From 0d12d9e4a5731c6588fee32e587a30976c38edc9 Mon Sep 17 00:00:00 2001 From: "jaspreet.ss" Date: Thu, 19 Dec 2024 01:39:13 -0800 Subject: [PATCH] Corrected validations and re-packaged the solution. --- Logos/Samsung_Knox_Asset_Intelligence.svg | 4 +- ...oxPeripheralAccessDetectionWithCamera.yaml | 2 +- ...gKnoxPeripheralAccessDetectionWithMic.yaml | 2 +- .../SamsungKnoxSecurityLogFull.yaml | 2 +- .../Data Connectors/SamsungDCDefinition.json | 27 ++++++-- .../Package/3.0.0.zip | Bin 13281 -> 13356 bytes .../Package/mainTemplate.json | 63 +++++++++++------- .../Logos/Samsung_Knox_Asset_Intelligence.svg | 4 +- 8 files changed, 69 insertions(+), 35 deletions(-) diff --git a/Logos/Samsung_Knox_Asset_Intelligence.svg b/Logos/Samsung_Knox_Asset_Intelligence.svg index 21504c4e05d..4c780119c25 100644 --- a/Logos/Samsung_Knox_Asset_Intelligence.svg +++ b/Logos/Samsung_Knox_Asset_Intelligence.svg @@ -1,9 +1,9 @@ - + - + diff --git a/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPeripheralAccessDetectionWithCamera.yaml b/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPeripheralAccessDetectionWithCamera.yaml index 6e199b63fe5..4ef23aa1edd 100644 --- a/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPeripheralAccessDetectionWithCamera.yaml +++ b/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPeripheralAccessDetectionWithCamera.yaml @@ -10,7 +10,7 @@ requiredDataConnectors: dataTypes: - Samsung_Knox_Audit_CL tactics: [] -techniques: [] +relevantTechniques: [] query: | Samsung_Knox_System_CL| where Name == "PERIPHERAL_ACCESS_THROUGH_POLICY_DETECTED_CAMERA" and MitreTtp has "KNOX.2" suppressionEnabled: false diff --git a/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPeripheralAccessDetectionWithMic.yaml b/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPeripheralAccessDetectionWithMic.yaml index 1c005d158f6..2a30894db31 100644 --- a/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPeripheralAccessDetectionWithMic.yaml +++ b/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxPeripheralAccessDetectionWithMic.yaml @@ -10,7 +10,7 @@ requiredDataConnectors: dataTypes: - Samsung_Knox_Audit_CL tactics: [] -techniques: [] +relevantTechniques: [] query: | Samsung_Knox_System_CL | where Name == "PERIPHERAL_ACCESS_THROUGH_POLICY_DETECTED_MIC" and MitreTtp has "KNOX.2" alertDetailsOverride: diff --git a/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxSecurityLogFull.yaml b/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxSecurityLogFull.yaml index 40f0c74ffe0..073729ce334 100644 --- a/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxSecurityLogFull.yaml +++ b/Solutions/Samsung Knox Asset Intelligence/Analytic Rules/SamsungKnoxSecurityLogFull.yaml @@ -10,7 +10,7 @@ requiredDataConnectors: dataTypes: - Samsung_Knox_Audit_CL tactics: [] -techniques: [] +relevantTechniques: [] query: Samsung_Knox_Audit_CL| where Name == "LOG_IS_FULL" and MitreTtp has "KNOX.1" suppressionEnabled: false suppressionDuration: 5h diff --git a/Solutions/Samsung Knox Asset Intelligence/Data Connectors/SamsungDCDefinition.json b/Solutions/Samsung Knox Asset Intelligence/Data Connectors/SamsungDCDefinition.json index efe91a03a20..b606cc97116 100644 --- a/Solutions/Samsung Knox Asset Intelligence/Data Connectors/SamsungDCDefinition.json +++ b/Solutions/Samsung Knox Asset Intelligence/Data Connectors/SamsungDCDefinition.json @@ -71,7 +71,7 @@ "customs": [ { "name": "Entra App", - "description": "An Entra Application needs to be registered and provisioned with 'Sentinel Contributor'/ 'Microsoft Metrics Publisher' role to setup client secret-based authentication for data transfer. [See the documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=client-secret) to learn more about Entra App creation/registration and creating Client Secret credentials" + "description": "An Entra Application needs to be registered and provisioned with 'Microsoft Sentinel Contributor'/ 'Microsoft Metrics Publisher' role to setup client secret-based authentication for data transfer. [See the documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=client-secret) to learn more about Entra App creation/registration and creating Client Secret credentials" } ] }, @@ -108,12 +108,29 @@ "description": ">**Note**: : Since this Data Connector is designed to support Client Secret-based authentication to securely transfer data, the user must create the Client Secret as credentials during the Entra application creation and registration. Ensure you copy the Client Secret value as soon as it is generated.\n\n>**IMPORTANT**: Save the Tenant (Directory) ID, Client (Application) ID and Client Secret (Secret Value) values" }, { - "title": "STEP 2 - Obtain Sentinel Data collection Details", - "description": ">**Note**: Once you have installed Samsung Knox Asset Intelligence for Microsoft Sentinel Solution in Sentinel, a Data Collection Rule (DCR) associated with a Data Collection Endpoint (DCE), is auto-generated. To view this information, navigate to [Data Collection Rules](https://portal.azure.com/#browse/microsoft.insights%2Fdatacollectionrules?) and look for DCR with its Name starting with **'samsung-knox-dcr-....'** and click on the DCR to view associated details.\n\n>**IMPORTANT**: Save the values for Immutable ID (DCR) and Data Collection Endpoint" + "title": "STEP 2 - Obtain Microsoft Sentinel Data collection Details", + "description": ">**Note**: Once you have installed Samsung Knox Asset Intelligence for Microsoft Sentinel Solution, a Data Collection Rule (DCR) associated with a Data Collection Endpoint (DCE), is auto-generated. To view this information, navigate to [Data Collection Rules](https://portal.azure.com/#browse/microsoft.insights%2Fdatacollectionrules?) and look for DCR with its Name starting with **'samsung-knox-dcr-....'** and click on the DCR to view associated details.\n\n>**IMPORTANT**: Save the values for Immutable ID (DCR) and Data Collection Endpoint" }, { "title": "STEP 3 - Connect to Samsung Knox Asset Intelligence solution to configure Microsoft Sentinel to push select Knox Security Events as Alerts -", - "description": "1. Login to [Knox Asset Intelligence administration portal](https://central.samsungknox.com/kaiadmin/dai/home) and navigate to **Dashboard Settings**; this is available at the top-right corner of the Portal\n> **Note**: Ensure the login user has access to 'Security' and 'Manage dashboard view and data collection' permissions\n\n2. Click on Security tab to view settings for Security Operations Integration and for Knox Security Logs.\n\n3. In the Security Operations Integration page, toggle on the **'Enable Microsoft Sentinel Integration'** and enter appropriate values in the required fields - \n\n a. For Tenant ID, Client ID and Client Secret, refer to the information saved from Step 1 while registering the Entra application \n\n b. For Sentinel DCE and DCR, refer to the information saved from Step 2 \n\n4. Click on the **'Test Connection'** and ensure the connection is successful.\n\n5. Before you can Save, configure Knox Security Logs by selecting wither Essential or Advanced configuration **(default: Essential)**\n\n6. To complete the Sentinel integration, click **'Save'**" + "description": "1. Login to [Knox Asset Intelligence administration portal](https://central.samsungknox.com/kaiadmin/dai/home) and navigate to **Dashboard Settings**; this is available at the top-right corner of the Portal\n> **Note**: Ensure the login user has access to 'Security' and 'Manage dashboard view and data collection' permissions\n\n2. Click on Security tab to view settings for Security Operations Integration and for Knox Security Logs.\n\n3. In the Security Operations Integration page, toggle on the **'Enable Microsoft Sentinel Integration'** and enter appropriate values in the required fields - \n\n a. For Tenant ID, Client ID and Client Secret, refer to the information saved from Step 1 while registering the Entra application \n\n b. For Microsoft Sentinel DCE and DCR, refer to the information saved from Step 2 \n\n4. Click on the **'Test Connection'** and ensure the connection is successful.\n\n5. Before you can Save, configure Knox Security Logs by selecting wither Essential or Advanced configuration **(default: Essential)**\n\n6. To complete the Microsoft Sentinel integration, click **'Save'**" } - ] + ], + "metadata": { + "id": "790935a7-f8ec-4207-a48f-42a7e4ee0ab7", + "version": "1.0.0", + "kind": "dataConnector", + "source": { + "kind": "solution" + }, + "author": { + "name": "Samsung Knox Asset Intelligence" + }, + "support": { + "name": "Samsung Electronics Co., Ltd.", + "email": "kai.sme@samsung.com", + "tier": "Partner", + "link": "https://www2.samsungknox.com/en/support" + } + } } \ No newline at end of file diff --git a/Solutions/Samsung Knox Asset Intelligence/Package/3.0.0.zip b/Solutions/Samsung Knox Asset Intelligence/Package/3.0.0.zip index a48f92a9bd1faa908e657bb46561b543e0a68a90..46df9437cb9f0b4f5e89aaa81d63b8d70b29b5b3 100644 GIT binary patch delta 10686 zcmY+KWlWx36RmNF7I$|qP~6>0ad&rjy>WMUhvM$;?(pDl#T|XlbWn zYU^NQ=wixbFce&G1hSX_f7fXuH78GJ@pn{)NG6!N@@TPPKSioeJ6f6wWOsQ zUGuKY6plBmc}9}^+$Z@>@rt@#^_!}V}|C+)I< zl9yXwp>FxBzLk5Uqt7?78DT#6Czlu3-VUUKs!yJrSWQODGT1nhm@^@{LX8ecOw*mp z`RprLDJ4BK;hsmMZsA+@{6*FZd^x=S)c|*Cb@J0jIjCw~yTW&lf6;+-W5+t!r*z0E zUEUSF91V~f-?`Sk#>YR00bwKo)PF=LanPbrlf0G*G1mTUqRRVu2?Ziyjz5wAeWT&E z&eThAlWW<{zI=cd`--r!*;WidG7&JLlF6ngVuL87E$|F6put06=}U1!MmgAT7A4p* zlBba${fw>8t$&sjxlY$8m%3nAuE-?otNG<53S0Sk$Wx# z%h^%w*1dJH?Ecj8nCVmN8>GZeC=05RD#uIe7F6vbA+9!jrc#=Ya6RGiwRSM#AWPxn z;Vbl=toLZ8nTRM>Tu1=aQP)>DZZ-od+P4dE#1WF&$hDiMqD?f9=n)=xDTZR(ld%ql zHXjD!@B@rMGowofp~9{5B%=l=jhB6Bbun}icnQ1E8VPg}3hjj>LyhlY{$kPe6zJv3 zYFq7=GPZeLp&9dJR#m-t%8(&lsO-(Su9bE+vt{cN?98oZc%K;>d|4f5)^J5{ ziXwcuX-prZv^~}7ppHikHw%Pi;^ylsC!R5R1uf_&;mdZJUHS;jUm>VB^*~=~ayH&s zFN`B`1zHtbMLo5hijL7NNzLi0R7H3tcC>1IPCLbok?wvIH&FQL1o|S*kKFhNODYbf zvpOu)?(1o^c@Hf_g4E)z8e|Mdr~g*^EgxVXM~IWmXp_Z-yoZL=a#_diIwY*V=f&F*e^ zTK26gOC67HMZKcPMH|;4!G$hnmGjB(M5{~pEO|=E7l%L$*>D(Z>aGE!OsTgtCA~&O zwFUcvmkBNSa(4(c*Uel4ws46?idX=?&Z^jlQS4jO1&6aqtEPsV=Y(Hv_l6~|x0dsY zg@vv1wPj~@N5TB-RqXu6xf|Y=SLy{vTG|%bFm~$Jai&SD24&==o%2V7cA1Rxq#eDa zn|6q4+ArYZyh&DjE3{O(1Mx@8YoAF`0ee474|c&UQlhT+j-NPmB}j-@8qOi!atO&ng833tC?3*pj9E|ICaY| z_QDNuvPP=ix@Fp}x8(AIBx&qw8wClaQ?6*R>*}sSyZCvaVM90R0;^KY zaqY53-wjcfR?;n~F!514-)l;*&C3e9?>h=tN@{U;iWlW=uR+bXbmGu;pFPan%)bmg z_l^8do4k|3PA#U&&^&0UzXUO<_j#YKisaMkOzos0lyy+d3HXFu;00bu`mN2IzFux7*FsGCR@pp1{yl* zJ&&`;bpi>6kU)@!+jn7miOIb4^~IQM8(hQH+OcQV8n^PjGSoEYfLHU+QiBkUmldv< zXV%Qo)y~yo?{`pBY=L?YJLmWWFfoYD~)RO103cPMV0nx%a*NaFC!H#BafxWbfr0!SGN zR{k8tB>#SRZ1BC+S%|11t5e%=HxIWrfSeGGl8e$uu`AmwfUE?!P@LMU)7fK(*m#A-mEc)V|{TF%qa!q38Tt7Km ztWwd&`H&4tmgH>S{M=Mg_%z2J5BT6=@S&1{=6*9z3U}=`vcbN8FV?{dVQ}785wu8) z9|$(~$R8aa^n`hXlXH!E^SAVc$)#9l>!E9iaFUw>0S-90kNIi^5B~(cVpmv!IZ`f> zZ+&NoNE{O&0mB7UWyZuce|M)CCof^X@ocOojE=)4!ZIS-rLtWHvO`HSAJHC)5>7GV zwyf%ojQP#EHd(hIzhBxdE-GyA9uI*&TX}USXqRFTQPTPZ3lFYY^T{UVcuD~Z#wIM$ zH4B5tK(3T{6gKP6%z0nUL^25cluieWR9Z>LZn>LPG4IINbpLaKN>g<3#Q@Pjn~8(pS$Q7Wo1(h7{$t8ZSWBEt5Ua#D zIgpO{v|0LJZ*Hr$p;pxGC6%*pX;KpqLkMiX&Wc|;58L4ytzv!cU)?I|p)#`F><>+* zbjDe{9m8&O)5!Chw7``_Zt=AE@}xNk1`wUZ1t$h5KKaP8`Js>K=!BOVtv=sm%w--iLb}%5U?|Y3d z<414I3R!|~N9@nDIKLyEvrr@7d`v*_hB=}iy6M_!MOt4!HKCpsMj6x#RGe091jKC? z5LNt~D@(Ucos)&A&9ro1w{Xs8NFwTf6^mhq{d|m{07C3J2c(0W@}l8{=7|U9{PwhB zdufS%LOK^yM9P`9EAkpg@fo@EH);6DJ3>6>e48NS zWtb1(1`jaYj3v^^_TO9aWzDVI127H|`A^cQJBVBqs{OJ9_TJB0RNGv7Vi97|TjsT~V+kSI+Y)%czAK%iygVCNFj| z2sA)Mwc?}{N*{2Pk6s$pK=?6(=K$|Ip7xzX079gUroqo=KZ`4jLb99DT0Pq#4(P1VUjS&=`~XD1cObk2 zD3j8nDJRJ%NU)XHYI9^U9*NL#%TpK45B(OV4{yAHprNarkCJghr+Ddtt>Ut5aG*He zg*=lCJf%)JkwC8Q8n#_cW5@taCmaQ%G@raEpdI?;uQ$Zx3_|Z`+1+OE#%OJbx{HY) zh=*K&D#>$@y=$%lfMW$>-mGq~$0!WBuet#zLT`g@LB0o_#?zt&fiQPMg%KOSXPLR= z=gNbFdFZA|ds;my+bM|xL5s-2s|i8KM_P6c#~d@yg-~_dk&L7wHxtqBlM)#4!k$*k zbF1*EDq`?(@+4tD)D#FV3zVP)_zz+P!o?WVWB*9UR30OEFYvL&)-vS1Dv5Z>!j&=JvOofM zGIH_tRRw4|E;|ux((!OzvL9bi&V?l5U;^JrfAUtMl6Y4g+B`tvTV}d>Fg(26IK}Q~ z1uxo4zG`!v0qjJYWc-mD_s~ujP|Pp&nCMJl9}&~M&C2BVmOHBCT+!ARNfqhk_Q>%= zP2c0UgLrmC@no{?&3?3@g(ncEyYpDo^-{OEl=!(?q3goU5mV;Nx0 zzHM^m6cH|$IY+ehXAm8Z${fH#IV)7GyNvRR^dS_P0~lzh_AFTkIL^}&OY_c@i;is&m*g&Gw4(p52f)xtPc=n@Q`0%f>W8Z>wUjWgL=puh zG-Gi=H_FsUG)_AtPP@1%$;Wjd$HvhOjo37H1xx4d5MZ+oPiE~A9N@iR&CrTzq1Zs^ zqkL+&w3Sof(&zo+g!7RbuR6w7c192qVAQU0kZ6#?cNoU@FegC6l4~ogS9k#?>oGCe z0Dp zB{yq^4o^z!w9%-0f>aI&&)fktB9RXBZyV$qW9aD{kl`o<<>a4J2|YJ(#EewFV)_OY z%mRV41nt?m$*bb=9pQWPZEiO2(J7TF z!M`XO;%*~T-Q-lqa-*Fb&ahI)DBYfJKJQb!{C785FK#aH*}U9X6$jCT_=4v@V?xfj zjU`8BJJ5{_yv#1!o@w2+7*qx?2r&gue@5B_>DY{lQLScoiW-f~g#WH1-?#2J1G2k| zoGV_`8iSnoa#(iqHIvT(fX7vhp7J8G+$S)4*1^iFzCDE=FNOxwv%9q&aHn(fO&vM9q|jo;Deg=f{2PtRayd<9?V& zrS710N6k0Lc8^kd_dKIYxRc?fsrili+3DwHcF*S77r{Dbt^QJbkF0vU_T5YKgsMs& zjHK(jpBdqD+6r}9El0ppZs=0J?+gt^-2iJYxH8_RFP+gdSctjL(pdWUKLE{Z{5OjJ zUChRJs&x7;yp?WIKorl>Y66LCAYehW2G^)y|I;8!{MiA1)R-iF#9At2cZk>sN=kv} zIep3>)1*97v{=aH^^1YD&k3*OkA?GC-i3bgJ-gWRi~(L8CGQ`7h)$%OGaO~yK3%Ks zNHf?@*9o6P2julfo1{}LUxC=QCAZUZ%GP$-8FXusUr`a-)A;=BVq2P!ex#| zW3;qgl|6lf-1(J@8@9?o_H>}ENa)mv{z~TfuNz+kuKJBF;diwI`|Nu+up=wc$MC-* zc&02dB$=N)@O1lSU0L!@Z`UlBew3Cj>d6*`uGw5adh^C?F;Od&VE|RU@{VKk3fX_! zhmLJ1&$u8gKjuTlSkH<;6lmEDB3@HG(S=XtyfaeCF264`z+o zUyR&;<=mS6+TNb_09{-=iX%) zV_H9L*4|RLOa>>5FZh%TrN8~1(svZn-hGYzE130L*2 zu#-@f?|j8G<<>q~TdwjePB)O({aeDHp5g{RTl08w&+c2RzPk2ZH7kE-3>=_7B6qc;UG}XBk!>U-hClB!mwNWr8AaVB(SdESKfua1T#x1H${#_ za-DnHnI`PKKJdKWN&^uFL$5v(!aYd9^L&T4#fV`UNtw?kr>Esi;kF?@tI^*117CNs z-=Up?fS$;!c)%#0fo{FEY3-C_g9L)db~jhJ@z*6@b!dzA@^s6*9XpSicSH~72i6L~ zqs6=cGF02rvJ8I{D(B!EJ1dbr{sc}YoRGo&yP5|KuqFfasQd>i5dt6%0tL%yY@EOO?|m!Zv+Gzo3D=OHRDqHr6k*e zpAf_zPj%M!mP6Qg;xv1(#UmcXztIq|4~yq;5Zfmx(KJI-MWBTzbkMABm1X=S!|jnc$CIOh^5Ll5p(PK!dEK?i57u06HIQ`ZE0wa=LH+uFU8PxIb3%$lo0||}{B>@NK zLa6n=`c<~C2{(s&_i5mr-?q&tgVlvul>wm{lA7VA)>6>*!Bs$5Oa+Ak@&uAb69J-O zJ(1O(U>%gGxeGdN_nJMZve-~9;(0m7&r$_{5U?_D!o(shKQ1kN$~4f-UqrbsjtEKs zQLRKyR~z)JO_dr_G~iwn1#@$dcf?QOar&P^ag-cV-AP=SNC+f@#HdVV*_@XM!UdXtoTy8oK?1 z47?+|2JB%$w$p(pgflBt%8;(@@6!*Djk<0G5QK;{<6-B%;}UmBEqY>!}?IX9G=4`8N6Z z0s6((lhl~O2a}xaaQ@OBlT19J=5v;>fWHht9UvCL-7VliLbdUg2H_jEKq*{XIUbTj z_~q`Z`djZ`aV8stBJhl8xn`Q8Swd?n9dsQe#e{$(?Py2HU!TTa&-fI4pRpDz?Z$!z zLX*VeIX9R*i8!7bHh~`TM8UB9TWp~uU<0!l))NBSrGgkzLS$H|Q9s$qzT#ay10#gK zCzk<~G%KS!lwYA{dfDLe_&@7^p39$Og|+yR##KC&=?6>d#`?*#ypDf-IeGjGhjeWn zo6To;ac#UU;f()DY6jascJ7r!kR4z;7>E2kR<1sd9-UV%CQ4+UfT&Db@NdJ88%#ju z0()Q`xknxvxv`r;W#_EGZ}IN!2g)PXP)Yg@ioVT$3M6Q1fu5Cr=4W_>KUBn6@pCV< z8k75ms}9#q=b3f^XM1a{HZOL&nr1##m{DqEYz(2+@)9!{SNNh41QJ>dQZX|sY#v|t z9kTl@E?9B)w$Jps7;3mzAeh1uDwR}A#1lgpe30rV;b3oOFuxT@PPh6P0%=fnkw;Ga zEJ19NSonyZlL?)pwQ+F?*@pCvF>N2G>ogOuMwohC89kBQiN(&N&3E6^3E z-Q7))8S=(&6ni=wU}8bAzsGKaR;nfSq_f>UCc|34ff?iE>=n7U0h_3ro<+8Ct1IswiKD38pR zW%^?v`i~&$Y_T_VF1TT;hoy1aeS*yAA;PZT&R#d_iv6=bIm@W}XL2(-=s#GPsv#1v zW}nG_gh77e3prT|-Fr-ZXp`wM8lqpJ@LDZ^5r`9R<~xVky{ zdj6>C&v9h~NZszLdf3 zIo?ffq&)@n=PDv3Pi2C7YQ^3&|YW^NV##QSkLPzHB&5p8& zD6^YaYj*bD#RoO|?O}|opken)@LEnw$v5gNBVfEoz~J>_yDu^XACs+R8EnI4H!`V3 zWpPR%`RI3BWfARF{Kw$cnZj0vZ%6CdqABx<)P?8UAL7Ux`v*fHb;tVJ86a z*PHU=Tkj`mt!KEfyFrXdZqv7`*B->`)R%H_yFlIXLaIiFzCc{*aoZNPf1FfLVBiz= z1l+XBajD5SX{(^fD07-v-`+cZ=?}5^zSSS+r3UK<=Jcjv_-VU8i2Ml?FHVy4Dh$?N zA|1({c+!Z9^jqJvoQFJV{BA!}X&7mn9%JLF8fp-WXn5y_Gr4)B`|VcjUqIY~PVyqt zv!H3n6lr&OAM1*fJl({-!vHO@$=^}~_he1!Fj%}WJY)FXX5cZ0R!p=x{qq+=Z7U<{ zPxD>Y#+D;5%hm_9=h4T_EZ+|tF4%99d3dmm8M+QAaypZL>Ho@2NmDInpl_?9oAs66 zR!-UPX7J$?{p?nu`vak_ggMOAz8E*r7^mg|JSm<) z>v$~Zgrr3g+}oNxpKS6HkkPnR#`-VYI=)E1vnHoG|4{1rPN(|@A1j}UM&#$FrDBSZ z`zu-ReB<+K(&q-ws7%~&BJYap2Ya<`%xHa znKO)Q7_lNZmU+}q2Inl+_pQ+#050JK>JPJW^j_tVBO&saxE7^@%ENSufz>h6hyaO1 z1xi!{RGAD3#q6K<6{7FTO2s=|U%lG;tLO#CT!Fkz6(*+HFLAXscFaujpI%O0@1M_4 z&u2Hg54*32?+0=rgW^^*F|F%zM;-H)*V`%!^4w^v=nXgELmceL!M^#p0F8p=9RW6x zk{+kPA%);fHQ)d#awJ4($a9|mk}jI==EwVKvZB!A|6O5wDpJ_RZ8 z-&bN!80Saft)(DGh~MyNbGw8ZG99h)h>K>q3rNh4%92TRINZ@B#U7z4J0P=aDiG|U zzpn@)38~9k%3j%yKS~%tM)<=QO|+Szx+}!0M&XExd0Z~RwSgcuTPEn@Nr__fh9lqG zs&qZFo56<=I?vstD>03(8ItXE6aSlti(HZa0!jIZ7E-qVpqo5|(II0X&zXtJq2A$n zIyZj&kA}gN-jyBo5hU($I2}8?l@|&`zHaqBu0;x^dIhqkhB2@ zI9Oj%dMUA;jp07ya?1uw>vQRf)aOB}U40P}WQh-h!5b5_+aXzyo;OxZT+X zc-r_n_<7oSJiNVpT;8spcV8EeZb6rzTUV?y(6(iA{_-Sj^UtAvcUT|j>$6>k_*}FZ zy1gp2nanRUGCXA8Flv!!te9ZUOH@oXxvZJOj-+?1jADVpVyywqTQSOP)d9_MoAb~{ zgv{iU-Ks*zJ_tB9tT*t8<4w5bYzlP)o;<-o(1dWE7G+>F57c=yvo>m0(@qBy*BvpaMM42sY)QY=^sC`<$wIbT5LWa&&e( z)G#Vo+otXZ>v0b1d32 ztY~OuMRTkL@$wC3^w0}DJ$&uY4nCd^UfvF4UuHT!9XvlzKf*Sm?iZ5=d$))P^@)k~ zh>5p|h_ZznT*l5@<9`3`TxMXY#jfA03r?1iDi2O>=z_!{UV))?O$|y`s%T&+{+@CZX)h@KuLF?+K$#^q ztkpVgL8%~|6@3Kalg#^^v^cigDBDrdl>$N9Whk;63L)k7{qg~+ z#kFxmc(#Z>ah$8j$s^hqP|!>qJ2XzQkO1I!tG?n?>;lry1D`; z#cGYHOOoJ=h*)eUpGV>pB{BOtdFQqaNCQJ8>tL-!I7VxjImFk#nD8~>NED=77jKY_ zr_Q10AQg1_BLzRH5O_o1GH*xdy{}d(@F#F{-+{}H!Z8(xw9D7g-<&OihR65DUw&0; z?+OQMk4mBq@F3B-nzqGXBbTo{$vgvRA=gMgh01HZyu3#(eP}my;I%JcwZ+#EMSs@8 zYOkF9)n!yup}UUn9CM*==#I7jz16#z@+uH|l)EWYEp~mC`O=yQH*^=T%>FK>x5V)$ zGchjH(oWDV_Ynz9(ESV$E{q7WrhA<3Y(s7%;R-rW=nxt{n`P0|{P;!&XM{jW(pY1O zqWeLR;C{=)%59cDt{Gm}3ta!xxqj;rr<0*_&K?WDFWjbY8gcESyX{8zC`p&(8&04W z%8*wdJzxKy30AO-+bn$8@V~u(-|d~oI~h{_-w{Z8{B42Bj=$E8vB+?M2l~K{1-YHRk{)gqX=Th*)&%}b@Qq}z z-MPIHf&P7)PqCm7zp@6X_p}*x!z__ql@?}jxZ9WoCIB0wzZdluQraI8bewH;|=D8W{5J85Yq6SV7$O=5|!P-PW#$!GKqDvRSp6zlm(Z+ z)^N@do)Z_&K)nt%5Cb0kmBEslYJUUROt{^poc&KORGJyXxK#dpe>Su3VK3}&k}i}V z_*BsfH-Lkmj}I5&s1T!kMQW*r?Kd8=W`Dl@Mw(fQkCjHbMDRr|5n0Ix;n5*~G++8L zm-kkgu0P~0Z_Nvh9G52Q6wmSy5`>cCH1bVw5Y0SxKHzWSk96S1tTb$YfE(HH4QQ4i zna)MEM3e8Wg_jNUFDp*6eJJjRBz1$-rdBsBfZ3E_&mXyh;lzypzDO(*u{HC|>jQlm zbj$htSsIU@dbw{JlD5XJ6jZg=4-yduZT71y!OA1&n!(701eI8@oc7N{2rJ$iSeSin z^0>Ljai(_&{Q~fq;QcOZ^LgKu)8>BmNKWU1D3UI?yfe2-ZX3$qx9pJ#Qwc!SwS@sJgXexong-Msd`nSnHRIn*N=SHc%Jf;gEHQ-s=Mc2 zx3R0^t!Y_x=Y{D=b1P%&yyDu&ysPHwA=ee;-jgJ#)(V8!=sxDy!%m!~;#61m+*fOA z5YADYXCdZ1F~+@MLtt^E(HneaI3rP7IvILb3*n~piRo)a%oRTtqW6${?|W2w$6Fju z;at40Od)Yv9%GM#ffs{!y49iV7D3R>((7v8G*Q3uqGHHUZ-q!$@z{?7eFr?>C;!4K i$bv&)K*Ik&H)fI=n+VGP@5W3jWn+g)Wc%mH1p7bBd)Zt7 delta 10610 zcmY+K18gNwx3+6fjp@|3ZQG}|ZM$b`+qR9VZDVS;Q%r4~`p);|-aq-1ovdW>PaK;a3ziG$N|FS1A zo6uzt%RsWtmEt+)pY%_8BX6q`dN7|z6N-S;%@lx_-dDaOW1Ed(0qG(81mG@I*XrA6Ll#rzA$Ipt zxZTA=q@;s;^rEB zwN}s_Ne6;AJ|{i#>a-ul>4%GHSJ)Ne=m>__u}};(=a}D|%WD!^%7}|%#o{yUO%pah zhqV&X=BJ^%@3gJ|Bem;Tp2)86l~+rLx{88dw6g3|RLL;X+z%NK*?hhH7$7dkR0-cx zq*$el!k;d)5;jRU$BLIvh6kwoiCrZ#jE$pyg3U4*^~2AY_QGIta)E|oYaK;sN_FzZJ&!PjYH)7TWBYYQ!5=@@4s#hRTxK5hU}4%< ztl6t)e9AX=F4gGndOQ$oZFpO&v=cQrD5Zc!-Xemu#vn@4<27EV+`MHWPFpk*6cl9Z zITw0C`Y4wos}#3Gbzlf*94Ei0F#9SWYO{2lN10l5Yo-c)wZBAQKzI;0GtO^Q{OoK4 z(1E0pR%$caW4r16rD??i5y+132Fk8jzDSYW3*4YYo>YyolI4m1i-Z{M0AWJhY%(dg zt8D2rbD2feM||cnoy?{nX|<@1Q>^uF^a*o;bF$gSwye-T1vnP>IF^9`Y|d1AuSFs$ zNnH+VAn(aGLvp?9I9`Kmk#RXcZ(|>oTmnqi(%$u`>@dfE`-DWhFhqEwh@C#`J~K|i z5ur$5E9$9fRBsyVlJcIJ&QpN~FrfF~c{-@9;v;9h;Xf9|xlqbqE110fmdN|6nG@fx1}X0(npms}thYIg zzsuCdqeL+lmq#}$%yoW&uc$^#3NNf`TLkN4F<1_VwHeqhG+RTSSzSr z+wjF!6)v19Zk}9u==@UTkn=pBI(NuBc0G6SSLn=Eig@qTHSD`OMz?m@wx6EgmUP%Y zqVVOt1kOvAmz}0ufhEThGHX{`Kl)Uca_RaMZ`hliI+#LtW*5I~b#7{<|GP=rcf}b1 zzCAuTdUk2BxHQeUy`1&yxURKW)7?J( z$4uD5eAl)PpPZ-e|Do9aFUqFQ|DnvyZ+rX)#kzT;;#t0>)<({jv&y}8lch?hexaJv zqpD@6!h96z^2nV_>Au6gt%q`ZhDtnO+rHk=(>0R44S3~YapFMLb`_PxXR&Da^h2jB zR-Ux0%RU3&<4m$v)mFnZHY>5TEBF5jH2-gb%bNcd5c3Q!OS)qqCTzyRRx$^Z|ML^W zTxLVpS`+;X@d+XL!#LrX4#&&ni|u-L?rGfhnjT|gJxw2LOsn1<&K5iJnqed}}z;O;j+Zaj?tx9<^W`04EOn0q)}X63k3-q=-asJ-o%~;C!A| zEJ?TWzG!(0bt!LgZbqvS0Zau(FGiFv@Q?0{aBd&eQ`*aayr8`?R6R^}e7&?Pl3glg zSSnO={+?#5Xbee@xCSXE8O(j} z)3wWNzbifE9c_9yQI8*YeE(VN##`*X+Pd~rvU%#aoFvkx+OvbgGf*&n|3Hxe9wvHR z#O!c@;64Yl$9BCSI3vjHXOMTN{YP+8A!0m@F+dEyXDEcTh>x;yTX5(%H73jGv}d?- zuyGl-CN3zjqK8Rk=!V({cZ#LJoP2Q^mjj+VhZ!F3ZveIzxrWSjaBq1$%$F^aY@$i> znbHRH{YF7(fdcKv5peR+T^A$~{{!=W6o7Z6ZjaDoE&2AwR!qo)z8$2Wq>oc7kw-+j z?C8|)@HAF-w2PmU0;m=&I z|2=2!ON#$yxeD80^K&A;wg5*|cCL{~P=(0y8tXw!`jqDh^7RADEr|Rc-*@jWP(+UI zB>3n2+*Rln1~4Xuw3aU-5SbV?2wua`s7a;pi6uEO<1BF+xjUI>^7Pv+sjJT##`h$Q zwt7i&&2rI(hy@LHxE~+S195~b=$zF;aO!$uG_^KSORdyYVWQ#Dq!n#^T zu!8$sB`}00B!W{}3a{BdPB5bHSK+x<1K7r>mOq{rmjlN_1UCD-WABc+ZxLwx(a5_Y z^tbbC1L>Vp<6+!~d@qkcivO9{_-$%%p$3`AU&ZPvB+rz-mLG-p_>*+iTg8;ZB)fQv zc9S`+4#zZ>fNU5{HpDXTpo_nif)KeJhS3&Xe}R=2*(F?+wBpM~YNBf>jveZp zM7HY)F0RQMHtGOYmz2LkO~dWh4?r6IzHD5*XP{>IV?|qxy>pFGHq*%foo%}v?5miu z4sb6@z);o1_SK5qPL8<}o^mmk?qs4rrxluD|4URDTwpv9^)+d6Xe@`o=~A0bB~0=t z53UJKzs)iIoE4N8wPW-HF-&N#NuYk&@eZAkZr3x+YQ5u>r_z6qV zYvo)U#=b>&UBYrNbf0=a@3=yMl=BKE4A}dxFT8Hzku^eB^=J5SKyoY3A6{0KH8B#S zl9XQV8*anfUlG~Jk7+ktAnFeZxYCL1qh=xrJ?glv6wF!n&WyR4?C{cBFiR1N7)h?# z$sk(oemJ%A&bhKNY6Qvrfm-3SNRgOTH(7H*LKtc%+7=Rm8LNLYW48!~FTj!f4OHMu znwZO<4a!+g(=g|Vo)1}bH0XJSitg5|H%MMR{5=Tce-RmS^UluPjw2OPVaGq1z$j>1 zqLl0>8+ujnB*v_I=iNMQImrUiClmJo$cm8>MW?&<=VpXUVt9nFaFqkEn+=wlm<{` z^#1vbu_F{siSU1FkcdN>s*0SEW)EiK4!%9+I_i5Dzf9Y+n0&yz%G4vsP5!Yk9(XdK z>~^9fz>wu*qrfZ1F&IZ^^tYh$to2(Ji`+6xi7ZR<-csKY6v~viCa=wuDR9$o74r3K z&jb-Bz9TF&n9^i$Vo)lMM-(R-E3S2td%mEf4m*ysBWaU$i2umMDjao4Q~$3U zj0JvS@#4LB!=8-@0z}SlO2F#={8-I;@orcjr)um{X?c4g3Er81?q%Jsa}@F05kCP+ zxM@Clly1_Zm$nZSJZhg6_+S2mKq{RN3Fh~3nQvL0$n*%_$>odS?{z^7D`3nAa^Ie zMz;Z#w42!2FZ*5T|SB}N=*X>x_*8!j+yp} zJ`aMFehB>m!l~R+1uw1fhX`S$0m-#66py3$aa7BCA(EQYambEn5}KoU2BF^Xz(Q1c z=x4|+2Mt%@C%cLD69i7tH(qY^R$nI;sbcrRN)EDO`mQ?!CLncUqIk_B#3fr$`g>9o z%WCh=+OgPrRYF_K->OW!W3~q&^O~jRS7{Rftn{E@Y4(*f!!+7 zI9#Pc&qm6sPB-$DV~)t6w zXPAi$-isG4OydcexM6Of;pMdidCHYc%AgljH@lQ!QUPhF6_i$F>|(R^efUmt6wm zJLHr9iy9`jlxi^EnzL!;^Y`P!-=CDaWVRLE&fxEl7Y4WK#5~CSepL%0i|TCJq(lPV zOz{tf(k9?WuuLt@-c*YXTPhns;`OIo9#pn-BA{ijXjXLji+e~jWg7IfNU9xERqJKo zPdSCrhD*+^Br}{-{n>4B&7{JRqSF?I`5GDNpSbj5=tw#@U7xQ=O;PN>0QFTP55mFW zp}&N(kU)?VhdWIic!)46ls3A8Bj$B3nFXm@z5=({{8};}aQy=_`M;0^-H#3YMgwxr zzOA~olYAA1QLX9euPK-l8H_&|H6zo}`)(LL(F6Fi)o0E0Cgi9#tpJzp9zzeOCuP4V znt=;ANz8ob?>IA@a~|U_O_OW`$C=uPs!e10Vk@AwoNexprA_hY+T)bX!Sc}f>=fJ zON9waC6;jh^#h3&Q1jFeB`fK&;M~j&9-u9&k3(fnGif`i`Mr0!T^*yktFrq42)?)A}@0ryK{etv-Seo3H0z^RSwsPk;SutZhenTv41F}ry)2ZOZ{)g`LiD-aex zxXoJbfoBz;UeEPr8L|EM9$tdU2qE!h%p4Xj-T~o=7aApLMw3b2E|h0zKAihCb8CWP zPF54dtgVq-nr)a@IVi4bgw(G+q?oC}ZFG)>bs$ox|B+DSa*vG#QX`?1RWSyl?^NI? z)vfUbej{2v-<5K>Q%E>_on=&p5m5LNEihs%bfdkv;OX=hvYZUACBZlTVU#c*$nY0g zB(@iBkPPy>ChTp@cp_G>b~ld-3F)Nuz;(xhLl zRxfvSo&=p2IZ$1%jQWNWuoXJ?8>8P59)jqrVGc`kOqq)q^NzMso3eiX4A|QF&yp=~ zJYL1El=O6#Ejox5hiN-rJ#}7gD28K-stfF;SphN?%Qtv0_rHE zrWnmm5Ky?;=?toWMWAX`Q2HRm@l!|2PWt=+S#bp z9O-iGN6*OjWfD*E6C^Dr24X#H?jH4To z@@KyUI0TRcv^T$VbYp?}~PhCpTGwR`h;SJL~-uvI|@5q%f6JHSirtCHwaoQZ&lFcf%nKKll8Zo+CE=$D{W9-BUoOyFb51?6h zW)n1GE_^`d8HQlLTjC8@CJBZhY9{vnxKv-)3|<`TR4&^+5zy||#!Mt**!DKoW1*{l zL7^f;LojIe8>t4D-mO+L9ibIj71DkUg4`KzFVf#r9sdpST8r1`JU&8bot3d&h%)L2 z%2^lfL}61&a#U5L9q9MiSY1qRfLT1Gakj2d-B5S*gBsNB=Pef~P!lEGgEQ8v$sh#% z^XJlcqJzwkL10NX<`1$$O}0pJzzm>*n3yLyMAk{R@*3_jSB5kRF70H!zvm_tH74N& zY{LRK+Yl%&Fn7>a+Ypuk*S;%TTOcb=`|a_%U1xuds}(Tx!d4J*(!+F@9zagovHEV_ z&p6$t4ZW|fJiSDez^1ioa*DTj_IMN0KP0J*P7P}h1EjxW%0KtOsl6du3o2ymj7-_N z;HWYOuuX}-uS9+V=vHBlR-EYUcu9}Tik`BJbd45~iAoxS>8ceRu(EYU02^V#}I$Ys?a!|U)XL{ zv;matcAx6erLcxHj8*f=ic5VUAY zqI7Z;>wnJZmdD4oE`;MnOE+SwX&zM8i0gxOZ7aHq)|ERxxFv{yYY+MsC#_fZk_HaY zsb+Wrxz|qD6cKh~_OHMd^yLE4oc`*NNEvHHpf0tY@o#KpF6NkiLo=%>E-dlADHKMy zpEBZ8j4)y4%vL`6lU`JT;*lR+gigeqE2z{6%v6HqaP5`&@=g(#ds~_>eP0r@_6W`3 zxbgC-K??_g92kZ0Wr8V(gLe#d&cOwrs;_rk)Lst+3w3N`0sYVnK+JE0n%|}WOb(ft z0*8YijJ)TU1x&#Zi2ukZay^Z(egq0bpxdG)YE_{H&foNN5uOZLJu`@O@V+tz62pDw z27oSZ|H9Pv*=gawzJ`)kkroA@p}DiX35;A&&2bwoeUUkJ*YmjCwKukfyW2k6gHTxb zv|_sJG$uZ2yg1(*VT4@H%shIIQkSyBUfSovw z(Ymv#Kc|e3X;am06HQ1E^F=RM2f@2tq2*6h?irN+B!Ox4>eNwrI2~7*n36g2xIBX{ zZ&?6r7ZeU?Tzz^(6559Hdm~+^*=uAnFrHhqC`EyaO-xM9>~*clJK623Q!sV*O*f5) z@)iDCdp%>$9v33UvPs@I$BjWGK)_Vv2YTBiTDMx|rwrEcq|H)*8j<70c!iHui8(iw4V$cDv+Mlfh z<8+^EFJ~3xL9+MC6`EpcGzgM22f)yeKdl&7+9$iU`(B{gMeo+_!sRwUAZ2>|-FE4+ zXAL2gR2)&a1HTK2^X@)F{>~uu_n~E6L7(u-*zrlz4cSVK872jST(U1|F`6Z-ey*E2PH`+Jqhn|AK!IZA!%3a5gb^ z_A&3l=DP|Vmg@vN04*K^NL4&-#R-4({O7Uba<&ftw(ItF(s-H@O$)02cPO`$x!`OrGCen2dz709>aXKa9Lm%Hvq~ObYwkS6GYU&tGYKA84P7FNU^^Z6(_WhL#~aSPwvFZt8DdI-t1o z@6*jSK$mxdtU2}`c`si-PreQOTC40V5MTM|4#Yu3p|!xT1#h+9#cH#ztji35o~pkU zi0cGZ9V@*NhX0to!0TSlV0=T18_sM4eigz2OHh0lQ_|=b9la!ez9IjCj4^roQ%z9g zj8Q#!_1c#Rl#cctLF?kcZ+we|dLAOYD;}HQobS(ryQH(!kJ0E0z!(|yO)5`MO>^cS zP9Bsc0Zhs;HERwPclAY9gPu&bg(~6ups9dN)bIA&3$EKlhYO0FS5epjsyJA_RU4)h zRj<}KB@#@Tb4}emLSISO{dR}r)hPPbC{=@#x?+0v4)!mZLV6}l;Q#&y--0*41xgcEYj`-M>&e1$$cUwc1u!@e%g zw6ZPZ9?ra`D`NvZF;&KX14yOHW>>+{!Rw3?*YrELtNIU#`eyj+avDMDUs|A~cWiap zho&3gBT{ppK&cJW&3a|G`d_$?yiEeB&TirF^(2`4yb&sqg1PM<742_Up`JvcD*YXn z+u9)TM6!TsB%)kzSV*W5hb4}=P6k0I^sl{%sSZl(R!&;oH|RR0EM>v~Pn{(*m!0wy z#z%z*=e-*-uas$W!$-ymwHQTXRqw6j0rAY2P#X0GQ@%uYUzV+9Mn??y&u>w1qR3|!3HF?3Ni0^L_>hV zvfwmz0K4kv9vy6{zq|fv%haJMxbX(TC5TFZHTR!CkuJn1(gOf{749ZvzVCaYl0o`< zIZ6AzBQZS~$c{{KbA|>?jBV+W$prxclQ}Hw8npVq60>Ep&XomC@U@S^AsEW*Iq8~- z!FqO|EBeWUPku~prufeJDF+VScfn5_Fhw7A=96K_u3Qfo4=lDEt#vB1*zT8YzCVmo)9BH6ir zUz2*BCpypbwqhZa?+Z?Fzt{(={1jrjN?j7xZv1R=uJ(T6Agr)L|l8;>8By>|Wj@?JN&y z7YIP-sP}6_=Wr0^q#}tM(Hh|8s2d{B%A%QTbKBPaJd)X~@e3>}(dpN|75#7Ogw1(a zvrA`6>0V9u`A=xn8u}+l^v4dg8XlRtes@72R5c6afDI-G;SeO?DvV4*aQ8&N&YY7gwEh)KQ|cGt)pGG3s> z;b>Ke%0x8^ToxAmrA?}qy3-#L=o%ki4-a=&Cl8+hXAd7gZ#OSj@29J?sn3yxnau;G zHyq$pP}RoFiaX6mzdg9d2%>q8pf{t{GS3DRbF5rmsgEq+8mjzA3QKg1)c;ZcC-oooXw`qH8>;?8-B9%(>e!CPs{f^~ zsp5gGw!zj~K5M9Q&1Kn}9i9{EIuLS=QU_d`jT}$GRAgl`cD=BI)4tF^G6R(gK~UG) zKjQo(VO|L+8e}0u*?3}t(>Ww=>7&uIfgHI%OV!}|S`j|a&ya|C296Zpi}>yvDzI(sYskX4Z^!nwX;fJ&S#1Xb`~D#of)r!w2$u;$eHN3d^^kzNzWB zrFT~tcNJ+yE(pI7Y+5ci3>AT6k+Z1@$iKua4RmORU~Sj#m@FR;z;lUlPg&a4`kdfK7Ogs~nast&X2 z9l(Qair;z)pf+*o>SxMFGTPrD8dp+~aYEQ94sU2=QO07x&f%Mm*Mn}A4q-t@&nRwS zHBL}UYEFf)CeX*v2Xc3=33aRs?crGJ`?qtyy?+kPysS^$4(vK0$JfOn|67j8PfCSa zyoZmsi|b!?OF+cwa|wKIdg4+D04;H8%?a4?*e?;;+9TppOqI0Il;bGUJSe~Uoa2MM z0v_~^aUd@vkbE;S+Vhx!K6_`W?t7l z>q7OK!l~JGg%r{ztHTS&nH2=+5*dk0E5c|W>mo2SVJ7iBT1@2$689T@ShRQz$CAB@ zncP~WA`G*hFihH$nw~H8x#2sd&!=s@=)L$c@NgQIo`9sCndeMSSa-b~f=S3QkBA6A z-@msToRGZT-Hn>0CRn&aZYb2pQTkVtZoekeyV)Mb_T-LDTeN8)^qxAH!9BRa#2U24 z^)GOP+#|61f5Jg`A4fUoLETK^=*m_>?_n{iff+#WrT!DHpYES<2se`iuS`GP%x{52 z2`AIBZZk42(7pGOiHy(#^bl?g2y*88T%M{+9+NQ%hR+xX8NeOt*in7FmHs6@c`BBv zbjhJul+T2>-@8(d0hU^oU&k2qt%hH{3_!BKoXfZdi;KabUDtQ#?ml()UC-@s*S`rF zMHpaLeERA52c9R{z%m!IZDAw6`o4hgjxGb?^cp|kk>xyydprq1+k*6mWBOP2&uGc$ zK-+XUFz%(DCu8eAfe_|cpG_OEwbqmm!*lfuVNkdy$vfWV@Fn78s0h5axs^fs&Nx+w z(5t^L5aR$8RX-K}3OSxRSQSvM8D^I)vy!5WR2Jj(OZL-i%mc%OS6#kwq1?6vpiYsoa1cdhLqoF;(;i+z zMw~1PwnF`L@_wfiUXZPumcWv~9YgYk&_)P7gO6c3K?Gpghr^d*JWh;ycOUl$E_!J8 zXJfpBkFTAkA7bP3M)LG;fm7O)eyQeUTIemAR?S1V-N+w5#enenQn6zY|aNIMOgF{j}e3kIfI1Y_s_#7B<# z?pC?uJ{Ay#s@L(AX-~zH6xf(imnbR7d^t~DE`P7e?|h6;Fw8U&6lrDQLOZL!h}!$* zX$!Y;ft$#9`|uWZ;|3QY%e$_q^vb7f!gb@$iipUtM`;6&<+0kw7+9A138r(=BDuS- z*&vt!4Bp*6L>Ouk>ju^wnR~=8Nvu4KEQ>~0b>OHjeCKz+Wp`gl@omJkr}TGj=`W)G zGO;=%wYnXdGo`QTClLIeAd^#kc=ra|tXl!x-mqQuao86;YyhH(mrSykk9l>6b zju2{>Mrr$E94^C@d`YT}YGtJPhMgkPW&a+|ndzKdxSKXw+EP%F3dqF7MFIAZm0 zE4{gaw?Jl+4}(l!wA3mbeu$PvS{f4wMP%Jue;R zD2vYIN`9*@6)-xgNu=xjLEa#nFyUJ27Kqu&nc4ko%VKrfkJ2tPS~nZm6Y~E}P$n0$i6a016O_rfY#cCBZ2zVx!TtyR;oWlp diff --git a/Solutions/Samsung Knox Asset Intelligence/Package/mainTemplate.json b/Solutions/Samsung Knox Asset Intelligence/Package/mainTemplate.json index d0c689f4ad7..12d847e89aa 100644 --- a/Solutions/Samsung Knox Asset Intelligence/Package/mainTemplate.json +++ b/Solutions/Samsung Knox Asset Intelligence/Package/mainTemplate.json @@ -208,7 +208,7 @@ "customs": [ { "name": "Entra App", - "description": "An Entra Application needs to be registered and provisioned with 'Sentinel Contributor'/ 'Microsoft Metrics Publisher' role to setup client secret-based authentication for data transfer. [See the documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=client-secret) to learn more about Entra App creation/registration and creating Client Secret credentials" + "description": "An Entra Application needs to be registered and provisioned with 'Microsoft Sentinel Contributor'/ 'Microsoft Metrics Publisher' role to setup client secret-based authentication for data transfer. [See the documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=client-secret) to learn more about Entra App creation/registration and creating Client Secret credentials" } ] }, @@ -244,14 +244,31 @@ "title": "STEP 1 - Create and register an Entra Application " }, { - "description": ">**Note**: Once you have installed Samsung Knox Asset Intelligence for Microsoft Sentinel Solution in Sentinel, a Data Collection Rule (DCR) associated with a Data Collection Endpoint (DCE), is auto-generated. To view this information, navigate to [Data Collection Rules](https://portal.azure.com/#browse/microsoft.insights%2Fdatacollectionrules?) and look for DCR with its Name starting with **'samsung-knox-dcr-....'** and click on the DCR to view associated details.\n\n>**IMPORTANT**: Save the values for Immutable ID (DCR) and Data Collection Endpoint", - "title": "STEP 2 - Obtain Sentinel Data collection Details" + "description": ">**Note**: Once you have installed Samsung Knox Asset Intelligence for Microsoft Sentinel Solution, a Data Collection Rule (DCR) associated with a Data Collection Endpoint (DCE), is auto-generated. To view this information, navigate to [Data Collection Rules](https://portal.azure.com/#browse/microsoft.insights%2Fdatacollectionrules?) and look for DCR with its Name starting with **'samsung-knox-dcr-....'** and click on the DCR to view associated details.\n\n>**IMPORTANT**: Save the values for Immutable ID (DCR) and Data Collection Endpoint", + "title": "STEP 2 - Obtain Microsoft Sentinel Data collection Details" }, { - "description": "1. Login to [Knox Asset Intelligence administration portal](https://central.samsungknox.com/kaiadmin/dai/home) and navigate to **Dashboard Settings**; this is available at the top-right corner of the Portal\n> **Note**: Ensure the login user has access to 'Security' and 'Manage dashboard view and data collection' permissions\n\n2. Click on Security tab to view settings for Security Operations Integration and for Knox Security Logs.\n\n3. In the Security Operations Integration page, toggle on the **'Enable Microsoft Sentinel Integration'** and enter appropriate values in the required fields - \n\n a. For Tenant ID, Client ID and Client Secret, refer to the information saved from Step 1 while registering the Entra application \n\n b. For Sentinel DCE and DCR, refer to the information saved from Step 2 \n\n4. Click on the **'Test Connection'** and ensure the connection is successful.\n\n5. Before you can Save, configure Knox Security Logs by selecting wither Essential or Advanced configuration **(default: Essential)**\n\n6. To complete the Sentinel integration, click **'Save'**", + "description": "1. Login to [Knox Asset Intelligence administration portal](https://central.samsungknox.com/kaiadmin/dai/home) and navigate to **Dashboard Settings**; this is available at the top-right corner of the Portal\n> **Note**: Ensure the login user has access to 'Security' and 'Manage dashboard view and data collection' permissions\n\n2. Click on Security tab to view settings for Security Operations Integration and for Knox Security Logs.\n\n3. In the Security Operations Integration page, toggle on the **'Enable Microsoft Sentinel Integration'** and enter appropriate values in the required fields - \n\n a. For Tenant ID, Client ID and Client Secret, refer to the information saved from Step 1 while registering the Entra application \n\n b. For Microsoft Sentinel DCE and DCR, refer to the information saved from Step 2 \n\n4. Click on the **'Test Connection'** and ensure the connection is successful.\n\n5. Before you can Save, configure Knox Security Logs by selecting wither Essential or Advanced configuration **(default: Essential)**\n\n6. To complete the Microsoft Sentinel integration, click **'Save'**", "title": "STEP 3 - Connect to Samsung Knox Asset Intelligence solution to configure Microsoft Sentinel to push select Knox Security Events as Alerts -" } - ] + ], + "metadata": { + "id": "790935a7-f8ec-4207-a48f-42a7e4ee0ab7", + "version": "1.0.0", + "kind": "dataConnector", + "source": { + "kind": "solution" + }, + "author": { + "name": "Samsung Knox Asset Intelligence" + }, + "support": { + "name": "Samsung Electronics Co., Ltd.", + "email": "kai.sme@samsung.com", + "tier": "Partner", + "link": "https://www2.samsungknox.com/en/support" + } + } } } }, @@ -405,7 +422,7 @@ "customs": [ { "name": "Entra App", - "description": "An Entra Application needs to be registered and provisioned with 'Sentinel Contributor'/ 'Microsoft Metrics Publisher' role to setup client secret-based authentication for data transfer. [See the documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=client-secret) to learn more about Entra App creation/registration and creating Client Secret credentials" + "description": "An Entra Application needs to be registered and provisioned with 'Microsoft Sentinel Contributor'/ 'Microsoft Metrics Publisher' role to setup client secret-based authentication for data transfer. [See the documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=client-secret) to learn more about Entra App creation/registration and creating Client Secret credentials" } ] }, @@ -418,11 +435,11 @@ "title": "STEP 1 - Create and register an Entra Application " }, { - "description": ">**Note**: Once you have installed Samsung Knox Asset Intelligence for Microsoft Sentinel Solution in Sentinel, a Data Collection Rule (DCR) associated with a Data Collection Endpoint (DCE), is auto-generated. To view this information, navigate to [Data Collection Rules](https://portal.azure.com/#browse/microsoft.insights%2Fdatacollectionrules?) and look for DCR with its Name starting with **'samsung-knox-dcr-....'** and click on the DCR to view associated details.\n\n>**IMPORTANT**: Save the values for Immutable ID (DCR) and Data Collection Endpoint", - "title": "STEP 2 - Obtain Sentinel Data collection Details" + "description": ">**Note**: Once you have installed Samsung Knox Asset Intelligence for Microsoft Sentinel Solution, a Data Collection Rule (DCR) associated with a Data Collection Endpoint (DCE), is auto-generated. To view this information, navigate to [Data Collection Rules](https://portal.azure.com/#browse/microsoft.insights%2Fdatacollectionrules?) and look for DCR with its Name starting with **'samsung-knox-dcr-....'** and click on the DCR to view associated details.\n\n>**IMPORTANT**: Save the values for Immutable ID (DCR) and Data Collection Endpoint", + "title": "STEP 2 - Obtain Microsoft Sentinel Data collection Details" }, { - "description": "1. Login to [Knox Asset Intelligence administration portal](https://central.samsungknox.com/kaiadmin/dai/home) and navigate to **Dashboard Settings**; this is available at the top-right corner of the Portal\n> **Note**: Ensure the login user has access to 'Security' and 'Manage dashboard view and data collection' permissions\n\n2. Click on Security tab to view settings for Security Operations Integration and for Knox Security Logs.\n\n3. In the Security Operations Integration page, toggle on the **'Enable Microsoft Sentinel Integration'** and enter appropriate values in the required fields - \n\n a. For Tenant ID, Client ID and Client Secret, refer to the information saved from Step 1 while registering the Entra application \n\n b. For Sentinel DCE and DCR, refer to the information saved from Step 2 \n\n4. Click on the **'Test Connection'** and ensure the connection is successful.\n\n5. Before you can Save, configure Knox Security Logs by selecting wither Essential or Advanced configuration **(default: Essential)**\n\n6. To complete the Sentinel integration, click **'Save'**", + "description": "1. Login to [Knox Asset Intelligence administration portal](https://central.samsungknox.com/kaiadmin/dai/home) and navigate to **Dashboard Settings**; this is available at the top-right corner of the Portal\n> **Note**: Ensure the login user has access to 'Security' and 'Manage dashboard view and data collection' permissions\n\n2. Click on Security tab to view settings for Security Operations Integration and for Knox Security Logs.\n\n3. In the Security Operations Integration page, toggle on the **'Enable Microsoft Sentinel Integration'** and enter appropriate values in the required fields - \n\n a. For Tenant ID, Client ID and Client Secret, refer to the information saved from Step 1 while registering the Entra application \n\n b. For Microsoft Sentinel DCE and DCR, refer to the information saved from Step 2 \n\n4. Click on the **'Test Connection'** and ensure the connection is successful.\n\n5. Before you can Save, configure Knox Security Logs by selecting wither Essential or Advanced configuration **(default: Essential)**\n\n6. To complete the Microsoft Sentinel integration, click **'Save'**", "title": "STEP 3 - Connect to Samsung Knox Asset Intelligence solution to configure Microsoft Sentinel to push select Knox Security Events as Alerts -" } ], @@ -588,10 +605,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "5h", "enabled": false, + "matchingMethod": "AllEntities", "reopenClosedIncident": false, - "matchingMethod": "AllEntities" + "lookbackDuration": "5h" }, "createIncident": true } @@ -689,10 +706,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "5h", "enabled": false, + "matchingMethod": "AllEntities", "reopenClosedIncident": false, - "matchingMethod": "AllEntities" + "lookbackDuration": "5h" }, "createIncident": true } @@ -790,10 +807,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "5h", "enabled": false, + "matchingMethod": "AllEntities", "reopenClosedIncident": false, - "matchingMethod": "AllEntities" + "lookbackDuration": "5h" }, "createIncident": true } @@ -891,10 +908,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "5h", "enabled": false, + "matchingMethod": "AllEntities", "reopenClosedIncident": false, - "matchingMethod": "AllEntities" + "lookbackDuration": "5h" }, "createIncident": true } @@ -986,10 +1003,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "5h", "enabled": false, + "matchingMethod": "AllEntities", "reopenClosedIncident": false, - "matchingMethod": "AllEntities" + "lookbackDuration": "5h" }, "createIncident": true } @@ -1084,10 +1101,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "5h", "enabled": false, + "matchingMethod": "AllEntities", "reopenClosedIncident": false, - "matchingMethod": "AllEntities" + "lookbackDuration": "5h" }, "createIncident": true } @@ -1185,10 +1202,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "5h", "enabled": false, + "matchingMethod": "AllEntities", "reopenClosedIncident": false, - "matchingMethod": "AllEntities" + "lookbackDuration": "5h" }, "createIncident": true } diff --git a/Workbooks/Images/Logos/Samsung_Knox_Asset_Intelligence.svg b/Workbooks/Images/Logos/Samsung_Knox_Asset_Intelligence.svg index 21504c4e05d..4c780119c25 100644 --- a/Workbooks/Images/Logos/Samsung_Knox_Asset_Intelligence.svg +++ b/Workbooks/Images/Logos/Samsung_Knox_Asset_Intelligence.svg @@ -1,9 +1,9 @@ - + - +