7zolKw;h8FMU z4Ekkhr2>yMbmKmhNEb38=G{hny(T57R}t3Dff`JywOdRPSMI`mw^#&0F%Lel2p zscS{^?mMcQHcpGdYE!dk_0e_-{5!d&>FlAiC9A#|*QKYqAhDA^oFRz!O$by8sahYB zl$sHrsBDM(ro$1R=9lBcZnJ7s<`rQf`jCC%TEESsEi=hKOIa=eRy3qXN4`&yaOD|r zB|d56Fz0ea>*Wum2-a)P)OFHTj;y)fg$_pBFc#x2+wRB2RF<2}`UUr6V7M76z`+r1 z>E>eNZGKeU*GuBkV@QtK9Ky?&XQl>ipB#Z{L@i!+;GVsO(5uSY;-p@PC2veB`pGl{ z^}|4I3svS(_v;h28;?4gl}vZDy~40^dJL}9$$%bN5F-L4tVe zul{+hNWm&1-Irg*)B-0@Pkb+|-QnNIqE=W}5M4VcFivjZ)f_)+*YOrnauMC%5|s() z_Q6%EQtCI6nYry&-WhoCsrI}Z0c`m9EKHS{imDR}>c)TC+?^RFw)U~&@|gT&N800`u%Ot&tuw!>Ojo~PH|k4X?8Bc$$wKHUK&HtsID#3>xIl$O0!}(_uc&YN zUR=Kv@?&X;R@5i0eEs&$r~R+Cqa63Pb*yIs&A_*N@rIag_g0MWh-bk|zLy@~^S%cs z?@r*wDL&vir7uNl<{!(X>J0i(4JxNCa&8V-C5 zyky3#-4JbAhhDie(wIzqnBKI|#nLut3h&2FSmo=^h^=;p(7--Pn817UEApz8Hq>bj(O!Ks=(@y(0CeegF#Pw7hXK{q z>yK-<*LL5y8-8Rzu=g(b!f%(Hc%po|OYvGjIKN|*5(CR0`NoT=aT2%Q)>Pws4{hfZ z^1&jdmPzPP%D2^82h6R#(XiKlWMOJ*kF11qAeXUmKeJ`A8dt{dRt|K>M4{Q7I-}kz zM`-kL*3OzOd+n*7a(m8XcU@o5R5RHpBXmOi<66siuW0M;Lf;B`opw@WIegYC4R&t1 zg{e5pEiC#>4TfSH%kN?`?n+6nh>I@3BY=L>u~+_%3@$5EB#RJV(f;I70MUww^SXtj z@DKTF#}gvF!0=1`kGUsqz@qSE`Hjc&nTkZ)Cx;s-Ep_O4kU+2v;CR)|osAvE{DrJd#2T9R8%W`AKQJUG^io2-0gCX^?vZcNqkm0^R*2PNh zz?3-Uzvag<3aT;`i-<&vK6`?yxV4 ze?|hVLk}Q?dJb-))uJ(f%BAcDqsNGEb8b1eK1LOyXg*84CT{2>!%;j=+?3w+*X%V3 z?kfmC!ZU0g?KN9Oq=j7DAh4sPj57!AH|G=DYaG`7CL`QGZO(Z?*PjR4HKB59x||MV zcPfqnlg6VIhz<3KWQey6j7w)X;jr$9kgK0oI-L0yer=6o-1?^IV``XP%l)l7ktepw zAvq=l!&2}PUjSzr^gzl3j?GZsBt{?PG;AhBi{6!Wp!r?*MQ9Y8wn`M&(=%3}3QohM zUesA{VfR5PJOZB>*i0nKPQPRZ^Ji$+w?M4s(iq*Tum)mw5AYoEOhxQy%)%s?P$dZW zi*-B0|E1lG;Vh^&Uj!}p0S!bNsEA$1`kHzV% z3y)+GykeCrR_gm8stMz%{@Ip5SpT=C!wbUq>k`SIkm!+KSc( zRUxnU<(j%W^ve8Qbt}K{t;S*RiVaK^S2lJ!@O;#tQc=KG^HJO z?h)I@Z`glyvMmCex2-)Mn~+t`V9lCavG;A|7~wSiPGU9Z5r;JUly5bX#c&PlhK3`P zlL*~yY0oz^EL8Ou&^!qk{N($>8HIWQGhmN2Ot}1Em zxDm@5_m~=QoqwgU@5WN@Ono$q|CCi7SG%k=iY)c)hgR8Hf2hK#`9xS4tk`50_1X#YNjl&ok z$d$ZP+lP?|8oe?h>>TAOpAiW`Ds4c~dn@lc0yJWL&%vIP)-|di3I(4y)&5}gYD*`318iG3I%#gJX?1B7!cxlVnhyVAo<@uvWl`UWjts1>pJ zZu@eZq7}6axzBRqKZn99=EuJ+Ie&P64Fmi<9{l|qOxEK!Ek^70PQS^)jZ_^vXXWFx zDV+v}oPI+xX#3*iDthu|2uO3k?H!z}yvxa#=XT>MXpHmd(hGvxdVa&pqt9VCvMcQj zt%+7Bz8j35ci}5rDMLFCCqr z*I`n9;MJ=7^3|$Q&;Ey(Yy^#ahxpwD{-~l%mPdQGJ=cY)X_8|J#aLr6o_xU6=}Jj9Z$TN}recS$m=x<0a4npxH!<>!8}(r7jZS;Rr# zQakVc5hi@9N?Vy*D!6{8BObN=dMh)pfmdZ-5nYmWo{DdpmG}^WX2&%e7@yuh zYF1Vm$gUoE8`HMr1JODYb0xT8My$MHz|?%L6{0!E6!GX<6I(#paVK~Xd4;ZQ7Ud!u znBG)wQyp<7_#yQq?ua%#JhT3r;AqK-woBEx3MJLa5`zz`Hj_Qhw`RqZZOHld8^KSP z?=E7YNbj=xZ|ytDi`q~4fv5r=ZjYgQEMoMSNCuP>!ijP6<)!6`XpwM{IJ9pk>7V(i zQNJ%7B@tRpDqJ6w#1Z)(rgoA!MVS~ifn4e;4@*vx;@7IYyd0mM>tQqQB2!V*_F3VF8Has=j8Kz zQe5UoRsumk85*I$CWYQAGU3RX6wx;qj&FlgJY(48pM0ZVJ3OX8quv%w-J+yaU^*Dv zlYG!PPzy)D3L7~6pqn0P1f|JSg)#0HWqgBWE)X?LMwv#DqpUzhnc`WamV{4J(JVEF z8K8~p(Nd@*@FwqcU8IPj=!w?H${yyJ8-d+6W99Ghv1KtGQL(O1Qj_6p z4U<~bRezZ){9xmg^+@obYS4#;F5p+tp~GmFMQIlmzWQ|!iw~XNxLuWT2iUrvXwjZy zdzM_n?9&V+NVxG6r?s8254xp?IVkLqg%0btQPAzCN{r)+4t&n^q|^O(x^c`12*sHG2E?T16#3@By#}tPU1P z$;O3I`V^uRL5wtfufgxaiNv;+`Q!fna>H`#5Z@qaj+nbfni80H>U|_(fATT7X&r1F z44N~)gSFSwxBn7lr1~L8KzWogU>nrt4mj0pO{rOy9|5P?kddfFwl&5(tb^?8DzE!t z7sjid40WK(!0kOup|_LQXR_6!r0V85fQsS=o28ox^CC7q=;ZcXk(9C`0{{Uee@ZL$ z+mC6NoU|k(~y+llo*S{-}sk7=`h3$$Crg4NAkq9=EhvO?Gelpxyjp7A2mc94Wok z!FOecr5g?&G&0kwPg3uZ5sgxF@+lcJdCCh<>C|DleeEtgwfZaeqPvt0_iyq~r}D4G zGCHr=IQ!HHLR^pe?J2xX8x7VcyJg>}7MCn%>mJmuJFwODdDc9nn=ONP5+&5nptuD7 zRP?kn4Js9AN5axHxo>o@PgMT=+yEl$4Zp{2Ag8?#v)EbSrePbo>b+j0;_k5gY?jgI z8%Z^Jg`JfKbO26~H62o2@0BbYE!_l!GDX)7SMA%<&JTN<&JVu{)vDLHUbmhLBSczR_f?wXZGS{+zxN7@Gl!xpn1GBSFh2RiMbA{e9q z{%E(Z=}NcsbC|i0Cwo{N?7VZ+d_w*EgF17cZ8RjEnO)hHk1Z6G2<0nzGLzIL>vaiF zR5Wt$Y137i5`bkD0=60romjy->UlQGq!p?m^ztXb>UMp$XaMs z6#OERI|$7FLE3PBZOGbo%tA&}NRz2L;I?MH`1rQ1E5;crJDsd5?+e|~n`vTa$^fwt zV-rlx<#98W0+Ybwo!r@>jNC_n)~zE|g@8iy<4btq7^udkRs0{OD8loSNpKt}5woSO zomlG2@AAaouPV4YQ7+lr<*FC0nx!~FtG>Z5QaOWA9~~%9=G9JdYF963qzuDK#*{C#WY2XbS%mJ=LY~<&*6k(F+)&^3%ClX?zQ;u74q`Dkk&JT(tW|8- z9D#jZ=8mhig1$^_!-9!CdepjvFsI} zbM>@QMz#c*VH?VqpnN^E)*O6jp~N2~SUZgUNuAObS9TSp`>Vb|Td906SR1=p@TlXYqY+xAfyMl|{Ke zCgdB0rHY_ZGR6qfr|o_<)c1o*rtfsh!=+3X(Hj~No_%?v1m=A)y%jT4o0qc!Z!5*- zih0(`;Ij*(1beK%T9FOw4I2=O$vd>dFJV&`Qyrd$&_2zmpo{(J&B?`Gw1^2+!Sekv zhejZd;o4|vStjfYF>7lz`+luky5<#3O={sB(Ys@k#}hbh&LKlDJNA1`?+Ado#8xHkcq^4 zJD*W}=iGb4KB+UJ_<3(zD_vwRcQtZT`qK3>Yww&(HHF(_OxBdfUb`$>g>3>k@*IAH z?p;?xsZ-9u7#G}>1$|@9&mB82yZn#i!>)l>3x^5To1rBHX}T7ENKnuzsCI(RN1EI+T7Y~*7!+f>+$K_KyKnAP)=my`m6_iN`w3#y zsp7VoD3}PagRFpjdf3|-hT1m?Z=6zja5-{rH(QyCZX{mmk_ysA`$XA;M`6vq{3s@T z(YJ(q;J?&n$H;zF(Pc)jpp8cG@%N{WnlhdjN|39-h? z6YVW7i7z_=!ZHXYm12q@fdC=lR&BV&wG1?h1R9O@QAoagFs0YM6<=gI$K?Iu!wEi0 zfUg9@%}m3FO0&``uqUtz#V-rNFH7X*xo}2U|E6HPO*6T%b{2ug+D1rSdk{Dz0yIB( zLiZ~`q-uhpY9f%sQ+PHIc+vpDd|J;9G_1g7yi0emG{XnS#RtuJ|DocR*S5w{tj2K{ zs456WIvDM2pMJDkhRZye?r*t?8-xWNkh->nc`3P^yB(RkJt|z}M4%dte!uSUWm1Vv zYL!J;#T+LH1v?;q%@LsodwFv!VsmSxXXiip%PXk5pfI2@iIox+lV?Pf6Fj73UQyb+RpAd=nQJf=@I3PBtf@4cbu8e zj*;tAMbn;1P|t&}IPs?d+RAh^jLHJ`D9i1{63&)l&G9A5ikw8h5^Z+|c<@l4Ao?;9 zo4}>1j^9^Ey{Tu8)C4Ss!7D`4x@AJ`<)WGNw7COXTRsI}_3HMF^b2~7f(${P2G@Ls zGz3RBl*oiIIDL?)T+S;l)7TU%KMyOmvdY^##*+qH!4_Er5cH;>?~vL=Ll|abprLRM zhB3<&6QOXnlh|yNj!Px=M@ts&vh1GCl z1uLsa2`y%W1hcT-`q#`s8p6NCJ%;E?J*=)6R7UA`5+>tt2`^|1l@2$zG{A^NgtZ0{ z1-ta+3$Cg~fK7gh+e8JF0-79y8n(mtauW4M&o+{=MT6_cZ2NaRC8S%SET`f@J7x#> z!;@>Gi!2KKNjmO#(oI9ZlXhz(Io*6onqj5cbwf&RXijv_36Xgjd`O971HtEkjulN6 z#_+%a#`raBHnd>J*Q{}gducMfgciRB)$EB+cabG!YEX|AgiG6BhqZ*z>@exRZ(d*(+hCl>=hh6N&c}cnj>(VOH)&i{uQ6j5_=yUJ1CL%Jy5*FwH z{C5~El(jE?6qiP9u>+qGZ9#_c0zo4#LOD~-5h+9Ed_=SStr5x9h)LX`k4*AiqUSjf zX5zjoQAQv~N#?JVAMgUl`^r(D5^N;`=%B7Z9C;AH(S(TTl)}(Op@z}JXY+!O!FMN> z^p(eL)B)i)30GW6-p9w*4j;{C9Y73y5`omNMe*GZasib z5zq1~I0(`2;DNt`i+V(Z!J8deBWiAV8%0vM!ULj}!virkqib+0) zW1{lb3ZzgLr}^@Fy$zD)_ia+~GjpjYAjQ62#zS5(({Q`{Nek z3tU)n(|W*mGRGPk!VVNe+HZH`;`aFWm&MhRdB3C`>nlf6_Zu>D?^nnqWE&Q_)?gMJ z_?d%9rZDp3YglfhDWv7lJ3_qR@Kp4h>qVVU_FhQmcMTndQ4ptEY?LV#^MOPz36`_y6$(;;{RT>|0?d1F@_ci z+j4h!cCc1XxiBqyy0Aj&V;50bfVDM6UE?BU9?meh*xhe}4*%iEe-?}{o{IliTL9Gt z)sqE72I#^(wA#%K*ujnGGzy;qc%nmRV!`}P-Z30Ap&$yCgTPyV++7{uXwb{|rapk9 z%>+BSEW$1*nfKomEm)Wah#>Tr9bh$5ZS;X=6|2PQJu*1N2_=@up;W-zmM5?vCx6A; zV(3Qc|26wxbzct?wJ1L;aj8#8vBRueMBs_|AhgU&7ls7DN01wlAfqmcz7q5^nK#WV zze9$JBwqO)efo=_wz*4Gj(tLuu~7J`Q!pgiM53c*#5isyS+yS{$h|uvz`4BtyKeAd zGjo#{j>;Oc=;U)#I2mci_)29p5v1jq1thCZ$bm6Uhhw2R3I%gHS_l6;RdL>V$0Dov$8JRr}FBfJWOpb2u3lM|H-s}9d<+So8{1j zbOkSB1HY(gq0*NWS*UXX@?vFSy`&xx4SXGu|HBr26V>8TssdL8`Rna&6~aEqB4_mc z&}!`N4`N{eZHq)Dy|fT6M__^o#4jbS`=f=YzqN3fsGu7x<8zxM0R>UO*HU;S5!q`J zCNX3^m~{w^ZG7c)z_vfk%Y3QM{x@v@M)S4qAUUex*?J3Gr4?y4L9nnWq&GgH=urKf zIyV16mjZd1mZtYK#jP{dRs%YfA~Zuvu99r7YtyUKSZUy!@&sCzFg>qY8hQF#OJ5rQ zOH1p9XljJa8Ul=uSUg${d5?ppR;2kja*@)e6%b&y0b*fVWhnnRCe*b=GyG-7(-71f z^XgOil-Utg)Ii*xGi{&9OfJXV1+f1edcOh1gB^TKV@IgK)P6_mHassNOMHP83U|3C zI6Q!_KZE}l;$O#!WPWXs*8zo&ubO;?d>y6Nf@7n(0H!y#4PCdp0vuMs%%U_|awZlm zN^9H4WWC=|Xpou2QF8dVD5VAeUq!?JCLMnmT*~>NqefR7us}0^^i5<2>4v0+q)!*- zpCIR8M-Plit;Wkiyz4k?DKAOTLSz`bA#vNuVDNj19UzW?`fLCErM4)*KdGb%EwVTu zG6y~PtNVh3NGs8X8Agxmui9m5GCC; z4HRE0QB>~!Nl>rpZh`MGKa!V1$r;Yl7$*V*5$0tiyS4QC^E~kiGpY zRbunbfjW|}LBH*WmW5}uDmP!LwHnmeUNi&i$-=_-3}^eTE6W-D$^X7X{!I2fCjw%} zS|(mF56ydAO5l>{WR77A6-Bie?4^#`KXnU{0c{bbMOlB?CI0|E0uN;|KNFQgU?A`0 zv2Z}*FP8|vzm5B^&AII&adMdOl?PNAU9kib+Y+$GNzXCcG3<;c>I~*MLjTh1h})OR zu2vwXdsT-0vm02kyWd;;RS^TmEztGDUudIUJg;+^nt17IynUex%1 zH2aSlR}n7@TZF_OOEmbq4y%PPPE9 zLkE22jj$B1RQt!_f}E<@8tD2MnkRug8d`iz=~rnLu|t_xfc_!;`|yj5(;@x}{eRuY zznC(c1R)aFc8tfecr9?41%tR1+oCBp?<&iaz z7udRU?tL(~xkC?*LUF?qaE3+IcEo<|&T_~6zpC19lY%iIIeyxW0j2~x4-XF|PVRJ= zT?k*F2`epS@BiQ1|B*Q|3GXkn1HoDnVqv_A0$u5mgfpvtSW0@Suik7dN*=niEaoHf zvO04u1ArjNyU_)xa`4GGXhPL8tcjKZsIRX2rDuVlONUUb1-IZ_SL}(U1_YoV^Y+Vg zEQP@ui6Psd*DR^FPq|*2e#Z4*Ym63jsT-`7?R6cny*MuRMek$OO5FHV=&c)&dDIC< zHGVKQ8g^0LxPg+=7vr=4+kE^-5g%}WpMO~=IoOY(h7#pl)ZG=>5AkK@OI9W;W+)bp zFh>giNOuP5#Kn3Sc@9@Xr;^)YRq(zGHNh`rOk{0XybQ$yAPM}xFEf9=f&i>7d`TXVV|7b+jqO46{-7HPvf*A9;`{rUfRtsr_%Nm@E>OYyq z0!l*!s}zs;%o54+Jqw6r#yd5mums$Ju9NibLel>?<-gSF^#=IrTR=^kU)voowBOLr zB{b5j)F=<;Nm{)3#hQ#@jwI6#zY9CGcCq2bJHVJgfP0Xb6U2a+{Gl9LJj=glZVTNu zeut=TJX8m>mOdCC0C(4cZ54pN7z!Zi%>p!-XmI_FYvSpTbe&>XBbO z?fZ4!rcONr3TAfb@}x;T&|7nkA(ati4!mlKC8P;{xq8tVz^~!3Fu(h& z-94PMAKZmxIa9skT|>x0Hs|htvgic+ zuUm{Fp1bOOf4~u%dp&pY8-5c;-fJED;PGEP5B7 zN&NvJ6#D$(#u=IWRykCh3?AsvL;~V}C+P{8-0_7aWqu+jv*I^esi@SO*Ri%isWogI zjz;`1zCKIwZ=9Y4K2)vZb>UG&WxTK4 zsB^7x%1hdd%W;ud!1y^EQk_6v^bGyvZ}cpCewtnK+I2V`Ne{D^vkgy&QA@lU(<-$D zvTezT{2yG0Ee0C1KS|YyGvVf(yUpA+$+y`C4$TFZG0r^6kbk;$>&z$!jp!-0p^zP= zX0@P%G>Fd4^6@s2)}1x2`iy41{A%URFD1nM%LQ!F!*D2!_3`5|o<|!4`5llj;Lz*P zqxwip!en4u4}QHrkFvh)zhoSlC1N%m20En*(eSv?m33V{N;FnJi(M3 z-=$gH3s<$Ze@oh$V7#M|6i6%Wh?J@6f3Qu|sI`B-yU3_F6Vy*s^;RFq@9=e+!({>l zJL;d_4HWQkiz`+Vtf1lx%|qe|(2k3%s3^#g9Cv7JvJ(E+JINn$NIk5@dO}qe#e;xP#l^diu~%^6}bARzMwZ`qA4rJkY~HasO7C#3Rl_G;%Y$4*V-n zd>C?0hO7v5Q^C0bU3O85;TKd$>)Ekal?AR zuXQWMFvsRED%gB7{gl@D@?d}k0qwzjK))uK>F6Yt+e$SmWvauhavSJu?jM(wyEPsT ze&IATL)ZNQGPLsuUS<*gACjJSFza^&F6JFsTOHP`>I4))k+P`sA{cXBatv8)c$$J>8+O05}^-hJnPMmnT>XTd=;oI{S>NA*Olg><+#RA&OXhdu*f@g}2j5^wn4#u@2kfIEF~aftSgC@QNi$be|7 zO~4J;AJ@hYBa-{N|10+Q-?1G9f5(1!jm>71Xc2n87z(#9&}khry~4zyrO^R!BkkRR z3~13apC8QAlyP$=0Y9h>dRa5zKw>4?UjjmrWt=gMEWG?xQTBrZjz z{5?H2H-b!dA*mZNPj$e7hy*Nr>sM@$7t~+sW)b=w8)ElY?7n$d{x2L#9n%^NeU0iH z?j$BhIIs{KYg*1LeE8t~pezK#-JX>~Bnn7x0E#4N;fdwg*}S3w*${~45(N11`iQXP zR@=fiUu5`XZwYucU~$AVPqf;=Cw*A5p~In!0Pz9WT3bTdzfj{t`Gp!31otayfJ@Re zCMS9h1t4Lq5n8E0VU-91x{CbEPru}(^dw2FceNx7sl6k0DWTc9Z3@#d@~%5_eKmUw3&kzj?s*c}=RDKLcfiOqgTXa%}D>)K65eazx6SowcZf| zkpIeGS@?JUYQOWBgv5Q#e-Y7$?j}j>mOakE5OQlArS}45BpPg^nNXjaq3JdL-<|I0 zD3J(UWbfv@f)VrOdx1YRz4$!c&j>m}Ua=rzi%-l~5dxakfvBpRTILt>w7-yVF9?i& zMc(ERg5GOQNq-YjMNUMC&kNDUMl4t>VFzC#Y9piBF}DDz=XFpb;kJJdO5m?S;iVmx zdL5L!uU>8-o+?xfyB5OB#4RHMPs|M@nzSLlSk{G3vGm7I1fku~0dqsU_cIelWm6!r_(Z`GLQQUP|(d z=)c?LsWyFuw&Cc?5l-%qv=U596nsdiNgi<&l3>>a(RxdoANYGlU%C{AkzIm<*)KH* zKe?tXED;#WM$V}(Wfnp&1pFeUHr6c4QG5s}nwgvuXav`Z7k0H=>2$9Kdr^`eD*PKWlu9&~6c1Ao2;5OOR z!!#}Q)?|6rwm+bS7m&EfZv;sB}#4FXnjT^3kl3l2y?OoQwUNv-z2hXS%lP3`u>J2pqG4`^D4I32oz%x@*LA^N--V7 zoDs+Yo+Sh4<12s~X3)Rk%2+Vk0%>YqnKW?ahR7tY&BWi4VH&*6doHLDa#C~_R{XWy zpW#CC|B9yZXnTPlR*Uw&^nAn-p|##Tjwl!RGJ2?m&ij^%L9sq)=rH*I(e;hNnMLiE zF*`}8W20l+cE`4D+qP|XY}@7=+cw_Vx4)@db!Vn#s`j7r?_fRasb}xC*7^UVg|mJS z*}h-BqDJF#U#P+-Kdb=XGuNWCe%ngD7 zZ-yK`(%JME-&k63DC|w&aOvT}|0ULjtY;hSgyi` zGG;2aJhObpQ?0?`-_&op%fS8% zuxK5JziSh4527IW<3FrIO%e^sY}J=@QJ)DU`=6s)UxlOg-VSM;37O`@%bL; zk#R?#d&~B8n^fh$c?}p(nq#_X{tcLi+1ZA5i?r|F*{PvbFJt(Z*Wk{116-#Q2Ww*< z8P8B~BQ9YN2nd%%&Cs&^A>9s{NW6CWl}ImY*uhi%>K7&JM&JP|MSYfhRdPksm#!@t z2~CitBk>%p@*J#W;Yvj)rP&vVXUP99qLhkoO1-v{{p#pUkcbvM?1*+udoSVJ#Vc8O zr~gg{7d70e9FVL;p&ohwOtv-n|DzIiy!L zfTF}fuhbYpWR78xXkMaOHLa{gH*SgeB6dpXf`;OI$ggM zzQIxXGySK6e#BT5-Qn%iaE12r`S}pzXB6d~Mq6DF~K^h}0{a9TvR*u@&v4ISGYRa0XM#f{C;g0)k%bpxN8?JEV< zG3V4~=S)zGZQvR)LFT#H?w;S@Io5XAQ}G)1ES0z6VaV^J52zo_)Q;f$IncefD~CLq z+s1%-_@Lqp`F!oZ)2TGKWV-LMSN{2YdIolMf0{>??zFfug3R5;Jle-DfM&Xdwrh==UNG+CIhZcRM zhn=y&DziBxdK`0+3VEoXW_Mv&_E}RknP>ivBP&6U-*$~|6~{W=NM>1_Yvnks11W_@ z$&EH})WN{y^FZK|E9mizV*=l=rsnm~dks&SWl=A%fy9ztxMhNaqtcN05Pd#9U&)lt zBh@t;v|XrZgb*d$F>9_-qP0(8xx} zjJ)rz7mvGZ?6Rnv;*BNC_U$^gF*I?MJl7ZT-e3>APQ|aPt^iK`5#(DEucuEp`ec1% z@aNV;B@msKi6>^tBVJ(w?+Yjf9~rYdt-?)IExaeo%rn%Fgsb@(vRICWDRd8Z@6KR_DXl5)kUwZi>5`y}8l#O*<+ILS=~QNbyl#&n z>}r0$`fxR=Q&O?}edLSD(YU-jq@II3_xA8(t(PH;ID+pk`ION(4e@Tc<0dcN%>jnL zX@DM|j~95-cZ8QU<13V>bfn6*8>#8z`#I**-B%iQk>H3AY7MiUG1&YNyqH83N(KWk z&j}yxH`lRVUM-RfkSQI8e)HCadTlz2JW{?~TlN)(!d|8?Dk0U}I$4BW3^*}5X)>qs z>Kly1El*b$QGK4g8E}8aW#v0+bC}QeDe7SZ$z^8`8rGB|Aa!~Mh^7v$F*%ezAUy&x{&W$GjJ!--p~QRQh8WHD9-1N8v*;T?#w1i>J?!a&`C zPvt7cz;`K1nx6_k25poW_%UmD<$`4-PE4dtrRo zqycddyzl`3Qy`Mh8Nl;W>CM&MV3 z=mtlbK7YIUhe?Z;vkurTAx0iCi2t$(0YZa#0OOYODU>&Nb9BG$I$-rcKmDGCu8=a zYmviW+)>tDeDEM<0c(mvtb0AesVcdBj2`>j%mpDq)c1a!gtRI@;&-`c&yS-@6y3$p zM_I|4lIJ+sttZH)KLhhzH08OS&k(;@Kf5-D)Yj#|0sWapsaH6^kn2VdYTA1~fV~E-_Dz6poCS63EpN-uX5(s&&`&F=kE=?R#@1dGae%@ zJy*9$W2${jd5K$-o1VpmwemFVc2jd|IRBa-Y!|1gZ!q=#L;!9nc;PR%<*xvf->LLU zGOVa?emX#JL*3IN`$f$O5JE@yjTBQkNjA$aW69iCrSMuW?p$hsr$zyYN1nC(Vcbg` zgY!eN*`8VC#3)@zy438>dXsl8JxoW4fAskiAja;prB4UhvxQxwahjI|@CDqN zd3z~IN{~g+r4GLvt6Q4XTT+pq(G-q2in`?x!3z0vJbbryxRFvm=+bWgA^q`{&*DCX3cEsC`0 zh&H9E(7J%d4*T=~1%C%FUEJ(+dA)6Mb9LzbGLNkz zrcl2im<78d^GIPqhBJSq#W^KlgUh6KhTJQH$>y&>_SErx9^u#4SATTd&otVKtHVOk za`PXqKa6!X>{4b-hn1{NoL;TlJBrrtY2QWSLY@W_1U|tb3^b-tM@~FpVG2050$Z5F zQ~Prmc3F;n@3c_`))&}olZkI42Q>KAa{EcX6T07D?wkzI(ULf^V1xx+&<)tQ(E*A?yz3V#7-!Anp|lSMy#9btd8`+PnN|Um(41_@_(1 zExaMWb)fTRYC-%rejd-eq*97y1(-!=eSBBGLcsD1U}Nv%d?l0`mE77bYutX9H++>E z;H=Zt!}^+BItbEX9g#|pr@eZEh(S(j2ideZ=;qoBETA-$xH3yiY}8>+|7&M`^d8p* zK=v^~jX4P}X|6Z|zbq3GUSDbMHJ&h3WPNs=lu)eR3eXQ)Y67V@v<`CBFa9H}3$?Ga zj~yFk$%Mrr^4`D=HJWau`AiVOI5?O;?GaCYn?;qM@@lz$2pOYLZ>aLD{UnR9joM+d zU{l+C#r`yP5-36CQnx=`$r~+O97wU~rH*^cN(3iKrsvQiO|hB&h{>f@n_@3Fm=r6L zxWN`@SeK<{;!HH6Pzx_gcz8(wEtjEgYz?jrXQcVcVF!Xz@Phow2v)nlC{IXl<`Xy4 z+E6U_giehvj_xrFmu5JGdk`^Db4^9CF$-;bm(dVT zAA?!SjATKl(8EoEj>}2Xd|yp|)u+AhaFNf{$1?uG)#DneFaBE4m}DfqQ(p0)u?RO3 z%^8irk45Ii{q4yi_AtsJw&);Wx>HK#M=16c9sU8DZmXvc2%-}=(0$X7s&e;1s>5}+ zKk5UgZcub3kUsMuEItuL)%bFNmVLu#IrHih(M;(;N_^lFn7`PS;D?Do3YWn9k-+s+ z@iBYplK##E!65+j@_}XA32O`7ZR|A)u(ugvjFev*K$%w=pNz%rBlofy{CB7=!?EFn z_-}KEjcd+kdsqu4u1Aj`ZsRo{VAeHuZ|@`U;WY&5rJwgf-*gld`mR6p2^^uBNwgXo zQyv-vI|&4etIS>x8r2g|THx4r^3d9iK;V?eeb!}HpI`m`Q2qD1L;mg_VLvD|Oe|jUO z+5Ycew^?RZ(gVCybNDIx^gLIjN%Hg@+(9z=-_?`YX^?Beh9Cdd9m)ZcRJh%Sp=2ta zPZ?Oc3TX1UMTRW$cwyz02ab>)q-D>Md#(Z(X7_3c$k37?zysyHtS@C zM}pwc$;Zy@LGGL$M9J^@T@6(aRU_{02+PlPsdtj%D`(}~b_B78q^-d6>oXZ*htX|u zf457WDY!X*^16u69o^i5^JXEZlf1aG(7DIZ8)66vZGeC(7~}4fAm+UcS=Za7i)s%N z{@(@xJvKMbuwAd!VbVt=oBYy1SasN^Z9C=B>~vb+GgnkoGg=+Bqow1f3;M>@Sh&I&CBM4>u2)vitYu^87Eahj5W`8|jMu zI}=1~MJ%r|T8%)Qls$Lvy&_L2W2AAD2?sZFF?_va>x{GFt4?-OmyV`gyn?Q$e@-Ca zaP(k}Xp^7o%ngf$Mf*0zUXJ3p5*RpbOsooFxq4M7+Fzey>_5wffc z>05EmC!l)Xn#-Ktu0GSLwNGFGrNtO42^mq-I@u$r;K7bEC)H2scPZnP=PU9(=g*9% zxLL=W4Z(fUUFNF-)8D;z&oHXVfF`>Nub?j{Ig<$NYI>5?_7W#3AJs0No_m*g)d9b= z@$Qs+`jeJcR6Tl=QFi2yxr$ee*E;^Iqd`8@8;nOY-n5?Li^=hY0cw&LKYX}Pe$+R9 z#e(noxp=-8oYE;j$|)cBt=9*-kYZ-q(yaTAQyO*ko^8%hh<(FCljhi0832Ns!b)V0 zn+Ug5s{%i=wm9#r(1R$VP*j34PDHJGEVGmw9XX4c${7)RpqQcCaB-yt!m~nN7Y9?j zL~1PvOT5)$D2s96W6i5|@xQ@_yKXx&^RtfE+(inW(o) zy(&wPg><+RRi()f%-?N_9<@|wGk!i(&1mCjGD>ijOKMa66$s|r)Zh+wFF@{ioD$Xickldo}XL)L`hpo-J_tNI+3rgO(+)$ ze^|iE*PUV;p3h;~-u=Zx&5)}I)ri95QrR%;rR$K}j8_Nyo_(Yw?7BwNUYUJrpvW)~ zJWVFUuHuc@7otmF;^Qe$5oq}Fw_{MCxEZ)cvEB#?6*+5YQw8wj&%7gli8IW;n0UUd zDA8oU;R@A}5=ek&0r_1b40%Pjlw623ZwjN7d=t2_hQR|w`RF}QDT8iqtChzP18_vO%dN4^CI`f)#@Q7YG*2y8YjF>8=;qmtavlByEZQ8vx zx6UR>eWoBbqn(ttOs616OST*G37Pd*NNMF7(uK!~RcpUD6kH_Z8J3UjxNGJUp757f zpKuB7O=<0f@)Z8ZfD846uJ70 zsN~_BD^z2Rqw2J^djtH~F(X+|trZ*}|66x;)3I&wmWyG_g{g$;h4qv0xV#MyeXP1` z`I-hUHGOSw^N&p+98GVPX2_Xj@2EwMK^`PLTYAGTZtbhY-Y32K9YM2%mxnHi;6f0TcV<9EaPT(o=+&z|?8fv_AU8;BJkL7$*rrpm?GIs{)+fdkhE!1(RK`e3)Cl_!N zC4N32_s+VOOVIC|^r?}T&`nrrL{(3y`uaFK(o&)I}{Hy|0k4=iuLt*0Jes9el4#oDEMk zXMr^5**Mktf+N>Wz$^NiqC=!GlzBR}DRQ%Ztn-Dn)Ew$&cjMT`c4nhCdSaS;i;nyX z13gQ`y*=L5i6frP!s*=JT#7469`z-- z5@R0j0P<9DBShlB=t(eM|KC#FQ8P$G)0L<-{#NI;Jc-_^czsYvVjM|tT+_rguC1;$ zx*k0zfT>na@cThzC~&p6lu=!-k){7`Eh2Se*pwGk%oIibZx&$(RFX9uS9fkPK`&(0 z)TkM0OyIDxDF${^dMG}5Bj+oZ1W^p$3ccIyJ`LA#Kt#jiynW>NY00EbTW;*q03Q<< z#>4F~>gq0H^xf;&#C|kj991=|@Pi~r+iz7wDP6Boi+o^-aiua(-*9?pv)nk#MK0>Fc`v>a_t|>1kxI9mkZ$o(nH-$ zki$8l)!%U@9FQlRPWZ;LDU_>=|BM)Ds)UGskd$U;R$!^~r>YxtuQuMZhh1Gnu$QBK zWY~G6xjgB#>`JFaUBCsF<-+VN%7-boVU4%@BSz4!9J`XXou8_mpGIr4C_oE2n~?0} z*07I;%xdx_ULM-;<2HnZDKP&T?Gk7?ZbgQZ$;v_zt-Q-4Vm}wR zp~76jb%FU@D{bk_d#wYd3W7}S%~kgJrMD&T*FO}E<~fIJ)zufqYKGzZWssi=1Y&n) z8=X?CUyhv`Htcp8+D$9mZ5XVL8qiV6nqfO1NjZ-bHB{fN1BiP=%}ghL3h0w^W^u{n z6LH*8puRqSnhk`q{C)RK@Qd&R;bp2Rc|FCRW4R15#&K;yT?IMy}pOyawV^;eM3k}tl~g1%f{V1-ie?8U@_uqo({nL#imzyt+V zCXWxysk{Y%7EOpjReDaqhRJV3HEXZZ%T@ltyfmO?44Uh%DHUg!=>8i)#lNOQNNRdY zPfK;@-MTTk9JFuOLw0M=t%v;5yLMyeI%oG(g^FMXpr-!iP79D!*t<8eVB8OWY<9@w z(!=NUY1wR@Rf3cJu0qE>NnG@u5}_g@Ob_4g2r!FVKTcqJ zz_w2XwImRgaW6k8WMNE!+(dA6QI`r*$10h?WO1&mBY*a^2)2+1<}Ux432IhR<$i zTS5oG-qpt1rx_xq!q0<<=u9T5$N0I!Fi5wZF~G%DPtted8ujH*9WuUmx1fRENE=W6 zvM$LRMC6>EA-1de)|G&5p_GAx=&8CKS0O@*t2Jib$ltb`Z)0*94o+0xQ2>&)dV0PL z<9|5)m!37J@fuOJoMDPYK`N3=B##FKg0Lf+TWp?#H{&E*`%ZZEE)J*I(zq$N8%g5T zCwV9Pcs={27^z9go!Isi*#!2fFtwi8B$b+UEG_ zOdpI@2LSEXz5<~_qHNSH`~>{?Prl=BNKbnk;6tz}>|T=a&L$tQT-s;hy(nDTv}c^w zHSWS)*hKqhR&uX4;a0pxOjw@_g_J)gNNdSN?Z+#79Xb?iz{sgS8+PTpQRp*4(9^1OREs+4 z$Lp+LT*x%kv2d2L1v7wf=d2xZ6oMzRyvCWtCh|$Jx04Z}~N3S)^IzwoZV4TdM1ta6W*BBz2?h>ZD7m#Xm zq+g~X%P9u@`Q`6v5)iYj#g5q4gqakggd`IMiv!(tR~TA#X|M2UWZo~Cbb}0GtYsESr%BD?Yu5um&vW5?m zvN{WJ{9Ir%G1dK!8dlT)uzt1|Qm#=2Q(%tBt(n`Z0(#1?_96Aquv8F2iL)UtpQVl2 zGdgye_8WH2gWyVD(fGamcZ9;ap0kt?yFE#K8{Y5=r*wcG3o(>+A4R0 zrMQ5qCXO#PpwUSYSE*{AW2@AD*I7_vIJSOw`UI_+(%*!ku-uZig?-QAIBXf50Yy)U z|9#lWbMlzuG54&OslM)+LT*zVS= z$$anr(eY~+;p4Xlc+`(fBlrAO8=IBMP5wS>e=7a6rSUq1@5^o?mGam#6v`u3yulOI ziA=Dxjn5ydteh8LVNu21g3+f=ju*=$`AHvUr~4+zi(Z2olz^M`MxBJ+HvSzvxxaU0 z9YUJ`x)!CBkUZg>WQEwNeDAuku!b>GMb+mU)Z^Ogs!I~9;I-8(D@!DSMIYhg`!zHt zN|K8s8FY#x1s~FGDfUCMe=|D{R9SAEM|6Y%d+2C$$Gyn>@3C7nWAE9lxJC;N4alsE zJ=&IQEgQrcLW+lQEcT!%dC7I&z@N3cJzn=h9&guMd3ioXsFb^-O|y|r2k&)YZQbqB z`oYWM>Mzd=C2_>4@6kd#3cv?n)48hFx>ryn*RQLB;YpOfxB%{4B;6@(=Qe#lZlJr$ z{Aye;HLYnV;rHS0bx;jXsAm+A9ZUnH|J)Ou(!(#bUvhPbWns~#H|R8(>ASp&-4xvRCQAh^sT;S>B=%VFq3Qu|At__EKP zw`9A+F#4dOPnp~ER_(`8ZQpWgA`HjYE!o)~sIELk9HAn;n1P3b+elE+J`x&rRaz<6 z{;{6_fKi0AT`7!Xd+cwS6&>QwY4BX~_I4-?Qw4^wHLGC|yuED6m0>Svb#9G27TeS0 zkr04Y-V#|ASh>-9-s3MPamH<5_vdI2<2KM078G17H~ESrH>5C)KoU>~fe0WDFqQ<3 z_Q8$kG6l$cqflbmKJZ&2t-7X*FBJ&noXq9waMqX`E_wkp1mzbC=SlvgYt8bKuPrje zoSR}pXFs@5;#@oBn6y@fc5-*f4P@GyS>90ID;91S@HWT1T~(K{8VsvpeW|;^v0Ncn z*{=8azWsOlDjAAP4L9cIezZ8tsj)CMr<06b66XSvzb%$^mB}Mgo&^Qt(tZ)p$#!4;A7zb@l&6J{BlW@schJm~DjX-a?dZdk&H!iSXddx2VUI|=a1EY; zc|rSE4A&t@nUdI(e%xJ}=6r+h;h5r&yEx~8mhm1VQLHoH+3MPShR(DJ1wYBcGfa(@y52)7z%NLyhSoPe$O^RtzFh43^_{itT^JNWrK1a@nYrQ} z>XP+@Y=}p=?Ln!h(A!roQ}NHJ+J1C8vd#372#(ktfj8o4=A!q;L7V!y+5nTy%j+DT35SG3xw}Dj}cd z>2`@usI+o#MgU_HpaLu;*pq17hG7SP*wgG89?yk;_(|TnLhHoJMHTQiCgt!7n14U& z;nE10fL1%i(G@@w`nb2*f|#_BbTODr`=wj5#=Um08M6Fg!{!j7YZ4M;bu%Xf0dlZ% zVe%vQ_>xKF1-YcSQRX%wo0V0BUc|d_b-jqZ^!zMofrHEBTfRlwWg9p#qVap+d94x< zBy(%suI~S*SNmRdf_~^|6u?nQf3Tl+vUoHEqHl~qRoq%h&+n!4fcsHefB#e)SY^Mt z>R^{aE04``ug$$emE1c0o67h`IAHaM7H2XXEA=83LHUSfPm>g#t4Wa4G`%I%^Ub-V z8cRlGX02sMhi1|S)~hmcN{va^KOKkxv2G~_+LP;4vTD=zW6XWWh=$7BT5Z+((sg}V z17irt$w?SiUFuZLIT=xR8oS;T{BdRD#<*!qKrPw`s0vJRzRHZP*#jWGkFdCSr?+rk zp&frIQ_E)Xm8Kgi&Z<4nN~BohL8a~slb)Y87#G6H^Qz3Tb#p$_EPvH`Yd0BZ7w*m7 zXY_)sad!zJJ+%?-#rOAe23)O}48V{sB@mCn#K1-;{`D0Qm4|Vof1&JLoM@|7Ng5L} zcaWuqi^~J9X3cAIG^|k-S_3k?Hqd3v&0({q;Q&{nd3K`dle*=R_K~{g6v8w{Exa&5 zd(Rp7Q}}J((aWWp=M!z;X+muS68_ArJ*!EZMFw=Nb8q7at##2N%A?dcq{xU0Qr-*? zuwE+E3yR@ck?)d{5 zsOBMS@MrKu?dQ6Tt$Rf7(vE0EQ2SzaZQ|XpAg1*uFYt2a{fq1ht(kMwJfS{MS(4+I zZsBR~nuEcezH@%=6V9WZI>l;sNq4o*%urv+j_-?vOK(N|(77k9*RcjvC2NboBUZ`I zqqB6SxT#m$i9;tn^3K3B;Fz_lnGlJhNaJpOKn}nGk_zZinRGA`aecaagpz6R@mlK6 zm1JCP(o)pPgpDaS?F=*{KdGC{@2p{8Lyc>_t5Ez*`=w0_a6WiLE|zFzXWw;yO;Mus z1APakHBP|Cxgty}p066Otk!Rw$zF5*T-}DuX`CH;2hWq=+C~~Uv)KnqDHGe?fZYA% zyuoiNq#pJ1>$o*!F9w%1}WoT;e2?Y8{Vur-@-0-B)vJ!pRK>-{d~o7SQsXyt4Y#JAyCr1 z9jgR;Bx((u_wB}VF5MSm%c7au_B@Ox#LcV6vZ;DhLIQwav<1+OedOKIEi9Wev>xUr zvVp8JyMZMG{AHm`$g{~fvM&%SVo-Uf1pg1)3jW0#d%iv7=#ebSED%)<1NW&w zj8rSs${vG*r8@&}W`4HXxj*3a9?-L48ut0PRS|B__<>IT*YNI}B}8?}I>0~R8mQ8E zb1{n6XAy*L&c5?YrL_Ofs{4Oq-IllFGzeW8N2VJL7V6Y?LhCet3^|uQkS-4+M`_H% z!1=7Bepm^(XXy3Y6i??*tt_WS8LxRJjgQkgQwwp}&}A9m^Ouy9{@f0n%QZ3T#JR_8 zn8RTFOG1lkjwZxNITUZ+Z2q!`6M3PyiTIUoiP+BDB*7WQ%Lr5a*F7zkD}}(Y@Tk)D z=^#@wcdy@+W4ZaA5ZSok^7BD(d5n6uAa9}GI4FBX2P*i=y#nDGS*#O=o`7LdqeN7O zP)KY1+Ua~as%?@-(5l1lIfWG2V@YaZguIff0Br* z!fG$a^%#@llyH19@PfYE^6g^9U_?tJS3aM^FW9dl%##ivZzF}}Rtw6@38a2DF}%5c zI@SpMI!^e34sxm$tc);6Is>5}#^y}TX@HP>09#t(bf^o;gAQdBaWUTb!KlB2E|q`c z<#K?2|2E*-``|Cgn75l)M7!W$h>0|Pf6zAe$+%#EVbnJTW9xzRK1mVffSl3}fahY-@aB2vp4wBfhJKHSP#nxNM7F9jF3&GM8 zZU>NIHklbt!CnnS&#N)zuL?nflOxP zAqjeHRRhk2I|nQe@{}|Z`jP=Cwa3hX&%OToiG^jN9BmZY!`OVCO8^-(T-&#z=$hZv z#jnL=WiT56_YJS?+6d()pk!G#sJwZXhi~cO1r#1*N^w&ek6$z$zTQjfwXpCE=g!6L z*DDJ+8cak(@dmc5q5qG}K*O-F2UL;%idpN;(GoIdk{QsqivK*O#q_3oE&vEqm5c0X(eD-9`?) z5TVaDbYs)k#QlD$EQJl`N|1-AsF~W$1&HC3>m#Q56=vz?_|QyI#M`boir}?BFr1SK z=5wgc%m*4Cgg3ZFyK9_@O?Sl10|@nTk2(qeke2^Vz^fpu1ts8I28;(a=ONv&Z%{3n zv&?#Rn1(Y)?FHafnW&i_MIb~{B9fjH_ueQKEW-=PX2y4La?(z1I^At3eNb{V&MJ9ygkIvfN|O1zjf%o zl(P((d;EB;=PjH6%AF3q8!_x$M`Rdq!nWMY$l3$HJ_EhqaJn3qITFxPj46N;s&XYh z?BH2&>RPU6ZWMG7w*-;J<~xWJyQ|Y1gdrqD**8f6Mi*KQZR^@A3#m8|?=0oEu|+OU zN3mqKnGJaDP=_-!UBuufMY*cVJYMr_KWIO0fybtkijgnTs&+AHYIJjpIG-|`f?a{8 z>|oS?pwj2gC!{!_ax(+Zn7UftjAQ%lIc36jrj)Ejvdluo_>&x(JUX~K zS@8f@XZV(xNo@K^cYJ4!H1fr$`}{Xx;k81)LO_ylJ>KGDTs4wAbSQJ>-Qn8-C5iPb zZzI=V&~NzPsH%?^KhfW0DY!sNx=5`d9LIaiC_>%nY#*blj@1)p-235e!jDSNKO+4X zttGyn_H+DWOTxUlJ2Py)zTRl%*Qb@MJV)g&e;!T_SFRNXCF0M1MQ*uD@cTl4E9iAA z9=vR===nJ~-HT>^=^?W>d6V>N?ZFSD%2=@*w{LZ6`)ktoSO1}86(o-*v_)DmjcS>& zEeFw+GQ*=Q1DD1OD30K-j9H}aEn`TJ$5WKX@?bM}`e-Tk(=#HTd)*3=Lm`~Hj`_4? z3*$d+{dReM-b(M;>iZ@5#}{R^ym7gQB%VoRJqtX(l^sgs7sO@p>r?2XaCFyJYVR{k z%&8R1^j>@wafg$7Km=J!NL%D5`;W5=eJ9#6di~^YhZ&mFlG4Zf#xsYLX>Znai@u`pkCjvSt`n z!G_{yR%@G@p9JL%d^*1TVxaHl<~0-qKvgO9bf3TTw@I;GdUjuGUr=I8C~L2CJ~!lXZ1W7++%HSFEOyZ z>pb|7vPy~KpWhojDiW4*=qEYY>0j3BqGZr|7Mx5!={6OT>hTFFRqeCR%nnE_NcpE^ z2JE>Lul#Ggyz(Cj?{c8u_g0^R+SKoZ@b0kIko|_t)$t={K)sMtZO3u9V;N>$gU1qp zoeU&Ukyf9vGI0TENBC)?1Wi28UDgKr;od~%*XHJj?LRmx}|6(8{x zOn1sD;VJEV8C0K2$_=XSp%Vh-lvUF-%tu7D|CR~nAfg{&CICHW>Yv-O{lH7x-KGZm z{i@$LtLZa!2ZOh8x`ZFo21#tA8{39hC>0Z4WZijF18Hp}X^QQ-P2fiVMqB*Cj|W^< z*}ZIti!fv<^|i#euP#7Le)%uQ00qU*)b7um!?V#3?X!zVrfsp;yLsz`Z3u$#jMI-J zl;LIlW>vYo?3x3Zue4m=Z93Ds=pK`kZa{--FhZSM79baRY%JIAh%ZkXgU{-gH?O=q8aoHMr{1o7Xmh zoORei?bDR<_!Iph{#VklcHzp=aDf-9|PWaTuJ3Cq-D&}^^s@XHpw4y12}libl%?9roH1{9Sd5|AdDMbM5?1` zosE9FOMR2AGnJsV6s^wf{M!0+;29f@yF1C&%26vMVe<9%^N|<;KS!9L2C`CoFuswFui;i0d7>+AXi!)D z+e*ySO;!^@SGUv&Bf3^z_rHFs;!n6G-a%Nl!n{$7Rxpd=TxDK-w)gCBC1RWkJrf-s zu?)w^*1ncfd{cZiSlAGfotQ~n=pN?yT_V^z9QNcIHOPM{SogG)<-`QE+p*IRPNjoykWW9Iu^(6K zVch~%f9P0-S$;w{=ztjfSQv9f=D<-o@r$-o@`JK%yB1w$#AQ&H7X+uUeeOczhn|X) zNJ{14Bp1g}bqZAevFopHjVZBLk>$n8&hZ-9lHN!8Zs);ny|rQf7!2|`7yhUzm?g=1 zz2zoMN8>aei`a^Ozeli3ZnjJw3tD_u%)k!0j!p6O%eHR{xp|v3fur=#p7KH`uLj-L zq>5rNuY-v-MT&+2nmF|_rl|F$-x}Li7wOS%+=iNMsV;3lhMZ2GkfLH7xkoRJEz+PA z{g++iD1Xj_2cQ-eG!vz#Ng&L~`nFDcGPv1gwa$83caJj_41pbnz4nAY7KB*0sN1kt zJJBrddN*4Tt<%?j|4nJLs;>H3s}Ku?OonavK>RJ*$Quc24PIOQ{tcc^yDng$cZ@0^K@zsuuK+!`&$BB?HVTSr+C{BCPhWI&*KVSj#rsw6CI4y|$($J@1R_O)AO zrT6Pq+JI3y?ci^1RHA2UTFw|o>^|KBPS>!)UT3`ry+IRiH`hqTg@sTnmy)KYv7b^* z^F^NxXX6Dyp5;U8b-K`Qc$GpY6aIvlz9z^APTe|nL5g@V!*n=-Gz(QJts4}?B(}HS zFm?%7wX=G(D`_O*!ArlWgyDyxRW}tLFfr|DSLV*69o|m;dil4AfDhmw8pAkMTdK?J z>~GJLn0u~B4W9` zuGwI9I5&S!>$OQ&CZrp=r3;kZK6AGN+g>a6n}w_`>{q6rOyTFdYs6Y2)Ky2*e~hVP zh#L}Fxk#fcrj`lDHOSaYrm&^n7!*>uC$4eq5a`LVqwHJY|IPX*3@G-KwftEbEn`hG zImP>#jXqT0)o)V|dOqMYGL<`hB&VS|e{{Xcwcfmn50-XMWxK+%c6V5dkRr;ZNNSFK zr;G2Tg&Ex=9~HE;Z659!;h1L?5#3Y_1?@1+uid-p9E=dKj3or;u#mk5*AAt7QHA1XLXz0@HxeIC6d!Lp&q>$6gh2-hv zM3vj4_BCad6l1d}8B}o>d)ILmKJzF@S*N*I+C7gu8#vXxqh<_|tRfxNoe%4~kzJNu z79`?|9oV*S?MCPJw+$wKvE61bA&q`Qh%$>dwDTU3_OyJYAMi4`=f&PYKVOq)WhguP$W9?tpNJ1kDe{E)rwpVbm9nzKfmx*=TxolLO?TfW&M;7YeD+Ysh*Fhia! zg?5`m;_)huYo)L31dkga^VO4PQ>8h$9?I_Lrf)24Py^ZUfW>@b^S zN>5@THtQaML?FL3FB4!trNnv}FsMF>Ag_|q#6NkMv-@TBeEm0faUgjG*>KQflP=M| z9aY7<;dZg_lj}tc?r?LS(vSRWkZ|*v@KP29!^l4GeJZEaB;1103W1aS`h!B)o7<}T zfPt*W2uhuSih79T$5KoF?vRYKZKf`;G8hgSKN0CmU>v&E?^KrWv@2irxMCeK=W0L1 zl`f0B!Q<>wxeFi^+~HU1fmZDWfR&aU<)-L#i}n^GH{3C99no&6Eol?JewBj8;0n;W zL-&4Xv{{hDyKBR+jHB54!ueaRR?owXxr2P z-tgaSm}%o+hUV{1D1~l^J-fBzpas0tL447s`sM~ByOlMTfX0Ekd}h5OoxXXpEh4C`xk+hO3hY94GilYI({jBS>R#etCZECth_wn)J(1;Q zs69Ja|7`hKO~;Himkz>IALJi+_3co{++3dJ=)9s1sROxXj(KXnQqz;_X4BVtRUx$h zezMpA-;McRNY8@7JtG8ypyqZ&kFgR0yD=tpe?-jwYwM}2kiskHw_01Fw{<&CjX|_V zhAyZ~F=5*a9rK~31UXs#w2Fy@2YmV)gc0Q~O>Km{Nz^A*ze0yjb?U`*9}U{@yunSL z&tC1NrKV<`+AR}dCYGN5wjKH{z?4c|kuMb;4${nj1!=fYxWb10l zIzbm*x_>(WppT)ZmCj9v*i&9NU^$rrNuH(#Ap(C2nT&v^>+A~iFTgz`w_(}*q{OMF z^Sa$&O?Kf?QRD8kHYgcQx`B4bNqW%5XQkd+=9%Z>@4*PP`rC1$N!9a>N+#<`= zb@+F^47-IZ@65IdI%Vg5uu-is;H0)x60=WNp@7V{1#imE#IiHi*llg_H5a6gcvgOa z2J&0G=w?@h-!9SIty(qtXePnE*2R5;Lrpj7aXMP>^G_=^&!1lJda1f_t2D7<8JP?( z8OW-N_6FSnZGrC+JO%CIL7t2%oBj}enVq_s0QkEls-;PFruws=m(TJ_7f&8%Pc$73 zRc3psy4B58-);nL?E&-JY`(pQudr>FyX%ehD!k^=MF>#1!4v zi6l$1OcFIy7$a16v1UBGZ|G?&5g_<&sRe^w3$Z%AWpY564ILFX?beq^(_qK?UjUCl zaKG&pUQ)ktFwd`}>a_C9fByE_-Qs)P>uV3Nu=97nX)&@x*c60%xa5*|!^0()le*+G zyZi0oa?8CL?BR0D3Q$~r8|uU5mJ*j+%G&?azvpryq4OS*--io0Cv^cQV(*B&;BU|N zI^x}s54VOs+#1@5j32}G*AOz2hVpH=)(?j3uy;}NBcO(Lc@6V;`xJmZMp-^MX;^J3 zZI!c(^yr)T0yS~3NuMyhXa3NK?~Z)8;*VdxxqK^gquj%tib7;O+^KlbortzMCE5uM6AUM9m-D1Pt?%`z12bz-8)-0vF`Ei zS-zoScE}{}pQVg_z9r@-f1BGuYwwXuA@*5mkId3g>*|r&Ja`qoH~xCAnZM_Xmpxr3 zFO$oljLJ*GtMHUE%xCE($x0Y@9(u)A_Rdw}vZ4}s2_SG2E-yvlymyq9%V#M4-d*gT z1uqcuHg@@8#Neb{%iIZaTk&64m-5n@+Fht;Zw5wG#zGbi%L6@Vp=w9HO99YI!Vf=% zo&S_xfFI-OeBLm^Pt&_a)O>#MesyZFLO4xE(|y&y>8Lj`PZ5i^Ov(O}*D$wkF6pVb zAJ)iAROL#|))n;tHOh?zOkKI-A&LC5f^a_W#*34HoxJEo52n{4#uCgs9j66(|88zG zfNIqftE(M`?y~5ud{wmJZKH6vP4?)^Ao{pnDSuYpkfQ9Z0xmPEwX9G{Rtex-q35xR z&s~wO7P1Nh$$EKHDl*j)36tC}LHjKYVj;rt~(&kNnkMyFLW8=Cp@4fMz$1y!7LL`lf$P9%y1ia?=IsK-|h@EX^A#0`WJ#0f0}s|XyMkFHW4 zJ>`g@ryOi3ddhPzWFRIPJO?t7s7P4kMGQjHMpQ9K#Qlq#SUQHm^tYgpUAy}vl$ zVHgz|Fp%(@J!gm&vNN(ajE8|tF_0;8?lh1o1~P>(hJj4sg{FZ_k+~d8d2|v7zp7O} z3}lLdOd+Pvs*oxA=YZ@E40HkVz80ZuOonoL<40MX- zZYkLnSx^$QsNjgV*sNkPy9$cxgX4gKQz`gk;8gG^Y)FQB<_SvkjBDUj(qm%aR1BPo z`Vv|tIF%;$S_83SAXe&!Sh;q>`FIu}6ongS3}J@T$IxvLWaTO9{w?eNjCCKwte_j% z@9bxTv$8%oD@A@@1Gz$n*g&r2bD)7-SvANNRVB&5u&_S{hJ}uUB&}K&4^$kpp%}5z zL-i!`>v{;Tv0@l?u`p)kz&lCP28PAJu%!MN7#1s;UPpCSsRI^sP@DnCcC0A!J1 zhIC+9MvcR;q;t0PVOT~jz_4WYVPIGc49oh!u;>OeCli6raMgfD>Vz64eiPgf}D`ikF)P!kJT)L0qqHLcq$S%2{tio2xec_Mn2H8bl zA+L<=qNA3SM|c@kKzK<#t8uJYFNBvvgYeP>!pkdr`VCIg1kq?C;9NvTY8uW(7+-_k zA_^XZ-6C?5!ERx;`{q{)I=JIHMRVU;KpYi1Ic4K8BC_BH*ArEDYujMAWQ?!DZZX&` zgfR?ui@|OwDi>j}Th6ASe|j(~U(=OzYN+*qw=8^?yPf*qWSVI5+%`DbJ%IlPl3P8g z)1Ft9U;)i4=u{TF-D%-vS$p)x}4z_Ik1j=1VmTA0OQz)%briUC8B6}0@TYMIO; zn4#rX%*5~f5AZ}~S{5ZxniCY6Xp{rm_RsjcYA~?!60o5eh zs5S%KrWn_m=3|p{UZqjMyL`1o%~n;UDiy*=7)X<N z#YRIcia5*0Nex{>Hc=jJx%OjVOxPa-V?xIv&5j1fgsedWW5Nf4^|$tEisaeM4fn+= z49b8oZ+ zcs2ALz4<#DrfK28Az3?zdvt;@_?^WJTR6>(&26fhATMbPSWSVc)k_6Mqfx=_kJ9}u`{oL-NWF%O3hz4|$n8U`w>^+fEI12pI+g9g@SOjO!$36BU0A zVo$#Ig90MN@$SK~4kCnZ8Hd^cA_`qEiIZH_>JwakbV!lbpWPg{R1;^dtSA2va1JsS95Y-K6a$5UfRmTwO~N;xJl-gGyX53i zV$;lBlLk8^ajuO9+hB(n>=1(;A|jrIi|gpP0f!p?>&2uwpq3B5=Wrq7>KH9w;lV*= zvZRqg2GYbpnourE;}0NBWDKeZ55MqNAs0e`Uc5b5g-N)F^->tC7b^`4aeC~a@++@g z@HOzZc0O*2@r9p1Zt>BW1tH{RlXHNUdmrmz5UY_J&^WW_I7f6pp0a&jh=u#V{^fW# z{=|9z?gByEgZ%Ksz&KInfdchoU$FHkG$Fx?f>t=6PhkrJKo)v7ejVwvTSyRciLl%g zIPozI*kGI}j)$(U6r*r(>QZ^6la$W247?MKH(4U;NrFm)eWD-?v>{sXL#bT+4&iuo z82dzj+clUc2J@tT%o7{&VQW|?$jmz?tWSYX-~#!++5jh_`8oq6AhjuN49>|F!2x$B zWUkj9=_IWr8N3t8^2O%MP?CsL0`Ek7aT(N;%BUyWV=ihx2J@s?5UHBZbIkI~wU@u3 zr&%4(t8Tzo=0@G)ombf-2qCS+ot%9r7rb7@mVGV)r;ZRhNz=vQwdLc5@+e5?0b2?0 z+Eza|f&eK8alVsCFAGsaji^O88swA2AA@|-0pydT#*t6bxmNl)o<}VppJeu7kWUQq z$@(Cl)CT!VBe#%S>rYjb8R6r}*<=@Xh4mejXQ6+{4!=v4U)7|0G)xp6} z_`m;3WAiXQL!Nn%&OPXX1!R66C1hv8`H*ajoFeS7_^)9U1I(T+0-WUWq%zD2wFek@ z6LG8!yh$VQCP#I{n`A2hp4Cv-*9+g|*x;Kqfp7B6|LPz>pBJ!Vu*}~C zgcFgMnnpND4za;F5yg+eI1!o2V4N6?ljx7ZI58L}njRNR(dA<4q0RRMG>23seG=*+ z`Lw|};RnQEoEVG~gK@In7$?Pgzd<=MC?~g5{~H`1UC%`fFFV^tykbyJ49bZ?Iq3w- z36t%r=`tw`5o>@vF9Vy?q_hd(ljHF{xI_y80g!Va!dz|&(uE-G7p!X#o(H!b=Y^%+ zqKX*M9@^J?FQNZzz=P~Db5I;0Y|N8)og|Mg^5qi2*;^K=2b?t#Rpi9c9w4TPKo*9z~-Y8C<$dwSht@ zGsfyS8z_{fp-{M8y)+VvL^Eg|2u0&PmWP9qAkx5~GzNoGb(7v)B$P@UumMFepeR|4 zSRNE55}UV_C0heXiF#&>fxx6Boq{V3mcpzxL{jELrlj_-Vt|3P7+zJ-l;otZJ8DW= zqcWf=&4Q+AFE4|cQWZ0$ghb0wlMH%F-RLRZGq)S?6a$`Oz*An4cw;0nUE~y`0eo$l zw4~1T5|9IZ{W65gnRQY2M{%LT;SiVeA1Z^U{zi+{9PKa8^ZJ;58 zOLO14S%g5pHOE3Bg}(p-&_SVOF0P%N1s0J9=}-VOGEAYK+<*^e&Ou3p`1Q};UT~lx zD*~XxS%*sCr?d)g!bmk3Ce34*Op4#3Q@Q=!rDUbFgD@1#NG7Ib}%ivG#5(b*25onU*x}iz(w%79DB*zuNNm9>h zsKe_8PI6+vNtyvCAz~WO`cwPn%VM?}03{+nH4jjd9_EbzDJguTK7h{_Xw6`3@Tem~iV1MEWC~^FUpTZk*rSSe2i{ z>XjW6wMRuv4XcMAwA0Tt$L*494-MV7dpI*%EH4AjZ}5#BoU{idmEKX)m+K@=Fg$4w$;qIuZ~xcDZ`ZjjyjOSV(w8KxQr=J`Bl`Y=B8b z7Tf@bV*y#x+Qt@{Z|-zzIp48$1X&0Y1_JchBg}-w^ZHKVSm%IWMBAWbV-tcaQZV^> zwVp+sd`T)31Zs#FD%cQ{z}HXgA~H<#*tNFJPI8_ zi9>PK3LI#tvVsVrFfac2n?yE}nAv6BL{#Ga;fl`b*%YpLFe+cuDZe$i8L=>ra3z!& z}2rsI2X;MbW5^^D&lLLM4ISt~Kt-=^uC3DSdngC=w zG+B0>aezwSXeAnimjWD*T&1fy9FKydvLeAkntOA^DjnDqNtP(Y%@JOF^j4%gspMBD zxe3^m;o%qogXAL#NFYFRf*(tum<$hVf-zYNGRcRh?+hr30VU}KD9P9BpglYi#Q0&8 zP$Y?!wK*sx{EHg^5(7Z8fdC|_GUU1~q)pd4Pp>!n2xktkm>0Fnlp6#RgFqtZqbez- zZ6c5mU8ywq2(M}_0e3`=`sG26#Pk`ok;c$QD(%Rd3^h`5w>5Ah25zK&xRD#4EyvfG zEgMH1$?`^Fl!=wZ6#;|GOFx|F0*dgvQ&Hx9O31DrkVx(%w*)0pFdkIB2_2j!lyB!R zfia@Q>uPuoDpsvR>y|p3=&En}3yfFe{KXtSxxH1uGD@%`k!w_qx!cp5kn?vDJ_B2A zsa+q3*8%u}bu=0^193onZGlvcsc}x=AN; zD&EX@F}X88m_xt_Nz?5pz2A2q!rcdmZJFX6qFwC$3+KCdH|iq6G>>YR#!YpZ#NQq7 zZhqe)k*c@;s9CxpHLT;JjVd3NxJGYp&}JJJw$w@DIx7!oEMgZ)`=@`crtB_(Hk>_$ z7KGc`;e)k)2TuL)tpi?ttiyJ4WdMl~msFZMeLr6%PhV+*D-Nl?8w$F6fZ2yQ%Sxn{ zaOISs)D5565QL>*zsV&Q!l$Q>?dejhL<+dLkFr~bQ$m!`A zs|v_y==pQ_;?HJkjHhlq#CJn*%q7vAv=92~7DH{LMj6XtYt}<`RhBo0iL^w&U=q+T zxI1^EWS!K~+;y##6(Nr)H)+@=Yh9cwhAm+Vl-XX-TA5y4O6Eyz6Qz=wQk`GQm@CVz zZmHQa9xyc3y8*c$h zYu7CL{kmfr)8Ufcj9zrU&ydTfL53Vjy$Wbb@KsI{i z-J|lb=jQgA8ku$1$V>punDUr~AXQ(Ba6Uu?=z>{@VMXggHkC9j!@JFdmDR*>%%dQo z5~PukYXL%5gBI;??bB*QXEQh47v@NPB;P8VGkf-8evjIZP*976c7)?<%42R!dCZf> z%VVaCi0D@_I%%OiW@aCzJfvG;>pGm}*2lypQp6&epaF(abvvR!6BGiA z8V+!=Ome^>G+6&?y>mcJkL3;iXn)I7;FqyY=BsZYd$Ki zN+>}b*m{vpjvXbxXW_f|F6knf6w!eT@!DPm&kSD7E8dA7D=;3U zig;R_s3RqT?_J=(M}GmGdiXXfe{ezHLT()2IUcGV;!Drok)C<&-Z(NY;uNKWz0vXB z;N)a)czARys~kl6;H4d6M6=VAgTcY^$-yD~b$W6YeoKcZ) z9QvfDA^kmB>ykblo!w=RO3v!+If?Sko@%K;=}G+sO7j(*@010twl;vA>L;w)af0#vHZY!>w~vrGwPFytkhV2Quzp*(xj_fnpC&MqIUI3jT(%m z#G*opMN=a&q3EZpJ#u0)St>5c{+V71-Uz*ws-Q}52CMRx_c_1aNFgva5(^y!rbeQv zk!Wfp%J%8lzE-+MqN?te-JWRaQh73})yg(9nS(ek1uKg$lZ*r?(2h3=-(*CEH{@MU zc4R6fW*k$n6;#e21;>);rhnmU>#7uOdqa| zeTKJIr`pmz*q95$AUNf_I0S;}Ex+<>grAqKosU~$=*H((>Z7UTC-;!^4f(LfivWfF z^nU#dS*@SZtM7y9_Rf!9Ndjgz&JFMFvsvF|d6Ua6*~bF?K)OGSZ(V0P36-mGP_}=H zA_h@hAW1UBQGkgW9A{JbQeW+je_XzK-KlCDl2MeEBC#hET*TI%qCja9E{UJ9&f$>n zP8H%KH84`NlRveSJ$oO7SbIItDLV-4N7Za6T%u1s*{MYOWnC$5uV8h6U^^E~>}F)* zk$Des9A-!evk?CZ(L>ae{a1MjEvsr(-rgM5O0v;5Rk*S6TVRBD6>m&pN)IO?i-fyQ zu@GlIW~ZXDrVx%xDm!3sC2iE5v&Hm4o-`HV$zrq9WvuYjZ0+<`DNTr~Dcwj6iqiBb z_tvsj#>0A7OM3HcYSEP2rrTUQ5(@Q~(DtgVn3N1&xmD9#rq6{3rv`iK{+YqHolg46 zXn=ny#SJX#F@Cgo4XRl}A`4^DXsQ}OG&VjRP3uRQDb$>p-<? z;EW+o0{*tW$MFrKWgHM<#xvsR$W0T}uviJrcEfZ<5`D8)`^puI1z!`Wnru<%oukze zo|H^LwArQ7@L*3-iKt5qR=jLtN*H{U%??Tg=s-R;L;_>b5@w!y2`Piu*bpfsVQA?i zqE+j%K{~+EvhUrZp zn0V?3KUu-u_4e@SsBf{qcK$Csg;Zf^6?9>Xt^*6N1M8a|T6p7hCMfCb=Y7=t-+%op z>+trYT>nDbJQ9zvDzVL!-^RB-|M+=-_V=oYcTtSO1)aHY{}~lCWhGm4MzI_-g{nOv zUwoi}oxE8TEQsFa7Z=0x<=^!Jy!*9VFp9ChRITH9m+}0>=~s1=DJP$`?BdEYx`dQ& zOHS7VPpT)aHRN?O61#bs{n{60b!dG9la6(Zo>Y|8#j;arYD&t_3W{SHp`nOFr-DIO zXbtz(^eP>UI%)DV zwt(c9*@r>$Ge~}GfaIr^)2IjH7eQFDBeX?N&V7RKcME+I47_QUi4j9Hyy{!w%(-zP zHU{Ih2~A!8O%PDU_h78o{J2U`fv4WCyDcAtAI zZvx?X!O@N!v1xlYdlXumU=Ts?4!^oV`KuM>ZzXa0GI95c5MkaqH$IU2Xkhu2VEGCr z)xg_rZ(UDq?+ci7WjY?nw5-ECGaoPjsB~g?&Q8UB`5^(3V^D3E6gf@?G`FencBi$$ z+ZFHn<&o`9Dz%Nv{GIBo=}oybLvf!d`8*WlU7 z2Fu{t89cizOQhgHNiIu+XQxr@#^Bk>)S3uK3V}9Biwt=(n5G1iGE^wZ!9c~3o`8>1 zFq0cRJA-Fu@a)nnu@*c#1+^`^DFbE4|1nT@%|Y2+g#QV*>^s}T0es5j^akGsIWe&@jzV7CN+wCF3FAqkzFr4|#)vZTgYj4x_`y2h2UF;S z>j^%nlzyigeTV|tsV8zg_j!!X<%SPmj6J72d8`-!!lDd8_F|M|pd3qJtUU=&SyU)EFe}WobE-!F66@qycg#|C0LrHyUZ7Nj7St*fLg0RxC zD{8}(NY2$KNdp>MgCaM4W_vddN|!G~6vT3%C@)p2+C;HggkD$nk+oEI^DG{sDyU}m zC`N|V)6f(VB5Op6Or39-YM8LRi73qR#jFMAaX@YsT(>(l#Pz*UOf6D zxXtyGpsw^1N(|wutfI7JUb_{<>5KMMsgjqliuf~ZdI>dNkW8QYm8?TXS5f+HS864t zMBU0QrsgbFrbyW)6)7vaJzD*q?>S2^X_g9)&9&R91CSTl1~;p)*@t=xn_VY`tk6Bpuar$B1 z+aW?6b;EmSvS*z;bK9MUKf#k(@c|?Z5|d47+WP!s50&94C=lZQ{b%PPc?Zf6+I8n3 z#BbmpR(k_eb?rD9yVRe4btZi)^sPsKVWC&Mnfjq)xpU~%dHDO!`_OWJ6%e%qOZCbh zy0Ryd4V9%#ZZ5}iB@YZ5EFGnjvNV!S;4a-@kL=XZ%0n(YfEpRU%z{j1U7edOelg3Mtq(M^k zp_!kwP>Lk84^xW7lpIRFD=zqRP zOH&ZPi?s+*;KLcRnE zt0EGbvLP_}rfi5DSo@5zu;e$imQ1;jI?9Cv&eX9(=QXX0kw&}a_V5I7d{Wx+TfC{j zu~HQ{p43)>BX_eaUwq?9h2k5jXEoH)^(wwGI55>Wny9`3^E?NQ>%%Kn%4#Eua3r{? z=_(wlK{mxWWMgKEahPHp@scvdIMmF*eQPVn)@+J#Fy}#JT`|QtvRorFYcAtA;uTS2 z$x>F~giikPqq0XwZh{3xG|PVxIeB;;JocCD4tV`JOClxJ2E2_?K)~MF6s~wMDqqu4 zVKw+1e)sR(8?2h&PE9e6hKq41Xm8mqnwlK^A5)VfrzVHgMkUIaJg|CG-yt3gQ{O@4 z4O8EtD7ap=WQ$3k+w3F^jbwF`fw6fR7zU8d0J1d-Jg*4_gr6~hY@0nY29PZt5(CJl z$!rFYEwQK!AX}{*WB}Qe$HTx$88|5e%x18pD#2{!9bJF7!}&8*o#dSZ;nIQg)_1)* zH22{ZE@@y;iMoqQ)IlI2np%{N5`-cbg!&mN-U~@7jdtLK&V45w-yjmk0ij_$Lqv?7 z?`~L2nzhmrQ?)7P^8+fnHF>irDu8kM#l?yB`FFjrT~zL<=8_H5u)u_&3RTHx#%rW3 zD#D0pV^j9-QRcOpIVTP}P`2hYo_elYC8^lDrJjtgS#`Dk#B|;C^w&Q83do2^CV&-~LqPp^6mq=Q#em=W$f(IAkTojCv8epcWC0&SPs_1P|z%o@R z8pQ-i{PHyl4;ZCOTznkkjo?ai`LY+2T+;9HqiU(0T9#fQ|62-1qk zg$$Vs`k+=MS*xO`mXAui5U^$;Nmbe0dcP0$^qUPKs!VjZPJmj~V?A$FVW(6VZM$2& zDxo!Zu3Of)=I%+F`cmGUFZ0)S-}V#&o#8~wG8FaJn4*7I$G59p0ry8O6aNBE;*Cr| z?HZ(}GJzrJQlZwh*&Q=<6@!3Y!q%7?MG@;z{26P|`25{byJHUHwPbiq7g4PT&@pp0 zt*!o?JD1&7oaKN#6-m%013y4Hk>)ZjwH`c1fn7EcYN~a~V)QBmsH)iwlJHOeT21X} zkOp1NyFpT5P2C|Y*jpz+;9kq-P=ZvYO@*omDJ4cq5LR-CREH^H;nycgBZN~ah_k*( z&qe4p$%9qTHp@O-GzguYR^AM7cJ?0woZUEZHdTME53j&CNils8IyMEyRt3}s?~Ul& zOw>!rIOP@kGnZYbAh)_ewlq)*ML+=_mqZebm5&m|Wze)-h^m1{_};Iz1Rvq1cnK)2 zeL$H6opWNIuV@ofwGC8^OQLhCU=ygc+vTkcVJHiEORsJy$Fkij7^+|?&|4c)j~jda zVm4Q_60~$oSG5?FBBvBdWvvHo=>1xjgf<9Lw<=UPgQyatV_|5494%`@3-pw+JhVVo zNh?Gf++E?|uOp&Li>Z=CRv0>+;VWyYD9>}4I@Mc$)XXdz){82 zw$W@k7A_(1wD&8C`P|N`vWNA(t6l2UBc~gwh6l2U@ zP1ToK@{%dWSfUssDrM1dHAYFb4E;Ji*^Sg#k1@LwQ;^XVWL%$ujD?Wo+I1PD@{6uS zNu<@H7kC$}0OQ^$dD7l_fzlohr&=AfbZony`3vKN0XRz!Y>QzF;(vEfy zPIre#R|f|_;s5?CwXh@92YH2oG=@CJUO116Xi0}+uxFjY+3hZ~DkIv)1NR!%WMBpU z)IpU~(XF@;1)6(U*0cx>t*APW#D*#InA!n;NJ=TPf`yl~exj`0Vn%hdsOBR5J)>A- zR9a=_iae(Dy2@1^b9d14#U9gyYE*knKdhtmu35cDT!SZmRwzTnBj2RU5Qz`Mp5%b; z@FwBI>V0&+!z&@W-^E3u_a{CTCMSc-V|$k0L8IR_swa!lu%rY`{#VM^ouBUQeddqp9>L-9S^Oyk7KUylIo5 zZhq%Bl^)BKOf;1qvm{bdXE2o>OV$8omVpdU1UsNyK8B!)5`#oLl^zvUx9sLjnMeMQ zDf5_9=22pzO9~iM<`IdKKb-6P40oUoO2`I9Dw#5m(qSRdNm!)8~(z{ebZRZAizZx(nb^IFen;}@e)Q6M|vfO!Ja_i8Mc+3vrNxt z#LdSZ`n+0ccA`>H0t97Ei;I2mJ!g|j(RDHFm({r$^>cVq~+G;=w7KUx4CSgUo;;boa%-u%>@%+Bc4Qr2)zVrS@3IzE=5_Z( z9rY}qPgN<@5ja}ZmEkc>&XF4?YlAIIo{2XL4p}0A1qdXGewHsdzlutOh^M5wS1lC` zS;}v1Vj(}fcW%B=zQn}fAQ<$q0I5OIxPo#$L&V2ns9G|tOu;a9ON(l;Fzr%d?Gy^D zifXS{B22kJSQF*J)Dta9Y!wcvx;PipE7LNCBv)QLj%QKEyj`G>_kb+L2@0bXnh+(4 zQUS5ziW=pLhb;$~AZt@Jl@m)XANXE{OO2VJknSg*ugqhfy2U7?fp`}!L(ibn?rjgDg5 zRS;#D4S2)~fJd;b`u%Wm9VJGD`&)hf`}WRW68K?@OMnsSWx;N!5yjBmt$msv2ZzXT zUp#dcyhl7bZ;;Gi!#(RQDj1JXTOmrI$Eea=4tP zqtyJ3#Bw;JXdyDYd?uO$z7A|8`6(-RGj>TBc!xUR9maQ#hmxy(sm(WXVO)bMI+IKX zx3eGYjgI#QCntNu!=qza)-BD{cxi{&EOUBtFgQ3qIXHyBPEU>pC&woVVw0!EUf@i@ zn&iCpiGcVkkDNr_bW$SoddT(E_P&5KMy7$mX+O(V&w>M3vUX};`JA(f7%YnNSQLZW zuqX<5IjBABWCUdh97g|b|<|T_piySah5cB)!CwB~M=YlPO^uWl{Sn!7Ji^RsR) zQ!ks@0z89W4bKv#BbC4qG;4M0V-zS+;fBwUlt#L|E+KIKLx}n+lr)_ZqF4=7m#e#% z$55>EHJOj6sh}YG{4oD8!DfWrTeg}X($orL&h;`KdCjUrqlzm+j3qLAuz(ce*R@VbdI@}rrzOo3Q}Is8b9CVvg~mO@VBDa{CI?l8KhenTAJsvCN(wXvssfwsGZXq)D%_EYz>m2 ze127N5jo&_;gZGsLe zo(;>cjH*Z5T#ckQ1Svu3Z3{B0q&{`-fOA<{kNU%gvqeoR6q@$nt36dxfo}W-mbrss zcZI{F%J7$U z=T+v~TuV=f7@4lFF*$X%V(!a3&8iNs&iY%zXv;2}v{sTBol_!jt6wUub=Z7bYdV0p zL?*$ojkMOxPE1;>No!q$v{uc~P3_9)aZz!U(nxEFvz%7eFa9m=+={Xp=oS}RUtQZm zL2E2U)+C^IApsR93ok4G^eMz3z73G0>qeqH^>VT_5F>Rs0X0R7$(*EPyV+H|hqYx+ zY6$%bIh4aHIh3h~b@a70%b^^Z9LidAC}|PRZHqtLM!>=HknJt~@Z8Tzd#Y_1nDzgA=72T42P8lxXb%5pp%_P@{A>1YUuYUg-hJK_aYYXar2aT@LNN>fl_#!oec~(qR!g(YZ%* z=%w!kH@F1cC6X=6$xr6v?O*!~R&;VdBcDzaWCL>~@A;@5bV&&b2DUcjO zcC*hQ*-aauf;9sw;A{IRIqu((Xw6pg_M(ML{24Ih2l%5G<-Xy;s2Vt;rtoB z`aYO$@BAp6%O91)V6(od){Pk=KU*Kb}YEq+6Ub_PcXteCI zWE63NVPY8U$pq^^_VgS~RQS>}g1}Adj24%V=~nWZ;=qwxoUr147MRx)|Aa^#p047kJ?5rcbikPok z0<9f{Ht;~r@hVHv+c(-KV!aanVNECH9OwM!Q6 zlxjSn>nG7)O_lMaH60{vTjI2xC2d#+G#w{PG7acDQCd8CS8}MdNGGi)w~LMN-{&2r zvaIJ~2_))!F)9+dENhF7XJbk7p`@3iP5Ys?$D>W+^t>M}E;e0HNQ+@cpHl7>Y|Q=vxisfGo z_Ww?#MHI5>l2Ri$(FY=LHgy{EkgF_Hods0PIWKH?s&wP!7Z+ddaY{w7=mLeJdi0r#j!}QeTx%#7EUil_^FI4 zi>x<`thYT&E>vv~w0eZzOizMXI6=Q}!K@WJmg9v8`WVTtxLxp;*{&B_wk3#Mp+k!P z4bMTlcg~!GC5O1+g~gVPiYQc?=91#Df|glE^zet;Tmgg=#jAnm_-f&b|go)HX{Pj+!rFm@b`BqNLBLjS_~LotP4ari9@dlrSt)T_#!O z;Vid^;r!m7TQ)6HhhSbGEif6x`D2Lv41=Ag|vkaQPXw*j0?2AK%G8t)D*PzhKCWF%t4)#XJdxMjcz2V`}v8>b< z9nY6`hz$^@CkKOrB0p$TM_r=holxHE4X+`3qZ>1MQ&`B%291qDs}hu3Z*JX zRZ3N+9@f#z*Q`|Kp(#~aYpF^M%J&}&_vQ=L3pb)HrN~8%m8DD$t|>vex+N$#yuhHf zeRc1KAQYxk%lYnxa9jn)77Xy)3;yTJ?3ASHLFjY#>R1(~fN`lIWjh^p0U8*}sZM8Ud z)D$0FF8?LwVy#&amDGv`aEv_Wrg&kM;)OT_+>|L?t1^WufzGcW1OZMG=Ynre54&!? zN9H}mJ((dPL!!RfuM4BBTcuAvi!dtl*?e`+^{MFjS5`^SysGbA0@PUTnw~}LLQg^! zFAcH1npcOuIBj!{=$$6A3*RP&a8+vGrlsu4Etckzr1J~_D_I2>W}APJr;iEZhrbl!SG^oHzd%uSC}gNxU~^VGuc?0s-mQH%ACScRYFpYG+ zq>f7|dum;mJ!;k^Ns=!6fB4t6ZJ`n=Wwy)`TV}M{#p4cV_r>-Ad{^ONM_9r64Muk= zG^*C1Qe%Q{kkcG@zU!!#khQp4(h{ECJK&~H5;1;P2==VHz;lF$>O#+F1qwOW81hCp zkW|zWQn(s7*}O$jN=exm6-c1r!9kUiZ@sglWQ>8M>;xs?Is{%8_SrE?x=_YhG@yXl ze>N5r(7Ku0Vff3Zo-=Xhez1$e$?gJscK@mOcf8P8x;9D!$bkjK5Pdw@)p{WD)d*`B zt=?OZ?+{0*wRp=dUoCs80k>NdaJyQUG-6g~f^vcI;$BB&xl(2*icvAXIIlyeEK*w6 z))tkm&~@7urCCNxv%*K==BQjEtL~0b)&fd`*S1O3)W2GQOU;%r)zVrucdJ}BtLA=n zOJddBeTi~cb#s||Whm|PRoW%1G|N<#s3oKnVy0PwN_DmSK8$X2C(txE0MMBUn#y$Vj1ymGafR*w3jm~!nU%XK$_9}xVmN|+f^ ziv*r>R##AWgfH*?Z)5WC*bc|Gii2Kt%sb-FQw$(bbLpv6#M7#U*L)ScviqreSb!R) zPR*eJC4&I4li&5+@E!tptaE1$4*&2chzp2#>IQ*;DE|NiknHphT ztPxfV5~^Z}FjFC{-c^>oWGaM}sStM9e1)(yig}503Wse}2+QomR0uN_!q%WdSP^8b zUNtaWd4a3t#fp6ONu4l|8_4_>TK~uWSW65|9WY>w4X*>1UmW9- z@N`ZYFgVK0Kv{H_R1PeK;cLo)nQ~yJ99Wy>zz%CG2bQ;qS1A2;Sf%t=>Xf}xkSI;i zEjqSs+qP}nw(Z$t+qUi5W80qDW83DP@4s;(?mg$}ykvBDbvkEs9+*JB3!ApE}xzS?V6Hpf< zvZE3sWee33T_{kfyisG-z@`0t9q}5Vbn&5CZnqN(>%P1Ip{NC5jR<$n(tN@shKHvZ zYBuVyY)$Xi5=a>wRKABhINDnMz5N|~2K6vgYhA&x?+!M*ArA_Bh9Ld~<4No&I3cl@ zTyd#v(2WNak{9QOJTtETyZ_4+m)J7e1~sK6G=*S%V;|5vwk`CiuV;b2jVBp4+cJT- z666}zVIU1ZhWtiR%zX*;50k8^I3eY5VtKTfBoRWvm+ebEWipo1}v zKo_(n=3o;LqxS{?r>^lS@S~D|J!(zYMdzMwVKh$%`F=jE(d8$w!DLpM_7_nAMcrFK zP^Cw`f!7SJtj?g%%ydX|_G6Lb7#T=DFJ=z%HXdbbWsQ>zM#RJrYb#r+eLQb#JG&Oop#>t6Uvr-6x+(DVF;hMc)*xdAiI?`^PY439 zKMy)L4w&44#J#%w|HUINFcD5Ux=#htgMo8E9iUova<~SoI;=2rV89c`J}amwsf;SWC~&T@_=6j?)sYR@B+d$I-Jxs!P!=Eh--!- z<;m0P*Th9rg3=#Muu5x}bL0Hu-OQy6xg?P4JNyK+KabIO_~lkm#}pv*PL6m+4Yek+ zl&XTF^Gx}m;Yv^#CA@!_Y?2n^NomK`r2r*ZtGZz3$A`Us zu3x-P4QeRe>8K3^+TaYr^$t1@Ec9Kw{8K1+_BmK9LWUeYo?u=v$NIs*AN^dL%k z@^+=%=^bfAD+_5EF$!K;IxK|vVVO6G*w-{-Ty#RBA#X?3Yshj5gP@~T_!|PTp0D=y zogB$$zueF<80Ci<)jSlcxcOZ|6B0nlN(hPNqtXqw)Pwem#^uK7i@#s4sK26PewMGt zcmq}R-iO_y*xFmJ!QGJ<*S>Z=6t(ASqt+Sq>b+`0j6@DJ`Q}fhVRVwz|~&#xm@pWC78*1QW6IxR>@t#-If*6h|CMxtqmnSZSI= z6cRr^HUx!0326M4nir-;1)ZaOn+M`F0a_9j08QLzmMu}2CeK)85T2YO$oAqILtrX0 zR~G>_|G9*cq|CBVhnQ?^af#!b-)t}S25?HB!q;DK$`GoSTxqO}pfR`Gq3zs0Z*(1n zTjDLMp-T$BWemPLqiinLhZ+-VbEUGEZRA*^0h{~qdg-1#g@Vf{-4W4~5$aH%r! z)TxqMc?e^ttCQjg-zI0`8RmFVtmZ~YpRk`OcjWr}-_V&c{Z*(4KIbUVR(4z7TBu1V z?yYJQNRGYeU@d&iS(o0@md-8JN-ZzJ-JUE|nKj?wN;%5emnLg@c+lT=+@6>1J?;Yn zIX(qj8z>I$RJ1v&8UEIqX40BB(;QFN7@ty~2T-5SRvf%*0ZUO))?89LU_qskT`o&j zDtwk944yb1IiLuOb{WIQ>%7bB(WX1cd)%Qq)gxkM_4 z?_Cct=KX<^!F7x8lMW_<`{*|HMurZ6lF|Lw=_tWC&);A8IRn|Rwko3_)D42rz@YR<%&yB&v(7v?fhWs<4A3E*3CrGiKJW3a=x$;G_t~O zmlXo0wbO1(Fn8&cVK)daU%Qe?`tPw1vvrZH8Y5I^J044InkO5p)yDi42HFf84+g%K z#Sa^Dw9ZtWUE(t86vCZN4BM6Kny)e`^ERX;h8bhGez*B9Fn7 zU$#M9&3?LGXavJb&O5cJKErc%&h8>FGCDRh^KI%nGvmG5u)1hN%+@(q*RZIxf0n)m z@as_ZZ+R&!S)>jNtBNbisigs5lBlOup1dY&Zs|!e&f%|~ta>;%3teOUpb)nbsz`H@BJS}2M<)3|g=X#K^w^l$TVUxpVa)PHU1 zUYtbaza~<8WNA_noxW60&K(8nxAVxR>;;X($b&cde;daef{I{A*hS2N2M=s_`IDKF z^fuAf#B*+%`T+4|6IgL~U=$gt=;B%%vy06%k6z)Tfh%!7!h~Qtl8BGrCIqxIiFGeD z(%>FJsB-<=2tOwX;Sc7NQ^5Jz^SZX=9N5}TNAUZGCwMlkN<%HS1`qHr`&#PCpz1`V>?P_*x$ZkyDTH?E7$ z2kMAlgfkvE#@7UA4$8HWPR7~tjvR9c$kpO6a{cqb>%C+2-}i7_md0Oe@TcyAEgbRT zaG0$>2KI6Snb#@PSm^YxMq{hujKuA_k;d*eg z!w67J6$6w*9}uAuRcA@#{n~VYH$!^ApZUD?~g$z-tqlc{1l`W zSp%1mWbDl+yZ7<+09sJ&TyORzE*dzPWa5jTw_nL;ayNi5Ajn| z94x?NbIT$}P~5#RHHQgv`XC}he^T!~u0Hger9=c6xD~$};-w(&UOftDN)CA`c4#PW zs?e9pGa9DY@;hM5De=6#${P!d;og1*+~%QdFl%%yfroC!FUiCRWyTWM@=Z_%WR)P2 zpa&>|WvfAo5U@fVP*Dajk9=#w2LJNv8}I;Vkx~@5+7+qUb!cVO*}3Z0*z7Q5U*v0O zV&6@UUi9Te_gn1=&Ou!kZ80I0jcX$^Gt!e?@}ma`%M`*JU?ElaMP1yIIhcExBo>DK zBv|o$5cJ=XJ!$XKn^lkp>t_sYY=E;LtD|c+KI{MeUHiSaJ#@Rn**Jcj>O?TVlFIhq z)UD4tYQK1h?L#JL*1vVrRg}WQhlX{61Haloz^p^b%3=KN{X}5= z+?g6+_%n)UZ9c2DS_KsuDBJ>%ti4Gd5TXqJ!GB-+xYN|Ewf%$Hc_o{_XDpHsy7Ckh zJOcL0-IaF0+5fs_be=wKAHp){o0ZmV@jmbs;T$z{ZKE{(y%zB`-`zPnN@v;-fKQxM zuDGr(>66cI#;uicRlb{C*n@bMZkgJGt{bRj?pD~c5iypW>1z@4LdX(ghQ4tstT>}+ zDC?HL)2AuYh9Azrevgixj$pJgm$-XwLn5r4)qp*i7lMsorPiT` zYH=ka=5{^ zQU7jpm~}oTQ#1IQGO7fxsSSf}#&^$-JF3qN7=;Xu`DGkrTu2S38A65AgX%5W%i|g| zn=GFqrKe~HB<(0h&56|8S~{oFuZp4vTs5hn>lsv|cBKSdpo$r=+MQ>MDvx}Qzj6(c zt^u82QBPcotVzivt&$M!ldjhi^nzV1A=<6)c;3`+>sO^;u?y`UF-$`j(?3RFubXZS zddoH>@p-osC19%yDj~K(OUj3>uUIPP>M0d+zP(8r?7!b-B}Q6>)>U@Kr3Kbeju~Pd zUg?5^X)X;|8Iq7P!^JR|23j}y!`ca6J?_WQo|y$u*F~Zu+r?hZUws^E9{{G}tU4qx zn4kH3tHdBj6{ ztW#4k(ZxSp=s5B#AOkXBAttQ_%R8Yk!N(K!LSRD92NzH#c}OcJACg2K={4rMt$0Cs ze@DzRX-XVrixYvwq7YTA|Ac6s&N3*ZSJ71#LycsHQ*zdpB*=&{jkgbbXlaYJpz!2O z|IvbqomXR|wVc(8PaR<1*jfU$&?MApwdIj!>js-q`W{X0(dqCj@lrYOSoEWOgP!FiBHa|6%34?><71wDJp5;=)c`tR) z4R)>XnAGg!yTX!p9AfQPW{U4Cxl5{VS5M39fO5rAUI8Je#UJ5lNaP+9kQQZ(?R)D0 zG|GPHpt8>gLx{qD7l#nse=Dl$$oE2^fb+A8Bnw;Vdsc(Xw!d5NMBm=zhHp)+zODO# zBm)6uEU*UN$6G@t_){k_>xF5&$Mc6+sg6w80nO4X(ttY{(0pyXOB&_x-d|?W-UL3$ z)gFFVn>xVEU6}AxNq4Y_+JDywBI2hNPM4{z77~x;hA@DJM^qJTM`6;Fm!d6MweiAa z0=gh71QoLEI$kXoFHwf+Ba~6aGk<4#GWyPD=2~a!yc@9M*G2qHvNNuB8wed+mo6MrlRsRUJf84E3A^2R$f_%XI(x+`;3VIE$~jQ59(6`xjQwKE*YULoboI=j3@z1vLY>{M$p?D z(-H+=R!*Q!*VQI(>>zZrBw;tq)ZLg=VO?pJ^DuolMWUp$bf^t5ddf<%|5AK-%LOu^ z5*ItRr`Db1(fG^UbN<%kJnx=`ubCk-a34V=~mq z3b_(_Wj(X83h#6sOY*(b3tHq1B&by^+0WxtX}Kk_tRj`v>I`AQRIw60WbJnWHYk%O zV|8-U>qB7$TWt4-n%?&RX4w^e=Vu;k8nDxqZ3o74Hc z^o3j~gyG?^npQi0&9IJ}mAf_nE8+)H# zmpAVb48vP?Tdc_wdvbO)UN==Ix!YS_;xM(xJ#G|g3@;nvnp;~MT>vZ+)uA?)P-`2X z|30jSd1-~zR+`4Ey(LNeD8d>mOju~}^3t7geH&?#{+QO(S(hV`8ThU|wvVuz*NWHk)R(}7TVbo@(G1|bJsO9;?n%}mA{gF)hN{&K0NTd> zTKv(Cn2X&LW>Ig>M%-%8k12XOGN)(T;QCUIy|WKjk-Lrzn0ULchRni|ipQ={A?#~V z?cEez@#XZ)&so^$<(c_q?4?*wJDy)|cgrK0mIP~*1ef7@4#Ic}WfvxF+P6zWj68Ch zhd{?N|RLH5$cIR#f97I+#C%+#%zCxB5-CAva z1_^JZ`RseSuC6yjusa3jR=~)F|?Td&$si7(u#+TSN6G8ycdO-L`}oxcYSkvf+{4L;N;^jB+V38HYl-i zZ;jKem2H%Co-7=J?WHiUY#3kg!&lPCsEr>8MFB`xJslMV5R}*?0>4tEi#f{q#XG^} z-QYvj!GrSPLiurVKGnUB7+g;#JOMBn+&R81>)q?!%fuZoVEQMFVI+jJ^{wf)ST=b2_SI&l~ov+`u|bl^PzlV^}rhOX+1 zR7Z?X-a{9mkrYz4^)yaAb@8EeAE@uA+1DIfxXEUFV%41Wb_i6ypV@7!!e3C?oBO^2 zM)_z2?a&v`4tBm*+VH+Yjsm&?5}Zz$1NY}kvVeQIjLrC69Q$dkEQEyx>@Pd!Gt4W9+WnS%xeMc0zP�Pr%2b0fXK^|GiOZpE3J&(mlhiQB5LZ6zCA)pkDSooobL&M45tl{J;PjJQ z6wu_&(Ll6ZeRdP^Vk9q)hO}OU6b0d3tB`V%S3q7U4U^G7&n*?%FJ(^teA|11ljDVq z9vkDhcWwll*aAfsIlfO8*LWCX2~=@ax;e-d#`}z6N}bv-{_^juxc|Cy?N|H#|}x`p2Ek)pkkYKY%Gl0#;*D%+-2o!?-q-n9Zo124TLOZmWAluNF_AV(-?vH1^ zCwFT;P<)=?Uu6Ue2IznC=3fMVa4iIuI!5W>)@5fu*NHnh&h-aosQG+1e&RyBA3#|$ zxS4QX&j_0_x7Qq+@46VH1^I7e`qN(+zotFl{}m_ z{Nb>YVMj-Y==+qu%vD;*MM(YmWjsnv)|FG%x#L7S;fDajO5{v*yF**e$3A7XxY!dog?aU28%B6 zcLLKL=?!m`=0WBk!jZX^JD)Io$St_LoJcgtvOF?S%K?y!V$8G|gaLkdJALl823)p2 zlE90d`rbn2^M5jb8O6n9mM)mDJVZ#x>L7`d7sQ(I6jr4Sz0W1HaJX3nty?8T zRwhKQyD^*EHkpSk zNYM?C6^V^O&G4Z_`0Ot=;`Ijqo?xYfkk(>VzmYHdX`tO71t$C3&(tLv{yasw->oX* z(|j^>)I7Z4Jm(d?A~q(7s>d0CM*`#TUy%E981sv4q06hT!CUKhdviC} z;*K`$O1R0U>F#wia9*0teTHu~)HZm9(ZQ~jP-e63PYSzbaE3@!-N6=pb6R59Oe;Z+ z^(VF>De2(nC8<5Brj`pce~8BLNos;=k+zeir|C84{+3 zmYzKK3n+5!g8VjRIOq5FGUa_uDwJhAZ!sX17BM65`)U&zmU#=jKD4U zl`!>{sHn!9iGLmIJ*s|(VnKs^@j*pNJb6}DUlhCK$8zx~6ky(1z5=s&C3!8aXWG~0 ztxQx1wH4H`Ui{&PXX<3aCV_;3kvBrXYRSZjKx{0494LDsL-3!kmMdNT^? zfnGsjps?pk9x%r@q8vdSjQBQ!wcv=(6b29?M7R%gUyF)%GA{Vt-XCIb6?@*qX}~POHUE6yVKoQ0k$~Vdh7@{ zK4qIfluD_E&Iv8FG_1`X2NqNq2e_yUa^MSqH6^z3NQIrvk?|fta!H!iphMDdAqd(O z7VP^XLPoDnK72U10OR3ORwi^ib9?bD!8Sd7 zG=Bk(E``bs!z-WO5Wpc?4eLv8v%(t9cyMsz$^)OF4#Q!YkK|hoAlrV!oV4WO zQ_YNUp8yhBN_AZWz`?0w#4?W{c!avIB__if-0^0;M@2kgU%u=R2yscVlrE1&Nh0XL(-bl5Et3>EVQn{2Mm=mwCz? z*iLmQNutnHGW-DxVm&KMEVb4%8|Bc5jbo_p4il^d&)JidnmOnvSjTDjmu7v%@%4Tboj!Pg zEUEl$qn6sZ=rOzq-YhYh5l`Njx=eYbkF}j~#Z*n1Tx>y%!cXV042b}kkE%bIfb>$m zgUqD*?fAUG1?)eK;)!D*x-?ZuPArN4RDFa@;!D91^pwg4e@^tFvEnA{LTqL@I@I^0 zmxksTSuFG}qi!XXBz@vSVcS_*%rE+(h|Khgau@pC(@!6(OhYrr7!jj$5r4><0!y|x3=7T0%AbWwt4$pw@JIb_%g7=hJN zXHEXiGVjN0Qq9@U#K#kfq&)OIk;mBw zp7Sdagk4lzF!kB8A&y>=HQP`7Az>6p9F+c!al+!4INu%%f?j&dQq(_T99w*TbRIL89rf({Bi)sFEUT@q8O-F1p$8qDufYKL}G;1xGuvc>croR9CRRilVqjRc}wY zGVIkRV8Q-0mQT1J(-z=-0Rk}>;-;#8F$#`A99}Jx&o$7n`m?Xn=p*1gNTG}&i=D~m zr(7|a5ylm%Iw)Je|z}c0~^KsV>#EzCj~OVZ2SV7Jo-$U zW@*v!$A;^vx8I3BOSt?xdZK@G+r>xW9=)1167~&@_zeOPTwupVP@!L{f^&>HeO?dL zGejpCvnF+uG{Kuee7b@uzpNtEI-9OKHkaEOTh1U~B2j$MtNQQQ^k_-WY9(!c>w(Qv zWER(bJMN?YJjXA%BhV<%Ktlk%V(F5ADWIz{h@Rwee|@Q;yV5>x_E1D39|9#)NjPhf z13+RN447hvV|vX}L81fA{Jq#Tj{;h!TQ#3JwM54TXpJbQ=K8+f&ZkM}a92oic33ZFQnuep$vp{XfE2$^Z?_sp9; zj2@u4oaq8H7bdD3PzU2{qSTcKg-=EOmphym{Bj9=Iemz4O0+YVNC0}er^6${kn^sZ zYD)~!IW*EJ-3&C-h*E^;Qy|{LfBEn zi3wk$cBI8|>TFK- z>nmd0EGtk84F_d;MW%xf_g-TcXL#Y+!j&V5Oo}P+L1nV~IYuf@FPTs&KJoHH41=tJ zOn<@U5kp)Z8KGb`xLIB;i3%a}piy4vlWl)z!xC)-giZ+D1r|CgWTSGe38cdoO1>7D zI-8klEEnX@>Q$sKL8$GB4f9uq{<*(8ACX+_9bSX1WfC7XrdA|WL6 znN#VA&m~8_?+Z+35|_L`cEFf$p4gvE)z^aOY26XOb(c`lLw&+s=Q&B@hYw$|29Uesb*qA2uQHZ)zuy>QRnprR;=e;Qq`(lc0$ zolHj0Hdf&9wvk=^4v!|?rklI@+(Orw8VI*+l@zCTr(dE2bgp@&eZab)jNPd7Y1KMG z*+LG`P+z|#c6$2DZ{%h=kPk`Z;w1Kb4)YBpH2FI>d2jE2EwcqEYGv!9NXMpHA~KV< z7v|AweBFrP2o*V$iDYwSbXy~l!g?`C$lq#a22hoE93u`D?lQW)nXjG<5`Vp&GJkw7 zy_!h&Qk2J!EF`E!v-cmV+Z4VvrR)CDb!>)3!KLsH2&1@I;dhG$mI*%*Wd=ijaAm94 zK|mylYRAHKPzxYn@Ekq_5KjQ|0fZcQ$4pR6FgX&&5=xRvED%1PM7?@uwo7sqhW(!sb>JFhXQ3sLG!{muuEQz(Rr*gVX52_aA_|joX6R#(Iwv3 zCKIj!0;nPM@eVw6_( z{CbpD%I64%sL~dtu7;E;Wb}9l$&R>fvD)S@t7Sxel6adH{o5RvJ4wRMCsiC4&2RD+ z`h-jU8Q1E|{w!=U6XIy2-GS_ey*O3Cl3SqA89bnQV0TFMLZWkl+}<*!O(G+qhVm?F zmz)%LK+U!UCu)U$Wk5J;8rB}&|NHF~n$5`ney-@>=`FMPWuvd-w=&1*_AUekL&qPs z8^On`gEGBn?$?T!jPLq~y9c?v-(p|vOzywDh3y&n?wp(-Xc2^Td^!k7LpYEUZUgi52GY`53M&R(j zzCJ!eYxes>t1NJ%lRUoSl~jKR<`BFNx08>bBXR`k5V0`MDC7ec=+X!kkUB|rmRKkr zAROrT`5|-tGuagd+dTH9&Ru;ahN?2gkGr*bIm3Qw+K|3$8Vj2P@TA@l_-sU6uDr<_ z^;9BkNiyge;t>5r*F70QffIB_nIW2j?=0sPR&hkYDq5YGVuN+=;y}kb^e3pXs)6+2 z*)mv9or^5Ywy;$uB&hX`MI8r!lSQ;Y-VzZ-CNE*KkKQ20Cy|MeQ1?IMDV4F4L-Hdz z7;+}+7>FT_Jsb5~(b(aXcm2;RI9 zug0(9@*U~(NQ+H}@h|!jaZ=PUu?!*JI5EZcwz&^}Ew)|Yg|g}!8n;8Rnv|-VExksJ6K)ii2OR{CE{S1bO)*AjG?Rjb zuW+oi7%Y*uPf#A9%U)3oxv}NQXn(lc584_w0pRUZ)MI!R6EV}EEZpIzdP2y8EcB#t z#0WaxH|j8@A=(dM`o{-!jJVDz$@yjDBzv$Tp^M7eaS$o$G|{(vAg64ySA~TV0%F`?mWYR8 z9|W5Be0!n31k|Wz$^&Cfk&nX?rb~ZNTXEsLS7Y=t;}VJxmt#PGZs5Pa)7My_WX_XC zXCMtTim15zL?9OV)d@N_=DV(eDrxggO};G)c()-UU7745)u_U1IzAb>SYv7D@7UUe z=JRt3(8{sa+G+;)8S+feko3p(97&tA)e<`+?m!&!@1bLiAkmg>0H@~-z}26H`{SxF zBvSXt_bqnJRvpj}M^t84&lj0eWMM0$+8#d_*}nHuedBvpvj5ZQ`XZo(kbxmW&dn$T!$kW?8)()x3qHeRuDH_9xkRUs`bGiKT7f+g8t+rYN2!em(o z;Ihu5RM~5zR$Du1S0?r=ZMjiBrW;Z(Un&i6S;!op9tIC{#jH(VmI50qe>?2GChPCxn9?d+qs0yzkMUKdET( zeEpkE%zJ!?)083HA?zIUGTdR!8gcA3o_!-@!_$q;jH^vP@5_rEMAesb0Z@PBdfoMg zqtXv>l4MvC7;UD{*abpP)IWkzcYO-2 z6>9J%;Y@4q8U0514x_w^UP|1f&p?)$uc&yyELcPe6Suj3V#H)aWTA3t7!o8l%q(8g zK5w|8#%aT3*L+JNm&N2*L}s@%6hrhD*mS75o3`{C>o?_5J7+@gXh-lT2|TNbF-GAs zuLrwWp?L{`or?X{g`SgEZ3?o%LD482*1V zTNK{q5#^ih;S)lGrEVgosf0~Uh$(-;COfJjmjkJwVUozo7eG{Nbrg;$n9H3^0;w)w zD@_0okT$h4M;b5_QW+Lh+GA^8#r_a-9gWC8j1qiD^<&h{3Fbft?bic0X6Y3{le~hu$hw5Ig!5grxbF!nB=Nprk~_dc^EcoH zM|tVC1j1v1u^SyY5JHhb+eyK)#Z6#(eQyGfY>D+=?Ph|%*8YU7Xy6oteCJ z+yb~M;OvD=UWnx>1k=9-7y6I;K5q0A_KOG0W9%XObH(!Q9m(d!@DKY64Bf%W=X!g0 z!qx?Chtv$=LgXB-*gZ;hgEH4W7Uj7!>D#*aFpQna>=JAm2ZEPuMarAPQ&+~z>0zcY z&z1&CKyLCTQ7rhK`DWn4iGzd0BJttEX|8&RId}5KcJj?!ymOrB2Cy2DahB>L`xvks z5p%sUyp$ymDF;eN^D&}f6&fggB83b3lts#S-F})Jp8YKcvL&PJzB( z@{dT=9+Lv~JWh|}Mn2T^GhD_1tF%mHE!8lN{NK!$j&e05%2vC;yiiu9TfRjqY)ex> z;d|>s2Mp$Np*XZnA(_{bNL;PX?xR$BRZd{^Cg%G;~iAhVjDs4mJWSb@8PJqig$J531H)NqVL`0)o1uA~eLy7Q<+~OpMkiRk7 z9Hv@sN!}rP#qkfEp2>?|jb&yeH?Ji(fnweV@DI@B4$un)Eq<>KQtFuDOWI()VZ_kK zC==rsB^2LjwF|g>j<6)g_(W^vE84yqZ!*R>H0>KOeKHc|fTr%nA)XOqc}DPy#l++X zoEmQe!3q;IG~6w>Gh!u$@{e3Cv~zqik|AwG@;9!U+`0eu2L+jGh$G=iLW>_|416Ru z)k1TU;$HwAH-fnvE!RbhjN}(9#viedP6fRP3>Hm{+w3MWLiCT03P?JgRbj-hNeAI&Mo5-Nify;s1-b_OAut1VbicbMaA}LjAtjCQ4`dC0*V0z8=4|HU zLnfct?KeGUZ*uan4y2d;JAfBq3 zr^X>G#Im9~5zZmw{Q;LX6;9D?x>zbB7Cau#fQd+*gQ!TMWi=K~;gI3Ne<#Q$L7n!R z|2qx4N2W;mj5&t6k=+$Id@ZH##9tY))QTQx{r^nRi|K6-%r^RyD@GUn|D3E~-AuNl z#aK5)ThAAN+3IZQ7sM%WU(rvJudO%t>g?$2hQ3*0`hoKCCGD9reX7w7-cT?P-i(>N zE+_7Zi@8UGZmk>n!QV;x8-WodUJoL8qv$ET42Y3@56g(#AA8maNBD~umQhQV_|V$f z?dzjO#pQi%OZDW5tt!ssk&M!Nmk3$=O1DvqU1;Z)c!N5M{RX4XA94dLhjAwNAZRBc ziNDckH?J;=T=C_)hz`N~1E=Ts5L_w;x&zRuk<*gMW&YY=brI`)uM2<$OVX(}pPd6$h< zB$~=;S!xuF41P($yj~i`u0sx2CFl(B)TjUBPe?0J$R_*{JL**6%=AS|!+9l!^^Kcx>2f zmlPM?1N-$U7VN-+AvQF{jRhq#H8D06NVWJw4{W`!Iy+79hg9ksj{3-SjFX*qc~YU> z%*u%owqpk(%a;q2NkwjEl!*p+><+qTCw1?pT?E0|p~6@Q$)NTYisZ zvCP592dd=*MQ>f1WymCAuO?Isy(KpnEQw+>+^t8n^AViJfq}b%?;e(1-0inp>nvn z&hE>|mc80FB;EpLoc#?V)Gp#XcU6``l2j(r_Cq_N7jU*yX9c=Xgk<$vWsF_*x{Fj@ z3CDKkUJVW%fNQ6BXR55Mb`@Itbcmy~#+psGsA+JqeCW%DGsPE0BI3^CLP z7h=&iYD24wM96hvsl-D&o*%5fLj#Kf?$|N>2PfXJb4}i{b20pdufD-rjd>mntN(-I z%>04J`vHk)4Dbs}e>t7znRFeyxfNMT|IeYr&=1^3&TiVDAU@C#E&uKNm=^!9SoLN4 zgrCw8{`o@xz$8WVBy!nT^8a2Bf5K!#$|s8aLRcKR>^mhCyZlD-oiYZ0$enU^b6%lB zbMm7y1vS;yi~3lo#nC6~JH4V)o(84A=**dQ#Wz&UvU1XnQ1@u7JX6ktd3l~pw7#*W zIFfCz*a~8Ck{@hNk(jQR0PBxff5N~kd$hmt(I<9LkPP_fZl4DS)~!RZ#WovLT;Kt# zS6iPE?!AS96lV#SXqgYDU6*{&t(!Mq^yl||^XJu&RWMuiPeb-i-vsi7Zt=H9ug3M& zRV(%YR64)i>{mRlWmy!s{pB{-&Xxn*CNh6uY>`CLh4#Ap!Hja;A#Z}6e;IwxAXHC( zCa1TN9ZPKvnl5)&eNQ?JT&BY{$%lsKi`-CAN;c=F93E~n&RcwSHgwsPb@Dc@+C)r}_n}TBF}d;d(s64-n|-W3wTsV1 zewef$4)b?4Y3^V%uh#lWZR~q<g)kJ~mr)JA*(+pX;z``r9lhs@QYg?cG)W|Op%el;mxy$DjWoE#f(T*^*uRisv z8Y3_hWG4=}y4P|k+j|q`6nn3V$rL-`EL+#%g*n}Kfy-SP8=r}3x&U}mN%1?$ z$^d7xKQnxd_SAPOulN+~&Pk7{{BCE90G=*C!OwOKxZs8hE? z?11as-XXd*3kDqATpWW_I6R+cIj4g;w}Z>yryy`|zTCdHzaP6c`u+O7oOm1D*^m^n zN#om9>fUj;qh4?KWntiR#f2wV(o^Sik@)TIbPg-8cyi>AU@|D2c%p}Md2{9Y0f9Sn z`HNL`0<6I601u#pCTx#Z-F*L#nb(hg&%q7O#|7*SxLOx@CuW?pl~vp4zBi- zqXB$QuJGNPAIeLg0m<=ydG&Xb_SV(Y!9^mQd07hWc4ZLo|Bzh*8ovd!GQ+>l^Z-$& zzY+9Y+%smsyDR18Ow|bIbr`B3#_*LPDu%kp9y6~=s(z&?tp}o39e*IbsDv_^m8Td=1UW6<6G}6a?X^=?ja{4y zPFTHrOjRpc_UTDDme57RoQ%68%q@@hPKT}N<1D2Zx*Yz*v#<9@MgH9=xkEhn1~ai6 z{l8K(gtGnc$E-=eJ0)v)v*z*qz9O{*z?-AP3=Kh-W>~>v82{ho41C~ka>fm~>m0;e z5&Q%B2TaCO#VFc*5wtvMkAuhxM=5Xkdkg6BpC6{>r2iL={~O_5^|v=1d!si~Y&K%r z{EqtOiMHM&$yRShV%g!i@xAt{EZ=FA`uf@Hot9@8^l{c6Wyp%SW)b_rqYu$fq zGpQn4lhX;a=Bg3O>@44 z{(DEGoQ4Xn!$?V`H%{R+L24PhEkWvUf=n(gDV2Dd>Fy>2_zkOHgpx{e_YOIo4!_7g zuMD^P=$dW_awa@9F?s-|p52YVL-Rd9}%$`%k|4_U9z2@lPkR6#d@ZSy=!#>6q zzz``72)1IUOQ=SEcBu~M5lzzAn$k9#?IeX^x61W#-%IaGb>42 zkx;6CI(~L?sL7DYTKLcA9>p9M0fLmQZTt-4R6ak~P8aqpzE4xX6fPUENwU*as<+Fg{`j%6pFxy(OA^eHSeg@Y#|)5^?R08NAQ{Ma1b9Jo6>>I7_P z$wTNbd09Y44NRXVwg@IW7i?x32Xniw4%qJs2-5^K({-3kdonO}_Gc2ib1Aa%Z#I-G zf4edG6*y$%f3gU_SK9xZUSK7sPSxtfUHBUFV}X4qWA>-9y%o5WS<))}Dl5Vsb*}G< z8r#7TXUJ)S)gd1JEAmlkTx{(dZ$xB)tupt{r~Ijzw&A_CP*}(U`!6m~1#rTM1mQ1P zluwq)f|u4TUkx^Ai5@vK9#hE}z7YE*5QM16Wf6v|G|{yXUstXv$ZqiD1}5Ciy1YNX z!4`DZj>0@GU3M*#6;>UONybgVS5zt@_Wr_#;IAbsw4f@~hNDwig^GWL#-06UN3wF( zJ;0|RFe-1&BHTN;IJ?*_pL9EUQ1);_`Jk(bTOZIXlXZ4O9(zW* z^&^tzBIa`vt@o8OOf|6L~BA);D{SCq2WX zBH(`BLjqUV0;K&T0tdAZu4#eKDz}dXDyGZw$d=ItS0z;$Y`0_L$!rwzPaFulX%KPu zN7v~lA@%AU4Mb+2mDSL+DXImvb?Ha4&@5U|7-^BsN=v5V%}VvA)=;XK;+{Kn!_wdw z(Y5)(7(I+sG<0qKkBPPVIngoQ%xxJKL)<*Vbv;=al0F|pWPMhc!f4xGtBf|BM@0C; z)LWv$>h-4-!5P;y{pQH!vRA{A2(|Zlrd^{jYojQw!|JB(n=?-0``X{>k=VqptG_HR zvm~2Mv>#&kS)6#11yRC@*#7B7nivHwC?W#T%BrCO^08Z)f!Q!M7ig*%36QvPNLcuE z9ICK*6}>MFvSQ3v+r@qniV;tA{Gv;SRoG5vNLUw|V)H2CYK*G)YZRMPWvt)r0v}vZ z+6|x8At%pryNH^LA5P4n+b6~Rud?wXye5$j{-p3$u6^CKM@{crySjIw;hlk+?O;%> zr3y0c<%}P?r@9nw@e;ksc-e&dbArLM)Q{}pEI};yDnn850B=!FZ}ttli_eS;3D$rj zu9KV(H!chvo)SYE7p}PVrBVrxu}j^f(7YVu!^2Kg%A!)6sG3u?!2lY&3l7^LD8^~f zxxWprKuM$N9`_J=$Q z-_pcw%rT4Jd6j>ME;ulhSTQA*Nx+Q;Crx30xKt>jto;=2yK)}8LT+*B1LjH^rxz#4 zr~kYDyQ{FFR9)XzDN5iO8uiy<$iO4;WcxEHf^{J%n_Pd0L63b%0;0`CCTVsIDt1-i zlTtRmu}{Qo<+2mNL@={UZ|&wHN{>Xvq2m`L#;I+*>6*t?y=xNBt=33}Y!MXB>sDd2 zo*~(sYXy&xgp9O`QqG)gSH@I!9C6PX?XPP1dNx38QYT<+d*`NhQr8^zTYEqToKpl0 zO*^)dAZZYxi-ahMzv{X+;=58!lkbmOj3k=t%0d)9+*knD&4M0H09PD_!9ZeXGCywI z6Z#G1z6|a)@Ms#MNgZa3F10WQjge7onU-U^JR&3>e(+k7@>wDhVW1x>Gb=JP*ZEyi zjPiuu9(GJ1LM|RiPbzk_oPnlvl{}0Zn}grZIzQ?J>u>+nw zr0G{7grnNV3(z@2z!Cw zs9szRBRFHAVKN~xE3tq7b``EnwE)?W3(eW6(C(BQhTgoB`;nh2(c6Y1CpGgHj{Blx zCLRF$kh=+8`TBfH6C$h*-v<|8%(A*($x=V3D2L8b8j?h zx9sZ_`(9$*dQ?!Tfr1uN;7|ldKD2(evVxTGcYZi5D};03&UN^%a=k0~^;Ap6`BaIEhbIcs z6H$baW&|alJ_fnQ7B}%^kx=DKmxPmvxT#Yb&3R~3BIeB%B-MG$k3*7WDUu~AP9Tz( zJVhR&OD^#5isfT?tNLl;OZ8nkXX?jYuycqgbDD=~#!;%E6lu&RXo8EvZiv)%g;jor z&%8y?CXq6pGuMS&nvXZEFUDf;vZUW@V8I{8l{+~cNJJnd>EGVZ2;~8;8i~2P<%_B7Q)QP({tTFr+k$%}x|;ylx$NP>D3Ffy>Ko3~f4O!na<yhzKLqjJ^u66`f{$|YHdB`)>76qw-k3!*ZNY;Wlwf0Q}T4Y8%14Z9-Z=U^|G7` zmxX$qv>eed;lH_DrTM^9EYFYVw^dluXbbIwru-{;8ojg#eOh@DaH^q_r))&L#8(-X zl1fmq2xNTPGlbJ~W6i>uOX#ARbX8gvL1Bj_J$2E5&tg}(QhE0$N0;52;Ixtaf6J^_ z4!%XMyZgaKqOFc5a(&+k=vg_}2(F|+jPal=LST)H%@2FsWyD?s+=jO;7;ErMYnhe`If zxt^d;#m32vf@zVMv)(Ib`g2hVgHAdAQg9_3zlN7tg#F*&n0d|hvVA1mTymp-xfiP( zG&?bfI^<~IG!bT!MhwNI%7Y~tFChDsHOS}~J>AG`@CI6-pgaa`Snz_$AjF_TSir;_ z9yJKz>^#a(!TOb{JI|KDLPpeUc=fDm}a*ABFtsgU+KO^kQxiQdSMfKF$2^kb4Q417w@>*fW)3KooK zbdyGONslD_h$5k1>EvP1Ygpzip z71kR-iV!HY>|5sbC-yMBu1dVF5(M~3x3vrX9iI>i&pP6sH3D1H5O8mRP(~MBbj zveFKINh+Q|6rLntCCp=%+%AW-(hg-j>VVdu8}bl0V=N8cJ^u$o^VxosI>T!h`f31L z?GK{uEX_?SGW&K@dBLs_+EK>DfkDG;RJJLC!lJ+M3(3QW+^RDyN|Vh`CIvU&|UoU((N4b(7|gl%s9V`Rx<6rt|HVs>4mKakWH zbbd&X`=)i*>x7DfHf5FfJ?V`BVNC{MjUaqz%gmA?Gh5I2ZnHGWzeNF;aTkl;vQuoz z5uqdF!pu_XAox?%iN{ESxni-Q{7}XASsyj<9D&I5 zQ>A%gB7^zIfxvV2eEQ&@B#JUolTG`ttxe5YLCEFT4jJ>|2H98Kp&Y5Aoc++JMv9E% zO+jxy4?lY8460f?Qj>?AeFb1Q2MWOD{M3Gxgx7BUQLN}D6us`?CZOFsEzAV4P7FAS zS^R|Q4lm@OLlzq9P}Q_P{&rBW~%eK+@AzK85O7kpL!1; zzzf-15{ox>_*=|ej{&|8B6G_T+|*HFXm1DSGfto@q8$h2#F0G?DUMgm@4Mb4x0rP6 z0(^>N$r(NMx=n)SwVm6zc~qTwM(2n%b^WZaYEEl(zH;_stU*>li9*H!Q@SEG(mC(;dtA^NZo=J` z*^vsN~-#3*QXL|dX{3*xFO3AGD|Ho%1F9P6g zWf5e^<@7)0j@H45pkI(reQr6!2A5oseZ9XWSH4>f2#YU(U-6cuh$?uc|IfyHSxe{ z;(3xp<=PtcW$sE<+(w1j>zAV#%S?|qr=rs?)B!{* zLD@jEf6}oo{9S@zr;KLT3dZdM^Zft1ll|%F^*j*B*=8D;KFAd?w#P;l`qC}X&D*GV zAka!Qx^|E$5?zwKF5oyvS&4P2^~aCnz5E+X0X8wbLustcVFtNvH&2Ng5{w+)lCW(q z7j--cki|zdm?@N~@dyKejEllna^VkzEda>UWs5I-4pQa$c`N&gK+vVRmTh!f3fk@5 zh|JACl#eC=iiTTBY0)HUB5_zY>UTKxYnr#AThI1E!mf1syI)!_ANw``i;?0R8vPKl z6T)ipsDk%hTR+CPi-wOg8UzxPNQHNU*An0PEVhfU9FWbJ0W`;@JU*{iyoPU)U{D?V zzqyuFpP$m8^W1Q_7s@kU?$n`km1(F|tLgYcH02!&Uyh>&DG#C=yGP!pyGgo%8EFkK ztH|9yY&uNko`49s7;5JJo*ow`r+%;9d>*BFGx~N)Go`aX^*T|pUkW8`8wiUf7Io{0 z-7AQl%4=vhDCGZry6vYvCPP>+kRH7Er=KzNsOPHE@hwNl?!G7J!D@x#-Bvn#C?!I|Ft2(E(6M1*|nA-oU z*p5jzBF@P(Faj52DPKi z+KmeY+0W^anCjdvF$NRXE%p(D_gmp{O?y)H~52a&rM-s&!%D`upH zAeJv$2c%(KZL#;h?&`Oi}hjuvs}h z8>q!#<3jqY4-wJ1_X#(y4=tD+LIOAFJJ5T>ASv{e^Y_(jL_hFz2YvrvJesc7Ktvcp zMR*47`JpTBz@nQ)_}wgGs<53iOflBET<#Clu15o}Iu{F6({+$!^2qN$t)=9jEogk} zm25{+#R8s3Zl$@Nr>%3>f&47z7;`V?nbA))>MX|fBEDX#_-ZLpo-X_b#Tud;+-&}g z0Kr*An|Yx7&oqJZH?Mg@v4-dA1 z0Hok=+0oUc4Xf+PIB(ttQxD4IJ^YYNzFK{ak$nsN^+Q^CUZ zqhw&N3C-uqQY=}hv$Hmqs9I)GJ39^$c2{WsgxVelKn!pNiLA#1z$vy!XNYdkdK$X= zzy%-NV<*D3%h}R|t55(x;A%_m6qZK=v0*sEi!Lo3->+9MgQ>)oiEM%!mHwWyTYsSVx@SW zQi3Y|Rr%}@7=T@%Fd!F?rHht2Qq4kBR!FKw7cM}n0-aiQ=marwCx5rAt{hGzw|6NJ zmn0N3s{E!w9@C#`tVs8U`3Uj)+5a zP&SX#Sbi(*3vaaB#$!c<}kZQ z?Mw8T{C;Ojdu<7%sQSiRGYl2AP%FQvt7bHc40lk;|12TntA$9hfJ*TNPq~7)6;{rd zO~C$?p(EiHeW-hJ2C{$#&61S4fMBYm-qICLiGkBhB;8SA>n z7n@RPm@RIg_fxZS8)mfYvoz&ax-TiAlUuRSQ`tt(%rLZLXM9w0C*5WTjP;jLPVpgK z*E)P{staO@5es8&^|%+=p+#ZyTrR0NPz=RIn3*a>sqtU|F~m**yn%lp%z+qcK`&Mo zsX|fD)g1UKhg@O<;I%{#X!-|Mh9vV3h~y&Tl6JVdAi8%>*)fFzW9j$l>DRCF$EF83 zo9ae~RmQ4f);ARXUpp*VwSv05=N}y_^Sl|YXpINXhhk+j$l7Qh{XDLTJF=vFH;aTE z=bP^^NbM3YNe*?4H#6+VUNR1!9G={kQC4U9W~|(L1nR10Mv0pYa(Ck@<1^QF)maY{ z9xVlO)J0{*zyIp6_&LW@*H2tJ>^McNbTH`IUhEkMM3a}~Wz^<8_+`aaz^R+e;JYR= zOr>88!0xm0BP{@BEbt5|^jwpD4245B2kCY&=OoqyD3P})2Pcbb=S#=l?`o$sjIMK}LuFT-AbWmd!3{7c}~qb=z~6vXV4ip9p@j=sC zYQ+jdRRA@^qhnIgxPxN?0KY7=zKBu_7R8f+-MAcv2vim(`5|Guw4Cc>o$G~opW;6 zmZDyshX`~<^+L8~JLXE#!8lRb+ZLdB<}8Q-_AH7G>ef>8R}iWIkmbLHyE7~(a{zB( zk%1!5ujcV&+Lm(Y@#R_!AoE_UIsNK&hGBijU^fmz1(_d*o=sKE{wr0e4@=5MK&g5z zRLLglRG8#=h2p)YLCB!znnE8eTTFi@i2m!dAN-s8krieP(@n79Q9hBDVP=qTe2I2} zS{$7==CnTziYI0yz6hOmJwKIcZP;?X~ zabGlmcUhF1xo|sl;NQP;I~M_=9`Fl4ceQRH+J7io+nHjG6Yb`^=COL$#EOi3qf+aV1}{ z?`>#|nfPu~ty?`%))q#MCpMxk$d{zaGS)20vo}+TX}vTz?tIe*O)j(vq_dgl<+p4^ z90ZfKDQYD3PrzzGL1tT8)ukP&{J_Wu6skPXV{*g&b#zo=H^Gjn%h+y0|C!)hDv4hG!dyyH{Du(n@{0LC?|BL%56jMnc86i>X zZ@=m3oijfZF6~BxXdzu|@BR81T9jnk^}XmqwE1!$B54gpKg}u=J9D2Jw+uRz!}YGZacBsqCF#9grFZy3j3KK<>piAS2+Yjh;N1Y>w-MU6#1jo!W=cNjxbKQ4K`@fEBJ6(E^*_7i zJ0~ee?IKyVgHi==VfY)t2s4HhNw!ouZ(c*PyaU9wrDV;a-JlRDXkQRnl|S+D%%y`% z-_;f=VF*GXLe;`R6b7#tG^G&M%OGWn3MCR;Q(E;I&j$%P_PxL)zr|h-leM)Ty{ycF z?>p$UhF#g4DfD17cYMSBvBsZUml9HOUl`q8++W-nrjDSrSZ+SW^+qGARU!2t@cO;S z@;7>IRb~YsWoEyvP^dSi%o9L=iMN- z?mDpdf_1I}1{3ibIS;sJWWQXfk%(7Bt3id=#2W3a1ffA0twCR`IuNza`IxkFqSPvF zh0AOFMDjoW#0TQ_=iraxjVD;ed();3U)sJ(>R|-{)nO~ zwNW~e@w6>4ib1E2E?u|ING&@DL7Vdhwm$o4qf?k?fc{so%ot-aGR*+!|4&_-?u(~n z<8su3xl5ucz#iJQbdnBtiy-7sSkUD3B~m_+%6B3d|3D~zw*W2>xxosOYR?A$5l7yi z{n;=79!Heg|4;{KX->~ruE6+mRsnmLzYYrJ)7>jx@9>iJ>mN?AsVPOc*%B;{OxuHz zzz7mfk%5*9XR83H{8HD)S&EmfSCT{3ncGi?ucn=td>>zTK2ffO<-VS<<)z#&efm;= zn2GlkYe#(OmkdonZbW(W8H+5XI{zfTY0<^A(?%(ZiacQzU*1v-IWlHJ7CbwlF26aJ zN*Xfg@|Aakv9KaKb>P22lOWV^fIo$^W0AD1Rh0VC*n+K)Rim@tpG1n63s z>wGW8Clb~Nfj*F<1Pbyd072LnohONF@-|{43MZXPyla_st4F6uAt zjf>xuLA5}c049-nUTzBv*am;JJH|-~qC0?3m&#Jtg*y3V8#Ulj1-O$y_%z`cKGj-{ zc#4r^%CDru7cz*8!SOBiX@wfbI_FE*vD)|OY7nidBdUh5nWi{om=fJ|ZVbP8|3Myx?>p~AVEfsH zfTlk2;>dgB%WB|9St2Q`r_O2^d)q52&z?zTrumZ8xPqk)IEzS~U?iPcOn&PLaF%Rz z5(arGViMr2)u3>}>Z>fmp= z|IROa2byo!f3ti)|FPAs3x0_qUjR7<&54wvi_f;P`*g#<$pog!@|`T&YnY9?gOnL< zPLa%Gj^#P56}=(M;510aF^Ys|Xrvxp`gXxO6Q+redD9&|qNF{Et=$~acH2JS?eE=+ zTr+$(Y{?RQM}H{p`K!oC5=2|4(BspiVHMfO$sVeRu;3#JTG=zJNJp>1)c41S8%39$ zL~B&i_wkqZ3EcRKcFzu$y~AqN!&sN-+ct$*i%xs%kD`nMhFQk)c2<4?D+p^JY&6K{ zujrdpdobU&eG4llB2^u4d-r;OQd*15$ltU)3IsKHttA`E$;D&G$f4*mS@gOpKwI+6 z%FFcrj)kd0PAF?v^Z!~u;`n#=ZT6!f&pc!=?mu)Ci7g3K~%OM}6;9D%7DBqT3e5F{iE5|T|< z!8#(vS#5*q-VTKGBf*eVE+@ODju-ul7*z~w&K^og1o_;|Ph=kE$1 zw#=b(XKcU-5u$pYP*#`roA}mXe~32+4%z&yr^GGtmwbtO*pPWq!lj;veQ7V_sI82P z{>Xe{?L;_yd5pM@V2fDZJBH;Ym zA3T2v{54b_OQZt)3B+jD%z(X{VegVs?6x61nTY>0XZsv&zxWtUDi*UBJ^228VCJ^! znB|KD;JSLC)QK|AKt`BGb5AvR z0tTF%u&N|!(To*(J}Uq&Pr3il>FhM7ayRj~vF!@sH#R7J) z%mNlDqoe|C=XWh!o`oA%ze8Nk!A4P>&-=m~AOXneeO?&zeFT5QeUKgsA=4?0ubreX;tS-^y}F}Mu#cYhwOXuYnSLdK)6}l z*8QgS$o!~CnMt%`3j|CStmd2wG#q{%9eb_e`0(oIcy+(653FXZ>2B>nd>OSvWzp`V z?+@sEMQ=j60(zLPRt|1_=v|x@ypJ4-i<{ww8tr#~B1v~z&2;$g;JS7CzAnz7mb*X~ zhihjstV{8Ag;19)YAzc^(OqOj(;!o0pg#HbNQ>#Uat9h6~# z=KWZ6Y*AmLAx>cy04`s&BuEzAs4xg9`0UW%?h8(Lf4Wdt5U%tEf(pL2_4Q5(!iN&t zhu(0Y-zBpn9)s4;rJ-B>V-}d)3L_xrl?Q=a2&?5SL9CJ1cYD#9@RZc_NGxXEwnzTC zxgzK9^D~>m9q}`ZybE{91sjD&C@{D5a{rRE%L|@>xyu{eY#_tWb&-gvn4N$*7PIA- z+gG2lvcMbcsFH&?;sQZL+vfs-I|ARlrE=gBLi|)RXk33DTSRyBUjpmX-!yZJtElKABl(^3 z%`5ZWz>xZNcBsKk4_)bHwnvqSdk1@-u5yd3+FOcMmcJ&PXJB@+${I;aeih zm7kB$wF1l4E(_d8ENR#WpVW<$Q}J%Pojq^?uNe*ANEg{Q6UKN@L^Z^0EsqNZOB>>dyuCWP5)!Lx#g8TKI3BHYIKg{I8@qV0y?;tjwMkPfqI=Utr(AJZ5*8 zhJC<&puY=%ef-@@G_^Sq2haPyHJnkI z3VHN1CX|haw5W>zT2cx`nRNP!fY(i+%*8Zl%Jngb2$3uP2{{jv@*zFo9&?QttMG%y zc((3%ugo<=O;w+6z!ha0Cy7-!G3b7%83w7{;cF%6>(VzkIl$UG`FPhh7!C>Q9Y$un z5U&3571bp0_37rkAN51({rLtJbzFpWcBW^hW3&;E@4z=R^=0H|Z%$pv@rE6p?8n~z z{7|6#-Tgd|$or@FTe^=Hr`wjrH;B?_ypQ15M{um0y~Gbv`km3p?jXJ-I{NL$oabuQ zT38&!GKPV9rVH_39(ztSZDokpTbc%0DJdhnN=cjHoFm?M*=C5hWv=r28n40KtWz*D zWYx)f%sT<-P5r1aVSjC}e*My0?0EZHAw)G9K(EvII)B&6^g5_@kC5xh@b&E1XI3#m zDk3zK6lJ8Zr(pW$R7uzE{$N|S2!$Z(u@LzMi5c8xD}WF;4vYYt3&I8$tQi3J$b~JP z2Oe%#+%I zKeu21uq0nrZFPaL!U?rguob>JB8SG!7%HI^{Y(FX!CV`+ZX#awD6;2OX6FWTO{l+n zMf1t&O2=_As#iYazK?$P-TC(M@Jrs6IgSHsLU7IrH0N!jGiT2NY{qCGk{;BzU*M&9 zoGCVy{-SFR2y~!*&>>5VrGu3^;uW+O#2x<_k!j3KTf`X_6(g`*d@SXS+^S4Dv_ZLg zBE)-%|8~TJHRg-D1&g81AP*x{{amEU^mVCF(hsHlh=O_XGV!PJoxtl~%w*Bd$e7sv z-akxvZ2{jz;i`DQu$#PnyNcL`j^(x#756&$|H&Nwc!OjP!twvf9HO5<10v?QFld$2 zIK=-O5QTt${7>URybT%tZY|@ch|NIwNI*2eZvJU!OhoJj_rrQd| zwA0j)z3BA&hY!;ApCP%=DrOEo(C!(U4@&{Y)j=8*Y3xntR}pKnhM3&08h7d%U#9SI z#rDMrXxVq7XxK`>NTb=ct+$B&-5F#|zx`IDkxaZd=kO?wz0mc`uo7a3Lz}By%Y!hWyRBB`iY_;=($I|SbdMIvD(&JS4KeqkaBxSkR>^`{?rQjH zu~#Hllka2bD07fOc&Wvsw<7W8+#id`?FZqe$#v}L%n0&_$ zdFgz#qnuu7iLV(WFMR>}@iq^bzYjlDok-Q3zEouVMPZ}Ys*0{`Il`VZTH4SN@CGy> zh<`Z<=}Ss}4fhx>?WxPt;*O5s$~l(HoW>;&GPO0^+MSTQikk#$QIHPB%`L!kinCK< zaf;X6iLskfewTmotKa#C3Tih{2}YclZ^X9n_#K4)Tf$Dc1TG8=7^-i@JR+-5NY8ar zx&x4fK{P>|M+7QL)zdE6bD@^7?8{lZdzImfI^rZ_UYDYCp(k(yb?($cWeNN`O98*h z*4$@}2Tp~&?6RXYjSl+=l=9i$;qj%*S{C}iy=jh%iYaS%@F9g$IRsRS**-?nSGC$n zc<)x8_pj4#t8rC_RwPVTTDVteqT!-_km2onshf?^2(w;>uD~sLDbi=nUtK2&s#sE% zMrU~XPQ$w|n^mW)vTOz>={AWhMhc(xGpDtyUI{&>tKTdTW>~QU<|gnq-)_<2*JVP? zyQL}89+Gzp=`lbvLkupY9eweTPI4~XI9ar0G72%=q{7x0+c>D@w<3N#XI1!f7;d&g zpo<{+g^$ErJrE=@6y(W97IuAi!Xtdrqg3FCAxdU>%cF!BcAd2lj#+>yths7n480W| zBGF<1qT=b=skCqZMCeB!<5mwrqVOI>h%cN91~wG>IAkvlRa#mF8qdFXFTFqH^Lc}7 zhi8Rm@_GNfp`Bs!%)s1tJUfBq>8czFGl!Bf&v;cLZs*y3 z#>!Tk5|{M0!Pu8@JH_OvTP#}q?PndEKa3L@5ovxdU6lT?x7SWD2r^iZ3+YHdB(if4 zc>dRDd*lNWxVwNKZJ|jRUNk-W_S!LS;=cre{FqzIx$CSBjY12DVgMV-g?zJdP0+9> zY3Ay~?2b#QyfkAB;_b+FVY0G`-jSjseoWsYMAQ!CZ=-yn}&cL5~EmgwUYDN?XwMZLhW2pmR!Rc^YX#yLQyaL$i456pKSPm!d~ zHPwbt)Fm0Ql9wOvk+*_9Pe&K6WBW|txk}ef3~KH!6pD;smMPNIaii2ZK)FG9GZ@_lgl1(Z4-Gfa*!zw5@nSvUW{&Vfd z5l7?@ki;v}Bf|8d3eE}@-ii?F&OeFjZrMQ)Kw7;0l`0XJ^oq=N{+C5l`Rm2N17MlJ z;-Lb6akT&CoI)OEq&tbEd7SjnkO(_ zx5H1rHj{&FqaF3vW6R1raO3y8U(e5-1`CdkcXQ8+r`(6m6)$0qj0?DQ{}T-wIsd{Z zzo7lUE^0g108R3SWGm3hL$?BxZu^F5BcXQwq$ZtcN?&d=kRq)17yj54q^3g1KBgfDw=_(`HQXYZ2*7=3@fdh{kjuzx8=n|Avn-}creTOyM!xn8u~Gknp; zg2IiAG{+U`z@ZqdKTHJOFzuk_6vgh46qQt{glY76CL9wxeiIR2N@k_M>6#M)69{-R zAw!O*2bDUq0kivhNz>@Q1!z-XM+6X)1U()6PmLz<1TWmzAeJp*1>cXaVju%@C`0?^ zbEg<`mS`-Th6%gI!Q@$S7o1z6=No_#;0Bl!1=}Ln3yw=k@F$ooO?oMtj+WV)Uhn*e zvjjLfCaarXcYT#-hT`3v4~P^OhNzV0wMtmRKQ)}}-1_}b4w-1X(d<#!IHh%yup#+;CdHC@e(j$?!%PhI8%8yMa}?fI!dx(N+;oJBd%oWM5hog%4zK{;in5eAY0gxTU5w}!EKNW3=x zwHz{OIhVwlbtNgrlb3~b{@06jTrZ&2NHV?}TD{3cq?O*KN_HjW&J1U*_6CK@hB-fE#UUKp43Tc~3udL{v zh^LLk*97xc^RmycUXN&HAjHJx<-UFzG+{=qPV@^b4MaWYT8kc4AZR9_Y3jqK73Q4e z-hwn-Dh2Z`Z_57E)5!zdw+w$+T8Jv&Ispf(E41?xlXp?4tMz62(JNV8w{!C(X6KAf zJM3UJ3Y^@tCIlSk^*B_8g2wz&pl@`Y2#OBfJeBe0L(=AH4;{M|^thm+h|7hvtG^%8 zDFzgEL$nSuS25gn0Ms=MKzsbt^dQ@-z&MV#6BYj-I7)IhgoYo5gWre@J6XD1j0m#` z?>W+%Gm_=i7VrVUHe1U)>&@VsHD5Zxh=c>7@Cni_ed31eym{IJDfLf*ECju;A{&_0 zT0wj%?aiM%@W--fSsbDj4E7h&d8fOGGEfb&iSD9dZics#DkPO4_kRcL5UhzzG@VCo zpk1XEa?$UYxbG8xc!^!)md5?x84E`ZX*2$Z8?lk%@m3}#w&=C=>wf!5ib=m-GZz@G z&B>V`RoF}}lr9afY#SJBv{nY@t)KY>se|>-&fN@mA-Pw}n^)u4%59t1QC^lV*-Ma# zYh|Mu)%Rn*Jr?+%b``*!H>Dvd{2$Yjr1C$e<*-RZN?1Tvc!RvamVfBpw{>CLR)w3D z-rUaK=gkc_*mKDkG;&3^fe#wll)Ob$hd|_l`L3G9b7z1O*8Qc^TOOo)hS0qa{N$E2 zQ&mF(qr|*+knRUYvd;Ifl!bj6!-cX;UtM5SQ$eoO*-3oUWmg&)&Z6>Mo+>ZzCFIGA zuU7UGgK%=|jPs}?w%0j@SMvbzPOy2%see8QE;HsXGylKZZx5Wa1clImG-(oP6A~+V zdh%rJrpl+!c9|sHQ=v*LB*yMvI}GLZGl4U7KeTQwlxtPT89x5HJ%Dl)tK^z*X`5af zP#mqcb|Ns`hNfh1D7Tcpt6Y4<^!8OC9ZjT2Upb8C|getqIf$yW)vc76W48wHm7EEdsv3cY7!aZh&WFV-!nJT*DbWP$uk~hG{M@)8_V1-|oK`YsS56wa zut9^I;6y-&q=3zrY7?hc zB+LUthfy62GDvnY&o2S_qQzC8$W^aJ@buLK@@nspR_+nIHC;!kNu(629u$m#DcO?Fqu)R5^Dz2qCEqe9y#~qux6u1aCX<}=*O@1lt zGITC{xB~n*1#MwYlQ^KXZ`6>6UOc6k;K+z?w~*LZvdCet^v{&@J8P%?ft@gBcIeLw zE*sZf3Etz@}r?{ncVj&KX`TJ`5ua+>ScBp_kT@zUMW#O{3rNq z0 zTB9FrTBhwTsJq*^+^m2&t00Z=J-6!Nkpd#|+2cE6GvLfXtaUR;(eccRAJo{1X!66u9Vr!^1-+Wci? z{0(Ebpy+09jzXR9c|xe4^+*Jga)0xHFZpktf#Nc%(>&rhuv#1qLx9553PSKT?R#82 z^QROXTQZ5-P8FQ#tC0#^1sAzT+s!4>y$sObU;gNC`h)Y$imuA#5^S($HSH@t)~DMU zzzs`mpx*JXC2Y&DHKJci68Ve8W=_pnUg|K+%2-OfJk`QD6f(JDpqsF`a z?__NYJeJto?|R~}Y^zZFO#XL>k-z!W%I8WB8~u8$!;LpexS?K_N)4w>9k`YCvOPg@E#}g(f!oTE|;mMeX%71 zn#w}&t6S`bi~x=b&e}IDD$IWly>x^ywg*hWS|&544Jz;2{HTW_6X_V}U#UOb7*qV# z<2J{#P!X&xXjn=AXD~Ab=GK zY>iWhe1|430OrC-Gz%N`xOU2#+p@tLHUwPe3=83w&QS6$rQ62PJNZAj!d_?3=ey-qhuR_!6}#1uM@~-E8Mipp{!N*hyR4tx%-oFP$-k$ww*KYwVMUz4&V?4=5g`%N4ody7}QQ#k+@ao26afnNE~S-Ae2a{!Qp+ zEdTJduK~;0yrWXy-&Ll=({t3tY(- zvQhZ-)jWHeX1cY6B|4SZ(qY;a?GFh>((V2N%L)jrFF2O=A+{w2RcQy}eQBOf=1y=2 zt{SYkKCYWuU&`p^ z@!H}AF{r<&(@{qHfB7fafa8lhhLBv+;I_rEZrXj<9|S+$#V|WG=@c+@ULvw#88e1% zC_|^}G$$0{iccu;VaaR>D7}_qm%HH5Zh4K-e%7>&t8=0_xs#d^gifB343tOew-d7d z^wdBx_F>hVFmjU~tuUaJltc$&$-y^=Ov~_l9b>~v3Lp{d>gwi}Q7zvLed3K*M58Fs z8Xm1qI%e1E#O(<$S41p8AEP(d%Fl|XjmIV#<>CeokWu(}I!t9~%OF;yQF2r6&)5`%7LxVlXl*c&=;o!eC$7x4&o&0E;+JT*Uz~;6X8J z+j|8-^Udhz0f8&W>L zoU8h%{5o2e(bjBV?6L>+;}Lk?Q21Em4AC|VVynmwdHl=0VI2llu6hq1n@ehwnMYbB z5#e*UX%SWGbW;n zlOO|17>f8LiuKUwTM%_Eg5G$+@W$cF|77Ios+=!b2I5v@fGWeMqJuhjy{L~n6oyf9 z;?eH}oUM(q0kFr5>m(`F6Y3<@C=y9wierTu*QgD3E7ejD`jNkwXVXQe$BTbyhgDfc16VW@0T@ zl8a9YpW45?CVcM@VfkXB1)~uWjJvxLD@PHsqW{w*)~=RX=g$xysj;Y8y zh|4@2`73lsMl|Y5M$WZ)n}8$}5eo{1nSl%f9xk0s%zdf^z@MS&&?$}R@pU*)=ih`b z3=Fi_BpLp1(}aRvL}EF9!$=3CLrHDLj+3Zj4{r{FKP$nGa13ST_PB6JS=R!Y`){6h zcb9Q?KU{wGB%w1CDRq|BvLRiX9h&W#Oly8p>Z&SbHEZ0H*9(8mm?XENYwZEcJt~4< zTre{Q0zPMOD3q7rl*wd*xHt9DXgh?6?zy@9QDMNv2+IH!w$PClv;1%=j5t~zAq+Vk zMb^sVOSy&Z@KZzJCZmESk_hL0Er+_x=>d5P-E(5ydQmKY!SeVMZNccBj;X?_%eRG# z5?dr)weIopTaP0qgY$E{6GIFxIqVX5H%lABAQqd&ptOm5V&XQw28I~zrA=WV^!|hh z1BNf)0Ev;e>OLM0b3oJ(mjpUB<>AJYB-d z+Fs~lnA=(cM^L>&Jr*(y--5c^3wLRDsqm|bi<&Am8}RGEByV8U0Sj)w16t+@Cs7Ot z^jjSNKcHV*)9?R)e)I9~|I)X1szET#^R zFYWizO+xBx?1@K>KQ(KX$?x<*yB;qLx~z2@5LLdCJ>NS$-*um7(!bW9%YUOzxWj*% ze3f>fxpO+_(JBzQLn7-Uv3W-{O<5W+*T>68NeeQk}p zxuB9gVo4eeJn~H!*%mX*1{y=1y8Jk7_ude=u^q~cjcElO_MC&#e>Ps5*uRiOTbo>w z*Xc0#%Rh>t9z(#+y9&!m=hUkFfCqOev)63`K(VD*j!d-%f_f%lSBGFv3qb9UG!|tc zEvu|({5-)Q^y?r1=#~el^!g34A8>7v6Ix8#cd?30hGsAymD*9EAE@eQxM$e1#Io*= z?~&;aR^x-t4x1un)GVd4e!WW8^uZu&dx?wXj0g$fhfuil&@z;^AXj!G8w&{^OWpOW z0H*(Qgg%_tq>P%Fj2TMP{Z!)@0e>rd@+j}5q=SV?gW2V+o!J3eF3?$Q=Cf@(V-b5a_|ZY}Agqz2Alom~t6K&*wd=iVak6kDWN-I2>it>dX`C9X z3Rgm0_a-EZjLt-4xp2Y|X3CfcvZ>(&E1aO(6^lTMBgPVHe4Ujb%xnf+!ACf}UCfM= zn7j^#!-lxGN*cHdY*0oSBaaZr3sVh$>7*Rgw^pTw?(JgS?Wj{fVc^l%%X#(fbYP)| zV4$=?0-FiKRNq<1#w;`Y%$DluKxN5(naspSD zg);diSBof?)kbiw@kcTFb=0@%XC^}>DhG-E$YGo-UQ={3A>8M4f7WO`M+xBDwUd}j zt)`zWCivqxGmI0*N^0s9zT95{vWj&1!+mPT3~*75nT;qm6Y&DV>MxBt}7Heki8 zuDsU@*m+zrGDI1}NJNCW`gNe?xsX1CyfTBwx7IJ++@9|f7JFoR!hM_hdkp%QD=)aS zCdClXw-jtwi#7K^g%}zx%s&Nvr3|myKD4~j&#ZNZry(nPw{u^lW_~Y4;^V$adLTAo zS<;_Ls%dUgT*PW6@(INRn<8YpXdSLmsbNa+))kLJXa;4@=`2cZNpsjo65uM?|`hi~I=#M@DCvKF+y;Tu# zGUuFZ!S?Q+wJxW=!vvje_#Cck9m(`}!IG zCCrEE$&~uZ83uS$-PXXoe_X)k4Mz}xdppFxX2fL0)}fE8Kh$mr%K`t#0tcNvPV7(n zCOau(d;7Fy-~58)?`8jQ@}#CDyf9c}TGq7$*V{*2MX?l&swBOuAtlxP6}UgA$8B7# zeO|488v889>v0O}=Ok*{wr_AOj1(kVe5?s{=h5s%4vQUViWROIlV|I7-Y*2=ewpWG zZ7$sParHOOtU}Hc{D6cGFl&kL$v5N_=e0s3`QQDW$}tIyq7zj4ly=uSxg7(BQ|h($ z*Y6dc!zkwRgH?HoiM7|C&;9gT6%pej;Z^BBbwNMiN(Vr5++=-d$^=}bA6y4?rE=|d zFz>q=o=@ubJ4Y0J88}eZszTu({o!SHun|R9hkj>@Flj?$jmm7|W8p%Z(eH@73#CO! z=!7;S+y8}cp6-TR82qi~A?JMk_jac-Rl!Sw-b+KYlEU;HAaJg_+XvVc9eavR!`k1e z5LDRec)y&#(U<&X=04$wjpX9e>{A1m(I2=L9LCAl&%#%Ya5cvlv`TS$nSje#5E#(h zH`DdkD@8Ql7eE&mazEu@gFh=+BN6*yU(jpZGkC8M*=Uwn1O2jOF8i5J(IoUKyI0kC zob7@S^bhZ%FThX0z7$;r&`oy{bmVF|RjJ7B@Hii50sX_|B0=j?MZTwQzURes2Un;N z!46SybYWMvjVZkRNoP^fsCp- zc36wsuE%qzt2@r&Ut@FpRe)5S;wdQ4s(Ti2jH4X{Ej1)5=&PG?&HO;aC}M*B@4ua@ znF-L1Sa2iG{Q)j`bHYIDGA%quT|v)NOhE5ABLy7?ASG}L006Cvr_*%(lxhUNOBt+Q z6M*~6#iF!{0z8xUt3&puS-8m`8bI&kCuk1uLKQO59#o-HmV`pM4QxYRvC6uo<=rMO z40&Bsae_$@WhcJLxSPst>M+NsfjbD!C=fpy5$*d-v}9u& z%`6)ttye9jzDfgK|7)6ruC=}3#c@i6#AV1jQcE`4y22Ku=C%)RN1j$>mHNc4hck9I z@Nvp75ezO>8GCsfdnMy+ogFwNJgGZ|jtD4JUA-+>Gs%%Mu@Bd9IZrRCYwG?)B!KdM zC;0eT4#p`=)DYs<76oOVddMAdqpSi-+1#48b&E)dAgsR$)nR&{wMl{HC4|e>%hwG; zN8K94Nm>E7@1Ktu3q5NgL`aH{FgAlA^}p!{~KLm!lDm5%yas>#qC6Yv?J4 zJh)@${xkqwR&k&tFp1AmSJ4+16IcWN40;?5sftqo4Nwx+WM?MPcZJz+@a9Rv4jt&9 zwOyrvBy!|{IC3q@Fd#UqP~QigUUtQxlW<24TaGm;?IAc&Wr_p8G?J+*2|zZu1DFDS zkAzT^?v>I|%j;o2|5E;0j|+u%W1 zJ{0(q#G$v(PK22$4|If(Yp0r->dRMCu^}$3?gp)ruwq61caI1a*WXU~+HP3jOt1w> zzXAIx-lA|Q@U$(4uE@K^s3g(IB#mLn3K=NTs%pR*a|q6kS;!JlRCOhek4(tGk?)C9 zrojMw_!lboPIg0a<+OH%%q5T+=CWm=rnnJVV5YcrNRwY}!z>q;2zL?-)7GlchiSmqY`)>|zV|(qQzF$A z=dc5D&kayzjQd>1rSpNXGcn&Kf0#WiyQiMRJ#*hzBHCFq`f_`E%(RbpW%mHgk6@o0 z%o3j%Wp}zzFcn}s?&Oi#E!HN3*&<#Bl_53BLPdVo8i(e>^iUprK0dD21Yey*@5ri9Re>BwMm&+g!a z!DU6@LtLI_)3Aicvw)t^VKWr%4-Q4l><)fmD0a4@KBHUc4NkBC_MQU~fkDn~50F&v zQXGTh{3noBFA{OfcK6?#2cgaGiI+2h63-E1p}G}HuiM92iD+NET4AHQqJ-;T5};Qk z`|^r^4KmV(cUkYva@V@Y(!z&i2gnLh@osx6ZrrOJQJ-gVu7r1YmbZ~r;NlPqiHrk> zq2drp@%Uiy=*0EeZq2e0UEpsl2{@=3-5oj1@Dm#Pq5c^eG2pHc*9sd4GE@tLV;TD+ zraLE|+6f=rSv_YyX=v$G2kXduED<1*bY(JLCwSyu*+19oaZ#iLbQZp;h zjbq=fo-k3LpPQld)7qh;pPtK!m_G;Oq+q>)F$UR~W~8T*2<@wlChto%NeFCO%M23e z3?r8qJ_whFs-l#TDi8E2iZkov8H^GZ8x}GD_|lOdY>3;dx#6q+z%W#K<4&yIXP4;uBQBgU>mMop+}E+}l5;A~lLqXz1~tbrieRB{*BdN82;$)ZZ* zCFP3L#zJblqv&VqC@A0tkfJ9Xf`o$M5i9q zW}93Fhdbwx_(~^*{0mVuw5b(&Q4e!bAW7lG(2pVDfaxUt-|oTuDs8#_R%fX%TTZw{ zFuPPn?#)l`oh(iCYI(wVyc)zB&I5Da)_JGi)Wa6m{Wz}PR0R0+pambd%TX!-Zj?Ql`~7U2bB@w-Oz(X*f#hsVl*?VmI}Sn3_#~hD4#bqu zhF=##N^V7jUbE{OXwqd%SqNaFCj=qaSKAnxgpq`*Xv4p}(QN12{) zxops_gU4-Jr;_6F3_y6UzS|?PE4=1*J&~BxaY8GrPSpP%T`-!Ort=e;04m^}z(%he zjLLtzQR(G6c#8Pv?~~TRm0+!4{OdkE%9Ct^^fMobS8P`(DUdjjTO?E=a=)+N2!lbw zm9U~X9)v(%qhPV>?2nH#qa z1K&X42&mA*63;8|4SBc!==^Q#5z`&sx!t`XMh5H?H8QY#f)kN%EN4uZMP7r0y44zb zfrC&pd*@IJCOgh=5+ z{Mv^0Tkgnr30|EJ4M?iQ1*(899$wHCyhd{U#5kBqH~bdW(G` zx#2~)K_g?pH9z-%io!(`1O^Srf^*pA^t(j_@WAl#zk3`5o=)0w)I#-)COJzF?elmt zrht0ldj>edQ+McOb`apruqC80-rBT%FFU!@2c6kCpTF7E_+{vx>4<$5<@)6O6_a~{ z45(#Yc^ejjZX|xQCG=!9A=s2dXW$0iKa+kFu#Ts`z5_yw&MDlP3Hd0v@!kGl;IU+V z!lCBs_kB~6$L|0+qD4H701$FLGNn)zqr6J{CZEuh@}_K2B?&?V#?6bdbcfi ztA?q04g#_EBH(YyR9TfWV!n|AwtsAUUu*=;%qkRuDs!bgBMIoedO zTiN5ZCG-uBc|2VpN|8AhH(7eUDzWxMFJ{EPfxL2pKK9QRf*1cD`wj4U^2!w|1=(YZ z_mn{B4bJVmEx)}0<`J=za=$ChqyCzKeaC1ico*2^X){*UQ6KUW=+wMIrY{I z%dhhjpRso>xY{uUSu=hRCFz-ltz*_O1!)u_+rRaHn7XFao2~*OW|?d-ekQXa|2JK^ zVYCQIOpm!d@E^u%gD&O2p0dsO=o$)<*gN;LdX`Ub2MqVOcNHJQ8Q*D>W?+|0^Hj<# zs>pXt;oT17VB~ZWbWz%rn-ht$z71sh?FGpFL<+L{b`=RyYZkQE)7K-;yqRY|Nw~e+ z%&ha}ZFJb8K-K~xR)MU;QFbU_3|3UzKyOougys79*MfP#p8XYX$sqj8+i1F`?&inS z$j8!XnTDHh>A$?Ecl#xTM4%;A93)K{G;^)&EDg}wVKE%e7>?8TldY**rzTl(A}&fs z{;uz{dfeHcRN%|fJgmWGg^Dae^jr^qRKS&#l)&|Ua+A={le9S7TZu90MseSRm9LT5 z3~fhoC%cu9mJA9O@Z63{7;IMp+O_r>HfpN~P7CNGpk0&Lj~d3y+>QdqZE&{h3k9W+ zgj5TDcFNFvUy+Y(CTL7Y1nu>5o6xlxB;Uu`iC~dJRh9q2oB#zS+b9MQYaOuJGKPP0 z_sz?*1aAFTbSL!T&a?I%S8Kk6a%aXfA#F_!?#qRg+6*735rXg^*?m3#fHRu?hL{fL4CuAlc7R2o zWR%Yjg2Q6Emt@3ng`5F=%i)H7iwy(dFw^0(@ZmC?V}H=lMtbUs_D@iP;FwH;58ZMw z*PXmj!Wh;QB`a#A%%^1n=a@(_9+m-I9CAv*UE{M0Xe#YJqeQ0Ba#%FhVgX3HhuWM8pa%Vqbl4MpTR zX=FVZS@wbbaH2ut3FkDu;B(j#1;sdU&e#(G+_()O`f>&Mx54TDLI_pZ=H#d+{u|tsz-ZmLKL_ z{Z@X=5^&fx%D6qo*4y&N_-xLNS9l?Gc{U0EG@H1Ra@&%MybKnJW<-h$e-1k6jMv8n zG>+X|bJQjD*hK^t4l^)&$b%%2j$ng8=){Bq4qtu!B>jIUG(r>`Ufq0G%Aqcg!@}D5=|}x zwak=na*GDHqXk06EHQIuAhCMz!1u#VcPHjxbt-Ol?GW8>5M2;(1HE>+Wj{;Hf68l{ z`gplwyv&S)8(*{T?^m=t4fueV^sgXi{JXk_Q+|qnrivee{Qicsxg71qFLe_U+9}B3 zeAqdEqK=MNJ?B2==U4|MI# z&E@093Rs`$QxNP96Fb_Tg2g|S0Na89{d~$ESgY5l+F6yIZmiZ>^^#z0ZpKBF^tn2m zDLz9Y`bQO5CiyYIG^(BPPDEgR}50o78_DzihTSKO)fIq*S_!lVajtk7*5pZ zw(cwvxf9q0k~K2Mx%amR&mqTESU_)bU=MBJW>Vuu)V8=acT4?k_R1NfD>9_ik|(dS z6k?-CjKbD!MqPK|5AKMcL_XK=Y z_dzPg^eM~jwX?YFOi?K2KYNz?+Cfaafk1znf=fsh_=rzsLq;3W*`giy=4S*rZF@KJtZx_-sktPshkNgZr@JFzu1TZT6D%rfz`! zK>c`<^aVwF-*dO%R=|R{;Hu}k{yj=5fA4O$*9YEf|9x-7l3cpAKJ%F(u6-PSC($<7 zF0BJ4Omk`(vC(x3i>ZPFY%|pADXX#i4SC*o(ZeK=Xq#}%etD>l@!maQ3f^VMqf?`Q z@hVQep`z=a(4GHwZxP(J6*wVx+IKR^mIm00x7GX$<~G&8SK{R**$x_(c%1aP)AQ{? zXr&)40ZWa+qAItBdO0mitxhTZ3rX?b*Z_RIyaWOMzFh&NKH^B-!>Ynp(jM=DZ@-Wt zl+_J(`G*g(6XwElKEz!egg>~7IFIM7yK1X4g+H3!QYLc}K7aeTQ?H}J;eE(ns&lNJ z0jbgn`N$99F?xzwr`SS3Np6taveJljCMc23Ww&I-F`dj5DSJ06dBuhmz`I^ATy_e?J1^l|Vm^5Nnr z@Z-(^lq8GWC7h#+Zq3$v*>mz%|I4*|Uey!gZb`DuWv>yjkp6S<1KC@YQQy>tn5Q6$ z`wjO{+=^g^t~ra*`|vXPgYoXb-~qO$Gf$KH>mW&AMx+&uV8Xi zcgw!;WXJJEfIs*_k8cPb$>cWq;Yx1$9t3zX&r4p()vMSr)|5X$?GOSzFR&r9K`?zU z{q4(S)7E3zj!ve~VaD6XhV=$Gg&{VwQ`Gf)q`BZZw}XkQ?=%ttNAa9b+g15FzrS@- zN)CS#yH83l7Ea+e3bRI>7GT!`CQY-v##8g!HOhw=jy_ zXyn}aWyz2BGDt)BtZ2AA`14k%pKUMC%AQ1OTcMaP$68+(J ze;LhhPLEYo{3o|9!4rj*3iQ(#vvMT6#rJ{WeO-I&{@>De!tlQVQ7jBl$t2hB{PFW7 z-s?R1G1?*b_93FX15A6cg!yo`9P8KVpVc#w ziz!Ck`Fk0Mrh4xKUR~v;N}1VfGTcq6r5f{Q@)z_KM(x9RLu!A6qdtb&n$zQ4gWQ}OI16&>u@1y;maFBR&bT+z#Md^~6I0(u#~}lqoHcqcJmsO{sPL>f0d5Fu zZeu5Qy)bxECle++x+96trMwqW20ESn=No4asQtn?l~C69VBz-u1m5L!wWWShbR8SG z5$PAU&jg8=G#9)Oe_I$ay(0-*F3F{HqL18TKy5F-?!+=ter$eZzD;v2=D~Fj2%08c zil-!Fof|akPR_S_6y=dE1>dA^aE^idjP~dBU{!DQC9Ug7g2r9ONNI-)Dnr#UD`p^W z%U%ANoBnQEy1ndIoJ)%J8qF}O2?$%m3{NRU6*(}ykR(rzvy{`o-EkT|EY>k7yqbCG zuuzZq6viX*P4z4LP~ZZuulwmV=#H!V$L!lZ<+niwlv+yTfj$hIcAkJ92Oizajo{;8 z&cj-d@fn^YnJv*qcwcA9BY~!0YaViPf=y!ym;-7&)3l(+z*@^A@+Dz zCY?EfwR*O3@3^R;s8cbdb~rh9_DmErjO1^^jg!vZTt0+haUeH)wlSaAShtKfKi9G~ zrnuSy9uxP-bL;SZ{P;Sne9A1Yx?<~m$mg&c#oxL%Z|BIW&34ZXrhQ;3e%~JY9wEdg z`>J`xLg>(s#CZr+(tVe^5inot)D})e>Vt;ms=GEh^bLlu``wbdKGYT4Kk%sfms)>6 z;JHe6j_`wK%U!S|HLDBOJqa^CL3XxFl$uPs>eZt&V5=QkM}{aKzd?1n<&n4dnP_Z# z^vVny(mj7462^!#<}Leuiks#{FX-%WQe7pPz(4qrFF-b2^NF?X?S2`S$mo6Ti0vDI zZ%PpC&<5@*{Rd;l3&GWaD1^e^fP}hw)att!WOpD#9@V2m%GS10tk)NWT~FueFoS7>hc>^-4qRr^GrH zZgtyC6-VR=l16Hl-f|q<_*JmwCr})+5#6mQ4cZ_%QVM|&zE97kP-LCfk8XQZri1Ff z*(yG<*5r>wsT*?fk}B64$4yj0lhUU8oj9dq8a47vEvG$Gz4cPzc2jhR%dXpuia!CW zGDP3BVz0WMv+y#q0k+>|w!%a9+s2WE6#tWdA{}Q<>fuHTN3B6of$Q$K!-As2$07qN zkrlpEvS*xjFnB7|BYMlWAoR~tl)r|lzSQfNv;a^$`^&HPt~NcM50U_*tYZGo#RU^ZLm!!Jb9rqp0yf-jc0Jq zZ7 zUD_a|#8#mCO%@Ow)p|<*$f#*dFrw|XKjNai*p=Y*Y?;aO@~tncirDiQ^3xc&ocW7f zHoa!!K0`Z}^CJU5le-x0H79U*nXP0ne{#2`oR+DSB4w&Nb&49B=CY8=(s|d5Dt)Oz zI>MWn*D%4G_*68RYU1o#d3YL+c!+*k>xJ;GK18zYWeHmkpR^OC^7qXEb3c{^p+m8h zs6jQh)jWWsvwrpI%15uF;gdbx>LQ8HdOTt#MgjezE9;jbxqfpA!HEM^U3NalP9%uNl5)$SLtJMs$;@5MKU9jEYdcvwRK#%Q2 zZ(f#4IhZ)OU1=$}x?hu|ohFq&@;QIk^ByP0)5%2Pq`A22mwJrwiEBYRn4ARDOdvb~j}1q_ zH7MtN=VCUEFG%D8?6BbXd0y`vm8sgDWc05e2dPJnr@mJm@W*)sx&iLaru(X|Aa79w zSB0uAV2e7@GO>R4KD_oo#%O@?xzl$_6OUam&kA}6t+5@9hbZUQK|?a{Vu2cc!pAbkc1umJRz<%XLkHd}3u^_`XBji=dU=A8E6bbI z-sKerm2N9ko#O+2et4^iOKr=>ssq((=DK#ZQGrz!PsB7H17&NN>sT=-Sdp^ki+8f= zl#iDuHMSGk7pjSzVHs}uEZOgBXyipHq{24PTnCAVLMCezB@jh6jYII!(l@y0WAR=1 z*3II0YUd-hOAn9r>aRIfJK*hGfAR>|DF((5LQ6T6570@*P;Su*bw+$(DAX@i5BJnLXo+39z%g z0Y}YgTQ=CM`kKHdmg&jh@INho)9ZN79E4LSV(Y0;M-QBG7`i$Ig&o0KjTH`yxxjs#_$LR?df#p1ei8vxjc|cE{a^w{n#IVH?$K5e{SUh-eXi zr5L|$Ss>65q;KDug;_PkhE~h(Hp(SqZdVLzOgqqaE(6aNW>a6#?u2~+OV?ZYr|qx# z=@m^8@WYu#mF%)|w6ZcwS4>z3P}aqg{H(1kFkF-Yap=N9)AbKQT7d zbq+(G&s}prCZ^yc8U?I4TRELBfh*eTo!nmBWBmvlo1Ami;FUOzbSnaL+A z5c#ew(882&y-Ap8yCVf}a2$dsw}|pjC&O>9B(*Wm{=K9D{MT#U&ga?{zCOHTDSc#h zp~@xPBGf14<6(WK8kPRY_>SUwvDYC#jtiCi4!tuv=LadEbUjM3>kuaQlG;byXdTy! z<;r`pM};>RCxN|V&CNh^iw-~jmdPKkD#e{sg}~5fidJgY2E~P}=({Q1MP9B-<7J}r zsk`swvp|bs=C6Fj_8S}Z^-;@SuGQIl|FY-Ovk_wvH?27phjSFS8NEH#UdxhRT~uYvt|i zP8MkKo9g4c5dr_efU^O~nyHj{96D3Bl55_fvSP113AR=)tbd4+i5BA6(}T z_)Kgs2w7Y^ZnVtLDeeUn&^?0MME+KGmX& zr}S#ckExHNjEsB6+7$qASL=l0@6KhP44u~*t-Zg5qio8eBuYQO2_6=+9+*qI|Jhmj zS;}|vG*E6*v|X=1ZrJJvy;j~676%yZlG12M9kQ}yJV~4H`52kISUIP`s6&>5&d$*) z9J6cG6uNG|(9Votep~yU9cu>M4OQIj4%T@GUM3a3(u~^aBj0u7JL|7}S@?_Z(rfJx zYT)Cj%@*-iE~4>;rdsfM?&U-L&mFK2hdcV1`+`H@UXNAd3FNMc#(yKxu+}>v6!w7L zNxO6XI^CT{zk3$hH*u8MTD<+A;ff0&)PkZZS0*^b-jg2QEtmOopGBhcR8$k&&g$ZhS z-xl0GUQxvkoteNp{j3Pcd^5u3mqP4{uJG?0CD)Sw&0BbaUwq zBH6mZu2f+P)u?(P3ehFi`7-IqD{ms3y1c6}fje&_=67{|YwT_RmrG*S?2~NU-S5Lc zH>(^%SPD7$yDY%$=)fw9bEQ3X!NeUyY->92e09P?{^K-qdx=R<&*bEjMb9Sr>Zs`( zkF{+QU&sSlm^=8m??iMje zSNW#usvD8WuxLTb(|x1d$@kDOZ2sha@iii?$f!ono~L0Zfl>7hLZkcu#vsP+t;z(% zW}5)Vw?GNmR(rY5`TXhM*x$*r;`DqIdnP6uy~~6RU$ZQ;>M-Xw9yWvuVvtwX&w8A} z>slYlV2?IGSCeSP&RPLX*&*EI4B@gczR`8_wBT@xuAtESXcZ;0}r4x>rW^l4NQ~6;_raiVW}(S)YsB_=4v= zvS@(Of7iDP8jaWyp9C_Ap;(^}lNAJV+KOP$LYQ`gZeH!4wdtSCMO?-k6MWu`pkbG_ zuj%jyhxpu5{>oFxs;rY!AnG`@yPxR-iAGJv6l~E7Qdda!L12Fi3d`S5e0xegnZ=rp zT3C7heEl>YL3~T-t*aCCFzp`CFJdx&^^ll+-a%`J6FJ(2*8AmzsRIx^C<_t%E-thZ zxW@D%E0(|DNSXCm;Ie9U>{Wg#eLsHPOtwI;H^^eglYV*R0ryS?WLwm1(-af~tL zVO($Oxf?fbqvP0xNY`ojb5ZHqobZjVC8!v+f}olnRmcP`yQ-jyFw3{WyJ&h|$99^PsAx}pPKh&JdijWJzqq;fAvg0*w{_@!zW~0ZL z^R=Ch?Y*5Pyqr4+6HIH)xi-ybY%hrava z;5dx2!*5(!TuNhlTmKW|s2Kl2ef)kK8! z(EnqE*9OdL?(^=?<@dJOTG+EO< zUhx-Q`Q_CoZG@wOURR;DsmER5Z7tVW&`d%vEkH_38Op`+L6}QQd&>*{1AT$t=wlleRBlqM||x9XOx-NPE6GKOe_`paD&M$)U|rOga@Gz0PaJG^gi_IVcR! zBw>O<&Of1rZ|jIvo360M9#FlBC*@2io2{uUkr=nX^@?2;zmZ=z;)bVl6MBGzk` zD=c;4IZMf4k~tK+d&Bee}cX7 z=@m}HI%a}|nGT4R9WC2K-$)XYXVz-y_8tUcmEitlUUF}j3p_h^SuujvF8VofHEuEr zop_zEyom6$4p1Om4kfY@5Kn>G&!)9M7zMlB)Mr*<9l=|nqxlW*6zmb1xY%za^5Wka zjM5Tzf@36+z8+jtVuSkvIpGYh@vJ7KIcr^K;?!N+tUB>~q@pOBG@{i-i0|<TCwY@7cK+4LS5tM_5UulR1Y|ds)y7liW)rl~@d@2$$j@ z?kMo1u0N>~rbrCsuirrPu$CPFcWNO&I3_6W6N+XPU?H92gw;7rZbe9O6-xROq<3H! zba!EsnvuRUD482Qk1()m|MRdps`Ux0%R5`by|~O-ykYFqYT812Q#*d`fRc&TElp1F>5Bf0)l_=vD0|+xF#GvLzkwAMd??rV z$Y#q!zrksEe8^^)LAH+ftdUv)m(YWwNpIpIzO#3pS^#)eDZYO8JLLkd6U` z;hxwv;a^kg9Eq!x>bLO(K`Eg4Cev0qOKy&IUbhgqJtl^4xqj-0;Qog?q)d?7OsqGR zGweTVDT~J7&nGJ859x5<95H?Er8|OkOY0M77yDNAqlPlAOr8Ph6E;QKUFGf-m~>k< z)1{CpQ6>{aIu9FTIfz+akvc@iMyq*!FjWtfVpD-DKe$qGq<_W}mD@4(Xf++f5)F`= zU}n{ofLs`Mb@!+r7A4Xvg4t1`jJt6T;6oZLpF(B2R1h{YSVj>aF9Z;pF>2&w5ph6m zb`zCH<+(CWPGY<@rxor>wtz$6B4VFJ^NpWjO!+LkLi?Zzsn^Ywu)p=>EZ+5*R1iE= ztG7=0RMyg*F`h&9Y?xq_P%xTu2 zvjt$uY7L743Bh25!P~!5zqdI^SjeZZ)q;h3YmczSojsQ!GEVFD>a4jL+D#0A=0E}& z;WK3kgNEG9z1J>-kfBOnYCVS(R;+sFkEM(<>G*Nxl-{BB=rDbP#B)(ixkpeyPAfj8{+i2_p+O-mi6@cM(dg#-iDg1UCU^|`NXn^aaXx_0sUa{ zH|485$@<+*2(tB9<~Sew+tr1gJq#i122;Z#7OjCu-Ej0h9ph_~Y0(!m5eOF~^ zCVX#hc6h`<5in0@N}=Y z9mT;-!51L@WXIj2K8t`6PfxBJKVwZ1c$x2Rjsdu~^ZR!LORe?1W^2xDf9@?};3 zueGxdYP;LkKSfJ%D-H#UyF>9}#oZl(Lm+67;#OP=#ex+n?gXc}dvSMnip!<%x#yiZ zcjlfsKS?IZ?5y>Co|Rc^@<(>&yScm+bV8kGboCKx{SXV^b|;t^F!G@oR2v>*XH5%K zq0BNGHcYt3AXM3QcTsCPkmvwz?-V}9mQ)0605@T^OWaEjG>OXYYZZ;6ShLfLdvN#& zgWI*MRf|h=h^Jj^=?IfuODTTy*oiaBsQcT_uO_Pbo6w^Xl+}3WlHua3#Dje789%XW zs}C-*=6l099WAL_!#mHYwNUfweeBLw!_lsyfDONn z`!0&8Oo@Q0GRjV|2}syUbBz7GnOh=|e$BUK_I4B~T(4{hmkhFfPSCplH54&bRZTQh+??7Aq(%7342IF%HK8=P{@g- zlnv-ut$H}cnobhGCWYN$wRG_9VB={oy?{R78fi=MzN46PRSQKmSlxp|HSSBx@;#E@ zRYU+|A}C)nJR}O|ta5yEc0_@EIGl_DWu>nX_+(~dsOrYknUIhe$Kz#bR+R5%6jzUi zc#%Jb?OHkLu?G&=i$X!!>+n=23U5Y4AICx79vK2z&M1 z$z}4gh#(9MaX_gv-&3#|7_Wuf1} zo9hnC?UY2QGSjl$uiM&EP(MBjZE(;)?h}qhy*Auy0Zm&`FV`yTWS*tcLI`*o^r)81GRv9Lt13)Puy~~bC zGAJ|2<2*`RRRd!MUr3iM#K+0rs})^|ZlZl9+ImIi?MwVjxS+zxaM4{pxh4-zu~`e^ zQT>F*E^Du4)izhyuy1qB;<^~_Sr|lPsNf}QqsU)9v5POjeBHY&RW#H7sBC}x9onR7 zV=EkxpswfLScQH>qoHV$yV*m+XNq4{nw|^0F>}@cf1!rujFwg91y@b#mNYuKpw#am z!Wv@zYFjh$n0f$_$DOziBKcK4 z#j{nnd;mUJvx6DTSzu%f)g8dXq=s~$#r%Nlq6oCdX(-*I&j#Bm>Ol1@*ZEt|YWTxzRg-C?)t<=iLNffi zNITx<&U<*c#;9Iewi6WIe)nk6i@>FQGEsE9)symOXJBBJ{CX8Jpn9C~HQ|Qk;?J%vhy*t- z)o!8EVBeqsfirJ7V+^SgFT@pd>0EnoH70;=&E-B;{A~ltBfR%#5yHiM7&jj@g_aCV z!28G^@y|V+XQKcS2*jw@=V{{TlF82O=MPj4qMpw>aBD`qug>R3DPYM^3g#0kOea658G?P z&i9|IJ`2iGQyNpra(tA?I z(=9%+IIdGmofs9X=$h`e)f^M~iuZ6 zXOIGL2c?&}aLXwSbRIQx9r^Q|V|P+UQhPTcVUAA>EvzlgPNc0qa49`JNk?FB6LD;- z!cklrHi}Ws1E+8bF}Zhmf?o*saC$riLifaMX@Fd?nY>WX!d^YvEWo?=HnAyGc?Bk2f}bufru!z{+H?MKOVfx67wI3F&y9N!MF zF!wlE_PV?e5=L@B93~IgC3-+BgX6s&w5>aJXekh>05@+sH6s1 z^Dk5dg)D=>j%P|cO`~A*DqG#^W-;}~|v$yNxBq|R`-BRuG_k6c*JTGKzmWX6e5R>Q% zYcqS7S_D7U^;=sH4Xg{sCJrQ+taSHRev8;pqM=yit~LK)woP$!a3n}yR9gGM z%vQJ9#TQe!#_cuKyq}s-4qQ?>EjpKT8U#^X?BF}~E{E2~?FSEhm#R_++UgWfMdqiS zV=`0sL)R!g$*+bmU}xFVTLGLbaXR+mttfbTZ}4hswR1qRCHf@F?lQRJ)GHcG2H&LP zi<1Ms(RUZs8ISr}<*a1%AzzEF;`iFjei96(4&axwmYib(GvUw6lIt@e;*~%TVuwUO zmKg}L@Je_-%`?Ygh?IRew&Y}Q#$HgNI{|DBXfE}%1|jQvfl#p3@wE4VS4Fdkb^)ef z^68PO>H1xuLBmvHXO74annOy%bp@O99$mO?v`amF>nDKbidKl6{~&4TCwUxS!S&6y%ZarE@sAB8q@f7+65f~Vm=B_x+Wu#eP1^x%0`*kJa{kCph`${ z>70pqB#!5ERku!4co)r0xz$Fih6wc>Z!#$3OYIPAhZ7phX> z0(@k{y@4Rjfx;Zk@Bq_{liQ_;YG)H8lfk@A0l9tevmM8g;Su)e;j&pkC`YFEn_dLl zI%DTfVP;T6=JC06B-QKB54Yd%Je_#3{f-X;v|;EJFY%MqhFIS{+5@T+koIFRAr6V! zUJmNlVhPG#;TS%BD`)!gkBa!R?RtY90QMgo+0)(i>Lae0<9C7nsoy_(aIZ!v8vs-7 z`dIrg&P)kH=}k4ddYZlxmGtusEKxP27686=`yxJ{CleYj!8J_uDq{O(q{&>=S~4hq z1rI2+rV!z9R^)8Ux4^rErOfiB6Pc+o9u3$9*t;ROaD(uwe`{x8rt{<0+?aIQ`{$9< zk0tDQ>?O?Dy*X)4Vib1WECA|(_uYcreGHiPW{B4l7^hd|?9Z0!F5i#4G?^A37`9Ld ze&OcYH${u`3|UCJe1AH2`q22zX>+Ct*4Ib;Fi)z5>MDr#cf_wiNZE}+0m^G>Fm|Df zK_vjcQ3j0d5vnPxr0VNQiANryxjGtbD3_rRrN1oQ2^V6%&eyU;qJ5x$M9>t1|J}>!@d`>qWm`9>G&ILSJmhZDm$!H&40X=S#CDIGYaE#-$b(-K$2Xd8zvbq!D$n(`3?eb#D zuJ!Dyx-bmZvJb)?x*XQ~f0C`w^^mRizr{DR751?zz^KrdfHkcIOI3wNe_~D&2ML*0 zN_|*)bVGXnHnmW129p`>m~SBcDin#dKG4K99`EfAFV< z?i1~-xQd4)Y7c=0hpxCqWIe^T8hoGec{dt;$d&&}d3&lGj=T~aUsmrgghk#p(r%qD z;WuR??BSsGaj{_!8u)(L={UJ7Bvv;`EuZ z#DY#;Q)ykL#<48-!kisl=~kMW#R?J?PI_*XahhbvQ11Q7C0T^U!hkMVknA<{*HCk4 zW-U5%{3?7(c9((F1Pg1t%w?7U%SL8r#c-@^V|309+igN8<>R5 z{`c>MH@42?%y&>2sOz!2f|E`B4ZM^dn>6O7C@Fem@MM&+fI{o;b9qj1K2GwI?UNf9 zj#XjtC}Smb>v57U?1Z2z#kZWwHqNetPqgl9zqFGLd8Bk%@g(R& zaEg-Oc)WUMoX&`+G0ZPyEUe)0YJ)f}&_f3XO63(-8171y8#Ex@X)b>C3B%n^ysz6Q zQG-8e0tyFkdjalADRF?HxSM+Wl^GL(xOu!M^v2bF0p76MCNVn%!;)qOZXFz_{KdJ{ zk_I=Xu`L)+sFS^m@jxTs4dTiYnUkbI83)6|NRpSYT?4~eE9dq+V93B}&CPORDaA!g z?0tyEQV}v*QmR`uKZzTI$CAYoq^vbFe<@M@a-^U*=#5IT49Py(XcwimvjiRiY3w*z!>(4NLC2{a4NA zX|8JeMCcl6o1*hj!qKeRWz*(BC{f<&8G}VS<&^exkeZL%@#g+g-;_Y5f)GqYDzEJ! zV6Wv{URr|Z!Pj9T9bG{x_j6~)rhUl6;@Si$3-{YxYWNFXb87^BPy96n>kCRQ)+j2Q z0-YQ>L_`e{Br%oJ1{YEKUh_-FEz!4d0{~I0cZBn)^M~u2(lIie-zzP2aYZaT zQ(_s7NXELfAuJYb@OkCvOvwF3%@F0YMzP=h*A?aW8af;7LJGUi19-FsLbCa}YLbFo z6Yg@^F@rnby!7qMp)v%D(XYN!;|U8kT;Zh%lmXHcrEifLNj z`DZ!`7FqKNJ^sbuZfWIf3em}=p-M*B=S0rFa;l`@eu*Xe9z5I)mhhb4D!BH)f}1cS z-NClduevjcri=6^B30*xZQIjE-3C0QlZ;{uY+LxLo%WS;metEb#@|0nYQ)cJq}Uf} zBEO}hW?N40_MI}AzCT&9Uz~AB8MX;#X}osZBc-gOr*mZ)tp76ic`NU=^VTwv5JM@b z)WB22F)`6p$6MpJu~wF$%q3BmKi_WTd3Ta)eh#0*cv#LupG5&Lg|6 zYPi1dB`f#D(PawMg_c)8Jox!Dd3&ukquvEcW2AHS<3d?mLY`yL;khX2xV^!o5*L{T z$y9cJU49EgtRk72?`n;w+n(5i7;?9ZF`g4WCx9DmAHPt)>Aq8Y9EPA+LHY8q`r;vJ zV`Qp(puSuC!-k||3(OA&uw4Qe4x&P%AYQ)}$x~0hmow2hBu<(2Xq5IvBpwe=X|gcN zb}pckujCcE zuX?;+U8q*V9CQ4tLG?H0YmKKh+mNx7x$_#zSknoWLIO0Y^7Dwh*PA;#6nw){(rikw zu@+*jwO;KmH^N7_<;NbijSEkg$^Y6uPU4r;Wfz7kP}^^iT5* zzL>r(qtbPVH+JxycXR=3nIZ!&LP=om(=aAPN-ft%GDlQ{08aGzZwF#@Y@cF?Vgp4U zM`Qx^eT!0>n?J7v9Ji!4lSF^i2bEmf-fXemdH*h@QugumA?=~z5B}Xj2tV%XfIWnW zzO3~H#)f~ut}Ifi)f_sW!86I#Wu z(akX3)qae~>Bc=;7D9tj%F<8D|)Zp5C|tAe(1$%!8*Wn0l@Z!0RI2d<_>G0Eo9&BhWDJx*>4 zc8GY4Ux_D#{$tl{?8m;O?8Z3_!P*bDMQ6~tu0df9S4QuIT6ssi zm)|Jg3{}Fpy*5{vte5>6wP6*e_tQ*N9@-YnX`9+NbvCF?yfDUA7hIL=yGwGJ4mfwl z^8IROsOxiYP+P-XlqtgSe!q$|_#azvWBJd>6>~8NcaU#bb;zSb5Th8N5OipY8s$2RA2#?XxP zvh9ceTtI^xI$CQf4DGGfnfJydqs|8!Vy$IG9{ik|FSnnIjf#1{-cP^my4lBkg%i`5 z24fWx*DT0Xx<7PAQe$2ctR&xB_a~792<$6rLiv>6#?Sao>H%ryF8sLpqi z8<=6F5|Uf1j1CKesFIPhRnCs|SA?*NmTSX~pba)7N-hl1qp?B9RpNPp zO9!u?uP!Coki2?GzT!sXPQVPF{&xTXdiX*1IPWg_6IVr~sPqh!H6*d=m@Dsa#-E>b0KAEIx_}GG z3I&V-52`8zIpgz*%#W`=+I6Ne(x(0n2Bshwp%Z#{FcPp+2*rns;gT74!Gvd;`F&f& zci};tKia<30ym?p;JhCll|9b6^x}fBx2)pSf;_*dH1-h~EWKv7Po0w5QB7Jpm$E37 zic)DXO~i}r>+ac5AdaG5j)?5)?pcHV?)U`Ou+QnwWZ&Ouc413O#?ar2ivR{PkB41{ zN@VX_pXJYf@fGvfFCCfd?=LiF(M{wni({yil*@B-ief3GMV0x;IW}B?El|JlmWkrH z?#7s8HyTM^`@C*2e%S^Coxm?xLHhzanCj99=#VxWtOjzR&*{V<;|w2h#0hz_o8;Bn zYxaEWEJj#}# z#Bmn>V7YU$(j1{+Cv{iVN^LRb<#5UGtZCoXU#I>|*a$eN&Ban$b}LBz82j>F8bAtT z2N#LkcHrP#@np|_=*#g9?zrxkFxZbZzXQ=Pfy1=t(<7}^vFzf5`Gj-dI98-9IL*}h zevV>giRYX%W1njB_^yb@WIrl8BCO&RWA31qvGT^7!tSLz(2K zrxad__E{RI{_(idDCE$tuiq>O^x_J?;_}wmN6?Fmer=;vqo)U&F1%HX5>$)AOOcfU zc`ei>+ia)Ul=Z30hA*ttb*nRus@qEDtEw(yLz(mEJ@V%nITGX7uj=jDr}{akbpGNE z+eZ`vGYXHx<@0ju3xRs_*#^u7pAU+QR=#SR*6BeiyXX;@l#5P#A@-+DxcK^EBG+1C zL^h4<<=a2ZqU61F^NZhMaT_2^X5h)+|5@PuS+wHG^VY~~iE-F8zR4%nWLx^hVSupr zV~-&jsN3!$H|T=*J~zMExX~P8(w=!zBQ`#@EMTt=Pu~5HNcE3M;6*g`BC;-g5gpIJ zQr!1+QAPM-O;>#Sh5APcOcLQb2Ps=MT*?}#FdD>ZC-qe$a>0M(lux6#o=})-fT8C| z)Cvq=Y_^E{9m^bV!!3(TuxyGQ7%~}F6%G=JO)UA018*x z;MupGYQmFKV!DX_YkS`$&GzNQ_P<1F1=7F_LZ=rIRRn3@@FW%QC~CuB^mn}FKYv(Q zX-uX}9f|@o$QoY$hx89zgNNtlb_xaWU%1Wfy|^^Xkj4Lrdnxum7L`i_TmRHhlt3vE zoA%GupU(?yC2P3-+xHehIw!<3r%_zx->1Elm-csg2XSc*f0y^av$-$(N=^Rc1%Te$ z!fkkNPP2&vC3L#$N&8B(rGaRioB!y?BGJEuR943{ZySVfZ^h~#AZe;2|Jf@P0H$U#9g{kMpN-8jA8KgI|fpQaIe ze)pA{{d1u7q+=F8{M}{Oml^th4HdkLO*47VYe2{QGDH7Le=)ZGmkH(mdm4(Rfd+pM zO5@9*{QnIhn1InXPWNHY=KU8JJyqxoC$*dBjho%Fc%g=v(NG{k%r`5>6ewJK!|#CD zX4lT-W(mFiW>UJ5Qv9H;QsSO1>Ur7iBT*+{%R4TIB{m+`aZL^fq*Uhvgf)+YkTZ`j zb@3hom=HbI*W-G;k>heTi9-wi`-`4p$;*u<>4rI_fMs;R&NRx$-_vMjzp?G9FWj;O zUaZSrtjqthhF`;@)?*v4%Tj;;@8mQGl_vEW$@*zS*#{mX5-zn>COVI zw-N035%io`ajA{ihFh}~+KlC%f^*6$@Uqi#)+lHx5uZW0>xAj!IsGeGNGqT{e!D--&^>( zhYTHHW>7Z}E(UC(o{q$N*qbuTVH%1Byd?HDqp#`2e{X00Gy!vhnleKnD0j|PkMM

)DUBayP7#Lwwa za*<`=y->oHSNKEZEdTzSjj8dGW}i|2O}mq)?mQ0*wKYu#GU;_bSw?L!62gwf7d z>PY6oVKvvwp(c)0zn)YcN-)&RX{t@aR%AZc^CmCCcY>nHnmt^Pn;{|9#^@!IbBc2U zDEAR_jy?y!(k~8l2!t6_3FKBxcYoNNhy`$X=>c8a(h<~zR PU+zIKuV;0yUY`F8F}&{E literal 111011 zcmafaWmp|p(lqYw?jGFT-QC^YA-KEc;!bdPm*DOMcMA}l5Q0lS5@x^MeP?#&FAwK- zpQ`Sv?sGv=1{4ep2nYxY=tg@&7n;c;goFSHh*}XC2=n!)CeCI?u4ZahqGsk+_ExS| z4)*lcE)Mo*de6>loC!aFmY?G*ZdNp9&xT){jh1C@eCM1Z<8a??$S!P7m`4*8Mp;7Z zC70yM=qziuXp`umY_kV?0*La+hvgbh%E=9~iv=E@6XL`ga0L3loOC1AUpe%p*Kuul z%DbC8;YEEtYi^&-mH!cBMV<(U+naI#TX3zaFf8ZZ9iU8W1ii{ zeCB#tMQNE+;MtpU`GVcZhZkb7J&k=;+`#$x$nY^pp|`=p!DAvvz+0T&M;x3KIkPrm zAZvg{oMQdN9AObTY?SWsvcN+W_HEEx#xB2C^`)9bWG&#MmB)>lM0z1F7 z&!&u+n(-!s4jxkqj7JgfoN%*SV*TLa`o{2A)YG2p7$JeLuE2T}gbpBnm`Dl{g?ENt zpx;pK@(7dMRYy7&CLhU6m1KeKsc5YGQOV9kgF{ZnGHOmrLpu|m$%l=gR%0X~WD}yK zw)OoeBib*(W2w`Eh8$UZ#yg7w`*lG^C@_&Ty+^Y+BO~td0Fj6g`>}cGW#0f>b(RTt z16nb8S1bd(PQU|ktf0-vOvpjGhFW)UNpw&jldg{tWJRcuH}S}lwn6GSNMU`avVXLder~=IllycmLn!r30S5|n#t-Z|_|4S=;uuH{rVHt#sGbJ5 z#0;8iCNwqC`Y`aAs{ghla`e|y$W;=;{Q%Ohcv&>-x7?4jmxCvtI)JXJG>@v$gr3*3 zDr#DUgz{q{?6`Be8L2*Gu>RPa!Lva0P6wNv-!<|DqF5h@6!T8l+TvneY&$ZE(;h_7pClTGA5Ph8l8Jh(Q_hsa27wSoPw+RuI|wb$qq4kRIF!@wz)(?pWHf@D?Ttf{nL>H z!G@J39#Ef~VHUKYiO)Z0nG|+WN}3OT7I_?z)hfJ1SGFX`@gVwhWeVw@pH@H#E8LM_ zV_G~3(*h9+gYrh=xfA;qMX~W?To4UP9@ufm40>X4H#JaVe)QVHEc>a=Gj)TXCKxhr z1QK76vssM9H#iG|*w{QD!rBkYA@gI5hmv#j49(#w>*uA8k{SPd%d&PNf`UT>b%CCl zX_sDL6Ul37Ic_Ubc<14fq(J|eQL|8jE5JrbRgi$5;##GAl)OMq%cC zBIl5SI9YUJ6+qy_YH%8O-gj_1H}Iw!jLTxC%=xgxh|S;}3(fYEB?;PsNcFsE5jb8t zfD5+-hL<%DyXL0`I|IXvFX9L-t0jyzW5H=oD?m`tnaRe1`iVEKHdVzz} z^L`#odziZN4T{6wCGQ4`1R)vV5EdRl23xPABIKO#Rq$nOW8KaQ^M(ORfXpN=-8iw+0bSSsU9A5W`%b4 za+NrHUy}Xxqq{rqw)L{EUxkpnz!@w5*+@>3|HB$RYiEdUtQ`Xgc-4JG{*ZI3>L)4C zGnZpN!)r9Z1<4dM&gCNxb2qP6JkIUv>9vt?EmM8E_fRGFGK9K2BRIun zEmg8;<2)O05G+&&6p&2cp?udoatRjTx#iU%goYldgkLS8Nu;6T9N#|6=D2h(ZJyyl zPft~cNE0!lA&fQLlv3Oiw4@EbWdgt0v|(t9U1@r;*e{?*fth!Iohk{L=Xo+=e#=QTs)Tg}y^9}K}>2`gU+FhkJAnZ0gROn;o zQZ#U1&WO#v`uq6#Ak|@{F@%Gk5Q@;c7GG%Q_yk4=L}Jb)4B1d(ZzDzAR)V+-6XB$E z-v&VrB0aV|QUbmc_?^thUsw7Ok}diuuBP)DVgxp4G6@XSDHJ2cnYv;;V2TYdR)9?1p{6?N+e%N$8PzQz&ev37F@QK*QEjCr~mibS6g@JL>nd z5LMdjcZj8O-dzidFy@j-c8?Vm+!DS6^5g+3yL&hma&{Oj>Q|QOGfV^6xSaHZC5PCR zCskU~h;P>rR_nNY#hiZL0b%xc)Sx(GU^cjtsk6*`s3lSJPc|B4G9>~wzUcX2w5#;l zm!a${L!xiD&FsiSXPwlS&_)VQFKVnjCIpTMoZkp)+3&6HPH8OCfVJJu;o7W$PRNo_WPwkoOhyeDa5m z>G5Q_(1mm)7aEqpW4xSeZStjnPCG!f6Ze0mT;3 zmWxQF%A-v6GD$x;m;By2E8i$Ioe4tY%{!Lj#Y~a(OxHuNG1@<Xv!NwF^S+V@s3sOv0|mtAQ@aSYnlgqj?smw&u)g; zB^E#n!vya}n3JA}`?jY7l`63igLxp`bItKt)(9Zpmzz2%_~f+iQ37t`GOif2F==D&1&O&t5va~G-%XL|_c1f>bz$t`&=3Z-dg0mSpd+x1QkLy8HWglJ7G9Iy zsscPf%oM2zgxrz}hOa|>2nD?PIuubct+*9Cck#tHvyAuXr21FCR?~RyBo+}Dgs=Jw z^5vF|LD)p>m|0v(e8=hbIF=$yl}caaSZ@E;=BMKGSe&QMym%GS_=S zt%##l>}nom{8*$^epi2Lo&CLRZBuRb6QyV07i9|G3A(DP9nYl%UY$?%=LA^b(PdIa z-iBmIVQ2P#{mhBbvs!$XaS%DdcJ8kOckTxqM(Z?M=NqhdGVFuG5>o9G6yZPK|jk(v-OCH**zI~|B9#Qo^bTww z88Y`8Rr6`pyOoB}AF8a)QzrHf-&RhrK_c$YKxmC*qd8X|Gz$#4w9QLtOg0BFGSmu0 zVLAq<3Z=cS$?fMn+JV*yZJZV?J%Cj%mIun4Eue?Fg?h1JU)-6{~noo@2-8)so z!H}8~Q-H4sw7q_2ZoRJdh_n9%$Hq-9fEqQIRfPn<{wy;i%&{ z5Na3!AF+spHmsXYyEOMDC59lICp<&&H7zj;;WDawxtkKkr9f3$mjSu|UE=g`ZZZe$ z&~wnJngWxxtfsbolbDu6?~3m2^52Jq%m^hDU1cG_HcEb z@u%Cl#)6-A_F{rvV!rj@V@|^a*IWW^G4_)lEHG)Q6_`01qH3eiaSoo92)R~9xwss` z!tS@n>X8TEU)`hMr_+s)e@NDJz9MG$HZU<@1d#$rOUhm6AbOuPR)s$x8m-?VSFuN< z#NO}rA-GyDZ2h5rSZErKcjBYIF?5rb;AnFVIfNQYwna`qNNb_xXcQE$*v&*m~P}pOj9QI_H+Q zX9D2;qo`QiS_p8Vb3y`r6} zH>&IJlU>(E#5jjGkp&t%x|0YW zY`3k=KDgoft0rF7+{05HBy994fQGe%R23j*@TYJCp0ZU%Hk$d%M;Dy|9|Mi$G*?Nw z5O~?UgN^XWuIjiU&Y9R!#US*(1K{DFjFQndGBLkm7Qb@{OR05XB~o6ms_Dd5AHC_s z|I!7s#~U4~;3Hm9Q;6qY2@I`)QZUGphmY27&*EOe@gv`OKjZzoe6TKg)d2rQ89$#b=u!$xA}&@ zerQBQfa;+uL;IPYVO+T>o{bABsgC9FwU%*o-YgR|`WM@Q5flt(c&4=}iJ0;|ZiYEh z6V>C{wBWkXlZok((eFvCoxEJPO619&W$(P{YwL$SKuqQvAmKx!iYH5$#Gi3&AG9&8 z)f^UIP#JC1i`5&pmM}2lZ2Oz=$v|pQ{)*>jA{zUR0Hqx z@XAcyR3}_~YWE7Yusn*zm^>>Js1G?6^}LED=SW}UEKi7F)q`;}h5p(446Z1lmJrvZ z#*eSn$M&KmofB7Hh*gu|Gyy_m0AShUuQb9Gqd39n0OTM$VqM{<0AjgVD-nS|lot}$ zBt%%H@0~X|Z=D}kt+$v-d=L86dScsUCU?)N0J}BsZW?PF6$svsU(|?tukz@+Ff=7(nP`xNq@iYaG+Us-(C}CK`hKEdze;zK3dl1UtxRO4g?$sz!)R0ylZaaA()lhPmtcCoALIc{(mo&XVz3kv+lSYhan6dm>pyQ^5TD)Xl zEI=x3g3V90&4>IYJvl7{^@XI}G?F8~J0LWM{0#4N_1vaqI?&}k&klS@au05>OD@b>{|V=edhABp_AwL~ zRJ(tKTwC{^#hZ<8t)nkvUGJ-*>BPu^ae4fP`R3|KxwQD1gruyH5#>Q)?ly84xK|$V z3%AJ>yl4M{@CuY)CGjel3rg)tP>d3;Q8|37h@L{vLOZs-i}M+$GLP27Pa3=JX)$zy zg2L{_E`Q?^74p1dFrUYRB)ssIG~)OAy#1(=4C$mCpNH^D2z0$*pN?<)f!o*-urf{r zsmQ_bw&X?04=1`dA-mmMW{$Ax+MAD|5i$3^?^Xd<*yoUUXlOg1I2l~TA2+~P_He7s zn%NkeOH5f`gbuTyKc&W8!DIPc`DnANUSBqV-^0rD$3E2!mALoc#$XXtWeyOz9QUB3 zz+rh_g=7|(P2x8(d!H4b;xg@@-19~rEngwGSu@F36T7xCIRRlq)p>d!OP|ml3)6Xs z(G6%n?W3Hnp7Aj{IH**68YU(?-L{cG(uBiR)IMss+&|_LaGp`Bb#EQv;Q+_2_cHP= z897L~wVr7$vL4|h+`t=-p>SUq_12wgT!a*>sdZe34^=tzv@R<8whd_Z=y8q}y7Q<@ z?e8n=Iclm0@$Mx+1Wl(Rmacn)D@0^m$iZz*Hu$um^r=ECRfjZYY1hoChc&Cqo)K}b z0zui=^kGM*K_lVu2_bzFNF}tYnvV^r#zr}(;Q=InLdcR_MPEL26+(1%yI#Do&v`#S zop+5nP=efbu7f0?HywP}R5RaU?$PpIhy(>mZfeV_R@?u_VpC|gH>YFbyC>0#7++vv ziR1B&8I;)E)VI6|A=OUS~u2^Cr5W6!@BUv#ao)ma71(ru_+uF(<4Qdm_Pc{itj_HS zl4#6@7r0&v=sU4O+s8$XZ2e^0weT+-J>}d1U`S|p5GM9T?+v4MgyOA)_UPQ{UZ>{L zwD%01arkLkViPwVX*67&iR9Ex?r>-I;CwA+nN?SlGVLNmBUbQE9!gEjlKEIeI6%RbRN5&1ig4cF~I@ z5`#W7P`JGRq5r}OnZf@OymdQ>KZ?}Y;#4J7&%17#;P8v@@+Sw@ecyMXd+&QLiK)yP zCs-gfB9a5{!Re4O4D$l!v-^DwR6YQaw7I2b{mjM3==D%e1ydk_{DeY5ibo(Oy970^ zhQZ!%uS9+Lg5mg%+LITSi2n;PO^w**m<9|<7=J^c0WkvnH@g&LhPffIf_N4iG|5@2 zODEO=7TdrH6rX`c;tDNN3d4-hFyW8%Ls?rrSmSckzD>NY{l29&-$yzC!h~f+mZKCC z2hfdDd{or~!-hNvZsu6@0rE3sJ^Km%WFF>-a1O1UspL%_4bvAyRG~sAw2g=KvM@e@ z?L9prWQhEQUTkQWv{Vk*KkRM04~eQc{*WircJi!FN(YlEl2QnlVUoSVi*ty8hBFnX)=`wqqZM$JQ@r6jR03{%*Va+gE_U<@tr7$6 zRqAF4jOe4MP;0u?HL_jpXKH2y7j`(M2^`-8~+U?Yj%5;wHc-0skrc5)( z$CF_+TLx(+`=33eJ1>ltWzMbN25ku{6KmR%ZKIsV}%Xw#UE`T*&f!p&mkSoXaYVI-u||Z8AF#H z_(dKdduaOwDEmry7S-NqpD=-hJ}$W1N?4;izS#>D+d?8$dM~F`;d@D^td4vjZ(djF zNodMC-a_}+T=L`{@Py$Wlgt5?VGLfWF+Mky!5FMvNlQ5@4cwhgG-StpNkj?{vMlqvqJz0aWAd204^6dVXwH^|Rs6 zQ?y#1h}~>bDc6;YcdX$r z5}_8GlH}|oPAFGxex9I;zUjq9H`SX22ImY#0Usz^1tR_Yj#20QMq`i;23;Q{%;F4L zOKBArKc7?t^Phqr>ifz-}iKdJgH0dkHN+&kMlM>U}r4hBAEq#Tuo+ z6F6~mcrPpX;lWH0^?`+w>LUaNzcy^Xv01006$O$_Ss>J zjg5`)pWAf=aHjW)PesXNwcS6tI1Z;0Opge?Wm-(n#=NC-ZnShnj?rEMfBr;N{I9Q- z*>CLZf)jv&xNxz7kYB%6wllJ_S2eS9w0-?@`S%yfr=8x3>+A^(4?kmDw*pHn-nSRM zbH93a95}_+N*LDGX% zNR|fugd%B5f%5ag|0kgs*Zl{wPsJR2d$9X^UJY902D-Wt22&0rLAsxD+n2Kv4O(ox z2^(3||+r@@KwHrB#QQJ#8Jzcx%owBY+u6(AIDGq^z``1T%Ke@zxcl_Dz zs?@cGm4d6&cZ5-PXV=oJ>L}F~6-gzD7b&=AnKOrxD7GA9L9-F!W9DU*k_l9%z6JK| zghJ=01y9p0M-uZbOXFv}$~$V;GUa}9i%P8_OD|t_mHhI@Y~yXIA~h?<4l-zdURkxh zq*Y2vF2qd!RN~j0?z1sVp+eT1w%Es&0#{+P?yy zdPDC5IQm;}!yLztS0^ol`bHxKkzi|!BBquc!mP?Tz{s^^kXzruccpT~ye z2=UOoVqKG2`p=Lai4Xv?r967L-c1Yhd9%dR1bQUW*q~$ZEc*^gI;sYy+n7Y*SWK3$DMC&om#=@&c2s3fAl#@ zb-8#e;W`G)MSHy{Sj3p!qG~4#G?nZ5@l#WS%FCCdDKde!iJOq4MRC`mmoGsk{k)J% z;_~sxpG;v~`tA)sF%@ATptDI;xv`O|aiKeQ|HS?*9sgw`kz_3$@nCS$+U3@@lj8jo z-$6VVkMGYs$@XkM9s1psg>lL0eeY&D_VLX3PpELyf^|Su;104=O8ZSDGNBTKh+>0b zIne%qJqeu*D&`r%#Sz&>uxD_p6~->9mUxDO23rZ}pS+XrHNS3I3{j?chj3I^bBv00 zl_|)7q!LRNd;wzjuKl{!lu)L+DH{21QC6swVkeqsL>ke}O-|>dDU?@7K5>7SzH2tC zGaxS za3T+K?`Hk`h&rV%KX%$@y~72Y^!Jqif=yfUt-3Cg?Z!M(8;b>sqv`5}sZNM`d}_CA6ezIKz+oc6)PZa;+G1}mhVEUAN3Lk z(Kme0HYyEO=LIHvXE%kN;v9-;oxx5wnRqIg#m@O^w90rmtNa^AcKF5cEmoqhWf(bY zEr<vW9K=F*B=`iJUnT|N3(lM@;8cTuxWK8e; zgkV`ZlMowAt+lzV`eckfTZOb%knZC6bPA&`OFa}dBGQZWk|A}Fh#_J@Hp6@c{sB+y z@zS+(G)_jgwIuSp3 zb!3t5Jh{VtN^m+HZ%cboXgk+zANNh^xQ*W*N5mS}zBH+W*PWmb5XcJICIu~{sv_Z5 z5Z#!f51gw5%9F?ed@{k229p@bA6nFuS|t=~Xx+|O%Vm>W#hkL_2c5_?tNq*5e6zf+ zogh>QA&dB@z!rvk%RjJaT|2cel+c)gTho>{p>KX;kb=@8bfZxfnJ*N-K5HtSeSxJr z-g7Tcd^hUn3tC09zgUsPlP29pmF!Ges!Xq5v_4v%v{t38Mh(8c?D}jg4;|eoOcmI5 zz<-O6hnu5;R@Rp6i(g)1r$ktz;>*k1eSOhv9j8&lwP~2~C69GDGxxwlbMlg+f=j>U zK(z=>(pzqcw(ihQa`xU6vhP^}-M7s5y@A@zh<4+^#XJh(py9Jk70m9^y9j}_pgSt? zOUhCres!UzQJRRYDxy~oh=Mma0D}j^8V*!4`MOtNr3g`8Ze@05N;Ws8YsS^u?`PB! zcRF^iZ)PeMk-QheV7sha4=dP()OJ68*{xYMO^$^Aj2&17LnAnx5OUD+W5dhcO>BvE zSHB#e;)L+^K6SCabmioBD#W6jL2>3SI~(rLR%3ctjGn;hos6SDzGZN8MJLkM7aZ|~8mmyPosZ&m|RiBh*%aL*xtoq(%Qdh;QDr}lj=(2!Dv`2x%$WC zZolz~)~3?YBUPfC@X{9K zPaxw?RrhUW-ULp2@Cxvscl%q15C^6aP17iMt~)Lr=4;b2O@wP*k|T7no67YNquO!J z{7OhqQ0_xqhRxL(uuV_pHC)j}sF_?}Vj)XhqB2|puL(KJk_xGW`z?dQh!Npm5NDP; z!8S;^W4y&AaAmH6n1&!E)6L+-;lRY*t9OPR8hZz9gCeOB6XCMi^y^#~9QxusYnI~= z8VD2*mIH)G0)^5e1y`o7sc(1K54GfG8us#1-Oe_dGD*fNy~VU%KQf?x2txJsBi(7i z+}*pnha6OmglE5(IrKo4H@HSkSDcjT<2{fVX=jC95o8}S!1vlOrGNV{~09tJeQFdV-WPE`Q z2X)OMq}GWuglTJ7WEl&(kCU2=$TkMiC`p!&$kttGc|asBai|V^wkLKzK)i=47H%OL zWTq(%q6OvHz7QBULb zI}^jU+&mo4c_qF6!ubYP2Dl7(Xd56AkV{|Qkg7U3=p-~0q-F|3Nkh|PV51J$K6Zk> ztobHkmWYU|Fyy>i-GO3hkTqpe6fq~kP9oPPaj3O$5v;4%!)NhCF^R$;eK&VV;-jyD ze+4#sY(B@WJ8t#L)vg8>=W&8lyOP`OH^@WIj74%s2xmNa^nl_a6~dwn1q;c( zB#ucagACcAhw69*OL+~(ch|D(*b>=>m#nJ@8EiNFGcjOMNmqSuluQ3Nsrqmk#7D7 z>-|UA&OgFF(?h)`9#AA;#bQF&$>W@ob zz9sI&`p6Nm&KRlDvJCL_s8Fn@eptq|a|`346Vr zP5a~Q@vpPsbl?&4GDLjCYvmQMuLBYm zrXN%cr+pl?r$3kG9f6U2MVlbn_!g)!uGA}Y2(APMD>GxO9YKMR6^{%jne~A6u09-9 z=y%B_L2Kz)}bhJnUanU46f%-X9{+5+SmFhURp3{CU_ zeWgE=7<3O>^hWVlf!-4HrmJ{lvB!vPIf0g2r|d*-$6^XoDZ2zg^n&KQ8@RB=LOm zf#A#~pdUvk`Hmf9E2mb?=U_u%&3N=NOn}q^Tzfl0(K8Lg{ol!zxUj1ppawYJ>#<`mPzzmxaYF zm?LP4NUlmq^j`di6C7h?7odMSzz&=mWhPo|eUD%op@|$a*V)4aCjiA)!DS`M>XaKB zWBA&Z1^9C!|B3f+t^;XFytl4|S`}34x_^al7Hk0vup9can`M^L? z1POlE3B(9$#A#m0F|cU^%dg`_wVZSdcsShg72^DbayoJ2@(qGxW#&Tzq&N#8t9VGr za(FmMN9Kb0Sc`90U#O)(`c$ziRl+{Vi=G=(4twhns) zRP=`N?@({6Gdj+w3Th9WO$XzptsY&B?`fjNUyjR=gMCe1Q2cjel6b#0*T`FQ(brR} zm?h3}hZTDw*QpLW3LUMdl?R?6-z6R+QNqgNur8Us=B-(X^b57&|52v)Xz|MhwfJtm zLY7tpd!dH|q1*6v##>Oq%T@>xukFPv7W<1alfN!D?KN@&Q)Z#!oI&g0Rr$&XVoqIG z$sLxg0L3-Sy7<4ZmMr$-?N#@_h<*8va&)VBm^?g@1^mf*HxU=mjyAji%iSJn5vbov z`ahZ^u1I2gKkTd&k>7#xMzs%*J`f)lX~3xzp>9_E)jw9=6zTtf7IXSr&Fs)5yasLx z<9boDd~`JUqLUqqn+bx=z&gGjsLba_f_7s3@6h$Rp*;msv^ud7Lt~rbdB;j3pd8WF zB5=&LM$lFe-;peCem7Vni#OG8=lVq#fnYQDuMYDTfht+>*+LM3;yIQ#1+GCL<4h0C zV*ZVzrD6^nGEr%q%Pa_-X??3Q;*A6`Bdn6-7KA=L>auA#(2pKSo{`!7S}svLc&8GApkE%~ zUPd7OXF+r_pPnP?gm%v-xHHu16_dNRm8P@9RL=0pK7( z>$SpBPhNdfH=AGmS9eWp9K8wRzcU|dM@W}t|2DP=_YTHR(k;l>T9SC5l{Es|s^lL% zNL!#*$`Cy6IIPl#suBZ$va3~oau~ReyjEa89>e=;8ox)Jzf>fQ1y0|0But;xtVIo{ zhjYpxiiH+tn4TB|e!^s#<7%-wZT|sy#Zcs*0oPh@uxQ)fVE0+b%PZ3c7A1}p_hkbk zG{!=jbbiJlLUfw`gX`(P;#&UXfed6VyOiM8^-;VqfpM|t6Xn27_HrYU`YO~vc{ccT z#g1544MgA&!WcyH@t|L!b={Z2zyg(z?2oT)4XKVJ{5SPoRW{5NLg2Q*MpFCLcZLJe zS$-kHnt;3xJA@8X{MEEUng41|`NKEMorK|fT_j7}iyenxyLI%9n7HFo2# z3G4q143L2AUz#EaqBSGj7|%Hm{BE-l!Udh%TF_Tx;cR54bf=Zwj-Qz1ZK@1_bRPQ* zRSYf-2Thbpjy>Ag1NDb<_6FLzf~L#(Pi4Uy>9e(So2I;>8H{LH_l z?f;Co|9{+KiY0|akpp$C6#ND;L9~Sc$5szAGS}eC_dOGoouo}liM$5p@cuJfpdA}Gr0WI0-C|2K1oTPgZcj#a5R7K=t6M4%fk$Vr|(STS~c{1!?+h8*5u)7uvH zmyCha?MXh`Be8VD@EAaOD;u*^8_7kI&PC~Uu6#H}P>MzUJ>dSOw589Xe1NDk0*ldz zO&7{LwyNb}BWj66r)RWnd7GC0&bygQVygh6+{84WwTg34L#>f)x{iCy*zbG>x1Zot!#zAsUq+QKXsIF`cbjD0In4jtQnvR`;m7zm_7HqUC%PY-cbUIb(x zGnx;MGwfF=epr(J!`_;;*l422jG06qAlbe@L@!EwCdkG%9cLR+*+Iwg@znu&eWLzu z337z>0t}v1v_s_Bk4NxoN)WXZaOT)>=OJq=xm1T*?#?7={rTFEfaiZXXgeSt^Vkol z%oEx4SPZ8y>lnjU$xbq>IL?Ac|H@q9wN|yXz(75SO7J!W08W1>nwc5XucwMPEuXLg zwQieV>?tzt%K-KhQMuML%x-nx#%VVXh%Wl4?NbOBr?_G*&l*K?wgE&E0orv=-2_KD zyj=;aaq@pn_5XSc<5zMNEzttj1tBKsYW-3a2=rq60wA^JRGWp+ucXK)!Z#sKO%8$GeT48#Z zcH8_4#pBJm0Ks2Q+^?XKU+0Bl@VBMlF9${Bm4ZN%AW+^kmXveCNlq@Z8C_(vLS{OwGOyk?mL5vU8OMVG zuuto!KVZID1R6PT$4SF21&~>PBMT!q)&Fu(7~L2v@=n*)g$VR(U62naSK&5qAQho> zxxV8$+!ZtmYZjN2C>#%?uN=IOpLDb)4RmSQst{6JT@9D|c;0biET|kj7$mbJ!MpkJ zL=l)N)QIc6!ej8SQ-&Xjg!;9Rc(}nFeKg?ZV1*Nzs0c3URM>Qnt?~#50TW9gUx}?< zNjL$4SC(SjO3sqKo*>8qNvfUO>)78>$t*ctj3sBUeE4EC%@9U>XM35>2UCjMRQZWlPkjX+BySWz zHva+noe*kRO7-vne6C974zC~>Qhy*^)-Vk4?j9iM3d}fw>Nn(2RKFn)t2*&2waN7e ztkMp%spz^89GPV@hU)5wKWO%3hll_*{&jE7K*20LWyc&rG9+>}2F~|kAmGqAQ(2tM zL>)LN;`7VFhehb#DaTyyh02UktV?ySkXiSWjs!$F5j(%~4h41ko%f~S8)`^szfjv< z4%h9Pshg(?a~p`FQu3A53B{r)%s5OElr3$G6I>k%G(vl0j4I-dF_`?qV^E7u9-0xU zT1Sk5YALzlTU$*&!LPK4F)uxEA`8W}f$(^+K5=w@7N3U#n^}TDp*c%vV-0x<_5gt{ zT1oM?7BRng!$;ry%^Sz-pGYGTZGTZ}c3}e<(P<(XVXHH_^EYnyyYei1Et#E|?O*we zfxqRiB=kG~f1OShRo@=2JGLU|=!5A?2M*aGPQXUlYQfhlp=)li{36In`WrhXp*QSQ z->{Pa=X%91|5J&$lqrrOt|wYPKLM4#p@{62fT%V zO;8Tc$_j!adQ;%At}|hrWGfC0G=()zq$wx_(`{aLRV2zkUAiFxMqB@sr@A_U3XG#o zE`3)hV$+EYCsQBk*jxsnLr6js@$1e7V&K0c!zc;;7u9p2rs^XgU=*>MO+Gw|k#=c@ zG<87chOPQD&FFYUG;f9apG5m^+q(YZ3S%m085U#?ws#&8x*-;7JPn4{V1b&fk()sD zI8Oz4=N0a6i)vtyD30=4?f#r!{;0Hby+O(UAPhljJEIFU-XlNQ;4?%6l_OE{QNKVZ z(G47rZ6r(-JHij1zbTe1%?4YQ;MyV_tV&MQOWBB@%ZA4~PL>|>qI?zP;8KlFhDY>o zokH^;odW*#yp)Jis6QPQcff^J?p7^Uyf&@YjSLE3cKyCHRuRzUZf?W+~2yh8BH3f|z-(uF?MLd(CTe^&;Ht%7uE#GfX~#+R+Q zRX4f3q_fRCkR9;5NLPyjsD7JJDba5eii2_fWkO7WaDwVQ3Jb3K`$M2-4Wy0(0paU; z{7ppDP2f|YqTqi{8Zm3~SLEJ4Eu^);^Wjs7))5ZDM_x*G&@p;^5^+lwgEph4LZV1^ zgkYAi--5Owkmck&($hve#_1^jU$Rh&t}^#|9#G$rAjhKUs{$I{hU{Hz?tKd60GkE* zH%x~&1O~jS%KrnHKxe;fpT_Lcde3ws@GCM8xkF>s)xy9frU!nSmJ}q>#-U|nx;c=6 z^H@>;%WPCo^`aheUiXrQYP#8+yB%)nUbrpjXjfmI{NYBsD-!_Dk=wwckS1*gW4 zI5ki>H71BtqZ6ls>kjD=I5j4VQ==QFd)<_MuqtH_A(MG;A>XFI>FYO(P9bZ8ZzF+3IRdZ)fyVfph`buc9)7g$hP=0oK}by|+S?ZJ7BIx;FjL`&v~} zGm`R)5na(mlzhL~bqoLfJ^cm5V!XfEO(^wqOM6$rI5nvDBUs~GW`+!hB>YIOcsosK z$PENV`LL4=h6osAb7s-due>=dRzH4+gvM~w9l1WF^Y=2?wq zW&bJlM;YjcEgD5Al;o>7v^D33qD2vjV|bV z7XI+EhNejsiU1NU{xAb>66J2WRW?fn zxB+8B5tJJ`2VLE)@5C$-ua`H<&33+-t>#n-x5)o>im1jcC}irH~bZPCD0_M9r4jGVcy%Wls_wPU=ElG1UyNfegEAHg)AcA{+50s z&}FN1Ka()tQ}n^NZUEEQY!<(z%1yr2;jbpCPQf4PF6~@l3~~u)3A{XqE#!tq%I12# z++JN*2S>C5Edt4Gk#)njOBlth#jI1fR1uAs6hNJJJa3-~&9;Y$a`yb$n@7CS>hl+i zXtji1;xsQF@xFZg_?h_NJMoE^i*UY$PkizC@y`oYdHk4n)GIP)-SgrWh9S9p_U+@x zUnuEsz|SUapYq3ISeyI4&}=pzJ%bLO&&VRAT;yNrI{ijQ04?ljl#ED$2@}v$?Bl|> z1M%(IB3=_PcfkZ>-Ok2xxnO)2_;|YAT*HX|%K0k^S$e`dmB23yj6#@H=0aQFFX+4V z?COfbcs`vIfKu92{wrt*`?<&~!(l?#YNwrhr^moxxj^S)YFLiXn zChDvO@zEsxu|ela6wSoU{D%H>J6rQr_Dce4$EOR1@fiAj`H5))7^iEP6?qTkJ0ln$ z{-Q#du_C6``5kD^QrRXnXZtRhFR#Ra{AfIW3_Uj^ATDUV zXdup&2sEdbhbJH=Ro-u|K^12UfdhEq!&zoXkdI(RBo|3K!KkBc-8tV4_)F z|6P1>f4R>7Q#6H z$AoVC0$L|wVI7uK&)s_s64m{@+r*dJPY5VE-7Q|FT}ZY+esQw`cjIj0>mlj+u)S;QoBPcAM0P!F?~>Zq zKC>Q?TT0sdqo%FTtT%AWPS+fgw{h>%ORR0FUx)?y?wCCfYaHpdJY~Mhmr3f{$~vUE z18>QEOPjyNX&{gTMquqyl{%$bC+n1^e%4AK*6MHitOm>ZXA$H3EkFc3QyD@~Lk*jI zmM5bWIuhQiw)9^Lxmuo?Q4(m3@2CGI83y*d7KHBZx4DmAi&u0mkig)iI z!o`|jQxXa13)4HLK*&5k;5Ae7Pbh4Ika~xr^Y-th0;C_yEbyPQrdnT4LU1hM$uo{# zV}>YwhYJf-;8~(AZS&Sigd&W|^uhLMcEp?3#?rU(`A>WM~` zkI*Xj^|e4pdH)vNdyF7jhFj*L6uWF_WlqU@0p5D%e+-t}O`!?a^3DSYZzktAxx_4j z$YY7(ztz;=f02a-E+F8z*r?$4gfK|*r)98#(51SIGR-0tlt6`VJnDt)&d$6CP!sO_ zJOF|959+67wrcYjM9Vte4&BVy*}?WF8eAlxm`M>^t=&`!X1{5k%m7=}5Dxql0+NA{ zvWKlw#s1#Ot8p3QK)xqKoCVX?KNO|+(?K|b^ z>z8~acK*Ub2rkpga!D2#v{P?@?-@Sm~o#=vHloX;WNiA#z#cmv+w?%)fwh)vMQOx>SY&l|^ zcKQvuOa0g^B(sYlWi7F2Fz@|kvVnIpjd)*WZ3W&oKE5#97J@ZA$D<7YloC=rU?QF; z7X=mIt4I3#`CwbCN}oS|{Px|8*NU#FAPoyc3Kh>2PLw4l<-F7f%vn@1NtWS^M|CSb z!Q!w#FJNF_zIy%rn|DvYd&friOA5_V9%L6^s%;uFhSn59Z&b;b3WY5*%2`MjO2DF_ zt63H`-4p|QZA(`XxUExm>wL18DAPs?#PMuC{|VyX?H^2ub8-2i+D_iIDCLd8j)Bfg z>#fq+Z1WUb+FU+cuI`xje9J%4W1;8|JUTx z`4s?g8^Bz;PBX<=Gw_Uall`xnO_1;dq@e-6;U8H#W&;1_ody5Pl=VLi+t7B2P4Fvc zPY80!DKBA4zRczWFe-TF8f>$T^Wua9njX_NvzuW;+6MV(K7RZJe#vqVmA^p_%8EtO zVbXd0_}eri>hWXN$>uqvhyc6ksMO5(WepH-S=m^!udqF_^8YE%c)yBIXa8=SQSziF zG5O`(zT)Y9kk$kUdXz&*%1yNY;~rh*hpO`YYsfq{&?myw1d~wLnB_Wj5@7oFDFbAV zMV1)MT!Lq?JDHWUjZ4XRX)^ysISpDSX^yQ>EYpxnGJ3jfIn%I`Ei08Gxl1TbWka=8 z-%ysFSQ?^Q%G*PdSJO5`cQ@uPX3S)hT0?lSv}0(X$p&_>e~Nj@yR_u?CGLco_|Pp) ze3!Q{Z(;bEFSLO(NFkoh_t@gUN^q2BCl1U~ZUK|kD*eJ=dEydVj~Ww4g>UCIS#MYl zS3T8yw)j}gv%aSDRS3|e>+}2rd=m;8Q$lerSM%)^n1q)(QQ< z&%zvD>|>ZWct-m-EojVW8Zx@~Pdj|5dpmQ@)V|6dHoVsf>*710TrfN^2^gfu=czoseXLcMuGjy66hnN=)W<`fN(Pl=-n-8T0q~2UWt;u-v zp!CHCb3pQw63c)4vVZL5{RqU_k z^BTbBW+ za_1h}rf}r>hUS=c_j!i4a|{pX7o^WGe83Oxp$9WN4mdO)Y-m5wP$^T?dVm3SaG^E{ zV4#Bv_jN#_*TDp2?zT+McJ~2<&VvVC2M+dwwNH*Uq8$ec9u5*5aDd<#;OjUj&=uyd z=3cfP1gL}90g3;AgoJ;bp7u=a|D7cCR}tB=@O3Bb@0(o@3Hp5#^t)~RKWZXAA_2dC zw#FpfqY~{=3HFVry<`&V8_v#P6X<{Ivc_dW_K+C=kQjgb#Q4J!;@h^El4VC9ssN@{ z0A+Gorc(s_u%sHLtA;kidj8{c3V|Aa+K&}YZ+!RJv)8-Q;t!R#`&HhS&GV}tq!04B zzPB^>C-WD8slWUED~2zItVjLwj6b{T-$fMv&g*~IV+U6f+)y?DeoBJxm^*55a8WE7 z!dlQ}_fa1_4YahJ_vy~vlhWCS3?5z``aAiGeKk3OU58vAYK=eC8h@xY{)b2stet9_ z{SMgbtnZeaLI&P^30$w!I9*%$yF4Q&t8Cv{s`s<3r!D{Pgez)`q0aAM_%pBXpQa^} zEG80hnHz!n%`_Lj#+43a-*CNZoKn6# z4Jk(Z+BA}+`65$TV%~JFEdP|sFdaj#-C`kTd$cf336x_9QJ(uHG1!>=I*LMNvw4oU zY-UEwQ=jQMj?RcFyK^!AXG;=iAI2r-^UvZ|gltYM_khS^)QxLMTt()${sHbs_)Poi zUTy{WO#9}ZZjty*d*|r4Cw!*;GWb0TqxFNta#nZZpwG&dMS8v_NhuJRoZMSs|6-PV zOBwb;o_rm_AFZx`o*DboUS{k=8ULpKtY+1>bbT?6y74jz@t=p1{|_bqk5ux%a7d&N z{>CZzUkG>~UV%QjOJM0tiizi%;y3LfFn165y% z+hyutbdM-{Mb;mq<)?-ky8R%OCbCro=cg3bmB|jU0hnO!u=e>aEjPYVV9H9NnBOZ; z^Lyo?H8Ix}E{Y zVa#Wfx(h5m2jD`l=W75vH&sG0ep20GpwwFN$Q0|@90Pguurk)?zaP!`6Z}Up&UNK` zeuGn`n|B?_}gXFvzUc>qSTTj$v23GB4oDmM{0;IpkiBNi7>DMa~_0!M53fLX0ZHa$Z^h(7?nh2Qnr4CeP#~U_4RU| z?yd6+CRQ`ZE*5Py7ul{6jxXn3#F;&tec|b9_QQJK`Pwa+&p<&j_C2T1%-T*nzhlUM z4|qtmw>bYyGx^#l& zoaZ{OZ)Y&;Dre;sh9|oSY!+S;o4mSM^P}I}N^9;`+Fd86TX2qKzRspU6b#kcW8{cs zmzkaUY4hUxTS=-duE6rks+F6r?0bUd8unSRV1p?Op7M&r6yE=W*921Y{Fdj?qiOvB zX!z__KQ~qIQtP625If7Ozv!P&Gf7uSkQ~*he?B#SA(|EVAl$n&uGXDJQ8X3~-0AOJ<&~!cdLN`pm zDV5-Nu>xn%7-ki&^xP3wVMxk)ScvZj8UroJy_!30Q3jAatjqXy8RpM44uoHWUo2QG zV-iux^rO(+yXDo@oPNn~!5w&^WnT~_mv&$51Z6Z!s;@rJe?mig!=<{n$c;o2+AOQA zTQ1J~ifqE`w@c1_Lwe8QH_{&a8o1tNBG7dr^rO{@Xt{FtbH19kQ1RlB0UGAsT10`F zBVA?NQi%n3nJw}Pxq6*nNZt(EcI#cuyih03!yUJu%N@6MqbKrq=pt;KbC~uWkY+uI z&Kx!iuqnxCZ#e^hHj|c9!biX0y_8=lA`pe}!}Divkc*lFiyCS%t4#5kPv*^*Rf;-d zJ)`2F26M9bnAFpEE|g`yU!)m9`^agcYg{eBI)*WLPD5~7wTCg&;!JAe5tinxeDH#8 zZx#oqqh|5huOV*152?3hqh=rg0fE8htj;Hga0K( z*sLeO$ZP_NbVI^xFvzB$)9YFC@ms*ke0)}tkSwM$yRd-AH1s&0&FR-9x$ZajbaiT9LfEBs`uMM4yZ8F8hroKwZ@mCxOl22&KDfIx-gap6Ek=U7r zk;K!4vV!TO_X&iCA{JYi${6L4nTmCt7OfZ^HpS5R=*)m8pXG3k&&V45{$%rvZP-T! zF04fJbf%vIJA9UTi??z+m&XH#>4rwLjttE47VGx%XMe11;#B6lDeOlAnrvRLSrwTn z>=juFszJCIT6uQWyZ&IRA|#(i^kpKBl_{w0H0=C;EQ2XH&AHnkb*W6jo`y7ysjvdk z_bW&=OI}m3l18`Kb}4V;gC^tU4UJ(h2KLbSEQyrCbg`L2A7!PZrm+@f+)SZowh7M4 zpD&LI;O%@f#l1#DiQGSyk#qrrJS#0O?vuZH@(Gz8{{B#EYvsq@!yHE5;d7}Kd zGc};e_ooHZWAW)*roj9OS7rW4__M{2{Ga02{Qe>Kd-?}|@{)=4 z{&W`czn)ik<Fe4~Eq7W|-|Pf0ikgX5t5)@E$51mzpF0O9IgRwX_CnVOq-w}TFpQ^yxC+LeD4|{j*9OT}V>-F%>BfDwlgD|4Je3d|v3NN9C7aEhF0W)(t#+)Ha6{ zp;v>m6j1vps>4ea7llcwDBy08%fnh2#L_U8#-OHy8+&rEmqwTZrS5v2C)Obr zd(o9uYps_EFiUcqW%;bo*zR%q18S~%QSvSc8@2RPjRCMfKfm7jLDCsF|GWG=|47MM zko@t9;xbVMcCBNNLwk&P~|w~ZUo)KUpYKU#gn*h?GUZYPa4*$-0mq~ z+$two(`CB+qp&*C6Q;u4NdFL8Q`$D?=RbvAu{(k(tcu;=g?Dph%l_iezS=va$cgsP zE^=zdEK@;Flbs~oeIq-}xBE`^OKPR?6LzWi{NFXY{wlKBX`R`E?XSB2Y5$|jUft@!#-Kyoz z`IO6YZbpeH|5Zp{PMQ#smwyvCgenb0s z3Q)~}SvJH3@b*l(3|aeFs-UKdjT!*#4|3g@?vGt%luAP)Mj-F^UGEmVuzn8S|MA1H zbzWL0w7T*xx`r+9(ow5S+=O(*IxlQS?NQWa4PRUE5?G7pS=Ycuq3>uH>5E_ zD0hi&wYZ|Fs0cnHa8X^e0&KTbN$2kDnyGNUWtOudLJ?0C0RCpVrs8^q<>s2McQ;xk zqUNrMO90G;&q`FqO?3uZWOx;xl?Em|vt614o>_O4=75%9=3XSanRJ#sr!fK5N~0I8 zw|E?I8!{$Gry96!CafLs+KV63GRApDkf8-DOuR=BjL+xGIKL-EU^qwS@Y1yB7W9_m z*>=sQe6BiNAXfM^6=!fE+7bnOOYj5ViR42t;I_sQ zWO$k+%aC1>5-DIkA9E0jR?;vNZB?^@8noeN#qMEW|(w&+kLal$v_?DGpnM z*`3zI3sbRH5kj&2cCtQ#7=Xpf;H>Vt;((HDso25c_ zD^4cg@KYJ~{6}w*#20Fe7x15DSB1ica(Ky52TA&il{PPIn!-@!*HItKz}Yz{jwx1Q zobFRNaJV3(;zwNY=JSf#6u>eV(M+`#+neAx^F!<5n29f;pZ(%Fy=8Np3eechhzBR( zP);G8y_`RI0{=*!z&u~( z7~Us-^V{_@^9}IzzYJJ*4Kr-PKYLF|S*m0DLkd|;$MClma-_iBc0YqvPQ|+a;o?bd z5FPrQT)Gtr*d+fMx_5cx^xkk*$m%=hY?r4q?$39}6KTAOE*JN+i|dqS5hqk9WssvX zCLgTvp{#Lqg6jU=#Nx%Bg&n6&aQk|5&1?aPwr}WsKD*+sgm}HYNdu%Jny(~x$%ft} z59W8x@Kn<;k1;9i#_+fnca}GL1R1`9Ob>R0aylg|E3&yB-dgLv;pX7Xfn1NcVKcZ0 zg&f@@2=VIWyEiYCr|;hV`Pny0p7DK5>nzVQz7GpP*qX}_MreJ6MSnj_`Y1y2&nWC2 zCCldL*35bf8z1moXWt%Lye!}Q7`PMZ-}%hNh70DiBac@pYyJ2;(tKth*(V2g9dz9` z)LWFlQHcJN)%7e?vUJ8Qr{y^F+%Y$xsfBaQX)QhRa12#>ZY$U9&_vq(?A*!l+n4m1 z#xVjTUq99FMS%2h$#F!0#*Z&VekkU6s*oN@I%*0*_f=a5MA_0Ql^vf_=KRnQL~ddI z<2B_6M^)!lT?1xx!MB8yg05L``UvY^exm9~9wo3u_^I$}EWLHb7{^`FT?OgES22{Y z0#|WLBG7ar8e|6sM5UlCa>zUwxz#0H84pg1KU9pcT6gM*8~+9r9!sQqJ2{ZabsTBB z?iJ~88i?G;%{90$^NKj!R?7$I2xn8euHZYs(n+hL2_vU4E@EE$tTtdJNFCGmtk#Y@ zisAOdyJy@RBaFAYnc!GEgF*qkdpN*C;uypMCCcu~JCanag5UA5SIF_aN14iX2#+9L zy1I%2Sjx-iJZtLc(xufDkK#K^4}TU8dMYGXZa4R!UPsR?Vi|2bW+v9BVv^Bumf5tx z1!cOOt+$CHYJv)Z#L#fy@v)lLW)E3P@L|U{)Q(T0c4PhC;rs7i6pT1t@lWjT zis_(px@Os;yXZ7b9cu!B-iDj)nm$CQ>xKt)$?JhTKQ?;D-sn}!B@TT)ao>7i3v30G zpIh!4Px3knb}Yz{5c?gOb9>n)^29C340st|fF33yyA z=F`sg<|v7GM>*4*XWnrkj&vUB*csBPO)X?7J{{bG?z+{tzrh(rGf}69ofT&vNtij! zN^~FNh&AF);C|}<9Y2uAXJMu#>6k!F5psyxM~|Qz65CHHQC^m|)ae$q;&?mGGP5g9 ze8g4q{slU+r}{nxs+Nd8o*MDO-s#@p2ophFS?goY(S_ejrrMDl1l97~!%OytiupR? zNBi@y!4@u}!kEU1IF8Ri@_vg4-@$Oj=%gxgvj7c5NwHV+yASyh*zTm#KK$&M_0t$^r$H zc_8U6nQxC`x${edj=GoP`zJott+RDHEn0o#Ww`if;r(J?ovc9R$rb%ZluCur{(M_C zzcQLa1=!;CgqKPBPWrr3i#2hRaxtllujI=?e@OJs-XRq^~ga6ca-u|VKC5~%5?k%?j3WH{zYv)>t^0t0N z8`=AiBR0iW2Bloha<$4vsynFIf#6K@^XkC;ySmsFb%vtmtD3H^*7SBpKNU!& zs}`@;%UhU;*U3eRy&W@!6|HwAKDrdJd_Gd(4kdnghUoq*JT#qWv@k0)O-$JSlP2Mp< zzQboOo~*XPe3o2;t9EB}!YJ_oXqmDw55FSokJ0keqEQAiXIGdicgroSj|Ni%TX_WK z2IPWKTHlE(%RKaT1IFoW1)k%O4~HTuSF;nGOC<*m7{jnSFX;UI=f%&9cd+rw2SZ7= ztJRW4(%7L-=nrvPn&s^_+h1uRavtenYe;?~F)Qv4E?<7SoWZeDD7sS7Wp_#@yRr6M zVGN2o(yY|Wd@f?kkodIRUR^6se}(9t^3`_1lL6AKPgY!-B@blX@a^(S*!rx+tW(l5 z(-D&bsMC(;?K7d@fCD~J&YnMe^N2TEeg0w*t=I);oaV(N-j|Ob3pG$UdJ^R&uY66T zFCIVsd7&zgAJ+ou@#8PD`!M&jSPK!&y1p+o+qzd`-{{x_rCXaqAMc;_EeBQkSV9aD z_$=^IUmJ)q@Dx|`r_fey?3gw6t{M+6@VbjQ7MrR$Bwgy1{NyulX?LnNUBpTqomWU_ zEtIN7CoNOTel7BSw*yn?S(wc`@0J^|&a#x3`4YGT1C4^>)EMt4b9x1aTOms{?avz0 zfFzW0b=N$*$vRBRoIis;g;Cux-^j|2Yy3Oi?Ek#@cY2I)cdPGTl%Ml&{CsktfMRI! z`RdO_CjrS+3O`~v-9&YT%&oHhq`uuv_d@ybau!w!;j6_+gt@-7pCmQaXk?@*PiPWw zMcqc&Po(S?u-$})m*-jaU6e50*SqyqE>U<;MvHcDAa$kbZm06rv^=RN5Y(PiiCKN` zz_Xa&#K6}u`p=HJP5C#hOY4mi+*K~BVIPw2`)aH^n}&yAvwaRevLyMWT9{Hr&C+gZ zT4&KC^SzrS#cbEfZ0!VjWG2gV9}*+=^WL!moy}@F9vd`Hk(iShyH9x5=KQoWuTs?WNwN6FSz8D@*iW3b|UI>BjXVMv-i9ZonP$tDsW; z0v6;iXQdY&?HZaT%-wmj+T3xHM<@3h8f+K8W7e5?Utm+K+xwtlGMl*U=o-ZB!Z%Hj z6PF%W@U30++PQY(a<|_}*QM))sr%mLY?=O3Zy>Ky!)!G$-3VqS$UM|vlcW@yNF=^Z zZXp4N1hY9iNV%6Ha576?r;c%PaayI%AqK`HwUB#Id{7?L6L3i1%u;X7{wK1FCtj!S z^L@!{V|L8bozbIx^mW0yB75l}ym$1MjYy&)5qF#Y#70Fa5Gu^PVdY0>FlpAFb;$WE z9vg%7YzuW4Lz+b@;8%rjJd#3bW9Jk=UtahICFPlG_A#)?7N>JbuhFO(0eU zLqAIgdIx|A64MtEWGF2ZXcgis2?T{$v1s_=8wT=15DxxeIuEHntVTHxCUHC^G=G;t zfXNR5&f+aQ`$0;GqKXI%pYC|q?jxolDP`}c53<%?juri!jU^xCtn4ztZO2n(xQ{T} zd93(=p-vMoDgsd!UtU)x4H!chJLXPkpC^7^80Rop8wFH9g-jkJrFo2W7rajA5BPzN zcT0d4S~kxi%$hI;MIOPP$&>3H1S=UvS=*unCcJH(gGlRHe5VvGS}ui%m~(Be4UCTf zFzCg6ZhZRsWf^VVlhbZ2ORa?LTp0)jR#5pWl{`978ME{0Bll16AH_J=mG8NEQR%jw zz&|el;|y6q1H;TQp3~kyknW1|)Jtd@qP&y?`8#quyJBYx;RV)QLN^=UP0)9Rl!%0N zqzDTGMn%N{MzUK6$b!G0UiT(Q0g%~NjS&m$NFmCXV2uH|H_MMy%yRrq4&$E}HZTR# za)o_H!KPp3hd0&8MKf5R$POGcM1$oohm0F+=IFfSg=MTWt{V~+Prxt;>Gg7+n%S8p z3aL_Heu_4j9oqPQ#ynrvnuszxD{JxTYWBmru}I+wBPP#XxRBuSdhS!0*_wBfdub=0TCocQS-QOUO$UBe0Hm! zn<{wU^hYUON6t$9OLb6bY(M2~?{T&!GSP}Fp>hU5VWH*uosz8^Y{XQav7(BkFt&Jn z;aj>74LRpxuOs^B(+pG~pvsnQYxu#1C2UKU3zm%w9hIiYKYRY2%8r@<4Sc&kMSgO# z`3~7Vmfq$r9A**bO+T!_^<&n1`P~iqan@cwYJY@jMH0=!q_=ri4# zS=9wK6F6N%!I|5zq%uOx#w@y-EoLCNSVYwSQdnIzF+0D37m~`Z4CZsTAEUp(J1oGbT{c0CL8L*R+&l< z47kcba>2tw(>`C2d9h$V(|e6Rq>aPt@0M3rbNc0W zvsoUxkgyiN-MJtdq|f?bmQ-JPp8wPdr48qLFi&qwQo}5HR+CbZyds#)6UHOv+#&Q6=brZ+EF0_`+H&zGP5O8lon`qS z@Xu2$FVJ5N{r~8Ra@sNgO(!!C8GzcOwl&9dWg0EFnVtD8f#$$tyT!M~08}T6^kjad>2p&2k98;S4Cffjp-@zWA@jL(G*gra|}vKbfa2z6t?G;33Ex>~b57vY{xGn7lDsU3vP!?cR2wo%_=2D)q}DyPu3X3)tj8wbp? zsmxjR&7^IbH&xB5pXLWzw;F2|Wb853F84aJzQKnfPQ|Cm65lV%fSkaJlhv#cRU4`c zO>rhIOhX@V2l|In31-+8v%dy7-Jh}dO}m;E-+<|Ik)dgC!ugN9id8=OiC@ll{)=;- zBgf}J@hrJ8G~E}faRCsSFYg##_L1{{B+JF0DpPFA_m787TCMi?37dF-B=hZ_m?@TH zvYl@-f|K{}7xdHL;FYu5i7YQi!;nYQqBQM$AlQn)+Oo^wLvhgn|Djk4_wAq*j@`Ts zQjMaS^L;XKhkZ*ISDWi<=5vi;pC;AKQMj%z|53+HUBaZ$fXqdj6=h&-RFjeNXHPnt zVYMG#-rQ_?B9fTVs;!Co%mtciqrWwGkSM{~jlfcB0%o+jvKfwnr@9cl46m)8oMSLt zj5c8yZH-PHjX~M&?2g79jn$n`70qai8}^uN_UhCwZ{rXQw`4fyt9{MFjWDfxT4OB? zW#+2X>Cn;LRHs~jjoz$- zyjll%w=iC=wt!-T*GtM3CGQ1m<*30cb|6a1_XNW=gLsGf%z|t)Cfc{Y=Ku=IQe6R(HO)r+cVwPTGJyB>JS!vcQzG5&u~i zKvWh|FB(7zpJxyGXctAP+Lg@{ifAG8*_879THn}RAi>@fpTep>3*AEBHHr>^DQ*dC zfn2cfIf~((i(CC7Ekc$jL0*W89L@4Gb$&%bYCfcYd-1M;jwO|RJG+@}{{H$cP}=oW zyv)Z>{2b-W#jDw(gOZ)`{)%6f$Uc4t|50DPQlseI*I$2ebMr-#{NE;SSOrOOIl~u< z*)*-)(B*dXasg_+1h*!m)EYX0lBhk%n=aZazvcpXEu4_JU=FaxxGhT;T5Y6W`9+1n zgq)Im%E)p^>!ZFc{regdzs@c`d>R8`dg<&}vpM|1zWuMuzwgHM?FNOM1r(r&SFyxM7mH`0gpllnJn-?m-#j?d7d$4c@vv9;O-8PP4 z%bGasfts+l$1!tI14ld&8i8MfgX)X&B_(n@}qdxYb5B)b7wBKJVc0sWN++u_)@Lvuyv z2OHuuvLXJ65wI-!oB{SCC|s{OybWQXZHOiZ%J0I67$}zYJ2pE8UXrEnm_BG}?scQ} zLoDN%OLR@m{fD*rVQrrD+FZK0>{zKO_!apfHD%(dDIqV0BQjI^r=+BVnhQc-xD zX(q};8p=Z&$}mP9_Bx&etvUQ>9?ZDods;;Gt_R!g!FHRp?Ur2?J)*s)KNxHe2HU+F zY)ynb2^NU7>A0~TGK(jfS=@Tp-oakE*0%q6##>W?p#tlG5?({*o9aQr8k&akCHYas zhC*QJ+uuo^a?H+;zFse*ZI~S+O&915`AE;2&RITDYz}giP1FCeCtmit>x<^>WFlhgwnTY=Nj1Rd?UH`s|u4uIO$W{zs1`AfUJ-gzx=3c;E2`zTNm*`#rD&>q{>cOw`;6>lrMTF^vT)W<2ukqUR z$u`J&cqHA|#kU(kDBZp9i;bQ=Ixm0Y!@<4G@llc+z$z_yR%+yL>*aPe9Jbz<+6Czu z9zF~@5oKRcuGl9s)niu!lyJnaEoAq>tfF3%6J6ZS*2@K3Ei#Mn6<=r8O~sPrJFD;w z=&E)3Gl%zD#bA}{-Te#w<|@1&x= zVebAlg z9o{KlabNW!yc?!hz6OOqM!&=vn?rR>&!TBNYem&duKUxA;)=+FO0DZK#GDEn(A}Q( zCmLL2yTNL$;{D1n>TEFwdxrTQPA|kZB!by6xhUCKHL-$|%Y8`-Un)MVd%Ka7qO;_5 zZ!u1ZS-@@ap}pOFGmWhwx_ft5&`iixtZH`C>Kw?;?@BqcGFzqU#)sCp+xJ>91nm01 zZq}{(By>;J-1bUFyKrf-KU+-w`kF%}KgD|-G(Yso$gUJ|K8$VAWsRQQS&EaQkE^Nx zNUwFyC7%#85A;)(>#~4ex!pf;DqV|VA28gQ;EpYJDK!c(&E`!#P>NoI<01p*Lm1ah z?Q&F*{w=>~{3$rzuNHO2b0kNkX`VkIjRQ#ujgRju~Fwq zYw@VT5LA8A#XiDh#r;Qdl5V>qD#Pseb(Ndjlk~csR4tX(Ygf*ef{-Oo;$aHSZoyAIc6tIyEKpjw6=Rpfsh^uq!=}=4Z*xbN^pA8 zyKUBkxqDl`h2CT9O_~MOEI@XE?`v2eTF7RL)ppZ5$1)AhR+|>0{WAJbT8X>X$`bJ! znA^Dvu1LsUjB`4 zF3Eg;xib$hnSF?}3qaj>o0vn@fL$)$sRV_XOE<2w9l>9V<6Sg>Lro;Xz=-Y)n7sSbop}$(LFDVHdD7)Ps{&a`P(+}`x8E>$jG&kS5a&xNEC()XXn5WQl)!ux?55S+D zX1(1$CrQjp_cSH!UN|p}R_X+mn;>fM|LSAuwzAf~(Z65D00tzzv}7V2&64MI4#tB# zOW-ME^L<-cQ#XDM+^Xd z3OIlz4B2l-)0PKtcK_!Aoc9e*Zhw74?^-Sl9d-8HZ4$b2xJR15aG6#kF~{#Jfl%S^ zcXAbR^H*fGLTqVp*UI*03(~!=Mz)D~R>znO$XFLgVj*pHOcoNJsKJi1O>jz;HkR*U zqRM%a**M=HUr#p^;%QEj&8ua^(?2IQh-JnmHj+i=o_!T5J!2%Xt;IYnJSI^4FTGA|0s`ERA?CkGU-j#$Kqz!76XmM7^4FpDT%s ztfd+Uam7Dew%fV4xZYAe{Q%$n--W_yf2nX8;@lbO@t0jB$w83U&|C*Q1641nN7cmd`gpFhNU@ zPe)AS0lsh31lWmLUOeG=LR|5D=&5m)B`;5fpIx1csc=MK+D(!|4VtMi)}2y5*c{P& zo~R_YOT5*$`((PXKG%JUOkxu3hjLi;Vz4_Cc2xFINe-iNx7==UM$cf}VM%`*c+TpF z<9>ponWE|3o`@1(TXD?s9vHk&$M=JKcM|U1!m+zG`|d5|(SC4o)Xj|yPVT|b zTS24YY(?hxlInovN;U!O_wElJ%r(^QA)UChi09LTyXXgzz0${9lr}Mxuc&y~x|Bm( z>m~w^X!b%|=Is7FhHE=}0nxT(9y{hF@`0Pk;wfd6w3Wo<-S_yPX=~kG(Qqtz02a!P zA~`A9u|sgNYY@qS?1t;)1-Mr3F8}&3Fm%ttC7IJCq-VXt1vMw^Sg1fZ*eMzK!eOmv zi6^{GRvzc{(QguK_wJ;g)WVe25#qyn+%A%Ex#U%R((u&4{W|zY3gq0fDSs#a!yw%E zAnZ;P=VNf6`^=rEWr%4pZ4Egm?))f2d^>He<1i+!V+L3-N-M-94Ar)v;KWT-VVYj1 zmk4DdJR~3dfszki|InR$(0M7X%=NS#I@`qy>s&r}r1R3*Y4bh{5$gV(=2f)rJtr_J z9q*v*-ZAnCorryt-WYSqznb6j6HRcF4(JQ)|0;rW#AE_yjpbS^W?d@-9UNqJNk7jD!wsGJ8tnp>Ht7yA=#E}y zsz%We#X2Lpf@ps7eS@`kBv4jA^x^Otwdkvu@=D?Row0Wnlfh~p56@GOWNVztD@b-}Ht0V#jF+pyukX?B)Er zu*NpB(tMf7wM4f)uP91i7szc~Q9icZ4OcV9yi9KcO{pMw^Ic}h)sRh0%{Et=A>}P# z>JyA*17}%Hgfd(FR|$@i?P|4LZw6*5FP08_|MUxg<=4`(g1rqd1ERU{1?K%`0spM0 zf+gi+u`uv8ov%UwBwe59AGnB?VRDhA+6d6yUd2(c|}1q!Y-ez>F~U>16X`&&h!+uMmsm1bKP~%4a;`wu9r%SM}JKcUNFhFe9tir z*Y#b;vNhfFtdou#A7JU5OO~7up+Qf(<}l1T&?fmL_e>SXm_nvnC8yWXs>m6 z+c;NV)Ah|vT>QzlD2OabZ@b|_ zu)1$p=fFkt)hgx7SW>as5bXC*UF-IF;r1-HvaDypmR+s2D#*nUz|BW?&&v`-T631U zbKty!;j$*~(!2IY@hN=gMwo~Dd^IcxCvO|~k%bxywGWHwlpQQH^FTQ5(i0NQV6j!r zQw{B%rhUQwU;n@Rz|9Pl`m*u+70XY+J-B(EUo6;!bx|q5pI0)us@v;8?_mf5Xt-8I!OXfEw^XxjRPAk9o=Wn0gExyOSzV-kM zJA3z=76ZF_{RwXAuD`jsj=3t~9*?Q(q1U?-n}XlhoxYF^^KhqcRvvkXJADPx`5#aD zmTUGaA9@ky{zF{vTgKD?*ZVfy-rL^Q$G`aY$T$7Q+XbI8p(%9F+^^8$I?S(9KDkA- z+cdF_)K#tB*)96RCC5Wta(uuY#sh=q^Sk62chzt2n|zO`lw-`Zmt2Z&c(~+pQkPt&cfUPcZn-yuJzQ>C0*WhcLw&g1QsQz;S^Izb z_gqdSblxNK`)~p0q%Pn9k3ew0MC=`r7yRwnUPrte^5NFdhg(Byk?~`&{u)9?(ont) z*80J49ri9taRk(`F0Wx8Z=V9N$0&;jCk?ADrLA<9ksW<&zCf+H*Q8Gv-ZOvb!*@r% zTk*#)-(0?xxl!)nPQ^xKJlv^x(4C5>FcB7xEgbn8MFxD-Rf>JDpQ~urF;6%=nbbXy zMZq8Le;nifN7M=MlbOsHde?*OSq<{w`(qAb`T)lHt7$eU*b|VAC3~67q4gr=Y6`-a zzJy#F<%c)lPMXQok)o8GC`#%@nKI)5T;)e*@GGw&{}2|%NO}4EGvWA$gsyo=?A|#Z zu|(x(QADi83LVN$%1+d=1-;cmYPxr}Xky*t-Lqmt#qE$u-apG2`+Q5xPyRNygVx?7 zmqP5b(jJ+mq1M$Svw83;dT;#oTr+>q6)$_bOkT#9q=?E(Dyr}lGR$YmB~42hb{=}g zR`$+R;I3xt6&Tnyo780cw;P3z)ic$3qhR zWd-4U+>I9}grB_VL=UFdA;v=HosQF-yni>h89=ylf;^@Mws1FPt2Q78@(^vxVEi&3 zr$9@s+kITG_*d!1wP9mi_wz$tm(RJb%OGW4kX2nCin<)Rs7v{WhuSHa+9}4-Yp3j= ztCBz2Y1~8Yl*Vs7)J}P*o$@)>PN|k7kxM+5uS}8_hzJR*XqmcXlJrzEu9QD3Z)jfjRsok8(^_7rB&`H+uCVi1`RA@^R|{!{fq1>VDU=yt^*k7hqJ&EO zwqD8h|NQ6|vkaBgxs)>aM1fDxgnfuN$3}u3AzUiqHi7O?Hhix6!&OabsEi_ptLFTr zIL`~+%15VFG8>xt@(uLJAO%&NbLH#1U_Fb9XYm*lJNGT9_L^a>(0q;t!3jgcJr`Cf zA-27`O8@F9c2+$_`-4_bd9g^cA|?%(gE>){NPNo60V0mc!)xu%1SOu6D>hScIlyC} z6sA5gZ(Yv-W_Qaid~?Cc(uwthq@?|*7E^%QSdfI{}L(20VPuQ-j%TZe_th1 z%!d*w$0(7Kl`Lhx|M`q8Ldpxn{Yuwh0r6<`AD~o98C%CLmD1Ja4<%E|)6+xAltYSA z(Km+K;g#^jYGm}sx&|PR$S69DX^_DezuxFgH zLbgZNrtvV8DTXpduAPQ5#ZabD#W0j9qR}*zDY7HSQYSizjbGI&ABHl;P^M7mvnpkZ z{yreP14Er6{$r?9GWNg($(B>=6zqA!iwt#&p-xFHqmp8&%@NeZgPJr+b#eownv>a3 zr?iNg#89V5hs98*Z0-EH6)#Tr>CY`O>a!qHy=)#(REim*Kym{>r}m7bq3%a7D-i=K zWgZc2b=>3;;*yy8R%k+E?vc$TIw&e^!BD3d>J&qrVyIILb&8=*(OfMht0E6d;)n`~ zc#B{ai{mO7)d$-FL#I;kkD*f`qp%?v>X|zz%{{K6Q%R4Bp;Iw*D(X{cmFQHOSZfW% zilJDkpJL_431-8ok1Pte&Je;3$4`N~IFglLvHN$t`!n8sM6-ey@Zb5*hG%7ccvgze zc@5eJY1+`R7#fz;KZb_IN~YH_pH+GQOEf6T0OTuHnEtob4&lKFalR8B+&zeIV74Dp}c^FYFxWJvnU3Y8SaJOWPuiwzp;WG{C&_P)wI(d53Zcd~l`|LaLEok$PuMMqiwM)_-} z_o@{Vk+s8NvW%5JOvZl-U<*SzmL)}W(h(DNakmsW{f4MTUfU))PKKz3=!zj~@#Ar{ zO;d;n>F1jKA(=_+%?X>zwyz+vA!=cREgL`i8|c7GyT8vTMS^v}e;W3NBRgZo3ST7+ zBh?{9=_&J}oI~%6rbB65IzD#<;i|vV!YmF$hGNK23>k{7pygjx%VZYO3@x`}CVA$6 zzzIaoa;}op%Y8a*ljRZQKDZ%6F=Qx)48@S4Xjv_(;o-4845DDQnRL>y7cO#Coa~() z1hB0dSr_LkBJq0&8YQPp3zt~^V&zK>u&9{6v?xx8|=rcFenqkyi?wv zckDUDc|-eQyjqd94kPZUnCQ5<82Z5i)ylf_nP*iMXITRghRV5PVVr((3}U~JiDR+A3agWiF9S-=I8k$YBNI zkkq{zj{JHNha4H=kS2&j$RBUtyf_=%{^Mpahr~6hY37jl02}I%xal#}A#qhQ)FFmC zBon?>OA<^c2gYvO-r2)t_tRo0B^SZEM;UM@F@uGJ;|X~?m%=Q1@z3~(b;313V%1|Y z4>T}>3wbfx-imypKb)I=f?oiXoSVs-#!d}&2ptAP9g?G@T=zj6-b%5rs!DiJe^4>JvCrS%-vS_>{P9iw1tTCy$59KL{r_`kK8{Lmjd{ z)FDM)e|B@iR88!)vhMsN#&eJ{;W%(jSqu~g0(M@`WE8xe$m5N2mrKDOB^J%xIcc~< z68qY4unl*J;SMp}A#ui&V15&BH(*mE{&_KKj;Q5>H*tgzadnQCFK}b8vRKl{AVXP1e2LYyAosQe;27h(;(t(`x& z;_-!_{@fCyF$+S-%O>Z5EDs*>!yr~8H=uE9&q$8we)P)rMI#pM|MHhJx%EcQ`^yWY zwg>w$i3i5TZ5}vK-}hr!k3tg?t|(|lIP)oNAx4me_ePH+y>|-@p^ykG+(8mwv-yKG zEj7!!4fVfSeiPX=+aQ*c)Z-hj6T@|4xK0e$iI(k>njaov#ITgrU<@%FC+cIYKE#IO zL~%THeWi$nLvWYMGo7S-u4V9@XgtXhSx*vD8txMXW1vmZLT*as;d!ssD}&VIzgCsNL8N^oxm6L@6{$aiNn_!Bmt>KX=8X!t|XQ%(H`@-_hUFuiVcw}be;ptFBdO=$#%0kC$G8z zUzrPaM?AdB9zh6crN_zHoATJHS240LMBvmBLMLguIJ~xeyilG52|r*fak{qE&5a;H z=OD^=ip$GG)UXk?=tjeQlK96kpR|Da%S`!LKWhWTWDm{0P< zlGC-7-5{6!B!l>bf&tKtMKGHbrOBlOfTi=r5wDChmtay*4tq(2#Te?6c2bvw@3kca zCW1UmpfTaoPV!S`S}>cj*inJ3xXQnuf*o+KUFu5o5Bf*D2dBIJqw9l%AISgyJI&3* z{S0~LK|1%K0|?0MJWR;WqVu8I7CA-OVe;R=DEdS_7f5iDr<2MwCkziT^d|AKHuNTq z(3>39O>dIz0F>u9IjX>KlDb#JU0*MLlVihg(geTBbMK3Tgg!4}#t@so2@EH3U22-) zBss)}<0Ni=497`anGDB?;W!EZF&rm`<3#hs#Zo+SvGmyHJ25tgR3?3r>LGcz;W!Zo z#BiJ#juXRivfdmg#eTnGIWa6JcVq7>Y#-f;iwZB>+lIPgSWXPfiD5Zu1J!THZ0m8yOx@@I*{FMsQRe!C8NgQcb2CjvM`^0dcw1WHOmMi4K_)qkv zKw0_|SudNzev*26Lw;h&Pd1SJMAvIvI$uYbwCjZn$wQCA(G3BYHcM@&P|A$4`o)F{ zrD-Y@VO1~9gd*__7EXks@f^$JK}iT{XiyrXL8-b(Z!Qx`r3KiKq8L(?EJZ9&iV~X5 zJEoEgBS;B*=97Waq$CdoSDGw^qczl0=2E7l)~{lMfwUQ3RnnB?OJ8@^l(a`>NK=|6 zP0^lShBKuqXG#f+mfW~J`8z^Ax~K!@|2=@ z=ep=qLjRd#I@$aw;iYl!b}FGWcrdS-0~5 z&Y#g!OR3IiGV!**}DsYG-O2xR0MRW z1b@mx$xXPZhQp+J4wF2!$fGdH*_)@BObXSq}OM_5w2t>@m;aPpuM$nxqkGlHqSm- zV#rCFAt#|`n!NR2?c2}u>1Gg=#Pz9pf|B$wZv;t6;S(i?t=5N@IKjBbpdK=&qukRs zqW$PX)V-22H2<#u2=^=(=hpUb?=Q}G_$a^&x6Z(%Kfyi^+_mt+*@I17`5DY!*)~yo zRN|>&_2`3k`kCgqT?y^s(0zS?J)_0*GGPA(fANiz_JE|)J8Bw}Si3MNxR6#Kig0&% zkIh=xC>xI03<58|^nm1$sVmK+7=y;HP_Mc1`E?BwiHr!?%sIq|p&iL4m_)JQ0@xhK zm?f=kg2;Sz$79R+M$i#N2oeAR-u47Y&T#7?tF`c$yTb^VE>sOE zSp`nKnAf znDq^3qG5O`;PJ?Hx|-whDA+113LHywZ%$aH4V$9K5{I}s!Hc)vic%+?{OTe%L7UP) z93nADK9hii0wgE+u>^}r|F9++lcg||eE9X!kdhcul2(wCe7W%#$47#SA2dltl9*YW z!$KlHxFH}h1SA_sK$0p$uG>Nyy4JaSz1c?uIKbkksBMuGSKGN7STW9_2_RpJ5wmjBTXSioD5GBNbO$LpNgRM(U>|!1h`2fxW!|TZ?CKGT^)ha}{)YU}Sebb*{q8sPUXL#rKR)NYW(T;>iqiV{%IKK%Gf9Jt-z-mja`Xsy- zw613Nv7>g%iHC}}vt1(Y z)bnQ$FhbLGTPp9j-N#_}5n@}$B!_61oc;x~U9uXrQDBxwwaenB+AQMl&g6dfus|VI zFa2J#bwf9-<))1}ACdQO5s{-4_GW>8%6u4ccbR)EFCe3ef6N()?ZNcE4Qpu0zS`w(YYNz@WYIVB`@ zgXcB`VJYA@xxzyD^w_Z{y3%T$1vWGd=7BQQQO69e+tpFI?0XBKl=l!hJsuKQ0YSrw zH-kUC=~PYe)WJh?H3Y|8QNKxhqpyw_YJ(bOki&(chw84Z2#3XG34b9X;4h>*ccg?) zYI*LuC}l;;W2Q|S*krAfQw7+Hy#i&m*F!7QlS>Jn)P^XPU`lm;DFauQo83~_G8!;7 zjIsnyxvb4;Da>+_PHqYOa>-t987y-Nj$>t9a|tqEGK`SmT;FCZAaNDYaEaoU0}yKv zxD6W$T~Kk!_ND^BxQwlJDX?)Fg6ad0OPH`_K*%MCSqhL`f}B;r$t8$e5vW|otf~P6 zEMsCTo7sxO*D%y&hPx`5SzV_~OI;1vtO4BA_D4$Gpgny`fSq;B@}}Ifwt}fDc+I&p zwx62BX_A1@YC$!B*zT+;lt#!YS4UTFy*XJTd+NB#d;-rv*lZ?qa9Z1j=y&UmWlV=l zwljLs`8GwjhY|YxLThJjOOWh1j!m{6Tc5f;1r)C{b|1;hR~fe%xQl=m5`^-4aPYcQ zV}vF-cj;6-ytyC+0T_r00G0jg6Z_+0q#l&5sZF^jM(tFrO$<9%v(Zf*8nr5ObW zafQrS?%$dh$E43WbSHP-@(N@&oi5U#lEv2F!q-Ep3lwUU%3Gidz4Gc&dDwGv`%I0@ zx@%-6h-OTA%tDf?FGV~baR%suw-C{a*2QcpXEqMLBb_SGa=VPgses_ z+TGe`)rQWdZm=JFN9rT_P8rVZ*z?%~wjZ*f78&i3$JLa_+?ev1CykfKOcxQ+uVQqv zfby7`eVFo?rab04mB%cuvXiXqaF$yilaxq_7s&(gmRJM`Fbg6e1!UgBk0i3JJ}JrB$gUsDTSF(kZB; zmE(I0p}1&iUZa0m2Ij&=`Dcl$@z2M0fp|NVEmN-XzCI1|0#;`EaB z3F#dGVV;LI$+8N|Qo8({A~A6Md;=rtlNzs!tKgZTi+RO6@wNi+AXUWE5=^exoJ;k`4#+995F?;ZM?H}0(?(;~r9I@lW=@AXbj_WFlM$Fj;n zOb=e!0bw*dJvrzd9G@HL4z|Y@(lxz)-+_lCu?1@ zyTiS^>{iKMo!=*MzWH4XDo}b-e}U3`2d8|I(vu2BN>lf0Y)aOvNa?95Qd(<~QY^&# z97CNh;TX&Fop&Cbc5Fs{(zq%$R-aTp!lpFo>Xs(eEwQLweNv+aqbaedP-4;4NK82T z>1vOHnM{_7OR9h7DTN3^Z>1`zvWo##-kN;MZ#Q%ZOpV0C0|HYc(bPyZH4BV#g|D&0vu>(G78>iM1?nWx}NOFR7lL&rVtcV zt{(;4lJKIxiM4fAinhI_Nl^=_DHkf#kZTKs(%ll&RY_I|dWh5ubn+qNv{t9u(gR@3 zg<%ka^IaSQ!TpwB#5p3qm#v*Yx8k82pB7RdO(j3MgNJW;hBch~81~co++&@?Cf^+^#7Amyq-ZC9 zYA1VkKEz_}^+=~|-?yJsvzm;J;ZUCA)(4b z&sV4)qMq!(%2Q}rRjcyW=CD?hjmuQw!Xhq#A>UQBFvU}P1PfVY+;xhDII|(&6%93w za8y#+0l<~EQFqQ3_X9=IRE#H&%}$rGBClp^r?X0FLd;ERM`BQzrpL6mmbo(Q*E?I% zi)T}lrra{U$hjktP=5+-ugZ)`+2EC%HO*!ETuflsV2|B@WvFedlYTN95Fbi$0SkMK zZY`dJYDh?kFcyubDgdIf@acG3-^;v0%@^~VGy5H)98;)o?yJ$tSxce~OV;1Qymd7l zQp{6N<);hiw&*Mt@GW#cJjz;-ETB7OmwMF<@(L8g>7xaOl=0ds(4P6u5aJ}@-}dBb zc#ErgXmy4sB?yQ$yHpt- z?J<^!x*}x7%NC{t;G+yXC<&lL`Ph&MTtQ2~JoO4vhOe<9QE0-@(nmzA)@6foz(JGu z)ft7s$3ZIrK^;20@3kt*OLy!v`jXlRPM(cML(DpgyATk-_Q(>0{;C(WN_r~o+K0!E z!RzvhRL;S*&%zgT9$rV48j$P3BQ889ofW!$s#M<{e$su$7QNg9V?upZ>=#D7teqdH z)-6no;HQrr2aZ)ee-{TCLYk)!A3Hz)2vI^4E0{fv9k>AP$328$PDT(+Jofw_EdTyy zyMJ`lwfMhw{tw)Rt}wI;zOcpSfkozl_0|J zovY6-q36rL>Lr}+*N$KmbA73z<7AbYc!}Mw>LOFlK5OCP$~L-$m0pycu7{pf&suBP z>t-x=^EUg97q``c^%Wo;>kjW!wAID7Q|Z-|w4W6m$1+Akk%vx&gRT$__tg9<9gezq zjj0UmiV@e+GEHh~dU$YHbkV0~-eMK-`r@v_xr^QzXo=IR_`%L{Vg403G}1ruUDnx= z>}$!Fve%*z%dHs6ZJ7KFlb>PoQ{cZ!%);#a+)ZZkJ8hiFFP(0$Pxo=U04Bf8J`9te zVe(r8CO@^DMm-Y0kiv>@p)Iy^?oxigJLr>g;El5&MncW-x@!ef=hlVT7{b>UYx3sF z5{lswpL-{70(rb(Ye%=( ztUa6G3ayO@iQwd(Ji1}|tCi(%C3*QWdH0GKVJ@9p55#>kw0ugmd<8Gn(A#Zq-Hh$Y zXMl5MJ|5V#tj#=!4>$o-I)o{|+i`nj(VYaK4+3ua=W5C(ft<88GH-gkIu0@TJ+NB29@Y%@*%kbG5KD#U= zGIoHHoR)^qPNUe3;j@#uH6f1_k~T?;3{7M-O$jCCtWc7TfeMhGppR03$qk>K;j=S* zcIlZ|3!j~W+m_vwp|TVIF;sTVQQ2Jt{{@%jM&l$rZ7hdT90c>L=Z$p(hAk2 zK4oz_y|2BTnAnI%AunzvQzX@d@uW~+Zv0+jLK*tOXe)>>DfYqjBp*~tzf+Aq z#6Wg-5;>fCBFE-(!w(fwxz%Qkn8F=K!d}g6e?}b|bZyQ)*o@1b-|gZ*SkB4ZrouL~H z;iP>^0Px(fpe;yP~ZQTbIea7;YE-_^U?e!jz$u#jTmVged*8g=iDK zjbU@KI{)-;mQEMaA|e-<-}jhR2=FR~1ut7eX?i@MWhCW+dNec$rz6$Dk!FJ{dMp?P8Z4EAmxaRo#`itCU*)2 zZ$ih;9f&2XbN`au7`1B$^M~!u>Y5s8=KL@ASdoTlPJE0(vF^_yY?}sTOy=OlFM5|< zndK&pkS_1;fsghT07KwY<^b~5mAep}OD_Mt(&7$U#Z{jSyq**FFHW#;3Cm=7v1~;p)*@t=xo82UhY^#-Be+YSZ`Bs`Czy0~C*RNnH*L1{wlu44xfjV+t>@ht!s8_s2e;u zqdn`~nc40*_yO+BiVvV+kVI@I)7Gc&dsv2}pg@TG^N-GB@(Rol+I44O#BbpmUVDQ` zb>ldMyVM(haYkJ$@T@0qZsDWdj=jLK+!^%hJpTOSKD3-)1w<{uQoZtruI&kJLuD(I zo6E6W%L9W3Q%7m1ERAG~X_s!WM|SFHBY5>$v{e8`h!c^pSaWuq$W^4eQXoMR2H6khHz9dtu#c!n zL_!)DXzU@cIJv6#eLtHZ4HkN#&F!5%@z0A<1{oM{eb=3gp_#%5iH7H$awk8t7i%71 zv(3U9aLBy#rHyqlxMp@SbPjaea8rOIdA15srj5HC=@xHOQtI zhiuGDF%DCVBbrjC7>61R+_koHux3+?gC8D*=!z-Ek##g8Lvy*l(NhsMl`Mq{Cw%fh z|5QHFkwdWHh-RH%goiw$4<4PD?Dj2sT%grSkFZZa@7F9X96vKd0QMv3P&ses5mhLCNuN5&AcMMGi;*))~S5V9pE zl_6xSRf7y6oAP)VIw?aZWr*1fmsBO1t-P)4?{+YIj@3yn9SE29op+u)nL%?OUXzjr zhLxzjtVAs&5@M-E*(^aAxe%+LkUQ__%>a$A{>+`RAX}ehNsOFLl;X#?^R3fnDRx!8D#hvbsfl}M}!obx-y;$goE%(?}q4<#67C~AOxlkc)LR~3}3}CpqIcJQ==H?I*k8JJZQ52ZYl1Vqj(Df9@9ls>mhW^oK0)%Kj*&7 zc00~;LY|5uXp2E^V4BEsnU-1)p0L0!TL?ARx@0kW6#-P;>;^^nr+1^~b~Gr1uIJsL zC@`n)5e0ka_(<-xYz?JMRoYUhnvhavq=aB4he&mp5(vM(NE#uWNul3yOUT&e z6`p45)75M62)cEw2lx}1CPkHUup?HB29@FP+I$dDGBa# zBAu^@iK$`(72}fFJ5|60Dy?>TGb1*Xg}S9zH&jsBb`=a&KnnEchV;aZKYp>AE20Do z+NP@_2BpL)B~n@RU=e=57Lu?Cfz(lj3VRS$VRR6N1&E`CHY`A%GRVUM#43qGEJC|0 zZ2WahRB1C+QpgHJr!#zIk&5yT zV=PgO5ldM#T#ZpuEknOfPj(|U)?>`>#1v#S1sT_;AY&mVxprN~u>7JcaS~azwl9xX zFm-O-I~T$TZk}@LERynymUk!Va!V|xC|n)vS=Z1p*?n1-J(~6}V@k;(A;bS~{@H_as=<~WW5)mZfZW_m|e1h8P;#UH=m}8 zT&`8k$1677CDM^6lzg94zlrZoa0sUmH{cY>g$w)pDNK8Zoho6mw4>dF)7}2j^})dp z07=xcCd0PUP=m4 z;Jb%u&5F>limJ2FY?vaCsTJV6q?95rSa`+iC(6n#W>hx|Yc8_iGm15arBzn0$YaW{ zt6b$VcLgn9>@h8$GHF%{_a{R@)rX)Ge=xl8J zkDF2KF|JCD6?>G9u&MMY8!%Jp(Nubj=98)PXevEQ7tj=x*9m`&7Ht~TEw0?A(qoyD ziKfzHmPJbX45rd!$r_*>8OS(^;2V^yrvN-r3P>!b(xam5mff5w^Cd1j9_KwJk#?zJ?7&#eOj$F zySP(Of&^tvi;I2mCe9|6qHAN;$4k#2qNy6{DrwBdg?z}7F+!JpW9kRp#$0(2_{#m}^{1SH>;(SV~Yt>T8kfr*zNG{~( z56JNQ-K*Fzr%dizyUVmDOIaM3{1c zuqMibsV7>}*eViIb#Wd~uT0w%np}C~I1`I0=G`1a-hDb1M;JyMYa(t*lnRIySJWt1 zJZw3{1X+usshn7l!Ba-$%ALPtPy1Q20N#a(ShwCt=WT(#0#XufDs0~ee=Sy zvCqKTrjg*BNFur4{%4AkIobt`N3?^2Sn}1Yqnyg8!Mj0h}@i zSy}RVx$Fgu2mL+k9TtoyyR85d=n1Q|kV7930)(@77Xl|jAZu!nYRabB`4ZbnBEhTfqLdWYe?Gr{C)Pm1}5M;JHYicTf3Ls;1l_6Em$ zy_1u@{^8NFEbEqKYP_-o0?VA99P|#3PYw>@U#BO>y_4gUgs{ooV#jyJfF?O_JZd2R z$`dD%H=VS|q91ZIwkMzAFh=Hq!EQh6sGbK0@MP`Oy7DP!5iwj8<+&(&wQ*4tuE-UL zD0)?hC{j1;xX^1xMA0`y6txmjkQ%+53I z>5wB+VaH@Y0)Q*K7&_dVe9F!C-wiGH#xVtuxk47hyRr9GSn$Gok_%t&WcL96*OR%E zd>CWnC>oayO#s(6ln%&1PIHEHaskO?;xIY-wJyXgC@2B9SxWD24K!S^}T5zlGbYiYPtOk-rZH zALhM{Kj2tvXb)dqU%wk7UgrcetmEoCw~h-DAxdHOm-N1zC*$V|uRx(|c&@^5tWJ>u zQhBUJ$4@7#$BL>RFCW{|Xy<}KUu4{Kx{P@7`&P*MR(s*;vZw_klOGAMn7^%+yRDVC zty_asv!GmIG_7*2(YiZUt0}6NAzj$1YVFXPyH&0cT64d;wLoj`zC_K>y0uKbY~}*! z8T4v+mM9&mM24VQt5ct&KuHQWc#c*YeR*9$VE>1V`YMt%of4v04OCaF+n2{s?DI95 zkEiLNpnP7CznS1~gkM{>njd;QbS8_t5i)$DKk<+u#!WhI!tBueq}l8G$hjB2bSCm5~&tRI;gleEITu* zZf$ctlG+%gVovX(D5FaHQ|AsGE-U*{f7r0MsL6%G*Y1C@$4V~Htv4q&w^!`^%;6l8 z9??(c;7PPXBa&Wg3zVWc*d#(CTC|ZTb21Cbq3ksQ+1Hqpy!`21Ve_am{AG{xDr;>n z($gYEX0vNZcbyA?`|@_Ps>7=@|CTV?vad~AD@}~fDUr9;EtS^VZ$7Ox9l%>6lc2wd zwARc{Oj@f+Yh8o1R?W~&?aJs;QE^OZWHrQjPAl)1{1$a?h1m>ji3_YRu5Dq^8c&fm z38-yIKqbk-%gR6f6=D$I`FPNED{-DWIawO0NG(o4P03<1C)wC;b`|e_ZJCoAM!!N1 zWxq-eW$I=fe{IcjCb}}Tg=F7{}rbBeEN36=>|6=kut7XjU`g54ERQ5 zQ?6;L?>P5cJx~5;F2CHT$^&yHw1*U`UmqM8oG{(c0uUo~qO}JkmaAExHl%VuaT%#T z6d~2kJvM7$qii^0x&k}B(gTviL|D(z#5e(W1-AF9gL4fNhl~hVhk4+H`yR=rmpvC; z;8Jpz(6%fmKUs{Ai%%as01$so=_@%Qs3*NSdKbIB0!m3MUt%>%NmCAf(~`UsB&aG$ z-Yi2_Imz3UgBOn%#T}eDz2(P)rW|}DYyhwpJCjlHHX~x8AJWB3C;cB&>d#>#8AAOVe)U6za@ zNia+dgFPA%|HmGm14Ko>dQKU*S)I}1@-gj7UQ=8aq*B?wZ$Bxf!;oQC?Llvn>7-#a zngdbNd4T9n)z!H~L3SbWw%&T|+yd*!zVLGF>K=l;8hhg1tV|vDn3Xk!*NgnFl`OnY zs|mYzqJj?Zyg3Os`K#hGodw1erg^lMjzBD=s4=5kK_8I&HrhZYP@L?nW4(%$uU!Uh zG5iPxDzI8!XH;%+*{R?Uj*Td23vucYh1b2?V`(kqIjj)6E$c7ZHx3gU$ z;?(nJyF7TZMKXTdeGGOV;jm)te1+hZT}JP^tIn3O03lg4>#h!$$pXdt-I?4IptWhi z>e_CqSRfVfdI{#I1gp&=_$ag(ZWbX>tLCo`^UVUp(PF__fIMXwaTXv}Np_q?XmA69a&bQ zc_~Ka7QW3_hO5;#`ub;&5kQ^Ii5X)5h2)rJb>M6?8e-7Ie2SbO{>&LcoZ%x&kgN{{ zN@!ZU)FBqKQ zzp`NH??3LdYiLRvo72|C`495D!>J+O`{Vxf=gK7fJeY~cT?YHl+3aq@n3Q9Q);zFO zr&2C)exZLpsd0{>cb1_B2*lZy}XqU82@1S-4WF z>45GziT-S=%qOjRK(c5gPW!NA5y*h%!O4=K0o_BC1@62n9jGi&PF7EDmw@o!W-XPn z?8(IvMASdUs3_#J&=#GOjV0NKlBXPt#1FMkJQgXO-s#5zC!6j`$O1*vJ{4J@Y-LYK z7ARtc(~?EbjEaX6x+bua8LS|1#Ua%l)+#3|)pWF!q~%XnDxR~6D-q1AAJaMTy zL+f^R+H#Upgfl2rA}E6|Xp`?R6=EnZv7nDG=#*N}EVrOva$$uEdE_1vwc{*DuYzEB zuBK8-P_>+(UP(cPXNp%(EQ!fqOzvUJ&+s$Mbo=!wgof2J05lY(eDQ#VANs9CK0~qn zs{#LSMOs9mnl33dLNI+`@}^^_p%ZeIX{s}UiZ$n@?T(c$y!z~t8C-lNZZ$`5!TL2n zea)G@Waui+^EErO59h1ysr{by(w*32i*BREGy6h+g5DDQ7(dYmVcER4kQvc>umkJH zaVC~a3;+lVPO3*Z4MUcyy_SXoG*^U3PK2BY#O z%B8aCe6#3$+q2|G)t-P?kL=BCCrFGF^!pBAt-!IINr2SHXuqO%;k3+lCxK;KF_RnX zkg}ruHXN=`L0@0JS!t6rkuuZNMV2reG+)9nT{@#gNuR+YN*HE#VoDgA5{7F~!mvzr znPioRv)m$vvj=--*{nz%(!4%d02xH(@Zw1s3`qG3>l80n2ms0rRyhoJAA1(ol?Xe4 zodvInNF}%a&AN2Jz|mz6+MIz%_knfi!_Gv$HR@8CaIcalSC>@;9FJk`rI&MwDK=zE zE4HDuBJy=DueM@rF3D;y5|xtt5YD&umRC&4+}pD#3w=&q7nsL4Fp$3GL!b-@aR}p zYKx8MD?1wW);uCu%Nq}i;>pAn#7WdnOWJkOo4Fa= zlh1&}$^1A#2eSBiIT0T(*p@C_kh2sCe|(qJg5(7kuUG*{S-r@Otx`FttxBctx?Z7F z<)BKb%GAv|e)*b}sysBMDr+rONl5wrbMD@LW`5yDl%{xdCif;b02}_}zuL^?=)+0Ijw}Sa@eS#R->CT`;$zs3|X)TOyFu z@goCl$_o~vin4B%KE*7;u*_%k)jijzqUT>(B|Y=1zPE``W3_8~7R?Ji z3spQd;_cNuJM_)zBIk(SZX&zzZDI&lrS@&w%C6jGX)Z}R4**!nD!A~r#RvKINr9n8 zb+8n+s!JZTLOvQbKtqv-rX~)W&P`JDVl8Qyo!nJLm4T)L5*!5@mhSITKt`z53VX}vECM|kQC&@qv{5x zk*PVt83d_N+R=bBu@TM9)_RMmg6Q z^F}+ERMZ(#gc>*5y2V&ZY1tSRN}&G1L6x0vy>CYejDfA}2orD}N-qoR>=2VKlzA2n zDPZF}ygh!>25A zTGtkf%6915jYVme(bBB&QMfoNm&mHSW6WB>BzSF1s;2(c0$gfF!cXo6i%U5ZatkNt~Ric)VQiz#m2`c>{CnYKL%S)9gDb;xGBE=F> zP1)|Xg!CmfRj!JQsw)C7QEBC&vd^)Wl~W|l{@?)<^o{IQR-lB6cG>hs0wcA`q-(|k z398zzIG{!|1H!Xy{`ke}tx*Ae0qcB;%Dhc2_F5Hqn-W5ItI?z^CF1Jqb$oQH`!*zk zRu$idWGGXuw;@qVR^@FS4CG@qHkU7M&|`>IpnP$jQiZ6?Z5Ulda=Ub5WdCO8L#b5|wK z3@IW(UOBHTs5`<}58l@yy?JN{LtEv5UUke{a-63aK%jP{r&1A5s}^4KRq)ELr|Mw= zYMeSXhXRxg0w9O{?!*lqAaKVzcV=+lAN&Au0b$S`Ra*!MC_4Pl9la6<{#9!i$*90g zjj%S>2&;t&Rk1{vsSsB0EK7c6Duk7(5O&yng|IY>d5Llghl{8Xmf4A^5N0ZbtwDvb zBFb33YG9=Df>6tg7y0VaI$>Zp5dI3R{}J83U_PCC{*1(c+IM%bm}5;aAuZGbbLHH+ zchDp$7KZfh@kHgY!ys1pYe!OPOd@`G^Pa^cqXSm)D?qY%p)NA<5(85Q3>0I->wx7K z$GD<8ol^!3wlY(27M&%P150uEnsQ*K9GEEww#af|hqaXh%Ui@Nl>R!bQu-@(vyQ{P zW~IN5OzE$BOMf}D`80ADg3T!X71yE~N`Gk=dXkTRtyQqXt;BX%z-b3lzHS_gMBK;< zX(aYVNyjEpD@i&O3YEPIN2`UUzdk!p#D%U;1sZtn(9zd^JRidfut8$vTm6uiC@Lvt zMr74~)Nm=2$BryPfy44I*2THC{oDJC^Bw-kFm&B&I!&iD!t5{1B~KMY8oA9^2PPN2|7_kGw$x(Z%(im z_B9DU)ly(`M1;0z2V~t%EKAn*=m}m8;DY1v6U;DL&kGRB0RD~3HMv|6SAT91XYzIE zTsAn4Tq9^_emz4-M<9})7$9ddntI^8G%$Q6t8Px5ua}6(!|@cXqfuO4r`J!RVX9{3I&RguCkaSs!@}iVUrDVnbZNyDn>el3dyucyiVyOwv*yF&wNUjJP%QkV=MOQ)dide(n-{}? zykhvzZ20KHAQ>>eHg<5_ytx_%u7#I zt#5EQv?otP@`i@)WEggU8S3o$m3_^;LKj-aF3826uflhsLi43w_kvs=dnMH4n~A!S zcrkmVnkAf~l6?$$P0zjY81p&K#Qi>R5aRe!KlfVhYDRU*RL5+eca50V8rn@0aT9U7n1CVM~ zc^cx*#d?4Fdp&aS)|9)CdoDx>_ip>6|8Zh@KK-u+r|Yw)?b@BBovy{&PZM(0(m~fk z6SshFwzhUi7du_@pRJh>m$Gha?+#ntQGB~n7o*XaoZ-~e{t`0!Y3P+__Lg|_EPk#D za{_(wzLBN89^J}#u5v0SI3WvCv6$P_;7gD7)3}NydRwT9@xGf-vDkA_6|2c-2^oOyX8=l$gcVGNvLtaVonM347Ik0ZTz z>kIrB0Y3)233s6TE5C`nqU|jW?2x=aHc`+{JgDK;ZmXo*B_aPEvj6&o!Cr7087 zm2S--@zk=`2*gI{*QXX1Dga~UDn$=1s3?F=$&UqyLtlWp38)~_BC)CTY-y!(8f93p zGQ@U0EmQ~@=-C!iA>f~F5h;aKZw@@#bWy5Uxa!hs?10EvBkDOLO{N5L`Qqd056$FJ zDAwjo9dJ-s08OvVaBIdRN5?P2-QjP51=FaUQEI%4Ly=A0p>l@@QTWWglV5ho9GXcF z&4NyI#z!w+ze%H{IkBnLEI*qS4y4pl>e5BL)of1w5!CWiQ`PoPdfq@`qN(a;rRHw+ zHVz9o?@P>o-CdLI`}ULKrimbh8vCU(JF}8|vziV*tN5+zE_E$Oq010e_i%I>GHM@} zRw^-FR!YqS)MX5$=8@_$L@Wi!lr~I>-u3z{bL?7eNcD!b)Y;p@1uSzkTZ5457k^*K zoLmuwH|o@Kbt-lAyHu5`bQrvFb5-Vec;P~pKQLansFjb9mnd<`L*;ccH>Hl8%N{&y z3#xMny)b82{aAWoBI&Q{3lK`@=z3v7=^th)YS0tTbh|# z^mmJHoMWP>Ys}ZGQPs@N zsZqWqwg6a-8B;Gu-MpB3Iqh*MOud{Mb2qIs-xsZE22ltz%s}&=aJ1@y&+tD~H}pLQhq0{M3B%_F{sw;aFz) z0ghPt3AY;55YBtJ{e$hh_RUyy!E#se{qTsA zcD^4$x~0FLcxrBSJE?JipFN}0Rv*MVj4jkWLAoVro^0`1p4P?e#0qNN zi*GX@R zJ3v_Wy+6hfw5^BPY#RKqzrRI-Na0^UZ0-DcpyZx(rts)I{tt#?`<~E4`rBh?azA_6 zt|SBerw9KB2XC9j{ozKda+??^3;%H;VylMsP{{t^+0GK@6O(Z@Clfrxd>SR$T{*YD z1N%Mg*>rUa_D^9hDZ8Blkq|dnOuFHVZ-f9+RmPZ{uRw`Zi?3-+dve3vcgb92(W|1u zim{NN*ElK1i2p4j)!2-ijzqeCe@tOmQPJs-IcSLf6{@+u*`3qKTn zPRx61LYSG*#7ubiUVSD!IQFQ3z%~6cX_((GqgC(NQ&c;08N z5)ly0PMv>Zq!LCv+McLuDSZy6H*==@>IF4wRxGm&s4fF)j)$Hfs_ZDKQ~tlSU7Udn zW-C`(0LgQ5+{8G930o2YO2#4FB!@6LA&f)V#7r;_p>YUT!6BS7-PgJ~nAx*A;R9e* zf&zwh8@F=P-O7A-tL<*(;(_7Z1B#W!h+jS3`0i*3sKo?=R$v`%7f75IZ$)5Y(M;I? zn)?ogL>~bfilM;so8Z=Wr(|T3rbqmdc|7}I!O0@^oA1r1sXJo7a*MUK5675aTtu?= zU%R)y7kGEGy-Np{xP9DLk_>)HQ}Fv6{&UpU19>CS3y~q%;#!w<)A|Sf!`*`({BQGs zYz3ug@ph!VsUWSGNw_wXaO1a3Wvc^+UikAdScO@P0*pc9I^I2E#IK#14Gz5>^JV}1 z>thF;(~q4WJ_7PSntE_9|FP5kNWp*dH7JZXpW!06y_N0SkSG`oejpq>KWN;9F%0CU zkDc$Il{8ShA|04!S!>Z1xOHYF zTC0_azEZOet?)X8uh6VQ8@(yY*($8b3iKNs7O~|ABFxP`Xq{G{eI(M-cpHtmhJRV3e+I1lOX9t_N({Ar;(DjCT78g(^vr*J&jOp=JDxC3859(b|47&FNT}PyZq0*g zg`4y{(hIE(eTZ5Eb^}<0U;*Oo#`afb8v2l+u8^#AjI6?awEZXePV-F%^kDnfc@X+j zDNsh{Zk6ohYJPX;e#0L2*q1l+VDBp|SKilPZ{o~MtibxgVyYXhwucKWKJGZ5%V9MG zj}r_Vts@uWqAiJ8NGKe<6n#t6KebTJmQk5YUQlQQN_0spIu$*-snu1!R+m@;uE|ne zVuuT@)TKm7t27F$!AILHqbjZ;+v`e~S_`ACr(~%WTPyXJtRfeIOu=de={2BBMZ#fq z@435fgR5Sw-3)t;!!9q3zRV$R-kV(v=W_-~`0M40P;B1#OJ~?D7D1a}Q>jUHeocku z;J?ofd&{HO3`K0`&ay1Krsh0a2Dzr1h-=ENdE*;uO+&3on3T*sFvOY#w#g7{wvSko z|6q7EH-TPxNxYh5ZCHO=%?)1y4XNg;n1O~#HO)LQl$r&qV_dB$t**wzYG}) z&6Qt-429;#*A>X#C9KKvlVtEPOV7G2J%&GXjbWNBr*TcJk^)DIF;r{7g;{u>VW==y z-Bd{(j5RS+a$ZYgnT%zUX^S~&T`;R7* zqWLWO>os(i@_$U}%cc8Qs#~SDAKEX4{~?<@VKt+Ehp}w3*3ntUgwrFmRAUu`KP>V# zE#8rJajrsLSQ3hv_i5X7N)WCIosy9RE=`|e zlY4dbsjXDUkz`G1((-AH6EnGm3ba%f*$VIGp8z2!mBjTMjy-8WCfEbwG-=Nuv3c7bf!GNB zsvNteZ5k3iYJeeNtXw76ru=Ye!CuU}X^S}Y1*n^V3L-7?7%n|qTB)2y85XPzv28#L z6(Y60ZIP+q8>SYCBqy40p@6Dn?JX2tMtI&LF{L15E9DdL=k;A}DL2n+dpbo~OB&dk z#Byf#{gRzzciCRLj)&2Z2&~m*iV!>nu<)PL?D@8>`P#du1z4?6CLJVYadMr_S|k%z zJb3Mm+&i~rFEK7y%ig3Y+(KSwT?=BPn0gNW+;kB=S*^7qc&bg1qgQznsafH*(%zUXXf26L^&E zJUX|X?@2bd!X_k{8_)`DAU?A+i^3MdYncS$IYh?2TVHN`I0)ip7KIx~S;bCs7AQQD zijJaCkl~{n1Q@m!JypXNNpn``TF&CBtZ>?=HjTwoJ{q>FWN-41`xKA*v^-@k4_VWl zUch-{VnXQdC2Zff6-hig1gX^6MU>gEl-#k@0I60Ix`N=Z4 zI_LVs+cz)T>s8038@An_Ry&Q*vrL6S#;Wjt&E1;4!wT#jN(XILTSL`X{2IbImm#Wd zVCOPq)DHD59q?I2O3mQUWelWdIOsA&EOo@WG<-liWOU(s5Z$=Jg$r0FthA;3qAGK8 zMHJqsQ_I!KV5|mXjWE8k?du#3Y$!&ydN^cj%uT5v&a$DL+JfqYbuP@=RS)!Bm`M7o z`T~T~2?kx5Q2ODaOLf;u?xq%OQA>xAE=y9qD8z+JSw75k$)dLY{g)3#twGccILb?- zytUx3)sWGOm}Mm}u@cNz5rC@*XVkELt-&SLbQZPTI86sj)AcFkl&IZfPQNq9vf$jd zUFY7#!kQp)6C}R8AaVHba-zg9Chp9&$L_x%Duj~<*LNvFX_z?Vq4bP& zid}ay2H9!p$464RaCA0xgZ(%cgz{j%Q$9cMU|C#jp9-RoC&NuVEwDJkOko#a7d?b1 z%}&wOL`!~^_#!zGQ%@f~Z}@KC!q}40vd0&bfYeGC!HGy6KtF9b8?w`Htz%E!543D2 zwoNN{_V9mG-}&M?UnRG2@(`}7QoI9HXiHE-p1&K)xz**0{%&kP-FV*TT~JOu|3(M|=TCPmv&1Jaq#`A1`nyADBX5wdD!);`0NCMV2;$AYU80o@8OJirs z9TUj90=>dC_6*5*en4C-@~wtM!FR~pU20!fYKRDy*EvTg9?}Z)gkG$JpKVUNwly`pbPJ&@5)R5cx{rfrC zkNr*wYbO5rDJE(sG)Ad0g=d_Nqv6~og}#K^>d9yBjGS-<#JkR{(BN2n6}I@Kv1SkU z%z`<5=icL5W<^_#fL0JA+yb;>GG51fweCFMqVJcI-UNHr^@9^Ne2@3ipWr{#=_75W zd${wxM@xiw$#t>A8Y_Z`yB3WI5M{kMhp+J_xE}5vk3m!tag0;~cVinGn0eN^4QFWJqoGW<4tMwWtapx2sDW?{K_>bv*6-fEduyG6 z;*-ZXdv{?8uUOX9Ak`FXX5IUV<$Exx@o(@PkN|?%B8!0avUU#l*lQ$in#D`+p)A(O znU1|DXGCPmf3l-J)R0?Tjil>at|sp=;s0H!xH_(R;4;;dI&xEatFVF7tsc zFSEID8fVO1L6}I*&qj~#1atwM&Jt2Y?eMKt#$*@zhTRJqs7g;Co9B65AI7>CXXM+j zu;OZWOz(XY&gQ(n!KnQG?*wXy))hCf0DpjOAF&{J^YQrU?|<)FPu|>`0A7Hi+Ud8+_XjOMp_k|i%p3&^mW zayRR2_V{f~y|`+HGo`M*dF(ds0`zuW3}O(ZuYyTLn5ocS*8V;DdjH|wSQw)mfFbri z#~p!)|L<(<+SpL%pWe+7MGc1I^yT4ZId$3IZSW?` z^(pTr@x#%9OsJ!tOsb=P_w|)^^`F1v(r?A3J38#X_3c~eIsM!5LHE@=aHzp^ao!?h zoutR(fvm^lBiXkn;lReeJ?y>%C-WZAXQ_lIr`;FeLD{ft5bce5PSpG3mAD)U|{p_?$Mi{J?dzT#8gC6}+lpI`ce2X|d(N}}+`^m_&u%Nkz zyK1ob^o>6|NM1bX9e1Cfzq8)q{^|+8IfO~lJ-Y`j6&}UfW}hjc%3b*bo1Vei+1l5Z^$L3|OM6 zBm54P7F+`BYGO}=2M@Ln?8ENc$@odUwwJy(-C#d`QA`fF z+bfHxf@DMnM1utLdxh53gO|;J?PdNN`6khFE<0Q}g~Nr;GTfJb^X^OL^Xhvzzr$J9 z1g86okxRE+5=STDj%3`T>yQDvfJyv@hm>B7j!@DjL^HGSlRmtOk_U*VcA9K=s+~@;~e&m zPy9`wqa#@G@Y_Mct_S?5PQGs@yDIJUX1u-S?jZ&%ISDhj8W}S%ds7hC^TxIX={cOc zuThy;@mWJW|D@Xw(?UL7(D|Rt#97kszIk~W{W<6Y!as%Gx_HfD_XWm}(1k4g_6Sy> zDDWZr{-g_g?8mVCf+>{R+bGx#(R3!x`<6PV4p(YUg@RCIRAE-h?F+gUBIyu_ck-P~MOPw7FqGnrojOfz2N+i+~s% z{q!0{Ces49dE{IP*J1=(&;|^;f7t#6)E}4GiwVvwfRykW*pWJu5&5Mz=sy4T+IsXx zMT>0MYr#yAj^lDC!tqK?1U$#1Wh4|PLELqbo5NURC;~*HLGi(1XS+h#kaoG|bss=c$iE2W z#euhL8-Sjdc)b3Q-_C0QcVKOUso0%B+z|N}w$zIOd?-|f)&OU%sUZf*Uq{G$rRFl= zW&NfAr;UTricN5bi8lk|&Ve-Y3h`|H6)2Ox`@#C~+Io3W_E|-&o3C5tM{dwN?1DHX zI%(oDPpumU{6yLbmI7n2$KeOO_b7d@wauP#N41qfPi)1fBFk=m1jJ(g$o_*j_9Zv! z_kY;OGm^kXuhh3Ef%i!4pAARDU(oa0{&F?NFa`An4+|R9mGBtg?|CqVI57{fAa?>0 za~LoLCXtPK;Qq@|ZY+L$bouVB@}1A%_+=j8UK|b(tPykXRbCaGPGK(l9OGEZ>DtM0 z_X6NEIAU_g#2-hWK&k7K_>H#@_5`qTIP|)Oc;|cN{!h_a3in0Uc5JHQ?2e+TV2pQE zL_6(C2eg*9!AiuBORE@(XK-jTjl6(p%3%nxg+aTaCQ^$OD2W(qVi+XLHe3G&8_2Mf zSLU0Ryrx6gVbUufSuL{>cyKhtm$ZR!#=tlI8C(r$?dKRh^$8oHv%F?vEK)*oo`D5J$v;vGkg z{RV3coZP`?#2abt0n;L$M6LerKDsC%O$sjA-f8@8Tsn^sNmJr+d$4i1CUl$;hrn~P z!j_b*2b1sl*qe{6-(bD}3K7y_vH`1hS5*@spe4~mO;e`_TZnkW#46P<|3KDFT@L~J z%UyeiPBC&P}Y+IAOM-W$qCyA75wzQc(>i5NF>d}BBh}P*o z2kV6S1h8qigyj^bolfI18IPpRRbBs&PM}$`#r@(2h9nk5r_qdOH)x5L^Fp4OG$dx?+KyGKhEA*XK-FK#uEpa5jCso$w1Oa zJ#+a4tq&t-u->u5gSx~%mbG1z+^8&ko9KJr>hdB^(JG|(bfsQsa_XG+rEOQW^ryHU zHDQBKQ8%>L4RLau5@UheBpO;>*GmG)x^K>3zpJ^~XMKjcTs3{NU^`ziedIDvUYeBJi&*)w_L6*XmWfHwRJK0CW_=OOf0ReE7q27uD!_fYu} z(58!Ee-qk10OUp1OD)!P0GJ8HVY@z!8ntg~7ydNSem!DiTv_)wX98YU-PpkZ(~r8y zoM^!urDJ_I8kNvLOgrkrt(ce+Z?F8G1J0mR(p6PsOd86}U#op|(cOFj$Fff}_BaH@ z)W`Rz zfEYnUnZR{~ZLjy)sf2t$d;Ks|7+)K{K5o5;H3R7{zXrAnz6i|umjt(_Cs`g07 z-FU8OW1ZpIQm^|OPSf1omkjdNy3=E#loJByJzFE_Z6o5*$hH;r_2uK_NH?NC4azL zquB6lFtm>laRBm-=adz!l$(PmgBk5ruvd6Qn9*vP!F1m$9zKCd9B_8wjE`wS6tNb#Op{Z4FIUvILpo9_gL(SD)!RH{RCrG_!J7A^5Ymo&ODdvl8tymi&%h-z7RIs)v zmS|jUV!Fb@5i{R|gDz@qBlFfSJ8R7B%9z=+vF$%D(&Y8}gJ=oVK_JVh zqM^HG*B2SP)ODH$4}29=dMlJKS-A!eh2Rnl{Rn8zuW0Q43%o9*{bUK!$qO*fnYBdB zQ?%T(-d^&SxwRtB)Y`aW!dq7{6SB*@nPb)szX^?r)J_!Il;>j?7cpv4c%xJVY9P2x zf!V#s6%I>Bb>kQFJ}*XzA9%N^A85}PD`HOSWxW5Y!~!(fJ-`xtr8l-rd&qY77GOGv z8c{bv{MKQ>ZY{P(*|%sKCUVZfof>g-fCh;-P8~BJU!d>c?gJ^veb^BOxIZLm7IYW{ zlf<2-fVyfB`0zw~A&0R+H{pWOGumhvu{coJ#u^za{(RiSEHqWJ8!*g=y^0I=Cb~Fa z?*SdhInIWZ-pe+YY$w?3p4(5UYseq5on!9hd@4u#QNA5zSX)jn;O;XYOnwo!T%q~R zx=c`3zL5K7Enaz9-uw|uROuC#1*~(M zvo7%BE$~tSrp0!$>f#8sSw5*)ZV4qD7LEpFm>;i@It#F>?Nuo zbHl(%*u8i0OJpb!VSe$;0b-Cwu=4 zyvhF-Wr&PcMgb$aYVk5Ri6TvjTGa6xot>~%$!}ayB-NeLg{4%cz>t2C)cdfF)QmgY zJvfQ2#*2`yN~Wd-~?IC&IKgDx4{v8!{wN+75{5 z+(RI3Y;dBgb+ldSop-FtTjGStoZ~dn;YEC|Mjn@p9qNk zae}vQau-t{zEV$r@!JUiqcPU!~-uVWwh zU44ER#Hi2@1ODNVUvtQ>IpjYbMIZX~1H_im4<}(e7=;~uJZ4Q`geU(9VPi19_;~C^ zW1;Dv#?IZ$BaCp{DMj94uN{=(Z+P9FIJiGqfAi52?!i7a8h+vZ!}tp?K=|P&82`@p zzyBzF_4A+qKYsb??>qP(>6;NcAwmuxJ+gcHiO%4z1up5m3l@6#fGMj#kwXyjV8Wer z_QW)Uenn;CnxP;AvR%xBSWEOP?UuqxO+t)+0{kX$w&}pf6>wYBt?0c*A2F@^@ zyUU)qo7G-QpW}K64bZ1z4MYzcO0D|5d739RQacIdON>*ff8qDSn8GG#hT$x+_rt%` zenZT0h&9H(EAzHlnB&EHtU>Vy+N#!^fZNjzmTd`V6w^d&n;C)l+!s`levn@j>So?W z%rpsBD)YjyJ^DeSlqkCTL+2@Fa&eOABONDE6Y(2iEJ;j1Ifwlz^gOKp^^>*587#N( zVsP(BR4s1JY3d<{pNY1#8?$*`VPq0^uN$g<WW0NfHaD?l; zY{BnFkDC~2*l6c@h3~{&L`QmQRED!J`#Gz6HU1;*`}ug@Bm|Jqo<~_4MH?i3OuC7sUn8U?%txigk9LJV}%-H;48z+D;bC+VU7f64aJX=TJ$>c*v)5D6p)obE>DpO3UeclXIH1M(e7m z$sJWJl1m1Fk2_9@MZVRLD4-mRHH-AfbsG?T*26Dfumwb`GH!-BtY-yU=pPlWj3Ew?BfF%x=t*xmK|HAbPU=l#5t_aGp&DzMk zo!m;rrMGJg676ma;N-mnTmhx!%~$&&O0E?3AKzqPxeEAk6_~pG@l56+h7=O6K7Vu} zV14MxCq2E_O9JZes4%;{3u=R$+#>2EXA|f`@E_Sh~R4s~#?Z=_U zq?GbWXCh)l7!-4j7aRy1pH0QFuu*DGn`2;AB00gx)3nFY(8h-!y77=s$?vg1C&};X zVOdlxSr-(389Y1UVU;Ytb8!5O$8NHixxq2N=7fi1_V~pEe$5Gs$sC-V@K~n-znK4Y z$U`_!`CUEU@__$z$Xh;vh^oB!rBFdqVVu$dmB(|^-$$@}amVp!$Jj4Cq%-!VUQj2! zm1IMvyTPyHec(4`IzR_T(gA)Q?*PB46qXuwA^yNS5x*xw{^nqV#_K}DN7J3nX3HuSh)a$9VdHVMsB|qu)9q^b!u|xhP z?}h)Z*))m!9ZsCD@y5fi!{)bkMl5nUex6HU-)+~YGrqa}bxVefM>>NgQI8t-9+gGS?fj!JQ({WMnDZ!&JQa3{{1 zGI66OZq&q$qJ1G*@;vZM3clly8TS=J_L9R5Bsh7r1&nEcv48r2KJOGFPtrvcCHy@8vP4h2#)BJDEkSm<}gLsq``6>*oB7c== z^f=w!Z{X2XyHHjJ^wq!zIk{6 zD=3NZBIR|%PZ;4#KVkGQy^ei%a7g(P;S*u_B%hAMPh@(td!tWL9}sc8BZ}wV-EG6; z;Ir_VxC5b+!rToXsWa#BN;mv@C-cz;#|OQf&SDxwdQ9k`wA=Vy*~5wz(&-~(IrD5O zsFfhybBiMFmtB|HVSjKy=_ujTVV`$R-e_*u$5GeEd0ijpJS(V1q$J0zYswFduYAB> zKD_%=CgLgOCB{!&h5Dz@nAq@%5WphCW{-dOjMBv7r)TVr0rbW{@m2RkV-bgKU{)xoclTYl4NGWY53-4nPPLu%%&p%OqToRri zYDgqOG%n9rAMh#c13KZK_$$UzPP)R0`o7q><4&MsMYUJoO)< zJsEHmm(W5IDJ$jfKJ$h)ON9&CqTjCG}111 zv8Yrn3KTtzBYjCJ<&(|?iiRj8S8eOVua}FC2aQjwP2%QUc$IZ5O3g_xA)ctu*e-d9 zl@-NUk&nkDDu;dK#ns^>W6Q*kjAaue?D(}12p4@kj6Q~S+A*ds{K!c?c?=c#*y9YJ z@Ge7|MG@!& z8VyB1hV35Hh$r$fYT;OD;aT_*eh)uJkQ41^#jnc$M-$sqGm^AV+YL~^uk&ls(&{p)3KPHdABOjwK zAYhJvq~V#YfINv2WFMK*@{m*ZkxfV*V@N)R?eb7m@-YvQ^??QJ(T_ALl6~ajus~V%QTUdR1B=HcAITG! zW8aMj<;zHSO;ElG$~QszCMe$o<(r^<6O_LKLHRV{NazN>AU%*D;#on$RpN0FUL8x0 zl8PkW!5hTB)|S;;POVS&#ECL^@HIa-vvSVXVrOZ}74`%+7yp(Y%SkC)(sVP1)H)88 z7*gvJM|uK!criL`B26OR!wRQK#KF2s84-u+)4szdGa?GHY}S;?h%gxuCL>~{Ga?F2 zOAQ$j1xF_BPkfLK(#j=1=s!fsm13n5A99XETa)-uIDcx)Z^%AkG)If(Xwe)knxjQ? zv}leN&C#Oa`!alAhVP4=br`-c!}n$QzSf%W%N#A5qs1~uize-F@Fv!U-Nh#I(b(sswrXn4lP-yY)|2rT}0VBz0ul>}IlX^%|VlJFR`?s^e zx+Cgu*)vpb_e3>XsFP=X_H@Q)~Bi&D)(#3t9v{J(3h%eCh^j*?@mNTD0TGI1{|Ql(^d}*Eg~UnH zZ`mg0oR-;x-^8fNc(5q^C<(31&boZ*JMiDhEg8Od*MnEtm%f8my;1IU0qYts`rZ2~ zzh*v#c|vF;&Kb7^ZL{~P==vAMssP~!_xIo~k~QA*vE|=<2VR+f{b0+-f!%Wb0KGhT zV{HCFDhR1RNL2U>yayCT+8&Om>pLUV18{>UpjaNUmXe4uRjd*D@1JB}$8C5ina^OgTe#TiFF#3b3(iDhfxskPIWveoxX&=2X!q~$ zednHNEDtOqix5l<$}1!hQ8s{`+j%ha9@%ux?2efU?1q1oj$?;Ucrxbvv;0!DZN&8B zf902axbb;qO?D--W*OJVjT2e4?)6U%2P*9<(yjH|}(UDd~n9oThLX<-wQj~A9=Tc<}r76I33TyoeYMdP{V*l z%NW0-sU{d|0wYb+53hZYZ@#N#LB@_rK*~GHpf6>ffz@HmfBRV;( zJKuZELjkSp2e|qX-whyKBmCO2<`e2Ly8nU}eCN^oVvjBF&f>Y$7U=lYn;=}L1|td* z(v^_S-GzgQguy2YI!V_7jmm$j70+xr8VR8k>A`1V6>uefS~PCiJ6D1&GcFTROChn| z9vl49;Fku!H27uGVi^3gcKkBwbArFsIDXl$h+j%%u8d#m`Jc_;mx}&BUp)oWscL%4$;$qg97xjo;r;Ny-cH*Jc42Peu_ZB zhQpXiJ*`f=JDboO-%VSkfwn&O-QCNolHn(I20x%(}ZLu7MohrO~Y2z(@w)% z+5%}N{ZDy0$$BBpK}ASYB6DR(Q_mM|2GUgA3$SJlq-h{c18J@Sq^W9pYJ@cN_HHGx z&8#N~n;7V0o4Re*U}e_@+dM45Hce61nj$m(+XwfHGXyBc3*4FKKbg=>nf@)eZ0lk% z&BIJ%ez-Z9Cj5_14L}(A)M#I9CKEB5y~_&Dq$Md+Nah;EWI(f!*Vqhi~P%`nDCLYtoW14u(q@ghJn6-nKNk_Awa8@ngjGLH z6@ZpUCLpsZ(9%R?<|!gmb5Z}+7QH;mwC2gjUt{z#4PCZ0Bs0A-E;}Z(|Lk<*Vls0u z%!NUih7r>+Vv7G5MoeMC7)DIls2E1fHiTa$olS7G8b>gXDk7K?nJXihdX8r^2&SUr z&zdy|ra>?bg1H6=rmE?w6Tz%G{xa(k!X}RNp-kO2YcR9x0%aZ-K$*t|%B%;BPl4J#^x7 z40Smbb`E=S)bhn-H1*ucEEa=FUSNMMqcHjN(%<-BCJfV*^)Y3AOb)rpAx|tbCWpLW zzXNVo;~?g7MG#XWb7c@y&+Tjm#8h2j zV|@Tqx6K+%?79G$Cj|iJi2*R{1~BPC0EA+)8fx@K7$j4ojZD`?C0tu1^CZ)*Cm(-P zihk4ZO9;uNgKl|boPwfo%&YYEx8wQ9Ay60ub^`3@d+-vv)~)Z17~<)}aQh?t4u!uX zcqzq2r*;s)!;chG&7;MW&htnd7CpE$;FFdXH^8R>K4ThX>X{RpXzH2EVh2qT-rB{EkAKJ~oRW`Iw{T>@Xwe~pYym%Xyse`STkAAWWp|uFY|=)Wv)Vm<)U)HO?7d{zkUGY_F!_sWB-_3aAD$@ zTyT>M-qu|3q~`}-PvdCfX+<k14mPb!!VBKFhS;$;aOS z_^`#5cUaFYD7jf0iXDuR^~nJa^pdOl|}V5OqZ&zd!0r2#7q zSh)sZrK;(v3Rc!$c_&Nou!(2-h^20uH5k`*K`eU*1(0R$z+jdQVV0)!POc_0MUN@q z+QOIQ>E#AJH2~`iV5Z^Ac2?g>FOEwuzH{1(p_!3rX=FMl(5EnA4D@NB&$dFJDK8cMv&O;CUJNHFfqqKGu8e=`I<3thpvoHu*08}q z4F+m3&^5q7)y+>-{dH88-}eQK(p?9nyA|m?NOwv%(nxnBNY|koM7mSDySuw2rKC|p z>OSZ5{oQ-tcMQg15P$4v$69mEIoE!G3(qDOeK>Qd?Pwp~G6j_SRW$0XH^NH!Nab2h z2jn*fiRn>__ogeiwn#WA#!7tekRe9P!>@Y`Yzr4 zlIgsMHEd>hr$iE}17|Oy`sbkcS2@ZIEs6h*T*hs2q`wt~sd8xc>IbqjJd6DC&5$AT z(F93@8sRq}oy3;dt&oibj}cT==h8`;lnm1!6?=#MNb7nFapRq@v;VYByycHBFX zI{lG;?)x)diWGMSW!TtI<$TWHtzxTNnQr8@F9j zu}93iHTy`9@A;dkza1kz2)%=j;CbRWZYxZqIcqD-qBCMmB!~*iU8hKRi3)m&Fo#;O zhzjZ+%23TF)|69VNghMvjk^(MN;hp-v^?wshQvTKV0KY6b1qK>_fLv`k+js=qoZ`@aJuY`QR zJTe{(0XOjva2yllODqUJflJXu#s+?1iP(IBVD`q9XMeC=>4`(~$3TGuRc@HSiT*u44bZJO{Jcbb{@qg?Mdfy znSbmBgzhrI6-6v-OOm*abiWFd*0-MDb;QHH6Gf0yNzA+cCa3U57ooRYd?y@kTU`Qf zmnWtqS?Z^65T%(7pUX8$47r<+s3M9c>hAW_y4OEhc5R#w^KbP6LsgUX!sc6Lnr0sm z4yVT_x(;s73UANopr0S*$4-3?eO+e8>^yIrUwXUYhnj!xhf$dLtRLBb?x(Lk^uGH* z%gpZub1mDZu0$fBA-zOBX`%eaUMMfCtL-mpWnHFc^=h@;W|cA(qLU74Vvkb|8Ty+XR%-`2^%O7y^fZL;6bdud{S zr=EnZeX*yNH`FQKwO%0_qoBaE>tB^O^h{&3A!B0~MiRB^V%A0cPb7#mGA7RN^Hf*g zg5+5}A4%q~^P?f084b(ay>RM@hS zGCo(D3xF^NPJ;J&d#Gr;87Gi z_>AGH)Wpa*o%qtiv*=FQ9&2=;bZo;aV&8}$P*{D)<8P^0`Pg*y#5btd$JkSEMS}v_ zua=-ZVd)6MusgGSpY*Rd~l6Yhe1jh~07 zX?2I1OMly=?2}4gbkHx1d&!MW{^*`pP`UCq&usK<4fRneDa5rGg&g#O#;pPNgH3zR z$&70EmPRPsExMd>H=GeO%VI=DV;CD&@M@d=!JK)8piw>G^xmKo`@8>yKTSE zYG^z2k|S$ZJZlr$9$e1Px>mj;FDF2#h+FPyUOr%Gjh84AC;jEH%3{oUpCpyZ@Ja_U z7Z#)oRK1aOQAv{>12&6nYBT{UO=25JfG}DT7ea?CM;cMs^vI!1_i;L%@{QVn7$UE( zUOA}57V|sMD>_PDC#P< z2KR*{*EHX2UWl{Fs5)n-7u*wI;B&ocJweV(j7`~f8o}awi6^HK7_b|fB#M<}o2>6Q zG4Oc%-s7u>4rifl1o=tW;wSbx3G?s~EPLbdweu1z0p`V`@*vFc&;UmrSklx~n}IF8 zU`!dQ6{nDu84O;GXVmW6XH^?Zn@udkMkfg0_) zH^{#9PLPR}3__eFE5u=j%f%2CoMo2NpA{!9N46yRmu#^pyUujEB%3~XKCHCF0XYy| z`UJ9oS5|_#puYaBQIh>3tBtADRRe`y24BU}x=cE=lBKkMlSwq|j39q1OodTdP}pIi zH80?4Ec&Nz)Q98w@y!QmL^AS|h40x0G3w{G^H+vr+tyE|rjpy$lO(dIm{2B%%MK{W4w6@1_KVgA(cX>P8Fc z_eyw-(%t&(8S?8Inba{{h0g9$sOvq8`1L$NkDUvX_!|+cvJG>BIBvh;#B^(a!}lgq zf07VY;fq$vm^H7bdoZoAo)|d}^KFdg9x1v|aK>s^r{MPqX09yzH&GNUsx);}t~f(sQQXRHls{cYFD{#9Xadb0-m)S+=0A>fhU*X_CF5I8 z7Dwd_Vk98@H+3Mo|LrF{#++j8wRfYqBJ%9WtTJxkCn*UfkwL&=d0KsVMoS;`PO)zq zsO}r1&7og8`_8hKo>?#=CD$1J>OhIJ;31L{n5*Skj)vogKAWWvivr!zqk8ZN>r$dM zF`_dlIKK5Qm?E=|dv}I!dcTJ=_m1u#xgxHk(c=A`GNfA3YQOPC)WJX?jLp#tuisx1 z8_AWy2w`4O<rP`5TG2gZ0Kc47*8CZPBWJfD=x4V)7zgaq;W&Eup|HyWhnZ|{ zw+Kp*2#sF@j0g}R$L>`tDzp$qn$X2e+Tr}55i+R}NyH=a(hT{^%`s`v0*|8yG_W*`wL@23rNJIjiw_Ea%^PutZx5fsrFI!OKJA%$k>B}^n4)H+ zI|Day^^;;&i>4?yeRBB=V|YoO4hnUUdyJ?htd6+K?(hw{6HPW^igO$krnU)s7oQFX zc^6;g>Z~+AOeNFxX;(U4wy)rT*t~=_I2pfPIGCB3i+6y^eb0lHh?tI3);ykb@@geh#AxVFoAB;pt1i*Fc&YzT$-9f}qdU zXXUdwAlUPD?cc)Ya@58JuWx;*HE}sCjDCbmKl4B`{-H3ivqkdR!oLpPhLaZ8g|{9% zs$FkS!+B$ogrCvDAlN!XDwB&cED@&Cdup{}od5ISk7<4d=^{*LrOj+u!stvqenuB1 zQgBJrW7!n{-!>Obuw`|;>@Abi)ccxR~`lFgfLmLU7l8a z_345;Ma<@0BX)l8Om)AUDacxst&-z8|A_C}H^q|WgTsFnOeo+BSJ`j#gY!o5)Z1v? z!gK9B&_0zGHo1MQYT%=bQy92d$25}O8Jp6vuX($A?$^C~9D{PQ(CELnBnaklve!x+ zgL7VypM|OD@>Fh)YJs*&AiGiurAA|uipRBad?1WI0?pFq%aG0#0NFK?qWN!WIs1qo zHOr~CaePq`$yM_b`-m7Qn2aizyN{|nXoUx6le9a>8-1cKnaRl1IDcvtogCSw8iX`=gN zu{HbQg7dXUV7lY9V{z^MC->|Y-TUTVHYrGQHNT-HCvd~W;U2cQ`me$)e5 z5p0jI6Tas1rgaC$hqg!PPY~7XO^AU*Cm-!pXPzJXeej|J1ikE+ANF3nFk4) zLdzr)|JaL|Lze3^F9TN;gu`y#5QHG#ma@p1IVF@>@qjv&qurY^A$TXsV^EkO%adSp z9ZHwdQoDegEX%|9;V&9xj{=QdK8|duhJ4Lv=eQBh#1xe^Hj-u-PL!HvGtjFifw4(rdPKuv7ea(I{%aObLfZs- zI214p8cC8UX_69# z)#9yAVcGQQOC{0%KUDDaKU84%|3?KK|6f$_?*E4h==`9lfQHBQnj!*AGB&c_Vt#Pi zG-xzfME_?{+rOQtKS+m3+q@s*ymSN%r?hair1u(B_E1>US^q-?EkoWZn0){$u%XVO z*E#9z4dnR8LJz&kP28=G4(UE1}SleMa=#!}NTGaWhCtH9|Ame-v4wAGE z!e)zMToXzm@8*0~4Uk;Pf{ABOQyXaC_*_MvQ#@UR3=wMKtOu|05f~(uadc_wB+b9^ zfh1E85O#YzZYl;Jsd#D|wf|ff74UD6kvTZ?vNOMO+VQijMy8%R zg9w6k{D98@YTc;d>8VpkU=~1Oj)7PB6zW`o#o)nEp53`$S8)650j(zOQ{=|A=(6z} zl7Y_Z9x$0ZwlK)WQ)BjPRSIeu_@iQoZ?kcujK1|mxMWL&6KKcury12JZfwFEYARH} zjPR(eHYeygbgDI%T*3LY5Hpr!@n(mnPbwsephpVG?g*?ThTf{W|9G%ZHFBe&5xRa! zWyk^a`IP1}w=6LwRS?iQTXsOdM9-AjX;)j}0Ueac`$V0=KnAI~{4+Mjy03-&36iD# zg{Fr4Vd4q8>f0L;d|v96ejFW1J|gB<$XUi7P^e;ySsl=kW7oQW0(&0hoiNDtOWvV8 z##Y2(X`U%En4dC1MG35U8yT1}U~hKK8)Yj(@W)=(Zc(u9bV(`=Kv^Gvtrgj$X?O1CGm~@9piunQzQDKhj`+`dtyCwI3_$7w4rUO}J&XzWk z(Gf&Zb+k9CR1p6Rndr{82HzI*=qXNt*1I-G0uHe6^5)JNYb6fvfX*Dx4amgoG8z+CXq0FgO-_<6p`HakRz5&8_ekA)bi_ORH_}I#~6a+&Uvd4d^D<0N$HH3YXHBAV?UUiz`MSBu^?@1f(1+re?RJ^2;$lYTZ-q z?G#`~Ikzrdj){S)$*8I~P^*1!ekYzHI_-D3-WX-A&mV}w0uo<6?F6{!@#~m%g+*ezF=9XstOy16Pr>1bkF~$)0UM^L4p~WANSvS3!cqcxO~hbL;H+ z*ZH&9b(@{y^$4P}sJ<+~VoxJ289hKI{4>PS1cUx+<+mzv~?61xB}ERGK&)K$S}qT}kq3TX~G#n8+u0n8j+gTJwh7Hp+M+U%%H^rYF5Vrsww~ z1;l*#Tie+B)lZIh_OlNyW=-7f(dndCoA~#}ka~itK1~`|e7KXgh;FRlMcg3I{n!Sj zcmd%-xm8kFYSd7Y!`My5tqwTPWP)~HPi9g|-hT2%GdEVER$3RC{a6AgnXh;1Spuo2 z%9_UUV*!Wf5C;+FA%M|eIaC#cxwSp^$JHbt+FV=iC>buEJK~avUq;7Zj_34?ZF=6>NqhgNBl{MkK7J zsBL4?9b;FgOZ==P?^Causv0iUzo&!2_Kga_!BgGooj^D&Mxo~G+2rbb3H$|0q!U+D z|AmW!?c_*U7%YhykM*-Vq{-n>1@AbwVQf@m-(0@VhLdxymr)M+rk4~|Kcgi0tj!II zE!=9%nU`_M7h+0UjSGWikrS}iM3Di!r~BdUv83is@R@kx@{b;5C~&r{+6m605nd4! zULm90w{Df0LKZ+1z|)*I6kbsk`0IIjL zaWfz^sc_!(Wdsi~d&RqA7!Ut&C)4}{?-(~P0*@F;GPA{mp}FEM*1>N~`Th3xOEF|q zr%@Sx7)2x;D}`iV=}a#TQYpuQFLYzp6pS7xyOID|vNw>JXCwhu<$F2^0x{AkNoHEX zD*>p(!Z|;$btFsta=9!3?|(z@g>2Gfu1IBCAuuMo_kbwn-C1kjt1g}nh8r~EO=|~C z-p8BwLeR<70$MKUu^NSe$GPIkJn*<=4A&h3LH+7L;<2*8jN_Di9-;YG#fB9h=!7s(K?*Cb||zb(tC3K zBTc&6zeG#&7%gcc8xH8SivN#ta-1c5W3sn8=3UL#g{bBtrfskIl zB;5c?--=VhfgIbAKI;Sd%dIS3ykYjPX$_ki7vn`Idsv>$pl+4o*ua_%&{#$3`svXEPP4s3~9*2VI(N2HwGa-UfZ8xWZ%Tr+TBnR4Di!)RRy^mTGVd zXlMZGMMBc`|FYNes6L+#7Q;6x1IM6qg&X@LHa8>JGWc9bsGd)-M)Pg6BJ9@UsRLcH ztl}?~(*+09FC)y@%Y}+BPN|+8E)&QhbZ=}Z__0oCWPl?{JDhlBA~B-MCw&+M;-_(u z+_!>vfffSs1;>h$V$}3x8pd%@)Y`aIGi(C#A*1o(?xWaZp`aGCkeA@=WBMudtC#bgihFw0GIF6ll^uCtp`X^OZqeUIMimAPBAWKPl z}P22w|eh*;r?_$^|k#S2>&%U;g>is~ozU!$2?eaoj!Q{kZk*OUe2zleEV-4M`07 zz_Q$Qw8*mD1t{d8YnSwl_4E6|KP9|19VYS+kvO0>SwF67;PDQsXy|hG*hLteAUyzz zhJtz82&=tu8kA{i*KnIJry5nI79`UYO@zY8iYBU2!wML=TfGRn80yiBpsVIyxV8YZ zBOT=-L+&sX79GU^P3d^!NlxLoFX*|LU-z{w7H0Ge<#G(qr}>zAJPc9E>~_6CzEPzy zUOS91>1E$=vgO_tip&nhY$0NCiS#v=I$8K3WYfENPSdp8J7c@NJv`vue=@GaeBU<#k;F|QI0?|(46VKXZjbViCeS_iuO5R1veMycMoU_d zAEakw`-+AV%-Qf9wM7%>OqZn-KbwtM#20#y0cA|0BppO{4vwzu!q0|!w9cRvtwZgB z4v-Syk1xlr0k-CotydB7!U}`^6lt$te1vIxj!(*a*kThcbg=109|`ACT7Z|!%WIoh z<)5#jzcXkIhvuGmT#SK-)z|%y4bepAaRCQfJ)J}p*!Qlu?`i*x%T?MPx(=;(rjF38 z*12ZVTNL|R`qkS0yrb_x$szm(J37&SPNJ~8_N~Q(VNR|vX+Vf7%Qw-DlaeJ7T;~1Z zc&R7}fFLDF^ufbnM}-bBz*A&Net@{mA$@sDCD5?J`T_Q3U1Xe_lCGb&@9=)?JB-{cfr{m#)BFogTL>6j2y!7FjDVqKT{gV zk7tnavrTNBs_-?1aUJgx{v%^S*Ee01$m9%>|KXLcZtd}#?0CU&;|kgHNiGGg#G4YK zabh@?uG}VDuj#j%0uVpc#}o4`Bo@^8HV%Ul^k^C-ZLHxNf%wr_TGUpeg{awto@d$) zR}LMgXCsoPN2JPUWYr>T4Tye}qh{~Ggydv>ny$w}HW1}+ITZqRC=Pz?ircnaU=E`8 z*sY_ncXwZb)W#kiz*mpc?~IZ;`x)-;q-9%w2ydi*%BMzohYhcG5G;o)&4c|;z@54X zP*bTtkFL~F%a)OD0cz?ykQz;41FV`&J0)KH+-2%i3F zf=O|GD|@=Zt|)gdgO0$BCrh4(7t#c(4beXdka38>;u`?2*pt3av?O{=ddITiMSxJ) z63^aZjBfq2%J1=PKFzu1I?J+ffupszp6~QYL?#}txkbeN-jiB0{`Jq(a87p4hiR1g zrxL;~;fdlIpLSu@jk|yQ4>#T5W%ODr$-%~PsR(7gx7S5(kb!mj!FTO;md%TxlChhy z(etRO*p$Hf4z!3sU;dkmU1LP~3qf^_U#@TYytkaTMB?j>3XAUN9^iXc!v935sHvHK zGfjj?8h@*GE)BanIX{^SFVhuwNmxcc=zrffy4KNG_p#n3*1~goFP)0 z&^_gpfs)wp-{|Xq{Q7tK*mA4mv$MDc|CSXFk*o2acI+eWD+O@78pidtice^ePp;Hk;k2D;2gpcm?#M{ygFi&rRq7O$XL|5uLpFgP+aR+WN&=CwbL%3o{EdK(?XtsJ9mMx zPwdxU_a8^@?6)7+&WAC!rhAi^0=l&$c75<+{Gp|31y4Y?5yJf=%6$ynOEvY^S;~6J zrmN4Vq4B0(`!(Iw|J4|w&tDs9fg0ng=f%gAekxH90-p(vrhUMr8xL4mT=;&ake3xi zc59VVDN%PhDqX}ORJQL1V^fAzuMw`#ghfSm2_sI4jN{}0Glf~>YJe&>PGb zumES2VJps1-67BUlv44KtVd5qh`Dy(-wMkJnN$~&6IRgnfg6_aVLdf^cn9{lq#MS% z&JvvKwDvpAHS#A z2fB?+$nt=S*KaAqIYew0+y^rZijJlA706QFyZUbA2#ojF!Eo4e~%8}?e1$EX(KOG8K7V6IlK2R>uzXIWx@slq-fjbW9m5KCx`_GG&PHgj@48m;XKC1$!NsB1UwOAR?p75kuQ(6X zo2V(D;i|VQJkTz0F^tcij6RVH0&=6RoR2j-Ydy`98-P@Q!mBD-51PI>GFTG7+YSrc z_>m7zcXdr|w**J|psOW~%6Jd49=xWa?ywXEJe0-^yq{F>F)=`c77b`RoDsGWa3@G} zpV-wz3j<_f?Q;VF9Keg1{3oY;yW51ilvJz7ABqF2mbSZ9K`*4#FI>A~M z5C}xik`0Nh%)qM)E*2JE+Bg408DgEt_QB6Q-_7{qTda>3V|x_&;oad@*f*gZMnpHE zEK`I-&TwRmBTt`c+vRP)Z-aX+gm%DUN|SYHDa#+S4Et;2@b=r?3nk{Cz`dpC;6NaL z52MQ8UXze8&YW4h_JWlH_7K2I#{J+xVDg2OY7lcYh}nqn6Q5N>uY#bYl8*im`oF56 zs~|u0Ve|}AHt;_oDZW2(6`s;(mE`QX%4~PPNb#ML;gQ^%2qzm1TPBZ8=3iOo{0m=Y zUs;M@k+e}?dGDqCumq_Z2nxM@J56hOla9MsKD>UsY5+Nf-2q~7-#rywVmH=TtJnSt zWMxC_r^E{67WBT?Q_4PnG1ZR8$C>UDlJB=ma_OjHSN{=vbs3OKIMB=CZ-gCxgZu7T zDcY>0p&fq__z|Waf9qP?{?|I8CX4NEkLqve()V$flsnysmquI9>7lQG`A9TV1yd6I zVaWd(8J2@6Z84ucqmH_x{%oNn?UuvOuR_Qt2F|zK){c-?UZ*=|VI{64EukOYuLt zmkiyCPh%6;(6{XVapaxus>aaQ(zC(BHXNVc#3;d`#(hVgaWH^k0Zs*sLEZEWPQcPx zvvV&>E=ZI%pb1vg76A4zdKChOp`z`fl`B=Exlm5Ryo!3}j0SE~8qPjhv}7Z|PMseh zs)zy0Qs&eZwn7j%HcPe{Uz+hGuT!$E%Hsm6EyzxLqjSrFzUO2_O8Dt;D6C?p8U}YY z_I?;JCU>Y27+yHL9s00>94`O+haZa|<<}PVyoeGxYo&Rg9E%IjHcSWZPB4-~@uBj_ zc;Dn7CvS|2_{nxOgyaL*&%zdTvuZa1fFz;FH0#c*+xP~@pEmQAin=J@e5OBRiZ@a!F7+)ar{B6o z_NMT0k0tF1%io6%SN2ZDnPY`8tLWw@x*3Yt|Cvx6jsUqy9Er}2&#;gWoP*Fj>pf7g zcjeL)bkF^t359Og=)V5Ohv@Nox*{4KVibBcJB^ERKS^M(IHl_5rOvX~y^j1AsCex~ zb<54P5Otc+X91L00|jOCjYv8kkpZ8P13ydjTqjO0lKJx(DAESV$S5%hpxNT#&lsw$ zsy;pdc^R)PIz0yLIU$`NS(@-YBPm_aeh7SHhCBy`JcMxvzSHFjQfVJ-LM(p;ZPX-} zxMfBDK?!$QCoGTu*|;l@A0TYNA(4hpn^ZK0r8zS8OY`O2UHa3PhGs&(RIoC-cZ0ps=ar=$92jrtO{P8EzoyC6HFJq#8p^CwS(tdYw3i0 znk%VYTiB~b4-q8DMbnEj{=)jZkh(0i(qi)1&rjl*s33k{{DaD?v+ zoG`$BMqi7$hnJ&Ko)RQ>I3Nn^0GZFx7L)Q6|EibbTCBh~{&v~KXRa(E4f!tQM?1>?o17O5Y2KK8#aaaqM6k2U%ll~l%}W02Ujs_mxP_ul3w z@$t2sp5z&D=TT|d_3a<#*0p5a5P+<0>%?`Cv}1g6+hIwg8+)%$e`<3LPM(B|*Al+l zT*&ztd0zj^P-BEea>JFRXr7O%veK*V7gI!OZlmKI#F+wvd=!*hPKzYLz*V#Ai=nr6&LDR zz-1=x;t4@;m#|_bN}!?)i^7EnT&g&V!MtlyKy%P{4EGR zqc;GjPkGqLyRZQ4*BS{M7(cqjZGy9FFHacjtK?;5;+T)NhK~4X)BK+!V>?r4bd|gj zcX(U}0#D}DhZ$P9$p6z$`eu#01fo7V@se5j%nx}!6LhUX)C&C;oX&qQdC9m%SVD0y zFzKF+%ee6KTk*g-_?v;%gk7$B3o?$W_z3gsZpY3*}A8Av;G@5l&++-NSf;;G#fs7>v|WXUT2GF z&S=+3(*=_8E3$@+K?5-##Nt~VcC8<~8X?NTn6YqoNVqq>WT<8t$dKSRDyX7I1$Y~l zaby=_s#}c_ASk#Xx-}SFAZpN3Ioo!Zqp6a;sp}R)%!h8pVOva9G6K*bHSXXLWLNXD zzMIG&$f{dr(^6zi(Mk&vKGwS`XV*|U=i{HI>w$D4^t?#w`m{Be1ihU8Do4u8ny;6a zPM$|IiyH@$&J^cXlP9n{CP-dgA;k`dqe&>(9O$Z`T?y9{04-ur9GLOpHgaQQhr93O z0gz?KWK`t`wO1*r5>RqtgD7YO8(=8_dPsUZuTEJLkqiqRv{eHK{=e`>78}{KgVJlV zw;f+h?MJ#n!%Ox~QE5Tkr*=p7>=ZggUW9Qf^`u}Us#&MnjIEv-O{Zpj`Y#+iM@~XB zlCR79TRDaNkB}vlS6NF_gOc2>y2@a&4<#15p<}jLO83sER-BZSi6f=n-2CNH41j_b$Dj}v zg_$R}8J~qN%?+`_oh`()f+}c14ER}fOvWx65jZmVJy72J(+?J7ml-CQq+o&|Ia=fE z_GQA0;WRF$GQX{vI8>y1Io#XW5c?kPPKC{MHm@I;0v$1G%~gjn31xj)^mxwtS7 zSuqZu{SgCTY^(9zu|{ZUDPpbKaFh)EanBIxzUBE+Wexh!S&t4$Di&@R%0&+D$lK4nMHgW5ym4UdOHnk z!+d;LfBgfz+$TL8)KRE#Z4blCyr+V}T*Vy6pftlz>&%IRLAh}u0x?O0Vhn~qLyC4OQ4@2K*xVt(4c8IA{$PKB_H;}-VdiL zw}A2zRtmjO4ws7jpsbM}J$zGGX^z9p1S0KUiIeb!X{3`9fHhL@-tE%BzdR(M`Opk^ z{~pM*;f+X7jZr;Dq`f(Em!7EK2)3o!gH_7ELjD`zy=?_KKpVxvJ^_~%VX;Euo5MC- z?$TtyBx-d>uV^1Q^8~Tu$sb6*G+)*K#&g;KA3*ef#=d?K@qc2wKKp;d#OrqOgU<^> zlQXQJT*wE-lMK^2;;GX&8^?$@1RRba=m&@WXLiTh(gKN~$^%r3cGg~Kgz9A`_U4sj zcQ5c~B|>GuRisPj#Zd$zRGP8FalIyW`kDCB$`4U?XoNDUqE64E30f5kT1DvX__OEL z))F@)!i>rYz8#$*4=sbNS+b3tmI{3VBt)ri{ISH&@Xl0go>~*K0bf!MzNw^m&ie?5 zE&{hh6Wkda{O99CEA3~hLYq{qT-nj;K(6GkA+>do>*1Ecvd z72EY`Ir&#$EzQ@OWbB3@@Rn0{NOR!U$@nvimdWIRWMgIE6_ueqUAPe2_Ztsn7ar|w zGzxmMTBd4#K}Sn}IA3XLzbRvzT;~Q0!%HMTF!q~IFmDe?(G^9Pjk1&$@eQ0=&ru** zKL_mlUluGfr!G`h!a4h7_-1Y2ayJHk7IvZIP`~M^(7}N zO5<*6CbHN50*(P$91DxxR*vWgz2q;(Z@H4bJ_JsrYWGh}=HxIopaX}1Kc$t{9Z1u z8`n2=rAOpFZ8!UFGb1_I+!{Vr#IvGQ_(mh>Q!U`KDoKx=Lq40cGZ@L&b9;UI{#{~n za_6AQ7HyTHb#tlrqNBe4qdR*eNS%}e`T_9~Wxc0sH5N9dt(Cv|3G-nKD!5RY48o|V-pt%>@Gv`;!Ec?0b`enj8o;tkf2}YFN>sLJ&F&aS88$xceg- zprxpo=Z%Ql8|MLAftbMNt%-|{EK4}Pjuli4uHs>K(-;t!84-`EnE~w7hvC#P(-%+a zU7mEgYM6?ZiW-7Gs7JDAYtU>DOP`yhA6{>~R9hSId3AH>qr~ijU)F%%9p9tRij5Gy zECgMF##wSVqQ1`g?jrL}W>;qcpPE|bX24k^4Gf(zaB4IrmH~we;phv zABkP(Yq7C8DHNMNTLj8YG=+!&uKl`+<@W@ZDubOaTLe|c5K_p6ueHoErZcVch6bZ1 z(}u<&jzzX(NC_RgZRS@jF5g_ZN2nR(k(soLw_mu?2LqTgW%Ha7VHV?@f9EAgk9KtZ zYP#1N(l4-XBbMF(;aSPEKhHvw!b^xt=hv?SH;y z&=C?$Oba9eT@4PM8B;uu^P>2U428eh?J9W$LfJu7bM#tSOqHdn&x4VnQ`gVpjV-t! zbYH~Ev54zTTdZeVPG78d&>>u`M-UoBhhjs)*XHgF?Za|58y%^k-Y6x_0!{`gh>ymh z0hSL4#I7yQ`ar9MryDwIo_?SJ^rWxq^^>nlZPdnW%%XTc!9=2#-&yBPG4$8or50h4m|dD6gkSvFlx z(Yq?f0oXaDh^O}=h!c96Q3q0S`oB=xGOt%$(CVSEE?hauU9rLFcI=ew2!YSNDDB{$U!j zY$V+o4?lNDTxkT*B=Fp)0ZW7GBb17bc~=$)RxqUsQJX4@0UPdb;F8XU#3-UPavsv8 zh*sGxPt>kEcwz|~ftn8(s)-n7X_1(Ps(o&@mDR8%P7|;m`mID9CO`g0;Mh(Y2zU^U z0p25I)}v&A0c9;QbT}PsQQ%L8rarNoiVg%sz}ojfSxY3Og;Pb%yud7RhvhO+cqjz0 zs>%!8q#;?6B3XHh>D$~AeCPBhsjwYQA8&CQ=vdM8xdp<(JDf}xuChS{JpFZe0y|1! zf(>e-juV5UUx-XocsFocLHwqs+ZA-3%B`u?3`o4SbF{c(iWnLLS2JE;%tKYjBaDUB zXgTC>B!O}n1$y*QQZY72XoA{$xq!Ym90(Pz7- zmvLgBS!ZwxQ=gbaadLmVDKU@XD-uIivWfki&v(>KoBEiF2SqEam!! z)GN!M;6n4OAxo4=jXNhj_y|E%&rk1QS;sK&}cXF7~_`B2%8Y z5@h}NEly1C&!XV->2gsH6uaioOU#8Gl{hp9piBRQ{J}de!TbZXqH&9he00>EXG2JR zMk8u~3I)p~7$4sD<-!l-TCkT=3M)B2U-`UbbBwB&`$J+NHkNGHWToW3U2v63*XB)P ziRfkaWQG=uY{sS?kMf6h*#Dv}g+r^XoLucb+2DF+iXBCKH#_VQDgH$8S6udKUeJwf zAv6{kPz%frByN)^n3QikO*2Is%xGatWE3pBnf*;J1>2!Ds>hbL)}xfSKW< zB@m(~VWeZv;(Xh`<@F6oHr5leV=YcW#Z9;&%nlvuggRXM4fQ26pBVvm`3U{lmPmsi z+6pz55kwo`O+zE{mM)&-dH#sWYV7@<2`3~p6vMq3O;z|ovCWFz8y(>&hmH%FrHPhD z$7N)(=%o_I_E7uq6y*y?L(-F5@~HpwV+juHoL6P>yg>++5KeE_%}g}F8A!M+@)ibH zjw1ub-88bokQ?Te*k(%xx->xV;5_7F`l_ryr|$)a;o^jc(mCn`VnbuxuwFm1jFhia zi0=#rWrweTAEFSSSH1d?ajem-cg}DuvJ4s?UgMOZAXx438d&})<_$v zdN!PokA$yB3=2ZW8RN(05kz*q)ud!Gt(~F7?sBRiaZn(I%g8fLE#uB#2!v~X^U>{E zYOFHS9@pLx>I4az@CKkg9cY^+t7|dSMwEy}3*0G%3xihOQH{WldWb|W3*s2oND|_^ zXkeVo7iLX?AB)8H^#mewC28%KF=#b}BGMC7SdLR%Y|GijA3Qf5D(rtv@kp)I{Y2tL zdDpsYQdhWIgab5GF~^Q3e*YUXn#j*1A*+k0<}i>JybLxpHPn0J2xlaFlKd9h|d(imI`=k>3pz@%UQDK0&7%_vH3D2y?EavNzD z6)*I>4CPs!$#a^Im%!92zr%LJCNXULdch}=TjZls1F|&SoA@ox&d8Nyai=Mk-tt5E z;zjt+MH#JPf&ZMZ80+PK9nf-0X#2PXOYgbYw1&X5|7KpF&T zn*|d_{|5slNsaRX(13}D>G+(_{E+e5ieG994P2Ex8np(J`0KLxlPZIYm>rsqAhWpw zjVs(e+`p5CnJZd8S3omh=b?h>oA9*z^i(^e_KrVmtUtCQ@QR&xqzA(9tB>KTTI&HFB{)G^#eEttZmz3QW8Px5l>2T5Z00srTBlNaad7phZ^n1F_#x= z%7i}6k)GP#q#Cw=)w#rO_F|~M5@Nu$_(O_^I$z$ylI@J1mU%Z^gctP%lg`dM8^Plw zQ4~m;Nj-_RpCss1__7az5)f!mC2_6bQGuk1B%7Ou(WgXR|67A95L%)9Sc>m)0HL1J zpmIyXN#sz+T!{pIztUz8`g$tRZ1?tm{Z<7wM<|?D?1(uy{elG7n@>#9FWjz=)FbV9mo;QR97hj1 z|K^J<2MaAxb$|3SnHIvg|4b@|i7vM3v%R3faUzEvb(a;U@JllD^5dbPu;c#^Q(qNT zSFmi0LvVL@cPF?zgy8P(?(Po3-7UD=27f86o%3t++TTCeC})Rzw?W zn$S(#*&v-5`#_{@DyebqDoYzsobg_}-xLh|b-}_vdk83Nb3;HB(Zu_9FOB|uN6YL$>Ko(fAE5LEYNwN1_ znIApU8IT{TuGc)NYRv36LR|VbisL0aqvx#u9Dlle2$Td;1mNE>U0N!8hwVrx&(s3G z8rU4`7JG;FP<+lveAvN=YP(7V{lFLc%dSvfc1h|2$;#sS|4YsIo>ja9E1YMO;vo*h z?!9ahfL;Pnnjp`S6EaQtNzlk&gs9e6+j){6l3Lh_=>?*b2`x73@a{Re#~u8JDwxzG zLjd}>WtEN0(1mlaQ;ZMh)y`UAb7y4G&I4VWQDLz;g#>ZoFe&G=EAXPNg!x#NT+1Av zu5VjGOEPbttF=47j=(p`yvSI|S(I

ebV@zEB2NDm*&gZfr*%u*tp)#gptt0?*?M z;7{O1dz-2T7}p{rJkWytXU5LGhWi19I}+k5ujbiTa3{7 zW`q3>Eh$2O$+5KteWYOjwzGcXs=B>yna!8eh?vc%yKqbFsCX*{99X3JaxOHf@KAUn zQ5~Sbj6@10k(5*%FX79%grm3K6<2}``jNbxs)IxU_vN~F5oAypMG2o+i5(i9>1}iY zuLmgzhgH1dg@TgO3Rp^T%zxMe7SnQRrXnr5Wtn692ci~S2#h*j$)lmU!f{7QYsS*& z?R8REs$t2ar7)cr15N77;Y14a4o7$M88yF{Bu#o8R8BEW*M28P>`~Graq?)+1mJLv zN<6*YrJQPDbg&3KcR2{w7mPHj4vg+6ZQ~Yev%qEayHjIZ-`A}9A6%h}U-{Kc6&J!N zfV#$Q(j^t^p64?w4v5Hzwho8ne%eH;CG4H#hhQsoWw88Ydf3I-*nT)5BTqs_NTFq7 z1VltLmHGoU6&L|+$)hvR)CmKEledG0x_~dJ3(#PtwuxZ+2X!d@8Whd6yBpp1R0!## z42;a%(PRGs9Q0y={r?}}paqK|gNQK$-Ls0zi2m_cc0zW6+k0hK>U{VX!vWpKkwZ}D zH;m~TnX(NLx-$7mluz@B3F=+Vp^*MPV-uxt)l~nxwiE-gh*(Ja2MO@E4J{-c=|L)e z{<{cpU?Bnsfg~d+jC;b63+>)=nsOtMQAkKdnm|Z^G4=&UdDFR41W7V9+x}-D;TK%! zUKK&wP^$tV`hzoqGckUOA`Hqiy_GPxp zx9m%u<@0eP71EW;=YBPT}O3eq3q#Zj0_gRG3@gz7&ZOKBa% zUF%gy@Jg0QqE+{Cof;oz#9I>>JEX8CXT-OWqCMU=qe(q3ldr3w?H&Ek)JB&-OhlCq!+VyY+%&CvK^Mi>=;kMArtJ0mZ*Hly2go>b?XJ)SjAV;astP%vl&=KhhB)w1`dlg z!m)HBH^SL&2fQ$r^Fq^KD5)9++Oae`SJn02I3cuad21MSCP20%LS~u-ewt$p5C#dg zKa_9+%WQ+hb=`wyM^)P}LffCnYvod)6}smrpbtoNSXUs(#AXmi62PAq$M3r9bnB$o z$N!n^*0sj1O{Rpxe*O)$-U;rqtNUYex|KQUbH#Q_z(ufW2*1~<~gMp6*_5C-^uu*bbEzhv7dq6e{PtkUz z0~PvBIPj5-B|M&MM;n_++ULOwLR`TAjhqitWbN$?<(tnW(HOx2l0ZsRge^Ixg!Am;RVXqZxTQDWba{L&-xnOuje14424mcdTz^TDYnyhuf*G z;{||?3t$hM;KetvG30?CIUn0``!a#yL1>o039rav0sBZO#H2z-h!G%plwcF#X6)oE zpkQZ<5&?5bctQcD!Of+}`ED~4;$&cA5D_plun^^!LH|g583-z6kn6PJPdikJ4LsY! zzE|@j*QvvRdc%Nb1qSpvMV^H5r=$Qg8y1K&TgQLTwA{2X*z|O)LRM;><^e_EYXSQp zlmvTbL%<}VTw8XPExOx7d_G%G;Ey+PB~7)4jyv)af!wD<3yT@(1r+EZI2&%l83^cu z6`7FbC<1YBLxGkGj1r%T0xs@& zBRn}!TremDxI}EAENBVo;AUU~lXAU29uoaY1O~l+w(!&p?V#`)oCemg;8xI6I_&?= z_p5uq&IKdXPq#{1;a)$M->2$<0S5=TH;oTMy}~3A_{0$GV4%`!Q`|7aU(_d$A5Vq> z>b8)nQQ?&41PHYDnd_7rEs*5-V&95=klF% zTr{`!hd@J-A2h{5V+YViK?aDo^=kYukqSNpFIPi<=wLF7UqVe1K1guHSfwUFN4Mw6 zgP-$bq3HOCgM(L1z7DoYoelO9I?e)OS-S;!uoP4xyp}N3y{?ietHw-hB?J`oAc(yZ zBz$U`^~mHZI8=D3fkT8r9Vm0eTB6inCJt8RQ+kQueg;IK(-{tjLb6gxvgvOt)0O76 zd+dcFQxNl`yL7EiHAq6KU*H;i3CL!-%nBWAe?y-P@*bT~`tRvcM%|B5OlCVI6T*Ey z3t&UEc9sBcvcpgVi=j%kG9TwrVImu;x!9Bir1^roa2R({#k*A4pqPV3DErrU&8~{# zN`@9Yh7`}jSiW@<4emV_xWjRr$LoV0rprs``M&+@>v{Kl(*^1AQVxlXBum+e%(P(f z#kY051#W$YfJ9en4qhF;koAO9w)D2-6lnmN0fWP;t(7$5_lfgqkbdqIIXyIo(dPDg zfnj^U@=&bES>DLms2}CCyar8(Y+7t1EHu|I64I8#wSaEKrME;m6b`Aqq#`GIV=t(}*CP=vXvbs3NzYlX%JTw-J( zKP#s)Ajg-xUznIq!Xj#92FWt-E}RmnSwbj65yeScs#`>hUJZ0MQ%kr}hb>XmnQJ0Z zW+8?36WNzoA5RCY@*KFItg%Ex(FXW0tygo>HL+ZP0v_qT2v^Y}N2A%zn63h9B54#9 zg^8`Kevb8%E(hli^9y;b(bGw2J1YN(a&R(8-)&nMz8fRNe~y>a1ujfoTWSTLV0DoH zJFMS#`;A-)GH=9lR9^3m4i@t>mrP%$858Jr3AvY8O;m5kB({tG@>)7tOX75hyL{fObY{H?@9IOA8{?C9q<7ab1+^8m+SXXf~sXgU0 zwO}I8?tnMU7PU|X!k_Ox=U%Fl%5@|C(`^S7<@E@Ye>v(kOW-dt_z}{W|##` z4k0}~#({GImpy`R-;XQd)M>%Ze**4%0r09dD>YY z(z12|A1SdtnT7tVj?7rGcSt8hbAoioc>p+8q0g4PDB4;6*7QH^s>gc3Fp*u&?^3HP z^|&ham|5VRNEF2TN02@O@6)j>mw~(VHJ6a@(Yi`bX+b)=UEe!;ep)>+Wt~a>oh-E> z*ZGuza(80YB!1iCKz-jo?F=ey7a_#Pv*YM5AshJpiosE}o>~6x_iW+uf1oG%?`-CY zh@=E!yc(H^hsLb9(PsgOE!OkGK&zkWYf#owaZ%#aIxPI}I~I@xK*w@;Y_KArLgBQ` zNa=GxG4j(~6j<^kefG2Kideao!5I!iau_ZIfr!iL zkG37wX?yxYK-b(a_r-Jv|g8D@W{9R{_AUJc2#H4^$6hDaZwNFQYZ@f1R;g`t&o;f-bt zn76i$F96m?GVnS$FEqeL!ogvfgk)Odv*@-@pUE2UWt=#3NEpW5Z%2n;j?7$P6AdOi z!TF6|Snd)_(4)RTE#6t<@85!G?_BNg$7CvEr4g@j+v`T_?huazE4O38&*^bPtb7Jh z-K%oSz^ErzZ}V#jU1cGzrQO0LY6LxzMyn6~UN^zA)WQtbu{QnbzA|9|2xXtOy`_wL z638DC$#E$oKVj^K4E)d;Vpa?Rggd&(aVjY|?l0ZO)0}5jF-i+E(J03L(MMlK8-dch z0@Nh$lgMs*8Lc4z(kEFXfw@7+*s9XlFb~IFhiSaiEn8>LggiUQJS0vc`ynIW646Mh z*4d~gpv~BcS3s%GmJUOJ7;HPlRJ6I2yTEM(h{34D6e6-`U=@HE4Bp|-Sa+!mOuc^0 z%ZniJMogk==!?jDSE8j8L!# zfImvUqVp51JCaw!W?ROv#j2S0W(;x9r+@6o?Lk@S3k(z%3?f==<#V1V12O429i9t^ z_-j+JJ|nIr(VRfBuiA_N5R;}q{0;LAHag}k2fH2n57r9w>=#Mr5=%G7KI}#+w1BNO z!S{-$PX7eknOyFSEsHlPz1E(|c6hs9CfQOl^)2Mpf`1Ov&IWG&?+~BUQj5{aLCvh_ zrPkoT31FSOHOz_7v^!tdSG<>Ky!jmCy-ZTr|F4 zSH7SlIBOI_`-HDiKc|uCdap^p@;BbFW#($wfv^aK6C$I2s5(Od_9Bu|#JZhwPR=i6 z&qnRNdUV-UfX_vdr7Xe&sGJU9I{t7jnv41+LVVQ_|7 zM&9J%n-}{|_a#i}F0+bbM1>f|^Y-dfwtJ8mz-5R+YMlu0%vgq`LD(etKOFovY}bk0 z4p#z#LQMifgP=+9;mWoIgaldq;fettT92Ax@J-T^d2oqwL)db@pAFC$@x(YIY-XT1 zHU2>27z7{i%BZ&G-*_&*F@9=j>C^@3h<+>)G9F_(31hYA8!|ri8(~y~Kzv01W*p(t z9Ym0ksj#$)DRk3!wk1wE(3{*_fr zVN~Zw0rLV7)!!T5l@PcaM#RTzps~Oub{c&M7;+=AumMWxLRx&k`PJVtwkmetm`>i( z+5`p!hUw%5-s<)L%YhkpRkthf#q<~Tp?d==CgntV| z$nW*(65op<$nSNtMgRH~bPY~0YgkAt$v-;mg+gM15n$Cqfxygw1YINRt~okVrxW&s zj%g`jxH`6LaBFao|zarzK%u1;Kgcz%3fRrs(DJE|~w zkQ78UanRTDq0s+TtPFwX8^o?vfkgU(-S4Zx(4C9HjcnaV$B9QG2&WLptuj_Dr<)K+XY;qOqYPuP!u^{DtegPJc~%M}5rh=9 zDG222C_^YUhX0Iwca6r;ZH0aPTGPGe@b`Pz6@8=?{k^lxkz^2WS`}ak*ywO+ZTI+A z)xl+=mhohbY^z^hJmHdLOB4|9gY>-Vm-aa>slnc`47zpt_t5*x{d$`k*OWfxx}A-S zll|wlX;?tnWl-j}cXNeaZ93q-QmOlk^U(G#*Xv36cc1u=L-Jk(#1!O~xkRxhwqi0; z#)4(@)c*P_)j++x4lIUW-{agB(p{Io4CGa;3@YfO~qV&WUUt^=t_}AYCPAtorf&Oj7uafV@XZ9Vu+T(E?|(UQvE8iyQsNp7|3`^uphrdb zO<45aZNlwA`uxh{$YS)vWaA`!Te-nxUqsUXzg~Oa5f2{i4MnV3ZiWT!AUI-$oSdy% z5Q%K{(F)9-kEV|sO_4>wN@46MPtv}c1TfNT+v=TD}6}tDM*igXP94NbSHq-hU zr6AT_NSTw!h%^-$^p%mRF^?lPzWwLtK@KSXgcZx~CiDi?9GM5S%?SM!?B6uIWdv|Q z+k8uSBDro1dOGRMmx$1}o#LWCbPT4=t_32>k43^MF8X~R(S08??k)D1Q9$>W7uS~p zYhmYT{a$y$*nn70Blaai>(jjthDPKgNE8G9w5Lfa=*BNRb6g%YGlD5y>^^C`p1@Sut&lz78Bpz$-2NbG^KjHVF?d_?+H5E~C3vPWVxN_6U_W;k8 zUK;|t7BiupCu>24h0{qgn(2Gez7XaoTyHqmD1~PO>t(A%qJqrGT^*(f?p|5IZHY5h zh%*x*xWvug$-2Kp>htGn_>KWLGmk4ET~1F&r|SvAe`>AOKXN&Xp(FlSb5Jc*mcQt4Wi1HZ z_0E9lalS|b{QpS3ICZr3+!;&tx2bz*&Izr5X&AZ2TVe$?X&7J;y;*QXPfoQRG6t;! z(>FyC>4}_0&l^oY+H32kSmMty#b*yR0Hk0_+i^3MN_L*Bd{gK&VMW4}la@gG%mtXx z?I}w4d?bj)Z4U<+cecwPpDxM0Y=YiFL)*45@7V_Q_%^VNR+76q>|c6XFj&? z&iZC}NmTAoXzqMXP5UJH#hU# z)875Jz*xkJ>eJ-BF;L0}#|J^k#{dy8(Yq(8@5klm z=?zDp_dvr^pj;CWnPGZ2rFRHKAv#nD8reZn$U!DBq0=$tZab`JpIzGZkIdBfu?z4GkV=CLIT=y+vL7_kG4Ez!s;g za-ssNbDEm0h*Qelj!4XaVN}L)R*!{abydT-vBKIFgO6`b>Bf*i6kN?eF$+`-WMmzd zNGGHGZnreBuqg)Fge}ma{pJlM)y3_>Y6NP2^J?l(H(7I z-(4y=hUiV~!^IIx1dApFD)_fWWj`rfX*RO5*_avgKE)aWPa_JvpoCf~+1oX*Hmq92 zDcZ2M9Da+#8byxP_>^gAaGr|Z$$olqoye-C6Vn(@AXC(%KnYrv;xqrY`?Xm|6Ear` z&#t^B#DPG^$w-BvvU;{(;^IH)UAyC+8x@Ftbn>}cEjW@W{R6BktpMl0_lbfbbVQ5c zj?d{4LtuOXj_0e)3czJ!uCe*GfF3g+r`B!};s~>cJfsP_cLyXGvCCFk%LjH=2fKdj zhW4ib5yggpJfftXI~s(beO*forus#!sA$g}R`T(yI47py^Xw-^ZUp)(@K(u7%4t+) zFruEBY6=(=bXgI>@cmSV1@c)qvsp2PU_SEXxN+}t{iGOY6#CK`-@uxHTSdKBweysu z@}EZdcphf<`}9Qu#StC(^gN%c|BMbMDma^Df(DL3gLH5(*O=WOe{+PWQ}J-#CZcnj#72lPHghxtB+>}g)9f1h?J%!T@tigq>mIk8DK=mou08nhUC zFjtD^C46c&0~EgOY!qHQ&2yFP&SIoAPS}_jaAtuv+3bqQj2B z8JPUxK2{pea(~PU*oqAt4@q?`^x+8T|MMk&5Hi|Ao_i930>tiNY_{jHtLb zkOz)GE`B0@BNx=@C1e}O}5 z%b9>HQqBvmKOecEHm)8Ytjbk_ZDV^W zuCna=fN8u{fDcu(nmUQjWm5^N5Hma0h}ffSJd?Qi0|20Kalz7cU|er8Im3l6+-Y5X z=Kf@mlRDQFJR%>TXTzT|0v~r}N28L5mO9wtrP{fUC5PfJ*+*F)2e3mY=FcL1)6=ZO zxktG{)4rn^@sPaJ$0x<~XGtc=*|Dbfo3+`ks9*~NaL>sLNEEiqxfh zba;RC$H}YUv;YbvEN*SS1dpj_1E|J70^JL|QGcjE=I#sfg6^Sv%#1U3=79SO;{^%v zTB$tzAWl%64LPi5NR;(&@c85Hv!Bl89|>@5SUh?zS=pfNmiy?t@b-qtOm6##Y9sgL zgrs{;Xi^GuWzUkhCuOU;yzpJb$i6f&n+|a`D}ryTvjirg-tFmiNW}@oF~xRm4Q2;d zeF3Zu8jO#rdS(xZ2O+^VGZIo1{#@^>HPjObNs7<)t;k(Bt;PRBi2UUIrHNQatIFaG zG3#bQuIl`u`FugHn>w79bZYDhER-)umE>7{$U3+4^x6VQ_ZeY&^O89O7nf^SZjvp% zW0ps8|NdldJ7T7kP3UdGg#!LNrfV;v(5=iaV#SD=K3XAn@jQTF}hsfk~{Uv5ES}F!2VyUO+X4SiUB9(hf+TTH}b;XA?D*_sYq*8+W^Cx3M0E~53NcXugN zsbR6(4L<1Rn~wZZ_%4UB=5M)3YUkvflVo1hK}^X{T=f;OuCi`ptWTViic(>CT|b1l zKjCn6p1~1{h~s~C1*|VmW;{keN+%@wkm{&&>&t7lK;TZDBD2y^_A#B^>={$}#N1!z zCH>~U`o8rvv0<{wQKiRy@4Y!54wE|+-CV`Suk(1EQf{#S)i1az^mozQoDU6h7YM2w1icjq6xB!5`Bj4p2HkFL*9(d@ zOB-vVJUqH@e&8=)Y9#)nIUAOqE4d-1Z8jcj3KPHNh|hYr-1h8vPn^Mt9H>WTXF`Sb zPpG5KV!{()HC+0!OMdq@=b7f`B@b)+S1+ZL!0QnH?;fmxJJJS zzx{aNcd5_OYONogBfL^}+5TF>T#^y>dk3MPKPx;T`MG<<2*KnNtl<&Mom35IcSFD(YAR3|ps zac4CdUh}75)yetv)ZkriZJ1BKC`?njB@G=CrA<`d&YM}OC$*~e5~ck7ef&uAN-7$; z?mr>h4D^K5+DZ&_i2Qd>lO8;;keq(hoPGv`Sl10PTy~P)?+Kd)zyEG%OS0@$q8P*G zh-*%=FB`7o3abC(t;}@XV9YBjs9N4X=Hj_2AL$s9NDqvToeCr#)hV~|wkFd&qs%$E zflv`Z?4V#>g0G-Dx0~NuU$10fOU~V7uOh-cNu99ycC^8CTI+Dbo}s9N$|`;2JZeY3 zi~cheV%Se1ZJJWR{#~>=#VYhQ`tb?1axcOH6^~9}KSQ@Tp!v|v6cS%2_1Tf!L-r2d zcWU(rK5q1=PM(H@8CVw_h1#k5lzYhx@JJ8iD`$!?DQ)!pk3k^sT=#ic>VZc(A%&lj@* zWb2yNjjKY{Fkx#yUK7IRjvM*c^iF^AQ01~|ds)+tV9vy;^4wVpVwLksW>cTjP(1P# z4zZ+GYDwcPcj{}!6qd=|3!TBg6xI_o>t@f`Y8FWGnD@0TfMrP^P#w6vXwe9!h3_W% ziD7>XSeDE2ZG7ySuD3n_xYnO^>?^Buo|)-bMMQbjtN#4s15)|>gs=~an`f9HVN)a^ zP}}3!AowC6N_BkwQI5-wZ)YmimbfVWm7!#@=8S=ogLOGL)tIN_n zADr5={n2@Xtm+jmm$-#$*d65+wmIy0XrfeH!b17Z! zpt`KOZ%(T{nk$(@^D4+hy{RJCz{vq+$CQ27e^MY1E8`JJZq#^ryTHE}xxsIVcwC|9 zfd5)+^QZn5$ykVkRZtz`?SwX3*)*2R{p`y8-Aam&|^*;PIk4&>$#6 z__MANIp`DX!L;Z2VbOv2;TH*|l;7l>f6ibbS0l?k6aC07fsF72qLS(rv)|J8X~ zk9p6`6|=82Y=UU^a&V;)9)fPTXov_WJyEthk|2VLh7|ebVA zHxBQlNm1&J8h1P(H^|VG`&92-!M+Z4`0n|Tb=L|wPJPc+)Av|waBwLIn2R2@?XIlnm)>V8sGsF^CGV*k zG-fq6Uy}oEly)dc>%OP2&j*x?7`}UOaY(NHY@Fc?mN-$KsM; zk6n~t*Lg2Zfx;!lU(>JeFe11!b|L=O2wh{N_A^P#wtR~ zAG6AzY|Ws24=Xwc=b%~DHjO3aL{*tglW|%baevjir%TXggrC@#wofQf$Psx%Gh(UG z$lW2P9l5&oS(^G9SQ&-QPliVRY6YraC8_7b|AQj7oQ`mQS=C3b*;Rb9(=cho6KKqs ziVRz1MDh6d27*9017)=-69s!`>T+>bB5&Pa-vSgy~at&Fy zIaXfK+!*3DQB++ffTdYdOc5Zg5}~qkHFu-#wzxQCh($I$pbeX>sbKlXzKX#I4<_&V z7>ZApdlN;Fswy+j4Aa(k)5b-AuHC%&WWXTWSYk7S!Qj1}rl*ith09c~-(}Gk> zEv7Ce&!RF9YZ`Bb&T6eI4y8T`x0YWVJ@xbhi_>PdmE3zVwua_BpAPx72RH{XOw_k9 zw{zr#&}rbkb*^X4yJ_VFP_TvjIu=c`<&D(wIl^966t&%&CF<|nIo)d$3jZV+WU`3C z3syYv&QrZwNVO=P$lR3gstdNqe314`7YbdH?bg;LF!GzGmYTCeX(1~UF{eK-DpcXT z_~rV~(|zihrrjvVv{=?-@4TihaVf;Hso(^hYhHZOG>@0Dk0cA!fiw<)=45%uIvj21 zJP$3kEzMUFcg!lS{cl4Q2=7kDA6XUH*PN2qX1D<1IFP@G+bnSlmEUs0T1)E2TOwhz z3hCrjmeHM%lhG~2#3tzo!M#fiAI-0W?AP@p*H7qs=|aFhS7|l)Ia%cuw+}K*F=SENFV=N z@^w+3O}q}il8;CWBu=_5KM&f5(cTR{>>aPh58)!+E1A)7Oi+wj9}MHWlzu;_u4Vh4 zC7VJ;&=c|Z3_BY$Ml;6z%AksZn`KV;nd)1W*?ffUIR$?*?{W`!2Y(hpiIEwY31Z`DjbOEQ@~$KfiQo;TO(8kRIYCr+_8P`ekK^wEO_dF+-py`J``D%#x|N_hI4AX zRi3xI>(-Xgw3~8&^UIDW=q>2!&yDKz>enpaNavn&IiqFOEysPcJ;8b19I(>nTmiu^4mm#lo zbN!DT%GRxbkuF5a{H0O*`p3r0wr+fR!1bTl=El_w>i%a#6qW|})=VBErhk(xmN3}S zrf(j7vLk*Rz?pzKIuN6Z?2X`^N%8{>N3&MJS2QK)O(C!Ga2vV_Z6@3xsBv{8@YKsC zHinJk8PVq6c83%qyYB4jYsxIFMvY1Pw<|iYU%H)Ia-&r4AU#mKJ{j$gr!Ig@eT7Rb zm(@*DKZJ8h{A;N6&o_)~4+rHJ?N_$9(Vgd7rapz+>BmT-HImIhQAvM7kldi}{F1Z2r^%@lzt)nAkExSF8 zHoG9_u5Jmr4#!vxs~^X5@FghIBejAf+h*2lfW>^DS4Q?}OE@e0S3QvuB;=LvCw=#* zX7~G&s0ulsbkEmICdivE0pZ7R{aplMo|LJnGGVC$e@e^Vwy4sPNkS}=0AjNZR9@$( z3dSr={>GfRv}|}?PjgfP%<5v0vhkCa;d=)|M`POXLslt9&GN<3I~gZe@WaUQR`Ayj z>Thy?8un-NoPd`$(k>zlFBXAd`xB@qS)XV~kxe(NaTlY(jV`D*3tI?GOX7Jau5E!H zci$WdMH^w`72J?|B+iEl@)gArcov&n9g+r+$U8vcZ@&W-ORkOxyN^lY(q{9frwxDK z7`onq5x%^U8WtTfrJada29wZE#GmbOiEI@*@G*U%@gLr zq$>M7-J08n`bg_-Ocvy$>YXSqV>WrU6PbFxM$v;TaGq^s`oRmw7@l`Cc$-&Dnt%4; zi|j{An)HunH1Cned)rxI=JNTr;vG5CQoQ@g4V;!i}87j^^U0QgDFWif_8Qlbd40$r1Hv$!T0*@F8ZD?wDizTJnVYT z$3(HuE!YP(q=di#EO+DTP$%7e?XLPO-6sj5GiBD|`|8Qxf{aiB-*)l9WY!Nzu*BDGx;kQ9lo>ieC>c}X@M{lu&>d4P;fP4*729bRIcZL_ zocXRe5?3IW0=|)L;vPe`$u1c-b%hUATQKFv5Q*q(ypngZ>L-Zt0 zIwFTrm6;I9W%rfbk_X(wC~1@UhlkCcOOhp?RZk=^DF;*NFuT*8PgovlQAxsREdO&Y zVxdJd`QERv=wFE6yv8Yd`nL!pA?B!Q8KIyhtqviepxk3^!%ocKD$y(O8bfK8=)V1I%p1Q@A=C1 z^lsnM7PF5}Qk>8M_TfEcNui!BA?``@tn8>;aEVg8!*q}&ks#v9H)CQ-+Rs}f(EgCc zko#f68X7VD`b)r7AeR)Y&3vGny0{04WcT>I2hmi*)xzFe`%&>ms)B6Yr(BD&VU}AW;dx)t<)v{ZgWyk9a(3oJRP#&J zDWYy+SzLa(mv1}yj8SqhY4|q!1|mU3_SHPFA6ee%ZsD5r2+N<7>=OV>=!@zsa)>0v zWWdA3Ss|LD&?xb`klL(R0g*&1`eOzAhExPSGC7*n&xCI&rATH!3Kv7=CERdY zI@%q>-K+Tu35upP-I+795%}CcR*oMQPw(Cpj!MTlM;1HAy@0wqn`BI$Y5o&ThHSwz zao9?k$kJn6J8+M>GZ3Gc&qW$6&OXK57l;^wE-#gI9lC=|8w%Rj<8`$iLj+B#6c&#X zw4U#3>aHnkcCkOj?cH@tM(*sAw!ALts$OiFvFp~FsW0!OTAt`K4bmNEY!2zXQ^rWs z#*%WL+zH{$lx*__lQWDz@;>214Khdkmv4U4LkDf^&>DQBPbbj}uBgDt?BZnFo_yzU z#ti&~y2g_Kr+r*vCTFSZRfnMFF_%1b{txr~@VS`d;)U#TAJ*S!XU@vgdGgfV80ar*WxCLL-a^}U zbdOD2^{YvwrK#r+43(mfIg;ED|0D8}_at7Y3!?IBVQYyJzrJ%X&K$G|;rN_GR@Zs_ zK=R)nqQ=3K&lp^J4P;f8nhldtT+&0GNeca5k0nHn0-*;!$$xs#Rbc_l`~gyj9JkV= zg}vT)eiHo4TC=O~op{r?TIM-;SCkuiRsNj#4|Y=$?#VmnCfrx{@5+$k-td?oZ9;2O z*sXL2g+$w7Oy+vrX>?1H)HmAHj=boR9jfB3ZVO=JL(QXnX^28_u_0bQni0$v<1HmQ z_6xULZQYx;TY{%8oihzvBE#OxL_*^NR_(g2eE;Gp-BsalC`}$l;;>tr{suK+oSqe# zFYGdQt$c26-ZQq_l0RNnjPd0^BuUAn%7VSwYmZf{FXl|mS&~(sBgHj@Qxxcm=_H9K zBt7D*9;gr!$0ta3Qc1fbL8XJ5U4@G>hFf>&BniRe&Ig}dY~9_t_=iE_sGOvk*Wwex zKsYjAv3fwHY$J^)-kw$5S{EYs6z;+3Ta2bzKgTYh;!EleG`^j6mo<5#<`Inb5cqgv z^CHJo5Jo-xb!w!&Jm7?f1CtZ^F6;@5c6U+R2c}2Fb(oVd-*3f7!lmLudJ^n0Ai8Ly z9xYa1qAbLxWdCTfwl9<4G(r%fK2nu#X1;d$cB(-qu+$lKD$>Z z#B0x=#is}7Z^9#3T(rJ$rqPB*G@Khw|Je@cm8VsbwkP1s{_~2Uph5R9XTnK8t{W=U zwC9I^S~lUP*slG;R?zBTVj z^J())%oDD+-?HVw{3{a|yneWhht;4^5Sgj47VCxCN+*e-wG}|>aiC%UYzXMn+9iw4 zrxueQe2$e)*fpNjzR*v<`8LvQu2RC3&X@ZyCEJFuw}2$FZk+0<0oe=gx-gk`i*DJFu!?n3+n6}oP3~;Ss zbhexbjo@t7xOKwH@9zN*!U>{p&W)kvBukNl4b>m){E4l*71%>g=XO?iEAxc>isk+7 zm1~^X(+y2wmkCSo7Bj>GKdB~Vllbk!ixctgD5k2-<)Lgn@L}N6YtXHVFK>}2T)R%9 zCTF)8gnpq^)%HO7-h_GU-!%L__(+r!b6pm5T}h*@piR|O>yN>Q z^o@`Jf+53@TwOcE68>}TPh$rh$njyD~5NtMy!;ckkyDDTBnl9*SBzSNxhtnuwrBjD3`O5hR;kT**dzZ<(sH{cPq2u{mmAMzvZ=pANm_T zb#%6AtABZhZKjQcUija6+EP6Apa|lyg9j{w(!`h!V-qxQxTME92a)FQ(q3K z21AYK|IJt8wQzW7b&k#6#f~j5PIamao&hlYI6Z;@|E{0UnaPbZ5eP=oJa?r}^aglN z#1xhv~JL{mhqAlGc!6CTQxCM7hfB+$c zpuyc8x^Z_xfZ*;PEWx#LcZbFu8h4jqkKCD?dUvYct$9<^r>eV7uf2cY>a)K;cAZ+i zj*m5&Vv20ukGf8R*UIfA@l;MZ$VMEK9|Y%z76u3QLWiVh%EVyxzZjEItF-0PW~&x^ zJsi7^I?hpiUGLzGoMMRSo6D_~)zWY*N;TKmtkzt9yxx8vE$+1`DN%{Ox3Hf?{cR(D zR7}rY=zu&*r~0`Z41%s;x$)Pe)eOtY(@FUMDTsB~=92%>1; z^JVGGLL1+LVCA8A!P`j(O_G8`E<%Rv&2PsD*QvEyb>&uBMX&!nNUMlXQ;G?zd5IZV~c^Jspb_(hW0b7ixWZGJRSeP`Q<`B^Q3IH{WR zA+kN{U`fA1ysweuPJ!r#cGs9Gw}TgOOIdDa7a>fgFw_LFwjcroM_Cc)mEq0zd_RQ) z56Hg3xL9y)$qaZtvUD}gjLoC8*_h0dQv*Y4f^4{|8h%#_Pc9E$dyzSg)x;j~_-~Yx zv1ehw5g&PJO|>!pme}c@ZSuME?CLsVs(>|K1f7LbiFEblXLv`m#6e~>5_;SzV+X?w zSNldQlZK!QY*aeD*C)>R2kU{L_`7dqoqJGO#-O(!9Wx7-r0MG)_#6;R*HI?>@IlME zp8?~6$cIT`MLyB19@2m&V)oaI7g!rtuVe78OjvzU!@s8`?{GRdn}Jhi69n&eXN2j> zf3d~B9Ysr7ZHq>7p*a8e3n9Tg!X$r*kGl9Oyj1UZxz6&mvomc&By;^RbDC zdrA2>$0q349dlhH$gcIex@L>1eor_yFAeo>XJZsO>C$RgNF`hbzDa6y(7Ft6SS#ha zAtylml`d)DmGW9Xq>+}J9gx-Qnel^XUPWeWnNL3l63G-@PnbMm zbHGI8MuwQ2mqK2F~=v?P@QZg=?V_(Qdw!!F}PZZ4Zl{60Pn(M%(l(b zm8yiz)lINzg4fzKH;@5xXUNC+)oAxWGybYNjc+R-TyHyRC5p~uuMXxL#R}X6Z`p@ot z%=V*KFMXwX@&$Jq;Z6YRc>!5!jW`ya37>FZ$v5M;`x#=FcXNJamX-KbF~|H@N-CJ`13k6EA+B&*aP3HG$9>L!#}H`)z#?Ka;S zXlL7)?`7KY`yGJSBg8U{Y*H~b`zC{ zcU=v4^g1_=$0t1)Kdh#~%_bqrp;DLM^om--y;cvrfhEZ5?n&;#Db;1<{C5(1^*kboJe7;rnxKFw)b71b)ZDM;A%FgrI`UMx|9Z`S3 zq%*A&_ik>@gRj2#MwH0B#eS5noIqRC5I9Y*&O4~Y9tGGz@)J3|Kz(AW%Z#OCtDdTr z)kvsa?WhNYYXhNb`31Isdo_!t{m~5|;`^ncjof$W;vqZ|bg`*V;Ap@nrR%h|#1P?XWZnxAgJ zgZ9QZvHD!5L2PAeF48U6gcMX2{ZV9Z1gj0bKIrsSQL+WJ-0*DJ%4N;@C{;+~@TX&V zNiaLnkNVjhepry>Gz);+z%!NG78d{=Vo?L)m^+`g)}_#`=@+~a(8@jcL5sn=mkU%P z2620SELV3NzcUzPP=6wW%M?+Sv;j^-@UyJ=+pA(@7MJLv!wr}o^tDtcY7_6s3~lxw zI}L2w|{LrVH zU70EhjGDEF;-&QdVoTqzzQ|TTkt$yav)zZ?oo?2KX3N~@C4m$UfJ*$#B zN`7JfzVMU5te?_|QBxcyozCaA+w;!j&+iEvZ{dk5$^d=OB`YfN3gQYL7N(V~-5!Tc zAWNDkSAo}*WsHN(Y2CCquqqDI&Jd~5!120RaK-)HnQRh#(-&x+Yv@x_?oCC8k+G_KOo5^sy zzVJO=U43?(rp`KC{G^w=2{rPzYc)^WjEoUVz70;k+6I$dSFVsAEigmsubjEEt!OS{_&4&%<-X8*{)igb$l z^L~HCH$S6h@vfZ1=(|{@kGiktJ=_AFyy+{YDhJ%(67<6If^A{E>U&m*IS?d2H^L6q z|Ra_>y24v9`=^DBY2x}@i^?ED+xVE zzxqg;I@*X!@h8a@1N(*e@~g+YH-XvnMJN~DNWkqKPtVPM=AR^SM7*_E1u{@n;_o^^;VCepacW&iiKFkg$ySs9x zd@U(%7jiWl`TlONM-HoL6K@60{7{Nto!ghw<+STk+?^jU$sI&0R9Rse8wlTA;fH4u43{k&tLOJ zg<1(@45P;jK0nbe1z3+?&Z|-JowF6UEk-7l>arYjxcc(lnmMuN$!n(=Q%qDTNhGT6 zHtJ9FGEa8tzU6+1xlCT^3f){I1^Y%U&;?hHgn~qp9JG`6{(~Utade)tR6e0c58|Gh z6ulAAwCU&%BMfizkHAw@b6pP=-O}ZI#2T@7u?GZ?T0f*FtRioLUAmv6(?zrTY;PYK z^8D(QFF0g<$WmzhVrAZsrKHkyk6mQX{6J#TSS`wC>l_m-14dlSYF-b z+MA*SJB%FQBdb;KYeXPy;)WWs z_i`7yGnLK3@qxOom(MAjHHU?mVgadzGUGv~n*zTnsc!XAG2vSB>caEeM^^1GAxWJV z)a5Y1j})+J-uecs?xcn(*)@x2kLaCi3N)t>kx+i#u>?4Tvy|H(%|BFg##i~;KU>zC z2Mpa-uM)Ob{jf(aCVFOD7i#+0iPVf}1dDNX(PPt0g73_+$T2%MzBW%{7b}WC#xK%> zGr_4@f9_M&fR(R1T&}$sp(fP;5>6d{DdxDN+D*V%`9OkrT<8B`{y|v=`PG>?1g{5cfgdz$2ilr?@^d8aWlNsc|ynf_znt$YWP%!J251v5S z8hmC`hMCS+DAaJxom>&f+BI%vPR&_5KCLH-ldNfG z!asAsu915sAnW3Vig*Xv?%vAd!A%;aeL}H!B5kMa7S>s5e_Lk$ewV2po}uvTyn?zT z5q+#TS?B!5LRPN|{Y6~tnmRcBg;a0#qm?zq+e7jj! zp+T?XXTQQB2G`q__)@gF&WzC)ODrM=X!reeqJ717%FIyhvF96D&>F{Lb8L4nk(i$U zKH-WhU@QP0^~fNkM=}N%W|2dGBL!8PC3GOv$RW1z_ZPnnIwMCoy?m5iWt?`zCm|Hj zy765cVhFaZeRA*4A=`)nI$>a0JDPp^X?2&paO(_(qbQG#KRrE&vsqwzlcO-#w42VC z&tCCFLbL-KCMw%$F0j&Y{8fXcAmtcW=5Va{$c6+?!>ZFyQtsgxW6m-e%g@RW8)hSq zA$_(a@;oMKLAwp(SCH;c)H+9Wm!~*E;J6a zYeiNMc2s&t>cLW?97ebT#xb>Z4R8;uV}plP^>cRZlfQk7mgHXXxUnnvXQen5Ne4?Z z8aqsqjevNICX}vroAP1e)E>40UFr)BKgHVP=$p2T6LCkr7+y@v8;^@#Rw z@IT(H9Om)Im1192H*=3J;#+*miC84iq7wrsp{eh}d4UhLmq5QhIe(1*7_F^Dl&>x@ zGs>DO{A^XH#WalkGxyoySBz{p_sgT_H*t%ieZr`D^aB?zlha+P7c1as%O4ndDBB5E z^xjSw(V`D^K6`bJ<7T#ppzQgpgy-0uQ1>c$k-`UTiWrx0jvu@3w6$-^`2|rn_^8=q z=j-S0dF>%Y6?sGGME0oloxCY(YRuH`)0qWbitm&2`K`PLdG$5Bf^`nxuGEcbY_#-C z=^T=>oucfxs!x-rJ`nuy8I`#=`hL@{dR)IdGm8`9=Kcw9A4FgqmT^lsRk-pyJtHFn zZ6(*)9ZK+%K%15+qM9`Pld$o7oJRjIBDHfJ2;enjd)FQ$=zH*6gU(p6cH*VHXGj|i zqfMulC%8m9O@`jf$>rUF8N?5GmCP}*%!)goL5Qp7(PU=&o2pr_@=72KlhdfMjmG6v zIlUv+CUo5fW^;_HW=d8O@$JSYnU4P2kq7@d^u(~U+YT(-oOe3E6;;04OU_5*Ilq9- zP1MYP7eD`tZ^J~r;2H4IZMxb^;Mlle4#BWTEV_@tH4 zyVge$0?&>YY~`rF+F?fEf(H?tTZT}yc@JH@l*Gt{BL%ISgh>^9Y9&{E19VhYuM$~< zoH66FU5h;jT7CD^95^&g&^`HYrh#?yDurWCAlHu0J6O!Dii0U6EhGv?Y5ST}A1PUP z_kw2Ll+V)kQj2BDRy!$HqL|XA~`^vGwTs2JW$7< zDmtN}Q8O{zyt-%Vjwy?jkj%tAA%~)ZVuOY1fW5juC%;}!8i5E904v0KQ$tR@qXxjW zJk7PtYt&e5)@Y3Y5oU!5(-e4G6?m#~EYET+^BXmmn>E@ZK;T&+@H7QTRs~3E9Kusv z!aPPEMP?or2$0>m*_^mU;&+yor_w{Od(jM1sMsK|+;5|aK?J)*{9R@rG<)g+yXgG5 zPT^_m+_@!2ORociNU?-^M>t5nsBwajK6j0vzVwz9h+r%x0>l4o@F?0&HRS!rz?$v- z^;GMi*^sJG`?pwW#lbdZ#AY;uOua|%fo0@%4QBQKF{#1bV{5>7B5{ z#c(v~Kj;n@sOeTgdb}ChBd<5N_hQn_gO>h*i%u()0%a0A{09z{N#5XY*8g8|FUkJ5 zC)Hl{mjeI5tqS{JZ_donfb0I!fx-^fX@Bzj1Ds)-!{J@Rod$+3_%AJZY|ijWfc|ln z`b$ftKtS%zkMXMEi~rM*&(Ai&?8{@bBqDUj};S@_{JnxsUtG~lwo!n!ZQsef~t{(py91tJaH z$i-YKJ6Lz5{2)eq47~x{6d&qB34U4etG_Ne*!ypW^g0Zc zx*&Ot(7gX2#EbCiA7KROry0cF7o*tz(}mjlQA@x78t>|V7D7|L| zjLUwY!5`rOds=IFsK+KB$3LA1%$5Sd|6OIo|AmlZbpHrPTpC+K8leAQ=|L}ap8wmS zq<`JOH$?-^`D+vjVTb?SP*(s?bCA26^LMwS_aIO)BYwFhn;wu$@9lWnBGae7MXupK znVN**MgO%WHL=etiH7oexuqs6ukm*3P$$pp&@aw$fOHowl!9Q@=v1(2a$1rFa|#%K zq@gt6vYEB(q4|UMKr>p|EfYZ=W)?_v9@kH&4f)(*E9SD$6w1rr-M9SveT(kmJ z!WvUTo1aaJDsCM$=K*z>0j#xzp`q-_YWm}e`W5+4;$L79A*kpJIOug#28>Ld23p_5 zw1YYlh0rCx5y>)hTF7wDDTU<}5q-7fMFa{WYVUL6;hS)j_GhyW7)Z+@g0mUnm$*yH z@+906r%dh8P`TTMCAOWB$6^=IL1OlZ_2&J}brp$p$mQAZUj~}!1)s9~oLD2kv-I-} z8a}|vq;n=&3J}Mz8;f=abXMo7ebrVhfjuVXD*pqtegX3R6PStt5}Wu3@b$W;61anv zaS7%IJ!O{aos1QKJwgxZTBaef^dE@N3#9!o#Lf;aRNy}$d68WT)jfU1^M}TOR(8=o z%nZ6_VGpIR{7(WWq9V0^mXMrcefkb&`){wh7S0& zz6Q4~u*=b_3MhY36xf8e`ppI~P~Oq9XkEuWYapZ_{~#q@eSq6!MOjYokMG zJ0tI2HvI;ygRciCnha{R0*BrfuIntZ!1?Z_vzy5zX9~y*mEDOdUq=-@v2s3ed(rJ~ zLmS%s^b^~uNmnh7qXMK9A}M(FgMaj}q>E1! z!7#v(lT`ghFts%CVmcNP-Y4k!nL<$p77h;v4+aJX8RlARSO\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Veeam/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nVeeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/products/functions/#overview)\n\nc. [Azure Key Vault](https://azure.microsoft.com/products/key-vault/)\n\nd. [Azure Storage Account](https://azure.microsoft.com/products/storage/)\n\ne. [Azure Relays](https://azure.microsoft.com/products/service-bus/)\n\nf. [Azure Logic Apps](https://azure.microsoft.com/products/logic-apps/)\n\ng. [Azure Log Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview)\n\n**Data Connectors:** 2, **Parsers:** 4, **Workbooks:** 2, **Analytic Rules:** 132, **Watchlists:** 11, **Playbooks:** 15\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Veeam/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nVeeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Azure Monitor Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/data-collector-api)\n\nb. [Azure Functions](https://azure.microsoft.com/products/functions/#overview)\n\nc. [Azure Key Vault](https://azure.microsoft.com/products/key-vault/)\n\nd. [Azure Storage Account](https://azure.microsoft.com/products/storage/)\n\ne. [Azure Relays](https://azure.microsoft.com/products/service-bus/)\n\nf. [Azure Logic Apps](https://azure.microsoft.com/products/logic-apps/)\n\ng. [Azure Log Analytics](https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview)\n\n**Data Connectors:** 2, **Parsers:** 10, **Workbooks:** 2, **Analytic Rules:** 132, **Watchlists:** 11, **Playbooks:** 15\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/Veeam/Package/mainTemplate.json b/Solutions/Veeam/Package/mainTemplate.json index d10c27d11e0..ea54161c42b 100644 --- a/Solutions/Veeam/Package/mainTemplate.json +++ b/Solutions/Veeam/Package/mainTemplate.json @@ -342,6 +342,48 @@ "parserVersion4": "1.0.0", "parserContentId4": "Veeam_GetSecurityEvents-Parser" }, + "parserObject5": { + "_parserName5": "[concat(parameters('workspace'),'/','VeeamAuthorizationEvents_CL')]", + "_parserId5": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamAuthorizationEvents_CL')]", + "parserTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('VeeamAuthorizationEvents_CL-Parser')))]", + "parserVersion5": "1.0.0", + "parserContentId5": "VeeamAuthorizationEvents_CL-Parser" + }, + "parserObject6": { + "_parserName6": "[concat(parameters('workspace'),'/','VeeamCovewareFindings_CL')]", + "_parserId6": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamCovewareFindings_CL')]", + "parserTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('VeeamCovewareFindings_CL-Parser')))]", + "parserVersion6": "1.0.0", + "parserContentId6": "VeeamCovewareFindings_CL-Parser" + }, + "parserObject7": { + "_parserName7": "[concat(parameters('workspace'),'/','VeeamMalwareEvents_CL')]", + "_parserId7": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamMalwareEvents_CL')]", + "parserTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('VeeamMalwareEvents_CL-Parser')))]", + "parserVersion7": "1.0.0", + "parserContentId7": "VeeamMalwareEvents_CL-Parser" + }, + "parserObject8": { + "_parserName8": "[concat(parameters('workspace'),'/','VeeamOneTriggeredAlarms_CL')]", + "_parserId8": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamOneTriggeredAlarms_CL')]", + "parserTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('VeeamOneTriggeredAlarms_CL-Parser')))]", + "parserVersion8": "1.0.0", + "parserContentId8": "VeeamOneTriggeredAlarms_CL-Parser" + }, + "parserObject9": { + "_parserName9": "[concat(parameters('workspace'),'/','VeeamSecurityComplianceAnalyzer_CL')]", + "_parserId9": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamSecurityComplianceAnalyzer_CL')]", + "parserTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('VeeamSecurityComplianceAnalyzer_CL-Parser')))]", + "parserVersion9": "1.0.0", + "parserContentId9": "VeeamSecurityComplianceAnalyzer_CL-Parser" + }, + "parserObject10": { + "_parserName10": "[concat(parameters('workspace'),'/','VeeamSessions_CL')]", + "_parserId10": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamSessions_CL')]", + "parserTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('VeeamSessions_CL-Parser')))]", + "parserVersion10": "1.0.0", + "parserContentId10": "VeeamSessions_CL-Parser" + }, "analyticRuleObject1": { "analyticRuleVersion1": "1.0.1", "_analyticRulecontentId1": "6d1a5478-e613-44f4-a48f-12cc18568522", @@ -1694,100 +1736,99 @@ "connectorUiConfig": { "id": "VeeamConnector", "title": "Veeam Data Connector (via Codeless Connector Framework)", - "graphQueriesTableName": "VeeamMalwareEvents_CL", - "publisher": "Veeam Software", - "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEvents_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzer_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEvents_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarms_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindings_CL**: Security findings from Coveware solution\n- **VeeamSessions_CL**: Veeam sessions", + "publisher": "Microsoft", + "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEventsV2_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzerV2_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEventsV2_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarmsV2_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindingsV2_CL**: Security findings from Coveware solution\n- **VeeamSessionsV2_CL**: Veeam sessions", "graphQueries": [ { "metricName": "Total malware logs received", "legend": "Malware events", - "baseQuery": "VeeamMalwareEvents_CL" + "baseQuery": "VeeamMalwareEventsV2_CL" }, { "metricName": "Critical malware events", "legend": "Critical malware events", - "baseQuery": "VeeamMalwareEvents_CL\n| where Severity == \"Critical\"" + "baseQuery": "VeeamMalwareEventsV2_CL\n| where Severity == \"Critical\"" }, { "metricName": "Total security & compliance analyzer logs received", "legend": "Security & Compliance Analyzer results", - "baseQuery": "VeeamSecurityComplianceAnalyzer_CL" + "baseQuery": "VeeamSecurityComplianceAnalyzerV2_CL" }, { "metricName": "Total veeam ONE alarms logs received", "legend": "Veeam ONE alarms", - "baseQuery": "VeeamOneTriggeredAlarms_CL" + "baseQuery": "VeeamOneTriggeredAlarmsV2_CL" }, { "metricName": "Total authorization events logs received", "legend": "Authorization events", - "baseQuery": "VeeamAuthorizationEvents_CL" + "baseQuery": "VeeamAuthorizationEventsV2_CL" }, { "metricName": "Total coveware findings logs received", "legend": "Coveware findings", - "baseQuery": "VeeamCovewareFindings_CL" + "baseQuery": "VeeamCovewareFindingsV2_CL" }, { "metricName": "Total session logs received", "legend": "Session logs", - "baseQuery": "VeeamSessions_CL" + "baseQuery": "VeeamSessionsV2_CL" } ], "sampleQueries": [ { "description": "Malware Events", - "query": "VeeamMalwareEvents_CL\n | sort by TimeGenerated desc" + "query": "VeeamMalwareEventsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Critical Malware Events", - "query": "VeeamMalwareEvents_CL\n | where Severity == \"Critical\"\n | sort by TimeGenerated desc" + "query": "VeeamMalwareEventsV2_CL\n | where Severity == \"Critical\"\n | sort by TimeGenerated desc" }, { "description": "Security Compliance Results", - "query": "VeeamSecurityComplianceAnalyzer_CL\n | sort by TimeGenerated desc" + "query": "VeeamSecurityComplianceAnalyzerV2_CL\n | sort by TimeGenerated desc" }, { "description": "Veeam ONE Alarms", - "query": "VeeamOneTriggeredAlarms_CL\n | sort by TimeGenerated desc" + "query": "VeeamOneTriggeredAlarmsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Authorization Events", - "query": "VeeamAuthorizationEvents_CL\n | sort by TimeGenerated desc" + "query": "VeeamAuthorizationEventsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Coveware Security Findings", - "query": "VeeamCovewareFindings_CL\n | sort by TimeGenerated desc" + "query": "VeeamCovewareFindingsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Session events", - "query": "VeeamSessions_CL\n | sort by TimeGenerated desc" + "query": "VeeamSessionsV2_CL\n | sort by TimeGenerated desc" } ], "dataTypes": [ { - "name": "VeeamMalwareEvents_CL", - "lastDataReceivedQuery": "VeeamMalwareEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamMalwareEventsV2_CL", + "lastDataReceivedQuery": "VeeamMalwareEventsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamSecurityComplianceAnalyzer_CL", - "lastDataReceivedQuery": "VeeamSecurityComplianceAnalyzer_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamSecurityComplianceAnalyzerV2_CL", + "lastDataReceivedQuery": "VeeamSecurityComplianceAnalyzerV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamOneTriggeredAlarms_CL", - "lastDataReceivedQuery": "VeeamOneTriggeredAlarms_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamOneTriggeredAlarmsV2_CL", + "lastDataReceivedQuery": "VeeamOneTriggeredAlarmsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamAuthorizationEvents_CL", - "lastDataReceivedQuery": "VeeamAuthorizationEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamAuthorizationEventsV2_CL", + "lastDataReceivedQuery": "VeeamAuthorizationEventsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamCovewareFindings_CL", - "lastDataReceivedQuery": "VeeamCovewareFindings_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamCovewareFindingsV2_CL", + "lastDataReceivedQuery": "VeeamCovewareFindingsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamSessions_CL", - "lastDataReceivedQuery": "VeeamSessions_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamSessionsV2_CL", + "lastDataReceivedQuery": "VeeamSessionsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ @@ -1832,7 +1873,7 @@ }, "instructionSteps": [ { - "title": "Prerequisites", + "title": "", "description": "Follow the instructions to configure the Veeam Data Connector.", "instructions": [ { @@ -1976,8 +2017,7 @@ } ] } - ], - "isConnectivityCriteriasMatchSome": false + ] } } }, @@ -2025,7 +2065,7 @@ "properties": { "dataCollectionEndpointId": "[variables('dataCollectionEndpointId2')]", "streamDeclarations": { - "Custom-VeeamCovewareFindings_CL": { + "Custom-VeeamCovewareFindingsV2_CL": { "columns": [ { "name": "covewareHostName", @@ -2089,7 +2129,7 @@ } ] }, - "Custom-VeeamMalwareEvents_CL": { + "Custom-VeeamMalwareEventsV2_CL": { "columns": [ { "name": "vbrHostName", @@ -2137,7 +2177,7 @@ } ] }, - "Custom-VeeamOneTriggeredAlarms_CL": { + "Custom-VeeamOneTriggeredAlarmsV2_CL": { "columns": [ { "name": "voneHostName", @@ -2193,7 +2233,7 @@ } ] }, - "Custom-VeeamSecurityComplianceAnalyzer_CL": { + "Custom-VeeamSecurityComplianceAnalyzerV2_CL": { "columns": [ { "name": "vbrHostName", @@ -2217,7 +2257,7 @@ } ] }, - "Custom-VeeamSessions_CL": { + "Custom-VeeamSessionsV2_CL": { "columns": [ { "name": "vbrHostName", @@ -2285,7 +2325,7 @@ } ] }, - "Custom-VeeamAuthorizationEvents_CL": { + "Custom-VeeamAuthorizationEventsV2_CL": { "columns": [ { "name": "vbrHostName", @@ -2341,69 +2381,69 @@ "dataFlows": [ { "streams": [ - "Custom-VeeamMalwareEvents_CL" + "Custom-VeeamMalwareEventsV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamMalwareEvents_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(detectionTimeUtc), now(), todatetime(detectionTimeUtc)) , VbrHostName = ['vbrHostName'] , MalwareEventType = ['type'] , MalwareState = ['state'] , Source = ['source'] , Severity = ['severity'] , Id = ['id'] , DetectionTimeUtc = ['detectionTimeUtc'] , MachineDisplayName = tostring(machine.displayName) , MachineUuid = tostring(machine.uuid) , MachineBackupObjectId = tostring(machine.backupObjectId) , Details = ['details'] , CreatedBy = ['createdBy'] , Engine = ['engine'] | project TimeGenerated , VbrHostName , MalwareEventType , MalwareState , Source , Severity , Id , DetectionTimeUtc , MachineDisplayName , MachineUuid , MachineBackupObjectId , Details , CreatedBy , Engine" + "outputStream": "Custom-VeeamMalwareEventsV2_CL", + "transformKql": "source | extend TimeGenerated = now() , VbrHostName = ['vbrHostName'] , MalwareEventType = ['type'] , MalwareState = ['state'] , Source = ['source'] , Severity = ['severity'] , Id = ['id'] , DetectionTimeUtc = ['detectionTimeUtc'] , MachineDisplayName = tostring(machine.displayName) , MachineUuid = tostring(machine.uuid) , MachineBackupObjectId = tostring(machine.backupObjectId) , Details = ['details'] , CreatedBy = ['createdBy'] , Engine = ['engine'] | project TimeGenerated , VbrHostName , MalwareEventType , MalwareState , Source , Severity , Id , DetectionTimeUtc , MachineDisplayName , MachineUuid , MachineBackupObjectId , Details , CreatedBy , Engine" }, { "streams": [ - "Custom-VeeamSecurityComplianceAnalyzer_CL" + "Custom-VeeamSecurityComplianceAnalyzerV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamSecurityComplianceAnalyzer_CL", + "outputStream": "Custom-VeeamSecurityComplianceAnalyzerV2_CL", "transformKql": "source | extend TimeGenerated = now() , VbrHostName = ['vbrHostName'] , Status = ['status'] , Id = ['id'] , BestPractice = ['bestPractice'] , Note = ['note'] | project TimeGenerated , VbrHostName , Status , Id , BestPractice , Note" }, { "streams": [ - "Custom-VeeamOneTriggeredAlarms_CL" + "Custom-VeeamOneTriggeredAlarmsV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamOneTriggeredAlarms_CL", + "outputStream": "Custom-VeeamOneTriggeredAlarmsV2_CL", "transformKql": "source | extend TimeGenerated = now() , VoneHostName = ['voneHostName'] , TriggeredAlarmId = ['triggeredAlarmId'] , Name = ['name'] , AlarmTemplateId = ['alarmTemplateId'] , PredefinedAlarmId = ['predefinedAlarmId'] , TriggeredTime = ['triggeredTime'] , Status = ['status'] , Description = ['description'] , Comment = ['comment'] , RepeatCount = ['repeatCount'] , ObjectId = toint(alarmSource.objectId) , ObjectName = tostring(alarmSource.objectName) , ObjectType = tostring(alarmSource.objectType) , ChildAlarmsCount = ['childAlarmsCount'] , RemediationDescription = tostring(remediation.description) , RemediationMode = tostring(remediation.mode) | project TimeGenerated , VoneHostName , TriggeredAlarmId , Name , AlarmTemplateId , PredefinedAlarmId , TriggeredTime , Status , Description , Comment , RepeatCount , ObjectId , ObjectName , ObjectType , ChildAlarmsCount , RemediationDescription , RemediationMode" }, { "streams": [ - "Custom-VeeamAuthorizationEvents_CL" + "Custom-VeeamAuthorizationEventsV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamAuthorizationEvents_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" + "outputStream": "Custom-VeeamAuthorizationEventsV2_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" }, { "streams": [ - "Custom-VeeamCovewareFindings_CL" + "Custom-VeeamCovewareFindingsV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamCovewareFindings_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(eventTime), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" + "outputStream": "Custom-VeeamCovewareFindingsV2_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(eventTime), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" }, { "streams": [ - "Custom-VeeamSessions_CL" + "Custom-VeeamSessionsV2_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-VeeamSessions_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" + "outputStream": "Custom-VeeamSessionsV2_CL", + "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" } ] } }, { - "name": "VeeamSessions_CL", + "name": "VeeamSessionsV2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", @@ -2411,7 +2451,7 @@ "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamSessions_CL", + "name": "VeeamSessionsV2_CL", "description": "Veeam comprehensive session data including backup, restore, and other operations with detailed status and progress information.", "columns": [ { @@ -2529,7 +2569,7 @@ } }, { - "name": "VeeamAuthorizationEvents_CL", + "name": "VeeamAuthorizationEventsV2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", @@ -2537,7 +2577,7 @@ "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamAuthorizationEvents_CL", + "name": "VeeamAuthorizationEventsV2_CL", "description": "Veeam authorization and authentication events for security monitoring and access control.", "columns": [ { @@ -2600,7 +2640,7 @@ } }, { - "name": "VeeamCovewareFindings_CL", + "name": "VeeamCovewareFindingsV2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", @@ -2608,7 +2648,7 @@ "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamCovewareFindings_CL", + "name": "VeeamCovewareFindingsV2_CL", "description": "Coveware security findings and threat intelligence from Veeam backup systems.", "columns": [ { @@ -2706,7 +2746,7 @@ } }, { - "name": "VeeamMalwareEvents_CL", + "name": "VeeamMalwareEventsV2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", @@ -2714,7 +2754,7 @@ "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamMalwareEvents_CL", + "name": "VeeamMalwareEventsV2_CL", "description": "Veeam Backup & Replication malware detection events and security threats.", "columns": [ { @@ -2792,7 +2832,7 @@ } }, { - "name": "VeeamOneTriggeredAlarms_CL", + "name": "VeeamOneTriggeredAlarmsV2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", @@ -2800,7 +2840,7 @@ "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamOneTriggeredAlarms_CL", + "name": "VeeamOneTriggeredAlarmsV2_CL", "description": "Veeam ONE triggered alarms and monitoring alerts from Veeam infrastructure.", "columns": [ { @@ -2893,7 +2933,7 @@ } }, { - "name": "VeeamSecurityComplianceAnalyzer_CL", + "name": "VeeamSecurityComplianceAnalyzerV2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", @@ -2901,7 +2941,7 @@ "properties": { "retentionInDays": 180, "schema": { - "name": "VeeamSecurityComplianceAnalyzer_CL", + "name": "VeeamSecurityComplianceAnalyzerV2_CL", "description": "Veeam Security & Compliance Analyzer best practice assessments and compliance results.", "columns": [ { @@ -2959,100 +2999,99 @@ "connectorUiConfig": { "id": "VeeamConnector", "title": "Veeam Data Connector (via Codeless Connector Framework)", - "graphQueriesTableName": "VeeamMalwareEvents_CL", - "publisher": "Veeam Software", - "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEvents_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzer_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEvents_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarms_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindings_CL**: Security findings from Coveware solution\n- **VeeamSessions_CL**: Veeam sessions", + "publisher": "Microsoft", + "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEventsV2_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzerV2_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEventsV2_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarmsV2_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindingsV2_CL**: Security findings from Coveware solution\n- **VeeamSessionsV2_CL**: Veeam sessions", "graphQueries": [ { "metricName": "Total malware logs received", "legend": "Malware events", - "baseQuery": "VeeamMalwareEvents_CL" + "baseQuery": "VeeamMalwareEventsV2_CL" }, { "metricName": "Critical malware events", "legend": "Critical malware events", - "baseQuery": "VeeamMalwareEvents_CL\n| where Severity == \"Critical\"" + "baseQuery": "VeeamMalwareEventsV2_CL\n| where Severity == \"Critical\"" }, { "metricName": "Total security & compliance analyzer logs received", "legend": "Security & Compliance Analyzer results", - "baseQuery": "VeeamSecurityComplianceAnalyzer_CL" + "baseQuery": "VeeamSecurityComplianceAnalyzerV2_CL" }, { "metricName": "Total veeam ONE alarms logs received", "legend": "Veeam ONE alarms", - "baseQuery": "VeeamOneTriggeredAlarms_CL" + "baseQuery": "VeeamOneTriggeredAlarmsV2_CL" }, { "metricName": "Total authorization events logs received", "legend": "Authorization events", - "baseQuery": "VeeamAuthorizationEvents_CL" + "baseQuery": "VeeamAuthorizationEventsV2_CL" }, { "metricName": "Total coveware findings logs received", "legend": "Coveware findings", - "baseQuery": "VeeamCovewareFindings_CL" + "baseQuery": "VeeamCovewareFindingsV2_CL" }, { "metricName": "Total session logs received", "legend": "Session logs", - "baseQuery": "VeeamSessions_CL" + "baseQuery": "VeeamSessionsV2_CL" } ], "sampleQueries": [ { "description": "Malware Events", - "query": "VeeamMalwareEvents_CL\n | sort by TimeGenerated desc" + "query": "VeeamMalwareEventsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Critical Malware Events", - "query": "VeeamMalwareEvents_CL\n | where Severity == \"Critical\"\n | sort by TimeGenerated desc" + "query": "VeeamMalwareEventsV2_CL\n | where Severity == \"Critical\"\n | sort by TimeGenerated desc" }, { "description": "Security Compliance Results", - "query": "VeeamSecurityComplianceAnalyzer_CL\n | sort by TimeGenerated desc" + "query": "VeeamSecurityComplianceAnalyzerV2_CL\n | sort by TimeGenerated desc" }, { "description": "Veeam ONE Alarms", - "query": "VeeamOneTriggeredAlarms_CL\n | sort by TimeGenerated desc" + "query": "VeeamOneTriggeredAlarmsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Authorization Events", - "query": "VeeamAuthorizationEvents_CL\n | sort by TimeGenerated desc" + "query": "VeeamAuthorizationEventsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Coveware Security Findings", - "query": "VeeamCovewareFindings_CL\n | sort by TimeGenerated desc" + "query": "VeeamCovewareFindingsV2_CL\n | sort by TimeGenerated desc" }, { "description": "Session events", - "query": "VeeamSessions_CL\n | sort by TimeGenerated desc" + "query": "VeeamSessionsV2_CL\n | sort by TimeGenerated desc" } ], "dataTypes": [ { - "name": "VeeamMalwareEvents_CL", - "lastDataReceivedQuery": "VeeamMalwareEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamMalwareEventsV2_CL", + "lastDataReceivedQuery": "VeeamMalwareEventsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamSecurityComplianceAnalyzer_CL", - "lastDataReceivedQuery": "VeeamSecurityComplianceAnalyzer_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamSecurityComplianceAnalyzerV2_CL", + "lastDataReceivedQuery": "VeeamSecurityComplianceAnalyzerV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamOneTriggeredAlarms_CL", - "lastDataReceivedQuery": "VeeamOneTriggeredAlarms_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamOneTriggeredAlarmsV2_CL", + "lastDataReceivedQuery": "VeeamOneTriggeredAlarmsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamAuthorizationEvents_CL", - "lastDataReceivedQuery": "VeeamAuthorizationEvents_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamAuthorizationEventsV2_CL", + "lastDataReceivedQuery": "VeeamAuthorizationEventsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamCovewareFindings_CL", - "lastDataReceivedQuery": "VeeamCovewareFindings_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamCovewareFindingsV2_CL", + "lastDataReceivedQuery": "VeeamCovewareFindingsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "VeeamSessions_CL", - "lastDataReceivedQuery": "VeeamSessions_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "VeeamSessionsV2_CL", + "lastDataReceivedQuery": "VeeamSessionsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ @@ -3097,7 +3136,7 @@ }, "instructionSteps": [ { - "title": "Prerequisites", + "title": "", "description": "Follow the instructions to configure the Veeam Data Connector.", "instructions": [ { @@ -3241,8 +3280,7 @@ } ] } - ], - "isConnectivityCriteriasMatchSome": false + ] } } }, @@ -3428,9 +3466,9 @@ "pageSizeParameterName": "limit" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamMalwareEvents_CL", + "dataType": "VeeamMalwareEventsV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamMalwareEvents_CL", + "streamName": "Custom-VeeamMalwareEventsV2_CL", "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" } @@ -3478,9 +3516,9 @@ "pageSizeParameterName": "page-size" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamCovewareFindings_CL", + "dataType": "VeeamCovewareFindingsV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamCovewareFindings_CL", + "streamName": "Custom-VeeamCovewareFindingsV2_CL", "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" } @@ -3524,9 +3562,9 @@ "pageSizeParameterName": "Limit" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamOneTriggeredAlarms_CL", + "dataType": "VeeamOneTriggeredAlarmsV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamOneTriggeredAlarms_CL", + "streamName": "Custom-VeeamOneTriggeredAlarmsV2_CL", "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" } @@ -3565,9 +3603,9 @@ "format": "json" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamSecurityComplianceAnalyzer_CL", + "dataType": "VeeamSecurityComplianceAnalyzerV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamSecurityComplianceAnalyzer_CL", + "streamName": "Custom-VeeamSecurityComplianceAnalyzerV2_CL", "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" } @@ -3619,9 +3657,9 @@ "pageSizeParameterName": "limit" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamAuthorizationEvents_CL", + "dataType": "VeeamAuthorizationEventsV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamAuthorizationEvents_CL", + "streamName": "Custom-VeeamAuthorizationEventsV2_CL", "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" } @@ -3674,9 +3712,9 @@ "pageSizeParameterName": "limit" }, "connectorDefinitionName": "VeeamConnector", - "dataType": "VeeamSessions_CL", + "dataType": "VeeamSessionsV2_CL", "dcrConfig": { - "streamName": "Custom-VeeamSessions_CL", + "streamName": "Custom-VeeamSessionsV2_CL", "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" } @@ -13190,77 +13228,55 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", + "name": "[variables('parserObject5').parserTemplateSpecName5]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Adding_User_or_Group_Failed_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "parser_VeeamAuthorizationEventsV2AliasFunction Data Parser with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "contentVersion": "[variables('parserObject5').parserVersion5]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", + "name": "[variables('parserObject5')._parserName5]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects failed attempts to add a user or user group to Veeam Backup & Replication.", - "displayName": "Adding User or Group Failed", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 31210\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "PT3H", - "queryPeriod": "PT3H", - "severity": "Low", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "connectorId": "Syslog", - "dataTypes": [ - "Syslog" - ] - }, + "eTag": "*", + "displayName": "VeeamAuthorizationEvents_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamAuthorizationEvents_CL", + "query": "union isfuzzy=true VeeamAuthorizationEventsV2_CL, VeeamAuthorizationEvents_CL", + "functionParameters": "", + "version": 2, + "tags": [ { - "connectorId": "SyslogAma", - "dataTypes": [ - "Syslog" - ] + "name": "description", + "value": "VeeamAuthorizationEvents_CL" } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject5')._parserId5,'/'))))]", + "dependsOn": [ + "[variables('parserObject5')._parserId5]" + ], "properties": { - "description": "Veeam Analytics Rule 1", - "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", - "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamAuthorizationEvents_CL')]", + "contentId": "[variables('parserObject5').parserContentId5]", + "kind": "Parser", + "version": "[variables('parserObject5').parserVersion5]", "source": { - "kind": "Solution", "name": "Veeam", + "kind": "Solution", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -13282,88 +13298,117 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", - "contentKind": "AnalyticsRule", - "displayName": "Adding User or Group Failed", - "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", - "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", - "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + "contentId": "[variables('parserObject5').parserContentId5]", + "contentKind": "Parser", + "displayName": "VeeamAuthorizationEvents_CL", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject5').parserContentId5,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject5').parserContentId5,'-', '1.0.0')))]", + "version": "[variables('parserObject5').parserVersion5]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject5')._parserName5]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "VeeamAuthorizationEvents_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamAuthorizationEvents_CL", + "query": "union isfuzzy=true VeeamAuthorizationEventsV2_CL, VeeamAuthorizationEvents_CL", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "VeeamAuthorizationEvents_CL" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject5')._parserId5,'/'))))]", + "dependsOn": [ + "[variables('parserObject5')._parserId5]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamAuthorizationEvents_CL')]", + "contentId": "[variables('parserObject5').parserContentId5]", + "kind": "Parser", + "version": "[variables('parserObject5').parserVersion5]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", + "name": "[variables('parserObject6').parserTemplateSpecName6]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Application_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "parser_VeeamCovewareFindingsV2AliasFunction Data Parser with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", + "contentVersion": "[variables('parserObject6').parserVersion6]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", + "name": "[variables('parserObject6')._parserName6]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects when an application group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", - "displayName": "Application Group Deleted", - "enabled": false, - "query": "Veeam_GetSecurityEvents\n| where instanceId == 30500\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Application Group Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", - "queryFrequency": "P1D", - "queryPeriod": "P1D", - "severity": "Informational", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "connectorId": "Syslog", - "dataTypes": [ - "Syslog" - ] - }, + "eTag": "*", + "displayName": "VeeamCovewareFindings_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamCovewareFindings_CL", + "query": "union isfuzzy=true VeeamCovewareFindingsV2_CL, VeeamCovewareFindings_CL", + "functionParameters": "", + "version": 2, + "tags": [ { - "connectorId": "SyslogAma", - "dataTypes": [ - "Syslog" - ] + "name": "description", + "value": "VeeamCovewareFindings_CL" } - ], - "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" - }, - "customDetails": { - "EventId": "EventId", - "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" - } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject6')._parserId6,'/'))))]", + "dependsOn": [ + "[variables('parserObject6')._parserId6]" + ], "properties": { - "description": "Veeam Analytics Rule 2", - "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", - "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamCovewareFindings_CL')]", + "contentId": "[variables('parserObject6').parserContentId6]", + "kind": "Parser", + "version": "[variables('parserObject6').parserVersion6]", "source": { - "kind": "Solution", "name": "Veeam", + "kind": "Solution", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -13385,35 +13430,820 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", - "contentKind": "AnalyticsRule", - "displayName": "Application Group Deleted", - "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", - "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", - "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + "contentId": "[variables('parserObject6').parserContentId6]", + "contentKind": "Parser", + "displayName": "VeeamCovewareFindings_CL", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject6').parserContentId6,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject6').parserContentId6,'-', '1.0.0')))]", + "version": "[variables('parserObject6').parserVersion6]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject6')._parserName6]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "VeeamCovewareFindings_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamCovewareFindings_CL", + "query": "union isfuzzy=true VeeamCovewareFindingsV2_CL, VeeamCovewareFindings_CL", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "VeeamCovewareFindings_CL" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject6')._parserId6,'/'))))]", + "dependsOn": [ + "[variables('parserObject6')._parserId6]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamCovewareFindings_CL')]", + "contentId": "[variables('parserObject6').parserContentId6]", + "kind": "Parser", + "version": "[variables('parserObject6').parserVersion6]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]", + "name": "[variables('parserObject7').parserTemplateSpecName7]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Application_Group_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "parser_VeeamMalwareEventsV2AliasFunction Data Parser with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", + "contentVersion": "[variables('parserObject7').parserVersion7]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]", - "apiVersion": "2023-02-01-preview", - "kind": "Scheduled", + "name": "[variables('parserObject7')._parserName7]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "VeeamMalwareEvents_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamMalwareEvents_CL", + "query": "union isfuzzy=true VeeamMalwareEventsV2_CL, VeeamMalwareEvents_CL", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "VeeamMalwareEvents_CL" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject7')._parserId7,'/'))))]", + "dependsOn": [ + "[variables('parserObject7')._parserId7]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamMalwareEvents_CL')]", + "contentId": "[variables('parserObject7').parserContentId7]", + "kind": "Parser", + "version": "[variables('parserObject7').parserVersion7]", + "source": { + "name": "Veeam", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject7').parserContentId7]", + "contentKind": "Parser", + "displayName": "VeeamMalwareEvents_CL", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.0.0')))]", + "version": "[variables('parserObject7').parserVersion7]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject7')._parserName7]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "VeeamMalwareEvents_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamMalwareEvents_CL", + "query": "union isfuzzy=true VeeamMalwareEventsV2_CL, VeeamMalwareEvents_CL", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "VeeamMalwareEvents_CL" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject7')._parserId7,'/'))))]", + "dependsOn": [ + "[variables('parserObject7')._parserId7]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamMalwareEvents_CL')]", + "contentId": "[variables('parserObject7').parserContentId7]", + "kind": "Parser", + "version": "[variables('parserObject7').parserVersion7]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject8').parserTemplateSpecName8]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "parser_VeeamOneTriggeredAlarmsV2AliasFunction Data Parser with template version 3.1.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject8').parserVersion8]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject8')._parserName8]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "VeeamOneTriggeredAlarms_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamOneTriggeredAlarms_CL", + "query": "union isfuzzy=true VeeamOneTriggeredAlarmsV2_CL, VeeamOneTriggeredAlarms_CL", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "VeeamOneTriggeredAlarms_CL" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject8')._parserId8,'/'))))]", + "dependsOn": [ + "[variables('parserObject8')._parserId8]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamOneTriggeredAlarms_CL')]", + "contentId": "[variables('parserObject8').parserContentId8]", + "kind": "Parser", + "version": "[variables('parserObject8').parserVersion8]", + "source": { + "name": "Veeam", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject8').parserContentId8]", + "contentKind": "Parser", + "displayName": "VeeamOneTriggeredAlarms_CL", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject8').parserContentId8,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject8').parserContentId8,'-', '1.0.0')))]", + "version": "[variables('parserObject8').parserVersion8]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject8')._parserName8]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "VeeamOneTriggeredAlarms_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamOneTriggeredAlarms_CL", + "query": "union isfuzzy=true VeeamOneTriggeredAlarmsV2_CL, VeeamOneTriggeredAlarms_CL", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "VeeamOneTriggeredAlarms_CL" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject8')._parserId8,'/'))))]", + "dependsOn": [ + "[variables('parserObject8')._parserId8]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamOneTriggeredAlarms_CL')]", + "contentId": "[variables('parserObject8').parserContentId8]", + "kind": "Parser", + "version": "[variables('parserObject8').parserVersion8]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject9').parserTemplateSpecName9]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "parser_VeeamSecurityComplianceAnalyzerV2AliasFunction Data Parser with template version 3.1.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject9').parserVersion9]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject9')._parserName9]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "VeeamSecurityComplianceAnalyzer_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamSecurityComplianceAnalyzer_CL", + "query": "union isfuzzy=true VeeamSecurityComplianceAnalyzerV2_CL, VeeamSecurityComplianceAnalyzer_CL", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "VeeamSecurityComplianceAnalyzer_CL" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject9')._parserId9,'/'))))]", + "dependsOn": [ + "[variables('parserObject9')._parserId9]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamSecurityComplianceAnalyzer_CL')]", + "contentId": "[variables('parserObject9').parserContentId9]", + "kind": "Parser", + "version": "[variables('parserObject9').parserVersion9]", + "source": { + "name": "Veeam", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject9').parserContentId9]", + "contentKind": "Parser", + "displayName": "VeeamSecurityComplianceAnalyzer_CL", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject9').parserContentId9,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject9').parserContentId9,'-', '1.0.0')))]", + "version": "[variables('parserObject9').parserVersion9]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject9')._parserName9]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "VeeamSecurityComplianceAnalyzer_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamSecurityComplianceAnalyzer_CL", + "query": "union isfuzzy=true VeeamSecurityComplianceAnalyzerV2_CL, VeeamSecurityComplianceAnalyzer_CL", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "VeeamSecurityComplianceAnalyzer_CL" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject9')._parserId9,'/'))))]", + "dependsOn": [ + "[variables('parserObject9')._parserId9]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamSecurityComplianceAnalyzer_CL')]", + "contentId": "[variables('parserObject9').parserContentId9]", + "kind": "Parser", + "version": "[variables('parserObject9').parserVersion9]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject10').parserTemplateSpecName10]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "parser_VeeamSessionsV2AliasFunction Data Parser with template version 3.1.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject10').parserVersion10]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject10')._parserName10]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "VeeamSessions_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamSessions_CL", + "query": "union isfuzzy=true (VeeamSessionsV2_CL | extend ResourceId = iff(isempty(tostring(column_ifexists('ResourceId', ''))), tostring(column_ifexists('VeeamResourceId', '')), tostring(column_ifexists('ResourceId', '')))),(VeeamSessions_CL | extend ResourceId = iff(isempty(tostring(column_ifexists('ResourceId', ''))), tostring(column_ifexists('VeeamResourceId', '')), tostring(column_ifexists('ResourceId', ''))))", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "VeeamSessions_CL" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject10')._parserId10,'/'))))]", + "dependsOn": [ + "[variables('parserObject10')._parserId10]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamSessions_CL')]", + "contentId": "[variables('parserObject10').parserContentId10]", + "kind": "Parser", + "version": "[variables('parserObject10').parserVersion10]", + "source": { + "name": "Veeam", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject10').parserContentId10]", + "contentKind": "Parser", + "displayName": "VeeamSessions_CL", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject10').parserContentId10,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject10').parserContentId10,'-', '1.0.0')))]", + "version": "[variables('parserObject10').parserVersion10]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject10')._parserName10]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "VeeamSessions_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamSessions_CL", + "query": "union isfuzzy=true (VeeamSessionsV2_CL | extend ResourceId = iff(isempty(tostring(column_ifexists('ResourceId', ''))), tostring(column_ifexists('VeeamResourceId', '')), tostring(column_ifexists('ResourceId', '')))),(VeeamSessions_CL | extend ResourceId = iff(isempty(tostring(column_ifexists('ResourceId', ''))), tostring(column_ifexists('VeeamResourceId', '')), tostring(column_ifexists('ResourceId', ''))))", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "VeeamSessions_CL" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject10')._parserId10,'/'))))]", + "dependsOn": [ + "[variables('parserObject10')._parserId10]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'VeeamSessions_CL')]", + "contentId": "[variables('parserObject10').parserContentId10]", + "kind": "Parser", + "version": "[variables('parserObject10').parserVersion10]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Adding_User_or_Group_Failed_AnalyticalRules Analytics Rule with template version 3.1.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects failed attempts to add a user or user group to Veeam Backup & Replication.", + "displayName": "Adding User or Group Failed", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 31210\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "PT3H", + "queryPeriod": "PT3H", + "severity": "Low", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "Syslog" + ], + "connectorId": "Syslog" + }, + { + "dataTypes": [ + "Syslog" + ], + "connectorId": "SyslogAma" + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "MessageDetails": "MessageDetails", + "Severity": "Severity", + "VbrHostName": "DataSource" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 1", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "contentKind": "AnalyticsRule", + "displayName": "Adding User or Group Failed", + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Application_Group_Deleted_AnalyticalRules Analytics Rule with template version 3.1.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detects when an application group is deleted from Veeam Backup & Replication. This might indicate unauthorized removal of critical components.", + "displayName": "Application Group Deleted", + "enabled": false, + "query": "Veeam_GetSecurityEvents\n| where instanceId == 30500\n| extend Name = extract(\"Name=\\\"([^\\\"]*)\\\"\", 1, SyslogMessage)\n| project\n Date = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n DataSource = original_host,\n EventId = instanceId,\n UserName = user,\n [\"Application Group Name\"] = Name,\n MessageDetails = Description,\n Severity = SeverityDescription", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "Syslog" + ], + "connectorId": "Syslog" + }, + { + "dataTypes": [ + "Syslog" + ], + "connectorId": "SyslogAma" + } + ], + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + }, + "customDetails": { + "Date": "Date", + "EventId": "EventId", + "MessageDetails": "MessageDetails", + "Severity": "Severity", + "VbrHostName": "DataSource" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", + "properties": { + "description": "Veeam Analytics Rule 2", + "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", + "source": { + "kind": "Solution", + "name": "Veeam", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Veeam Software", + "email": "[variables('_email')]" + }, + "support": { + "name": "Veeam Software", + "email": "microsoftappsupport@veeam.com", + "tier": "Partner", + "link": "https://helpcenter.veeam.com/docs/security_plugins_microsoft_sentinel/guide/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "contentKind": "AnalyticsRule", + "displayName": "Application Group Deleted", + "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Application_Group_Settings_Updated_AnalyticalRules Analytics Rule with template version 3.1.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "Detects when application group settings are updated in Veeam Backup & Replication. This might indicate configuration changes that require review.", @@ -13430,27 +14260,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -13533,27 +14363,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -13636,27 +14466,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -13739,27 +14569,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -13842,27 +14672,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -13945,27 +14775,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -14048,27 +14878,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -14151,27 +14981,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -14254,27 +15084,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -14357,27 +15187,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -14460,27 +15290,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -14563,27 +15393,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -14666,27 +15496,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -14769,26 +15599,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Date": "Date", - "DataSource": "DataSource" + "DataSource": "DataSource", + "MessageDetails": "MessageDetails", + "EventId": "EventId" } } }, @@ -14871,27 +15701,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -14974,27 +15804,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -15077,27 +15907,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -15180,27 +16010,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -15283,27 +16113,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -15386,27 +16216,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -15489,27 +16319,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -15592,27 +16422,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -15695,27 +16525,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -15798,27 +16628,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -15901,27 +16731,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -16004,27 +16834,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -16107,27 +16937,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -16210,27 +17040,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -16313,27 +17143,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -16416,27 +17246,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -16519,27 +17349,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -16622,27 +17452,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -16725,27 +17555,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -16828,27 +17658,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -16931,27 +17761,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -17034,27 +17864,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -17137,27 +17967,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -17240,27 +18070,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -17343,27 +18173,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -17446,27 +18276,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -17549,27 +18379,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -17652,27 +18482,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -17755,27 +18585,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -17858,27 +18688,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DataSource", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "DataSource" } - ] + ], + "entityType": "Host" } ], "eventGroupingSettings": { @@ -17968,27 +18798,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -18071,27 +18901,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -18174,27 +19004,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -18277,27 +19107,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -18380,27 +19210,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -18483,27 +19313,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -18586,27 +19416,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -18689,27 +19519,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -18792,27 +19622,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -18895,27 +19725,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -18998,27 +19828,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -19101,27 +19931,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -19204,27 +20034,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -19307,27 +20137,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -19410,29 +20240,29 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "MessageDetails": "MessageDetails", + "EventId": "EventId", "MachineUuid": "MachineUuid", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource", - "EventId": "EventId", "MachineDisplayName": "MachineDisplayName", - "Date": "Date" + "Date": "Date", + "VbrHostName": "DataSource" } } }, @@ -19515,27 +20345,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -19618,27 +20448,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -19721,27 +20551,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -19824,30 +20654,30 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamMalwareEvents_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "VbrHostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "VbrHostName" } - ] + ], + "entityType": "Host" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "MachineUuid": "MachineUuid", "MachineDisplayName": "MachineDisplayName", "BackupObjectId": "MachineBackupObjectId", - "MachineUuid": "MachineUuid", "VbrHostName": "VbrHostName" } } @@ -19931,27 +20761,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -20034,27 +20864,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -20137,27 +20967,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -20240,27 +21070,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -20343,27 +21173,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -20446,27 +21276,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -20549,27 +21379,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -20652,27 +21482,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -20755,27 +21585,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -20858,27 +21688,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -20961,27 +21791,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -21064,27 +21894,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -21167,27 +21997,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -21270,27 +22100,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -21373,27 +22203,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -21476,27 +22306,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -21579,27 +22409,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -21682,27 +22512,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -21785,27 +22615,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -21888,27 +22718,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -21991,27 +22821,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -22094,27 +22924,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -22197,27 +23027,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -22300,27 +23130,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -22403,27 +23233,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -22506,27 +23336,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -22609,27 +23439,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -22712,27 +23542,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -22815,27 +23645,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -22918,27 +23748,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -23021,27 +23851,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -23124,27 +23954,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -23227,27 +24057,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -23330,27 +24160,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -23433,27 +24263,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -23536,27 +24366,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -23639,27 +24469,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -23742,27 +24572,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -23845,27 +24675,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -23948,27 +24778,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -24051,27 +24881,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -24154,27 +24984,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -24257,27 +25087,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -24360,21 +25190,21 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamSecurityComplianceAnalyzer_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", - "Id": "Id", + "BestPracticeName": "BestPractice", "TenantId": "TenantId", + "Id": "Id", + "Status": "Status", "VbrHostName": "VbrHostName", - "BestPracticeName": "BestPractice", "Note": "Note" } } @@ -24458,26 +25288,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -24561,26 +25391,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -24664,26 +25494,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -24767,26 +25597,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -24870,26 +25700,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -24973,26 +25803,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -25076,26 +25906,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -25179,26 +26009,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -25282,26 +26112,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -25385,26 +26215,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -25488,26 +26318,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -25591,26 +26421,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -25694,26 +26524,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -25797,26 +26627,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -25900,26 +26730,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -26003,26 +26833,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -26106,26 +26936,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -26209,26 +27039,26 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamOneTriggeredAlarms_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Status": "Status", + "ObjectType": "ObjectType", "Comment": "Comment", - "ObjectName": "ObjectName", - "TriggeredAlarmId": "TriggeredAlarmId", "PredefinedAlarmId": "PredefinedAlarmId", - "TriggeredTime": "TriggeredTime", - "ObjectType": "ObjectType", + "Name": "Name", + "Status": "Status", "VoneHostName": "VoneHostName", + "TriggeredAlarmId": "TriggeredAlarmId", "ObjectId": "ObjectId", - "Name": "Name", + "TriggeredTime": "TriggeredTime", + "ObjectName": "ObjectName", "Description": "Description" } } @@ -26312,27 +27142,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -26415,27 +27245,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -26518,27 +27348,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -26621,27 +27451,27 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "SyslogAma", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "SyslogAma" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "Date": "Date", "EventId": "EventId", + "MessageDetails": "MessageDetails", "Severity": "Severity", - "Date": "Date", - "VbrHostName": "DataSource", - "MessageDetails": "MessageDetails" + "VbrHostName": "DataSource" } } }, @@ -26724,21 +27554,21 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "VeeamCustomTablesDataConnector", "dataTypes": [ "VeeamSessions_CL" - ] + ], + "connectorId": "VeeamCustomTablesDataConnector" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "SessionId": "SessionId", "Name": "Name", - "SessionType": "SessionType", "VbrHostName": "VbrHostName", - "Result": "Result" + "Result": "Result", + "SessionType": "SessionType", + "SessionId": "SessionId" } } }, @@ -26994,7 +27824,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "Veeam", "publisherDisplayName": "Veeam Software", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Veeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor Ingestion API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n

  3. Azure Key Vault

    \n
    4. \n

  4. Azure Storage Account

    \n
    5. \n

  5. Azure Relays

    \n
    6. \n

  6. Azure Logic Apps

    \n
    7. \n

  7. Azure Log Analytics

    \n
    8. \n
\n

Data Connectors: 2, Parsers: 4, Workbooks: 2, Analytic Rules: 132, Watchlists: 11, Playbooks: 15

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Veeam App for Microsoft Sentinel allows Veeam Data Platform Advanced and Premium customers to combine the powerful cyberthreat detection and response features of Microsoft Sentinel with a simple and powerful data platform that goes beyond backup, providing organizations with reliable data protection, seamless recovery, and vital security insights.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor Ingestion API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n

  3. Azure Key Vault

    \n
    4. \n

  4. Azure Storage Account

    \n
    5. \n

  5. Azure Relays

    \n
    6. \n

  6. Azure Logic Apps

    \n
    7. \n

  7. Azure Log Analytics

    \n
    8. \n
\n

Data Connectors: 2, Parsers: 10, Workbooks: 2, Analytic Rules: 132, Watchlists: 11, Playbooks: 15

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -27179,6 +28009,36 @@ "contentId": "[variables('parserObject4').parserContentId4]", "version": "[variables('parserObject4').parserVersion4]" }, + { + "kind": "Parser", + "contentId": "[variables('parserObject5').parserContentId5]", + "version": "[variables('parserObject5').parserVersion5]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject6').parserContentId6]", + "version": "[variables('parserObject6').parserVersion6]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject7').parserContentId7]", + "version": "[variables('parserObject7').parserVersion7]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject8').parserContentId8]", + "version": "[variables('parserObject8').parserVersion8]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject9').parserContentId9]", + "version": "[variables('parserObject9').parserVersion9]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject10').parserContentId10]", + "version": "[variables('parserObject10').parserVersion10]" + }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", @@ -27851,7 +28711,7 @@ } ] }, - "firstPublishDate": "2025-08-26", + "firstPublishDate": "2026-06-16", "providers": [ "Veeam" ], diff --git a/Solutions/Veeam/Parsers/parser_VeeamAuthorizationEventsV2AliasFunction.json b/Solutions/Veeam/Parsers/parser_VeeamAuthorizationEventsV2AliasFunction.json new file mode 100644 index 00000000000..218aacda8f7 --- /dev/null +++ b/Solutions/Veeam/Parsers/parser_VeeamAuthorizationEventsV2AliasFunction.json @@ -0,0 +1,14 @@ +{ + "name": "VeeamAuthorizationEventsV2AliasFunction", + "apiVersion": "2023-09-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "properties": { + "eTag": "*", + "displayName": "VeeamAuthorizationEvents_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamAuthorizationEvents_CL", + "query": "union isfuzzy=true VeeamAuthorizationEventsV2_CL, VeeamAuthorizationEvents_CL", + "functionParameters": "", + "version": 2 + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Parsers/parser_VeeamCovewareFindingsV2AliasFunction.json b/Solutions/Veeam/Parsers/parser_VeeamCovewareFindingsV2AliasFunction.json new file mode 100644 index 00000000000..bdbdc9658bc --- /dev/null +++ b/Solutions/Veeam/Parsers/parser_VeeamCovewareFindingsV2AliasFunction.json @@ -0,0 +1,14 @@ +{ + "name": "VeeamCovewareFindingsV2AliasFunction", + "apiVersion": "2023-09-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "properties": { + "eTag": "*", + "displayName": "VeeamCovewareFindings_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamCovewareFindings_CL", + "query": "union isfuzzy=true VeeamCovewareFindingsV2_CL, VeeamCovewareFindings_CL", + "functionParameters": "", + "version": 2 + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Parsers/parser_VeeamMalwareEventsV2AliasFunction.json b/Solutions/Veeam/Parsers/parser_VeeamMalwareEventsV2AliasFunction.json new file mode 100644 index 00000000000..8b9e883ebcb --- /dev/null +++ b/Solutions/Veeam/Parsers/parser_VeeamMalwareEventsV2AliasFunction.json @@ -0,0 +1,14 @@ +{ + "name": "VeeamMalwareEventsV2AliasFunction", + "apiVersion": "2023-09-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "properties": { + "eTag": "*", + "displayName": "VeeamMalwareEvents_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamMalwareEvents_CL", + "query": "union isfuzzy=true VeeamMalwareEventsV2_CL, VeeamMalwareEvents_CL", + "functionParameters": "", + "version": 2 + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Parsers/parser_VeeamOneTriggeredAlarmsV2AliasFunction.json b/Solutions/Veeam/Parsers/parser_VeeamOneTriggeredAlarmsV2AliasFunction.json new file mode 100644 index 00000000000..026451f7c89 --- /dev/null +++ b/Solutions/Veeam/Parsers/parser_VeeamOneTriggeredAlarmsV2AliasFunction.json @@ -0,0 +1,14 @@ +{ + "name": "VeeamOneTriggeredAlarmsV2AliasFunction", + "apiVersion": "2023-09-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "properties": { + "eTag": "*", + "displayName": "VeeamOneTriggeredAlarms_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamOneTriggeredAlarms_CL", + "query": "union isfuzzy=true VeeamOneTriggeredAlarmsV2_CL, VeeamOneTriggeredAlarms_CL", + "functionParameters": "", + "version": 2 + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Parsers/parser_VeeamSecurityComplianceAnalyzerV2AliasFunction.json b/Solutions/Veeam/Parsers/parser_VeeamSecurityComplianceAnalyzerV2AliasFunction.json new file mode 100644 index 00000000000..7bff6a0bbcc --- /dev/null +++ b/Solutions/Veeam/Parsers/parser_VeeamSecurityComplianceAnalyzerV2AliasFunction.json @@ -0,0 +1,14 @@ +{ + "name": "VeeamSecurityComplianceAnalyzerV2AliasFunction", + "apiVersion": "2023-09-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "properties": { + "eTag": "*", + "displayName": "VeeamSecurityComplianceAnalyzer_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamSecurityComplianceAnalyzer_CL", + "query": "union isfuzzy=true VeeamSecurityComplianceAnalyzerV2_CL, VeeamSecurityComplianceAnalyzer_CL", + "functionParameters": "", + "version": 2 + } +} \ No newline at end of file diff --git a/Solutions/Veeam/Parsers/parser_VeeamSessionsV2AliasFunction.json b/Solutions/Veeam/Parsers/parser_VeeamSessionsV2AliasFunction.json new file mode 100644 index 00000000000..18794350418 --- /dev/null +++ b/Solutions/Veeam/Parsers/parser_VeeamSessionsV2AliasFunction.json @@ -0,0 +1,14 @@ +{ + "name": "VeeamSessionsV2AliasFunction", + "apiVersion": "2023-09-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "properties": { + "eTag": "*", + "displayName": "VeeamSessions_CL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "VeeamSessions_CL", + "query": "union isfuzzy=true (VeeamSessionsV2_CL | extend ResourceId = iff(isempty(tostring(column_ifexists('ResourceId', ''))), tostring(column_ifexists('VeeamResourceId', '')), tostring(column_ifexists('ResourceId', '')))),(VeeamSessions_CL | extend ResourceId = iff(isempty(tostring(column_ifexists('ResourceId', ''))), tostring(column_ifexists('VeeamResourceId', '')), tostring(column_ifexists('ResourceId', ''))))", + "functionParameters": "", + "version": 2 + } +} \ No newline at end of file diff --git a/Solutions/Veeam/ReleaseNotes.md b/Solutions/Veeam/ReleaseNotes.md index bc9db3b9007..b645c4d7bd7 100644 --- a/Solutions/Veeam/ReleaseNotes.md +++ b/Solutions/Veeam/ReleaseNotes.md @@ -1,6 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |---|---|---| -| 3.1.0 | 10-06-2026 | Added Veeam Data Connector (CCF) with support for multiple data tables: VeeamMalwareEvents_CL, VeeamSecurityComplianceAnalyzer_CL, VeeamAuthorizationEvents_CL, VeeamOneTriggeredAlarms_CL, VeeamCovewareFindings_CL, VeeamSessions_CL. Added backward-compatibility parsers to unify legacy and new CCF table names. | +| 3.1.0 | 10-06-2026 | Added Veeam Data Connector (CCF) with support for VeeamMalwareEventsV2_CL, VeeamSecurityComplianceAnalyzerV2_CL, VeeamAuthorizationEventsV2_CL, VeeamOneTriggeredAlarmsV2_CL, VeeamCovewareFindingsV2_CL, and VeeamSessionsV2_CL. Added alias parsers parser_VeeamMalwareEventsV2AliasFunction, parser_VeeamSecurityComplianceAnalyzerV2AliasFunction, parser_VeeamAuthorizationEventsV2AliasFunction, parser_VeeamOneTriggeredAlarmsV2AliasFunction, parser_VeeamCovewareFindingsV2AliasFunction, and parser_VeeamSessionsV2AliasFunction. | | 3.0.2 | 15-10-2025 | Updated author to Veeam Software | | 3.0.1 | 03-10-2025 | Updated Coveware security findings integration; Removed irrelevant mappings from all analytic rules; Updated Workbooks drilldown capabilities | | 3.0.0 | 26-08-2025 | Initial Solution Release | \ No newline at end of file diff --git a/Solutions/Veeam/SolutionMetadata.json b/Solutions/Veeam/SolutionMetadata.json index 10294c0a70b..ce67ed86cc0 100644 --- a/Solutions/Veeam/SolutionMetadata.json +++ b/Solutions/Veeam/SolutionMetadata.json @@ -1,7 +1,7 @@ { "publisherId": "veeamsoftware", "offerId": "azure-sentinel-solution-veeamapp", - "firstPublishDate": "2025-08-26", + "firstPublishDate": "2026-06-16", "providers": [ "Veeam" ], "categories": { "domains": [ "IT Operations", "Security - Threat Protection" ] From f0d1f0eb91b74ae1c4b12e44c79c61ae514a9609 Mon Sep 17 00:00:00 2001 From: Hector Arvayo Date: Fri, 19 Jun 2026 10:58:13 -0700 Subject: [PATCH 10/11] fixing comment for the PR --- .../Veeam_CCF/Veeam_ConnectorDefinition.json | 6 +- .../Data Connectors/Veeam_CCF/Veeam_DCR.json | 6 +- .../Veeam_CCF/Veeam_PollerConfig.json | 27 +- Solutions/Veeam/Package/3.1.0.zip | Bin 112523 -> 113114 bytes Solutions/Veeam/Package/mainTemplate.json | 973 +++++++++--------- 5 files changed, 505 insertions(+), 507 deletions(-) diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json index 2d1018170d8..e6eb7fd6740 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json @@ -8,7 +8,7 @@ "connectorUiConfig": { "id": "VeeamConnector", "title": "Veeam Data Connector (via Codeless Connector Framework)", - "publisher": "Microsoft", + "publisher": "Veeam", "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEventsV2_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzerV2_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEventsV2_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarmsV2_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindingsV2_CL**: Security findings from Coveware solution\n- **VeeamSessionsV2_CL**: Veeam sessions", "graphQueries": [ { @@ -122,7 +122,7 @@ "requiredPermissions": { "write": true, "read": true, - "delete": true, + "delete": false, "action": false } }, @@ -145,7 +145,7 @@ }, "instructionSteps": [ { - "title": "", + "title": "Prerequisites", "description": "Follow the instructions to configure the Veeam Data Connector.", "instructions": [ { diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json index 3029100e6bd..012d9a92a2c 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json @@ -358,7 +358,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamAuthorizationEventsV2_CL", - "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" + "transformKql": "source | extend TimeGenerated = iff(isnull(todatetime(creationTime)), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" }, { "streams": [ @@ -368,7 +368,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamCovewareFindingsV2_CL", - "transformKql": "source | extend TimeGenerated = iff(isempty(eventTime), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" + "transformKql": "source | extend TimeGenerated = iff(isnull(todatetime(eventTime)), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" }, { "streams": [ @@ -378,7 +378,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamSessionsV2_CL", - "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" + "transformKql": "source | extend TimeGenerated = iff(isnull(todatetime(creationTime)), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" } ] } diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json index e52019664da..e0d48e7592c 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json @@ -8,12 +8,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKey": "[[parameters('veeamBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/malwareDetection/events')]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/malwareDetection/events')]]", "httpMethod": "GET", "rateLimitQPS": 5, "queryWindowInMin": 5, @@ -62,12 +62,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('covewareBearerToken')]", + "ApiKey": "[[parameters('covewareBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('covewareApiUrl'),'/recon/v1/findings')]", + "apiEndpoint": "[[concat(parameters('covewareApiUrl'),'/recon/v1/findings')]]", "httpMethod": "GET", "rateLimitQPS": 5, "queryWindowInMin": 360, @@ -112,12 +112,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamOneBearerToken')]", + "ApiKey": "[[parameters('veeamOneBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/v2.3/alarms/triggeredAlarms')]", + "apiEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/v2.3/alarms/triggeredAlarms')]]", "httpMethod": "GET", "rateLimitQPS": 5, "queryWindowInMin": 5, @@ -158,12 +158,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKey": "[[parameters('veeamBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/securityAnalyzer/bestPractices')]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/securityAnalyzer/bestPractices')]]", "httpMethod": "GET", "rateLimitQPS": 2, "queryWindowInMin": 60, @@ -199,12 +199,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKey": "[[parameters('veeamBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/authorization/events')]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/authorization/events')]]", "httpMethod": "GET", "rateLimitQPS": 2, "queryWindowInMin": 5, @@ -253,12 +253,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKey": "[[parameters('veeamBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/sessions')]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/sessions')]]", "httpMethod": "GET", "rateLimitQPS": 2, "queryWindowInMin": 15, @@ -274,8 +274,7 @@ "createdAfterFilter": "{_QueryWindowStartTime}", "createdBeforeFilter": "{_QueryWindowEndTime}", "orderColumn": "creationTime", - "orderAsc": "true", - "skip": "0" + "orderAsc": "true" } }, "response": { diff --git a/Solutions/Veeam/Package/3.1.0.zip b/Solutions/Veeam/Package/3.1.0.zip index a78fb33d01084f8cc1c0f79afac101fcb1ba9d2c..092b32f4ee256008c86091c2d9ca7a7e65ae7adc 100644 GIT binary patch delta 89635 zcmV)5K*_(0?*`iQ1`SY40|XQR000O8h*s0F4OAWuh*r~FqYmgAx|#t11;Vp$9>zL< zWnmtwgFjRUm#z-}qj4Yg!HchqS0TJ$VTc;xMPrAj_w9F$e1c!m2C7o{u(hz?EjOk7 zx%m?KUT0CZw&Ha~K246h&O*B#`E;xgCRh(!{#}fqqt(Rb!(H5>@MorfnHmSV8q1^L z;8NQ%DTl{|3h$rWT1sM%9+4=wjY(5~Jig39LmFcbxh2bQqp};1FML$be(WK+OeyZ} zq{!pToGmlGw0-xcq)wL>yd#v>KD3}yzL;^?wTSl5&iS1tEG^d?CA?EAIZ9xlrO~m9 zBNdC)u!6L&R3ph+EIFkG=S}B2^G}&IW+cgWO9!9((c%b}jgiEtt^|@u6s-b(V<}cX zw->0(=V`P=jT8K6y2B^%&gJ=^;_165>k_m3k?uR-i%-ishtI69+49w1;5mxAaSdsy z$n4dr+!r;2CW1d&CI2E9_NTpE z*oVUXqW&!B(X%5IEq!0koEF|6!TAWM{S-Oh)iQq2k$ycF&FA@-7v1R?p zPGGc{OtoS8ie)>q#OHEqb5@@ovLt9+c2{P)n&5CBmCB35lZ#~e3J?TYM{Te}rdscs z&(__?kG}(3uBhH$E2o`R)1znA_;t!@{XXT&`4o2cAxIVS%Zf$58D3LTyh|ZQ`zHXb z$NXw>+QkjYt$AIxUFN)h7?G`0#(fkrFR(~!jA!8C4nI)!6~9oX2}bvbqF2HCW4!z% zD4W|4LRs!wO>lNFVO^W-02_b_>L+WT-?9qh8wIAU42s27@}#&*9$MpbUFog}ildf$ z?9a1O<0)k@JIhnIF$=xtwdYye0h_(gS!Ollnaz^B%Gn+!1tUy<*lf~tXT|3LTuNU$$CmRh;@qCizwmT5`(ZureC;-v&p<&j_C2G|&Du_XJHKPde-C)bwB;Su7FkgI zpFJg#YAu&@6{IN`X0bFp_}6eBnY1` zc@9r@;n_Um#5Z|Oq3B1yx0Tl1t+cyN%(mbR$!wj?ekd8LjVH$u%PuuLiv#B6^|zLf zTV8?XmsP8OFkR{QIL$TevtYpnQx;t1HIFI0{{<@pq!vjq&x@33+VI(}er~GZrq+46 zAbNbcHF>f5r6x!T+s}C0dz{-0RJ5|Cpqv44Xm-u~PRZ9tI$|nIOjLPRGF>FU@Gaek zhMeroKJTATGfW4{w=UaQL zZgAusli3*GkUN3N!HUozHumw&Y%zn5;ft*LU&;^MmkO)b8+akD?doB@qx*UC3%o;% z+t8bT1G%epXHk@mg#&l`I~V!xs1RGd*?q3mKf*SCUG7v zru|$lrfnKMo_RwSk#NqT+IK*v^dLHO*epP&B%{6M9Q^rATFvSn{Z{r$h9Hk2lmZBU z&!4?PE@}=eYN*AmHpS;&l{Z^j-sy-%h{}T+&V$9rw3)thp{(-#BFpL7M~;Y2xLSaH z3uEw{MBsL64@71amDHBgDB{$5@MLXo76+%4<}uc zf|+oZK!*7EoUj9#^vvV_USU)6nB&HYZ;PDWtLE`sEH@oJGexJyEt^8qV||-E_GP*VD0D*hfZx=Yk&P zoB|u%fiXTGS&^LaIhn$0Qxv15lj{$gXbSUdcK^lrox^XmiNBlxR>%T8H)Jx_$rP6x zQSp!CuQ?Fxp3tIG=>w!03Eqn%u`>-riKYAGwa!QH69^E+G{P{IF)AQ46$?A7J~29M z$|3I2nE`)3&BYp@ku`Y#gUvI4x@jL7xUd$@v$=i>?66tpE#A)UTp$k|rW+E^Ix;E8 zTduomoBgr2ic^{Krm!aoNxFHxruAT^uwSIrqz2()X!R)<%&{^Bn;H@}rosxu;jbX&EPYMDQX1WA+a9KJBTkkdyNE zkY84_^`yGz!NM%rFFdPg3R+Y!GZmZ+w;_^Q0MMDs^x$bn3g&!yRg`G!lf7KzukMam z)H6sMNZNCai%D~SYkW$7^+S`38~X;bTEChvKM7?Pt&=>vwRN5BN(>PUwV*%h!zli2 zdv^)jUv4+6?dC0$i}rd4_o8Mt>tK;m>+qX@va?>=AcP^B>uNKl!i4y+QQ%><{+j zCFSb<=`3b{J+CDTuxIrQf{XEZ%mm`Lo|3l@224|otBe*HJC(ny=F zjbL@;8pf$MIK_Z}l*WK{dP83~c51cLM18Xpyew)iTBB|>F9AbM0R3(boaAiK^NNleLcf)K$Y51ZIpGk>+n|;U`{ijh34=YXC1x;xy4Use2u8V=G*RUzyBVa! z4E?1=C7$ngd)azW{LR+{9&YC=0{=Jr{mm}=&7PH_;p};3MFOwoSt%-fzAP<9oUpz& z?o;Q>Bd5=n`xbgiLFu2>g5zA0+K-t?MWndeE5%nzvE=hoM?I>({Aw8!(OWn0>`~i1 zQifgw&N4uM?W3p(FLhj$CZ@80yFsoFYiSTG!&DiAh7K0?R z>4|WbBxkd9v7OJ)Hp_gUd{%Z;(bMg0x_qJtDG zQ-e{kKVQGzxjC{KxcIyJy!c4P7g5Z;)lCT2lqeg2s+At8>u^oj%=XAyDa%mjIOA>v zU6i>>c#?`JbxqnpT3DPgY*xY2V>Yo@kFaLTc=bnam1IXtxjB;k!L_Key)F)Za=T-9 z_L5s2yT42C7Rs0Z#h!h&cRG;~?H^iX)RbAOl8h!lLb&@zeu{7Ro&1-~ieX3VGV$5J z8+8AFRczB^MCG-6ceLpICbnspzP%3g7OE5;XJm%$v=ahBX(ylYQXG8aHc5W=j2l_` zUwl%@4ukP|CHsRtq1ES#&dSeewN5&FKq(=j41wy9mj}3UKuhCRAE@1+WK&h%`=u_f zbYr=r${kbch@Ir4?B=`g44>pIhPu#jx;8|A#(ptFmC~XFYj5|O|KBuuhW*6SXpr{E z3!Yn&Imvdb|Lba^M{XmOf6F!?G-_Pz(@Gl%`ujQme|)n+|CQZ1)IfQ|pX^9qrq8HP zhTiBysl(-Rp3}~XN363cAa>69Y-?Be<})s<$r%-*;#V$tHEV)PUj2>Jm691aQR#<& z3Ps*X@n<&SaSISa|D~R6?L$=WA^Q#O7b-zD2WHh!SqGW2uIkIyM>rus_I6 zW4b?fwNa`J2_J!?-*>%R?!x9ddH=@`!GJdhq5sSXi`L#!d zmoTdx3WlZ8HMt3YgdsxNi*f7K5_yS4@GF5^>zdYMyCq6Cf9Ll` zMe{AStrZ@|c%lIKH_J8Q_a!Vh*JQoBqAKM@ba_kzpw9hVyv%K;H_#%*EceC;nCwh= z5yw394ynuoE%D5~V6>QYmOdv*0P2-RK3cEkIN*+BOqxzTb}c4s9Pq}Q9J0E9#6@|K zp#>{VzDE#@&FRaexcGx(xIpIc(zK@+^p@k!raDX@TFEpMXK*3fvITof@B`bO z6hkm$rOy*uOm1lQkEA1+ek*L-bmS3W_Qnxpc$%imh~9Y;D_}t%a}dgw(l8TkU9*82 zwBcq&Z&qIvxcU^Nw6H##--nieDKq!(QyjVm(_5;C7p7*hB7~wz?r3@5Rt2E{T=6f_ z+gOJdrfh5bJSO(6{NpVcEO5=2&!hzETAr(94f;XR6)TRKI!HA}+ zwbt@|G?mJA0mqR+{#Ta$oJ@}HrLmqk$T4QHk7 zzhlmJMcU*3e0MyN#+&F0aX-7*PE{6uP<2v9IWn*E!6F~ZB9};iWZl1Xn7_KSvXiV4 zW@B%zsXYKu_YIlPXIIRnkgS(CS)i0h^_BE4-H@B~!31v@pn7WNF(!uH7#`Q^&T~qS zAj4OX@jP4Dx7fO`y*W68pwJ^`+zc*4DS!6}LcDtU?#&D3>AQD-e)f%0 zWP=~mLMt+m@52gz;P&P+f)QFDVd3A;pgxLF>@x~|N69n&nMJeS!sZ7&*!j1I7B9~Q zKL+l2YIreo(cyym?8xI)$!I_RuC$mLg8Y+%yAQgqAnGm3-w0#@1gq;=q~wW>d2Y*b z=DA~TLNg2JnA2Kz8sZqL^4wOg>4A!@`{|jK;kPi^5sqVj1W3Mqs^5zM*};?JhyaZr zUx?zs%<)tqJFaxpRD$mNw+@K5Wm76WTBXd{fg*_D!urRG%ny#L&ilIt%xwas%K}pl>A_zyl)nO7d`cqVbie%#oZZy4~~jIRIIRGzv_sae*p@QCDOf}BFN=Bjx=4Djr2DUc%J0u8eEt~MIC0Z z6$5mHb1Gdo^BrLAWYyKUp;HCeqGv<-u23*rjaID=y zsgT}19A*iU1jGR)%CFEnl2o)3;PJ3m%J;lSnX2`F438jPwz~2HTFT4kEPLwc(q&Z{ zkK#Ye4uX~reJVk?+-~kcy^fw?L^Io1+>EbJe6BY9Qa?l~Y6KWKA8Y%JmHD2&(YTn;@N zdCT?jV8SS@$)P3MtJ68OOuG+cVyw528gax8Ql-l1y(Hr?v8Zpm(3_(q;T`3SZ;^$^ zggDaqq+@4GXLdE0q5O1kE4u5t-~L8t9M5=vOMDM6*&D*=>zEz&FTMs_xR`Kb8Ykj^ zIDP}^n=&5!2g4Pp>v2g*^G>wL8~L-cYfZ_UQ|L`1kcph#`LRnV;l74w_Xa=Z{SZ(7 zL&cMiwzYU#04*SP5fA6$`dcmY)i@z1w)6D+4G)rBqJT6mde z?_|$w6#yVgV-oa?M*QzYv!nKjW;vjEi4?o>P|- z1Avh=sFdEWzWnTU(R1*h#?ITnE3(3IW5>N^wm@mn%yaErt5DuHkEoEn4+UZ~Y~@fY z)T~gee54wy`O+@A*p&^=HNU7C+`p^KUD0GJYQC!J>S|4HXXI0fRJxY&YQ4OLiFln} zRM^`wQ(Dn_*Ei1V8fOLSXTP$4YFE3*qRPe;0-T>8X24o9yQ-Un^y1!p*)N!{&Tc20 z*#^E=7zb1#l!8_{yPeTLV*-PemVW<=N=M~-RBLXv4d=7;8a%FflQn|U4Eicqe~g!( z7Q(Lwb9yJKa<|;lYG2cXK@-j`xoa5^K$Lr zux01ODUfPqpKG;Qc4uAkD`?LZ${?=_O^de7=R7(LsY}c4)wS~USBT9iUu_pGoS)@w z(o)eh{GWHjx63PTrPCIF^G?Z%M#oeNpw2p;wNHh91Mc%wIeY%>%_G)m{rQVUyrNf} zF`5^TSYJMV%mJ*tR6Nbi^q?DUZ~3B$AUE0$B)0r@5bEEL@h-mn|i<0aK}!E zex+jvlWj~&{k(r_w;C2@;|Wnf;IzbvsMZf<;VG_$PpLIQ1ei8|_O2e)E%CdH8i8va?hgNo_M$1 zfQ^+Wu*{dhADCGLl&HZ3Kbey&FuzJUpINUqkcL4@C|7rFdDgPdk1FrapkHBhckBz9 z+3}5k2P44Gi+^W-hXZ%_{r*Myx%kS@CkKkiho_jo{#@Sf2f2FTM-8W^sLqhPZ?>P@ zx4Q*^t07*}(%Qj&uNawd*P8Z|rJ>f0j6BupO#-yYI|};=mEZogo80gcJ*&Tq5(jh5 zTVEyP7M|Wj3D2$rvBjXVN|A1FZoujCE2mQa0`}!EXO$No?HZb;)Tw#1+T1ac zM<@3j1Z?ku&RJ;U{ee%WZtn--^fqz%C8`j&cYt`(oOlmlOTM*>FPMQRE_>GvbzQn& znbPlF)|O=<^Cq%dHPo5|<1WCg5V>#q>maQJB~pohZwI%K{t|?Ra56}K5@@ptwXO8oI$s40})W@CEqrLM@VY)JV z*)hC#A|8iC`!n=JqG z>$aYM&1gSS-kXQ7Xf23a38*ihwUGq#R6s+cvdq?EG?<{|lVgqYMS2ax6MsYQWCxt~ zL}i%456>G@K0<3n+EnqaDh`zQZwWn>1y1Q@w573jZpuR|a}um+?iG;plXbf$Xv-hY zt~Z-i`o+ZsyqTWg6q15h>>{8pd;Y&_=KsHc$U_Ae5CmLo)K4&zL)_y}%MjAp7V0j1 zG>cULunOOJBn4Ap=N$o|CH!Gn(1fleBE$vc2P%%TJ3XidDk^bouQbYs8+Hw}@c?1oPo$)aHD2yc{vOHTyRrSp@2 zu0Cy<%x4Q8%79P3-H;V(D^mmvVKHI-lEReKvDB2f%aDJkBi5TNoygtUC=&VH0r z$#Xr}bjP}OA2EV_l)axm$eMfwR`hc^mTZvo3d{hv9Z$94KEh}h!R7;oI?K7J2}Eds zdR?0|U<_gGsGp&Ip7?oToWo#k6j1#PGDVP;6hYQq^gEkB;0HS1EfHR5**u4TIBiN9 zR*X_*u}iLy~$ww^TGzEU|O!RPbuj1tNie$ z9^epz^@;4jQA0Fb{&L8;!ETPsD=u2fI^|lBqj&;_K}4>X^UTc7Em6pSk^=LSw?XYt z;rluBY*`Z#<#txy;?vdahqbU);R&R5&hl(Xp{yl4Q)oX56DOxTUKu*yQFLMl?f>k7 z71c^E#|qMe!GMU-!^c~1Z+x6F9BzStiH5Jx2dxgfChAKASYky2%=#8`njtl+8Yg_R z3$Ns!YHrjwg^C`1E-Q(Dxm!tgos(^)7^2uZlKoIJlmrC{JC_w|_PlxV_TAq4Qp=+% zuQ2kD4?)@ctJNT2d6X2o4t|v{=JuxB9uMg8NN>l+kr0 zxir7j1QlWX8E<=!^EHu*R$d8}GXM&WKF{xzeBGcUrm_SVm1mQG(Z%Bn-_m_($T{bG z9o|2mW}pHgQMPnj!_F)$VOz3X&_rD5s4P4F+4JvIdddW7;M>jF@spd)cgXIs^oqN1 zm_?X1{jdTzk6G{KcQ@q6S$o;2{Sg*kwvQ}QHV$8W^JeM`@Lq|d&va{M)fd!U;A{;A zXRcsLrG%J`S$s2pTg*UkzKE#*rO?u9e0F{VFQm0y8O-N&KSq9mcWA2mmR){ET~50d zv%DA{xKrD?086Eh=;}oIV;+_EWeU=~7L4Og_|ytunP97;u$=T!V*& zrhVuRTyUhC>9^>>ApQ~79hgrte{%O4^I}1LruQ0s$Qp-#*WWF#uIA*+?Pjw)bRnTF ze!Fu)2&B*ZV3yWjd0za~38f9=dN5C~=oIUH9YxIEt{w=j9q5!hqu6;!Q6Kz}BFG(3 z9x;app`RG{tnXj}phwb{i#J*R#>@CDPvwAro?>}{{u1>6qbJH~%K(UuR~|9|jpt<> z&e+N{T5U6bKe$-|&4Fic%Wv}msH=STv&?DXvYsGMW|zb(j*FM{vdktwGqT5KH5mUE z#+_BPt$u^tK+4h{U+mZNN#xoWvvB%>pDYqHz^jwB_*b?a3d>tMYB%eMA( zK3jY&8)MgGzKQ@wu-7jdWXT{Gc?9WlHQ!#r8gf~GFmah?;j@dYEvWN_NOm4cCW~lK zrzy%MGR_Xd=3!bzRoiH8F$Y~f6IHX}PKH`G4wz*#ne#H5Y1=e!s+!e2%@4G02@4M7 z>`~RO_Bygi!G|G^wr6P%-!H0woWP2c7oOmy7wQX5c_uAQLmzOb@`q9hYND0%xCS_) zpR@OWO}mUyx6KgICTPC$gfZ z3`HKvD$BI*W?)kRYs)Sd55FO!nDc!yaBO``7FV0=dJ=Pk zV4o({&2hADuHn(dO;hS4*MQvFnb&8aY}C_=if2zco1tYOUf$enSxOO~(dw=7LdzwZ zdZWLIJBZiP>_%WE$pAB2U3m$|z*AE&U53|IpUg2BF2{{9jJC#^j>e#DcXr2Bj>hVL z&O3@`w8f!%Og4LUYM0+|2!>m7m5bHBVc|xYRz0n;7KUXkZhB<^Pl3>zb&yx<0PhyY%heVd6nMR)Tv75~ zuvU%)UalSm->V?0}f^p0E+gB?F(q7~Z+K)i1Jt5@ba_ z;{~s~(b54_pBsNjKkBPjY8=1&`s*)lZoWv<|108#mXqZ7EPSDuqKWN>EVrAN3sCGOI5sJz zCg=nb#O(pwY}r=XjTOLa>9oUt1$BW5W3V*!XSI=fTE5cTdM~oRpzJ5^T#M)Ck@RNJR4Jaf~xS;2hL#qcS5yW!F-+SY;1(&R}*9|E1f~F>F~whdxkK`t~@+4ziZn zf%XpiD-R~mu}z-+vV#v+&*x$FGz9a0hgMHDyt?ye8RzB&KOlC0v8m#Bf)1_Ug-dEO z_5-BG3T`+3Y#b%6R_D;Jp^EoB9Nzb-$dtV}#*C1M3{c*aWqRF$k1o~bfWiVABp%TRepPkBgB8OF53 z-@kL9O(*lA2V?H|UKd`a>%oG1u;8X`!Q~f8k7>2(4`$ng+4f+zeV)Ox-(^;D$HjRE z``0i zve^PrEvo5%a&z_Bb+EW1yJ?KwSo%8a{Oq=`YzUMLd-NWL8Y(}Bx=lHvvd2{*br)>P z`$Slgs3=JxDn`**vZ!$Ynkrf31q=iwd8%VenN*eut1_F*t(<+kyqZPI)79z`t<4=0 zCG#M5UF#>VXT&DC?wTHL1w4eMJER0I{1VE`=gQfC-+p-c{827{^~SQ@^_iRNfE6yM z1;f*ZtHq>yt(n*-Yf|g*}+G&sU`i{$|Q!k26tmh8io1!j$Z+}sPReuIDgC4W~c5 zGIf{KfQex@c$r@rHK-O9yq6WIR3tC|dU0Wubnj%My`e7sHG#aCm$XjGZ7`7X=*GeQ z@tijaGfK`PyYi9pn1kihHCZT&X@Eo({|R1s#m=8rx)cFkp+%g*I|e&l{TQeJ?l>-yvTQh^=ifYwPDoRVh;8U z^*x+k@NGy8vtfEsv9TH|$edj6OH%q$`C-%BLQcxglGDA#I3uP(wZ(__c8kq4wu{eFt&M@34Ob>3@2qDS6urWV3;w%99#5)lf8f%95nnXxZbZ8O~!S@PCWn{qPfxQSqxuQb3~Qvz?1WU zA_WycjaMX-8i6VuxBn(^`V7qwpeX9t#d5Z;C!`dA=)pblgfcp0iu&0f+~Nd zFWoT4laP-E-D5JqKO8B z23jd4By_e=vEt~vJ8`<-t*-Lrw_gemTDA<2a8ZQZue9Ve#%KV0g&qn$6#b=}q5m2# zCB}mFI=Jgt6*^Z21i|ntix{8l?SdVI z>Od%V*$^Cy&RTi9jUqzg2G57^zS#Z>{nc`PNrFgN5uq})K+I^x9Yv3M@z!!3tl3=qBR>aPod|kz4?kAcRxGLd%Jy3l9+#&?rBQc zy>MO`t;`83H$gPs0M^ISZDp-}qkq4Q0Stod+LDQIG)te8IT#P}EP{};Jj~eGW+Wra@TTY=%|0Q=WdhGmBT&K{DsT38i_e}R|$j)f4`F}kDI>=Rx8Ao z26wS+Z?+)a>uO}1h-Gz*$$*S?aU>S9R>x!^Wr-T}DBA?5RB2=R9ww@SCz*}&{qgm5 zGa;VlLArUhj9L2Uqz19d*u+M%%-qw@X+a#z8{8Hfpf22J%@ZJAiDv8&rXZH|&J!&X`qrPKm`FsNe6SM@`bVM~C;QKa9 zfSs7-#S)Gu#1+ejo*Gwq^72&p+10t23P%AL#rn;Y?$ze3^mfH=^=oySVEa`u51J7CgaNJK&G*cv- z+f!cRYs-&0-UEa8>G*zd?@q$KTRQePs-s(YxbNOV9_+Z-D%=t z4DNHEx%0FPF)e1TA?L)MA7zMdXRUP{#>92Z01HNCg_wk)+7=X?xQWV5(@TC;P$9xY z^1&Y{`QY^r-N^@?SJ28_M%$sYUA)lFWphV1FP)u=_gRQg_wO{XqIK^%fl29j2W9t; zkx%GE?3;h=n&V6M)f9KgJ%8!oLMN~*-hyvGrmY%+n^>w!*6yUZ0SQ0>D36&u$#y=! z%PSW*Rb}ly+)kSzalR69D`8F+SDWjzzK4F>Ov@tzv2^@-iV%FUUN6_<0ni>6fL{eO zaP+VuuMB-Xz(=wUIr(d5ZI{nf1FYEdR-1DQVB&urF(i@>x!1ir&WS9CcS5(+?ZwI} zrDQs~bN9`mDup&Q-Bd?bSgy5Z*0nOw!9iY^^z*DREa=SFXcw@wNq2}rcl0t-4T^>+ z))|u(MDx?{1=ik?Kw1CLhr?^sqOW2qDuwTN#@_RWbzUT|h#g4NOK*QBt`OC$1VZt`@ z(tNqdjYPLSuPDl1=g1YVC?8wyhHDsOR;E`#Qz-~8zRL``8q$eLY;#o^Qr-flKEYTD zILm7yRM}#`N^q2JSF7cEGcZd)do^36mjzR>ci=PF#nl$(j*EkDDy*>Da%I8E zuLx&fg9m3+%aHglMHQKr9oa?T8ZdkU{biGtoJo@V(Wd)OL%l919a9w}j zbu3%cJ>-~F`W=%Is?XKhs;(u(@O`2Vgvv-+A%I-Yj*elud`Rl0? z2C!FDsEMC#2lHE*+O8wnUG{LkCjhJnG}JUp!9UmNJ2=tLnJVh;6i-0O7$|9Ol&#?`#sdux_w@{J&Ud^>sh#^S8J_Ga!~{@^O4^3vILRVjAiB= zIIm&2eqC;!-nBo9PvJW^+&tXpORylEycO;vOEnf6AC}W8J6NXX0e9MECnSHU!D6eL zryANjP5XlWSO35Jz|9Sm=Cbko70XY+J-B&ZTr4QUIWX1KP5Iza zSY+ljRaZfCtynZF%rpZ>mWQf#2(&C8J|Z!*@S7vqR6XrjbfR`m<^(3T@0NTH z`d8aR(0C=lZtgA{2jM(ee58L@yf@jq*|(bZ3NNYOIGE?xQFU7R>~8Tr?)9|? zSlIcy-?SLm_3KY?OLz0l#ZAoB3HNx+To1k8mDm*gzV7seWSECLee?3jL)_`hkiiS0Df4+aurfn`{?s%7muSJ#&A*Li6h|zsmSz z7SV3gL^o1bjdo|Z=nt114{^!y0e2V=44TjHl4IOezrAnrJ)%;!U-jFz^EuZ2lckBQ zJ1oV#A2r{9Z6<6ALOon^$-CjshIzbw3cwztEFYXSthSW4%2`Hw^i6z$nz+}bPZ-`af9S(^N4{I} z$1mSpzLmLA?%_^FAu=BBR6OWT#Z#CFOUD+De2pRnKI$sPzSn=x)impvCmfzk>K@3l z;1Bmdj&c7Z>IC@7Oy&!{>p}Lc26^!PF$Xby0ORb{EE^Q;3CPBhy-eoNdXaK91>s9y zLN1N+!<%m>&1B|CQ7TRpCG(<8nQ;KF@*_3)mDiAe2#aE@ynOzdaQs6`)+{7;?;MX< zqVlsSBGzJs4rPBQ$sKHn1alfTXFptbkN zr4ak9v`1!XsCD(oY#zLd-Wz{C*UaB@#mk;9lb6Y5P)6k?;Z=A_8RoO}l4K|-c^iMb{4ip0Qm$q01i7vFud7RW zX-(}e)U!7OBPwGdi-zTa9<)%kqu!+eXeHr?pTf?6N-w~V@pL|K7~!Ys-6Co}KX|`7 zHCQ2>CZp-T>fdzKo0zAF#apIi|H*5ZTQ`^VRNN11d<#p{~p4T-RlgvM$J~E)PXrj$G8G`olx*6in?D~S!8xOTp9%`q2j^QcC4=Awo$m- zCVTW{5PjUPls_wPNKy7y0hbxoT2`nes|0Ya(DPWu=dMUs3t5GMWWBs8l^LM*JSdC2 zgi8CiUdi|W?C2M@43*5elri{3flrW>euyjy`xfrDaV5>a!qv_h+jr%MB)`(z zeW#r`>G)3PF|m_AGf7s5wrHC-GN~b@B<`O4_bt3gfCNc^FHsV5x)X^afg(^S6zcJn zJK=Nj5D~HY7M6B^c#Ug5;s!zq;)IrgRRn*I%|}-$kDhYG&{GaJ6g}m+7cvl&44wm- zNK_;&@*)NyY4Y$`zA?eNo!WOuQsMUii-E<7J|eg7U0}0Ee*t}Z_%e}9ogMs1xbOO+Tus45t z1E5kw-f9{urD(_vWQr)B3}i|bP>Lu;7Q!{G?cd&CobNDuL*pe-W)+spiMmHJg6a#;qlG;Wk#ZsFCs1bvjG(mN81EiXx*+8ds2%5w| zr$~pzK&Nc&eB2U?(|!K9#YcS>M5>p~1By#ALlj7E0O-t~<22O$c(M{Ppi<-!URH}D z4+ED7;#;8!iMU5-Cb6TaumuC1VxUtDbc%saG0-UnIz@B0l;Pl_Ec{fn1?O zY#>+iInY3^tQzEss*+@2SlE9b1H(ecL6TN2iw7!>*-(tw=%IQN`E@-6*H|%(x>y*q za^Rh$X#>MzU|3Rr3=E5vOs}IltJDFDIVjEmWII-r{LtNG$=0JM{!ZMPZ(sETu@eFE9JiMM|OkkqOXuwMt0FrOUfg>j4B|! zq@L9{R;(Ao%b`JdX#(Npl|B6ir)h#{v=MMFA|o{o=OT=+!EO-+kHKycImuwRFx!3e zD+L|gah;;MZ!I8>3Y~wPvT+y@S#X2viK@G`ZLnK1#@ArC80;3p7zVq=V7C;Ni!j(N zXH(EWJs6d*=}I~^)Ox^M7Cy_}PW^8(O*DCK8=UMOz<&eDt)A3r&nwFE8D-N>o>eO( zB5Q}4$uf5OC>j4Tgd+^WSe6vgNk>f7h22u1^c$cSd2O5II2nJS7R)OKs3j2NXq$!* z;nL4F@k26`*qb9Zm2F>vWCPSf2U|9N@)_vCq}|=+gCfB`5Il|tI*#ekv63R?bEwM=Fa%+PWxX5x4L2Y4WI zwsV!FUZ&HbHfetzLGFtiFcbrZV!%)g7>btEk_sLc+e1whv^JAY8g}a>$HmFs+F=OC zs)==Rz9JOAhoDjHWon&b^_!J%HIOIeAx}U_Lcy51D$*^j#~mvLX&oz(U5N7uqtLz! zlxmolEvS~D-b>{)Dp0ShC)EmoLg~v_lW;>(NJ`;aj9!1nzy2pk%%YYR@>X&lFgPgd ziGxypn>A=B2JIw^3(KROJP>{yrC^p$vLmmDBxYbTB2sFDpHjSVI&NsNmWP_<>kaw1cg=9AYVD(XW(L^Ar?iPW#goV zE+LyJkG6kY`!O&k?2mylq2rKdM+0L*)}Vng;e){XTl+Lc@@(dY`(hOaWk8s>%IEW* zy?{7xXg`WqE0Wex#2q0MDQ+$b{h)zrW!3piUsc6b)jkMW0Kj2fiW>KChG%Zk{f^5TOVc#HPTqvNTY>IVmFRVBIb*- z!+wlAL5)b1sJ;b_Iw5KrH-JVPF3o-GW)Z@>TXQT=QcwmUI~^1q=7w;%kb_eU_Hxk? zIAntipoF(h@ZjRZ7`z-11iqI!m)aHLcRzc3!P39bjk2ajsitfkac%`Zyc+tB-uxX6 z)3kqZ;E=4H!#z4d82rv+hAo_CM)F``Sn+)1zS+@U7VZOw_27Dv!IQOiyl1_9ybjz6 zHwu`Dj-!xJHZ>?C-A5To7zqrPh&b8?ON8pWm)LX59S=syVzpJY;>uVenYuxF;E=-# zz#*w;H5B>v0uDJcz#&Zlhu|-7UOzvZ+QEOrW*~=%oYXXOh&aFoIz$vb20BD!B?BE| zphGgvw`xg(>EuA+vF)8bwC#RwcTqADtUE*lI!Vl7<6!oLypu~|7Crw}9I;-s2S}v4 z5c5C+BN&kvlkKfoC;G#=-pBR}FeT?^vZigP20DZcgMkjoVN%9*60?blzXq`-32{cq$PQoaBia)l+1HU_v$3x{i!m*6LqH}7X zL)Hg6q)6+}ZjM{3iL+MLlYa;}2N?^F8LkP6fx2O5%nZNrNKT?5C+;1E%>2SE`En_JUWbh zqQC7L%oBroQa|R2jrg!NtP^DB9TV24Kqqj4d|z#V6VZH~0TPhflr{$EcI}PcnP6YVhEiI(^6^4>6eRS3t%P@N ztDhS|fRuwc-$|sGg{YxM)S?>=@=4;4K|bjK^2t%-$S3JsEBzeLqZW`)GW#&dCkFXs zeUMM`!;;grmEABG{Um<__=Fe(pc@O@Y*LUW?;J2#I$s_BP7%2TB?aZ6m&CRh16|Th z=#pq&I|5+B(X#{?6SnLmKV_x`(-n(4DxekZ^6zIL2b?RHs1n12;nD8F>F)68>fqof z{NI12v3Z!DA+6MYa%}KTn!q=C=6`h%pwA0fF<9nr z0>X*NOHCu3B!}2woQUGbV4R4|WH3$)#!2+YV4N6?6HSkcrRZ|8^w8#e0-8fAlRgRc zkbK%;obUr;Fiw9A#)-i=S#OM!V!hv>oEVgo+o}Hzj*qVAB8HcpZ6jVWC?^Kx#GssX z0_B9scGYy5l!b^jK%SR@&1q8F1n|l6_#RxM1%Lp^xesA3HwEcJ5cUh!H3-jx+m7?X z(r!^j3}_GS>%EuIe>UJj_Lw;+4iGlx$-7RH$EK8{uKItp7AA3|Q5hH)8tfB;ebNc+ zlN-j6t>K^OErGJ|CjgN^Zojf#HV6GA_4Wq*#DJe{Aoz){*0^-MjxuT2trN*YkD}3y z3@%-!+CZU{8DsUE4HQb#P$=B4UK$BSq8YRfgre~t%fmrQ5NTjg8iPTpx=C*?5=x~F z*npxKP?Ri2EDwr*5{b=Q%95=Cq(nWl#Xw+El1{;u21{Yq8X_rkAyZQOS24gqS`4o$ zXi9R@*Bvz_tx*}!lx9Iww3nB`OsR^QQbM9-s7VGrrEc_;?wQ*Sc!~i}G2kh$NW3wU zm@aY((g41;Oj=TBdI`vZzJ3`(<;=P$`=hu};c$r3>SURJbzJ~YIc^+0C7s5lpFw)u z0(eSh9|k208 z;5H{jt>ZS(kin(7Z`~|Hpx>Hfp^(B~00HQrP%;CM`g;CNBfc$qP;+w1@@F>@TYbO15MHhG|6$@&?I@= zYk6>z;|ky;sb@9R;q?M1IWgcQ&47~-F^y;aseSW*Wii_ffD)0Png=LJ5A#NVloY;E za@cBpX^9ey&KN{PM(HSbWJa`Kor}6xVut4D`j6<$a&c~L|Mvdke20w!Ot^IhBK;B0 zd7!REH_q>Etjf<}^~#Qk+M^<-hSkFl+UaMS<95llhlcLkJ)9XWmX`tNH~7X5PTB*K zO7EzDX-tH6VNlRUT74*@)8!p%)DVR%r|#BwVdzRI)W?&2?GIo>=99pDh)Lkj874hswH6+7PZ-hGg;+xhR)H3tp!Q05JQCUIL%NFhC{YAL!8bHG-aUZ-BzeX0 z!KP9viyq_1sxTgfj-bS$xM~FsG*nqZ1W}k5fBa1%8%fOUvThg z2Jy;PVGOO3x#l%Z0J0sLEIZCPK&5ZA5)Hyj0ggwm($yS}N5N59kzgUsy*Xl)4s41f zOBCYf2roW*D^i_Q@~e~F1Z>LiaEyR|LGqCVBoH7u!H*?SOooRw!I&%sndHOMcLtQi zfRc0ql;rDm&>kKMV*Id4D3Zj=+8h)T{>2Rdi2)$lKmd|d8FJkg(xz*jr`H>OgfjWL6Uw*qm%tcN;&nAV2NkPUp><20O?1^a{RPIWasFbCp4{FlU>POY zk;pZw#@y}cP00DX2%mwiw$!eFkHc$$>uOd{?j0L>hD(v8YY8fC2kM+1H`sWaSqWg_Wp(Q zUA!B0kzkrfwM*lsx=iBlj(0b|Z;?pVTYuCn-H;mAanVMVk4jvlw>M~ivkePd>LhWU zl?OByv5Tbr)4x_zc9%dK&YnUG!tLzv!CJoqr+)a>0k1yRVLQ1pfJBH(DovffpRbaq zuQb6Ghg9DU1>HTs>_ePoB~nYca!OF@hRFbU`v+?_j7vQBDg?z&dWijc>Yn>1{bwJuH-!aOfJYAaV zYKF}kjGNl}NQno3w3kl_V`m+!yeYM;tHx9nd(F8swI7?b(to^)DPoaK&;Y}zx*buV2?~Kl4F|YbCOP1L5E`t1wca@(rpRVRi(2Bl;)0r} zyhPONoih*fTi{D=q6!lcj!vJ@hpy$(*rzohX}wQ$JN?BXK0#AVv({poa1tn2M>E~p z@t*ba@j7rPe8mt%L<}|tD>gtZ#5Et4Rwa}m4s5+hC&!MG-?Q-DdzW;POp545`oQ}c zNDPO6hC3h)0< zDG~$j=W7_r0M~eJuYzX=FXk2RM2{614^l-uEl$*tlEC*a@ZY1qfKEMp8gJvknn9G~`3g??BBdu4ij=0F)i{)_SCP_FQ>3)kBBiJh?=uwY^bXuue&D?I!P~Ka z8TCm;R%)z1seFV@Y0}j#O{!aBQM>x2Mh!+&Vo{;QqN$OXQ1sK)9yu|YEEShz|4c6h zZ-m}TRZyijgH?IU`<&lyq!5@IiG>aVQzOyTNHjGPW&3n&Un^ZBQB`-#ZcnsysXQ6g zYGoUl%t0KNf|bRWNk#$`Xvdp`Z!)5P!W;6gCp$6~5;Kk|*a|A=kAh=Kbko1^wRKgB zw!I-qQLWUJix_ImxCKJ#Zm`u=iB<@Dh}jEx@;<{`t5a?19&F5oVGx}1T^s_z^p;=w zHNwx!*3QQ*F?8c|EA`P-@{@bW`G$O0<3)hNetN(Dg{;=k=+*bZbbIGVuOtC~GaKiI z_x9PW@3Oqf<(BMYfqo#}AI7(?Go6IWRX8ZyKSdFPC@zpB8R96wL=BF!DSWA~_QpRh z-@NWrwGGKA%1V*glL;eRHQqD`zcfZCEn@7Ur$1@sMJkdMZDivu^Xs zVgcSl@56(v1<3}wQ+BI=SIr==05P0)Ehwan*H(e{EO5pUCjo!k-sAWN(J~GQG2%4P>80(2lB8zO-*XbCe(IP9cB zPzMh0N3D$V!ks#ePEr?*lV_937-b!aDg*?uJC>k2?s%^d=BYJoSU0tl;i?dw6uzx7c4h z{}-M@sxY()y0AspfrZzB_00|~ym2}clyvs7VVf1zz2iAPwK*k;Oa z<6ED9{JcN=dsW1{C`RFe&Rn?vjEb4ElC3$TSdN)O)t-=lFFw$~PTnjE7DVszi;Lm; z^6z>9-u>Dw7{yp$s@8G5%Xog`^sBnbl#|a|c5!7HT|!E?C8z6wC)JbI8uGdsiQT-+ ze(j60I<&rlNyoZHPb$jlV%e!QH6`U|1;w$9&``voQ^BAsw1)d?dX)}FomgWk!*)f1 zYe|_VH8wqeJUA@6>2ou)SjBjKaa+OfqUQrG;jI!KJIgimuYl7?-{ZS1-;wOHLEJ)1oW ztxYh9pm&E~-Jtx{it@LTxO|zodqs#a@0=SS$bB@hd`hr<1(Ryv?Y6hBr?&S6%(*fh z4`f<@)?uER4;TPcI zYAEUJg>3i4Aluc7Z1>g)P{7&cjZJYJHv-g7tjQ5*#G)c2>l0YfMb_MPqF06t}M zdV_C+oS4`cMxEp8Gt;=5oUi6;ip?Rt=xR9Yw-k&h21M6dI)3oPEeo-&RcB)=JyfO4;tk(YZG9Z6k3ml#)D&OE&eY%jcZg5BrdjXyyRFPENo5D^Y;nqBM%`aWMW zHPjomdsQZ{zZp_~cf30+)4Q4qTU!=?Ve{*+jr8xT!&!TRh^BJ;9!|p3F_PNO*bT?v zDIZ_XeVq7K7eor3hB`Bve{<%Sq}6ffGMU@Kc44o-YH%);8A?gqn!!sj(=VHdF2UOv zG#9J)Pyc%9a3LK6a)I@Ihq4O6yo$ntm(8K1zO*(Ks^YAaNGm~DY1kFDVM-)_=jxNB z0S&D|ksCg4Z z6FheAKrC6E=a=Ncs9PtPKWuk@Uf0q%Mo)m1TsdMVH7_205!~kbNl;gM z2_=SbRaQ}2GOyhV;`Bv(s#M8KSVjC9Hob%zFG!|O{Yus$qpK+Wwkx%gQlf6<7E^PU zDpRCvlZuoT-5#xe&-a{vrI$2Ig~#UF?bHFti)@3NRoLu9J%!D#lR{Q#DW!+yH}jyH$$d4{jl!s5Fw7b z;k`52v(BBl?M}m=;K{7`01^g?$)+@Ieg3hB%5W4E2yy@Zv-6O=17!&9x^ocXH*gQD zy@9E^b{vdd>QBEqlfD)D)}z0$(5u}{{m`-8IrQp0{Qc*BXgR+Mh+2ZBdgTvY*%Qfz z%2Fmbmt(n-2L=s)mX6X%SsKYEaF=edM|SFH7m0`Gt#T?z z&tA;$5t*bb1-Cer8-Ew<)0ysV??f5O;RNz>t z3LH;rtH6=F*_AK8@uWiWjnuOmYUz3v-xwU2>KjdeRNsJko`c5q;T0=owGl-)65P~u z6^_&(n_?WYF*C(DOfimlNtt3CYG&ZRwUuLQHpMuY^B}UWm|`4Rt`V6vm+>3%im0(< zDXVZoC;#|S*`p&j!Ga>1<-drWJiHDb`%88Qy#Aaek&r=}Q3!^Johw72XQO-&B|kEzL#QW44jk!W;0lSQk7t~@{X>*+u{5fs!sCGfpF=-dF#90 z9Gd&^3YRo6s6^dGCF&rM5KS%0MhQZZ3qt*j6z_$kltw#nLg&5{j&BeNG$|iwbV|o^u`Go)ga}3B|+LF^?no? zB?cxh-jAblL8KVGniM%aIIPNowfnJ(v28AHbx#Zg+9u!zt{&*cLPc!3ZdZlkLuy9^ zX+`8hhRg+hP%DzGRZ&#SN2Of|ShJ9%s%&n(-v@j8&4v(FCc0ZEK&|Sro;Rw0uv4mw zw%x5>mC%|y*DY&YbN3`oeJO9wm-%bEZ+i-X&Tyh-8H##qOwqrqTHE z=$N^h)>ePcoy%@3&T>GWiX>=%lYt+goJez-mRb)Uqrfhk2sPEZWHEXb0#w!P21)p* zf32o=G)RN4=G`DEu%_;i73{4OAaJi`b0|To(xyUHgp?8^B?v1yM5@D-u<+}Xq!GfY z6vSCyq~{{^n&iQ%XPadoE*gZ+PAhK)I6M1~0nTn5IGd`!)`wT%o1~b3J_sF~0%NNJ zYJ>Mi^lc{UC1jlP3jLYOu2Ya(T_9T;D1{=R0FO%|3C7AtiQ+P7S}sJ@z$1L`*II&) za8tYll-53=OoGliG0#`DiK*HKD#j(zIaRO;RNC$GR)#Q?g}kL#HW6`~F9u5j?z5mBYZR7oN$44uyKm9a9O&W)=L=+_Ebr&yMfSNBr!&R#R}cR0~#@Go3{Yf zqiqvezp7;`+i12N3zrah+WVEnd~Rn|*~9wY*602pN2~8m-3L5JdBZS=Js%=Q@p1&&biZN!6 zyeYKz za_zc|QTatzq9oF4ZC@X(aOT{&w=RScTtDX2S;XZPE&o>1N0F5pEA}WIVN>Z*HejaGqp9>5uP0OK(Nubr zZlEbsUN8DF-n2B zN{@)H`nu)0_Ycj3di;r{Pk=KU*Ka7zp5pX5_11>`R2894r!x_au^hi#dry$h$Foc z!(dM!@C@6^&RM4CGvelB4}D&(G&@l#C;@_hvZlqwKKP!qNu}tznDz0(55`DTjdht+ zkZ}UckxL3qw*Bf%~x&cAg@B%*-KOs|}PIWtDXj6)0tbG;`8&Yjbq3 z)E3>Lx|JA|U;IXWLFq_0y~V`0T=PQWo9^r)5=OS#0uqLDRTfX4%wD;*)Lix%S93dm zvW~B6X|0TRS&J(3x_hFIdX~?psub!794+d~@R%m&$PJUV!ImY@#G3_&ED^v01d>EQ z%NLwqMWsQ+Q&QclmI{U}<+nDmke}TEg4p( zV3@k4MYUL%cB!y-3WZfgwbv^Vrd%L@tcmhq>WP*lwhD(-U7U;Qm1&tmk}Izr$FnG7 z-Y!tcdq9@r1clKGO^A|2seo88{Yp`hES47{#N5gGNWO?J9_}%LY7R1;8U%R{egsxQ-Gd!u_p2|9yLBFA4mx#U;Rq z^s-<#)QDo}?$$m{kAp*GxG$c%3f?0gowv%q>z=)s-=p@UteGOY5@iPwGEs7+i{^?( z?A5*}Ra|AsO9nfl40gnzdF+UPbn;D!^uIwH*b$kX80-jx9kB-35lTVM$>hPaT+|4B zdV`Zwgy=v|kkla%yj=DI#Dn3U^%fP3$EU4-5GBxKRB0}U zKEwbBXKyb!OoUL@)F{=IO|th$oQL_qwNM@}MdIw_HPJ>+_7dtbmABh$d(w4ddw zXTbq1Sv$3_e9qZK3>HOsEQ&#GSQLdjas?oYK@}j1)WbR|^qK)t3=I%Ptw0pGMlS=y z0E;*rPi^nUIfJ=>{1cS9jew*OnW`~Jih{A;2yhAo?1=_nTB2EhBgL1f-MD@Q5qyQO zF6`bS=j6l`@*`Aihs8&qgatM+#4@XEFVpaeJ7kursAGH{0fQ^O89LnZKIdlp??w`P zpk4P@#h8%ALqdEv653E;k^pOv3f-UNaeNKj-O6{R*&UbT`V8l(P-y_L2one zIbBA)c)k^~zSSl?T^6-qWbz~774x^Xa<{eewsmWeY8I3$jHXqtHClJaYBfdmGNcPT zRjnObbGOPhLTm0V<^`7n#{-3R8SCoewcrlU^Bw*EnCeGX=;Tr z=X#lryk^y*QNxLrxsqHI zy#zkR(~{t8(2~b0RS{B3jFcd( z{sPO~L9z0)06!#g(R&NfBs#$nNv*X5OwpX#B(_9! z=pc{RWR@j|px1=>Tw^?W`OCY);ZbGy%ewO_b8W7rr$dZPSJ#-FI$JUK<(+0#hgWC) zEn&1}mrYtLNsP`Zk+;<^mDW0JKCLw!z*{1JlVI3JT5Dz}Cau+^wXQ*0t7hn?c4hRq zs5nY#q&37@PAlsd{}y*{McE8=iwmu9HI^c45>UI4fQplamz96|6k-tH2FTHM zBT=4uIawNrkvg1!nxe&IPSUa6>?+>F+A=3Kgnoq_%3+lp%GAR;`r4Z1P>xIvWvw}X zl(dNbGrF1KX@3gKd@+0DF}T6aNTd`wtFc5%l>y&~Y|1q)^(|t*)$`^bbMfUqS00#4 zt~~^y`t9C97cYo#@;nIrP%^f*V`{?h?tC<>V*x@p0nvK@I@^ z*A%~E4?#WY&GB694hkS8t$d2rASF#X_)SalPJp1QBze;eS>+^eQx2YYFY+fietFB? zgQgsOBWM7y7dzf0e3KEe&=6#>Lb390!xTskA-maUknE-nP{Eo374WrvlpObeZ%DLe zD|!3T7>*eqju|4S60Jh`Dn?3$|Hia+nu~#*JsZl7e-GKx&T6S47ia5bAF%0%(g7qJJdJZNkeCZiM z;HGs(i_6D!D|ty*LwoDx*wr-zc{TRL+^kF;c0tOT!s|tP*Gd*%C)I@ATb@D3xBdcuhnxIWahuLE z#uTP`bQX?)FQllkqB{W}kUJY)023%qcGi(zMaT3_`PEz zD`*FE!Qp_>rL^m-!1lshC)j=N-S`vKL3e0F5Un@!T}drNE*$$tAl0IB3ZvX-W@iyHcePv$4wOpq++~Yg7_(cYSRWD zg%-k18w7P~{puj!v_Os)3Qi03ltIL4fvl3~IBjru1wa}d5mj1Dl_avl(CG|cSp=Q( zJf}@vIW(OLh&q@;)mwkm%+4AJJ5^TKI$Nue=~u~RSqbK)*ech5`Y~VGT&;f4*Y`cf z2I_1~%*gg%2##5n2hJvwF$$Vk%n;^BFn1;pXZS!9B>z~f)Ws0@V3kxd z(Qpy;dL9u0m6eaF+S&o{CLg80_4(sg{5$Ygk(IGJI5yCA?_&!oO1mvw45}xm9*fF3 zL-m)79N+oC%#v+?z4!C%?}A~@B5T8+nJq?6W@+r>us@AHmQS=Mv01QPYV7!`?JmbFF4 zv#})kP}0lMru|Uc`-K!Z`r7Y}IN>9-Pp`3%MKuLk>nC(p*%5uE4) zkvE$<4SC2_mZ{DHD(0LQwmVh2@$!p{S8(y2=%_h)1JbYg3DTgbS2v}+>WJ%>X zr6O2#grJsdqzOTo5`|1y{b2_l$dsSrSftm!#R)tMrxzpqR7RCW)|*Av+nyyCs=J`rO=Vqp=54zGmnDANp`hBlrzTit+HEx zsb?=h7(@FJhN`NL@`{j&N)@?iwkSqv?Q*l?I@1JJPrZGW(k2lwdTQ3vrA>yYu8FL) zNg7C*a%!6;3`fnEFie-uC{fa9)J6%z%uY-RLsPzxAv zj%;(#<{U`63$5D#PA2lBQJ>I+&MJ9y^=U=G=@j-}ayz4#*oI7L#V(XqM0j1xtF0)k zC0Xr7%u%2YVJlq0g!70_*r11~RY$2$VskV1)86TcJg@V2go&-y`d8 zMsu+RwP=*acaDd2H(zR*j5MrkP-tb7!RZGFd!ysM!O6+q@bKtZR%(lm=Sw@p28h#> zgTcY^$-yD~b$W6%2Fl=*OZ`K-4c`=USQDLzPfiq5DL?& z<$QNTIIe@FIZ?D zH{}Jh9BF8%GM$B{ykKD+N?y}xw!C1stN7(=ZQU>0*V)>Qg`P2%EZlqUp;3^=-}d4% ze%XNmU9To6sSQg;$kY-vwFKL*C73EDXetSANF_mK#758eoG#TJq_$cdJ8Fs#E|>oj zbFtPeh)QZj12{$=b5p#3uuAbl90G326s}d7LX|-0R}g{#Cy8^xH>ZbPx85W39^#(N zkdPr!-|W|gQP!=}C!a+amHBMGy65^-^!zKUq-S2$_bvfytaeS$qIIDsp^BG=*j~-6 zLtmV>xkmI(6WN7t6GONvwQti>cI6gJb4k*927r~Uf(x_FzsS>nM+Jl$)xlCYsxEoV z3h`*v3>u0!G&Nz+^sbYfC$yv?c5-(WRRo#}i1Sj;%Lkp&PEE^Ve6ruEK|X3QeAZ%G zE~6`8$E$HVZ#^M;L-sW0rbnv5#cSbtYT4Mmk?o$EB1# zwXVw^HS3ZjNtgY9Km6<3wor+bGFxVeEi+o};&F$w`(k?lzN_%CBdp;32BSL_8dYmh zsWCw}$Z3u{-*r?=$XZ-2X$jBn9dJ`8i5R~t1bbFp;5ouWb)o080)?Dw40)p)NGj?G zDO`=4Y~G?MrKD_(3MA0*;GoLMx8B)NGRDABc7hUc9Re?Z3;XOCC0!`vEE-V2>^~a| z3TWL-?J)f1Q_q>Wb3fQc;beD#J-h$Z`#WA}EL|I=0p!2}Vu(H->}oxb_-cf;i&pO~ z$ajb%)LOjdmampQ)qvZr3AkOYOByk&GeNmPcyX^IvRo-M6ve0*U!2#WQx++$YioUBJ&^>B2NlS^i`g#=~o$9^~k)Tz@ zw;>wJRO@Ysl#*3>o8r)trv#m%mG%z1)!dTRa%(H` zs=}6k8r5){-bWf0UR95bP3V|PC35xiF*Hi!wyIqgm%>$7EOkoYM&)lu#Y&-8>DxAI z=x7DE3BHddl^fG4WUErYR;6}rqHgWWUInL0Ub)&#D@T1%Ou6=w<+_`|4+wr&CCm(| zMFLMbt1GBG!k72{w=sEmY=>i8#X+w+<{fc==P3pdsJZl1D&lF?!fUW%ofRaG~*vapDZg>xYJJz`~2Zw+76T}5XL3f00At0d0`JX#_B^>@$YZu9&z)X#> zF4hRE1qoHLM3|`%R_`iHUNRNJ%2WtDY`#KR8pXUsIfcVEDuiWrVk(503SnzdA*=|0 zGFGn|7_Pj))$(FRzWSt27|0D|{tB)C=GDG%F`N0p9LIp#x3{pFqncn`TBrr$%DHiG zp-EgU48gmLiONxjp-}j1M^b4_LVon{p2Z@gLt61GL}2k;U1Y2!hNcb}Fvf=00n0Cr zaY=YOrwkYzWoDo(I!h`CmcsBg<-kmTIWSWWtj%&@hqaXh%iF{&l>R!bQu-_Pu#UpL zW~IN5OzE$BOMf}@#Vl4A!p$iCC2~;>rN6WbJ;_JE)+$)hQDQqP;IxBMzOEe$N8HE? zX(Y}?NyR2nD@i&O3YEPIN2`OSzrHw+ScR^S1sZtoNYU4Ry#R$3pa!v!@AON5zC)zq zVrH0D?N^PqGI{LC5*Rot|6*O7Tid_Azc}AvuMA7qI)jb)aqixPaZz7l1VBO$q;DuW ziJQ`P9V%^?wb5_y{IoQ z{9H?c$q6RfA|2p;H?b{Q+mlC_8n6par;o70NIfsGP=@d~+OF~K9J%^y3oDbaBIUBd zabz4pIt%I}X+>Ux8JVaggN-1{Pc zs4n<`0x5bgVf;+3&D}wMP0WO|8*?J_My3QGy&0U7Tb`-4DXjC%m>j{>lDdAT)@Ej{&4d*sH`u_`+%z>etJU00I2x8*bu%kux%iBj>gckdj#^rw z6{`MQtvC2rshj)lD!v%=WeK7S z42E?R%yn0Rm$MJPb<->MSb}8bBYWMHOFPba0oi5wTlHw5RNh7c92R!zxLIYgCB&edq+}t9~8a+}Z5cMBZDl9>PX5=_q+54zbZf*8Ix5p4#4* zuxO>#_I6LfVEaCpuHUQqp3`Z*2l_hA_(0z}b3VLY2U)*`V&O0RV2om{#~^vs`5Q9j4n)DH5eN$l8LOtbI_l%YF+)IeI+Y1meG#Ly6I7YV{nKzhdb4^%Y;a}_Jt4-g(f5+BhU($;ab>&;G##*#;+rN zcIzwriwu6$?8ZHT)L;2Sc#5{SG;D`>k}+3&-uY2n&#j7Av0pFztb}7*grd!Hk>nQ((nL3qfhp z#B!xOGe|78tTP1B5qkRA!9oQftX!q&p_YmQ=#>0ufgCac>LQ>5Np0Gu(yOJD%xRdR zWo8ggJso5SnbET=qJp!3c7>#rO|&b7W!YMPx<{XAZd}tn069$NkFV_6Od-}JYuVRC zmNU2SmR)ak*}7u~>YmY7mq|kS7{YdRo(T`I)SXCMr*A=OMKtN0@7ts6Y~CT75Z37{ zf8yS{9h*dvu#U|nPh2b0S=WZxsI520Jlb?oDj{5TX*G6$WK<*S83j!y0CM@{BkvD? z$>dQe*5=F{P*7+9&7jP1YsMqT?w9fI_&2Zxlc=0YYP^d>kxkv9a?XP|eCE!{FFRzM zW>TkF*lSMs=*8u9Hj$d;SF?gcN-d=>UBp{W=H$DemYRMc(%OF+PIl2rQ zwcVwaN=%ofQqzIDjDgg2sV;-WQU;mQf+^9vUY}*$uGNNAZ&*wD-dZQHjBBIW3YMnoQ%WgOd!`V7LS=K~ag;+wI^+$H-S|)6Ef;kU`fn9E9-|WD#o___V4m(KTB|;L1{ob;@iG@G~rmpSXIHZ{9pI}jb z=Y(LZ>muoA3kZ!1+&^)gWp_td2nV%Dx%e*8xvV6gt|v*Yx{j9@ANTBk-nscQzPJ^! z^j;a1U5PGK8g*&yL1XJ1x6MKWt#8~m5NLL}Ot;~KCs%9Dl5Kk64BKfPRt!TfZ%7TR zW*$xrTedTNh6S??4~7R@8o!N%9R8F80OM%;!FCRK zb`1xzoqjHmbqzg4u-T1&_p`ON1KltX{>Da3b7D0dC(TT`y5?U0B&qk^6r1Q!&cf%L`JL5W2!)$);Y8sh4Bw<>anIQ!hv5kExf_&gA}57gH~%I|_xVms4ZzrgauL z2S>S+=rpTI(Z-%HC6_-a_Sx!>3 zta5w@#sO81{X-!J-N_O2d}W|5&5^EktV;)a0u|4{+Yo+#<&cMQ=&8zspPNtKZYMY! z+%n@2;9_MSZZ%UwwC>^Y4|d?%*HZ=1BxNTF4~*GMP^V&E_(}noYhS!;MH0D9}LCz9fpStwx^DF zH^1MmL<9UYfd4_k+oo}U=%7`(O%x~#|F{sbRYQA!h{)mS$<7kj6QyxA7Zbe1ViqUa zT{<^`1Lr;M)pU6S@=swcDXX0vkPs7Cl)CZr?-&45l}3Tim%v1-#n&{JJ$_&jxOgqn z=vAI!`B=y=bg=P8up|HN+<&lL4|Dl`Nah4JlUN}-PVT(aW=wD9u4vPbW zB*}Y!zdgTFe#%~ep#Xy6;BA#o?UMO;WqbCWGeLW!i=smbJgf$~s=b)F5Lf5aJ@P6c zysbM$pJDNyS`cO>G_exizE@uf_l`X&0B}uDCJFP~rLgKfdj>lpSxWo=MB#)rn@M%j zZADG^{p<7RFD_m`Ki658bFlSZFXp;s5qge)ha?=D0c7ZEqH=|uUxrrlNa!yDB4R*G zdA#=hFIpucAefyf|5!*Rgm`>BQRh8*KLbwVF;f(UW*2Cd{ z+@3Em9ssQp6jEEaQ7boHt;|=qx~^8XZy3&XP^_$t_~qku;7-P1weTQl1@_Ty8Hv;6 zt%#YJ7ZdiMi@+f!(FZUM30C06b$AoFGdwa$(Zl~pHJ*Kt;CPezE$|n!)Dyz5Ok!>A zgB$a!i!53DuiTr!5B=Nu-a7}jxP5eguEZJqlBVGI*X-xGt$REp@r1}M*!*6XRMUnB z!^7Q!0sOalhHM3<= z<~AtwwxG*?{OeN>l+#bWpFV-*eKPaGFaN36|3r-c_%bkzznG&kqh)Tr#OBtFm|vmLF>c2samQQwGk z%rwi|i!MQ}Gds~*?L=fs%|5h$!ut@KLbD5P^r0x{sIVqG&~M-@qT3Hdn45FZI_*CD z2#gbEHLP_TdUI)v_MH(;63wxUU{be!U4C(Avu=tqV#0c{@W@HwY&IJ|b-f7!ls10G zdUWeQoa_D2g@Ey78@F`SVbHT>+G}m8h_9FMhYWWQM#d?*%Bq)KFWFds*@gt!_{tZh zoAKBhahAa^#=TqJY=Ata45Z*!J@=|sSZ9H}}2XTigJ8rbCCvV?JhprGLX z!(F=*u5J^3G|yDaJ*3}}UTAHkL)03u8^Rt08xU((IA4`%=tBa!LbA_MunPCV4j$o} z=1hmgvHf%rM*39BC?ivUw@P+$xwyS`zoQ=Z=*81@P1H6T+qP}n#>AQ=lZkC-q8;0q*vW(w+qP{xnb`dDyr;e& z=RH;D&)WB{>bk2}_gdFp-K*Et-FpzdQb*mvIF|BaSi5l0%)wi;S4xB?b*Acv3D_8` zerS5L5sH#kc2=&*RSN?te%7_>*jt9>$*oBsmdR3voL3eZlIoIP!w;>!MT-Fzz!|-) z)xe_MM1n>k**4|(za$+YC#t9p-}SsMs@As4u&ufKe(qI|!51()hh;38t@U_MvY-k1 zG?AfXEcMKyaz)BcLoKUYsS@g|dZ~ zp&95Ij)nuHhG<|(i{U-r@1T+vG&s}OKidNK{i8a;l&lkkZ1CpLD(<@Qt3Nmt95dJr z(ybBxSpMFIViE-}YC%;_SK2xux12Rch&x<09xORFJBuu^eCWVjc|?dX1GFdg5%1Un z^DRZP;A5z*!3?Pa#n{%SPwmB_#GDVfNx}14u3aH(m0+!F-ziW9#uw|DbYpv_ei*YW z{GM&5Qk4ZQ7=S6`?Cxc_GsmGB*TB|Lg)~;^Pa;^Fm7yX}Gg&th_{&(J1D8E%Cc+3g zWKo{_yWX5pMt%qPpWP`~Jy3zdw8oW9neh|coc7aLPM=AyOI480b;Gg?<1N(YJZK^6 zg%EzlBrC8EBWw=5UR@kBkQpmmA=1@EFSA@kYmxnq^^Z7oXf}D}N}f3(Es~E~GgB|$ z_l*MvgB-W$VxHafZCYHJ?b#>U@9X7bN_xS3F|^hJiNBGJGrx}zngF>)`8d+s-WwpS zlfU$mxs}1g1`yxLgGjF5W;FDa1z|9tg*hb?#jOpz=%FW@p3XPm?Ju&Rb>%gmmOdfS z0|HW~8$cbA&tXxzwF=EUqG}w7x=~BD5=nU?IXES&348t6ZR|HGBi66h(*m|+atf`t za`+mTKolIHB*qH)0|AL8TX&dz@;h~2H+fwS3eS0#5Wi}tWc7@jz9Q3y{8a_5VN zCNR3V`9Jtf9Xfm?nIX73W>7mg)1o0Vg!cRtbj$vw;uItPhx{_Rbl<(8Wm7=2-NU|> z#@8g?IX)cSZ`i_eP0@RCiP!(esOF4682{HsNk4K?+u%ZoSOAcsS(J}aka{B+?g>+` z-0H2}HYh1E%KQzZB9xc&a><(Dmq0J`xEjrAZn7JqQlY3YW*xl<5sY7T83w>OWj`k%OxBmg@b2Fq~>K}wCSVd z*&9#-Wl1I{zimpcG$pE7$JM`oTj4!;>C0G}YAe@(pO0>WB?Wm7Tx^m*TgRBh!RX zE+O0M3$6sWU9~INSWvRt-4AtBg-Vz{d^g~fhaVTeyryQ5tFx5wxEYFTUaHa4ZFn*) zLsc}>RGhZ~b^-RxMqxz*`OYSq;$5!;GT$XYRF_;%Siq(9RA*#PeGIL^1?HrdW+76{ z=4)+c_(z_q;r3Qv2%`Z?mAgAR<^Oj@2K?_O*`P-k`%rDS{TgGJJ8KP<%sNCkGqViA zhn`~6Q}EHGp4aIItO_ZDK=YaWl8Jljd5pr;#qmdLQJ$IJ{A-7_cErRc!yB&s zgsFYo)b?n^>y*lDB~S3E4l4VCmGu(V} z3HSgUkJbd4=le$MDV(mX@AhqhE3`|tzoU#So^VMa`# zkQmMN`WEklA%O;9;~<{9%r=+j;m44_?#YUU>S<^d@d*{(R|wlGxgl3&Pllj>v^Y3% zIrsUX!i)W40k-H~r@TrSn5=S8^5dxcBm`)yc|_BCnbMhdgJ_}^XXeG^f6D!kVd|e> z8@j}w_=k_9E1>gm*9-6X*JYCjwGRBM7_pO-U(j06>(H0PlwW17(CG-|of|&0s`6Ih z1_m72u!63^9R%Li(PsF@ot&@fC2D3%@!yd3)@LpJI1rxMzP4j?I@!c4lr_W8L={NB z&cr}<;zTFlKsp2UCc5NdhOPQwcJz7IXZ&!-?k4RXzU6LZJ`dl$= ze-vXgDnuS=9Ud$Wmlw$W_7>%p8ublPR%T7gjTu)x%4LtVsD}Ln3#OLIze*X;3(Ay1 zScC#zA6Uqx`7v&x(8DL|X>bN6P*fkP-<6N`VE0xL5A_GBgxC7QRAb`I|L!B;qBUpA zd`Ic^^>Nb04V>Ww!b=7E75$TH9r+{z;!tnBnbV0Z}R`FDV zngC~nqwA;sP3p1c=U-jn>ftxE=?sUd)>il3kjv@1ed?!B8lUFBF33&(p9a@dKfQCd zD{73;9k<9(K?VL|A35L(LOk}(&C$k1kjJ1Vb^n_WfjaDT#bh8D>u6Z!HDu;=A=$i+ z1)6`?f0O)&_+Zk93;X0jGxxV|u21mnFS>yR2}g(s`Y-G=_s_|Wnn}OwYwOI8j_PLG z-<+IsoRFc~kCSy^#8{j!Na^5Ue%-ahy@Q_G{Gnbhcs1!}HM3q}Sk}Aae?AJ>dpHid zR%VE7NwSlkK+iJxyP6EN`=lULp*NSH4gev9ziGm*_R}-+v%9R;*MwyqmZWLAxEp~a`@`52{CC791C*a)O`{X5%Rxf=pzm->ZFN2n@Iy%D&-~z6<_DJf zWrTM^Z=J^tN)S92jrhsGMSE!1Uc_0UHZQTLgC2SfKFm0+!ZDUr>oP6)GYZ$WSm2sh z=*6U_PE1iDS37b_`}Cba!j{O{GgsWUS0V>jK4U%~;-5FK5+<7K zOPBLj*`v?_ulQV?{jU-DItGBBF+lvAq$%>`?%EzW(~bS;z3KkxC)09^D|&rA`*q?r zi?xopwb=lRvp$cMgquNVco4Em2+^m;Q5o*gB9K%vWsd~r8@w@8(q zH~K=S=gfjz2YrtYw4k90Y@8NgYNmTdF!Ou7)#BY_zgJB$IehrJO1NZ@pjOG~?bI~- z3}wjp_Aw#lfI(3my4TZ|bBtm~IQ-CHvx935*oY1!`hbaJqO|tSAcz0Fo7#n8Rv(d9 zR4umgUyGu7S1xQKW4dm@U`bLGf#6=l2CZfy$(s4>Ejx1)cv`}WP(cz!dDWMYBpLkV z&uHbcD*3OhHA)6?XzuRcj3KY<+NQ#jh6&qsdwii7%DLb}S?^PrO`kvg`s&;?>T56O z>=d>M59=N>($}=B4fb<*cDWyT=UfWQEB|98s?6G+_;*=-8wzNB9ALXcJrcnr~ws`Ox!3i`o7#CM+-IvIb03=hbDnl1U<%y`10v$!ZwRh-? zh3A=yN$rD4BKTu(cfC=w_y^1=%|`kK0L*NKO{*C+Y-k3EE}QtYVSZ*Ffa%w5dk0%Q3!jCli9;K3!Hy8`iWL={?JLq zq#$SOCFl>|lBdw~Nws-6Be`Ar&K=(5oaVfPkqO^nTEg6SxR5gbxUl5l3$6bfdhGqV zpHiABJU>xcnvG~?LC(m>LJp6BzrM$&K}J$zWWi0Q_*?Wd;d;E<8CElg(n=b+>5-KF z3M#OG!>8l(!dx}z(H8h&y=AoLDLUCV31P|IulcYU7)%f(!q5Rr%ZD=YTJ2Z2N1g#& zc{8dKejYs;$D=z8MUH&fooKs5Xo{|5?=#WhYU%U!|lc(Q?;}196j2L zriHlpmS`o+0RQYHI@-m3q%~6g`7+S>$)xirLe4plJIuR(bU^mB5YN!dK$r`x5ZI zLp%lQd=^6y|N4NmZ9G$~aN#LL#JSFs{spRIRs#iAiS06bv6A=nd0{5_stt10F z)-a~;DcplOFFuo262adjnmlT39%#Uj`d1A_ypZzGxS+xo$FPjEYy$s2V%kVQ8<+h# zdJrklOMIIUpKLhyIf5OvL~pV) zRQUHg)o6u#&FjGq?W*vg&(|`zu)&ffWlTRyLfe_^Ns4QWvyT4`7&x z&EBrJVsQM+fBo$7`CmKO9@4pOHO4DZKjKc8vOIWCcW7AIG~TkdwN+U9{uhU)SJ5Hc z_}Ghrf0ibP6g^iD2Gt@$6hFXTxI-(^d7sk#t>*&ztdIU|KytqK6HKi3daT5k8YnfA~4MkT_e~gD{tP#qtGG6b7LWeqvr%>=p#SZs>fHM-A z)_;#^-)pYfGKdA8A|#M{3tz-#QP`DTKfSyNjD(?(?V()b$28x|x&?{np#13$0v$?^ zFobIiBhbfhBRdLJ{gkcnKG6Sy`0#3vLP|)9KW*i%!HWuj>7WVD*SkPD1fk#$s+Rh` zNY~n(dctn&^W}ZkT!|LUrA@TEDWUya6lX?~$p2?lXRB~WB>DsMh61f*W!C7$f@eRY zG!#6BM5p)@p%8tP+E2WXe_7FR<%EN2+JnNj^7I360h`z*ztG~A&_te=J59e+lbz#a zt}`ZJ7?K8X7B~Ay76K=)C@7Dv4dQHKmj8`4xMljjJ4uc2T!$CZ0$lX+E0*oMC*V4T z2j7O#wZ~4AZkQ1-$K7xjG2~S1Q6q@4n@=IaK&B(Ac4Wf67B6Ab=stP8Y_t5k%pwGk zs>!U(782tNV?7sdU=xHeGJ8Dbv!Gq$eHg6Us9FKkx@u#iZJ(RkT{Ic&aF;V(&67)-bCrXNHh+3w%)E0rkMUx2O%c$QUr-g74D6^6X zx2S>R3h@yCZHz*lN@-o+0D(gwfc?^Po?2>mA@cB?o1B%)WB8qk4si!P#Cl^@!l z+(Y1u<#ua5Fh#`os80Ei)=5$KD<-M|pUS|h3NevnIIWS_!4$!EprVRaa(3)RA2nv@)Ui9~(l=XoO-NSl$B}FH6(s))6HRn9EHlXGR^mB=s4dCer}Q z_261}iz^t!u~=JK`TZVv7^;LOl``SZ@)_Vrr!AD*VVFc4^#@UbxT|#jU|gI~vb0%+ zL&;4EPBZ*G28ole>_KkGhgGY-W-`v+avFf#fWuCSUX39MC$hMqtOTND6vjYngOn?mo0;q zoC#8Occ}vdJ9|DMnrHY$ynzt!zK2Ak!P3ftu7DQ?mWr~pkL&3!#`-gk8lhzAZ%4?2|o&ySmzkqe5mnw_Q zuL=^;8YLEn+(>mRHfvJbgPWBL$@I! zU5pq+W`YW(8LE}@%4({z%?m4J5C|U!Xwq-ateYv*-4A4YuSRt64`Wtqc?7-DnIgKwiDc} zC^&x54IFRTA~ykyPW9yve(1lUr?b%WDZQO?gS>?K-SFcAJf1MSynsV_*{T%kJ!H5s z_7NnmacO`4fmvjh3p6g`3ARKyc*jpvB1BV$r%fJ`seR)@*-J(+xkR)EGYiXvZ_)=g z<9=e%elW04^WUN}236U>nbgqx3g1D;#erjir%6k9O_|2!2satXlfIjNXEx#$M#=KM z)6E0_-`8FTM`gwsP5?qfgvietl6sbI=)n~#k8LjlxSDfVn#eoIjDRWZ%_>HYPKXx0r12D% z$P`wti*QBMo$Q2p42Imsn)xk~8Hj*syqRKxU%}W6EF$7z-MOmW40yg+f`x+FILzzp zjlPd1E<43THqhjc5ZaFDi>vuaazD1&|CIr?pCT20yW4lTDvZTpd)7LYm6CnImYR^0 z*`_8;=oaYr2I4CYtiPybbw9Gu1+IE#BnxdBHd`spqf_;8S-rR# z0znC zN{L<#??*%~+UwP1P{tF#LI7rDcr;*%sLd;a*#NV4riDjm+>B$sN zCEGv$1c7m^3W`uZ$r0PoK5p-wBc`5^SV`zX)JPAJ`qY2NGZoIKO|8xeq~(0u0fD7h zbB!*CIL5_PD7`>}pQlTkbJ=I4!5@e!_AH|3NGYdg11SYzkzS4-j8BQ)Bzbrb zHz$8Pc@voqsaRQ$oj}g}lm(918zs=Ab!j&_0^_4dwKIPQLQde&f*qk5B{V3skcwOd zjZsInh-<)6cKRK;mseNFx3r~G9J)p8gtsZl%Sj_M5+Zg=#w(P;AT@i(|A%Y8qHpdM zX8fZ2^>wqY8LO(D!TuwRvh2=j4Xn&LqmH?HmyxB^;E&`#lZAmDt2%GZ_;oZHE_EIN zkD+h8BjAjoyE0}li=<}!L}v z$-i>G#!+OY7fDPEMYRxv`(g=~1zf5C{lypgro{3{fo?;Jw?!a-!mzz>vNYoFuZ`Yd z=PdeHq=t{CyFN>WASc@&Jc*C^s`9z@gd{U9fg(DF4!dQpg?cB6P4%O?h2z7ENq4eW zi3v!C<&CN_l4sb~J9z_#Ax)9OpWbhf_%*`6j%RFLp3=zORyuh;X)}%O9Uw3O96gbY zN0OI^Yc=LU!ngU?Z@}{N)30KsuPmXo`P4rpOZ%hZ&B@76NHUZG)zD0`g?Mthe5R9h z)m%k65GBLfiUdAKi+zt-G`~H#e#%!f7d@d6wa<&hN8v^8pl7rA%ex|0ftzBYN+1*? zW2Bg<72RICgff;NG3EJy)zUM7BJMxCa6U&-Ukm_nn6A!aee`ziu^2nUAeCh zPd)DgFDW3hy@EW&gMCvI!coH9pzFw8-A|8=pa0A+X19btgk7$0x7?MMyr_CRgJ?r{#=_^!@rQ=*Rr(c-AqFkMc2M_7(hK&5hG`A470*g~AGtEWtv|b6_gomU`4Mf?FynZWld)G|%v=&DdxlLw z%n1DEi4t{oWZhuHLcJDAvn2+-4Lc{G6citX{&Zo~drkv{nV#wGkw(Uzc(kjn#@28W zq-;-|Vp1_;L%ngOA;w1eiaqHn>N9=0TK+g%7gk2#Z8#2)@tPW3ITq8_UTGjkhy~Pq zXO~5eYU&A4@_M?bw*u8JXCn&X#85^`@2gC4T$;b{ywa@kGUpQy8&a&scC8k^wl`Q& zE@jVFz^(=;L-xXGt~^o52R=5yO!hl%Dk3PjK9kWe|M+>>=2L3O2~cX6rPuD84xB7< zGhi9#hRO1U7|#0kC7kVz5nEU>W!=Oz5)WmO-ff$Ff`l_T)5Gp^+(2wh^%r zYRx)iqMf%BVek8_$mkY1XD$v{@bOiV8`L!nx83HH1!(ZEXFiQTkm4YEtoH)t9Eco#pWNWxtD)Nc)F8-+i~Tj^YKKhcCXg=cTO^~?nwQsnMg>qG(BxI6z!>KBm|j#n88aOaMz zE{XRm?0Zi-#_W%O<|9g;KA{YM;x6O#OggGB(-robw`z{O(eY!Mq`xk1lXKlx8rX?o zrsngb_ayYb5`<1>7F%0pX28ot-ubgfHdwKDW&JS6+~s{L`4og=zv?yU(<7GLg&ugD z*Yv38eh0}YUhQ4j^1Df3@D0T$r1T7a4t0we2VG&hq~tm+cLps)`r_P~6_*Q@ zgYKcaSF~U^tw44Cn8mi7fD4yf#{;ccA+1>jo!bi7m5TT7(Y|50lDG1f7B&;mvZzhr z;YR5m37l9-m7;l2+Co&N(Xk4{PsaCdC1#?-&q#*HUI4-q@cZS0BM+Ay_|cit8*Hqi z&?Xuq@w`fELjRYrOA?%yP`CRbVVY;C#-GnN7PqnzHu@vbRBtiJN)$+j43R}ww+x`u zVk&V;!d2&G6HUH{(x~-wgtcQ-*jtX08B0C*GR0z7npr0bos$IhQLX&&`Y495+1im2 zv1;2PBRYoOH;{=7(C?}s4d@V6gZCkFpxdk5-umZc@ZE-6_r3OZ*mIU;mTvK!6P?x} zKk|x%(F!WAifF3g0Dykx*s*oSIB&+dLkb>*`s+(`qfj*iiS`E8O4Zt{Baw5z+IB@! zGLrooh29(zobw&ISF)p0rw1A_5WmK;83i&ClDh~hL;3(g5V!!{vn$wgbC>}4UiuWX zW{8;<1EyUc1cN(&d4TZK#9Z|rxE3hU^rm==&2;SxdH&mu1GdR~siUsKg$bo|u5SKJ z4d(0$k?eYeQcrbsY=kU{UiND4A_XZrS#x_9Z3d)iz06GUr&V$B3E}L!P&uGnu=WJb z+6@%fhGJ^SP*+8brkSgW7D8NP%VJn|-F1#5g%*H=NyFwKg;rP#6tw6O59tvfx%y<@ zR(9jDCKAk50$vf%Hys#V9$<%-_mu9U9cXRk z;LnUP7?V&@ri4(ve-LC7JIZ_$6<|`bAiknK1?Mx&0hTceRQFcY#@!SIMy`eEvks4c z;vtT{!$i~D(g>6OC3(a57ksY|EyRzv$;81#D1c?BfsgyAmPUy~h8tB)L-kzf0)B0o z&pC#}*>XEKU@|XJ|7W=mPTHC-Q;sg!A!hdXj7lPDX0WvPY7*=Y$JafXLC!_uJn)k8 zh@_dOjDYM0@=a3o<|yQ^(=Le-Mw6ld0q60dEZ7@{u4=2V$_tJWJhckef&V4!DrpxX zBJ6(TTI4Bc@GEnSg{-cKsQBnw>V-sE%@ja#sh|s5hCB^lbHF?Y4Eg3ajkWUvpcQ%iPV2+W&};FcqY55C#C!U6cd<< z%h#(#p{I|j=_QVJR7ZLrjwtVwj`$req?)9FVK{UVEYke6XZXfiHWy=bnjecWpE#hr z6AK=41xs8I6JJF7F>K)%i;9S1hv5^o8Vpi&Y^>gkFC=vb5XC!CzQs$h@5EA=zyVQo zG~&7HU+?1au_|pt6uYoMlrGQV7hw1VZ56~i^1ddjys=UpQP@3F*!fHO?8G|47hl8A zkZ`=Q{@KA`s*9!IiuR5gOc^YVkDZa3^e=mUa}GC zi=SvUVZwt0-LiLPW%WMwOy8A>o`*HD;87`vaRK3J1Hqek3CY>mC;~hhd0{856`pC2 zA8)8#j=XnztTg&it=0iI3d)_Zquip;R5V)<2N}6MFvmB!pzJ z<^qfPrTu<7DGn!&i+zzJhUk`PM#%J;RHS%kbfyvne>!|Z70e_sR%*aBrux4wdOpL;1?##dryBMGXH=arO+y;(;;n*N9!Z1_IdU@`l_#q_UgTDm0bA>{!5+-6n3^0JDl z&$|Jk3ye5tLTmB)Rx8&Z40B1xdJ5$)AQu9m+&!Mw3ny%E1(1WO z5p1W#7r#<`+0aFa;(BYIoR{J~ust5cQICcP?Z`uEo1w;gJ|!EkSL2_j-r%sWVEZV? zZTKgiVZ1S$9 zx>+CQKpO+i$+52}htfSX`G##jGvoKEDa{Xd&K8`A7t0%jS>7qJnY7+!%-?RQ({A)8 zghYJ6i6)H@#e74c)-5dt0aTPy&l85`WU)iSi5d^9Q1Ge`T-7-(noCB;7)l*}N7~WX z9r7585(7N4Mc$Zp&Eld47me+(a#>hq*Ws?XXIF9)Rb}X;_fCU>)A`W;=&aa@iBtkG z|0y9V!)8hO*dzNATg{uIp#5c?}^|2(+b`t>&td3XP833vCi+^2IB?iFm!!2i$uKO^Z@R zQWx3LU4uFhJa}35-V+>AKI@E1S7Pr4f%gx@o%0u}lUj}LBZh=!2k#7#%O!!h-91A*Lb_F0#9 zJkS^6#G*qgg(LTW&)Xc2N~LeIWtzI?zK&!=ZW&Bu3IeR$cuR_rm4rXP>wklSR^V|@ z@TsWqqTZd6nH)N&Dz% zACD=J=H~u;uC%waW>~IswiH86UeJqW`+Yg;1 z0L&9K*AeoxuD|pI3KA=AudVwyG*)d_Z4n^tYB7Mk&X3Jw?TuWF?g>s6K@dykbgX2dJ}uH?Z!vwcpp~2MZ{znIU|6youZ93Q!A#Q06{dw_DYxN-_H~dx0 zay4>wPCpJ#Cb>$4r^4+(6^1N={@_>hCbE_W?QO2_k1_6zvgP`WqxjBWI;D8H2;?bk zu#|;K<;;cA^zlpI;+_|leaMyCh|;6Vlc30^OcGQGKM64V^knn>rJL@kn#o%aJ*>oF$gx!Ux!ss-RKJcfMynjV5KF1FO7OF zjT3vUjlIE_+zH~gy^b(ZPDnw+PT_$ARRb%JYl?;g)dK}%zim2)2NePX7$D|JjNCv` z*-LE#@)w#RZ%gta)x?}l;s0dsu0%nqsazLN;KBc?F~EaA#QV;oA*qywHJ-l5T=$dI zYFB0}sdUW@(a25jTiRz%N7JR#niN{cCouV|6Wrc@GD=WsZNoFgjGKM0fp9JHu77Fc zdfnNm>i33`yER$3PJ+`pu>aB~9E`0>0vQGZD`!>WqPUACi6vTHru>u#awo5BMy&FO zFlpog440a8s*QjhBT)B1CMmAGxx{PIXuNZ_2%C88;IC69ZVCn4v4RnAQdC#Jft1PL zL!4DAiv&_N_Mec~w7mOXV{!BA7&r9BpM2kjFXLR&)}c$^PIkEhfK5e+XfSOd(a0Zc zeUz_vEPV>Nr@n5>Cyh7rHwQ+w2*r^UDS@*325Tb><9EMS>`%DA_4V8OaOt%f*fsw} zwmS=4d)aOj!q1}$(vB7%_f-g^rFFIqv&3@a0%zsy^JT&!r4suVl!_$sO>aq!(CE~C zg%0GK#x*;tkF%d89WWOV=?ZCpBnNT`0{X|+Zv+aA1T*n6Z}2BX!nbfPCq3-sY3&4F z<(K>2J>s!HTMX}Ls%+XtUZj7En;8gioo?SUR;Fx*^5=0b9e)kutxTL z4<+p*U(>#xH@;{RrqO{@q6%04>2qa?Rm24@#OVcV`5JON<@munDGWSqt1aCxgXFCG zG{Hfr-xH*T`SXHuCR_F_wTg*^QbM?dLCnK}9>8Yg#^*R*e=9w7?7+gD)L!LP=eynA z;}>`rm?#GzXmgP57ryzLTUC4MGCOxKjd{c1{%%VLk7>s&Y4Xa1&wkzh;n3sY zz{E2NDLmh@Jur-%pFL=~TTP{ql+?ndz!3?Skr$q>!h;>jfoe%MD*D0$H%lh6n1b|3iW zuh6Y$5Ux$!#)g#gw=*EF>(dFMT+@m~e%+H=qa!F@8Y?0QRi#%;1*8hYppZGV=?yI? z84V-2T2&b%C>e$x8B-H$?^{?6UTAVbdbO(R;cE3P!=Vk7rq$rv4~Aa3|Jo4xCAU@< z156e5owqS%+i79(yfy#zu%%UuLHCGqxYjjhyq44~T=&vuL89`Q7t#ewf3`S<|1KKN z0o%ZCcdT#S$GpyQ{q>N)Pcz1>GO}@m^R}xfh#k0NuC(XM2G;ee+{3*dwzCCyp=XK> zSi*!*eTe8@*27d~y%%}jYz}xtAzuJmMmO6JOT2n6aghdoq#rD7$|kwPB7_FHFBd~( zkPYo#u{XGExC7ENp!tWYe?4@~b1ljdA{tR5bo}$bPDy`7-;f%w<+0A)2cs!?sU^-A zPSd|vi?Qju^^i`zxcgb!`OR>kQ~G5m7Wd5Bnjj|a$|Ko(9I2YO%UD_xKs>2yDVwPDA#8u%Jm% zM9JXjkwmRt6tfvJ{FBr0kNB(lwp0d!8C|5~SUo8+;D)Pi^F{9pLf47dhr31Q&89dp zn-kBCf?bfSUp&&0a`m|Dcz+M@Dd|FDvpp6^-rZvcRwmjTod(LtUi@P3juFV}JL`f! z%ym?H-x~HE@zZ;>b+tfK;)^KzTg zGmFB2$t@kx6FoA17Oy ze%=jT4OUKW74Qwp7{Ug?oLSSatzV@VAK6*8sW5r{wZg7D*0w*kd1YcX&@h60SK2`~ zj9Bt>bVxodRN+(N&7=FN1_vv_ujJR;a%m*7=|E*HF=9b~$W?(|;Upxvuf$u}(+uQW z$v$;MMah_2qb2E> z5EVo5VHIw+qX1N1GAD`sV=$+AH{suL1-7fpj0XW5aP>3a%P^JB5NywrX9kI8r6TL& z_u{YDKny_ARsr4*B)%QeV+vjg6j2sjeE?SQ$q>kwYaJu;vU1n20HMa+ zXX8ZOb{Ur#-amGsa_dKc4O`+!Q^orA4(a=?WMg=QoWpJUA1EuTI%Qbkt$o4?bwEq+ zaK_*@979z4JX`vtPi^!hHqY0N{%iVLQ_4zH%IcQ{xM^wYF0*b&dVblpWjx-x_b{?_ z-cxbk!K|%G+0)}Qg$qt)VDlQD^nk}b;#pXV;_;i1oyD2e6-P8?Pb=zgyg+DbZ)RYh zFV$ZxQpbULR6v}_R>(QXJ7=QCvhSu94`^_k!joN*lH&0d0%PpbTl&)drG?S^t0%OR z(n4=Q^^*gu1a*()t#`9l3i4QlUJf$8)H&j{;l@vN>?m)XXO_v!3t2o-*a1Uoyk0Nhvquq?`+oTLm_%^XVJbuCbUM|(+=YaG z!(V;0FC=rIgx!RC7f)tEKinOLMKYP3NIf1vJGVGzR(a~)-EZun--2KJss}bfk$gj{ zL%!=S+MZ4cfei2%N`gY*g}0-3&QoN^2mKO4J{rTckb5X6@Q{j-Sfl|@OMzYI-N*(q z1>_(07S)%0&iQ;%zx^q1d8=PQJCEzk#(v9Ut@*oTdep_RgeC-6~ z$5vg$-OYQ;WBws>G+vCL5=w(sHK2r0R#{m(K}U(KBM>y^uox0EP#p^)Fd;tVt9ML8 z@8)xCfdk0}LFh{E$b^$eE+!om!z2Po+dirh@|`|rlwA$@(!!o=ZAX5MY_pE}({64Q zGg2Hg*BG`V-PM=2D`PP`ROcIb?W0`#5CQab!@561q!%k@1$uQ+#=>5(Q$xKuB1jT|e;UvhfmR z;S#fuWTpRn&(USq*bkwLFdUWr75;Nsmn_4?J~l312`g#;tpAR!w^NXD<;??B;cnN5gvRxAF6h;`z9ah0TQCHR_Oh=>&b z)xgD{(5fwm?|iyMUIP*zNgi~o8jOqMx7ENFUm&8i>9Rx6GBAzA6%_!R(GFXEMHNN0 zhuwn^HnKmgy(432lE2w91}AMb^|JybMSDlVjKBqR90m>3*uM9?uPwT_#c^@hYNsl} zOT?_pKZqtZG)KhE1KvGdRSg`8S3krg4Q0ZWV~Nt_5Pm!g%l;_0X6P2<87*PT&aQVM zfXNi9TJgJ#D)8k0m+E=x69wu0!2d5Jtx^cYV9T`;&KU*~CU#7Jlx$)4_!-GP1D{c0 zb}}C=3dxg+OixWPdE^XDcwc&Pc0udB+Sj*nevXC5Hq7(X4W-$jFk412-m_Iiuwg^V z^|W-Zv^;=Mx=7hc9n|%|88y)p&H8tXHoqbyJ->niobHDY4Mp>DW5nsF&GDP7Q2Thc z@Nbp)6^Lhf&efGWj{4a0ZJrS=ds}@A>!-w*?CS{{&dejnV|Wpg2n>T-n86R%#gh*F z_hVZZ6j3fx4<9id%6TGJ^q*fkyc9>61zH!3Ci$m|gsA%7%1jufkb z5xzhuK-biwI@n?w4v#_&$^N1^l3&P?k4T@&H^`#8h=on%a$Pczv4Q^!K*lWMrb0Ti z#I}`giNpUE!p3!0Hx^*Qj(>~p>tEjc(`b#hY}*hIfmJNk^wVM@N;8v6G0L~jfFrrF zlt&!TT*ls8vC#&Xym2?U90g{y42?T&@Q3Ixpx9r6egeElQ;+077bUU4>E(ogaP6~T z!to~o6NLz10ulZ4P+S-**Wxme9!=U-YYmWqFAwF>Hup1VLx5>Sh0y^GV8-U2!G5uQ zTl@;NZ{sL=(g=Ji4Rrsi0Sy4DMaHe_Sx16%{;C89gN* zJykH+WG%65dGDN$ClxtU zRN-B9Qw{9keyNGQAve9Z|9bysfy2TTMC=;)P@gB?6q#~KlOtJ@Sw!9&!1+T^T_$}5nTgu6dk(BbOr3LF!cG0z?B=QdCstGGj5)YAnt4J@x7yK zr^bM0b|Uj&ysw%ITh#H%3r!K3NfTEM0d=0Z*B8h4gK~%)pDs!KIcESvZHJ9$9-~B7gV1UuN_Lu#Xp=3x z^j@R=3Ns;oU))n{_H_$h$aYLA&8QR!S0%roR!YZ6zEE|F1krdf1gFq${R>nBC7{9) zW+9=zK(&HRMppkXT=03)O|K#(oF&6TM22gKnA;eQ2{u4$VvK?29vWY2U}ctn*dkBb zW|i`@!q2!c?gWZ;jdowLF*Ket+G~~M&m10K1Z%VtEvkMmJ%o?9cBN$)bNOV*Z^hEz zrX>W^o$FHu%_=(Q6M<|!)S#@>S}M&tirDTcqF}re)>aBfjoYVMU2Of)2t8tbJg5xB9r+Ev9C#`3@F%qE zBKRlOwfFA>DQ*v5Dp)EA)LSg8eCOSCoDsVJ>@1_=Dt~NoD_! zR*}qJ|A(xv0IDkN+NHa@aLMIOd+1ex4aB;{L$i%*bVG(NKCP=^&2 z$v;OSJcIVXP721FF{5_p?B{j0=Rxyf-W(UJW0d>hHAbuHPTsI!vU_{CAT%FNR{Th> z>J{`am1)okb|+JUG;LYuZ{|I{o?MonTqfC97Dj3vXwoFs@W_1LS7C z1O(Mn))qYeksi{mC@Nf0G-J4#?LNhNcBC+R0(&aa>!VNd5TI}s%lF;Z(f%zbFLv*N zeh%d40V@hX`KsTp28oqup~soCy@7~G(75^T86k-^O0ok(T0)3)NBOr^db;cUXZH7Q zcBP7oQY6O1ypCzt!t28UfFlasOKfGC`KT7ehAP!6Pb|_|chvTedVNnUeJYR{&483eA_F6qt)?9MLVs~DSk4?U>>FU+mkIoH$!Fkrt0N;gddonhb zCPhbQ3TIcx|HVHjE2IO9QxiS0%YCM2eE%^J>u~lR@Hlht`XriY?<;=lZGJG9rn%3VobVPY9AX)|ksaj;jrPYifY-eY|f3+5?`}q!FMJ z_@6^L)Cv7BbHU*-Ml>Nd7jpzYMB;$+pwqYFxXgrdK?>W1^s2Kp)fqD$r>TY$oG#Cu zXp5G6ZOE0&QkBt~_!W%%k)!GK*w(0uB{^U|L`uoZySj2~Za9W|ol8x3-AsE35a$K< zWJo2LYH!z6V2R_P|498Uarx)whk6-4{s$ke!o4~IaV$28w-y!Jk5xRX?wUw^@+f@d zK{*1U0aZkwGZ3h{4`r!}?@1lOKAl~FZb>}}MhaKC@2o(j5*ZY#kzrc& zMSzQ)0)V7qCo>yWGJ`k^kSq3Nxu2JV@}(Xwn!$q5L}_PamXLpmx3?rHzqf?ouKb9i zY@e6&S)4ANnwX9@hdASp&X()M6_oGt|Kqz8gz&Yg5PzW8h6+IrgphqDvIW?No#an9y0w9jr|@{aRn zpPbM|Bs)!_{?iVOI!jyd=|{S2>^Qp73o>v1%XaS~{!4w=j{=wXe9ZVNU4aP-z+`L) z#NU5=eI4;vu)qHg*+}vpO4Rpc@{#$5hK8_|P&7fAGw3%_D1G81>?le)lKBmjyLE>` zCirpAHtQSbfZ(x8X`I#NN_{OSZ@wczEEOL!u3im8 z9Nw60PT3Oyq;1Fh_9qi4`0q9Wap(s~a*m)c`sOQ{gqTL_xdBdd$hlb7D`yF#(BF1m zp^XYY_yq$Z)s&nzY$$BouG;0U7{toNJ;%pRh^E`squLf*KN62PO&EesA6~6weJuW+ zZLL2D@y4P&?4UOI?b3Lo8BD?&n?J&wVH`=41H2{EeA`Vy1{! z;la^D`yAX36>B~~HH#*R7z>4om>2WL#z2n5#_&#ev2`yRj5U32q)=>YSjGL)qc_24 zZ7v=fEVz6}Zba9%fj_+@d%=pPqeN0Uq&H!{VESbIAGgC&J~hfEWQVW#ov6 zB4g=pRsPkz5L^-vmyGFeI4%gVF&Be2<<2V5xE#_y0muHD+Wy;^NF>c;L1yH^MUu!3s>9tb7!WlADGOj6Hz}o=?mBvm91iOl;;iOj8iCo>&@fni}12A>CoW zQTGI#0=R~7-6^<-W`r8p2Q%p#?5Xsck3dR5Vxd#&b7`cttRTNAJ3-$QFi)V{6A%hw zho*JQwys8PMBQek8S@UfIw-{N5`t$Jw(4#O?Vc5?>(?S_IW)Dm`E=N(#35{N0+b@} zk<#H;*d7o}xgyEc2ei08wVMrmT5owm1J19nX$i}sqm!J8s;_O?;_s4Bi221(h;cbU zhF`IWV`*tn19Ku{^V?mZs+7wN7svsH<4|tbjwi+icN5eri@fm(NFH#+uWCEX*`IQd zy;xP{pt+-(C#~KxsF3{C z_F*jAf!a=m9`}&DB8#}KNYyf%!NsYcypvt$JHq-10BUYSzkoe~*S^strz5fcuG!Gd z6WhC|bNHgP3Cs3gP-S<}(L&juV*2-kj2dO`s8Jl3g2RGHJ0P57LWPse2v{3nd_kT6 zH=vvtf!bv}4&d5>aNwIMt^5uwrWdf7E&o}}4q!3;fyIpMp2eyQTfe#8&7`3c-!=?q z?YkY|{cJQzS1`Y(v6NFDc)B(AaU~zh0Rw!|Yxfmkh_*_1k{NjMQbyus5_$0i`)51z zN_{IzPjZC4ey&|YGP)@nBVf4Jazw4=NrM7Rcg}4#VVA0pj@eYYeh9%+JXm$tCwAAXZQLe|GsmT#yXSlb`VXu1wOoQ~=xe(PADR*YnlWdWigp2J z`ZbtDKq|dL*OZ|TlVb33=#?`yMZ<|$B)vjX?_py20Bxg{14DN6{~5*_9{|wp*~(|OB$$4Mo^vz9St;6g|Gm) zUDb|6_6-87C!H?`i6ldaB0@Sx5OAuV1*N9b!L-(9`jdLYQf)UIRM~8s{4**^T1!Dw zyNX&HaObOV4JY7cEU225R~~+PF&ezGK+Lu=>}%CsJ%CoblhJ~0yzE|})1Jj2{ot_u znNOW0Cbbb4?Bo=hAkpw9iG2_fP7kuD0%IM*DF7=9uh7R;PfJrlUg_S0LXQguC3(Pt zffXGLDk&M#Mg(Ii&TJOKB|%qoR|uXy(n`WDO2Umv;=)K`eP{-Mq^NgKhR-7tjJ5FX zn=Y)p3O$_@hjx;sz5j!0iqTE>PUuKcKc%aSo`Q1e4%^t6DF0`O`e+_1RR63ui(SQ4 z2xLi7IvP_X+Lp%?vBFY9_FZ(>9NJ&}K@X3Fb&PY?t5ww!OuU`eJ=m z2uEaTlB+JP5wr@r=SyZ5zxEK6@~}fRdM(G*_tesIWMXgeX{9ZeRo;Fdy7Sda{m3cK z5=i4c3{D|N4xJP6UT3*Z-unCdtp{&Fa)+N>_Q~>UFeg!Pi+}6gZJ?gl927*6VEgRn zn6Ju%KJMXemvfk>5q5}~^J2i0OU1Pp2@uCc;o{PPxHv(8NY=PGI`5J#vw@ODi2L4 zmiS<9jPgMau{DZ*q^;{EWQBPP5iFPUo^#qAKD;5@@^wRE4db5uhj( zk|*rt{^1gB6<`i4t24Y}4iUokL%$8V+~ju>hAAmG67EmSguHo=-)Wg9jg}2t5>U%U zNBo@4791=tJm;SF9ezBz90maZtRD#|C zkWIu2$7uw)f-HGdC*Hzv8VJPEpQ@=Vf2v1JUT*34VSH_m3@*OdyWl*xOZx*$19QQk z+}du$tuH?S;pfNu=#-5wKU$BPKz?+tN|#x6TEzHJqJmF`vLRA-t_PWrXD;gX+d zBNbf?_Ja|9?I)M;)XZ3|P=zpTw&*&N&g8mMU!kQhO2|+chm2{_7V*2#Nn`?%j#5S_ z%3~T)2!L^r<5@`srb;wwhs=~tFGMkD@h$L-!1fxwHATKNbq`1?+ockuK4v~v))e)= zGnGG?2h=|f>c0x9(%yF2kp(cw>vEeS;Sq4$)xwV1waL2qOs96nZa1BgB5E7a`9J(b z)Lf}16+Vk4bKu4Z)R$8kD&R1!S8vhh)$%hZpFvKgC{v% z1?n}3nV>7nL>3WuCl_5VFG>K{^%J^)+Rvw@f#{4qkhfxwNg139G#yL{h2nQu z3Dn05%%G_RVCsoSVV4SJuB4aSpKkSiS&0TJf>i*xVWS@ri$!Af1~0N7d=rlGQyP+h zai={aa`$eDF^9rTSmxzQeE1i{)uGrH^wXmEM_JN$uTF)p6UXv~lDMhVR@5cwV7AyV z#V$0|bH8OdR`M}yPd+r923d?G4os&YXidzGIvMFhbE>`_iQO9+HqYV@93*xOvx+6@ z9MeEf)yUSa1SFi_mMv*?UTo6}5NKhpFLzhlb<(>Qzx_>HA@@UY|cb+bFo(Qf_PP_o3hsepqMUl)P#sRT# zXeKk(A_qI3I*e(q8OcvVxO+sa#mRq=zTA)0tQv?yhjA7ZSd>9`1Wl-)mH3R5eYz zr!9=5$VSs`5Nv4MpG?ahxot{sr?MUgb+2NMU?Y^hIzh;|O2VS3HHP2TM zRXHVOuo8JuX;xI57Pf`~{=$@zgOKXOU+9Z_8$111!u>UR{Py}BkAEM$LAcu(!5^cE zQ#o@;Our`9fC{!yDM3rC9+R9+u9?#NKRZvJGLN-kjiXaTubikB+0V=+z*0qf$=ih- zZqUT<#v6xCE|t*EEkqnQjGIgck|$0A5`TRJg`n#bJNl?1t&Uxzj%U#P z0~&7;P|Z`%FJ18Bf>Gl*O$!5so*|P=Pl@L|;8%2lh;c=6CLu^N^5Wb9<#pm}3~Rf| z(oKEP-igQs(I0~DK|$_Rrj~hS5pf&Fj|E9uxGB0l6g?rsBhTZpsS78szFGy%bROBJ zBfRT|3$6-=vE8^@tlmL7#)W58ohn9p3?r?}(dCnQJ9Ia_MFjD+$=D0{V zACK#hiy^PZy<}cYthG5(nP;AUoQ(qg4-pm0#eoU{Vh&YAY&uE{Xtl&9H-B{SkWOdG zADGL-WQmZR#e(@@663y<4^eDOwf@AP+g8Hv{Y7G(!NV~S@k%ufqj1rqS&iLqzEH+e zGM`J4o!IW9*Tmy)%CAl5f+&QB&)HjBVei;|j^t6p^8dr!wpQ$JdK`S=56NWSHInDO z?ajSq-%Gyt5j2ogCQEFTino}R)>w=s*vJ}v`5)#6VVJ)74|UTmeKq&`xx-&T z>*tf^V1?&HtQO8u9YF*Z8;v$JN!0R0d1^-J%0~f5cP@U9{Ly-usJW}&h{rc!T!I8XKZg-KFPnFx$7%TD#=*P&Lt?H{dM@+3GLlG>PJoHXFL7bxoX3* z@CHcU-WjC*l`zJ#l|C*iGvenEbJpKQZ;uAkh32ro%^q8xp8Bt>qq0o{@f%cHJbdoI3IuR7ECvg?@ zrBhx|hQ!0rf5RmdS%{K8oRb8}wr0UVs^W^|yI+eX`k@zMe%R63o1fM*Rwyt&o#JQh z_B2MNaM-%z4v4LYznvk5$;!^g`KZ8R$u%<=|AHcF9T@grZFBq)MMP=$^rNiT&n>DQ z)yWCR;kzCWCb#FSB1gF|sDgKMW=6-AO|mAFHZ3o#rGR{mt}WCWZ;$ zvA@Or3P;^eK`;&EH&V9PkdudCu^6C9<9kjSftS_&Z-H!q!O|nqX%fO|+>c2=(a^d3 z=2JLBG)~=X&ZgH=-#h0=y~J!f*My1n=*RfBKCG^$ovm^@O+0)HBgXv$;-Sg*Uox^# zFcilBF)1SyjhY&g+1Mvqx8ABQNFLkQ9zL#|ncl2kC0 zQDG|dJ?77!&S*)d)TsL`RR+;RG5^;|nh`J36bHJLuMzZ|p(tOmnY@+wIGZ@sHdl9( z9Gf_S6mdlH`m?sHi+iWSOjgh7`%3SYH9==oa4Ow*z7fNHEita3HY*eAdpaJxO`GBp zMZ-@iY*c%i+G`L|y|`BjnhPRL4nImWfc;yR5m96 zP|%%SD#4EJuH#z7w|Wz?g<#rjgqS66j0{0x+5NzuciWZv>Km>)sD!`+fp)hqByGSn zB}{EXdQ`;-46Wv1I}(F82rQo4{v0H<3{r|=X&e$zh6Jy!zn*NUcgv@9tXY^24SGEr zTdS5hZLef){i1YnW#lMU>*Y10aJ%T0J&vN|N~qGZ%8(`oK~CbaCZVr? zZQ9&(zWuf}2ev#pT%V>eTjH?L=mOP|&K$L69yW0mN7N~*$&4;;r*w)7 zi%~tuE- zi{t0A=vkD;uJ7*7jjYX(@& zXN5Jom`aF!toK!YqX=<>yKe^@%Wm4EIx=HnL}`V>!(+cUEnJGE>&o0iMr!v&MzS3E zBF<&HRQlf5RHDUT0&%+=1`A`OI|v;f9@sD!-Q7eE>Q-EZ1~Dfcgh=plz>cYz#6bEx ziUjW`Kw=8vf)Rp~7bBb2Sjs4OI!!?OJO8ai7j}q;tUCe@_*&|3$Zz-_%vG*?DsfJz zxmKo5hQn>CXT&}|?ac(P$twKq5&KdR_ny^aOPui;-5Bofxo_)Xz?k$Pk$39G-}CMp zz)$bKnK9MSeyjbdwil9oM)ynp+Zo)iA70{Kw}G%9HDMpS)Cqo7!Q29S`MhQl<~fjb zj1?|>E@*ZN&WgYFXJ=UK{Gw^5F3}Rvi6{*l49_;0TF3@)HlXt&jCqok+wt#C| z{{;g$gSMioLVP<@N*Gb__?*=!(h@f*UJ>6fWzz!&@S8VkCK|9}(NO$>k)lS%adCo~ z#B}j-lGtxrUxgX)72pq=hcn4}FU43Z@-A~wT$;?aTsa7#FH1lwJul zvrn^a!XaF$9hX4j6%I*SMGof6%=qq~21f4EM>{xosb zB=W%oA@#sMp$d-n&e?;3j{fC+s`Le<_J>)d&oa|Yy2Z}-B|*Bil)aIcLXNvk0IuEf zA6N0oJbONj8FHmS=wHCkMl>%#=)AepxlCmpho~yIO-($;a&p9{ zVCr^-qhLz%Is!+2zH<#xTXTg2(?wP4 z5DPR(IZ4t}p47t6;r;=2wr#|x%arqwXTbzwUVdYjzy2{!zo~W3@>T?eO(g)-F~-lj z!HkS?=)jrtzRM+drtkBMQOOJVCHYxc`Q_CYyl3g#sz(YR3ENlT%UkmSb4SL;tM=o^ z%-uPNTsP_Z8X_+Gc3%`YkPvbDSzhPnTPM{m(CT#|4tu%7?uAIIJ$7_3w-%G-UM(tQ zp+=l@MCmljye_1z>Q2qo$_sOMn!eD*m;||J*pkRSrzb>LXCn8MN+krObjuOPd#I2_ zzC2OTRKdKI4t&9UdF$^m(G58<<{^&zL%j(R?}Z?5eE;@PkN$Gx%v;Is%UFC1BlP!| zVI?8;5yq2q`pgT_EQIavOK-swTG7}oDLpqN1jcb3<###GTkFIvP>#8dwOt zQ?9W+^iPMeY01ySf>;WXS2)4J-M==NNeN)DIiCNVL}F8`P(3}G>=YzI{FI;XT-*+u zR75idhDm=}NS=m6+{KL$I2RX^QlBsHQj=eHu9s8K#Gb_-?`0lW`0iHhA>p$DQ7bv#{7< zaD?oL<#7$N*+;w@&K+Hz&UwV%`C#@&0M0Ca-2U!5HVg9`KTW6I&uX((0ehQVaL1$G zA91OQ1D!iSI@;}nn;uYsLru&@o~~(!(FXt&%u3zVG)~asNsDU_N+GTUgf7SnR^oj} z!6=M=m9TNRM2n)HYZYAZ8vvY)2uTHCP?LtM(FaNo_%=2_o}P5e6ZAaAhsbH!Ly=FCdU49`7q3~=$q7*BfT zm)IK&l3heqND!57CgDl3t?-pt{({a7Y;|mAOzGhWm{KQ_DMY$L8HwniSwsoIK41^8 zSe&3oXu8ZH8+(G*JqzdpWk(ow$7!%*Sa4$zLAwmORf5kDr}nHtn8buUO)r8)M%KcP zl7`~zOW=%YMs-pi@^h!`_SZmFknzUW-2hv$#J~a1Z7-`2DX0Qrt(z0dh+yQn(*JU;Q=uYd{Dn;;n zI1Ufmt}tgS@l;?L(0nH9Qe)aL z>vW`i8coyRh0+`1!$zMCB1d!Lnb3b*jCSU}W>mAe>~GP?yoIU&w`37pn7Afur>ZM) z4G5lEasfmS?g6D>hIhhje?PEHnt8LzTI8TUJ+ngE%BrxRjE!l|@Y>Dj8+6hz{3_>` z2=l|9F>(t;fp47(48{Do| z-Ok$aVGmheUPGgq*CT9U3w&yQzR>E``u^)v`~gG|%_Yf>^kq$Ss|x7O;{9@b+GZ_p z(Ll2jCRD8jO3V5p>HN=E(p^R}UGYWh2&+d%aS9dcZgf3ClSYh78p2mV4}M~{q6Af+vp~pbb=FG5i$^Ix z=ksp5Mw>$f*3cBBdu0Cf3kQS+vUxH00At1Yz6WeS+o6IRHpnE*?Q%oDje}`p znS+KuSjP9WmYXo9b!tOw3re9B%|@`)>P1?l!_&artISo29nrEGp&BZ)1-S*;l>4Q7 zB;Bs0AHdL|F(3Y0AHr}pbqzb^56rRFMA}^h-$(J^J*VDlF9vnt{-}hoKf0{+ljR#| zk5nghgrxSzC!2B`(()l~^w1Fi?#U zV~GvXs|$@}8rWahM;J)QnP%N$<`TjrI8wIN(~hFM05gp9lVLC51!mb z0LtVpGL!g$!#Iyw*=E`w7KMt7-yVbtZGI}-E|pe7;4mLbeQHf$$)Ifz=ltM^(ATyC z61GbMya))d85TFf`D>ym2RFaMA7O z5I*8K8eBF}9ozuz2hDJqQuf$CQp{jB{l3&(<1liU1Sot#Gf=(6?d1fHrHn~Lfb zi?W%wMNlm-QdqyyPr|2_XX6edM-37d>CiLnNWSDe`N7zqW#DdADcOBaoNzA9{W)6b z@evnQ?G;t;$Y|3KPWC}3dV4!6Dy*YksBg4Sx=-~Btxq|*3efbz#-##@c)(HtO)t5P zqK0=`h!j{#xPWg|0LpR?gy6B{tu|c3HtJkmz;ied6lWar1Oi4T`yxokl1qu#HPiw^ z9%7YLF|t{kWZSAcQET>_wR0^7?F{=qq7%S%*6OJJARyWGO2#~ zD7FnBK9vip!DEs(%Rw;p9(y-G@iGS??Iqe^I@hSjVJle9i{wx&$fiQuy{QqK=F+z6 z{FXqs_bn(#hW7w22jKGYg$lA|)o581>7af!L@uZ+XUr2(8EaChduM~9r-YE}E|Hkn zc_>p7;gCNNcbukD_+oVcb75O&k9SfJ1u7LS0#cC?1m%EJ#GIIl_jTdA#{~}$=Ghyx zeX1kIy7Y%G@opGW4LL_Tq{9$KwS&b~Z+&8}k9O z)04KeBgmymMiu-}7&{}%!6~SgV%-%7CGc9oAXap!ZNn%M1Z{R1=NCoQypCCt zim?p`HQZB~OjFtp1&RcUp+62JhxTXm_CjPz-HGX&=Z!mcVO2u=leCe|qK=-joufQ$ zi^R0E*JZs}_^R{wX`AnB`aXRShX@o&2bFvj%M0Mm-HV&&tR(_JEmE(#l$N}9$(PAH zJVv`>le49NWB2jC=}=u92vZI5zMvY~!!mMS;C`Qy?rE>wgYWHt`<<`t}KmjO2&?4i{-PZ29%)(b$Z z@^(MtJne4(=hh=oP1MpS%*ocTAFA=e)^*=_v$&cPWEbtEzY_boxQ#e|OT^Xd8hf+W z%DviE<;~;>M}SMy(737#@zLMV4&6)}8zPH$c%FPyZ-hOUKLg2m8S>eTc?IX^{0UYG zCf!eB#ioi6L=SGNbg8rmNB>1C;S#w&Mu}cT&FD@>-S*KCBqtp&{yA@_HF784#K&u3zxJ2O2`|SZSkvInNCKrH~yG z{HJz1XaLPT^W2|)E?P7;Wd!nGtP(0vs#e33)M$Vt*nuMWN@~*Q(cv|0Np{#aIz)~v ziknWER~f9`=OWBI0}XFd6Bx~MMS7ViJTD;Y$@HX&YuMV(wZ))PR8^A zt`2Hq3APGfHzW*LeuWsnhIR`D%|k~R-;UEa$EdcHs%~Ge6-Fo*%7#_cW>uU=-~Z<5 zJ+3f<05^|dw#WF@`JzOS(Itg?7kiQdN& zJq$jDqy>@7;{~gaz!TVfj7YYT9@pT%2Q*e+(51}Y0o)~2W6icH{bE9Ry3EFq)`hk@ z2Ry+35ys7Nrt6fL+qjf3Sc5yoUHsZ}P#b1h5 z<(-dJ{wq_sOiXYRvpIb}HB)&(#M6dPzIbQtWOIh{}$KTJ{ zY?Jt9+24_B27LEgZ@h~uK2PmsHAma!W;L@!Gbzw7i1Z%+kj;V?l&pwND`^xB{(fNP z%|MV|nXm)6Ug(|U?q#SL5UMV7%EmmQ6+)Mu_z0t%A}x3nHbn8L5YK}rU*j2YtBswz zw>ST)uPqT&{Wm_MJ{G)E3$+f}qY{_VS$g-sb|XpUEVaX+`mwjC=6>1Qc9J92EMIea z*K^j{*!b3ys|i37BdKpGNcUogciIA2jcm zGf&@Z+bHB9hT;}tUW^U0%u@we5{MSfW+A~oCaZ)LRIvgA-$fS*H4+6iH!|#C{&YJc zOgg+Pn)NpaJw;`H01zQuO*6kXB0HwsR&7acnjCM-7w|Qxe(Zi4SOG)Q9#1V8V!^Zc%uZse?<}WJ%CX)Bo8?5eyiB!`l>*5bTA1G82i~tAg-e zhpCyjfiJ(7?Q&*5VnH5c=#xkxF|j@0z!Q0$SH%bs)BjD<+2Q}YCE0TWv?P0O{X{0w z_!2fl4j`bc{I!~($viE+Khlr?h9knb0{;z15V(`@0J9OoLt z<8NgQlkjv4xlzJLJM-6FX?E782Q&Z$yzK_R`_oHfPKbxL;{unh{Rmadj_9B1#U4)2 z=!%Rea_)tc6~WK?L`Kw~^|cRKB#w?lEpFBnn^sW}6>#Q7oE#Pg;(>%P6d#dnCf%yW zF9ak6evp&Q>TftFARk=2Y&V~35}q!xGKAHjtwMbbHb)rV4w6VAiojzAIr6BV{rpi2D^WC;R%_pJEdl!r8>3 zDVyN$0vCD13BA)YYwpAvUh~fY_HwdNw5M55AwelhgSgw%eWV6PrR8|d=xgR(G%nzN?>91)UVH-r9ZKcFCm$(}j>JN&7B@8A*Rm&L)%5Nu81%MREG?&wR z6!^ozNkcAk3Frrmx`O~9g@iPJtgKZOoUiWmqe24yKfT21ZYNUAV-Ti88qznt)n0#y zz`eq(QFu-C;XVh>aiyp~km3kXRNAuV%|j|`PGHfSv8mBdaWIUpIR0M15$;F(2G{mb zaC86hZPg934o`L~uv5ku|FHPhN3w;BTUDI}jF61N>W4uuXZI1s>j+O0z^?d`ecd&* zpmK5%0J{P|2H|=HqW}{QM>495kn~D8#E#P2F9xt^P^kAlKRBf8HS>}*vn?W;vDCc@ z*RyMS+;WQZws+6#xH3~$6Bn^YO+pQKe7 zmJ=JP{p`E$lDXH_Z~dHkil%-#Y}b12Q#BnHk9n&hGpPnoAE@Fxd^X>k;e* zBQ?|3PY!IC5C>!cy1#SR8GKLbrpvWKlF(LD$E4}BBq
    $o3yJXs=ruqcw5@MuLd}NR59pkD`T8m zwMo&d9(hallihQHD$fD`!GNqzQa{AMVK=49zjf?`0NvJ9DWbxor7Y}l<2x8Juv*E5 zPsksHRJ>B^olqwJDgo5}_n#PdYY;X|ncpFvyKE}#gvQV$gmF$>_Lv!oL2I6vEy)~T zKeFexJqHP((E<7##~)yT&>|6AUr~YrP~FV_qq-#ms$0V7?FPynq>xg~=g#ku!q4fC zb=hosQ6^lvE501Qm-_i~6O%mk`l{_J46$C-xed$MV^dyiqA5O(aDL7(%}-{9nt?@7Mnsx1gl{zvC7j7=*yM z#Z3KlOJJJBaD~A8H%5;jFNw2I$p4xjJb}&+`tbf|e(8agd>5Tz3ogE!0JBB0xFpgn|EexHHF%_D(i7AqpGpU{Oy;7PC2 z%dpCQWsf}&3M@9sAwY!*jLVj!SkJRD{v!I;^R&5r-;v4t3rkK+UoxL4AXO z?^z51rqRtn0D6z+=#~M{89Af=`n{~)1>ehit-=^6^3=5{H}8mJZBAxgDT=9j?^E>* z>M4=0*eV@lILz%3sIR%+0s_=;Ds!G0i}ReDZTXv*??ID6YapFU)?hd}F10y_`D7_b zEI{|Rj^r?zrpz~B=}Rm&)C!4>NeB5J@u$e?FVNl;lL?5rokk1*bn43OK1b0q*3~*A z#oHCa)*?VZpIjhyT4LFbpxlYbXrp!71!;87x5|8Q&m{MnKLr~4r*3_Gd=B>5na4;E zE1ji3oT!N&`(AwB7Bhzd6VS{L@K}3CZi?qcj(?HAwt5}`37&&IQh8L_E$@TjhfJbx0A~ICnG1Q0(u-N6k9Xw&onPAv|et_I_CMy~73(sK5B=uWS3l9zplG(pX zGS`;lGEO9|6|F{j{XLiCGj}Kb?jl!lC|wM2l0i_d^{}>J*gg%u20sz+_~fLDg;Mo- z?43f26*gan^89*Z>7~B&6w!chs||Vu;;OKpP2-mW$<$ZE5Qv4RpCQ)yljmQuPVK{* zAAxVJN3ue0H`H-rT|v=FImn4??HkZZmyH=N2L}|9!-!Kut`K>IL=-9`m_#Vb@L@l2 z&ePaMZPrR$PIo^K^xOaPPNp>w@XZ5=FzqqZRi# zJ{(s(`2eJQbwXCTn?vMJoGXosyhMyCmD@d7{j*3C_<*(^iTe2t;S7vUhsX1`oOCuL zK6mrW9KJ!#$2t~t0!s@MqQK)KrwOS;udXXJ2+7Hsj>|*3W)E<=Le^1cufSLhMD#6Y z>#QdsP01?vU0*e5uu^!>Z5}Ryj z7g{$ItOCsdm*Y&>Au%|4|L*h11J50K6PFR0iqq0-hRVE-*7{nnZD@k#zsC@m%rc@_ zt&ILkyCc`p5{@tYq_SUheAQW1lLw3ysS^WZMcJ{ySP_<8AG^4J69Rs0^e&`p!~bDp z^&lR5GM{4}`7;-QN%vK@SM6k{Li?3fF!9Z1&!)gWCG5Rk$LLxz!^BNWh?GW|J4*_ zU_=yp%O6=LqwOF*N?gDQeayUvsCoMXeJnD6B-se)%c$;GD#LVc9cnO9EC`FLd zFy$HLR}n=~<44`uSbd%3xf`?!+D%qeMe;_GA0n1E4n^FvA6W=Ng3b z5NXel3;Oe6VxtY<&WDgpG_OBb!VH?RpiyYUK=~<<17WtyF}M_f)4)+y9~L^Ma}a8Tuy34c zn}Seqam}wK!=0v0b#Xbs3LZTw-O{7uO_@9A! zJz9{IOxSNYDIg?r7LhjLAx5{-vdt zgY3=a{?(P|_Z8Xa<;s|gdD&Hr6}zlf(z}_cGS@tmoAMESLWbJ61QQlL)>)q6rIi$}H5Y5U8d*I&ofk?k! zZIi4&SUx_ko2)`8AFii!(Ex90xi=R6;35$)C=OSKO2>!oJTeigI=GO+)fi2MV3}FA zxa)efB8YO_tiKit7mQr@xT$s2WUOAaC8Eqq-xQ<}J`CH4%}8jjzUd@j$}LvxI)Wu& zTJ;7wEn^i9nKynZXDetW*?lE$7DcMfSdxg|t-J{4#SUVqWRm-j_M3tf&@<9=urWt}vYf8T{vUPrc%4WtdKWaIp>&<86d3va0|*aXpzO+>MOu-a3I#Sa{{=SJ zPyfzE;C=J|oQv>b80tk%BmL(^ZZ&QHC(gnULTt1iYj3Z%@5gjd9UlT?-+bO@_RG%B zIR8bt6Lil}E`-c}rmAHgT;pc_qp}xnVprd->9nrfiv`_*4*ly0+{+ECasWcG+sT*% zz?vf^P5oovaccMA26eyCHmfDWsduc*6`2@+0rUdd zNN8VVH)eW^!FBQP^qh7|O~azP5~i5B*a-zwZi(XH5iGE2#~W1WI->GoF6V%PSBiLu zWmVOR+Rif(~RU5D36JWlq* z3W4ll&3AWngs+X0cyina%@M$K1(Ys>Dvp!Pui6kNZOQQ843IVfDiay>KiG*=agqB# zY#GV3lH<3^vLBq!nm1$kg+crX%jP)4ZIHuFE;ldPBIVo)Zg~q#)&XHhjROmU3!{)$<|7bgn~G=r#`mNl zriO*PVa6_|i!osfZh%Kvs)>gwWoQY4c^lgF8K=-|dR&$cP6iqKS7)gi?pL7NRA z_!8?TeJ|e@t5$w~ z3hi>=fe4W5{-w)8jmi$nLe>3Kn}vGY-Av07VZ+P542yL9V=!no#h^RrGpvCIghW-? zW$zO%JP1h!<2M4*ytkw$cVUBu7AoBJn3>UcGz8wv_ajs7@UY0GI4(gr(`X3vdVG&GDl&@{c2Ki)>n)>WG$VO0y_Fom?)q$9S|I~P#8n%&(;JeG ziYd+{H(%Kl$`(YqdZX}@O~(9exwiMPnx`$2-%8nZUk;@`2I0!d%! z!c3k72K)PyNB_vY^~e%SXl}g&)>@g`!gy?*PZz6@&suPu9>d%jw->jLNZ^FAksh0B zZ;v?0EKl)sEo$q|%BpU`b_>mHZ*0G9*SxJP%e<{9mwqCIw1#pgE5qkQ@z<~0`{Dsn zi;v05xVi)DFZYWNE*IN3)GF8YLL0JN*|AG_6Zhg#L{$D;sH!_y?kpPKdpU^zABIkK4Ye<_arnx%>@x zDv$)ZdEzZ{K-Meg^u+P~7}2D7JWNs9KoV3QXT8EKJ(!&yDet!vYwc8K1+3Smee(3biqknW zbI7U7g#90qt|=h1w(Vxyla0x??Izo{T{{~SCUerH$+l~zQkS+ho6!yx9UilF8gJcRreK(-pXgAe9TQsl)pzZsB z*y*+7YV`TO26#%9aHCP5Q^mXwdKBDGO;RKME@(k6joAe>x2#hpjiTuqYXE_(qF1)! zsOEyoa;+Q0>R=&mz-Dg3X5<)tp%DJqFQL&U$9zjf!vHTg7Q>i3@0DlTMEMGd>pWB% z43lETE}S(2Cf1pn*cD#Xcj4X#?A!PjEeY|g+Ra!Nn}1PO?Po$vRj9y{8ObU((+NoF z)cn)#3VVRdTBcz5wN30v6L3X!oM>Aw9yv%C6H&rfbCrB43+WS`b3y5k-absX=lSv% zgA2v662epQUrWfp8*&G_Ke0cjx7(dmJYUu8uaRALnJ~_|`dRTKI1&-{+KihKm{QX_ zg_t-{X7KyNUxL|i<6F^O$o9l=oeP5zE8-BV@3Sg)#199mS&eSKGy&Hp&~0fsb^K2t znkcGX6e{DsxTWEDkftYF;N!m$vyo87A0TbfV-{k22bcGuug(~#zX_K@Jj3{=ydBKo<4V9!%gL(q}7;d!s!_z!K%Wnc{!73C)70nEexpRhL ztb{ENy`0XG1d&wHP77Fx7>3O`a8|*I?3YVJL2kPswDg;_noh)Eg$6dTJvod7O@`Z69PeAFL3nz`zvqX`@O+; z=*zNM{))jTzC(uJYT-AT<4p(dn92Yz_3;3O;_f$Rx}_Oo^d|@bOcIDq4y~v z)Itek&0qrzek?}Yp0J#pIo>>i-ah92H@~Rmb?fgDHea>l(z6g)`i3s<6P&J%;UFXl z?(^pTe6{qiiEVbk?!X{x3r-NWq8h(`hfUTMA(p8G_aVI%c@ZUE0YhboFy(++1xGyx zmX3l!x4IKt+NYx?pu#T$x>ZN0(v)Lhou>_SIAYWOcdN%9un7O; z3XM?>D|jfSQGi!8kJR!}{_=fre|*HJ>hIr~A;D=z;`<~za0~3BGIh&+;j1r3^ z=ZO;?Hna{s~~2q7%8urIc-7 zsmJSlH6q{#dW`NVi|M)3&D($0#tOlscYsd55|yqYyxKJIs^v}OH=}l~TErF>Y@E1- z7+C&j{W?i}m4u0sgh@^_Av6k~go*G0%}eImPXyXG^}qDTxj)cB>A&MD{g?g>!8eIp zg0e+2SFwXIK*?F`KWoF(yyVmni+XomSgr{{`!CHNx+EPGr4u706|=`6Bj%+b{8go( z&L8<@*En|hzq}`I2G^1T678NeeFg$$gXBW(-rad5sp_k9DQh`&j*UVkxE21sg4s)7 z<}mV1w`r85cr4LOx2VI~e`ddCh40QO`Pvu?7%}17kjx1c2Pn-5few=SZ!y9r)b)hx z7sMUN=5HG>dpk|&CJ4wU8j$X`B3uN*wb&BgBnhX0@N3KSZOVCN^U@o;nH=l4j}@|Q z6^nqMe0)gH5qdcRbqG0O{%57uW0OOA*|F(avBxQLiHH;`3lVvp+y_DBI=)v+k3K-! z)-if|+lYVfZ+{}{jm$7Ds9RB0#8FrqPErtZR7Q9dmS87z=p;^xihn0`V9j4e*A>x! zhQrV<2Gw?CQlI1hL8!Sqp)X9M5F{K|3>xH-1FrqtRbnWhTfFVN{66rFj+c;(cY})e z&ApBCerIKDSLT1`R6vo|1G0imv1tPaT#^PJaqnpyMKtTk(%Y2nSETHt2r{lwmB@!> z2SdF2WCwYoy(3eiVhg_@%X$VOOE=XOf=s@)(57|?i)#TTtIc{aA_^IufG-&N!9Zny zMP*5+A`Dsj(A!BJnji~g@}aqX5f^uC_A5ft_SRnr41ez(-do}WzxQt3T`<4#9ZwH0 z+oSh;zpU4Z4mbx_ z|85Ho<9Y5&I;jg_UzN9rM zAiAGXMaK1uguo4$9fe6kCMR$YM#gU?MYNx(DpC(e{F-kyc@>jbG6YRO+H?SH?uJyW zGOdU)S!W`CG-?mgg9U$*S0dgjYPp1BP;gGheOpk96g9Dvk5#FHpb;&c+M-NNtI2Tj z>9g`CbLZb*7(@amZ&7Wgly2v|-F4Jsv)>hqkil+1Rh0yaV?qE?PzCQ2sa}WodzQrl zR=rLm`>UM1WAN837-z+Ak{2Rbu~MKX(93^fs(;&t)+vZ-@>BjHVpd5A*IW@K<<^#_ zU(a7qXMlje4u|grj-M!SSX*7s_3fRII{JdKTBHsE^iOfT+&8k-5lT)}A>maB`VBMR zLjOJNOTZ>s1Nyg)j4k*wL-Ase9nM}>_^Uote;o0My!VikHG-ARx0oCG$a-aO z=h_YXi30KJc=KWfrBMZ*-k=f?U4lGHVg{ZZRAn)si53N_QVFckjduz)RCwLA z4}AERoYzF2*SP%iI*<(#{81j=e#~-r=HPNa^p%J2NGtvRBI#>zz_7@ zcSrg=Mf%s^naqxw!ur=}WnamHKBp^?ZT{mU5{fjy^2satBJ0u%+cZJt zMn`|OKnzeR1nK(%Ac5Z+rfzEzJE;GdL*aUXRl=ih-=E=+LMBi%w^1^USkHg%4x?lk z^>E$&m;K+dBM)Yo2Cjj-tbLtd(fm*yTuFpP%0wd5FR4-d--L{CwUdh^(aq-LYg?H~ z-_;@XEmI%HD4~SpSWu^e6~WL?X=FKxz3l&|wFA2KJ^Hu&Zx@(JB5ZUZO|s0{pwns+ zD#RzXz$N?kC&`JGR#eMzf|(Uk->l6YdyK6?E7nJ{{X=^XZiB)9XbE^sK|CIwo-Gh~ zF4UEkdxibM8~?9LW`6PibFxw7vBtR1OVYb}FHz6T?Ik8vs<&n45%>46Pt*FqZ>s4t zln;W`y&mwro}-)XB&!Ex^=6Q$-N1?ysHq7mPNV8yVs>i&DD`F|uMm$FeFk?F@z}te}07ZD-i>OV^Q0Og5Ah8;sztbqR&HBrzXqhz__wvY-0&6bBtra zyT|&4+E{-Jg5Z?e-H|>&ek9Bc4T?w^aw+ol5*JS_EKkEa$ql`fKF8b&_zl4Vbs#98 zA`L8M)m9r+=Eni$Q%__!;(NzXH=y4ikJhu6g;-q94Ix7zMUp2NfXO>6W)R{!vfx zb*|IqxIv6Ar#y+TQGVMwHrO0kb-Ohc@RoDsxzR0qr+38f{bl-&_ny4r z>|NfLfE4;KNW-&_e-l!7hh|1B2?K6uSNI(Z7QGxGeR6;X=8AB?-@#r&88Q~M;02=d zy}s4U=Q+U%mjY>M;9npeK=^B45dQi|-~&yL0Y;7Z0%B&I`G%ph5}v;WE{V#9P$e^8 zbe^8^-;rqM4yMZT|K#Y#Pxmg_WJrT1?6f0TitS)3kF7usw0XB3W^ zBN_2(sqIjed6!MCkm*DTk!1%e&12x+%>-NGVg{?Rg2T!_SEt_`4-d=S(_JJc1c9Kc z9*L4r7P$05yfn`cz7NH%)Iog41np_m%#0Omr;Bc^EZYH8T+OgVgYlCk+}%1X z=JM+{3holutv7vugtUS?10Q;hqyhh|3k6E?jq=@2UCLRS7I@-q@-l4VFbLJP^G#Sx zd0kDP8+}=E&;yeQED?t37n}FOiI#>*!k?cttHw9*jTvU3LR!C?f1*y~524;DA%RIk z#&xR!Cc7Ud_KeBX%G%y`ti}$LKf}+F0R>+MuGCj0e|uD54OWVrDAP0^2_uEXrT*b1 zG^HB!M~Pa`DJ+x&X$?Hoe$nzf$fAwEmx7zBA*u4KfKFomeUvmww7r)U)YIaGvEc_- zeMW-d0F5D&K=I>Q-^vo80>iSD`fuI%P9>0Vvb|j&Wq-g0t88G6~)>De5e;h6>G=hnhecLA|nazJA^pBt+9||0? z8ODN`J0^?n&8$GM?1mCo=&R9w8L zEO)EUw0YeskgMlNS-T@iwIYVNCb}LD{NZYp zTy2}jiZtN@p|N7ZcO|sC)O7?!^=Jb90iu`LK}hp!`hx?;PWPceFw4PJw48^UYkbuw z(C&rg5oozL=&hABe?gg>*r;yd&6A0M>baUxZexP0pw7W1%-fif2j%&m9iV!8RNX=q zRbuptWR7}oU<`x`dxIn;Mt6g0e%?K}9~i?r=ZeS=jKGYZ>dU9#nTUt##)k6$6mDp- zsoUyp$}I3OX=^+UGjt9VJVAY%x=0aSzY;!8@Lg7ZyEC~i=EV1GACTp4?IQjLuIojH zsyt0Pb3r5HuQmC{%I^X!Z>KauXQEK8Gd$FwpT0)k(9@5T{fqZH+0Abo;5`n zEINhu1#MowosHBST%>3XY^BQyVfQyxU~V*0=Mq1?Z#h2|uV*Uc0s3AcTPdQ>7e+05 zMO%uGogtb@Z!<0!9~cZLE~F8CaUZoq&?<=os)}aczN}v#6N=2=C;ufO1m_^`?fcXT zMprEdijS2;R^3rN@n+4OgYqDMc?DP{E51HnzjU0M;t%{9h(w)*O=cyiIdZ$c>j4k> zOjdTCL`dd_2G}y|0b@#J{lH?O)HNso9{6Yw4vqZq&eEM~SdGI+VMOsStdGVFK;L+| z4syxFMSKMMjS+n@Y~V!%SKcR;MvTip5Nua zWu#XJyUO$y_>t&@?Ic1@<$KuUa~&h7(rg+$hPcjPTUJ~*x|*4%+3+n3l|(4#t-Bd? z!~8@c!N4b+d7tQHI;@~*(aS2oZpdaNye#(4w!KII%yV3_w3HQmILr;B8 zb>36&@dD4h{<{)nl@cPbh5(%>VR2vl5KgqVz8;V=W22Hk3No1{W(9G$kAPS>;BGNNu;{_+XmKmX&mpXQT%-t)Yt_+;V4kM-#3^R?i@?EnI$4B_Z@d*#Q-A^xzhLUsyLpqd~j34_1srhN7Z3qoDX7s zly~Ab1fJP<#xZ`D7nT2_H>`q{pA0A1y_R~vz@y#88#V}_5MwY;>dRM-oUPL2&y z^V==Z3vC$w_Jv#0Vc3a4b%|UEqyR5!&~K?9vULd7E|Hx}bVLD66O~-LRobcX;#<>| zqts@O*az+PAohQ*o1L1(wJn@UX1Xu=6H*W;GXla z$7hNblKeNG)mDsG(OWxI8|yC6O^m|)Vukj`_9~V^Yuy=wkDYqh2Vq~x7A1XA#p~K7G-v>x zbY_Xn!~L2wYK3LUWWUI60?rnbn|AvtSP6dt;vrSf(C79sU&w^doe!_eDqVCyvVE=B@-xQhM>z6FZGJlft z>=S;s2A8DOM+*_Aae%0%PaRH+ZV#=Xq>nT3@rX zeQ9&Z<6v%H2u_0+p|RPNwdKu6o(w=UaK>x7aV%r!qkX-=Uu7l>roDNig-8cSz=bu# zco*v@F+baYirbHs0pg&dNCJVEvYuoh`ce0D(06zhyR(dt20i!in*HGB{pPX$-v>SK z8AWDyEz{oT!%==-kR+xRYUn>VTDnxNw_J7+-4EFhQ4HrMO6kAoZEVb(L$AdSuP)%< zgpf!mcP9GRqd%dUCUA~SUGoE}qhr(63u%oHLY`|B=7~Q$fE6F%?u@)1c%L6fSt$y0 zJz}&JvNf-s?Lpg}()#iwDTGbxGv$xSyKl-C&W8l}Qli9kKH%YX*)$(DAGo4&FSxty z{m-_4>ZxX~4JE$Ivcdxv=_DllyJl6N&s38!kkfYoy&H<4wOfC~)qsO8|EL|CPVKY5 z_1|<2Y}F9g0QIBMKgPz0&PmeHheVARJhYK691ld<0vFWE=#4~r@>)$+^9uaW*K2eZ zh#GLxh}FrWQhPU?#zu+dUuN+je$6B=*hnpX!Fc}H3AahIRV&)AcJeEV+4~ctXgppuKDZSH74(Cl+emla*k}g&ct14O2<{yq4X1b?B z+~EtM`LbhS(L)?pfo2p0p1Qs?-KK`V6|KU^{OEsX}dX0E$`PWJsa#+KdXBO zW1oXk?DFSP^>JA!S}KS!bwy0pwzQ8+u0?jmgx(_SQN_M!;cLQVswle$!+&_B0qVcb zFUqhpd?w?RXZ#nxHR_khGatRPY=6iR6dS~$-|HPqbJ>3OXw7FEb;h0&86iK5M50*( ztPQG~#Gqk$=)m)&!ktRR(r?AA(le4I*#<@$nf8U?H8wg@Mk5XSDR_}rhtWXLYA*gr znA`zIcOJxMd#!m&4j*0y`@wKA>bk3=>PjA80gizY4>X(tqX)YY+xBE9L7}-;Z zw>T>EaaPkN?BS0$na^sRZ#goR^)c8KkL{8+wFl{bF~BFh=P>3g`ft5N+R`r~JmOy6 zFshHB&r)(}`j4`A$bj2TUi?AiX=S+Em$^TI&)sVUn2N;y zk=~ewt12Vbz8TlET58teDX{6#r)1UBr*xG;sJxoh=;y^9AwLT8FvoLoZmZqJU#GO! z|FB~3wz?6fc)Ao-cWqcpcMGpAEf2YLiHlSXUCwr+*%h{IUjNic6SZ^UGe>V~KFI#Z z>h+m}P^6T`%R^#&!IDkVciZ`#ee>LT-1Iw zDjZuf9Gf5R#Cv~|nEg1@p_YP(@S|-N_G!?Az~hSq!wX_I19OH07a6+*kofKX-7Q5| zzXvz}n_FJcrZ94`g7IT?g=`gR-fHnjuqR%VNp2=KJX&oybma=?$`s*hHzjBc%P+-x zy>N?F8KXu#6%sxJK9}7A~I`4gp8A5J)6iXa&p0I@PE|w<0`)3V$Vkdsbo=PP76(B_Vi8b za_@Ns4U>mVwQyYN?UN;zs6IxDmgQZ>m2Hlk9`t8m1XD-&%`mzq531iTf^JM*^=fSGl`)>>t?e6?h{mpLZ!$JkR=L!A?J@LEESv-p z?I($K?V2kO)oWQBKnMq>H8wxwOgjqUk3xnTm=MgcPYKl4?aSHF$Q zfSKiM;;pL-QPj(1)0mPflNCu;>mAVGNTLBP(}toUo@Z`Ww9vpk7%lCzzn-Ce3ztfM z@x$b%&ax$(c|q2!Q*Q38n(ah&&XAyiSyH5iKa2v%e3C)opIsZOFzL2VvN~#z)HbJoQWL&ikllst&)#O$%4?)PLjitP6x00*e?s zGdKN(vYFNhmd(B9suYT8z~F@3t>pH*i_AM7c<(J)J}`2BhW@$r=T~7vLzwSGQFWP6 zx=u+kRgkD!l-la`+$}r5o!x$IY?9d?WB3?D8OQEpC!;?B9B?;_?3w1=N%4{U+cq#u zukpd9VYaK#ZCduQtYl!GIRxsywyheoNjFN-ZEJ}S3;*`L5uu8~=9`Qxm+};{O?C?` zklo^39L{n-&_sQP_0Y)!UZ%n3Aie)$W(Ui4F&**g)a@3;I8oQk63&?$Mz2lq*0GU2 z@2Q&`M8zH%;8HZnPBL1{?}Fe|Uex+v<)U)ri11*SKw6Qom(DR9-$!$|WrZ!!M3u#= zGv5)7>v=udFGPom`Rm#@(~EtP?C7xy2%)^dG2wUp>M=Yg^p(%zOi8CK&+9mcB$<9m zM{2E?z{zVUzLPqxh*6QGHIM0*>2<*lov{83SlQkQKUw+_)7{%sDN8^QR9>Un-)N?k z#*z;rcg(A~Zhz)ui91H_HspYPzl?9azH!;5WcWkC-1QP%hkf?1TDtarj&MaX0G3rY zSV}^DE`NpY8(7Sp8N@Cma_&)oBmP@htXKsE7gHQ*+Zf*C%07_2Mv3#m$?Sg|B_!*)vcDZs!l3*Tg>FG^y$6W zkV7P_y>Dqc8Po(z`qNJG>s^U}g2ahFtT2YHlRp?yvw7~9{9)E{aMI2>_XB7;^WE-U8&PjAH)%ulV) zSW=qzSo`LIDP|{j^+M)m66xhYjwSD3k!DVl-S7T+uUHU8Y3zgRt|#b(Eqfz2<_9lmp}&l0`v zywuCZF?(uZ7bcq}cS%tJg6E<9kNq^0uo_&b{O>{n_dkmvOEwh8y*EzVxiyfsm<*{)*7miRwXYUsB$-;-wtCK6Yon9h)k^=>Mf(TEjM4xM-Uu#UwK_n!gF_5`g}Y3 ztHDn-GM*X)NG-V04CM-wLzP9aWbLp$>!hr#zcKhlI<_K98?Q%C!P7_vbwv=25M*^&HbwnW{Umm9|)N8`reUmFCx- zM9d9gF=x*1TLwR=u64U06ubWw#Wyvqwb2f|+Mu)7dv#>_TrvNhWVM0Ai?sj^OXWuc zo4{g9=IFsp%X2n?(A`POLu?mI?j9&i71%A2m+@DB`UyQ|{E&$8V^c`Y^JR9%&664N zrrtJZ4K#>zi+BRhpxhyQ8oA*e$1W4|F=VWa<&*x8oMNKA=VNp zkC0hDpZWK0c7C3>{L^|G-F-f`GAL@_JQVGd*7*>+6EZgmWCd+U-? zXm^R%wpBgRM=C*|9<31`-LbS=?_Me}eP!a9)g5D3DwfzEFXNoDYf>sWhkbbG)1664IPt6h3nwBcZMnA=$K>{OKv*to+3yQ#2vy$#OhU~i{*XaY_ zSXXzp{l-f6E16;dU3By6XmSEA@7d;2PT*h2d-NCUM_Im5VM-AQEIJvS^Tj;Dj#4-j z7BI`B$UbAV3G(}?A?1IVR}8-hHO)UytpF-`Yd>$!%uO=*EkVCk*X;w6ZVR~gG)CnE zSUPGVk0&7y^8AC`Q4f{%7W6n{{m4_iAT|2Y7Ek63DSI2SZFFr)4qU*{% z%pAF5FOg<65o%1s^OE;6*w@pHkn%4K&IHUh#~{n#F0~4UAkXg_~3q3jI6t zRzGv(&Bdadbiv2o8$RYmza0o`od%&RcYFC;^$AS^kJ-Yu(C9N-f_KIWgAfBCax z`6YUfNvNw7TJek_i9%W!lA^lc=f4pM#UAcBup1~Z_+=e|aFSL|b!Pm(W$aOGBv_m* zdMwLRqdV&eI5EJ`5kbCT^hrjL{*qF+K=eG|fScr_7PueRxkD;F_qRMkY2&_7nlQ%Uu!cMRz4A6r5QbCIGJ?Jb2;u*x#J-!x7aG zvT5?t=_g|{)cU?vd0M)yn=$m`YKu(h5)O}1+YamJGGn@LVLqjC5|mbiW>NkKkrqo0 zwHX)vGjuW3m3yjoL++v@$K@0X3$Av&D2*q(1uLRna;wlp-wEqYuK?dkK+rj4gjWT%pocR6CekAPocYW20E8ben`5(zaEsItBHY&o3o_Gw|9PzqE`JHZLTUI_K+qa zMztHNDxD7dt#p&gZ#*VIJ#k-?>}jS30#`PHpb&{0sP`z@Q0_B-FF2X) zsP`DZe&fz~tt&{>(&|to+w2~@wq11cXwL@{UL#a%>(hd!<3Yy&;q3r$s zDtb7o#h1E9tre3@6p;>YZ~1*y#BhJC?s}Eo8icqxmjtijfPvU-3+u)5?^_t^7@kod z%g%`baG$c*%cphRpN<7Se#&%(YgACm*_?@TS?{}0WutGKR4$(V!%yd|*@U^dfWFXm zUbSC*+db^NP2?j2NCa z!AuS#{N>#gFUd`ImkEBy_T=ZYv8#?^J`AF$M`E{^~@VEke&l^jW~*1m;;hM5aOSQhe@K<5Qt9%z$oux z{!->)dB?6fRpT?{S{uIBlR$|U9X*O>bLho;Rdr%LyZdsg@bkrfRAt4wJNr(+C4_3SHhVCQin+&^`5eNakHAm zv(m~@gI$PHt)xX?-}j!X2Oxt4f7O}LI{cy^@%deY@W z_D{0C)AE=6Bs`T@Rtx9r%uL6;+R0QcK z2*}DJ7rDfkO06a4U~Zx!t5#ncBP#SM-|SAZ*!WHfsH$~OXBQN$MpLgx@y|4wKHyQEv_n%tU(8p>GU@O( zyO>l*G(?Bn6`EnGL$mD%5OHQQb~^Ti(cWe&6ukcpFOD-=S24!XdUp;X;Tz@*MHquC0j{$74g zsz>DA)NlWZz12w?+&}a|Bw)LF$sE3C_qb~L95(PsgpQPtt&W)vr}OdJu9YnjQE{R_X30x(TN3>JjkxBMkOJb6P^ zmL{U_dS^peWZ4UEA{v|D`NW6nE$Ty(z7Uv4N*-CBjfy9HJ%WS-t(|PwtPp*A-!#Yj zJN+fyv;9n()-t>6TL#rs{d`jGBYssQPLkUyr4goEsn* z(Ru;FUcOB=u_9xa?x=CD1P^IakKx}c&s~n`h1i@cotnY+;NP^B3J+5)p?z)X*|T)n zl*&#j2XKY+6VJj#iNlOjV{}){ziT{>Xim#K(Z-E%F-F!kb92kQoR6|$=LoqJvy*qs zOi``x-B3C^dVeod}*tucVt9mOYl)gd6Aq&F96ZByeuLb%%M5)GE^%0go zSNjBL$MPXOFby`GtO@ej26f3yg6VLxGHF-X; zI`LX7^Vv+kxgINo2Uu9#Cc-*H^sSzthsE8caI(Pr&{W{Zpr4fYq$Q<$u^c;2e6(Hj zH@W+#@s(%N1%-OPL`Wz!ltMnUDGShT5~QUl9fUbfWBoJMmGHR-R{8P_smP5fT*u(Z zz8bLi_rGiM6tLmTN;`xz5>^Cp(u!M)0qBDT#qfvb%ytwsW%5ikHf{LuPce1_aD~44 zl;Dhh<0D?%yfwxEQakJ`k7m9Ev1#<00G-KXp>3W?(zK<=-TOl@Y53D5R25|L)XfK$6KcZ6d4a*p3p*m4!7)h325OJc)uNriv zQK9giYub-noHVeajm3+x7Exa>eoT~&l`+}KP7ev}a#g8XxyYrqC2`fx`mmD7!^a`g z_aQ}SSf-n{H1`cdakom|R9IVX;NG1z^xNEvFF!uK+cLQcnneH?YFWbT1aC>gjGcb( zoF8dU&FnP-dBbU3;nY;nkPZJr74@<~dJiA~+T#$}A^Jddo&Q&9F8O|gt;7P>u5fcF zK|@ef~`s}W$EZTPufJZmQ78)Da zA)Gv#rQ&%2x7lEB8lEq|Rgmygq2y=M4rmCY|`mzX!1cq*<^ zZ#%)0kF@Ir6{vsw5yI^bR8=H>#m-}#>S3POKo&tLu#pc)IWjg|-4bT{JW`OQ=ECO1jesoV8*@*d4D zv!!lxs8!zL_Ycj)VhSvmWW?%@i9Gd)a8H5#C*M0M+f5uf5|}gque|AMWV1&|CT+~d zrt`;;4`uQn=7H|STr=i$kR(@_^WsX|@j;q7q zm&Onp84|5l7cV-SAZm#nleVY|*yrlBg}NU%dozNlWQI<-vfmV!Zp(UqwMP38tBu%s zX8UMlrX)IUs@+xqx8!Yyo!_6|5!=j2#I|Ib3T~^C?!UG)joNaSotBbI$lKgHNJI&R zao!byabcA)>%_^MYwCT!Qk5)Mm2_ZCr{iAVTkD#wNP7|Y z{5etaVLgR+myGspPam0JtgKdo)rzkAS9W;Rp_tKW(fCjS5c1&Zko?7Zw5f9BFhOS8 zsDtMA=2&Co!Jax&YmXn{@JE&YYQ^{pH%qWx&6P-K1qS`*v@Z5~kfI9G)xK`qS{Cl6 z18sV{tM2_s+YTf9BQY+_*IY@L$xM{=Ufk%3zh{4(>73h+v7%3hLh0>xU!}>`D8d)- zJ)XrQcxMW_0oBeE_ddOoi;N2-+r2y10CxeSGHO48DH5A)4W_(Rzku_RxaVh>mXb?^ zE|vy5ZCidNAsh)qD^wm@CE^r%vH`Mxyw3+hQ&1M~I|?zL{F>v3v@Pw^QFG!36656L zZr|i2usW>1))_O>Q(?vxKaF`pnL+YPBw9Ss|B28S04VStk>`fxt;9%%*?1&0 zj?w7lG!f{XJ6vEe&>-3tLr&*1Owcn?uA=yi*R8@^ms*LX)196^|a{ zSe5u|EXe7oOkDYWT)&*_Yiq5z(mro7d2~OS@fF|)rF6MIy;$QpLiJ4bGgHH_$9z%IZ+#+@vjsUwZDpApoX(-P?n9#zH4St#g|;?k<>3o?Ycrucrl^lL2@1*QNAV z%>oD_TH%t5ei{?=UAk)2jJvG8^Hg0%;6biq_r+ANI8BxUN=*r0$0V>fr5BP*(ih`c zSV^=_$mX(9^6Pc#ZG!S%j$LRMnzfwUln3-y_HP;JNKIc1YtX4Mp_KeFe1aU&^9O}O zX=LT2*az*RRnM9v%Asvi@+5Tb*XFz&p7~vd{fK1y`MU2Z6HC>_rGL)-(B1q2{5=a< zK~NT~6ZYE^2&LK0MNJX$Pv+DVPg6LRor}(UB0}jPMV;#$4#uH^6;dd_|5c2}f7x!B!_@Duz5(CV~Ml| zcMm-WlS=&`wrLHk>bm2&WeYv1O4KW|1bu9=JZveKJ8D3ABM~-{Zktz+v&!Q*iyC5G@J;@mE?DX zjQu(VfO0~AQ91ZRs46rMfMLe$%ErIt&zcP7pg=h}ylR+V;**YN`NsDv!jzwAr!EAF zI4-VWSvZmc^-;{!6jNI_rZ7?tznQpDdg@KxLv>BRZyk|xC1Ud-i@cA9mtLz4`~4h= z)v3As>&2pz;}X~uNBm43{e@3=B8p)grhI$5;69f?6C6FU=i{N~9!T6SUh64w`k_a5 z`R8%2212f4TVG?Rt_IC3Kf5w(ozjb|H4FJS%Lo5{75CKY;i5eSeO3J0LA{iY?P2i# z8`2DHpkeQ4Om&%gbh^%8IqIs3H7BbL&*AEN7kalcC+t^E>y3)3Jw+IijqyEGAG|O$ zn+Q3|%6fH+7`J-0eO>VLpo>%MA zUU5sGAIhCKXiN5YJh;N@cZI&)4n6VTCnFk`;oHxyBniw~C0kxo`q?>c@+cdZ`tAJb zmtUg>XR7rc#6nAcZ=MsO@TYV-wp>nW3M(vM%2E3suWvf&*8}n6KXW2=MgkUdqN#d5 z4eYajA1CDhvGj~5K5C-j(JNIPn&(!Jq>kj_s`PYoX{wk1Yrygf5iBWsE;E*iyic(r zm%6k^NxmVd;9q45;ch) zUDW7pl;}c2lqeB>lqeBxqD!1;;Ua2u5kk1ih^r4qjUal9VDvg%y_3XyaPQ>zd*8L* zzh*t_d-n5u_V?_4{y5K^wQJl%^F?Ev)yJF7wX{vIY00a@uB2ZQdO3i<3E@@ zUwLIFEtq48A-5IDen1#P7@vdqh%!g7{w;#(ai~b8S&SLm0<=03Daak*#oDxDbU}ma zL`k`}hMC%b`k=E;7W~oeKMOmga`NxL)ZU0lh-T*0A1wI5oN_R!w>rOb*d^EUw&U)c z3I7WxjjVcA?zcDG*YW)**ED5!R1Kjo>ul7$LPTjT%LSi4D=&J%q8SmX2gM*VHd^Kc z{tS!Fa@5@TP7MT}eT8;>;z$ndRGp;%LQOg^82Mq}n98{#w2mt3(C2COTjNnKYc&1l zbosVL6kf&hQnrl^qrC zxH~02GQ;px!XI?iN~BaCjE-oIeWCN#m)`igr(ZxWw2`-zL}@K@R7SuqC>v2Nof4id zWBKr16g%9S%z4A|NbHXtO)A=l>)UO_CsrbDP@VVXu?afDrZjZf*z^9{%yqNS69|ts_1$y`R~7(D>`I zb1^ch#Ew$N9QU&Iju~}TRBknX7k^8P-jaE6Y@6)0 zf4%qCArKa!`y(tk6J_7a3}bq7jZc|dg?|@ABXcd3HK6SMJrWPm+hu2atN~o2jkx#xEqwGgy$IV`3%N2pDINO6MFb%1IUm|#Iu#|o}Jnr}gdH)9X z`2A<$AG_SCCGFR_Rbpb>R2K?MrtzY)HQl}_oxF-lTo#_r#A3hHZy3QuI9v!SAIdlWu1DHgUGg|y-NrR7S6|UH+5cL&(hEy^#*O9XI zeP8Zf82sZnnT-sgRPcNQHb*VJXLUwkFQw#KpcDJk@0I%doE4_kr}h#7P6Fk_f|wIe%cp1PF^zB6qayG{2VJ_W)l4OD&n_ z^RzGQ5D+hBpQ70W7ih-?LvSCQy&#@#9B>ZLd^&k_?c)|BP2)=q8q>Q3!2#Rrx*61b zzOS#4+hjeu(pf+JC+^d_ooS1$7~@|kT!!$%t>^OBk{u-tZ=^;!t!43P2}mg40D7A` z)@twfljd4VJn=Z$XSb^;u;>BOM`A-v6#sr(HK`X2qu7NS}8zYsvFO z4-qB-*desx9)o8y!VLKN6eq|~Xu?QE$=5+PO4&%X!(UwiHCT#+OR5!(%d>yqP|@n) zh_c3)MRVbnhuJmD;5+SFz5C)8BI^Y+=Iy}9Bi`6N31@!=@;<9;-UJ)p*(O8E@*L5( zW?I~-X0LA%Qw~jjn(a>Gf#kx=U9aD3#tZMUjhfQBi!$Qx8t7nb`f{sf1I@26eA7>-Zbf)@-_^=sHWlxpDtCB z<|tCmM#(p6I9A#RbsbeJ&@`2ytniCcW&~$t>eN~&>KUwY$o7ZEY-{NLqhIG1|4+XT zSV`eG^OePzg%5EpjUoaN0|q6ghiW%!@92@^7nFU8yf>L;t{s7zXR%|v68ad~LfX@v z#h5#lE_gDt7y7dgZ1-rucm;to@kX|$ol{KLrd61&XoKG$6A$_tK9zGXdr%R&uXML) z-tm@oUn(s`Wz3+QVc8i0#2a_2?#kiEMkNn-ewKHHcOj%A1jlpTnRtZ~Zz0+&grpM}w2~ zB4MHAZyK+_Cd3THIghS0PO;8>G~88dxBNmWb+b)mtm4J}OvaON2`MS#AcqGs0N&~C z2rIgke4<|Q>37g$i#rd}?uT7_VbzZj(<+|70vGNM!AcAEo;V`(N;HNtZyAToiKZUJPTW?HXw73%T0^Ml89 zX!TdP*iXNQCX5*h+rglDZ|!Hp9oW^LNm@CFXvweO_v?yK(L<8b0+X4Yh$s|=HD2L%BsZ;@zw+42V?xnwO*k<+q)9p&E?TtQOv}R{)!70pkyk6& zcBYaTINr9QqxoBxhsc~?Fd~EU`|INtJHBUs@o?Ra=(Jj0RmZW`{Cq-OuffruuL^NG zTH~n?Y`&@{LCKLaC;UbSV=5XfVn&&UOKq(%TiU8E_vj`ml7%5t@x~1ok$S0-1>yWT z-)>Go6t26eBHKJ4sSx!c`TH~ySPFjJ{UvqjM$!u41WjZ0AcD;`qS`m&6e>QNJL9lGiEAN}iVHH`N@_x|>h~et&O#8!_Th z#Y-X3&&GA@RKpuir{*gVCz@5Lgn(Z~J5Y|ocX3v|qmR~J+*nPBEA|av(*9WxgmXa7 zXhCcy)t^46SsmA)b)YuPvinVng(i#rE<=MZ-yf^78a2u{VKZfwH3)-*)nXouvWrG` z`joZ3EY#sJ=$EaC(f4Z~fXH86yy~KV_0Ht##p#qP%h26*Yap(|C`r4jR>7`3usG4@ zQKU5Wc)s|#Jg{G&d}fU;RL2KD_}U-`FX0Eb-5?yEh8UcOa7&TzbPnDoLzXk!GOC)f zcN+PT5rdxwJbL$nbcTB|oZ1+6dk;_UiVBBEvhOr~y}D#mKQc&YF9H#UkKEX4Wn-Z0 z;z>S2@awd)VI&zX$Lofbkz9@Kf4<)x{PK8C-YwBou$G`oH5fs0CA6@vE!{foXVA&8 z>AUjzdHrVd3O-jfyP`j{u)ltvHM;M!RNlae1DoPFnXrAb%;uHLI--hQ61;n>=_{| z_^Dw2r&7hpiMEzbeXOEEdb%HBo$+_w?q!&_roykSKyFAyO(Gp7>EwOdm`BwW!Zsvw z!8Z1FBHz)gG+e;L%}3So(ZFgtT-d~x*dKa0@~n2k;A79i%tq9gT|8#_+`a;eimURv z@pBHdyGbcKI}dzsizdd;MOQhCEH0<+7}@f1wwXVhur5rsFGRBI^YU)EPSEHh?&u?^ zQ#J0ppG{PyJY7zG`l-V}Bf@{Ks?C7A&%pj}o}M0>rCI>UtM$#Ry+~MsbQT%u5*sm% zD|k!gJ>ne6yH~VW>}q4Un|@sr?Nua}gx?0E)1dz4Q%V+)JQoBWTF}gQPese<#|Wcm zah#)0mk0H&4|zqf@$w)?OEAd22&#iHc}W<)dum!n%^pKn^Gr?hiddN>%n61BZl|~a zPN^k9A;TWj52_Kc+MFk~SM~IU4238E3c{3}kJ30FHF`DA|9q6d`6xNrru!-}+J&ql zWKXE&|H4nCZW2{7%fqwtViiLRj)=It?je3cJ@1tzhSolh`Ys|?adgmmG;pbjqf5@C zA!6YCQdS8giV-uhVl|#3x@tTG(ywMIZB|0rxUGgMyk|s3a+I|E+E>0W>x#}L%vDIc znm4+SL|lmAyL%lyVk#~nWnVk3|09ZUmyJy~nlTXDE5x9mda*)vV$gTQ7A}(`ef<`e zQrVyv$vb+601jv$De^MAOC~eY*RJD#XTQjoukMmb59fGm7&Q@yz9R?U?T)>fU2Kge zUszg;OLu*ZCVn!a9mmwsGs*#-#wKiFMjro8NK&OrcBtx^{sCmNj6uIRX9CV=j64RR z(y>tgPm2AH9_aauFPJ{5yEI^#()<>_iJwbB?zf!q=Kqb(FErJUL8oCcoL1vZhp>b| zPtYsL)^JJld+AIahyryNEv!=#`yB|!^NF3`q3S$lq(slZbN)8WQJwdHOJ5Yzj6s`R z6cdiNb%vS!8=c=UCrq4a7q+y39NZ}t_;=QbkLoT0*xHp>qdDj@)%%(5mEs{Q_c{$TyDaDlEu22qK9EQIA2({1?b&bPloxti+kN zV=ZBlgRiAv9m!F5VZwrVf+pBtL86(Fp1)1ty+>f3LZX^X`k8#;+W<#(G!{e#1QEf4 z7{#D#{|ltn4)}MuuYt>A6boVwf}~+Viqu`qe}jOIIAK9bK#<=ijBr$!U~AVB{DCGF zLt^xhV}a;e5JUnC0`5q^OAz3nMRFNlSOPAR-&;}+1i@}s1h@<3ups-OBlcJjaPRK_ zc4Ua7`uBGA18ZMACob0KCswjgR?HUW>=xi-Vgfu{s?8}a(kMM@lzeYV^6KEWBK}*bwxLq99B-(R$*?TY=rF;In^>K?||~or3?pU2~dV!%HrqpE-3F_${wJ67nId6 zWrK5h50v*VWiL=RbZrHMjV^VMbA2Dw_s?|!C7-*=0x45fStyt0v{RZ0K{H{LyORH6 z5GV1cl|h0bQ`(AA!SC=*<$*SmJgAVvCyUa>jnEHWv=3Y@`z;z_T|Y_g(h8?cHD#fK znv-PdA_T33QK3ryWWfT5!c^v;VSYD)5BLa8femY(+NkC|Ny2qc(kgVjt_NE%<_+oi zZF+uWLbE{4TbwESsghh3pCokG42@YgWRo;?lH3YO0O|mLWp2U6ebqwgBE{2(RY`Zcc_MI=uT!7|KvaQ}&U#6Dw zgg%_KiB#p)jBPULOysrvOkbKz@PbE z@Fa()A%MDDrTB}J&$>yD`SS_u=LdP^ozCJRt6AOLaR*cF!lW)C;|h`Q$zH9F*wTa^ zy&DemZ|&5geDi#7rl%9R8^F*TBwb2lFZ*PZpON2g;74zP^zvxAaEfexc_(8Y_d!Cm z(=Yq4zow*W*hqn(he3Aosf1$sM^DK42Ym%Tjb`pAXV+iTyY|)78YmrGijFAP{0m_@kku gY8+*9@YgJde1)Ml4F^KdlB`>eBSEN$!~w7QAB%3UPyhe` delta 89040 zcmV(=K-s_A^9GCW1`SY40|XQR000O827A!44OAWu27Az4Iko`PYnTB5=E1XX9>zL< zqIAAud<4V~6~Z4XgctGsAC3E{5ng;{yei=Z3q#ZiFB&^M#c#iB%hWi? z)mR<{2bbHHNjp3yRCxc~*3uGt^oT@%$!$!k;_+n;8d4d1$Sqld8nC3U*A;2oj7_Mt_c^2Ln9u0^zecFylKX=%CMDB+z_$x{LY zEsc&XsEbtRC0M51UF z7)!D8xxGMLK2M`1YMkIl(;Ys6cP`KW6i?qhS(ljIk96k&Uwm5DIed0~&6cnB0?$*_ zjcZ6vMP{&0^rC*gGcnf8y+a_`$g;zi&y?V)BPzi;;lR+P`Q zZ>oEP{&P=di5jghB$m0Ra|V5XR=hmE^L3C`!hh+>y_NGX=eD;LUoU0HHxc~Ns`(fB zus`kP!#))67xia7m%gRz%gNKiDq5sm+kUsbur_6sT%zb#>`SdP@ zr86z3oAbKpELd2+-Z_Q@;$os@wT}5s&ka{m*NUBYL_15jQ9lt}M?Lv}Li9xrLW_}9 z8;P%2jx$SlE+;f+Rp}u&f<|I@#igrh4fj!>yf`wsNS3bvG>~i5hBRb?^{)ABrG5PP zJFwo0n*FsR+F1=fdP0p~qMX)mQLdayVJ9AfR3X2tSge~tG$qBm6jii;0)ThSFBGR; z+>p|mS7Y1d%ZowSI!oMtNBQysezdZ91|II>1MOb%Yh;>WbdM-{6|6tT%TI!0x&0uN zWvtZ%XU7rNwfPOO0hpkkvGyq~t1G@yV3x|DSX>}aiVNhSH9ozSZit{bYPr4sJS#As zQUofy>v`vEx50b{3W_o58GUZacAEAbL;ibzz(b}j@2IxOg5v+|DUnob zxtyyYO~EjWrQyN9hWpqwF>-$kC`_!y4OWM*p1Y>%OD9;)MM~uQb_TPqa#qc3c(Mz~ z<}oI|uWJfEKl;6`wB~N5-F0HN>t;x1>umNz$xv-PFOFDtso7Z^D=)9VwG7KJsOW35u?C!bWr**Q^gab?yan~Qm zNMWCPuuzVRiG$6P9klMpHeslEFih}<3G-VN$#cUQCwX&q17%Y`KJq)?+FNylBk!2Z z#`uQZ2}}-FdIqtvk8fs+8FUO^WYzyte&D`TSiRoB3u$dv59=M>&y!!^9a_?c-WSMS ztvic*y_!0ait!=_GNszAlZ8Ig>IO>D0|>{u>$AN7-ki&_1qCx zVaUpQScvZj8UroJy_!30Q3jAatjqXy8RpL{4uoHWUo2=WV-iux?4!`!yXDo@oP5cy zyB&C;rC;E+m3Ck31Z6x+>#sg9enLZf!=$=@x5&-CT^@Vv8{2wUbU>GM(2rKqq2+em z&-oVFQgMny256WoW)Zbuj&$p6OVJeEy|c*M-kP&q7Lu2Ewp~!yFfTNT^Kc#Q=W-ow z)9CTc8?uOma}L$M19GDW(V4?$0Xiia?Jeiv&u7wV9{1>Xu~(7;c?_WxKzRP_4RTR` zb6`PR~AaM0CQ{0_(9w)Oo`8r4;jUCr7cktpYI_80ivh~t%ivQ@Q%Wb%xj@80GGCCLZ@a7bM*x(L~ z@%hNg;*8J96jqy}{3M-Rf7nD*m|wG7FUId2eveK3wxZH@!eH?$y zfnfK97M)5TAk9edUL1*?X&6c@-6yYbK6;-(fGDOBhN+BE0hy^-*jc@a(P2{#agWXn z`15Hl*7%I9!TTREr^;2Mn%`$KCc5deadEhYJka*USNjctf-Br!( zkF`~t%8WOKJxNH?&FeKS0W*dDBCQ`a2p2=EPr3ZoA52-e?9+(COvJr11;w3)t^bc@ zI0ff9a~@=ll_}WNkgzcoRv-?41u19gYXX+i=vLb<`E7jAC7wK( zEjLr>qrCFdG}fY=n<@0nHpN-`^W`xCyq#~RxZe;~yZvL?P80HJPi=*ql(&ccvYM?Y z)jbauX32ixSw&OOqJo*J;AFTBk<0>s&RnJkPdidD=gX_2L|dQiq`DT-?}yH;~o()qMF$D6?pttt7Ah+wD%{ZSuA@n_q+OW6K$ zyIE~FZ<$=Q*E_fuHM3ae=~OZ0d<(p*^|OVV$WW%$UA$$gYfX{ziE|5+H7qEt0UJi zPPM@)2Bb6wtkWBR`ns`GtDPq5o1NfgQFGB6b)$I+7-|COcURyfXM>)XvK(z{pupO4 zg!7m}gC2iba3e8HOw0;f;;}Hc?*4X9O~l2!n&Gl*z); zRr-Meqsm4Gt9r@_hfv-IwOrUQPpe57>|rf2gVDXNr$;b<%DtqCDnHp>ASGt#FD)wZ ze7D=n)`Q}2z9#T+J6{p_zuE6^cF}M4tP~Ar&nqhucrDLLQQ`AtX))r2^|f)II$s_+ zeYV`U&{GOZ|Ev}q=aSTZ%tR_8#noOZzEX-MpO-r7QT63l%b1AXx`Ahp+UAim^crxM z0csybO?at)DN2o zMmFshe^;LuAE`JXiV3&6^T65M}sGB*ZKQv0NC zLpwbf*><}q8JhDHy>Qpw;#Su?#VeC#>a{FTUcj?_i z+Qai|B~4&>=0chKKplr!oP}bdSIx$ zO79MT5uM+}Hto{4*MZ(bmBQnU%&?tyLLeyZ*)v{>BW~RK$WNJZb1MIf&m`HgFFu)M zf3PRC&Ro%1`H8I7nPv|tB}9}VP#yB}05=Y3Y24}qwHuUde#(2l)Wwxp^6{)RV1!i0VCLzoFeeC8*}WteRvTczZ@&j;wtw)lgH%Mgsu$2f1lX_s6a_N|hnu zBT)4Fu6N5_*gO&M|M+3piY^^8MM_?=3oFO_#-XKJQV$Wes0juyR+6 z=fNGjvDDL=VqIx;O>P2V1W@*-+j=p7L|y?A+(zKFx~ApUZi$l3-}$vr(R@p-XoW{9 zo+tqR&2mlnbqLGNHCgX&ph|g-TpqFjsBSE?o~G$CqF0*43Ruv`9E7r^G|WU>*KD8$ZMa#{tI`(* zu091Rt((v0_n~FV%)R>*hpxeY^xEm+g{fJr2%%^WJ6fK%RRQQfSNu!#velu5DI42I zP@7yBzQ@Symm>+$c^~aiQe^w7BZ*PkUvx`CH*h47xH03WYr;&-iq^O7XAUyGs{68| znP2%{{g~78-j4DJ((HDto23%$R-9bE;iod}8IRr~@h>zOFW^MWul9t0E#>f%p$?1m z7b|O?+cc%2Dz1+{mVvW#QXEsP(m36xaNu-7NX3q^;LYb1wJCsQFrukyEw(q|aps5C z127X`LO=V(b9&3>IQ5?KsS*#4!l4|6a_K3}HcU{twUT=HYL|7g$Zzec@|)#i2F^q3 zPGoQJd$efb^YwE6;0^qLBY6Xh44PwjpxA9~*UQ{Lz-)jjVCmJ#unqt0y&+Ypj_DIA z;8v}rM*Fn=yP)G)+C^l{AcLmWf9bS!&xcM@0hb)k>I#L z-yKh+@g}-L+|MqyQ?CW1+1Q(FY7aov zeM9E+*%fmsBn1H{>RLFu@xJsGg5`jEP}4hR3zK^F-1k$nX_pe9)VZ zvuRmb1)J;PEw=7kZ4S;LDD;RKH-n2%O4>bw5U*aod-Fnh`tIGIpM9egDd5Mn(2BI< z`>+DIy}68Fgw{uYSortTrjH^N`;0>0QS$VDX3?y-u=xQGcK+?5#mf`GkAXX$4_?e% zbhuzXJMwr{(%6r`D=lV*Aphjx?t`uyhI)(gHv(Az!RmSzDS2XJp4)PqdG45-(9FU) z=Cqa_fjEY$Jhzo=dWs_JetHmP_$^F!ZsQmMlCPiY_aZ=lcG~1PB0%HE7os>Nb39eZ z&L|x(HiU=aOu>P?c@`IzQ^LnlUGrQnh+)+W+G)R4f^{+T$ zbtJD6SR(Aecs-`xx?+suvcOb3dhk~a<*&fjmXZiK-S8&q;Q?MyD32ggFGgW`ad*ap zqv8)0E3B7)r#j;1Ux316iF9wL2y(fOBTd&`BK^$+o+r7v1{Y>gFo)S|#Q+`QoJ!Zl zdk0uMS@AS(=#<8V&ugF6CaeOfW7?nf5_3l}-hO!ZjCo|Z0oODW9BX$_s*`sQhgpIo z0dYWy@*DDwBo!_6cRcKs@;&cSrfRvuBS@F6uDm{fmh$pB%bq&AbXn2GqxjFVgP^5D zpGpuex0`!VucK!e(abg$H{FC*4tF!r9-(ud}tW(*jP<# z!-uXl_^|66YS$-K-m!WA@cnl$N`@RO3dnbO<528%y{)3gfjhmP3z5-g13Bm@o=! za%hS6%5V-X)9wSA80#&hMjUa2R4F2QFUfdJEb7}X^yVl@ct<(oTV&xeA&zuD>DbxQ znO)6gC_f$Citf72x4+RD$1`5Jhn^j$A4#cyNlhzxALGb1;x6ER>i!)&pvPumswLT& zKx`56iRnj=pc@ifP$^MfR<_mIHniq^JI*q*t6qG>Rr3A?Ine3f{v@_J;8JI%Y@xi?6{JE+*WV#)&wN-$42zj0gXJ z!EgoYdfY+Myb~?*M*ghqT2u1o6naqzWFlu*dh8NPxUV7Fy}?g;Kg5&&Q1RrWZ7rS_ zK+8)Xma|4Hp!}>teYMTGNV^7?seCcdF_X`#0)>QnA<1np-yX$!XZH&obw9=SP;9DO z=WBIV&-%zqarw{E`{lkmS%Jz2SL7RiUO*K>{PS(y1j}hkbz#ew5?-d+JK6JEh1UFS zHgSnwWrdAv@6kd80OQx|WelF?>@r075vHZHP4JPNH8n&pM0}#y+M_3@>gkiyI67tj zP_|5U-tx-EStG*t*{jckP4H~FSb#~tT=Q1SFT~}?&p4|u}Rl8TnKqm9AyHS}$*5B3`E#74~+_lvcFf z^^Nno##vSR*{`hH)$XyVvN45!0O#k28L*bjuIeTsy_Yv%_6z2#v)jpLwt=q|#sO6b zrJz;LZfEq*n7|;VrQg4z(owk{)tXyv!}%<|29ImGpKC;=S@cz~{unPmErc8db9(Kl za<|;lif5qMblu>T8{i81czws~CbQtx4Vad*75IK5)|m>gMorIRE|r3R9WZ5KZC#N0 z`Ok}=7w=%}RCJ}1Zda=%jfK(Un^znhJOfv3J!R#^S*(Vx0L9tDykt8#ZP{6I3Z`1= z=URQ1-FcV%mf3TKGRP}K)50zDIgb!S`qFZHb*()872(>1Vl{v|Kbz0m!@I z+vOFv)M<-(r(}hrV=4uIP-h*_+NVOl0T+6zoIQW`<`HYO{`|!vUeR037|n}EtS=uw z<{(zy@lU*DwX8|}#pB06FI466V?iqGvr; zwY57bn=M9_4lmU|r)^YfLD%g46LuQv?_0>nBMp_t_nin-xo1&sQ@mSlz|P8(SmsOM z4@@lrO4MM6pUlY>m|&&6&#YG)NW&l{l&ib8Tx(eeNR{_z(62DMJNAXl?D)pNgAw58 z#lN!yg1aky|DybVTzuu{lLJNM!&A&(e=cwNgIvAvqlVK{RATIJp4Hz)iG#V+t*?^t5`!|@ zw0i@oGve!yhkyQXYoU_8IxevJ_KnX@cc7O1tIhm{X6;`EJVOb6+RBg6Z@@FUKu*;ykt~c2fkGJuv zQvH__TrJOkbmRIFrAW6oH{f{rl~XBy0sHcov&svPb`8x^>eyu0*sMgFB_gl z6U5Bn_7fcyr9`Mu(}xx#oxv2^c-o=huY7nA+WaYJrtzgT0_S}OsyoCrvww1d~&QozDTcObmDKwo$Pqij;M?>xZ!zY%13Ce z$eb#^RfU1_{w<*gv%n|4jJ7n~&MkRpWln-MO}_$iezid_WMW6%Fr&D{SNd8FV1;(&{d`Uxg~atM3;X&FLB+d|z%kY=$8_*LN>kEBp4 z?7SlYv;;p4ZmK`j?{Gfh5sb#0DVqRRSz&n0f)|!+6sx{rM0lwI;k16dSI9np8Strp zw;QrT?PQ9WVZ)+bue%3bwfw|%sPrY)#Sx2H(g+HD+7$e2KzNy7!EL3@pv>3Smy2ZC zdXve?E_5qGIBhPQVIDuGsU;BJg3+F3W4jyk7_!k9F{C6d6lfJfF)755Xtikg;TwwU zQrr&yplS}eJ+w$Ui#;(2rKEV5jyjcpA7Y~At9JI|no6GG!Dcwtwfi6uWTEW+^g-6h zE8wA@)3IcOoY!3jgzb2$4fhd7y9h5IFw|M5MNJ?=L(=QoJON_}V@Ev;?Nh_g3*#IH zYoma+XOJnvs-y_3?&96qlmS1`@otIfLd)hkL}pXUAWt0FvvLZ(gV-j;C~cd6*T00f zt#c4*JxlJCvJuOq;6Zk#&5g125da3gSWJgcU%#xPt$T9Xjb){kh#n>bp}_E|-lbB6 z4r*g|K7Hi=3I3xP=eqJevnXoawiEd01z?;a3us`N8O96R8;Ijw5teHSO+z@CFd%;y z+|I7(fkJqJHkXpkhIJG4T`7xyBBdS4~%-u?| z>zr)O^Sk?e<(p(H4OL)f{jP_yUFi?{Fg)|Xo5RC$GwUpB15bfVwmH1tp@EJ$EV zffKLhGlKWOfMAlMs6{xqD4fL_KD*V=O%)t&`lF1lBdw+Rr6#Bd+s}C0dz`O{RJ8I+ zsGI>%XuNrTr{wDf9Wj-qw5U9Pj4mEu_?GTNL(Vzh>+t^hGy@fX2#K<#+ZuLKVF}xk z<$|W)LPupe@z0)rr_!?}Km*@y&WWGgY`#NwkEK`Kg~Keutm%gpxOvQaFTcAXKhE0A zM(vNV@Unemk)(0>;+r>9Ux4=t8-1o*GpoL!<^pGHDEMy$ODZMAY|P@D*7c zFNGFVNCC9=tI^xy#8)^bu}knZa16dp$iFZ@!Oq$3ql}$-UqX^{>t;>r%ots z7}tY&dPQef@9O|!_IC9cXzduM+{whwqlx<9M-xHrfbxhrG6?;|xMzI_3jjTYwp_f) zGB#euXL<4l{PPsc3-p(u{~tY3PFn^*bg1%>0cboW+i{G}4$BH(s$U1|4Oq6dr}Nq3W7!zHCi7JUFoL~)(ICtJ zxX2?&m#g{q3f7Rzf{DvC3!hzFZ9$zcM6&ZpGFe1_dpb=~E|Ft)5H=6fDyrH>bBj6X z@|mcb|8_FevT?vHo5`FP&rI8^))oV?rwFSt-&Xv#BbX&U-~JBvS*N>CH6oVqo@!Tg-PZ`#$Y{02;yiyTdR6V87W zC8&yj$&deXzVk$!vjjIb2l8j>g`w#_SB(pR$b5N6>GF@9|07*4{#2V{GroU3Y|?7A zq)+I?`(rTQ?unUUISID&O-^v~{{4b{`Ww7*);N(Bm1HRLNLEj#eK!M}3Rqiq>31kD z1n?h5L>jh9z0(bOCLP254ef@U`YD@g{J(dx=e zI0l}Yg6T56w)$j_!EiZlgkiKb&U7>eWxKOGu5vV1civGnqb&~AW3t(+Q@i|zLonQb zlAc_w_6-X+!nEpXjkPe8o2ybsK1X*`Ws=q0BhqfFy+I$uT~)LyvaUY|_f^_wI2uOd z7~AXa4R+Hj19%FA-mHVXS_gQyFkY^<(4fHUCFP2e_ky)@B=CwI$dZJY4CgJoFRxkA zS9=y|`zqNoc{k18)jb=+V{=+LuK${Un$qjq%u{Scn`eebKa+8^dAd5gH673G=^kpD zlQv)v@jmIZEKsEs;y>>Kh_6Btg#eWBdHRrzc3G6VT`8VWcni7DrjoJO`o`}52l^iW z6jt?V5ElAQC^`V9yd`V|a>>4DD28_~ZuN_-=2(%=c)<&8h~=m1{EC3oY)Joq_Trs@ zj;4ovJG+@}{{H$cP}=5M3#jDw(gOVQ5{)*jpNI!lD|50DPQsemD*I$2e zbMr--{$CL{w0tDLTj2}E6isV4WVzkET!30H!L3OtH9;qkAZ`!WW{bAUZm9rXOJ^M} zr~^zGfu)H*tBuqvzo;;nkR4KgOc{ALXmk9wrGH;zBGLKXg-;V8%7rTO-T^+Sxj-Il-iG>zy>G|l0V ztRlK|Sb>QqwuQKg{WlEh>tJ&&$S+`&|8dSN=%%Oj^Rw9-{4P)`2ZIcMlI2wZ>u#fS zs`NOA^7lysnb`tGTe61~NBI<)ew?j@i4Rxg?d(@drfZtkPE=qsZ+K2;7p#P0M`vr< z+*(&uMfZ7FbPbNz-=9%`SM`K5G}BuN7SyuK53!DD%9)N}PJb}wj$@hu0Oz1=8=(znMkb&!?I4zzaAUwJTij&1Pl7a4r8c|H%D zry-E{`?Gnfk=30q%Q!bL_}Q?FO%=Y=b7uW6+)x{g&SsJ)+H~KNxKfM%%p_Z6ZRJ7z;$&blh1F*~XL1Htx7U?_lp-N9%t)15Q+U zsKh!Th1Hh%rhdS%fksf)q&UJTC=iyt{hj3L$NXIB>-92!-bVTH(rl651Ru$n==|jq z#nxc8R!^UtuHy*)m!3V|E@rTdzGdgV&$3p84X}5c&z|z;WKX$r9#AEX9yNEL%$d`? z>)x_LHl<-R&$V-{LMeZ0_A{zlRT79+C<>R$k9pH?SA^YCuUAV!J=BoOW(!0OsisTL z)o0hi;)?8lrZIMN>FccXvpc}DAy6{x(c2knsQetNIpv7T9#?_XUB)Tz6JedAqELmX zL`7pEqs9Sfs&A2(H4qf)sg5mWQduUf_G~VmtIKVI+$&aS1`2}i?}s-RV_>*_B(n-k`6s>hkF}EO>Y%-Ph%}1t65}-uLB3&mNsuzwzPVUS{~H z$PHkBm6kj&LGrita=RK1Tkk9Fg7g#*9|oO>@-HY?^b@)2(c=FV9I=ZD>5VU|xYy)F z7PqtYazR&%+#-C%)|s`ah?0C~mA(O8wXS~V@LtRLRJ*IiNrCWhVM zWqy&=pjuS$URIz|>Ad{w#Whyay_1RdhPwRM1hQsc(&{O;I-%x9*eBJymntD;(`Yrse)@G4-2k5mo#Y z?{U!l&?h^)R^0h8wt1HceY>*^CuJX3T>+4u>w-%*A?9A_r!?nf0ljj&e+pH)KEpm> zm@&Z|TlCs#6kx>WO*2r+UW4Nz1Li{**G=PcRFeKJyGr~ixZbZ8O~!S@PCWpV?tlye ztHYE0fFcFOKaCeBlOusD9k~A}Ptt9dK;@YIzNw;fd$L})ld7cxd*jO4QYe#Zfjce@ z&Q5-}&3Z6*Z=1K!du+YQGNHr*@!UKY5zsDlgOw~LB_ zf@q?_pn+CO2??DoRIE7q?oOQUcdM&>`R$j&W0)<&BU}_A_bV+qjWHU)UZFX5hoZl9 zU-VzYWqfybic-_lhHG`Ew6w?&OES`<{j%wQ$)SUKsl-^YUI%v_t3v0>fFKxtWf9|Z zy7J&9-3#ZH(aM~lauY=3y7{DONE;E@3N3--fnS=2l&k}fw=OkDh zfu}svYcidbXLn47q5QP%oit0>siF2o>~~7nrXcD2bQiYE$~&8>u)_xcKLs4X5{B%z zqiM?nIJ^Jz0M7dcC$qo4A$KhoiHixg_GSyxy{<;KiC9+0m<-5R7e`_tYjsQ(QkJMekFrg0N|iR2?_r`Uc#_#T z-ydI3HxuG%9;BOB%b2BqPHGUVj7@AL%gjCfoEF5fyuod;0qVki#>}40FuQbO@t0jB$w8a&`~V*Q164IO;p5md`gpFhNU@O-EGY z0lsgu1lWmLUM%5wLR_(Y=&5m)CofNhpIx1csc;m)w40`-8Z=X3tUINAusNdlJW)$* zmw2mh_sMi&bFTXonZzX659P4x#b9?P?5OOak{m|kZn@pyjGn=`!;=1gHt?L)56Ark zMKeXRxjp42zP9|B<2^8VpN{Vb_wFRzyQO1)qdK~Uhx_g=b*6-aPI+$yy+e12WXA#S%2Y1mAJbR^&w;0Avl&i01MSd zk(^ZQ*de&sHHhRucEfe@0$eM1mw){i7`kWCGMJMzB4@qA1q~0(QguK_wJ;g)WVe45n{u6+%A%ExfE4=vhdWv{W|!6MhfKI(kXu@{=*>L z_aN*}6BlD}pZm<6r)7v~F>4JuC+_?xLwq}Ht>Z8zu44vRFe)p=Bn;KIpy0$!RBoDH z@~eaj5gw8c{y@nGuYc%HKIpulR_3bO4xR1dg?28RJF{PtZLWH`1r+F2vd(R0> zO2<1WyLXIyLMLK>-(N-600u z(aTIVC>o+zXG~TQ%}>7~TXX{3rY! zvAG83J34xQsTMs&ahAfKsB)iIeoM{ESZB@dU#x{K!wRgj3%wZoqAxTTJI+D?4Oe&N zFBjK^3ERj^^W`Ep65aN^q9}WvBUiYhd~CTJu3?N>nO*@+r69QYE;Hn6NGB$-%~fSc zc?+2O1Y;@SEU$@BWsChP!BM(ht(NP}z$_KT(qZp^pMBx4>}pzCuvhRhAetFpVBT*Q z@Xux{SW-Tg3j<%1`6>cHlJ$AMLuDkBJVcAa8^-@{!=&ys66-=@% z-*ZfV!*zYvv20EEJnN+6#s^sX=8|Qs_wQAjHQg+=yOJx2|FKOsX?8u%-endkyYqx& zuVl~Xuct~Fz+O?ICVsXZ%x`6CyN+ac*~9ss0I(v^P}3|0|6HT*;6y)fl4y6WR+Qz= zk$A6lc-uHvUX%6Bj9>jpw<|nJzkIPvu!w7amqw*cO__U51+1#MvR=YmK>wy4QCy|N zJejO*!G&N=->}Ys3-Q$|)yr5ivFQ-(_fS*o_Ic^{EV{C+XW^D!t+gu2MG?TvM|#i8 z5=2@vmYH+lyoTYbChpR^_DAt4eCLLnhx>d97KD?x!hK|^#zN!6ayn%P%hWvJPP^=X zgakEMY*q7ALwl!bU(o;R|92m_xq;GLHh#Zi`3blOH_wZU1w~lrmGWC|Ln{W2!Y)T$ zF|4O4A3O?+%$%m`Drl}1i$;Z+X5h&3P}L5BmgU1oBxV+Vb0nKes7e%?Ll=fl)UL^# zz{K|5lFvc^YFh{zuLRi5-DTq-oCk}4kIi?$pDeO(HSHB%QonI9&#$BEwDQY;{`T43 z;(OfdYY(un^LM{#F|g~`pWv46=9`O~n5z@+@tC8UPzUepFF4&X_O`&^#=6;3d z*I|B@@yRTr-KL3dq^=t6&Ti2kE;%0JlH&vJFdi5*pWh|NxT}79-{gBlrEI_Iw{7Qh ztotWR6Ipjyig`b3zW>@x*c60%xa5*|!^0()le*+GyZi0oa?8CL?BR0D3Q$~r8|uU5 zmJ*j+%G&?azvpryq4OS*--io-I45-hCt~l2yx?!o_B!I-kPo+pKHM7Gh>Rb@_16$G zl7{kaxYiGb>#%oG@*|*zb$Jc*c>5H9Jw{nRIB8gIDQ%UrjP&T6_yRR?uSuUUyl4K< zhwqMjx8jdqzPWrWbEDkDor*$aJlv^x(4C5>FcFrHEgbn8MGAb>Rf>Ioub-=F)-g{w zJekxzkY&Li?tdKP{zuda@ROO$7kbx&>{$)+;QM0^V)_8a*{fMLDA*H_jU{`T%%Sxn zMVT_=09@rqYVa$sA^#8-#aMay{4?SBhm@>Y zNbKG@9XF$zcon@j{(7#NzvqgVJzXX*lgprt%1gql@RTylXXz!$ zN*Hz?dc{`u&Q;>Fq7r!tAaD~dFGb#MesyZFLO4xE(|y&y>8Lj`PZ5i^Ov(O}*D$wkF6pVbAJ)iAROL#|))n;tHOh?z zOkKI-A&LC5f^a^6?#7FgfStVPL=UFdA;uESI~}J5dH-&1Gk|dA1X)ZCY~gOoR&78G zYNtHZPWc>br_{@l$R!?s%U34J3PeN!t!SCKWYX+d zUBzvqaJNnN=*uAbxLqlKR^E`J?5zSWGpe<$P)Sw^;9Q~Sv5L=Kk**f93IoY{c~dGg zK7I_Jk_HDhA@Bi7+FKQVonR6*)@QDJSASwM2YmSZtJwmutqHPM@p={V(^M|XN zBB+eQhpXX#{3Son3*E{_r&Tf=n)&h#^vECuRh)C>>$`A0i_2&6C=)yPEvWYT|7Y)8 zxZB2+H2(@$J7;X)l^>G)N^kd_cH*StJDtbGPWsFwSsmJc zBmureNyzC=B#H!zK%r2m$5#&U8rOWp4TKWJ2`vMEs|XyMkFHW4J>`g@ryOi3ddhPz zWFRIPJO?t7s7P4kMGQjH}ZU z6|yt3HjIaXOfirta_%&cDF!lyFouCl;f1DwOp&=9OL=q>2fwOSJ`7}vflMK$&#I6q z`saY`4h(b(|HnY5WSoJqC0h=yQ*h>uZZgn+DF!+vwT()Or8WmpBL+2Tg6iZ3NHs^Z zfllcVG>L&ukq(Q2PTAV|xFr^+`}}c>kNPZ#R4NViso)9*%et(60@j( z;E1=_tYR^{3X1B3QtR_cdXxpu<&corZOg&SuKVTRMk&}|Q7}P|svOYK~ zMSflbxk887K(6F-pn+UjHOLiJCCR{lu&_S{hJ}uUB&}K&4^$kpp%}5zL-i!`>v{;T zv0@l?u`p)kz&lCP28PAJu%!MN7#1s;UPpCSsRI^sP@DnCcC0A!J1hIC+9MvcR; zq;t0PVOT~jz_4WYVPIGc49oh!u;>OeCli6ra8`)nc$(x{1}o+bd;IF4Tl+P+Yo?;-YMyFvu>spsd1H%6;LF>;~CIUm>rI?4qNV zlt*|ORX})2J*#o7STBT^Lxb?r1j5TJd-@Gd(*)6IBj8*_Mrs<)MHpX$-69GegWV!> zlEH3aw)^H+3OcysIz@BeT0k6s6*@U(<1iw!;0D(dRd;LKV7Fw9ufc9H*e!%H40emb zZYe4kVX#}yrl5a%Fe+cum2_&T^?t5!%v)($h1W$g4(GX7%-M;L;!EGeRsj+m$myQM(sH$W}&+BV65aWX(Hm{$x? zOCZM4HVq-drJrl!hh!$PH%DwL+r9$H2B?J&wru?5Gth%cySvK=MS^`GcpMML6FXza zil&l;k?H`V43zOu&Y}0V;ZPct{ZEjXMJ+4j zt>ipla8TA02c`TrYtT*%+DR4{mPb2zApAJSHHljTIiagyOjZF0ZX!6!HUZTn+Nd@I z+~jOJ6{Z;1ndW1Yb6%xUz`K04M9o%Jq$(A{NEk?ys*oni%ZaH73ah9=zH+|Lz{N&G zEQ&bG#z_rbLN-x<9&NeyV_;0!9|L1T$05y*2F8S}K?7sL2Z8ms_Gyab*~|_1#VQQS zfG}^B&*wdR0dd~YeiW}(B(0-}J3=N>+*}m;K?Bvws`Ht?s*0bQ zI7EqKvfQyQz?d914r7weRnmtsIcx#OB(o0#V`5-T)(6IaBsZ?NKFktoq_MD(Mhln3 zZXB6J%ok;c{TO$G8j&bbeG3|OLew;F0F5?Wn)}wxB7}Fh=2)JjpbS8EIw(5K4dHMh z2d5b9<)R~S$Oaie32&X?!NrF$csU>ld@pk@wJXH$e)jf)rGKFtWlfDzP1!i&+zNbn zHS`_5`8yharfK28Az3?zdvt;@_?^WJTR6>(&26fhATM)sh6$$$`RS+dF$`+x^_`qGTjkcZddbl9P1{ZlbO;#+109mXq>Sq%W)l^E z4PsA!zV?FxBE<3T!Lbe^gl-v!+5jR7T`!4~T-E9mXsEKBgi-hue{72fes>^`hst+^ zV;Ox#=hQ%ltPgZZk=CEx9Jf>xXRWL!{}6BvG8P;&ToV)ng@J&Rm*Y*sH=aD+D0jQ$ zCwo`j2k>*%-vhZ_Ft#iTi)mJhz?a3SLA7%gAn z!9iuRq>(`e(!@ZTP%cX24?I~bAXn6AM0TdtC1VfIJ4(CM|3})vVC5Nh5NsM z{^fW#{=|9z?gByEgZ%Ksz&KInfdchoU$FHkG$Fx?f>t=6PhkrJKo)v7ejVwvTSyRc ziLl%gIPozI*kGI}j)$(U6r*r(>QZ@sq?44+wG6xyjW<~$>Pdo1gMFeP474Fy@I$Fw z{0`xGbQt?Yf7>;fCkFGRe#{da@nLINC&Dclf)l`e9{5rlcUCwPtv(o`Z=CQEg+v{ z_F<4u4D!kPAfM!iC8ujEyJ0SW`bh@x2{8shHx{G!B60~z3d%t* ziES|kx}=-XCDFWg1i*x&X9+MSY}rYE%1jHUD;9NBKr7ni-_Jk}I9D!FC58vXquqnk z-Qm&I!NE`XzyC^O^DsR_o_UbYJ?Mc2WPTncWM{$okZg;bBJ8mEuVEB_1I(T+0-WUW zq%zD2wFek@6LG8!yh$VQCP#I{n`A2hp4Cv-*9+g|*x;Kqfp7B6|LPz> zpBJ!Vu*}~CgcFgMnnpND4za;F5yg+eI1!o2V4N6?ljx7ZI58L}njRNR(dA<4q0RRM zG>23seG=*+`Lw|};RnQjV4N6?6N7QG-WVsvdcQ$AF(@auQ~w(rA6?Hy3@*00EG5AHrO23etrj>=&$S z5S|CO9p{Cm-J*&Z&>q^?doQ8?Y`}x;F>_EHAZ*N&cbz1UO({ozUG-@#OyWqRG60W2 zaKA7vG}tEw`=k@tCpU~CTf;xmTLNX_Ph`Dp4*E&z?G5;e0YBM5@Dp9Fap`y+Wzw!& zCz6F8MWY)TT)IrPfkG)W#_Bg4D3qq5P`F*aG!lwLGiV(MMdLk|hl7$J(!iiJ27^*{ zlipk;lu8@00Yx#OC|QhHe;yPi5}UV_C0heXiF#&>fxx6Boq{V3mcpzxL{jELrlj_- zVt|3P7+zJ-l;otZJ8DW=qcWf=&4Q+AFE4|cQWZ0$ghb0wlMH%F-RLRZGq)S?6a$`O zz*An4cw;0nUE~y`0eo$lw4~1T5|9IZ{W65gnRQY2M{%LT;Sius@RZCx40wtGPgx)El%ja&y5LhH{h8Txvhh=*TSfSk9O#r(J}f)S$6y)M zW&~{_y}xh4ZBB?<$8De?gG+PYx>TzMIMAn&e=SLWKzgJ zfirc$N%Pt#>pHC+ek~|r8_QQ-skoln-WTwX%9JUO_9ZJsdx0_w>?zCOPwf&0nxqkE zlHjh47V!%n70Vg418qfMufBWXkVzwCoB_cmH4^WaG z=8XU;DSV^ku+{p~5+xX&F^GnY(oycnjA*|)7j>`149(B=AJLiR;@sN)?fu314jToS zaO(_2`Xik4KwXP&oZs76m7l}vl^qkcM@38xtA`)7)6X==?UHK`4c)hUI5S!-F9XhR z@Qoduv+K@=Fg$4w$;qIuZ~xcDZ`Z zjjyjOSV(w8KxQr=J`Bl`Y=B8b7Tf@bV*y#x+Qt@{Z|-zzIp48$1X&0Y1_JchBg}-w z^ZHKVSm%IWMBAWbV-tcaQZV^>wVp+sd`T)31Zs#Fe=67zlfc(c>>@Hu{azXtB@QL5V|g)e0PFsIr0xqA)N1_?tvFl9<_L-9%L4{o#tv z>Dd&ne|Rt|U(+eSHMkkEFpqF0lo;h?_uxc_QTVgQh621?&h0>UYBC5fsnM#vI! zA)J!~eeXF9;+3t!7+NKB&1;$fWIHrjcARm5O5bQD8ibbu9FJV3t2rExf}^q`!9tpQ zbHpkg*c3^YD8$VXUVQXcq&lhOS0}j%*p%Vne;5IS5Ah25zK&xRD#4EyvfGEgMH1$?`^Fl!=wZ6#;|GOFx|F0*dgvQ&Hx9 zO31DrkVx(%w*)0pFdkIB2_2j!lyB!Rfia@Q>uPuoDpsvR>y|p3=&En}3yfFe{KXtS zxxH1uGD@%`k!w_qx!cp5kn?vDJ_B2Af2my`ht~qv)vTV}J2vtRmm*2m5>(m_)H|01 z!Z&wj*0DFF4&3dm^a`E&T<&t__jr*1sNcSCT@CDEI- z5BlmBLv5o*8Ovd7)YA&)6HY1k%fU7RY0 zEny0j*|&N^0kQ)*dPjj1a3nsaArKQ?KnNg9M!%T)7+ z?arIB(r`KD>eiJTe}T8ifx2B~;lVp#G#hULN^93F`u)0N8PnmC-HcvzzR!@_Ljiq$ zCAG7*C6;W_j*X8VTc7&_1uI@}>OSDfR~ffCsEc4N#1_h{(ZQ=;e~l5E*zeM-=)AeW z1p%lL6AV=L(?|N{Vxk_Dt;tQf9;0qD)+UCXtI6o5oJO4rX)jzRYg{2y$o*UM;+W(; z$F6tlFRwsm)9E4&GMTXd7ETYYE>Or(DziW~dga}t^04RT_L&-)b=SyD0L_^4n1vu! zUyE=)LbjqadLYq>+$o0YX-T7VU5C(`rL!GdJ89 z=16@c-zu9kd-h^}kJ^t=P>Y0igyU+;V{S}&%#+5;W2TFU=vOg1X`wu3W*??JrYVoP zPUSI+tL!A}I-KR!$HXO4#3GrX0ftd^JEA}n6atGH4sfwde{#SfG+6&?y>mcJkL3;iXn)I7;FqyY=BsZYd$KiN+>}b*m{vpjvXbxXW_f|F6knf z6w!6Z2oTwuuf$v@5zej%ooqG5- zDt~Z6-$HI2-#H$t9pX#R-jSYp?cO*tF5(oWgT2x56W-wDWN&zQbS$eJMET&Q9b!bY zlL5sOe-?f+1xoSKy7>YeoKcZ)9QvfDA^kmB>ykblo!w=RO3v!+If?Sko@%K;=}G+s zO7j(*@010twl;vA>L;w)af0#vHZY!>w~vrGwPFytkhV2 zQuzp*(xj_fnpC&MqIUI3jT(%m#G*opMN=a&f1&87t37gJGFd7v$^MyM3f>64m8zgh zZw9OKmiIZo-AExYH4+OQ1g1u!sgY=EB+B;b*uGY}Mxv_jmffCc=~8(zs@2LiGMR%o zE(I%#FO!S}DA0~K3EyNyg*W6~Pj+M~BxW2_uoYC!9|gyf=%#<+YwM~MZF@tKqFSjb ze-|;-m~jh)(%oRIs}ijc^boTb@Z^1lw^pax(mmLi3&S8d<-0fpg6S>4@@s^jm#v+T zTVm+O=T_>YspKd3kn;`su*Qo3h5ht?{R>&GpV6!DgX#9pk6uXvW;V_Z@9nc$-(`7| z%PrZ*0{uX`Ka6i(XF3U$t8h@Ze~Kaoe^Fc@NixJyfQcF$XH)o6U+s;5T)uhTscIXN zQIwS;u_qH;#MYjoKxq;#iJ!5~;gIi672+c`FjBOWKedxRdmn^Ydp*!8I|%GY)odqR zqE9{9sYLo^T`6v_V0D0CI~PpsW@O@#c@J?MW=IIL5dR9%L)4S~S9u97t7=u=f8HF` zO0v;5Rk*S6TVRBD6>m&pN)IO?i-fyQu@GlIW~ZXDrVx%xDm!3sC2iE5v&Hm4o-`HV z$zrq9WvuYjZ0+<`DNTr~Dcwj6iqiBb_tvsj#>0A7OM3HcYSEP2rrTUQ5(@Q~(DtgV zn3N1&xmD9#rq6{3rv`iK{+YqHf1OVH$!LIoDa8#e>M?$_cnzvqLLv)e(P*j~Kr}W! z9Zl;;nJLtqnBScF?-1pfvijyujaJTD(%P_O{w>T~SK}eYJoQw5I%nPHmBj+Qh2Dn; zSqqX4bf@fAubM$#0b)4qT2M$CudM>@S>TKzP6Gb6y~ptlqGcQqV#YJ#f9S|f6V$L+ z3C(uHbVU+}eOAJ=LY+_0ne3Z=& zN(AUYJ~l)GW6%<2o_Yx>gV)#)DI{TN=_8_5>#{*Qz|rJ?b0$&nao9v>8w!gQ-%8OF;Djy-Sl!D#u)mlSTBrmS$jXvtQ%Mu;V++h4!BkQU>6NC zgf!3YKlT3pGeik_Rycp0I&cG$A9oOj=}jP*cXt^*6N1M8a|T6p7hCMfCb=Y7=t-+%op>+trYT>nDbJQ9zvDzVL!-^RB-|M+=- z_V=oYcTtSO1)aHY{}~lCWhGm4MzI_-g{nOvUwoi}oxE8TEQsFa7Z=0x<=^!Jy!*9V zFp9ChRITH9m+}0>f9Y3slPM>kwd~@`GP;D6Zc9$r15c_atu^FzGZMRbnf=-qWp!wM z1Cx$*i=I@J)y1+?X=+N!&kBlT8KI$wL#Kj4S7;6Q)$}SIj5@K#REF(}0@sor`zkpeVn#{YUTj9*PaUnJaz%Nv{GIBo=}oybLvf!d`8*WlU72Fu{t89cizOQhgHNiIu+XQxr@ z#^Bk>)S3uK3V}9Biwt=(n5G1iGE^wZ!9c~3o`8>1Fq0cRJA-Fu@a)nnu@*c#1+^`^ zDFbE4fB!L1cFjTAU4;J$x8+9TBs6VQ4x=~-=Be*bbpwV_9PB&W!vTECiC^Sg5Is1^Gf4;4lx~-MAt(CIfi=%Uu0)+K)4+|4r z?j0N1xI2=%el9Vtww!r-71&;Q>jb;cy&Hdm8eT3v?;s)^+%&t`5A=P$WNN54YWJ#4 zUVk&B{O)*nSf+P16}Gl4!sgds8|mLwhqLws5l!XxJ)DH6VzzFG;K8&Sf&UgYCjzf7RezC^M9jxHW^9V5VO-5nY0}F=#GU@1Oql z(&0in1mpti`wnFlf_W8%1uvUJNquQ;DpbW;DUnu!u+p$AYQvOB&ebPL0~%U`A~$?y zdp8bBmoGyU#B!i0FIB4AM6p?fURU;!f3;M0^DG{sDyU}mC`N|V)6f(VB5Op6Or39- zYM8LRi73qRV4EngUAeSN%mrMKuMK3P#2hP>P4d6j18O;Yz0pQC>}$ z^cK)UDW!F;pp=-K6)T~nRVt#3e^p_MmW`eOE4gySPHJ8}`Xac^^^>5k^b$%8;i{~n zv}9hp6~yU__Ef2om#~WXGi-VZHC~WRpZb-oLq=Co`fXQgC8b2&$}OhmELEmR*(Mb! zE4n>e{hseROD}1b3XjdT+o=PP7ug0ktFYOJdJ3CeCxxugQc4fYZ|rOLf2yR(y<6!B z?$Z9P+JgQ#k*==f8<^mx#kSs&X0;`En`qT~+MNNct^=@owYV`OxoEuoVYE{RGrnWt zVaw$_#UdUi%dd244z+~9n#*yh7vebkV1=NBVB|=lZiY;8`eEJMAwnE=!+U44XPrB9 z+nt6#!IN3>0VE6(lTB&bfBO7m50&94C=lZQ{b%PPc?Zf6+I8n3#BbmpR(k_eb?rD9 zyVRe4btZi)^sPsKVWC&Mnfjq)xpU~%dHDO!`_OWJ6%e%qOZCbhy0Ryd4V9%#ZZ5}i zB@YZ5EFGnjvNV!S;4a-@kL=XZ%0n(YfEpRU%z{j1U7edOjn?f^%FA@*WTjf-cp1qjgBQi-> z3T}r8QH;DTg70?Ge`KLX=1E-a=JG;Sms#?XDMeDE6v>muOOd2OQuU#kpR`blB(o1w zio}#6S%Xp}g>ZC9Waq1UH!Lnh0%~2d4v94*U4`)D-2LhXi;(DlzDG+_5WkDH2vOw@ z&SBHHM8jxbQgp;3p0Bu9;sUegzJI!z)(GY9oqpB)F;RDjcanHpMt( zV`hqRm|`69f08oAIMmF*eQPVn)@+J#Fy}#JT`|QtvRorFYcAtA;uTS2$x>F~giikP zqq0XwZh{3xG|PVxIeB;;JocCD4tV`JOClxJ2E2_?K)~MF6s~wMDqqu4VKw+1e)sR( z8?2h&PE9e6hKq41Xm8mqnwlK^A5)VfrzVHgMkUIae>|{yQ{N#T3sc`gc4B3Oug~1%#h5fNYyRG6s+>9ufn{rpasukS(#O z3?N&r9Ap65l*hxsNf|gP1I%Wyq$H&We@fIrAR(Gsl#LREA{T`E87bZiNhytX;DpY7Cmi1(62<|cVLU@bjGgapSWB9< z(h^g(DdzJ7D!Mg!vnVQnarwo?iS_w+y|7(W?x^OH4b!l|grN#m$!ErEq%11Jh-hO| z_U=*UwVF964mwb_<}{vqu39Cj*t(^jjILRAf3^O^blvpy*FO9T%NQjIp>=FwQ4w0- z9Qb_eFT9Cj=6X@0y7FL`NLsIcKD%;)2N&X86pWD?V5X@hU5I0<=xtHJGF2!V#RN$F z@-+$%7^O>Gd>rGA;7W7(vKNzF((m!3YN?%E>5UUGszJ*6N`kaU>isA(N(@Y1ydOv9 ze}YIccr__9#fQ|62-1qkg$$Vs z`k+=MS*xO`mXAui5U^$;Nmbe0dcP0$^qUPKs!VjZPJmj~V?A$FVW(6VZM$2&Dxo!Z zu3Of)=I%+F`cmGUFZ0)S-}V#&o#8~we=-#H)|jGySI4)jT>mrbQObuUc%Ox8buN7Q2ZHd(D?k_QM+Rf>1gNUn4U+Ir|5{D$e`t^f zUCp~eQeaKpAuHHhCqUp{%jQsmRHaRYst741MoJJ?a)?xiDPiH)CrKlOQz?kEzDUnS z=rzfMRnIodK3p^iot;+R3~+Y#9|N4-IB+&qf2|L%z&A-TeGob}1;$nd)CTX3=-W)x zOUO9o75X!mU8f+oxZ=CRv0>+;VWyYD9>}4I@Mc$)XXdz){82 zw$W@k7A_(1wD&8C`P|N`f3k=5y{*svL5^16o4OBpj`D_K4tqXCjN*@^v2?MmVjgbR)Wxy-D;M4?g@3`YzIW-8qhkm^(Po0a`aTAJLe- zqXjdp-vWOzOBK0Xf2*30mvp&HsKak4xt>$MiJeZ+5Y8ZOz$u~&ZS3!7u>?Jlz_BihCT_Zrq@ zUA-R9a=_iae(Dy2@1^b9d14#U9gyYE*knKdhtmu35cDT!SZmRwzTnBj2RU5Qz`M zp5%b;@FwBI>V0&+!z&@W-^E3u_a{eM&Xqin!TrAJfgFqPXs%lTt0@Ni4ucEJCz<4Rk!Ts zOqoaik16w*Q|3`(qDu-GQ|1wgl0Tg5`wVxW4ob)de?=;pGLO<>A<;=#rjKdpQf{v2 zEd|go02PkyFZk=(6u!X69DY?xA|>ShTx8tXEtAmbuDg$~HOeaMBq~tK1Zn1^<<{otUa2j*Lv<@L zD8KlP`hwDtZhDJ}Z@K1$#5dj9MI?-DwFM*$<*F>6Jej?6YpJ>HGp^=#WF24C(pnks zvKCe5b@xOa^(>!HRVmaFI9k+|;W16lksBs!e}gSco{2XL4p}0A1qdXGewHsdzlutO zh^M5wS1lC`S;}v1Vj(}fcW%B=zQn}fAQ<$q0I5OIxPo#$L&V2ns9G|tOu;a9ON(l; zFzr%d?Gy^DifXS{B22kJSQF*J)Dta9Y!wcvx;PipE7LNCBv)QLj%QKEyj`G>_kb+L ze+des6`BwwiBbWv;))vOiia%+m>_FYG?f!eRZhHx%^!q-si0^oD7INav4oKH{5cVn z%CgaV=h)yD`6cI0Yn*Cwr4p(;0Il=$5^k#U87=t(p{mG_51o8 zF^WeA2aS$m+f@){mkoHt3V=tjtor?Me{mfpMuhuYeg6CQ&R!DuVT((E5$R>YZm1E( z(A}+lnjQy-$Z%ggbrrlvJUVZceb+sEF~3LcM_DsPawWcUeLG#!V>ExRd>3@SZup=@%G1w6XJ7Nv6Bb0)ilgWc;xu_BN^adxVe+bcm zo*=FHy^VkuaEBoU40!YUxn-k1Lu;Evf-@kA*LVDGKX1N@_D)J1&9a3J?kwh7>`d|AxfafsM1^xeTV@N&fZ>d zmTBc!xUR9maQ#hmxy( zsm(WXVO)bMI+IKXx3eGYjgI#QCntNu!=qza)-BD{cxi{&EOUBtFgQ3qIXHyBPEU>p zC&woVVw0!EUf@i@n&iCpiGcVkkDNr_bW$SoddT(E_P&5KMy7$mX+O(Vf6sygSh99% zU-_J~i5M)3@>mpu+OQ}JcjO8{6oV>26sd=GROmGWq8J(=idumvaE)FDh5;6FIG) zF6LIsMK(UX?_tOGiE*)O?sX8-IXXYiy5SUR}K%BYT|_&QTrLz`1c;hzL;% ztA9tH%Xu^AS9l2wUBi17hGX@L1dz&WwH-g5tRBm=x>!E8qtVUSah5cB)!CwB~M= zYlPO^uWl{Sn!7Ji^RsR)Q!ks@0z89W4bKv#BbC4qG;4M0V-zS+;fBwUlt#L|E+KIK zLx}n+lr)_ZqF4=7m#e#%$55>EHJOj6sh}YG{4oD8!DfWre_OViAJWtcW6t$59eK^F zL!*i-LXNS%fKD;s?t?G>Y^HdSAq6EnUNZCGRhgQZYUzBxIk12f;@7oKNqPxqeqH^>VT_ z5F>Rs0X0R7$(*EPyV+H|hqYx+Y6$%bIh4aHIh3h~b@a70%b^^Z9LidAC}|P*I!04k+42st-j3b#sTBwNRsUI0RmSlV0fo$w4BlXJ`aW zz+DdQz3Sjx!NS2K0@7g-I?=gDa_FV+1vj_^+$EAN%gImXGf0%CX{3x5tAC<#kv%brMud}m*+5leQYBQ>0 zW~@+kMkO4NZk9geCgxHJ7D2zTs5s%vEq=HH%oI<=qwxo zUr147MRx)|Aa^#p047kJ?5rcbe~Or|TLP^ee1rlPSS_tHF1NVsRPcMpMpn=c=7Pfk zqf2SmSAp$?w@$G8+`I87sDtj%h9FvR=DV20nIFt|S@2|sX#BqW5bi#JvtsIegW#22 z3h%nBj+W5^ku;ihR|m_aMY4W(ygO`YZJMyUj+-hHNX2-)1o2Y>)us(Re+n&xn>GmQ z)cVyyzG;CREfky<=qZDU(*ju~(Q(?~?h1f3IwGpHm?}wRg`v|KzOo29<#|qz21xj#Qx7a}l*{O>m?!hXlWTN3B==D4z z0xByXQ?<1N-c3GAf9vzdt@wA~ts*O9b#QE;>)yu}Qj~UExENGVPCXWtbB5|K7dgK3 zfte-Sdhh4i-vz^*Mb?Hz*9NL3`!np~zIXTcU;oN7L;v`BpWZ`Kf7{Ht;~r@hVHv+c(-KV!aanVNECH9OwM!Q6lxjSn>nG7)O_lMaH60{vTjI2xC2d#+ zG#w{PG7acDQCd8Ce^+v-v`8ndC%21@@ZaYhrLwH&VhJSbdod~!xh!joj%Q;@@}Z=c zqfPsvw#TDQ;`F>9EiN`)Pe_ZTX?sOlq^+!nq(u@dcuU$`85Nxpx+1WW7_2~W#Ua%l z)+!#AYCKws((>MwiXIkBtsv~E?WE1sMpe>;OxC4w^c1#R&CrJ5Lu zODyPH7j#N3XqH>hFS)Qng*Xj5!cqg%XVo96)g?9%> zeri8MnQl)XBh#>227m^mlrJ98y3=nZ@)?TdUk&#EPNYQ?vgwjiBRJ6qB5yWz8uE~< zEK{8YRLnUqe{6TEbmQe07q8&rJJC^d@&=?|^UK%x>?K22ahxJvt zQ;Qs+ddaY{w7=mLeJdi0r#j!}QeTx%#7EUil_^FI4i>x<`thYT&E>vv~w0eZzOizMX zI6=Q}!K@WJmg9v8`WVTtxLxp;*{&B_wk3#Mp+k!P4bMTlcg~!GC5O1+g~gVPiYQc? z=91#De}a}-M)dH9+FSvI6UD26=lE*jisWRiWJ6T@24m zVXg?O7eyWCfC}(pxPb5CK3~@Y<|=JkhLu|v$Yve|iIePVfhcE;@p@w}|2V-kw`FEmDVIULP$m z8N}uA#H0*rNcjf)6f0K<29#@5{+O;MAQMCELcrMLb>&?);k9T9NFfe%{h>C ze-~P}0h~HjOJnsYSAc- z?;H>5Zobqq8EIJ8pwP-DgVPTV_D08he}j{gz2V`}v8>b<9nY6`hz$^@CkKOrB0p$TM_r=holxHE4X+`3qZ>1MQ&`B%291qDs}hu3Z*JXRZ3N+9@f#z*Q`|Kf1xQ= zS!=0E49fQ(3-{&=)eASGETzarjg_TL4z4Ldxw<7NH@v{0wS9H(h9DHCQ_K18hHzX3 z#}*9m+YA2a0gpX`wc6s%!aK_;PPl~Xg1Hq%O?koG5`nmmA0A*+Ua-(QZpsU0InvNj zWjYH@dBMUul)R?XY1W&E-O1G-*K zP*NL~jF71%XlelCw%7~4g?>SwnJ4kJ{ICj(&A6zc~CFWwSSrC=f ziUx3uJm#i&VU^;AI0W33DO{^Eg(`v0uOI{gP7>#WZ%z-pZoNn5J;Xhke<2}5qQ2R$ z3!|)CrB6PKFe>xee09(Dsp$DvR!Psis_$I_)L8ABo<-|IPeK(h4Y9qNSBJhhZF7z2 zohGsi-zJ7|Rcha+rR>TrmgbVA^9%qhSp^qnn}3m~j|vDis)MC)R9*6z72?sT88j4e zXllZs>0Ku|PiRR)?Bwn$f2s&H6%gm8oR<$eqn(Zhr zbl!SG^oHzd%uSC}gNxU~^VGuc?0s-mQH%ACScRYFpYG+q>f7|dum;mJ!;k^ zNs=!6fB4t6ZJ`n=Wwy)`TV}M{#p4cV_r>-Ad{^ONM_9r64Muk=e>AGrpi*OkZjjR) zcfRYWmXNi$TGA4p-8P7*PGR|xj3y1;XUhw4JlX9Ws5*BJ6fH;`1+5mLAsH`%;J zQA$bK7!^pM;lV+blW)DVqhySMqwEAF;5r0e7WUaOO1ewU zbD4T&DDCo9+9j(r%T$%9C8QK$rdfhYKgdam3jOj@B}z&)Ub{%KL{w94KHzN<*~BPv6hunB*^}t0b}bMKC7%i2^H5T+NYL!XXj0NIYwOesOjb;W! zzHRpU#q6z7e*wLPeZE9x-ljHttqQzN5utn3Xp)u^arN~oK04KX8zMogif=}RmfJQeyvLF+C<&jm%R#3mArDbnO2VaqL^~+CCha;fgce3u1c60Qi}wha#mMR zcZ4tR{cmIP@YoK=wu*yZb<8{B&QlB^P;=?2RK(M&h1Yx)yt4bLdRTxOrcTYF040L} zu#?~Qf86jM0(Y!)XATbk@F$21h=T42+d@D(QA*|k2mb_#tgq5ifcG!G{ur!K!iE;{uZBz)$?8HmG7LK@)71BtYi;{{> zqE?c0C=@Dt6^>R1OMiWF9Zkje1}NI#mq3R+OHaI zW%AgOB`|PQ{>8dDx3+(Ke{sIUUKy6Ie{}{M@#EaR3FD%^#0Y?d9!TF%auPSC?K)K2 zF3EwSC#0T*_A%Gn^0_jPlC{UT3d~wU%n)PmZ-Kwa-a_w>f0GkT zv_(3=`)*=evbHCWFg0KooK7EMg^_w*V4)1*Z?s+G+c|Re*A`YLUq#AggX73Jf^-(t zGlXOWV*0TFa=gjR2j!)K;VW5n({sMPLl${(Pr*JK$JO-)!<02lxc5Z>QC;u>1yb~0 z!uXk5o4bSjnwSY^H|9j2Oy!)u~QP5ME^4tD9!Nzf$9@Vymm0=yb0oNLMf**G+e#%MwHve;5qwCYbB4 z0xxGDeCwuH?6CyN%18FPDVKJf^8&KV^0(^IK&iZq1Uz7i{A9G~J>Q{2b6$2r6sY+U zylhpoKbDTe7RXEs#VLDqvdKJi-ao0aLIEPAuS_Oy)u@TisL2MgOlk=pm-Bxi1P@=r zhgFga*QgNl`_Ku{SN%G;f4Q^SuZg_3U_FG5X3|meNE~9Lg{=9NcRjVeFJaM2tL^Qc zg2DEEFkQb_^F622d=K<>n(=|Yb>@6{y$-T|3&p};_`w*(SdTxvdHsAG;wgrI=Hmw! zoH*XySjF-nDKeM6?`0L1!~}rB4HX(7wMP;)x4+r*oBJs^z%Nh*f5p7?RMq+hw`1FT z9OD@pyWTkJ0A;At_gB_6^9o&P6}!MU`+*AHg$m4v#A~APm|cOx0q((6DUJ>sDZSs)3B}Xh@m0aE*zHFLC>~F2<|YW zQ_JYA_>$9QAg2Ere+H^+bn0WE=HQyt>rRsdtnnX_7J&4O@gJya3g##T(Q#1&C4#7^OXcl)6FSIN+3p64szbK^3@}L~N7OkR>h2S4sg$HLJV~(aFVn z|L*sC=wPiWcQ0x#mHng?(z?Y8#rP^&wNvny3G8lB_}rKa{t$mpk`DbMUJG4nKjt_g7heX+g~ zN_joJmGNHXSd3FbT4FIl?P+k*g?<`mu|#jJvKZ^T2^JIHi?CQtIzt2(7O8(>0yXN_ zzrg3^Pn`Gfe=aa$poe0u^P*ICe(Vb&APP-LLPnq!F2l931;Is+o{e8e`s~(M_!k-c zsM(Es0;#|9hwv0_Z)w;L@g!re_`LI@xSm@TuVTMm_*n_Zwg^R=<08#@&s@^~T7K<> zGW@ez#T7VtCakAY)fQ?8l9!UUbg+GnFyIuM0xWcde1H9cV>`S zYFTFpq9gS5v4e#QKv=m-(L*g21<)z^(E>SS0@Ou71(MpdO{G^$Cz;bQL(9w{oO(LQ z5Hh1@S40J8|Lh7$DVu0l2+OjybdNsK+_e6cL0LiFE)H4d2OaSEa$w%HFlF6e`tj(D@ zprFtInn9W2){IAv-7n+a@o!)YCQ&())OZ(%e}K`lQuRqgDgrwtS)nyMaFYVKC=;Lw7< zFR}i0Pfd0Z*pG^bCTuCxI4_ksnUy@7)#UiBqPME6)U~)mmqDtob95OrYP(A-m6$F| zf2F1abr}Px=~7(=iKPrOr3F)>cfCH#xLvCasot=b^1ZcAU>VnJ4MeKn{G*jMxgrd2 z*s0^}RLb?cRFs(rd~qvc>Af;2yAoZf zH0sjYgT~f3ZkvS$THm;BAkge`f0=H>2T!innkC!xz!|pFI;h+wlD?`Lak2fAS({Edy6=EQ0^PMVo=bsu}4;K&9Fko7-~*?mZPwldC$;p>z|5@j+&bJ%nFRcOnFTr@RQbrk4nU_O&Yd1{|eSv8)f=aa9C)6`IzQYBSO zm0SmvE0q+-^R0ZL5=-be@*KwaK`g{2mZFb z$FYN>4aPS_X9L6IZQwtYGLv517T8Cf@3X)GA5D=p9p4O5F)A*Pwz8b0W?AL<4vYh; z9Q%ht47!se=K0D%Tbd(X>sXf#^aLuNf43q0${`Qq&{LHMKR2Je-A-^exMjv4z{Scu z+-jzVXx+o(AMC)jf3K$sph?P35*`?{m!M9?yzrF*FxSXpS$VTn9m{>i`C$tSf1d}i zdyQZE;T&|-$@r}w%<+V1aUTvG3Tx-Qd!Pz)PY4m)^KFRcf0#np)Am=&=-|sobAZgU z?}I4{LEE~Y&u8IJ`}fs%UCo58EI_&*qm?K=z)8Ej7-?{0p-U5N(x zX8`|$g11fM{?I|Ia+@en7XEP|VylMs5Rt>tlbt25CraaLE+%-1#Vk&;yL4^>2hMxi ztLgFvuqbuo=ie~^q$-U9oiBljREw`^EPMRGB5?6qq|vK9!}76^ zU+7@tjbKOq+qwT>yB_B9{gBKFY9_HdVo8qg{5N~%?!p#>j?llH>>U;d21%0letUkU z{FJ=_LjeTC!P_dG+9mVx%J%F#XM*-d7e$8>cvuZ|e^q-iaUrhGse9yALU>zuiax{Q zJ+&arN@!vwynU~}67C&)QUKtZo=g(vw@YEwd-e==Lb8ROrj598WOC)i|gu5ExByX{S&;bTORhSv3ie}u*c_&dCp<2k|j-D2vP&2NP?(0!Yiv}pRm z{fTpn&hBhd&HmVl{n5R<$Hy*Zv4I~Wlc-VITS7>6mGjwHIB2 zT4#2mwc3ful$w2Lh4&#eg=QDp=tEJ?QDIGXpx?k*M7JM^FgNF*b=rOQ5f~@Te`;9k zHuUDw80|YFnk1TI8NsA({kr_(&Su>dWyFN_V&RdK!r5##e(HJ?1SoC%jP>Z&e>m6s zp$h@y$u@53sKcOV%e2?pQW0M-;SU+^9*m4ra+Ostxn8odvJDBc@s%%1H{-E2;w*z- zjC;4b*#LP;8A!pedhS)Nu+At!e_YQStJMeINY8?Y_cXA{y=4jG1VKT;{fE1DCtTeo z`e>f1mU~FQBfZetNQbC3U^j$42sR+ru5i98)6jE@lu<^eZk6oha&dd>en&m*(TmrMaPJ#zSN^wf&vWJ`R$%?iVyXwNf0VsraG+1{ zE*jgmZQHgt8{4*%cVpYO?QF8K?PQaUu`xI1$?t#b)~$2Tr}JfA)LU;&ch7Y7OwaRl zT{wITv1d;FVMA8nC~QdV7YicmLRtvJ5GIlVTyN=aKHr$dWW^LEGffL9WoHRyZj{01 z(kY!`bu=^Rs#zsd&!8r~J1yt}UF?9(&OBFiMbtyWg?p%cE#&;l_oSt$+SDw{Y8lBs z`34B{vYm#`hYiE_{%_1H4q@HEh;cf$l;K|#?)vGr;O87;3cnWzNfNI5;8Jos ztmFd3hRUT9zMe8M*Xyg~!T#GFPI9zWcztzOLPl^s_1GcK;gw%V2rXrSD?>7J7KAuP z(_m|6KRCOfYsLduIVHw_DgNTF5w7_g<`@X2;reYzWUwIX>rza$&!Y4~$t(`Zbn9r0>iqNyw)En;FMZP$F2;0IPA}fEIh5q$4?b)Hjx5sNH_QfI}IBrvIH zR1Mo7q1wl@EGik*OjRXtBUur&ymh6C3Q}z29m8Hax>Bte0=d&abl~FVHCY+0XLStSvYOd=)VW}V>Sqp8!_lSO@ zll-Wcnf1Xn-4*yju2xSa?u2D+6J^970&4kt>z6#n&)uKwkiCgQva3D9?soN{Svv?3 zX|kSBk#&DAQ6!{~D_zdh+N@;mDvS|8jSuN6xemkSC(k8Yv+EMX0V)xF2n~`-MQ%Nx zR<|TxMD~^`gaOuqV1z`zEe{!u25|LonI!OO&jgWg4G&03OyB}nD4A;Hrqn0<=d)*B zf6(mmzCYN7SuxTY*^*6W{_&L8OxiTJJ>kQX5~rBcOqUgV!WkF=l$wsZ+Kz1V^K=q) zP!;*oQXY=^vOOcH0F9fSRAFbw%{av(8Ld%^B{EKfg`bTQ(xTn&_&?Y87L6M4r5af>G z9@W4XT9d+$5bScNHuq%ZC|>vG3L8c9x9xy5`sn%=@6T6nz|msXnRejaYXNP?zW4tl z=~>0U-TBt`Z)d|JfMR|FE<3@@L4@Av$CKD11DtNeWhsV4KtzmX`xgRf2gbx4>nF66 z_OO8~8jXwWa2<`r*i%2EI7S;*@3%oTS=Vnzax;6SH9HsTx+A~R<3noc#ZVRo4{Hi;<1GF4Ne#}GHYG3ff5&LFOx8|yfhPCasgCce|DN-}jOe7L{yNg@ zPYP)LWbZkBZg!ox59hAW_xxUsRe|rRpRWo0lRB0y8z3?L_79le%xWHl%ORA5w%7b4 zzU=viH^B3?UUM)yVzXL8x@RD~)((}M-kCK=D6!xpUo{)>mT^htQ8RlYxUWE>< ztYtM-6CJPN$-Z>?z)PG!1h+}01b7{*Ew?6>SEf_9*?F7u@9y&A)15iJ#S=a z*_T!*?d1UmpN`gK-NQ&*yl`=`!Si!Z*0n9PN#@b2X=qMUdgaRZjE}rJ>);C zXzMKrkxGy%hedj+894{Bh3a$Y55cP9QM%;WJ*#MHx?}{e_E|{^6DwtBjuR zC6f7s`^bWuiI8@`D(o4=7xi>(P@qF`1n;cPrP{nm+W3md!S_MCOhum}*&YvB~e|WsgJvoQcT7Z2h zLVBS7Q0yRHz=WOZ>TvCLB0%M|a0&Qy0KGNs{VtYuV<-$?@<3*sf~W2^`piKzqpx=y zU0s{!ceFJW=^=8rl!*yT5PdO#rOUDMUzWHb%yE;yC0+YQm7D@|h@}mrG9%{Fv>VWA z4=_r6rYzvz&2x9Z8baJIv>aEyMpk`s(mf$^0RQaYQ~dQL)URziOtse|Ne1Sn!#uOg z<^yvXUS6(Ff+uc<+&R}bkVgrZNe3@$rDa2rN zN5}yU0TO7Q7#e%uHG#3l5iwMx(fUj_S1~~RN zg~h^@ApNRGobbodVFymP3X0Q9hD}%Y_%(bN#n>dxBb0ai^Lm0SW!aFFZ;9l1Zdq`#A z-87kPk}i`u)f-oUO+Ch36a$AXm^vE9?Rr(b--Rc+28(HX(xIQJq+vyNpv}4589hA%?9t`Gqn(Qa|ZeuY^=n^MI5yJ z5@O*E{PA8)_6snk=Ap!+5dNvHlUde*I0U}#WP%W7k>^GE7*2HvV$7rU`C>DSfebvH z&v{=YGt&A)ywKHfjI&6=LDb*<4+5A+-5eU~i>#?}jwQZg*hg{emRI^{x98f25+**I znZ@NZuQ;&Tm#2{oSgtv_ihMLtmc~L`D@Kck@vT!yJ<2bnE|N#c?4ReCi|UuNq<*;W zJtD~ULC21Zb>2NSflO+Jqly~eql#}jh_wc*yeQik&kz%geY(V3U4JhNjG7}5CA zUl$#O!*g2wo5CcUcGY0zS&+B;^SYi9qnIFwb)x_ZoP&zoE}l;pSX`M1y;)U`11?;Wk>h2#&Rwk7$@V@@U`!~_Ii)q7(i zt?vS^CZ2`1fwY2kT>(A*{_H>7#z)BYZ2ZV`8-r3}+l;snTkz+O zZmBMwcPG8T(amo^I3aK7_i_>yBkUjf^N*sRgjOO;ouf=hYl^dPYvf%#r-lPF^g{mY zpYfr-{~$Rs`Pm4bPDopDw|+ajhQDJotrgdwXQJy1nQu}A@bD#|x^pC`x^tZOcD68m z?t8Y}>yo)khre?N`hyFW1N=hAy?*d;oK{RT_#s*V^~sGF#o5i1jK@6%p4RTE@h2lq zrl*mAnwpo(I)H?if;c)l#N4O$ZmH2qEkOwgE4;-8<<_Ha?9$`60T`9Yj>DG$F6*P@ z2x^nvib&`EKix9*xo;RX<~F3uZ4#c$M)Cqj1ny zUzfMtw!rhYI|^i}WB+To0^v9I4`YhAzS%wyWUZn~ayLX)#tMj)Qp?!^U*b6AyTMC* z$Ct5fewpoT2d9i4*#d9}UWM&}zprR+MxDSlbh+2w*Dkvu;Tar)>G;-8SfH1<6#L+D zo$F^d_x*+JZCv8-nZsgFSK=okamNE6fs`bQUt}BZ6kC!#ecIW*M;)IY&WQZKyWKCt z43jW&AGUWCq@rUnBQS{LWCN}eM9PDKu&x87bzd7hbBo~7-uF>RGm8X zGMB=^<6#xNW|J6Il~jF^pp=RCkH3Swe1*};I=9)5OO@%N-!Awd4!i5N?C_j^Gv-QpoMjN7?c7y z&eSIvf8IxX-mIz;GrY0$)c$)Uc*rk)LTyTv{2p%v9R*IjcSh~cV=64MiOm2MF0Dz4 zI$RgA?_TMiX7TA&a$=&2F%-j9%Y8^Z+fQ3w#5R^w+Nv@*%10UE?D-TiA0N)6`GUG# z@Wr#B4C&8kbo=tR)Dez0@5p#4rt9x^v+$l<%)LcyG}blxgfk)jE~U-k+M5*j$m9)` zslGuh{@}I7v71(d8|zPMLsJ9viS-3cu=TIFK%f;tG}+A}sCNjDRw%S&!19Vo0EWTf#h_b>Y&hqv6$| zRTWcaazYwVx;2p{^Dp>C0xRpfkHWnw$O{%OtcC@;c05-8U4+d5>o@}lf0wgjmI}k7 z0GE0fKJNp6kp6QX8m@_zkuvuMU2^{g`(e&iiRa*Q*o@ z>~=qq4Gk_@L__~zPsOU{4NNqV3CW?#H+p}MU`gJrOguQ^oAwLgX#5>>pu-SNL%vby z9}{dNP=vS$!hgJWD!);HNC-I)IDSFQiLjPgo_YW|Cg^j3irK=etEqqPAK1^;tABsI zAx8**|1qL{5RAYd01DHff&!6IzZG&eG_Ne7aE==er#;F|n`floXM^$ATE%GE1<@+h z;No~%$PB7Se8ETqGlMpfSHi!qL`OGWP5kLx>-iRNAQe0)ln`7DBn#x**u2y1Q2$j* zz@UNh#q$@LB`VEtZ9CDutY~AyyRL-@Fg5#m9qR-ieVC<0;${HSvBM z919ygTL#-c(J#EU^%~5mWCZyHheINss(B&&y^`b!=3yna6Rm?rb)_+aksu@dH}}4% z>Y(68-0k}+^*l}u>;!0s95WyxLD-5d`=(ZcU13a^8y4`Sx%~2Q+2{rNhue{{LAx@V zs8q0YANjO1-F*>gPmp84jdJBzzVS(`mR97N*viPj+0wahMTfIbh`FEyy#QKUYM+2s z)YTG|;030XtX%^+B##t|qDy1Ny(dAIC`O4!t`rkwc4B-68191Lrru8ESdViM4!|aF zJd4<7DvAV?H%c8+eXwjr-S~X*>Jw8vn6^!7ShH=V*jin{=nO)vEMTS0akjV#@W}YQ zRJTAWy|Pops-loUG&#d7UT#788?((XNNag2oMm)R|Gx4 z9Yi3qA1b%XK)ogsCp4IRuv`1|aVri`+1mQbtW)hNSFa7d#>- zC-ho&qpYFij^*u5XlzuOq#*e=Pr8{A{v%K_Yq?*SAV^5xapKrVP`tuCespql&Zbo#hYy|-J|vOx`}<7?gmSh zvuAq)7kL!xwc!Q?5fXofE&gO33kG%29mrCsG?xzF%{z^8t0O}bh_)zw;>u8`D1(HD zc{bz@G%Z@|72L?I>n*>39z$deOMgLAB5H^VQkOVS%9F}$4J<}^wBq7fYP!QktDtjt zW#wk}`$^Ua8vmr*UhurX9L8h}?xV}9f7odPX-$h>!;8=@GLxAJ)JpSeLv#v% z8lK?$G(O~0vRADY4@Ea}3**tDzE6X6Ea#{au@{B!He$*0M{YFsT~#H*lCP@hY+sbe zH(?Jw{mgOd3=DIuks+F^oU$U?pZCwz?VQ}NW-_%*>5pSp-(G6-37R}$yxnIflgS(3 zZ$pAKGa@wW!WZ*%%JAwY{wmKw!OQ33qBW8?To(GX;mGmP^7kmuX@?_#_tVO>>czLc zL3q=-zS6!!S%Ef3Jar!KCR5*z(7Q|k#~|a^@=xdIJ=zjwy;V!DgKS{*iUG)}hM?na zTfes<+T;6f$<9i#togvQVTX*nKqK*5>usq&IOYQc&5ApkJ{;qqbu>5If>Gs!PstA? z;8$pH&zi?eAU+FQiiHHC(A0+>Ch~dvpmV>f9N`z26i&Uhu1jNAX3zFBzRH*Y@#Mi7 zFE~dW0ZH>6aS+&L*Br(D6Q*$`r-z5~^lh{urIi%gPTT#)2&x*Xl2#AbL6(vm{cids zVDp0rMb$`*6N{&xT=(^bYpWQlyL1hXq$|Td?IKp(_hSX5d$H|-u4fQ1bDNtw{SwaEom6Ms_d{Ju7#a4Oec^EZlYlMV0ZW>wP_oaiM}k-)0J!m<&|N!IZQQi zdHk;UN=5}TNz#KpH9yCuM@w^8s~8K~_U-PYviWX12=5H%dAY|S|Zq$OXnnP zfxnu9nJMn})|MK(s~qEj*#ilg0vL=eHSz349uS#vC~%r>p6O}hS*^QRx(7CiBW$j} zW)-N+XV)zQB8Z8P@wMsgJ!d!U&bynM**l~|r)F&iqXNkNuvjNUT0e?lW#e@i`dT1Y zQ3xnivE4{fF{UOq54y2&p#QChqrf-trngLs{8K*o^=gWs`jjMh;YH(D z+3@a(q=UR%id?}Q>Yp0p$|n(so#E|thce{4qxr2hmh2QBZIo#So^3=eQgU({i~j_P z4R3)t0u9=yn@j)?n9#cJb{5GSAC*bo(uGK&qO_TwTcF5{n^?;L4aEaRMZ2!d#Nm!D zHG|SCqY9IK14G6#;9#OdH>uE>Ks#uq6>3GO*Nhs;WBifFC~^{@g?o~mHA_I7 z(%C-ymv9OM@R}f-&Y=L6PA^8s!<({PE8Qr9mI$So&zj0WeJDNbeOX|$kU1CpbO6Ui z^2UE-tGN_CP4ABU%7AX=i3dELjPLHq60@4!)-NT;B;7H`WThtbDf3YTdPh8yX-}?x zamlv531XHol0{?JabfAJ?nZd;1Q$ok{L%X5EUX*`>o(um zDc~2o#MMH%=BlDOb~t{Q9AI+KFY5!>hh*)>oKLUO3(gU9f`@zm%Fr`2pMRjYFhRV^ zqL(Cd7w}lFqhTrEcqse&_Ul+Iz|pJQ7DqWZ*O5_~wLh|t))4DQhD2&8VN9f0s$<)m zNE9^yQn0XJiO@{2YTtNP0y@HFY)1=!0|hkU1_yQFggj_0AaS9TC|FBrDXQ=wgancd8rZpjb7~Eiz2ew#R7~iobuDty;jMV4Z%_oMhJ5mBmo&t*I|=}zVt4(2C&iQKeM^Ec2k_PhLj#;sWo~slkXiMW zVXn@T>Aa7HR>rr4#kXI#1rQtOCTNT(EEzTbQmK~Esz&S7%&$f3q`r;dNUCkp>TAiF z!^Vthc~T^9ztP3xF?{Xw!XNQ{e;~AZcLYwt7qegv z*E^i3uDDCmM6CHmid>-sTLyN9zMaW*El@jJr?$&vCf3rPB=1mD5)NqEml8y;Fs}@V zM^7UGLLk=MQzB(XAaA8kWuy;QZyEfJYom7fNV|HDfm zTLd-loIE79|EXxT7(EtF@srKn;Ydg-t2kVSV0cfEe^mFhmqzF}VgI^Q3&9Z9H- zzuxqDt54)`)uzPp*LII5_>ax&@;A+6;d3C~^y?yTO{mLNz*Y9Bw;E|{vQf_vkK`M+ z{?P~qlBg@j4A~TNSB0RshBFFY@#@4B7ozJg9&Ee=fTY%@7S>B((`YSiE~+TU%3ht6 zq|QGMa~%3v5!LbUri3Iqbt#);%sM$Sg+ipvci=>zOu<13Er4Qw$d#;fAeJ)jWHjKn zA=&ici(#)8po`G&0>6oHN*GrqDeao%6EQIBrM-@AW{{7c8M1LET|->W=ReZtl^&OY z02F^pxTtEGS%;FZADQC^2nTEq$qb6}E7SW;=9Bp>=F!aoVT-&OoNWYl7H0;j<=U7p)P5VGz?<SWxpCX{ zAYYv^+1J=e(doz@{tPKtN~m ztoqzAW6)Zss5Xvb1o)1dF1Yxc6c#nB(H53jv+eYulI`&A5ZhJ}vTXwiIcG7d9d$8l zY+ZD#lKRy)J?QQ-jOmxp)dsn;9MSF9v0hB?2aUrscN@gfk#rq-YH-TBQBfONJ?FE% z%T84!&Q-qbPgR-1%!iJOpDC(Z=R6tMuxCRT7aFVX+DQOjjW!M|mRBOEG{WWc+(;kh zCKrGWmP^rF9d3@=WTubuZ}NB?6~4OUCbxK>n!zJ^WGXgpO^}*_z_rhTsL@x+O5yME zLC7#)?C>H*No2&Q|hUy#aA_m6L5XyyFe!Ehr|e|zdpM_Ai-I!26%sr2M-V zByB)}beptm%*S|}Gke6j*L3!oii=1;E-St+<+Lw9Y7o;<$qnTD9pBTAFA|+$NL!Up_g!1Ge{H7w~?%VW%IP$(Th4Rs{$* zB!jZ)L+V$)@TPv%{W$!ux4)E7D1zgs?<0_GTpAQ(VaWOmf|{&<1gHM;7+xpL=vl^< z(a}5Rne+ugeHFWmyvLA*Dyu+Mb)Q|dm=Ym=W9`U<&5q1UqjSZbJEy0l~7cwLj% zj?JOvnnEd?&AFJ$VQDCq>^Z3UKzk>B=_xK?%Byb9jM>?N9tLL8ZrGyS9WwnPrd7`JiHo{QqkgbJCd3BIJS5E1NSm8cQ-4BDcGkcy2hqVJBvVx^KzysyQ#qtzuW&I7qB}#ZG6UU5 z+tA4xX~a!TV+AI^#-h@hO39&2%K~L(O1%WSHLf;Fsd;j8sL`LeVGXU2XV9!o@P-l) z8)_JX*fYdbu)bEur=H)ESU(1P&O*00n93G47SG9Sv;0>Peu~Kh6jIu|@~TFdADTt; z`)KvJHyiDV`wR6x~8wBZSUcJ%L?Om1Mz3Txusoc;QB(kZ2$M z)*xg&C~lK|CsH^ncn3K|uJ{RDpN|djkxi-Ii=8a!r@GJ36)l3o(2s(%b6+_Bf7c)$ zDg?WslV?)-Dk03zAw|Hr|J`~&X}@%cGR`hKz!xX9d#IQnD?IEkGIWEaoagJ?g;*cF z6h|Uvd@+U z$-r(1CethgocL!FB1uC-#GwfhB5ALBNx60j#dQhIoW1ZI=?8L}Q1O=Oqx%_g9Fp@r zvpklk45pGgpSZz% zffs9JS#Gj59#%RWDRc`JERsLvZ1OA;Y&gcM3b(Q+PD?V0TihKNMiSL>`=r>D4B<4R1{VFl&b8pU(CS29 zjn>eON`<3IjBTY&NWg#9L!hFgh6^^k`JV2qf`${k8wl|#B9-hiBh}O-Fbx$Z+OHsZ zNyPjf9*@C@?q5QaO*0U;2_NWmGdlQWs!>ijyd+7CTR|ONI6w@Iu!}AvMMy3${+2io zLQIZFvO)8L(+UqNH$Pet!tEDxEJ(I1_e36PF+eOkhVg;(O(jgE^6NQ_jJVh%UUmrm z1E<{ym}pe}wgRhW_8xRl)hi+vd&-p5kf$1W1J`g%J^t7kzhYlruY z6U!W{PEK5$SaPG&A>#Hn!jTl~7o$_4YX4-q!5Zt-yl2Gr#!8k8nYJ5`dP0up9Vsjo z8(R=~Y`Ou4C{E7Oc(dHWikBQFJaVzn!Se>NQlYI!2{)~p-FSZe01{%VF`hyo87pCw zHRz7qTnEcVPIv)w+yvofv_c;%DoR+Ygm}a;CJpi|C`2+TexsYh1Qm#h4op6t*06rH z(r+jbxJ|5Oz#@|oVhbqf_cgRG3pl82axS>(cp?wjcRB7dQRzW&TLmBv zvkUytQyhbC6;*m*C%8qQ=}}UY(c(HBcEBz{KS?Ygojq?ZN!;2K2q-BdfgsL^7ad&< zTizBSA$01AoqqGb+|4e2wn5B_KL?1y|DtWMwC7+nQ6h4iiquM~M}oF8?Jn%sgkvWU zQY}yn5oz)$igB!bn~301@O?$fo&q9hTFe*A6r@7NBUo@z>2pz4X>@GHB50g4-GpyM zxn$_mp9;P_vS(DPoZpypxChluq0{?P#&*Jm2}hmezRv&F1V5Tz_aJOx-@D`dV*a0p z6}+p-4y;()#u(fAl6QN(b;H7V75)q6N$THgExmf%fT4cavkh(lq>xbZt|i->Cez>* z4g28LnAy{E(yp|WXAI=#nn?iijVxdSMUr$mh~kT3pz=5%Me#ALAno|qyH-3BkS;2x zmo4>Uba2=+#EOp3f8Ubp$(LGHoyn&dW%exXv>&kL_Xm!uX%mZJ{uY`eGF z3J*dLx)H*;8l3PZj$`je9vyjA>3ZDF{9Jy9LVJK5Bc1c)UbshbCFstyY(e@-6enrV z`=ta@hmJGS@ooEOLXB6(rHe&)4$bp#{Mz3I;XHL8zUXs74i^@V*Aa(kei* zyC@eIwtv^S+aW70z6R*d__1KbkVywD={P-l9E3zotQ%`rX!w}o02KbZHx(t7k4_T1-B3TtT~|zO-@9VbCTRM-G)hJ2u?6tkh=^{zJuK@k$n{1 z^^neHy9D1CVz~@X^&tLFh|6FB#FEz@@U@DXoU5-;P0j(4{*Zr+mkeNB_DtwCvT-3e z@K~5~E_VG0+Sm_v#$veGD7au4}I%5NxH*igX`| zDH^mXn7SKu7k_gn9Rs%Ko=|n}$eo&wOkCDOh(*thCEsDxlxhzYcod1rl(OBZFdV{K zX!jLZW+3(zw5%<~3aw~Q6lgSLIyaBjzfWe7p{5-Q4{5%{$ z{Ne+u%~ar@am{~_pP3)XM4u3mO@RU78IQ-)0+a4zSJx6t8UKlN5cW#g#M{mI87u@D zssn7@#i;YxoH*H-`i7yr5FSsh_(BWEt-PLc zqmCmS3f!pIwB#45w4~gr)6mmxK7JnyvpRgkd|_5~$=9L_j_M_5JacU0lh7u8BYl*KJ zV1G#fxf#f1LBKasXiC6Ge=(({}VCDTWt z+f6x_kePXg2y}93$qU8G0B;Mxj$Erd^^qnhJ%zY^)MKu^)72_Mq%TbJxm8#S1O*JP z2i;>RFkZhK_UnU3VUpS^Q-(&=h@1)9uH`0g8jJ?is(TOJNQS5kCzAwP9G7e(CR$>g;1M5IK0 z2c>|)OC)(Pmp@lg5E!&QSFl)JFTx4F2J#Pb5M#jc=tg2emx&NX=6c|o{B>+I<-)`d zmFK$NGdTR};)_7`q1LhR8<6B{DAOgy{eB4~Z#QT3^YwTBeGal4Dw*yFCW~J4v6}~S zO0ts$w~$pPdm)h&w4K}?Cr1N?T-=enH(u43-U3q+ehM1yB=4?$&w!SQY7yipa@bKo zA^t&i4r=-w*v5|hG}8k{oAFH2b9T#`^Wv$NpF346p5JM#ff_4Rj;b2w8TXg{x9qp~ zRJFArO|mo*k|d^FUM=8S)7#)BNbvQN$?1}1lx>l5E5yk7N2oDtuDn$uqS2KF>dZTI zXAXOpxC>0Q^h05bL+70tZ1M04nWG~q+VQl> zOJKO4z{6JCr2U50(tE&a=VxHKr{>6v{hwM-+O_1NM!~jZ=aJD%=NX;-wRPYet4kMG zc8Q91*6Z(6@Ad#ZEgFQx4+u(54W020$wWz%8afOjj2{#S-s$RLCQj7^k!UWMvuAnD zIIb0LCwu!{zrM|2?k7n=b;~k@C*2(3Ohwcz6NvwTP-HW+8ObIQq7L_SBuvW677s8# zHw=Y+CQM>V?jlJQHr$k$`x6NisFF-lTP4a{beQE6S#;2f3r->Nzbhr`^k_}5?E0l* zxUihSpYvsgW(qOCGQNjdXLQsmueBacA-3Q5+xt7|5^t=OW7vpgEb|Q!aD`+fv2llG zSQuOKqo}i=ADN(tz!9sI+^TUSKArO#ar1z2Fm7y}-Ji zKHF-_Qj4xQgwHwyK%blJ5`Qc!g?CJ{3QTT!V1-?M@V##cvD zU`kP-2}7g&8zS}%5_>kqhG_Nd*8s0P|EQcLlTgp#;_TutxrAF_@}@Rx{7M1w!RX99 z?#U8QTAO@(tc2p#NaaOm<)RM%()QE0?_;|qK?F(( z1nU&x9gi~(_rU%{?kb<<&91~r_wcANsGrvm|J5}=asLSae%*shD)6j)`?y1TDo6Cnk^`lcN4tSvX;ylL-6A zNj#NnJ{xw(X?<%~cg|EiGZ3>s=@jZHei-zy1F=JQ6qiD+o+3BtuNx4@CurPD{fO>P z;)Jqq(q#D$u%_j-#wnOxyv7^|(7I$Xous_jF(Ih1ZN;ywQUOg&FW_#OI*C46GwMx`*E zH}&HvB!ArdM3Lx|AL;ui>9ufOH!mmWQs2_VZPXEy_IZ{6Pc6`|?afsqLg_f{NKoP= z)`v^^BJw(}NZ-}-=v7kF18)!);u!510f1NMZ$qJrke+0H-)1QiaE3zZGYk$Kf+pIX zLEx(=XP{|Ev?h5rd{X5Z{@|haK~TdPBY^jeY%PoyJIF``Mz)Z)k%Ch)C89 z%TZnKVd4+fJZ8kaX7B`Ps0T^_qXHviz27C-SkHP_G^P_B%&pMeC^<-c_sqPbMRR+% zjT2zM(FDa##JaEQh8aO{r8rWI1C<0);eYVkF^a%^*ddMpv3MXYq1eG}29n%G;viyd z9`c~#B7lKZ`cF%v;W*?gr&V#I27TTN?mACJQ7m{#ES5F-DEVSLXdei`*6R9#=r$le zC+iYH5@f{H{UXo}AqOg)_b_x8IPh^xcfu4*P_fyq1**h0=59mQcajmAFg|~xa2|n+ zhEng%R?cvH%Knz2(v_GjZFOGo2i%0LLJkG`$dLMV6lcxlTV?eJ_Tp~YUfC%1usdKTK=I7M7mW7Ds9ZwcP!&Ww z$0+U%4|$%qj-I=^8tn#qA{5QLx{zTv&w_+$`5x-C`B?ZBA~Ap^?uM4rHX9DD_}ozQ zd-}P-cxVfac;$lAxqmD?5t*FWBM{lPD?iMyBY?OaiIYgpf@TPSHo~lXej6m2#kuXg(+8|N)!v= zjX99)P4XR%IY0<%%XZFZUb1*kJCdyA%zG&I>vvtuVLqQA5$Admq8Q%O(=yhCql zKWiBQa@c=qrCqf-Ddn8jHmY4 zGBsICA%f+IGz3B>ow&l{Onys)3(3W#u?zll zUdV*N{i~w;(_TXo1d{Fbf8I;4mfg=;V;Ea{4ExVvG!J1wxmcN0`l`66?7qy!!Ivt% z_8{?I5eGYPrEpFh*ARx;c zEeRzOa8f2UnQ&7lh0UADOQ><190euHkO7GjWG7&WOCG`xktG+n|BB_Jc&hrTVoPYh((-Nc$s){KoRvcvUR~I}s9fNfHO}J8L0*hQJ<$!n+qQ9)Nf_ zVxs=7z4T!2FE)gzf496*^?fR=;)&G(IJA#Y=@#Xv_+Z~UA*3VJE42N0Fl-`|Nce{o zhcQ_RA`R9p!}rV1RW#54p3kwA*hUhbhAr!{G>Myqk0I$Bg|ASsx9}2?aTFX z*99VeiFMOHV>Bp>$(2LG)e?+Y3>b}2If60#LMmRn^KJk!VdHn!4PxA^Rn5HIV>wK=dj{GWYJ}@bZ@iD0MjBeVOIzeoFYdo8O#p)ALdWN~Ap3 zUqonhGWf7KE0sI{2q;v=7a#J}sJ!Rw%$*fCZp^CU&0 z&~pV}Aw&e!g+iVtmS8feP#_W>N4m}MIA1Un|2M0KV5>PeJPLIrp#JJ_wXTpeUtW*$ z8_c|sw6U3Yw<|WH$I_)<4M_StNj{=Kdw5^|Utu&|S#*;3jrBMk3Kn)wBy`jG?DZa5 zquxbHG#aJYOM%ra+*%$+Vb+)XsCkX`vONUr98&$4oQvOVRNGPT-$_wYG~i|uM)X7_ z%L66oFTnei)JbUQ0S{LaE1ZE=2nhEco%FeST zkf0H@S{`l7A4ctPFdnEdI-o(!nyd4cFZM4h@upt?5-54HbN%X!zW+b{hw)hcum9nJ zI}`A1XV)tmd@#6ok%0-Je0X0Oq}W;c*xBNdc1MZdz!?I3a+cxrci56^dusM%a67DK z`hRKT=#7;V2h1BA=G77%Kj9rNgPv67%u$8O0yNxJW$c!O0?xUH+f7TUd88ill(w=Q~EQSNqw4xMpoa!CnuwDI6&81ZrctlNe0}X^)ixl!H-HRnY>0Ju*vPQNVrB~rKWI+PdBvpX zg;rSff=R2UUQ|E$*x4hPy7`(f0PWwCcc+0J$z@Erc3~OoxUw!}G<7>Z35BwmJ0%es z5=PHQ$NQ}$*z-rDIR2t5hWaiW<9=^fIC1MHplttEvHYz%n7Avopg|X07*D=+&n&k; zzMJmtxA@y{yZ}F`_71`O@d?4u%tOvueULSEez!(2B~+31?0N><)eg{0VzD@a&;))9 zA#UTu4q1fN4hVx$dz414pof?l11Zp7^T%i!&vv7f>7F}~R|Al$$MDv(R5!_ptXs|H zK>m&(%3=D%zHZ}eM3xbp*-0>Mg5_#94{Z8IPO6~!UYV7+$cH49cFWpJH#B#;JOgAT zg@8@I=tCBpjCNx-yUbulBPCQNe!FY`7)hciS+HB6s7)7fHG3L<&P1VDPi`pv8cvkhP{S5)Z?dzwuvERu9G6bIh51n($Kh)N`l(PoF_1vLu)%Sk zJ)b`KCx{?T)Min?w707|$qPEKY?Ck^{2}qd9?F(1%H9ipY9dQN+7R&Kb@u~krP3+t zY={jXviIb_67La-%=1>wH{uf(c8C2KObd9^aySoMp?(P!Yf(3U!Sb&2=f(8o?!QF#9 z1P$&Gf@_dq?>_h5r@lX56~!Nhs+rl--K$rxo_X@__Z>*r!dIDOtMNPA83$g61R}zl z?!8;+eD0>i!qrXTCJXn2#<(b$jCE&db7$p&ZO|scdjgONkUAx%GofP2_W z0rVnNYN4}&b1;8O?Akjbl-lyKewY*8A2JQMhW;ebz; z%m@*5cn*}J7+(tHft@at@4v652i=sB76MyM0U7BDEehG{-){Pe6&T@Udb52N=m-$l z{M{>3GNFQK4~e)4AK?N0rd4{n>u~ks_dYh|@~dKmv_&DGuK+w)fXrF=uf$G-syT4>hg}eh-s<-_b$UN=1QFm%^WxHAe;p#=BI0%KZi3G!&U;`1+asE+xuL$*2ta zE99Ug4#03Vadg;)wBM!9wxOtyVYr8-s5jcH&+{dDsX3j(tsXka4D$T0r2rDg_({Ab zRNa?jHIM^h-%`6e-4pml%zDCF<9;?fRksogxD;suf<6kF;I<*$p?-TB4)AI60ZK4l(2m)RheGia$6Wo1*c=%>8RqGw8W zpjlumC)ApJl;R&m`aEEIsy*qZUBS%i?NMP*l++B8;r9}OH|B!;lLEgp*W~vIW$A@yCFQN{g<}vOoCT(Ah2hHt#5KSTg226 zA5-*0r%0z@{kvU}X0qYs-3)PXQSyq2^E7Qa-kI+2K%SS<&m4L9~9!*0HdWT6rTF+eo_(^Ebk?Q zfSJZ>uHg+?c#jhkDi6nSA%JPVwu%_)NHJUBQuxG4$-cU0rT2F15931XhI@Tst7+y5{)Sysl^ z?4DG=_7TSKoO}UbIE4Y2I7z6DBma8jmv&PJhBmJaFKZ2DpqV;kk-#+d$@m!olXP zH4)NZQ2D!&ZLZ__VuqSXVkxs1*321hwTUu5<(M6jjKb%I4ppb5Yqq}Y*ASg@;8?)? zMY54@+^^**UyyYhYEjC}1<5_Q_|X0s!bG-jzafn4!3w2@ktPiJ3Z&);Xv$rs!l0g7 zZSbuyf5_K=?b3Xy3MSG7F48+>I}lrC6A{}YGVpQ^SDovGWrDTF?QEy7dIby|cs>re zhKmrH(rx{~92n6%Aa0bI4BbIgsTcX}_`u&X5Bqtr^V z%9FKpX`0wG9A}t8Xrtu=3J8X`fH7m&;IDZC?Jq&gghDTC=Am@DdI!pP-d|`S5s6m0 z-?f3>x}5Z?^b{2`1Q;hA!q&8|9%S9t(V&ND;LSQ?*@93D@#w?LqtrclyEqo1lbxm> z5!hwfByVIt5hc@V@R!P1rZw7iM%WlnS_0>(5tA@Lb-MrvG}{FhGD|qd^YLSIHh9}K zeXTPCaTF+8`)JcdPaK3KixdPO?dTE}Co z*&U8`H6ZVOfGx|zSFGGo_(WqrgOQHAEIN~|Kr?Tp#m!k?q+y*&@9I22+F7Re9d2V3 zfHlA^2?}1f0QuM?moBmK!`s;157DQ$bL6PFDZ%cqklOx`la)#U+4S#68BMR9gaE!& zqc|=_#|5$W69L(Dz`4k$M?%{w|JD-teGrCiU_#R_<9P_v4tN*znc|A?z<%BW`}zIf z{p$b|Ddb%6)0jfS_Fr5rpO;LJ#jt!zy$(2WTEknSto& z8TbK!<~gF33r{d4-x4g72@faffskEh$7rr(deFnvAedpj&|MLpLN2wEA9k~2%D zxjxkOv9|4#hv{Ri9i(#nQr!_-ZMBcb14V}AZtXe3r6AEc*{a33QG=sb5K{_EB(#8> zSz?w;#SvNIDDueu5qzw))1J~=T?8wkwffwMKu0gyEG*%!1ICc&4=MV0DpW$%Fez4W zDFM(a=P*}dYPkvt_;1qnrG3DA2B*i6iO>+cdDMl`X|IaFeLCs*L3a*P#h^cn4j)&t zWT7{EXL{DgoytR=kz})&8`K(O8fvCulv{Q1c|V<|tx=6*@IF~a?ex>Qo3=Y7JiFTy zsWr=RcuD(n5RKBODAT2LBq=-H&5^Wy_BuJrA9tg-CR>z9hnSeL?eu;TiisMQiJ@eA z95$Ql>*@O6^c4eB(CM0NDsGbp{Xa*NZMY~1o^jFaq5P2_|Dupm*@Dh+Ax~-oeab(q*Jvp z-UWJHkhf*Z2CNl`I?ps-<4`&zo>A=So35ohjy$IC-8MQ; zFv}liv(4)Jv_MTSdGVn01i9*Nzjte)cN}0;J~C&~ zYctSiW#_?19`gM!I_L=HfiVF6&n1jD3q&y>R}DYW;U2-@QTT#()&J!%)(nV{R~Wm8 zbIT|52j=N~Tut?zJ8jAoA`XijdLbQqpk$9>OqWioCiJYH-?-OhJ@E*QSbHu`KMI>$ z?u3>IN05w6x-RiEm@NBjnUl1gP1$oCmDvzoujyMQ*8XHIAfEZNYvQc^A@S+blX0PQ zwx`7P&a#vOqJouFzj-yiN*SpJ0G^StacLMlp>YAEUy@NOA>O_ixk6IJ zp)O}`fa{}OTZKQQ(u6GvFUCAO2@~mv?uKp2a?X}vLU5sTw9muv{xT~GOlVHB-=Laa zxQtXC04@Iv+?wJ5VN3%|f>k<(lCY-Ny?IN@p4W#9Nr2^hs^kr<)gMF*7(ra!4S&mi zH}GJtZt+i~!n~bVGXWyiL%wJ* zS?0yM{Hk-H)iL%htK+`5#(M{dTXC3*1jfOk(kNJ%T?5qIv(nW4XBo88-MW10FXK+Q zs-T2g@`Bf^yuEXAk!DT4@ zBX7q2Xr#gMGH6cyLMggH>6p;g;M@r{tCVYxQRKT!!(LeLI-NO}%hR7MxYH7mv$cuv z!OEi@a+or#XtS?aR4g=!eF!qqZFxW^S$!5#=(=XOWVS^AFwvINEe2?o8fiZ@5Km z(&Phi039MqSPZH8F2YhpNK%B~e(eEEOg?RBAuSn5^Z%eyG%Z2#2_x^v7aRzMWY`57mU~n_KL$`v(o`)Ep z6A!f&*lC5}V zmgyTTr6;Rk3GV@iO2hbw%Bl87KwvrzTJE~KKo#dL3@ThT0!)7BqESN%X{|h3hJ%L%?`1_|9V*;|pPuU*!^u&Xn{B9XfVnX{NXIs@eyz4oHv+Htmu zbc-% ziNj{LSjR;ub!u33hLV*a%o!_%s-rpAI#JD{%?h=_lPPt<_)U> zgr8y`C8-tJop=S9HHyFUtFBLoiUwU=8(;pIOUbp}7bYBYH|>1&^GCE!H(yLonq#Yq zhWiYoEy<0Kr!A>mk}QNZn{wvL;CdAGEt;;_PW4dU+dj`E2AdvSyaKXK|5S1U0XrwN zTs@9plOu!&pg^E(oj$^0VxA5Z2;Ow)c+MSBjVjW=&7PM?0anqftDm&DRRE)i!GWb{ zD4p_(R=OF<`Wr^=s}*pk!6jaZY-<+uw>awFtoMPrHv|&&L3{cH^V9E474uBbekkK_ z3D>}3yt#fN>K>d2$vyq%g_@X9LHbdI$CF{dI|PcP;1%y{Ds#07hRZE>zxzS+xc)@3 zr!jT)X7945lJBMJ z`R)4a(?f|!<>2mQm zbpC1^XA5vphrp-_9(lGz5B*Ey55B+A2a$VD+EKW^cc5TtjXgRGUIuU)1=1GDD7@3+ zG>*OMmQdo(ptI0#0JLJ4<8Hm!5@2#ZX4nAMnHbqSd@nI zRrhxHcUoKVDW%J%JCTq&pXFp@Ma6jh7)1;NHmh!TWq50WA4>AwzhV(8&=X2pHG}+X zhn)ZXc>ZzO;<_5vd1H?5cMd%ksi}pNDH3d^82HP#wYydobgoQb)*aF<<=<=`v#PBa zA5i4JYN9;M85^dK}1RT9S=Pr7U|W+q0sBjKzR-pR*)+M7M24I&8{PF1r}DMRxzhHB$&SW ze31x^3&2uM!n{OWWh7`sTjn9py->fAvhVGBBrJ^lygY!$pZwc(OZe<5J1A0==&pN= zrTLu(p=HExQjMSiyYIEMgatt|kI}cQ@{g*7^fQQ{$JP>_>hd`7YsNiiJIdbUUF3Oe z7tbuEecm}{)>RN-Dc3>$YKF>zW-Wyi@U)xq-HCyl@ZB}1!6z3%(7E%_PvJ^<;$_hH z5VEss3hKoIe~Xf4s|DrWOzN*C*L$$z+#Q%wGG-gx|MInO>Z;;^#ahS)YgZd|%(bgCR5^S%-(sAKsb3n$k3yBp^v1o)nSnOw1ypj; zkG`Y_2-7IrykD)ok(=~AY54wfP$Zj?MOq==*_=q6>?NP6K3XC6mslYJQI%4J>*TsA zok|d3NalP`@?*Zv6U!6n;k;VJyTSdN9qb|%R=7oAC(s&@%inuEH~hPvLY5ApCvcsM}B@xFg`}u$rT>cyVa|s-L0`buSl>JSS#6CMG@7-pQXO zu9-zWeh0Y3NgRE6sjJN+B{_u`UZT)FkXb`N#$~;F0c%duGet6}&O@%9{`AwUruG#l z0F$mpN?doq^<`<(^#%o#1RH6eH2$=KRO5O>O@!-?& z$Ws;1t4}Y_ljl_}sFJIyv$+lRao7QqL$8OqH@N2sy8+`INM|~ldH9Lpw?G7oM6X|@ zPcH}Ss`Orh$YeYjb<&VKLu*!;dpdYSnyx`^P8Y6{cxO^8%HeLA=#x2te~~v}HP!3~ zEnm(ze)7trMB`2KMfiM%iP0nl>#vlC?3Um`BmsEST+tuEFh>Zp0J|?y6ruoak{<#@ zd~W#9H+e@}-`(iTNEdrRAV|p9v%T0XLU~oidVMzt3Or+XCSuY3K0k0}c))>>U1kFK zyV4M7D>2QSd6;F&+D;!PGl8P2F6p_>NJ%JVzghPQAQP&^cvZ02NQSvOU zeLO#W*%E|Kz}*rIZ8VY><~vQqRmn=g9f?^F%8ua z2sA((aB}MQC}I%tEt@t@`)|J~99DgORCrB(p?&trcrh}je_Fk;eGs|`nKn%Nb@>oE zxT0cnpu6zE392ZK58>_XLZ=}Zio#BQ;z7xOPUJWb^b@^M<~ZNtKzfa(jCd82y>xLY z+)8tB1TG7;U?3XmpxR)=84Zc7g!xe|;D*D|!s@MzsNEw!T@}6beU>}fF$l|;WpADl z`E$Enk;km?6D0xEJM?=_c5kbDmldlIh%X=Rvf9ieUO`B&*e@bbuYcAPP3|`X3pL-5 z@)GaB{+ow`svQxXa{t`L7J7KWYxPOWe~nH4K^h+%YBzk~qZ@ zLv98dK?rEAPX6VPpR<6_V%1lWa+EPtg`^Y=wd!1#0dR5}CWT^cV+Q~VAAWv19{EmGy7`vet6CvV{{rS(I z@8;T`{mVq@#)Fyl>z`(>+u5G_b#G9zy;=N^f4=9Gd`m}$WtO6b=6?ibctV$S(HaB= zTDM2Zhp>|Q=#OaZ(01#=q=a!$B+z^?c7#xk0L(|vZ))H5Lh>w4!S`{%vI8tVyOI~K z-AFdSLm|Hk=XV@wk`oKS0&(mfwj|97JqN2|4VU8{R`>nB^8d||d{(jE0YM9g^e&+` z#FnT$+Lt4kq&Ccty|YHsE&K+cM54-Jbno+w_Eq+(@F35!#>1nOd&@YGZyjS(Eyj`=1>BBu}@8CZFgf1rHO|dHvl2~>^VS+4#30-<5 z4XW6gD6cs$?%>;ye0@gh9KoQ3B#HIhU9n))dU?v89me@RDbZv6=Y0?d-beuEIwFo1 zixPrpiOdv+-J`MZaS>kuoYmuivxXBXjQ8BT--M`s#T7o}IAXNx{;5K{y zd>*+0AIonoA?36C|FjUleIZ&1vG{+q5a4@A-H1Id0$%+n4)wpfQ5f{=zd{J|4G^So zbOx;iPzXdCBwiCoP~*<@h9^Iv(jXjyiEYUH8We+DEQ4k^w#|mNtT~ro-~7-neh( zG|7vVtrZcC3|lZ)C0p=M3E6)IgNkapHlZWClqqbRf^;70l90a~{XRYj3<__oa4!wP zf$y|gQY<)IJ5R+jtuff2qbhfZhc(9CjwT=+!ds#W<+!dAX2f5VSxUYE#W0sgsVd@I zx!`y;s|NxJ6j!ll zL&0XFOL&eY@lm1&_G9bzr?q-`lpj9E?!f(ADRRe+{_f)>6&xw^!&3r1M;|-S8Z{;> zGVS`tnLuk~Rzvv@h8dH36;GsIla{88h#*v`1z7kL+inz!G&3?qq!xht6GBSl<{}?9SWCY>rnOf=e zu6{=vf)5BQ2VgM-cO#`{kKTgn^8K8$<_5~GZ9t|oFP-x*x4A;T(0U&;!!v|@zh5#= zv3aNC?l>PGA_{br4@FqQ$y=u1a&Ol%Ge9QJz=!tRurH!r5QiNPzL4b=( zL`Lt>@yg$>#W_d+AR!F_U{$=+t~&7O@<`}LQIR1MCDv(_v(jx^C6VcivOb5~3a6)o zC>p{a=L(`s(Kb-DlB$_y94D~AD#C}iNnCXx%w}kpPD5%nNpJo{97&omnX33sqs?^E zbf&i_I3F#!?2h!hH%jYKyk|IJ5s}+9XR*uOkqUa~FeO z)N(Vhtf+OkEpKOusI-o+TmO*5PfD9Y_C45^2wjS`ZG$*8F zeC=>{q&<#sd1~eg=6(g*#^w$ZL`6nfp2!uX-EMEUGQWjvP zBqUXv2Thqm7(HqOgv>0m7c_9>x5+D%$m+f?IZQL^Nb*s~p$rJ$jS+j<#x)yLvJ|3z zWcX2pv0}hi`#S2>UFI_Ve?oBIYc} z0OGo7x~H1 ze@Z^(W!n1+Xtv%M2mr$2^JfZ#k^JMnF`7-+_YE|l5gdcn|0JX!$ufquJVWC3D0*XT zoHAKf`{j&D7{@~RRe{WtgyHbrm8N%n40laN9tUlD?S(syfz7+e_}@fU$i{zcRQA?e zTDtxasNCMjQEn3jWXr;?DkGL*NoO2av)ehgu0wnbqL#C?45De_VmN1wY6S8hecKQ~ z?;!fkcYN{CtJJY8Zh$`78hex`MHX?Spc`neAYc{N;AbkRp9ZuHC&G9$Ko#ij2u=1x zM{@u}ONJFMdExE`eLd9sXn4*xw#O_-P~n7$jjhJ>ENmbFqT|`(Q$Vx#!isEN&wI!+ zh$1+$NfqZAVevi$m6q?u~ukU#~1JaR|vG-XBs$e^g4!2XHLUNq?#Tc!d772eR7v zns!cI#3wHnY?D%idtM-^?H7i9Y1iGViQW3aa36pfgyu?{A<4ARJr9E9QXKck|K^NP zFP1hW^64@oM$*o0QRB4Pam??~f}zPXHFFV15(49&j`wvgnk2KJSm6JXL3*t&Pr|IsxW#_ z^y-J4(Ze8$uqdxc^V4&B)aPbr?&w366`Hkk33^m0p4amE11Y#DFnU& z#~7ZV%>?>DxZUO|7cKPB`w8B!EH1xV0#UyCfPxNcoO|0-M8q%e@iY>34au`I4eN%h z?x74k_TKzlOAfIII~%UVmXx*;#_x1Kot(Jz=j|VCWuFvIcn+MXoFVL+=J6T)BQ!K| z{YgxH%J^S)pol*llXzsg zCM-KBBAbBP_HB^x7wB1)zC%*bC2s_uww(V62Ono}o2lc-c)U89-!1+>emmLL?DRKK zr%twC6{{oWMDC(*AOGGBH< zVS}JiHgwq0w2)$FE}+<7D`O7snT0n8mP7(GPSVvTd|wYTLne9Tzktwh35&#mLS=pF zumkCOm+#vp(K97tk+jXYwRgvl3pIee_N$Fv`SlaJ zmq{R3i3!IAu(g_~qBa`8V$y=xH5uP~h`ii3H!|5)c|u#@FQ7s5qq&y(bqI3}l;7er zZL6xy$j^kz=st&&tU=`E2ghi4WO{BtsNL1St>OCi-JEaZbJQ^ZFNIzwtH=Sg7H6}n zk#CmCZeZ3_&S1_rw-?0Hr{h4#XV*P%F`FW7YE}<_xiR8>{2{Q(qZT}&SgTkO{74F# z4N~W&1Y~43)qsp_@(JILeTsLu>$@`L8a&cLCT(A10@t8#ij3AN?SzGP1VlIxVNYb* z9Kq!!{nYr!dcdsdM26spJ4GRpk^-#j-)_8vS`poPiqWO;$~87JT~Jzw2GzN!Cp(g@ z=4UjC*+5Me0#OGI8lE}YIGk}=!x9r(P}eV?`(s9$(1}xRW3*dYhhHaEl=N8UEK`OP z`r`WsSU?W&hrjFtmgto8g*Accu(~CMvif2yx=h|BAL~3{BR?>6f$N(uSNC~Diy*_7}!eem!aq+ zVCfhlrsjV+%)Ww1zSQ$(nx55y=qHo=Hm+EHb2O2aKeq#Wtfky4NKV~BpQhQ95y-4+ zb!Bq1N#mf=oVyCe|gjj`IO+$9NH0iajc2k-S)$BSya4Cf%;K|<< zSxWlvBAF=f{KZ#s>2*VdQd%3|w-JwIGIBV9m5p|0(*!3w$TCurDuW1woyVjAtD2HR z-43|J^K?JH(3=oeiZ#eOd*e(RV{?04 zd>hcZytx}2`v}AAW}!%zpg^`Dk|zF9Q;|5HeNz0B%g11Zhp}%Fk%!j{>^5d;M~Dra z=c>2GL`W%EWkEZF_DYZ@H8nEy-M+NwLT5)nXyGQa6Fo2kzXN0rAO~FeE}&O$O0b+R z>=Q}$zrA`Wwq#~Hu0xmb?sCf6*w<|QH;LbTBu}%8uR&W@OhiF! zl{(K}c;F_Wd3M8Iou8B0(!tU1*@H0Dd)^dMpT)LA4jEdLxkA-~LFGgEs*x#hZG;ig z`Jvrc2_l+?F}MM}@kpAgsG>kn1+g#hrUgP#tO)%r=HOnyaic9U)DjuiQC2K=b&*;# z`&;@nP(b_D$@4P$iASZWle0XnSR)Be@^p7dO?wSe$z8J}B5sZ#^(yq>AabMKksFBT z*pdS(xtIcHM`{b(2{}qqOXa=f5cJ$UnJplH_Y1$F=o z{DTD?f%Z*^CH2WsCQ&w^aZ;xxk2kNWzj^PFLBT%}uDVEJ>gnHRtYnx0bme{1y|PlP z))-}Z{o`>9aaNo%%K^nL?^=LRX|ui=iQ_Rap>RpNuKIb2scePb*GeX}QVdI1=`);W zvEKpAiZ>{aC|%9hEm5PGNFfEQB1mW1DF&hvOJG6Y9ZS?IxNH_)2M8Pv zg=0q?M&x44RdnEWlE7KO`(hrW<(=qWj#6AHDhKkY^)Y31qaS>;{yUTy9Hyfno-1Yq z_i_Z>G#P**J${_qkx^fIdjM!R;+e}seLsLKsUoyE%Hw^5PfT!0XCmTNkeYbTRT)AJ zm%B5qzOSB=2X)gpPpX=7t0fJc+F`+t@uFbE(je%-Inc@2Q^MY6SxNxN#Y&>TwTd3C zj8p`W<3K|OctXPh$OVB&qk&g93gMQe&7=ka9ir8k5tfF1)a9#9c@~`-GaCoh}10T9Zofz-BfYxun?}ifu_Wn5|Ww%U8&^FrBbWkTZ|)9%TX> z7dEf>OE%N>BNunAyFOusQ3erHIUZe@0vx_50#0G0I^3fwI3L0$xo`8OvfOlh0w5PrNG4+Xn07Cp=nB@R}vqOj0&$227XieuNl{~^Cy+% z6qh-lUg5X{bGJM514qS>!p;CA!;+d$-#68$Y`Ovp}22;xG7(EF#;m`a`XLr~?$z@KrMOHn`nBe2ho z%xMg-ioT_lOH4d9nwG!`ieOVtc(AfY;^<2|^&vtT# z+dL*f)d)A!Uq)^?grmjJgt^tV()x1QWIv*wFqa{zx zr>Xw(ea9$qc?cMyQ!jrhev_sz;*)%!06N_QrXxK1X&FJ0qo~;}Ff*q!r2LYCC8t4z zgeTXJvbmslvd*nsaUsrg6-u3@XbFpK-P$)Ip;hQjiLp|l1kP(CCb_)o*FxY!e=W4o zSi6?oz*ZkMG;5G2>Lgkiq7 z^fJ)$g_zZmt;YKdW~go@69Svf*|rBsz@M9#wnOVFItqJ}HKo>KN(z_u{TmR*W5B&# zWqQ$Y4$p6*4WudMWcVSiMy5sDrUzF?PjcaHN<}ppi&E#Ru_{Mi~V0rsTq$Nd95El>7#&?0_ ztZgbs(W3ggBZO%qtM1c)?P4xjP@qSl8!Xvg z(k!OC!d_CrITl9ra-DGRNI54uvs^5lnnRwnT9!McS;|A9f2)ojqnxw{XqKW*mZpjF z1cgciZsIRleY=%DqO=-I=ynl8B*aY&wuezO654^2=dxJ>bKE{2u}--$fOR(}#%)Ug=1Azh*>+KY)AO}w!+k?5 zss6}SH;2ansq!;1b75N)pmG6M0q{kF(^`Tx(*nm|h55@MvOeI5 zR4i2$#F!Mtc$e*fexYnsd{^Q+)U5C=ciaCnX_CF98{k$4lf7|G&mXg^95|umU1nm6 zu#Qo^8I4=wwk|${SElE4uWs>gbaqtW($FtVBoVoYs zt^`5MPhd@}zxmd6)Y-Lc(gFV{?YJmQUj&zke&>g)`grQa4~7= zI|}ZVh&8ThUB`sJ00`UDkH(HXdg_>ZurkiPlY-YYzyRAinAdF5%2#o$%7Q^&9uH_% zhus*q{YKX3kpwO;hDUE`Xqa2V`S4^JoMOE!9Z!$jbmw^3HM`m%>qc?5Ead=wm$0!~ zd0aYeJwC;$nmo9Vh5c5z%T}3LjSgGuajR|glbDYLgQZ(Mh7 z-12K{J7?RJDG?pSA%3MT8hPm>VlFp^`xZ$Y^EC@%y-jBg>kSfPa=(XIQ_Czh+iAFb8}I(J%+W8bnnTHVULcY(Mb zOB#egMmWKd;JhHSg5_Q)y3_~mvZ(PfyY=5#)SJpVFf5OanY+r2tI0VYGFf-Y}>~vz}=vgzm3>9$P|IiY&xXWc!n9>Fdi#(*Q#uNM@sX=NZZd zIB6SeHy_&y3}Z4~%N|YiR>(%idLeKmeB0U~+AeTvz3<&*bNyu7_Fr&6+%Y&E2ap_g z`#pGRh#+|&Q;u7~E%5QP;f&VU5(!zQmN69YI^<>X6x(Uc*m-i`x@v@`f!hiUKjrHl zY`?G<5nxf%NKJ@EW6_hId~ROE#)wWW!Bx)ok0~HJN#-gIiV(Dq!Ga)qEOe{yX;=l$ zPm}PpQZf>Rwr10k8V7Z{q4t<)Y5D%o3 z$qyO9+#efG?I`n@!jZXsau+wPhB+X%R8id(B&OkA4d))Xyx-YbBHnrNe&3sl$4#l( z{jHu4^UUs--LB2_yH^Gi9nIWUgB!X=Nr*HhtsT#B_iz(*r7aG*duFCsEch4&o8b(W zA&pj?k z#mR~5p(O}kP?f0M&-a5fMFfxY&xp*)8!D=fw@n<0MvEJgKzIKkB|g&IuzgHUk(!$n z6#N4VE$VW36&4wcj3BOZETOGn!F-~;nO18|vf8-}SS4lWP}nRvM<+Ll(-9#jIbw1B zD*YsQFqs2WPaw(S>|zO|0F0BNFdO!M-==VI4CGFTve$*Ed{6vY2527qIq|>d!H$-X z|1=NIr#%13+T5Y3sAJvd{M}JHAXa4)Nm@QFB}pUFAO&=@GBh7U!&!S9`<>4m8rG3nm=|?5f?V@ z$pp)V0PKti!q;c2{0-i@u>_u~MzG`KT82eFdBYGon_@&2T0(7PM5iI*`KtgDE@g0j z!y(W6NUAF4*K6yd!g_ymGikv<;7k87`lCG@Iv|y(Hi~Fk3}J7yxilAZNqgDA^pI>Q zq>CKGq%usqFJzd1UvQI-!ePqoJFnDKbT;=vg)1WnZ(qke+b`RNCy94wVwcursFn+gkRo{Yc8Rz4*kTB zso8aj*)t5bdl}Y$#X=q3=;DJ?Q}-99EM}KBw`T`g1fge%xQ{PF>SS$*l2%iPPeBgn zRIbsnn3fgPchu2P*w9i5)FmWoYpfh%zGmJ$%s%LL3iXI^OD=Ix#q=#9P^#fg%~<)~ z(-X3^Ffwq_NYlu0W#?g8G(F_x6^2-~X6VO%y{PirjFoeLk|PP0MTEdcgq%wBxOT}Q z32MB1XL?E&84^woG>_3ZX$oi5RyVz@NcLB)lTwB0F#hD^wks$6{b`B)x81Z*@}ksz^-04X8+r z>bOq8b;@UkSo+HKr-+*OSXiMkvA4ma*^$&XeS~g;wdEk;rm~b62vIW!CNhr)%OaxN zM732*@)P}70y2@ON{|Sas}3@>JQ8%3ghWazFM8qOIMZ5Xsk$w%3Jh7f3eY2q!P_%~ z0pidL?LeC@C3Z+U7<%cVzm+t|S63NO?lbv@apc-}-sb7xOTph6WYuR{8epA~q=QmU z)$k;tf`!LL`C;LZ18mD#2(@A0i7fd^=X(+w4Y3SQwDm>qCy*q!9q_yu#mH6}H}U7R zH5g((^xYMj@D-r68E=g>N|hqXI07+ERRq>{&8D8MGLo(MqYz18@@thM=B~!b2*XGS zMo{6cWyb)&4f}o*+0r1$xRn~8=pzIUZYfJoA6-q19 z@eO{HC8P_taNvcw+8|BQ}w{(j#uU?FP;Yk7wB?dpJHYiCg~IO)LlQ0OY><2d4b9}!ru zcl5);tm#BP4y%6Q>WR#P1Ye5#D>xpFf>}fqA9x!qkD`{%uI3;&s)hV5m7M^knn5{( za}{4xbuxVw1gZ4O)jpMxZ%EPZ;CA@{{5Mz=)v4-EVuB$aoY}ZX5S?jHHb=lcm%!L& zM`xojk(41MIdNm6;bf`zElMM{K()etu?Rz!7w~!y!qPLsgt~ZD9-(-XD6&?WLYq}# zhjU(O4t&pkxofKW+k7b1+r^)ZNkRUy9w{Z<$B{#G^99fFe$sVBirCnueVboE!~AQ< zqGw1iwue9T50CL-TN*Y8=R=djHZI>pko$GQ{b@x{(`X-lsrka>i?$T@zgy@K^CqZ5 zS)Np;lwGdwH{DwQVul8~{h2zfD~~COG?-TLDJKaEmetm%fMG1p`reeDVgCp`1=8y~ zq1QRD*EmgdoEUibgV1yegp;`iicCUMfX7WqvO(-Vm_5zsafMEIB(dWPXul|Yk4811 z{IFysNU}De|0IxGB5+6+_NfcTNlq#4l8*kQUShOJDb%x)fZQtKlg?Ysoiza=kFb&S zM#H_e8}$b;{ajI`j&K>3(b~gFh*`S^dP*Fs4*RPK^b1PGAauSjNF|v0o0zxat?GDLm&10RlP30UTrsLs0Yfi2O3CM)7ze4h@I%{^keKukKZR{ z67FqRiK}mRJ)g~Ag3RUL+xboYA5Ui)6<5==YusG|!3pl}1PQ@4xCVE3X9o!oB)Ge~ zySux)ySv+&Jn#C>4+ehptTnUgs=KMBQER2P>v=ZW#vLp~xJ4ZJH@_pp#uQQRsJ)W5bMz#)XSJfG=O|QVll);s@gq3T z>R|P`M8n6#x>?+=72e{yNO;uD0*o&)C zja+|&a1z2@sozeOEC3;vAuC?!sV|BP{){ll%}ffw_6#sJITsJeqRTE8$Cv|e-kX9ig~XLldvEZ z#G`K;^nz2;DJkbRc4olmn)o@86j^4BPTJj6c5Q2LLqY%`L#Tmp7u8cGDT3B!iBN@f z5S)@Hc`zj2^%-l*z%`s&G(cUgSV(-41cd@GNn$$I_JU`J387-=L93`u8JMf`8_*h? zK6q_8nqd`cW7{6ixEY`aDz`w`zffW1K?F33V1Fy2)(UcMviPmbVM?P6vpDCMsN!EQW@DnY%34g+)jnsoQm5 z^Y!zWqUIK&UZlk8ZR)~c7_|aH5>awGyHM1aRDDmVnVS$p&?3j+P;9x$cR!zWJgh^n z7+dG)5%%AZhi#5Ww2id5pE3-2Lin;d$SIHqFTMSj;lH*gDru&4y6SWc6&EoI8N{jq zP|t@$9YgIm&{th|Nmj5D40!QIPJL-m@YqB_yMbABhPr|wzmU)xBsy48G+&gQ{AfVC zVMS(Y9BW&c;|hP4^v}Kn!;_Y)1PEeBjuJ(#N%;rV`jxNegT)}Tq~A`oC5tP|7MFA% z=&v-vNl+ZdToH#t*1v@^0s0~_!2o*aQgJX^mso4*^H4eAI;b~n(LdcU0WXde3Ci;} z{YJVCw#D}T@>i-|SSlKi{=KkVFz7d_LwAqeHx}j`@F61Ztx6WEf6`6Gjy$)#9k5Kw zh7vT zkq-L2Wfrsm+ORrehX*EPkZ89g36l^g`~+u8w@!8gQKhtY`7A}yspc{z;HG$?=@6!P zHK^n4HgYe$XrY0hJTtv>`fKGi9T00L*bgm2@6BO5wArTxa=j&9QZv1u83$RLQwg{BJJQzJY=_)_#-PlOS|-ob zZBLO%d)4ss_3hhs_+D6GF%>mr>T|f%eJAWd z_|w1L`j~0nI{%4y_HPPkxBhqE%-aQfrxOV+V79JNEQ&HP7htO$MDTC3`md1&#Yj1D z3p+H*J3Jn}B~SV*Q3YYf-R;dy={s;QO(6xVWZohdh@uF#W(nFuR)-)rjfxobFdB%g zb_M`|9R`csmww4!?mv&rF~NP4VS(hHoq;j^iwdCUxH!qKZi$F*0XwG6ZXnVd7>u0O z8Tiat=xjxOLO<6X7-IoST>B$~!k+6c5ZCWq6r1z(Cy4A9hP+|BefR1?WV3zbA zxjS;25yaH>!rU1eGU6?fR0|vVGgb;i;u!fNCp*U;+X?U8SUsgZs%vUj25L(K?+b*C zi$%MBgu8z6O`8uTvaR4~kG9p#BpXiHT+}RzGo!dS%SX)Ar>AD8eTTTAy7Y7e3n8QcpO2P>l&eNpV|Q4nR(&e0zx zDl{lyQTb;nD(uLc%h@5zzU%-__ z40#EHc1`3gM7f4U3HSm%)>r6qjX{A%6MaW4>V7Tu@kL04Q-D+K-&s@0Hy>SHi&}vX zV?P@m`U}E$tV1XS&{>lqtFu41LQ8hH*;(SBUng21oL(p)_x?)m9WP1zVtK@LxE#P1 z!V7oW(te}X(8d0z^I=r2p#bH>gBEhsGPmclqM_&FpI*Ki-lKWmsQiU=sJUXTxl;6G z>HTHfm^@AYn)U{w4VPB>Wf9A&?$TILAkkfq${2->r?;ZBo0O;^72^=u~aH zOJG}g#qDw|HnZ)BRz{7u_w8@qaAK17Pgp_##_x^LMz<7#%6GH=$Ma?21j*0eN6r3A zftrB?mp%BDM;ZFbCq7UwxUMh~U{PS#s2D=zzyAG26bKgb11FsGUI^?Z9R8ot!eyEh z%zpx({Tl=dUH@CdD-8C}Xdw!hM2h>~pXb8Lb%Wmi`5m`4eZU`7Rw@MCFYvzbU6FVC z4$odUA28qGpW59TV5bt?SV}#k3_jQ?q3?Pg!9EdPf8F&Qd_d`W=!FXv`{cRl>EG}5 z&(nELu3Z7ZQ(=i;q?^QRe;y%WKUdcY$%rw!z93UyE_T zsXwB$*+^$v0uPS@Z z+cgwKVK!oQ*rN5e{tuzJB>_Sx@{i|%ke`18p*vJ?KurVjLi;43rh#4K|3fJLvHc%H z(P9WxmVI%#Apad=C|BX%l@VkZj* z-xn|fwGG%Dl(;2hTj2FTqZKgzyE78wkD61N<1Klr5VYy=ii)fQPAB_s2}Erq{<}3w z$^aSd$g7J>l*LwuK1V+Od=~&RTKAu>mm7r`AK_>pbrBzO{3W)z)pf1cJYjEQeA;d5 z&{VN=RDK=2eBcQHemx|H;G4Bi)Z=f&Yfi@8Ecb0H{A_(wc|l=q+4a;~1If7YEm{5t z%nyx5P2b|*QN7@x)cq(`F|?YlpNPUwi3vrz-{irR#N<8_uaS?WSA0lUm}HE2=BK`o z;dq#WpdbQGa0a)OVY`435foDXx5m-$@u($JHCWdW80RY9x6k2CodB5&aDsAxujbIs z;vm46YD+|6w6SjcR&sQs2R^lSI(xOQZfxM5=7@U{?)vEbFI4vg>r+j?@HWT?UyG%) zCGuo5AzYWmV&nneJ&}ABu#Tp_yaDwvol>~75b;y+5V)maV&wh0ujgUyro%B&Drbm=uVRmm?ZdVLa^X~cM?1Um- zlPR3y~qFf}co50>L+)Q&`?-3|PNVJ1L=H91&Ut6AFNvLylnBOZ?D zh!dm_MNJl7E{d#wVHGmrUO`_t!5;c%078hOQjv5hA4f0T!4lA2w)l@RMBb1*z^2^h z9E3;cR>HxG>o}9=#0~P+!0p7UWHVCjjW*rU4|`34gR2z<1D3>VGn`-T9|TO@D}j}c zL1-G${pfK|H0*8D1_`LcP#M0>|AT~0s5M;pLrpW=VE>F~NBgf}bIoubfF@!1wAlAw zKi3+40w^OLAZ;@`yn;^r{f*~IE#0TP4UUKIP07b#3Yau$1SQurjwQ^(3xE;%H#_XT zq2qb*c}Y_qE>z0e7O=_JXApDh3)u4OMHpDMS-?(LPnRgmdXD`#(dKp|i}pY1(Pj?^ zTk#8B2BDC{?a;RX5Ic)%6C^#ws5q_{P$*_x*(kLhpy0rGIIQ|#1MprEpBM>lj{o<#_& z#(#l!*!`_1tsCy_t4cf!km5yzz&!RLA?qC2wN+OK`inD%SmwYjFiFU>anEd0g8eN+hd z3+bQZkwfG&`v@!t>vk>H^g(4&`-{T+ivWUSZ@|D>a^jNKPjJG(h%~}?ol*$bt(;(@ z2)3giR@A6zkBfxP5n(G1j)Ew zWInio7Lp>Lg8Yh-QRF`$YI7$ENP;+E%=y3-pOARW7KmYfg@Fkr1om@CPr0VP< zlu-Ia2dVE#G%H<^7fUvSzkzVQM;6w!xXXcvKE=v!Ui>$&bEAfc4Q&NV)=N#Lc9)L* zbYFcX_v3l_L)2j_U)7hHas_b>~f-+y>-qfz; zMl4bGJBFDyN7%cYUYVZEdGPbkgw9XK5g(^xmlCd<644eR!Y~cL-~ouI;Qh|{J=`Ea z*~vXaUBrM}Kv?E51-FCNPa5V3(GT*I%gk~$wm(99oJ-s_8c>4%Q`2>M6mc6@>_EXd zbuHmg%ZL7~EM3?Vjn}ne+^LK=v{wlE?;&r0XCfDBU}D7DA39HEp~UT`YB3+|;PRcJZ>Vu0`}JamPqG}(;Q z(i1>@lRA&11yb2G2}`>_iCSQv)c(4=6HA~P6%U72kPaPG2NXhIw_SG0&*IXba$2T7 zUar{BQ=^bZmu$PcWvxzqK42!jOK7Qg7ncZ%kI_$5(E|Xq)a&Q<#lK!(C9Xn)+XWe& z_uFTW)Ufa?r};>js&0Z?4b0zWZkgOp5Ls1{W+Bn9R|abTJi6TvM3{a+1&jCcgRi{0 zxx8Olfi5t53?rGiiemCVk?++pF zaa(o%7PjTz0hT^A!nKpth3}B*DlDKo-nWC*kupZ4bLZEU^TTdW*O@P-%lRWaP&Mjx(j4O*tMt&GB(Tfx zy|M>dA)-f7cBhrqWov>$A@|9%7_ftybOVF^FohJ8$nz1M$bb%g!Z>Bl9@qr?3afB& zKTZy$++S?Xaox=E2mT0(AkK*(H{@KWPuM&FprJmR5_glabIlOmtvF4)B=8!&#J#EO z;NLOcAH@N1)VCdX3m$nKL<{a(?#ti9lybN3b~`*{7=zlaO7Ln^+Cvcd{C?M8@tsc|sD_;S$SzzA7#GiPRXvBVTpoZzzJ!S&YWy_;o zy?6d1O0BM}-Ek&q-!&%;O@BRXq-I>Wh2^FBMZW9qIajr%S*f!{7>v*+{acI z-M!FKFGLKEDx*b3b`|wvQo3r*kK}*N8gKP=pa;xH=;sS`_2oG7j<VotF{Hl}O6?78?V@3QTlmUV@An&ND;IjX){NT%$mpm~ch>6zM) z@aBc{yyESPS`kjsH>NXr@1MuNGu`Z&Jjs6lGHZ87a4V2yy?fvAaI-S^3cw`it3lH7<~n}NiYH|nt{2hm)Qn-#g4 zzv?caS=LDi&=r7?r zhW@_0-JbvbYR-UDP?(b4661-^Mg{%>d@3KxXaepD-&VCYZtoU0ftbO&J`o&jaPc@- zsjtzqq~5E%xe;1HxAs9I+kF!$@1le=Ok%XZJx`I87L#s;A>1&c%MI6DY;&GU%`%e8 za)&9G)t|tx_c?y~T;e1R-9n!zh@H!{HyCj}<_xTN10N4Sji3*m%1FZ5=V^rwk!I1^ zW|2X3!@DbeqKS%qfcX>!H&n2ozJP*mPq+nyWFhir=y)Wy^GzTH`l|~aUR9&3v9Ao@ zNeiW^2Ph78{$@%mpPw=lKWS}IJ7@6eqzq39NlQBa8sj&C#QI=>`>>733u4)yF2ylE zPFX(rb~eGJGkYuT&`|5W$ETy%P%b@vNrtyBu~22+NdAlkEHP>AM;lQ4>L2tlPG3Db z@V6f73SZ7_v*~ANULjbJQ;)PEcd}kAZna0fn#R7gupOBK4~_%++L=2Qd%*1GM=1rfwFU~e_QvonuBtBd ziePEmAPh+Y&+H#DV$Vq~_(8t5aNl(g#B9067fy-avky_KyT9s;EfVKO=7#0kG**Aw zyX*qP)SyrB6lbb&gJs*wq^m_&9NLfv;^+_@{dbw{PZ=O8UKxs-S5XCxI*d@0_UDua zD&dyQz}yx)eACu_-86N&IWD*s6l&EQ;gn;LHU=4i#{}ZCOt@}n(nrT>%1OMJJar#d z>j-o{jhtk7mNP(A^-DDap$K~Baj?J#p>i~U9%^#!wK8)*jo+w=o zygKJ=fro)y`_&$!Q@jV#8zS|HfV234K!fp$hpen%!${1hK2_dHTJS^iGCoO$1EuLz z&naji$R7W~q&?HWTGuw}4G$w2V@>&bVSzpkk8=Mi@tWOU(b+Lnr)xzPx`=9 z{J!1?4v-?_0adR^C~bzJC=a1>dMVi}0rM50T}wC?wFefSyXMkl9|%OO`Q4PbI?xf> z+xMWHMXk5%_f#P>L-bCw;V#&gnBD>J9``9ZMrOK0gqlpU;>DxgZ=)4fTbekUpiX(R z>4C5NiFjml_`(bq+C6s{8qSa_;x*%Kf`{fvH{fJ{TumvS&^Pdb-%ln)z_} zCpLUrIbf$l;hzwM*tbErNLFD=eI~rv6M>T7=@U~^3!gq#Oc9&R=M-0kf#mxY%1>K( zo_W?U3>}tJbg{T=&gCAGc{Z!r-264gWqIgjL5@a?nv?)rlfpl&cgC`_Jynq{n*~ZC zhr)b1%!-XXu?Lmn)hWmQ6=-5hwFDj)@(AjgMY;zP3aT!fQi?S3+Lfa%p*okUpYnoc~x%~CI z$QHLak+KDR;uh*TH{43;ecSRcjcSq6y!^=f55Wuke{DcDcTv$6Lz}7)akg3H z95V*^c`M|nRdK9io@gu7bs>gq#*;E>QkbGQiGhgiQ?0Iv31R` zC)A&`ISfX%O@FAeF}MJ@uKg2r&3}tcv>Qea%nxZfd7fqe^3yt$R}GDI_K6)xMCPK= zHm@&Bd}tCpx$XJ|70mSS@EM!OQ7#IV)+Vf=v%nR7Wayqx2*1iBiRZ#i{rN*4V{XR$2#jsH#Q*G zYYg&xiQ#&|{*~p5^b7ov6$Weo4NUoTyt2Wh!z^uanb_Qt$y>IJCUP3opoRk%D1ygZeIjN9WSzK#Gnc)`?6<}4F0&U=j7NPiB znFp*BQcsKv(#AJ8JK{9R*p+6WF!m2)HX%+{Spcj9=23C&a60#sGrNGf_!oB|>Y~lZ z$0=Qe{b~?+Tm8l?+?xq3YQc3mBmOBOWht{-P9*~hUrxccA+`f^9YAaK(ejc6%hLFGS|ejHMxzu82`b zu1^Mz+fB-S}AhI=z(W#RZrHRKjgl8E8r59ca z^bUk4G2r29hscbK~Ws5!EQeIM@p(r-ZKT_{kcNAys_)M}~0-K_BI%D{oI z!ope}<4M}gx>k;G=)&?Uv3qfeQK{1kL;G+~?<=C!*twQveZ`(~B}+}K>af5vt0#b* z#H+7p4R;y&-3k6%N#ofY*<`}|^P?*Jk<2sISmvNKk6gNplqx29LBbbd8(8kW*nJ_B z6^bIL0-O2)#J`ePc&8)L9R${mqWG$(L)8oS54CD9nH5`*ts5yhM5`2iqY2f%`k@As zom%X6e@sYOXT(hMxTmLtv%H;r(c*!l?rQpG0W1pXxp$wdDwl@eILEmhKPisx=07_X znN@@@C49+TAncARX6O7ah8*=GeS1-17!e-z!_eu{`10mCqD-+$WqCm&L~g{XbS&CK zNUUsQk^eJ?{IE@1%-F0?B{rv$*qAcB3qf@g#u<1@nL$lnA#p)6)7W3lnZI*@TpP|b z{2_@~yrtboG@K%ATG!}&4E!{o-$7&2h7Inro(3rOWqQ; z>n(R5zVcy?`%Mh9c?9hK1LAprV5yLxWl_N20IX-%nUzI3$c9$)*LAo{>df|coDnU5 z+nH2+Tex*SLAxW4J{%oy;h(m~vy)32-yrv=>XkA|N)@LuIx}f{i>%zt-w^pMO?N6I zq71hg9Ah-b&ATr|xgM-zUs57$Dr+1DJfAvdRK_L{L+b^sxSF|~&Y_Ed*IFmHXZOfo zMD-2M*{X;?I1hBn{3j!c^HubWB}2bSDGD?(=UT55#oBI3AnG3m;mgjW-)X1*nkh=G z&#`|is)ICssoDBixggL(bS!2FtIStAN0^8CpnTY`O;e@P8yekGSS|G0|N7a5N^Xn6 z8H?-v3rg{7xI)K1T=qFNDF0}~*%zTA!JSKq z(7rCtIohJl6Tx9TqIRIv7~!z6Hl{o0cm|a81f(xUu#_BWuhLS6El>tU{`d3@;h-K%i?tEkGp-{<->CP<4J;L9% zj!Wie%2uw=)1f3+fXzOlf#UkYN@**HlLcn_*wAjID2GMA_u6NlzJD-Jc1l1Q=vxUiU~p3tKW+Unv;oD?DsXre?oGVs>)JCSd zMJU&k$XZTM;(5pVEoQ5X=P2M+fB2OP&K{F1#os614^mTanW~pi_&S=$6n?ia`lM>V zOlj_95e>5|ije;JNhi2p$hK!L?w+!>^s|`%=&`TVq+qjFZ`7dq7wk%D*Pkeq;SLG) zy2Jr1OQxfwS)l8EXy$C`lm@#7O#(I}Q!{_Wu3kgvvh_?WEtKVT<#$G;8EB|gVW&Gp z`we7?M95MjM!Sz(#}zQ`t9YJo%zy5+l7iv?Fl@6yvXPB!bf%#ic$$5FAN_L+;@#nf zA>uY~A2fqx*=P){W32ve=r6qWRuF|fO82v$R)gPcD|9Jlq;?c_9gc1pFG+SZ+{`apc# zSuGKG*m|n3KMG^~ZQN^d5bN6_`_`dJV4A~|JNWW%4RIs6$UB?l} z&5s{{02;*U?N} z-jtXjoi~wlJKE{$yIb$FNzEF4;%z&7eZJ02D+Uo2Ly!M1@iRNvvkK>0YE7IoamW6? zF`09^JZ2&HejK*Bz$~b1a`eHfYZHHQ&_Ks)4cNx<2i=qXafciQ-UHqE8>wH)UZ4dW z+}=l&DwVFD1aABVvFu%jC(PULh%))8XVaTr}{ucZP_iKEw z=nAoBSa>~G*W)0wz_8jHkzuYMQvlQEMtKZ!qm7^AtG}2`v%PHlZ0_W5Tq&~jC|w}7 z3m6-(_bw4OcuBWRulY2)cE2W+7lF34deY?#S=0PL27j>r5%u~g%?oGC*C}%QTYsIX zhaX>BI!{FUsoSLBHN!IzEedgp-1|?lvHa~aMQXo+`A5G2yAdmX>+`gy0JEAXboju2 zZI6A;6^~uSNA zq6u%{8=iZ4csFU9xI77ES9VE;1 z=d%5VI}K&p3BG=@ebSGkH89BMn$kE&KE1p~R-U+RAF#Wf z>HzzT5&ucBNi#rAKHdk3<2B$?&Sd!9($mMwhtUx7YfN`dji85V=V)#L zv(bx(*!a^HW-G$CgKbz{W2aBrD1v(>L4s1ELQDQD%+E64bLSi>(;xEOHbY4cxvsn{ z1iu@o{)p&U`L?@Y9Q+EkdSAfP+66qq7v_M5yfY=-kLpf5b>c;>wH>+;>o^U5%>TGF zCwirC3Mj-VBdlb=5Hdl?sK~1zN(bt^3npi^Z3mfus*YETKh5dp+1{fEWFfkhp&Gco z4MAod4}GpMC8Uj4_@*(J(S<1zhxQV99cO_imuQ`Wehme@F<>Kmw^g`O+X0&Wg2E&Y z_&$)IzLPWy@gbD0LWxdHOc;>2nAPo;t+_d@BSo@gAGj2*`??q&B+Zj%~^iTM6eE!hT z5$W?nw!wO?kLYOmBKwRgSPjhR5tu^j_7rYwmt$2VZ2Ilg;*lTN^S$7Oo!TGB6ImN~ ztm_ckeR8G0fOx!kRl1y)KX+-vvN!|$&+y4zpU3VWmC;5dlA_0_1nuo$2*y{`Rg7lMD8=D90it2mc?O@5)5BpN0X41|Q@0|3(!` z?7|$hq=bQN6hD-?xTLq7;2rogoOkUDd0J8*L`x?loSme79y1jcdT`(A z_~khl7 zrN0GIW~T!$hQ7HQ_(e$S{J6_X3eW5K_|4c{WQ0o*X-@n82&&e>rj2uQLf9d7Umjf8%ZLqd+5;01&OPFnn*C^gp>t9F7eiEzpW^}lN0NN({pQg57}K=6i0(;xH`k9wr2)!j?d z)HLf?L+E>T#!1L|?9OHlI<;>~m9cQ${7PcdHO6}ra=Af{n)DkjbBtdWA`unZlhsP#V)C~ne_~i#x%mk@{+~q5H z4$h(j%8hD}3g;NbZA`(mJUp~hl&~77$@RA{c=AQPF_K&Gb2{7bagC@_j6ci`pN1IO zwC+4?4yt|r)a0Bj0C;ETne$gnJ(>+0sIRJrFKsZ=kvhfk?7Dw!OU2fI4{ene{gcy23sT01lQ`N*(_6CSuP+w;I~%geCFWwSC<*JfL9)Gq?od;Gjqo7bg_KKSyC={KMvN`2gnb0MXm@NPpEOmE>o&q zM-v7lfD@QZT4gS{InsMwL*aFq7`$fxQrn00-PiuY46Vh?c2z#bp;Ap*FoJkGRyMm& zkN4{M39y%J3)CsDjh&wFS=I|5NV76|LP;L8DbVUDbuarwzhN_344n{eGDfU@zc!MI zobDB-O>AVi4CM5{Roqj4pYUH&;ZFE0`7@fh)Q-7Jv*8e)xbKU}r}Ua4urq^>&Mvk6 zf>;Ix2s=vjQ8%tW0%-lkW0*9TGNO7$%W#szIX@yZCiTp8VosR#PU6z=99O3CaqQQ| zr2K91CP*keWZa{_{G%t>6F!Tsus)bVYBe)O9IsuO^T17yNg3gNrCRftPfoj^o7{wg zMgcjYVkYn#bA0hCjU}wSgX?hGN6e2u9<_E}C%*wI)2wYip=2-t?(7u~AaDS9{gfz;>)3EGH`15WgwwA6V%1>|3o8 zC~2zX1)%v9T3Dgt>1!lqxJjGJiBoc$=7YoJ5i0LlC9#WIqFDyj&ZWVSl?bk@T1@Es zFN6s3u2ZqEP3s~tz^_kK;!!P4b;GO8WXPqw3;ir=L_&yC-+*>{5~OJ>Xb+#9=#B%< zls8p%OE=`nQ}0DLS5525)3xRmJNz|OSG%TRKj3t1(Zi^t)H{!%zmQJxB1gP-dmV~w zHIgOD$NqYG>#xuzEM#046*Ux){*Y!WpSFSN`xsD8=9R~wTfXb6D9KFVjeT)l;}LOm zOWw{GTR~{$e#nc4LQNb}Z_%Wl5W8fH; zSL;(=S#UT}3-q-2$T_d2YE&F;YRBZ_~jGmrlzeSc-`t8{4 zLa3LzmYt~LmA}-<>4r09rIhqza)18arCy_0QkIQB?_5XyInlX{^p4X?gicb~*K&C? zPRUoF1{t@!)+?6?3+G3)y^l4W1i+%MJhH}=?*-;?wx(`m0Qc|jq`rM+Vw*g18N(KBpk0?9+$o<+)A#+=5r6_ImX9sZYf{t1NWZc zrwJQ@MuneXUZ`*nvE7GV*^Roiw{LcS0yo^~C5Mv@g7LaZf)Vyq?gBhbD8NgGQ)2V7 z!-;T^KjP2T9VsZ!42V+#LY|IMzalnR`7ERE&Fa@n^!a#^2SSJgCR1CWo0+q#?55%4 zNmpHri-dH^St$rfXY&XWNpCPE6F8GOl!JCdgI2hueT@^y-ei?NP|L ztuX5&rys(X^cW^w$>!ZiSX?#-(*jv)mM(4+*9G~(!0`Rb9JxP9ImlA1;llL!JAQ!4 zZs;>pF}Q42zDPZyzl5rEznh?w%a;e`xb1G+u6KRGLz0}A;(+Vu0Fscty?xzbrA&K? zIT!NWaji3I*$W3@)Or{e$<$En6~R8y&d@g8P8qI8l5tD2*b3lOlt5;YvQ{(eSSo5dwm4^WUJdam3ZVQc z>nUX+$5S(Xh{MP5Ft9FGywLTgVEvTS(4uHzDc~2QtmV~QjdDh*BB!6b+fTr4fKy$T znhUYBaMc8LqlE5=oLTJ&SwrX&KQXf+KV&P&6le~Tibqe$yU zjwpoeCH1$)Y^pdm0_JY2=EyJv;P$Fy$MosX#;~IWc&lZg3*^~nX`<3B526k2UDWi3 zvfQlXG#a!_fo-1lt6H9rI>kgvaiw>n=fLz|y@cJLa+lrRog)-)O}lW5o^ssVv_h8= z?>Ku~4wu#VU4SM0?&3b zp-rIUGZ6S)rY0ZpiB+DTdToT8GHno^FP-MJt2X%h_@mmJUz*~J9+?#Dx9@rEWK}I2 z2sp}OWJkqib^$$5l`zI|vebUKVeCKT#;Z9U9GiDtqT@=UdeoHhkEZ>qU=Jb8|h z2T9|}1G{O#cJH)pOl_?WgzY|%N&TGhXKr5lA{b^x6IhhYq!Vl>4k4t%(j?gYe{hd5 z`#t!Aj)W~KZP+0)xJXOS+9xv}cPyEs!(b&#;qwj$p*n_Y4?&V%COGLf_kaH>a@ybB(ZA!_lJP93N1hq)b%MS7hS zDVCBwXB_Me$-+$)oFei#Y`7FkOzl^(+^{%U10RiV3a z32D6irwjOGN;?caC>Ksl1*EPiSYAmT{nq1Mes4ZjZF+b_Bf`M>TutF#V(x*Or%Q~m zci1nlJg^!9MBTI^4`8d&TgTzjz4pDv9c-^Rdv>43HW>PCO$VIF0|a1gVaAC44gtJZ z#(aJFE|Cqmxy|-`^3RzrtT9Mw{75!g3C-L#0ONAhB!DfY=CoJULA?~9*?Y>eI4BbscFhaB;Q zu3Y~n$OmI(?Keh!uR0-gNw&s00`?v~Zlo;M@T4wa;;D=3G6vS#_$BIx%*{uKxA`OE zhGX!dA-VoK=0|Rdk+EyyWCdW#^x&so zux(bgrI05Z;Z~V2e>hWh%=z(hvZ)fd?2|s8obl5Xm({&8FxRj4az_+xad?il9w*0C z*sT4yEWVa@7_le4IlyrkSPyE9I{rPJBUY_!W2sRx7nYxLjmAJR)UZYBL3}@o3bDwX z+HSN0w?6D7Z>uO;K#9tm!0(N0%h}CD8O0*XvCHX4xC* zgYXZ+n>Yg&ixT|5Dg1b(%|(~!-RN|qW-yQ(3?P-sQp^UA5WOHA<2xH}E;6^+@J_pP<9@^+M&BgU( z3yvb&CN(`&GAkTWhgkk~YJ_T+FjC!63zYU9Aqm|9wI9+pGdhHD+Ot>GQsj zKX0Df)S2JH$6e>K0E?lzPs-7oL& z&aS2KEw5*nu>DP<;x`}=^3?Hpm+>6R_-ylvb~#O*L07zK&D(@#Z9%rS^}7+H6a#wS zQIds5F9Tg2r9t#I)rtl#J~yccb&IaO^OPH@ zsTprE zYKWgf`o+^)XpN)3uKq~gE}!(V*VTdD_}Dnh-?8#VqafA{FN6VT%X&S>9svgXri}Az z$1pND@7JfCXAcKXj9=#`e(GSYldB55h4Do*}3{ zgBw@c(Qk4%QeA-7NVgG7A#2urU!(H4GuqU%zi)ERH+PQBPz4>EWUE1@LDVY)+#nhQ zmEQiASiI69?%_4ErsM*nggyY~<2v#4&o#)V=>a*6U+F25H+8183bAg(vh7KDm~55V z`!a1%PQgiw+^KkmN_1z#R({ql@NFFS*fn?R>1e4uShc{Tevh?p9x=^i%z^t+%z_od zMQc2rfb(vFjh5T7OMt774*k&r{&o!A{HC<^)mr^6`IJ+OLCML_Hd6jS9PGyi$l)G= zEAhAFmy?&T%?S>>3oQ_UkH~4BSR2`W0M%XStbbbhqfP-LoVXiCk&{l95l*wD8-{z3 zs+7DU-~oKWCJt2HocR4yI$gVg=C#N`@wccOs*~#ljHtmXlF!;)llqo{5eZk_oO^4qTiG}QA{ zV`=dc(CLcnSCXlY43jtzvgYGW<(-~A*hQO@Qt|+VtQ&@Tw;yK4ccM(KUaG2zP047C zZKSK@?czJo&+j?PuYWA3EG0MUb}xEAU)1Gc&)?@!xwGftEn~#}ojv}mtP2}ob~%gv zQbRY+=7zEU#0=j{rC~6)7f16|l64BRqemZS-k-g~KC>?lk~m+v*(xuR=t0Y>x))Vv zD+@RYvF)|p9_l38Ug{^>9{Pl1Xer=hR)AWm{T;%f%1x{~=&uAryomi*gDNrJjW-wA zkA%6EMnkZ?@RvR4FUOD8jOhknaq8%ntOpW026yuD)He(cMVIr4bbUuURW#qJ7Daxz ziz4;ony_k$n1nTwJ}5yA>RtCC(*)l8Zd3qW$u5{O@{rt_1GCVpTw8>F8odGt<>M?N z_S;j!WA5;6E`bY!xEGVGt%e#97&yoSY3tHGgp9Tlty2@Hb|Y3cU0yKrS9;%9H0oQ* z>Z?@Fr8riWtf_;i2fYIQDt#Y@|ngQ#L&^AL5G%ls`Xicm; zE>HI#+77-c5xpJck_?-i3X2=8Hj8||K^EI+`a_qwceT**9`|J8oTvZ_626tjA?X~Emr{df^u^OMK4L9HhIw34$pW`x$bC=M3*d&4F~ z{OAt;K{uZsP5Cpwh_0xT)w3hbVTGn)c(_bPZiDu@Orc37tuMvtS7Xdrp92?M*9_8c z300$_VXOfo*Z8C;qkyQ#M(d3QeZHt=?01yr&0{{U;JOxJE9jr4t+X5(m=5`?OUb28 zF7%UoU>*$))=qlE%|-|?8*4;>gD77)EA8ueyeDAQM0?fFw!dsNs^hTbVmiH+{7!+;6m%ZX0n!6-ky=a7N>kWUf;q8ngPogYCvRy{Geh;8UOl@YH!t? zP9PXJcZ$a_YKdxBFOwY7V4H{}%V=)}BE-E~7{|<}=-tB;g!&Ce`LO}`&*HuA^oXxt z)Y}HoD>&W^ZiKtU{%qLIUm@2`{^5qKZpSod6U~5k2v*AFNJ2PotP&13l3|2@SqQpd zDNQnS-J@?kE^Cq1&7P4Cdi0ac2fr?!XqmDV4UUBqZM64QL|e9?(jscKqG9=PaS$Uj zeKa0_Au&}Xbf^!`?-2l=^Vb=)B~RAi<6s$;Yh%i)sjKeWzZa#Aw0)CIL6?5$nyuZv z%vDUC4%#B@kaHZ3Ia@TmZP^_T!ppn7qBTkVGN(QtpycCnzI(hjILB8d`xUGynalFj z=%_6rFD1s~Bz6o>LzAD(_1clHgV?1=NkEu{kuL?SZo;Yku>Eohh8m zqCg{?8irOnBP)#55mxv|S(B3x&4BSO-JZ}V$YCQPGm_8C$;+qPs^SrnY&lgXnplD+ zJxP&tx&)KG>S>H7%usn1DD?0{#jR-ySIxqALl2b|FDe>4EMH|09fz^0biPXE=PHTv z_fES?XGM%0BzXP;NTWjIEw8qi~l|JeT}9c8*7I#B>V0Mmi6rK z7PK%|H_L`t%>@{PRhkRI>g%5!`}4YeI-G`ENh#y071T@AX`3|FNIF)|S(Pk7^}5ynak@jf0JEDyDfduqF(yNVU9xMOs> z=3z4xYQ=CGaCW+t+0A}nZpNY;3U6vVo;m)=6H3P-%vS~FU+*yzv#-2Moj!K`6Q%h> z28W4y7FECLREu&!psR)OCp{ezU6Cn&|MQ0yIsilMKmQA9NNC!4qQQ5Ps%KcW)=NFp0(9x7Bz2Bd=s;CS$Gf zNaHF0%bR(NCD5}3??KpHqf98<<+el3lb&=!Yviqb(hhh!klIhLvEtlu;P4IgYQvJ` zwjoZdIMh)}qR&~>cUo@K`xfR8@B;TXx%Jr}tV-THS=(gKf|f7s*zC?PFWcT~e6kD4 zMkzS%8%W&FU}x_dEAgxzdEwU?M#*t|HIltPmqsUh_FG77UUCF4boAT)GOGHLzDxyJXR*a<`JMsZK<aCi(p|g#1-`>)Kgw7hzVLoQ*Ul~$_@kK$Z@|s*%11C{N;?$GR&2t9${?ev zFTFGWDzL>XyQmjX(u)cV)i&=B-l0gFeL1C(YJ9wgJr#R=B}#t(EUt5DQyEKtN%`R@ z$1v0nl*CkYJ7;N@tiJ5SbL$Pwn7m5iTjuPuPzGK8FYA%B&I0-xA{qB8U{aSA&}(E1 zU)>JKt}SFAmC3Tt7mo3~#Hl*=qG$$!Gi7TYtpV-PFPo8-2kZRRUv47!zEBuJ+jO(_ z`uLhmh(0khB_~p=zjxI>9Va|>rUfc|!8tdN(;l>1z*UD^JtOVbjG0yIZC|pd`N2QC z#W7M983|jsZvS8ovk^q4oQZHUh3ZLpD~-d7rJaJj#6Boi*ic!+XE{D|9oEW(=d_V+ zjRPsE@r)?r+mUwrLsogdb(%Z;DlfhzOZdWFr20}ceDNhsZj{3-S_W#MR|V4O*vV;$ z*-w^3!t=sctg#Cl2jm8e2+J3u%CA*cMs@8COOeozLCpFSz+T_?3zw)xjIm|of`1>j z^%t$mDa~!OQ_dFgO}IF3>lqf;2xR~t1~r@BMV-Aa(_mD!8{2cI&A`0Py!^2W*Zq=( z>d;%I_mOkfA^Pvlq*RcNfr54^9m8AQIyB?`e2Bp6JYbo2H_d$8g%pUlf1>x|$gsAC z`*o(|P1e4p#RbSoTZX`Ptp5#FZB_!z6^(MVYdME_WvR6Z4mB**Qm?TYE(0sswjI!J?Nub%)Ud1BLvzdLg+X5bn%@xEA^< zF#dIAK3YvHV}O{261=zKC)ne$q}o6MjkBya!PBR7J^ZLR0{IrKn@hWo)q`J3dtjZ> zY)Khe+PgI)*qnw9P~oUq&GtAs&+!>C3qhsU`@5ZHXa3%pJGh6F`Jytpi(&+`Un}MqD zLtZq9r7&RN0fpu=yWY{4z_?K@zNjWxD@R{5sbWsj7yBznfE03&byZ46?qMEO#}@q9 zyOfR#tBIpF-)YEWtozx3M0jcBIH6lhk8+AQvbif|Bw=BTbjTNugIX+HT0(w_^ z;Ju=V2-5SIsUi&}l~60-Z_)$_eA?gkwV;E*&moC-OC^xyTAO*B#nYseLuc$Z{nlJk zodkKt2R7Ivz~*OlPuu|V2;0gC80DSs2s5 zXQO3Z_0CY+XqI`kg)8YYxv!%87X_4VHeAVt9x!KB zriV`y0}@&f-%t6q5c(0|duu*h85u%$j)okXO;ImR;@r!--$J3p_JmG@K-(IZ$N+H- znXIIdel4G8{xw1!+%GvQWe_e z#ZnDYHr^i0l);vx;YEo@j{rRo1>frH!0jAE9*q`kAY>&fcNwbsdz3lb5(1QikQ1G+s?^%Uc%9N2;St z6UZYv+S=z-X(HLC!XsMS+GlZcolZTq9CA7{`B#_Fu6(bOpau)E;jjSifsmiU_p(=Q zfUSZrp@6j4YFY1SXJ@f7k6wakdF;(9Ipuu!r;$9x*NGHm1p9jmuZX{$yT-+|f!H^u zU5>(6(b-0H!>4Sa5K7-bRh=DVcZzGBd9#99_Zyf1WK=hr;A+phK&*r}ze#?r!{heE zmJ-l-j37QKi~E?qDSq%*yghTXT`OEh0Jz+cZ%LT{hD}YaX%Dnm{^kWqbTGly$#sFP zuw$#G@6+gTReSlv>IOE;ejmqOF_*^m&#KI{%?RlBJKv_(_K$r-hyVZZ=8T>`~8#a@+C?W#}t^iKKXXuNGBo<&+Xg+~x^!NA8~d{O*Y*6|Nr&Y3fh6 z-?4U6CS*ZWir;ca(4_a2!A!pXfVpvw?iV6%;MdE6o!nitdn^l8wZ>E^Jgh!uGHh-# z`KUQ$X>Iz!$rK0~kgf5FR$cl)Y;io9XpKYo4avUvMrO?$H(;jY*EA#VXhxDJD=9kr zj3bh47n5zvJ02;8jZY)m9&z?PvXd*&(3rS_ZLuN8|$W|1mBdIcqnq{4=vp$u}Bqw@v%`J#bbMYKjmTUx-j?s5UmW4_5x0*0WK zqLrITFuf*M_1W9OW!%FCVWJG49v9c}wfVTdKP(T{qj; zrK~;iO3WsRa!D=7=iIY|?vxMn!-9rFs>7VcV^T_jZOf@1|1PvEr!PlYdPZ`TP$F@w zP~IJjDJCL0rKS^*Pm8N2sdho*A;2$JYM}xwgX$^9#S%`}(KEy%+DC-?g=ZA4cwb~` ztu>T9{7nj$L65?G(e#^#^75WvOlA`O#hYJTiA}W%n)p4$zi^mo|7-&OhpR#X)^I+= z>o{idnAE>k=XVTiphq2CG(G?+cxC(v8j$1^Zknr{BOAMZbzBP zd7-~Es~zr~_xuQ-EbN|c+grMhvTOwyvEcmgEt#PHo1{L|Z@D~B;9~Oz7j=O+-w=J- z=n3kJ(f^MG{F9~`J&|&5<|PQi2*x)`eXpCw%nBo6@ z9q{YM{=N1~%2$AKpLZsYV9}+a{LF%U^(!amo5C&e)b1hxBZL2;ROa8E7lc%F`>c45 z0RB_P2n!N%-uZHSY$oL%On9qvJQ>nKj~S!g zvqX_kNTQH1%IHLE&SWHR6Y7V54BD+F34Kq$6HUj_TSoD6p^T<|fo)7_ab4;ute#N_ zaGc~5;T?D^;E12%vId&Q zW_97YP2BefvAz=}e`dO)ye;$=6iPjl&a`v;rIlhi7|E!MixxD0a!&k=A=>{%6r-8& z&m%r3(lx(fbqvstd5b+oB~T&j`Dz~KLqKZl%RAbuB+Squbl{%?vReXtSx zn+Nrs^P1!hybY}k>8$8=$@2F!XK6?V$tl>8MBJWF*j{)v!w`OKMSb@yS4t+2cdm)+ z$(^KNok;DUdbQpqi-^|6Z>m;teJ$9J@Gb6!)cl+ZHgRJ4bgF(_3Vl?;{>CI^TJiZ? z(WD8y7Uw8>w3i#Ofld#4V+<*k8&w+>Cp-!tb$YS(DQ#y>m-1u!(5N|N=<1Q;2jMe8 z3&4?ff~1API6f;mx}b^ZMKW%9DUfT^5BIy;XYI*#>OGTBE!PMx`YMx=}&xs f!j^$xE)2vFSVMM6*jS5AiJ2&DVel3L8&mXOSpHgU diff --git a/Solutions/Veeam/Package/mainTemplate.json b/Solutions/Veeam/Package/mainTemplate.json index ea54161c42b..36432b56462 100644 --- a/Solutions/Veeam/Package/mainTemplate.json +++ b/Solutions/Veeam/Package/mainTemplate.json @@ -1736,7 +1736,7 @@ "connectorUiConfig": { "id": "VeeamConnector", "title": "Veeam Data Connector (via Codeless Connector Framework)", - "publisher": "Microsoft", + "publisher": "Veeam", "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEventsV2_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzerV2_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEventsV2_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarmsV2_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindingsV2_CL**: Security findings from Coveware solution\n- **VeeamSessionsV2_CL**: Veeam sessions", "graphQueries": [ { @@ -1850,7 +1850,7 @@ "requiredPermissions": { "write": true, "read": true, - "delete": true, + "delete": false, "action": false } }, @@ -1873,7 +1873,7 @@ }, "instructionSteps": [ { - "title": "", + "title": "Prerequisites", "description": "Follow the instructions to configure the Veeam Data Connector.", "instructions": [ { @@ -2417,7 +2417,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamAuthorizationEventsV2_CL", - "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" + "transformKql": "source | extend TimeGenerated = iff(isnull(todatetime(creationTime)), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" }, { "streams": [ @@ -2427,7 +2427,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamCovewareFindingsV2_CL", - "transformKql": "source | extend TimeGenerated = iff(isempty(eventTime), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" + "transformKql": "source | extend TimeGenerated = iff(isnull(todatetime(eventTime)), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" }, { "streams": [ @@ -2437,7 +2437,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamSessionsV2_CL", - "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" + "transformKql": "source | extend TimeGenerated = iff(isnull(todatetime(creationTime)), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" } ] } @@ -2999,7 +2999,7 @@ "connectorUiConfig": { "id": "VeeamConnector", "title": "Veeam Data Connector (via Codeless Connector Framework)", - "publisher": "Microsoft", + "publisher": "Veeam", "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEventsV2_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzerV2_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEventsV2_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarmsV2_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindingsV2_CL**: Security findings from Coveware solution\n- **VeeamSessionsV2_CL**: Veeam sessions", "graphQueries": [ { @@ -3113,7 +3113,7 @@ "requiredPermissions": { "write": true, "read": true, - "delete": true, + "delete": false, "action": false } }, @@ -3136,7 +3136,7 @@ }, "instructionSteps": [ { - "title": "", + "title": "Prerequisites", "description": "Follow the instructions to configure the Veeam Data Connector.", "instructions": [ { @@ -3429,12 +3429,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKey": "[[parameters('veeamBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/malwareDetection/events')]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/malwareDetection/events')]]", "httpMethod": "GET", "rateLimitQPS": 5, "queryWindowInMin": 5, @@ -3483,12 +3483,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('covewareBearerToken')]", + "ApiKey": "[[parameters('covewareBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('covewareApiUrl'),'/recon/v1/findings')]", + "apiEndpoint": "[[concat(parameters('covewareApiUrl'),'/recon/v1/findings')]]", "httpMethod": "GET", "rateLimitQPS": 5, "queryWindowInMin": 360, @@ -3533,12 +3533,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamOneBearerToken')]", + "ApiKey": "[[parameters('veeamOneBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/v2.3/alarms/triggeredAlarms')]", + "apiEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/v2.3/alarms/triggeredAlarms')]]", "httpMethod": "GET", "rateLimitQPS": 5, "queryWindowInMin": 5, @@ -3579,12 +3579,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKey": "[[parameters('veeamBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/securityAnalyzer/bestPractices')]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/securityAnalyzer/bestPractices')]]", "httpMethod": "GET", "rateLimitQPS": 2, "queryWindowInMin": 60, @@ -3620,12 +3620,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKey": "[[parameters('veeamBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/authorization/events')]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/authorization/events')]]", "httpMethod": "GET", "rateLimitQPS": 2, "queryWindowInMin": 5, @@ -3674,12 +3674,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]", + "ApiKey": "[[parameters('veeamBearerToken')]]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/sessions')]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/sessions')]]", "httpMethod": "GET", "rateLimitQPS": 2, "queryWindowInMin": 15, @@ -3695,8 +3695,7 @@ "createdAfterFilter": "{_QueryWindowStartTime}", "createdBeforeFilter": "{_QueryWindowEndTime}", "orderColumn": "creationTime", - "orderAsc": "true", - "skip": "0" + "orderAsc": "true" } }, "response": { @@ -14071,10 +14070,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -14174,10 +14173,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -14277,10 +14276,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -14380,10 +14379,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -14483,10 +14482,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -14586,10 +14585,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -14689,10 +14688,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -14792,10 +14791,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -14895,10 +14894,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -14998,10 +14997,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -15101,10 +15100,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -15204,10 +15203,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -15307,10 +15306,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -15410,10 +15409,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -15513,10 +15512,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -15615,8 +15614,8 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { - "Date": "Date", "DataSource": "DataSource", + "Date": "Date", "MessageDetails": "MessageDetails", "EventId": "EventId" } @@ -15718,10 +15717,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -15821,10 +15820,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -15924,10 +15923,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -16027,10 +16026,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -16130,10 +16129,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -16233,10 +16232,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -16336,10 +16335,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -16439,10 +16438,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -16542,10 +16541,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -16645,10 +16644,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -16748,10 +16747,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -16851,10 +16850,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -16954,10 +16953,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -17057,10 +17056,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -17160,10 +17159,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -17263,10 +17262,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -17366,10 +17365,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -17469,10 +17468,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -17572,10 +17571,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -17675,10 +17674,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -17778,10 +17777,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -17881,10 +17880,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -17984,10 +17983,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -18087,10 +18086,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -18190,10 +18189,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -18293,10 +18292,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -18396,10 +18395,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -18499,10 +18498,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -18602,10 +18601,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -18815,10 +18814,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -18918,10 +18917,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -19021,10 +19020,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -19124,10 +19123,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -19227,10 +19226,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -19330,10 +19329,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -19433,10 +19432,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -19536,10 +19535,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -19639,10 +19638,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -19742,10 +19741,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -19845,10 +19844,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -19948,10 +19947,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -20051,10 +20050,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -20154,10 +20153,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -20256,13 +20255,13 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventId": "EventId", - "MachineUuid": "MachineUuid", - "MessageDetails": "MessageDetails", - "Severity": "Severity", "MachineDisplayName": "MachineDisplayName", + "VbrHostName": "DataSource", "Date": "Date", - "VbrHostName": "DataSource" + "Severity": "Severity", + "MachineUuid": "MachineUuid", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -20362,10 +20361,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -20465,10 +20464,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -20568,10 +20567,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -20675,10 +20674,10 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { - "MachineUuid": "MachineUuid", - "MachineDisplayName": "MachineDisplayName", + "VbrHostName": "VbrHostName", "BackupObjectId": "MachineBackupObjectId", - "VbrHostName": "VbrHostName" + "MachineDisplayName": "MachineDisplayName", + "MachineUuid": "MachineUuid" } } }, @@ -20778,10 +20777,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -20881,10 +20880,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -20984,10 +20983,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -21087,10 +21086,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -21190,10 +21189,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -21293,10 +21292,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -21396,10 +21395,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -21499,10 +21498,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -21602,10 +21601,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -21705,10 +21704,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -21808,10 +21807,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -21911,10 +21910,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -22014,10 +22013,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -22117,10 +22116,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -22220,10 +22219,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -22323,10 +22322,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -22426,10 +22425,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -22529,10 +22528,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -22632,10 +22631,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -22735,10 +22734,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -22838,10 +22837,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -22941,10 +22940,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -23044,10 +23043,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -23147,10 +23146,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -23250,10 +23249,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -23353,10 +23352,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -23456,10 +23455,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -23559,10 +23558,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -23662,10 +23661,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -23765,10 +23764,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -23868,10 +23867,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -23971,10 +23970,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -24074,10 +24073,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -24177,10 +24176,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -24280,10 +24279,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -24383,10 +24382,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -24486,10 +24485,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -24589,10 +24588,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -24692,10 +24691,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -24795,10 +24794,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -24898,10 +24897,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -25001,10 +25000,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -25104,10 +25103,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -25200,12 +25199,12 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", "BestPracticeName": "BestPractice", "TenantId": "TenantId", - "Id": "Id", - "Status": "Status", "VbrHostName": "VbrHostName", - "Note": "Note" + "Note": "Note", + "Id": "Id" } } }, @@ -25298,17 +25297,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -25401,17 +25400,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -25504,17 +25503,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -25607,17 +25606,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -25710,17 +25709,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -25813,17 +25812,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -25916,17 +25915,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -26019,17 +26018,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -26122,17 +26121,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -26225,17 +26224,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -26328,17 +26327,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -26431,17 +26430,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -26534,17 +26533,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -26637,17 +26636,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -26740,17 +26739,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -26843,17 +26842,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -26946,17 +26945,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -27049,17 +27048,17 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "Status": "Status", + "TriggeredTime": "TriggeredTime", "ObjectType": "ObjectType", + "TriggeredAlarmId": "TriggeredAlarmId", "Comment": "Comment", - "PredefinedAlarmId": "PredefinedAlarmId", - "Name": "Name", - "Status": "Status", "VoneHostName": "VoneHostName", - "TriggeredAlarmId": "TriggeredAlarmId", + "PredefinedAlarmId": "PredefinedAlarmId", "ObjectId": "ObjectId", - "TriggeredTime": "TriggeredTime", - "ObjectName": "ObjectName", - "Description": "Description" + "Name": "Name", + "Description": "Description", + "ObjectName": "ObjectName" } } }, @@ -27159,10 +27158,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -27262,10 +27261,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -27365,10 +27364,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -27468,10 +27467,10 @@ }, "customDetails": { "Date": "Date", - "EventId": "EventId", - "MessageDetails": "MessageDetails", "Severity": "Severity", - "VbrHostName": "DataSource" + "VbrHostName": "DataSource", + "EventId": "EventId", + "MessageDetails": "MessageDetails" } } }, @@ -27564,11 +27563,11 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { - "Name": "Name", "VbrHostName": "VbrHostName", "Result": "Result", "SessionType": "SessionType", - "SessionId": "SessionId" + "SessionId": "SessionId", + "Name": "Name" } } }, From 9ab70986f9469aed53c541596a3ad411378c0825 Mon Sep 17 00:00:00 2001 From: Hector Arvayo Date: Mon, 22 Jun 2026 07:50:03 -0700 Subject: [PATCH 11/11] fixing diferences --- .../Veeam_CCF/Veeam_ConnectorDefinition.json | 4 +- .../Data Connectors/Veeam_CCF/Veeam_DCR.json | 6 +- .../Veeam_CCF/Veeam_PollerConfig.json | 27 +- Solutions/Veeam/Package/3.1.0.zip | Bin 113114 -> 112648 bytes Solutions/Veeam/Package/mainTemplate.json | 1201 +++++++++-------- 5 files changed, 620 insertions(+), 618 deletions(-) diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json index e6eb7fd6740..6c45cd43f63 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_ConnectorDefinition.json @@ -8,7 +8,7 @@ "connectorUiConfig": { "id": "VeeamConnector", "title": "Veeam Data Connector (via Codeless Connector Framework)", - "publisher": "Veeam", + "publisher": "Microsoft", "descriptionMarkdown": "Veeam Data Connector allows you to ingest Veeam telemetry data from multiple custom tables into Microsoft Sentinel.\n\nThe connector supports integration with Veeam Backup & Replication, Veeam ONE and Coveware platforms to provide comprehensive monitoring and security analytics. The data is collected through Azure Functions and stored in custom Log Analytics tables with dedicated Data Collection Rules (DCR) and Data Collection Endpoints (DCE).\n\n**Custom Tables Included:**\n- **VeeamMalwareEventsV2_CL**: Malware detection events from Veeam Backup & Replication\n- **VeeamSecurityComplianceAnalyzerV2_CL**: Security & Compliance Analyzer results collected from Veeam backup infrastructure components\n- **VeeamAuthorizationEventsV2_CL**: Authorization and authentication events\n- **VeeamOneTriggeredAlarmsV2_CL**: Triggered alarms from Veeam ONE servers\n- **VeeamCovewareFindingsV2_CL**: Security findings from Coveware solution\n- **VeeamSessionsV2_CL**: Veeam sessions", "graphQueries": [ { @@ -122,7 +122,7 @@ "requiredPermissions": { "write": true, "read": true, - "delete": false, + "delete": true, "action": false } }, diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json index 012d9a92a2c..3029100e6bd 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_DCR.json @@ -358,7 +358,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamAuthorizationEventsV2_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(todatetime(creationTime)), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" + "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , CreatedBy = ['createdBy'] , CreationTime = ['creationTime'] , Description = ['description'] , ExpirationTime = ['expirationTime'] , Id = ['id'] , Name = ['name'] , ProcessedBy = ['processedBy'] , ProcessedTime = ['processedTime'] , State = ['state'] | project TimeGenerated , VbrHostName , CreatedBy , CreationTime , Description , ExpirationTime , Id , Name , ProcessedBy , ProcessedTime , State" }, { "streams": [ @@ -368,7 +368,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamCovewareFindingsV2_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(todatetime(eventTime)), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" + "transformKql": "source | extend TimeGenerated = iff(isempty(eventTime), now(), todatetime(eventTime)) , CovewareHostName = ['covewareHostName'] , Artifact = ['artifact'] , EventType = ['eventType'] , TechniqueId = ['techniqueId'] , EventTime = ['eventTime'] , FirstRunOrAccessed = ['firstRunOrAccessed'] , Hostname = ['hostname'] , EventActivity = ['eventActivity'] , Country = ['country'] , Id = ['id'] , Md5Hash = tostring(fileHashes.md5) , Sha1Hash = tostring(fileHashes.sha1) , Sha256Hash = tostring(fileHashes.sha256) , MachineId = ['machineId'] , RiskLevel = ['riskLevel'] , ScanTime = ['scanTime'] , Username = ['username'] | project TimeGenerated , CovewareHostName , Artifact , EventType , TechniqueId , EventTime , FirstRunOrAccessed , Hostname , EventActivity , Country , Id , Md5Hash , Sha1Hash , Sha256Hash , MachineId , RiskLevel , ScanTime , Username" }, { "streams": [ @@ -378,7 +378,7 @@ "clv2ws1" ], "outputStream": "Custom-VeeamSessionsV2_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(todatetime(creationTime)), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" + "transformKql": "source | extend TimeGenerated = iff(isempty(creationTime), now(), todatetime(creationTime)) , VbrHostName = ['vbrHostName'] , SessionType = ['sessionType'] , State = ['state'] , Id = ['id'] , Name = ['name'] , JobId = ['jobId'] , CreationTime = ['creationTime'] , EndTime = ['endTime'] , ProgressPercent = ['progressPercent'] , ResultStatus = tostring(result.result) , ResultMessage = tostring(result.message) , ResultIsCanceled = tobool(result.isCanceled) , VeeamResourceId = ['resourceId'] , ResourceReference = ['resourceReference'] , ParentSessionId = ['parentSessionId'] , PlatformName = ['platformName'] , PlatformId = ['platformId'] , Usn = ['usn'] , Result = tostring(result.result) , Message = tostring(result.message) , IsCanceled = tobool(result.isCanceled) | project TimeGenerated , VbrHostName , SessionType , State , Id , Name , JobId , CreationTime , EndTime , ProgressPercent , ResultStatus , ResultMessage , ResultIsCanceled , VeeamResourceId , ResourceReference , ParentSessionId , PlatformName , PlatformId , Usn , Result , Message , IsCanceled" } ] } diff --git a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json index e0d48e7592c..e52019664da 100644 --- a/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json +++ b/Solutions/Veeam/Data Connectors/Veeam_CCF/Veeam_PollerConfig.json @@ -8,12 +8,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]]", + "ApiKey": "[[parameters('veeamBearerToken')]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/malwareDetection/events')]]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/malwareDetection/events')]", "httpMethod": "GET", "rateLimitQPS": 5, "queryWindowInMin": 5, @@ -62,12 +62,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('covewareBearerToken')]]", + "ApiKey": "[[parameters('covewareBearerToken')]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('covewareApiUrl'),'/recon/v1/findings')]]", + "apiEndpoint": "[[concat(parameters('covewareApiUrl'),'/recon/v1/findings')]", "httpMethod": "GET", "rateLimitQPS": 5, "queryWindowInMin": 360, @@ -112,12 +112,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamOneBearerToken')]]", + "ApiKey": "[[parameters('veeamOneBearerToken')]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/v2.3/alarms/triggeredAlarms')]]", + "apiEndpoint": "[[concat(parameters('veeamOneApiUrl'),'/api/v2.3/alarms/triggeredAlarms')]", "httpMethod": "GET", "rateLimitQPS": 5, "queryWindowInMin": 5, @@ -158,12 +158,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]]", + "ApiKey": "[[parameters('veeamBearerToken')]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/securityAnalyzer/bestPractices')]]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/securityAnalyzer/bestPractices')]", "httpMethod": "GET", "rateLimitQPS": 2, "queryWindowInMin": 60, @@ -199,12 +199,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]]", + "ApiKey": "[[parameters('veeamBearerToken')]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/authorization/events')]]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/authorization/events')]", "httpMethod": "GET", "rateLimitQPS": 2, "queryWindowInMin": 5, @@ -253,12 +253,12 @@ "properties": { "auth": { "type": "APIKey", - "ApiKey": "[[parameters('veeamBearerToken')]]", + "ApiKey": "[[parameters('veeamBearerToken')]", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" }, "request": { - "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/sessions')]]", + "apiEndpoint": "[[concat(parameters('veeamApiUrl'),'/api/v1/sessions')]", "httpMethod": "GET", "rateLimitQPS": 2, "queryWindowInMin": 15, @@ -274,7 +274,8 @@ "createdAfterFilter": "{_QueryWindowStartTime}", "createdBeforeFilter": "{_QueryWindowEndTime}", "orderColumn": "creationTime", - "orderAsc": "true" + "orderAsc": "true", + "skip": "0" } }, "response": { diff --git a/Solutions/Veeam/Package/3.1.0.zip b/Solutions/Veeam/Package/3.1.0.zip index 092b32f4ee256008c86091c2d9ca7a7e65ae7adc..96526c58b465dd5afcbc4e0cfefc4fd4d3d45ade 100644 GIT binary patch delta 88970 zcmV)AK*Yb=^9G3U1`SY40|XQR000O8kUG|}4OAWtkUG{}NeAHf=$HWj0JCl$$2xza zbiQJI1jG*&!XGMx7xDccjr*t(UVLS|D&YkSL(~Z`8aq72Z@+8gll+P{P}RbRt%vmni(h__0h(v$MZA_}-@nsGgQW<;5Em?vamEm}N;iGy6WDm(@ z%5irmMjl`0Y?+Qvw4m zjgD0ysaULr6{LNo8cEh-$tf*3Z#vhRf6A;eBT2SfI{4g=7Dupbj3h>NC6IqaqG%Nu zOR@5~y+B<)PopJjoZv^(9X^3~F3286@9sB>2RO#4e@mG|u@;dK3(_K(nV@7qD*Mc^~-p=Kk$Z}$jRl+Uzp zs(XX}b5CW78m%uRmbs>L27P~4yga`1b&yuVf9c7+mGdv>wzm{tFJ;F!5&Y4r`4{=H zKkeniJ{0d4^=CbozNPES$k|I*QrKKL7_%zr7&eR$pZ^e%;^ zGcBi^^SbCPSXjQ^Ifew{VxncWj`>Z`4Odauik){vJ4?4wKM`CWp&U$KN|mit`JZq7>7L!tx?%kC;oS92WhqgZ)yesYm4Ujc$3@u&@U$ZYFf z^Vzcd`0;mO$`u9tYZbM#f_n708oyCFtzW5JIikXjKLn{lep#`=H^Xa6igzi*X#WI& z^_br-PP@1vzcnw-wo8AW7bCKD%D9hO<^>jMnehxf+}{VPzT$VvG{NW|QS>TUe~g!( z1eJ69K`2XKs|n7|Cai0d9bf}6LEU8S^IKMAe51gWl|iw%O`a6D$wO;=t}9&^L2=Y_ zmHl~EZ9Jt6X2*HzCT5}cy!0z3+E}0eel+7x@E^rE*Ol+ty-l@l-gOMSqktk8 zXaGh`hYH$V-YG>N=2EiRu+&RLa(m(9g`ly1rh{v%Ph3t;A{uImNs! zacS)a;n;HCMV#BS`4^t9WP{IY*)6{aiw9;dm6eHJX(V9J80yyh^4_rGA3fYc%f=6R73O&dPD)z3{8ywp0c z7(`Dnx8^Q3ztjXNVfz_xdyjLQfr?hP6qGXn4o$9^-zoX}NJmU%d5J1dN~VkC7rv$Y z(2$cI+volBX$Gni5_%CGx97tpY&Vw+dNu?)3KV~bc|M+hr(Q2%lM=Iw=zgEp$xagv zFipf=e;gx)ed@tNIW8s+HcxiYx*ywwq2j?X!5b#bZ&75@4QHI>&D9N*P5ms%?|f@- z)eVlkV=^1#8*(QwIanPU#Ku0pnJs3}F?^9#|4aFS`%+=`dIK+{wOu`|cXU5bet~yr zeH(vzc_4SS?ktM3v2fr{f9E3KofKlLH@ni6di>g#@#TVK>&X|oVfvy}g5SjooI_)n zRk+r3M_h#=MeAW9z8`1|v>^9t?yyA}K=QCIs{UfUEe`J zT78F>t8zc*D`iWSDh?T-VeXqn6oxs{6|^lCRB)HjBCmdHPI*~K-sstOTV2Dv&?L^o z-L#*}-Ly@k$1`upA`;FyRQnD{lpaK94x0t&lw`EGoP$4~NvlcSqhHKk$q?i*gi?P1 z;rX*S$VJV8MGdu>)u#B|tMX<`D?A;s4pDhf!+Egym^RaQE|gWiUt~Ew`^XW|30DiS zZ($6clL*{S?SaUwsFK=p7)6{}51y>;&Envc(mclcHN+m+f%LYF(i{dLBCsgV%zSbP zM=%r4637rApA&W-lOA~-pB0FiT`zxT|J>4LevZ#GyZC<1 zJ)3Ps6Yh^I8p>n;p2lE3&C&$NXD3>27n}727@18#k#2(M8ceb&==6G)e*6}&G9RCn zGzu0|nO$hmVj6m!%;x0lAcZt`T)*7Gi?isMrzgtROT&@=qnj?b;d(k&3;Tb_=v>f~ zoKs+fJ21xQBdd`!J||OHZHiiybaMS+6HQ@$&91;0zjOGdHu0AezzSJ_=Y~wiI+@~f zBdYyz{51!H-4j}LDt&-7Bf)!dBzC4@D6w>(yxjTdeF6cZm_`_;GDZbtrea}d#V1CG zO*zCpIy2zUr@2_;GqMKnf3SafMmOyv0~gk!c{bNifgLu>yv5tOoeSiF!*oO9Sw|-2 zc*}KHX|q4pR&gpb-W2vEAxSr{*R&qY6!wd>nA9L#46Q!pT3mlHW#O_R@j-u+^YVryupa}P zXndA<@?f^yOrekRGEmc4i*jzJ&@?JE z9`eg-ww_e?JXn||`-Nu}O+kwaW~PFZ;Wk7v3jjKEnI1gtNWq*huZj|FeX^H}{MFqN zi+ToW14(=R_j;uX zC_nBj2Ke>;X~}{({Q%F)EKn~9BcfVWe)^W`A$!6!l0D+iY5spB`zQakxHgFXp8dg| zyrf*cKb^(wujjR70rsq(L6EV)!o*n>?M#l%k}LdK7DPTTU9$XW_tFpBS=>auh2KkL zJfZ#j@E`E?myIuk6^ch(0Ge5l^G*NF*yRV*VLE3|3KNMvd%+^_>;VtL!>|9QRT^ot zwGph2T*Elk2B&`*kkS~iPH*Vz#!jtvny7Dff|o_jMQhZJ<|SaL383G_fs>pKdfw1- zw5fptYs(SNV+sv={AJ0(&VDa@+!+O{o$V4Ix z4z5xr3rAP!2L_BP8yT$XDJL94c^lMnVZS`BCSkCLwZwl6M)$g&9>FO0k|wJBWEX>! zn4!P4sKoQ#ZZBI8iof}qz{Bl)Md1HtzrWcZnK6mtQSoB6{lvo;_-t zN6OG^z*&C=sC^VQ;iZm?(!^92a5u=+VJ!_}Wtb{s(9prcp4{uD5vD=OOIs&756WI& zB|Q<&lH_cb^2>wD?x{yl_#F8Jz@2ZOs|1*}xy{UcR%&ebIQs!LVZEq$jJUyC`KiGY z*q@|d?|d8Cv|IdLeO`Q|;(#b7-0IE)Yd@5&(@KAj)D^cTY-Vs|t(0Y`bDVKEf&$81 zA3RCzle!x1Ak`}l6E^DI?kQX5YKK*`1-tqqw?DE&q}=ex{@|)p*+>^hJh_FjJ7vl3 zi{0O)cMFZn|6sGHS{!)k8*;9~RtwBR{XV`%eB#X0NbAbeZ_<-wg`? zDz<;=fuZs$y*os7eiPfYOW$4xdJ9zwk25mEcG?MnptNVtcqxv!aqA;LWyZ~^{4YL} zWXHbvWRm^Cp3pjTMQ7zFvRY@FJ)o2jQHDTu$jbxVIH09*s}Iy}P_p?c@BLC2SGuv> zQRR*)b;M5cQTFZKmxE7o>O$RII5BG>pMAb^mXg8^eBLSu#k=;{{J0 z$$VhDb^diVk0ZAR%D-j%3mOzIwqd3H0sZ})|3AK$p#RD)6l$Qn;ZJs?FVkn#a_mKUDcKei|ngg?Hl5ybe8Fe|b_OVn$O&uEz0N5YorZL?g zyV@vKhJ=qm(eJz7Eq7t_M7;mwhhZzabj)c@rCf9kTgs)QE*ZbK=!i947Tfu}M*){L zd~LzXT`ismckKF7Piu;GrO`FH350(UK-p_=>%|ax1w?Qgf!FGqmRq|eN;ZGz*Fr_} zEw!Q*9;JAq0Qfh{HR0DGEH~F=y}N-b9swg{N)%x4jY zH1iIr%mXdq%Dq^#m~@stCrJS6l?66hZ{0ZH24hSXPCYa&CTtw=#)}%VvcrEx^^c(i zD^0#f5RA>~%cQv1gJZZr=J3+AXAkt2y}|F%qJ_`b%lU&h@Q>sTEHY@0;eleewOucB{{XWA zs(__eC&M=Uv-gHnr8=fhq?Ffm44+#mYYJR$_cK`4P4Dx7fOGwK+J0pwJ^`+zc*4 zDQWizLcDtU?#&D3>AQD-e)f%0q<|mOLMzga@52h<_U1Bz5n3N%;onc2K8jH6GYWl2 z$dV)Kr4*>$MJuwq;W)Jx`^~*(oB3;KKUHYRC_cs?O`V2F&b&Z*fNjS<@i(5!S!r zh}Dt2N??hw1LO6Wdh3cYj>`g5?dZW@F_gaoTYph2_QF z84r$%KUA!+UY_cRn|}cck0sK*og&EPI*v45cZu{j4|tyB<{Dg>MZp|quN4DygmWrg z7w;Wl?PSH%xS>-T7e23jR-3R2q>gES)=SJC#d!PS-81Hq;RamOOmM8-L8(sOJsf5U zk}Cwn0VT?B$UBl$w9w!2uvg0WyhoX;PV}AG+4y!>(_rU7u8W$L9UR_usuJ8FH*BlX`0( zM&+&t?*8cL9ecA^uc$cmdBuGTf-bT(Onz>8Y%JmHD2&(2SPnfJdCT?jV8SS@$)P3M zE5kXoOuG+cVyw528gax8Ql*HK-)krvHsAh6XB^LX@R$lmJv6sTTB`gm%@YJX>YgCk4?O_i^YIY*a%ub65_auU=lcn>ex z8^Y)7m>u;mz6M*km~dknC*nAM1L=z}9{dNx6{zcR2TAizw8$Izv$AVV$(vK?MIn%h zoL%X$ODN&KhG_Q&Kjr-pPyR#2laIEwcv=9H%WM@R#XQGMKC22866%E{x50dS6ziSc zFLc!X6x&0wscxOG)mc5018pG!UrLiEZ6FZK5aCCdmd-Z8M{?HG5WNtSR&7oJ3X`R6 zVH;KHXTP#)SG&ie%ElA|oSz?Nz*;i9s+)xLUXvkiF@NQLt`U`H(O1FxW4!#d5ONUA z>9wQE-EvDSo`GW1b%RrGfGgDR0?*$l!di* zLFVT_FMeLUgRN81l}fr@t(G(vMvre^ad7YqT(R|(l^18R8oB}$XAAR^?clU!XT>R) zYNelR^?zA*=Uwt!X3rJMAg>Hf3%AVYJVFfVOUv!mwes{=h|eisZ5J%0pXF}Sa?vye zAn%56msi|Ur!D54k`<1QsT4q+bv$dI3jGFL=&5q{{MnmFtkL@O7mIjBZ!u#uFCMYJ zeEgV$Sb4`k@sicDCh-@KAOE~imB)_-sjQD5e}9o*f4QHHT8c_G^?s@0j@=IZO2;lH z+nkj8dH>{YH8je`6C#1YX^9h2y&uZLQ(PUNQfq=JFm3EzJ+fQkcNaS>H`aLYxzaVo zX=c{e?xbwC7*#sFRR5f|QK%4R2tuRB2eX?MY&D!Zn*(FD^FsX zFMokQFtrFMQG*$NGACDHf|c?%DPES#tA$O&0Ke=yr3jkL` zyriYIgZp1GGU0A6?I%k^y%`yKs?(bUXn&E{5cU%)zxHc4x#1;xR(}^I4(3v~zDmYR z49aNJ?hT~Qh_7?1ZaJ${dHe=rvhzuK7)IM?IJDU;8Ao$Lyx%OkT{oe7ah5r55s z#|Cyj#}%l^=dDhT8z;J>W0y~8!sX?k;^|D1wU*hA?#gIj7&X($pPih;E`#p6-egle z-o~p+^qnF#-QL`Q(OoF46=Zwl3w*?-H9;=Lok zYf^QWAd#+T9vocG;i`Ild}^=wA_ ziSph&d_`+P+)6*R z-b~ML3Q55!b`emIJ^x=dbN^rDk%9||11>h|Cz!|~?D3~%2pMe)br(UJ#VX)eg>O8P zLaDIxjsVaS{4ltw{!qWe`GiL>8gHg-0$62*;V}zdSguj5`i6~H$A5?M&HUKBMkfut zm()meOpSH~9vjvZ2 zz^C4B$O^TSDPo4Omau+FVMc1&gw>1iLBB0OF@-99mi2eU0+=+MLZ3E80vq67W?pc0 zX){9eh4$qlS+-tla(}Xm1PAOZoObQ-xXWHBtSRVmk(2K>~`1JM5D%!dyr`=dqT8Ze% zG7t)^pz6gcMSmQjHfHD3NA92CKZ ziI>nc#D)n2@^``Q?24W)gcoRYDcNjTH$mT(QYuo~kvy0T80B>XD9LUe2o~)9>;gDW z3V_VFYLu8;M@pc43Dy{Zd$asV_$r5_U^7SN6%Q?CopLQmQ#=8~AR^bxd1hwkmMA1jf%(bXpmwP6{hWEWtci$n zJ1cMT>1y`FT3D{|1Ts5kc|xR6){>nmv>%1JlhYlq44v;NI|z ztbh0NyBqT3ti5d1{s;>%+ea1|8;38xc{B9|c(2OQXSy}B>I-TvaJGhmGgq*rQbNqe zEWVj7W*|6UMAZLMXmvF{JHLS!(%P;J=5x9qBfr2qG*f-c?mwe0r`?KKUJMW1sqI{V zrRqm?b)x(+k4pP81=-lyJo|-in0`HUH-G6BCLijoT(>`C2d9k2A(|e6RWR1h?@0M3rbMobOvsoUxkkA&t-MJtH(&v3J zOY5&ZFMjHT(uQ$8n5S2CkoCS!BW7<`&xF>_bjlr5>^!Ha4}MM&D-z~i^&xA_3nRX+P!=D=`SPmqVROX3wL#!GrxW|JQo*<-UBjDHK`&WhSrzd>#w zV`+~s_G|eta_x&*IQ_s+7Ks_))qlxa{3}}__Z{T0tnj7!b+F!mWm|hXpDjL?jj?Mo zUqt{T*y|S!vSg5pJc4w&ns2XQ4Y@3sxJP zFs-7hZ8W!-gD#(ms>yICLoFKz%(9uxc_q!XZJIY#&1#8Dp%1u&`9rA$HPOm>Tmzia&)NH?UCqjG zz;wCD(X=<={6|rbs+j!vFXuZ?#5v1$V{;&XmR=Z|?sL_+0Eo<&ca$#w$oW6g<>F7Z zDK_K#$HOMAR!jPXPP{(`^MCE0m>HInU_0OB1Sjv`FUY6A!7FEt6IoGKh9Zw-#bw%e zGq9S;yAvnQR+&?*owZ*I0MrHIdH_11W;<$n@Qz0u#q9mLCN zb|bKoWPlm1uDpa};HfE?F2if9Pv#g5m*YklMqA@dM`KX7JG);o?tk83H@z}|r$Fe@VafOiYyYuh@Ys zNqEU{-m?4hniYMuXOXtAk}Z>W)9hW{vmrb-r@I_#@9|GzRi6f7q3?vE17ONq!bTvM?0be{c<16)zsL%Z73qu@yy}KneyYx| z2uRI_^lvZT3Fv5g$hWhb+2-%B-vXuGOvOrh{KQT~zFfSTEjlRaY3;Ar)ra)sckmze z)hjiQ-+le{7k@W5U!>{(6>&prN%D&pzEDijw01+5+s(@bsPz)unv_x#bOH(D_Hb>s zXshhX3gESL*5QIWz=RQ4n)tKYNWJol3WEvRA;pxDXM;A!Z(I8JH6{|BUu5_+0mAGO z*{^1E_=A4?UzdO1jp^GBED@CCH*uUgYwb${DMO^aIe!3odt;C#LBL*`Z*N#X#K@~| z`Fl^(h`vPA91h7UqC1Bbm}p{Kh^yFt!;roXHrImu0!H~C=gfj`dRjkBo4vs=2BmT^ z$RJr>1+eZmI;TpHb0~kGB#@acP_!j`NO6=;k?F_TN|^X?Mc&SSrDVFMY3)P>HuHw( zbauf?D1UZzw${+C6$6s0@zdq^V-&EDhUSV|lI+BvD)EU{-(Yo(E0{Tbbl&`qXwL6+ z8)83Hd-cQTV9(VGusm3FpNB=);CTK08Ff`pI72hNqF_NSyZjLAh^CzB2 z2G4%Q!3Ue?^RRgu0(rkbo2MFC-TAVNbMu0q4ZGM>;X6HN*6+d{H5uyxl41o{n|?M< zl2-D=+$0RQBiRnz~*6-N#7gqqN&kyVKq}S)l^<~FO zRl%>y52-2>PgRLnnH!#|(mzEdYlUa143wI}+RQRj9@0`C(o%*o?C_WF9B9$WeCWZH zJHE$-*XDY#-yZC@N!xGv<L-mM1_Y+tOHV5ZJBTC2Mil%1Z7Q%BaDIqVcFZ?NuGYp&y~JjFXL^LA1}=o z=}qvFoQcj~K2dB9R%`Y2$>}JJ%|d@~37$qpDRUfoO%IaJl@LH~n@+*p>BqwG`At z4XJFlK-7?Gy763nb{#CP$Zi^A*O!UduJ`D*l5`TLu%Lz6^M6ZB8*cvF zmDZv+c=7J#pi<7*wH@rj4p!EkUNx9qxwY#J`WmY)pKil~hey(VU4B~tLh0^(UvBj5 z(RuY79}ezihL4Ke09I+q^AaR~TQ9e(;js0-(k@6(@$g~Li75Yqaz#Ips~#=>U%?T( zn2_H1vWk06PGoUATQ3)MwSUMh!dGmaS&ND&$#+)i8_-qj>Sqq`wVZDyYmwblkSisJ zQHcZT9-7mxracXwvfW}iK)>)M+lD3kaAkp6Beyq7vr-8q#jTgA{Q4DaqU$+KQN!ua zu6W%gHDF@c4PNFKNe!w+1@C1ADwWR5zg}EpCEYujXm6;?e@!53=6@xvo^l%uq&&KD zaDP1KO~Q9V7-R%e#IDdwwQxG zLwygY7knEM!)%ydRDW!&hIqlr<-R1PFO?rQy)ERV>?}FmTZ}Ve8gyHHXm7XJOk-<{ z?%v%MI^%MctDW7nItL2#yH=*G%2uW7@u9Wv_PrJq0lWThnsw_w3EfjQx4pvAE@WEn z&lXd^xfW5yPw^fH%@2LDvunkj4`Z8mnb5a8%WzWman%(7>3_K{xMUMz?uC9zb6ytE zE4TZnP^IfL>;r}w6U?ziuboB#Mr__R1EuUWI4&|^K7?`IG%iOa>EE)e#Giue{c6!< zTsQ301F#{Q8@-;z@KrTORJl65tb;?`T4?}kZYR;3#cY&MWKF%go9vok`dbgxOE=v6 zm0kSPcySV4_kXj{R@0%(*wYKus5!pErlX0%<_nZEVHOxJ(A_UwvNeowlje4bE4a7NY&~`cGPkyVlAI@fzi55MiPrMlbSTG~1&X zz&7yOy8l0b*`i$pw{4GG9tt1*cDN=4UF-VEPx-8wUaFUWBb&=$KEK?VhnLho#MuR) z?z>IQp?_*XuMh83f>O+-8`t@c;IHNJE*n3mkKUhF{S6=9mplkyakL|#ZHQZdOr1(u zqT`k5@P9_Rg48Wacd;9^n!Dz&{{pNoWAekBm-Lw3azS0=l}0cPRQx_eK9T zT*h~2rzkZ&ZMarvN=u6ju_Pls+Ao`)96G3%N{j{Tb#T|QDs-+42!i2P7BN28+XXu) z)qzm#vLVPa&02Z8jUqzg2G57^7TNv^{nc`PNrFgNEuk{BK+I^x9Yv3U@z!!3t@t&y za5PJwlQ|d<@+^U;cus=F5qQcoy(ZI1d3MKS7|KuE-bu5Bof>Li#D1rAZIhsbD<_fY zsI%v8lhBpJJ<|Mz%d{GaId+E$gbIJZlPiy#zY10>#Fhqk-IMZzasgSBWrQ*lp!Sy< zr;Yg+-Co$6?s_XFYFdM{s)XMG7L`yT!b9@GA1L|Y^$*?22b~wx%3M{GpN1-b)|gB7 z)f9KgJ%8!oLMN~*-hyvGrmY%U^IguA`S>HpyZKmZBfmk~JJVgk;Sg)7s@c?KK3&5{}88~`akynPk9^fNc zhn)O1v$o4;ssUE)d8^Gi1u*e{ju;Y2hg_4@9p^-r!#kl{>h@w~l~OVt-MRbbP?bU( znr^BiD=gPqGwWIz=-?o)OZs_M7#4KqYqSek+N3+gpgVe*sRl(u6zh!13ZnVx_X2D0 zNT95L=)>VPYSC9Q6_vvGJ7e!ECWF>I#+5y8NQM7|zauu+zWL2%zEWuKeZVx-elId1<~}~o>vrQ zuXE%ISCo$}cf&P|F)Pz6ps5rD7vE)uTn*{OB(}M#3@L8`Q=ecg1)SwI5vpvlUnMw7 zx2x51y&0ILqF6fY{j)EB{FPlzOAGc2UIs)n;|t9D%>w?}Oa)8I$8urdYcgL&07$Yv zFFtS)FQfD#&9o7qySd&P>7Hkublms= zOW$0wjP?G#O0%Y$rFK_x1@S+&=_bvt$Jx8gB4u};aO{=r`TX@%2?N+GD%8Z!wuAYt zOl{YZ>@Isa-xB~<1R83ZrQn}y^c|e&=S>pruGNaN+&L2OwGM9^=gMoczM1i>Kk0Ub zC+U|jb_o`7?b4`!w5cg`uc?4lHCNV4m<#CNv?GeEbeJcTwJo?1tmzxpIdCDqTBUj! zOC~lQg8d$9YTZ6B-JV5Pmh~*$(yO&rCAla9nE6QWd0B!;YsNBj4xHC8T-C%~de{Ca zK85exaPx4VFTsLv@>aNyEY(|mLi2i$3wosgh^28*p~o@!|CH0=xeU;Y2? z12;ENn#;!TS1dmP_u%Gvaj~EX>%3Ba%WY`Ipi$W6s4Ir`H06UwVUd~BR9ywlwPMkz zFw+biSstp|A<(jX_=v>J!f%dbQwddxLUZWC(23eLnG=}UzFYD+=wEFMLF1JGySck; z9E9^=@v-@T4)~Kr_N}J9!b|Em4(9oFRGn6S`On`zyIXvZdwuNz7IyybH!TKs{rVH! z(%pP>aT9ZO!aW`{*F&#&B{l`WuRDDq8Rp?m-@H8X5O?}=q_aPsvMtx_S2pxK%>9SB z-nWXW0j~EI+}_*X)yKd1_Q*H=Cffy@GNCDS&)lzn(EK{guQEQFMYP*A(T&tqqutpp z`oks1LtJuvz#YZ|gXZ(QV9j6%V>o@f0S)(y@gjU!zEYkGe{+@AY$kHO)Ha35O?>x(Bi>_{05=W8D9UIstw% zllemLdXPP_kV~Wd@aEe|GnqM3 zl!_BY$-F32W*mU4{74Ocy}com*fhWRYLBv}c=&O@)*%HFw3Tvk*fF98H@ z!sVqXocE5ha`_CU-@A+5v)~0{-o`F}Ka3chlxvwgL2fJl>*`WoT2s3V_3X{Sh{{;V zqG5TU2Q5_XsCOv@-_&20t{uACr?sevurP1&jqh=Dvrn{pVxOvWkD(&%;{*DL;2 zws93~jGKObsO$1M*L4}BtP8TL%R^C@BNuh4{_s#c1yei4IC|}r{c~0FCp(RMsGTDG z#zXCthuSHhW9^iBITE?VWBJN|Bw2xoD4-QBGnY)79jmLjZ4~ad$sT+<+H56U7hq0+vsSMvQoJNiW} zLnU)AWeh%1;1eXJA7ahXk)THimrArvp*xffn`{1XRZ|3&QTT8*oWJCM=Xs%9+32)N zW2G4;^Bq|aXc@cwa+41{Wn_M1zZ>sXbS~MN!uw%0r|K zD?p^Ap4HI(*9#(LWFS(SfJkAGrO5U_b#3p)!N72TIss@v*c-in0Z=I-Z#4~-QZ(cS zGDQ?m1~R1zC`FVa3*j2p_HXYm&UY9_MFtEc{ASM?VukFCtPSH~AX5xvikv$QWQu`I zA&g-lQ+T0iAX8*6$5I}h#KEs>l@9}%Vjxq9>9ZlB=MqniwLih)jlNo}K&VyVpm)QCY%nxHzl0aDG;Y@ky*1WjU~Q>4RUpi{PXK5mJ{ z={|ql;-fwbBGt?00mY@5Aqpfn0CZ;0aT@A=JXwhtP$}{VFRMk7hk;83@vYE=MBF1Z zlh{#I*n)vhG0-UnI>kVz80ZuOouav0N_IsSl*BA5IN~jTHmg|7u7aZa;5cC5R0{qW zI2Ak!8w1HtUFf6G* z28P8-rq@xORqBAn9292&vK=c*|J&*_upu27mQmv{Ea{vreHfNe3otC1eHa)P1H-aD zFf6*k%*jNcvs^3|oRO9b$P#JVGA%nGS~h_o=mtuEOQBJ~V6_;mmTqFT@b*d>lnXUs z8WflAqqr#BCk(PnE-0(8m2zMBBfCL%(O1YTBfIFRCFK!bMimfVQqO7}E7l9)<640a1)41?Wbuv?1CMHuXsvnlAG9*oM@bS0e{ zYCYgB3!mj~r~WsYCYn6A4Ni6s;J<<7R!{1*=M`o7jIwDb&#Dy?k+s9jWEnesl#Krv z!V!jGEK7>$q$4Kk!fq*0`VCNvytYkpoD5KZ3+5FA)Dnnsv`s^ZaOvlo_#v4|?9CCI z%C@gSvH@zLgDo3B`3&@6((dl^L6Kk|2p-3S@x;#9v7)IYVWc{MC3Gq zAos-$7>WTyF<>YL3`I+7Nd*s!?V%z`pwF>8pxCKkSCxdpL!uc`G>&7#x)K#6c;)%^I{5gLaa| zh2_ys9tb~_CPK7DPb*A~)(N*6-nzT z;*OAs6gL-ze$YU*vg&-Mud3oIYaqf$iXQFd%5Tc9I`3-;K^D$-m_jlUI*@k8wE^6$5BWqn;Mjn z?xTz(j06TtL>z5{B|>%GOYFJjjt8S;vDzwHab+x#Ox>V7aL8c=;E>d_8jAdS0f!tJ z;E*POL-3b3ub-by?cia5Gmt|>PHGxCL>yoP9U_Vz105o=l7S8}&>@-TTeT#?baJ5Z z*!IpI+IBy;yC@k6)*Ye&oh0V4aWH#A-pQpfi=O`~j#w|+10+&ih_?_>J~n38idS<|*t106z!!9a)PFe&3YiP=QOUxV0_ul=BZfCzECdvL6S2%%fX zp*DbsLf1>;Bv-Zi1RAO=Ct(ym#UI<^f!`g-@r)-}WV&VR;e>vWNjX!bTzq>%t_8>nzF)&V) zd7wc3*cWU)3Qb6`qM#Md=Tq2%0FZ^AjbBIl>=qJ)Tp}#@1WtU-#t+hz)HLfh;{Rsx zO=Qb#gHTRVuWztU4AzOkIx$!$TCz(jeprMNwWX{EVu-;wQ6FRVAvPE%isPZHE5#@r zoVrvV=_I9pb1eh!MB`1Ch$+I8}OC6QTKS~ zRrUx%NGowCXCKN1uUD~UpNqh$BZN-Uba8lX`FNo`3KDw2R>Hfs)z6I}K*~X!?e>54@i70`-y`S&xB1J0F8REgoi@M!noba!}kb#U+#{_nri*gQBrwBVN{%aV;0JCR*ivTBiJgE$GLhS(t-b5U018>p@yvb4B z@Fv*`KzV$VqYC&Ysb@9R_4UFxIX3tvP2ih6^S?R>(B}oL7%cNQ0pUdCrKS;1l0$4T zPDJrzFiu2fG8iWY<0SfHFis4{iKfTJQgpdkdT8@K0nH(mNuPvzNIq>aPWS;a7$*jQ zS)=8ieP;ZO3_GX}72%2DFFv_1;V9 zKO68Md(0dZ2M8PUgCmOxqf z6Im~tgMN~Fdjo!Az)v<1{6tr4TsmGynY8QHiDaQi(db47mo8Inpis(;vHHyh3Z-c% z6mC~9jf5i63|a?5(Rh#L;h-dlG%zTQ!Jt&#q&F7{rP2m$Kv4`RN){uQ2Stg0#O5t! z$<_c;qMq4eATTLOr{GG1r7&v^k(9ZRDXIOd7+@eRhF29dB{}Kqj+&Czs0?UIv!E&3 z%gbP4Teec7$$jakq2Rtb2d*QnG~{5;7lEG(!BP`x=w3{Ukggu#`2X{Dz2xt z_XYf;GG)r6eaQ;ZUZBhZd&)BSQ@ezLCTRqkY_-0$LN<>#<^WyeJA zQ4v$a>fs0N^fS$IyX4wKL-*|-&Wskz%YgG6d}9YE?Ey)pchoe0CPKR~C}<(Fa&Ub7bK^B69fdD=B2s2^vyuMR7);Zu8(KaaA*o5GU6ij|zt!EJ@ zUy{lMff^!)3O2-lB=GeUyNC=^zn6wZ$wbt*YJt=@055VcMh@r9N+yyEy^Q>m0ik8xyG7>`0nP~uQr zwE_nks;nS_D9npL{w9%)BxZJ5HxZS1f4HJ^dNzeC9*oL=*L2En4Q@s(%p+V0B}O^f zJvh-}6#lHSp#U$Jb32fonhe5=YF(O?5we6_2RO!DFBI|E8$KuJ0QO7itOXb+DB zF@D%26iH%bZ4L?v|KbLK!~l?NAOK0K47qL#Y16gN)9Z~s!kGgs=0)u?0hfU zyGx)AXHTI8;dXZTV6ESQQ$Kv`fL9;uu$^2PKqAB?m8MSL&sWLQSDN68L#pqFg68WFTy3}g<0vlQei%{9rQO63cTh&py?MDYp zDeob2e|kE`ssb_^dj1@~__LWB!GMaW~yO&YezS{J8^VM~|-WwzI|R;Cx1l6g|wM5$z^ zROgp6=E`!bTWYq92TaXIS;9`atix$3n`N6ye{Ko;<&w4BGPcYmD2|ownoFSh9kmf+ zJJ`b#$Vtqa-eQk zS$Oac7|q68fYRDEi+;cESjKd?WH+N1o$oWG_E12dUrFt(ZHXmYv}5C=$JXcmK*5UF zo4OBp@>Rxd4(cLU3$carYIN|bS7U@GfA+idDmrg2a6tfS!~_GC{q&K3xtOR2WovR% zuE(gGjJ1hj=V~&#DW_4VLfQ+L$r@M46mtL8yf`L#&#~*>`pYYj*>t){gG?suzlGC- zs|yrzl*%lSjb3^8s66bsxqYTaX5BS16F@VjJZ2$C)z>1N4-o;nU>0In(YlaLeGz^C(ED1ZgDXT7Zz%phf#z`?T87*~|_1g*j3m$+ybp%$~iN-=p>;6x1T2 z9pSi|@|YV_9`mH}@|fu&BKlQ~PFg6Bnc0Uak7>$du2Xr;;wn4Ix(;W#^)YdY6tPGq zXnMwB9GWo&I7GpP(tGS!*#(I0=-iqnU2)c+YzIcpbPCzG4U> zA_g0S6&oNH;+l_2s}f2O2ew|MlVeB8?^*cny-T`CCPnljec=5JB!)x7e;ts9aVMz3xiZe*oCnQgR3G+OvNtRVumcZrb6o~=%^EHfQfNQ+A zSHUxb7xRjDqQ?r12dN^S7ANXRN#J`I`0vqQK&KwQjmjTf(6^8q$9Im0YKQpJvv;It zUb{DrjEgu$>0obkyf-*Gf7u%z9v#an2T?wFX@?lm?DXVdaBzHba0q{$o*WNOj!$}p zg`Z4;QoOWoz5oYjROB0nKB;L)e^1uBq)$g@ciE$ovpRcDqI|QbS}IU_Qh$NcdYW1R6fF{ zH0kP=Ce$;QV2|q#6kywsgY=EB$^tDvVA(Xua&NmsH(eVw}HyKgke+_xplO34~i5bTfYz39`N5Qcqy6Io|+PW%5+uo3*s8(vqMGQ4& z+ybF=H`wZ`L@NY6#Owt;d7t5})v3004>sn)FbGchE)IcUddsi;8sX<Ryy1nzGSCW94e~oj)d;4tGcUj)#a!dBH zKtGV~593?cnNC9GDjbyUpQ4CC6c}-q6Wv=6u#6~d*dIMZ(et*+J@8JT!w-a{OR84|)Q#J@uH5cOpLRbE2Ns#=w|H%GOSY_v@k zZY=y37~x&T8xTsc5VzgyWLR4j5cX8+GSwF+GqcO+|RJ*z9x} zD?Bw@JH1s(6QXKLHxh%QG(F0_wXBu#u-?^@-aMOHe>CN`={DDnghKr#w7n`TCMAPc zZq+oG>2u-1sllGQe`c_4r;~m%8sJ|_aRZBbj2|stgKCzL$ii4OnyLm6jg3!7)A~_n z3NfzO_u)a-f@A~T zDZACHe`b(ZfEZ4@78Fv(YpXze7C2*wlYqZ%?{R#CXc-5DnDLA_I&#wlH7r&_v)wRV zkwo9D)xL7YV!_u0swP_$dgo|$geN5v5N&p;G(6Z-R3hpUgB35Em=XpbWwV140XmS6 z4UxbYw1k*Cce>C~uoJkaX9Cp$mr~`-hqgF}(|txay&9nPY zf4#r|3{gU!70w^04%~p`#~p-WdJ_mHp8CO0R&aN{Jv=(;_A2t8?U;oNFy!|NGztA?1#3QUqY%}Gz@vYB4e%_z`y(;2e z6r*rKXD-}-M#W57$<~}vEXPctYEQ@)e;;UICvO%73!-=V#l`S^`FFhl?|$tTjAE=W zRqHt3WjsG|`c>Uz%E@OfySTE9E+M7clGF9Tlj=!p4SC&+#BN?@zxG909a`VOq+{Kp zClzINvFucunv(Lfg5p?4Xei>)sbJ6*TEl%cy-Ek8POLGNVY{NhwWLgw8k-&-e;gLw z^tqW?tYW;rxUJxK(er_p@K%YAo#mSOSHNkc@9|xh??`r8a#1!d3bEXZk=zE!&mj33 zBtHfGtHdhI&d=RsB)`+fk^Iu>_WE!ir!64)W%gl^{0x%c8X)ih)T!@Xqcx^(H*N+ybQDZ>1w92?=UEI>{Y*{~j z%bvh*E}WAQjF|<7P1eB{f^);?Rf65;-pZRmI9_nHBS&o7p3NSG)+QK4(7VI0ZczSe zMfqDvT)s@)y&^=Icg~FuKmRNEy*j*|h+Z7RIoX>IU!#k+oaWV_P}$abk`HI(%ALbiKiknL(k zwtMRYDB$e!#-=!q8v$x3a#3TTcB#QNcy_YEGI(|d&o0XnDL7D)%hKT4X%xFLcy=ibjOfFTqI`_A@o0G~2By}`FZPE2f!qmUQ3 zl1Y+k!g!LXuh+q#F`^9oU_2HEey|Ss!4&%7dV&usrQfMWAEH2Zf9i=G&wU#rEK@&=v<`$VZGeL!bF#Q$3`~p zj-;-iON^^6XP#aKwin(y!R~YK#-E^umrKt(hzJKa%`Wx>eV;Fx8tRSOy(*K}-wY|g zJKi0Z>0M2Qtu2eNfBE&-M*4Tv;jBGDL{qta4=3U27)fns?1p3Tl#egxK2ChA3nGP1 zL!BATzd7?u((1T#nau5AyRg?^H8>Z_45cJ)&EO@N>6cAJm*8y-nv2!@r+>Y4xR4G3 zxxo6qLs^AjUPWQS%jQs0Us{_ARdH5Iq?I77H0+AnFeQ?6fAvYyfQHtf$PJ&_-i?FO z<;xHSu^cGMOO>iNQEV2W*Oh%_EtTCoi-)KRs+m2Cks%U%ToJhouy`t*L|AmhXF zZQwtwTB#&ua$B#NR5Z4xfYSO^e^F6UO#!8Xkue37f8rrA1(Z5+xYDUYlvfiby#=&T zN@<-dC?)1*#Y!k?m5S(MRhXh>qbI;ht{kzGnir402yS!zB&aLBgc3uzDyt|hnb&Rw zar&Y?RjTAAtRnsln_fbV7bMfCekJRW(N&aw+m%{LDN(m_i>WzFl_^rTNkz(vZjV;K z=X=i5e@mLB!eevocIp7+MYh4sDs1+lp2B9=Ng*q=l+wfU8~fV5Drs`>Ryu;aw12C% zpg&Het1I~iCb(&_t#_nZZOPpxTD6{bX8^0~0IXguZp=t78gG9X?bN}H?^t-)ayd`2 zh=6>(O6W=+$nfe&|^49C~#g{{Hhmw47fBL@mKmz4C{y?1^MUWhs-J%duR^1A_)j ze@E%0ERAFnxJx(KBRh4p@{r38phm_ovmjGhSLY_ncq~mpZUl3X^BobFvdg9tN#@A& zD}fgY1Wk>j=Cu+(%ZC7=% zpcF|V99RtV$DcbA^bRZzq-L9B>JE4(b5#e?_w=NRJnt5f7tXb z(JL7dPc2eptdLBgttgr;l=Oui`_A_vw! zV=OHB4Xq_pE~JifA%Qb>?9h2lt74?lZn-@?0UV!{cKjA^DsZe+1&$}RRp7|o?8+D4 zcv7MGM(SA&wRF9TZwwAh^^GQ~e{aA%&q3q*@QRhP+K3_?32th-3P);?O)(DHn3-Z6 zrWi-Oq)agmH8XJE+RCvtn_?Wyc@SAwOfilu*NDuT%lM6WMbucblvOyPlYjiE?9q{% zU_lYh@?S(w9$p8J{Uy5tUVqM#NJ+H;Z(|e?uy;0vD;|u>*K|}^4L*n8fBif62CL?` zQ&Wti;bI&L+FN#urX~mf$JFG=smUR=QHe4p53JtQcZkQr)OQeh!_;>u3a(cz*<#Y? zHaiJJBU#;KU~FCnh5=+VfNYHd&uc;f;b#mW+h&i90c4AZ!~n8sGMfQpODrk_$W|){ z89+AW@i1^w22RQVvl%R@e@ZZ0c}LgZ?Qs4KRVR7pK)7_^y!Bmg4$Xadg-aS3RHE*p z5_J$rh^7{0qXePI1)+XMiuXcNN~0Y(p>y8}$2W+CaX@Go&kzw~=erx$l4h;6#8hpH z`TT&2ZcW}SiV9#{esOVPeg0i9Y!{U~s<~vtG%PS-s6tipneiGae~XGRBHGxLy?c~- zt!B=NgASCfIgO{Dt5!)Wwr;5>qia@Otv@kcH$DBe55K}PMoB_w9a~sbgw{6)KHvHa zZ=#sFUX-Y=JlG|Y)~lb-uAJb(g*X=lW26R{X=+Iq;+QIWTNJQN6^ceN0TRD_jlu&) z=@J(o$9N;S(pRW`TY?}I)4Wy|aH zxqFhPzLYoT%lx(7w>^bGXE@Qa3`M;)rs&_*@$G6?!2MCn#J_-(cq0=~y9TMLOkfDQ zRH$`rcE=1|#UP-Uur;PeQN%hFf5sX#K7V)A?wG@PEg2ruMO5nnbj(~$YpXx!&Ske1 zXE`8GMG~~hf4~n=PNca^ORWcwQDB!%gqmtyvKYMz0jg?tgCzXZzgAN_8l*v2^KOt7 zSW|b%3ij3s5V+T}Ig}t(X;YypLQ08|5`>i;BGq9^Sorlx(g@*H3gWCU(sL1dP4ZyX zv(2&(7Y#yZr%%MXO;SuBe}s-rfw5HqwZVHM`Zg2w5;9JC zh5pQC*D1)YE|4t^ltK|ufX5|~1Y_l+L~$83Ef=C{;1Ry}Yc0V?xG7!&N^2ibCPC+% znCC0n#8hnq72}fVoGRD^D(!Z8D?=E{Lf+D=8_Kb4w+el6|Dp< z9n)1Ue+H$p>fOzm_GT4T99I3Kh;Es>JA67+N4l%i7QaJ!LEpEs#~x3eg64 zS2+0Vh^W$Hsw9yWhE8Yr%33PQ^Bks5_0}IXGmD1xq6+WUWsq5xH6%|zJa^#iR;ON= zR5-h(8UA6r^SYEm#6`hZd#a??-9TtBk{F|6e}!)00gV{8&0B!#(YA@KU)8deZ8Tes zg-ZxL?fpt(KDV=~>|uRx>vMmQqt*AO?gO5qykVHbo(~bD_&jnodfBVs`NXyd-6%^_ zSaC^(6;0XPoK>Nc`>#1v#S1sT_;AY&mUxprN~sQjWUQ4(pj zwyzIXICE~?TNlCzt{-#iEaLKtmVYbha*Hpf$lV?8Sy#|UM3B9JpTOvTV^61`rh<$J zF%h`l)LfQ)-G_z|PAe+ii0))>61~QQe-FQdzKe8Tca9?><_->YfYwdTM>J;dXu%BY zx4>V_QbjJ;s^;S*UG5U<@Ec05=hSavrxP@UGl&~-is(Wc`}-Lzdxv_JP_eY5-GkHJ z;nCH>!B6u9}eR__tl;EA6V$`J9$H|a7&;)Ad!IiNed zN%*jOAD!>;N{H@vagiv#UXg>5%c6Kwj)B17#oS?>|O<@Bp_ zML=?#$=TEn9yX)cqsU5)6?>G9u&MMY8!%Jp(Nubj*ORIAXevEQH_((RuNVCoZ`vfN zo8P%jrN=TQ6HTSZEQyrV8BC?ek~Kh?Wgx>7!44>wk0EHH#30d5rAI~8e=WN?Q|6KX zW6C_{lzEhx=#m1)lzBv=J5LcmX6BHt)dot9vdTJ%3Y0QInmK8?wK=+1YK!hr-AW9~FMgxG zpme00-eTfgu6ZHxO?P$?2_su=0SQC7DvKviX0O~@YA*YXtGOLnf5%s~v{uHutVNZ1 z-91r9J`o&$j|Pbn=h0vF)=s@27N3*YEU$;pj^)o@o^ZcmJBOXFihRjqFO9WyHr>^ zg~F<$+Uu1FQ!WtJe?)mO^+Zb&TZKcaF3!dD%Ct-&$(7fR<5`q3Zx<-!Js?YQg2HHp zCPYc1R6wk_qDHymVaov~$l4T5<-}5z6K`Sj2O(f8D4Gh2ZB|e$AtXJ2P6Va0Y_#4v zHn>H8it|)ZK9Pl39z7jEOY=nlQ3jUnSxyl6LD%as)+=$>f2f$BbXVwP{l5N2jN;M3 zL8GJCb`?a~Wdk0u0^kuWtA0ORTt|r!;r>>i|GvGmmjr&;;u2s)dRed=YD6(~cWa-f z$H5^o+!s$>1@94$&Rb>Qb0~<+x%F5l0T@nV~p$>S5@txzL z*Px2dB-6p|><4?Jkr=vbC@OEWcI+95W}oSqyE4vtR_4&krUljFh3@kxT% zhXHCONNtA|U?CBPWqJos`JD9&$aky)WR5k!fIX+Rt*;v)}-htex6dKId#A z28*IR7R8`8EQ-P%xdITypb8L0>R}xfdd+|+h6aeDRv-#oqnCkUfJGdRr?z+FoWa~b z{t3$5MnF=COw|}9MZs8a1UQ8P_C$j(Ezzuzf8tBjZd|{D2)@Es7j|!vb8=z|`4K9% z!{Vb)!UCHZVwu&omudLK9Wu*Q)G|KHpL4VQcO!|taYzApt>De@cItoQ zHoWMW&1~PS$4WlrQyl~mj1aNIZ+5J@TLgOu~h}L`Vq0Xd{yGVLsRLyK3 ze}e87D|4z4Cg(QaT&uo+?ZmaXQ8G_}H*bG=MQUbE`ZsN#x{ zW2`TrQw+HK;EO+-DIR1yEI^S;&EFgvWb*)p9UIL%uX-V_MRJ>F2 z99_7IDvD&)gIJZrSUi;q=dMZ;e?9N$k}P}N0sO5fHa{MrVg~6JhL+}etVvBx`E1rC z5o+hO1~o<1Gh2fsD4*XNq(S#A*B~h+&UH<4Xvt%hst741MoJJ?a)?xism$50EJmFM zMf&H!l4n6oRhyuLif6;JE2HYsHdiC54M9p!dfS4GDydJMJK$Va)}#Kgf8lIVlM02V zJ@{%*l~kY`e}QH0pji1?fFF{$=)DDK5}n|Pq}JL2rfAM=5?dlVbdbkuGRu-f&}%|` zt}&jx{N-KY@TfBUW!-s|xi;6*(;-Htt7}Y7ovoPr@=mj=!>hCYmN43~%Oa*S1j58cUHi38-C2K*hr77~J4yBvOi;)mS2>%7AY~HszX@`WCU@>Ur~zx%hIQD-X;i*B*jU{dVub;6&+$ z78o%iC0ctxgj~(~xFMATinfvJLlHsU+@WSI)F>Sefmh(9S9(BlkO=D;8UYhg7hoGMH=6Ei4 z2L+IlRzAgQkdmex{H7&&CqPhDlDuh#ta6gKDF@HH7x@z$zr5w{K~oOC5i|hUiydzg zzR8GKXb3V`p;&phVG1ONklpMvNOsc(s9?>23i#SSN{;(CeExRlkMVw%m7zTSX!TOIqJqHsNzVwVBaML=Y#pPqVmAt07 zEl8=dgTQ`NOoze4tlER#BGXC3Xfy|+r1AjKovOQYiGu80;%&Y4*qH>@p}qBT?CKhV zyc&CAZdRrayC7vv;q@ZDYb6V>lWM~5Ezh9iTYrJWe@*_XxJ_pnV+zweItxd@7gE$% z(Vc(~$eoQYfC&^QJL^cVBIfIsKx+pdp@0QeOY4lwEiOA1{NAyV6|{r7;Bdg`Qrh)Z zV0+=M6YM_sZu|-ApgXi7h}N6=E+%p22lHJPJlP={zwbVTyAR;3m^$Aecx9KuyY8x^ zWwbyfe~o6{)xk1pk*wbx?+zPUn)|_ z>a9O&W@inAohqwqovqc#^sD5utOWB?Y?W*Mf0(aqu2w(j>-!#K19dhgW@P&>1jj7P z180-T7zIr%W(e~mm^%}QGkl;4lJ!}E5}ej8b`U~#>SBm{uu3YKXt)S^J&%Zh%F4%7 zZS8<}laJEh`uuS#{vCL$$jVq992@Am_pyZ(rQH@T2Gx^Ok45F2q58{3j_-V6X34hR zfBSj%cfl}ck+osbwSj8M{tUag@7?|V*T1sN&_90Or}vPQHoB&*i}Ro4Pe)6GfA;77 z+21RJ@Uvhh7Izu$KclO=31LzWC0f&AsSc%F!hfOfpVaVU==n0#3<4s$vYe;tGO+5n zM_NT##&6KHMAJfC*4!XVz$I$!l7%~^e;N2u}2Y$eT@_hCJjd%T#9p z6?4uD+np-ic=^S}E4cVhbkv-@0qNKL@-;qt$;d=JeBFAXn zXJ4pKkVk}%qDLQyrR&;4$cWax9a`6p<5?~i06;7#sXoRuj8LlfIvNVle_RnFIS|5f zQahb#el>CR;03&yc>WlL1|g%S>ON9V>}eg2l*5%u1T3``vZQjHQV}dVLQu;!(u5#P zi9#l<{;&fNWXex*EYfS=;sl&+tTZO@VmRoert9-%kWlOPsO(C=F? zYlV*Gcp-v5M)E6e7rbS*f9r*oZ3!Y*=#Zj+!*kH?oinFk$ssOyVX-BnA_|qJxuiI( zpk(T9=Vd^AtYBNZa6!&i z#C`c8sRhXje=c6q0+6zLksDj3a#UNDO5J_ELaEA8l~R?dhjsMwH7iwlXi8PqTB;I* z^8Lrcz4=1*!i^|PDRNO`Whs+`Yf4bAZVAc_FED6rU){SQ2!-j?a=yDE99O}y1q1x{ zfna)B} zUa+tZC9ml;TVAl+Rs3?bw(b}0>ul}DLeCgW7VbUw&?rdbZ+meWzwE$(u2&P3)P^M^ zWNHbTT7vD@5=@m6G?fH5q>`XAVx#AKPM7KqQd=#K9W})Vm&<>Nxmar!L?yMN0URTb zxhY;)f2DXK4goi13fHPkp-Q0hD+ob=lf=2;o72OtTkny14{=XsNXU?=Z}#iLDC<_~ zlg}cI%6v9o-E(~^dj6GF(lf8>dzSz;R=cKW(Ynx+P{m6_Y_I0kp)XF`TqAm?iR{9+ zi6LB-+P7&byK;-Axg_a41HejF!G+o8U*zede*!{{>R>4xRhK+wg?Kb-1`S0Vnwl_Z zde=$L6I#*`JGr}xDgsRf#Ca*_<%7;>r>12wKH2ZoARjdtK5H>8m(dll?fed_ zWG$|iw1j8(4!Eh4M2z1Rf<3D)@EqZxy3q4kfkMtThP=@YBo%dp6t2ciHg8dsQc^ZX z1rlg@a8TvsTkq^B8DromJ3$G!4uO}2e|>h0k}i~S77Zw1_MeRf1+;Fab{PKhspm}G zxgYGJaI(9=p51@y{T(kfmadJ`0CHdfF+?8^cC{Wzd^N(_MXUD~YAxP!%U8>u zYQXK*1l+FHC5@QXnV?)Cytvm9S+0~BieglZFV5@GDT|cWwY5cMD|FqqMQN7Nf6}b* zQMfrOm&mHSW0bXklHj#%QZ@Cj7T{8|B}}!nR?Xcim(8lVU)_>eHFsa4+*RFNrd}CJ zyL^>)$tukbKJ)s*aBOOw8&rpje;QFTSb zOI%uctgLgaW#tqJvOj3R*!qUge<~|bLPfi5dLx06T4mBTV}UqU?N%I6qnQDbZ=1b- zF?(xNKyP86FHxDdsm)%i0&i19=pHqiq@_e$eZ7j0PIcdgNYJX{+Yk+9s`WNRO3A9c zO>t<+Q-V&_-BQ(dOH|n{Sq@dXN_&ZFy5*|qDpORhYHrDDxwVyeRbfkwe`>f*?<0*0 zuc}AJCUi`t61n>M7#gK^4^lh6pbhLuo1mDM!%8h9i zvQ?>Ht5Ul*QMdMGuYyx0uUu`Wm7~5Wrd)f;a@|ef2L!*X5@v?fB7vuz)fLno;mdpf z+n78&w!^Wl;-FU@^NzUle-r}<)LeQh74fuc;Wb|cuk3!R9u}a6sZ(<(K*=Bg?BsVn zH@t_y9qZhggTp`k3E~2xpgY305D-x0{LdY|5)S{WwTom>V5UY`7i)yof`qDABFt0> zt9O+pFPREqWh#UnHeVqujbdJ+oWfxn6~Zz*F%`m0g|IcK5LN^kf2&sw3|C&@YI(6D zUwu+14CDqfe}&e6^J-tXn9clPj$=UW+gsSoQB5!|Ez|;W<=nWp&?GJvhTz@BMCGW% zP$>MhBdIhdAwPO}&tj3$A+7ioBCvR_E;7~N`DBW`4cG!o~cq+*k(l_VVs zh00!qqt(IEUtgR@tU}kv0u8)(r08qEUVy?1P=i>=clssYe<4zFF*8i7_Nzu)nLKu6 z2@D*Sf3Yskt?l35U!3o-SB9l)oxw)@ICpQtxTr5N0wAFW(l?Zx#7$|t4wbe`a-ir5 zsb`^m%=NZ>uFRuk?eVPwvz8Du#Mt{=;4iYb5dD`I+J(1A(&2NhvWN9x-Jven(gX5D zJ__j$yTEpae@W?W<{Zo@u2<9OINnz`@I9nNVa~X{b-z2|UeuQtey*j!_ zo7k4D?a3od4cG;z(??igq@EX8C`0%gZP)mAj$Hk<(UoNw=tMIPK!u#d)Zb-lqbe`O65?tKwJR2O_effT)$Fn*@i z=I$WBCT7CfjX9BdBU6Hp-VDykEzi{26xMlWOoU|Nnp&HZco0)-Q-M)Vb`Rh`NnJlv zYcsRfX2J@R8*E@|Zkn2#)oN}g91TmZx|tQSTzp1Mb#z%!M=h<;3RQo_9ZY0RuhclJ*y`#gI^Amt(iIHIb<>^bvINlu2E)1u=DMrE%h?Ct zy6F{rEJ3pJk-cupr5)$Ifb6pTt$H+2DsLkJ57;6<87+Fxcj(ZZmz@v=YQ6+7Th;83 zrQ@&#GSfnF${w9;GS8g%Pim}CfC%X;lgV2(e`=yLYO+BrlUjnu<@{d=!NZsEVU?u9 zH7dmXK6C=~Rlg2y?ripJBJV9&4`HL3bd)?2huCN#YkuWjPi^l@ShUh=d%LG#uzep) z*YDMQ&*?PZ1AU!le4uZgIUioHgRI{|vG5muFh()f;}36MKOcv9is7I6_`wAyj(0a! zf3ZABip*v2ds&4gF#%w3Lxl!N?U6*y?Qiz{=6(te@C#HyF)uw;wZ6ga*!CXBc!tKV zH;y_$8S3=?m37U$LKj-aF7VBMpn`Xy0`sL__X6K8ObOBW<~(mCCT0&;vji_HKF8o` zdgf23D4*kOY6tn#BzEjArdjv|%FrEZe;_UEG;FIoVrU4q3x_3k(6j9kf;-IU)G|6N zzT|Wni0OZZf$AEa`WUD=xF+?w(xx% zv77}qSbhEX!gS*)2 zW<>z+TCpkl@seKYM`e|s&GkZ(SJdK}gLYzQftZ#%;UJq|& zyjM9E>aM7b@aYAEJVo1E8n#0`$(SoX@BApP=T^n5*sm9UR>H9@Leb{9NORsZm-N4ue_uPH4F9ZF zaRpAE3G1m;wT0S&K601F+V$PLe(DX?Org`hNPV!6_t86=ik))|86 z2t9r5V4(sKR<2U?P)kJtbV`1-Kn|GzbrDd3q&96+>DAIn<}}REGBXILo(?jE%;?z_ zQNh_iyFyaRCfXIkvTQBgf1^({H?HX(fE*_C$5-}jrVwkAwd`vm%bDAE%dWS&Y~8T~ zbQ1Ds)3+eCBARs0_wCVjHt!Hk2H1=GO7{vjDjW;0J(hfk@tsWfAT04Yjb7}C@3_5 zW>99hHRF+E_se*9{2SPUNmR}xHQvRc$foX4Ip;wfK6B^fmmM-rGpW-o>@_ER^y2lK z6iS*4n@G*_t69MzrIu2cF5;~wbMjqK%TG;JJ3HxV1BHpEs)v=DyVW~5wBYYctbg58 zlN|*1qvD|nTM9MKe@kUfW+l&NH90=3=&kB1buF&YWss`t99;&D+V0XyC8o<#sp&vn z#z1PiRF^?wDT7RD!IbD-ug@}W*J?wmH>{<6Z>Nq=< za{Vrqr7AgtTNhVl+{3LCS>9pXI;oXi$V;TSq*HmF#7!xee{)&Kvo@hRPUzN@U3Ir~ zYb5FK>ManZT}DYH5e}vMAN_nYK=4d8hc2N$vdnmv@|Zbknan zumFKMx&gK@DdBDuTX}1-zgDx1RS51%$>0 z?w>f$vb!TJgo9e7Tzr@4Tvn1#*OR1HUB}Cdk9&6Sf82Z-U)+jVdan%1u0$6qjk>h< zpt1Fh+h(DG);De&2sFD~rrYqrldH96$u>Q3hV8TtD~2JLH>8GDGY_YRE!!DB!-Cm{ z2g8Fcjo(JX@oU-D4HEyRBJpdSIGP0F*C3-b4u8r4fN`|_U^@pqyM_bVPCpmOx`rMi z*zCspf7#mFfo>QGe`6!2Ik6g!lV+w|U30I0lGOWdicNGVXoi6_#$UH~hupE%3>(Qc z?fNH7-cM8Pk=0u>tdKE=n$w=;C~RilGql_Kry`@Hre;2~yJn_7YZ&XOwo%)hXII#$ zY4Gz)Yd}AFRW7P&gNY&+O$}8Y1$r8o&ty@af7<6$R*k3W`Q+>3G&NMFR7urRCD%da zN+redd@En5gb%6gK%J820)NvHtPKbGZV(P%v|?y>fNBw$8bXpY(6?HTP1bz#Wn3i>a5>9fiWw%c(JU(>e>B@%-L_zisbv?BHmF z@eR@0!0>n*_z$Jbq!+gZ_EG2iEO5X_Q)ErYH$zm6ip!&|EGMa1Ryn={>!|{0lCqP82gd9rs8ca7e5C-)HL_S%-fUIJa$j+NSVT!T=ZB+i>GLC| z=2n-J8V>yI6{WWOsJig$$o){}JWeupkn=d|mc)6o&1ZRBC&-Bva zI0qedGJfj^b37qh+=l~)!rD3S9;m|H6GFuHd>f)UrV#eD{gpC0`0~*lAhYcIV2VP} zw(jTiS@_fb{uT}*g};8<+WB~(q@MI<@aio74~Am<4#PtR+f&E8o8NC&q5=LH!2h7& zZPU0vbkM5YCJK~=e_V*zs-ZnZf8=oVWM_%%iPE^5iwRz0F^iMzE}fgef%BgBYP!4u z`KPd!l+{iSNQen6O5OPRcMJfjN~1vMOJE|^;%geq9zU=MT)Y-(^eWG=d@SS_I@ow4 z*pdHs?myVBhq-(|By)nANvw`olH)u7&7Qftu*IMw^e-oShsA+GlH|SLf1Y0{KV>h# zPyoSj@U}{)cFBCavOW9GnV`MVMbV)I9##Wg)m}_oh^uqz9(k1z-qxL>&#-t;EeNv` znpg>M->a{Ld&iy>0Jx?nlZ5&0Qdsq#J%gQ)ET#Q_qHw~R&7?Z%wxTBd{`L9u7Zn5iy{pJYM_$7p)Qz5X?@L ze=MXDLOed6sBaJ;!sLQ53Sko~!6<}AAzTH8a7KAw>)~*2f6o^f4}ew)3aPEz zsFjVxqiwXPBMc@#V z=mVIB1S|03I=l(o86KIW=;42)8qYpRaJ)(V7Wj)<>IvajCb72m!HxOVMV74nSME*V zhyLw+@0|l%+&(&2f8q>&NmKCqYxZ;8);*q)ctT_rY<{mxs%gW6;oVWaUJa**@#~`a~l+TThL`c{`IK` z%IT-xPoKc@KAHL8m;co3eI(VU(C@ax4o6E+TbV{e-!+HF?N2^cnHNX;D7p>_Qrp|Jt}4)5i7PB4DAm^xuiLcn;k zjaxeEFzDGb?X|X4#MevsLx#HtBjc1@Wz|crmu#$Te?x+7eC3PM&3J5$ILqJ{^dSLVA=&3BScUsw2aj+~bEZS$*nYYQBYi4m zl#!`he)`_J#~tTmIjm;j zaROnZbKpXZv?U=6afO4I!f$E#rw+2&GAeV)3kq#Oi7shHr=nLkwYtjJ>f%elHCd{Q z@37TMT}ptoN~5qEc(lzTs-it)dtKpDYeBU2f0ZP)Vr!*l$tqG2@Di+6kY2-dsR%f% zu08kHZE)3#wVPqDaoFXB(U&>I&1N6P@$R3mXsu{Ey)1FdPGH8GNsSqBDKvp_Z(V9o9UYqB2< zf3D^xz$-5aR}=3I>kq5B;ai{q)m#-Z&@iZ`SqBDEvw(GsD!7)aph48!uzDR!LeyLd zg|dB9aGp0}Wv#-JnC1?dg|maGyR8LnE}Eve%^5JwH3ri(OK=01pn=ld2q?{`@AQ#0 z=`#jMbL}x>RCKfT#nCkT-iqvd21TKkfzaIex&qm!gf-cIk_aAV>sgnr$KYqKv6&`IX4<7 ziz=ytu_j_lj%#TolaWj^ZZV$LmQgJQPiHfrmV#rnRZL6TvlgVK@Qijhbpcvde+ZXt z8_$wWuYt3a|1qU6m#$x_9+kT8v|kGTLpFB8YDWEzg>16U!C4B#=>b}*p^Cv53(uy- zID8TuI0p@T!u5!dX{vyK#pzA0Q6VI8dQau%>pyT(%-aZT`)3?y)A{3I;y z)#azILLJAHHNi>ChcQm9e^OD5BXGWMfEeezuF4yz0mR~l{t-fuc>d_BE~p*^ zii4k;qRF8(u)UQ7=UaUC?u9q^&V#KbEBxz!f(b!EOz7HxxCizG2;eKyvtGtnI1k{6 z)T_x5oJE?NBG?XLz!|nT?-E6Bc)H?-wW;UWpPMeCC#$tqWO+9=^b{wf_Xo29hvVHb ziYa?9AMWC6dS^2?4$8|Zbf@AXU}bIcof9{4cf}5eC=`=V0r;1=e~EBw=OYPUhk$&& zb8uu`)Hgb@ZQB#uwvEZeHYd)BZQItwwv&l%Pwa_#^Sobuf86(0-LC4@r>l0IK704t zYcKv5ue-H*`~CC2#@j1I5XM8s_3U6>vzx-D?^fojvu=cgU``{r`}%*FJ^u%?r}sXD z&pr8qkE9UUwRi?71~a&R>;WWQJ|HmAGTmeAl%L+AdwkivZRm&~wI=9Y4Mv-J3MelDqr z%|za{9Re^m5f5a#n-Q7Lzfpmx@y@h~dyEBfjV1RJEuS+6lGe6Mx@Yqq=; zUS${d6L(BL%`EkSMLoKy8clDNuU#xc7B|Z}PwU<6?+;+XySo(lmNp(A|GX}<%z~tG z8TH%q<2=jheRuNgXmhaw;&k}ua_M3xif2MO)2Pg#@ahA7b)8vXKU-SN2$>?WxcSf*E7XsB()z}4n{9cVoiRlw`i(i}vbzY#=MrEyrw<4EkA;Te3B ztMoc*B%$5KfriIk#_(?33={9`Pr2rn!P`haxd1IO=2SmWSluZ~Qk{ z&2A53cLANA@v1~RN$91~h@~CpF+Z0xK`)B#_Q7g&xwtdicDutM^7+#2f#mliel<+2 zCPirF(L_Vi9CWR$JUK%wc`QefB#BZBt9%MZ3I=j4qtlE1$LPZcgeZDKdN0r2;8qPD z`>e24kf(Xb?YQimrW}4}!MOVDGFz24XTOh3h$+qGXG)JC|4=54>obE$M&TU`%PECD#W1}ps;n}z~Oqdj-NYqOn{Zxhhm3?ndrieLD(8+0rrt+&DQ`& zxgHp3C%UPr|$~KRGB1AP|*5CCFW!bYcDZSEcnx8e}0gHP>Ira zm|sq!B!s-kmaHQco>rp$CT?ye-31O@JGEDnI+{O_C54DMA^5iypoGp~)>vYYP0nBI z3X-F;Ht<_t8P1E-cS#CN6>1@i{jt8{@LtFh5O&*~K5DoweSh~d=ji}RaS7-u3w#d; z&@Mw=#6kZtT3j?~=kU9!B4C6o?LW#=?5pv#O-p zZsT+;AVB7KH4_H~MvT5}0?cUkuP`xY)$Wf+#0ygm?*(XS2<9kyAzI49SFPVm)kIn* zzA(q~UuB`2yp98I$J)1OZ=y*88yfAQ>%Bm&I~rrRqQjC_U3jZ~eAu^~rAX)2D8hi( z-IEh^sUegRXqlZ~R-$0e+wHKJF@Lvo&a-M$ae0uho+NbvS)G!C2S~5_-6(KxzNC|- z-ILv%`z07AHe_7UyztJ*`wrk}OUu0X>4|-6OHXS9{Z9sNaYn#EmDiEBKT;&F57Z(G{iJ@^<9~19T1^2~c<15}$C_-bddb;SyK}iS+2Ebob8pPA-*~`Af z&A{EozMay*T}3FU&tyGrxy?2wLLtZr0tEo~oZuWFD9XJac;+@^QiJ5PuFFO#k?8!c z?IzU(ye`lK@v#R@&PTo_q9<7X>dNBR_hj39F zJx3Nh=Y$GXQtZ|*UVB|D^YOuA4`qX-{W)}Mf1k~d!;eu#%^dDx5{zo+R>S$yBv>f3pX5&q%uD*&2SAuWWa6{Cg#9{A@1*FLPpV{(1@z@u>%3Ap)ibD1+UmlKY zv)XO1DBoyV(%rYDR7jv72))z|y~Ub$dok=TERVx{c5zRR;8?QKZlJzipESlsxLw;F zPTkXwxfEp&m`KYC*M|>oE6)RTz~^lwZ=e?vxQvp+Sg|n_=VNXBjGHW^|0C!t-p}F< z0-u*F4?d3E0L3lgPa0_S6^I@4JD(W<3KzNQvMy5e*E}omFv<|~l3M#OLNWK@(|C8w z8$|vv1|G`S6WTU}^Vi0P;b*Yy!!e!Lp;)S-HfK0d45En`0fLDd0mAEVfT8-&=M#bL zdy3TNtl_7;!M4!!$#x9V3*&Zx2tr2WKS+`#X-_`FF;6~$grEH3kQ%L?D*&9#A%RwI zF?vqcLvA3X>A(&14P33-Cyx3BjPlqv5?W88!I3q%+tYZ+1(Epaz>m6)+^mNi=)eUh z`$RA=CSt+cq`>iLGZX|xz}s>GxRUpV!(e-yEypDnNWYf8YSc({fc4lM-D#F zYD?Tf&p#H3;z`sAdW`fL1z^JnUb8awf~8oTLjM$%gQN9#Jy~r4uD3$>!QN|Mhcg9k z9}(vsOYrbZ>`{;Xejv`b)IN8E6QnV`_0i;TA!}S}jVA{CRv{DyWT2zQHTbXYpP;=b(psXKu9%RakfHaw@tJ;z)l5ku`Hw-{yUXDd_A@1>Ir206ZrSTdoO`3Rcuzej0`9C*ovY~fQ<`;=ps%_w?_XS$)Tx zjQ#LA{UbcH&X{;-6))V%yLRxc<;XFMW2lc-F?3f~h z2X{hD_2- zB3xErEs)r$l^{h#%_t=@x4|_y>8cphyBnJ%F2uoedx8-cl?uUgXxM|g78#!pG3KZI ziNt&D_dd(vwVR&|K}q3)lqE%A9{}J)y-ermX(N3UStLe#(rdxYIqF`DaOsr?`@Ojr zMFsVfBCBJyaiQbV^#~~yMFwV`Ztb;lLEWRK11B@YM(QcPBR6F4vUzySu;)}-yUi;Q zTHgZ6j7Gc>@z6QMNc~a$`V|y|>q#zHr_Q#)3U_*H$0BjIYHXP9I)yIpU*CS|`8z^A zaA-yNAnk=*>z5V#8|;XRsaqhNSFy8;$=_<${q0h5#yK>7FX>gF!!5+fG=N33h8)hu z0p_mJNw;5Q4N43i1Mhc}@AnGMJ8qlpn(dQ`+GclZkq&l_$)`&*bOd3a!rRcuAtL&6 zB#34jBu~t%ZC_G&E2^U)z3D(mv>&d)w7z2^-4WgGDBb4yeuj!3kiq;cN``F4dO_0q zSlz+>h+ylv_?^m%UXr)9V<;Thj!qc(40xeT5i3kU{fIjg9>j;m291{*;dA+PNy0&sBO*E6l?pkK}^`SXs&pvBBk)bFtkEqZO@e#O)epc;!YNG9TxdehkkN5ff*e$ zw3!{LD&@9t!KfCaPCeSokvge~fQQ!~PELGyk}#4OEfEyBJIAT9N8Z+#WHou1TqH>- zA(ny!-1I-3E?ndYB$>aFWEq6GJCLog3#@zu20;RBv2AGH4)d#UkR(UQD)PEOxs3+o zo>l1+`g{+d$g9#m*%1vlQyzX&8K}Q`{Q?ItLiVGW!E<&An#oPUw7jQFK8%ds zAz$A)!{TBR5G6t40w%tGS8_YZe|_u*02;b zYtTcnaJsIbV&5!=mK}-)`OhAMSKhZYB0PPiK=Ifs2V(~1}@;HI{ z>&Sg{I5-zM()>kNc~qq(z~|%Cc5+exN2T)5Uw#&yWZyHY&?*8Ez0H5O2U0dYeEE48 zlm*FWyLVKjpR;g>MJ~Q|IQ`B2741(rjU!b{X1K4GT zUu;-t`T*(+pbROtU=Y2o>((6cTDY{Va(tNDlA0B$ewYXBapDNKT2F8Fw7mD zYrG3=lVGC<$Nh^)H;pTuXimq;olEL4(qmAOm^b;#g=#DAy zxI#4Yw(+G${@vQ*fn8j!754l`m}}h@J@T47KZ`{e;J$CWv%v!b>XQF+aq;B_WDuH^ z4y`Q4;rzabEBQOo%ofu)y2N})N$j@TsncP8Oo7@4bp}-j6-1@jFUe3`0(GzA{q8in zH7)be7PjLaQ2UIISI~X~B~H)^G8uF7Syc)w=u^YAb+FxLw<*o17W9^U21Mr$p@C4h zI-V^^U})91sT5n^R3uOP_GK8x_yra2-ep5DQ{mmdc4PVwxq`RQiK&H?fGFt=!aCYW zw7XAAKx7bPhVv(~TCIu|;w`*cqo%MP36`NmC54;x0pWzQa|QgdWyLOTDO_dY7o0~3 z8a8#p!E7y|HG|VXN6VuoE4Z=?t{+`{B{6(<0MxrCo5EKGN!|(-Hs*{tEjw?R9P#h- z9XOaScMeyZ->2*QtlTK5)S$s73p0moh~HG|`@W5HDmXi@uwwcYMs&f?J_kp0<5&&; z;o+-hQW8CQH$MAYedYNkr|aIbNa+q;$CF;Y%segX5FpOOjG1R4GFONR$7I{b4lXIZ z06_ed0*7dD;`F$J81CzQAQ=R;nWC^|oq0p!wpVX>#_xAQdijh|GP{eeQTYI&L*3SM z1&tpZq6wZ>7THdZQ_<4K5y_WMukLaFzzfvujaN;-i&BsX&i1o|?=Di|C4|+dwfW2r zToQFX0Xvm7)Th|bLR8*?FeAk02fx8@1=Q7T3&UOl2J0gK1w_@U8O=I13@Nk+MuptL z6%6|8{f3SWVZrpa$B#3=Wu7Z~!~`jp4%cCAWRor_bmA}*%9jud0{6C}9F{kxNe4+S z4>z3q_;#2t=tAgy)W}Om{=-I`wQ?B_Q`fEYA~P&^2%sZQ z{96lI2YUx>-v*8Enx83H>j6AT{6%OR)_f}3>s4yKLGC z%#}NV682x;brQ^XmnfMS!o>W9X%t#+$d!`XLw%(tM=dCo_LP z3lbB&Gny8*9nTYpua(^_rMVW;6qd6WzoVdACN4$Z2oMnzN%;2%uHzHD8m`ZG4*cW* zfqE*vIcP|=b8~)6uQnyU5$GRZSSvHysHzNuS-p6lU_O)7BsC;WMhj;7ySgBri5*W} zr7Qx9f-G0kd%9%|A1WhxKa{DRi%!EVy(WK=pVZ$pR{gGmeu+F0pUSTkzo-Fna#fJO~IF_W8>K=`8&GO3<`2G65 zkJWT%(vJ&4ypWb08;4Kg63kEf5^}(y-ko2WU6DRWv+$km&1Ja-V(a&*o0|UKfu0I1 z_8o9Ck70ywSFLlI0j5x^$4f>7E)e1Ut$~;YvQ>aEQr1cWRlm(KHccYA^X%m-^Lw`6P6nU*M>YeBFB)nl>ipnjc_4B?K z$q=^3y4F8V&pdu`DvEw@WP!yV(~eATlSa3cSt!7?c6lh!py*+ih*xuy!Aeol1~qmf z8GBU5E5`ubzQ8w0&kts+*JK46`v{~DID5tmA^+6y-}kpoCHsWxeExXZZKM=w<6y`d zdqpUxP+CKbJKhi`u4dwLT;!Rnxf}bT^Os)5%*0yeh5SicIsz}Q{q7jn^sz{sREo5r%2|q)y{H;OY zzuf`o`X8pRXm9Cnx!H%9^7@Lb&3L|1ZlhaGd^B#J0C{xvVP>dgjuTlyGMsa z!?~H?E<^PV-n`a7A6VT^u82N~+Mk~7d5?)sCLFR2NJo$a1o+=YG#s`;lkcV=VEDTw zX)1dRsGxnBFQw}}!Ka8*q2;4k(Jh25up*T#!gc5DXml312A{BMw}YlQaNOfTT0DTQ zh$Hrou>RAP5i-7YpO@kHst1*~@3$muLR%3W$UQb&H! z!J;$x!41&=1{kcSk=5~ohL4+A8srD?8K;6FpNXU@b*w=N6*;wRA5b4WD5|kv5FDPdt6$-h`Ok2fdlmpwx zg7LcOnA$qKVGkawA=|O~oXm3$GgI@h+qb1*Id@B~@JC7y&KmbtcajB+aHRn3M1A7f?s2h9R32xaky^V(X|>~JE(-18=y zWBokDe#Io@kn9Hn?I|^H6GTAjTQX{eutmHm%*4mUU;7pgmt)Kz}j$-KU{9*A% zpLQTDPWl`g;;5OQ3C_g?RHCJD;t3#Ky7`dQ=r#L% zb%*4BZt*9c48~;yRsIHuexlWOpDd?&N00q~iRSh}rNQYW(~XRL2h2cl1P$jv(4Xv6 zK~5aF6pk^gG^0Pci0w8VlQG}t8y72rTwEt8f28)2uS5O_ykH+V)G?5pWF0zP*MK<7 z*hr}`sa0#qhUGU~kzwyxsEs~c7t3r0fq8ht8HPjCJu8lSL#^UKT*iUQeeRTW;6S-N$>|AL4YZ?Y_1iv;@@;nC(z)j@l z;Wn&OAp6DodJ-4xkW*g@S@jp?>$=Gs6h+kX+2?L#NrPUSbsPYj+J z0EXy_=)_~Erh%|kw)iD&HIE#SdJ$Si^U0IV@F6eoZ_|6yFYtYe^yE**RQ!BsIH2n4 z7R6K@bsJ@<*IRL$EOFepT5;|UkCsd=JS?Ou=D9B2a~MiRBk0BGLKJw)2^`1Dw>`(g zM3@S7n0G`mUUGb5e?3Xn7q}<&7763L;NR~y$RFPh?|Yv4$#@dFK!6SeVQ>DUeMxJN zghCZ-(SzPDXZu|6y7IYsvv;rzMIx2I+89XQ|M4Wd-t&^__^iemO{811P&_5>JD8vT+okcJHnPNd#bAg5wt~#ni78}8p?@P zK;5RvBO3KR_02*DW+{YhwSk3ru-v8bqf_$5<|d14P*J&tVDz z6Yn$>H%U9Fg^E$ZA*G7ctJg4Ky`({tARP}uy@LgcipOYV$I(7U)lnhm;j>Jq`_z}l zy#oA(|5$OEmIx5A&teKz@es7^TQPZFgN)B_s9q#mlQ@cl@0lYo$DzZ_bD;$o5T|3g z$V-R`Q>hw}p3v_>vTGG>fC%OCn{yho4$7PZ_uOO!XBWn3$iKcp!^s>;xp5lEAJM%z zzH6d$(NY`=QLrJiK{!beqYvd1sPOUd5?bhq-YV_>Pi(UprcoIi&nHGKR-`(r=Z3+B z>=+6Z$s$~mmVb`R#*nA_$pmc2gB&uD70~+I=18)F3yMRKr|MIRfJ-QkaS8js0etuR z1qYb*D#AJ3hx=3D9x3`->>>VE879#*OKC>`i*PQZTZ4*oGAK39lvEHXon?ZjA-q~j&RY2`kD+a z?vjcB5hJ1*r;MmIeiR|reY;`$z+SYJWOkjEgghNHD!U#55q%1ZRUR3gLk3LPdPl+_ zp*bT2BrZh!RPLB*cM*ulJYxZ=R@4uvg7j-iRF+^t35+BXCEBm=`J*Fco5rX&L4w2d z_|9JfL!kd^cBD1yeT@18JJA`n#S67XsIdEbq&0Z{DcAxT_XB(00XB725;apoKw@8Z ze_?dQg50tblL48ahdJ7WjHnRPLJjW&+f9yaqlzmH9*B}M_cwhq2E<;%B=q)Tm5s?P zh+nWaowENTg#r3y$-Bqb0Ll8TAiDsAvB_!vIIwp;OEYOs?S!8X~2pDC%g z!T)CFd7~xS2i(dleZYeMO$;Kd!E5#N>J<#r7T);T$qT(nPcA7fy_ai%P|&@Exu}C! z9XmZ3&f@Nn{ybTQzn!rot6Eb#lHUf-IYCbqY$H7|iLGP}%&Hj)Rm-;Cah>fB9n^-i z!PJFfC?q0ByC$=cBF=Ah4^Xm_!rHDj(j=l7vXIJ249b{`p+}_PvXH{+Qf?}G$05v( zQwSXYr(zftqY^o7U`JcewqpLj$c_(ACu88FxDNs3)t?<70H^bJ z)9@=xjrhLK_kA5UO8_tRLGzewLE-h!EzB>D3&!O~%~Zo~oe+Kh*lCleboid+Ki9nD z6W6>fIKE9LPw}$^#=>sRY1^XSbGd0CVMVV@gM`6Y3thD+;Q;geY^I0anbO{N{PBs5 z3XOhbX694s(B8gzPfNm8>8xuK@Q-Tj=8ssxyoK0698^+RnzU7(XjHM*dC zl7K8eJC2}ME5%%i+*@8a5!+259f6=0wa(o>6ozZUWhlbJgE$T>v_CBGl8hzRG8GSVXYl zQUh;Tx+7Jtu{)Y9>|Buxfnd!CbeQ(ZNz<^^=&cE7?NEGJssf{|B9(4f&W(IxCbu73 z;Kd4Xi%)~?QLgUAhnkDwah}}!!WOfEz2Rw*W724Z;Qvj6m^{5P;dO`HM}*6A&PSd;>Uo@Gon+Blh8;krwnd|TYQdl|qM+VYoG>8edB zF_nH^D_ir*Lj5Q7Ehn3A5av5{)_Gf67RRn6vX_>!U_g>89XFc7d}!D_Wj0K3CW-Ah z7g`i+9~YX&TDlUojtmbPEJnhm7rKdPgA*addn$FCU{#VN$q{;!T5LdnMfq5@(uV3h z6_7CHffJ#KJ-k@kSQy+~NpeO#E3Fwg9-m+H-kH&pzhhzWhA_Nc>+}&qmHzb}-d5`9 z@xQ>H_QtmUD*4G`-3c5K6fUsI+a@{W_hg-RBDm${Lt#Jsnh{0Yu5YM~g8iS*JVoLB zrQ8;8;|u+sef4|UgP!sm#m3{@9g_uM=s+6n<3FKuuXx~OLm@bnc(=PRo#-3UKbgp3 z`i4HNX!wRscTq}>PEYZUJ{}?S_>NIeqQm`VILIb#P-%?o$2-61RP=}#-!B}rC|%WE zB+4DV;ha*T?JsMs#fz=~j&}t=Dbg1`DpO7+RGREjb|_-{K-k~b;{F`oAqM9An7Nn; zV<7qPNitfZCkl7mqqpd5wLS4_k+F)AGBA)bi+4;wW2p=6#)85eu_aMblKzBH zJCj#Z*ex#_Cp5iOuH z7HdM#hr$n#!X;Y+(OQGGb`IM7`|c{Yx!GV0?Z_j|8ZH zzLiHKY2#4N^qJ6<0|Mbq4u}`q6QXCB4LzpQD9!_qZT72ZPj>WilFLY=J#H4|dE2$k z2K*4JaNeJq4$FQ<;-hP-(j=sGGoFg;!*nyGbV@I+`}rQCg>Kf0qEyS;A<}rChZ8t0 z$Z_+ETc29nm)X5_x{O(c4g@Y-&qKHfA%S3bWKsBgfr^Ay0OH0fBK}Xi_np3+SgLE= zO98HR&Ff|Rn9v7Ab5NOillsTg#VxY8I=$|ZW`;!#Qg!|5G0<|7Ad+6j|*)O zDi6l1SIal=VgjtY;kOX1nLyZ8yElC4NA`j_mGjvQP-=&*E><{gDVDUGUHAO0E0Q%wTq5$$N$ob6?(Trg;+?3QaEat3(ZV(`)RH?w)iD8E>Cg^x{`6-! znz$@W6WXkeo$EXCX+_iva4`hsND;(&Bm7aNp z_#m$wIEEV6;Xkk7Fj7m7Cb&9n!}BUKSlH){QBx=iHpyg&SmadtdFwsaUIDuL4-K}C z9E8WRb*5N*{`U{{3AE8|Y0$I5B|F7>xO7$8D^qBlF_0oFUtT9x-rvP&Xgnr*pOADmQc~aPT z;(y#XPk}pM?wieTzj^xf7WzI0dq7kPld<<#T|iDvxMIR^Ll?~JfR=C1&H55+xB7x3 z`o2KkvT@9d1qp`W-!D>W z-=l`X|Mw!5RCgB6LduYrCD~05Yvh_Uqb__5Ek?;<&(*m51aYRQ?diCDgMrC3 zX@Mf7+w+!YvkB#r?~2_YxS7nV920RhNN{T2*1}8BT3wB{=}c)YmjnoU4R*w}=ZKig zZ(BJ(*q;87?gJWg31drj;>(V&l#`;yb8M9IXbI_BEtKS{*hpvzmLe?1c1$Gc5HD26 zdeNC|k{I$Cs2OybZ1*m+W^x%3<{)cT%$B%`CCrvJ{?e-IcMBGC6TBVCwYFwm!V7~^ z+s)NTQRdS-M|&Ou>QetV#l3g>;mZ}Ic+jC z`I7_5-wShNte5*>toopTGTi0RV$)xY_n77RO2S8~cnMj{Edml2TW@Y_3vN_IoK5$O zbLLi~ZocY2PRujEhOphFQ4%`eN2gX4ly=^zoTO>=TcnG7EDYv%&#JUc;uf8?W7EgN zMx{s&TdXF{&WV{EGLxD*=X@?Ld3q$#O#b)KOMeI+HIPqH0XnbQZTO7XA~(~Spg zCW9=InGr}SKSzj-oZyCujc~;#YDkSJljW6wM%)$yLiI)i8H*a5z6Djj%sK;F+K)zU z<32V_IpaQEFu0P6TC&Aj9MWeuFE-kc2e1j{k4)U)Vj zyJ8Bm)QJ}mEYV;&ZrrBSkS*gV)FhfWRhQb4%%Li&dfwidE#qxQx(TCsoZ*8?EHC)} zIPpyxWEPpd1|+JiYfrP>+y~reehV7_{w*EZ6>ZqqRh$dX_H+2#^C@M}mI8D%sJ4J` zxGu{8#p@l@fIRl8;jfjG4iBqmBlaIq|J1Yo^c6AITAN~;-FBY095Bia4BGmP*YF$L zwN@k9odvGH>@*7$E1~sQEs-47k_@6JX)9^)C*)!MY6fG*81QAlB%u_M3rfQTgyhth zRf&u$+*Yl=$!XuHqKNwVmDA1pMK(bg#L#{_ga#?G^c#Z&CB{g+${*GPPmuHHaQZn- zo8Lt4On!ehG$NQR-=qCPQDjmt;|8jusI1O&*m3*39632rN)3<73-THa(i!A@#B*n! z?GRK$Lyf>nJW}J2s(r3 zeoq*ApMW65s(^fC{kn>brx7!)4xCmNy{4gdHoh*$DsBc7!0>{Rehv9I?fAhxCD`-1 zqq=yX_APhZrv(>W?E$|$EM5R)G1;|7^>7Eehk-{?nK z(Vnx$R#)+=7KlGSo&`i;pCyX^Oox1{pg(X>5k{nvLX=Ms-S9GRd2#$ZWtH9Z^Dup-B%e4%M zgr|}FA4Xv<8mUTAt#oDdpk!#eSPTu!eYvnYozUdOkXjX`Ltwa8h4Ih^N`rRzP4|1h z%zuOE{gNwcN@=Rty8p#g?UaXw3)C%qtzO%j$oEYJh^(eFQuQd;k)6yy&ga#V$^ zZzy~`>qHsV{kpz2L@~xXKW01ayI)Vb4co<-*+ps`W;}1B_NNQJV6AiFO$%OjFLw;` zdpS(!oI}k5=EDZaKBO;v8h6?eD$?FdJZ~<}S$UA}=$IYMp9=^&>m+&O1W*jvIMggk zCV7}lO0JK_aRInnU6L>GKl*yFtR!LVTN*MF4fEx$I zR;_1Lus^3+UHA*huXjceD}RLfk20`Bod3Y@A181D<*Pg!Hb^PGt8TAcX!zy<=DHY^ zny5mITj>(53HiOu%wACFK-;vuUk-z#D1ojfD(3>qSJ&KI%Uq^*d6>eol}VUFGp-d> zLp6l4HUsh~DeQQrH6iTeO-0*&t<~fTFpN!^x1%M$h&7dHE-mXkqZU}&Uta*v-!Qhp z`vU9%6oE`ivlIGJys!x68ODE4Q{m5Ej;${|T_bjV!QZ={X+3;~^3KjH!(ND05_q@Z zYsq3$uV3unDJ(XOuQ==VSq!i~e%uwUJ5tFFAyLA)ZP}wOXb-b^5@+=T0czrV<=?oFCjGiyw4AeGd#5e_UajYGis# z0Pf66C1^B1c(kp*MAm$lDh8VKAFI5s!8)qP^C8&UR4!QeeMf~;%*F($+(m?^y2vLK z&W=@2COJp3H)sZ!oBbuq+kL`DAIUfOg{L}f%mlwOpSKn32qN(zyBH$&!oig5LaU-F z2r^%>x3H&K$gdVLzH)n#^9^NQ$%D0;K%l6VEc>2a^={ldE#j&q;wosU7m!SMgtf2~#^o&{J4-Wbpo(bD zo>9=>d;r(bo;o`^UoN_AriugQssbOAu99((bKEk&rTO4VCLM{~1n(bx{aZty%8{#3PXrNeI}0 z5o!DqM0j?17qBC+;wwAo2*h2``cZ-MX^p^6sG+=1qGHUtz?DhQ`8PBFldQF1<>^54 z5MM@)zS8FbbT5Bn8;cI;l@XGwWol%54pQmH;)$0+5;MY_7-iV)R>lvS@pb<2Qb6>W z;vvT1e#BHb_zA)MOt9kYeMEJ8RGEqVB1O`OVPYT#gM2hThGy26WO-)EqIv(rU=OA9 z_Xfi1`xeOLmm`E^gLJROw^4f#90}ku76$>xHS?f)n~if10X+nsziZWS=Fyz|Hrm1Y z0`MI`H|dVtof>;MIMALWaw};kG+Mra130$750%<38HC>5^BrA9g}dsjXMYyx$UcF) zW6Fb*#J{oJupD{b6oTcV7%D>_5{Bb9#<1vm_fD=!r=HLnMJ0Jy^_FZ1JrlgA32Mm~ z3UkO~=MPR~CC0<>zzlH@7{lZ{A0(=2oLyS;ZR@@N@|LVCTe)lRdi^f;_ zBFj8NVwshq;DM^QgG+{~mTCL!pj(-Q{y6KEAF4FsLhWjtMjVk}&Hp+UR`boImQi`t z5GvaYOhQKy;|bP!5xcAgJNQ82}kH`L$Q&K+0TSwYB;Omda^buj*T-_O7cHz6-_#GAag{`SAHb8%$vF zucbY+F9R_me``T)bxl>z^0Wki%s;%n+c^NS#AsERbh+H1LoSG{o)6?JNlpemVQw zBd}3_|7FZphBwg^2$>9K#eh9aTp%nKh?yt+r8yuYWTf-a(|ghuK7rF(DCt)KC{)%6 zxGt45d65<~(75EPh`+DCAV35hc`~{qyO3w|=>BKnBO!mb@iJ=oOfI8`76;78JZM%!wLWc?W<4#3)fhK3b0cp{%>Ovm*Mm`frG0LSTJDw6N3ta z2XK57{@Ry#(6p|lr{9EIP&eDy{qnw!PlY91;+1O9fS=$25`H_8i>^=UAM8H+;wYUS zqo`Sv3Idw7|L5`Hz&o7WzW656e`owg^~_;ug9jStF3dkJ7~sLBgtLpDmX4avA8xT1 zTX7C;lb-y2Sc$Fj)SQ?;2Eq}!n&R>2Abds5^cI2BZIu?q?lK^=gV=X)@~0C$+}=n9 z18jKo+DPnX$&<3$`Qei?tAP!SUwi9w4AIq9WB|QejnEYD@%J~-QxX~+p}gk;weOy4g<|9;(ETe8@hQ^gBR_sW6MQ^` zOA(`ukYfe<#Ak4Of!RQd$bO~RJ)a((gE#R4b={Dz_X8s*2ssl0XUEcm`$s39b^fia z8709P66Aume;IQ&?EK>RP!`p1ly-$Kr(@RzyP=7<1pzk;W2YDsTHOlMH@Da8FEyn+ znkc#5%Jtf~1r`05^^WBKa4Y*$on|nRR~XTcf!OI|%$8CC?KUdrhN{C=IASlSP`xTY zRq(jOL%PT{c00e<&^R(#l7pD^X?ZPjJJbPohLB~)v(WD;dHjV9srg9uY@Oih0_%=r ze+k@yz77Ln^melI)j_>Zl3}lhJG4%yf;SNlZ@LE@Wi&be?>69gH=El$V|}f^-)khDz8pP3$F)Q&hGBOyU%oO{|~>sztAV$*H(e;&|b;UgG4< zSY=3>WNWFw zD-Ap+Y~)V?YEoYyYIb0X^ahSK!MBVp=lcXB* zH^Sc9@qe6ah&r=)y1z@LlGj)f=|5!d$$qH``?8Y;4HVwxxYy2oVT>sHq}`1m`m`NH zh5rv(Zyi+C_l1qq-JMbwkOl!s>F$*72BlNt(A^zZX{04YO8S!0lF}`RAd(XDp6loP zzP~?yGY;c0hnao%U3)#xde*b{xtSdg;hF7sleXzW>xP5LgmDB9I-q~!8G18|(~UAs zknVc#JKzt?k@?@p+Wry-|5&}QL8CvBrEIL}6kB_ItOs@{l_~L2c{|r=dRMb!2YR^1 z#vg6T=WG=+N0-MXIZvD?4uTmDIE~*0*vCSNMI5Rb{-lvoY3`=P9*DCnZ|l{hpCa8P zK)(tfa7Gsc5CoS(FT8wD4RGyV8WWWtnJ25h@o$Ewc`+WyO*$bTfRyo4CJ0 z9?_^Y?qn6$d~88Wv=?5D@Bx8{gA0`ZkYbZ;QN~Q|n5!oI3Tdi%wG~{p`6gS*Tf$Z% z^l)HsbVue0^D=rZ%mE3(WlePdj?8=tX}uo1Hc<*klw zf8gx={o&C_{4co)5%>A2V}YMh&}Nr|`IR}_Pf~6%o=&41zdj!QxXdXLbBAYUacXLx zSHIZ4E-O@$)Wwy)4cPeZ!1s)q&*%=g@S4jEfrD3wGg>v*jOP3#2woS&hpe-j)ZgLY zr7p=K7U1K4P)Veg?7RsFFPd7xHZRjCvEf)Tlis(xA2K#_9XK05)Q&ByiVb`6fXU!% zG5BjGoM**x;geWU3K{i2)I!>#K#+N>pfXs_IwE6cdUMpknKuA2IOm7<)J6#A1w09L z?obj;b7q|1z1QjhMh zTfVFLMe3gq+i(p|+YQ=2zKLtnO%+%dnl;2hQ>K`caDoajCxO)uYf^rrm1>!`pu|CV zngFAd9QdJ~;Hy(AJq*~%P!Scb>Z1X33UK!E6YsG3`*4vf(Gi*z%j8D#aAkGkuNP!x zze}wla_9Zle^qGe+ci!bP28DO-MUrQP5FL_-m#a2#FA_$3!xs5>@a`+V*+4~T`k?c zCcaJi5W)P&^=9^G8*zo1rhTYy_|)#_U6vFeK71Y^38gn!O^kMCr|Wt4-fN*m;TE{C z2F$BNzmArn#FGvwrmBqMdOy;5_}kKGXD+t&Wrnjv zt1HykSKK#vt1F#sqMWFHkXk2N+AB{F4_t3J{qU}&{?QVFm$mb=?9#T);^ui%AM*h{ z(f2~Rf&XEkEhmV9TM{|I&`Z4ZY%v4+16tUhp3pZ+DrjcK{}%&oTe9gBamk(XE_6R% z=5K7d6~>~>rev7nT**7{ALB;05{Rfw8jl-DI@~4r{k0CpJvxd>`ARLGhq^eE5gXI; z_0k&I%1%HXTQF%e{Lh$$c>5Z{lE02aP2+JPT`Leoh|mE5C(}c_G|E!~^UwZv`h3?~ zd&rfE*<07ewSLOw%U){uhSa)}XFfKfC7Pl`A2uy-y@bVwv+yH>HM$#pYp&AlTG^W5a!Au0j*y8=b~OVq+ijW5v@dL(T#7mZmN#>X*`0ux zi%+OsD-oBk3xX<`TUKiXdz%bUIRh~`laN(SqdeZ@vG``|zX%+)(>(c-Kx)a;KJNL2 z$t;5JEB%uo)ST@cE<+VLlQa)5t(Orj1=SXB+lm6W=2uXIb2tJ_3-@RAWu{yJX@w@{BdAU&R0`_ zH66nzS8qIlla0j49urD^hQ?Dp&lBzE3DTgyMI1VByKsX2>$aFvf$L`49MknaGhUvi zH%@g-`60==?aK3;pZG*y;5lBrD5=a=-{V%ug?w_RGrKA%fkS+$>O^QWvv(EM1qkun zgl3E#9}&&iI}4+~>nvE*AamYjIW}4#8^Q}KvpU4=2zE;mDN83bLz&aS+wEpL^+L~j znJlZ@peHlj2SA+W(G#UtTs0wAaJYX9$IYMsrs`DYaU@O^479rR5%agCAI8y8Uzi({z5tnLzTxdeyB*hZ?RoHW*5Hg*p zb-mW2x*+6~PaJ%j3X}ZFG$gGHgVTIiB_+wHNPt2g*^8Tkkcm-2F7Y|N0=)j_bM~G) zLKv22rlOfcNCxZg8)KKyodzsnJVN15STq~ylu_E^!3r5KHQtKhF|*{%%LKOXXr1hU z(c$y0EK+=Sw3QGduaJ7BR98+Ix|@CA{zVKW=J?wbgEEn={pE1~cIqL&+tf5`R+|Ed zKl0;IwFL%G*Xhu_7+UA|*Vd!|atV%qbdb*P77DppNO_)M=u`M|6}?l7wGH3bM#~6? zTDf;lqLSu0Y8II3(X;ZkZB>hO1k*vCOOLTqPRj|o63p~N(tF8xX0+xawUC4Xs?R!L zB;~l^exT7m8zcNZ*7a+Qyr+KD96(^5E0-{D(S=z`k;)hqsjS)$7HJ)JKc^`xiE4^VP>gIK*B@)`^Ki|Z!D!uEA0Ap+b;R#J^quBIR|1w}V{b@aI}vz7r-w&AV8SSrR^w@X+u%M~86%3<~pFP;3QQY%C#RDQ>Jb zn3fb0*&ixJl{|DXA6W!bOTfe`u|QU~bgD-`7=oTwLRr>^Q6KvB@0XNO)k5>=^@)l5 zH!25~J7lXeX1mqzbfsO+7{Pvk4ZI)VKjYgP~7>22wL*LAL9pv+iwmnZ? zY_){e6`1*WPDJaRa`I%?!1qM;`R;?N=RNmLxik9l0gXd*`}#>u^|{CJF&V3{jWbil z^9ri))w6f69dxlUl%LLt`W+wK?hCe+HY_Ezm%0Wm;rZz$&$L_aCXdjji5d6O&aY_( zpHwavR`=1DYo?7ol}N;jn9Fg7Z5R*Gud$;YG6E3-qx2gVY8Llzx|UM?DAWrl?cYnF zcb0|4W!aHVng9MiW)|3pbj+Lr73=PCzlS|{L@HGrFGUh^o|Z}NX?YRzZGHW~(l3?p zQ^%Vf4qk0o)K~y;pJ>Yyv==8_pr7ff;IT7msEaT>&ECOZ_G%$(%Q;{)xJL; zj4T1Hg@z;Z`%G1HwFHay!wHEQS>)6lky*e4q|Rq0uUL&oW+{+{~m3s3p<<_r}-x$h73{`Ah zDE&;UE2xL`+Q?-Q<@hJZ;bNU6!RW4l;F@q;1I6dGhVo$1rPnIx@OVWRv}w=&UgRwP z_T#&@X6%0t8%m*rMWK=C)9-TgTM=t2>5FxJ=pcbRYhL)(XHH6Y%s}@l1^@TQRpNt) z7jbXx^ry@vmNLXH;T;$B7qh$5X2#ilti54ERt;)JR?!sC-+mfjRH_B0i17t@+BYca zHOGI!);R>srMU=#>WuVj6G|)0o3~ zFz%15-twFEXVj2`#tP3MK|u@~-EqD?1Pk=Hk+_%bVB{VGvmdjJ;9>%9j2lDT~`wD+rqxU(KGTV z!NcMsWaH6#Sz$)*(?Fz~Cd0XN zfKkL*WiRh%M&iL^LQNA!ceXkw9UD3Yzad1MB z^YWF)UDhJUkdsq$A_wO-&Cx76AEUJ#EOv;`n(u;1TJw&=W155se*T%96~egyE4g_` zaVLfU0LT$h0Svqe-jc1g!t%lO^d4#4ca>nZ39>&{yc+*)f`AgrcNkcNA^D2Z!h=mxWN|SBGv(g-BfTl><>{pJKNeZd?Q@Xb4E5=oXR;6_2>tQRM*kp2lMEfT#j|Zu( z>l`#C`#2cl*=sGJR$Z-Jj_>+Y3%}nJO%P$D`4LC-nfm__#Qf&tw`ygO@xm|t#-a@W zVy>XQCs%*XVYsW30K;c1nVubTedpV3s6`&wy_4?p-JZ*75lH;RP*s{f*WIu`a$r+x z%+h^oNAW7z!|kWt%Ekj1+NyfoQK-D8g=GF(8v>O zNsQQ zEqOz(4*_^SFCZ&EOxw35qZ*EQ?|?U?_z7z-nQikfe=P|{5?4j>;@yh6T1wuYM~<{> zMiA-CNw5e@ZF`AGPFko5rIpn79g`>N)6 zFW70|1$*j$1v}V{iXE9j+pPpZ#>b%eH7~zZMMb!}?+N@ww=6UadyodwFa-+qKe6~A zAsxQ->XtM2kFF)sS8R-vgRgEcW*>7UqUN5Zcl1(>U7$Kj`Tr&!7$&;=QeD<1?#bzQ z1AeM>#dWDd0?VEB+|g2MXO`p~e&XST(P|72h*h$sH26v{@MUWI`vBUvXT6S-`fYI! zik4x$^HK-`znooOdLsMAA`({~Xd#EdaF#}?8wPOwH|U!-4t>$`TDUg4LhuOOI-8j9 zC&)hOnarfC1~lf^Mf_o(j8nlo8WE!sXIFVzJ}nTyKBSh>gQZ34oc4fckqN$_wO^3m zW7yqPK=(!(8ZS)BFAOB@%vp=8GPYlN9JR4&kixUdJdT@5e^s?vV%a5Z`9yey)}hlR zR2SaSg?{_kV~F0E%whGt4b6HUEUh1nBMe#fV|~J7=P|4w6y2l59x?Q}`D$t_mQ^)a zJvZQDJ!|hHi7D;ckfdb^dcoTI4>i&22$^)_Z}zS_MSu$6lHZXR@aA^&AaA>nmHCC{ z7a#MdUjqLAJ#czX)})$#bQs6rilY)%Rg{YrUsYsM(5t6K0H+$S{8bV}1yDkFC(P_m7yx>tUUgDq%d-_QdKs ziP__)nyDD^A!K%RPLclYXE(sRiGnL#xGGrm@OgO#NT=Ut^ot%T7x`SGnds!#bL<9C%{> z>-E1nNF{8EFD=+nj~~Lh($ej^TQeV?pjS`6{{-K|U#wp#msDR>fhBDV9C%yia0E?Cva7cwz(x;I6|;^i zb!9oov*oz{p;?&{<%xt?Cqg<)^gQaGp-CC5$*b z9`M3`a$>HwDvDg_*%jQLfhZ8%@KZY(}3UMgR6pVxV`TV|6 z>3Pdu1a#zad^A8xaTBJ9j7GFFR$b6liiq5P%KftUFcGbxICLcLBvhSC;zves1H0Uv zV&avTm?y(G#g8eDJ;5J0ytRpZ8d6-?ck;(_Z&KnOt5T%8fsLDxMgxUgrl02z(z@L| zAoc71u&nG7cUt3{36>>yBiCuCE4|kslcwyp2xav_03M5o2JxK{LO`YvR3jJ)7^2?9 zVB91j{mn`3{;p}nxN>239F=PAzuf>lZEUVRTE@PM@l=Fs%wZ3$Fcqj^3lX}o2ZiD` zv(f@$RZV;AW{!*)s>tySi&2d2UPh9N&71UnZv^Kmyk@-^6Lvg$nlprc0(1g*SANM-yD#B=huu$k6l109Y0?P++)$D_`iW_WW&jrWr)zG7;^YY6+gZw%qZzZIYDasrMmm%NXqK-ta)JwLcRdk9bOZq1Z8 znRastF`0IW*SF|6gerwrk1tbn2V+2G8<4E!OD+PDsIbMJ#!62xnYZ5qrE~{lV!4>!axk&C5_BYSv%g=({Lth4)9 zar{AX00sRL;nNM{c=z&N`ymh6!pXCMz-;dja|-DnT)uEp|$0L!Cih)&F(6!ydWO0@Gu5cvm; z2kwXU$AQH0ji=|p51t53R{XnRqOW7l1zimQ=k+G2WH2w`=StcxY^_H2c`m-J5G_Sm z-KN?Bf-7H~(5yJ`Ny>!)N`5kSdA-y(x+19lU=QB&FHb%06VBLvpU5r&ikxKv7tz35 z%yndK4XZ)xzo+X9;Jr9X)o5(=I=wn`3foy%Y@2OtsPLSOI)}4uToPIxCP1D@LI6G> zMg6o0%*kqqs1NT&Z`@2VkA?()75+N{RQEzv{QxlxPyo*83Ih|Uqp{|B_!?^$mJ<+J zJ;~wi%-&GK!b%P2uw#6~b+OD3)Uylg#iMEgtFjk2*95ed-MstQHr)+_fBJ7{P1&S>Us?LGrgI{>BZzI*uPJ#beA$PvqiJb)9Nj)|?p~8{9nu+` zLcbY_SxOa}AAeCLbx%h|Q~yLh(PG{<@!jL=qr@yw_Nes8Rq=>sfceOMBOin(PXCdt zEFh@cs_}WoVRyCYqx|JZLigy_){v3@8+u4OU=c0x@o{VKEo(h`2-uKaMco4aM*Na2 zeY*bh_4f^(B=x`_ka3g&{~wA4@|+aY1p1rHmn`uS%tDSHoM;YbZ1TI$M-8?{F#3VW z$31SUL+D4m#~2Z*m&kvyL00nj$JNreu*b13dv1y?N%%8ly#VM#Ap0w{;izZ)TMtk; zL)81;(+$^HsBTYR&H&_xJ%qQw7FS5vwB0R9dak6jknb4A_bMK09i3j-NYfh!p1*#3 z>;JkofWLI8?np(kmnCd+78_vcj6k~Bko)oHQhZ78_knwNeBoPSEy;+hl(b6As;o$Y>`<%DCK%fK7`XUtWwBG&GgK2;e~{X18PA6H1E z5GKixS@fLYUK}Ho%ppWOK6}WF&RuBJ3W*k+0BJc#r*a{x z%=1b(Nm5SbB&C$`alGeB4-1EkRGg}M;&tjWk80DbpFQWjqE`9xmLv5XuLB=amYIq3 z#_(Le3NXB=REWEw(HM|7W?7?i>)Q9bSz%=i^TuZetrjyzqHdpgqY3mp7p%K)MOJXT z&dFUyLL*Oxb}rB~?fZN#Alox%-d#&lK~(BrWz?C7&OY1^W|&Z5o)^whl8^oU<8e1k zj)-=DfcIK$GR@mxmushI1^p>lOW8)UA{GXD;kXvm1~@ai#;@$a(E(u{zZ5+laB9Y(;&<9LWHc3`a(ff<#} z!P_e?DnW34El5!IEIamtv)@xEKq2jh@l1Z(1@TPZR}wAmwEnLL?c7RDWK$Par2!}h zxw+sT{WK_Emnd0Z&~n2;c5WqPDaR7zYy4D;^ey4dohP~l$OUA&#uYr-s(d_n$bH%} zXO$0@ZWu>@dMmx<^UU4Pey+~-LQdm5M}x|4#0a`79sFk+KGi|QU?`9j$^P@aFGN=Y z-jk51r0i*dq3hdxFT0eJhz%n6Q-m6%wfsP_7x5cUpH^b&10>*qDoE?Uba=&d5Y7=IX~J!W3P!) z6e@9t$Ev&1*#VT@L?vi$e4_6pFDQFfID<;SQ^h*^BG#X9>~~*^wOMjsvl%Gu#QpZJ zi8NDZk7_bPnB5+AazC0_wHU8HY2Go{!+p_ZI9R5})}h zTVEOoEZ)>QS%5e8NKA=10=#AGU}v5$w-L~x9Z~M`8Yw{AYO#Q+q3D)0ks}lD+U|{Pi-`z+0Wc+9q1bc2>DHCNl0J zumRV9XCBJ~tEny^6N6}~R$W*wH8+R=@-hNu&8yg-dnLVH$)*HnEJ|~UKLKN;xau=O z@!sX3bDUCp7% zBk_IUQG2XS+>G7jw0XX8cIQ2)HmeeMy%pzU8Iq~A9yu=OlPX&{aQ`8OB7Xejh4?C+ zs5fb=NE$Ro%((fDlz*ELu=$51Upq1;%4x_19g=6KCQc)%Ejll9;9W^RMMr3n?N0|6 z)sRYzTUwl@Mf(Sw{S6b>l;&n7#A$@0VnE6m6O&(Ts`^Vy5DLooPZ-7J{2h_S!GgW6 zSJtVp8c&$UfU(;H*Bu@kUt7>MPeoNXfD&FT65!=$cg5f-b53+cE^t=bo{5>qv~j522e^&@Y_ zqS33^l4>~sSHO0OQn2g{+X7RYfb<3Ri1EfWEQBR zY63g1EQIQe`5zJ0!H(<8>9R82m*{F5?1bB8Xt{8&$=)|47R9$%ydp>RxdKQmkC*q` z6Blpk!f(|J@33Q!G{pTH%ii3NL5Ga684kZD0BdimkiY_GeT>0(ONt5kNS#%Z|Es%e zzvW?rE0T%w#vf#yRO!X2Ecwq{WA^f?%nhG5q-4H>Yo> z7T8*UtJ?nJQNBg=*WnZ=3&!_s1|F{U05k_Rn^~rGc}T)uQA(s(UB;j`w|TuZS=6Ab z8kvtxukT2SCk^O)GLmbGwVgp~syqpC&KQix)5DE_%H<9ECVWZb;l7E$mT1NfeUcgZ zc*jV_rrUSs)3lE7%>{x#{py;Ji;yz_tgVd7o5>*^aNiI@jkL8?O$0CO=il)~m}sUJ zU5(lSV^=2C!umPET5+K1$J1ea2XBnjxvw$JDQ~_)({A_Xk*YSXBB<;2^w8=vVs+ng zjk0peJ3^j272dY1R~3TwaaEyx?*h@KE^dCiWm$;QL+b6a)B{MnUmqE)kjYPp6P=760ON{kZ9i;rHAvz^9XdzPR}Tq@MzR&U!{H=pJuU z@6Wf6S3Ra^vquI;HwLf+89poBC?HY+ds-PNMn8$iU3J6Zt&{L7%79OD zy!xd8Hw7jOks2iTIf0tp_18?xlkd&*47qD63rlsd@%x=vP7muN9DW!e1~GwUZ*u8d4e)+!$;-8Y%-G@ieK0Jb8;{PHjkM)_R z?Yrl^nqUOw1}q%i&TqYoP>~U-?0W%6neGL5V9JX0nuhUOVC+R0s~X52w|?i#T&k*Z z*7#h_P89zecQEf5on|SBco$J{_V)Ci#Pp{Z=0xnK1p4^77I@2ZhpSM6Sn<=K?myWc zzinQItLt2@Y}{m=1m^$QlzE-s4n~c@xj|8j@D$DUU+!Q6t9NE@CBlZDUSvWv!c&0w zd0)W({P}po86>Xkn_})j1%@sN;TXF7pI>2GRY%{L@-nK)<;L>9mdXVooUea%#;FFG zJtj-Z!w^{yt_xe&A!e1bYl+BcInn5ayRvwVSw#2QzX(=Xyb`<25>O-x`~qIpKIaL! z{sEqb9OM4MQH*7-#zdN-T~#N*Ibyi3U1V;R#?|$%B6Tfp<&@@OQY>&q4_%jv9J2+Wqjs*d!SHPp>|0 zU2ZtPPV_zn|TtTo)3+LdtOXj=(pOi zh>{73KH+0#RIR@00<^E*z-VoCpS13k46>I? zVuiFmBW=0}`NWDvxn8F z4!x30(N)||8Jh>3K6%U~Vw*4~S2u!Vb}+&?CL%@ZSh#;(oo4=4*GG7#EFD9`*_0&R+c?#2IiL@Nl+%Oh%zDrA6SFHM`IvawK}4K6%;?9l7jy?%aOpkh!B~Fp z`tcjyo!$u_1eX@~Z}|`NvMoMzk@T=s$h-Idt41M2Wy%R-6G(tS{2ZzUnj z$Vh?~nep-|&Ol~tB#tx%HTUeZL#Kcrf;|Hp5`>txLxsE64Lmyh4)A)E!TW#K|MC9+ zzx6-j6mI=LyL8MabEfJ;J25RSNY$|cz@JbEY$%^j-PL@^v=^6S%$LbB?Ad7 zIj)c3h!U2K;0RNPbkZ|7NWCV&$^xC%dr~9q6$$U zEgtkxwl=y}u9b=+{c}g5mCY3%1g>+5I41o`)iYoav=MqRZ7Wc_!)GmHsQtiU5qHJb zbb=1h9|P(blM7TQOLg1HX1mD>Z967fYFb@WU%zZR08z~yQQva@39L~`W?K4Z0EB8~IB(o~9GesbGiI`stt6$?Mans{XxBodc-h*7~p zYtb3sS;QpBS`S&XX)!UV+)*?vk|4vi7i8z5*IZUo^Gl#uj1x-%mVCGrV6`mJ8yf$% zN>rf1VD#r3K}YzcPVxd3)zXKOu;8+=y4l{v8ft%hR!QX!p2n8i+huH&JNQ&rC^2fd zmn*=Mlxu12g5Ddxwlf?ah!T+lI*>n0jRq`#?lrJX&ZW5FT*fla--w9|!+kyr8R za;};n8;4pL)?IHcis{(hF^F5;N*Y0}x6vvxKB$xgd-{_YEbtlO37D~xvaLl9ML)uU zn<9>$NE#CUoB*DHp&0QUIzB~~Jw(99rHhm_yc+?IRJ&`TqM~DENs2q97X+|DEpVTX`2I9+5>|^n*UmAkf@mV2cwe=2f+(@hLFpQbIxt7wqo9AvfQA9M$gl$C7M_mT!aVM?%hi9H&Dawr%n@1gltj;fiuEgZe5OnY);ahYGy#^CL3U5yD1 z6WVE!O1bn1sv=#GZ}_?3ey4dEHpvh^xggEzO5Uu?O5FLSx}*!{_4FFF8aCwkpKQM! zZuc6mN4uCV7`YJT2DYaHlO;XQ6pMCqcb1P{uIKJ3SED%u@6?{^;HZ>*xH>#&V0(Zc zy@xp*Ws{P^>NO;83i!A{S>f|(IIqBZ5a_a-Xdp7gbFtI{H}bw-kiuIpN?I{idcsmm z@?N0l>b=`d;1EQ!_%HMGY<;o7v;(D+O}Kp~owXUjO*d6~y>s(SEC7*s=Y^iAgP(w{ z__@R@`G^9W9i5CO%EJo8cmB~=f3!8D6~BYM0C0A5ScgPuyYQ-br;^PZzBKPS94wRY z}}!l5CkRxs4V6qRBagJK0Sk!Gb3xbfw; ziA%DZpEU0k&K5fdD{5>CRsTi>MmsJQ|DxLA6GwO3OoG-D59Ur&w*^ZhLcTWgc`QQN zx{X@~m+uj&l|x^qW5~(PWr$9flU2D-H@W@#!edV{u!#cCqA3=aziOt^sKhg74iiT@ z7I|T$l4`*cBPFcEh~{U~f^i+jeUR-Z9e2Nf_d7E8WaW(9sC(MSx%ZK}0^E znQD-hVEsNg0}Ow_5t$Cm5&Jhq#V9Zj=27a!%?LOk8@k+Vmc`?1q~hmqMVy+e7fMgz zt{>Bg=6-eXUO%YX>5GHGnv5NIo;ZP%2K zFKc`Iq+4(a4ZluP<;P>2v*EyYl-=Z2+1s6~aw$7g^sU6VdO^N>qcg)oLR3P%(s*q5 z^f7XHMi;bE$b-j*S(b9`*oe4oibT#_D+urZ>-FP-MhymdIlv$oF`O-2=8OOuHNZcL zqnSkm@W4<$@)|h;jiERqRVdLJR1|RPOzwgm4fST{-7Sltn8k^Xgps<_3qKfD`kK~w zeY58ZDbwWf-6{v6NK#>(KG|)OpJy?wLiBnqR)@ zc4WUpGEa(1iq-PFchX}zYRV;53k-V@U@`3jA{$ud;;{M1j{DM=d**_RE0Y78>$6Bo zRVN`wvMK>Wb!gB`GT|(3&Q>fa+)vqJjLZre6Au}o0-)Ytk^lBKXUXv8&*SpU`qdav z)Cf@tC<~naHB0-ZhZ2cvtu#DI_?*hYoX$H-)-*5e4sxjHczX5x!mWx4P%8yygQU5C znMi))w3a4~&;A61PuUCL5hoPWVZQkm6X&X%3(sY_m6VvDP>A(Q!TDt?#(ufTxaYlc z;Q6Cqp<2I{H~!7_=;fj%|6h#jHJZqib}ErhXbnz~e%5y*wV5r|IwRT{J1XcBZsfS$ z26MrisT|nTWPs<4k88QuH-OUH%(RD)Rc)s~DHh+2kj|BseV=i?)f8r3sTdBv&CaTo zO#*(_B<2$Djr(J&XN1TTZwSs9wq>b*6@zCj1>f%ydgMOf%DnYsVKW+xN?`++HmeWu z)K{t0RQu6wSqV!2Tfu4rtKSAZ8&SJf0ahk~ZDm5jbNgHouGejwbgpM=<~!7Cknt5< z7NY$lR%eN+g%Ks*^%EN-& zu|X=3CGaacKeSm8=ivS37(>(d2}Y0V%~_Ls8UHQu_~#+s?Igm9fdrxn< zGcz2a%|GI=vSj`7fMpYoRM|8jggSSdjTrg387Zx~wwiC@mwvv( za_s@qpHjH?G(Bv_$B|}*t$d(&`xqre#w1Hb+%iRtt{wotaU`JBzG#WaO%Hbg^b{nG zP^Srf>!pVK)7A~wIBJk-(6b!fwUCA3wV+iUV)6j{rm)kW&YJb^DxT{s*-3GJu^l+gCK zK?zOv8}B~}4aR64F!g6$LfEh4qObjH)NL<`0#vMP9t|pHHh)g4MY#PE(q|$3f$KSN_ps^k|<)3Odt+| zS08}0g5j27YTA_{ARBF&G_Md&zdN%=HJl>JfeAnbbB8>v<()h5_||082TKcNlWYkM z>^P0_>&J3y@F59GWUb#qZ5ykxWl9RKMnUP>2!3dd=5R1g7!#_kK!CI*9A!+GryhYT z&tU%d^Q$=O9n@wwXQh4g8e zj+I&g9%u5VL3|HEgia&>ddgFZWSu~ua00$EL6mCuJ8aD$fV4Y2EfMzBbyyT~u(O?j zvTpL6vV#IO{pNjex3KFNIUGgE1ta>iZ%UjkK|Rt!t~)kp2CW-xPN@BocXF%7v!pR7 z>Gi<+g6f+vuGfl)?HGL`_9`Z)8`A{))qm-#B3 z#WW8l@dOEdPcXf{DaK}0V8BPhF|_%wTre4`hc-azLQXC=mf*EiEGS)w$dFt^kEREd znGXu)iekXj)Mj7;d@o)()Z3I5M*dSQ5^^(%FO8T+7oU~F;b(qO%N%?BXE5ZmDe3}0 zEH;108K5@%CoziwC?|Y;(j>D z-jL6$a}G|~i(}ZW)?)G(R7p$u23VWnwbpk<^mhNaO2I;T()T+i=Y*rBOlCA7S5L_q zF#{_Nxq?m&V273U2SZ4+clfDtj>C{Ul0=FccF}~3Twx1j=z7V}4Eszjc6yT!^tePK zbE&lwsj!xdmVa~gC@kS0Ew$U19UDKcwj+t0_7a64GN)zYbO?ft-hX}Gk(1Z|mDY{6 z|F6?~F$xaV=fQ{SccS=E(t-45vh(?=c|m&3@C+^9&I?50OZ`j`QO#Kpqd#;6=rO8rM0T-0}bW?=|S0Nkcg`%QX~6pQ0ciEx);Aqp9? z09EdB7>X}-hLqJPZmQH;Y8@9*C5@=pj1m$YCqIUxRCg9tK(xM9RYxHLo%3z=Cg{jV zUj%m@e)ffSso*Th;y6A*{%yOWJB5Bc`iis0o6M$n9WTbbHe9zqbXagtcm?vrdD3Hp zmcc=8GS@@DjW`};YLnvNOI}7OGZ^rdht!_UNt=xB1|}tv?jf=Vb zSgNj}{6|BPuRRp@mY@lM!elIzP^6R;s=bDqx0P5?@#MNX!14p0!(5Kb$kew1%DXIR zV+wQz;;@@*d&?dD$^()VoRcI(-tjjh=PeRrfXKG1Z8V1s?hOW(>7vogOfy-7e$ z2h)>1ktIN6M2e)5RTEsjoexUpe{FTHNPzfcQG;c#9uZghDilDtOCp3v96^z5!vYzS z9$tRCqg-e#0wJPt7{a`nmM%(LsjNOW(p8O>Sq~lxd{tk+AtRz^5x9pEG|*yD)GlHm zqCevRCzb{Y+#3d}$ZIys=q(%SM-i%weikBXB)>vVXUg?XETG%~^P(%Q)f6X~7Y7+Y zgMT1>HNaMDXzE9>NUJ6(yh728a2)~OT0x1cbQOw#{{I$M`EOx)8PRBqv@joZk2Ps( zf}#%WXE6w>4^_q(?pjGlXg&l*-KMhd7M`F8*UE*;%7wBJ(pz3G4cnm)e#`j=+Q~T4 zLI-HMy9`mUkff3yF^JDxxJ8xffFsKUJUr2nNB3v$3n`W?^!7;BES8g<)-3d|8=PE% zHJ>3SY*FH>UWFpYB=NyFinqwMcYzE|4-eYz2n&rxBt$k2LxgV>&eNZI^WmWb&W1v@ z$cUGFRKJ_Aq`MPVi#7L--qOCjp~z1Vyp?fJUri zyU-^SS`p$xSEpQ!`29#PtQj?Ej*We^qKNIry7E1v^N_9}wIToUHW zcH$VQaVCMMg2_{XL%0n99yhLr63? zBG(1yK1v3o<=XJE245XEi#^^R9QGjH%qK9asX<3@cxvLvz7CJ#30c%46&%{YT$bCB zz94=ChB$}wP(yZWk%W;JklvfU&))4FFnz?~P1GIT6-3Ng&8Pn1b-y2@;-5xQmqGFR zC6=Hudg6kWf(x1m3-kK=Q?{QM%YJnITmVED<$2n9Pq&8zH284}-yz1378Ix^gubwk zUj+^1zhEJ2G}TxR{bl~LzQv%95;u*utFKudAVL44dX$3^5RwgLS~qG7((-QQ*UHfk zs%`dM{yG3eUBVo88Zu^2w{_zRls?NX_&|msIbA(i7KoFY^&@}Tx)JViUu68{kcbLE zJ6c&5lFlN<-$Lu2h%@4IF0Q+L61!Z+$43nAE#KE9n{SNvV`mWZBp6N{B@sVIY+eU| zU9CRud`aM}{ZU!)XZ~EV5YhPUYc{(6b)rm$Sdg84%$ zMcdn8Qf+hvtT)3e1irgxL~}a}7BYuVfWV&DGLL+g*#GxdJM_YF`Y`qzwMkXi-#71{ z8a^n71$kUfes8RgXNk`Jsuoy96&#|ht5uD}QI+4?k`wE6$L^lnCp`WV3VWG3P4Oco z=27CV-lXp@d4Do@$HUy)!#e^voSG=M`0@WMIdyemfL;nDWgMH6VPnF>Y`# z^sYk41HW(7JnT6WvuZ#(i7#c5txUO;=*xuUEVWqnpu?hE8NLsy>s0OR=Q${m(nD^^ zk#>*S)9tH)`F?Q-r>ublFMSUEU{QBU4FE@!jR1}l9eGE)Z@i=(ltldzL6@{cxU4+mcJS)5U3{j$PskA^nBxS6hl#c*%S4&0>Xk?(HRfs+m0 zfBw#$6>;!?to=VMU2}L`-PcWH8*OYfw(TYj8#QcfTQ_QK+jbh;YHZuK^-bU3_s7iK zd7d-R?7QzhXRovF+I#P7gu|>6RCcOEscv^$_4eTr>VH9254dte%YmvgS0nP;3@CCe zEsH*YkX2QfV--OQ&J#&78SvWc*K|ZwxU%G@+;VYL;?P++3R%lz#{6({Zu<;^RPz6>Vc z|G{;iZn_(E4#@in@JD(EJnG@YrgVQ`Kv|EnFuy4{gKYD#Z2P)VaWVoio?ypG zc%I^OztJh-H34OM`^5@M&o!Q1g@4P9B?|YcN^CD-tZ46U^x^{aqzq3{@&uWHo!nyF z7cEr?`u%`*g7be)w(qg9##w3Z9c5xO)6>^6`^#%_j4b&svHe9c8Ec3ZycS%Velygq z4mbLx02#bl7dZD{t>S*59Z+X$ScG^uVc+)#xpdRJMNv(2Ri68KFE{3eYI@rwJchP&mp_O_5Fkdv|3#RMf{m%ugNLRHbuFZXFa%-7PK+XZ2JWVJ?$1}vjY1cw&jz^! zfpW^Z@B7bq-u)}^*>;EP!GVs zBY(}=1k2G&Q$Rg{MyO+|uP?vW2nUDZ)$*!=x0Lj~%E$`xv6Qg2?Ij_ZQ2+41ncrZr zz#)B%#^w@3LtAYnN0I9Fwz`LxLGla@0q5BNfZXlqNU_w$^OG+ z#-YZAs3@f&8`;Rx|Ip9IvM72`0=Zo<`4p4%tE4SE)J>l0ufNDQcd#~owyC9~b)5L= z?hRWC#sL}?b)T7$U0mPwvD8C8e@d^ohDEdNlP=3TUETscM;1rE#RSs(irIbmKthdesKO>;@R@1`NT?pxBH2`;5UL48*{OV8x9-^~FHOa}WWcT3eAdg$jDPVtf{d zsedC#sp|YNN?VB`(yN`TO0Y%nRr5N25d{2mF>M13NhCP#Bh1)0Wp`#7Yzytq z{aGW@W;*nP#YMyTCp#1kmZ|8PKP?yGIo6B6#QWvLP6{~T7$)Dd2fF2% zA99pJ+}wh|P~Cl3n;pd{9@!`>;>|jwB3qCe3sO6vf=LJXUK$^3g9=p|7GBX#rrSQh z&ysAY8+&Ou)qTE>aN&9ZxexBC;rmo-T39VR4iz)bAXx$-mPB?j62E)Z@F$E~$93zA z8@A>N2!VxGLCP|9tFdlxcGzfn*-gmu8gf?tRbd&lyw2hA5u4tH~(v zGJv%Y%JG1O)s^sGQ%ab`|3r{jo*+Q*6_ zeT1Px+acFa7YmOIMqv$U`kXoyZ3v(&+D?DQ1KogNc*oEdR=-5|vO#uO1}~!4a~Wc$@yjZXpK>EuyCV?@%^CeBzl_LhPhoo z3{~Q0LyiD9v5uvtJ)LD40qN*Q2G>^!b_)BAGW4Ls%+Q<^2dk_?BfdauFI;&PC^eCu*ETsiZUn8+H41Qqg zz^;vRF*ASn8LEh8KDgs z@d6e>m1)12prNVyMn@U4Mo7?3T43)BG#USLz*G-!G)=F8!CbTo2M5I+A8;qK>IQ{udvZ|NffoZX zgQ+LsF+p+Xr-*Nav~FYSkkd)DfLC)MUnPHjm74UkyVNscoWQ-+5&hwE0Ba}@>}hMq zjcVgN8*=x6iF^jl#3U)w%j6Gk8RxL6zG_ zU!i&Ny=nk>xyUDW3NM&lkERmX>-JrLPn0LZYyMr2pe>Jn*f0rfk4+E%0Z(~#dk9Z? z&VBQ+3!1?WEw+Cnh91f{J&qZQkvbNVkC94`RBijYX^Z#TeiO@=(%KlX}Ud{ZuP=rLkMAS|a_Rn|7W zu_@wxj3<~5^Dl``fXySjb~hg+BifGRu$W8>!pguy!gFU7^l=}P=Xo$Paf*tN{+ zwZV(9^w{Ot9Mjg~xVT5zkXdyO! zOdMMIM*73+?qe61jq+mP!}-x#h{h5Sg`7H{t2WCX%lkd=95@Vi#&yf9gbm&v>7=XZ&dzOssbW5!Go1?LB#FRnG|a9!l>T`q+X*RNv=ea8Fk*)EY_}STf z0!N&x{eG&hq9i9Fjm~cwTR;Pta=OoUxjKvjG1s2z6v?R2x&}7l5>qrpr{TN=*JM9f z71L2@Ns%`bEcJ&TEcG40Vhk;n~f*2BkPEpZ%MZVhA(n<5qMxDBo|h5y`Vak`W+2Kv{)r`zd6D z_ImC4GX7+A;o3p+n(R52p8r>9?ckeqRP4+j?x+nY@UZT9$y%`6wF6VMRgQoR-hkj( zw#ed9`J5vx>{d?&@<+s3r~k@}xp%a99SlYX+Rk5k@%NgW(KDY~_NOqRm`u z$VF_eACY~{rU9U`TxbkGKjDCwBCn>VRuq*mn#i)H4WJ2G`5&qrTkgfAN|3ellbzyH zmVJhvA)1GTPUq7~9|9Gt^2F}#A4cxfDF^r1(#NKkSQWwl^L;K*W7v5{mN)L+eo zDDt9haVy0Lxs2JWD|xZH*UI%H-_Fr6{|Y3wfaKuGZvfE}vk;L(c=EQP?AH?idyWLp z1CX-aEKyq4Qu zf5jg)PSOiLg)9IR6tdsx%RI0hhR%_R{>26ET_kpYaOO7s{1~Zx7*b~AZ~@7hPDu5A zu}N3qGNk6Xse!2RVUh_An0(5E=&R3eYQnPKL2N^h>2-l@ntl=@RFla&ARdEx>!mpnHE`%-|rZUVJM}r7FV`->J2ARG)aF_z6=~0 zAvXTN)QwKHmgsPd=@&aicJoA&;*##bC#Qr=4YKP`4jusa@UdGPV3GsHQ6@RgZ{`RC zG?HanY(NiJfF0~kxsM$vkaC18pK8u-+pd}G%vbbofp!h{jSq3XF)P|o-4hh^i8I^F z?RKVz3-9LGUY&m>Z%qWBJ9{u<^gH+1cJEGw!6i0N7E0?OeZvi<4}+pt|M;hpyLZ#2 z4w=~n8BWu?L)^*4+A;Xe;qyoe)n@=V%Z=t$K)hH1`VRG0ihoRP`g1gCso$U7SCf)3 zEY_ld$**wedAzXp;_Bsw=jVCjpLH@eXB`Qg3s7ItsWB0HLn?Vf{_uRU%5a-nQ`!8@ z3KQMU7#-JWAB*+!DH+W~)OKFJ8!P{^|3;oX3L*ZHwXKHW$vt`-2i*(MIv({ZnW-A$ z1oR4AgmiLWg4^_ez0KS*x}G4gsHDt7pk2QN<%c}l-WQ>me1Hc__VImMd9`(Z-?Bt@ z#_N_B>hOFUhw0)m--!t~1$;izKOYu|HLOf<$yj z?V0v(LNdR#cS_Gw){bNguzH@ z`&Go)`uEJ4@=vbIOXUwkcg}7b2$$8QHxAs0#WNmV0dEqUtTx>H4#Vpb)Jhfp4`4at z4tnzeX6Gu;+lIr#aqb2tO5#1iWzLDp|HQi}P&MXt(hUFgwCd1~IPl%?y}B1lA*xsD zdtNz<^VSJE*TgHqoFEst>1vSwN9`xFe5KC9gNfIEPdMk#(+0LanGnS;9wxEhU!pdT zSDwrXyNi2+P_|%VnenU=WiD?zKLLIp>GJm95n?%^Y&gH1x%Tq-D=vbLagpucMo_7%jo_|w zlT+xGRuhEeS@d7tVjQm-b=9w^v%s=@p+C_k;fUR0P%Y!F+s*`n^Ok#uIv_T15u;LH z(dkIY&40Z!57D}&&A@fFj<`WgEh~G4aUL6yfG5|BmqnEB(1s%{^!pob=p#En7@0D6JJr!0%AX|uQ5kKh znj7LcKu(Uz?>XZer*dfnCUD386bB; zYoKXLvfWf2$V4@_7CfAIHfwm}#lo_y^TV`9nc+3Rovpn(vv>Lynqd_QK6D7p4D;P@ z_@lP$hV)XxZ1D^F1DO;dcqRI~gvmOC0|xK>S^ec4(7!q2O2N1SyW5=+p|ZfRfpZ_b z5!sa0Xtsml2~610^pQzTaZYd8wX7sHy>2@u1dh!>qUsy7d3Mou|YTWd&VRtxlU@3{>KC+-JuGw!UI`XnSPSQG_pgqx>1%P5@G}|9;MSWy&1k*tk zqR-V%Qbf*N0J+X<`H{p24cISgK3;sh+uZLxDAju|Ws)G?X;0JV&JzelelCl8 zxH0u+5BlZOrT)sDz)!D1gR)$Z-*y9Q`PBd6gV2TuJhCQ=C+sxF##aPKEd^yWG;E$lZ@M`wKryUaLfVk z66G1jkhSUigbPRMwH5~H?kH+kGL^x?&DcZb{7%ah8NVEOL|#1Sn8?AToh|W?`?oBd zEI14RDk4cC&+pIb3K-p8B*R0*u3+A%i_5fpC#e6_FRkpAu{ZYoNX0K${A6DCu*)n% zhvpq$8G<**^)}TA-q+9;q}9e?p|omD)Eylz6U}#Eg)ISaMK%g#CRl1>2^2EOb5<^3r2W< zp;zQWoT;j|mFkjaLH+Yb6YP&T#EoEv$3~pWY}nrj;Fkya-?Q28EjnHemkG(7b0ydT zEW~r}@Zner8`IihBxuijlq+^+>ixRmDT^+DvpuZ96jO0#lxJ?B_lz5Iq{Ok=1uvIi zJ$dAqS<)hd(FVzHZZIwYj6-V<(s0=bYj_sU0AzfbD;X)h-f50j| z?a2@MuXnBZy@eEUC;=m4w~Xv&6F?u=A)vE&<+$(kb}9qdVN$=V1lt z^Y7fkuPaAxM~~Y-qFq0BytkLOe~64fOBFI&hCKoqdqt9ZQ+-Rl*>C9I;P=Mf$G;HM zf6#ppGdKN=CA;&{N=ZuH^qOw)>hz-~3PjPjHSQi8eL=)2L~vkkjshq`!Y+Vf5yh?{ zs2kmsLjG5Wh8u5pW_|!;`|B7xRY`spI5nAc)r)b5-$pu&mJCrWe!bXa^9|P4Ym~U{ z9xbkfFd>cGr{6VclIx7?2jTI%cv~$gH+%6$lG$5)C?s+E*snbdg8a@sgX$me+{2*| z6F2f%&1tKx#&ZZo-V+{AsNKMfYt7W0N?u**Y#~}*$yiK5cNg*|X(W6puW75D0`d;^ zF)xSP-|v~^ro8oumDUr58P3=5^~%%OrKpkEKPe(WY9WiRj&vo~Tqa0`JPNbva7$M5 z>oYgBmW|F|{)R=92p7-R9pH@5Fb7BU+SINWWU##WOcxkjx9r{GN2LIXZFK8CHoh%Z zg_0DuQ@WP7>eYb*C5KGu{0-vBSb-&l_3hj5S_sLKr}028a~xiGU@92jh;c)Z^G_VY z9kDi_#i%$EPk=N^lk|qe$eK~XhM&Mt&{|}dg7l{Z$>CB+e2CpKZuv5+ls-(G{W4i} zxA~T^)J7W!BH0$~l{>&HKZyzDLr*9 zD=-7r$e}oD*W?m@G(#%AvH0w3{-at1>|XDy=vG6y_9EDttkEg}e_X(RPk9u#Kw{H_ zD(XQlwfvya?`*#|Kq=$aB{}U|`)6wT8rm{FGT-j+gA&SufKddPX0as#MR5xD3iTZ2 zuc(T6>vhqZh}beN4rSc2*%CHIwkV{u;+-Qw0^ySY`nckYx=z($^|1Vn9kVi(Qp@Oj zW(g)oUMddrk4{eD<|Hd4?1^3%=}9UG)s%TgX`WD)I;?x^)w$43O2uM>^83u4{80W< zA_lqkv6NK`W^`gzCDs9C_FIEtCk21cc#gz@t)!@dHfId3kSCzN@`(Ps0$ z8s6N;0djykhx_;x=GwGHBc6yLCj@fhM^kz!L13o`Xn z%8Vm>6lHmEi>B6UI$cvnDOnPJ zjY1QX2bNyI_+h*!@=83qpYmkR%8s)@d2w5QL|e2N`t+Ie>lg#UO5@Ja1-!F+5Rx-= z(XMOhd_I3u>y(yA!#6OVB(u#TYK2O0VbOS6Ho+^b0x-u$8qsu&X6mG8Ne-?HQ=&@bUee>l}F8M!kZvr4MI} zBP_?FL|oT}jL!xB-@}?-JO~{^EAhH~%iB>9J*DUJ+B(%zN zzc4!;q4pq)NwW>N+Qn4?KOWv`J0+!E8-H6sQ%`Aqq3n65kj0lPa`~9+*m{mP+u(C% zoxvk=kN?Xde)j6Xn`nWoBidOLtPurYbefcELBf6Ca8=%wG%tGh3j+Va-A&#NzBmR- z`@#egB!(E`b5Q$lRISG7WOGn`q{1;Czm^GPVg}+$>8~#A4?(|^SVX(`P(oj;a|?e0 zX#u799}8PyJa1vCM`F{cVsV_M%cu^(~XQIS}t6Rx1&ko(FGhEk+(FhTb`uHg`3(AhYF z=TtM{dJ|h6_xR+_VHrUgLt{Tae8sAHe)+h^SFI21IgGgE8*Oyr-&o4M5v4Z@c-7^} zFjbw0r<)V`bk^*w#eY@qN*%GoBG*gbkW1H{&xiQJn-Lq5lG)UyV-W_IHDKNiGtA5NBB_2*k+-@)uP~YuW!#=Wo{*p zekEgSRVPO{d|`2wyt=r=pxkANu64Ml$B$q+cCKmBP__4?nwhmt^{>D(ivv;$-!CO= z*vn`!M>vs@rn5J)$)xq?M^!dEfa)#ISYfvSpGuyRq6{uJP9}!95h9)Cn*(v}S?mu# zWzLlysKICWXxGyZ2R%bK`HuS!s*5Z<8k#0PCUBl#WF$ zqqI;JPXO5uGt1yQT+)}M!wua*LOimHfx}Hu(%K!7W`So}T~!QbLgJBn8pV@OxK?M4 z+q8LR{+c^&TFILptz}_dY6TRn&m%ZEOF2<+b_)4L|qBC(o=c%!TIM42Xy zJEd9%C=9;F^lHC6-+zt8MEtD@J7blCW^&Y_!Vq;jEX;+X-Y^~H2I%D+ncLVOImVi= z0ymNFA#il!fT=kg!#h2m*Ha$Ws-n-_%U!mwfA*PC?{|!u<@BCBi%z^y!nVWK* zg*9a_o$}SWC8bj$<-*g^KO=#AeZ*T{m0fUxe)+k2?NDc?`5^y#CU)!Sz#GwhaeY4I z8@?NC+v5@RntFmiW6ZNwyU9LyzmQI zKY0}z1To$_-^M>RFcmHLV9q=K)#_f}+~{9VZJIk55-HEXrt;q@1tqUiQFF0 z6!T7KrJ1b~@GIsG)t&m>2%UB7k>zwb8)+(G^8JECXK{)XAqdFllg;isDOmrm7L>ff z3LhJ<8L&1~GW`YNrT8#Dg4Za)eLc&eL%veo=!+SWP1_1q<8>-iBnO+DT; z3a)&7FskiCUXrAJ28Xu87A7wr$jmzBV?%99GnsbHL&|kZuP5R0kbO;Sd%WiX6sA0% zyU!zqG3=q8GnarWLhEU2u>!WXL8^$xkfN+oHX2&Ot)%m}L;r10BGE@7Q7Ug;gp}V} z1yRcvRwZnj3AwDsOA++`dmhJ?#H!&C)3pZ`7mBS6I*a+`^lr>s+PGY7Ic<5DRvf$) z8KGA4y6#(p<71w}vVWh9(-Im3<*a0Mgb2@c=MEC$HR)jdi-oTTmGt*X-m=M?u zi;tJNZB{MVG11R3oU9kDT3r4+eMJ-@A)Nx`WTq7b^n~W4n8yN-zvFY(u%kN3?2N)_ zuE$sZ{zIm7Juq3S*7(w9ow*DL%pMjG(amKM3-AV2A{RGeH7*vlWB2|d&i4t*ys z;t9ZyQh=}_Z24^a92GTfNYrULvI@>)_ifv2d`P+@X3TlM`8(&qvv>X#px>ZhZ~+ z=$X<4r&$DZnPZts%nrVFA8@5cEr`ZxP>>TV9l)F$b0AQAsgF*N&IyOb71iz1VS**i zjHlMKFma^&nq`y#k+A|7~1V&)MyiJH3gk}Pe(86uIS<+&FJz8XkJQ`d{km3 z&^NW3HV)n}UU|+Rgtyvyp|C^#ow2ppZQR;p_36k6)gz3L*obqeEnbA;CCi68R$$Kk z9iRy&ihofde*2V=hU$Ck+a%rdw$I6lqMl{I(|H9ztpp#=*tLjnDJIyrzyu^K80R7{mu)54j^)0_DO**UIzjdVega(F)1#dvoA&a<8(rZ zz!l=C;^Ml3$)?>D7Pmah2(MbdGt>9*>h!>qzY#&T|_o3PNJWXt%N5S9}bUJl*Ng_@FfET>; zPtT5t*Uc!m^o&b~RGW5~LuB}Rlk<)l`csQGRD;}|sE}1l+1>T1)WAaXh%&0@}Uh=WkLy%{Ks~;Cm`!Pa5(is@JdN#zCfuzGqtI0yx0xuTDvH8qHQal)S~i|? z8~RMDWmshiF${qwg}to!qI@OHeLLD$tZ*Z-lARMI8Z4!YZ1^jY;Cio4z)$JQ<(g=b zOp82QDGF@#k}^yGN&UR)D4 zab@DRcZNse3cd2lQs3l;fvBhy2Cq+R>KPdyogeb4t6hR{e7rAl4$z~ruJED_RVKUX zM1tLA#EuN^mrmbIy7w-XJG>tislorAZ$NLEkdl^U)^5A$Uc+=?LcZznWi6w`B&*Ku zTr{FSIej4&{M7hnhHS&+4t{+2Y4-YW0sqasgFv-}p$qTYd0wQ+Dsa>o0+aNk`t@M_xL+iSe)oyV;j!|1LEtxQw3gb{SC7`&=m!cn!5F%snfm*{5FvcmA;8TW*AGKch;;1OfwT2HH~ zJ4Lf~$_@lTF`zsDQO_m7p<^|OYEz4!KmTLRnoh6YVVay%u^>7xUJ~7Z#V(#yfgV!XlEeW!AW@KbM zfg6;VeJKu};##14t``Z*-9wz9;att%m10UB+r|anZ@5Fy>fSXr=zzJPu56UWTC=SwHqr)W&5hgp6Cey-rOm`y| z8|KH?OdC&k3YkI3-GQ^+l{jiE1H#?sdI@C!&R*HJY%?HEAmcX#KE3>Li2qf*Fw-8f zl7mHC@GD7N;#67)-43!qv?6?3#yR(9xxmwn@RAO=Va2B-Tg$g>u!5T!lM{raL+m7` zCL-l=M;|_fK53Kd<)|;q{WH!TI_Zqnin3s&K}nH7{8GO!=c#E=5KWouBl3?Qp{Gee z-iaRgt2RWLWVcNzydZTg4%A!N)A1%A}k2i433 ziN4(B>!&=NMf=EW)gUL1F^b!`qG@?JD90FKH4fuz5mH?FlD;_UEx0+&Ex3dxly3}* zW(H5g46K@WFV+vacD}WF2Mehg>(%pjj6FYXm|$O>4`1FWWumo96WMelcOO0jjcs2( zQjmVJLYoF5P}>Ff-6QREc~uQ}clv%rYbZXq7d@?=nd>}St>KIn?thn(L#s58=D7Mal%B$;5hPJ;|=}hq7n{ z;dJb5cApOS)d3r@lWzCZF0G57p6^}Oix|wXG=4(Xtk7v(XexF)2DfvBGpFec2bDFHjv z@9gSU+b@czR{*!AL>qPE?8k@twRjG-CRc&hz-T^3e7N8zV9KbTok_$Iv_45>9iHbh zAwPln+LThbE!hkKiHr34sFH6q4Qs-i%QnaxK}fA^rGou!t9t&SSG5A;zDCWxLb$dj z&{b|iL8FMA0Mv`%H^%rPaFxLvUfH>DIPLw-k1r9WZeA!2Z4TzDg)pjeDpna#t>DRw5DM_I^vTX&IVilQj)+B%kL*ogPo{;8YmP?LaQ0pr29Z|hx-s~k0q{br-kF)hl{S2t3tlGOF@1@6YnsN$i`RkG> zX8rBR15G3bq;IdgKteBpZx;&mSATg0*!Q;2T=H35omAjg%-WKmA9QF9U*yN?aXo)s z-!r)*oH>&AbfMPeUA&%jBF0w|z_gmPuVJ~fCkTZ5G(grS?1qSOyWePwJU95;jcoU_ zdRbzqA2UK~nONs4nnDxEgl(8bFooGZ!**JAKa`ja$MMbsW-Ol~aJx=*Dwa-P>UDTc z=a;JyA*yzQtQ&3ezckjNrYCmE z{DZt#S>FV2{s~EmK9s7rP}LT@#khTuLa4&U5T{zL4X`h`AcQmI3=NSfU+4NWbbOZ< zK&)W^HMlkeRjqy@u~5OLv#y)A2)tJbmr2XwNs6DEA(wpTbwD**zq&YaMOXF-Y#mwh#zN&OezQl|47bKv(?iuYk@ z4HvEpyT5~UnQPv*Ic;E%gsA75@Ody{+twwM4|z1tqdQ{dxuP4d>fT20eBBwlOSijU z@ja)19h;9-pb#K4xY|Y0qMd5PS1VWXc8>a|)B<4gIfgx(e_k)q<`YF92*3{*i)_4m zm^iv4ZW=$Hbk!vmh)I^5l!FkpH;*6?^@h^)Z1-f3-PA_ znGH~lesV@4xv^Rl`L@An>|f8b5uv`5)3=yI=7KvgYTP+v;Qn!m3T6r0Fg_(lJmW&BN)%`2$euWm7?_ndZ1@{~~(?j=n;ny(o*Vkai7(+wufl#5h@c8>V<-JJ*V z?jd|6+3{Si1>!7X<1Y3rkyD_;0i{tdN(C}+G@|V4{`KyU;icN1HDY{V%eYNvp(5Iiy&4CHybyfcITW**Pgnz7M zB)*=>mn@6Ma4ML`!?-@aeSbBvlpHG_J?I>laM&^`{f)6KMZ(@kU9X+JC&sANr*mZWe|Eot}r zC&{jWy!|T%=1;iB&9iiG zt5tIvNuhX0cuu}tWYi$UhVQ!_rEza66NB?nQm%~ggAD9JHFcb7QqPA&ELiCRQ&L4@ z_mvs6k^M{BzF0xqHQYus))^rOkMlG8)brndrQ&~o;yuK32S;~-)QmPi*qh@AzD;F8 z8RYLr?cZ6`n={U)plZ#Uf6NOfZksaJ~v?IOcWW=*tNgKxV(FFbd3XF?8joeGyfJH!-R`+_hq6_Fz(IK z+ZpTSNv3h8wmRZd9?Os^=7SMZfW@hkYgvi+(|5bA<+|sF<3J~*^?3#dcCS1O3yX)f z5nbmEctN~2Vcq-ZSLe^@%wvHJyCZy8*^Z3c$&RE{r>=$7Ff*io%Rb70`zyMHV4n!; zVOX?;>F~aDZwoDjFHr?$4LxYc7+tvWBy2gb`b^Ve+}tC}f5(nuSEN-dC6IL$t++&r z*Ncd=jcPqTZz66G#|N`Ls-wv6zVDJG7SqR~&uf+LqhUW;s&Z~@;KM4>5xLDMv;{gE z-D$@3?8T1@XPWR>5XQLxq&-h%w;i|Ff1MupkqmKH)EjoLej`a|7YHaPcLnfGl#kE^ zLel&GxFpv%6#9HJ23`nLk!}k|-2fv3Y)4gfNwIvPtf7q0CBwKBje|LSr-OIG z-3mA*vqdHn&(i6})=QUJ%k;#{Z(iBy_l4nYo+BY5U=}XbB2zB_dXHBRDQI*wdZyR@ zyyV8cU$^*yvg9f$kQ&t{SIwdKe3udVHOGI&*EOt18vky_)A+S%GUrJVW@j=!~g8HNTZ13*e)VehW$yzN5IzI+mD@yFs);TImG)kLZRJpZ^xO|kjLfss|$rugW?MhZ+yAEWQ6P#qk##%$?Js}rX&)ltsD zlfF-KXEI9Q=-mopZcTg{x*mpA{n7%nnTV)nqeU7?#_*D{mBlD=V|r!H?ZzrtNJetY z?aFWYhAO7EX=97kG_0#r76F{7{Kl5DTIen>rRp-Dt&ijcmf#Ci=J~@$miBeVm&r_S z4BT-7%5hm43Pm3Ye2J2pJM{x2ohYt#CoiO<2jj*3Wq7KE?~5+O=}BZpjv^`8ZXG7SAj z>SLHqkz}IRt87p9mCStx#5b)|f=hXyDsX0N5^A=AYF3nPU7HJOMXQQE8{e8e$^kc7 zq^czY&`G3wI-Ml?sU_&f@WZ z7g=`{M=-uzVRi4E2stwBhkFF>fIVAIw8iL;V_#pM{u3$&EHB18_LnmLdg2{E>aDWU zu0v3*k{njODkkQQ=fp*3RwmpFye0!cvGG&s;6^YA!P+^}&eFM`k~hBpR+)=Ny%s7B z@7^qANw4Y`R#u%2hw1-x~Wyuwi*8!WOIobUvY1VjjZ&JRQ zd=oNRZK^V^2ld)lCA5NfJUz-uVOgKtKk+6(XMa)!I#5l&IgC3&t*2E=K?SM0qnq}` zNnv28KayXAt&s|ZctOj@#-o}9FQBVcfL`?F97obxVLF=6mGl7BxN8+zMRg=2|8O47 z++<9#V}Ytm!E;NsDZ9WM*`&5YQlWC2nhO0 z{6~PPVA_E8_ifXLaU6yBAsh<7nkShzhCK8=>IBCs#qiz3&E@GE5cUfx6sV!J8Z)#G-y)vfEmKD@V4 z`@av0+fNe45QW+b3Dzx${)2EV}a8@+qsSIy_i_KrI$Z9Xc!L3wtT2w)R+Pd z73IGN<8mfNK>D~Bjg$M@4(nzen9k7qc7Qy`mXmezyo*=bV6a)YLn`fNP<4s=V1->d zQJy6p=R}1SIc5sI31ypAhp_X9b4Rw4AFZ%f@E7dG`iI$0%>pZObp7-nF_2hW^JLyh z+Fv<$sRn;w^6?8q6^>9hgN=of5^4Yv2Q$nj7lzz01q})~X#u+1`lmiW^`ng(P}6X5 z-0^%KV-UtRi^A{3qHth#3wBU-eDBW- zoqq(qlgvL-J5&gNH(4AM=)%PRn9x$utEt*_$x16rwT$&3(E1Le_W7gTex4RMIK4OT zNFbP3b+XqepsT;0wDX2Ogb-xh0{WMgr~As-oG7qVjV~J2tUdNrHJTHKk2J+QvA#Bz z*1D!4qc;9&RzHI#aZSxZ9S)^aN!d<59skN28_tAI)VTJ-b4sby+Or{yqvdr0U1P@? zoY56luU0^5Au=A%yAjR45D5je;0j%+RYoAoY9z^aZ?9e z7|==!Z>D8fJ^$X~5qHiL+&5XS$)3~wZN{1-s8@%=X1Tm|Va{cyt~D`qeZ~0!Ch4l% zNO82ce5=EJv@dq!gCz1hXWUNFpVYPN-)=jf##N=2ukMlJa)v1)&qCLLblnQeSa*U^ zL06lT}wggMXoEnah{GGY#uZdp?McltHMK8VPw0| zI!e}V0!|LtnDAkWUmxxt{DJHkXASAU7uuZ~&tx3kk5F~1huMU5?%X(^Ghk!Tb6^`8 z6yQZP&x}U+ljte-H+04U(_O^QQ8%1j*-}xtq$x`_p^e#<-?V1!9y#_CzeAn>s9;mf zuP0I0J2Wd(oAK%&F(jv|;%EK{RdyF_+u<~ebZf)&2=`9XdQ!;46wnzASI);BNwxhu zG2X7#PSEU5+fd>`taf7@(N5QX^T*Lc$tLcP2ANEl$*zv~xuIG+kd)=2)iPKx;8z!* zw_Z$F;Ui;1)<$Ec6R=-kCw9grgV`@+bi^9ZY-mkFUCN$>Oug3>?p=UCq%V|$2#Z86 zswtDEy?T7eY-Y?hFB`T!XvvLXzZV9P`njxj4?i&bcFq@zL?fXQLdL9UkJn`P~fjt7c9@e)~gi=fu(N7!QqNYmvQZs+ftozBot-~0YB zr4)PgHwEgiN-EX~gyu%H*b@0&VcVP~DxE9~g?sG1Nvf`=0Sl|oWld#;2JRH5IEAkw z4o&nNFP8JI9+q`g#ot(3zt(=Abfw1ai!8f5eH?}hF( zE1!3)zYc1rcmrSOw))p*SJ6c1pmiIB`c%}e8elN46b=wV5?`{ z)kz*090u(nZty*GI3Km%ECl>tW#<_V*Vgv&L6j&%5GKkXGC~leMv0z7q7x#bjS_tr z3?ad0^cJG`5-kW(5~IfGBql_!L3AR~QizOqxLgp_7pqU>%F3OD zRofI&@O|MaZaEMPryEl*xcMCjVGE|+D2ScDS17Rkptj#j&DUq)U4DU$jX(#%xkmt< z?pv#P@6EZ{uTk&g3i<2&dwJHA%6iz%!nwraL*3}JS=$1)*YXqj(%*k6GTuJk$q(c^ zRTM`54CAn~N9!3v_XvW@JXl_>Wh!Lpr!-a!(+eH(Bc68{=uRPzjQOj9Yx%c?n7Y&TI^#PKcEtA$a$y!(3T z#*c6Z)L9G4{kBnS(P-%SW@JAl#!gO3TH^cbR!QG=e_6EdKu1w!p9gRgl~4z|z9o?%tq z-&U@mmJ82wk_xUUVaP zcW;j>%dSASKM_=D67RO93}-yBeJe+Vy!Zpb@Un@$x*+CTs?7)XV-+sS5$Xf%6FdO|$i4#Siek1K* zSxK3XgUdT9feHI^7wJ5HMB44{e(|Si{OWONEdh4#svdeapIWfCw~T$LbkH|x1j$@t z9;2~`Tr>XR25|~N<$Zqb&GR5L`Yn+MU?Iq7%GyoAj0xCB632-_v>wdpY`Y^UMQwVVERNhRA9$#j&E1ss|fs5^I8&8dz#{lRYy zD%censpr~Pumio;j+FRZb|wQwtzj{)jj_!O7)^THH@?STj9+phOg{~|;6$=6fNUzF zXgjykMS8KN7`U5vLv7Klc5R$mI4VWF(~aHL0JDUd6sla%&3#0=p@Z*%A5`0eK^m7q z^3ED0(4&x|dX1OVJ+&lSy{LdBLp?4XO8xBU!o5kK(W_jr7zKb&B|>yFuo)lYhS%@ zxLvu}>Qv5reK@18B|XHxDzfR6=ZAPs6_a6!N=DS8G<1Pw8^SP*cUzdr;Pdc0IzQGe zB@u(n7h30%rIhDQKho;tf@P+r%=sHvxI}NP#!*K$I;rz0P|rm-lRiJ^N9yv$CMaO_ zZU_=%0J!yh5~m6VVsX0P1zwK$VHx=&<~oBtG@4ZMTNH2_j#zul>u*>^7FZ1Z_lr~WD^?-KEpYlLoUt8hY&0O)te>qR6B_7C>czEa)@o~)r)vy?ve zE9NgfmGb_}*YGY$lGmT?bX$X&64sY?1)$>cgi5HQj9ZTtL+G2U&A12HoAxA4Q_%t| zNHV(ReO35sm-=%XTzu+&j)*q5_=CewOxy(QF+p+S@lfS0p?N=6X=A0s$RQT=(XDKQ zn>2qDg^mqOHNvxV`ey_#e&CN<8{8F;m-%qU8HK7jRdCvi;>$Qc#tM-Om96z7-YWQD zhu@KpU9Boqxnv;Qb_*AfCiyCee$Ws13V0N^Vmd)v@Mu&98laXYenAyC?dv0d$3m_@ zl?qR$C$}%g@hwb(uXa5Z6;RC~7o4ep0{Nd2!sS$hV4=LB61bYHWCSZxoE#*XN}D-K z%0EaHO?r`yWXL-F`e}CwcBPA*!e(a5oT)dtN9f&fz3Yhm;bq#!$T0=)1$4kUK+C#{ zUG&u+N-Ke%Pb#+?8KSDNb}C-)4D&fqN=9%p)R~e-39f?_nAy+%B9{AIadB&Rhi)vh z#*0F|K2gBITVguUa}#dPc{)g(W7+nW2u4>=0+kSpr-K5$g7!RmcPnBLx2sh1IndSh z0v;*|_7%;mHy0v)6E$&9=O`)$0?d?lSgI8$%7-9J0>U^pf-Lx%RTajaF6E4tds?^K zq-jRm+GQ&3AnNK|)Wkv|w45$%227{R9T{ng7SVyp^p`rE*-2L9l;i)JpN-h*;_5Ca znV4%>>8MH56~kXlnE;%}hx@2-2Ar}&WsCLW^MzJgpfU;#P()%D$^xkMc=Ni@x5v$r znx+*@$L|nU#%ix6ul6~5Ib_Ae@YpV+GcR(}zikfrq*8Z5d&?6vYoSZL-m-8H3QXyp z<)&Q8(;24LnWRTp^M=Q38wJagzk1OcGgLNceXq9kW&3XufhKUKOQ6IL4uKxEDzM}g z?xPZxc?u6vwrekD`~rc)Y#V~?T*x6>NE4bcQz~zyhkKXbK@)VE^8QV~b*Uk2-(U>2MPr;Q!RXwB+au*n(**(^num&%wM*Ux&_dB)xsS<_9W35D{Q z>|5%{Bt&{s@Fqw3Va^V<@niOWtJ0=_<;z<`u8G(k%2gpzaVY>cH7{n+hq$IwT0VsM zwF^Q-dE^tKl$oIxouH^(o50i=R~^p7Hyeldf|RQ zRKKwoVm?bHjLaBSTQx|T-Bq(IRg2YcuueW3)7#a(h-8n2y^D_N?CM@1EkF@`jF6A} zaz!^*o6+!;GP4Rj$1A$ED0x-f54kMM1k8S|Ys=|N8Vw5p}86j;kBlmiZ;$*fxWlp?u~?hA=q zd1yb2W~`}&GV$GMx_kZs@fTMb55}KrT~J!lRiF__NA#4f#1spV|=b^rLAqHM5Zn&Hu)SMn!8ww52eO(iUz-XusD!j>%^<$ zU394X7H0Yk7VER?EjP-H`G8-7eE=cY5ryB(fz;s7Zm-|YCpK`P?iGD$BlDACk^*HV zoe@{tP!t937`Z+?l2;)0|e)ohthbHKL}cy}Jwr2MnFHiwz8B2z7$RQ@+Jh&SJ?4 z?^Ei{MMwL@M@4>g{8H6f+bP1j-s-HJI@~r|7=?$L+B-J_DZKsCC%*i94tY1p|@)R*O zPMnnfoKzqhOYb&PC+H6w!DpXi)>Bf}FI`vHHf}?|rY@eoQ(Vr?BWX@Pj1)}!=#XBC zNg6?))w=f-(O7AIGxNvN)n@?G+(eumWbz;w=D z+Bi+Gm`p42$4{+i!051^QrT|&_Bs7qqOO!G9lWNz9uqpDKlv_S2dyJr`@^Q4UFr_ID?{^gpv zD(|t^AJ49T>zv64CD$BigRfohzwiydV=*G=l6<_*K95LJfFadw<@*^gJKS?5+c`|6`*X$?bb1(kNufQVGjFMNGMmeLV z{&v|o@0Gb<`B}!z_?_ejob1xyz$;4CUA0dZo{ix(VTX+KVvEmt@V>g#y`|);E$`u+ z!E@zjNtVV&{w(21!=+T?q_QvRS*VNyq8`!FUL5@cP-I@Q1cYgjw8-?5_^> z+V8Ef37d(iiE@{VH&y?83HS?J2{&_ul@NnDoZ;^o#&I)^CkR1^dW{skQr*@3SJyWZ zOD6fN(&hhM0_uqk@)z3wmB@o;Xn7mfRT_v7#J}T9)LrHOtxa=&b%eaU$L9Yw%P=qY z&l2!A+CP*8sXCk?;l`{HIQI%sW1O*!ISm{p9$;|kk%V8c}@>h^sp+QofFBy7){TMnzwP=>XFl&3lfren!w zPhz(aW4D~dhEYA^pTs!Uks}+4p9u>y!_46L`aJCh#A%>iP@@r%;ia7E-Imf!^IIgV zmbi$+O_7O&2l@O57{@Q<$U}0|T@hv&0*=S!X}2LX!C{Xt&=#9Oo;yNZ`a1NIBHARF zf~C#|3pYTb5=7JNYzB*Ms$g8I`YIH|F|<=jv?)urD4GN@oLt8T4cQR;8x|B;Zc(yk zaa)VxzcZ7w31*v`Q35BYy5dDOkibFbs+>UKW8d2hUNA{0X%oIa z0{TRoKF)Jh(?hbJypL@@n`iHY_>xGp`kg4$H%SB{Pk@^YIWS-L8B8bL_M3QL&i2|1 z_kvC1n@QfCD}FRWgzR3a2gpxz{6PUzV!0!Kr)cd;ABklH8@eUAW!wG)7-8+g!d6=W zb@R@E@AsX>*}6G#$JP>u)^FcL{TU8q>mm4puIanL)u_rG@@R(g9X5-mF^BP)x{0jd zNxws1iI9!Fe#%E*+P=eSD?_IgqjKp2HO6kCJbJ!NQ5xN86_%fv7<7vSX>b4J0ab#DUoj%K5KrX(S*}YEA=* L6oo66I0XF<*=3!8 delta 89380 zcmV)LK)Jt&@CMrR1`SY40|XQR000O8h*s0F4OAWth*r~FqYmgAx|#t11+#7*$2xyy zVIHc3KU4>ot`7dAaUb=;i?57VA-rH=h#KKVV~3~r?RSlQf?v@Fs#5r{wXokUH>Lc! z`4aeEXHmAc;&nwnO^&G8e>;^KDems1 z$m7eLEi=8eefOrMPL~$EBb3%Yw4hVIm~q&(i1yFU`JE;#E!P_*yi+PUN?@R+(Xomn z6^qrdg0!zxBgtAUIi&^XP3JoEPnk7lB*}J52cP@V;s}P;tpa~zDONtW z7pTkUX|zO*6Z~kp!zb|0<@ulD>ANTE60`e}?mOU%Ps=)o&#bT6^3`78If}Y*4QZ*! z?A58P_wPE>+WjnLP=W=RuR-YcSBxqcAS7y4J;BX(6%8SF3i)8r<5CmCAZLmY8TJM_A z*4@XCzXMyYsNP>Ir=3;Pqi5Clb;@b|KIO{!6n6F@NEPzSibcK|UQ<%MOCd)4CjhL+ z{AzL9#SO`=d0n<$=DdFxk*!n4eH1b;ut;l+XW-!uKT!1*zfh(LM)!!KSHb#Yy!<36 zo7)dUS?*d*aCR_ZU7PFx8-NMwCu^VIvI^rH1*WVFip5p(q_|2RTH|wF>8=Qhqn3N@ z&$CkFDP=G_%Tu>83%%#H=ULkUo4wCjW;NuQ&62yy*&ZeZBTRqTY|?aR#peKA==EX^ zphu-DD8^5!I}B7>E1#00JzHR)2sGBl`uz8!8GnNRD8{+2e9tazs&(_OW7q`+6uCeH zFk(7X(C(5>Df%FZhA>6>F1Vdt(F1|>v>-H>lFf#7C-gBW1%V_PJ~cy!^Q;@t0e%F4 zlI+$wdS3!PAh&-iWkdns^SwVM=66mhf$}8*j@IzWkA%<8>`kU7KQC-x3YL=^`;>w% z8_ExFL;=rkWq5MvK+~OOxcp_vaV}03RYavywtj?uW)9Z%^>UtVu8TV*Rx?N_=52}V zYBvbSmh&#++@8(9@N_l%VLk7B?KYUtKtVC~J)_Uf+D?BvzhlUM4|vG5g4aC&v-XE;T!g1Lo!Rx0a7v zUV-J8RjYq6UFr8Y%{A<^V8I4c7F^{uk14$W1uFxj7D+JAi)_J)g zdVIMxd9nGWCP)d}&v@H=oZAdkw6dk3oB?oXcFp`w$=63ZVk%2aRC!i1T_nHoE!~HP zob1d#@1IXIP?eC-Tj;nwA1-0Lxm?hLA<$8vILv?Z@%%gWdI_79nB7A6`?OAWns9(= zBJTR*7%A*i4;IRCF>$bYvV+$B*d`1W4~7ZeFkya+B9(49<0NmcZlG-Hhe>|tTYIZ+ zaO546*%;rDJAui;iqIf7_VLYZF@uibi>&%z$`9O^3ai%}cpS4X3`+4#UyhDrI z(3^h)xvO<&QIw5^19$p67y0g}5L><3eXi8w*S?G|7bIIxzR(TR7v&QCE>_?i8pEu@ zwVpfTDhxSV4-4`AKx3c#2aUL$F z{ah}lZ5lnEc|#VFaL%FHcR;4}AUbo{EI_9uqrK%E{P|2;&FUWgR`yDUAdexG0tkQ4 zpS?jYY7Q)FsKu-{#phm?H(OfX>4-&$%7YrtgT=?RnZ9$Otn&RL%jwxij)+dUT7Z2E zWAL0r;C5;cL}nG0)RxmI;?#QZWNmL22d9+gG1jjk_P|c0w`G*(FaQyOMR8{4lS4Ry znQ)dshWPlLumhR&%;Wg1K+NoVG5de#mM;4f>6aN2ETBMSLy3>WOfp-in>X9V_iOIi zY^$1Ze_YW}9{cw+2J2~-COAGj(Q>=ktS7+8YyygO6GYcwl1)LU*R%BFw}6%T_^hN+ zu$ap1LW365(Bot_Ctn9Cq_N}rkpe~3iE4r|Hb&7!*8^SznlP8$O1e!WHQ#t6qg%O z@sH!LIS}lg(4tf61Ed)V-isr#GYvzDrTgTy&PVSP2oS|I!Z4LFDj+iz3p=YmF*Kf2H|38^(hzQ`hzJ8mwg&hn2ESorl7df zu=W4345#2cXU>Dnu`&gl8WJ|9!V1LUuOQ_teNDhp8r^E!CBKainw)=^Hza}m7}!MP zv&54Jv*l(AeUz7hn#Nj`b2EjW*`_#4f4)2>fVcC_6!#m#+P8l!+i5~R?WwJhlk)bE zUskjAq`K$9!YtV@JgaC5T2wGI6`TyWA(B}D(3#8h;Auw+=6rcolxXXdyg4x=KGVU{u-2U{y~!;SkE(pq2~!7Uht<6M&3kC{kCq`2BE#aBwP4NBhHI>~uZ_WmmA ziEx%AXR~y%ozKrU%Y2`FR(4d;)9q}!e4+>`5X*F%#rdq%*zR%m18VMiQE?t|+qLpj zgHfwvOl^&_9I^HnCTaux876^+#@%WJgQ6Igz<+XcvwCMaMwrQ8Xy$8(H~Z zd{W5{gYkJK`-459)#r-N%Fk)FPC9!)DIuZ^f$ET#2e@%SOXF4_sNJAsQ&rykr7o^? zW4WWs9aHLvo#dnJ=DY6uRD$ZX=X`%Qhf1YFzBoN*f6J`#JxAe6vCSmEAbhKzYNT>_}gx&!|s^ z-snTA!{u_G)6R-Vtg|T~cFy>0YghQ@GcK#i85N@9S1x%qYl2H&{f*O=k{LKr>4$#` zMczp9XExz+3lKv8rJiiR~OO2Y2j(Q%`FOhNaOpxe0%SAwt=UaqHC*d5J{uD}h_`ZtO z$2{{6smuc{@yxwow3u|3J|{^4>Xk)4TCe3e;ErQVnod1-EhcOn@Wz`Qvbul7MR|~+ z1uIRyM-Yt7>C2?J_=97(K<4n$w5J#JmgCuWO{aaPI!qv1$utvZa3R{V1$#^I1KXVx zLoj2d&l6fqZfN$8q$8PrD{R|zq5XzR)FcWQEvw<44 z;bui|R$mmj`V^$Jus)mLhn7nzGxzRO9J&V6TdIc_re?7sgrZ6AXnEdN1)%?2@h{Qa zScev-Y-}GvZE|7w9wW0~jwD3qg|$OTk?p6BBt~g}(Jcwxz>z@WN{y4^XDuR!KzfVB zztCX3fIlt2`xCa5!%K!bP10Yita)zJl!mIfUz0It6o2P}H=kG3rT~_~h^DHw*xrQ4 znIBqD$V_|*{p=Ud=`EY%6okg-Qam^chjJ9k<*zi`FhS*7OX}gP-R8-Hz_q)~ZLd0jhwdcPqm-{ImClRHZtm zPo$LXbW{wVTPc?cTyFO>Sk;uR`yVcr3dtdYk08TWknusUM$V>XWfg3$hqu_eue~`qgP_nOX50)eLMeau2tvGi`R>gN<>|Y3 ze}49jQe=Z4(?TmUknh6^;P&P+f)QFDVd3A;pgxLF>@x~|N69n&nMJeS!sZ7&*!j1I z7B9~QKL+l2YIreo(cu?@`RvH!Rmo^S{;sr`8G`(igS!v9t{{`#X&-+Y;uxy(+*YpX zfr_mA>6w(_w=mfej$;H!zJ99TivZcdljDd0jUQi#;=s)DR3SUAbktOW?)$e6h_+=@ zDm_}I%-Mk=h~UEd$BN7kj;hZ4y9Uhcf^Tt01zFP|^%2&;;n+uoLC=n0o7q zF^Lhh(@b!z-9f34-aQ;<36d)W!~rGBuh2V^RJ0P{ z@vv9Q_q<1$s`U(yAYHb)@&a1Q%jYb6>gdvCRT+~cYa=qD%;Cj(3d(dlTW?c^*B0dh z@u6YBV`DX~4IjD~;lr+Ps9m2_{m170!}s64C>e6BYLj_uA4cu32k!pp=pB2rS1-9Z z^m)a73xY1PHB5ePd2B4<>nM!Z>Rb*z8hOk0@nFIztjVDz+N;w!v`o7XWMZthkQ#Bs z4N|4bliq768@k{AMrRz)c;y~?cAS1Br6x5k^?i&Z*NDr4lOb#>f4uP#SIPSq=*Zsc z`xK~NX8L$)#EOGwdxIlP1Wl!}k2yz|ey^BnM{*L>OMDM6*&D*=>zEz&FTMs_xR`Kb z8Ykj7ego;7G9LT~!xgCOaY;$@PPE7y`LnWXP05>6=uIM!iJaZ}u}di7zJ_S`20!Kf z5KsO?#gmV=wRlmx74Sw>QYFE3*qRPe;0-T>8X24o9yQ-Un^x~5sZZUs(lQn|U z4Eicqe~g!(7Q(Lwb9yJKa<|;lYGyn}61(Tz&FU9FZh4n~h|UU6XX>|3$rl$91|aT+@N z7v~D|a_!)-W#_~xkZNV0Yqft_c4uAkD`?LZ${?=_O^de7=R7(LsY}c4)wS~USBT9i zUu_pGoS)@w(o)eh{GWHjx63PTrPCJkPRWW!$5aZS&N`m8PlbL1?(?G9Rw~&iR8mf%%I}oUH z&!XI(c(>eujg=>`%$I+_ADCGLl&HZ3Kbey&FuzJUpINUqkcL4@C|7rFdDgPdk1Fra zpkHBhckBz9+3}5k2P44Gi+^W_19$iR{zdt@_{z^G2a3ptrnxq9J84X3B5 z&XBurwx8U$y9I!&Azsqb+QEIV7@2U_n)Z{Wq1KFyJk{w<0f;q=7M|Wj3D2$rv zFPMQR zE_>GvbzQn&nbPlF)|O=<^Cq%dHPo5|<1WCg5V>#q>maQJB~poR2e**^5`?okJxaNk z9&j>CUuQ0HevMkK*CG1FVziKVP<~Jy*b{I?-^?-(&;BR!Ybai4j`MxV8>4m9$DPxo zz4J|Bx-x%z*)hC#A| z8iC`!n=JqG>$aZFXg^Wjn}@GxEr?qQs4t(jkp%NpKtrRl%+_Kwn4sj7V~z4fdJV%9 ze?#tM2b}gqWthPa&l^)dLTg3ZRPn7U4wUzA2|a(61y1Q@w573jZpuR|a}um+?iG;p zlXbf$Xv-hYt~Z-i`o+ZsyqTWg6q15h>>{8pd;Y&_=KsIQLj@NQ1YB&?PcV~1+~ZHn z5YpKe>MndVi&X%y3g37n1yfn(1fleBE$vc2P%%TJ3XidDk^bouQbYs8+Hw}@c?1oPo$)aHD2yc{v zOHTyRrSp@nK5d!IXA2(6fKR>MkQHhxQv?iQF=73Z!j#ms3#(V)gMM3nVhUCIEbH%x zMK5VQg+6Tx1vbFF%)H><(q@F_EA7igvTT37)8u3q#1+AvHkVB|j~~+{69{&}(9g1g z-T@$ny!1s3$w>@K`%mB9?PqpDb!e|%4<^z9* zI?K7J2}EdsdR?0|U<_gGsGp&Ip7?oToWo#k6j1#PGDVP;6hYQq^gEkB;0HS1EfHR5 z**u3hZAuyBDFk~qPoZ}Z>7*E?ZSzW)@V0dhBCTi1ol-VwnG`(a&a}BPvOWU9pcjj| z@#*WARkU?aPP?(Jv=Y%{Wgrw-LDhd-Rf<4DZOqQ6kK8}Oe-z_fSH5TFMXlR*0{^@K zj8kL*4Gc5GctLvuQN1g|vM!-%2o4hlgH+3jzf6abm;)hIEyj+8+8609)*_h$K#@L7(%$zc5R!Ulh)U|O!R zPbuj1tNie$9^epz^@;4jQA0Fb{&L8;!ETPsD=u2fI^|lBqj&;_K}4>X^UTc7Em6pl z0`rr%LG4iC`#JM$SrZZEc2?fv)79*UwXjy<38Zz-@@z<-QC#O4J89Lul zbYchX|LlPk)k-eM3etnYfQWz5!^c~1Z+x6F9BzStiH5Jx2dxgfChAKASYky2%=#8` znjtl+8Yg_R3$Ns!YHrjwg^C`1E-Q(-TS<1ElWnCKqS!i;{ZKNL1O*8@mlbOEym|5V z-QN0A%cCl{udBhQWUia4i|qVv{=JuxB9uM zg8NN>l+kr0xir7j1QlWX8E<=!^EHu*R$d8}GXM&WKF{xzeBGcUrm_SVm1mRD#p4U# z(tT*iIp=#F-ansapaLOLwsc#=&MYipTe4ixL|o{oEIa<$^Y2u8$^>ZO+s)bWlbg+V z$nLT9io0-_MVK}HumXQKk6G{KcQ@q6S$o;2{Sg*kwvQ}QHV$8W^JeM`@Lq|d&va{M z)fd!U;A{;AXRcsLrG%J`S$s2F%s_Cyh^YUi(9&vrc76jdq_tfc%;$7JMt*^JXsY^_ zU4BMgPP-Meyciz1Q`@-!OQnzK>O}ct9+mcG3evH&dG-t4F#Uge>~7L4Og_|ytunP9 z7;u$=T!V*&rhVuRTyUhC>9^>>ApQ~79hgrte{%O4^I}1LruQ0s$Qp;&-z~4M=H$!m zX0tqWA)zgPyK_MZq|f_cmeyZ+Ui{Pvr48eHFi)@O6zhE*Ma@CDPvwAro?>}{{u1>6qbJH~%K(Uu zR~|9|jpt<>&e+N{T5U5wxLEa3d z>tMYB%eMA(K3jY&8)MgGzKQ@wu-7jdWXT{Gc?9WlHQ!#r8gf}MahYb}vx}=OsPlzL zb{&JM!nVOm91+h}ev2VFiBRkPtvhFUfbm}N7W^D>%g+ca;gn$`~RO_Bygi!G|G^wr6P%-!H0woWP2c7oOmy7wQX5c_uAQLmzOb@`q9h zYND0%xCS_)pR@N(yPB2Xfa!9PqiJu#`H!L)RWbSTU(R=)h;x?h#^yl&EWI!^-RG)t z0T7ul?Uyx6K zgICTPC$gfZ3`HKvD$BI*W?)kRYs)Sd55 zSDWj45_5xKpC;AKakOr(;nBoRQ|cqvfZW-c*Jq$?)YFQJXHPntp=BUm-rQ_iN)eyY z>aBnALdzwZdZWLIJBZiP>_%WE$pAB2U3m$|z*AE&U53|IpUg2BF2{{9jJC#^j>e#D zcXr2Bj>hWFJBnts#i4pkHhXnym)~#*hFfx#i`Bki;YOHNJ*}}8hH`UN>Hz5IZmLYO zntMdrO|>`ZgSe}TRz=qJ=it6d`wU0JXdHiId)>XkZhB<^Pl3>zb&yx<0PhyY%heVd z6nMR)Tv75~uvU%)Ua@!)>>=JKeU=5PltTRHT>$Y_NTLvc5lSm->V?0}f^p0E+gB?F(q7~Z+K z)i1IVWJNyX1+Tl&(g9SVUl9Z@039KV12`s*)lZoWv<|108#mXqZ7EPSDuqKWN>EVrAN z3sCGOI5sJzCg=nb#O(pwY}r=XjTOLa>9oTIb%6TE5cTdM~oRpzJ5^T#M)Ck@RNF~whdxkK z`t~@+4ziZnf%XpiD-R~mu}z-+vV#v+&*x$FGz9a0hgMHDyt?ye8RzB&KOlCosp5Bn z4z1sXOKLLq1Ej_ZZa4jG93`#fhq+1^Zbz~n(6w+6v>znC^I$<7+ky}maDK2PJ|j!w z4;d571JXHSFT&EbnMZ%HBn-4AA#$etE=-AmqFcXX<7423xySX<2QAP&ud9BDZX9!= zZYZ$-utGnq(9>R_D;Jp^EoBA2EJVg+w_#!CNGm8=z>sWMQC3TrdVP~r50YkU@Fw_3&O|3IpD4Bli?Mq8*?pF^B5Z)Y+kDED zHz#|ZmGgiqUi5#cx%*^Jm*!pfmX)k24V!tcoofeHdHam&Q0ive^PrEvo5qbM@JEu(%?-X^h=i`a0|U?6$9L2$T$a^d5#9DnEz1O*x{n z$5kM87i`M=L|BoiC`lnIM$uTZsBr+ADp}+O34s$+jknN*eut1_F*t(<+kyqZPI z)79z`t<4=0CG#M5UF#>VXT&DC?wTHL1w4eMJER0I{1VE`=gQgNet7x(Q7(V=#D4lqnd@}+G&sU`i{$|Q!k26tmh8io1!j%h-YCsVC6pBRTc+~sSFnk$ z=P*SLr$4(gb(hqDiD5T*nO_+-s1_Bxmldc~BrpGZabcBo?_{FAp)UP3fxMWPv`)%x zFpz)p=*GeQ@tijaGfK`PyYi9pn1kihHCZT&rW)S$ajPFYQ_7t zVbs}T4)zT7J)B;I-%x9*eBJymnt zYZ>iAqUHWt`-wt1HceY>*^CuJX3T>;R(`HV|8A?ANx z=%+NNWdXf%yMNYHx(>rWV3;w%99#5)X%t|@=1ntD%3g!xA_L|_7}rhXa#WK3ExR=Q zDY)LR7EQ)=!%jT_8=|?<>sbt6RdYm@>%hx8IK-`$2B7A461`c>M)^e6)T_J6t_h~U z^-#TZ!@XbG6+ewvB++$0i_8esO45H{*0dOMWS2Z?j;g_b^#bfWHkv$XEgm%(g1S$- z+(($~xBn9{wn2dKj zVp_PCb+`<~bLaLCi;Z$S$LwTjmj+UR)^?965YhvI6r-WFA()p){mqVdx6OZgFn4d8 zx6pfRy~z@t!~*08_P&Pop@nR=SZz10b1c>1e6?vI+ApO4q?Nd9t*j8QQH}-?CK_V& zBL79RJ&FNr1Fx<7{{xsU+C^~N_PFJt@X>FFYeLYquAlsr&zk9_digi9xeVs>%bj_6 zN$o?NT>$F7+r%8I2K1uvP9=XR#ay~^o$m<#S|0DR@pJm<{b|+T@Zo*Qg8&vsI|AB< zxCO}6sg$KLUWrniGRjrJ&hwsJ>;|pouKDY~0ISQG{P5-_JxI4)P?vaF;Oe3dE`Z-I zDh3Loi3WoPS}7$Ybhc2j;^@0Oak}5FuJYx#UkVRewhWJOQH0#DwB&y@#%KV0g&qn$ z6#b=}q5m2#)cRZtj|mUj;L8^spkY41GPoN3sq%`D?wKCAb zL0*^i^Q7qGNRcZflE^fFToiiRlG8Iu)6^V9DI*4~joS^v<7!)w%{uVN}H zh3|L9-c?Knt$Bv$Q7Y1yith;4|38)fVQCi-T_}tgza0Wx>hi6#>x#dI4oahZmh4!s63#rl+hm+PUeR z>#lolShmx2y;N2_`s*NN1(R&c_Z-u3UEg&qThl$yI_bFa0hYeGWEt!IdzEHQH-Ag* zuH*{he{9oDnq7~xcbP@X?mXexE7|k;>!}h3uvb*5iJxr;^IMtPt|Qr9_He!@0IUc! z)HF-MKiB9xIML6WB-&l86=k_|B;IQs-Zsva*JOP&<5z#u?FvuQFJJ5uEaKXwQE5|C z=3Y|)t7@*SmoOL5ziCGlSLrZMCVy*Na3NUJH>`8uLVUGK^)i-BY&rz{J=D~?eO|gf zi>@r|S-7QFYpqIhQ3Npak>2yN1d-N^W#$|>uVJ`;U2dM4d+>rZe?ck|7~P0ZB^_jt@) z553-%*cAM}?(~IZn1?%k^YX|;-091a&i;7Hwp_Dc+0gSa_aEYV-zugCxZYQAdvAMJ zAOGUpBj5C!Y!__Ggr?9vbH76K>oC8{_+%E*Zqr0JQdf<3XSe7Nmwy}&amn!kcNh;0 zn$Pc&W8780y>Ie8qEfbB_1m`dIoAD?rHQONEXBMZHQ#@2CTt2qJzR3hyW!!I%Sl~w znce;NaJl8)4EAujWd$fMzYX=_a!ZNJEoJTh>EClXkMF&)*U!~7>zF4To=oZ<$g+LH4W$dGP%) z2QhsBga;rY9Wd4oh_SK z_jva#-%v3-WPg(P&r-%d-xBkazs>ESwfD%S5c{mOM`mfLb@j+>9=wX)8-G35%-?gx z%bqTim&s*NM&%{pRd`An=CkyYWF-tc54~b5d*>=~Sy73+1Q56hmzSb&-aE?5h8Gk^ya)K@@D7c8c&D54BSsYNvdTwNvWl zNaPZa)xZ5Us^nYa#ecY~;KPzuYQTA2=ml@SsR;VPa z1aPj<^H{~_u1Hr4S%raQy}T)v8KCt%D2u#=O8d56$@l;4=ohsNmCU)6G5AD*Pmq*; zh&4w?f*v7UD$zED?oc*tuKB}NO%YT^;ltH%{*s^Pg>Ge|(<+$_&3yR=dSsA-D$cp` z^?zNs{{Pwg7VfrjCC$IW)y^5)cjbp9ztY=%r=2+I_)h0Bv6DVCNmhrpXqz`OsUf8# z?whYC3;dAj25wZCemUe)6jcY#Q20{tqgqDF- z1dh!|S1FI4a>US64mK1$<+&F!5R(j^1Am!FR3t3&A_gI8^6*%`F~Pc>+IL7&;r9TG zfyIeFBDd~cV6#Vm0eyP-HY!*RE=t6R1{XzBd#-?sqOL=fhe#P#fJjL_tD*a^7eva) zK%_JQk-{KLk?nu#+TM+Wf#Lpi0?>f4H+lo0QbgWr8Y-n|$PHwQD4q;tN)=FwD1Sv3 z!Zobz-`-!G?=Xyt3>ZlG&7L#F3fUQ18^*&xrWnW+Id>Y!6a$$;7{frO@Iuo-rpR25 zr93)`gJ0Du9|khTK&BAWXI01){c}Ke2L?KY|6`z2GS0x*k}ZeUDLC^+HyP*@1D%rE zMkU2kn**p3gPJr!b#eownxol3r+;(^n#4e-NQcEhr)=$f+!Bk^eg3$`M|~DVs+Y|J zic2v=6i99W=**tuG}QfgvJx?%Qsfa{R*NDJ1D6QmTcHVwxJPIvv7@N41p}R8pi>NV zih)is&?yEwMRT{5?20TXiCI)|#9M4uv6x*2MfJgPz`&^#{4sDUcoa4yLw`N<1f_Y# zHE=5FF)?r|22MqN39S;GN)vmnfmksREA>OHTsz@>JPQzt!i_VAFvIC%=(Y#4@)ULd zmUVx|x{qO2&<*T&_OroRSs$F0B0sNzT%kj3AXoA^&_J%N8sv(ql4M|5*dGJKLdQXp zRxOJMDvsGujM(U*dJ_3{J%0q(STT&cSQxW%;GLvt1H)oqSWY1p4B*3tQW$|p+R_Q0^#MAJ^co!X@Y39 z5pXUdBQ*`@B8;!WZV?5K!EO;b$zZoI+kNvZ1s&XRouavKEg+5xot(097!g@;gX@W^ zyR~hwTQbJiV7D0T7JtGR2D`;zw-l9&FxV|;Q_w#>7?rQ-N;);vdca#2KFi%s{ckc& zGZJXpc8K4%-D+Z_~5aVc@h7jS>&o%KwGLzVwBY!rPZC`<81JptXTQ+|3 z8R)^J-QDGbBEdcoJdOwBiJh@yMN>(_NOb^F2FiFS=g@oGa43ya$JP!ocIza^#mU~C0D> za6?f@O5s|JUdF%vCrHeqmKE|=avm@^DC>!XQhu8?Xn!XL?Ieo}%cGq<5Plrvn#8Sv zoX}M;CaZu0HxV3Vn}BK(ZB&~9ZgMuA3R8^hO!KkHIj_H%`!q%JZ03ghVig8uK$y46=kuPufH-exKZ;i?lGahg9U&7bZY~P_pn+;- z)%i?cRmD}-K!l-k?pPG3UmSxt9HPWAS?*XDU`!4hhcQX#D(SjPtw8`oPOW(hUYSlCFTg-c>Lj!Yuvi?YLhjDI^pjYyQJz6FgsA!-^ofJPfG&3)@; z5yHD$b1Y9%PzE479TXkrhH$u$gHsIla?ueuWP=Q#gtt!c;Nrs=yc`e&zLzZUsKP8v2gj{2dL`v~b{%tewL>Izbrx&SHiwoMuMyU}0GC ze1GJ=+0kAW?gNMQ;Chn5leKodXT5y94%`Vh3YdtFqmWQGH7Fz9M;S>N2@IBqINAnF zgzCDN*mKJr4@SviwN;4g1pKR=t= z!NX=ChlrfiG;)YIzy>-*6g>tyL}Voc9e-k=Lo&^`YDt3W2$My>_CFf?c zrfsJNI)n^^fey)GQpR->vx$no2C*k!`#}K_;&}JqSO*b8w~Rw=01<_*m&8e~YJc?! zG*nqm!YF)-KeojKzdMk}L*+Zdv5dZ=b84VN)(1MINbApTj$5jUvsTuVe+W1S84HdX zt_g~P!a%^u%kd`R8&4i@l)GJW@+h%s=B`PD9g;ZLMuTmzLkxC^!444-Pr}7@bliYL z4gd9G(i~9B2j6qJ5OH;kmap*Opno!1(#RkKX<{HvC>N#i2aqN*233TIU-+w#3n4%+ z-kz(%B;3P#DU8*Nl?H`4J$6v}l~*qK8hBefAGgH#!p|SK_-M?65c0CgIY7(3kM%H! z)yNHKoY`}nBf1|?**-7C!u?s8*nfHynvh^c zK`Wfkr?3S9APYSkzmD|TEhGrJL|E<#ocNlJAEYU%Y1VDT|IOl?$d=g#p`4^%-(Z~> ztP_KEVz5rMWS3O@um~e+OIZ!X5QA}|KE~=pY%op~$3s_FicvT?b*VhkNlNEh2HuIr zn=BFaBtfOYK2Z<`+7K=Hp?_2^eur>8I*fgyzwH{#6N7nDKjw*z_^>ss6J+Kc6V|6d zCvbs$Uu}RB(R`f&5|G-IHU{V9ir|1d6EfFpk93k&k__I7WcgzAWhhBRDuH*Ry|@hO zNoCX%?J*a%AA@;PEQnN1=Q(Ei<=V?%(9^7r=T$f0D|4gn@y@I45r2e`R^m?1K9mby zuVTwS7lBhp2%V(q;_%w?@j`hNB=mr-gm-PLpBq7dl!G|mNu-yBsG&yGq8knJN#c(| zKIs7R$x-9TC+S=({T$Du7LZRe`!L8S2Ki)tkWcc%lGC-7-7pvZBm?+_7z3ai3)^f` zkS6aOFjzWY9sW)cxqk#D1?8ZZ#I_g%UD8eHl4xE#0${??vji9uw(KN7Wu^tw6^lA5 zpcU=%?`I$foGX{862pVx(eALO|lh$^7tl474S_` z&uXaa>xFM}Z17E*z&Cm3e{~R`&kI;FSmtj6!imUBO(UEnhuC18h~md!oQTY1Fis4{ zN%Y5HoEVG~O^=JE=yI|2(B^vrnnNm+J_+@ZeA-}~@B?BnP7KD0!8loOjFV!$-=Lfr zl#|=3{|%0hu7BquhL@dfBVI8mCkExjpqz99<%G$0)pVJZg@`pko|l2mX;Rt*@X7J` z9$caYfB?w34`D7h1?fT%_6ycE2+xDtj`PCOZc#-HXbZ; zpKKubiLTbTbi9r-Y1ge2$wH5!(Txl)U8dSVp_Cb8^_vY8O4Cp%+^$|42}PnAv<`%# z@gB>=K}is4U{D%^L8-b)Z!Qu_r487Cq8Lz=EJiF3iV}&;)_)ozDRUuHQu|jiz(86IuPSIta?;lwH6^W48PJqwK~uDsm%&V_ikVVEqGhN_ z20f*2^px(I+YNY%0Z%dDDX&PpF_M@rathJ_zP3zSQfGPz$br6o8A9dEx+wdjxKQD6 zh|=n0nRQ(NPdRQJJSCmRrJq51+yZz?W*-JT#eaaOtPglfQM_|q@F|i0%xpT@_$kq? zB78~?bV@28mYwBeuncN5f;N%f-?!j4Cq%8|Hqem4rMYk2EJC2)nq#4m!e0OZ=%7$C z7uQbC0*lClbSQus8KzKAZomgK=b$7){Q75aFF4SU6#-D;tV1R6Q(6T#VWb)iljbo@ z@_*PO55gqpY@R|gDP*6(nL6O4dF_*Roz@P&7L>4!sU`=I8p4 z=*)6)Zf*be{^ERxjRH)#bp|5+5zcv_u0=P_?`^Eg&tdh-j)~f%BBqAb!w=f&XPV=7 z$+d@u?%O?_87-EV0p~aP#tu%}1CmPbsA)`uc41J^Mp}I+qSNIaYSu!H(%}$R5PxX- zr3WMjOkHUm2?!dyT)pPT*Vh#+Bs?M@GZzpahU7>#z$79IZh*tFfGlZkV~fl;cRID4 z@7OwmECdMy0eb8aX2RlmeW!4&bHFd6ZBVkY3BeU9nEbq2&mvB~B$WvQHAD;*Y=}wV z>nC;*8K!NiuWi{1VX_#G&tTpfd3?U#qq(WQYnibmcl*E9NbOMy*>vhl`9tmRnut_MA#LC(n6cYZ$4FHJ& zAlX0wl2jRT-4@cOYn`Xp8-0W`2UyID+GWZO0sxahY`=*?Ad&M?m6Xyp5lD!xR2qDQ zSGAUaJEBJY@*qcI`V87gV`w9lcH~Wl8mYM38n_VyH&Q>`$PLey<7>>8jU#`KWO<`7 z%EU_Iih#l8r61070Y&)TsVMV4C1h6*NF;ZXTY?fP7!Ru6gbq#<%D3~Ez!*{Dbu~N( z6{}XEbxWO1bk#Tg1;(p!{$h@v+}sTdvSAp$?w@$G89NFPfN8O|oITdf_yO`XW zAIu?OgrwV58>_u#I{Uv4$&_5{)O{hyc>0qV46p@OXH@xOycj3cQ?Opkx12B zf7C49kQ&x;(MFYzN?fD2H)yjB3tQ?Wah;V1G#0Uor2W&sR#SGDKpTI~oJ*C z&uj?7Qn26T5)0weQ^)pnsnzlYHna>Dp|Yu?jul$Bs-tq-j}Dkp-b3W{bc|I6WHj{r zIehVFGd0FjHy+}!G?T%bUYQTB2Vt3FsHxojXyo zPHJiHx>m}HkjIppG;EW#E>0E0mM{g%Y_DgnOfN1a^Q5+kQprrI&M#%mmE~5q)NC0K zn3|2Ugq?C(htpCv%QltV686g_Yq@1?nM+U{E88`fK=V6lBgB7puJ7{|pty?BaEauW zGa%MLa2E~~x<OBoxNL8!jraS02yj1h7PWR@~WE`iP}#>pj+ThUOt zj8#>G4X})ett@6M5?{kmml^J=#?0zGU7G4@hRqs`o7(zFi3hZoPYGjZ9jm-4wXCbg zR26&8xihsNo3ww^Bn?8VWvcnZcIQo5X}Fwnb?eHFzrb7MK;5pg@ZcRVnvJ&rrL}7o z{eIoCjOlR6ZbmOU-)Bhep@2TWlG<6@5=*vd$HqsGtOBaZK`_W7oU&mscRO>2#3>nM~M!3#SKH7bxT?m02Jgz4Go+ zdDwGv`%I0@x@%-6fM!g2%tDZ=uSGZ?A_8>5EX1&)bs?KdnwH_+X2Qy9VmRhekWdNI zNXWGSA*+8ui}ttnX|=1Jq_ zG1Emv^s5-1v``*1vky}q)0D?tr}CJ^Rd$kf9nNy=W8xAiVv$VH0K=%d9Z{eO3V}rp z2e?=!Ip7c)tbeuMIUuIUW<`ry;=AI4ny9=))a!qpGY|7y;7e_y3KJ2IPM^?+uI16# zr!^pHy-##I{ly|aK~qe#)?%7)5-3+kGu_(pp7rwaI&dd^#Slb93^oQUHb5-IH6N8$ zC6pizY`sV)$BvTUv+&(}mvoU#is(i9!220U42On0APwbc_uzDQcyx7e@Du*;ztUA= znMQxYkmxxTXOOHV+5(Dn%YZ%D@*LZEOf@cOV<`wTmj};gX zQbjy1PSlZ-!1pfj-=n{PPCa}Zl|Q(kZy`61?;H=+4)LXD??}(Qc5fUR7jcTx!QSY2 zZ*X$5H#|H#mQ@a-eDKl^F{0V&$-&^@_~d`!5dJznIUbxGpY#d~KbZohcxl~y0S?Zn z$TtpsQqz$Bo~(6ApN`J%vPUInb@rS@`DRbGRG{>v{sN`>3QqYVr6(1Nl%}55IFzhc zks7PqcKYJQ>w$WgD5yK^&KYmBp7yMgkOQ$D4$2GNQs8 z@~$U4G8Gatjw#p*D(8=aV@Y(=zwm#xbybSCy&*|at<;o@7;4P81w!d=u+>$GRtS2C z*$a5`KEqq9Q*G%UY|MpW5S;Q|90I}gmS6cb!q3ar&c`h=bmMa?_0d%FlY7YdhJ0A# zMS#M7dcXdKtk%!y)%U@4d*?^5BmpxU=Z5$8*{tufyvgO3>|=p`Al)Cvx2}IPorKC& zI4IjcMG=E2E|4S{;wZpG4UV%Ze5tSY#y>9KyzW%B4aq3VN|D%;2`*x5Pf?&W375pr zSm$uacc%*Rks25&+R2~V$)3FrLaeXH6E4xGp6pa2{j#nUw^y(_K(L() zCU!G2@yNV~I1V!;gjtAxh3J1F>dF4Ayo8ojwJL9Kj%p>@XqzhBSoke4!n=w$CNZUl zlaNKiU8h)xGas{4(O6Rm$0d~=Fu0O7>dx6>dLU1lituEy+37M?cxtwGdaINsMAejT zBnCxkdX#%>Su5jVy{jd?c{a6Z%5Bqat{n-5`b%hgRaQ(&2Cv+zX)b@$=fZAg|TQfRSh5-8=sD*^`p!bYEH~=&ir?Xa!gr$ zbEiftXDw-MSTg?>=B=yokYb*CDnFgGZu81w0p3FI!-K2^$p*SpcB@y-Ag=&1oOUfJ zq>R^Af%YtL#t(8Qp>>NQ#=HI;6i!v!~ZU0RWfA6(lP-i|-Kjw&@k*S(Kbc$9QjsP?HsefOBB z`;2aSxej9teO0U%#<;A#pJ&z$ER67%Pdx|Rs(!GG1{p${XZN3afBzYxggh&pKTaLE z0m+X$2*dOy5KMnO^@E?R;O=^Rcy!da*k3#U7oI|@FtiG~utnE_h1Y@g%?>TRaXJ%} zboTQ;YX0xP{*`rj`%$icp=}d#%Qf?_fYV6d1k?gYMqHJ0eV!0I~xebz^LGm+5ehT|oK=M<|Y19Mpiy*An5!#|B=RU#ryM;ap2HrHw z#E798UiGbT=G?dt8-wxMgeI>aEl#7xfNW`%anFCcxTW3MvVQuOJ%Qg`I42_*GYbrx ztb;8C=Z4R#1iR0@l{bNKyx?d@j@Yz4n>`AxO)!X{cZXlyp#0T}^0$(>e3`g=MTju( zoEsm=eKfFqO0awdlWO4YwzsaQw)X|hxiTFOWLnl?o|z9A08~1$J7=fjzWk7Y$T6t4 zONxISCj*+>RCv47+TiVqcm49ncBd7P?NZNbDCz5kZ1=<<+trF}_tptez}e-EO>rDI z0@P0AqQ*e&QiE&o>|}#w@aznpU6v(MaG)fYrNOh)D0XA;>||<9gd>GOo1{gCJQ++= zf=L-Fl;mKbVn|QGM=6-e4W6CBvom;h>6L$23!a^V+LqmvfwJTO7%02upzJQf|AgCe zqj3_NHY$fv90c>!_ouo6LnsdRo$cWOK4o%xgKvYJnAjLcAunzvlO)xI@gz}SuY*Bj zL>c(Ocq|P3U>)#-DfGeh1RqpNzf+AqM1kzo6FHvyJjUj7!w(fwxz$z;pTZqQ!d`#Q z?O;w68l>8seaKJWR!rU2O54^-+3v;Bxk>@Tdbx*%i7xk!jcnW#vRU@2bODdxD6ja{C@m!qYL5+RlI24aeXqA79RWocLB3L<*gTIy0JobLN+%)p6%C zncKm3VXwbxa4wV?N=e+B!AmgHFPn%i!P^)#7pwPA|9a_gAsqs8f%ScdvI@bxio$}I z&7q{ev^Ev0;;fWND?wOk*cG*5N+jp%lcWI+twE6+KC`_W2c^rGAqrwSP?Ud{DphTw z*epV?EBnY=D!X|W4^b6VGkX*xL+WX0iU^T4qC}?7H%v85Sl&bw=J;|Es6pW|PZdK_ zz>!1@iqg0KI`|>NMba507?FZcKLIqkQ%HCdJa+CtELolBm*l~yTPK)5YHWq*#)sqEz<*e^Qc23>wq7%- zXlzXZrS+@+qN1Xj0!jrVV+tt6Lt+Xjb>wiRQ-vt6CQNz@XrYwSI#+*CO3clQl~B?u z71712Fh$EoPk@zNIbtU@FCKjn+~)d8P*-{hC5CWSR#93quiXmb^hJBBRLM(NMf@2y zy@VPsNTyHyO4cExt0?`pE47kRqHg6DQ*)LoQ>1K@ij)=I9<6@Q_nf7dG)slY=GyJl z0mzGNgPT>@>_a_;&8~lwLRM%grHAD=_O*Le(&XN)bOd*4|5j~5f1F5HSMm)^aMNO2 z??|)SlDkc`YCY}F09MxlSiM@@n2}sG-u^J!se>8cvGB0va-L!l50m9rx-^GcLSW71 zIMfSqoPDrDP(masU3a^N_p)WeDxMa}eS;a1X1!fvLK79E@G+Pro{oz7_h`qrb4wtKCff z(6QV(^y)nP{pWpXIll^sT7so|u(n(nw$tG}@Zm>so z>S*O5mmNTjj9-6dL8h{<&P|r_Sek;|2<9N?J0dP+mrW&-%#r6;2r)-6e5;EIOnnw? z6&NG|kE|jw2&qWW)JM4D_^!c^{cM0V*yy=7 zw|DmVuNRXHFfi8ouIo*qnZg%|hv%(wDoD>>%06>{&98YSiz>&Mzl`p>Wq(bqH)Uz6D>3S94 z7#x`D8%8P+8d=9_+ckT^V&2Ois7)Qg!I25$E>=sQ; z4*q|SsmYO3lS68w5@k#tSiPz55RZka?;!Gqsqat}T(4TP#iY+|b`pk0vbxE@*t`r3 z1IT6o*%}3&*MtJX&lo_q%^n#8$QBQY0c6u;HUr3(SX2g(tyT^)fNaX+Vc?_;oRk4( zGgwlUV7Bs(uD{#i{28iF^3H*9>A-pGyWW2sn)~nymozY_MBPOt>L8F1O)bhs2||$z zLj8;s?}en4Mmumq=e`q;Zx9LNfY30WAtJ`kcQ>ph&01-RsoE6t`2iK(n!H&Q6~MUs z;^M^m{JUP*E-H6abIFEjSYX0Xg{tH;<26zi6=6iQu_=4^DDzs)oD&BfC|h$HPd$HE zt&&u1-BM3R*Q~l)e`30BdirZ0euZU>l7!GYwy>xOt#1x|zV#R0L@{%{C{bN`uuCMZ zS3jR!Il+SqaV`qRNDVO4)RHd5F;(=oC}5c?6pdm6B!2lCg$In%B`!XW@kVf^xqR7+ zNiOO4_))dgPOkLE2^iHN<$NVU+9QAUeiRuc1|~1wkE3!yq!_%K6gfONtjdD5`>~3# zZ7yzgPYeXwCg29H9_YnFMQpilSB2t3YDWZVMdU(;%msZ=E0U~LQB=!ErCkVEvyh~! zY;L{Z2YdR>h7eUIx?3ket?IF!H>$8xs*ASWtzMPTnmgAmYg}{pBu#xOZ_a<0`D?px zdkTThaH3@yih65I(Z8$X+tsds`=geLe*q`)Mkb(k4N_B?zz}q)Q0v<4jv2a&K|n8I zYfO!zh;=Cbj5TO{{_d#VF^BP5GCZb>sMZ7Mn7NwPR)5Z&%Wf;qazLJnBxsX?AE2B_ zbD5S}4<4hyE}IB7)w*OcdKG^HRMqSTN%*IKt)_M~NQ18C-5@EjrtXjx?5z_ZaIa-^ zC_$>yrb1POloBH)2rD^6s>779@avPL5yGhy#93dY=OXl)Ch8?*obn3&nah8!Q;=I-AX^$J zg(9E;k4qv6#>z*D;xcGjE=1M9BYf}IT7r*oQ@jL});^$2g3dWH&sVgGsoDlA#wF1? zRj>(E+U@dIhA@EN|95Fq_Wn7 zHuQciOF|n2saq8)oI!t7iP5nzv_OuQwV?%i%2*y+AgiPmq7Ck@aPZd=QKiLHNg^u@ zozC!;wN#YnIZU1Etv_mJ77gn~72d7OAhRrMNS=Op?!eitPQ5UxaCS>G{KIzVbt#32 zi-NEAR7tJ7fzVzgF-FA--NFMJF>IT+0M(;y6Is8iWh>igwj6&8mk@Z``<29eZf8~5 z!}{LV=l&o^tM5(S2Rui4!!UdP#7$rNKOQH&9lvS_#( zqoi7fex07|Mrwbo$C%xTDadFFGOkZS#zIJP?YfLn`9)WvB+_baUmvV+=G?fqE`$+W zKjzd~#N`z&|5noF7GF$}yF1*ouAq;IAbSBnfzkcOo=!nc1sM@yB5=K_xh(m*4-F%n zR#dtX-O1i0dW{Dkeg}OQ>Adb7M?}mW9OwY8o0^Yk%-(;|f*ICtfxnogid?Q$&Bsf+ z+$GfEHVv$(KpI0HV=tUXMYN;0nk^Y`htT8IBvT{WpQ+i$HDv!B4 zX!&A~X+kxsJ*FSl(R$ac-XpHT6F)1IA>xs5(q)Lm2VqZgKzDeP@L}~nI^W@y5Z&+M zB2j$3DAi$tGn$khIFUghS=Pk7Y_Gno5sZ z5-F)Om`aZ&Yk)G#K!zuR9Z)VGL(oKtL86^XkBX{Wc5|l8Bmc*gdCV#EC^69`1&k^4 zh(v$MAI|lChC5IPC1isll}wpO>9COKBrMa%G;}F9*YlPF=of$r$MzTe^=t}X;A0NI zswI&Ua{qDp=CyJTX`_j97!-}gcnPD3BfS#CU{4_M4BN`iS*GVR;^t!yeO|3JJ5ebp z0fMro#l=4Op0i1%=(?Eo@xl+rNK}n=nN)v}aS_*t zo+5tC%pqN?4U`&Xm30yoC}n~)bJB8ab9ArN7Tuw`l^B#?{6>92=}0%d#l*K<^FrdA z?(8BGMz-1l5{7bB7EhkcUb(f@T=p4Pb33w*uWD(njCWa!D)YK~qKIi=v zE$Yhfm?r1Q4U@IOmL<=`n+1m~5x@cjl0-kt7o1;3r9s3~Qr)YT3WhA@w>GhmpWQn* zUnpNOsOK$hYJh0zL4h>}F9fLL)wjdI1q zmIF+XwJDm)iKQwh-ooY&Lcml|G!+!vte{vzNP7O92ufwyXuWf6aEtsD=c%B4A`7uR zdOCoX=8FKL3@qEToFMRnuGeF%SK_WwF+b_9(8>CJ{f!vKql1G+N3rcHh_Zjn20UT~ zz#~{z{eHN(juIon{jEO#eS2pw3H-3dCBTUEvS2sVh+^pO);>*-gF|GvFP^#z-Xk8J zx5~cjp1qjgqxPe$nIgFoWd{*5QF5h==88t_)xIZHTxH2i20Nk*cEq50?1*&oO^Nis zK^xc+nVlHy2!kE52G|iwLC$~4zhr&|_3-E{8tE00?JqFE~tuP}bBa)s%ltviDJH{zhUs zoKdt8nO!~;%>iErHj@05mAe_cBn-Sm9qi#QxlZSTf8gSmhF6O_4)fTR$asxe54 zg0bERa0&(Ni3VREiC##>eqt@qqRok=5ik@Uo0@hzl(xOY@RNqs5RHiJTcn$(8TaBKVws=N_+0qSU1$ zpATw2%$torz^yg5$1kt0-j0#I&I#wJj%(oDI4(qlD23I(BhTf$8S^W=1ct8Ry$Zvz zdPM?A<+a+5pH5bfzd@ylE*4l5mHKwlpw6+5UCDRnX_M6j5-a9^v{7M&w`k$HbDm! z&xU1JM%ANju0~QDf|Q{2wgnkgQlC0^z`3lfNBv>L*`g*D3Qc?P)t)M;KsWvZ%iKY+ z^0R*cKO}L{dkfGcI>8Z1t+fM8(VW>NwnTL3AdlB%mL-Rv*M#_7V?25J%e%tiQDykc zy7MY?ZLX!KLySyU*O;6-TQT?Lon}>sS7-e#VYFqJOMx79C|);erHtu-CM zTOyNS*hX4wW+x`C)ugqqL0YS3=%#jM^tgYhI7(@xHN;s?E9)2k7I$t%*$i}x3$3rN zZK0qwmLh8sP`i+Tij#$xm4EsaVi4a3$kBBpQJ#7^SsI9uI-G!-qQzuR(y`s_D&E7| zGAA{JeuW&$VU--p)WbUZ+M4B1j!X_^tvQsmi2XCVnc-=F3d?*kd*d;gb^X4CO@#Q{O9+*q6Jp`fp?cRaGiP8-%Fk(bXwDy1qxtjHH zLn;RpZ6no(B7(ZPL(N*KQ92v~ufR#K^nm0b5!N#_0w&-thxT4|aIRqC;1L1oun3*# z+#@;k()WTJTmtSA$(H5hC-d=f;_`n%4gmhw6u)8*K|Sfs@m%Z<3Lqt|e2Uc|B~3Z_ zO-u4lfS{@*dD9G8((r#x z-EjVlUVR@-w|9P&&E=2EVX#@>Wx?0k*+FdpFL1RPRWUPGs5+w(jz>33A953OsRWCl zUszO}@Z}aiTmfc^r(wldiA0+b9OyBIf6m_@`FhSdHIZVQJ^p$&g)i{2S2d|oD6idt z1TqUCkN)}!x)r8$!oG0Sl~_))|*uTy`q>y<;OQXa{q_;egSlwCk(D_QG2y*nRHZ_!HDY zcW6TptvB;sOybNB=DRF-vO_d}-+c&oAHZ2Lb-qFH$}WX>-Bm}+Xn{x?&AO|DWzr&9 zzdPO?HncWPSY5|W6$yW&V!U30_$h&E(*_=e7Q#&%1a)ft>LA~=K#mp)P7CyuLBwf+ ztdi(BZE$x5KpGtpRa#7yB(lQL=?q_41fB9cr%hcsG@S~FI+#M$TYuEd&Kd|iRaVzJ zTdR@jSIK2r3Ff8PD%bikU)fx(e$dzVJ;ny=Y)s6^_Fo8&S(bkX&L)#F3Yu8V5avfP zcP0>L_&^gR>$3tSIIUakAcXAH#Sr&kl~gj(a1r!+9uWbRm5-^~+5zt-AEm$b`Qujn zJMdPKm9aWFHqdqNV+$!tyDeM{swbx&i^@4e^_Pnr-}%7Il5M^B^X%_}Va_6J!=h^g z)sp=gc5&ak`}=>de`T4WfBd{p?;$B|bWK|q=Re7xj+O@h?9cnNzgGs~XTeM??lRne zMpt(e!lWEZw5G#S9ZI=`|3cqCso}@a^JSAc+#2JDoak4iNjEk$X0?@C1v3#L}* z_8$!`15JOAOVt%xx2n?>Pfn4YL8%f!8T*1Z`2JE&48P_;U0r2u6N2l~RJL=mU{An>v3DdB|0ksm=l_=A0L{J5{>z@{5aC zaPgh!s5yB9(y#gDYkc;Sp{uyg*UV=htyf*I{hsy0_3Wudj?ui&zEGbaj|d+{k3JAf z*R_R^5v_YWw5}b;vs^3yfLKsceT-=sp;Ya4G!&q@B1Cc^gyp1mI@A1W;_AT*cr)?* zF$#YTLPky1eWaY&(>fd}hbxr`SZXU|N#!`DB3N{Upq6W-2|<_=g-lreVFw<_l%L{Q zq}RU12|Np@7bE;sMwLa@n?=^!o+THmwg*~0LT{!gK`fl0-?w1a3LVSwLIiz`wMgNB9pxrxXPQj8xT=0LwVoOFv6e>+~NpV;~%Pb>$_(N^30K$pl z)xdLnwQxmpvQ{%6Rf}%w70&bLW~QnVJkqTeOr0)S2E|gY8cwNh@tthM|S?xv4Qj#B{_14|;iYb~0dlo^V&#CJI z>-ZW5GOz*<HCngz_$1p+&V|i-F%G>uyGKu?4kgl*V_ChjcezYMG2QtZRQzXl0YZ z=?4dUqvO57$;saE@aR}pYKxBNOFP5{h|`mU!NKv#!6E#0dU8BCIX>wX);z+tme)Qi ziYFtNBPUTiEh*P|ZRUDvdtbm3C)4A=I*^6W%YgV;!M1eaf}E|0`|?9l3z8LFyrcyn zW%VLAwo2uwwknmn`+9{^m7{+ur7BYo>*(ccR;u#Ql&Y+?R3!%G`;Uct^M&e#8&Q^0 zH2|@n+$j zs2c6MQP0M0@vfrseK58(0)?!*Nqbp#?t8qGSJt2BS_B7_EN2hddPl56P>>G~st1@xI$u)9rIbCjuFD=Z>yji%m;FEd>)N(ZiIg&1W{E8` zTJ7R-hqL=)djNmFtMITRtl<0xqdOHERclbGF+n%TX^uPJbyQ2pT3jt@3D52wa8oCV z7{4n7dsbcGIl@DAq35##g`8^)d7~RhD(VO+T#cJ--l8a_q-=}|B+&5SpvuX&-q}$y z#=uc_f)a2Y0xt{u>=-3oDB~;|P{8az8w(0(-AwH;{N;aB&zZP$KiEa#WOso*yZ_Yt zJ6>okT^pqVdB_b5t&oRd>fIYXK#} zYulu1>R*2?z@=tOm}+UQn!8mln^kkax+Sq{?!H91tGc;Ny)u+``6}&_Rhnh0O4Jfk z3Nh0xL8Tw$q(p^&d8ra5r5dkYq*x-VDcQZ2CVfdwmCNFy>WYS!xU}+ES?5^G$|(|L zf6#!j^$nj@R-lB6cG>hs0wcA`q-(|kaje>{IG}$b?z;pjE}UAsWh5>urdXl2v(|;?R<(1f8n8rK;_g zsIptK9IA4a_7c@}%T>`;rl?%i+>+IDYb)`p!j>AU$AH?mx3HO`nqXX7s0HH6xp8lyNn9)p!Mlrz%29`*Q21*{QfW*=e)RC3 z#Ui6aTJbAHVDVgCWUM8IrVbb|#)j7c%P)>`Nq9P^3>X|`W}qxOODYGJ!tgcaz)U$X zQx2@na$twGl>^J$#4D8kI;>LqEA@Y{j>5fWrN53$>92ZAe>wBTELIo7%_#jPa#0PX zzqAWI$w$A|Dp=7`Vmm6}w1ZN@&q~c;`m{#pqjkYp*?8p)rI4b{QU7UYg+rPcP zINxEf3`^HKgN^uc?%srPQD0&NKtd0sZzws5o6>e2Ds7kKK+zLY&qDi{>uvd5nMcXm z<68x0Eg@!zvG=#YUu16~`Y$iE3vZ94!{=IM59`6YLtU_?2jq!-6w)1bf$a>F(%Z~A zm{DA>rqOY{uWsObNQuInaeII3es{vXs4p-4TuXt;2`1Vi9pHU8u`OBKlSh~uunSJ7 zkFdf>Juk3OhVVDquJP?0x%z7hE0eDx<+8zXWE?>{3+fp{G6FIESO7WRWafkN(!lVQ zth(tr-`*jMJh-P|AC2ScdV^ug8YbNPB7mqa_<#Z_dM{!8Os&n`L4JQt%!IQWb0YIb zrUW0o8Jv?_o~gAdtn9N+x_+kCW@fF;gcT$=*ud1> zG&MJ?)!a-t8kSsjGb?1d_>7q9=(3=WT3VqMs{V>SW~WeRlB{&NtDEXnrzHq4vhCGP zGv8mSaaOU_)lGD|*AjoED;SXLraRGP38D)OhIJFnbytCxvk$&?(<}B^f@I|*d)<^v zJI;9l*=6}#^=P0}-bMl*utk0{TJ)ap(4jdmJ0S|xddna(`mj3`Z~?{ zK;JrZKD=HBS-*v1;V=APjAE?EAKtuvJ`V8|!$0%!g9}a^?{2JOd5{#D%ij003QJ-F zz~F`o4UpO+iJE`g-|YF#{S+MF7pQ__UV5r(eS_Pv?LCh142@lH9Cd&))am;x>za9m zF0_hW;G6wG1@A%y=1aZq1-@OF5~A_VdEQ7&%pR_030_ouj=|IP%%4tCKF8VA4)Ui- z?ATjOv+xO&p*z$-TGnaUR(HhE5NsC?OYER$+am;bn9+Z!Wpq}2$>}l>)Bg+u)ipZx zF;H`GP3m>0NdngRk4OtZddBzmNVz`H(w+^$_o+UZ-g{WKs~EgkeNB;s1=W@~E)cd^sQ|7^_zxRrKWdv~bS z9mUy|su+z_Li7=8b8;BIDx)c-w36=9^T4$uW~HLDIqPfn4tDF zIO#$^jk8#yw^mt<_1y%E3GYQ%tR|fyf(wh(zc7D+8uja6;Pdh)&ii*47%|X8vDSG} zDmy>+g%A*hCL|#v&nr?=41Uz?#yx@5U-?6Ling~jY=?M~ zF;{%v`B7ZYt%_H%UoZTugkxKTqRnxU=DcSv>3=Q1c0w8cS*_vkhTwFAjZ zNn3w9*gi)XaEeU<7CJ(a8=gB;V8uoYL21&&a-};nNG!FiGX&8QdivPGLIohKT&3ut zmWl%Cl>BIc95MmwBA^0EZQ7>NtEH37X_%p9W)Mz29b^cZ(X%U}g0p{ig`|{Cv@3*V z*;=|spJ;Ae(>(w=Oy-ZT?Ac5q)+B4$*F=AoGq>-SU2k>Sx?>0Gp3zp9NkaG-!gh3? z2@kN;ok&}!Z$WBBH0hl0+oS7j-XWS0*6AyM;@-L)n?#YYj?E-bTr1OA*M``rtvAO! z+H_GWAzXE7HFkhxR3qvc1x+RZa{1&V?+?l3Q7G2t%p6cqXaLQi%y4VQBggKS@$P^4 zH?RehsGLb^yo*DTP2Hh#&Vx97=FZ74J7k<@Qm0wiYfkv+#p^dIlr$GMk(%XKvw}lP zEu}79#9K|~mehBxfgads-@`dunZRdNQmF0RVB zhg&DIyu-M4QY*WVmq>9*r}8?9n^G?4vW{nMLUo+bttq?eZt2!Y(%;ovAWDD7b=?|K z`p)d7?yV(HQ!Pu>(hl!sQL5)NZJo;UPVps^+WGk}?>O)1reAYl0RnS$18iYZ!rdsg z^44O1t!5dmXtS(jOsr()t7w3$XwInN_*#QXs;Mk$sd1VLmZs`cN-0r$rVv79bK`N8 zLq7CV6H`sf$y%nIyt1d??7*>}e+8xv zJ4oOqLK27l-m<-kg+K+SuI=48q?qWRU{QYOgkY=dBI#!f2#pKeKXII8cSl$V2enAK z_%6}8tR$bVCrPckj+Yl7_w3%e`7*w^6|wYQ8I)a#E>s$IY3)H{>l=T!%|ZjMZ`?Kz zXm+_wx8Z{)S8L6ZZF=Ag+i4wE3_~t&NDZrI9!?EgwljQ&1+xtgh6h_3zm0_B*Rrb{ zB>qiB;@3EFGzrA7K}KmD{*(g%<7oTAb`E%U4F|HFelC!84LwA#*^T$JwY3A?FcAL6 zMoe>JH5@0+Ou4$|UjKh2srTI!o9Ix`3QbXAFGWBvyy&RDf zOuZb%C1dL4sEdCWQ!l4G3WcecQ)BL?brv||`Mm>w+uq~Y!O;fe8=|v;;qf-`A4-`? zFK!F$qt5qP;DC>&$eNCChNu`7mq%M!PExb1a(oBI0acFuLm>v;$r1B>WuPt1k*;;D zO9y%a70h?&0wdcHr9AQw7i@ zWhV&_jM+<2r($0CN&%Q_WU;Kg*{Y7^zT*6_h>~v34@ce7=SNJY{M`=QKvoMh}E=W*06iSuNe&+@oVkP|D&b<)b-3X4&__6osH|-OuN<@TdL#EgVD& zfBm$z^YK7QJ?YKh)mi)>48`^xhKCHcr;c|wzu&Gz1N<|9|3Sgqrg4AhpjEj|6etV- zxDc^bLwktG;poZE64w)@aWxkcyu@M_C)r&(H-Ucx=RNJ!ba?~vPhl-7tDPK>5EEFG zy7BYx7ywe0MuE$9MjlJ#%+qi$O=|UrzQ8ivxos$$P&&zfyk6UVxzhg5lt8l}_!F`FLe} z_MLw-L3^W%qC*KhtOmNOy_mQVSLf6{@+u*`tvf}ZVey_?5N0Jbu@c_CS6>PDjy)*= za7|Ap3G>^fu+|O?E?z%B*IAcyu=QRq=DKAO zdX9%A9GU@S=xU;Jg`Ho9R`N*bF9ITBKudply!QPsS|uVNn4Kv9SV$#=czirj=Th<> zly4T4_tgt()XZ3B8&KT_)D#arJycmyQiuG1VY_Grwv1M;v;pGxWOfsy5GG_vY)~=^ z;U+1B$pv8)!X{RNQ3#DfxC#p4jPkzL!{OYXFEAbetr8ScTendwH(jmFSGT&ZRPhWPR3xh@E~Xf_R($`iPPk*h?$rd6ZW5rz#%5l2QUo@R^Y{TcoVoY zJTghq!~aM%o_&zuc$4}q@E5bx6T+`dVr}h%8}qA+ELr=n+?&7;{oDE8I|sJ7eRQtG z8T^u_;P=<;=eVtVJR|Xh$Sm0WUYCDV(}oAb!`*`c{I_|AYz3z1@NuNPsKBk5MYuML zaO00mWvc^6TKKamNQJoo0Y**ZI@&$55x;WgHYoJApv!*z>r)Su(@(vhK7r+ZGV{SN z|EbsiM2!FVGBAw4n4?W@dn;SD!BH?M_yJ?={G{;^iebPHed_)AtSr|yz>I(0_9oEq zF``IA>-s@LV*~sh-plcvVEk?|b z3vKkFDCelKCOgn?;4Grs4@7^Mn{&`Q?LPYmj1y)xtaTfDb7_qBoe@nE&9RJNQn!9x zesO2BZi+Hu!g{gr$VuUBHXA>6y$J%8Hh#u>bn8Ey>;2G$fbnD-w{+BD(6eRQYi+5B zub1$L40jJk#woeVs+U|Z*;v_z1ljn?7p0r=*cx$`!7s+WTitAcJf(jOq~KRQ_o`M{ zXOtkW=Z)3s18<~f!NYqR*yP@_gmHqPpy2+)UAq&mZWDbp&s57jq~DQVXlYl3irVd9^sniOozm={d5sV`c%p&BU86Zc5=D6y>-8% z9`@+P>qWTt4Yn))TeyGcIdc;$uzqGS)q_^o!v)%pJI=>)Sk1uW1j0t=z=arTOF|an z3I{KR-_r0;9b~g*ROXTw6xx6iUDAq9MXzpZb(OEx#g~9;HnpEH^W}z zu*(ahFLQ{S*Jj(ne9kZuK7F?$5S!P*(h)X`Nzew^RBBQkUsItu`1i@-V0rMG5sB-C zuBo|>mI1D*M&g=cYhDKiTGK#lVk9NA4h*nnfow9sn%x7|WIq^O%}sz;UJ|Y*-W%2* zR&&F*Km)3|Dq?@2VNgx84h*Db0qYo5a4l6qgQ&S-^*WY>sJRjfW&5V!Ja5FxT7@Ms z%^fleX9rPtTMOD;G)-}vGhmu)45n$8;07*11EskUP?}HQ=_6^D9lwCRZ<0GO~jNO*V0HP zBbj8}Vmz%aqgo1{&SpR@1;=Qsn3l9>El5k@8SQTB0<^3UF55PqC7WIYXDR<`uGyhy9VrfdQ@Ad|I#}K1EMT8@ji)%`n&2rJNZ``=Nm$&g%THZ}I*uu8f|HgH zW1LvY9b}-Tq8LZueBA&s&UsyxH&6qJ#SQ%5W)SCb()i!?PwupPpH zGi-0(C5qhe+?j&kNS~x@-=8|R*8oj$21LuGJA*{mZFdNwBlJ``c1v3{Bzn{^hJdhg zl~jM5^24QN_M+NNSI8j~pe_O`kkqCdF1=bh$()86T4n~}7|=n6NF8rGBr4c}sY4{m zf#y3%pek5<2T7L!o_B~$sgbdh^l|p*_1$d=HqR@2Hbb8JU*UEI(wIMcYQ_rzKH(f+eR%@-u@@{JADNaW34`u@n$Gc+`Q}$jy+{M-O&Sq{L zl$TTJPQ^vQ%G%^RCvM{IiX9G7C?=l*@Go%_;nvPa621-rcktHEbnElSt@!r~2rGZ= zHQ}R)V{Px8-2J>av*)-J;eI@63GlXG|8l$=f8xAJ7ZQFJxo+OirZD*nz z+nCtK#I`Z9ZDV3{^Zs|YYIncwm%h)by7koQKHa~2&S|ZKw^SNc^TJ}Z78+?`keR$~ zhmgYQMsAfGh8MP$J5!opt7=|7lrb7_j!E|cn#uc$UG2&<3nfLg)|Mmbr!MdxLjwWR zg7V9v2J`_QcQr+-dl)K*9jZ42s)4eNXfv2F)pjO-@&ixHMli>#{-A4bptN%&WUx#y z{WC4cv(}~VsQcv-j*-H_vm{dcGV!%7KY8Vnz$n5Hf4N8@rzy+7$x055&gitOa+v*Fh1h-v{E7(|2vfJGcbyLMEn0|b> zQyzX?{EFJzA+D}6!s8Ywu6d~@Pq&dtAS^>wG}Ba^w-I&$_RL0cMFaWHCYs`1uM;xg zB|ub{TuxZPrR-E^bWVK?tg4GQq1P-Y-U(2Pt|yPt1pDn2&Ky1lbrJZ>qIu> z(ak6r=LxeLk%Mg6%DJ4AxA5H3coqoWokRk}QoXIblxTl`SC{A4* zf3y|lndwb#vHZfnc1Y_$Ol&s1;o47_+P6*Zh(^3lsmfON1dr;ZvM*Tah(0*79$}Ja z`n%alP2nWJ)jn(tX@aZ-@tF0e2%ZFd5ROM{7=;nIj3s{VU&OUKOK76R5?o&${c|(G z8Qo8sXXy6Oo@!$set`We6{0rGhzS%DqoqOL;(aJ2&;V>4#B-O~=JGuJ81mOWS&2{s z4XqMBp_2OwVS5!fd;2r(c9HT6 zS_^s|`jVLPtE?3|9f7=a!)I1k-74O|fFm1L(lxq+z}q_7jNG`B^EJOj&1@BwuG@pgM5^=mZ={XQ19hmpsg{RUgcbKJWUCAMV)Q zq}|B%e;^A_ZR&WUGZv;xQe@SfD~0X<#n_Arkq6pFhDyTa1#%VMqP$Y06cA-))}-8+ zan++-_DG9r*-x-w>X`hizu|d7nKB5AP{8Xi0~07}2-WY-$9k{> z-YVmvijhirtuIV9CeHltJ_0Vv43ukHZFoZ1~sYY z-+TzvVV5f=1Ho8l<1()yGp7s5=5=h#?*;|Qe~1qz{kX7C9yD`*`sexu&;FnT1{Ne7 zAtLC%u+Q8-Cp&8={jRUAGdnwLT4;ZBa>{W+hH5`f)`JmaalRm>gM<0?)Q$8Fd1~{A zdb!}$rkmBydWB(G?~WIL6tMSl9CWYD5ZRJsCq03lW$<@58))}SL8wA+ESw|eI(a6?Om?6F^$d?4V5kjkI=!LiK0%r7In6ME}BZcvKgv1r6kt`O~^U3U=&SfREov8aO{ zdJR3yIIY4lme=SqE%-AE*SA{Wnpf(@q^3?xQ6X1BcYw&5!_w`#Ezi&y*E;+3pFqNv z%Gonl-gZ~<$SmI;WVm)mj2!|3lMAuu0I&2$qS za>xL!m;Yq|XO`802Y!`q`fiabJ#X{{PS2SIw+{LqooGSB696_&D=;F{Z z?s34YwuBr${9GkmGDuLX^zZG|H2Mr>$oTd#A?2V!Q9ZiX)0T6LQfD~)@KB3`Yc1HQ z4kY@ZiDRO)_RSE7|Gb;pg<)1dkylh5w(%c}qIp*?Y$9X29)l%GQ3Qf}4I8xDi6m?0 zv$yQbP2gz>3y4rb5=D8{myjeG`sB}O*E019qN$?CMkD2L4Fv??!u5f@A5YS0Coxaz}+U-%Kvh=b?adx1ewzj z_@RbEQv=^Kb^Mz9iNrx-wPB1MdR}b)aUQQnaL;Ubgqb7s?{m1X^BF9CoDdi3?G9xX z!T!9Zwf_S?<$Ol#VLY5Er_K&dn1FC3j1O<5ln?JgUr#6H^O}G4g)zRZp#LMIr^`Qk zuA7h;xYO@~494TYK0*|$OuX|DNVxa#rfBy>L#%YTuldAE8t1POlBX5m{U;2K_%~$F zco*BC?1R006+J(po0!U1x_5F3=Heeq{fr`PlnDtcswI>?CIcG{vdf z$aZcD;+qpRI{$pDbE*&Z34fb&;W8DTXDTMOUm_X8k#0@D-@731hr^nPo33X9H2Iy7 z2jn#I2ks{en(wx`fgd!(%sgsaNGg^(*x78o`A#SDF!YPzV>GwV{v~1Ir6M#^&f| zro9!}J2sEoNsvfR7VRhM1s~canf`X=#Fq0q(B2Y4c)rQ!-p?!>q4a9+Kvgg}1Sb)J zJWL_%F-~R=<1BFg+2ki$v-v|O6_bJ-VCy3o2;Y*Y(DO;Pc{n4vUHZ-)-t3&_yn~Sm z-)UOP+<&-`GXA)*Q3p0uG;!&kJ+)kVkvqhxL}xo~P(!|0IMZz&)V( zuo)Ok5G2CT2}{d|GVxmDSHDM|0b6+NfF{t!CpU5*_dY+iG-2Xil)M?WqI-dB)Q}L# za$6c-3s#Q|NtVOy#voI@v+f-Iw+~GVaq%tDN|*uu*-7+oH}{d&XwB!#VEfZqDKgdv zZsy{%7t-sL${WneNPdNM4fvoxfP8(QD3n=CoPPoT``f8a0SULqOxo2WqpKoe)qHvc z4C!x`U=2zj|E=k;{$Xf&E}@a;cQfT6GlHYw4EEiPMR+Gjn_HGN4$Ll-dHH51q0Umw zp0)!;d+}J+)z4G{H+BnOiHq+`-#f)qpw4G8l<=<)NZZFV#R?amLR3C80S<&FGg`=f z16f_zvZ`1nqT0wRcYMD}JAi-JLaHis`=9x>~&{DmCVInqrhu(_8@h|`Nv&ZLu9bkJ%=e9K%uS5fgJKf*p z!Fzi`!^)@embI;|!qWG@YG`^D9kPv&y(s!;X>v%>bM<0SEh0qmvls5rN_5?)^eFUR zK%e!~pAAZ`xF6VV05)56!cGOfhQuSiGqTyroQ=L1SLn{vGH@7yg3&^`=CQL=I%{`~ z?&`X@h)nGid-L{1-#?H;N2Jl(WatrXnD2;d-s*cf-!LtG*Yugq zX%s{|d;0^RTxkWMZXd}qMKe>8n@E-d!+0@RAjsllejR_D05sfGZLyo3J_T?4=nmZs zVlG(F&;guzr=5S*{oUaX>X^R~$n*Z>=e^MPdq()7aDj2QCqw=1^hLt^>TvU+hYLxm z8b8dvOYPzlgI0c~bz~LmH=fRhBL`;Gbqt(k3HXWM;w+a8?2Mj{q>KP)$tc4j*e+$L zSQsNl1HL0!JRp;Y7LH0SC0ch^b6@S?7bW-0bh5!D9cd>>_QE^2ahxi*H~xEp6FPun zKj_h^z8;H={>r*$TF!xM|Ch7D4dRa>n6)Lm{4t&m9}xkC;Jbznc*#3%!VnD%3fM|Z zFqMZLy^AAQf9lP{Z+kl)95EDeg4!T5tmD1R#7lRFdw{+y9ZiTh2FcGvf|8Rh#s1hq z22YGjpZNC=KPNZRc@~L<7w<4|h&7gF)u#z@ZFZuV7-@A;FG#0>khGf;9g4vB5oDR~ ztenz% zTe)lSqJrt53C=gTKsf}V;18*m`MyZk*`0dAZUg#!d7rgcq6Kql6CG~KX#W<)nUN&& z{~6WWD&7%^{=mGUKr3CDHF~k&+0Q5o1&<-oDfvVwME^_eC*IG$tYo-y!of7{L19~U z`T@9rP3)3iXmLwuB2UYmrr)W_&T%r=8xt@LOXDnV_LD3GPF_(^9$g#6*~BdW8*BXP z77x5TNsaGZhZoWUT=eoQmL0n%;5vl|3M1&+W2Z?s%!rrcZn%pWa;goe5yaRnrx0Nv z(-GA>GT~l}m#}GcpFCc+S^nK-5dugxWL9PiiSdQ8o{KlI2|^f|y`J(}(5~@54A$*b zZK(A%#zxyfwR|Lxq$;UTF+FGAXpu8t640clF`JYBUJ8rr9pNGFwY7~sOpAqeoGKw! zah6VzTlx9&wy>6-;loy_nKI^O(m?mVsEnk|AJoxybTAsf?E6bhlwLuCeyRUNSxF61 z%k-AoA~3jU5+QsU_50(r5H12`RubVB^>L+mi2pW5p-z>wu5W-qa_f7NFL;BWHXz}> zadS0_{%a4D*VM(&!gg6%*h6|LlGmDz7*AArukg2?%aqwU{56t%4H%KwsaczN{JlU*3JF`@V$8$!)!gkl|7-UAsg zOVj7p5v2~8%grcfMxDAO4H=#$(dm!-P?t`cl*uoVV?vqlXK9A+`?^f3zOtva6W1d+bn_2EzBF>}K#Zt=w^C;9 z`WqxtzkeT%K6FQkb$ZeQ09;uwTL!H;6Qt_yQU?Zh_IyG#&+v2_u531&8Xm({t+moJ!c5(osZIStvKq6YJ%)*cxscz+lk|y$V1?a^_^Srh>UH-Yy zJZ$bnM)3^-PO&U+!jb@_&?FEv$v*S&u*RI>MGDgkH~$tM-bl#fU*rVry!_{ zowTT?jx9(mkxdskdgF$w_9HK0JHgG0g5w9>!10zXaudMlQeXbyhyD|KItx9Y($^(7 z#7mgp13xan;|a6N>rhd?DusFv8E%Yy1c_^0HjsZ{7MbM&4d5c4U`vF9cm6~rLNsM~ z+T(_Y;fugModTSBT0OQe^{YQbX@Adj@AOfcGW=aWu z1!FU?h=_;v=c;xy;Q3++7K&!$Ft4*W`aYJp>=X~#K(jwWXa}M%uI3}j{n+Nfmj~2- zid6XRZr|amFcydHS?g3*O7;a?YC=wCo0>48M_|A^zVg8OtFo-_M>gCnR{S8m7Jg(^ zsl$K(aMe2_S!m0!*+yv|ovMe+>c!O<7|JENX~5%Ix5;MbFilAMh`<2jfv|A0=1b3HTE9~J>FX-z}JYCk3%RVCw{yT07EWdMF11opVsAsO( zWn?KcD3<(ZvM{(~Rqw4Czm6uurOt!L&_CW8aK_M66*H7YQagTfTpu8@Xu%AqK$eBx z`Ebb^rCjZGlaRg`+#ZmQCJU_8n^Y>vxOjXn`A5#zIEt+7B8iEis19OiUo7FWfJ>GB;;Za~Az8QsYPSUB9Jbkdy5Xp2SCdRr%ZoLXw%* zKoK27huw15LcNp3=7ztzh2tZONq4eWi3v!C6-}x!l4sb~J9&eLAUnR=GmzPl5eCnUF zrTtOK=H%ojBpJ$}YG@|eLOeNLKGR9MYOazTh_Yc_Wdfh0#lFWZn%^GW0OhNhi=I%3 z+UG^$qwpek(6d?mfu2 zEX<$d>0>>Oy|!7K`}hfn;-tWkM_Z2tWBZvwNkbpA-WiGr3m9r;6VxG>?1Kj_%^;tb zk$S-ysgH!BzB-It@R~dl)aAtNB8%UE8jX#FCYBOn1QP-R#frHw$`7c0Lk8Y6XEWha z!NoutU$ZkYd7o_w&aY4!BmfN)OY}yWAuS5*7x3}j@aOHLvB;83CJesF>tg0r^tAz4qw4P{k z50fd%gqn_HPBZN{&4iUVjn-PYq1sUD7&EA7$r zdKdkw{jcardmj+D@aw>|CGlMevs!qZ*b^v=Ta{(eH_9aYh^%rph6~N*g)>Jz4Aq;@ zCN1ZIiJq}GHOmO${h0}mcq1IA*|-QHkZo6EBX1$8qSVk-hJvyrG#s%X_*NXoeQTGW zAD*b1#x3^e|J6+HRlh&!2gepGq7a2zY4kEMk9W~n^ObwUKmX|QX;4bx~^ zv|z6G7zPZJuH=;j?0^o zy)a_)Big26#_=X6W3R-Rxg<{Z44Z(M5%|p$CF<OALA&c1}PkC_V)J z>B6Y@oF>flOmB}gI`+h)U1K%2hLa#=d*T$6iUGuidgDq%jQ!;+@uaJ4$n@oEEq1gn ztct+fa2zD#H8r?$ETOHt(m;$53#k3hE{h!1+#8_m^>j~f1*%=aMijz{@eL`xzbeIX zY5uoKHM#Sg8ivwMO{b-eBch8GE)Ob`537UKq`lCkpxC#|D_mewR&U1O?Y; zGCFWs?B`*dPpKg%K&f4xUbk;Lc(TaR+|9G54c`U0fans~=<3#ke2Bebr^@#5xrYBC zSZjzLAHFUK`f<}TL=u0|)RWoa?&l_A`RjJUH#~t~^8F$MLANU4y(J>8t;36IE}WDT zR!d*Fjmp4huA223FY*6Lfd6w`)itWsJD*{=o1E^39s-Z4W)}jR!oL96v0*XTCM>WF z{uU;5S#irC)GoHH(11NTO;v1S3Y2X^Y=T;|4w-1|iAgt)SZMwOx5(Mbs4;3#X2*}| zIbM@&PwQ=E^o8{S_jVQZnk z4o16>{fID_skeY+a*~O{PC`;|u@+ zen-Gm8S(oVIq)^Geuf|`zu8S8gOUw)l!I0$nv(U+={Xt9ikOM%V`eB+YbnK^mn9lp zi94~IHmyZ=DN=xz@sD@$V~QlqrBCit-D7$p{!abYh_+Gqle~@2CHE6eXj6Fhwnxug z&>=9iuy$)h2vF50^GUts$1gy3j5v@pkvJb_-8(TX}FNf|;7nkKU8e`$`ZxnOSUYnVA7E6M3h2k8G%N z@5=gNj=9_WRPreZ#eUUm$fs8gDkm|Z7Imzw2A z+2iIbu=~8VJ&Qyvk-pyfI$EPDDpg;N^D_WF-oQ9Y%l!_LQM|^xu=RJdz|b3tPe|Dr z{2b~QGY-1qbZO~zTJ8*5i1fv|Gb=6^DhJ&|O`mANZd!rr`Z0@b1pyZ>w~hx|iDFud z3Ocvdu2j5tul5bYmAsX=w6K|gmPK6(4>w8=Fd8_qk}5^>puB~sN~2>HhM$b@-A2qr zho6xQkG%kdC*Tjr1xFq(JMg13r8nAGMWIbJMdEpt)`tFnh+UH4yo9>l4++yeLpA<< zwz0UCm9W1*0!{T6gRDf8Awy)*)hz?)w3terl5o{|*+i4?p)~3MKSx+QM#a75D4DU; zgD+Jqaiy7cqR=@>Q2(oyAKnnf5H?#kIx1FUJ8VS9(Dw#1aRK^W6{HazqI&2)L=JR& zmD^kYoD9ClaO=L$-VS@tvfR=wo^zthI^;)QkuX|8YuU!%}lLV|O?Blk&mR_XLYBL?EvI<}xd zCPH!-L1joEAP52%pnG-&TW$^$;NDB0V%7{X(_+B1>w{o$*Dntcewvu8z5~|+WtzSe zZ?T!~eId_(+i~0EebiA`;lhN{IafEuQ$snsLL|E$q13=sXXi%9lIUfh<}Ol@l9M&J zXVGRrn%2wA6n|PZ7oQN$z6+HD$^~n0;H=$XNnI$Wh75Ie)Za97HPJ$di)>j8%kI0b zaiq`!a4>1u9Hh`nYk`7RJ>p?K;v-j|%-gCSJk~^lxhhy8mh>CcEbr7;HMw2dUP`GP z9C$?KoNqwg4my;dBuoal+do+UaLJtPX=k-XmGxmiAJ4u+a}I+_ zems^%Ldkk=yqZl1MwbWJ;pIK$yJ!bmTRHeMV+_V5RFo+pRPP@I*~E@A3Zeo`$`-^| zw5Q;FhB?a^1*&^1YU6H-0;AVL^jU|;Kk*R%zQX{~^tLp@q<=`>@cjkf8$t{5<83l= zFcAu1*=gY8{;8!=;*jA+)zDBq7rKC7Tjq0);c&Lz&JCK(OEeTO_rpnB(`Cxh1v|vd z{+>}uB+U$#_Fheb-QoD^lNsb(B+dgbDUV2+Y04F$vXJ|A$C=?ix3fZKXNVd6gBw2ag2qmu864k=vwN9L|M%g zKys;|3tHt%YcYA=v9NpIO-sZs;tT%eLNSV32@{$5zp?e(-M5B2%CaP8K6Dy9ZBkro zUE=I6Ykng2ADTc$(8P*ova5Phy8llxftk2`y*d;5WF-E8Pu?X{tgWq;y!9%WKi3?)li%364Ec{|o5mD?ge4>erX{H1($Vjba2uHk1$INn%`cQBahV=1_zy`zRwhRWh&XJlqQ z7=MuP`5NPmN(o6ZPM31Mv0kJ~wP-uC;C|r5PlAnI4Ts&KMt2Ml7Ys>Fi`=o=`G@48 zrY=8O0qZ!?vi-z+Zk9g?K5)=sZ3l^0tm~fmzy1IW>~L8cEn60TWDiI5C7z8Dp0|kj zB*26<38hxlX>wp`@Z(Xo|xkaC; zXtp2@GIHNAVg6FXO8?+?0DbfWQ0fC(+CAJ++H_@N5)uZ4d+{WE{xFs|66g@;grl2Y zZL{5GX!CY)_NEm7FpL#nzo%$ootrQlr9>C&Oqk7&%QOFj^Gaa-K-=3zOx&r@s)H ze^8E6Xun0AKk?~Xi?7wV{fHYY-cr6J3la;Wk9 zP@~1{2N%=7>S<}9H0vSd0R7x%Rln-8nyKHr5uqE5IA`>V9oLsWWyd`!ZO7e&?agZR zioAe-DB!||wLA2wP?!}QMfTA!Oc0K_)XR_@?bE2Zfcv&%F>j!od}c1WP_+w-oBNtM za&UOc*Pe1qx!{cENI79IrBgMpv8!kev*4a_YPK_gryvhFKWg=%HnhHxX8Q#ec`GLS zwMX5|W`d(ueXt>8LV17A>@YEcmd}Le0d-;JwIXx-c5WzX41G|kL+g7*_Tf^}%GTkY~1~Pt9^u*s_#Q$s_(Ws~o${9&*3=UuYCl{wA zJe|wJTQ5*3e*w7=2<7hav|c!2dn(6EN)*>y^W?k~?}hF4AdY%8 zJm^3kPTLGM-t#Hlc)c3`JoN^LeFfV`Ic~>4@eJdQ*&Jur3H^aQoZpoBB?J`i_4~N} z%ceJ^@^`G$hZD%Js&?gBmF4ZC557Z7)4Q^Mi2x6F;vSVZ;+Hm@TE|^kQcCwbzAQVe z7Z&6>fEOy_N(VY}d{s=9fRB&%_-@CZ4kBzw7|+Y-h|C zcXy?2g~?*KtD5+WfYhU}O+|(4h@J!8X`d|JfxKh?2BamD{g`>~rgI(@z^q$b%U8WQ zQ{INMZ*TDi!}x;Av*OIkYugt~@=%lS3qf0==|q)TjEq{M$cGNcExwxMNQGk_;7C>3 zz@GQ5A<2abgN|b3k!B>s>_7nSg;~W3_)Z%uHc4w$Mg$qGp_Ztd*HTifOp$fVhLOV( zRbgl;4R5O@zNnI)SOt{~kc;cR{^A70duMu{@T0m758e=!+1?SAqq_6l0Pr=|>}Qt6 z|5AR;d!S>10ErcmZt-!iJG1NqzI}HOGOO|bSaRxrM_S3;{QW7K6Cn0S*#3EFwcB^N z;xuIhP}|F~m=W$BEsY#aqqmV z#^mdAo$jX;j==>M(WVSniT<2BYf1a)XdhL)VB}Z{RrWb2T^r#tFUon;_C&J!WVUl( zVyOY4H(WJb0O!Fp+ef9&o3=T+I*H{Q5pUz0!JFxxv+v>?5hMEXuEHT?G#jKd6ly1F~u`$6tQW@-GNH}~w=pWoV^)bNSx*c5UD zM^#mQ(5!a|R=d+e7a7ffv260gkW1&SI%?o*Lx&``iZ~9qoK_X>Hni>age%5+`l#Nn z0v(KqYb;3+lhDk)&u)s=%9Yg2y>lEEzYUSPT+9wps;Wmwd6eL#OUR(EZXsX_>-U0}a z{}E0?Bo&XETrN~}NN8?SdhAT59j@e|)gI zV|!g}o-P+2?PM<0E6DJD>>j<;9tRAv4D@cjMY)V-54TNc-lrn94V7jmMu{$=OAofd zpot;Chp38>GBJgB&kf zd<=q3^VeZDQ#ZQ8KcJaKAy{b%;LD<3%i_cy>tb*4C3k|jZLcFtz9pofVJ8F@=M&Rd z-`7;EhN)<9xph<=*`3D+r~t8-JgU6$SP8amG@4r?uA{ec*v{>RCE5jz}a8(#kCv*-U)zb((B3( zFC^|dFSeLW)RdVmt@R__pLY}+-DwFW`=hcKC`^)`^8+HMS$`TQ@CMG>aKJ+$hkEi@ zp%#r1G9`-vcq>=|_u||R+ZI}uQQte!?6bv144!d}-O(j|c{P&nqXJ_gpS#JTh=84i z;>d1|9r!2d6r6?LM*jw~gh<<92tKOi6CdYRUbVju`_>0AFRtbLe0QQ||GM`n{^|X(_I0DL zR&9^?f>moW&3-!x_nlnWHvvJY4RI6ULLz6iNf&7{dHgqS^R?y}d~6iQB23i#>@u?& z@V`g&d!5~@sp=7gPle;_K~4U}z6yzFMS znIofgW#y@Khq3gA|7CC>N6XHoawy7}0Y)3?aSDb43NmJ@yI;T16Vl3nfQy9|S!eZ` zLfX96I$1SkY}=v2G7qfW3B1H&R!h9ZL%dWD4N2u_s)>$zUD!3VMSKaxs5{$?HrquK z)1|?tU*8SZ1UQ-|JZ&<1Cpupja06+FkT+V11=6P#a6eTp4p;1KZPP>3`UIYVFCONC zK1XIj;K_CIHXcz3rpIHZq>TElog}SDaEj0P-vYE%Mb6xm_E`KfiTbUG z%cv+}Mnta4b@Xg+`zJ*@ZT5eH?^MWO;>Sx!+r&*FOyu=;YI9^w2 z0T9Tjnhg-hiWwm0NsQb;QQ6CE0`eDHAa6_aA=SRL0=_tVcO?pdR8zSwnZScDt~J1e zKg9da@+H_Ttnu_c=K7zcR=YA=No8whh(>OD3TdA?oz0g{Yf@;PpTOj=E^vGM$tXeP zwGGb{Gj8_1M#8nkyMd*R>vdfaki?$%`CItfna`!DUn!Pu%KkYOOOa#p1-O1oH+ zSfVxM-=6Y7?&N`QX2dGRgh`_hV7SzzQ|$!o7=gM6GD&e2Eu~(QM&n(xMcBk!2Y;NZ za8oGQjunk~lcKr@45Uo{9OA4}StO9EvHyg;rsduD8jG7>$GD+4{^U~_xr}p3TZb-t zJK5z5*i?du2GbT2jr_sZPx*Ss(yxen>g%?A(sVO_b6^D2A(TW?qy)<98?22ojNkoQ zu|MHf=pV54;nHh2uxt5)YGmyS#R}~k22^;K z-+MmF&%QEubVzh10rJud3$d8^zAe?Ce_M`cV~stY!VlGNUH3-Mz4ZvP1zWhUMw_st zufn(4OH^8NcmtHNM)!OVCG8_$)4rZJzGxDr(Sg8}sN&Us{9IXL6>)(JaeBd8zJ}aR zIezd?3Ik8uYD@RaAUUf(&2SLv_XKHS{=A@^$(FrKZDJy!ln^dq5c6=L2e28r@i~sy z3T20momiNY+N-?ke7C!M`~vR+6BQ7&Imq@43clu6HD0>R&OJ+G-Y~eo+ta~g+9RQ7 zfCWLGX0J^6?APrd4!sTzOgxj2!t<@$gCofK*+Z7QHB^d8Nv&Lp9FbrddEx0QJlK&O zsFq~263`a;RcB=i=woflm?L@R<7r`eyu2J=Q>$(hLz1T4cL>^_rs5swbZ@F4*0NJM z%Nz_PFM4DW`as?82jBb^y7dggwTasVG^SL%odI#(pH2`JnpPz8>z>paok8)^SP?;} zDt%fiAk`QKh0LMNZ)icuXc)mYs^2hzl40nPF*ULF6vArpLX!*9YgAPaS8HY&4sD<` zt%lxyF!ag&_YR?7a$8jiQ)NTfZA|%gT39@9?SB(&Z4+bAJ)#_`bB!6V14zxnbuVoe zB&v>iAziTaXG>D}@1o%xunp{X$NJZO%2VIJ6muUdZxsHB}@p_hluWFJxo>Bdy(hO=72{O@`aYs&Gy3*uYpTkq>&%# z2MgObliU#zLWA6wi(xWIps~X%_6C;?cTjo;H2+ZbkB6>#u0;hxL=#Gcj(`4FBE;7L z8&c!7BG$R*;BN|EYN_*u)AaAv5^VY&J)~1F?g5q#elr~ClmXd^#XYn3W{63Zm_$K`NT( zFF`Xb1U6wTry=`4SkR;>qGWLNNTOCRO4tk;{>f?hNBmKJTPg>^j4sk~teF%Ubi-A* z`6}TILf3`ZkGn3;54Fh;{we__a!|l;{Nqg&GX|; z*ZpWbGdTt^_ zD4?veS)0z-q_k_#*rob=YDkAl@iU!!M{wd<$&6k6S*_ZM<)c&~K*){10m^gucA z*ru07rhRlqkWV+b3~nKk{|2UPm-k)2hW3zOGhEA4t> zZ3kjoRwh;h4S@*qU1`JfIm+}`4)TsH3|2Gl4tev?xd z4S{?>u5FCO%gSB95`-FepN$iB+hts0WdGQO%54AvHf)I_O%?0cJEX5d>Bh(?IfvWy zKTuXwb;_{7Tl<6)>VVe1k&K~hIEJY7dA9UPpStKtY@RQt-D~<PY>WTg$qt)VDlQD^n%Ad;#pXV;_;i1oyD2e zmqavWPb=wfyg+DbZ)RYhFEv~&QpbULR6?A{R?0cZJ7=QCvhSvq3~F$j!joN*lH&0d z0%PpbTl&%iWrflEt0%OR(n4=FPY$dS)V-Fs-Yr@w$YT+DImq}@=ZM#a8$Z#pqX2K5 zXOA@@*0 z;2{+uu}A}+mIAxZyOEtKApfwpsJ`TL&gYA&P+Zaa*06wf9@mwP{g%aA3;bC!J?dsy zLK6bbmP9v{py-YOD{Vf8W2-6R?%}=VG5-)b8ZSXm38g`+9#lpsuc|7Wprb_A5eOP{ zSPY37tcisXm=GWK)jOu4ck?;6z=7m~Aao^nWWvcK7n2T(VG@zHeN-dlJAKS3zZ&$V zg+15Wj{FjAi;nrzZf+DafE35fHHPiT_of-F5Un&X?k>A0@^3#9bNkB01K0cwyFnb9 zkNxL@&4pKjcgcdWY$>#$EK$kmTuM|DDmPRghYas$KZndZjtnYMLQm;0GTu^oiZ6>* zra&wh3<)c=8~C!=cnPv_iCIXpvVXqk=(20}TWRmEf|B zR7@aLhfP)JOHu@rgx#YptntSE1j%|O&mk37U(P5ExG);cTb=t4`Wa42XwXJ5WqYZ$ z<3$j~1JJ{th%kf%{5l7#J+VD`BO-1G z2nLr7N>lSjGyvhKB(FgE`nfPfe>y#X@&VfUN+AchMhV$CLNb2!0S5|C%WOiVvpVrF zM64I@kEo+QYQVTSep?N0@dYAEn=U&9 zEl(qHMFqfSbimeJQAJVhVfP}0jqZvpYLvdqs6P4sp?Y5WL_vB#@c+X|s~iF`)Ou}%bA~~L zi5)WlM9CIrkDrm;Gw>M|W+(H}qL4h9$n@3*lSj_bg!iYHWEZr}t9^YN=jT{>Y{NWH z-B4N#3bSPd<2~C%1RFP$T~EvA$|?f*q>H{ese`)y2f`+LqFMiL(dJi#q~}*qPWQuy zhokwpG2-;o=J?H3sC_(J`L{~_3dFNK=jwq9$G<+de4A%P%idNBVFQ%-lKs6wBbj;R zcnmK>5`ke*3p4oPx_Huo|9))if+EUA>fs}%Lpe|6ivIIUhnM0Avp|{21-JON_5NKV z(2Yu&J~DfhM#vutk0ZruaFj0)O4rn)CfH&c4v#_&$^N1wl3&P?k4T@&H^`!(yK|^W~~7d@MWSr+U9-+ z?FcYUs4zO90nFIkGuSV-Z;M|W?b|p?o-_iVDg)jB=@2}`nw9&P3WfS__rbHBUHx9? zgTcKE_m2zav!a5pik^~>o+=n>ww747ymwAa*H^}dExh_e&7KHug9X&n-~Jv&uPyt# z&%C~F`bVOr72fV5;7LW!6jgXv-BbfRctC1mZ`e)m?Z4^2S>Uj61rfUjJ~ZUXH%F#i z(&R{%W){)>5W`cQdo1D!-6%_%v-z2E$?jljV@hb+>I`|qlvjU6UmBWk0^(m>A8j;K z07XegDvm?>JCZ}0AK?FR8oj(~R+a!u<0)>zIggwlAJsJwN7131OjpG24nv>62wb^= zn&%A5Hsj{W2;#oh9^X5uwJv{?b;{x6%cTiU8uZqTH{&i!h!%@TIOi>ZYK2N&oQ-XxEWLSvEa19Z28>2D7 zrZq9fKywd`FEg+*%Rg+DCvCS%`B~{_To`u(#kvO2?khEg#&bq{t&$Ya;qgVVMmy1> z>i5w@_;_nqS%xuJOosecD*J6(N-*8EK4s9NqH{hG$ks~@$~vv3(xRh;?VchE#!KUF zm3_RmA=yiKKcEc+HpJNn9_yi0n}yp&An%SP{K!_j-9A{pHf3$2aMZYcs?){R{~Mu4 ztd9pkWgzazZ}{cFOL>PspQ!t~yFuV}9EF$KNl8??g}>k*)TdfDT{>}4 zUY_(v7{mwJQNtu}q#+G#Px?`2XItifc$hiILT4N1eENTo^%g)?{ofZT-Q69RkdhFP z?z)6XcQ;6P$)&qH1q7s}q(SNK5)hE?5Rk5SuHWB(=Dm3{&Y5wz$~m92KYOpW_S&C& zjnQJVojW9uCMEF+{6;eo{|t!OMjyV zvAQ3==9J+&WJ&ws+6=J;UD)y)_pa8a#Ge`g9|HxELQ$tuFV@}APIAE;n(JggvGZF5 zorHM<%iXNy%kNF&r{DCEn{?w5R8Co%@%V@a7ECJ;HI~F73$cKLg@+Ys6?)h zKFa}ht4OZ*wwCs98F`UgH}qp5Uw2p$0LfSGyFm04D$qiXGiG`M5Rss9^TQ)t0&9e1 z8-}!)5b2KcZ;RAa=lQR!A6;yULipmhms*3xIe^6RL2Nt6ydSa9PLeKc&QvlZC%zNN@ zX5aUUH`3mh|I%F#P6_}$N#7s9JpqV3?ZDdhRSnuHMQZS{1mX(xaY8(hys$={_i$XS z;agJth3?~g!qFb^G$#xJk-+cV3<7Yd6Z+p~0z;vUXo9THW(d59#Qx`jr|-mYnFwVA z<+ljwRc5NI(x=@|Qw+vAoS!?;7A$sKkt>!YE21>;%Nh3~M$+i9txy$;v%$QGloAzp zwPjXZa13?Yml|$58FoON=i8AX6=SNtTUCZ7j)ndkwRgm2Uz#53q~}ZPeSwtDE2+n_cmHj+;GlLTBNuRPnmc+c0X(twE=s=&rG2=|(Qdy!bBLybAd) z^;|yjU*7XF;VX9r#LEN2@4cm^fL4p;R05kJO_dpDqbdB-D-wdyiu9#(kB8)>$cbJuUDX;zgq;vAs>^n1$@vqUQ5SE zH(1T~bC^NSMKfPJi5rIO+j@pHK;*sg^ZSLXC^@WIQCPQJw8~sCh?R)DkB=P@O}45= zw9GeuCLD1XGX$PKyk5@yRJ5OEr8fZa!lFEEr`F$hZn)71B4LTi8)iy3iXh1b-jYck zZFuz?vqed>MHDWKjM1W3;jhDjq6GKYx$MhVy@6sDMG`(50uw$b>V=H~L5{%2@Je&G zaVs2%F?nMsUu0uY$@S8$JI-rmCKeJTuyjXmNY}cKKeZ@x!Gfl(NK!GVJ8m{_@^vF* zgm)$K1gtSD%xOQ57!ELH?f14P`NO$CFYV2+TW-E$ zHM@B=DcT)FqeWA#^F6pLbRTt>-_f6Q5Z8@@Yj9eyo^1e;b&?^+s83@wN9&2Cg31Ufmr-7bT5YHunO`I|B~pN`4em`w!BplsO}Yv7GYu z^TKU_aFPKPPBOw_t)=$W`1S$e#1Pab?S25)2809ebVZdH9TyDZ>zbM(`49+U(6`=HnC$-@wB zmTV_6@Zcp6$4Mvf;0g52bmW%!l$V@j3wi!py-e?-YzT+pT+J4-k|PcDH`zY7-hf@K zIyz=m?v(9=L<*^M69-4C%6`D*0-2@C1<^m-QgK}$f}j!@oosJGEp1;Jc_vUeNuVEa zhXo|C{KLrUf+8(M{%eJ4lNvZ@Xf*s3gr|70?5a!Xs#9IRjUQu*O*wbV{^okTQdh$% zpo+e_6aTR>0bm)kwkc>A;8(u~5(!A9mLYVF>3T59`kw}0J5f{ApNK}#%P006CWQ6V zHdq_wn<}%o#DTv?XQJ!!)~I|J!`PMlS~>osJtkPlE>m|hnCIjF0j*Qf>K1IzLS<*_ zO!F zsnsvmbg@E}&DM!OBNC)F6f`v}s5Sm~KJwRa{H{gRtm{KQmR(i- zXf@mE&DcguZu#16nS4F-x>4wH!5~PYJ1iJj(Sg9?;z2D$FqXpfMgd$RbVYXr;prnR#a$!CU0;b` z7>chAPU8<3_UuaYx@Ul~=D&Z}ft6FHr*mZ2O0=-^doW2hyvf=Q87}OjbaB>|S1Q?N z9UT?n`=U0Iiwf00>r7)-aODG-lNFCf6^ORv@C10@vqwNYhD)jzuZBxZ`Im57=P(ai zP3SYg>`4Y~;_Se-H{VuUsH+TSk0?oW(SbFDRzbHsiHxE*?gEnTwupvrWI21EnwyV| z?aV(fx5lu@+3i7hzG{gtImKB#X`H+MsiA$xc%0{1j-!{}-d@YWTafJGXXib#+-l4T z6x<@nzV6*R>Us4+ek2LD_g=QyiX7yQmot20XcBY+E5eacm?mE*(gg z7^etO%3?`8?o~AtH_Hf~<5*~9fW7Zu#R{(TGYTeX--{$Tq3PH4#*{v%mXI{Mzh${_ zaw_FB7epp+UQa&+XxWs(P%kVb#bN8b8aq(DaAtl;DKS-zt$jS);ib8XRJl#HCqOAbLVR>bmN7O!C$Zl}ofYViOJAQ}~Lb)D) ze_AT&#dG{#()6ok=09Q>#nJM$*HMdf4{_YdQ0 zx}|aPMc)VIx?b8HSU~j61Ojtvx)3+N{se@dpC6)<*T4R3Icfy?(zz&JX4YyF<3pJW zJ{gi5rm5sARC7>@%*5d;M9)3KI|?5274P9SWKBDy$bWzxkhV(U`ox@TxVl+eKL$O(-YDqehYD;_s7r!bZ zLlrkqfI)3K6%Ml z(#d;uYHQ?r(-9%8x*nDH(^pv4g=#|ni)a!%ZZv;g8I^%N&a1VmP5Rs#KBlCzQ%PCg zGO<@L3e2pGcp>rg@sVRA`1_|+>l=VlY=gs8_AFB@)@09_1Dv4 ze^mM|$V;KyxD-wqnhqufL-5-z`Rii%r_q%CF?Gcvu}cIqmeb1YPB(kME=K_s!O|aG zzut$4#Vo#ZgBQ^Uz6rzlB^8fxr!_5n_kNKvo5EB``sGS&=r_d0zQ_jj%e?0&q%`q| zXNUZ^@nbmy3EUKFOX}h@Fl)@$B4--v*?k%IB zq^f62V*6H_)uZSmJBcmBj6!i5`xKB=)w8rJ010Q`qB)h$lXXfST9+%h-RrewU-^Mw zolFnApa13h4RbKmK;ef555f1CFjQJn_d5duIEIs^mOvu$*-G*$rD=k z>c#bIRwts^*%>R{fVYl)paAEv{uSgs73=U|`2+=WiC7)7`=o+WpV-C97+fF}00TB% zcR1%~M;-vt%Sy*al1wAU0-hJbi*-!!)(!`v3P(%?d$H;foJ8LHbfqEt$z=!+OSir-jF(KpPV{|}yrW%-Y-pT>y9c)8nP@KV zj!=dt626!&1owl8&o!zMs;Y+V(=vb$V`;a&n&&wYtOiP7 zjS315Vbb8eBX5rC51+Q3Wb%EXaa%~t`>x$JIn|Px!$rNHReD2KlD2~btCn1Q0(^?_ zS&z8GtDHMCz9W`gWeghzmsQ`4Gt!`(ERAfS1+xyKwi$sm5Mt??m{5=np~HfB;v@tL8Z+VKHmQPx*z~cVWDb{@!Gif{9PPH4r_h>W^_efHwV2K8tN0p& zyF&otl}ai`!Ge2}Dw{84u0YyCB9Bvnjo9{+=lJ7J^6w3&{78iQFIk(Lq3_wekK|B8 z^Zui5o6EL0-S$54hh)<48_09t_2k^L?IzuO3+PKIktH-p#+lDZ=^!*Tv=bJ5YG8@F z{2z0hy7-T|>6E;lee>Mz$FKS8Nn@bg;~_>9=Lk|u5RS!4qXo?pHQbRN8sR!}k-+i1 z3qK-$wp=D??5H*1@s1n13ab5+iG*RFjW@2k9UkEs+nSe7@-CT!yHUZ0n4owqrGbZye8XcG*W79wOZtaMmkYWDKzznq)w`;O!djvlTSMs?5R^ zn&QdOCX%LhqQzMUg8cOauDqU9@(aqKSSb2FTzsLq2N(MyHc}EL|Q(5L62L%{wmtnDV&WX=0entSp>Q^2`>T(*toYC?Zw? zp&wK?#vW0G6?aZQ$$0+Sq}o=Q7vn(T`g~RBAo~?n;BMAbkYO?o1|oy;XxWP8 z`h5rvGke~8Hv|XS( zX<+SbSsAO{l&Gz@k@nlzApQsT_t@WIs9VVhCINhgO6Kdba#+mzXj1qdlZN0WHNRUR zSzs`Ci+30Ya~Snu(vL&xJ9gfF4r7SIseQxI_(t+a$J~ggsCCDx5V0=(DDURSm6g=9 z6%NPohwq`pxPL(0G+BO&hUW4HLij%?qy?i;Q-U+P8o8cfDh3*IM zu)&_DC}&`+r7`tA9XH;Fby2Z`!RKUFs$C7ORT1QJ1~o+qxkNotHap$e*YXqZz%>FCv9YYAtyBw9vq`ZKpxYJDOxG?L!Xji@ zRv%I}^R}X|y1)5<%I_$fkllMI=*}t;XTx^Wb}8gtxe4DyFljPG%oH<1Mq%Fh$d`ND znezHOt{SMAz#V~hr#CpY-y}IybzBNEqHG9;R&%f|iT+yzW{)jDb`n|!Nrli+a9OES>C<<&mcC`f|_y{@&5Wpk{SXOfm)VVandQ?Lw0tZ{%59J9dn(yC#YZPfBE zd*N{fRBBmaNEJm+sIJ#?&W0iHLTl>WO*GSC_;md%!zsmv&^rNKj_(>G z$FXz=iKj($bn!YoKa;GWc{wPp(K-<|>i|L}j1tPt9GP9Y<{%c9(EK+^PXJ`9H#(Gd`ovjAWjOO=5@Gp9Upc%ge z0?j*;k#}o+D>vk>*RxdwzkPqh#CA@`qcAY=rn52%nAF9Z?Kl!7t_rhK-mws2YLHXB z3n;q(YZA74XnbqDNxj}A;B(N8cEP?R`k5RQwuPP6XB{7Lgbw-jH=uWukE5U_@slBE z|5bVMfQXvFamQao0_8v+H=~4}R>|>YJ@1W>>lt+IPV}pCCkaRXC10al$7sY?ok$-! z;GZ~d{}AFY_XNS#L!z^HF)L;0kx&1~!t}utRlV!orBu41tHo z{$NtD7(v&Wv5O2rYV$xwvgrRR#%Z!x^1;SLyjg!7ajOdk3uC=25FH*K*fAGfT}1Y3 zmYfCp(I@SMNbs@1j;Wr&K>9m^1n+TAi6Kc-o$&;Zl8|rD%&riG40jm%h`M=$wU&~`Zu$XU(F+QUk z!QDOgZa(xIksc)QOy2l;+D_nJSJkxNYksNj1}B}-{g(TF2KW1?rRLubzN;4j^4Wqg!uAyET@$H{-O5vfmo*OQ7lhGh_-eHic?b=noHe zazGbo3lj9?)u+(G(1?f4?~>Yg!2nLDEw3yW+scp>LKHYYXEBVhz)g%(!1qnwaEAd# zN*Xj0^jWZIDE`1mQX}IyJHkw0I(s{c?=`Ni!1Vj@^99bq8E1cxWULW>pRuR<I( zj{F3C9}$otsD(I>FL`-93x1vL2D==?3}QJScZJo#13267xFEJrgH&!m1Meju%mo2j zLaVs9P(tcmLSf_SbSUL+O$GBAw=(jbV4SI*PwSSUDg1sM{? z6-ru%(-eurjYoI?{sevC`%=l!6E<+*YvKdljofL%igCn)F+$3LU3?`R?VXc510DU# zhZL!cnxCc--b=5h)6BPjEDF%AChrcv6tLfA0O0M8@3@jz`q|@Q)POS?LjMAOHl%q0 z0_p9Y_GJpo7(_*351BCY2S667APc0sVr=HmQWnozSugD-Q~`p%i((p?>17V5JU*bN{jV{84J{g&oYW&)UAC&uzo_? zwS4!Z<*heA9hw*WNlAChShUXUaKrmQRFSR1qdk+S2e+9bK3W4b@`DG` zOWeqx-zew#nva8fYn$PPYX74RTR*xt_6Qbd+>wIH8~8h*|msofy`rhvAxD z3UZ-?F#&Q*w;_>zPK%GK%0TWek&O3G?vf>rb5|ydczL3rsf2kc>HmuP^3KnGybE$- z#7!Lghk8S-2ZFr*>);NRZ{6@=7B7*9@V(=S9b5Z1phJ^4>) zg`>Bm^jwf&7>6;G{W=cv`oh5Sq$uA#cF40+c_&mC?tl3c3{#r;PO7vkva^-?NzxM; zasNkj#%zvl3(Kk{K`K!+XTD?u;&#j=9gPTAH7vYij*%VoPrH#x@vp=D7z*LnI6*;O zzt@>a31F|;pZ}ahU{fnoJv|z4=O;jXm7edMT@M?TMbi6+NPnA4oQ6T%#0((_91HV_ zDbJU8DM>He*Gnm9qR*m__tKBcym!lXkgys5$QSA77nJDR+pQP5k(&)Jjsh4whW-az z-n{LRt0A*)4H^E-62qZ3_Q!FQ4{b2N-!-N&GuvXY2XBk!at^TCg})xk8Cjaje#GAX zX!@2P&NOb!?(RA!6Z1PCO@}SySC#1sznygsxcyQ0kCDXn|e&;@Si{dqedCBapY1pN`-{A(Z6E8Vhw>L89FCPu8GUQf;jl(!EdSCQSmD<)p?<-bniJZiDA(iRM#^t?syol7Ng-_OqE zTHT0_|2}gkueb4a!B|n^$V|)#%QOo=1OBqCjbw0KnD45B#TCa{B7D2mr5G+APoi8(>*ngMiz(j$!8 z<5bvDEV$9|z#WF1N`Ys`w#)&Tg!o(yPl5$TmV)-;`l9Pg;8b}=HBxT!bH}W>K0;MG zK3)#q#^qQSB6_M~7re_j8#whgD}+MN7zcEX7m*GtX2|;`LBb_mtkotC4cg8R{b?*P zADj9x47Fkn(piKwXjwC~?*MnA%aSU7REJeer2_Z^96OB@no$?u_FU-!-N&Pk@Fdrw zKH2lv5<7#EjP?~pPDX#OFlQ?8lwldryvJ)(qT4QOwI#h9Ow!(m&>P^xMx6~HM{(d8 z(|=!xa)NMOGpbr&_BE?#+(K1>Te9#?OkCsDQ^K;E3u!9jA+jA+Dz%|wNo*CD`uBu>-JSc@Xj?K{?SRgr~jjqGvitY z7}qjCEqwt#*_Z#nR-o6jDCGau3;fp#>`>=4n$W_@9oVW;*~;AZW(!_gT1BIo(K^{PFv9+<^d^bD}Nj%c{s`CD5zI`|a?w#ZuO+j%F!Ds8R!zmbC@axnHlP zIt`^e;|kXhR*no~<;&IHDOJDI5cg7b(mq)S^0NV?EMp1G&d|tmy7T!uLrqXnjORPp zRY*k5I+nt!wZubR@g@oXo~#P*j^?5}4*No4J7fsC`m)=sOI9*%_s*o5of;}vQ1it8 zCff{Y<8oj21yM_jM*2^|iUL)m>O#UJ0uUdM(~~jtHFW&62}8z3b)hT3raL}UUW}^8kuPYtGGnRk$*q`|{beUjz12P(Yj6_MH9U9v zm7N)~aWVVz_0V-cWBJ&gJ8U28p}Z?L$T-yXa$T;K{nh#sI}Kluw9gk!S0PNRl=_%v zlmbbb^&rWWi_{4Fr~cX387t!35RuYp!D=egdD(fHr)Es20{Yz7$Q3^N6>$X~NRT8Y8#QnY3c;b4myh-dj;$E}f4Vbf8*`|R&1 zAQgrIK=mt$de-`siDOQy!DV)>Moy!4blGxs0#DV1O+|HzMcKsDETEbjA*9#fEAHLG zy?%$0tr{9(-#z6(zUVaZ(a4Xv|87Mw$!%7Qa5mNLIZE*H5f@eUHC4~>NaIfqwgE?a zJ6kF$tfL;Ni?mm&SLG|McNw`d&;x^D<5Gcy-C?PK9+>QUVf}keL<%fLT);-k4<)?^ zg78>!mg~-;>$NV<;8`39iW3fbJOSe?yTbNG=VH%ms3C+r*fOzvc%vrKrbTDG#&n;h zV>KG@Db(4$h04b4&mAKQqi+1?v^i-(|A8?#YJ)oC_2>v$!VhOrAYp3A#}@U%$WmKd zbg|Np zIlra7%QK;i0+o&y0O`mO<$y!jjF^h&O~IP`1vfY5*;}+dsw2kQw1-ZyE*MgGLml01 z@~>4y2)b||9x&;pyM-UOCsF1@AJkck9%@6;CE*%v7+yoj8*~F5zL~T$rkrfldg-*k zRb1Tu>iNO3b4tNWBbU)i=(}!hThVyk|Dd4-YHZ=x3^qiw=K_4ic9QI z=#TwLA${pRJ<=s^#Pm&bMjbk^${~G;TF9o6M^9N!ksdaMqFPyNGM>!5Re5`~P50Hk zpFfI0_zR^1i$96x`t#)M#?Eon5P_c-s8^gJCB<)?^Q3bRkI}AJWo_u++J3rkJX8|{ z;#6I%H?W%au#}t!xZ$V7d)h0vpnF^3e&=dBI5ZI-8x?R3E8%XrfiUeAgnwSPT(5~+ zpJcpk52e6#rpuIIn*Toc?=Bx3=i`C99E5o`vm!&zkRH;Pa%_DVrK7-P)`eh*hQuo| zO~PBqeV2WHcd_4#Dsb^X;P|gob9eV+sQLc`ABXyfe{Uhz#-aaF1kIVN{Uk`4aJDL4 zSLVoU*7?Tm=#beQ=@awsl2gctTA%$Y^P~*{YS}}W<-D+uG&z)g0mgfj=rh5bhBS~& zfS0j%ugq9iN^<@xsj4#!GJz&E(>&VDyf?v162VId-Aa4`6ffWCbJrJNNqG@`VYJI{ zXKE+{zQ+yNe3nG~R%4ibAvVADx#(aIEyuVESpe&vKU$@i+Zo4cSKB}D9)U`NrXFE- zmR{XpwKuko+xpvumE=I%C`X9ia?F>aR^qr#VHeM9?2Q^rw<;Iqw-dwc{?3hqV=B(X zM}I@wbuz52iOk>QdGJoY74lg60wm|9FQ!b(IKSpju!=G1ei17)mVYFAa8;p8p+z|Q zA5aMs&-pn*^de$PcQWF-hlU_A;c)TKh&!d8Gx0WBCV?z95)w*cnySM-BYYxzH_Gs% z_qQl6YH?0E)QI~P{c<4zFOrMUdi+a_ao_3jM^62swAQ?S!TS+l0J&qKjr{F2J@A)8W>Dat_-(HawD!z$e)&3U(pZ-g z$U!_=#Fe33t(rTrK_5w=9Yx@^b$pKs~)YB4V8MbCX=)d$DF>V#@ z7K)h%k1)O;r)`W9wLgI7LrUik8O-trUh0M?(v zldPr2)cNiK#nlG{xs={LfV+fBu36S4UyTV*mslB6JJD8VfhX8I!nirkaG4Z!eP6kP z@7;5Iw!zC@!>svZu1~t!EyMA8UKuc9oX)%pf4fBSmtsZf6#fioPq1f9#iE{Gb_w4! zhFg`c+QqcsNB8XI)R4Xs+ofNm*ZlDuCwB0)H0y@_FK|XD>jZvj)(@oWexKcz8?U1B zFO$2OO;NTvnN7@5ujJ|Hg?o;F%49+-N@nDptsfXn5zr*@&x7&IP?7 za&#LKx?msVU-ZvjC`UKV+|ecbPu7P`p?USp4P49(nDxn;rR}z^7qAmUVGA)2#yZ(% zaGL}VajXGOD~+oJaZ3Tv&x7|wHqOF~5~U@JK5AfZN}pyot`9?YF? zg@;Oobw;u5v(r;l;&)GQrdp)9k(sjj#o$BY#=l*3dB=zysf@OQ) zK{ubN9BwSBujDmf4s5rui>;!;GG0a#^zZQMc*(qzk`W%dWe^~h=$4u0F5{rjpRhW2 z4@oA4fzUmI!T>yCrBhZCI&8|^NTFp?2q@pT`qn!8WwBxLiD7!Cg-%85ZzDl4pI%V# z?$?q66?i!t->9CiFci==egME;J3?xpvLoeMu&@Pp3}TH-8=< z3&j--bnv1eba--hXZ)=CNV#E_IQ2hvO^01J>d1glabqFV%Li! z{>9gukegYc&W;lM^)NRZ2oohZablLZ7d;0PH-usUpz5Xd>nsJ)o>F!udr!D zLi|>m!o%E+og@nQRrK-fIM9KpEdIl*(hBDRRR}XKh30xJ@O0j~+WcF8IzqXzCX=}J zHe)lb%L^d}oo;q}Y?grc)C=&QuD`WpQyLT%9`fc~N^eDEW4RKT6WI#C|DCZ(;aRE%E^d_}K{rYJ=Ql;rXApugDIg)(3I1Xt60uVO z;k^k}HERW5ekTYv-+|Qw_q?MHYt8YP1!o^TGNE!^=Ly1v2>7RgQJ#oRW#L zY%Swl^H#C8OLtZ6MDewfhMd9(302nxe)WL8pt0*_b7 zB2(Eip|`noT9qgSM^hmc!8(ktLc`r0j504=VgFMm4VvxJ!d)z-%GCIpfJe~;RY+?b zz*PW`lBR0ulTnS957>G706Py9K1XzdG!e_dJ{G^`Y8^E(G~mO3pm2PD4(F3 zZVE20KRzuwfmUHjuKBh~7-Jt7-g!$jb8@MuF@q73P*{91=w)p`p?DtQNdRaTU!u3G znif<>E)1Yq;Kv|b_aGFzb_n&6w8}zS1sq~~$?aEtSTrd3`;ZqD-1&xSQHse15zR>Q z-k9^*B`tO-*=ftG`%P@AiHotbXoCi!x*I<4lp*_~`U5ap+%kq}ZpQe&M|0D#Aq}@^ zObN@8mDFzLeOK}9o2qxdPTYl)zwEc{MDepjeq8a`xUNe~1f`pgLGs0NIUjI$WmA46 zx|*%gDMPHjBQRS}cY=2M(#YlwY4BWl-wXJ8FqZ;}nz_`JWEp2??gY)b8!V9I3fgfG zas?9gNa}3utQMmCwL+3b4ctDIIIar93qDvDG$a%>xJ*U;>bIW)5%yJL?%RC{IM*+&}Qqj-HDt>U(x+ z{!`muD3Ja;%SrDL8F1){4$K1PgT;~p+Qh{GVSw)M>~%WtlbXp=O`rs{7u7ytG9^KZ zL`j3x7$Om}Kl_)Fkea3QTndd18G8weo4V2&m`uA4k^sR}@0~?l}7jRz& z+H2e=t_vo;ccm7ik@yA&N*Fb{XB^;x^RfMoV)>9Ct0E9Tx|Ae>%K!}TnjNGoH+!auYdf)jzQusRl zu_~SFrVuN=6iuMS280GiyS#R9=i=)fDA&ObHWfEBu_6Hx%=HF1cbe!>@m1wbdN{_p zy5;>wlonttwm2WCPw1zn-o{JRcf~$PILd%abHSIz_f$JyYJ4R}y|!Yr0)s42{5OOG zPk?@xSr0O)&L$f}uWa{8D*n(F3~W?4aPN8@Emk>sS84StMRF}nMT=>c2$tx=D4vcl zXNoRZ?dr_6N%SP6BjdXbOrv?MiC(Cb5ylcC1PmeH=l_{{pq`%nH~-CJ0AF$UfAbjb z7=*w)#&q3Ob3m&2P&xmHw}y`pkf-?B|9`;n1Ug{o&GX-Y;U|NCrk>j529|@3|CxHe zo&9edn&pwex5mo1b#=e{Jm(tV+y*4RpPO+6aY4osaf`x&14h1QBYQB7zJ0>nMwijW2$z!cAUiOtiN zwB=~QDzl*H0$PMVvNBYQ(8~)-seZ%1B*||}sJ!`|NB@eW5gPX;sjnNcfw+H2y%4`C z*eLmR6Tpq2*Mx=kc601Qu21JrO)M8n+0dxq`1O%kY&*+=xTypLk@4O>EyGM`pk~^T zphDgv;CmDS?8THogWppoiUp{CSL_?9Mj&+$?dn`*+63cR7bma%{ z%4bk_v0V9P$pFJ)PCI{H_4OtYpuUqCb4*wq=Ul8y-#vW}8ueQO=#(=D!pL!{&DhN* zNAGU8*FmI| zWu?|o;dYs@r4W$RC+0~V7n!%hDYwJZTWKA4K!ev1K6vqm|K>74!x zjqX-4x)>Fy5z`I`+UBgi7I!L~oiCPL&yapN>Th29>zdxsN35mLpU3R8{SFAj*tp-Y zr1!28&9r1WjS@&}M5<8U{K#Sd!qq{)v%pytLKh7jbr4u%HKZjFx<`Yr&PT*EHZh@W zu2^**b0?o{iOrj?G`H4Ja;fJuN!0JtVvSyoxFY0h-S9OZB9Zc12x9KxYk+nBjX)sz;iVW^=fqjsWe(1_IknAZOr9Cgj3C1(KY99_X5-1|-3+90~p1d*_? zCPSeFGs}F|7Ar@|f%e-ZIVOC6IK;ciu@-RYI!UiZc1$C#0fEPIIdEa5OSrzs zDihL))&&KtKzqRXI0JT26i&{s>pbGXV_VMHd04vqwB(whBDcMzuEuiP zdstsNh{K-9W1mC*!U;gqJ>{(xTbap_K9O;{{s6;b=!Pw}A;EYXO5g$S%1)950?9~6 zv(v}``xTqn@jzY^Hu_2J@6Q?-sP=wdGXc{tL8?MQqw)=zfFpQ#j`|01NX{FX^81p1 zHAM-SA%)&Do)17So*c_K|Fd;X8ogLWVvDOk_wC1H=WD?#fzL z1spMQ35l}`EISn2ndJq=^uB4~mu|5kXa9Z!(dJ&+*8K`8kBhR~V>hIz_y{z^<3rg4 zKus<~-brL+LjcZOD9H)Dw{ld5RB^sQju(k59r62vNn-QY9lX zF&vwlF-v=uN>cwux_w0JS5|vQ!MOmhNX zyvT8gv}?c#{rM2F;W}{VgGk02*Iz1N227dJD70Xp{1nK6Fk599obfoE%ZRa+0#@t_ znjE|ws#`0TF?5a899mtfwf*yt&UK(vhXm=mk1Enh#jF?epjr7T;IONY^X*gF2-Skv zH%_#Tfhf4RX4ev-OiLyZYjeN6o*=W5gFd{$PoH%#uECkJ!jgc99|Pd5QYfl? z&%i(*El5&2bRSL<$VgYXpF8$6!l>dE1b&yni9jn|XPYFp{@xzLEzX2^fK39m5fUyF z&4pC!h0D&wQEmf5lE{yh1ShSaOAM|rUtBUVlCn)Zr*K``B_3~ zLWWLLx*}3z8n(h_Gx*R&#>1%sPFsUm2)|y{m$F_*<|_l=5tgBS+Dt#ujEs;w?rkrK z^vBf}$=ZVjo^U0hIQB(*P z8Knz5E=S7(D925Dt08bf$hD6fnn#UBYK5D^N-Xq^f%0KPunpLZgl1|Rj{GKEqD3yl zSo|iHZ;?~eSKyF&;uf3AV>;M6yvkpmBA@>kP$!h#wz8c;I{`7p_dw@~jjnu%Y=6 z*nqB|{vDja^Y;IBaKgtSs98Cc^q*O|#iR|z3IYhWFof2ck2SYfTlb^ds16SSF>k-@ zG5Ka?rJw(%+zz~FFB3#&J5$j#3#xXt`dQHfH@>6i+IU*q<;je0Plx_(81ChUMadr_ z$n|8@9$?K85+;5z?>V%(aRa+vXq!}%;MCfe>EMp3wb<8TX~f4+`eK0#2Hw8JYIz0( z@dOfx)pK4h7A90KWQVNGLb?5gY8&l zXW5U$77^Ub*}f~xdqH_Dxzh$;8N`mTtdG-O2iRR@b8?f+lg};TAWNHIvUV0${P_vf znZ?!3nHWuHgkmnUg$-Eqm@!V8X4ZsX^Ai##)Wp<%8d9fHIItkNPzos}UIG!;$vDRE zyie+)s#v(|rfi}*7~?kJdU%Az>NuDZhUP$+cOi{ma0)!9#$@Q=q!A)frce>e&Vmm? zU9TxC6mV+wv5wj_AvDm1`m{iavd9`1C=wbtF5czbDvh$JuA5cni6zywMpSB46u*|YyVW_Ezb>?dWP2XX`U#M=S3 zu2q^YGZR_(WJ;PYBL@WNav|7|Rq%$vG)nD$D};1=AiJze7Vzp4hl}KFW!26$p1wetO+DWkwYt}9VT&0tVcRHItELv za{1TikWRO42tTRLU%E`x$gIFjRGmLHnW(p2O|*02Lfl3^}8T}Utsms zNmPWKcR%C8gOH>#_7RZgyd*rh3hLE0QQ@vfO$~pbA@F2;7@ll{hea;IaSp_pLPMa} z71-h=`w`tU?+WxPy6L-uM*5`l+%jRYnr<)62wO&BK4upp`8Xc`7BZs_MZE8m?x0_3 zIxN6?^%$jC8osC6`-_+H_}elBIUH5KBoXb+D0Ux0H{7mywcskl`L-rO7w`pjG&aeH z#K{u$Az-8!tssj(K}p?aQ?emxl!@IE4sW1K`NoE9fL8{ovDcQJY?uc6QRPI5kHi{T z80qdsEJ5880$t=9upzsyuUmD!y4Gt6FtBhj-ohZc2;r6ATgo!pLGpTSoLl+}i7VG{ zr`9DL6q21tZoaX~m(GiD_C(?*8ISrIRx)H-D6w5xwu;hN8$cEuJ`^T*@v)2V^+w9% z4Ur~sJMN>n4j>PZ#^BP#`FnPeMl=c(ecLADFS1oyB(R=~A8)nUj)i_uu$%PCFp*)x z=7U(WsQ@m87Hu2^xHSPiFYs1bDo=bOj~;E@3u)i*t;6ND2VVn47Q z14v)!LXDsJ2m1PwM*c{@bI%lwZ)&*%)>?_$+-P)-R|l(r*GgcG9>dHDw+FYDi2sDK zfgYP`cb7QOG*{tE4Qk8w@`_IWRx`~^PfVXp=bViU^BlxRgi|kpw3>1|Gu``R(YJ3~ zdt&~P3y(=kxH|o7FZT-%&KFxZ)XLX&g6lGzSzmW8Gf(=XdHs~w%vy8nVK+Ki3_sKu zaNB`|d_(r2>|A?}1NY)lSVZo7!=GJ=rB!8dL!#lri4jX#=~bEsMLpv=n&OsD%-IyKj$se{7YHXEf_^no_ymR%w ziP1SRvCFDShXMx~?z&*!Ko2r};r@4!ArX8t^jwE7u*8`Uc@J=qVTkVvq8rny`b)DW zfiR+dHza0qd9NCGwz~n9UM0+U$mihQr)O3y;ukF%V}njak++)Db2x6<2ka2dqRIb< zq-zSO?ETu+WOHh=G1<1=WZSlDXS*hI(xl0@YqD+Ilj}Rb?|*g9#lCp=+VAqSo>grL z&r#kZU4B@7L1Dhy1seNcBCN+^Y{a5x8+suV{Maj|(j>)ri$_HVFEbQDpFQu9W!OOe z{sr4{up|&V*@9Ita~MpdBPG5ww6OQWwHMg4@-AEy;99YnHZL;$rl{Phv2pC%%tfUDvx{!$v$D?ICj+!wiZ zkY>yE?G&8@*}ek8UH)Hl(7zi}JDR`Izoxd@9F*K&RqL*ioOT${&pG;-al_c+5p-G& zo8TEz(mDhf*pR1j`$As=S+HYUP@PD2MX((U0ujn%5UTDo%eO@j`l|qDgPU)S*G5pS zsoAx>PoOzc6rBhZ`aMx|{R9x{CyW2%zhRT%VEUgR^3fwELR&kh_rdRu=qP{iC^xTB z$F6%=Iuz$ntxHg^h-Us8OYh$E&ePbM2eNuCc~`P7lG5lsk!}kQ3ByAx=sS0o};#;8?VZvoF6uK~D zHUM%39OZoRFc2iw?ZA>=Efqc`UMY}NVMtNL2#+CAKvMncnQu>3hK_lj+TU)EMg5;t zkKAD3|H%{>q7)b=E1@1i%Qi68v;TO;mk8{n|I?)j^{23BUtmO3h=Yu);~*iyqVluX z2fH$@F*e8yM=_Zxh*$98&t+*XClzo72dOZ^Eu2ei{wRC-KCm}7>{WSsIz7lgMNfF2 zNJFYJF3>{DI7$EY4dIeE=r!)#@u1gOPSPZUfN4Gi2#=P}@WxNo?w46oUerW{X~n>K4CIGcer``PurLwxODc>NS7nh)C5-=`(HIY34Eqiu9XW} zLIMrrHxc~H9xY!d2(J<`kP|UTsm29H;1V(5KcKitocjnsOXvPS{Bi8_w^R76E*$+{06!}lvFw`&E)kGrRo#&UTgHZnqvj;DU2ZU)v@QFoi(Mbro z$?$(y%Bk{(f7>yPUivTYiJ8VWC;NhWPnpr)IGkAd-LZtZ3@Y17t^(Ww zcTdjbr8i>;X}ZfeLR>VOV7g1#ZuLK{U$ww>1*!dOL$Cn@t`*U&K#`xqv;gQJ8UGf- zyn>yNIetUjfpq@1;j*X0h-Ms*bi5w%ZZph@FI0mi?oAwj5(vFEKi?vsQ#38Pv6;@c zeEV1?*-|p|`^Ce9_#CE_?NXO#Y$Nc} zuTd08holFBJbI-ExFS8nlOv)Fz9C7w2Ovo{))s(NzNWycW)YKP9yznsav&@M2@Q`Y z5a~frX>VC+QL8)zN%FwcK@|!w6QuINIlW;QcPzHc0+P0t-|+PR0J{hG=D2@$Z(N-) ze()Sk4K3NC^?AOm)r$5bRms^gmd0F)h`zicB}PFl}6T^M-@p~!?4pAjV~ zN5QclY_oT_35)(b`z?*w39zk+rwJW_o#*4Fh=fT2SoJ8%;zdzGfG{Y7cM4an z#rZSCWCo*JtCsa$M%F&?dnUA_{15R9q0DFr&=Y87zc5sPY(Z(|M>YB={uDB)z=v%r z50G$aP1UXA&9Bvi$6bTP^#I3>=R2sWs^j?aj!zkRL0=_Q3lI8J6f5(CWM!C~9YsKJ z1%h_n#2YB^-Nm}JN>YRRqa|exzC>5F5Mc9lH#77;*ybxo07Uf7*H~8f0Eo55ANin9 zt(0#Cxrhlr9~aVUDHa$3fd<7B2m$)kqSQ4UCpKvqt?pQ}79jgL>=u6SCL?VCBb{e9 zJN%LP%G$=U6Y>ig;?@50eNc}{f%KYxZg8WvALx$z3nm`xiu2*t^z?3w#Rd17&Ofl} zO5!MF&!KP5p>NF?hI1W+;GGEPt#Eau=j7#M60~uL%pe&thIWfW31jS>zpcl_jhg($ zBOPB8vCs0l_6zB9nLH#Y1r&mm@2@L~$anVyrGRK+q!D7%aHOCtiw;$|&|jH?Z<%Ho z@XYz{`Cpp#c!o@Pp1Rx1uq(Xgd2K8=z3GWoQh~DTKdfvvE~hXr93E)s5xw@Gn-p@~ zpziG6W{to$YP&RSDo7=P@dbLx-^t`$Hc$+S_S8|}h|z^Ugdrjzm9812z!JeO6TrR} zGT_>s2Y|WTUvh9fJ?##~Ve(*aN&!I-z{YB!{P6_GA<1ET8 z|Gp3C-gkxjI)wXH;~3417{mBhYh+zXgRavRh?7(PhW}zYEm{Kf1Pbt+i{Y!d1;yU` zXsyzz&+T`nR^a_#x}@XrTfaNy^da$-UGjkx%na;~saWw(Y{o>S%rVpEnZwQ9f1cs$ zCa?&9eUD>TSZ`h7Du73^Jh;n4cM*L5-feZ2_WgljzO)PJm(_m*i}*tIFg&sf-bmWC zf>w=?Igydy%@F(mrGo!409P|~SrXYm{x?h%s^ecNIP#Y840jkbj*_v3oMFIx{%dCl zIo+U}6|F;Yr1R(YEbLe0;eD#e58JdYRZeb7R{UeRIHq`H^Jrz}AgZZ{WW{1ssL|E;o1g zW(XW7%8H8Jg1*4@|IwD2Ui`05Hi9(T5c7FSd^hJI?4Gf;$e>K|w!}E>3cP=RngU(F zsWapcyp-K;@ZIjio2^8P2PD-d5bIt4vID572}({Q>RzI@tN$wWWFf5)M&^BRbW6SU zee=RQnw{nYk!#M>fXFq8|4=$8XxA3WlwMQnKSh4>>Cy=;^hxc4Elc8prqF^as(VPN z8H+5+eu|)rC8MAVlKcMxK0^8w2nR+Zwhs8akf=oUhKGco2P;pEmP~;$MfvE4Vrs@H zd%t(LwF{NezGis-NtL@pU0&R9=xHisp;Dw0r0Ycvu4ovp`Zb~(S_xgY*=6t>ym?B0 zP&`HKU&5@ZGN8!&6%t!*jSI*Fm0vy<2_`w|4tz!T zecidX*kne!It8DW{-X;1)jnFg*IDrYwFR6jq~@mwkco(V1dF2Q+jIwWhCj^!#h3D<(>$mJT*abPv zqyC_XFP>PQTi(q^Y>&yz_u|2(JSc>Ey`TC}O!$Z}l%<LTb*pK1FT>PkctZa?TZ}dSJ80fqESXy9)r_ z%!G5R)}S=k(NJXv!Hw{IUNUeX#K`WdO?I+%s{$f3Cq2>Sr3T^qh5y6%A5b0YVc6~5 zNun}bLNa{a+URL{b$2UTZJWWD?$>a?oHrdu3h=7nYm2f9BSA`#VH}Hyo=oIa z_wW*&Tm|}3pww{)31&lF1rN4eFi!w!v|&OCxUmYNGOrToB&G=?#EHUfJ;b1z7CW>R zFSznEA_N<#4Veh?AJ4iThNkV95>03l+JT8v;`l7)IA(7Iu4D23yANUL<|UM;x&8Qc zoxtEQc14dgvX|^cz7S&dH!E`VlR(Y5Z+nbR=;Pq2Ud(Lz)7GMwrXBFRD$XO1pyBLM z8dJWZ54ZG$EfOS_Rutvu|5~(qMXG)V-qJwJ?hYeUxW=8EEm}fb1KY>K^jY;(3KRpC6O3zCSu1X>v6E{$7E1 zM{~{-Q|>jCWbu zuGM)#Q$lip?L{%8#X`A*?X5N%WrG4I!)&XRdCZu(IQ3S`5GU9@)FE#0y?Z?+zznB! zrTO>3&gwx&rCw2_z9rOn?A6P-neyG02 zRel03XGj``l6iyLTu$}nm%53L=n~vG9`~!7tsdbt#JdXU7+A!(jVcBn6z96PtENU& z&6H8ZMy`lvDR=uvL7=d=FT{jsF3?TSJNx(jqnPI$VR`;x7?G2`d1PGUv5;L@kiMUS z_03kbn>~#g`EEw74JRS`j{f||C~uP&$--+_f+um_ONwuIM%P8`xbAKJ(wr@wgg?Nw zJxEX#r--L72&6-b!o7ge_O~h5^;j&yu$z{w5S)G=0Gcm3&7n^;7{NK;MM1zoF?v`s zYOktbH(bHMO}x3{sd&wb*8kf-wWS7VJ2kk~&O{mg&yI?=@&y5+vZ&3=rWDfpc4_~! z#xT7Fhv43Tjmx*Q;p+X1WR3pKG#LS`zQ%Hl^#;lu!l(C5$0wj@EkiC>*CS{%S=jNy zpjoGIQ~t3dNImgw+6nywo$lC)IIK73qh=6FDZXD>-sH!(wd*5%p}G5{QzCqDHo~6X zPpv>S6oo_see&KZ_*!*T?IZ_7h{={@?xKC^Ilg%y`v@F4uS6 z;6a~Bip~@8Nt^%_z>-mCNRFiIUnG#S3JJggAN7L4;UAuv+LQGwF}TR|$i4-2kr;kx z>o3;E+|9@WEBgc|2>^ zT~}R|3p`~#6))ICc26_LBRq!mg>@&r+GSqIw`h~c6Jp$jMj0ArT4eSIDBYm8=VlP; zPS^nLqg7d`N>Ni|Ofp?r(DiUSbJ+R=L;MPL7_4LC3Y&a$zuZtQ_+vH5eG5vNi-RwD z9?P#aHZv&ZOowv$7CP~cAIGt={heK^{kb@bfdKC8uVtxPj#;)?qFb|`cf0QHh8N;H zx5a|N&d#(3;G;3;*|t5z?v21_f6)#O|r4QjflMq+n_LojTc zVD+Egpkzn%KRrl-#z(c(1d|jF*E3sE!Y&%VvT+HY|Bbw#uu-#SM*ai`WZ*f5VM})>o945 zZ2_vbe|}tjngefLKj;mXETlx=zn*;kafVDH8M83_YQ@)?+gHPDNcWMwnwwgg0&@W( z(y>Bpdb-?E`#!Jaz8;Hn5_6X}eX`Q~x;8{Iw{?BO=+gn5! z=d7D8E<>b%_`k8t)*_tpo|?g$Xji^2LS)7l3)DB3SCMpT%Z?yitds+w7uqnx!`5j_ z>Vp&Y!#=icWlL{|D+Zxqt<}Nr6sPgWjLR%lc)q-l#L}F&lW@o)By`-t`thf?Dlih- z8qFuzB|R0e&gKm76voLEk>=?PLu>0M&nGr{P?C^cqogf2Q}xY1kj?vqH7v=BlDe}#zH49} zLXR2@);7a-+@chnh7kEr`i~N_OjMM{8GWsr0lTjGgmd>s*|l=R`qQerAvCkwC!U{a z`Xu4rEBI~+E>5kB8YD<%2T@f!^?aLb#@I9;mQr z4P%1-F49M2dbSQg#_UB)#Xv?7`2#Pd-AO>?qxR>3_s|MfM=3rPTF${W>;BFA&12oa z4_fXsvW%`8hTYGH!@S%8aSRKT;D0XEG$|TyIjln3AJQMf=#Gu#lBZ~`ER5`fuSIsR zPT)TT5Q)gQ$NSbIKcN`LzaAPp=lN4cMyIJ3P#f+CJy!#AbA+Gm%U*(A>ABr-UOx{r zljUZ+MX1T7t6$yQ0=7CNb!CZ?@f%gA%N~(--W1Io5Abj$gb8W9z(Z@Zs6MJcu!Ut_ zuy@+}o~{4ZQA}U!izP@i!vSV#L`1whCY7Jh6cbTjrtbWD*5yHaxlTh>fc;M2h;6G5 z&9l?GAKHMPwF<(j>fy*=Lqi0|L`kRvf`$t&>ToBv2ZAiV3ra<_1_B*fjYf+(Io{{% zRT?t{HCRc6sw82F-5Yj8gZQ#5PIbFM>xKh%eFnjbr#l)9+NAOWRm0ZS zl&bmIuI}rmZEF54EeuIJ6Ui$^>qN4f+YJ{o&Q>Lu*+Fp=2J2}7xwc{Xmq49M4%&C* zdtv@_cd#%S_}~08>Xh54#14~QJa%K`C7!%`u+sa#+_2dlmY_HB8VQ=tL^)2h4}EJ& zI)Ig8Wr)`EQ2U-1ceuZ6-oqTYkO058S8tOw+JHfqWwMmK{PtGjg`)u$mO85rY3d6 zh==w!{Q0%d?w4K**oLjyy3A=Y^S_egWDS7CVHUODlU!=$aeC0*dSi%E)~82uCeWpB zM*9xhHXFIf>F=ZRGNiT;?v-GkNty$)yl5OGq_qd4^VOBS~|L{ot zl&6j_iZIhWMq}h>ycd7e>J~{e9z8Ryf6Cw$>BXSk>l{gPSbuhF%w-vLM4u2CAOX)p z;i#6(^~&mmpk{e+|MP_0ol^PYANkCZGonQ4dU`6Uw)wzS78+uD12x)7IH6a&5r5F~ zF5YnHoPK(wSeFekTsD#(zJ$$!%7qObN#>(+G!yt7ajglqWutXmL5)+M@=T`^BdtRc>4DL)lYzveBEausZyPeLbIPofTQC&?wu-#3E2-nQa7P=AXVs3kY#EBW=q&O_Hi;XW12n(s;Nsr1>GR}$H($c7X&2xh zv9E6ERfo}L$T`$~M_AjXz-=Zj{vvR-(B17xU8f#@d&zE``i7r8Wt62X;t0U=xOyy4 zhGYFqYe>abmJ(^(i0NJ_F==<_+pz0Zu;}hpxJt)YT*++k@!$-T9RXRGquCgjm9C=i zlbUOPnXz_ST=0|KoeHZu*DWQx1XmZA2Aw)Zg(?RxXSz^r3Ys^rf2pMk+c@!UL_{@ecRLI*({cDS~DhBWrdaI`ej5k#DrQB3u+b8U&QY3YVbK|ach(-eCF;=M_ zN8kT2XqhPNaEuMti1>ImR06R#g95t<+uAq=_#(aqha|62Y?#o|y%Gn8dp3o!pZ^{g zG+zx0Mi=!*=Y~3P-k-!~KF+i#B_P6ls9OZR>UAJ+c*4PO0vJue906Exq0vi3UYmb+ zi;-3DfldErm*zFe44f>WedwLPvD zlOkRJ2*K5R+tRZczLocJQVkRdT5f7-u=5OacP%=4hWeRo zbUD=~ZffMU7!smXFm~8!akVK0+!#CSR9o9BqCd-8+BPTTY*MkT3~0;71)I-(7{GJ&8rJxl*=UJsNzbaWpQT9ZBXM#tR6MPimX1CYj#GsK+iQ0HT9&gj;?JJ zn?iQs!|0~gyg8I{UfQHXX7;R#o8TQMI+q_l;fguYG6o#JqhC7Ke(<x*vW1IU z1B`9c?L_J?|7`0nHePEtUUi*^t^@@kn4Nmv;P5oD1fF9=bBB%Wu4Z27a>16SW#*U5fPUjhYd2PG57@91Nr?z3WA3W~0{?LP9 zVWVfJ#=ns_QX9asI9Ht&f-&^y9FV#cT!25FB%ZPFJ;h7=2CmOgzc&B=E~u{$@g6U% zDiui6DlVc35LSs$S-GCQW#zT8*{g|8G})yO9i=N}+j;Du_r-$+?q-nOQyn|VK63t8 z`)BGjJUG?QbQZWwNgtFJ_s=l~LEhK2R$(-1N65QuF7jaF-o7`$SJGMikdo$5oCJ`p zvYKJCnjMQmneO`=DbFw;I=H|~)mZE#_g+kFU^p(O!ag0kTmtCFYnzxt*>gf@HSyls z*R$r_wQ~X}Si}9C3MW{JMrwGS;2p{eTOKT&ln(9TA8g`?%j0&_*oIuuP6EhXizYIUwdbGumTGthmVy(Q{owq^5uloj8x_it^l6J^&_x4o6{u5@kipzwTf~y^7kNj{lfiZ$96pr*y}aDp zTY5}BdumflHM7d^*J};sFmoNgkGTDx^ra&@F0?AbrJJ1fV7{y7dr~s5NN(JUD>^;_ z<9ZGq>bO2w-g%Nyop@PxO?a4fjn%49UdLhdZEuCD4>fvh_Sntg0l>1@WyPGkr~ER; zr^aVAG1YstZBzdwqXVmI0b>)9+)ls>nClTYKWV% z?SA~V;%B3)^_7S#;ujATIqOhw2T}C#_r>r8#+G(<<`G-w8!x8A@OC?|+)l`$IXla} z-tB!=;3sP7PxXAnW}K+{G6hM&ib9yudDh(Tn3VAxuWH2aXu!`b^uY7L7U{nClIG@k z%{&vnP9%X~yMg-?u8m)Vf~6*(N7ut;8vd7ib8dEXC>EMJ_NmGYRqa>`n@l+ktD0pB zb88Mlrur}#(`Wb11D_Pv+MN*cUH=MW8|znFsrz58&{*p{+B3bb7*8jdtzdDY%|Ojk z*%ALnu&Cl$S^&(rEPEq(XM+3y%gLOx8xlhaW>e^8?A4ccT!#@iC~WM=_>21a5-a`2 z@w8}TPphLEs$FMx)eU79c0GvgC-|7xJ4LTuTW-{#3j7T>>dx$c<&f^|P5R@8PVrla z)p+tlB&N@2-rbw+U+2yLG@eFwo{uaHO9zi$`%r+7?BNv}!P4hN-hj(|CEmkJosGUf zLkP^2Ja6g0DTc(V!qG68z3C#O7X{gH@TwewZW4`r$<;TIO^UJ^Lm0QW?31us?1Nn1 zIwj=VoMJVtm5+51i_xY=ss%^3&284Y7W0i?8Q7+@5Kir1?ek}0B5Voox7z}>_@5F( zRIY$eDgU=@v=P4u1 z?4(d|KY@-wtr9P;N)nvugXa&q#-64W*;FH-&Q*kgFgmZ+C~V0*C5h*gxV8mx+zEdu z6pfC9S8!|WnK&oTZ()rxW`(0ME%oqCfuHECFR>+klC zN%(S3YF215mAX<=s<`RM^|GG_CJ84SJ@v<8=V4_%z94KWT}nn_G+r@-!4GOfGdmmj z=>AkpUGEX3;p2U-_kb9e^M)5~a-iJL&J%q9ywJOHUu$vx+;n+C=G$yi&>lmVewXJs zdEgoC?8>rTU(R|Zk@usCY+4yfilgQ}+c?bjKmBr#_G0-c%@Zt0E(C!|BlY!sA(y|s z1QwYI%=|FC*AR7_^nP+s@gK$&-EVwA-SqRsf&$Lc$CEu{g9L7q-)F^nYoDmg4E8;h zUU46WhLXVTNx+RXZ$D?mO=+zeEyhqc`~)XJg?6OboiSa))&$AQ2WhH;UH8p{2f?B6 zx?&e2Tc*fEs0mew5<~yI_`MY7^&~y0>>HgU9;4OK2l%UZUc4=m;W2F3gES)0F9;-^ zc+)wtxWZ}OqnEe&qi}^W2tSAYJMcz@M^s@A!hhT0RKQ*IW`w6?a@cbLBh^UeBo>B5 zOJLmWV+_B!Sa6Zd|JZ%Q#klCR0f8*Yb5crJ5qHl%$kUMsQks_GhL8oHU?HM%uH+bc z2ObI5SGz+uMJxPalH-4vd%OdbOK(ZkdXAF2bb=v=LW7pPdm1~KkHFBE<8=O)_c;q~#D7jh*IXI&G-H&5qe#EE(>;QJ;V0K)6Pt!#x`b=4U=MD97pEIPqxJ!X zYu9Y)2G~gOiT{pjzO0nq*Lt}Q%~f|1MD6L{Fe?Q}3 z;{O{bv`wD`kF}BM9ohx3=?3jC+_*Al(~J9yf?gb1BF>mqCb8#cAQF6h6WLCKvZ`Me zARsIBo2tWtzRtMgYcUvuTm?^%FNX>Ys{l z*|UAwC0e&pu(Jee(X>91TxtlSyej|azhMaZZq6968%PhhB`v;Cq84^lM%>d<)(93N zOm-$6rlrY|?KSwXQNZ9KUY>sBae9F6qCyv6SAUnruKNJ2631)gyuu z50TGz11U)=-M(#q1@1ZUTRK!Kj^rhOu^EQTCKoTKu09cF@CbZ;o)05)ESQ;^nRFDD z#p`RV-L|emMpg>8WPaF7ondQ*cg4s68GGis5w|`Zc)`}_Y4+H` zuyPQ|6luxSlOYL8UGIu4HO=PDDB4k#Sq4-wo7;$WyXAAKASZ_7-@Dd2ZFP6gkDnXOOF1ju-p6Vd@em=p310lWr5Q&U)MUL4 z;xHdav^PxwbCu;7u+;)E3h>0`E)v=G$2iC*&TD{ZS3Sl5%E}+)BC-8-9>wd+yyout zC$j8y9%I*TTrKH&1}&2^SkP-M)PcrH1&%Wt$Rl!{i^paK>FGrPm& zJqfSE2O}ChDXWwkQAq@0Y2dcz2`fVSd!x12E3B3v#Lc-lcr_a|#71jK52kPL{9yag zG@v?~l^uosl(kkirRDl`#P{(_sxwrroLt80Oqj!R&xs-nZOf=);p`u78hiBy^vwm- zg|_30?ZVs6K~Eud!mOYC{4Iil_`^CsTdQ(2f6v2e=w1 zY$3BGwn@i;g=1C2ag5|uA8(EFR!HlZ)}tdn`(qoh6*V*ZCAq=JJ`W8MMXJCP9`k{b z-$k90=VE$BuR2uW(&bp{zt#~!3Kt$e3TLtD#JX3l**(~Fjv09{oxAr5FY6fn+E5tU z8BAIUW4i33#D4zroevkP9`9lQ1%Q?Rz-ZuFiCUkiQafDa*D_q_;)rW?{-Vu<{_<`H zZiG6fZg|95{`_iR!EPDeSh55;CJ+z`T0Q_iwrSHM-@Ib;7?xH6YYIplB!1MnOY6kU zs29yhDn<-+B1p6l7k+==eX8pJ5=e{;{XJMw3GRcBh>OvHtD6G;<{Nk1H4sbp>`c*} zCKI%GoaLFCx9B70uDHBX;Crz>);}HSD0L}1qfU=atHRi9t&&=W4TnSJ`s7etClN0v6e{U%F}ZAy{aP~fPL$`bd=vq!1F-CLZY6e?cgENv z4fWlsO0-?&_tthu<8D{7wEey%J2f2&?ZaczT>qKWTkMOEYZfp31{JR8L+{xN;+Q3h zLPb2A5B*Bm?X-4EkhTzX+1L8f8V0yYktJKqcF5lkf#(qajFV{n9#x6k)#Y?WytT{| z4{o!Hh_!@+v^bri=zzs`_12$ZXGWtZqfh8I;QS#MP)3OoNm=LW=73X1{91PK5lWL6pzFh-hTFS-qv|j^ zx>#(0C-ZLxv){!zNzYJ87+X#TZw_S#U{JwdU=t=*05|^8{{YYgQ*cB>Hhm$sIOSk81cjo zfvYtev0$AT_Y97Io)Mz5c9K#bA6E}Ky^ywWH|ddXjvvqZD~_aC)4!<iRVGT=9-( zDh!$nZ-T}-&R{d_`mmK>I+zJ64<0un*a@X#2)LX}jV1xx7hW&9DI!9!0HoffZ?U0C z>&ntpVZGPe>w-c{9ysHXSiFwMUKDQ;AL6tHz#L-I@X|~~EdJ}^7g*3<$~N_K;ivZv zQ=HSOZ)r{^eA#En4OIRb?Y7MwcUC`LTA*z9|I#SH_lTHjAE*eaJ})1XWV= zerZSk((Vd0@guI4-&LhB|9Ku%i^1?Uk$S>5uu)VHak_qtzOtdz55pIZao6!9 z#9fC)*$R+ZAdKh;{6Y2zh61#h04##mL#ACHX1Eg}X=PXnmSmyxXoU^#p&wZ}85Q=2 zmvci^mT5AYy9<@2riUr4v=jcd_0HW_W<}b_gkgZym_z4A+7F$(ui2)n%a?z7Dzj9% zrO7Bb4|~ws6BrK2F-G+3{ors*NjKR8hAs)l-8HqkWE2G{y5Bn@W+B)rzw61?VQM7h z`0*I6`>|XP_fQp~ooEyUOR@)gFh{r=*^!V}?2C!)u#3Ii+6CM_9131)Pdl zN!zC}y{-oC^j@k7Vr^`aN8`g=V@D92dz z;+H*FdHHEZ^T0na4AdX5^1E*t5R%FmTy_AT-4@+aG-yqPIs&<@(4_z5%Q;-*&;Knp zx<4>Ga9b+!SWUb+AIXLKnVH?j!#G0pt{kI<#M~vbGr@ULmE%UC9hY^dCZ>5X9odh6 zw+O7x>T*NvzqK6Ojt`;(L03q^>72Q5F|Hr_O+C{fmY><#9=t_}$$BmM7O1i!0dnAD zZsnOh`YuhO)WQf4O2RDR$G}S+^xvQ21e<4S-ET!Lj<(u<+HMm~(26!`+?ieKE33<1 zkGJ6)oPATciqmQQ0^Q%j#N_HrzC5!i^3iPIr6w!vhuBYH{xj4T^STFCcyjeANDaxH zM`206>#_Fry{mKOv*1cg+J(~NgZAIBQ;S-Ppbg{~!5x?~+K^F|$}&({wc^4(McMSj z7I^28gVXzr4SQ^HR~rI|Z7{D~>Um;>#*wRhG)5Bz*11NBQ|4}W?+<~*p-&^xVaDHP ze=abJ!w=Hr1i$5;RQky2N5Z~V&%Vy?{ye*W;2mM>s7L%?GQOns5tfxrMRy-M^H zoTX6Fq_7l!NkBuIbmsNn6SMT=#`YZP!PfDkzF+{p2ntCzOrz`tsstG!M43JTgz-wh ztI-rj1VXp3sXuPNrh*l&FINw%DKOTY_pZ#rKW1ONd2!)fmPn0I&HOk}O5rY||CMN?1t$61vDVOxpx&c1WYKQQ4;RlNAyifF25 z*MlyT6?bsnkMH?Y!Izcw&`f) zKAK!+N!(^rD!s+-9hitj<(n@`iPRnuxa$yLp8$JL-ggq#8^Bi?BIs0{vc{|7jcx&{ z)KM#|j-P{GKZlw2W>3(Kub7uCZUZMEZ!^YKH9ECo21s1sh9&QuxO z&UORe8iJ^#h%{Q9JZP)}D8;soS|iF~o~u&lYk%JCPV=LX=sRFb|Bzq2E$#W;66r;# zGHm0X<)xO991qxUsN9y{lC~anBs{+(w3-l!Y)Uoe-&Q8xe{XIav1TtlDIpb;wYs$v zix3E5zbgdez$|6dijg%{*Gafi7B5p4x1&#^mQDIO_T`jel(cQXy}aV=R>~Pm*V za{>GOIbQx@Etz|Vg!*k)7YT2)v__2Cf~M+sR%pb5hyid?I5wCc^x$rn^v!alv10fj zPHM`ao$B`HNNxDRmNHypmlyuvXQl2+`PeciQ=m=tl~8awI_<`kHr85zyb|Koo_6bM zCiaFMby}OV_Wf|{Ha+VjAvW~)9C4?K4CJ&P?8x!cv%iisj;%+Sktc(}v^G1hk|e8S zp$qqJ&!RvW_jG=ja>uc2ug>vB`URr(?j5tAE1y9rr4QdEk=2$OL+*-?-}!LN^D}gF z@g;mGQ$3BQHLrreS22AH6fSB7!em;Kev*IO&-((CkY?}Oa#8NQ>SG7g&23W=v!Z%p zW2B@mKV-x(+bzD=8q(8JV8j$Xjk-gceBl*~H+ukR|Ay)Ek>NZd%?`<0oF^UBo~Bq> zxy3b%Qt4zj;^~~*U7*uZAy^lE8P`&(_YUhu)E`->bG61Yg@_@0C+{!e>Y%THB0erH z8aeuEQS7TWFQcV2e&zFV{c^6Wsj=)#{k+NG*7anSxyRjG8C%(&AcWRCEa z^L`FM4}Tri@{egk5EFO$b34dH!BIkA*mCiG($ z%H!GGT5i23DwFjAJzq54XmV%%Tb8$#hB=0Bz3g#SB<;|mikFDvq0-E5xO_8Gu78nG zT2&5s9QZ~WUoN;h(1~g(<1*<6wVCxt3MyRP8{M)mSqcME!57^tz#c7cKp>b(S~h}p zz$Q}ptWm5C$|^ZmOzVDi*2C_Z*J;RyK)R2o>z+KmL{(Js*X&R2ji0AyLCf%p{I!BU zyL`b^J2@!HLcU4t>Y}M~C(^T#xlaVh?Zhav9YcX%DPRQTfU^7FMX0=&%_pWtDEvDG zM^O#~4$G$bD7H;AFdQqI%-`?M3z7u_S|T6^jBO=m!~aOdo{*@=YgT4VdUVeXewtly z{K4t5-1GJdjL7VqI8d?OuXCrUuycQk7F$>Sa;78KDWzT}se#Jk_%rnrZc(YIgA|4= zI3q<}EC-E~9C*V7XKC?u5{@eK+kUjUF4=&bn*-xGzBz>;%(@QT*BTIj|1-%P?Swuf zoOuWBeSsLC_+zuc%yXy?lAHlI&WArOj8=COwP|{)(s7K=zSj?W^TtptwcgcD$Ihri z_osDg{fesg7VOEect@@4mu3tgreEnv4Z<4N71M3}naz1a3pS&gxj zwT(T~{TMGs!#9p+*^HV~bhF3zN3-Z*(4@jQrGBD~X3T&kMdM7(0iRSsc3Z&Er-KhD z!}k@Ifh&NlM0KN^Ho3C$ZT`C|MLxh+Mhd4K;uHU*dR9P zCar8I|Hc@?XUfQLJlf+CbYswETU+_}Ie6;eXz|@257qbaTScqg#STApNG|_A&Q?Rn zlyB*(ZP!+#dgNtQWUi5WaI|D1{bBmx-K*rBTmcRiY{_UVV^{aUhW2rC9o;jMtlp&T4YxE}}eP^qe2`a0XWUiJKr8)l+3As^GXaE^XyEb$KCO zxq*O9=|8dHaw`dPy*uqXqJNHu)yzY;o}G!}7&VGFJtlRtvRh@5*DrP3c+)PwM+{6? z={$%87ysEfCqU*+?yzsZoKzQ-Te_5?^gdeKu+y!J9s89Xt~KnpkR3_U{i$c0_2(!q z@2|OgEa71z6_-wl{NNm?YB*&$7e|G=ixbdTCwr>L^a>FuE_^OEnt`-Ow#=Uj<%HI- zS(v_*>0kR?WLQXU&xQ9CrhcrM4ZgA**^ps84ha{bqHDu~)#sEU8gZPyPI10P2n^Ji z|Ju-~xh^lgA96snxCYF(;B*lJJ1{ORs3Q3zN( z8BK=gTPWi>H${}rfSIUVVgD(5xJ>y=rty7sR9)+*rjP!w`M(Fk1w|9Ti^I3Awd=f; zX%tWPBH|26c@J0I-X}5WjLQ zKk^d=+0waE0h<*kXjT#?wa8R0SK+tkdj8A4&-(Ct`3P5GskEQMWmIw;AqAi^TlR}E z{ojW2>E7+*7=K^Ni1@BHov)2deuo%U3Wn1Kq&MoBEbssIb)MmHZEYVPUGyY+bWx+X zQKAb8Q6fY{8zo3YjV`fc)PpFI7%dSY9At2`F?xv>-9(GQC?Pm{C*j?A&g41odtL9h z`CtFN?)$gywbuSH_nz6CTBgwFHTF8bVNy&sWnzz?lodYX)QgTWhAtvAR-0!;|BOs{ z|446jlp*Bg3$&w{7ZKj6HNn!xKs75C^I^xF-nBfuhCX)B|1s*d`3S!qmSt_KY{R+% z_&&_pY9+^x;Z+~^_|8<_;<_>B`VW#sYlOrXJw<6{Logi6>6ASmQYUy+^*tboo_!(UiGP6c#g2Y<)1VO z928IG?HSbm+~)kb*LPyM`^r#J?iE6i#j=(&V{MENZJ$HRf6V>3?%-M^&9GCp)e#WJ z8cwx@e0fBhBNP=>CgQD)4wzPXkF>WJ)jV-&7xPXHC>!_dRhaOLnAvj>l&kCH9(!Fd zegzxBX_OG|PMZO3dVw1t5~y>CK0-`3pXiVgrqRW+s?<`?9Q56-<$V(M`Nep*xN0UR zZv{-Q>R2*NIA^{Pdh*71&~2fiISSw-Z9TO5)w4qBjFA6$vE$X7^nMPzLGv#MuAk7! zMUHfeR)n9GXx$sH_j$^`m}*^DWR1*b_0(GDvzUMP6^J4mnbucRse0F!w^0`OOE}F& z{4lZ~d#I#hwycBse8XJHHmPElDdkgC$V?z0vpC|erqN>l_SIEs78{Piu?=b2qZe&j2IVXEvHP4Ibr-&M|%;=O~8VMyjn*!|4U z5iJJsVKWR0+qNepPV(yR`GyI<0$(^?ZHUOeczojTbtRY@w)pG<|CNeE z?h=SJvA)hv;S9U-9e+sAbAmMbWYWm5d_NbZMM(?mB(EDd>U}A_ zNkaZT>j=v&Hplc$EDRvLee#Tax?#XI>fPgs{fi&h*%%w1>oQv0APEiLSTV|A5DtjA zKx6;@-i6NEuYVFguGyTjUXM3Ft|MfPDp-H2auM-J&h&C>tjqFyVSQ0qjmy1_9n00X z`l)hkWFLAT?(jI4=Uevx=|c%&57hpCT{&SK3Zvcfic7M_NR?b200c)wHeJFQTVsS~ zP_j@VbuWAyYCQjdnO_xbL#cHtym!(UY7Dh0p@(*kOgk&SxWLj&lSHx9(#ciy^o_S9 zyC`fAT7Q$(rwM8K>oEb`RD9e_Q$4_0DOSTwsv}58wQjJ4fRIW*j!*REpiQ?(*G=8tAKO@ZT!RLGtM#V`Rz#iU)6^RCVRVMH_wN6It@r=HnDS*UTdY^Fg?{>nY-Y)Vk;*S%KYtrOEDDbk;@JOis>oXL+VANEJx&m*Z zMpm6lqwb>$CwSLBN|mv(w9b~eFa;+ztyrVoOk2xpM?k%U8FQ#&{;#f<$18kSOT;oj zY0)wY!#_WQ3`P!^6j|(PU#`AxOhcSs+7@$j;=PqYblohcBin`W`vAI`s;B!sTh3&< z*dcB^{8t~?6w!qVi2)}v4cv{JM~hu+wvi4}^?`qk-|nj~E)!VrrYH6M(cP?f-A~DL zzNDZo16St?%gP8QU%g&=Ly3?o;Ktee`%`o<{x=v zy)sj8p$FF2Z>Qagy!gzve^FW>k^Md`Mq6Q>pqkcM;Zk-0MGRo;U8<Qg5G8J0W5crK^^S$oiR@*nYA+l`xh!zDabw>n@Iy zA5t57=Z}FKS~V-nk|^im%hi>lcR_kF#`)jXCZ-o%A9D#Uq76)rR}39`y}HqX!tJJsou76avbSE$gOtnbt=Uv`tMl^>du$eRi1<^!a> zjMg-jnr35EV?Q89r_l4E_q*Ft=PxJ!09>F+p2V-AuuaOgptn6AaSwB5HYz+bfra)OY$14c9}dMFa-X+Iy_`1s6~`QayN_6 zqf?vcYdV8)z6{y4Y6S%R>98~1h}Raul3(2Z^0UiJKvLqTfT($cU-@u?T^crPa!dLC z^cg)=V!i&Z_E*lWVR=r*_dGXP>y3o}SW3{X(zpV{l~z1L%*+Bqpf zo%i6!4w7c07eB-tcM0i8{nd-hF-|lr(NJW*;ZaXsxu~w-u2l)UaNGLuuAmy7h4<6% zpUXn}MS(KhGIzM4KXK^AL0%!!4<1`^0>S!tf;(O|lB3Mdeh)A=9EBmaP#_>Y0!W>~KhJ3yrt)l)KSl118g??Asl#)4D1Yg|<2cZOn zGQDKp9U=S3uQM!uKG|u)fo-sk<1+t)@rOJ$J9f>wLF1od#j^`ZtP(Jgi@d&y7ItKj zGt9uSgMF+M5f?!5*GEVA;KU_?JlqkX-^dsjY}U3}%f04yM#BEsLAxJkN=#3OwH)}; zNA0zjZqh+R+8Ix}wli&SR!-`&Zp^v*6$sIf9c^6r1c9-@9QLh%^w1sm80Ym?OWLY& zsUtdq`V^!iGf7VmB&{(YHR@h~`RS=1uZIXg%B$Wm(@{;_Vv4_qDwnXQR1URws*xPU zE-~`oS-XdN6$dP(dr3TSAP<7>4LzwIH~H8zhg*$p+alsn$?40dEvHa1dNt!by#*wv zY;N8TxF+@H)l6KatK|2E)J-!7VZK(YC*yVnsZIrGp1VRqtM22BcahicA{kP3Z+V`K zSEf8(NPS$~VWJxyG*j7XBG6~zbR*Z;7|V$g&8-f|tv-uagm#r2>XII^NX&mt?>FQc zBeY%k{gb=B=~ntBJ*;n`bTV-(0Ato=IQB204o1wt!N2xz627UaZ}xMD&F53%Bf~Cl zhN~ZP3t`{N;E!xTk#iZnr2f2k@?6OuQ7}0AfZZ4@s@UXAm z47X88SatTpY6@dxjH$%LU+~4E(?PnYgGMNFgH8vD$^zghWu?Yjn(+n&T$0oe8C3ov ze#6ixrD>T<~-n6^XTY+z`6NUZs=L`jvfpz zw2umX9^LI72Rgv9<9`P~3zw(k_KwAi7kF(NJ060)uI#ndop2@VlO2|3Zhkp2-8}+J z{&2`3k-ej5gcmx6k66!vKKLDxvQmqBPs=C$1IT0(k9~$`Islo{@l5|u1YoD52YNc= zGpJ%6w|WrjoGC4EZdm5jf_q+dA)5V1onB~hHy)dY$8cFnw7}pAd*CnRTB78vZl<$$ zAoF$H^zl%#I~~YJr}F~Wk_(l~ftKw_0RA)Q;jg@?-2a>UESX+B_Q6>)i8u#WnB_m} zbirH}6D_*%sYR8&T<|M_{HWt5iqBm^5y#8?PN$#!W(g6xV!H$R@EimHNs>9x75L&0 z5Avdt@gNVtSxfy>9t(?j?6-e`oU1dC zvvu6q@gP265$q#?f0iST1MTy>2tqeW>{2MT5LBOO=7tA&QE_+>MG!<14`LRNt^OCt zxjF*@cf|-E#0msS!-Ev+xLKWp04O4~4_Fcxd`XHxkl#fZ;zbqVb61o6fu)j0FB+rA zLa@~!h%6oiJduI_0y$S_AmASPeI%7Zkl%YG572Q_#+PIVEQu2y1U$Suzbk^_MV+44 z^P>?6=03YmobAtIF6v@i4r?nOYw$KPE~wk;k``l@9y>y_JugQwxFJWiwQ=d2?)-|H zhg&umpL>ghfOr0#+ywp2bKeW}WkDZ$?#qDw;1+0ao!j1^eFL<0&TW%Z zdmFU3&uw4OHU(|7bKCpW-U02MQ(IKs{{})dWwP>pom*4d5o5HNr9_>ldJym(&PQJS zV~_-6!BjpXHtMyeG0;kx3l(=Rwl4X;8vdb+>9)H~zjXtw>lft>CW(~E#`ksbrer1N zXfa!fx^VR%>QK==33{u~u)xcqyTYUvt9F9bu}#}@q$@sDmDqM8Z|=~=msH=bv526P znnbH!6HKy97UgLACu6&CjFvz*WQ{6yg!{VQs-p*`n9~cth;A40;Zovh2FrfD_%I?k&YIr_SfpZcX9T>%9p9?9F9!y`(7I zAgRAoM=i~?xtDvWg@-3mt+a!6;<9{mavr)nPfUg03bfXKT{vBPY^ z`e24`%};GE{woi%t)7nCJ>AVM>vWX~TYBFukhnY9EY{Co`r8!RX-xk#31OQdufUx)6+qgb?Ki+Cq{Y%g!B-42n0e7iMoeDJVy~| dP=g;VvuS>?R;Lj_ND$p90y$DOGy!