From d946bb36b734e97597e9d0530ccd45796d547b01 Mon Sep 17 00:00:00 2001 From: Samirbous <64742097+Samirbous@users.noreply.github.com> Date: Mon, 24 Nov 2025 16:45:15 +0000 Subject: [PATCH] [New] Elastic Defend and Network Security Alerts Correlation (#5332) * [New] Elastic Defend and NG-Firewall Alerts Correlation This rule correlate any Elastic Defend alert with a set of suspicious events from Next-Gen Firewall like PAN and Fortigate by host.ip. This may indicate that this host is compromised and triggering multi-datasource alerts. * Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml * Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml * Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml * Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml * Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml * Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml * Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml * Update multiple_alerts_elastic_defend_panw_fortigate_by_host.toml * Update multiple_alerts_elastic_defend_netsecurity_by_host.toml * Update multiple_alerts_elastic_defend_netsecurity_by_host.toml * Update multiple_alerts_elastic_defend_netsecurity_by_host.toml * Add suricata and fortinet_fortigate * ++ * Update multiple_alerts_elastic_defend_netsecurity_by_host.toml * Update pyproject.toml * Update multiple_alerts_elastic_defend_netsecurity_by_host.toml --------- Co-authored-by: eric-forte-elastic Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> --- .../etc/integration-manifests.json.gz | Bin 22491 -> 22974 bytes .../etc/integration-schemas.json.gz | Bin 7339957 -> 7348384 bytes pyproject.toml | 2 +- ...ts_elastic_defend_netsecurity_by_host.toml | 105 ++++++++++++++++++ 4 files changed, 106 insertions(+), 1 deletion(-) create mode 100644 rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml diff --git a/detection_rules/etc/integration-manifests.json.gz b/detection_rules/etc/integration-manifests.json.gz index 2e6d05b8b232638850ceeb4c6b86444f8ea80c64..812594aa6dacd6e1910586549baea0aa427d52ef 100644 GIT binary patch literal 22974 zcmZs@1yCG8w+0G}1(&e61cEM3@Zb{M-91Qf3+@si1b4Eyy99UF;KAM9-QJS?|Gl@~ zdqq_r=_B7cJ=E0n^ek!kn>QacC@cUk7B)_%W)6l<7PdAF)`m6~pG_T|92qSgZEc{A zTC5#6`s1JOR56|ge=xJxbCNCtc@U7y^1a^*N~ebiw}NL_zYx2Jlhe>v8Fv3y>4=l_}J<5gEw zUY5V1y7avCa&as2(&A>ST;o2@cTh$9IP!3yO^H0%yT;H(^^N4<4i&Pp)&1 z+m~3(^V;h%f{2u3^%Ts3SV{F16@gf@^%Qo2SX>f_YWn2|4AAovaK-D0s%J0?VsBKV zcU2XIRoNU=kvefozO};9A*#}5tLKud@p~I1SWm2s%?S-^ARX?l$1mDfW3a9pURQeI#c24 zo1Kxr^A=&0^%O?v0Xw(2o&RrocU6>35S62$n zD+$Jr;ty<~=|z(u?JU9GfX_i+3yVL4nFz6q@5X*5E!}aiWUE^xU_$)ORW$TocHsT4 z!X;VS^K3i2#ISND{hC9{NXTS|MkiE3ywKkJ!25pROGRO?;15vmbObA4v;->xk>9uo zBELznhvmzFgO#rLH9)BGH9*A0IP}HApkD*{Gr;FYV(foNx4AJ#OoiE_l2z>D4p#sBiRYd_cYsb$nI^S&x2^}?UF!*m)j)rWRuZ~xv3t^DR2T-@tCFFbtU&|%86 zX58sKlmEq?zf@d3vG|J6*%maOiHmbdK9EAA+VIt&uq8^Q< z%d)~D485s%d6sB?7K(ycgq#?0S{Q#L&NS&&l939Kk_TvN2f~2_h~lGwYYD^p8OF*5 z9NOJqFGM2}nO4r4RE94x1L{7ZaNCuIiH+_8K0@0Q-@qRPjmy3OKKne&)=OJ02Kjk7 zDVJo(dfRsB8f`G5EM}+n!VVh^a;}mrow6A?X|*7J4UK48b<~#^AYWhh%IK<(mG78e zm$t$hT&0+rrI_-Qq^V@jac~s@En-<(VePMBDN%b#t#lxRi1txEQNpZKc$ zRjVHhYOV#*#4wm1J1Tx|z|X9=8TwVCh>FLrQWE4C9ue!uz@x85gnRM0w*YgUV0s{1*G3{aR#`bJPFp8nAb)efn-;##f(-~p`mL~rkL0S0a6)@zsh&Ul&oL~NiQ)zgOScvSIxiCs@=={ji-4Bz7`-DEiLoC!EOh>J5n&tC=C`SjFR;=Uzhu-}~XdcZMVdq!Q7HCyRabd=cQ^dFL^jDy@o_@P!dnEzH zG1|M-fN;j_>%1?*i!6zI(Bpy;oIW~pXDHA!w4H|T6+oH>kf@jyqIP2muEvDYCudFo zzNVEcLHeP}T}fb95{yZA%aduJW=(hNpKz9@(J_M{(|_+P)DBwJ2!hNNh0}6FklV5Y z|2Lq65&NnJDw*18lrL(%XC8ixvzgIP?*%B=ckS>xtQWz|9f>g3a&rgTr`erWf2pb( zU78J?0LlmQ^8{RXD)F>r>keE{pn><8hhVlDE&GrJZwP z!V^`j!K1XwYzQYL#Hj6be1Z<65v0VRYf*$5O|xBGGj`5;}>*&7q&u z{~DShoHqpI$XCx&ae0m+dbepa~!g8gJtJ#PEYFi>CtLDQ4{X0d1 z5dA-{FUGvq8J8H%12ARFm(*y?+fPKBT#)c!A$DO?V$=Ve_HJ0HqZH%M)FoB)rq_&Zo+OUodM@bSY@N-|- zoTA}%NfIA$+aKsC6gXG$gAHX`qU(Q&OuIz3tH^Kyu$r>dO4FDiVe8%IweIrFMqX6x zoaqgQTU^KW(TxZ5i<{@Og{P)ju^UH&dA}^b=g2WhRK%!y?5M0;)d2kiPn)JmwfmK6 z>uub0dg=`0SL4=)3tN3>mWD3lYwL53hfv%1$4Al$oF^wIk4kU3AeV(#WxNP z_HtVBbY4i;@qEUPSeM9eV7ZCEri4?pCiJoAZ%}+Lxda@+Gowq=KG?hi7()Cdm*kO^}Wa%6we;yl`-^Tet=Th5zLxTd=2vzft&~(62io-ikxqa65?4YDuGyx`- zu*Rw`{_*`7c<*`u!qy5U`*Z2~0>aqX1<2gfw8M&NuV&kbHG1MdU9xv;9Bdr(=AYIPt9EPSk8^> zdFz(#7au-uxVmUEX)EGfxu%p-sbATkrcBhl1c}L9&3Wcs2auQ{6M=-GKlK}lAf6g} zNS%hhLqZny3zASyg_{i>1Sm$LpH*DofOjl4>IoRj5`v0NH$e0{a6t#=^TV*-guh1b zne}z7D^+k3!hTOwPJIngUP=E@w#U^aK22q~Bl$l|dnbuie9S9Ls!n{K z3x`hULUY{AA6974d5~}2s74$YVkZenn4&GDE8Hw@>K_%G_xnlpVECK4=R-L2pHAWT zyB2T-9v|G#s_;yksqXLlJNNBL zl-qf@rL)84-&8|evQORPRN9v=xLofdUQ{HcwYgF~NODpEFz-vJG``TIPssX3M-x!T zAY)EA``JgUfmBs7$XXbfag^p5Go3A`4c;%Q8qnu7>Ix@*v~@hJbyD}Mj7ssKoSG;C zu}$d0^$J_oNzby$squ0AmG*0;HMllPc+7K}kiG}1kT_+e?C3=;Of13i;}xc%722je z3}TY$;^N_3sBX(Hhz2_88W`k!5<}8Hf478f(s*q&-e^f8DTOQ~hW z&;85A1WvoeSKM2J9Cx0a-#hUGp;2YXDB(30M?D18l*kiJfcNhibdED;&c41DWa`*8 znXnAWRA`e}p)iS!K?p(do{W7V3nsQ%{dWL#3g2&rWj8&0Id+Zv2m$C@G)Wmh= zx}P0P36o4OYY&(}a5w8Z2B24Z==(SsPFm84u*^O0<^owrn)Hr9r|)VUZmdAdDOesW z!^Z&9lKA&iMU6M(seAs7fX23Y-PM3!MYlB*%7@>No~CAJhH*w{`R&{1qPD-K&jxy~ zD^E51(#`$o8wlp!z)l084c3Tn=G3QQhfKC$`hJa9K9r4X8X|P!e3Eok`;-~t+cXqD zJSm7i>5_;WpFf(*TINL0YdeHIqzpq*OpKI-h| z=a#Z~ekoqJ)w87u6f;F40Uw-qp0j1eU-3RK#^ENK)rBscp6VpxhUEJwv}W090U{G! z5^og1&nmp7S_phAi@JI`;9g)E`FaB*6QewxYG^aN!&gY$#;PJ-%+a#u3f>m3^auao zoxJ9HUN73b^}Q9&*KC?+-10s(v`qA)!o`b;+^CQ{k-ZxaUC`FqU(4dppAMz}p`riD z_5R0y{L5sX#`BsBc*Aw*Qjt+d7a(9&Vn6OqMnLKg-MPl64`L~EfNy+SRMn#ZFCbK4 z*WL-Fi;Qx9jengU9~Aq*fpa$Y44EbZ_jElgoi9T7{VS+vz%`-BpI2aBS5E^RpOCWi zA4n;SY%Nr;tx|NW-7uc^?@fPgmW8x!cudGnBcvueZ3(@z*A^w@OVCoDOX5S8Vra6K zp?PcVwI!oj6H>1C*|KhiZX5x|X42qmM`cLMQgF-GEd)5X;I`*vIFYEpx{&Hqc(>P|i_P+-7iZ50M-#xst;fvc1YikX!D>vcF&Mn_;qx{Fj@rh3#7LOU{h72z5|zdNGcv<>A#>~O?FKuaY9-C)Bdf1GaU=yy=TwT7GIp1 z8wlJ=j~w7>_;d_eQ+kKVnls?*HDTzM;1(agQ+V=Pft9=T?$!FzR?wEFYP|AL7o?La z;GYz@3@$b5La2{f! zv1LNDYUUS1d^T3kkPS@hoPqt(E304s*}`mxgX(p z`QF$`6x_!3)+fR2<8~OZlp8#FKv=u?SVe7)Q1|7i=fXi)1rR7zp-77X68l6c2vqnD za3M%Xiw9&XIsKm*Q(sUM_Z z{wRV0il&GFK!j90C2WBid`L2xAv`wJ6j9R|0uq!Z8egGWMnQs+_%CdlqTKvY%cEZ$ zP1JlDQGo=)?f_Bw{$0&?Cz?Db&|>{lo73#=W4}URu{o|4ioXUrSFwU$t>4{ioRS(4B|P#3g4az1c~C4 zvZ2?_zj155`;m~84YQ7i5g5BJBgln>A)dLl>-V@D`lJD6PhY?dQIKuFI>f&pW7e5l z=MfaK?dp@Wn~m=2_RRxv41ayYkltgTf$I1UAeONQ-nb$kqv-jdj7=0)!%kqHh08kX zh=(mr6h`?$tRs`A85qn8F{%+I zu#qVFzD(N2M%*Yh)dr2Ik1t9Ro;=oWC@&TopFQ1@pw zOrax3Cr>_%qFlD}Zxm7Pw~-DpNO<=j=P77>?Lxp_?+)1$?8{wU-AEx!D%Ti2&miyt1JxsHrSye8AZ!h{t> z75trNHRd5pO+$F z*?;LgiXEduC9-(gF-V8yw1AR~f6HkhBZ*3FGr_FfA2iw#uEMuY6~P;{h!NqN%7zDY z$Yq1KA?soIUN70@N2cywSAWBUwu!w;oIirj4}6ftwUJD=mEdzXB6Wk-bj?&jDp+DzcI#bM#*jF-x%#SQ|Vggl{me*WaP=$ zK(k!R&$xfKzjXJwZ^`SiU$aZC@9m3m(01tZBAXu@eCpPswmEaf^jza@a{V+aa9G-_ zyybq5Ye+3B&}Ml~k+yNDA0dfsIJv$i^iwgE%#XW>=`d@>?B?-Hce5^e6A6>r(Ww80 z?$%jrQ^6(bQW|b_E7fN&*@>Cnl5*Mm`J@N^kAcrOd)Pp?<{oyCn@AO=bEIY={>B+8y<+;JR>%LIl3FcN)>LyZdz)g71MuyOf0WQDq+7-ZPAkX&G}H< zhz!Ts^y_*Z=DmT^1oPuIrDVC^PQa3ju!j+Y<3 z)|%qD8`G{+ye4V_$#DphOa_QIY?o5-?v$XGFh9K@X?eU|L=c~8Mt;F13JhO>)F|s% zb-^VO3?G7|yrVxq=O)%$ZcIMI4C;c*I6rXK#0Qj16cFE#;Hc4r@f!s=-Cidw_d!8< z#XWp@clbmw^B4?qr3U4Q^p;fIrC;V#fQKhB^i&PCi$7|GSClv*|gQj z?KN)PZ#<3^2R77*X5$9&1@|{&>bQ3bqF2u_+Y%;^dfyx{`8*q6_qnq_KY=M=vMx-MjD<0yYNiAnOFm65oEw@n9&%suS^Zt-H0tR=7t2LJ{3LC{Zs|3CpNlhj21PewF zCF|_tp*`Di$4ld{+shT`3}R$ElCd=UwkY$FnZ8-z7713ti$cOw3SKQhM*Oj#N@n^k zkw^Tm5~ySTtAQk*5 z5KyVhcS?cm7m5S}x>E3nImzBJle|LlQ)c{qeLFogGa=w`Rz24(ILI*lLj*BjS7*g& za_9Id+#}L>m`NWJySY1HH(qk)w8>lW>bj(#dQG=;Ed0 zJ94GAl!8^5Nn?=In#o?9qaqOxU5G_y+Fy3TQL_G(B_BkwJw>Qv=t~!8haZF2^4^(I zBrEBr#x4k&(X6^XDsl%|X@}Jc?FO#YF&?@srjs4T4wX_TI8awVrnUj4u&I^8+7Um- z)k|`In>FX+KCDu6?8Bo|V%hgJ^B|~F<}4s!1}XnbJXEPe7CWptDxDUYAYGdI|H$vP zq{sef{jU9knSrXwM29(s1g*6uS`2F*|F)D&@C(!@^DIIHDemDR%gT05sA}Ft+&N>SKZC* zfaOL1f{(bvZOU-?!;)<{an%=X5}Pe9-;UBQ7wvcKq52|WDs&+1eAo7fusf0Md#qmL0nNmWcUn9%&{0~b1~SObtsUiU=VZx7Ie?a7JJ%GIVttf zM^*01djiGMuC=3`J3E+|c#yeS;PW>@XE{i2k_%j$SM)BRioT z;zVwFB8*)=jWit|Op|Bqpb;iI{sx9Hf?4#!9Oh#r$Nv&zKUySAv9ahMWGUi=vu-sI zlIrW`#!m2(<3Nq_lR6>$~lKvAPV(--^D~BH79;KO5)dy_Efa85HuLNzY4E zbg#FhUPB@)z2YlpV_(n4Z+I`gtS%WwzfJaXuGjFsmm^&HHhKP?%i8n3T;Jq*eMN%V zLl}w)aiBOts3yYJxRCLmj?-NOqdy(zy9N;cY=;c=B-chFWHbsu8Vsz59!LM-#4v@4LG${<>#J^OzutJV~Y^CM1uvx^6oDYT;|d*egZ6a9(DIJy6@bg+It=}T2v3G3&=l@ae> z?ZAN>3@BR*{6f2`C0G9gP__|xK)dR$Rxb>#&b0=D)7c9ALbFOBSDyeVGY!;Ma59H8 z3sF;QXW(8_!?r7~u=~Bx1w^XvL{z6;1(E8AR0?AzNW)`$vPJ%O5bB{nOo|6oI~e1H zeG-`^M9pn4c}xldR96_QAq_WMJ3jOdZ7a)vzPeoURBQW~{@a#u*{eR8UBH!mX=iVS zG$mzv?`&w>-sk7^T>5;z>B~5uwXHRnesr=8Q3jor&%~1N%3egN?z%wqykI9ngdhLA zr@flMo}u?AYSSE5MR?lWZrWTFIjM+hwSA~BxxJcn&c44Ux;5!WAW~?xTFTn=AXk$V z@t_Xt?_))gNw~Sq@M>u`kwPzfmw?YSzeYc4J{&4oriUx>b7J3l#+~0~_N$B1>a$?q z4bp7UiF^pT+l-~zip}iLR~*dmiYgDQIxErh34@Q0vL?$@$CWn`{na)n(vv@c%!Ynm0Dv@mgs!m zB=S3RHjUsTImhjG&r=FnHvC|v;7q)Sio{lbEk4fi(#aEWEBK0ahQu5~d=FMqhq zIKcdsv~$gHu>oe+`6gL@GB$~@KF`lS5zqJ1%1pRdiDxyXRn-HQtx3a-b!y08p_&WO zn_f%^3&>&E{eUM7ekm1N3%>%lkV7Od!_*MRK`>g!@QO zGOaDaFK@;P;A_AYrB~3_M+4*hzp2{A3FGAKSiw>=?Uwxm=0`Zwv8QZ-&nOzLTx6p& z5v49dsq80QmSc;GXgyRJvodyeySuagati!p934Huha5dUc@?v;bumbGl)yzPP?+#A-V?p_YBceAyPUn*BNFe1`XYWCVDuK~+FQ=88Gt|ptB`3- z+fE+?o$A z(DPVzKMLLdg-|vFF47}3_!0aq8*W?TgEuT%D*h^*>gw)~pkAu_Sy;T(b)zob5O^@b z$5kmL-nTC8@z}2G2flQ)c08Y^bCjfOZIFK2xt2)@Soc7Q*AU#KT)6Ft? zi#}RDya~7xY}MoQF)U14(T#>cCoDK5t0&i7lLpD=gq*h}eD#{KbFzu14A;WJhxpia z{Omg}u}#yi>%3UV0wWLDWqhqRoUuZ8u@!So))k3Ser?0T?g_uba+zfNVp|Xnw?F}) zs*@pwIJF93w-c;eZ_K{0J8)+yG~2o2Ov1s<%MIAGGvwh(BEik04zREfk;Jh}x}+FB zKL4<>w7p&>PHpMZhP-}1x#`KG|68D>Y8%rdz-p!ZAw3$FIFojC{eWLqekPeu2iC(_ z$zNJ3ikGq_$A+pm>B%7!`Kl_-k}U~l^73yMjz*4<<0R8#xXgK zG9uE7=@3EkFc7GFFw71BiQ@#Rw67*d*PtUYY?}}%N+&b-4zzXS1j8g8Q-Yr zdKtecS{T+GOo<*vmgrt$pm>icfi)}&hg?lYS%ga&-!Vi&9%$hZj!3OP z;Vw;6Z#S{OrC~)YXY3c*O<%b=07T^q`e`v5y2Q!u7BW8wPP0=i>7o;NT!qR(Tyc5e zg!6TFQ80MA0)GR3Ig>3g4=-do3hol&HfCFSJspIgk30m)(>kyQ1Ns#@@s59yKGd@T zqdxbSjbZucLFZVQTWATUBqZfQO<*gfppB*e_>=lN&ZZ(sC`($nx2GIid}%}|*#p<+ z;rcGqo405}xmRageMa0JiTRUCnZYS-WD9yHo11F^WkH~of)kaOo4W^P!K0Nz5|x*q zs|hthFJYnPyD<{x++65O7f(iw={E+eQ;otMfDjDHO7Rn!b`_~&q6~`e|3y-AC(1NI ztBq0aMkxRZWpfKinu*&yKv@;-5hxW|Z7zOymS3{mh>&q6DkO!Dh(Mo}jqS^zc zLPHMO&EMwz59!CB|CR>*y&qphMj6T?=0_CNO z4VEkh^%K?8Mgihuc9=D;unf3DA>v~!n6NtLH1+pJ?L9#;5gDtPIRqn6i~}k%Byp?n z9qMSFPLC>?z&L3kKPA1gz9_@=QMP%f(VtjVU9BE^T34H@`PejHe4o^76}=ie8=!5l zuzkO-KHXCGu0KwXbDwyWvFhN=NV9xtikjWPwuK|dlg%=C!|7=TeCI0ajg8Brq4J`M z_R?}qlk@)kEt+@OU}VlSfr@vqU%E(X+mGyL_o?SD$4gQ;P#XZO|8RSj=$uRlVeX{$Wr3+}1+j)!^kGF20CPe; zxo6@s$7j#e)}X=A8@spkRlgUqS*e@c$|1Uqd$Le|06Fk?uhZm{w}hU*QGA0-oHFO? zJjeSybo)j8ILqT~!s+Fsw$H`NlE8@eNJ8up?h1WhqVq$~&cOxx-R2VJrN-qI26R!jSUUgyz5r}aP*0?O$k7+@nQxGP2uB*1)`i>CzxtLi5 zZ<(0asf_1r}3K#7A5Jk&%G7x48gJtz1jp_(1cx-#?3!j zkPM8m2k>mozGKbenX>k3<9ESCvUn00H|Mg@SFl*I_AWp)gk99e&G9Tqt7SP7x&y`E z$M;+-AGz*MEo0wQNGeqzcT*r)#nkvC8DYU#Va3Y$8)6|_#ju4#vxLHMNFwEnB;~+@ zm*U2%Q!lnoo5|btqBnsw~U?k5{q8~a)t$5<;^8~a%s$3p0aul2^Oyy0iP@hU4rE#yhm`qe~i*W0INNO#1l z|JVVpmTm~CgQ?4T58|&&Im}vX7~SHXv1fTwN&>8iS4Z}QX3D7#(#CiIR>YEjglc~P zw0BmKtz@cxBbFNbmKw)6N0l1;l^Vx7+m*t2l84WCg$xYv%jR^Gn3rQj|_BPG4t%&t3+ zhI){QiRAJ$@s*cgcC(B$_k{Iy_mAGpR=zK|+dlu?TwhE-pa(05doIYp+&5(Lem zO28eRBIPHWJD~DC55P~@n>6)QnIh#Y8{a6Pq)b~;sB|N434*Z##me-UgH{7Xzsnkf z)RYk`3MZ1nrc{uuirDhV+2daWDMzOa0#XO5lXkaQ=Q+I6^Y*;+ zR|@i#Ri%K0FM{PzO_u4gC_1yX?M z&k2?G{FW5fh(e852vWwNzm@$h0De}*LPpFIgltt5mn&#d6ifW^vFYUHdgw%?L^XHq zK2@{$?lWYcm!bd5clhSF&#Muq5iN_+U#ArTLzB`bqlCkLLU5)rbTmctyOCPC|wr%q-@V08XuWXw0B--sbU% zvTros)!GRej^e&`no~j)$Dt5K2Sicut=$~Z#`?~}^c{RQZSy!AJ_CFV&=05H(jNko9zU-=B~T%;+>LZS zj8M0UZPo#nZN<*DMZM|Pp46yb6-djrs^{8l-WR85dg<#eig&WBPYJISwaqVfsaIw8~5Uu0Q6>8 zhVR;z{MrIYdq2mnkiX_kmG%zru_gJs<17CW;eL@@VeJ^c=-XGA7TIEldgx0O&m9T% z_NmJ5@yZ$&E4w;L2W=Ufw@!7r8D^q3$`Bf5#%mKmS})n&FFPOM{c_($?0@`kN2T+1 zM@6=3%fhPR-d)!=x$5CTD1S{cc2iH2k1l2P*dZZNS0^z%yH*2<}Z^3vHmM_lmQWwx@ES!pB&gB>(BGtKs-nGf;yr zOLv+l%V5oV1TzV0wwQdROTGqM5I>%_=dKB{9*ImML6oQOlCS+NfXg)&u2C`%?KSYr zHB`wQ$=9tG49ynStPtl~3%*Cu;rvhy)+4V;oYOo8fXtT|3u6vzMB91R_L^FRNea+qOyB#t zHu_dU^3|}n;}%9n_Lck70XQ-EtDERJ^=O{T;o#!F#YgBm`Kg#nlt%Pe5&*Z{VSyb@ z^q3X^T<%DD)qM{@Z4QuiuyZ(#MGIb`$YYEMhz&@0u4wkXwh&2p zAo{FiAvV~uaJx#NsktJ2`RB)RipDX}G0-8;gXb+Cg*b<~sk~?)h=${eApOta|7$wR zHQV`dmI{FyL153|_UGBBNg2l15;vHjQ~!gjt$cR&zwG<|`v0=&owt8kV)|1wIXZ%Y zj!|xnHR3ciwwQo)7v@JWhjNah=-+BqCO;3pL&#sOS>w`JC8mExILZaFE%`52{mQ}# z8uEYT4$Re*bAi2jPW#U1o!+a8+61ih*j!XBbN~CV_qfI`Cy)|AZF@T+b?$I}4%WkQ zWs-j7Nc4h7>FNyKwiw;q>>xaI9hDomn;R3;212dXtAQRw$y3Mps+4C!Zce29H%-@^ z$PVG|OqsgSS#-1zewdk}dB07Ow+SDx_CKzTbH<2RSgq^D_Oo7~L+~Gn^>TMOAzM-A z2wHhjqDrMo1$Wpw(84?%n@rYQ7433Nn@pN0Uj~>Db&Y1qazu>f;Vk8G%(2Z~4reY* zQNG%{Ii=p4Om-|_d(%0`1C$2xB69p~Cb6Rk8f8cDZ~x4c`6A3+z8tW|dZs2%d26Q4 zF-jKRRq+lfw@y@?#}6lGJZQ(X#kT3M+1|qI7+H3tqMsT%BsV{+>EXJTOP{-+yQAy% zk=9FC&cx1moHcfO=*Irz{B9a0_2l(V1`YrxS8T6b-vQEzv+OI^a{#}5K;_2g)`DBE z?OMLDd9`^((rmM~lgBY43yE{y*zUpi%00YB{KuU(29S2uvjt1Ox|1v)@c(niJ=J51 zfnBPmdfIaM z%9 z>Ar=~P0e3!+d}N7hU!(fZV}FZU14z;&D&C!uZ_txTHZu0nf?3(-}E$+xqXcClz8{( zpk?M`8EqoK`R5jLNcYHkd)s>9<&&--+6Tu<{=owa$6C@o{`S5a8!>|Ew$l9`D_&yR z&&Br+EP8ETH+F8GA0t zv#_YC3I@t-R!EVuqwT`)2x6{G!KUo379{7)W%WR`#UHl6%gb!lu8zVN42+lFnh9;t z3q@qE%*Fz^)9PTlJe~yGG(raTjaJ~dQzzO;<@>5HMvyrbZx~sh3LkcinhErowskA+ z@3)_-#`CGiPeEZ6<9axZw z*4ay7KkNFFL_qU8AKYF@E!o014SAhCn&ys~EX#^aoh%!}$CMlpJ50=&OqgT>piZV3 z04E+^ojr>;iFm}x$9j$q?0A?{L{g{Aqi#!|Bi48po_PxK2PH7EgGUF|1v$YzYZ3XR zNuB_Pbc#E0qI~AoB*lv3dHh&}Su(-s&Q@{8R&iGR$@T2do{__)U|pXWq?()<3O)s; zdNKY8@3+9k!9{Jx;h%5Zek|fzfbX*~B;m9srf`Yr3k7GCB!6AnNdmQ$WMhIQKw~j^ z!8gzN`Aeh`ug`!NE=M1I-YR7VO;K!m3lr>q;&|s+648XND1pq7LmU@XC!qa&bLpJL zW3H%+#V(`bhoc%(5E72`b3ccFdJ01^Q<=F&A}jbCQVUy&=|2PZt3shHP)$LKC@SW( zV7O&W0a=!oxuP`|yQm5RLy>eA2_wkq^G`L4OG2t5!SIw%ZIF0%5i6_d8RMg%Uw*%D zS=}t(qc;^?3=qKog#Ua#Wp$nN!O12mS|#0MQZvJuM9_=BsuiiUoXSf-m&vI!A5r4= z@OOtaz!s5y3?Pkl>kJSvdrJ^&d3pecWA3Mnx-7pMzO}pI*-*svX~_M|%|VZ;jzY~m zlwI;sD>TzFC_;9`i4+UDrn@lH`&akaz#7#%ZXKDJ+t%(e&7NNBP<66yBxXV-N5$$prf|(kMTP%!(+^iYbGeEV|GriwA|xROfhA%VyLW zcLPDG`F_U-l)=AqtFY9BY{XcjK5>Qid+2&yLM;sws~gt6TZue4IYi>rpeW zWdEzD)%cV1xmmt4^DTFYtkDfE$EAClv*aO3PjHjoAI#-+NMRG%l4}TbVt!O&LNq;U z*)x$K$`lY~9VoS|fYctuW?w|pJx4-)Nv1+Lgo3p{6B)bp6H0q@`1CSQ2s~|7GK|;#c&j>X0u#4py$dUp*{@ z@UKs|EZzHv>l&hc-sXJ2c^-u6@YGP~PC6qpeI}+|YjfK;etrFLc4v9su=e%g>AZ1i zaWcZFiL|BLC()L)?5>5yC=|o~!bgz9Mp^{zZjZs{s85;V4*|PnWZ=AbM5Cavu4qJ~ zsIYGDcLGaKYPa3q9s$pAU@ep8a&w#d?9GPhMQUr1Ise&JU*gnUigZhp$Jmv#@;9`Z zrlC9x{a*bCG+z#8I4Ld3iEG+YK}kBv`R5!}8Vh#Gh4dPDDXrL?BY7=k%2L^hYsyk# z)ND4VM6sCb%KuC$Yx%{f#ngC7e#x{fmHkyKU_l&L!zj6sUjv}Dwv6(K{Ub81m2PS6 zGl8Qpf%6)gAv1>|w&qDvTS!uy(&8abEh9&^tAHf;|34)~DY^46r1ZomiTs((Tv{dl zf>Z8pzG_a1!;y?xku77(=LF?CH0wBGpk#91Rw zKe^c_M2i=VqKKxDl!h)!ktm`jhA#<=v6KoC$`l=^kP7b*3^j_OVSq=b9PIFOBaOsD zlS1S)pyZ9i@@|*HR*=H(QUzEF#`h`{!xijhY{QfhDL4woL(}<9%kBBb`=%Tf;#XiP zDDx7ZV#{adx$>;if`w(zoZ6LngHqP_qVioSdEgaPgy7rFb{SmZK_o#jKCAskLL`MX^h62^Ji#6z&zPJ{C?E!H3-{i!dDwmb1|UHKyQ4D`kG!|$@ba8-_%imQ3~Dy^FZ1Rri{vd+m9~&PM#(TMfzRlTZs_L zC;%c`N^QEi6CrROs|Q6ITZAl(IDsZXFwRH=#+Telb#JPuzd{8QUUkrLIzB4=-X``# zF>cI<$ec(NX;Q@Toy(%#3Kc~()!_;i7L+2Du6;vL70G9fFDytcGTbHccrXx%5cd6rr#4pUTZY?(#Evs|WuyV!i`A%y@&%-qX*u57(X(|M zigF*$ew!F~yVqyMoxbceTMl`}n}YtcbbC&$r3muN4?T~Tyve4C&dS5T*f#dInrWvY zUzmUOc^2TR()0OkaU6WUzasm*M z$b|gJ3j$$*VHso;<{59ag#E9r5o?iImOhWX9!YHxqYcyzORJTh^GN=Jt4o$cN8uDd z)Bte7hDvEhwn-nD79UlOf<7+QL8sLR0;VO z?DdOiQT3P6rVz88$<(d?r;F>3hO6uP+Kk=>qXf~38V1pOBs$SWNJf-VGbTa?(QAlk zA?m2n+mJydL`(?L8G=cO-aCVQ<9VO;e&723IcMK}cDv`^waz+w{q}yZ*~q-xq6I~O zm=r}PIQjDFGEm9+6P4RwH@*J*`<26`L(kN?olK@J^d>$pZwXH(occI*UW}jip8a-3 zAL2^`D|P!H%1p=G*YXeK{I2Ej1b1!?>OB{=X~T2TLd+#sE@y1gZyENzE&e%ilrm|F zRPJSe$ z<{8(UQ#WSDb_`_xiGELIRh_7~0Tz)~J+%f+U)%WDN0rl1F}Q`ST6!E{wQu?4*urWm zjn?Mk7U_KgkzTwJ(kGVFkexQGZwv8E3Z9?fsBP#ftrCD7n@!Y>+rIf<6D3uU%0}=w z_986++K0YU3<5(C=5TcgH5ft)E^K=#CJybpYYyjuV6Enw4Flj#kSHT8!KI}YHf_9k zL#?mjkEL6>-2x*08W>{X* z{9}`_5Z&~(+maBrQT1-#RoE5sbN6gfDk6`}J=^mepjg?jLjO@Uy4ZL?@TLjMTqDGJ zMdYW=np}xm5R6-7NZ5Z(Bka;u9HSH-QV^`anBo83t(!BjiI2a#(x(Q0HTvYszrNU- zB;Yc8H%U(CV&B+E>7Zr&{|+^nJVd`weVSpPETJxP7Dnkli8B?1V(sRY(|Ynl@vtIND3m7aYw|Mw^x` zPKBt3it2y(tgHx3SJ6F>`S%h~k9+3ImR_iIh>yiAopp{^J+`eF-Z~AFG0PtdNt*5| zg|Gcr)wh{8XIiL&y9NcZm=S8$9(V0m*wf`GiK-mP2w&_kKJpx61vigosn~d-B5ygB zpt-BS_AQQI@_pepA9rdF8p9$7kDqfjtsL0iFE%ay{Xe0m{JAbM+ z8kN!I8PS?sqGYT=ic4#ct4|=Cl~Jyoi1e4p+G4!+Y`W1iBlLD5zQ_N-Z%(?Cy*VoP z-Q@gqASy|%q!@g8m`$CtRDlT1U4k<1hz+3gxC>f%yf59Gmw2Dh>#xn$9x)u%4y-ru zd{hl8)7$Ju{{;p3!0IG__)M~5}7z2$o#l0}AWWtd`1w&+P*~9_a zn(%Bul8~v#DD+bv03d-OG(8CPED`O*KiBm9sX1 z-RhP7`{qrNy{_k2yxOEmzzUZusc>pqIgVl=*1ceuw;3~} zfz(_}DSQb8kMV1h<{~{`($KP;P-YnZKR++~A+N}%z^x|tf2FNV@@ zqa67qgk69ha+H4AN@MQ9f@SkBe=e46FU5MO@hy}Wa5W$E%e)#e(@>%U=>z_hTXNC5 zb$}fXIhvl2StR<=Ax}2y$j6eRX^=f%+`dWQHcWg)gY5mX@=cmGi=Fy*VtAa{khGe@ zoT$ve)Zc4s`Xx5b=2clP%)nbho`e3Spv2FKBiXn3kQ5$Y3tGKCEc*%f3W*iyL}iqR zGu^i<0;ZMo3C2%zQ+g`D&(cV*3{}Wtp=HxeFc@wyV=;{H(lwJ26=T+ou|;xw`fN(C zqaNk%2O5S3S%n7uGqPq~-n6-}b=kXV``ju^Mcg=VGs6=z$|}E6*E71|Kr}1ou1IGi zmxWiO>D?_a2sV+3Io41pyv-UEZeXIgA}XXB52uF-H!YWcD6lW0rVAK2Vl>tgQpVXpI*8W`YyP3mCAGTO`0Q)V!Jqm7C*|73NCvu&FKe+9 zed694Pmoe(!)&+Dm>3Zy$lBo{YjlP_zsGYLZUi$U;-3Dzp3eO6@H58YW7q*g=Yab5 znXctQ)T4La)oTRqf7w*IbCwws+(?|k4a~hY`7I5 z0}Ia@5)V@%tA~Y8O#v8hYYKR4rWrFN*)wPh$Hv(++!Kx^(E7r$3HA&o!m-KrDdEN` zH(WKjW>voQsM7nv_8HiYRlW=lXgmDeXE2$3eA=2*btMAVj5JOu$ET#$M5p;pro61|^k#_n7xBb&m( z5A%9UQzBylhQN5c*ul=`@$#$ju*d#H=z>(y_eedxPqvh zx2T+9JX>_jEa|_{$?r*bTeL^EFE7D&vs=^Uy3IzuRu`+rry9Ah^&Gm4q-c(f^;B1I z7L}@b8(lESOZ=W_VoxjGY#Ue`C)}<^+s0kae|49hCqMZ`@6>EE27l3kwjIN^GNPRo zF3yr~&!`B^sJL=}=YGPo+&?~7KSQqj`~-pFYFio9nfvBpt~$ zEWdugd-TlbF82!U2l2&X*oPSkK-oR+c$yE%xMEm^_G>q?u&3Bg1Unmi=`Swyc zl)t3r^j%{w4N{A-h>>r`ks5Qaj-}Eo2JBdf>*2I$x!#YyxM4dceM{{GQ>;KO0a_bM z{Z`MBT-I)wTkh`v3K(%a@kwO&w=wq|J)3t`V=3vxvH=d$BKl7Y#|EPO<=DnNiG-lE z5Am(V%nPLtSfu%4qNnk_7P%QM5O1xU13D=|e|nsK;6<-agJGzy@2o+bpu-V^mzy); z*cJfFr^346E_B{p3VeSB8uhmNVdH&QRQ$k%bfbI$wCx#tt%>y@k0a;g<&xUe@u3IX z^#8;01``=~2ZqS!4f4&tFn2jKf1oLJ!<(@<%~YpK6<3A zw7qz`UN+vUY!ocKQ);sriaaNq{MtN}O#pMM;HFt~+S-EPrc|I%vdJwTN zujB7etC9m$)1!?vB8@X4g^X$}jDD(ffB1X!Q-k|M{*eO2*S+;U54GUQ>iM6u0RPU+ zkH@K`-d?9A_%_-pK67x zmL}V~m1i)&kBDBgDWsCKbdFpr%w1E;y&7$E-w&Byqg!JZh0=GEx$)9cV@S}OH;HBj zg*B<CKKC|Jx?aPqJRmJ0m<>c^6ma`S#1DV9L zEWTC##50WVftelxCUR!;^=K2KlfMbd^fQ<^Sw6HM1bUH=m4?y(r(j( zD)5bqlHfZ>_Yjwp>lZPD$8%?w&zzNrRVQ=tZm%r-7R|29)bYwvXhxPqV>CQs>&6&B zcWBKrIEqLs`1;JXVbbzCwq(Oo0QdP*5C4x@Qp-G61NiS&Z){Z&E{g37QRL-^UekM{ zn@>4DO#Hyw*Y)a7?efPG@6p+maR^$h3Um(}1g^iKsZgWzL8S7H3;(G$xm|o#+*|2>RV=ay)MW#K9LgQTltR zR2GTL-3Fld@TIgM zCXq)53}IMwVWvx6`#!fTxn*op=VN?by#V@NbvzEO>EFN~(KmL2Lr*T~vB?sDb~kR|D;`J)E%)b2x6H52DZC_i%)b80 z;oK_m*}yVA`@6w;Db76})`dehDIQ7+5{DZ=$*fO;cDQ&-2Yx_JmQlRkOtFaTo1$T` zC~)+bkX?+uAr9<<3#W7_A}oJ;#9gBJU8tuc#DY#GC^=3|08pyPEOr18I&)!I0Wf#a z5Ouf|O|A@QX3-ieg#pXDbewvUJ|ZRw=X{%GL(n9`58J-W+|Q}}fW0a3fG20Us`KRD z{=1Ft$7Z1*ld}E}>o?cgTzivAq*NO?iJk1gbHv5@fVLQg=dV-Q)b^MnmPsd&-#LH1 zDoUdK(7d)8c8}##6d;gGg39bokr|Qob(|0tE}FbGiKO)p@m3MhR$v%jBrI46#{}@r zc6Mfr>ZZOPlW9gIWkPqJm09KIVJhRv(6bTy#J^bPpz`i$wOTt%0!zyX4lIKM%e8vZ zv`Wx=vypoDhAYQ6^A1$#$Cy=Fm797p^fEYplTQ(mWALDrqoPf-i4d7M8Z&Lt6^ch; z{+&LdbpM074;p{*bvO_{{9-20_~?K;`rWw%RQZ7EuZY#BamM{jkrQf((4_Frkv#>o z9fhWIFP3u&iBL8`sDA&v{^$A8J*gs`)6kw266ch1SVI%a!Ys-km-A3ppt!FJYnMtV*%QqW6 zq^VYssn$w*EK-3^Da>xCI7OtG!B-TeXD~3dihf|YhJD^47@@}(;or}on~_q#Lpz!v zdxu3fMd7a5A{5m7fV0R3EtBU2jMD--XKEr-UIrJl^k~E_6V;0Zx#TT$7p?fIGJ3}m zEA)ee&5Db5xVTt#mkbOdl;d^Y#1lWmyY?>$E-#Fq#BuU$g>;bbIe}{jLQamrZQI22 z?K@iuID3vfez^6)$H8z);r;dAZ+nA|_VhmneYS5_s4HZ&b=X~GEIdXzBt7w}3w4T* zH!|blIS!@x%H1+FUo?%UI@2GLTiLl}+sfMpWfN&J!`!GSjD`zA8g4-DY(S*zaG{ch z8y$BxdE}A_S#?Xd%E2ynhJuUw?kf_E*@|LDSjbJv3mcNNdVzySfR*0(AIVgTGvn`4 zkwpG1TCb=uW`&AsIlh(2^cdZTA`b)3AXfl$47(VwHVO?T0&&Pjv!)c5xKOZHS_!UO z5NS_(VAx6Y8su-Lc32nvdF@UT-Fley?Lfa*G)xh|wEXm2=h=z01x;FCER(N+o~oN* z==GA%mGi_i=KB_B1BTHGn_THK3!aCdiy;!+9}D8;3?yA#~4Sh3>n?(Xn~?)|>!T<7~U zYt6Fzo|SRQ$R(y&|e5n^r98TR|TY8qOSH7V{L6ON~s((+!wvZzJy2Ze~wt z=T{vvV|_Eq1WjLgh?q6vE{{gc1a#8f&{F&}SQD3JebQP9#(pg)Wghf7tF*q-jrL}4uRcGnjyUL!6~n9XA6bl>lwLSr2wf_0`CX&mwIa70`wdE53^w;nXUtv5)R433sJzq|vgtUz)CjZbn4Hz%aW;#h+R-E$ zaV34Pd|A59NVLTaG~knbE%Dmuz77kr8_xGXOu=ER!N z!iPCX`45`Eh_3>u-Z8Ahd?6Z#`9hf{Tm_vXT=f+Lz8*JTP^4(g@R!ink*El|E(wo- zFGx#>0kjZC(5Ja2kY5=+-cOIwaKDyje{MJ7*F=nwmeIg=sm{3)GQS!!w(5J5;|Eyj?$`P0iSY}g z=l5dOdHwJ6#fv_N{@;r+x_qa}1k#dDd*7~7MEQA4qfWP&>{wbFGq_$?1af^mydP#y zPrDv=`+TNrUf4RcOi6ZzVXr*gW72`UTsT@fC)gVy7Y98##FaIN;?KohOZ;nS^Ww`d z?zd)-HaKp+>C5e+?yUNewZORTt!2}NC*KC9hT!Liz9Qsi9lZ?HC4-+w<()n^_JaDl za^^|7JJS-AgO3kS!}lO!J-vz0_1t+06>o zxJdSf;Fl8;xZ%%pX}99f?Vh7W;*Wm3udPeUN;xV@u!T7i8aPqj^C$)3RJ>SG-aM!U z;hel!qBA5q&RBY`bRlKR?pJg&u5?2XYEyfvQ(eV-xe-M#Mg5q$B{UPoG(jrW-zu0w zj!0?u)Z+J4}PntcL_ri7^R#v15G)}r}9UmFKK_T3ZkHk0~5|Isu*z&5!@eBeEQAH8t> z?`Y^7_pQoq&15_zXp{aUlm4~M*rr$Y3|hF&y?Q0sqa60iPJ!mgsQS}5!ykQb3t3xQ z1mgSaxBF@sFzoD-v=j>b-nM(~g`_5KYr=nZ5gdMLd>J{i_EQ4Z4jxTDwemq&`sO)B zcsorFII3A_TwAm9tiEFAl{?${6UB}n-gNIpjIpjzxuum7ZFQBA=klVL^NJXJrYJkP z@{k>(byfCCXP2UuEQ}jJqzD?9-go=+Y0q@ejSYHyaJ&I%{_Z#~e|GR!h00^oZp8g= zgjvv$NgLjlAh)IaqvRK+o%_iKxFg2lnNWLwf!Hh)lgv?N`wm0k?cowh#0D!SR0!gz z;yNCphaUEqW`;F4E%<|)fLSxrqG3e+q=YOcdJjGIFU_`{zLxMlmR)$-P$8&k+2n?M zU3gxIAyA|5I^=0PeKp_RRl!(jDzjiZhKO`3cHz-Mib9W$cYZAE+%yU%LBsN45=Pj8 z!sLf5h2hZzjQQ>(xEO@WKMRDabyg#itDhnN#8+s*cWeNUUv|l+otv@v1&W!r8iA0V zbZeTy@990rG=2A`%PU9KI-3w_H2}LM@w#0Y=i1S~AkVg16G6IwGd-%?S&RW=S2h3w-OME`=!_>W&poV*$_OkU!A^K;^)p(i+%io7VX33Bnq%3} zH!Po>KHSj{5Q5@{4D{-d{d8%XScIj{#vE&!C}4`7BAeVM^mktq&(k!!cH!g(o&rAo zOYW{Lf|h3)F~fla>;EQ_s-MLNpfvgv?8mxU7^nL!LU@pM!s@bJhO=}PLfa|KALyLr zcH91yTI%#^_5dN|VZ=h6F6zp1a2I?o7U)WKun6flzYTo>>g)92!E}N>+r5Z_4rWAe zU^4Tjfj~Izv3>QkePJD#^!1kmFuiiy!7wbJl_B-N3w&n`I5lXh8g4P5^+Z`Ibyl6E zL-nER+>Upe3M?$sn*)5izX|59MA7VoMB+09z?CfpbnPOf)r7*I;XxN3kwW>Lbkh2N zV_6G8;W9k4!pC8gS0RIh&8%`tBx3Qh?y81{&9rmOAgKy~#l2@7ksI8P&h;vY=}{gT{93Tzb|)%aFPqIx#$B_{sGY z03fWYf>w9z974h6A3L1CY$f*j*wg@~!5?!nkFihevz+ny2vuTiqiRgm<4mmC0+{Fh zKceyu5{cXJL;{r`2IuaU8D|ae`inrWet^Xk(#>}-$c!__IgECIM|T6u8xo5r7bHK4 zR@E*!(wVE)`rlk5xU#i?rrocIXFjG~8Bq-5a6JGaLr6F|;-D^Ys&{t-1n>^~2*JP+ zI_d6S>P%-9n#os4;8Pz}(HTsa%Lb*l0%0p&$#_p*#wR`yJ#qD?#S0`({p?@#b0=8N zw{)EP`Tg{B9!)_(UG9~npDX)**$kfZ+P3~6t~A`la&8Te)F?jpI$B#B3=$2DO!9r9 z7m{(jGmE@s-n4?w58aX{cDybSa{9u0y8EI3{D`cDm^sny#!ud%!KD)CG9vYIx(25) z1fs$$*k*nGCccSBKo^0VeV}83hf5&6{uw_x0p11pGi}mjCO{=sAEUO$c*nWcsL!^D zg-`wW55!uFzN2CmoU&vjvfm+fg+@hQ`2R~ldExib8`qa5Grl(;PMNG?fFo_lyr>}N z3QqgY)Dk)ngk`(h-T`-+*}qHDpX64bVi6Y+vb6P_baV(^bAE4qQA`Wu{Ap&e!xdqx zUMUFvU|jp4a#=gPoZRv9&`{Z&wzSUk=zgyG_^Sc$_C_+1>-3~mSk{ZJrRji}zn!=v zRW8-SVQ%%}>4b!+3EJgeV{&3-tJ;T%%8azI3^P6jaVUCY?M7K>$H z6E3U%bCAxSeN7=-aH$zFSlxJlLtv=`v6s6UCQeX_<MH(SBOmRG@zcvLL_6)PKp+_X9y z=B`SB@=oksFd(N>B(Hb`>PXBiu&6)OW6l!^=)%FEi-Myu+&x|6goR!4rQ40&P6DbU za>1f4lewZ^lMYE%++ttzprxnyG^!R8JMqkIsrK#<+`V%p7_@Nc51!i6c~k7vc>qt( zB&jO;*YJq(=nw2g@LI6Zuw2+R-?13kL`Xl;G{PsqWN(nMQ@|UgVkA0&dLn}vLt%@HvER~v(`+9-fYB!=>oc~AIMwx<%5CSR?=)h5|^a6r^`YT zmm;%6rtkgdYwM?tqgptP-gQB<4w%{EZRRz8;W z{szSjQ}+))z9HEpH1!1H_4MIr%ItgARSyt%Qe3Os<0ozhrowUFE#XG;_Uep{NUXg` zomoBR17O_4rIe3WV=JAVp@rGU*83jwx)+k>zB`<_^KIMqvf4{emA!|CGM!q#cH(<> zqIP$Y&-{FqwS&%{DnibnLF~3=0IKFMf4aPU#Oduk zk**qn)zJ&b=$u`HCH)f3rJb5m%kBtB7HMj5Z@!r5p*C36%OxadhGo6ApqQck=m)AL zjUR7N15%}I4#pVo|G0sv;A7F+4hFfZ7@FpdCMY2PV_e{@-VCFADd-%Rl0E&3Xr%%6 zw$qg8hDBE(A%CB;s`!Q82VO`_40inxk&=eL3YgeuXS0O!6-*xXKYD;)B3{%Q>IwNy z;Y6~Zv2c<0)ho&d@-IfQ=dk?$E2mXQ9Z+8Ff#xch5iL;Nn@Cx%6PjcD%LD zKB-D^67wCwegzacDaT?CbX=>-Xb@zIz$oL2r@j-?I!S2m>S285earTq@w`1TfqxmF z9@Xx(a|4^68-v}6CdGsH8cVr?;SJg6CTkUP&uDu@!qDg2@qXNdKj{0lOlOW))d?I} zae{h*aQSFgqan)xV<pKR2UEYZ^V)dB5vF;kZ$HmF`#`@3fovII$e$!`d9oKL?`C z486BjTlTy*Z_KI)u&;CnudbX1;>&%|4ZEp3o=3jOzvAbg-3IJfIS)?~FDK$8 zS*T$q(0X`O3?mIsep8>hymL{}*Uea_vhV3}(bFf)c+tNP@3ul%GFZ@C5%qjfIR{x2 zU3s{C_H^>Z*Jup?w%gp=$X~8Xc`-Av46eIBRB|E4-*VA?akb%df`p%uda-eFm7g45 z=(`#ZMlo6d8*aRhYjThw%39no3)x_#4m+X>Bk41w)A) zPUx7?$BuIoA_^QBHnN|=Zf^dF$K(91Cg@S-W2Vz={)o791~q`E52yu9iJp;T%;g_Q z_9iQBdE$&iFsSWge+eK`$YD5QcrtMXn-Xoz4ZL{u`smh;^(H1}24IY`%vKzmdlF7k zp&fba_M4GuEa#7m$3m{Wr;#UTx`~Bs#$6LFGZSzGN#neCOx`olld~uCOPGZQxYtx; z<+yK1;6DB0*$Q&`3@&6*e7r62_Dc0_YlSs;U!LhE;UpHaj_gGi2`qs7SQuBr;Q4U* zw`IEdJV0*{Etp8E_e4q7`d^^)Chd%u-GaB*hEb+pW%X~H)3}BviS35K>u6cR5_I}M9 zyT@CAy4v>C#o1CkPJ+dvkh%&D(%2$+r-8J$wf|bfcGJ&8hNqJT9#_Fl{5#V~SV|b+ z|D5o~)o;1xcR8bYwC7(U2lo8R7AfnnRYISWZWS}82R$B2@LaaunjXAuC8Loza4Fd` z9Pzt$NC0cB9=tosO9oMZPhjw53oSg3w@nV-ue}Ht5BbaBjQtB4#J_zG-k#4$wu>2q z2LEjuf}5%O&BJ|Le4{Ddz%q`bUNPdgi-u>6hy5-N-85YT!1b~H@1DIxO0e=KncE!E z+ZJD+=f52-A1z>?`PN-88I^F$lCiAP$dqm0y|jGTVCSu*q_u%q*U}n_NO>iK73{FG zI1XP&>#!v9?ETpPy34l@)m<-=>Tu#@a+$d^X+Ds&3c)K5Mq0v5Ku4U4($dA)Zq}I0aK2f+&lUkOWu1|5QV53D;kDv*F1@ zN(U)IIah=UpFoz2o`pzb0m&B$43!B~q~-lz9yVdDaYGGZxUWM-xfjAk{G26F@M?jP zB`_jt#+N3%f7Kv@4EdJ04jND)OV z!J;Y6pVMLl3|a46)o6Q4H7R{`h@A!gl3G_3EUaaanW0rAj|;}KDTA&h@SILrx3?M>!lMCgfYWxHCTQ2F2Wgxe<@ekB*Cc@|n;U6K_X@m)b6LaA%a;a}j zAbYE`cHRuhZwcx@gqI!7h7Td!+E7UNx{M?fF`)5F=2%uq#RMZZg$Z_qVZw!b1o{uf zvp$7e6wq*ETG_CV3p1Oh?Xu7$a%0Mxhkp@O@}Q+d6*tS*T%XztuaWpn(v;khI-{{m zLNys7IV#d|N$x%Vd>(4cletnBl}nQ8PiQbRZ{5z*E%<13Va3++d*^i3q7=>TM$|j! z`P47D((lffQ@=cg#K1gG>&DElcHm&XaL`z=#oBD(Mg8@5#8ip7*6GFt+5-HAW2hc2 zd6jX>eg5=`ax3||oMQ)A?%SO5!=5UND2A9>jz>@q@7u?1%+dHjZWV=1IU;yD0Zut0 zDQHa44rpOBCE-whA2p8&I-5zdp#3m5bunXZryv#j(dpJSHgJGqiEUrlRN4OLZ(&om zCARs%0n;WkXXu#0n8B&1o1zw~s&-sGc@iBP^iqA9*==t*X1s6u=)wBtAFhXCrYnz+ zxH6pC-fdH`Z666Aq(xSY&IeBM5E!LT2GSHx&|1Leq=iW~-QevStV~CoZ){$B+z)`B zZ-7T`^G}%z1|GF{$210U)21#qSz9R1J`k>k+?K+o;N8ul&Nw;Zk*+40@GYo-Gli4sd7&ql!^#9=p(FaZ!!q;SALddx?_zBpmZ|U$~Bx6B4yOWnX!6 zVF!`Wn zXlDHMQ*xi>1&&H`cMdQ%5CR&Rym-Zc zEHHh}UF=@I9+t1A&IKLOis#a2!_3S#WAeB@cWj@eqQ`Bnn&p6m>Q`~Cv zcRU7jov= zroJ_M&GiEEGrif_J-t=mtacW7h^)fM$;{yJ#2j_Hsr;1}TxI3-3jRmd8{NrKGIo@+ zYH|A{+uNG{c7mXO+ySWkoDlkWlJkel)kRC$L_}#*4e^Svv z4`YSWAVCej(k*xXHz@;>+IGQxo!&Bs_s!~p_`W8@MAv@KgE1=aS))vme`2#n@iKtN z&!j|e<1PQ&ID*K=IP|TKW)M_FHj|U{M}$1X9km&Utz;rsu#tm@$<6HSz`FO~U~QV? zeW?v>MTOYX$7TCK61iTtS>*PUly8R>cs|Q@?`QQ0)IXy&dPhiF z;8c$??fbNtncthuW3I)Zuz}x_-0)_Ym&XLX&E_6rQiY&SwY|M+dkeDvj9WBUOOCpvN#Pm3z%bNmi9v6 zCpoIe=)Mf4M(`%BzjtA`ALeZa9~0#6kk&p-hlH3D#xnk~=!yYaAVOx0b=)QTik;fhMU;s(24eyP*6WK55O0r`PM}A4EbC7# z@)ZM>KnRT5xS1Svb|LZ=W`cjFa^$H0jwse?h z?G*^czaLePMQg6}o5;=VWF`2FrMyUxV(g zc$5)Q#EqYau)!7XOtmEd%=Wib3Sk1VsQC&!lYmiH=)86E?8tA6j>qdHp;y*NlQ#TU zKVU4R)&GyBgrgYUBjN8FWBq!YFbEP_Uz)LD19e|&#+HAfjO+3^3hRNcix zW`5Z)k!neXs=r{{(vySK@x()CF8JzZFu2x^KIc0WfL6C}IPmxrvF;)S%@bHJyF_+e z(tsSMOb|^|u3*9yB3F#1>4O}RY&Sr*xB4vNW?!bdxGxG~IjUkfj{PVmd+5U;XND zL9|K?ZpdL|Ngtc0SP7rjo#~R;wl>ogo8n0&cSW3CA-xN|M24d4T|$tHSw3KqZV>p zgbrCM7_pe`gBo342xM`#h&5icHgO(u>IDCvWrK_?^+!?qYo|ahC__$|x#~)pOJs~5 zL5l-EuaGdK%#YVZ0zDk>|CzUt`;1O~zCy;4xl1cKO~zO{n!=8Sr|lslU{+-m?D=V= zU!?65;wGzKtXqQ2qy}CY1K^TWwkupi?7tkq3o1QqMJc`08!bj0EZEAAVO*ziP6JUU@6SfL27S{*}#wEtAj)W)VU}A zJC^_@ewfi7)jWhB5BZ&x0B;!#QSO+d1_c@ln|YVTk!HyVsXhE{27}!sqZaQHW+Zvn z_80%Bk2^f6tibW_o}=bvAHLPWRpu9u>TiBcz1b85nvWcoAyK0hINEo#z%6%F`m;a2 zELt3y)_HCnXOi>yDD2EXpEUHL&et*CHaHV@uFV*=l)K696&f_3)={OV%|5mqk@E0( zNJ<8co;F=R2ft%{FZOuwj?4eYFS|iWoXu&EDSk6`e}Hw5&CXz8$kOH=qHr*L(HgXy z7^)jG>f1<&sz#O-jy8p%<~gRgjYO6OfF6&9w;Y53kwIxYL12+(bwj9z1#C22;E!I; zqQz}%u<3YyIr2gAx@X@PptU}QlWV8A&gKDroeJ03H0K*WPT0lHfnl3ee7Gu_Yz)n75r9EF zCoea#6EpZ5nf0MaeC0IabVLYEp^39*xY#^AbZR7v*rp{k-w)3J5hj7OV2JUIAEfw_ z1anRxut*JXa`lY$#1Uox!TDCw2}El|iyjFfA1pHg7IvtzF_tivfaIKaN|=h_;8LYk z`V29ai&<>RJm2z zu`5+9cJDNoQ(xqSUXx9H4-8Ic{a~%DJC`jfDcB@AW_ht>^x4z(vEt?I_;=aAr^@{; z=Qa1E*&esNk%v~$Lan>dDeb+I2A+F1wpYQ_7g9bkl3?BE3I)vDLVC>Z_*+<`+dE<+ z3Ui`(Nw`QYxSrggFb%kED-!mdn@^q#aFI>EiWxVb$n8iLq8|PGHBMLcnRiNI_sAPs zSMFm3w(fO&^?`yMy@$XNNqg0Mp_EWlp-PgP2F%4wpIv6s+3v(+wG3c+#0t{}d0u6I zgxaG6pEUEow>m)8OO}~{sc()6SQUz$D0qH&5RHU03GYrHJ}w__TucT~Rae6Vx^rhG ze5rK~K@x?Wb?mOgbY!H~m4uvi>b}Nw6rk754xmqSOn|Cz?&iRBM4{G|g`8#UW~9Lf zeX0FKPrH_w=17m&sHVxgd%cbb&|Uvpis_huR*{{Y4X+~$8}Gx8HtPJTkKrge0jk#7 z1Uo#7^yrf)EepMnd3NVt>qiG$dm)ec)@xIB;OeNw_2T9J)6T~6W2)9AS`@>r=hH5l zUdr_T`S6aD(8$3N@OZMO!xgxwlPWoUdG{GA3GOGcy0ySfGpTIDO_A6|)^?<*Al`Q$ zCv~BHBOeKBvph8=Slawv+I(aMnaEo80|=Y^Ut08T0d;?RwdhB{v#?tAl=bN$?o=6~ zAx*Z?9VO8uq?$n-i#W>=<;M+M*bznR%*dLX`Rpk{oO~a9nu~jy?Mu;^%5Tc;#xxfR zN<$hU6@)u+z?^ts2wA2CZ6>N{JKfNlR@)OM3K{95h+HKTvDW)(KMS;DzbDcb;(x!{ zWav#TBZ6*xu{W*UIbKx_I2__RD)kIZFSTy`*zEiqSu+?{XCrKV+EaY2Wg2yQ3Sf@? zjSf?mh>bx@)U~Olb;Q7BL~jnFWjXscfB*M<*tCIU`IQnSd~nA%nxKy7``r<*!Cgq} zae>i(h@whu+8_wn^c*!Jw5&78cyeglOul~}!ALr!q%Rh1wD>Rev}lOBL^Ynh$FbiS zlGJSqBM{sONp0LFw{HsL6WsXm-Q#~he~BWRkPOh@=Vfe}AP~Hwf`5kOiHM6ZycesQ z2wS@ob9^8E!G}!Bm5e469zPvE1PFr>1;6~g&*SDkX8y~Gj`!aAr3dfWiW~vsi$>c6 zzk!dg`Ko_v!W;s~*Y#G26a%tv=U`QmTDSSj>*mk+joF{^4-LO~YR|7?+k_q{1 zgeWmkOr7~C?=DkcIUe?t3iO!{#x|{V%q-%jeOQ0$*^gkKKzJyTxW5i^DvHBeL(#9; zKyet=)kl2Y{unBK6|RmjK?kiZyQe+8zVIjt0}FzSdLQnd-bbIMCIT7?oOzeSfov&Y zRCWzneY0grQbE-zNdQV)Gv!ZU>a-phv^>V1jyq%j`huL?&P_U&bY1TLDU~CW+j`t5 zpDcZ$VR3akKa_IgaU&s*k_EYRt`V|vqalxy2hj&~VGXRw7&=n2H6r5b zxJtdGkM@a-8+`143s%TgjaU-%wX0OAiy;qgpl0-U^l--sD z>=cO+qOeGc_D(>#fY=EGsTHT**L_57Om`AH{tj(#L8!zB&EHX&QKav^=5-u)PzP5r zn^B@qVE7~CTP|QnYSJG@Ar)^8L2d2mNANGI#yJ?=)D7dF^iWu0e7-dqM1FMl&IC-4 zwZi~<+B4_hP>r$JjR_!#iadZlCF7gz&nkLjEEMxoxnZ@|QrqnfgTkztnld{-CL@#hu!xeQ4$iuj9!!JV`-~ZJr#7kDo7wdn93r6q#QHDseheHU zdtFz4r?&|XE>44kmFg z$mmBQ=Nbd$FJj<&q;E5?TA;EN`PK^>>rou$ANZzM6U5Ka2gmTro*um`rQNlzXD|pE zid~}kEI0l`GZX6w==_|!wCMc#Uqa*C_FmtWllO?qSXzF9MWgM{ro`jV1BI&p&57<( zq3}>Gw}Uio4T{R6X>Mw>uLIuyw$3D;gp?}p?TYNRA;tJ$O2MS^!E`79xfo8_NmVY- zPqI&mHO7koGCdMwr2G(XbSoocTdoIE0ONyecZfp3cy?rN;&sk4(=|K~fUHn#3$v)1 zPS?#hB@H45gU%UI?Bq;e>cwjhS!c#|X6-?YT6pg(QaV(&3X>}=e7cc{MWC_X z04MUL*B;?J-u~bd8XW_Fuh;hb)-zIZgZ8s()Nd-`Ukms?qMaJ0!*ijhe zk)$TkCozRnL}Vr*y(TBT-p2RdDv(xmwDM@0lLB_~w*ef>lQUOPuUeQZbLk^_KwdG39p!_(sO%)v9}tM0=!3kZ>?HJ`D-b)9a0-BS1hJ|^tNMlu z%dvoMi-PQ3N`Olusl{36I2bk0gcOhlslI?`_H?1}APq+uD5nBpg~$kokxp4v z?bPDTPd8KP^d!ws$5HMq3svuB2SgW)|4|iAk&&H*_(PFy_A%gIUNm);{XYVaM>I9& zV*nnH$u}#+5AuJA(bsBjqt#9;oAK1n;ps3wb+Q-iF2o=vH(%-2;j-xM&s$e_ky|#x zYx93ejL7OC-%EyvQeel_wPRh|5*d_GJcC!hHisxQrK3WVIeXuv6W{)NGiL!r8toa) z6P&0k4t$RNd%k2>bG>%tV^<6Q6m8vl`E@d*L+pC|WstVX%0XZQXS%K8!$7?L%puVj zQ_bPIu~y~s6g7vTLmPX(54&~9rt5Q3#=VD_A0`g3rs}H}>TBB-O&<9L2C859P*mOv zzN%kHV5Vq!$B*0>uc@0J7Z3@6t^+E=;PLK!*X<`U>eb@u5nuf>Prn3-9xfcJlAC)V5u9oJT(`J`cQy7McdouKZx{MroNvkoS|%~aWn`3{9Vjoo+gb$jTjRLr zWgC6TmlD5w3d4;ZcR{cp_>^WRcyv=K{C2~EEReu;4;HaXUSFk1iYtOY+(=WNzzgik*j)Ha` zV2lpnlur2sU=4%h43nnnVhID!@%sXjdm&RP@+V2C8|S8ANd#H{gW~Xmj$~lD%Nc-^N^AG)3~T2M>mcvI zOm*i>^&oHK45VO;`0@JkmT9_*wq!s#`I}G4@G#Gw4djMg<)+Mqx4?@%$6K6=Y)1rV zOO#X=WJ`o*OO#m_WJ3hU&;8lT@rNB4M*%-g^bIEtc6a;@LpsRC@DL)iuCQ<2mngN& z<(pedhl2U=p~T?*M!q1rA&K$iSM#G~9Pp^ftx$Qz{tlIlD7I|`n1)KilCt=!p*7>Gxy*eGrv(*U3pi)XkbyC9UH zK$q0T1g-DX)AogVYhz=hmapf};(#$VmK3=@YdT0ywF91*6q!Kz{6W?41yF(nzmlh( zs#9bFEh)2Ea}#Q#J(y6N;fE}6PQ>uuzB~yiD90_lQ zRAN$wpi+mZRGdYf6|Y47m)B5{3YZ5-L#03vtF#zqPPG^)ZcPXHmoS*Y zb+MGZS)hD^I;~>LfoVVL>&eKf|Gn?Gx{@h9e-0ZCe>?-AJ<JG9Zg@1!nN#A9)A8MmQwSW>zP7`NfTGLTDq z2v5w29mxR{FZr$85_QGW3Qi1D;_^&FwuLN*MH|uq1X3YG%uRSRP=gHsupyTWDi`7D zcR=3HK-}*IXA+a9Al&cfYmwNFNGd-=5UFAIs(53|OtJC0h-a zPdn?EZGzk0xfiLOkBo1Uz%L*UbKTfEt($;pgr#?j3;MKyz2{xrDq-uY?uCw+-z6C9 zBQooKdBCksiqW@02g=sfKggnTex+b=bKH${9Y~=b#XP)_qNg`{ACb@R%D+ZAn1wsM zzejoTqS2x3=-cE9^|m|f;)9%R5HtIGt=>*f?pA!ciFs&!1#YMN1X@-`D2M%N#E=PS zCnaVF{{%2%0-Dqm{avYzBY0(jw>sKE7;&o%V05O{#DL(#GnJ>DVO|P(_mK|sO}lbI~$c>-K8H#ekDQzDyX!qr$KK|tU{sjxm}pY_PRd3lPrjhdK|7GkE*vxnx|J(EE0Eu;G+p2;a64OuPHKh& z8|CT2#^oT>1@8hiaPr9~wqt=we2>W#(*@IomV&yog1SL)@?ydD88mAqtnnb|v%F4c zYCSwlxpYC~JczQ@Y8Ya2fmm+Q=PA^SU(anu4mHHh5pcRj$HUEY=LFZo3<<>H6?5f< zeIh$?O&6834-$$HzntPNoVgF1!F%C{OxRl6TB9cXzS=eQS0iFLLrr|sB#Dqa`eo(A zy9T>}+_-+H-xvPtS7`gTwN^-2c7{6hPqytEk!@^HTo8#H%M%r=TQNx*;Zt4^V5RG? z))=%t8)`G~;Fv_nj|--RJxlh+4gs#Gl5m#of7JhQ2GXU1ocS~AT4DVdD+hx%@(Vn8 zqCF7&S91`W99Vfgq)^p8;B1^7ozE~(InPiz2f-AhcyawCqY>ucZ>g*p3Zr6sz{&m- z@c)Mbx#zn1=BVJP;e-wh@6yjDCZ(9(*lYqJQ~y~Ga!2Ld+<#Q^fyV!+nca7P)wdog ze8dMghDURqD9xNbHi+ai%TorYN}j&h8>^7jN%Nr(aD{bNJx*1fe41~)$#ksh=F^P( zw@dBDD*11*o2Vg~v9(qPPW+GI>rvZv`w}JJmS8&~mUoQGU2ZD<&0eSLk7x}z;@$E6 zs8bTQwzswg+8ECC6aQ+h$Q>0+A?5U+2Zw_$*`5$xY+{q*l5Q{9{EUaGn5mghx6SU< zc4sKx)P1wS+Zu|0jKQ}xZ*HMevpc2`*~`xJ-@m&YL@o#ISexX>mlM^A#5Ota%2~w? zZM}^oSv+fiz?0=|@81Pyj|M}glctj&@8p@x3>VXF@ss4SmJ3pBQ*6Wi-r0HH@qh*k z-Y-n$EKX6SQl)0_xTZG$jgPWd$+YG5NbPpWuTU1Dn+L_Hj@zZ6D~mQ1^FXgYEMT2| zNPY2N9->&SkhAV!7`1JXD!#AbAD;BeH!9a)v-oo2ApN57;uqMl4&B&`*_DdpA=D(N z@6T9?)H+M)Dd5=#SGoCFm!j`_>sr6H;!J;b>#t_N)@C0&8#n8H(cI}Ra1GWT&zrlw z_2S-a=gon)&C>cn{nNff?3F{#f6D0GRTs;fOm1Cgv@)IP1K%{iw~Bu?!Pb+tM;4}Q zqu96f(A#F#b8q{~qQ**1^@mRp#@CtVf;Lj<}AV=kmRm znXS_|FM+Fn>YJwM-vhiX)Oy*v(oaJb!i(Se5THP;M@*aN4&YesTp$q~vLX zE9?QD7S2Ea6WElwa})P(;PoU}bMy)$o*c#mtB+1^*?m`UffaiSz^0_FE8;Z$>|6bk zDQ{^7|E5XC2NZ~#H3A52poW0}qY43^GeqWKqRJD|mQtINkyZi$3%@=bCN;|l z1JO1-M1H+`A5RleOjOh5vpmA=q8^Gxx@?p#CIeZke~ugUWxpUa@sGVi3HFLTdM;GbTBZ^koe`TAbk z&+kpfS$bfJ$6Ag>P&wvEqaSNcoRy^HHQ%(_1|%>}*YBFC@Xxak-lW-jlu%A&V2yN! znS+DF%-6+gr9r!5E{-`(6bmjnp4<~Y=*QsaSKJffZ}SAloP;-j>6%z+tR*m_z|qPi zlH0CTpIAuirZA(km|D6`VEUt@+gO?x`cHW_By=ggW`S@G5sV+Hie@8Nimp_ zc(i^00@oty9S@B20S@kZ!^if=jTHvmr};oJ8X#tj4HS-F(0{;`OlyjThWMde0m!AL(0 ztfk*eHVVJf;XQvWVOwP^i8vyK= z=bU(Y)C|j>nIRR>sFpfCdo~15`nriL9iY7nIkiiESUUb-{pVKvL4^5^9TG{f#pNuv zQwItO)ENuo_p@`n6d_WY<8J%SPz-xYeb(oEWz?=ajgxEEcE`?BnWTeG59&>!@GI^e zw+W7vH)=);188qx78x+GUTrvHRB`Ld#okr)j+cf<0?|8kjrTZy6-c4ql2!}LGDvSE z$(D_y+r-}Gql=yru$UoEF(=`AIi(fH_A)2po)n<)#jB}dd#NRisBC+AZhz5NG`pOd z@NEKP6_tf#1c#31mxj+|DleZQmro(Wu7Kwv{)&rRKas zXRuMmJyo&Y3nrYQs(!>I@M>Rerf`ok?$KjDgg*tIQakNWuI z<)qU8;r@1h_Q!wJ_Vt={?;Wcp>7&(J`;)Mhwb*Dw&%w?ACCK}vzF(_i{|B}$!p^l zf3F{}OsgxIm)>T*=%gDvuK~78i6Mj+n>tGivnmub_#DiM~_>hF(;eUTY3)>NJO4ktG*)`C^*}3t%mQY#cifEVw07p39b54aw)DbF z9%FVMV;mSl=aaM!rPX7+dRCtNauIR98jTgl8x*XJc3j>uP#cM|T>j4uML8Kq9byO5 zW1s@FR#JhKU3PaR>B-NwPsR?geZa89fdWr}1r==Zo} z1T-=7=uQ4H+1P(d^Ekl4f_kt+l<{68>CK~P(>G1s6!lgv z-D^iOfxx;Y0K3?oM8`fbmT&qbcL=4@_myyiq1IFCnn$m=?10jCxRtltR&>8NWM1vjxQu-h7#2d6z?|`BFz4Y1fG~h~rd@+uBN;OrAMWEKwIkuV@umFek?|+awWq+nDs%10;QT{tdfig# z4wrxOZ+kzTSHGJiag}dlmwo*^e4A=Bcjjq&Q8=ZxFMfv>LNgIs0s@P6aeVn5x3fyO z^`ZEZnR0t&LhJK#!!?2(TI`9q(;ek08&QS1LoD8oJO+G~@1MD(d6)-IK}XpLuKWL*CK{p9H<%mA~S&+_kv+bY(wg=#Qo< z`!){w-R^d@-}}0^41cikI~sm6j~O{oqweqX-~j*b`0oYQ3A&%pOYbau8;9x}_>L0u zXuTf|=49?Go1zNW^yMYF;&g;|Z#R4x_O|Z!C}d^_&-DtEv2LVU@Rf;51vvTj9K?8& zv)-X&(tMGTQp|?O7x@Ako<&JvX^>>d_kPlDri@uaV^SwxWG-*ODmA{Xu*rP_OQcyu zL<6C%^wY|6My`N>h3LS%qBFM0sK|g80uMdu+nmM8KJ)y1M=!NhcNg*1LNdhc5YCI| zW~)S>k!m;f=-~DKdVT)>%Dl;X{7CGn{GEkN9;q^faO3H-uw2uvl z_G;Fj$N;#YA~7?#dty+5bGh2?^H_d~cHKAPdiePNnz+uWCZeqi(!0_LNRuj3r6Vn% zfPg?iTBH+6=qiHJi`3AGfFLD=-U+=UT~LYyBs5V}ia_W+@I~MH-g-V?O%u@YdU@W}+ex$d@0CgQGMYtR5gLxKa7LY;3!v zvR0H+>fD9AoZyJ*VeyE^@(?-E_9XNOYeK-c89)uXx42ROa%?hFJ8hM=vDr03osA{{ ziz*=%_43mMz)Sa$w!+Qe5r26|5Xe^@LL(0$kw+4K-iW!6JOugjK(J4j8Vz3h+Cd@> zv1TsEX69JLbm6Aj2)e3l;`aTO|B#YhGPQ!3$`fu8a_$ungC187bzKP7e3V^pWV_-o zxo9!5i2uQ+O9L1aqRR*)*#*0~Be%2Bq5xdcoq1&uCy?xtkyX>Q%%BkD__6sc!fS@rF$4gmVt8q6ChL#0pT2* zV|&uVIIk3VbZBAd{J%R4FE#i`%#9IR?_HYR#YFy=$~4_We#Z4*hNr%j|4(1xp0Z$_#6HiO*vaU+T@N7D2M->(q4T_=<&Qh5X!a2vpGTq>5r5>kB(`R1^BRQXOz(~57Z))M9sdbZc9gQw4oc0;*pIP+4n807G zc-fkJs;?1jy{%6|uf4gUSBUTdaGaVhZnp{C8;I!09IE>Tw@LX253Cc57TK~@K;w|| zU}|h+VX_CP-88#O^GLL!L#$#Giyl!kdMn@Y1udA>DbQ$F&{SI{uD4~}h6n@gNFMH^j*J|i@Uq(gH+5sn%+UYOc&`bvOUn)_Cnv5IUgmH zJWO!xTyL?j>wlr%jda;_LS;9rn;@nHK}2i%DcI{L9HUP|z)_`2rp-y3fM+p}g7)ki zv8?Y;Z%=O#oUASWOEQ<}Dz>G@i%NTNu=&q2>S&Aa?<-$>(!9seTY#~cN22uvwu4p> z*W5g>Tx^snMN%=j=xuOb1?}dGmuT|~^brdZ>u(3K$BC^6+xbDJY|^#^)`IJ}f-)68 zNj~s!5MDiOW*={wEI}}@*j2aI!g7C{kIK4?hFZWdht3q8L9M4l(^(Pk7jb2N-{!Pt z^Rn_r2@2v`4xo{NAd_Q)CO)*?>$E|MZM^X6t{nGbO`Faz!GoP@u&sopQew<4K>9)hSy1j z-w5STkg{bFzs%C~%_56@nu1g^hSGCpg#t+uVcZxPv5G#P3P~j*`ytXiRJlsS*P4pD zN;}Ft3|LY7H@uKptjI(Ycdsr#pNR%gD^>Yw@6n7JGVJNC$H@d6VOIAaFnJaoC}LA~ z!adpA8JdsfeK|a#!Nj?df(%QXY}AM%SAOu7ksYuGt^biJQZ2O_D;5Qj@h4YepRTW+ zuQuv8ka`zsb4y&RFZ&1{NUx=!*Jzy+n|Lj@dpHhYs1V(oUY(XYPsDMofkk zZ;R*@{eWuxY5ZRPHUGPb(d3X){ExInZes<2Ogt+SO0aKDN?KVao|_3J+-GU;cxO$D zTIhjh--%gBNx!Vql|?DfTgOPfI>!-1_D}CCl}6t^kRrdU?>6=(p1+hMVz22}?obX_ zc4;Uhi**6@Lo-+`z_=g^A>#T%pz@iSbl7c+b5AKzfJ7W?S^)$llF1wiFK`5z3B}RZ zKTw&OnRA%&7*hVdn|XOqd3o^9-jTvv)t=S&|FlByRZ6`!e}8XY{A+TFxa+I~yad}y z)CT+F%~cDPIu2q_Trtr+&b6k;g?R#B-Z>ym%k`cxHSlMC#^58|uv*%h4=$jg_s~Rb3=9~K_BfaSilNTl(C-`AJcT4h%Jm$E?(^pD z2X9ww?!P{6Jm1~G|6-be(s5XiM$CYao!#1G>{VR58x@z6+m@G86!RZX9lPFl+Xaza zgj}6^brNm6*i7(r39`=f*#2#Z^x)rG#zFa@MM@uwm_&*=%_5|=Oa{@SPSL3NTG3lt zCJzX4Vi6}E_vT*KLGrD>@-ZKjen1r~Tmo1Or`2W?oVrhegeMP3bLeuJ%Gk*2vYkI> z(?`N@xgFcsw~v>?lh^qpChiY!z-bG+D6N80G%;*S)e?Tf=4V-EH_)fIAtaSgLX+n1 zD^q`;(63BnH?j35QRWPajq942%!pYNyBU-a)%E2*cY??syYiV3|5mW9KcK0Xl~-6XXidQ9~D`LUU=6i-Luys&#az@+R?L1C0jO$c-rOqL?bk@ z&J!XKDR-GnN=QB@rcGp?d}v0#g>Y#Th)6=qziOIWzEwpxBBT|sD%iFFz5y{V(C=k2 zAumd;l1J6=j!piEktV=lzq5ZO07;{)>4y{j80=jH_N#D+ zKDL>Uprv3r( zm=dP`A#q(zVci?`yosJ%KYnmWE4Dq0fd_E?SR3S%*nSpMLSv=2o&0!$3e+zVGeO1p zk`wf0I$35L0Ggx%-4~}^e8acAD;Qn2`;(EP2>c`e^}=Cku_mleGY# zubs|u0Z=%BRtwM;sp%R8a$8HMT$hsAawCG5KI(liKL=lIiR6 za{P&AK5jfCrOn~#?r%}Fx&!;en$6dX;@W)8+#6AGExzncD?tVmZ@U9wzJ0z&NmOn7 z87Axw71A=vfLlIw22qTk5QZE#W2B-C+3&JDyfMslkiAN;8k`Noun!5vbH+&J8nUZj zcc7Mchzp}MMN^s5YiGt8X1YrCQf5m{`en=;spXA%Nyz7YQEfGRu&CPmXDn$Gi4i|* z;dj+Tg7(ih{iUyDVZqXWa@DfrBG1fR;MrK$=Z~Ae*~mFI z|02jz7e~j!SCx`z|05VWbG#Y=$!ITHl-SGZj&J*_Vm7{xh0<(rda4*SMD2Q;o@vw(cYpr(r*P zp^lKB&uxR!fGg?1zQR|<0rRTffvUj@@8ri9N`2-9@!LE#sKQvV-d!$1kA;VGC=o28 z*!GE}5FLlMq0K^88=vdO$_$3VWQyO@5UvTE3!baA4a${N>#`9a#C`J`x$1}fko-MV}M0jCucI`#b-*qvk#q|4auXgpsB`X zpPO=vp>JPqd0sJnVR3D{X86@K;A=!cbAB;6bV|HzJ$>0n%$3l$#|Bv}w(RpZt2%s2 z4&y^7W3wR}@kPL&=ZR?VfYOlX5<+>B^SQ;a-um+)O0p9DoH*Lnq~$`NGSd`33+gu$ zTU+nVUcXWzV)GuNd{P=l!|A=jRqU@8ZCWDNxJ>dWXC0Hup!jmnRP4brkdCW-GSIoM z)ZuC1PKsVly0r|ZOfb!fENQ62pwoEjCl_&qa)Qg7zK@tu`Gi_Ut1><@66cMM29rc@ zB<4F%sh8}KE0ijmWL8aLy}zYQn9N`pi9FigH7oh$@lGqIh=UR|-l4ep`4L7bBx%e% z6ASdZh00YHtqlT8oj3Iyi67FM#cqK&J{D8wR7usdxHpY_GOxn|o;HyqJdUYW4%bIc zBivTza0_JT)wWx}^A!dxVUf3Tf*v#9-z@NC=z+11*9=abewJysHBd7wK7=fWs;k#z zjQ&n~yl+$?iFHoL2g$f)N?ax5C+NpiUI(AG0Q^c|IMOBN3cMF0Z+WhT)!($TB4})Y zYFH<}rlutA%+W{ArXok3U7*j+`yyNSQFWNhRL@XpSS^fq7nbi1fCd8C<>?Fp0haP~ z?%IHcam!#U+s`gu?Wfr_eqjq9MYxM$;^wA{FZiXX=YEl+U8+}GMjiVZ+x!u^`$T@W zH6=Nt6Qq%$`9LPKYvJTs`AU2rxHFQ#(9(3K@`$JnOC+_dnZuh6WX^_C&R=VlQ$AtL zLceiKe|EcsYC;3RnoQ=id56ep6~#*iDBKA(gC@&Lqu*4|Il!MES<40)6kba(J4rU5 zkf3X2dSaWlZq9$c^|j-`zqJp4uo}TLFE(_wvxfuse;ZG)*xl?{;=I6LyGQ7E$eqfv zb-InC$V_}88F0zl`Vg5!ufx+`M z{wQoQ_|t{|=`b*~UHyed#_M}kY!wN*AzR$3cu?MzPiM&2(=nZIc<^jiXzrge8`+^U z#Xb9*(zU!Yl$vjfqJ}kGV`?$iIdthv(g6h|WqczbEgva4Z7b5rSu&XVsq6EuOvzQ8 z#pl&e=4n={L4_(ED-;aIf97j{4b890KCjBFZ?H}HGLcJr~_ zw@LiTZ-y8_vh1(w)4*_xqN=(ndEExXiw3gTrv69Z6sX%mgE&Z_u1<$BT6=!L2%HSn z;ciw0IGL*fdBQ^(ebvM#VQS*QP_Q{7zF1)qZaUnydT% z7(YsS1FL=AYgCW7aPSP-$mxD#7D^)F)Uw~CqfA6eUz$uj&|FGNy6!89gDEj8nzAe2 zR?~qjLwA$_EYB6l82oo|Rc=_rMQLWr+`YKTiR*PP@=(=#(vJ{QbmR-;_Ifh$*~HjbnyH`CaiLIGr=i;%nl@x><` zrYzPC;YsEqlZ-ys5SYdjQ8&2;C>c*xa>3)khKF%8%P2Vnbho5Y))|i`)_|)|6(#;l z^047#KW;0Iy@3P zFM0zy9*~}I{M=<4DUM6McUd~{ zTu?(i_!{Q-GiwfYF;~HddnZmDLoC`mL*j{U`|t=Om}2#3$&(1R@yEY*DPEC%xWRsM zt0gs*{}Ni+TRa>5=_F49eztYdmYX1)#C7Vos&lm3_Gzi1I}?w&_>qmP=dm7H!QMY| z>a;c(%TOWAC?=1EP@j7XXHtiFsF#U!e z7N(X5)K8?f;vR58vEy7tN z7hq&pkG37{wNCqj4B~tXg9Cu-8ROk$1PP@gi_qC^&x5U!t~|-PvefDMZTRT#2%dLK zv%3+RX*wa;doK6^yX;kGoG|>1a5TVXTQ&QjR!ZfPu=)E|`;DDe*vd_fvv;-aA!%%) zufN}tlzydVuQt-bxGmynFkJPxhT=&9k;I*zl^79izWXSm>U%wg%sq4r-kfCKqa+LW zi5GT>j!lS;4SEErmt_}w`KhDX?$Jx4h-`DYPNXHRRxtUFGrVz=H^!HBouC$Pi>*3C zL|H{Wi#~Wb_INc~w#ZIvMt?+e9QI+r@7#PYLp%v#E}mDZH(OImzZNgS+)|E}3ucTW1|F#Pdb?;vvZ zL`RyWIx(|b`-2_y)Q$P#ZF+ZXcsKHw7i!rHcG@m-qGEliMtzx^9&&^1Dm*=egX}65 z5yDL4I6alvU0_*VMkanGV(#UtH>w`@Hrx8feul^ijd(~xxH{}oI1Z+pdoxNXuE{P>}TU<#G2_2yl$I KCu5h6=>Gut`eLI1 diff --git a/detection_rules/etc/integration-schemas.json.gz b/detection_rules/etc/integration-schemas.json.gz index a596472c16caa708d2cf2067b4d93a1b92287806..5e1085b690512c8991002bf98d3d357efe594d6b 100644 GIT binary patch delta 18575 zcmc(l2|QHY8^?>d5lJdV(I(z(k*zROsgxyDOtMUi$U0PZ<|bW2Q7I$J`XYqv>zI%w zV@Y0Q-x@o^SjINyPrYqg{wZ&LzMoIsbMASb-*cYxoa3I)XOgKn+Mt|gv;eoq^5q9l zZFd47U?~L9KmaWSEQ0_#2%v|6+0NwIQm>_@|0#-r*3k0l!09FWC4FPNr zum%FwLclr*V26P95U>FPI3R!%0yaXxCJ5ky0B#7_3;|mpU@HV{gMjT2zykq0Ab=MF z_#ogf2-pb${16}j0fG=91OdVjunPi2AV3rXc0+&|1c*a`1O!MzfD{Dmfq=abAPoUB z5FiTyFbIG{z&;4r4*>@tKn?;9Lck#iI1B;u5O4$njzWL}1Smp)5(Fqiz%d9=fdEwq zP=kQu5O4wlPC|e>1ZY420s>A!fF=Z-h5#)H(1rjV2+)N9Bm|s+fU^*A4g$_YfF1-~ zfB=06Fo1xI5MT%aMi5{O0VWV&3IS%x0P1oP*vQ8do5H{j+oq6Ik0n>A-cYmUbaDym zM~HXM5Ew3ozUlN-<}Xqg-<=$R&4X`oGKg7gFW~W_>wG#FGt4L7yenSma%EABgA&?# zET_9&%KUENG);x@GDY_NgEb>9lKMk&cy~FMmv;`UBS3eyFIL*7K1vY1MyYL}AEjv3#(P~#NFL;y!9gNWgDxjkz$;f9xzOHNmB6>_O*uT|G; zJi2Ft&6G*UVeeW|t&WNzQ-5W=LkprUe{g7GIb4)o>bd4kF86vVH*NhsMZZH5#qPUf zo^5JkD!?`9F4HyR`6rccB^OQaigmRVli~W_EWlggHWpu0%T%=&57?85M8giQ>RY~bHC1~uHqTm_5mT< zc8YjHyeGvyC-baDi38TRv@%=7;%dJn*m}WxM9lK_-{XNpGNv__{x4_F$OaA^avi$D zlH1`Rsh0`?Qccs~loeX0_&-?b(N0!FxKp!& z2V48NUl^wKCF%9Ky>^Q1@vfu^`+yG42Yn&=aFzqT?uc&Q;+KUja!X2u^bg>wAh4NI z?(96(S9^A~zn5b*UA7xjfZ!9ak*&zYgI?}jG|jTGo9s^IK9_b57J$CDI-Ot3*XKEK zJkTWWIN*J!hME`hXzZxj%_4<-F?L%e_xRTKPY7zUT3GkMazGdE3p;yDl~ziFJhCB#<{YjFlt<$(Vks+OYy4WReJ}ThRFv$#F^ENzYo_pV~sv%ovpC@yM7Dc;>ZlPMqQu6?%sKJp@0iDSj6$IdFl*c;0cC53Aj*k z?gWMLYYM)L1-Mv_zT;>7wt8;!U&Z|noV8r5t7ESfyikG?ahMOuNy%>P`T zF(-2u1h}x_i#{53jafag&^@q-_&mV* z9lyB^&Wq=Bd6?e)L2yC!ywCz&{Q3u;tcDq^MtdFg)$`RGS3K(C-;fK$tm$B$V`e#O z*Ja^P06%TaJrgrau}WFL4KNEh*CwlmGkYDNcgUV;zIv5;Gzi(6h>K;M_Mcp zaG?f^I3BKX%O2eSHtY6nMsGiCdGNm(@FxTt0|m&Onr7CTLfhsT;N`I3d|suO{xg6- zWAw8&h5UHRF(1WG0Y7bg<#}ppLc>aamlu}*5#SFw)*@sWV0T;Td`4rM4!O#uyY>k0 zrhKJQyo0?>dWI2qvBB{E^h;TjH0h2%0{A0?eszpWX@90*-npf*>rE;;tcI2WLhkRs ztloY9j8~q_b^PSZzSa9U1971LhKt)r9*!1F^yvyGZ;OB zR|RLW5jfMTF+A893`afi;I1ju>1I&%E!o;*e0nrIvbd^?c=D+VO|PP~Z5?lLT+Bqn zdsJ#VvwZ=F0gph|Zt2}JZ<&_&Z>>BfdQurRocV10N<2&bwAa;8$KxAWOShe$Ft^~G zlyH3$@PQefyHkDH;CK;w4~y}-yKHUm;PzRC^VQaq%$j%yZ+j`cv-Cd${O?@<>zR5I zg$|Vb7T~vD{HA{Jn~{ACfXarQ=zPB(i~K+M?=mm4+j(9CJ4$g~kA^yizX1Hai}=DH zN9jy@eC9=T`7Bffc2XRbUq{}|3jYB0tjG8^t7Ez7A7I9saSHF1w4F12EaI!2_^&EHrKfPA|zvhE2*}Kl5^`o-H8$D zKqX@Kb)XnGZ8WuQNw5x=3Hk){5`t6e?qqju%++304E?nes5R4}7*-Mr!fYm?q(Jl4 zx2}QWjADNXa503Bg{Tb%9(MW}z@IT%L>tEUQRlc};C-kZI^GICsT$0)9#kgyl5c$S z)-{i&2M3)#ki)>k=qY-@{FLF+OW-9cwuoXl@g5Zf9vRk16>~(hw>ud0+h>|!)j-`y zDXM$HC5_AfGTffx7x*-0nvdyCN!uLqXV)35_!{6`C;W<*6!4DmJA0nN^Lrha6%0H! z@Ry#7PD><5(p(n#{BKMA0ggZPSj#@2+3%E3YK6ZF_Glu%Gfno?{rL2*;GIoU6-H?=amC#t$P4TI<*^3AA{7cFG<%LYB z8T9=|lfU<`r42K+v6bwj27B73>1PiQ$!WkO@IDhMoHL^T*z`6VTw4hf5%Ro4wh@ISvI=FTAGey_4L)$NBR>-&sZAs&i-^^gicaf_FpL7Mm_AqSHsam zyW0|Yv))0y*y_lk7!cQOie_IQC^WXEg378|uHwEe#8yv$TgXhVxx<`%`2#q7V_+jY zcdc;e+0xTwNBf!7d|&q^Yn^!n87V@gSDzhv!C1t&@vKJB+(oX3_8rJ=(lqc=IRi2niBH+DlE6>-|~=u3*VmsTqN1P zi0iWpzvKGm511d=ay?XO(?*SF`wr|oa7LJ6DGB@+YUO<@;sph+{HhtuH*VGxYL2~v zy7vT8{0bK`^^hAI&Hae{@Ga9%vpRYEcEcIv_mHJ#8COdyoOu2%SQ>fDR=)$S=QF4x z0&+W5N*lH5*Uap+>c_e#l6jtoXUx&$k>?lS7cdzIc1LPPz#H}|@4#}y#kz;NZ#>MD z@=M3ep;Cfv*h&sV!gwg6hNK(?Z>=2@w@Nr5!%7}5wzDqo91(8GLY}!LcXOr zu4|}qy&Z1%i0HQgzy0dByaDIO7Vvj4`ED@gcLDyg5cwc8*3m`xCjo!f@aOHC*u+L= zDy7eNU6=)&`{xe=enZ@Jy zL)ol8Dg_~tdT6pjwtgZut&ya$tzv4MP9vUP9f_=A!XWhrxK>vyp;qu@qC_4tX=L(O z8A}MLgwW?l>e*h6=Pz>1ti1yIu((M24`+1hC{(>vw@O^v)*J43GrV!F)2PBEm~J2I=JnsX#St5o-4V2%ht56kW#O%xz2wNDYHp)MhH^0O6h4X4>GwEyIB?j3 zWYn2SiRfv_t>cn-?Ed&432?LiaIxbn-QHE)T(;w(68Xc1N{#KuEo{|eM?1=tOAWOx zdpjny5_B!R>4T79a%Cuh2*1x&t}+(D`v=&gQZ z5=a4wuQ?>?ZT`NZJl{I+fT(fCPLrEyXwXRo7 zr9ndGM6X*$e!p_4bG0J2oOIR>3*%nL>=Ku4Yf^Vk9A{R4?!m#S-n_C=KzYZL_=ZJvLf3Z?Pp%`lY=SN!0c)S@?{ zfheqqB_iHKPO{@etnZG2kwM7>7 zu_jow`G#!nJ9q~_vtw*~8wLzt6)5FOP8o9eGQtmW;_+udt?91@OjIdJPk8&Q*GdOJ!^% zRA_m79+J++;b|Xej*vRNyV$aB;tIAEip05u3OBZaqarNu5=}Iw%!ss-7!)hqB7mQf zl_s(f>m+=IBn!iw>tFO4Nx7Bd9Ga_PT+*Ig4bAH^du!V-nJ1ry9g;jkjo)Zewl%}_ zp7yp!68tFb<1!_3@^1(dJX>vLeT6kD#}6NM`Nz~_R90bEt(-$>bVTy1@ODd{fEn3T zv*C;EU>sqk@Qu-M!qW58lf}GIuMa6F7)B^JT^83Qsim0QL0|S|3QWlFNQ$;>9@BUB zucnavnO~7vH^qg>m~te6T-e%J8xI^RbWAQyl2ee_Y#X>2SxLE6Hxw>N%rM=R&28ma zbh!2$%&t%l+cdDrYfRn7c^VOcxgyd;pwqbtTHEbmAJ#$M^Hm+l5aKh+nkb0$Q z8dS7Mr>zwzjH0X+8gw@Gi%Qzj?}^pip=)vZ6`3L!ce?<|n>ygo9!EBed#QD^qgyG) zQi$@8)Z@V<;<2U+-kN>sww_!jDwrc`IBUEx2OuUj3!WyyV_d#O`pHb!k((hWqYNg_A!Aj z<$*)Vfy?B)7wx+)QRP{Jg9(=g&0%SE_ax6(+FBvA?EJt@O-*efl?3FKwCQ`hVsD6^ zR0@wPvGP`2>s((^=i|=_b<&hHbgZsist5M6;wKxE6gH~g&rTs>SEWhk`HyZ=ah0oy zR%@wpd{oMt7%^qS;j0YSTkF~|)R<3^5^l=09XiTshb&1vq`53$2W5ofus)rFvt|{y z@NzdLwVJl1pf0`;)7+>?$dBEVS#Y#%yTx6pqYt+qTg~g{{rs~gIIsP-35UF8h@*t+ zt9SPu4ce}{nvdb$G6fo*<`oJW0|YcR#uNZjuWRKBw)&VWrtvhaHe>kdCOFTSq-u_b z{gTId4!_qV7`B5xoxePX?@4@`orqgny3gh%4V>3ryk>xe*#z^)mBE+i2?`3OrpaWd zWigkf&PRkkdT~gz5xjDD^b}Y(r zSexUCU&%DMD9*nq#JN=ePtJEfDC0@b1$$vI)+R4&I>shU zr+l5SS_z;2n%(Xj@^79yEE4)@6P(xn@un=R{>c!w4^Ca5-8>){9Q;!CBA?hA4n}6k z<%gQ!0!F`F!Z8{6Z~+EC5DWO7P`mB~1$P=ObVdt{5BxM)FWdLaP5rlepUIuyF9(({ ze9aa%!%q|oom|H3KTjz5pUS_So#FQr3NE-}zc>3iy@e(87w2Di%|&ZH z>_x{+q5sjn{XyhA8sPWO3E7omBU#pqs`$AeIDay8iZtIj6nqDjm&eMOT_ zV@AQ)^UH>t@JX#TgT~|H(;R4KoC`89j-rf?Iiyih3yTjEu%#$3bz^iZE+eRSbJBCT z6=$4Sj|mRq<;AE5@vgwA2J{-*S|e9@9toysyg+gC{hI!r|nufWGQ0D+;>2ZPokIvnv>E}Gkt58jp$J)Mk2U4qx=PTmz5V4IsnfY;5h zRY1izMTYn&_*>OlD~}Ng;@vrKJAP|VtN`3nWDM&_8-Jw`=t#3gwqoHm&x$`0CP*bx PXW$)}zdG;m4blG(v_|(; delta 10593 zcmc&%2{_c-8&=|2Vn|W4CTX!ZB5RT)Bqdw67F(8|UDjXXL?KC;qNr3VqC&PT8Abnz z79mTR#H8$l!3^{7-rIVsd+Tz$&-Xkt&wJ)O-}ip+S>`+E?v^p;(n}eEa1;y6P=r7z zfM6B`vms!FU=9RK5HLgVZjc26RtVT2V25BX1RM}>LV$sQ3j%Hk=0U&%!F&i7K)?$D z9|Q{_SOft-1dAaMfItueAqa#a5P?7xf+Y}$L9i48aR`<{AOXR02v$I_5`t9_NJ1b5 zfiwg%5XeFx2Z1~Ut0BNbpa8)d2oxbuf?zEK$`GhPpbCK+1nLlIK(G!1O$gRQpasDO z2(%&C2!Rd+n;_7IU^4`I5a>f-0Kpar3?bMGfe{4TAlMFpF$6mxFoD1n0y7BAA+Ug8 zCj^!dSV3S7fei$<5bT0rHw1ei*b9Lj1ojX(K;Q_069oGpaE8DI0#^v!aslF1g%(R+ zs?MCXP+bi4jH>VhIkt2bENfHd>HZc|>veqf>x5417HQB&>%g4Gy?BC8;x%myur6-?NE zlN!H_PrLpGubgm8v_nIjj|AaC8NoqK@yx>`8Ou{Uk`fK@LG9aL1`UkmLFqdsMpF8boFK_zWvN>!p{KpsWR=#O)n*pc zyOge2b0NXCQJH_gjr1)~IbeTvVi)V_vx z_!qX6;8=@=GrDSvpYKt95jHTkKOnCuJz8~3cW}tOg;bxMtNuQ>jh>KV)- z^SxQCq`V6kf%-T}(+x~(CI|&Pn3ad$R{HscPFBg=?8QIGA-;9$Tyl2d(Uz(@+xGwM zHcYH~e8HbkO4(L=4?AG)Tr0j6C8e9^* zVNugu^*JSpR@LF^>FlKwDJXMRU$z8(=^EkYdZwBU%(1*CfdO%~l23{+M3fa&MtBH4 zzb%w7AoC%^Mu$hiGV3QfY6zOLW!ddsx2lB;!3dCCc`^D$Y%u zC|Ib!1hm#UdTWq~9#h9mu4Cy_m0h_~byY6OC1l=!O+t*Tb_r$Qjjcpo)I%Ka+_p(a z@^!XM&;y$Iv4$nIBFPoad+SF}=RUNsmsCuG>w%RB!Y5S?CVtHj*ND50+zQbp~1 zJyXYv%-oon@wspEraIiLebwSix`&1vt*T>F)SCi*7C2gBrBQyqn5g^O9Tz;FIiS_Ms5X|7iU<10g>AQ6tf!-NA0M$f*VU*Y;Mam z<9Z3dLG({}`VdKSX)~A`HQRFa^RlkKjyWKcO+0$uM%L7Dqw?juP7Hu;<-sRpH!u8S z5dCBHBmUJ8{XpdF#J!ioseEdmsDAD7uAJ!-M?aJ1AIEyfROWYae?9{GX=Q$X^3TrA zJ3VhI{L4u*QvWp80sU=HepPvX^@#z8uZQ37*_qr3=s#Sy_bR$x4lg}79X`M4{JE_b zr!DyW8u%bN`u40hTL8rz3 zhsZbUv7$O3uKz#DE&CVu@3d?Ckl3FO4}4Jk%K8h4Bn0Z-S!z8`<}j{8@1^)4 zdVK#Ec*daX;fiJ>8^sLL#|G!OMr%@uKQH$4b_@M)+pi1gH~YRm52qHrU(yVs(`h?n z^*Tb<|K7R^rg`K&!qQC4q$T+h*a@(++;dmK4a>iW=udf1!H)STxjf>Q) zm|Vy02P`=V=#NvKM)L1#f__IMH7iL9`;TkcB4%3eF55VMV#eRGS*dseJA9MA~?l`^|hep_LBg z^v?ecPORGd{w08ZdJ0Ux_5b*)_>oXZ!*A~d^!pEm2&2y*3gIf+tfe7&j2vNyH1X$% zIAPbA|9MUgv!au1FZp=VFL7k~>U!ME-)$+ExzIFvRVyv4GtH7O&wNC_nVCD5lxh_{ z7J>FrK0m5D`;}&jc6b*jTkGH>6~{JGYB1fw zGP5lYk;vBcpEHkEne{yFNW=wvItSi+tcWNy`~Iws1A~`u2C1r^(NdT07vo%uW(b%} z;cg67zUH`;C~T#GX%nRR<1K?q)!i5m=bqqCFLA!+t1z*cbyU|jxZ8RQb*Xn# zBB{oUR6uU=?|U)QLiR87dW3F#>?g0fD0!~oA&uK}Q|=$%s!+U2Cv?y$gvE7Ar_3?M zIB)~G%4}^_|9S^65z4W^Dz#Tao+zdObUVjWG$C)B&Gtq%ww;}T1M_k zNP1LF>hdD1badHxk_*OLg51;r)}KSs&%1^E9ar>^`eve(Kd1kp$mmy+ z(lFj+nP0{SouN#0Sw(uScI@A1fQl%hE+7+lv zb4m+8sH!a-?y2LIpG4&Z>~a&ba%xr{kVSK!WfBiWxEiat4@We*ZSiS_Ua@VRX%P#qvW zG+APry6#^#qnS)_?rqFL1n1F<kX;x!Z?pN$aUO- zHwYKg!J}BViBHbxJ7>#%^Bw;yLuVlI88o%MR@?Bxx{r2F>+r$&Xs(=9QVf&`s_-02 z<4c!Nz~7LO4*l=AEO0Vj2AajPQyJ;GQI>njGuPdQXQpT2V&U#?rJo-n+_Q;Z(~dj)vDI zeM_Pmm`x|>-YynansNa?`%6U^8#;8>wfhE_Ogg0yV^eG#@=#~&6?@yO9DJ#o^s@qF z+mW;Vp0s09^flV}pjr-8sLB6r+cHfcd`gOM+zZova&_?@{OwZRv(iSTVx@!e=~6`u z&DKYD+Jvbv^|(^wclz|GO6{((b``Cq^Wlw50<&w5)^4;*y=ByR#l_e+@M=%wg9eXn zfp;nm)L26n*T$gT_q|gV)D~Na@LJS{4Q~t(D~@a3gj`g7y0|;$1MIJlZzUL5?A}3a z8$iYsY1Ed1eizvlIs`9&DOessDnH!jFiW3S5*gW{c}jI^1zQCzh>J{*CX7%=d-twc z9xHN|KDL0GF|>6_K<=(noTy@pmYcHT*`!u1nh+Zi(NR~~860lvaAWmz`tiF{3yaU+ z7){;NODxjzK~6>WH&n8Y4R^*okX#Z_`_j*#F0%qnmDFI(aC;Gzk`lhfea{=Yky8Qs zYL`oj^n=wgvLoY`R5PwOq~DeTwdItPxiiGRx&5mg=*+Avw`=98y`lZ zPzh_LG4ChamA3vjhR#r0M@fO<1)TGL+R&e$GNUuNzhKPI4sf`EVWco&1Yuss0mB~g zsX@k{urS~GoNhv0wRL%y6QKGI)ITKi;MoP{jsP*4)2${EWZQvQT8X*nVz%vpxJfy?q3jdd?9?43EpCIZ= zsaQcg;l5c(oK|sS025bgST=lgbBlMc*OOcfn}aZ0#YU^tOrr)MmofNk|C`eL+qb91 zW^Tb>#B^wBrL@gj+rI~!jcX+IbRKOaaOBH`6zI|9u?4w~p7^Dh(-A@CLY}EsfBYYc zmUHcj9N5W4)WVnL+qB5^@lgoqVCR@;(ApBx>#Rivw%3!Je|FOMYeD~=QV|{4s{SKFqQ6MzZ!0D^9}OtA8fN(g3;k^Z;plfZ+zYwk zhekJp%u6I~5@ZOtPQsAgxNrT?WX-$pTVD=O3!*a^>q98Nv`#AKJ?Ho2`qdNqqu4L& zhzWWbuO2ZZR}*)8yihf+=|W8jK5s@$H_cnd8XvA(zI4}dS>01h^?w;$@!d@Bc}s~X PeNy;H6VP{7?_~ZzWMGyf diff --git a/pyproject.toml b/pyproject.toml index b8467f2c8..c37ce537f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "detection_rules" -version = "1.5.14" +version = "1.5.15" description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine." readme = "README.md" requires-python = ">=3.12" diff --git a/rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml b/rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml new file mode 100644 index 000000000..a1a06ac20 --- /dev/null +++ b/rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml @@ -0,0 +1,105 @@ +[metadata] +creation_date = "2025/11/18" +integration = ["endpoint", "panw", "fortinet_fortigate", "suricata"] +maturity = "production" +updated_date = "2025/11/18" + +[rule] +author = ["Elastic"] +description = """ +This rule correlate any Elastic Defend alert with a set of suspicious events from Network security devices like Palo Alto +Networks (PANW) and Fortinet Fortigate by host.ip and source.ip. This may indicate that this host is compromised and +triggering multi-datasource alerts. +""" +from = "now-60m" +interval = "10m" +language = "esql" +license = "Elastic License v2" +name = "Elastic Defend and Network Security Alerts Correlation" +risk_score = 73 +rule_id = "0bca7e73-e1b5-4fb2-801b-9b5f5be20dfe" +severity = "high" +tags = [ + "Use Case: Threat Detection", + "Rule Type: Higher-Order Rule", + "Resources: Investigation Guide", + "Data Source: Elastic Defend", + "Data Source: Fortinet", + "Data Source: PAN-OS" +] +timestamp_override = "event.ingested" +type = "esql" + +query = ''' +FROM logs-* metadata _id +| WHERE + // Elastic Defend Alerts + (event.module == "endpoint" and event.dataset == "endpoint.alerts") or + + // PANW suspicious events + (event.dataset == "panw.panos" and + event.action in ("virus_detected", "wildfire_virus_detected", "c2_communication", "spyware_detected", "large_upload", "denied", "exploit_detected")) or + + // Fortigate suspicious events + (event.dataset == "fortinet_fortigate.log" and + (event.action in ("outbreak-prevention", "deny", "infected", "blocked") or message like "backdoor*" or message like "Proxy*" or message like "anomaly*" or message like "P2P*" or message like "misc*" or message like "DNS.Over.HTTPS" or message like "Remote.Access")) or + + // Suricata + (event.dataset == "suricata.eve" and message in ("Command and Control Traffic", "Potentially Bad Traffic", "A Network Trojan was detected", "Detection of a Network Scan", "Domain Observed Used for C2 Detected", "Malware Command and Control Activity Detected")) + +// extract source.ip from PANW or Fortigate events and host.ip from Elastic Defend alert +|eval fw_alert_source_ip = CASE(event.dataset in ("panw.panos", "fortinet_fortigate.log"), source.ip, null), + elastic_defend_alert_host_ip = CASE(event.module == "endpoint" and event.dataset == "endpoint.alerts", host.ip, null) +| eval Esql.source_ip = COALESCE(fw_alert_source_ip, elastic_defend_alert_host_ip) +| where Esql.source_ip is not null + +// group by host_source_ip shared between FG/PANW and Elastic Defend +| stats Esql.alerts_count = COUNT(*), + Esql.event_module_distinct_count = COUNT_DISTINCT(event.module), + Esql.event_module_values = VALUES(event.module), + Esql.message_values = VALUES(message), + Esql.event_action_values = VALUES(event.action), + Esql.process_executable_values = VALUES(process.executable), + Esql.host_id_values = VALUES(host.id), + Esql.user_name_values = VALUES(user.name), + Esql.destination_ip_values = VALUES(destination.ip) + by Esql.source_ip +| where Esql.event_module_distinct_count >= 2 +| keep Esql.alerts_count, Esql.source_ip, Esql.destination_ip_values, Esql.host_id_values, Esql.user_name_values, Esql.event_module_values, Esql.message_values, Esql.process_executable_values +''' +note = """## Triage and analysis + +### Investigating Elastic Defend and Network Security Alerts Correlation + +This rule correlate any Elastic Defend alert with suspicious events from Network Security datasources like Palo Alto Networks (PANW), Fortinet Fortigate and Suricata by host.ip and source.ip. + +### Possible investigation steps + +- Review the alert details to identify the specific host and users involved. +- Investiguate the network alerts by destination.ip and message. +- Examine the timeline of the alerts to understand the sequence of events and determine if there is a pattern or progression in the tactics used. +- Correlate the alert data with other logs and telemetry from the host, such as process creation, network connections, and file modifications, to gather additional context. +- Check for any indicators of compromise (IOCs) associated with the alerts, such as suspicious IP addresses, domains, or file hashes, and search for these across the network. +- Assess the impact and scope of the potential compromise by determining if other hosts or systems have similar alerts or related activity. + +### False positive analysis + +- IP address ranges overlap where the host.ip value from the Elastic Defend alert is unrelated to the source.ip value from the Network Security alert. +- Alerts from routine administrative tasks may trigger multiple alerts. Review and exclude known benign activities such as scheduled software updates or system maintenance. +- Security tools running on the host might generate alerts across different tactics. Identify and exclude alerts from trusted security applications to reduce noise. +- Automated scripts or batch processes can mimic adversarial behavior. Analyze and whitelist these processes if they are verified as non-threatening. +- Frequent alerts from development or testing environments can be misleading. Consider excluding these environments from the rule or applying a different risk score. +- User behavior anomalies, such as accessing multiple systems or applications, might trigger alerts. Implement user behavior baselines to differentiate between normal and suspicious activities. + +### Response and remediation + +- Isolate the affected host from the network immediately to prevent further lateral movement by the adversary. +- Conduct a thorough forensic analysis of the host to identify the specific vulnerabilities exploited and gather evidence of the attack phases involved. +- Remove any identified malicious software or unauthorized access tools from the host, ensuring all persistence mechanisms are eradicated. +- Apply security patches and updates to the host to address any exploited vulnerabilities and prevent similar attacks. +- Restore the host from a known good backup if necessary, ensuring that the backup is free from compromise. +- Monitor the host and network for any signs of re-infection or further suspicious activity, using enhanced logging and alerting based on the identified attack patterns. +- Escalate the incident to the appropriate internal or external cybersecurity teams for further investigation and potential legal action if the attack is part of a larger campaign.""" + + +