From 7a867ea58d0cb26fe55be8fee0515453419ff26f Mon Sep 17 00:00:00 2001 From: nlepagnez Date: Sat, 2 Mar 2024 18:49:56 +0100 Subject: [PATCH 01/10] Version Update --- .../ESI-ExchangeAdminAuditLogEvents.json | 12 +- .../ESI-ExchangeOnPremisesCollector.json | 6 +- .../Solution_MicrosoftExchangeSecurity.json | 2 +- .../ReleaseNotes.md | 1 + .../ESI-ExchangeOnlineCollector.json | 6 +- ...SI_ExchangeOnlineCollector_Automation.json | 282 ++++++++++ ...crosoftExchangeSecurityExchangeOnline.json | 2 +- .../Parsers/MESCheckOnlineVIP.yaml | 25 + .../Parsers/MESCompareDataMRA.yaml | 186 +++++++ .../Parsers/MESOfficeActivityLogs.yaml | 62 +++ .../Parsers/README.md | 76 ++- .../ReleaseNotes.md | 1 + ...soft Exchange Admin Activity - Online.json | 514 ++++++++++++++++++ ...ge Least Privilege with RBAC - Online.json | 233 ++------ ...xchange Search AdminAuditLog - Online.json | 461 ++++++++++++++++ ...oft Exchange Security Review - Online.json | 395 +++++++++++++- ...osoftExchangeAdminActivity-OnlineBlack.png | Bin 0 -> 79242 bytes ...osoftExchangeAdminActivity-OnlineWhite.png | Bin 0 -> 79811 bytes ...ExchangeOnlineSearchAdminAuditLogBlack.png | Bin 0 -> 85845 bytes ...ExchangeOnlineSearchAdminAuditLogWhite.png | Bin 0 -> 84209 bytes Workbooks/WorkbooksMetadata.json | 44 +- 21 files changed, 2081 insertions(+), 227 deletions(-) create mode 100644 Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json create mode 100644 Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCheckOnlineVIP.yaml create mode 100644 Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCompareDataMRA.yaml create mode 100644 Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESOfficeActivityLogs.yaml create mode 100644 Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Admin Activity - Online.json create mode 100644 Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Search AdminAuditLog - Online.json create mode 100644 Workbooks/Images/Preview/MicrosoftExchangeAdminActivity-OnlineBlack.png create mode 100644 Workbooks/Images/Preview/MicrosoftExchangeAdminActivity-OnlineWhite.png create mode 100644 Workbooks/Images/Preview/MicrosoftExchangeOnlineSearchAdminAuditLogBlack.png create mode 100644 Workbooks/Images/Preview/MicrosoftExchangeOnlineSearchAdminAuditLogWhite.png diff --git a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeAdminAuditLogEvents.json b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeAdminAuditLogEvents.json index e273fc0aa6f..793c1269b7f 100644 --- a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeAdminAuditLogEvents.json +++ b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeAdminAuditLogEvents.json @@ -60,7 +60,15 @@ } ], "connectivityCriterias": [ - "SentinelKindsV2" + { + "type": "IsConnectedQuery", + "value": [ + "Event | where EventLog == 'MSExchange Management' | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", + "W3CIISLog | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", + "MessageTrackingLog_CL | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", + "ExchangeHttpProxy_CL | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)" + ] + } ], "availability": { "status": 1, @@ -685,7 +693,7 @@ ], "metadata": { "id": "5738bef7-b6c0-4fec-ba0b-ac728bef83a9", - "version": "2.1.0", + "version": "2.2.0", "kind": "dataConnector", "source": { "kind": "solution", diff --git a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeOnPremisesCollector.json b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeOnPremisesCollector.json index 41c788a9ca6..e0e77f3667a 100644 --- a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeOnPremisesCollector.json +++ b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeOnPremisesCollector.json @@ -19,14 +19,14 @@ "dataTypes": [ { "name": "ESIExchangeConfig_CL", - "lastDataReceivedQuery": "ESIExchangeConfig_CL | summarize Time = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" + "lastDataReceivedQuery": "ESIExchangeConfig_CL | summarize Time = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "ESIExchangeConfig_CL | summarize LastLogReceived = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" + "ESIExchangeConfig_CL | summarize LastLogReceived = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" ] } ], @@ -156,7 +156,7 @@ ], "metadata": { "id": "ed950fd7-e457-4a59-88f0-b9c949aa280d", - "version": "1.2.0", + "version": "1.2.1", "kind": "dataConnector", "source": { "kind": "solution", diff --git a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data/Solution_MicrosoftExchangeSecurity.json b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data/Solution_MicrosoftExchangeSecurity.json index 9d3fd138081..1dbc9c7c91f 100644 --- a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data/Solution_MicrosoftExchangeSecurity.json +++ b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data/Solution_MicrosoftExchangeSecurity.json @@ -28,7 +28,7 @@ "Watchlists/ExchangeVIP.json" ], "BasePath": "C:\\Git Repositories\\Azure-Sentinel\\Solutions\\Microsoft Exchange Security - Exchange On-Premises\\", - "Version": "3.1.1", + "Version": "3.1.2", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/Microsoft Exchange Security - Exchange On-Premises/ReleaseNotes.md b/Solutions/Microsoft Exchange Security - Exchange On-Premises/ReleaseNotes.md index 7af4337c69c..879e209f61b 100644 --- a/Solutions/Microsoft Exchange Security - Exchange On-Premises/ReleaseNotes.md +++ b/Solutions/Microsoft Exchange Security - Exchange On-Premises/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| +| 3.1.2 | 20-02-2024 | Correct DataConnector last Log indicator and IsConnected queries | | 3.1.1 | 18-12-2023 | Update Parsers parameters | | 3.1.0 | 01-11-2023 | Added **Watchlist** to track activities on VIPs' Mailboxes. Change ExchangeAuditLog parser to work without watchlist and searching all type of VIP information | | 3.0.1 | 13-09-2023 | Readme file for **Parsers** and typo correction | diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json index 2d2be503ce4..dfd6d612095 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json @@ -19,14 +19,14 @@ "dataTypes": [ { "name": "ESIExchangeOnlineConfig_CL", - "lastDataReceivedQuery": "ESIExchangeOnlineConfig_CL | summarize Time = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" + "lastDataReceivedQuery": "ESIExchangeOnlineConfig_CL | summarize Time = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "ESIExchangeOnlineConfig_CL | summarize LastLogReceived = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" + "ESIExchangeOnlineConfig_CL | summarize LastLogReceived = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" ] } ], @@ -203,7 +203,7 @@ ], "metadata": { "id": "fe7ccc48-e21b-4b90-b83e-9c8a6cb17d2f", - "version": "1.1.0", + "version": "1.1.1", "kind": "dataConnector", "source": { "kind": "solution", diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json new file mode 100644 index 00000000000..42785ee5707 --- /dev/null +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json @@ -0,0 +1,282 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "automationAccounts_ESI_DataCollector_name": { + "defaultValue": "ESI-DataCollector", + "type": "String" + }, + "automationAccounts_ESI_DataCollector_tenantName": { + "type": "String", + "metadata": { + "description": "Specifies the tenant name (don't put the GUID, only the name) that will be audited (Name of Azure AD Tenant where Automation Account is deployed)." + } + }, + "automationAccounts_ESI_DataCollector_WorkspaceID": { + "type": "String", + "defaultValue": "" + }, + "automationAccounts_ESI_DataCollector_WorkspaceKey": { + "type": "String", + "defaultValue": "" + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Specifies the location in which to create the workspace." + } + }, + "psModulesUri": { + "type": "string", + "defaultValue": "https://devopsgallerystorage.blob.core.windows.net/packages/", + "metadata": { + "description": "Default modules URI" + } + }, + "JobSchedulerGuid": { + "defaultValue": "[newGuid()]", + "type": "String", + "metadata": { + "description": "Enter new GUID, you can generate one from Powershell using new-guid or get one from this site: GUID Generator" + } + } + }, + "variables": { + "psModules": { + "PackageManagement": { + "name": "PackageManagement", + "url": "[uri(parameters('psModulesUri'),'packagemanagement.1.4.8.1.nupkg')]" + }, + "PowerShellGet": { + "name": "PowerShellGet", + "url": "[uri(parameters('psModulesUri'),'powershellget.2.2.5.nupkg')]" + }, + "ExchangeOnlineManagement": { + "name": "ExchangeOnlineManagement", + "url": "[uri(parameters('psModulesUri'),'exchangeonlinemanagement.3.0.0.nupkg')]" + }, + "MicrosoftGraphAuthentication": { + "name": "Microsoft.Graph.Authentication", + "url": "[uri(parameters('psModulesUri'),'microsoft.graph.authentication.1.19.0.nupkg')]" + }, + "MicrosoftGraphGroups": { + "name": "Microsoft.Graph.Groups", + "url": "[uri(parameters('psModulesUri'),'microsoft.graph.groups.1.19.0.nupkg')]" + }, + "MicrosoftGraphUsers": { + "name": "Microsoft.Graph.Users", + "url": "[uri(parameters('psModulesUri'),'microsoft.graph.users.1.19.0.nupkg')]" + } + }, + "ingestionScriptUri": "https://aka.ms/ESI-ExchangeCollector-RawScript", + "InitialConfiguration":"\"{\\n \\\"SolutionMetadata\\\":\\n{\\n\\\"JSonVersion\\\":\\\"2.0\\\",\\n\\\"JsonUpdateDate\\\":\\\"06/10/2022\\\",\\n\\\"Description\\\":\\\"Configuration File for CollectExchSecIns script\\\",\\n\\\"VersionInformation\\\":{\\n\\\"2.0\\\":{\\n\\\"Tracking\\\":[\\\"Adding Instance information, Add-on config files and Internet configuration\\\"],\\n\\\"MigrationMessageFromLastVersion\\\":\\\"Compare old file with new file as a lot of things changes. Especially the AuditFunctions part that is exported to external Add-Ons files.\\\"\\n},\\n\\\"1.3\\\":{\\n\\\"Tracking\\\":[\\\"Adding feature to export Domain information in Sentinel Table\\\"],\\n\\\"MigrationMessageFromLastVersion\\\":\\\"Adding entry 'ExportDomainsInformation' in Output\\\"\\n},\\n\\\"1.2\\\":{\\n\\\"Tracking\\\":[\\\"Correcting PartConfPerm in AuditFunctions : Correct Expression to avoid null error.\\\"],\\n\\\"MigrationMessageFromLastVersion\\\":\\\"Replace all the section 'AuditFunctions' with the new one\\\"\\n},\\n\\\"1.1\\\":{\\n\\\"Tracking\\\":[\\\"Correcting multiple entries in AuditFunctions : ExchangeServers, ETS, EWP, LocalAdmins,POPIMAPServicesStatus,ExchVersion\\\"],\\n\\\"MigrationMessageFromLastVersion\\\":\\\"Replace all the section 'AuditFunctions' with the new one\\\"\\n}\\n}\\n},\\n\\\"Global\\\":{\\n \\\"ParallelTimeoutMinutes\\\":5,\\n \\\"MaxParallelRunningJobs\\\":8,\\n \\\"GlobalParallelProcessing\\\":\\\"false\\\",\\n \\\"PerServerParallelProcessing\\\":\\\"false\\\",\\n \\\"DefaultDurationTracking\\\":30,\\n\\\"ESIProcessingType\\\":\\\"Online\\\",\\n\\\"EnvironmentIdentification\\\":\\\"#EnvironmentIdentity#\\\"\\n },\\n \\\"Output\\\":{\\n \\\"DefaultOutputFile\\\":\\\"C:\\\\\\\\ExchSecIns\\\\\\\\data\\\\\\\\ExchSecIns.csv\\\",\\n\\\"ExportDomainsInformation\\\":\\\"True\\\"\\n },\\n\\\"Advanced\\\":{\\n\\\"ParralelWaitRunning\\\":10,\\n\\\"ParralelPingWaitRunning\\\":10,\\n\\\"OnlyExplicitActivation\\\":\\\"false\\\",\\n\\\"ExchangeServerBinPath\\\":\\\"c:\\\\\\\\Program Files\\\\\\\\Microsoft\\\\\\\\Exchange Server\\\\\\\\V15\\\\\\\\bin\\\",\\n\\\"BypassServerAvailabilityTest\\\": \\\"false\\\",\\n\\\"ExplicitExchangeServerList\\\": [],\\n\\\"FunctionsListInline\\\":\\\"false\\\",\\n\\\"FunctionsListWithoutInternet\\\":\\\"false\\\",\\n\\\"Beta\\\":\\\"false\\\"\\n},\\n\\\"LogCollection\\\":{\\n\\\"ActivateLogUpdloadToSentinel\\\":\\\"true\\\",\\n\\\"WorkspaceId\\\":\\\"#WorkspaceID#\\\",\\n\\\"WorkspaceKey\\\":\\\"#WorkspaceKey#\\\",\\n\\\"LogTypeName\\\":\\\"ESIExchangeOnlineConfig\\\",\\n\\\"TogetherMode\\\":\\\"false\\\"\\n},\\n\\\"MGGraphAPIConnection\\\":{\\n\\\"MGGraphAzureRMCertificate\\\":\\\"\\\",\\n\\\"MGGraphAzureRMAppId\\\":\\\"\\\"\\n},\\n\\\"InstanceConfiguration\\\":{\\n\\\"Default\\\":{\\n\\\"All\\\":\\\"true\\\",\\n\\\"Capabilities\\\":\\\"OP|OL|MGGRAPH|ADINFOS\\\"\\n},\\n\\\"IIS-IoCs\\\":{\\n\\\"All\\\":\\\"true\\\",\\n\\\"Category\\\":\\\"IIS-IoCs\\\",\\n\\\"Capabilities\\\":\\\"IIS\\\",\\n\\\"OutputName\\\":\\\"ESIIISIoCs\\\"\\n},\\n\\\"InstanceExample\\\":\\n{\\n\\\"SelectedAddons\\\":[\\\"Filename1\\\", \\\"Filename2\\\"],\\n\\\"FileteredAddons\\\":[\\\"Filename1\\\", \\\"Filename2\\\"]\\n}\\n},\\n\\\"AuditFunctionsFiles\\\":[\\n{\\n\\\"Filename\\\":\\\"FiletoIgnore\\\",\\n\\\"Deactivated\\\":\\\"false\\\"\\n}\\n],\\n\\\"AuditFunctionProtectedArea\\\":\\n{\\n\\\"ContentCheckSum\\\":\\\"\\\"\\n},\\n\\\"AuditFunctions\\\":[\\n]\\n}\"", + "DestinationConfiguration":"[replace(replace(replace(variables('InitialConfiguration'),'#WorkspaceKey#',parameters('automationAccounts_ESI_DataCollector_WorkspaceKey')),'#WorkspaceID#',parameters('automationAccounts_ESI_DataCollector_WorkspaceID')),'#EnvironmentIdentity#',parameters('automationAccounts_ESI_DataCollector_tenantName'))]" + }, + "resources": [ + { + "type": "Microsoft.Automation/automationAccounts", + "apiVersion": "2021-06-22", + "name": "[parameters('automationAccounts_ESI_DataCollector_name')]", + "location": "[parameters('location')]", + "identity": { + "type": "SystemAssigned" + }, + "properties": { + "publicNetworkAccess": false, + "disableLocalAuth": false, + "sku": { + "name": "Basic" + }, + "encryption": { + "keySource": "Microsoft.Automation", + "identity": {} + } + } + }, + { + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/PackageManagement')]", + "type": "Microsoft.Automation/automationAccounts/modules", + "apiVersion": "2015-10-31", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccounts_ESI_DataCollector_name'))]" + ], + "tags": {}, + "copy":{ + "name": "Level1ModulesInstall", + "count": 1, + "mode": "Serial", + "batchSize": 1 + }, + "properties":{ + "contentLink": { + "uri": "[variables('psModules').PackageManagement.url]" + } + } + }, + { + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/PowerShellGet')]", + "type": "Microsoft.Automation/automationAccounts/modules", + "apiVersion": "2015-10-31", + "location": "[parameters('location')]", + "dependsOn": [ + "Level1ModulesInstall" + ], + "tags": {}, + "copy": { + "name": "Level0ModulesInstall", + "count": 1, + "mode": "Serial", + "batchSize": 1 + }, + "properties": { + "contentLink": { + "uri": "[variables('psModules').PowerShellGet.url]" + } + } + }, + { + "type": "Microsoft.Automation/automationAccounts/modules", + "apiVersion": "2020-01-13-preview", + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/ExchangeOnlineManagement')]", + "dependsOn": [ + "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccounts_ESI_DataCollector_name'))]" + ], + "properties": { + "contentLink": { + "uri": "[variables('psModules').ExchangeOnlineManagement.url]" + } + } + }, + { + "type": "Microsoft.Automation/automationAccounts/modules", + "apiVersion": "2020-01-13-preview", + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/Microsoft.Graph.Authentication')]", + "dependsOn": [ + "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccounts_ESI_DataCollector_name'))]" + ], + "properties": { + "contentLink": { + "uri": "[variables('psModules').MicrosoftGraphAuthentication.url]" + } + } + }, + { + "type": "Microsoft.Automation/automationAccounts/modules", + "apiVersion": "2020-01-13-preview", + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/Microsoft.Graph.Groups')]", + "dependsOn": [ + "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccounts_ESI_DataCollector_name'))]", + "[resourceId('Microsoft.Automation/automationAccounts/modules', parameters('automationAccounts_ESI_DataCollector_name'), 'Microsoft.Graph.Authentication')]" + ], + "properties": { + "contentLink": { + "uri": "[variables('psModules').MicrosoftGraphGroups.url]" + } + } + }, + { + "type": "Microsoft.Automation/automationAccounts/modules", + "apiVersion": "2020-01-13-preview", + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/Microsoft.Graph.Users')]", + "dependsOn": [ + "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccounts_ESI_DataCollector_name'))]", + "[resourceId('Microsoft.Automation/automationAccounts/modules', parameters('automationAccounts_ESI_DataCollector_name'), 'Microsoft.Graph.Authentication')]" + ], + "properties": { + "contentLink": { + "uri": "[variables('psModules').MicrosoftGraphUsers.url]" + } + } + }, + { + "type": "Microsoft.Automation/automationAccounts/runbooks", + "apiVersion": "2019-06-01", + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/Start-ESICollector')]", + "location": "[parameters('location')]", + "dependsOn": [ + "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccounts_ESI_DataCollector_name'))]" + ], + "properties": { + "runbookType": "PowerShell", + "logVerbose": true, + "logProgress": true, + "logActivityTrace": 9, + "publishContentLink": { + "uri": "[variables('ingestionScriptUri')]", + "version": "1.0" + } + } + }, + { + "type": "Microsoft.Automation/automationAccounts/schedules", + "apiVersion": "2020-01-13-preview", + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/ESIConfig-Each-day')]", + "dependsOn": [ + "[resourceId('Microsoft.Automation/automationAccounts/runbooks/', parameters('automationAccounts_ESI_DataCollector_name'), 'Start-ESICollector')]", + "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccounts_ESI_DataCollector_name'))]" + ], + "properties": { + "interval": 1, + "isEnabled": "true", + "frequency": "Day" + } + }, + { + "type": "Microsoft.Automation/automationAccounts/jobSchedules", + "apiVersion": "2021-04-01", + "location": "[parameters('location')]", + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/', parameters('JobSchedulerGuid'))]", + "dependsOn": [ + "[resourceId('Microsoft.Automation/automationAccounts/runbooks/', parameters('automationAccounts_ESI_DataCollector_name'), 'Start-ESICollector')]", + "[resourceId('Microsoft.Automation/automationAccounts/schedules/', parameters('automationAccounts_ESI_DataCollector_name'), 'ESIConfig-Each-day')]", + "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccounts_ESI_DataCollector_name'))]" + ], + "properties": { + "runbook": { + "name": "Start-ESICollector" + }, + "schedule": { + "name": "ESIConfig-Each-day" + } + } + }, + { + "type": "Microsoft.Automation/automationAccounts/variables", + "apiVersion": "2020-01-13-preview", + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/GlobalConfiguration')]", + "dependsOn": [ + "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccounts_ESI_DataCollector_name'))]" + ], + "properties": { + "isEncrypted": false, + "value": "[variables('DestinationConfiguration')]" + } + }, + { + "type": "Microsoft.Automation/automationAccounts/variables", + "apiVersion": "2020-01-13-preview", + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/TenantName')]", + "dependsOn": [ + "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccounts_ESI_DataCollector_name'))]" + ], + "properties": { + "isEncrypted": false, + "value": "[concat('\"',parameters('automationAccounts_ESI_DataCollector_tenantName'),'\"')]" + } + }, + { + "type": "Microsoft.Automation/automationAccounts/variables", + "apiVersion": "2020-01-13-preview", + "name": "[concat(parameters('automationAccounts_ESI_DataCollector_name'), '/LastDateTracking')]", + "dependsOn": [ + "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccounts_ESI_DataCollector_name'))]" + ], + "properties": { + "isEncrypted": false, + "value": "\"Never\"" + } + } + ] +} \ No newline at end of file diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Data/Solution_MicrosoftExchangeSecurityExchangeOnline.json b/Solutions/Microsoft Exchange Security - Exchange Online/Data/Solution_MicrosoftExchangeSecurityExchangeOnline.json index dd32c748709..9afe2568311 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Data/Solution_MicrosoftExchangeSecurityExchangeOnline.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Data/Solution_MicrosoftExchangeSecurityExchangeOnline.json @@ -21,7 +21,7 @@ ], "WatchlistDescription": "ExchangeVIP Watchlist contains a list of VIP users that are allowed to perform privileged operations on Exchange Servers. This watchlist is used by the ServerOrientedWithUserOrientedAdministration rule to detect suspicious activity by VIP users.", "BasePath": "C:\\Git Repositories\\Azure-Sentinel\\Solutions\\Microsoft Exchange Security - Exchange Online", - "Version": "3.0.4", + "Version": "3.0.5", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCheckOnlineVIP.yaml b/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCheckOnlineVIP.yaml new file mode 100644 index 00000000000..8bf5f86c411 --- /dev/null +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCheckOnlineVIP.yaml @@ -0,0 +1,25 @@ +id: 9b864a03-5db6-4cf0-aef1-17ac0cc34195 +Function: + Title: Parser for VIP Check for Exchange Online + Version: '1.0.0' + LastUpdated: '2024-02-25' +Category: Microsoft Sentinel Parser +FunctionName: MESCheckOnlineVIP +FunctionAlias: MESCheckOnlineVIP +FunctionParams: + - Name: UserToCheck + Type: string + Description: The user to verifiy if is a VIP or not. Default value is "all". + DefaultValue: 'All' +FunctionQuery: | + //let UserToCheck = "SampleEntry"; + let _UserToCheck = iif(UserToCheck == "" or UserToCheck == "All","All",tolower(UserToCheck)); + let fuzzyWatchlist = datatable(DisplayName:string, sAMAccountName:string, userPrincipalName:string) [ + "NONE","NONE","NONE"]; + let Watchlist = union isfuzzy=true withsource=TableName _GetWatchlist('ExchOnlineVIP'), fuzzyWatchlist | project-away TableName; + let SearchUser = Watchlist | where _UserToCheck =~ DisplayName + or _UserToCheck =~ userPrincipalName + or _UserToCheck =~ sAMAccountName + or _UserToCheck == "All" + | extend ValueChecked = iif(_UserToCheck=="All",strcat("#",DisplayName,"#",userPrincipalName,"#",sAMAccountName),_UserToCheck); + SearchUser \ No newline at end of file diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCompareDataMRA.yaml b/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCompareDataMRA.yaml new file mode 100644 index 00000000000..e8e3c61fe4c --- /dev/null +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCompareDataMRA.yaml @@ -0,0 +1,186 @@ +id: 39f51672-8c63-4600-882a-5db8275f798f +Function: + Title: Parser for MRA Configuration Data Comparison + Version: '1.0.0' + LastUpdated: '2024-02-25' +Category: Microsoft Sentinel Parser +FunctionName: MESCompareDataMRA +FunctionAlias: MESCompareDataMRA +FunctionParams: + - Name: SectionCompare + Type: string + Description: The user to verifiy if is a VIP or not. Default value is "all". + DefaultValue: '' + - Name: DateCompare + Type: string + Description: The user to verifiy if is a VIP or not. Default value is "all". + DefaultValue: 'lastdate' + - Name: CurrentDate + Type: string + Description: The user to verifiy if is a VIP or not. Default value is "all". + DefaultValue: 'lastdate' + - Name: EnvList + Type: string + Description: The user to verifiy if is a VIP or not. Default value is "all". + DefaultValue: 'All' + - Name: TypeEnv + Type: string + Description: The user to verifiy if is a VIP or not. Default value is "all". + DefaultValue: 'Online' + - Name: CurrentRole + Type: string + Description: The user to verifiy if is a VIP or not. Default value is "all". + DefaultValue: '' + - Name: ExclusionsAcct + Type: dynamic + Description: The user to verifiy if is a VIP or not. Default value is "all". + DefaultValue: dynamic('') +FunctionQuery: | + // Version: 1.0.0 + // Last Updated: 25/02/2024 + // + // DESCRIPTION: + // This parser is used to compare the data of a specific section of the Exchange Online Configuration. It will compare the data of a specific section between two dates and return the differences between them. + // + // USAGE: + // Parameters : 7 parameters to add during creation. + // 1. SectionCompare, type string, default value "" + // 2. DateCompare, type string, default value "lastdate" + // 3. CurrentDate, type string, default value "lastdate" + // 4. EnvList, type string, default value "All" + // 5. TypeEnv, type string, default value "Online" + // 6. CurrentRole, type string, default value "" + // 7. ExclusionsAcct, type dynamic, default value dynamic("") + // + // Parameters simulation + // If you need to test the parser execution without saving it as a function, uncomment the bellow variable to simulate parameters values. + // + // let SectionCompare = "SampleEntry"; + // let EnvList = "All"; + // let TypeEnv = "Online"; + // let CurrentRole = ""; + // let ExclusionsAcct = dynamic(""); + // let DateCompare = "lastdate"; + // let CurrentDate = "lastdate"; + // + // Parameters definition + let _SectionCompare = SectionCompare; + let _EnvList =EnvList; + let _TypeEnv = TypeEnv; + let _CurrentRole =CurrentRole; + let _ExclusionsAcct = ExclusionsAcct; + let _DateCompare = DateCompare; + let _CurrentDate = CurrentDate; + let _DateCompareB = todatetime(DateCompare); + let _currD = (ExchangeConfiguration(SpecificSectionList=_SectionCompare,SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv) + | summarize TimeMax = max(TimeGenerated) + | extend TimeMax = tostring(split(TimeMax,"T")[0]) + | project TimeMax); + let _CurrentDateB = todatetime(toscalar(_currD)); + let BeforeData = + ExchangeConfiguration(SpecificSectionList=_SectionCompare,SpecificConfigurationDate=_DateCompare,SpecificConfigurationEnv=_EnvList,Target=_TypeEnv) + | where CmdletResultValue.Role contains _CurrentRole + and CmdletResultValue.RoleAssigneeName !in (_ExclusionsAcct) + and CmdletResultValue.Name !contains "Deleg" + | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName) + | extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType == "User", "User", "RoleGroup") + | extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope) + | extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope) + | extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope) + | extend RecipientWriteScope = tostring(CmdletResultValue.RecipientWriteScope) + | extend ConfigWriteScope = tostring(CmdletResultValue.ConfigWriteScope) + | extend ManagementRoleAssignement = tostring(CmdletResultValue.Name) + | extend Status= tostring(CmdletResultValue.Enabled) + | extend RoleAssignmentDelegationType = iff(CmdletResultValue.RoleAssignmentDelegationType == "6", "Delegating", "Regular") + | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName) + | extend Role = tostring(CmdletResultValue.Role) + | extend RoleAssignmentDelegationType = tostring(CmdletResultValue.RoleAssignmentDelegationType) + ; + let AfterData = + ExchangeConfiguration(SpecificSectionList=_SectionCompare,SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv) + | where CmdletResultValue.Role contains _CurrentRole + and CmdletResultValue.RoleAssigneeName !in (_ExclusionsAcct) + and CmdletResultValue.Name !contains "Deleg" + | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName) + | extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType == "User", "User", "RoleGroup") + | extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope) + | extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope) + | extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope) + | extend RecipientWriteScope = tostring(CmdletResultValue.RecipientWriteScope) + | extend ConfigWriteScope = tostring(CmdletResultValue.ConfigWriteScope) + | extend ManagementRoleAssignement = tostring(CmdletResultValue.Name) + | extend Status= tostring(CmdletResultValue.Enabled) + | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName) + | extend Role = tostring(CmdletResultValue.Role) + | extend RoleAssignmentDelegationType = tostring(CmdletResultValue.RoleAssignmentDelegationType) + ; + let i=0; + let allDataRange = + ESIExchangeOnlineConfig_CL + | where TimeGenerated between (_DateCompareB .. _CurrentDateB) + | where ESIEnvironment_s == _EnvList + | where Section_s == "MRA" + | extend CmdletResultValue = parse_json(rawData_s) + | project TimeGenerated,CmdletResultValue,WhenChanged = WhenChanged_t, WhenCreated=WhenCreated_t + | where CmdletResultValue.Role contains _CurrentRole + and CmdletResultValue.RoleAssigneeName !in (_ExclusionsAcct) + and CmdletResultValue.Name !contains "Deleg" + | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName) + | extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType == "User", "User", "RoleGroup") + | extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope) + | extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope) + | extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope) + | extend RecipientWriteScope = tostring(CmdletResultValue.RecipientWriteScope) + | extend ConfigWriteScope = tostring(CmdletResultValue.ConfigWriteScope) + | extend ManagementRoleAssignement = tostring(CmdletResultValue.Name) + | extend Status= tostring(CmdletResultValue.Enabled) + | extend Role = tostring(CmdletResultValue.Role) + | extend RoleAssignmentDelegationType = tostring(CmdletResultValue.RoleAssignmentDelegationType) + ; + let DiffAddDataP1 = allDataRange + | join kind = rightanti (AfterData | where WhenCreated >=_DateCompareB) on WhenCreated + ; + let DiffAddDataP2 = allDataRange + | join kind = innerunique (allDataRange ) on WhenCreated + | where WhenCreated >=_DateCompareB + | where bin(WhenCreated,5m)==bin(WhenChanged,5m) + | distinct ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated + ; + let DiffAddData = union DiffAddDataP1,DiffAddDataP2 + | extend Actiontype ="Add"; + let DiffRemoveData = allDataRange + | join kind = leftanti AfterData on RoleAssigneeName + | extend Actiontype ="Remove" + | distinct Actiontype,ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated + | project WhenChanged=_CurrentDateB,Actiontype,ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated + ; + let DiffModifData = union AfterData,allDataRange + | sort by ManagementRoleAssignement,WhenChanged asc + | extend Status = iff( ManagementRoleAssignement == prev(ManagementRoleAssignement) and Status != prev(Status) and prev(Status) !="" , strcat("πŸ“ ", Status, " (",prev(Status),"->", Status," )"),Status) + | extend CustomRecipientWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and CustomRecipientWriteScope != prev(CustomRecipientWriteScope) and prev(CustomRecipientWriteScope) !="" , strcat("πŸ“ ", CustomRecipientWriteScope, " (", prev(CustomRecipientWriteScope),"->", CustomRecipientWriteScope, ")"),CustomRecipientWriteScope) + | extend CustomConfigWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and CustomConfigWriteScope != prev(CustomConfigWriteScope) and prev(CustomConfigWriteScope) !="" , strcat("πŸ“ ", CustomConfigWriteScope, " (", prev(CustomConfigWriteScope),"->", CustomConfigWriteScope, ")"),CustomConfigWriteScope) + | extend RecipientWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and RecipientWriteScope != prev(RecipientWriteScope) and prev(RecipientWriteScope) !="" , strcat("πŸ“ ", RecipientWriteScope, " (", prev(RecipientWriteScope),"->", RecipientWriteScope, ")"),RecipientWriteScope) + | extend ConfigWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and ConfigWriteScope != prev(ConfigWriteScope) and prev(ConfigWriteScope) !="" , strcat("πŸ“ ", ConfigWriteScope, " (", prev(ConfigWriteScope),"->", ConfigWriteScope, ")"),ConfigWriteScope) + | extend ActiontypeR =iff((Status contains "πŸ“" or CustomRecipientWriteScope contains"πŸ“" or CustomConfigWriteScope contains"πŸ“" or RecipientWriteScope contains"πŸ“" or ConfigWriteScope contains"πŸ“" ), i=i + 1, i) + | extend Actiontype =iff(ActiontypeR > 0, "Modif", "NO") + | where ActiontypeR == 1 + | project WhenChanged,Actiontype,ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated + ; + union DiffAddData, DiffRemoveData, DiffModifData + | extend RoleAssigneeName = iff(RoleAssigneeType == "User", strcat("πŸ§‘β€πŸ¦° ", RoleAssigneeName), strcat("πŸ‘ͺ ", RoleAssigneeName)) + | extend WhenChanged = iff (Actiontype == "Modif", WhenChanged, iff(Actiontype == "Add",WhenCreated, WhenChanged)) + | extend Actiontype = case(Actiontype == "Add", strcat("βž• ", Actiontype), Actiontype == "Remove", strcat("βž– ", Actiontype), Actiontype == "Modif", strcat("πŸ“ ", Actiontype), "N/A") + | sort by WhenChanged desc + | project + WhenChanged, + Actiontype, + RoleAssigneeName, + RoleAssigneeType, + Status, + CustomRecipientWriteScope, + CustomConfigWriteScope, + RecipientWriteScope, + ConfigWriteScope, + ManagementRoleAssignement, + RoleAssignmentDelegationType, + WhenCreated \ No newline at end of file diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESOfficeActivityLogs.yaml b/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESOfficeActivityLogs.yaml new file mode 100644 index 00000000000..4fb34167e7e --- /dev/null +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESOfficeActivityLogs.yaml @@ -0,0 +1,62 @@ +id: 2be516a9-f8fd-4357-a839-cafcb5a6d73a +Function: + Title: Parser for Office Activity Logs + Version: '1.0.0' + LastUpdated: '2024-02-25' +Category: Microsoft Sentinel Parser +FunctionName: MESOfficeActivityLogs +FunctionAlias: MESOfficeActivityLogs +FunctionQuery: | + // Version: 1.0.0 + // Last Updated: 25/02/2024 + // + // DESCRIPTION: + // This parser is used to compare the data of a specific section of the Exchange Online Configuration. It will compare the data of a specific section between two dates and return the differences between them. + // + let CmdletCheck = externaldata (Cmdlet:string, UserOriented:string, RestrictToParameter:string, Parameters:string)[h"https://aka.ms/CmdletWatchlist"]with(format="csv",ignoreFirstRecord=true); + let SensitiveCmdlets = CmdletCheck | project tostring(Cmdlet) ; + let Check = (T:(*)) { + let fuzzyWatchlist = datatable(DisplayName:string, sAMAccountName:string, userPrincipalName:string) [ + "NONE","NONE","NONE"]; + let Watchlist = union isfuzzy=true withsource=TableName _GetWatchlist('ExchOnlineVIP'), fuzzyWatchlist | project-away TableName; + let SearchUserDisplayName = T | join Watchlist on $left.TargetObject == $right.DisplayName | project TargetObject,SearchKey; + let SearchUserSAMAccountName = T | join Watchlist on $left.TargetObject == $right.sAMAccountName | project TargetObject,SearchKey; + let SearchUserUPN = T | join Watchlist on $left.TargetObject == $right.userPrincipalName | project TargetObject,SearchKey; + union isfuzzy=true withsource=TableName + SearchUserDisplayName, + SearchUserSAMAccountName, + SearchUserUPN + }; + let EventList = OfficeActivity + | where RecordType == "ExchangeAdmin" + | where UserType <> "DcAdmin" and UserKey !contains "NT AUTHORITY" + | extend CmdletName = Operation + | extend Param = replace_string(replace_string((replace_string(Parameters,'[{"Name":"','-')),'","Value":"',' : '),'"},{"Name":"',', -') + // | extend Param = replace_string((replace_string(Parameters,'","Value":"',' : ')),'"},{"Name":"',' -') + | extend Param = replace_string((replace_string(Param,'"},{"',' ; ')),'"}]','') + | extend Param = replace_string(Param,'\\\\','\\') + | extend TargetObject = tostring(split(split(Param,"-Identity : ")[1],' -')[0]) + | extend TargetObject = replace_string(TargetObject,',','') + | extend TargetObject = iff(TargetObject=="",TargetObject="N/A",TargetObject); + let Office_Activity = (){ + EventList + | join kind=leftouter (EventList | project TargetObject | invoke Check()) on TargetObject + | extend IsVIP = iif(SearchKey == "", false, true) + | join kind=leftouter ( + MESCheckOnlineVIP() ) on SearchKey + | extend CmdletNameJoin = tolower(CmdletName) + | join kind=leftouter ( + CmdletCheck + | extend CmdletNameJoin = tolower(Cmdlet) + ) on CmdletNameJoin + | extend Caller = UserId + | extend CmdletParameters = Param + | extend IsSenstiveCmdlet = iif( isnotempty(CmdletNameJoin1) , true, false) + | extend IsRestrictedCmdLet = iif(IsSenstiveCmdlet == true, iif( RestrictToParameter == "Yes", true, false), dynamic(null)) + | extend RestrictedParameters = iif(IsSenstiveCmdlet == true, split(tolower(Parameters1),';'), dynamic(null)) + | extend ExtractedParameters = iif(IsSenstiveCmdlet == true,extract_all(@"\B(-\w+)", tolower(CmdletParameters)), dynamic(null)) + | extend IsSenstiveCmdletParameters = iif(IsSenstiveCmdlet == true,iif( array_length(set_difference(ExtractedParameters,RestrictedParameters)) == array_length(ExtractedParameters), false, true ) , false) + | extend IsSensitive = iif( ( IsSenstiveCmdlet == true and IsRestrictedCmdLet == false ) or (IsSenstiveCmdlet == true and IsRestrictedCmdLet == true and IsSenstiveCmdletParameters == true ), true, false ) + | project TimeGenerated,Caller,TargetObject,IsVIP,userPrincipalName,CmdletName,CmdletParameters,IsSenstiveCmdlet,IsRestrictedCmdLet,ExtractedParameters,RestrictedParameters,IsSenstiveCmdletParameters,IsSensitive,UserOriented + }; + Office_Activity \ No newline at end of file diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/README.md b/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/README.md index cd777082513..46169e80260 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/README.md +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/README.md @@ -22,6 +22,15 @@ Parsers are created [using functions in Azure monitor log queries](https://docs. - [Parser Description](#parser-description-2) - [Parser dependency](#parser-dependency) - [Parser Setup](#parser-setup-2) + - [Parameters simulation](#parameters-simulation-2) + - [Microsoft Exchange Compare Data MRA Parser](#microsoft-exchange-compare-data-mra-parser) + - [Parser Definition](#parser-definition-3) + - [Parser Description](#parser-description-3) + - [Parser Setup](#parser-setup-3) + - [Microsoft Exchange Security - Office 365 Activity logs Parser](#microsoft-exchange-security---office-365-activity-logs-parser) + - [Parser Definition](#parser-definition-4) + - [Parser Description](#parser-description-4) + - [Parser Setup](#parser-setup-4) ## ExchangeConfiguration Parser @@ -144,4 +153,69 @@ This parser is linked to "ExchangeVIP" whatchlist > >1 parameter to add during creation : UserToCheck, type string, default value "All" - 1. Function App usually take 10-15 minutes to activate. You can then use Function Alias for other queries \ No newline at end of file + 1. Function App usually take 10-15 minutes to activate. You can then use Function Alias for other queries + +### Parameters simulation + +If you need to test the parser execution without saving it as a function, add the bellow variable to simulate parameters values at the beginning. + +## Microsoft Exchange Compare Data MRA Parser + +### Parser Definition + +- Title: Microsoft Exchange Compare Data MRA Parser +- Version: 1.0.0 +- Last Updated: 25/02/2024 +- Description: This parser compare data from MRA and ESI Exchange Collector to find differences + +|**Version** |**Details** | +|---------|-----------------------------------------------------------------------------------------------------------------------| +|v1.0 |
  • Function initilisation for Sentinel Solution
| + +### Parser Description + +This parser compare data from MRA and ESI Exchange Collector to find differences + +### Parser Setup + + 1. Open Log Analytics/Microsoft Sentinel Logs blade. Copy the query below and paste into the Logs query window. + 2. Click the Save button above the query. A pane will appear on the right, select "as Function" from the drop down. Enter the Function Name "MESCompareDataMRA". + 3. Function App usually take 10-15 minutes to activate. You can then use Function Alias for other queries + 4. This parser is linked to "MRA" and "ESI Exchange Collector" tables + +>#### **Parameters:** + +>7 parameter to add during creation : +> +> 1. SectionCompare, type string, default value "" +> 2. DateCompare, type string, default value "lastdate" +> 3. CurrentDate, type string, default value "lastdate" +> 4. EnvList, type string, default value "All" +> 5. TypeEnv, type string, default value "Online" +> 6. CurrentRole, type string, default value "" +> 7. ExclusionsAcct, type dynamic, default value dynamic("") + +## Microsoft Exchange Security - Office 365 Activity logs Parser + +### Parser Definition + +- Title: Microsoft Exchange Security - Office 365 Activity logs Parser +- Version: 1.0.0 +- Last Updated: 25/02/2024 +- Description: This parser is used to parse Office 365 Activity logs +- Dependencies: This parser is linked to "OfficeActivity" table + +|**Version** |**Details** | +|---------|-----------------------------------------------------------------------------------------------------------------------| +|v1.0 |
  • Function initilisation for Sentinel Solution
| + +### Parser Description + +This parser is used to parse Office 365 Activity logs + +### Parser Setup + + 1. Open Log Analytics/Microsoft Sentinel Logs blade. Copy the query below and paste into the Logs query window. + 2. Click the Save button above the query. A pane will appear on the right, select "as Function" from the drop down. Enter the Function Name "MESOfficeActivity". + 3. Function App usually take 10-15 minutes to activate. You can then use Function Alias for other queries + 4. This parser is linked to "OfficeActivity" table diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/ReleaseNotes.md b/Solutions/Microsoft Exchange Security - Exchange Online/ReleaseNotes.md index 923bcbc578e..1be8fb867c8 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/ReleaseNotes.md +++ b/Solutions/Microsoft Exchange Security - Exchange Online/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| +| 3.0.5 | 20-02-2024 | Correct DataConnector last Log indicator | | 3.0.4 | 18-12-2023 | Correct Parser parameters and force version update | | 3.0.3 | 05-12-2023 | Added parameters in **Parser** to fix default values issue. | | 3.0.2 | 01-11-2023 | Added a **Parser** to verify if user is Microsoft Exchange Security VIP (Watchlist) | diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Admin Activity - Online.json b/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Admin Activity - Online.json new file mode 100644 index 00000000000..bfbc47e7b8b --- /dev/null +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Admin Activity - Online.json @@ -0,0 +1,514 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# Microsoft Exchange Admin Activity\r\n\r\nThis workbook helps you visualize what is happening in your Exchange environment.\r\nResults removed :\r\n\t- All Test-* and Set-AdServerSetting Cmdlets\r\n\r\n**Selection of an environment is unavailable. As this workbook is based on the OfficeActivity Logs (Microsoft 365 Solution) directly linked to the Microsoft Sentinel Environment, we cannot provide a view of another one.**" + }, + "name": "text - 2" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "3792117c-d924-4ec7-a327-1e8d5e9f291a", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "value": { + "durationMs": 14400000 + } + }, + { + "id": "743317e2-ebcf-4958-861d-4ff97fc7cce1", + "version": "KqlParameterItem/1.0", + "name": "EnvironmentList", + "label": "Environment", + "type": 2, + "query": "OfficeActivity | where TimeGenerated {TimeRange}\r\n| summarize by OrganizationName", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + }, + { + "id": "8ac96eb3-918b-4a36-bcc4-df50d8f46175", + "version": "KqlParameterItem/1.0", + "name": "Help", + "label": "Show Help", + "type": 10, + "isRequired": true, + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\\r\\n\",\"transformers\":null}", + "typeSettings": { + "additionalResourceOptions": [] + }, + "timeContext": { + "durationMs": 2592000000 + }, + "queryType": 8 + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "TimeRange" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "id": "34188faf-7a02-4697-9b36-2afa986afc0f", + "cellValue": "selected", + "linkTarget": "parameter", + "linkLabel": "Cmdlet Analysis", + "subTarget": "Cmdlet", + "postText": "t", + "style": "link", + "icon": "3", + "linkIsContextBlade": true + } + ] + }, + "name": "links - 1" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "Cmdlet summary", + "items": [ + { + "type": 1, + "content": { + "json": "This tab parses the events from OfficeActivity logs :\r\n\r\n- list of cmdlets\r\n- filter on a VIP and/or Sensitive objects (based on Watchlist \"Exchange VIP\" and \" Monitored Exchange Cmdlets\")\r\n- anomalies detections are based on the KQL function series_decompose_anomalies", + "style": "info" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "Yes" + }, + "name": "CmdletGroupHelp" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5a942eba-c991-4b84-9a94-c153bca86e12", + "version": "KqlParameterItem/1.0", + "name": "VIPOnly", + "label": "Show VIP Only", + "type": 10, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\": \"True\", \"label\": \"Yes\"},\r\n { \"value\": \"True,False\", \"label\": \"No\", \"selected\":true }\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "83befa26-eee0-49ab-9785-72653943bc6b", + "version": "KqlParameterItem/1.0", + "name": "SensitiveOnly", + "label": "Sensitive CmdLet Only", + "type": 10, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\": \"True\", \"label\": \"Yes\" },\r\n { \"value\": \"True,False\", \"label\": \"No\", \"selected\":true }\r\n]\r\n", + "timeContext": { + "durationMs": 86400000 + } + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 0" + }, + { + "type": 1, + "content": { + "json": "This section show all the Cmdlets executed in the selected time range. Possible filters are: \r\n- **VIP Only selected** Cmdlets used against VIP objects (based on the \"Exchange VIP\" watchlist)\r\n- **Sensitive Cmdlets** Cmdlets considered as Sensitive (based on the \"Monitored Exchange Cmdlets\" watchlist)\r\n\r\nThese informations can be useful to detect unexpected behaviors or to determine what are the action performed by the accounts (ie. service accounts).\r\n\r\nℹ️ It is recommended to delegated only the necessary privileges to an account.", + "style": "info" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "Yes" + }, + "name": "CmdtListHelp" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| summarize count() by CmdletName\r\n| sort by count_", + "size": 2, + "showAnalytics": true, + "title": "List of all executed cmdlets during the last 90 days (based on Sentinel retention)", + "exportFieldName": "Cmdlet", + "exportParameterName": "CmdletFilter", + "exportDefaultValue": "\"\"", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "CmdletName", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "showBorder": false + }, + "graphSettings": { + "type": 0, + "topContent": { + "columnMatch": "Cmdlet", + "formatter": 1 + }, + "centerContent": { + "columnMatch": "count_", + "formatter": 1, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + }, + "chartSettings": { + "createOtherGroup": 20 + } + }, + "customWidth": "45", + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| summarize count() by CmdletName\r\n| join kind=leftouter ( MESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n | make-series Count=count() on TimeGenerated from ago(30d) to now() step 1d by CmdletName\r\n | extend Anomalies=series_decompose_anomalies(Count)\r\n) on CmdletName\r\n| project CmdletName, Total=count_, Count, Anomalies\r\n| sort by Total", + "size": 2, + "showAnalytics": true, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Cmdlet", + "formatter": 0, + "formatOptions": { + "customColumnWidthSetting": "31.5ch" + } + }, + { + "columnMatch": "Total", + "formatter": 0, + "formatOptions": { + "customColumnWidthSetting": "9.3ch" + } + }, + { + "columnMatch": "Count", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "customColumnWidthSetting": "330px" + }, + "tooltipFormat": { + "tooltip": "Trend" + } + }, + { + "columnMatch": "Anomalies", + "formatter": 9, + "formatOptions": { + "palette": "redBright", + "customColumnWidthSetting": "330px" + }, + "tooltipFormat": { + "tooltip": "Anomalies" + } + } + ], + "rowLimit": 10000, + "filter": true, + "labelSettings": [ + { + "columnId": "Count", + "label": "Count for the last 30 days" + } + ] + } + }, + "customWidth": "55", + "name": "CmdletTrends" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ExcludedCmdlet = externaldata (Cmdlet: string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\", ignoreFirstRecord=true)\r\n | project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| summarize Total = count() by Caller\r\n| join kind=leftouter ( MESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n | make-series Count=count() on TimeGenerated from ago(30d) to now() step 1d by Caller\r\n | extend Anomalies=series_decompose_anomalies(Count)\r\n) on Caller\r\n| project Caller, Total, Count, Anomalies\r\n| sort by Total desc", + "size": 1, + "showAnalytics": true, + "exportFieldName": "Caller", + "exportParameterName": "CallerFilter", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Caller", + "formatter": 0, + "formatOptions": { + "customColumnWidthSetting": "70ch" + } + }, + { + "columnMatch": "Total", + "formatter": 4, + "formatOptions": { + "palette": "blue", + "customColumnWidthSetting": "125px" + } + }, + { + "columnMatch": "Count", + "formatter": 21, + "formatOptions": { + "palette": "blue", + "customColumnWidthSetting": "300px" + }, + "tooltipFormat": { + "tooltip": "Trend" + } + }, + { + "columnMatch": "Anomalies", + "formatter": 10, + "formatOptions": { + "palette": "redBright", + "customColumnWidthSetting": "300px" + }, + "tooltipFormat": { + "tooltip": "Anomalies" + } + } + ], + "rowLimit": 10000, + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_bar_Total_1", + "sortOrder": 2 + } + ], + "labelSettings": [ + { + "columnId": "Count", + "label": "Count for the last 30 days" + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_bar_Total_1", + "sortOrder": 2 + } + ], + "chartSettings": { + "createOtherGroup": 20 + } + }, + "name": "query - 4" + }, + { + "type": 1, + "content": { + "json": "## List of Cmdlets\r\n\r\nBy default all accounts found in the log are displayed.\r\n\r\nSelect an caller, to display all Cmdlets launched by this administrator\r\n\r\n> **Legend** \r\n> \r\n> πŸ‘‘ VIP user \r\n> πŸ’₯ Sensitive action\r\n\r\nIf needed, select an item in the dropdownlist. Dropdownlist are independent." + }, + "name": "text - 3" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "008273d1-a013-4d86-9e23-499e5175a85e", + "version": "KqlParameterItem/1.0", + "name": "CallerFilter", + "label": "Caller", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| distinct Caller\r\n| extend Caller = replace_string(Caller, '\\\\', '\\\\\\\\')\r\n| sort by Caller asc", + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "defaultValue": "value::all", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "21bd4e45-65ca-4b9b-a19c-177d6b37d807", + "version": "KqlParameterItem/1.0", + "name": "TargetObjectFilter", + "label": "Target Object", + "type": 2, + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where Caller in ({CallerFilter})\r\n| distinct TargetObject\r\n| sort by TargetObject asc", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + }, + { + "id": "9e93d5c3-0fcb-4ece-b2a0-fc3ff44a0b04", + "version": "KqlParameterItem/1.0", + "name": "CmdletFilter", + "label": "Cmdlet Filter", + "type": 2, + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where Caller in ({CallerFilter})\r\n| distinct CmdletName\r\n| sort by CmdletName asc", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ExcludedCmdlet = externaldata (Cmdlet: string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\", ignoreFirstRecord=true)\r\n | project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| where (Caller in ({CallerFilter}) or Caller == \"ALL\") and TargetObject contains \"{TargetObjectFilter}\" and CmdletName contains \"{CmdletFilter}\"\r\n and TargetObject contains \"\"\r\n and CmdletName contains \"\"\r\n| extend TargetObject = iif(IsVIP == true and TargetObject !=\"\" , strcat(\"πŸ‘‘ \",TargetObject), TargetObject )\r\n| extend Cmdlet = iif(IsSensitive == true and TargetObject !=\"\", strcat(\"πŸ’₯ \",CmdletName), CmdletName )\r\n| extend IsVIP = iif(IsVIP == true and TargetObject !=\"\" , strcat(\"πŸ‘‘ \",tostring(IsVIP)), tostring(IsVIP ))\r\n| project TimeGenerated, Caller, TargetObject, Cmdlet, CmdletParameters\r\n| sort by TimeGenerated desc", + "size": 2, + "showAnalytics": true, + "title": "History", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "formatters": [ + { + "columnMatch": "ActualCmdLet", + "formatter": 0, + "formatOptions": { + "customColumnWidthSetting": "120ch" + } + } + ], + "rowLimit": 10000, + "filter": true + } + }, + "name": "query - 5" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selected", + "comparison": "isEqualTo", + "value": "Cmdlet" + }, + "name": "Cmdlet Group" + } + ], + "fromTemplateId": "sentinel-MicrosoftExchangeSecurityAdminActivity-Online", + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Least Privilege with RBAC - Online.json b/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Least Privilege with RBAC - Online.json index fb14396d3f6..77f6d1cb6c2 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Least Privilege with RBAC - Online.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Least Privilege with RBAC - Online.json @@ -58,7 +58,10 @@ "showDefault": false }, "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "value": [ + "ITSY MCAPS" + ] }, { "id": "a88b4e41-eb2f-41bf-92d8-27c83650a4b8", @@ -67,8 +70,9 @@ "label": "Collection time", "type": 2, "isRequired": true, - "query": "let _configurationEnv = split(iff(isnull({EnvironmentList}) or isempty({EnvironmentList}) or tolower({EnvironmentList}) == \"all\",\"All\",tostring({EnvironmentList})),',');\r\nESIExchangeOnlineConfig_CL\r\n| extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n| where ScopedEnvironment in (_configurationEnv)\r\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n| summarize Collection = max(Collection)\r\n| project Collection = \"lastdate\", Selected = true\r\n| join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n| where ScopedEnvironment in (_configurationEnv)\r\n| where TimeGenerated > ago(90d)\r\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n| summarize by Collection\r\n) on Collection\r\n| project Value = iif(Selected,Collection,Collection1), Label = iif(Selected,\"Last Known date\",Collection1), Selected\r\n| sort by Selected, Value desc", + "query": "let _configurationEnv = split(iff(isnull({EnvironmentList}) or isempty({EnvironmentList}) or tolower({EnvironmentList}) == \"all\",\"All\",tostring({EnvironmentList})),',');\r\nESIExchangeOnlineConfig_CL\r\n| extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n| where ScopedEnvironment in (_configurationEnv)\r\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n| summarize Collection = max(Collection)\r\n| project Collection = \"lastdate\", Selected = true\r\n| join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | summarize by Collection \r\n | join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm ')\r\n | summarize by PreciseCollection, Collection \r\n | join kind=leftouter (\r\n ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm')\r\n | summarize by PreciseCollection, Collection \r\n | summarize count() by Collection\r\n ) on Collection\r\n ) on Collection\r\n) on Collection\r\n| project Value = iif(Selected,Collection,iif(count_ > 1,PreciseCollection,Collection1)), Label = iif(Selected,\"Last Known date\",iif(count_ > 1,PreciseCollection,Collection1)), Selected\r\n| sort by Selected, Value desc", "typeSettings": { + "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, @@ -81,7 +85,7 @@ "label": "Show Help", "type": 10, "isRequired": true, - "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\\r\\n\"}", + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\\r\\n\"}\r\n", "timeContext": { "durationMs": 2592000000 }, @@ -133,24 +137,27 @@ "version": "KqlParameterItem/1.0", "name": "RoleAssignee", "type": 2, - "query": "let DefMRA = externaldata (Name:string)[h\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"User\"\r\n| project CmdletResultValue\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| distinct RoleAssigneeName\r\n", + "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"User\"\r\n| project CmdletResultValue\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| distinct RoleAssigneeName\r\n", "typeSettings": { "showDefault": false }, "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null }, { "id": "cf5959fa-a833-4bb2-90bd-d4c90dca5506", "version": "KqlParameterItem/1.0", "name": "Role", "type": 2, - "query": "ExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| extend Role=tostring (CmdletResultValue.Role)\r\n| distinct Role\r\n| sort by Role asc", + "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"User\"\r\n| project CmdletResultValue\r\n| extend Role=tostring (CmdletResultValue.Role)\r\n| distinct Role\r\n| sort by Role asc", "typeSettings": { + "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null } ], "style": "pills", @@ -163,7 +170,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let DefMRA = externaldata (Name:string)[h\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.RoleAssigneeName endswith \"{RoleAssignee}\" \r\n| where CmdletResultValue.Role contains \"{Role}\"\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"User\" and CmdletResultValue.Name !contains \"Deleg\"\r\n| project CmdletResultValue\r\n| extend Name = tostring(CmdletResultValue.Name)\r\n| extend Role = tostring(CmdletResultValue.Role)\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\r\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\r\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\r\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\r\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\r\n| extend Status= tostring(CmdletResultValue.Enabled)\r\n| project Name, Role, RoleAssigneeName,Status,CustomRecipientWriteScope,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope\r\n| sort by RoleAssigneeName asc\r\n", + "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.RoleAssigneeName endswith \"{RoleAssignee}\" \r\n| where CmdletResultValue.Role contains \"{Role}\"\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"User\" and CmdletResultValue.Name !contains \"Deleg\"\r\n| project CmdletResultValue\r\n| extend Name = tostring(CmdletResultValue.Name)\r\n| extend Role = tostring(CmdletResultValue.Role)\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\r\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\r\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\r\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\r\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\r\n| extend Status= tostring(CmdletResultValue.Enabled)\r\n| project Name, Role, RoleAssigneeName,Status,CustomRecipientWriteScope,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope\r\n| sort by RoleAssigneeName asc\r\n", "size": 3, "showAnalytics": true, "queryType": 0, @@ -232,7 +239,6 @@ "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Explanations", - "expandable": true, "items": [ { "type": 1, @@ -243,6 +249,11 @@ } ] }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "Yes" + }, "name": "group - 3" }, { @@ -269,24 +280,27 @@ "version": "KqlParameterItem/1.0", "name": "RoleAssignee", "type": 2, - "query": "let DefMRA = externaldata (Name:string)[h\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"RoleGroup\" and CmdletResultValue.RoleAssigneeName !contains \"RIM-MailboxAdmins\"\r\n| project CmdletResultValue\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| distinct RoleAssigneeName", + "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"RoleGroup\" and CmdletResultValue.RoleAssigneeName !contains \"RIM-MailboxAdmins\"\r\n| project CmdletResultValue\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| distinct RoleAssigneeName", "typeSettings": { "showDefault": false }, "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null }, { "id": "f5511a2b-9bf6-48ae-a968-2d1f879c8bfa", "version": "KqlParameterItem/1.0", "name": "Role", "type": 2, - "query": "ExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| extend Role=tostring (CmdletResultValue.Role)\r\n| distinct Role\r\n| sort by Role asc", + "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"RoleGroup\" and CmdletResultValue.RoleAssigneeName !contains \"RIM-MailboxAdmins\"\r\n| project CmdletResultValue\r\n| extend Role=tostring (CmdletResultValue.Role)\r\n| distinct Role\r\n| sort by Role asc", "typeSettings": { + "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "value": "MR-CustMailRecipients" } ], "style": "pills", @@ -299,7 +313,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let DefMRA = externaldata (Name:string)[h\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nlet RoleG = ExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n | project RoleAssigneeName=tostring(CmdletResultValue.Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.RoleAssigneeName endswith \"{RoleAssignee}\" \r\n| where CmdletResultValue.Role contains \"{Role}\"\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"RoleGroup\" and CmdletResultValue.RoleAssigneeName !contains \"RIM-MailboxAdmins\" and CmdletResultValue.Name !contains \"Deleg\"\r\n| project CmdletResultValue\r\n| extend ManagementRoleAssignment = tostring(CmdletResultValue.Name)\r\n| extend Role = tostring(CmdletResultValue.Role)\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| extend Status= tostring(CmdletResultValue.Enabled)\r\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\r\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\r\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\r\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\r\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\r\n|lookup RoleG on RoleAssigneeName \r\n| project-away CmdletResultValue\r\n| sort by RoleAssigneeName asc", + "query": "let DefMRA = externaldata (Name:string)[h\"https://aka.ms/standardMRAOnline\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nlet RoleG = ExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n | project RoleAssigneeName=tostring(CmdletResultValue.Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.RoleAssigneeName endswith \"{RoleAssignee}\" \r\n| where CmdletResultValue.Role contains \"{Role}\"\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"RoleGroup\" and CmdletResultValue.RoleAssigneeName !contains \"RIM-MailboxAdmins\" and CmdletResultValue.Name !contains \"Deleg\"\r\n| project CmdletResultValue\r\n| extend ManagementRoleAssignment = tostring(CmdletResultValue.Name)\r\n| extend Role = tostring(CmdletResultValue.Role)\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| extend Status= tostring(CmdletResultValue.Enabled)\r\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\r\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\r\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\r\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\r\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\r\n|lookup RoleG on RoleAssigneeName \r\n| project-away CmdletResultValue\r\n| sort by RoleAssigneeName asc", "size": 3, "showAnalytics": true, "showExportToExcel": true, @@ -337,7 +351,6 @@ "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Explanations", - "expandable": true, "items": [ { "type": 1, @@ -348,6 +361,11 @@ } ] }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "Yes" + }, "name": "group - 4" } ] @@ -362,182 +380,6 @@ "showBorder": true } }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "title": "Information for Role Assignee", - "items": [ - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "title": "Information for Role Assignee User account", - "items": [ - { - "type": 1, - "content": { - "json": "Detailed Information on User account Role Assignee" - }, - "name": "text - 0" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "parameters": [ - { - "id": "27e4c2e9-d113-4bf9-808f-0f8f68b5152e", - "version": "KqlParameterItem/1.0", - "name": "RoleAssignee", - "type": 2, - "isRequired": true, - "query": "let DefMRA = externaldata (Name:string)[h\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"User\"\r\n| project CmdletResultValue\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| distinct RoleAssigneeName", - "typeSettings": { - "showDefault": false - }, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" - } - ], - "style": "pills", - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" - }, - "name": "parameters - 1" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "ExchangeConfiguration(SpecificSectionList=\"DirectRoleAssignments\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.SamAccountName contains \"{RoleAssignee}\"\r\n| project CmdletResultValue\r\n| extend Account = tostring(CmdletResultValue.SamAccountName)\r\n| extend LastLogon = CmdletResultValue.LastLogonString\r\n| extend LastPwdSet = CmdletResultValue.LastPwdSetString\r\n| extend Enabled = tostring(CmdletResultValue.Enabled)\r\n| extend DN = tostring(CmdletResultValue.DN)\r\n| project-away CmdletResultValue\r\n| sort by Account asc", - "size": 3, - "showAnalytics": true, - "color": "green", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" - }, - "name": "query - 2", - "styleSettings": { - "showBorder": true - } - } - ] - }, - "name": "Information for Role Assignee User account" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "title": "Explanations", - "expandable": true, - "items": [ - { - "type": 1, - "content": { - "json": "This section displays detailed information for user account found with non standard delegation :\r\n - Last logon\r\n - Last Password changed\r\n - Account enabled" - }, - "name": "text - 0" - } - ] - }, - "name": "group - 2" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "title": "Information for Role Assignee group", - "items": [ - { - "type": 1, - "content": { - "json": "Detailed information for Group delegation" - }, - "name": "text - 0" - }, - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "parameters": [ - { - "id": "75c3cdf3-d0c3-46c3-83ae-429979774234", - "version": "KqlParameterItem/1.0", - "name": "RoleAssignee", - "type": 2, - "isRequired": true, - "query": "let DefMRA = externaldata (Name:string)[h\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| summarize make_list(Name);\r\nExchangeConfiguration(SpecificSectionList=\"MRA\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \"RoleGroup\" and CmdletResultValue.RoleAssigneeName !contains \"RIM-MailboxAdmins\"\r\n| project CmdletResultValue\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| distinct RoleAssigneeName", - "typeSettings": { - "showDefault": false - }, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" - } - ], - "style": "pills", - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" - }, - "name": "parameters - 1" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "ExchangeConfiguration(SpecificSectionList=\"ExGroup\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Parentgroup contains \"{RoleAssignee}\"\r\n| where CmdletResultValue.Level != 0\r\n| project CmdletResultValue\r\n| extend Level_ = tostring(CmdletResultValue.Level)\r\n| extend Parentgroup = tostring(CmdletResultValue.Parentgroup)\r\n| extend MemberPath = tostring(CmdletResultValue.MemberPath)\r\n| extend LastLogon = CmdletResultValue.LastLogonString\r\n| extend LastPwdSet = CmdletResultValue.LastPwdSetString\r\n| extend Enabled = tostring(CmdletResultValue.Enabled)\r\n| extend DN = tostring(CmdletResultValue.DN)\r\n| project-away CmdletResultValue\r\n| sort by Parentgroup asc", - "size": 3, - "showAnalytics": true, - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" - }, - "name": "query - 2", - "styleSettings": { - "showBorder": true - } - } - ] - }, - "name": "Information for Role Assignee group" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "title": "Explanations", - "expandable": true, - "items": [ - { - "type": 1, - "content": { - "json": "This section displays detailed information for user account present in the found groups with non standard delegation :\r\n - Last logon\r\n - Last Password changed\r\n - Account enabled" - }, - "name": "text - 0" - } - ] - }, - "name": "group - 3" - } - ] - }, - "conditionalVisibility": { - "parameterName": "selected", - "comparison": "isEqualTo", - "value": "RBACDelegation" - }, - "name": "Information for Role Assignee", - "styleSettings": { - "showBorder": true - } - }, { "type": 12, "content": { @@ -742,7 +584,7 @@ "content": { "version": "KqlItem/1.0", "query": "ExchangeConfiguration(SpecificSectionList=\"MRCustom\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| extend Identity = CmdletResultValue.Name\r\n| extend ParentRole =split(tostring(CmdletResultValue.Parent),\"\\\\\")[1]\r\n| project Identity, ParentRole, WhenCreated, WhenChanged", - "size": 0, + "size": 3, "showAnalytics": true, "timeContext": { "durationMs": 86400000 @@ -832,7 +674,7 @@ "content": { "version": "KqlItem/1.0", "query": "let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\"MRCustom\", SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| project Role = tostring(CmdletResultValue.Name));\r\nExchangeConfiguration(SpecificSectionList=\"MRA\", SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| extend Role = tostring(CmdletResultValue.Role)\r\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\r\n| extend Status= tostring(CmdletResultValue.Enabled)\r\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\r\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\r\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\r\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\r\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\r\n| project RoleAssigneeName, Role, Status,CustomRecipientWriteScope, CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,WhenCreated, WhenChanged\r\n| join kind=inner (MRcustomRoles) on Role\r\n| project RoleAssigneeName, Role, Status,CustomRecipientWriteScope, CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,WhenCreated, WhenChanged", - "size": 0, + "size": 3, "showAnalytics": true, "timeContext": { "durationMs": 86400000 @@ -880,7 +722,8 @@ "durationMs": 86400000 }, "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "value": "MR-CustPF" } ], "style": "pills", @@ -893,7 +736,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "ExchangeConfiguration(SpecificSectionList=\"MRCustomDetails\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where (replace_string(replace_string(tostring(split(CmdletResultValue.Role.DistinguishedName,\",\",0)),\"[\\\"CN=\",\"\"),\"\\\"]\",\"\")) contains \"{CustomRole}\"\r\n| extend CustomRoleName = replace_string(replace_string(tostring(split(CmdletResultValue.Role.DistinguishedName,\",\",0)),\"[\\\"CN=\",\"\"),\"\\\"]\",\"\")\r\n| extend CmdletName = CmdletResultValue.Name\r\n| extend Parameters = CmdletResultValue.Parameters\r\n| project CmdletName,Parameters", + "query": "ExchangeConfiguration(SpecificSectionList=\"MRCustomDetails\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| where CmdletResultValue.Role contains \"{CustomRole}\"\r\n| extend CmdletName = CmdletResultValue.Name\r\n| extend Parameters = CmdletResultValue.Parameters\r\n| project CmdletName,Parameters", "size": 1, "showAnalytics": true, "timeContext": { diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Search AdminAuditLog - Online.json b/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Search AdminAuditLog - Online.json new file mode 100644 index 00000000000..9b8acc02885 --- /dev/null +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Search AdminAuditLog - Online.json @@ -0,0 +1,461 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "## Admin Audit Log\r\n\r\n** This workbook requires Option 1** (upload of the OfficeActivity logs)\r\n\r\n**Selection of an environment is unavailable. As this workbook is based on the OfficeActivity Logs (Microsoft 365 Solution) directly linked to the Microsoft Sentinel Environment, we cannot provide a view of another one.**" + }, + "name": "text - 6" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "79f1e435-df12-4c83-9967-501ab5f6ad6a", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "isRequired": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 14400000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 259200000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 1209600000 + }, + { + "durationMs": 2419200000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 5184000000 + }, + { + "durationMs": 7776000000 + } + ], + "allowCustom": true + }, + "timeContext": { + "durationMs": 86400000 + }, + "value": { + "durationMs": 86400000 + } + }, + { + "id": "59486bcb-db99-43b3-97dc-a63b271a91d1", + "version": "KqlParameterItem/1.0", + "name": "EnvironmentList", + "label": "Environment", + "type": 2, + "query": "OfficeActivity | where TimeGenerated {TimeRange}\r\n | summarize by OrganizationName", + "isHiddenWhenLocked": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null + }, + { + "id": "079b3cc5-dab3-4d38-b4d0-71101802949d", + "version": "KqlParameterItem/1.0", + "name": "Help", + "label": "Show Help", + "type": 10, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n { \"value\": \"Yes\", \"label\": \"Yes\"},\r\n {\"value\": \"No\", \"label\": \"No\", \"selected\":true }\r\n]" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 4" + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "tabs", + "links": [ + { + "id": "9d830b00-95f4-4fd5-8cfb-95c2e63f5d0b", + "cellValue": "selected", + "linkTarget": "parameter", + "linkLabel": "Cmdlets Analysis", + "subTarget": "CmdletAna", + "style": "link" + }, + { + "id": "944a83ef-377f-4374-83e8-46816b6ce570", + "cellValue": "selected", + "linkTarget": "parameter", + "linkLabel": "Admin Audit Log - All Admins", + "subTarget": "AllAAL", + "style": "link" + }, + { + "id": "cdab541f-8d91-4882-ba46-7c04cdff257b", + "cellValue": "selected", + "linkTarget": "parameter", + "linkLabel": "Workbook Help", + "subTarget": "Start", + "style": "link" + } + ] + }, + "name": "links - 1" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "Global Admin Audit Log Search", + "items": [ + { + "type": 1, + "content": { + "json": "If needed, select an item in the dropdownlist. Dropdownlist are independent." + }, + "name": "text - 4" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "e100ee8b-d63b-4c49-9004-6555b56051aa", + "version": "KqlParameterItem/1.0", + "name": "Admin", + "type": 2, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Caller = replace_string(Caller, '\\\\', '\\\\\\\\')\r\n| extend admin = Caller\r\n| distinct admin\r\n\r\n", + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "defaultValue": "value::all", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + { + "id": "0d7c1223-d108-4d10-bb24-50891a3415fd", + "version": "KqlParameterItem/1.0", + "name": "CmdLet", + "type": 2, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| where Caller in ({Admin})\r\n| distinct CmdletName", + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ], + "showDefault": false + }, + "defaultValue": "value::all", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters - 1" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "**How to understand the data**\r\n\r\nThese information are extracted from the OfficeActivity logs.\r\n\r\nEach entry is analyzed regarding the following conditions :\r\n\r\n - Check if the Target Object is a VIP. The VIP list is based on the watchlist \"Exchange VIP\".\r\n\r\n - Check if the Cdmlet is a Sensitive Cmdlet. The Sensitive Cmdlet list is based on the watchlist \"Monitored Exchange Cmdlets\". \r\n - This list contains the list of Cmdlet that are considered as Sensitive. \r\n - Some Cmdlet will be considered as Sensitive only if some specific parameters defined in the \"Monitored Exchange Cmdlets\" watchlist are used.\r\n\r\nColumn explainatations : \r\n - Caller : Named of the Administrators that used this cmdlet\r\n - TargetObject : Object modified by the cmdlet\r\n - IsVIP : If the Target Object part of the \"Exchange VIP\" watchlist\r\n - Cmdlet : Name of the cmdlet that was used\r\n - CmdletParameters : Cmdlet parameters used with the command\r\n - IsSensitive :\r\n - true : This cmdlet is Sensitive because it was part of the list of the \"Monitored Exchange Cmdlets\" watchlist and Sensitive parameters have been used for cmdlet with specifc sensitive parameters \r\n\r\n" + }, + "showPin": false, + "name": "text - 0" + } + ] + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "Yes" + }, + "name": "group - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where Caller in ({Admin}) and CmdletName in ({CmdLet})\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend TargetObject = iif(IsVIP == true and TargetObject !=\"\" , strcat(\"πŸ‘‘ \",TargetObject), TargetObject )\r\n| extend CmdletName = iif(IsSensitive == true and TargetObject !=\"\", strcat(\"πŸ’₯ \",CmdletName), CmdletName )\r\n| extend IsVIP = iif(IsVIP == true and TargetObject !=\"\" , strcat(\"πŸ‘‘ \",tostring(IsVIP)), tostring(IsVIP ))\r\n| extend IsSensitive = iif(IsSensitive == true and TargetObject !=\"\", strcat(\"πŸ’₯ \",tostring(IsSenstiveCmdlet)), tostring(IsSenstiveCmdlet))\r\n| project TimeGenerated, Caller,IsVIP,TargetObject,IsSensitive,CmdletName,CmdletParameters\r\n| sort by TimeGenerated desc", + "size": 0, + "showAnalytics": true, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "rowLimit": 10000, + "filter": true, + "sortBy": [ + { + "itemKey": "TimeGenerated", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "TimeGenerated", + "sortOrder": 2 + } + ] + }, + "name": "query - 2", + "styleSettings": { + "showBorder": true + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "selected", + "comparison": "isEqualTo", + "value": "AllAAL" + }, + "name": "Global Admin Audit Log" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "Analysis of Administrators actions", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "Total Cmdlets for the Time Range", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Caller\r\n| extend CmdletName\r\n| summarize Count=count() by CmdletName", + "size": 2, + "showAnalytics": true, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "chartSettings": { + "createOtherGroup": 10 + } + }, + "customWidth": "50", + "name": "query - 0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Account = Caller\r\n| summarize Count=dcount(CmdletName) by Account,CmdletName", + "size": 2, + "showAnalytics": true, + "title": "Total Unique Cmdlet per Account for the Time Range", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Account", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "50", + "name": "query - 1" + } + ] + }, + "name": "group - 1" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| summarize Count=count() by CmdletName\r\n| sort by CmdletName asc", + "size": 0, + "showAnalytics": true, + "title": "Total List of Cmdlets", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "filter": true + } + }, + "customWidth": "50", + "name": "query - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://aka.ms/ExcludedCmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nMESOfficeActivityLogs\r\n| where TimeGenerated {TimeRange}\r\n| where CmdletName !in (ExcludedCmdlet)\r\n| extend Account = Caller\r\n| summarize Count=count() by CmdletName, Account\r\n| sort by Count asc", + "size": 0, + "showAnalytics": true, + "title": "List of Cmdlet per Account", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "rowLimit": 10000, + "filter": true + }, + "sortBy": [] + }, + "customWidth": "50", + "name": "query - 1" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "Explanations", + "expandable": true, + "items": [ + { + "type": 1, + "content": { + "json": "This section displayed the list of Cmdlet used in your environment for the defined period of time with the number of time they have been used." + }, + "name": "text - 0" + } + ] + }, + "customWidth": "50", + "name": "group - 2" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "Explanations", + "expandable": true, + "items": [ + { + "type": 1, + "content": { + "json": "This section will display the list of Cmdlet launch by Administrators for the defined period of time and the number of time they have been used" + }, + "name": "text - 0" + } + ] + }, + "customWidth": "50", + "name": "group - 3" + } + ] + }, + "name": "Result Analysis" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selected", + "comparison": "isEqualTo", + "value": "CmdletAna" + }, + "name": "Analysis of actions performed" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# Workbook goals\r\nThe goals of this workbook is to allow search in the Exchange Admin Audit log.\r\n\r\nThe source of this workbook is not an export of the Admin Audit log mailbox but an export of the MSExchange Management for each Exchange servers.\r\n\r\nIf the Admin Audit Log is bypassed, the information won't be displayed in this workbook as there is no method to track this data.\r\n\r\n## Tabs\r\n\r\nLet quicly review the content of each tab\r\n\r\n### Cmdlets Analysis\r\n\r\nThis tab will show for the defined time range :\r\n - A summary of all cmdets used\r\n\r\n - A summary of all cmdlets used by each Account\r\n\r\n### Global Admin Audit Log\r\n\r\nThis tab allow to globally search in the exported Admin Audit log content.\r\n\r\nWhen Sensitive Cmdlets and/or Sensitive parameters are used, specific informations will be displayed.\r\n\r\nWhen VIP user are manipulated, specific informations will be displayed.\r\n\r\nFor more informations on how to understand each Column, refer to \"How to understand the data\"\r\n\r\n\r\n### AdminAuditLog for Org Mgmt\r\n\r\nThis tab allow to globally search in the exported Admin Audit log content for only account members on the Organization Management groups.\r\n\r\nWhen Sensitive Cmdlets and/or Sensitive parameters are used, specific informations will be displayed.\r\n\r\nWhen VIP user are manipulated, specific informations will be displayed.\r\n\r\nFor more informations on how to understand each Column, refer to \"How to understand the data\"" + }, + "name": "text - 0" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selected", + "comparison": "isEqualTo", + "value": "Start" + }, + "name": "group - 5" + } + ], + "fromTemplateId": "sentinel-MicrosoftExchangeSearchAdminAuditLog-Online", + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Security Review - Online.json b/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Security Review - Online.json index 7a07bab5a55..9e8a49ae978 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Security Review - Online.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Security Review - Online.json @@ -30,9 +30,7 @@ }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", - "value": [ - "ITSY" - ] + "value": [] }, { "id": "a88b4e41-eb2f-41bf-92d8-27c83650a4b8", @@ -41,13 +39,26 @@ "label": "Collection time", "type": 2, "isRequired": true, - "query": "let _configurationEnv = split(iff(isnull({EnvironmentList}) or isempty({EnvironmentList}) or tolower({EnvironmentList}) == \"all\",\"All\",tostring({EnvironmentList})),',');\r\nESIExchangeOnlineConfig_CL\r\n| extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n| where ScopedEnvironment in (_configurationEnv)\r\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n| summarize Collection = max(Collection)\r\n| project Collection = \"lastdate\", Selected = true\r\n| join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n| where ScopedEnvironment in (_configurationEnv)\r\n| where TimeGenerated > ago(90d)\r\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n| summarize by Collection\r\n) on Collection\r\n| project Value = iif(Selected,Collection,Collection1), Label = iif(Selected,\"Last Known date\",Collection1), Selected\r\n| sort by Selected, Value desc", + "query": "let _configurationEnv = split(iff(isnull({EnvironmentList}) or isempty({EnvironmentList}) or tolower({EnvironmentList}) == \"all\",\"All\",tostring({EnvironmentList})),',');\r\nESIExchangeOnlineConfig_CL\r\n| extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n| where ScopedEnvironment in (_configurationEnv)\r\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n| summarize Collection = max(Collection)\r\n| project Collection = \"lastdate\", Selected = true\r\n| join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | summarize by Collection \r\n | join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm ')\r\n | summarize by PreciseCollection, Collection \r\n | join kind=leftouter (\r\n ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm')\r\n | summarize by PreciseCollection, Collection \r\n | summarize count() by Collection\r\n ) on Collection\r\n ) on Collection\r\n) on Collection\r\n| project Value = iif(Selected,Collection,iif(count_ > 1,PreciseCollection,Collection1)), Label = iif(Selected,\"Last Known date\",iif(count_ > 1,PreciseCollection,Collection1)), Selected\r\n| sort by Selected, Value desc", "typeSettings": { + "additionalResourceOptions": [], "showDefault": false }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, + { + "id": "181fa282-a002-42f1-ad57-dfb86df3194e", + "version": "KqlParameterItem/1.0", + "name": "Compare_Collect", + "type": 10, + "description": "If this button is checked, two collections will be compared", + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [] + }, + "jsonData": "[\r\n { \"value\": \"True\", \"label\": \"Yes\" },\r\n { \"value\": \"True,False\", \"label\": \"No\", \"selected\":true }\r\n]" + }, { "id": "8ac96eb3-918b-4a36-bcc4-df50d8f46175", "version": "KqlParameterItem/1.0", @@ -55,7 +66,7 @@ "label": "Show Help", "type": 10, "isRequired": true, - "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\\r\\n\"}", + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\\r\\n\"}\r\n", "timeContext": { "durationMs": 2592000000 }, @@ -68,6 +79,38 @@ }, "name": "TimeRange" }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a9e0099e-5eb1-43b8-915c-587aa05bccf0", + "version": "KqlParameterItem/1.0", + "name": "DateCompare", + "type": 2, + "description": "Date to Comapre", + "isRequired": true, + "query": "let _configurationEnv = split(iff(isnull({EnvironmentList}) or isempty({EnvironmentList}) or tolower({EnvironmentList}) == \"all\",\"All\",tostring({EnvironmentList})),',');\r\nESIExchangeOnlineConfig_CL\r\n| extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n| where ScopedEnvironment in (_configurationEnv)\r\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n| summarize Collection = max(Collection)\r\n| project Collection = \"lastdate\", Selected = true\r\n| join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | summarize by Collection \r\n | join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm ')\r\n | summarize by PreciseCollection, Collection \r\n | join kind=leftouter (\r\n ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \"All\", \"All\",ESIEnvironment_s) \r\n | where ScopedEnvironment in (_configurationEnv)\r\n | where TimeGenerated > ago(90d)\r\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\r\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm')\r\n | summarize by PreciseCollection, Collection \r\n | summarize count() by Collection\r\n ) on Collection\r\n ) on Collection\r\n) on Collection\r\n| project Value = iif(Selected,Collection,iif(count_ > 1,PreciseCollection,Collection1)), Label = iif(Selected,\"Last Known date\",iif(count_ > 1,PreciseCollection,Collection1)), Selected\r\n| sort by Selected, Value desc", + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "above", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "conditionalVisibility": { + "parameterName": "Compare_Collect", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "parameters - 0" + }, { "type": 1, "content": { @@ -121,6 +164,13 @@ }, "name": "TopMenuTabs" }, + { + "type": 1, + "content": { + "json": "To compare collects, select **Yes** and choose the initial date.\r\nFor each role, a new table will be displayed with **all** the modifications (Add, Remove, Modifications) beetween the two dates.\r\n\r\n**Important notes** : Some information are limited are may be not 100% accurate :\r\n - Date\r\n - GUID of user instead of the name\r\n - Fusion of modifications when a role assisgnment is changed within the same collect \r\n - ... \r\n\r\nThis is due to some restrictions in the collect. For more details information, please check the workbook **\"Microsoft Exchange Search AdminAuditLog - Online\"**\r\n.\r\n\r\nThe compare functionnality is not available for all sections in this workbook.\r\n" + }, + "name": "text - 9" + }, { "type": 12, "content": { @@ -148,7 +198,7 @@ "content": { "version": "NotebookGroup/1.0", "groupType": "editable", - "title": "Display important security configurations that allow to mailboxes content (direct delegation on mailboxes are not listed (Full Access mailboxes or direct delegation on mailboxes folders)", + "title": "Display important security configurations that allow to access mailboxes' content. Direct delegations on mailboxes are not listed (Full Access permission mailboxes or direct delegations on mailboxes folders)", "items": [ { "type": 3, @@ -190,7 +240,7 @@ { "type": 1, "content": { - "json": "**ApplicationImpersonation** is an RBAC role that allows access (read and modify) to the content of all mailboxes using EWS. This role is very powerfull and should be carefully delegated. When a delegation is necessary, RBAC scopes should be configured to limit the list of impacted mailboxes.\r\n\r\nIt is common to see service accounts for backup solution, antivirus software, MDM...\r\n\r\nNote that the default configuration to the group Hygiene Management is excluded. this group is a sensitive group. Remember to monitor the content of this group", + "json": "**ApplicationImpersonation** is a RBAC role that allows access (read and modify) to the content of all mailboxes. This role is very powerfull and should be carefully delegated. When a delegation is necessary, RBAC scopes should be configured to limit the list of impacted mailboxes.\r\n\r\nIt is common to see service accounts for backup solution, antivirus software, MDM...", "style": "info" }, "conditionalVisibility": { @@ -210,7 +260,7 @@ { "type": 1, "content": { - "json": "This delegation allows the delegated account to access and modify the content of every mailboxes using EWS." + "json": "This delegation allows the delegated account to access and modify the content of every mailboxes using EWS.\r\nExcluded from the result as it is a default configuration :\r\nDelegating delegation to Organization Management" }, "name": "text - 0" }, @@ -233,6 +283,32 @@ "styleSettings": { "showBorder": true } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let ExclusionsAcctValue = dynamic([\"Hygiene Management\", \"RIM-MailboxAdmins\"]);\r\nMESCompareDataMRA(SectionCompare=\"MRA\",DateCompare=\"{DateCompare:value}\",CurrentDate = \"{DateOfConfiguration:value}\",EnvList ={EnvironmentList},TypeEnv = \"Online\",ExclusionsAcct = ExclusionsAcctValue ,CurrentRole=\"Impersonation\")", + "size": 3, + "title": "Display changes ( Add, Remove, modifications of parameters )", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "ManagementRoleAssignement" + ], + "expandTopLevel": true + } + } + }, + "conditionalVisibility": { + "parameterName": "Compare_Collect", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 2" } ] }, @@ -248,14 +324,14 @@ { "type": 1, "content": { - "json": "This delegation allows to export the content all mailboxes in a scope in PST file.\r\nExcluded from the result as default configuration :\r\nDelegating delegation to Organization Management\r\n" + "json": "This delegation allows to import contents in all mailboxes.\r\nExcluded from the result as it is a default configuration :\r\nDelegating delegation to Organization Management\r\n" }, "name": "text - 0" }, { "type": 1, "content": { - "json": "**Mailbox Import Export** is an RBAC role that allows an account to export the content of any maibox in a PST. It also allows search in all mailboxes.\r\n\r\n⚑ This role is very powerfull.\r\n\r\nBy default, this role is not delegated to any user or group. The members of the group Organization Management by default do not have this role but are able to delegate it.\r\n\r\nℹ️ Recommendations\r\n\r\nIf you temporarily need this delegation, consider the following:\r\n- create an empty group with this delegation\r\n- monitor the group content and alert when the group modified\r\n- add administrators in this group only for a short period of time", + "json": "**Mailbox Import Export** is an RBAC role that allows an account to import (export is not available online) contant in a user mailbox. It also allows searches in all mailboxes.\r\n\r\n⚑ This role is very powerfull.\r\n\r\nBy default, this role is not delegated to any user or group. The members of the group Organization Management by default do not have this role but are able to delegate it.\r\n\r\nℹ️ Recommendations\r\n\r\nIf you temporarily need this delegation, consider the following:\r\n- create an empty group with this delegation\r\n- monitor the group content and alert when the group modified\r\n- add administrators in this group only for a short period of time", "style": "info" }, "conditionalVisibility": { @@ -296,6 +372,51 @@ "styleSettings": { "showBorder": true } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MESCompareDataMRA(SectionCompare=\"MRA\",DateCompare=\"{DateCompare:value}\",CurrentDate = \"{DateOfConfiguration:value}\",EnvList ={EnvironmentList},TypeEnv = \"Online\",ExclusionsAcct = \"N/A\",CurrentRole=\"export\")", + "size": 3, + "showAnalytics": true, + "title": "Display changes ( Add, Remove, modifications of parameters )", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "ManagementRoleAssignement" + ], + "expandTopLevel": true + }, + "sortBy": [ + { + "itemKey": "ConfigWriteScope", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "ConfigWriteScope", + "sortOrder": 1 + } + ] + }, + "conditionalVisibility": { + "parameterName": "Compare_Collect", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 1 - Copy", + "styleSettings": { + "showBorder": true + } } ] }, @@ -311,14 +432,14 @@ { "type": 1, "content": { - "json": "This delegation allows to search inside all or in a scope of mailboxes and export the result in PST.\r\nExcluded from the result as default configuration :\r\nDelegating delegation to Organization Management\r\nExchange Online-ApplicationAccount\r\nDiscovery Management has been excluded\r\n" + "json": "This delegation allows to search inside all or in a scope of mailboxes.\r\nExcluded from the result as it is a default configuration :\r\nDelegating delegation to Organization Management\r\nDiscovery Management has been excluded\r\n" }, "name": "text - 0" }, { "type": 1, "content": { - "json": "**Mailbox Search** is an RBAC role that allows an account to search in any mailbox and export the results to a PST.\r\n\r\n⚑ This role is very powerfull.\r\n\r\nBy default, this role is only delegated to the group Discovery Management. The members of the group Organization Management do not have this role but are able to delegate it.\r\n\r\nℹ️ Recommendations\r\n\r\nIf you temporarily need this delegation, consider the following:\r\n\r\n- add the administrators in the Discovery Management group\r\n- monitor the group content and alert when the group modified\r\n- add administrators in this group only for a short period of time", + "json": "**Mailbox Search** is an RBAC role that allows an account to search in any mailbox.\r\n\r\n⚑ This role is very powerfull.\r\n\r\nBy default, this role is only delegated to the group Discovery Management. The members of the group Organization Management do not have this role but are able to delegate it.\r\n\r\nℹ️ Recommendations\r\n\r\nIf you temporarily need this delegation, consider the following:\r\n\r\n- add the administrators in the Discovery Management group\r\n- monitor the group content and alert when the group modified\r\n- add administrators in this group only for a short period of time", "style": "info" }, "conditionalVisibility": { @@ -359,6 +480,51 @@ "styleSettings": { "showBorder": true } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MESCompareDataMRA(SectionCompare=\"MRA\",DateCompare=\"{DateCompare:value}\",CurrentDate = \"{DateOfConfiguration:value}\",EnvList ={EnvironmentList},TypeEnv = \"Online\",ExclusionsAcct = \"N/A\",CurrentRole=\"Search\")", + "size": 3, + "showAnalytics": true, + "title": "Display changes ( Add, Remove, modifications of parameters )", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "rowLimit": 10000, + "filter": true, + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "ManagementRoleAssignement" + ], + "expandTopLevel": true + }, + "sortBy": [ + { + "itemKey": "ConfigWriteScope", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "ConfigWriteScope", + "sortOrder": 1 + } + ] + }, + "conditionalVisibility": { + "parameterName": "Compare_Collect", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 1 - Copy", + "styleSettings": { + "showBorder": true + } } ] }, @@ -378,14 +544,13 @@ "content": { "version": "NotebookGroup/1.0", "groupType": "editable", - "title": "Exchange and AD GRoup", + "title": "Exchange Group", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", - "title": "Exchange group", "items": [ { "type": 1, @@ -405,7 +570,7 @@ "content": { "version": "NotebookGroup/1.0", "groupType": "editable", - "title": "To groups - Number of direct members per group with RecipientType User", + "title": " Number of direct members per group with RecipientType User", "items": [ { "type": 3, @@ -484,7 +649,7 @@ { "type": 1, "content": { - "json": "Exchange groups content (Extract for the OU \"Microsoft Exchange Security Groups\").\r\nSelect a group to display detailed information of its contents.\r\nLevel attribute helps you understand the level of nested groups." + "json": "Exchange Online groups content.\r\nSelect a group to display detailed information of its contents." }, "name": "text - 2" }, @@ -503,7 +668,8 @@ "showDefault": false }, "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "resourceType": "microsoft.operationalinsights/workspaces", + "value": null } ], "style": "pills", @@ -593,6 +759,34 @@ "styleSettings": { "showBorder": true } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let _EnvList ={EnvironmentList};\r\nlet _TypeEnv = \"Online\";\r\nlet _DateCompare = \"{DateCompare:value}\";\r\nlet _CurrentDate = \"{DateOfConfiguration:value}\";\r\nlet _DateCompareB = todatetime(_DateCompare);\r\nlet _currD = (ExchangeConfiguration(SpecificSectionList=\"InBoundC\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n| summarize TimeMax = arg_max(TimeGenerated,*)\r\n| extend TimeMax = tostring(split(TimeMax,\"T\")[0])\r\n| project TimeMax);\r\nlet _CurrentDateB = todatetime(toscalar(_currD));\r\nlet BeforeData = ExchangeConfiguration(SpecificSectionList=\"InBoundC\",SpecificConfigurationDate=_DateCompareB,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n | extend Identity = tostring(CmdletResultValue.Identity)\r\n\t| extend State = tostring(CmdletResultValue.Enabled)\r\n\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\r\n\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\r\n\t| extend SenderIPAddresses = tostring(CmdletResultValue.SenderIPAddresses)\r\n\t| extend SenderDomains = tostring(CmdletResultValue.SenderDomains)\r\n\t| extend TrustedOrganizations = tostring(CmdletResultValue.TrustedOrganizations)\r\n\t| extend AssociatedAcceptedDomainsRequireTls = tostring(CmdletResultValue.AssociatedAcceptedDomainsRequireTls)\r\n\t| extend RestrictDomainsToIPAddresses = tostring(CmdletResultValue.RestrictDomainsToIPAddresses)\r\n\t| extend RestrictDomainsToCertificate = tostring(CmdletResultValue.RestrictDomainsToCertificate)\r\n\t| extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\r\n\t| extend TreatMessagesAsInternal = tostring(CmdletResultValue.TreatMessagesAsInternal)\r\n\t| extend TlsSenderCertificateName = tostring(CmdletResultValue.TlsSenderCertificateName)\r\n\t| extend ScanAndDropRecipients = tostring(CmdletResultValue.ScanAndDropRecipients)\r\n\t| extend Comment = tostring(CmdletResultValue.Comment)\r\n | extend WhenChanged = todatetime(WhenChanged)\r\n | extend WhenCreated = todatetime(WhenCreated)\r\n;\r\nlet AfterData = \r\n ExchangeConfiguration(SpecificSectionList=\"InBoundC\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n \t| extend Identity = tostring(CmdletResultValue.Identity)\r\n\t| extend State = tostring(CmdletResultValue.Enabled)\r\n\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\r\n\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\r\n\t| extend SenderIPAddresses = tostring(CmdletResultValue.SenderIPAddresses)\r\n\t| extend SenderDomains = tostring(CmdletResultValue.SenderDomains)\r\n\t| extend TrustedOrganizations = tostring(CmdletResultValue.TrustedOrganizations)\r\n\t| extend AssociatedAcceptedDomainsRequireTls = tostring(CmdletResultValue.AssociatedAcceptedDomainsRequireTls)\r\n\t| extend RestrictDomainsToIPAddresses = tostring(CmdletResultValue.RestrictDomainsToIPAddresses)\r\n\t| extend RestrictDomainsToCertificate = tostring(CmdletResultValue.RestrictDomainsToCertificate)\r\n\t| extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\r\n\t| extend TreatMessagesAsInternal = tostring(CmdletResultValue.TreatMessagesAsInternal)\r\n\t| extend TlsSenderCertificateName = tostring(CmdletResultValue.TlsSenderCertificateName)\r\n\t| extend ScanAndDropRecipients = tostring(CmdletResultValue.ScanAndDropRecipients)\r\n\t| extend Comment = tostring(CmdletResultValue.Comment)\r\n | extend WhenChanged = todatetime(WhenChanged)\r\n | extend WhenCreated = todatetime(WhenCreated)\r\n;\r\nlet i=0;\r\nlet allDataRange = \r\n ESIExchangeOnlineConfig_CL\r\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\r\n | where ESIEnvironment_s == _EnvList\r\n | where ExecutionResult_s <> \"EmptyResult\"\r\n | where Section_s == \"InBoundC\"\r\n | extend CmdletResultValue = parse_json(rawData_s)\r\n | project TimeGenerated,CmdletResultValue,WhenChanged = todatetime(WhenChanged_t), WhenCreated=todatetime(WhenCreated_t)\r\n \t| extend Identity = tostring(CmdletResultValue.Identity)\r\n\t| extend State = tostring(CmdletResultValue.Enabled)\r\n\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\r\n\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\r\n\t| extend SenderIPAddresses = tostring(CmdletResultValue.SenderIPAddresses)\r\n\t| extend SenderDomains = tostring(CmdletResultValue.SenderDomains)\r\n\t| extend TrustedOrganizations = tostring(CmdletResultValue.TrustedOrganizations)\r\n\t| extend AssociatedAcceptedDomainsRequireTls = tostring(CmdletResultValue.AssociatedAcceptedDomainsRequireTls)\r\n\t| extend RestrictDomainsToIPAddresses = tostring(CmdletResultValue.RestrictDomainsToIPAddresses)\r\n\t| extend RestrictDomainsToCertificate = tostring(CmdletResultValue.RestrictDomainsToCertificate)\r\n\t| extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\r\n\t| extend TreatMessagesAsInternal = tostring(CmdletResultValue.TreatMessagesAsInternal)\r\n\t| extend TlsSenderCertificateName = tostring(CmdletResultValue.TlsSenderCertificateName)\r\n\t| extend ScanAndDropRecipients = tostring(CmdletResultValue.ScanAndDropRecipients)\r\n\t| extend Comment = tostring(CmdletResultValue.Comment)\r\n ;\r\nlet DiffAddDataP1 = allDataRange\r\n | join kind = rightanti (AfterData | where WhenCreated >=_DateCompareB) on WhenCreated\r\n;\r\nlet DiffAddDataP2 = allDataRange\r\n | join kind = innerunique (allDataRange ) on WhenCreated\r\n | where WhenCreated >=_DateCompareB\r\n | where bin(WhenCreated,5m)==bin(WhenChanged,5m)\r\n | distinct Identity,State,ConnectorType,ConnectorSource,SenderIPAddresses,SenderDomains,TrustedOrganizations,AssociatedAcceptedDomainsRequireTls,RestrictDomainsToIPAddresses,RestrictDomainsToCertificate,CloudServicesMailEnabled,TreatMessagesAsInternal,TlsSenderCertificateName,ScanAndDropRecipients,Comment,WhenChanged,WhenCreated\r\n ;\r\nlet DiffAddData = union DiffAddDataP1,DiffAddDataP2\r\n| extend Actiontype =\"Add\";\r\nlet DiffRemoveData = allDataRange\r\n | join kind = leftanti AfterData on Identity\r\n | extend Actiontype =\"Remove\"\r\n | distinct Actiontype ,Identity,State,ConnectorType,ConnectorSource,SenderIPAddresses,SenderDomains,TrustedOrganizations,AssociatedAcceptedDomainsRequireTls,RestrictDomainsToIPAddresses,RestrictDomainsToCertificate,CloudServicesMailEnabled,TreatMessagesAsInternal,TlsSenderCertificateName,ScanAndDropRecipients,Comment,WhenCreated\r\n | project WhenChanged=_CurrentDateB,Actiontype,Identity,State,ConnectorType,ConnectorSource,SenderIPAddresses,SenderDomains,TrustedOrganizations,AssociatedAcceptedDomainsRequireTls,RestrictDomainsToIPAddresses,RestrictDomainsToCertificate,CloudServicesMailEnabled,TreatMessagesAsInternal,TlsSenderCertificateName,ScanAndDropRecipients,Comment,WhenCreated\r\n ;\r\nlet DiffModifData = union AfterData,allDataRange\r\n| sort by Identity,WhenChanged asc\r\n| project WhenChanged,Identity,State,ConnectorType,ConnectorSource,SenderIPAddresses,SenderDomains,TrustedOrganizations,AssociatedAcceptedDomainsRequireTls,RestrictDomainsToIPAddresses,RestrictDomainsToCertificate,CloudServicesMailEnabled,TreatMessagesAsInternal,TlsSenderCertificateName,ScanAndDropRecipients,Comment,WhenCreated\r\n| extend Identity = iff( Identity == prev(Identity) and Identity != prev(Identity) and prev(Identity) !=\"\" , strcat(\"πŸ“ \", Identity, \" (\",prev(Identity),\"->\", Identity,\" )\"),Identity)\r\n| extend State = iff( Identity == prev(Identity) and State != prev(State) and prev(State) !=\"\" , strcat(\"πŸ“ \", State, \" (\",prev(State),\"->\", State,\" )\"),State)\r\n| extend ConnectorType = iff( Identity == prev(Identity) and ConnectorType != prev(ConnectorType) and prev(ConnectorType) !=\"\" , strcat(\"πŸ“ \", ConnectorType, \" (\",prev(ConnectorType),\"->\", ConnectorType,\" )\"),ConnectorType)\r\n| extend ConnectorSource = iff( Identity == prev(Identity) and ConnectorSource != prev(ConnectorSource) and prev(ConnectorSource) !=\"\" , strcat(\"πŸ“ \", ConnectorSource, \" (\",prev(ConnectorSource),\"->\", ConnectorSource,\" )\"),ConnectorSource)\r\n| extend SenderIPAddresses = iff( Identity == prev(Identity) and SenderIPAddresses != prev(SenderIPAddresses) and prev(SenderIPAddresses) !=\"\" , strcat(\"πŸ“ \", SenderIPAddresses, \" (\",prev(SenderIPAddresses),\"->\", SenderIPAddresses,\" )\"),SenderIPAddresses)\r\n| extend SenderDomains = iff( Identity == prev(Identity) and SenderDomains != prev(SenderDomains) and prev(SenderDomains) !=\"\" , strcat(\"πŸ“ \", SenderDomains, \" (\",prev(SenderDomains),\"->\", SenderDomains,\" )\"),SenderDomains)\r\n| extend TrustedOrganizations = iff( Identity == prev(Identity) and TrustedOrganizations != prev(TrustedOrganizations) and prev(TrustedOrganizations) !=\"\" , strcat(\"πŸ“ \", TrustedOrganizations, \" (\",prev(TrustedOrganizations),\"->\", TrustedOrganizations,\" )\"),TrustedOrganizations)\r\n| extend AssociatedAcceptedDomainsRequireTls = iff (Identity == prev(Identity) and AssociatedAcceptedDomainsRequireTls != prev(AssociatedAcceptedDomainsRequireTls) and prev(AssociatedAcceptedDomainsRequireTls) !=\"\" , strcat(\"πŸ“ \", AssociatedAcceptedDomainsRequireTls, \" (\",prev(AssociatedAcceptedDomainsRequireTls),\"->\", AssociatedAcceptedDomainsRequireTls,\" )\"),AssociatedAcceptedDomainsRequireTls)\r\n| extend RestrictDomainsToIPAddresses = iff(Identity == prev(Identity) and RestrictDomainsToIPAddresses != prev(RestrictDomainsToIPAddresses) and prev(RestrictDomainsToIPAddresses) !=\"\" , strcat(\"πŸ“ \", RestrictDomainsToIPAddresses, \" (\",prev(RestrictDomainsToIPAddresses),\"->\", RestrictDomainsToIPAddresses,\" )\"),RestrictDomainsToIPAddresses)\r\n| extend RestrictDomainsToCertificate = iff( Identity == prev(Identity) and RestrictDomainsToCertificate != prev(RestrictDomainsToCertificate) and prev(RestrictDomainsToCertificate) !=\"\" , strcat(\"πŸ“ \", RestrictDomainsToCertificate, \" (\",prev(RestrictDomainsToCertificate),\"->\", RestrictDomainsToCertificate,\" )\"),RestrictDomainsToCertificate)\r\n| extend CloudServicesMailEnabled = iff( Identity == prev(Identity) and CloudServicesMailEnabled != prev(CloudServicesMailEnabled) and prev(CloudServicesMailEnabled) !=\"\" , strcat(\"πŸ“ \", CloudServicesMailEnabled, \" (\",prev(CloudServicesMailEnabled),\"->\", CloudServicesMailEnabled,\" )\"),CloudServicesMailEnabled)\r\n| extend TreatMessagesAsInternal = iff( Identity == prev(Identity) and TreatMessagesAsInternal != prev(TreatMessagesAsInternal) and prev(TreatMessagesAsInternal) !=\"\" , strcat(\"πŸ“ \", TreatMessagesAsInternal, \" (\",prev(TreatMessagesAsInternal),\"->\", TreatMessagesAsInternal,\" )\"),TreatMessagesAsInternal)\r\n| extend TlsSenderCertificateName = iff(Identity == prev(Identity) and TlsSenderCertificateName != prev(TlsSenderCertificateName) and prev(TlsSenderCertificateName) !=\"\" , strcat(\"πŸ“ \", TlsSenderCertificateName, \" (\",prev(TlsSenderCertificateName),\"->\", TlsSenderCertificateName,\" )\"),TlsSenderCertificateName)\r\n| extend ScanAndDropRecipients = iff( Identity == prev(Identity) and ScanAndDropRecipients != prev(ScanAndDropRecipients) and prev(ScanAndDropRecipients) !=\"\" , strcat(\"πŸ“ \", ScanAndDropRecipients, \" (\",prev(ScanAndDropRecipients),\"->\", ScanAndDropRecipients,\" )\"),ScanAndDropRecipients)\r\n| extend Comment = iff( Identity == prev(Identity) and Comment != prev(Comment) and prev(Comment) !=\"\" , strcat(\"πŸ“ \", Comment, \" (\",prev(Comment),\"->\", Comment,\" )\"),Comment)\r\n| extend ActiontypeR =iff((Identity contains \"πŸ“\" or State contains \"πŸ“\" or ConnectorType contains \"πŸ“\" or ConnectorSource contains \"πŸ“\" or SenderIPAddresses contains \"πŸ“\" or SenderDomains contains \"πŸ“\" or TrustedOrganizations contains \"πŸ“\" or AssociatedAcceptedDomainsRequireTls contains \"πŸ“\" or RestrictDomainsToIPAddresses contains \"πŸ“\" or RestrictDomainsToCertificate contains \"πŸ“\" or CloudServicesMailEnabled contains \"πŸ“\" or TreatMessagesAsInternal contains \"πŸ“\" or TlsSenderCertificateName contains \"πŸ“\" or ScanAndDropRecipients contains \"πŸ“\" or Comment contains \"πŸ“\" ), i=i + 1, i)\r\n| extend Actiontype =iff(ActiontypeR > 0, \"Modif\", \"NO\")\r\n| where ActiontypeR == 1\r\n| project WhenChanged,Actiontype,Identity,State,ConnectorType,ConnectorSource,SenderIPAddresses,SenderDomains,TrustedOrganizations,AssociatedAcceptedDomainsRequireTls,RestrictDomainsToIPAddresses,RestrictDomainsToCertificate,CloudServicesMailEnabled,TreatMessagesAsInternal,TlsSenderCertificateName,ScanAndDropRecipients,Comment,WhenCreated\r\n;\r\nunion DiffAddData, DiffRemoveData, DiffModifData\r\n| extend WhenChanged = iff (Actiontype == \"Modif\", WhenChanged, iff(Actiontype == \"Add\",WhenCreated, WhenChanged))\r\n| extend Actiontype = case(Actiontype == \"Add\", strcat(\"βž• \", Actiontype), Actiontype == \"Remove\", strcat(\"βž– \", Actiontype), Actiontype == \"Modif\", strcat(\"πŸ“ \", Actiontype), \"N/A\")\r\n| sort by WhenChanged desc \r\n| project\r\n WhenChanged,\r\n Actiontype,\r\n Identity,\r\n State,\r\n ConnectorType,\r\n ConnectorSource,\r\n Comment,\r\n SenderIPAddresses,\r\n SenderDomains,\r\n TrustedOrganizations,\r\n AssociatedAcceptedDomainsRequireTls,\r\n RestrictDomainsToIPAddresses,\r\n RestrictDomainsToCertificate,\r\n CloudServicesMailEnabled,\r\n TreatMessagesAsInternal,\r\n TlsSenderCertificateName,\r\n ScanAndDropRecipients,\r\n WhenCreated", + "size": 3, + "showAnalytics": true, + "title": "Display changes ( Add, Remove, modifications of parameters )", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Identity" + ], + "expandTopLevel": true + } + } + }, + "conditionalVisibility": { + "parameterName": "Compare_Collect", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 2" } ] }, @@ -638,6 +832,34 @@ }, "name": "Outbound Connector configuration - Copy" }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let _EnvList ={EnvironmentList};\r\nlet _TypeEnv = \"Online\";\r\nlet _DateCompare = \"{DateCompare:value}\";\r\nlet _CurrentDate = \"{DateOfConfiguration:value}\";\r\nlet _DateCompareB = todatetime(_DateCompare);\r\nlet _currD = (ExchangeConfiguration(SpecificSectionList=\"OutBoundC\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n| summarize TimeMax = arg_max(TimeGenerated,*)\r\n| extend TimeMax = tostring(split(TimeMax,\"T\")[0])\r\n| project TimeMax);\r\nlet _CurrentDateB = todatetime(toscalar(_currD));\r\nlet BeforeData = ExchangeConfiguration(SpecificSectionList=\"OutBoundC\",SpecificConfigurationDate=_DateCompareB,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n | extend Identity = tostring(CmdletResultValue.Identity)\r\n\t| extend State = tostring(CmdletResultValue.Enabled)\r\n | extend UseMXRecord = tostring(CmdletResultValue.UseMXRecord)\r\n\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\r\n\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\r\n\t| extend RecipientDomains = tostring(CmdletResultValue.RecipientDomains)\r\n | extend SmartHosts = tostring(CmdletResultValue.SmartHosts)\r\n | extend TlsDomain = tostring(CmdletResultValue.TlsDomain)\r\n | extend TlsSettings = tostring(CmdletResultValue.TlsSettings)\r\n | extend IsTransportRuleScoped = tostring(CmdletResultValue.IsTransportRuleScoped)\r\n | extend RouteAllMessagesViaOnPremises = tostring(CmdletResultValue.RouteAllMessagesViaOnPremises)\r\n | extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\r\n | extend AllAcceptedDomains = tostring(CmdletResultValue.AllAcceptedDomains)\r\n | extend SenderRewritingEnabled = tostring(CmdletResultValue.SenderRewritingEnabled)\r\n | extend TestMode = tostring(CmdletResultValue.TestMode)\r\n | extend LinkForModifiedConnector = tostring(CmdletResultValue.LinkForModifiedConnector)\r\n | extend ValidationRecipients = tostring(CmdletResultValue.ValidationRecipients)\r\n | extend IsValidated = tostring(CmdletResultValue.IsValidated)\r\n | extend LastValidationTimestamp = tostring(CmdletResultValue.LastValidationTimestamp)\r\n | extend Comment = tostring(CmdletResultValue.Comment)\r\n | extend WhenChanged = todatetime(WhenChanged)\r\n | extend WhenCreated = todatetime(WhenCreated)\r\n;\r\nlet AfterData = \r\n ExchangeConfiguration(SpecificSectionList=\"OutBoundC\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n | extend Identity = tostring(CmdletResultValue.Identity)\r\n\t| extend State = tostring(CmdletResultValue.Enabled)\r\n | extend UseMXRecord = tostring(CmdletResultValue.UseMXRecord)\r\n\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\r\n\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\r\n\t| extend RecipientDomains = tostring(CmdletResultValue.RecipientDomains)\r\n | extend SmartHosts = tostring(CmdletResultValue.SmartHosts)\r\n | extend TlsDomain = tostring(CmdletResultValue.TlsDomain)\r\n | extend TlsSettings = tostring(CmdletResultValue.TlsSettings)\r\n | extend IsTransportRuleScoped = tostring(CmdletResultValue.IsTransportRuleScoped)\r\n | extend RouteAllMessagesViaOnPremises = tostring(CmdletResultValue.RouteAllMessagesViaOnPremises)\r\n | extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\r\n | extend AllAcceptedDomains = tostring(CmdletResultValue.AllAcceptedDomains)\r\n | extend SenderRewritingEnabled = tostring(CmdletResultValue.SenderRewritingEnabled)\r\n | extend TestMode = tostring(CmdletResultValue.TestMode)\r\n | extend LinkForModifiedConnector = tostring(CmdletResultValue.LinkForModifiedConnector)\r\n | extend ValidationRecipients = tostring(CmdletResultValue.ValidationRecipients)\r\n | extend IsValidated = tostring(CmdletResultValue.IsValidated)\r\n | extend LastValidationTimestamp = tostring(CmdletResultValue.LastValidationTimestamp)\r\n | extend Comment = tostring(CmdletResultValue.Comment)\r\n | extend WhenChanged = todatetime(WhenChanged)\r\n | extend WhenCreated = todatetime(WhenCreated)\r\n;\r\nlet i=0;\r\nlet allDataRange = \r\n ESIExchangeOnlineConfig_CL\r\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\r\n | where ESIEnvironment_s == _EnvList\r\n | where ExecutionResult_s <> \"EmptyResult\"\r\n | where Section_s == \"OutBoundC\"\r\n | extend CmdletResultValue = parse_json(rawData_s)\r\n | project TimeGenerated,CmdletResultValue,WhenChanged = todatetime(WhenChanged_t), WhenCreated=todatetime(WhenCreated_t)\r\n \t| extend Identity = tostring(CmdletResultValue.Identity)\r\n\t| extend State = tostring(CmdletResultValue.Enabled)\r\n | extend UseMXRecord = tostring(CmdletResultValue.UseMXRecord)\r\n\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\r\n\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\r\n\t| extend RecipientDomains = tostring(CmdletResultValue.RecipientDomains)\r\n | extend SmartHosts = tostring(CmdletResultValue.SmartHosts)\r\n | extend TlsDomain = tostring(CmdletResultValue.TlsDomain)\r\n | extend TlsSettings = tostring(CmdletResultValue.TlsSettings)\r\n | extend IsTransportRuleScoped = tostring(CmdletResultValue.IsTransportRuleScoped)\r\n | extend RouteAllMessagesViaOnPremises = tostring(CmdletResultValue.RouteAllMessagesViaOnPremises)\r\n | extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\r\n | extend AllAcceptedDomains = tostring(CmdletResultValue.AllAcceptedDomains)\r\n | extend SenderRewritingEnabled = tostring(CmdletResultValue.SenderRewritingEnabled)\r\n | extend TestMode = tostring(CmdletResultValue.TestMode)\r\n | extend LinkForModifiedConnector = tostring(CmdletResultValue.LinkForModifiedConnector)\r\n | extend ValidationRecipients = tostring(CmdletResultValue.ValidationRecipients)\r\n | extend IsValidated = tostring(CmdletResultValue.IsValidated)\r\n | extend LastValidationTimestamp = tostring(CmdletResultValue.LastValidationTimestamp)\r\n | extend Comment = tostring(CmdletResultValue.Comment)\r\n ;\r\nlet DiffAddDataP1 = allDataRange\r\n | join kind = rightanti (AfterData | where WhenCreated >=_DateCompareB) on WhenCreated\r\n;\r\nlet DiffAddDataP2 = allDataRange\r\n | join kind = innerunique (allDataRange ) on WhenCreated\r\n | where WhenCreated >=_DateCompareB\r\n | where bin(WhenCreated,5m)==bin(WhenChanged,5m)\r\n | distinct Identity,State,ConnectorType,ConnectorSource,UseMXRecord,RecipientDomains,SmartHosts,TlsDomain,TlsSettings,IsTransportRuleScoped,RouteAllMessagesViaOnPremises,CloudServicesMailEnabled,AllAcceptedDomains,SenderRewritingEnabled,TestMode,LinkForModifiedConnector,ValidationRecipients,IsValidated,LastValidationTimestamp,Comment,WhenCreated\r\n ;\r\nlet DiffAddData = union DiffAddDataP1,DiffAddDataP2\r\n| extend Actiontype =\"Add\";\r\nlet DiffRemoveData = allDataRange\r\n | join kind = leftanti AfterData on Identity\r\n | extend Actiontype =\"Remove\"\r\n | distinct Actiontype ,Identity,State,ConnectorType,ConnectorSource,UseMXRecord,RecipientDomains,SmartHosts,TlsDomain,TlsSettings,IsTransportRuleScoped,RouteAllMessagesViaOnPremises,CloudServicesMailEnabled,AllAcceptedDomains,SenderRewritingEnabled,TestMode,LinkForModifiedConnector,ValidationRecipients,IsValidated,LastValidationTimestamp,Comment,WhenCreated\r\n | project WhenChanged=_CurrentDateB,Actiontype,Identity,State,ConnectorType,ConnectorSource,UseMXRecord,RecipientDomains,SmartHosts,TlsDomain,TlsSettings,IsTransportRuleScoped,RouteAllMessagesViaOnPremises,CloudServicesMailEnabled,AllAcceptedDomains,SenderRewritingEnabled,TestMode,LinkForModifiedConnector,ValidationRecipients,IsValidated,LastValidationTimestamp,Comment,WhenCreated\r\n ;\r\nlet DiffModifData = union AfterData,allDataRange\r\n| sort by Identity,WhenChanged asc\r\n| project WhenChanged,Identity,State,ConnectorType,ConnectorSource,UseMXRecord,RecipientDomains,SmartHosts,TlsDomain,TlsSettings,IsTransportRuleScoped,RouteAllMessagesViaOnPremises,CloudServicesMailEnabled,AllAcceptedDomains,SenderRewritingEnabled,TestMode,LinkForModifiedConnector,ValidationRecipients,IsValidated,LastValidationTimestamp,Comment,WhenCreated\r\n| extend Identity = iff( Identity == prev(Identity) and Identity != prev(Identity) and prev(Identity) !=\"\" , strcat(\"πŸ“ \", Identity, \" (\",prev(Identity),\"->\", Identity,\" )\"),Identity)\r\n| extend State = iff( Identity == prev(Identity) and State != prev(State) and prev(State) !=\"\" , strcat(\"πŸ“ \", State, \" (\",prev(State),\"->\", State,\" )\"),State)\r\n| extend ConnectorType = iff( Identity == prev(Identity) and ConnectorType != prev(ConnectorType) and prev(ConnectorType) !=\"\" , strcat(\"πŸ“ \", ConnectorType, \" (\",prev(ConnectorType),\"->\", ConnectorType,\" )\"),ConnectorType)\r\n| extend ConnectorSource = iff( Identity == prev(Identity) and ConnectorSource != prev(ConnectorSource) and prev(ConnectorSource) !=\"\" , strcat(\"πŸ“ \", ConnectorSource, \" (\",prev(ConnectorSource),\"->\", ConnectorSource,\" )\"),ConnectorSource)\r\n| extend CloudServicesMailEnabled = iff( Identity == prev(Identity) and CloudServicesMailEnabled != prev(CloudServicesMailEnabled) and prev(CloudServicesMailEnabled) !=\"\" , strcat(\"πŸ“ \", CloudServicesMailEnabled, \" (\",prev(CloudServicesMailEnabled),\"->\", CloudServicesMailEnabled,\" )\"),CloudServicesMailEnabled)\r\n| extend Comment = iff( Comment == prev(Comment) and Comment != prev(Comment) and prev(Comment) !=\"\" , strcat(\"πŸ“ \", Comment, \" (\",prev(Comment),\"->\", Comment,\" )\"),Comment)\r\n| extend RecipientDomains = iff( Identity == prev(Identity) and RecipientDomains != prev(RecipientDomains) and prev(RecipientDomains) !=\"\" , strcat(\"πŸ“ \", RecipientDomains, \" (\",prev(RecipientDomains),\"->\", RecipientDomains,\" )\"),RecipientDomains)\r\n| extend SmartHosts = iff( Identity == prev(Identity) and SmartHosts != prev(SmartHosts) and prev(SmartHosts) !=\"\" , strcat(\"πŸ“ \", SmartHosts, \" (\",prev(SmartHosts),\"->\", SmartHosts,\" )\"),SmartHosts)\r\n| extend TlsDomain = iff( Identity == prev(Identity) and TlsDomain != prev(TlsDomain) and prev(TlsDomain) !=\"\" , strcat(\"πŸ“ \", TlsDomain, \" (\",prev(TlsDomain),\"->\", TlsDomain,\" )\"),TlsDomain)\r\n| extend IsTransportRuleScoped = iff( Identity == prev(Identity) and IsTransportRuleScoped != prev(IsTransportRuleScoped) and prev(IsTransportRuleScoped) !=\"\" , strcat(\"πŸ“ \", IsTransportRuleScoped, \" (\",prev(IsTransportRuleScoped),\"->\", IsTransportRuleScoped,\" )\"),IsTransportRuleScoped)\r\n| extend RouteAllMessagesViaOnPremises = iff( Identity == prev(Identity) and RouteAllMessagesViaOnPremises != prev(RouteAllMessagesViaOnPremises) and prev(RouteAllMessagesViaOnPremises) !=\"\" , strcat(\"πŸ“ \", RouteAllMessagesViaOnPremises, \" (\",prev(RouteAllMessagesViaOnPremises),\"->\", RouteAllMessagesViaOnPremises,\" )\"),RouteAllMessagesViaOnPremises)\r\n| extend AllAcceptedDomains = iff( Identity == prev(Identity) and AllAcceptedDomains != prev(AllAcceptedDomains) and prev(AllAcceptedDomains) !=\"\" , strcat(\"πŸ“ \", AllAcceptedDomains, \" (\",prev(AllAcceptedDomains),\"->\", AllAcceptedDomains,\" )\"),AllAcceptedDomains)\r\n| extend SenderRewritingEnabled = iff( Identity == prev(Identity) and SenderRewritingEnabled != prev(SenderRewritingEnabled) and prev(SenderRewritingEnabled) !=\"\" , strcat(\"πŸ“ \", SenderRewritingEnabled, \" (\",prev(SenderRewritingEnabled),\"->\", SenderRewritingEnabled,\" )\"),SenderRewritingEnabled)\r\n| extend TestMode = iff( Identity == prev(Identity)and TestMode != prev(TestMode) and prev(TestMode) !=\"\" , strcat(\"πŸ“ \", TestMode, \" (\",prev(TestMode),\"->\", TestMode,\" )\"),TestMode)\r\n| extend LinkForModifiedConnector = iff( Identity == prev(Identity) and LinkForModifiedConnector != prev(LinkForModifiedConnector) and prev(LinkForModifiedConnector) !=\"\" , strcat(\"πŸ“ \", LinkForModifiedConnector, \" (\",prev(LinkForModifiedConnector),\"->\", LinkForModifiedConnector,\" )\"),LinkForModifiedConnector)\r\n| extend ValidationRecipients = iff( Identity == prev(Identity) and ValidationRecipients != prev(ValidationRecipients) and prev(ValidationRecipients) !=\"\" , strcat(\"πŸ“ \", ValidationRecipients, \" (\",prev(ValidationRecipients),\"->\", ValidationRecipients,\" )\"),ValidationRecipients)\r\n| extend IsValidated = iff( Identity == prev(Identity) and IsValidated != prev(IsValidated) and prev(IsValidated) !=\"\" , strcat(\"πŸ“ \", IsValidated, \" (\",prev(IsValidated),\"->\", IsValidated,\" )\"),IsValidated)\r\n| extend LastValidationTimestamp = iff( Identity == prev(Identity) and LastValidationTimestamp != prev(LastValidationTimestamp) and prev(LastValidationTimestamp) !=\"\" , strcat(\"πŸ“ \", LastValidationTimestamp, \" (\",prev(LastValidationTimestamp),\"->\", LastValidationTimestamp,\" )\"),LastValidationTimestamp)\r\n| extend Comment = iff( Identity == prev(Identity) and Comment != prev(Comment) and prev(Comment) !=\"\" , strcat(\"πŸ“ \", Comment, \" (\",prev(Comment),\"->\", Comment,\" )\"),Comment)\r\n| extend ActiontypeR =iff((Identity contains \"πŸ“\" or State contains \"πŸ“\" or ConnectorType contains \"πŸ“\" or ConnectorSource contains \"πŸ“\"or CloudServicesMailEnabled contains \"πŸ“\" or Comment contains \"πŸ“\" or UseMXRecord contains \"πŸ“\" or RecipientDomains contains \"πŸ“\" or SmartHosts contains \"πŸ“\" or TlsDomain contains \"πŸ“\" or TlsSettings contains \"πŸ“\" or IsTransportRuleScoped contains \"πŸ“\" or RouteAllMessagesViaOnPremises contains \"πŸ“\" or AllAcceptedDomains contains \"πŸ“\" or SenderRewritingEnabled contains \"πŸ“\" or TestMode contains \"πŸ“\" or LinkForModifiedConnector contains \"πŸ“\" or ValidationRecipients contains \"πŸ“\" or IsValidated contains \"πŸ“\" or LastValidationTimestamp contains \"πŸ“\" ), i=i + 1, i)\r\n| extend Actiontype =iff(ActiontypeR > 0, \"Modif\", \"NO\")\r\n| where ActiontypeR == 1\r\n| project WhenChanged,Actiontype,Identity,State,ConnectorType,ConnectorSource,UseMXRecord,RecipientDomains,SmartHosts,TlsDomain,TlsSettings,IsTransportRuleScoped,RouteAllMessagesViaOnPremises,CloudServicesMailEnabled,AllAcceptedDomains,SenderRewritingEnabled,TestMode,LinkForModifiedConnector,ValidationRecipients,IsValidated,LastValidationTimestamp,Comment,WhenCreated\r\n;\r\nunion DiffAddData, DiffRemoveData, DiffModifData\r\n| extend WhenChanged = iff (Actiontype == \"Modif\", WhenChanged, iff(Actiontype == \"Add\",WhenCreated, WhenChanged))\r\n| extend Actiontype = case(Actiontype == \"Add\", strcat(\"βž• \", Actiontype), Actiontype == \"Remove\", strcat(\"βž– \", Actiontype), Actiontype == \"Modif\", strcat(\"πŸ“ \", Actiontype), \"N/A\")\r\n| sort by WhenChanged desc \r\n| project\r\n WhenChanged,\r\n Actiontype,\r\n Identity,\r\n State,\r\n ConnectorType,\r\n ConnectorSource, \r\n CloudServicesMailEnabled,\r\n Comment,\r\n UseMXRecord,\r\n RecipientDomains,\r\n SmartHosts,\r\n TlsDomain,\r\n TlsSettings,\r\n IsTransportRuleScoped,\r\n RouteAllMessagesViaOnPremises,\r\n AllAcceptedDomains,\r\n SenderRewritingEnabled,\r\n TestMode,\r\n LinkForModifiedConnector,\r\n ValidationRecipients,\r\n IsValidated,\r\n LastValidationTimestamp,\r\n WhenCreated", + "size": 3, + "showAnalytics": true, + "title": "Display changes ( Add, Remove, modifications of parameters )", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Identity" + ], + "expandTopLevel": true + } + } + }, + "conditionalVisibility": { + "parameterName": "Compare_Collect", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 4" + }, { "type": 12, "content": { @@ -662,7 +884,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "ExchangeConfiguration(SpecificSectionList=\"TransportRule\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| project CmdletResultValue\r\n| extend Identity = iif( CmdletResultValue.Identity contains \"OrgHierarchyToIgnore\",tostring(CmdletResultValue.Identity.Name),tostring(CmdletResultValue.Identity))\r\n| extend State = tostring(CmdletResultValue.State)\r\n| extend SentTo = tostring(CmdletResultValue.SentToString)\r\n| extend BlindCopyTo = tostring(CmdletResultValue.BlindCopyToString)\r\n| extend CopyTo = tostring(CmdletResultValue.CopyToString)\r\n| extend RedirectMessageTo = tostring(CmdletResultValue.RedirectMessageToString)\r\n| extend Mode = tostring(CmdletResultValue.Identity.Mode)\r\n| project-away CmdletResultValue\r\n| sort by Identity asc", + "query": "ExchangeConfiguration(SpecificSectionList=\"TransportRule\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| project CmdletResultValue\r\n| extend Identity = iif( CmdletResultValue.Identity contains \"OrgHierarchyToIgnore\",tostring(CmdletResultValue.Identity.Name),tostring(CmdletResultValue.Identity))\r\n| extend State = tostring(CmdletResultValue.State)\r\n| extend SentTo = tostring(CmdletResultValue.SentToString)\r\n| extend BlindCopyTo = tostring(CmdletResultValue.BlindCopyToString)\r\n| extend CopyTo = tostring(CmdletResultValue.CopyToString)\r\n| extend RedirectMessageTo = tostring(CmdletResultValue.RedirectMessageToString)\r\n| extend SetSCL = tostring(CmdletResultValue.SetSCL)\r\n| extend SenderIpRangesString = tostring(CmdletResultValue.SenderIpRangesString)\r\n| extend MessageTypeMatchesString = tostring(CmdletResultValue.MessageTypeMatchesString)\r\n| extend Mode = tostring(CmdletResultValue.Mode)\r\n| project-away CmdletResultValue\r\n| sort by Identity asc", "size": 1, "showAnalytics": true, "showExportToExcel": true, @@ -678,6 +900,113 @@ }, "name": "Transport Rules actions to monitor" }, + { + "type": 1, + "content": { + "json": "** Due to lack of informaiton in Powershell, the Transport Rule compare section could display approximate information for Add and Modif. Especially, for the WhenCreated parameter." + }, + "name": "text - 7" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let _EnvList ={EnvironmentList};\r\nlet _TypeEnv = \"Online\";\r\nlet _DateCompare = \"{DateCompare:value}\";\r\nlet _CurrentDate = \"{DateOfConfiguration:value}\";\r\nlet _DateCompareB = todatetime(_DateCompare);\r\nlet _currD = (ExchangeConfiguration(SpecificSectionList=\"TransportRule\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n| summarize TimeMax = arg_max(TimeGenerated,*)\r\n| extend TimeMax = tostring(split(TimeMax,\"T\")[0])\r\n| project TimeMax);\r\nlet _CurrentDateB = todatetime(toscalar(_currD));\r\nlet BeforeData = ExchangeConfiguration(SpecificSectionList=\"TransportRule\",SpecificConfigurationDate=_DateCompareB,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n | extend Identity = tostring(CmdletResultValue.Identity)\r\n\t| extend SentTo = tostring(CmdletResultValue.SentToString)\r\n\t| extend BlindCopyTo = tostring(CmdletResultValue.BlindCopyToString)\r\n\t| extend CopyTo = tostring(CmdletResultValue.CopyToString)\r\n\t| extend RedirectMessageTo = tostring(CmdletResultValue.RedirectMessageToString)\r\n\t| extend Mode = tostring(CmdletResultValue.Mode)\r\n | extend SetSCL = tostring(CmdletResultValue.SetSCL)\r\n | extend SenderIpRangesString = tostring(CmdletResultValue.SenderIpRangesString)\r\n | extend MessageTypeMatchesString = tostring(CmdletResultValue.MessageTypeMatchesString)\r\n | extend CmdletResultValue.RedirectMessageToString\r\n\t| extend WhenChanged = todatetime(WhenChanged)\r\n | extend WhenCreated = todatetime(WhenCreated)\r\n;\r\nlet AfterData = \r\n ExchangeConfiguration(SpecificSectionList=\"TransportRule\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n | extend Identity = tostring(CmdletResultValue.Identity)\r\n\t| extend SentTo = tostring(CmdletResultValue.SentToString)\r\n\t| extend BlindCopyTo = tostring(CmdletResultValue.BlindCopyToString)\r\n\t| extend CopyTo = tostring(CmdletResultValue.CopyToString)\r\n\t| extend RedirectMessageTo = tostring(CmdletResultValue.RedirectMessageToString)\r\n\t| extend Mode = tostring(CmdletResultValue.Mode)\r\n | extend SetSCL = tostring(CmdletResultValue.SetSCL)\r\n | extend SenderIpRangesString = tostring(CmdletResultValue.SenderIpRangesString)\r\n | extend MessageTypeMatchesString = tostring(CmdletResultValue.MessageTypeMatchesString)\r\n\t| extend WhenChanged = todatetime(WhenChanged)\r\n | extend WhenCreated = todatetime(WhenCreated)\r\n;\r\nlet i=0;\r\nlet allDataRange =\r\n ESIExchangeOnlineConfig_CL\r\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\r\n | where ESIEnvironment_s == _EnvList\r\n | where ExecutionResult_s <> \"EmptyResult\"\r\n | where Section_s == \"TransportRule\"\r\n | extend CmdletResultValue = parse_json(rawData_s)\r\n | project TimeGenerated,CmdletResultValue,WhenChanged = todatetime(WhenChanged_t), WhenCreated=todatetime(WhenCreated_t)\r\n | extend Identity = tostring(CmdletResultValue.Identity)\r\n\t| sort by Identity,TimeGenerated asc\r\n | extend SentTo = tostring(CmdletResultValue.SentToString)\r\n\t| extend BlindCopyTo = tostring(CmdletResultValue.BlindCopyToString)\r\n\t| extend CopyTo = tostring(CmdletResultValue.CopyToString)\r\n\t| extend RedirectMessageTo = tostring(CmdletResultValue.RedirectMessageToString)\r\n\t| extend Mode = tostring(CmdletResultValue.Mode)\r\n | extend CmdletResultValue.RedirectMessageToString\r\n | extend SetSCL = tostring(CmdletResultValue.SetSCL)\r\n | extend SenderIpRangesString = tostring(CmdletResultValue.SenderIpRangesString)\r\n | extend MessageTypeMatchesString = tostring(CmdletResultValue.MessageTypeMatchesString)\r\n | extend WhenChanged = todatetime(bin(WhenChanged,1m))\r\n | extend aa=prev(WhenCreated)\r\n | extend WhenCreated = iff( Identity == prev(Identity) and WhenChanged != prev(WhenChanged),aa ,WhenChanged)\r\n | extend WhenCreated =bin(WhenCreated,1m)\r\n ;\r\nlet DiffAddDataP1 = allDataRange\r\n | join kind = rightanti (AfterData | where WhenCreated >=_DateCompareB) on WhenCreated\r\n;\r\nlet DiffAddDataP2 = allDataRange\r\n | join kind = inner (allDataRange ) on WhenCreated\r\n | where WhenCreated >=_DateCompareB\r\n | where bin(WhenCreated,5m)==bin(WhenChanged,5m)\r\n | distinct Identity,SentTo,BlindCopyTo,CopyTo,RedirectMessageTo,Mode,SetSCL,SenderIpRangesString,MessageTypeMatchesString,WhenChanged,WhenCreated\r\n ;\r\nlet DiffAddData1 = union DiffAddDataP1,DiffAddDataP2\r\n| extend Actiontype =\"Add\";\r\nlet DiffAddData2 = union DiffAddDataP1,DiffAddDataP2\r\n| extend Actiontype =\"Add\"\r\n| distinct Identity;\r\nlet DiffAddData = DiffAddData1\r\n| join DiffAddData2 on Identity\r\n;\r\nlet DiffRemoveData = allDataRange\r\n | join kind = leftanti AfterData on Identity\r\n | extend Actiontype =\"Remove\"\r\n | distinct Actiontype ,Identity,SentTo,BlindCopyTo,CopyTo,RedirectMessageTo,SetSCL,SenderIpRangesString,MessageTypeMatchesString,Mode,WhenChanged,WhenCreated\r\n | project WhenChanged=_CurrentDateB,Actiontype,Identity,SentTo,BlindCopyTo,CopyTo,RedirectMessageTo,SetSCL,SenderIpRangesString,MessageTypeMatchesString,Mode,WhenCreated\r\n ;\r\nlet DiffModifData = union AfterData,allDataRange\r\n| sort by Identity,WhenChanged asc\r\n| project WhenChanged,Identity,SentTo,BlindCopyTo,CopyTo,RedirectMessageTo, SetSCL, SenderIpRangesString,MessageTypeMatchesString,Mode,WhenCreated\r\n| extend Identity = iff( Identity == prev(Identity) and Identity != prev(Identity) and prev(Identity) !=\"\" , strcat(\"πŸ“ \", Identity, \" (\",prev(Identity),\"->\", Identity,\" )\"),Identity)\r\n| extend SentTo = iff( Identity == prev(Identity) and SentTo != prev(SentTo) and prev(SentTo) !=\"\" , strcat(\"πŸ“ \", SentTo, \" (\",prev(SentTo),\"->\", SentTo,\" )\"),SentTo)\r\n| extend BlindCopyTo = iff( Identity == prev(Identity) and BlindCopyTo != prev(BlindCopyTo) and prev(BlindCopyTo) !=\"\" , strcat(\"πŸ“ \", BlindCopyTo, \" (\",prev(BlindCopyTo),\"->\", BlindCopyTo,\" )\"),BlindCopyTo)\r\n| extend CopyTo = iff( Identity == prev(Identity) and CopyTo != prev(CopyTo) and prev(CopyTo) !=\"\" , strcat(\"πŸ“ \", CopyTo, \" (\",prev(CopyTo),\"->\", CopyTo,\" )\"),CopyTo)\r\n| extend SetSCL = iff( Identity == prev(Identity)and SetSCL != prev(SetSCL) and prev(SetSCL) !=\"\" , strcat(\"πŸ“ \", SetSCL, \" (\",prev(SetSCL),\"->\", SetSCL,\" )\"),SetSCL)\r\n| extend SenderIpRangesString = iff( Identity == prev(Identity)and SenderIpRangesString != prev(SenderIpRangesString) and prev(SenderIpRangesString) !=\"\" , strcat(\"πŸ“ \", SenderIpRangesString, \" (\",prev(SenderIpRangesString),\"->\", SenderIpRangesString,\" )\"),SenderIpRangesString)\r\n| extend MessageTypeMatchesString = iff( Identity == prev(Identity)and MessageTypeMatchesString != prev(MessageTypeMatchesString) and prev(MessageTypeMatchesString) !=\"\" , strcat(\"πŸ“ \", MessageTypeMatchesString, \" (\",prev(MessageTypeMatchesString),\"->\", MessageTypeMatchesString,\" )\"),MessageTypeMatchesString)\r\n| extend Mode = iff( Identity == prev(Identity)and Mode != prev(Mode) and prev(Mode) !=\"\" , strcat(\"πŸ“ \", Mode, \" (\",prev(Mode),\"->\", Mode,\" )\"),Mode)\r\n| extend ActiontypeR =iff((Identity contains \"πŸ“\" or SentTo contains \"πŸ“\" or BlindCopyTo contains \"πŸ“\" or CopyTo contains \"πŸ“\" or SetSCL contains \"πŸ“\" or SenderIpRangesString contains \"πŸ“\" or MessageTypeMatchesString contains \"πŸ“\" or Mode contains \"πŸ“\" ), i=i + 1, i)\r\n| extend Actiontype =iff(ActiontypeR > 0, \"Modif\", \"NO\")\r\n| where ActiontypeR == 1\r\n| project WhenChanged,Actiontype,Identity,SentTo,BlindCopyTo,CopyTo,RedirectMessageTo,SetSCL,SenderIpRangesString,MessageTypeMatchesString,Mode,WhenCreated\r\n;\r\nunion DiffAddData, DiffRemoveData, DiffModifData\r\n| extend WhenChanged = iff (Actiontype == \"Modif\", WhenChanged, iff(Actiontype == \"Add\",WhenCreated, WhenChanged))\r\n| extend Actiontype = case(Actiontype == \"Add\", strcat(\"βž• \", Actiontype), Actiontype == \"Remove\", strcat(\"βž– \", Actiontype), Actiontype == \"Modif\", strcat(\"πŸ“ \", Actiontype), \"N/A\")\r\n| sort by WhenChanged desc \r\n| project\r\n WhenChanged,\r\n Actiontype,\r\n Identity,\r\n SentTo,\r\n BlindCopyTo,\r\n CopyTo,\r\n RedirectMessageTo,\r\n SetSCL,\r\n SenderIpRangesString,\r\n MessageTypeMatchesString,\r\n Mode,\r\n WhenCreated", + "size": 3, + "showAnalytics": true, + "title": "Display changes ( Add, Remove, modifications of parameters )", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Identity" + ], + "expandTopLevel": true + } + } + }, + "conditionalVisibility": { + "parameterName": "Compare_Collect", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 5" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "Outbound Policy : Autoforward configuration", + "items": [ + { + "type": 1, + "content": { + "json": "If **AutoForwardEnabled** is enabled, then automatic transfer are allowed.\r\nFor example: users in Outlook will be able set automatic transfer of all their emails to external addresses.\r\nThere are several methods to authorized automatic forward. \r\nPlease review this article : https://learn.microsoft.com/microsoft-365/security/office-365-security/outbound-spam-policies-external-email-forwarding?view=o365-worldwide\r\n**In summary :**\r\n\r\n**Scenario 1 :**\r\n\r\nYou configure remote domain settings to allow automatic forwarding.\r\nAutomatic forwarding in the outbound spam filter policy is set to Off.\r\n*Result :* \r\nAutomatically forwarded messages to recipients in the affected domains are blocked.\r\n\r\n**Scenario 2 :**\r\n\r\nYou configure remote domain settings to allow automatic forwarding.\r\nAutomatic forwarding in the outbound spam filter policy is set to Automatic - System-controlled.\r\n\r\n*Result :* \r\n\r\nAutomatically forwarded messages to recipients in the affected domains are blocked.\r\nAs described earlier, Automatic - System-controlled used to mean On, but the setting has changed over time to mean Off in all organizations.\r\n\r\nFor absolute clarity, you should configure your outbound spam filter policy to On or Off.\r\n\r\n**Scenario 3 :**\r\n\r\nAutomatic forwarding in the outbound spam filter policy is set to On\r\nYou use mail flow rules or remote domains to block automatically forwarded email\r\n\r\n*Result : *\r\n\r\nAutomatically forwarded messages to affected recipients are blocked by mail flow rules or remote domains.\r\n****\r\nAlso, when setting AutoForwardEnabled to a specific domain, it is strongly recommended enable TLS encryption.", + "style": "info" + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "Yes" + }, + "name": "AutoForwardHelp" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let HOSFR = ExchangeConfiguration(SpecificSectionList=\"HostedOutboundSpamFilterRule\", SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| extend HostedOutboundSpamFilterPolicy = tostring(CmdletResultValue.HostedOutboundSpamFilterPolicy)\r\n| project Identity,HostedOutboundSpamFilterPolicy;\r\nExchangeConfiguration(SpecificSectionList=\"HostedOutboundSpamFilterPolicy\",SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| extend Identity = tostring(CmdletResultValue.Identity)\r\n| join kind = fullouter HOSFR on $left.Identity == $right.HostedOutboundSpamFilterPolicy\r\n| extend OutboundSpamFilterRule = tostring(Identity1)\r\n| extend IsDefault= tostring(CmdletResultValue.IsDefault)\r\n| extend Enabled= tostring(CmdletResultValue.Enabled)\r\n| extend AutoForwardingMode= iff (CmdletResultValue.AutoForwardingMode == \"On\" , strcat (\"❌ \", tostring(CmdletResultValue.AutoForwardingMode)), tostring(CmdletResultValue.AutoForwardingMode))\r\n| extend RecommendedPolicyType= tostring(CmdletResultValue.RecommendedPolicyType)\r\n| extend RecipientLimitExternalPerHour = tostring(CmdletResultValue.RecipientLimitExternalPerHour)\r\n| extend RecipientLimitInternalPerHour = tostring(CmdletResultValue.RecipientLimitInternalPerHour)\r\n| extend RecipientLimitPerDay= tostring(CmdletResultValue.RecipientLimitPerDay)\r\n| extend ActionWhenThresholdReached = tostring(CmdletResultValue.ActionWhenThresholdReached)\r\n| extend BccSuspiciousOutboundAdditionalRecipients= tostring(CmdletResultValue.BccSuspiciousOutboundAdditionalRecipients)\r\n| extend BccSuspiciousOutboundMail = tostring(CmdletResultValue.BccSuspiciousOutboundMail)\r\n| extend NotifyOutboundSpam= tostring(CmdletResultValue.NotifyOutboundSpam)\r\n| extend NotifyOutboundSpamRecipient = tostring(CmdletResultValue.NotifyOutboundSpamRecipient)\r\n| project Identity,IsDefault,Enabled,AutoForwardingMode,OutboundSpamFilterRule,BccSuspiciousOutboundAdditionalRecipients,BccSuspiciousOutboundMail,NotifyOutboundSpam,NotifyOutboundSpamRecipient,WhenChanged,WhenCreated\r\n| sort by Identity asc ", + "size": 1, + "showAnalytics": true, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "rowLimit": 10000, + "filter": true + } + }, + "name": "query - 1", + "styleSettings": { + "showBorder": true + } + } + ] + }, + "name": "OutboundPol - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let _EnvList ={EnvironmentList};\r\nlet _TypeEnv = \"Online\";\r\nlet _DateCompare = \"{DateCompare:value}\";\r\nlet _CurrentDate = \"{DateOfConfiguration:value}\";\r\nlet _DateCompareB = todatetime(_DateCompare);\r\nlet _currD = (ExchangeConfiguration(SpecificSectionList=\"HostedOutboundSpamFilterPolicy\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n| summarize TimeMax = arg_max(TimeGenerated,*)\r\n| extend TimeMax = tostring(split(TimeMax,\"T\")[0])\r\n| project TimeMax);\r\nlet _CurrentDateB = todatetime(toscalar(_currD));\r\nlet HOSFR = ExchangeConfiguration(SpecificSectionList=\"HostedOutboundSpamFilterRule\", SpecificConfigurationDate=\"{DateOfConfiguration:value}\",SpecificConfigurationEnv={EnvironmentList},Target = \"Online\")\r\n| extend HostedOutboundSpamFilterPolicy = tostring(CmdletResultValue.HostedOutboundSpamFilterPolicy)\r\n| project Identity,HostedOutboundSpamFilterPolicy;\r\nlet BeforeData = ExchangeConfiguration(SpecificSectionList=\"HostedOutboundSpamFilterPolicy\", SpecificConfigurationDate=_DateCompareB, SpecificConfigurationEnv=_EnvList, Target = _TypeEnv)\r\n | extend Identity = tostring(Identity)\r\n | join kind = fullouter HOSFR on $left.Identity == $right.HostedOutboundSpamFilterPolicy\r\n | extend OutboundSpamFilterRule = tostring(Identity1)\r\n | extend IsDefault= tostring(CmdletResultValue.IsDefault)\r\n | extend Enabled= tostring(CmdletResultValue.Enabled)\r\n | extend AutoForwardingMode= tostring(CmdletResultValue.AutoForwardingMode)\r\n | extend RecommendedPolicyType= tostring(CmdletResultValue.RecommendedPolicyType)\r\n | extend RecipientLimitExternalPerHour = tostring(CmdletResultValue.RecipientLimitExternalPerHour)\r\n | extend RecipientLimitInternalPerHour = tostring(CmdletResultValue.RecipientLimitInternalPerHour)\r\n | extend RecipientLimitPerDay= tostring(CmdletResultValue.RecipientLimitPerDay)\r\n | extend ActionWhenThresholdReached = tostring(CmdletResultValue.ActionWhenThresholdReached)\r\n | extend BccSuspiciousOutboundAdditionalRecipients= tostring(CmdletResultValue.BccSuspiciousOutboundAdditionalRecipients)\r\n | extend BccSuspiciousOutboundMail = tostring(CmdletResultValue.BccSuspiciousOutboundMail)\r\n | extend NotifyOutboundSpam= tostring(CmdletResultValue.NotifyOutboundSpam)\r\n | extend NotifyOutboundSpamRecipient = tostring(CmdletResultValue.NotifyOutboundSpamRecipient)\r\n | extend WhenChanged = todatetime(WhenChanged)\r\n | extend WhenCreated = todatetime(WhenCreated)\r\n;\r\nlet AfterData = \r\n ExchangeConfiguration(SpecificSectionList=\"HostedOutboundSpamFilterPolicy\", SpecificConfigurationDate=_CurrentDate, SpecificConfigurationEnv=_EnvList, Target = _TypeEnv)\r\n | extend Identity = tostring(Identity)\r\n | join kind = fullouter HOSFR on $left.Identity == $right.HostedOutboundSpamFilterPolicy\r\n | extend OutboundSpamFilterRule = tostring(Identity1)\r\n | extend IsDefault= tostring(CmdletResultValue.IsDefault)\r\n | extend Enabled= tostring(CmdletResultValue.Enabled)\r\n | extend AutoForwardingMode= tostring(CmdletResultValue.AutoForwardingMode)\r\n | extend RecommendedPolicyType= tostring(CmdletResultValue.RecommendedPolicyType)\r\n | extend RecipientLimitExternalPerHour = tostring(CmdletResultValue.RecipientLimitExternalPerHour)\r\n | extend RecipientLimitInternalPerHour = tostring(CmdletResultValue.RecipientLimitInternalPerHour)\r\n | extend RecipientLimitPerDay= tostring(CmdletResultValue.RecipientLimitPerDay)\r\n | extend ActionWhenThresholdReached = tostring(CmdletResultValue.ActionWhenThresholdReached)\r\n | extend BccSuspiciousOutboundAdditionalRecipients= tostring(CmdletResultValue.BccSuspiciousOutboundAdditionalRecipients)\r\n | extend BccSuspiciousOutboundMail = tostring(CmdletResultValue.BccSuspiciousOutboundMail)\r\n | extend NotifyOutboundSpam= tostring(CmdletResultValue.NotifyOutboundSpam)\r\n | extend NotifyOutboundSpamRecipient = tostring(CmdletResultValue.NotifyOutboundSpamRecipient)\r\n | extend WhenChanged = todatetime(WhenChanged)\r\n | extend WhenCreated = todatetime(WhenCreated)\r\n;\r\nlet i=0;\r\nlet allDataRangeOSFR = ESIExchangeOnlineConfig_CL\r\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\r\n | where ESIEnvironment_s == _EnvList\r\n | where ExecutionResult_s <> \"EmptyResult\"\r\n | where Section_s == \"HostedOutboundSpamFilterRule\"\r\n | extend CmdletResultValue = parse_json(rawData_s)\r\n | extend Identity = tostring(CmdletResultValue.Identity)\r\n | extend HostedOutboundSpamFilterPolicy = tostring(CmdletResultValue.HostedOutboundSpamFilterPolicy)\r\n | project Identity, HostedOutboundSpamFilterPolicy;\r\nlet allDataRange = \r\n ESIExchangeOnlineConfig_CL\r\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\r\n | where ESIEnvironment_s == _EnvList\r\n | where ExecutionResult_s <> \"EmptyResult\"\r\n | where Section_s == \"HostedOutboundSpamFilterPolicy\"\r\n | extend CmdletResultValue = parse_json(rawData_s)\r\n | extend Identity = tostring(CmdletResultValue.Identity)\r\n | project\r\n TimeGenerated,\r\n Identity,\r\n CmdletResultValue,\r\n WhenChanged = todatetime(bin(WhenChanged_t,1m)),\r\n WhenCreated=todatetime(bin(WhenCreated_t,1m))\r\n | join kind=fullouter allDataRangeOSFR on $left.Identity == $right.HostedOutboundSpamFilterPolicy\r\n | extend OutboundSpamFilterRule = tostring(Identity1)\r\n | extend IsDefault= tostring(CmdletResultValue.IsDefault)\r\n | extend Enabled= tostring(CmdletResultValue.Enabled)\r\n | extend AutoForwardingMode= tostring(CmdletResultValue.AutoForwardingMode)\r\n | extend RecommendedPolicyType= tostring(CmdletResultValue.RecommendedPolicyType)\r\n | extend RecipientLimitExternalPerHour = tostring(CmdletResultValue.RecipientLimitExternalPerHour)\r\n | extend RecipientLimitInternalPerHour = tostring(CmdletResultValue.RecipientLimitInternalPerHour)\r\n | extend RecipientLimitPerDay= tostring(CmdletResultValue.RecipientLimitPerDay)\r\n | extend ActionWhenThresholdReached = tostring(CmdletResultValue.ActionWhenThresholdReached)\r\n | extend BccSuspiciousOutboundAdditionalRecipients= tostring(CmdletResultValue.BccSuspiciousOutboundAdditionalRecipients)\r\n | extend BccSuspiciousOutboundMail = tostring(CmdletResultValue.BccSuspiciousOutboundMail)\r\n | extend NotifyOutboundSpam= tostring(CmdletResultValue.NotifyOutboundSpam)\r\n | extend NotifyOutboundSpamRecipient = tostring(CmdletResultValue.NotifyOutboundSpamRecipient)\r\n | distinct\r\n WhenChanged,\r\n Identity,\r\n IsDefault,\r\n Enabled,\r\n AutoForwardingMode,\r\n OutboundSpamFilterRule,\r\n RecommendedPolicyType,\r\n RecipientLimitExternalPerHour,\r\n RecipientLimitInternalPerHour,\r\n ActionWhenThresholdReached,\r\n RecipientLimitPerDay,\r\n BccSuspiciousOutboundAdditionalRecipients,\r\n BccSuspiciousOutboundMail,\r\n NotifyOutboundSpam,\r\n NotifyOutboundSpamRecipient,\r\n WhenCreated \r\n;\r\nlet DiffAddDataP1 = allDataRange\r\n | join kind = rightanti (AfterData\r\n | where WhenCreated >= _DateCompareB)\r\n on WhenCreated\r\n;\r\nlet DiffAddDataP2 = allDataRange\r\n | join kind = innerunique (allDataRange) on WhenCreated\r\n | where WhenCreated >= _DateCompareB\r\n | where bin(WhenCreated, 5m) == bin(WhenChanged, 5m)\r\n | distinct\r\n Identity,\r\n IsDefault,\r\n Enabled,\r\n AutoForwardingMode,\r\n OutboundSpamFilterRule,\r\n RecommendedPolicyType,\r\n RecipientLimitExternalPerHour,\r\n RecipientLimitInternalPerHour,\r\n ActionWhenThresholdReached,\r\n RecipientLimitPerDay,\r\n BccSuspiciousOutboundAdditionalRecipients,\r\n BccSuspiciousOutboundMail,\r\n NotifyOutboundSpam,\r\n NotifyOutboundSpamRecipient,\r\n WhenCreated \r\n;\r\nlet DiffAddData = union DiffAddDataP1, DiffAddDataP2\r\n | extend Actiontype =\"Add\";\r\nlet DiffRemoveData = allDataRange\r\n | join kind = leftanti AfterData on Identity\r\n | extend Actiontype =\"Remove\"\r\n | distinct\r\n Actiontype,\r\n Identity,\r\n IsDefault,\r\n Enabled,\r\n AutoForwardingMode,\r\n OutboundSpamFilterRule,\r\n RecommendedPolicyType,\r\n RecipientLimitExternalPerHour,\r\n RecipientLimitInternalPerHour,\r\n ActionWhenThresholdReached,\r\n RecipientLimitPerDay,\r\n BccSuspiciousOutboundAdditionalRecipients,\r\n BccSuspiciousOutboundMail,\r\n NotifyOutboundSpam,\r\n NotifyOutboundSpamRecipient,\r\n WhenCreated \r\n | project\r\n WhenChanged=_CurrentDateB,\r\n Actiontype,\r\n Identity,\r\n IsDefault,\r\n Enabled,\r\n AutoForwardingMode,\r\n OutboundSpamFilterRule,\r\n RecommendedPolicyType,\r\n RecipientLimitExternalPerHour,\r\n RecipientLimitInternalPerHour,\r\n ActionWhenThresholdReached,\r\n RecipientLimitPerDay,\r\n BccSuspiciousOutboundAdditionalRecipients,\r\n BccSuspiciousOutboundMail,\r\n NotifyOutboundSpam,\r\n NotifyOutboundSpamRecipient,\r\n WhenCreated\r\n;\r\nlet DiffModifData = union AfterData, allDataRange\r\n | sort by Identity, WhenChanged asc\r\n | project\r\n WhenChanged,\r\n Identity,\r\n IsDefault,\r\n Enabled,\r\n AutoForwardingMode,\r\n OutboundSpamFilterRule,\r\n RecommendedPolicyType,\r\n RecipientLimitExternalPerHour,\r\n RecipientLimitInternalPerHour,\r\n ActionWhenThresholdReached,\r\n RecipientLimitPerDay,\r\n BccSuspiciousOutboundAdditionalRecipients,\r\n BccSuspiciousOutboundMail,\r\n NotifyOutboundSpam,\r\n NotifyOutboundSpamRecipient,\r\n WhenCreated \r\n | extend Identity = iff(Identity == prev(Identity) and Identity != prev(Identity) and prev(Identity) != \"\", strcat(\"πŸ“ \", Identity, \" (\", prev(Identity), \"->\", Identity, \" )\"), Identity)\r\n | extend IsDefault = iff(Identity == prev(Identity) and IsDefault != prev(IsDefault) and prev(IsDefault) != \"\", strcat(\"πŸ“ \", IsDefault, \" (\", prev(IsDefault), \"->\", IsDefault, \" )\"), IsDefault)\r\n | extend Enabled = iff(Identity == prev(Identity) and Enabled != prev(Enabled) and prev(Enabled) != \"\", strcat(\"πŸ“ \", Enabled, \" (\", prev(Enabled), \"->\", Enabled, \" )\"), Enabled)\r\n | extend AutoForwardingMode = iff(Identity == prev(Identity) and AutoForwardingMode != prev(AutoForwardingMode) and prev(AutoForwardingMode) != \"\", strcat(\"πŸ“ \", AutoForwardingMode, \" (\", prev(AutoForwardingMode), \"->\", AutoForwardingMode, \" )\"), AutoForwardingMode)\r\n | extend OutboundSpamFilterRule = iff(Identity == prev(Identity) and OutboundSpamFilterRule != prev(OutboundSpamFilterRule) and prev(OutboundSpamFilterRule) != \"\", strcat(\"πŸ“ \", OutboundSpamFilterRule, \" (\", prev(OutboundSpamFilterRule), \"->\", OutboundSpamFilterRule, \" )\"), OutboundSpamFilterRule)\r\n | extend RecommendedPolicyType = iff(Identity == prev(Identity) and RecommendedPolicyType != prev(RecommendedPolicyType) and prev(RecommendedPolicyType) != \"\", strcat(\"πŸ“ \", RecommendedPolicyType, \" (\", prev(RecommendedPolicyType), \"->\", RecommendedPolicyType, \" )\"), RecommendedPolicyType)\r\n | extend RecipientLimitExternalPerHour = iff(Identity == prev(Identity) and RecipientLimitExternalPerHour != prev(RecipientLimitExternalPerHour) and prev(RecipientLimitExternalPerHour) != \"\", strcat(\"πŸ“ \", RecipientLimitExternalPerHour, \" (\", prev(RecipientLimitExternalPerHour), \"->\", RecipientLimitExternalPerHour, \" )\"), RecipientLimitExternalPerHour)\r\n | extend RecipientLimitInternalPerHour = iff(Identity == prev(Identity) and RecipientLimitInternalPerHour != prev(RecipientLimitInternalPerHour) and prev(RecipientLimitInternalPerHour) != \"\", strcat(\"πŸ“ \", RecipientLimitInternalPerHour, \" (\", prev(RecipientLimitInternalPerHour), \"->\", RecipientLimitInternalPerHour, \" )\"), RecipientLimitInternalPerHour)\r\n | extend ActionWhenThresholdReached = iff(Identity == prev(Identity) and ActionWhenThresholdReached != prev(ActionWhenThresholdReached) and prev(ActionWhenThresholdReached) != \"\", strcat(\"πŸ“ \", ActionWhenThresholdReached, \" (\", prev(ActionWhenThresholdReached), \"->\", ActionWhenThresholdReached, \" )\"), ActionWhenThresholdReached)\r\n | extend RecipientLimitPerDay = iff(Identity == prev(Identity) and RecipientLimitPerDay != prev(RecipientLimitPerDay) and prev(RecipientLimitPerDay) != \"\", strcat(\"πŸ“ \", RecipientLimitPerDay, \" (\", prev(RecipientLimitPerDay), \"->\", RecipientLimitPerDay, \" )\"), RecipientLimitPerDay)\r\n | extend BccSuspiciousOutboundAdditionalRecipients = iff(Identity == prev(Identity) and BccSuspiciousOutboundAdditionalRecipients != prev(BccSuspiciousOutboundAdditionalRecipients) and prev(BccSuspiciousOutboundAdditionalRecipients) != \"\", strcat(\"πŸ“ \", BccSuspiciousOutboundAdditionalRecipients, \" (\", prev(BccSuspiciousOutboundAdditionalRecipients), \"->\", BccSuspiciousOutboundAdditionalRecipients, \" )\"), BccSuspiciousOutboundAdditionalRecipients)\r\n | extend BccSuspiciousOutboundMail = iff(Identity == prev(Identity) and BccSuspiciousOutboundMail != prev(BccSuspiciousOutboundMail) and prev(BccSuspiciousOutboundMail) != \"\", strcat(\"πŸ“ \", BccSuspiciousOutboundMail, \" (\", prev(BccSuspiciousOutboundMail), \"->\", BccSuspiciousOutboundMail, \" )\"), BccSuspiciousOutboundMail)\r\n | extend NotifyOutboundSpam = iff(Identity == prev(Identity) and NotifyOutboundSpam != prev(NotifyOutboundSpam) and prev(NotifyOutboundSpam) != \"\", strcat(\"πŸ“ \", NotifyOutboundSpam, \" (\", prev(NotifyOutboundSpam), \"->\", NotifyOutboundSpam, \" )\"), NotifyOutboundSpam)\r\n | extend NotifyOutboundSpamRecipient = iff(Identity == prev(Identity) and NotifyOutboundSpamRecipient != prev(NotifyOutboundSpamRecipient) and prev(NotifyOutboundSpamRecipient) != \"\", strcat(\"πŸ“ \", NotifyOutboundSpamRecipient, \" (\", prev(NotifyOutboundSpamRecipient), \"->\", NotifyOutboundSpamRecipient, \" )\"), NotifyOutboundSpamRecipient)\r\n | extend ActiontypeR =iff((Identity contains \"πŸ“\" or IsDefault contains \"πŸ“\" or Enabled contains \"πŸ“\" or OutboundSpamFilterRule contains \"πŸ“\" or AutoForwardingMode contains \"πŸ“\" or BccSuspiciousOutboundAdditionalRecipients contains \"πŸ“\" or BccSuspiciousOutboundMail contains \"πŸ“\" or NotifyOutboundSpam contains \"πŸ“\" or NotifyOutboundSpamRecipient contains \"πŸ“\"), i=i + 1, i)\r\n | extend Actiontype =iff(ActiontypeR > 0, \"Modif\", \"NO\")\r\n | where ActiontypeR == 1\r\n | distinct\r\n WhenChanged,\r\n Actiontype,\r\n Identity,\r\n IsDefault,\r\n Enabled,\r\n AutoForwardingMode,\r\n OutboundSpamFilterRule,\r\n RecommendedPolicyType,\r\n RecipientLimitExternalPerHour,\r\n RecipientLimitInternalPerHour,\r\n ActionWhenThresholdReached,\r\n RecipientLimitPerDay,\r\n BccSuspiciousOutboundAdditionalRecipients,\r\n BccSuspiciousOutboundMail,\r\n NotifyOutboundSpam,\r\n NotifyOutboundSpamRecipient,\r\n WhenCreated \r\n;\r\nunion DiffAddData, DiffRemoveData, DiffModifData\r\n| extend WhenChanged = iff (Actiontype == \"Modif\", WhenChanged, iff(Actiontype == \"Add\", WhenCreated, WhenChanged))\r\n| extend Actiontype = case(Actiontype == \"Add\", strcat(\"βž• \", Actiontype), Actiontype == \"Remove\", strcat(\"βž– \", Actiontype), Actiontype == \"Modif\", strcat(\"πŸ“ \", Actiontype), \"N/A\")\r\n| sort by WhenChanged desc \r\n| project\r\n WhenChanged,\r\n Actiontype,\r\n Identity,\r\n IsDefault,\r\n Enabled,\r\n AutoForwardingMode,\r\n OutboundSpamFilterRule,\r\n RecommendedPolicyType,\r\n RecipientLimitExternalPerHour,\r\n RecipientLimitInternalPerHour,\r\n ActionWhenThresholdReached,\r\n RecipientLimitPerDay,\r\n BccSuspiciousOutboundAdditionalRecipients,\r\n BccSuspiciousOutboundMail,\r\n NotifyOutboundSpam,\r\n NotifyOutboundSpamRecipient,\r\n WhenCreated ", + "size": 3, + "showAnalytics": true, + "title": "Display changes ( Add, Remove, modifications of parameters )", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Identity" + ], + "expandTopLevel": true + } + } + }, + "conditionalVisibility": { + "parameterName": "Compare_Collect", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 7 - Copy" + }, { "type": 12, "content": { @@ -688,7 +1017,7 @@ { "type": 1, "content": { - "json": "If **AutoForwardEnabled** is set to True for an SMTP domain, then users in Outlook are allowed to set automatic transfer of all their emails to addresses in this domain.\r\n\r\nWhen the Default Remote domain is set to * and has the AutoForwardEnabled set True, any user can configure an Outlook rule to automatically forward all emails to any SMTP domain domains outside the organization. This is a high risk configuration as it might allow accounts to leak information. \r\n\r\nAlso, when setting AutoForwardEnabled to a specific domain, it is strongly recommended enable TLS encryption.", + "json": "If **AutoForwardEnabled** is set to True for an SMTP domain and the Outbound Policy is set to On then users in Outlook are allowed to set automatic transfer of all their emails to addresses in this domain.\r\n\r\nWhen the Default Remote domain is set to * and has the AutoForwardEnabled set True, any user can configure an Outlook rule to automatically forward all emails to any SMTP domain domains outside the organization. This is a high risk configuration as it might allow accounts to leak information. \r\n\r\nAlso, when setting AutoForwardEnabled to a specific domain, it is strongly recommended enable TLS encryption.", "style": "info" }, "conditionalVisibility": { @@ -721,6 +1050,34 @@ ] }, "name": "ForwardGroup" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let _EnvList ={EnvironmentList};\r\nlet _TypeEnv = \"Online\";\r\nlet _DateCompare = \"{DateCompare:value}\";\r\nlet _CurrentDate = \"{DateOfConfiguration:value}\";\r\nlet _DateCompareB = todatetime(_DateCompare);\r\nlet _currD = (ExchangeConfiguration(SpecificSectionList=\"RemoteDomain\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n| summarize TimeMax = arg_max(TimeGenerated,*)\r\n| extend TimeMax = tostring(split(TimeMax,\"T\")[0])\r\n| project TimeMax);\r\nlet _CurrentDateB = todatetime(toscalar(_currD));\r\nlet BeforeData = ExchangeConfiguration(SpecificSectionList=\"RemoteDomain\",SpecificConfigurationDate=_DateCompareB,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n | extend Identity = tostring(CmdletResultValue.Name)\r\n\t| extend DomainName = tostring(CmdletResultValue.DomainName)\r\n\t| extend AutoForwardEnabled = tostring(CmdletResultValue.AutoForwardEnabled)\r\n\t| extend WhenChanged = todatetime(WhenChanged)\r\n | extend WhenCreated = todatetime(WhenCreated)\r\n;\r\nlet AfterData = \r\n ExchangeConfiguration(SpecificSectionList=\"RemoteDomain\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\r\n \t | extend Identity = tostring(CmdletResultValue.Name)\r\n\t| extend DomainName = tostring(CmdletResultValue.DomainName)\r\n\t| extend AutoForwardEnabled = tostring(CmdletResultValue.AutoForwardEnabled)\r\n | extend WhenChanged = todatetime(WhenChanged)\r\n | extend WhenCreated = todatetime(WhenCreated)\r\n;\r\nlet i=0;\r\nlet allDataRange = \r\n ESIExchangeOnlineConfig_CL\r\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\r\n | where ESIEnvironment_s == _EnvList\r\n | where ExecutionResult_s <> \"EmptyResult\"\r\n | where Section_s == \"RemoteDomain\"\r\n | extend CmdletResultValue = parse_json(rawData_s)\r\n | project TimeGenerated,CmdletResultValue,WhenChanged = todatetime(WhenChanged_t), WhenCreated=todatetime(WhenCreated_t)\r\n | extend Identity = tostring(CmdletResultValue.Name)\r\n\t| extend DomainName = tostring(CmdletResultValue.DomainName)\r\n\t| extend AutoForwardEnabled = tostring(CmdletResultValue.AutoForwardEnabled)\r\n ;\r\nlet DiffAddDataP1 = allDataRange\r\n | join kind = rightanti (AfterData | where WhenCreated >=_DateCompareB) on WhenCreated\r\n;\r\nlet DiffAddDataP2 = allDataRange\r\n | join kind = innerunique (allDataRange ) on WhenCreated\r\n | where WhenCreated >=_DateCompareB\r\n | where bin(WhenCreated,5m)==bin(WhenChanged,5m)\r\n | distinct Identity,DomainName,AutoForwardEnabled,WhenChanged,WhenCreated\r\n ;\r\nlet DiffAddData = union DiffAddDataP1,DiffAddDataP2\r\n| extend Actiontype =\"Add\";\r\nlet DiffRemoveData = allDataRange\r\n | join kind = leftanti AfterData on Identity\r\n | extend Actiontype =\"Remove\"\r\n | distinct Actiontype ,Identity,DomainName,AutoForwardEnabled,WhenCreated\r\n | project WhenChanged=_CurrentDateB,Actiontype,Identity,DomainName,AutoForwardEnabled,WhenCreated\r\n ;\r\nlet DiffModifData = union AfterData,allDataRange\r\n| sort by Identity,WhenChanged asc\r\n| project WhenChanged,Identity,DomainName,AutoForwardEnabled,WhenCreated\r\n| extend Identity = iff( Identity == prev(Identity) and Identity != prev(Identity) and prev(Identity) !=\"\" , strcat(\"πŸ“ \", Identity, \" (\",prev(Identity),\"->\", Identity,\" )\"),Identity)\r\n| extend DomainName = iff( Identity == prev(Identity) and DomainName != prev(DomainName) and prev(DomainName) !=\"\" , strcat(\"πŸ“ \", DomainName, \" (\",prev(DomainName),\"->\", DomainName,\" )\"),DomainName)\r\n| extend AutoForwardEnabled = iff( Identity == prev(Identity) and AutoForwardEnabled != prev(AutoForwardEnabled) and prev(AutoForwardEnabled) !=\"\" , strcat(\"πŸ“ \", AutoForwardEnabled, \" (\",prev(AutoForwardEnabled),\"->\", AutoForwardEnabled,\" )\"),AutoForwardEnabled)\r\n| extend ActiontypeR =iff((Identity contains \"πŸ“\" or DomainName contains \"πŸ“\" or AutoForwardEnabled contains \"πŸ“\" ), i=i + 1, i)\r\n| extend Actiontype =iff(ActiontypeR > 0, \"Modif\", \"NO\")\r\n| where ActiontypeR == 1\r\n| project WhenChanged,Actiontype,Identity,DomainName,AutoForwardEnabled,WhenCreated\r\n;\r\nunion DiffAddData, DiffRemoveData, DiffModifData\r\n| extend WhenChanged = iff (Actiontype == \"Modif\", WhenChanged, iff(Actiontype == \"Add\",WhenCreated, WhenChanged))\r\n| extend Actiontype = case(Actiontype == \"Add\", strcat(\"βž• \", Actiontype), Actiontype == \"Remove\", strcat(\"βž– \", Actiontype), Actiontype == \"Modif\", strcat(\"πŸ“ \", Actiontype), \"N/A\")\r\n| sort by WhenChanged desc \r\n| project\r\n WhenChanged,\r\n Actiontype,\r\n Identity,\r\n DomainName,\r\n AutoForwardEnabled,\r\n WhenCreated", + "size": 3, + "showAnalytics": true, + "title": "Display changes ( Add, Remove, modifications of parameters )", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "gridSettings": { + "hierarchySettings": { + "treeType": 1, + "groupBy": [ + "Identity" + ], + "expandTopLevel": true + } + } + }, + "conditionalVisibility": { + "parameterName": "Compare_Collect", + "comparison": "isEqualTo", + "value": "True" + }, + "name": "query - 7" } ] }, diff --git a/Workbooks/Images/Preview/MicrosoftExchangeAdminActivity-OnlineBlack.png b/Workbooks/Images/Preview/MicrosoftExchangeAdminActivity-OnlineBlack.png new file mode 100644 index 0000000000000000000000000000000000000000..5cf6e1fd9428f369ccc7887586fef77e7ff80016 GIT binary patch literal 79242 zcmd43cT|(x*Dk7}SZHnwMVf9K(mN<6DBFq(g7gxKfJg~NI!SPYu%)`CiIkuSNDUAn zKp@!$0jUv?8XyJ;krG0P5JFOr$GE4dqXU5UfWYMAhXE-Wxw~;dsp}D zsY@4PyB*;FemL-!eaN0YqU}51d%Hj%9`Qds_Vl{lQ!9|y({Q(7&pkJTJv{?L9)q5` zSRdm53or5ZA6FknxU6svH_2E()8hgO3?5y!pkqwo$PoqKV^f*}M^w-Lsqp7_^*>J^ z4Lxe{`xm7@WBsn2?)m-5Ui&{||2*wFeirra+0}i2m>w1R>*diiXG{(qcB>!QW|X&# zSdTbQhg0V-z*vT`M7(oZ#r=Yi7Wk+h`Qex&q27hxxt*^c`}dyz)%vQj@6NAQk;neb zUoDfaLkfF$o3UxXS?v4uq3qeB{l8jQZkQbY)q0u|d+b;1$Lo>PMTX~`w4)>K8lT>_ zGbVkk?YaW0Q9v|G9uGsg25Ebxp{qaN1Kvr%l^|Wr=-n=UJq$jipmvC%oUYe7oYykgcbNJ?VeEtCt?LM^^TE&& zq=f0K27}sD$2;%8aeQ3%aC;#Vs>5(b1Y?9{_j>YVB_K3xeH2Uu!+2ji618lTxm++H znAxE*US5~Ie1$o%=EsTlx*Djz9$y$9B47V4I|jq0eKBa6gWn^Q~D!i?}1FW$*tPnyh)t;rGo+w=0upL*vncj z_ZwAO7(W}rI`52)FJoaXc%Kfe6frG>A?Cr@e!AGnW*PHf#HqZ}cuZepRr;C4*x-9# zL$O9~ZsoYr=Ss+BC@eHeko0$W+v|Ma?m64=7(vpR@HWfG$Qf|>#&s5M;k$G6*js?u zu#3~FY&D4PT>za^;(xZ09kI1^>3Dl86mmrw4$curR@b<&h#u|cC=3s8e;InGDF%bI zmMaEK_80wR9NJlW*B={7MNV~VC96e`Y??y-P_d8hf_>VZ$lm562dhD^$@dFe>S6w` z8P2VPP|ktl*z}9qSBzrlb5Pqls_Su!P4f}&awOt)WvFhEQ|Jx9%f{>_QfDm0l^9UW zh3X!}1uo-$bCjD=N1->T8CwFxfl8d11b4nOko>W$y|tqQl6MjUUi-d3p=}%O>`2+j zHNuhrC}qE0Lio4K^za0>aJeUHSSx48CZXrH%TO@6qqK1Wu7H*nOVF|1cb zFVReu8Pv2+21r=$8bVv}NS19vddwqykNZj6Th~@Jzt8Hd)j-B^pD!PSXEuli zaH$6m&|zz4a`$?w?DQ|QndlX-kFoVhv9H4FahBR4*qrw32!!s6k9df$?@g0tk1eje z?Nj8)$2A1pB?CzBgC)cPG50%+!552G^45n4T9au+{o(aD*t@--4rL$69MPSQC|(;c zPESbHi;C7~+$6`pz%*TH^=}tZ?A`6@qZ!6bH8zvAD#T;H6|)IQpKY|ekev!=Nm;m@ zOhfAn-4%~dG_P)Hj&U{mBa*ZbhoAa~df8A~YqeE9XmXg?{M@JcaR=7BeK;cxj+4WC z4oxu|CD*{;Ki?+4CFhiMwJ|CL}K-p9Yg(p(C84G5z;$7*Cin_t~b|4?HOzUB_- z8XCPnvtv)t)oK-j)ugd|@9>h=wvBTBF-Uz#o!W3?8|4K#Z!)YiUhQd)kFWyrkUVQu zhxn{ae59Ah=wr3NKVI=_)4zQ@B;ZK6o(v%E`2^-ASuA(`Ua)#9Ad+;8lFfR<_`Mk;?4N z6!Xl^NR(>}4S^bTDNE>`^{$>-^#O-RgwP_|GH|msU_q);xlLKR#J=9b_US@&bQEKv zs%3KytLAbG19MQ(bF7LMFSR+~+u>T@lRPGC+q7_i_^i0HCbBDVGG$%TS5+$_3AaBL zDqqoa;-vSdgf6veD0!2iHFKrNkK=s#YmkE)P~J@F6}6=kbGY)3@Ofy+7`*+rL}(j# zCSGVjEF+-h%#P`pdG2n)Qyt%fmf{$R3=kr8xN*y6D*JiH1B^gV`wZB|=))ZlI|o#| zp!MjKX(NB7Jh0?|$Fko~_DX={05N2^5F+FWX^GfdLyV6mj}hSYF+uc@fz2j&FU~?l zapx7xQmt=$%IfK|EK&n=rS5)6?WCXe{>%on(tf#AGsT4s=c95)W%^&jsz(spQZI5_ z#d_TOPtM6d8Eow5td;9}oJkrBTS2+lssV-1ESO&@4xFhcS>5+@xUf+Gcr#Ov%Q25s z2f8`Xbx&Pt~|wNIMibtw%Bt*zK-hU(V2r_11I(K zVp+4o?-0l>)+5YpDr+nM;|n0(IQNW}dvAIoI33gaFtKKOKyCV?%Twxg;=CGE_i|TL z$m*eCmp)|w_QYzpv181NR`+JQlf$92s*~pU zS?uFVN8@0}YM5r+l$P1`rjDb(C$U_>ea~*Az_cWHb%(;+V+~NbL!GY6AY}fa(W`s=Obt_HwhYLTnNE?lZ0sMJ+r!Klz?jEtS(M_BbbwO`jzP~66$82-0-lj z6~`oRekh<4?xPLF@_h+VAKA^@#!4k7(cEex3$BXO9f+G+s?%=jl<2gLRQ_n=*FH&j z$r-+~$XN4KGrjn-Z9D3woW}dNf_Jy3KF+^&9POg zu%Er?YhrJBW2&so-n%2OD;2?g7yNa+N!#b4=tTYUVsFUw`aileKLZMXvl8B#y|)s= z9pm*QPX@deBWWo(`m{Fw=2&>*La5r+T){@i6Z`6Xh&=`Cbcwj^rA8ISgPF-x{nl^y zJ3Mp*FY%(jL!Mh`kA;rIm*#5q4XVaVt$PO{q}7<*?pfhRcYtvSsVt9KC+Tvs%g^Wb zfMsl6Ph6)>ub)jfzEVT|5`=4W*SN9P{9(-I?4N6Ew^PYV>5S36o^zTQ4{Q*FtfeT8 zZ(uj8B$&4eDYUOh-$A&}rF=uk<2IMgP$QFNYZEGo79GX`0eNT$;|~fTueydqC(d4^ zGt^|ap-ZffZwAM&*eL-)BjMJN{?s#%T+% z7OkZSCRq3R$tu#IC;B26KtwuBI~?CS=dQaT63@y{=uU+bsILNp@nSq*&s;u??U1_DA&uV-{&V{t z11*^8JSV@ZNlqIF8!n0 zJL+V6!TL}_!4U=90se-2%FqkL~fUGqvt~=V7iA^ru18+4FyVOHgOSq9c8=O(y zxl&BlW|(W-qELcMI*!&yPA$MN3mQ2%OW%`MPA(5C7WoMeWpFNh^c{;?05)?R7``-w zBRf&l8t(|!t(br2L`PgmhHZ47zsF)uAKy?bsw${F8kXb58zrbEzNn6Cm~52W*E6dl z0k5pAjSpmza~G1pmZN$9XvhQGl;lt1)nRo63@&1s;m9#cV(Q%&g0-(=E|EBChmON2 z5Sw6149VYgdCnk4+mM^n^@=A>;B6w!Z*gz7fA~8uXGZ?6Mohl;V&^<&B3h%!kon;( zK703oO-Q5|um3%7?BTSklaR%apd>9uMZZ2hYb16rNsr6o9}PO0KgwgMX|~Qe73AO0 znyl5e0=E^BE8hu<}9A6wx@a%w|un_KNF{D69;Bp-S7UZy!QTUmzBNy_4^7DmxJjO6PF_X8B z^T1|6!G?Y<-JSP-fsUx+pciA3mYs}Ky(0QW$^+^tX5UD9k9xJB2_Ys@{vXFQh}dp( z?E{b0%#F(pYJJ;44=SThfL+<+yY_=UI1&cOFZ?BPo=>-n{rRvZ!jGxfo{pWy6CYjnV!7|GgI}( zL9PCf>$&KInH?o!(IEn;vb?Si&r6Q7@XFe6Zm)ygJ#&9^gcz=b_Pkg3c;G;0ONDJ) zf>X8Xlh&o_4PoN|xHl~!veM%H@Lp1-D9f6&z|=x`g~JStGXnE0n`5$pk>bDx?t#o` z!W)2AE$woAb+#e}7!edD*Q94CfItI-@=tX6xutCAjz1}r>}iddwrw8=Zf#dA#D0bR z6Lk&%rKfa;`4jSD>m{SQJYDFXz-an}tYJsp*l>vNO~1&9rqUS*$@|?VRcj^y^GQU( ztoJJNM~3zJgbcnd$O5=^fon}c#6?WMXf!ko9!P~wJKM|cOkz=iU*jW>qf*ufa^jBi z_l{-6eV0;NCj=(YgQX8ewLFvEkhBormv_!2hEOTplX5t5D(ktc5x}fY@`k5gQ!?Vu z!g6QmoZtJJY1MLEilS=WYd@taboAt9gdEx|L@#E<@H7qP>qSjF0? z@-VgsVWVZJu7@dMu`uQW3G-e-wt@OtknejvX;Mi-SiZx8yzH5KKk~ZT;Rq76?r9vo zM2&edFpHq231NP$Vw!kRFzH?ic!rtn+{R2; zsFj_QMBuPOa_?Zx>zF8Xt8caW8?@=Hz<>6EQ&!G9JU&EQ1Zh>?=eo)atRqt!3b=^DYR6C}-)68_`S% z%LPusAByiz@I{S?l-?E_71Enas+?0mu{$RA=)-vM*+#bobD%(vlVn&aTKhIhf&f1%2PZK;#XgP}hf8t6{PRSj3H+{n=T z1lIQepxTr+&dXx7XBC!MMB|XDE&BOv5-x0vk)}@R_<1G6-lQyjvBtI{qP^AnkX03r z9xj{nv11I>RKYcD99`FS*`YhQe;y`w9e-0m9}x@9QA-GXzO2+2rKq+M<=V8>-O5Y$ zHwc3T5x?|8rM(D|!Qm79?a;w>)}>$rf7Zw!;v?4Bz%3oErO+fnIg1*JQ5B<*r&qUz zt#6+9m+k7_7DHPQE-I!^$okG1igB`ygRT6hR-}wsgW>UGkcgZ|yb#bE@j@88fZ6P@ z2>xQDB987s&O2Qr^ay|ms? zQj{~`-8>0qt-hFq>PDZUM?T&H;0#X|-tqFb#Xa^L+jK60#?vgCwtZpcsm*k3D1e(D z+#I#XK+llpG>J267`FH^Nnr(&mxvdF275GxOwN^@Z>Yr1@*@vN zs^0is&u!Kt59!PS_;xguwNo2 zZ$@CpFn)Ar0eF#HUv4&5PuYB&zG-|60_h-iQ{ztXC(YRIkZFY%_oq?O-JDI-JT3U8 z~EBT|O@>3#NJoz34V`Oq(d2JfoQSY$OR*w&gcgq1o)7M}on(w!3qn{@O}YVXOWs zUQ;6E*me5z+SbU+-*1!zA_J?z+pD+JhBpxtAtn=BM#Frh&1zKRnLZmOCHbG|KY~o7 zlshNh7z?!t7@p8XGC9eQSKjS#n$_lA&wy4cxfMy z=s10T;Bm|MVt55ex{g#xe5nMH=4yJoabDL|yTq^y)feNHFH?agQq}YlI@aIZ5Ga2T z-j^%4Y8XUb3r`d;Jg={?*Yl(QIIAneY;2vNMHSN<89FuuyaV4W9Wvig_8CDB&}D`q7(0Cx6*OqeKY3En$_xF;@_Ban}OTU9JAV+bd>V%j3uGhoL1Nw99TsDiZjTM1U}hc1ma{0rg|fDHS4tBw965~Z7? z)TgOp3=J6>*Ij|IPj-7p4`N$6Hp+J~1`c4{4Gt#-IRoDqmmk-cJ#M@??TekJomz&5 zXUFG|aY7;T&6n7-ADrKyZ|+$Ap3z5qn)=y?%GyjXke4ZTsZ`Qp^8|BuUH{=Tqu1p5 zpx8Em>Fz0I2c}4(d0kJ-7fuRYOgvl+w0f|UpV+e}AuaY8v&a`|)$WY*#=Z7)I(EVa z+ED^_R5>rS`v<1CO%C7dOe7d{0-NYdR@iPJ*H03KGuD~I>Z!FF-Hq0O-f-EPvv*4m zwILx`MaV`G11idVoSJ#t?FJ)6QyO;W*MkavFN(h)5g(mRzWOLjot_Zbql%SHNOZo? z?=RVoz{17EYj*c??UO?aZ@bCubs3Q3a)ldCb|3Y{Lirr?r9Rk(NfV`tgB1n2Al(6W zM&P9c!=e}(4c|^W7+`HLy4&9?SN|8e1}U;pVIT|7Tn@#{oETtz zg2s!%Q30f|-RJIceSAnksSz%kFx&Dgwc%=g+``5WDEn`!!|wQoX3^AH8Ait0c4L&R zJS3|7y3Wl6UPSvSF&WT$E)u*g1yqO!K?#5p)VIHkE#@E8QAbiQ#iX8ZDbHI*ZA{|yYo;m zDX^~Po^B;2dN3#4|4COTbH3|W4`YedVtYO1S~^@+#MXz_R79p{sRXt7=RUQ$3Ar5% z$K+@3a;qg>11=JAU9-(YMQS4Q^bmBp=eD~^Zo)I4Z9CNf0~9Ni8GU)&uR%rR8e;B* z>9CFedZ{kuvEYBwKfa~L{Y8D(T07U2#rAnL`z-*C1=IxtNqf|$;rdqU1xAvlEg;>j z+qf*j2$Dw`;x}o5E^X}<=WWSj3unBxqmoEblQyEalixmC*1bfvGEVqULMT>e@aX~okQTnt`t9B2^#U=4O8g)HS?Yf#ysptR@lg^MjRD91H4ERotD*{s`t9J- z?V;-J;7V&Z=b9#-53zDCO(nlFCV%}^-6DiE@p6PziS1~;d-0+a)lFeSF^8lBm}x!1!l1M1%~~lf zu0cFDSs<%R=13}8)gQX-i2Wd-CJcg(9qggPujN6RuhrMT-8{~3kmU;i|%#8~`z56N?q+}>Dj|Dfe{ewLc& zhXi>}=uF^sqix4y;5=bRnMhwr@M!*f_zii3%PHKU4!4Z-Dllbtm(*TZdTb&U7aM`N zoNz!op#Hk#HVKySHxTo-Ub&smuIp}pzUubvFeBjs&`{5h{R|57{U(7k>$$+v7JP2{ zxE%>Pc0-n#tgQ~xr!tp8lDa%3D1ML-ea;U(7LH|tz`j1wWgWQwA07}{-SIWb3&}}8 z=G&38PL-PLe5k5&pJ_S-sZ@NQLeMJ41cgX$v}2zCjgptpom`r8i%Y$6K{tw;)*Y>} zKiSiLqQc`TwiG5Qaif46G5(Z=yU2TdcJfgo?@;kTgr;BPT#h2cez*!l#ACk*s2(ad zFO<_IkiM>MLb;Evfal#vM7@z2eAT+-u1gaZlND0X<64}$pJqs3tfd_cGn+|1)B8of zAEb!7Fuuh>B|IRvTEKE`OP*kKuD7C*7>_)4rZh6XpUe5sqj^1#!y3GO>t|y)8sp)A zyuEvn(4v-NIA3w@=#$VH$(Ns91Lui)2^(WTOnsk)*%GtC7rVg9w}gV`$Ek^b1M}=E z38f|VmC297W<_}qD(MXD2P^IgU75?J^-~rTu5%CEes+spN4}C(lQ)h5YE}qJ5-Db^OtNUT+YHLS~`tt3dWr6;(XjBNHyRFy^nWW z!n>oPcU){KsEW__(6cy*YHpn*FkL3vq06-AZ(y@_%9YvDN98jWl=BUm8t-K|B(n;n z*jxSRdVNvpj-qfxy1ZSp|GlI9;e?#b5eUdHaoWzU+OQVBG$+h1_5ZbULZ)&So#z!0 zftt~3{J2!tQ&>?iihA)5>EPNYiCNy&=w+<@+c5Ll5wtG z=@MsWHAgNN-CYWs1is3BVU4f+oSPKXhxYGly7in#+2*j_?x}xT>-}ER z1zyWdNgasGrTmmx;r2)3o_Treo*GZ@u7)oFLf|5Vh-qoZ%zlBMcc0J?@JkEZuDGI= zmhXeB$pa7w;JsenLDStik=fpsPv{4L?~)qBUggFD4dKCf*JPZ33Jf;0{~b*VT<0eo zP|+w>qK|r7%wYTe&W+=5cj)ha+6!k(G^PDF>VC>A<^N=_=`u=W^UKWYKob)dlm>#lO3z5C?npHe|fQwTqM=Puavc zXZ{?SAyiI{-eKw$Q9l8Nzef#w#ktku!9`HU647IG*aEpQ*A*KYKq9#ASVnB$%LADj z`7+>5dfd_bH>yp$yef^0QUsT!G8gY=2A|Fq%nq?xmi~vv9Ex4f=?)?3a{s{~Pnu%v zbXSM*jZ%LNcJXYj{u-5*#(>D`%=yJEyrAQ;1jypM9)IiER}E(w1F#1Zhl6f-=Zna~ z2BmU-$b>TIZhvu7=5POxea_vlDhpm;m12d@F(?nAvM_tQlNP#Y`7U6LxO-h+#R>1O z&fGsak%FYa!wPsGhV#pxBSbx$0N?Wo{?Po*Kp4D|PZqfrR`Q^X7M`1hspI))o<#XW z9do$o%@!;`GHEaAJEwrJf#HMSyQar1L<97t8pITakE(GZw@Yay^%JS2PW!*&f&?N? zUv&U&`iFZoOUgaMNO-qs4;)nt=!F{bkaM#&)N8=yX#ANAMYY7 z+wcv%4$7*J0eQtC{WFzw92=^Kb(w30MgyM%%8+|KnMN6$d7k7uI6=eojH-9*Vk7He zKr;BG_p*(DW%dDYK){i&6_e*grdv!~nC7OeZ%_wb+}|H50Y8lIH$u@VzCi?cR;j0l zGdUp-#I;(#Z__o@EChBM$(bPhO~(}sav+p4w0RWR8l1ZkImhY%pW@XFGUR69Bqzq8hf(rCJ@UCLU zYUVyOg1D@M9U9v7_^_;$ck2wRMgam7$LK{d)1(w>k)^bd+Qm(n@1!{EN%Amn@+U;8 zV^e|a{8x|vD;HppjjPAD_UqpEo-nB6P@__#_2mFHd3BSvovDg6sW1Smj zZW-n>52FB^*3_H`6<+mY;q7(m=Z`TSKWxyWOKYmx-^Tp#uF~e*14w2sqDt~A>v>%p_+d;ppjvapW-mBTpfjByU;q< z1BDf&O`qMRl?GZjvoD0V+B?xQGC`sWy?R|NxTHnECiP|sPQmZ3e!J@7JqAZD(%4vg zH+mZv5$tI23*gZKRa3gJb*I=y-F{!j#c8=Y(rw{gJ;8(c8z8A05D!buVdVjt82pcF z#a@w;rg+~fUz*fwjdL-qXk#bEu}fz$fnIG;J?__4w{MrU6uln?)DD)q{q%tz&Wrgz z+`T-GDK@s{&gegCKvpD2<$PuC%CS^T|cMgPHx%bccqU9{BSdOIpT(1k&8YgPHdLB8cyE z=3%WBnCNQkH>apV8_%RrKR=~kvBX#DIB|=#D|6lF_K$A~@LZsv;_C4Ge9Ho8zYNr@ zK%a2}A8&{;4c9-INm+7iU7U^(Fzf-DAW`;H5p)!7A%fSj+`F%bk2Td&xT91)UW$Qt z@1UX^t6`78nEMAZLD6HZjJjsx1;>X0@OnNh5-!HQvBK26)n;z-?(BQL70m_-Uy|;9 zbVD{Y`dCE=Ze{@n&`L30sObqd^_=quNZ){=PV>QOx7)X^=8amPpD(O3!UB{Dhkba) z)>OiSgD$T>_Ik+!)DJ^FK1f65!7KB%+s}@_(%gabk4nQYGLZ$6E&ga~IX_l@$MfxLY^OUC9|aNw`l=x0~a{!Cf|_s6iD5Qs;nV8sdGbGfM}yzh6CaUzC%gCu0$ z3wWoiJc2AWjMGfo5PR-jaD7o{fvV#Ya>eu_p-`rH{YD6xPf4p1PI+62_oi|?`zy~C zrQCp!hH5+9#;gN;*GG}(5GQV?v3xc*uZnw{)?lu-wED(~dZNfKX;(m3?VucySA;Rb zcYn8^6F9vrz8gZw;gE}6Vz*pCKh+G*eH#2CFd$ZZAKGdI-^kls%pAAf!G)YqwrY~u zpPffFRRIR;%VQT2N*R;}t}G|j5xa2E*+C6c@rVc>X+;0HXOauKC=N@vQ_Z0ehQs?z zI`%})LjV<1qvu%4kY*&TV}aWIVT*CPxsXZtTRT>X>wJkT`(kMGN4u7S8RzKo@Rifb zo930&AM3~Jtk;j$RRlzu*o#W{4n<`z&rIt+XUx(L?CLR1fFgHHnzvOGFSwbrjZ_!) znbGOz5IKSu^HW+tN!gH7`ql6Q~0p|wbz-b?DluNI`Fx;I-(Sp?M5KBzCDpu%S{5L0|^ zW>DkkhqD29yfiw=DmGbCenFAn`~*o}DEYkB0OgDq2rIqqTa(^FFG%`IwRL?K;}Lnz zuRI^m-TgevqD>SA-Ehj6vW>wEyYteFw~6QeS}BLly{b5ip<8q@k;kKsTioy&x7)gu z@T!D>2X_hIJys=8uT)>+aenvPN~>1t{bRyAC^>_BR5t>DBg^wtR(scM5 z`TRgW3dp>M)SgcUr1I3yv3z7l#qk;$@^Ds}1tyrM4ZV4@0~1NRC?bgx=valVNOHs! ziWe|#d_mJMnX3s@_>PHGdv{Zed;YT%-WNJ1GUFuf4`ozHf3KWeh%U(NtHS$rshvlR zzv~Ckt7|(Jq4%o4N2i1W1=O?NseTi)$o>ImkA8%>{XoNX7( zOA+NmN!om5MsX+3?AqU3E+ZNV*Mxm$mFt=wEq#cC^P>y1_sC;p*`1pz?3`02-=? zqvlrT|MoU6V9OC4dDWomDQ^Y;p!w+ z@x}28%-vIM&wmpe|8F8i?!x!=@V3}?zn&kvS1aycHS_PEp?I{91JDfZF zdt%pfj`3DY4`q+_4Zmh@eRdx;k-CZsC2cm~8r?8f5E(S|2PUC<)Dh_(4HVg=?GD4v zv5K!U8GEajnA@8j?`f73ze5@C=&pK#eG!sa89>d6MNykmcOLTGfod0Cq&2kRHz25iomVq89TxZU!jfNv?tcYjc&et>-RZ3QLh22 z{rcIoYDN$E+a22%!_L2?|3rS|nWH7A-tl0Au z`#Nxn6ZujC(-k0#Qbc$45Jm)eeZv2aJWn`^FL;q&>v|4st*!b9@-UGSXi|d3T%KtB zF*DpQxBOFe%gJ#C+LgS~=vWtM(?njPx2IoplI3poQb&9JXmtWRq`1Zu=QEv{>$|B! zAxQ7*X}CEy7@pvb!ar4Kg^v8vCPru~R~3YiT2bxhVJ;`%x>nx{XWo9@qAYf&`0XJx zAdBdXwKdO`3}DlT-6AQd`iedS=ug+z$Os<_%KgUH#wP(DpF-oSBg1aSs5ynQVC`1P z7ZQ70xOHv@yQ}DnICDrLC*C%|xapmr{g{~CU2NPeBz5n3N{q1+`_bs85VpO{=Ae2< zY#rd!tstJQm$?{Ynt{55(Z6PLdFrG9^)Ars4`lt5eLW+lW9QSeC$$_dQ<-Z8V<{h$ z3BZntg~~4STm85V5RV&7~pR`Vhbr3B*T1cXkG&BWF>Jz7m! z8^d^Mbsps9zWz_4K|;n=VFjuXa#|O|VvK4r-_>y7m5FA2jgQM-Ps|~O1DSDU`o)oa z(PLse6oth`WCz1 z1>E+8n46we1;hmE&z1TRK{%Bvc`ZTsj{bHkdSVQV_L#9y zgh~DPw3gdp{8NmN1mtZn?BBfE8k?Q7M0P-Lm8e5U1&ED^O(BEUX30k3XY>UpFy8Y>gimFSwW4R!wK})sH6?=sGBbXL4USt%nb+~ zFEesJwM@GL4d+6&Q!>zBytTV>zw$F?Vg47Vtl%CvUf^k-a5jAT=55E1sG3gQ>Bn%Z zc262}$^VLy;Zv@}(%5LL5ePFIRGC%)^5wcrY<^I}&X>AD(xEYyk*!#Ay~9fKSu>n`fX=Ad zUh02@?Vgu+w@w1=s)&Nx@+2nkZ1he+0zH*HYxycje2^gPa7ZUF;3ZN_VMiyjwV0BF z!r7Kc-px$k7_sWX{iB=!;;qM__(cVgr!7d(!e)bfUibP&=&uAZyED3Y!6NYPIJH8m zBT7pejq5kY5Kzx!uS{r^)^&?&N!o#L>ZNt z{9LDrpx9kX&zMmX^xmfbmaY_k%jdCu1JwjxIbMp{9!zx`RT}YU&W5rQ`@;+{{&{*3 zz)#&G!_E9f6}(O%5~?L@end~@%OuF5DHs*Obw8S)kUhfM_c+79bm6e3e- z$ipRg_@iZ@ea-NWKToD}tr)Z7jncPVwzlUlV%HNa)(QZM2hR!#ZKRWu z@$2eTIx$b8Q`0t)(DoYl2Yc9>e4fRLz%CN=B7`mJ@$JSLS+CiNo+&04R+=Ba2;D|BKu$@dwX)x? z`MniQeS1qTLgkj%#}03unUIa`+Z7_@MDcDJ?6D zE`MZ4x}n)9s?S}wRG7gVD?T~7|0E02G4Elecor16W^D3pWTzkH7 zsbegp9SFyq^P$6x>+bX{hogn;#T@Ja&q>sXo;N#!C~G<86-2uFuujD*e!0c8`JD!D zeU(Wio1hX!&aOO7hYpGMmANR4|YuaH8NMBQKc#v*-u2~pPEi?p<6SeqT7vhsmY3GRp$DoM8)y+mQL&myyg=9V&~=Ean(34ixiIxo zK1wD(8(!X#(qRlmj%+S=Xem?*^h~15?pHG&ggka&-&Y<(j?gSSbZepnJ!x758C8j{ z8CL-O_>MP=wFZ3^=-GmxV}RS8A+*vE-Q#6YeopvlsoPle5!Odb(eoA97I)`2?IYKk z-T%@deO_fGhbBFnIO7ik+8#MEX$YskM7fmbLDZ|B9PC_=dH| z>2Er^FeCeosUAgAZ2eLsgv9;f|K(eNp?Lep3esgqBV=9pT!lB8EKG(fQ-4)0&^dHuPwXQgzxp-SZN(1*QCSpW?wb; zBf@*fzQwF?V~|;0xA>=B@K?hfO&Yp-t6+M|NT)WoK5RuCakrQ~-cS6Mnrgc^Lg_$Y1 zgN?@Um53iPCfhwLi$pXFGB*Fr5#!kWa97CKR-kFEwI>?CdcDN>!=ajY?pq@=MO6~U zP580)7ZTjx*}*+jY@E5Fd?7Tzt(?by@5mX~%Ai5~vadD4UH<2dk%mS~;a)}4F?UJA zQ45iuEj@Vg_=9NyHR0xS$P-5xXN%Y{?|?&Hymsj$cuRrpshHZe{E;5d8llht(J&T$ z+GaI*N0v!lSl3r@F`F}{q}g)O)uMdC>7p|3Yd;1*$ua%y*I@=fb6BCbmr>HYPdrCg z*(jr0o)7MACn>{sAXQm(kO%=9NwZ@`tI1;@kbA2HV8;$ zQTr>UjG*ZemSUF z&kERgBcY_D(AKRZe}n$>@{&e}!(%wK}6rq7NqRlB=BTtRZ3Y$Ne+ zezOo?9(F8&)(*m{jlsapi$%%@D;I_7HQ1qEYpttzc{tzLH6;5d&xom1!UlJv)qmFX z9`TRYW-lf3v@CZS=hLiCFC%^*gIlSMsUCeIdv4xLpz|O4t_Lw!YCEKWS8cOXus!4z zmb9}_sd)-zmv)UNRl(T~ zsBCDD73f*lPsY<-+sJ4iV;3r)QP;nl^Utj~b zS&c*M+yrv`a~_n&N$J0YQ<7 zFCUv3;)v~EKM&jugzf0UJ|^}~XtfcU_@8=wBYAFyUGKmpOkkSd8JjM?%3D3M1B=eQ z=5vSqIXg zKhDo~k?;JZcgiIn!Q5*doQ8A~6zmzH=sr6>Nku8ic4a<4He35slZ+ls7 z{VN=^*YnbA$76+<<@~_)9Dp<*qr3~8gZ1J{{A4b2L=>dsa0=Ar%65Nq<%%}sX=R7k z>D9sCwJyj&Ks5V8p;tkh8C1DfDF}fy-qohHi+TwtScLIi9%MuR@yB+ZNX(|8Rka~r z6Q(m|2S>Y%y*X(ip3@MZCtzT8$n zVheG(%$s0(H;f$nMoG72Ln^@O#!()cs;VuV8ucKjWRhJXA z`K2AY6<%u_dPOOt+e7Dx;c5$rmv2tSz2MgOIw_EOm-&!}pT@QZZNRTk2^zvT^F9>0e>>y0Ud7BJoXB+iX<} z<3t+LLqBq9mT62XafuFKxMOx+8LHoCkyzhM#MErv>!pqJVl_A0iNqwP7WYlZo|cD% z)som`7H~b{vPre2tf9^mqiA^6?6G$pYaei94V{9SBx*~Ax2~?@sL^QMR=Napb6Q;1 z4o0(k*orO`=y51Ga>ln}V`Z|C|8n9)W%CjwAfGRj-`oXhu3M*OW9uW@QBmFP&-P~y z{-weY?lNx$ussK`t5JUlVU*)ecKyF^WR4A_Xq7&r1jenO1-@mcy@>55Ap3_y!3m9Bx z=*Ckv677js-^|a$3YZ&7h^yRZq|e&DpoAb!g;Lz6ZqiFl)s@l6@#~QMioe^R)W(Xd3bEk=3w7l@*eZ{+PqNYw?Yo< zy~c=X?Zi#Ia+s!y0SJg@zsN=~>%7~pGmzx+>u>hO&HbfLn_%aH!zpS-Zj=YY3XVqf zU5+tUCo%SzjX+0kY|!D6ohr3z<%7QOW{<(!?1Ojt+F0T}lf$xKb+~D3KO%vL_?$sx zbKe+bYaAP5fLE(L?E5Blv!xzw7$8i>&CF7jdVi5|3r8)k9ei3~V075kW*}O7iXVpX z1?(5j)wFPMZZorNDX^0G{lkEXiS?SQiOtrZNa9$I(^1uC9|t$K+OI1WB6l~;sPeu$ zKVp@O{JeMW9$1L$&wtd9?0w&SZ;qeh+SCi#?WC*9nWA{n2udPgCkSd>TdN{t-#y<> z>HhcT15C?Go*PCCT@wtn8)ma~B2Bh;HM|8)h``->a8>#J7j?5|&;RmTiT^Qg`aiv= z;{UD(dfnRB^XuY^dxvvEIUc0VjItWx9Xb|&h5TnAZoO>h!U`S#ol5yLmB7|b2{^ti z*zp0VSLakuOZep1)Qn(4IK;3~E?VGk$g0-{vB}gb{q3t1%7pFnb|9m(hr(%yijfa> zfnq!o%JfHb61oOtQNEv%~tg}28s|% z&&%c$pko!H3rr~YlSo#At;y|7LH`cw6c;ixRudb%wG4)e%t$WYo+B_DKz9%CUK>(` z5j2deS4=r!(Kw2iZsN2JDiy7yTFdrr@Yr$Ed#aYgim2`|k%92#Nr?+0pf)PJQ{xpk z?%mthMv6rzcJCW8fr|K;Y!@TSYzMw8%zVDv>!oG1>f1t-LjpL+%H`fGVFl9ZxjD&j zghx(#*1$qvT83cwag;ZtlY>)xu2pw`A_(zP4XkElv%L_|x;GzZ;Ul~sKT`aZ(%qmf zhq7Be_&m3QRAS)R;HXiwvUnxRk2T&XV)jIQSw0;mi>!mxIW0OphbTS?O=|+toJhL3 zff1R}Oq}Ct*?L_MSRSdf>G-h9QF$z;%4rG{?xADE^Y@;%0|04;sT;T8WkI9C*P-WG zB+7#oSVbeXT+XNg$YLV7?3>k-nv~?(Cb%5lnykRMUAM|OPpZJ5rt;YT4|ne!*JReN zjp{IC84w(m-t@Hq(m{ID;Z;WIgY+gMAcT%|LU3rKG)H>JLFo{RB=jg47-|%R5Lyf^ zLV!RZ1PG9`0yyv9=j`9N&v(AP&+j|u?>tGKXFY4J`(F2T-Pc81T<1PB>~guabDDO4 zrg6qUwJR(Ip%b3hS!2$}I!X0x8+oWlqjd%9*D5o5kj7(VhAouL!Am zksjjH;B{sFy>zbejRY!&;ACrGTH#m@k-UzyH!EsN#BF;v`53rb+mR{M8;LVZS(FfS zq;Ycy_jrk0m`hpPW#-(8m^ga^G@Y@m^T#gqPX%3;X*IU-_meiydsW^0+LhUEB_$}{ zdMS76_dYL!bT6}FCC)e{>2*I5rC(T;&eie1z_rco6n9BZRrkY1)I3QckDU0&UmJ%c zH%&Ni>+kqBb9zNx!~WV(GqIx@GPIfCG);O7=Vy7bF}kh%7yYV+nQW981e(}l+v{O5 zg;d{sPD~&!_16=LuId4HMWa=fr1N<4o<)C`&5o*?-GuabaZPSHDeL;?Eg!x6srvPB z9r~vDO8Q9oZZJlRk&vGm;K7?T(yM^BwLF*vD+>PbwC%wpjehwnd`YRpuNI3O zTc(y`JPfJ7B>CAcPoU4%S%&v7kfwvn;a5G#(})1Q&>uMk^UTkx+&) zu7GUQY{DmTp$Wu(w5mBiqDnPjyVZAF6yf0qeNL|zDmU#aZ)+G@zjy)Fg}zt0l&Taru?| zDUB4CP4z=Z7IPAyBP;%XjLxRlGYvl0Gdx}u+K>dt*JoQ4sXkM8O!LP@N6McpM=N^T zcP$2Ze10+sEpcqd_IHV4TZ3#9$mTR-Ro%DLt%1X~rI12LOo2PJP6?Gcws^Hi%{5vJN4ZxISCZ`#xuj{551E=|?HRe@99RKq+^_7i^vQq7|Aszy z{I-d;(y)S8@tzz#OFN{?x=amoqL4^)ml!r*0sJk?;yO4*GoQavap#}K~(+Xz2LT)H%2)wwRmc|X9ZPJo*zfvHC zDmqb6(YBqfp(BmjwzE})!+iUMoSoj5>x3*X)b(YJU&M~yNgzJ1_gdRst}5KJqa%`( z9?bNiw)zGt42QC(61v2Mn%C5amEz=GVf$O+s0w?>FjUQ%U(tTWbkn4|PE{_iE9r1# zSl+y&847#P3NdNnp$7%LVX-u+R@TOo*cozR{Pn+`!)8c#YvY;lgymt2*pVJOy2&{|bravwIPFqWGk}Ij z3#oZRY`Z!YG5;FbGV;@hlj}a4g};W@uN3BW2G&S0_lS?l!=hmP?&f&WtwpskSp{HVf5y6|HtlKotlv0YsNEe8m;&$Aq}K`jn+{3UyG?} z9ytqH(ykL#lKgOKq4Mje%9@H=$UQ_zm6zpO&hkKhtN8`ejg0&R3gUWAn5jJ%Ey1a0 zrkUsSh5TEV(8{^Jp&cUr^75EysW!pJ)jEad0fUxy&Rn2=)>$B(Y~M4~GJ0G*t&j?r zzDL3}VM1Ew+ZF0VbA^<=lK$-6B=g@`I)Gl&Ci}c{SGd$F- z*oL%YW*_J;$dAG9`-kK_gz}NNF&aP}rdxux)Vjgru~X8&C3PKX9n8-h{_3eRcF`gJ z-*Iwo!%B)K2}&o*+YuWr+qLd!{+wZ@TkF}M7ZN(3%|#(m*hSRhY&ccO92z$W$+9brhqg`HP~)ZK5C?&(5FXWp{#&&}Kj=^_3# zezCPNH@7?}=b_pMTHH*!hUhxi|Pp)E|_op#w0wQCTXu*-h_bb7%r!4q7=$qUKuu#e#%E>dPpb1M?7$z z6C%rF(7fq-XD3~#y;pI`-j;Y?-Q;#1?fKw3+muUTP{QzYdeO86f2culyh37QkS&!m z+2s{jSxIjrDqhbM&y}>xIfJ8PjMtQnN01u1T539tf^m+m!4o>mI~9{E{Pc=q>>S2< zO1K{?Ou{YJ*;Ca&EbdWggVj=62DI&FRJj$*}v%+mE$X zHz>2~>RGQ3&$SIKSA9fub?-8RUZ@ww&pBRT9QL6(v9OC;LQN;PmXm_cBL$9C2b8l1 z$@O1)U&gJ)TKV0}r>nTHcTFu0y71nO8Qg3FoOoe;^4wv$;{N~s z#~EIun~k5w@j{A|kCLl#MF-D!>|NG%=ig-cD|*=IWuP2aanp3}@Pi12p$AbZd+eh9 zIfp8O5%s!#r^;(P+P(rU2-8c4S3T%AOBLLV{=1v1zHF&l`fpW2xT#Yt^a$xcb}Xdw zy4n)!w-&IE5L29k{on0XcI7?n^q;>mhc>KC14g<3);YwMfxkWbP1msX|FyrgxcpsD zt7ovHgmu&F`F-y>($v@tJ@=zOL0CKJOJ9#i<&uBz#_G6sGaw%qjY_S1?L3@AJXPM~ z5O22+zmY*jDNi)-K24-eepFGnQ6Mh#XnGC@_z0k7)f<*od7fj>!R+%s*U=o?{H+g% zvmD7BzZlz_nI{wtO~2=_Y_FJ#v8kCDT)8Pf#CT9A4X}itkTIFPLZ{9TFq|5;(>bCU z+v6X+`*ys_CDeETMX$)eXZ%m4N4TmD$}8rV?`F4sH(TZUi)(sD;}=GH)870STxuK%&9&*6L;QRl+n^@M)cCe zlJdd5h@7siqo5zu@l4-Y-civATpx|^%Gac3j_n%`W0G?VZ3`?pjm+v@%MriO#1OWA zlLrGCVG0LxEzW_<$WEZh5J2u|!h4r0k5lgkFP5tO?oJIC@1Jx0-IU{TVuOPE-iAVV zBY#KLpJmlWsW(Iy$!tAg*Q~e#=5DzvYD=EEQ3rW!PQGu|R;I@Wul-oE#z$9VU0wCw zBYTzDx~OBxq-DXROncZAw`<9;dLiJ%3VCzERn9ckLjJ019EBy!#W`L_r7g~Ez!RPm zArr->;|k>Syhe zpKxMJqNu)+@8{DlRbLW2dAstr(mOtkpxs?n=DzE-Jw`t#g>Kpp9^CIH*J$Fx(RhCP zKOp4kz9wI_3&{FKnmUg-!h8u%@u@99?rkkt^P9%{8j}!^sbUMn8egrSLSppw%7M(* zeClmQyXm!cpCKDi9l$r~m(!$IhO*ZVxquaX%++2o2t+`nI3p9xYGp)C*k!GLxVy|! z4y)mig{$zmhx+c2zO@tgTw`KNb zi@KY-f$6wYR}wa5Pbp0t>F?LdH(u?ZeP>zAe9dM}wQT%wqq9h5ZZ|x4&B$v{gWA z`e$To1LCQ0tC4yhPjr*1^t16Q{Lq`e}eMF6_uKK{NXxz?O=MpE4vSNU3B$nQO7M~ zc5%v=YiDZ9TxLvL@ph&cIq|*e%b>gxa|5@=ADMTf}H z^E1P4zJEAT?4zE7`Gaa%KC@Amu()R=lw|6G4eH0y--K5#o3od%Q(AcgO|dzGTAsc8 z*|ypvBQ-1Aa=i&2e_+BYJcl+WOg)U3dIKB})JTt6_#ce68K&TSEAbQQrtpKZ=&=*p zhY`R+`-01rtfz<9vZen2D!lv;BifFjk!RCg|LDWO5TRi5ckpEfaXU+~!w(+xUyyHS zjtaQ`PR)1DhXSP_tV=ro7WtFG9hM)Dgn^Ik{2g8Y>v_5V4`{Rht@+ZUGf!?cxNHxu z0@(7tyEQZy@MKTb!GDZJtt1?2%pM#0UYpA(d|D?ks#GaVdZ}h0TO8SO6DXTP00<%Z zBdDm}t*{7!G*pxF-Nwys-?W4d92R~hPbcN#OhZu5kFp*M{tdN)7C^nFJ}6mg^R~ol z#lR=_?pdfXMppOCQEk4A_a6bFcCe8tc&bio9_nbIu}!L2YCKtn*=`NhUUld$RElBc z7?)oP{y=M=GpXV{N_8scnX>?eZ95=Z!PK@_R+qr#^S7I?z`It~pH+8cgI+6_>Nm&d z4uup0rhEvi5a+09z#{&^JiMt^9ghZD)c*xs4J>eKD(*&BQBR zHfCyuvPRM;QgGo(HuR3w?8e@gAwZxE;k_@yk2%zz0OatXXIL}&56>NXrIP1kli;oNFeR7H1ZJEr>8aGvsh0@xv3aNCxQgW^%m+e6C&Ii#aynHNMhK>{w){dNnrC9t z)WaPcW-z_Fb>nx0a=nteTGzKcnlX1po-98xYY6-_Sna#74FsCCCeJ=Ec5o2jr-k{^ zs_|lhB92c0nQI8z>|!s)6v%WVx9W}~t;idIGrL}}2Bw%)k7W5whl^Dku`~IxqtzyV6#UY^>Y1Xx3>d7 z)GB#~)qE;Eh(^+WdG%Sx=b@L!c1)B$v`N#<`2-BuiM#N?sAM6lpW1~nKQ^~4_yMs) zd-frrpx4dh8Pc3&T4MjtpKh>urG#sCDn)0YF?UUGX7*3SZ?;jN?UQ|f4kdss|% z;y^*mlUc@H#2ff}W|HlBO6CioNGRn|j?v2=75MQDAW(gW#y!CbG&q?w>NTr!rnBjj zsxPX0KQW7yb$vYC>c!{Hx!FJVWy6>M<7vlsMf>K4P~OkHgpryW4n7z8fRicF7gqs6 z^pXIB!|Ur*9;PILfIkV(%G?cquOofhBwhcs)_#vPWRE%9hl1;8+V1mk-v-S#pYx-I z4Ks`a_dmFH`&O;3|B;Y9ossaI+7k}nvEd|HXeu2%!@Jc_pCaT~&G_uO)7|uu3bD$j zbtBK|3F*rwLt1Q z@_$qTvZtASZu*f+KqRG{H$|L?=WAmuVgr*FTsoGO7_UOF&D|vw{lMDsnSbTSxR;h` z3}l;q)mly|g?L$VXpy(n6tF5zI5kZyK?&_uu0+T==vJ@%M(77{ew-;hp5M{l$VxRR~Aw0 zlS$Z6$uuP%J^+u98455R*OOgtO9gK%UdecdNmHL&$u}S1gRn6P!oOy0wAbzgJC?kC zNJs&yL7~waNe%zly`&jgdpq~u@ww4_k>evTyWs42`qC63&Rji9VhG10B$?$KaLyYY zv9y>Cd+9DdlJsiGf1{ot?Zm7ZPXMc0usb6S zXO(xGQA~p_{L$N9Lk_WB*g9MY9sO?HMxEHpNo@!rA+)8Bw1%&P(-yYD{_RRqkq7|; ze)|kub!lw%D;9=(MyxO3S-@`0hHA zB3=&PvG4jk3Z>P5c0npPdnd4q$k#*qoPX_XOL8ozkvy205yROB7k1vyQ3?EPtP_1^ z1O@?ZP5oI76%g??s~LqZaP>QhLt_dayYEvpMgahRkbZeOdQ+YB&^W))r8dy2{@%yv zt130Mnp(VHvk{IhE{dV$hUkx0tWK4sNi19aGx#YYeluB{Gm0TNu-E6LedwPW2Xe1rL51T zN$P6^IB(~O7}{FmN7COJ-^8gvPm6LWe~GB>AF(#~$|Ds%CDJ19acWslEEC3~Jq_kUA2`4H!%O9px; zmmD*EtpahZ?Hax5ia%sjo)Rs$-Coa+O(L&;>hS=Ln-*oZGhSkxsS$dv1lt1JTTWku!T{3Q-56V+MF>UeJz+pmGv2SJxgm+Nx zcN}H);`v42ZTgWDZ{r)fzzxJnZx} zyh@b7fZdzuy(!I5zorLW-CunssAbovQP-h^WQA?*eO_&&d73u1mPj9;1FQApA4J3X zI?=c~5zJ{@?!F4lYl(rkOFM%m)U$OacXE-{svr2jw*+-A(DDPHi=ez(ouZ*$2|Q5z zJ}a^+pnq*_hUa(3S2g-a(+_+7M^TQ`SoI(esNy5Gt=f0hra_}aY(0Ozc6aT3#AU{X zFc%W%;7azLBs}EO?A)vMzA>pNe&!N?VtPI*tVKbe?Ld9CS~t$+Sm$ajlJMxQD#%_X zdJ+;t3WU@ZV_(Qt>$wYCb?@ zjodkf5FuLW7*B~4Ij%28f&A!H=#H1Ul3@9Dfdq1@iw=NS%-C-^e#ttKS<^?clNM1E zK);~8a)q5@w2h-ur;-SdfHeo<(dYDtT6x`;qK993v}-Es-q@iw?)yD3%Q42aLPaBc z45ZhxS_ho(D4s~^*KO+LP1oU0doTFtNM$0z0g?)+aNd1s_dM7*>#o{nJ6}bd5%pWB z8Nww%GjCaP-busjvUIgf;Z&Z#dNi|5`SL{n%yq|KwpTY|+w($~@>&w*uhaPq?)>}p z5Vp`OAaQkaOw6?xQd-uPbtU`mc5bo(+mLV;7h-A$ znmRYOpnG$>+i*o-b5!HZKV$7w3c~j2Rni)fwW$V@w5Ejs$8znKTOS3Cik?1F_Y%6- z`O$Z>Co>JbcfzD)-XfMcV-j7hPC#>nNwWBD*Y(KVTy zM(z4x&@D%?19jr7#)b5Dz}paO)mna9NCrGfQ0hz?+R z$$hjg{9Gk#2WgofrTMVkK>Tp9lBz@ar-4S=IhK2u9x>IlpGC-L=y`xpNcgDDafTU7K_Jl2 zu~oj`+gf#REvq&&xd!f--__>T5`OUI2UL*)f$wpYS_ozRs@f|M8>OhcEahdHDPFEY z8aZsQSGwJMm<`qjnX>9Grk$!?P1veS*$TX9%|xh&tNq~}0F#Ld#S?Nx)9y_Tvo35^ ziWZE@R41Ochxwgt2~hX>D+iacd3|@!jGsl&WGy(#kv6Hsd|?hrlYt!L?ydf{0wwQ! zx1K?{=u(>wOTDATHC`Hi2c))RF({Bi5cA|UTgXsy<-`dnXVes?nVnjN2EtO)1@M}q&hh{{_9t80i-Ne<8Zv*~u(W@!lq=^emy?bTYbS2@v$jT}1 zfIX8rO{l`h2;T_>`3^tOz1`b1b~4mfWa2!RRPImvJ6KS+;1>=E9?BN)rFOkz=@IOx zG2xEoWG#+j)!Zq2zI-@OWYpO%7ECDQC_3Ig*D|?I4K#Nb7GOCeY6uLO%=X)WO1&)8 zVk>qPG>O%vt6Pa{fy3(Lm;OHmnk@5=exe0TwZ7jvn0?5;p(&}ES_|>3L%h;a%0s?D z>9@WAB*Tx{4+)s14H8Sgt?t_5Plr|{4_Md`b&1h<%~nyd=7)p|Z_IEY^{mkfAA9zV z!nO}f;(kTgM3m?9o_6~jM#6BaH%hG7pKPM|uy>7ME-ifqbeQ{n}pnV-n6xL!@~zQg8`WcOm1G3 z<8mH0Mg?a zX!&-p0X}YKH=m4?XH%5B|4o%^@%nbsrwsQubREc%2B(qgtrDl{15*#ZF@6jl zmtX@{Z1{W~fi-{UL1}nq)uWNw3UAVAP#-2XF5gC|{iwS&F!M%1JaL;u6^W7-4)@&h zSXS>%8#skr{)wh?#YS;Ckg({;&gMu{sR$TIhl~Rf&4`Ky7C29oE&$VuqAr8Tsi9;N zN1Yd|OV~mkkPoFBxMdf!rYj+#cg;8d0YAvBl8yj01(rZnQa^$`N7yLfWb8pJ_-2W0NgN+bM};2Sj;6o1qs*x0QZE8s zP;Ja5uzA5Kz+Za7%0E7Ad(8bAHtgA`@6BeWelRljBEW(9DUvP!!`PKRH%9Z|IXN8sHc=E?dQnL&RoaCAEZppx1~ zm1HUnoJ}{$Jr}-D<~MiuV&^UdRgvL}4^_hIqcdzhoXLhiI?`~(kB}U#nqqj9o0%Z! z@$Www4rY?FpERpZ&~|G)*Gh|F`ew&ERDAf?kAqw;h&W!@TzEQ)>Y-9%z zF93B3+tF(U6TsKZ-)EURu}aiUGH8FlHPK^_5A=aHjyNU*8MOyO=cP31qqD6OPYHkG zdP$ca_*jSJF{{4Q!Juxl(1-bf(A~?y7Am~4?7h&j08ChZNWu9@aZ84kg31%52`?hLj%{YvPnSiGLfr#pux;`t@CN!c0I#m(v$8S1z1*k^ zKty`*%6$^#CNC(JDMOt$CkYe6Q+BF%97mNN_Oi4Gl3~{*ta9>TN3LTWpt9KCy=g8O z;E}QUu<3$Zjw>&|_lY3X>`>v;vkOwEex_UH)7QRmrM4-Dg&v)kf>15PAc0I+c0f+CYrXEoy9_Rzbh3Y4z zBUcG;bi#i!z|EPaIvsxbf&SHR8NmMYat1YJ(NB7h-GmIf9^LX$b-tCSb9+O=AVA{_orX0_`dN#M)=SXa{H&m)C~XrQXvq-(fYY(;M@^nQaw@vN?}Pa zYW=>EP%0FxeqjDEj`v?bv;1ApRo!$}F}0ij`XSKo0^^dfxbj-y;lC~ftxIbzD-*## z_guR2ZCY1;$_97Qm!+U~TC6q9V(+2XYROm_Ezs+fS6D~3IL&eOU%vpJm9y@J=&0^cA4}|3=x{ij&^OWy zBmo#&baZb`LG0FJWP&LvS6;`XvTv)r{nyh@`(2GAJh}j5F!o?@!|!^u_FV4-QGqzf zSnT_6bMQeWHxT#omfLUH8NPhIS4R2ouTw{C11BGG&EXk)ssw#6D`YKO`v(l8j?jRJwd{ytDU?Z+69j!0Z?7K)jd#7(tmW6^G1`&mYZ4* zf)W*%hYj))iskKoaki?;VE{vgFEDnxt-|F#Yk~A=+q0mJP7O$`PvtDt4WtjSqM#wh zzXqV&ErE^zdGQj+(gYM;??9j7%;)vsg0RUkdTdm0zGYrZ`e_pb(v%4DlbuV9b>2Np zdIkWIygy`L|E>R^AT*NnDIe0C7(BOdpjoohW;5PKLJco|g!YRQ(T*Q>umfw+2g3To zTmjh1x0Uo=5a)v%f<1H4A@&WczpHiB)dQuI?S(H<#|Hwp_fP?3o z`sII<4P8Br2g}B>eRP)k+v=<#>H;Y8r+D`c^}5jw*_SLxUutqY#}V=nD^IyM)=wV)4`cm2JV{BPpMA#wEAT{h>^^!F@1 z=*adr9H^Yndvn`{SG%?bqlc0sWREgsZR}Qa#|(1+qCh=u3S>Vk28qJX_Nkwx)nLIV zNInE^X$e-~LelXbZZ8rn?EweIV9Oy&GvC7KNfuU7vWA#@y zI=^z)`K;N=l$qp@GFsu4yQL<{l%!lcwjZn|*Q|h{BoKWGo|Jjm8z|DX2=2QV5(gi0 z9AJ7sOie*O#J#lCgLC_L`hNavqtym*dyO=+O;G>#{lUqjM#>tdP zf>rYy?Ygs)tlWj2U!=v)YquCq8nFqNCxHgDI*;y(4=3h~s!ea=T3#=ukjbOP5w%F{ zh-WAukwo|wwi=w#%HJ(sMH1(uZ%^uuI@8UUvjzN$^P@_8)2{8kObZrM4|AK!`}+?; z!1n#~plgglOW;Sm+2Nb^*MFRsilauJ49&UK_>gj!iM6CGZN9>a%wK&P3rE7 zER@kls4&IZ-zC)qjfAqLu&Th%6jc6WFw2clS4J7sgz1DP%}!X;?RXa0!t*Vc;p;j4 z?{|xp|0u8llGN0d+018aD$nb}1N9ri+M~SpKUjBk7~;=ME$tL*#s=Y*Pz|$-f+E5K zZ6UzT2)fd)cziCAFj^W1ffHl2>_eV_#1{IJXtux87Dv*3U3AMa%wSfQFkRQ%`|6r* zfx))_xnqfw#A!o6T-_GLXuZ^mcp_$N6Hki_NBhk#n83qnZ<@`LKi#L3r(S zvwP9yLz+nRU7z4l*BR2S!z%qTHXxSj;4r>gYVo*)OP%7#f3$g68adXH9O29J zR~pn7C}{Vy(^^80Pxfhji|>mDFmRt z&U(;v7ZB4a68=OdBcy}YE<|c+v>!KDvLzb86AGE4Wlh(SaLq7|!#UZ1;(}55e@yC7 z71R?raE?AJgt{T1Jgpy1>x!CLv9~G5&dNA!K={6EKREBgu~6LL4}a%$(R*>7QIk>` z0!&{NXg(t^7?$y*9l_~Tep=M8vdh4K`{`ECBs}U+?SV?t#*WH&%#H;Y=V!)-qL)FP z(phh7G>{+eW41L+VBz5GJ?^BM*pV`n)l<)e9_wp%EyiEeL6GM=oIqc09G43frr5XN z&+9M|8ZvHh^qvYVLB$COak0Xz5LYCCZ{)#3Ws31Mg!R;yivoFF6fXgxL3!u&A#J7u zZfD2G^fxpr5-^H!<&LSLFa4dzp7Ryj-SJ=S`X%ACV=^>7>J6xHNaf310vZEAE!r=A zc*^>$kQ!7^dmE^e-KW=>v|=7CsBX;5)CH_`{RlM0_|IzwYOC4-(gjnrLD}wFRK8*O zKlHZu-Od?p%CLe*S?_4A$8<28>+$wbyI&b`K)uJpqPa-sNOG>xKJ$o8^LPX_TAx;) zk74ZGGky2RiSr=*`84c5dvXHT6C4nXAOIQxoaTA0q|HVkoGzLTL3zaX6pSRDxvhY#cE1MR`4gOZaP4sGT%~f z#qP@SUiJySF35`8?642CI`>!_IGC@j4=-jVbeS}}LEpM;jZFHzT;qvcaPM=b4m@&P zn`>t0P-{`qFmMeG{AH)heqUXEBaE#vJ?b_sPe_wm4_R_KUg399aycaGMbv9ESbA~??m1gjGSjG;Swp4o zWnE={Vo3~bYYYXpG|kC3uVr^<^cPq&UA8_?g{C9C>Zca&{*uz)q&iz={_^Zqz^C!F z>rqgZVY<;fSOZ~LAtA8u1=vy^dxYM;iMwW`OUvY38PoFAg@>ZsW7|K#p+(`g%pfdg ztqy~tR(Rbjf5R#mH`f4n+8bBm9cMC@HTeQiZg(siHkf3YP&fR_e%S6JaQRY;=E(Kd zZ=ls;M7sLE`>SKBRU52EGCO8u^BG}o6sq}0jv9w3o`*^3xpG5|DI)aF@H z*qrDH$CvA!HNK3%HYQtwnMlcgSW*FJ_0tnG;S3=Jp7i+>jNrWE^KyCd4E2J z&R8EJ_=S4fb38Jc?8*tT>Y#sO5yXP8Z^_4)-{U4NrWi}GM2erk2 zW*Q5nD?z1fc4vDX##oY`ocv{tN=ehbQzUZpSGW~m0lstV zPF)AgBD?gCU5d|iMW4j3zDuU_d%u}O@wo^ET*P-hpEIiau~IAHLNoE8k~jb0Pa(G_ zu`05ou58}V3ATJUrnsfHzFu`$tQ8}4*+0|uGhj7ed1ANRAU&M!?vWB5?lW)6_3ky* zRa3{TnCFF)8L&i^!jnCyl*}7v-IOBbvi))UO}#`i`_<%&in$6IlG%-$kA>7+`RAZ7 z?~cDc*c-y0eKvO{>Y_HU7W6rv>bzM^`U-OW$xBuUd&gGF9)&bUA8Al`6B<)+tI+n# zrI40(?lnoW$|qCac-IK<%nv%=7*XPf0h-F?_75)U^|`k!_iV5gp1ArHy7-x^Lm02! zcy1S^Lk%!U(yddXCQPc4#JE+?!pQYs+!P|^Z11g8C!hA$5jL|K9|galjUG9G5NqpT z?6BSMtQJFN$PTpSoDEm5-^9n@UI3mEINUJ3sW^LW=9@bA)f*98?(G!c*Pv>&zWx@q zQY0f1d}scx_Zp7l3RVF`)FzsB^Mx)0(`w*V+_n%ZyP=nE-=B7A*&5W@Hsauz23G^Z z-o`|0@SVq-Eojg>kMh-{GRMPYzU~fWjxG~fyQSX$=jQRb5Q2DMmy?rAlr^e4d|_{c zH)TOyWrhS$BAi^GxECW_?tF+x(9~fy@?!-9Qy>5f%-G8oZ{Kn}s%`;u<|rp0*S?vu z-=6ut_`JvqAaCB@;<~rM!v0sW$Pd2|=QrLcDv}ELK=B_kUKeXMwE|#ty;;%fT zn|}sWeI;^yX_#cEyW>c*C1JpoJGwA%QZsBTju>r^%Fq(2xnPv2-!;`6D9GQoTFRm5 zVYrCZ@S|)KpFf>VtoM!UU>2_hMacP4V>1Jp0-oxX*T0M_h*=9spKr$i5s;!Vt^5RB zb_Au;YdcJtzBbn#ECO?3R1<$PkHQaERf-iXv5%QB{kZ)Ur{-gHFmzwa{_!sR^Wo5L z?m@qR*b+m#{l-;Xk|Jhec}#K{fEB>zu}V{`lyMu$P{FwbFU!|;sV-!Yt#4Y6+tI_S za+KgBZIwSiKG=00=wlfXl&_Eu`*{hy_TRsP1739O0Ipo^5k&Yinx^SJ4YGdECI&Mj zK-s|_X>9yH4LDS6@EbukgEMj^xcItG-YjDfS{{#A(~?BEtAcNBkuzygy&Mx|Mn!x6 zKrMd3y)~#J*3c@nJ!{j^rB$XDp~25z<6##v+rHv6R0T~sW8PKnD{bxpK*Nf|05+)bYWma>oM;OdvU;i@D}{E1c)( zTt*`Za)4RG+``6~*+BNWf#z_lUy;DGEBA7$=YdO}bs&aGM3u6=%LrDgVXB?1q&64gh$>Bt2Lmf4cLIr>+bAs3hDHpbp_Y_`{NG|MNA;m@5Sn z4>w9ynfN?AAkcWv{((QmgpjvJkZow0bN`}KmG6X9^Qv{=%lHmkSKh74lmPRJe{`-i zdnqrL6t)XBlZ6nt5K{HFb9M}qP~;SBX8#RX<)z=)TsDfwN|T=MJb=%@v@>WgS?7u|=9Un$dzkAu3BjI)Uu~`$?P9{$+;Ai+KG(VPu*Ot< zjoOPqXvocYCe{cDCG~_v!3og6qzqI~zAVxl*CtmPy5qQWH z0MiZ=DXDP_1-gevN?#a%qWn}yd4LBlzG0MDL#EShZaEhB9o_T@7hvmmtu({u_?pqY z4Z&a+GVfo-H z%(XqzVBO zIf4?w!hVX0wF9Eppnxd)i>uivrPWI!)q41jVAyS^v+_I-|9abfGJu2e`K)N=;tMf5 zzm`oVW#h4XazK1;PR$Uq=5Q9X!N4OX0npuHydbP_%g z`n4=ph!z_NM|wh0RfQB@$8mw62YY+(@3+hw7x$IqdsU-fEWj9D9fZAl#ornIQ(o+u z*J3K4d#sj{7M)`Mxtui@M4eZqu)PnvX5({W zLgf|dw@fO|8;$d|wGSy1`lo*nm_KGGWg{=LW)7Yev#+WXkkhy@Mc-FS(JqNGa{D-3 zrD7K$^L#X1 zJpZ81Z%5SFh@>qEFnK?>`T*}IvvyAPkoUv-Z`oO6vH`yTr!m`|6$xZNnq=nenRbje z5(K_(=~el}t$Tp!_agX#?YH?CVrNpPgV!I3oiHSs4Wx;$C}m75bg6!jJ=^tjjYh~r zFt2jk5{{M;laASl{%TApDNJ1aSoeMJC6g4%$xJa#M;REZ1!Keq?Sr!t1=US2nE>+< zN+0sZIIJnSwbuJ|B=~jt~EfG?QZa?@2Sa z!K_d@8gPqjHqnCkx_kp=Ley$rAgbJ#K6cHr%1@s?%MF_*iQ%QIZ$e=%?|9XmzU>+a zCIa?zsyC%ueo@0bk(P<$6?M{<{{{%0Z*VqTw$)kC&J@m?ip*0hr z{Pdt|7Zk4=1o2AX+paAC__))Bd@-c}Jha1DN04(9a6y^0ND*DtA9G{!M_p>j4~0A1 z;sM_^pd^p~@lu6~s>Y#5X9U5?h^0r5?H|+erQfK!U~k6nj39aLJj_S8#X))KwI+m@ zHS)WaW#85{2k??&|f1qpnzqL>4h!pfc2MNl2m{N3mGWw9b*P+I)a?O47kECcS z7KG2nSJm5^cwJz7q(}1FLdfha5lL_*VEyAT%RRtmowM33vzWu({`Gt@@LPj92hr6K zVh7y;uSa6&CwZA56Wbrigt33L&^PjT|G{0=T1aTd}LK=wNv_(Bug<4=dCO$lEYR`&Td=1t&4g|s1D`3y=8+7n9m1-eg;`Tz({}E7EJs}BsOr8?v8Av zGFEoJtP>&@FvW1M&>QXz-9@Q%jx>Wk;dtdp-`VZB_OEsGS1vi3X7&Lu$a8o0x^SuE z;H^CHs6|X_{lx}saVBSTM~C#MX4=t)n!;)L&=53YN>zi22{{}UTdpyo0`nACkA{;e zwvHIK$(|L?)+flbnX6SVf?F&4jdKM7<9%hP zvYG;#ujtus{u;EAQ<;o~xB!-pKsZ^veqHi(+)ArDQw!CbVCc!lG@fVKvf)&K&1?C0 ze5qeIiqFo|WQCei1!Xck&Q{V37aRzK04d5fTON&8c&`R;5NVmID$a_BEumMxw!fib zvzIp(diGB0g6ViiE|T&a`l@Vo#dZFCLzTr8-hVf6cW>fC4@=ZQ{f%=x1oEJZ2OLZ< zP8bQd0Z+a7{JsbA#8>9S_;SaaIFsDLn@*lvaQLI+e=&&{^_#HW!AC{5e7^du=AP-E zWYwL4Rrd<>B*xcE^#IP?BL~S= zqZB#0pUXRbV4oquEJksTM@(74BG0scwcbC+4*jyQiWfJFk@O60nTL17FuUvP4xPHX zi*Ow>joRbLmS(^Zj-Psde4c@74NXceEL&%2g$pO)X|$~s8ZjL%@mu#3L+5L!jyJMh ziTd8$_Cm|W>nqP~zL&oE*VS4Zo5rZ#d*5Gr`b&HN#ggA6Y<`aT{`;SNp5FG2Jp0c} zf8Laec*l3s=k9l*;d`Y+#iSgQ{HhfL=a7&ldziX#=8E6q=Tej6>qFGMvXQBS{Jy~C z356Q@sx`7U?07vnBCZc(wvXOQqN}Zv0k+ zL6X(3lkSdx?1*?OPs~D3?Jy9Fp6jiKV<8DAQplPV%IpfKt4jwzJkxxIj@X`PM&2Wz zvQ}&kbJ#z%9_gZ(fwXTD51w$rhP!0*>n1NyUvt!+!Df`Id760!zFUHN?lkC%!8XgF z!>pgeVYUtFzT<0Re!tOvN26M+Cnka`LZ1{#hAy13zP4vky;M1f8AfiCHG?V|AAee( zm-ZT^{&LFiJtNHgjWnuhqqC<_8Jjw$=0SNjzbL|x4;IwQ8iKhK$E7u#JzLg4%@W;? zJJtL2u7r-qC}Q90=z41Im(NcODmDh#Hx>GP`lh#k682=qi^f!nVWbitT)WpwK(n&$+NyRJP%wInkVd3B=o1~1u7w)Arjq%kA;;l=bje})eNH( zMNFssy1Mr8O$9fQ?)XQoDCHULIaT``M2*$1d*l35Tgk!mW0(7)j0fQyrnX-Djjz{c ztUCvU`Bm&+L-mNQTBvsaowke|+M{M+bsv#8EjudrdnhBO%Ng(hcK8&2k*KqrL-O;$ zhfXGU2jN17$LjprsiqCv&7T~N<^;|rJ?;Agl2*Bv*iYgOiNWha7$rur!f2r#}8Bd$q93Lc$!n0t(Use1F6z+a6?7pO! zuz3h98xwBn;aL3^6apr0sm!?6ANU_d7<}r+a%7z~8e<(fXEzbNyFb5u2oQSJ$)~2NwdNpI_Ctv-kz^d;%!X6HS*Uz+IZE7a0N>#2Nw;5X`Tcy+lu8uXD^F9U%$Sv*uJ-O?Y~xcV21xJT>idAgw5 zN>w$wco#OOGrK3Y9lX9Ka@BE8NSh7{0Kaq+E9u48pkFhckZb+Lo=RGp%cuM{uF^7M z!&k3TA2#CgDEgPSd3mDxi})^nT8`b+zF_~QySe85^5(*>?5c|`SAs%GRC+&poZ+=z z!=ERa+8t!)Il1?x_^BC@sjhN zvd=mD-Fu&BKj)x~!as z@nciIt$pCU6?&$?Ycb8>nzEUvMp34EGm${zf9Y3_jl<^ysRUtGU#ZV}XUQN1#2exI8PI150)*SJ) zW2k*Wo-(m2I>93v6XO^!dwQ$z*`DGX^|v}L>l9(kED@Zz)haKYI`Q@f^$BSNHIB^w z_7bKm`wAiise4*jh>9MnTfj>e@Y7eIEAem>*fm))_E+twOYEtrr6Xa}4fd+FHI%gv5Ya81ps4!9SS=|l?G&0( zuB-(sZ5ep$_BDRk3=WTZHoC=2DW3%!x4X=|{=`(r6+HmRB8Z41xrL7i_mazQoYq&4 ze3P@}?QI6~DFZo*6puA8$~&;~j?~9rkP@5j1l3L7;YATDrlMM9c<*)&g??R|zE;YU z-u{Z16x%LDU|DRc(?qc0xdk$6dFq6|WH_}Yu}*mYYE>G^P>eJB3Q)b*C9Ws=CLV8& z8_iWZH0!GK$0zFFuH}YWlkoGMrDj@frkgN|wWn&iE!V5!i}CSr%iEF`_qW>?{YST_ z-Dpy;pi_pAz|K-cv0K}{b6H0S;nAiUvvHoCx?{G<{TG|~!^IOcSPwQUVc{V|?C{&~ za7G6yyL$+-G9G%7cjrD5`LZaVr9a3!>OECZ*)%2eoEf`^4Cdr$Ba<>5?NdO7-ifN=Fgl5*Ue zINj!vBxcy--!qe^uT&YF%f0gg;l5j2kQhBbpM4aGg^EUiL3Cv{B-eFH+2yl2@6Oyz z!(?<=$KR4CSl`hnu6-z9`(g2D>u*)Vq1BC?susW2RumQzsXWw}@;MazI$5p>0(uiZ zANt!@-a*9V%hbiS*Zn7*0j+6WX#r-%bj8Ea&bkrtP^Z0fXL+VCub5&efEvNGn$lWC zIN3hKQHsR5-YKncdA~NfwGP=OisYl}gvO=pGkcX+1k=@~$^{G^&td(vXwtrYQ=9S8 zm1;8+5#@KTai3K9+KMTeoWJSvg2(0-)*Ni~LF7mCSt>Y}P#imsU8aq8$A>{}z`KR`zP zZJm9t5iIGRRcz}xcuya3Q9_$2*z!2IxuZ{4;3Bd9pjd3tz7ofB@adiB-4HcP7B#cs z)6JS2w_K}56zt(u9rT&Zm3Tb#Tsx|He9o8uMK@?-f0vvBWc=A7M6@vzOUV;o5WM~g zuWisrX}-+cVP~=v|5d~DtA?rr{dBWyGF+|{6Ou={hsnRBkqzq`o!cH;KJWI5=%!{f zE|0g(Gewd?(by8`R~pDgQNP=BdFA1pVj~D>q#aEma~gzqMR(_=-{D!G>Z%pU@2>NI z5G8J=5=HDw8=p6j$LtZ&(DR6{+23q?ClAizf~zMC0${U7<0+HF?XslENtg$(6s`+G zOfJhZ7hNv)2u+{5L^+~6UYQw;Gr0KuS2{0%VFQxAr%sRV8vm^!fco^n_sZRm{UB7i zy+Jl&qiAdeC`}H20At(1?Vv(E9CELDz8{9 z-UBeJgez9Hp%z;MiaSK!%Y8`JRU{DH#1L{DybU6@`4>54KqKdc_Wox^wj*=*+8tu7 z!csQA@*V}+>T9CcK0M?x*f)kmWQ;XDOK9p}CTb3O7pG6{)yx$G3v%MN<3>i@4|Cf_ z0}<3}Vq`hlw^Q9je;=qvZrhQetUdm1rc4hh{btfa@ye0Lbs&F2B!QFo`H);juq65! zI-+kEwfoo`&Eh6R_=d*o!PCHWcS~G(-_+&V(=V1?uT*LrcevCx*lT<&cHaq+%}IfJ zMmZc2I@q)cz(6=! zI#M#5qa!5>_PK$hUB<;OJx)X#P_SGI@dZeHYY;{1jIixh!X?(lt~~07(aF%h=~7|mBm$00yV{_>e>u`j~>E?Ne=oq^{QC*m3|aS;E}RmZFbBA}SA&JN*<7JIZLw^(Y|WV`pyW)*_0 z=6V~$^C#7zJ643#Bl^S#TJeO*l~u%{Sv%=XG{{q__!m0rTJckxMb*0wWSr57KEN=i zsRiKRQ+K;zyc_c8>jWfnCY6P+2{!nxmePD=-#iT;>UcYrbr^KW&>!@*UKK2Gjb0Ge z)7KU!&r+uycc9b*abbz-n#vEyOxXwGOo_rTGb^!-tMx=;4>hm2NC066J5UM(o8t^; z3y|3TM_|Y<7yRO0cGVE@q@*aW8tlXz>I~(lRBQE&)~h$E$G#EGb4J?<(|z!_Lhilv z^x2Q`loz}0TCFxoAYzY9-Xe~RhjQTTNy;G0E5ftkD=GP);IF1n>hi-Q&h#9=l~pcY zc?2#ue`6m0l5)i<0G{NNorRbb&UCU4N;KmnRxmA!KAr0-Hf|`2@Rs!7??1zb#A!>d zAN6`%Ac@boP`G+??6dAb-v+VDDy7RGpLn$|m}`3Yph~vEjPB4z>x%tI4g42`4_Q(jG_O05XQ}0;U zJaIAO;2d-~`=A4vDaR-`nx|7odwcM>_iFfLd52{{R*G%z50|YjZ5Sl*2=gU(ZpyfY ztcR>lH}UXAu3qr4@a$;9R@ecOu+v=YAna93%6p$-h|jmQ{DVl1HbiOs$}9EcT~u+f z?crv@KK=Pt!co%d2pyqk>l!4f`(cw@pF*$~NJJh>%Ir{&@NjHm^*gyzUJ{~RfyJmb(dJ;Ti{oAy> zpa8Tb))kE%EbGf@LT zC)2Ik?0SS6eN1umo;+_7cI6@J8uNaixqj~_Q~I4$Z5CxKgUhJ~w3%;Rm|;BD4U2~h zN|UI|&e;b+S{uCkV%TX9QjKx*+sELs5{}gGnb<$6Yj1j7zAy;>z4zFZXE^v|K(RQw zhV{DeOz9h`871-kY>}J{nJd&(RXWTjrH3(Yjy33hERvnkeQdS2hp%I#T-0VepSIKj zHz;XBC4Y;z*PTR{^W+Ihhz&bNF|{ zEAKNpTeW=K+?%G@zx|`RZQ41Bzi&8rJg_V$AWJkcX#stm8#b_&`Y1p9Ao6XzpcK>l zh*t{p^YCkv-hA-XG}?QS(u(k(2h^w5c1R->U^lQIyg})m;<+-E2$yYkZZ)a+`!DB8 zt~j$0t$SjphjxiHjZZ|GbLWaHdK&9-WDB3Be9rSd7>BiA!q+W7lRZ+)Z&SwGnpz|% z5_vDfD%wXg;^DJ-jT<6==B)DunOEMut8JH9zP6WFG9QgEiMsGzbi`5q*U``O_u38Q z5QInh>~nyM7doano$5>R^&A4yzGuDauYXBJ`QJ%_^k07eC9VAU{qlb)6w-&1+yCZ! z{P^jF!oRs4(uahye^X?B{4{Xl-?WS$PkHzLC0Ug|SPuQi9VdPIKi^o%Y-l$6Y#T%LZ7K=$WBkhqCJ2@%uVlFl+9!RL4A`%I$zU8QAYWG4QR z;Yvivf6821+QMbmuV?GYj!OA6 zIk-!Xlpsz0AFcy6{{LC6g$swdyuF^7?OW-6i*${7g%Z50*hFMSeO(Qy&RRbJw*&r! z=BjMs#I<}YZm1sTK9>KiSL<51p>$JHokc(^zjKxNIVLgn=S&_~`MD6>fBVdyem%yU zn!_AwtSf><8qC^=(N5I#$KT7#nb)G*#$UeZ-CE2?+%-A#57X{(m2+N}(S3u>#I=b2 zTtV8mhuzd1Im0*Cr!?bS3FO;Fu97lGQf|trg?4}3u310fG8M&L z{e_o1{4v_Y>tj%Wr{{RYc$gS@du*T&?7<7*@Q(^EkC;CdQ=}=wG2*F~*%v~L^BIY) z%rohXK-eErdYj}5m9Y+oxl(tH<6DM6ith4G?%2_{dY!|*kARhG9>Vc*SoTx+wPeZ( zuvnmz&O7)8+p@Aow<3j&Hi0D*@^~+c)goSoG|@h{11IPRb7V88)=$tHl=zn_+9>xu zwjLgR<5uco=^tcyBt9xqbei+$ON>m{huHy~yxSwLvw?et$XU{o+M5v8LaQDM+K~LH zO0#Z4ep0M^)Dw%k^G8;Ko)@7XH0AY(Rdj>0`d*+#`Doh2_M+X2G@BESo&W8k<@hUV zFBq0KN-x`R8`H~pr#D7pr5am2_1+CQQe`C}E55Qa*F?p@COZOQBh~2yY>*+x!6!el zUw>AyFxPCNk(F5Nko_Pcp4)RuJEr5h+?#Z)!dDk4=I2Ccu)waNKq~gEB|9!?%Nozn?Fv zV)}RIo(*WAsGE@7i}8lk)yEbe;T15jY@U-Qs&iZ1$3OvtaET>2bg()$hL9&Vw+M*o zWIU~KPLbc$QL+rBu4oc}xqETz-bSlB>yLZ3WGtv>8jN8r6)YL*8Mk8x(=@%-&wTBW z+tute3S8oTWf^q2O*Tf%SfRavaToK&XRDo*-%TdfUj+8K$)wkvtPDPpEX@;2ir=bP zzA&OC8t7&;RaItupl8e<^PZ2qD_;?(v*r_>X~W@B`;>#HXLvAa*&Og zLl6O^b&o{tH#Ec#vSYb9@-*MZC8+3Cllt1~hy{W`9}*O6Xbv|IKed?PcxUT0mKOnq z^Baz_I&M(jg7O&sg2Dyzg68Mt)cL#CvDq&-WiYp+jwt^%VG68g`N~?~CLjtQ%33>e zmvh1Ypu)-zo3KT?$8TLk(=U|MrnZKt&xGzF`>3@<@6d+M0Gl3X~Z*Ip`*lq_RB!OwrDafk*We-IRB9?@lma&ecX0mRaL!Em zteM8NZV9ovrhj_%Ui<*nU=pq}!KZ)w&{GcmL)_-^Fc&kI^&Pu|F}f1LpLEDoZp`M4 zdeWLm=L9C?vPI!?KZ_X^Mo&Yg2$w1w)yJ1ok$d9f7wA#3?HpQgKq`Q3mGC-83r^sx*fU+tBM!_jWEu2b}1eEYpP(l zhwVi$jTPTd66j0fybyg{D^fq4!dZ4AB!Tec*g>Bdro8OsClpDD`Gko#e~o~t-!?D2 zOiyChj;MvTqp#A{Zp4o}vF-BHyYy~QYpaSCHjyLekYEPmes(jx5-uL$CR2RALsKEc z+zVqk9ptE--|P663FckUA*l>UTE1frBuUI4594;~34^+8+@#j?{4g%@>Cf+QO~u3? zCEDQkmjS2w%5N7x9DsTB_yR3UBfO)d`(1k#fKC_MR-Qz!eL&Sz2~%R>;6eF#ahQEv ztv1Fya$B9U=r5CV9AqN?4dO{3D_{7gaXy;{v2vZC%JHTXdb|)LYqa40kbopUeMG(g z6P7>6d)HX(YJrIla>N%k6}UE=m+d97ZWl(8r$ha-mwFl*3Ib|&vS;qEXE=Q`$lF!M zmHqKmMU*BinWt2f4RKLb<3Dd|YXb=*{=`TuhWY z3e;k>dl(5E@dh4PQ>N4@&kX85jucw8l=iejK58Z}p6zJCQJTH-!vMYW!B&jr7S__{ z-i9>HvHdQ%5sTo>3pgkX4GEh1u_`P3=)L6Q<<`i<=xD zg_qo?fl_Au;O{^tnT3?>Xb z*+j|;S4<{70m1pCebuu+HoL&Y91$Sspp>~6_y-1XZ|+>H1$dFwf?xR@w{TfE9S62f z94HA_M$J`|hf*BGNk({-C(y0x1W+gM3fvZOuF4?5zWP_d^V=)(zSH1gIc36g`Ov0d z&eXzA@L2lj0*`%Axmyq7AW`hL<34}ZKm$LP7x;|2GXC@uM}7tbW8=>RRaU?+_xp2*jUkLro(Qi=ue8I3cFEmbkpH}RO5YdLcQ-H5B zN+TeJftZEJ3*-<}1~xQ4Rgj4-@BOeC1j* zA2XBNionx!=wk2%+TX6h6Ok>V+C{T0+;yo>OaLNG=OWC48v7`b@#CQ!p6>*Fs_7nS z`XZrug5NG>!3`8Fu4RC5e&Bz6r_be(jn*E(UcPeWWbDFhYn?KwUB0y|sjMUoHSxg* zufv$RS*j_Yy-AraOmVf3dZ#^^mQ1Ys5FG9KTeG>j{<&eozSvL4r=+*aF`xTRxV7C$ zz&3dTdd7J(VLjYYyrnZkw{(2I5)u$KeZ2KmPOL{n$Ol1ZtthBZ7%?ONej={Mb9U{! z%WY=W)=nKa>FLcfv^CHK7lf8xLG(H!ncc}L6^j6a=-Y%VrZ(idOvo=(b_aDZMFi=V zO8T-Bp5)kK`uqE9%l(Jns!DF${9)H4*4M3O1NZ!~XbeMHUE`8mj{e@QDn0Uip+{v1!6! zMIwP{z64nvphxuZ8Qo&kO8HfA(-8M$k*6Qx-wE*jYfHwfgR!4}^E)^$Pq3`~B7DI8 zfL2zC`L{rFLY>06sY)Ky@Q)hZmh)*NXDuH@db9qROS5qI`^Txa)7;o?@EhoAYRHbN zw1gd1DG56me+tfDYro+B^?wzSBFv;1vrXBqdZbGQE%{DA=|Q#mi`vD{8teXZLyMdQaxyy7 z&}v!v>3^2{SwX_c$y*z{p;4_++wPO~5$pT}m(bMCQ+` zdci+mbYFe+I3esIn#)&sm-OEM|K&yYdswlwmTl{ukN#f`?!B{N9!kZ%Xw5LOgsw}| zsTbU!_(QzpZ(DjVD2b}f%C|-hn61A!tc&<5iiBx{(;K_TsqYk+HgX#^wgK1YBZZ$b z^6W>4or$J4Eu&@_i*2w?8-^~J13o+$a<^0y$bN%o2%8RUD z;8MOPA`5&ITtwPrrV_K>ya^TfbG!q;p8Lykoby04x0EjJ+}?HBY-TH0{UxuJWN#So zR;}*Khh-P|uvtV`#XDZ*j_>ZTZvR*+KK~8CURQ5p_bl^`SsH@@qId&Vi&-etX~NB--N|G9IP(c{Z= zHuVl}Tp_=)`|Me8%=DFD`LXNkCGYZ6?4SP_CjC)<{Up|{=!MU)0`(=a>2UV;?0j*&{*kw}UEZl@pdPCru~Ig(CAotgUtS<`!4w!T-09l{SG1M9;T^SD*u=3e2- zPOpr4cuv*H?DQ%8Vu8!Y0@MPl8 zl0^;kj!A(7Z2R(M>9OXuOp~`?)`wrE#8xIs70;ijX8vmW-S5=YSevUFpi6HPsZv30 zAN3S(^t(qSAf^gJ*?RSL%Y@&8^CU6cb8LpB5$%NEuBvLMVa{``=PszWrHpb<$8iB+ zfbjjro1h@Ucz^FGF7hQ>xZKl=E1uMfj-T5OCVnPU+nn>w4-pW*oM;IQ@k7?%tn%C+ z>vEkYWezvka_exvX>_Y1`r{;i8R!$;chgp<@Y+;N{4+H7zHBdC@*U7IiuQ#Aq_BU?isrjak!I4b!5M$YZ9SU~az2R1xB1(PzL`MhcR6HC z`Z2|`=2U^J#LBhohrE1%ZkU9+@E`&4%@-gWJ&0 zy^ajy1j95`8=uW$6+Y9x$Byh}ul&j;ajJ6({naADwfd9G7AOkP~FSVodMK}i;>kUy4V5p4=$@YaDwd%(je^Z*-U~Nj z7o?125_7642IE_xLl;xv9$8hc*?jUbv1?xz$=eOhlB14*CPX~$ zMWq}~#w_4F;-i}RXkoS&e#)zl#FIwPu6bDI8fr!sMk5`sXds*2Bu6i7<^ z*~Oxw6>h)n(QKsy(1wY^Yta(JaHKfLn1k}|?Wryo#7^^Bz_#GgeS(R?ScXNzsmqc1 zznmWkD$C_pqYV4qYOB#-41@R72R4nvF7o7@m}X&+d03_dF8+a?EhD^ZDtGbSo!Mi6 zU2>Y|X&(t#ggy5syfQsB#I{;Bb>u+DO>KS=a2Ia~4zXn4o*&sFH2{nc@Riy{cUNCW z$L+#^(5umbpwEi<*a#9sYh6bEYR9+_E+%8K^O&#zyou7;B5P_XAF#- znwO&R{@*Ih)52+L3C2xZr@1Cf7lc(YAi8kath{udq=mog0XmQC7&Q}lLf=!JgFZK% zAHN+7e=lS!*k<)LBJ`AsKC+tkkMnS_=z|4A+k!1`Be$aWLq0Vt=_jkjonA0{Y|MX& zrauO7TE3bHOxTrQ3r4kV}!!;(NO-_ripH$II}x4$zjyep5}%^!QZ@_+-CJ zyw`2DG%3)4l{D8VigN^8IvOh-Brx--Qrw_}2@2%TwU7$5{3_aI8))teGQX{9S@PBW zZQN=?NC8iftRBWoF*WQmUPzXl7zyZE!zeKW#7hL*%x`$V-SPC|-e<*Py81#RZk^?(GjYb{}PXu$P*qz%2Y*HU5Ha4x%;u0iP$2dD;Rl&m%3=YtEzwG#!E97N*cwb*j%6!luMF{xLF0p=N9M8{s5 z5H2-Ig1yyu-0h2^@IFJ9N97-dyXt3Wqt^))fK^Y>b-JRQUM9V_u~Z zKdbh8f$xFvz&Y4+tmg?}$s0J}STUg(_o-mHLfS7QC@T7E9x$s}UgjKX`)_tOx`tw= zVHfa`U~z|=wh*JF;a>)bI>g_s$5(px9udCf`0wkAJQweGa^19O90xxp3pv0jnKM6? znE@4;kb2S--IB@sEDw7(jyKX)&YyhoD+YC5({=2mU}>2ux5$I=4s_O!^kzNSDdAnUsaR zkb(e)G6@IPsN~)s4bNRR$n3kl^IR#3#@riD%8nO8TKX$9BjRVQd=_GOa>}IWh&sl><1L0%QO%a)iL*umf^Kc_H2 zh^;nMqWPZI^xbS(Lka?zGg_7f_U6ODRZ*S z1zejd^D1o8w&3{*^n$d4Ef!7Kce?jOhpg~E1ieGBgl=-?vU*0dSX|vz_#A4ntQg_) znuvCi7=HBpL#cI{MqQ%08B|Lx+?UAPrUn@q$D5CBy*Fe!&Vg70==Wj`4yB*s)3+)S;|9wRk2(nfLKCy#8=!NuQ2&@fT5-<|!9sv6+nn&k z|NZ8SVXTNo=vCKZywO(L23WV_rEc81XBY&T7WN4qD{kAeZl_L2Jt~8u*l>?V5FlV~ zW0ojDpiD%l%>wl1$)|1uUE0=$5JyK9KAgJ5Jw2I_8%CL!yTu=*lqt{6g(fVw)SDtH zplFw86q_@otKxBscHKqQbJ7M)xjCM_73D=wh1%YL0>MDCg&ztpUMpdKISRgn65?G& zHs;Z06<9@N%22wg-JD>Tt;JVQDFUzE^FR^B=GdcC;^=ZSK(~5EWMKEa+uPfudQzUk zAB>j3KugD1{Cis2o6e2af_h9qcd%AZuolANrlwvo07U&XrJ&LOE>6n495A=k61g}N zy61Q~Fs4J*F!;v=2<~!<%O6#PZmXnX8Dth z)sBA69O09M)vs#Ny_NC{?7scZ*V_^Y<81@a;CIfey%?75j_LE3^%-2^ZkPB>k6Rnd zJks9(hcrV%P!L&&7Qq6rc%#~>7|}_oRV+s&*Qa%vS?p9fx~^@c&ecx`dSVgSA7r!h zUnfucrQBSz)XEjOEt{u?Ev+gwiw9hyKkPban1_)>*)AKsy9aPr4~q}`Bqo*z+v0o| zYv>vmaT`m*wwtuv=jcNFqyRI#mBnqQG41Pu61Y{;cj2YV;Bzg=BhO{`NQF z!<)IBoA~f1DbV9x=`5pSE(%IGZ-y_lS4niDsf$bxyT0|+j6GaU<{4V>3~%=Y1rQVJ z)Bs`*u7Y~87>+>O9NuPF*ij=_8J%hD_MIRLO6tscf$%I%n6z5s-nh*jjabkhgBqv*lm&Q0d?yX%E#c@bNx?K|IBsWLpJ z?(SqH2|^ul4nB!r8?NpRE{%9S9sLDtt ze5j=!Gc>#H7IVf8?=Q9GQD0OZ&|o@5jYKTlhWFJrcjs<1$LLG!A8AhT(9YyRZ~V#` zb_m}ndw@OzwobU++-Prk1X7Io+TT@I_lRpH=V9p>fd5K6v>t!}#h+_8hoQQacF$cI z_BH>0+B-hD4KV%n?~==^P4d3x~RytlQdK}TxtEL zU+t@$n~&4AJCe^bv!luSt#tHom!be2d>f5~~ft4{fZ@Bb0|G zOZh(hTs!_tyH>d*#lJ55b^D^s|6Bz~nJN?P|BoY-!m;MO$#qKOgtXFldkyP^;yajpU>JT-z5FeHHqi7J{-Z}rGd>eJL$f8m0?ZEzj=~pKHqP!Il-%D$K`=q{? z=_@&1B`Z@HSba-+8u6O4=%Ae!YqgZ);NJ2d>I-r!8Da8iF>)=gzT?g{;>+Bg%dD0S zjT$oHuZJGC`9yx2GUl&PMLx9lub0$i&LIEAj`{7JwZ(l}G?^D%utbvPS3HT&%+0&{M`66&{XHOAKWWr>UHE$I(4rGO_2JSCg~A_U;@}PkvDB=-g708}!B<*0W9bWPirjPn6K> z=6yu1hQx;{GheJXRwYsMP_T0>rJ`^2Ca&xETNT3TeT*~5=q5}X_F@b|^OEkU1%BTi zeZrg8cLfdOyWfSicFK15sUl2q!&Fb-r_uF*9OxsZyoEN+vHnYWk>DLR4-4_(sN56m zD~$k|@aM9>np4w0E%0n?0KfOnI;SaolkrphIXu6FzyJ0b?mqm>PU6HQB9~yJUtiu|aO11ORIFbmydGAof|dJsWmw8SeH=2qG8csYex)Gv`1Hmz z=#+10>w$wC9QS@5OVCp2t-F)gj}rJarmgrgu+gV91KqRR(t9>XXS)TmKK>5(bAX^* zE-}wxL&Wm$>bQXRFtnkCfl7vWT({PHLFEJTBr(|6M=z*pa!VbPd6mFDVp+%GjUgyk??+uH<}b z(kIg^^Lxa?zNXO%FEtM651BmAnFc|xbgAA=7~GOoUcr&>7PI62Z}?IBw(SQVUCGst zX&>0}@A^*I@^ZuVI9`sX-92vuVXe1E!byU*Q++qK!S7tDn_J5j^G#5XiBdPs11?VX zTkE}Yt#cd{U%04pBlbSGcLpdjTucFW7uV)D-++(#$O7={k|0|_tDf6Q(pFhYh^g?g zk>cSF(bKMb=nsHW7Q7{Njlh0`4t zYxG9O%Y6}pEbHRB*@1;g-RZle@JDx^jhY6%y(DJNo-#VJB@H*Z2w&S6u}9|Xft~VX zDvZ@<(Z?ydg>?L4&fR4R{ka*X^ZEUp!utbrOQ+8RZ`PekQ|K0YzbrzGzKCbYh0bG! zCfAPA?KhTo3*eSC_FDOt=;6C%;l?`G(|Li#^^ljMUlW^!qp6MQ8JUFEiAZ$lN(VM- z+t3~jhpvx*NC!38W@>X|XTu=YOh#uU9pJGeNR^g38oZ4co@l-#|E zNI~4NR3oV8CWIx++8U+$9Q<@=ZB5=suz{x)dQ=sa4}Zf*7oGrbuo zG@j;l;j#fN7T6JRn;?I*BlNr=$h*0G;^zDK?pVg!_BxLstcy`lBzT@UZlhcbOn7!e z42F9}8jJl8mK69$n$m;xnfn*`8)ZzM{GER7q37qi=of^%GchqzROy+-pK5OJV+A#r z^ZJ+_lb?S*cwprTOR+$T(6P?(!e0!zaOgNYi7`=f9%rQo?{C@%62L^I-uw;TocTJB z8&#HRiVyJLw5H{+6b z_#OIJ{p_}waKCi=h{$x8=LOYD`*RfYT)49L$)(nVCBG)toG^RXVdB_SWO_INm~C-r z7-xg`1#b1sAY?r>y3`X(K5sghye8YdtP%tBT%#}bG#s~+&ujM{rLS8_Gqs-S$ zn!w+QiL5TT@^C~2R)n#))TK`H;l zQme?a8%ImFLfOu9fG$^$^lXVXSPT^sihzST;?`9_YHFhW5tG{v2e+vYtsVv zeT1m?e&PqGYLV!ui=zv$$TJ8XvS{Ma0&c|k-Fdce-&~LuC1dNM`1Eq1Uc4#m89+&f z!F+SNI(K}iJj)mvWIPgAVrSPQv(4h?M7%wh{`k>vWsdD3zsVFl@SVIZ-Ty8MhYFX< ziTW(T;?lQenE@tKg&eG?J%=F76)-KJSDz5D8;Sp1t37s@%S5j*LECh;CU#)l^bA)15(Rq&A}cd7Za{uP%pnmw)Y@x4)cR5`y#Zbojoy;}s}0MEGyPh2bU?Wg04zoH_Yz z4>vbz8&r+?ma)w$RZB@toAxJ{lR44QQ&ppFBo}3FVRlz z@drfQV=Qd^?rwRxE!Wt6c&D}~p`Nu+?P; zOHjPli1XlNf$*3~H157X39pO4b~1ehQv_9!vfP}n7r_a+OXYnxIzIXzLhwR|OoJ>T zN-`6~CG$3_)aG=uC#E|;I=S=LI56<|=e)gkLEn<*V}O7gfLlj5q$=!Emcn^QcG^An zh*a#;4;>ilmG1%ElqQnqcNipqo1%_D^`CA%Y`VA#q4Hq|HfI>z9At_8!_yvN-*y!N zoy>2BIn4-3pV+07wCyodZ+L23WGpLHjfAK5#dG;b4;4HWy9{3#U0`J|u2p;NVH|P7 zwmqPUlJ_)^Du3o*C9WdSCVYT(RhvD<&3H=#WMjephvwA9TfvqZ<40b%A^bxxmGyq= z_5;S@he?9@S8%A8Ez$)18r?b&9HgS&v@j9CVPtw*k`9&ZQjq5D>BcVgo9p$G$)CqO zw=&MY%Ket)aKt(EQ?|Z$*e7Y4KVJSc+DLhGMzYIOu5s*iUl4R6GR8w6H{jbG|6LP( z|J^Jg#0PlQ7pP4mdLx(@q;TVJi)ZPN<^2F{MzOjs-6L;sy1D7&==rrB7VV#^Y}cM; z5}-zI<%q?WNZ~vuG=zaV0qbvVYcLnbh&UfkS&n7LGVpz__u$U|tf~Qwm~64Nz~k_Lfe?J&=N))apcR!8CPZv6a-k0oE@RvDms~sWBH1|kwIr~5`AX)h>Lv4v}jfrNLteM#evdtqkwyw=o z+pc*6XV&6vfnU1m;p$CzW`tQWqi*2?HOh6_#H?xLhMRA{0ypP8vN(jilruV!7BZs7N##p8r$6Y!U!hlF>oX1vbh<4v!CQznf#g``E5SZ}o8Xn`R5WznOGL*#R& z=fnodbYy=rw6|1Q;JH9KwWmKlWIXB(*`k><%Xu$c4#7Q$dQ>O))R!6MGRt^lp*YbZ z5Y_Y$IJ4-lz+fIybD+gw&{OM1r36lXMnj&hE6fa)=Utw(LV%J4hcWSkLGkQo_R(Wn z)4VfoNG$&;x$MnEdFUITuqC_XfeFcwRpsBkRfQ?3OLb1slSP#v30L{Ke5T*oX|)xe zcO#mbb(vPT2$jNmsYycN;Pd>pXaHk%`eGJ{aF>4*$}}FPHDn^|umvh0HO1a77O!+@{N6K=ZB+Rey4c;dutNvf~dMZQngU*J?cDey3|uaqpr61S%% zQJQOt$92;!lsfs%BTa(&@mf_r`z#&&s>s5pnFI{RA{*0STBbjFsAW`aI(FMRac@0s zbN51IrBHQYwMTF*bElKAF$+mGdzBZul^3ru|Aa)H>ciLU1_w60#I;3bwf&-1M{goc zgMU9)IY=!jlpW{q>eK3B@)}UuKvoxiFev8Pjfw1-9V%nqWEXkhz&*%~{CsK0fuG26 z@61wZevz?@DyyW$EDqt7IP`mVDpFz8knb4K1MDZI1xEL#!5VSKF{a|ynWc-_7YRD# z>LU_VlaCap8VrU^@<(Y%DFonA_GQ5w5~gP7)latPwtODFR)x>P$2C<&nbtvHtgU%t zzwJp5ln4##p*p`nKXW-2#$5*2v$|M#iJSg=&nMiIriUg9YT|9^-OI~G!efj>vp2>O zSAnr&B2%fDf?OO+74o0DTG-oa){_{`&KRWFLV<_0fZK?1>$Dd#mh}oy%RO$d!jz|H zOl;bev)g0B-W|oA(Z$N_2HX8uOUhWG*k5_ZAH0|zQ4TwZ7V9_{z_s=|IYcT>pkKyU zJ2TMQl=Rm3eVK#UCzu#Of#ftX`nNt?Q>|H!018AE8q7kRF2+ zJwVdTHYj$pXxn^nvVBozkaHxaaDvc?3mj`gD5_Y9bLLpb@RAtxwJNt7pgvU3)t;V+ z1w$NRi+>9`K5>)c`#D!A#r8L|3agju#*MRFJ6YGvXCJHE;)#n~KE$6v;=N9up4Q`w zc-aB>7H_u1kH2RJC--MN(LTkjqwPP5XJvNw_wne%a37UmB0h zDr#ZKPsK{t6~_I5GHaQ6;0CZE#EU6D8I*K%&4e_g<~3FAK2QcDmCP9aH>PB<`+xAe9XE?X>V%hmf|R|J+yPUL_Jf$ZD)`8 zX7RI=E;O)~nq*n!tYE*ZM6Et>X>+C?VmwMrAZ@QaY1L?QyKPaTx)2trvD%YF`Z~Nc zb&X~{9Qv_u*FwMq5Q7CFJC?fohNGe-g6y*`{}*j<9uM{U{|}E86>&<1EK{e2k|nZa zuTBYtHv3qTEqnH5W|UCbD*H}IvSk~~V2YybOAH1RLJY<}7&CKUGpf@$pU3C>{oVKD zch4Ul^B6Pl_xsvk*Xy}lwT6`P@%LwR#Y!mijZWRRuFVD6-jk-Cl}jH98O0RTkUW{k zz8qg@2rnI9P;}08K*Eac%ZO?0ji-{DKPz)=>}0G4{_lIgDG1N*I83@yu=Z!sTkhDd z`?NpfJdWJpGJW)7ybe( zA6%P@mShG!yw5V;!Yw$vl{*ct zF1PU9h6c~~?OX8p0M~41(vqJjL)EJs9IpW)4=A6$IlhE@3T9A&pYfryTd|1MiWrA$ zIF!X?EGLjAyyOKD-vCt|JISiiS^YGeP1eKKx8Grjl%>*J9NOFHg{!CPk0g2b8T+{K zP#axaYE5h>@KhUb-u$6zmrpT;6*eASuZCDrE%@G<^&|X=&fb=SRw$uD8p@%ZdKVfS zTTc0uDiYR|Xw)iClTVg6P1^L1#5dkexuv8hJFGT>sGf^n<-KRX&3@rS)Kyr9Feip43pUk$SjNQib zXT%O+xt)&2&A3c;TMa4)=Z-`CuUoZFP$oW{skz77G51S)%KpYdd7f9wrQy#KLT7Bw zIHY4r`R3^aH59*H!Rh6kaaHuM?4-nN59;VSt2*1Imbq?j;KtE0)iygN6&pS$+gv_i zD9Sn@@RK*|f4+>|kC9+jYm?-%J}m=hCh8F&szPYbTbTYr{j+T4)3Uw?)&(`(Qh-#C zhJ8|)L#L#!e|A^VvjyzelCMh`#v9kQbv^JedVL0IgT$tk?ZkaXqSG>pE-yJ`G+0eTW&z9izmRUf^OMEAI^zPndn6(6=KEGEpmDHpj6Ap|$b(u% zgy_XxNH?MR^%D2>@!~ioD_CH?uV$R=r(W;ll=KxKWtyLOE3>}8@ zJJuL*a`wvyH=WbO%Ybc?v3I_Mk%yoA_9z?C`-1xA*IjvSgd(k!?|D$WD%Dj_p16i? zuO=~*bKIHIxRh$g^`$DGA&B1uGRUn=fhlPm^sexLg+X-O_5*7AL56@xL>;>-m8+Xz zjcqjl*1-~0EBBSpw$#6ilNTM1zR7C}TH8=_sf}4RcfhB-rsabxH1AR5o$^Shv&^RF zwDUP3$yUTWor~@;QsV(A9_DNtVw9Q3fL|63KEp@LHXk5 zOx#iXG@ICkST2twM=^19onoaAJS)WrtlbS`hY2L&g(X5G`N&N3Cp3Eh(Zm)E&>80O zJE;l{jJ)f9q1weM%=%-)NH54lXo`vJb&%CmF%eE+T>~9AZtp%FjyUy3Q!B?BTDjFq zbD=NP3V+tAy1GjdjOwjfmQK25@KN0Xd-MPUAm*SG=dRSB;S+oHKAxU7r3ySS=aKy_YpOI7w1>Uk zUy^-nA`VC`glYUiX(&gYI9=d%;Kkb?O=GIL zDJ>PD@J^?hjqpJ0%tEL_%e&54R;H}D&7np*guuvlvRx)620ZO=tfbBjS+xFDTgWYN z_pj|yuo7tD=6zFuyaE@fLNQKu2H6$13rkY=d|-f*+2q*Q8Wh;wIyqbu-Nho|^-q!w zpiy7^%-Oj4wUbl0n#pG1RgWggV8k-3- zm?u?ivQ$MlVMXOQSoR|u4SZc!LNplkwDcZJDu@~AWNb+!6Z>%$elA<#gW$-@%FBHq zVJgy2PnbIKe7McU>emnHTx~Wj7ioVK&syjC_jI;MQ z9s`OtmeLH+4Tqfoi||E@g|RG@=DpNPHrc7{SL;sulExv?$Ef;lwr_XwYW+rUO%<9_)%pPXuIhvAm>VkZvS_hAp z-@2ek7KqTCuEL3Ptc_w_gl%x;tpj3iVt(s z+thdST@xxDZ64>QZ%9!;q`qbvZ!?w0UQMXH3gdvte>@H_p?gJoqLGd0CJU1?$uxnm zXT-FYF)`HvwopIJ&MoeJK}&n0ARrlUrk3kA<<(4VAjc_h4E%N@hr-esN{QypOIv~l zOX@Zr4Z}4X;zs0>dKuA@{kTJ(AupVCcLNqx_JPTiYDbR$T+{X_;Py5RoEmvuBW3|J zCbO7G`PU{Dg-xo_TyPih0>w_fec~LITm?kh$ys=b8+Xnb|Au8Otd3Fh(`Le|t zes0oIyf*(dogoD=;+zmqQ2$Ash45*z2?uVsL_FqBwXSPF<>I_I=rR4VHwVg`u#_YN zl-IQ^MJ|q*jVYDzo)s+qAUf1f@0FdDsH?**g=}CMYKTW=1l4Adx*AJ1a6sF?JX(qv ztc8iqhM)@l)AtEp+(bM8b^%L*R$ZZ&?nz9|cr0GCYGn4>;Pr1?esJNvVilNVUP$?F zv>5E5aA>9tm7Z5!KO;r?Tz(3(x%60%U7Eoc^0_NE(ejn~bWr%e2=6`;NTxJIKV(0| zzk{soTg{6cP?U~yV_+yA07LPH*mw#Z@NETY)3TOxZ#yjJcv?w1FQr1){1*j;21j7V zem#oHVId(rhKwn2h3=vk9WqA1D%s9a`CWM~s{O1iI?EX7Q2^Nh75EO`w?_t&mOS(YBy2^(uQw+RzmQH`Npz@E%NV2kldC8pQm~tKMBt%{_{VqK%3t;E_co1SF zT=WHyMOt!bntvCq?Rf_diD**vn|kml(q=c~-inD4wCZ!#Q+&h56C7sjN?RYcn6k6} zdcC7&)sDH+*crEY{3#bVqb3(Q{A*gRulR!2`)Wd#R8UY z?nJ*D!h9}e7+Ma;EfI{_{H$M} zn-n!smYxp&I?ro0y3Uz13sFTUn9N9bKV8SGOwHUr9T#Y{SLY=qEY1Hu%3wZKJW|pmZX5pK57SK_B$28*FtQU%C469<>t47JTHiL z#V&vM)G*AP6Z<+!g4!^zGn^(r`~@affv{ zaq4!nzsH%E%o^5%N#iD0K9jDP+b|-nS1c`hj$Sf5yJf2vk^q^T^OXC8t%)r04)vup zV|95&7dfTD+4&LayvW6C2e`D7;zC zK@(F6uJ#&J2k{7gWn=Fv6RUo0kX-1xXqGndvW8kzZmr5#VfkXt1&b(Qog%+y+ES+b&+C4`DqCWTysW zMg+pAtzX$(b69(f1#AFb#nA&l2DAv1xqbqCgIy-(SsPJsV8F>+dVp*3U}| zVmO6CXxhEGTF%xIZAxR6GXLWHuoy^IzVNS8#wWB1-Oh{oSfVVq6AcsK^CRBcLmc+* zIjtNx&tI=ef3R4fFZ!{l?AW@nA@=c3;Z#x9XMDq6t<{T*ng@{H^)Roiz-a?x#$6`x zgT*?BKD;?s;zQpMp!~Nchu_yFn=dK8b95^kh-zb(vIu9^-UB)l-sJX(c+;eXBV~Kc zBp7|;{saD>EAf9m$Idm5CMKz=wdNL4Hkz4<_xj4$3!_Gbw9k3)jq|RgJPY6xY@dFb zja`{OIl#o8W&8|Peh_Tqe>M=|5EIk!4nsx*{Qo64EC8FkAJRkMVic$Taqf{WOX#s* zTT}?-=)0PXjaG5ZQc1I8zgZsfFzHtN+LeqF!K%6V3%i0qN-G#}&2tR__wUyGHcXvZ*YcUlrG1P9-?*~ylTz8sh>e^JmJ!&frR;@V|pbj!qP zMrNb#+YYxDtj#;>AyN|Cmh+n%s^- zcd@*<*;3Z-^txJ4+iWkZ-+iGN125M~0d#eZf(Y(azQPbe%`4a%g&dGv5C|U`N;d41 z1NrC|#nvf?upFVxWVy6bi{h%TLa(co4Hs2gQ}pUCWJkhXEfp7>Vx7C$(a_}i=b)tl znW#SSp}}T~JDl(o-9bEM9|~9oy;@{w!IZ3+w6TJSn?&QH`Cs zS);`E?|1ohkkzT@;iX1^l~*CI+z{>P9`K~}#5|Y50zk-Ho6UUG@>?0M_pWcWdk>e6 z75Suv7UWUyUVf*hBBsN58R(|9)YKsBK6<}|$agXpb{`)}Vzcj!gBZ@x?OT2R?Q?s` z$ebcOG~iIM3)qYaajca>iVVN&iF}A$%tVB(j@N(#TcXz;diiv!Wb7$37S@D4!W0M8 zGTPw51RE4~Rdv@{$ITqq)&kmM#-q)=9wvXSZoS1#D13q53vb8t*2pm9 z$}~5m4*3P}>P+nL?|*xp7;7qyzIy0T17Y93>a#wqS$ITs?d5GvK8=6a$i$cTLz4dx zc#ZA#ow4vpt?ig`{`%z+V^lDuMe^U8IRo~Cxt14z88g^odVAiEzfStjaGTvZ+nX_)q8|GPp zb(xgh!9d>S&tVxx5qK(HUEjUoLS7%^ECnR6Gz0}bYkLB=W^+8r4OC=z45-|N4qXb! zVq6#Hx^cq2R5C4kYc^61ZVpNSrfuy7Hw(^k)w;k>q(zZ3uNtvHw1!)a$~sEWz=vgYFQ8;^Tlp4-fFt*_b*9?vq~D;d&JPs8h6oFU8QUr?v!*txY^^)7fH-WI%|>M zKQ@|u6|WW9BY!AI!Mm61mE0>mQPvN8KMJ~f6v;~D_r<&d?C?Ml1uZ?q_5<2gJ@6-BGz0iknk=12O5|!>eq#v< z;{N-dHX^Af54IjP3YXS9xB;BF>vN}=#(ylHQ{EuwcPrM=GjpoS-n;mkh}avH5}g&& z%L}XsZm?t%Dim5v2$XY+R?VS+OgoSi4M!KBbghhT%ogl-Rn4L0I!XvRpaKmsyqVg` z&c-P6x?ZB%s+WNc(CJ&xQ=OkJm?{vzeyss&YM$B1VAk})Rt2c^P2VIWA2GM8&0N`< zk)D^>mxSxK784k9ig79{17u#WJ({XhrfFr|)~sU>XXZ<|Kj|faeBmu|{wlW4?NRAo zT6dXu@Xa)EuLcJ!ySGl?Zc?^i-Lcrq3ysHywb+Vg<_Id9NtDsnJ-=^jdT%2nh*Tif zFBDRO#SHo_-g-}FSiM*{v_6S%*ti$bxi%+|8- z8HBbJ<~-g0#@RedJLafRTIu;rK@L4!%)R19E%J<>DX0Mgkzm$J_eCr%A0~y#eylA5 z)LysZWVVdf?nIK1O1s!c|QB#$yXKP-xVZU&h0r4*Hht8 z-ju``qvyFX++s##v7?^X*X!2B?~3W3u*@QjvcRgOL zo~h+h=RMq{Q?O{sgWQ@lM}i$L7B$XV>W$mGT2!2Jtrnu_Hn>@aBM>8IE?L8`&d89- z8Uvw|e+{F0rIf>FIDM~vA`_Ybia!?{I6hTm6SyP`Yfup@nS_X-VH=yyD?>6^r1DPk zH&)e=HOod}g%d|_dd$qCUX95wwqween>M{I31~@$?E10K(Aep*s68kn9$!9n<}jhN9oN$!0_zRyjt!_?9|QCN|6ZLL-@^W}VwE@&d_y1j zqssTww_+QPsFOvNO;%L2oQv(lk=36`q`{ z-ih;=twg)JK26B?H8y8O}aU3^Rb8|UUYo?DcUXZIQ(hygj1OkhS z>4?DUf+!(wn{L#o3#YhS??CuW5`a1z34B@z)A30+g*teO>FRGzGb8OKz^;M zhC`1#b%lm`I{5^Tt!Tj$sqIr6B~5_i!0CwIq;R)2&eSe9ekz-CQmY0_iB>Ufa!<_~ zm>>J}aqz_}AcP~gKDy~h=lw^*Zhx0*|_YCHP;0o^>+H(G-!22$OTbf zrV77KaBRSt+MRr+kG_a)e&i-?$`o^-T8fEYeCu?Ewk?%*9*a~NW-+axl!+bIHPz*7 zyo?ez(O#{)Tj95Qu_mfe3|m+uu(0R>pW@F!wbmb*$;CK~cua&nu}>wZ+*n`Fx+JSM zcH1JQhbOgRHFzi%0Y`>UyNcOgR1h1p%nUbDLm{;W3WgfI`0Kp0^UF8Z-<3UIB=1E< z!?d8m&(%=oK0g+ua#>ce38txDvI;$M~%qS8ptBEb{Ve1#^q!c zgPd$Zww^{2^i|ZgbO*kUsc#j|lL7M)TyJuT`Y*=ZU~Z1ul}qRSl03p^yfvueS4o#B z&aI%1u2ON4~6v;CCylj(}{LO*Rp*{h9QWfdjLgWI+6|W^@q`iA_ht`+d$9{3(aY!f#rO(kX?}+bODrLZdy`j>6bDeQI>_7{ z%)X138iUc!>BPj6zM0y}^2VN8>Il=50F3e}R$X~QEgY;`(p+uT-S!x~3mu95 z%a=Q3B0YbGq%CiKz^AoEko-vxlAoR>xNr(OQ_nV>zV^}xg`i$S-;MveEfa?M;zAoB zSsHk%U8=GdU0^l0?M8^-^0|(~2UQ@-LgH>5#I_shHjQ$gM-5VryHHm@I^b$EaeqWO z$axg?y1guhK%^bj|2ltbbM_gw*w6X=5uV@*A_CXSP3j5zIN-hXaJB`?g>7r;D%PA) z7IDaEv0NW+H-u8{!n8BUM*-7CE#H}XH(b-8!B?O;+dZu_={ z-&*KvCN$Nyg__#jY*a8fk-+DO+#pM*n6A7*MQm2yYOj8ZCp8Kw&%KF=MNw93n)ut} zZ<-s-uJaK29C$I>E1?0K{DRqriLKGIk$l~~VDLCRay>54I8Sj_`h5TPM2vL#=!t6-n)CDQp>Wug2WQA|OVM80UmBN&Z z!KJ3FUL=g30u^Iy+6Ii$bjHkGr#@yaJu1)J#E-><;APpy=av_t|K@($tvB+AKl`s?#CWs29&&e2q#| zMXMqfe z(21AgYOlVT4^&0p|BaufWwHCJPAMPj=lrnBtg{-BmIZ&tCO)TbG<8Xq{Jw?u$9Q4x zV32W?QAOr5VlDlMf!;DxRm|GUv}!Gt!G3wF%m*CTs_fvwk#bYt{&{lt4D0NC!2Pn> zkn(!eWQ4ZYLYJd;8D}oTdhgtb@?kw3)Er+AKjpAKCfQfKgk6!{c$TVg!jWA!A@*Ra zFh+}B3G^6U#QF)3|An=PH#-^L?+(Fb-NVJekgcn#5;Aoo(T^!#5I99%63AsyS)A{ zx)>{A2jC!_|2Q*dj3mt!S=~ujSW@;M>D&g~YQ~i)9hNE(9Hyi6A?K@T&iktYH-~rJ zFAwe2Z7R?vzq3?ff7QG}=)J4r-xU0AUMp=TxYNzZ)UfmmdH%&v%v(ye}48cVMBi7q^3VN@MO}|@A`2#ei55mjEm}J z6Ay2sM7j5Jv~;0jL=hs@UN>z;6fXB$+_~E|QD|@En}Td6T8GD0dmo7TI9sV4=z0k% zj;S@e%t!MI9rYHg8_V(I*6b)Rg?dmtOj|IN&P7Q>^m?P7u^DH)QrHC>u~_Ni?z<{EnLUSmuy)X9jNRO~RIplqD%?8l@( zRrC#dbiu_j!oqW~VN#ODqaAV4wm!wKZexVpZ=sTxv63}V`NdR=tRn3#ey-iJUBNbf zNRZ@8B{U4|YRB|jQe5_zwMA0bvMgQ*h})JM8ZF4#TIA9&dmT-y^XHVXx`PFn;R;GM z)&)7c+SmT39}$Ezgb%B7h5B0AKX`wJp7U7Tp(!$w87JXh+dr}-lnbnVm;d3-aiLmgi-`PhxOd55V>pDqQ6ch)RkCTDNXzNmd=aoD{iBAi6X zCLa@wxS!fY`GiP$iqk4TDPVzx+KNyt4kO8%wQ@eRrde;-Kj&@^6H1{+cpGO>fv$PA z-fSXC+yi~v0?f0SwWP+hYmV;}X07!o>Zi>3_G~~p)H$Z6&MaLfMBGol!5{f3%8=K8 z;%M5;&ei(+Ye&GI{je3%dR}~!`L*bt`OU+kMuoL$LiY76m+lMsZl>^O-;k}9!u5nS zZ+^|)xc?co-E(05fgyiW;O19R8YsjgT(pw5Ivi=-?b6$BJGHj%PI1q47cdAuI3Gya zzab9>Y`Hi(ACX#@8o1qr?kPo1K&h*qlY6rR&|V<{4s?xPn_3&la21i4KUxuBDw$$H zRXY0OLgBfxzTBA4W3cfvgf}Ui-a^%YG-Nu zx#Hh<1xRvxtvOW93v*pL?rw)aZ{T~5cD)a%bCCO9Ut)U273|<$$Y(3WA2|ThfV05I zyoSdKjnRHXM9=8&7VYC2K&%oraMpP3dJ(dG4V#psW|QoRw3a!&8mBoW*~Y>4h1E1= zP~(aBW*$Yv0lZy~OY14nKu9aVM~tTLLpn|##8~I8JEy0`JYm%w2O1?n!Dn$?yi=?Tzpw@urK*|TdA(F>P# z5_|mbf6bL@ox^)yp%Wn9v+mxp^gU+X^Ge&yl$7;>WrfpBXMf~N(oTs&K6EV9pNBlY zmO_2oKQ+(R<9}m@n#|hjD@4p-0XV(^xpcXtTW=HH!Ib6-BuD=VjYARu^^jhhI#!t64keab z&a(K9Cs6dX%I<@ZJBvH9yYLkzKoyk?WI+9thgo!0RNL<3B6#UudwhN@*^y7Wmw%u; zBZkQaQ1R#&f^)k_%SyXjR1i3319rg7 zpAp_Wf^cuQN8vX*jkdfr$?mBdz&SJFUv``H>jHDx$;s9awwPNC@Y}==uubli2|#T0 zx*N_`Kof%M7tsCUkQ&iG$lIA`z1T1>>jwAY>-y3znzti1J`0Y)nDLixZ! zNNEOHElfJ~H0Wxri}@%SUpLp3?Lk}sL_5sD+J2gO{`6}Az!Ue!lrvU~$F<`HIF*b5 zP|Zb~bu1Yg4t_n$q>7H$`7WdFcpX0mOBP{+PpqYwl(93kr2j?O4^&Ik$akLv^%%W&LUQ8KnflCvhB$|6mHVFguKp~J3D@FVIdO8XH4Fm zd)a5vCbr7*ttj>706F_$b->}^Oug0Zz+gYNRt%$DN;1o)1{0c!(2J2RHGl!X7fWcun4d?|77Lwz^CGIT{ zRyO39x8zfRlXCFGD}kE|QkssjHSD;2c8gaR0iaq234>rkeR+TZn{WJrpzUne{qHX= zK&4Gph*qv7C~Xv`|83jRpoo8=$A6=&9k2goJs>IwJfwi+{Cwrx@6HeQwq^r!KO=w- z_tISwe}D7S2eTMFE0wgw8Q1JY5#Z)IlLzqCy98iwGA+n4r4O0n;dc#X4t65r-0=rIyJ<41bNx|EaV#D&0@vRz5|tM^x`F>V*CqNNMbUAk9pr zf0LB|%k91^GSc7i2e{pj7XoG>3V_OATiU_(-d%CmFS2o*o-6zT^ZEm~WZ_K6&Ep3?U(4dh@aMUvYYNH?`rV_qMeU6W=ob7rQEliv>D(aHb9qkl6g z{x5AI5qIqC67yfX_7GE~X!ZjWxTn~F|6)P`F`9O* zUC+^b9a~mOd}tYs=tESx8Y5JvNGir{tNp}mOx_piEy&{1yt4mklG={@)i&d*H78PB zkzi=~Yq{S82ie}Z0wqp=V&KSWD`0KkS|9$)*m-BBNi<##Xp-2!f1m!w`!wix^>_u@ z$`0{8!g$^uPP{fTYB|gO-i|2qw{a{v2*^~^*t1J9$WfH{c5(kxH5T&9G5%pit*o?u z5Gp+QfiSz_UKdR~OG#-VFQ!C&Br@A59TiL4zBR)C!-~3f^q~eHkA`rZ@}aVQ$}z;( zEi3^EXYVctyqEiamAT0)c`icY&@SO_nMnUGGUA%ZY-BYG*OCEyU|6>lV8Z&^@_&N2 zYbIq0+S4B_A%<)}+vS&w_Robk;pCo`y2IkVHsCBd2WL4W@Ae%psRD`AV)J;+oV`jH z@pCSTqX{6z_dR)ZSZNV#{+AtU8kMc+E-fIT1qdXIDZp<@{`2{df+c2d7{e2pSEp^j zEq~3Q|8dKpw*69`pGD702t7zf#@=1!_)uz+0Rq9l%J8pBBL`>W29pn9^NAc9G#Bh= zk`+rt9E^Lp+f-(cL_HC^-3%s2(1|9uTK`t_qaQc@MX53T^uMFtY0^KUPzXfy&Wu)Mt01=$@P}DzxvC1dAOO&h z+2QZu>6eZ*zTG%xlokG^rwLNZ@+(rj#Ln+s^b6&_p=NXtGBC6<1fKx$$xmSY_gkcS zqG2uHG*@&tl!7@zV$c2U)I}m91dXmCP_mhNJsd;@MuU7^e5ga z(E?!ct5Sen|3&r2QFl-IHTE*m|A3wUzKQ={v#;~OD=5BNAT;f2que2q&7LseF+YFcIZRe-*_2=Y^3ZDv>`etnj5GsHsD zGFF zS1H8!t$-#uPciB@Zr1;W!|nW0OFbzs&!PKrUr0Le{^r*NB9S)NL{dEO$J(oMCy7es z>-s>t@VB26_jwUx#MixrgxF|Mty@s|V9t!FqL^%>apGWBatt)m@&hj>gARIp3A zw76hw4zN!+Ne|$}*1Lm`4CIvbS$K?r0!T03iSC~81q7HEXBR{p6Fvt%{LlOB+m~=# zMC!bL$u=rtzz_)~pj}J{0Eq{=QMt^y(tZup@fh`&%id*1GBv=Ka9G?X(P~=G4ltkKh zc+dD*a)6-is`c`6LdYR6``jp zi&->;oW(_j|1>A+n+tZ%<2Q;4QgdzD#Bp99=EM>oc01!YEGAj83;gG;pHoaJoZv~{ zb?8d~tn1dy_2#n-Rtkh&U~3Mt@rQB*JP_YP$V&j~GgDm7( zTlcavSIGP4xSxk>8$y%MPh3*eqd&v|kg9njN)X-IQMZq}r{e7icMbCSe@YPjS=P+s zuP}>?N~#xgJp8Ve5Y*`}culm95b6XCW@>UOzC@-$2dKd+2IU7lQ9*Qq<_|y*QaJB{rRRj1r(ImEjkJAw)q2O;JpI!EI|1Kv5 z-sbOG>ghGa!i)i)OpDlZM5)RI==1ecTj{bjl6sS5aUSUMHb1$HrSqLE7Wd1OsL4;y z@IA~At@V|ph&A0Cb=Q~NF6o$rDJ{S1QT{j*2QB=kC(<6y}&fyBKYz6ionH zrD2R(%yUbyp#3sC`Xl&J_@08Uw5C8{G33Ycz=+>$04+h$xyn_D5+GVafJ-!S>Z5trIah;fl*s;(O3d1k|iW&h;u=H zltfuMJ~CC8SmQA!W0%i0D>6*dEqf~fCW8Xb{ktbRMP-%mMpw&`DXaPUhGD}JD%D7eVobrC(>+xun-dnixY-bcX&I<#=0O@L2K z=3rhU+>YYk<>>1*Qa~u)aV=hizS8)wexbAU>SPi3JZNpmIFRMZ9H1z0o&XfWUKU7c zB*pjXM8S1F8YMEk^oWBks5>mkj@eDNYStA>+~TQZ(pF%Jx(M|Tzd9?2ERm^6ej6e4 z*O$qg8B7*~<-iKt1m$;S&XM6s;r7ZwW%-=c`ok=%OqVdjb=r~=g&Tj7{RIVB$Hy!Tdl4X^T;M&*A zRT54UQR0J6Bd{DpTv%A^{Jq(Aqg>8@g-2uO;9sH?G#q?aYR(;}+$UN?ub(1lLCrTl zI4qrl=Sin-&bB)G%A25)E1U{8o8S9IFgL#?jwB~}6QZzleRO-N=MN`;L3 zHm#vELQ2<7t)J})IDw=L$aml8dz(oJ!D%z|sXWRN^w6~^KZ+Jq2`z%VzIA1WWrGd7u^0rAzirrUpxn`$P>Ne4xamW zY9x+q?jjr6C42CXK~$7Is^Ks(63)%xTiBLUM9(J+!$#y1O9{Dr?u>%p0>AX*mXezQ z*=es8vJFtH-DV@pwR>pdvnY%BtteFHHTuxy?FCv=zPhhRIKJB3yp=y03o&b*=8I&b zEG}t=I2J_pd%VHtAGi1K@KWUs;?JolM0_0`X1n-I?(SZM@C(rhT#He5E!_P33+^Tx zO6*GIAE%uZiplvN_(Obrq~ZCUENSt?4kp)y&83h5k+sWKv&tx+5pJd5U+;5kzt$jX|=D_`x|N6`s zYi?iW#ZOxQ43YCYhQk0T*%OFx*Rp4~B?NVvLuIp&AYU3Vl)}$EAj6bz69-Jz0yn>n zVxWqB{_l3&QRX|8Nk1V_n;PvADRE>cx~oyE>RGzaJFZo64&F=$Tntjr&?B)_^{BlF zhe4Oe=&Y-yOQJX7OD|NM%PA4s^es%A>haxN=MUYJ4ze;bQ@-^_1WB31&-!GFV8MFg z?8V{QD<-kM);Q9nTQw(GKxZUJsKDyM2PukNw>P3YCv=y0hgqX)$Dv2ddUFJ{rxah; zQoXL;@K7AHr1yCG>-+wCL7ghLO)zD!J$z*NAj-ko%C`S_^dEoCX+#pAu;JR@9E|%w z)MMkduQ}WCq+FftY#pk!;{&IB@i_f)^H6YV+(fXX&-Xv?Ij9YakE~uRtCg0KnX4Ij zK2!^O??PYC0QUlUDk+@wz&-*cQn5Maw3E_Jzm!ygZ@@SF1$4CWcyni!tV*i3n}JGV8V zC-)7@$?$_faDSUN{0Yu|dTF4Q^C75TzPdpCP+XK=OcC%Ww5qJdT2bX^7ZKzIuU>Y` zCi1aiz5dzx`ajDBX^x6;qtTTwDl)4zBVAyY-c3@=hhK+lS(EIBm7Q^^f(jl=)KzOj z=E}X+?)i#PvaVx2A#peeBR<2Q+w%Spp_F`T&;u#>VYboLFov@nXNv6OMkYBZP^nvE z4|Gzc(!W$s&Rn9-->GKXog{H=r}zw;E!yz$s4LTj6;%GQ)AJWtFtwQBQY9Qxv|}E3 z|48#D4!Sb1%p6q_!I`Kj&VkFT(c<1WH5*J(C)l0W7`QwbJ`^se`lRs`*LUynF6&CW zx6g}sweqEqcC1nALrL(xvFl(;A(4+#mI&k}p`^n0cyK6g!SWe})Y775tOZeW&!lCa ztb!Bp(lB{T_0nn}|CuzoPG}J{>i7OyF78e_ClG$En(8cgMZpo~Q8|P9(I^m!E@`E- z?TeNd=^j32um9!0@@Lv#A-}12Y^;G9!I{4|Ly+0fpL=fb>;Kau%O$p5J>?!OLi-qo2V7=!;o>%Rq%<#g)%z_58?mL(Jahd69apKH|A_?tJ?j@cB`icV=sM z({1LU(lYd{um5vEY5L*t@Uyr9=7vS>SH)NVRt)_BWqy3YOk!}$BrlGhYkqg-SH}E@ zkPYI0tqe{QE?IG2z}nkF3j38435}s?k$i4Qdz}J z=rg7*pMQX;fX*n81WuajBDy-oR6e^>NcbelFxbmlKCDysnts4CU`=0|M;x6tLQ3}| z`u$tN&Qr#|exTTb;~a+DtVl(`k7Ag|NJQ*u<2iO=S-5HQWV9Qc53ehkeeagGk?sRtub&RAl3(|fQUyb-VXwz z(D-%xE5{ySgXEE%q4h^Z_;d!o)|c_J=p*7E*{R)vVIDp7;T!P)Cw8H*;^0w7DVJ44Dhdj;*=;c_Gq?tp~49WjERza+!I z&s@g}w}R8aabTxHu*BdeF5VRas1^$KkU01K^YI7g)bU+v*$osIrUU|dPhFRb*2cH| z@>+>oF=g*ftMcG51MN~J6x6ZCL$So z?re4ph8o^xYsowN>@(+{m4(N+YXlqk8&6ojWw%Gk*dL_s9_`ih9T(O z#IjINIqsPxHtd1bl=etc5gQWW#jnXhXSeFE%LC4Vrk4 zy_yYzH;EC3OJ2M?xifOCwo3z_Uh`eFQSB+sb$PkTEzeiLEZlb&vhWWASc#p%(4bsx=RKe5&OA@IfU-B{j;;Db6E$!9miu<@u^ zOu~R$cX^C`d}O(H-D;gn#76?kVQNVqr`EH9t$Y&! z_1~Zy(i{g#nD2kF9`J2>*!e3pmk(Bot+^P0X<(v|=(u(>FEoHdb}4vM%lw<4C#HE@Y%(lzkHX4An@BS<**;q`dm0#%;J$|t z22jiXtp!q)6rFOI;m(x2l0l-gX`lm&k2gSKo~7gQopzoQa$rQ%>1&AIX^3ieD*mJ;TKB`tlp}WwFzjU_PJXO?G!O1G8by=&nLPe&ds^7>--Xk23mz#f6TOd*G z>Q2#VbCNYiZBX52+W>h?!&{Df6TZwajIc~bJOf_F`{ty1bYzMP$J}wCST`~qf@gPP z^4r*j$JXz-Ysj&&2R%4y4NQ@0%D%}+&6kDr$U{181qXobJnZzF-$Z|Z1EgRr>JTe_ zF9b0gb3jj0trnL*PQY1HZ9U|^hkpB^;=6M{-AoXFKksJ-k}gc!B23U>S#Sj#ZV)I) z=)X`yr_kQ^kH?*}3TDne@onIVcZ@+aGaJA{D z(Wx(5lh+F&^6j1=3p|*z0mYqix8wz7yY#QJfjf|Fupg&0U=~vuCMty}y1_v#5KLPi zsyKRs4nOdAJpCPh2S0#-^QxTJ089rF|KVyBePn-D$F>Je$Q* zQp1~7tYUvgH+j-KW%xpENpV^XQ-07t2P}Aiw=TPfhNj6NPW%Rf!Y!`NPwbrjd|E)! z_^-MFA1D9v+1eWU;3M#oA9~Ct{9p@I2h)N7bMyaDv;CmoY<(a6ee|nBepsym0^Zrv zOvitH!N2X70ug+cX8YfO3e`vlyb}G0h}Xc!<(CN>=&{AWq;3EF{AK(8kcsCY;|};d z_s;$1u?B%8ddD7JXi)$JE3-SZ>ATyeAKyLBGbd`PO8Mf?P`le77 zUGWBZREYPXPn1syI`rE2I{9SC|16L{%az9{#89Hu$4f40Lg(=p=;w}RkXZ3Rs;9N_ z_3XjvYjj@Bdjfsy0c#wxO@R>|2wR>Sd%xK3DAw+6Q_vT^DD-^H7G_y134kI0i7hZ< z8F1I=?%Bf2+ui*==;~JR+H>VX>1`1p?i-UR<^=&E_t+oWbwwKi=;vHIbLg*^N)SV? z=kb|ZGW>#w?NNV_#q=jy_4ssAqkdp;)m#4;n=$&8ZT#6fk14VR)ct@XWOfyIy{iif zw0(QLP)~0UTM5CfuH%exFm!Vre&6#b0Pg1u%Jt@Mh1R#NiCtECoLehaK6nAp>Q@W8 zz53s(a0;!AS}twF8&V9xj4UZu0LSWDPVX(9=nEVlv7=Lz?j?yL>$K-}KAUSOmY>VA(T z!Vx6<$`o~au+aAF*+xK#c=pZO7SH+e1=ZIgAyjkRy&~U6Ptx=a?LAnKzF+;P!`Fuk zo)hpi*bj{}b1_pATj4Rc#S5RlihVfydOr5K4?TSl<9Z}^Pv6Xtrw4r9JQ!bC-5~+e zMVNZE>J9jphjl*K1K|--*#xcWkDm8@nwxx<<`i?YO{t62jY9;z3gVj`pGG!{Ee_48 zm>nS?eENcflj#HCpK;A?M1Aubpg}2ugejb@l99m_>z6!=ZQJ|di63~AfPIB z>#xw<`2iN2hK4nmhifTA=Up7kmJ~JKf8(VwRXl}L zdfizQV3TALOWM1yThHsCY>C?UYGJH|)iTE!y8OR`trvVbY?C{;uDbH|D#-x1@_=8j zFHQS;_44{&UX90PvTM)#?Xc5rm{Rzh@6lRuQA#3!#4SBJMe%>ADalR{}l^? zXT!e*7W|<6CAENcic^!7y-zXYtZJ8xis!L1O|1(P?4qyN|H&w`yuDAi9(4NVjr5ys zTl~#*X4n5-JoVcn;64pio`hBFwe2~2ZlC=Ye526!x@?ZS-~LAj0$yDc2lijCev936 zu4HBjpU3R0w-pxT*xyVx-u=GuT!6;68J*8aPq7CIe6LH|Wos zS>OKT46vvTbKHMeD8n2+2*GytKzRDBkIU~Rm01+5y7}{lCGg0i{bom#`lEnLJ&wX= zCW`rVzRUpL*$43P zFS+kN7ubBVtNEM(uo-YpZ_H+0N(VN|V7p*Vu*ioA< z!SmW9dcXhvRp+oBJES|ees}hUl-?B`{O#dor-ybSz7He49{B9Ac;Mp`9Ck0{p@;oG z(N~1Y*Z#VAJIZ63zkkHdC*N$-H$OafN=RRCrsSDUu>di8_vh|Im-p@7_w3Pujj5Oj zYWYNKapV^+s;rF@H@2yLD^|6jd_gc5&B_)HZR=+t^ojL9uinq^2W(Ao$Bst@$ML)W zIT%ymdGMcC3(^1kCz>dNPQ9#%hz_xGi@o&H=qD>m1J=^w5;OIh&IuaBR$G)ab)wF~ zbX~MwS|Y%<@$t#MKAhVQPZD*#aiQe8*fYgzQ-?kJW~$YX`*An9`8qE-A@gq?CCsB% zB(SO2s#XUdS3B=?D6sGNSeY1w&NQM=CPca&g(UXPF18L0V{XK^REO<#yt)ubZGDB z^kquJhr;`B+eL#NERQhDA|1{O7OwP|ILGGW@50Pyo{sBxwe=08z7V67L81XQ32_dy8rIvsj?V zxQXO%>&~4zk;MkJ~vSY*`u^>eAzHLub233Uaqb7 zMD=(`{^o-~kdf|6+;JGmp+YE#w<1^hd zeppqpJ6E4zB5C(;wElOSc07eHuL)}J>;8SSd zvaGoeO#xYuFJ|niz?P4rf8gEZ_2U;I_VCe9i*)|wx;xm0a^wynOE;_M248kRK&;f@ zFU}_R&;P%uNcs7of&<;xXZnR6AR~uX45MSx z6s#@bL@eCHC8A>!+Lg&wKIlhsUjaHAuZ)#@RP;0iI`a36iTwsTr6noT>^18GK=;z- zvN^OsUj{DstjQ_oOj~SGAQxkT2xxBPx-tGj{S{cl`IcWdQ<|^e4<9{$CK_i>t^^8; zTB5#E=)H#rUXWQQL(Ccy^KIMC2nHvcOAXsfC$nH+Z`{Vuy`$m1wgvL71G#G0hYRo4 z2h`1~3oK2QeZ4u9&9;Juu!#lm=&CR8r}drQ1fA!E%sC0ktLk}{!mFMGMzil3>I&Ll zvjX89C)1j*!SvbY^j@Qs^LxB7R3B%afCukVwL9iBoC|lQo*!*QuQbMX-$b0#dwJ?{ z1S3+vpjG{pEvbRmf=fe`9c9@faZ%LB_Xi%b)MZyFh!O}16EPoe>sB+X#Hr^KWKvuW zSuWVgn0z&%esnLW>~ z;guWkkfUU%!6GG3MCTT)>>%_Oc6>tvhrnm}bhUpj}vj;%84?lU4A>h{mW`-P>Zsxt={Qg>QhK}Fx=fysCVqER! zd?2fWReIg)Z!dJ525>GTe*JEs8`);m_~GnZUExPlczmUf+i%0Y^V1f?tttwzJVfI4 z)ch7#<YM=}m}w>_2zwr6kUrF-9aoGSf4!|1Wgjnzbwq0> z{vLOvBgZP8AjoiUxQUqp zdUF)MR<>@j+rZgVE+LJM5lxMdR z?rNAG$Px&DGQ=KCofIccJ&3Yz>pk4)0o^HJ{W*n(<`00c^^fyuYkXz-ECop2dFK0N z#V_{jbk|XX`MK54p~~hQ;`f0U)WG}gzI-K_H6zrAc3&aEe>xV=Yt4~`&?cClRE{k| ztm5u29SbD{A$(xK_~uo1WOt&1#{t+xXmZp_^Zc5Ixh8Wr|63M2J^blhCJ6 zFnS0BEmZ6j^9*~UxoDFXJJANJ86=0adZ(8sAH#I|%ExMqCHF6vnqRnyGu+YFR;#6o z;!iaF98sU404FpWc?<70TUG2be#sZfOiFNaBI$4{7ylbzR5q!5dBis|H_KM@y@O^m4mUx-pM;(>3UX^NQGP#qK6XmG%J!rA~G z=DByQt1%0OVq|aEkPJRzVJ79&H$iWYCcN#9?V%WrdgC9D;CF>pU!P$5bg*U(z^xp4 zhm)R`2k$;B?~Ifs^wNObnXYzUdV3soXPi1nWAENwQUEa}-}Qz#VIxl9L`22McwOxb zKtkrd$*pWTwWf&p-#td?2I4XkMk=HmyP;EQRrxVGn6?S#U&{DU=C5uMIWVFfqOWCi zN3qje{qgsLd7E}$%YE&d58Yn){{OE)-B3+6*m2P$6`bTIr;@cuR$32rkNpGBTfA6Hf4X#@Uv|fq z+`b$#*zS9|N+Ht3Q~PPYw#kWBcW(S7qgr^N$j<1{-c)uct1j!_bbRIn=RJxnr-GwQ zvcyJhB-o$e*SUxN*~Hio5OOrLcH9>_)``iF+`P>KZq4-3~_k*J}r3OZ$g65NRAP9d;tlZFRzvqa-mk3?(a zUV@Ta4d-Wn>Y9HLu@3Klb@XDQ>X!Sd_XSjORAAwW5w}_j5&>hR3zZd@vKeZ1^1VZT z1tE6q-lMHNNCj7$)uh=t3qXQ&5vpVRQm#1Hj4Q5jhC_#*C=lEb^WNiNQh=m|t7PBa z4Z_>Xt2N_I*iq7(o*TrVm>UtTEdKsF39o2?au7IbLJ$|3e8Vf75<%tTg!?MM)iMqdTR|yhSL|z?7wC8- zQa?u1#w`|RP{(?!_cy8FZlcI8)iisjp{wFaguPx<)nLdI%!`Rui{X&Lyf8$musP_N z8R!M6u3q?dW=Ubq`ErQXi$IoZ3Ce8~tTBbX2=3K9U#%}PJGH6S6K1~5kJ_nEg&Y{E z+rc&XwbW%-UB3Z6dLa{+0u%f^&e={&9|^8K_ECy&B)qEYJ`x~yC+Z32)`eH9KN?x* zlvJh=In_p749LMa{9>H{CA|aJOb#PV=r6K` z3lbc9ysoqei>h20*_hF`rk&O_zDJAWrT%zW_jcu5bvKg4xkv_wspwVHb6u6?NywGW z>{#k#=H_@uk9FYFNV~)Hjtf5as&82I>^d%Kwl51#9rBa!H8(RjZz{lu;@S2+&~7dl zwX6CC3B8VchBp3HLT92R-m1*O7;i`it|Q zUpEpWHrq6S#zukqmV#S3%%0C6z6f7BEg)}5BOj-1stnl6{!)eJ_ZQvd#vnKNDoed* zBbJDvcj9d`ry{-kH+jd37>d^IzTQov(ro1WChCk?kK&gQ+aZ4IxFa;=X{xYks+!&m zvBjaxWxfUDP^;uOt>` z9uHC+W|r2+Pimp)uD)TvmZLkC6kOA zd|$an9(ekA=%z!%w3%zg_hWk%K=QGznSlXuvqrrQv@!sG@Z*DmNR<{Zut)RIjkc_a z;5x8d@@*=Gt=vZl5jH?`dyAU;T$|D1)6L_R@eX*-I=yr@X#q z9NKdJ{3B9<6^`ahYWHQ(ta?@7xx>L6HN}S>)lsRpz~^lQcBX-!koPU(B5~3|^*6{7 z3xglSwi0-X6u2fQ-gZvSPUQnKEc~8Arzk9lGhAtful@qsHeIR!P`mHPWM^){l>~8s zF1%MQ#6UA`BDxd50OlkJuO06B>5i7|9f&;!^!A}AKxUEDytkUEuo`6&QZmoJqBHg1p6pM0m7z ztrO?YwfnBc7=tl4w{h#NYq-rp1MZ3}15iDmEo>=kiMly^UWC1vTjGv1)LNUixW>(` zYtA@YGG@=8WIbB3FmSvH5{|bX4E*fPx&9GzJI%WfZ1Yl6t)jlu23G~A-BrVd7wv^6 zdfhcbsW*IzavPp0y+s^GlL~SNNSOHDP-`U7l3h~@2k<*o=zJZ}O*10>ZArIBm}{?@ zHY-3I34B--Wm3S$bdN{I4u4Hm%_SdqgczL{3>-_~r$xHK!wA6d5u00(RTJ{$ywgJB zW+BE@$%qDViDRP_7)4vc+;PI?vFE`rvPryUTbkv9Ubkl*wnlOL6Nlg0k5#_EbK)F* z8P)qTiTGJ7m^UQ+HbHZ-^XH9x)}Z%pXw4rU8`tt`nCPD(Wg9H25kDb$aWeFa z>-Gr?JD*rD3^#;MNCRIU^dyS$nc zux;16!{mC+esGNOilN_?Wg$$Ye3aCRK6(7 ze-<|A!?|<9*%{8gQJ=_;1Yjt@nsH9X0}iAEaB;!RG$D^TjiHbBclPMJ8)^n=0VUgYV|d>c3*J5 zIs^NU6lyjV@76Tu28iqYTgH2R1h2fW{n$UBR?0rXJU#&WW&7RV*N^F9$y?C^Wz^OeOnDAMt(P< z{iPg^fz5oMCw?iZj3aToC2FVj6@0>P&SH_vi&?~e6vfgbS`+qpZ4$LGy75iUw%Y<5 z^{1d=jqvs)-_W|1D+8aita390uVQOyMYcU%2jzV;1iZRrK_1o}ti@-n8PFQ%$#n`Q zs^00br-`m*Dt;#N7Q7AH(7u2ulkLTK@YB@8TkX6gE_>_C>JTuqx6o1K+t5Fs$DR6k zO?>}65BqteD>}Ug2ag5BGZ!k{1AD@;cl(ONb9ePjuP*^fUpuN~>-A~us##iB5jyUS zY20RK=t>o~mq7ce>+ohBIljp2ok`Uv4V+9giPRQYnj+YF4?ExBc`q$KQ`pOWn#U)t z(7Lg1yr`FEg2JXBX+@#JVR&yJ9GO1~hQygbGdt?)tz05}nu~{4a7I2id3W12$IVz* z!-sdlyToi=6mfjPY+TuQDm(48R|oXbKZfnA76c??qPho z4nI&{5rd+1#|8K)keHVmm%XvV@UCiWaXqv60kxS&niVF=MpXShni@AIxo?ioP&3{I z7kl%Ed~ACVkWDw!qciK!tgiShGdVcwI}}-9=b6{htb4Mz?YqBBuWsKJz@(c)bBJ0_ zvjMmF;MAo)g_CU4DFOzCj4ImgTL!i^o-VAU>RTcchugj@|16@pZ(8hz@oboC7u%dU zVaFFeiad4q%)#vif^DgKK6KS+_Z8Q(OK%z>Ywhtr{w7%Wxs4wXS zX69V1ZYFEh>TG@=J|F*Xb3=#QV7gXj;g80D{DGI>b5tw0>- z^OOB^zH8+Jb;O{yx6`QRC0gHNF0mY!4&_WNfAG7qk`FbDUB#YR>`G+5;-Mj}S_0Td zg)Sj@1ZtVKTrWBpo!>wtrfZymZm=#s5j z#M;iyS1~6(F(|X1jCY4&sWj%VriiyOs>STbX-|*B+cLnA&4ZtcBM%h&*!|EINoOn> z#t(E@R6AQ4w$|aa0petBtwmjKQ6BPZ=`PDhELj?kU2-6MLZM zY_`_cENfy8zxE8fXO8(4TjMMxEJt1gAXiyKpP6Dq)=1UlnRfb%-S_z}h`wEmcNT7N z!)pDk!_q&^wDmMQ#*XDNhMhC`m2WYJ%YXkU4=VP^Uc~atUN6_?5QQ5!#9meTqC#ss zg6e*a`<9*WSU8h(!BNu))|aBGMes9!$fC-t{7*M@nI1N@*UHxx1=4r3r*m<{IHSX3 z2n8N*+L61=nX-o@V3s3`H~BgO^%su?J(9`ime;Bz2r{*KEA~q&laPkLsY#hXs;2bH zlEPE!?!zMnFu0O4NQT+DGLP0226bdCL{i_?4G{&d=qvV~(mrJ@dxs{7aLdlE7(yaCzD-K&F`@Q&JZVs|F^lMZA#tTp@!y zjDv4RpZF!^VY~)jx%9O-U^o^iCd!{rA8nw$UKJ|yJ=<=M10h8oV2#1U*ZMqSjU+tN zw@hKt5#}@NBhwfe$vcXpa_?4XKN2vHpZavF^F4|S6NhPw@0ptTN&z`(GbC`DUBA)# z9T(Dn{~9gOnv?)D#mA^@fn?Pdi?qZSYkFm+dB9qQJB+o_3-DhbL~vV+VyG|L{p_;w z^}!TA=K{wRz|Y4SG#1A?zYT)q_W-W5tL?`NOfD9^Y>DaQv$}N zlv7unJm`P*OM7zeHRh4PDut`%O9_(^GQi<_fC=F3DH)iU_n%KNL!IkydOFEN=5ua{ zTcBDA`ii`N| zVWt)edR8S;eBb;O`+=#?-6Ha}&b_#;h=XTal__XGb1t|A?SFMDV{sNo97uwxJha8+ zYQ+WeeB~=xDj|I8Jz?t*U*9*1FY@K|>g%lq!y^>^sS1H8++B~nY-fPqu8I#10r(eo@;2lWoDr7D9h4>(Kh8wQZ z*4t?5@cA$o6aEmicAgFU64O{z@B$J?$HWbMxn_MjCyty0dZn1~09| zOkW5XiBXV;IKF^XA1Wuk@P>nnv9uYPdGyGd0Ke{TOv#K#*);|=;WVr&?}<}f5-?-v z^z-iNnSqYYI#sx~?}r=P@>!xxw*`Y-Ng)KX*&Zba8Vg%sHhu5XY8PGpq1-(xJO^r@ z6SHy4P837O)c@*PtZJb#(iTVuu4yEU3NAk2Cc|gN+AAK^j8mghWcplH^Bm8qx<$r* zndA+&aSAto6fr9HKy|BQj}_;0@8!{l=UoE6iNc(tk?3sgte3ZIa$=H-8#zP3^X#92 ztd5F4@8wXLF>Ig#c+Du?x83?pN26?T#M&aw8{A2p2{>ewkI<<322y6Gm2aW5f~7F1 z<}&?B$Yxd%LJ0moRI6PrPZH>A&D`44DXl}(D?2EH;N|5y139U0E%_6kL$#UFBAq}rZ zN`7dZPx5hVF;j{E*k?Z8Xtz&|pzNxS2Z?J~miIcFvX<70{4=N$+v(_|>9bnxbN1+H z4TFTl)-v?f^=*6((W%|q7GWN-jY|Jl~csx`05|ANZ zllrO>bM+Rdips=1mYyTd7IC?+zwxbi`U2VdQv8;2gvE*=?U`UV^qTxFKs@k;moEo9 z74Pj}CH_;$;PsOGM2UbcYOuK%L~U*297^vB3}G=mGA{LfSfbrwy2wJ*Bh$m;&sQjq z`Aq*fpAn4_zW)?4bw0VRo8sh1@(Ab8&@*VZl#qwFct$$*dfAnGUpM$OgCx)6tz3jF zK^*SI|1pL8MZPj8Dcb6Y{nGx7m=J0A(rds8Qv=}F0VI=Cd7KoEh8R-xvI54amfrbq z6@1N$$CeJxn;Ck)Ato$ zw0q^;>gb<6JJK_Zyv{zb<@p|c4-sv-5p%6Xs3R7lQ4kZlVJ`PA<_z9y0PXFMj9j`9 z_^F6k1ZDqC?O2{VTv7?~&_)5t4S5lXao?cngKbE*js?HMzE0`AS$yxM3Qoih= zH`B~sBe8PZqZ;k4*$u69Ln?uO`ItcZ7na=nANXUCu^YN|nuwH&J@_vQvctsoADQjg zv2OfdoVZsGWV-Pq;kriAyIcR~AH6>^7Ha>27yr8p|1S--&0Yr|7aY&~S;Fr52*H@` zTJK#u8Y;An{|z0#iHYl2T46>lu>#3{5~Oct@X|t}>h=P?t8!_d>&U64Opx!)OdPzk zJo46iz=-ouDO2Y;2`0?Idk@R_;QVJMC|$zvA$LyyO|6Dh5gj{BHS7zO^HRooSoQ!mBVqH~(L@^duVUb8p0B>@~{;%f0t^F!;}B2YJz zil}%kQ7I~pd#y&fHT0Q{&=y6=v*cH^V@`(ca}8&_F||y7@M+4|xXmxnE&g%3_sj$= z?XB<~R`KR6X-Q5vAjxEHPyhXBjTn>(2?X>XHZWo@kUGqnhymVtkZb1|Lob*;!@r<(NTHys`Q_bmC1zD zj1fcT>98$!j@a#OfKwche4|i|nX9YN#q(C`{0s8)gPbM6k>FXkYNS8c7dA6aquoGD zd;3o2>zw=R-<|gIQl}Eg1F=C!ttsm}kjXrvbKE*zjmPRg)$S{bS`mYcSz+@DRP($; z?c&dXXRnraK|#NYiX#{M!Fs?_Orr;q^9(<0KFTJ6e|{()T=|Dq{1PkZedlCGn(Gpk zxq1jxISaQ?h%qAqntg=;OV)Ek?nbJ*j&qd_qe@j{0?E$BNW&0^1zd@-n z_wquA$#fT#ll_^~_Z&xG)hQlps1PKn?UDxQkQz`t7dz<`wJ|s(m;)#0RRt7|Z`F`z z>jGo>V;;u=oQ2@pzCGxB^<{weIfg#$H(*(%V=Isn-0G+-ii|-XDc|_~*~`bf1j1%# zP>aXMsknP}Q!|<(4yIsmP5`L(SN#)xALs@iVKJG#w!}XhjabD|tMJiTLiFr_^ElTg za2^o9R*&a&9j@aukMD?^e|>mn2EO8Sk3zW{M0wSWq2B#n$)wZ{OZhld)4^6gsD>pW z#$k~AH@MOOm}86l)Ih~-u4$x&Tfu-1x>!`kLu@>tPv*`kz=3s{LAVBid|N1qJ+qOo zUx~;ck-pAVc{($QYV}~muuzyqZw5Qa=DgM^$Z=pz3M!uPf`pB*Z;R~q31k-<+zy`S zx-CafY*=Vg8y$Hbjqry$f|B+4*)*@nBZ>k7)=f!8K;4FZc6`Lw?1g4^A1o?Vuoc*$ zoNju3>8r%un!XrCNno08n*mV+h5-rKdUCJQY>-JD_t#p^)1F-$ckUs0CCR;~D1awV zBN}=dk9SM;t;q#!6}nLNK}}!B0u+v!viMWp(3nR!)Y#N~c{WfcI7U=>KQfM@mBWX5 zs8Iz8gRJtqyN*N))`}lw7-RQf@XI-1J91sY8an8iFmv7#O~l! zwi(fGA8f6rEqNf!jc;0qyQ=CUKL24#7=KI|9yfCpsz5bg!CcHH^?36 zdpTBW8%e4OP@40so7`1uIC5Qy!Kk@A*gi)-^C|8}(E>*@(q}~V{#^xz*aUVcX$AVZ-ja87e-JII@eR{a5 z`Q;6Ih+1k9)>y4?rS<43lX$KZdx5Zaw1S8dNF-kH$seMZ%%(i{Q{NqD9B*`7JIqVD zZakO6)Akn9FnwdtSSpqb5h&OG%nJLA&4PrJHvs^HjW=;Q&2$pG-tx4Ilrg?CYU#iU+j~-TO9PicR1lUKr;$z?j0W9q^!tWvo+CS8IJt4uH`#d#} zs9b#R$!96=rDK6Uv=7DsEU9ri|3_(hRtIu!Fo0t{Y&q@x(cN810TNEg^sF)5q1BkN z#d5G|^YaljqsfT@v&s{K;GppFKF&yzpgw(* z<$=%Yq#)u2`f7S?9eQgDSNGIrl~VQ?Psu>1KQ(!odz+d*zXR zn>@D{ksBL!tQ(vWbKN@CBsf@i!AIk6(2AbpBrxp$@aa;|&+nV!O9GG~8O(vHN>icQ z+6@r>YlDXiX5Mw>D+{%2u3p8Z{!^JB{)(RnE4g(4P4(1t%GzQMf!v!FspwmO`dx60 z&YfBdfAtfVK`S*IH-}Av^MGMG^>=8!ENZ#(1N}XZ5*vqt(cK)X`G?>a)Y7tE57_ju zc!A?(dTw- zzbOf_d>pu#H^F|Tyb%lw8ylhwVD%0xe7u##oXoTSOp8KU|?!BSzd|fKX`mu-b35HK#?bV8> z?d2h(qa&07)#pD22Zl_q88!sRo<;}BY5pdvbu58r`e%Yp?0spCw$qdcIXqk%b@`5u zfDUe#ksporJlhS;S53n0!p;mnaewk@K*URmY5nmYiRyfL%V5xJ0b`Zy9lVnNuT#^U z!P%m7biUt^+%q91bi$pfQRH|s_(p1q7HZMAEmc@lSAtAg^N)?q@N#>CYBC?Wayc<} z5U^T)BFVR^-Lea+Q|zUy^D@UmS^^ z!3byb;)p9D(p27@H@72x4_4E^pYU0fh}pxahy%xDj^TN|)Pd)upLQt@KVum^-2@yi zNMAXUp6$A8x}Dc(|B#n|??ize1AGF-_^ddgfGvv74<={|i4pq%60{@Q?0vz!#&Eva zKSkk}G3p0FnMsHGlXbKt+ntv3b+bLg=!@=Si=S$%^bpzOEH4oT`BJ*qp1y>!=sKlV z&Kf&8_D;v+07Cv&VX&9&wKIRaer=!g9E1Fzj6Q00pkA7sscGO7EqWM-m#|A(8cRN87J6{YAB3RfOyHm3ffIgQ%8>N=kX8m8 z;k!yjO`12*CQeJY=mPZ)jfA*%i@HyWATMtTlYdDiexxS-vC@K!-vd>NVJpP^8o5*` zxuxZQFL{Yb+%Gy#Cuk_%Ytye@bbp<&9{?;+8SZuH?6f)JQz4S_Oid<+M$uf1=@)fl zEr*;+3t4HlFBAJgqQ!ajV@WDo9MYv>f^?wE@R=GX5w)S@RH=-Jg;i^38w_^zE_C$7 zQ9RBqc!oJoHqly_hV}XV&*@W?m1o=nccm?c+|(?QCD#$|g1}RP?l4*}NSxpEsJrp= za9iBWjT7}%0tbzICnpi@d5%LkJ!&04++QpoVe+!wcRFg*wFt6srj*q9V#~Qc231*r zy`C*ZnAo<4z#;9vt&#qKjsX_!_pN^89iGfH4@6%=1_gp*Z{@8O36FCbr1-g^6F!n# zdcE^6?|q%J?-~zxe6}}xf~hwD3vlkz#D1_${^sPUh&z|+5ejTO3L^$R!#NP<7Jj=oS}!#s?qzN1Y9+4>q-l>$ z+H8tXpKqK!Eb|RVslndmV7=#xg)YEqSy?&4_2JfiVsLy#%%wOURKI63aK5n$R?y@Q zZa!iHfAL)&B#(w4R*t(ypyVtSOGuX@IBQ0C#25sJ+71yrxiG(olX?L~iyan8T10<} za1seypNZCQ;h)+jGStKJ**i|k9BYJD7${~ z=8=~o7G;USgNw;YfCEKA^2BI@&EkfHNwwp8+sP}AHPLo)6!XA2iXPJ{LNkHFD^3&~BUB>e|iphs+?AN}KTve!Tsj6-H z(v2eAJi+*Mgfk-4lq}thJn&NcrDa4;u1aSc$yCV_7LB^a?$yyb|7Ro2iQvK638AYb z9>jSZH;q{3gnkVlC8O6jsNT?y(~VU}0?iUIm*6d1O{EHTUqsehO8sy+lLOdJY_H8DLxZ%0%v#<(ddsG=j|9$+Pu*g-WS zH$Pb6#t0I1N6wjTUNWXb4bM;*(A(8FQNrtbh_@HTpmN=R*T=ziUfM+x>dyuRSWSJB z|E+QFWkz~gm225GSBJFNi2i1BVP(Dv9SXfe^qKDojSZ3mRx$Ujbc#@g>JT`sAas_P z-|g|Oh^*8Vom%c$cbXT0P$lVg?_h+mTFUACL#rY$J3W=Rm`l6gBR9^TTPDLxVL%a% zJ#7ka?rvm~s_rbfjDTaiAzw}(5ykb(mF~Rzb2xI_9M>%hNBNn0+)o(9wz1vXtUDac z)DMFIVt-I$B&7j(D^>J4>G8@j^Ky5&U8$lbzONFF%g*9*gwZ5m{z1qWQkJtQf}sWk zfWpT+IiL0VW>CY$-J3yKqIS~S(L>aj)1r<%xA?Gr9(ycsL_-qfAgR-0&(A%D)*pbe z(mCr=A16~noF~D9=uw=%>YGM5#iJ!8K?iDOq*=zQV zyV5+-O`{3baKDXtBqi`91v~DI96C=e2YZfIhK01JiJRwVUMksHfLo9P^r6G4#B1Xp z?k{U2mBiKwnZ~MN5yIBY*%$M;ND*&(pI_b55EKEYZt;PY2xX33?&M@E8i?Bt?jGF? zd76NEv6-+YZLV8=wI)Xk_#4_xIJm*9PgUAE{YlE3Ol7@*gK7G7E0efoNKH<(2*_GE z+}eE{z`YR;%}_Fnev5wqJ1A-$L1ydRuGdn{1z(L&J}lSKEECiiv>Y+Q38j7vneA(c z`8OR^bPZV(Y{vXc5)Gy>bwx4|hQ@_qtCo5*2E0@1xNX1WJl+fKE_hz1;L_)1vQ5*j z>fKUTIqcN0St_Vl5PQ0(q11!zJ+s^@L0@^FfVt~jgo!)K%063m9zEo7j1~iO<2cQ_ zMEa*|%7TtLyJ{~-Qo~PjP3q%4z`1M?H4$2J--`d5P)Pl~ks!x=#v2eEBM63eZ zsE`=e$cyhiC5~LWl~L`7#s656QTQY3JotNX zW2?^x@+~1hf97!d>|3w!8=}^5k{^90*s0TZ7+GSu7%uo*j9DIi)A!m(%kvbJkA3*aiSu==REPj@$NGrN4nXzOD8g zqz}rZrSpYhb@+!5J|@ro=V=SdkZwMG0m$(2dgpqU;?0Tl%+GG46o#^CngT8?Fx?F2<;r+H_8YUKZe z^yAa75IseuKYY5@$D6r(AQ zXu#2JrsJb&z`6;5keK}hleWqI5m_T6qPOsCKkq`e(;)W}5;DLlicJr(NppyBrbMAb z5FZW11by0+d7V^*DEGAcr%uob5@w z^{8HJMp1_v*N7jR1AataBo3deGDFBNeey03LdZ)yl-MKe<4@$ND(lB|)$e}pp7!zK z%6Rj+kk;~+$*RPHTB8iLf{3QzEowDmfimHk29I9A&d^J!xJE);oPYBW>IJ*3w9|B` zMU>UTql17|M{J|f{~vpA9@SK~uKil&R!R}DN))8kvOz>T>D!b=DJq?c^u0*miGe@} zBsL|KC}638(nUo2CiGn(5ow}8K%@x}2n7)$gb+hWLI_Fj3b^+oV76J58U{VXxs09AH2}1bHmQWj~nM}hZ5W}0&R?SqEc(W6? zX{d9v0)lV~EHeHhE%ZMp+F-8^55Rapk9{Bu`J?Y7a4aQB!Rdth>qv$-$h3*80 zOf@l35FbJebDXkekfKS5>>a4v9%VBhsI~fTW~srv+-TCdLf?QB)@n*PP%&YzqQ;U0})`P^jW2l&nec{0Ac zN$c=Sa4RIE!kgA#0lCv94!J~=7-f^?pd4n#&Oy;w9ww;-0C|nra6HIWS+)`FX!&LIacWW|1FJ zo}%x>cPDzfq8e?P(cy@SmN~Oi^$!PHl`T0`CwEkw`#c>s%bQutU4*C)LyQ}EpW^Vm zQ;J?peyLJ~FVe3&WHL6suyYUS0<9QHFM ztqi5>D&TC`uLmhk%ASreT0Q%HAjy$0J84!?krP2X7vY7wIz3R)i+MB~P~Kxi*~<$< zXpB-latJKb-M47ezLCKKerva%74^h}kdGC7^JJW>0Bk{S3vp$;Wu~_9?^7W}4ZD!I zj~;(kg;5#OK(C`CF$~4$o|p$Ox4ECU+HnP=U%C6XLN3ay2$et}M$}N;9T={S%UFAK z#DrzO&7rYUY5|`WAjE&Ft)w;HQrNZqb-p2-Ty-k~W@u;Snv~2c>^Xc`j(CdHR4YJ+ zK;?4@}MY3n3 z<4gp#_5qEMTKH!3Rx2^`4cLwsI(@;V&tka<9AsKw<(nj1l+7cX5zY z0-YHxdvHBLIR;n~%`_V)=8(?>({;AIP)xwIIUx8!I-zG)%2wM$fbmVHI-vX#+A9)t z>DaG4FXT+1#bUFuC%qT>Xr^<_H*|`5En73th#rm`ug6v)tvJ}CTVZ=Cf2N`#@wxON z<;nVI>@YFWaLXD4sH-tuP^dI2q>tM7z(OoE(B#^hxnxGT%GC`q!rIPMZjHA-g}8#gVm}qo z#BaJxxEY9*pH8hSBeKd#1r`|g!*}|VQ|0ayaM%jerH!-GMN@SJ%WID~MMt@KaZ1J# z`v@&u!(_r61gB!yJe%&)G}z!9QVeZhppM?&r>N&a>8%;Vs(B!i#P`nRXZUJ((&rl0 zjFo+vdJ+FN!o*F<=c(L#4)Ib`w2LM_2-BNp&P9$4G>|)&lA|zqUf_&v@^E&li3!$q z@Kur6Kw*eup3{`w1{h6!QWRq%NQBpqF8G#TB&eAr7E#CJ2aP?RSu?kL3@>8*G`5tTSM$F0$RmKt;lD?bmVy_qLY z_sz8iy}ZrS*lpS!6WRzO6wThNBWq%P>xgEjSIXnm<*?_1rdKFVqiwmb&FNR!+>eHF zXp6ms(pZ~bf=a1U00lNiFp?Q8rBXuC2||cdIz5^z+sgNEYW%aOaky=z^Ho4H#fvKu zJoRV^PDKKpmeILsO?+sKVNVf1TIfD)%ZSZN)1>iy#gyG?4qnf~3Yca~V;HN;gspBR z*$O3b{cN2yKbbPYH{C$c%5f7LubLqEve78b%S4bV zwPt+9lv>MF^`i6u>x?vtR$ia`F8bo|BU*(aecI&BD_>qbZyx3~V>hf=RYnD_m% zu7&>DBXcFJp-p(a(jG0=O*LM4a$l`aAJl9YR?dxcy2)Jiv!Z-jbVe&%dI5@6_~c~d zp_NN;g+>1B2JSq2lzv2BX zZ57W|Gb!fv;uE4*Y{x5vNXU@CSKnSLoo#mC z*{t$Lhd;!WmXzUs6(c`gNYyzmY~Cu$-5CV{YI?Om0nc0k>3y%(6F3&^v@4QZ{W=s= zP`Q?E-?oxCx0R52pZ|M9)c8~A0+mpV5S|^nwR=^tra8ZmnLkTbqL!gOIK`wra@dajy`eYS%zSVZ_`pm=tIdaVy$EflETAuD8o$ zHp1Mi@hX!fvMoWQp_hZ1gh8o5ftCy04y(<6S1YO)08DlOrTLxJ%3Rw+|31n+kgl2z8v};==&gg4BHZ3x7so$Srk~o zKaFtdpH+X>CW~b|b+7HT-*MYP!I+j)^jC%4FAck20MWK=Y~Fs|K^$^Tww@0e{j1dI zxSAvSNwK}d&Y}+Xc<5Su`GcD&cN)fyRmuH6Hjqz@bSiI+NBdp-;vk-#H5lpLE{Tw@ z!`yb9H$^y25YDlvxs4Ns!k+e$M4w8tz+oeUdqZg0#-=oWDrZKUdf5; zZXexR6y(VZ8R8oM^O{lS6#S;*6VPd68=P;cZCd77yrXV-&33dcUhnN`wnq7b%MC|r z6c(wR8C?_N#COB?H@mQL1H8ubVN{@eVWQu|k7z1*Ql7h`IaF5o`my;?E**C4ikc@X3foI8WnEh)!FNMaCX=A0#$M>L z=;S_qq(vA|BFXoNo(u?!qj`=@T1~mS$4Z?6xj-dR$zZg6C-=6062Hi-LXS>(AM9Q3K4wbA=4gl0rg0HhXW3yTe} z%9`=v=^3aztC^!-Ay*vtZ5WF^Z3uB7U1);2D(-G%wnUkaO&TvMjgHZxup7n{R~B6^ zI^2qe@+cEs@gaIxgU3i>0}UoisLzEEsv7xGwhh9f`CdXRt2qnhLkY<$<8e;Y)N(C( zA^*J8m!`WM^E7@XBwPjnJa+96O^$$8IbjRBhxVV`%9DoLcMEl)%i+euLJ)aD=PctRLeuFU;g^+_WPk9;>*5s=8+Jzq8Jq9 zoMYCQtY>{=Zg8_b5e~j%FVS4a+*mO)s16P_*=19QS!IOsa)Gtt4+paWssJ`){(ZqJ z_t0SFp~qtj2b=732%-B3XgAS%Sqs5*E*@g;gzx{rCJOVN4fd*HFf$-)0CWvH1NN#Gown7xM zA#kle6k$`&3y)Dx=G3~$|NCW4wQ!`j{Lk9USYLb9(U#=90qDVhiJTT!MGLwKx=d@}12;KgOzs zj%jiquIL>8^mit;x8eU6^2h%^thVD$5z_+Kv%4;@AB2)yF%PtEgC&WR?{4aB<>+sh zLc8waDG`PmlH38!xx!7IeGLZmyn~jsHlGSC`}Y^lrBb0HCL!MCFd#lj(8xKAPL)@N zP30g~zIAf#_^5TWW1*0UQ4xRUO8wegaaMR2mG%e_gB<3+2k(wp!4xKJ5m;8nv*)BD zD9pp{d96nL!TK3kfQ)gr57$EVog58t2|CibFV+{b?2%YmXoB}3(CB1(Sx^b z{nVq5`68npxH3vG0Bd7_9;$B3%$k zD(6yK0Rcf@W|w9v(O5rjX8na>Q0MsT{apZnBEH>BGfM`CcwHMhZ#aWxUW&9}Y|}k< zT&T%cPHwbFtG{uv?sEkm(2Nh0>y?*(Bvu$`oUFk5EyplxW0!g80HliT6>4(_oNTwey!C*m(WJ9Bf3DK1pNrZGWmJM9HPnm8!#OIlOBF*7`B8GJ{|P_t6BFuA0}%|5}lfY9y#yT5fBi@Fbg0i%6<|0)j800oM(>$&5&j zNC?Eo{nE1jIa-bQ@`{&1f*`xSDjDR5Ox}bS z7wU=j28$ryF5=hHMjp+5OcAR0C>Y|t4s1Vq!9FK;XCJun>}5>1vf!3g4*Q{AZFOM5 z8RxhoRTDA4&NJ77HJj%RaQz4`9r0W^XVQy2K}Q(t=V^&hq{L8{QrrSR61Rx%@~0DP zhlm>CY03j_CssT*E(0)3skx6IgpN{$$+-IF+HlCehP+s=_9lOz7-y%HkgpU!YEf(| zYeh9@Pl6e52~EKYpktI4lN)UF?2*p-2zBSY!IH$sAp;e=6IK7RwNOdpqOxo4tN_hl zBnr$-b2&DabuGb?Qt8E=xzV3#f2aBQ!mog8lZ$6$Z0Z~f=|DIog@`07>CuIuD`qYd`XL<6hWm)Am7H~(X#b)~rLz24d6@{W zi7^5>3FRp_j8i^DP!~Yv1uHUj8GJ)Y1l`h#_WI}yr6W^x06RtnL^pq=r43@0p(d)0 z6W6=RW&D=UzkHG zO?S|hLLo~vEenTq$f;{bLxzXv9_tiS%nT5U6!^_)L$-+uZcN?*7Tp+33aDD+muL(x zDpu3(0qjKlQgyS}x9-0kFfEQkctsXG%s#qlVN2H@St7DnPi&#s2&{7B3*G+E%YhhiCj&h(^7 z*>S+Z@mxZXKgYXn*hF8x{T}@x7__QcGj9nJ@w;y8&sSOCx>~6StsaHjFm{Urz^e00 z*I$p&29Bn+nFF{Ri#mepSyW-fwvIJ-c&}0UTNJA0&zzoCp8Jzs z#*5Q0v4$&i?Do%D_wddFs$oF6-V*(cwaosXuG#cu(F&!%89{ddHs>1^7*?Fk;Yy9q(AZHYIpfu+fLyipny3j0!uHi<~N)k9(yPu znRg&lc^#X1uf{3D{AWO5q3RYO!n5PBP$yN{`v*VG!nULZJE~h{H@v|O+l@b6B3bfU z!0+zPKHo|`-g+wI%b6kM{z2qH5w=)gdPT9A{#4>TnyQzZc=W;1liyG{j^KNEc#BHa zlyBb#Y(Gc@Pk*4MoJv@2*?t$^e*Nixy>aa9lDbE$?n*N`^@SM>k^_+MBc~#9-H#9J zjGVr{m{$nPT=8kmT+G|%@swu*^m2ruuuvAUX`#LFRqVOz?By`khSGz7zC)FxFvhk< z^Uq%xM0lQYtv}@nollRY9G` zO%kQgmh|U5@VZOW}PRzGzNJDympDBJ57vA8*bn3eYk)Ht{~*D^u7lNgX~nl z8dGw>bBo2ufnw>3-lLSg3cNw3O|Z3aR$0_TJ?CMmQQ|e@Q20r^*w>EoWT5cmG&u@2 zY_?Ta+;PF6`2(oxj}~4JI;L66cqMYSe>{3>{Y5kT_X>8i5i$?Wd!@~S z?%Z>FSN5?21g+GEy*yD9IP`jRSSx6cw*5F48QH76nr3!mLrUn3gikqn|}6$ z*C^bm`s}Tf3w}EJOYj!C0T>9K;QRO!0lD&-^9b8MTX){q4T`jFs?lfm=I~ZuoO(xq z$~`LB@aT9&;_C)-iH#l3O%gPG+r*LMvUJJSe9&Ry=?SYjPz=dP zDfSgi-nsdf&+=NSB6;g!t|wsGBe#GTF{PiUM{U=ak%!mJ+R6qA+zmqZLc*EV1Ej<;`4O?t^513ho6V{EM z@bX@V>&J2JsO6ATldpSg=asS=p6C!F-5&gM_JhTTxIlmirc~z7GyF|#g7&>(Sy=}g4@nUoe>3N~IuK1Dcd-&dZ#iod9 zNAwjv8#PW(g=(Igk*UqOFuff%eQm`vousPdYt1cWNg{4@X7eQSTKcbe-F8sE|0iI; zw9Z-#Ei5QLkx+A!f2zMLyCL6Sz5&)Q77!+=-ktLRtn@HHFa$|8)6Tw+&&Ut3mm0)& zrAaE~c>`G6?Rc=kvaL2UXcw!~ZVT1EQXyeRoC4$?)hAFsq!y(u~P1ErS-RhyRw z(K?pF&XbFvO<(?oM6{k*cEiyi1cZll3QogE4O|M|S*pIhj2GBN{4E>babq3~w)^mA z1u;ASM5406+(Nq$U>V@WX0^<#~-WfMc^YA)nH^)F4Xb#u9uh0 z`mKEeNY8Y<{F`TLUJe*t3OmxU9mBlW79Rqnj9<=ReCyuG`a>l2WqK-@;U9$VSL20# z=b;FX?|X_^Wylcvc&IB1I_1{cVJk_MM*!t;o;q zZ4c*jLV@YJWNsQ(nM|JvwFWh|4QNdQaIhu9tyAS;)h?yd?isKk$4-3K>^{BWmXkmq zxc-yL?U~B%M$mbdmK77I&_2yB%X)h!_ z?$kR&>#YE4etB7op2e`dm2DoIR@@%_q;p}iQ$w4A{@KQ#X{r*JvhGzini*JrR?O+V zxhvI-6`CXH1oeEjm#KW(ZaBOZ^{!A0U%r9mtTY_`tZT5ePXXSWw_6>DczV z(@8Ju(^rC8n--O*rP~eRIXv2A$8a15^krzxU>E_q{jqr zzt>B?@9*Im00;|UCbTJCRBiYMA}i~k$d zlK;V1M|`=DH#pQih^YwyOd3?%tgruI}$K7a$?um zD+n*LBY&9Qau|b1!uCycI7xJCgCa@AH|jhFQ%z<*sC>&wPwCfpEQo{2T{c2Jah+nC zh}YUmCHFkCdwdL(;Od^CS^LgWYutT(+O8X-oHxW_Oo6TA<2OaU)j}g+1Fz!Qt0MK_ zpp<@Qw?`62v&S~~M^L;Taw|330kp*K2g)XMJqa@h52(l4W(v znH4i$9pi%pu-C4rTWJj91#P@*jv{hy4hQQkJR#QUxt_rq*-rk|UIRFHSZ*$gJar;R zK?DzZoiPPB7h!KRyY4yrL;U#9>YjWR71cu6Feg93 znj!eZr`VNltfN!#>VN~X{0wu^kZZR%yw&yJEour1jH<2xDl{r#htUHY=S?BP6acd; zyzUZ!?1c<(K8WNxr6n^Fyg3t-VsWhlum1DMM?P1xc0Pew!Wwt8#g_IQN^(G z^~iu{h%^Yg_5k2V==f3&MD!g361^s+L-KYno;)Z9K zB~&A|cRpbJVm=Sp7s;^yynY{lZQKax2_%P)g{@Du#RT$S)KQ(q9ROE8yd5STpBn#s z#Qb=W_|!MtU$XzJnYouyDN=_-W*o!Mpi`EkFYRBH+a-#{mfdeAD4QwfL-Gk zpUU4@X#g`@wNeG+*q$u6{>LV@g{?rwGwTHDmB0KhL~DR`l| zmVk|2L$BHOkVEmBq9OudBsBOTHJ=7OgE*$d>mUK0?B=BC?fv_X@)t+<=^rDt(yGVd zbL-2~&yc1|o6VnFTO!HbDm|H?=o@->T z>7*M8!U0@Q1IVnQJ|*MHEiO5-?@uDGXrj8}z>Uq%K{cI+W4f)l%g(oa6sozfIw)XI zpoV{)|nV0T+8l$Yc@{qow zYoy!@5j7grL~`v%jS8ubMk{7T*1cnP1Q^;kA{o?{tG>Mz-%;@HiCFf&PxI&ta^G`G zc&p#|zQ5#pgZ+4YV8;8l2*4uaaSC>VT6QXGTS~KI2LL}wuP}bIEPB{vx++z5ABy|2Oh={(qkt{3q~3Z33}u z!1O}o6ga-pNlydXB1%SpDTfr}@Z9Btjko-ljl<(Z0n*Jf`DvX#YT38gQ1IvSvF$0V zmIFA{+;>xkk;4f5yZ#^^a?47hnK5^O{N4@;GWR8D#gVws-K2OB9UoX3iU<-Qy*7h#8au`6 zd~=$kY3pivt>#-?mmywH(?A~wJ8`LwTyOV=n}n0#Bk5&PP}{F4Ei*)828dD zqX(=hXlT7Qy&d0O?b(l9#62JTaXb#_NE(BbO8OTgswe2+@{(}yuc7OsxlIH&NCNd}V}_K5Ahr54cKeaBVf;ey+8W*Azn+^4$qXZJA#y4_!W~ ze%A+My;qo#gLd)r9Omg{H(uSV&xER)hF0BvF|G<=5ac%45w~K2#3eL>{D#vAj zHC2Qw)cpJ`OG0-un>lf&t$f$rmq?}Othb@^p$lgE!l0h8nzfe{E7q#~#9Y|-z3dDS zYdBPvI9Xj8qnI_OwuW(sJ17W94HvY=H=`j5!0aBUV*(?A zKdO8#br_@obbQ-R{b{#daJ@5B1eEl<+?o^*5$&w$(5bWLP@w`>Pnq; zBYf4QhZ#ba)?Pp<7L2d7fSwLzH3aS7+Ye>nt3cQYI{$ZduY=T z4+HMu662YrR|&SW4%FcvZAh}Yv2+qTxV<6WAzQd{F!Utdbal&5LxjVU++*Uyx4F@m zpi#;GN#VD3&cbv+*LQB#fV-n0H!URu5f>aJKkr?4W~zy2!gsU-|F#TTr)R0 z1RPfahQ*ey3Z^O=ps$FCiW&du#Ndd@PdwA@?9p3#DW>|8lpi@~Cn{qSu%A>`&WmfXO}W3)ukx)5eG15h4$gNDry@5?#}TAD?r+<_B`RWX|Lebx zM)zO(#0UVI5aQdDaj13KGe4Pw1OJd-j41s3Gvdm*|K> zMVbi2hFEcde|rWy93abvtE!>!5kw zK6pWyF$iS7hqWoW3*M1i+_zftK=7wThBD7;&E`YzG z$(_RN(U&)F%FXAzCE&V6nQ!)R639at=fp;PvGdDx5kIuw4qzIs9I~9w9CZJ&5J;I* zalrAMe)$YM#5OtGZuwGtD zpFi2vRTM~KeZAUM)>+8)TDHV`J{d(Oo;$~l`xk)rK3<-lop+!eoRb@E>`4xmN}eet^=MW@j(XQWe4Y7VA$ z_Ea7upYF>rj{4T5UenV^=~A5deG)pDD$1Q9;be%RYWVv>bd8X5V_*d#Lnr0$->;6< z@UPI*H@|(AIbfMz6;?dgLZuQSM64wNGY=mSg~inTReLRalC~7=)(o7UOftBGH2^;0_(yZcS3+*x+w+pRRXDy5WFzC)D>-V$JzVynY{XZnp|w zfARte+PuN7(?}BuF^p29=XUCZKgv|v1mq;UzBqMnPByC1ma`H-IlBrM<8p5Go2UB$ zjvN@JGz3Sd#%7FsJ9oT!?3fW+&=8`PKP3qk!2)lmnso26;e4TmaNc9mw%BDYlSRe2 zAkcV0EAoE=$kEo=GUl;{d+ozGL@f zsFe1F{#_HVyZKn~D5aLQWVT?utFho}Q)Auc!V8y|nUg(qK(lJfG(*ss zQ6AR-<{^hgET)H+5RX;G{#W@^(i)CxV5lQjw0dtj< zmB+*8H5VR>IFp+_wXyuC?Wc(^wj@Zg0xotTWaKk(6P3L>cz)Y0QWm@xHc=d$owq-` zzfJ8B2#j#Ai`Z)wLh<}TpE>(l9_KP`NkeZ(i;tlfXKD@uz<@f=#Bp)`li}@N@gW_n z@fY+y2L66%{?!|gulD<%hx2=dhkP-nDxS$F02msl`=}SuKv_^bIb1XRF=JFIlM7)g zJ?ZvC@5=5&ZUi0L+@u9)gdI+9Z1a3}=1Ii^Yv?N&doI+m4=U62jPrdZOUveH=-%Ac zwmERr;s_+%wB(lAvn4$b;k_tjw8u>Ft&Df?vh(0|#wJetG>Cu~UKWz|v4XW)8D1yn z=_#+0rruOs?}_$tp&Lh8Z;~ODu87q^^;O>z&aVR?LR0&e7j(!x5^zb}bq8$j)_h?e zGIix8hL5%yu45Z4Qb*ZN!AGc!kT?nNg07?WD;-Z>yEQ*s)QqH;0r8ep@aW^#~8FJ11qDSqEDW)acwX#`S6D2cQSb`a;bddvX3`-D>j4t+}Y zHRP8Lf6_5+@t+Vezb847)cBkeeUB4^C;Cb3e&h!};f)dD|S=4E5Z-K3H2QNSmv zj9Yseg2WF#GNT&rj#rEe9ZTG-*lo5gh3S|6$p~Tl~wYSpY?K|}l z$j`g$g3YY5_Z=Vahehbel{&69;rz2ayQpH0A0Vjkw>V>P9XQm&g6nSp z18DBPmZcNX7w3sOM1Qtj^x7Q;R7T|kx*AmmQlWr>wP*b2CcxIs{;jqiW|OL0m$sv< z6Y!SE54=V@*a(PhT$Ri8B5*qm#A#MD9)S?wB_gpcVAUZy}U0wf@dw#Q-0p+!&PmYc`_dV`*8ktz3qfU8|- zr7h<}TSl=5-!=KA&kNK6{;P>UiR*kQ5d_qC4Nq?9A{QA%+|{P*{!##2 zrBj>EKy(9}wA6^}Z1ghb(cBaKSVbsW6)22vxVB?VBO(BRP9{a8w+NusxG?a_4l^dM z;$AUr%MYDbGnd{x1;~It1sunLm?i)f`0oRKb8k$M{>@cj?vndrQuG?98*e9=JRod8 zVGb66QfQ@31Xa1gZz#8LhXZ8K8$#&df({Q@a!GBx$LqbgvA(g~YC%Q~wSrs7u_{u^ zDOB>Cc!E0M`mXm77pWo^?@Xbd)0R0W$^Fs}JvUfiIZte?^CVY$#ZPtOkB zqtA>9X(Vq@Kt4SVKUiO1{&FdyEc$V$5#4z3Yu604X!n7 ze6n3dmpP>fl)PikRA9r{W(fzvwZD$M^zcg%zmjugze4Nl7tmYZxJ=f>S|k#h-CJ6p zJLLO@xaDNLL(5pg4S<6RHY;T&rI`PP_%acpop49aTSV895fFD`vkX zJ4(nD$&T*l({uyBean?oyR$!(DTPbA0LBY$xxgqh2Ff;-x{m6~CGDqOUvz&KMYori z4IDHHE4KbNT8Y1ct6x_10`~-15#UC*H3hS?%{Pi8MYcuCAq$H8ePeiV(-(;4T|s}~ zAx8(UjA%#|eWl~qxd*YDgS;WHIj)mua)DGk)->VwGX09c;GH{Z&{ENL#nHBpk*@^F z0N#SZ%|?L8dwHVHcj)zbZn4j&pMEQRy96RX2YptCbpg{+6Lv>OI{jTK#S5x7H!st7 zZsf9L@h2mdQi(T>TKgw$?>FjHe;b>qG1YNv$L?ETpgKHk2Qm|>)0UEa z-sryyl|r2l=%JW5+loAx(v9`2%53qQOHUB*i&65~p3V|i6WwQXRFJJD-@Y}I4l~8@ zqX2vH!H_-08Qt_%@&{9HsPBYN$u}j(zTX=QXvgn=o7G`1@t|B z^bhh7R$j~_akG`Gv;!w;V_y=SzT|SIphVs8D}G$9Iwn&uaVzn4@a%QH_|yB;T=y2| zJru$l6g(S#cd>B)rc09jA*}cu@v!r^DKe%4T?u^|d}#V!1E+RCodb;#sdFrf$99~4 z-~gy|NC)qg{dxB6?DctO?gO9mk7ln&#)VC1ctS1Q%73dar9E!_$Dla@PNKYJaJhAJ zOR~iI?Ch9d^mPNnoQI@sM-#=vMpjs!u?^f#xod!u>UiRT%7iLTQHW%*Yoe4*`y*at2CiHWF?1-EzHox|%jsQ?(1^D9 zm$PuY8{gDZyMHAHeS{=}Ot(%w?u?!X3gI>R6w-4()Il3~ zT)&B0K9HUnY-YVHJ+6GC-myF8lzx%2n`eM5ElS`UW|4ESvT^o$;kEVaD?v^YCBcb0 zFD`EjO8`CG&isE{2dFf0jZ8-i7YSrQ1{Ns4 z@VMwQ<;8&BC60N+-HwkCx%zJl>8Ur~b+W-Hhl^-G0qd?Ef3W--O0=-pN0bAjqmc(U zj{feLM2%6_&a$ZR2A|)C&FnbvYO|I4+_T$Mh#k&X7u#QUU(vaQ@Py5MULKS(Z`K-f z3AoIrICMM#mJmR%NzMTeJaqDeo

dS($xG3<(@ccUjB{Zl`@}w*~Ysyo3Mlu5Mj4 z(*vw0LIHl>1j1>Tg;MCrAmHHau%`jovz!=>6!8rE-xP=^>Q4(Ea-SquP9x2M*cXF3(Y0?<5Op(`y?FQq5@h`M3Dt}F1acPZN zR4RfQUCV#oShqyz4gR+5emVP(qpr8ff492)A9>1uAW!+1L#W5qP8rw(F&b`4V9!`J zCBS$jRt0JP)4=*7*hQiVi(x_9DC0@1c0UecHXTLQN-rQQ1&kG6rN@;6n-)3OxPamU zyI>^>x97_{nfLFCMAL77fO0Ei=G^QsN>rg>{&M>@A-zhfT@EW`x^b^{hWPz08;e+N zkmaN#&ApM&=$bo$NHG`|YQxq?#{<|07$SEtcQavOs1fk7-mEyd))i59B>Pmrp|=>Xz~Gi?ce{gt*Tl2h2Es66<|ALsLiTG16>}5^pBA}5Gk;n34Ig&CxJGswWWfpq&C<~pJ!T37v@3X9Lwdlvdf!iMv z{$?-jXh?v6=IIh4I$v9&prz#Ox$&{?j{Ig<=TeGk%*--|771pNdrdMlXwV&bhIIRy ziK+lx?y+%D{6*A+$Y7(Hu~VQVabbf5pZBHuakgub=cRBV+_pFC?Si)_(cNprM_``T zJ<8QJk#xQ^Tj3DMb!>xJTl;uDCYbxQnX^3D15t(}AoP<}?Y7qIC?iI3Jo^fax3O45 zQ;|#&Pr4zdRyti#aGW?NE z8+ayTa&?xkEP0HDu)dat7jk|SzX2FV`OW$p%v321?jdM?00BAP+oh0b7%&w8M7Sua z6DT*aG`~=1znVqPE4lTEv zW%SBj(x9dDE_hvlZY_&(a&Y31C>TvT!L`A(9gS`U{>-mYqUf1bf_U9Ss7x=JnLcXk zTSirncO7@2?(>=^K>sO{D(;ODqaQ=W4A`u8i4XSGfs8C90T_3n!i%q;+%3$7eBS&h zb|90O1i#EC3V(g+9CT|~`Mc2#-hA>oi_go&(MLu~Iu_=X7qytp)RkuwIstvdQlz5= zs8*C4LhDIy9d4rK4_!OTh@j7qEzC#ehL`q2JcqK-Q~qk$YL zxqrgnkW+9*M7>*l92q0-S_BWIX%wQbix;@mH*qZ?#L6P2~PM zdg)oVBJ*zj`(qUNuY!epmUAk+L&7h^wKD>z_n(g+fwPLwMtyv>SK$2aOOiKp+D-DA z9rElYPp#pU!=X#ez_*;dCnWAdeV!?0XPnQ}TC9-sVI1yKq$CXDzWe=_?02uuqD|QE zv8HvuX(0R_ECO>lt0b+^=loAX0suE}xn~;#=J-<9FW-br61BmXvFHQ%Sp8oEJiLR^qlb#d*#4}uI@%e>Sac_Jy zVJcLm@|eQU%dSx+8_yXV4R5GkPZnjARg&Q5!4YjzY47J!V>`wdWQGa1%ecj$R@K;@ z#30n3U3EOHHvHh{!xrp^AmN&4-d!O>qT8kYmq`eMq4z%4;XK8f;4qEP_tf{Yd{^LKc2E#V1B?C>M_yYv z@+WMAT9|F0THbiRgt30Edtu=v#Zf};KKFskAcF+9;ffmwD`LCfkbd27RwIZ`t7s|n zFR_Q&-m9N`Q#WacJgr)9!7UR4I4P~3Z^HJaXnLT`FxM&>(ROBLvG{D-f{qD=TC;+UsbO`7KP20xQ!~17&V@a+#gc6XC==LXrE6b64(|l!sBj zu>tmUrg<(#&fG;%Jji#2M^#{yh(fRHBWGdC1{mp)onPAUVYIWcV{WVMp!zQCi)9_A z`pdfbg2(R7);(B^D`_JZW{Q~k!VJi;6s}OukFG!Zuw;Xte~WYxZux8Nc=cVR@Kqc9 z2Ypt`%AlhD&v1w39)fZv)sl1~0T) ze|1XU>N8F3!iSeUiDZkkD~cxHb3VCcV^o|>H=UpnqsA^9Zy!V^e2`dZ%bx4l|2Cd8 zK9kE7=T3`Jt)g?kz7oJ+eO9f%iuymOd(W_@wy$3lE208h5fLe|f(VH8POzX`sS1eH z;HF6p(g`F{QBi3sO$ZQ*bOEK;WMiR+&_f6zA~l2#38bH({@?dK_j%5J&WHQuejsFJ ztu@P-W6n9on7=W`LI{`O%&w|NALm!^qyzvXIqhrS8bIac{IC{UgUvT;REdd>TR<| z&sIKQ^gW#TQ3Qmaj{$~RI&FV%SgQ@(vXz=ET4FB2OISZpVl#2)E4uPO$p zW>n{h7tB#SPsqtekty<7A)s+Dnp?5Hya7y%;RZW1jv)l#Kxh{=AQg{|5gxqaaCuZ= zp^nzKZ7U+_o#U}9*p6+ub;TW&gaVG;g+#U9?p+%p^higGNDqlMOiSuS zvW)w+S8c*0zwPQ@>j^I_1$k>OBk<6W*Sv^sDstv^KQ)z|vqJ1y8a@goV{ zMDLLsgl$lNv;1`JNN}b5HAH#0d)B{J6}c_&5g$5rdvZjJ<;a3~YJMBSA)G(i-U1$9 zjD`#ZprL3POhV%B6?)BM(SG`lM0Yj!GD-(&SvYBUXY+Z6cu-}F$j7=FK0nr^f z*U;W$$&y^S%)xbobGa27 zB<51R;GQ0>*BEhe#XwKSklN$Q1_OH*0Z}cpAwZM&`S1 zn9)1C`;}xWVCTT#(c@SfB)U#{PB^~tA$d##U$4l%`I#H@D!nj;Y+j;Ig05au{bhwV zbos%#GDi*k)L{M7Pl;;TfIGNgfq}K;tv^a^?2l*`66_wC3?xXQc|8q(6T`3q20e`)oQuq5cj9qxv<6Yu<}fQ`<78KAxfxSc z09FBY#K!2W=`j>!M->(|zXNGTE*N)4(PmKDdgb`q3X&Z3DXm#YeNw?CJ`Spok^odo z2gie&;ZeblQ^M#s*ORZ%TW>!!nfJAGIioG~2tBV%)_YsOeu=*PZ^p{MfX!{eh6$@iLmBWaVRvli_Yp)lDmPN6^Gnc2pX^ z5-FY#RRMQ0qO{1Ycg?+%9q)SnZnoevkR*`V#gB-XfSbVRQ5)0ME(wY)=@s&=1z8^G z{T5<{!cO&LdZ&Y*k2e{^Kh(W-R1$dflv$M2^rURN`#rgj)(dxc^0zl)eguE9CsetP z9o0Gx5qGSU3P=gtl}k+d3A5bYZV>v>c7kbC08*W5_~KmkNvT^B?M&J~@@Vg@M*@6ldMJ@_5ae~)LzCzD$zI*H&;Hk30u{F> zdES*JxiEz>VNnir3!c7e1J)HRVc9fIC~>72dy>N}Qlh9c5EF?RNsc z+_`3gc&98j;kTxJ1eJ13D&~haId19ansr-m==55Q6*K5W5oMi_<#eqZEZ^jdMjoPE zo;ox1qMo#8E>+Pow1IJkqeEPdGL-0cvT3H+hxqL0z@<+N^1asI91Ed$eWl!pH$$?X_>hM0Fuq@Be}p~IUasA8v#d6O zTfoWT^JObtKaXGi1vN69n%tT5=AS&P;acWszeim89?DV|@l-bD99{Y~1| zX8W3m+5!&@ok<-j8&e1Ey9#R#8?j&0A1X6N%(9*_RYZO1)c>3IqI?z83M%}{?WR|sRX6C(s$3}B8W zC+9Y<&9(Qst#@JL6SmHa%Notyc@utn^^nNN!o6F7v%=@il@THPKybTSfc$7e82ymj zSXEs|-<1iG*xStB0r_i*8ah3el_3(FpUtuqaGPPk>o-vEn|E*dh_9IhM(Rz!;ziA$ z1lO%*9MB84nPrXOs#ir2ohRg_L86!2Z|b++Up{FEv&Z|UqF)dw#~cB9_$M3P$4i<% zpX_N%!RLc8W?7?Z!Q0T|AXyd{*-jlbFWh~>qYYWt^?9r8QgZl;Um|>aX1u89 z6_?q`9pDl@eyRqnZ;H)~?88)+wrs()M=SHLnYB#q(VpwgU*Bjbdvpi5qY5>1R$J3E zRi@`wI^-2|;Lmpb`jd!6qh`tOUr!NR)7x}L@z6Lh8maKQ?r`c z{|e8%j!ykfNv5qGUD4HW^J6(iEi?_Zq3hKctn@HuuONAVgL#8PBIQ(pqi2*H+4Q0W zb46%H5o4lRq9R;t0wh&%IK`z6^VWvT@Cc_hR&=4ch!Rx~BxXxY$YB0s#>!|lIDYQA zP=OyMLKMJUsr%^?zV=|DiNwQIm3X^L^LF%;-_gY#d#MJuo%>qX=+Y zlZK(#4c9KMWE(T(^p-PdsfSLP%$K8-9PreH)cgidz+v(-+n_<5%CPcrolU?vz19#IuR}JJ zA61wTHbr{hl;pT=)wBebC!m$?W!?lB05z6*0+XkcTQg|A{qPa!N9xvzg_We18z}mB zY%=HNX>#7%{)V#nS7Yr14R7j*Ds$Hhv0zFBm>TM1kVAL?<@d&C^Bh*}xJT(^sQGs; zFic0Mb|E6jxV^kby_!{9$;GZ#T>BpEqtI;dqSw~Gc3FjLq%wCklzGZu(4X-yqt})# zg;-$FzCYv~d6Zqw<8SqgB0eQs+eu#2;2JLClA|0;6;^ zqwQxJO5;Z=N@Hi?Ye`1}x^p)xs;y52RE8(dh~_Y-E3e(t&5P-kM-{yO#;-y~L_OOa+8M6Ro z3pHF1%5P|B#`WE*ye|c(z8(q`dK+Z|gsvqWnwI6sWk1GF8w2XAs}rJx46HA`F9YR_ z8Gt|1rN7K?fQgsT^v+xTSel?`3%q2amEZ9~okE*$m*HXD<<=j>S3xj9JrNFB1-ES_p=PCT6|`2obgxEQ@~c5s$$CV4i& zyvE7WzM7aDn0sih4q_c@htxq=B!U!8xpTI#NW4=DC=<@}z9-F(N^_SaGF?(51mmnK z6}epTnTp9@f|VIR;%zP?>EDLF7K09_Ju0}L>I;mJj6lU^YC`^Tw^Zz21dlZSFNIHG z^4Y_16?T-06m4d+Px*=1d( zc6M3kPXgKPM4+C~nIUi8{uKqvAVzI=dU+~)@l#V={J8-z;6vHo%3x<+-llV6!j8np7af;l_}2t4sUT%j3yJ<|?aSsO2{a7<3+pLAt zFGODy1b1ej{WOrjHjuv2omsaRVL04Z;c4ddpx8q2Br!an#)Cu~i^eobkM zrQe1Bs_EB9iS&QmcX*eNOK$!rV>Rz8d*Q#Fb$M4skpCcnci#K|@oQN)5Zu%csddGV zjyFAa@cGpoiwnR11-xbuZP`LZo8MvI{>_6a+t&o-r~O7zoL&g^py~#JPXCVQlE5ha z?Sg9I1mXyp{-#@2FY7L?P`I{hp7ikzc${zsgbq!MMYP!6gEe>e{8ACKQNO8b2rSu5 ztu!*O>oihL>2C8~niYAQ?@gGFl>>B?#5MhKfEZHx4bzyvnasL7GV%E)O2zXPPbz(2 zaBGKm#MkzNeBU|?Oc^9wI)2Wq;x;j5s z1`c}?o9$5{SQXV|^XD;K>X|=%aK?;%^ zoAz-R+W>|c4Q4u|veq2(b~AOHH#gkf&ofrj@2au_HPlj?%#Z-`+HGTx@G zwWZL63}Bg&6UP}rKZiUh2CwWh**j_;ICgq^Ec%9>dHBTXs-C%vC)ks9vYizG`V~E; zVuBNg?wt8rMiGlR!E520c!F(oGo0Myi zbs5KUxG}qZtfVEd$--U1oq5d>pey?0s87gUQY>luB)~~S@E*n8XX}kL8WuXkdO0F~ z8DdqPnE@y45-s8lp76+GlI6WM?(tE3){y4{+v9()lr`pyB|l^i2Kl(+ooy`pTti_88If` zTUD85B5c#9EQ{8jV$2dWpJIB+d26L9maXoqqu<&Wz37uwDVbj+=vh31{I9=hBa3^}1Qh$3$*4?wYF#n0wA8@6EcH zeHf(^(u!?%4!q0Q>mm6vUSNMA) zic)dAEpSx$^>UR!psW!y4@57(Rn^S_uT0nG53oN0EseI|=UWS!^y~DWPy@GWbdust z;qj#FR%qRnAc=IDgxI=bN*}?P@Sq0&5$!ziIiJ2964>_I);#lUryktICSY6%F>ow_ z(DH)g01F>0EORpjCATO`FK<*U;_0-86n)KwOaqx-`mFqkDxS5{wY|Y0#M0EUK*%E^ z8Imhbk1c`8#ZNI{gw3~t{A12-=8*jcJQ<=yIzlH|KqD`>-Rauz&g&$a@Y$Vw4-|v*h(|4VK=Yo?9j5U|XCF03~0igsKGL?|fV|vRH zZU+jBAXlT&6O89fJE@X?STZW?JW4?P9W|Lth|8LhNLK<4RT4ahu`PkC zQSgLLnh||!8DJk8@pd5G>)W75K6G)b;pgTnU6Sv$hkBZid(^)i1>jg4N`a9F>A3ww zlHdK@g~f&7;R?9Bn!zxfI@cT0{3wr7vjs}93DtF4olN-tk_1@R{_7;j3Bl8L#{N1< zxZIu-+79;A2D5_>Z*%<~rg+*+kR5DTQ|V?Dy$A2Gk z(U+jB^qN^Q4%^GX0X?1)sw(&=I9ddys*2mykz>+a)>^80xtQU-2_-kUgRyEIw(L&(t{1A5x2-`nEmvloIIM1=WrT+yQG-@z^mhxO66Kx=W*>T8&R z=a3`0xn6o}f6$BIub2k959wu~UkQD@Hl^js(ycAU=8Tq==jZTxQwaOrQ>0%?O74caea>z zBbKKDTh|M)KXnFWeO^=4GJI1B?y`)=iRfWRg~eg4FOYb<>dWeVN6M`})YBWew5 z=I|WzL;5w#2M|79P^v9i=2Kvmv0^G}Oer$4r>u0lz!{R*E3}qD{fA>(yU3Y0I54gd z`vGbd4m>y1NW^IMP_T>>^hb(E~pt8j-n(&7t9$gQOi!W+~fU&RWz+TEKop z649=X9u5COAOuFn0uOyeCxl=vTjEuL)o3%qBHa&E@cqz~#A{;VOq);GVsy%2WxJNv zCCGeZ`lVE2`CT1!K<^Qc@n>zJr|v&uoV9C*zy9RIEL+-!rX?+gKTBH1W=W%I0c7Rs zc2nor@9m@sKb7NMj(KOaDemp&-=w3{s6m~8_7X+fiQ26^2W~Pcq1O?;2U--y^jI-2 z^3A8GQU1QW7^p(L*(-mHTm|Y{caoE^Bqh)ly*eT69Vt}@`i4U+}nQw&0=UrBg3Q}3T7z&q_{<=Ba?Kexm%z{6cHJ_!q$H;ZO4%?a$0SYpW=-W4F2MqEbz4~WvZe<6S`!1K*C`A0r7!@z=dQ2x; zwQEyp;rJhIEBW+j?7ReoW?DX7wOR8I9uc%0=WJcqWD=i&80wAt{I6-v2dOyzg$G-8J#3{^O)fZ$CU z#YAL!g|Nq=!G2m0&9jHV9W({*=((UK=0lcDvqX2!S~gS0^DDl8R2M_mgh$Xg#mK?n zGLAaMv}qk|yg_`#OB`6=e%obm)8&Vr>4>5)Rvhc%Hj!~;q_&bhxonx&@~%%`rexct z!M}&mUTCpB9>TO&O7tlW#94Xb2&Apy*D2$UDkC+R16@t=!%5-&3`0OpYJ^Mn{La`o}8~>Gj>d;E>Lg+l|Pi*WR#Z-~=-Gn_X_dk@<3rYTW z(7L6h9Ol74#qG?^|94H@`iM`~Ww`w(zM3D6lasrLo=$19 zXGZrn${q76;oY|=Dn4j&=xR>E#a|Pjk8eSwRi@80$HG!H`}nh~rq++`{yL~`{Tq1C zXMsGR@x<@o^YjwFnp6K>!0%TdGp>IU2(r8|WVNqo-+veIr`#dgr>5D6or(+<5Bzrl zzwc%n4Eua)@Soec3ju*?B&wlV{&1wj$kFx!9d{H9lMW z<125~k}jw*2ciLQYXV{pYRdEzc4{#?fi61EYejPT!^|+XDKY3pUV8^bV?lpvWDGz2 zgjY~Cqkjn8qf+7TaN5tD6ikv$q51fDQeBf6>1GfKFlg7})PuiA#(pr7vk>^faz{TuK=wPl3wf@Dh+9BGR|02LF4+ln0RgwyR9Z4N) za-HRG!hA7Y`9+3*Sh=r99~3xtdBIJWb*Pq*#bsoqjgRVo3Q=hL;|_0;=%qTEp;{R< zrHqz5b(6UHF4E`TE{HL&rt@M`V%Fz)jk@cTryxmxJ`g4~u$e{Aa6SN)-}yE6zvx*q zc38s$bQ+|ya9^7LRJ7pk#cN2g3ZMFm$Kv%?idr4MC>oVQaH6 z|HQOCo6S2zVxtV}Pu&@_D-@6J;Aq%LEavPq%cB+{F2EbLvYki%ni4YBS#b6yQmSui%%LOO0rOMEc7nJrFD*P9j#cxbu$ULO10v%$iBow zUp1_QKx4Ws+S<$KH?;dUcG~FJzHLO>A*5?HT1K^Zyj1Oy@Cj}~+Jmzvu99{J-t{tU z*XDB`tgG8GwUZvb1TH_%-_iONoGR9{xIFLm2_HFU8}OyBz)rJ;D#%*2q>P`ssVq7# zD5Ya1&5K+ruI`n@BAdfs7XqN0cdD*?b*CtEk@Of+$A!Ij?INqYAv->)pixyst9 zarQ7hngRzGKp~vB{ONTsGPJH1G`qOV^((W!3d(lnAOXi55yEfb0O~UZ9_q5|N28$C z{MTFSW!NPV$3(xBcFaxd@60-)1aRUe?_j3cYSmny@8SL6lRg1~N1?Jjz8naS1#M>T zj9c4c%x#xS`RAbeeu*9GiSuSoOBq|efjbUQVbg$4W({iwY5IX7R?8{&D2O-tR>cmD z(pt#APcidj8b2b;waj<>M@br?=ooNHmYG$~1kao3BtI0yW#HU;Gql&{UU4}q-1tpg&Gq0yi+#8pX>`FiZkBG-!6;KU zGlH|Sgi)#E1rTGkLh#!RN%7DzU{|4en$AHdE{nE5&fmxTL%5tDhwIiM6n z(XdDh1#6pdw!%s8R)nO_h*?i5)|#<+&R*HW9-r_#po??iLS!?P6>wL~$Jq3pZy!#dnbw)={AKqkHSTl8&Q?$=Ao z?0;tS+3!&$Hi29Vo8)bXwZFqV@4;Jnu!}peDLgzPoSQPZ;qjd!89exPASf&RAL=*W zNkIPB>T7n(dRQNGDO|A%aNFso(x}1-;iZl8)R=f~WOLaSe&j_PCA*UoxZP$zM4kGQ zZ;R>mxI5Gj_g0Guxm?YT8@53dc!&74AZ`g|NfcXJ;nYX)?|r*{LRykv4-Zx8<_n&3 zYnUPd&wd4f6a!IApxeJQG(ZS>gIk1HmS@|$A#*f4Eot_OPE9w!D<@xX+~~M|Q$_di2a`m31T4J@Y$~ zL~=QApHSM_xm0H3-cBXx*P3XXkgU|FY}j9Q(n3eitBxZ?425@A+g}Sy$?SG8jwA9$ z13KmXNz#CG-nMdDdk3%D4Py$YTtjnr&eR3NS-JCLRa{Y(aPMk=rm6}Dw3UL^ofBJc z5*|s-`XNXBvF-;`hkX-OnaK>nZ*YhK^wWE$3ZWss_vI53wn6K~gYeVX3MbjJ zwF;X~LDrTlecRrAYU}4ua#q`d|=V?3QQ?WNU zoQM-LrG;=)j_+!5z!GKchDBa^<3h>ZBC!EdYk`jJkcdB*{`0PF-9klwxWAzqG{+=% zzyE4;7}=@ekzdtE{HI$ZT!wxB2`L3xy&|ws(`l;`E;E}I?D2Io=MEv^O$B#>SOl0z zw1I_0>XpIK9~DMT%C9ZRv@E0!0*FU4ak_3BF}TjYD^a5*3_?`^=b|USwLHU=Oz`VtJ?$aV@Vb^;gOu-vhYXn#b9w?M*Z}T-nb)BE!hDDU- z(wa|zO2-Y)PVPg5Pvt;U9Jmcn0_Lgc)D%I4+ma=Y7YodixnQ8~u=&lO8NKl{gf%D( zuONK>1tf#=knB_V&&|pY%6jNV!^Y9P2*upmR^a)*5!N| z6x-?%S{AXenT?BuVO6=8KEvbBFmyQ6t6bId2T$Xz)?bl{d`ZC0#K)AA(pI{|MSUCN z@rCp0_r~CGE{*$0|{r%sY#C)%`;6qn9;8k&hWUa&Ly_Y@c&w*0tsy`hB9Cwbm?(ra@SRQ^1h-P5-2(9pa12lZi5= z0>#-0U-nGD2 z_|Ng?gC+#cMXG7_rcBz;y?bdGrH#OVrQ5eFeKh`E^ZS8jo#pjnwWxe)xpJv&J+-Mk zWhDbroe{PzmZ76tqqL@1=Ueh@&)%WeB|;h)?FYbJa|z6z@XxdR!u=O2SH%duO{Yw)ya_4wK8F2l~4|T;LOA0S$ zUAu~>r)DMDPQDDxJG{r zW61`P;gaWNCDqUQh1w+usZRZ+C6r_?r>_l|kj*xGzdF$(bU1|zojBZ|`YxC9(xBZS zm~k%L2pfx^D}tlkdqH!J*8cGj+|cIur9j0EC-bG|t73c$4srYly4%XsjShGV8F-Zc zx5#;7N^JQ2j-;Z#ynTr^BR#+C7rQ@T?Vi`6;+RJ8q>*9?&>Cn9dC{e;@pTpt)zr*k zPux>~`&Phz_hf5?Cg3>9mAe+oEwBCv@tvF#k~o4+F>SfmUtVa*Jj!LMH)z9#&n*~T z7>bzBiFRF|?p(uqIUQYSVbcf!lh4K4fLlUr?#d>YKsVptR&gh;e(rnsnurp2Q=d9! zNWE>nCD|DZ&O6D--fk438uyAI8o?%L+t!B;pvsE0A9uHmQ=>4I?dKzWyXLJv(c>r3 z({g23L-fB-T_K$IhE;%Uijf9e?at!h_!!U>!r?0$X3IiyA5szdJzNQz-a4ipegjpn z2K!zK3>glsEWu$p98T3o3)#sP5eqJVg6s<~P1U2NFQ(D5!S=M{^z_ueccJU3N(^>HtQ#i^-#v!1VDt4*yu+Fx> zHirOwCy;}S+}*OH(7cOYi}BjgvdAad#)c{dJpJyMZtM7Udtaa6Z$021&mqXF!N2R; z4&1D0T#=_wjBLNK_VA1RuF2#%6-A+fn>c<={Fjmvfxrtb{Y&Glu?vT8a;gsN{k$p; zfP;y4;asw}Yh^=4epG_7+rR*ImX!Jgu{oPuy)c&QGnHS;|B}JMMC4I5P_POIHkg|+ zF-_?~`MhS#{J?gJq4m`##HcM0c>RNPj)C0JM~|%V8~4iW+zP7W&j>>@-Ak`JKp9)R2 z_4{PIT>otMbu3GHZOc(8!ar>*vsL@aGo6q-q)0GLcdh0TUfy(lgY*mq?=8Q{AJ@9p z7a1K(p8>d%X&QJs1O5w{EU?Rd=2Zn3%>#Y-z0)qOb47uz?)4^;dLs49!C#r!PAEz5 zf*0<2055>-v0){o?&8&k?~?pfHdI#c#I{Sa3K!hBE7l;(OSev#ounJ0xdX}8Gcu!h zc?<$ybP{E=rRQanRna)!avTS0cbL_Aw3?E2?i->0BHMABKtA;5et9PVU6AfwyVru4H)TVsTrfGe~sx#;P z_AJy>Vx$x!)HHo0Et1ZinsBCkLv?s3&QvA}#Ztz=+-tX?PZ?DaTYlPG6|z@7UM0~2Skj)CrE2i6yDT<0}Fdid*5CxuK-u(qvY6L(Ezv6cJo zGm`B<=FR056-Kl0!E)UNVSrN;TOy$CFMTjt)DU^-hO^=%+;G`N&tenVUBG5FAUMRh9}n}N?DUH28{{K)UW7^ zT>3xrG3SWBbMev130=Zv-uPSnHQM36-tCDt^TD~{sd|M#`OmnRax%X#+Ae*uPSuD> z{pBDP@CP$CVp&`Mg{%4TkG@R6d(4}vxQy@M&PItBcEsU4EXwhqbqr0QD10rnTj-*G z8S-`S^B9f|>)f13gu58%=9#ABW*6AHZNQtlJc%SXu=>=FMAD)Vn&n&mwO@U56-??X zeYi{Q*#E(5#<*#3kI0Bz?_4i7=jHgY`+TIIzsO8yRMNkJ4f%&>CLH@e7~>4NcoejW zMaRN5EaP4o7+T|N+nVof`HRzY>AVzU*)OdBz)5)DWyv<)B{mO*B32zY#Ce88-?M)* z8ts@VEOL{zPjIJSCRXFUN)49n9VF(pOG_m#Y*#*@_+kjKduch zilLZekG*dEK5*jW8~TixtLY*S+Pkhr6Lv5?gb`(22SW)UFBRjYjN~i2_uu77KtM4L zwC#fpfs^|;1o-}~<@B9(BP77j=*pO={cn$EGMum3v#MvyHgFx904G0#eSGJ1CSb-I zlA)DB3U=otuqS!HS(N=}XddfO5on)xM-s~3FpvAbNnCci=v`Zl;CVZ{&FOD-)goDH zoN&yKJ#N^>;595?3D5ZZd)zDvVVAv=$5)$1v_>V@MsKRjEn(b+_zdxplivq8i-Buc z`%6s@A=q?L?%`~mKcF9r5t9bk$^(^Us4D*E@p#EozdS+tvIBK!i*L^sMxL_d)}I#A zsK^|=2!y%U@C3a#j!mvqlJHS{t*N;I>!puGpealB@dA%`cbY*|W}exx2nTRf-5am( zd*CvCMRiy{psuXOOiw2rSQ|>Pz@+nFoX|y=z8zDp>$t})y!SkD{Y9Gn$BkC^DJpuI z)VwzOeyCo2K31E-4<#qh5N4XAQ`&iE79NOBR+dyX#6xE-I;}qSVKFo@R<88u%H=m_ zd-gu|`k#&Pp1-VQXvvTnwIWD|xL?RH-YxpnRC84CtAOmV$lDz#Q}G#|-xqZa03GIf zW}k|2RxK4S-(&cMz^erKzNYe+Pf5V?p6;2lVO`8ozP`~A*5Yxz_KcZozONQpjlAvc z250QgUinQ(!_Xeo1(7D6N~#OU12j zRuM1M)Ej(XMxn0YW!p{ow7|VD2lQkYyY0pAjaUSl6)P!j#DM9C2=^xT>-?mXzEArdb`g;3iwI3{&R zO3YV4^*}1DkeNsjJECtee7}EVGqGePY%nE5V*!#?H#TMw&V+{p^60vi*AvuWaZXdu_-cK_JqfD|!L}!Rj3`OFYu zL2QP|tse-Qav#%9b0tM&#q$wQ9rVknyKzIW_KU(kzBq5}>*PvWOmup&74zx7O0tC5 zdpW-0KY2?VU1~)y>Rd@b7(K8$Akg!ZuVb$dO{YJg*D__TTIvVc|3h`lKyB3(D@KFV zBK~7|E8k_M?Ay3Q&mS$Q5@!vi@$b| zm{M!Clv?FN@KT8VL1wEb=n-hUz2xB-(k84Y6NYVOTT&mmD8U&d02yZ>aupjZG2=Hhl62YKDbL2x1N|@dMR@a7qh@xc5a(OOcrn1rEdy^la>a zeJ%I#MBuuxR7|{ zpyHIFDYU|=H}nQ0SBG{|r-$i>$sq?xg9#T$1NNxN2d!U2JtXo}GKD55hGPaqhaGP! z`tzAnMalMQhyEasg*(1QdZV%5pcSb$!P+M*)?LJ1EWNyE#!?&4TcW)&r5O81mu)1}FZ>x?r6Lq{wjZZBr9_N&p zfDU+(*0u1^FNL>qJp7-8#!nV12hS(%MH~@foHt)-m`nwP%|GrCD89<_CFD5u2xY$0 zATJ4@(7%|OD!>=~cS^NvsQ!7cYbxeTgHLa@>nz=)p4+g#wXk`u{&sXvV4egzFTIOOM(8YyZ5y;4MsX4os}T~!cWKkuoB5SNP=xIszLVX( za-m)ENa8;QUq;~c6Xg4q-+0T`@!!kVW9hsv>R%A3pU+?OIXkS+-wc>)R&O;_l}pt} zU6qFV=KU(6U;}l2>5$W9%LfErOpP)3RVBsju|M%-czK7bv#3cIA;|~d5({N_8M=BC zq_qRO_*H!S8P3^hNfI#JMd15}u8;fp1YHRlw(PB_>mf@jfM-itsy4L_0mW&%EfoLk z`;H=LCv|8`IUAZVAI|YM4JXP!ej}FRlY9uyesH;`y4&#(uKSKDpd(A)-H7kuUrSg6 zS%gyasL2eW$}_JT=FXkxDU62de-O{SQ{it|r2Sc(UX9KPcgBo_F#JM=0?BV=@8h;l z(DAs+jjRZa)o0VWELo{TV(GlK?(u)*zao*Z%iyNKXs~P_|#qq zwr46xfzfUSuWN|PMztiyA=Q1^C#|mhIhCdAWM;vG-!dlNepv~Bh30qvl)*y-Upk8R zB7eLqFpTp4+d;JF-N+@Vr~~rY4kb7 zSQT%rL@yvH;D~>}6+)OWC9|N(gA|uBvb{fAK_^H_M zjbPB8@3U(v56bBcvCR^*1~ucKRHJ7V5EG*n7e+V#^3kYu^>N#iZqR&MDpR#YkcWj9 zLA~|y(^A!NOmoIC^PZ0`5=s=T=5Ikm*@B9xWN!KE1pD66iZ`Si>X`!WIvf0#Z-f9! zfkk(j%e4)*=`uhMSox)rGB%7Ir?wt;XPt(Y=N2p&mk^U3zVdqEg>k9yP3i`KjvQ9r z=(-hJ_cvvhSg@b32<$7&yB_ceRR|H>a!cVa9$QjdmeyS z^6wcv-;qw`yAfBCQBGD7r;>|aQ^3~}#E7$YEq?bPf_wO~$B48qI^y(iukSYeGke=Z z$Eq9_V7(e>eIsI{NXfpW1;u^;+2pta-s{HSZskx&O~zK=x-)bbg4dtD8rS1;DH zg$frl)U+>!BUjR4Aa|#`A*S8Ec?Me>UKQXe+qte~+p3-e#XTdXH#%pJkPeO5EHO)a zcV$mlkwg%v?ScpEURBe{fteA|TvWI^Fzo9+j4n4VrAIHg>QWgAws0oG5-Y3$ge<%p zfZ!!y5aeLvphRw(#IrTj7OV7hf8cG+8>*Uhdo({BYOB)f-@pH;ymWL(AG$s^z&O;u1MDFG%b{2p%YLC*s}4X|1-~l%ATl z7!v$D`;9M>81MQKQ(6y`I$XfaS=eIATi;?b&5D(NKI#MFNQ-Nq@Jk2kifh}AYq?)u z6Yd9U9UY*;F)w% zXbU0`qq5YcYusIo@FPQ(F}LOl3LC=RNmiD;q|U>Qdoneef(cA3vf#B%*@(mL2{pkY zP0k8Un!VH$pHr==$K#{MANkZM1ui>~tG`cVc_pCe-Uct{>@{I|g5Z8`xFfK$$Qtz)Zhe=o#>;SciDAa;NHv^9^QK@U6qcT4TQO4!ua2%A| z)^mpTlIF_jwr_QOVnl2uvv8rzNAKC_MvI2rJ>8@+38g2{t_!3aHKg9Km^oR(ypII6 z+TNzo4?+~83hwAcy!m{E%a3@qJ!`3PEC{SqEOE~x$uHL$VtLWAw?!ZowoE**p{?0V z)X9)|%S&LSDd$3K%%OAQu2e-1PEWN+WE9<4K2e?EHgVthzKgcb>_Tx@n8S4-Qf=Xq zcSb2>u}|jTlP$BOaN2yqkikdLjZ)!pad{T(xvA^(DTSB!Uj%oSabud&8u81i(=y3$%ZmbMU#A#@vy&Sd zJp48b&o?wsCOQKBI>I&O)N7hiWS&X3(6z2?>nkcP)=Ttc6y$JESFBQ~9yvE5LZ@Je zv7kyN)lUovj=5@!s?7%*yI>kVQ$~_?HKu|GaFFA`&iRD?9k{JOHtzb^&E&0XSIa0! ziCcsrY)<1M-H7=%b7hd7iL1R{FCAeI<9d3vRFej#(vLIc8d2E*R81ryUDTn9TPiF;9EuG6SJ6trI{yh(@l?Zoi%?z{DY4|TAdOt5XI(G| z`Ax8*d)CK&8a3;0Ypw)XK`gr*&4@`G$d{Xb8FbB`84`2LaX02(ILz;N!Xut}5y+Mn zx0p9TRCxX5y*-sK776)%TO-MU?u7{Fo8-?&<0PoZ`g!tM3V^?N+r+P{i4fYBRTnw= zK3&DM>-@a&}RNUg;69~^sM_SMgZt`V{vY3|0{ z-(lArru_dfC0TR#BQR4lm2x?Vce7Ra1*NqOq{GL}f+TcCx)8MR{{Ld_&EuhJ8~^bs zx7;nLB$ZHiMG-;>FZYR1o67YHwd)1`@5)%{70QF&qtlCX+5s%x$m2#Ukf>!vzE;4NHsfS zqnD^=O&Rax>Pmy>IdOQ@C!La+(n6C}EQ*nCc(RAylIL$zH<1nmdxCb84AP%cDh6V( ziD3mo&g*iWYJH>6@SARU`qHgpxCXd4)Ng#XI(|PNY|Df(9Q!fW*z%mlURrd9Hy1mF# z+Yc8-2@cOqwLN|&n`OmTNPv&n6zJe3IUY%q) z3c9JH0vqy;cY4K`nvMZnv+o_v$mV|0)e?;C zUDO6ej8;=NM7SKB7Ojf`#_N_~cULy+pMv+>Mc?+r?%~cNQ*hR@|Zp zWeS(ul5-2Fx|wX2@wi1B_kCu~Z$exhZnz*<>h52bRR+GDi-c!$f^$r@(HOee$`@&p zNc&2ZU1X_T33@yW%jGjbJ7$`6z>7V{mtgTZE; z1SE-}0Q+n{1p82I)^%e5V4vYT_kW*s0ytQkIB*JrJtxAQiz3uuu&Q1)q5zUr&Lj!; z>}M+GjMi)TkWjLkA-`msl{gj#vj%u)fRhi8fL{FrW4Rr_9&dQPbJzL^n*d@44S8_A zkoC`A<`L`R0VE%8i+|k}y)rgwPuLK*r>q`cH@X(NehBuq-=+8Q?EQjUTi|B}Ep+{m zS2q9C796cQ$!LdVH3KV62uNSQPGBlH&dUpaBeyN?-db9_2hkFWlA2vev>$!XEczvv zeHmb+7ad@*#uz7p2|z=~vBk8BWN211j@@AbYH0WnAmMgcUI85QcWom7#j>(3Ia?4vYPkL!r9nd0A=d#dgD2wyaSe2 zO>)p~Ds<2tH*%Qck^B^(A@|l#*1h=wK!gEyoaMtK!iL|5OAD3M7#@Q<|A&IjIOGcl z(#Txrr{Ts)N|1)nKY*!4(_akV5}I3C++vUibhbxL&($LqQv+nu`V;^nXr_M$5ez`x zu2*M-h|bnJneK*}TXSL1*Ce7GBf>jTs-+qbQYyyy0RZd&pe>GV3*RrqnX>-m1#O~t z007Ul)IFq5zLE$;-8pQ*RXK6=4U2)xo)=P*Bfk)d;;S~UH6EdtMM6E2W)Rc$_@0$v zJ~<*O5NXnPdyVffQ-HT9;anLuDZ&ZI*B3?iPn=Z5lf6~4dAiBb$s-w)V)fM)N<`U~ zSI0PfaSzRsra9aHT)-$Wg`;v@!Na-i>(j*-1d9zIR#>H3YVaST7$W4Pu zlPXqidXeap8^RcwCRh`N8YICgvrbGf9jkTb(LX8Ksy7bocu_8DuR#tZGIXa`T_FHC zZvmjwl)n&wo{cf=0)Pp*4os~MH$pwneG;Ssx!Gm4vX>(q;7&K>uh;Hgrp3cKxr^_u ze__Q4^F%s%jX*4SL(Mk@aY!{f0Z9zRQNNopg`#r8cXwy-?XP^R0k^PF!|zC_y0`u? zo@bxw)2se_Hs{@<5yT?X!At}}t)|K7$gv(a7VbiI&Uq^b^L53iE%Qb5IY(!#JZD(D zaiD3NNJ(Nfp)?W1s;8WJXt$;+Dr?X0hA~^>w^7a_iIpps1g&_JK4bszbFh~{F06!` zNaMTcA2L2}|L!8WXVCrm zA)h!{2iW@88R{yxYc5LmuV#y<&3K(+mg4ZcJV4Fn_&oX5yW09|3LarA6OPsCbyvKo z(}sD}nGLr{*B!x{^@THYGLQz)$Cz+tQaJn>JU{Sj6VbiTN7*|3D+rA0iw5`ew5n(X ze^J0`^a1#jr$rwb3Xqus_mTX(*^jSVf~^4d>06@$%R0s^QQvq@a+iT5euN)G8(3-; z&Sa>oG%?*-c?z(}2Tg4<7BLkbw6GO1V;4vm_7&a5Iggc@cXNH@AHI7PvJ3p%b%|bi zUNsf9*?buUi|r9}JaWk}N#E7%+(y^vL#ed)$$M!=?O1Znb$#H0+szKL%^&s!=+y5q zqakbUpVnVblFPivMitvW_mQ@jQF}E<0SFNXX6C>FfWu}?xvYVFD7a_?NUsRhjZGQnT!j&ww1 zi)L^A4@P8%`rL(nWzU9QNnQZAY>PeamF-TdzkpkPF9}^+*_)-;a!_|PD_SS)m9>X4 z@&J3zz!(-2ZHFuGWW7A}HTO9DNb_&clRPVl`M@}o95Q7V>N{wGlaR2;t`v6TBI(E8 zj_&p3XYA`%&j}Z@o!d>aSk<8%({abtHC9NS`dFQGFgtAi8ks8nWMm@d+6Hx}FJhJ= zA!SVIgn&rU&7E7TeDJl;2c}*x9eO^1WGGjs{G9l0KrqjtF&eaVcYUg-ZiG8@Y${?b zCbbG?5Kyxwv|_VUe>rOX__m}|2sj{EzhBT^7<<#MWEiXjLP`M<`f3aBoX!kblq>p} zu>3?MvvQ~Z}uJlQc)m1SK5-EliR;`s*q@8 zTG3Fir5uwR)M@{%EC#3DDPIf0q>~Rs9JUBf=wueJdz+x{HWTSlE$da6KN+ZmSc@t( z<*(1u&!a3dy|l)g%E8q6s;5{6%I323j5;Un7dV2{9UiZ~MoHSVGO$CccE{V>(mf^P zZx|3d`c3-8D%3$LhF$RNsNX8w$8U^Yst~GrXdwS4)EZ4>JtufSNzxbEAo(nR49qlD z0dQ=`^E{FmwJAo0vxRA0!q6qR0N!Mk=yjc$DU$4*Rsw`tRs8WW2FOqbH*M(Zx(4+S z^iP=FI#IRb@oP|}O8YLo_S_FWB^S3G6z%Z_I#v2rOJA3b-p+4+PR1|@B*MHE z3w8Z+1PvKMI?n+Wdk}Py$w1N%bO+p$OV6D|Ey-!ni2&{!l5bk@P8?7$);JPJC#wFC zm{!I(vDl=>jxX{YO#HZYYsk_~ZozsUck2hLmn{Eu(6}3delc=dEd&$DITH#UxmMTo z(@Z=WRkv_*+#t}u#X5HDP2h(d7ErZoZaX|yUuDA!9srn@_lU`h#-m+&35Xh@Ewt8O zjgz04O&?GWDTbJJwI)$9#*0PL>wYT6)1nqtYk2$RX{Hbxb^5TBa}%ejMEjNuKLlv= z?zIjHb7jwwd<;w1^kXD$V4?0w^XbxS`e9JHslRQxL1wrzf#Q6(bMbEs%@y|R;{p@8 zeJ;{Fh^Mf%{F~63dX*t0NUE9yu&xM>ZwY+@znaVt#=S-h|gD9of$3Y{jd*J z<>9@_s%o1CLT9ajq8@1~)Gi43bi)~yiW>X4A8==6r=&Q*&UVr#y7I=!GEsRB zof9P!=qf7;I^6a4fViNHKV_&bRanrKggj~&Ze3{^d^9m+K-MbM`k0$dPStyIssk)V z5=gWuqd2Jqi&F3=yFvy3qlp)Lo+*4Owb87#T;H<|SKGk~mG-9t>u)Cz>c?2RK^*gD zC82#9x4C7X@REb7^QZl0;?WQPl6dA00|lA;LawdABLKb0XXX)*R8+}W1I;x5$R;hG zXRE>gp~b!M(=SA@6z;d?77lxG`HrdNq6E+VLFdN6ddvy4g)li^k*|M7PQH}=;nlga zQhz^=x+FTM1zHg`sO(pOtt%XQ_Q2Q*8tMat(-nxWSVnI$g?Y0|Kk$Q-`|nCEe?T`g zD`^0ShLEdGxz2$ZE~q}<_P)GXZd~wG6bdRq#!f>8yb1~^0d3q58tvA90v=SDA{Dk2 zn1Zj1!b7}9*g%Es9;=g1Q-QAf84v<)eFH{D+vO?DmcSXWv?NcCY;KfAq2?djzjb0* zHe`XT`fZZ^O+F5p4s_UrGP>z({hX8V^YlLs_}x9%T?IxtPqw^V|6_s!&P00okE8tU zGNh=1w4$wd@w-cKdxo^VQ68Q4>IVx1zKLEPv)A|9^>gM41Vr8vF-|rQyl(une&Tg356o^YXwCEvR`)OOJ?~+6ko>kwsxGr7C#n17ZF&&wX@0#t zCgzl$P-(aF?TviOz7*&0A_bN0WE(E)Mrh6<7Vo8N1~?}%c2S6hiq*2!ZN=1`zbjyB zcp3yI>Wy3ovMg(&Ue9@XtVeoj#yrCxF~1YEl)1D)LIUyzMR+gi*Ml?j#~!~xaTQ~? z;1*_^ioos-W|a{1yl~%YXLZu38M{vi@S@&s;Ngd^)hi~K-c*09KJbjG;uma>nSAAT zt$Ep~??7~Py&!i*Nq@2qJ(}#1x2mIX#fM{G8Xs=gn;6Tv4gw*$I?rhifh`^!le-gv zG&JYhe5tr*(W!oG;Nto>myt8tG52&;LrS>e{corfZ|;_hqAi6NnIe}~PiVm74x|Mg z>k3n`_#>F9>@%@9+HMCd0SsmkG!edt)L@Eo3&Y&^2qDLMYm#oySAtoPmwML|(}Vq~ zvGM6@)^q#2MojaS%a>a_J+z$jhEIQ0E=o@dDjOmvZa6u*xP%VGjIfpyTdUs1f~CH* zY2ij)k%q20sXKcgTEM^Iccfhr^`xnD%PUk-J}jr47t?^j5|M+B17Mga7IGJx>MAe$ zy)G8`WyQ^Xd<|v}-+A)z;J5W^(}TQefxD+GJ_rfFJ)isZLvtRgB#`a57jwdek_D=o z(>Y=-W^rHZ4EZ8d$yy=pMf|%Z@`;*g)yL2HA7NSJ92n%|;DUIe=~nZXuPH}ivB;{g zj|OBHb^h(VF$bAAyp_*RS7r6EE&;pvTaJCZyj!Ajavpq3o=Tr=>dBTw|*{BsOn_BBU74 z{r7EOTsuVND}kXGdaz?O_l&*5a?f`d<)66J{33V^HPD3U%l&u*qo?RFjqNWWtQGf# z8|8nI`;DS|(I&rIW=uvsweQ}-Td@VJ03Zg|6N?u}+=Ns0vX(U6a?>JFsYRm+M*7~0eg5cn#Y4dIDf6&KZK2XIMODyUW#D;zGe7IS!z4n#^ATZ;U` zgA%zTmTB*&QW4#Guy*ra7HM^IhMrl{aw?*CpIp204$|`<4Yqvt{SwE>C<$chn}|w& z7G8{WwpNwB?dzeHWMhw!|4i{sp|2r;R4Y;)_+o}TEvosLryJj$m>eXi(*5Q zLuJAJ9mtJLmI%nEH6$bIiO!c0(+LfB4OEZ5RjTMpV4jsOikno5)iBg`%d0{b5Aj=( z*WVu<2+_-53^QpPTpn%M-F@(9ZP6_8S*=XL<%4VQ0DLMR|4VQ8eV;_%Ps66RIb zn>)j<@ zZ{q%8W7K{2b+-#w!?|&BBI$m_oT{TuT0`&caEjsdOF)=(NaW^C$Z?^mChA@fi41)X@(x`FO=%vE98xp1SNvWQgbrQQl*D6(#eUT_qWKJ zH7S7{xEuVYq0_PIBt9|Tojb0Y)#Q)7#}6JF{e<%Np;zRN;AmX~NVDu6x`oHb-R^Dn zjUL-0F%A>s(`?0u9UpK=_VY_ml*__Jn_H>*>VtE37luTl8jAF}fa>{ef4)t0#!(NW zjTIme)Zm~7iU>1{!iv=4v9OgFO*Us#oM z=*#?^%IhHJR-Is+FDVu8Iw!WdD`m85)iiS<3`#{qDjHmwE;@o!z0Qu zy`D3!Qx*Z=Zd4e^6<{p%$z5j@sAEOB1qQ{o$Jb&yzxl59$#Fl4?5URPpjz_?XeGmW z_pB8L(r5o#YM*{a@rczK;USPOJA1kb&3*A3b>yN}G#fCyY4)6a!+L69x-px{CUXAs zCnC<82SH7cKu`@9tp>9TF*HFQ>%;y6l^&GAHWy`?>7ZfZby{LSHFi*f*oYG(U0HD5 zpAXi%e)C6fRZ{&m4m1ldq1l%n`Nq{2-n4pcJ-2gB5&6pBN0#>^I(S&JvJLG{Bh^12 z?cEU3ynN%J8x4e^)Q(HYGIgUq_7N-SihU}S)LM(kVOvn?DJ*)Zg@779;ec>kYbXWu zAZXSDLG#YNIRrG;dFvlv0|KHuCT%YW)_O%T)s-Ht+#No2S~aPs%(ASY!Z}|5rZMl()h2oiWJFX0(yOm^$FRXoPE!! zW;Tt3=(r@Mm2uAUUX4@(T)E_}CgM$$vWd-cDxPo?rPtFo>**r-YA@xlS*tEMIWNt? z{efvP0o!`q-$kGO%jqVn@l9b{9_+_lwk|>f^)p#z$|bD72~qzNXV_4pTogYiSjL@V zQLJLYd96Odyt$Vjw>T^^&*LtOT)SgN(G#{M;ku@6hF=X!6xu8u+52ZP_Sq#*yLxAO z$ueGCW2!|2PMOwcq#+isb;?zGpf>f%9%~yf6`Zu}St#SUWzSE3Ax1Kkcf-8S^KQr$ za_xd}adsXpVXg%(6!0nwhq^WI&sLsEzf3K`!#O&dq>NkU!_XT;OGhq+-s3srBuyP# zyM%dJCAo5XLHWgx6Wg6(ap>%&b0X!nE2+te2;b7rwkrjVe}(@XDsyz{+|2j5bgYY zkol(KXw5O2M`ucT1)X24wQ*GqxK`vs$;+)rnEj-R{n}k;v*SZ=7X=^Mco&`BqnY<%>zjVg`c-Q0z34JCJKOLsk^TpnCZFqG~aUC34JcbZspHP;u%HM<5l zznQ1;%VgzEUwetOd5C$w2Iq1ZTR-RSxxVyHN+Ql_Ub=~VZRRp_&p`2z!~oF_ABrp= zET)&yZ$ynF3Jdd%KMkPh8YyEACvmt(tnvJ)Y4_dwB%;ai$vloGCc&`D47JQ3YGf6WvdME|{D)WZF=tv;so z-KgX`HB5hWF8Li=?8;_Troe32GBsdbVPLL2fo{33Fld`D9ph#=pX?~G$W~ZIQKm^| zNzO%9*xjGY|45(RSW>4ZOk0qTw7ltiH*zD-5BDa51qs*T6}*?U41-A~-@blD)1iWm z?8#XFINTxit6QuImG^=6x`laIGq9M16xUW}w% z=0Z)WuRRdg^=@=4)ZwY+ux7-*Zir@?FbyFx+M@>Fv#KB_BB0faCjJqC=+F zdO)yVl_tNSS8zp$-g0vp-zOO^1@rR5Rh{Hil?Ez*ndG5!GM=c{K%lCWM%5~4q5Ilv zPnqhQu78O{i%i!gj#TOLu4gCps>FPr`E8NITq~JAlD=wMlFv#P9&(k0vyqn-2sc(l zahGdXf|7-r=COv(L!pj5s}zgTGW4`SKF@)|s+HGyU91O^i8O((dtDqLk~E5Tejz9! zX1${aLj0~vKB8H0`IpfgERWL}tyh69zLxE~6gIpA*JqQE9pq4#zc)`61fM z+NrFz1)jwuvkI&$ZsPEwPvB9uDGox#_*l`fY*Lz#*_+jz`ES0#HrMY}&77<)KsRgY?ao!!@#t z4a30_V5}Q7)S5tfTdi@?Jp^?`?w%8hrgCXosnkyVhYV+6y4h8G$S^HCn*0~uZWHrX z=f=yheA}xOdM?LA>BS&3>`6m!v< zS--xMJiCspVQoK{Ej1 zoRuS+t1r9*NBLgiZ4`QlLP7D$n`fh?xGe!};7C<37O&t@l*VcLOVT$YMP{eV`tfSB zXvHuG+cdMmqsV-Z_RwB&O4{c5(CTeMBl!+FDn+GwiIb>@Ho*8cuiw3xHRS4vz8yJ~ zdvHOxc7&-=HD!|~w_NYqEQMXw5VOH|qGpH$hLh!~)|gZ`2f{KaNpbb2Z3z`*NB&tktXxS((I~Hz zD#>#+5nQ_IAZR7%C0E`KW5cT$-Rkm4Nc*`;!9;+3Lmot?O{y_u0n0(+ArK2-Se*4pZ}gIm%NOJQ%Q!Zp@Y$PA>32W#_J`Kg)AqfI3|;{Cja*PTln+6@{)uRLPlz z`sS)qB2NWY(8c!!@BJ2BeBUrQorr^ zV>Wr@$$slwlrZZxAP0hZsclA9v+RRu#va-j*zw>VVn=|U56ipmpcT5=9A9C^=4qF_ zD0mx7^Pb+<4*Q>ZePyTr@-(5+zFE^%3RV)~0yN-#!*U=84OQf`u3J#3rL@ag+8<4pz}d8X;my z#h=`*oFfupu_8#^!>9t4NSmYwbK(UAmdnjxD$o8~B=eO`QRL* zY8sB3j8^@c{1iJeiYK>KHSYXF*huWkOMSC*j>`bHsL|P408@?6*YF51IkRRSi z`6gg?tKKRbXf_JJJ5S1L-1(cBYc}Ab1u@@I!+Y(a4}Dx-rM02UI#{9|ABPnf2N&8% zyvb+yutEAG5tX)1DR&{FHSub_TD3N>D<723DiRu2U(RBvyKjND1hHpm85q@~adIW+ z;NLSt-`g zaeu&ETFY<>yyv$h1?&Dt1(ye3aY2%T^GGr7U}T?xS<=Trj*1hJt<+F3=-T_;6%_Ik zdnw-_R zvGEy_wnvSX{Kq0Gr#1ccjt}t$;xd-^zKIvyz7scoc~92Waze&AFl zcEFHqJ!mfXsTj;>6KSA#1Xi}6%T08@+mf6aJmA@Pk!U|s!_$ZjT{?ZxtFANmah$dE z+GQ~uT>67FYDU7Mq%t8nY}0T)U?|4VeFCe;I#ae`9P6 z4SSOz@611|4nciERrcT6LZ<`PHlB7*JvL|B8a=6gAb8MB-f)Xie+3wINYs*gXq;r6MosTO29~6KjMbgq{LYRum#-PXJO@^`A&tU&hF-1uAyg+~R%C88qV# z?F}+1)6^hV6=Yz}K?iL3Nmr9%le}BdFARhoB89%xou+90+iveE(0TJfO3~IwUN)uF zXobE~b-L!p@R|HbXM(?}gYiKc6k8bxvM5Pg5sE;pgoZfjzY|5dyFpesr9|YV=avcq zWKz=3Lv?ll1eQX4@2}aLKWeVlK#gB_RDkb=bRFL#W#xw< zK@4br9s;)c|Lz=FASB|BE<7KzS`$-}F+knBWCokt``-)K{&*{36ZkGVG$20tq)L+* z99pcW(6X<~!34Cy5$9fF06U!`{DWo(*YvZfe^*o0Hl@iO8YSg}) zJF>p%S?SdD&Jd=^8k7F;Yu*o2)2`_^fd_(LoLaOxj)0_#Q(Q`+ z@BVKu;cm6jot$^i{L^M&5E{PRuqXQ(fB*4QDnb5jFZ^4^5&hxLO~5Ar%m%Jc#ZqOE zVJx?T_T6ZP#m1`&m`pKoEEUvQcrE%%bmt_95u9mO1FBs6(dVJhS#wXJ4%1=Ku#sqg)PkD>tHzY$cvgwiC1JX-*1zdLJ zfmRRfa%Kxgb<~OnY?8Yc%m*r8j0oC(!!mpl#k`4a<%pH}PxLfwj_H4SKDrdu6bE-C zbMo@@&lE5y$o#Ik5@@Ay@NiOf5)O>vDJDsR`biIRW_JbNgIO_#oiVr+-;1+WWP8HA zKUgj#V2B-E4hYqjAh-;i9g-0;OdUku}?B06M{!PM-6Wx)_ za!l*pyQ+`k=Nj0e2INKl+QXMA-@$sT%cyJAbh(}r(A1gIW`+}<81rV!po5EI*|Cg` z_F1g*eGlk=?O7j->fJhJz>oZZC+@l(W|`O{hlCko<$knD|0+0{aZbF@z85AN%_4D1 z`f(J;H)Yzyi?D^Vh0E^v0o46bhWle|kzh&tSIHe-d-^fKFvngi0q0Lg*9t$OUrYR@ zK+BM0@Ve1gW%R_FQU}DyTkLHL>yLNmUnMG(dyw=%m9Jgn3YMm6N`84$kn`*dm$4Mr zkRtu$G(HxI@#N|agn;{_E>FSYJqAPCV=Rt?vjydcJgUY$FlS-N>V$?~(iN;)6yHo* zu3A>8h*~B;W8|C}=_u@C8BucNJW^v(LPN(gMt7GyI^{cwY#F+nGw92%@YyxO>?1T& zva29s$(iO>okY8scxR8qDe{^l%MsZ|-C~fs(%F58NytqfCoBEt_MG7J2)ckd%>vdc zmAWU6w=B)IMOBJ4f=E;sJGae454>Pg3-QBE;bg8uBr|m3TMaBso}IcRmMLo4+o+tA zDpx+{oN0OvW-i|Zhfvjryvwys*PC{xpnvWjqFYp@;)gBMTtKgnLqE}2=@x~x|A~^_ z3TW{SZ%huo^RK@s1JpF+AgF=Zsgkamv#c; z@;jsb_X)aV@do$#PGRrg;n!|{Fstm-*rS%U$1|(Z+?Jb!P%`XUqt(L$*+ANkASWt3 zUOz^c{8y?{yi-0Y^{zh+8b;ls2B|gq;TIn_w%!gJ4_sT%nq5Oook8>!%wL{!fG?&~ ziiYjeGX|z#Puy-v7_ROCR!GmLC1O_}Q@{O@W`} zGdSk|gYc&A%3(FRGcq=~Q}Lu-+YWCh42h>f2}8tU8|(s`tT6G^=IzEWZd3KNr0K{LeV1Dzf=g8H=+&Hje02?% zui7k!S|A6FXAK54uXzi&$8=?zUvjGu-34rDN-~QP{6Go>)Vj%`S_D{%>UPW2&c)lW zd^PuCcb>P3ZOrb2K`FQvdv-(P9v_yW8hjr#pL1IpkjMvz9QhPL+<^9(9cEM9Pr5&{TJNjRZ+HoNiXeLdvJD#)@ZO z=x;U@J~UVQ#Ds1oNs||aYQ~Yb-*L{5BD!LdbdWMMc*B4v0j*tt?uOTa283n-(sB}j z5>QM_s?blDL!PuP8}eHC{duTeti&yQoLDD^kJ)#V$MjNB=1y_a^;l{`;%=>tx5B!` z@A)K}vcf#E2{EcTV~yvY)j1cwFa;`fMW@~@JSo}#W^my+Lo$tWB+=>2XznZ~1{q1? z!m4gw?*=)rPhQ0NVHR9jfr?|8VyqerhMxbU9A7`yK4Yoq^b*)j3+xLhyAsXgF_$bC z{Xyuj(IT$7+6*JH_xRun7AH;5nWMQ3;X|b0OP`e1EP$Xw?4*&XVMv0i%yCWr@T>%G z9BUwHRkX~o%Pj-MgZg{pm^U5V-P3F#g=Y_;Psb)Q#gLxccSbmY2?mo*H*PqnvpH$p ztT~qTZAy9 zoP;SJ(0rc?A5A>AD4q@;>9mH4u-+#0>yHp5(|i}!4g=wGy>0Wt?h?q0JdQEC+C6b| zJJn^={^&oBnri3B1 zYK3t?sDn3e6?UGVQO|RDQZZU|?01QAG`xw}Hc(7zxewlV&{-rF>fsTq^IA}x8)AY@ z;OXQLQ)q2d3IbpwPUjz-jck=|Q+A3@yVk=P>!zuYBbAVPj-_Sj!h4i=9EeYGhhNH6 zAzkv!cZ=mt_LcV7=bzlVE65XXd7?iGeJA^}%2vvQx$@pHo1m^FLC92kW=(KV{XV4i zD`bIn=L50x)xm{#kCMt%zhCL;{s-LOghJ)t9TXnNeL2f%k|Isyn`x{%c2@F;J%cQc zTU^+}pM`(qB|gw1ez$0n{(AA!bXum3enV9&(6Us-bb3D5C=uo#Fg+GC@+cV zE%nf4_EmqS;(UwcPcF1hx>S7&<-zXm;nJ#E!yZ}Brow8O!v`?Rn6JP9>6Dy(IKMvF zQhV8ztd#}=1Jdt-bqa%va+_W9)+Eap?_p|5-;iC?HS28!m&S)#rH6~kvp)z9B|U1* zWDN2X%*0B`slxqzTVIZMA--6TOBQs_1p$Dinfs zr~mYH{H$uV91BlXhMmH}OWvp0gi_wtGXD`Me@6da4}po(?`iBANt4{7Y>(A$u|zBp z{VM!zjm@=EiE=6@OUgXarzpI&uUfgR@=pz%jel32i>JY@h?|QyQ8K9gsrb8=Rpp@`^YJmQZ_%4TA3nkE(JCg^z5-bXyfw5N9+|>(r;7lPKRy8N-#F} zHI7XEHke%$_RI_~B%1O5IZS%= zlcg^OA{R$ZTZE5?_`QUvMfHk* z3ipYtvZYy;M#&+=hd?Tz*ukwwx$Hz**T}uQX_cGZQm{i7m}QFrJ1UpzfRu&(gJro< zaavV#MZ$bUX!K3=!gP=NXy}2k1`zENey1Ismeq2qDr`Vi8=tH=GA*l*m1gpC(?C=w zRdr-v^VYd%6zBc?^sW5YES#N>uVrS-X>9ruqR{~yfr;7m=by8cR=>qpDPKC!lS#fEPZ@*kR<$EbQK~u~-Fz1r#m99{H&l z;H5!P1yq^mUOr#Nj|}WL zwh}KQcs`uITCHADxv^Ml9qkgXWg8AVxBr<*jm%p4xt5`aL*0bAJ0X!ZTdyZP)aJ*#XbHU=n+e4BMzJ7f9XPS(pM{fA%lQ+mz~_0uh-Q zAUn3b3GbQnQz}L-{`&<3B+=HyW?I(VjnOe5j<+u9oZ9fY-;>(_0*ry;l!O9jVdjH3MoA>A6HouUKlu#s?k^MdU*}}x#F(>I;-kxnQ6F7($1w=)Ty1%(>p5%57 zER%%zFf-kviLnGmny8cGBa%TqX|5IfMyJnrsXBSQ(85H5x3?Yf?`ENYqdSN_h8a)Z zLfH5A@>+$qW1n_(;HGy)+M^Vn1a4c1LiqUPfo*Mjsu!exXMnu&+aNoWmACXT>u#K^ z7N@lvbzmA9g%0ScFM|^Cw7=|%9ESHYL=&AVvu;d~dC*{}=hjHJ$_^?zI*a?%(>5m- zJJRErQ#wscPMDSP(Zd-X085QQ5P9R4o2;9O{g~9)y%m>mXo>0AtfwuPtXG~Yv%yTS z73V}iBOt|?SKWt|BZe}^+b!-GhAoE0ut*R^QoPF){jK7yz^g58Fe3wMz~N^w;&;1L zA%}I*Vz4t7r(v@`7jW;y^$X8_P%z*b>*iuV#?HuY>A7qx$0d{+J0HYOmuY7Wc>_Qv zhM)vh$!~ensbB4GFOap~9m%R0_6MpCvqGgF?8;!*07rwtH5C~#r0UL^$L@hfUBg)h zVh`IKC?d{!b7sRMKxrHjQ?a_%v*2@5Wu?nWj5L@>3MCKc;H}y;u&frA{9Js)F{>p~ z#HPIxD~ROVwV~D4SP4itbr#X@>7*;B;z>qE14{KWELx6@>uVa~rBW4sf6>17lV$QMWA{;< zOBI*->{xT=4D++RhZ+YbQos1v%;JuA-PPqibY8dGfVW$8sEy%?<~jMM1s^ulBqLHp z;M2K%oHewuzDOZ9ON~T)V^(A@=L}PJ^ebHhE{0EQFIw(e zO#if==m*w%6W%7xpc~+BHxuNMov`OwUYv=i*P$=Z6?e;&?A>*n>?Zx`F20qyDFZS8 zo}p_#{Z=$3o@n;8=b)8Td5ehTg;naQLlKD&jYNs9riah&hK z6*%6}i!AVbl=G{azAD`hwJ+G00pMK5$%$%hh87@(Zhl*;QhUjeXA5GFS94pErlvO8f{$*NC z4@vE_@xj4SXJ;1O#~dv@T=#$_h_U!ZISjrm>+2;JuJ|Fcc*X{uK|NeM)YgA5Oy0^c zM;@$|v{Ni35txI#+(1~+PaY05hR6EOgGAh}-TSpJ1pg)j^dHtn?5`;Tj|Ger)d3)Y+F%Iu$( zxKVR%O~;f_Yd+?rA)*X&ueIUx3k`W` z-=1hu)+?;bD?EQEhOz7>ZGg5UUOJPHsggW%!aA)`KYejud8Ma%C{9pvRiir(_0Fu1 zkfrzdvPz{&(9O`Pa^q^b8)i*2>8b+AE*4nG$JrFD45u|}>OK|U>ooaWq++T~F?VfN zx`?+5redb^Y@AR#n+=VoTRLAX@ILRZO*pRCV-L(1S@SYkvEFcHQyfSu{>Kf1#j2Vx zXu#zADhnLbqeLnd7S_A!?+onUtjIa@6>Se|zZHr(OJI@us66pH>}4q9+<{++C(tl> zNka}?S%pdzIfEM3P~w^i1tWplWG%;PckVQ|F6Z{VUgQgMLMJuAJoky)kEI2^^USfT zV8|e^b|*Wwa<#)>G0ya^5ZdwikSNAiXAkUH8;C**0|4uHSYO@$7Xo?PgRH*X*@?8L z6d;xW!(pU>MhzAuE?HUbh&_V_9MVxPQX=)gaJ+j`?5f1`G!F7+xWS zeG4gAEBcE7>{$Jm<{!-7Uw!o-f1vLOCO#$r8Bm-AQugRs^-@ZMR&|@!QDRGcm33TI z!Kw*53{DT&SDvjv@4xG+Uix@eLTbD!v9qYW#$%^R;eU-bb(m99QtK@yhUy_&H(*oyp^yo5DPjo?8*Dr4_G?Eb-sObX(y7tHaquRk%^#i|9p+84`n$Nxuw|Dh+%Mk@4){f8ANNuQ@b;yX;4RUT03C?vGdP=Uhg<4FE^mf*9x!(8nuAWL(O8E!#mB%lGV44Y7Dk0DG>yxE6yyvpUfNNXj zcD&cmi>5RH-pd5=U-j@}I5o<;>g$(pW-y)a$7uR{i3BY0heInQKp>nKr2zOr^9W-% zoB#Te?cCV~JHGv^cCKGDy)@-7-Qd2cQE36jk9M4aouwCYAjbT5I!%k)T4KvC$4?|| z`{FVz-}^PZO`0^_{#-KDFA_59}wU^8O*{5aJmf%ly*%%F!uuHY_j+|{S1zLRI z7KjvAez7?2^A3H$dQQEQbyG9tp6h3AnQBvLG>k*Hq40+VgP238fVl|HVg%}Yt%0ulo-8p7vF_oD{LzXbP z+j;T`lg2$U7OmS%YccFIl6_Ckr^gTV2YjB-@%_F($NT*{zK`itWPG zmlvGgXEZ$!p!_^`N_ewL>HYm^!g&cfvW02J)xcw=N8OA!e#Ar7LZRD+x7oB^g4cj2 zZEVauCydVQuJKzq}ST!N<=aTOL{k7 zc|dS_*puK`b@XqY1q4JE2ps|OItK{Yrm3EDwGM&cB>-r!ON+m6`8V4HI``5QS>PRz zFxISSC5*m52nG<}jqCJhC=E@w65=idqLo=b$)J%Xs1?olI);>(s2ZOrH+)D$hIBVa zl2H!%(e3!FSy8MUpC-x7%>H(xS^l8>tG6>762>%Zc=2r-=DPa=kTT%Zun5z2{0OGI zdof&S)_D`oPI4BOd}lv<%62UohHNM27V5%+7>&NHQZ3K7_dm(c$VDNG=yS?ns^%va zgnN-?nmzv-ugeg77(XpO-ePpRTI=UD9OiA|mXg=u?9e$`$Ouct&G zLu(V4>UOXYXLRiQE6uq2Upzx#$SQn}= zxHo_S#w}-6QDLnNs$P2BR#CYe0+a@nm;aJ`eFjPm3iSYHGrxF%j4FMT7@9HLLvd&w z^)B~~ncL4Swms)yOUwkJrA$A?QEoN8v0{A38P*;DpMADmT1XZDi)p$Es{1e~ zunLmya3j}`{GsM5o4t)g?lX){&7I51-jx-5@)zx@ym?BSFs__nL(Jn+O*vubiV-*} zwpQBp%SU|&H$b6^->dZ5dZ;t0Z^a-24}_bMBZ*? z%jbmvh!xdKj87J@gOW(pPJO9byibKSXdVVRuLowOtz;)gRK`?_r8<+d)$bxS!Cqzb zEapZ2mJW)J6x_UAn`kHuN&i6I>n zFg{rA&2I;@y1macQWB6tea#z4Ee*mf^Me*! zZ7kjWT<4(q8mR!7!e`?TCiePPW}sJ-Tz69p+t*6Ze1-wlp@9WNy3#Jc`?@x1(qM9O MJoMvZwEw050b)u01poj5 literal 0 HcmV?d00001 diff --git a/Workbooks/Images/Preview/MicrosoftExchangeOnlineSearchAdminAuditLogBlack.png b/Workbooks/Images/Preview/MicrosoftExchangeOnlineSearchAdminAuditLogBlack.png new file mode 100644 index 0000000000000000000000000000000000000000..14d43866d58b3f6e3b69abc116b06566a4020934 GIT binary patch literal 85845 zcmdSBXH*kw+cu24Z6Kf^AYCAebU~0_1Q7xP(mPSA(u)v!RGLUNH0jc$gY*(0A|)bC zkRC`-N@yYUKtjkHx7&T+|DWf5*Z0j@SD;5Ds!5irJ)YYbU!dGVjso7lXXJ0QF?TW8 zXnc;mT{8^Fem^KRu`s=R&%w~;sw)$dV7?JGv&dK8`Bx^Vfaj^df~6WS8#Gx5N61Fc>vn?Q1cyq^(66ZdeEldW;)MNh!1Yt zSb?l?iqfpVH%+N0#XtL+!2h)yjLxY+t9AnY@~$p& zr+wbb8{Mh!k#sXq&!~U*@qPz7+hs4x`>C^~4s55Q{2|K02KVZiX(t|s&$z33qr+=` zV_T^pI2H_Ql7*T-=BhhXZhG#U3G;4=+$e|JqqBIPO&2t+-@r&l90IPVeS$=bnZt7bw$rxq>45tBRRr8Y-|N6V(kF}p_ z^0L|$PEWsu6iiNH?o6`_y9=OrjZIl$+a)y{Uv{1d5ZOO>_}y8AsVFloxhF@2$!WnF zo3y_Rom_P-c(b(NSk#Y)Nwd^_)6g_fD(Y)Dl(-?iXd#K2y>`*>-yw-=Cnu}Ek)-rzJOE%) zWI@`Oj<%;{dX6-1j8euoa#R-@xYJ?J@ipypTYIhhm{gVTZ{dOp@bCcjH-D(y6VYC7 zh%xfiqEWipn>qvUW7idq_<2YZa?l{}b=%re_uZ{(ojtajdb7vy3}42$M1YC$gK8h9 zDtd@~zc02|FPp!-sVc1{9H76V6lL4as9XJ94Qj6)Ozsxy2yIYCk1c$;093Um)Dr6o zZ%J$470VG#BIWWKG8gs}vNc}yC*M~Z6}HlRwOcsODdMmL!)c~`O{wqyTWeIj0RVt( zjR$CJGf`7r2QA{!mvOp5H~x65D_$ipJn=rl{1%<5rq+E;hN{_L_%TVc6D4+oHQ(Y74Kcr+FYBi;| zsYNU(w$7N{J2o(d4Mdv;%ydU30@_-9FkdpO;iBAaWTkt*b+hOe4^OncSW1!QpejB( z5^B^;S_Qp;w(}ag0BXs35^wZ$9UhzTD&1s(Kec3{L-Qe3Yr<&I$ zzkokSfCVD}eJi>CSD*k3M%I%!rbYr;%w|;jr`4T?n^WMd`viEq%mv_{Xqk=9U5^>S zc)9iU1sg6QLuJCFGLzB@H=4ial0oPmPv6zm-AH4z{Qp zN9EwWhIjnFo>-ID#P`n+q&A!%h<@#GM1?pQEnH2)_3^X&eZ7J> zpeTW;<#Jro=Dr@dzQG(ZZ{w6}54o!;XDovpKWL(D{c^!>^Kwu=_H$d8_tSofbgB2H z<(f+hn~xkp(;>x-+TR{!C3c%<4R7O@ma3MR*63(YCIa-`TieFR0z?Kovf=wGnrQbd zfAIS_X+SBTw4$<(iCYsle#dZGD}4^0X9r7-9ChCiHeZ|WV56Ci(a^;74?l0fGo#0S zS?lawJUL4DL*Gq}ZOa-N-dm$v0=q%}^+2k8E~Iei;1=r68GzH|>5p(|L-zWHXhG@2&& z%Stb~U@m7k?~@RBjBa3l{&0%W=7?WVRQ&dA2&pb07nOJk0Wp*ghoiTdZ6T2;e0c z$B7fAI5C9na6r!y2fhl!0bgqeA0iWC@u3O`eTIX%Ea%*sfjf3&xZ5#W>6<$@&Wwfy z8cwg#KH2)RKEN${L2iolta@SW+jmqj+CeN-c7u#7(mBf)!$Q*F!j9iLoaw%};4o2< zP~@BKo8Rt>iPZ*Wu;PX_WbE zbMiFADyawAQ@cD0IqIBWmx~B6-^mr-)EKA_7CT;?M%gJ3x+yG$>ozPM^zjxGg2q*bUN6T zKzM2)h+dd5s~_%*M?6zhN~y5>fucFUsBBD@9_|7TX9h3W2(9~kJ@PNzf{Sn;)j6TR zN_8sHfd+ELzMHJ08J!2D*4)pZc9*RUFw3yZtcd`y-;9GUJy8mx(-}wSF?x{i3mrs( za$biv^u8ly=mJ%tKSSd!gGG9y+Rq6Z*|bl$#@BFa0FQbr=r=(VmuT5HWE#@Jx0>U9 zX1nDlveucD0Y_#J24*;2F@*%5&vC`F6NWsYVgWuevYqhwjHG_fjWi{uL}9Djpg`q= zlJ)(5(f0c&2w8C)-mhA;0p46@T5S=0A^&3a4eQ{+c8`M(3{0gqe|@$&zU{VNTd|buAxM z8~zgh9QLs?w17|~2fs7nb8^#Nf72p;rv2@9W-ZeiN*JstHSK!|b$a^kQg#3P^Oo$y z6$QUMdyd*PY$zVoE9dLp+GTdq1UzVQ>_83pS6U;HMXO8@sEg&SL$IRg;Z(9>?anmv zjN1vb|U`$HOtJ{I{w802c-wFPRiF{zV)Nv(8c!joqq1+t}k zAh}Da0%)XqjiR#>bgL3fuAK zPV=4sQqiYtuD6=#8gubDYkmdmd8pm-gZdy>WY(!PIW(BNW$0FHS!f3Ph9y4eVx z;i!44Fxbkq>03Em?1|i?HD8#)MFK-&w=0x{daF;ww^{|P#6kLbQ`8GSy+NX~z1H$; zBN1hwF+cvwCZc8IL+{x^SL#6Wt0egx(H3Wrn{rsqq=_ zd664CehPDxtBy{Ajyr9ZZ(Wn60qXV$?6m~M=;pOyO!78W(n$s8u@Y(pa`B&^MFxAu z6ikhKJ@}Zg7qY%c2i##k@ZL}IvE-*4O8Nn><*s=iQXJF(W;hHC=HiIrXWpv?f%i%` zM;_CQH4GuRir?(YZ4%}W64zHQ;j-)|WP4|Mpnam6m@j2YH8ya`XW~y9Hu`sM;2hJp zOWXOc`wS`1cRYAg?!ieif`*P`H8_3XDF>WaTk)?97qKl(OKrL%({_XG4`r2MV+ypJ z`&p!w(8a_)lKB-Sz_wD=P>3i>eD!3&Cz6L^ht`@lv%$wDiP$2MiNIEI77ubaI~4E% z)Q(^aNH3Mi&E5`;mnS}qu;NK5^*I~WL%NiZ;1k@<0-c(?j;b-KP3#UrNbP~@eZ$7p{H!t7CS%7%#7!Q^iCm)Lh6SKBz!#{=WywX%c4TZaR{Y&vzrh`0fIh6jaG@vn9X z2u7$(*N8vDqIt3lUd;!O`fTk1BhQhWEV6LzgI%_(#O{`s?YP<{A}$V|U9G(P5CYT# z@iaJ3c(&(g3R0yj5*Zgf)}@%BdjW0W?z?|$Th>lffdyk z6gI>0F5;UV20vlCBfi#)T(BQYUkE($c-u<|?hc*BZAPrs9)*a|J*=xyG0qPm9#3wOU&!6lk{uB1JFmOSeZys5H>(^iOR_<2{ z_R@sUJw3}>?N1}){v+njxP_uXwdgdP!9%51`^VQMUz<#c_ZZx!1_$?ueKfa~Z+x^F zV0CrQzNbgN>QI%zY1?QpSKQ?h%QJ`*U%?7X)kn6<>y;obZIC*5-AK2=d~D&wU-Hd$ z%hjF-YLXLP{6(Oy3KreqNdXBw=i?Ds3_N=2u&XIrAv8Zb=A=FOFtHFoD!3msyq?Nm z4Jv>;*^y)4ERm{llV%53h+crmVR3QDp}bwz2FQEsgqw>J3gQC~@v8MM??LW(x96=3 zdW{gtcJM)1{P4<*kN{~dEAz&HT}l>3Ufv!(sG^J1jB-@4 zeVD_!b}>NA>~bSUz|$Ip$U0wzmFH4t2@+Q(w5*^PqUnKJqsni5Z1LYT*k!rd9do0^ zo{`u{yCMg}Lx;);?BwS`*|ARXnjkObu7#zXhbQwJL|&B6Pil~22rFd_<u;g3o zk-Uj@74?L>euCHa6Ohi{yE>yqK2Fmue3moy?l;IJoPk@=-+Gm31-t+}X7^P*24wK2H2ZsPOerHvctXmH+saFw!fj zJn-xhLCoh^nUy5N(9@3QAj|qD^CJ8GCu_P1~mPbUrG zvq$7dE8STB;mX0xz6tIQX|5)R_6h9UDrk_5h8zl9T`uzX0N&yRUIfmn>-Uf>5n6}5 z#?9DPOxLZigU}_M0*^KF9eimvU_YjtF~G`k}8}(LLpZ>APxcWPWiharx={c3=KzcxAcFJHGSG?L1*zuADNc2&mT= z1wHFiU(Iiia>HT%;K%yP1!94r3hH-iD%0i=KW@64_9}T>zi+>D!80p&p{Z>yVa}V} zSX<|TY`_Y)^Fw&1b7`sT5EV=O4&M+|;VJfodMvnixd&h2fV z0FghC3exycOrDp+%;8Rinsaui^f;`9Vl=>X3QFa9lI`Vn3fpV^wcZ$sfN^l^h!QKw zx!x<52^aL^S71CAD_mZIK0m+xZmHLtF7ys#~|$G{+QFe#jqGdvW;fG(r|l%jzWz` zQt%yI$UN>}bLMXeD&hn3^aXfV791A6u|%EL z-d1Dql~((eSiwA(7hSn4UlbUX1i@oHk3ZB74Z~8u9ztZOW#f7C;=%FpgfmJ>6?XBe z=C3)XN$$np(7JwCV?T4kVOy>vXK8KxxHW8<%B&LFyymWq%=)H9l&ehH)(fK+gyUPM z&kj=zKgPoYw)CZmTdbC*CH}MXaSwjE>SLGA9ILp%#=E!)`Zusc_ITJlOS~d~e1nb8 zDtwmicn^xK{vg>hNlw2kXCp#MQjaHr!$;7B(#`#8J7wpuLfXp-nbp|L zr@2WZLq(FR(EED{Y)%Jrx7^p-oSas0MnGM7>lx1&pAZ5fHWXctVhpo!PjF_hl^3wdm?^+Dzle zjRHt719`AaPMx=ow~K)>7t0-B1sC=Vm!ql>eyh_V9MOVYNA9fHL${SUiRx^kSytZL zz>SG;c0C%=@<({xRRW4-hqO66f7ckqIaB-45$|#BDNDyZyW7z(FlV=k>q2~(9c;4C z=}g8~vL8{hlP7xg(M(%ox38$OLshc*329t@Sln?k{M@TD?wpL)(S|BEy8vQSe`q~)$kN_XgWf+FCQ10OnoM&yH?FmJko#*!+fP=nDB+U6SFf4n zfLerPP;tZAtO+sB-`fW%|2*=+cxyz*92RZ5ePmzVt(o?_*-EKi;cVBs-B;$jYIE2r;&W@6%j=D_LO< z1EmIWHP_`81pI`FYA=hiY5lbA-~XaYKBvm?K0J$2k~`Bkw~>}gMi%qxC}0w?Ge&N~ zS^P%KRaUP9PHBCbw0$is_jpjYRwH%)Qpm<7s%EJ)oA{PjSqUP)m04w#7jP<{jSsY8 zC6*f^V|Gq)%3`L$ZGF-_$KUrQ1#Vc@m)T4o<5DSGhX<#*rsF$eSCIl+Eh8qIkTu^U z`>v6B%!7NOl#Gw&hv47M`_!kZdHTMC-X)HB`%vMq%;}_wGb;5Lf70yM+OHbY*029A zxx9aV8A_$^o7hpu(od)$c>{*c=M{v{*O~MkkKnZye1^s=&R0K{d@n~Om$1PbwN)$$0s)dA~qHvY-em0Pg@nk7q z*RI8pR;T6}Ga{`UHyczYK?nPNCUv}OsY~o!nk8~y^v*DlGiG{-({qKmXiILbR-RHQ zq&Kddwk%3 zt7nN%Z?qF)cbH0e-Y_>A`1wbPy;0?gdI2^7p1$VQ>LBd+&87>$Pym ztjP*tGZ8R5cWa_HF#hfjWLl_ZK8{h9;m_4tdQde6Cc3s&!Q-emSN+~0y`yM15pEGQ zbYtQ=!8;d~@m{Ml@@ME8Y!(r2Etp$gqA?C&tIH5f=a+IjY*aEzn2@6o~mf4$q+H)Rd$Y`A?vDbYz$F`aSt zMkw2yQnJMv_zvV?L;Q$bX#?AufjpZOaAT2j7Ly7ZO19vWpj|_=pghwWv85GjJ!!x= zlVPoF)NbLy%3NWy_;etkxW3NrB^gXCQS(g--hbYS}A3k zaS)}O4WL64=lVchLF0-Q3!9lS;)jDI^4qV*qPI&vZ>vwH#GQug4#G6FvtNSPN#NR7 z4EwT%#2Q(H^&U=xT@b0zqCK<7yCEae*;Gp0#xTNv{6WLGTY;q29)8HcWs13_ME^XW zjEQLLHdm=)aHiGl;wh|LafX(0nbshYUlV(8z3@SuyLTs(bflFK-|bbYe)3GujN3nQ zHIh}ISV-_CLuU%`nuGfCMS&#dUYD|OmM$BeiH*gt)=Z`GxyXc0`K!;LuTvnNBWusT zaRXvai}$u$f(uf{I@prC;F0zIsEbymhmnc_ah1uSZvAS(ElziMnP&Ot=!|xyw^}KJ z&yavjuZp>1U|eHZSoOH8w3V}8?wWE(jFnqIwQpLa;NIj@;;S*X<7}hS^bc-n!YSpG z(3!9a_Is{{RE1yF)7T~(mwjCHw6?9|sx$cNVry{LA2w|b`gNBcskGyauAA?cIy`u9 zQR>a)Ca-QS!~`wbs`MUrp81W=P^kd;Zvga9MH6&F_A|HE&{7&$D9t)rl*I-THMZ7d z1k(-paGHVXoH21-xxSxCm7yu=3bX`)AKN6{+gjHoRvMMoj%_MgJEP=HU<&DDe33?9 z9@Xt4PvFu7v_>UuuU%8@WXGM3iOQhb5*W90M?JdPM=iv9w<@oQD|sx~A37HJJav0Y za?YCt!p@XD7P_TF+5s4V-^w8J(x@{bW()>3r5-4*!c7Ek>4SMA zg@5~Qs{C8~iT4%hzEEpcOd6@=b7kg#hB}*)=Ege~Tl>xv@qN&!klsnL3dXn94+3WZ zk%IFPh6@KBGrq!Qahv;w5pwWa4(K(+-Myd%I@&pJPG7_WPV&3TjEP4u1y<44yzDX7 zw*uoQGh@euR8fPVSspk?OY^%;;dEcu3F@(Go_oO&*4Hwmi6uLY=YH}R z?~NxXG;#hdx+><6%6R%BCYzEi><(H^GxW55w>1^N`Ou^@O5dl3ypb-NkiA`e+YOu8 zEilrP?|HWEJ{tHl^P_<0=tOQc)M88PFW*oHSwQLZ4|O|+=X151&W-HO1G)K@sZX7` z==V>eZzSvc+%0J=^RKYXdAKH;>6`}gc$D`P`@^!xVg_yHRyGdnyY%pU=#2)V@N*IE zb5h)IGL9)eb_(}myy|Z2WL)$%GS0I>cG_9_pww#WPzhVB89Pj?^CgdZO2bK=eoRXW z;I$>{6NPbzE+2fV#c5WZbyT&-8%|5^Vm*+XK2h1jMg4*)K9{3Jufw)!vTbV#T&BE$qr zusEcA*S0o|AOJW^uKR77qD=&OfVO8CZg^|jp1Zi5TTs{AJY&%#f}6V*eM>c^@Ev!5 z>)SV$L#IFNdtf|{10jYpEdxs6UFlF|cKJzo?x))anIpVL zV8-Y>GfS~H2R=`CH-A<>F+WrSE>vf5(Xw!foT{c7JTH^8K@i-bM`Getw-#Dwvbn;$e zw}1D7R-kSKY|I5thEJe3Yxa4z#eMM zxxN2Anl~`Lfn6UI z=MOiJ$TNPA8CJ>6b-1jMCAyn!>yb9x4MIe@K=N>1!eEF<7&Z=zM0$c?o;<+jNu8mZ zA6TJX83sIA__uw?zaa&vIn5w7UBBzQKb3iShM`AzN{0MSoyVF-qn$aBKbin8R5el1 z;sbawFVAkMCf7Z7h&Ga`YhrI5u)Gv&nobWSAn?s1zPb%L);s>UL9&V)e8jD6qn7%?9aaG61ujpHn73|!+9 z@XQb_RI1_H6LdbhM|g3aY=+zZHcUstXe|z3BR1GKQye+DSxK1Xgv2wszGl&L(ky}} zGojvho;;L92GNi=ea6pUD2o#{+B(Pvqfz9#S;S9LEZtmFjiMcqus}_M=%I%OLmt{3 zD5(*@%0_1WE^1RHGXZIUyk`Mr^DGdR{BWVE6&o;oS=c=Vk=Skdu3m=5u+`5mPlu^O z5)ylm#}f@xVNs?a7B}6cmn$xG1r)!$qMEF#`7?V;-lW%lgwuwiC;+KvuvVe_`wCAKj}=Mpm8yXG~$E2D_X3o$Hp? zI@gr_3l4^$U&lqEGivZOiYImtuB`H?JRsn$p6Q2}!zP8XwLd+XYqPU(UJG@6iwOZ~ zFL!-VhjkX@vsu395tvWVqLf`Ajb2J^YY`#)sPd5~$t4#@eX-D@z^(~{AglPXr&3?uy(j%t>4Y7;km5;d zPGjCBxYOI9EwXK-2unXRTu>UGUbtQgS+yGe#{d45fFRO-rrNnnpk1z1C{= z{crdtC`lDj@nHBGKCs8Q{X{vAto&y85H=sQT}zl*vgzGkKam+4o~9pBgMRa&pX5e$ z(15LlH|@4VA4C!1-}-IDIuh?g26Z-f`TxmFmUIkM8H|l86z%J*JbP#j){i`5DYPK2 z8Yu~(Q>UUCI&Rxv^;SsGku_ch=#Op3EKK9y1jHY>pnUE^45w|}UDYf%1ltqu>!0=U zHI1&z&Zr>ShXb?*qxgZ@TzBgGRgDzT&6Wj@n5O-H#)orE2Boz}B_dK{z`}q>&h1dX z6hY&=C)TCj;|7^#Hu^Z<26&8nEBdf?CM7QJr|%#Up zALiZnzsVF{5}@IHko9cV!B!X#LeC@&rm)fLP&X=@S5WCURmj+01P%<}#{{!(`b`i< zl|$8bbcb`yS;0ZU9P0Dl+vwO~@t* zlcl83O$I^sey>h5+<5fPi?kh1^-@{GDQ>%|;S7_9SHE*+$@TYu=g2W}8t-`JoYU#% z;l!yC4OD({6S-oEaM~)Lu>5%)cbm+40XPO2aCVhJW)CEGzk7asVol2G3}3vVB< z#b3g#J6EO6bTzSpFUWwz+|~#aT=l36YWdcnegE=|;YyK)bxStN=v}?D<$3INj;{)$ zL5LM#<(m!K@hRQMB@}+W0U2-9ufW^>N_Z$J*NlJ5nadc7U7wK+8jRDT`;qI0mFW-k zCAKkc4;eSoMeb{|#1UH$u`PsG@a8%rfwfYGJZuOVNaVZh{1-)?Un>LjRmr&h6Y`(@ z`fFxkIN(=dsa78zU3t^R1e^j8y?#%!m3Ow!q+ncSfi5g2Q{nOPUAVzQd~wmxNA6gJ zs=4z%NVH*-o#og z8SdvRlaQj<}e`=gE^wBpISyznBS43S*wQmqOdZR=Rlc^2GT0?QlQf0W>E2#zlK zq!+>4iT^oQ5G(F(B}A4QbNeSDczsiVQq3RqWlApT^A#)cNok~o77IrLwBl0r&f+oz zMCT5mz`1>ca->GD-Md$aJg&Ym-!~9*ZLC}oP_gmryKgY!bGxdzi~>J4vPrdZnVCLJ zS7LlsQOs4vfVp(tvH%%n;B?<{i%>c?*)9)fE)#dU+o!R)L;)+NBl`d^?@9)5F-ss-HFbLKEB@*_3)4UC= zc={AMXZ{6Jl3iwj|F=ot|NZ{|8O_{54!~N!9R7<;u6Ad}ISo<%i&l98C4bpCp>62z z=lh!}?m3GF2`zG>adDHsm;n@^-7Ga^O2Z<@SNDtD?_sCFOtpYW0Ow+yTf~De`iZ%G z<%B~?H(qTMO%Dk>f4)J z{|7gqy5#|7h91fdUAT(XiReGC)xJA4-bl-D&eP}ieIOt5gz&9!?#bKNyJB>1nxk&5 z_MH7`jOV{ERetc(^!CL|FDB8-lMs@^hZcZ;VYwHE`jnzb`Nz=U@A%rL`R1!jqHm)c zAO&vhy0sL&Nc{CMYfT2-+k2YaW!9VO|B8_e(+vT@DnB>L?E0Fx;rjW56m!`%G~$NO z&l?$yKT^<%0C5b6 z2}022yQb?`mpN0_ESbM7>h7z~6#Is%Eqf?lb|o4vO9YTmkp4yMWh>E4jT>MtmVbmm z#aUZb6MBXa@s*#)V$M1}E0ji9bPx=#o6J|-HUx*tzAqdQM?IP&T*%k3e! zKMydYo`wUKKeYWR^p3D>YBuMTMtI`lkJZ|v7vpfp7ha#x=<^32&=!1@a?_M51F2@3 z)TCjes=GEsx3CTg5l{Tf{G0Z0A#6gg z-^@TAHJ){+lXiKV(u=Wm?*11pp-yc!mE)P6moeS1YjH;m0uYGdwrOVZ4s*7besl1qH5P!X*nhWNn zaGiR2?a~i)p&k!lT-LtW$~+zhfe*8_v(&)oPIc2<$NAp=;w z?%_%^%af=y=0BF)Fd*%oz1>=O+nr@wja#i~<#hOCag^bFQzPW(yaMY<`5n%F)vm}d zJkj!xJR1_&1Sunx@-rM@g3P}WqUe^5fJmr9t2zVj`@xY$b;tVYt&?rv)z5O9fXsXv zn~^ifKS4JY6~OQp#ckm|Zw;5F1Isp6Pd5J*kfBP`ZX@K$zJDW;9w5CYeG+n zApW@<>u~$mBg=h1=jbI2J5*!*TSevmFnm*C?F-@{{sk|~Gm{w!59)4~gGKQThbkR+ z;`z3kE9Z}IY-$v+x`o-j`WJ~$w7Pf+xbaAh3Edvy-6QSo>*?)r=c?Pe8)FoY*?o8+5&vn= z!;3V)4cM9I;0UvGUn{ay5--1-M@rj2d#vbV?R!45bs?XkAQQn(=WZ?W0HTS<@5#15Y>Mcl|y+ah-&?PBe&ooxA1JI@LKMf-`5t3az!#v%B30Dk{W@6JP&#`>27V zg=nohl~7ys!+=d`CP}x4oGe__S9`Gmnrrm$ZVG|9F1F?HMZrm$Hpi3dohpSJQGgqY zWQx^IVD&56MU$6quLd6-CN7wa%`u0ixu=8#EN5R+Z!xd+JD%IYXeh&!WEep@ZuUCUml%-T-Z~xOlg>Zn3fJFyBLYU(@ zOi~GvQw*rwCGPk>J{>qM0i^KAQ(b=JmlT7{Kq=|)M@S7vXT&UiIti&&p1h=S6$ilm zaoB(}JQsD}l*8aWltOzVU%cnyN@obP{m^06hWs4+uU`lJ&mxR}jVsmv>!ou4dr{K= zs1G-80agW*z)V{APP{59LDtvzQv9(H53Z%}6%ZTG7UyzHo0;H+304H(s+v@P|B@!$?atKE`h@)pV#7rIc6%{A{XO!!YE z{8L?`QZZN2WH`qYZL=ByV6-=X(&0th_J&bGGP50FhTsDCQQ{0Q#^IVjA*z_8^8+Y$bB;`m3%J$F(9 zHEVq|{N8_at$l-ORc))v9uzFhRQK~Zg%mW1Lgp|StPG>Lo?_^L6-$2i(4zIYS^djq zjypLCX~ugA^|RAa^u8oX&xeH1ZF3WHe&a)Q?pXtNH27;mE<~?LKzv6K_R0FYxiLZ> zhEwTqM5L~&uFhj4#B!_#{6+vEa5Cj72Ik5%^i=%U8{VqZQl$8l-cDQayo)st%DiM! zd{P`)0XNueL^TD6g|mo8N}Ow_Ed5D@t| z#5cQ!1FV9d5Bp|fH&SV4>h*J1-65X|kw3NmtYCgOT?UUU)38~>j4exxn@MNzZi)DV zC&X{Dti5Oxag^LSTq6_4rS(;#HHUP|F#j=Mrjb06?tDK*~3T%7dXD)z&wW#f^KoN6n+O^w*u)XiDSdVy}GyA^hPf1;KbJ5>Xb zfYkZyGa0t64b>F?a7Z>$_t?FnJ;8Ym<)#6%{AB*E5mdLl@$D>4#_l$^)6Y#nI`4NA zma`yfJeFDD*0)N=)&cf6{=;)kty|Z$#ze=fNuBQrsF0|5p%6_5 z;uM9|@>^717^h|^H z9nX9BSMI7J13^tq9{BbO##97jDtdw`MrHA<@-T#F`3`Ky>Ht(cenMQLM9bexSA$( z=RYig(&$9M(tp-C8!-MG8&Ul)E^Ge(h^_ulKmT8><^JzZ8>CIB1c<&UF-(ddcAqK zLT{0^Tq^!)hGs`$Bw*Pt+(NTRE2X~Y!TSn*yZuI_`<>n@_lIeJ;i3$+B@n;95L_jYgc$o7J~7i36!iH!gG%e~cx^{_#)m_bAY%KHPk+5Xk7Jf8~~# z(GU46;EP+KGW$22|GfE@^+kH%*d4++U&LWtKr-0*QaM5(#U6DLMPJHu#qQTP1}K}# zDrM2PL4%fqorK-8)u+;Y3Tw0f6ppDx=8`%4&c}aYEJixGXlSHX+%$Hy8 zta(6)nc|JUc1jGCNAjcov~GS;^Qopcf)o5@+9|hEgzNOuxGW}%uhODnH2z4_U%4>H z|KA=b@jc-ITFfkYchO2erHR_!QIynfWU}x3927FMbc>i{?yCwQDh4dFz`u)%iLpsJ z+sAs%O-%w(#3wCntMWRqwh93cMCPp?PNCoZq0-F>j{wB6&0S9eg|;+4z1C+5qb|Bm z_J18_Xz7ehn+@Y33TLVZ@5(Iovq<*8DQ{5daBaFO!d_wSD5eZ`IzU9Xv+nerfzyeS zmu`qGM)$yOOs-UO$hHyGSIxR?xPZ^104!FXFAsdPf7a`0Yv1W@cHda1`SaP%}uNw3zGVqa2#zCY)2oCG* z(v-HSEKjr8janT=(!VQ$ z(IVWs>G{?ld`8q+SnaH&4}5=yD8D-uy&JOie&C(>tX1k~9^kzbcOcFI?!_CpxvD~2ZY~HA|`}hCVuj2P}GN3{YU z2lHnYYn$~B7fgL#1QS+W1GYNPH}t3I;?ZJ0n1Q!G!-}Rbt73y9t>tTzu_4+1XnIu5 ziUqU3a%`x0*9uL~oJqUJfD6uMnRC}sK8RzbD{+dFR)=B{3$keVNc>!|N5r|5WwY7q zE)yL42?eY>E9!7b8|fye1P9-yq@a!Jlz@;bKezt!ir7D zMEmKzoT5|X<<{F)g(4Bd$@E+>OEz+Qjlyk66ZxIDJ@&icZG*Ebb5QYPKXNUdgy(dz z#E_|V)iZHTrD?`{`vh%OG0Fp0#TYTPX`4-Vp^;ddq#})DH#kIXhD^YZ`kmaf z%k(h1i!V6Hd-d+#IOuK_@oi7oQqE0jt?wg3OUi0(Axj_LpnaBu1?O7LJL9oGqU2d% zE0tNk6Xw0wCgVb~57G3?GLvV|O}wLy4_I(TWu>7(|+6|D>ca(B3 z?CZPzfRk$JFB|gxCuaY|K%P6vb&1_{JiHLB^|CNSW{>%L({y%TRD50YhR7mY&yot& z`i+=+I=rqFWxnX#P!SwNf3eDAT(Bd15)gW+iFmp?D;U* zHMd4%L=}Y^%Qt@4n)@JiTvH^%V8EbC9J@lfsX-XuO*-5BrVzwi>V6w|?h>ax<7xM5m zw0Ujecd~!)lIDU87M6XCqzey%q1>+qi*R7gR`mn__>WJ0hMSZ%Fz0FCc1*B<2NOSu z{w&*{1&6&G_*~I$GnLp42_90dlivFXig~W!7u2-X*{jY8N?Ao?lSxGHGfAbEJwI=D zUYwxWJ@_&K#Q((wVhXinMuXh%Zc6C;Kp!HX8@=&P>z`V$PzAe!p|g^6!E>$b_r1>X zti9Dt&@<=B1Y?uhTO1)%>fU#*=|{NNeQMX}@b8`->QU=Rtl)DbW_h5fmAnPmjE{4~ zLozM}ZpyBbrtEsHPhqmbIgM_TMf=Sn(s1Q5Gd96MhU&u&k^$R$((r& zxel?^X<1Fn{CY4E@NHSFauFRfZr5CE|0HNXkU~1?n>3yqzp~l1=knD~Xr~@bb=aGp zK(rX`lViqb1J>SJsJDRn`RU2u{TI{jsOV$YAmRX}=E zIwBy_Ym}zc&_igk0ir-4C`c2fN|)Y2rPn9|kx(TRAtV7p5+IQ5h5Wtmd+&LkPkYaP z-*@I2KH)GX>so7F*IAC^cRGwmwj_XjZB~gYLim3#!0w^(@%u@ixi{vnuOiC6T`;mO zt!s^b1m-*x=&^5v6M67u)sy`dR;W{IeO`QtacxRw#Oz^0!`-jEhR@}7_mf_{P0=mZ z?w@+kSp5N~wKRk4;U!;BS6FOQS=qb_R?*JBuBKrbmDsUX1Wd=o` zZWWod!iBtPma=G!Igh*u+yxI`c)^CMV=n284e%g_=-AiPjMNQ~b&AC&8RLQ~g=8E8 zbyTIJ007)H2a_j1W2*;Vzsxf4nN;!}?O+?Htxc?^gw)Y=yi`>^toeBT3fXPwy?XWC zg`B4@_717k+`)+@m7OXLGn!=dG$*v7$^6|v!S_Xa8T0zdix$o$@Mn#m zn!8#;o`qn>m9(g3b6u0e=j_9P&Zo57NZ&}Ag>XQ3 zyb=(DmAAx2LEBZe@9Cb0{tcYvU;sNru-LjLQOL9a2ukz2Y(H!HIqO^oBVKnfpb^fS z-9~jjbG7qtr+4oA9==*Xm-q5NBig+nxmRCyB3qOvmt(;J>DT)!;MOzv?NnXPE3&HE zBPzDlPjgZs&7&8`>LqxO5sz3GJO{1D{wo5|R#Qh7nD$L&8njQnqpJ9Hg{37nE2s5o zzslE!d8GRpuAF(`bZfW(V5<~&RD1SmBYTKPN==UH-u`zm$#v|c?(4#(;WuzPDPt{9 zH9c*U>9K~9!^WTFqtdge^C?x`Rj2LmDR*}Zunr6E2G05^H@;su_hd~i=7DsgzeA&3 zplaIIS?RxF>gy7q&;K$=rsXT-TUH~Gp|Ca$Zw$xa1A+8I`ijHfRTNYP^iSu>sl%dH zm2taTlkz#8Be>)&`nFG80E5++hT94Dnx5_EM@yM&G(&dL%ij0R4d1*LdX}D0Y z{UvLarp_fmG>jbjY3#64P*@__kIf8uv0CZ~P> zQwI3gYW$yD*aq_EuwC1jWw|M3VO|fYP`8#%@b<2N)AK#RHqD;Cpo-~Qu9WX18}$GS zjvngRof#Rz=aG<=5wh;^#M=&N{sv@RQB49UL#s0KZ^=>24YSmgxg1ozT^V`!pru)@ zGJ(Vk2n=+#?gE0l>(vR$nnCHS0{FF=yXYZ>s}-`MoPn+RtSUQJe?9ZEV&vFdi z%km$ui2(}3()K{W0n2`giyn~Jmv-G~4{j#*+B`JR4SlTy839VqbLydwU-4#p7rK+A z>q*zz{1v%B{!fG6w-P^NH12zBSYxZCJ0Wx2FWC$00$h_JtAvzUaa7q+%kntTnV}6# zox_`=@#OS4>fK&4NcrsFb-Vqro^0*5Tu8=53aN1_@!pB#r7j$PtL=8bm-{rS`*YxSyUk zDreca-OO~Bm)Bv#dkt{No*epl+vL}c!GKJB)^Y?WzQk=+9XUgR72yq}=L5aqDj!i5 z>5ApbUo>^6wEtG`b-01VyJ%(RXPOvh?&a|O^zxZCN(Zmz&f)c_XKqdgNy4*}*EpTP z?}9YUW4SEW(<+sE8`ZJ9`UCL*9tq5aIp^+j7BrQK<|#G#)o^u7frWc)g?|vgv9SsNA-DA>O%P>R!42$d=?uA{7Q9SB?OWm$ z!EMmvmrOSqQhFUy>Yh5TyOf?6`%6g|w~G>!MQO_?DuX*1t>YP?Vq~WcSxvfwb?WaU24N`^YyeZxY0-GgSMPAvdk#UBrB}%W zH=jox%;w%BLUt(&*_gKrPLzbI*d~2w*$ZO=Z-6lBA@JsfWN$el%w5RrIeB^OdbTci7b@0iLd#Kdg`35L%p%s z8iJ+wVw?-RM(6tt-=R5OgQv%r^wOlR-1`^q)$l=&v>bCCB`C7IIm|2|C%ZsQAzI|_bB!? z4|Pp%%|CCmC)fHc?9CUI6_;yWVsWVRYomyzY(a$|PXlJ7UXc2U%Z?Vyyu8`iH(s#+ z`7XxD5WwlVK0m8j$LX~Cd%%ZboNy%+u_-5Bcs=*HO~4speGEHzp{u%vH%^A-WMZA- ziRk;kauoctjS3qa$7Pp1lbDmkwB71xBW`n;Yst>E?(}TiF`l)V6ynzlZ6O^K{FZ>_ z*J=^~wwVbcH>>^RNkum~ca8k2eaqr36b=FK1{M5A9de@vHda}+M$T3ltkSoxBR1)4 z#bqA%6VmX0_o}Xx%Tl$?rc}+=cg*>ybl-2b?sww+JdZ@Fr{0MIJh_YbKKoM3*8qgc z!JY9rGmO6DpV(Yc)BW=M?ydJ183|mu;8~oRQ}Nk_r@=Pv2CbFH*o<$?s*}q%V4qCo z&-|?}%)|FTmxR*l^H=M9J0nXd1FOrE%`=`@WgfT2$P4%Jq*nn-ztqlFK+@VDl0qC* z6F1s@Y>Vg0(j2l?5XFXgoV#cZTB61UQSlAy8!O=pAGx^BgE|P?yh8hFaQGoyfi?is zxACx9$g2K@N8Du8mBcF>G~rUg4W03r8fuW-6uM(oBakL7QpGEu&v zw6LP32n&soN3HH9=+i?!K5EFh0|%gHH;yS~_J+B?f%I)n2Nb~{8Z@>|Mo0+g)W$hR z8%>wj5FxxrkIS$~)j%!`FF#EJ?4;i5DK;wlgC&(}EO}QuCb$Ql0{hxPXrauLr&;`R ztNPJH;!iH$zn?nbTSl-d8)z3YOW7C0jf`$=_)w;VzfC&xaDe0+0b-FUz=C-Q<7ZKg zK&hm~HgH&+#RDs5w}n1-%}mRcXy;r^6#Lzf-+ba4L4iWt!C1SKOG-5qa=+p07HK-( zMD)zK-MT}RVI_{Ej)_~yDub=Yuy`kO%DEEjE5_J3gh~vSc~P=F4-aPZ0* zaDALc6~1=mF7T&S{ZBvehvci?uP#!)KWXY~KV`L9iJt4g5lB+J%FZescl2`^vCOse zP^|_>Db$t9(x>6Qg6$@5oF&ccU@)!Z*(1FAtMsi^&D2o(Whn7P2XEuvv<1Aatc~KUCfm?2V|6F3D^RB2k@2)Fj{_bHTP3)abOIME8| zRE89FUnVlY2Jm(DZ=q4o38=NP!}uI(=0pcQ4O(K+*PulK*cx{6=&J_I8+XmP1mn&f zS?FE?=i^h`H6O-*6Z*!!;M;3mo_h(r1}HTSD}UsnlCzDJ{4U_qG-2RQc6zg%2u@4? z`p608k{fmPwBR*zd~xD6kVJcJ$i3wcGY$4!vhTgm~zAQiyCrC$uvOY zc3_xp`b1PsXYCWrb91VhA5pU?(v+J_t2q9I;A@0SCB5V7R_3bBYD;MgjSfka7(HrL z1T**Ji-Pps+w|-^e%4EW7D9rqSJ$Wu5^E`QZE zkN)5wKP~}7p@c(JBM7}qsGo?O4f}=?!c(7Y-{>6FtFgS7n35`ZdnohwSd_Asl-WrZ zu~&X#Io(@#R%4y~Cl#TN4O>I*xa~U34mZ6c+@~lKS$#+H_=ee+ ze#@eJnqszRhJ?P#^9uU|Ag$SEC&-SqL#XnHkpw26wMB*&~mLRF-`^4fmB&s{1H)p_)!-`2!k%usxS z`*$kWs03A?f7*-fdHNxJ##YBc!T`)>2)8ramQuj|hVhP-&crNGV?1v@#h<0*ys&Vg`d zq;v*9>d?`?HQ^4iQ}?aIpkG)v@N*@E(g!>&iprckP_trJ6_a2!zm!J4Ib3W0SyCwF zc(f@Zab_L1x;3O^K$I>U(^gbj@F7hNgeHZn)k%vrYBIjvY}>3?HWE!dSLq~^_h7Y>Qst7EIli5Fg89N*Ge5K*)b3^dNc{@`dVM`Y_d8-AX?&Pl{#Pu^ z-W|zHd>#qXDRR})`Gb=XJ-xsEOv!uZ&zUD;_Wr<2h#zz3 zP*+4itK`kYbI%D|e-+?yu19t6#r@~+f#VnUu7~M=TIT=T=gKBUac$K3tJk_z#gKc+ zsz>U^oj9lP&C9#`EPJe*gxv+=s5qy+rO(GvUS%;Ciegz`(_tEJ=+CK;VQRT`v zJ5|ii6W=%~w?-anPkJ1eJ;v27A}1D^TRkj>NGhFR-W+JL-3x{J^h=Mjg`IDK-@bsn z5#Q{#2H?4EuZ{<%IM<~T6Tg>l>olLwWr=fsn33h-u&5*oz)!@YNVRvG1F{^uDg5Pb z7+cJoQxr8MK|1m8bLynm2c*$hX5ceL_5|;TeC%(Ddo*mkRs!iJ-v1J!HTx8%v||k9 z!mzX6Hf0oR%e!W!|JX*DF4fte(&aE5L&kDk+b*8n+RMgArB=Dt zL+bH$@Gd$C7PROok9_EvCkQRR)6&Xz?{(>3Cg@fPd_cT|FV9I&RB_#UO0~>}Trq&R zE@$*U7~EWwYM1r2y&tN#p%zq0H=->{0LuAZDXQXhO8~*wyqEKKD%wn*Qe6E*VrCPw4-qtrIlCEFqx|j^oEFdQ z={)(x0o-s)(!Lmme+ekrL%XWJgmwn}V~znN7Uvyw1_51i*-e0=f8*sqGoKr1w76wDrQl{SoW?)~GlJAA_rM=%~lq1qz8sBo1zHO@#1#r{zU?k9W@L zY`K-}1gazd`y4i?Z7R%g#mEkby3>1Eq-ed*nmPcUu<5r?fZMhd~#0MRqlbm)PA1bXVwg9|Ie zw(JF;l}pnxX6D$Monof1mg5lb^!fvQK#Hf-Yy7iX9T^Xmy)mNKFepS&jFF(GN_0pV zYNzaudN|*2Du@+*i_;+TlDG_(Q?H?Ra@7D0_o;-qIFQ#niVsOHdMDbF$iPe@s#&;y zAt9MC?Z{D;5S^Lj&Tsgwnsah8!YhNT6yrxN?UU$%9k~M$M>vNiM#^HP&f+{Tkj4*S zAN**Wwv{vZHGozMn5e4gcobW-0#MY2VqSrj?3P&BM}`t>7hQLm7gEH_@e&k?r$}(28vcNh00xQ-i5;{wfH0% z`I%|Dl3(OC4AL(G+re)7byA6Vq_!xT$d`rqyFy`Sbu-KS7Zcgstq z`e_%}2jSHmho<_Xk}l#eM}k88wI4Z&OY=ky(Fe4Qj&IL%A1-%7GFt=+&em+anUZ-V z-o%DK#q+HB^Si6&P&g`ZJ>HWup6F@8m*7fQ=nL>DBO?eUDF$mn)hR5k%LgXHknBi{ z#+{FLudaYro9eo!u4-2s;6!c5D&IsP;7hLO>J7TL>eVJv=bEW9>>mbz5d&(8&~?N) zY5GuB&k(kWe*FuKP#-#WIRlcdsQWci@dGjP_rGqIpsf*LE9n~6GC~Wzw-y>Yd48hi z4$^>iAoeUWT4wC<{L!-cu@@H8EPc2S1O;z{nK0mkffq;Ud5!ed8#S^0wjX);Go0=u z-eRdfHDLGwFdglOKKV&k>=Sun}CF#;6FAz1{Q6J3D7(-+;PB_fX z9VzG-M!Slo5_6S24@!*K$kadnqA(925e1+suKk_%=?(trh~D_Q1a4pC+ntN}5d5ZN zpS&(WEPGRCV{1)*Bn8}1LR{49Us*9zjXg~>kl8`Q zT~^%0*fMX(`s)%VPq(wa3^`s%&eaXGPUSHF-)W$M9gr007#iU^ z3IG80IzD_ZzjC0ebKXtDYMyX|Rtvx(L+AtchN<&w>x0ia*1k5zNK(UwkF*or_R@)p z&N75x$?RO5y$lw3#r%QeR&7$tcTdE<4ef+|1OoFTaM{SNL( z5b@jJcb-YGPLd62fe^cgP`6U7ej{NXUh*&R!cE=Rqn#dq<02-||ENy?mhhPX9|f?R z0Bw@jPq(pFk!4{HWNUjSfFJQUs z2#`grv4dHxe7`ct$6=jRT3mJ1o2#N%ixTnLYqm7Q2pk0-ROPlm2n__47}(it#hvJi+=e$wr0C?HMY-YEj>gwCp|Yb zs)HT%ayV+B0slt;^WuP05)j7Y5f~s=AD^f>mJ-WBabzr~vNH88zfp zqt3444r#r%X8Q*bAc0f4y?w`)E^cG7w5$&D_)dVa{vPQUP=FQ)bzrOQ>w5W3RtaBU zG_rshPJfJ`TS-%IDB2#W8iGcEnKagM3nB5Y!Tol*r{jm6lv;rB(=36s0NUbztQgK+ zCLcU4<;4EE`kR)S{C!Q=+gi&b(|DA15$t5Wq%-#Xyji#c%U zixcm_CT0U#8#fCyWF!a|BoK^GTq_W;a!>bhb9d*XMinSO%NhaM6{}dTRMI1_sl;#o z{X75RHYI0{i&!dFo4#*ZcA#xH#dKgh8~43pZIr7i9_T#|I7cOn%nqVL^MUCuOV-q^ zmZ7j8kv2F?fZz_9bXaoLCd(_-Q?w>L0@Q3hiIhIHd9N}X@?KxWVMThe+AH;Y9$`+% zuMWJ+wOpyK;bN5Cq3}YVIApA@|9!9DR{{g0bQ1!!Ru#1a`a&%aD{ny9t1sO(G2p$_ zKhSK$QB|+k5o$aON#OfId?X5;DmdQm;P@+Ibj=l^nA5NREM}(M_9mdTe}19Gzi`hr|LDoHj8JHf0jb;fzlEwf)>!vqdO>Rhj906+W^#IAk=ddSOkV% zxHF%x@&D5$v?PE%Rn8VxjZ-JDV$+~4H1SQ3XU=P=TY5401<_>zJZ2Jz1uqI^@K%jY zDF#+Miu0TShBx5owj8$Kd*v1~$79MLeN9-qU+VotTYIi+{((!ZgK=m{OG7SjyyiHK zQDfq6O4^YjHN};+gua_zA9$>*%~V1&3)fSeBSg&NycTNyHj{?qd9TcpBqK;WO?}cKBRX( ztkN`74Ow*mmX&g*9&3@I$Zyt1*vVLVa0id&$Pcmmw8`;VxvNxp3zFNCC#KUgL5c zZ!Qcf8z`IEJm6#&>o2SE9w9lEDE9E3lL+A|eeFV7**Q#rzkz9i{abtMY2 zuiQ89zH9nWotLh!csPAQ<$IltEaBYue_z%GsLo8Vg(_UDR$JJTPdB_C+GA|I2LPR( zevq}nb?^O1#9m5$t;cq^Z>Uu>_m=!vog^dej{>y5YBdQBU7RBjG!#x`3MPEQ|0=pRgiK`Y@$Z`d$ zcV3VU&N99nCai3Ddz!n1#43ZsjlEB-c+4kvVwo><7#eGah60o-Hcp^Hs~D|qZi$&1 z?GpToqddHw0ND2gz`Wf_e;vV=JV8Zgh@e$!JSKx0LROVdEMnY zb|5g?8mL~V`gFW&KAofB(#~!OHZ_eF&S)?sgbbw+`Kp0-_Gd6Aa~^uv_eD_xN`(v3 zCoiGAb7WK@C;fYF?V&($2CD5X<8pBRouIWdu$f`g^3@kG=o2weSv54|hd@W#1w4il zccwz7i;cgpdL;euCQ#Yi0bdjrSG|5urT6VJF=OP*rnvn{U?!OKf>hZ82zE>5c;8f6 z*n1VPZzm2~(S6f?Ql*nuDwVw(R6u1h14rC^v?e zH3AF3N&)8eDbzOYRxFzYO8vQvf6EMGD@O3$(ip*Av@ulC`Veg|g2TC%uhdah#fVP4 z-j%jjOQ(Wwy)RBBSQJ)qT;}zZyZ_wKb>|;Q@?mvBz%;izjjoTW_ozjL2H=Z;t$W#w z?Vd}-!lb8Pp4s^TnU?>o3iLRjnsR;85I59#sh#`TWM?UGP+TvG3MvM)ZzHkXLO*Vg z|Hr+Ljyw1`wzU07N82(|p24Oh2L_tREup0inh~^-uQcTZvG{z0RQm+1FGY{t>XSKvHj?pRGE3?|H#d<86@l0 zZ9rsob8fR%;gKJ-#@Lwaop#q~&xLjATER#GKb(h>XtPRwP$$VR`;pKH$T(S24f5XSREMuwniC zEuYaf<*;B|xGXsICIJlnyd6Z>%J=!Di6NiM0Wf?2VO(`ZM@<2ep10yi6_biShWZ*1 zQHB8#W&3)N+`j`wUTfOyBS8;4Yk)K{aFX&6h!`!mOfqBh3%&6mV8WyV)^G+Vqb+#? z>D_-@{m-07dt2<&2CIbYx`@RypC%zeKp7Rx{h#V0j0Xrw2n_21 zT4PhePpXxf-iPcF4|Xr7$;qcX6VKP-t^!K+Aw2_wLwfQ5T!^h!<5eK}{!I-JG54}@ z?0xzfea>l_AMJwnUfQdP#zRBO&g1x zcXl>E^bKs>8jMVeiOUW|i`Iqw7XqT56pO7-=rsqrcO3uNWY|rh^kn6c8hC@d$*P>i z(VX*>Vmw6V86Fj$ z?RrX+a@Cm5>oou_JR@9w%F0)*Z%RyDk*~Yk4BxNcvC5M+Vak!=TT-px{YC_IZPH&a z_r_w4q@iOk$i-vb8X$42Z`KZ!tv@K=svC8OoPN6-5c{d-7*gpFDdIO>RWYWU_ItL% zoBK`cK1K{}Z79M5EpyKxZI&6-alHH*an4fGeu8I{@J+&@E~u%)1L{^2FPNvLGiVc} zZ!J8AnB~;$`B&)dLmnG*j<;*_ltAMz?K<#x>P8fToyKMj?h%z(FMzIs%8u87qu&Y& zpL&aMQP`6QHH{0sH~Xg$G`lsHKlM`e)1&gf3CsIOm{WFwUX49eUU?}p8rJqGZ|m1y zEw^5gr!VYp&p2g{PC9mwfU z9)+0iB|uYO0+oBL=T$P~Vd|93@5@=+3t=FXlHG94JoiBtpC6W1VlwGtOe`dSwjEV=%k@;DWVq%m_F86Rd?) zuc{1C&5S&}Z@x^C;t{UN;lVA)#uPySKUgqoppGhLF|%Si9; z_lLkO=qi36ruJirda0F(uT(ay6vVge!i1C_Y%5ApYngRW$TMJk+{q)PX!L7W^I^27 zl%1(~la>(JLUE%CAm8_zaN=;~ot*cxbrrK}-|{QYH;X*u*{)%>zJCFH;>Qu4iVE?h zy=w0H%`wNWbw#TqJOVegE_l8bEv3{NW0Y?E6r3H?9MOmXEg6{!&!zLQ=#;u}#$bi4 z2GM2Xn1@y?@!E>>v2ohGL0TQ9GAHWFfGp+$)@kz$!}}pB=?qI{A}|QeaT!8wU>vWm z(NxiH7ZPHdcLGLgr00-+4tJmdC=DwX1X%L-y75sc&a3>tvO&x!f?c2 z5C|~Ehx5~m6(K_X-iTlvoVve*68QxT# z#6GvYfr@91WyN!R8EI8O0+J+KU7Q)jC| zvS{G|Fd^3p``u{7zcN;xo0eM^!@VyOkGTNVC2B4iy!<#Z;iZ0XuX#fmo0~_lk2o^Qf)$vDU^MLe1dzXR+}}y8`7??cHs9fF>Pnl0zTTI*;bov4vB&nu4Vmg{S)?Q_B{$V7mCWx7e)dGDMcBDy( z*^d_YoS|iv;VOgC8Bqd4q9vgJ%mWpU?oFNSZ}t_bijQA#T{IR5DMFG1tbc!u2 z;cE#&X_sK~lL#uCmyxWC5C2-uG z=Ue4#0U20RQz(NHQ6zD^H8nDM3=uS;7W|F^y>XwzMN6N6`5|j?;Q~D50)&+>7+EnFZ~|0R@8m7`YLBh_>~RZoE-wU z4gCztx9Mk=Je%)Bwz`KK9llq{fad^Y>o0K{JJ#U>Rfofzo?of=?>%f7zwzMV_X*Dh z(UhPQ?SN3~nxVd}2(E(C`{Y?CYTeM_T+l-P5z6aJza3Kf9Jkw4>%W z(6vK6r8#3AKzTY^=9j=PmVC`I#V}ZZS#~pr$BxO z4d6Q@uljwp)n0(@A`xWGQUhb#VLUA!-^_D2JDXB&&;dl)7%*zKYdM;C7mMlR8lQ*p{(6ZsnCCvfBwC&dN^iMXlyRlTn+nnNLtK4H1t7}7KV(>?>WSFyEsfQXQ1~;4yBfh zAC&KR%im+HyxrQ-f8g1J0o*re^^OR<&;oKH)l_ip|B;TeeG!t;5@t$m*Be%$7UoOB zW)vl*ThoGDQ}ooTUYV`?iOcdXW)HN!v&L%6BXO#ygzq06|2~~w@!9&InJ@Tbof)PI z&&TiV5ht!?L4%SeBu(a*B~Y}DL?=mV|1qsq27sD#n((5@{%{Z%>hwBQ;vusNKEir* zIsW7m7zeN|mv298=hU*U3MKki#J1Xdpi&alZF`fa3gvZ+I?rlOYS+%x7XuuxVix&6 z|9)+M(~pWnN1qLOhme0smB{M?BcIl56vcpq*fb29opE5({N_ zJKr~GP5QnZiF`?|x9W87*9FF{7Dn%U>~u?p@&I6>w_j{y-P1>`56AM(6G@Nwbk`+5 zoFgbC?go2hyH+a&hQ0%XqtRE8F$SGol}Ud_oU%|qyPKn@u{r0%xs-u^c9Fw?yzUI{ zKX;X-%22D4Ag6{QvN0U}$OnPL3BRM?X|O9dE%A9W6b9fpC!l4k5Zlypfy%A|p7flT zy)@tcrw@$opC#`0=-hp+5Q|7}!A~LGH?cTig7xF+w&p)+bJov`O-##f5;rHif3k-- z#$p~)X3h+5`p{&nvsjgzdWU6H$GtAqHpQHayogvX!xUz2H5tqFG%Jymd|Ej8jir_q zb%$hj0~Z`+mZSGghNO8DB@y&dPOlHi)asS}%G0p?~Y~FF4 z<8A23C2+t{*Q|JjCUFI^b^UIIPdjbiLMiLEfpa?wfKTh6JjdK~cch&(F$eObP{U$kk-p5cz?A zQulv?H2(KW@^`cN|BosgH}|KRlfS+%EU8t}$RQ1!G|Dq5K3(sDv+*ZO^DWt$inlqz zn?*EQ-AY-!U5a0+{iawiK6T|2D=?FP?l~d6v~#5`M_QcOsA@}-&()-qORWZBB`tR9 zgWD0NfAQ|(n4a(QGJAM|KHRvBztXaR+bqL{aobduopR zLlPAU?jZ8Es{8N6-EQ~I#>^chT^(Rz)BA1U&c^v;f8Z^Y7?06jroV_nYOQ~Dl-mI8@% zlP}-HM(bfMX%^q~DjJso<&lK^4Rv_)?g#hOJW@3@+t4GuhiaWXCGmSSp06V|P(&l+ zOshIG=eo^{BRoNZ8ffhd=G75J2le$u`lA<##a0o4%gK4_N;}Kbr%?zV9{Vl_MC3(< z5Wg4Z;2{3CZ)}Gn0y8_g`L>i4ueZ^#+Tno%EzRf&WnPx=#n775hU+-anL0Wmy!IEd zUtO;A$m4PV_4enc6t@deT4-BZS#eX;aw!|l9bs*;H_Ok2G~`9J*_y5rA%aN2gF`MI z+qGp}6kL)8BHUMwBtfd}X(7<2_piLQ;j$_~;^S($8@#?N+71cllB%Av>j?EVi7mh{ za3|XSAjnd7NF{I9rcNFK$uepIZP}Z|hvC(F4QpZSWfX0!SZoHgI6*&hEoLWU#9`N+ zQd9UtFnhIKi!^CK7Yd{CEO44^+pnO%Q**mGX{+GEK1P*eOmzvY zlGp3-#lM<1#tI~1@a@v3y19>KEm=pX-Gi1=TztCX$@7p5`PH)y3^$hZ7Xby7Y|mgG zhul_0@~-;`##0x31yDq3sRENP6EY+Px|MBJ$wWxhouZx8&jCJHAPg1xMvCd;D$%8+ zRJ$J|Iz!|H1Mp2>+!+TrP;Dlv=89OZf9owT@+vK|r4%otOc&C`Akt)AfLE&_Bbp!| zJhVF3Ro$I6`^;lrKL1kT=;(*ehs9FRhB}10v0{(9vE&Z=R{GQfGM27}S19%DzrfmHfNV_kBI10&auw>n}-Fo-n-; zo}X;B{Ei<(!u)J69WARVRzs>wDR96SLcAI_ws9e$j`>PdBrAu_)sv+yLrSsx^yYL3 zXB{koL26}&;8!fOil*ztz%ZQ#bj;la2dN=FbUDsHtd5F!B z^GRovrgF|CY~Bqiuc-hI%VlTUK;>Y+s(NhjOo>U4x8*Hm0u!OX3#3_8#Q4s4I5 zUFtoa4uC)rV?FVGXhj{Y?+`a%UAfCLIL4t^`awFwVnKJRY<^Q^r{iioL`$!?VnAYm zAHwKd8;6L!0qkzk^!&guK$uQ@QN(M1m_t)UsG>T)~JD;x|V?H!+4J(nYOlYOwcW4*9q>DR+0png9)366_jsl0qr8x~+?#N7t`)fezIO^q|aA!xbRd7iah-et) ztsN65j_gm=XMC<5d(ftboBb9YF9|~j!Dx%&K97Lnn2e9hC)=&l;7@TSJY_kA*T1Db z5L~H0+WjB4KMo(8?VOy5@&ANsZ6qi@Lnuk1t($@#cCGeP zs1?54Zbf?`dR_^z-JM0A27Z|4Sb)>u^*Ma1)vJn?;$}}t&4~wIMktaw4yc{=^gP7L#kL;5`!y28OP4h?5Gf}Pek*o}1O?Bv zummrF*aa(g7Lw$>O}YRyL~Zb40tmMH>`uIX!fZ*U>R}32H9}TaegMtzZ(ygZ)bJS2 zGwM+f%WLjyu54L=3*&USjZ5b`zmDtP+l~Y6w5UGk%7Ah|)Ul5=+1=$0u6z%B2LkZ{ zKl}F1#y0gZ*CGmcr>92jx~=Lu1nD?6WVkr<2^ZOXXT)>}$L18>e31GU z8un4%WJu|<>tx&knr!ztjrRoy(yzh)b>9RG6v!4%Ae@sDd}Oc0p@%1>8sg=3O;UZq zW{8p7NxI@;=hG5q+f<}my6e8|tZ(=lIuH`RD*39q#ycI+0m5Mhb#Y0)dEsjW$W*ITWS84mv)nyTt- zAXE6C3w*rxtKenTEH5jrTbY${Rasc(&B8#7dPll1q7hDMm8AB)E1z9gDPMx_I88tf zcXfbIA&GDai*mTMO)R{kmrR2&^@No9S{W`|7dLU%B? zs^Jpi$n=6PlN|Xp@)Dm|zIXGuAAWOfntP!u3z{J+PTp*4RGvmldTh9?B{GQAcZ~2m z>^>=d7YPZA{2?7vuA_aQr^k?1v#mme+8uw)xEBPjPKR zsC`W(;4f9!X!&KzcbnE(-8~T+u$9EU4sX(=lc(Xcx$qdN=EbJ%0(f^gn{A2mk?d2{ zi;|0f`2IT0!a{Z+QDHle=a;akChhrmqk7HssfUgYkXrXG__Ntm@Tu1jI-2>GBwXT7 zc_=@K2H)Q9g?@z77z31(C%2Vt$_rwV8L~v^wvr2-3kF`H!57f-KH#Yx=eWU#kqlzG z59(ZS^xV=y_ZY7QNVWzDoRlmP83JEW2~1u>mqEA6a%{cA$E|1qu+>$Gav6U0a=68n ziVnN02}gFURJhi9?=#tl^R2$6&y4y6P94UkVxoz$E-lBRmadVhx3E)7sdlWHmH4{v zj2KAu_>M(xWi8dXZgu2W$AkbIy76{!iJWwJG^?tuqOmz3X1{xU4dM33^`GLu`;h+L zuDa)eEs0|raJ!OW_WK%V7`f4#+8F^>7D#S6dXSsp5W%gu|AV%-lNsj~0U3hucT@tE zT~#kd)o_xC{s2v^3|>DXrLov#>xo;JS2fHPBw85x;nQ|01dX-x+6+|OAL9goD%b7( zzB{sbcarNid&PC)CoW9+O}iHAe)Ja8<5^%SOk_tMUB=TxGMI~0)vnU<2a*Q^pM?04 z)Hc^goHFU>&(C(l^CojnD$YoU&dPs@n=OQ3nRV^G%uD-y%n`(F_306uGd@pervq^t z-^<}b+n;xM!s1(%)LuJywZ3d{u7mrs@j#G8^XAl(@=bFTCp3Kf{>0{)qZ((s*^wa9 zLN{%T{%BhShC0^}b2?{JSt?r5U<0-`l*@UdKA;Dzpd?%>HY!y2C4&!`g}PJWJPF8{ zr>B42-lui2DoZ4opH~Ag<=6s2^cK6=NQ9%>Q@O#Kz$ob>bbDAhhEq zZmNFm4#xP-?%PU0?%xOMw(T=e`tuSmA zlQgG2gv#j5d89ivjr((Zo_w&x!+TnADpw)f9w~R4HhnkWuPPw-3K;moZ+i zK@nkm2QCU#?m$ulE~<2qpK+d9*Q{8y7~(oHL~d6=4SP+UQy@Uq@DjiNzTrw*0nG#nP)ak}P0& zC=YvQLUJjnleC6{A$|Tn3$4PyojU)aVX{5|$bG`7&X#loXuj%$^sAunxcc93zncw4 zx+Wc9I*W({g;&)TJzFmrGn{N#HO9uq>pansOP%a_otb%AKBYpPGoVc`927|naR@O^ zedmpA&L4h6Bl>sDu0Z`61{_rvuO->7vUp5oy8p1XwpDD0?s{8qhJ(JhB<~&+_u5s3 zMiL|z#zk>qQa5FGfD6g9`1RCJ{+&nwCFyx@hGK<`{BJXk}> zydbmbf*_|K`Yzf)LLJ#UuMtG^wS5rfXc*s|l>WhX*KjDuYNFVJ^ve&d5K+lOgfI#h zoJb7jME9u|arZMtx{KuQ85E7#dIC>L%VYGfRgq2ffma)_a;|T->b8n`D|}JPFkn#p zTGB?i5|g0Qb5PzVD|m_EM7=5~nBt^o^dR1y=9nb&TQJHHVtWy?f zo5R+N<35kfBUbhCNK+?9s+DzYC9ckB_cR(0q4nOQm2+014+|s_FpHQ)p!`tb_b$<8 zI{>kDIDp!qU$t9;dAzpVaXYEEt%8_P%#bpXp_j_92Ejh4Av2?G=LieB($J_N5L%g@ zA;3u@IVR^c1k?u@#H%5JBLoN?son85zF!08HWCdTy()fi0skXVH1j#WMXGu;OJp&L zhm(sz_``Ofili1X0fV%-uMXju_gNY#;_ z11;w=08q|H_AC;q2`Ck*A*+B1fd!eBK_f#>LseQYjMj}m6u};3sVoaViGjFFslDZe zmZA^ytiE-A4gzyd4T)J9oodPVe}u*=x{U2uyG;03*@UV?@m1=JgSG;;4LT|PlYd%2 zkBzmcBuKn;OQ@C1_L98E%H4PFity*>Lp>rub3416K7pmrc1;xc#%Jnr*}ylZwc+X2 z$|^}s9gS}}ox=3yuk3p~cvI)zfN4QsvrVX;QyqTw_TWs}|Hai?hE@4Q>%%IFf^>Io zx)w9;U*39(VZ%_R2 zTMOCBz-9hX#_eP9n(FN|@i;s&RmBau!`YSJeJ&top(mQRF5bqTDzLe;vj_Q-e6eHe z@dlls>f_7i&n^!7Pc=ow%>`hgrOUCJ_hq3-PX)AS5TsGS`vF9%<=3_b#B{`xj?jm< zx84EN7@^Rq_jzF$pPXj;Kp@{c<6!nU>&djA(fmo1T39jTYr}r7<@Pg#YD`Ej&8r3l zfOh!_nenqeneiMKGuCx=t)Qms@91B#u+w5jjs5H@cau{oxTs|yVBT2^f?NtMRA zZ>L*&>SiCMkGove{z(JzR(g}IR0CJjXL&;HA8*I6?-wGzd_6By1wW4GRW3em-r6rJN#o&dEH~hYqxGXcki9Rbr6!6()6%1EI`M2Bb}hw zDn;myHFFW$3L$kV=JGk;9`HQmCg0MJTAVVea@P%v?&3L7n@P2ASqG1UrzbFv#L6KSB%uFY^73(RRhV`5YegSEt|)W+f?Bv zLA6#W=hAUu220TqGt}h)Zr(CFuJCWn2=H*l?>1ZYsU^zi`9m$Z6!>H2=lZ6<0mi@y zDf2$B_Jr;G7FzKb&e=_eD_7I=8+&J1EjajBA3h=jo?tK^vw1|$&S_Lg)Hj6s*rWxV zm#@TaC0DE~Mz2JE@$n1|5)bFJrxvfnrvX`jsm8011i+J3?0vY9*{IMA6vpoFe_XME zi+1%~uUnh4?ykMI(kVt346|%NhvWg?JFMgW88);EE$G;o1M)Xp;DW>Vo0Sc97Cryo zGQjF7`SC~*KH_>GpA;jg&i{CmgH`fD45E7LrmS?X|G3{qbuWPM;v*Yy&9A`}vw%K9 zZ3$!DbqR7l$95%GaFByy)g^A~KpQ*Temq|3+(hlrF z!?@6M`I7O19+&YJmx2$!H`JisYg_Xb|BAub&)$y`XMg9?Utw16cLb0JH-Q5pO7n>=Z)o91+_k6)e;X^l;<60ciO7t@Ka(ge?iOowepc*Wgv z4*1t$gBR8Eb6aF0BYyg6$Q^XR;l+~cI9;h_RXEILMGSQGtqAhaKsx;?lt|bQ^~C8r z$#=XNs)G;2dXLHj{mblgZ>+m= z-zPJ-_`p7Y!50yx_DEBUPx0@Qpj;sM=4Bk9cEEo|+s5)3u-OXdDs0}A>4>-IU)vm= z{py$|G$e#1j6C!WbRp-%d}Ngv?DUr315{<(!s0*WK?5bM?+NM-_wCuZsk%j2bX4QA zWevLY@iR1nxE)!h8NKei-9Nj|C?~{{Qc_6%R zhDpJA?weDj`XpUbRNRvaKQntI*)Dp+OC${*dwf;DzR(E3fu=Rw?M!EGcTK z{;^%jEN^Ame%MuUa<`4DE(mb5y6xk)CjR1>rmBMUAoS{C(N$PlTs$6G3__t^Xl`Cj zs6$}=8PVnn?5tam(4mj(tpF%MWOS8xA!>> z2TiUG@N0Pnvx`eY{P~++^H``&6QsDEVZ@7qoqH>lTCEe?7_jB)53sv77FmPdMWTr=ap#zmWj|>N`X#(t$ zcDoACxrN|rU-NZ73!Q>82qclE-8^o_U;9BjnwcsHFED!{8v7g5P7?vdb+C~+fW)oP zYMF%a8!5aP#T8Q#T@a}o`riI8XA7T&j@>cT3AdjtL{foSe+!#CYyaoRk9QoszY*df zeyKRbiux9eeScsDBE8&r_=-X#`8s>y=ci{gkDW3CEBEfzcwt&g{*Z*7O5n!O#v?D{ zJ_vnIzePXH6eg@cw(@?}7Tg{Kfkd>{@rSla=>^=8DD&5(I#;Q{!2NaKgYL3Kig*oE zDgUY2OH;EQUGFK)?;|;0mRv?g=q4q%t8lU`3gxR)GMuLA|iY2CgrDP4AJ_O8nz@JmJdOY3*SUix-JZ=|tFseC`tdnC86K zZd0BI1yyt^`kzrx2a-#_ESmcXI5R^a3g%{34lNyFJ!%pxnE--!MA$h>$@0iLKX+5_ z-V!joV0aR%qZ4VPyHe(CF>~~#kc%a)dy&oAM(k7F8f%3-5S;)|=0d8lM#?NKfO1gg zv3@5R{x+I;9T(kar%L-AK6-z#g6KZ(!lJ=11M_#Tj3nyyg~PDK=z;gna5|!!K5^Mb zx1a|DK7G$tmxuR#v%6M{tKP{vx*+q35yquq)!hNmx@xGLAf9 z%I!s!;$XEEEHYVLw;`qCc(gmhDEi7o=zd3x!>Pr_q(IivA=Bq7IeCQOenhTOooVRe zskAJ)fz-#OAYBZXW4PHp>9)YylEYf3?!yGsh>)X%kehp=Kunf{X`zNqrF7kA$Wyto zG}%4V)9P>d-R02aljs*K(mBqbwxu?Qs6&%bSZMMiT-uOo(Mdt_;9(lr7V!KR{0quA zIixW&MZi6u!94`$r|in^+z0=0{cj8iqQ+2SE){@5Eu=J{wEdzrw7i3AQGo z@}?YLxbNdI&|LoDbIP_DxLd`(MXSaiW_jv4xLH&ljs;SUuDA>iVR_y}$Y~4GSlwDp zv6tj+)n4>v9mLK$D)NNrnVT&&&V}oWV{Fsc0-Rz8Rmw+H$IZjAKF?L2Gn{#Ek4aZy zEeWftX|RQDa;7P`{h6cKD^^gS6sc;Z#DGEmn71b#TSU3)mCACLZSXdW-7&>}197y2xB3!uVVU99GxM9z%pgi1kyG=% zpt)qPPvfqCgCe*B7dL zU>Sb&NSoEjZ$fzNkpmt6?gq$T|N2#UHtsskJdZ2!)-4ExB#j3_Ge;GJcq$(k?cud# zA{qNEI+}g?`<(*TROAQ zA=D^J|20;D7e9V+qA!$l_CZxrhp`~_21|%6oP*z>_x1^2a_%;B93#23=J7X!c(*fI6agh(>S|$&w?gG+{&2GZUBY+A1eaMUb z|JyZcgX2*|Kqm|c?18@LLb(3#WDBiUkDQIUl_4s2ChgdOV=+0MJ7;Pd1%FUN`e@Iv zvv&+^<#V=aBGO`e(hzw=cj%h^tfe(;bUN6G6i zWNAi9&*EbTIoPy(UvP|vxnnOL2ar?TXz;WO5C*aXPpW?x67%()cOzjG2cPI&g&o!4jMV`37-p14u=9yTa&vBHj_J^XbujOZaEGIlR@?gm+!gB zP~kx~4r5PLj*db(u8A5CZVs=vs2m)5QrsMHZ#_*-218;^;8BPTP0mi(Oe9f=%}n+L zjNB@B_eZ-1qvLu~k_FuIlBt(GQnhM5W0SL2_>%01c-jZ65yS?Oi226`>tmTsQYOnx z3e+$AP1x(aD42}EX8~zK4=kREisBX)zvuEO{5j$mr(lT>x>!;&F@pFE5m z;Q3tzQgp=xJTO>|rdwn%*JSFrZBxBqR46>3o<2e&>=Tc}{&@RqzUynMHX zIOBAA_H03db9QIxNzsXp*%+rM{XNjipOcHViKPhu|k%kj#m{C z8;b?We(+VvpzVSp51-lUwD1+%#kQpw)=qJnUv1%cO{b=RuWNptD(>0!+kZKF&zI#< zV1y+TgYNtn%Wo=~tV^zp*zFUtEe^CwLC%NeVfJ9ax_QX}L7`iGV;lfbgy=!Zrk>1f zvbwZA&*}77u9p!E;ZwIKDPtTneJtEn3t;Q$#theogm z9z?)b9b2}&q>JI3rOK-rpKr>ENy>hZRaSk+bZrGB3P!CNC@J1bBdW5Baz$BgDzGmH zRcMwmA;#gcqFb{vw+}U)p#;YSjG$T`K|2}MsQGCkFIcHaF^;T>i9A2|Hd`}-uL;l z=E+WS+6cq<;T{6HX@Vh-E%B=x&f|0kFiMb7ZC|TUYPeX%Sbe=G^i~cMe$J}=PIcXd z&-gxrB&n%+oc}P*!A{_oWH^FtNO=zbM?4)U`R8NF#EM2Q59#wxBB(93pxEh6w-ucy zEZ`=r^?ef7r%l{dTjHYZF>o&+hVdMQL#l(x`;07<+SHN3!_}TzP7Te(o`u(a?_@mv zSwckusP;eX$`>ySOQg%MUxv2=;+fVL9H!%ZIfCi1g$Ba)W42Xmy{$5%C1YFRc z{M&S5ct7$z?vcO;&|KZLYZUUMeVf+3}`cePCO?DK_Kz@j+jlh4@~-qHs)(!lfs2W-{XU0 zc0b5Ki%+-#APv5nrn}{h4vfwdO76#-J-kOVN7a(xlRt5WFCdu48&}_}W4^AzJ6pVm zu&d3_Psa~IRf^Q+{868Cxk`b463}PEqE#xJ)_z!@Xx6gg^yb6YzuWi_R={9I^8}Hk z&wd)rDf5iotEE}o=4gQp5oHcmxqW^TpylP^ed|7t!IRYd#jGOyeZPxo5B`WI*dv4- zY;$1a_UgK{i;V546whx{ay5Sis7LReDhy2{&Sc{ol0EV*?n<3=OFcBbO$b^eV&p zoZ1}Jn%YVa5892#r+O(X2^9$?@A{sL>k{G{U`!vmCY$n0)@F$hgBhOecSY5%-RmO+ z2@4rS=V1>OBoX^{pIr?QA%D&Jbft>UYPV!Nkk$9A-+#7(x#wR0m&$2nj95RtFY{3l zDIa325SF=Ru-kv8E2p&M-c1;a3D|2d0UM|<|EWa_!^iu9K;c88f9!#Ri!0{Kfu3YP z3^Der-zB)O5C%4H#NK><-;iaq+S0gX$M(7}w9*Y0m^|}bQ&AG?gpz|5UI}nPSMHM= zgVN{Q$L+rJFME~!az)+=UFNTOt|q@~{hDiuc6cJNJ#b+sqhmzSVLtb+MB|NWLV$^A zL|n(Iby|K@%)6o{E>!zpx&pbaWep}0yX0sIlC-^n`2z;eSaA|wkU*GDxW>2Ij)nT)&M9=X(h8kH{v4fO+H>S+L!;uB z#XUtC4PUKq0=^AYr9b9qUux8b{YMbqJ|lLOMppxzR#-IyQB_jSN0@zJusbH^1l_|Vh)o5*BEo#u3tsvgE=1+Wn>UdtoE4R zV&UX0pklACc@PEVVF3m_$Cj4)H*hlkE0N}D1)#?M$oG~&b#$?HFp2Y{l+q^0q6B4~ zGsoC%fAXs5PNxqnBZv0-PfcCq3BkYMV{&*X6f~kT(dkWt-Sjax02vq96FQ$Ej6JEt zE=%!&JT4mI!g6z70%6i-Uw-s!_9IFo%2#$y=kKbS^h7<8(b2JmfM0R*_!9mr`>com#E2W67!PpLdkeE8I)UQN%Et_{Rs;ETttIq2`$&s0IXsCLVY zLsV?%QvtWb`f?_$FRXcxP|NpV(y0<8d(FAzcO*vv!Q|9OZ4X~77sNk!rHde-$5MR( zQ)n)&IuY5D2NT_jAjq^|m#X<=7<0HJZk24tw7+spyTLh<45k=okVFx+KM7U}t1#NT zyne;@&Mlr0SG_2G9y*ZIg@TJ6#oXaJ_E$&aRD0}KlcR;T?9iX=S#fxZe^fGf=sR?) zF;}T=VoaxqVgLru#poT3;@3Vxj}Bewfpy&osZPmr2(9{002rJ|G<1%9ozU!DM|O=eKnrMP7gT>3fcA; zP@ICA%+`t|F#gekMS)_gc4aT6YQ=LmbgPL(AEpgdX@GNh`Mk&RkCB?2yWzQaUKCdr zt;P!w2s^(00TdMDhRzmDz8xViChw~gT@TIV0eVpR$_vY<|4N+VJyVoJ;;jGdr)Z29 zoX~G{nIi3b=S`W_Wa+_6<^3?}(4p^3CyL4@khJ!c%8^hY{Zm>q1VjFIxX7%zR^2cC z6x5h+_U$#|pTws!h!xopY7WCw#iBBXyPnXvCg*)T<@zSfJte!8_;se;rIU5jz;om= z2M`pqVc|4IgqpWxmgJ?yI%gi0+wP>$&L5#KAuW+v9q-wG9?7m-J{J(Z4U=?gFNK~q zB@Yuey|n@R1LjPuRcVE2HFTPSs>LmA$L;>^Wj~JUui~WSEo(^H9A}v0GgDB|%OFXQ z7n|R}KQe!hoOigQAFgKh?N#vr2=%RNHW0ogW-F$ZiBoqGwUD77mTRI1bZY-+t(pKr zv^1%JBu3JG9RXx><=-uPwf(%~D9YVEh=$YoS@guTA&CklbfDkC^(U;02+_kB31ns* zpXpl}TY%6S5>niAWGMFSa2IMQ9EX_67x#6G7f5lEN-1q~4(o!uEWxtRPM*l@b$;bY zhrT>_MMn-GOx-b^X1!8WcExT=uR*A3HfluI!$hj4@xcB`29GTPJ&(UeC;IDu;(%_5 zcE;LD_;A{q%etrtfH9|rco3WY!NSUWSi=HFUS6JI(>ye?f4WWiG5vv!9?d9s)Y20a zl_{(2--PA=l0hc|ql~Jg*RqhS%8;`~G_&L}L}7n5sMwN`MC#e0rVTzrr|bWCfx}e4 z{LNHM^#*{3;AO>zq$7t)0m;Ce0ajtp<*&b7nam~r)+Q?OF{ckH_I#sRNIZgU*mPKG zdB9VNi{rHKi9v#lW!J>dMHhoN(c_Vqa#@HZEiC8-Jfp)6B$RfaQ`&_m|GVWY7iUbk z*xL{mQ)dI+h{4*9kI`0ukHJxh#@cx9Yjrux z$k<%TT=T@0(Mp(5_5L|GA952?aCXZ#BB%EX%xmVvC4=b;v=^+82W>BarzbPM;l|-e zZTvkH-$0f`R9=sZab(8h7Jk5&x3&zMiO1QjQL!wgFG!PB;;;Lb$}FJxPZl3{F&PG| z>_{Q)tg^<4;wDfhl9NfK&puagKYKZ|0~iYtN~^%DMm@rS$fsTZ(_CFv`%T&pyY=Wp zL{A_0GkmhWS~%O4f1YO0wD;b7v!4s1Z&g(&?Qqc}J;NqtbWAbxg^p?B zx8vy(@W<6GOA>42Ae%)6@vjKQLZI6cCA&0wh;i*89eLj_R~Nd&Za{;;kA)x2hF_Fa ziF{~nJ@vm|_rG96VmseLzkl2^IIyrsaw%QzZr~kat5_+zxtrkrwCj(tzJ1Cgv(OxF zQNx!l60T)7b8O2K)s#GatITJxORN_}?KZUy16v8lWDS!jwX=Z=$!z}G)xhllFfWmZ zQe%~LrHdK%xLx!(fYSUI&=_1U@|70D^Zq3Hp>4Ss(^YwuA$3Jl@n_{87P=Oy;-8+o z5+xtg=s2&01L@=HCPpmRf_R%p-~HdOli5#Nr{|-u&TCVyS(fDOxqn{A1?4igpNosD z&KC25@b!v7DBK?MNQ_}};fZ#&x^$g-PAdKwGvPX&e{yIYlkZ-l=r4wK{@k?k?Pa?+ z$h%kdi)GS(2;92#?m9uG$ugfyFkHe7I{VQo-jU!iWx>9_m)>Z6voOOk;mcamuQ zb*SRmBiHCjbzJacY;+bMa~R8~{ia(FoDb2dvw=^^*RPuVrxDrvM*M<}S zam0PJ6>!ESq?oSwk6Ez3`T&}j;*uGQSBJC2!I-p}j=)nw)W6=1HP1=^CnpvpsJ?VG zyWrtAOh6m!u`E`@a;(@wv&Q^{xm>x}`)9qjZRoo6K!hE$#UJ9u&Dw6&Q#^{AF0p$Y6hW6hu4){3hL-=m}-&S`F$4RD*W5lhWi6! z+jEyr*1(BedW&0j&Go&?3-Y&^30qc08g|PS7#MzDlUZN;NOL=1i%Aux%|!y0)R_KehMZDiodz zsgMiN-Sa!44&&N0`c){t=0m2QVfvo*IrGBggRGpdbimvLZXc1l9)WjA=n{Jm#1y}UGOb_+xIy$+10H(r zpIbLOH#9^u*d4BQM)_bZoX1xTnsbJt;2nm*6wCazsqmc-#{T|b!sVx2f9e43Cd7Pg!&KDXTy z#P5IvS7~tD34^8qR7^>vDh0TNLxzsX>erAKC>bi!=aNamd&dlcV6xhqbFiKChC55j zd>qefEzxxOsyu(hTQ2v?MO-(NFq5dn8vyP;RK>-3kdX0AH68VwkQ#( z70UX2{ncxjql&~HgC~K$LIi@;u@-6A%ii4TOtWA~LHsCzQj;kD2|oLTg^EKqW<;1G zbxOjF%m*^NU>X~oOv>feP23Sv8lw*RmW?RF)zXL z5_=DzMZzYjrnWv8#gWb_QyRiDLFSczP5k+*f(pf=3+o?3rL)&H%8yS;!*i6ke?Am} z77dT6n0)PhmVn0pffW#L0NK*NYe1F0n_+~8H-kxjStGbMR*L|6=Dm%s5*!*Eku-N3 z&QSW?T(9kwe{%$}&hI#l**k@>&ajfxy#sU*evBi9 z=jF6a_SMe6i73uDzdSxAp3K_(^<>UVBt7By0uJIg4j?v0!KFKVHT~|jD^by%E4Xn} zLvz?{aVX*3+<_um&ig~kR?qqu&y$zYpMI{t884hl#wV&y&i54zb;sf?$IY8hTNHk0 ze*KhlFgNa$M0#NL`|b^(Boy6X(1T@s`r(#TqRPiIpB1^nbr>_#J?M zd|m7z8M@J{1I(mQPXh`BNU#R8JMMhKJL)0tK1cE_;0w$4BT2W`C-CNgk#Taq2_CkU zEK*t&Xrzs=Ww1V&T>9XAgji~{0F+BDsThH>GZ5c+)x6~}5%I#6&D2y1`@btjY~NRS z{yB7{(p@=jCQR>OLpu_PFMy{j6<{6Hy-!bPYCyW?UcT0H`E)k)!ez2l7+ebcj~vgu zg_uo9n%t_cL=nUbBt}~(D{(vA zbcj{zJrs{E>>i!p1FSXB?$@nu{}#NXn>bT!`r@XN$55(mEBTD+0flGWnK3EU$C4=? zd0w%VRlS&yUI5tI*_WTRY(K5@u;UT8Zq&mARwAGaoDC!3Uk|5h!Mp2`cU=tA&>)wQ zmiArq7Qi@O6#Y}lW>}wvTGl>va~>e(RAKY;#0h^r@aPsRo(G>Ud!Vfq(|1ypObA_R z<$-Q_Ruge+!8F}k7<0eiCo5>o-`&jWiIX6~Rm}C7tesOjFOBH!5;qoz7SFlQMpr|2 z`;1*yZQnQZ zUW0m;#ZK<??0qv$XNUNKR3BRbn3Zp3o=>)cRF8#@YlXBUujn0mlHmAKl#9Aa_(py zv^kkqjq3=m)bMg?Ma?8UYWgr}F$K4y9R?a1k>Ug~b)9a0tiSShb+c};)!3)^b`d_k zJ+Qi?ck)1ANVWKl0_@Jc7;e>?Uk`eQ+4pC(;f&$?ZnuF~yG13WerHxs<5THM!RM+) zKNvOxy|gXdr9jZJIt2a@?PTV1lyS173v0$z|3aYN}@ta?B#RKjukd6d@ zA^7@V5n1cW730#oUq$n(X(tPg+bV++9&ifby})k_sqd+lCpGDxv3t12Uxv+Cfr~*P znIzvV;v~)OmG$#ot2-NijR?Z&`KF{xJ5B(?NZNUEaF`~Pw1Uat=V!;kBOOQHcVl!K zvbfxL(?|zm`;kpgZ*#>xJ!QhvdY{SIle$R+aTG=ir9IxS$E?8R$n;VZ=!R6YC2-GK zH{3iAPnc`umbHkA-UxzV5@aTmFP-#Jpgu*i-IaRYZU54fgVPR(Qie*(}C_i=j@lI}Wv#do?>_V`!;W2{>v|B%O!_7P_ zwqY@>dFZ4eSa(+Eca0>=5Jv}cvpC^$4Ui;!8WsfUX}wSEXCc%V?$ZnwnO(Tm+2A$$ zW}afNpd!f7vxI=^zo6(fc}{1 zWq}c6KLD5+5Z<8&RWRrh)NFfX53ds%euT{RgnOMrPwQhFZPsLZAFAb-Ri=`uu7^ni zfE>gS56J#M_+T3c@R1KF&ky4Ov!7j2`Z&z7JN$Id8=HuxcvwS|`u%m4u+jY_yxDpnwy`n9x!O6!-8}VSGrs=B61>WA{?}w_LqxF%=En#TCw=9CL`R#3 z-Oo&kt6$|l3`Znq;y{qNTeiQY;opi%^4=$^sdoH?Jz9<)PpzBPbE+cSSR|nPdjZ+-zj1=okogV++Y`l#Ivd-|6rG($!IUW zl}TUA?H*+ybc}3x zF)0v45CNLcBrdvcUD$(eiOSucvCLf9r6`Vgb7m9MirC)VEZFF`Sj5cF-R19q4Ycmk zgXmWBXe>sASb``3wEb+^+JP+UuKO3Ufw5rjWZvse_l)k#(DbfP?T|E!Q$(U)_UDEr zp9&CC`8-gc;6EKB#NJqscsT{B$bgZKoNv^clE)wnBl4p93uT>rbXLDnrRBn=%%ayy z$@i8i9GruGa?r)kAydQ3vuxeL?6{3bK}FF$4GP2W$fxHWd&08tTnE#l#41Q;Ra+H- zn=p+c`TeHOX{(f8tlsYbQ!o+hxy`KEO=ac06 z2X(Fc8vpSc>4UDZyH7LhDKwRwpYG;Gzde3hB(8{|CI33#7M%UPnyb@X)B#%j?XC;b$#;8@(a8u)B2DgAef1jV^X zbH2A(%{-~j;&EG+rw%w-7ZM*5@W=8bbxs3`Hf*_Q=T3j%##v}f?~nzakl$Sf4B@1` zbruD|Kca;W%*6R_Vu5U~KG|yLrQ$R3-R!Ye2qEg|iD3i|Emnm@&W6_zKD;>QEHASl zh}X!JB@9qRWvmn~Me1bW_ypOI8_=0zG$)8}t<+7sSA8k{cu!R0m#~@e9IYwIYX$h zr4^V^fnHJ%f%-ha>|+NH#>|ap$Bg8m6=|pm2G8kbiRH|8eFN#2zmIOm2-(0`P4}7E z=ZgC3E4m$4y3=#FNzfsVqD3YB-elKk=$=HTWpw1yG^*NW+K6&< z;TvTtEfz0WZ(79$m-Q9M`?6ynhV;(MWAX+Ut1Qz0SbG%2h$HaJ$y&OVq-9jlgr2qB zPhZRF@C{tt?NvpSvr;Q91#c+GzTz$Vq0K$GRG?agzMAl6W?9xP zMy>P&;1+~K)fJ+kw|Hf06ZT!t>991QGM~eqB3LXqyJzEPbMISHmKI+{T$tft#==Qc zdX~2(?bMg=$D*2%%l{0mpnyNg>PB*7l3wZbX3lN0tKW+e@B@CPzZ5PU^k^lHJ9XN9npG;Y!bF3K=9`&P>EO)i(m(3*e6rB0UUAo;#t9eQV)}j5UCf~7WEuM#a%?c94 zI6YB_9nHp6vv|A~*7d`+k#yYKD$QakA162Fd=dyo?ziK9?Rr&jEuMeH$Qm$Xi~ZJ^ zG+%1|0Fpg%Y%ntRdNEu*!AiYFGw~IOFy>^zIKZbyeFqb_WYuR-^p6Thr#so z^&Ze&PkwmJX6uqEg0E!Too64iXTUufX6#B^@a$F#8uro+|z@HJ4#50k&7n2k*S%z_5%3pB#H!gj#f z_pL4poH$~H0kCOLn?~f!fmH86#5An@e9 zoa^D@Qcl-h|GrX!Mmg>Kq^WDiP zDBOusP^IZz2!b2Vn>$x?etK2_$2+E9uU^Y471+Md&m-G)Mtg;Wgy|ps+5D89%looH z^KBlflpZnF%IMBua$>ikA+*+z7z;iK1lX{6-cP`>9s3gVYwZi4Hffy_`YQD|)(#Vk zmsu!y-#}e9(1c+;qV&u-uo1$)Y9L>EoRe025afH&igAQ6jcUl(>rf_sF8_ZNh(XTe-LtO_!hwmWWY5trP|`cA z=FrxMi7O^)>9+I-!qwA5DMOz1>2>Thvs;L!_c+UnX#wR4{w=%|3-hDLtGjt`s)W`o zL20mZaknE;nEcm&HkW5tBlLuV(gD}?ayIAW&{gFNyR#nB=cR~;p*&S!uDBCK;k~?4 zuVw_DE%V0O%Af$+E{3<#tqqYVxC==cv-}=KGv%t@fX6qDJA#$H{>YGrjKUkQKu|2< zPI|UH3d%ca&n8Jev>;e5z5@8TD49JztUp}As z06r$mWvAf4qZPEk$2j@yzP-cKdi1ZK64#Zl8x}o?UHI?muSz5UIQV|1F=UJ8;Vx&2 zC|h?|b_Tu8%xc6qE;NMJ$BYjI73>j1BCGCrdzrZWCs7z?a0`7Wo_DB&;jjy8>Zw%| zgKP}x;S4C;ZNmmX+)7H(_(e87@=7pzhiW$3pyz(C*7LT4~xvJvW0IJiiO^hfK(bVzCir5{#L48Jk z0A|!P=K{Ia-I@O6->yUxFqA;*U2eI|O&9(S}F`#%?I7l69<9M;T zR~0wlkvYZ9C`9v4BQ_R4ZP1*ivsU#WIzCT z9tfQOS|hdk_>24v6rnFf-<=@4CNccsaL#r%91xb}tO9z#)zZOESJyW6m*@7t!5g|` za%m1ZUfe?F3hc^KWGnaslmAT0z=;q=3>e|-^3@3E;_`Bq22nFdwVj?z?~M;ZgH%Dp zXA%Jq2@x%|m87An&Xpufx<_~mk>36gppyWdsZ@1-wx&@lu(Ht&HTl<3RAUqAaA}<` zfQXx0CmP*j`StV355>&OvVf}kEy2n*&|si$uUv2hhTr`Do0;wAbeQ!!GO7`F75HL- z^$g?}EM24HL2_&^G6;wwckF`8n_OKg4!#PexGY;((cB?R11FYprMHm{=KyH#Otgwz zdT9>#lSgbc9_vn^s!gR(ze#xiBe8OCmXpkj&Bp`rip4i{EaZJE{!glK=wj7`>YQ9} zD1hlw;Hw@o*g>`%Rg3GUANVE#L?+t%@((yPEFkhr?@CQzEq4^@_*&azPkBZl9aPdY zV+Xl4iXu;Dct{}OI2vTL2oXF4YdTj7J&%lzPE>Wqh@i#~Em+R|z#Y*01SDcj|Hke? zzYKcyA7s7?495U?NC>!5h!#c;oHc>G)pg1m>7*@QaFk=@*UF57V-7nMX92RtpEK3} zq`Nr&6|7vE-OLv!j)Yfjlg-Zm7rvis2b7RrtO!h^PtAdp|75*2eG){8s?7{HW}*F! zES++M7+8raJ&c#|Jltw zm*U9yHK+o;-)MPu!v8;o;&_gEQm1tXgu|82;|4yr)a>If_qg_I=eahya;D!6a5w9}>a9 zKn`6(DsYaHsU|YST52PH^&B|h7P1A5X7nQu1%gOD$30Dhpku|Va!}KE+z;C!e;6hYk&e>?pJ8j65THkaTIg}c{ z7n=O?hy#oGPcymYrfQlzZwWc~<3E?|?PAnW(>}L%v18^t*#Bmz1!#1+>Q1!A2{ry- z#yNYAf+`t*5PdLP2*!NE7?6uUnv^x_`YwWs($a7H_$*4LHjDEThKA@!jJMjHLz)Fq zaEs3??(_T+OFUe$Q+=n+^FWu7{6FMPX4pvrPBQYAG;)C^A(?gwn9baEK6k$Mk;fX4 zdrpwz^&5EfrLHT^J{HwVWEq72HcSp3r?VC}XRs$6uY5O)+CcH&YSq|~*@XUgSc78l zhaP3xg1;BV%?ak!FyY`!R1(nMf2hRl|8GGSU}oKYDNY2zyI;eGEHRZ<{iRXL(lePuU;5WBeOwA$j1I7uLcsL1GD&`eti27)WOA?biMU?vc~sJlH72-gxugw-*c!DO|LA< z!8P_7-Nvr0yAKw7`}f{b82<-Y;}XF|`k;VZX}^Z@LLVhjy%B}1^K3`bo+*Ty#!xb} z-oKu5($>0L|4n5vb<>Rk>cNc0{P7T-KJb-0L$YFzrxU=Az#U_<5@>Ju;Ru}LN98_O zB1bYD+8FhejkF;ZFR`58h&qV|RHTvRVWdsnLDz(~f)KtXEgFRYG%TOnbM2qJSrkuH zFT>7U3pe<-{HBaEt1^v1$8qjtjS?`C^slA>3Y`2wUTN|*+6O7*()PPJSg^sUBiqUE zn#f$A`0}{O!#l?4IXlDm_ZB@Vok&z_{v1$vc0_6=O!)U@9%Y()ZaqLI^Mm~E7E5z1 z7S)eGUfsrgU&8-_u1`=`M--Ol;mJ0u+GWVw-Tttp@^tAlYfPTeX`^{!#5C-~FRZ3d zaNqa8U4(v)L6mo!aA7n2Q8pFqE??Pqsvlq3WgOxEqqJXrqtHNYWO+Dg=#xNo%#~W1 z4>PyTsq>8+XkKQ7n+&LnLC39l-o*A<(IL(rYxd*y6%gKD6i^s%o%VArwL?xRp~^2b z*C~^i7LEvEV>WDkKaG#7msJS=SZr`IN5gISc>*f*#zL6faa9}N2Z<@a{0DOMR(GJ$ zM1ucAV!MUYj&2U0p(jUfl{L;fuSJqIrTL~jzgDpX0)3kg>@>0Fz~=ug#O5Nyn%lZq zB|lQl7#OUEN?Sxpjo7}BTtt0%COzLSD!%Tm=>-}HZOA`_VyR4)v6M~2T%f>G6zi}#GM&~?35DU)VswGvMDFiqjB zf#?1ra(yB`F`y#Ax7xh$^ndH|xE^?7XRCafE)UP?`=^w!th%hfA1n6NqCn}HqD;aw z#hjOxrxet8n1aX8P-Xm?+hT&bLyCuWB>`DPI}KyKU3EL=ujdE^2Wdle0tFnRadpcJ zx@gs4%T=Y>qZu}#U|~`WDs`zsd!^9 z3Idujre?X}^3x~G zha6~Bj1#YP$JFPUVpMmZSaYWAd`TU!^*k3|+;>q3|5NqghHG>sRb&ayaEsw?9&i$} z{8s}$%Fs?(S`$)vqBUMps$gr6LfDtDZ7&I%zh*emmg91}8m5F&fz;0ABq2ci`u){G zQnDk7ho%+3e&R@piXdjd3Q(=+g>TyQf>T67LXe>kLLjuKCMDdLsPo!zX~?jHh6p<) z>b|HHz2cWe+_$#eT*R#r&>Di|kB6=MJX?>0$zpf(u4^T)uACmMlA?4k`&6@S49TOP zT@!reLQcD$y64{b>|P4`yCb5bNfKD16W3B`qKwO6@zac_LslpaH@nEct!BwB zInX3@pHPEGgp(x!13?II3}i{w#`*kly!Blw87w4WxT~Q)k4Z9&d$?Iww4`F(1UfTb z;U*%~FQixzpnUq!l6BCxxIdA;$tvvN6fqqcQ@QIV#mMr{a%*(vuueS_FlC z#pl`@0owM4>w|;uZPZI@YU<9T`rb3)E?qo2)TLX6`_YCO5YfDSfgn5xk>Wen8%-CP zvVD`IYdqghNc*n!vm!s5d8L=6CvKhkeVw!gLS){byLa=-HE6b^6UWQOU*uN758%Q?sesp}W*uh-~Z@HGK_46%B*waLHV-O^ht^whs;hd=&eoGK! zJw7V@(t`2)u*^`?tDrf0(xwhS`AE?7O**!RC;5evi?Tq~dXap~zdCG$iUX

)5&E zT{xdeXImpEl1=Z?nHxil*C{l{t)>ACjeNdTPF9@KNT1TdeLWOl1>NMsJi_ji27&Lf z3@A$%(1#ps&c5z+-2EmjtaeJ%Tfh{^J%QK0nXlWfxha)4;^(B`Vertst`_Nu^)=o= zwO63chf1;2Mza0iY2-w9hWBWaNk9KG$OjY?nhhgllJWzY%v-`41=*B)NkkYS#Q!GFiX{>`!b`h%t^^-kY@O@vY}wX&-w0B zoDJiNOXqxF?q$cphW3PrM&$SHqz;3_Jh<(IHuGozXS4(FJvvye1_f{~hQ@K51R20Y zgCBQ~>Q;s>3=1nAykzdr)G^qhhMp z7+U+zEoiDjDm?UDMTQ$0U@vWz2LyiTj=7;Qxj@q7_##a3>1Tjj*Ps7NaF<#VI{WyPnV`o7D&xPD`< z?(vSdl{UeGv;EW1ZCg<_t!J>MsM9^RpmA0*6Z2h#N3$I0pp-6+|Df%9Oy>B>UWogi z5ch6vI1cP*g;u(!=I&WIx%z!FYEp%^PGm~xNtxHz+^_H)Ev9g@(28- zT$rRZYtEJvL0Bc1RAR&wY=RD?5jy`%BW@1+Uj0z0(fNL|dxX8(x*Jb1j7WXFqkx_jOJ zSCePX%43%mFxM~k$#H8LaRRz7H_x~{tOTl7XtZQdTas7!vGMHC56uN*KM0LJ8Su>C z%(uF*a;)kzE|{h8&U`;Avn!1um~Lm>?|%HV-t7&^+k}`jH`YkV^@U_8TFZLREk`oT zWq2drvVOoMF_$Ms5XLr^?vt+ELcrU9-$AP+CCRx91vn$OC*Q&cNWzzY%G-) zMULvEa6+Jsm52tq&I4!89B%~XLE72%UTlV=YW%Gl&uuHNS~e>LyQr~QJ`9cfW?-+` zBvme&+AJ*5dT+!htlR|sk(w6Gw#`I)e;?A)+*cEU6E4}K0awe_l`5p$>ZE;R4rV4v zcL&MztA3piqjT{3TA4c_tpA{zZpkBe|E(9TrX$!ZEvfHm`BI#st}RxS)gp(a$Y0DP z-U`=bYl+@1tzb=gbj#f}y@EKG$xIu-#dn#3eR^*A@-e>s_f(_aFOk*Fk$w3_@y%H` zrV4x49;93O^gdk&wPo;}wDSPQhXJ)jHJJ+rju$nt)&z&7l+c3v0%6votRnwtPfzC8 z(J%6NBVB6-tH6A-KV$Jky$RoY3%;!R`$4ivYV|q0-t}!~R?Ji3-1G^(5YoXvcJj?z z7+AcH_+<>E?K5G*M#Nw7Fm_>KQeD&7*9&#uw=p=+3!Q9=_3 zZiu<%{nkD*x_LpmKF5CS=OW!Bn-P*N{)-Iq;i--hr) ze$^Xd04a-H4k&Je*Jo)XBbpv7ErBJUxHYk*&EKW}9yvI)@1slw9tv6|&KHkGn#;xzEau22{fZ$*pIs z5v1zZ^4qh%TZQkx#A_gY(LcVr@zBM(@aKMtcil|Q?@MAo2(Q5%^c-Ze@Pe zcx1rMv^X5nWyPC4HQCG4q!v>AW1(BShKR0_2Cv(HEr0iSzh3Z}3+7pjwwfk|~-BOK;9kOzlPvU0;SkCrFlzE?+gKM4M19B0_p&y9B6Y3_+6E?gZ% z4i(XTe^1DH>(!4fip2ER7`DaCCB|su`Paq_Jv2^c!gdUv^&`RKgDkUC=fQ@;4!94; zEn9#8V7cRidDxs$9Ny7GtraUhRJr3K`CkIvAXt}K=kJgA!Zg0jSM8)s1I-T-CSfCO zl{J0ls{4O7(QL}-F;MfuK~}Alr7tE2;ejr2mH*Xy4@;F1Agu9INmrOMaLliQ1$BV$ zmi|BcnI%<21$mS{0sETBI(t?J`zBfJbZ@wV1vra5(?qvY+pmb~lW(hXVKDowToYA{x($4)F8WW5TT9&pX(3(|AQDAMo>HWS zaVRr)Tw&*CR_`>bDWmfW*F`*l@Z^K1!|k=zLf;3_0k>GHky(MCi(!^zZ^iH*24YcLSXFg4#Bz}c zO$S=KDo)$}5E-ZQh1K1qce=-%`{(_D&1ADR-xcpDL@{B;1cJ`M5sb{S)~x@c`6e?q&k^5wDcJW?*%rOzkXCx+LfFC3_e1_Q1|Bp4gFNbk6 zYIy=x)Ta%_8kS3G_6&~K=O3vX6m1x@(4xNs0V+5nGb6}m)ox%!FHE)LbE!MP7L96W zbLvJeSugd5cE(LrCjU}eMFo_aZz-os`i2whed~*uJi((WXaH1Ny6BaBuxU#Z_~$Tk z!Su3LZT0G;1`fev<#NmHi--iMOymDO9);i3CsC68*H|D5F|y`!yEdi$u91`B%X$px znPN3ddox0&=YeJ@g<+Z}oj;j$jNLTy24y6s7pIzaiTZK z`qET!cC!De?nZ%<&%D#_*x2VEZPNSeyd)Xul`ZZgn@|8iY?D;tH*Q}6w+jXo?_eu@ zhE1$qPualZ_>>GVf&G8@RTKr6SG$Ht|24KMF6&}>R2xPwIhQU*`_UVK4gB+L#Qr6W=7hWdB>(3OW`3mNptP zO||fX<`rZ4tbnX!`ZuA=0s-k|9Q5HGwYhDXeRqxQidb^Kuh2zS0r~%f5(X}=C|_t< zOYcuefMaLzdfd)S$RRi19~!vVH789vT+)#d+e#0t3<@XWgQ5c5J=Q*5=7dXYi6#|B zZ5bz+1F<&%F-ZnXwL*!s#{Frdim$TdjXhju!o?ICCiO`%W!T*sA*;*o=z00qEbPWP z6%jiIStl7*Qj%-S=?^|nk-vpEM`zTAXLh7dc6@}pxO4W|owVzLX)Eb*(d#tfcZWA< zHRQOVdus));`TFwGbmUcmF?3d#t!uYNJPN1Tg9D=Ki9UND&o1^wbPGBdj%LHN9*VD zIaB}2e>9+JxQ-N}!ewLg)4Ej6SkMI)-jPW@_2u_RVF8;(*^b6He*#~*f9L%A_N2L@ zn7Toh;z?B;LlwmUht8-8zn;O4?j`q~Ik#w>Ur(2S=; zs^bvi9mr}g`W`fxAW8=z_>j|mzpgEhWTamnCm$wQtfV?hxV0{y7^)5Cn-!<1)b1JA$`#l&jUYQd7Ks^qzNV_zW^x_KO< zIbTMO=+_1&OnW>KwEkJdbKRzfUIk#w`lo#&c*QMKssDKZlpR`Qt%UZ<)QYGUSn)L9Zn6)VjB-bQ(GG>zlqR^JY zPIX)zhO`nkPVEYiZgSeoh>FreroUh2Ld0DC8t%(wl!Yu20p_##GM~I+$3>ozTVb?F zvy&?WImr*;#8rRmLqD`66|=SI8k$~V5+9|W4RwM#hRgN)AZu=`Qy{+j&G<4|ZRbOz{BVnEeJ=}}$1O$hq9_Z-LgGaO-^KtnO6J@Q;jfpFI;?uju^a&x;Xr=MkID} zlKx!V|KZxdT}$e!Sar zqjFmjmRYsqXS3EV)YadY8<8;Nt;aQ#v?_HtPxjcHXE6N_QgGvlW<+s>w`sw1b`HSa zkG3IiGY&YO-_o=VpS&;Kf`7l*d7-iPbB8C3Oqewrui@bml!+ClK8=YVwRx^N9w)@W z?=n%EQ(D&figcjwskqn^p-Q-k8D8ohU}~|xM_eQDDLb1tm0R{mbFlck6wX&P6^7NNN+Pg42P5xXnJ)Y zpzS;g4&h|#dHD7nF86s!9b}Se+NGr97qz!IsG;D&-xg@klm|6?<3{LL%`vNyvsyMNNYaJqO4ipXKb{Kec= z$k*Vco9iG8GF?w<7Qec0B;E`NZi=Zz#6 z(O8Sv`H(FQ5!=%3E6L8zn&T69&H{O32SY4Y)b@44F8w=70sOng9%g}NLZC>iO6o9< z_B{3xyh#65d=7uw&r|H%f9!yrH!v*ew2m^kw`Yk;T~5;ZDx+W6>$vM}|7vf)Mw~(@ zsGKs*TpmWvN_L8k=MbG&o7Gkq-dCkbbuA8-z z-vQKhJjy&dvXcZJ?$$d+z+mY+y6IQ3TLivwZ2s7a)|A$b&DgECai8B&{`}6;TU#u^ z4TWzZ@N*)Ypd5F433DJJ12%ayWOrnBggxbJ{Ut=PST7fD<1Sh2!1oSQe|{&T8}$pa z>sXBsXd+qt&*+*Dh7&9Q_-AWY8T6c^JqisK*UxV0u%&-AOojDL5BeP$4d?1=%Uu`N zcX-}&mi6G2>W-V2KHRUz0C#0rEgPNS4Vw@Af=r0VzfM1Gl#Ehmm#M#^k4XUtWpM== ztfHjy(=P~%y$voy=GJRP<}i{f;ani#9Vnw(^bC-EAtdYrth~elYdDuO-q70Dk39FE z1Ho&CYQpaHlxZs!=%9ESf`^ym+s`x`x)L$Eo8W($n!himI?%smz+#pR}ef zi<)M&|M7?pj6W+nTb)bmm!v*Nyx9npJ)8~#`SW?ad_JrLn>#)=VO7 z7Zy|_VQ1X}#F4NOquzkD*9uS8T_5CpvdIGiYt+ZBFs<%uyCD}A>n2VL5hKEu)8lv- z4cO)n>GnIi8R$c0B)dpbiOqx|=^eK#HH{d};%t6A%Bc8V|4Yd2TCqs`ZVBZ6tD>;# zB+LDc-dJ#D%g?jQ`^Yp)5&=v2dWh)Y!uz%zm>ZR zVOUt$*n&lkDP=xE$d%+<^mp?)ou5cN#8L7@aJO7}2T3Z^yX;VW&CS1&mlI3;SG;(n z+Epee9cW`MJ}sDa0OA7hCk&lS5(Q=LKgG{MU>>tj%|iq?$?mlC@a2K256+?z($)il z++==HhCoi{DI+6kvd%2M5%y`XGK<6ZD(wWK+1%woLdJ*`Z)(X48P93IbCaP~VR}>) zX!c2-{Ef80R`54(uSMf{mq+x%6hhP{&v-N??SXqwi?A97Y(MgF+RP<*Fq534S2?HH zN-7RUEOk9nXcW>H3_qbuDLjhbREX8%mTz_5mO6e32O(Ziz-XnIJ!Q~ID-1h^5o$;% zvIofngMvPtR&I(|*wW5I=%(RMRS%|V zJ83%sUVuJYl?mSY(3qmbcPtJRkM+2)^CfS>OyNomP0e{d94hi?}@9Z5Mv}5<{}cH6Ck`zKCf1=YG8!R;Km}jm+y#Ws8CP zj|$hzPw(CAH5K_$+XV)0z_g^mxSPJ{qe%?0li!~;ssHH9tRUzM;t{M*!9vT;Y9Bl| zNMER~BLpRMtl1q_3^!|w!kU<(1`eQ*|ix?xcRGx??woNdtDXrlXa@m5J51w4zO)#Lvx3Wb|AlB6K8QzgfT7 zx`LRTU-N~&eb(##W&JVaAS8(2I6jcLLL5sK1HF3ie_)Z3!&NdCrGS6yAOr38X!u1@ zBS0vl%M!64H&C+_Alu+4J^7|wTA!+Ip390n^!c3MzuJZGG!g-AeW1 z3ES{#xU&(H7CnnXJKpJAQ0EnlUa`4zvBTe#3Q8~`+1NSRwggL=dkWe zn0k_9BHK#GTn!O!y7d{kd;MC@ne=3ogVv~aTEN_T)V7_`L;z@?jJqF(48TdC$ct|t zW9fG;)YCPmx>Q}iz{7FyaOp6+`zqE-DXhLeM;P?MQjPM$edRY=I6j1Icua@-8!%k} zt6V`y+5$M|5{mw72%t9JuG4_1n@9$(I5uoiC3s76p)HNRlE7+eYItV$4!P%?Ak{^# z3wsMxaCX0vR*4uo!O_NMWmk%zYak%_HH2@yqo$YYOMMnbTQ5!AVp4tW1Ye(J0AJ-v_#+=HmaPhYK?ZJM-E?_Xa(;nosucUJgIZpjNy9^q(Q}=6buwHs0y+< z%?gwXeLqkp;=pv(GTw}cDQeLi&kH;TE8K+g4Q8)MeU+|@Eq&f2fhnBl2J0ZR6(4{} zvBJomB`JFdNP|MU)^`~U`AjD6e8hM5sKPTkp#6b|Y<&F9pZ&0f`o6A{2K5B8y3k7b zTOrZ)!|{B8^NfR~0*TM`=V>V`RbQm!7?}O=UaxGt{qHT~Rpq7|?nH%U z1Qbu`rcE8RdT8~U(0CI3(g|9$GOQ~Nz~mD-UZ|LelDmqmL4gHQ;45|VqKQA( z;Qs;1T(J%nx+N9c;pIs;6>gX?{h))oGY5h?Ybw1l8EK!ZO%K=vBjws zNrh@Gh9X~56hOYTj4iV3sbkh4zP;>9XE@>rA^R&SmQkTi%oB<#0%Fe7!eqL+kw4d& zD{qCUx`(SfhvX+gkIH1WeTdXCkS{;Vbijwv&R!QmbhOXQh~D94dKU@eU~d=i@TXr9 zdj1JD+Z*q5XRUhb{3NN_Rs`Nfx)NI$j`$#nf!hY5*VBTxuMIjG?r!7=|rwDcu`KE{rlo{TES9ZBGcs@ zEN<1VP>aNfudpvlOSd!4UKBSs2zx5+ICA9(Kiew2ZV^g#zO8|?Ph_O3xgZ1yqHa!Y ztJ&>zrK2Blr24nrIe@ifON2v9TlRAk*cT*15U zWvK(##G77%&e$e;Kaz93*>mEJ{)nTHU!pd1emSvDX-tLDkB!8E{0K6nrjVD zz=D}YamVF~gAuwTiCiq7T6g=kgqu$}LD=b~v{m{>r%6-=@mCRxU#|oW4;yqZ*QLFB ztAimqk?;_CBK@nv`LFk#b#ziAod0{!+@+7fYeF<_mMs&mVyS?BsQ+7jK_SMoe1aIV z&WCABxakMdUEy_bovE)RlVSukT>gVzJsW;!UtP&*CkX!j{;A!PA4Nm4HX*VmQ_nib zANi?4l>#dImtB0tFT5g%NY%h(MZyfrz6pCWe9Co=h`*Xqn@aUJPaPDST3OJiG#>je zcs8Uk-j_;pBEdJmLN9oa1#DEX7=N^tuJta=XU7m&SRfIF%P80oQeSXf!Q+m#~u zMppimjExAr#)ad7PVa~Y0oVKG1%ZVfPn2Wf;^z}ME6q;Ad4W=Wo;ae27H`cKa7#mj z5*!L8y9M854BP;9QC8HC7B(b*r5s1921PwOy)`#+A9gELk7I0S@ugp>f{si$4M+%W zbJQp+Rf++WetVkdscM{d~j@4sa5wW-5|JDOL4)SW;>Q;+5=Y2dd@ z97!%nE&|k2i`3oSrls$)u5QTxMNJ-xYIJJHy!2)ZLyea}dK{i$4sBUVXKV&MwYxW|!MRhTQ^4SAKTv;TT(Cr& zKbv{&O$(n^VpczLr}?tN4RC}YC%#o?+I5c>gjpxSh;RprTsk_*H*dsVzDzYc31Cgl zQHjP8viFweFbV5CYFuSUoty_)dW3rp2Ym^<{IJV*96VJt1Oty8XP%n zPJ0T1%zv&jqxiN~?Ntj$$yJ)5mxwrP>|1{OQ{^*oIj|9m-(ZWXr>D|8Uy>EMOb8WqCtj$Sghc!0l%rOYt1<>|rnge#uNplcHIu0FgU2*M2;P+p!cIa$rqi+o z9MY89Xd`x5FWRHt+il=#Qf^MQ7`IseFU_QrkaTc2L*TDa zT}JZY!(&Z!fjy@CJLi-_bUGLkQNW|VdNqzP!k}6dhmoLx;rP~x#d5le%%=G`M$JnJ zH>)p7ak8>vgwL+L%8$ZY*J*nevVZ=e1(YoLmHRY7T?h6U}?eCP=XHIwfT3ozs`tk|0 z?(ljORhX!{e!uCCKwk=q{7-sx(ys)e1)Nw&Yu@ne$HXl2goW(%gFiJ7apX5YO0Q#v zh<%>F2Yhq%V!9d3lX^)yL!D8YZItoENsDD7h123{V55SsSH&bMteP8;mu zK;A2ub*MHD2??6+97)Ya?iTN2l2Lfnn<#ba-maa;H0~@w|16&KJ&lk?J;DmF8$<%c z^p<)GuV)h(SrJo>cL})s31tuQUtGH}Un_$b%yY6&C#bl&^9f_3{XJ z1P^F?E0t?q-`}aFp(X%5wjhtolVHTms3f|V2YWS!(R$E7#Yv@Z1Ngoj9js4#LbCc4 zX4UxhDWU(fVClGLY)>TW2_LH_&fjTU2`ys^J~nPMM-jHa@;L<~bhoP)Hd z5IEm43+X&*V3uv~;F@_-(PJUKSt5!sV12oRjHP}?HBFbse5-u*`b~#=1<4Mmxw$Pf zqb3UPw~=^BpGI*ga+R^XttwEp40R^K#^iBkDPUc&jc8*x>6>EH# zHZk+zT6@{r)oo@++Lir^9^nwF#_U;_(`Nl7KsUul%149ZU0n$Sgb7}~L_Zm6kAFo?EwHxtn^-A-99p2sq}V%R*YdjZi(n0&W->2&W17xe z#ozE{5C928yyEb==^Hz&1qbv zqT%~Y_1jXK)-o=0=;FyyOKZ~`m5_0GF+{IyDqM_h%IHNXsbGTDj}&r=y#dXQFTo+@ zLwc?9s&Cdx$+Z)|ybKAV2zJyZifS%w@ZWW_>S&bhV{h)j`ZZ=Q-!jhK|beCaoHnDCR}Sa>OI{br9r`7Jz`_@pH>Of zu#@WOQyA}&GwDvZO>Sb1SFKAh5s_L3Du;1!3NrjkA5nRheXGu6Ck}10x9>UHtq>Hd z3#|#P@(6{W@ozePXXCA` z`|Y;zmyNpnK79S+DOHiV1?z+ABTxS{$&^@SjxbrYU;bm^Y&^kvgTz6jPN@IQ%+G zXnC`sa^VvF4kGoNWudx|cIUi+_X@6v>qEfKspmI)xBvcUTHG@-3YSg15K% z#}ey=L?YH@Myx*FmG*-0?iIVOY`()6h944rUWi3`J{G>5nj#FaOJ#KIqoTGA$8TrtFZS)lj(R>;@Axa=AQxL$apGww1MCYWCjtDUpa7)G1ATlDXJ%xBMeg;u zyI+r8OMWP>Q_Pgs!;isVlFM7U=BNF6VI0Y*9eSGZf}ofT{xai`@Wcz zW^Fj#h<5T&b3XwN%s+b;iB!1SGJBrDBl*U#Flw(vZ}WVSQxu4_q7cCzRas5@jhYMw zrQI`%4iEqMqs5ew)Kdu^@5uDL=CPy<^s}2Ok$LeP#2=MUQSY2y=_}9c1{HW@2%yae zgEL$03YU5zCpcrVmU3|wDQMnF^7>zWU7N3EvnIbF1 zB|wEqbFuBUlUCyf9nyp4&zjY*#9`lv*6fmAwEXH&{I`(7y`37e_}aNGcnfs0`NA|M(8WliVOd2G@b*iL#2#%dBYo`PA3Z zF@-;l#kT?1$n;+;#Tt~Bq?RB37za5b@F;IIRoZ+ywg?5hOX-eq2qBl%l&^GbQ2+=| zsOX9(%aWZp3A0PJh|?tp%b>Oab{ZkoaGOpsIHLclheUZffG=l zS-}}mq<*v5$dQ3ZU7jU5Q>$4P-tb)pvsFH`XGt5}-XQMbwcWSC$9I$iMi$>^*YEU! z6AcS=sT+j0zmsfDs&Q7*XcPgExL6VfhaKwH)>emw2n*=9#LFK>d@DEi$^k&xUu^Bu zooCwbXit!(P4|gZlhR2Ffu{dN?zq?C)9)6V^%E`*r%1aiQbtO_D-knXmzs_i2R)Rj zo8O<>$;V3q{q_gxGAyc<1JaZCfve5}r%PJ-Mw1u}AnzE@w>N!fg^q;S_Q{~c)YoxG z0`{v`)O%wVayayL^onK&-*})kaiuqC@?$cf5h%2wKiF>R;JYPAkuw=}B5BZ{DVd4?BInOYACITB zTL7J_OCoW4s6Y+OM)$#@(&M<~5~T%KhijfsaVa;uO!_f%PuFv@ z4K%IW#vv?Q7WI=P}6Nj|(3U*{?ddarf-3 zE4SOzJ<*Ff1)dKC=6uCUnl-KsuDY;5b`nFHk!;#Z83rp&bD#h(rqKdsKvkH|qN^6W zF6QOD!o)pdWTQg~L_uOCqCrNQFzs10*s#Q1X_n)@F`t?ieMH45!<&KHT+r!uEcAG~ zPUrs+(7(9__x~ck5A^c@IY_!33+*D?AM(C*)4JxuxnOhoOSoa7j8nlQpykoO&V#q< zEpvQn=nD~?sG(953}Yvu29ghiL6ki{D^+heWCoKPkpg>{c*J6dQde8Odz&RDJsE9Nt3>!u<_ z^Xv8YuH-A9dy!}uoWs3QRDIP5je44M)ywI;8_d$dRb&FEjd8sndd8*CGGTp$*f81B zv|)jjER7~Q5#_6}h}X2`$Ly0F?;D zl^EBjG#9ig1*|F1#pZ%^Gn$^2q_b;r^ajGQ-UCl~NcqmLbh$>NR}wF&`SnXw6=S6x za8^uuk_Qi_s;mr9r3y^Np^~QG_%s*ik!;v#ON^z($wcj8W?Vh0&DQunDAH;DPZjRN zPD#{sU#5QtiMDaMS64EH-`c$znM*Ych>F|q*Y;n{xB}S?#C{oiyp}IBqmgtv6of{F zXR3v`@Zgd7Er~|`p|I?|3DyO}AFJ*Dtkr^k9E2RXygpCrZo11u14ofwEa zzZWAUBEA~RZ{{9PkkM9~7ZNFg0V$CmET(-R{C^<^L%OJIQZV*$fD2p3Fg{9Vsumd_ z((7O%wEM_fK8xK&Ke6_%0xqfh+azkcR!%kaN8gu^bVe<4CqKRno=VJ|VX;u~99C@5 ztPcI@SNKnBqYMIaP7xp>vBt-)MjA&$Zw_=3;g@!+d_@xYcCh5DH#vD7M-=wzN1n3uS3xIo!ry`&_u59z zXITdVYDk{=cT$B0dEe`iy)nzkEBNNF-<&;$o6m z`jf$J`+N~7Yduyf#qqAGb9pdDz(UysaCVT6HY;6!LnQS_Zqr+Hw0oII+suRBh=6RM znSY_+R>}mnY8@XeL$O@k@v6xHS(diX1_g{atoPu5lZ0WnU|K>1Qhp{PSG+)!Y;~Tc zP}0}q(TXJz!t{(feyGBOEt>cYK~~}9-``4>eHX=AHm`5ScX~dD$ZOC_&SKeI=Ea848PjH_W@T8Nwsue z-v^H2x799xI-hSzRIWZQB^msU+} zJBW5Jh8mO>MliBa26o&{i;4=!?6_BR@>iop>~jv7h7KQ8%!lbfh};lp-v>tg!AHtY zM~zK@cT@mE(X)eLf6h{~QDagedpy;~1~4xSccuY9-4Al3x|>H5Ax(L2WvfG$!jTJV zc;%tgR}4m@Gm2;JK3^*AjqczQ$2#qx?D_u(L&5WvC~y%IN6QhG>9YxmMs5it@9Oz> zC{IzbejGa$lL?;?ZzuyEy>y}7KcA#7Mc7LOoi0ejQtNBoSj^_c=Hk5Y%Ix(Sgws~T z;Y2{ly)8Af?Le8 z+6sg2w+SmSC!7@2QiC{5mVVbcc2tSg0)9E<|4wTHv4H*w+__$Q=DZU=3*w=bjT!{= zoB1#sGOIv?7}yDQ20sXaVMU*5jhhy@Ejh83&{}$f`?w@7F+tdCaNH1Yqqt9(-nc~; z)H^(MoUjb{!4^4>&L3}-=;b}ep2l2}Nfw2rgf7TB$0<07%fo;ouTI|-2kqT;GFZNN zT?wF%-tD$tb|1eM#76dMJCJyg06+wH8WWD97)a{tJ$YgJan5VbJ3}IDAulIK-Buy) zSw{MpIs||(L5Md|PTii|+cN3Ca>v{^eo_o8@(^v_45>rHw8bcjed|IE{lv6}KG0#U zUiw70)y#)GeY^yM8cSoh1Y~@`^$Hz7{|d{hNe~_2@dHS`Jx^Y@0&@pT4pu_$e4%72I^m(_-n z{-yz!qQdHV6^^UB94;(QsT1Pl! zC@EQ?DUyKANk=Avsg?9b)9XzXsPlNNGRl6Xow=5>K09xJ$NG%}N`Nl>>EWP62ZC2` zeTG>%H0t)rZQTGPDP6N6FFo@)G5!U{%lI;*&MFZ(zq_^#ob}&u_%-80AAHC)zybmh z*E5B+C1$}D+1qr?v$hoDO4X7Cc%3K^MKI1THj7KoCw1+X*A&3JClC#}A|N0r8vL+# z+7SG@9ZW&yHsXRxNztENUMws*l2AN=fE{l;jojPmP6@E`K9B&7H#cfmm$+YwbcIF@ zj(>0++G~#1%n$&p!ci~k9oI~CEN*@WB!)TAM#(7>!o47;_B zkIgssoe@+L3O_ERK@C~=_q(g_RThg+g$3g?riPs_ zIN0$awTmqfjn{^WV5ai7H`lhk12ReKir9LAVa3IK!D8n&D;>?9BA%}Hy_UE}(DLiq zN%>+M;r;UL^od7;s^qQkNjC2QnrlCI`{HC^+s}`B7F*};u3%UjB}fk%(c0|BWb|5+ zDyUGC{AcB3-!3)5;REoh0>z{0tdRdu`q*6@5s$9!sIIgu+4=hV=9No6YhNlc?NG4$ zm_j}$kfDxvGG9C=z-HQl-JqUbaYlUSu5s`mfJ)ey#RXzrNKGJfJEAXwbD5R`C_<5h zwj=JFWw3P(ji_9G0gp#}3LZ}@ek6;{`NzAjSC>&wVzg>6mN}%;GctfIzVp{dD#%A! z-k!Z+kUf@x#;q{xQoXk6;cL05DkGk|@Fe!Sd(c_#phuM%U`$viqQ#=>bx`uS=h8o1 zO3Z3stZ*<`b;E0I=~r#xViK-imrR(X0s%|iVN2=${_x?*2PtJU6IGuHJ6b(^6H|~V zS}HvGS=XlrOfSp`_sj3#1u*}vaue%SjyE}cUeO)qvYxvKADrrDV&l#+pMF6MO@Y5q zLC|c-H@!v9yQcD2z$~^;voo=&q^dQpv(6@lJ9hT@&mcd z&;jub@hrYYlRHBYGwcD%IUkFsnBf(XHNGvRs7BUI1dm=h1#_Met1&Bs-z=P-NV)+j zaBOge#Sfw~U&!5;DiKD0c6~Z$cQV6E%4`21`PIvGdE*G$#43v0b_w)*l3cZ?1dbEm zO}kf2uhgGMEnJjAXwb>h!lnujpA1DVTXZ9sT_GN04^_%ks7FODQ%K6uCy zZPqnw{24J30e|oiJY96|rJZ(7&6lo)b_v_XyW#u~@<$M8b)bCTp2u5W`J;r0c7uo_N9FviXsgcBTZFu?g8|MeIQe;F%zxyvB~nh?Dk%dy}} zyL}`9tG_?wIquIQk9XF=*V+e~L+q6r^~qio&tY6o$+aKd@UvOW>-0Y5H8nH8%`Ytw9cPzzgxgL`ASKF*dM8$1s^0d*+LYmgE}p`! zEs;xBlOG72Jn(Qgw5Csts0g(U#0wTRDAP}mcbb%uXh)9&_opS$k&B-t)}t zXMXd{JijMvb?!A4_L|L4jUwy%#d^8xtX=Sz)feQ!I}aa@WcKYkIaFTLO3p0@#0Vq< z>a*t65YT0gKBZR;*elWfAfi5fPxTnc4b8*zD)c51Wu_YT`CGi>a0CD%B##?R7jJMT zu-yQ@<~yB#$KMu+yJrkEsvn>XjTh}`v^bYJyrY#K)R*&JM)LU``$t!`O$EgD3NCTFRpY?3-)p(ZE|}vXyg!Eh zD@fDv#J3G5g{NuVrgm=!T;~DSlbjwIMy zycrANx6RRcp}vg~Z>QcTHP=TUzvEB^>|GR6@AbOwO{CMo*k(Ed{KxEHlctOON7dnF zhHSv6rCHC4yz`>?XMo*cks$;9<7#yRDf<1s-*La{l+aHc2*Z|myyD0M51jC_hl$q5 ztW`vImu9l~x4-+i7jSe#nD{ZS4iD=%@)HAT1Fr8imjdOx(bdj;S=tL(kMOl|azeSr z3B3c`X9euGtwPUxvFxV&Ix&=;eeWa=apwqt8x0(uT)l=5ff0S+iU!aH+avFgi_S|>zeGiz_}Csc?|#rr!0&C)H`**6 z@DnATW#V|w1h&q+gXTNjWSSH!#6#T)xa*^G7<+=49 z@^$&l*bat2$+kRGgGdnZBB=yFua(f zv!V;OLU5a*W)}8y!Eu;+C&1=Xq6biwRZ2w-{mtW{T>uy_ zXHA53|GU(v>RN~4 z`;uQu5F1iHIJ(1=x*5QHpGyOJIx7UmFCp&OYa}JM;+`*kZ)fd!MEm>OXMM zOCItf(ag=Xk5V6`M>R_aJdxuO(&MXTB7fw)qNB*Ww9riSyTec7lDpwq}-Ru;7{4|kGX7%MyhNgR@*yhx#xq7dN2&>((4^>l!K*nlYx>swa*!Lna zcA3x{=R$09+)3n<$f)FHol$~&4u0gWC$4N1Ob;af%jrZTrVuA&@>hB^P?SfpDZTSa6|oW z{&iANFlWME)C(#wa5@COGq%XP=@X@))oRt{zil+yRsSlt_4&0ALj8)zp<3B<#&>Ui z-P~eKP9&rp8Igy!c}}T+T=J|*hlD`r0^U6Eo=hnZ6kl6%KkSl~pUkxcdw!K1Jb8lH zmciNRaTS)mLX zHrY(#)F^=OB<9`1ErBgNcb3;t0e+5_2Jl)dlQUV2ZNW4PzqBct;jTAIj2} z`?S}p_%%bkg3wz?0ImYA4`B_;;6hau2@rpkE7H!G(*$AuOF^nIn&rnnJoRt#ct`67 zEWi>$JDZ6tpEL&O4CXv6ev4Jj91Y5_Ck`}of{}E_7uT@)InH>-f1CFn?$Trr_^;=# zesTV(bxQMW#Sx~JJqraey1+rIcyTbFg+PqJa7x(;V?637rk!RDckSk6evAG}KO@ki z54|=n0E`St99j9_D}hi21mfI%n~2{PY4Xz^)~>B-XzxNgjl6n4^{#~i&Cp6KQb8Lt z=>R>5BI?Rjv-I1@dAUD9MvF@aDU1V`YhwQOzOS2T zYUV$NNz)Q7vzAt%e-hvzHm|Div%r&iPR4VW$jNDUu*+K=h4&eN(Z@(Nj(n35U0upj z5NZ6^xX_e8=uN;8jzO&N51Brq*MRLVWOWb-z}i0TCWbg16u=jk4X zQ(TL4F{XDP830Te>~2bIu6|{fD|WAL2ifhReAQfV5T$<&{LS3omCpxz2{jDf`3%q= znjH=Yy;82KoG@7D9`=%z^1BFx4MO27&+MQ@*#yYxQO(kypNbwS?QXvm(DgBE^idjH z@~+r``)i8}wv>0@A{SEEPu~8vjW%6kD(;yNjXK_9jmR`njc|7H8NwL4uC*ZfqX;PmJpsfkQ@aun;F2_#M23N^)aOSTkmGtAH#*PMj6^CJX=UEt|>k6-P6=?osMnl@9`Y! z0g`h322KNqBlXy_TEIY8AY_C)2ii#TJ#e_k+EcrG*k!0SNWC zKIW5>Rgc{@Mdh!0CUe5hhQ0}bbm)ZBby@>V=>lSKZ*B1b*hJIC=BcP);$b^`Eoi*O z@{2b=8r{r({)}y{h%{veqN}+2&oK2-ZbE>)a)6J7_vhfO>SN7vhwo=5PmjGoi8kbC zNT+vexh_2OdHcx#WQBjMVEtuzZ2noojoepj=*V!<&-U|TYWx{Dj_N02ixAq+u8H{5 z1(?q{E3C6FO2F@!0FGX7zgLS5FUc;D#S&zl`J#z8x+d990vzU2Ret;n;2EofR7=x! zdjC62`tcQjNp0A5ZV`pkKK++ws!jlV|6)!}bXTf{UVP#$;Y1vIt>pCe={72IVKTq_ zBmNs~UI!WLmH#()LF~6%KOe{)b8%_IPN8ZSl?O4@tz<^Qng?06O99dX#{GLAb}dN$Z$^kk*XB;?MhX(ANkX@XfN$}5}mB@lm7A*~v(1!Mihsr(xk{nW$?I+HJGRQ^E1REP=7FT>#om%1H{mc>4GpTb5 zdhr2p&|zyd!UY@aw<6JFzsgl^OfPf;2L;(wrzq2RjzrSmYG1Z>r=uD>BmupL0^CeX z9m`_8C>B!@YR_={q^_e8Q?7Qa%Gs+v{66D`3mCHaRwxQ)QlGI z<}=v7bP#k?Z(rV^Mxy(e-C~B({<~`v3D5MAJC_HPt|j-<&e4KnGv4I)lJz%EA?zOfuNOz_597!901-ZF?9C`>y&($;!e~XU&6a26Fe|5QM zRt4#~uu-4b<|%KUUAy+Ef`!9rnuA_Blg(P5yv96!1bl{SQ0$*y(m%a|WLlOBol@_Z z)718~7$H6~WxcCjtO7Xl9eSRn1-w$vUn)p^r}u5`t;n4u{l;d(=o=ZBx2}m%`|whb z)!IQp)n5e(RO(As>BkQ<7vgNFog8MG9)IEU;5}fWe;$~ybsT!(1g+73y=6omswJ4K zA_qz>nYPxJye#T%ro61GkJ9c)0AF#05qVxDg?Yt7PTF-wMp#72Rt@b9W`9i01oKUR z;08nzCZ|gLa#%30*w%t;@#q;apYrY7Iq@Ow{w0~R>s zDy71B+2`9$Kn}Kxh>o@_=d{rd|1lJh=VP z7hdiYv@5aN|7k_vdX(XWDayUabYKO)N8`rwWX)_jVWHt1k5C$nCv6oE=CWR+HHjV? z9MgECiL%<+H|Z@g9$`Zn3}4gBb?e@E>sl85ENGxU8t$}!mwCU_Z?$H{MH>bvFTbpv z-On}NX3ndQ&Yg?!Tohl%o4q-uH6fu%OQyc}*ZCM=4roGI$Oh|3z>n~eiYA1n`O2Vc z`?e{*g%>?zd-obA!lz_q^qfGj z^c#2Zb!C!ioi70qm^5MOdk@JE*mGv?O=9L#;H(sGY>8dnaXJHCkL2Rw{L!+v9{cT- zkPkDqQP8D%H3z+bZ9_8*-S)I_E@^1+P*%huZm1&JaU7$hCUbtPl`%{1_9!EbV>__T z(^)-HCyaF6SK9^PaLhPy3`NLFNYhwQ1cz@m**2ykaM>Dm?M>Bc_F4VZ9UA^F};+6e$*hY zsc{SCjN^eop(!nufS;mJu(+3Pngo}?>D4qtMK#+KsPLia3niWM)= zU4S=Z0;&Bidq*OYHdFRLGdFh~PQ(;^4=x2Qbp9QIQZd&^9s4J zbfdj`d8x7qMp){^yzgDFNyIJgo($5!TW4s3Fr97ZaQc|n2)ufqlt@}trb-qwJY4zO z?!UYn;r)>4B@vA)jNY}TMyzWgOYvarn)`b=-iou zPsbM|6lq)4@PNwWe7^DRm1$o0mR5dJ5I0l+BG9~EXyNCEKrbKZYjQU)%#5%{lM)wA zi9cepvkC>*_kLu0Z}(Z^?>J84x&@4Ebl4P2KE#|yPMS63%PlrlPijB~&K90W-X9n0 zf--Cm6c=WsxY?t+gYw+$@JH}JsEcpwg^cne!-?IcVTp?gV&6-df*{TYh~AlpBfY*T zo-@}{Mixk7=?NlBb$yf(X?DcjYt#_pChLB`43R1GOPk33ipv2*R_w(hdSzXYBiiVc z7+Wy;e`hJm4bPm%M(wzn$RMfSWn^(NPjy@@d#!XrnsHFq{TqE`*)wu zq@A)$Bu^*5_qIVmsPa4C?yT?xNEE}g(%-SU@;g_X<%;S?v5TfM>&g!?)1>yz*ycKo zA77;*O98h{mjaTAbxk-{#Sx;XxKNa`cxhU_thYTey~wJHg`7F&nwCLKPzm2KFR+CY zYnWA#Pw3Cwb{Zk&FQ=cES&J^<%MF071BbfLI484MrDMl9j==Eq*LLfa9`I&=#-ff`c4e@7H zXkD%Q*c)Y>(g@p)&3Dtjd9k?&UTD$%tBT*al(vISE94u;3(4FR*;6azs8o&>6R2S* z)QRDIOwu-lO=)`opYTK7&Y z`7XoCM0V*d)L#>GtNs&-1=)Tkj=hohl3#C&3gBM2=gy7!Zth36x9!h%rL1NEfpMZG zdm9JYt~~AC#|QT<(%q@|L&Tn|kT zNB7Bor^^0D>T2@L!?{nZA=O(JGv}|xWAq84QOaWL!qZq(g-K@|yEVWGSt2j>&@*&- zVxjYt(+AnaBB(K%!EZ`?KNbQdzlkS8Wc%-oE9WT$JZo@LetO%VJeDMn+xklZq3wex zv?K;dgW^hiLc<;xk!~AabZk>bdT6p3z z8(uWi4}nFAxo@wglolc14V-HH1wTW6!A~rOa#YM^@QV_LAHA0(UmpAIo)}oE@^O_IKcet5;Vl;uX%${ zq@j#2r}&C&({>$*m4gnlY0Uz&S4~F@0DGERHXvBe z?Vgh(G`#2Pt-|=6>6Zu!b^ZrIAlU9h|EFm3`J~y#5ak zRjD@kovg-S@byop(MD4cWJs*c&F?f93_3})(YR##)Dd09ukEN8lAZSq27tM}>-$A- z2HuNXjgKio08CdL-TDHZ=cNnyn-jjcn%wrB5XT38o`6+~?zV8ZGZ!1eu3lNge`g~Xq80wnCN2+y%d=)wAjkjycXI< zCweu?iyZuDsvhFfxQJ4MGZf1d7!{|~2|`Ye>`MSK-yz1#WNmKfgJpeN>w&D%iOCBX z;ypBl#b0uf1=~bfl0@a?Nfc!2UNXqC z0uc3#|(9cG2f;Z5y)aoa>~Zhb>BVZG67%UO&v23XAomG7*sq?hgNBj3RRtcw5H z8-X404VnLIs$rE1u9$omz#+;85O@Ym4S#x@Nyw9NZKVf5StEXO3t{}k^Ff!d*in84 zV4YU=$bXhc%>Rj>%uL47qadsrQQf~c^!1kpxk}S05}4qE>ZgrTP8%d1cehVzC*g>{ zKc^KfgfL}i#6lx8H!)X7+e@zIY}Em?n=%Vo zq)yS!W}YGMAxdhzd#A4Fh(mVO(URIggyLmvTdPmnIjmxp5LvM;O6!xBWyv0wgPm<& zt(1fjI-QF$&`+#)DkoEBGMhxDE?~C@Uv0{LIJJ=9{SH_G;T7{>dMmL-_nYK%@?}QG zP1Du|`R@x`|5Fj&YjA5rHnLB$Tw@oFEVYh-uZkt37} zJ<&CPNO8*5=3`E1xOO-}VQ|GNV0%+kPDrwDB2RLK9huvU+bu9;-PqI3Bfv*oRyO73 z%QDR#bo1Gb#J40ObGt7n{_Ni>O5n=v#9jGx|Cf;&YvH$QE5jIw@w zpK+h$fXIk4vntErR^LU~E=KlCP7&`FDfkiV`MgS>rC_ha;#(#8ICFw^EpeHbgCP-u6&CSPGu6m%uv5!C%ZqJx zwpv-Ye7N|}K#jY7AqPtm04_RpWNGKce*4m2_RzWG#Vyia#ylmjBZ`Y+aW|;4zL-FA zC0cy=yi0UQxcq%)VG2hw^e&q+lFj=&Pod{0O1d?BY7MnC7B#lV2cN^2bmSTGw$G{} z3y+WxODCb>M6+i(exR10J`N%fD_vk?IVR1FNw|9mKdP$SyS*(l883Kb*#@0Zm@=23 zip+o^bKxRY-OYk9)(opt308gg#>H*#RmEuFnmQRs}QF+_$x$~^KQr|;1f_6eM z{YqRR*^bz{(f3TidM3YCvS4~Mc6Bctx=+sP&$#T^9C`1=>+LhUs@(14 z#Tso%EW`Hjgrcj)c4hfR=aFe%8s>pHXlnlUNoWVL0qwnbohakW0swC7YMU z^c<&p%uKlqn#H76g{mCo&TCvOwi)hbXj_~o-h+BntiP^Vrgo=~L`4Gzsl@Ij-+@Kb z{Z7hQV^bZVO7{dQ&ABj<`vl)7%KeF3CK)s&>H6C;v#~b$=FZTdSsrqxBY4hMG_3w{ z4Eod2%wk_oKzh%!bb&cJI`&&D6-VM3qw*An&--jChnZzAS+*k?;>t%n^Sm_Kx4Fh| zh~`If8fVcEk!m_HvvM3*m|{V21RzZ?h5g5u(@mI=4O?+c3ov$~25dqcoT-09qbndZ zx(-C8r}j%P(CJg9QYNC+Vd@7cr+|h6kI+L;j$Df&ZF|T7rNQ>xjrs*4_or(lhkME9 zX^Qo~Z(#*t7;uZ9;H2=smHr=T$bVnSUxyB?cW%qSBy{Nijm?fG{r?`WUG}*!WBjAQ zP#!EZJIDtJRYTLm<1`m}X$PZCm1>K+Xogn+Gxt!mS@DskVU7K>!D_Ck;i0&C&P|r} z(lEdP92e5~!J7POXSi*lZ`xbJ6IcrjPJ6aP>6!du5LW@EWkOpPJRv`3UiVjumVOsG zLH)+T+zUdYk6fw0pcoBvDM-$B^`l0_AhLi#aP{9X)(VT^d73SbhS<;qMa=%nzPIHh zlGq}-Y`w=zJ>_f0nVv;tNY?~|Toic!T%8CVy zm4?=Nq5Mr?71bP(ztPXh*yt^3^p3d3L&9iZey!nHzCQ(l z1`Kr{0vLcb=XWNJ?Tg9+X$ZuVCuI>vEG&YXL>7b_=l)iCi0#0O#V3)r-Ie$cVLVzR v_w-llywTB#B@_VAJdL6)TM!C4^ZQ3ETO}KWhh6%>9)jN1Q!7>Z>*fCfxsP^( literal 0 HcmV?d00001 diff --git a/Workbooks/Images/Preview/MicrosoftExchangeOnlineSearchAdminAuditLogWhite.png b/Workbooks/Images/Preview/MicrosoftExchangeOnlineSearchAdminAuditLogWhite.png new file mode 100644 index 0000000000000000000000000000000000000000..41284f87dc3092eedce983e8e3f03dc838d1b9de GIT binary patch literal 84209 zcmdSB2T+si*Ds0!DyX0oDJn%;1gQ#0FG_Er_aa54mk6PSj!5rasvx~X=uI|7K|neL z2uLRcq$Q95xzWA1|8M5bnK|FwbI+Xf&M+xM-mJBr^{n#yttSycb%ooc^rQp?1hR}#T`Q;nS}Rs;c|M+p@K4=iRW<9#<%*q`d|;RC^Jdd{w7GWu)M5X zJzI2<6&EliVnc+N?Dy4uo#dD3zpv$}(5wGG|0ySX<=^M0kMjS0O5m3O{PVoC%3YTE z#fGH&N1dwVC)B=Gi4z;+4pR|f)r0kD{R!BM6#FFdOb6wtTN&TCG&aso5;8WlOnUD% z-aJO{l(H3e*+wVpQ70XXrhV^hBGrdhK-lD@rWuXY6OP3}Zgx~q)3bnr!msqcP5z5I zb{&%@CDy9(#m<#^+|?hsrCfOaR)S3?nIw!@AkXAX+Cn--?}#TI@u>ECysjNHAv(RB z%9vo=h@6j+mgZKw0UQ67=`jZyBa@k;v3THn-M##`XKxJddmrW)X?^qj=3HuOPT%m5 zC)Xz9eyWaKBG7<0>3;I<2gSpI9vg?xsqJKYF3-3tM(u)O9A+!?je$6g3WQm|pNl4B zlv$x^i*AR7#t3`5UNG-GW(Dg7`c*^NEPx+ybB5XEv(cp_{m;e~V4=crR2o z!};i9pK9^BVkVnm5R>l0mF!y?=;7@7!!q}wz?7N2>|zCWrSL=fz+%5_TkEw=2F+Y`%*%uC|p(C zp(;utft{+(rZ?}MkHF*YZCM{#=I=<#>KY{dHZJ0(``cbWZ`}Go(aJ=UO?k^?Y-sS{ zToLaOOVhQa8%srH&mLswjN!t2rSkdYT9+UnS@j*59(w=nA%PTZ8=PYX1 zv%iQ-FYi?hIO7en2-d7R5PR7h@u-A80QkfU`E_cad!Ogr=BzNxC7{U$`F z8gu?K^ZwE1gNQGM$>HmzJ^Npe!=kJ)HEBghy-nAqOA`lQ6@6x>VuDv0b6j9hDedj! z;<0qUd^hh|q)0vxs`;^7`}$qNK#_?;u$-X0`)zMbY4~v7RT5$iXr6s@p2{N%(v_>u za^az}Z|m497hS%2mN9eRGY?yK)_lAhD!Zper?p5M(4`uV8vodiQ6Kl;d(cOzx03uR zRQ6SaM!O<_HOGEJxrc+&K29}FHSY8zL-67uOz@1AA1=a5^%*f)`mz0>A93iOyTnTU zdsDF~50iu;GH)lm(zr~!1kK5>+BCMvy*I2pcH*3*XJWz9$>7cPDjpaZ(vhuvX8S3g zlJpFeOS;=N)t)VYPLRs1zR0a1EvI6mA}xaakdtNZ!AsuTm9d%gB;Y~ww8Q}m19;zZUyry$j~#tt|QGs)bx z+oVI!G2T#J6!$R>4U7%o0|boH9QGW2TVI+N&cXsI$AuDKf1J6tm*;Vvo2U9dw<$t@ z+PsZ}_S@M3gl@4jY$3%mH~CQ0+wx_mW0$q_n&ni_S&sbpk8ddy6ri?d?M?=`agLM8 zQ@#ji_s040JY>0mbM{e=xo^jdsPB3`&?C<8MC(>c0PDf%Pcs?Vs{Fz0k-#D2 z`tb?1{Ym`x+=hFSJ*+9mnRXoNwE2*)>4qBMgJBXU#CVzyR#sNnu)}86C1vZl=PKiW zW?9j`)ZY>?MPo#!o|L;N?A1y*HSck@6Qg$s^jPgsdK^=vTZUe2Rldy8hyn3)@ZNUr z8f%iM1eJLw-F={@T+02;Jd=k@BmMsA*Tl0poLN9MCqJCq&#`g14n4yuc!y$JPj-21!#7dRcyPvm8V&5%Y?t0KZk_t<7n()NVk0oNpC&jLwnlhnDJ=*rw< zglNrzOqaQw-rZSsVC*93fMbH2%0U_WwOvwGp|ZE&t7NZnPVU8LxD?b}Tk(YTMLnaw z1nDDNqveRCt&P4LmtB>exVCD38iyZ9hgX!OuP7t-93YxxqX@3iCG&5yOVc?^JhU)a zRo02=y*(Vd;8Ws_(FQvf#(?95mY3Fp@jc^}#`-Pp>ya(LLtNkwuBy<_(01OCUhC$o zsMc=l;k~?OvG^a<08&xDgG*^(x9Khn7IJSi#%qHA?pwZ^WbWw3rlW=5rFT>H0X*0ft%Kh*bFyeR=9TL#ERTnR=+Iwt0=kFKxrzw~6g$T3;+B zGAK71)E0<9pQwUX2s3@9!+YV45vADw+|?{d3F`y66lUewx16vC4Wl1 zl=NCsY-oZaeBx1f;qGf7)EfF31WHxGW%hfws5E|gm2>{S9&&zlHDQ{j z-Lz8jp2>zTX)^Hrfv@=TT0zZBo?rITcyacDwfW=;prm0hXf@6IRYVJ4T?mWAwI!>4 z;RBQ)7Hg>ih)ye_+_?^|PdoIuHmI;iq_oGL0mlf9B6T0@2L$@MTcEr0~T zdk;VnE0d+#hhK*v#~go$Bf#DdWk5;bNY$&xXsJnwJwMfe#)?k$#oCG=>~3sS!^}z1 zR?kvxmkgP+;&S3CGX`vC%D_dqsEMn;RyC!Zbx6&0^Q-(!W#aXI;-<&?T_10mCFbuV zCUY3qk~({s^v^_JoQQdN1bH(}9x^1hA}idkzuuD*Xyc=(~GuuQ89_dp5mt0mQ+ z)90cz(-v|i{oT`VVgaKMCuYpkoh1$up2UrQ`JT2t1d`*)74XlQ`A)ChReOAiYH0bE zaRba~{OJ0Uj@z|;9pH9OcdN9ihB`S>+~R8aK7&1qxH7r=sH9!oH)?l8XU4wCF-uC- zsH^4k!Z^c&Ddm(dM3B3OX}xgqm!Gd^u1}|IZ-~EZ?WfKH_@+Md(d2RysTieGM?>t4G8H%zR2Q7(?J2p)1LkD;6#yzLF zy(j5FJ~Fe@^w(|(&D!kOD?!U{ic;i5EFzjkLDOb-%n-5egj@7Xpr_Gorn+J=4k%lY z)X1oX4D5uQTVXJ)WrA!g4xh`N0{0a|9N~gSBs8abn*|h# zyga(_r+c7M77u&)4eTLb%=Z z#C7KbsKx?G7*T`6&m)k`$PPRxsc1At-W&@`x?A`4T-ckxb#28+ga%q}_U097u^S%%1Px9=vi@&nq>>oGol{_XFa%Kf>3=7TB zE~%-d*f%Y5I_3B)cVhR%K#zYXw?2Kmyvy1*IBOC=x)jwfuFTu#xY76ylMurs+xPUq z_1C!%q|5w~l+=Q5SRblMY^=DyxYJH&D!ByE6wtXo+A~=*zT^qw|>b znNVoYvJ;`V-NzO_QjU9)ym1TmY|n?aih{%?Hv_pctnc$KLSm?VVe|8)OvoMY2Wpt1 z020U5GsBvrxm<{O?d=PyT?b~R2QaXHM!efPa&=_J?H1OuHb6gA4d8W)?zL1}yrdm& z1jI`AYq{H69%>}M+2r5Pz}ZxxcR={HZYK%*tHD9hl%?wFUx$lyXmoSsH~)#(?;Jto z-`5rE`Y;a}7=3Z?x$-UAt{tEnud-3e=7dgEAlb+bAQP7o4i30@oc^<(QL|#eJAdU5 zz2W3TQi#da6t0*xRrOdTnC)BgQqLvx9~#XR(SAKj z#xB?n{oSH4C7x1}LJv|aIqoKR1G#m5hMqjFVFbzc2LlW|LT<%gV3Vss3xJ3dpTQr$eSZ zh24@aA%qdsVBm~DO+|_{=_td46VbSzJ=%+Xj&qInL8^?Xy7uY(uxBOuTzq70oUu%W z5_}tibfvb^TwV{67c1v|98(CYO z^t)8ys(SQKcBwCg*k}&vNj~}5ZijaKN`A1AD9D_h>XcHrGq>iQU0`vO@16ff2;4M3 zcgErZ33niaI^e5?hl$U0Hl#|cC*YeYgKuml!X{sQN>^cluC_kS+8w5UAGCB~k_apYTQu=c}dKBIbSavgF< zf$4~cjsY{c%6l-|>I-*};oZ4ftF{HO%Zm&1Hu9waa|TF5$_Eipze%DOr{P$m1I>kb zR1Pp*aL8}HI;662vWnqU z#AF%vG<~B*G81~ZU+>Shvz%k>oa#uAF8nBUjY1q+Yf3piRu*Aa`&XF_&VTnWJ6cHhEC= z7UC7j^nhsr=E*F^SSMF520}*c`-5qz^BxNFO6sQnOt&wj#_1wT|KcVrl{;%4UuNHC zrLL>1E0nqLaliCyK0y372A~t4+iT!G)$nh$H*SawERiuP9xPRx|NP9oWD%|%D&1fE z_Utr9Vf_;JA!vr4a3=GLXBX3Z=FDZ~W=tPLblppRVP2Fsht5GJtuWN5F9Qg?_$nma z9XchpcIpO-K6aH+?2>NS#JrjR+BJ$vDG3g`yT<*78_aqiOB&te;&8o-q6GY^!J!!) zMmghgxI!yA*!6q^@&420tEPi(Dap+r7lxdnp|Udb|6@}mFhP}?SR~x;QnfR8Uj%ry zL%4UbpZ)KhR|TOl7BCD=HHHSNmL>G1BY1f1X_tRg> z+}7Z;OXiQL@Xh)el+1^1jL~NFeE;Zvmqj?FIiv<#Pi(%Mq$#>)mTbi}Fv~t$@hX;> z;ek5)4INbY6|p4qzre4MRJhVPvS341y|#R&_>nJSd$9>soL&K}7J z3xr4V=HF>|n6`Ry>e^fQ7j=o*qmRzQ>=$oGSMFFKIAT!^C$*o+4ZKaXVL;VagixNa z@hW_qsNnsP;Z-=aHVPqnW-u)g@7luQ(Im<5{ATXa1mhVl8Uo`;Z3-aw5>NPO{9UXD zw?zo2&jlS^M$^d3<})Eb)@sZ@5N(f!Y_Y?n+gX!K+=bZgkUTZj({Z{lk)jHG!Qcdgs@>x@V)fX^ z6#E^06Fyu^(nvS{?Nh)ys^|C}7S-lX%_6-_Hb3wI_};F-9A^GFAwK3EHL8836M(jJH~%mUP{YFoj!6RLN>yDg?S|}vm-UyTYd*8V zN%oHZo7UOR2W(Wqn+){b;?EBmK&H__E~6(Xi;{uRJbGU#k{R3HYpNepnQzLE-g;`T zkj_E13#JLrcrsTBoS$+_1HHM*`O;+OF$H$5D?y5@C!!A7+g6eG<#zBDtLnhBNS>aS zC(35B`FY5X$QdDXX~kgFnDutNqaWD^EN_M93C=%iz3u7VzMC<{d6$_11?J2gXa5uT z1+bIA7rQ$BeZ(%!K>*x~Z?_3GxJr@pykKW)bMvU5f18o+bq5m1T&k0Ny1w``Oifk%9l%%l)1$rjndd?L>(G@hlt?Kg2R#;!3GqwhA zkX-D|Nkk1OkJ1zqL(w-q0jP@zzbVb^vFmGL^+k3?@?4SFni7mV1J@6x_ln~*e;7%t4< z9FfebJUQwjo}RLoQr{Og+-%ULsXsyUW{;`u(a~;f(_F8AST-5opZyM2HFpaS7`=`a zp`stTb?q(EgZEc?KV22VANrkGq}(*h>1aR+z7cY>$&}jI+%4c<9lnyjKH9~^Qn4TO zyjt7fH|)Z)jCdH|P5FB_?iH5A;Yt7O}9_@P$C_AhP3*~DAa}$)O6I1q*@$TtTy|RTR#;a=p zbWaJFyv(O1n3L<=sR6m($*RWXfTaFpN}A=n)%q0;P1s}kw6j^sZn=M61Cor{Db3dq z_-ktB*(*2=s($&1jW z;K#5x@BLnN)x+)qk2v>4i1E{d|5_mkA1h9RWcphp?NdG ztB4PBi*8aZez_-h*LB+^8S{6McRGnSf7V#5V9NVztX5Q*o67CrlN$^dQ=HKKpyui% zVJtX7vRdUO$`d-Jgx$-yROAy`1LztJrt`k@ZHh7Ho7^;se3Ty_kJ5w_KaA!`U65n5 z=J3SkZaB=KA6jSIE$IC*F%|F;VuQKl5s6*-N@71vzOryXGNkSOP zI~jW`KJG$;#Sn(1>xde6r8=2{8)`0fS*9l+@#vB)<@?(8(F`7XeB zzC>G=lJqOFhF7nhxLLebtgI0HiIUWHVbBl{5er*7V8OwRCsnMtVi6f zUvHz_@RU46`>{=gpNyeE;F@atbyRE2+V{>RYfbs|&O(uTc3m@Mq7(m*TwL zZl*>C)+1n>JH59u-@lI?-ZUYV%8wsJ&GDLdd{<^Db2c$PF?1OZh;Zzp+Qyn`(;~~J zY|gmU2ro>hiY}X%^=jFv-X8eHIUJ&&OKCJs`s;{xG|Aw)*bL$r1o{>_6|-Ti=5hP% z8cW(-r;CM05`JlGM#djfc%+wf$F^LY?*^rG)8t z?+^F=-m(O2w@HYZj5xZIWzd&Xs(@#yowwp{ck4q7yB>Ui{l)(l&jsNxX_6PRS6mI4 zdb1kSWF}HoFiT0lFnK-CA?R6eA!1SZT5#|PN%<8MMCW!uwK%_J*^|px)n^@UCS;E3 zyrrYlWPUC>RpUxpNJ<>x?>i>*u~HF)FBj&nd^OLd<=`4*C#X5dIu~h~w-R9DlacuQ zYrnk2f9)(UVt_ne9aqK$UVN?E=}1KApt7jfVSSu<;l8v$LGWZiFE&9~tRddl0q&^6 zs*^H*!jQtVUlET?8@~OIDflRU5nR8oZkqol_d~rO`gz9XYgfO&ZKq;9;Y86WSMC?} zBes8U_)|eP|2b#$(J#X6*Of=02%u8HtM|{;V)kBp_>)K^Je&Pv1jdP9beF zj-zVLG+_n37Xjjat+=3+@#mYm%E^uU$s z2wB*7UB-XKi3|Zyk~$H}xKrOCzqS-((Q=nnUkVK+M#sDiP4KJXCD&jh2=4K+f=@g6 z7IgbRVc~OOzj<}wR#yj0e%|$c-Qd3pD-ko(UR?+EPw(D!&Q55qL0M_IhdLxFB1=~O z*jAdK@`RE!D6frc_TjCCa%8mFF%mpm9@z49*|}~p!et@5I(WzG1(ZM5hG-!hE3}US zv)zbh3U~`E&-3Towz%;j4$}3>74bpowl4*5!ny>)<_%SAd?;nIP~OK&T7lAHNAqWDO!A?(-t;pzQ}t=()(G@fROXKoI!j(;x*Yr)%+5Z_Z{g#-!>P zvsNQ6b`jWeuPB0aWE975%&Fi!^3aBwpytWtrrCeh$wU>r<(=W$N2&HfXAc~`FV*XJ7lgN;f!5N@a3@X)Qu`Yz&LDq&bGc6T7Vooh{|y9^N{=Or@+84KprUsJ?wg2q$)p{l(!yY$&wm3+1aj3td^@9fk1NAM^9zyS zaf0#_M^P%tErwiEfwsP`H8l|J<-X6Q=GS9Wr*=g?>RnR(PZbg3ogMR^o@sCDf1o72 z-q5;uxuJeBf_qcSaYZM0F~jgJh|{m}LcdhtIZONp%x<{j*{DBk4R^fAo?DnZomR9j zRSfSlGwFw!XB?F00P7P;Qk%x>3NglFQLLqT7(9kAwx)Uuj4E$~Pxr>99~ zM_dbv7C%Aj+f<#^@s;3gbs?3P1(;Z$zx7uxmQ?}x)noNr`~#n6>RJe4z5sO- z^9mU9YLw3uiX+h$N+Y4cFMMR{8 zVZ1cK^W|p@k-?e61`z)OC5saNjVUPSn9=0q#QnBdv+*cpCcTH5%ybIb9!ox_!JX=A zq32u47aQZBKW?}HDX~U7adRxU`}g?GiCfajCHei7QqRh~yzFLMOo5pw@I6p<3AEk5EXeDAU%~%c*1GHpq9lZ`x({|h}$>(aBn=kCLsx|1Yfp$uGj-Zc7UXIrI?@pB5y z{3WB4jmFRNP}v`sxqr7deHx!BNh8$Q0ST0(@?(q5zK2zh%OAk5U6rY7JEy!`^H_0N ztPCxGgJ>=UGChhCQ(6Qs&(9E#E;c8bR~vcfB`PgR0En>1X#Pl>9(doreDYnK=wOb=d~`C{o|Wv!B&+UzHjX@(vRj4-#D zj;f+F++ZZHuUGqkBE6TX3L-PSu4CW?XWvAZy`WWNK5yptEFAafP|y$i?^p?Ok=Os*^cHnX=Qdp<7sQH6}qCHFfpyPsMh@^&wpO>0m zWe$O6&smZ2Ds5G9;N(e+RQ?^6_*U1FeHFpb6pUnyu?`6_ODXNCb0Z{ozDxML(~2}I zGwub1EY*qJDLfrdPM}=RyYk$i5%OYESX1;KGDg~mujS4*?%qe_F3ENMJMfdGF$5^; zNVN5G^yc(84{mPEW%)JqO0(w*zW7PKzYFPI)RUK>K;xeLwgkYRA{AJZNMirUP)zVx z@%#%>-wkI2utb?95wJa&!9HVvl2kb~PeUBvoiE?86d?)`id~LOemTGeTT^yEmT^mA(%gS+&zX=vKOu<@ENdbi=3V+= z#q-#xOw!(qb11?b^etC5`&95bQBrHC{nn@Q$M~!(Ijp&$!ESJz2mUEGVOBBfwFM4G zqm|e8(?6fAL!TZRSDKH4CDse7bdO&!v|LuZ60e8ABiQxh7rd*MdORCr^a&&jktPG4 zxZL%MD6H80>g@bw^o8#X*D!wMLw>*vtpsFp6`z25yNT@_9tyjbkQztHQ66nv-)cO>crk(apP)^~t zUEz*>Zm$gS$<)hl`n_X)3WPIYWKMmefMf9{Y3sIo2-v)J zaH}l*<_`xGnZvPA*)5#H$~;RUvH?LcztK}H^#OaJ4rqoW{J#!&N>$^~pV_2>qgO*= z{hA8;#{ZP4dB-Y>vMZ@QbUtJ1YBdg;;Mp?k&-06$!)ynKWXoRHB|cn9PsF3cI_AFd zoU9f_B-f%J5rY?cIKg~e{yXOtp~0E1EeD|;0zPxK@mdb2JQBzZ3STto0HO<*A+>!Xqu_C$uJz#)p7z5c{+kYWoNgq6nd9o*QZ&6#m>~fE(ofCBg zY6x+WWqvlxP$eNd&ok^%`yBD(GL{S-ke`Kw;3pW`t6O?JF8^r?nm6#EdEQmmDfs+j z*i+uG*({#hU~Cx&<>cu$u?9O}B?Q2^wZhO^&@h~zSAr4i-deursbu=LEXOHcRWMAM2k$%CrINB>9ERHJ{r|?YP_oY;L@R4Wx*j7uu*Yto3+dgnXQ!GB{oJUqmug$g`2Msoxb=SPw+2Ft z_Er1Nz=FJYH?{DqqumfNg>apmU>pL|zKAJh9+)&m%P~W6A`k=iU)3QBdMd3uJ&QS~>K>VcdUP91;IO zobHn3E~4HGy(NJu9M*JWy}28`FZYpq7oHF|bZS#N!qmc$TwPWP;&89@yqRlK+hiqe z5zvoCo`B49$M)a!T?XWE%FA{u5*Q3!#l9EI&kMbT-#^3={t0Eo>VOjKV0!hJ#Nkuf zT|0JRf3Z<64?MN-NKwOgLtP-qiiQZr^ha4?l_;}r`0K3~M+WOX5x(n)icN=z9gRV7LrIp1g5Oj2X8T* z}CJ}`Nvsqk^+KJ7_zOe=%^>64S=Am!LnqF|58NmsM7xN?W0D(2r&nxHBc?;Vp5 zzjK!URKnPayrpIj?U<$>2n`mnJBjF?psh{C7yO^L1hDZrcj|ZY{P#pR<0V&4r#`(S z(@Hui`zzW9Q~cw;*m3SuT{(Z*SknGJxwk<6^ZF{6l%5_$x&NNfW}2lN1W6&Zrg@cm z9UQIvsiQI*_fZ>#AR+Ro^v8Y`^2QgSkWR9{)6*N9jwWzBf0mpGI?VZh&e#1!>fL#(+jDYUrDd+aP`zyfY3z z{+m#_A@KKt;z#V0fX|cyLXCQd(FA{(~j)k|+XxQJG(r*Odhev6*TDE4cwv zgyWSPrhGFB#cS+T6rf9f=KOzU2Urqo04lcdbUcSjn9&QH9F)L?F13k9s=(rgFFF5P z_r_tL&Xxs_ERmOE9S?10(VOCwq|*Y_x4PP$8{W3;3tf0n01k9@i#eNNV@sHg{Bn7?JE zPNey=QB^rin;7Yq0h(r}piLBajqD^Yv>^dXj~jnYAYV^~g`DA=rrU+yQJFq@ot_;= zLET>KoCzU&p0ytWDoDZzSEF0Y3r1>#^b}H_pS4Xhkh7My$}0kPbC^u`I|m%ipUze{ zfo7LQQec`o|Pu>5a8sXXyzeF?0wWkr{8ia2q!%5fQ=KwTR8#kjHDp zsb9u|H_Vlts4Q!(RjI6@q$0~vw!{qE3ejJ@x;ICL*R;Vsk^J~40dGXi{F|+Lq)-vZ z%KTRs*5#d_(#YRgJsZGJkEk7+fEJur?QX5F+0)Goi{fsO5GQ$Dk~}2X?IJXmRxbMobd7Ank8I%y6C0w? z^5axPsM7lojeD~p<2S9}cvC+^XPPq^kI!G|nQx{50TXi~eq(*)ne+pd$LY5uEO~T1 z<8F|YVI}f^j?05G?3{Ry(lv>et;BG%6r_ffJ3FvzghxUM^AkL0szZxMgFO!Dr#a(q z@WX^$)#z2=-}>3FK-X^m*^7WB(sNQR)Z_awx&KTRVf2^d$;94wUpL?e)8BdZ|Oyi0wS{P?@+=)9HT2cV2a z4T0@W#L0hgg#0<<39BPWs>;UN#|CjY0}qQNW#_WMm4~G#dCya?3Q7B+Ovc zoKi!!2eegWnFxGy7=cxy>=VnslX#UXSpz0bf`K5_28X_tW=hg0cx{Hb3(w(?H9DfhPiFP*^diQd`YnB%S{>9oBo)@qRa-c~T5`X_Htf!)}tf=L2vf_7{c zze(4nNY`kLh{@^^U4wU7WU02`zwL)efG4SQjQesvOBx zzqXr?i_*f%{;LP!ndqRlk&Yapnu;_M+<7^}6EfAM@{aw>ES)i9-)e8$uGS>{IK`Di zqj0IMpbSq(P>jOEU%Xsc4T`{s6B%Ab-aQ>nZS1foN-e!8Yn^&l?Q|wOIw&S~vbe4O z?M>N?G2Beb#R?|Xu*=3P*xCa%|0fhnyHV@QGGDBBZOJU-cZhFv6k~&f0r%7Q3wYk= z^SVdrcvFkFtOI4*$s>Y%kA~1PF2)K{{ z?4F`b=O_qkuN^h{mstU%DgyGxY(};?SZ1uhdLK0=cG*TAx30QiCP=#Mp6WkR{d*)0 zZxFz>U;k=&Bv8^qNk3W6fu8O(45*Csy=wcfwGQxvWZ2#hRL0@-#O?JeDl5x3y3W-w z#b1Xh@N{F$zX`67{?A4x_-`LD`?H}4{%_%K{ufb0)C%~Mb+4aclJFJQu3=d*L$b%> z(3Vt_nSEzppHVfG``*3A3552iO-@iywnrzo^)drU^O4Q(^K@&iueGhqTS{j65PB_I zj2U)3oZ|TxWy=>V&7-am{<{^IyNdz;EKlBBru@8k;7>j4zt7NlU(h$JJdwdv)PfQF zB&ar7bwK(Bdrs>=nfuqM9&_AhqTUM%(mpbhu=1}vys>|UaT_o?NpT+f7thp&6{_!6 zF{b?+jRMCj@Mn~;gy8qECK8hK*1cmgZ}%R^19bM$20~g|xMpcK_oF{_El4v?vhGQx zl|_c-)TkF+-B|XO(y}_nb<+_)Z7a6xGt*)Sp7WKYwt%4!2PX|q6|CV$WC02mu<3g? zKI)!q3KeMLB(_+G)v_#o*c=Ql>i-kdlKc9=XPnsp?dtR?H?ESW%kR5njmD}$zQ#9N z52(4ARqkHvwGp-2Z1bO@vrG45k&u6k0yLtwm(BN{c>NkU4baP*<9dT^G>xZzD|B_7 zxyS5j-hJnQvgVK=BrhEC({n)M1-GZ^jup`#%+A=H2c_>T~<>!LwD}D zJH}XL=>HVHqbL-4rYD^c(%H_3#dtuC}p&7r`T`|CVOnMz(s^aK4O7{ z2;I_R))u$<-7_DFWb+%Bu0^ffSjZY6ot*mkaB+YPslP-LwuQa+C$!a=T!hLp0e4&5 zBwq3XoQS zgx$9W~{|Rn=ns|cg%t!?E{YJWx%!K)f2^q2odB>$kqLYbo+JI>bA1Pp{6kBJQ5T|nGWYrOX8zmcf-SDU?<}npk00Zvf3&t$ zy#P^rEFyQJJ7ud2S9>N&UQ|x?+Weo!UpW%rS*vGj_h|Qr7AFrEV5)X{Bk*@RPJM~~ z``8&l9_wRQ*`8*~tmVf=)-)2p4}oo?XX441i6x!?iE)e z@B858l>t{gN;4~-ZfhRdvTt4R5 z_&h-y&^U-ZiSiLjsjK!|ujOg(9C1>T&w94SCm1igPb5$>gM4E4k0aRBGFG?TQ8@N6bmkT=9K-2?|uVBu`5ia=y+9z+u|H5Um z7jzmcEPQN|Ny*Q8Fcbsf_|mm8kn8w_=Z|r|;7vJ+_!ZXRPff z1?@rVOLnSrRHNEPbOw(K^g&8C9Ky^id|7_Jep!2%;mv)V=bRG0-lscYZ8c9|r`b}V z!?1Dd=Q}RBY~a@6`OU+X;+qmPb3+y0=88=WqrO!~oMkTMk_?qzQsnXiJ(nW0?7i?y zE!>%rIzXptQc)B_c|OekC?9Bo`De-vnAnGJQMZ2bnDr=Z3Q#XN^7O*@USFe4I?&hLA%{>8VP4qK-6Vy7L|xI4yylVDc4F8S!Tb7e_&+sWlC0mQDSF(l>(O{idS z^K=V$YETm#AUwNwM}O08Ric-W4K|VD3G9bM1y{!B7i_go<7=? zMnI6}0*qI~j|=f;Y(a-XZg@+s$Fq42t`Vmx+rr=hQE;v>^d^dM|1X(ie0FzZBzrJ$ zd3I9Xb}&b(wnGQ0{U|I#wmW1Rsq$yv z)HPF(n#nX8L`s})bqwDyGLli`N?7)L=+{O1Qk1YvZ*1wIiO2QhO_dqv=`rbkQLZsN zR-)i5+9#r3w{*Lf{mAvYCwyGiFn^^2XP@~-N1wiK+LiRu(z|V!H&yyh99xuPV#liS z4JT*Zq;aoPK-nek1y=8iG5SL8>)T8=n5V6BKZ$MNteO8@i;kJYIZaDGTHhz}$7vO~ zNG&Y#aM`v8BSJ|AMdzA5aXDX=Kdav8wH`_R7*tFbOcF*d;JqbqW{-P(=8b*3ovLN# zk6n9mrYSbk6tbWERoCaM*Hep%*!;wMNAC9&t0SokFlna+xUL9^SbypX;%}Yu>385cvs~ z=G!27nWX9j&ce_2-df1spUrKf3jY%ft^4p3fVp`h;|^$1U+JkE)<$3@7$uQeAH#c( z>k_(5)1;~8$OW0XWnY#lj^>W~Pz}Ir6ibch#bc!3j$%|P%*GrF5yL?YN$68PG}j|k z4P6(S$@aP{Im`CU@L1nbtHTgN?A@ocidCG03gCH^y@tc$w#zl8)j}!>e)qNEQGwER z4@`}+LY!&}gA#S2`+#BHar%*0LL@c7fAhjF$R_C%1mHB^&&Z_5W@NS>(@BIa>4*#U zmybqHHrAr$uqeG{_@X{6Hs_8(u^Ft|rKZIHzTb}?vkFKUgZ|VP#o0N;eIsx+`rSQW z^P%%)P2^^H(U80YT(9c`Z?zs^-z&0TIdt*lGNQZAb>03yiG*wV1p{%&VS<_Ob=jCe zAHL<%rA@!D-2nMJPft5tNr-i&e1X&1OgDI{oeHURkrN6n}7jb{t03Vre`FuYjcC_+Q<%vGec<(gFY>{P=~~YI@g`9TswU z)w{YKbFv*~aRVEdd$J&usYUgIK_u#^)f*zOgEb-v z8^g1H*%wD2{g?8QM{+Y=Bh20Ha7Gj7ee_NE@;CJ1+hDKUveTHY0hiMV0sl{TLZ-(Yiw#!VpzzF4jXd@K7E`Z~^>#0hNaF2zsMx?# zH96>bd+pvKW1M=52d4dw-kC1+)5-VI#+}ox;J?ZYz_~QX&PN5A$s!Fz*w`7{zjA=C z=9Ip;Th49I_zKfbFn#^`Gvk1zi|J1D{g?8tZHgpeiu;X`V%{kpu9U+(!I)UI!NK-VrW%*riF!8POAKv%Mkf+ZSNdfK2G107@-lt8ZhQ1U4DpJRNkE9_K0%^Lk}%ng3rK{2^IZ?Zp@iG1>Nl_NA^h9! zY*sIh)flcyeSV@T{j5bGu&rzVi_~TrQ(_7y(9cI_}Q0FV2>Qz1<8bQRg7r#Q=xxv>r@A;-Y-LK?o8z4 z(E?R-XeS5slK_j5Tt{tN1+YWbPh!vbo*Y!|_Ug}1m_xHYzmn^cWF}cLX3`8tExR}^ z`@Tr4E>X(cMtfqJ9J{_wJ5v;1%6DO@voJff*trAam5mBhE__^mu|%clV(|5CUoVKy zXle0y!(dVO;NV&B_wXJvzWX{KYyNA)8sX#SKfr%Ks+Znj^2zTpDS@R3m`dQ4bIqsi zxv#$tZ*v{51x}$xU;d}T>Mp%9AnU4I>mCg^;5^Q@ZJyLhU$>sT1OAZb$1;^@)y8F_ zNHI~Uy%c#jE7Yt(hm>IdUlTR&lW2A{;?zA?7C#qtXJ48v9p)(mP*j_ z0+zWdyY;^oMh=jKh}XLR@^(VDFB@}Hkwh8F<=MU`8=6_;U+dF`AYENuHG}bk5_^Lz z$!$BZkj9Bv{9^3pztdMF<<)!Q*ox3x?c+au_K%U8^lFh-noR1O$?X2cB=M8e*g(T+J99%XPaKuD|p|? zVFU50qWoTuzsumN1O^BRE2LzW4(RS{oi$XeJX!jIZeJv&8Z|RLG8q>`8Vsw+-BvGoiFPTDNvRwV&YG6*2-29PI|ptooqpEnbW)fTpOh81j8Nr^cF+ z+};i@gKC}^x91Uj;Qhp>@fN7g*`_LLO(=R`o`*i6%bjK+e`q{4O-Asw*0XvpLBz}N zt;9-B>u{=|!v?{@{UZ>N`uMXse}?g9o83S;(X|X3EqBZpY}7wZnc7t?)?wEN01|9_ zI|B(|E&8N0r&6|r((&j!$3&k)FR}(@T0=uOWjGz5u=0{d5rDnQLq&|feG}Oeqd1!F zBfAR4x%+_=0(XzJr@P=S_SA~SLfQtccKN2lj4m#~TXU5mzPsBVf^{?xO)aQlflwEn zQIYesOKHPg2#;oOczdM^S$;pbjuM(vqdyU|g%TJF?!}$K?2-l4Dk#}-wX{y@l1IqG zuLg+hwPziszEo3jz0OxImF28zOTF40?pC=-HedMUk@a<1d0t8g^8VS`H!Xx`k5H@p zqooGFACzKKDemEh-O3r$5AsxPF&!YjPte<968N~@qD7>mt+kCs4}MRr!Wy>e3qMTp zPXP|D&0Z%j-Z=xh#5dqnHZ%qc;9P#Sk9pxf8e?s zFK1lX-^Ix<1?&mIF=|24@z8(3CMhce$V@lsRt9%SSzQzl9&E zwp1`i4bLza9&;r*4_=hD_!ZFwx4G=p55P_g9l#`%ajw#l8I4T$C9O+ZDzfp=Y8H+$ z>n)-oM0D%JV5Pa^$CO^rTmAsYe39P?@f{s+jFvo&)+t`q;hPei-vq;tAw6Bem2zL@5U(Wpy`!(!)nk(u!_ zrCkdB9h`{4@b)6gcEg{By9%n4WKWx(xc8&>xog~}1UX4dcmgh#iCt2!NO(UQDf0ep zKn1_Eqop$<_?xa}7&j;(JD}sB)|{#vbc52k`eLTJ8078k=eBF=?66uAHL)ZUl+aZ= zf^G=D^~El{_A8!k#9>4$&wkiOqX8^exLd)2&NywhqN+jSgw8yx!}p$nWH&O=SFDtz z5mqIYn4cnP!VDl9YBJENLbcB6QNJ8Xa?$BiJ(Fq+dsC*O*ABL)cVVwEMy06d=QNEK z&R;I*<{I^u@J*OcB#^?QkkZ_i0hA~zz0~*5B){c20!WNkU<0@tj}(uygGR$eEfMHs z$+}ec4!y!n5Jj-J^s4|uZqvnDzX-~gPHpoZHrGD~b})ELGeC11MnKB~`2E_W19? zP{hQmq4L|CQ?qo0b-3&a(TGnVYOBv`WTew!)h#fOPshGizvmQdGDL6NO8P2*jRF*r zX9)_f1PfVVR@Cf6s|Gt~hY;oT^9sA~W)5s^0#P+8<*T7fg{J5om<-Z&VrF&;u+4{u z4i9Z5q0shK&}*J2nW(oa4|fril}P;I;bb^PCV2KNwWv`PqQW+OI3`q4I`z25E2K8# z*96@V>d#@<&fXdvNV$oDo~?A<8r=-YFyoWbxWXVGJv}dn>x4zD-I(UC02i65n^A)@ z2$q||#M?K7Om=(IOiVoUJAd(>rBnR+7fmtFBaou-G&ze?`G97^Srhd+zl zhq^aTsVimg>{WrrWklb6al#F&@w3WknPse2`+Kjl4JoEf^{?Hq%$F{w<6F&Z=outD zkxx_q-Q47-?~bnU9u5wqP-8QaG|Nx#5!+=0P+JV$RYqbDs2A-&(+}@I5AOA#%KrK; z`Qkm7!IvH`t-K|$ph5$R(XysB;m!xp_3;6-L|=dG)b8 z-dl@z;Mf61yiZjBz&Em06a^E5&l!wYzP((Ly3|{p)etx0u8VL)42(32t)kQ}?E{oT zHm!TM;FEz9B)5v#7jX*|nHpGU`kKNaXM_4Hk|>vU-00@900O%}d$0?%Y9s$`_4_IQ zDpS8j;nP+wBy1Ft+(JTv?9&e!A19jVbE#m7wK12{gXBH{o{mA2Aug2HpFb?zY(Kt^?d zq*bp95)Wv7-Y}*(@7s}j1PGU0o9~S}Z@tk^t~IID^xi%cF3Jl^r7(btK7HF}x*>7U zEj6+@B;-r9)hgGb*-->kq%1HVfts=pjb?n_VexA^BnO7io43X5E1RN;=DFZdZ*_DwJ3DnmxrtI4+)|-R_ln!@i?*~HnfT5PY8Z@+= zNQ3oCW%;cp4#j(W<ZL}Qa25_uR62Zm*K#HYHckn!TR*p=UCZ9?a4^g-z^kjVr(qh5?YzEPj#DTx z_00NFAEkeP;?dM#ZLy|I>6E=V?mN+JJ#E{7|~b%d<}Q)622M((G_e14NR3 zXgGi5@%Z*aV`A#sY(23GiZ>>!B?P4ONE=U{dRiz5BqI9U{qUaeHx(22yFTcf{ z{n=DzN^k#)9Bui9bu~m|X}g%yzQZcWnJ7r6#7Df3Y^I*_=_=l zn(?&-mHqNDwLW{#^<)WB7k5gDT0Zq7+2K7x-8ie^$cAs&>vkjCx?o7t#v#UP! zAq@;EIM0Lrx}s8L|LN%b^ACY?;Qww4^FRG4Y^r9=iZeg>Ut$1hK(I7B@1K{$!C|^8 zL-*J6{{NdG=>Nf_@_)|Af7375oeq}1m@mw8$+!69kn$*pW6|86?0`=CRD_uIe(z_z z-MHGr$kbb;(C?kl^_V%%P3WRmal?pA8N8~(o6_M-f^W=+w)7eqePUyIS8u8h=owQ( zn#HVEP5#QJ!^YKM?GNBTfF>LqrMO3c@1$slG;Dxl$^hY7k-|1q7oM>{v4$ zOCY~Ry4J(ArQVuzp1pqa)MZbxA=-|IoirBaYRxfXPyF* zKh2_362q}B$8w;GybeUX!U%YDU&L+~OLVLY%@%%EVFez5ID;gN{RrRZ}U$#=7oNmf@$-l>EeJX!o+tN2X-0K4BXE>0pZRp4zUN0}C zRvJu;J#tOhg9D!C)2SIU0%|7o0Aj>gh3ca3+C zMNP4&e~V2HRy)3`2ZSsEN3ZMP_RPUp9uJmp1D;#6t;tu!N*Ob2Z8bz!(E+3qn>$ky z+d^3RI1+}az@7@6WKHPdWr;!56ipJ#;p_tYMD=PyDP)#S_gDoy?~&z3=Nei@B=%~V zFxb#RNM3*hle9S0J3*yzn9_7q!=Ok#>^9H%gbJpOn6_tHJrOy5^T>dRQf9ffcwBPF#xY=Zlb6(DRnaML5tYQdlkaaDHQlYOmsdg0GUtnNiR)wt3fA9V z7ydg3QoX-o{s7+-_^wS-^6DNXipJV0h|XQZm6K-B=MbQNK<|Xs=Ua5*bZ2E%1a7DZ zqR|^Yt4@&UL3y>FY;DMvOy6}V)fc>`2y^uAN6MV;&-|#?(xd2)R)gds`Iz{o}xs*Y7`MoXYgNM4VEP9;v=%5#Hyh!+`P=i;DLE2EoYXK_`l9BZNHL*HP~9(xW%^y zrINI6fSKQ4QRY*(`=kK10|e(1eyWf{bc+fnYcIV)Dq8R@oGx)F%&jkgsCX0>*@hdZ zq>=TH&?ufO8z1+uIG{cFJ639spa#4xyYS#Z@ee?%v~dshg^b*L$=In`e*tdVFlx?s z^ua43dr8(27X}abogRjIST14Ud_5ot|9w6lWHW7ZE?Dn@Out<>Twv)jL<%6L{*3&o zsAg6l)Su}y2b94TOey{WvVTtnb!4dDWMaMw8}wqcS*V%n_?X=?JCgY!=2UIAmLyC4 zZFMe-#mxt$jyf(qVNDs*v)rg!H=6Ey;Y(JQATdaO*lB#Q^RAp9+t{m$)#=2yP`mL3 z*sMOdI-t2)!~4~Q=v(-6;>fb%azQex{mg$}m>k3aqy>Vb2!=w)4~wt-pgQPjWHciA zE`ZW{l>HW5@Z}Cck9PVye-HdqWK3&+VkvJA)iuV}LzOo; zn&!DqZ8ZJ1jv$SrUmRUqcmhBqAbaJtLqw}vWG$ko?(pzG_8|W13$|qUIZVOeP5o*! zjn7=(r3rNE4hOxs;3^Mr<>6@P^H*-^_WVem}`P`x5xW#C=eAi@WNe=KjjD-NzDebLQkUFNprs{0os- zq*f6=Zdem7|4$}t(L=t2mW)Abo3@)(W^`DZyl@@9r`nY{5oFHJ*>6hlW_Fr8PxVy!tJ&5rnlS*kWkF&ujp3~NvA~&MI{t38 z0wk~Q-qJkx@CQvuAr|P*TSZ(PAqH^PzWuC6+7Mw@Dc6X5A{)UwGK9>!T4bz+{Z`_> zx#evl`0u~Ki|o@L0<}IGriH^+%M&*M*w@P7g<~s*l2V|l%`Ocq&Cm8FiY>K)A#K8b z*}x)#@?5$3DQjlc9Bcrv*}1)gQ{grZ#jldOfi!zb_XxKgekXBKp=0hEdZHJOaKBbt zkHY)X+g}%`YI|}QBZpc4-9aP4f{hhdpA1YOEqz8#{{-p7E%odnt)RNu%-@Mw&v7NrFmGu)Ix_X9Q&!}GEjs6 zr6{9yX;L{N3D%hO(*zll($z2R3h@38df<0yx_Jrp&G#lFe*(71b602kIEzo6d+bnEZzNWBKuc~cT^wCt^WHkO~ojI(pjcR$|QfXNlyFXr;8y@li+lK4)8|0n4{E^g>a83+;MF#s>A%q^XF+3Ir$K z>Mx zp(1M00l3u|U4Uw@`4Ojlx}BDPas+8~d@QhF8c|n8!$zqtF;N|fB`+maxIWKnDq7#r z2{(-adZ>cZe&9NyTHuCvF0Iu6x|h)E0zk|DtjZbpV5FRJk6Znx*KCg)&yXE`+Efaq<4#8c^ou)Q z4q(G_5|~rsk*@Y@ImFrBN(40Gz=l4TyS$as^gl-3@-ny&X{iltEjUWTJWSwpB@mNc zzS-sNOvoEw6x?afH%_ov;ipZannc|&X!IFgxaAsv-dsJ?wdDc}Qro#!8O&_2iQ$=h z&s{JpZ%AHvpUNm#nJ|32$BoZKo=DgHnu|bCFz~F!W&z<<4I~vj%GY=j7$%(J`7$Eh z1h?-Ix_RGn&;?le8M&!euK@SawzgljB?6n>c?`k{IHfI-O{adC7%W{j#U`C5N`Zc! zk)|D+nfcI;QT)O3Pdr+v1V*tNHR7A~q4uw_=pV}pbQRgXlevlxrCwwK+~L94EEYr( zmK{k1)0w(fvujoXxD1z7oY>w%hlhi*bkdQ~$GicvT?9H1`1-8L$48-o`=Cd94tMSR zOu9iN#ZPSwlfwgHEpiXUrxR~jy=GqX5r41DHjQ*x+LH!*BZW(TwJxfDWg^dMlWTR@ zUAE5x-I|4|-Fm6E;83RX8Xk0fu{^U!_S5a}(W8Dqevbd1qs20j^2i-8%AKe*zr~S( zHtEggx4oWo=#g2epY$^(zg;a!)*l zAH-P^D8uy=Xa4lKu2qjKbBl2%?&m5%PY&MFL0RHmq@0&@hkb7JA%ffvke2ti4pcqC zBAmND-()-yM7|Wl$6XR|f6GE1zaXQXWyb{+qnmWk(1$pg)M zsX=UI^h>I3)aOwFy-ww z4nM$W^eN9keqKiv1c**MZHmbVKnxz-Ixgs)TPU=FgEZ+OrYeinuF}}8crGtIM?=7A zVav+DBt=_}4p)&Lnu?1#2jVd}`sd%S{^SV)idPAKQ6FBnm++Eq)1iMyO$PcU&2BB- zQ8!2n@MmMI6hf@w9>!Jsv6=S);5zbIHyP(l?BvQ)^_1&cihFAeEsDQEi$fP*;_;pT z+)1v|&xmNNZ06$*)DfS&+WFb@zg8=$xT_L3|BdUmNUT7-XellV0rQDQ#20)L94JR$ zQ4m&Lq5WezRL2o=R#a`8Sq_O5)+-nO`rFfU?U-Qp44dU)>5rlZAjItNvTSeW@*pWc z5+O3ms)Ov5cwM_ zim3fRpj~Po7N#|yZ_|PZ=LS=Ft`gB!Ha`UDD3lS3o@LQ3#rAcgCmi+W$O{f+aY>u= zWFjXAnGk~Mg7nTl+uh_6F0Sa!K=G?6dFqL9o3O-DVP*shWyBot{w`}~wPYYlss=;} zq7Lrny=Y6=_^0r_UH|}DKEx(wd0!Y-keJulO*HXsF1CFFNB&c!S+9friV#L04+uOB zc10`NCYQ0$(tK0@dr!321pfa}4I~wq-aDAYKhwa6S-U#}Vo*C6T$g=yRB7&o9TtMW z#o}zA(>YK1wwG~>kH;wGZE9A_&W~VsL8YC4qNnd8{)`-X`}(<$r-gFuOBG4xI!B>m zj3NKR$&^&hjZ!N2owMH#^|I;gFW8y0EH+`qpUw8gqMGst>0MI=ZQci8Y= z6h~80@qcA<_UE{voDF&TO$|G_Nf`GI=|(p@O!(G6G%T0YKL~{)60E4F;%(n}FKRZ$ z9HADmx*$|d6IRSq(nbSBFj?+)@^ccvEM0;s9~-ZduCCdppyo5Y=x-X8O0OKwe0qQC zdB_8{D5&iX_(%f4fLAS4G{PD0Yi5-I6zsME5sL~ue><8#b!u$>@{?9d2?=;IebdH; zme3UCfT=B3-sC+t8fNC~FW#qD0jE1g=SJVyU5>uJOo~^nCQPQ5>HKvBysHbL`Mnv} zjvnN;s^N7NF`xD9eFJaRm^xDrJrs|iAp4gW!r3X@@<_DXreldW}0T{~8&i7TQ3))IZnO)cRg`3u?eg3*@aI6cIx&xsb&X!jGZg}G1M$UImJ!ytom`*(wS#e%4Xw;jIF48Gf z<@?GOIF5f?h5DY3s8vLZ;T%NVCb2y@P-WA(;%d||rXz+Q;@g7rIr*Qb5dpF5a&S-c zWVFseSjjnTB@1Z>5_e(5Jw1c+mS|ofmmC9@>o(wBu#9@ z-hT7D?NZY;L_u6=gpNEI8Zw%}o|+hea`=(gY~+eNF~cAAQg6F!eND`4n*rT!W5f0B zuIJv_&EOe6lXe63?P5@V=T+OIIJ5ALXH^LSUOm~NZdyqAor9_4-boL5h#h9 zNO1NaIfCG%c57Ykz@_iuF)%$xjPr@$&o28gI(5d|Pi;43vtD+wMt>f(#15z#jS<-aw6K76U@6UO}dwC=Z>Nu>$46p7~ktjw(9N!+JW^J zi}za^RY}^x%Ka@K0(?}V>?;TRlUdAwP3_gvM`&bcNKY6D?7hJ7Z84pm$t=OXLU1@z zK0{roK>;<@tZ^~o6717}%)^Ge&>loqsXt%fWr1D};Mlv=bg%u$r>wNv=Nv83lw~)C zs@jaZ0v<-Cv}Triz;A5&W&hq1=q)pOnO$MX?AMAQs)uiUed}QxuXlOZBjpYTM3;Jq z%T={Riyt@=m1l$xtLB;OO>L5JclVRrX#@kwqiQ%^TsF$*zCIsjf2kknnaI#_;tJ>& zy)po9x}HgLt(+uM4HcQ_Ih#7qEPe!gYd7b7utnlsu+KBft6%BzApwo{y!vGX|=ig!`(S~@>613XB-$YP!i z=$QDLMm|Fq)VTM*v{zTN)L;fEuxU?r?XD84|x1fX5Uuz^^u)DzYrNgCErI5(au@bbF=z9&VG%P#=L>+`Qg$m+?0( z;nlg*^xW4s%=!uStay47tKB$$+f(ndmN%8FYNQ7Nl^>4u(`|2Lof;U0^=H#SLMJA5 z(IU1k1^-w;vtd2mUn(?^{2L-_v!3oJb<4ums)YazWcXgY0CMJCr1ucnDph=`3BEcXLr~_&3X!!c`|AWnyL7K^spBB2em*wh3b&XY!s4n*HY!2uRC1}mufrY@xCwrd+GLQ61xrffSiYOIZ zKR}9xEvd#yMks;K4V`y18~nDZC@&Di4e5p+&(Nm4Yl^G*-udeQ&b*vi-%CTX6gc8^ zn;WjhzWF@{}D4+Pb@e{Ya+83Rb`=(R>p6Z3g} zI-15Gyi%KbS)#hAdA$zL7ohnIsYi>=-i^Ji9Zk!+?@pa&`2a2IXE#I2uh2YSRh`En zsrZ)F&xlT^9_}&Ny(Vs#0})4psit;OS2$@A+RV_L+38ge$Bm1=h^JT28ZW!_-5tz+ z{g9r~=)vqz{gbv!d6h(bghqiv+nHlDKpLWQ-%pz=m=Hsf5zO)<>*to1m)s*BRKkh9 z+^M~d7?HxKwb@+_5$+ioYL?`h(hUC$yKWg;c(PGwNCxE6c%(2|p>1`D+PKWp^bloO zDPWsP?2K>xUcwWBBHvG4AMWC3*PFW{rSX>+rXk|RqAOr&LJ&U&J*0uSXDFP<-Si!g zmRHe2_F|@-n$ELY=Mcf24az^nQ$7dZUq_eza&uoD|>mQtl!*-Gl^5Lr_>CFjlLaXaJXi zs{e*H0kT=!=DHrRlqtDWzYzs(T1sK(%2~pFJWsQD8fHnC)-Zb(QjPN6*s_K`dMY#XEKR z&WMUu3=pOQ90O(GL1lI?afK7)|adjQ`%==*Ow4mqp9uaAgZbpd`2t!=~xVqkJn~hN|@T!4BUYx z&3R=4rr7^gD(Cw#(!z-n`7>Qg|8zo^!Ez=?n8EVrrvwJeMXN*UKGs|JL*lD{+>-A5 z-n%N(S7tLN-3K*=5V5EE>fP6DHKH_F%(!@_pno81pm6Hb3uRc(eV-K^KYX8;h&u}y zL|B_CwdP_PA9J41A>ttV;KwWxgXNeSOr}q_e=0csM;P$)v~%vkrd8H}Ovm``KeN3%RRs+d)Z)m_+x9*d|TQyxnNagBcJ;3-Bp_PF`|F zoo=*OF_$km;{eICx3GvKJM5m}IV9lzXu;QuS26 zhTKNXGs$;HQgDmM$<6u!zmrm|;aPe7*z8y7+WrOJFz@kr+l1JBAlNawyGtFh3iKs6 z-YsPZnk6S0z@fI#DlIIvt9naP9q@E>;!Bq_3c!y|W_3Av6H1>(ANLR2oy{^G&Q6RW z{hDeoGBPCb7RLb9m14zlGT~_Aprd!1Z}S{%GEVo6YBe*tKyO}`U!u+-&t~_YL0jd; znzUx$6Tam$Q0?&mpnj#^?kjz)68*T2CNBq2m?0 zYP-84x{*5`!~3Z2eMH`iVeN;ky2{&R+DEGswwQRG!cfcQOlCl($GCMOX9yG_i9oL$ zIM=%U=vw5q6lv!8M*m`TxaD+!*P`)s(eOr*8*#bmvN*R^H3-u*J~4Z-=^fQ?T&F!g z1gX`yO~IfE7SXgbh~v=(8Ouj<(=ziL&ha4a zC_Sgpd~1W<;ZklxPqz#(bPe);qh{EoQc%j%o0|CVw~Lz)ewb6=#EVQ5cfuHc8`^95 zVPW?p94sAp8|pUH!N%(x8R6!c=}h8%l3Y$Zw-$E$)v|sbKVDSuPe0f5%0E{z;9V$N z+QN*=)x4^`7?&#bG(@aPeo9mVnsH6pS)0MqZ8x;P>#PKk38cIcGj&Tj9PCJK zt;`mm#FACyMFB0VDD_fnKpD&x2fugAOyCqRs4JhqyJzdLU9nV&kI2Wiy_ai|H*~|O zK(-XgS7#3{Bb(|}z@D)HlM*nI``cXwZk>Ds`!<|Z_gVT>E_kT~V^!h1v1`lT?h&y% z37SVuzo?V*hgtV}wJ?ujuTE&`_Jqp~_YNSO6u%Wh`(_}h>$R}2efQp(Od4~DKbG-L zeb+WG=9RV@i6(NAco;$FBSlx{-2`A)MpdQNsH#mG zU(8*+kq6Ufw$2(^*%t?H2T0ZHN2z(8%Q+SsOa9I@fXnyJktDh{%d6!8T%eat#_>Un zdohxB&^Gydwy>uDvm`{_N27BE)cmyQTh*lqNa50i6K&zM76v{^znIGcrWX|XFX~PY zV8xbv8(Si%xT_iW=onAq_qUoXTJrGW$IEjO@!Kfeq^+?N8{;|TNDq|ECuE0Xx{4W&P% z?Q@T>Q%mJ^ZCUhFo3w< z#V&Wh@|i<(ZIW0tIbrMEwS`sa5y{MM6(x5yd>()RCu-C!F&ejN-{RJ(?C@AmP*0Xz zzJbQS0o(P1Ag_}VM1(i6?7$PxTEd<5bW(i|9D2wIN)` zQPaT~MXxlx%;V{&3aK_wJ7aoSjZ#sONPe4vzyMIz$Vx63;q^4ncNYm1Id%kN#X0_? zOp|S_NV@5}Y)jxKiM*Zp2JSon$MPUA5A$0~VWtLT_0sYz63$@RKUvOTxtGnzu-<-Q z%)kr|a`VwWeFdwHcCj8FijKWlB>}!OM9W}#c05vfS{RXS*3WzL9h-RpR+y;= z>nhCDg1i-GPF8^r?2;yHD`G(hdJ0!6?q1%>UoWmw+|(;I^BRL)eYX3jezNIDGtBS9 zz*r)j&Z`s%6KK*`$d5KEuPbq1?XVL)Gu|oG+MC#Gp0c|`p}7U3bXKdJ_i<DF;J#JM8fhd za7sBe{S8&%#-^6$&X{75Qptt93Ln9@|-`x zy;LXNCb`JG?yr71ndet;V!!kO&rj{D6dNglLh|{!Snq6`TqNe8<-GFn*34JOYI}pn z>aC|I`1*$$ocjAK*D8IyWE8!TI;TG8OKV{tdn?V3=q-QNQ!_z5Le|#T`}+_{`Kz$P z{JGEeTl;TnkLXeuAu1=@A#LtDizy)00&XGJ!$jkF$fR*BQ5tXm?zIM&gLj#3_En_* zx7u*9@A<>D^;q6`k=Kez5dFo-q*{33(Q`anZnANHk4?Ne33A)9miC4 zAnH;-FC=_!YQC1_N6+jjswQ-ixx=?vEhhQY&?}-R=3>=1L68;AvHB)+;v!Rw{=}OP zto(aV@d3@>k+@xTtBo!p*IT!@mjBy2(8OWA)COU>FDlq;#fWLT*z0umi#g5p<2{s% z|CyNZ6N7&D9m9M$=r>_kIzYcKc?2J(St|AoiVtsT=)e@24!WHeF4UUVz8mos-VxC| zTmM~7Q*NQ`4o~_Xc`X9L+nmBE!;0Z}a^HBw@7a7UtF9{acmGPw&`fAJ_U)Iqdn8e% zYra*cY82^P==^kR5yQy&gGd_G9^?9N({80V`5$BTJ#%OpUZvBZ;B3M#-{iIKs;AsJ z2t(LSJN=PyNWbw~L^kT3{RNm3AOy_xzp2VIYk@*htlB_@^l}eVW}ytE4~2S+Flq z1H&54^@S8~pBw=7yB`sclJ03NBYSpXfw3KjktMArawT2wCfy z(;Dt8ROVGeC33p#khhVWC`+S0>2&r-Q$}1cC2%r($KT_78`W^xc+k`{)a9sB6tXWaErj9oPiyQB#*X0I+Huia0O^jcdoexP2MlGK_d4d=*G-0-HKGL@ei(6X{3 zD1voEwB?nUIKOOfv`DZ*MRX!M$JP?P0o77!g@Rw$48 z7O&nH0akB&RO;dKuX%2lMz{}HHHc9#GKoeR(gQ6m|_6V zh!L8t3bab^Qe3{)W(~<9(gN$J{d~dn@-Z21MQ~^AIIqPS^I^Wr4%wFJp&WRQ@7h%A ztt+2T7_;9Ji8Su!*=IHDCW@c7`24ge=d!sdPZ2v2iI#eMKf%5SbsT@Z>m!UhB*4y- zta!E=Gr8}q#!KuAQK?m-{l`W@Yn0&RyeZc7gi}-F_$(6VIz>gOYs)vo2iN)%STEiB z;FvS5f^$?CL2t=vCe6hv1^DFQ-RUUzo}9pYVB+`Xa?&fdXz}6=4D6)KX6uR4nYYWb z4dtUp@*!iT zYbTweU3R9F9yI0YhnM#jo8BYpM&~A0!&H0&RPL|;uCZt?AtBc(|#fF zW=@XR)eeXSi%R@?xqR5dQe2DNde0$h-dFfsTtCp$*w8d=7J&R=n@F@eAjX3>NO9OM z6xiZl3rl9j4d%M{j&@JNKnz8B{<@V9W-B+|XAOvl4NxNthu5UUELV~x72P)Oq3^fT z*WSxA#ewHf-CRw2hJZAVt-ZY$^)->)Wa?3Io12t;Ud{; z1wKc6#j*OnMsMkYU+cV-W^k&CQD>|0Q*)zFp*u<=jzgAA|cyuQDI{ zg=Xu-t9Af&9!Mi3UELsb(CDVo-@-<@CsDS2UhF+qPYyPP0% z*L#RKJ}%QX^F}gPbzbj9Zz+5{^RDdwOtbZ*@5I|>Bj*rU94|bLMNRLJ5>(AiCf-17 z_ZqX`9dw9g-r91m1S)2=t}NR!W~+CC+rY(ysXq-eePQ=JZ55dHkKo>@gZV?xOvQk} zcwXQf9dJ_JJX<HAy&5P{ECvEVp7&k`u9PEv*Y|o~ zcfnFmKe-UUpO@*k0P?P|xeGueFk{Yx=l=^x<3c^lh?ca=6JIIf)|g-Xz}#X2N6oRm#sUgifUp!3FnC64+4umzsEfFM0kSb@S>3?_Og z7ib7@&FLl+Y1!y;d0W3)lP+v7YtgOi$z%2C%EqS0j}H@+p<;2@_Tx{TFrn!p%^Dco zx2|5j7q}xF;vp9OoVmlBWWv1qAdM!s@G#FB596$93uS{)zbB*wXr0u4V3hqyHtrZ}0WiqE!{AI%ZJk;B#?LS5IU5%fOuru!#Me z&&Bks-D1T=n@isLoDtg~yk?@G2WlI%Xy}9t+d$fQkuI4&h@%^qm#DLr`Rk2&&ij_V zO?93uH(&E`WdH6b0XAl7D=&8&4plyIS|1$DS>-hy_nXabhi#KF(}s7`l-ZNf~Nr7#MnB;9dOw)?4r0 zKWEK4cc0z+v-i0t@6JK!TA>wC6>W$i{1&fmGs)J|$s_7+vqyX1<4Xg`(;(WhJSQ?% z?YFdUL;lu>0rRoa-!GcAOnn<4Y_vHQ$bO3_xPO);NZtPxrZJixT@#OrS$@`ee93?v zJa>K!6r-<_7`1tsEbMifyjC54ZGMg(&d%5Z+JUG)RX~M*Y(LWc9k^A`^xTJK$_L6p zhiMZwH#E)8k^1A{^^_N(O+HfxdP22`=EiNGg;oT|#AAtai@TwFStY8)?0eKJ=;Aa2 zCtEdhHY~NPWullu_mV!&j#xlj3-`YPsVy$IhY#ogEeiAHH);>ZKS4sAzaX3`n(B;o zlDi)mbf8J%V2&1YTmxQzW$EnF$67_JUv4 zoujQ4;pe{8OO7J|9S*vGE%Lw+po}O9 zC8rbe7i0syj{zd^+uFlZZXUg*7ZC*TI=_8@VT5J3(~L*ZYLIFzq+5|V4Ii^x&sX;=pdeEA7qdyKnUHVw1{ z&?l8YoQIdCJ`3CySr2sNGFggUj(QHaIjd^<%@5H_;Cl=C8E338;b`mYxyK7CG@g+G zWe`M^%^MH8clfV}HFWkLiQjluqyQ8+1%8=9asVaQjr!LYUssss5I~OKnZSVt5n>ZR zy<|Yi#s|dpUhJdLyUZ8*s#Mfx0u$zM>B1H-e;1&gZ)8lg?xawJ7Coee6o#IP@KYCy zjo6h;pk^37L9;pc;=J1X2zWx!-w<nRXp9+o#Zgd?UtZD+m(7_vHzN!V@`EEGD z^_?W(n3WZZz5y4%JyeV+L_p(0hJ9ldZ~EphW&v_&FH`<&P~u!f5fS|KlmTX1S$^2E zz$<}oqdRZhV5|JMENcS%t4@^gaZS8(gR||u0NphmPyrv`7VLavpTPT-m;@1{Z^LtR z|95aYX8EkwxqgdC=ytAV?o1u)0zTT=$HmFONc=Cl|Gwp`3#GJdwJ#YZG;*f8URORW#laT zqeCPw;Q~!*beoL~hY;9$b7BU0hZgR=L+1M@ES;1rEs%q4n0)lK=g*URQ~)19dHy3v zl3+-r#R%hUJ!W851u5>{p-@zYQ`75nj%pqFo-;HSpp(-4(R$5654 zG@S*Vp$w1ZC#CrKZF_DpFr;A0(O8V9Oxzr8OESd`r}w7(<(;s~JT+e0{|+@<#BoVL zm$0ZcLEKAy9(z<1Lh=W;iIuJJPLJEX^qG31IUO{lF)sAs88Q2!A~L zwY6wlo7Y&}CjrLnKzxYY)Sj_TZcm0W{|GJqT&+@U`F+A}z@Le)Z(BW$1@qR1F6)Ee z)3uW#iyTKkx1d~_VxPXAFqiSi2Z5zR!L|8YK-D{w}3Gy~Jg@6$T z#?M(IkM!#@n7=mtvS!0jZX7{M|9iF)gq-nWsWJlv`)S^&vtE9XUF)_6XO$ZRZ>2M~ ziSmmF$kU|43I6;ul`47)()oR&NGyk9wJOr*)g5eT{MT1{$TumZGVqr71v9kz>EtX; zm++XB5#T;+f+UgmQOn_UnAM;4qTu=8S<(o=WX>ad4PWev{@eB^!F9XlKc8CI3FFar z6c<7z*WNybC~MK7`IaANX7yjjNlSmx)&XhM)Dd7#`HpN{Irij@d_yjd$P(_GE!DuF zF72%x@&?Z}crd-Prl~5P%$ee`g#-H)G9{&0Y#AHj5P4K?9ir4=GAYf*8MFlLWc&AG zvb3vw-)V>rg9Z~;=dsM%-NTm65fRF=_gITJ!>_ZWKnGm`64@&t*$P z`%^H-{0zmEy(TP`wLw(xY%QYES=TG=>|>DID1+4xH*})_#`G+Z5&NKm<`tC>%@ z$m{4ND~xA#?!@K?StprW-!DV+o|BS8W6vUNlZu06gW4EanFjdQlJuWb5^TjD?^q}4 zxB3h-ZjWa;$tx<>E3C(=>pv&(THssL)_)%NY-j~-d*s>A>T zZJ6?F!kbvD&Y37HniwC}U0*rKoQDMdv!V?14}zha1E&ewm1Bo-*#(Zu48R7Z`WSyU zD`lnbCAX2Y6X}4KpW~qO(2!tX4%u_{{pRa9Zb?hR>Q5p0t)O4HaAqAAd9rx1ZKf8N}felWmGHn(dj7pL+a%B8nak54_sDF zVEfYb#|kI*<(Ot>6A!V%8mB7g7`fRY?IUM*mud^nVwZJo|ND#to1Mu1M=&ZGK2EUr z&%~I37@U=^qPUlAn6SUx_ZNOI1Z?H2ZI~;?eW`NUv02lVFrC)g9EGIT&W@@QWF%zb zULf)Si)xKw{(2evh_K>?umBnfxiV_F=GEg@ze)e@3B2WnC?KAtR){+JC-pZM`+I8F z4_Yr5o1`qCnrY>%O1Qqy)DG0D${R!wA%&sAblIn9R~|`sj1Rl`8<;3KY!zRSB3hIN;+cq9MaFFtn9YeBr(xQp=m|r2nMDnQtda-84S-k5m4EV=RT(A87Vt{mkvcjy^RLO*)jghr zG_D@2kYHC#?xnbM^C)&!uwnVu96A=(6>&J$^w(O`GMhU%= z-vAXTE*0#lq;I)Kg|@J&w=mqAzQJ}2Iz^fj7qpQ8u1wx_?EmL{8-9W#ZXRi8xPQyq z`l$PRZ4M(v2im5*F0EpAEY_DTuTI$jN4{Vm1Q>OgdGFc%_aHXC&EF&a`<|#e#Jk&e z{nO?2;!Jn{#ZNW^yGjoG}*M7CX9qV=Cr zVWyy62u$?lOlza$={x1@zqyX9)22^%ivLzgVb)XQ2l4t*s#p!#mR}YBNH>@))c)x+ zzU~QztgCL92PVlH%lj-qfWZCTW32>XJz2`}@|uD}9VE!_AHghqBjIh)TXrOT92GAx zdgIg1c43*5Et+&!RX^Zjr#Avoc<|H2R(SH#aC*N*&yuQ9PgWOqmU*gy%Q#JnlgwBc zGuxe?^Ip*4P($BiJWSEd7fP1=K%PuEUG7k2rPD{z@mY>oiO= z&UEUn$Hth+wwU+t&2pxQx`!xi{mR;SUL|zLxzKPUn`Ha9b%k-pYQlZ^C__)b*3ICj z0>7;eEOxd`yTu&3$H$o>X4R^|e>A@xE91h{V*ca)Y0?-xZTI;-jI^cirVX7__szrv z<7whmoB3WjOrOWBM=)tjudbW1q-4$@HYH*AIUNbMd-qy3JzzS4mQCuoi*4S0>tlml zcHi@=pD+&^swJWmN9rdFsp&U~8|jj0ygo@17$)or-WQZnCEzO`k98sDofQRXtYlPF1VR~{hVxFexHc3cHXO48BvgESH5|pKmJmO zuZi$(k2qqzpef_>q&pM!5a$N#s^bj5)!}0_!MVeDb?B)tfveZ!HF!Fy!=2cN-RC)H zjL~~;X;Fu8u`~yDQ2Jo5QkC(}rxQvxez*I`cD#Sqo`RHPf9@wth{aA=%5G}3<$wdd z8U8HC#YN63Qel8}MvoQq@UQ4b zB2v%rV&|h=Yb~hQy0P8q#YvmmYBj0xW$d4k+HATXZSAU=D4aT@gk7bI6Wm&7FYNkT zR3QpBCxFoAA|JHb&ywydO{yy=x>0QOf_vpB zJGbbl(aPNlSs1i7u%XzSXJRzee_ca*erAj>&A4r}DH};{3mEp|RP2q$O8Oba69?S2 z|IxkteCds=+~h^-+f)?a5&iBdqA6=9@Y3+KS02fqp7wQa#W2FmnLqIE<~0-t{rb{o zpS$p!_XPtp<=;w``8?mMPbt0<52oO*)hv#2a#0-lAABSs=C+EQW(InFZ38$SFhCoWpfcb`Sdl&CI;k8 zWHN_2m|!6xL&xd;#m_S6LePz3=`6UGz1ge~Dc)zW_~g4A>JD`uVb@+LhL zEE6S>h3NI}XzOYT(=&4{{FwF^9sB3qib%pcCDRYznvQpw9fpqBU2 z9#Xf`$693YT38_oM`!kf|5!z`Mim+&W70m3mxqc|6GYJyLBeI)HPK$k`VatRps+~E z9xfdw4Q=d3{WU<5B5r@ageWIU2S0Fz1bb5+$f&+1r#R-0!W`j;_i;k!5(a&WupHgm05zsc~5nb#Y$RH~aez%IKiZ=b4ozH|_O;o=187?Stnx6rU(4ezVfS0rC(9@T31A$Jt_Qu6z7QMblD{6 z%XMI4T5te6aqFziSh)mT%(PH)XEtu+o45Novsfh5Wuhgq2uKZLIk+eX5|f~gtd)c4 zY@-3fGVCKhnp{L%mFrl>uJ07J&+GXfOw9TcegS{fB6cxkBB`8n;q*Ar&Q zwNwgE&X*EL*CR(yNG=`b_&W+U+~qc#yNwx?n~BP#a9&J2@hbMGtg(j<)WIAggx3q7 zMtUB+K($gP%D8SyfryhyDXUhCic6p7gb>!3XuvHD{)^&69Sc&=V~#s{6SngdiMPPJ zL-%XX0Yc^KFXJ}K0ejof0pZ7Zo8&m+v}j8?ZHY%Z!aFeIEhL>J#jY?bId9+HMf9${ zJ?^JY2)sN>=`?A+--r80$Ko1l10H?&&s;Q(y)1TE{UPMdjfsVcV^N=>PPpXZV@Ed> zK%YeOI9|M-3cDhjXvP40r=vUvlsbmlDab%}y4U5W%J(|L&ve)1oIuk2%yLqi9HRW3 z!1EOeHa7aFVZnPDwicASQfW|@`n})d6NUE8i8mB(2f`g%+#ayZ>o3!0Pol-?Nv&4y zE(ji892%T5p@=uv*ny9!?XF6K;XX2ZYO~4w9<0|**p)gm$ID|}^Fvu6nOqs=L3@gs zhzrbVuS?JuJ()*?Qs1v2!U1js?h3C2tj*W~N!e)&oLNox#WHsWu8Gkl z{#4=Wa;EA?&#KZ7(WZ}nx#n9y#{Eab%S)I0lWK^_2|sVaXEfz8jx}z$^QN8oX6B*!P&Yq~Ni#g}t6^RDy8ca9vz&E;|)~IqwfzG(qg_JrNcu zBXPuqUOYeZNN#*Hp|Dm> zx;ELx`@n^TJGWQmIVnSm;Tj|uO`~{VSA1_Kl}r?+`%LDqd>Iaw7RKk%Lhxih`v39e z!_XN5Oa2@gzn!JXwk3plL`;ZPh zIJu4uinUtL2$Y*A5sjwFRnNQwPodm4{34GS0F%$%OKdxM9lKwnSe$W1=RYe1NU8s6 zrY-bFo{kQ$M^eH}_?%GbZXY({ylPMXKKS=99F=@zR_|I@JzvLc;I)111e0jUsj93o zmm>%#P z^xFQnO3dXdWeFtmp-_|4_IO2t<)2(20y8faclrp|$^a6Mk4mr;68$G^zm15ua^7s& zvmA>2iM&T~sJBsti`B}s;Z3>^%j=xA;S;2M8zjZPW^occRh3HLfeTx3J91%p-kapx z>y;uC>4=DlyS@8mN4kBQhUPm>7E{GQ&L~!e!7SK;!uc~22guF*#td8v$h4mB%Vo|f zE3F~IF8Oc|RGl=k*Ha-jyIUVM%hZ^^vJ*YfTKt^igr7lt{rlC8{)A9Us=~^9tDFb5 zN;2Ficm9AL?I+&SP~-!f&(_rYvN!pNOGLAC6S>)&cTuN7LpO7L1>E70#_8Vh#6<>R z?7lEsJwzivV|8<5so&r?8p8f3-oTv9$9G}+I1&Igw0iY|^>NLUS;%-mu+M!hTSOk6 z=_coh2$_6lGA%8Qc6)BmlWpFEN3ETR z(WG!zVgU$0KwMl^ZRz@R>a%Zpzv|>%3Y1W4$P8WgYgA|+G*EctOzdkuGbw07ASLy~ zN*J$?_%0K{{%Ojm7|YocEtW>;3w@X>c#wfk{bXK}_HY#skgl%$aFtdZ$ew*|x^L7%OXw1i5%+%bb+TslC)eb7(o1!6FoM{*!2=;|1MxNk^N+j{p8B$ zGcPpT&+Z-jxX(JAlW1%C@A_Dgk0kUB_R`j!lrF_Gt12x7NPSOEJy3T@$m}GPIV@F5 z2)owfM3HZj=%SkrBPt2qSDnFr)DJ-#ZXNXkht$NaZgcNJqOHna(RBb`cp^KgIjGma zNe8=qr|5AFgZo-2+&@9O(a~)@P}^*iuxHWjkADeV6ZI*)rTvaZ&9ycXmS z!o0BIT^YTPq?093is~!}B$*^io%J)gCx_1yL z9kc$e4o^hcVDfuv@BWqwQToY}Wz63%`C&m+`|4-H_ylBGvc%ZB+Dhx@bC?N%w|tZ} zIxYh#XwF?1KEDZ|U4C{@$O@hr^hh4wa(K7XTr1M7+1N=OaTdZ!daOvvtYBU7LLm1us)Fd!ieWwN5LVwL92P z_>M?^y?&@oMk0NM4Zf|YKpvt z;wO6GDKdYrgFszoO1zrHX|}R6EJD`RM=MzrkDIM+pIXHmHxPHf>7QRB#!kX;@A|>% zuY!9#_eDB~hO;f+bFH{tdh$d;I3e(+Awij$FEObNOV3MFm!h~93YD7wbNz}v=aXQE z3qyc_U)bhQ$Iz(a^ga5KfuES;#e3R6ha+)WVgwd}B4q69{ME+Awtarf&9e8Kp;zCz zzR-9h2s~@!&yFedZ92!UMbTLO;Xp1_Qnyt1&w0Te*8}WJ{h0DmYvSAL9A4I)?ne5|IPd!118%M8qno& z-0I1gaZ!AO@u7B2zt}I2O#r3RhBeREPrzkjkrO}X z^Cz%YJqb3Df-aHE;`5wfoAUSVd(R_-WEQwx zbVd7w)VoLNw!;F>tTZ9aRWD*`W82H1**om|JO_e!o;`##S`b6J%a9{yMi|Cf32xfBW z!dQyWn`n_c*PI5+y7Ggs0ASCvsgr@WvzR>(Eu4O(dupdQviE8uGR|FAh@0V}sW`%w zA43cxxhhX6ubGsQb~t?`7dT5#{W>!)5;~z^a@W z7PmY`EwEw;y(L3awHvJt7w!M%=Lak-$lvvzx#~OTksYtzW#-Ft=K+z>-*{PKJ~Yte~69J>&pTy!#>a! zZkPQ&q#Ap%2xUnHDZRf@K3E`9xjl=5zv9X_|AHAOi>h!QaiTPi?KNZ4;^we7uQbUcJ0Q4u-92@WXsq}+eWOBUcx z4kbH-`uinG7t8wIj*+3qQwW^X;O02ujTzXueqDF^@Vvx zHMF^$$ecibf;F?wUcAZU*nuWQt@0ukQPACpsG?;@X2RngP>+aCTvF&S1*yaTDM!Ao zlp9S6I18Sh+(K3}RI5+D*2EhldYuiv6d6p-Sb!t*;T$&+&P!J5C0NN01F*1^#Y)uwon=!yFJIMpmDDsYA|x z=*royZ_X7!e~V%N#ZdR?L)TwMAe(XAh*u{}|6INx zP9wJtxs01lqm8pmZlCwSc}++V6UTxRd=@CadNBAQ9_{>H7&|eB$oHOz*F;2HCYu2Q z@zA#x)0*KRLa@PABDhJ8Q5^EE3cCJlAgyBZ!Cxch9mVRqgxF|1@ms*fv~^b*YIl+=u%AQb(qMSb_ZE;DTCN`wy@e%)SqpsDq>nA z9T%SwM@m2xG;}w%twt1RT(#SyPdA@t#eC~Pc}lL~^N5QP-iICs zD`zc9V*EN{uPC>y%h;ozRA$pBPzG`e{j8MGAr(bUP`+*Y_qwc?{)a(&TOFM=2TSg% z8X7^#`3kk{DkNBp*W}6F0v7_JIs@6(JlYnwD-6s1U%ThI3P2n2IKu7>AT0>W_Uk!P7%`{sY1IA{ZsW z9@H5kY?%wmbVT(dB`{KW4!EhKU?2J9)XOLlJIPEL^gbw!44hpDb}ugdrAN>CO~ae{ zYwjfe-1_acZI0Wqjk26V;pHP}+SgP$po{dDR$NQ+fdq_#j8P_}9shHp?N+Lk8=shy zStZ|X6-~Wrem!raK{bi|IUO8~n|b3Vmp{S;F{;UhD$R|akCgn+ioNhxY=H`_r$aok zpl7!l$tfe*bmDq4v)h2k%-O5G*ZJ0tTez2Bya=~@gNSM}UT#;+FBC#)L%U#`b3{Uk z_XJS+;x`jYoCOH02qNtLAa=^5PXc8_Dq-wzBu+vQXU?j_|H4u8y%rSv(X&t?i?n6pQcw%SE% zxEGgO8rA&A5>~@+JD-m;ces~DNE$Ga2Dx9MH-TtC@6fCpJ>5+4T+%4PDOogpDq1$XVMvPBXo&4n=7vBZOCV z(pq{^6A=ql!@l5qDcV%Ro|Vd*J}U8BS(h$GD53U4BQX@~*Cjo2^w}#xEQGuFhDCn# zDhl$S8lHH5+dk{~Cl&Lj>lFM2yFe{eIk*Ylm9yWf>X@5!$DVyrGm3e243~wBjda~@ zT#sh}f4Bcd6f9X=p>oF}RskFOC1EegU~2hH1GguQgBHLOfW8OKiC6qGriM2LBDCSz zZ)VxcSicpmE6xc?rOFEh?1Q13wdc?8+(QtNZ#kIOI(=gn-F~=OHODZGq8j`oM}xiL zoDOnqGA1tABjmhq=XAd09F$?xb>FHX#` zISYx5T&kYPpnHPkl;17qs*Zf~aFJ$zixk#>F>eU5FSRrJFr|c2R;;m8DMLi$?LSUx zNA@!gZ~rTGf&=O@bYc3ljx{PBP_hJPZ7lE4JbxKLPc$_9T5Oy*JV#vgCPKN? zK63oI#F%Y#uv`@JG6*)ADSy(UkqraNN@wj5E+PzDMaeWzRUS%`zU-UD#}pA`)17*c zWlbI(ERe|=@=+Fv73&&(AcNl^FZH+6lebjTil=P;>Vt)1?6Td zZ*KUuD|B}Mlzc$qS|}f&2HYyb1;pjZ($lI|SeLNcy&B^RUY6KL>JL^1(+0}ouERyoa-i{B!7M$dDCcSV4a_`b5Rq&@vqI=)Su*J#@JzjP;`ila z0)iGcDN<~Lxzou{s$b-D9P4yK2lPfwYmUl^-JB$Pa_NYK4r=w~kWN_R=N|951s&Rh zzLf1R6KuLklQ{}7e>2qzNZxC4%n;Mjdu$$sl)uL4GKf2?ranlj63Xf%FLunSE+s#L zt$$Z{Z?(1R(?9!sgq|cD6D-MA@3n=d$oh%Ml;G?x&13tpHH4i=a)7TZ{LX0+k{&F1 z!oSIZMDagpeLvc8g)*t16%dssbX~kYbo^3n;9P z?sQ+&nex%>bp=bFosFcFxG&ewHUb>P2ZR2R)-UWu?~coC_4sp9S`)s z>3b|ViJ{LK>KFQp7RQ|&QiqxH14v9c@-L6Xm;U$M~At=rRb;SU5*RP z01Tcq&-v+8qZ_&k=S^HqoM??AikGHv_RAM1C@CWa78|-p?b32jM#q=11AHgTJVjsI zPh)kobq3$Gg+4;UC%7fy{~AmgJVn%}-xah;tp{ z3_MJW*zH>OQp{N2+2q|1E84xgp^~Kl5#y%$h(`$+im|vVYAY zTz$Ay1a(2)$UYk9>4RR|xn5t+w^MuhAuJR_Ma)C+( zJzeH=8Z2SErEu7HCgy6=cDpfdX-{0DJ?X4n%_KYe8C%n_X_2(_(O7k`WKP}_F3yN< z-ctvl(%2R{6thF-og7{e>C4ZG`>~Taa*loHFz1q#1?NySyUzvP?$dVB%5Dw)I)7Ov zCeIq@z_GJ$*WK)y(wunoGf8kH<+Kj52|+ieGB&XDb4Q*4%iw<EY1U zoaOS?=xO!$ikmU$^K)1}G3P%BP*SmeM5M2}HC z8N8)~&7a9bg|eQVPb%jsRyO+ClOBu1&iDNnNQ)t*ZL@-k-eWDhNm!qKhl*gH=(hH& zv-+z-7vWaB-3kB(HlBRN-x73%^6?vGu=pS?GVa;PsX-p| z8XgdW;>JHPT{7PN03WNh`@i;nr#GqRO>Lk9GW-d|qo}8PAluILZ{rGP@#sB=be!MM zt`|Kh!dhF#19ZBC_D8U!BktvdzQU9M>=RG!hDFZ*X!FRF5PM3Bv($B8IWaV@z*X2e zgHhX=X?n$|OyopB4ag#Cxpo4;q@T4du+fJz!*Jq+*SeJh9S5ocZ-e}ba4FBOjFqLG za;nL}T=hv!0&t;^JjT?aWly|1vAhnK(6an-``XJxV(-|kH{R`YWB|y5I%GAct9+8-Mw2f2lv%xt)> zZ*zOCR{sjzI;!1A_M;&!FmBKNF;zkFe+$>27klXSowDEGqP}l50Im3u0Qs5pmdlR$ zBOvk1O-e!su+h&oCNr7(`MT-!ho+Wo$u+BTLvOd{k)ij!icrt0H8`7*AZPxF9m6GQ z+Ug`kxfG(1$|qH{v}qF$q*`$%IKg7%&skp!OJvBkSJPk^Bo3M)g~$)0=!BB>G=4_6 zH#-6Y3}qB!!0A<7fs68~OBAwxu$kwge2h&AjV0I9RP*lsP)Tkm#=c{RfH~sIi(GNS70>rxGer0tT zL5pA+X!D|hs8ek##y(u*;pe(2dy;GH{JvM-zS%3+EZ2#563J7!Eu&9^!$%=bo_71Ijlr4Cw@%Yv$cgt_T}>z&o~f{E3%18t?~JI`z76-ihr88mU(*B z@|&xcBZ>EESd+GQqqANHFY03}mNjnNF;_!e`5XUhw@vhn!G;Tk zgl+H<6?eFf{+^uv^p6PW*3EG3U|Gt{+!A(HuzosF{TPtds)Wjq%6^wg$jZnbIlVLe zBl+|e7t+(J6rqQ>Zu>9;_Vph$oeC-}%I|L^<&+&A7iD zsyjryQM_EBIYk+^>wR z9R~(WIvOGgn0W4AnCNyvP*?&hkud~4E78=^z)y<0E2=*gk6Nlui}ED*^5+r}wv!y7 zllQhO*oSQhWAlm5p(TnXj69FSuUL8FNrBKLipmL?QgBbu@o44JmvG5$u=-8LqF4#< zXU!DJM~xLPW=e%x?S(aKLnM2*Oglmx57P?#{3hhuA-OCc>j`;L5XN`Q$_hxTqV@uZ zjXCPb?!Kg@jRH5j$-+9)MgyI&M~6mzqjnA3*VlB?c83OV7wzp1w)>1dw}U|W!1Oxq zqe>M=Uq5v-H_*K({u|OPk?Ugp&{V+PMR3vf(^@gdQ+2UZs3t2YcbyOi-a}VJ0Po9xfjf^7h^qN^`-}xy|hF-xILWm_EiNe?;_(1CEdL zsV>OJe>uRdNjIXU_LC^r^NI230hiOfSD$5BEA!t}xfq%^^=6hJqvuEDp8)+mPBbK6 z!iEEqiWH+EY2rtOO};~jOY5FBjvJ=UU~g4t^y;d18|AaaxWh#Vn`OvB@0D?E>6eSVYX_>D{CWGH4 zC;!cKkX3bNs%4^(UY7z|R=r2@zl%r&vxLe1RDU81GyC0s4WN_!hqH6p0OrzUIwYAh zTB}p9Nra}EaDkIMWoCeiD=R#w3vw2$CmayTx6h2O%i`C>MQ9uOeUF2Qg0e8lAf<;b zp&z~g*I{3|Rl&_6A}2EM%YqS!b5wOi*bg&Uby{{)h#Ka}(lk6jqVQ+l=_=*d)tpog zH|&|8;jax3$b<0xtRJR6SU+8TNpnUybtBl%e3ok7J6ZBjmt*R^i*Zxp5(_HKh#*>w zX*!~->?Fz-WUl-hnu3LOFDeCb=6O@|)8ksfHAUzFbx8!kDPeB?97k?Oyo}NvXW1s@ zdUlc(T|Z*+^rqp33i$me`K2}t(i^d|7q?Z2&{0Z8j4MHbOvM~yBOu=?Idv zy_`&5Z&7~eJ!ju88V#p#n^!s*NHD2l3IAI9K4^j&kr=0|BlfW>WBH~v{UD8-rGkXk zd!5#I)CLm={Q(4GZM5{}#8^?tQHlMc%Nn}hj+bHIUrB#GH0I`q^6WYo)S4JsUh+Lg z2cqnmsn2`TA1UB*WWzs`WZ|Wl^UB8yBfu>*81qNyP{xZ&6%Q9(_QkRAFJxy`M<2i2HZ5TSHFo?f(4z9&-F1ig*dc#u|Bt90)ddkJkG4T^H%jEzq2Jp%zk9acot0P@_OCtJ9Hc(TX_DfT+!2~BubRmVwHi7|M1sL z6X4~RzX3dp*6JTtz$?MHuo0fPkzFeYp3-@d9!0+3rpr!bsT))6L#G5jWw!X_SOyH> zQDRpz@9KT9)Qr~yDPI7ffMUELN6BH*uAaduFoN~~*&LsbMSLXtitHH;@LM7A5oSZX z@f(*l1Yej_jGvRhn}TU8Mn6M6&pM>r=V)9;C)~5YV-jK0L9D9`0DyoxgoQ|r2OHWm zRNC$1{-c>_8gP=(tPQs!n%h?JxTFM?8vj`TZuHCMc+Aqit7lV9sbicQWf^i;3D*k2 zecvs6V^oBhzg>O=<#X)^3`D;C?1{G$gNOtiptL#Y6A30Fq713f7pjY6%DoNqAClPA zZ1d?1MHN0sQa2&5HSpv#SOBo>hh@jbL3*C)DIC57dYd-M0Jj27u!9eicu)3XUqFFc zgX#GLf-w;ST##N?Rk!N6I&h>Z2-*K+5#xAU0ioMOVxDm@DbtczN8J=4etp%Ag$Iel z12}i|^y`jFRH|VCF!BA`e=dWkS&A7aJ&8u`sn(x&UYO~Qv@ok?pMJ9bK^w)*&W<; ze{?;>S6LhN>xIJ6ITFo;9Y4txIT!T6@VQHh!2O#nwanDg?U-X~)jo}?ko8nouHc9K z$1A1lzlp;kz-PJ5?EliUsG-3Qfs(tVhflmor+&vaPxhn!a*lPPA_0JKd1Mb~nvzBO zODVUq3IH$;9p{hbz8*kI!>?DtJ#67-34!MW^7;BItuwhV*u@f~zW8PYkKuGbAxCBc zXvE5W8n^-It+S&;(@^6WBou&w!n2ABU3UYJKKxx1;@PoulKb(;K#cz;kDl6oZSu;V z&H$Q^=tw3VZa4eF+t-a9D*Cv?kGwaZnMcf5h)i&1^xdbGIB*uyejc7EU zlr94|065jsQ&o`k@=)(+c!VKndCcWBW1qtVCNI->E~3l6IVekKa?Jp6b|zF88>{ox zC42CuEON8K#AeZe82cg9Lj+nc=W_wyrBCb!CU+k^s#(~Fdb2L+%a&zT86M+Y^o~K@ zn$LQ;ri2HeT49xV?a*{|=AYAEHEyfG~VT-B^t6Bkje zUGPpd=pAr2IBYDk=PPyWSp}oA`$hqZdR4*Cvmpw>b(;%@>Ym`9hVvIQ2!hx4a4O*F zNfXxpG;;r4s}wGn4HNX?r`SeCX!FQu*UuRMi;W-rp-cBilA!7n9bKt`JpjXoj`i6< z(yS!5cv9H@sD=(m*pdGTy7iq3?NkoTBoqm4*T0sa{ok1Wa8i?y>92I2597Jk~KA}pKZ<;p?+&C0Qf=CYg?0jD(aOpkh zvy@IJFR5t9*qg4;GO!xwS+3mY9qs9ZA&6vdH)$b|;S69!ZOdSl7uDRV0MkN38wi<> zxu^dte z_xwwwrf@sT4s^!>)ec|~JEja%dwM3%`k&Q=nAZ^JTte~ouRUjzK~kk4pF zhZ6+v@UG-1`H|Um-|{Uy{FN~(l4_AVSH$gUrpb(LGtsBHCZLr59H>W%4dk0^!RVG5 zIrx!vKiZcGN*1D-hepv#Fg7DI^E-dNJF1=ezbkiiUtjf%<|hfiw3E?M%mEijTl_HV zE#C)4q{q-2Edk>3UT#%MuDwh(rCE9UyDE-~?yx6HZzhnzwX&xNM4- zZJbpws44ha);w&yQkprGtIJWLvlKjg23SCaQP!5Mv(UpikQ21GE2mrT}l=I z+S$umw~j*__?^!wBGgRA^(mR~?h9@pqX+(3`pjMrMD)qi4Xh*Hoz6={R|ORkh~FWh zAXQ5UJb4%09x>w!UJTc7ANh~SOu?B0lWCiw@K^@^Z~M%Xhy6@~zXzkI@+j|3yFY<5 z80bnxffe)3=TG3dFQCTlHH4AdTe84*zIdCiih`rAEm;`ueEBJ`ZZ)v}6ZY$HG-UfP zZP3{Ziv$_q5NEPeNYoGtb(v2jA%W_lq%-G=&gULU6MLdXu2%~IV+-5Irit@q31N2@eg1o#%>8UIObdwu%&^Z`2ih{me_+6S{-56S6=NaFDs~B z#1a+bil!Q+tb7E&ux?Sc2I#llp)mn{)iM??@7J~;G3Y8&4}e*Sp|{J8DuVbapMZR8 zG_+zEq4iS#mS6Gu?3yR=wn>@y3q>7a(&>3tXU3k7EtN}=BovV?-rWCG z>vKl4%GYi&%l6F}VzF=$^FmmI9e|FPbo+B8a1e#j2^jBTa>aW_=xqZ)+n%`fbD&`o zKNx|~;jw>rwde?M7ZTTylQw@0$l}&n+SH6!t5duDH=+%G?$ajIfP zed|$#H>;&1^uMbqjhJ;ze5&&ms;^L;&`p zl`yJ(by5{_g#c@vA6+81xnbVi!S8gf@)BKM#&!mxcYVLp^TcU|8t=-8=V27?ZpQ&P zcuI4CoJzc@LG4^wOPvSvKrrVGsVg2o>gI)F&Oj&UPXN@nEo2debJ@JSXF&vcl(GM8 z6Qf2{8iC(y_x!Fwu2KE+8VR17@|LK&0*REx$#c=}Si}s)suj3P=QE$u1I9h4;>3k- z89Mf2JDq*1G^-oJ)<`kryMmwdd_fK9Y%Sw1(Bkl}pl-!EEStpVVE2He# zA2F8tY&8(MS;~M-h|@v$&b!pfV@>&rfIoP7wQ%5P!Zp`{yq!QLzJ#;B!17M?L8*9m zKhCD6S_9qxrHENKN|ZY3)gHt|y`h!fhQUIi0Ze$Rd+(TS=2uPm1ixUUf&>nooxRH+ z+>Q~zFYpU8k1pa7jJP{Pifi;SD!~=#*KUPdU}_s5Dh)(d0dy*phW@Gl6( zFXlDEN9lO*4(o0Pi;mPX!o2cH3`wCZOs~6)q=`k=gUVS*J~zJD%maPRn}$q8h?J}m zo1L!BO++s=#-S{lJ1#n~RbG7(E7re=lbV%vyiz9oS#7sbeB+f0H2ZG)~!YrK_{?X@S;kRQ0(LZ|{B=zINb`;Wh$hH-&vV zfH^DLyb=XH)Ea7d+j6fj?~WfD4DKzbEZ^PVi(g$VYjzIzyJnKK?p|pWnSVnOEN|Y4<4xYF zoH*(ZF5E1;U`Lu+K-Cr(*WG?$*~iO{(aXfp7E4bLvV#o_Oek%8?Ir2t+%9|JjdqD0 z0fhVyS$*9fR>U4U(kbp{F4BR$=TC3KPlqnjOXAo9OTDw)|4C8X-#u>*_-W0YVqRx_ z^d--M_42p9%KkV-;w=AzONG)ieH+sCdB)lg&H2$M`l^ogBt*{*W6^`Y) zOU@0E-vF(zMkkk7#1NA9`K$*eGhyBeHd6i4J zwQWrkcaYIn*r>FvIVdn%b;h&q^D_{4lg4GAt2jMdNBY-FdPY;qx&NF;!gc!?-RMIV zX)NlzO1rD`<~ctv|GJI-#p;HTLlcV%Sd_S)OPlYH&hhP?v>RgH-#jN>U@n{>atm$~ z3RJ(~jooH)C!7me0HV*_p<7BreM6|MwZC$uoa3R4V0?I$rnSxS&E{=~nPb`q#62}a ze}3NU*?10;Kre?y!Whbfi+8;$o7_g!sRRS+aPy(Z?hxt{WCTYf0jj1-9 zZpR&;!U6GNrR@j(W_`MS8dt-$**bQ>sjqR%p`i1EI2qaNNEoHoNF^EB`Xd6@chov<%i>Es91nZ z3=qBCnkk%l51h=8XsL2?$PhgK122AgPm=ytJA8L* zcv_948lRq5d{In1R%3H^4q1Z+$)6Areei;4FvVi5eOm~h-{Et55YBB73!TozCo2Qj z)*Eo~|IQZff(``m^@_*-8J#okaz+K7)N#CmIS29nXaUI=#KZd+L>&v($gpl`3zb-- zI-mVA_juE8s_ur?uzframatw8-HX=Gs@xu=d4m;Yr zf|Q|RC+d2PSK7y~D19I~8$6a%zZIH#dGLi8-nv=Lpj|ze;wv2dIni5~k~|A4tpEzf zVwOVk{5!vBJ0k1^Yz#gZUJx$gyj3BON;9-7YP8=Tr%!|CR3Bur zhw>s_<7DZbR65%B;StoOJZOnR9eMAyG8y3Frgaid$XN;gTcw=~uYKHg3D(umcHNoj z!hAM;b^@ylloj$CKZ)~GXLh2{UIG3UFR(=>#m9Qk)dFf6S=ZRH60mT0QX}aY*A_*K zXDHCaLsl@OVawEW3%KHlc{qQOyg_p8&&ps2dG+Ouz(`|^2(bL-Vg=3qZBOqS@mz=s z_a0DSrUR$y*A5=uH1ZcM3{tEY4yX_SeUAfcC>-=D@b5#P3w;L!rjH82wT?3OIlC2j z=IHTNH7U1qAdkuE(#jonPJXFu2||vr&H{V}?~}hP;DLoTOsvX&Ws- zH{zc$(iY(C05ktLd*GCaK5E|cO(Jb0k2bLk&D;>dNAgSy5%$cjSCM&Bi~T_9Q^!!w zx+|mK9zY1DmnwZ)%}?+m!+HBWVp5%6OUw5l+z_Q^? zh8>i+$5UnpQUE`|4$rx}O7W0bp7OmsR0Yr25T)f8)1l2Q zdhjcP|629KMKC?cAO4?V6&rD)oFpA^y4>)W4nnw!1&n}|# zNMHu1LmqrH<1~!b3-^M(xpU6B*D02B_DUySS>3y806lItXhBz^UCexEBB_` zDkhj?BMEoC!o~<9-zdJ^@_)m|pIr8?p{)53c3PSGb0(3?*a>^Fk@$X3`>^He) zgZZ(*b2qytvZq4r2u`tB*q-h0a6~q0kd0Yo;4QE;Jgbd@km@VMDRg4}H7RM6`0*hr ziv5n=nacrdVcJXAD>{%U0uYdf?n`Sax<-KfUA4_^8vK zA*0Bed`G_aek9&>-9@s=Kppz2wgsaI6wy|`5Cwk0M~tS_c@7|?-J0*?+*5mb9c2m! z|3y}5-X}8u23IT&6dCHQtVMyLYLsi`s@wa{Y6)+2mj~n~Pl+-~_z60(&wtPS=+!2Z zTxAxvZ;{SZ3cA1v42vsL!xxyN()o`m23|8J9_+X>N*6wFlPCys0Ay0QEc9?}I$Q|z z#?HiRJftQuK4O5lj!CSG(TD_U{$-$*Pmhq7*oiJQxemToIYsW)C|y$L8BtP!PDsR~ zr3{t#?!?yjdjU-U$iz(U-!DZAFGHb=bRPWi`%T#1wEJ|4eg`gsaHa;jbw%mKJ1Vl& zTxf`DV??$cS1Na@1Hv!MGw?~8AVj7xcZQv_|J?-qd6Q)iN+arMOJ9io9FG;npFTXC z2xiRu>A0xOV@GFNmWn@5E&rwfg2?)pe|qKQHcPO#VazInPIm{mIq_~*b$?teSR&hY zP<6?cU#bI)LRhH2vi-k1Dk>_9mb9*l+=b8Yp?zJ>*Eb)i+yk_p5C!``-iCIz0b=`DECL z5i{RUhUGzbdkz~xVfVRXlYFQ`3htZWDgR!odV(fyF#)b6&%QbFj9#D2|NACLUNSZG zh=oL_EV}4>Hb#g=2G*b46zgy6o;o)0Yg_ExDmhp~VaoS}0>7y-aCBR9(%+$+18f0b z_%DciWkl^q!KIT7E<>JDO0sMy6Z>4u-_0U*RKgsf*%V(fl1*# zQ+vMl!4k+tSPHxk%R1_dOVXRX-Qx~5ncq1qnlc)IjcGT#&ZFgEpGolZ`vbu3&B{F) z@Vw(5U$3J8SS%-_T*HsMUAKP8cHv99N43yG&$j9kWNF$t$n?(d{P_yMG(4bn{e59@ zN2;Clg*4i~rVq1EJ0Uxz&fv1n)kodNmQpDG3nzb|33|h)1WlXpRo|jQ2WWrz^!%j~ z%<*$so0Th|Vj&3~VHlFKZ01m`1})}id-}jJ)dP-zh}N;srhOZ0>Kpr@#Q7BlwVL*z z2^tbmPE*B%sq#VFSFrF>5bBzckIQpM*eEP0q?Yb>uAq4&NisW}4vKcE+iNV0K!2Rn zu=_i}hP|ZT$%a@Azn>k4Q#3eztb`}4ssJfI{*H8dI7;NCVHGX^(jCorN-7{5z$X^o z8Qcuudzr>cXfm%FTylmj_-(ky3&`)Gb&iiT{on&l8cbb3WD^8&3IEb$5?KmWbCb%` z`QMbymc9t-we0HyLmeu{WkVf_e&(V2GTXMbMkdix>3_2!TD|X^)1G*MyB$Xw@|-W< zl2%?Fpw%S%QQJ_j=IFpyE?mLZ(*57Johq;Z-mNpPLasP6L_e+Wi<#s zCAJ*a2C=Xd_-Ib>(IkA>m#E+|;5pXRsyLdaU8TEMU9X>&Z(+_P&$-tE_^;>RL#2lt zuR8!q>7?1Pr(9V4O$V|p{>PnxF>EGeI26=mx#l1?sc+gtZhu?v#I`&14;aCsROg-O zc~Bat;t25;?1$XCZ9j2N6J=ma7&lL7jDRA>B4cJfzogfa(`nhJJr5#{w>00amg|~V znoh`~9ewCANCe(ajav%Ko_CcE$vlH;@i8g*;rPbc6AVv`mwL=}p6A4XJxOM^tw+JX z6w)T>mPL@w_3kBcbb)y<^j|^L=$AWjolx^icf<~})@+MoJkydkRPmr>`I2RWb-}|E z7Tq!UM?OO7q7bfKlXfmfk0#>g!6pMNf{B4@u znP7PoQAlg1o`M8df`FW5d@ngAS9BoAEZVq02ldOH={|wI{1hw0!)+Q6RJptx0Rj2t zQGbKxzA}vGvL)RUuR&&%31miJvaiTnt}SRiU+(`U$o#-KKXsi8vh`c@Q{}inq6!&k zF#}F+b1S0VZz)n4vAIuU5YO2qyJEk*)yAehN;!!4I=`rKsQGz%_?dh8ik1%QE9ByG zjSy~Hf+>r%X&{ihIl0TcPiyRzBce8v)Ul*5H2rV76kfK_;#tYp5)cP6kiHagI-Inb zfTVnxpDun8IGEU3kkkn~7Ec8IS)0}0}8*A3stEZo>np|E^t z=J=lsbqEC}^SJpyxf^)Yxbt09n$s zf|(N5*GMr=SCs5H2(px9X0uPyU!Q@R+_@|*iOW_7wHx!%sz~UHW*c1=^st>7>N=au zaJo5Vf;Gy)E*KO=Z9me>>{}&U1x&7HG@q89z=f52EDr^gwm4GgMXYgKor;~)Gipf~ z@tDxw4Xg=()P0CV^t}7{l&!)27dy-^(2@u4yj}X+vDY0(=&A~+%-St?)qXsn9EO%w z0?%bRPpGRBGM+kBCK~j)1qI?FELT9u7lUX%5R+@l*K9{EePpRh(L`+W3;M^eZDkWw zBA+?nv(AuG@Q4c7$Jprg$x66>W`c_B0@MZOVJsp%^F*)7RYm{@x?icWHXPmGzENq5 zH{;Sjty*mu z7qv$@S>P2tLrBROkx{-27gmu#t8dq{-6Skt<4B%ukS*afO2~!(ql|Sl*^Ruu)dWmD zbV<8?Vq_YFTW}1xrJ5DpmMF0|RfusiyMR)z_du4wPbY) z$W2VJ%Byd5C%=_V5`u_P9ZN+Zo*Nu>y{Zw%Mg%`j1_T?Ft_(xl)*|y^-2ZrxL$i1C z{l}USKeP?7U?Qjjs&|J!4JaIP+t_<9JF+O&n#I%w>`REuf&xa0a)T^2zPl;pDIB{#-8=_{r#WrGVD{sQgVN1%5f=h1C+v_8C@)IiD1$2+Y zMx0rXy_hzepkOkXBjFqMuSJ8bb!swNO@$v$H8+0b3UFQAz)54l|!Ni~jHU z-7)@-6pKYYLXLpMCCguOxck{HuY0#~x=x2@Q73Gx&J5LFOpLs$7|kcchzXORA)s%m z?x)fqs^pJ#vZDthvXtN=s8Z4+)7Km6F7(j~eNu^S|JJxN<`t3IV?uAlH24QlpDgBM zKaUnAkdSHD{U5PtXzTk1$vB=IavMJX!DlzD&R@a5_lsLUtyDbW7joAlCDLqE;OWxQ z#I1QC38tjzQE1+$sdZ9MCod^>tH6*%9Ta*Ob|sO^m8B3RT6=Hv_5Ly6BT`||w~K`O z%C#c3(D(Rt5+*01jg2|{Ct{{jO;=$8?scVIC{9T1|%@L@Hu1)oRD@} zRa)g&-)d_MEH5uxQ@+NOmmj`X2~%&V-G^ICZsbjuS=6{BxWkPq)QKv?CJ=33gPIuf>KZx|xf1tpG)?fJX$$qIP^rCj@psp1SPNW^GitiJ$Mk@*|#Lb#o0;(gMR;jB<(YkJ>NxPSJyhT?iYYAA9p6o6t~O)!Bm9 z9;SZ5)E98;QUP$Y$!9J2>jTqR4Nx{(_~wxQS1uQ~qc}(37gF1soPj&)!XTJzq|(rl z`_SJXoic3(tmbUs5`vF^XUF2;^AF-nX@m#MvlXK@3Es1_T5Z}5biLlaDTOeJ?f(A$ z!(g7vVdlKyUT0!bNeM2+9DFaQU}1q(4#2v_L^f+84n6(t0QJe5D(thhRo_8DZDoAd zYAS-7Wf+zT6utLRa7WaZ)-{<4hj+$Y4I=-tl$6XWH+r7D8~dHH#WwvEaO;z&KD*wQ z@#&Kqp|kRmnur%Ru01lhRcYcSk%d;2&%$BO_hWI!1%D*SYw9wWwpvt?Q&K7q2vobS z1@yknqN_g*b@G!Ufo*l3EZ;aF5d+Zi)oi zxx5fJe|dh*RHrmw6A%nNC!T~Us!bR+zTE&?jiCO_8V#G;^rE5s)t!#%kB#X{kvMH3 zcW(H{YGu^-*OaYs_f%`DK6kZ2*Krp67a@bigMhDpfP8iuS7eYv6o-l_U=Uk`~i z-!=O{R%TCoeA)5I8DkND?nL;z?cH+|K5EEAZglhymZ#sWB4N0UY5oY;iGrHKg2~A{ zE|W$RIBYv-SYg?~176FWO6$OSoj7&$E_9%<1>j-LSDgJ}2(a|d&KWzJ@5Lr;gQ~Tn zHu7P}nB)QDdB5|gPs{G;=+RKX0zKT}9Hn+Mxo&S+m)*!DMYx$rE{wE(CX+^~L3A^9?O z9ANXdsq%O`^PC&43daX!u9K#&ch*vi%hb?(=`=?6Y z&x8KRGV`|TwKX7-luwxK6?K9|{p8DtiLiThsmX|gpcot?YA+PYfC0KdpyLpS6d%HC zHSWIos%|(;95AB30zK zifo~we=ePWS23`8-qsYl@gcI;Q?C(Mt>TBOAqkm{u`d%QWRy8YUiSl_qu8y^nHQ}% z+7!nVl1_fcg%1JYN-zE#Q>v1m-(vgJobrsaP*1bHY}d(jrFeSAmP_h+jy5P$0e`At z1e?ro=3_8%>%mx17MF|XZ2zHY>gI8ufnq&X5mim+X9qGe1@~C%q*R3eIL&4UQ>y2ej>`rV1{c4NPYY*g6R6+V(L~Lgqs!n zm7}pojlPfPTc$Q*kfYRI+MJx~mw3Lt9ABK$ct!h^{DO>f7Mb1@%_I|;T!hyXls|zp zSb>(V|7XahKkZLlIr4o zby?}5kyV_ZM=pGC>hgsnfL*!7TYZW0C8=F?#@w`5t zf+km(;R;kyN?jD*z?%Qg9J1PYZ%v*%fdIWG@+EhjC#+v;H?+^YaOt1lSf#8_lgzhX z;BMS<$vwUrqE-MfYk+bDiapNqj>1jiP@QP%3CZG_Jqc-P zvFz&l(71kyYP-U&4f=7%^{fM|i&W&gOaoP8*|6uBnEC51W?de zq!nrMtBc`7iVBMu5G|qrZo-eP6Ay=p)y?tJ`}Fin&HENCCnxfWW(kL2HANvzMC?FO z3q<9lAF3^f)dbQPv%LgZ8)J5Yx@YaZ*NN85xf7B;Qx44+Np|Xwg$gmV1FcT4_+nt{ z$oR!HOMpB^qj7evpIiR)Lt^x|FmRcHf7+oN3lYk<0~CZF#sNM~M+yd~Ey^8=kA}wN zY;+n>`zn=;=l5EK>HG4?8oh+{`^XtlWy_XO-PhW=L|PZ+fE}Bt*??`&)i4{m&7mNV z9yYyc_%Cyuy=*3s<#(J9WQ##9uHb+$_mlfK^=X0eU@lZ0b`Wn}%NBd8T2cY%2uO{z zj36Q&u5OF<94CKqKDc^?9x1mvB?_bM?dkcnt-XEaom%z%3y%{DHoBe~+w7itS{xk} z)It~iH$^v3=$W-fE`o358<^-;e{t20S$?Iit@oP1d;PB`WW$SM9SPa;YmaRjIfqj& zARYZ|vygjUL%mLK?%_8<1gHSta}a#UxS{!_Ll63US#^pp^QUCN6uaW@m-=Njw3^(7 zBjE=sUTVP+^`lu|Q3dvATC&a+5H5u}+O)r0ORlBPy4yy!+KfW970;b$Bb*x4TiQWQ zwGL~9=M&JxM*NGU_Q|+HG_*QDaBOaMZ?RGliVq&Xl(=}e+nT67(B9{2?&4mc5xjFH~M#W_eIV$t#HEf*Yq3X#Fld47NN^GVx<7^^UvsY|SFF^xlG=lf_-^5?QX<~Q;>D$tI*_;NxwfdOZX51*>*i)};Sz3K2gE5gX;m6{=6sLZbm?gO5&S9G zDR4qo*EYz{x0StpeO7F;ciyJeU{D$BTUA2Z_xysyPO$PKytWb(Go@gT)@y;pkd036 zM9Utu`+zYXr^uZi97zS+3WjZ9Epa2k4Bo+T}R_6c}d_VPNoqDP%5 z_inp;i$etyfglc`jAV+~2s3G%dTl9B{CcYcp1LJGBc-IoiV|*>u6hs2u$j6tmX>B9 z&^p_UJVr!38bFO(ORo9ElJG(#D;aqb3oGq_^b&&IKIm?Hn8 zZQ?Hk6u+h@@<=U>m*@i>vDJ-}yVZhKoTq8V#$9e1^WTG_U!0z(n~MWa52~?*R%n>D z?E#aoLf_I#9v{V}fW+jiU#Mk`P4C~`4VF_MBly{hb^AYW6giVV&lQ5fGvC}t6c%(w zkB1~%hh4CcN;k>;J*BJGRE#}sU;PP?8V!Mzr9nAtpr_3lkgdWl=#9L|{9YLneiIyO z7U4JX3Y^z4Q$$!&E-qE~mx2s@1j{ypx!*)P)EUw>zbl4cj7+HjLL$w3I-(T0S+qj^ zWLE>tmRrbsR}X;TUBtD7J_MK zY2YEgJDR&Ns(#G{D<;;Hg#>t^-hT$6WyELLA_Jd?8vQbk~Pf{wTvnvV;- zoM5juEE&|JtmqP!jsVJ?J{^WW?HHd#26Q^yJXaZY_UilR=%Jx8wQ^`9Bctd<%@r7Q zgggeM&@jBKt83&U^GH9`j)wlH?(fp!Cf{(=P)ELG^(Z)+3N*EXV`re|} z{Kz#owul1w-Z2Ldpy@EWh6wrjHw1vN(JP>DkKBmP&#x&khDcIU63|-bA1*Zu4fPy; z8}{Kl!Mg{LrEvGwhjiaC^SEehkBf68?{}k%2FhdW7b^U`OSqm1$(REIf&0WVlS`-d|B1zXIiZabLto$W5KT3S-g%JwZOY63Nr7uCDi-J?TM> zW{>E{x-xe3z6r_g5Y6nC!s~yyF1F=_SYwJpwzMvJUijF<0Y~VGF>UydYRo?wW)r9U z0J;OKkDI!@cd4K6{4+eqB!8eiKwNXkxE|I$uM{17tugRe+n=tjZ%w@vK6EfCinDg( z6wf%c2w)^^0wLh}Hk&9S=VL3K{fEbvOHxAm*Ugu+AjN2|Tau?##GOkrp%Ooe8f5YP z78ny-10*|H944C;D4XvUJeq7HgCEodw1+b2opX|*PuCZ%G9pCTq=*||sN>Q#`gu0& zJ2Umsh`4gZvJ}}FfkC^(0uoeVbJBad?zO^aPnbN1ReeyHdmcY>_EgBFa3P?ARE=WR ztTEQ8H4~`B&Qp<*rJY2BjS2{Ej-Zdvu`25B>l0Cse!h+(xJuwhysb6qSb6SXElK)d z8KS$FuLwW?l5&E9rmv_LHmc3QzY{a0VZTmMjb$7D*4MO2=V5NSCY<>NUEGOy*y_{% z1kZ7LxCwsN1M}I`2Sn%vMt8~tg>=J#>{z+4=bG&9Y2o(7c>{eLR|*c#2ivCSYPg9% ziMwL~Jyz92tR0g4nTYQ>3%H2$X*Xdk=fwJ2DWBi%9L%}mkIL!BIzQhtVorRiMz zWwbP;1NttteY?u%L-)-m>aV*-^d?E2UZjG6RZZZEd%R!3i#STVZC^QR6%UR#Qm3Wz zfO+Y=lW~cW5&YB4_}{;d1bau`M&dY|%3mLehRR*<0A1|5N zgXfLNCGh6b93YhbnE|Qlp9zQAHJPx7|77= zZIt;8z`9|<rdV@pu8MLIBd8pm?rbRZ)$OMS2TpX0+y-*Ieg$gZXx)fftU7 z6I*YI0gLWeeLY`#o1yOhp>R*L1G~{tbQ!F$)gHNL3Nqb6;HC$A`j z#biQ&uke*Om*R9G0z~2Y-~J1JbjupGFfjG%G%P`Wj*Na2K=3Li4rtLsjEtxXy?vLC z*XVnizffUHN_N}mz`o~AA^5^&iybV0@I4J)&(zc=MStvVJ?;pbE*5}{yFH8_7cn;) zQO{?SUxoj74@=@Nffa`13Q$(C48m|12qKb${q8Iu1Kd#(y$%uCu^8-uE^j@8-v-tv#~*d zsMFDqGdWKS4BBa0xT89@c`5PH{{Zk1(Uxdfc6Qg22 z3G)m|xk5PUQ@C9JO?tPyxeVxm(!tL5IaY?~1iT6A zpkD;}^8xa-RBKVz;{BYGY2czW+@8a)yHpUQe#E*T`=mc9pZ1xq3+y<)_-~T{BI1_~y+3F<0rkuXR6ctM9>b!A` zau>!;fp@%dudlgBdiq8%d5&7;LGghTx{SC1+!cw{B#3SeV=%=?22d%H=2f4V<7jF! zvO&-_A*Hw&7~aroS9Sj1`=;OqR!9EycOvHlSErE(@dDub?HB`JSE7(C}aFb?WJT%b@2(fp-4gcVN`yjn67 z4jJD5rsm5k486N0fQgy--KT|db#0CGb9Bsn(B!&pd(|bl~KFQbl4SsRk6c6Q_Ut#U>dmNi=l z*74TvzwXj`EMKZ%7HIz_gi(|D)L;PVyrkOzkb?Lypsi;H2F@>~h(7>OX+LnRk+kQD zy{vRsVqWP-b@zL+`fudo=~-Ggokz27>H15)^f}0d&k33lK7*Yug?pnQx(6XIJ*{8r&h~N zA}`=f_s-yh_HMM8Ppz?p4!DGh+*}q<2ERo|VaY4dh!kxFhG@GXC+N65@5gU|JLpR2 zfh?_4hH&;C$ez0+%NUDpRz0y+OcIiM;NG(|F3BDhcFZm#e*dNks(dJ7v8v!r$S+nV zr`v~a%@Ak+%r+lBq7On>U*8v$VwcHS1i*Z$2+Rs)|MORq34^Rycm~eIDA{>C0O(t8m2t3ns1aX35dB#+F7ry&U?3lIYeG%-K?xU6{ zw}PL(T~yloKDybwZ-_Pg2G!|U#6s+m0u5ro4*5V}4Kbq-h+Zp_@=%Ie+{`QM^$6L? z20u)EmseXPFmyNFd%i}}SO-K8(F|Kcs~xXg`DFlYB%JbK(+u-<+lsm1??o6Mn?rYl zLF1#3wi^tvJQz<>;GG}P_uLQk>h+OfooFd;m@dm*krxu97HDV@$6YU9#a3+l;WT^) zM8wUbF`D{oCAZg~na0i0#vnNyn6Z36?59t^r5KZ|3esWGrv3d3dGGf$> z3pp*~i5P(rO16vhdI+C)%hQcB@`b5l+#iv!G;pV8?2M}U9o^|4K{?XDG(a1il|1wU%muFR)f2;awwVX1M!nv@fpPrpW-zO zGDw)L|5)_D(WH0Va-kJ}&9Ae!dI>3FG(}u4OcY;{n%b&A%*x`511aI}buTJnAa?>t*CiWJT0e zb}n|y%YJo)2K!ymZ&%d;&(z87PR!MI5eL^0Nq|=y6kj|wrGCI1(c~{OU4MOzl^~vB@>MdIJ_Q(%f zxakC^MFSunLMf9?{Pkd=g#GsgvT*<@ME%2$Oyhlj-ao%q1G*1|?ymv$WDa!ar3;Tt z3?3R{(UM0R!KYnTc;B+j+T7D@+reS`olrz5(KfOr%H_OUG*lU|EpHbUj7t@QzWE3Q8<{mF!`q36B&h54+TWoJqaX2l!dHr-!rK z718G>FRl(icfuUV(&oiv6^s& z&7)u|>FG2C1eB#S5MZ%pY>)~sXz;k4p)xe)(6cYXL2@bm1hku8+=+=V_&uu$1c*~E zxbyfjfdSr!1$7`llafO6R98Uhpigg#9_ZTSAfc~N%7CfQoYgJrs|?0YP~?+pj*a`C zm1|g#1Zimsab)Ynp(o|yV22>8 zp!{OT8XRVnx8e@?XJ>0(i0142m4ijng}5Rb|tqNk`k#^=l)?p1x+4#f8q-uj(kkf zt%>wyGKkaEt^zt*9e#ZhJ=FMr8J?rh+KEkKa!0o^LMh9S(wvSTb-fG^Uel zwCP@do`1nVp0()!Wq<;e55PT7otXTB6rD{ZZN$gL->Ft%(CS&idvclvBGl|p;6RD; z)YSO-`vcDbn4Owswl1Bp619S3o&?@s*#rc}bV;po31yhxI1~B8Anfta52wdL;ypCjWZTc>TXY!43<3^kWSV-`-A+H z3nN(EwXsvn4ZwNMt}T|cf-&9N0-KwQgSh?VVLNzkpKob$(Ls!ddtmm1O&Q{<`y2uG zw++>~>k;vy{0||KPt2fJsa{Yy!G#X3{zXDX*fdygwhENcvP^&t$>K)B$%u57mVxL1#qNVB`q9)FPv~GP~RmTshlS1 zMm(I4BW<`igMHoZfHe0*b21B3KqK_xu{+NsMUYq6#b zbmsyr316WwFk4$nLZH>z<1v#oh`s$V4YeMDKAv$>va;f8j@9uca)j-Wk4l&U0r63* z>g#UOJR}3NEWG65Q<<2HHE%FAo(YIs&kCWXkjwpV8YB z^n?*B0F*k{oBn;EN=h6&z+eZhD3w6Zcq*Q2$Zs4^jJ3t8Pjc}&uD8BKzx9iB z8SvaNjn6w<^)_ONq2~^LjHvEB@#Dr4A84zne~4*Kn|^BJH4(&X2++s+`p`=*j0|WL zTBn<$D~BBj8!A6M&>q*i?|!tdAGe;Qh!Vse(OVz-{qSy5m*IkkO6o5VMCMQiB)7z_ zr&&IhA_KM(TzO1vNcHQnpE;ba?Ciq#P&-;fj*aj79nguo0a7pEuPY&;R_!aT6x*<+r#nyj za6N^BOjaFs$w9jY&S<$u;Am9!BpVop3mbtdG%D(QTRMdkZhEmFyx})F0bJaeW8)Pv zhG@a#Vw>dn8n?)xJN1Eg+?T@73MoH!-91K&A|EM04j+CpHgMj+{MBp8a0CYITtOA5 zs~m7q;V0ws?(nVp`2i&L91KBjM4-l?A|l>N0Cw)Y@oOKVet1Cn*Eho+pMLt`t;p6nS3k8PIUooYR5yMWBl zIV1RV`4YK9G#(xv38+)&_^hQoU6bMXTw01~{ReQ2L@rkQ#!J844yv(ns@*$%l*0U_ zpKp`&c$(0ie);9uKilhSFE&+iQquo->@SvuR8u9OFyUTk>J{6RFX%+|YCY~7bJi;l>y3L1MjK>r_i0X0141Vi z-q7r169?RIz88qFwTzk?Ok@Mvtspz0wueuK_?(rcX%T;KFtnW=H{J{d^Pyp!?KJt; zcK^_;6iIz~jX^}@Td~Et=`+i~$Qd$F=J5EJJ5lik4#I?~-&)8g{UCq{9*Z@@U(aPm z?g=bKLw-HEIo0?Omg15#g$dqeaQl$&DmJE#<3$JRqbn&CExabNOJu-A5`%o6Dr-b? z5FagJUv1qdjr-`$?Xn+ZJb?7sHalLhZgZ9R5?3G3Z;zX7raYzVO0R)Z{cQKT^Qg^r`tJ<*4QXGjI2+J9 zmdf{iMYj~ZzmO{{qV6ivM$4dZ`OJ-M@#4wwni2P=&Vt39@9_eL&c%?sMe@0$j!a2U z1##N}R+HlGzTWggmV1(agr?1^Z5^g*)Z-XEAjndtBj?AFWK|J~uL~~wjS`sF z;sTkDyFWp@a0mZ|?hBCS7r}z+UP}KP(?PG3{1`MNoT;(|A^n3hx6SpIeL?CPIkte` z+9L|8-QrZ`2{$IRA|`7vq<8mxiyN>Jv)>UlsZ9O1H^ek2rwCz@?j2~6@%Qf|CvY{o z{?Mt?ltc22=i9qj?kedRFg5r`b9Z%bfYSP02BNmhj2}>}xV$gJuP3i)D%{T8BNvQc zwxRsbk7Pc6XaSJ5fX~;uLBAiiV}-O`n}HzUCNXsL8iHRxl#4ZewcCuUbIYuaP;R;) z*`A5&5mIYo=mf(XPg4$BgU>#`RG~a)CmTr0I?RslADX{pW z-28&!eySczTL+WL}Mk zihv-!O9`k^1OyQ&Di9E*3P=Y7*kB z1J2~^y7t;@t+V#tzqNmEmtbAJ6kSn;)GevKUriWof4J~YL4Cymh@`Lw9Q5J3%jdg_ z#M`Kdx=G1Ig&j_7^9=U}aa1mHi>Y}C`GlzTY!LPeNg2OMcVi5=B9vSNz!e;Mzyy$j zy^FIwm5l*Jub)|0TdVWHSMfi??Tl{!?ebB&Xh^*}0*VA9!GROZ!=%6LS)Al7IFta)SFq zC)dGBnkzPsrb|gNNg-LN*GA6I-V|B{aE&a#ZE4obG2BKDcUQL_fc`?UmyPilme0c^$Y|z>He2|Sc z^4=q*@M*pEaayl%y#b^m?lcg5c3|PegU$f^fmO_XRoc-f+pKHh3xa{@>d9M_I3pmp zCx=tHeOL1mEAmLw%OKQZ`=PmLXyDGVK+gdNFXcduv#O_uC0ovt1Je#l5TTkH7)h4U z2nPE-nIl%=dTHZ6YcVsLf<{1m^FF-;3Wzl`nXI6qfn!I+jEtiAv(TYTKs@1?jwiZK z#zmFWKWU=UI*I08D-SvXgnl$tKY9AL1%=pl$NO0S+-*k8JSC}ORCOK;z*BP6leX@Y z8G+a-mK)Mucf0=jD$gg1ldjZ0X92mqeZw|m{3x@>7!*L^uZ?W)xstashPTIkyh7B^ zd?g^c6=;BfJNiw{0Y!V4G zRu9wfJ{+4dKnD*dYa@?cvl4;bvyE*ykbQ^bV{o;ts5C$g-9ljNFiBJMO3(&nY$K=I2~7Q`xecT5R(D$JYDImZ!6gX0vs)UaYPl&V8 z#FIPyFH8tELmJ-n%Nal`1Yg!-6IRjNTIn`y3@P0!{tf8j*SNPs0vWNnS^R0V(E(le z^8K^!8}aVl^hgL$eK5w(;FzYGF*J8n#&giT`k05U@OA0PTox(LrkAn+NX@I)mr91$ zjc(SHnDDntoQSjqxX~+!h|Tb1Ngd`uO3N`4y4>_M^YYXf(jM(G*Vy*qM!+)N$JYaCLZ53Vz{}?2o`z`Npq*4<#9NCcm%- zzyJu{E$(QOuLhyV`LSR6d;k~nuM|Vc(as37JlsS+3n1A7vUYRq_kdyxPlB^u17I@% zQgyiD2(HwhqT|u8erNgg4dl0HfAGx2@qbtWXypU&#YSD1l)r&`e=rl^z);>s^MCA@pY3Jl<~70BY1B?B(?k zOh9DGTU>+Ook`y7&OazO@W4@i`bgoY65HHfhSKaX&eI<^$BNxAr~`@%0CfpmHW2S^ zrUZO-$6JPcHS&)_4}#{=tAJ?aLq^!sKBl>V33iJ@X!*|v37*lM#MwnC3@ zhmzPp&g588x;ehtG8(Yf^31e!&TFd%Np>GxjkqmE7kEe9?F0~piP!#YWoIh$YvGeI z8V@?r>mw(9{x*4HTZLCxfQ>UDXtQCtakUqe^IM{X9`-K(&1d?3jyj*})4_OSqr_L> zE^e&8FzawNHVRP&Uwl#sHNlLPF_o}`GY;iG82m5IT72`Z zT$6}%1@X?W^12I&N8qD$P_9Z=4!>CuA1lb$@uf#0=(Uem!g^lC-Bau18}6~H{7yaP zJNr`l3yOVg&BV=t=X}4niV{z`njD9XTp-G4&&!{5ex(+G@S1MhTOB1fX3oW)2Ld8t zwmk`f54I!X+~Q)n_=4^pp5DmhTz7xfa^!NrB#5>|Nq{E|lrM9Pw1)dan;t{FC7jI9 z4{i2MOZS$VidC=l9?05Eutgq*?|-9z6tW3y;KEsYcNqZ$iF@g4OqxTJ$s%~}h?~r3 z2A6U&bJwor1elP3U?g47G|10M@3|`9?AY60y7I{;J~=7jFTRzA@nRDQQCa(h5FM6W zW0tVT*o~G4ki@+BH_utbDnRoW-W?%|33x9`kKzI)wAyAl$mbRafrH~l{y#6Rt1S$) z&;x;j#DNoVS8{WRyc1R(Q7fQPTfd_xf&OsTfoHm2F_ooN7TsJ)R z>A+s>kM?=Ha%R`GU6%;RK_#jkltv4jDWCeb3ZGBEB&r`#?!rVH&gWzvtcO7DwW3eO zMAu6o`y-R+%u}x+-Z}H!Hk6mhH8UG$lJca+_i;qM%UfamHU&CL44P0gPTX;h?qHN_~e|4sug#)J3^a%(}1AeXkqdL4P zjQig)SvvkHRp>zxnN*+~3jg1b1(a8E(H|Y;wztyb8~a)WY0>C50@=Q#{-tlZOfXHghh1^V&mS zWz^BY(7WXJ0R7&JJlmN3Z839d46Z~jByhMlLB$Ju_n_~r+7qjda==>uhCQsi224dxyC$w zi*k6AQd1z+Ub+tX9&%il@X*P%HDD*yA~8zrcP%GCNO`~qVGn5&nkTA%?&Oi(P<)F9 zZbkk|?UdOzYc%-|VB&V`WcZ{K5aJy=#L3?ow6h-qV^03VNSP1*gBAXNGjIOxw)TI+ zuDV!*M-d1A_O)o=2>Zq9p~bc?B5neD%T<=RX+%zmTIo$ zD7i227eLKYDZxM^8uj-l;sOFl_W`&zNjN?wi*U0;1kpIm>$UQjO72dNTymm*VhO$$ ziq%;5T(9qLe8fe-}TQDM|>{#be4e+6Kc= zIEm@EN@u06m}yN%Gx>3JJIH+HJ|a%%@5}%5HnvGq`;5Xm;4Vs;X_US9Tza8%Xg*eHh zc;AUIHMF6&h1k^X*-o08wR?0SuRZ?cU28Jz8O8JUQc}s*!(?1>ZK7Yj@GFiSH9`YW zgI-^kUA>HSWnVvDD#zJ*cVVBd^uxy`?cj!uOUL@-y(Wr@BV3Uk(8N0HA-#!2d&>f1 z#HIJlcV){9ygbitu9DLB8+Ib^+u_S242IEA@K|1L$REe@M39(4)G2rTD-yXT1Z!%Y zy2ba`E{beT@=L^6x}If-IUwwQ^9X8MZ9J7l8=?>^;3swe-C->eNv8bh{F}n==llZ) zIE3sq8sE|zFT4@+$+gVSO7)97op!W_4(f&_t~OkdR!ZnnYFCE$SYuz}BVDmX6+##q znT;i_@Zu-dpS%;z3t!-Lo-2_!%&;|Uh|gj(v*+iVvtbSeo$wAm2X}dkZ zA}e_-wHr5F!qK7UdM82CX!Dz;a_F7y<1{ohQ>q>nyn?gEv zZ_QQw&>KcQ7wmM_x3+wGyZ%}8+bH-4&)_!}JHtE%qm|APO0M4Mw6%?;I1iB&%$aswc!H+$MsN&^_a1Eed~B3_!pkhKAZ&6OQ==9bO89BnAAaeb z{>PN%P-o|nfUzpIFXbayJawip&6VuXADw60+{zo3(gL$Gd(5UAm9p%3CGFDpz1Sd) z5g04K{hc|cy31Dyi+eE3Wb*`-O5v-ncf_j?0kr0cIn1D8>Zzaev}l60$3g01;wv-W zo-(dvyFNAlw%C0$cIDtWZv<3c)2^tv~H^Dw0R&`pA)RL(6EQkJg1lCUjuet zNF^@R>-wVe^9sIt;=};}^K`SQBS!Nh?kEE$d?}Y8zmT`SPa-vkNoaa6K=|JK9HU4iz@`g4&!6k)5cl)V1aB)yt1%xtrK*)X9DTC+ zy^{TCP*A3tx1mZFugW^E(|Np&X+7nKe7}OpWp()oV_I3x2%%lI$;6lOiAgQ;E1zu+ z0K`dDIY^sRSfgli*~^BFC~DE3QfH88ge#ftsus;Lsue)iTbcbuPs`9H#@5kZiK#Rc zYU1r@a#qWR9SUL`rH{H$VTHVHgJXcjPKbTs&dxOn7qCYJ1s_{!xG=Ob#>;&+s@m5K zYOmVM0{JnE9xc=q;6`J8NW#&at8n<1Lm}ID_BsRNaK>5_7PWsqo-sz-JoiF_-60s?@Jiy&3ey#S#*Htr zN=)oRK{1+k{4d`1=UjocTC65I$Q7A{l7_B~-~&HZ31v5^=yoZ|cdOqvwIv%((g76k zJ^U{Sjn0biAsBi>;T+wz_;_VuNIT~ShJ!6Tptr8tM8f2mxlmhKVfJ2;3*y^sKlA!A z*y`KU&i(loLQzd>-Mn%tx)#DHc$J#R@n&9Sq*dCMIuup*lXwPIe@nM~nLLMU=5^pF ze{Q`OvXZ^iqkrZHei_Sm)<{u(sL3+asHG*G)2)YR-nK!YxLaAo!Pn;`c}so&Dv!LQ zsqMw8kf`xR&6|DmTnwtZlCjvg@$1CO$S&pDAt*rH#bF#(^Ww*>(a`BDRHie~iDe=0CktKkUU$43r# zRGvHJbhF31FYirwpqR2qegq*VbU||W3|L3+rK3RQLune0J)^l+u}_=tTHNS(T3NOQ zPkK=)=yCif_dy_+20bX5tzR94c|OwFg^kU;2*EvUgV%kHcbs4xWRR}IJfT!};8$hS z#$-Y;sjR}T!fzi{sgXcN zpTUlz46Iny3HpT*~0KjIPPf5e0d#Z^QekNZ;x%!fE?) z76(4*3v_0iNgH89J<(Qead8?A!> z0WmCZ#>xs9A%5o8d+n*C3JrY<^pd_;K=u+H0A_4AG)%PH326dMzIS}%zH>zBbksbT z*z71&y_N;C+z2t^wdTtcGfLpgOGjl9f>9mo{P9)io5fwz@LxItcRMA#IM;{ImN?np zPIpN-?MzzkLFpNfu}HQx7dE)uxN%HXk?y%+VtY~(cX$~uN7hdVHjAuLiLv1Re8Nl` zS5xJedy}2~PpY5h1*7^iF1}HD_&l|}w>ZmhZBnw`kCmgH9jDjvmrM4Z{f_%`v)|og zSAG`RSm`_$9+NrF23S2Wx<0dFRfkTNhy3q zb*V4keNm&tkUxNt>Cv|cO^+5Xg4-Jb^$?>CQ*%=RG!_h+_0?mzeFsJ_c*VlMu*-sVMG}vj#%7f%&BB7HnSKaUE05 z-b9}@LLz%H+$9g)7?&l{VdgxM-4n11tctoQs`N3hrx;bcFQ|LJNc-BuIom({48Oax z8tUdOzR)Bvw4y&+smR4$GAt3t*Tlgwx;@Dfk1*)ozRe>f(>!O2xh*zJYJ%ZBl|nEo zTQ~V2Dq|a&E0$~`(sH^l01Fpvg{ed>cSDgv+}2k044Ne=ABZ!no(wX9VuW@BhSTXJ?RZe~8K^_!q;YkZW#(GhPM~fVfztu|D=8N?e5!dJU^PINR5KdQyt7Z`4e2IfZR}m=I zXBr4)>=htdiC;)vLf*Xd+gqPDSo}E8;!KZyJK(Wc85t_Cv;TI>v0HFS{qct|)I1>uN5z zmAerJXjw-}hG$$7g`$E8tr?@`(9CMzNR^Et{@Dew{EiILEz_{|+MSO>VIw>JirEp1 zFGH2E72eIqt=4*=+_!Ul=N0GJB`U<=xWLR(vVDI52LzNzdP1P88|8xtd%)vl^AeMe zhIqvf5+9-($b&of+D!4YMS(H(3p0_pl4TTNcM5r&-_gz_)|Bh?1bkzNUXkEIJl1u- z%HK9#w<*28zPw2IK)W32hu?&L;hbW$K-TdMBo^=VmHd zn7R8+W4ahV&VxgU$ChxbPbn}%fDfX(wsp#$r8c%b`>5)7LQ|`$_pLJ!E4!p58F*El zPq*l?#pWcJ>X8Nx(Sz4uCa;^}o5AMJYJBnKJ05b)6F%OTJ0|^Mnq!AxDCQ;nHGYUN z<|r^uU*Qv=aj8Yi@OYDp=GIw>#KrLQ2}MMsgea|VV%?l=spYD@cVg?4e+S6IyE_1)D8sBGWhWaj9Y1nk$hCf91J1~mk;;)kOYR29v!`-}U< zp|3|~!W|K#URU6%h+B1zO2Q_edKTVz^1C~(o?1b>bT`)po99I_9N)j`6yeg*zP{4; z(P^M}1Hz9~S&byo`>np8mii#1Sf{u&n{I;{#^U$3QmQa2fn~NVVjS$nQfjt2z5OAh z`}k*BxUw2QS2XKP#RP(T~FzfO0vf zSpkw8=74q3tY`r?k8I3A@VS~9P#M+iefb}I_CFrVe^EdNutk6r?Mi)5 zqfzp|`=DVu)>wJ{w|! Date: Sat, 2 Mar 2024 19:28:45 +0100 Subject: [PATCH 02/10] Update Deployment to add new Configuration Version --- ...edeploy_ESI_ExchangeOnlineCollector_Automation.json | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json index 42785ee5707..7d267c83c96 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json @@ -12,6 +12,12 @@ "description": "Specifies the tenant name (don't put the GUID, only the name) that will be audited (Name of Azure AD Tenant where Automation Account is deployed)." } }, + "automationAccounts_ESI_DataCollector_tenantID": { + "type": "String", + "metadata": { + "description": "Specifies the tenant ID (Put the GUID only) that will be audited." + } + }, "automationAccounts_ESI_DataCollector_WorkspaceID": { "type": "String", "defaultValue": "" @@ -70,8 +76,8 @@ } }, "ingestionScriptUri": "https://aka.ms/ESI-ExchangeCollector-RawScript", - "InitialConfiguration":"\"{\\n \\\"SolutionMetadata\\\":\\n{\\n\\\"JSonVersion\\\":\\\"2.0\\\",\\n\\\"JsonUpdateDate\\\":\\\"06/10/2022\\\",\\n\\\"Description\\\":\\\"Configuration File for CollectExchSecIns script\\\",\\n\\\"VersionInformation\\\":{\\n\\\"2.0\\\":{\\n\\\"Tracking\\\":[\\\"Adding Instance information, Add-on config files and Internet configuration\\\"],\\n\\\"MigrationMessageFromLastVersion\\\":\\\"Compare old file with new file as a lot of things changes. Especially the AuditFunctions part that is exported to external Add-Ons files.\\\"\\n},\\n\\\"1.3\\\":{\\n\\\"Tracking\\\":[\\\"Adding feature to export Domain information in Sentinel Table\\\"],\\n\\\"MigrationMessageFromLastVersion\\\":\\\"Adding entry 'ExportDomainsInformation' in Output\\\"\\n},\\n\\\"1.2\\\":{\\n\\\"Tracking\\\":[\\\"Correcting PartConfPerm in AuditFunctions : Correct Expression to avoid null error.\\\"],\\n\\\"MigrationMessageFromLastVersion\\\":\\\"Replace all the section 'AuditFunctions' with the new one\\\"\\n},\\n\\\"1.1\\\":{\\n\\\"Tracking\\\":[\\\"Correcting multiple entries in AuditFunctions : ExchangeServers, ETS, EWP, LocalAdmins,POPIMAPServicesStatus,ExchVersion\\\"],\\n\\\"MigrationMessageFromLastVersion\\\":\\\"Replace all the section 'AuditFunctions' with the new one\\\"\\n}\\n}\\n},\\n\\\"Global\\\":{\\n \\\"ParallelTimeoutMinutes\\\":5,\\n \\\"MaxParallelRunningJobs\\\":8,\\n \\\"GlobalParallelProcessing\\\":\\\"false\\\",\\n \\\"PerServerParallelProcessing\\\":\\\"false\\\",\\n \\\"DefaultDurationTracking\\\":30,\\n\\\"ESIProcessingType\\\":\\\"Online\\\",\\n\\\"EnvironmentIdentification\\\":\\\"#EnvironmentIdentity#\\\"\\n },\\n \\\"Output\\\":{\\n \\\"DefaultOutputFile\\\":\\\"C:\\\\\\\\ExchSecIns\\\\\\\\data\\\\\\\\ExchSecIns.csv\\\",\\n\\\"ExportDomainsInformation\\\":\\\"True\\\"\\n },\\n\\\"Advanced\\\":{\\n\\\"ParralelWaitRunning\\\":10,\\n\\\"ParralelPingWaitRunning\\\":10,\\n\\\"OnlyExplicitActivation\\\":\\\"false\\\",\\n\\\"ExchangeServerBinPath\\\":\\\"c:\\\\\\\\Program Files\\\\\\\\Microsoft\\\\\\\\Exchange Server\\\\\\\\V15\\\\\\\\bin\\\",\\n\\\"BypassServerAvailabilityTest\\\": \\\"false\\\",\\n\\\"ExplicitExchangeServerList\\\": [],\\n\\\"FunctionsListInline\\\":\\\"false\\\",\\n\\\"FunctionsListWithoutInternet\\\":\\\"false\\\",\\n\\\"Beta\\\":\\\"false\\\"\\n},\\n\\\"LogCollection\\\":{\\n\\\"ActivateLogUpdloadToSentinel\\\":\\\"true\\\",\\n\\\"WorkspaceId\\\":\\\"#WorkspaceID#\\\",\\n\\\"WorkspaceKey\\\":\\\"#WorkspaceKey#\\\",\\n\\\"LogTypeName\\\":\\\"ESIExchangeOnlineConfig\\\",\\n\\\"TogetherMode\\\":\\\"false\\\"\\n},\\n\\\"MGGraphAPIConnection\\\":{\\n\\\"MGGraphAzureRMCertificate\\\":\\\"\\\",\\n\\\"MGGraphAzureRMAppId\\\":\\\"\\\"\\n},\\n\\\"InstanceConfiguration\\\":{\\n\\\"Default\\\":{\\n\\\"All\\\":\\\"true\\\",\\n\\\"Capabilities\\\":\\\"OP|OL|MGGRAPH|ADINFOS\\\"\\n},\\n\\\"IIS-IoCs\\\":{\\n\\\"All\\\":\\\"true\\\",\\n\\\"Category\\\":\\\"IIS-IoCs\\\",\\n\\\"Capabilities\\\":\\\"IIS\\\",\\n\\\"OutputName\\\":\\\"ESIIISIoCs\\\"\\n},\\n\\\"InstanceExample\\\":\\n{\\n\\\"SelectedAddons\\\":[\\\"Filename1\\\", \\\"Filename2\\\"],\\n\\\"FileteredAddons\\\":[\\\"Filename1\\\", \\\"Filename2\\\"]\\n}\\n},\\n\\\"AuditFunctionsFiles\\\":[\\n{\\n\\\"Filename\\\":\\\"FiletoIgnore\\\",\\n\\\"Deactivated\\\":\\\"false\\\"\\n}\\n],\\n\\\"AuditFunctionProtectedArea\\\":\\n{\\n\\\"ContentCheckSum\\\":\\\"\\\"\\n},\\n\\\"AuditFunctions\\\":[\\n]\\n}\"", - "DestinationConfiguration":"[replace(replace(replace(variables('InitialConfiguration'),'#WorkspaceKey#',parameters('automationAccounts_ESI_DataCollector_WorkspaceKey')),'#WorkspaceID#',parameters('automationAccounts_ESI_DataCollector_WorkspaceID')),'#EnvironmentIdentity#',parameters('automationAccounts_ESI_DataCollector_tenantName'))]" + "InitialConfiguration":"\"{\\n \\\"SolutionMetadata\\\": {\\n \\\"JSonVersion\\\":\\\"2.5\\\",\\n \\\"JsonUpdateDate\\\":\\\"19/02/2024\\\",\\n \\\"Description\\\":\\\"Configuration File for CollectExchSecIns script\\\",\\n \\\"VersionInformation\\\":{\\n \\\"2.5\\\":{\\n \\\"Tracking\\\":[\\\"Adding Multiple parameters: \\\",\\n \\\"- DeactivateUDSLogs to deactivate the log summary\\\",\\n \\\"- LogVerboseActivated, by default true. If set to false, the log will be less verbose\\\",\\n \\\"- UDSLogProcessor, to manage the log storage. The first entry is the default one, the second is the file storage and the third is the Azure Storage Account. The first activated entry is the default one. If no entry is activated, the default one will be used. If the default one is not activated, the first activated entry will be used.\\\",\\n \\\"- UpdateVersionCheckingDeactivated, to deactivate the version checking\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":[\\n \\\"Adding the parameters in Advanced part :\\\",\\n \\\" - DeactivateUDSLogs: false\\\",\\n \\\" - LogVerboseActivated: true\\\",\\n \\\" - UDSLogProcessor is a table of possibilities. Only 1 is mandatory but you can add multiple. Possibilities :\\\",\\n \\\" Output, default one :\\\",\\n \\\" {Activated:true/false, StorageType:Output}\\\",\\n \\\" File :\\\",\\n \\\" {Activated:true/false, StorageType:File, StoragePath:C:\\\\\\\\ExchSecIns\\\\\\\\data\\\\\\\\Logs, Prefix:ExchSecInsUDSLog, LogStorageRetentionDays: 30}\\\",\\n \\\" AzureStorageAccount :\\\",\\n \\\" With Managed Identity : {Activated:true/false, StorageType:AzureStorageAccount, StorageAccountName:exchsecinslogs, StorageBlobContainer:exchsecinslogs, ConnexionType:ManagedIdentity, Prefix:ExchSecInsUDSLog, TenantId:TENANTIDGUID}\\\",\\n \\\" With Certificate Auth : {Activated:true/false, StorageType:AzureStorageAccount, StorageAccountName:exchsecinslogs, StorageBlobContainer:exchsecinslogs, ConnexionType:Certificate, Prefix:ExchSecInsUDSLog, TenantId:TENANTIDGUID, ApplicationID:EntraIDApplicationGUID, CertificateThumbprint:CertificateThumbprint}\\\",\\n \\\" - UpdateVersionCheckingDeactivated: false\\\"\\n ]\\n },\\n \\\"2.4\\\":{\\n \\\"Tracking\\\":[\\\"Adding Parameter for Pagination Error Threshold\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Pagination Error Threshold information in Advanced part : 'PaginationErrorThreshold: 5' tag.\\\"\\n },\\n \\\"2.3\\\":{\\n \\\"Tracking\\\":[\\\"Adding Parameter for Max Packet size for Sentinel\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Max Size information in Advanced part : 'MaximalSentinelPacketSizeMb' tag.\\\"\\n },\\n \\\"2.2\\\":{\\n \\\"Tracking\\\":[\\\"Adding Proxy Information\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Proxy information in Advanced part : 'Useproxy' tag and 'ProxyUrl' tag.\\\"\\n },\\n \\\"2.1\\\":{\\n \\\"Tracking\\\":[\\\"Adding Beta feature\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Beta information in Advanced part.\\\"\\n },\\n \\\"2.0\\\":{\\n \\\"Tracking\\\":[\\\"Adding Instance information, Add-on config files and Internet configuration\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Compare old file with new file as a lot of things changes. Especially the AuditFunctions part that is exported to external Add-Ons files.\\\"\\n },\\n \\\"1.3\\\": {\\n \\\"Tracking\\\": [\\n \\\"Adding feature to export Domain information in Sentinel Table\\\"\\n ],\\n \\\"MigrationMessageFromLastVersion\\\": \\\"Adding entry 'ExportDomainsInformation' in Output\\\"\\n },\\n \\\"1.2\\\": {\\n \\\"Tracking\\\": [\\n \\\"Correcting PartConfPerm in AuditFunctions : Correct Expression to avoid null error.\\\"\\n ],\\n \\\"MigrationMessageFromLastVersion\\\": \\\"Replace all the section 'AuditFunctions' with the new one\\\"\\n },\\n \\\"1.1\\\": {\\n \\\"Tracking\\\": [\\n \\\"Correcting multiple entries in AuditFunctions : ExchangeServers, ETS, EWP, LocalAdmins,POPIMAPServicesStatus,ExchVersion\\\"\\n ],\\n \\\"MigrationMessageFromLastVersion\\\": \\\"Replace all the section 'AuditFunctions' with the new one\\\"\\n }\\n }\\n },\\n \\\"Global\\\": {\\n \\\"ParallelTimeoutMinutes\\\": 5,\\n \\\"MaxParallelRunningJobs\\\": 8,\\n \\\"GlobalParallelProcessing\\\": \\\"false\\\",\\n \\\"PerServerParallelProcessing\\\": \\\"false\\\",\\n \\\"DefaultDurationTracking\\\": 30,\\n \\\"ESIProcessingType\\\": \\\"Online\\\",\\n \\\"EnvironmentIdentification\\\": \\\"#EnvironmentIdentity#\\\"\\n },\\n \\\"Output\\\": {\\n \\\"DefaultOutputFile\\\": \\\"C:\\\\\\\\ExchSecIns\\\\\\\\data\\\\\\\\ExchSecIns.csv\\\",\\n \\\"ExportDomainsInformation\\\": \\\"True\\\"\\n },\\n \\\"Advanced\\\": {\\n \\\"ParralelWaitRunning\\\": 10,\\n \\\"ParralelPingWaitRunning\\\": 10,\\n \\\"OnlyExplicitActivation\\\": \\\"false\\\",\\n \\\"ExchangeServerBinPath\\\": \\\"c:\\\\\\\\Program Files\\\\\\\\Microsoft\\\\\\\\Exchange Server\\\\\\\\V15\\\\\\\\bin\\\",\\n \\\"BypassServerAvailabilityTest\\\": \\\"false\\\",\\n \\\"ExplicitExchangeServerList\\\": [],\\n \\\"FunctionsListInline\\\": \\\"false\\\",\\n \\\"FunctionsListWithoutInternet\\\": \\\"false\\\",\\n \\\"Beta\\\": \\\"false\\\",\\n \\\"Useproxy\\\" : \\\"false\\\",\\n \\\"ProxyUrl\\\" : \\\"http://proxy.dom.net:8080\\\",\\n \\\"MaximalSentinelPacketSizeMb\\\": 32,\\n \\\"PaginationErrorThreshold\\\": 5,\\n \\\"UpdateVersionCheckingDeactivated\\\":\\\"false\\\",\\n \\\"DeactivateUDSLogs\\\":\\\"false\\\",\\n \\\"LogVerboseActivated\\\":\\\"true\\\",\\n \\\"UDSLogProcessor\\\":[\\n {\\n \\\"Activated\\\":\\\"true\\\",\\n \\\"StorageType\\\":\\\"Output\\\"\\n },\\n {\\n \\\"Activated\\\":\\\"false\\\",\\n \\\"StorageType\\\":\\\"File\\\",\\n \\\"StoragePath\\\":\\\"C:\\\\\\\\ExchSecIns\\\\\\\\data\\\\\\\\Logs\\\",\\n \\\"Prefix\\\":\\\"ExchSecInsUDSLog\\\",\\n \\\"LogStorageRetentionDays\\\": 30\\n },\\n {\\n \\\"Activated\\\":\\\"false\\\",\\n \\\"StorageType\\\":\\\"AzureStorageAccount\\\",\\n \\\"StorageAccountName\\\":\\\"exchsecinslogs\\\",\\n \\\"StorageBlobContainer\\\":\\\"exchsecinslogs\\\",\\n \\\"ConnexionType\\\":\\\"ManagedIdentity\\\",\\n \\\"Prefix\\\":\\\"ExchSecInsUDSLog\\\",\\n \\\"TenantId\\\":\\\"#TenantID#\\\",\\n \\\"ApplicationID\\\":\\\"FakeApplicationID\\\",\\n \\\"CertificateThumbprint\\\":\\\"FakeCertThumbprint\\\"\\n }\\n ]\\n },\\n \\\"LogCollection\\\": {\\n \\\"ActivateLogUpdloadToSentinel\\\": \\\"true\\\",\\n \\\"WorkspaceId\\\": \\\"#WorkspaceID#\\\",\\n \\\"WorkspaceKey\\\": \\\"#WorkspaceKey#\\\",\\n \\\"LogTypeName\\\": \\\"ESIExchangeOnlineConfig\\\",\\n \\\"TogetherMode\\\": \\\"false\\\"\\n },\\n \\\"MGGraphAPIConnection\\\": {\\n \\\"MGGraphAzureRMCertificate\\\": \\\"\\\",\\n \\\"MGGraphAzureRMAppId\\\": \\\"\\\"\\n },\\n \\\"InstanceConfiguration\\\": {\\n \\\"Default\\\": {\\n \\\"All\\\": \\\"true\\\",\\n \\\"Capabilities\\\": \\\"OP|OL|MGGRAPH|ADINFOS\\\"\\n },\\n \\\"IIS-IoCs\\\": {\\n \\\"All\\\": \\\"true\\\",\\n \\\"Category\\\": \\\"IIS-IoCs\\\",\\n \\\"Capabilities\\\": \\\"IIS\\\",\\n \\\"OutputName\\\": \\\"ESIIISIoCs\\\"\\n },\\n \\\"ExchangeOnlineMessageTracking\\\":{\\n \\\"All\\\":\\\"true\\\",\\n \\\"Category\\\":\\\"OnlineMessageTracking\\\",\\n \\\"Capabilities\\\":\\\"OL\\\",\\n \\\"OutputName\\\":\\\"ExchangeOnlineMessageTracking\\\"\\n },\\n \\\"InstanceExample\\\": {\\n \\\"SelectedAddons\\\": [\\n \\\"Filename1\\\",\\n \\\"Filename2\\\"\\n ],\\n \\\"FileteredAddons\\\": [\\n \\\"Filename1\\\",\\n \\\"Filename2\\\"\\n ]\\n }\\n },\\n \\\"AuditFunctionsFiles\\\": [\\n {\\n \\\"Filename\\\": \\\"FiletoIgnore\\\",\\n \\\"Deactivated\\\": \\\"false\\\"\\n }\\n ],\\n \\\"AuditFunctionProtectedArea\\\": {\\n \\\"ContentCheckSum\\\": \\\"\\\"\\n },\\n \\\"AuditFunctions\\\": []\\n}\"", + "DestinationConfiguration":"[replace(replace(replace(replace(variables('InitialConfiguration'),'#WorkspaceKey#',parameters('automationAccounts_ESI_DataCollector_WorkspaceKey')),'#WorkspaceID#',parameters('automationAccounts_ESI_DataCollector_WorkspaceID')),'#EnvironmentIdentity#',parameters('automationAccounts_ESI_DataCollector_tenantName')),'#TenantID#',parameters('automationAccounts_ESI_DataCollector_tenantID'))]" }, "resources": [ { From 859b1f7e8d5c38e0d96ec581ccc722c2da08acba Mon Sep 17 00:00:00 2001 From: nlepagnez Date: Sat, 2 Mar 2024 21:52:07 +0100 Subject: [PATCH 03/10] Update data connector for update procedure --- .../ESI-ExchangeOnlineCollector.json | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json index dfd6d612095..971bc021e0f 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json @@ -69,6 +69,19 @@ ] }, "instructionSteps": [ + { + "description": ">**NOTE - UPDATE**", + "instructions": [ + { + "parameters": { + "text": "

NOTE - UPDATE:

We recommend to Update the Collector to Version 7.6.0.0 or highier.
The Collector Script Update procedure could be found here : ESI Online Collector Update", + "visible": true, + "inline": false + }, + "type": "InfoMessage" + } + ] + }, { "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected. Follow the steps for each Parser to create the Kusto Functions alias : [**ExchangeConfiguration**](https://aka.ms/sentinel-ESI-ExchangeConfiguration-Online-parser) and [**ExchangeEnvironmentList**](https://aka.ms/sentinel-ESI-ExchangeEnvironmentList-Online-parser) \n\n**STEP 1 - Parsers deployment**", "instructions": [ From 44b7e9fbcd08866ffcb96bb3b925768ffd959379 Mon Sep 17 00:00:00 2001 From: nlepagnez Date: Sat, 2 Mar 2024 22:49:55 +0100 Subject: [PATCH 04/10] Compil Solution Package --- .../Package/3.1.2.zip | Bin 0 -> 70658 bytes .../Package/createUiDefinition.json | 4 +- .../Package/mainTemplate.json | 178 +++-- .../Package/testParameters.json | 72 ++ ...crosoftExchangeSecurityExchangeOnline.json | 15 +- .../Package/3.1.1.zip | Bin 0 -> 43588 bytes .../Package/createUiDefinition.json | 36 +- .../Package/mainTemplate.json | 734 +++++++++++++++++- .../Package/testParameters.json | 64 ++ .../Parsers/MESCompareDataMRA.yaml | 14 +- .../Watchlists/ExchOnlineVIP.csv | 2 + .../{ExchangeVIP.json => ExchOnlineVIP.json} | 8 +- .../Watchlists/ExchangeVIP.csv | 2 - 13 files changed, 989 insertions(+), 140 deletions(-) create mode 100644 Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/3.1.2.zip create mode 100644 Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/testParameters.json create mode 100644 Solutions/Microsoft Exchange Security - Exchange Online/Package/3.1.1.zip create mode 100644 Solutions/Microsoft Exchange Security - Exchange Online/Package/testParameters.json create mode 100644 Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchOnlineVIP.csv rename Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/{ExchangeVIP.json => ExchOnlineVIP.json} (64%) delete mode 100644 Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchangeVIP.csv diff --git a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/3.1.2.zip b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/3.1.2.zip new file mode 100644 index 0000000000000000000000000000000000000000..5b54b6ae3161a7fedc158a65a2cc094ae0825a04 GIT binary patch literal 70658 zcmZshQ*b80wzgy2o?v3z#>BR5+qRR5zS#USv2EM7ZD;=3`_wsC|4nyQcVBc>uUhYV z`&o)I;1C!fARsUxjJ3v^F=~?G z9PGDr>>TjhP`~x_{{|`QXu>@vzdGBYvU$v|U9(%x<22uVk{}^1GLYA8>s=@5j*YVm zeMG;dkd>dLyF>teHr(1+?=J|io4)gS|&*>I-J_NfRFCQNd zSsrSKQ_sB07LzuJeizId<5VQ{k?{&zH(nc?-J0!7JlqE;M+OZB0sog%&lTlPxy0pGf`ta{-r?$Jes`O zBgIu`28M*C=3HT@BFA9VhagwD1R%;3q92U(SIv?v?#fHZ4Swd(C9ol-E@$8~;FYB( zP%Sij%I@iPNy|Nr-|L>!Y$%3OVbzGV6;(E-Vs?_o{3KXTExEj8(%hD`R2rUw)x;~= z5dIlI6=QT7KHTN&^GxtE@^JOk^d>$u3qPIZrXyEpo+BBKL zRtj@=bduj{ZYurG7Z5Jd(Z`<#Z^unVBMlQqh4|3;qSeiC;HuXsS_}tcoC|vlFgYMi zOAD%O;8z|IaY4JQn%v!9W`X{YR{s%94MtsCe#bDKRt_*ysa75a+{KWSvPzo$SrQo* zBVjN;MMN4lpPD_J_0Xbotrsb+x-z09&9s0sPpkcT>Vlws%mofm4b}EX+R7dx#b%Ph zs>W&NNST3ReX?>ZQtn&C7zyI5@^B&t)rOp>Z&40@C*(Om;z-^U(Qbov77)*+wfhy7 zac8Rf9s=4-aaiWb0>U49b;G<$312mU_tS+Q;gw7`YJ{1aDz|q*7RMN6m|77|-(756 z^8xIrH{x=uV$!&Y?a~lbrd2O8&<>T`FG(w?*M?Om9SdFUqsrEq?bd`6)A<1Byyvfg741}l85 zMPE>^TD!>l$Z<)I@xJ&`$h;B4C@VXJBhI^*u7Pi59$j~OR8H`ekHqcij@ z6ntj|`G;r{In93cez4(;(glMD@t;IyPpsILfF#o>|6~CjI1Y5f*JUsHN3Hyx>8D_O zT=l3z;jIxUm7Fj(=VX`!5{|@c&PSc*ll%z}W zNOZ?Qz)5y`4=(PkhNLA^^^OXoT4|by;@xc%S5 za3FHITV#n9PPLU`+e?fpc#tGdU3PAu7`JeWA^Cij zb-m=2mIs7N+Ha(o{z18L>*nXOvZf%G;4Q;6@>5K(x6H0hjQ!vZV&7a0?1oz5q^dig z*eVOO&HZ+|eOyCA*=+8>l(Oq+?c9U9uE5B?b2O;({b49);@VG1+P8PLo=7>%q9Ju@ z_{w~R9QuqXV=y0#qaKUuPH&dX(&X_y7{Dm@xK;NQTwUxK?||8C70}qKtQ3f+KyCKBFS678PIT!0RaPe7sqCa8;PBUur}cs-+pGIh*Xt?pl$ zeQlxIv#tj0n~<~20xoy&G7o9Pyg6*8aykR-OhquA^|EY#^X%=c58Iob#EfWE9h<+q z_AhGBj()#io@U(<*>ap}YM+E;-%r-25>LZzYKX4UFvr-EG>t2o>Mh{cYhbAe$X?b~ zqJ!Uu6vvSkx*Pydn5oYo8m@sLUj{}*>E)QQ5I6ENkPS$T%f$8?hx@ zIgdA}X8dC!oUT4-Ac=dWce99VyV&-Zs!V>;WP|gDYyL1H=tH*0S<$3&-piDO8)wxm z7%&VAy&TX&#iMJaoBNXwp!fQXNs~bg8%#RZIZ71|l7y;W)LSH~jD!_R5oZoHP%N>U zV=NxJ5*9UyL5{i{r3c>pK^UR={^y6)z2b{gr*7WsdH~jg79`VXv-jfe6g+3uVLQSh3{*h@j*JjV3`YpAZNv~ zn@EH(mk^GctUJdrE8*D3g_0){PPWXiW741N)W2j8>2x3(shFhV;DUZU-t}}~D15jv zAWRl`cY?cv8~n zGEVJ4(06xJ2~lKx_)v8rm`dJ`sfOoFNKx`6-vo=^9L|jII|!V_XS&)(w0e2KQzn$2G*_vV$?_g%ee1&& z*V7PDvr(86*Lx5`7h3w|QVw(&(^wUj7*(1^Q-DUX5ow1^To0yf@J#B(F3?t?cXsiy z%7%$a$EPCFCZ1PJ0*xaXl96sTWWXNBG==Y^5XM3tYwuSg8-1j5fY!P_TNJm&0aR+r z%Yd`AH09ga2qoC^8t?(H66b2`HhP!3bmV-f)58VAm$C&im-4-v+e@3@oj}+qt0tgf z8<~vN=lyHzPd5Ps09?goi~d8>WYw>*F($;X_~iY0j(kMoD$o!JR)(o+1g{B+QC0@e zJ{DJJ9K~vEw1nSVtiZ^V7ueG2N|1PPACH&(TJ*u)eRUJOAcU`b;Pu;pwq6O=uRg@_ z-K~yHJ)hL<@Ncw9hBOL=*Kw;A0!P{XS_GK5_(cv)Omj6|88wLCCP`S%M*V4+Nbo2o zc~+d9ow4CueQ0uuCZ+kscy3#F-Mn0!47pyX8VUv?d|+-(S8Rn8VB!Z;MOJ|6$1WqN zxtaGuEVOxN!lXa*LctXK@2k=>F8*ZTzHGaif}6Gd%3BE5HMOxi9S%B1R(i2p)&2AG zd(D_>(e;1B;A9?3D=6d6z$Wg&P{>BA`d3nANZTzj(jM_y0nl_=i}Rm7j9G*I#&Q@k zr<<8UG8R1o{J5oa$SnR|k^1zws@dPWe+DB~{?^pp@J9X>n4p6R*>(iTEDB6QLqn1=s(nc@i%?9)cK+7=_#vN;3qxU4FlZdgH4FtZOv zAlMx&916+O*-^G5jegxAw(CggQ$=peT6;{)gddV8oZYz`v~qc)CnI3cWtfMsT@f{a zQ~N|dQnIeN1^1?ZLmJoLa8|zw$N!pgOFFvda-obFn+q9Hi66Ojv5)eIM6IFL0*GhAeaEGjZ zGSj!mxjqcEudUCP(Ob?p%8mT(Cx5npTg!p6oDeok``H?8Urh3wLC=5%0bQ$+M$1EE zw7fXTu_phNi9T5XwqekL$%7cN-66K@3?2r%(XZqOOe-0pJ1)Y8R|8zTd-w&>HK^iz ziNg%oK_M<#{Q@g_k)l;54%uU18-DzRd4*o6$ zSLHi6!;9~i+lM}+8EoUx@%bv+ZxE=>6<8H8fVf{2w4cVCIOtZ7`*!rvwPpRcNc{J7KkATY6P_ zudcsorLhEHykd+XCCN%ftDvCf)nji`aMa)H-1JID55n*J5O>xFh`V|;i-QFT5tE`s z!UP6n^7629>LHG+L4?1XDRp@Dn`HOmE!Nz9C zDu(dg3w=AP8|smppti%6b_2Qn^CuK6)+bzH~J$d?~_N)9W%NZZdvBOEyyF;=fJ+3B z+m?QJZJyRDtD@I}O?VuGmBqE_OJadGb(nU-M9Eah*`axx+Czade*sX#^8zJ>CBGk< zP6t~%AFxz50!xQ!tv@Z_n~#JW{$8Tq(~`&Ihb}gv(!kzOz0E++{Kc4*i@`&i`uh{v zBi`*-cHruw$92I()XkLU(+XphbuG!=_wT=VW!d9wqt=gdX!RUz0w6Ua5m`Aek7;!Y zzqnj}3puA`X9eQ)CSkOJt-+5_CWVctSnnC+*blO25x#XdG`Xn=Jg+9gOQg-%rG|f2 zT_&^!QvLqDvQ6)Gmbox8TL+dQbFL!i&LBKWkS_1!4UWff943nEvt8C5l%FMM6h7Hq zN^yGu$&|)ga{JK-do%i>!Kg4!UX3TUEiFPkFfN=D?_9gCq_4aHjq7bSps3GaOBt%= zwGE1-!7IeUa*uX+NQ80wfMnOWUQnTS#NXv{I=~t?g;3p5fgb8NP?v=$hjg0!{(@BA z$(ef*s^27Dy`Jdro)f@es8mg8$NXOKj6bRGn)Cu%;LZZ9FGL zW(O+!I7%-qD!^&V8xs8u9)z}vKYgW_5d?lC^26s*g0i=t`))JJ#mD|-ZPOqZ-#L-_ z%G-Tr^4F3=Va|5av-AyY8-#vq?W@l>ET_-Kvo?t62yvM<0|y$!7XrJ}`8GW7@#gkp zksxn0xA)EQqQ!AEH$S#ZZBgv+`~~uMt0MhCy9IJQj4>@ZF$7wOB19U8+eyRmQbk;= zXiHKL+H@D|0!K&5euzn2y_N6#D6{w#whtO}Nf>hXV-d$L||0ZACpOH06htOf92C|u? znLow-YyXf6mJ{D2cxn3jd_|M~z`x3j{>(2NrG$kzL@xhp|B0`9J_77d_*6qgL~b?z zvjo~lk^~Q>a8Or{UZI{fx*~75t&(-~5nYTJTFu~2&}N}^bL^k|=2FY~b6*Fy{31rT zhcgz7TTPT1g|j8P9p(8oPYcL8YLXM3DPls{txxwFtFfEimwuQXJ!-}(FRsmpdoY+- z)6XfQa{VilWr`C#$D!Vv$~eo2Xak`tN!lcf^=12xAKP!O#^^ya$SK?)*@>noeToP3 z?9LSUTc`)_0fGDB5{r38(IWR!AbQmzWkjIJ`Vj2d%f;Qx`B$~VztB@P1k9xy0;H+T z8l;AtYO>|nQmSf)CF>>nya&&V_bAqc-yimAbB0|jC45U%ekN{?Y#xmB#!owKasJ82 z(4nb|8aan;;E$7;G)%9_8`}58!3JyqGDbM?*Id69S>9iFaXIGvX~oa93L3vEi>nQ1 zQiJN6g6Y2pTI;(0R{aava|={Dvm;7!VrIsul@K^EmQf6pKOHRKw3)6LS|&{;CW=x# z-H}>qDm=*>z*xMJdDM;g6Be7_Q)lT$%RqXoWc(NayPZfez%63{=o`IIfE}k1gV4L) z$paj$G8l}n8mk&m)+bE6Kd(irL0U=Eh&bxZ{He14R1Q`X59h^B^tAZeIC>78Dl3xq zeHTX<%k<@;Ia*Mn&WoqHJF~QVb5)%#lVSmok{^8;OE-M_zJIi0@<*IO>q~Eg3EJ<&G9Y38yPz9(5fpP{f%=a(cZq-G)z1Oa4v)&m zA3FkPRD3Z_cBPz3OA@F%>Sl7|%I?53PIHsgkI+^}s-@vU-b<$N18`Z}`*}J(Dw927 zH!O2C$%?T39~)Yq83tkjk6ve_yE-3 zTp?jqafMLuoOSjZll`f~s^k6I(=ZBfq?uOlg@;|*wd47xHU>(1eweCHOjRf1`yTBU zO0*4>p6LLQ-`Pu0zwu=86)GpKBXgPZA&o-xoQKm^95Bo|H)(%!2F#=@klyG1iCdc`-3E3$ z<^&M<8`Qq&0nD3WJwF_atIWswYmvl|qK9nFQ*kNIzsH0wzRcj-Z)I=JM**7gM{Zv# z3>M~L$nzY+gU!F2qO86YWjo`Wa>K_E;~UvQm~MgGkWtA+V)9H?=2D`JrT`&~fm^W0 z)YEM&K|=!@B5ism!ITD7Z9UXzGOwzEw5LDT6B!f$Sk5^Jwntq&`lU%EtX>~aUj9ZA z1Cq9k^K%w6pL%pDrzo(1r;s5F3?eEq$wxQ=(!*rt(XMwhSUC8(9!vOi&oBsbmwNwZ zGEw|ab&`KIewzM(aSrqoJ7GKV&SY@`^`c!Jv`A@? z*@DQy&&B^G0n*Vu%{z(ww_2Sc8XHWQEJ^phh|9QImjZqCFW>qPGdpIaA+w7C-eIXP z{IK@%DJn}r4)Ex5L6)j`=J9|i6Y5LsTn%o4aL5N`)WbM!Y##hI$G?+jH}FY;2&8zo zO0pWFq3I8Ai>TiAauEVQ|Axfck5)v)2=s*wj}%J^Murw5{Th`JIjcU&cxgP7NY%7x z4j{}GLPt=kK3RQks_QBc21)+)$G28a>1!Fc+>&miKT_k2M%sCdV_hN`X3PPgomXgLxUKml?QqY8`RWt=^q1hI%F{CfX<}-u23*as9u)}$XN2dOlPMg% zW(-M6NB&K{ums@n@_48?68}6uVt5T+%~owayIcr~Ihc0Go_S>^RMAxMgK9`M$>Ds; zNJufIAza`&D?V)JW_~U-rE^u^NUlPak5egA8Kb&|6#Fe+Dfs!s+9(<0B_UIx5Zhsa zb^V=3E$lr9@@4fW^FNa02PI1bv&w3y#sH%bs!Al!IU$qe<-nujaw&Vq*= zfK8?MMF3{U)feUn+C_}+f;S8FUK_VHk@s8ODAb@H8S1x|QdkSSMaCR6_|u4fJd<=q z%Uc5XCL;QG5%yT+;V#-A3AHmJ-8_F{7Zej?j^;U<1P%j|%c}dE=8oEyKy$lO!Y%LH zW$$&dyPO5KGA_#9>6FnD)UteZSg)c~u1r;Jss=E&aVgI5s`k(??`Q$m}G+`-Ao5TCQuGY8Su!|Caa^ta|G z8_fqyl_8x-{IL{`4cYaXK?{1#v~S+Cxdb=s#I2gt$5j0Lxkj5w_k4-Y@-`hHWu zjTCRt9q@pbr|*fp*wb0GV8!{a!sWK00J3pCcH#0S@Q$v3Sd;JNqHc00viSvhkTa1u zjSt9=YWuYJ`MBz+YQWyu*sREgsfj`%2TkIH74#IE9W#8O6eKZ7y21WK-UK#I%?vIg zI0LAgBijLo_e7SBfQV!>fxo^Tws1lLWiB(+LC0BrZoc0eMq0CT_;qRM&*H;6o7~Uo zaQdroN%-{A2Nf&?xvUpy;Y^Q;H*8+CzUFzn8VJVpNdO%s5@Y(X!h0TFE1EQ60CnH7 zFDBcY(%uF_2y(sw_8fp=XjMlzj#4@8rbLbVGtDypi-`M)XtM%Z2D3gC=XDT(WvvfM z)i&fBYGTPGJg&l7JEJ{ zmd{EPR15Q5y&5-Q4ZD7tv>6nqa9v;nU-TH?vSb+iZvPC%mPx&k#zgQwq^f8cA}l&&vTVMT{R9DNMHzQYl;D<=>Vv zNb!F&$#gkhlnNEofnj*`CONRY`Xj<1nJ2Q6$iu{77zFvE?4$5cO8U>3z2WMvCbPEx z&K;M|P|K?*S0%NgpC-V^J)mxr70-Kl_4Tg<#DYuW0nH!Gw)n9;?Orf zt{TiY?;#&{>%_=hzf;Dw7tc_uSXeDikcM28N&2pQrh97!Tpvd^LdslYc*7s%(z;wh zx%o-SZ89*vEYmjlS5?K=jQOSjRKM`=kCi8gRg4@<%OP{{?T^C7TqBU=70hWbx}tQ- zi&Bn~=_sqK&KuBD;UM~zZAuFZ$s=k^BRkplL(5f%iDH`DdcQuRGJU(9D4>iOmgzba zi*+=9V5c>Tdk#DImE`HU-H5(y{+ztOJpXxYRZcpzRfZP1Ia`bP_T0?0+}sjo{&rj) zb(BFxgZMs-#+z!G(Yd!u^~$=~P0nOR+Ib^E#>UEHoYjqGoSrjoy( zsSkbx(`6DXb{Eihl4e$hNfN=1XVwz>^aUwLJ88slf3||qHPCh^&X9QooObhfoQ6YO z*Nmw(SSpV339*NO8Im0k)NkrF3S+`WI2xdU$f}oL&;5K&Jz|5Le?PXm-5sd32>>lD zdJD|Fl~(Iu)K@2m0Y`z@{S4zKFJq>_z&A!st!(}_Pqh{9WyH;Y!RpFCePX(%gt-xDX{vex1agqsU1Tdi2S)^HJn^iGB&9tbCq$n!!$(CqxY61 z{DzYww_}7{xKrb+d3#n>VYQI+mkfz*d^*FeVacRYl_ujawPhGjvd!{r)=P#npGTOv zuNhQ)n7Wu{dk8(}sD<+3R>FNms-gM7W$Bpbnc~XA6jT z9FjrcS<8xyA9cT_p7=5f)E60%hdI4^$p^eiiTxTJAG#Ezbr)oah&}=4M6H6mClTFB z$fjjin$rrY(%4Qu$eg9|_ps@Ncv^MpF)|=Z%|*gYh3_b`TEC-s-Y=&XhAU(9O3@yc zR~XA4g%xyyeoh8PQQXIw1N&^3ax2~&8kLuU?1OkARjfd5It?ezxCMcdmeME9U1Ec| z=XbGFHG8mnITogE%?*kJhL82Q6?C8T*nHlF6UCuEPwZRfnBoaP^tZJp;p$&eHMKLl z2N>6#r|&SE*^y7;cGFFeFc`c#Sxft|^*^hq%c57OZl5fDczuNXrTNaFG_<>OCn`uR zx^Ld}?yJr^EOE#hU9i)wl9ppA*H*oOD1E*-y6)#w6V4J2^b~{jjY0VE5}jEpFZawK zX!`Rg3sm<=U&rY@q$4u;k&@|{mMd`O>7-rpL6Km!21N<}jz!La?v40R?m`HnJO|#J zS#0&XG;No8zz2%xS}@4E#mw>Y(>J2A2_ZXu)18$=^asg#T z8Q&Da3V_~xJt!}RnjIYPDom>ZiK5o+w%Fg;l5h~F1&bpGgsOPLU|Mxo=V2kGr-X>m zb4{|tPE4c2El5qzv}it)_-x)YEMB_l4~?_2=<|{;*c{l1!{~m@W=kUkUjR%?Wag=mOcU@z_24=WDwB2bl;+8tYzX?cJtyfgf!jGR?a@#i_Zoe^mMI+i` zJImrc0baXP^oG4=vSn!#GwnN(z3=xp$v7?S7V6SDkmbA}*OVORt{Fq9y4lG<-+D&%OG}&DW*N^ou5Srfoj$Fq74q-Jpr72wwkv(~ z1qw1wG7OoDy`$r|b$NAqvteHf5c1Sp16_) z=8>J}pC0+dwtU7_bh-VA>$`fpWA~&CkF}2-Ea6di1O$PbtH)3S8t|+}kefiZkjL&S zjPJ++iyu3?hHFEZlylgmLO~0}z~Tb@vm-e4=n^ao@e2*hA4-?rO0Q!C8tsr(U?r8D8Gv0n{PoFDzQ5-f& z&-Snr{fI;wD8*Um=W>wk3EwZCRrV zOenwoMx2Xj`0@$t5)Kjyed{~KwD5bhR1T8Ta#i&SO`1w`y3{@OP_0y+D#e$hROux9 z7fH9YR5<0FX27%kVtO%NS&#Y}7X6kKdYD!asiw7@oGPB2vMS9>NQv)Nz_TwE`v5!E zN2VnEUQqcWDHm4B&%zj^w|4_6P>GVt<O3I!LQoKAz;PGTc!RRoKW_6?7To3zvn;8YGkxaBKH!3Z`3Q zK#nK=z0#}-Pc4gS^tEE2nKU_X|M#h*WQme~D7u~$`>Fd0mi{GA9d%v2+2=9kV{R0t)0VPE`e7vI{Zm!! zPq)2IP0nsRl|`@Uc5_DQE;6n!__9ATl$sH?x!$rr?gef;toI0|QI~r)0iGySQ3JcY z{&hCS45fQ%#mutK&_za*H^Xx`jT-UdX1HB*+F4K1S>Dq!SAa@E8CtU`ZBZa|E6+gX zkTYfxp;4B%KJ$|<0}spICqxbo0@SbLl|9(KwT=0CBZG4jSVFsP_pFxc^l?YpexP&? zX8GWM65-bI&qXH*)x>UB`TlQ2FVT?RQ1Nd#!SGQ5z$%knzO;S+IFC)?DUBkGOm#)H zbdgky^pSt9s%}#r>n{@ag&p}nBCOw$;}VjB5!tbfqMxQUwKT8%Yn%H{n~$A+4e)t| zd7y%2cps;Lt2q#tk>7dn*grZ-Oposv^?QsW=KfWUd+Ks54`74gIZ(T;Q66Tzs&h{`%c^MHfNpyz>XsWfNq6 z(<4TSBu=1WvyYGyayX3kswX|38Md_S%tKGvNpKi_Bce!JJJh{yP-)0ld>$)gpVq83 z$q_jWpcv1uW3K;e#xxyi_>p}Z&u&zRsLq#9Vt3|>90}3U9Cc3}pCp~J`V!v)Q<}6q zt&&LN6OMe32HXRT?FvWO=U+!9A2eU{DQLnp@0!QDSpz38O#vtkU4+o0)3&N*v8^AK zJ52f!R(w+Xt@QT`g8Hmek?BI6t?n({HhLX@Asa!y!GSrrUqS7oI)N+9lU$b8c>N1g z$b_E@y*<2~I!akK*h83#;Yb0G!HH9S%x|-M39-C)K$nH3s$7H9)NHTE%o|YtznjPG zhYkaEMbfcntH4^G%d()V=*s@?x!F4Kfxp@zbPy*dPDpQ#iS!7_GDLPlYL&si12(EWc)n zK7TmdF6J%erQxoJDx?|`g9V5)ixXWM&p6Elw#4WTPHWiJW`1|Z2N6rXkw8WQfo$66 z32i)qULyTBvs+1S35IapY*{G3O0SC;k3lf}P?I7X{86ps`F#mcsJwDizPa-dPO@9b zG)kCZ=fv3?OVFahQJ|*&u~gIw-));w*FUwMyAQJ|q(xbvknECby`mHHa2EWfTIZ9J z|9-e3XN>ISs{+9kz)yr5qEHWBZW>&p0rqBArx%rC@-YLaZex6+!#I|;vCn5FZ|V#^ zTIcn)HGdVq5-PVebl4d)Jr;9u0l(AnG=0C@RHwxbS;^|ji3#=)JgM-k;8%IFuqpv+ z*+jBKX;^4BY5p-b=aBzs&nX+{L2T-xPuTAza(v2lb?$E=O|g~}vvV&#;{ z>7ak^goj{1hHu`aIQaY=F<2_oX^*Bba77g0x4Ju}8k&=F^;tReBlRGfe{!twPmWdpE60Uf^SM-2iq@z^GNRv+ z(msVi2`hz^CF*}Z^xuY!tP>q#MZB5Sa@6?vKX)p#7h>kOkfX4Cgro59sJj-4PV)*v z2lN$a{WAzIW86#sPzeb&9%{kbExvWiGl*7aBbJ($7TgcI3mYZ+B)b<49-(C-^a;A1 zQ)XsYHx>m8AE8Sb0+ipG*T3>n$UdxRA_&DE)^ZVSG7;c^=D&K=0#+mr@j+IP7e{2W zR16%V3^>XJ$j=NsIQV1t(vE1ThCKb^vQRf*=@Qf??HUdAL|Z%7SdB@}RB< z7Ir^|vw0Q3UURtp@mi6ORr>h<{n6zD6b2lzx51wnZ%$n+dt)@`E4@7hTW&QV1OyE@ zCt_wxFDRt5{^+RE3{=B3(734^DyRu{VVt?iu1xv3{oXJz%`F%s5xKQY;<|RI^)nM- zX&QD($d>Em#@@5d2WXm_)Pl}i?Ju(%2yhbM*KP3P5XGMz_Tt>=bPQXH(3{v^$0IKA z;Oxc>6nLeS#c>Q$3ki%1J8-s;YN`S`uPsp{q+DzsuH2KXl|aB9+Nt8B?DOY`Dh(@w zlz`NJHha8#WKn((5n01MDuND3&QAK1bJS{)jf01SSyNaHk9vV_ryxj}7lj-{?enT# zZv7oY8E-=wQ!{_ri_h8*Ao_xjowc@Mro=r@-cq5;vDSF9v+tOmsP2fPY~WbQ@51Jy zbEwqoSYNt)pqnZB;?W8)ggJWaKg3PGw)$pQ32{68Or~9ISu-W)eQWtvSO%snVYe>J zuX%O0;;}T7=qhh7UBxe^D;Ojt%4AB-QS6}}D$wn>v$_Y|WwUY;n1gs*K7bL^SSeWu zKaFmM2tTdWpVXXMo~!JoMoSNkWp?#EE^34+H6xq0Uj zBEdoHC6GiLOffl{r4#ExrIuW^OD|lXDm-v56mGTb9fsPKNnEtbDHnpX3MkpP-lo|Z ze0f~JG7oyz6Lk|wOI24-IO3^94;!GgfZi;N@*K*p<~$1+5|>tprqXPFYV-zb12ys; z>DDS=W#;B*svwAlek=}W3Xs0!7oW*f+tHAN9}pH3%MK;|lh)CUF6*iH+1nB@UnTxI z&>TOW-4B*0=g)<~UMpmIZC8=XogVJ&x+RTOqwL7u%1|2GgR09Aq3m(n$JVKVIcA`X zOHTC_h7w~w(u?XHg)5q4E8dVhwbYk|SG$Brq8s1Xli3-xTAb^@Y-Pov81QY6sSvfu zIX2pk2RJP`=xUIqr$W~Yi&~~Q;H4*nQURb(>3>)8{xzAT(?2Ywzi3);Pk61d=r{W^ z_SjY(acN-wkt9XfKw4!Z4#ry?o+X0ku=vR>Vbmoa_)SlU##p-2dc z03|`ii!mv9fsmLK6KMzaAEb6ARI(K{o68+m5nLA8!z!9qFz9qMSLZ%)tmjG$mSy@W z8SRQkK^o70gC3&+2lX?^_X37tNY|IcSnfu=x7_FEH8)1;BkJv+^t^2eV)Z()4e;hY zYk_cryGVcBz}?L5TTux#mAm9&mThGy6Vqz6@WECD6e*fa20rA?+1o;4DESPQW`lmm z@PUX%-`JWozP{q5Ey%Dd`e&eztV!9jjBhd1;^N_onH*@!r{fcpLhy(f@GT^U9|k1O zA#y(%HaX9cw zLF0YK9N@es9^=jsW6VIyJWi9dU>&$(^j3XIi-+5!rPWIQIA=>#jTM|+>qlEliwEa8 z5>qhG<~>sux41deCW9wKxKL?4sh9i}1);VOLL+rFCd?}Y`Qo|ZkrbkjE^fV9HrZ!; zDJLI9)3EpCN-xvQhgjW05_q-WaXsJ1v!)jbcvT*;i@{*gl(@E4d5RCS@a)sd9$-kIyx=%!_*Ok1;F9L;=|1gQ{+FjXfd(!mL8V zkQ}-FcpN#(YUFxkgzZv6T1(ki5FQkX@yn!#?QX(&- z5i&FiC0g()T)9c0ilvK>dMpq5?cC2;1yEolzogn{Sx%=GCFj?NXUk8x#IL#MVoLW^==CinS2a+ZjuMnSMz(WA zmNCaO!iphZa*&9B11EANYTz9)#1Fx1i1|&E-2e6+&Yi70!_F0GunnQ-bra-JfDf(x z@9Rn5K0f;F=*fn>0v%X$09GDq{0JdozC-zz8gevg!$ zk~J}7ZB&ZqM=P)?3~@Vl4n2MzZqLR(S-c}Sd#N73BT>*w=dy6LV9OO8T`d2L!V>?3 z!b(`YjC2!xXIR!V5DqZWWWixZ2nAw7U?RC8Wzu?u3LDqbpC_GC2dsTMUWxG5qzU{3 zqb9>mZud+zr7)E(8ixKz!`U9)=Uldf8B#JN zI*UU6A%^+X3h}A>v)_dI_)7&Nea_N0C+(`@6P389{WD1$UM#I1rY@uWUTsrilm6E6MAO4J zD5*-2iU-35J!n7Gi2x?Xa4R|o1IUsONi;^dT6{>bM4ct~p? zI207P%HI`c5wt){8BN(yMjL65Vyr>Ni@qP4f7wRyB7Axa!betgQtxT~Oud)$n1W%f zDt}jwfdVO0qBUDd%M*>Bs=LEPD=^H^U#Rge#8TJ%CB!)wQ|J`Ua8WCyDjg9l-l6an ztal=Il{E?9dPB&%j+uHeX;>zI2DcpZXRntKD`duD=Ubga<1E>sLagLCH0r; zu$XI~N)uQ!e+sdiFuR{mDXrPFiOb^LZbkR1rBlwLD6{92rmE6)gUWYc$#lG>%YI~t z0>sHjN()k>3q@jZ#Xb8DF^k5z<*J3;X_*L^so|3-sd#=yZ_Wncn%^-fH$MBunQk3M zU4LykfhJ5BS#2g=ligA2X1HHtf9~~XXgl$(JIfb~In#!oj*L$5pz(f+kskeg^;9v}xTb^2THDp8dVEw1En4wzcXCNBEZW zsl!j6HisJ*?{8Au`qV(CTZ$GU-(0tas-*KN!Zl3;*8c&XlW1_(LGcoker?qt9oFSs zzo>)nS<%%+$G{$;ZIk#EuA%aq|H&=g;4pInZ?Q)9?OfFWmR1c<1oE&dUoT3W<{HVV zUEPP@?7@cm;AxPEnQV0QkzCb@DHp_dgfyb-Glt&a;SRQCR<^>3ZGMR`-3qeix+*2+ z$9*@jG#jLDgRG^c0aKtS1S#ZiYx3QbvOFyJgWt?evVq)=I5=9t-V551-1TS8{R(a3#qDi3@r!E#ooy$fVhN`>nix1tk z!f09po`ga2^=Wuc{W=AX@_45|rM3Fm_Ju`(u5~W2HA#mDaqJGYpcHx$ zC9Cw!eexERM-^%nJEL7r#oM7h8`bI=?0p(iV?TBs)R`tV)u{|(8us`8`S50Sly$tu zf@+S&5^4PPoOHCVX0RBHR7; zz~yx1FrTNtZEa7kt)f_aOoA6U6kpy^#4YUeIpJuh3v8sT!ycpgzb8j*cB;!(&N-(w zDv=f~5A?-sq^*-2qCaZ+fz5j5v(Q9!?nUHCf+|tU_NeBG5Je93EtN?}%79#i7{I3$ zzmRm#03tDU*B9@`Chu{4Us<56R#V-U5|xNJULrzwksmn43F0ly7FG{#YU1hC*zqwm z@D;f*{WZf+Fey>zvmZV5#t=VJWdk0!P4Eb}1`G76=M5su>`&>~@-i}C*T3}82PbOP z{|`d=Q5i8M8tB0e5cU>SgbNtlYmkZM)^ulj{n>7XjqwAqUt~&MCa-$6NH0R8P#F$e z2I}u-;tJ9v#KVC(LECfdk|G!7q~7U%S>IfgvQwWVF4E=Y-6DXSBq96D1(Y>*k^<=> z#vvPYAQqcM@cO1T&E#Nlz|=#;A763QHg@~j9Wqs?^thI-_(F1){X?Sd8D zERKVyCSWk&`&cS{YNu1S@iU{$H+=_%azoGRsSvdVqD}-{jff8cEpyqaqL|#cpud zo(D`uJ=M?B&1L15=bkJZJ4pJ`fyQ!@r3v51ycSKFK%g9?!wUTDkR10*Y z>wHXMGzL<|kF)9z>JP??Ni9+t+ncre!D)pa06|@O%C%MfzpSHN&xV?|z7eyp>{8wY zrRCts&MuVYx}r@Jmswp@QZFXG4X~NvA3^LfN57dKlx}38Hb>+(g!KKO z`G2(CQ;;oDv?l7ZZQHhO+qP}nwr$(Cz00=k+NIv-+&+yP9XI;rzGSS-nfa6vYpwas z@sCNYsbVv=7D~URqL@cjwPC1~4Z)!>&1&bOR5t5oZfmSax~WdUa?*NXa(RBD(4;0Kk3x=~`( z?p=c{Agv@|s+2C7U*7&{_Tc`+7Z(p9PqdO2!u2#6O~cNq{Antc&zv-Nv8{1SrIah% zAn0~(+~VzC!g6}&RhV-1zxeEJNn8*`;++)9TGbk%pNiChQDuh}ulNibtFgZRb=xkF zxG6CT{@(VkALb!>&q&qeUGOn=*HPISa9$+*)S-Ef5q@|BFP1@^+2fPnnF?D#rtevx;sSm79`hRMxx=vu2!BY+pl* z;Js8SnQ9}8SzratER3S%GJo2OGi|+WMH6gLdKzkjt|LMYqAZQKx&?zzb`4q4;is)i zPi$2Btw6KXY~d=FN$*d?d9^yC%b?FMepcQ zVX;mpi4)xi$D)3-HBFBmSm6jsV|9zs7}FSBY#)aq?$wY;I*svwuolHXyaY(sT+mbH z9AZ?4UAx@7L>Xe69P)rwHh_E+(hW@JWWnILU4dQv!g1QaXjT6_pV#uA=gVgTH2inZ zPyZjD&+^anXYc>h^TWf#^mV$oa$4(leu1{V zvEJR!%&4uLZ;CpArv53u9zqi*2N^!sSE3_%o~vD#*UA%gZxVC7-gJF<{#H-emo0~z zN+ct0HmX|qH;coHg6g`aDPZt-ZM%B{2LX2ww+QRUa>m2B7xccpBJ|Ia{)`a;lhzc} z?MSqGAo!$IgYsY44TXC2d-JL)Y2lP7j>|(sw9|&3T`q>z*aQ@Ta|B>?>{)_WrE&flOFDjzv6tB|DE%R#{Y}+ zU9bQD;Cz?l|Kj}6;{S*9U3rUwFDN!6|AX_JUurd;{|D#iR?bLe!eV3kQn%hyXRcqR zB6w@suoI20|1<`vX03OwN^708vB@hUWmW<@ndtRZxhNmCGAg?sP~H_eKOX-5JM?Df z>n!E~j-sPaJ*BHp?$zJ-Q`+zD>q}aC(L0W{pHZOcQ?RzS#d}^G%nfID8?-9$vK6Z9 z5=DY9uh$&qLmYr^#@vjaFA?3&>gJicx{msyZQO1%XcxP)x^DX)htx5;e)TVsw;4&} zt5(TotwKJ%ER9K9p5*jb9|^fixtG)irBXr_fj+3sRE-j&GFrK{t{nKupZi)KF97d~ z&WrF(O*p)}0a_)s0pi=xagOlPQO?~S&&qL51`ZN?xMiJ>tu1_{Y^;YaNgk+n<*%E` z6MAh%l*NyMwm2vHs8>mvd5xRvbvD#^d?4L?kNEHnCUPkLK4D&JsLzZ*v`0yp`n9~Y zNqW_iy!6)=8E-8z)k--h89?`P`DvW(1pN9sItYu*`S{lO1{F^7W{`I-sX~!5>O{?I zz3_cS%FyW2!>*mYgheURA)`vpc|}Y436qr95SX-of8PInR-t08j4EY>7BRIni;yb* zX{^!Dx|r<3(YBDENcs0gxugG{H4*$OAmdF?=8~MLY6aK2N^k{RUj}9YKhlyWRcv-; zQAv~N`>f7|@CVQPBQ37C06NxlVH22M|8O9B*?=D?6k|i(d-sGOYyP!F`p+>x0pRGG z_9PD;(H_76n|Q}8qTdwGK?;fg&c+}^m^K==TGZWNEOy{FWDUIPv}}wVrOf#Zbe%e^ zO`j?^?(I`$Qfb$!`jAvA*g~L3)rGndBGjWM4qaQml|RSIl_$m@G*rshnZ>N2&Q3bdw|H&8?y2{-`O^R%xGKd6W`T-GFV?bL+y*Xv0CLy&$%LaXIV(ta$diy@=xqx!wuz`S9L|4^qDnbc@f&Z{3Z z@3Z|~tCjG)%F&GOPb8P4p0U6ow7gEY4TS^d9SO84O?c%CbrRG7W`;X+cw$#>E)d_P zi)&wG>|IFm;Wi!vnbcKN3dmdRj$s){HJNlp5{4ZnT+oxW%In z;=XYyNQey|VZ=g4Y%u=%9+-TDunDl`@gE5a8TGW8i6rY!TY%^RnSRtHmr!t#&Y#Ch z(cDiW^P#bnpwzKb1h++}3ZEaoydF9Wjxbo>!>^1jwrcW12Ag}2C8QL|8sPo_ zo@QpS0(<;PNt;W9x(0M1er`dEU^hd@4)>#cQ4oS((V$Tqu%rj>QTYMLa^^Y<3xe*3 zi9Elao5QwIe-ZGf@q%b{#k|h9xVz4Z6aLeU3)hN>ngHxTF_e_Qon-DZvjigg>)wNb zp*cvzC|(sd8Y@T;~lL4 z9GFn-0oVfL#ms87toN2`eE+k(thy)evuJiJ zXjz|n4sm)*G(Es%&`7u;Ze|i?=L0Ps^k{Ygb|$;&8_=@laI^c!Qr;;HZ9JhbT4(;@ ze7>wJ6lZ$Tf=F{YASf%~lB9yiKagtsST%WMIvYbj|1*4W3>BYDx=k^J8hXm=$GHJs zg}g1X{`GH8Lv!p+(1r4H3^;-Jk>`o_kwdT~6R&_=b`dljtVYxicQqn7^vD8=9XlXU z%phok-_Wb;gG17s_%Jt`TR12_@^s$<$1;7+YC~7$mS~Z7UNXQ|gO^0His~u^zZjM$ zFI<3&MH5}JY%o%hvL8%3M44$$tr6;5-3r4EMk#E}pzcuN6L`42763eZQomcwnXPsb zK$=mb#!s4~CYIk+AUQjURWV}CDBD>iMJ802JwxaR^1~|a2YkW=YCJT~Y0}ANi7rQO z00^f{X6+(aIV);K^2Q(qX3z;!;Ka}_4D_>vGQtA>^b>he?z9hd9hF~trQ3a+A{Su9 zgR4Y|uzb*<=c+jDn6@$^!%eml?=vKL|oSU#ZRbEynwp7ldd|Ps5i05InZ% zlw4#jHOx+EQ6$ZC#$uqv7o#-9YIcPp=@-7(lw&uF3Kd*B%2JQ(o=81&AfL4oun~(Bo=hOyMKI?9ywtukvAuhhQ!)P=)enMcIRHsbLKSK^&(Q29n?v_ zi=vBMnp-0I)(m|<-a^DblLMN6M-P-{LV`0S6;`xO>crGs&T^c@|3--=t?%>jv4Jbk z>-hM6*d+g6!^WiiA#_=64-PrtE(t}#4{}bJu2T^}5XPe*o+Ix-7C+5ia|FZ7 zbJ32F!DZ+|AH)gE6O-S#nv+vP9A@G(|H$LLRgrc74P@>xC+FWJc__t|6;ChcZHce= zn6_sX{R4mn0!pO}oLumeiG9zbV4{Z)PJ{ z@Gm7JB6!2(!2WAW<8&h^;V|yRXJ|Cji&FhMA@h8h?#}lzq(w)@+o@oGaSf0>Xny5F zP!JnM|K4Q|EYHlG(+^OeMpaof3$H|B|Jq^Y=P0=cG{Q_Iozr23M9GIH{ z@xowZ?jyR-6AB05zv#%KQN>k20Apx$nkz$j8nYvf0_dsjV&L~#qsl$cOZ|YU>P*Z; zq_(+Y3Z8#aJT-AW zfaH`xT~^n$g``XR$g@CNo)1;2J8G?U7qQM$qW85hP@+~G`OLu8HSbhC22_x#eON4F zL_kG-NnW%du~ByXI*=k`=$jtdy#>}YQ|w91+*l&~AzFG954v9 zO(zW{2=$bxoJu2l%2C{HY9yMFaP8H07hc%HH7K5)giH^lTyRG#O|W zCD~y^B9HfmCod#>f~!82S4O4o#ghx34PA+ipfXEt+9kJ+@9NAI8smS~5NLA_@_`o| z2ca;&3Z?wxuiRJvxh>sP`K{!{bfF3W zGcf1zquQs|BtKgZG6HW8 zZxy@@DWrBm-E_00H2U-_fXc^4N|o+1FMui`Ifb@b^>GCY=e|l{VNuc_`m_^xCRGXU zA80&-Dfy#H7EEfsik3L=l(dosDR`pVBft{Ui>DUw*t~~;MJPG)HCawM*GxG_t?*!> zlTPw02ZD2G+ESvU+OL86OZ6pH-0RAQrntz6aZ9lDb&On`rd8o`F|0shN!*N6S3(;Lm1(ki!mBnG2v zWg;xbFYYbq`yYw?5>9-+l zanfdH()qowqgNcx=0Jd7=e6TcS;@kMPb*Uwv zXT$O4eM3UkPotSRUCLeTcDtV4PlY-MuGz0b`u7Aq_Y`}OufMFqR(DX?5C`GJ)p^e~ z2fts&V5yR1?e_8Y?HkN>`{?}c-UZ+Bu0i+s#sY3v`*ph|lB89J3Z3Oki4Qr%N-0Xo zpWhom3fm$82r4^0UyPi+t)ssH!@y8{ST(*eK><$c{V^K|KQxS_Ytf=xEeP|&uN;rh>8>aILTEL;>z><1XT$OVFRjYQBi5-0K=U@WBr~D;PDB82j5pI zK~z0P`MsxJ={Wew{-$#!d1DAze=btHd)U`GOpNZIMz_p(%h&5Pf62MZS%*o+YGxZc zVkD)QSq_(0VdCADSh5QXNW3$5F~_ZU>@SN5`%0-zfL%sO|A1aQcL^R!mJzY3z9^K?Gph=)Hv>snyhdl7o2W-Vxw2PB8FdD=b7W@L zD~Ft={-8u}XL`dkCt`l?^q|1et{d#z!!QhOdZS5S_w24O@$LIu9t{0_^ULk|Eq}z) z*BBVnlpWA#Ty8~EUE;f}Zjm!fkoLV1Ek|k`?fGyxiSF0;YMW%vWlNuUMz}rY#()vX zQiy)v{-AAa5c&rAb{fdt(rtv}?`6-SxS=jX^|IuDT$=-UI(OCHf?b;WDlVy+u$8-!BgNgy00k%9@+ zPQ#p+Woa3N^4VmJ#thkY5T78RpdgoKLqp)|< ztyq)XbHfkhAU2mgBNv4W-#x~h&`C?th{V`fMIFy>kY3>u*xMn71p?)s^BGP3#wsZC zm19V*$LOitsWX>exe|97WQv=klr)FSlkAe*m-e|yh&ifSU z1tr)lYkFtM8Y){+jMR$6N>_o*#fKa)t=&=&_o)@r=?``@45rZn>}`aXR@x(WQ$sgm zt6u6icwG;*GVHA@S7JrGvb6(~f$o1oF4asEQ5u%1*$#AfZc>(A*66Z|Gp&DI&2|f& zazt|r$!VIcTxPryUbtB7ote`fg`x;rW^^k)ho26EA1$`T+!PqT8B(hn>exwO8R(u! z?IpSl;+DUGu1&V~X&_C=RbFz_|KBplkAQVW`sU_odU&BB^8xCz{ zTj^C2NU5s}dUY(1Mv>5&CzRaaYI=1lCr_kWQ$!x4N?YPIsDjdcvy(LJ?$6)M@HGE* z3Tm(!R9epb#C-+#!uahh*cR`iG&p86m*uSM@q~qXxaIoBQ|L|BSvE--^85Q;>g;p=usShjmhiv^x)NW*%INY?n&CbCKKB zhVrNk7`x7`7BRTQ-a9+rRg%nbja5_o0ukUF^#=PrvBnA4Q?;bvyW3&;EeN)tKckOC z8|V6tqCe9Y9`wy%o(tY$o)1b5$=+a|%cL*qA3{76R04vtLuxqhczL!FF9dt!utt&w zE8@+ms#;Hft@(p+jcsKzScM0vPH!hTc$QN!^)w5QT=y#2fA)Us{ceV;zk32aKH>C( z88p9r7w7&MfWJ_A%dhvBo2QfC&C}P-?e+Q&;x%-Cb8I2Z6hTDT^EG_(E6#(PjiV_B)lV8t^v2=eMgy00f!jw6$l z63DE5Pp!S4?d+ya)13%5Idw}il8Kls!$0gbrU9l7-_wWN0)ez+xaO99siZcujyUMB z>L;@SyR3xTwB_tE--xY_*(J#GeXcl>!Q~{wmFq9PA~6fMnyjp#mha8QEkIFAmQUqV zHw*5cPf`-AKEaifu>Ne!w(HZJIvSU2C*HNkuZ2nMNQV5ZM_2Y|b{mkn9Ah%kj*H^#7D$*y>Pq*g;P`V@AV@!qkCDT%ns^|E)&dYW9%YFigR`0+!=RR zg~zgNM9Dpst)rf2t3w&v)F3r;!7*ynA8jt8b=DH!W+jM{v(T@_x9b(3j5~3V%tHCaW5>_1rY{i)z}$xN zn(fKdsbOD6ewIs7x5X}1`7IokQH1mCxz9xSWLj5Hjcf3q-Iao#ojRqN)kcd2n?ul z)}<3;G*y%7b7#Jp_Abq5RT7=&We+6XVsvzBwKR_7a3@CMx;Fq0Ohnvn5+W`hdSt#x zv-4S4bc!(dXnBl6gPb#(e7iS{ex#MXr9Y@Gm%cUyVdYweGd`ys*^jemG~;N3xo8aJ z`fw}(sj@o|j{yhF5g6)!cbl<)vUSii@kU~R=h&|$x5LaHOdiE$PzA{+_X*Ao!)?Ys zeQ?_a8GAoudU)JOLSf-DO<(Vh+li3H;zz4|CizK#vqdw=~)d;Zo11er?8Ao^tYjh=HJjy4Q zNYT@&t|xzdV&Pr4ABx=|o91`GuO*nrhs^aj|xP(C~ zUf&HZF(g;2apaOpdHp8xtUX%C;j1BSUf$~asR&BV*b*?qD^uCMe$v9c z*JF9_M{`)Y9~fu(9~kw+OI!IL3C(30s#8p^Z|IzFOfuK~don=lI&AfMw^wtFcqfuZ z6Naf^$|@_{%HO~9KO`O8$Wk{NF;G+O<2;ek(mjbEkjB-pRi@9a4)$#_moRe zN4!4BmZ6cOCY2*YhFPOM^=yp|SqrBW zk*OqTXzLSK`C1vGM5(FmpQ$BitN0?qvGjyBbNDYIm7$>7w`175E9GctQt~^nw#BhF z-GR334f@kyZXdDM*sWh}MQNqni<^qmJ-OzndtW}e?itlgSn1K)Y1brM9j4grI>8+$ z6zq1KT9LRLW3;W+&%a2GQ;JG=v35uer(Lp7Hvi6iwo*ot1}XM(E2~;bzpr9diO8So zGcK&1$PzZWxmTE4hyNT?GzYeI57$EJ!T6m_#@FiF>tqe=7;uFA9KD3`Od`~Wkb@b? zdk_)XAuGk}lgTOE8>4Hny6Wv)e^zY$@n3+gd_?u1iM0(`2~S{XWm~b#Y5bA*0TSWk zIGrW0y4Z7>u1zsY_^OJ8Pd-^yrb$sJ{Up{81)luNr2?koIsmsv4Gu89YUZkO%fvlZ z%*w-;7KA<_pZNvrcfQBHFTb=$zdw(h&$$m@oH&Z7Q?++tPtkCut&7W!@)^Nx6mtmH3zGZW17 zE0lV^=@a`6QN4*plkTB#NN<4*zc~_YF2yr&JC^rGnQ65Uf7LZ6)g;R{kubN0Qa=sy zbhw+jq;1!n^j5Ezm!LoD;-g#%ku*MXP-Cmy zsR(e4gs?qGWNoe@G0C678NTs>FeNty2Tt;ywi8SBfk=PQf*Y-?gW}alt!SC@K7Ol& zOP^yIk$NlR2Us1vWggT8QGXtE6BDS;vQcL5oYzhX0Z1$;u)b2ocrRtq;x{r{E2SZm zHWo{HxNuVoj&OnFhVpRPYv?vOS> zWzcSfM5i&)(_>}Nd2*WGJ|0)z(VUKE#(M|Jk+{HoemK@Ls%{2Yo=b@LanNmnXZ;fz z?WE>o7KL{GH>EfemgXLwU*rezk`LrdZT1A8XQ1Xlo{L4kQy*4G@z$2`y7oN*wcY4S zAkBa79%Orgxo88_@e7Eih`&5R;zNM~^&tWHzn!bvc+M8o0HYF67jUv!IWS-Nj~x2#v5O~<&kc-lHPCLD0aCpN2b-}XpVeNStl}-6ovHe$_IczAH)&nw`YxdJqA;>pJr2l!aPz*i3({O#9pV&So8 zsCIQ;?VO7AJ5n+<37sgGJdll2H)6>uA8DKYNy;AP*98-<+n1a(9$qu%DfB44V=?rd z(+6H!-5PDWGJ6zXH~ahCT8jyCc>Wb!jh+c#G$N*79xVvh(d@!H zea|^~Ml5UElZB`K+Z?}}yk-GPdO(QYRPXzB>;+G!XsxNck5r(g&&w|&RT($p;Gmvm zoaU#A{JhW-_j=)Bf%5`CJ~n}Ki)}oOh52e?zs8pn^ZE(y4J)&NfAKF7%1LjiBf^Wm zYK9-KWMlUeh)n3+KPG+;KkaG29P&Hio96Qg_%jG8Q1=OpI?Eayn3B$~S26xO$cA)1 zU*|QkNLK~z?1bw|lz;mCu$t_j>XxX=s-Qz^)tqsk|IRMHPxcpi?{{(|9vO=T?CH!0 z?NdSfe1d(#KDf6SF#dte^ZI@s+XE>iUYW1>biKQL(alyhr{V#o>g26s9Re$P8xexi}(Y573_Z?&Q=*yw%J&?Eu!&;$1tY~PvTwTZK z{fZ=j^O{dJ6a*F_wqtCEp92FA_a%JHql2GGtQ*|-$id$P8`&Ai_}}73S#SSRqIga& zqs|Z3UK)`f#EcgUR_55QgHY_^t_6tn=)uT3HaxAffBxpFLyOSJD3*ku!IA_Da9J1u zRg+icN0cBX?jc^Oi_B;DSjH_rM)72!CC-MpuQ5y8Yi+QuwZvz24))2V>a>xMiJ-+_ zL$)P$#z9jcuq197iQ57Rr&9FfM6pPEWk0D@X3^49SdKQ+(BgWycv7%t5p^3}H z>BK`L#!I%tDM1x0D`N z2pUFn9Ka6;%YA5UPGt#u?>orQ$c&51Km<5VWl8lR$GCzdps$>pd0tP(GK7=BP~-xk z!;`V_-(F6Lzj4D{YQP!bpc%ga4!aZ_7UX>@4p~LD2|67a;2}`396JIeusxqsYzAq8 z_^>L8_bkDyB>*S+t`#%)rtLNx6X^h`#LEz>!+iFc!9TX)_WJ&Us{1m6LmmH8@H<;6 z)4~)2m5aIi*ZBpg3?u8Qa6mpk_?55?8caxH+g8AnuZg@x-KPT>_}3d_=MD|vpLK|= zaIfxfZ+}0%ySrn7CJ~Jl8qLHPM?8)ZU>@1;^plKFKc54eGP(uX5@VR2eui`B1p7V~ zjy$a^06<7F@H>^c*bB$^+~?@#W1-95<=;PXX9zYGIn@T^rX=Cr=tiNSES_uj@jkl- zT`iNVamM5hJ=YBJH9mI%{k-I9=i4>8e$sB?a|4;aCYbIWVW^fcoO7VlrB}s8HQfWC zuIS!`Rcco8F#~tdV+wy}?0rvn@ym;ga3n7fiFM`k-C1@` z64E|SO~|QiGHmFmA=o?MVh9ULH_+W@Dd-CyT3pWQHHDL3&)mA>UTeQ~*A=k4hY2GJ zS+g+2#a;F=aB$+phKa3>Ub97hR`~dozxv?vmNO1Cbr1M2s*?VM4aX6VvC(ts3ALuw(=xUeQI*--B;g*q=1e_51z73i)5~y#%R=sn`GNWnHbpzX6A_|xSSjrkHYJIozdFJZNy{M zf>*WTwN^r#RuuGjejS`xzfwn+K5fRUd`ffWF5i3yyoLXgou;c+LEkE1&rsf;9 z5BT0=wGO90aZ*^H7Ilw(#v^YhpJwND%C6QhHg3qmt0?EB*4!?2${JmK%8&8LaEx}Jrc`qI3jea7A_B$tWu4$R+; z?-^Nw01hMuF?;|v8oXl%_aDysr}R4ZU`!&eU~-%@lSKi)4C>i|cJ{EB_yQl6x2A~)`RvxsMdJEedXu>?n6c%@fSv=&}Z zpHs-Sh`;>E2vnmxdE`J55fD!x)_l6h@Z5))f}Vwa^aw}88WCR6*o3`p193UsY@(#t z^Ug`+YwM#poP{n8uME3&K)PjkYmoPwa2_OZ>7CDlIqbvn=@x{%k|eZD_o?AfAN{Vu z-Vww|5;?`urD39ks3myStgd{D9=9^%yXH=O#=%_3#!oBIez^b}IMv&YDk=zmhWATI zav-K#CWTosm!#HpEGF#Wn~Hh$wQ=Zefjw*q?Ir~AU#!HQtGnk3aqjUky@bIM=W6<2Z{{y(2;pwj_7ft|0ZhXH(w<9U!Xq%oTej^P42@J(aJW-Or^s z)gOq$lmPl%8q2bGj7A5;Ka1xD{svgY$S4C7To_nKJAe~@do6HpaPY66;%>ql^XVV; z!U%mL?+&5J-#vDO zo}^aH@rn0G>L6hu8%T|WV(7OGXW~GDgnH4<-c$DcFFo=Lkm~3Slyb4bYg-$YLD{cW zXh>HW^A<wEsobG$H&&O#_AAQ*49((_yS|N(^}zi(?U`HW?|1B zbw5%bQq(TI464i{#k0*&@)vxff~T$kFRG)zLgj0R@|R1!#(910`9_fv3?H(VyV z*NJYhX5{O*F|C;}N-aX&LqU>pGTKt))Q-=G)Of zUuZtY?v@_y;amryB!d`_Y?S@WeGBzg4fJU5Fk6MW|zbvEmw<)k*6biV|2Xck- z13$=pozThNid^0jEC~PmoQ5=y;qGvRF=ZA8YOnYf%wR%F%GX)+gBH974BW*8_B_$> z?Niv8B@YKPygMA(*xiX^gCFPaCOtf>tjq8}+1UL+ z$+Lq!6W+5pEQfv;=EMc$sr*I~tO-Ff-t^?a+Mu8K9?&PRbwhi9l7T(1^kIrF64D#3 ze|61)d@I6niX|?JqK{~M)$@>E$q@AUkMA~!K>_$l z(*=#_Gz5;EI;pLC?U+?ugATn;xQEItI{NeZMZKae;@ z4q=ZHr8=kGJ=;1q|7oABfc%}X>;p?K1gmtc633vizkIOI-~O8t6>{h`(6cIUwS(Lz8n^(hRjkC&u!914MtBJ*W z_v!-1%`ktsa57f$;Ns%o;^3eKgU#WXWigbkN+C_v0ta;at=vaFVkATO(ZS#ZlbiVU zt?TCm20U4speoz7f?P{0DnU^88ayhJKP5k`3Hniq5yxWcA zuZ78T{Odh+!M_=m55qe9YwgZ=?{M$;VBb5BATOe1D9uzzA*`fMJ7FZ3mS3(Al6k&= zf?wwgqbN(g8+IVYXekX)qWH<$_0#IF6U^s)78-{2N8?CgylYaQxUW(680&7syoY{9 z!vi%4;)?Y!mTbZ8E1g=^Jp)@+t6fRc5voI3;#z+DR#h$}_L&AO!wpT@y}A z@g8O3zeeM$h4U{Q9eM8dqUv|DI3PZo%7OZtGe4E;Z6Q%Q;jFbDyp?R{<=Ss~e!SD? zg$GK3i`1ChNsl)CK!v#0$o$p4jzE7{U1efw#kJUwEEq)@Fa;bMLmJNH3_NK>GA%-X z8{qNtm-dyPj~`YG?W&-^$j|U(U-H5yCf;^Y%-E}gxU_Pfkk*MNyg;vxhrsLN{BP*K zvE*r#zdQZ&V<+bAoAM4(lgGH-|7N%wQ>b-Wq6KMt@1cVo8C|Dq!AhG6=m?X3Q+NFb{IQx2cG8MXI(tHQDgT%IGYH7 zE-X?N%EY~^7edo0z<`6w?||Vr2!_PD^V}rglworXG)4#L%*|#>4MuSJz(efsqKBV7 zUD*Kem0>S}r)eM+$8KNgT9?JN2tGgjoAarxah{5|XnJ-F@T{LnaZ2$3Qs<43^y~Y7 zt7cKU(y@4Sp>h*(BG^O8LXv>{||H2E$RdxMsUsx~r*k zZ5{QeI0X6wNa}rTd&xYAwHwsI2rKJ-Y>EcCf*{m32T17}7h%zb4og~_d{o@v;Y51E z!|;T&mB~Z40ZQMQ|8KKqO1~J~MXt}6CYWiKLhl~y4G3;)*bXlL_k;aq7+4pQ|Q~e%Qp$XjT;+r%-e`XHjWRCqi{E{Qey`{7U??_wP$FHKL!T3o6G0$@vkry3=9HHaWK=HJHQ_s z-0RlQqMNTAE?@zu443T*-pjRf74uo8ELxHXWiK_Yd8|IYZh5U$k=p))B2Dy%E;^cN z=8mTEIY?d{$SfA2lv6EIOkVdIKTjiX$3Z|B>>Q*KQ;e6LK}$AaS7oimW|{dYJ8DfT*fsKytw?NoQ_>y1g6ZKO5kYUVUVL1D+wrXJ>YXcZP|Xi86as{%wx4Zc?T{vokw8 zbHf!m(zmMX=TGUi7w|wEH~IQ8sp6A zUIU~Tsm7ve9XJ_A0S}Ss`=e56XMGSZ=Z$SiXm%)5UOIy+=mmWYIY#cy<~kOXmV9bM zYDm7ttWAh5bD*x@JTn!<9sp@Eh2Wv|J(ldE+P0lv?ZOD>at}y2)$5YDO2>aH{rP>) zaXy1pe$NY=>+KE#T`N00VYn^!?g4B>{bOgB=B4kEmfYB)R*j*IQ>lENM|<#-fVJnoP|rh9Gw^Yy9yj z$dGBRqzIOxI|z}HvrTL8tyxf9lM)doCWP2eNC@ns67q)zqfAp6rY)ElfDxBYGvEsb z3y;*Vn{)`UCpp@#Q26(I33h!+)7OCzcINEwLyASDWI%_iqLn!Z4WJvd!Hw||Phjwk zGO3Cp>C)vy!3@R@%H)U)TQY!$=2(n<#wl?OogsUcmH}Iz6A<^UgF|6L%?=7oQ30Th zq7fBHLH-WVRUQ%Rv+#5cC67cS0tbQQ8#Boq#n>K+oH!TL)6aRz?ZDKu%N~`1O$nzs z1=)|Gqrn0f!vJvVBthQdGa~SH+|7}b^t{UkL*_H*mdcqLdwOAra#=R!z7L))9yl+&)ycXP5;T(OM30l?dc(<8&R|kMnE8N{TaWofqd7g ziQ`K<9+YVc^XE}LhV3G~RO?#aa1+N^E()igx;sZB1^>_)-eH{i^1!)=H!o5Mx-ZM#B-utn z%mNAQ^S=y5Zqqn`7O_>zn}MH|Rr|ls|67Cihn*XL)HSZqRv6?EBrqxW|AJoP9UMPj zrv6qx?NbcFA6wNbqbaylCE{FD@uf2bM(?LmcbDC;4{A!^`|Y9VgbAG~`tng^2nzoQ zJOMZ-U{j}gzbAfL4{sUdLtIR#cDpwz{9`WD#y4^i<2yY~B{BrIx^HV)b)Ve^hulQye=h@+`IE#TC%MW7e(K)(4_~dP%Aq`p=J}t4FA(o zvru0}m(N-zhG&jl%tn3s+Ox47W}^fc|eB0iu$)?e_5ZtLhmlk2S1JT zs^~$DtL_AN(Tj}$VW$WPrJYKY=z!%`IK@B}-ZK?~Mb}KWz0N%`2C-d}^1UsW zq}1+b?_Grk^T+q1H%B3Vv9PkDQ=Q)lm)22ESTq=)X6O8d(jVaJoW+V6DN5_SaMxf` zivR1s{qcYN&5wWhtAG3BfB#?D$gQH=*)oRuoBv5;EMnpMAdXd~qbW^D8J%01Tg(mJ z0v_htn2(zyS+03?UCU*1i!scdi!qCmXq_lenxBMz-Dbv{Ghr z$At_G=aD)j5Ar9!y?L%aHx@`<>jphP=rz4&w;p<}Zmr?@gHFfmHvDMN@Ef&SyNLso znni-XFO?N^>I6EV()?00PSqFR7vl$Ex+%zg%WFg}H9E>usuhx>yNzLOtVF{wf*4lr z6_-7a1E0wR&gM@S8%g6Jo5RLt3H-CmjlddnRQKc&sGs!|3h7aC!D^GDrcONvK z;v-3)QvQi^)AgyqYZ-tdV3sdYMO#n%x2xl(s_0eLysPMXvE!2Jd^%Uom+v7G)6Q&8 zBF5K)=pC1UjX$Mi%(#C%EmCnEkkxM%r)N=!5->uHKWa?uhF>6r9sWJof4M8aMS#R_ z`0ZQ$yRAx>CHs~?Fz)x_Oz3fb4*7h7k`V_%!3&6kkWviVkWHmrZC9f;>Q(uY1pI|D ze9ErD2x`n+P5%Ar0x1>^8StkYjDzM6J|hmtUJ)?xr&8f|Ry%L^Uic2KS^Ju`f2pi} zggy+MVY3Zf4x87k{#x9y8ms5m=6)|}6%0Nj5pp#us>?a72=8c~3tTOk4Qf+lsx*RM zkJ&hefH;BXE~hlAQ~;c;Jo{fQkFV;N(46C!P%Wf}>$f(YucE1kfo~WVDGQx*O%w)D zGd?NuT`Ez6TcrHrv9YwlNRjFI9xI`H%5z=l;0OSb306^_(QsU|!O;!}N`^RkwSh&T zU^cQ{wbowi5X#f!FI&)n!M<<_Qc;#zWG8eml?CFN zob>Zi#N-xrb9bGePe5|9l2~>09RJ@{fpVQW3|(zmS0%I0U0<_EWdhJKxG43|4`kx} zbwr{>@qW<`v3{?(nxszl+Z7I#lP{}8Tj?W|Fz((``U2Gwse!0~Rb`oQnv>-GI67yP zavJf3PbmmF<7ni`G6sSfVqzSb7Y7)+Op5dKG&qaSDete4EJ&(AQ9=&&h5AMso4YQyR5K!>iTde-~6B#nJ_E3U`NLGdSyH z?-OO0Hn!Z2>`Zq=3Rnr}hRb_zh?Dg;TuijWxv#PH(Bd$x&K&O#ie z48GhBvIb$429p?d!?1!s`9TcL$jEL*jq13?y zK-%y!wTm(jPc9^Y1D_C)Qz~&z6Eck~#Pd^Y4iCHIPEX56+a< zE_g3ryh=rLYMj%v~z-dXQ62d_I`)`wtVVX+Q{S;Zoroz`KTV$T6dn$>g!6 zmWsePZ7=qd(Fl9&u%lu_04q!nq6;R`MB{*A&+gF`gYKLsM*aRRHIox9Xv=TT;kkbr zr2A{tE|vg)$_}7GoqE%W{peKAbMUiP%qeP>{W`(hx{7f5C*T0Zso4 zkzs0*4fAP7y*4(2cY#uuoo335TRlw}HrsVBs7@ z^X+6s0pTba&5E{3A)WKe|0wCy6r?Q}u!vi|OF1CKrSg4EeuJa=v*}qfDO_X@`U0RL zs1TEb2tTa=Ogg&&fp#G@5CJ)E$il^zn&!FESLwN*)RuZe2u;p_@?N^ z@lBwYyi?bC!f-gnLsYq9`6o=%tF^38nC$6dS&0}L^r~=L4Q(eLU|B!05!NSAtyV{o%&8g!%Z+Th+{LEs?ay6ES)~t$(-SLeBkNG zw_O;=%U99}ZD5>0nvW5R6cn-eH;NI#K}VX|^99VxPTPPyOJ^**k?n z^6Inv2`|?ElwidT8!MJ0q#$>X;@?N%0in`^f(RjLH?I`Y^Y9^2M7|-6CUSE={@mVn zbhMn%#-$Pijf6yLw{IKJb zmb%O=67=KvJbDAzfgf|oTdqB%#u7P#%5xxCXu=XOYZjDxOIT3MZ(7Yp!8e)JB{y2P z(JT0>(e4+G*QvFNdes}Xey3=}R=sdYIh*CXcD>gs`mWpUcKCOo_eX6YchBJVfbupe z9GxRbyWi?{2Eo7!2mQX+Y7Q8Jbi=^&JIz6(Tlf3*u)YL>7*=llGOIkHe5)c*qX2>O zNjNmoBz1&k70~jlXbkcgqi8=!Ed4}xRP$^cTsiQ>wm?!U%4vm`ySt5DY8j4OIRdC2 zJmjm;4m<;U3TgZCm{}Wx3iZQYvo@&JyncJw@>;{N?e&7;fc+UXqE2(z4r>E4q(!6A zx6)pw+1OxMa+T26AisPr(MvE?QOkfJoeh-k)PyxKRsjR?4H2-nT7It?4ZUW!J7gE6 z+w$0-J+Ia2)jNYu5Vg6B`D$P{SPWET7>$VW*w(?m+}nG;a1n!OQ0oi_U2hn68R(3x zd44TqqI8`Rv0xC^f==f~7x5yqJrtD(v@CA#`KuSi-X_s85j8%ze3r1$oEN9((}i0Q zgpA>}>O-#=_Um4&*K2qKzt!=&L9G>p!(pS{T_q06=Mof&w5;ujQrX*p*3H*=op_Y= zZNx(J#~+-Z+-Q*doM93$nHegnFRK56BidxE)xv!9Gi1B+H57x;L~r!%#8SELN{SFg zspi}2utya*@=Sab=4A;LI0@^EMXNLM6zqHK!^sss34jj%9@42XseK}?e8U8U2>2@y zo)2lh(9Av-FXA=dxvv_T$#7`r+r!sjs*K{LvLw0)Rd#cPdn!j>BjeL#90LZM=AO z%2oitaHX{)phzr+dh9h8kNqisJU(`m6JpY5G+`gXV=WZ59<=hZyj%nl3`$Ob5M*Nz zCUHc1EHH{5tW;zOy|Rs7hbds$W9QI@ju%h?iUVWAv~1ZiQt}S{WAw*xbNS?&Z3J z!;0QS;AIFDi#2_YYdX$OA7;`K9UX8OstZhKV*FUebq&=8x@HqT74%U%2@zpn9z`Ke z>F1!1l|PW|YAVBLK?^E;%5E3;f}PLx^qg!XtxKE8ugz7O>!MjL3o*_mYdeSne+JBm z5MM>T>&1%fiNizBcgwe`)G3fYccO(0)S6ynlUw!p{3@sW>!pS<`K z0D~j&ol|@_jsQV3k8R$J`{JnVIbO}qsFb%jB;1mcN| zQJEwcVRAVJh<2O<5NB;Rko1V4u!Xag~l{0Xx~k z%(y5?IzNNp27RG<7@*W%q(9rG*)U;es^z`>8-yv# zorxoXH;4X-ldCMR3giL^<&(vr7?Aw!f6GClzhn%c%r8w|ts#ob&(_7oxGF@h0=AnS zfondWT+8#!HNkN6kH%aZrMvB2ly(11L-`EuM<)fUa%H!qN`O1Hzk=eHJ-$t{c;G^+Qb;_Gue z*0--l$-p1waD`yPwv}-7GuQk?jNn93Z{UTU=D=$Ot-jZ<)mmPs-EI%som#u@FXO$0 zySsiW->;{{&4~QynyG4+c=iaAZDIIF@MG(HR4*mN{5Nm&Pj(zsrI~m4a#s{fwXhr1 z8;zzH)@wbl#eRB&L8IlhYrTHmZ?@{~;gX7_=WE5%4c?ZLh`-dODtlYj+9;uox-B=G zwL^);g1>esSv!=h9ZIIr+M#6aP_lL?Sv!<0u`?>=T}Csrw#41}gJ3yH-)4zJV9MFy zp0Dk2YdhTS+TqYZu+Rc`hZe52$zq!=0IlVs&qyx183~4XviYGLLo&attb|!XMQNl>zBChqXPBGX;z8yeCT z%^Kom<-jOHcF9X?GMjJ4F+*3W+G7tkvCabab6;-#G@dKXqFPFS)yc7DVzB<9f> zPY+^7AyQ7F_}9-SB*Dn<8lT`_1@c#10sCgnQETC5O?q!wxG~fK3MhVQ6@W=ah0>af z?zc-QEsn4Yi%=Hb`_f+@)w=C1KYs=}BqlFb$XnkE*TY z>Pd|1VN8p5;l{A35_&w$vhtoL{)lrwuvX)rq<@d~T&dH9mlDZ>nBefGRasRJkCIbO zLk=So*|iRhc5n3bNisvWF`fg31_sGTXE3ugw&!96{KbkT@=GSDz%FaR9omfz;J9^l z;iqT{Fbx!!$#`R`>GWwo)P?!zpv71@`;aZsVOV#TV0u-ss=cSyAZBUMJbdUJLqN}jNSAAM9uW>fZsr-MU`v{}0OcnX<{}*H+#kmmvk}>Gml^UIgY-O^M0y{F zxMw-{Q9J_jwR0JM4H*cm0SJV1Tuo1exN07n9@hvMB@^x4#KGYV=&^XdU*mwtJbT{y}&C~x1$&-4RLYGb!j{8-@3Hj5~b}Lw_4iH zg2~I&wOeP%AK#Y@`JY88J6qY0@>T3?y>F|4oxQ|`Q>lJX;TS6{U{^Rtx-MXshrR%) zbpbmYe_0o>D+|=RfF1o?7qC2gs=pxN5ACz2$+s9ldLQN-Xe-l!OLO_tzye1Z{ z?2b`14fV(=m8)mdpn+3?dh#J=Sn1H;Y(_ZckyIHgDg{_KeFWJ6TyO3@vy(O z(s#`}Eq!N0BAv+Q%mVUE328tzBz#OGsfs!CFBtoRFrRr!Ag&rGBXR1m8EV_))TXzz(?!{D1B?_UWu-joTiCyzh^(-0N@CI z0HfgvjzNj~>5s?q+FvNJi!CJ~<&%<(c2zb%}?)>IlIMQaS@hQM|X zz}xIs_@1L5ZFD@Zc&17jbR6p$39I}8<4!o@N-@z+_%%-fWo9qP130>3ph0vMaA^kM{&S+ zpeg4&O!+}S8Tny!B1m+$>OoX%1l?xa>(tvduQljIjAQrMjc*KUjb_wsx1#n6SB*kc z;^FlRCSvFzsz`EKyE*;1ZkNXPI=2sCjr8^1REAhm^$4pA;$_(cbBe$3* z{UNz`lK7bXc;O8|(cC#t5Q+s)olTkHOFFIF^FD!yiNDOx%CaRO@I~Tg_S~CB+@BB} zMYNP+zy8g0XE+;^vnNROQTi^7z?~vVqj$cR{5d;$@DL&T5L9v5ko={jyT)&GREQRe zXhMVCoB-YS`>jSa@V%f9wL1sBme*$=c|pD190Y!^6V)3_@LqPDug0S*8~X)3k>4$1 z!KFnL!1M!5@%I>c??m!l$q$LaJvg4wU&z`d2jpK8b4A8Fe+2g#%v?AQa!~%2!Z|ap zIYExOm^oT2OZS=swgZih7e!F$rtc5Dez({5x{Xe|*>ACf>kO7SGrOPNDrN`B=Hxu%Rp!YqkY(`gI(J z5qcUvPlESLVeU$$(F{3SL9gFw)azcm+x5LxvtRQDy|(XlhJ8P%_lAvLqqPijAa_xb zL&1Y}?Atv@;%c#PMcIc}g7zip-HI>BZ9fSWXXacsjgsL-7&{=cI0=ut=wlSjrXnmN zas-P}b2d4zlaz^@qlin|DB6nLqn@+9ErcoAdwW}P>0^WWr;v+oic(iz7>9WQxpHE- zOnSJL&6P7TD02k`IdSt-mCd%er9ME8&6LY*Mt=-W-fWS>*$6BeB>y|JarE(mn_8kX z|3eI6TFFGTn6PWjmE`bB0H~DGLKuW3l8Dltkh+0$XNNDy0e*1Hkj?ZXm-=%3nw;%5`JxRP}T>3NqaL zd^avA3H^&RedngxflZT(YwcFRdPb9__Ul%6At;p~tzl1))@tj|pn{A7Yp%8;u2$AS zxn^t2v9;eNY!Gm_+67{l%s>&p>DW(%zZk%w#eOQkVh@F6vsnwb@+~VJjM{O*;Xu=+ z4oID&+##twiVsR}Rpzj$$GQJL^2n-SBz*^t3-8Fd46R>r1z!WFSS&JCmw#3ORweCHPL0$mYZ-j_ zFqdT)Dco<985*@NVu=57KvgPCgTnjHs)9xfC{SWD=?d|6g zJ1nqbvVY=J>BT#Sev1 zTm)rjeDr&6;ePy>jlvGpE%ay!O%s~h&t18k$EPvjQ+>c1^+DK*T5Ye>4t%dQ=np)< z-VeNbw;Of_&2HGMb(gsJ>eJAA`?YetCJ|WQ<@H@IbC*>t%RS>%BNh5F2@N3>MXby+1mR}pxT1(tE+HX6TrAwoHx4viVdsgwDDJo`@Z)Tv~ z=^fLZHZS7QC|xx}Eq2=Mt(DzNUqM(Ve4!_$j}gyyyxoU4v!| z+<5u7{3Q3DKSw-sZWmHnQD!>xNBa~HwJR!DYesdP1W$o~EG30>%NR|Aenl0$)#h8S z-rJntSk3B+cdG+$x%xa3i1`(|wHfsxa&o0cMocpSNL33xKEGxpB;irEx2E)8Lb0!H z1B`K9^?tp<_4{QM!FDxhTWDj0DsJk_WI3n%l=oH#j>VO=HyD~-Df;^1L)2Mn8IcKZ z=_dw@P&Q}E(gZ1erU{m`c#pvyw!A((6O_>9a%JuIwv6=#eP`;>@jDHmp3Uv;Qo75M zaV=cQOX1|Xe9r(}F8p4^pa@02jCz54OR04Zmf_mv_MZ*GV+u@)O!T0$JKmcPSBSy8yX z7rfjGoc-38!>16L-7sg_a-u8rJUl?r#(HG-y`yuPMC_^s(L1q!3=6^a!R0L1tZ65{ z-q_i2Yg^yf-fqFK?1%2KU~{H$HWjxC_{RXqK0rhM&!P2>0^Y9kb2LpVr})lTj3KzA zgyC$)={SM3k<+V9y}_1w(wcPf&G`K|xg2{aU`RN&3{iTyx55lb6rd8ygwRW%7K)%G zi`c)<%T$ynGgov_e1p=thl0}9_w}s4;G8moGB2DW*8uStClEdV0s_lUiQ@3v3K3}| znFvv32c)J_`yFvQDb-Ia6L6}OHot+h zV`z!IX3c2UjAqSfejI$!1mbmA76uTs`j1HySF0VpyOZdWRM~D#W>1b{70|u5Dyml^^n^#41X(1Z^aH_t+3W_ zcG_OEHUP(vLEY;|-Huo541?~V-;Mn4QkkPTKhGPa>$vt(8DH+!+}Ez8%bJrE5&ou< zUp(`*s&}F^iM+V3ko#oyTt|3w&LD3|=C?XbK*0yvyDX);k!tanm%cSd#q{hc*|GGj zDg;iq*6bjd{L@Pzl_KwvLmi2scperYTPI3BMVcK`yQi7L4HxBXqSt0b=B?BjM^iWu z-q;ucJ!gSrx`tv9K;#)wfOqf|_pp(aRUWLPQm1)xPgHkw)6>=FK>3VcK}$SQ9^?Lg zvVyyQc-+#%!ya1BcTyD%TLz=!l#i-pL8_!&(Fg2p4Yg5+FATQHvz-<43U~F|r)*WI zpW$T~=XMF~DKrWqWX@v%vq4g0K4N9A`U$#d+NX?!hK#VBL!6F9v804|?DJA}c$E2L zl))3?`+9~tnm)=5No8WNE^j>j$ngg-^_Y&N9QRh@D9&Y0G07=;Arrf`tGg!RCtMZB zA(vu7p-M}%$mE7X4c9?dbVWJt2F@W1xAV{r8v_;H1*>Vf79?9S+-ZAvuQd( z&==Y36J->N@YC~6;?q@mw(33+POH;sX_dLeyEHe(OpK7dOnItN{w(#J=dcDq66cq{ za+=QOOM3Uo2Ol?Lh!${TUiiUTJdU#a@0n`TpPl*X#Uv7HU2?8`!M1IXd{n#f!OixB z4!ktm1UuZTry}mz`nkA%F8)OMydtgvEz-Z#35x#Rd}3lskju~%W2O?6Met_Z<5{jn z>dO@#tt1geK7gwN9UcU31S?mGx;CzS5l0x<&WWM%9&5Dq=NM;Q2rfPLU&qm!hOKGX znudK5G;HB(MGWaWhZlQc$f!~38bnTz!_VWXVxxN9g;Z}TQNN&K?rNle$Sto3{F%6J zxI;^^z13~hB!UQYjPhm6dF`hu+p3U}p;QD?;8zXVFB-$6E>ym2%kRQCHNWg+U$R9B zqwYPB%AdpGaM*;oe=VM`S=&#XwZRNPC%|R11wR_D^x!mcagSm?cAdaaqfM1L!T>n& zzy0z5{(mea2Q+Yc`<7_`cYmIvLiyGW(fW`7HBXrG&D(PD|81dFaCg~{AOGnubF@mm zfL39jw&42gEni%qh|uhRSBjBEYeWqGVGb1Vn#6EZ z8BYZNylKK-IsPO#Lq9sD3|RJ7;x5PJeFo1WaL+SCKQH~s82xm$-TIC` zd`tnYQ>qA!`noMuC3zKX)+)@3EeVGD0beEOe2hJ*a-|&}-bI$i)Y@dS}QQ)}FlL^#WW9QoC={nt; z7im`M+_Ny0jBOpYL|!7tke~tc`Ltt92^w^assWy%Bo7ey`=V8h+R7 z4cfjJG@89ur%~&72g_ue`;4858#hS@I8lRJw*7-e%HZ77^Dq4?=jTLlMb{hDzLmS+ z8X0C>I^5y+O`hsAMw}&P;5bt7UG)LFHm8C`;TQG`R=YLc4cyYeJ^1JuHebzM@_fU*VoC2=lEKS0l;L zBnQmuN|H26m-v`ll0--T9J~dU*l6=SSj;&*ei7Y_S|tbm~tOWb|H6t*yF}NPY>2UV@-(O)7BP@DDS92F<#E>c> zwS7IEUc8#wTT;pHUJC&QDJsd?DG3VdK^U;4O*-ONj$Z2!QNh z*J9sV>|2X{%ZPnB2BC<4R$n;jV)XU#@oR^=K(l<0n=7ZVmLflIDRM0^=B%aWH55YQ z?RaCNXWWVIwut_dJYgVgBGBGr#y=nfI^Tqp?Lj<_M&1i?d$Vk2BmgU!c45Y!r@>it z?qg?B9Fz)!Vl_}X%%i;v#$W>^1KuI00^WCw3V@$y`e-mp29M5tM)xO=Xhktg~ z=royJ!4P7b9+>Su=^uPD2KvElkIx4fQEt@EtBhJ6=Bec)#%eyqAzSeyh9o|?k>;U& z;9tbwW}DKeH5y*64*$EDL{OQ{(gm;tcZZ=Su)NG~T-hZMgt9Z;5jY{?+;DmC4RNyG zhU<*jv2yv!*m`Jj7&dX(jV<=ivh@$xirJQc$18&`w}Y$!u+T}2{_kKT{MDLFH5$~iQSOaB>UG(M^>w_SlFbV;)c@=@N_j(eY$B^1U za@J&W>W_IuM~cZ0WTvtgN3s=VxIj@W!j~L+1Vf5xxd_!Cm^YI)IHRAafn1q2& z#_aoX1m)^z;c4PMjN7#wH`W@Kr88JVPPgAc{R(y(ul?!S;(kaEHqVv9JQ8)%XyP&(cf{S>94Ma{I z3+EtaV5c_<2uDnSDB324rp~**UiO(nItm6XVq@=84hXTYd|#6h;b{JBdX`KI7ny^; z04T<*<53PG{Imiv>Ffd?HVdI)}r41HAq4Wk{CGVRz?r2rb9}=%**xz@s=# zXY5=`t|nB7L*bGVUb+Op*n4?U0BFFISF={%+ZtG;3h__BZt$Ad^nCC3pWElez5>S& zIB~Qr9sb#t5C6&ojRpGe6BlD!Qw}~!m2VzMt>`mj5Ymw4j~h5zO|E5Nptx31}PQ2UkbU>))l@i=(mu_seSlq9pS@4 zfw#%HYR%Si83rW!{(27oc@SpV!f^&ujD`+PZ){mNADz7w!&xv7K(k>E&iERAEAUOx zi{qO>FL|e~^S0q|ir1-f#qw{PrdMlO-!|Es#L_~EBZ7>gFH&Q~Z zHUmeu)oj+gQNxP{!O&~<+dZ$>sfS)`IP76YPTlb;Jb19CH&UN_3=?K)&bd?#`_ZB7&U z>(lXcas|ln4oVPjT(N)Nix*xP+B{0MK_RJB_Ce00NNWo#1;YePOIvUxG8gYUfION@ z3c7kYLxvvG*TZ%w&aIvYFqY-cMD1C@uV!T@NTX(_h;ANoY`de4vitXC^RIUR)ehn2 z4niB5F{yx&x@%A1eEs#~^K&OZk9O#}*<3pwP*M?fF5!6AhYP zzup^oEx+0E20_sB!eP4>_J*xaohLP|CW6WwRZ2NE$k-)67Y{L5%6xJ22RH~Z`w4u+ zet?y?h9?9+#5+rT`#t*s2LM?20}z@M90PrN_#cnu$G^pg1peyE4+-pfZP}TeWRr+b z3+8y4h~E}YVQVV=mPBjxYKNSF9Dujkukbz398DV?&r7G+X!jd6N~q}SIMy=~EMmQh z?76loOjK|N$TH6YSRosnp*ed5URW0!0FpDf#vAPFM?$3)g*(o1BL2d50I}-?XGxMq&Tq4lAk!o{9Yv5y zZkn7UpUm#g$()jQrbeP~Y-DaH)jRz>9>3S_ayA1b+@s6P+8Bz7W~<)o4gI0l^=l2U z)#-P={(upYhClTCy^cQ&YD4TBM5EES(yLDM#Dih!g^%A!9fhv6}yK3j*eE*Kg=iUYn0O*!RZ$}i26ksn6<%Bh5N5Y-w%x7qeO z^>)o`4LXtMH+zhFHU_muGwQZmQG108mzenZ+Z1$J@Q&Dzrld_ zYhDlx2hIAR?+*s61U^qi@|qQM9RW01xR6GN9YWZzdHqJ4@!p^rcz&xBcaK43(k)AW0_dbGkNNb>?u zVs6{~sb2*5Tb==pL4Q5oWsD749JWZJB#~C^PJZ7u`J_HNGRAYTH`XRD+ z99wAQypOIjGl0hN(D-05Iz`tXWp64iCF+ZWs*%|3HqM#V+qj(%dRNgC|uq95|?eQVKEea;=&(qn+p9s;1A;UNV?#S*(zOb)~Gwcx(pN`2s zhxv4M)KE_unu|kX9nk#cE6^uwJ7LoRf*t3OtqtBfaP;QcGRUuBLLmtG=)KEM$Y=i_ zC(bvA;v`0q20ol{i`md;fibe96#HBm+jw1UPUf!T$|m!|*W}bP!R#V)jz> zr&B+8kJdo})ZvsC2$0C>W4y`AZ2)`cgx%wiro|p0VN&amVSYTka%N*Fqk!63n=s6$ zWdGE^A3k(`GmC@w4p0g(OTtkDAQD$ls8_oj%s?NXHQ=OykZF3EIJkS6X_ZW-hy+;L zguy3E*2zJRCo{CK9?b?R`u{qQftSHW#-z-2+j-0x_k>Qd+JNEkoEurBbABC77%fZ@ zQ?jvPT#EUS9i}EI2Bl6Tu_Qbpxt4EX*+_5LVSR|1uo{5@+1Y#k90a=%qX<=#GR!?m z*vZpZVw^Wf5AktwrS7umCJB}b*Ir6DNVeyt1Pc46&>7FfHnSC_uo}!g z4){J*9ix$(bAz60d0RQW7U|2f5&<_VBTf?4o?bu|;ZUsfCo|kW6J1R9yv-zib&u#K6Q% z0ZcCaejzHGrP0)Nw2HJA{I`o}C6Ezi*bGXoJBk*?ibJtt2qB%}MdCq37)b@`94)}8 z&0oKIjmU8LV(+yv^J68#%!N~bJ%T31m{HG zXqp4(HDf8UxsR~zMXH9y+s!GPG6}zLAp9ufX5M{bP3&0}VKki#EX%!E_88t?or9Mk z55s$P!EP=@eqCjwoI?Q+%H{xDnXogyA&cobd^Jk%#-q#no{F#-VWt z|9umMF?*JP*AXA)|6({aW|RpA!4sDsup_>RBNOrDqJcqO0P#5Bf+NnVaXv#gEc6S9 zq&B{_AZk%ZG|R=9-S=bAHr}8LCZEd7K;$8>xh)Z2(IQk=;z-n%-mF4AkPl{+*s=FJ z!!IH0Yp-qw7E#`fR7ZdvyT-q6I3X^8F(u2TW|WXyz;|3anC^d*>31|v|BP=Q#urT4 z<1-!!xfZM&5qmeHx(c*#jBfqXcg`l!5S{rP;btBtLAsOKjljD+;($CFN0;7^Jqg*Z zN+03q9*v%Q3^tEzLp-qArvDLm+%9ybee=LK9cP+mE`;v}BY*rJe*2YN?GuEW7+(6z zNB*yJv`TDNoZ=FvJmZQpWD+k57H|zYnY@?{n2hXDC>&(YNm2-r7Wx=q+S!Nr+VaOU z3>KbUggDTEPGcJR=h6~Rx(l`)>?|G~eS=(5=z_$F=!(zVt}rC=k)GM#5(@1D4y?Ag z5IeU0Z`c;>q6-C(N^s$JHhDY_!10(|0$sLQ^4Fv6S3K~SgT2v6`)L20mjn613;%b? zL>Y(oQHIk$+4}wruu35H#J}7j6aZ0&FBNfnJc=&-({c3sM-UPB8nI=czJCOC{E>`Y zNgsU&8ATxYJADMprWp}WcY^c-%=Z?E{w5I=L~#DO8=sDoN%RbqhM;tugqRL(EAy>T zw#(iB#y$GR&9=oA+u`CixN`ZfTsHTreDp|MBaNySr#<7XdGI-cD%xrzfR79I_`%}R zDvKl+^?o}3u$%J-b;(q~{T5AUVzD0Snd5L2=8~|?W0X(8hN9g85mMf1hc*sI-a#-+ z_KL?#^uiyn#cP0&T( zntP#4;!weAXVW;J6a>B$g;5x&-rlJ-a70HX0FL0!?&9usd-o1~ytsenEu?mD+DEO~ zP;mbn?%|ljgWU!+(l@t_Zm{S6xpd(&s^5b>{< z$n`-WWLysn0awvfNE;Zs0RWp2AKeDTFpCEA(J~-wiQkHFHuI(<-Afv%QqRJyZ~4@2 zQm?W9jmLl-u?3H4u;K)9D|CNym&w;wDQOmGu`;*^MZ>(mp;mJE(^^RT0)@0MM<)2} z#k1QHYVt!E-25h_6O&as^ZD7MJZE4XBy%uEn#<+7hBUo6$$mtTH*s4`r8h7My`??yG3} z=r~HJTbdqBRcs0FGK&1kSXXR0nP%%EVJzhewOF8O8O8oMh#q0QxaR}>9)tgsU1r;7 zRaIT)PMb=ulHe}`J!OyZR$@{>QUd!HT4uR9MSS}v!eo0UDuDw}X5HOHh3;&6F$4YmY!pgJC|yUA`Q@O^Q@Cv@ zhV(6UK|lWazx?Yz|8?d-rrQFZ3jYH}8qE!g$&ZOW9u+g0-UZTQ#b6%g=?KY^3BAz0 zh@H`B7TUXNshmW2RGFfMd)wI@aZ@86ek7jLVs)NKXEH^_DBSBHr<4omMQb+A+}WH+@DxW0ZWcu){y1?0+;*_Gaby&yy5sDD z$Dz>HtEYgTDh2k2+R8M#(w$)c#ldqF0QENmA&eC2A(`f@2^hwrP<|+5lG0le^$95X z!SzLb8qif&=Vq%?s!iQQ#z&re^Y zazb+tm{X{{qRMu-qA>yTZ14HeQ(OxE>HPRlf9V`>7Uw!&gG<_*IDMbB`0*eA!g(q@ zMHXP*-T-PqmA`3(dYJidDr=XrUiw)CB1tJ4!qp`$+EMxqi9Z)aUw#{|pimo((2VPA(lT z$;U(PJ-295b+~{0i#bi_Z&^mM%A$`h6fGLH;Lv#kx3QXG3Q$LU?Q9^!+t_kSPG?k+ zu?~u3Zn*H%c1!nB_?^Bhm;u!e_V0*lY~zs%a==5aP4^zrg5hpFv=4`AY(T0S(Obre zMky2b$D=EIdvtUfMA*Cp{mFB_vUp^&wQ92zAcWCy0e&q#YyrNR&76(53n*3|f_bQC zj&DanMf1qn{EA0qvcl8-Bgmtq9ycXcnme*Y*lbe@Eh;vaY`s(ZB;3@u={QQcqyjl< zOJ1HMaGw;f3;^Rf90qu<2!Hfk9{fDTHP4c)SJ@>cqK{LFCNP7XR=e<2s7Hl|&Z3+R z>DKgmdBc#b9wW42fl+a09$~~W)%r6v*IIvOL1`YCi3-P9%v4~Wdve8r1GU|+qbuW0 zYybp3UUAb?oqQ2jGKhSq;+cSBT&5maX#LVh5Vc-vIDfIG@}{(<8ZhV(YDm5YlnX~~TkhpSKhE2KTv&g7B zyT(A{M3|_SU{llo!UVeSwa{*DZ{unp5yAGhbNu{>K@m)@@ZJg4+(abmWFMhJalKyK zaZu3#XFx$0V%0?7aLKbVAB%OJv8QWF)lg;-rZ>8ZDIjZ{`7UOy*$&K7XaE3#mHz1Y zjs;?UNfqJ$I=KYbSJ!#sr*UB7Tbz>j`E-i?s8)*a@DLZD7kA0PQ>IlQMW5aXafv~< zpRHDb#Bt6ceFq!Q1b+|>AwF1zY<#Mn>pZP1e{CXiaWu+8h55r{dItGDF3%FFnDc`v z_x4O9!ZQfnN*F!o6CXu{<;H%ouF7ID7;EZ)|7Uh%@+XFfBW^Y+8I=$&ZKeFmsu5oN zbcI_8*K`xmKmtgqtIn5&Z7LdKe))v{*?Q&j`!$JhmvGx+QKQ~-c)=k_UNQuiy6}Cn z=4g~6$*&I4O~g+R7>a7KHEN*to5)8OZ4o^~KW#RXX%w6>x?@;PM)6?cPp%&Me!t(X z_j;Qj(CTrzQ*YI`cKr0>BdIX#W)GpE0SJuK1r;&dgr*D>X=TO`=Xy}KTN#v{8bLV+ zNQRqJ?{#t^7_8kWa|n0~A;i)clOcc%edOt$M}k7J1!h%LnU8lhy{NL!DCyrX zt*G$D!{dHQK9h^RGLoUELSlx**}HBvCz= zm3(6;(9}i|y69}%%ecn4LR7^Lb{Je9plA7-zBnRt6vjM}NN;aCLElDdtsV6GVD*E2 zf;xWZb3NNFs`e*fHU3;Bnc!n&&nh;A-Krv+?Cv^shZ{%!)8Az>WX^oDc$@|whO{vS z(kKpw&HnK(RACk|#axJmWzXM~dLTbPv*8oS0W%Jtjzd12)+L*vZka(~ra6uHJU7?VLa=hfW7|a&WWDk? z)s-0ID$8(bI`v+;xh-%7psogmn?H0hz3wlLXYTX7tBW;#Q|Y6|Xpkv&KUOsssC~es z4N_@wa;rXoOXv#aG2|43ZEH1ad(rIzC8B?NI+0lzA48nM`5d*OS&jTGW(%GKXIJ`? zrjtl)Pu=DEGEx+3tHFBAG25&sSLQ-Leag$NG{bL5@^s6p2umrzK*@%Y`xUfo(EgYZ zuiPa3$&T~fpqec$(zAVtCOJ(T0#jMl7MD=5;m9|lV{^tx9TXkg=b&P1HSddxt<_w) zhK*}4go+K%evytX4$e?rgt?;f+BN6)6l>@NieddDJq_Q@DcQum<65@WDcLgg7T>-h zof+gF2}-Hj)E)Tj^=j7vve#%gs;kxLfj3XD#*u3o?HUZ8;Zt_mEc!JSj=NK^eU*dc z%hj&II`2rYrf%^))F-Us#k^LmEzrLp<E0~nUkqfK+IxbozB zvhhHq&)jjIK!#$h6viH0Q0oU8ViCGHaP~m8M%8{$MU&+XM%*`>3RN6W+qVOh34w$( z&f_b5(!^sX6JV&N3V4<+o{13&(AP3yeZ?Ecv%KTeEgoW-2h>$40o7_kR2TBxU1<=V z`&SB7u-as7*}!x`0#dGFv1K)c=tr&vDLT(#G8>1&XV9qmZG(ktU%<_SQru!<95}N; zNyg4^K$=ON>~+m9IcDkSgi|dz&U226FLrizw&XlVhX;rTfEjS8BDuY6@M;v|n^#HJ zokILEd-B5;8-+8Z8`eZ1f-)QZ=R3$X2(irI_R2)j3FaT4%b=^qUvIX2uhpmxy;e8qdxLtn?$rao7j+v9^_s+v zO3flc=cou-QIMB$B3e}G5Qr&zFZ$T`dwv*LwNO?Qr1F3djwiDy6Prc-K>j6_CVb$q zU0g7P`wVJI77m032>Dk^;lZrvAdLQ&pNptu)sGsrT08KXgRteb27{hAh&oNL)^3LN zIvc+pwwBmQ#{30qQ`4W9*;V*HFThypYOZ$si?(f5$D(XM$avXByfjB&6DH9Q|EF9SyB!A_^_vdGa542pk@pDRpO`3`;@ z1!vK@ul2wVf@B`&i@N06aP}<6)G9?%dJ@bUEqhWn0q0pV0=>M^0@p#(9?T1zHS4+e z^3}`VzIgS`k@Ni3SFc`XU%Y&J{N1ZJzjltEzWMfWUx|P|`t8y2(-#WV4AiS+9Lc$8 zddAk&VpqzN-l{S1u;z5~!P%{*H50AXow^_TGBpF#x&J;0x7fv za&?auZYm9OOBM}^G>Q1G_?c8C!k~g2qI{I^ahM*;Cy2eHKBq0H6|+;mp|=mUb@^8tz*w$q`ix=OnxaLRaZ{WXu&JJwK>?qOJ}Zm zK%(VA3`vVmXK{KKg&K~Qi&7TaMmC|WoW5Aic!w&&5*ohZKvxA>X{A-7WJ`3GBAtki zZJd->`spJqrJlR3q9dXVuLki_6+muK)mdFpsZ|!q6jjn|E>IVy7ar5f=&=<;41Vk@ z{!|;n{Q_c`4zNm%R>jQc{0;;s#@IcFZJ2+4F@hpq!k5Gxne0t6iuO`0`buWH zpOH}Y_0?(2ShDdr!9gmFlBs;hP>0yt%e=q12(kodjB^CwWO`))w@6@}yE}_I=Yauv zt$3&0^2>MUEoz}b9{@9~`ZP5V0bClp)TO%}o->loNQ<-{LvITkFX(=RH3=7-sqG+m zbw%pGr}_vgTae4uJ4eni&ua@a`cBxVy9;`8fw`PKp;)D4VLX*M4zXO5$Y%29$=*J~ z!1?fP2_yN0z|&X&0lygrMOf3mN{;id^XaQcEz7fxo(=uK|RCf)NVE=*{jRGP1FH0jakTO@wq?3sn7k7@%ilh*@QB> z9>k|Hh)<6j*>^__SfJgE)yl7%WK7LTNiK<9`|$dm#Qw858io2^N~uhISJ%z5jNfo; z>YDxf-ZQMyL#`a63j(gk3W#ww;Ly1bL4YNh%c(Z&H3}3HKH{-s-UH4(l1@oDI>>AOGRMPyhzb z6!W6C7s+Kb88Z1v_aIj@xCTrlgBDlW&h9v5yi-pgR;t3gv?j)bE*L<{P+TmbBo&zV zm78`cc`uVSeaw|CS93i(nBpEDt2^((9#k`Xfx$`2@VJGAC~dk=A7VM@fQqwkLg{q! zK$1S{c&2F-GGP$_peIfg;oTB2H0L#O91YiLn_^!%1gQM19`Rl>v=qWABFNWbEW&3n@yI4{SL&7BOv1QH?Xjq zRa?Bz6TkslR-3`>V;$ZOebIsC8Bwt+8&b*n<}hU~3ZYpym*Q;zcD>Z`ryg*Z^u zza{%0MWbQW*}F6!{4~xN8&w^yrz{4PwUc;&+)PxAm%BaXd=+F!8;a)frr>PNmK6@x z-nA>cs^~axH|*mmw^KzAYFu?EAiPa%gx$?M*G?r$+}ta+!YKx-@SdpF*^;fs1f~sy0)3qPh&)T|3p>Zo(6|Uz50Kk4pTfbtBO5#vbd+p5z8V5z? z5Q8oNU;FUu>!V|=S@XSl#%5^|P=PH>wkkmYx_>)-VLoie|E+9-Ahdk%WFafk+ z7eHoX2#`1fzEN=iIuM)INAyrtF4S6HVz9pXqlhi*64ZHF3#vz!mE!WlPmFsn+vH>2P!eLiY<*>(Frs4q+U(suD6%J{8?ncp5 z#vKwzxA;Orz>KZx^vaY+bY$GaXIx5ar09Oe(i6$P@8n^vY<(HcP&vhrnjV5QLz!B@ zwv$V!iS9@@MEko^r4XI+U1@_O1BQdy10XD$y^Z~WpYqeH zsMm_p2sH-TgE{I9MCSw zdG^xnZ8LR&pP$Et+86;Fgy97h4fqg8mjzBlTq%bMCE1e2U<(x`^Q%V;2K7d>*X_&d z5xvF5BcyUf+0`uc-d;&!v4Z3v$w~-eeHAU3Ut*1jLmO+wPIwiY)a>dyky6V9H6}(i z6?S$%{^9S_tjq}Oe;Gl-#|gU!7?}nK^M0IMj=|f>Ck-10va#>RGH93l0e6Th;#67D zAJCFb0cti+!T=kL^mBt^IBb%+*jWKL=V2&a%xdVF0&wRL=XV3weK8G6d@&(P&cliJ3mx89^N=25&r6XK~mWL=)=AK0aR(_nnm>zc{fq<}Zo) z_eS#v7viq8euUTu{EQ|0K%w-0sRCzXK%8qWkGA?AuB|}j==}0m*zJdnr;|xC*?7G1 z6g)7g#Rh^RMyQfmBFl)Lfc)n#F^{q|uCcB@^s(F`Hb7 zq%v#5tr2d42=7P)H3whQ?nSiwSe~jyx5e%w6qkYyjW*k)HE~~k-sK7ulI!iWWWVL4 zTBEzzOs?`TO=a_RdY`}`YK=sggXXGpm>VS8>=(3Lo}?~RZ;lg~?ggnnuiz40GE}Dy6CVIqGac2b1Y%BuWB)QaS6G)PaiY z<;jBuhKvf!D8mnm2<=ysI4t50^UH6vR5S7x~ZCzeNIMiD~bDo za>F!m4n^W~k@q}M$?+{2(Vr)QKcad<(zP0!RJE07-s7@99h%p8o_EvE41bO+b8~lY zuz5v3L!cB(@aX1CGEIrWuo4_N^kYwMF-+L_6Bs2*r>P5N6C+2-77z9xxa$(itQI9V zMCq7qzzFpS2at*+0QdP6z}RtgtLTd)mFwjDk!pL90t-^%zyJl*Z-?=aEhz$hH^@3{ zOI?{Re`jaM9z#+$GD#L6)+=z8mwwEKSACXC)d;zmb6Bi}9FERQPbl)+WX8h}5_VeX zbx;u<&}2LzXD^3QgIJ$HBtWHD1~@^iftnQ*V7K%=%#I-;K5S+HwI9d96$T;kl@6lm zWyHe}#5$b(JVtU=IqrEv22e1hiq+_~Cxsbf$9XoJ0ER*rS2tp22QVX599z3`6A(H1 zPOxL7T@QDhJ(<4M8O84-=lS02Beo-AsFdJ5M}I73w{`dg5ZdOJL>CcOGfGa$lsp$D zzK$jYh7z|`5*IMYBR4!hCz;1Y>k4H=f;h=KG86BnT7Br!cWrxn$2lAVTaC4J$XCi0%bDW&vN7~04uWJYZC3Do0AKHxTFH%M}A;+A)1fk%c%XPh^~ueLg8 zI2;ZKzTfiNyNRm`h{Gdy%ESv!>8;nElLjVT*x7z_B}U27!a9~J zRM`pTD_Fvhc|?;pSy*(EhIGQ26XG0*F|xR0H9ZR5c{W}agmk|YC`D0d&#}hz&vu=f z-m;)z-wVW**FIp_+_He2gnTNm!Ql!NMw-~lPC155C-M0^_VMPQY@G0aw)e!wJg<3W z#9XO2Wj%A1HCa1zgjeWWxIbco&HN#hhQ_I=L+HVTrvjTqhn$U90Sr_`%34L2DNzT= zY)9(Otcx5qq0({r28zO{wOY#OuHHndF5c9>R5Ftq8}MaVM2Qh=6khn|_isrRus@1} z_YSWVkz-CmL`CtNy_h*a!!e?d7eHiiNFjMt(jUAmJ)4aO*48X=%>vgf@N;E>YyS2V z=Wp!)`^m+X(8$XMdl}(Z_z`CfE2H_0yik^$2wOS+IxiymN%%!Q0xVUu1EY{8R zg{WW%(C-2rV_a9#4A8gCD?Ers(N*!Gd$VihSP|Q-dR3lreJXBRtV{EqdDCf(N6r|= zQ0khk%4Wb;Kl@$6IO+R%9PUnl!a~(BXOphe7HA7?{q4A9QhL?K&F?=d-F=2?LU7HS zwKIC*T*3*aGc0jOwdH)Ur2n3)%?i!j_nXD!9Yp2kX<;A$poEb=iharo{~`5yDd zMVNe-Y;noQSZSu1?b)CigJ|n(Gdz zc8ScU3AWW(7-yW#FrF}cXHrHoq2OggpT+iE2xsQ!ui3}* z@GIY8nosDzxG#=#j!uf)?k#<8cKD6CPxj&0(S!>YD~s1&>lkl}g{^>tfsWC511_&* ztjY?PWMozO*vc3$XZrIxW0RF?BgNc)I(?3AM)T(v&5o?T;PCb9OYk*bJPft7kHb@< z%^##7Z`#4j`P~j)7P+3Qp6A&qxyqrtxc{!QkFMMiH(Qj;L30mYnmB79Wvb>f``iEH z;8jy++~Pq`3Oq~0Ae6!?2!0x9f>kLedFMEpvWxSQVT)v%ct%P!|rfkPp*wa)AW%L~)H?$mWeb%(%Szg|hCF(m`tL zlx=_3{N=#Odc6HqAQogjD@z2$YO{y%kIfE#+E99ftZz_Vg@-!D(^Tk#RAteVtdcKQ z?!a)XWbB!GEeBFJs#+ptj358$FP+Cc=pdc)z>_SB3oDACc8h&;%0A!~NR-A{Jp_^r zPbhAu-m5vGf0f#2ks&%b0whp0Cd1FOK%Qu-kKXLGY4kEqY^#k#sQ05ztrPaW?ywno zt*|ll{ARu7_4U^m>g38a#6bbV1{N%86?OdtXgN=2Nk zkWJ#n;iz6~N5j^z9(b)_*z#Jn&d}=*2MwkXOsMmUPKxmd4q2DbYA&Us6vE~lNwqwq6 zvZ3lV8cW_9^@=oxUB6Rr4!vHt)%RMhpzjTOgUIW(TK!II;4`7Cx5O2B&4n7c62>hN zU!gvoNrKaxye!s@yWVB_Jn*#tCEzJMv+gWnv%WUqE+c{8ngG56`P*W^oh#ew*;9X@ z*9-!#53;?=khMguM+dZgGX&XIfc65H}_@~L{4=OGGw1ux)F3Fc0hHDP<%UleP zYE2d3$j{5cq77jIrR=+D$yZO+N6*S$XImBX^^uCgs&e3j?*{#*}8Csn_4@Q6SFD?B2#M|MW^sqK)YygJ6yN~7t# zqoQ%Lv&uqbZprPVlNIWoRXrgmROL;Bq#A*6~EKy^TuNr)$XA6(N;k;_AOD{=2xZYy>*_YRz|-iWJF zDTW1E=aCur6{r(Yx{UYAv}X7XXc&Y;3KB znH<}!!lmpF&+vu%UHQ-u3^Fq+4@IU!BcYk7zy+ssu=f>h_t-gnO>S$>{>xV`&jZHB ziY}%i0UPF`eaR{4|)m}?ic!kz?#JnT0ne?@dh8^K?@@=e!x^rR-?gj30M9c6DnHiL@ zSZM&l)8iv1JI0}4O}o5u4@UAPNGmq0>5Xi0nD;|*qz5j~m%5<^)NHP}ct&PFiv^2} z=3C3@1{v1eqh&7A^5Not2HH0R+b#a|FRm01Gxl!Qh6CYI=&6nXKF6{dViZrmTpbGLbt^E-? zH((_P^z*ZOl@&7EoCwFc3GhE;g!SJL8(SS4%sAk3wD7*TCpneb+;S}7yVsv93lP*F zA5TSXX`cB;IYX1T41pKaoPNXmBFb!&e-M+$#A9v}v15$bOM>J^b={vQ1EY7q(rnD~ z7UPVlSnkgRI(ek2I8xp7O3(u^_)$C<=x)n%!f4G2*PQScIAO!W32$CKYP)-uTPH5j z3T~Z6|9U-!FJA)VX#MV8zkACp^GkU5GHmBPAxcZnC`X1*hb*7}>F*HQg~(z^L3}8v zQCvzwSZYoehamy!k}+G0kQ9QWpt?;OPAo5VD0=!5a&pa09h{_|fuZ$x!ApI(28@zE2>UkYax zMoF}z51<|#BTC7KEH@gEEeXZ0nz!W@ zL^Qm!ces*X-Sw5!lMbAM6?eN&ZqH zQZmG=I1u!X1A?WZAkg}yfw6|7_H>EXB;=zM)Hog}!w7Ytf zhv_U|-OiCemE1TDccICH7j-E%B}frKq(cT7z!3NOy(R$|DCUid397&ksdb!?^gvJ< z!tjjFBx&qvDXMVuM|)9J1Q1DTCIa>v#OnYxe5C*Xo5GuitO>yuq*=40`p( zpw(>=)|Ht>p2JrXn>f@B*Hm4t#i6x0bkk?D7Kd&_94Z^nik%kgc5Qnv6Z6P1OvxY{ zTn2?n`coG?ia&Q&9@GR6`= zUOJ)6I#0{}$$#+$v{kUEk|doc3P-$X^(%I8 zvsVmAO340LaGy4w)SDZX?@%?QtaOD$p4ZxH(f7}s^A8?rxC-xWDw-B7l4}^#on%g) zc`=4~l`5dPnmRqDbSUcg)L;I4U`fa#VE`_$<>qfg-OOS?XP;~fV%-vnBS^F)u+HE`@gRgK!pRzCMdaM@xEmUyf8L4N3#fFu?otswD zt?+ytaV4+6jpYvbOV+{}d%3hAuq-=Y1uI{UjT?PS3on1>7eNzkT&;iv0^M&q zQD9CWF|x?n%Gwk(nVXHyULFU2iiC6yW~8f#3>7m5I(o`L6(a~3Ytlfq&Ynm`m+k4T zrVaf3j?2s+Na+JRCDR8wM*cwii4|lJEIcIIPU^MbA5|Kn^Ezg_uOs*<{QZ=@>lV;q*lktJ`u) zS)znf4p~o3uMvB7rg{D<_8!^p=Q_a3uU*%>5Xi%@B!t$6pvGR5>ruMPypG2Tu9*HX z{9S`WOA3zggdIyb)RPqCIqgE<8?I$8bUwcuAAJ0B<&O4G$LVasOM5@arB@aHfYjgm{)NkXj0LjB+sO^`Ln-o487 z+>evSSF-xCoo1^VMPNA5C!QdKa2|uy;GO&NXpnq#*&c=73;H7q?%B#FKZw%+PUp%B z8h<$3zWVy=l))TXzcU`*spXqofSlu4T3Mp2vQ{5IessRJ+-heNg1P)LyCi4+jIt$; z*zqf?-W!eR*3)Sbs^I1#nSciZm(wmZ%#;Ki3gAqq~i`$@umWl^|75A9Iez=OD-W z#+;8--dpg6x0hV z-|Pcrj{R{ES--Y3P4TUTX^O9ORzFt0rjFc|q(D(^W4YoxT_bLeE+%I$jMV%R)sN~n zX()Dh&g3{oyEq>t{YqhLdh?!~QVUscfb< z9P)UxJl$pg-%l>Ca@xKg_ar8s$r>KGY|Lq-o_Zs zA!!BVa)p#mjmj7{2mNL{?0SQ4Z|Jq^|9^W=*W5Oat62p-mmWA>VC!jp8Es$7p}VjkRS<4q$Gc3 zq?vLg5@<9UjYgxp(Qq2Zeye92{XKhcch54Ljdp#3NfUXz=&|lp5__!9soc{TLm=FM zhpnr$@P%Z1KtLSVqgy8fdR8qr6zh{ucjwT_H*oSPF}s@0Rl%$ zbqw2acIv&|U1z^_-DjQ(&a(xl%ldef2Ex7J)cbKfD(SwBk4CMJMEz!tM131d_N@k% ze&bhZ&o>99b@*bImqc7@(Y?n~hL&$4o;w<{>k6*DHZ^C<8t`k3K267T-iS{S@5_!@qEra! zvs8o>K$5!|P@yN*2Oi@T_+BEHcN`9BjjrObOyOxvZHyAT2sOeh6ZO;)QK>J9+b{x= z;!{QDbRO);TnZV68>v9pS=|z$xLvvmI*wmo zWwTe`uGU4;Xz%r$=1$w#b?Q4t%e0%u{$6|6sMqbb)id|^>>cZEd3)4KT_oz!;k&ha zE2{plT@TBxUtd)d>b_HN*p|~U`Yjt-cF!^PciVlVx3|~ZY4`W)c5i0^mW>qSw@Lfy z^TaIFF)deE%y^DrRmcQQtJ;NNY!=iI=BhfK`PSoMqCGX zSNUAK4%V)NdAotO9VSi25xW^mT7gSG46{<{utDK`gh3g&q&^v8c1ZzGFsNsmEn zyyq`US$LxzWC<%TYMz~=lx`atw^6M}lumEXeQ_RGqY&9Fj)$^U?Uag_a%+&KADWVS zKi+`a@4GnkA!w|+MtHPVgbC8pAMyQ=b{AmY)Pb*4*LLw>J}B%X7;DVimqU*m*@*~r zB5X(?-K{N2ZghVXxzG2_e923m%j}H&(bdqOCSv>JqfCe7pMtdl|HTz~1+8o{T&ZwM z&$?HbyD0hf!eZB}Nb!1tWg_tGFf)%5k1rp=Na*sD=_(QQzbu2ybaHu&bRG@DVOsQxoV%bv z!N6fjAM^kV)86Q~R%9obx#h@8Wp%YsIGMydFFj9sBTF;R)6)>~C(f2=dskdba_=zD zHr}RBTyn#a!S-%VX=1UY;8cA=qYPWoQ_6$2jN~YhpZ`5|d2kO8_7PYP z!lcq&O~wm_;udlY%;{mSI37R~;%sz>{NBpxB*X+vSkG6IlhoLe3q+xqr1);jbW3*3 z4nv?_FBLG%E?v)i$o}$^J2BES9kadT^UhJMu)?E1vM=Ai zuch!XyupVO-T3+!l_aGTSK&Y#eb4{29S_&Gg~{6tOLo!-koo_J)93&za?Zi5R{KOq zeL|}a0$~vlMnI6PDGsFER!SGnT+VQz;00xkR3!`%J|2gdu94WlpgAsr6CSw0y|4me z-MF>|%M&U;HZOwP@&rTH_yThKA!2F93a>j@tZ(h~_jggq50U>q3;uHi`Hr#PUb|JN@UH4g^(i$H#%%4I z4R^0;wCk2>w5*0{Sj|??*s0f@R=eG>+U@oNEc?Rmo&Yt0xHi|=V%}YKunQjxeN4)E zz<+6DFn-}|7e}__f~Y>lrgH(k@Z(pBz#04#Rb_FANAZEb-C&T^QN&rABYLL&3(QA5 zoq#4zK^YX2fm#xuB@fkwOXek&zcQ+WShPkyE-pdLN@;|J(X)9Qo6$RM;gC{PS}LmZ z9O*@DA(SrqVlg2SNNL|BJC0fv*<|fbL1T&mImBSYY(Oc@O{6=rz zCEp2z<7=5PbC8d&E>`+(raNqPV063D_t?2wJb(x6drBo-Qx~h8Rnt^W1xaJ@7yjle zC#ni1JCtS(_En$)g50O$0!c{q8vTb~(Yai*b{{?u=l|gZ!5fUeq}HFW^Q<#wdE+?S z-hRx?Mo!MOG&qckFj zpG|vF8JYp~^l3ms+DW`x#4~T^x#lypoef3L2AO-f62`naAT@@+2+8Gt#U^xa}~!n_cH>WtHg$~Lpip~l(O;>~!hEd4Xrx2lUpCETC^^{yC%J4uU+-cPU+ zbFT&&JGSqVMxHYNpotcA{EQQz#@^^Ht2vg!Pq4K?v!}%^VX7rLVaL3m*4rhGxBTzg zUU^OSN{--f)oN+(?^x}&Wg5Gd)i7E+?UvDVnmwb@Y}Q-*PP=c`%>_(AYpdlqYqeaV z7NgoCTW;TU8o+~=+3Xvwp3^e+-FDk(IQy2lV>x@)?jmQc=h-4L8*?xiPb5T?QF$^c zV~*m>uEv^q?~RnVYkExC^VX)vdt;F*ChnHBHZ5grx@B9_>_{L4oEr#qV>YL`i&=4_ z)KWI7#Z6MTZjoAvK`PH4#bGMvMHD*iUx8Pa(Nbq@Mb$NlGaf&K14#=RaK+v#@R{dc>DDr zn1KLrp4C?qFW7m(}+ zRKsa+N3KE*`W+RuJqg z{P++)l&b2FFlijrHP8K6dv#!kVo#2F2jdrNG4=0L=qP3XRm0Xq3#9}6#=bYOuMCj- z2HG{efi<#~us?%(oc>)l*6$dNYgk%i!YK0G6A;zJ!_3y%+)4Q%7d#M-mcOJ&TmoxGm2nD6D3y z#aJY*9OA=iNGdHQw4760sI@|uko%mX)l5YhRzP5y%UPaV2?NVg`REHlIvRu#s7!{- zGoaYHKX1Q)Wm1}{j4_DC-)taCK|Q1*KxWm?NZon9=~Qt&)MMY7!!{9nV$t+O%1LjT z(ITVS66ukuib*`kFeb5}c6o;tLw!O@b75sIt#IfxpkijL@4owv{TXP1&ZA@LfJ!YQ z;=OpCT|{OZ#kRIG@Oj=G6p+$EhH40z2m-E#lJ*rTco^mm$`0nA54j^uG$(GQ3KPz= zkbOk@Mmks0-6fIXgab-XJqNvMfs5LJ@I@-AVSqb9M+qnBbVJve>(pdNm^Fp9T!9g1 z=}|GNv5pt|*dd3TXRBz^^GB|%Y1zP8GRqwJuC381m>SEeXb)u zMIEuj!ApG-h$(gbPN+kdH`mdhD@a%{SEQ!>l@AHzoDoW8hD#0`*w zw(G#QskDNr^dSb4#(kwd5TkAoCmVRT19nFHv}|XRlSBY1FgABfffhq@OPaH2{oB!- z3#b$eE2GlVSy~-URm@XJ*&K~D22(;ORkZbG%(;S5p5V+CX2;oZG!?SCr8p5fPp1^c zVpC>m1+RquSWp>^ZAZxkKeB1z1v}g>;>OH>*A0wcb+W1KDdL+j*hNH_%t4xlR6)?9 z)U(23!%@zR7qU##*mB%rWR{a5SNsWRQKVk-*eg)6WDRbNi&Rn3h4NacUI~rKW2-{> zhV;@G2{n{7##~)g(O;9{V+$*!1r^b?I=U3%Yjt#Cb@Xnjps}pDC1v!u_xb3@m?!R_ zLYf!hkftDukMvxxE~^b3Sb?5bP&G@JUY((?pcZyBs?>^&Ynl1>6TkW3MieLRxMxTH z5UpdK>BR5*pRB-1rFAygmRzAc%H!W7HR|Pb;sFszPay2rY88KoNlO(B)|XI8cq^5Vk(7Qa*!7LE@o9T9o~D;W>;7s+C5N@q_kqQh2I zm1-=ZPI;kUI>*`%c*ezjkY0ZYRKoP z5i|{q!knQNB<5Rq_ZEL;RBmb6=M>@ux`S(e(S=(C`OR7`b&GXuOqo@aQwQtUa*QdO z*##iUrj-SkEi6n^6A_}F6HOT*%S&$&!K2_b{3R~{oE@2$YJ79Est;~l7SBKAE~!Y><*iMNC{~4>ggglyObEFs#)~yi`|x)+ zF9+IjDt>6Wbz~^RgSIV!l3Y_V56bR7(|x>q3(YO&aFN8hziUk1#xuJvBxLg)TcTn( zgduy#@GjXn2V+A0)ZovXKqRT_E6(HXHrKALp(A*+0BOecOiMX9)VX;@-qMaa( zQNS(g8zWy4oSRuVXF}}A3uf=tI@Bt$4kb7EV!4;w`kT4ZH9pCa6QP-Vvnm~c>j(bu z+#QZRkbGT7U@?MTyPk0@$uGsOgmg;21488c(7uH2C{>h;;RUeQv`1@T1Y)}rpXfHa zVhD{lFobB(2)BEl--CrR1afS1kTkydvc^~RuP`@8mFn+*$5J1;c2pj+3M?7gBAl_h z4wm`#BajuRT)6Qd;-OPl7J0DwP74BXcQ5?l3PDH`Rnq0YCLerF0s4|IPwOE=G~OrR5= zR#d3;V6*xl9@CoShX~IHRZ;ta99iQ*m3c6%;(~${>9IuDX%W~5s2^)cUx6M2NhSj~ z1pG1-gaS%_LF~bwzDUqNyH^KunD`N0X#RBIxi||CI)4WV_x?-_Z!P?I@rWtl56F5V z`-bKU$90gaxluz|=VSA~YJLeRQAKn!F&T}3avr~H3-H2gigP9`da{swcu*n&Zbx?& zgSu*aQ#{}UIC<^`Z?DP%4qNqAR^$4V(g7BCHW;F;u%LB$DYXdX=gELo@FO?G{$B6{ zJwQLa+1_%7gAr&xfGZyHz~l)0z`C$F$swWBtC;U2^vO3mLROw28fdCgFJVrYq{Mp= z{vXJiCJ2PqD`-I;V`jJp#V1W3sy-M|L$YdOtPXw8qZ+kGL?v8+LY|h`9ofKm2WMB% z=V6WC@BZsMUMy;8PFXSOxGcd0;`QUv&jEI)?ltr`waWZgMyM z{_wfJO{yz-{78sLP1o_G>pp&pBV|aeUXCRDN8-64evw?hek41%>~+xf|J=WL@(~x} zRUxT+{7%Dg=|^c5RQ;*cSBU^J-2MQI)6X*mnJn{KFG?esBi^S(sjU4%YMHvK_%f&7 zTp_2{5uZX5VwxJ`^)?qvyXu#2wS#(}U0Lt1dh=Le_ zYcZQ9M0{MnC$`0&v@+n?0>-|*PGk~7CrJe@e2?Caw0cz-yF$7lA_o0U zgZKx+==a}N;(_mBaUp#j|x*k8=%{IjG1a#L_o&teEyr7f%ZROZ?2Gb$`{tV_7 zx&!p&CR#oXT=;in6H!mjoAu-TvL~=(@Eu;ze5NfI;@wHOKf;+#nCOeazAWJBYL0|) zW;WQk{FC`i0;IgSfI(AsLO%sA@O^L&T%m11R5`zdRxW)H!Pm8j5ZP&}eFUl_Dq47f zFeN2abd8+kpPU^-B{CxARisk1U&vAa-)WG;4=yGgsbZTE9Td&hLf2eng2#XD+&)yE zC^AUD>#3Zea1LP>*jjQk+?mtn4nY(}%e5~@gTGDlsarWW>kX|VfWO<{%YA2>t)h6i z6uWwCjmPLCD$64Mf$KT*D&r@2SISVgMU%2c+n~-3M^ff< zpEX~HbJ#LxUpj+dIhD?(62Vc_v!xcq4bl$}kq|A4lkCtRj`7OlYa-V(Kh%%Jt<&mk zpwXL@(u;6bF1+Gs@g{zn-c9TlV6bAiEyZLV9^HF4`K%uU`|o{+BN*&wTxwv(ypnGokez zCWuJ->a1!<@#ZB)iEm*ro`B8ra9ANrAy1omB{{Bq9V^>d$O>ooGK=k8%V?^HMYg_$ zO;&f>IUiY5aD$!ip`UM=fL-}2J@@53V`;;Xsa5LpT$F`6SkiU5tVx5#7K+3$X-nqV zXXp1T$D|~{uKk^Be`isD=R6^+{#?7C3c8;b7b0o5RIUtJ#NapAD^(ot2t*3~thZ`; zm@ANy654(DZZ+n3w;F5j)?gLhEq>--TA$y5bXBd91N65il1&zg>~lXzSX zLq$XA1_vN+J);MrIh;}hbc>mF22&9>l_8r9hHgK|F*l@FOOdEPaxd{6E6iMn+)kMn znD|=@x2)?d!jc^@(|PoEgb!hmM!>5B{Fkuyn3 zwY1h@85fcyMW!x5Q2Zdoe3B+h%p)p(QiP>PDsht#XOLGZkKH*51|xegw!9Q}J~!vS z>K-W%!_Kj=#HC7;b68LnR>%lhfuqW~85$ZoPW?fdS-iIJ=;GTW*PB?-twNymwYwu+ z&2a!VjT;%rY6m91=Z`KnB2b&`@qseoDKTNPglH^Tu(*fW)JCLc{L4ATRQEDExAleA z&SmwJXJubImqn4abNL1xG0QraGh+T)J#DYXIZPu;FN|Bs3FWT6-acP|!fEnqJcgmi0ELAFaKe%X&N0rm3#exLe-NhK^rLcsn&6 zT-w`N&Zfn##oJlXrYOL!y`5`s=i1w;)SJt5YMpEGb`}*P3wt}4wcjq_3C-(M1R~Y7 zBA(E)FjpW!CA3^m=!#bFL^W$-UwW|BH;n;z%|)GBMr(N^!KyA-Dejd=`A)wiQz-&J z_&9*J*fDoefbyIehG@l!s>m8~g_<3HOmc8id&q4Jn6^(>gUTEkt`%bDk>pGlM97u- zl|gvq0_SUOY88>NKVhZA6idJ8=7>~i&)v_H?ZZ^BMpH~L^0NON1aElmpM4mND@iLG z&og}H;x&gqyJSI3Zy_py_34l|CSO;Tut`iD^tN(*7N2*QiQy@Qk!Hn?OGxs*t)!ux z_~T|?{gam`&1{V$>*DxgILWJY)cJ`WN6uJHg8=l$C$pMlKjN*jBS+Rf8~eT|Zuv#~ z#)L&rGPt?k;G?|nLjzuhhQw*5;u>jKr|#IxgM;rx8Yo%ug*(9w>>2-S6YfyjgU(Du(cqE}{E@yPlauHGPPC3IxC|mi}abD$DBQ(W0 zjAswj4qWHx+#mZO8FB>_%~2Eq0XZ(axY_|?i3wMk> zk?ho;D$?T3@!4xGnclcPWdTU9Jl*bD=jgcmf{MZqMjn~`^{E4!8BlqKuf~ow$zAEN zl!3*VESE#Agy5b{E{%+T(~LUl2cE;;U~+ow@5!_W8rUV$Cef2v&y4l3j48=9>P^*@ zbQ>yZ<9?{5ue&F6R8S}}Pv?~RZ~1BRNZnK}yZM&1%&b=^U*%NDUd;wHq#_o$>G-UB zR8`^|Y-Sp`sN0audJa4vmV$hR69be(nVvVlQ z#*uwbPtFX}*fC%ZwcG8ToxS~5(`fAOw;S!0z+Q31|y=O&+pff{j0KZb`*wL;@2WH@k+!jCy~a?FM>$q3Kg?7 z9u~4={oU0vo+i(zhcS_KjM0jXD4xr2K^N1V$t2V~P!%JB!x&%5e6KLMsdt4$h^NFk z2AH5?3R9KLiZOdC9mb1rB>ofY175|>qAY?};!;C}btekcDj^m6LpQ!aQq4ffT;NJK zkYhg3F)oh;A4XD;V#2xAejAg^dfP&F8TiyAh1K#5;A3DGV2Bg`mUsc9qg={SL*o)q zB6DokQt#{mkx9LUa!Rsq7$4AuI5!3wRz>=wRMRj)i z%d1+KPI$p5uWKRn&*pn zFOf(WERZU&a8;Wt2R{sk7c2~Hg)E>c*Z4w+ny~v_E@H~%jaZhlfu^i9u zJdf`@Pw(;`-UODj^7YQn(>o(SZ#LjYpANQ~DVNX1i7e!YvY4qqrjz6ROTZ9nzL|CA z&yOFvuI@CJ?oMNw?(mhXOh3j{BR*2ff5*d9qBnX_a+GeXQ;lq=v zFD27fgMV`w{F}Frzy7|5g7~+V!GBJyW0_E?qKP2{Tu+%p3(AHjeyoP%%Zt8ry1%$(GYu2oDA$`MdZu0~^e@LUPM{~i4Q|4>T-0u%rg00008057m&Sc~0GOeYTj0A@b`02crN000000096X z000000001Ea%Ew3WmRcJWoBt^X>@6CZZ2wbZ*EXa0Rj{N6aWAK2mr#cVpz7U&i>s4 z0RV{?2mlcP0000000031AOHXWTn_*MZDDC{RAp^&Y+-a|E^2dcZcs}F1^@s600IC4 O0E7Sl0B92d0000$Nw%2) literal 0 HcmV?d00001 diff --git a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/createUiDefinition.json b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/createUiDefinition.json index 980c54ecb04..744f5f24ba3 100644 --- a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/createUiDefinition.json +++ b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n β€’ Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/ReleaseNotes.md)\r \n _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe Exchange Security Audit and Configuration Insight solution analyze Exchange On-Premises configuration and logs from a security lens to provide insights and alerts.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Windows Event logs collection, including MS Exchange Management Event logs](https://learn.microsoft.com/azure/azure-monitor/agents/data-sources-windows-events)\n\nb. [Custom logs ingestion via Data Collector REST API](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-collector-api?tabs=powershell)\n\n**Data Connectors:** 2, **Parsers:** 4, **Workbooks:** 4, **Analytic Rules:** 2, **Watchlists:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\nβ€’ Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/ReleaseNotes.md)\n\n β€’ There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Exchange Security Audit and Configuration Insight solution analyze Exchange On-Premises configuration and logs from a security lens to provide insights and alerts.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Windows Event logs collection, including MS Exchange Management Event logs](https://learn.microsoft.com/azure/azure-monitor/agents/data-sources-windows-events)\n\nb. [Custom logs ingestion via Data Collector REST API](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-collector-api?tabs=powershell)\n\n**Data Connectors:** 2, **Parsers:** 4, **Workbooks:** 4, **Analytic Rules:** 2, **Watchlists:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -293,7 +293,7 @@ "name": "watchlist1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "List of important Exchange Windows Services that should be monitored" + "text": "Exchange Services Monitored for security reasons." } } ] diff --git a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/mainTemplate.json b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/mainTemplate.json index ddcb4b50991..52626486d9f 100644 --- a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/mainTemplate.json +++ b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/mainTemplate.json @@ -81,7 +81,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Microsoft Exchange Security - Exchange On-Premises", - "_solutionVersion": "3.1.1", + "_solutionVersion": "3.1.2", "solutionId": "microsoftsentinelcommunity.azure-sentinel-solution-exchangesecurityinsights", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "ESI-ExchangeAdminAuditLogEvents", @@ -91,7 +91,7 @@ "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", - "dataConnectorVersion1": "2.1.0", + "dataConnectorVersion1": "2.2.0", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", "uiConfigId2": "ESI-ExchangeOnPremisesCollector", "_uiConfigId2": "[variables('uiConfigId2')]", @@ -100,32 +100,32 @@ "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", "_dataConnectorId2": "[variables('dataConnectorId2')]", "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", - "dataConnectorVersion2": "1.2.0", + "dataConnectorVersion2": "1.2.1", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "parserObject1": { - "_parserName1": "[concat(parameters('workspace'),'/','ExchangeAdminAuditLogs')]", - "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ExchangeAdminAuditLogs')]", + "_parserName1": "[concat(parameters('workspace'),'/','ExchangeAdminAuditLogs Data Parser')]", + "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ExchangeAdminAuditLogs Data Parser')]", "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('ExchangeAdminAuditLogs-Parser')))]", "parserVersion1": "1.3.0", "parserContentId1": "ExchangeAdminAuditLogs-Parser" }, "parserObject2": { - "_parserName2": "[concat(parameters('workspace'),'/','ExchangeConfiguration')]", - "_parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ExchangeConfiguration')]", + "_parserName2": "[concat(parameters('workspace'),'/','ExchangeConfiguration Data Parser')]", + "_parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ExchangeConfiguration Data Parser')]", "parserTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('ExchangeConfiguration-Parser')))]", "parserVersion2": "1.6.1", "parserContentId2": "ExchangeConfiguration-Parser" }, "parserObject3": { - "_parserName3": "[concat(parameters('workspace'),'/','ExchangeEnvironmentList')]", - "_parserId3": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ExchangeEnvironmentList')]", + "_parserName3": "[concat(parameters('workspace'),'/','ExchangeEnvironmentList Data Parser')]", + "_parserId3": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ExchangeEnvironmentList Data Parser')]", "parserTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('ExchangeEnvironmentList-Parser')))]", "parserVersion3": "1.0.1", "parserContentId3": "ExchangeEnvironmentList-Parser" }, "parserObject4": { - "_parserName4": "[concat(parameters('workspace'),'/','MESCheckVIP')]", - "_parserId4": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MESCheckVIP')]", + "_parserName4": "[concat(parameters('workspace'),'/','MESCheckVIP Data Parser')]", + "_parserId4": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MESCheckVIP Data Parser')]", "parserTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MESCheckVIP-Parser')))]", "parserVersion4": "1.0.0", "parserContentId4": "MESCheckVIP-Parser" @@ -185,7 +185,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Exchange Security - Exchange On-Premises data connector with template version 3.1.1", + "description": "Microsoft Exchange Security - Exchange On-Premises data connector with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -261,7 +261,15 @@ } ], "connectivityCriterias": [ - "SentinelKindsV2" + { + "type": "IsConnectedQuery", + "value": [ + "Event | where EventLog == 'MSExchange Management' | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", + "W3CIISLog | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", + "MessageTrackingLog_CL | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", + "ExchangeHttpProxy_CL | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)" + ] + } ], "availability": { "status": 1, @@ -886,7 +894,7 @@ ], "metadata": { "id": "5738bef7-b6c0-4fec-ba0b-ac728bef83a9", - "version": "2.1.0", + "version": "2.2.0", "kind": "dataConnector", "source": { "kind": "solution", @@ -1035,7 +1043,15 @@ } ], "connectivityCriterias": [ - "SentinelKindsV2" + { + "type": "IsConnectedQuery", + "value": [ + "Event | where EventLog == 'MSExchange Management' | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", + "W3CIISLog | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", + "MessageTrackingLog_CL | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)", + "ExchangeHttpProxy_CL | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(7d)" + ] + } ], "sampleQueries": [ { @@ -1677,7 +1693,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Exchange Security - Exchange On-Premises data connector with template version 3.1.1", + "description": "Microsoft Exchange Security - Exchange On-Premises data connector with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -1712,14 +1728,14 @@ "dataTypes": [ { "name": "ESIExchangeConfig_CL", - "lastDataReceivedQuery": "ESIExchangeConfig_CL | summarize Time = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" + "lastDataReceivedQuery": "ESIExchangeConfig_CL | summarize Time = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "ESIExchangeConfig_CL | summarize LastLogReceived = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" + "ESIExchangeConfig_CL | summarize LastLogReceived = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" ] } ], @@ -1849,7 +1865,7 @@ ], "metadata": { "id": "ed950fd7-e457-4a59-88f0-b9c949aa280d", - "version": "1.2.0", + "version": "1.2.1", "kind": "dataConnector", "source": { "kind": "solution", @@ -1957,14 +1973,14 @@ "dataTypes": [ { "name": "ESIExchangeConfig_CL", - "lastDataReceivedQuery": "ESIExchangeConfig_CL | summarize Time = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" + "lastDataReceivedQuery": "ESIExchangeConfig_CL | summarize Time = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "ESIExchangeConfig_CL | summarize LastLogReceived = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" + "ESIExchangeConfig_CL | summarize LastLogReceived = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" ] } ], @@ -2111,7 +2127,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExchangeAdminAuditLogs Data Parser with template version 3.1.1", + "description": "ExchangeAdminAuditLogs Data Parser with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -2241,7 +2257,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExchangeConfiguration Data Parser with template version 3.1.1", + "description": "ExchangeConfiguration Data Parser with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -2371,7 +2387,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExchangeEnvironmentList Data Parser with template version 3.1.1", + "description": "ExchangeEnvironmentList Data Parser with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -2501,7 +2517,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MESCheckVIP Data Parser with template version 3.1.1", + "description": "MESCheckVIP Data Parser with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject4').parserVersion4]", @@ -2631,7 +2647,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Exchange Least Privilege with RBAC Workbook with template version 3.1.1", + "description": "Microsoft Exchange Least Privilege with RBAC Workbook with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -2722,7 +2738,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Exchange Search AdminAuditLog Workbook with template version 3.1.1", + "description": "Microsoft Exchange Search AdminAuditLog Workbook with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -2813,7 +2829,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Exchange Admin Activity Workbook with template version 3.1.1", + "description": "Microsoft Exchange Admin Activity Workbook with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion3')]", @@ -2904,7 +2920,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Exchange Security Review Workbook with template version 3.1.1", + "description": "Microsoft Exchange Security Review Workbook with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion4')]", @@ -2995,7 +3011,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CriticalCmdletsUsageDetection_AnalyticalRules Analytics Rule with template version 3.1.1", + "description": "CriticalCmdletsUsageDetection_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -3005,7 +3021,7 @@ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", - "apiVersion": "2022-04-01-preview", + "apiVersion": "2023-02-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { @@ -3023,10 +3039,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ESI-ExchangeAdminAuditLogEvents", "dataTypes": [ "Event" - ] + ], + "connectorId": "ESI-ExchangeAdminAuditLogEvents" } ], "tactics": [ @@ -3041,48 +3057,48 @@ ], "entityMappings": [ { - "entityType": "Mailbox", "fieldMappings": [ { - "columnName": "TargetObject", - "identifier": "MailboxPrimaryAddress" + "identifier": "MailboxPrimaryAddress", + "columnName": "TargetObject" } - ] + ], + "entityType": "Mailbox" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Computer", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Computer" } - ] + ], + "entityType": "Host" }, { - "entityType": "Account", "fieldMappings": [ { - "columnName": "TargetObject", - "identifier": "Sid" + "identifier": "Sid", + "columnName": "TargetObject" }, { - "columnName": "TargetObject", - "identifier": "ObjectGuid" + "identifier": "ObjectGuid", + "columnName": "TargetObject" }, { - "columnName": "TargetObject", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "TargetObject" } - ] + ], + "entityType": "Account" }, { - "entityType": "Account", "fieldMappings": [ { - "columnName": "Caller", - "identifier": "Name" + "identifier": "Name", + "columnName": "Caller" } - ] + ], + "entityType": "Account" } ], "alertDetailsOverride": { @@ -3142,7 +3158,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ServerOrientedWithUserOrientedAdministration_AnalyticalRules Analytics Rule with template version 3.1.1", + "description": "ServerOrientedWithUserOrientedAdministration_AnalyticalRules Analytics Rule with template version 3.1.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -3152,7 +3168,7 @@ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", - "apiVersion": "2022-04-01-preview", + "apiVersion": "2023-02-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { @@ -3170,10 +3186,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ESI-ExchangeAdminAuditLogEvents", "dataTypes": [ "Event" - ] + ], + "connectorId": "ESI-ExchangeAdminAuditLogEvents" } ], "tactics": [ @@ -3188,48 +3204,48 @@ ], "entityMappings": [ { - "entityType": "Mailbox", "fieldMappings": [ { - "columnName": "userPrincipalName", - "identifier": "MailboxPrimaryAddress" + "identifier": "MailboxPrimaryAddress", + "columnName": "userPrincipalName" }, { - "columnName": "userPrincipalName", - "identifier": "Upn" + "identifier": "Upn", + "columnName": "userPrincipalName" } - ] + ], + "entityType": "Mailbox" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Computer", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Computer" } - ] + ], + "entityType": "Host" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "ServerCmdletTargetObject", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "ServerCmdletTargetObject" } - ] + ], + "entityType": "Host" }, { - "entityType": "Account", "fieldMappings": [ { - "columnName": "Caller", - "identifier": "Name" + "identifier": "Name", + "columnName": "Caller" }, { - "columnName": "objectGUID", - "identifier": "ObjectGuid" + "identifier": "ObjectGuid", + "columnName": "objectGUID" } - ] + ], + "entityType": "Account" } ] } @@ -3316,12 +3332,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.1.1", + "version": "3.1.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Microsoft Exchange Security - Exchange On-Premises", "publisherDisplayName": "Community", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Exchange Security Audit and Configuration Insight solution analyze Exchange On-Premises configuration and logs from a security lens to provide insights and alerts.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Windows Event logs collection, including MS Exchange Management Event logs

    \n
    2. \n

  2. Custom logs ingestion via Data Collector REST API

    \n
    3. \n
\n

Data Connectors: 2, Parsers: 4, Workbooks: 4, Analytic Rules: 2, Watchlists: 2

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

β€’ Review the solution Release Notes

\n

β€’ There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Exchange Security Audit and Configuration Insight solution analyze Exchange On-Premises configuration and logs from a security lens to provide insights and alerts.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Windows Event logs collection, including MS Exchange Management Event logs

    \n
    2. \n

  2. Custom logs ingestion via Data Collector REST API

    \n
    3. \n
\n

Data Connectors: 2, Parsers: 4, Workbooks: 4, Analytic Rules: 2, Watchlists: 2

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -3408,12 +3424,12 @@ { "kind": "Watchlist", "contentId": "[variables('_Exchange Services Monitoring')]", - "version": "3.1.1" + "version": "3.1.2" }, { "kind": "Watchlist", "contentId": "[variables('_Exchange VIP')]", - "version": "3.1.1" + "version": "3.1.2" } ] }, diff --git a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/testParameters.json b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/testParameters.json new file mode 100644 index 00000000000..71bc837163f --- /dev/null +++ b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/testParameters.json @@ -0,0 +1,72 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "Microsoft Exchange Least Privilege with RBAC", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "workbook2-name": { + "type": "string", + "defaultValue": "Microsoft Exchange Search AdminAuditLog", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "workbook3-name": { + "type": "string", + "defaultValue": "Microsoft Exchange Admin Activity", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "workbook4-name": { + "type": "string", + "defaultValue": "Microsoft Exchange Security Review", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "watchlist1-id": { + "type": "string", + "defaultValue": "ExchangeServicesMonitoring", + "minLength": 1, + "metadata": { + "description": "Unique id for the watchlist" + } + }, + "watchlist2-id": { + "type": "string", + "defaultValue": "ExchangeVIP", + "minLength": 1, + "metadata": { + "description": "Unique id for the watchlist" + } + } +} diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Data/Solution_MicrosoftExchangeSecurityExchangeOnline.json b/Solutions/Microsoft Exchange Security - Exchange Online/Data/Solution_MicrosoftExchangeSecurityExchangeOnline.json index 9afe2568311..554749ed90d 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Data/Solution_MicrosoftExchangeSecurityExchangeOnline.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Data/Solution_MicrosoftExchangeSecurityExchangeOnline.json @@ -9,19 +9,24 @@ "Parsers": [ "Parsers/ExchangeConfiguration.yaml", "Parsers/ExchangeEnvironmentList.yaml", - "Parsers/MESCheckVIP.yaml" + "Parsers/MESCheckVIP.yaml", + "Parsers/MESCheckOnlineVIP.yaml", + "Parsers/MESCompareDataMRA.yaml", + "Parsers/MESOfficeActivityLogs.yaml" ], "Workbooks": [ "Workbooks/Microsoft Exchange Least Privilege with RBAC - Online.json", - "Workbooks/Microsoft Exchange Security Review - Online.json" + "Workbooks/Microsoft Exchange Security Review - Online.json", + "Workbooks/Microsoft Exchange Admin Activity - Online.json", + "Workbooks/Microsoft Exchange Search AdminAuditLog - Online.json" ], "Analytic Rules": [], "Watchlists": [ - "Watchlists/ExchangeVIP.json" + "Watchlists/ExchOnlineVIP.json" ], - "WatchlistDescription": "ExchangeVIP Watchlist contains a list of VIP users that are allowed to perform privileged operations on Exchange Servers. This watchlist is used by the ServerOrientedWithUserOrientedAdministration rule to detect suspicious activity by VIP users.", + "WatchlistDescription": "ExchOnlineVIP Watchlists contains a list of VIP users identified in Exchange Online that would be more monitored than others. This watchlist is used in the Audit log workbooks to filter activities on those users.", "BasePath": "C:\\Git Repositories\\Azure-Sentinel\\Solutions\\Microsoft Exchange Security - Exchange Online", - "Version": "3.0.5", + "Version": "3.1.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Package/3.1.1.zip b/Solutions/Microsoft Exchange Security - Exchange Online/Package/3.1.1.zip new file mode 100644 index 0000000000000000000000000000000000000000..eaa568ea1bfc563b341fe0498dc9a468a17d1c83 GIT binary patch literal 43588 zcmYg%1CVAt(C%Qzwy|T|wz*?t$F^vH@n_-oVQdcWwas}G{6CCl9uFgO!XvDi%7t3T{&Ih zTj!ND4VloXCLwo0CO<(4NjZcM9oU)t4B2$;`N8|!#lP-E=diu;x2w&ucnc@iTRPz( zU`B)vI`y_C8A-C@p?xOCHSuFCP|=!c=}x8GT+-hh&EO=&+LKZR~s> zq3ib)>xpPdP+wcl#G+YcDcu_RT6~bltq>+mfSsLbeS61Y$Vq=6A?6)?W*+0xkn;38 zxLLw;lh=eSc(hVA0F#Xu#m3m;pl>z}Did3y-Q&1t+-n#hNs!CF%;=RqS(K@kI1UZU z%+-jv9-_Mc6Dyaeh%OY}r=EBCsxZ^|czWKx7X-tq_zf#Jw@H|nlo z)L({H-Li)2LN)K6FIbP70vy5Io1%xBRya3zCw+QMgHjAcDcWwhy6&G9Ndjl?Qt8?FQjT*zCbAIIM3FC?duvff&U%v?R}jEZScS#UbI1UU=A z&97f83U3n1Il3vP9wx+rGQ$Kdt=+dEqpnF9wcrP#>sqwV)e-8l3&qV{1^_KgeA`e% zPiP?Dv|rUL7C9Ffyjw_AYW95u=={nXMYW7X94f2#asU3ISV5$0!a9IGfHjJlCv+T? ze(O3w`Dk5~4zqL2U+ldx<#kt_6^Inv`;Ob{a2zBB_h5I483QUAs^<6DVB17!_IT{vb&W86Gpn%@6Kn~rb z5D+GZoK2P-iihAQ^=okZ6}d1GSv&CTo;Wi+HF*bE=^9nJ>UQb;Rk@x}+8;B)@R9a; z)%s`Od!CEP?C&-+W9pWz94%NTlpWs5Ujz?cprsL72=heNl2bF+B@JcU-&I)@NDeow6`^onbEg%Xv$=l( z?(g7!FxWyh%qlb#p8(%qebz3vc}S&iAg!R)ILmIWKkXV)fMl)Yf(d18b@C6g9eUE% zd}dAOoq5e{DQ(f%f-_~RLkg>U3tI4e&uKiARx(&Qv(1Bb@Te%Dczk02QLg&moUari z^D`!cX)**3eUnokc*M^TP}Oz}n|Ruf?Iqt>^LZQK32kCAiywDq<{0U{jhk5}L2tnL zU#px3MCov@M7FKvpxy|KHp-5jBM2`3NSEKnjh?;`sN2mQ(NY^O_U;34JhPl4TZiFu zM<~0$vgab?gZlS2<`k&R(k+wS-#vsrK*#Pf%K!c3eNk8rDaFbW28bcb6+{vuVYMwm zLC)Zi(G57BQZdB!YTA7%3*g6{m!1O8U7nAw?eMkC66hRWqv!UZ&#&Ahq@(FpJ7>a^ z;?4w@pZcRh8>*jh`T}}f@rhZ;j>1aENk1I zO`rwz%XSf~DPl&Mj6}`qI0^fLth01Nk3f7{J`8U9%Cectop`dAZ|%%x1#V<=#l+Uz z+<)9klq?(Zhg&WjeTn*Ppkr1}@Z?o)n@=LvTLrQuI+wF6e6gKUJN?>4p zu<6F&=q4m$gAXOU{)>t(10^ZQf}?_6KM%cI04>@dCFxVslT7s-8ak^P->g`T)tc>OXtE5GqPa z&=O$5V5i5|b$tCJJE<6wgqThaLnn3yDVF*;2yr~f|ATJ?u=u883+ z7%OIO3E&}IAn8!xW;w1*DKb42aqg_r%tCYtl1lM2P8Ra6FWSzCr zM&%D6Y8fS(8;Hj3VdZH%z{B}=q5E;qT311wCsErgG7HM`)Bbd+_NI39ky~yJ{^cJ{ z$d8NF7AMvF@TZ-V``h3LNIjlhm|br5wZ)pBO|@}}+5GfMP^hL0fHt966N9M)S2_$b5cQtCY2g=_fSlT3evYu z_|YNtRT3)6!L&^NF=+>Mu|TE!w#tmFd(<8?6|6|3*zP*4;|Q5 zd0=QD@Td(=p+R>{BR3*;{eS2hiH)f`8^~M+QXKJc^}``>Yn}MA-~WJ#9dixjZO`Yx zZQru;6nVFr({5=`=_<+C-u#?ecvNychaWw<;MwZPvm17s33go-HO&?A@}TAaAsc3V zBIk4xgmwt(tAX4fz~d5?W4%Q`dIN0(jQ|GMZe4b5me~QmgW-vnJ?p2(Nyyz_!*g>6 z7$cfcQW$paS;)fa$`LmRLRsnVp*Cbx3#qsKEYBn}P=As^#FCz^uKC{A8|gEA?icBLkVzG* zp(@_)78amPm>2VCRmPGExER5;n-45Zfu%+?*L15!s)|EC?}c3P=!xoZkC}9K2MYT& z$)^yFd-t35qjasznIV?extJ-4JR5NZf+uZ3pJL%PJ*f)jX&5@p>r<6_ch%Q2#8qrc5wk?Z zmmP=P?A=T{Ff!4_HF5hh_V`^{ts2m-Hh)F>Me(j&?8+95xc5%r&I~tK@B`JdAiN8% zy><((LmzsUdNpaevg(9}w>;Yxa_y{&j{lzh`w9Y-!(_s0?*pR#3~ej^lR)ABp?;iZ zL-k)6U$4R0KtK>MU_eO!P`|Z-xs9^1wVl;J?EfF$zwFv@z->z)eC;;*K;Wog7AE6P zFe0NTQW?r9p-@5V5DBNPuQ*Pl_$zMmYm8%jax@W%GNM$|@~ie^wRxGD?Qip6%LQ%( z?!RpE53L{EClJm223vTkK!{<|WQnN7&@KdMSU|Xb1AFWoxIN!9KPZ1=eR3ab`tyHI zp*)?EOAZdl*0F!;xgN#8jX7Y&&nkXS&PcScMuZhp0M0Ai9am3N&mN|;_y+vhOU|GCihQt2{I^QDeKoJZd~XYnR5|)f zg=PHViLXS))+sV02W|=9PYON*!1jcTQ;4B)`jv@p46^ymDG|VRk#7A=>NEV0HJ@|F zqjLSo{h%aAB@)BMFv1d~pgTN$bB-lFR zb$cX*bCGsV>AHgE}7~f8D-mGW%ym1U~%Xr3XjL6_-a<@YJCUz|?2* z1$CGUg{k)AC6btK0Cw3m3fMpfee=m-p9BV9Cacmj?q2zX`X0~UT;{pjLkohlAthI( z1|JZ<$d7-`o?R=WzL4w9l8W*P2$fTGgD-EY55_u-E?)+kagTTEE-K4>hYEtg_DDPs zbaZ9*f2;V`%_s+oJ8TlX(Gwg|9SbfG)I^V_±UqH<~Ldf@3I9}Pw=uu79Kjx|ZD za=6xAI} zwemegu$eE*?bQrPRM=o6ukF#dgtc=|WXO(@E}f4&aLr~5$gzdO+jtT^1?|EIH4qI% z{O*pKr+$7v`v$($tFxwV(dOOkOu`f#Pi`pBvT?0jP}w|le&vI%As8iLN9UI0BW)(= zRbJ)0%zj}wkmnwl8k)W(c_i;eF%S7zAe6FC_13};4GY%$PQ@ggRup<56uUDcw& zN(rXxFix>m?QTp2A+`|0rpjH3ry{J%F=*^wG@J#w9H}|&^efvg89>|9V%*^pX1A5? zkoL~gfb3nra7u`;Ba#{_7^?bySW8Pjc;bkNpfKqlQSx59ewuA2>On67r@%lY0HH0J zRXmdL>~RCO1T9V^7(|dqwtwG*_z~K7Px9d`iPU>uY0vTd>>2?+f9Oah13;;fL*p*9 z@=F=G3Z-WUwg*lDIM-5k-S;N$nkXk`^K09ZQ12{xR|CM<}Nk!MK>U!FS29p2Yw zT-OOkhs4bmW(PG^ni8$~0b*(2*|8EW5wE<2{V5baPFHWG6HMk4sq*Z?hY=oFE|Dj*a+8aK)LPap-`O(KN_?4&F< ztG%6RQ9ihCr~sQK;%JE+A=@Jp(;5{~VwDF4vJo;uzEoJH-J?ejc)HaVM*1RdTBeM} z{;u5UAf_80(^`cfnO1^~_Uy!{QAe0e^F@AG;#g&5WEp|f&SK;%Q@J43#)}A51MIXc z9jm=P#$f`17hb|zwII_*fDyE3?HG7yBp>sJl(KgjcF8(mmPm!r;SV(dYkS$8@K!UA zAhLSf)n5e&)s|17x8GR!KpLNtQE3;t>0j5lZF^mIg&(p*ms4X4W=s%r@CyU;v~Q8? z38ZqkBVivfc7)n5$1a4QL?Q7nc&&&jjyS70eVQ1Rty+I`ow7ef=27`KDYglW$+jmy z3bibKHzSML4!%!SuVZbFzEA0vey>~ylCIdWwym4hM?9!X=V-HM9gfG^2H{ecEHhm= zm{@F;iB`QBGE7TU;Uq7%D@s=3G?h6Y^!>RIV{Q6RiA*_1lN~0F+9Gy1{x9QH3RVyE z!lemqMi+*(i&(}MplEGM>R%_?kcp6D!d_{2)%w<=B#XwKf2zU z4cauOZ?iZq(ZFNj=$u}uysMmtdO{Y{s8WkGc>$+L^Q?E!>1i?p{=r#8*Pcam zUfV36oLt=XcoB}Khd>O{DNi5d{ZU&g!d74}CvTq%u|NBuKQOlbq|#iUQT7FDcdVeQ zUIXw^#zD>ly6UgM2sMnuZ&XH<37$|?-^$V8&o4CT@S(NN-?;VLaD}weI{oMpUr3O< zrYEWRp738gJfJ4NIlTlxbllW@^5}ljBr!_6=8k)cOt)>P#=GQ{Tw8iD;{ZW!@OimH zgVAUGDL$G~Mj2w6y@C3W8r4eFI&?ZLpp&`{MWzVF%~JM>RdGvTb#$KOO+tuX8b61x zHU_$(83Ur$#6c~_oSn$sg@EodIoYHhKT^;__3Blkx}O&_msM@hjkgnDz4I~)I)Iy4uqsj}g&%4AEU?qCND;n6&3i_N^ zL3}A4HEorEpa`7Jjap?0IrpK@DZz#e`gGA)H=AYBn1b(|Wg#Yx{@K7EE`&rKWMvuA zXHkHpQeN){=jG{^>yGfGTn)OC@s15(vkG8)oXd!;r;c|=5V?8@-e#c(Ylqpi!ZJQ# zkvuR6Z=@mDDK9iK`jB4LlGguA#$}ycFgA~&hr!I8M>`?ZC-0qSRCZcfW97>;3}fIp zSFt2$ZP*n@yX^OhK0!c|&@lZ)NrOFQK>M+D^Kx)T(WNwaQ@Op$cQdW-PjU2(o7vQV$A$zl7Te5=< z>T^G}{*^%;;5xD!gI^;61d(If(sjsnsR6N&`t7pvBCmj)%sK+y>Tg&CZv zLXiRR_OxK(`8_F_*Sqy$;J3Iw(lG!CZJ8~ZrC%eEUuEa($OyvllupR`bp1X@B&oP1 zYP_qCbsh-~)O|;fxSvMReVxkqv0if_F6xR+C}S@xZklbMzf%t{q4tfyg84QInK~un zgHHVQ%Y4s=0*OvEL_qMQ0r?{_8O_Bb7^6uRqwco0knVyRUwLSj0Qr`lzW{O~jsG)- z3ix5Jih&H&G}#*>5={@Ki?mf(vIFYtI~h`Hp%rtPQIKqsz)uva=)uHz$erB4nDju7 z&cZ>@Xg6r_nArm9Vu`DEfBC}2Ahbg(J1crxzmdFjCbkdPDsqjS#?hBwK#UkK!?3)* zuKq}`x*zGFd!k+m(w*$M9IB9x`bcDl0M_Q$Dg%X`hXrWG%ymOkD`FGrcQM@!yy`a3209rEz7 z@3=eZ_hh5`mWoR+XQ+CK5Pn}#495&Me#|QJa0K0NH5|VJmOj?b@KQSQ*FXK>cci=8 zhqAYRnK8CzLqkw0BtY6eMm}!9+92Jwur`2tl%FrWgByLsr=9%XUIh~wfdmle-00PY zTaaSTeWC*?3ZBnHyi^8tC$M(Lk=8Pb7h=ENI4FQG6uNm`1*I=~RL_*kGZ(H>BXF(+ z$inQQHhc}|920_26^x7i6j5?$q;s&2jj?;d{>D@kID(sE`f zfcojlv5~~KB;RnLa<|3>b^@8-4F|T@Nt((1EYgt$JvxtPMo-m!NBB|706F7~Ft}n8 zAs~!K(Vhm}5X%TYrhtIl93%>vehJaIa}3UjC;XjaWF#-k!od&zN>)pLQ5&XzF%~@B z=B6oZS5$CLtn&#Q608CSda+Lhm)vhEb*7fw#`qi^$^87I-~3(h{^Pqn>PE59 zX+a3Dg5nSZ6s4%>o@j1C-IqXMIw?qH7W*u~tvA98D*n-MKH(G#62($!?nnrM(93Fv z-HH6MKsdjPVdqu=sAjT0Za^NOhVNj`3jGk$z1~!x&_rO^I+z};?LBIj+bu~N8t$S! ziSeWEaZ!eU#ZmvT8cclD#A?cfNZSuTqL3O2&moqmG0vnDuQJzyXQSzE28dS~s_B#1 zPr>W~06ZwLDsEK%ln!_Z94L1ADokE8^XxsI#8f#E5uAyE2u#tE_jZ_79xmbckWJ;Z z5Q|(m{=s%alB=!v98mQAQ1}ggnCZ``>uRbzuLZR-5fGCgZ`b1ylc6p30nEU`Z=4jW zD2&eDGmaE%7=+5-XGsm}JQuwP(m<|o=qG4?X%rZ=Wd?hM5-GKbwt`iIet2|+3U)91 z2vIH|(O-y-TapsPpv!)HuqfEHG$?AI$RQ_f3Trn*H^O|6v~3pD)FTWt)ck$Le?acw zMVkrDP}c?elx7ukuntdC8ZXJ?H5pLO%g&oU*{%P$J5&B0dwMg&889k2j3cC7$6pFe zbaTCiT~m8zC2BgwG{lDi=Yaf>v!KSkwdaxi@`uP6{Wwi{kHV|4xE3*#nQDYwsJWdr zxPn;So-szfU0;y&$}X$)wPczGItXk;oCIY0E`8B`2s@=Ws)px|@;<6r@k7Q*+ifQd zAE+22gcA4RRtA?|5IfoFhHPq3a4!IL06?IS=^l&u|Ak(Xr_Kb_FjXhzUul+&2F zK?*$(Ju;S_ctdCdTC?|2XLZ68ALE$q6a7U*rCG8j1R=Ti(Dal>fC;dTawLeM%TTs} zu34ml&IK$*b}x}z)i~Oae#PA?2WII`GL%`(E4WJNb3Q?vV-;)X81deMoO?K`tn1!S zni(5gHi5?NuBk12^{9z}r(Y>#kZ{_DZyG3ZtYb24d74U!QBAiLmN0VkeL0&w>%>oUp zMlQ}hX&v>4B}==l2#AeS53ptk+qPe-s7f)E1jh?Qhn=EUW;nR8b8tX|2QRym%F%C# zjH0Hwt4@85`xQudwepz0@D=QqG22f|x)vcu99Zw3hiq!T{wvn~@$>7Z_r#*FhhUJ` zSAW>>hlUP&69R3tTWS=jxTpr)7)kK8?*>62T-QNHL@_WA#K%=Gf*SJ}nKVjgUnu|8 zXi(Rc4{fn0_%^r+Td;vGEyN|LI-<(Rb8N==- zZ4az~MLiFF%cnriN*asnB44zE3>SjPN6m1JJqG4QBO(`kEEI{i3@s7PO%Z$cZb0~J zHT_RW1L=$6o$4BUHfEBFA7A~qQ$I#lg9ho(0AEs&e*8Y)&``Gl9{MZ0u5N!O3E{6W zcW|Bptb+~^N~aLrIt-)kfQYG6@JQ>N&UeM%em|NI9Ic)Gw)^TzxaHP)9awm73z z0ja?L!>xEWD|jITx*S-uP0cXJ3rZlVMkn#)LPPil&UNf#>o{@{<}CQ9do2jlN2zVc zuTtiBS8mkdIASV*3timMajwO(!tGngB+)`!77C)}q|}obh)wjukW$asKOPZ`L;?Cr zp{Ddbf4hGqv)=oKf>G{=AwS3v)q~f^Hb;LkK6yudgptVTD!bRWB%^VXtag(BMw+Dh z5auCW(7{^YkuM~S467#_AYHbU?_!efD3_~)|i^tF{njIwx2wjv}Nd z3q%MlcFZo?0LUPrYzZBj6>h`up=cnxxb*#y!G^H6mFPkW#87}vf&~2#su_IUfm{6r zr4u{Bzi<4s2N*OE{&xV$c z?dvP6psTI#n4Ya0XMBjQ$bzoBQ}2|nqQ57Fj8x;3gktas{p+8rH8L}QfQ(~ukl_?2 zkas1T5BO}3-I>0%G0(I_knZ;i=IbVa@kU+!rNDE=K9?=C+Zl3Q)zvCAQwe!Xc)6@e zjYEDmQhrBR_U@G$7$AohU{$!{SCXfZ@}>Ld;So6I0uY|n9f><+*KwN?9U#+xzol5z z=Vb{OG`(HJ9#anh&?m;+5Yr`RqrA!gj8>;}?llUk9-sOvh7zZ@TqT;`F`?jSNOqcx zj}9t-S9~^T4aIHxk%W4v4&6J^ad}qL02gK%SM+5i)lYm5S0&Z}fKo{OaPglSEo||! z`i9)8T4MqaS|N_SIIgw3aMc_c&}6#l0&6BVF-BIYvC6+oOM*|;{ifvC?tN%}Q)-kF z!ekKvCrjQ{RW?m>?OI7epkKQrvy`?VeS8HWZ<`-%F(@t3`!P!Z@vAb1i2J8I|L%dX zO)im%8JO(W;2`L5vC)iSv1$NLOa2)v3D6|9ujp!3H|Gyb@|~UU;(#;dq%hr|a909D zH=X>vSB}_Vj*>z%JgzEiajt|#tLP_E4q8(I75;8j@uxz|>po@YqDFjDA?lWD+|ezf zR@4~IZcMX%Izo(?Pu@0YpVKrKBM|VIi)bux zcl3^7DTqCmCg3t%S5Q)HzSYT^XX00y;#BdS%(XlpX99$KD<>D!uQn-VC)CrR8S5K{Pwh8m9-Xnt-UzyTOlg|4W>2?rCJ-NE4B>9; zl+0vNTboQx1~eF<0_0*f($O2J@JzOM5E4NF~n9?rEOLNMr4$jcx8FzV8#iuzJkgkvVRAst2;16;UsV~g1Y!%7wz2~M7 zR>eeBDw~`a#R8CcPPaFm1Hdx>CHkUJKq`8@7?;FLoy*i?EN6)o^$z-NyU1#hvsa!u z-c1@XPh4X(>#F&)5(Cy}o43a>8ExT3DaR*Z*^q|gYhPHV!%Z5NmZj_8sM1aPbJO~L zP(F>Vju2!4%U7eEa}nmd(-E(r=Hn^TDb)B3-gMYGart(ygtb#kr%Fz<3;PUuYi`{t zffrEd~$K4$0MpcMrGpyTN zvxh8OFLAoYg{wzvJuH{adgqgpFT=@O&#S##>(4Xo{QZ~M!rd0~9&_Q+bh1Y; z$ZHYY;Foz?{G%u{Be!sMu^W3%n%SDpDI6Eg9&up?gF~vd_LIUL@+5Hx&!h~@f2^0X zDe-#wZ+hwF_KR#CIUY-mu)s^Br&vjz_i>|9rWP^5fZy!aVW zlug&Ui))}KpMkQk&|)?d&Kudzy%~k)lb-ko5`icQaMcaXZS1)q3h63zJWuqJDh^P3 z+>{Bhl(Eb!>4F<_m<*k_OvkRVcxx~mGN#g4Zyo%*EAv}8<7>)WF1lKY-QVODjScNx z>zp`(NbP_iRulzyQ`f2m9pP@Nqo{B1=g-64r@gzgy~IlD zXvZ0xmEhsI4~}B==B-MAVJ>NJWMO34j07SM`3%uD^ZuMSDmu?JJ?yFa)qx~rI}xnB z1Ny*oY#Xu(*qiioO9XTA+P72v&zB?L-N7W|Ly+~k5B6fBAUkx)De``IMHs;mF*ef4 zrHG7V8Yd?GrTvb+P>!HH-lC)L{2K8q|6FG#D?3Bv_b@bJS}SmT8Zc<|)ncx8h{~2F z<|MW)deq@R9s!I)p^Xz0Cs~pu>;6HNinEhp+WL$zVVdfdD3m}T2Wc$tvDY%7R}}HA z>?B``rX_l07o)vvc;iK=J%vQ$cRxBW4nDh2Nj&Wjp^T0+gzC}!{7M^k+ftv0160L1 zD103kp;YBqDs+$KMc;(A2sq|8fxU>~g5yi8I}<$yC!M==RgLII_g}KPp&^H)sFJ`w zhrJ*zw>yMk2`tVCOLs0~5A(_LlA?cj57*dBOrQrcsmyEM6U!3=Si&+VKX^A(DSP%_%5QPipGI;W3@ z=U8ueA{KO(w6Lrdc+wY9N8cN;t+AsKimqvq;MI|$DcPw?F)Ya`OYt)fBpjboO1!zN z=)m~(kZb#V`%Zf0QvH6Jz5h*WiDU$yc9~FI9P&;;Q2=^>zyKwXx5Z>% zO<)6JZI^|`B*CnI)=^)yDg?m0%-qioy63RQ0)Z5<1rH{~~8x0*E{=Ohb$i@0B198YB!McT>U z5k*eWg=d<68K_pS+Au+t2Lw*pS-C3S=HQ%}MoOaq?hDp^V^D$wx&WxU&810P2TP8P zSSyoSe8=9(A39`$K~KRfo72d0;ej~d^d4*gB-fkg^9ZH{d}6~DTz@3$tKDFVY`bMX z{n?9pyC#E=dfSft>@j7T0NxmhYSuyr$#dpY3klp{=|j+sy!aHlAnK#(eFtyJLU~1z zm!0RinvaZk&gl|-2ryyXK>~bLK41CY6Ekx9Ksp3J@9yyWD?X?(N7K<>t8btJ-3%(+ zjwTJ>a99c@v%A$hC;|$vVm-ZGaqmk^@TlD)=&>F{+RhIzfgu0Z`EM?H(R>b{?S-Fy zA!InuM*@GAz^%L0=z-pY%acR!FrU*s0jKFZB(r6~98;SMIg8ejc9gyNK*Ah5=O8(O zI9F5)H4jl8h+XUuT?-4sU=P4{&|sV+kp|UVbtT6WJ&Zh1ZZZs|at(ldpCKY~i~%B`g!!W-_z zTZi6KPC;D`jT^pi)!7x*^R|ao`S_f2QhbkI($~sW7LUT3@49+Ab_w zUc&v!FNd{46L}DT{*qUQKy@82_kg%AcVG{9Xf4(BRE@qulOyy5!HIsx$*+Hn>ctY+ zx0V2Hv>|kZV|q&-43aZ&`}l|m;HGs!SR(*V8%_R?Ck0LTRh(1VH~}JN;Ak-(I-WV> zN4UL(+_s!*Wlk2W%6}s{Id)DOG?a~sk%hg)QQkh~zq%Q!ICN4xJy5!Fh37jwP{IkH zo-t5-Y*)^yZ2_N}F+jQ@tjpPYY$wT;^8d}h$~(3$;?l8(O6NY>oi*?)Q*p>R;1g-^ z&2WW^frW}@bSQG-V4R$#T}6-f3+KM+U?99Dm2vcUqYthLZHyqiJen%%ZtXARxa;_G zLB5>HJ=_=0t(kt_AJDpK{penQIKkX}IAQD`SzmvQT9=tC9invP~Wj4g7arTo z>i1XMEIQv1rOjUMMM9D_28~tqLv^?h%onTFiUy;oT4;hOqsXlWp|I@*y{bNuB$$F~(+Gvw6{Zs%+)>v#zmoL#3crDRWpSX-?O zyL@R|t!!)nrZkRHomDl=gQmSyHH@5=?I&Uh>h0Soitk)XlhMSC95prcf3cM&zc^{O zDY|L4)ghwQb5`+q_z2PWeS5imW^&|j)@p1IYr!n5tC{kxK^=vdGp-eqU@nEES8zSZ z{dmb!#3#HR47YQ*fTXXLDbYF(XE(=Y!Lba$SE0(Rcws*n6vTM#gE|LJ$I01Df7>3i+PhnoF9ecRNrZz^zkKHe`) zoUpVd=qFr=zvt=h1Po;ZO;^gc~fo{NdP}X+W(4l?Rs6tZq^B;v?#MsRpOqJ8G) z&m8DEv?A}w4u-|9O-3P*pWkc(USCp5W8qr7#qgN%#4Hsu8rfbKvP9G<=tBF3b+SY< zdA*j&=WKM2R3YYY+;jb<-Hjr-!m5?az{-vZ+d0E*;0yS_1f58ITbBf#n(m%%XYzG0 z=VRPmDST98ZyJ#y9b!hq8rN)_58`Xe>Obun|NL^38ZqO_qj* z4Gzv1JSc3=(#`hax&dy1QfdQ}ci^Jc!CVlQ2N0J+>PhBy9d?1xYJw;>3i{{ld*Cmq zHnkdA$U*k0N%#(9vCRY9?O`1@l23`99YSD}z zmYdx!);f&IPH3m5OdT^apRR^BQ_^Q_l=U-EuB6bv!E(%O&&BqRb+XL<`OBYtT?lde zT;G$~HoF}awYe#+qm6>8;rjVaft`#tfBx*zPav&vMkB7Ixp%-dU=%o2L2Fw3nNv z(aD9CXHDLZ2wyC$mYFgpu4A!~w7S`GF_qv&5NJNG;k4Q|oX{mV4 zi!X|4nHJl@hKFSz_Jzk3Ik)f@lPrU0(yzkxc_kIo?VH>iEUG{E{&yv$bF8IL6!sn5 zrtD}c(xqc&Ry3v!5w83zYAckyO4nO6*URf%T_0^@JMKlk(mP*4JH3#3sCwRfbmQ~E z9#nj1MP0k;L7(OLcfBQ~WwL<79tg<(`{2x8)b!x41#7sryFq?m?xR^asY7z_VXy%0Wzy4^t{$?~(YvfHx2F z=5|ZGo-%Cf<;y#&gem=q$1Fd8N(h`yppnRT7o|IQEWt)? zjct6NajwL)EFS_zB^o^wOjA+AXpsWuZe)$}X2htEP?kLK=DDT9LYB%>MLOo4xbdez z6&+_P=G!9$1D`m2hG2-h$j_YLf}dnCQE!&M6n<>*lL+-0;UHJ^l?05wSM(4;rIT(l ziqvB{{9r(@ZtL|%Mc|;$ycg}J`Lons@K*8!fDUXzJNf-}rEoOT6s=Rs@joAXI8Nf< z5Fs_5KI&|`MV98e<$#R#@ZK%Zf?jS-E0|x~)wdSxB0v*uhBmdlDnGU8$uvZ!QTpGdq#0JL6$|$$jfu(66Z~3#3{A|4Uva(%#~(MY9ySqM&g51wkx*I2h?$$`* zOH^qg4&!W?zZk4nj$vNLC_mVN54e``Kb9mC&lRX_y1QAn>knXg^-pht1(}$NAAVmJl0Q{s<{eq1j3z(~G>*`{;BsqRXri zpz_=tQq{%#6z^#MNuhPeg4p{IX+G89o<<%vMtuk)hN8_r(>1|6LieP7>i{dd#=iIoNn~?LK99-$tSE7g{?F2 zkl5Xf!x0gb@rNu=U?nT)CKblAQ34KS*N5EVf!{s;ZqL;db@pO!4+~-OGu8L|FLed`eNS6p(M|ks?tU zP>rYo9buq-xj_)SQ`Tot^q!~PN+}^Qf`8x zCCkLLc-exBws@9l9Z)ddQ7|GTMU&r`URD!u9YI+gw=7jggHm0yhEF6>tM%2zii_Rj zr#Sg)^yGDg+wY)KXG5Fzs}UR5(w$~Ka#gPm{&PQvHW$G6VY|j<7-dAy-mTY7RH;>Q z0ABH|F3vx_#CpHu*A3DxC3o>mgSO7Bf|cE%;fSHNkdu3cHpe#Z`%&8SIl%ut!T+=J z)29&yR%N{SRr+&XU8EFz22$t>;ViVaP%flrW|9!s+7!SR979_uTN#F}u_NCPqQB<# zeV_XSDob9ua-X&(p@}Be@uR*aH^n%U80AvSxcodc9k*T@BNSC(yneiUUKPXfExJMe zDQqKu$e(M{RE#a*i+Y3I#Up-K5V&u04L-E7j$ike*!(nZqnst;UOl$k+bHMp3?ouM zn?)@^H$YHY=^x+Am0_M-i4x_Gw^uZ+qjhfwqF}}+M2Ww<=+(JgE3R(vaApvLfd|{(_81d_031788oT9JLYII zl15Ai6yyr{!W(vy#?#sY@V0jBfASfbx{v=iUMSr?h$4Bh27MeAPRZ6Bm#7hgSG1`R zgZmu(pS^8kfuqPopk0h-jic{?nvIJ!x)$>EUes z--dF)O$)lA+o?-hg*2)2>yJxPv%DP_D!aSq|NDfdf5u$x7cSVn2P)m4&L=#cD(=UZ zCu?-kbml4^YA0SFS|ggusL@+I-zxUURUYnD`jX3!k19Pq-Yhz9k1DT%wHwU-RnK_% z+@J3gorji{cZDK#hS4YP3|^>husv+}{7-&gUnBSYve@X`o;LrM7}id{6*Q5n}T3o^OL>h0)-P6XUbUE$|(MhFoko`%NE6eBki2ioK6t^)e z|1ypLl=z~L=C6V&-+xmenGmptB@g1Uts(Z5n`Z`m4#~;DlQnme?4AV>eo5isPk7Md z^RDllx2V%=>k1crd0uyZ@?1gKAF||(x`Z=xSM$6nu!LhN|Gp z*qL>B_VM=(^+0(8T0f2ABkDPKlC7c9v47g{tevVG=@6A@5fv;-$F^0nrts@C+@Pgr zQX0Nak11|BvAbe-g0;cvS}0(pYYb$s8Tuf`3{>Za>i5OG5DFJQ`UyzfrZ9>f*Lqj$ zhvjc0xSy+y<{ctK1Iyu|TW)swAB%8rdRW7I+QzY8&|#vV=9a79XoUWLL`#&l4)WQv~A!Dk5~Rrs%NEfFA81@Nc8vY!OnIYFH}AeWq^ zH}_no6`lyOUb^_13plV?V{K&o*0>vTmJ36*m&}@guRls8+`B61<%P#>LA$Nt%&;69 zf<#}^1aD$uEewbRYK(;=yF%iBbb!uEy%L?d-fDn2J|f>=(&@*o)kdNXE7h_!C01Uc zX=75l7BO8S8_+MlIf0pEXssfkv)&O65o`#Z`S+e^BG9F>C}86ag*H_sxmOXW{r1*m^$uJ~+l?hIY*?*By0g?|x~8>nZ1CxGjU%#A{o^JPV?LWCn z&(o!>bnkcO25eK~DV-|%i)z)Qy_HGVrU>|sb8S&f{#D^BQO-(RSKi9~+lsav6}#6( z?V0w03yoDB`k0+HjCwAz#LP@?HnnTBYFJH;g(u zy+vM8y1*7Th=Be}IZGC8`A`!DFB~#egEF zV?O57=94z(DA9ozI3tS0y*|jo-jkphqa8U4YD9f;KVzRZn}T?=CTQ&TE*!+ztARo~Hw< z@SY?k6gU;Dv+vL02P{owGGMnVEDRcg_Wng(#fCXo_^to%Rf{xN5tjcSgav}2n*rda zk=WF<`()99ZIbwr$(CZTD@=eS_6hrLxHGRHc%f??((u2uTm7L!9a58`5Wp zkUCHd5EXQr8~rLho_;fZ&`Zs$+4`R4ou182>(GorTi?Rg=0?xC(v}|whRM$Y2pV(^ z4QQ&ik4ou$5tROWkAr|I5i(d=56u-g{(W z=dHMV)VI*j^nl?Vge63i9&ND|{vXTyY3tz5CSHrhr+;=AK0ebJppI9ia~U9C;Bz0UlMXX6bH9f?iJ5vTvBiE zQ9&-FzaH;%z3;lXKgU@u_wl7KFB==j*EY}H9KZZ2)aGO*-cT-Hhvb|ep5|w3{w#Arr-{d4-(A59Ih|JF)ZSLSf0hGp?%jWbYXUr8|a_#X^VcO?5-zTmX z2n$~kFC^xVGqOfpTD(==Pbxs_D0(Qfl8_G9DGjx}@>f;X{p*JgBNF>&XI8GR=fd8m z&HMYujJthZ3*L>6t&Kab?NmWFB`4*gkes1z`X})RAX};f>yw%;&+C#H-%V3jBdMtx`J*L2F0J9KrV(0Q z)%108)1~qo(fP^YFcU0D9FMTawau;T>e+Z{eRixZ*ADJ4 zZ?3J|Kyvv4Orz<~ZlIyI`@9k*OKr(gq@KKzi$p9dYc4|sMY8%nF)B0CF3c3*k(1U2 zumC+9{v+zW@B!Q+Z)lQ&n0wOL5>UExm(l)@OYtPA-go$oa3#AxumybuKuzIl|N{If2E1&19Y5luvgJ=^KS@qcm= zFB@-)pF_>$#+#t*Y+_4g9#)`PyoP)4*H%b+@i%s&0pXG^HG_Qx=_MH%{=3-kMed26 zeYBPz{|whPd?1+8d(fEjf!G9XBYP)-%|SZ`%sOvfH@inQ`8^#=J68Wr$FQ5Rt*b5VoST}LmwM*# z?1dz;E2omHja(Rniu8h&-tPc7$D3WDT)PuRV3yf##nYQmW*{;3;97pzZ}$UE z(Q{>hqGyd|KTx#417*MsU5Drf4e#pV!RL^Y<#8i5g08z$p6ZS0Mhyk0DM?e< z9HKwX_+$Q6qs{?TI$tuyq5Q&cxfLj<1mjRlhYWe%y{k{Ak0bnmvOUWtYxAJj;yji#&d))Q2TP+whB8==Hm+C#) zVk1_8EZ-&|Cq=!=cbUY?KE`h{y^Y-9$Q5WKVecy%@+|=FEm{Fk1h@gB^l{0-w4RzX zpuhcI5yfy0U9t<~N!q+a)(5MR;NWUcFV_nv=GPbrsuMwsQ`{YB1BXga=E09~;GQY+ zthDc@WNFzf6d0yvr54}-p&@<~-W5E{= zE+MO219P?F2q3EZf5LyiqY6hs#(M=Q2R}%m7O5AA1Gmnr?Ff(KNceAN<&Ku|X^Qi9 zR$>nA;N}x&U6*d!|6=|P06;`pC}KdXvr5FiI)WF?xr;j_td7?}^aaQXio66)4;fJI zjN%!hP*BYrUZZD-2}#UJLl}xeNop*MyJ)yjKmwVcQHyk1igXMK zyjU+TK9(FXr24!wVb53IBnm8>28A!YIQA%98hCpo0>x zRx^dTWTyBUU56yR#|@FFwnc_spJ2fh|E9>jOk%Lw$*sNTXh$zx(~j>AxqJ4lokHMW z7pe!B1o*)rRiww-x8)oV3VnH1VpAK_@O|k-_KizC^ACC%V_=rY13P%*Kc*4F`^1LKYG_eFRhZ|Lbst(ikZKyr@Sv{3o*WR73o$f!*wJFt#>+I(+alFJmtQ zu6Cs5M`8APFr)V)&m`Sy6EhAc{QA5v_XWwWME55EOP@AIp&wVEeO2{mV$V7)>0RHv zbosKY>)GmBx3j-}C$w3-$#G*p*SY4|y}5g)`{HD`Y~swC@hr=Fl6Lg=?v!$R?u;?Q zK`iz`&f8|~{m^!dIYNjWH4MpPg*NcQgY_1^O&M>XkA++{RLFZ19LQlj@#gS!=sBSc zO09}mCPb`MZSLZYNgq1e$u{O$cm4yI{=C!>4{jiNW-&tKmRs8te<&RXKTfLU=@5{Y zr|h$D2{WBR`jN@3|8K{I@ns}o;(Ar0hypCn^3AU&sk(7M3BhEi z>FNFGl7S1%Oya6WM}jC3V+Pdyr9fT{XW~a-{}4ZDY2VHp4O7;H5q?Lw*puI{&RwaI zk&Gov`=R(`z9UZZ=Mc=M%)iwg51}y&7mfn+qZ>>nuM8+tqq?1ch1z1R((PsD@E!{Y zjNf}#{6OaOM!!GR`Nmd1u#O#=6<3&zFf*`pA1gIG6xH{ALH!Fjv|}vC?xF=$|9)9l z?Gld%X+Mq*qFPg3Pi~`sPfe$?(Vu7J(gj6^uBypU@*R^$@^fLt+SPwDfmrCt(%iVX z@@ejSIeD(jkWbB@Lgkm+DjR_f@W6UvLj;hBjYI(COQn#n4eRIVK03|8^bE(GxbLEd zA->mOqFzG^EXFTsYKNlos2_3BT^b052KB_5e;jGTd0+93ZB}@ahR_1LxSR)oB?4y? z9+u-Q;fOPQFxdY3+}3l(94Y z4B`ZMEtQkaV;is`Ny0P=ALJn-gk3qXG!s(!N4AuB1J@2L8by!;M;DG6#WG;OkMPg0 znA1kcvu3|QfG%-NDu%1j-*V1c+VZDKWj5Z%UUKOxO}Zg4-FV zP|@{A@+CgJ_si1eW)l-EW9p?=iRdWW)$#9#Fbj^}@w9GLx71um0IIu}mZ_p;D?ar3 zC-_PD2ZwC|NJ}ZWrn~e+9VbWnd3}K)*KQ7aiqPe|R{{Hq@(E=LJeV&L+P}*YKYH5K zj`9(nJ=HRN1TV6{pEyxs&Bd|a6l!Mko#I6j&eCmS3Cg7U0jWGn4oP3s-yWaWl4;O z$TtQ`UXnM(@61$pTI4<{Xs`3X@hxE=U(|XHDv~)#AFGB7wVPDI=+jjApGJ5WT4i*X^0J~H-Phw1!ZGcmo##Pm!)j7_BQR7UdDXL z)^eAkx`4C-%OA;?20fT2sZ~Bw8t5G?Xo#q$WooB-1}$xXRoj5ml3$w<5a|wM^xDix z^Oov59}}FH*;Ai5f0Vf@2JR-F(FXmk^45CfnM$tQco#bikfMwQ&0fmhRLS@^8pA?U zUGTP;koqFOo{NPJxPjJd$V+t>f>{@I*iXAZl+2;c7!%L}n7 zyr0ul0j1k>z)!}KD8!CrmK9x$U5-s<8)b}uKxyT#=9`kSwRixvOrQ5}Skecd%T4-x z7CEh73!G(uQ<#}&v}$a7J2dm5Q66R2wbKyKg1awxsleYR^=44S`YM+(@v*^l+Q#T3 z0IhKz=-MkDVN8%I4CBp8DQ7*Jv|2nJlz26JL35hGh0i;! z)QKY;dY$1gFFzehzvF`luEGJ(!fCOvxWF^!K;qTsiWVT`>0uV>)_!c$@!|lMF=D5s ze?u9wZ-q>Zha_%;6Ere*qRBd3JiH#mN#j&yZ=Tj)Q;IBS`Z3PSm9lMD&)^0v?oiy0 zapN(moNb=iHm1;dvR?InmVRG;zxjW;y)n%*J5f!`fux$ne$Rf*!2Bb~GO%t|J5L;4 zrOgem^vR&L|9I`y*Z(yzgm>BuV-lGr8l$~03o*I3Df-LP#@OtKZ|Kk*F_nMX{}R|p#%k-)G1cZoN7MHAxVJ}KY!Lq4 zAMcE<34IJ=d2EDne{&ZZN^iQu)246CYX}22`z@h8aI zk>mtRya#a|dZQ%ApFQKCb}p_lBWKAP{@c6v@0^&|(IdI}U7zk<+rK?GH?K#v_^+LQ z?!La(!PGgfUW&r}3f#GMT=-mxN*`P7O;kXcNYC@hft%z)uM;tY8Z|DIFC8;Lno(yG z)lOeK8{~4OjTmEBJ|q^g9s1>*{i&J$hk%YS<&Zt%c8Nv#TBBo1HY;Cto7t1k#DmhVFyn_M`9n`L^xHkSB1!o}a(G`zfdd z4o^G_;VM$`z(nWfj*wN;9*)5TCI0X>Uiq@{`!oZ5Tdk4rMj)UTs_C1G_@t8`vaYAy z5$8{sz>bf?e=X0&y(aL-`pw2K>fX6+UEzNHK7`y}a%B=sAh-o+7* zvg-08vMa4{r130xN!HqUPZ)cY6W`uzmXBfms|D$&YuO(Q{1j&}7LddWh5SPwE?6F5 zk10pgc^Az5ex*-({x5pnvtjXR%@#p_be9kDcC`DGSC(}DB~txr_4xB>UHZ~04po~? zWflQJ^pmKGwKZ3M@!>#eEo_ekOMxCFL6RU+Pbn;>UeQt4T%)A84-qqsbj~oA~s_G`v zx+S4qga-;a`zN3lVlr!aJ25h>C(;05o$-%(;gQLUwa@dScx^5Z^ccni$K_DwUCuVZ zctN}L`zdW5n35@o|7cQFXV5NuxPdl_lP2y92=vBPH4ykmW`b&Rf?Svd5ngF|I5u80 zmn|731?u*TE5t8QX59C)6`#iNN3YpL^B8!@(?J)1@SCG5xj*_5mhyH&)>{RvM*mZL zXR5t79X9?rRw%>#OTY{%uUdn{8UiRY^>y%*9lQ5@m;(}gsi?)GM!sMa-t5#wRW8I;B^BQ{&m0#&5w;7ROQ5vv%m9@bkV$U=+;sFcf zW@FSweACMD%D72b+-^KSP3;v<*tftB*fncHvA3?d_J0 zndoVRZCJ7;B9U?8@)MJ84tL{7rbJD$ZGhS)<2ka(s{~yRZA-Ci?Uc-qDXVj1-6sW$ zWW>K-FIeP0M=Y)273^Vl;h1L$)bB}?2d6qT2Qlj=ml|F%9yvOK*@0x4I201`43cyb zdaJASbui9^--2lZHyKIBv9IFto9-O4f!oQSvT*Sap5 z8QGbV*ALvR$o|O+V1iA^mQjUtkj#uqmV(NSo(F5#EcJ`+`0$A<-S*^hn^tQgu$=3z z6M~?Gf-z1A-<&YH53D{a4##CWXUw<@z9Uxmloxl-Ibk~&Q&e4k?F&1Qty^7P-#M@U zgNgs~aP}@=f9Ca_9o@a1j3bt5r)}kf{=0;=4T>6P4Yq8!#R&41rJU6U3HBxth5&_! zN0N@ji{LY^!}`${pUfVGx*W1{?@ba9`+`Df&5qkUwyVA$sPMj~ zr7akC?wk6xo_+a~>;K1iV~KIB6+=^kx&h=#FKMbV@!fXYX8qUkj`(E%c>hUUaADAx z#f5CSf7MS8K#;YEl3MaW&<{seuYjn31qbGe9Q1!3xuZ%a+p9jI^}ICmZ=k%0vV#9d zbrW_!Jl|e|sW|bD;FB2UlF*pt`yYJ`<=%DVJL(HUVyds&ARS|dxphRP1?T0G~J5g-i8Bqd<1!J zC+Tqow+_$Gg9)eEi*J14+~a9ywJ)190Wc%={xnY!0{_FNQYc(5PT4)8s~8RF+kkR( zYh_p1kY(+T-^gZ$3{~fX$_1T`&-@@a8l%&5aA)&%JExb#1N7z);6!)35%e{a;I}TWfH1 z%xzo>tuQ0JdOAAJX0dBgy>~^5>Ha(@O2B$Qv%58ex8# zqgwHx?(DF~hB(}JO$QIRpT9fzwQaLIH+Ro#X|S zv3~S^bL^Kwn4x0KR2v(*oqS(A4!-|H9vl169yxF4qBh{1>8=lwi7ux*q=oij& z+|UvONiNSKSQ}@e>L@+-^4mDkmr=Q1cvE{mQ2PfeEn{+aHz#BAy$L6bcy#L*7Pm&M zFWYjFaD_M}kLa#KG~iDo%F>1;Z0-)7?;dj0F8(P|$TU;kr(TeZ4pR2CYHB}JcAOJI zx-Ot1M11-}VPzH;+C2zPWsv zqntOEF*V^QqXwASPR7WmhBMHD&cS8$@%06rJTf5}pDz301@*x$>Z0^Icdz*NHZ5)3 z+E+I-yKd{R>~5`FJ$CjzU5I?Un=ox?91mx|uc&|5{sb9p{4l?`nA`nGME{-3MqUx$ z+qt#B1L?ZD*|}A#>)F^lZ~OO59lLQT!ha2($=T6k*VsRoR~;S|ynSEA>8sS_46R?= z+1R-Fdozaq-Ewd5I3Y*{$G)6&E+S z@SM!1Dhq}p{g&qfOO|VbLQU~G6CjdmAg~wcE6dJJ<}$KZ zwkGj0<@V7=ODSe+3R-O&5CahI7=XytYzL{m3ol^NQ%b#z$Gtcu017em%mu@FCge{B zH|VqNVtS&`?VonoWqXJ@fZSbC(>E8%e9DLl_|5lh?~wk!h+Vod*4!x}Rp3*Vj0a0f zNc;QwQ#NGoQ4-4k$R@Qo4}Xko-%L_@>aGkm6wKsYIh^gA+Ya-DMS3V{@3g5D1tgT} zGYV%gDQbjyzp|oQI+rH`HL5E+@mENFS+Ke^NuvE0A-aG=csdKL!%sZDBqzBY@{~A|l9?Xoz`4D|`PZ2AN3P z;IYT4AvbhevqOpq;aN+A==h9kLMS!xJ8%8)pDrL%oN;*k>r*6J$w&~$B#)ek(brfR zUVu$vrJ^;JZu zu>iuwDIB!m3#4D?{{H_6=9VSM7ak`lpH;MU46tIeP*~dTF{VF+nkqtdATlzP)u3K6 zNt4G%<}+MwrZ|+=O&CtPrVH+~$)@!AC@I7v@a?7|{4x>Nct!E1!-`OE|)5-k~alfncTARZnKaT9sf~tQVlgU%iBF}9X^qT*B@}bwtMT_|)FvB$V{7r}FAj3Kkr?D;uzD>^o>j5Jz525$ zDfP3avdzfC3i!AzAa(~P%;rZ^}R=(NjdscGgViP6jCb~X0#QqrADyIPKb*^7%Fp$ zRg$Ur4FkY6sFg233Pr-HX6m5o*L`B3fKU;S0xYIW?SRw$Ua_1mq!N zeW_AFD*SIgu#lk5KrR<3?BKI*nqvR9D79b=$?zF5OBV8#L6yuG@|2T5Bi=3nVud_n zYz)H0>x>vZpAS{WL}5ck-^NvEeP}9BUHg ziWt{imu)_E0Ezs;QZV>fWq?w|*zgcoZ&xtf=uTJKC-PwgBO1+%Z3wB1HIA$YLLRMCV9#Grl(W}) z`9Pz2I3mW_%NX%y{s4X5T`@%T(+qGk15NJ%z{UhH6C!9iz6hQ+HOoM6Ab>7oWQ;Kv za5$M~##&6B5q?95Z>Rb5e-wv|En{URENlQ^y&)Nv1drGl*)`Yl}s?tl= zhRHh|Xl-t|FogrQSu3Iv)AfDrpq%GWqiyakVFBoZp)x2AfV_}fqI#y^QnKUCEq(1j z9T46$?!CMa0C05==v#EDmKmnD9r(3(gxp|Q*-KCmFbhl!gUS}xkTN6FXU;ORuPqggRX(jLLSeMW+NBJp8?nYC0c96F5C5)PPOu^-!+`KD`*3-lX< znN4)bK7gJ_we5kmXk*gDrqh#{LnS|oAq3CLfK1MbTr@P+w5LDW&%MM8U`^!Svp=op zh56<)$N2H2!-OmasDZ1*xD+3ayk11eX0W=OZ0dUOE<14HQ{|d8Y!}SsS)6_SdGf7bz za8Ppx4lGv8P^gYzs5Ab|MdM4n3S}Wfu&hG;Fr&Z54*G_><6raW5VK zK)EC+;KmIh{N0$!HOa9Pdh>8VhT)uYp3fu;4JL7mVs{8x1V+*=Z#Qd` z->K#@F2B+)jkeQiXu-|hepY|>wioD`9>If$Aqt4i4wMyhzy`8{AWxcyTT@%BCElpn zJS_8>!u4EJq5VyWE?+C-Jd6YGPCuC<<~~ipQ;H-y=Yk>TQeuvD91>NP-E)!rRBX{~ zy+rH2VQ#g|LWuuDPaeb~Km%XuK@%(~+i{k{f%<9Oz6L*$3{+&}{0BImknmJkHQiE( zUwUEKIVWU4hK{{zP(l5mLgnHTpkg%>N+89u1PS^;mxr)0?I;(`u<0bAzOWtr0r|t* zKri=!{1BG0Q0#ESbK{Bpy@R}ELMhSi$8WjJyG&o$-z-M<@B*!JsUX~M?WJ%*gjM`$JliJI z>*tLa{k9}wPH;!5ahu&9Xc3H!p|z~Lx6@1h!H>8fpg5^SgN5k!vBw5#mr$CEeG{`Gha10b1 zGXm%`41bjGGk%Pofv~mkIK%eONLc68%-RfSzM3Y;n^EfckPaT$BnQ8Cy(AKJTw^mE zMJe#iarTGjFI(6ZO24gTGAC-bhK{Bo%b{X|`~b%V8if{G_<9G$Y(4*@?oauoh~b*ID{*anpT7zgo~fB*VH<1rzJD0W%kdaKHaxln%`T zR*M2_Cn69kxsV%GLjhrOu%OxA=+dDj!{E(84NR&HbEKFY#ojrr*~Kt1VSNiPL;wag zHD%>+N;~JgH4Wdt$R2lN8bNOl(Ckc%cLbye4-mK^!Wh>V8>0Ro*lreYu;Z7(nG(PE zCkNk595P052V?nvC*3`)3Z`;iKa>&L1pN-ZFXM4jnb^gcVCs-@)L(7j_hGQ_G!y%y zwKVI$p9skrIgyLmzPj(vyMxoW;XUBDQx^Keb{(t%8O?iLj#w`H{@@SqW?{Z|PEkxx zKYHKLhnYu(xX|09BhV}!2QW3;9)q$+AuPzL_K{FErcTJ`)v#=0SF z%TK}-e-dHupmOvh#sXxNhD_r(+UQhf4*1`BvcWnL<4)*=`CJM^d$vvR?g*4r334*<2-m6;y@hh8(99>vqV@DSjIJj=t$Gch%T&w|NijJ=NaBw$r z0{(m5s`3ned%^G>^E7>z2mSq7$9*(k#g5i9ZuXvhI|*Eja!tpV#;KR4^>4;D_e!Z- z7H`@Iv5$;PvUHCCT90eq&U7b1-2wBwZ9B0D`%lBaL~RqajL4+x_vKwB&Iq(?l2PV+ z+OZy1sEcy~_P7bQIhsqc(pWmOf;)x7dK#jc2+>j|cTwYy_~RwxKRgP+GAxc2m~uyc z*JyZCh0C!e68=(QIXuoEW*@(d;CSIO@} z&@+hWl&_4#0#k_u_g7Lc0j2W>$0*5o_@HcfP^sZ;v>lsUZ52GrUZ1w4n`Z-^j>`@B zt+yfS>Y9{xeOQ((zHR9X?dBbIpAo4Xxp2UKkV#cznqDos{)fLuP;)DM>Xl|4|9su* zeonDvs>kk&CG>=O2%02>b0PLEu_F)>h zCvGYIQrXi=+flNPE-2z8cDtj>QAU82q7JJXVNgo z0WLkAY4;O)b-u8>3--4{KJ3~MMQPcQJ-J;01d>S#Nd$j8$R`}M2l{;}aq5Q+h-u8w z(fR-t7Z@7$aFCU2hrJe~g;xO&P9%uy)Bc634R zd?a+5WP-tt0Z`@yyAq;Bajm|V zzKiP^Rf?nKzf2Z6uwW8pD(TDNeX%XZG;LcO;t`5kS~l3`p5Wo_uBO=n!D~1p8OD)N zg-4~nr2KuW+qVAI>Aih?R%dC9&pp!GRH$Xx&=k>mNya9CUj+4h)N$C~_V`55_TV-u#tp*RiyZ z$Vqu%$5bEYz)~?tXhyt-Qp-=Q9J@}?{7&6O^IGWyM9yQF6r_ApVr+&D;u&kO4Wdn~ zQawPz&-vtVk0jNh{q;kNTrcO0eNEvShMoJ%wK8V+0LuQRaZdrBG}?D6+zDSNnJU*o zpwF(>_qXWVMj*ThFWpTrRi*RP75#j}}+J6tGZk*kQIw?6MO zTa*^1q~}M3@jSe!EFv#ByhLqf#m%f)tr=h=$_x}qD#4)zhoKT}kdshP4;iU0J4-gA z4iXpd4jgbC%qO@SMXR+~lY6vl`)~{FzaCT)dtg}upAl`CI^sUZQVEQ7z zFbNCbaS^}ZMOpEIr8efeF*T(JCnPCZTwLwnQA_Kb%pOq|$YCPIKv9@FsJ2YicUq8# zXSldA#jqg{7wD-7^%G_4&NexKN0PnUyrFvc`%kv2y!-dDiuX21aVcQxqTjV-A31#0 zv4`j>*R5L59-iJcg~(wZFx6OKbrwwrt^PNAC{IR@&-qp2o}PG#i+=%tMgVQEyE$aE zk1L9_I0V&)TlK`Fam=+MJowUe>{*<3JO$(ABcqBbyQna=C&#C)|qS&lf0H zxJYLiorDip9O_)57dRjI`A8~!_@DTx4^wXk5EIle-6=TyO0dhdQlt5dbkRWYXAV+U zGg&WfoGW6>R;Vcko{mOyV}u_OC1;#(!=J1hC!M-&ZO3(ICw4ix4P!6i$35 z9#wO4N}jG9y^gdio#Ygrter=j(Te6z1ZQiOF7nYTS1$srDa@i5ub=JiR63|{ED}C* z1Y_L`4l_vV9cbqO{L!Ow8?e!;t}?0(%v|U8BU>lSKm_zgrrMU4d75$xRxJ~ae}T{h zA!1?9aU?uiz?)uRp;Y7~VkQqReqz0XN4mEP$*CK|VhX1Jq>}G0~aLMZC zFLO(&W%O^k-VJlCk5(ae#4gwcTM#>9=U77O$i8!h(a;3MCOc!e0Y%Y58~b+~_(vAQ zyQ0K8DxEb^@&}Bq*%?MkmFI`=+DpJ|gK0J|K1{6&t7D6_7}30$5bIkeTv0zDj}Txc z5>D>noiH?*w!KdDSQk#CTUf2Hugl^I^x%A#w5r7wNc?z_h;s&yxg#Y#I7u%sd>0)a z+3LZBo~AM+`sE9)>dl5dK{=cd)5+GV2P7W z02Nu6rQrwno|mTUcJaR0CfZw<5Xcmm*y^_E^nFu}T=OPi>D+%wTy&vksTWj0HZ1%vc7oTiL8)Y?bXbf zO)=TYmfmJbO}%UB#T^SyNvwcaNo?AeN$#4Xq-GB?76>&?5eRNgz^IKTXeJPR%75Sh zmtznXHX{>14c%Pl6Ya~!cj*?|1bVB%oE~M^`&gX%@oXP+Qk@A5t8%^;LOY2G|7nH!!XG@Vt<=kb$Fx?$tK{!Pn;pFA+!8)@Y zT&ij5dXXI_QmGv@!4pMnV>+=)tygLT-?1DXuM~uLq)>!b(F;k*0&5=B{1s?TN|cu zdC)RVJVnr6jt<)(@&LEAbqgzm>+IO3uwCSB7*ZfpbwO0kpR#xd)q zmj|m)5(%wluXnR(xvorPRKm7&l8;ptn*ai;k32 zA2y9xA0FeAnhdbM7i##8EKssS1-M`+2q*cJxU+Zf6b-U-Rpx!<^f@4 z8O6Cy`pnHd1PY7IoQI)_gLgdf&T-{GO(%g`|NA!}Vj6ahT5n3z*B3QgjIO4YgLy&3 zzR@xz8Fv;%0bbGk*8h3(N66-@+I!UKb#!yHX!(tM*|dJ5XZU`3Z5Dn%!nP`X%oh`P zM9#|JriHJ?o{0w^Ab-DG18g@^Q=94%>JGB2Ube zi>b+2sby$~uF5Da$TVnhOp581P*i7)LX`{61QMOpuxMzw+G&>Qi+IyG^{^2|^4i#< z!Z(-uc5ooK&vJ3*gr-I|-X?o6jre7x-IwE~PqmV18IX z1z2t+$B%0Ml!9O)ialy*bgkgEU1_wEBkR;2TV~nLk0BxW>wMgYg)2X3n5+_pm&Tei z(8c4=<4`IB50(n23dgR`FV0%L-VIkrj#w*Rv(UM9Tn@;>GG9?e6e&vE^%8CIeB0&W zM6$~`d#pj(T&Tw8QjQBcOnEg*(xr85slHq(l&{9fZqF~-)O&v@k@z_jH5>~X6Sd>g za#R8>GoJX`340zyconMLU;4>n#UrK7TB%+3ePqzqKMOl)MSC zX1R}sAs)`Fe_v@kS?Vv$scRwI(7!W2hjE6|Q?x_LfOf|n-j-r}(II`>4iLI#Ic zr;*jn-Q{H4+=gmH%K8N5+M83Vl63<^>b0P0Vl}lhLcv9*$zs%o*cG#GJ8VbnhTZUY zBVvc_L5}Yswm`I9ZCy`p)nwO_B}Gj6|0a4pWy?lX)i^f&4tM{JD3*?kjm42Ek&rTs zo-#)3xe2o#rBMx>m~3;g+^lGiL`)A+?{#Nee)%mSJ-~~!Vj;^#^qH*Q@`8p=mQk0R zUpOahR%*r}DIdDXxJ=QSj&i!9*4Y$()ol||t45*;-Sn(#$ocf<4W+#9sV#*=t8_?M zeKWOUGQdGxGJ)}Gp23pOCD%1gG`{=jc{p%wT&@Y$sm4SNIu2gsNL>}khJz zwj~KV!oHPsi_+ke(+ohS(u|gQb4`!vf^l^%^TFFzsSC$W6;{}BT|Hn*J5-iBY))>5 z_>-_=Vmrb$+Dn2aoUlW(5CPwC)4lmZu*awx;hu#1 zw}S#kfHb%X%zNJz0(o_7YDz+Qsun^*zLkNHn;dqIF%=7tei{|`mp&eWh6jn8C#seR@ zt?1EK%K}OXzqEbG&|Hl1>L9Y>$J6YfR|F5t4aWE$LUkKUDyrn6K~P>_@`feZHF|&I zr+sLvlQMiwRaFe64N2QrRe2(nybJ0xgg0n&d$i}Mb4!RY#+7GK{INpSQ%8YUrC4W_G=Un)ky6I7sRVr;Cs zPihX(s#3vDnZsuKT1HJX-cl;1ugFC{I@erMbs9vq5KMh@YkV<*7-EPB&l}T`Q?H6i zSVGQWk;0{rdWr3Zewm-&?h=v!++Pleuu9!T{Xl=@BG0XnN~iJkyiUp#0E~w5VH6yL z_K-Cy-w3gzc;^DZNf66@(jjSAm57X70j`+W?}PQe1j{)UV8fULXi>K7sqqPPWx#o6 zu1WB!A9F^3U5^dA01H>eI2Yn2hQo-JHHHV?z7eqn^f^#6X}%ulJO{Zgn#$@yfn>0N zhKcw9`K6lrL^P9TXuH6yVS+@S&C?cWneR1G4jNn!zEPG)JXkxv1epex-tV1I7&y?R6=wt-6%Lx8^^19*Z1OM%X z0tb#OuG(O|iuO@b5_&zlAm~50R$}^Qq}dO*h{zW1FVR9j2Z926R89Qpp3F@G0z zEi$^6?(@wj*{BSiL7{+-|L`CbvY0p7?u3Ty&No4kU9HK8uU#6Xt&c@3leVlV5|NPo z{I$QccHfdn1o@?}zl*1y8%*s_e3w;RdaT{F(}$*wb4@h|i&h(=P(vjhB#9m(s#$%; zTE}nuMbo(c=^Dblb?EOI+PRvB-sT+?74cIsGgWJdDkRyGH5Q{)H5D@x5fl5*pmix} ziRH`>Zf_DbARDa>YXTY;y8*&=AT_n5Q8q0iTJjDK3kCep`vYwpviRIOp-V=;!&+Qh zdhPe71zVoTv;GHRH!8S>L!-qIUloUEHp(tQKA12yxFjzv1|(;B_K_1NX6MX(e>z_{`1^6u{#iiZibmNy1z{uGGJ1#*(0 zawl5(2j3Fu$fP28h7&k!PvgLvnqZJGVGFUuI+8 zrLH5O`j4L!UBvFp3@m~62FPp;S%EQC7cw#?b2AmUPr(W?mBWS>j99hiw5bexK;^2A zNBf6=>Ix)PK0S-)Ohr-^QokvEs-o`YOIpGNea#Y6dE}_pBHWiH*~NS?l0>9wivkh> zOo)g!F75(N@E=R^v;m1b!iB|L%XUn8X@YX*>d+FnX#v%{lA|j3aROb)J(x@Pu|C83Op>rS9`- zDZw-H;Wqa02R(=PB9EiHc%#YUjVwbz8tEVNP{Q*-t^M2;hAie7nI~~$53(px?e+k` zK=XOiqYH?mwZO!&rSHBsj0SUdVn>YF0{8&Z2bXZ^{UaEaaKfjAFjmk%)!y-2f#&PgL z@ufwe=4VWx6oSVtZWGwg9`4>b%C8JUSpwcO8BY>Y@bl3Cn!%PBgN&~g&zEPgU~p~Z zgCv;N*kHM!@dQ=bwVwzD7cx+5bB0%5X^$a>)r$0$G&v>6s-etDCNGSd}?t|E6Y81U-UN`9|FlJ>4puF*LaQ$OvqqLT0~l% zlo>P2O;W|lF3dgo0(Mc%q4ABzA7}=yoUz>Xdy;l1<0P)(fkkaGX6qsvJx#IVu)s`T z5b=P^rdKd)m=jws@-s;R(lFdu{tsRWeE;U+6`b`d2Ek!& zX%tE$;{rJJ6)~uaiDRElZjd-w<;_^wM}?R1#eLOC@{p{~AjSQ}p>;Ea=OFWG_lT6& zZeA*c>X?^~m@9}$$8#na7S8#GotuY^xym6LS7(7OuGk zXsz_hxLYDcYxblaj})Zh=nXrN0fQHq?pu5Gl*O9MAvTY1XtUx3>+la6@xy>}ZPhlK z=qPCmvXt>W_>I|`+cdxXxA8WVa`JWL{cR67k9@cp-!b{J#8xO+3^N_m-O$(#tZD|9 zeMm4mxQ{TKIl&lHTH_RBqO{&Y#(=TLS;pw^I?hx)PB@@$_&||`eXnPVg26U_tSA`l zjwcIqmGA9vVGL8+{9MD@FF0SUp2G%?7{(wQJ7uhZy19dfF_0N^ao^d3?gZcmRY|&e zw$(^mjkMKBTaC2UNWWT*l%KyYkFLL_wDnadZwJ|}^=2iq*o)MrL&vxjsQ_{BCvQHQ zb^2a0aBfWm-R#+NmTt9uM!aPOz~VpC=VrchM7`oaYq-q&Tv0bLvw+_(D0SS`+pgR& zFw=@fUmZPVgC3_As3rNf#%QMh))=i|A8w7&tugvV8>2EEK38Cu(*WrWuKC=qwvYcD zx4UKow;atha>@t0P5$;SY@6AgSqyS_K_O7SA2Ur#Gk2MObf0aubKGvPYM{o zt5^)hP|GZ*9Ev%nyXJ^_Pr7S%xvxqo%jxJ(V4P*@rBp4K!YbBFVV%h?8YLNHiJq_C z%G(XgG1zX{qJ6;J1!l~xqBEOeM)177%geknHlJJV7Z+*!46JTz-^ zIa8!(%WGR+tHNviMTJ^QxdPQHsATwIGUX>%arKs6x9sX-S3@+~E=jCbpgYzaMTXSt zk`=JX&3bv6Ul<_ecl=wF5y`;e@2nbFyvHv7+)W=Bdg@9dshX#sg_b@%{iD$8Ss6Ul zW^*8_AZ0Mk^iimm@F5{orFv2VM=3aL3?&p3KeN5Wu9CO29GZ@P5@Ux$ zG)3O^vIHF*qS7Xb1GY(>Tqu%I<$Sqrv0RRBIejJV+^;qIF>OVhLfght!^ zRwj*$+LfbqfdS*BdBKPl?N`Fq)}R3H%C)esODeBL7KD2(vUe+aYhkskycSslan)L6 zM=V+kH*EJ>l(BveKU@pVI z9JQT2-Q3P!<}$f_U4pjGbIK}~7VwKW*?{C`;Pc$O%F-vJa)d1pPStoV+e5DaTfR?; zbtw(au~?=1W>&Ctzs$0h?pJ!P#bxcfYfIe=*OG2^SF9axv+i2afxP6}&`2fLLW5aI z`|@|z<%sO)C#mbW)=tUldRc;=4#$N}NC#|_g1Jy6={9jAzZUUQ0Qpo@Z3@Y$wOWg= zs(&d0r=zW+bQW$t$y1oQ_6s`C%a?Oa9WS{}q{kw+fj&X)%$nQY;TyvP@~ z0)F5^z%H?1i-baPuu>GP5(8yLK-ukIYU{7q_Uml^a|@+Gg!iaUH5;|6C&;w{W+Pgee%#tTui)h;c0x!HQjqLL?43#(|tL4sYp zes?ab$l|#I>w(IxA}c!UH9&c(Wvg(qpB7ricGXHJ`?6v(FGvc*@d+8lO>uwH?4&jS z)~JA+&T)_Mz?!Yt+9n0HLlV@W;Vq#8T5qaVVD(eHuuv%Db(-x8q=bxy20+uvDa)Y7 z%SAGR69AQ3)hfj9vv-IqmUCv;uvr=K`3JLJHUlh13pT;6EDQSv0j$k}MjS`}2ZnV* z=Mw=@r`Wc5>4u7zR?FJwe8~j>nJ1r32_Ko-XXOfH3_@IvRmla=#Ihs#HeS(_6UN!! zW=;ULy3C|Zcj9=X^1=U-6et>AT9}aq7Qn(%1%SdYJCJ#)P}-(LJ)l zX0{(p5oq?+@`Jsw55^GrMMn${`BfE&$nv*?*lU%8&;@#`F6_z-WjNqHUg>Eod+c8D z_xdf}*SviyCb^bKab@n*P&29Zf%8~d)kM~cd90nu?(uOpi8UvORr9N-%UrV;X~mb+ zDZWDOPHC7dXA@E`l4+1yT6~1 zjKg_6c^6H9j~3BsC}sg-ivSP5V5^9%J)uyv+8wZHx= zmiZ^0?mI_pr?FpmHsL&c8e*FtKLT}eJ0{PbDt3Jv$tF*Ce{zC=xkp#={1!n-O6_FZ zeKH?>$^iN$+nz2G5TYW~{+o1Ho!YzV00h^^Q3x0x01NpcXc&98JN|6+hmI>0O_aZ{P0QR(S!?PZPPd;A#mT99LQ?P(U5pU!oa_TxfCEu*CoiKJ1|>}KW7Ws} z%f9<>2B>6z{E0Vv5l^S^XFOlgRxs)51ivRM*Tm6I?EB-!K5YBnGSZLfdZ&a^H04VU zQd%zhLI}XO5&Rr|jL!YVbrlFCntscY<$w>4bLZPLh4N`%=TDbpK{Yg8xP_D2Avr>c zUq0G>-^5R%lAl+}Sl1MVw8;e4zZ_V3 z8sU8+=D;<9-8U=K37WseZ^!52XH7h3QWU^s&4`{>m`t*q;qG2J8?b;TaGY7(=FA2} z?z~Jplo!~}q5nyc@}Hg*rw5}XS%NSxiA|`YqDM~A_bMm{FITM9l2nucFL#rQM z4IBzu{xf%4{vC;XWP%`>{H2hX4g%mm7ZLDZ`Kfu?xsibj#3?s7C8qNx=z9EPpn zvc{4Ar`BI50LaGR1E_%?3Iv2~^9Q$xQX5*l&xk15`*+g*adpL)IsH~j5WSCBsS7f2 zwfVO8>!#s)7r`$3{!k#-cZ40Hu+Ex$*rDl79e4}q=kqvR21OIhHniqBx*0IOb<6=OWT{J=w(U z$i-^%W@-w~gj{>RzYtE|=F%4Trxdfi z^FsEV;IJZ2!U;x-2Ve_wTS6Gq%GAFB)uyaQX@Ig87@!Su5ZqaCSH&1|OJD`@s*y z;W46fCWYMt*Z<-4oc*4X58z~Y5YO@11&R(lNr|utfciH2({cnvVsvY$jEf_d?!Q*I zlg0(^?%Q4!n`o<@0wok&%cbBHgal2+@#xPHx%m-DPHKvZ@T`;_@`SAvK-^o*f6}_k ziHmi*jhF1>C|S}h+0C_2nF81T3`9Gg`~lQ0R^?IPqcq4yBy{koi-gU|cO0@KIp)G+ zC*v`D7bOdir*T|F3-2Vnh~_{8;k=crtWR`r?}EIUC>SxxWU7yf^IJ~+k8q&DExXT7 z5}svpqjB`WPhci7Pch-FsyOuwIF&s!Sw|X$yDS7o3l_kh!i9m13^3B>@(jYXaHAT# zi7@K~lYfL}XFj8IKFvP{5Xjuo{@z~3*SY{@30k6QMg{k?Yo3V;K9{U$ga@Y#DmZAw zy|S%dzu9Q?0x#@0+g>{gdY<2E_Pj=P7fh9-gO#>?YwurUau?Op=X|Qi(V{~MLZFN z{-innb7@I%1<&-_tyZHKHN9vM483;0bLbs*8===84*R`f&Bi4u#nB`%xH1l$>@J2On0j>2-V~ve)3j z&>ts6FaUm2mNj|XnFm{;lOMAt*$o+g0>e9JN58z*zPuZoi)}&rD&y#Z~=HR z^;{~Udd~Ju*X0+yK9!?i;v@Lcz+)-hxZ)2f(&XD8;Rmh`UTFS;x3HH4gD05qKaSL6 z%nlR3*3?5j?V`4@CYR|T@@dW(zl-H>D~E73RhMwGH4=$o?t_@XPwB7tUhpO-G%zd~ zoj)%edsG(;CXXG`j!$#-`~hB^@6piT`IOlJ(Do?rE%%FU{- zcH{7H=nuV~UvGNtZolXC2f+JHf9UrQyZ$h!5BZg6G#>v!-E11Sp$L}8iqku#CDqF_ z#rxbCVRUt#jQFgQ?}avvs47bhU){#91Q@j|-`#h(A5BxRM3hOMz|? zdW(yASqodU9OoF7FX4(TnWPq>2M;T@MkH7E@tUUKC`im4bv?G=uk3x_n2c%^Bc zRO`%1v+P1Ex(~tgV zAdNovC1ek^hGor!bR{3!D9{4LJXX&rty-bhNW@VemrPcakaCzsl&J$!cEqKuBoaeH zusO=?eRduvATY;~&=n+{kC+tSdwWtGsNQ>fYJeq*aQ_NJP!}XOY;}U;;-XlJ`VauQJBH|fm z6^cp^l8+>dMpsi{yjP=nvcRHL^Y9pD(QdZjga~GS{oRFW+M#<*9=S`N%y}~o7T1LR z4Q%#j=G-%p+ouU`Rc!W)FathWEzRw3Y{%nm z(IQ_NZ+j+eTdFZ5MVc^l8HjN7gi_#?5AFJO7Gi)`Di)N}aULNf0sHVM+=wD@UyY)1 z_&eV)?6lYC7Qgc*uSCTI)llfm^caQwK>y#VJz&JI^hZ-O>b`)zp9uArt-U}rexYx$ zARaF#)7QxC8n(*I!&#m%KWgA6#-y!60NR=xotx^x8@gOcq ze?`rCI}C_HFgi{PH&!fq5asfM$qOhlnm!qrEA`#L=ynZ$3B3Zp_@(^aD7=sX>cql0cysa zKKX6@tN2-~9`2&uHH~keU9yN~tP#2>$A^$PLek@LobL>IMpFY*WTDhnA=#?We&*VD5y#`jXr}8K@rWZl2ae5~ z=856D)2G^BJySTseM=PsHaT5wM*O6|s-9I%I36^HOBqb$?xd@cdSvJs6_-@TX^R`D zl%(X+l%0&GG!oOPLd6n^{FXPIMo2FZIx#=<*89^6N=MV z1jU8)R4B}nnv(LAbah!!!_RpD)uyszPqB zRzKwwWuw_4&GR@~x?Wc8t*NCOIjga*nl3%xb<{NOM4q+$3%`N=A>wN9H&@a0{lK5U zCti3jYEeS#H{z(@q#^D@&2L~@l@8z5DZ5?vKHb1 z9oJ8y8_wfd7~f3M_St7IwZDi8pvFb=6#CkY#SxKX;TfZN58oiEx*x?eU)F{(j^`mWtRG@3oXRbTP3GmT~^TVa4tYRTio)U~O8smni zoj?z2>zT5fwq!p8zfYm{rYc^UW{oVUM-Q~h~CRGaAHqBy%hhRYQL*zR*4S* z&KFjXeVOcQ-?ZSyN2*AE6c?p z?LmLw`Hg$2)2DSF1ek<$*Ew4Td1{jzgd4r~3_l7}hIBd85`k>xkgEcuF-Qt~d znD%bVl=sV&DPT+Nrb9j|LzCJa*X7An1_=?~8$m!aZ7(X*S9H!`LiaiXjks>>^ zz;iP=t766k2~(WSC(Qabhq*s$sk2WTSk7Pm_dGpmWi13_vt@mNs2^8GxqJ`8A{No( z59ZNZ!)pf;XX%e$P>?CXxU283(GP-WjZBiI3KxQpZ$N)V5=>bp_; zsg&s3GH=^5Z<{Rh)_Tw~Z!T8eXqC6GBGvvgsoz#FtluUmZRW<8FW#0@)Z?LQx4BDD zuu3ITJ&9H4=LD>TK3LD^zE*`c}|5ve(y9ovppC&USy**)Ae19MA2!lO-Ip z&*H0JSB5|=|9u45&(?&XWesag7K{*j*~D8;B%HNU}6dS49P7@aT7S;Z1gea zUp`+>QP?iP*TVB84?RlMg!yj~pT|eyJy^foh`L6P8;z5bvT1hA|90meAC4!uD;tb4siquw~I zH~Z~=xW(;N8h zuGb6d?I0Wuo1NY!7eJj_)y_6&eX;Q83-_cSx8&S^7{>#DoHa_t8J&ymD)#ODhq`BW z?`Dm=s8O#+(IMz%P{d%|wfkPbUT=HdPNy^IbnBglzm9Q7)YauZuI4tJ{b3`|HXF7s zpz-V8<4lCSio2xO`e{rt!B-U9UJrXgquFeEVWSRO0)BdfL9-1fqQic}Z?zkp;X1aH z78#`Nn(Yp`za3(S6_em9jwk+F82V97()-o+l{EO?-uG}oG5vw0xM5@L?dh`2s&q#h z95xab|B>0(IW8(ApYJ@%1+h2oIak#%sXs(#LDgZqU8z6d8MO=zTSTn`^M`?Sm) zipvo0GdUTU4S5f#V;}>DDV@?t$Am|sq+sAKg=m1hh$m{YH?S+Pl3`9iUNjJBkzgP7 zF-wipVMC9mkxKJijh#jcoG{jjG?svef&$ZlE+0+(h44uqF>QsoJUe12u9VyK#Bi>2 zl28>&a(@OqI#ah@HCF5va0|lW}ocin)dgUj~kf>>Ox| zdgJq2n%ORCz%g_dP_$(s#QA;OHGPnD0=r(vBVFPnjWy_0f5e$i%wnXo!ypR$C5i|> zF&$&ck=40?zF;Cp&~Ui+X~byCvB5m*Kyoc0#v4vdrO*Y$tr;(8TnawmQX-a)oX&E%zUsGy^8eT(ogXnAH zA~=L5mfxII_NAO&apnjiW2|ybo3=*#T2{78_~nvG>b2Ztl1EG%S(Ud@yUZ_xVc^SA zHEUpex^r(OhGoV`leff!gYBnR6+n5$Np*FxPG*U8kQ&ol>3?zudyUd3{`XmS%9Utu#O3B)oe*MTTM^83rr{wO0cOrMzipjSp`#*an0J} z%Q(B()oc_|DIUJ7OBLm5xGUmzGCngYmFipL@Bz5?gx4;z+`m~i4LP4`Rugip=v}MK zxmhXp`{@YQOdadMwv`jhk!zm|>)Un2?XuYt-xoUj+Nq?0vp!n6%Hl8FeVa9B3hHAP z7Ox}&8rI#SJUTwOw{a_fHYA}otK!fd~xo-3nA-Zj8#jAHKhM>9ydxw*<#&*9N+#)+I0fs%TDS1gCr zx6Q9(Iq3FBmf3Wy2(PwDrmcC%U$G+chH>?RY-l}NmSx00pRR?^J&>=4Q;vf2jQQvu z6X7CBKl*jA+*FA@o}}4YS20-YTu|dZC;iDUcrw`p_~|gb$pyBeG%#@$sIGl<7u7hv zGH&}2G8el}(3mmc(`8_s-ZW+4F-+th#6Ppa($VyirX>9nnKa%%?kCjEzeepvZvhuH!JRI6FugtW*opkit^6WaFbU%nfTHoqdk$(}e?POiaw8 zKJ=|Zok=;fz>ry{5=1ms0K?qv>K^u&bG3U&dBt5zFVBq+3CjC-cUfc_P!%XfSQCFb znk~otdSM-qaG+(Ac%J#5Au#T>6(d4Rz^~(Lz+c0NzGH~CYJNNkzh_B@OBc;d4n>Z7 zGrwZ5uO`OwZfxOb1d3h|^{8Q&p)yKT+LM;hpo<2Qq=~%@+jU>L?kjZpeXCv(k?nMl zbS~E_zJ(lTFz&YW*0%K4CQEO%AGGvVK0~ilfNPsa{V;jdUqmUe!V(bWOM(@Gd8oo* z?z#u8QgxYJ7#l1MmODnWEevK%JZDnd!eB0ivMmf|{c}xcTNq5d|LO{ZWyPxOd*{Mn z&N?L$diBC!);uc|2DAEB&^WSJZeg$u+0#Zhd4<;SM!bTRn*3eP5$a}6uRtdEuJ$Ou zHkP^U8D)rPc!SDHF;h$42oqR>5B%s8NCWG^(v<`5n_EdBn5zWg4E+*L z*kH9n6CRaej7~{fFGbM{gmR8oSpVSS+joNc@8Gz9@FIf;zW{hMJOezFck#uC(G1$w zjhUc(nwx!aWlXIP-yWJ&vCF&_nV}UVdu9u+ZLRLimIDw4*U|i?3DIeg>09*s#e~er zZ)VTGfkSCLy?TzfG)LbYh`-qRIP#Myb*ACbH%)&VL__YGgEQuMEYstp)&nrJ=a*9e z{+ECHpKyFsety}2edDuh0DbIqLpg22#XO3n%Sn1Lt&dL5Hyxe&%o-lg!&4K^iz~LQTeoWv%KZqQY7cmsl(InAKK1}1ADYs@}2>Ofh zKXC-SO~d>+B45n!P$X(KHnSICV$*$JP4k_8fu;C|dzmS1yhJeW7!M|#Y*Rp(^aWo~zgDjRMgAS;NKL$jTbgGi&eve*?@h#$??tynva6OG- z5cG_oLpo(j4OhGpmQ!E&A0o_lR0n}u=`l|kcA-J7(WEFpkYBka5z`M5EE?fumt5|V zi(PrS#x&l73ODj&)xkKr^2Y~4Sb6w#Opbbg>;d-zp8zkM^S8tX=*~fx6PwVI%=tYq z44Wn}!(SjH30u4*NM$Un510aS!^LBU5*g;{!x->jJbG@=9T;mq&CETTddq}k#eaGe zuCxzuxew4!;{`xXIu&>zq5lpm&m7O<8xVBY5#~Za=Y^{{f28yMIP#_ANOWg!zq@$H zPR>vHHiJ3BOb_C*$sDG$DbYkzqsC;TbAOJd?6sHO^riAwYp>hdYh_94uu~?@+vP+a zxzz#fGbAU!sqhE!a^WZ~N6Y+=`GUg$sia332QKhR`lV8;$o4PNRrwaYoJ6)^2?M@# z*MRHCZ$^_Vmdpc~Mf*hqEOM5>cTs`FS#b#0`&Ya-RnBGp|Vsr)OoD(>HEB0S?Dy_59b%>0{onSb-~ z=kNa9QOWtY9)JEhRrAZuzkR3q%QILd1ROr=l^AemUS^*9pLy3$LriZu=Z?0Q{PPYx zMyJvAnx=bDIX8DQ_MB!Hr;mTqyNY-vmkAlh_;m@#rxkXzC@ljs9ToYj=I!0kWyk7| zb@6CZZ2wbZ*EXa0Rj{N6aWAK2ml+l zVps$h{rH8Q000LI1ppBM0000000031AOHXW_6q<2ZDDC{RAp^&Y+-a|E^2dcZcs}F W1^@s600IC40E7Sl0II0~00015iD-TR literal 0 HcmV?d00001 diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Package/createUiDefinition.json b/Solutions/Microsoft Exchange Security - Exchange Online/Package/createUiDefinition.json index 8be3d7069a0..635d71d77cb 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Package/createUiDefinition.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n β€’ Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20Online/ReleaseNotes.md)\r \n _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe Exchange Security Audit and Configuration Insight solution analyze Exchange Online configuration and logs from a security lens to provide insights and alerts.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Custom logs ingestion via Data Collector REST API](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-collector-api?tabs=powershell)\n\n**Data Connectors:** 1, **Parsers:** 3, **Workbooks:** 2, **Watchlists:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\nβ€’ Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20Online/ReleaseNotes.md)\n\n β€’ There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Exchange Security Audit and Configuration Insight solution analyze Exchange Online configuration and logs from a security lens to provide insights and alerts.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Custom logs ingestion via Data Collector REST API](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-collector-api?tabs=powershell)\n\n**Data Connectors:** 1, **Parsers:** 6, **Workbooks:** 4, **Watchlists:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -79,7 +79,7 @@ "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The solution installs three (3) parsers that transform ingested data. The transformed logs can be accessed using the ExchangeConfiguration, MESCheckVIP and ExchangeEnvironmentList Kusto Function aliases." + "text": "The solution installs six (3) parsers that transform ingested data. The transformed logs can be accessed using the ExchangeConfiguration, MESCheckVIP and ExchangeEnvironmentList Kusto Function aliases." } } ] @@ -149,6 +149,34 @@ } } ] + }, + { + "name": "workbook3", + "type": "Microsoft.Common.Section", + "label": "Microsoft Exchange Online Admin Activity", + "elements": [ + { + "name": "workbook3-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Workbook is dedicated to Online Exchange organizations. It uses Office Activity logs. It helps to track admin actions, especially on VIP Users and/or on Sensitive Cmdlets. Required Data Connector: Microsoft 365 (Exchange)." + } + } + ] + }, + { + "name": "workbook4", + "type": "Microsoft.Common.Section", + "label": "Microsoft Exchange Search AdminAuditLog - Online", + "elements": [ + { + "name": "workbook4-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This workbook is dedicated to Online Exchange organizations. It uses the Office Activity logs to give you a simple way to view administrators’ activities in your Exchange environment with Cmdlets usage statistics and multiple pivots to understand who and/or what is affected to modifications on your environment. Required Data Connector: Microsoft 365 (Exchange)." + } + } + ] } ] }, @@ -175,13 +203,13 @@ { "name": "watchlist1", "type": "Microsoft.Common.Section", - "label": "Exchange VIP", + "label": "Exchange Online VIP", "elements": [ { "name": "watchlist1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "ExchangeVIP Watchlist contains a list of VIP users that are allowed to perform privileged operations on Exchange Servers. This watchlist is used by the ServerOrientedWithUserOrientedAdministration rule to detect suspicious activity by VIP users." + "text": "ExchOnlineVIP Watchlists contains a list of VIP users identified in Exchange Online that would be more monitored than others. This watchlist is used in the Audit log workbooks to filter activities on those users." } } ] diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Package/mainTemplate.json b/Solutions/Microsoft Exchange Security - Exchange Online/Package/mainTemplate.json index a570c60e504..15411ad53c3 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Package/mainTemplate.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Package/mainTemplate.json @@ -44,9 +44,25 @@ "description": "Name for the workbook" } }, + "workbook3-name": { + "type": "string", + "defaultValue": "Microsoft Exchange Online Admin Activity", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "workbook4-name": { + "type": "string", + "defaultValue": "Microsoft Exchange Search AdminAuditLog - Online", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, "watchlist1-id": { "type": "string", - "defaultValue": "ExchangeVIP", + "defaultValue": "ExchOnlineVIP", "minLength": 1, "metadata": { "description": "Unique id for the watchlist" @@ -57,7 +73,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Microsoft Exchange Security - Exchange Online", - "_solutionVersion": "3.0.4", + "_solutionVersion": "3.1.1", "solutionId": "microsoftsentinelcommunity.azure-sentinel-solution-esionline", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "ESI-ExchangeOnlineCollector", @@ -67,44 +83,77 @@ "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", - "dataConnectorVersion1": "1.1.0", + "dataConnectorVersion1": "1.1.1", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", "parserObject1": { - "_parserName1": "[concat(parameters('workspace'),'/','ExchangeConfiguration')]", - "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ExchangeConfiguration')]", + "_parserName1": "[concat(parameters('workspace'),'/','ExchangeConfiguration Data Parser')]", + "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ExchangeConfiguration Data Parser')]", "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('ExchangeConfiguration-Parser')))]", "parserVersion1": "1.6.1", "parserContentId1": "ExchangeConfiguration-Parser" }, "parserObject2": { - "_parserName2": "[concat(parameters('workspace'),'/','ExchangeEnvironmentList')]", - "_parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ExchangeEnvironmentList')]", + "_parserName2": "[concat(parameters('workspace'),'/','ExchangeEnvironmentList Data Parser')]", + "_parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ExchangeEnvironmentList Data Parser')]", "parserTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('ExchangeEnvironmentList-Parser')))]", "parserVersion2": "1.0.1", "parserContentId2": "ExchangeEnvironmentList-Parser" }, "parserObject3": { - "_parserName3": "[concat(parameters('workspace'),'/','MESCheckVIP')]", - "_parserId3": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MESCheckVIP')]", + "_parserName3": "[concat(parameters('workspace'),'/','MESCheckVIP Data Parser')]", + "_parserId3": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MESCheckVIP Data Parser')]", "parserTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MESCheckVIP-Parser')))]", "parserVersion3": "1.0.0", "parserContentId3": "MESCheckVIP-Parser" }, - "workbookVersion1": "1.0.1", + "parserObject4": { + "_parserName4": "[concat(parameters('workspace'),'/','MESCheckOnlineVIP Data Parser')]", + "_parserId4": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MESCheckOnlineVIP Data Parser')]", + "parserTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MESCheckOnlineVIP-Parser')))]", + "parserVersion4": "1.0.0", + "parserContentId4": "MESCheckOnlineVIP-Parser" + }, + "parserObject5": { + "_parserName5": "[concat(parameters('workspace'),'/','MESCompareDataMRA Data Parser')]", + "_parserId5": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MESCompareDataMRA Data Parser')]", + "parserTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MESCompareDataMRA-Parser')))]", + "parserVersion5": "1.0.0", + "parserContentId5": "MESCompareDataMRA-Parser" + }, + "parserObject6": { + "_parserName6": "[concat(parameters('workspace'),'/','MESOfficeActivityLogs Data Parser')]", + "_parserId6": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MESOfficeActivityLogs Data Parser')]", + "parserTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MESOfficeActivityLogs-Parser')))]", + "parserVersion6": "1.0.0", + "parserContentId6": "MESOfficeActivityLogs-Parser" + }, + "workbookVersion1": "1.1.0", "workbookContentId1": "MicrosoftExchangeLeastPrivilegewithRBAC-Online", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", - "workbookVersion2": "1.0.1", + "workbookVersion2": "1.1.0", "workbookContentId2": "MicrosoftExchangeSecurityReview-Online", "workbookId2": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId2'))]", "workbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2'))))]", "_workbookContentId2": "[variables('workbookContentId2')]", "_workbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId2'),'-', variables('workbookVersion2'))))]", - "Exchange VIP": "Exchange VIP", - "_Exchange VIP": "[variables('Exchange VIP')]", + "workbookVersion3": "1.0.0", + "workbookContentId3": "MicrosoftExchangeAdminActivity-Online", + "workbookId3": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId3'))]", + "workbookTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId3'))))]", + "_workbookContentId3": "[variables('workbookContentId3')]", + "_workbookcontentProductId3": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId3'),'-', variables('workbookVersion3'))))]", + "workbookVersion4": "1.0.0", + "workbookContentId4": "MicrosoftExchangeSearchAdminAuditLog-Online", + "workbookId4": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId4'))]", + "workbookTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId4'))))]", + "_workbookContentId4": "[variables('workbookContentId4')]", + "_workbookcontentProductId4": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId4'),'-', variables('workbookVersion4'))))]", + "Exchange Online VIP": "Exchange Online VIP", + "_Exchange Online VIP": "[variables('Exchange Online VIP')]", "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ @@ -117,7 +166,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Exchange Security - Exchange Online data connector with template version 3.0.4", + "description": "Microsoft Exchange Security - Exchange Online data connector with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -152,14 +201,14 @@ "dataTypes": [ { "name": "ESIExchangeOnlineConfig_CL", - "lastDataReceivedQuery": "ESIExchangeOnlineConfig_CL | summarize Time = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" + "lastDataReceivedQuery": "ESIExchangeOnlineConfig_CL | summarize Time = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "ESIExchangeOnlineConfig_CL | summarize LastLogReceived = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" + "ESIExchangeOnlineConfig_CL | summarize LastLogReceived = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" ] } ], @@ -202,6 +251,19 @@ ] }, "instructionSteps": [ + { + "description": ">**NOTE - UPDATE**", + "instructions": [ + { + "parameters": { + "text": "

NOTE - UPDATE:

We recommend to Update the Collector to Version 7.6.0.0 or highier.
The Collector Script Update procedure could be found here : ESI Online Collector Update", + "visible": true, + "inline": false + }, + "type": "InfoMessage" + } + ] + }, { "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected. Follow the steps for each Parser to create the Kusto Functions alias : [**ExchangeConfiguration**](https://aka.ms/sentinel-ESI-ExchangeConfiguration-Online-parser) and [**ExchangeEnvironmentList**](https://aka.ms/sentinel-ESI-ExchangeEnvironmentList-Online-parser) \n\n**STEP 1 - Parsers deployment**", "instructions": [ @@ -336,7 +398,7 @@ ], "metadata": { "id": "fe7ccc48-e21b-4b90-b83e-9c8a6cb17d2f", - "version": "1.1.0", + "version": "1.1.1", "kind": "dataConnector", "source": { "kind": "solution", @@ -444,14 +506,14 @@ "dataTypes": [ { "name": "ESIExchangeOnlineConfig_CL", - "lastDataReceivedQuery": "ESIExchangeOnlineConfig_CL | summarize Time = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" + "lastDataReceivedQuery": "ESIExchangeOnlineConfig_CL | summarize Time = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "ESIExchangeOnlineConfig_CL | summarize LastLogReceived = max(EntryDate_s) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" + "ESIExchangeOnlineConfig_CL | summarize LastLogReceived = max(todatetime(EntryDate_s)) by GenerationInstanceID_g, ESIEnvironment_s |take 1 | project IsConnected = true" ] } ], @@ -500,6 +562,19 @@ ] }, "instructionSteps": [ + { + "description": ">**NOTE - UPDATE**", + "instructions": [ + { + "parameters": { + "text": "

NOTE - UPDATE:

We recommend to Update the Collector to Version 7.6.0.0 or highier.
The Collector Script Update procedure could be found here : ESI Online Collector Update", + "visible": true, + "inline": false + }, + "type": "InfoMessage" + } + ] + }, { "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected. Follow the steps for each Parser to create the Kusto Functions alias : [**ExchangeConfiguration**](https://aka.ms/sentinel-ESI-ExchangeConfiguration-Online-parser) and [**ExchangeEnvironmentList**](https://aka.ms/sentinel-ESI-ExchangeEnvironmentList-Online-parser) \n\n**STEP 1 - Parsers deployment**", "instructions": [ @@ -645,7 +720,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExchangeConfiguration Data Parser with template version 3.0.4", + "description": "ExchangeConfiguration Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -775,7 +850,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExchangeEnvironmentList Data Parser with template version 3.0.4", + "description": "ExchangeEnvironmentList Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -905,7 +980,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MESCheckVIP Data Parser with template version 3.0.4", + "description": "MESCheckVIP Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -1026,6 +1101,396 @@ } } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject4').parserTemplateSpecName4]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MESCheckOnlineVIP Data Parser with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject4').parserVersion4]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject4')._parserName4]", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for VIP Check for Exchange Online", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MESCheckOnlineVIP", + "query": "//let UserToCheck = \"SampleEntry\";\nlet _UserToCheck = iif(UserToCheck == \"\" or UserToCheck == \"All\",\"All\",tolower(UserToCheck));\nlet fuzzyWatchlist = datatable(DisplayName:string, sAMAccountName:string, userPrincipalName:string) [\n \"NONE\",\"NONE\",\"NONE\"];\n let Watchlist = union isfuzzy=true withsource=TableName _GetWatchlist('ExchOnlineVIP'), fuzzyWatchlist | project-away TableName;\nlet SearchUser = Watchlist | where _UserToCheck =~ DisplayName \n or _UserToCheck =~ userPrincipalName \n or _UserToCheck =~ sAMAccountName \n or _UserToCheck == \"All\"\n| extend ValueChecked = iif(_UserToCheck==\"All\",strcat(\"#\",DisplayName,\"#\",userPrincipalName,\"#\",sAMAccountName),_UserToCheck);\nSearchUser\n", + "functionParameters": "UserToCheck:string = \"All\"", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject4')._parserId4,'/'))))]", + "dependsOn": [ + "[variables('parserObject4')._parserId4]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Parser for VIP Check for Exchange Online')]", + "contentId": "[variables('parserObject4').parserContentId4]", + "kind": "Parser", + "version": "[variables('parserObject4').parserVersion4]", + "source": { + "name": "Microsoft Exchange Security - Exchange Online", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Community", + "tier": "Community", + "link": "https://github.com/Azure/Azure-Sentinel/issues" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject4').parserContentId4]", + "contentKind": "Parser", + "displayName": "Parser for VIP Check for Exchange Online", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", + "version": "[variables('parserObject4').parserVersion4]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2022-10-01", + "name": "[variables('parserObject4')._parserName4]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for VIP Check for Exchange Online", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MESCheckOnlineVIP", + "query": "//let UserToCheck = \"SampleEntry\";\nlet _UserToCheck = iif(UserToCheck == \"\" or UserToCheck == \"All\",\"All\",tolower(UserToCheck));\nlet fuzzyWatchlist = datatable(DisplayName:string, sAMAccountName:string, userPrincipalName:string) [\n \"NONE\",\"NONE\",\"NONE\"];\n let Watchlist = union isfuzzy=true withsource=TableName _GetWatchlist('ExchOnlineVIP'), fuzzyWatchlist | project-away TableName;\nlet SearchUser = Watchlist | where _UserToCheck =~ DisplayName \n or _UserToCheck =~ userPrincipalName \n or _UserToCheck =~ sAMAccountName \n or _UserToCheck == \"All\"\n| extend ValueChecked = iif(_UserToCheck==\"All\",strcat(\"#\",DisplayName,\"#\",userPrincipalName,\"#\",sAMAccountName),_UserToCheck);\nSearchUser\n", + "functionParameters": "UserToCheck:string = \"All\"", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject4')._parserId4,'/'))))]", + "dependsOn": [ + "[variables('parserObject4')._parserId4]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Parser for VIP Check for Exchange Online')]", + "contentId": "[variables('parserObject4').parserContentId4]", + "kind": "Parser", + "version": "[variables('parserObject4').parserVersion4]", + "source": { + "kind": "Solution", + "name": "Microsoft Exchange Security - Exchange Online", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Community", + "tier": "Community", + "link": "https://github.com/Azure/Azure-Sentinel/issues" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject5').parserTemplateSpecName5]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MESCompareDataMRA Data Parser with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject5').parserVersion5]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject5')._parserName5]", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for MRA Configuration Data Comparison", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MESCompareDataMRA", + "query": "// Version: 1.0.0\n// Last Updated: 25/02/2024\n// \n// DESCRIPTION:\n// This parser is used to compare the data of a specific section of the Exchange Online Configuration. It will compare the data of a specific section between two dates and return the differences between them.\n//\n// USAGE:\n// Parameters : 7 parameters to add during creation. \n// 1. SectionCompare, type string, default value \"\"\n// 2. DateCompare, type string, default value \"lastdate\"\n// 3. CurrentDate, type string, default value \"lastdate\"\n// 4. EnvList, type string, default value \"All\"\n// 5. TypeEnv, type string, default value \"Online\"\n// 6. CurrentRole, type string, default value \"\"\n// 7. ExclusionsAcct, type dynamic, default value dynamic(\"\")\n//\n// Parameters simulation\n// If you need to test the parser execution without saving it as a function, uncomment the bellow variable to simulate parameters values.\n//\n// let SectionCompare = \"SampleEntry\";\n// let EnvList = \"All\";\n// let TypeEnv = \"Online\";\n// let CurrentRole = \"\";\n// let ExclusionsAcct = dynamic(\"\");\n// let DateCompare = \"lastdate\";\n// let CurrentDate = \"lastdate\";\n//\n// Parameters definition\nlet _SectionCompare = SectionCompare;\nlet _EnvList =EnvList;\nlet _TypeEnv = TypeEnv;\nlet _CurrentRole =CurrentRole;\nlet _ExclusionsAcct = ExclusionsAcct;\nlet _DateCompare = DateCompare;\nlet _CurrentDate = CurrentDate;\nlet _DateCompareB = todatetime(DateCompare);\nlet _currD = (ExchangeConfiguration(SpecificSectionList=_SectionCompare,SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\n| summarize TimeMax = max(TimeGenerated)\n| extend TimeMax = tostring(split(TimeMax,\"T\")[0])\n| project TimeMax);\nlet _CurrentDateB = todatetime(toscalar(_currD));\nlet BeforeData = \n ExchangeConfiguration(SpecificSectionList=_SectionCompare,SpecificConfigurationDate=_DateCompare,SpecificConfigurationEnv=_EnvList,Target=_TypeEnv)\n | where CmdletResultValue.Role contains _CurrentRole\n and CmdletResultValue.RoleAssigneeName !in (_ExclusionsAcct)\n and CmdletResultValue.Name !contains \"Deleg\"\n | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\n | extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType == \"User\", \"User\", \"RoleGroup\")\n | extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\n | extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\n | extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\n | extend RecipientWriteScope = tostring(CmdletResultValue.RecipientWriteScope)\n | extend ConfigWriteScope = tostring(CmdletResultValue.ConfigWriteScope)\n | extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\n | extend Status= tostring(CmdletResultValue.Enabled)\n | extend RoleAssignmentDelegationType = iff(CmdletResultValue.RoleAssignmentDelegationType == \"6\", \"Delegating\", \"Regular\") \n | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\n | extend Role = tostring(CmdletResultValue.Role)\n | extend RoleAssignmentDelegationType = tostring(CmdletResultValue.RoleAssignmentDelegationType)\n ; \nlet AfterData = \n ExchangeConfiguration(SpecificSectionList=_SectionCompare,SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\n | where CmdletResultValue.Role contains _CurrentRole\n and CmdletResultValue.RoleAssigneeName !in (_ExclusionsAcct)\n and CmdletResultValue.Name !contains \"Deleg\"\n | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\n | extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType == \"User\", \"User\", \"RoleGroup\")\n | extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\n | extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\n | extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\n | extend RecipientWriteScope = tostring(CmdletResultValue.RecipientWriteScope)\n | extend ConfigWriteScope = tostring(CmdletResultValue.ConfigWriteScope)\n | extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\n | extend Status= tostring(CmdletResultValue.Enabled)\n | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\n | extend Role = tostring(CmdletResultValue.Role)\n | extend RoleAssignmentDelegationType = tostring(CmdletResultValue.RoleAssignmentDelegationType)\n ;\nlet i=0;\nlet allDataRange = \n ESIExchangeOnlineConfig_CL\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\n | where ESIEnvironment_s == _EnvList\n | where Section_s == \"MRA\"\n | extend CmdletResultValue = parse_json(rawData_s)\n | project TimeGenerated,CmdletResultValue,WhenChanged = WhenChanged_t, WhenCreated=WhenCreated_t\n | where CmdletResultValue.Role contains _CurrentRole\n and CmdletResultValue.RoleAssigneeName !in (_ExclusionsAcct)\n and CmdletResultValue.Name !contains \"Deleg\"\n | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\n | extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType == \"User\", \"User\", \"RoleGroup\")\n | extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\n | extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\n | extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\n | extend RecipientWriteScope = tostring(CmdletResultValue.RecipientWriteScope)\n | extend ConfigWriteScope = tostring(CmdletResultValue.ConfigWriteScope)\n | extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\n | extend Status= tostring(CmdletResultValue.Enabled)\n | extend Role = tostring(CmdletResultValue.Role)\n | extend RoleAssignmentDelegationType = tostring(CmdletResultValue.RoleAssignmentDelegationType)\n ;\nlet DiffAddDataP1 = allDataRange\n | join kind = rightanti (AfterData | where WhenCreated >=_DateCompareB) on WhenCreated\n;\nlet DiffAddDataP2 = allDataRange\n | join kind = innerunique (allDataRange ) on WhenCreated\n | where WhenCreated >=_DateCompareB\n | where bin(WhenCreated,5m)==bin(WhenChanged,5m)\n | distinct ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated\n;\nlet DiffAddData = union DiffAddDataP1,DiffAddDataP2\n| extend Actiontype =\"Add\";\nlet DiffRemoveData = allDataRange\n | join kind = leftanti AfterData on RoleAssigneeName\n | extend Actiontype =\"Remove\"\n | distinct Actiontype,ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated\n | project WhenChanged=_CurrentDateB,Actiontype,ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated\n ;\nlet DiffModifData = union AfterData,allDataRange\n| sort by ManagementRoleAssignement,WhenChanged asc\n| extend Status = iff( ManagementRoleAssignement == prev(ManagementRoleAssignement) and Status != prev(Status) and prev(Status) !=\"\" , strcat(\"πŸ“ \", Status, \" (\",prev(Status),\"->\", Status,\" )\"),Status)\n| extend CustomRecipientWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and CustomRecipientWriteScope != prev(CustomRecipientWriteScope) and prev(CustomRecipientWriteScope) !=\"\" , strcat(\"πŸ“ \", CustomRecipientWriteScope, \" (\", prev(CustomRecipientWriteScope),\"->\", CustomRecipientWriteScope, \")\"),CustomRecipientWriteScope)\n| extend CustomConfigWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and CustomConfigWriteScope != prev(CustomConfigWriteScope) and prev(CustomConfigWriteScope) !=\"\" , strcat(\"πŸ“ \", CustomConfigWriteScope, \" (\", prev(CustomConfigWriteScope),\"->\", CustomConfigWriteScope, \")\"),CustomConfigWriteScope)\n| extend RecipientWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and RecipientWriteScope != prev(RecipientWriteScope) and prev(RecipientWriteScope) !=\"\" , strcat(\"πŸ“ \", RecipientWriteScope, \" (\", prev(RecipientWriteScope),\"->\", RecipientWriteScope, \")\"),RecipientWriteScope)\n| extend ConfigWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and ConfigWriteScope != prev(ConfigWriteScope) and prev(ConfigWriteScope) !=\"\" , strcat(\"πŸ“ \", ConfigWriteScope, \" (\", prev(ConfigWriteScope),\"->\", ConfigWriteScope, \")\"),ConfigWriteScope)\n| extend ActiontypeR =iff((Status contains \"πŸ“\" or CustomRecipientWriteScope contains\"πŸ“\" or CustomConfigWriteScope contains\"πŸ“\" or RecipientWriteScope contains\"πŸ“\" or ConfigWriteScope contains\"πŸ“\" ), i=i + 1, i)\n| extend Actiontype =iff(ActiontypeR > 0, \"Modif\", \"NO\")\n| where ActiontypeR == 1\n| project WhenChanged,Actiontype,ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated\n;\nunion DiffAddData, DiffRemoveData, DiffModifData\n| extend RoleAssigneeName = iff(RoleAssigneeType == \"User\", strcat(\"πŸ§‘β€πŸ¦° \", RoleAssigneeName), strcat(\"πŸ‘ͺ \", RoleAssigneeName))\n| extend WhenChanged = iff (Actiontype == \"Modif\", WhenChanged, iff(Actiontype == \"Add\",WhenCreated, WhenChanged))\n| extend Actiontype = case(Actiontype == \"Add\", strcat(\"βž• \", Actiontype), Actiontype == \"Remove\", strcat(\"βž– \", Actiontype), Actiontype == \"Modif\", strcat(\"πŸ“ \", Actiontype), \"N/A\")\n| sort by WhenChanged desc \n| project\n WhenChanged,\n Actiontype,\n RoleAssigneeName,\n RoleAssigneeType,\n Status,\n CustomRecipientWriteScope,\n CustomConfigWriteScope,\n RecipientWriteScope,\n ConfigWriteScope,\n ManagementRoleAssignement,\n RoleAssignmentDelegationType,\n WhenCreated\n", + "functionParameters": "SectionCompare:string = \"\",DateCompare:string = \"lastupdate\",CurrentDate:string = \"lastudpate\",EnvList:string = \"All\",TypeEnv:string = \"Online\",CurrentRole:string = \"\",ExclusionsAcct:dynamic = dynamic(\"\")", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject5')._parserId5,'/'))))]", + "dependsOn": [ + "[variables('parserObject5')._parserId5]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Parser for MRA Configuration Data Comparison')]", + "contentId": "[variables('parserObject5').parserContentId5]", + "kind": "Parser", + "version": "[variables('parserObject5').parserVersion5]", + "source": { + "name": "Microsoft Exchange Security - Exchange Online", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Community", + "tier": "Community", + "link": "https://github.com/Azure/Azure-Sentinel/issues" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject5').parserContentId5]", + "contentKind": "Parser", + "displayName": "Parser for MRA Configuration Data Comparison", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject5').parserContentId5,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject5').parserContentId5,'-', '1.0.0')))]", + "version": "[variables('parserObject5').parserVersion5]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2022-10-01", + "name": "[variables('parserObject5')._parserName5]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for MRA Configuration Data Comparison", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MESCompareDataMRA", + "query": "// Version: 1.0.0\n// Last Updated: 25/02/2024\n// \n// DESCRIPTION:\n// This parser is used to compare the data of a specific section of the Exchange Online Configuration. It will compare the data of a specific section between two dates and return the differences between them.\n//\n// USAGE:\n// Parameters : 7 parameters to add during creation. \n// 1. SectionCompare, type string, default value \"\"\n// 2. DateCompare, type string, default value \"lastdate\"\n// 3. CurrentDate, type string, default value \"lastdate\"\n// 4. EnvList, type string, default value \"All\"\n// 5. TypeEnv, type string, default value \"Online\"\n// 6. CurrentRole, type string, default value \"\"\n// 7. ExclusionsAcct, type dynamic, default value dynamic(\"\")\n//\n// Parameters simulation\n// If you need to test the parser execution without saving it as a function, uncomment the bellow variable to simulate parameters values.\n//\n// let SectionCompare = \"SampleEntry\";\n// let EnvList = \"All\";\n// let TypeEnv = \"Online\";\n// let CurrentRole = \"\";\n// let ExclusionsAcct = dynamic(\"\");\n// let DateCompare = \"lastdate\";\n// let CurrentDate = \"lastdate\";\n//\n// Parameters definition\nlet _SectionCompare = SectionCompare;\nlet _EnvList =EnvList;\nlet _TypeEnv = TypeEnv;\nlet _CurrentRole =CurrentRole;\nlet _ExclusionsAcct = ExclusionsAcct;\nlet _DateCompare = DateCompare;\nlet _CurrentDate = CurrentDate;\nlet _DateCompareB = todatetime(DateCompare);\nlet _currD = (ExchangeConfiguration(SpecificSectionList=_SectionCompare,SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\n| summarize TimeMax = max(TimeGenerated)\n| extend TimeMax = tostring(split(TimeMax,\"T\")[0])\n| project TimeMax);\nlet _CurrentDateB = todatetime(toscalar(_currD));\nlet BeforeData = \n ExchangeConfiguration(SpecificSectionList=_SectionCompare,SpecificConfigurationDate=_DateCompare,SpecificConfigurationEnv=_EnvList,Target=_TypeEnv)\n | where CmdletResultValue.Role contains _CurrentRole\n and CmdletResultValue.RoleAssigneeName !in (_ExclusionsAcct)\n and CmdletResultValue.Name !contains \"Deleg\"\n | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\n | extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType == \"User\", \"User\", \"RoleGroup\")\n | extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\n | extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\n | extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\n | extend RecipientWriteScope = tostring(CmdletResultValue.RecipientWriteScope)\n | extend ConfigWriteScope = tostring(CmdletResultValue.ConfigWriteScope)\n | extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\n | extend Status= tostring(CmdletResultValue.Enabled)\n | extend RoleAssignmentDelegationType = iff(CmdletResultValue.RoleAssignmentDelegationType == \"6\", \"Delegating\", \"Regular\") \n | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\n | extend Role = tostring(CmdletResultValue.Role)\n | extend RoleAssignmentDelegationType = tostring(CmdletResultValue.RoleAssignmentDelegationType)\n ; \nlet AfterData = \n ExchangeConfiguration(SpecificSectionList=_SectionCompare,SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\n | where CmdletResultValue.Role contains _CurrentRole\n and CmdletResultValue.RoleAssigneeName !in (_ExclusionsAcct)\n and CmdletResultValue.Name !contains \"Deleg\"\n | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\n | extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType == \"User\", \"User\", \"RoleGroup\")\n | extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\n | extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\n | extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\n | extend RecipientWriteScope = tostring(CmdletResultValue.RecipientWriteScope)\n | extend ConfigWriteScope = tostring(CmdletResultValue.ConfigWriteScope)\n | extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\n | extend Status= tostring(CmdletResultValue.Enabled)\n | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\n | extend Role = tostring(CmdletResultValue.Role)\n | extend RoleAssignmentDelegationType = tostring(CmdletResultValue.RoleAssignmentDelegationType)\n ;\nlet i=0;\nlet allDataRange = \n ESIExchangeOnlineConfig_CL\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\n | where ESIEnvironment_s == _EnvList\n | where Section_s == \"MRA\"\n | extend CmdletResultValue = parse_json(rawData_s)\n | project TimeGenerated,CmdletResultValue,WhenChanged = WhenChanged_t, WhenCreated=WhenCreated_t\n | where CmdletResultValue.Role contains _CurrentRole\n and CmdletResultValue.RoleAssigneeName !in (_ExclusionsAcct)\n and CmdletResultValue.Name !contains \"Deleg\"\n | extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\n | extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType == \"User\", \"User\", \"RoleGroup\")\n | extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\n | extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\n | extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\n | extend RecipientWriteScope = tostring(CmdletResultValue.RecipientWriteScope)\n | extend ConfigWriteScope = tostring(CmdletResultValue.ConfigWriteScope)\n | extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\n | extend Status= tostring(CmdletResultValue.Enabled)\n | extend Role = tostring(CmdletResultValue.Role)\n | extend RoleAssignmentDelegationType = tostring(CmdletResultValue.RoleAssignmentDelegationType)\n ;\nlet DiffAddDataP1 = allDataRange\n | join kind = rightanti (AfterData | where WhenCreated >=_DateCompareB) on WhenCreated\n;\nlet DiffAddDataP2 = allDataRange\n | join kind = innerunique (allDataRange ) on WhenCreated\n | where WhenCreated >=_DateCompareB\n | where bin(WhenCreated,5m)==bin(WhenChanged,5m)\n | distinct ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated\n;\nlet DiffAddData = union DiffAddDataP1,DiffAddDataP2\n| extend Actiontype =\"Add\";\nlet DiffRemoveData = allDataRange\n | join kind = leftanti AfterData on RoleAssigneeName\n | extend Actiontype =\"Remove\"\n | distinct Actiontype,ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated\n | project WhenChanged=_CurrentDateB,Actiontype,ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated\n ;\nlet DiffModifData = union AfterData,allDataRange\n| sort by ManagementRoleAssignement,WhenChanged asc\n| extend Status = iff( ManagementRoleAssignement == prev(ManagementRoleAssignement) and Status != prev(Status) and prev(Status) !=\"\" , strcat(\"πŸ“ \", Status, \" (\",prev(Status),\"->\", Status,\" )\"),Status)\n| extend CustomRecipientWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and CustomRecipientWriteScope != prev(CustomRecipientWriteScope) and prev(CustomRecipientWriteScope) !=\"\" , strcat(\"πŸ“ \", CustomRecipientWriteScope, \" (\", prev(CustomRecipientWriteScope),\"->\", CustomRecipientWriteScope, \")\"),CustomRecipientWriteScope)\n| extend CustomConfigWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and CustomConfigWriteScope != prev(CustomConfigWriteScope) and prev(CustomConfigWriteScope) !=\"\" , strcat(\"πŸ“ \", CustomConfigWriteScope, \" (\", prev(CustomConfigWriteScope),\"->\", CustomConfigWriteScope, \")\"),CustomConfigWriteScope)\n| extend RecipientWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and RecipientWriteScope != prev(RecipientWriteScope) and prev(RecipientWriteScope) !=\"\" , strcat(\"πŸ“ \", RecipientWriteScope, \" (\", prev(RecipientWriteScope),\"->\", RecipientWriteScope, \")\"),RecipientWriteScope)\n| extend ConfigWriteScope = iff(ManagementRoleAssignement == prev(ManagementRoleAssignement) and ConfigWriteScope != prev(ConfigWriteScope) and prev(ConfigWriteScope) !=\"\" , strcat(\"πŸ“ \", ConfigWriteScope, \" (\", prev(ConfigWriteScope),\"->\", ConfigWriteScope, \")\"),ConfigWriteScope)\n| extend ActiontypeR =iff((Status contains \"πŸ“\" or CustomRecipientWriteScope contains\"πŸ“\" or CustomConfigWriteScope contains\"πŸ“\" or RecipientWriteScope contains\"πŸ“\" or ConfigWriteScope contains\"πŸ“\" ), i=i + 1, i)\n| extend Actiontype =iff(ActiontypeR > 0, \"Modif\", \"NO\")\n| where ActiontypeR == 1\n| project WhenChanged,Actiontype,ManagementRoleAssignement,RoleAssigneeName, Status,CustomRecipientWriteScope,RoleAssigneeType,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,RoleAssignmentDelegationType,WhenCreated\n;\nunion DiffAddData, DiffRemoveData, DiffModifData\n| extend RoleAssigneeName = iff(RoleAssigneeType == \"User\", strcat(\"πŸ§‘β€πŸ¦° \", RoleAssigneeName), strcat(\"πŸ‘ͺ \", RoleAssigneeName))\n| extend WhenChanged = iff (Actiontype == \"Modif\", WhenChanged, iff(Actiontype == \"Add\",WhenCreated, WhenChanged))\n| extend Actiontype = case(Actiontype == \"Add\", strcat(\"βž• \", Actiontype), Actiontype == \"Remove\", strcat(\"βž– \", Actiontype), Actiontype == \"Modif\", strcat(\"πŸ“ \", Actiontype), \"N/A\")\n| sort by WhenChanged desc \n| project\n WhenChanged,\n Actiontype,\n RoleAssigneeName,\n RoleAssigneeType,\n Status,\n CustomRecipientWriteScope,\n CustomConfigWriteScope,\n RecipientWriteScope,\n ConfigWriteScope,\n ManagementRoleAssignement,\n RoleAssignmentDelegationType,\n WhenCreated\n", + "functionParameters": "SectionCompare:string = \"\",DateCompare:string = \"lastupdate\",CurrentDate:string = \"lastudpate\",EnvList:string = \"All\",TypeEnv:string = \"Online\",CurrentRole:string = \"\",ExclusionsAcct:dynamic = dynamic(\"\")", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject5')._parserId5,'/'))))]", + "dependsOn": [ + "[variables('parserObject5')._parserId5]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Parser for MRA Configuration Data Comparison')]", + "contentId": "[variables('parserObject5').parserContentId5]", + "kind": "Parser", + "version": "[variables('parserObject5').parserVersion5]", + "source": { + "kind": "Solution", + "name": "Microsoft Exchange Security - Exchange Online", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Community", + "tier": "Community", + "link": "https://github.com/Azure/Azure-Sentinel/issues" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject6').parserTemplateSpecName6]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "MESOfficeActivityLogs Data Parser with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject6').parserVersion6]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject6')._parserName6]", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Office Activity Logs", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MESOfficeActivityLogs", + "query": "// Version: 1.0.0\n// Last Updated: 25/02/2024\n// \n// DESCRIPTION:\n// This parser is used to compare the data of a specific section of the Exchange Online Configuration. It will compare the data of a specific section between two dates and return the differences between them.\n//\nlet CmdletCheck = externaldata (Cmdlet:string, UserOriented:string, RestrictToParameter:string, Parameters:string)[h\"https://aka.ms/CmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true);\nlet SensitiveCmdlets = CmdletCheck | project tostring(Cmdlet) ;\nlet Check = (T:(*)) {\n let fuzzyWatchlist = datatable(DisplayName:string, sAMAccountName:string, userPrincipalName:string) [\n \"NONE\",\"NONE\",\"NONE\"];\n let Watchlist = union isfuzzy=true withsource=TableName _GetWatchlist('ExchOnlineVIP'), fuzzyWatchlist | project-away TableName;\n let SearchUserDisplayName = T | join Watchlist on $left.TargetObject == $right.DisplayName | project TargetObject,SearchKey;\n let SearchUserSAMAccountName = T | join Watchlist on $left.TargetObject == $right.sAMAccountName | project TargetObject,SearchKey;\n let SearchUserUPN = T | join Watchlist on $left.TargetObject == $right.userPrincipalName | project TargetObject,SearchKey;\n union isfuzzy=true withsource=TableName \n SearchUserDisplayName,\n SearchUserSAMAccountName, \n SearchUserUPN\n };\nlet EventList = OfficeActivity\n | where RecordType == \"ExchangeAdmin\"\n | where UserType <> \"DcAdmin\" and UserKey !contains \"NT AUTHORITY\"\n | extend CmdletName = Operation\n | extend Param = replace_string(replace_string((replace_string(Parameters,'[{\"Name\":\"','-')),'\",\"Value\":\"',' : '),'\"},{\"Name\":\"',', -')\n // | extend Param = replace_string((replace_string(Parameters,'\",\"Value\":\"',' : ')),'\"},{\"Name\":\"',' -')\n | extend Param = replace_string((replace_string(Param,'\"},{\"',' ; ')),'\"}]','')\n | extend Param = replace_string(Param,'\\\\\\\\','\\\\')\n | extend TargetObject = tostring(split(split(Param,\"-Identity : \")[1],' -')[0])\n | extend TargetObject = replace_string(TargetObject,',','')\n | extend TargetObject = iff(TargetObject==\"\",TargetObject=\"N/A\",TargetObject);\nlet Office_Activity = (){\nEventList\n | join kind=leftouter (EventList | project TargetObject | invoke Check()) on TargetObject\n | extend IsVIP = iif(SearchKey == \"\", false, true)\n | join kind=leftouter ( \n MESCheckOnlineVIP() ) on SearchKey\n | extend CmdletNameJoin = tolower(CmdletName)\n | join kind=leftouter ( \n CmdletCheck\n | extend CmdletNameJoin = tolower(Cmdlet)\n ) on CmdletNameJoin\n | extend Caller = UserId\n | extend CmdletParameters = Param\n | extend IsSenstiveCmdlet = iif( isnotempty(CmdletNameJoin1) , true, false) \n | extend IsRestrictedCmdLet = iif(IsSenstiveCmdlet == true, iif( RestrictToParameter == \"Yes\", true, false), dynamic(null))\n | extend RestrictedParameters = iif(IsSenstiveCmdlet == true, split(tolower(Parameters1),';'), dynamic(null))\n | extend ExtractedParameters = iif(IsSenstiveCmdlet == true,extract_all(@\"\\B(-\\w+)\", tolower(CmdletParameters)), dynamic(null))\n | extend IsSenstiveCmdletParameters = iif(IsSenstiveCmdlet == true,iif( array_length(set_difference(ExtractedParameters,RestrictedParameters)) == array_length(ExtractedParameters), false, true ) , false)\n | extend IsSensitive = iif( ( IsSenstiveCmdlet == true and IsRestrictedCmdLet == false ) or (IsSenstiveCmdlet == true and IsRestrictedCmdLet == true and IsSenstiveCmdletParameters == true ), true, false )\n | project TimeGenerated,Caller,TargetObject,IsVIP,userPrincipalName,CmdletName,CmdletParameters,IsSenstiveCmdlet,IsRestrictedCmdLet,ExtractedParameters,RestrictedParameters,IsSenstiveCmdletParameters,IsSensitive,UserOriented\n};\nOffice_Activity\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject6')._parserId6,'/'))))]", + "dependsOn": [ + "[variables('parserObject6')._parserId6]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Parser for Office Activity Logs')]", + "contentId": "[variables('parserObject6').parserContentId6]", + "kind": "Parser", + "version": "[variables('parserObject6').parserVersion6]", + "source": { + "name": "Microsoft Exchange Security - Exchange Online", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Community", + "tier": "Community", + "link": "https://github.com/Azure/Azure-Sentinel/issues" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject6').parserContentId6]", + "contentKind": "Parser", + "displayName": "Parser for Office Activity Logs", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject6').parserContentId6,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject6').parserContentId6,'-', '1.0.0')))]", + "version": "[variables('parserObject6').parserVersion6]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2022-10-01", + "name": "[variables('parserObject6')._parserName6]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Office Activity Logs", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MESOfficeActivityLogs", + "query": "// Version: 1.0.0\n// Last Updated: 25/02/2024\n// \n// DESCRIPTION:\n// This parser is used to compare the data of a specific section of the Exchange Online Configuration. It will compare the data of a specific section between two dates and return the differences between them.\n//\nlet CmdletCheck = externaldata (Cmdlet:string, UserOriented:string, RestrictToParameter:string, Parameters:string)[h\"https://aka.ms/CmdletWatchlist\"]with(format=\"csv\",ignoreFirstRecord=true);\nlet SensitiveCmdlets = CmdletCheck | project tostring(Cmdlet) ;\nlet Check = (T:(*)) {\n let fuzzyWatchlist = datatable(DisplayName:string, sAMAccountName:string, userPrincipalName:string) [\n \"NONE\",\"NONE\",\"NONE\"];\n let Watchlist = union isfuzzy=true withsource=TableName _GetWatchlist('ExchOnlineVIP'), fuzzyWatchlist | project-away TableName;\n let SearchUserDisplayName = T | join Watchlist on $left.TargetObject == $right.DisplayName | project TargetObject,SearchKey;\n let SearchUserSAMAccountName = T | join Watchlist on $left.TargetObject == $right.sAMAccountName | project TargetObject,SearchKey;\n let SearchUserUPN = T | join Watchlist on $left.TargetObject == $right.userPrincipalName | project TargetObject,SearchKey;\n union isfuzzy=true withsource=TableName \n SearchUserDisplayName,\n SearchUserSAMAccountName, \n SearchUserUPN\n };\nlet EventList = OfficeActivity\n | where RecordType == \"ExchangeAdmin\"\n | where UserType <> \"DcAdmin\" and UserKey !contains \"NT AUTHORITY\"\n | extend CmdletName = Operation\n | extend Param = replace_string(replace_string((replace_string(Parameters,'[{\"Name\":\"','-')),'\",\"Value\":\"',' : '),'\"},{\"Name\":\"',', -')\n // | extend Param = replace_string((replace_string(Parameters,'\",\"Value\":\"',' : ')),'\"},{\"Name\":\"',' -')\n | extend Param = replace_string((replace_string(Param,'\"},{\"',' ; ')),'\"}]','')\n | extend Param = replace_string(Param,'\\\\\\\\','\\\\')\n | extend TargetObject = tostring(split(split(Param,\"-Identity : \")[1],' -')[0])\n | extend TargetObject = replace_string(TargetObject,',','')\n | extend TargetObject = iff(TargetObject==\"\",TargetObject=\"N/A\",TargetObject);\nlet Office_Activity = (){\nEventList\n | join kind=leftouter (EventList | project TargetObject | invoke Check()) on TargetObject\n | extend IsVIP = iif(SearchKey == \"\", false, true)\n | join kind=leftouter ( \n MESCheckOnlineVIP() ) on SearchKey\n | extend CmdletNameJoin = tolower(CmdletName)\n | join kind=leftouter ( \n CmdletCheck\n | extend CmdletNameJoin = tolower(Cmdlet)\n ) on CmdletNameJoin\n | extend Caller = UserId\n | extend CmdletParameters = Param\n | extend IsSenstiveCmdlet = iif( isnotempty(CmdletNameJoin1) , true, false) \n | extend IsRestrictedCmdLet = iif(IsSenstiveCmdlet == true, iif( RestrictToParameter == \"Yes\", true, false), dynamic(null))\n | extend RestrictedParameters = iif(IsSenstiveCmdlet == true, split(tolower(Parameters1),';'), dynamic(null))\n | extend ExtractedParameters = iif(IsSenstiveCmdlet == true,extract_all(@\"\\B(-\\w+)\", tolower(CmdletParameters)), dynamic(null))\n | extend IsSenstiveCmdletParameters = iif(IsSenstiveCmdlet == true,iif( array_length(set_difference(ExtractedParameters,RestrictedParameters)) == array_length(ExtractedParameters), false, true ) , false)\n | extend IsSensitive = iif( ( IsSenstiveCmdlet == true and IsRestrictedCmdLet == false ) or (IsSenstiveCmdlet == true and IsRestrictedCmdLet == true and IsSenstiveCmdletParameters == true ), true, false )\n | project TimeGenerated,Caller,TargetObject,IsVIP,userPrincipalName,CmdletName,CmdletParameters,IsSenstiveCmdlet,IsRestrictedCmdLet,ExtractedParameters,RestrictedParameters,IsSenstiveCmdletParameters,IsSensitive,UserOriented\n};\nOffice_Activity\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject6')._parserId6,'/'))))]", + "dependsOn": [ + "[variables('parserObject6')._parserId6]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Parser for Office Activity Logs')]", + "contentId": "[variables('parserObject6').parserContentId6]", + "kind": "Parser", + "version": "[variables('parserObject6').parserVersion6]", + "source": { + "kind": "Solution", + "name": "Microsoft Exchange Security - Exchange Online", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Community", + "tier": "Community", + "link": "https://github.com/Azure/Azure-Sentinel/issues" + } + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -1035,7 +1500,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Exchange Least Privilege with RBAC - Online Workbook with template version 3.0.4", + "description": "Microsoft Exchange Least Privilege with RBAC - Online Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -1053,7 +1518,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"e59f0f7f-fd05-4ec8-9f59-e4d9c3b589f2\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Current RBAC Delegation\",\"subTarget\":\"RBACDelegation\",\"preText\":\"RBAC Delegation\",\"postText\":\"\",\"style\":\"link\"},{\"id\":\"26056188-7abf-4913-a927-806099e616eb\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Custom Roles\",\"subTarget\":\"CustomRole\",\"style\":\"link\"},{\"id\":\"5eeebe10-be67-4f8a-9d91-4bc6c70c3e16\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Workbook Help\",\"subTarget\":\"start\",\"style\":\"link\"}]},\"name\":\"links - 3\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9ae328d6-99c8-4c44-8d59-42ca4d999098\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EnvironmentList\",\"label\":\"Environment\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"ExchangeEnvironmentList(Target=\\\"Online\\\") | where ESIEnvironment != \\\"\\\"\",\"typeSettings\":{\"limitSelectTo\":1,\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"a88b4e41-eb2f-41bf-92d8-27c83650a4b8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DateOfConfiguration\",\"label\":\"Collection time\",\"type\":2,\"isRequired\":true,\"query\":\"let _configurationEnv = split(iff(isnull({EnvironmentList}) or isempty({EnvironmentList}) or tolower({EnvironmentList}) == \\\"all\\\",\\\"All\\\",tostring({EnvironmentList})),',');\\r\\nESIExchangeOnlineConfig_CL\\r\\n| extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n| where ScopedEnvironment in (_configurationEnv)\\r\\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n| summarize Collection = max(Collection)\\r\\n| project Collection = \\\"lastdate\\\", Selected = true\\r\\n| join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n| where ScopedEnvironment in (_configurationEnv)\\r\\n| where TimeGenerated > ago(90d)\\r\\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n| summarize by Collection\\r\\n) on Collection\\r\\n| project Value = iif(Selected,Collection,Collection1), Label = iif(Selected,\\\"Last Known date\\\",Collection1), Selected\\r\\n| sort by Selected, Value desc\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"8ac96eb3-918b-4a36-bcc4-df50d8f46175\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"Show Help\",\"type\":10,\"isRequired\":true,\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n { \\\\\\\"value\\\\\\\": \\\\\\\"Yes\\\\\\\", \\\\\\\"label\\\\\\\": \\\\\\\"Yes\\\\\\\"},\\\\r\\\\n {\\\\\\\"value\\\\\\\": \\\\\\\"No\\\\\\\", \\\\\\\"label\\\\\\\": \\\\\\\"No\\\\\\\", \\\\\\\"selected\\\\\\\":true }\\\\r\\\\n]\\\\r\\\\n\\\"}\\r\\n\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":8}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"TimeRange\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Custom Delegation\",\"items\":[{\"type\":1,\"content\":{\"json\":\"The current delegation are compared to an export of default delegation available on Exchange Online.\\r\\n\\r\\nTo find which is used for the comparaison please follow this link.\\r\\nThe export is located on the public GitHub of the project.\\r\\n\\r\\ncheck this link : https://aka.ms/esiwatchlist\\r\\n\\r\\nIt will be updated by the team project.\",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Custom Delegation on User Accounts\",\"items\":[{\"type\":1,\"content\":{\"json\":\" Custom Delegation on User Accounts\"},\"name\":\"text - 2 - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"d9d4e0a2-b75d-4825-9f4e-7606516500e1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"RoleAssignee\",\"type\":2,\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"User\\\"\\r\\n| project CmdletResultValue\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| distinct RoleAssigneeName\\r\\n\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"cf5959fa-a833-4bb2-90bd-d4c90dca5506\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Role\",\"type\":2,\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend Role=tostring (CmdletResultValue.Role)\\r\\n| distinct Role\\r\\n| sort by Role asc\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.RoleAssigneeName endswith \\\"{RoleAssignee}\\\" \\r\\n| where CmdletResultValue.Role contains \\\"{Role}\\\"\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"User\\\" and CmdletResultValue.Name !contains \\\"Deleg\\\"\\r\\n| project CmdletResultValue\\r\\n| extend Name = tostring(CmdletResultValue.Name)\\r\\n| extend Role = tostring(CmdletResultValue.Role)\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| project Name, Role, RoleAssigneeName,Status,CustomRecipientWriteScope,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope\\r\\n| sort by RoleAssigneeName asc\\r\\n\",\"size\":3,\"showAnalytics\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"CmdletName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"31.5ch\"}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"9.3ch\"}},{\"columnMatch\":\"Count\",\"formatter\":21,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"330px\"}},{\"columnMatch\":\"Anomalies\",\"formatter\":10,\"formatOptions\":{\"palette\":\"redBright\",\"customColumnWidthSetting\":\"330px\"}}],\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"RoleAssigneeName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"RoleAssigneeName\",\"sortOrder\":1}]},\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Custom Delegation on User Accounts\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Explanations\",\"expandable\":true,\"items\":[{\"type\":1,\"content\":{\"json\":\"This section displays all the nonstandard delegations done directly to a user account.\\r\\n\\r\\nDetailed information for the user accounts will be displayed.\\r\\n\\r\\nThis status is done by comparing current delegation with the default delegation for Exchange 2019 CU11.\\r\\n\\r\\nThese types of delegations are not available on the Exchange Admin Center.\\r\\n\\r\\nUsual results :\\r\\n\\r\\n - Delegations done directly to service account. Being able to see this delegation will help to sanityze the environment as some delegations may be no more necessary\\r\\n\\r\\n - Delegation done by mistake directly to Administrator Accounts\\r\\n\\r\\n - Suspicious delegations\\r\\n\\r\\n\\r\\nDetailed information for the user accounts will be displayed in below sections\\r\\n\"},\"name\":\"text - 0\"}]},\"name\":\"group - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Custom Delegation on Groups\",\"items\":[{\"type\":1,\"content\":{\"json\":\"Custom Delegation on Groups\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"c548eb09-54e3-41bf-a99d-be3534f7018b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"RoleAssignee\",\"type\":2,\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"RoleGroup\\\" and CmdletResultValue.RoleAssigneeName !contains \\\"RIM-MailboxAdmins\\\"\\r\\n| project CmdletResultValue\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| distinct RoleAssigneeName\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"f5511a2b-9bf6-48ae-a968-2d1f879c8bfa\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Role\",\"type\":2,\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend Role=tostring (CmdletResultValue.Role)\\r\\n| distinct Role\\r\\n| sort by Role asc\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nlet RoleG = ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n | project RoleAssigneeName=tostring(CmdletResultValue.Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.RoleAssigneeName endswith \\\"{RoleAssignee}\\\" \\r\\n| where CmdletResultValue.Role contains \\\"{Role}\\\"\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"RoleGroup\\\" and CmdletResultValue.RoleAssigneeName !contains \\\"RIM-MailboxAdmins\\\" and CmdletResultValue.Name !contains \\\"Deleg\\\"\\r\\n| project CmdletResultValue\\r\\n| extend ManagementRoleAssignment = tostring(CmdletResultValue.Name)\\r\\n| extend Role = tostring(CmdletResultValue.Role)\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n|lookup RoleG on RoleAssigneeName \\r\\n| project-away CmdletResultValue\\r\\n| sort by RoleAssigneeName asc\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"RoleAssigneeName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"RoleAssigneeName\",\"sortOrder\":1}]},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Custom Delegation on Groups\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Explanations\",\"expandable\":true,\"items\":[{\"type\":1,\"content\":{\"json\":\"This section displays all the nonstandard delegations done for standard and non standard groups. Indeed, default groups have a list of default delegations but an Exchange administrators can add also new roles to the default groups.\\r\\n\\r\\nThis status is done by comparing current delegation with the default delegation for Exchange 2019 CU11.\\r\\n\\r\\nUsual results :\\r\\n\\r\\n - Delegations done for Organization Management to role like Mailbox Import Export or Mailbox Search\\r\\n\\r\\n - Delegation done by mistake\\r\\n\\r\\n - Suspicious delegations\\r\\n\\r\\nDetailed information for the user accounts present in the groups will be displayed in below sections\\r\\n\"},\"name\":\"text - 0\"}]},\"name\":\"group - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"RBACDelegation\"},\"name\":\"Custom Delegation\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Information for Role Assignee\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Information for Role Assignee User account\",\"items\":[{\"type\":1,\"content\":{\"json\":\"Detailed Information on User account Role Assignee\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"27e4c2e9-d113-4bf9-808f-0f8f68b5152e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"RoleAssignee\",\"type\":2,\"isRequired\":true,\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"User\\\"\\r\\n| project CmdletResultValue\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| distinct RoleAssigneeName\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"DirectRoleAssignments\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.SamAccountName contains \\\"{RoleAssignee}\\\"\\r\\n| project CmdletResultValue\\r\\n| extend Account = tostring(CmdletResultValue.SamAccountName)\\r\\n| extend LastLogon = CmdletResultValue.LastLogonString\\r\\n| extend LastPwdSet = CmdletResultValue.LastPwdSetString\\r\\n| extend Enabled = tostring(CmdletResultValue.Enabled)\\r\\n| extend DN = tostring(CmdletResultValue.DN)\\r\\n| project-away CmdletResultValue\\r\\n| sort by Account asc\",\"size\":3,\"showAnalytics\":true,\"color\":\"green\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Information for Role Assignee User account\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Explanations\",\"expandable\":true,\"items\":[{\"type\":1,\"content\":{\"json\":\"This section displays detailed information for user account found with non standard delegation :\\r\\n - Last logon\\r\\n - Last Password changed\\r\\n - Account enabled\"},\"name\":\"text - 0\"}]},\"name\":\"group - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Information for Role Assignee group\",\"items\":[{\"type\":1,\"content\":{\"json\":\"Detailed information for Group delegation\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"75c3cdf3-d0c3-46c3-83ae-429979774234\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"RoleAssignee\",\"type\":2,\"isRequired\":true,\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://raw.githubusercontent.com/nlepagnez/ESI-PublicContent/main/Operations/Watchlists/standardMRAOnline.csv\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"RoleGroup\\\" and CmdletResultValue.RoleAssigneeName !contains \\\"RIM-MailboxAdmins\\\"\\r\\n| project CmdletResultValue\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| distinct RoleAssigneeName\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"ExGroup\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Parentgroup contains \\\"{RoleAssignee}\\\"\\r\\n| where CmdletResultValue.Level != 0\\r\\n| project CmdletResultValue\\r\\n| extend Level_ = tostring(CmdletResultValue.Level)\\r\\n| extend Parentgroup = tostring(CmdletResultValue.Parentgroup)\\r\\n| extend MemberPath = tostring(CmdletResultValue.MemberPath)\\r\\n| extend LastLogon = CmdletResultValue.LastLogonString\\r\\n| extend LastPwdSet = CmdletResultValue.LastPwdSetString\\r\\n| extend Enabled = tostring(CmdletResultValue.Enabled)\\r\\n| extend DN = tostring(CmdletResultValue.DN)\\r\\n| project-away CmdletResultValue\\r\\n| sort by Parentgroup asc\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Information for Role Assignee group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Explanations\",\"expandable\":true,\"items\":[{\"type\":1,\"content\":{\"json\":\"This section displays detailed information for user account present in the found groups with non standard delegation :\\r\\n - Last logon\\r\\n - Last Password changed\\r\\n - Account enabled\"},\"name\":\"text - 0\"}]},\"name\":\"group - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"RBACDelegation\"},\"name\":\"Information for Role Assignee\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### How to user this tab\\r\\n**1 - Select an account** : All the Cmdlet launched by the account during the selected time frame will be displayer.\\r\\n\\r\\n**2 - Select a cmdlet** : All the roles that contain will be displayed\\r\\n\\r\\n**3 - Review the list of roles** : This table contains all the roles that contain the selected Cmdlet\\r\\n\\r\\n\",\"style\":\"info\"},\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"### How to undertand the \\\"List of Roles with this CmdLet\\\" table ? \\r\\n\\r\\n**WeightRole :** Display the wieight of this role based on its importance in terms of security risk\\r\\n\\r\\n**SumRole :** Among all the Cmdlet launched by the account during the defined time frame, this role available for x cmdlet. This role include x cmdlet run by the user.\\r\\n\\r\\n**OrgMgmtRole :** This role is really in the scope of Organization Management group. If the selected Cmdlet is not included is any other role, it make sense that this user is member of the Organization Management group\\r\\n\\r\\n \",\"style\":\"upsell\"},\"name\":\"text - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let CounUserCmdlet = (ExchangeAdminAuditLogs\\r\\n| where Status == \\\"Success\\\"\\r\\n| extend Caller = tostring(split(Caller,\\\"/\\\")[countof(Caller,\\\"/\\\")])\\r\\n| summarize Count=count() by Caller);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"ExGroup\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| search CmdletResultValue.Parentgroup == \\\"Organization Management\\\"\\r\\n| where CmdletResultValue.Level != 0\\r\\n| where CmdletResultValue.ObjectClass == \\\"user\\\"\\r\\n//| project CmdletResultValue,Count\\r\\n| extend Account = tostring(CmdletResultValue.SamAccountName)\\r\\n| join kind=leftouter (CounUserCmdlet) on $left.Account == $right.Caller\\r\\n| project Account,Count\\r\\n//| project-away CmdletResultValue\\r\\n| sort by Account asc\",\"size\":3,\"title\":\"Organization Management Members\",\"exportFieldName\":\"Account\",\"exportParameterName\":\"Account\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"purple\"}}]}},\"customWidth\":\"20\",\"name\":\"query - 1\",\"styleSettings\":{\"maxWidth\":\"100%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeAdminAuditLogs\\r\\n| where Caller contains \\\"{Account}\\\"\\r\\n| where Status == \\\"Success\\\"\\r\\n| distinct CmdletName\\r\\n| sort by CmdletName asc\",\"size\":3,\"title\":\"List of CmdLet run by the account\",\"exportFieldName\":\"CmdletName\",\"exportParameterName\":\"CmdletName\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"CmdletName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"CmdletName\",\"sortOrder\":1}]},\"customWidth\":\"33\",\"name\":\"query - 3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let RBACRoleCmdlet = _GetWatchlist('RBACRoleCmdlet');\\r\\nlet UserRoleList = ExchangeAdminAuditLogs | where Caller contains \\\"{Account}\\\" | where Status == \\\"Success\\\" | distinct CmdletName;\\r\\nlet countRole = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize SumRole = count()by Role);\\r\\nlet RolevsCmdlet = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize make_set(Name) by Role);\\r\\nRolevsCmdlet\\r\\n| join kind=leftouter ( countRole ) on Role\\r\\n| project Role,CmdletList=set_Name,SumRole\\r\\n| join kind=leftouter ( RBACRoleCmdlet ) on Role\\r\\n| where Name has \\\"{CmdletName}\\\"\\r\\n| extend PossibleRoles = Role\\r\\n| extend OrgMgmtRole = OrgM\\r\\n| extend RoleWeight = Priority\\r\\n|distinct PossibleRoles,RoleWeight,tostring(SumRole),OrgMgmtRole,tostring(CmdletList)\\r\\n|sort by SumRole,RoleWeight\\r\\n\",\"size\":3,\"title\":\"List of Roles with this CmdLet\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"PossibleRoles\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"PossibleRoles\",\"sortOrder\":1}]},\"customWidth\":\"40\",\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"0\",\"maxWidth\":\"100%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let RBACRoleCmdlet = _GetWatchlist('RBACRoleCmdlet');\\r\\nlet UserRoleList = ExchangeAdminAuditLogs | where TimeGenerated {TimeRange} | where Caller contains \\\"{Account}\\\" | where Status == \\\"Success\\\" | distinct CmdletName;\\r\\nlet countRole = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize SumRole = count()by Role);\\r\\nlet RolevsCmdlet = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize make_set(Name) by Role);\\r\\nRolevsCmdlet\\r\\n| join kind=leftouter ( countRole ) on Role\\r\\n| project Role,CmdletList=set_Name,SumRole\\r\\n| join kind=leftouter ( RBACRoleCmdlet ) on Role\\r\\n| extend Roles = Role\\r\\n| extend OrgMgmtRole = OrgM\\r\\n| extend RoleWeight = Priority\\r\\n| extend CmdletList=tostring(CmdletList)\\r\\n| summarize by Roles,CmdletList,RoleWeight,tostring(SumRole),OrgMgmtRole\\r\\n| distinct Roles,RoleWeight,tostring(SumRole),OrgMgmtRole,tostring(CmdletList)\\r\\n|sort by Roles asc\",\"size\":0,\"title\":\"Recommended Roles for selected users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"Roles\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Roles\",\"sortOrder\":1}]},\"name\":\"query - 3\"}]},\"name\":\"group - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"Leastprivileges\"},\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Custom Role details\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"List of Custom Roles\",\"items\":[{\"type\":1,\"content\":{\"json\":\"List of existing custom Roles\"},\"customWidth\":\"50\",\"name\":\"text - 3\"},{\"type\":1,\"content\":{\"json\":\"List of Custom with a Management Role Assignement (associated with a group or a user). Display the target account and scope if set\"},\"customWidth\":\"50\",\"name\":\"text - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend Identity = CmdletResultValue.Name\\r\\n| extend ParentRole =split(tostring(CmdletResultValue.Parent),\\\"\\\\\\\\\\\")[1]\\r\\n| project Identity, ParentRole, WhenCreated, WhenChanged\",\"size\":0,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project Role = tostring(CmdletResultValue.Name));\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend Role = tostring(CmdletResultValue.Role)\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend Scope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| project Role, Scope, RoleAssigneeName\\r\\n| join kind=inner (MRcustomRoles) on Role\\r\\n| project Role,RoleAssigneeName,Scope\",\"size\":1,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project Role = tostring(CmdletResultValue.Name));\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\", SpecificConfigurationDate=\\\"lastdate\\\", SpecificConfigurationEnv='ITSY', Target = \\\"Online\\\")\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend Scope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| project Role= tostring(CmdletResultValue.Role), Scope, RoleAssigneeName\\r\\n| join kind=rightouter (MRcustomRoles) on Role\\r\\n| project Role = Role1, Scope, RoleAssigneeName,Comment = iff(Role == \\\"\\\", \\\"⚠️ No existing delegation for this role\\\", \\\"βœ… This role is delegated with a Management Role Assignment\\\")\",\"size\":0,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project Role = tostring(CmdletResultValue.Name));\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project Role = tostring(CmdletResultValue.Role)\\r\\n| join kind=rightouter (MRcustomRoles) on Role\\r\\n| summarize acount = count() by iff( Role==\\\"\\\",\\\"Number of non assigned roles\\\", Role)\",\"size\":0,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 5\"}]},\"name\":\"List of Custom Roles\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Custom Roles delegation on group\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This section shows delegation associated with the Custom Roles\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project Role = tostring(CmdletResultValue.Name));\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend Role = tostring(CmdletResultValue.Role)\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n| project RoleAssigneeName, Role, Status,CustomRecipientWriteScope, CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,WhenCreated, WhenChanged\\r\\n| join kind=inner (MRcustomRoles) on Role\\r\\n| project RoleAssigneeName, Role, Status,CustomRecipientWriteScope, CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,WhenCreated, WhenChanged\",\"size\":0,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\"}]},\"name\":\"group - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Details for Custom Roles Cmdlets \",\"items\":[{\"type\":1,\"content\":{\"json\":\"This section displays for the chosen custom management roles all Cmdlets and their parameters associated with this custom role.\\r\\nRemember that for a cmdlet, some parameters can be removed.\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"07c8ac83-371d-4702-ab66-72aeb2a20053\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomRole\",\"type\":2,\"isRequired\":true,\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend Identity = CmdletResultValue.Name\\r\\n| project Identity\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRCustomDetails\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where (replace_string(replace_string(tostring(split(CmdletResultValue.Role.DistinguishedName,\\\",\\\",0)),\\\"[\\\\\\\"CN=\\\",\\\"\\\"),\\\"\\\\\\\"]\\\",\\\"\\\")) contains \\\"{CustomRole}\\\"\\r\\n| extend CustomRoleName = replace_string(replace_string(tostring(split(CmdletResultValue.Role.DistinguishedName,\\\",\\\",0)),\\\"[\\\\\\\"CN=\\\",\\\"\\\"),\\\"\\\\\\\"]\\\",\\\"\\\")\\r\\n| extend CmdletName = CmdletResultValue.Name\\r\\n| extend Parameters = CmdletResultValue.Parameters\\r\\n| project CmdletName,Parameters\",\"size\":1,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Details for Custom Roles Cmdlets \"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"CustomRole\"},\"name\":\"Custom Role\"}],\"fromTemplateId\":\"sentinel-MicrosoftExchangeLeastPrivilegewithRBAC-Online\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"e59f0f7f-fd05-4ec8-9f59-e4d9c3b589f2\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Current RBAC Delegation\",\"subTarget\":\"RBACDelegation\",\"preText\":\"RBAC Delegation\",\"postText\":\"\",\"style\":\"link\"},{\"id\":\"26056188-7abf-4913-a927-806099e616eb\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Custom Roles\",\"subTarget\":\"CustomRole\",\"style\":\"link\"},{\"id\":\"5eeebe10-be67-4f8a-9d91-4bc6c70c3e16\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Workbook Help\",\"subTarget\":\"start\",\"style\":\"link\"}]},\"name\":\"links - 3\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9ae328d6-99c8-4c44-8d59-42ca4d999098\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EnvironmentList\",\"label\":\"Environment\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"ExchangeEnvironmentList(Target=\\\"Online\\\") | where ESIEnvironment != \\\"\\\"\",\"typeSettings\":{\"limitSelectTo\":1,\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"a88b4e41-eb2f-41bf-92d8-27c83650a4b8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DateOfConfiguration\",\"label\":\"Collection time\",\"type\":2,\"isRequired\":true,\"query\":\"let _configurationEnv = split(iff(isnull({EnvironmentList}) or isempty({EnvironmentList}) or tolower({EnvironmentList}) == \\\"all\\\",\\\"All\\\",tostring({EnvironmentList})),',');\\r\\nESIExchangeOnlineConfig_CL\\r\\n| extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n| where ScopedEnvironment in (_configurationEnv)\\r\\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n| summarize Collection = max(Collection)\\r\\n| project Collection = \\\"lastdate\\\", Selected = true\\r\\n| join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n | where ScopedEnvironment in (_configurationEnv)\\r\\n | where TimeGenerated > ago(90d)\\r\\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n | summarize by Collection \\r\\n | join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n | where ScopedEnvironment in (_configurationEnv)\\r\\n | where TimeGenerated > ago(90d)\\r\\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm ')\\r\\n | summarize by PreciseCollection, Collection \\r\\n | join kind=leftouter (\\r\\n ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n | where ScopedEnvironment in (_configurationEnv)\\r\\n | where TimeGenerated > ago(90d)\\r\\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm')\\r\\n | summarize by PreciseCollection, Collection \\r\\n | summarize count() by Collection\\r\\n ) on Collection\\r\\n ) on Collection\\r\\n) on Collection\\r\\n| project Value = iif(Selected,Collection,iif(count_ > 1,PreciseCollection,Collection1)), Label = iif(Selected,\\\"Last Known date\\\",iif(count_ > 1,PreciseCollection,Collection1)), Selected\\r\\n| sort by Selected, Value desc\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"8ac96eb3-918b-4a36-bcc4-df50d8f46175\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"Show Help\",\"type\":10,\"isRequired\":true,\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n { \\\\\\\"value\\\\\\\": \\\\\\\"Yes\\\\\\\", \\\\\\\"label\\\\\\\": \\\\\\\"Yes\\\\\\\"},\\\\r\\\\n {\\\\\\\"value\\\\\\\": \\\\\\\"No\\\\\\\", \\\\\\\"label\\\\\\\": \\\\\\\"No\\\\\\\", \\\\\\\"selected\\\\\\\":true }\\\\r\\\\n]\\\\r\\\\n\\\"}\\r\\n\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":8}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"TimeRange\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Custom Delegation\",\"items\":[{\"type\":1,\"content\":{\"json\":\"The current delegation are compared to an export of default delegation available on Exchange Online.\\r\\n\\r\\nTo find which is used for the comparaison please follow this link.\\r\\nThe export is located on the public GitHub of the project.\\r\\n\\r\\ncheck this link : https://aka.ms/esiwatchlist\\r\\n\\r\\nIt will be updated by the team project.\",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Custom Delegation on User Accounts\",\"items\":[{\"type\":1,\"content\":{\"json\":\" Custom Delegation on User Accounts\"},\"name\":\"text - 2 - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"d9d4e0a2-b75d-4825-9f4e-7606516500e1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"RoleAssignee\",\"type\":2,\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://aka.ms/standardMRAOnline\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"User\\\"\\r\\n| project CmdletResultValue\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| distinct RoleAssigneeName\\r\\n\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"cf5959fa-a833-4bb2-90bd-d4c90dca5506\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Role\",\"type\":2,\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://aka.ms/standardMRAOnline\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"User\\\"\\r\\n| project CmdletResultValue\\r\\n| extend Role=tostring (CmdletResultValue.Role)\\r\\n| distinct Role\\r\\n| sort by Role asc\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://aka.ms/standardMRAOnline\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.RoleAssigneeName endswith \\\"{RoleAssignee}\\\" \\r\\n| where CmdletResultValue.Role contains \\\"{Role}\\\"\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"User\\\" and CmdletResultValue.Name !contains \\\"Deleg\\\"\\r\\n| project CmdletResultValue\\r\\n| extend Name = tostring(CmdletResultValue.Name)\\r\\n| extend Role = tostring(CmdletResultValue.Role)\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| project Name, Role, RoleAssigneeName,Status,CustomRecipientWriteScope,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope\\r\\n| sort by RoleAssigneeName asc\\r\\n\",\"size\":3,\"showAnalytics\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"CmdletName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"31.5ch\"}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"9.3ch\"}},{\"columnMatch\":\"Count\",\"formatter\":21,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"330px\"}},{\"columnMatch\":\"Anomalies\",\"formatter\":10,\"formatOptions\":{\"palette\":\"redBright\",\"customColumnWidthSetting\":\"330px\"}}],\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"RoleAssigneeName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"RoleAssigneeName\",\"sortOrder\":1}]},\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Custom Delegation on User Accounts\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Explanations\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This section displays all the nonstandard delegations done directly to a user account.\\r\\n\\r\\nDetailed information for the user accounts will be displayed.\\r\\n\\r\\nThis status is done by comparing current delegation with the default delegation for Exchange 2019 CU11.\\r\\n\\r\\nThese types of delegations are not available on the Exchange Admin Center.\\r\\n\\r\\nUsual results :\\r\\n\\r\\n - Delegations done directly to service account. Being able to see this delegation will help to sanityze the environment as some delegations may be no more necessary\\r\\n\\r\\n - Delegation done by mistake directly to Administrator Accounts\\r\\n\\r\\n - Suspicious delegations\\r\\n\\r\\n\\r\\nDetailed information for the user accounts will be displayed in below sections\\r\\n\"},\"name\":\"text - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"group - 3\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Custom Delegation on Groups\",\"items\":[{\"type\":1,\"content\":{\"json\":\"Custom Delegation on Groups\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"c548eb09-54e3-41bf-a99d-be3534f7018b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"RoleAssignee\",\"type\":2,\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://aka.ms/standardMRAOnline\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"RoleGroup\\\" and CmdletResultValue.RoleAssigneeName !contains \\\"RIM-MailboxAdmins\\\"\\r\\n| project CmdletResultValue\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| distinct RoleAssigneeName\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"f5511a2b-9bf6-48ae-a968-2d1f879c8bfa\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Role\",\"type\":2,\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://aka.ms/standardMRAOnline\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"RoleGroup\\\" and CmdletResultValue.RoleAssigneeName !contains \\\"RIM-MailboxAdmins\\\"\\r\\n| project CmdletResultValue\\r\\n| extend Role=tostring (CmdletResultValue.Role)\\r\\n| distinct Role\\r\\n| sort by Role asc\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":\"MR-CustMailRecipients\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let DefMRA = externaldata (Name:string)[h\\\"https://aka.ms/standardMRAOnline\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| summarize make_list(Name);\\r\\nlet RoleG = ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n | project RoleAssigneeName=tostring(CmdletResultValue.Name);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.RoleAssigneeName endswith \\\"{RoleAssignee}\\\" \\r\\n| where CmdletResultValue.Role contains \\\"{Role}\\\"\\r\\n| where CmdletResultValue.Name !in (DefMRA) and CmdletResultValue.RoleAssigneeType == \\\"RoleGroup\\\" and CmdletResultValue.RoleAssigneeName !contains \\\"RIM-MailboxAdmins\\\" and CmdletResultValue.Name !contains \\\"Deleg\\\"\\r\\n| project CmdletResultValue\\r\\n| extend ManagementRoleAssignment = tostring(CmdletResultValue.Name)\\r\\n| extend Role = tostring(CmdletResultValue.Role)\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n|lookup RoleG on RoleAssigneeName \\r\\n| project-away CmdletResultValue\\r\\n| sort by RoleAssigneeName asc\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"RoleAssigneeName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"RoleAssigneeName\",\"sortOrder\":1}]},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Custom Delegation on Groups\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Explanations\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This section displays all the nonstandard delegations done for standard and non standard groups. Indeed, default groups have a list of default delegations but an Exchange administrators can add also new roles to the default groups.\\r\\n\\r\\nThis status is done by comparing current delegation with the default delegation for Exchange 2019 CU11.\\r\\n\\r\\nUsual results :\\r\\n\\r\\n - Delegations done for Organization Management to role like Mailbox Import Export or Mailbox Search\\r\\n\\r\\n - Delegation done by mistake\\r\\n\\r\\n - Suspicious delegations\\r\\n\\r\\nDetailed information for the user accounts present in the groups will be displayed in below sections\\r\\n\"},\"name\":\"text - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"group - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"RBACDelegation\"},\"name\":\"Custom Delegation\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### How to user this tab\\r\\n**1 - Select an account** : All the Cmdlet launched by the account during the selected time frame will be displayer.\\r\\n\\r\\n**2 - Select a cmdlet** : All the roles that contain will be displayed\\r\\n\\r\\n**3 - Review the list of roles** : This table contains all the roles that contain the selected Cmdlet\\r\\n\\r\\n\",\"style\":\"info\"},\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"### How to undertand the \\\"List of Roles with this CmdLet\\\" table ? \\r\\n\\r\\n**WeightRole :** Display the wieight of this role based on its importance in terms of security risk\\r\\n\\r\\n**SumRole :** Among all the Cmdlet launched by the account during the defined time frame, this role available for x cmdlet. This role include x cmdlet run by the user.\\r\\n\\r\\n**OrgMgmtRole :** This role is really in the scope of Organization Management group. If the selected Cmdlet is not included is any other role, it make sense that this user is member of the Organization Management group\\r\\n\\r\\n \",\"style\":\"upsell\"},\"name\":\"text - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let CounUserCmdlet = (ExchangeAdminAuditLogs\\r\\n| where Status == \\\"Success\\\"\\r\\n| extend Caller = tostring(split(Caller,\\\"/\\\")[countof(Caller,\\\"/\\\")])\\r\\n| summarize Count=count() by Caller);\\r\\nExchangeConfiguration(SpecificSectionList=\\\"ExGroup\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| search CmdletResultValue.Parentgroup == \\\"Organization Management\\\"\\r\\n| where CmdletResultValue.Level != 0\\r\\n| where CmdletResultValue.ObjectClass == \\\"user\\\"\\r\\n//| project CmdletResultValue,Count\\r\\n| extend Account = tostring(CmdletResultValue.SamAccountName)\\r\\n| join kind=leftouter (CounUserCmdlet) on $left.Account == $right.Caller\\r\\n| project Account,Count\\r\\n//| project-away CmdletResultValue\\r\\n| sort by Account asc\",\"size\":3,\"title\":\"Organization Management Members\",\"exportFieldName\":\"Account\",\"exportParameterName\":\"Account\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":3,\"formatOptions\":{\"palette\":\"purple\"}}]}},\"customWidth\":\"20\",\"name\":\"query - 1\",\"styleSettings\":{\"maxWidth\":\"100%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeAdminAuditLogs\\r\\n| where Caller contains \\\"{Account}\\\"\\r\\n| where Status == \\\"Success\\\"\\r\\n| distinct CmdletName\\r\\n| sort by CmdletName asc\",\"size\":3,\"title\":\"List of CmdLet run by the account\",\"exportFieldName\":\"CmdletName\",\"exportParameterName\":\"CmdletName\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"CmdletName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"CmdletName\",\"sortOrder\":1}]},\"customWidth\":\"33\",\"name\":\"query - 3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let RBACRoleCmdlet = _GetWatchlist('RBACRoleCmdlet');\\r\\nlet UserRoleList = ExchangeAdminAuditLogs | where Caller contains \\\"{Account}\\\" | where Status == \\\"Success\\\" | distinct CmdletName;\\r\\nlet countRole = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize SumRole = count()by Role);\\r\\nlet RolevsCmdlet = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize make_set(Name) by Role);\\r\\nRolevsCmdlet\\r\\n| join kind=leftouter ( countRole ) on Role\\r\\n| project Role,CmdletList=set_Name,SumRole\\r\\n| join kind=leftouter ( RBACRoleCmdlet ) on Role\\r\\n| where Name has \\\"{CmdletName}\\\"\\r\\n| extend PossibleRoles = Role\\r\\n| extend OrgMgmtRole = OrgM\\r\\n| extend RoleWeight = Priority\\r\\n|distinct PossibleRoles,RoleWeight,tostring(SumRole),OrgMgmtRole,tostring(CmdletList)\\r\\n|sort by SumRole,RoleWeight\\r\\n\",\"size\":3,\"title\":\"List of Roles with this CmdLet\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"PossibleRoles\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"PossibleRoles\",\"sortOrder\":1}]},\"customWidth\":\"40\",\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"0\",\"maxWidth\":\"100%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let RBACRoleCmdlet = _GetWatchlist('RBACRoleCmdlet');\\r\\nlet UserRoleList = ExchangeAdminAuditLogs | where TimeGenerated {TimeRange} | where Caller contains \\\"{Account}\\\" | where Status == \\\"Success\\\" | distinct CmdletName;\\r\\nlet countRole = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize SumRole = count()by Role);\\r\\nlet RolevsCmdlet = (RBACRoleCmdlet | where Name has_any (UserRoleList)| summarize make_set(Name) by Role);\\r\\nRolevsCmdlet\\r\\n| join kind=leftouter ( countRole ) on Role\\r\\n| project Role,CmdletList=set_Name,SumRole\\r\\n| join kind=leftouter ( RBACRoleCmdlet ) on Role\\r\\n| extend Roles = Role\\r\\n| extend OrgMgmtRole = OrgM\\r\\n| extend RoleWeight = Priority\\r\\n| extend CmdletList=tostring(CmdletList)\\r\\n| summarize by Roles,CmdletList,RoleWeight,tostring(SumRole),OrgMgmtRole\\r\\n| distinct Roles,RoleWeight,tostring(SumRole),OrgMgmtRole,tostring(CmdletList)\\r\\n|sort by Roles asc\",\"size\":0,\"title\":\"Recommended Roles for selected users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"Roles\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Roles\",\"sortOrder\":1}]},\"name\":\"query - 3\"}]},\"name\":\"group - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"Leastprivileges\"},\"name\":\"group - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Custom Role details\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"List of Custom Roles\",\"items\":[{\"type\":1,\"content\":{\"json\":\"List of existing custom Roles\"},\"customWidth\":\"50\",\"name\":\"text - 3\"},{\"type\":1,\"content\":{\"json\":\"List of Custom with a Management Role Assignement (associated with a group or a user). Display the target account and scope if set\"},\"customWidth\":\"50\",\"name\":\"text - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend Identity = CmdletResultValue.Name\\r\\n| extend ParentRole =split(tostring(CmdletResultValue.Parent),\\\"\\\\\\\\\\\")[1]\\r\\n| project Identity, ParentRole, WhenCreated, WhenChanged\",\"size\":3,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project Role = tostring(CmdletResultValue.Name));\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend Role = tostring(CmdletResultValue.Role)\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend Scope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| project Role, Scope, RoleAssigneeName\\r\\n| join kind=inner (MRcustomRoles) on Role\\r\\n| project Role,RoleAssigneeName,Scope\",\"size\":1,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project Role = tostring(CmdletResultValue.Name));\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\", SpecificConfigurationDate=\\\"lastdate\\\", SpecificConfigurationEnv='ITSY', Target = \\\"Online\\\")\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend Scope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| project Role= tostring(CmdletResultValue.Role), Scope, RoleAssigneeName\\r\\n| join kind=rightouter (MRcustomRoles) on Role\\r\\n| project Role = Role1, Scope, RoleAssigneeName,Comment = iff(Role == \\\"\\\", \\\"⚠️ No existing delegation for this role\\\", \\\"βœ… This role is delegated with a Management Role Assignment\\\")\",\"size\":0,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project Role = tostring(CmdletResultValue.Name));\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project Role = tostring(CmdletResultValue.Role)\\r\\n| join kind=rightouter (MRcustomRoles) on Role\\r\\n| summarize acount = count() by iff( Role==\\\"\\\",\\\"Number of non assigned roles\\\", Role)\",\"size\":0,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 5\"}]},\"name\":\"List of Custom Roles\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Custom Roles delegation on group\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This section shows delegation associated with the Custom Roles\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MRcustomRoles = (ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project Role = tostring(CmdletResultValue.Name));\\r\\nExchangeConfiguration(SpecificSectionList=\\\"MRA\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend Role = tostring(CmdletResultValue.Role)\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n| project RoleAssigneeName, Role, Status,CustomRecipientWriteScope, CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,WhenCreated, WhenChanged\\r\\n| join kind=inner (MRcustomRoles) on Role\\r\\n| project RoleAssigneeName, Role, Status,CustomRecipientWriteScope, CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,WhenCreated, WhenChanged\",\"size\":3,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\"}]},\"name\":\"group - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Details for Custom Roles Cmdlets \",\"items\":[{\"type\":1,\"content\":{\"json\":\"This section displays for the chosen custom management roles all Cmdlets and their parameters associated with this custom role.\\r\\nRemember that for a cmdlet, some parameters can be removed.\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"07c8ac83-371d-4702-ab66-72aeb2a20053\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomRole\",\"type\":2,\"isRequired\":true,\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRCustom\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend Identity = CmdletResultValue.Name\\r\\n| project Identity\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":\"MR-CustPF\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRCustomDetails\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Role contains \\\"{CustomRole}\\\"\\r\\n| extend CmdletName = CmdletResultValue.Name\\r\\n| extend Parameters = CmdletResultValue.Parameters\\r\\n| project CmdletName,Parameters\",\"size\":1,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Details for Custom Roles Cmdlets \"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"CustomRole\"},\"name\":\"Custom Role\"}],\"fromTemplateId\":\"sentinel-MicrosoftExchangeLeastPrivilegewithRBAC-Online\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -1064,7 +1529,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "description": "@{workbookKey=MicrosoftExchangeLeastPrivilegewithRBAC-Online; logoFileName=Azure_Sentinel.svg; description=This Workbook, dedicated to Exchange Online environments is built to have a simple view of non-standard RBAC delegations on an Exchange Online tenant. This Workbook allow you to go deep dive on custom delegation and roles and also members of each delegation, including the nested level and the group imbrication on your environment.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Microsoft Exchange Least Privilege with RBAC - Online; templateRelativePath=Microsoft Exchange Least Privilege with RBAC - Online.json; subtitle=; provider=Microsoft}.description", + "description": "@{workbookKey=MicrosoftExchangeLeastPrivilegewithRBAC-Online; logoFileName=Azure_Sentinel.svg; description=This Workbook, dedicated to Exchange Online environments is built to have a simple view of non-standard RBAC delegations on an Exchange Online tenant. This Workbook allow you to go deep dive on custom delegation and roles and also members of each delegation, including the nested level and the group imbrication on your environment.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Exchange Least Privilege with RBAC - Online; templateRelativePath=Microsoft Exchange Least Privilege with RBAC - Online.json; subtitle=; provider=Microsoft}.description", "parentId": "[variables('workbookId1')]", "contentId": "[variables('_workbookContentId1')]", "kind": "Workbook", @@ -1122,7 +1587,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft Exchange Security Review - Online Workbook with template version 3.0.4", + "description": "Microsoft Exchange Security Review - Online Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -1140,7 +1605,7 @@ }, "properties": { "displayName": "[parameters('workbook2-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Microsoft Exchange Security Review Online\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9ae328d6-99c8-4c44-8d59-42ca4d999098\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EnvironmentList\",\"label\":\"Environment\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"ExchangeEnvironmentList(Target=\\\"Online\\\") | where ESIEnvironment != \\\"\\\"\",\"typeSettings\":{\"limitSelectTo\":1,\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"ITSY\"]},{\"id\":\"a88b4e41-eb2f-41bf-92d8-27c83650a4b8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DateOfConfiguration\",\"label\":\"Collection time\",\"type\":2,\"isRequired\":true,\"query\":\"let _configurationEnv = split(iff(isnull({EnvironmentList}) or isempty({EnvironmentList}) or tolower({EnvironmentList}) == \\\"all\\\",\\\"All\\\",tostring({EnvironmentList})),',');\\r\\nESIExchangeOnlineConfig_CL\\r\\n| extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n| where ScopedEnvironment in (_configurationEnv)\\r\\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n| summarize Collection = max(Collection)\\r\\n| project Collection = \\\"lastdate\\\", Selected = true\\r\\n| join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n| where ScopedEnvironment in (_configurationEnv)\\r\\n| where TimeGenerated > ago(90d)\\r\\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n| summarize by Collection\\r\\n) on Collection\\r\\n| project Value = iif(Selected,Collection,Collection1), Label = iif(Selected,\\\"Last Known date\\\",Collection1), Selected\\r\\n| sort by Selected, Value desc\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"8ac96eb3-918b-4a36-bcc4-df50d8f46175\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"Show Help\",\"type\":10,\"isRequired\":true,\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n { \\\\\\\"value\\\\\\\": \\\\\\\"Yes\\\\\\\", \\\\\\\"label\\\\\\\": \\\\\\\"Yes\\\\\\\"},\\\\r\\\\n {\\\\\\\"value\\\\\\\": \\\\\\\"No\\\\\\\", \\\\\\\"label\\\\\\\": \\\\\\\"No\\\\\\\", \\\\\\\"selected\\\\\\\":true }\\\\r\\\\n]\\\\r\\\\n\\\"}\\r\\n\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":8}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"TimeRange\"},{\"type\":1,\"content\":{\"json\":\"This workbook helps review your Exchange Security configuration.\\r\\nAdjust the time range, and when needed select an item in the dropdownlist\",\"style\":\"info\"},\"name\":\"text - 9\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"34188faf-7a02-4697-9b36-2afa986afc0f\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Mailbox Access\",\"subTarget\":\"Delegation\",\"postText\":\"t\",\"style\":\"link\",\"icon\":\"3\",\"linkIsContextBlade\":true},{\"id\":\"be02c735-6150-4b6e-a386-b2b023e754e5\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"EXO & Azure AD Groups\",\"subTarget\":\"ExchAD\",\"style\":\"link\"},{\"id\":\"26c68d90-925b-4c3c-a837-e3cecd489b2d\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Transport Configuration\",\"subTarget\":\"Transport\",\"style\":\"link\"},{\"id\":\"eb2888ca-7fa6-4e82-88db-1bb3663a801e\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Workbook Help\",\"subTarget\":\"Start\",\"style\":\"link\"}]},\"name\":\"TopMenuTabs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Workbook goals\\r\\n\\r\\nThe goal of this workbook is to outline key security configurations of your Exchange on-premises environment.\\r\\n\\r\\nMost of Exchange organizations have were installed years ago (sometimes more than 10 years). Many configurations have been done and might not have been documented. For most environments, the core commitment was maintaining a high availability of the users’ mailboxes putting aside other consideration (even security considerations). Recommended security practices have also evolved since the first released and a regular review is necessary.\\r\\n\\r\\nThis workbook is designed to show your Exchange organization is configured with a security point of view. Indeed, some configurations easy to display as there are no UI available.\\r\\n\\r\\nFor each configuration, you will find explanations and recommendations when applicable.\\r\\n\\r\\n- This workbook does not pretend to show you every weak Security configurations, but the most common issues and known to be used by attackers. \\r\\n- It will not show you if you have been comprised, but will help you identify unexpected configuration.\\r\\n\\r\\n----\\r\\n\\r\\n## Quick reminder of how Exchange works\\r\\n\\r\\nDuring Exchange installation two very important groups are created :\\r\\n- Exchange Trusted Subsystem : Contain all the computer accounts for Exchange Server\\r\\n- Exchange Windows Permissions : Contain the group Exchange trusted Subsystem\\r\\n\\r\\nThese groups have :\\r\\n- Very high privileges in ALL AD domains including the root domain\\r\\n- Right on any Exchange including mailboxes\\r\\n\\r\\nAs each Exchange server computer account is member of Exchange Trusted Subsystem, it means by taking control of the computer account or being System on an Exchange server you will gain access to all the permissions granted to Exchange Trusted Subsystem and Exchange Windows Permissions.\\r\\n\\r\\nTo protect AD and Exchange, it is very important to ensure the following:\\r\\n- There is a very limited number of persons that are local Administrator on Exchange server\\r\\n- To protect user right like : Act part of the operating System, Debug\\r\\n\\r\\nEvery service account or application that have high privileges on Exchange need to be considered as sensitive\\r\\n\\r\\n** πŸ’‘ Exchange servers need to be considered as very sensitive servers**\\r\\n\\r\\n-----\\r\\n\\r\\n\\r\\n## Tabs\\r\\n\\r\\n### Mailbox Access\\r\\n\\r\\nThis tab will show you several top sensitive delegations that allow an account to access, modify, act as another user, search, export the content of a mailbox.\\r\\n\\r\\n### Exchange & AD Groups\\r\\n\\r\\nThis tab will show you the members of Exchange groups and Sensitive AD groups.\\r\\n\\r\\n### Local Administrators\\r\\n\\r\\nThis tab will show you the non standard content of the local Administrators group. Remember that a member of the local Administrators group can take control of the computer account of the server and then it will have all the permissions associated with Exchange Trusted Subsytem and Exchange Windows Permissions\\r\\n\\r\\nThe information is displayed with different views : \\r\\n- List of nonstandard users\\r\\n- Number of servers with a nonstandard a user\\r\\n- Nonstandard groups content\\r\\n- For each user important information are displayed like last logon, last password set, enabled\\r\\n\\r\\n### Exchange Security configuration\\r\\n\\r\\nThis tab will show you some important configuration for your Exchange Organization\\r\\n- Status of Admin Audit Log configuration\\r\\n- Status of POP and IMAP configuration : especially, is Plaintext Authentication configured ?\\r\\n- Nonstandard permissions on the Exchange container in the Configuration Partition\\r\\n\\r\\n### Transport Configuration\\r\\n\\r\\nThis tab will show you the configuration of the main Transport components\\r\\n- Receive Connectors configured with Anonymous and/or Open Relay\\r\\n- Remote Domain Autoforward configuration\\r\\n- Transport Rules configured with BlindCopyTo, SendTo, RedirectTo\\r\\n- Journal Rule and Journal Recipient configurations\\r\\n- Accepted Domains with *\\r\\n\\r\\n\"},\"name\":\"WorkbookInfo\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"Start\"},\"name\":\"InformationTab\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Display important security configurations that allow to mailboxes content (direct delegation on mailboxes are not listed (Full Access mailboxes or direct delegation on mailboxes folders)\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Name !contains \\\"Deleg\\\" and CmdletResultValue.RoleAssigneeName != \\\"Hygiene Management\\\" and CmdletResultValue.RoleAssigneeName != \\\"Exchange Online-ApplicationAccount\\\" and CmdletResultValue.RoleAssigneeName != \\\"Discovery Management\\\" and CmdletResultValue.RoleAssigneeName !contains \\\"RIM-MailboxAdmins\\\"\\r\\n| where CmdletResultValue.Role contains \\\"Export\\\" or CmdletResultValue.Role contains \\\"Impersonation\\\" or CmdletResultValue.Role contains \\\"Search\\\"\\r\\n| summarize dcount(tostring(CmdletResultValue.RoleAssigneeName)) by role=tostring(CmdletResultValue.Role)\",\"size\":3,\"title\":\"Number of accounts with sensitive RBAC roles\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"role\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_CmdletResultValue_RoleAssigneeName\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true,\"sortCriteriaField\":\"role\",\"sortOrderField\":1}},\"name\":\"MRAQuery\"},{\"type\":1,\"content\":{\"json\":\"**ApplicationImpersonation** is an RBAC role that allows access (read and modify) to the content of all mailboxes using EWS. This role is very powerfull and should be carefully delegated. When a delegation is necessary, RBAC scopes should be configured to limit the list of impacted mailboxes.\\r\\n\\r\\nIt is common to see service accounts for backup solution, antivirus software, MDM...\\r\\n\\r\\nNote that the default configuration to the group Hygiene Management is excluded. this group is a sensitive group. Remember to monitor the content of this group\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"SensitiveRBACHelp\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Application Impersonation Role\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This delegation allows the delegated account to access and modify the content of every mailboxes using EWS.\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Role contains \\\"Impersonation\\\" and CmdletResultValue.RoleAssigneeName != \\\"Hygiene Management\\\" and CmdletResultValue.RoleAssigneeName !contains \\\"RIM-MailboxAdmins\\\" and CmdletResultValue.Name !contains \\\"Deleg\\\"\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType== \\\"User\\\" , \\\"User\\\", \\\"RoleGroup\\\")\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n| extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| extend RoleAssigneeName = iff( RoleAssigneeType == \\\"User\\\", strcat(\\\"πŸ§‘β€πŸ¦° \\\",RoleAssigneeName), strcat(\\\"πŸ‘ͺ \\\", RoleAssigneeName) )\\r\\n| project RoleAssigneeName, RoleAssigneeType, Status,CustomRecipientWriteScope,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,ManagementRoleAssignement,WhenChanged,WhenCreated\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Application Impersonation Role\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Mailbox Import Export Role\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This delegation allows to export the content all mailboxes in a scope in PST file.\\r\\nExcluded from the result as default configuration :\\r\\nDelegating delegation to Organization Management\\r\\n\"},\"name\":\"text - 0\"},{\"type\":1,\"content\":{\"json\":\"**Mailbox Import Export** is an RBAC role that allows an account to export the content of any maibox in a PST. It also allows search in all mailboxes.\\r\\n\\r\\n⚑ This role is very powerfull.\\r\\n\\r\\nBy default, this role is not delegated to any user or group. The members of the group Organization Management by default do not have this role but are able to delegate it.\\r\\n\\r\\nℹ️ Recommendations\\r\\n\\r\\nIf you temporarily need this delegation, consider the following:\\r\\n- create an empty group with this delegation\\r\\n- monitor the group content and alert when the group modified\\r\\n- add administrators in this group only for a short period of time\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"SearchRBACHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Role contains \\\"export\\\" and CmdletResultValue.Name !contains \\\"Deleg\\\"\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType== \\\"User\\\" , \\\"User\\\", \\\"RoleGroup\\\")\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n| extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| extend RoleAssigneeName = iff( RoleAssigneeType == \\\"User\\\", strcat(\\\"πŸ§‘β€πŸ¦° \\\",RoleAssigneeName), strcat(\\\"πŸ‘ͺ \\\", RoleAssigneeName) )\\r\\n| project RoleAssigneeName, RoleAssigneeType, Status,CustomRecipientWriteScope,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,ManagementRoleAssignement,WhenChanged,WhenCreated\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Mailbox Import Export Role\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Mailbox Search Role\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This delegation allows to search inside all or in a scope of mailboxes and export the result in PST.\\r\\nExcluded from the result as default configuration :\\r\\nDelegating delegation to Organization Management\\r\\nExchange Online-ApplicationAccount\\r\\nDiscovery Management has been excluded\\r\\n\"},\"name\":\"text - 0\"},{\"type\":1,\"content\":{\"json\":\"**Mailbox Search** is an RBAC role that allows an account to search in any mailbox and export the results to a PST.\\r\\n\\r\\n⚑ This role is very powerfull.\\r\\n\\r\\nBy default, this role is only delegated to the group Discovery Management. The members of the group Organization Management do not have this role but are able to delegate it.\\r\\n\\r\\nℹ️ Recommendations\\r\\n\\r\\nIf you temporarily need this delegation, consider the following:\\r\\n\\r\\n- add the administrators in the Discovery Management group\\r\\n- monitor the group content and alert when the group modified\\r\\n- add administrators in this group only for a short period of time\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"SearchRBACHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Role contains \\\"search\\\" and CmdletResultValue.Name !contains \\\"Deleg\\\"\\r\\n| where CmdletResultValue.RoleAssigneeName != \\\"Exchange Online-ApplicationAccount\\\" and CmdletResultValue.RoleAssigneeName != \\\"Discovery Management\\\"\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType== \\\"User\\\" , \\\"User\\\", \\\"Group\\\")\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n| extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| extend RoleAssigneeName = iff( RoleAssigneeType == \\\"User\\\", strcat(\\\"πŸ§‘β€πŸ¦° \\\",RoleAssigneeName), strcat(\\\"πŸ‘ͺ \\\", RoleAssigneeName) )\\r\\n| project RoleAssigneeName, RoleAssigneeType, Status,CustomRecipientWriteScope,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,ManagementRoleAssignement,WhenChanged,WhenCreated\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Mailbox Search Role\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"Delegation\"},\"name\":\"Importantsecurityconfiguration\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Exchange and AD GRoup\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Exchange group\",\"items\":[{\"type\":1,\"content\":{\"json\":\"ℹ️ Recommendations\\r\\n\\r\\n- Ensure that no service account are a member of the high privilege groups. Use RBAC to delegate the exact required permissions.\\r\\n- Limit the usage of nested group for administration.\\r\\n- Ensure that accounts are given only the required pernissions to execute their tasks.\\r\\n- Use just in time administration principle by adding users in a group only when they need the permissions, then remove them when their operation is over.\\r\\n- Limit the number of Organization management members. When you review the Admin Audit logs you might see that the administrators rarely needed Organization Management privileges.\\r\\n- Monitor the content of the following groups:\\r\\n - TenantAdmins_-xxx (Membership in this role group is synchronized across services and managed centrally)\\r\\n - Organization Management\\r\\n - ExchangeServiceAdmins_-xxx (Membership in this role group is synchronized across services and managed centrally)\\r\\n - Recipient Management (Member of this group have at least the following rights : set-mailbox, Add-MailboxPermission)\\r\\n - Discovery Management\\r\\n - Hygiene Management\\r\\n - Security Administrator (Membership in this role group is synchronized across services and managed centrally)\\r\\n - xxx High privilege group (not an exhaustive list)\\r\\n - Compliance Management\\r\\n - All RBAC groups that have high roles delegation\\r\\n - All nested groups in high privileges groups\\r\\n - Note that this is not a complete list. The content of all the groups that have high privileges should be monitored.\\r\\n- Each time a new RBAC group is created, decide if the content of this groups should be monitored\\r\\n- Periodically review the members of the groups\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"text - 0\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"To groups - Number of direct members per group with RecipientType User\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"RoleGroupMember\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n//| where CmdletResultValue.RecipientType !contains \\\"group\\\"\\r\\n| extend Members= tostring(CmdletResultValue.Identity)\\r\\n| summarize dcount(tostring(Members)) by RoleGroup = tostring(CmdletResultValue.RoleGroup)\\r\\n| where RoleGroup has_any (\\\"TenantAdmins\\\",\\\"Organization Management\\\", \\\"Discovery Management\\\", \\\"Compliance Management\\\", \\\"Server Management\\\", \\\"ExchangeServiceAdmins\\\",\\\"Security Administrator\\\", \\\"SecurityAdmins\\\", \\\"Recipient Manangement\\\", \\\"Records Manangement\\\",\\\"Impersonation\\\",\\\"Export\\\")\\r\\n| sort by dcount_Members\\r\\n\",\"size\":3,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"RoleGroup\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_Members\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":true,\"sortCriteriaField\":\"dcount_Members\",\"sortOrderField\":2,\"size\":\"auto\"}},\"name\":\"query - 0\"}]},\"name\":\"ExchangeGroupsList\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Number of direct members per group with RecipientType User\",\"expandable\":true,\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"RoleGroupMember\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n| where CmdletResultValue.RecipientType !contains \\\"group\\\"\\r\\n| extend Members= tostring(CmdletResultValue.Identity)\\r\\n| summarize dcount(tostring(Members)) by RoleGroup = tostring(CmdletResultValue.RoleGroup)\\r\\n| sort by dcount_Members\\r\\n\",\"size\":3,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"RoleGroup\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_Members\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":true,\"sortCriteriaField\":\"dcount_Members\",\"sortOrderField\":2,\"size\":\"auto\"}},\"name\":\"query - 0\"}]},\"name\":\"ExchangeGroupsList - Copy\"},{\"type\":1,\"content\":{\"json\":\"Exchange groups content (Extract for the OU \\\"Microsoft Exchange Security Groups\\\").\\r\\nSelect a group to display detailed information of its contents.\\r\\nLevel attribute helps you understand the level of nested groups.\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b4b7a6ad-381a-48d6-9938-bf7cb812b474\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Group\",\"type\":2,\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"RoleGroup\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n//| where CmdletResultValue.Parentgroup != \\\"Exchange Trusted Subsystem\\\"\\r\\n//| where CmdletResultValue.Parentgroup != \\\"Exchange Windows Permissions\\\"\\r\\n| project CmdletResultValue\\r\\n| extend GroupName = tostring(CmdletResultValue.Name)\\r\\n| distinct GroupName\\r\\n| sort by GroupName asc\\r\\n\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//ExchangeConfiguration(SpecificSectionList=\\\"ExGroup\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\nExchangeConfiguration(SpecificSectionList=\\\"RoleGroupMember\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| search CmdletResultValue.RoleGroup == \\\"{Group}\\\"\\r\\n//| where CmdletResultValue.Level != 0\\r\\n| project CmdletResultValue\\r\\n| extend Members = tostring(CmdletResultValue.Identity)\\r\\n//| extend Parentgroup = tostring(CmdletResultValue.Parentgroup)\\r\\n//| extend MemberPath = tostring(CmdletResultValue.MemberPath)\\r\\n//| extend Level = tostring(CmdletResultValue.Level)\\r\\n//| extend ObjectClass = tostring(CmdletResultValue.ObjectClass)\\r\\n//| extend LastLogon = CmdletResultValue.LastLogonString\\r\\n//| extend LastLogon = iif ( todatetime (CmdletResultValue.LastLogonString) < ago(-366d), CmdletResultValue.LastLogonString,strcat(\\\"πŸ’₯\\\",CmdletResultValue.LastLogonString))\\r\\n//| extend LastPwdSet = CmdletResultValue.LastPwdSetString\\r\\n//| extend Enabled = tostring(CmdletResultValue.Enabled)\\r\\n| extend Members = case( CmdletResultValue.RecipientType == \\\"Group\\\", strcat( \\\"πŸ‘ͺ \\\", Members), strcat( \\\"πŸ§‘β€πŸ¦° \\\", Members) )\\r\\n| extend RecipientType = tostring(CmdletResultValue.RecipientType)\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"CmdletResultValue\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"ExchangeServersGroupsGrid\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Exchange group\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"ExchAD\"},\"name\":\"Exchange and AD GRoup\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Transport Security configuration\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Inbound Connector configuration\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This section shows the configuration of the Inbound connnectors\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"TransportRulesHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"InBoundC\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n| extend Name = tostring(CmdletResultValue.Name)\\r\\n| extend State = tostring(CmdletResultValue.Enabled)\\r\\n| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\\r\\n| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\\r\\n| extend SenderIPAddresses = tostring(CmdletResultValue.SenderIPAddresses)\\r\\n| extend SenderDomains = tostring(CmdletResultValue.SenderDomains)\\r\\n| extend TrustedOrganizations = tostring(CmdletResultValue.TrustedOrganizations)\\r\\n| extend AssociatedAcceptedDomainsRequireTls = tostring(CmdletResultValue.AssociatedAcceptedDomainsRequireTls)\\r\\n| extend RestrictDomainsToIPAddresses = tostring(CmdletResultValue.RestrictDomainsToIPAddresses)\\r\\n| extend RestrictDomainsToCertificate = tostring(CmdletResultValue.RestrictDomainsToCertificate)\\r\\n| extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\\r\\n| extend TreatMessagesAsInternal = tostring(CmdletResultValue.TreatMessagesAsInternal)\\r\\n| extend TlsSenderCertificateName = tostring(CmdletResultValue.TlsSenderCertificateName)\\r\\n| extend ScanAndDropRecipients = tostring(CmdletResultValue.ScanAndDropRecipients)\\r\\n| extend Comment = tostring(CmdletResultValue.Comment)\\r\\n| extend WhenChanged = tostring(CmdletResultValue.WhenChanged)\\r\\n| extend WhenCreated = tostring(CmdletResultValue.WhenCreated)\\r\\n| project-away CmdletResultValue\\r\\n| sort by Name asc\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Inbound Connector configuration\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Outbound Connector configuration\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This section shows the configuration of the Outbound connnectors\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"TransportRulesHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"OutBoundC\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n| extend Name = tostring(CmdletResultValue.Name)\\r\\n| extend State = tostring(CmdletResultValue.Enabled)\\r\\n| extend UseMXRecord = tostring(CmdletResultValue.UseMXRecord)\\r\\n| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\\r\\n| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\\r\\n| extend RecipientDomains = tostring(CmdletResultValue.RecipientDomains)\\r\\n| extend SmartHosts = tostring(CmdletResultValue.SmartHosts)\\r\\n| extend TlsDomain = tostring(CmdletResultValue.TlsDomain)\\r\\n| extend TlsSettings = tostring(CmdletResultValue.TlsSettings)\\r\\n| extend IsTransportRuleScoped = tostring(CmdletResultValue.IsTransportRuleScoped)\\r\\n| extend RouteAllMessagesViaOnPremises = tostring(CmdletResultValue.RouteAllMessagesViaOnPremises)\\r\\n| extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\\r\\n| extend AllAcceptedDomains = tostring(CmdletResultValue.AllAcceptedDomains)\\r\\n| extend SenderRewritingEnabled = tostring(CmdletResultValue.SenderRewritingEnabled)\\r\\n| extend TestMode = tostring(CmdletResultValue.TestMode)\\r\\n| extend LinkForModifiedConnector = tostring(CmdletResultValue.LinkForModifiedConnector)\\r\\n| extend ValidationRecipients = tostring(CmdletResultValue.ValidationRecipients)\\r\\n| extend IsValidated = tostring(CmdletResultValue.IsValidated)\\r\\n| extend LastValidationTimestamp = tostring(CmdletResultValue.LastValidationTimestamp)\\r\\n| extend Comment = tostring(CmdletResultValue.Comment)\\r\\n| extend WhenChanged = tostring(CmdletResultValue.WhenChanged)\\r\\n| extend WhenCreated = tostring(CmdletResultValue.WhenCreated)\\r\\n| project-away CmdletResultValue\\r\\n| sort by Name asc\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Outbound Connector configuration - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Transport Rules with specific actions to monitor\",\"items\":[{\"type\":1,\"content\":{\"json\":\"A common way used by attackers to exfiltrate data is to set Transport Rules that send all or sensitive messages outside the organization or to a mailbox where they already have full control.\\r\\n\\r\\nThis section shows your Transport rules with sentitive actions that can lead to data leaks:\\r\\n- BlindCopyTo\\r\\n- SentTo\\r\\n- CopyTo\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"TransportRulesHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"TransportRule\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n| extend Identity = iif( CmdletResultValue.Identity contains \\\"OrgHierarchyToIgnore\\\",tostring(CmdletResultValue.Identity.Name),tostring(CmdletResultValue.Identity))\\r\\n| extend State = tostring(CmdletResultValue.State)\\r\\n| extend SentTo = tostring(CmdletResultValue.SentToString)\\r\\n| extend BlindCopyTo = tostring(CmdletResultValue.BlindCopyToString)\\r\\n| extend CopyTo = tostring(CmdletResultValue.CopyToString)\\r\\n| extend RedirectMessageTo = tostring(CmdletResultValue.RedirectMessageToString)\\r\\n| extend Mode = tostring(CmdletResultValue.Identity.Mode)\\r\\n| project-away CmdletResultValue\\r\\n| sort by Identity asc\",\"size\":1,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Transport Rules actions to monitor\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Remote Domain Autofoward Configuration - * should not allow AutoForwardEnabled\",\"items\":[{\"type\":1,\"content\":{\"json\":\"If **AutoForwardEnabled** is set to True for an SMTP domain, then users in Outlook are allowed to set automatic transfer of all their emails to addresses in this domain.\\r\\n\\r\\nWhen the Default Remote domain is set to * and has the AutoForwardEnabled set True, any user can configure an Outlook rule to automatically forward all emails to any SMTP domain domains outside the organization. This is a high risk configuration as it might allow accounts to leak information. \\r\\n\\r\\nAlso, when setting AutoForwardEnabled to a specific domain, it is strongly recommended enable TLS encryption.\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"AutoForwardHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"RemoteDomain\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n| extend Name = tostring(CmdletResultValue.Name)\\r\\n| extend Address = tostring(CmdletResultValue.DomainName)\\r\\n| extend AutoForwardEnabled = iff (CmdletResultValue.AutoForwardEnabled== \\\"true\\\" and CmdletResultValue.DomainName == \\\"*\\\", strcat (\\\"❌ \\\",tostring(CmdletResultValue.AutoForwardEnabled)),iff(CmdletResultValue.AutoForwardEnabled== \\\"true\\\" and CmdletResultValue.DomainName != \\\"*\\\", strcat (\\\"⚠️ \\\",tostring(CmdletResultValue.AutoForwardEnabled)),strcat (\\\"βœ… \\\",tostring(CmdletResultValue.AutoForwardEnabled))))\\r\\n| project-away CmdletResultValue\\r\\n| sort by Address asc \",\"size\":1,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"ForwardGroup\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"Transport\"},\"name\":\"Transport Security configuration\"}],\"fromTemplateId\":\"sentinel-MicrosoftExchangeSecurityReview-Online\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Microsoft Exchange Security Review Online\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9ae328d6-99c8-4c44-8d59-42ca4d999098\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EnvironmentList\",\"label\":\"Environment\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"ExchangeEnvironmentList(Target=\\\"Online\\\") | where ESIEnvironment != \\\"\\\"\",\"typeSettings\":{\"limitSelectTo\":1,\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"a88b4e41-eb2f-41bf-92d8-27c83650a4b8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DateOfConfiguration\",\"label\":\"Collection time\",\"type\":2,\"isRequired\":true,\"query\":\"let _configurationEnv = split(iff(isnull({EnvironmentList}) or isempty({EnvironmentList}) or tolower({EnvironmentList}) == \\\"all\\\",\\\"All\\\",tostring({EnvironmentList})),',');\\r\\nESIExchangeOnlineConfig_CL\\r\\n| extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n| where ScopedEnvironment in (_configurationEnv)\\r\\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n| summarize Collection = max(Collection)\\r\\n| project Collection = \\\"lastdate\\\", Selected = true\\r\\n| join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n | where ScopedEnvironment in (_configurationEnv)\\r\\n | where TimeGenerated > ago(90d)\\r\\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n | summarize by Collection \\r\\n | join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n | where ScopedEnvironment in (_configurationEnv)\\r\\n | where TimeGenerated > ago(90d)\\r\\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm ')\\r\\n | summarize by PreciseCollection, Collection \\r\\n | join kind=leftouter (\\r\\n ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n | where ScopedEnvironment in (_configurationEnv)\\r\\n | where TimeGenerated > ago(90d)\\r\\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm')\\r\\n | summarize by PreciseCollection, Collection \\r\\n | summarize count() by Collection\\r\\n ) on Collection\\r\\n ) on Collection\\r\\n) on Collection\\r\\n| project Value = iif(Selected,Collection,iif(count_ > 1,PreciseCollection,Collection1)), Label = iif(Selected,\\\"Last Known date\\\",iif(count_ > 1,PreciseCollection,Collection1)), Selected\\r\\n| sort by Selected, Value desc\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"181fa282-a002-42f1-ad57-dfb86df3194e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Compare_Collect\",\"type\":10,\"description\":\"If this button is checked, two collections will be compared\",\"isRequired\":true,\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"True\\\", \\\"label\\\": \\\"Yes\\\" },\\r\\n { \\\"value\\\": \\\"True,False\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\"},{\"id\":\"8ac96eb3-918b-4a36-bcc4-df50d8f46175\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"Show Help\",\"type\":10,\"isRequired\":true,\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n { \\\\\\\"value\\\\\\\": \\\\\\\"Yes\\\\\\\", \\\\\\\"label\\\\\\\": \\\\\\\"Yes\\\\\\\"},\\\\r\\\\n {\\\\\\\"value\\\\\\\": \\\\\\\"No\\\\\\\", \\\\\\\"label\\\\\\\": \\\\\\\"No\\\\\\\", \\\\\\\"selected\\\\\\\":true }\\\\r\\\\n]\\\\r\\\\n\\\"}\\r\\n\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":8}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"TimeRange\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a9e0099e-5eb1-43b8-915c-587aa05bccf0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DateCompare\",\"type\":2,\"description\":\"Date to Comapre\",\"isRequired\":true,\"query\":\"let _configurationEnv = split(iff(isnull({EnvironmentList}) or isempty({EnvironmentList}) or tolower({EnvironmentList}) == \\\"all\\\",\\\"All\\\",tostring({EnvironmentList})),',');\\r\\nESIExchangeOnlineConfig_CL\\r\\n| extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n| where ScopedEnvironment in (_configurationEnv)\\r\\n| extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n| summarize Collection = max(Collection)\\r\\n| project Collection = \\\"lastdate\\\", Selected = true\\r\\n| join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n | where ScopedEnvironment in (_configurationEnv)\\r\\n | where TimeGenerated > ago(90d)\\r\\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n | summarize by Collection \\r\\n | join kind= fullouter ( ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n | where ScopedEnvironment in (_configurationEnv)\\r\\n | where TimeGenerated > ago(90d)\\r\\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm ')\\r\\n | summarize by PreciseCollection, Collection \\r\\n | join kind=leftouter (\\r\\n ESIExchangeOnlineConfig_CL | extend ScopedEnvironment = iff(_configurationEnv contains \\\"All\\\", \\\"All\\\",ESIEnvironment_s) \\r\\n | where ScopedEnvironment in (_configurationEnv)\\r\\n | where TimeGenerated > ago(90d)\\r\\n | extend Collection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd')\\r\\n | extend PreciseCollection = format_datetime(todatetime(EntryDate_s), 'yyyy-MM-dd HH:mm')\\r\\n | summarize by PreciseCollection, Collection \\r\\n | summarize count() by Collection\\r\\n ) on Collection\\r\\n ) on Collection\\r\\n) on Collection\\r\\n| project Value = iif(Selected,Collection,iif(count_ > 1,PreciseCollection,Collection1)), Label = iif(Selected,\\\"Last Known date\\\",iif(count_ > 1,PreciseCollection,Collection1)), Selected\\r\\n| sort by Selected, Value desc\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"Compare_Collect\",\"comparison\":\"isEqualTo\",\"value\":\"True\"},\"name\":\"parameters - 0\"},{\"type\":1,\"content\":{\"json\":\"This workbook helps review your Exchange Security configuration.\\r\\nAdjust the time range, and when needed select an item in the dropdownlist\",\"style\":\"info\"},\"name\":\"text - 9\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"34188faf-7a02-4697-9b36-2afa986afc0f\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Mailbox Access\",\"subTarget\":\"Delegation\",\"postText\":\"t\",\"style\":\"link\",\"icon\":\"3\",\"linkIsContextBlade\":true},{\"id\":\"be02c735-6150-4b6e-a386-b2b023e754e5\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"EXO & Azure AD Groups\",\"subTarget\":\"ExchAD\",\"style\":\"link\"},{\"id\":\"26c68d90-925b-4c3c-a837-e3cecd489b2d\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Transport Configuration\",\"subTarget\":\"Transport\",\"style\":\"link\"},{\"id\":\"eb2888ca-7fa6-4e82-88db-1bb3663a801e\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Workbook Help\",\"subTarget\":\"Start\",\"style\":\"link\"}]},\"name\":\"TopMenuTabs\"},{\"type\":1,\"content\":{\"json\":\"To compare collects, select **Yes** and choose the initial date.\\r\\nFor each role, a new table will be displayed with **all** the modifications (Add, Remove, Modifications) beetween the two dates.\\r\\n\\r\\n**Important notes** : Some information are limited are may be not 100% accurate :\\r\\n - Date\\r\\n - GUID of user instead of the name\\r\\n - Fusion of modifications when a role assisgnment is changed within the same collect \\r\\n - ... \\r\\n\\r\\nThis is due to some restrictions in the collect. For more details information, please check the workbook **\\\"Microsoft Exchange Search AdminAuditLog - Online\\\"**\\r\\n.\\r\\n\\r\\nThe compare functionnality is not available for all sections in this workbook.\\r\\n\"},\"name\":\"text - 9\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Workbook goals\\r\\n\\r\\nThe goal of this workbook is to outline key security configurations of your Exchange on-premises environment.\\r\\n\\r\\nMost of Exchange organizations have were installed years ago (sometimes more than 10 years). Many configurations have been done and might not have been documented. For most environments, the core commitment was maintaining a high availability of the users’ mailboxes putting aside other consideration (even security considerations). Recommended security practices have also evolved since the first released and a regular review is necessary.\\r\\n\\r\\nThis workbook is designed to show your Exchange organization is configured with a security point of view. Indeed, some configurations easy to display as there are no UI available.\\r\\n\\r\\nFor each configuration, you will find explanations and recommendations when applicable.\\r\\n\\r\\n- This workbook does not pretend to show you every weak Security configurations, but the most common issues and known to be used by attackers. \\r\\n- It will not show you if you have been comprised, but will help you identify unexpected configuration.\\r\\n\\r\\n----\\r\\n\\r\\n## Quick reminder of how Exchange works\\r\\n\\r\\nDuring Exchange installation two very important groups are created :\\r\\n- Exchange Trusted Subsystem : Contain all the computer accounts for Exchange Server\\r\\n- Exchange Windows Permissions : Contain the group Exchange trusted Subsystem\\r\\n\\r\\nThese groups have :\\r\\n- Very high privileges in ALL AD domains including the root domain\\r\\n- Right on any Exchange including mailboxes\\r\\n\\r\\nAs each Exchange server computer account is member of Exchange Trusted Subsystem, it means by taking control of the computer account or being System on an Exchange server you will gain access to all the permissions granted to Exchange Trusted Subsystem and Exchange Windows Permissions.\\r\\n\\r\\nTo protect AD and Exchange, it is very important to ensure the following:\\r\\n- There is a very limited number of persons that are local Administrator on Exchange server\\r\\n- To protect user right like : Act part of the operating System, Debug\\r\\n\\r\\nEvery service account or application that have high privileges on Exchange need to be considered as sensitive\\r\\n\\r\\n** πŸ’‘ Exchange servers need to be considered as very sensitive servers**\\r\\n\\r\\n-----\\r\\n\\r\\n\\r\\n## Tabs\\r\\n\\r\\n### Mailbox Access\\r\\n\\r\\nThis tab will show you several top sensitive delegations that allow an account to access, modify, act as another user, search, export the content of a mailbox.\\r\\n\\r\\n### Exchange & AD Groups\\r\\n\\r\\nThis tab will show you the members of Exchange groups and Sensitive AD groups.\\r\\n\\r\\n### Local Administrators\\r\\n\\r\\nThis tab will show you the non standard content of the local Administrators group. Remember that a member of the local Administrators group can take control of the computer account of the server and then it will have all the permissions associated with Exchange Trusted Subsytem and Exchange Windows Permissions\\r\\n\\r\\nThe information is displayed with different views : \\r\\n- List of nonstandard users\\r\\n- Number of servers with a nonstandard a user\\r\\n- Nonstandard groups content\\r\\n- For each user important information are displayed like last logon, last password set, enabled\\r\\n\\r\\n### Exchange Security configuration\\r\\n\\r\\nThis tab will show you some important configuration for your Exchange Organization\\r\\n- Status of Admin Audit Log configuration\\r\\n- Status of POP and IMAP configuration : especially, is Plaintext Authentication configured ?\\r\\n- Nonstandard permissions on the Exchange container in the Configuration Partition\\r\\n\\r\\n### Transport Configuration\\r\\n\\r\\nThis tab will show you the configuration of the main Transport components\\r\\n- Receive Connectors configured with Anonymous and/or Open Relay\\r\\n- Remote Domain Autoforward configuration\\r\\n- Transport Rules configured with BlindCopyTo, SendTo, RedirectTo\\r\\n- Journal Rule and Journal Recipient configurations\\r\\n- Accepted Domains with *\\r\\n\\r\\n\"},\"name\":\"WorkbookInfo\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"Start\"},\"name\":\"InformationTab\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Display important security configurations that allow to access mailboxes' content. Direct delegations on mailboxes are not listed (Full Access permission mailboxes or direct delegations on mailboxes folders)\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Name !contains \\\"Deleg\\\" and CmdletResultValue.RoleAssigneeName != \\\"Hygiene Management\\\" and CmdletResultValue.RoleAssigneeName != \\\"Exchange Online-ApplicationAccount\\\" and CmdletResultValue.RoleAssigneeName != \\\"Discovery Management\\\" and CmdletResultValue.RoleAssigneeName !contains \\\"RIM-MailboxAdmins\\\"\\r\\n| where CmdletResultValue.Role contains \\\"Export\\\" or CmdletResultValue.Role contains \\\"Impersonation\\\" or CmdletResultValue.Role contains \\\"Search\\\"\\r\\n| summarize dcount(tostring(CmdletResultValue.RoleAssigneeName)) by role=tostring(CmdletResultValue.Role)\",\"size\":3,\"title\":\"Number of accounts with sensitive RBAC roles\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"role\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_CmdletResultValue_RoleAssigneeName\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true,\"sortCriteriaField\":\"role\",\"sortOrderField\":1}},\"name\":\"MRAQuery\"},{\"type\":1,\"content\":{\"json\":\"**ApplicationImpersonation** is a RBAC role that allows access (read and modify) to the content of all mailboxes. This role is very powerfull and should be carefully delegated. When a delegation is necessary, RBAC scopes should be configured to limit the list of impacted mailboxes.\\r\\n\\r\\nIt is common to see service accounts for backup solution, antivirus software, MDM...\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"SensitiveRBACHelp\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Application Impersonation Role\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This delegation allows the delegated account to access and modify the content of every mailboxes using EWS.\\r\\nExcluded from the result as it is a default configuration :\\r\\nDelegating delegation to Organization Management\"},\"name\":\"text - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Role contains \\\"Impersonation\\\" and CmdletResultValue.RoleAssigneeName != \\\"Hygiene Management\\\" and CmdletResultValue.RoleAssigneeName !contains \\\"RIM-MailboxAdmins\\\" and CmdletResultValue.Name !contains \\\"Deleg\\\"\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType== \\\"User\\\" , \\\"User\\\", \\\"RoleGroup\\\")\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n| extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| extend RoleAssigneeName = iff( RoleAssigneeType == \\\"User\\\", strcat(\\\"πŸ§‘β€πŸ¦° \\\",RoleAssigneeName), strcat(\\\"πŸ‘ͺ \\\", RoleAssigneeName) )\\r\\n| project RoleAssigneeName, RoleAssigneeType, Status,CustomRecipientWriteScope,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,ManagementRoleAssignement,WhenChanged,WhenCreated\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ExclusionsAcctValue = dynamic([\\\"Hygiene Management\\\", \\\"RIM-MailboxAdmins\\\"]);\\r\\nMESCompareDataMRA(SectionCompare=\\\"MRA\\\",DateCompare=\\\"{DateCompare:value}\\\",CurrentDate = \\\"{DateOfConfiguration:value}\\\",EnvList ={EnvironmentList},TypeEnv = \\\"Online\\\",ExclusionsAcct = ExclusionsAcctValue ,CurrentRole=\\\"Impersonation\\\")\",\"size\":3,\"title\":\"Display changes ( Add, Remove, modifications of parameters )\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"ManagementRoleAssignement\"],\"expandTopLevel\":true}}},\"conditionalVisibility\":{\"parameterName\":\"Compare_Collect\",\"comparison\":\"isEqualTo\",\"value\":\"True\"},\"name\":\"query - 2\"}]},\"name\":\"Application Impersonation Role\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Mailbox Import Export Role\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This delegation allows to import contents in all mailboxes.\\r\\nExcluded from the result as it is a default configuration :\\r\\nDelegating delegation to Organization Management\\r\\n\"},\"name\":\"text - 0\"},{\"type\":1,\"content\":{\"json\":\"**Mailbox Import Export** is an RBAC role that allows an account to import (export is not available online) contant in a user mailbox. It also allows searches in all mailboxes.\\r\\n\\r\\n⚑ This role is very powerfull.\\r\\n\\r\\nBy default, this role is not delegated to any user or group. The members of the group Organization Management by default do not have this role but are able to delegate it.\\r\\n\\r\\nℹ️ Recommendations\\r\\n\\r\\nIf you temporarily need this delegation, consider the following:\\r\\n- create an empty group with this delegation\\r\\n- monitor the group content and alert when the group modified\\r\\n- add administrators in this group only for a short period of time\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"SearchRBACHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Role contains \\\"export\\\" and CmdletResultValue.Name !contains \\\"Deleg\\\"\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType== \\\"User\\\" , \\\"User\\\", \\\"RoleGroup\\\")\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n| extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| extend RoleAssigneeName = iff( RoleAssigneeType == \\\"User\\\", strcat(\\\"πŸ§‘β€πŸ¦° \\\",RoleAssigneeName), strcat(\\\"πŸ‘ͺ \\\", RoleAssigneeName) )\\r\\n| project RoleAssigneeName, RoleAssigneeType, Status,CustomRecipientWriteScope,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,ManagementRoleAssignement,WhenChanged,WhenCreated\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MESCompareDataMRA(SectionCompare=\\\"MRA\\\",DateCompare=\\\"{DateCompare:value}\\\",CurrentDate = \\\"{DateOfConfiguration:value}\\\",EnvList ={EnvironmentList},TypeEnv = \\\"Online\\\",ExclusionsAcct = \\\"N/A\\\",CurrentRole=\\\"export\\\")\",\"size\":3,\"showAnalytics\":true,\"title\":\"Display changes ( Add, Remove, modifications of parameters )\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"ManagementRoleAssignement\"],\"expandTopLevel\":true},\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"conditionalVisibility\":{\"parameterName\":\"Compare_Collect\",\"comparison\":\"isEqualTo\",\"value\":\"True\"},\"name\":\"query - 1 - Copy\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Mailbox Import Export Role\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Mailbox Search Role\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This delegation allows to search inside all or in a scope of mailboxes.\\r\\nExcluded from the result as it is a default configuration :\\r\\nDelegating delegation to Organization Management\\r\\nDiscovery Management has been excluded\\r\\n\"},\"name\":\"text - 0\"},{\"type\":1,\"content\":{\"json\":\"**Mailbox Search** is an RBAC role that allows an account to search in any mailbox.\\r\\n\\r\\n⚑ This role is very powerfull.\\r\\n\\r\\nBy default, this role is only delegated to the group Discovery Management. The members of the group Organization Management do not have this role but are able to delegate it.\\r\\n\\r\\nℹ️ Recommendations\\r\\n\\r\\nIf you temporarily need this delegation, consider the following:\\r\\n\\r\\n- add the administrators in the Discovery Management group\\r\\n- monitor the group content and alert when the group modified\\r\\n- add administrators in this group only for a short period of time\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"SearchRBACHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"MRA\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| where CmdletResultValue.Role contains \\\"search\\\" and CmdletResultValue.Name !contains \\\"Deleg\\\"\\r\\n| where CmdletResultValue.RoleAssigneeName != \\\"Exchange Online-ApplicationAccount\\\" and CmdletResultValue.RoleAssigneeName != \\\"Discovery Management\\\"\\r\\n| extend RoleAssigneeName = tostring(CmdletResultValue.RoleAssigneeName)\\r\\n| extend RoleAssigneeType = iff(CmdletResultValue.RoleAssigneeType== \\\"User\\\" , \\\"User\\\", \\\"Group\\\")\\r\\n| extend CustomRecipientWriteScope = tostring(CmdletResultValue.CustomRecipientWriteScope)\\r\\n| extend CustomConfigWriteScope = tostring(CmdletResultValue.CustomConfigWriteScope)\\r\\n| extend CustomResourceScope = tostring(CmdletResultValue.CustomResourceScope)\\r\\n| extend RecipientWriteScope = CmdletResultValue.RecipientWriteScope\\r\\n| extend ConfigWriteScope = CmdletResultValue.ConfigWriteScope\\r\\n| extend ManagementRoleAssignement = tostring(CmdletResultValue.Name)\\r\\n| extend Status= tostring(CmdletResultValue.Enabled)\\r\\n| extend RoleAssigneeName = iff( RoleAssigneeType == \\\"User\\\", strcat(\\\"πŸ§‘β€πŸ¦° \\\",RoleAssigneeName), strcat(\\\"πŸ‘ͺ \\\", RoleAssigneeName) )\\r\\n| project RoleAssigneeName, RoleAssigneeType, Status,CustomRecipientWriteScope,CustomConfigWriteScope,CustomResourceScope,RecipientWriteScope,ConfigWriteScope,ManagementRoleAssignement,WhenChanged,WhenCreated\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MESCompareDataMRA(SectionCompare=\\\"MRA\\\",DateCompare=\\\"{DateCompare:value}\\\",CurrentDate = \\\"{DateOfConfiguration:value}\\\",EnvList ={EnvironmentList},TypeEnv = \\\"Online\\\",ExclusionsAcct = \\\"N/A\\\",CurrentRole=\\\"Search\\\")\",\"size\":3,\"showAnalytics\":true,\"title\":\"Display changes ( Add, Remove, modifications of parameters )\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"ManagementRoleAssignement\"],\"expandTopLevel\":true},\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"ConfigWriteScope\",\"sortOrder\":1}]},\"conditionalVisibility\":{\"parameterName\":\"Compare_Collect\",\"comparison\":\"isEqualTo\",\"value\":\"True\"},\"name\":\"query - 1 - Copy\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Mailbox Search Role\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"Delegation\"},\"name\":\"Importantsecurityconfiguration\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Exchange Group\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"ℹ️ Recommendations\\r\\n\\r\\n- Ensure that no service account are a member of the high privilege groups. Use RBAC to delegate the exact required permissions.\\r\\n- Limit the usage of nested group for administration.\\r\\n- Ensure that accounts are given only the required pernissions to execute their tasks.\\r\\n- Use just in time administration principle by adding users in a group only when they need the permissions, then remove them when their operation is over.\\r\\n- Limit the number of Organization management members. When you review the Admin Audit logs you might see that the administrators rarely needed Organization Management privileges.\\r\\n- Monitor the content of the following groups:\\r\\n - TenantAdmins_-xxx (Membership in this role group is synchronized across services and managed centrally)\\r\\n - Organization Management\\r\\n - ExchangeServiceAdmins_-xxx (Membership in this role group is synchronized across services and managed centrally)\\r\\n - Recipient Management (Member of this group have at least the following rights : set-mailbox, Add-MailboxPermission)\\r\\n - Discovery Management\\r\\n - Hygiene Management\\r\\n - Security Administrator (Membership in this role group is synchronized across services and managed centrally)\\r\\n - xxx High privilege group (not an exhaustive list)\\r\\n - Compliance Management\\r\\n - All RBAC groups that have high roles delegation\\r\\n - All nested groups in high privileges groups\\r\\n - Note that this is not a complete list. The content of all the groups that have high privileges should be monitored.\\r\\n- Each time a new RBAC group is created, decide if the content of this groups should be monitored\\r\\n- Periodically review the members of the groups\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"text - 0\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\" Number of direct members per group with RecipientType User\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"RoleGroupMember\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n//| where CmdletResultValue.RecipientType !contains \\\"group\\\"\\r\\n| extend Members= tostring(CmdletResultValue.Identity)\\r\\n| summarize dcount(tostring(Members)) by RoleGroup = tostring(CmdletResultValue.RoleGroup)\\r\\n| where RoleGroup has_any (\\\"TenantAdmins\\\",\\\"Organization Management\\\", \\\"Discovery Management\\\", \\\"Compliance Management\\\", \\\"Server Management\\\", \\\"ExchangeServiceAdmins\\\",\\\"Security Administrator\\\", \\\"SecurityAdmins\\\", \\\"Recipient Manangement\\\", \\\"Records Manangement\\\",\\\"Impersonation\\\",\\\"Export\\\")\\r\\n| sort by dcount_Members\\r\\n\",\"size\":3,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"RoleGroup\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_Members\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":true,\"sortCriteriaField\":\"dcount_Members\",\"sortOrderField\":2,\"size\":\"auto\"}},\"name\":\"query - 0\"}]},\"name\":\"ExchangeGroupsList\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Number of direct members per group with RecipientType User\",\"expandable\":true,\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"RoleGroupMember\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n| where CmdletResultValue.RecipientType !contains \\\"group\\\"\\r\\n| extend Members= tostring(CmdletResultValue.Identity)\\r\\n| summarize dcount(tostring(Members)) by RoleGroup = tostring(CmdletResultValue.RoleGroup)\\r\\n| sort by dcount_Members\\r\\n\",\"size\":3,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"RoleGroup\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_Members\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":true,\"sortCriteriaField\":\"dcount_Members\",\"sortOrderField\":2,\"size\":\"auto\"}},\"name\":\"query - 0\"}]},\"name\":\"ExchangeGroupsList - Copy\"},{\"type\":1,\"content\":{\"json\":\"Exchange Online groups content.\\r\\nSelect a group to display detailed information of its contents.\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b4b7a6ad-381a-48d6-9938-bf7cb812b474\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Group\",\"type\":2,\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"RoleGroup\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n//| where CmdletResultValue.Parentgroup != \\\"Exchange Trusted Subsystem\\\"\\r\\n//| where CmdletResultValue.Parentgroup != \\\"Exchange Windows Permissions\\\"\\r\\n| project CmdletResultValue\\r\\n| extend GroupName = tostring(CmdletResultValue.Name)\\r\\n| distinct GroupName\\r\\n| sort by GroupName asc\\r\\n\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//ExchangeConfiguration(SpecificSectionList=\\\"ExGroup\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\nExchangeConfiguration(SpecificSectionList=\\\"RoleGroupMember\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| search CmdletResultValue.RoleGroup == \\\"{Group}\\\"\\r\\n//| where CmdletResultValue.Level != 0\\r\\n| project CmdletResultValue\\r\\n| extend Members = tostring(CmdletResultValue.Identity)\\r\\n//| extend Parentgroup = tostring(CmdletResultValue.Parentgroup)\\r\\n//| extend MemberPath = tostring(CmdletResultValue.MemberPath)\\r\\n//| extend Level = tostring(CmdletResultValue.Level)\\r\\n//| extend ObjectClass = tostring(CmdletResultValue.ObjectClass)\\r\\n//| extend LastLogon = CmdletResultValue.LastLogonString\\r\\n//| extend LastLogon = iif ( todatetime (CmdletResultValue.LastLogonString) < ago(-366d), CmdletResultValue.LastLogonString,strcat(\\\"πŸ’₯\\\",CmdletResultValue.LastLogonString))\\r\\n//| extend LastPwdSet = CmdletResultValue.LastPwdSetString\\r\\n//| extend Enabled = tostring(CmdletResultValue.Enabled)\\r\\n| extend Members = case( CmdletResultValue.RecipientType == \\\"Group\\\", strcat( \\\"πŸ‘ͺ \\\", Members), strcat( \\\"πŸ§‘β€πŸ¦° \\\", Members) )\\r\\n| extend RecipientType = tostring(CmdletResultValue.RecipientType)\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"CmdletResultValue\",\"formatter\":5}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"ExchangeServersGroupsGrid\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Exchange group\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"ExchAD\"},\"name\":\"Exchange and AD GRoup\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Transport Security configuration\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Inbound Connector configuration\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This section shows the configuration of the Inbound connnectors\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"TransportRulesHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"InBoundC\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n| extend Name = tostring(CmdletResultValue.Name)\\r\\n| extend State = tostring(CmdletResultValue.Enabled)\\r\\n| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\\r\\n| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\\r\\n| extend SenderIPAddresses = tostring(CmdletResultValue.SenderIPAddresses)\\r\\n| extend SenderDomains = tostring(CmdletResultValue.SenderDomains)\\r\\n| extend TrustedOrganizations = tostring(CmdletResultValue.TrustedOrganizations)\\r\\n| extend AssociatedAcceptedDomainsRequireTls = tostring(CmdletResultValue.AssociatedAcceptedDomainsRequireTls)\\r\\n| extend RestrictDomainsToIPAddresses = tostring(CmdletResultValue.RestrictDomainsToIPAddresses)\\r\\n| extend RestrictDomainsToCertificate = tostring(CmdletResultValue.RestrictDomainsToCertificate)\\r\\n| extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\\r\\n| extend TreatMessagesAsInternal = tostring(CmdletResultValue.TreatMessagesAsInternal)\\r\\n| extend TlsSenderCertificateName = tostring(CmdletResultValue.TlsSenderCertificateName)\\r\\n| extend ScanAndDropRecipients = tostring(CmdletResultValue.ScanAndDropRecipients)\\r\\n| extend Comment = tostring(CmdletResultValue.Comment)\\r\\n| extend WhenChanged = tostring(CmdletResultValue.WhenChanged)\\r\\n| extend WhenCreated = tostring(CmdletResultValue.WhenCreated)\\r\\n| project-away CmdletResultValue\\r\\n| sort by Name asc\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let _EnvList ={EnvironmentList};\\r\\nlet _TypeEnv = \\\"Online\\\";\\r\\nlet _DateCompare = \\\"{DateCompare:value}\\\";\\r\\nlet _CurrentDate = \\\"{DateOfConfiguration:value}\\\";\\r\\nlet _DateCompareB = todatetime(_DateCompare);\\r\\nlet _currD = (ExchangeConfiguration(SpecificSectionList=\\\"InBoundC\\\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n| summarize TimeMax = arg_max(TimeGenerated,*)\\r\\n| extend TimeMax = tostring(split(TimeMax,\\\"T\\\")[0])\\r\\n| project TimeMax);\\r\\nlet _CurrentDateB = todatetime(toscalar(_currD));\\r\\nlet BeforeData = ExchangeConfiguration(SpecificSectionList=\\\"InBoundC\\\",SpecificConfigurationDate=_DateCompareB,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n | extend Identity = tostring(CmdletResultValue.Identity)\\r\\n\\t| extend State = tostring(CmdletResultValue.Enabled)\\r\\n\\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\\r\\n\\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\\r\\n\\t| extend SenderIPAddresses = tostring(CmdletResultValue.SenderIPAddresses)\\r\\n\\t| extend SenderDomains = tostring(CmdletResultValue.SenderDomains)\\r\\n\\t| extend TrustedOrganizations = tostring(CmdletResultValue.TrustedOrganizations)\\r\\n\\t| extend AssociatedAcceptedDomainsRequireTls = tostring(CmdletResultValue.AssociatedAcceptedDomainsRequireTls)\\r\\n\\t| extend RestrictDomainsToIPAddresses = tostring(CmdletResultValue.RestrictDomainsToIPAddresses)\\r\\n\\t| extend RestrictDomainsToCertificate = tostring(CmdletResultValue.RestrictDomainsToCertificate)\\r\\n\\t| extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\\r\\n\\t| extend TreatMessagesAsInternal = tostring(CmdletResultValue.TreatMessagesAsInternal)\\r\\n\\t| extend TlsSenderCertificateName = tostring(CmdletResultValue.TlsSenderCertificateName)\\r\\n\\t| extend ScanAndDropRecipients = tostring(CmdletResultValue.ScanAndDropRecipients)\\r\\n\\t| extend Comment = tostring(CmdletResultValue.Comment)\\r\\n | extend WhenChanged = todatetime(WhenChanged)\\r\\n | extend WhenCreated = todatetime(WhenCreated)\\r\\n;\\r\\nlet AfterData = \\r\\n ExchangeConfiguration(SpecificSectionList=\\\"InBoundC\\\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n \\t| extend Identity = tostring(CmdletResultValue.Identity)\\r\\n\\t| extend State = tostring(CmdletResultValue.Enabled)\\r\\n\\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\\r\\n\\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\\r\\n\\t| extend SenderIPAddresses = tostring(CmdletResultValue.SenderIPAddresses)\\r\\n\\t| extend SenderDomains = tostring(CmdletResultValue.SenderDomains)\\r\\n\\t| extend TrustedOrganizations = tostring(CmdletResultValue.TrustedOrganizations)\\r\\n\\t| extend AssociatedAcceptedDomainsRequireTls = tostring(CmdletResultValue.AssociatedAcceptedDomainsRequireTls)\\r\\n\\t| extend RestrictDomainsToIPAddresses = tostring(CmdletResultValue.RestrictDomainsToIPAddresses)\\r\\n\\t| extend RestrictDomainsToCertificate = tostring(CmdletResultValue.RestrictDomainsToCertificate)\\r\\n\\t| extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\\r\\n\\t| extend TreatMessagesAsInternal = tostring(CmdletResultValue.TreatMessagesAsInternal)\\r\\n\\t| extend TlsSenderCertificateName = tostring(CmdletResultValue.TlsSenderCertificateName)\\r\\n\\t| extend ScanAndDropRecipients = tostring(CmdletResultValue.ScanAndDropRecipients)\\r\\n\\t| extend Comment = tostring(CmdletResultValue.Comment)\\r\\n | extend WhenChanged = todatetime(WhenChanged)\\r\\n | extend WhenCreated = todatetime(WhenCreated)\\r\\n;\\r\\nlet i=0;\\r\\nlet allDataRange = \\r\\n ESIExchangeOnlineConfig_CL\\r\\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\\r\\n | where ESIEnvironment_s == _EnvList\\r\\n | where ExecutionResult_s <> \\\"EmptyResult\\\"\\r\\n | where Section_s == \\\"InBoundC\\\"\\r\\n | extend CmdletResultValue = parse_json(rawData_s)\\r\\n | project TimeGenerated,CmdletResultValue,WhenChanged = todatetime(WhenChanged_t), WhenCreated=todatetime(WhenCreated_t)\\r\\n \\t| extend Identity = tostring(CmdletResultValue.Identity)\\r\\n\\t| extend State = tostring(CmdletResultValue.Enabled)\\r\\n\\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\\r\\n\\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\\r\\n\\t| extend SenderIPAddresses = tostring(CmdletResultValue.SenderIPAddresses)\\r\\n\\t| extend SenderDomains = tostring(CmdletResultValue.SenderDomains)\\r\\n\\t| extend TrustedOrganizations = tostring(CmdletResultValue.TrustedOrganizations)\\r\\n\\t| extend AssociatedAcceptedDomainsRequireTls = tostring(CmdletResultValue.AssociatedAcceptedDomainsRequireTls)\\r\\n\\t| extend RestrictDomainsToIPAddresses = tostring(CmdletResultValue.RestrictDomainsToIPAddresses)\\r\\n\\t| extend RestrictDomainsToCertificate = tostring(CmdletResultValue.RestrictDomainsToCertificate)\\r\\n\\t| extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\\r\\n\\t| extend TreatMessagesAsInternal = tostring(CmdletResultValue.TreatMessagesAsInternal)\\r\\n\\t| extend TlsSenderCertificateName = tostring(CmdletResultValue.TlsSenderCertificateName)\\r\\n\\t| extend ScanAndDropRecipients = tostring(CmdletResultValue.ScanAndDropRecipients)\\r\\n\\t| extend Comment = tostring(CmdletResultValue.Comment)\\r\\n ;\\r\\nlet DiffAddDataP1 = allDataRange\\r\\n | join kind = rightanti (AfterData | where WhenCreated >=_DateCompareB) on WhenCreated\\r\\n;\\r\\nlet DiffAddDataP2 = allDataRange\\r\\n | join kind = innerunique (allDataRange ) on WhenCreated\\r\\n | where WhenCreated >=_DateCompareB\\r\\n | where bin(WhenCreated,5m)==bin(WhenChanged,5m)\\r\\n | distinct Identity,State,ConnectorType,ConnectorSource,SenderIPAddresses,SenderDomains,TrustedOrganizations,AssociatedAcceptedDomainsRequireTls,RestrictDomainsToIPAddresses,RestrictDomainsToCertificate,CloudServicesMailEnabled,TreatMessagesAsInternal,TlsSenderCertificateName,ScanAndDropRecipients,Comment,WhenChanged,WhenCreated\\r\\n ;\\r\\nlet DiffAddData = union DiffAddDataP1,DiffAddDataP2\\r\\n| extend Actiontype =\\\"Add\\\";\\r\\nlet DiffRemoveData = allDataRange\\r\\n | join kind = leftanti AfterData on Identity\\r\\n | extend Actiontype =\\\"Remove\\\"\\r\\n | distinct Actiontype ,Identity,State,ConnectorType,ConnectorSource,SenderIPAddresses,SenderDomains,TrustedOrganizations,AssociatedAcceptedDomainsRequireTls,RestrictDomainsToIPAddresses,RestrictDomainsToCertificate,CloudServicesMailEnabled,TreatMessagesAsInternal,TlsSenderCertificateName,ScanAndDropRecipients,Comment,WhenCreated\\r\\n | project WhenChanged=_CurrentDateB,Actiontype,Identity,State,ConnectorType,ConnectorSource,SenderIPAddresses,SenderDomains,TrustedOrganizations,AssociatedAcceptedDomainsRequireTls,RestrictDomainsToIPAddresses,RestrictDomainsToCertificate,CloudServicesMailEnabled,TreatMessagesAsInternal,TlsSenderCertificateName,ScanAndDropRecipients,Comment,WhenCreated\\r\\n ;\\r\\nlet DiffModifData = union AfterData,allDataRange\\r\\n| sort by Identity,WhenChanged asc\\r\\n| project WhenChanged,Identity,State,ConnectorType,ConnectorSource,SenderIPAddresses,SenderDomains,TrustedOrganizations,AssociatedAcceptedDomainsRequireTls,RestrictDomainsToIPAddresses,RestrictDomainsToCertificate,CloudServicesMailEnabled,TreatMessagesAsInternal,TlsSenderCertificateName,ScanAndDropRecipients,Comment,WhenCreated\\r\\n| extend Identity = iff( Identity == prev(Identity) and Identity != prev(Identity) and prev(Identity) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", Identity, \\\" (\\\",prev(Identity),\\\"->\\\", Identity,\\\" )\\\"),Identity)\\r\\n| extend State = iff( Identity == prev(Identity) and State != prev(State) and prev(State) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", State, \\\" (\\\",prev(State),\\\"->\\\", State,\\\" )\\\"),State)\\r\\n| extend ConnectorType = iff( Identity == prev(Identity) and ConnectorType != prev(ConnectorType) and prev(ConnectorType) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", ConnectorType, \\\" (\\\",prev(ConnectorType),\\\"->\\\", ConnectorType,\\\" )\\\"),ConnectorType)\\r\\n| extend ConnectorSource = iff( Identity == prev(Identity) and ConnectorSource != prev(ConnectorSource) and prev(ConnectorSource) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", ConnectorSource, \\\" (\\\",prev(ConnectorSource),\\\"->\\\", ConnectorSource,\\\" )\\\"),ConnectorSource)\\r\\n| extend SenderIPAddresses = iff( Identity == prev(Identity) and SenderIPAddresses != prev(SenderIPAddresses) and prev(SenderIPAddresses) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", SenderIPAddresses, \\\" (\\\",prev(SenderIPAddresses),\\\"->\\\", SenderIPAddresses,\\\" )\\\"),SenderIPAddresses)\\r\\n| extend SenderDomains = iff( Identity == prev(Identity) and SenderDomains != prev(SenderDomains) and prev(SenderDomains) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", SenderDomains, \\\" (\\\",prev(SenderDomains),\\\"->\\\", SenderDomains,\\\" )\\\"),SenderDomains)\\r\\n| extend TrustedOrganizations = iff( Identity == prev(Identity) and TrustedOrganizations != prev(TrustedOrganizations) and prev(TrustedOrganizations) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", TrustedOrganizations, \\\" (\\\",prev(TrustedOrganizations),\\\"->\\\", TrustedOrganizations,\\\" )\\\"),TrustedOrganizations)\\r\\n| extend AssociatedAcceptedDomainsRequireTls = iff (Identity == prev(Identity) and AssociatedAcceptedDomainsRequireTls != prev(AssociatedAcceptedDomainsRequireTls) and prev(AssociatedAcceptedDomainsRequireTls) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", AssociatedAcceptedDomainsRequireTls, \\\" (\\\",prev(AssociatedAcceptedDomainsRequireTls),\\\"->\\\", AssociatedAcceptedDomainsRequireTls,\\\" )\\\"),AssociatedAcceptedDomainsRequireTls)\\r\\n| extend RestrictDomainsToIPAddresses = iff(Identity == prev(Identity) and RestrictDomainsToIPAddresses != prev(RestrictDomainsToIPAddresses) and prev(RestrictDomainsToIPAddresses) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", RestrictDomainsToIPAddresses, \\\" (\\\",prev(RestrictDomainsToIPAddresses),\\\"->\\\", RestrictDomainsToIPAddresses,\\\" )\\\"),RestrictDomainsToIPAddresses)\\r\\n| extend RestrictDomainsToCertificate = iff( Identity == prev(Identity) and RestrictDomainsToCertificate != prev(RestrictDomainsToCertificate) and prev(RestrictDomainsToCertificate) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", RestrictDomainsToCertificate, \\\" (\\\",prev(RestrictDomainsToCertificate),\\\"->\\\", RestrictDomainsToCertificate,\\\" )\\\"),RestrictDomainsToCertificate)\\r\\n| extend CloudServicesMailEnabled = iff( Identity == prev(Identity) and CloudServicesMailEnabled != prev(CloudServicesMailEnabled) and prev(CloudServicesMailEnabled) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", CloudServicesMailEnabled, \\\" (\\\",prev(CloudServicesMailEnabled),\\\"->\\\", CloudServicesMailEnabled,\\\" )\\\"),CloudServicesMailEnabled)\\r\\n| extend TreatMessagesAsInternal = iff( Identity == prev(Identity) and TreatMessagesAsInternal != prev(TreatMessagesAsInternal) and prev(TreatMessagesAsInternal) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", TreatMessagesAsInternal, \\\" (\\\",prev(TreatMessagesAsInternal),\\\"->\\\", TreatMessagesAsInternal,\\\" )\\\"),TreatMessagesAsInternal)\\r\\n| extend TlsSenderCertificateName = iff(Identity == prev(Identity) and TlsSenderCertificateName != prev(TlsSenderCertificateName) and prev(TlsSenderCertificateName) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", TlsSenderCertificateName, \\\" (\\\",prev(TlsSenderCertificateName),\\\"->\\\", TlsSenderCertificateName,\\\" )\\\"),TlsSenderCertificateName)\\r\\n| extend ScanAndDropRecipients = iff( Identity == prev(Identity) and ScanAndDropRecipients != prev(ScanAndDropRecipients) and prev(ScanAndDropRecipients) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", ScanAndDropRecipients, \\\" (\\\",prev(ScanAndDropRecipients),\\\"->\\\", ScanAndDropRecipients,\\\" )\\\"),ScanAndDropRecipients)\\r\\n| extend Comment = iff( Identity == prev(Identity) and Comment != prev(Comment) and prev(Comment) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", Comment, \\\" (\\\",prev(Comment),\\\"->\\\", Comment,\\\" )\\\"),Comment)\\r\\n| extend ActiontypeR =iff((Identity contains \\\"πŸ“\\\" or State contains \\\"πŸ“\\\" or ConnectorType contains \\\"πŸ“\\\" or ConnectorSource contains \\\"πŸ“\\\" or SenderIPAddresses contains \\\"πŸ“\\\" or SenderDomains contains \\\"πŸ“\\\" or TrustedOrganizations contains \\\"πŸ“\\\" or AssociatedAcceptedDomainsRequireTls contains \\\"πŸ“\\\" or RestrictDomainsToIPAddresses contains \\\"πŸ“\\\" or RestrictDomainsToCertificate contains \\\"πŸ“\\\" or CloudServicesMailEnabled contains \\\"πŸ“\\\" or TreatMessagesAsInternal contains \\\"πŸ“\\\" or TlsSenderCertificateName contains \\\"πŸ“\\\" or ScanAndDropRecipients contains \\\"πŸ“\\\" or Comment contains \\\"πŸ“\\\" ), i=i + 1, i)\\r\\n| extend Actiontype =iff(ActiontypeR > 0, \\\"Modif\\\", \\\"NO\\\")\\r\\n| where ActiontypeR == 1\\r\\n| project WhenChanged,Actiontype,Identity,State,ConnectorType,ConnectorSource,SenderIPAddresses,SenderDomains,TrustedOrganizations,AssociatedAcceptedDomainsRequireTls,RestrictDomainsToIPAddresses,RestrictDomainsToCertificate,CloudServicesMailEnabled,TreatMessagesAsInternal,TlsSenderCertificateName,ScanAndDropRecipients,Comment,WhenCreated\\r\\n;\\r\\nunion DiffAddData, DiffRemoveData, DiffModifData\\r\\n| extend WhenChanged = iff (Actiontype == \\\"Modif\\\", WhenChanged, iff(Actiontype == \\\"Add\\\",WhenCreated, WhenChanged))\\r\\n| extend Actiontype = case(Actiontype == \\\"Add\\\", strcat(\\\"βž• \\\", Actiontype), Actiontype == \\\"Remove\\\", strcat(\\\"βž– \\\", Actiontype), Actiontype == \\\"Modif\\\", strcat(\\\"πŸ“ \\\", Actiontype), \\\"N/A\\\")\\r\\n| sort by WhenChanged desc \\r\\n| project\\r\\n WhenChanged,\\r\\n Actiontype,\\r\\n Identity,\\r\\n State,\\r\\n ConnectorType,\\r\\n ConnectorSource,\\r\\n Comment,\\r\\n SenderIPAddresses,\\r\\n SenderDomains,\\r\\n TrustedOrganizations,\\r\\n AssociatedAcceptedDomainsRequireTls,\\r\\n RestrictDomainsToIPAddresses,\\r\\n RestrictDomainsToCertificate,\\r\\n CloudServicesMailEnabled,\\r\\n TreatMessagesAsInternal,\\r\\n TlsSenderCertificateName,\\r\\n ScanAndDropRecipients,\\r\\n WhenCreated\",\"size\":3,\"showAnalytics\":true,\"title\":\"Display changes ( Add, Remove, modifications of parameters )\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Identity\"],\"expandTopLevel\":true}}},\"conditionalVisibility\":{\"parameterName\":\"Compare_Collect\",\"comparison\":\"isEqualTo\",\"value\":\"True\"},\"name\":\"query - 2\"}]},\"name\":\"Inbound Connector configuration\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Outbound Connector configuration\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This section shows the configuration of the Outbound connnectors\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"TransportRulesHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"OutBoundC\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n| extend Name = tostring(CmdletResultValue.Name)\\r\\n| extend State = tostring(CmdletResultValue.Enabled)\\r\\n| extend UseMXRecord = tostring(CmdletResultValue.UseMXRecord)\\r\\n| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\\r\\n| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\\r\\n| extend RecipientDomains = tostring(CmdletResultValue.RecipientDomains)\\r\\n| extend SmartHosts = tostring(CmdletResultValue.SmartHosts)\\r\\n| extend TlsDomain = tostring(CmdletResultValue.TlsDomain)\\r\\n| extend TlsSettings = tostring(CmdletResultValue.TlsSettings)\\r\\n| extend IsTransportRuleScoped = tostring(CmdletResultValue.IsTransportRuleScoped)\\r\\n| extend RouteAllMessagesViaOnPremises = tostring(CmdletResultValue.RouteAllMessagesViaOnPremises)\\r\\n| extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\\r\\n| extend AllAcceptedDomains = tostring(CmdletResultValue.AllAcceptedDomains)\\r\\n| extend SenderRewritingEnabled = tostring(CmdletResultValue.SenderRewritingEnabled)\\r\\n| extend TestMode = tostring(CmdletResultValue.TestMode)\\r\\n| extend LinkForModifiedConnector = tostring(CmdletResultValue.LinkForModifiedConnector)\\r\\n| extend ValidationRecipients = tostring(CmdletResultValue.ValidationRecipients)\\r\\n| extend IsValidated = tostring(CmdletResultValue.IsValidated)\\r\\n| extend LastValidationTimestamp = tostring(CmdletResultValue.LastValidationTimestamp)\\r\\n| extend Comment = tostring(CmdletResultValue.Comment)\\r\\n| extend WhenChanged = tostring(CmdletResultValue.WhenChanged)\\r\\n| extend WhenCreated = tostring(CmdletResultValue.WhenCreated)\\r\\n| project-away CmdletResultValue\\r\\n| sort by Name asc\",\"size\":3,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Outbound Connector configuration - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let _EnvList ={EnvironmentList};\\r\\nlet _TypeEnv = \\\"Online\\\";\\r\\nlet _DateCompare = \\\"{DateCompare:value}\\\";\\r\\nlet _CurrentDate = \\\"{DateOfConfiguration:value}\\\";\\r\\nlet _DateCompareB = todatetime(_DateCompare);\\r\\nlet _currD = (ExchangeConfiguration(SpecificSectionList=\\\"OutBoundC\\\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n| summarize TimeMax = arg_max(TimeGenerated,*)\\r\\n| extend TimeMax = tostring(split(TimeMax,\\\"T\\\")[0])\\r\\n| project TimeMax);\\r\\nlet _CurrentDateB = todatetime(toscalar(_currD));\\r\\nlet BeforeData = ExchangeConfiguration(SpecificSectionList=\\\"OutBoundC\\\",SpecificConfigurationDate=_DateCompareB,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n | extend Identity = tostring(CmdletResultValue.Identity)\\r\\n\\t| extend State = tostring(CmdletResultValue.Enabled)\\r\\n | extend UseMXRecord = tostring(CmdletResultValue.UseMXRecord)\\r\\n\\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\\r\\n\\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\\r\\n\\t| extend RecipientDomains = tostring(CmdletResultValue.RecipientDomains)\\r\\n | extend SmartHosts = tostring(CmdletResultValue.SmartHosts)\\r\\n | extend TlsDomain = tostring(CmdletResultValue.TlsDomain)\\r\\n | extend TlsSettings = tostring(CmdletResultValue.TlsSettings)\\r\\n | extend IsTransportRuleScoped = tostring(CmdletResultValue.IsTransportRuleScoped)\\r\\n | extend RouteAllMessagesViaOnPremises = tostring(CmdletResultValue.RouteAllMessagesViaOnPremises)\\r\\n | extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\\r\\n | extend AllAcceptedDomains = tostring(CmdletResultValue.AllAcceptedDomains)\\r\\n | extend SenderRewritingEnabled = tostring(CmdletResultValue.SenderRewritingEnabled)\\r\\n | extend TestMode = tostring(CmdletResultValue.TestMode)\\r\\n | extend LinkForModifiedConnector = tostring(CmdletResultValue.LinkForModifiedConnector)\\r\\n | extend ValidationRecipients = tostring(CmdletResultValue.ValidationRecipients)\\r\\n | extend IsValidated = tostring(CmdletResultValue.IsValidated)\\r\\n | extend LastValidationTimestamp = tostring(CmdletResultValue.LastValidationTimestamp)\\r\\n | extend Comment = tostring(CmdletResultValue.Comment)\\r\\n | extend WhenChanged = todatetime(WhenChanged)\\r\\n | extend WhenCreated = todatetime(WhenCreated)\\r\\n;\\r\\nlet AfterData = \\r\\n ExchangeConfiguration(SpecificSectionList=\\\"OutBoundC\\\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n | extend Identity = tostring(CmdletResultValue.Identity)\\r\\n\\t| extend State = tostring(CmdletResultValue.Enabled)\\r\\n | extend UseMXRecord = tostring(CmdletResultValue.UseMXRecord)\\r\\n\\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\\r\\n\\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\\r\\n\\t| extend RecipientDomains = tostring(CmdletResultValue.RecipientDomains)\\r\\n | extend SmartHosts = tostring(CmdletResultValue.SmartHosts)\\r\\n | extend TlsDomain = tostring(CmdletResultValue.TlsDomain)\\r\\n | extend TlsSettings = tostring(CmdletResultValue.TlsSettings)\\r\\n | extend IsTransportRuleScoped = tostring(CmdletResultValue.IsTransportRuleScoped)\\r\\n | extend RouteAllMessagesViaOnPremises = tostring(CmdletResultValue.RouteAllMessagesViaOnPremises)\\r\\n | extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\\r\\n | extend AllAcceptedDomains = tostring(CmdletResultValue.AllAcceptedDomains)\\r\\n | extend SenderRewritingEnabled = tostring(CmdletResultValue.SenderRewritingEnabled)\\r\\n | extend TestMode = tostring(CmdletResultValue.TestMode)\\r\\n | extend LinkForModifiedConnector = tostring(CmdletResultValue.LinkForModifiedConnector)\\r\\n | extend ValidationRecipients = tostring(CmdletResultValue.ValidationRecipients)\\r\\n | extend IsValidated = tostring(CmdletResultValue.IsValidated)\\r\\n | extend LastValidationTimestamp = tostring(CmdletResultValue.LastValidationTimestamp)\\r\\n | extend Comment = tostring(CmdletResultValue.Comment)\\r\\n | extend WhenChanged = todatetime(WhenChanged)\\r\\n | extend WhenCreated = todatetime(WhenCreated)\\r\\n;\\r\\nlet i=0;\\r\\nlet allDataRange = \\r\\n ESIExchangeOnlineConfig_CL\\r\\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\\r\\n | where ESIEnvironment_s == _EnvList\\r\\n | where ExecutionResult_s <> \\\"EmptyResult\\\"\\r\\n | where Section_s == \\\"OutBoundC\\\"\\r\\n | extend CmdletResultValue = parse_json(rawData_s)\\r\\n | project TimeGenerated,CmdletResultValue,WhenChanged = todatetime(WhenChanged_t), WhenCreated=todatetime(WhenCreated_t)\\r\\n \\t| extend Identity = tostring(CmdletResultValue.Identity)\\r\\n\\t| extend State = tostring(CmdletResultValue.Enabled)\\r\\n | extend UseMXRecord = tostring(CmdletResultValue.UseMXRecord)\\r\\n\\t| extend ConnectorType = tostring(CmdletResultValue.ConnectorType)\\r\\n\\t| extend ConnectorSource = tostring(CmdletResultValue.ConnectorSource)\\r\\n\\t| extend RecipientDomains = tostring(CmdletResultValue.RecipientDomains)\\r\\n | extend SmartHosts = tostring(CmdletResultValue.SmartHosts)\\r\\n | extend TlsDomain = tostring(CmdletResultValue.TlsDomain)\\r\\n | extend TlsSettings = tostring(CmdletResultValue.TlsSettings)\\r\\n | extend IsTransportRuleScoped = tostring(CmdletResultValue.IsTransportRuleScoped)\\r\\n | extend RouteAllMessagesViaOnPremises = tostring(CmdletResultValue.RouteAllMessagesViaOnPremises)\\r\\n | extend CloudServicesMailEnabled = tostring(CmdletResultValue.CloudServicesMailEnabled)\\r\\n | extend AllAcceptedDomains = tostring(CmdletResultValue.AllAcceptedDomains)\\r\\n | extend SenderRewritingEnabled = tostring(CmdletResultValue.SenderRewritingEnabled)\\r\\n | extend TestMode = tostring(CmdletResultValue.TestMode)\\r\\n | extend LinkForModifiedConnector = tostring(CmdletResultValue.LinkForModifiedConnector)\\r\\n | extend ValidationRecipients = tostring(CmdletResultValue.ValidationRecipients)\\r\\n | extend IsValidated = tostring(CmdletResultValue.IsValidated)\\r\\n | extend LastValidationTimestamp = tostring(CmdletResultValue.LastValidationTimestamp)\\r\\n | extend Comment = tostring(CmdletResultValue.Comment)\\r\\n ;\\r\\nlet DiffAddDataP1 = allDataRange\\r\\n | join kind = rightanti (AfterData | where WhenCreated >=_DateCompareB) on WhenCreated\\r\\n;\\r\\nlet DiffAddDataP2 = allDataRange\\r\\n | join kind = innerunique (allDataRange ) on WhenCreated\\r\\n | where WhenCreated >=_DateCompareB\\r\\n | where bin(WhenCreated,5m)==bin(WhenChanged,5m)\\r\\n | distinct Identity,State,ConnectorType,ConnectorSource,UseMXRecord,RecipientDomains,SmartHosts,TlsDomain,TlsSettings,IsTransportRuleScoped,RouteAllMessagesViaOnPremises,CloudServicesMailEnabled,AllAcceptedDomains,SenderRewritingEnabled,TestMode,LinkForModifiedConnector,ValidationRecipients,IsValidated,LastValidationTimestamp,Comment,WhenCreated\\r\\n ;\\r\\nlet DiffAddData = union DiffAddDataP1,DiffAddDataP2\\r\\n| extend Actiontype =\\\"Add\\\";\\r\\nlet DiffRemoveData = allDataRange\\r\\n | join kind = leftanti AfterData on Identity\\r\\n | extend Actiontype =\\\"Remove\\\"\\r\\n | distinct Actiontype ,Identity,State,ConnectorType,ConnectorSource,UseMXRecord,RecipientDomains,SmartHosts,TlsDomain,TlsSettings,IsTransportRuleScoped,RouteAllMessagesViaOnPremises,CloudServicesMailEnabled,AllAcceptedDomains,SenderRewritingEnabled,TestMode,LinkForModifiedConnector,ValidationRecipients,IsValidated,LastValidationTimestamp,Comment,WhenCreated\\r\\n | project WhenChanged=_CurrentDateB,Actiontype,Identity,State,ConnectorType,ConnectorSource,UseMXRecord,RecipientDomains,SmartHosts,TlsDomain,TlsSettings,IsTransportRuleScoped,RouteAllMessagesViaOnPremises,CloudServicesMailEnabled,AllAcceptedDomains,SenderRewritingEnabled,TestMode,LinkForModifiedConnector,ValidationRecipients,IsValidated,LastValidationTimestamp,Comment,WhenCreated\\r\\n ;\\r\\nlet DiffModifData = union AfterData,allDataRange\\r\\n| sort by Identity,WhenChanged asc\\r\\n| project WhenChanged,Identity,State,ConnectorType,ConnectorSource,UseMXRecord,RecipientDomains,SmartHosts,TlsDomain,TlsSettings,IsTransportRuleScoped,RouteAllMessagesViaOnPremises,CloudServicesMailEnabled,AllAcceptedDomains,SenderRewritingEnabled,TestMode,LinkForModifiedConnector,ValidationRecipients,IsValidated,LastValidationTimestamp,Comment,WhenCreated\\r\\n| extend Identity = iff( Identity == prev(Identity) and Identity != prev(Identity) and prev(Identity) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", Identity, \\\" (\\\",prev(Identity),\\\"->\\\", Identity,\\\" )\\\"),Identity)\\r\\n| extend State = iff( Identity == prev(Identity) and State != prev(State) and prev(State) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", State, \\\" (\\\",prev(State),\\\"->\\\", State,\\\" )\\\"),State)\\r\\n| extend ConnectorType = iff( Identity == prev(Identity) and ConnectorType != prev(ConnectorType) and prev(ConnectorType) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", ConnectorType, \\\" (\\\",prev(ConnectorType),\\\"->\\\", ConnectorType,\\\" )\\\"),ConnectorType)\\r\\n| extend ConnectorSource = iff( Identity == prev(Identity) and ConnectorSource != prev(ConnectorSource) and prev(ConnectorSource) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", ConnectorSource, \\\" (\\\",prev(ConnectorSource),\\\"->\\\", ConnectorSource,\\\" )\\\"),ConnectorSource)\\r\\n| extend CloudServicesMailEnabled = iff( Identity == prev(Identity) and CloudServicesMailEnabled != prev(CloudServicesMailEnabled) and prev(CloudServicesMailEnabled) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", CloudServicesMailEnabled, \\\" (\\\",prev(CloudServicesMailEnabled),\\\"->\\\", CloudServicesMailEnabled,\\\" )\\\"),CloudServicesMailEnabled)\\r\\n| extend Comment = iff( Comment == prev(Comment) and Comment != prev(Comment) and prev(Comment) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", Comment, \\\" (\\\",prev(Comment),\\\"->\\\", Comment,\\\" )\\\"),Comment)\\r\\n| extend RecipientDomains = iff( Identity == prev(Identity) and RecipientDomains != prev(RecipientDomains) and prev(RecipientDomains) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", RecipientDomains, \\\" (\\\",prev(RecipientDomains),\\\"->\\\", RecipientDomains,\\\" )\\\"),RecipientDomains)\\r\\n| extend SmartHosts = iff( Identity == prev(Identity) and SmartHosts != prev(SmartHosts) and prev(SmartHosts) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", SmartHosts, \\\" (\\\",prev(SmartHosts),\\\"->\\\", SmartHosts,\\\" )\\\"),SmartHosts)\\r\\n| extend TlsDomain = iff( Identity == prev(Identity) and TlsDomain != prev(TlsDomain) and prev(TlsDomain) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", TlsDomain, \\\" (\\\",prev(TlsDomain),\\\"->\\\", TlsDomain,\\\" )\\\"),TlsDomain)\\r\\n| extend IsTransportRuleScoped = iff( Identity == prev(Identity) and IsTransportRuleScoped != prev(IsTransportRuleScoped) and prev(IsTransportRuleScoped) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", IsTransportRuleScoped, \\\" (\\\",prev(IsTransportRuleScoped),\\\"->\\\", IsTransportRuleScoped,\\\" )\\\"),IsTransportRuleScoped)\\r\\n| extend RouteAllMessagesViaOnPremises = iff( Identity == prev(Identity) and RouteAllMessagesViaOnPremises != prev(RouteAllMessagesViaOnPremises) and prev(RouteAllMessagesViaOnPremises) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", RouteAllMessagesViaOnPremises, \\\" (\\\",prev(RouteAllMessagesViaOnPremises),\\\"->\\\", RouteAllMessagesViaOnPremises,\\\" )\\\"),RouteAllMessagesViaOnPremises)\\r\\n| extend AllAcceptedDomains = iff( Identity == prev(Identity) and AllAcceptedDomains != prev(AllAcceptedDomains) and prev(AllAcceptedDomains) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", AllAcceptedDomains, \\\" (\\\",prev(AllAcceptedDomains),\\\"->\\\", AllAcceptedDomains,\\\" )\\\"),AllAcceptedDomains)\\r\\n| extend SenderRewritingEnabled = iff( Identity == prev(Identity) and SenderRewritingEnabled != prev(SenderRewritingEnabled) and prev(SenderRewritingEnabled) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", SenderRewritingEnabled, \\\" (\\\",prev(SenderRewritingEnabled),\\\"->\\\", SenderRewritingEnabled,\\\" )\\\"),SenderRewritingEnabled)\\r\\n| extend TestMode = iff( Identity == prev(Identity)and TestMode != prev(TestMode) and prev(TestMode) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", TestMode, \\\" (\\\",prev(TestMode),\\\"->\\\", TestMode,\\\" )\\\"),TestMode)\\r\\n| extend LinkForModifiedConnector = iff( Identity == prev(Identity) and LinkForModifiedConnector != prev(LinkForModifiedConnector) and prev(LinkForModifiedConnector) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", LinkForModifiedConnector, \\\" (\\\",prev(LinkForModifiedConnector),\\\"->\\\", LinkForModifiedConnector,\\\" )\\\"),LinkForModifiedConnector)\\r\\n| extend ValidationRecipients = iff( Identity == prev(Identity) and ValidationRecipients != prev(ValidationRecipients) and prev(ValidationRecipients) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", ValidationRecipients, \\\" (\\\",prev(ValidationRecipients),\\\"->\\\", ValidationRecipients,\\\" )\\\"),ValidationRecipients)\\r\\n| extend IsValidated = iff( Identity == prev(Identity) and IsValidated != prev(IsValidated) and prev(IsValidated) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", IsValidated, \\\" (\\\",prev(IsValidated),\\\"->\\\", IsValidated,\\\" )\\\"),IsValidated)\\r\\n| extend LastValidationTimestamp = iff( Identity == prev(Identity) and LastValidationTimestamp != prev(LastValidationTimestamp) and prev(LastValidationTimestamp) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", LastValidationTimestamp, \\\" (\\\",prev(LastValidationTimestamp),\\\"->\\\", LastValidationTimestamp,\\\" )\\\"),LastValidationTimestamp)\\r\\n| extend Comment = iff( Identity == prev(Identity) and Comment != prev(Comment) and prev(Comment) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", Comment, \\\" (\\\",prev(Comment),\\\"->\\\", Comment,\\\" )\\\"),Comment)\\r\\n| extend ActiontypeR =iff((Identity contains \\\"πŸ“\\\" or State contains \\\"πŸ“\\\" or ConnectorType contains \\\"πŸ“\\\" or ConnectorSource contains \\\"πŸ“\\\"or CloudServicesMailEnabled contains \\\"πŸ“\\\" or Comment contains \\\"πŸ“\\\" or UseMXRecord contains \\\"πŸ“\\\" or RecipientDomains contains \\\"πŸ“\\\" or SmartHosts contains \\\"πŸ“\\\" or TlsDomain contains \\\"πŸ“\\\" or TlsSettings contains \\\"πŸ“\\\" or IsTransportRuleScoped contains \\\"πŸ“\\\" or RouteAllMessagesViaOnPremises contains \\\"πŸ“\\\" or AllAcceptedDomains contains \\\"πŸ“\\\" or SenderRewritingEnabled contains \\\"πŸ“\\\" or TestMode contains \\\"πŸ“\\\" or LinkForModifiedConnector contains \\\"πŸ“\\\" or ValidationRecipients contains \\\"πŸ“\\\" or IsValidated contains \\\"πŸ“\\\" or LastValidationTimestamp contains \\\"πŸ“\\\" ), i=i + 1, i)\\r\\n| extend Actiontype =iff(ActiontypeR > 0, \\\"Modif\\\", \\\"NO\\\")\\r\\n| where ActiontypeR == 1\\r\\n| project WhenChanged,Actiontype,Identity,State,ConnectorType,ConnectorSource,UseMXRecord,RecipientDomains,SmartHosts,TlsDomain,TlsSettings,IsTransportRuleScoped,RouteAllMessagesViaOnPremises,CloudServicesMailEnabled,AllAcceptedDomains,SenderRewritingEnabled,TestMode,LinkForModifiedConnector,ValidationRecipients,IsValidated,LastValidationTimestamp,Comment,WhenCreated\\r\\n;\\r\\nunion DiffAddData, DiffRemoveData, DiffModifData\\r\\n| extend WhenChanged = iff (Actiontype == \\\"Modif\\\", WhenChanged, iff(Actiontype == \\\"Add\\\",WhenCreated, WhenChanged))\\r\\n| extend Actiontype = case(Actiontype == \\\"Add\\\", strcat(\\\"βž• \\\", Actiontype), Actiontype == \\\"Remove\\\", strcat(\\\"βž– \\\", Actiontype), Actiontype == \\\"Modif\\\", strcat(\\\"πŸ“ \\\", Actiontype), \\\"N/A\\\")\\r\\n| sort by WhenChanged desc \\r\\n| project\\r\\n WhenChanged,\\r\\n Actiontype,\\r\\n Identity,\\r\\n State,\\r\\n ConnectorType,\\r\\n ConnectorSource, \\r\\n CloudServicesMailEnabled,\\r\\n Comment,\\r\\n UseMXRecord,\\r\\n RecipientDomains,\\r\\n SmartHosts,\\r\\n TlsDomain,\\r\\n TlsSettings,\\r\\n IsTransportRuleScoped,\\r\\n RouteAllMessagesViaOnPremises,\\r\\n AllAcceptedDomains,\\r\\n SenderRewritingEnabled,\\r\\n TestMode,\\r\\n LinkForModifiedConnector,\\r\\n ValidationRecipients,\\r\\n IsValidated,\\r\\n LastValidationTimestamp,\\r\\n WhenCreated\",\"size\":3,\"showAnalytics\":true,\"title\":\"Display changes ( Add, Remove, modifications of parameters )\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Identity\"],\"expandTopLevel\":true}}},\"conditionalVisibility\":{\"parameterName\":\"Compare_Collect\",\"comparison\":\"isEqualTo\",\"value\":\"True\"},\"name\":\"query - 4\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Transport Rules with specific actions to monitor\",\"items\":[{\"type\":1,\"content\":{\"json\":\"A common way used by attackers to exfiltrate data is to set Transport Rules that send all or sensitive messages outside the organization or to a mailbox where they already have full control.\\r\\n\\r\\nThis section shows your Transport rules with sentitive actions that can lead to data leaks:\\r\\n- BlindCopyTo\\r\\n- SentTo\\r\\n- CopyTo\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"TransportRulesHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"TransportRule\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n| extend Identity = iif( CmdletResultValue.Identity contains \\\"OrgHierarchyToIgnore\\\",tostring(CmdletResultValue.Identity.Name),tostring(CmdletResultValue.Identity))\\r\\n| extend State = tostring(CmdletResultValue.State)\\r\\n| extend SentTo = tostring(CmdletResultValue.SentToString)\\r\\n| extend BlindCopyTo = tostring(CmdletResultValue.BlindCopyToString)\\r\\n| extend CopyTo = tostring(CmdletResultValue.CopyToString)\\r\\n| extend RedirectMessageTo = tostring(CmdletResultValue.RedirectMessageToString)\\r\\n| extend SetSCL = tostring(CmdletResultValue.SetSCL)\\r\\n| extend SenderIpRangesString = tostring(CmdletResultValue.SenderIpRangesString)\\r\\n| extend MessageTypeMatchesString = tostring(CmdletResultValue.MessageTypeMatchesString)\\r\\n| extend Mode = tostring(CmdletResultValue.Mode)\\r\\n| project-away CmdletResultValue\\r\\n| sort by Identity asc\",\"size\":1,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"Transport Rules actions to monitor\"},{\"type\":1,\"content\":{\"json\":\"** Due to lack of informaiton in Powershell, the Transport Rule compare section could display approximate information for Add and Modif. Especially, for the WhenCreated parameter.\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let _EnvList ={EnvironmentList};\\r\\nlet _TypeEnv = \\\"Online\\\";\\r\\nlet _DateCompare = \\\"{DateCompare:value}\\\";\\r\\nlet _CurrentDate = \\\"{DateOfConfiguration:value}\\\";\\r\\nlet _DateCompareB = todatetime(_DateCompare);\\r\\nlet _currD = (ExchangeConfiguration(SpecificSectionList=\\\"TransportRule\\\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n| summarize TimeMax = arg_max(TimeGenerated,*)\\r\\n| extend TimeMax = tostring(split(TimeMax,\\\"T\\\")[0])\\r\\n| project TimeMax);\\r\\nlet _CurrentDateB = todatetime(toscalar(_currD));\\r\\nlet BeforeData = ExchangeConfiguration(SpecificSectionList=\\\"TransportRule\\\",SpecificConfigurationDate=_DateCompareB,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n | extend Identity = tostring(CmdletResultValue.Identity)\\r\\n\\t| extend SentTo = tostring(CmdletResultValue.SentToString)\\r\\n\\t| extend BlindCopyTo = tostring(CmdletResultValue.BlindCopyToString)\\r\\n\\t| extend CopyTo = tostring(CmdletResultValue.CopyToString)\\r\\n\\t| extend RedirectMessageTo = tostring(CmdletResultValue.RedirectMessageToString)\\r\\n\\t| extend Mode = tostring(CmdletResultValue.Mode)\\r\\n | extend SetSCL = tostring(CmdletResultValue.SetSCL)\\r\\n | extend SenderIpRangesString = tostring(CmdletResultValue.SenderIpRangesString)\\r\\n | extend MessageTypeMatchesString = tostring(CmdletResultValue.MessageTypeMatchesString)\\r\\n | extend CmdletResultValue.RedirectMessageToString\\r\\n\\t| extend WhenChanged = todatetime(WhenChanged)\\r\\n | extend WhenCreated = todatetime(WhenCreated)\\r\\n;\\r\\nlet AfterData = \\r\\n ExchangeConfiguration(SpecificSectionList=\\\"TransportRule\\\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n | extend Identity = tostring(CmdletResultValue.Identity)\\r\\n\\t| extend SentTo = tostring(CmdletResultValue.SentToString)\\r\\n\\t| extend BlindCopyTo = tostring(CmdletResultValue.BlindCopyToString)\\r\\n\\t| extend CopyTo = tostring(CmdletResultValue.CopyToString)\\r\\n\\t| extend RedirectMessageTo = tostring(CmdletResultValue.RedirectMessageToString)\\r\\n\\t| extend Mode = tostring(CmdletResultValue.Mode)\\r\\n | extend SetSCL = tostring(CmdletResultValue.SetSCL)\\r\\n | extend SenderIpRangesString = tostring(CmdletResultValue.SenderIpRangesString)\\r\\n | extend MessageTypeMatchesString = tostring(CmdletResultValue.MessageTypeMatchesString)\\r\\n\\t| extend WhenChanged = todatetime(WhenChanged)\\r\\n | extend WhenCreated = todatetime(WhenCreated)\\r\\n;\\r\\nlet i=0;\\r\\nlet allDataRange =\\r\\n ESIExchangeOnlineConfig_CL\\r\\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\\r\\n | where ESIEnvironment_s == _EnvList\\r\\n | where ExecutionResult_s <> \\\"EmptyResult\\\"\\r\\n | where Section_s == \\\"TransportRule\\\"\\r\\n | extend CmdletResultValue = parse_json(rawData_s)\\r\\n | project TimeGenerated,CmdletResultValue,WhenChanged = todatetime(WhenChanged_t), WhenCreated=todatetime(WhenCreated_t)\\r\\n | extend Identity = tostring(CmdletResultValue.Identity)\\r\\n\\t| sort by Identity,TimeGenerated asc\\r\\n | extend SentTo = tostring(CmdletResultValue.SentToString)\\r\\n\\t| extend BlindCopyTo = tostring(CmdletResultValue.BlindCopyToString)\\r\\n\\t| extend CopyTo = tostring(CmdletResultValue.CopyToString)\\r\\n\\t| extend RedirectMessageTo = tostring(CmdletResultValue.RedirectMessageToString)\\r\\n\\t| extend Mode = tostring(CmdletResultValue.Mode)\\r\\n | extend CmdletResultValue.RedirectMessageToString\\r\\n | extend SetSCL = tostring(CmdletResultValue.SetSCL)\\r\\n | extend SenderIpRangesString = tostring(CmdletResultValue.SenderIpRangesString)\\r\\n | extend MessageTypeMatchesString = tostring(CmdletResultValue.MessageTypeMatchesString)\\r\\n | extend WhenChanged = todatetime(bin(WhenChanged,1m))\\r\\n | extend aa=prev(WhenCreated)\\r\\n | extend WhenCreated = iff( Identity == prev(Identity) and WhenChanged != prev(WhenChanged),aa ,WhenChanged)\\r\\n | extend WhenCreated =bin(WhenCreated,1m)\\r\\n ;\\r\\nlet DiffAddDataP1 = allDataRange\\r\\n | join kind = rightanti (AfterData | where WhenCreated >=_DateCompareB) on WhenCreated\\r\\n;\\r\\nlet DiffAddDataP2 = allDataRange\\r\\n | join kind = inner (allDataRange ) on WhenCreated\\r\\n | where WhenCreated >=_DateCompareB\\r\\n | where bin(WhenCreated,5m)==bin(WhenChanged,5m)\\r\\n | distinct Identity,SentTo,BlindCopyTo,CopyTo,RedirectMessageTo,Mode,SetSCL,SenderIpRangesString,MessageTypeMatchesString,WhenChanged,WhenCreated\\r\\n ;\\r\\nlet DiffAddData1 = union DiffAddDataP1,DiffAddDataP2\\r\\n| extend Actiontype =\\\"Add\\\";\\r\\nlet DiffAddData2 = union DiffAddDataP1,DiffAddDataP2\\r\\n| extend Actiontype =\\\"Add\\\"\\r\\n| distinct Identity;\\r\\nlet DiffAddData = DiffAddData1\\r\\n| join DiffAddData2 on Identity\\r\\n;\\r\\nlet DiffRemoveData = allDataRange\\r\\n | join kind = leftanti AfterData on Identity\\r\\n | extend Actiontype =\\\"Remove\\\"\\r\\n | distinct Actiontype ,Identity,SentTo,BlindCopyTo,CopyTo,RedirectMessageTo,SetSCL,SenderIpRangesString,MessageTypeMatchesString,Mode,WhenChanged,WhenCreated\\r\\n | project WhenChanged=_CurrentDateB,Actiontype,Identity,SentTo,BlindCopyTo,CopyTo,RedirectMessageTo,SetSCL,SenderIpRangesString,MessageTypeMatchesString,Mode,WhenCreated\\r\\n ;\\r\\nlet DiffModifData = union AfterData,allDataRange\\r\\n| sort by Identity,WhenChanged asc\\r\\n| project WhenChanged,Identity,SentTo,BlindCopyTo,CopyTo,RedirectMessageTo, SetSCL, SenderIpRangesString,MessageTypeMatchesString,Mode,WhenCreated\\r\\n| extend Identity = iff( Identity == prev(Identity) and Identity != prev(Identity) and prev(Identity) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", Identity, \\\" (\\\",prev(Identity),\\\"->\\\", Identity,\\\" )\\\"),Identity)\\r\\n| extend SentTo = iff( Identity == prev(Identity) and SentTo != prev(SentTo) and prev(SentTo) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", SentTo, \\\" (\\\",prev(SentTo),\\\"->\\\", SentTo,\\\" )\\\"),SentTo)\\r\\n| extend BlindCopyTo = iff( Identity == prev(Identity) and BlindCopyTo != prev(BlindCopyTo) and prev(BlindCopyTo) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", BlindCopyTo, \\\" (\\\",prev(BlindCopyTo),\\\"->\\\", BlindCopyTo,\\\" )\\\"),BlindCopyTo)\\r\\n| extend CopyTo = iff( Identity == prev(Identity) and CopyTo != prev(CopyTo) and prev(CopyTo) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", CopyTo, \\\" (\\\",prev(CopyTo),\\\"->\\\", CopyTo,\\\" )\\\"),CopyTo)\\r\\n| extend SetSCL = iff( Identity == prev(Identity)and SetSCL != prev(SetSCL) and prev(SetSCL) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", SetSCL, \\\" (\\\",prev(SetSCL),\\\"->\\\", SetSCL,\\\" )\\\"),SetSCL)\\r\\n| extend SenderIpRangesString = iff( Identity == prev(Identity)and SenderIpRangesString != prev(SenderIpRangesString) and prev(SenderIpRangesString) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", SenderIpRangesString, \\\" (\\\",prev(SenderIpRangesString),\\\"->\\\", SenderIpRangesString,\\\" )\\\"),SenderIpRangesString)\\r\\n| extend MessageTypeMatchesString = iff( Identity == prev(Identity)and MessageTypeMatchesString != prev(MessageTypeMatchesString) and prev(MessageTypeMatchesString) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", MessageTypeMatchesString, \\\" (\\\",prev(MessageTypeMatchesString),\\\"->\\\", MessageTypeMatchesString,\\\" )\\\"),MessageTypeMatchesString)\\r\\n| extend Mode = iff( Identity == prev(Identity)and Mode != prev(Mode) and prev(Mode) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", Mode, \\\" (\\\",prev(Mode),\\\"->\\\", Mode,\\\" )\\\"),Mode)\\r\\n| extend ActiontypeR =iff((Identity contains \\\"πŸ“\\\" or SentTo contains \\\"πŸ“\\\" or BlindCopyTo contains \\\"πŸ“\\\" or CopyTo contains \\\"πŸ“\\\" or SetSCL contains \\\"πŸ“\\\" or SenderIpRangesString contains \\\"πŸ“\\\" or MessageTypeMatchesString contains \\\"πŸ“\\\" or Mode contains \\\"πŸ“\\\" ), i=i + 1, i)\\r\\n| extend Actiontype =iff(ActiontypeR > 0, \\\"Modif\\\", \\\"NO\\\")\\r\\n| where ActiontypeR == 1\\r\\n| project WhenChanged,Actiontype,Identity,SentTo,BlindCopyTo,CopyTo,RedirectMessageTo,SetSCL,SenderIpRangesString,MessageTypeMatchesString,Mode,WhenCreated\\r\\n;\\r\\nunion DiffAddData, DiffRemoveData, DiffModifData\\r\\n| extend WhenChanged = iff (Actiontype == \\\"Modif\\\", WhenChanged, iff(Actiontype == \\\"Add\\\",WhenCreated, WhenChanged))\\r\\n| extend Actiontype = case(Actiontype == \\\"Add\\\", strcat(\\\"βž• \\\", Actiontype), Actiontype == \\\"Remove\\\", strcat(\\\"βž– \\\", Actiontype), Actiontype == \\\"Modif\\\", strcat(\\\"πŸ“ \\\", Actiontype), \\\"N/A\\\")\\r\\n| sort by WhenChanged desc \\r\\n| project\\r\\n WhenChanged,\\r\\n Actiontype,\\r\\n Identity,\\r\\n SentTo,\\r\\n BlindCopyTo,\\r\\n CopyTo,\\r\\n RedirectMessageTo,\\r\\n SetSCL,\\r\\n SenderIpRangesString,\\r\\n MessageTypeMatchesString,\\r\\n Mode,\\r\\n WhenCreated\",\"size\":3,\"showAnalytics\":true,\"title\":\"Display changes ( Add, Remove, modifications of parameters )\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Identity\"],\"expandTopLevel\":true}}},\"conditionalVisibility\":{\"parameterName\":\"Compare_Collect\",\"comparison\":\"isEqualTo\",\"value\":\"True\"},\"name\":\"query - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Outbound Policy : Autoforward configuration\",\"items\":[{\"type\":1,\"content\":{\"json\":\"If **AutoForwardEnabled** is enabled, then automatic transfer are allowed.\\r\\nFor example: users in Outlook will be able set automatic transfer of all their emails to external addresses.\\r\\nThere are several methods to authorized automatic forward. \\r\\nPlease review this article : https://learn.microsoft.com/microsoft-365/security/office-365-security/outbound-spam-policies-external-email-forwarding?view=o365-worldwide\\r\\n**In summary :**\\r\\n\\r\\n**Scenario 1 :**\\r\\n\\r\\nYou configure remote domain settings to allow automatic forwarding.\\r\\nAutomatic forwarding in the outbound spam filter policy is set to Off.\\r\\n*Result :* \\r\\nAutomatically forwarded messages to recipients in the affected domains are blocked.\\r\\n\\r\\n**Scenario 2 :**\\r\\n\\r\\nYou configure remote domain settings to allow automatic forwarding.\\r\\nAutomatic forwarding in the outbound spam filter policy is set to Automatic - System-controlled.\\r\\n\\r\\n*Result :* \\r\\n\\r\\nAutomatically forwarded messages to recipients in the affected domains are blocked.\\r\\nAs described earlier, Automatic - System-controlled used to mean On, but the setting has changed over time to mean Off in all organizations.\\r\\n\\r\\nFor absolute clarity, you should configure your outbound spam filter policy to On or Off.\\r\\n\\r\\n**Scenario 3 :**\\r\\n\\r\\nAutomatic forwarding in the outbound spam filter policy is set to On\\r\\nYou use mail flow rules or remote domains to block automatically forwarded email\\r\\n\\r\\n*Result : *\\r\\n\\r\\nAutomatically forwarded messages to affected recipients are blocked by mail flow rules or remote domains.\\r\\n****\\r\\nAlso, when setting AutoForwardEnabled to a specific domain, it is strongly recommended enable TLS encryption.\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"AutoForwardHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let HOSFR = ExchangeConfiguration(SpecificSectionList=\\\"HostedOutboundSpamFilterRule\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend HostedOutboundSpamFilterPolicy = tostring(CmdletResultValue.HostedOutboundSpamFilterPolicy)\\r\\n| project Identity,HostedOutboundSpamFilterPolicy;\\r\\nExchangeConfiguration(SpecificSectionList=\\\"HostedOutboundSpamFilterPolicy\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend Identity = tostring(CmdletResultValue.Identity)\\r\\n| join kind = fullouter HOSFR on $left.Identity == $right.HostedOutboundSpamFilterPolicy\\r\\n| extend OutboundSpamFilterRule = tostring(Identity1)\\r\\n| extend IsDefault= tostring(CmdletResultValue.IsDefault)\\r\\n| extend Enabled= tostring(CmdletResultValue.Enabled)\\r\\n| extend AutoForwardingMode= iff (CmdletResultValue.AutoForwardingMode == \\\"On\\\" , strcat (\\\"❌ \\\", tostring(CmdletResultValue.AutoForwardingMode)), tostring(CmdletResultValue.AutoForwardingMode))\\r\\n| extend RecommendedPolicyType= tostring(CmdletResultValue.RecommendedPolicyType)\\r\\n| extend RecipientLimitExternalPerHour = tostring(CmdletResultValue.RecipientLimitExternalPerHour)\\r\\n| extend RecipientLimitInternalPerHour = tostring(CmdletResultValue.RecipientLimitInternalPerHour)\\r\\n| extend RecipientLimitPerDay= tostring(CmdletResultValue.RecipientLimitPerDay)\\r\\n| extend ActionWhenThresholdReached = tostring(CmdletResultValue.ActionWhenThresholdReached)\\r\\n| extend BccSuspiciousOutboundAdditionalRecipients= tostring(CmdletResultValue.BccSuspiciousOutboundAdditionalRecipients)\\r\\n| extend BccSuspiciousOutboundMail = tostring(CmdletResultValue.BccSuspiciousOutboundMail)\\r\\n| extend NotifyOutboundSpam= tostring(CmdletResultValue.NotifyOutboundSpam)\\r\\n| extend NotifyOutboundSpamRecipient = tostring(CmdletResultValue.NotifyOutboundSpamRecipient)\\r\\n| project Identity,IsDefault,Enabled,AutoForwardingMode,OutboundSpamFilterRule,BccSuspiciousOutboundAdditionalRecipients,BccSuspiciousOutboundMail,NotifyOutboundSpam,NotifyOutboundSpamRecipient,WhenChanged,WhenCreated\\r\\n| sort by Identity asc \",\"size\":1,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"OutboundPol - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let _EnvList ={EnvironmentList};\\r\\nlet _TypeEnv = \\\"Online\\\";\\r\\nlet _DateCompare = \\\"{DateCompare:value}\\\";\\r\\nlet _CurrentDate = \\\"{DateOfConfiguration:value}\\\";\\r\\nlet _DateCompareB = todatetime(_DateCompare);\\r\\nlet _currD = (ExchangeConfiguration(SpecificSectionList=\\\"HostedOutboundSpamFilterPolicy\\\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n| summarize TimeMax = arg_max(TimeGenerated,*)\\r\\n| extend TimeMax = tostring(split(TimeMax,\\\"T\\\")[0])\\r\\n| project TimeMax);\\r\\nlet _CurrentDateB = todatetime(toscalar(_currD));\\r\\nlet HOSFR = ExchangeConfiguration(SpecificSectionList=\\\"HostedOutboundSpamFilterRule\\\", SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| extend HostedOutboundSpamFilterPolicy = tostring(CmdletResultValue.HostedOutboundSpamFilterPolicy)\\r\\n| project Identity,HostedOutboundSpamFilterPolicy;\\r\\nlet BeforeData = ExchangeConfiguration(SpecificSectionList=\\\"HostedOutboundSpamFilterPolicy\\\", SpecificConfigurationDate=_DateCompareB, SpecificConfigurationEnv=_EnvList, Target = _TypeEnv)\\r\\n | extend Identity = tostring(Identity)\\r\\n | join kind = fullouter HOSFR on $left.Identity == $right.HostedOutboundSpamFilterPolicy\\r\\n | extend OutboundSpamFilterRule = tostring(Identity1)\\r\\n | extend IsDefault= tostring(CmdletResultValue.IsDefault)\\r\\n | extend Enabled= tostring(CmdletResultValue.Enabled)\\r\\n | extend AutoForwardingMode= tostring(CmdletResultValue.AutoForwardingMode)\\r\\n | extend RecommendedPolicyType= tostring(CmdletResultValue.RecommendedPolicyType)\\r\\n | extend RecipientLimitExternalPerHour = tostring(CmdletResultValue.RecipientLimitExternalPerHour)\\r\\n | extend RecipientLimitInternalPerHour = tostring(CmdletResultValue.RecipientLimitInternalPerHour)\\r\\n | extend RecipientLimitPerDay= tostring(CmdletResultValue.RecipientLimitPerDay)\\r\\n | extend ActionWhenThresholdReached = tostring(CmdletResultValue.ActionWhenThresholdReached)\\r\\n | extend BccSuspiciousOutboundAdditionalRecipients= tostring(CmdletResultValue.BccSuspiciousOutboundAdditionalRecipients)\\r\\n | extend BccSuspiciousOutboundMail = tostring(CmdletResultValue.BccSuspiciousOutboundMail)\\r\\n | extend NotifyOutboundSpam= tostring(CmdletResultValue.NotifyOutboundSpam)\\r\\n | extend NotifyOutboundSpamRecipient = tostring(CmdletResultValue.NotifyOutboundSpamRecipient)\\r\\n | extend WhenChanged = todatetime(WhenChanged)\\r\\n | extend WhenCreated = todatetime(WhenCreated)\\r\\n;\\r\\nlet AfterData = \\r\\n ExchangeConfiguration(SpecificSectionList=\\\"HostedOutboundSpamFilterPolicy\\\", SpecificConfigurationDate=_CurrentDate, SpecificConfigurationEnv=_EnvList, Target = _TypeEnv)\\r\\n | extend Identity = tostring(Identity)\\r\\n | join kind = fullouter HOSFR on $left.Identity == $right.HostedOutboundSpamFilterPolicy\\r\\n | extend OutboundSpamFilterRule = tostring(Identity1)\\r\\n | extend IsDefault= tostring(CmdletResultValue.IsDefault)\\r\\n | extend Enabled= tostring(CmdletResultValue.Enabled)\\r\\n | extend AutoForwardingMode= tostring(CmdletResultValue.AutoForwardingMode)\\r\\n | extend RecommendedPolicyType= tostring(CmdletResultValue.RecommendedPolicyType)\\r\\n | extend RecipientLimitExternalPerHour = tostring(CmdletResultValue.RecipientLimitExternalPerHour)\\r\\n | extend RecipientLimitInternalPerHour = tostring(CmdletResultValue.RecipientLimitInternalPerHour)\\r\\n | extend RecipientLimitPerDay= tostring(CmdletResultValue.RecipientLimitPerDay)\\r\\n | extend ActionWhenThresholdReached = tostring(CmdletResultValue.ActionWhenThresholdReached)\\r\\n | extend BccSuspiciousOutboundAdditionalRecipients= tostring(CmdletResultValue.BccSuspiciousOutboundAdditionalRecipients)\\r\\n | extend BccSuspiciousOutboundMail = tostring(CmdletResultValue.BccSuspiciousOutboundMail)\\r\\n | extend NotifyOutboundSpam= tostring(CmdletResultValue.NotifyOutboundSpam)\\r\\n | extend NotifyOutboundSpamRecipient = tostring(CmdletResultValue.NotifyOutboundSpamRecipient)\\r\\n | extend WhenChanged = todatetime(WhenChanged)\\r\\n | extend WhenCreated = todatetime(WhenCreated)\\r\\n;\\r\\nlet i=0;\\r\\nlet allDataRangeOSFR = ESIExchangeOnlineConfig_CL\\r\\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\\r\\n | where ESIEnvironment_s == _EnvList\\r\\n | where ExecutionResult_s <> \\\"EmptyResult\\\"\\r\\n | where Section_s == \\\"HostedOutboundSpamFilterRule\\\"\\r\\n | extend CmdletResultValue = parse_json(rawData_s)\\r\\n | extend Identity = tostring(CmdletResultValue.Identity)\\r\\n | extend HostedOutboundSpamFilterPolicy = tostring(CmdletResultValue.HostedOutboundSpamFilterPolicy)\\r\\n | project Identity, HostedOutboundSpamFilterPolicy;\\r\\nlet allDataRange = \\r\\n ESIExchangeOnlineConfig_CL\\r\\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\\r\\n | where ESIEnvironment_s == _EnvList\\r\\n | where ExecutionResult_s <> \\\"EmptyResult\\\"\\r\\n | where Section_s == \\\"HostedOutboundSpamFilterPolicy\\\"\\r\\n | extend CmdletResultValue = parse_json(rawData_s)\\r\\n | extend Identity = tostring(CmdletResultValue.Identity)\\r\\n | project\\r\\n TimeGenerated,\\r\\n Identity,\\r\\n CmdletResultValue,\\r\\n WhenChanged = todatetime(bin(WhenChanged_t,1m)),\\r\\n WhenCreated=todatetime(bin(WhenCreated_t,1m))\\r\\n | join kind=fullouter allDataRangeOSFR on $left.Identity == $right.HostedOutboundSpamFilterPolicy\\r\\n | extend OutboundSpamFilterRule = tostring(Identity1)\\r\\n | extend IsDefault= tostring(CmdletResultValue.IsDefault)\\r\\n | extend Enabled= tostring(CmdletResultValue.Enabled)\\r\\n | extend AutoForwardingMode= tostring(CmdletResultValue.AutoForwardingMode)\\r\\n | extend RecommendedPolicyType= tostring(CmdletResultValue.RecommendedPolicyType)\\r\\n | extend RecipientLimitExternalPerHour = tostring(CmdletResultValue.RecipientLimitExternalPerHour)\\r\\n | extend RecipientLimitInternalPerHour = tostring(CmdletResultValue.RecipientLimitInternalPerHour)\\r\\n | extend RecipientLimitPerDay= tostring(CmdletResultValue.RecipientLimitPerDay)\\r\\n | extend ActionWhenThresholdReached = tostring(CmdletResultValue.ActionWhenThresholdReached)\\r\\n | extend BccSuspiciousOutboundAdditionalRecipients= tostring(CmdletResultValue.BccSuspiciousOutboundAdditionalRecipients)\\r\\n | extend BccSuspiciousOutboundMail = tostring(CmdletResultValue.BccSuspiciousOutboundMail)\\r\\n | extend NotifyOutboundSpam= tostring(CmdletResultValue.NotifyOutboundSpam)\\r\\n | extend NotifyOutboundSpamRecipient = tostring(CmdletResultValue.NotifyOutboundSpamRecipient)\\r\\n | distinct\\r\\n WhenChanged,\\r\\n Identity,\\r\\n IsDefault,\\r\\n Enabled,\\r\\n AutoForwardingMode,\\r\\n OutboundSpamFilterRule,\\r\\n RecommendedPolicyType,\\r\\n RecipientLimitExternalPerHour,\\r\\n RecipientLimitInternalPerHour,\\r\\n ActionWhenThresholdReached,\\r\\n RecipientLimitPerDay,\\r\\n BccSuspiciousOutboundAdditionalRecipients,\\r\\n BccSuspiciousOutboundMail,\\r\\n NotifyOutboundSpam,\\r\\n NotifyOutboundSpamRecipient,\\r\\n WhenCreated \\r\\n;\\r\\nlet DiffAddDataP1 = allDataRange\\r\\n | join kind = rightanti (AfterData\\r\\n | where WhenCreated >= _DateCompareB)\\r\\n on WhenCreated\\r\\n;\\r\\nlet DiffAddDataP2 = allDataRange\\r\\n | join kind = innerunique (allDataRange) on WhenCreated\\r\\n | where WhenCreated >= _DateCompareB\\r\\n | where bin(WhenCreated, 5m) == bin(WhenChanged, 5m)\\r\\n | distinct\\r\\n Identity,\\r\\n IsDefault,\\r\\n Enabled,\\r\\n AutoForwardingMode,\\r\\n OutboundSpamFilterRule,\\r\\n RecommendedPolicyType,\\r\\n RecipientLimitExternalPerHour,\\r\\n RecipientLimitInternalPerHour,\\r\\n ActionWhenThresholdReached,\\r\\n RecipientLimitPerDay,\\r\\n BccSuspiciousOutboundAdditionalRecipients,\\r\\n BccSuspiciousOutboundMail,\\r\\n NotifyOutboundSpam,\\r\\n NotifyOutboundSpamRecipient,\\r\\n WhenCreated \\r\\n;\\r\\nlet DiffAddData = union DiffAddDataP1, DiffAddDataP2\\r\\n | extend Actiontype =\\\"Add\\\";\\r\\nlet DiffRemoveData = allDataRange\\r\\n | join kind = leftanti AfterData on Identity\\r\\n | extend Actiontype =\\\"Remove\\\"\\r\\n | distinct\\r\\n Actiontype,\\r\\n Identity,\\r\\n IsDefault,\\r\\n Enabled,\\r\\n AutoForwardingMode,\\r\\n OutboundSpamFilterRule,\\r\\n RecommendedPolicyType,\\r\\n RecipientLimitExternalPerHour,\\r\\n RecipientLimitInternalPerHour,\\r\\n ActionWhenThresholdReached,\\r\\n RecipientLimitPerDay,\\r\\n BccSuspiciousOutboundAdditionalRecipients,\\r\\n BccSuspiciousOutboundMail,\\r\\n NotifyOutboundSpam,\\r\\n NotifyOutboundSpamRecipient,\\r\\n WhenCreated \\r\\n | project\\r\\n WhenChanged=_CurrentDateB,\\r\\n Actiontype,\\r\\n Identity,\\r\\n IsDefault,\\r\\n Enabled,\\r\\n AutoForwardingMode,\\r\\n OutboundSpamFilterRule,\\r\\n RecommendedPolicyType,\\r\\n RecipientLimitExternalPerHour,\\r\\n RecipientLimitInternalPerHour,\\r\\n ActionWhenThresholdReached,\\r\\n RecipientLimitPerDay,\\r\\n BccSuspiciousOutboundAdditionalRecipients,\\r\\n BccSuspiciousOutboundMail,\\r\\n NotifyOutboundSpam,\\r\\n NotifyOutboundSpamRecipient,\\r\\n WhenCreated\\r\\n;\\r\\nlet DiffModifData = union AfterData, allDataRange\\r\\n | sort by Identity, WhenChanged asc\\r\\n | project\\r\\n WhenChanged,\\r\\n Identity,\\r\\n IsDefault,\\r\\n Enabled,\\r\\n AutoForwardingMode,\\r\\n OutboundSpamFilterRule,\\r\\n RecommendedPolicyType,\\r\\n RecipientLimitExternalPerHour,\\r\\n RecipientLimitInternalPerHour,\\r\\n ActionWhenThresholdReached,\\r\\n RecipientLimitPerDay,\\r\\n BccSuspiciousOutboundAdditionalRecipients,\\r\\n BccSuspiciousOutboundMail,\\r\\n NotifyOutboundSpam,\\r\\n NotifyOutboundSpamRecipient,\\r\\n WhenCreated \\r\\n | extend Identity = iff(Identity == prev(Identity) and Identity != prev(Identity) and prev(Identity) != \\\"\\\", strcat(\\\"πŸ“ \\\", Identity, \\\" (\\\", prev(Identity), \\\"->\\\", Identity, \\\" )\\\"), Identity)\\r\\n | extend IsDefault = iff(Identity == prev(Identity) and IsDefault != prev(IsDefault) and prev(IsDefault) != \\\"\\\", strcat(\\\"πŸ“ \\\", IsDefault, \\\" (\\\", prev(IsDefault), \\\"->\\\", IsDefault, \\\" )\\\"), IsDefault)\\r\\n | extend Enabled = iff(Identity == prev(Identity) and Enabled != prev(Enabled) and prev(Enabled) != \\\"\\\", strcat(\\\"πŸ“ \\\", Enabled, \\\" (\\\", prev(Enabled), \\\"->\\\", Enabled, \\\" )\\\"), Enabled)\\r\\n | extend AutoForwardingMode = iff(Identity == prev(Identity) and AutoForwardingMode != prev(AutoForwardingMode) and prev(AutoForwardingMode) != \\\"\\\", strcat(\\\"πŸ“ \\\", AutoForwardingMode, \\\" (\\\", prev(AutoForwardingMode), \\\"->\\\", AutoForwardingMode, \\\" )\\\"), AutoForwardingMode)\\r\\n | extend OutboundSpamFilterRule = iff(Identity == prev(Identity) and OutboundSpamFilterRule != prev(OutboundSpamFilterRule) and prev(OutboundSpamFilterRule) != \\\"\\\", strcat(\\\"πŸ“ \\\", OutboundSpamFilterRule, \\\" (\\\", prev(OutboundSpamFilterRule), \\\"->\\\", OutboundSpamFilterRule, \\\" )\\\"), OutboundSpamFilterRule)\\r\\n | extend RecommendedPolicyType = iff(Identity == prev(Identity) and RecommendedPolicyType != prev(RecommendedPolicyType) and prev(RecommendedPolicyType) != \\\"\\\", strcat(\\\"πŸ“ \\\", RecommendedPolicyType, \\\" (\\\", prev(RecommendedPolicyType), \\\"->\\\", RecommendedPolicyType, \\\" )\\\"), RecommendedPolicyType)\\r\\n | extend RecipientLimitExternalPerHour = iff(Identity == prev(Identity) and RecipientLimitExternalPerHour != prev(RecipientLimitExternalPerHour) and prev(RecipientLimitExternalPerHour) != \\\"\\\", strcat(\\\"πŸ“ \\\", RecipientLimitExternalPerHour, \\\" (\\\", prev(RecipientLimitExternalPerHour), \\\"->\\\", RecipientLimitExternalPerHour, \\\" )\\\"), RecipientLimitExternalPerHour)\\r\\n | extend RecipientLimitInternalPerHour = iff(Identity == prev(Identity) and RecipientLimitInternalPerHour != prev(RecipientLimitInternalPerHour) and prev(RecipientLimitInternalPerHour) != \\\"\\\", strcat(\\\"πŸ“ \\\", RecipientLimitInternalPerHour, \\\" (\\\", prev(RecipientLimitInternalPerHour), \\\"->\\\", RecipientLimitInternalPerHour, \\\" )\\\"), RecipientLimitInternalPerHour)\\r\\n | extend ActionWhenThresholdReached = iff(Identity == prev(Identity) and ActionWhenThresholdReached != prev(ActionWhenThresholdReached) and prev(ActionWhenThresholdReached) != \\\"\\\", strcat(\\\"πŸ“ \\\", ActionWhenThresholdReached, \\\" (\\\", prev(ActionWhenThresholdReached), \\\"->\\\", ActionWhenThresholdReached, \\\" )\\\"), ActionWhenThresholdReached)\\r\\n | extend RecipientLimitPerDay = iff(Identity == prev(Identity) and RecipientLimitPerDay != prev(RecipientLimitPerDay) and prev(RecipientLimitPerDay) != \\\"\\\", strcat(\\\"πŸ“ \\\", RecipientLimitPerDay, \\\" (\\\", prev(RecipientLimitPerDay), \\\"->\\\", RecipientLimitPerDay, \\\" )\\\"), RecipientLimitPerDay)\\r\\n | extend BccSuspiciousOutboundAdditionalRecipients = iff(Identity == prev(Identity) and BccSuspiciousOutboundAdditionalRecipients != prev(BccSuspiciousOutboundAdditionalRecipients) and prev(BccSuspiciousOutboundAdditionalRecipients) != \\\"\\\", strcat(\\\"πŸ“ \\\", BccSuspiciousOutboundAdditionalRecipients, \\\" (\\\", prev(BccSuspiciousOutboundAdditionalRecipients), \\\"->\\\", BccSuspiciousOutboundAdditionalRecipients, \\\" )\\\"), BccSuspiciousOutboundAdditionalRecipients)\\r\\n | extend BccSuspiciousOutboundMail = iff(Identity == prev(Identity) and BccSuspiciousOutboundMail != prev(BccSuspiciousOutboundMail) and prev(BccSuspiciousOutboundMail) != \\\"\\\", strcat(\\\"πŸ“ \\\", BccSuspiciousOutboundMail, \\\" (\\\", prev(BccSuspiciousOutboundMail), \\\"->\\\", BccSuspiciousOutboundMail, \\\" )\\\"), BccSuspiciousOutboundMail)\\r\\n | extend NotifyOutboundSpam = iff(Identity == prev(Identity) and NotifyOutboundSpam != prev(NotifyOutboundSpam) and prev(NotifyOutboundSpam) != \\\"\\\", strcat(\\\"πŸ“ \\\", NotifyOutboundSpam, \\\" (\\\", prev(NotifyOutboundSpam), \\\"->\\\", NotifyOutboundSpam, \\\" )\\\"), NotifyOutboundSpam)\\r\\n | extend NotifyOutboundSpamRecipient = iff(Identity == prev(Identity) and NotifyOutboundSpamRecipient != prev(NotifyOutboundSpamRecipient) and prev(NotifyOutboundSpamRecipient) != \\\"\\\", strcat(\\\"πŸ“ \\\", NotifyOutboundSpamRecipient, \\\" (\\\", prev(NotifyOutboundSpamRecipient), \\\"->\\\", NotifyOutboundSpamRecipient, \\\" )\\\"), NotifyOutboundSpamRecipient)\\r\\n | extend ActiontypeR =iff((Identity contains \\\"πŸ“\\\" or IsDefault contains \\\"πŸ“\\\" or Enabled contains \\\"πŸ“\\\" or OutboundSpamFilterRule contains \\\"πŸ“\\\" or AutoForwardingMode contains \\\"πŸ“\\\" or BccSuspiciousOutboundAdditionalRecipients contains \\\"πŸ“\\\" or BccSuspiciousOutboundMail contains \\\"πŸ“\\\" or NotifyOutboundSpam contains \\\"πŸ“\\\" or NotifyOutboundSpamRecipient contains \\\"πŸ“\\\"), i=i + 1, i)\\r\\n | extend Actiontype =iff(ActiontypeR > 0, \\\"Modif\\\", \\\"NO\\\")\\r\\n | where ActiontypeR == 1\\r\\n | distinct\\r\\n WhenChanged,\\r\\n Actiontype,\\r\\n Identity,\\r\\n IsDefault,\\r\\n Enabled,\\r\\n AutoForwardingMode,\\r\\n OutboundSpamFilterRule,\\r\\n RecommendedPolicyType,\\r\\n RecipientLimitExternalPerHour,\\r\\n RecipientLimitInternalPerHour,\\r\\n ActionWhenThresholdReached,\\r\\n RecipientLimitPerDay,\\r\\n BccSuspiciousOutboundAdditionalRecipients,\\r\\n BccSuspiciousOutboundMail,\\r\\n NotifyOutboundSpam,\\r\\n NotifyOutboundSpamRecipient,\\r\\n WhenCreated \\r\\n;\\r\\nunion DiffAddData, DiffRemoveData, DiffModifData\\r\\n| extend WhenChanged = iff (Actiontype == \\\"Modif\\\", WhenChanged, iff(Actiontype == \\\"Add\\\", WhenCreated, WhenChanged))\\r\\n| extend Actiontype = case(Actiontype == \\\"Add\\\", strcat(\\\"βž• \\\", Actiontype), Actiontype == \\\"Remove\\\", strcat(\\\"βž– \\\", Actiontype), Actiontype == \\\"Modif\\\", strcat(\\\"πŸ“ \\\", Actiontype), \\\"N/A\\\")\\r\\n| sort by WhenChanged desc \\r\\n| project\\r\\n WhenChanged,\\r\\n Actiontype,\\r\\n Identity,\\r\\n IsDefault,\\r\\n Enabled,\\r\\n AutoForwardingMode,\\r\\n OutboundSpamFilterRule,\\r\\n RecommendedPolicyType,\\r\\n RecipientLimitExternalPerHour,\\r\\n RecipientLimitInternalPerHour,\\r\\n ActionWhenThresholdReached,\\r\\n RecipientLimitPerDay,\\r\\n BccSuspiciousOutboundAdditionalRecipients,\\r\\n BccSuspiciousOutboundMail,\\r\\n NotifyOutboundSpam,\\r\\n NotifyOutboundSpamRecipient,\\r\\n WhenCreated \",\"size\":3,\"showAnalytics\":true,\"title\":\"Display changes ( Add, Remove, modifications of parameters )\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Identity\"],\"expandTopLevel\":true}}},\"conditionalVisibility\":{\"parameterName\":\"Compare_Collect\",\"comparison\":\"isEqualTo\",\"value\":\"True\"},\"name\":\"query - 7 - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Remote Domain Autofoward Configuration - * should not allow AutoForwardEnabled\",\"items\":[{\"type\":1,\"content\":{\"json\":\"If **AutoForwardEnabled** is set to True for an SMTP domain and the Outbound Policy is set to On then users in Outlook are allowed to set automatic transfer of all their emails to addresses in this domain.\\r\\n\\r\\nWhen the Default Remote domain is set to * and has the AutoForwardEnabled set True, any user can configure an Outlook rule to automatically forward all emails to any SMTP domain domains outside the organization. This is a high risk configuration as it might allow accounts to leak information. \\r\\n\\r\\nAlso, when setting AutoForwardEnabled to a specific domain, it is strongly recommended enable TLS encryption.\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"AutoForwardHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ExchangeConfiguration(SpecificSectionList=\\\"RemoteDomain\\\",SpecificConfigurationDate=\\\"{DateOfConfiguration:value}\\\",SpecificConfigurationEnv={EnvironmentList},Target = \\\"Online\\\")\\r\\n| project CmdletResultValue\\r\\n| extend Name = tostring(CmdletResultValue.Name)\\r\\n| extend Address = tostring(CmdletResultValue.DomainName)\\r\\n| extend AutoForwardEnabled = iff (CmdletResultValue.AutoForwardEnabled== \\\"true\\\" and CmdletResultValue.DomainName == \\\"*\\\", strcat (\\\"❌ \\\",tostring(CmdletResultValue.AutoForwardEnabled)),iff(CmdletResultValue.AutoForwardEnabled== \\\"true\\\" and CmdletResultValue.DomainName != \\\"*\\\", strcat (\\\"⚠️ \\\",tostring(CmdletResultValue.AutoForwardEnabled)),strcat (\\\"βœ… \\\",tostring(CmdletResultValue.AutoForwardEnabled))))\\r\\n| project-away CmdletResultValue\\r\\n| sort by Address asc \",\"size\":1,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 1\",\"styleSettings\":{\"showBorder\":true}}]},\"name\":\"ForwardGroup\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let _EnvList ={EnvironmentList};\\r\\nlet _TypeEnv = \\\"Online\\\";\\r\\nlet _DateCompare = \\\"{DateCompare:value}\\\";\\r\\nlet _CurrentDate = \\\"{DateOfConfiguration:value}\\\";\\r\\nlet _DateCompareB = todatetime(_DateCompare);\\r\\nlet _currD = (ExchangeConfiguration(SpecificSectionList=\\\"RemoteDomain\\\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n| summarize TimeMax = arg_max(TimeGenerated,*)\\r\\n| extend TimeMax = tostring(split(TimeMax,\\\"T\\\")[0])\\r\\n| project TimeMax);\\r\\nlet _CurrentDateB = todatetime(toscalar(_currD));\\r\\nlet BeforeData = ExchangeConfiguration(SpecificSectionList=\\\"RemoteDomain\\\",SpecificConfigurationDate=_DateCompareB,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n | extend Identity = tostring(CmdletResultValue.Name)\\r\\n\\t| extend DomainName = tostring(CmdletResultValue.DomainName)\\r\\n\\t| extend AutoForwardEnabled = tostring(CmdletResultValue.AutoForwardEnabled)\\r\\n\\t| extend WhenChanged = todatetime(WhenChanged)\\r\\n | extend WhenCreated = todatetime(WhenCreated)\\r\\n;\\r\\nlet AfterData = \\r\\n ExchangeConfiguration(SpecificSectionList=\\\"RemoteDomain\\\",SpecificConfigurationDate=_CurrentDate,SpecificConfigurationEnv=_EnvList,Target = _TypeEnv)\\r\\n \\t | extend Identity = tostring(CmdletResultValue.Name)\\r\\n\\t| extend DomainName = tostring(CmdletResultValue.DomainName)\\r\\n\\t| extend AutoForwardEnabled = tostring(CmdletResultValue.AutoForwardEnabled)\\r\\n | extend WhenChanged = todatetime(WhenChanged)\\r\\n | extend WhenCreated = todatetime(WhenCreated)\\r\\n;\\r\\nlet i=0;\\r\\nlet allDataRange = \\r\\n ESIExchangeOnlineConfig_CL\\r\\n | where TimeGenerated between (_DateCompareB .. _CurrentDateB)\\r\\n | where ESIEnvironment_s == _EnvList\\r\\n | where ExecutionResult_s <> \\\"EmptyResult\\\"\\r\\n | where Section_s == \\\"RemoteDomain\\\"\\r\\n | extend CmdletResultValue = parse_json(rawData_s)\\r\\n | project TimeGenerated,CmdletResultValue,WhenChanged = todatetime(WhenChanged_t), WhenCreated=todatetime(WhenCreated_t)\\r\\n | extend Identity = tostring(CmdletResultValue.Name)\\r\\n\\t| extend DomainName = tostring(CmdletResultValue.DomainName)\\r\\n\\t| extend AutoForwardEnabled = tostring(CmdletResultValue.AutoForwardEnabled)\\r\\n ;\\r\\nlet DiffAddDataP1 = allDataRange\\r\\n | join kind = rightanti (AfterData | where WhenCreated >=_DateCompareB) on WhenCreated\\r\\n;\\r\\nlet DiffAddDataP2 = allDataRange\\r\\n | join kind = innerunique (allDataRange ) on WhenCreated\\r\\n | where WhenCreated >=_DateCompareB\\r\\n | where bin(WhenCreated,5m)==bin(WhenChanged,5m)\\r\\n | distinct Identity,DomainName,AutoForwardEnabled,WhenChanged,WhenCreated\\r\\n ;\\r\\nlet DiffAddData = union DiffAddDataP1,DiffAddDataP2\\r\\n| extend Actiontype =\\\"Add\\\";\\r\\nlet DiffRemoveData = allDataRange\\r\\n | join kind = leftanti AfterData on Identity\\r\\n | extend Actiontype =\\\"Remove\\\"\\r\\n | distinct Actiontype ,Identity,DomainName,AutoForwardEnabled,WhenCreated\\r\\n | project WhenChanged=_CurrentDateB,Actiontype,Identity,DomainName,AutoForwardEnabled,WhenCreated\\r\\n ;\\r\\nlet DiffModifData = union AfterData,allDataRange\\r\\n| sort by Identity,WhenChanged asc\\r\\n| project WhenChanged,Identity,DomainName,AutoForwardEnabled,WhenCreated\\r\\n| extend Identity = iff( Identity == prev(Identity) and Identity != prev(Identity) and prev(Identity) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", Identity, \\\" (\\\",prev(Identity),\\\"->\\\", Identity,\\\" )\\\"),Identity)\\r\\n| extend DomainName = iff( Identity == prev(Identity) and DomainName != prev(DomainName) and prev(DomainName) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", DomainName, \\\" (\\\",prev(DomainName),\\\"->\\\", DomainName,\\\" )\\\"),DomainName)\\r\\n| extend AutoForwardEnabled = iff( Identity == prev(Identity) and AutoForwardEnabled != prev(AutoForwardEnabled) and prev(AutoForwardEnabled) !=\\\"\\\" , strcat(\\\"πŸ“ \\\", AutoForwardEnabled, \\\" (\\\",prev(AutoForwardEnabled),\\\"->\\\", AutoForwardEnabled,\\\" )\\\"),AutoForwardEnabled)\\r\\n| extend ActiontypeR =iff((Identity contains \\\"πŸ“\\\" or DomainName contains \\\"πŸ“\\\" or AutoForwardEnabled contains \\\"πŸ“\\\" ), i=i + 1, i)\\r\\n| extend Actiontype =iff(ActiontypeR > 0, \\\"Modif\\\", \\\"NO\\\")\\r\\n| where ActiontypeR == 1\\r\\n| project WhenChanged,Actiontype,Identity,DomainName,AutoForwardEnabled,WhenCreated\\r\\n;\\r\\nunion DiffAddData, DiffRemoveData, DiffModifData\\r\\n| extend WhenChanged = iff (Actiontype == \\\"Modif\\\", WhenChanged, iff(Actiontype == \\\"Add\\\",WhenCreated, WhenChanged))\\r\\n| extend Actiontype = case(Actiontype == \\\"Add\\\", strcat(\\\"βž• \\\", Actiontype), Actiontype == \\\"Remove\\\", strcat(\\\"βž– \\\", Actiontype), Actiontype == \\\"Modif\\\", strcat(\\\"πŸ“ \\\", Actiontype), \\\"N/A\\\")\\r\\n| sort by WhenChanged desc \\r\\n| project\\r\\n WhenChanged,\\r\\n Actiontype,\\r\\n Identity,\\r\\n DomainName,\\r\\n AutoForwardEnabled,\\r\\n WhenCreated\",\"size\":3,\"showAnalytics\":true,\"title\":\"Display changes ( Add, Remove, modifications of parameters )\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Identity\"],\"expandTopLevel\":true}}},\"conditionalVisibility\":{\"parameterName\":\"Compare_Collect\",\"comparison\":\"isEqualTo\",\"value\":\"True\"},\"name\":\"query - 7\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"Transport\"},\"name\":\"Transport Security configuration\"}],\"fromTemplateId\":\"sentinel-MicrosoftExchangeSecurityReview-Online\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -1151,7 +1616,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId2'),'/'))))]", "properties": { - "description": "@{workbookKey=MicrosoftExchangeSecurityReview-Online; logoFileName=Azure_Sentinel.svg; description=This Workbook is dedicated to Exchange Online tenants. It displays and highlights current Security configuration on various Exchange components specific to Online including delegations, the transport configuration and the linked security risks, and risky protocols.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.1; title=Microsoft Exchange Security Review - Online; templateRelativePath=Microsoft Exchange Security Review - Online.json; subtitle=; provider=Microsoft}.description", + "description": "@{workbookKey=MicrosoftExchangeSecurityReview-Online; logoFileName=Azure_Sentinel.svg; description=This Workbook is dedicated to Exchange Online tenants. It displays and highlights current Security configuration on various Exchange components specific to Online including delegations, the transport configuration and the linked security risks, and risky protocols.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.1.0; title=Microsoft Exchange Security Review - Online; templateRelativePath=Microsoft Exchange Security Review - Online.json; subtitle=; provider=Microsoft}.description", "parentId": "[variables('workbookId2')]", "contentId": "[variables('_workbookContentId2')]", "kind": "Workbook", @@ -1200,13 +1665,187 @@ "version": "[variables('workbookVersion2')]" } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName3')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Microsoft Exchange Admin Activity - Online Workbook with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('workbookVersion3')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId3')]", + "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "This Workbook is dedicated to Online Exchange organizations. It uses Office Activity logs. It helps to track admin actions, especially on VIP Users and/or on Sensitive Cmdlets. Required Data Connector: Microsoft 365 (Exchange)." + }, + "properties": { + "displayName": "[parameters('workbook3-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Microsoft Exchange Admin Activity\\r\\n\\r\\nThis workbook helps you visualize what is happening in your Exchange environment.\\r\\nResults removed :\\r\\n\\t- All Test-* and Set-AdServerSetting Cmdlets\\r\\n\\r\\n**Selection of an environment is unavailable. As this workbook is based on the OfficeActivity Logs (Microsoft 365 Solution) directly linked to the Microsoft Sentinel Environment, we cannot provide a view of another one.**\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"3792117c-d924-4ec7-a327-1e8d5e9f291a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"value\":{\"durationMs\":14400000}},{\"id\":\"743317e2-ebcf-4958-861d-4ff97fc7cce1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EnvironmentList\",\"label\":\"Environment\",\"type\":2,\"query\":\"OfficeActivity | where TimeGenerated {TimeRange}\\r\\n| summarize by OrganizationName\",\"isHiddenWhenLocked\":true,\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"8ac96eb3-918b-4a36-bcc4-df50d8f46175\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"Show Help\",\"type\":10,\"isRequired\":true,\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n { \\\\\\\"value\\\\\\\": \\\\\\\"Yes\\\\\\\", \\\\\\\"label\\\\\\\": \\\\\\\"Yes\\\\\\\"},\\\\r\\\\n {\\\\\\\"value\\\\\\\": \\\\\\\"No\\\\\\\", \\\\\\\"label\\\\\\\": \\\\\\\"No\\\\\\\", \\\\\\\"selected\\\\\\\":true }\\\\r\\\\n]\\\\r\\\\n\\\"}\\r\\n\",\"timeContext\":{\"durationMs\":2592000000},\"queryType\":8}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"TimeRange\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"34188faf-7a02-4697-9b36-2afa986afc0f\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Cmdlet Analysis\",\"subTarget\":\"Cmdlet\",\"postText\":\"t\",\"style\":\"link\",\"icon\":\"3\",\"linkIsContextBlade\":true}]},\"name\":\"links - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Cmdlet summary\",\"items\":[{\"type\":1,\"content\":{\"json\":\"This tab parses the events from OfficeActivity logs :\\r\\n\\r\\n- list of cmdlets\\r\\n- filter on a VIP and/or Sensitive objects (based on Watchlist \\\"Exchange VIP\\\" and \\\" Monitored Exchange Cmdlets\\\")\\r\\n- anomalies detections are based on the KQL function series_decompose_anomalies\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"CmdletGroupHelp\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5a942eba-c991-4b84-9a94-c153bca86e12\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"VIPOnly\",\"label\":\"Show VIP Only\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"True\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n { \\\"value\\\": \\\"True,False\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"83befa26-eee0-49ab-9785-72653943bc6b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SensitiveOnly\",\"label\":\"Sensitive CmdLet Only\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"True\\\", \\\"label\\\": \\\"Yes\\\" },\\r\\n { \\\"value\\\": \\\"True,False\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\\r\\n\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 0\"},{\"type\":1,\"content\":{\"json\":\"This section show all the Cmdlets executed in the selected time range. Possible filters are: \\r\\n- **VIP Only selected** Cmdlets used against VIP objects (based on the \\\"Exchange VIP\\\" watchlist)\\r\\n- **Sensitive Cmdlets** Cmdlets considered as Sensitive (based on the \\\"Monitored Exchange Cmdlets\\\" watchlist)\\r\\n\\r\\nThese informations can be useful to detect unexpected behaviors or to determine what are the action performed by the accounts (ie. service accounts).\\r\\n\\r\\nℹ️ It is recommended to delegated only the necessary privileges to an account.\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"CmdtListHelp\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| where IsVIP in ({VIPOnly})\\r\\n| where IsSensitive in ({SensitiveOnly})\\r\\n| summarize count() by CmdletName\\r\\n| sort by count_\",\"size\":2,\"showAnalytics\":true,\"title\":\"List of all executed cmdlets during the last 90 days (based on Sentinel retention)\",\"exportFieldName\":\"Cmdlet\",\"exportParameterName\":\"CmdletFilter\",\"exportDefaultValue\":\"\\\"\\\"\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"CmdletName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"Cmdlet\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":20}},\"customWidth\":\"45\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| where IsVIP in ({VIPOnly})\\r\\n| where IsSensitive in ({SensitiveOnly})\\r\\n| summarize count() by CmdletName\\r\\n| join kind=leftouter ( MESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| where IsVIP in ({VIPOnly})\\r\\n| where IsSensitive in ({SensitiveOnly})\\r\\n | make-series Count=count() on TimeGenerated from ago(30d) to now() step 1d by CmdletName\\r\\n | extend Anomalies=series_decompose_anomalies(Count)\\r\\n) on CmdletName\\r\\n| project CmdletName, Total=count_, Count, Anomalies\\r\\n| sort by Total\",\"size\":2,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Cmdlet\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"31.5ch\"}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"9.3ch\"}},{\"columnMatch\":\"Count\",\"formatter\":21,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"330px\"},\"tooltipFormat\":{\"tooltip\":\"Trend\"}},{\"columnMatch\":\"Anomalies\",\"formatter\":9,\"formatOptions\":{\"palette\":\"redBright\",\"customColumnWidthSetting\":\"330px\"},\"tooltipFormat\":{\"tooltip\":\"Anomalies\"}}],\"rowLimit\":10000,\"filter\":true,\"labelSettings\":[{\"columnId\":\"Count\",\"label\":\"Count for the last 30 days\"}]}},\"customWidth\":\"55\",\"name\":\"CmdletTrends\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet: string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\", ignoreFirstRecord=true)\\r\\n | project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| where IsVIP in ({VIPOnly})\\r\\n| where IsSensitive in ({SensitiveOnly})\\r\\n| summarize Total = count() by Caller\\r\\n| join kind=leftouter ( MESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| where IsVIP in ({VIPOnly})\\r\\n| where IsSensitive in ({SensitiveOnly})\\r\\n | make-series Count=count() on TimeGenerated from ago(30d) to now() step 1d by Caller\\r\\n | extend Anomalies=series_decompose_anomalies(Count)\\r\\n) on Caller\\r\\n| project Caller, Total, Count, Anomalies\\r\\n| sort by Total desc\",\"size\":1,\"showAnalytics\":true,\"exportFieldName\":\"Caller\",\"exportParameterName\":\"CallerFilter\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Caller\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"70ch\"}},{\"columnMatch\":\"Total\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"125px\"}},{\"columnMatch\":\"Count\",\"formatter\":21,\"formatOptions\":{\"palette\":\"blue\",\"customColumnWidthSetting\":\"300px\"},\"tooltipFormat\":{\"tooltip\":\"Trend\"}},{\"columnMatch\":\"Anomalies\",\"formatter\":10,\"formatOptions\":{\"palette\":\"redBright\",\"customColumnWidthSetting\":\"300px\"},\"tooltipFormat\":{\"tooltip\":\"Anomalies\"}}],\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_bar_Total_1\",\"sortOrder\":2}],\"labelSettings\":[{\"columnId\":\"Count\",\"label\":\"Count for the last 30 days\"}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_Total_1\",\"sortOrder\":2}],\"chartSettings\":{\"createOtherGroup\":20}},\"name\":\"query - 4\"},{\"type\":1,\"content\":{\"json\":\"## List of Cmdlets\\r\\n\\r\\nBy default all accounts found in the log are displayed.\\r\\n\\r\\nSelect an caller, to display all Cmdlets launched by this administrator\\r\\n\\r\\n> **Legend** \\r\\n> \\r\\n> πŸ‘‘ VIP user \\r\\n> πŸ’₯ Sensitive action\\r\\n\\r\\nIf needed, select an item in the dropdownlist. Dropdownlist are independent.\"},\"name\":\"text - 3\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"008273d1-a013-4d86-9e23-499e5175a85e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CallerFilter\",\"label\":\"Caller\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| distinct Caller\\r\\n| extend Caller = replace_string(Caller, '\\\\\\\\', '\\\\\\\\\\\\\\\\')\\r\\n| sort by Caller asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"21bd4e45-65ca-4b9b-a19c-177d6b37d807\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TargetObjectFilter\",\"label\":\"Target Object\",\"type\":2,\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| where Caller in ({CallerFilter})\\r\\n| distinct TargetObject\\r\\n| sort by TargetObject asc\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"9e93d5c3-0fcb-4ece-b2a0-fc3ff44a0b04\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CmdletFilter\",\"label\":\"Cmdlet Filter\",\"type\":2,\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| where Caller in ({CallerFilter})\\r\\n| distinct CmdletName\\r\\n| sort by CmdletName asc\",\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet: string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\", ignoreFirstRecord=true)\\r\\n | project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| where IsVIP in ({VIPOnly})\\r\\n| where IsSensitive in ({SensitiveOnly})\\r\\n| where (Caller in ({CallerFilter}) or Caller == \\\"ALL\\\") and TargetObject contains \\\"{TargetObjectFilter}\\\" and CmdletName contains \\\"{CmdletFilter}\\\"\\r\\n and TargetObject contains \\\"\\\"\\r\\n and CmdletName contains \\\"\\\"\\r\\n| extend TargetObject = iif(IsVIP == true and TargetObject !=\\\"\\\" , strcat(\\\"πŸ‘‘ \\\",TargetObject), TargetObject )\\r\\n| extend Cmdlet = iif(IsSensitive == true and TargetObject !=\\\"\\\", strcat(\\\"πŸ’₯ \\\",CmdletName), CmdletName )\\r\\n| extend IsVIP = iif(IsVIP == true and TargetObject !=\\\"\\\" , strcat(\\\"πŸ‘‘ \\\",tostring(IsVIP)), tostring(IsVIP ))\\r\\n| project TimeGenerated, Caller, TargetObject, Cmdlet, CmdletParameters\\r\\n| sort by TimeGenerated desc\",\"size\":2,\"showAnalytics\":true,\"title\":\"History\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ActualCmdLet\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"120ch\"}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"Cmdlet\"},\"name\":\"Cmdlet Group\"}],\"fromTemplateId\":\"sentinel-MicrosoftExchangeSecurityAdminActivity-Online\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId3'),'/'))))]", + "properties": { + "description": "@{workbookKey=MicrosoftExchangeAdminActivity-Online; logoFileName=Azure_Sentinel.svg; description=This Workbook is dedicated to Online Exchange organizations. It uses Office Activity logs. It helps to track admin actions, especially on VIP Users and/or on Sensitive Cmdlets. Required Data Connector: Microsoft 365 (Exchange).; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Microsoft Exchange Online Admin Activity; templateRelativePath=Microsoft Exchange Admin Activity - Online.json; subtitle=; provider=Microsoft}.description", + "parentId": "[variables('workbookId3')]", + "contentId": "[variables('_workbookContentId3')]", + "kind": "Workbook", + "version": "[variables('workbookVersion3')]", + "source": { + "kind": "Solution", + "name": "Microsoft Exchange Security - Exchange Online", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Community", + "tier": "Community", + "link": "https://github.com/Azure/Azure-Sentinel/issues" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "OfficeActivity", + "kind": "DataType" + }, + { + "contentId": "Office365", + "kind": "DataConnector" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId3')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook3-name')]", + "contentProductId": "[variables('_workbookcontentProductId3')]", + "id": "[variables('_workbookcontentProductId3')]", + "version": "[variables('workbookVersion3')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName4')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Microsoft Exchange Search AdminAuditLog - Online Workbook with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('workbookVersion4')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId4')]", + "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "This workbook is dedicated to Online Exchange organizations. It uses the Office Activity logs to give you a simple way to view administrators’ activities in your Exchange environment with Cmdlets usage statistics and multiple pivots to understand who and/or what is affected to modifications on your environment. Required Data Connector: Microsoft 365 (Exchange)." + }, + "properties": { + "displayName": "[parameters('workbook4-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Admin Audit Log\\r\\n\\r\\n** This workbook requires Option 1** (upload of the OfficeActivity logs)\\r\\n\\r\\n**Selection of an environment is unavailable. As this workbook is based on the OfficeActivity Logs (Microsoft 365 Solution) directly linked to the Microsoft Sentinel Environment, we cannot provide a view of another one.**\"},\"name\":\"text - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"79f1e435-df12-4c83-9967-501ab5f6ad6a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":86400000}},{\"id\":\"59486bcb-db99-43b3-97dc-a63b271a91d1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EnvironmentList\",\"label\":\"Environment\",\"type\":2,\"query\":\"OfficeActivity | where TimeGenerated {TimeRange}\\r\\n | summarize by OrganizationName\",\"isHiddenWhenLocked\":true,\"typeSettings\":{\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"079b3cc5-dab3-4d38-b4d0-71101802949d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"Show Help\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 4\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"9d830b00-95f4-4fd5-8cfb-95c2e63f5d0b\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Cmdlets Analysis\",\"subTarget\":\"CmdletAna\",\"style\":\"link\"},{\"id\":\"944a83ef-377f-4374-83e8-46816b6ce570\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Admin Audit Log - All Admins\",\"subTarget\":\"AllAAL\",\"style\":\"link\"},{\"id\":\"cdab541f-8d91-4882-ba46-7c04cdff257b\",\"cellValue\":\"selected\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Workbook Help\",\"subTarget\":\"Start\",\"style\":\"link\"}]},\"name\":\"links - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Global Admin Audit Log Search\",\"items\":[{\"type\":1,\"content\":{\"json\":\"If needed, select an item in the dropdownlist. Dropdownlist are independent.\"},\"name\":\"text - 4\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"e100ee8b-d63b-4c49-9004-6555b56051aa\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Admin\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| extend Caller = replace_string(Caller, '\\\\\\\\', '\\\\\\\\\\\\\\\\')\\r\\n| extend admin = Caller\\r\\n| distinct admin\\r\\n\\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"0d7c1223-d108-4d10-bb24-50891a3415fd\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CmdLet\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| where Caller in ({Admin})\\r\\n| distinct CmdletName\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"**How to understand the data**\\r\\n\\r\\nThese information are extracted from the OfficeActivity logs.\\r\\n\\r\\nEach entry is analyzed regarding the following conditions :\\r\\n\\r\\n - Check if the Target Object is a VIP. The VIP list is based on the watchlist \\\"Exchange VIP\\\".\\r\\n\\r\\n - Check if the Cdmlet is a Sensitive Cmdlet. The Sensitive Cmdlet list is based on the watchlist \\\"Monitored Exchange Cmdlets\\\". \\r\\n - This list contains the list of Cmdlet that are considered as Sensitive. \\r\\n - Some Cmdlet will be considered as Sensitive only if some specific parameters defined in the \\\"Monitored Exchange Cmdlets\\\" watchlist are used.\\r\\n\\r\\nColumn explainatations : \\r\\n - Caller : Named of the Administrators that used this cmdlet\\r\\n - TargetObject : Object modified by the cmdlet\\r\\n - IsVIP : If the Target Object part of the \\\"Exchange VIP\\\" watchlist\\r\\n - Cmdlet : Name of the cmdlet that was used\\r\\n - CmdletParameters : Cmdlet parameters used with the command\\r\\n - IsSensitive :\\r\\n - true : This cmdlet is Sensitive because it was part of the list of the \\\"Monitored Exchange Cmdlets\\\" watchlist and Sensitive parameters have been used for cmdlet with specifc sensitive parameters \\r\\n\\r\\n\"},\"showPin\":false,\"name\":\"text - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"group - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where Caller in ({Admin}) and CmdletName in ({CmdLet})\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| extend TargetObject = iif(IsVIP == true and TargetObject !=\\\"\\\" , strcat(\\\"πŸ‘‘ \\\",TargetObject), TargetObject )\\r\\n| extend CmdletName = iif(IsSensitive == true and TargetObject !=\\\"\\\", strcat(\\\"πŸ’₯ \\\",CmdletName), CmdletName )\\r\\n| extend IsVIP = iif(IsVIP == true and TargetObject !=\\\"\\\" , strcat(\\\"πŸ‘‘ \\\",tostring(IsVIP)), tostring(IsVIP ))\\r\\n| extend IsSensitive = iif(IsSensitive == true and TargetObject !=\\\"\\\", strcat(\\\"πŸ’₯ \\\",tostring(IsSenstiveCmdlet)), tostring(IsSenstiveCmdlet))\\r\\n| project TimeGenerated, Caller,IsVIP,TargetObject,IsSensitive,CmdletName,CmdletParameters\\r\\n| sort by TimeGenerated desc\",\"size\":0,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":2}]},\"name\":\"query - 2\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"AllAAL\"},\"name\":\"Global Admin Audit Log\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Analysis of Administrators actions\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Total Cmdlets for the Time Range\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| extend Caller\\r\\n| extend CmdletName\\r\\n| summarize Count=count() by CmdletName\",\"size\":2,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"50\",\"name\":\"query - 0\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| extend Account = Caller\\r\\n| summarize Count=dcount(CmdletName) by Account,CmdletName\",\"size\":2,\"showAnalytics\":true,\"title\":\"Total Unique Cmdlet per Account for the Time Range\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Account\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - 1\"}]},\"name\":\"group - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| summarize Count=count() by CmdletName\\r\\n| sort by CmdletName asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Total List of Cmdlets\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ExcludedCmdlet = externaldata (Cmdlet:string)[h\\\"https://aka.ms/ExcludedCmdletWatchlist\\\"]with(format=\\\"csv\\\",ignoreFirstRecord=true)| project Cmdlet;\\r\\nMESOfficeActivityLogs\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where CmdletName !in (ExcludedCmdlet)\\r\\n| extend Account = Caller\\r\\n| summarize Count=count() by CmdletName, Account\\r\\n| sort by Count asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"List of Cmdlet per Account\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Explanations\",\"expandable\":true,\"items\":[{\"type\":1,\"content\":{\"json\":\"This section displayed the list of Cmdlet used in your environment for the defined period of time with the number of time they have been used.\"},\"name\":\"text - 0\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Explanations\",\"expandable\":true,\"items\":[{\"type\":1,\"content\":{\"json\":\"This section will display the list of Cmdlet launch by Administrators for the defined period of time and the number of time they have been used\"},\"name\":\"text - 0\"}]},\"customWidth\":\"50\",\"name\":\"group - 3\"}]},\"name\":\"Result Analysis\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"CmdletAna\"},\"name\":\"Analysis of actions performed\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Workbook goals\\r\\nThe goals of this workbook is to allow search in the Exchange Admin Audit log.\\r\\n\\r\\nThe source of this workbook is not an export of the Admin Audit log mailbox but an export of the MSExchange Management for each Exchange servers.\\r\\n\\r\\nIf the Admin Audit Log is bypassed, the information won't be displayed in this workbook as there is no method to track this data.\\r\\n\\r\\n## Tabs\\r\\n\\r\\nLet quicly review the content of each tab\\r\\n\\r\\n### Cmdlets Analysis\\r\\n\\r\\nThis tab will show for the defined time range :\\r\\n - A summary of all cmdets used\\r\\n\\r\\n - A summary of all cmdlets used by each Account\\r\\n\\r\\n### Global Admin Audit Log\\r\\n\\r\\nThis tab allow to globally search in the exported Admin Audit log content.\\r\\n\\r\\nWhen Sensitive Cmdlets and/or Sensitive parameters are used, specific informations will be displayed.\\r\\n\\r\\nWhen VIP user are manipulated, specific informations will be displayed.\\r\\n\\r\\nFor more informations on how to understand each Column, refer to \\\"How to understand the data\\\"\\r\\n\\r\\n\\r\\n### AdminAuditLog for Org Mgmt\\r\\n\\r\\nThis tab allow to globally search in the exported Admin Audit log content for only account members on the Organization Management groups.\\r\\n\\r\\nWhen Sensitive Cmdlets and/or Sensitive parameters are used, specific informations will be displayed.\\r\\n\\r\\nWhen VIP user are manipulated, specific informations will be displayed.\\r\\n\\r\\nFor more informations on how to understand each Column, refer to \\\"How to understand the data\\\"\"},\"name\":\"text - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected\",\"comparison\":\"isEqualTo\",\"value\":\"Start\"},\"name\":\"group - 5\"}],\"fromTemplateId\":\"sentinel-MicrosoftExchangeSearchAdminAuditLog-Online\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId4'),'/'))))]", + "properties": { + "description": "@{workbookKey=MicrosoftExchangeSearchAdminAuditLog-Online; logoFileName=Azure_Sentinel.svg; description=This workbook is dedicated to Online Exchange organizations. It uses the Office Activity logs to give you a simple way to view administrators’ activities in your Exchange environment with Cmdlets usage statistics and multiple pivots to understand who and/or what is affected to modifications on your environment. Required Data Connector: Microsoft 365 (Exchange).; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Microsoft Exchange Search AdminAuditLog - Online; templateRelativePath=Microsoft Exchange Search AdminAuditLog - Online.json; subtitle=; provider=Microsoft}.description", + "parentId": "[variables('workbookId4')]", + "contentId": "[variables('_workbookContentId4')]", + "kind": "Workbook", + "version": "[variables('workbookVersion4')]", + "source": { + "kind": "Solution", + "name": "Microsoft Exchange Security - Exchange Online", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Community", + "tier": "Community", + "link": "https://github.com/Azure/Azure-Sentinel/issues" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "OfficeActivity", + "kind": "DataType" + }, + { + "contentId": "Office365", + "kind": "DataConnector" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId4')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook4-name')]", + "contentProductId": "[variables('_workbookcontentProductId4')]", + "id": "[variables('_workbookcontentProductId4')]", + "version": "[variables('workbookVersion4')]" + } + }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',parameters('watchlist1-id'))]", "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", "kind": "", "properties": { - "displayName": "Exchange VIP", - "source": "ExchangeVIP.csv", + "displayName": "Exchange Online VIP", + "source": "ExchOnlineVIP.csv", "description": "Specific VIP Monitored in Exchange.", "provider": "Microsoft", "isDeleted": false, @@ -1214,7 +1853,7 @@ "contentType": "Text/Csv", "numberOfLinesToSkip": 0, "itemsSearchKey": "userPrincipalName", - "rawContent": "displayName,userPrincipalName,sAMAccountName,objectSID,objectGUID,canonicalName,distinguishedName,comment\r\n\"2016DB1 User1\",\"2016DB1-User1@MyCompany.com\",\"2016DB1-User1\",\"S-1-5-21-666558943-2796267414-309129817-1211\",\"7d5c567e-621a-49d5-9766-b631921f1afe\",\"MyCompany.com/MyCompany/Users/2016DB1-User1\",\"CN=2016DB1-User1,CN=Users,CN=MyCompany,CN=MyCompany.com\",\r\n" + "rawContent": "displayName,sAMAccountName,userPrincipalName,comment\r\n\"2016DB1 User1\",\"2016DB1-User1\",\"2016DB1-User1@MyCompany.com\",\r\n" }, "apiVersion": "2021-03-01-preview" }, @@ -1223,12 +1862,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.4", + "version": "3.1.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Microsoft Exchange Security - Exchange Online", "publisherDisplayName": "Community", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Exchange Security Audit and Configuration Insight solution analyze Exchange Online configuration and logs from a security lens to provide insights and alerts.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Custom logs ingestion via Data Collector REST API
    2. \n
\n

Data Connectors: 1, Parsers: 3, Workbooks: 2, Watchlists: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

β€’ Review the solution Release Notes

\n

β€’ There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Exchange Security Audit and Configuration Insight solution analyze Exchange Online configuration and logs from a security lens to provide insights and alerts.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Custom logs ingestion via Data Collector REST API
    2. \n
\n

Data Connectors: 1, Parsers: 6, Workbooks: 4, Watchlists: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1272,6 +1911,21 @@ "contentId": "[variables('parserObject3').parserContentId3]", "version": "[variables('parserObject3').parserVersion3]" }, + { + "kind": "Parser", + "contentId": "[variables('parserObject4').parserContentId4]", + "version": "[variables('parserObject4').parserVersion4]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject5').parserContentId5]", + "version": "[variables('parserObject5').parserVersion5]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject6').parserContentId6]", + "version": "[variables('parserObject6').parserVersion6]" + }, { "kind": "Workbook", "contentId": "[variables('_workbookContentId1')]", @@ -1282,10 +1936,20 @@ "contentId": "[variables('_workbookContentId2')]", "version": "[variables('workbookVersion2')]" }, + { + "kind": "Workbook", + "contentId": "[variables('_workbookContentId3')]", + "version": "[variables('workbookVersion3')]" + }, + { + "kind": "Workbook", + "contentId": "[variables('_workbookContentId4')]", + "version": "[variables('workbookVersion4')]" + }, { "kind": "Watchlist", - "contentId": "[variables('_Exchange VIP')]", - "version": "3.0.4" + "contentId": "[variables('_Exchange Online VIP')]", + "version": "3.1.1" } ] }, diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Package/testParameters.json b/Solutions/Microsoft Exchange Security - Exchange Online/Package/testParameters.json new file mode 100644 index 00000000000..39020c8111b --- /dev/null +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Package/testParameters.json @@ -0,0 +1,64 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "Microsoft Exchange Least Privilege with RBAC - Online", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "workbook2-name": { + "type": "string", + "defaultValue": "Microsoft Exchange Security Review - Online", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "workbook3-name": { + "type": "string", + "defaultValue": "Microsoft Exchange Online Admin Activity", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "workbook4-name": { + "type": "string", + "defaultValue": "Microsoft Exchange Search AdminAuditLog - Online", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "watchlist1-id": { + "type": "string", + "defaultValue": "ExchOnlineVIP", + "minLength": 1, + "metadata": { + "description": "Unique id for the watchlist" + } + } +} diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCompareDataMRA.yaml b/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCompareDataMRA.yaml index e8e3c61fe4c..a6513ffda11 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCompareDataMRA.yaml +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Parsers/MESCompareDataMRA.yaml @@ -9,31 +9,31 @@ FunctionAlias: MESCompareDataMRA FunctionParams: - Name: SectionCompare Type: string - Description: The user to verifiy if is a VIP or not. Default value is "all". + Description: The Section to compare. Default value is "". DefaultValue: '' - Name: DateCompare Type: string - Description: The user to verifiy if is a VIP or not. Default value is "all". + Description: The date of the source comparison. Default value is "lastdate". DefaultValue: 'lastdate' - Name: CurrentDate Type: string - Description: The user to verifiy if is a VIP or not. Default value is "all". + Description: The date of the target comparison. Default value is "lastdate". DefaultValue: 'lastdate' - Name: EnvList Type: string - Description: The user to verifiy if is a VIP or not. Default value is "all". + Description: List of environments to compare. Default value is "All". DefaultValue: 'All' - Name: TypeEnv Type: string - Description: The user to verifiy if is a VIP or not. Default value is "all". + Description: Type of environment to compare. Default value is "Online". DefaultValue: 'Online' - Name: CurrentRole Type: string - Description: The user to verifiy if is a VIP or not. Default value is "all". + Description: A specific role to compare. Default value is "". DefaultValue: '' - Name: ExclusionsAcct Type: dynamic - Description: The user to verifiy if is a VIP or not. Default value is "all". + Description: List of actors to exclude. Default value is "dynamic('')". DefaultValue: dynamic('') FunctionQuery: | // Version: 1.0.0 diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchOnlineVIP.csv b/Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchOnlineVIP.csv new file mode 100644 index 00000000000..cfdea670c55 --- /dev/null +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchOnlineVIP.csv @@ -0,0 +1,2 @@ +displayName,sAMAccountName,userPrincipalName,comment +"2016DB1 User1","2016DB1-User1","2016DB1-User1@MyCompany.com", \ No newline at end of file diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchangeVIP.json b/Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchOnlineVIP.json similarity index 64% rename from Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchangeVIP.json rename to Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchOnlineVIP.json index b2e92167e19..009bfe4854f 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchangeVIP.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchOnlineVIP.json @@ -11,12 +11,12 @@ }, "resources": [ { - "name": "[concat(parameters('workspaceName'), '/Microsoft.SecurityInsights/ExchangeVIP')]", + "name": "[concat(parameters('workspaceName'), '/Microsoft.SecurityInsights/ExchOnlineVIP')]", "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", "kind": "", "properties": { - "displayName": "Exchange VIP", - "source": "ExchangeVIP.csv", + "displayName": "Exchange Online VIP", + "source": "ExchOnlineVIP.csv", "description": "Specific VIP Monitored in Exchange.", "provider": "Microsoft", "isDeleted": false, @@ -24,7 +24,7 @@ "contentType": "Text/Csv", "numberOfLinesToSkip": 0, "itemsSearchKey": "userPrincipalName", - "rawContent": "displayName,userPrincipalName,sAMAccountName,objectSID,objectGUID,canonicalName,distinguishedName,comment\r\n\"2016DB1 User1\",\"2016DB1-User1@MyCompany.com\",\"2016DB1-User1\",\"S-1-5-21-666558943-2796267414-309129817-1211\",\"7d5c567e-621a-49d5-9766-b631921f1afe\",\"MyCompany.com/MyCompany/Users/2016DB1-User1\",\"CN=2016DB1-User1,CN=Users,CN=MyCompany,CN=MyCompany.com\",\r\n" + "rawContent": "displayName,sAMAccountName,userPrincipalName,comment\r\n\"2016DB1 User1\",\"2016DB1-User1\",\"2016DB1-User1@MyCompany.com\",\r\n" }, "apiVersion": "2021-03-01-preview" } diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchangeVIP.csv b/Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchangeVIP.csv deleted file mode 100644 index 8b93b583bc2..00000000000 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Watchlists/ExchangeVIP.csv +++ /dev/null @@ -1,2 +0,0 @@ -displayName,userPrincipalName,sAMAccountName,objectSID,objectGUID,canonicalName,distinguishedName,comment -"2016DB1 User1","2016DB1-User1@MyCompany.com","2016DB1-User1","S-1-5-21-666558943-2796267414-309129817-1211","7d5c567e-621a-49d5-9766-b631921f1afe","MyCompany.com/MyCompany/Users/2016DB1-User1","CN=2016DB1-User1,CN=Users,CN=MyCompany,CN=MyCompany.com", \ No newline at end of file From 0fdbc9fa087bda31b5d09bd580d0ddceac8b4541 Mon Sep 17 00:00:00 2001 From: nlepagnez Date: Sat, 2 Mar 2024 23:12:26 +0100 Subject: [PATCH 05/10] Adding New Custom Tables for tests --- .../ExchangeConfiguration.json | 135 ++++++++++++++++++ .../CustomTables/MessageTrackingLog_CL.json | 88 ++++++++++++ ...ge Least Privilege with RBAC - Online.json | 5 +- 3 files changed, 224 insertions(+), 4 deletions(-) create mode 100644 .script/tests/KqlvalidationsTests/CustomFunctions/ExchangeConfiguration.json create mode 100644 .script/tests/KqlvalidationsTests/CustomTables/MessageTrackingLog_CL.json diff --git a/.script/tests/KqlvalidationsTests/CustomFunctions/ExchangeConfiguration.json b/.script/tests/KqlvalidationsTests/CustomFunctions/ExchangeConfiguration.json new file mode 100644 index 00000000000..7b4be175810 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomFunctions/ExchangeConfiguration.json @@ -0,0 +1,135 @@ +{ + "FunctionName": "ExchangeConfiguration", + "FunctionParameters": [ + { + "Name": "SpecificSectionList", + "Type": "String" + }, + { + "Name": "SpecificConfigurationDate", + "Type": "String" + }, + { + "Name": "Target", + "Type": "String" + }, + { + "Name": "SpecificConfigurationEnv", + "Type": "String" + } + ], + "FunctionResultColumns": [ + { + "Name": "TimeGenerated", + "Type": "DateTime" + }, + { + "Name": "TableName", + "Type": "String" + }, + { + "Name": "Identity_s", + "Type": "String" + }, + { + "Name": "ConfigurationInstanceID", + "Type": "String" + }, + { + "Name": "ESIEnvironment", + "Type": "String" + }, + { + "Name": "Section", + "Type": "String" + }, + { + "Name": "PSCmdlet", + "Type": "String" + }, + { + "Name": "Name", + "Type": "String" + }, + { + "Name": "IdentityString_s", + "Type": "String" + }, + { + "Name": "CmdletResultType", + "Type": "String" + }, + { + "Name": "rawData_s", + "Type": "dynamic" + }, + { + "Name": "Identity_IsDeleted_b", + "Type": "binary" + }, + { + "Name": "Identity_Rdn_s", + "Type": "String" + }, + { + "Name": "Identity_Parent_s", + "Type": "String" + }, + { + "Name": "Identity_Depth_d", + "Type": "integer" + }, + { + "Name": "Identity_DistinguishedName_s", + "Type": "String" + }, + { + "Name": "Identity_IsRelativeDn_b", + "Type": "binary" + }, + { + "Name": "Identity_DomainId_s", + "Type": "String" + }, + { + "Name": "Identity_PartitionGuid_g", + "Type": "guid" + }, + { + "Name": "Identity_PartitionFQDN_s", + "Type": "String" + }, + { + "Name": "Identity_ObjectGuid_g", + "Type": "guid" + }, + { + "Name": "Identity_Name_s", + "Type": "String" + }, + { + "Name": "WhenCreated", + "Type": "DateTime" + }, + { + "Name": "WhenChanged", + "Type": "DateTime" + }, + { + "Name": "Source", + "Type": "String" + }, + { + "Name": "ScopedEnvironment", + "Type": "String" + }, + { + "Name": "Identity", + "Type": "String" + }, + { + "Name": "CmdletResultValue", + "Type": "dynamic" + } + ] +} \ No newline at end of file diff --git a/.script/tests/KqlvalidationsTests/CustomTables/MessageTrackingLog_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/MessageTrackingLog_CL.json new file mode 100644 index 00000000000..0081db70245 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/MessageTrackingLog_CL.json @@ -0,0 +1,88 @@ +{ "Name": "MessageTrackingLog_CL", +"Properties":[ + { + "Name": "TenantId", + "Type": "string" + }, + { + "Name": "SourceSystem", + "Type": "string" + }, + { + "Name": "MG", + "Type": "string" + }, + { + "Name": "ManagementGroupName", + "Type": "string" + }, + { + "Name": "TimeGenerated", + "Type": "datetime" + }, + { + "Name": "Computer", + "Type": "string" + }, + { + "Name": "RawData", + "Type": "string" + }, + { + "Name": "GenerationInstanceID_g", + "Type": "string" + }, + { + "Name": "ESIEnvironment_s", + "Type": "string" + }, + { + "Name": "EntryDate_s", + "Type": "string" + }, + { + "Name": "Section_s", + "Type": "string" + }, + { + "Name": "PSCmdL_s", + "Type": "string" + }, + { + "Name": "Name_s", + "Type": "string" + }, + { + "Name": "Identity_s", + "Type": "string" + }, + { + "Name": "WhenCreated_s", + "Type": "string" + }, + { + "Name": "WhenChanged_s", + "Type": "string" + }, + { + "Name": "ExecutionResult_s", + "Type": "string" + }, + { + "Name": "rawData_s", + "Type": "string" + }, + { + "Name": "IdentityString_s", + "Type": "string" + }, + { + "Name": "Type", + "Type": "string" + }, + { + "Name": "_ResourceId", + "Type": "string" + } +] +} \ No newline at end of file diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Least Privilege with RBAC - Online.json b/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Least Privilege with RBAC - Online.json index 77f6d1cb6c2..da24ecd6d7f 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Least Privilege with RBAC - Online.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Workbooks/Microsoft Exchange Least Privilege with RBAC - Online.json @@ -58,10 +58,7 @@ "showDefault": false }, "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "value": [ - "ITSY MCAPS" - ] + "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "a88b4e41-eb2f-41bf-92d8-27c83650a4b8", From e4259759243694b8bd2d56ffef16c30c2c1c4cd6 Mon Sep 17 00:00:00 2001 From: nlepagnez Date: Sat, 2 Mar 2024 23:38:03 +0100 Subject: [PATCH 06/10] Adding missing custom tables --- .../ESIExchangeOnlineConfig_CL.json | 8 ++ .../CustomTables/ExchangeHttpProxy_CL.json | 96 +++++++++++++++++++ .../SkipValidationsTemplates.json | 5 + 3 files changed, 109 insertions(+) create mode 100644 .script/tests/KqlvalidationsTests/CustomTables/ExchangeHttpProxy_CL.json diff --git a/.script/tests/KqlvalidationsTests/CustomTables/ESIExchangeOnlineConfig_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/ESIExchangeOnlineConfig_CL.json index 8e1d63d5197..e95a4705fa8 100644 --- a/.script/tests/KqlvalidationsTests/CustomTables/ESIExchangeOnlineConfig_CL.json +++ b/.script/tests/KqlvalidationsTests/CustomTables/ESIExchangeOnlineConfig_CL.json @@ -64,6 +64,14 @@ "Name": "WhenChanged_s", "Type": "string" }, + { + "Name": "WhenCreated_t", + "Type": "datetime" + }, + { + "Name": "WhenChanged_t", + "Type": "datetime" + }, { "Name": "ExecutionResult_s", "Type": "string" diff --git a/.script/tests/KqlvalidationsTests/CustomTables/ExchangeHttpProxy_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/ExchangeHttpProxy_CL.json new file mode 100644 index 00000000000..694a26adedd --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/ExchangeHttpProxy_CL.json @@ -0,0 +1,96 @@ +{ "Name": "ExchangeHttpProxy_CL", +"Properties":[ + { + "Name": "TenantId", + "Type": "string" + }, + { + "Name": "SourceSystem", + "Type": "string" + }, + { + "Name": "MG", + "Type": "string" + }, + { + "Name": "ManagementGroupName", + "Type": "string" + }, + { + "Name": "TimeGenerated", + "Type": "datetime" + }, + { + "Name": "Computer", + "Type": "string" + }, + { + "Name": "RawData", + "Type": "string" + }, + { + "Name": "GenerationInstanceID_g", + "Type": "string" + }, + { + "Name": "ESIEnvironment_s", + "Type": "string" + }, + { + "Name": "EntryDate_s", + "Type": "string" + }, + { + "Name": "Section_s", + "Type": "string" + }, + { + "Name": "PSCmdL_s", + "Type": "string" + }, + { + "Name": "Name_s", + "Type": "string" + }, + { + "Name": "Identity_s", + "Type": "string" + }, + { + "Name": "WhenCreated_s", + "Type": "string" + }, + { + "Name": "WhenChanged_s", + "Type": "string" + }, + { + "Name": "WhenCreated_t", + "Type": "datetime" + }, + { + "Name": "WhenChanged_t", + "Type": "datetime" + }, + { + "Name": "ExecutionResult_s", + "Type": "string" + }, + { + "Name": "rawData_s", + "Type": "string" + }, + { + "Name": "IdentityString_s", + "Type": "string" + }, + { + "Name": "Type", + "Type": "string" + }, + { + "Name": "_ResourceId", + "Type": "string" + } +] +} \ No newline at end of file diff --git a/.script/tests/NonAsciiValidationsTests/SkipValidationsTemplates.json b/.script/tests/NonAsciiValidationsTests/SkipValidationsTemplates.json index f8088e97175..7b91baea4ee 100644 --- a/.script/tests/NonAsciiValidationsTests/SkipValidationsTemplates.json +++ b/.script/tests/NonAsciiValidationsTests/SkipValidationsTemplates.json @@ -23,6 +23,11 @@ "id": "44a7b71e-ad89-49fd-b540-a73c83c6f8c5", "templateName": "Remote Management and Monitoring tool - ServerEye - File Signature", "validationFailReason": "umlaut is present in the proper name" + }, + { + "id": "39f51672-8c63-4600-882a-5db8275f798f", + "templateName": "Microsoft Exchange Security - MESCompareDataMRA parser", + "validationFailReason": "Non-ASCII characters are required to test comparison of strings with non-ASCII characters" } ] From 463a6332ee3f06592496fb9cf7e4f98b3d6eeee2 Mon Sep 17 00:00:00 2001 From: nlepagnez Date: Wed, 6 Mar 2024 13:42:35 +0100 Subject: [PATCH 07/10] Correct Variable --- .../azuredeploy_ESI_ExchangeOnlineCollector_Automation.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json index 7d267c83c96..aa5b4d88777 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_ExchangeOnlineCollector_Automation.json @@ -76,7 +76,7 @@ } }, "ingestionScriptUri": "https://aka.ms/ESI-ExchangeCollector-RawScript", - "InitialConfiguration":"\"{\\n \\\"SolutionMetadata\\\": {\\n \\\"JSonVersion\\\":\\\"2.5\\\",\\n \\\"JsonUpdateDate\\\":\\\"19/02/2024\\\",\\n \\\"Description\\\":\\\"Configuration File for CollectExchSecIns script\\\",\\n \\\"VersionInformation\\\":{\\n \\\"2.5\\\":{\\n \\\"Tracking\\\":[\\\"Adding Multiple parameters: \\\",\\n \\\"- DeactivateUDSLogs to deactivate the log summary\\\",\\n \\\"- LogVerboseActivated, by default true. If set to false, the log will be less verbose\\\",\\n \\\"- UDSLogProcessor, to manage the log storage. The first entry is the default one, the second is the file storage and the third is the Azure Storage Account. The first activated entry is the default one. If no entry is activated, the default one will be used. If the default one is not activated, the first activated entry will be used.\\\",\\n \\\"- UpdateVersionCheckingDeactivated, to deactivate the version checking\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":[\\n \\\"Adding the parameters in Advanced part :\\\",\\n \\\" - DeactivateUDSLogs: false\\\",\\n \\\" - LogVerboseActivated: true\\\",\\n \\\" - UDSLogProcessor is a table of possibilities. Only 1 is mandatory but you can add multiple. Possibilities :\\\",\\n \\\" Output, default one :\\\",\\n \\\" {Activated:true/false, StorageType:Output}\\\",\\n \\\" File :\\\",\\n \\\" {Activated:true/false, StorageType:File, StoragePath:C:\\\\\\\\ExchSecIns\\\\\\\\data\\\\\\\\Logs, Prefix:ExchSecInsUDSLog, LogStorageRetentionDays: 30}\\\",\\n \\\" AzureStorageAccount :\\\",\\n \\\" With Managed Identity : {Activated:true/false, StorageType:AzureStorageAccount, StorageAccountName:exchsecinslogs, StorageBlobContainer:exchsecinslogs, ConnexionType:ManagedIdentity, Prefix:ExchSecInsUDSLog, TenantId:TENANTIDGUID}\\\",\\n \\\" With Certificate Auth : {Activated:true/false, StorageType:AzureStorageAccount, StorageAccountName:exchsecinslogs, StorageBlobContainer:exchsecinslogs, ConnexionType:Certificate, Prefix:ExchSecInsUDSLog, TenantId:TENANTIDGUID, ApplicationID:EntraIDApplicationGUID, CertificateThumbprint:CertificateThumbprint}\\\",\\n \\\" - UpdateVersionCheckingDeactivated: false\\\"\\n ]\\n },\\n \\\"2.4\\\":{\\n \\\"Tracking\\\":[\\\"Adding Parameter for Pagination Error Threshold\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Pagination Error Threshold information in Advanced part : 'PaginationErrorThreshold: 5' tag.\\\"\\n },\\n \\\"2.3\\\":{\\n \\\"Tracking\\\":[\\\"Adding Parameter for Max Packet size for Sentinel\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Max Size information in Advanced part : 'MaximalSentinelPacketSizeMb' tag.\\\"\\n },\\n \\\"2.2\\\":{\\n \\\"Tracking\\\":[\\\"Adding Proxy Information\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Proxy information in Advanced part : 'Useproxy' tag and 'ProxyUrl' tag.\\\"\\n },\\n \\\"2.1\\\":{\\n \\\"Tracking\\\":[\\\"Adding Beta feature\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Beta information in Advanced part.\\\"\\n },\\n \\\"2.0\\\":{\\n \\\"Tracking\\\":[\\\"Adding Instance information, Add-on config files and Internet configuration\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Compare old file with new file as a lot of things changes. Especially the AuditFunctions part that is exported to external Add-Ons files.\\\"\\n },\\n \\\"1.3\\\": {\\n \\\"Tracking\\\": [\\n \\\"Adding feature to export Domain information in Sentinel Table\\\"\\n ],\\n \\\"MigrationMessageFromLastVersion\\\": \\\"Adding entry 'ExportDomainsInformation' in Output\\\"\\n },\\n \\\"1.2\\\": {\\n \\\"Tracking\\\": [\\n \\\"Correcting PartConfPerm in AuditFunctions : Correct Expression to avoid null error.\\\"\\n ],\\n \\\"MigrationMessageFromLastVersion\\\": \\\"Replace all the section 'AuditFunctions' with the new one\\\"\\n },\\n \\\"1.1\\\": {\\n \\\"Tracking\\\": [\\n \\\"Correcting multiple entries in AuditFunctions : ExchangeServers, ETS, EWP, LocalAdmins,POPIMAPServicesStatus,ExchVersion\\\"\\n ],\\n \\\"MigrationMessageFromLastVersion\\\": \\\"Replace all the section 'AuditFunctions' with the new one\\\"\\n }\\n }\\n },\\n \\\"Global\\\": {\\n \\\"ParallelTimeoutMinutes\\\": 5,\\n \\\"MaxParallelRunningJobs\\\": 8,\\n \\\"GlobalParallelProcessing\\\": \\\"false\\\",\\n \\\"PerServerParallelProcessing\\\": \\\"false\\\",\\n \\\"DefaultDurationTracking\\\": 30,\\n \\\"ESIProcessingType\\\": \\\"Online\\\",\\n \\\"EnvironmentIdentification\\\": \\\"#EnvironmentIdentity#\\\"\\n },\\n \\\"Output\\\": {\\n \\\"DefaultOutputFile\\\": \\\"C:\\\\\\\\ExchSecIns\\\\\\\\data\\\\\\\\ExchSecIns.csv\\\",\\n \\\"ExportDomainsInformation\\\": \\\"True\\\"\\n },\\n \\\"Advanced\\\": {\\n \\\"ParralelWaitRunning\\\": 10,\\n \\\"ParralelPingWaitRunning\\\": 10,\\n \\\"OnlyExplicitActivation\\\": \\\"false\\\",\\n \\\"ExchangeServerBinPath\\\": \\\"c:\\\\\\\\Program Files\\\\\\\\Microsoft\\\\\\\\Exchange Server\\\\\\\\V15\\\\\\\\bin\\\",\\n \\\"BypassServerAvailabilityTest\\\": \\\"false\\\",\\n \\\"ExplicitExchangeServerList\\\": [],\\n \\\"FunctionsListInline\\\": \\\"false\\\",\\n \\\"FunctionsListWithoutInternet\\\": \\\"false\\\",\\n \\\"Beta\\\": \\\"false\\\",\\n \\\"Useproxy\\\" : \\\"false\\\",\\n \\\"ProxyUrl\\\" : \\\"http://proxy.dom.net:8080\\\",\\n \\\"MaximalSentinelPacketSizeMb\\\": 32,\\n \\\"PaginationErrorThreshold\\\": 5,\\n \\\"UpdateVersionCheckingDeactivated\\\":\\\"false\\\",\\n \\\"DeactivateUDSLogs\\\":\\\"false\\\",\\n \\\"LogVerboseActivated\\\":\\\"true\\\",\\n \\\"UDSLogProcessor\\\":[\\n {\\n \\\"Activated\\\":\\\"true\\\",\\n \\\"StorageType\\\":\\\"Output\\\"\\n },\\n {\\n \\\"Activated\\\":\\\"false\\\",\\n \\\"StorageType\\\":\\\"File\\\",\\n \\\"StoragePath\\\":\\\"C:\\\\\\\\ExchSecIns\\\\\\\\data\\\\\\\\Logs\\\",\\n \\\"Prefix\\\":\\\"ExchSecInsUDSLog\\\",\\n \\\"LogStorageRetentionDays\\\": 30\\n },\\n {\\n \\\"Activated\\\":\\\"false\\\",\\n \\\"StorageType\\\":\\\"AzureStorageAccount\\\",\\n \\\"StorageAccountName\\\":\\\"exchsecinslogs\\\",\\n \\\"StorageBlobContainer\\\":\\\"exchsecinslogs\\\",\\n \\\"ConnexionType\\\":\\\"ManagedIdentity\\\",\\n \\\"Prefix\\\":\\\"ExchSecInsUDSLog\\\",\\n \\\"TenantId\\\":\\\"#TenantID#\\\",\\n \\\"ApplicationID\\\":\\\"FakeApplicationID\\\",\\n \\\"CertificateThumbprint\\\":\\\"FakeCertThumbprint\\\"\\n }\\n ]\\n },\\n \\\"LogCollection\\\": {\\n \\\"ActivateLogUpdloadToSentinel\\\": \\\"true\\\",\\n \\\"WorkspaceId\\\": \\\"#WorkspaceID#\\\",\\n \\\"WorkspaceKey\\\": \\\"#WorkspaceKey#\\\",\\n \\\"LogTypeName\\\": \\\"ESIExchangeOnlineConfig\\\",\\n \\\"TogetherMode\\\": \\\"false\\\"\\n },\\n \\\"MGGraphAPIConnection\\\": {\\n \\\"MGGraphAzureRMCertificate\\\": \\\"\\\",\\n \\\"MGGraphAzureRMAppId\\\": \\\"\\\"\\n },\\n \\\"InstanceConfiguration\\\": {\\n \\\"Default\\\": {\\n \\\"All\\\": \\\"true\\\",\\n \\\"Capabilities\\\": \\\"OP|OL|MGGRAPH|ADINFOS\\\"\\n },\\n \\\"IIS-IoCs\\\": {\\n \\\"All\\\": \\\"true\\\",\\n \\\"Category\\\": \\\"IIS-IoCs\\\",\\n \\\"Capabilities\\\": \\\"IIS\\\",\\n \\\"OutputName\\\": \\\"ESIIISIoCs\\\"\\n },\\n \\\"ExchangeOnlineMessageTracking\\\":{\\n \\\"All\\\":\\\"true\\\",\\n \\\"Category\\\":\\\"OnlineMessageTracking\\\",\\n \\\"Capabilities\\\":\\\"OL\\\",\\n \\\"OutputName\\\":\\\"ExchangeOnlineMessageTracking\\\"\\n },\\n \\\"InstanceExample\\\": {\\n \\\"SelectedAddons\\\": [\\n \\\"Filename1\\\",\\n \\\"Filename2\\\"\\n ],\\n \\\"FileteredAddons\\\": [\\n \\\"Filename1\\\",\\n \\\"Filename2\\\"\\n ]\\n }\\n },\\n \\\"AuditFunctionsFiles\\\": [\\n {\\n \\\"Filename\\\": \\\"FiletoIgnore\\\",\\n \\\"Deactivated\\\": \\\"false\\\"\\n }\\n ],\\n \\\"AuditFunctionProtectedArea\\\": {\\n \\\"ContentCheckSum\\\": \\\"\\\"\\n },\\n \\\"AuditFunctions\\\": []\\n}\"", + "InitialConfiguration":"\"{\\n \\\"SolutionMetadata\\\": {\\n \\\"JSonVersion\\\":\\\"2.5\\\",\\n \\\"JsonUpdateDate\\\":\\\"19/02/2024\\\",\\n \\\"Description\\\":\\\"Configuration File for CollectExchSecIns script\\\",\\n \\\"VersionInformation\\\":{\\n \\\"2.5\\\":{\\n \\\"Tracking\\\":[\\\"Adding Multiple parameters: \\\",\\n \\\"- DeactivateUDSLogs to deactivate the log summary\\\",\\n \\\"- LogVerboseActivated, by default true. If set to false, the log will be less verbose\\\",\\n \\\"- UDSLogProcessor, to manage the log storage. The first entry is the default one, the second is the file storage and the third is the Azure Storage Account. The first activated entry is the default one. If no entry is activated, the default one will be used. If the default one is not activated, the first activated entry will be used.\\\",\\n \\\"- UpdateVersionCheckingDeactivated, to deactivate the version checking\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":[\\n \\\"Adding the parameters in Advanced part :\\\",\\n \\\" - DeactivateUDSLogs: false\\\",\\n \\\" - LogVerboseActivated: true\\\",\\n \\\" - UDSLogProcessor is a table of possibilities. Only 1 is mandatory but you can add multiple. Possibilities :\\\",\\n \\\" Output, default one :\\\",\\n \\\" {Activated:true/false, StorageType:Output}\\\",\\n \\\" File :\\\",\\n \\\" {Activated:true/false, StorageType:File, StoragePath:C:\\\\\\\\ExchSecIns\\\\\\\\data\\\\\\\\Logs, Prefix:ExchSecInsUDSLog, LogStorageRetentionDays: 30}\\\",\\n \\\" AzureStorageAccount :\\\",\\n \\\" With Managed Identity : {Activated:true/false, StorageType:AzureStorageAccount, StorageAccountName:exchsecinslogs, StorageBlobContainer:exchsecinslogs, ConnexionType:ManagedIdentity, Prefix:ExchSecInsUDSLog, TenantId:TENANTIDGUID}\\\",\\n \\\" With Certificate Auth : {Activated:true/false, StorageType:AzureStorageAccount, StorageAccountName:exchsecinslogs, StorageBlobContainer:exchsecinslogs, ConnexionType:Certificate, Prefix:ExchSecInsUDSLog, TenantId:TENANTIDGUID, ApplicationID:EntraIDApplicationGUID, CertificateThumbprint:CertificateThumbprint}\\\",\\n \\\" - UpdateVersionCheckingDeactivated: false\\\"\\n ]\\n },\\n \\\"2.4\\\":{\\n \\\"Tracking\\\":[\\\"Adding Parameter for Pagination Error Threshold\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Pagination Error Threshold information in Advanced part : 'PaginationErrorThreshold: 5' tag.\\\"\\n },\\n \\\"2.3\\\":{\\n \\\"Tracking\\\":[\\\"Adding Parameter for Max Packet size for Sentinel\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Max Size information in Advanced part : 'MaximalSentinelPacketSizeMb' tag.\\\"\\n },\\n \\\"2.2\\\":{\\n \\\"Tracking\\\":[\\\"Adding Proxy Information\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Proxy information in Advanced part : 'Useproxy' tag and 'ProxyUrl' tag.\\\"\\n },\\n \\\"2.1\\\":{\\n \\\"Tracking\\\":[\\\"Adding Beta feature\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Adding the Beta information in Advanced part.\\\"\\n },\\n \\\"2.0\\\":{\\n \\\"Tracking\\\":[\\\"Adding Instance information, Add-on config files and Internet configuration\\\"],\\n \\\"MigrationMessageFromLastVersion\\\":\\\"Compare old file with new file as a lot of things changes. Especially the AuditFunctions part that is exported to external Add-Ons files.\\\"\\n },\\n \\\"1.3\\\": {\\n \\\"Tracking\\\": [\\n \\\"Adding feature to export Domain information in Sentinel Table\\\"\\n ],\\n \\\"MigrationMessageFromLastVersion\\\": \\\"Adding entry 'ExportDomainsInformation' in Output\\\"\\n },\\n \\\"1.2\\\": {\\n \\\"Tracking\\\": [\\n \\\"Correcting PartConfPerm in AuditFunctions : Correct Expression to avoid null error.\\\"\\n ],\\n \\\"MigrationMessageFromLastVersion\\\": \\\"Replace all the section 'AuditFunctions' with the new one\\\"\\n },\\n \\\"1.1\\\": {\\n \\\"Tracking\\\": [\\n \\\"Correcting multiple entries in AuditFunctions : ExchangeServers, ETS, EWP, LocalAdmins,POPIMAPServicesStatus,ExchVersion\\\"\\n ],\\n \\\"MigrationMessageFromLastVersion\\\": \\\"Replace all the section 'AuditFunctions' with the new one\\\"\\n }\\n }\\n },\\n \\\"Global\\\": {\\n \\\"ParallelTimeoutMinutes\\\": 5,\\n \\\"MaxParallelRunningJobs\\\": 8,\\n \\\"GlobalParallelProcessing\\\": \\\"false\\\",\\n \\\"PerServerParallelProcessing\\\": \\\"false\\\",\\n \\\"DefaultDurationTracking\\\": 30,\\n \\\"ESIProcessingType\\\": \\\"Online\\\",\\n \\\"EnvironmentIdentification\\\": \\\"#EnvironmentIdentity#\\\"\\n },\\n \\\"Output\\\": {\\n \\\"DefaultOutputFile\\\": \\\"C:\\\\\\\\ExchSecIns\\\\\\\\data\\\\\\\\ExchSecIns.csv\\\",\\n \\\"ExportDomainsInformation\\\": \\\"True\\\"\\n },\\n \\\"Advanced\\\": {\\n \\\"ParralelWaitRunning\\\": 10,\\n \\\"ParralelPingWaitRunning\\\": 10,\\n \\\"OnlyExplicitActivation\\\": \\\"false\\\",\\n \\\"ExchangeServerBinPath\\\": \\\"c:\\\\\\\\Program Files\\\\\\\\Microsoft\\\\\\\\Exchange Server\\\\\\\\V15\\\\\\\\bin\\\",\\n \\\"BypassServerAvailabilityTest\\\": \\\"false\\\",\\n \\\"ExplicitExchangeServerList\\\": [],\\n \\\"FunctionsListInline\\\": \\\"false\\\",\\n \\\"FunctionsListWithoutInternet\\\": \\\"false\\\",\\n \\\"Beta\\\": \\\"false\\\",\\n \\\"Useproxy\\\" : \\\"false\\\",\\n \\\"ProxyUrl\\\" : \\\"http://proxy.dom.net:8080\\\",\\n \\\"MaximalSentinelPacketSizeMb\\\": 32,\\n \\\"PaginationErrorThreshold\\\": 5,\\n \\\"UpdateVersionCheckingDeactivated\\\":\\\"false\\\",\\n \\\"DeactivateUDSLogs\\\":\\\"false\\\",\\n \\\"LogVerboseActivated\\\":\\\"true\\\",\\n \\\"UDSLogProcessor\\\":[\\n {\\n \\\"Activated\\\":\\\"true\\\",\\n \\\"StorageType\\\":\\\"Output\\\"\\n },\\n {\\n \\\"Activated\\\":\\\"false\\\",\\n \\\"StorageType\\\":\\\"File\\\",\\n \\\"StoragePath\\\":\\\"C:\\\\\\\\ExchSecIns\\\\\\\\data\\\\\\\\Logs\\\",\\n \\\"Prefix\\\":\\\"ExchSecInsUDSLog\\\",\\n \\\"LogStorageRetentionDays\\\": 30\\n },\\n {\\n \\\"Activated\\\":\\\"false\\\",\\n \\\"StorageType\\\":\\\"AzureStorageAccount\\\",\\n \\\"StorageAccountName\\\":\\\"exchsecinslogs\\\",\\n \\\"StorageBlobContainer\\\":\\\"exchsecinslogs\\\",\\n \\\"ConnexionType\\\":\\\"ManagedIdentity\\\",\\n \\\"Prefix\\\":\\\"ExchSecInsUDSLog\\\",\\n \\\"TenantId\\\":\\\"#TenantID#\\\",\\n \\\"ApplicationID\\\":\\\"FakeApplicationID\\\",\\n \\\"CertificateThumbprint\\\":\\\"FakeCertThumbprint\\\"\\n }\\n ]\\n },\\n \\\"LogCollection\\\": {\\n \\\"ActivateLogUpdloadToSentinel\\\": \\\"true\\\",\\n \\\"WorkspaceId\\\": \\\"#WorkspaceID#\\\",\\n \\\"WorkspaceKey\\\": \\\"#WorkspaceKey#\\\",\\n \\\"LogTypeName\\\": \\\"ESIExchangeOnlineConfig\\\",\\n \\\"TogetherMode\\\": \\\"false\\\"\\n },\\n \\\"MGGraphAPIConnection\\\": {\\n \\\"MGGraphAzureRMCertificate\\\": \\\"\\\",\\n \\\"MGGraphAzureRMAppId\\\": \\\"\\\"\\n },\\n \\\"InstanceConfiguration\\\": {\\n \\\"Default\\\": {\\n \\\"All\\\": \\\"true\\\",\\n \\\"Capabilities\\\": \\\"OP|OL|MGGRAPH|ADINFOS\\\"\\n },\\n \\\"IIS-IoCs\\\": {\\n \\\"All\\\": \\\"true\\\",\\n \\\"Category\\\": \\\"IIS-IoCs\\\",\\n \\\"Capabilities\\\": \\\"IIS\\\",\\n \\\"OutputName\\\": \\\"ESIIISIoCs\\\"\\n },\\n \\\"ExchangeOnlineMessageTracking\\\":{\\n \\\"All\\\":\\\"true\\\",\\n \\\"Category\\\":\\\"OnlineMessageTracking\\\",\\n \\\"Capabilities\\\":\\\"OL\\\",\\n \\\"OutputName\\\":\\\"ExchangeOnlineMessageTracking\\\"\\n },\\n \\\"InstanceExample\\\": {\\n \\\"SelectedAddons\\\": [\\n \\\"Filename1\\\",\\n \\\"Filename2\\\"\\n ],\\n \\\"FileteredAddons\\\": [\\n \\\"Filename1\\\",\\n \\\"Filename2\\\"\\n ]\\n }\\n },\\n \\\"AuditFunctionsFiles\\\": [\\n {\\n \\\"Filename\\\": \\\"FiletoIgnore\\\",\\n \\\"Deactivated\\\": \\\"false\\\"\\n }\\n ],\\n \\\"AuditFunctionProtectedArea\\\": {\\n \\\"ContentCheckSum\\\": \\\"\\\"\\n },\\n \\\"AuditFunctions\\\": []\\n}\"", "DestinationConfiguration":"[replace(replace(replace(replace(variables('InitialConfiguration'),'#WorkspaceKey#',parameters('automationAccounts_ESI_DataCollector_WorkspaceKey')),'#WorkspaceID#',parameters('automationAccounts_ESI_DataCollector_WorkspaceID')),'#EnvironmentIdentity#',parameters('automationAccounts_ESI_DataCollector_tenantName')),'#TenantID#',parameters('automationAccounts_ESI_DataCollector_tenantID'))]" }, "resources": [ From 3003a1ab3abacd904dfce5612fc6400c3c70f512 Mon Sep 17 00:00:00 2001 From: nlepagnez Date: Mon, 11 Mar 2024 20:54:09 +0100 Subject: [PATCH 08/10] Update permissions required for the colletor --- .../ESI-ExchangeOnlineCollector.json | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json index 971bc021e0f..c7c70880305 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json @@ -59,12 +59,20 @@ ], "customs": [ { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + "name": "microsoft.automation/automationaccounts permissions", + "description": "Read and write permissions to create an Azure Automation with a Runbook is required. [See the documentation to learn more about Automation Account](https://learn.microsoft.com/en-us/azure/automation/overview)." }, { - "name": "microsoft.automation/automationaccounts permissions", - "description": "Read and write permissions to Azure Automation Account to create a it with a Runbook is required. [See the documentation to learn more about Automation Account](https://learn.microsoft.com/en-us/azure/automation/overview)." + "name": "Microsoft.Graph permissions", + "description": "Groups.Read, Users.Read and Auditing.Read permissions are required to retrieve user/group information linked to Exchange Online assignments. [See the documentation to learn more](https://aka.ms/sentinel-ESI-OnlineCollectorPermissions)." + }, + { + "name": "Exchange Online permissions", + "description": "Exchange.ManageAsApp permission and **Global Reader** or **Security Reader** Role are needed to retrieve the Exchange Online Security Configuration.[See the documentation to learn more](https://aka.ms/sentinel-ESI-OnlineCollectorPermissions)." + }, + { + "name": "(Optional) Log Storage permissions", + "description": "Storage Blob Data Contributor to a storage account linked to the Automation Account Managed identity or an Application ID is mandatory to store logs.[See the documentation to learn more](https://aka.ms/sentinel-ESI-OnlineCollectorPermissions)." } ] }, @@ -205,7 +213,7 @@ }, { "title": "D. Exchange Online Role Assignment", - "description": "1. As a **Global Administrator**, go to **Roles and Administrators**.\n2. Select **Global Readers** role and click to 'Add assignments'.\n3. Click on 'No member selected' and search your Managed Identity account Name beginning by **the name of your automation account** like 'ESI-Collector'. Select it and click on 'Select'.\n4. Click **Next** and validate the assignment by clicking **Assign**." + "description": "1. As a **Global Administrator**, go to **Roles and Administrators**.\n2. Select **Global Reader** role or **Security Reader** and click to 'Add assignments'.\n3. Click on 'No member selected' and search your Managed Identity account Name beginning by **the name of your automation account** like 'ESI-Collector'. Select it and click on 'Select'.\n4. Click **Next** and validate the assignment by clicking **Assign**." } ] }, From ae83594275ec1014132c8376cb4ccb7deaa8e0bc Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Tue, 12 Mar 2024 17:36:48 +0530 Subject: [PATCH 09/10] Update ESI-ExchangeAdminAuditLogEvents.json --- .../Data Connectors/ESI-ExchangeAdminAuditLogEvents.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeAdminAuditLogEvents.json b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeAdminAuditLogEvents.json index 793c1269b7f..a6dc0caac79 100644 --- a/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeAdminAuditLogEvents.json +++ b/Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeAdminAuditLogEvents.json @@ -17,7 +17,7 @@ { "metricName": "Total data received", "legend": "[Option 3 & 4] Domain Controllers Security Logs", - "baseQuery": "SecurityEvents" + "baseQuery": "SecurityEvent" }, { "metricName": "Total data received", From f3a24666f17fea8d82b8949498002fcd6ac4cbbb Mon Sep 17 00:00:00 2001 From: nlepagnez Date: Tue, 12 Mar 2024 15:10:40 +0100 Subject: [PATCH 10/10] Adding "Azure Functions" permissions as Tests hardcode the check of that permissions even if Azure Function is not used. --- .../Data Connectors/ESI-ExchangeOnlineCollector.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json index c7c70880305..e223a7bcfee 100644 --- a/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json +++ b/Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json @@ -58,6 +58,10 @@ } ], "customs": [ + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, { "name": "microsoft.automation/automationaccounts permissions", "description": "Read and write permissions to create an Azure Automation with a Runbook is required. [See the documentation to learn more about Automation Account](https://learn.microsoft.com/en-us/azure/automation/overview)."