From ef8f5620e181a7b7e183438a75e01782e758a74c Mon Sep 17 00:00:00 2001 From: Isai <59296946+imays11@users.noreply.github.com> Date: Fri, 6 Oct 2023 15:57:26 -0400 Subject: [PATCH] [New Rule] New GitHub Owner Added (#3090) * [New Rule] New GitHub Owner Added new rule * name change * Apply suggestions from code review Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> --------- Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> --- .../etc/integration-manifests.json.gz | Bin 7827 -> 7684 bytes .../etc/integration-schemas.json.gz | Bin 2622437 -> 2622511 bytes .../persistence_github_org_owner_added.toml | 47 ++++++++++++++++++ 3 files changed, 47 insertions(+) create mode 100644 rules/integrations/github/persistence_github_org_owner_added.toml diff --git a/detection_rules/etc/integration-manifests.json.gz b/detection_rules/etc/integration-manifests.json.gz index 897bd5e1acb4041631653990037606909e06e1bc..d7f09bdfc50b23605b29f8336a31105d265539e7 100644 GIT binary patch literal 7684 zcmZX3byQSw*EJ%DbPb@iFboY+1B}u+bR*qJ4Be@8cM2%oq0|r((gG4gN!Jk4DIf@Z zgU|D>^}Xx;=k62xoU_kecm38~_tM2YeY%``Z;5_y>*#Lv*4512*2$66!OYRt+RDw{ zjmyr>$r0_~N8oQstL1aA%N!LDM;UFd-7LQ!#FZG4>C zIxp{)nyxvU1w@}9q=c}|kzX%61N^hwFHc>FrT;{Xc5e({gKyrO9u7c-{sbQJtqZP9 z#OV(E2>D#+U|d$V%7edhMNoSVxgO)@l|KpRh2$>HohOis zw-OhtW&$nQ+;lM!F@pC)%Pg5#fjJ=`H*@)vy#hPVOXo~F2z3ybtVjDREUN2UW6o(u z{jNOtxKEy!d|s>WJU)vclmIyK{#j}vw$55^a(d3}!kD-ro(z}*4hYssq>7ObHaWo`iYGYew9k1e-3d(04FW%Q>p?AUn{4xnTxK#DwO1_XRVs*vN57%Vo za6+o9Sh;r^hO*vpcts*)@%nT%%hsj#jGHxx0!)QNt6c`iK?14G#3&|#nX*ljIsU8)V4<- z)#LTXWqi(~G5M(|6bNk5fC6)YILU_Pz-U#HoIb-!ASf63OQll>I@>y96foupswJpt z_GcEZ>0lOaZDzPKOmg0AH8Oj(dE$)M%Az|lVA3N)6yf6M@VcWXDWWGycK)fTgR|v? z994fvYA|@-rtqqPCqE86pXopUW?YuafkV^*W>Xjk2Iqna8W6HnHHe?Cv4K=Z4N29^ z!Omwbbe=U&n_bImEa}LUX4ErZTLBF!86$V)%L*$Y$z}1ukk*RA@4KtJ!SLOu1(4?M zylO~YHDp(f#?We9hek#VOP8`idjME&QShOv5@LO0eVPQZ0ohl^(^rI8*THw?3;yFW z{Kr+x9(O3v*z&JVNcg7?&HP|X z2z)fHEai@pYh9ailGpAiX|iL@g4Q=QobdIK2)%Ep4$*%QMErn0p>wUPh_d7Nzli7M zj#)1M4{i`!Cx^%tc89=e=OSqH127U?30Y`aeg%4;VpBo|8#V{4=pkw}-1k6@H5Xh4&-GO3=RA{xCtbk=b}TFehQ=c^Dc zrt-1~F+<_(QvXW>2C5@K^qjErXwuW+gZ77>vHV$dJctx@nNS#f| z>Vd5XEPttqS;PjNHY14HKO7M$cfP8ES8 zXrXLB7I9Ez!o9Q}N=Te?6?xS5`EoRifgROplVm|F^O{WKW1<34 zv1Inc+y~OX#mXGmVm02QHnb@O7~9XU9WCEqoN!K2ChG5S-?1$QCe0N1H1yxRKMW=O zcQ~4386&EEi;eXP;eX&AtRnb7=f8#wQ5P~u$V^B#@YFIq@6=F6N7ShBO8}H5`6Fkf z`Jn)1iGPL+U?kLrs5;69q|T39AkhFS(33{MBA+0#BCSbf+~_H#?HRJ903%`lNL=dt zg#SoMho4_!*5HYw_}J@dkFXK+`lJY;IzQ$=15!1(K^q-z|Bc&nJM<)C#mo+=Xs^prpHw?}3JufzE;u4eiLWzO-LagM9woTkn&V=uy;9Q^B} zI?ToeA4pQ?_!gaO22?AC1y0Y<30CH>wvzno5i7VW`d8MZH+~N1m)%V|9oQ94Wvldt z>}zEL)HN@~o59`C0;lF~G!(xivcrtw`NN!;UsN?Ozcqn7=A>7g!ya`so{YS>4rj-E z7|n$cG&FmU8eM2)=KL>tJo3W$zvgM2XIPia?Gx0@Es{M!4noWa9SHyW@Os!wohV3> z(;n4vw01#k=RG)ZtfJt=c;XEqY!-@JQ&h|QEdGVV4=U1x7jNkCIvUR&_J2nGAP0(C z&3P5I8UP`|QV5{l<*C#(%iAiT*vist?;l>vYaFYl!}0-vlqDxe^wdgsVj~kbOfw1DrW1 z9-Q$vE>Rv>&S_7^#M)6~zVFB-ao z8@HaB#6U=g&Zy6wd@TC?ld?v8UBGt}vAGV>zkHdLUF$EDDrat{@~>o~CKTX8Tx4`S zcA)7lF7UAVJrh=EtZVSWnDwXO4VP_tbQ`+&%DCSo(0b9R70?Ej(w^oypnZfKd&-4< z-dmv8$LRCA*^{RCqe?|yoioLH4cxW2tLATwL|%RQbG-8PQlU_90D4{QorN=(k%J|} z_c}l*I_10^u~qN&PT63=W!?_EV97*-;?CPQaC$@WrP0{sr?JJzI-@ArOV%O16RqRK zx!Om@&3r@iiugVLpw`PTiiv$mfuC8Rz@M6~bsnx460SIdzf*Gxn6?{O-G4LdGAH}C zr&IRb@Wo@BTx z4ArGdMrlU2?y>R=2((9!iZ7U5TkO5mYsd@Fs-kC#VLy^mo?%MYGxVWztefJE34E9a z9W+9Y|P@ z`fWrO$AM7HLwtrIT`x9-(yk87^B*KY;RBCL_@7{oYRoVmG8B&y#Vdd2SXadRs%=s) z4z#}K+}|pek>PWpPTKF4D|&Yxaw3&@<)ki275@70wXQ=FudEtM5o!@#i-@c$ASj0Y z6-q}^ij3mJJyfXc*}MB$#su@od~$b=(F8W%=a$Xpl*Qs9C^q+)mGmIqRg?61E+s=a zVJbdfWGR3C#gxa0Q#1At?xKdD*QLAgDq-KQdjF&=&2y7<7mePWT=!=Q z!@um|jM-W#-0G{${cJ;PMNY?~nNPACOP4pfv!8Sg&DN0HDc$x8(sm2A;cxF8DW~TS znF#4~Ic5a%E33N6?tG2kS~Gg-ll5b=;Vrb0{%bpoe8}@`DJ03yLj6$HLlIxg+3EXI z$>QgYbn*bq%l<{ou&<9-zPcQ}4DJ_RC0KdoN&z_J@;~ZdDn9?wS`1=u7Th>gC)XUK zE&R0e-AIkRmM+ErXRr%F`R~CLy?PC9`rP+QCOz6{r^AVu*ma?U+*0XF*ZLRqJsVFF zF^TIiHZopJ>b%t{<1!Aff@o2U-kFk!2R=tV-kyX{1`8A%yEFNT=7I;f`QR+HUu`-C zgp1Sp`*Doqmzvp!x?{LbgvxllCMLMKPG-vlE^A^~tyXq<42yC#U?ztH3!(<2t4-_A zk=xt(M6U}$aJo6X@78+-$$vz|E%J8J%ZfawmBTN>9q$X1vi6BB2yb;#p zM`>tT>Z|B>h2JRv&F>*-`f97_yXdGiZW&e{CZ=ef(9kyE>is%PuBItE8`at0hvUcc z;+i8C`Uq0PED~#+$VE{}nBGHE7|y|xNKQsusEjVGu zL38Yls7#pX$M|9HBTZ^ksqNQB(K<~pY&Z4X(oIM^&5Mlhv_5Qn-pO5vMJ(XI#k-Ra zwpkmK8zI`HTZvVL+up6PFOnEYtZl~cm|qlie>M?x;-yy!9xBi0S_sZat4yQolXz6Z z68TD~|AtV^i`8K}9K6NiWe_MS7Z{w7JC&5Xfh=|3C~dyNrr8tg(!Kxx01*habMYn( z3J-(#U^1wC-9&@NF|e~H5d1RyBU8j#&`|50ry~qfq!7u%XdLBEY(p>*kvAdu~DFmqfZf0tI)u8@N(;s1CxG2uughOC)zxxz7JnXKAE^d zlnxO>a)AHv&YeftkVlBD6QQ}89 z5+3Nuo|$RCL@OlNZEO$$T5&oP;{`Wml+^`!eTW(qOgG|qpcH8s*>}$?G#F82J55X1 z6Ny`)&G?{;Z)(uI_r67grM@3R+jmPv!{aR@_$EAH3*k!8##;Tvh-N5VN$}0@7On1u z&BrmtTaW9Hu`F*m3yT<{uI!%dvQCJLNP6YTrZO$G4u{5bRC~KsGgPg5JzkC;agywe z)oH_|a++dR_CA|twn^h(tIqV!F6*Q^2G8v};kHp7!)+e(b5aATBtT0prac?7f{Y#l z!Y0pD=4LJ&TPI?3=G>Ga&_HZv1h4Tjlk9bL{c=WTKu`E3Q%UyLy@&qFo=y1qM1irc zQZzWDZM>gV!Z=WdLSrh-E)`q^_>ejtp1Nw3yk!Udu+iri3NFGpiWbpTjBZs*sK#f_ zmLEcd16*)sPI*~TL7^i%ABWURrcL6~-_u)oA6nJI3Kbc<%(9=UW?v6kQn3XUD) zEyv~kqtDl5#Lk=GQuit!w@x>^^VT;h2_<+ID8a(|MqC%+N7pknCWcCmN@yH_5b|D;VZ9?m>^#GO4iZQ4IETwr}#6P<_IsB1_e zK^piO&Kper_i9Gg#>WR~cZCfO)KCoc-_*4oRBfNxrPe=28szrOoL-$o+bh|0jjd(v zte7lqFF-b9y5}^l62-W!C32n}iTyQKy3Npqs;*c9u+*=$E1nlEz`(Xo7?woenUwZy zE`?$fbSyt}JigiY{6Ol})-(%w3Sc%{tmkmgNA>7Rkme!iF=)L?VL_l{zhvpHV9UtGW$a%K%=4yvzmPX z^x=yhWZFTe)X`*m^>jMT0?AecSDA%@VKpjYQ&z7OkKMbsc+5#5W~8v$B9&PnE}Rrs z#25$ee^{_Ta@5V@eZGCRf6`;;Drh2VP3Y9~=e6Mv9O=tS4-%MQe2NvIL3-JCT28xZ zmr*EpivyxvbRp}Y{grZ~@nvoax8r-!Tc!~Iy|LRq%X+hmSh3;U>;TTKCugMZ$T*qj zkki*-6|Z~`Ym1I?49QoTHo<)SLF1! z>2JaK$cr6l$DKvg9rCPnV5YHH?PB!fCkEpzL}R@i zC^D(>@M!E1+(wwpl0z@*>z@qBUFt}d_V+)T>&2<>LG$Pxc%Dn&A2C$_^U5ZzG-RlL z>|Ci{>VabFGvmzmKd@haoTKT+G0!|GHj$)D| z6hh1ETRY38k zCChqnrx_xmEw<65$coe)Qm59!>?Rc|4j+G6IMsnI6@tDuF*wyF4LJWQ)UR>?kQ)HN z1$i=N^)hSp(L)w~3tH50EyJQyjhIRYAuazb=0LwOCTE@Qs25jDk#{8!1+l#x8ofz{slr@=r z`?pvA?5ut|kkrDbsp;Tns@=|jsu%BC#j{Y- zBT`E(#ge5=<;N&qfu_D)5=WUpPW;fWXW>QDnmBsLR{1u1ncsuCaZ}R6!Z@z#zS!u^ zKDgOgVdCWedQTO|35GCD$O)7#_G?{Xm3kZlHS1jx+YqMzQ}g# zDquuo>w;o8F)+i}0sYAg#5kHP$=rZ2wMWHII;OZW(KeBG0Ra!vy!B6lJJ*g zGStp8NK~TSY?S*slfeb$zKUTb$>1a*OgffcM=%avygPNLk`6rg*c>3cgd91!nBOh# z&s`#Pky5GMnOOCvc5S&z!9rkB$HPY}oiA=152;q}ljUAJg>3L6+JEkg9eV4!Eycnq z8TNV8s`cFL6-2thzx&89t(^B=d!kx8^)C>Zn-p3cBjHQZqkN-rMvuK_2&(seAD{Bg zrwbJ8z*<1ziJRqSL4Tgtul8^RwUE>oRU?6bS)DqjnpZylkMYM3$6c35G>x&JCVC}0 zz$s_L2d5MND9QRYlhj!T@8`9a1@C{+rr@I2mGGRS_j_-MIcE_X``CoZvgUEFP;1>X zo-2>TFXG*E?f(1gJ)dOmg0#S^%?q>-MYMU2r9Xa-Xw_-s)@f=U%9FO-?KHyyOHpR)S;$UP^#h2 zw-Sn=m=QrSNWA1rd+WTK#rtqw)WJX1{BUN%fd2Y5h1I^Fp|F`)-Hg4KMte0K^o8^x z^N=U*t$-hHM5M5@Ozf}a4sU~+{s^DeSIf;Y{44~_Gk9|*R^O;3{1Oh)I9fc1aDd#! z$ELGBDHd(pDvvQvlIl;AO8aWq`zFh)+A6CO?|jgoMabP%K8MH(A1yQwDgs<_iZ4LDR1-x zAw)FoFO};2{-=Awj6S@f=90s_{jIIhkzTLw*hK4cedO;?#UAZ%mlCZf($Z(zF=p^> zFAQw$1E#(>$-Dhftd=vEFC8A4#X1k2IhVdPn3Dl#myaH{q(-4l{InN|m+|HIRoG)s zwo@u9^%!d-`6r;LFdSk()^@T~njm&-`j-fJw~!60=L(Pc`kkA$?b_RVIzM}P$-bk^ z%!5CdCKuYzeBRG2f5p*$P#<|Q=ZmZ#yb4{u!XVC_qRIuXxt(*h5!4<-d?}10-gq0e zAGk$bwD>M;Cm*EvA{l8Ql)3drgASvh6Zo;2fYvD55707&BjK+8q27B|hL@Uxrq&du zn}68JB~F`TI|5Z0?osc8Fi@S)p`qyVF2v5g!8Y{_c!@n{6AKZL4^{M}_*P z;5zCf1vV*su~TRya@UTOBpuyh#fx`hN8b(@rEz>!@zLn9`{j;jbEvB{#o-L1xP^Vq z5r2uGDcur@^mHftH8ZX)-3mg1K$JV@cy+$L$Maa`%boQy9XZ{^U-QmQ;Wf(cKOZeo zwh|=O;I<058!;FWy4(NqwQLotm`0FEx00Yd1qLHbRE{i+tM$3vsscQId1BvSwQbBt z=~Wxl{d@*N#@~wL5MkF`(PIZKt$a$FS;>YyP-zni0j0^kh zhZpwmo;OCr%ilnQ#)G}$csnv>b!v_f+7K;Z#*V0VaQcPTUY5Rm}Z7f;^ zo#?YZ{RN-Y2Jh4cW2F99uA&pYjH?Pw|2Dr4#b2UhyXjUFzRh<OQp}-`_SWZ1#CR8XD?PTTUazlRZr0Lu98;bx0juR(F|G4ol4cgF#7b0ZKIoB-u0_;Pj39wU-+rb9BOrf dY7`#%UpiGNkIbV{{}k^DffUAVPJ9?>{|~`F9-N}Zofa+bQYa3^i)(NwUZA)IfI5tydTN#p0nS6=VX$ZWI_{zjxKwOZT0-o&dI~d#?8#b&e@3*Xy#;RZRPIa&SmfJ z?DXt+wxRp7d}jC~=BS>MPKnv4jpk49UuUWQE?hTg6CgDNkjhH)jS}@BNwSXiKL)tc zT7hZl_&U`Xh6A}BHR!#&&%{@3`6yN%0|DaJ&JTUJSCp=AI?44wBx?cMq9r*u6TWZa zYLzIs&xG`oKi?m-PE>d&D%A0DJX))QZ$vXUGx*i4Gl;p0<^qz7PZ;WsrZ?ffel!pI zju(a=4jrKB2ya5GIYH;oeviN#_{avmayef1z)dj>c!LBL{c-Aj+Eh6?4EJXhFkw3L zK0W6J9i^S|fJUqDKRY{Z+=!a|7!}O=kp$yY>+^p2yKIrJCaxoLqJ60Ix`UHOp$Qf! z2hhJy*Zcf6;;L!pyMI0Unf}QoXie+J@NK2Qg!aWF*r%y679o`kd-aG+w|{-aSz^nL#2Vq1J16lh!3ScJBP*&*^H3^7{6qxBhSW+VnyG zFN8BY*8)bNu)YYE@wtq@M=R)Uihst^z)8&nif*(@nD*ce%0;?Sn*B|_5I+vh+6NOf z%Z_Zhn7`Yv&D&#U*4O;uvDyJYP8m4e?u0;dCzmQM*C%9fo!o?q(_xL<7Sa|wv_C&% zE4vUnwgs>K8Ic{_r@8jp+XGH}=?fgTZ8a4B>su;b^>7ir64E zY#MW;L^AO-GOnek#@PIzi?d^-tDO0Qzj-r0;*?8E|FH`Tc@CB;)|GW$#=+F1{ z{JH~sMgo7ZqN3Y3u%fsU5krfn5>YOLP)v)ilB2lNRCZt`_`7H2-FD83%4>kp$<2E= ze|I%E6<4|A7W%bO&$eE#QNS-U4~;4!ki<|7OU#=9;PcKtjiA0nsU>uApo`^e1LQ{iez?b4cBU_7D0j^vD>Uv&z$|~r*TWlbuR(;|UKkZ;+|~&>=|ik*++-G6%rQwcaC{yuuMio_-bmdh0rtF zbVII@!(3T203>=J4(d1{pb$SUIStw+Fp&BWX39R{CV}-qh(f^@u|cyyV)d5p!nGBSm8G9b=@XnaK-9 zSb{S6oAellCVwHJZ0XcEN-2e=5?DK(5*1O=?C+zojtkaCd+NDdf6>M%Es2mYatlTf zA|*BzhUWYagH6Ti$t}!K%A@t7 z&|VQ{fg5vrG|pM-a*2khV}P}}?Aa6>xKrL$lp4)yCzP=gHxx-r5F@ONQJVR=m{0Q{ zCRBUzbm#vPVcAk1a&ClYi||`7#Zp2UU5Y~TXoPlxy(wERi_WuBT3Dwxk`mjGpO}ba zKK<05DjS%kxQdAF^A)HNkzhnp0WP8k^_}HiW`9ZoENiFV5^GW=DC2*V&U(7{$@Fir z5+GZwW)NaS+X5mJhov=V_`~IcVF^ENL$qnHRr?M7668hw;9byBD2UXD?_HlSnhCVR z>zj%Gs}=tSXJzhQ&&H#?+MyCf^+XQ>ph|_}V6}FVWPLe66<;n19|z(|ph_sG^&dhY zS4T%7dqAJ5N;Dp9i(eUIi>tv$3X!Vkg0#p&MI%w6t&!UVa%cZBsS$Ao{WBHbu{#E{ zBR}~=ysadq`6B1!_>_oLrJhJVwZrS1HprR*v+MywCT(=MLpFY8k}a4aGfoCkLfj?l zu_WXnUGD_JfY?5f_Ye)dY%(Sk=-a5GNQhZF{?kEK!ttJwphQT@oqz8B-8TLt#>=mO zZb8mf6sX`=if%!wRR#p1dm=;#!tz8)cCg5PO+{GgPpl<{noO=ow;hd=H)(f`_G)Jst3rtKwGO1Etqp@?tQlA5t<~s>Jo<3 zxp!R@*=a^keqFSYC3B9WNA@c#-kA$3Xk-@T{I=8Qe@)wffIebWgo*Mu=9dU|>|@nF zL6CP?&%ffS{M^Nl(`PiOd#MMd=XRt) zvQnKxHYs&Khai$!4eqzsm2dK@liM8iMv-F!$)%|v?2_HQEZbw@OG9=Zq?|>tn9(;~ zE1gr>s+mrX(hoID-L3C54+OKc4N-d zYjL*RajcHffD#jl#dh(BH<<>|bvmxHxx3!{L%FDE)Ufg6^);5Um}2>Z$-oB( z=+Z>A?z?31$8RocpyKN4O#kSj@|(G{ZQ?0%*&hi@ZxU z=`#2JWz^!$&j0;GZrj=%FpewRb)LL-9dmKsZl87&5dL#xP`V|nLb4WFRW|{Qqi&6s z=_tujhctTlF^MrnUsyha%DUD~g}qLbb}^V~xj;|-H&e`#cgYB*c`e}xE}y=VvMxk` z+O}2Vm-o zwi$@{yV*gJ{|=eXVZV{j^sYRP7uUXIgbfi4eJ!Ip$HW}7aj2g3jmqX<{cZp27*};f zossE3_=+j!pO2Y2hGZ7uYslj%GA|iHMfjcuOVzfH`1ICcO4eU&;zQHUX|0;Leedmd z-yKa?Qzz*3*f4o2o(|+Usbg3iOF)E}3_ocAwt$!{3bFWvdXmnjC6w^#H3T0Xw?5+7 zV~B_q1xtwbRK}1^k`|1S6hx3kXx8{T=HH@wvgF^!=0nizc=9oe)RB{C^Ft|Il4l7& z)TeVLJ-4`c-UWpR1h$eNxA|VM9I)ztn=57*J4i22!ad+sl1LM&eb4`xEN|w-IfMEB z1a(z^#PYDNO@uOrCFYvBWHZlsYMUnnMZ$ zPA!`%X0e9RXlLeKh=cyVwv-CtFgqPfu0a$6yqI#%$2vAd}B!mif5Mv?@k0J1>Rg&1`gid9H^t`XaKT6hp3hv7u(DV z+{+I>XRfHfEmQ?U0|QLO^l(ojnW60Qg85(o7&!d?ME7!vw(4_yuiJr!{)EDdcDeI1 zNg!9A*ACccToTxr7}85^!YhHL-bnwadn)rejXIfu#xG451k>6%>4a*Q;f(Fy5B(e~QDS=0I|mbAEE_nnDN9@FLJ>MCJ0?RkA=ey{A`vmm(=#+nyo?o}6=G7s zlE4C4_1D&-)sWTOEI}NLd>GPD4VERyj=zBHYDWvTYCri+m)*&)fYF!%Z^hC~;YC8- z;S+YPMA?Bd)0uVK47q2=!-^gIrA#BHF%k!{P(SJkvin4ZJ^HVpR=P6rPRd-jnf)%k zX2whOur!gPgT*BKu0Z3iksu)qw&M6!M@$p_s#LQ~IsWukTJgRbc;{VN6- z9^m(7A>x(-DbCNbnqaCK?G!ekL7bojy)7q+}_>XXX4Rv zM7Br{-qNW_(F079I|^K>i2AsY?O`DAVF>t6OZpmJ7E`e*!2OnSevtHN(EHIU zPC{ES5Slu%L^FxfXu8;1KhkiCCnI@BT&a+CKmMhG(>7`jQY#j(J3YmgCl;*>om!Ig zBdS!DI@sXxBC1pqiG6|4KuIZf${EvVzfmjO$!Df8pPcwm>1C3}00mg!Rl6aKWO3gM z?H4eecv4j1S%)D#K68{LeaHsEaFT2ue$NT|EGxYvols6tA(b^_E6899lfuA*hDw3m z&K4Tr@v;(UK%@^lt*pT1{EL)6=OV089RB_e}MK2 zg7OllTTBk4oA%2Fl6SF?>d;or2GVsg`ZH2!JQ{v`;Il3Kdic(_wX*B?x)hvAd=g+; zFMi|;BD*~5e32>IQ7~}DN?IXRqrF9!K=-%}*?C}FFyC~L1s)P7xSzz;ezOm#S8hGl zRcQy#u2Oj~J6<#)!>PPQ>X9;WalzTNNk>91W^Tn*#$${VR@dWsX*@I{$=r)*iP>6AOtU6sfx>Y^y zb$Bv;65(J1Vf(vjBTm+=c5e_*c=9jfnjL#3jkG=2IJzxDC7;0r`u9CcMoe4wN(4K` zz^XX6hQjCT^__!X>9k18j#ca!yd41>mtbk)>ShjtDovXB!!+jo$Ju8hmA3ZsqkR|r2n2+dPdWPgZ=z;zYuWU`= z%@lzlak+e88q*sc`BSaxhPM#}f3N3uT;fCn+t(=o^2cY**0*?RSFlEtGl!+9LdO;DHP`u%-Z8+pcXKanZ#18u#lvWKf~xHKw8lfW5Ry%=x%Fw@4& z=l8j;t&-u4djZWXnZB;6m5{^jpI?c>l2%4y*?(DTInka`t}y8RP$G0v%T!Grn!C;9 z@MLniG0Ukanrkx$DT^|9T$Eo!sQz4La*TZzBmLv%<*ZIYDeLgFTHn{j4ev|yMFwDC zPk?#U(;`V_Az7)BRbZLoO|p@oKu_qn07lkIxtg+PbDrnc0s}x`sIYZ>5B9tKtx;#I zo1;^aws`|^jT%9j1G;#fVzhvUe*?!Qz+6R z8nz*C_=2b26J>tH#*zDNS?Zd~Pt=$+FsQ%8U@oHL2<8?j^eUSrlhH!|Et}8UIprAY z1(|Z}oO=0$FFU7PSnC+CfL?gt;#NDy!5Y4$tJJ^K^aI7Nx+pqH%i5np1GJz|raqsl04 zJKwqM`B}x&2+v>e2@lrTek9h*4WnLJQFP^?Fe z0Huzi{MAMBH%2{+kV2g%dqu06O0?YyWAQ*rU4O`ArUo1 z$k%aRb-?1?fC3wLL$gQU$zm@Ce*Am)4}v8@tSnGhOc-A7`k`*=$ z%M_}p)2!S;@2g53u3aKEh~oz=nz%bIf9*&~XyG$?RW(Twhc=ao&P3^};^S8CMmUNN&c^_TEd5bvESu$skU*RZI zgiQZo$gFdsMNn`mYVSvEndyDjFple5^?D9R%bv6_)v;bF5`TT6dJdx}`EFdA7ORs3 zg%JyHD});hq{}6mj5WcbxYeuB@@uTOI3?zp{;?Io`2=KN_0c^=e&{W@O-w0-3Q9>SAj%37_n66PqU_^Ewg`s)1DVgB)I55Jnk zLacsb;~`sH@^9=19y%uuY|qz&z8grBL#^|^?}t9V`|f1Jxv1VIxe~u*CG#7}Q^X#G z(||YoyCi^V_S6Una?gWPd^oQW^c$IDNo1m8&RBRSaEW=yzsSyXxo?eqX>drq+){*d znRy75zZ9C=uibe&_g3D|w9~qUL%ez^4OF*&M%`Czk|^Xj(8Jp*^j*GJPZ=c|LyswT z3*|)^JJBGRo&Zye1N9>z-4_86)KJD_6dNe-1!>6If?QEKjI5Pgyg z@1EnZ713TVX%QBGG0KRI3PaurGEzb}CoCy$1}F40xHJx>gwitwYl&7dL>7A!7JC~h z;j5i6ygz9M)8?!zeO-5DloA^_OGMEk6z9a?%T5pZb-=7Z8O=(V#YxClluqxuKrdB} zkZA~6olbv(kRmaxgt?sHXNkwMgj26ruRfo8P<}JJ^&z)bIP!$U*Sr6=Y}Gl>OwP5{ z2l0Zep|ids8M6A;9j2?uodGhp4l9D4_l#HGaQPcEh+*|&;Lo$F?M8ASj_iUBn_=75 zT(Vc_+lv9zD=U{n_r9o(4uebhi!D-Z#~uD|)8QD4E~i~4-O zk{CVxN6M;gpN2@?leM&EWXmMqpxf-%rh-}{x}3u%stpdsV=#FwmnJE_nwIikM@X$k zM@tAbZ|y!G-iEg8)^gCjf=rcSkpsnE)YA1IdxcCsrzSwxRh=`{G6=_k-Xgb|pi~K( zKJE%*_Bdq(-|jwqYWJo7@Bbv0oNHRO%7XhHOf~v~CIMADja5=UL<>dQbCe!=GsPcs zLef8G4XHF614S^}FD5lUIEk^5wonsKkw6`SXOBcy3U+XmJG5pFYSO20#a3;7#S=|F z@^u8MsFA6v;qNIG>?zTUS@DU<71~g$PBKlq#}@6V?~c@r3>gW}No+?O`}W%UhA660 zsHzd}u@>yH(u*zI`U*tl@Z6TrMJnLf@rfxF7RMG951)rZ&uuwLmTj*bA%2a}qeaWB zLg+a|V$SPK>dJ;gGUGqO{l1gDt#J3qiyRA&jvf31v7uex$riftLUyVGKa8)G(}zvd z{I?}*@PzI3Gc)Y)np#yUA{ak(n35P-b z-TVc}b9pFpY1iC;G)~ej?PSJHGHw8@HvqE!(~kb&(8)J#$G-i&2N}lRV&-cXT(w5E%s7z8?ymoY7h{v~a{qE~1Wa8Ri6_n5v{|IYp@kW#D6-peCTKArh<~U0 zgY1n3IPf98cx}a4RA0@qX0@fg3x@Q4?X~GQjTd#-e{W`T6B`0k8Ul521nb2a^#ezJ zWadl@UhQ=luRM0_NCV(&tk{>%?9X?A6Jkyx_SweB9!-0f&7rjlq(_a=Z!PR=PFO3{ zO{vKn8##MyQ^5T4NDm+a8~}T7^OmLO_ui1HIn4}cRK``&LOl^?v{p_JF?wSf z55wJC*;b_8#wna(4_9r60`^D`MubX{ZN)_N*f5Pf-qd%eI8t@QEjD%gWSymZc_;1e z0t?t}J&2cZht|rd%NePv=p8?b$1hs<#lq`Ie&GHFv3=vlyI?FXA|F=?xc@DGbkL8^7y_EvA~D_;fX< zX^6b`67*$hu87!wAli9sXboU=!oj>~tN46w#0~t+TkeK^v{ZbNCQ3BigFe6fSl8(O zCiVPzNfez%Qkt|XZbW8tG9g>Iw)6lN@$&qDz$7;CXK?^?x<(Y16ypR)*#w=<$4Pr# z8uR0yy|`=j5kxg2NZAOT%{5T_R9bz+y+D&x^BL?0E6<&-ZEQ(yLiu%o3Yi` z5A!yyg5F-is?%aA}m)G0gS6Z5_44jp`v}qhZg3Mwv z`}|c8b$53O)vICO>RQoI1?sO(DwJQ3r>*oT6eSXhDJtn|KF})ayn6XLhV(_nkK0_D a)k?n|6I2$@XMs1Tk7;tCv~_-zXa57zdr>0* diff --git a/detection_rules/etc/integration-schemas.json.gz b/detection_rules/etc/integration-schemas.json.gz index 930510ffc4e1e59ea2339b548443d2ea0cffeb7c..ffc241b0326fd967b4b67c8d0eea9d4e2a82fb48 100644 GIT binary patch delta 14452 zcmeHtbx>T}_9jjzxVs0M0Kwgzgai*3++Biu6QFSk5NI5Ny9T%5?(PACyE_cz=H7ST z`%S%?e`fxey0xlye`m?r>qxErt$lheAPu@CFbx_&76Jg+W;_^v0)PR~U;qpl01F1d zfdTMf00J0*2nIarpMe3-!2l#M02vHG0RvFM05mWF9Spz#12Dk=EHD5Y48Q>caKQjP zFaRG6AOHgh!2lvKfEWxQ0Ru?E05ULu91NfU11P}&Dlp&$7(fjM&{P6|@v)#+GEpn9 ztD9-Zu2}>wcFy7|XDp3b1l->}3kGBZ($Iez^lvxoG?GKrzNO5stE)Sa z%A$%PlifE5?}{^t3G}X{q<{M=SkX5e0)sCol`Syb$GK&9Ger|gSYi-cQZ8f6#5V?# zS*D2S`IeKHC5pQh%bFB~;y?q^c6fQS(X4j_8$zab`+WrwSE%&zQwJJ@m+sN3hR&_6 zS0cSx^%`5DMTCN)9M)XHvj%W*uuHV6nWY<~BF@u#!)b~+R!W@%pvSUyDM@haE6QY$ zNX;?AD?FtH!E#^C+Q~y}-pnpa!YEX@r|QRzquB(7E~)*!K= zdFiL_*`Y=NYw=#iUX#B*sni=a*T^g;FQb%x6K+%`3pagb<}M3Me-s{0s3 z!jQHB>PgUMUs3G%=|?sirHbhG=dH-L763jaW#zp=*o?&!W5dN01l=Wj_~k`=_#PKI zJ8jMQ_&2Kd8peSsMaoj_hz86#A5i-Zb$68}Yz&xF8@isQApa$y6Y9)l%&9gBSNPR? ztl`|DsMbXDoHbUqb3dw<{VSWBbWE~ArxN;i3lno z51u9^$-XAluu5W(Jz zp_l)M@im-rn12a|p19vK6X?WUFLbKPdMI(pCewB%xA}S!#jyA}>s?BlYsLj_My)$? zbYr#k@q^*UXNx=%AwH5e3b5Go0BqEk#ERURH7;v&$IA6)5JqORIHc;J?Pz~^ajCJneRVCu+F~DRgMMr?jvS*v_ z(rUA~-$Fim$dbr%vU#FBZ~UOVET&snd7l4F*@geXlD+)Q`qIP}W9>}F)A9#(+gpDK zG82I|YlERn&tcRuHRwdU{No&H$5y6LR}$b`J?PbNd}Sgv;z~ZcN#(^SwQ9C^Zx)0% z88YcDURgKNsVS<@1Sact!duC4N8zB-63cU^*$OXvd!ZnHAucKH+Ce+l7!u<;izs~i z-1(f((ZuY?rpZB7K|8{U@THdT)zydU*%`yo3~nr*NcW7;Pf2F}O&%U7i`}=qtpjGU z>xQ7!4RSY&!mL^=$9%5kwY3Yjhk8nszIh_G2Bo(PA;YN{i2g*VT*TJg^R_k1fv{Al z$X!=V=!jL;bBw2T_bK-5*L7mF3*!jQ(0ty*%PWaiSd90EA%*!E(_pD*5tyXZ{L(I8 z&^JZXkfcuC9mR{PH@GSm*}o=2&q4WUHFkoO-gC&}`lSMdFuW*l#V>;nv6@AMA_arE z_r$j`#8}9(`n`u^Sv{&(Q*t(MvKc!rUy%}Ohp1r7O15Wqm8~S1@I4rxLk;^*rEZ_j z7Cjpe)V^r>8o177=g*2@C&-3iE}B;hdmLs&XkJ`BXnZ_@gbBf##7 zUoUbdc2}5amcKj2T!lKB_FAh@?_F{s#ruUXZcsEDc^suOXSKLx5yX4~nsj^gJ4fFH z9N8%qet6ys?wb<(Lj$p&|vPzV|3ak zDvG?9?t9J7CF8M){MKWKu+wXw5c_I{BlK#M!_V??ad05V0{Nre^elspyTDlFeqFI38E0EJ3>&L6=1G5jTXBDp~Rjv z4Dj#061?f^cHay(PgcF?{&q|v{XVAHt^;Z>jQjms9MqHx!S+}nKAyg2;75v1@DrHU z3RrMd8^4{z<49gQcOgntC0n&xpK)Y9bu%#J8K?SL@a*#@ZaPeAS<5;Pcc?A?GIOh* zUt3^e(y~Hp#w~w@ow^71wjIclCMv0DMIQDBSB z+0avSK4_f={1nREk{y>-QWbuCewDrX@uK?^uHXeek43mYax!a5`s3IF86I{3jmW>>XLz7{8-`c;P#M77= z^^;?hYOIe}%g*gTm0c z-+PvY4^xxcM#_w>HQXVTn7K@7RV?pnC%ld#(%34#`@v?rmR)W?BIs=?BV9?OAhDow z3ew&!Oj6OP4Uuf<(K92LpdVULTS`9Blr<1oqH^I5$eQ+u$sg+LNC|Y-AzdzYQ57s_ zxGuJqGOFs*?r>S^tC_>5Qq^6I4%;z~v4(O~HkEQ{JX6(r=lyd(bg#Jsqa2ZLvg(vae@; z96PB-nlYxn>FRoLzilZt3fYmO^(@N`ldxhiH&7r7nU%lR=OOBw0j;4#HAy8KU8p4l zuOp%&jZ~!Zc)7h>u_P|eRhA+#e@(u674JPa-+lVPN9Gmq(OR>UO5k%sn5vj)p*W0Y zp_-`eH%o38$w3v%mwTU%()EXLE%E8|IbNtp6KQ_)1{m@SRjH}OxdizMZwD3oN+21) z2jO-S;xUDy6AVQ#g%Z&y;6s0QNnZ|{o#(PabN_VQYp5kosW$`2BCX0<*MLAT069SV z*Y43D$8rjYNku=ExKqt+nxNWLc&ZAY2Tmi-;lu1iaafVo^%Ms1Zvqw3CJz{T(fX&R zsWEz0Qc1I&6rs%$!j5O_!Cx9>Dnf$HRGI*r{3S|klLA^sZrf8!OW}Nqd!s=ra+6-t zXxgW4G0LwtdrzhCN(U^e`cy99wZ5xkuTx5_T@ddrTI3yAOyg&k8!!DKq%A;dc(2UE^i0U>79jbng}6nIu}T3=!A5Q(#IAkqL9dNA zu=&sg78nUpC<4y@+MU$0z`<%_3ySII@lZ)- zh$qhfGN9g52k2C&ih@lX6R#}UtcI&Msy(G*Ke9d}G9sTrhYlGaDJMzbeh~xlsQ^-g ztkZvpTjIJXZ_M+v&E3klPW$9Mj zX73_B$$YjD5M2+T;~VLdk0`Inq1}7#Ga~NtjH+#;`x~O$42_oc!|V&iRmc8g<*J_D ziNfoWm;6z@@#pN7?_aPlDEhONEiA$5Lw+s+xnS-rAtXP5s?;2>6OWIkYYpkKt^_8+ zWtG0?e8p0Jd3u7ylTd%t&(v`nbhDZTiT?qlKr?(G;#qp?Ks@oEIuJoM(*`hNiBNZB#H==7q+U4&`Wgg0ETy0W9KJ$q) zfImYy39tB-6Wk9@I!mbj00t+vW^?BmOaAnO7B$~W#5jbo>q??4hQv_h_*PZ}nUjVb zu|Zu#-eS$bTl8!3O{}kSeu5aFKTs90QhP?%Su{Zmch~in5AoiAG-K;$c>B4Y9}QxG zhB--!QJH7e0$9C&pWqoiQ~7B|9jn|r8*xA$2bPC2vlPU-0poWA(Q4Y=+ksTw`XPg< z`h%kO)@qp!W|TdzV{zPNF25yoFR@FMCr}DOhQ@(=k1j7F4F3cc zm4rJ=Tl%TwMdTO8r6p059%OY z%^LipooHUO0ws9Ek0>Lq+@1wh#FHsAqY=|g7ta)iQrBP0sFAxd=HY zk^Xq&nR4c{6ojaRRd%(I(o*)=P`q=0YAEIvHJ=)apk@N$bs$Nd}MEH==uW_|uz5LJaxQ1=ORrIQ(GO;4{32 zmfg1THSt<1cFTtvl*14&SiL=#j-6S(5T8hBOW7aN3{|aG2!w`)j)Z(D0%j0QxX|*Pf6DdAy$=$1oS~y0Uz?r; zUJv(_KyZtJFK{7nqFU_{X5Dhlx5gDWyghpjW3Z`_+*NWKS|eh& z8D$~H6{R;P*~)j|y7~iW%(WJTr4~p4(}e($uLa^j^lE|cKnNw&UGxC0dtF`+(z-m5 zVLYSSv2$oW}diDOhckUvg*UTDhJ+9*?oUVXpSxPv(mHb2zzp`t9-mvlSFtpdO4)@vQ4nyL433pQkFB)Q(nIMORR94D_@Kvfo-}j;k|`ftN^+BA00_Hfq%&c*K46IqHkmK?<4So zuRyd$2!2&xmg`A?-_j2fuh%y`l)hBs7SYaQyn1(iAr(A;jBB|~1vt4)oB_z7X@lq> zRW}t_?fAq*zvKqV)^Z@)SL34JCUeySIWy4``Ah1Di%@rchB0}2+3%JrYZ6f zP+7@FTT2m*BTK+YsgJcJ{az$&7T-C#(FS z%0SPb(`HQX%$^tXS-EeUil?XX`@EvEiNKDKVy0d#djHi_i8h+qe{5JwNe4ol0>lTQ zID9eK7Bf*>(U@XBx1UPu#w*e5mnxw!^u2Hzl+iH=fmg%xTvJ$h3>VtpvZ)gm5M@9X zNEf)B`uaVjNKsTP+{!Z@E%`S1R)x=ZmgIoxlYtRRaY?Kl{!a7^O$G4(q?duLH2`Vg znr{zxs?i#siVqXSz3H*|_!1xV>b>OD$=W`F+%!G592)cJT@~ZSAD9rbc9_qznp6!V zV2C{2u&2L2?ynT3=|u>BmKuCr{^nT1oe^U1HDqMZJ#JsCiF$^6uAFPUZ;WLlDJn7Q$BUTKi!G01}OxYoeawu$Dcj!6S$RnnJ9SaHgy(%Q>?l^Wv+~V{(8*v z%hY1g(7siI*1LBV#}dLDuE_~y`&)ElO3nB8PVyLnhv`!Vh2|ov*+Qm4 zR@xO>Rdr08Fxkv_FX@_NK3-_Q_0(x=+Wc@J?|cH5uHPmtocnsSDfZ(#K~cS))I~xQ zX|DHD_ScasYc(TX!{8p`s8&c)29Ow(MCntC)hY|%quBL(0tXDc-_+)zMX(7mbFq*P~9)&1q*(Qn5--_OJqs19&G@8aV;_DjGaSee zli01kdFj+evxk^xR$mw^Bueu+QVq?k!!wzwe?`p`ycOZt$$Zx$OJHoZQ8?x^Ghu-CEH1fCdNdSYSme@fD`ac-%|dEEm@T&61j(u`F94CCdV4<;^{|7 zqcblN)TNWxrwvlrzuwr|RWBO@-3Yc7a4)d4v_zN_041Tum&Ebs!c23SeS12I;^qzE z>P@|z@p?GGyD4n#w8(ev2_NV%6Rcmh#ZT|sz_38dLH9(H@5>+z-+)A*v*e;YUfxXv z+Z=bK9Q4Nz6p)T{PIa5FK1GW^v$hl8%&GSm-`dwF+B|-sc*C#9(sn{*bcpu6r;qb( z6QC|-*I>|P%Wb=j$*ps|f`;H+t-SJX>>yVbw&>)Q)Ls4w5B|Dkm}%6SDX|t~$M$Ha z%$3WoW_e7|ZHl>6&dVQTpy8l=?CYx_;sKeqb%_3b`(2)+Mhyzv!P5td)!Gqh`x+IT z{l4j`@h0VoS7i6b9=`iddfj132f-F@qk^H<%G)R{+Q(WZYqvKLdq^pJQ*3t<+kOXIy>J926cDjJ877KJNta^ zUS&Zx&8Ii~F^jtj)pzWp8aZ}XW`-Q|#IWZzyqg~)sMfMJXV;73xB@*E^JqC5@3pEo zI-2h?h6E{k8SgtH#~5p(Y34hk{90)6J8Wa?^6iANZ_ryl)DU&N19kgzhSqJ3#)_Pi zSbg0dL5(*~y2V(1(fKAc8Xw3aE7{eP$}Fp&)Xses5Eh-qC~n8!4s|VnoF?S+*#N2o zDi|6Yb~724Rx|-$gvCc6t^?ra0#|vxAdQ=kZB<}_k^z()Y98LaqV8oRBcq57KsER}c^WJN7%2;z^#@z)gO>%G8H=qlX+WyQ4IDhy`GRvh*&(^V!9Aufg^VPyW5hosz zt!K^Tv%v0X#1yD8ofOFt!`Xzz#@*`$>QW6A9=#vax>%%Ah56D-$a>-&0UkO|&r`4nZFkBVcuJeem2t2WsrB0Syl z+qDuiTf?NMODYSWy`6kLJTR?KuJX3pyFYExEm3T#e?enfL}=l@(^<9#;W8rsD4wW< zz@yu%NJ@ilmVC&@*~;;E%4&g*Hrdzeh_;|-mKA2aIHC5=>&LYR=|p!|Crce`j}S9N zd~KuE?b($&u^B^Mg+;5T6OYxH1XMbUFM5hnF)4xL*lQ12z2xnwdDU>gE|uJVH|G_K~^;N65 zP~J2yV6w)1J(V6)K*8|*b(?@05X2x?KH_h-8p@vHP^aBtE7xnPE0Az3VURD<@a@X1 zx~VOXl->0ptjlF=(=6b1y=9#o!cOMQl{wzEFORZXY_gkDMuV5NWS3hnXGGgty^P?4 z4n*t#C;xB~2w6A>Qa}Vwfi#Fh8jW|Wt7s6p6JQ{`NkKKp2ai-IX^LD#A_~T@F@-`1b5YtnjKB&3L?ItrI@9}f^-t5-OMUAFF zbpX(4ffUh^YkWc8S!@Btk!zFqN&Y(g6I?)4ogc`?7Y-Z0?)%pfZCmHov$#>(LH{lC zPuG8)3!e#}>2F%l?@!C(^%;*z zT%c6sg=3qZ`>;P)6(%LhtSs#b#{)0efQqEWKmCyTBliahU%zR`dgj`~eGcUm*zs(hd>USngq3z&IGQ>hO+gr5iD^M3kb{=5SQY& z3WW}ZE{wyb(A8jo$YSxg=R>;1q7Y>D4#>#*Xz_iT;cwQ*^KcwAZzfy}sh#*21pO6^ zFCa4hXoFl|KJJ63ji!zMYu-P6Zc1v`?_e2E{Y!!*Y#7`OMs9wjUkuFlwfOC+PhCph zhj_V}Z`;XTl{tlr;QNtTY=9ywPj)L)+d_8L__}7VrZoAu#I#tPI$qTnb$@v?GNN8T~CVnS6#Q*$UZcg!JIZHZ08Rh7-Z;6OwEzxLOXiT<@S79 z248`8D8HIJ&#aVq^lIXWYb-pC*ifUFwpTX5ZFfXR!%+-o7UlTpO*JYkh>s%~p9fuQ zjqim($gx82965f@1O5EoP%9XkRI9>$JD*E`u=lmu1Ce^rK(~Hj*Luo$WBfMa)yJr9 zduiQ7nX$5vN-6uRdFPR^``fF76}v|mB$0k>uh-~z%Mi|vyD-C{$5@|KwM7Xv5+?!} zdZ`)_T4(k`FsGD~r342=S8*JR@0*)qVKiU5shbkhQo(wnm6y!R#!-(G{8--)cWy@f zZsDS%6Mz^ah8rQ67me1FB{qWI2`oe+BO%jgQ1`&6SG$X#nw|8oIGrSH5()BxYmcrwS8HsNN{7J$a zJS)LKc&qkk%lDY;sxQZcHJHrQ`2G0sB>W^?UK=tV2Le1#05sSv5RPgE25|}8t*O#( z>@t7q*&b{oOAC1w_4;HB1~Rn_#kX6e7J>7%F|1lHNUT~QZzOiDKqPjB&q$2Q;z-N| z!gvnl@_0X6e3Tghv`_y;`lIw_zO4eE5MfnwYwY{JHkpedtC=3VU0zcY>T4y>(2HJ( z!zsFJFvWl$G>1>bR`%p2d8?PF=4KlX_h9^*L5;_GAD?AbkghK5rFVAy8A{^*6qjYX z!IF182tIE93-HRM!%cek$u0zz2wr6qJgbwEuw4NRv9z8{nrnYoGln(d!JXufSDDRXB8 zv1=*}x#vl_pu~K@p#1o_QU-~=K#k-UU%~eSu>gMKzm)$DIvS*HSws&MBS-yoDe{T?%fjRO zUE^JT!<4xz$S^%P`9gFC#pq({y^~lvN)YFZ+0UjRDa^fv?#M~4if48KksdOfiHvnN zaWamX!WDR#S2hNf^Ol$o)`-3QwW&Oj$F|f!_8&nG&XdB@WGSz^3p&aWq23d|Cv=A@ zMTEj}hiY0CfO;y$g0aUB-?BWK*YCI>o>xFd&|O!t>#CnascETc(&uoj(T}3Mvah?I zZ5>?tozAOv>TPqsBMHb`Wp*Ua4sRQ8p4Zzx(l}TgaowH~Vm|(8UH*M|2-s_V zfUiGXHrK}!bXqp}HJrjJbTQr@IOBPpGmf^+os}Vx)gLymGv0!B4Q|U^$r3Mq4b5`{ zH%B832c4|e34C?p3DbS4_3jU7jWl6P(GLM7XU5p}`Zjkh3#W+ZLk3;^PfNK||0DSC zLn|iWt?pk=tNU)2m0c?CkHf;55T4*Y$#a;RMR{~#5h!?QY`9;~#Rm!!{s1I``$eT5 z5eX?R06kV%4dyuvEg+5D+Xw1T@PmXFa8Cw7eE?cN4e}sRwvX`8%&d?IJIn|`oN8YK zw842Wy<~wYu-Us5;TX9ma>3YJ-!#xE+sIS*YSLhOxqHrrN+!~WbL9;u-Ln&<1hcdv z2s;DmUUCR!D<%I6Ry!{DfT4%&jkg?;u| zv_geEWoJ+Xhxq=ybUb4Nd_3cK_yopw_ypQ+cnDoOe4KI`60dqL(y?yKtjKF*Ul*!6 z+5G-!)aiN8X#xKeTjO3w^q$a!;@j`wuj^>^UDxWk2m~lnyPcV)d+YGww6-d*Y!u(0 zZ8{o%fEbEpQOM}AQVU2Nh?Ldl9a_0*~ z?A0f-t64t;z^KuU=l7EW=b}`>8S6V>8OZD zH9Fk$m}6}=h)fAjrJeW>67kw>HhldPG-nUqNNqMOyNPX}By%||4!athivNJ&1^wOW zFYn*raaq;=+d2Nz{A7}RdTjs2XP9G{EF#yreECszxX_{`F}Tq9&gYM{dNP$^A`G7LjRBRq598+p7Pn*Y!LFieh}Mh KxwVj2g85&1%1-v4@zE>`c_ReM*{-8I)-a~Js~L#_HILxBhbL7=dE1U+|x@Vr6z-k?|BAOdd?p*M)g8$|34BJl>1dV^kjgWh<9$SOeKm~Vi& zc=(KB`2kHXToqTM^$q7Co3{Fz7U#YfTx5(`#Cy{0-uR9CyG@uEh8DuQRkLQ3P9=HP zG%tp1i>Rn_ZXB!>D0IP2I9t+~=ja)Tr!i_i>geAO*ywlN)hmS|vrWwYV-By%T%yeA zou^~&OyH0m#WK0XsW3`~sv;M~Op^hI!&K2}o_oYVLdBc!OR$(c#TV}F$dqoHhtC2D z7p|9lk7red>!^~n)SQFDonoid#eY)C%C^PTi|CBj#kcQRb5zy&lyLUs@`3{2cCz&R zBt&<@nWfC}pMa`Otc{<-qfwJ|z2Ijto2wUgE7djeMQsv%i&$Qkj(?gr@RAlFr3fTb zl1-^q4H$p%Gw$ecsz#RrEtPG2U_axF*W0T7Bf!6bCZ^+jJ_svi;Y39;#?s4xuZpkOf>tdk5m@wCxz9SV6LeR`3!C=97!D|Y=xW+2{2dX z_Br`w5z8#@C4JTO>&CQK*XUk=+HH&f4Vk$t72r@HaH;PKCZ_KC| z(^;Z5?}wWfG;LP+R>&^7pLoy^W8K>%@D)@wMmyq{%dhR`YYMI#7Lwo6S6DVX6?#@qRG>C_Y<1--hXnY!u2*g6xliF@UCCo+|6C1QE)nt1B5;14T< zR&qJlGk7Lv5b~0ue1AHYf@bTO)8A^&*7jmXz)0Ax@{S(#CXFkuZ%`_*w%$Ye%U>WO z3GxGIZ&vr+Xo3!BCUzZ6Svs;p`$RC)Kk7&B&1{K1W8E zdFYpXTc{a`7W=&f%iG6M&wWQ&gx|qU@t_MR1lyhaTxMu)_XQXXi-qTZQFD`CiO;x* z9H8{DoaW>aKNgR1;qF6_Z1rf*`WdsPTGS66rX^3;^`nK6#&R`%$s)=9M6cvMi3KJs zU7oiVGo4>=dU)_``2dMA7yD$YKM;YR$X-#0K=vMSDT7F$qQnD%rSp`#;{{`Wp0 zLuhi3Z5qHl#nniDIFzsPtOF-RTb5K$L(JbG!`WbVI?l#!z~sp_4= zr>|expBH5|pG{*;I9ZQIbGNI4W-qfVTY0aFv6O$tjk0a$^EL+$l;CZn2NbjyC_sz8 zqrfXc>#I)QeIZ!d0_FV-4i+7W9Dm4S@k{tJ#+k$IfZMj?M&@0Zt?=T&9sit?@=YAg zoLuB&T7rPcq^4WrM1dVM&NBG`pTx>Mxek#*Yzhsbh9?VsQ|V{x*bKJm3pT%bToWU6 zm4q#E2gl3XzWYLckBL7V%cPb;D?9uf<_IqTAQzh|wMcW7TMo- z>cs4EoRUTCQ2!URC(VWG%WrdW!SF4TUP&MxR5y|vz6<|_lq8`fzIecn$E%Z+?cQE`ll4% zF&^7ToM&uFIM0|;#(qFucF-d-O{y3$IPP4SGA6aTgwe$X=!o$iZY@;M&^W(yH~aw| z!JA|BaSBz%ew=BPGcvgQ0!g=B8#e0^;?K`eLBT=G?l+eAO3 z+?ffs3ap7#I`sr?ro;qFuDJ-;lZb*b+^Nhf)xasikOTtisI#b3hnYln+%R(TP|e=1 zS=#P7n zdDw#GRbdR|)L3=!S<*ybkdnNqp2}I0ku#mAo7ih_Lm`QBc=mReAX=roJLL|h*KuAy z@eDKRR%eCFhQDGU&skUb66sB@h(e9_moowUTr06JCiMuXMtni=bkuFtD9axngPp?G zJ$8W7*lj;BcEG~9KDa+G^pN>@haKCgfvyyP3-xIHxsVOKwEN(c<}p6L0Bg`^>_yrZ ztv2z21M)>_w-~`1N^Uq?w#w)WUk#1?gyzoDJsNi%J;cJIZ&ujb5lYYyrR3ClFTx6s zSZ$|zc^)vz772GcG0)wNJ%KC*Q+wl1(-HulpR&^-mPixjQMeztdu`kF72&&_GH>}$ zCPS+bt>-@#P~jCM1AH6rZdz$VQ*p$jUGkGMTy5a?d%BQN)#4nc&7O+mdAPNH$(uoF zThEclx+T6uHmd!^nDW_=*S=M${PaG14j1PwpH3kX_VG(xh!EzSl%o2`x14=prc7u6 z-Ao#DTvAe84Hv5zB{(r<>(EM^(={qR-p3#Y8B#Q3Fy^D#m%J!)Jwcbf_p*Z8z-mH0E5qI@bhcne0YdYB>z2MX&Q|1dgLlH}o{2I9X2bLL0b_4QM-Y^T z5e3wqV(RA?tl>j1OJLXOV~<9OZLW6#7p52A%&bq zKBdBXuW0D$k^(&DgiIeK?GST=c7U?0~_;Z zrDJwW6zJy9>Gzo1yD*~9b(d?EGVtE3Va%YaS=`EDp%K+^=v?0~`LHHt5Xd;wk*oQZ z(401qIHOPf98LQUvqud}?0n+RX(bRY9$qwKT@!!oOdZ#nlGwXym0blC7kyx|W{LYe ziUb)?krxWjS=DYIJBbz|#s8UPv1#b*2>OKYr%xy`eOO&%;G#$&92hmYase^!n@Jjo5cHbKR?j z0pA6!cs$6V5OTWy^7vN(g(B<;7R5Idd@4Mo#4rXG5ogW%Y-~mzyp8~4ME|G}7%VEH zr#OS5RNpYj)JcfHI;C!F4!0=srh1ojw8N9~bsR6lFZ&3i3p{z9Xy}m2eBM9Xs-9d= zuY?sQq{#ds$9Fg9a^mL?fgTbKrY5t&73aQ6SnbB*FX}vnZu4jkfC+tBX%f;IS%MjZ z^xeGfkCV-JzP?gFx95eJuVPwfO&2h}a*>=hGy8n6)fJEP zHK*SuM!xbN^E~AUJR&`2vJ>_y9nbR3NsxUXtDjbXW=^bUF}kCz9UDdSlznh}EXY<; zAtv$a^t@_0M7GW*Rc<_@B5A}Et3h2)4!)NDb{N|9ICi&m+?5xL*1JYX`jShq?p%56 z8uyHU(#f|r4*7OY?p$*YX-<&vDXjS%B1i4y$?1FO8)n4d0sGc>&q!s&1nl}CdvjoX zV8aU4?!(jzEwEPt%0sZ3;GKXea4}`q-eaJ8sl(D$546fy=sT?*W(jy9!3WyiSuodc zm!&K^1`vO<3YsKe7a=4MQ1g&g+WFbtGPRhNQPSEG*y`D@KI(HK;ZR&d__m(>Z2}(y ze2U}p><8zgB>jkRBnyGsKK2(QF}vyj?-yFImIX_ueZP$vGDMPQprg5@4pO#o`8j3A z`jl_6r8!i$jg{pPi~CwJ!+g{(((UzqbF0#P94q@uN5rR{5b+u0Pos89RDhQl5orm* zO~5s~Ms$1072GJ{c97PUX99iSPlxr_N7Y#og{9KBkjc*Y&N&QvgU|NCeKE8o``rFSW=sG7}{sBb~y^(walI6};P-?goMO?}Cbg!M|G zKCXT_?xiNpAF|hMQcI3wkFE`Wq8{UlmIPUC7$1>lBIC56hIB4~8HkQFYX5$ib z(F*AyxH3qST*XL2z6(d<-KgxfCjY=nRi8iKGFEz-3_@undw)qMr_qP=!xd_e9*GnB zu{6rPw<2{OnvAIGEnWXUab(JSNE}1cC4ME2FT{T(j^`}y(ZBLW2xa-hf4L;{YG6Y4 z)hnB4)uRpGGJc)pIlbD>JaJW0&GHsUpHBPJcPaH1?rP@xS$fm*UndqvFJ1=IU%+~= z=*7L!c&;XSMrTlO!*#ld#ig^Q6oKGOIX!c?X)l}QK5_Xi&29V=AHlj(fU(<(F@zeT zZHqXP>B4D8J>A3SCRvd-iVhqYZScv#-QMtptnG0hi_!s0cMdsJKYU{B2MwC~4u2SC zu&L(3o$KwG7%${*eM1Hq8hPzGrtbv??Aw{Rj0gp)-kpZ^I^g!U&=#k1B$W4NFQlzB z&HK?_{GBTLLz(hcWqvYT%J`KjI%+hVXjlJE6v4kT#ZHt>5g{EWCj3B|xvu0_Qx5Wh z&e$k@A86s5DW8|2^j+ma?pwipPtP?W=8IrX1kSsJXTZnJVH+z!ZAfq%SoT>$g#-j~ z3H%1h903QLaC9mwcfrSw#~Jc|3CswU1QBZovm&3hP4|Vqi-tvtFfP>rL?QJ{U>d;u zZQz)IL=g26W?+>0ddlnVr=`2I%@AXc_Yx55*-s+)<2)u%!=RqsU?xi5X^iw3# zcK3sR3^Z?XwwUTUn`barr+z2ht1SDnC zYMc=w8mi2X?oHK3O>!>NPmh3R>%Xx;I*5V3eJw%$nI$;3R%A%$FD&l|5)ATL;VkB~ zQeqAD*~it2Yxl*!_As)9R;f07TD7_`TwnVBOd^=1UYN{5cM>fFcMalEz(A46&tT@q z4bebnGkD9L!4Rma$~-73b15Bi=z_iUzSRSG<NMRFP;WJ9C=j1g3l2k9USRO_a-rFFTsqZYaUugKAsi$;u>qr zmiazI%KL0TqJay`pw_4~$~UrCfWY=KC8{P}3i0D0+4Fl0rZhZnnLtD&U;LhsJoN(+ zHC8=IUG}8T?U)Msx%-$IT`p_5knP&IhPMK>3*5C(W?ID@4|x$8Ggav4vt8(Jh8CnL zC*6D7jlwfa8mo8obdSq&YQ`pCp%G_SO7)n=< zbcNPux)S{3@`XD5BWNBr*HjKvZ0fulM;xPz$3x<`q`fxH;rFSOG2BIT_vQTjPFz37 ze?tQT;mrekLX|=Gy1*Zyd?6}p;8#%g5UFnPtCzl3Ms++Kyg|(+ztQxx3g`wyK|%RL z+M^zbILX&o6YsDh3Ta9J*;r3Y7x@8dyL=gmIaJnn23(-dVA@sLBP)tJ6=`d z_U&x=Z9N4k2Oq7fx2Wc&EJ1Z{|9h82W7}cE@OzYxov{Ze&tc{e4TdM~)6Tx>r=tYd z#JTl7d>fO%Z-J3udO~WAiotBe=4js5sIvkcskt}CY6B~nvrkl#Y#Aod$*&n)HQ0x~ zS-iEvJr3gj5xedc)9>g*XgDYvUJt{S#W|DOu#cW2nwf!9nu-_nwk~1Y;=j?>|HN8> z|DR~ns@Ug@VvkwES1_M%7T*43_`I4~YCSymp^_{^ zxl=!&w!o0rSYCpH%VgM(g^lu9;tv-4NMa#`s}2g>NTMZ|@8mST1vcPqHgbNj*e-O@ z-MlKI*G|mC-gm~SOJq7HdUxd_$y^vGR|_>JmvXtQoSjZhw&!Huadr>c-2%Ubs(|eE zgP8zA0>JU6**pw&Qj&EKrt42wPNtFFn#orzv$CW5fZobjl;S%zmUI-sDCAY zu6F+;`TH;2k5}}c+z)sle+5DRLjGuEXZ|Tfdm2PR?&A>m zuS^XcuB`ns@Ryl-YDQoKv>`-tm>dqJw00MUMmxoaO9z@|ljXz>XauHviAXdl65!#! z4~Fv>l|zX)S<~t1t#M)0WfC4X`gIB@M18_jDh;BOVv}c|FHe?C@$o4Fy4==Vy^STI zFumbndBRbbf3#^_?0|HlYQ<-zOUogK>0mB$4Ru0m0(*t7_~tpL2Zjek^|84~Cs4-V z=SKGTBh`XBq$|Up#gz?0`qRO9Pe&3UTj}68Bpwq#?~pJZezpfucfT4 z>UM(1Fg+!sky{X(8PK*{O`4r^DdX%BS$YwOlej?c2}lX4S1KLx51r}~T6c&}$`HB@ zGh`+*br*Mr7wjgv3EJWsCRng-DI^Rw(;ArYMNkSZZ&bn2{!7l^H#%W|-b z15imm60#XXgOV$T=D5sF=*Qqa$%5GyvuMXh#U6h!SU$G3BKNaKM`Pw$L9Y4b0n0L; zO%?n{^A#5b)zOGEEt|Yggf&4~C6oxyC~8NA>w>PhMDDhOL7p_$apFrHGbNI|(b(TH zZA{*Ilc|ef-Ytef&N1rAe6D?_da#Dcb#d`lvy@YnMjvczPhB<6u81Nl0Eb zSmEicAcSfHjPvrBirJHu@VANyp{W7mKxILMYrxt7bkUnm3Xqzc0lN!9Z4RItL#=qE z5&33xooOwpGFzw!wjTEvuC|Yi`}uPiNc#pSYsc}w(SET{d0mxbgORLauTq{`7J`=RJ@IFwUkf+%a3EM=&%1od}P)Mn=fU_Uxm=3h8d z_&F5|hOOF*SrF=+#1>+i#wO>f*uyz*Q_M_Ri~lm6-xK&+V;Z|(sQXcfy!=83omP3L z7MZb=^E`D}oehvPoP=BU*ry&bF7eJQ|f;ppYUWT|lLfFU&u14nWo^#_J{@Q~kha-+zhjPrcW zrdG-Ds>PqZ;^QV{zeKz&u!E`KnAdpP*@LU9LA6Rd0WLF;)OQa!dg(R>XB@D3sC*m$ zK0EN@tIy5F@q(jN!5I2=>3u+w0|a3PO!l1T{-C!Cu>ouX1yuxbYy{iFr{VAS{2^&U zE*rtjKvOkwh(V58g*t-Bq}Gn8Yf%>gH1ov?d9gdibhQd^D}gIfXndG%#7f?oD)stJ zV(;4L>~*Ue{4J`TJgNR4{bWDNTlH+SF~aF^=@6Ev44lLsnVoQF! z;SMH_<*nCp$lqMyA?kdk1wjDpy5A4DKT?H9&QSLSL2_)Z(b0K|Fst+*S`mNN|DYB9 z4^mM^OG9_{=BOMJ@}lMIyS!9ZV`pDMks)+n9@{sa58%Y@lSK1JR=vda9j^G8&7tG;9j&v+FKDWT@F9 zPwWo4o)CZj$vQDtoaQX9fh_yoVsvQ3g(aV!mcCsVNm%O$&9$j4x>z=+uAs1-m*`Kb z@QX7@pz=a$(!fm5vUq$UhiTw9(0iK)FSj6g>0lyYyw2ty%1)}^jy<<(_8GdSboJ*0 zQXIMg@f+_!Zuy+q@>g#}dx3+`-_FTGkZKOo(d%>~&OFD;)#Q5#iP5@*@?o2n8V9iS zE%O^&PCD6jqVF`b5ExkJ+59>8Hq-M=W$#x{>DDdny&ps!HBxJsbA|5sR;+QLJG?tZ zWctTWa-b%@9tB%5+qLR-fSYKs$~RG-4`}=HP0}#oh^WO=KZs{j{7L7OOutL9{dBbk zMKL$wN#!tbJc(kof0{xV#{x(h9cLoH)0^MXqA^6=+t+kgupQ`UC<|83pZ#R!b=k7B zY9Uu(1EyFA$+~A8cMD^nU+pg5Neh z-rVym(Yvba+!+N1oH%{YYyO2M>Y@qNNOp#n8;DvQegr85JLmkLbZQg~(mgk>hl zfb8=o=)cgvRP~L|Ddk`nyXgrEc_t#198+Q8v)ku?;Rb0F?CNP38@Gk}kq#it==(DC zjozhd*-QSRp1E)nzaMZkk&5BXk?Jjcews8q|w}}XLKa$x_w3H0e!!;gw5#66#FLV?YJRB6+hlNuXgN!Xh zYrMU{uhf$$LWH{;1;}J%A}-$S^_0C5_cYRVwu{ufO`h(FoRq7_bURYGPB-4_&lBBB z$z+5RA9oz=`BmpE)5zVKq^(4nNETAd*Ah#}CzhRyoGBtz$zduMKdr$m3B~8w^?obf zY@1~!`6^flJyNh(Z)G=Z=@68uTOaif-3(6eWyfdST9YlHmy+zz4BqFq78>=k5xUi7 zQ9G+~70 zgvPWXzU)l{G8t#g{|^;WFEY}{ifBLk4y6je7Te%#_5J)(82|*;`xa(TgtZH1M(soQ;Nh^Nwi?7(c+Fn$O5A5QAwxtz>+*Ec@oaPzI0--67 z`A{HArlouQO|VM=&3-&o0Sdz`ndm7p^dGn_JCw58c_s}lef!LRt5i-TySJo3lKUhj zV&Ut8v4K?G^6i_?`T5PK9+$X?} zi-?!dTo+yVLy|YZ;OEE4O`KJ|8;{gt27=W8KrMO>3-P~cAIs%7QbIx=lmgTHK)fY~ zZ!>b+?a4N;IvU5$19qe}Jtae*;#G$S*I_X348tCE;RrJeHyRJFS`F;im?HT)QA2uD z=35%!#{1?>Tf{k3<$aZjanev*iRP^`A4-bD(HsWigA041ba=YloOeeTX>%l`g-M?w zGy~vND8Z_n60iu=)20Im!4Oygqp6;IjdQQ?E1PGXiSEG9yLU0x7pV}bGO*p#q)f=+ z5EvUOv}&;oOb!KQ1%ayoKit#DHRbgN_Kn9yiAYp&x-f1k=4{&hVsH`V*DOt=SyDU5 zb?lta;KE-ST6Zxhw>vJ*XbV0uPiuks?$V{ra-3%e>F*%Da!O!QbpB#Al&w)0Hdxx- z_4O?!!vy1?Gy4jHUGj2|cNcPsq!%~p72gKh??Bi2({>c19T-Sw(`{BiF0uY;LCzH` zv6t>jC}3z+T$?emsDwFdFsl~bzLOYMd_*G3lS^@|%iU@jt<2D@0Bvov*?||PBZJ|} zkV6vWldoF;nIfO*$|~>8YSesC_gMaZjR&pUC~gb;cR9H_3jFNzdYqW^dZ?*$Ro?1{ zC;fbcO_hRv2LRc>3Ol^fHyKCmZ^rK9=Xxu4-JL!T=p?o<${()z^e};-9v`Ld;SM*%1U^hcJEwA`57{3*2TDN$5j-)RD{Mv z>~;{fzk=BinpJn`)VJ_mLvhepu2trNv#b}2C~CGu0}F|)alc(opTzBUEQG7GQc^Tp zu)o1SdogQdY--zNxR8QgwXm*4bCKXc%Y+)Yu#1C#oy*W!jx}>`+P}Jf>X^u9nZ)V= z3nCzLIJn;Jm~w#1yQXK(QVg?p0C2p*rG4G|2KgwrjskwG{*UrM@Sy)IHg#Mv8M00k z@&0-&;6XF#e&!M%Xbrx-#cWYW;++B~5FdjiGZzHo8-~%w4fhCIb@vP6Zg^BCPn3Zovb!sO=n5uxo7Huyyc6<5RLELQwNW6#Z}9Aio&;uBj4A|@-2viO z4qK4~o2l8n_2^!$7(ahxf1=EK#iyKUrtePUOm}{Ke=qlg^Hk2^{@Rog9BkLhllR4~ z>A@A%#qw_fuyma}lP>rmatDkGhla12`|at~nVR*-HgszttYaFCd)2TiG2>-2GP6sD z6RQNys-c-aQJMy^1!-08zOZ-mnEVrN@am!=3MjQV12z|&HZu2J^lHT`P2{4PgC>1E zX3}Bm$PP@ua5}j<9vk?{Kp;A)$QH!5!07kxPYlSm#RUAU`Ws3& z6X8NM=#8(Iv7S6_FDFjU?HIRBPWl@Q#JA}dLlV|9T-xMoX^}W6GoO6+?c#?58ZEZs zl8)7+=atJ-KMR)AZY~hMWoA$;&Iu*zJGRg#W#n?WO;MfM8w4a!bUvH@!cNim5++F` z^Erm5u#h6UujZw6Qf|g`414}1Vjuh2pvsh@u!I{+>0-meFG+NmkD+wn1k7&h$VI1R zUht(gSmlnD6UQ$+I;o6kgG~oRUgrPhqmsNcPLdUGaI_WX8jBQ2$zk7D!ja_}8+1AY zM5AtTJ0_ZO(Q^Wsf^s65ymI3{UEAtXRKQf`a8Ht)h3RB9&}O`?-YehDNkjGbI097$ z)pLE~BxsHds`})eDxMRbFoGh5y?W8W;BiJ&KQd_>1`DAkaS26 za)Oq>g<9*>pqeL%M!gRmVS~?C#Q9k^fW?uPeg!W{g@THq;Q^Im6aoPU z?8QZUOaeQbgTu8WZ)TZn+wRvvrt?RjOXH=&tHXE6sfg%&KU4k$z)T<#;!2cDlnW3^ zt5u4;crag``g7YH;T@^$A{g7(H$4xDVybRb?$OGZ)E`Xjdy298<|Z3s41ILD;)=~( z3hR&<@$zuJ={Ols&Ut&LcaOny*infGZ;7jRRdZ#32F|(m)_qbqB6JQw$HwbmLtXU0 z@XiCbf7Af(79oPeLHeg=|FB;nC@j8IXSdE8xL<^&hQQHfepny$ZVw#vf_*hdyVxZez>Z`zu2jYTB89BbN$Xv0}bE|k0*;O75b(vNO(3XuOeHfHK_8RP$pD#3^Xjhp=)z`~{ z#X|mRK!V(rs6KI#zv(UZ{Z!~_{5Y|{P1v1KGTIznn8$uFUrYQzwZymFo3@iu0X+#C zv6qFT44=)Nw0@4Al=@_5LJ*lvoTk&eV%0YuoMM+lCm-JQ0j2{nqoR*KF>d;X{LwdA zSh00Qls_mv9_v?H!pNdd8qUI!p`20p{BvFJ=vk>yw!3C9YCRA#EWQ`gV3|~n3tk8- zI0#Qh<5?9oOm|g$DgxegWJI5y9K~QRYu<2QIlF{fkl$w3Ka3WlA9>wkA%z z+Q_$eON!#P4x=`9o65j%GuC?kgBk0VPT#Z7w^M@vC{@vIJ4FlOXi>-6iE931gKzJp zMnCoD85`_xl`C*+|0zAEblmmYt`-pA)1#}#N1`x zRAA%u>I|!92@iH#J7Au*ht@4xa4ZfcE~Zu*T}z4Uqu=&)BRSQ)9Z0?DatT&5$}m0M z)G`KRe9fFDFKSRpnww>;i;mV`4g4~2%+91UH!7Ez<#v0!TTMDnonUyXyPI|LlfOto zY22ew3>bPjTd!YdYO65>4Txz`f0A{hSl(;+cGc+PI$SZIvbP2wWjD^HSoQII*!R1; zihXOy9+NAV6jYP=$F$?Q;-2qa=n-tMy}Kn(ZU?kmK4t7x){elq|E_TTQR-slfBvWM z=~t<1UTMlm%PZ7OA>XAVipS2g@0x}4R6kPzAOMW{Hj0Z4*YEXP>$vf76Yub~-*!3# zTNR$Tr%t^QifTtnqzrn+t&GcITF=TkwZmj4wC@EQSC`c)nmsDaScVeI(nwVfzBgii zyLq6W-kTpmlrX)A@f>9R@=ShzglV*bOO?BU6%V#EfTZ-7_etgp|6krG;4kwNCDs3z z=BI!0K9za?>3!O<{x9Aq;2-9v5F3O4N9Lzwrs^ioe=$FyuEGBo^V5IyKAE@n|I_HoLpr`C58S4D5@-;+YzGQfgQ%}ODi84n6fMlggZ6O02F=hIKqe&c^Fvkm!} z2_{Bv`HIK3fH8TJ?utE^J0=LR&IEtbF0|+U(*pE?cDo3-FSqYft-$F8pBKfm8jq&R zxDaeQnY88}&Je_7fiY~oKJ!6!-qL4gNR9$|tTd`BJD~4ovQtl@k(GAz-NyGyryck- zippS2kZBQdPfb{kl$asK(O`7o#D56%n%&y zPAK1R1&JfcSB8Wo6T?p-0EVP275KN3e56MM>~fYM>1{816MI@j3V``Iaw$U=IY$nxYmkpgs{ zNFmhW9KLtf(|2*C#zUXDU|PVQ%7*P(<7cSpBBqm+>xMUTyW>yUVgYI*zVSK0dknN_ zaGt&cWfLWPe1Urm>a)HCXn8^`+ir<9J^uv2%q&zi*JM#^n0c}qpOaPS1RwYr-e0*J z2x;I&IC||%939BjA)1i3Pp7k_5A@F7F+#zo<{`CR&Y~GG@Z@R|u!`k&hul)VIA>%$ z5yft`(jwC05DzZc!`kJDTsphv+=gyKL(U}AKCa{P)X}hAi$42somfzFQ_npZLB5A3 z_+YPk_8i%*X$~8YM$=ZKV-20c3TdAP@RXw8qWyXqLmtUr!(jhEOwt<`<1acrQ-I_=|t}|*hbtN zY{#mL_Ja!`$cgZO;hMm)Fj;ZI{)2m+(b$-r2Z84=0FQqFjS~m5@LrJQEB%@;`i-+= zW-oQtUZaWyQcSg&p;c4ehpa_Gm)aYnFN)JQlh!4YkJC1xn ze4C*3e7V%oEw(4rDrmhG1r`@`=R16&k+}oilZUcL@W4Bm7?tQfp~86Cn_Y&ljg*)| zEB#9Vk$$gkv^c^NeU9!j(sNDJ3cD-g;kG7WB*}ykQZ;lYKZwWY>ZkE|asjL5o?X3p zbkE2#OX}iRz+p}RrLwL`*>3b@s5+g^iG7B1^L{z)) z6QtKgAMN$jJ&%kGW;M(1D!z$lxJ3jf;9>t>da@5B1+S$Kn_n1U4DGX==0E|LF#iE= z7Av#G&4QNfo6;jc5QiH~Aq53WWh`t#i$9j~V`;I#z51<@9RlmZ^tvXNbtWE&L=6@r2hJw#3aO4O`oKI0a=+0Y6Tm8idV~2Fm;)D-Uv7H0RO#G2 zeV-i7{9Jatx)$jK?Jpd2q$iyq&KQ~J3L><-MAAR|pwe?N7lNidd@k;KY~4uFqY@~O zzUPNYc6$www(G;dGoPY*Io|b~dS${E@kENw-cG;JMhHRtgg zW8@n@`sa?w6=MICQD_K@(pg$t*2@MYNq?7z|ELpx)PC-dTB)f8kNK$Ml5*Y*w6umG zanGwZ4(Y>HP{(+M^{WsNYl#1l<57o}EqC_-aiaf$lfjOU-6hBm=7Lk?*SWp&Z&Ro{ zE4hb#CEPx` zY$=~l(;YUp2YGIe$YY1|8-q{F%0nd<)o`YXJr>`oKJCpq`YvY%vve$*7kKye#uuA? z!Yd0*yJ5~6Sb0ZSQ3WuPdK>o5o#?24Sbo`^iU-##IzxZTmD5rFC6%ft^=dOGM|Alq zX6i75ESGwre^ya=WQ2L-<>$*>R{=9n2Lf(kxy38bEo$j)E3&F7n5nD$xRT8G(@C4x zBkq+hqG6-a1}BRXoZvpw0fw9R&Y9sWOdD*g!`RQ0MPo$Bb#6 z9NWHSim5faP*;RUu)`n^rENf-05_&!0;FF#!@DtUoOn<(-7|Y?n&Cjf(UQM&@^cC5 zMr;LY`eCI?5>vz17u5v9U&`2Dhf$9ZzOYHbU z&!fEK_>0qj*#xzO_f2RvH^Z{R)3WiD_+hf3wO=XKeNgzCa)LN@x~jcfc?IIxgrnK4 z{dC&Sevstwou648a(sq&Lo}0Hr{6lA&=mH%ib%+Q7l2K2r(lUn2+YJRWqLc#&MY%# z#t;9g%u0DvDNvxkTPwysKt8dqq>*F2CcdNghP<=RN->~cA?K=8b!SfKd==G6#eS7k zbP|X{JyvaZSm>QP&98x#9$t4YwVcZzK};@$>$jNv@Wz(Ta6k*>@RIJ^lJJmkZL%*0f&AhQC##O6}_efBjCD z!M^MT%kF2TSH|ADK>`S#4!to1Xpd=nJQEjC$Fo*8O>8~UI(nkZ((U4Kvv>%54T;X3 zdBIvN_{^CxWOw*8Mb%_sZ0vKgLs_RX!MU?hK*%DYXEiHq{IfN})bduc30FuYB-JFY zN_(E@NG~gO?BvRRE)nbg?40}Bi@fdvOHiWjr$p>$EYX)Rahm9@N?W--P|`aepPMY2 zqcafW&CqUTimJd&+n0Oi3UcViS{^;?5DtpK2GdDs#|MQ(@My=kvHDvc+2esl)%;c* z06(acBHAx*Pl!981VEubBZnE{fR*xMr1Q{z-VO>tJvjgwpVmcD%D$bEpTrfA3`zu2 zhmTEy{Lc|x+E|%4LXq*RZ!5xc@wXDOT?*JNr2K%sAH9sdfTRd#(_d_2{ z$J}4rY~`754AFWH!`R^ziHG@D;8|FI0gj0g-?6OA+{T{E$rTh<(D&X+TCA9ciM>9Z zn#PwHw^`S06VI}uqL;gmdmRH^DQumN#PY)5JV7G;WK7m?YpX|x$&W0YAXn`O#-9(j zEM^}5$tV9lDTSbf>A@+ch`Ibc-I|GKU%PkwnpIozMWrOjnyuWehc|d)cTTc$jDUbS zTFh5Yrn!NpSFf$cDj;*gl+gr7jyH~QK6)=*#>?^xLq<#+l?EJeRyOy_KX8;=L z`rve7Ybn!tLJ||d$X7ey6n;5ew7m_PJD|IqiU-#oXOg<{f9WUJ2Mq1bmdkoOn;ik- zFC*$L26>rd#i}U4)v|!QVO943Z=9khl zo2`V_6*?EhI6SPrri@t!mX4-yZ8R0s5<~66Twc8Xv34vo>L2!OSg!HoNEtbydOf0t zA;wfvySvnFVsYy(}o2_0+6t$DH2GNhk(FQ@cJZQfz8@Aa*U zF7UHl9YdM|dmq9#nEpM3-oWY0qcYYJMH_=jubLgJnasc^d^#}1oLQ<|^jn!>7x69Z z<3%+^_%A{Wq+(9%y-4{^RVkKB_&aa&5fYn}dTS%~1Roe?bltvU%YEC$9gmv3`pR$_9?j#09%c@YB8Aya+aw`O2$vm?Q=bT0=N40PoMs9* z-i`!?oJN`v`1abzx!fs0c=y5lPn#qme*557s2Yga0oV)nZsZc{pk@#p%o0oI#V z-|hwwgFfEtKTeEtmXIzH?ZKD^#XOkwew zM{)YN5j>0*1`oME1mjRW_HA}(cKApChXc3Fva3?&eVqOdh+(|2lOc!4U~IY}rbqnO z4qLl4@)m%@4b+y|#k`co#|Fex=CN69F4USY5cgy7tLH&jL0FLQCtys-*JJPtXjJX@ zeo((&6Q;~RPW)l&{}}K04DPf~&q5*1M_@l_1!)W53q;}=?DyQm=~@sHcLvsmaGrq4 za016?dARPLoHDyu{57edL_gK{5Xn<8Cj8j!ui13KcfdoWPaobY)zgPJZ)_GsN7VM@ zR}1lD7tccX2k`!$_FwatvH(h)t_}Vk4T~bX>K^I;)>zP|4~}>D(+3Oc^=w|1q*FAm z9>sKF0<~Lc@3^(I!>5T|ODX%0bBMMqV{=mWo&)X=;QjOEU+sXa?fJcTEnefVUcZ_J zB>AY5_k3#cw#>8ZQvOWJQT&g z_0*>tZ^_)Rj(D$Q!~Z*U+Z>=~d9KxOS4oNb*bFpfRO7uf%PvnD@e#SENgtUH#y8qz ziX*be?uO`o!T*sijMOLu-0Fx+WZ-AKoddc6b zUK8K>$@>i6j1t%<&QFSAf6~;$J`ufC?CJb;M_3uzlKjY?rcTuLE! z-4f;xdflFMQ+6&io$gnndx}<_;ny6BR-vK#VVRH;b|9&OAgSqTQr%i&Lr-EuVPZu% zL1BVmQnV`7pgQ581}aZAjGN~8^>=prH_me$Z8E;aq}Vjr7D&q#)-o4mrY}sH5VZ+9 z^bNkP{=Vfo7naoedIdZDEjlJmky}- zx+la+1mXJ?9=!@rV6qsXtnIxka21HN7MJYLo2Jy-cR?wR(+RzU6{8Wm$EF64wpYhM&ozc{@$ z{NU!%E!-dBXIOg7?|-e%VuFGg!4;@q3r4^m}F018aG{} zozW5MP3N#M^=w1*ZSu2Bk6Be4XIGA!aM`e==={#&57}L0wY`<~01PwN@WKz&_HQ`H zgZtj)%4sv~j(ajTf3#(-f4NWVvO+?TEzLiNIrn)Y>9k2t-Oq>KCj5t{sQk*>`HSEk zD<&-%E>x4OXTakZ7v*8KrgXyWlnziNe3JZsrd@A;&2<~!-QAbo{W6ml`1La*gLmpaXUZN-(KUB{)A%JY``h~Jwo`~kR0b}Bbh7jXA) z%I>mVKWz10PRf1w=hzY5bJKn+T)J8I)LrkJNqvRowey<{PGsCjF;8>Nw%3nxY1|xj zP|Y=TzTfen2(4*ybCeJ6mlWa-J2%(bt!G<*S6(vLf|q%aKSweUji9_`m9>o?Yaj`vI7(4+C|NtVEJ!!Cokg*UfN&{0!g zD?T@NP!S`?@P_dKm^k`Y-)D3#_;}?j3xClzF+n;s40BI5Xe9w4AA(ppEdHKa&}~3WfWlv5J>pq@_=djFQ8}GxR?y$ z4C1E$`L8Z%!o{S)u|UBgf+>*`#As+@fQWz?P2~#|e(VnrIPkR%CVT)?!%Ur^AvSfc z20IJLu~R!WWb6M-KCEW-j(0|6!^yv%j5asR^Do>vXWctJPoqTs-6^ZP*>C<#yDX{mxYKT@ z)RD{{rJn2QWdXbKbe;C0H1sNWvoxlIqQ1StN)@&4TO&*_hJzL!SRt zF1c5*cVRuuiQrs{-5F5*z}inAn=6rwSC(qbV8Ns2h13fvROx!4-@lt*sr>)x2Q%0~ zbaqcYx`ROO*?zH7`u^^nVb|{e`|zV#xW@YHcm96)YyS(v>%M<2UhY2Cam%UdCI9=s zcJ8#8ulG90+NJ;h{nr^MXGe0EPOiAI!t}qy>ub5Y<90t^HM=b+ul`cyy>C^sCzi$5 zZr=K4U9EB{_f6(G(?fntpFGRx&&&FsA+H&$&SmTs&A*vsR<<~!%Wd29k4EXC9S1A3 YLd|V6_lJo8dj4OYAz@zoKH*>{0KORAjsO4v diff --git a/rules/integrations/github/persistence_github_org_owner_added.toml b/rules/integrations/github/persistence_github_org_owner_added.toml new file mode 100644 index 000000000..3fd492d96 --- /dev/null +++ b/rules/integrations/github/persistence_github_org_owner_added.toml @@ -0,0 +1,47 @@ +[metadata] +creation_date = "2023/09/11" +integration = ["github"] +maturity = "production" +min_stack_comments = "New fields added: required_fields, related_integrations, setup" +min_stack_version = "8.3.0" +updated_date = "2023/09/11" + +[rule] +author = ["Elastic"] +description = """ +Detects when a new member is added to a GitHub organization as an owner. +This role provides admin level privileges. Any new owner roles should be investigated to determine it's validity. +Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings. +""" +from = "now-9m" +index = ["logs-github.audit-*"] +language = "eql" +license = "Elastic License v2" +name = "New GitHub Owner Added" +risk_score = 47 +rule_id = "24401eca-ad0b-4ff9-9431-487a8e183af9" +severity = "medium" +tags = ["Domain: Cloud", "Use Case: Threat Detection", "Tactic: Persistence", "Data Source: Github"] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +iam where event.dataset == "github.audit" and event.action == "org.add_member" and github.permission == "admin" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1136" +name = "Create Account" +reference = "https://attack.mitre.org/techniques/T1136/" +[[rule.threat.technique.subtechnique]] +id = "T1136.003" +name = "Cloud Account" +reference = "https://attack.mitre.org/techniques/T1136/003/" + + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" +