From b473270b0f5b86cc5a1cc913dad2adf0e392c0bf Mon Sep 17 00:00:00 2001 From: v-shukore Date: Tue, 16 Apr 2024 21:45:28 +0530 Subject: [PATCH] QualysVM repackaged --- .../QualysVM_API_FunctionApp.json | 2 +- Solutions/QualysVM/Package/3.0.0.zip | Bin 0 -> 55381 bytes .../QualysVM/Package/createUiDefinition.json | 4 +- Solutions/QualysVM/Package/mainTemplate.json | 482 ++++++++---------- .../QualysVM/Package/testParameters.json | 32 ++ Solutions/QualysVM/ReleaseNotes.md | 4 + .../QualysVM/data/Solution_QualysVM.json | 2 +- 7 files changed, 260 insertions(+), 266 deletions(-) create mode 100644 Solutions/QualysVM/Package/3.0.0.zip create mode 100644 Solutions/QualysVM/Package/testParameters.json create mode 100644 Solutions/QualysVM/ReleaseNotes.md diff --git a/Solutions/QualysVM/Data Connectors/QualysVM_API_FunctionApp.json b/Solutions/QualysVM/Data Connectors/QualysVM_API_FunctionApp.json index 6315051cbb..76159de36a 100644 --- a/Solutions/QualysVM/Data Connectors/QualysVM_API_FunctionApp.json +++ b/Solutions/QualysVM/Data Connectors/QualysVM_API_FunctionApp.json @@ -126,7 +126,7 @@ }, { "title": "Option 1 - Azure Resource Manager (ARM) Template", - "description": "Use this method for automated deployment of the Qualys VM connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-QualysVM-azuredeployV2)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **API Username**, **API Password** , update the **URI**, and any additional URI **Filter Parameters** (each filter should be separated by an \"&\" symbol, no spaces.) \n> - Enter the URI that corresponds to your region. The complete list of API Server URLs can be [found here](https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf#G4.735348) -- There is no need to add a time suffix to the URI, the Function App will dynamically append the Time Value to the URI in the proper format. \n - The default **Time Interval** is set to pull the last five (5) minutes of data. If the time interval needs to be modified, it is recommended to change the Function App Timer Trigger accordingly (in the function.json file, post deployment) to prevent overlapping data ingestion. \n> - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." + "description": "Use this method for automated deployment of the Qualys VM connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-QualysVM-azuredeployV2) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-QualysVM-azuredeployV2-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **API Username**, **API Password** , update the **URI**, and any additional URI **Filter Parameters** (each filter should be separated by an \"&\" symbol, no spaces.) \n> - Enter the URI that corresponds to your region. The complete list of API Server URLs can be [found here](https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf#G4.735348) -- There is no need to add a time suffix to the URI, the Function App will dynamically append the Time Value to the URI in the proper format. \n - The default **Time Interval** is set to pull the last five (5) minutes of data. If the time interval needs to be modified, it is recommended to change the Function App Timer Trigger accordingly (in the function.json file, post deployment) to prevent overlapping data ingestion. \n> - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." }, { "title": "Option 2 - Manual Deployment of Azure Functions", diff --git a/Solutions/QualysVM/Package/3.0.0.zip b/Solutions/QualysVM/Package/3.0.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..6c5a6059e7d4c86188749611fc443afb8a452464 GIT binary patch literal 55381 zcmZU)bxa*h80C$-ySsaFcPkFX9g4eiad$6X9EucocPY-ror}A>U-tcWzif81$uE=4 zGs*lh&rEW1az;%N8U_af0s;Yov?f`%qmRh#bmR7b- zwjQ?5PHcAW&Q4qUUrxjwnBYF~?T}gAdJFlk#5pPCl8!JUlT?V;-F1b~L0%}k%wM|K zY|rwwxU{IV)~6+p-``N5+q^7CV-{fGX+nqdNYSFUr~D6IhOUD~S9j3qbYrs66IV?w z9qkhR#mH~X^KVL{Wz0puq6>q_nufw$;E?Bjq1-?EhKdbO~;kVlSsg4wheMde5By5}Pb@QXXF~E2{8kw;sXwLtV zwbaP+ehMLhkku#Je_#7okje}P12*QX3ts#~!QWC&a2;V1?~!9Td47knG0Libq!;XE z(A&3wr~+onOlE^m@F`V?{L`}u19Rfj^V)Zsc1)$Xh}kJ7E1ghQO`N|iN*NApcnZjL z*gt)6<`6{qm?ms^OB*R-NN#DOXhW{JF4oB zeG|Uz--`oWh#~XAD8FsYG+4x6O4jc=BDDtk6-GHzZhUA^HY(y-qOu2dTQy#6l!uuv zSq?I!Fy@T{KoS3#ZVMVdKXtw{cr;TMEdAobtj2=1P?$oph=OT9t05Fy!xV`7i`1fE%8LFXYx4`?eALU-!S}A2S5z}(t#PY{{wsI5gNz)+ zDeAaS!|2)lp1Ob_(oJU|B6yH#UkjH*NH3BH})SA(IT5@Ssp> z?#w`7sH8boMqI9TV^`$Q7A$yKnwr-0?inj7kDK-IAOO{yIELM zI(RvVI_N~6cK{{f2&X(S`8GOQHc5qhW9(g|?H>B{1YHcvDNR-A_AVWnCZs_7vlY*Q z5u-eVmHS495l$l1<5$US{RA%S`ENSR^kiA8oD3Y(sMEtp(Pbt@p{EkC0TU zrNvtP(*EZ1*N>9ASizz9uZY!-ic@wWk2)RAaXy}?=?vmjVIaJAIO|rSu+Id|<*}mN z<^u=T_~$hexZEi5sHCijYc*!&*^meBly00g-v+ z33>v{aebIDk@K;urvu{y(PkmVJ?QuyKz2Ae{IH&H8VS)`20vT9zY&*UF_=VA3H^gk=0NFZI|p-KMmUo>wEX@5^O4%o~Seq-&nU$0L z;6sUj6D~$uSkwtdm&~NCI`8a{5J9ipSp4Km$xYE45krm4@YZz=G53Y&6@<};j)ZnD z4T`%oE53&;_jYMj)dv_={R*wZaT-p#*nmrL_6)@^P>=Ah%IK%%pYFkq0?v7%HT;Z} zK;&zES*FR}D9-s_5?1A(M9(}Ggx_X7J!ArzEj^+x=}a7KIZYaP7eOD>E0Mx~=)Gh> zys5b#UmsRSBLfD6qQV2|Tz@Lldp+CoopVU5-|J{g->;i8geB}O*&6|9W4p%SbYl&? zfS&Z7#5fpl=h9OB2|i|4Hre}6N#d|#Zt>dD^%drjL~)Rno~xZ}^_bjvMw0jp%vC(Y z$QM6I53@Dw>MHw7WsJXD&Z1j9Xtrp-+R(b|BqPi8$Gk(9{ZsMjV7^-U0Vu`o#W4lz zLRJAvP9Rz{*oF&2a4NHRucOZVPD^@*Dk}imH#q|}E6`W%(fTTa>_O!z;-PSRuxmbS zqVYO{EN!y#RortYjbKcmw#!TMqqq~&n4Jeq66R#=?#m$q8@J^xhp7_h#YLRolbfG- zmT`0`O?^GrX}{NTz9ef0jbObfP>Y(U6^Z9Pf(pHvaVhv#ypagaxraDWWnVu_n8!DR zET}B_{(^E^+6wP;fCv`dojg@eh};(L8UI3}tbS4Mc&Hn7dDB>2R_3d{pRe8$sd#5h zmDO=|=}lf=-L>Y$g!tC^_O&THNRat%Lz&^+t|BfFV9DkQt4|8Q!o#pKdq%+hUK)0P zH(F1t@$4mEX5HGTb?6_9{_#$(_J66knkJQ`f71{UlB)0!nE$CbM>AU|O-n}?hyS$P z|I}|6J=QrJ|K=H9K1G3_=!SV+Iw4%pP%x>$w;pzgqukVkQCT{93<}KezCC>bRhU@| z@iYdaWr<1L&>j`FwUxDt5!+wKU(wQ_PxjP;X!oZr)f8{+N&PG_v#hTJ%Ne_BmKm98 zUo*Z|%HEqdVSu%{Gzw67bnKWQ5php)X{EwQCzoAw8Ox-stoHMKE0qtj&K|G(JTCI@ z3DIx(pqQdB*z4os5v1w}iWgFmV7Y2XWe;ec8piIToK6dweCo0u-IK`2?fV--s4?>4 z9IHfe4)wak+I2i7yauRXs$Wjh`n*-O(}9b$u-cep`j}904ZIDXjj2*X2-LY3u=F4kh#Kh35BPNWtd2qtM~*S3wyCb9cj+-l z;t`6A_&G`~PTcE!(qkQj0IM=V;G3WuOw>4j(mT-)GU~gflQ$F`1nfY-HlAe?!$Y)c zBPQ3MR2S!|F|OI{=n5!IRDBZ!7GZ4}vd;&wtsD0DCBrDbDh#a62 z|KO;FjhgX8b3|Xx&cM|@r{n4%)#Wl;R;pbUuazE^WLZsD1@}1uQeH^rQQK4NKQcjEKaatMLABn>QwY2E1C4*%O|p?QOoAU{aAmMMq@nP3|>|G#MsmFS`|c_0_3} zm!<1HYBIx4y^II%C-G(K*tr*~M(YejhuNz$1&fvlbr7DaaL-4Hh?`75fH+3rTuM!J3FqtrvCcG!* z3BGeih2BExZ?RcXAZ1ixUSJUL!!OMXX3%8Nq1tuI!MoPn*`D2DLMP>$eRpD?z&ntHCGs29?PD*2-!r(9~7Tp!SS)DD`Xet!?3Z+W{v z|F+BjVf)2#`$*#t{CG~~xW!Mo38(_VB4P)LAa1vm<^)6c0Cd-SVP6hMEdu_GDyBi~l{8bQJXV+Mc3jUeXb+K?V+coch*ER4@pN-4i}Q0S*2 z_GYoX2;wZ=+Z+3POFtg_6<~pFyO?2=H)(A4L#zcQ~iY26)5UII>3!GM`VBKkV4C zkclPvo$!0|c6`8C*J{)Ut8KBgMIo>{U~dmLLr>4`hJNh zNqKl0pPDU3t}TK`7FDBD_lOoOK0W5!H_u%1eWobd8F$^i99P{vHZ;YLV3LgX%poi> zmMB^$_tkNxA;ct|*GQS)&L$RFKixXVQd{9uI!kVx>f3uL9(eH~m+#k1?roz#K{nK_ z93FBZ;i%Zivn`(amwv-|6UNQi(U`7cEyq4)(TP-@e#&8mUx)3xG3C3nudSKyw^#Ri zDywBtBwpcZsOs2Lk*!j3&mVQ@Q;{BHcU%YxKfi?~^YuLz5cA znrp<+Ovo%;NqU5a40j8l{YmEER$@MN{+&KU@b4;q2;hlLW^S;VP*R{_qs+vAYJ;}W zIDT-eD)^m+3_dGZuN&?~20-0OT)<}29B)V{9@30jihVm|i55k}RqUZxWxN~U-R+K6 zi)N+rnGKqqpH9M$G+NEA%t{8d5Wh)Iiu|i<_@^{$gnn!!|MSfsyDac>pPgKi%**I` zL>208H3OEN?&!ih0Mx+ubgSD4(`@F8s43iqP#%UNsLQ9oAxyx`Ik%evA-zjENUl6r z_?RutWe??(d^b!isEfVC(jz@f1r*<5D8riCO8_`Av74Y%tV3Faa@rMtqpZ1{DzqLD zG-fpCCfLq(5wuYLt%?c4NGUuNadrupQD+29*hxxfmlUZBmO_uITZp;d4AM=)b!9a> zn1;L0GkmybH1>e|{rjcN$n}HA{7T*)x-bq_QWj4!CfR4{ zGbHx02v?6w;Nvdx*!@0_Y?HPzW<}v=fcGZ(lzF3zMy!bhj2x4sj*0Y*?wD!-R7^}V zv1w$mS?!*KkG*xDP0APF9;4A<3eFqhDs8=ie(6QskzCzhTi`K82w!xKU~hau2{U&--Hz=By7+fWdIMO|}ql&n`qdq!ihHmK+B>)S5zQet>uP5Ef&QOhoJ?vuz z+8+^Q(wiTy3qLp!ve;z-RY<*T&blGoF6y!<`7I|z;PHpFxz-Qil`G+#KIk8owOM15 zU8c1px_Q(6%bl|R_}{nM5(dHE!~h*zEA)?QbE;7Td^CD);gj~z@`cW5A!Jubo zm!iSGpM#0~STvZOURj>uU!CoZWps21deDa4CEYMAV6rO%ktqJM*5573FS2P)vbU1yS2 z4&3D)t_u(aovBk7`3g;Ov@B3rIai7VCQn;i_+W^9tZyV$?+QBlRU_|L@U+V!KwVhY| z;}K554UwUj3ERLt52;5RxmM_uAth5K_kz~i;#2u!XA?XtaRa$4;s*wf+qKIDgoB`> zE?4K`r4qy|I&H>_5XjpAgIAY|Fe;!TjQk@He`%|>)%3YjPVuf0uQWiGPdy|ioUi1< z^djzxC0uOk>yyyG6gcBQAVw{oZ%LeWYe^};!r>iKYvTG*;@1QRQ(#I+s%Yqsj1BG+ z4XEVn>?jZo5cDz_7@TSvK5G*fyPA!xh2E$nQfJ{RK5O(DN5|(MJv!kKUojn64ll#h z#=!Y1MCbvGZAE#-!NX!3+D%CxSc9wrMd55A!9)jmM!^nSj(Oxl{4`I6wBcyoI1&y? zJ3UQQ0PtOpKV3iEkdV*??3%5UqnC$F$ z8BiMa6XoUJ6^aG-v?QmFeH7hGRG!z|7hCp-O3aLBB-gLJjF0d4oH&>rGdGq)eVEG# z;=SO$6RF5CJZPb>hg5CXXwb3&07vGE1KzRr7!wgfXt##eXhv0s&fB4eg4;q8i`+&Q zY}l229y##ds8KBt+%n_}mCL8@#om5OCltr42WfZkW03xLLUX+~FLB8fFU_1k4^8+bhrk^4a{-MkI_(;UXNIl=U2(r6L2?PF|g~cAxnoyOx z$Z{M1L1jjP2#ghn!M&vRC4Gn?K!65&x=6zmh`u6l79#&f{~bdYjaz6c9UBN6s#<{5 zqcOX)P!93+Cnk*Lk3_UbHzIq7(!3RikxT-InK_p+=i{R&v8gqKM6kMYpm zu@yIhaTP&Wxt`{QG0%yqg=XhF>oB^68&9P{(3nI;rUob#`cY^39b!Ro!;Y%UABcMk z)=_v5q;TB$pj$ZnU3O^h((H*tucYG-}QgkurO8%LXdTcn#}^@gyge2Krg>S`$&=MDSc_tpZHGB3NzD} zpsmSD*q0F&w46hk=_VJFqPBynQg}aWX1nALf|$Ha&b$5IoGPzjUed88>Nk*+?SV#O8%$IdSJO2PLY+Oy1tE%46DCx!lXp36ye&{xh>)?v- zPD=bvu3HFrYi76mRQFO97kx>ZHCskb8`?^>Dx@5gR)zeGdNU<{z$y^ab?kBe7$61| z=xD-7xHEH`MWa(qs#5*>`u9+&STw}Pk`L3@FRp(u+4c2#Xf$jH6fg>iwJ}`-^#03C zs&D>+O1Eg^=H&}sQ9CW;5Q2f7h6Ie2-JamF)YD6Jyy%4Ze;>hi<^06diaLX%{ML-8>5CkKfB@~eDXGr0kU?V^ zK?Y}k$2~74_6zy=I}HMQ7#spXzi?Bwt_c74JreC@LI{gOL9Ut;&Yqd6i8M*Dcz8-- zFV;ocN>8{8lHj+Cd6l5&Zb%yp9GUO{=#E#)TTGOoY1w=paca(o0r{K5;5GtUf-!@N zHo{MYqs&_kmeW>_n#{!rCM=G{kMh!_vWxxO|48)`0q0xE!- zSfH3Bn1UhZX(QN~+oRopsP_WnZ5vAeweFos@)ybNg_?)_eucKRk;Clbnpr$0wV8R zA8W_LJ=q>Wll&m3-cVY(_N~9#P#r_PovJCA>w_1~rp88^Now)+7?#8%L!dN;11^i) zRrJ8Ik4;tigvm6*N4?KwZ3EY(6$S*JUzc&Q$D=Z`(Xl(jM~a6+Jk=(0pu#yTtQSWHhlxhDFTjr1gf9O5=i^sjf$GInuH^A4Q>n z6pF6fkk|=oP`Nqmpx0i{lG*CNH=}H6yzNlkVf}ZT$bR5dI>2|7u`d{bsbFxs2&iqp zXjKGbp0MD*hq7}UI@{AXO8zl~_JKm@rVEulgiy~P#0$d-*nq~%51G9M2&u^=?My}MpO-LzKJqz==9#%GGBTogwrGP+#2XkDiXCh*Noo@AZQld& zpNOXYcz1cfIb5Di^R%r$|e8n?XQ4DqF&ZIK=(Pk9L36 z41!Mf!39DDbpLb;CD<_$DHg<00$tCT8lI= zgdV9TR6WQg1er>Y9a9+4=G!D%+c{i+?)tdz!P#5wVpwi5gWJOwl_1MC)StZ5Dnjs)YTTUPTE+gBxR6aTQ=4oGbOt`66w-7d} zZ0JeCM&Jd#6*EQS=>)QZ9gM9O@j>qYZfec{qM8znlCJrM$nVfbYaw0`>wnXeRQ-1A zY(w{Q{{<)iGCk^Lfkt_2%9WH3rz-WqcxS+W|J4M2-zOgMgJX|2^1C3M0fjz+g5M|! z1cL{u>DMUw^;f+1YhT`Lohda%R1?F;ghFsrLC||cJYJ9xW*)iT?-1G!_bCxaYQjF! zADEI=LFN17$@B-3hgM-F_=5P)hl2MLml6z2C;QFNQ%8g{rl&Gk^i7vSv z_jvE==w}nL%fFPOr#`mbUr$6%M&><<+eB7wIBFUgb~}rq?$jvmuK`j*0nFY0`5=7b zz!;i22E?z&V&o&_aPv^23d|X2`L-Jripn7qIT!#~%`}pQSqdtEn0BPB%wf za>ZQ%F#3Sc+Lh{#T5imm)0M6%51@}7sp3_HoOo}iNp^}WnQ5Ptg1GwW_qjky|Q6_A>7vOBbs(WZ!{70fv3qw z_p@`IF`>}aK1texdWI5tS{XY|KvBDlu@oJYEtF}A@XX;ak$t^2m5Jf0_y7sX99Tpc z58GUgQDZiI7itI532zv=MhEd=oDp%;XC8U@^$mDwJZE|D4e*0QXe}j}8RF2uP?+CD z06f()hmu$h8=@+9&oUsEYD)>uJ-S(Sj~wE%Rq5Ab3;d>apV#DV|NKJsv_{+j@9oUq z`t(V#LY1)rIp>4^^tUCjG4o0Wfafc z$X~qQ{`2(gAgD7^Z z`vq2un^^Pe7++m7VK$+#@vJ*s9^cfA4YBYCEUeW$UjD{&#rvZ@oQFPgUw%TVS@&`6 z1qB@7_HQQlm(NmU@;uy}i){v9oMmdTMZX$MisJPTkVKsgckzuaewsXE89X(>x%D$& zYIH~%ndKmRDyvL_Kiq1)0geX_IuCb}eL38n+w`WNiPqmu-X^B_FtK(a(hWHG@>~Fp zN5nWFfOo6#;s{UfB7vy!M7B9q9q~@f-t{1SR_}M#iiIJtGEZS(|InvfUd6doUd`0Q zk+~MWqTuJTEshC0jguXQNr`~rEP;~^5+8T?iai|s=(vyaP6nLI*LV=eT0|Z=2+!4KfJs0UG%<8j@WHw$o7M7PkUyR`sG%-D~uL+Z77H?GiyC`?K?B!h~nJ0eG5e>9Yd&%qcFsu3Gw;Tr=c9 zeca zaRwjwW-R1ek~m)yIIpv){6;qHT_QSPgD~h?JkatccPxLwd`9|-eMYi1TK>Gk^#=U= z(?cmrC$Ve8GuFwDIjK{c?;NW~AKHJB{0;jIy~kIF%ro*ozyh9;pb4@hU&-x;{8>`Z z@R{?*=f#$es{CnE&rmizh@L*S*@(v2XYERXl~2F@L#u#-4Vw-v;IVy!+hol%9M7S8 z=5a#1-{Q8<|II7$^7gBhr#A@T0@ix;?A0>Lx*snEN*D`Jl1k{xH)jn@lzsDNb546nAl3D~FYVG&H zb_~Gd3>FDdWT}I8c9(!{+lgI(uow2eI%3ebXZBBWlhv(0KVPuu{YY1UoVA3_w&3uS zJ+6fE9K_*9l3wmIN>)>B>mwxDHpYiZ;A?N#c>yRDzwZiH(Du1f=>1wLK6;n1KsvOJ zr_gJc#yF%lh}4J-nZvV)NJ?G;zbb)bBrd7(w3Rx~2Y-I3s&?R_^&?mxBii~-w2pHm zA(YkmDE1O!cS~Jt{59WB;>Dc>)xf*#^wHdKR8tRPLNd^#u0Q+Oq{9=qSapi1%u7+0 za-yB$3{>sH{Fu)X7dPG-3&ZS2r}Ure-bki2X5X&gyzUAL`RO;UA=GK@BNuyqIWH{- z%cataH4raGt zdxTVx;15iX6Bwe-?bT;8>WqiV-N;EH0&21cvB3O}8xmC$0H&((nZz%AP_paZV2;O~ z2Dz||VQ8?tLxbxF6CpMG<6w;L5!T5&LNEVDwl|`%vaxTbLg~k;dC&(`*O6Am!zCvm z#tl4Yd=*5~Po0?8TXvDS{VKT)$oB<|R{~8wWIXxe;>fXBS)OFh8lD z=YJT|TG=IvxgajUP77v2%k%rlq?buNyGiq9I%lxm7nL3YO(y`48)h7qWT>R;K;>mh zI{iyRzXT+I_P&agb>n`suPQdM9N_ajsW-Es^$RVXOU%VOpRj-5XeZ#h+7LGMJlMiq zPI(rexwXqvwhUl{Bv0>^_xmBwt|GTGGAbNb^_Rx)X!-&!LpTIQn%iR~q>8vhEG$B5 zSYwJ2J`C-`JUcgQ)S}o|Oe4o_*(c+#$A=c$9O{!Gp0DxY&}D0V`=#rXh_^lwiK~>E ztAj`YKcJ>F6+bi>)@q4hq7b*Q-RFI-YxL{M^=q-7z6W3D zWbA>RX8~V-?!EDi9>`}VYKUNP&erEK@EW_~kB~#GRnHgf@`>d!GnO6k>+A7YCc6oU zcGkpnF(^>A7Rk+6Hvwd4DR0UM&XLR+b^H*_|q>S%)4`(QPfsZ^LAdv0t3%K>>WtUv-(U67T@l%!D z0WRy`#^ zZ=5cVna<&#I~SXW5gzMgg9Y5QHo#6yHwA^g+j@vk7);ynsAz7>II6;Ls^BD{xCKA2 zi}7az($&n-%e^kI_oo9_F7p+Kq^Bf<-7f9-=H7sl&qpR`n*Rbi69uKLqC<&x7@rX) zwONeC_st{w3z&CbsGk^zdT)br6u~>{yK`mN`NJNozQ^s^;YZF95D`u11%9_F2Z_Kj1`}O< zF(UuU$9=CpUM z5u91Z&i!@BQxv^gfFIjVGUc)NaR?_DB^cSR$>VlRKTN%_$>MwsMH3Osmz0UHJ6CF$K z``hFO+3t;PEAIO<J?3QeUJ*+L7e9`$@~=+tsA>`iC%W{BG&j4aOe0-RYt2 zIp-jN_7)gNu8xd$w$B~$L2l{(|HpW#}Z~C zll`k8@o18mh+UnSsOiH?@Z3JMY@0KN=zkNbO?Myv{*znCl2Q10GIEYLeJ${k=js=? z%on*v*ylOV3pFg5Vq;8IRVXvbYxm4!r?YRjU(VoZ;NxV)sRJ+R^Vl#oaIyS<1CGM8 zd!=Lg=bn5^IUq5MdyI?=1spgu*UUDWlm72k627&FeuMCtIqfvr1qWq+Nar?*Ua{Dl zfy2#AC6yhnV6}sn22&wR@Q`uuSNYE_Jb1U6fb75Ns`adXp+@X8?vwh`X zpzo}jy;Z;NgQOF|;R?X60;+5A6@iUmv3dn4yZbfB?qcfEkDEY0-j*<~8k+8}m&r9s z2ru>J1Rf%);fbz&uOJf9mwlVU?W7IASP~-FxQa~2Eo^PpJhCE!@J~`$`RU={K;5*! zK%`3{uc8NUc}jDbTaux^IoH>yN*p!GU(n5XRvnV6BDY6VukiT!=#zJP|*oHjv z#^5WM@#Ir2F zHFD3DTYn(viww;Ob49FR{<4p{lI`3_1{d@GGk(?15geP}la=^!JqB_S!>8DW@(^?O zxv49K-)0xo=(Vfu#RgG>7O1{LJZq*F*%`Y^l#VAZ)9$myA-%))(B;knwf>(h z(DyFRO2PP$uV1kmUW-L1M>sxlD#HLxOOyC>H;y;`esy++`ct2+=L#v{?__b` zow=7=={j98A27;lxH}aIR8b72C0=CkxS6$p#=*!0STi^g5!wYn9)5S( zeCtj{(fIp&GBrP5j0o$DAVk1cj0M zfzn@Rn1XATBT~9w4S@h6|6WzkCn(D1CBx4C(8cKb^bX^EUVWMcc%1l6gabA z+<};xb^7MbkzYA*draV?jSBkP=f`~ez^}Nw(aQ9;j>2+e`DM#*YfX7)Lw+lQ((}V} zdsCpR1H_p>L{S^I! zSa3bdpPA+4yb!cjbMcEQsCp3Jtg{pUW`UOGyVNnAJOKFb(TS=Mm4kZs+6w0L%1>5m z>D!_(b@>#kbsgRn=r#q9s0IGG{Q1DLH~oP9;vcUxaO`nAn*ei&OEko+KBBT$_HyvM zaKNKU)SZ~c0kZi$?`MRt*Po9|BMWhRA>mn&qc#6M+aJ372mjttFA+)tg@{Ygahk}} zW}>^;^=Ic7fVm(kGbrUb=A7g|l#}sN;DW{F|F{efkNM(V7xr^o?U;hP2_A|AS zgpi7>PeJS~5;og4vVh`GdJ*WsG(xIe5|J6y{Z4c1G3VkhU@tQ*uiD4TAWY$9X4QrR6PZvJuZya9DNwR3Gj*lt4oQuF`Um%FpoLxF%kiBeV z2A^XZuaN$_S7873(rw4=E>s7;iKJ&E=V?pE@CX$XyaYi1JI!X?z1bY2fP&M)H_F(;y3+d@!Tqx01{ao!4{$)8LmX8Q#<}Fy%!z^ zJMAo&IY~VbgTZ=KN?xnmIp9i2i7lH4-yzD|pl-_24?#bV(%0fN*SSx~DM@x$is8E9 z$4r9jzcYS5!r^-eY4F}JP&$RHoS9Z^l>0w_@9RP;u{oT=`N@4RS7GcfZ{dRh8D`_c z@IsyIoN$uQHbE1@e&S(tOQ+Iv%ySc7T#+8q0dzG$b3vQd67i8nl9=&#CQ&zGVu9cb zVF}^S5q=?@=(>Jg3f?~KL51nA*JDiab`0^=vq$-*E)tpc8tSmX7uFKwBJ_vVn|_l+ z^Iqf&ozDC|ZA;KXFnaPAQQt$3a)#+@RNvcfU0~jS&aU-TPzRL~$MZVwE2{qmX71~)coVH<5vc0T?kJ6dP(`^#TFs-DtOqaTYT zeCT5bycj!GkM2dhCXJ#jF_wQ!d{H8XtZl*J4jXL^>fL^PdR#9zV0`Ujs?EGY$o02< z`hwnOGqrmTSSx(@zIjFJUGP4SdF<{R%|vR2c&iE8Y7IH!>Cv*k4vx65{P!+doc^&%h;FgsGnBa~&yZ_WC9?_hu!Bt00n!m(73>{cGv)fc9 zo=?0>6+W8a9I}F^uH;(<14#3@yI=ww%eEtcT=xxj9_?)?qrwV=yO2N~m~5fmn=g0( zaGsyq2@PyoQSM)UzgdEhc*UsuO=^sgO%#jSLE zI`8%kP@H1S)%BkI|83TbpZTw|8}Zn8Gi|a$AZ(B*swp=h&`8vT;IuJbbYYjIy_|Bu zTIL7tWnsm@JJ4)ui5d3gza;uBfpFP%i^)s^aphQ7SD<%Q!$z+}Ij{g|vP=|Ba>QJ^ zC@IjJ>sj&Bj}Rg=vzLc}-SE0|-rKwM0%!463mQ-#RCi(Mn6QJkKj(PvOpGEnyh}=H zC;Unh_BHdz@oMS{xWc=a>-W)rCTd`PkR`ZH(1zyrI;ZC~B92V-tTczP?7_$so1-S{!%(=8Sb!niQc>GyI7j)FIH>aAZ+Gpj#W{4Z7^$Vi2u7m^FjJ6P4p zD(qg3$kt~%VEWpyTpJ#Znlv5FSr8W*N`l{5>0a%tq4#GoB8U{jqti8OGq~|utuTP9 z5_v2I!nVSu)hXvpkaL9x_BP`9w2_L|!rM*)3(`K@dyCbNr;f6ZN_>tBXOUEIM2xWl z1F?1XAc$I;W}LoMm2cgtS|iyL3A`xO^SzdSNcH4PGse6E^CKrA=FtgDq$u)HMM%3C zCG{Yc^`Wq)#g|`Meah}k@Kn7jiY()G(_*S?cAcbZdB}(49`71ga zg&P~Ev5c;q=Z6&VnpXbFmK+$`|2g_S$2pfo{~iDdL?EC;|HcxtFNvFqq|Dg+-EBcr zeIL6@W^v%s%1nx`UOF~kpGaVord)4pxKL{9A4j#&X?#Jb-ae~k*u;q z-kBmAUR!Femc{<}>PgvB&G_Sp1ocHY#yDrx3Lih*wqw~jvnaw8W$hA4Hs{e&$`S25 zY!OneU(n-eXEAWewAP;G@k)+F=2Xk%DVwn_cS92D>lT7F9z7MMd-kp+xXn!^~73Z+V%83hM<-x+fl=<0nP1Uorg)+cga zSN_?w#%=N445ve8B)8)`he|alx>Sa4i)-S(VdIy(W^Z@$kI=?}stnDgi|#drou94z zX%YHGnA5$##oXN5Rhe4V-x;2Px|l8ZDBQ`Hk*8laB@CtiR9b$M^p2-Kz-B zoCts>v^HuCrRuAi^@?-7BJ5_rNom%C->OX!JEo^y zj4(8O{p{8fNHS~>;-q_R8kUyqVpGCU=*%Y5`1MhL0@xkLXj+uoCIM`e#6vGO6}6Rr z0d*Ya=FNr$kAG@4s+Y1LIp(_QJ?WM_V$8P)X%EXT5oI&}wg?r)dSp({Un)^r?@6oF zZg{Fko8KAEXrLI!6Naa`RbjWPWg#pULVPMNCTG>^1I(8WWk}A?T8!8J_`b%Z9E}vQ zmEW3u|Ks`3?l0Tc?>TA~9f!lU?+F@ZdWm#cac0b_=MT|rTFsE6-oGt$_D+=Tuywu* ziZH4-b!dCFo0(HLc=)LCxNG|5xo0O%|C#4XIa746WCGfxa5mlb&qys;^k!vS5Vj$m zicl-sc$G8K%K#5g=ztnb#Um)+-KM$!@$y(D>k%QTaJN6Wpm7uNRG?BD$j--Tc&gPR z2>w)|V=k4pWNzjdbAwq*@H`=MaBHyC&NON~X7EU~A1~4W!KOyaRApn^Mt6MRR4bi+ z>(!jbb*e!*(aaDs&09iPg`3yhppi3k#+B)%Z29}B%j>^Saa_688tzLe(OBPa4}T?o z6UgEHgUUm8bcA9u?`B)6p3kWlKd;l|kly&pE0fZr#kYX*kT1O)2e&+7z|}-ts;K0p zm4kSg7ONCvNX4SJvg30;vJCOe0G-r%OmlkUK2<*E*d$#jUMZDO#i# z5B%MMqhoeJveNGWngu{F+(mw?%jA5-{VorS0xnSgHq9Sd!^@_9P~YpMiYsJ4pY8#y z)hgj|O6eC6m^@_gEnH+$=}vcT=_CNU;pSJ)`>yb(vEq{9N2S~( z+eqfwPXa$0wH6yatN9K+E48NSz2CMpf1N^1H*=xK2+r*MGqULz|ElqppLQhM&+}AP zFvMs#m)5{P@UKt)4**O+v%ktEJW5rEqf%4R1&VT$uBa~uv6ex*Ov)yuesK++tbUZL zl_8dZft=Tj*g}u7lbD%z86`Dn4!Y~UghdBVH-pv5&2lm`CJoGC;?6p{?6_5mn(JZ1dX(6#-fT8o#>Dtb6$=bMTl(fu1?x$gk zu!&3;^D~p-qe_da7PCFR-N(emU=pjP`*;eMTa8Q3kON%%XE(wh~1-rr6))wH2vHYfg?}s8+00Ta@5f9uyddTpLj> zH>Be+v6gR@=rJ}kX*lee=xQ}=IGJK4R?kjW#dU+PS({ODI?<`#G*<34i&`aLjEy!- zshS>QViSljg<(-bmO8_=9OEdu zjal;wF(gHs%A1_suDe1?_cms=G=LmQlK?waRXl@1=A`W$IK8qym9QCu3|#F4k@{N8yyrEQW0%I?t6_I;GQc zwbhfXvEFJi>w-d3)2hME>_)6UOpRKL6&j0f$5^x5)u}}xzbVG;L|k!8gO)p_8kN3Y zWGq9f8CYX&(XC>Nip!9!S=UDiIDu-7wL6M#2xd~EsVzBII#gif1!yw5KtPGB4ptGnLL4$#r^SY_LY9F{{q-G`~qM-8xlI zZ<6bt8<*>3i7Iw!Ny2-%hDat{uB9Y%j9lZX#HzI^Velf>Pl0SnO!Mq?BF`vh)&kB- z^v1I}W#Ti2q+6?WK}+;-oTosi9Iv!_Rj0_QO2iuDDemGZ2SORBbNV`3s> z$SmlklT=pBCZbg~-RV#{khOJ1$PAOCjRAWCXM)K%`C@d`ghvib;^~}b*`HCJ)QGROT1rBiWA;;J&$ zE%Ig@uMkFmu494XJ$BmnU-As+*cr%_%4W-5;mdZy(X2ObMrIcmy`XVuw+#c1m2YpA2 zk)}mCIZ-T+>P#^nPmysWxyXUek^^~<^_%HUrdGk0a#j@0L8FK@O05pxc9~I&%IfoI z88hm+DmLeHvRx}vBHyCWtL9?f$`qsKM9NHEWwhGRL~)Ka7_!(fsz3uaEhtVVN-it) zd4E>hRP*CyRIgQ~Bmls-hFCE*qN8>~Y*-a>QM3&UJ*BGoKr3{NNJC+f(@JX*l*T<{ruwDl)uO_jS zQE6_9W_Imrb6aT3G&P7*`H7U~xuHt632KaQKqqCU4cket87(bUshBz1q^S|GZmgWZ zHqNMr#pg=%hLMd*ma?HZo`v-A7NuB4+fL)G6i=<9?L{{}7tCdj zFX}XHIhIq4+IDHt#z9|7Z`xLS?a6YB?-AYpLbMmF4Q~t-j1?!%bTokr0%Ik(+$fnN zrJ)ipFFM6^)O0d<9QeOLI+?*RyRJwCF`(<@x^J~66y23a?TkZ+{pKj9$<;x`Rn7iV0C_Mk^`X%B;m~BVS8)$7!|| z2Yqr?*v!SjxHWcD+In4|b_yiZ%2ztkO(WarnP9+?;|^BpP~}P|o{f*E7#KKdwzGl0 z6Q)b7;!ZjxwKXPIp=zC;L3Nl(QlDiMBa_1FYA4fXWG2CMsWMZe<8peFAN8d8xYca6 zMuX^ROt$7-YDTT`HYV%+cvVxD(r`sK>a}#qS*PhzxwvHd@m0cA`kPH%02+x=*-0-k z>e$g@W45$Ku4>Y;61KLHeq`ikOBN%iic zSqwq7&L|+1yKO7pE|b++sYcbR%CaN4Y&lCT#B4HIBIq=-9V*IrHOEqVj~i}cYLZH~ zW)zh)$!JPiOcRNIV}n_ATj40MELfwC0e{5|YZ0Z2CcRQdpjdAVOy7W*(RI2+(|y4P z{gaSp{Z?{F#0teSPl4R76yl5td#6-DC92DfM#rT_Js_BRhRYQC1$EJ4IEv?C^0f}! z$QeU;Y!A~`TLr05qT;MU2-*IcpQO4KH!s)9eU=-JyR%rKpUzC?ZnMY_JIP^mGvFF^ zc1EnV;&dE!a@n)XodWOtsfyw}t1%nXyzHF?7FdWWe&A_3VDyny8?O zRw+;)G8w}Lzd&iDteGieh@1XoJ~e@kX|+0$RFhkn%F>-TmZPJNbisUS0FAc#ZSYrWWZNB%ZI=n#%B`7GCt$nBSxl<7 z8a2>`WG2H!mwY$TmD4$y%FiT{DOtnxa&5W!bOFQz%&pZ@Y;y&&MWYCcr8k5ib&MvS z?OMY)HQa30=?vH^10xFdsMHe{8I@%RZKgl&r=m-PtkpnocU+Qkb2C$l_VAV_bOF#< z-HFmkhmK%)1+C{2B$GN%9M2Fo50e%S3KPOtZNt6NJRxZc1 za{M~3h{m*~RmXWZnO?6cN0zBnPUmt-x{3Ued1RDBZ9rrCJon$tso%gcN zwAmR}p{B_J*NWC_Ea`y$p5j~395#ueXuH_TElpjRcPq`FQ3dA%Va?gO#WvJNqp*o$ z>$y22u|a#@Z>O-1WR?V*?17m=7VBan4q`|oqEwQpXDKl1HY7!4TMSiqy3~M*6Hc1K zgc41a7zXT5N@pnVpAN;tKj3WxQ@EO-VCy?myaGNQ0NVr~5WK9QeS`KVKZ6d#R~^9^ zuID6P-c0+Nl3&!}Oj@SL`Shr(WwailP3D-;gL$d?R4P#oH%ICDdSJ(9qC+;43DMms@}|>IfdHT=8+;H{ktuQUR3a+Q zQldhkJ>XV@TsF5}Y0QYo0OqM8uaER1_)K|GOGOnL>D*j_VG?~8OXXrzvNVZhYjhjg z0l3+qD*7r;u8f75sd@PF&Y$9p+Kd;NkP9?BVwYPK~6Y)Q5&Ks+To9e`du#roKE zUTU@q;(9UY#A{|QJ?PapDm$cR-6S>|kHFQ`p&7kBpDs(;7(L?>OUh0Sqm44fxDB$# zcFPSsM$D!{BAug3bYonIWBrt#9aXwb9*BCB$IW4}X)B|_vZhIuY9UT^TB6*_EYw~p zDsSpJ*ycoH1pajqe2tAoXEhv*rltCZh;A_OBeaF)6prIItfSP`8a3LQOFWqzObIpt zgv4l|&X)PQR%D{7N|R0W2&$AK1}(A+$nEC}vCXnpoHx^ntxkn+26@&_tSTv-tuM+m zOE1z(vN$nDYX>vp1Rymt1V3=1Elo4lM%_%CMhd4>6tlES1aGQ^Q8Jyc&NsvKq@|@* zJu}dC(50+Fk1ACqbCg&%h8c{fd1k^jI=Oa6)iA8xq#Bda%3;Uj7EP+fI5CXprfEWv zmOwXrm8zI=3|v%#*A91jo3%^#`a}+!Vc@lwV?)qIo9X_npl8blwwc!lWefC}#W2+! zvFl2TNmU{BE<0o$T>=}6*4DNt&tmmF(FPYj-Zn8ZGn$j5Dn$=F>D0i?C(0_|s11q@ zXLiRBXrRbedDvQFF)SvmQ_(`sq29g&#_hq z?0l`ZOjhb@pOEBX#fswfMycc0;~6_<`&+jcPhcl~;{C$(U9%VHAqJ1fQ0vUa@F3n$1E%ugwbm{t|2P&1&0e zg2g2dCVYQP;>KV$$i&>9JR`wC&A?H(u4DKV;yP(qfPw>CR2ITCp=pcNtUh;(dZRRz zxthl1!7s9$4x%#F2g6D#q-NkwHOpo}AC`*E4leg)AqVc6)r_F>oqlsL<65*jUbSgX zlA6-G+-&Qu1~pm~npK&ZF0E-Yi}&IfIc&4w*KkYBnoG&;6g{cqV%5P7a5hC76DpSN z6N4%NbOAnzai_u21I;0dv935xx}c?lzotFOYOFA%k`{}l;W^_n*|n8O#@xP4mxs+* zdKt&&y_G~UI>>M{R$Nx|#ELSKOFN3y^j0)BZpw78YiB`+$+m|^t=B3=m-%>c*S#ldYo|5N7GMO1?B)TkC$c&tA zHG3u;y46)3bDHH`k6PBs-mQ`{pw6FMJIg>Y}QG%imhuP z9uitXr(5)>hBwyCdWliV*r+@2kPcQVl&$VuPEZ-X+)A=4PtOMpGP_D8mMXT{RQvNO z=m>e86BsvdGEyE(%?DuEzWM{ z#kf}G;xTi~#_VKw1UlxxunBsY9^{Obl(sC1$f(0&xt4cP*Y#46i(I}YcN7Op#hc@y zn*l!C4D+K|oQ{h&2|_ndsKdI;=-tWR?FhRTqo59dE*((od@$Er@H!#89Iyl9gF->b_dx7%At6Rc}Hm}R?ox!9w4h&nA3DR(lWljO7( zr?piriDjm9!NJ^inJNi`t}~%qlXNCo02Y}N15979GGI2;(m6QZSISz6I>LCfu8%Ps zGjdg{1Ll@R(GrTPQGIosN?_oBz%)|bR2(?Nax_MHs(?+rA3NUEJ$ zS~scjbm6pHRtv&1(`2QTq$~9{4+w&J=CdVE+KII-tes95G9%1sdj$?Z(KKsGb*1QMOd8du7&8QV zK#fTT{1AimqUOZgX*JX66LylF+4LCBxO{e&T{q2Iu8_%tUw;%`G18=!5^ENhNhDQ5 zTMU;}u2rg46l@dAf?K{_0D}*_qXs`6#K-ZF%7ZmJXpQYHyLuQZ$y77wATB)lFw47nLs!PCD<;+bZCupWz1 z9GoW*GhMlmppMTvLd{ktIuJOMT9L-OR?1UW7Ge%WhN3ZhY1o)q zWL+*^Zw+FTCwPY0c}Yl*T~OZH_QIVS;L~1p7o(=kMZ;G!Z24e5jw*G;Fp!|}9D=|zLRJk9j5%vbeMBR`uH z+Ne#JS56{oCUUio)WV9AI(O{y(1d)8Zd0h`>-m+~tyc*VVu=|AYo?PqBEQkq3>f0I zek#|1_)xl}aG~sF+H4i=}$tVma5DD7g zjS5Gm2&odycUD=*CrOctlp0j{?plz=c)@1miVGgI4TdwTtfgnuCDM_TDO|T^y`>GC z)lOzr+$@gT>NGltF)nyi2;R{(h2Twc);iBGr(&&p~m6>YwL7!xnBWLVvnsXlf zPi=YF5$5H5l51umeWOAN%A~)_D`3%&1u*B`86TS^<7ynD5iy#T70oE?nQ62ReY5hg zkzuHuz0vA|;12j0(N^GH6TPdN6fv5DVqqGaRWG}MVCPzqnq#_9OM>k=XOkLdwl}Tm zYLuH$`NCLiN)iZrO6E!&-(JhP1SOFzy1i`T4he^8i2+#{D^n80%qI$68_vcs&P0wD z2uLDdH<;ph8jsO-ACJ>(cbG2cxz!j;0B_a{T$dQfX0nr*_8F>^Ud88bwUw7! zxY2`njRCnC4AmoedOf0uRSrV#qinuuZ_0TFrA2h5S`t!WMmd>|fzg(jc3KQws$yib zE|_AYo&m+7QKfo(B{9kgR9zp+Jfjcj^Z@i0h_w?rz1CPk44f=;@zxBSO3Q*Q;RY6k zxrBM!ZH&pfJOd?H1b0)lWy_*X6tVo6ZN?pN@lxZ(A~meU7wL3|;v8C@wq?U{G&Qlt zBoWWH)1As_)1Esx+gy+a92;4?noCSJNyrT8%WK!zn0Y)CV=~i598?<#Y<#M~xMVwJ z39($3QB~bVc{~io87mR%)HxG_*gd%UnMir|s}t`mR14Oe&ZI_`O;sA@T4y>PRI7Ola@x9Wsc5w%c~n}|hZ%j| z8uHazX)&l(%k?tk3=H$l)*R(%fMINllPcqu3Z)#|s&b6YNyKJK(QeM*3mH=rD5qsJ z^8vWlG8|@-Q>yIFz{dj4tL1Rq$|u#qY-;wM=mvZvT5S@QtEq7@MmrEh)QqMrf!~+} z%?I3GwOq24$EDP04zW^7(y0}}OiKf{N)9kVW8E@EN8Mr}=WvjKN0IIXBA~q`20BG_ z4RlZ|L*57Es!ZGok*Q}53DPs%tgbX6e_~b25jh)9aCHP(2me2NU*eQF(>(mIDH=v?z&I;?z;%6tP05CvAb3(BmuI9giQjdThIUg^-MA$K#s}5rLmqvFzGqEr>F0} z0(;tz(%mWF>72G+*Z;Jx+MiGPyX-yo5&t-@oDbnf{rp*PbnguLq4WBB zEe*bN&mZ&IAG@D!292xs{-B`dE*|viOR)rd}vR$jpytuuXRP@2|kYl{585 zFFfDuABi0W3~A?|tLLTM>F!nM;Q~(LtG<6e>JO#k!_U>~^Xb(+vPb7`I;R4hh(G!2 z@7KbynjKt&1)(L4{%D2cr_%ulOCLu+svmJo&~@v)r>J`2W4$hj-0)-R%SG-~x+$LJ z8=77?)WOGH6@MIn?=Gj7N8(-C*tVmSzOMc` zeJBmO?V~}dEgn^hyM-b+lFF|?MumIi2ke&4KK{rbe7tEF+r1G8#QF2wm(Mq&;`Qyt zd7)c9>i4pZ`|R)HC|BnpRL0nCJP*Xf>+`ET$cfpZR;Xt0KWD$ZYCQ_Ml5q5LtJfc@uobnlmmiH!H?R8lgX**J8HLt~a5LY2+&klcT=nn23{Dkr zu0ast9e;3qq#RXWOCK8t?H+&M%sl~B>@^_ZtWx=O{am;@J=f2Bbq(Oxz8pOrgTE{H z0^Iy8e{rhh&IYCH^Fn)c-G;wk9({WL@%!aR|HtJJ?A@oAmql==!y(!i4HQ;W_Z6Y=PPI5TbHUd?48O=;imC?@C+Lx zJoU3fP%f_F-yfsy5B=dsZWs6rTwD)_w=Jos-{eZ_P40KM(S6F@v_F0Z-|sOnjX(N9 z4I+d)xyxPQ^7q-N>$A?V1HO>lYy0>PY&z$i^UK{Y;_&8Ev3gU_!@Z$arG|Wi;@%*B zuKZamc1J(*gUg4rTMh7cKCIt>-L}*1l+Vtue~&t6$E~XLV^8dUEb}s$6MLtH{3oqh zKFwB#&-$nSP4-*|7m(V>>A!o!+rmxfsn{H3`OEv^GlcPcX{y7{Z*Upq0rC6c)5pWX!N<|j)6L=W-rafqRTN7Yd4omvs z`Tb44RA}E<%6u_bJu2r*`Q!WY;P`u|FzSGi`4M(Wd^paHPK|u70*7?)a0dowkeiC5 zs=<#g;C>ktpGuvJ^CMx{1E*VFDdcZPGK9#Kjthm_=qC5QTg*S?UM{P9;F~XwdZ)#F zb~yZeb^m;u{n0Jvdimyg@3gA|-#bRJj9a zvoiPu@A9Mb3y4VpmB0782iEONh}XQ&9}g<6>+G4LeO4}y4lV{~hf2Njaj$ipEhDb> znXi1g?-ni(4jcRD$GtzFB}Bh>`Mt`hE8Rfw?M3w{`|)fayf5v`_TBKcdkt}qz5VX@ z+nkhZH$l^Q0U77~xsorPf{o&{euGRNqX&Jz^h1+c5Oh)*Npk1r`u-|k;SM`s%P#1k ziHwYqlCM@igYUGH2W9tFg8+rs-v=Krz{YcUdYaE&JXelIp#=Vg3+dsa+>^NDtB;?= zW*blmF`0)TEsB?lQ28@FD zLE9JVPyF7;FGYwR1m92YdsEF08xoF_>{e@ko(Evtdu<*5{{8%Vko|J>di*6@|9JCy zbhX!p`&1|$e!j0g-=7}l21aR^>q^oK-}~G+A3^-j(+%+4-c1W)s6-G(cfZ5>+Ye_? z#dCgi2*UvH|8&L`J5?@sb}E%$?}7b6yczfT;`{T>%jNF9q+h)N&pnm$#p|59ul4?b zm*q3iSNHk)^w0e$|AiY2zko{i8>astDZ8g%uDhSAFW0~;q)PkdV)yw%&8p9(-1+wh zImaLMhCe=ng9}{0cRxg6?-%-)qbiDh0uS@eL$L>g{62a*Z02rG`>^N3#<2u4{KIMU zLCr%LPvOp}zJC8yL3V-X&t365j(hI$V!8bVg1!Vf4}ZT`u7{^z8Uq3RUI!39^eK0F z)BOG!&au#{1H9K9mptT$WjlGUOeQvk+>-mSLvnOzAKx}kD*Yn~{P5F4o z9evs>+`_&LA=pmpKNO$4+-v)(SZP7L?qTTxf~O9DT<77t;cxz+yU}|kxoMX-Ek6J93IQPJ z@MvrI=HNlzd&;(odJbYUi_M2WKmLgPc`JW>+0H(LObhgPmG72+S8of#@AEI*sJ##N zpj=^iQ@91^!)bQ^JJ>WD$_+%BTxi{WI73&t*Mo;b|FsH%nc(ocsN_GLzvN28Q*cs# zE`x&x8j9t<8lF994HR#WV(I(0 zeEIp)D4QQ<>j$6jU%B7fg~FLUN6nRQ2c0uxPy5n4%w6u6AVBwYuYdY_)&IVmf5?6+ zfqxBxra>?JQSK;U_HKhOHs85ZYsrg@e1j z>_a+N84&IJ(fD_bcFBQ{>;DvPU1E#(5BE|4RA8{mQi_fK~p!+gG*r;n8#L z_~GCde0hzJ+1_itH~RhuB1BR8$m#c5^QfpjeeZNS|NXCfVXqN~n$>vcG}(X8?7Mfo zM(Ht1TlLAun(UhG1qCH;q5irdYInSWgryLfZ>Xv($(ZcR94~H?|9d2w;qn`(<29+Q zv9Yy5K9Wza`A#_HO~-wZ(STWxXK<|;zlK6)2@=;ex|f_p*@pU{7bAPkOlcGbuIZij zBiy(}d=}NR2{Xk$?22awB>X-5rw^f$fbA^GKj-A^nEbu_x^_g*j=$CuW`$W?HuoF| z$SfVgc$6jaJ02y2X^RG+PIp#pvEb#^USCykJ$!T4?m2ZfY)Ag|OeU&tX%tWN*}LpW zHudb^gMNHAZ6e3^e!GUclj(*iY~M*h*;@fGN_e}vA}0X<3woF|>4H}bZ6F3cZl|bv z6yR|$?PI3yBlaT7f$uzT_w;QC)l9FSxu9Fw6!}~Or$e34Uaa?-nzeFNsd!xehi-af z7K=aww?gT|vS+U(zn;nAhyis3>-+RbUTG4T;a*`$!CZYr09!M%1US!5%fsF13{Z$aVaY7XMSZG z8mH)OQQIymyehy3{K`<$&D0jSgQCIM6aoVGC-@Bf%G?5ni@p-;?PX2=e)|jwJyz)` zJ^DIk0WE7usK6j^Y-18Z;_x$9j8dCrdP7Kh-BG#u6rAENdZ7qKLkfDJaWc%$2BsA1D5DY&i2+ zP=LS@Q4sh1lgA&t_BE5``cf8*j@h=FltxFU4yFwTKu!q)7siwlSeA9pwiF4hdUU$8+3RW9s`I1)tjbtT znUNBEhHPQ(hzqS(k0CF>gn?S0Q|SJyga+G!Axm&FL!zyrns!TUwL}Fz!SaM`58=_2 zquaUVTBra4sE{N~l$E8PWXucEUR~N;F^$%byg~G+-rL;`i)VA;$Vnp-^AfHbj=ePk zL$@2#IJcmp0{U0<04A}|2}4v6S6Be{)q&9;7;Kx)oVJo@{QmkXG?prO*|b)~DZ+8^ z1STAy<(~A^G4VDW6RB<5YfDqxbZVPUZPV|^7Fw@wSCg@YPD4s5?e;P&iz{w3rJ!(N7wF!*J z@uWqu*9D%Eg}dRxI={l0^h4U{LwW$_;601#`J1Gv`Quigq+SPdbF#d~xD9n&J)C19 zk$Wa{9S7Iwq5gY_$J0(lR0h4Eum=1f1!mx>Q%;w7is#Cz5)``pn7WRV&S{ya%O`z4v9i^_Lz$2Nu zj$)s))OD2RS;c1Q@5gl{^^HmL@0=rB9?-=e8$`@LNN9@N4b{aXk}@6 zAEJVI2|MhCNvB#fbSL8gBt9Z@$53Uz$n2mB*pnvq zq~00dpER*2_0FW;nKZE{P3%b%djc9T%ok^?UC2~&QgLg&~5%eT| zGc^p6sSqzns1^iQl5T7Ka7EM|Sq&@^E&)>2^+H3qG&I_#R^(jOm~S6KTW zb^A%bA%ut3t`ulq?JVBHRls4G>&0c?X_k>7`l&A}B$F&Z--{p{_eonLY%k!zQf7w$q4OrX(ZHVDpR(xP{B~ z)jw&-HBI46koeLR&NPK{hA`3~f!QDd9ZcLwh6q?`Itj!GINWO34xdO&!0k1HwFWT( zY3ax{3O$G&QLvJ({{D)jnNm47=ICr1ClibDie%0oXNa4#n%I6jn1k~=6JHS;gH~)= zd&RM5avf1%xi;K5ENp{lNbsliMJ6iYO*(h#)-e4FNzoBcQ37Lyl!X?b0;KJ-D$UR>6?y80%o&JKG? zntG=0fjAbQye6W!TSq#`B=BU6KPF5IWNHJNV;P_*7L7UOQ6y~|;xVZ%EZbzs<;m78 zM_{h`9!~ZYHPK^McAh^D*G}j3#e{WLMATi##;-%(W zeL&U5M+c@Ta9ZF|$IQM15#Gt#?PJqvM8@TA9LZOiDyEx76DrFIf`k@LQSxtvXm+-a zthESp8)Mg)jEqjlOcsvRfsk^a_riUqIY_fWh;0q7Nt;l^a36k-SB#1^!R{1AYkpp*-XeO(B zLzl)x#GKniG=CEAas9U@=_iSnYp(AQ(&uZfqOJ~4d**fnPsLuqfmjUvMUwU25B()0 zuch?oN`Izg#Ofla@m&_V3?MEfS=-!N+Q>_7#zRD7B%R5d@?>Z=6z{TWdtZp9JPkES zJ8P$*2K4Q}`h8hKjKe>wpd*F|D!_-GL?`9Q0HH$)n4B!*$kW`AlVsfe#R8g8aY;0Y z1#vvfG@E3V8w%NYVsh0|R0(Tg#)9-NO7EidE(%-hm=w26Jg?DFo_Jg*GFr&nY_OXf z@MNwj1la^k;I3EP8(p;33N^r^H^(nFj%!L zSh%!G{jG!vA5}+Oy1{T=s~yiRl5rw{F={5|Ou6J#9`;8_ng){SsYXq`Ma9^rsvNzV z`9OyFY-A}4$j(TQVU`|8d!9b}69X^6S&r&h(xH~>QJwFKJ3aludhI5z{?4SZbpB5v2JQGmdu5ATT&23(5%ZQ_LKhs zr87fNC18>N{gv6<+5MGaM1@yT9teEVY@BT$!&m?N%AC~mxpJd;UA@XRieH&u#z~{p zxWd1|@1^otg?SQR;2pfOUm5cc@TdRxGhfIxaz9C?-B|Z|e6-%qqSrCZtPS*}k*l2- z8?*3nV3`irCB7VHW-*B&n~vyuP=)^W|`7@6*nweb))v(>f`X>aZIR zvw#Ij2Ry#8h?%g~S#=vJXo4M$>vvg*U^E7L^!NKJVh|E1$A+YfKr3*P5}8YESW+he zAcop!c{p+%Rg*+L9vl?v76XJD3p3hK;^Qs=yYHibAOvsuVcRO8SxXEMK1VLlEUtMj zA_u1-3QX&TAzX&30+^PnJ_U`aBh|I#MnMRjL2vUz-EG6r*TaLLm%G5IP(&oUM51gK zSb;dWlsH!8_aS}_MLI_$0ZHNIfgr|aSOgB*x;QIygToqKq>3j7PU`i+@Rb-iU6ltO z7g98U!#-#5-NeA*I8*FrNera;+?Q1;xh?E*@`%%to1Z4?Am}7VfSL$4TtyTT0|=g4 zQ4yr)C;-K06ClU)>Oev9E_6^%vJSE3ZDjl&iZK9~R1pOLriJL^ zo1`S^$iW~)1|W45Rg3oiSeT2xh%t;fD;YzHu^f;mqpt&Ajqu?*Sfwe;1jY;A^z<{$oPrY4&$_ zqnDni=CPmvbv=6AN9Hiqe<=_|fzw&q zNPE7f`tRa}omBq~IF_mYyBI=D_21cjN%h|;m3o!b{F>?ON>rDp1TL2O85Ouv~Bru%}ds~F_VxF6ACdo>g zCS-lpxo_Ir$DN6;Lw}#N!dF`1E3NS5cb+oYKYcw5A=U;~T}_=e%k{D-p^?*d|H6`C zD}0&kBZt5;r!R1SNTA3`zRB@!{mxP4Neskn!Er7PMTHI+eN`_!RXoV)3jw`&-85xj zZ-arQC0Q0-lEtg6%4(xH$Ma&}SkrntxL7fdIcWB`9=>%9<>F_JIP|YA4Y6%WhOxG3 zNPk5t?o2D-cmeh;iz?)VDUD;TpQpH_U25CZ&5T8hY2&20z9zOskhI)>Px)1#Ohaa_Exv+ce3Dx=G3~xHBwbTNCMNdU-t`RO&Ssnpx|6^rV>Vp=H zTtW!rr3TkQAiyr_Za~Ob zxR`+naiH+shJ?NbT-3x4JOxj@4m6R>6^)v=>snZ2gOLaJ27}YAmjG8bUqY}4xRw|E z;%NG1wrdgvv(A^jC-~eEYOp>aHOHLqQ05f)9`ML@@V;WAu>Qtdi;`MBGGX&q3k*Rk zrUOv{%ar-NITn6?*vFX0c&oI53t6E+R~k6_u_DL||WM9;}46_~&r90J}$RVr-MnY)PrAwsiv#UezTFkufc?ycvV z_#~mzr3m6P<_L&|USl>qi7vpk9a2(@=m}4gsY51H|A)5}1WQI*TvYkw z$iWbTL#Q0fS;|Ui77;f>BP{zoM?hdOOV_PILA{=Pc;@c0ZY%{b@*P z&iIjMZ+ov%&-V~H&XELT~nQ2(+JRE#jC!d#p&vfkN(GaoR zdk!%3^6%j>@DQncFSg;I6zYxMHY0WKr5zVi_Z~SWse3PV@4aXD9{NcgbE#u4bS0{Rs^F=I zG4(K}g1*Op5=Sntkc66_KOy1}LVh0u(gpL&$n)2+n(&kmIYzsO6^E|uHV=5 zxK$}!oeF5Qs5SBhMQs3%GS`zl~FdHA>$0a#5Q0GNCqc~oA#$7!zglpbu z#)`SLUUs^=$;*}$-~;1HQt<0ud*J$#)npF?J@$h`_&`A0NjboVx}m zjep`g;-wFDk!KuC$(3ZRzfaLOc^f4pc)p7M=r`Jy1A4!C+nnUtq8 zKgDNQ5t??*O1mownRy~OMF`I zCO6SGM6uxjvx3J74 zfVG3ut`Ix5{-$U5clW-S1d|0+$?6MwjtsJc61M+ul5LZNc}sONCdp{F9>&xal_7g# z@rhZH({fqhyfMGsb&n?t?_|PUrITBgv61hBPIDL@Z-zY=YgepmZ$fO}aD8EW z>Wn*y1fR}n+}Wp|#31?&IrDJn;dmSR_WmU7tTQncDHju&s+%8nrW02;vJ+Xz_?3xo z;2ksdb;EHzjJe#M*vgu_m+MRTZRbi{Xxeo_?CgphN8I_x4gc*ph`k+NizK%VhT^L2 zkten#1td(Q_yIVR7YcZDa)=q~7ScBYw&B2U8xGvw_M8cZM7HGTGCP?r&rpz8)WDbAM0qWpm8 zMbswRUE3s&6&2jm+w~#AHdJ|PQz5TiH*&`Ev-3j!w7m=e>|r6NEvuvPG~6y^pNn}9 zi4c=Q1m#6MUf-C^eI4}neO56Y|M3lRa4&W`{*$x!kR`mEl@uQK*FVqIo-43{@y!5S zr3+l%+Zh58xcz|<5T-!YggL`=vfKi}lO1SSt^W2Gl?cgO-!?UQ^TWTHh}K<{!x20I zd)X9GBZSXnqkk)UyHy6PaNeY8`8vw-!;yJ)z`cm^vB07)EhE=52z`H|QiDTek5b zIgEQ_B{s&-RE-rmzRQ-XtW_t6?T7}8vnW}?GDa*L{f#8BZB|l3;LsNOA{o^_!#H-Z zPjmY%e`I2~ErP&-Gy`^<1q%>hflf-D$3^9P^^A2G{81B;eN7;<_rI3jlSmikt`MzV z%u4;l=!*7Sdy^U*7X-k;>Sk$m15pY3zYqR{cs)mDypEPd`B*I#}6QADT z7pd9j%%yCO6T~k=@y$T~86sqD`Z~q?5qz75Vka|a)WJBZBK5{Mtcu@6hQEpJ^XN3qIjFgxrpU@eaU`@LQ%;{$n7sW;fG68xvqY*d>K%&}|5 zdbLun7x4%C3HuZN1;)Vt|34lX?zbV72s^|AbPh5>T!n8Db7Tv-M$Y_Dxz3f!(dT@2 zQz$QX#%RRo^F@^n?W=ELb4K5mbJxY_^Db2x>k^v#%u7|uIbA^v6spLnhyse^MTI=) zKDnzLe0|%zDzo)`u8elL*eIcmrJ8YBG)_yE`Lls?v4O^kj_w7_G0yZ%Cmo(qsW5+n zECh&}vHM5*TZHH(nT*#4(8x2?vdm+QwTLoYtikJ`mJp|Gol=`sR3aR+ZFPVHglKN( zsCJ5o(m*uZg`133RvBx(3|=p;O@#Edf0z?+?W;=XEA#EI1koKJhEXXM__SDm-FO5W zBLVZv+p3*l9nCn@^$amby5)Qdq%lkzfyaVMP*&;7nu>pbc?B9|94{o!+vq5aVU&R^ z(>(b&f1-%Pa>&UpwWC_fk*++s@ux3vf&%s2khY#sOe9n}*_nPl&gxh(6)hUmP-ycI zy@|**+9{-|2(L5dHqe`mCQV0Q1_2<5G0JQ+Os_ zptc#?wr$(C^TxJq+eyc^ZQHhOv%8aYoXNNU*)wx8N9(Yzy6R-r{fL4RGEGrbY@2g6 z_@Z4734LyO>711AQ(lJXuQ`4-aRM?%*uSIhJUky9jrTcUQD)NYd48|uo=LuEF!E|L zEhrLKy@*TMls6efUKIbRow>()F+AvgDYR9``mp&fcnvgv_iNF4#;f>^;qU~PEStwy2gjx5k8c%!IKLn7J7;D zaZ^i{xtEdHyrs~8Ykj;~L<%7(40{xMJ+H8s-4I23t&R0bmZ%79)U_L-@(vs9*)|*u z4Wc!=bcXpG*_x8gX*Marv%s`nX`F%aoIz382EVgvhyIY4Z(Y52@u|l4bH;L7cYc^v z`p)TN;$o(nO(_@|K=>fl)iA5viY8LuQ49%ZW>s z70f_U7pmzgr0I*NnFzs8*Eb+1Qyto4?~il*%}#( zlss9-EE!?4M8f}elbZ27QwI4Gt^1~&7Wwo%m;C9=As6&rm&guBVS%EZAwOS7_32w- z_c}3A#h`~SA4$^{2$Q$O^Y>Q%Sy6xLPdWV#uI5o%b8Rre>!n`rT~j{bH-dziT_eb> zGChXk$fDv9QP!BKZHOBe8)FX|LO2u*R`;~utpXPBu%=)E#}ozvM$bDU5k&gfLGB;v zk|e-YFMZ}c_O5{H(_>|lLTHdB&022J?oVA94VPi2WH=c=>0UPYyw*tE=uXMdu{zi! zNi_E&Qi1(>#;%ytSiY;+AqNKr+04?qy?WZj$`vEhk0OJ#8fR4qfck$R;&=vFEi zmRoiXtBRLnlLD2zm!N}YGI*lpUW<)xr<$QVb>S%>XWb05jMnYWZ*MOw;8~aH@MpE? z>%E9^_LceavXS6;ohUyGRXof|#c8^|$rGeW*qAaEZMe@Z+u5+QrBb^GI*Q*?gI`?1 znUqJiMqwSf#Hi(32wyogg1sQtl4Vhoa1dQZ`52qE0l!b#kXw}5N}I=1a2J8@b*cD+ z)UFtmBxQk(V?(j2F=!pC@g2u=h^Rb-j$48dbe?(XX9A8e#L*9Kr(z-nXfW%p*um^( zZVTCaRm|!)vM0*!^5BQs3>ErwdE5N$^?1iE2?fQCYK+g$Z4N*^vu?)^vWjJxIhxBj zQf2N}Rd{R(Yez{blmu`wZ2m+a6aL}?cJ)CD6;lpLY_(4@$$_0Zgd1|rammC#!5PM| z&21w?@0pIg&_^qzvqRPg7WloVG25#)#Zb!H5*fZj`3=s{qf9f2Sfh8Nt_;1onz%I9VxM#bK;S`app4xNOwMStl=EHQfpi=jTR;rL|5 zkS}NxBM)&fdiQjbiEkwMQ&-c%N`7-GFg0WCJOr}`^pfn-LxA2#{>-!SKL?A5~0RdLx|&5E_E1zUY97A8YtE0)Gig8iSl znz=`+cikL^4SCzsP|=k)kpK5EOiQnq&S!;`^d{?er^%(J;h{up2R$pNrvsX)8){ep zR<}Q$*T3!ks4-r9&*4#E;RY+~re+ZOAf_*p+W>T_nCkWKsS%$;aJf>H`89Ec<8jDW3pV^NG)9-CLQ_W?#?Hnlm73p$l6szAi~FO;xIX^Od9cVy%tD1s+jOxzWAC4 z{aVQ~*LqMPXmw<#mye~<2NZ)26JV6@G+XDu)2^0G`?Yc(Eg?!%St8WerzDk~&c1M{7UVp;9d|l&H#6^FS%DJfA zRwvfyqv7K%u3`#2V3!BAk9mYwe_dfD)gB1kaay$Sdqe)x^#Y%pZhDZp(A_#X&9Wq5Gb@0%(HKZO*L3<*I}f!1?!_$>9nc)|}JUuQVH z4pb}%l;B(EhcZ!kX^#FugAyQ^l1pb;H@%F%=KZu=bmyW5NzYYXvYKzxD5Y}B`X&NQt$KAixt`@#Db%bn_HKgoiFFu@EQ0RXD=aOx%ZT z276#3r=9}c&gVlKIpO93jzvnmFz*01k7GcoK7%y43X*k=e{fSLc!_~@lEezGne{k_ zB%FEr5yL{c`9YK83kbX$4VEp$s=rzd^{pq zcyREzA<+&!pKV;isV2^|AYf}FIu%K8#x>M zOKOrsSn${6vnDcb!@ru6WNIz0b;c0M3N3 zgJ3+ffz;Jr?8;es>1s81wKdbiK;yU%FV(tSItQclY%Im6iaSA~I@B3d%}Q8rYzmvB zq`%76pk%@`H2Ex>8>@Anp7ILEohdYC&3~ufH+$@4M)dAwLA~h|sV77iUU|%8Fio+3 zgtRI*X19d2a;i{PRoOt=MU~UHVYN4%y9n=`T04Z7QAENNxyv#u;ZIJX2JQ!Wtu~!6 zvwLvRr<=ITJX;yd-JFH(H>)mG{BfNJ1A2OkI+*Zfn1e>*GJHdkF0CdMVLP?~MHBq!=SwP! zgm~OgYlv- zxf;MEjU0OXu&_?_9e-;Ebf(Q|j{k++Zo4XQTfDj&lnLpKMocjg91Xp5!uTkF(Z^Sl zaX>!f4xatA@=w_a>2OF`PR59+=y3RvdrZHxrl)jNL{5v0XCZH(b1Dr$pFriw1{YW! zd!{MqS!GOh)30z-dZFZ(14XH@D-LiS)-twSI-h)8IZDVn5C_(R1{IVP`WV>&Q>a_5 z^auWN)*=s^{iV?1vIV1@-7PL6m9=7l2$3ckE zAL1M4Bd}LKoLNbv5Em@8OfD11ytv z)a}Kk9<}?d^fb0Jpvfyaiu$McKgayf(IfxcbZsN2#q!8{&i@@{@}@~ucx03SaMY_=cR5dVr%r@6B>EmNHtyc$vCCfeGGa(VPdP$4$9qnFh>4X%DC9=GgYLo`OPA4mtL}p)K*kMp}{98 zBd8EO&2dWN<7~pN=cZU3XhUPC?~p*qNS^H@wdh<@7iyE9rz?!e%cH{@dh8IW8XA>? z5uKWFYSNNY2=15ZivOyzzR>u2H8l64H22WaO*%3tLZeCsF|G4{=IQP%bo?!$Oh{Wq z4L2wShawwGlsaQLJCo$7GYZH-=Drnpg)@MY zk2cC<#{^b?-Ep5_W&~voq-p2`;u2<@zixBK?aKo>t#C6@S3L$tcDVD2-})jhLwsLf zQ{D@F&k7_6BwJ%yen`LhY>eOBQxgE2`{Qu!+8iu2gpORaS|vQ`EnkMl0G$dAuE@tT z4WB(hHY4ss&?6TEP{wLAmTw3JRE0GQ_(QU8i=k-$?Abp1zhGlDy@{g^S_Tcyo_~JOdTmr@-l9nV8E)Nuuh+gIE;w^>Vu(faxebl}rS4<`F%R2mtBEmW*~D1+#3qDAj`-Qv zo(CMusbE559NY*c{&?JcXY`&vz3}!IIdw7NeSU98n?%E~Tl6=Ht+BnidRd(J6ClvE zPCCA`=8X0`v)~>mg}ncI8`RS=BUdj6olE17NKU$d!nsh!aeibM0f+k`K_7;WpIGRz zPQ9n4Eo^!OhBM^+Jwpb8jm&+<*s4La3paZ?9C(+Y-MzoFWP4JHZ6=neXA+uko&9bZ zp6T!$R1(7Y8@W*<_H9-9ln8_VxYP}nGF$ zWV_V#(^@JwK{iB>hC2*xHE3Lj=P|7?iIm|^2bzH#7ZnMTfZPTr9T&HYoNH}RBqZ3Q zna@8YD9hvFInZG_$yTjHp-H zEEVz3$I%!4Lv{+l1;fZ(j*~9{wjwcaci>k>L15BEtG|@-3j%{s1;1)MF|0@4fu4k+ z&GkzsXFQ)o&10IlB$9Rav*eP9*hZtb^@=x=3C~-REmP7s4e~(hk25K1_T-ZoS;*vH zq<^@(3LWPUW;1rkF6XDruHvHrH|jD($jd|i;utY~6yC3QS-Y{#=&2gSrND*H$OQk; znHM1H+4}1VJ)u>s#ldt+`KY_j^!6sWS;IaycY>8t&B;!yeCS7qjmb z1};=*Cn@T%7la*sh$W84JaRB91yCTJ>N<9^@@4A4)_W0i55F8hiZyDh!vqgk1%t?7 zyb1s}@DMMnoidCTzVrs5Z2vEa3Wk%5rABxC&k5qwfd4q~gdkcK(-=*vv65Mfmvy-kHRb%>y< zBpF@f3=(c^-g*!Q5@ba}iXB@x#Fi)&-w)#D5@A)K*OYfV1O`sqnrIW$4Qn2&G#uN7 z0teoX%-V8BF|4NE!o>Hyh>(mrW3PcaGdIXH!L;6XvI;x-c*0pTe!KD3^G+Z!_W^(FW&`Hgq` zogrLd=AVPVyaSxROGksVfRlH9L+DUndyK@UC!ZqD#bmZh+P*R=rFWZTqHucBOrNQm zH}HK!F-yIsX`jYl-Ayej0nehxEyyFlbuWN~@Jh)wm@a^V;x$Ih(jCpewqL#`zSs7I z+peLPg8fIoAm`L~yo>yr%Wm?2glXx=kwn|c?sS3R+ZKSNhcfcSffDk8>6@JW+h8WQ zHjGY*hbYwX34Kftl+`9Bc|3^4Z1M{b-ncIyh?fZ-uNh`X)5%2(8d&c>hHnTBU@~5> zumP!yF0d`Y^jZ`VCGc0(HypjtDuEv{`_A3&TQAFbgcnW8^x^lS5cJ(_GrJi>K9}Z? z3jJDC-o#C>-?_wFBVAc^os)y5TE|RBhtxMVlLt^DMw7HCgO~^V9hkt$j?u(3d9Fhq;o$s5 zOfd%|`FGct@Vn5a;jTp>#VP6*in&^-*W8<<8PPN5+x{{9%p%&Jh}XC>3bbFO@Z1MJNXc(j*$pAvAx<85Iq5=2~Qc3I(*J9;wZ^&&&aAmiPvo>qqDRr6fm`md0w*=Dz35l==f};xBw)Gg%26J0o zxWFGxWnoyy04Pu1(D66$tI%Gb-HFXuW2c>|wCiyMTWrPQTflQ?t}uCa8kxvwr;213 z&s}r00Y#7xR$>JB3LDF-{M?>s+Jk)>mUzV(kMagYhs^pg4`G=zMs(u80Ie6g0 zBEt%%P;AXyT2KkTHI}u;aO-8VZZDq);>5OEJ!DHr^td58h4pPvHG8@H;g%sb`=@yt zVGNo=7N{yzKtR&lr;y>G*?k)bCSB|Pw0CYRY=Fw_m_-2=H%3ZoKgvn$NzF-19(A^F z^Iec?ichF>%#0d)4jvitn24V1L&^8kwn4;*2o2ZSqBJ{)z=u!LZGe1douE}H4LXPU zf@%E|-JV@X{xFMWf)R`6UyHv~JCH77H6M&+N0d0$uepV1P7eIWw`dOjG zQ(t^BX*O}MX)ab$q9Dn@+snKP{t{BZj@ZVy{}L$Z*%i6SkJ zbsZr@^6!6L5k*91m#JDV=Vt}|#P>6LcXxM%zL1LDC3k4R`c^`YA$_BGBOzu`Al23v z+NEZMn*~nPf%^)Cym~X|F|VIAJ$8NB!c=%srE`9_bdxd8HvC1ha5NY8VMzVoqEIN>a8;P9+ zO@9J*Y|sn85AGTywL2abEO>7{K%rQFg#$4PeT@`lNJ+xN-hu!pJ0kK44sW+TjciOT z8Hg={=c+L-mWMClM#G9dHH9?GjEnlun`P^p0lU@9e4OB`iRTTkxZ%~FK|C6%41)H( z4G!)Jw#7spRs$Vw-Rd&5EkS;?p!z5DOsSaSNGTLgYKHha8yOk-97 zsfLyNN;=8K1e2*j_JyY7b7!W&;xh;ZBC9YK{x$68GlhRKR=@A|z^6p-IT4qkzMiq6 za`;sBpJ+^<6=mVEw_rE?YxSRS5Ef!zgH0^K?-}WqcskAQ_62slz;@r6cH& zily$YsgPHHW|`4unKXXC;J8aPCi~_a*E{rRN~FE)LZC8-tRcM5(xQ*hmFC(f=9@Hv%)C~az5~E0Bps4VSk`RSF$yT3rNJc zs4_YnD&$CskeCx{CV0ljrEL|tE98NCxo{ZkLLJc?2vceAZVir1f|GemmEjOF>(C#F2XW#(#fV$L3gx3o}J59RAK zHFGY$Y8zIg;tHXX$3V47t*aU!Gsf@{*47|87II;O%GXfl+8HYmFLXBQ%@R^?)s-F! zleMTKIPKg#xYF1CX3LQA<0+wM*ayT@vVtw}5#x-mT%%sOP_ziDD@coW(u(O^IdxTK ztnB~5T@>aIxSJJPsjx-*n+K|@1_sfnQ?@x#KN4D1L~+QMaH?2p@91byH*vQSEs&L2 zX?!JT2BpDW@y=D`Hi>GRA%g|8J5Fs#%aSXB>3Um7GoM_tCnhTquuIw)I6>4I(3+Cd zd4-9ZczK5#>=rG3X+9|vI?N>OSJXg)KD3KJ2#v)O4w5anx3ZX*k2_e^Pu;8VWYa3z zpMIuTz$)&!MZAlNK{Cp+hfpU$^6F_nxW?CI>uh1wp{XT+{Fg!0F+qyrw^&8&lm|gV zUk>mjbt?He0MRLmF0qf|mmnofwpl7Qqb!50A^iniMnvtR_+R(vZ8cOZPm>{i&0T1>o6e+oRFUcr>P{LE|f?`CIvL-AZ6X(6S#$R)A7+eeelYbD`Ge$S?MuM#gYL?SE=Y@CHvYmf% zJ0sl>eL`c27ng1w#45=F8|_8&;rXvlUBSKUvkg0>z@cM7pLSwUWKq}L>DHFn((+3R zFCv$UPrhnh@F_Dq$tWUuFh%q9K1Asqo|j{)eMzq%wP|>hDlfOb#USWDtEp=QR8=?_ z<(>nwxqNb1EJZth3&AG)^u|U7!!g#s!IieP9O>?|=+``ejib{7{PHGj`~@OM_b@r; zQFcgi@E)nMar7KV>Wh<5mG$8ml_`1dt*m&*5GeS{JxRQrQ?Mc!%FTmlxFk*FX*+WW z#uKV9YNmpV`f&Uxi%PfWV+l`NEtBUC+^2E+hAU+!z*u9ceto<}&$x^i+v;8r)l?D> z_aeE6J3W*AOu)iTtw51~m(UuLB;>;T}W-zmtanA5|8hyo%UM8UC*c&PSRJA<@CtPgBDrqp!M)~+~I}v!!`2i#=K?x1r6@4*@iW#Sd|B{U;+`WvKq>LPQz^LChO@6BlJ*lS90j98Gq?<9lj zckj2AF~V$nBn8=2ZL9P9Ar#+hQ#)%Z`I8q89Mo8KLz?6-A83RI&BlGl3InzM7zE{U zXRhoq{HnLcj_2ckyO0wXP;0MP2k;xqf@p_~zVmOL&*;s4U0!QNs<1b`^LA_DvzF4W zPZ#YT`;JC5z||95^GhGXIhA(cSu?V5V*J>v<(?tBRaROIF$EV`6p73BnXb~3-81fngFO(fR8*3f0p>ejm z+li{JNyfHgj^7@^%NPgML9E<*`5N6d67+qj6}ilaOw9sSh2{=^oZHx$ zxC%+jovXGmlAdGa5WL|MObewqCzXAMNUt2Lm-7X^C*p|D1M5CT(hM)ND1Sz(2O2^B zXiHvK{2%m27wi+pTC9p*rw|TwGd|IqMfV4Ea324+{zZzqs_&o@9;*bkvUmRRsNJ8D zwvq`Zw;gD%?PIiqco2$^98@jbl^@#?N32Ch(4zRmY?RUj$w_o4N4XVr5VRj@hrL906#JvLudG?4oh+!X0!5ON^FDlc zTJfA7c-l0c=xP3Ykc?~Dc=o&d|1~Bp5Jy%dB{e# zQLm_b9oR9oImwOCCX7$y@-8A=nTwHxKQHXU6th_&2SUlMA1$!R|S1S`5tE92juD2^p&4L%;~kZNoMVQT7p< zca0-q@J*TBI<}FC7vlU>1_o8;MOaEZtaIk-a9q$19I-&W#_arq!05+yPX7r+-Eo)* z@+bdkx%Kh@@=)I;Ak_t$OGs8YiJk4YU;;?!_W&hEz6eS>JKd=CZR#T zv{klfvT(71%Z&W(ZcpLn4kgBsk$7gdRtpfL8C6%wn51+X0%0evV8anu^9DXKHidix zvAG6g%|6=@34SG00TEZo#RLZL25WLE|Hr%vP|qs?h=6hW-!;uN|Gu$!@10 zhVv((c^%8B0!+bEhzmtCU$KFH=OW~htSb-{oeJ4U`uB<7^%SW}GqqS-$wzHwE|fhXKdDjD}rV zR53XWY3j-G=HjbHf%IlGtvP({&WGI#`$?L!$$u}ztl}^>hdQ|+$gl`W*9{>zxhmBE7_h)rQ(x^K?O%1PqhQXcYTGV}}Kw$~^PZqbbk4#;2>j>m<&mIT6)>i*CK zw!3f#Ha%5u6l`o*1|)RDcNO}}iKKc9y>DPZQEUt)`^X;Hm2S)?-1fqBY!^{ptQ(Z< zUUN#sL$@kqhR{AzSePrw)vVTyz{MGvQEJ&42wG5I6FV9_D$VE>QN0;Za#T@01ED;7ObXY#KJmrI=s>5eDIvmTarl-qEjs^gf!1dJa0?Hw`w0vTstOdd>>*H zYhyZ#-vX?36{O+-?jZ3Z9-HWk?mpGk+ei%qoW?wWQ^;fil@V&$>Lrb8ryND}+Hkjt z_WUQuXc>>yF~zj_;(=#J>qyY7VwdK%=~#mfW7ICf1_k%xhyyd$k+& zYg4YpKMGf<^qVzGy@$Wh$Y8=vh7crTdE6ol99|9|aNRa^gFW4G6JUpzKph)ofzatt zM~t&rZA0bKy*r>cfjQr|b}~vC<&fGtt0@iye)I6D>Bii>M9(AD7evsWWd$J#Y-MA9 zh6=;#D&^p1fD8WB1|ngIL1eSA12L`j1k|8UzZyqQDFhXXO34Y%6>2J1_7;3S5SQ{Y zu66xk*~@g39qB2?qb={sQ9))!XI|GD897m)HkI*PuKCnSMY9-EsfQ&HY%&Ahp9g&&`5PA0 zJ+FgLu}8r|_$vMcxddHgUIi2Io{n)oq z3OYx4vaw{gvME`Z*_>Pd8khJmco`dN?eXdgfaRp%6(x&SI-%d!$yE{$-eLcKpB={* zT=uM}Yd%=1!L+$iKkaFOalQe`)*h$GT1bW$T=Y!-@c6>-98!$+R(V8?=Ex+=wJ)S> zAd=0l{!8wJyIoRD+FB>CvyS)PtnJQTUdY2IF@Q(G|Vj6k` zHv%!D)`+4KXDrpSf!jh-t=Yhb(_ft>4(j9~xOLs4S94Z4GLjN%)vaHfPlT5S%NhMI zj$9X`vggbG)Ga+@`gL>{vg=SoCma!74QEdB4vwVtIbTAXa6CalEZWny0h^rVbR`cS ztuenrFtguqJoJ-Rp37SIsOOk0#7@LC%C=5oNh>9$*5fz*rw0S_{G8pi8&?!h4*QAG zK>doD^35^PHEA0qHRybj7j#ajS6EQ^j9e6&B|e8Jc@$l$Qk=}NX|>p#rk29m6yIA{ zI3i;#p)nTu43jg5tT8tIBMMX)ldwzaivjUpi>N(a&)yB=NXITqI%YY|+|Gy=i2VZLJxiK6GvAkH9`L>{R~p4GW%4{&=H52?-@7#$HErq(OoGCs98? zpn`C;N*JQU-8pfdL}kgAg0R zy^8m0*i;P=JE73GgGHSRAd6tcCKMkaYyehW<02Hbvuv%%NiAEG9td6Q;~D46<&}wv zgZS7K9m$I8WrkT`){?x6BdQd+)<%y+X(mUo2qv)9r{C|*-3hOIcElHa?&G#4C%0Lfx)wV7l(>1hPcg=^wl)!PSWFp`8p`bXAbb0J^Z8^9Uv$c+mFCEYYa z{UJ8lrQ7PQK9%}cJRr{ZPvc}gNVlO_C4T}19toU)Zcby21mtlT;0)6?Usx5+A*ZqG z(pw3mEXeteM_NZ_35E_{LNtZBZ1?TqG^Uax8>>-7tT8J~q$qr1bc49!8jVrvsmw5% zwm5t_o$R?+c?T1BB6#S&%D`zQb$dmv&{GjcTr##y(eb2XM%Ha$6HXS1wNk;>_=9)> zszJLah{Y~&Z{Z-F;-H(IZ4-pJ2~0#1+w9ArFbNU038fZmvfTm0pzxozcr;ewT-@8U zd;qYjqQg(Kn6)`;oYzNyP|aV7{)&exLv3L|1X#E`?xBYwXkrz(IB7UlrqE(@UeOsq zEI|_%)fuywM5)KNrXn@)$ijHEV!yeBtVVOy8zsYKLt{xKl$euPMK}ZNBj|b2L!UHp z?^%rf0=4bK?C_(3ytZVec>ym1fbniuT1eM(ZTld7~y#ewov zOI<%i9~iA(Rakv0#@!R;J+unV8r55{_#x)c6{YB_1t|s1)j)}QIRUv0FDFA77venq zm+}xac7yIo*vU_?O(T_SvIt^AdMq*t2ZJ}tm>7se<&{+H0hT7U+0ZD-WeNvMJOu~? zR8R^udLhX%%f6}dC6?YjU|vlNy<0eeZw}H-dCtmkC40RayWqGlnuL|k`&k%*9<-SR z?y8e#yC!vG4K{{EZ)0}*6H(U0)HI~#)cZJK29<@|GI+v%lpF|CbG$voQGh0_3=3J&1w?EgUX9<|?3I zz5-jaAO2r+#Zn3bj`#Dn0bU02Pktl03P^TqXW}GezoJ zH=gCHM$#YGHx+TmPl&SE>}Ep2ai^^l02$FN$a=_@iQ=S3T8mcTtI-?v%C9G zs|kt>m;oEE#rF8aPu=X7io&lb;31qUjRM)BbAvHxhMlm0FvS0jcd+N!Khm0ff`2`K z`=1Ge&VIU<5Nc%xn4?>T`Uihb@|BEBf(XVyFpbZ~Lkck4%y!CwP|98w+1h7r+cF$T zA|A_6%AfgPhwCwGARwTEM6cu=_ze3Asv{^GdaM#A^^L>;I1}O zU=kt%?eV*y!pW%=o?IX(_26SPQfVUUz{!=bVk6LpURv{|rV}^^BO!AQR`dl+6`YG+ z-4BL9P0~YeI<*NYJOubbbl2_g!oT5=gMW!P;eXhTBLd(bl@a=Ci73H)4RFPO@juL#^b5BTBXyg zf0YkBUne>EIy-e|Km^B$mmX+>k00%LkSU6s1Wt~m(cB0nvxGEJD-u-nimD0&dqmSR zwl#}6BSRJkG`gMPm%a%-)Lud-N+6O0v>1b`S{Qhk0kB<)9}4@g=Esbg325drE?J?k zL@=)PDq#k~oO%X0p*-coG}SE?3!o$8N7&5RVniaQ_@C((Q>?IwsR~rWYBIX1JlBw< z|812j{ArbH{{Oa0%|hPUZVy)e*D6IH?N9-*j_aCcgMi@#y3V5LEkgIQ0(>+M>?a;=rm@Wt`+#AoRd$$3OM`~lXXoM-CS!JY3y4tc^o}|(% z(Op*(qdAXF-n}KXTa; zz^ovPCbM#qt!>dCq5%_^8`W%x?w?%bo1tgfK_>~;|0gA4*(g=rdRNL%!2;yY7*e7ANptPYS z42U}fMdee+lhyr=T8jbrqJYHUGL%SPAfl_%S{aj0=u(Vw_R~YoD7iVT;ubs7jp7St zjz@onA!1CzEbYc{jC`4`EwC*eyKPB$+zVeq20#<@?0k%4E#|XRhsXFYKN(qb2R-B_ z0WAk`qcD^gDZg|Y!)*DVRUgh=3OdPFamT=#eyr3Aeo$@?^1g5rSdjLm*9L0N!(R`< zr!U1VsGZDhyW);3BsU0E$b*=0nw!7?Xm7oYss$!Or@iSula(Ktq7%#;T z?syL;zc$}B8uY7vtGD~g(axBP*f;-+MR4m9tx+dpjFvK zJ8W^$M~Znri(8kXw0rEYP`}Cg#D0l;ovl$yEMY^n8INh20NKC|;^Hn1t_{3GOr^J9`q*6mKuZ8u=6S?VN z$_#nRMKV=vch5Z4d1l{IY9v`=Zmm1hLX!!r!T4pLsqZ|_a60}GeuQu+$iO{G-6IR4 z)0z1?#AprzGmadQDJow6cp@-F|3ZW*x?L2Tw+V-!h^!ba+S@V|YLVNbxWI3Nj^6P| z5hY6#$Efe*fPn#!*Pc+)>8U=grM!73@f_k!TPo6eMrp-<%&6QqIdX`F`SXxjXR1qX zha?&wy(EB}A3JTTx0W+rcww&eSz!#Xw(0AaC;dWKknZjKRZ1gWI@(ZA+{vP*B`ae` z^*Gy#x?191P3 z?%Wy<=0#n-9)%Kb#+rH#!E zLF28qxsDy&L`js?(j8?_wOdo5FoOh{#)b&%UWb&bQs}{LWaEj5_U|soyW+Q*rH*jE zlc?gFPY@MPcT`0<-HA&P6(=fG3-{(^S=na0rJtt_2{&N47NA`vk^}v}0xA~O>30}U z^{90dFmaAaio3PMUG#X82{7s9i+<9}cNH$*Fpr0uT=a>Bit(~@2^Je6f`(mER7kDP zp5^k5O0B+JF$7PfQoC+mg$@^;fRnPrW!z=A&8sq-uQbb%$T(3-O30^^5HTebZ0H$uEQs+_zj#WSvh1p`TK39E$CSXCBmC@D_e zeo`C4TeKmVcP^sHWVI{204=5NYiNMKxdg^exEIs>y2DFRc==I{!iU)tBRQD zMWs^T&3qAa`zb}uiq<9pw-J~Es#hg^>!3yHK?UcTJYqW zjf;ssJn89LBYZV$xkjlHS#eJ};zDqi9a=1RU${5&LIRS!8EZ1Q^k^r+KU+y6gSjs3h9Z& zXJVKs=GO-EVAgLmBm49x;H6k!AFL-Bk&U6IxL*g{ClRfU0j20(2XrSA$&DeU_+A9Q zU#&iRA?kcs*wAk6IA}BpMtBRPr za$3%LMR9X;&Z3GsX)TQv#n1BVYp+aY?X>dpn=7Ubv=u|1vcaUKm)(BS(#vnL^m3z? z%U_nt=j?T{aZyP-&aCFOjr;i)if7Bcy03Dl#Vd9%?V-7LRW41;#S61fyPqx(a|bEr z*6z$4NhylKrOi7UpiIb&QksWfH#I!*&2BL0=!uFkHbkRiWK;)7l`e{Udydcw6bt7wm=k3ToY&y|FY$4peV z}K0)R>P#7^?eVpq*2K48IEjfMwa}if@lfP z`J1E|n=Ms%+1#jdnl7?e+(6;GY@O#6a_lMt1ITXU!~cG6)JxaZt0G$~Hk!5a#v^=F zE7q%(a=nN@lp4ir_Nr8G*q`t(*a*Mz_#v|ZcHzOttN*{fYh7v_xx%l~(f%-0VGGR6 zZtc{B;00#JnE@QzFxh1&m#`XJL6%%<8P?gPD$kNf%ai1Ex4JD^_ls>{Ts5_|7JWIl zK7IN-N3E8wJAIq7RfYdZngtWWbhTNRvY_zVBe1Mr5saqtmUT%7l#&u*NWL`3(dI=L z^6fgTOz6L~k)44rrssATnQnsZ&ep0jTNPKrt1zli2)ZKg#l5|Zv9|6j&Cr$n-9@kw5teXN( zSK$rg-0WsOAY=TmqMO4x9F+SgV ztJOZA{aU78C!gR8R}~e${Iw*Vd76KJ^*5Q9(PghsKPKFIMoSy^>dUL{$#e2H>>iXa zmmk{~YanW)wNn|!RYWkg+D#{KvF?gZ;2G|LGLBu(7D%Vt?to#rYyz-*Vs7lY*fA|h@y^(`=_pEc-?X$gcaCz15T=iFV`d&vQ^bA7} zpMcjBeDDd^8-ASqz0>Zt`t8e$K@k;f=s;fXRo68U`K5Jraq{UUiIuyN!H3K4d8_{d z=IUga9_k4?|sZwK~cA3c;#0_cCv5DDsYc z=M2E5i$ZI-8Zj55nl6;H4buGV@5RXdHgdaP>^r^X9ZxlDeyh~5Ncz8aUc#3~tQd=~&t0{hQ14kDCH$xOQ?CxeE)hG6KRxl9q<(4MigwQg)@mW#~+3)fybDvk9SJ!gi>-7xp_F9=|ir5&d_f7Hc?|J#B z3{Yo2-;}3jjmsnr?#uys76m$rRIwGBs}QhKcqZ1dXzfq&(|)cC$_rMwm9IK0R_RuH z-YP5JHdrQ6{4?wuBDjJ|xD8TYx+-py6*UDb$gWTA8=O-L_nn-uF^> zo2U8rcM(IDX5UF3uplgUHH8qb(5=3Cv9Tlo?s=hOneuu0@UcSI^Jd8H2`p``8NM`o zTiu6ul9S7u$pYiwr}PGS4|G3=ewW`IbwM?8$0Mp-0$;#gMvd7yZ?$VC&MD~?Pc zrI+-|+!7VU%?;?>o;gF@)^}>>#?Y~eeeX8D;ycx!ui8UCL*Nq+*~DHW+gaoZFF*o- zir*&Y`-g$%oRqv%B+tO}K{q$zPC}K;?#R$Fri>#MSn@yE*=_iLwso*?RmkR}W6!3n zOW+Cgq5hDzgyY7eL9?3bk_;IKkVa*_{pr9Zy-A@Juxjm}GY8+9_T4&^-x8BmtMJ%i zSFYqZ)tNSoC`R#7`eZu~WU38uU9_khmI(=I<`dP4W@#g=GnGrGY9$m)M7nzo%9YJT zj=fqXrw;$(l`WK2%Pgo)W{^|SX6~4d&k4y8t%>dKoRisuVjY9p10BRI{Oy1d+-T!a=4VS&+7k>?lozDo;Y(vcMr?nVp@H7PzGoBIbp)%W4wL4;OxJjIqy zE@O^uYmbc9vKy~%S6H5F=>)Q@t3NWV&?TCb4C?-|zW-yix~(ds%*tHDgJH3Cbsa@= z8icLr27zTguQ-6FQjI;lh%MMR(_o>adNVrE348XJU>$iv(idP6`6BExR&W?&1&Igd zYkJ;|KQ(JZ1`@<`_6u;<0~?1xCoz_!BLU3u8PEARw7L*}1dtAIoED#xZfg+ifdTzo z-+u!JRNHMlK#!aK+Xg$OzaEn>5}>~T(=T@JShCH&sEIb=i3RLD;;I+UoAtTROOPg0 ziDtGf2(ZR3QKi0!@0rP< zRT}O)5S>p%i`X&5>JThPHd?$&97&?5t=KtuWEg9`f`p!J&f;GPkUAEpmzZWE3=PSI zc*92@Ct~&ydNz(nKP64ls$z(ODqR4EmnmXTa}Yyj)1=Q8g{eU&wgWx58%?3i8~k`8 z7s$|_#B>64cCxSyPWgeh8@uk5yi-+gjz(~fjNJ2+6}E;6n1%wd46J%Xi%)mN1K+|9 z*%7`qorW;*ctkCJB}TuFkp$ypTx|#O;9n#%a$8^n@c+CG5Ufc59nyp%KipFUX8<)z zY>kfb6`(1kAqzht0fHgJ`&ukA2pX~*LjZ(x$M8$Y2#v5y5R^TPM%ckR(kvZ;8>U|& zg2!Ww?rjs`8K{at-m7u%&^HSmG|)%vqIL(#?;fLj$DYU;8?;rkfhZ%vW>1DYMx0^x zSKyH~KBPl(hS|idCug1g{Y?X%+E12gYdZTof9Hh}3?}1XWVpz+K>{?yW{)6(WIf+D z==7`;U1!L?mz@c;AM#J>($2Jr18!6KZ z+rnwX(9nYyAoL+exd?`St{)uso6UF4x9{FIe+wy;fneN8hUaZ}(q{E=#c)?HzzAiW zS&lIrM}N3kxjtt$pEj$5O{@`oVaL35>i3F~AmhUA_?_mRsaX$@R*nkIEN`wTn9lp8 zBoecx;ZXjcz90UL3?jYZ11#Rp3E_@t<86TCQKE5KPN<~%SW`lyN;LxGA24K@B}iK8-}R$&S8c6=7_OHFVE0~ zk;yev=3FM||XlgqB8Qr=IG-os8~TcacD3*Wt0y zgwAu2{J%1Vqq+{pkg0@RilYk26K|KjK3BUwhYs88H|5BCg4m&P?iV?hJqp=5?OVrTb%DhlRjF8HgLFKtEQ2Y%hSh z_V+^PvKQk-YKjIXVRJ*+Vjcs{?HT0-2*<=l^ksAupaw}25RKoVA+!#Ux8Pcs;}wn2 z%sCb1qIn+=$ChnEk}JDU6Su=571OY@;Em~^l8ADUEipCJQlVgC}hDV z8u#+6!hm=juBJ(>D)x;ys1P930M4di0nb0+}4welj2m0yozj8f5 zd!$YL$y1_lHCw$5+w6hnk7lLx)60sO<6H!MEbZRgMJTQ$TD(?{a z5SWrB>KRA;zx9a?!3u=3ATOe_Hi$HuL#
3o|=NArr@Xfanr!rCK@MA!$-5@qJha`aL_#XXD-|`4e!j2a|XCc z!Zj7Xc`(T;t&7v8dE?Q}@cCI-2lcB7kY<7n>;9hd$i{HU@GvpQnZOwFNM?HKNw6b! zfLxr=V@TlKnU4w4y$brp7Deb5m4^w<>qz@uviDr(NolrcDke#LYq+u!xfX@Kb4n=qvkWx6JnWPLC&CPQ`>c7lS zuFu-1W%xLJ9(({=WOdkg>x;AUW^=400DomTdKFP{0ab_Gy3JhG#%OH*_kVj}kP&{8k~@0IaV z2~>~8C_-5XU!T?tycN%??DQ^M-QWdhez8epa{&ofRNCP$JPm}jQm1TkE-M92O5)8$ zcntsk4^T@10u%rg0000803EH6Sfiw@>yZfn0Nf=202crN0000000000000000001E za%Ew3WmRcJWoBt^X>@6CZZ2wbZ*EXa0Rj{N6aWAK2ml?ekXWs=PLIaT002Ty2LKTO z000000000000000#t8rbZDDC{RAp^&Y+-a|E^2dcZcs}F1^@s600IC40E7Sl0K3-! G0000ko}X9% literal 0 HcmV?d00001 diff --git a/Solutions/QualysVM/Package/createUiDefinition.json b/Solutions/QualysVM/Package/createUiDefinition.json index 78b7c96a3f..af14fd116a 100644 --- a/Solutions/QualysVM/Package/createUiDefinition.json +++ b/Solutions/QualysVM/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Qualys Vulnerability Management](https://www.qualys.com/apps/vulnerability-management-detection-response/) solution for Microsoft Sentinel enables you to ingest host vulnerability detection data into Microsoft Sentinel.\r\n\r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\r\n\n\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 2, **Custom Azure Logic Apps Connectors:** 1, **Playbooks:** 4\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/QualysVM/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Qualys Vulnerability Management](https://www.qualys.com/apps/vulnerability-management-detection-response/) solution for Microsoft Sentinel enables you to ingest host vulnerability detection data into Microsoft Sentinel.\r\n\r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\r\n\n\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 2, **Custom Azure Logic Apps Connectors:** 1, **Playbooks:** 4\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,7 +60,7 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This solution installs the data connector for ingesting Qualys Vulnerability Management logs into Microsoft Sentinel, using the Qualys API. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for QualysVM. You can get QualysVM custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { diff --git a/Solutions/QualysVM/Package/mainTemplate.json b/Solutions/QualysVM/Package/mainTemplate.json index 354c29db07..655304376d 100644 --- a/Solutions/QualysVM/Package/mainTemplate.json +++ b/Solutions/QualysVM/Package/mainTemplate.json @@ -38,100 +38,96 @@ } }, "variables": { - "solutionId": "azuresentinel.azure-sentinel-qualysvm", - "_solutionId": "[variables('solutionId')]", "email": "support@microsoft.com", "_email": "[variables('email')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_solutionName": "QualysVM", + "_solutionVersion": "3.0.0", + "solutionId": "azuresentinel.azure-sentinel-qualysvm", + "_solutionId": "[variables('solutionId')]", "uiConfigId1": "QualysVulnerabilityManagement", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "QualysVulnerabilityManagement", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "2.0.0", - "blanks": "[replace('b', 'b', '')]", - "TemplateEmptyArray": "[json('[]')]", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", "workbookVersion1": "1.0.0", "workbookContentId1": "QualysVMV2Workbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", - "analyticRuleVersion1": "1.0.1", - "analyticRulecontentId1": "3edb7215-250b-40c0-8b46-79093949242d", - "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", - "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1')))]", - "analyticRuleVersion2": "1.0.1", - "analyticRulecontentId2": "6116dc19-475a-4148-84b2-efe89c073e27", - "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", - "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2')))]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "analyticRuleObject1": { + "analyticRuleVersion1": "1.0.1", + "_analyticRulecontentId1": "3edb7215-250b-40c0-8b46-79093949242d", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3edb7215-250b-40c0-8b46-79093949242d')]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3edb7215-250b-40c0-8b46-79093949242d')))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3edb7215-250b-40c0-8b46-79093949242d','-', '1.0.1')))]" + }, + "analyticRuleObject2": { + "analyticRuleVersion2": "1.0.1", + "_analyticRulecontentId2": "6116dc19-475a-4148-84b2-efe89c073e27", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6116dc19-475a-4148-84b2-efe89c073e27')]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6116dc19-475a-4148-84b2-efe89c073e27')))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6116dc19-475a-4148-84b2-efe89c073e27','-', '1.0.1')))]" + }, "QualysCustomConnector": "QualysCustomConnector", "_QualysCustomConnector": "[variables('QualysCustomConnector')]", + "TemplateEmptyArray": "[json('[]')]", "playbookVersion1": "1.0", "playbookContentId1": "QualysCustomConnector", "_playbookContentId1": "[variables('playbookContentId1')]", - "playbookTemplateSpecName1": "[concat(parameters('workspace'),'-lc-',uniquestring(variables('_playbookContentId1')))]", + "playbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-lc-',uniquestring(variables('_playbookContentId1'))))]", + "_playbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','lc','-', uniqueString(concat(variables('_solutionId'),'-','LogicAppsCustomConnector','-',variables('_playbookContentId1'),'-', variables('playbookVersion1'))))]", "QualysVM-GetAssetDetails": "QualysVM-GetAssetDetails", "_QualysVM-GetAssetDetails": "[variables('QualysVM-GetAssetDetails')]", "playbookVersion2": "1.0", "playbookContentId2": "QualysVM-GetAssetDetails", "_playbookContentId2": "[variables('playbookContentId2')]", "playbookId2": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId2'))]", - "playbookTemplateSpecName2": "[concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId2')))]", + "playbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId2'))))]", + "_playbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId2'),'-', variables('playbookVersion2'))))]", + "blanks": "[replace('b', 'b', '')]", "QualysVM-GetAssets-ByCVEID": "QualysVM-GetAssets-ByCVEID", "_QualysVM-GetAssets-ByCVEID": "[variables('QualysVM-GetAssets-ByCVEID')]", "playbookVersion3": "1.0", "playbookContentId3": "QualysVM-GetAssets-ByCVEID", "_playbookContentId3": "[variables('playbookContentId3')]", "playbookId3": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId3'))]", - "playbookTemplateSpecName3": "[concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId3')))]", + "playbookTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId3'))))]", + "_playbookcontentProductId3": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId3'),'-', variables('playbookVersion3'))))]", "QualysVM-GetAssets-ByOpenPort": "QualysVM-GetAssets-ByOpenPort", "_QualysVM-GetAssets-ByOpenPort": "[variables('QualysVM-GetAssets-ByOpenPort')]", "playbookVersion4": "1.0", "playbookContentId4": "QualysVM-GetAssets-ByOpenPort", "_playbookContentId4": "[variables('playbookContentId4')]", "playbookId4": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId4'))]", - "playbookTemplateSpecName4": "[concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId4')))]", + "playbookTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId4'))))]", + "_playbookcontentProductId4": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId4'),'-', variables('playbookVersion4'))))]", "QualysVM-LaunchVMScan-GenerateReport": "QualysVM-LaunchVMScan-GenerateReport", "_QualysVM-LaunchVMScan-GenerateReport": "[variables('QualysVM-LaunchVMScan-GenerateReport')]", "playbookVersion5": "1.0", "playbookContentId5": "QualysVM-LaunchVMScan-GenerateReport", "_playbookContentId5": "[variables('playbookContentId5')]", "playbookId5": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId5'))]", - "playbookTemplateSpecName5": "[concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId5')))]" + "playbookTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId5'))))]", + "_playbookcontentProductId5": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId5'),'-', variables('playbookVersion5'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "QualysVM data connector with template", - "displayName": "QualysVM template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QualysVM data connector with template version 2.0.2", + "description": "QualysVM data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -266,7 +262,7 @@ "description": ">**NOTE:** This connector has been updated, if you have previously deployed an earlier version, and want to update, please delete the existing Qualys VM Azure Function before redeploying this version. Please use Qualys V2 version Workbook, detections. " }, { - "description": "Use this method for automated deployment of the Qualys VM connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-QualysVM-azuredeployV2)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **API Username**, **API Password** , update the **URI**, and any additional URI **Filter Parameters** (each filter should be separated by an \"&\" symbol, no spaces.) \n> - Enter the URI that corresponds to your region. The complete list of API Server URLs can be [found here](https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf#G4.735348) -- There is no need to add a time suffix to the URI, the Function App will dynamically append the Time Value to the URI in the proper format. \n - The default **Time Interval** is set to pull the last five (5) minutes of data. If the time interval needs to be modified, it is recommended to change the Function App Timer Trigger accordingly (in the function.json file, post deployment) to prevent overlapping data ingestion. \n> - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "description": "Use this method for automated deployment of the Qualys VM connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-QualysVM-azuredeployV2) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-QualysVM-azuredeployV2-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **API Username**, **API Password** , update the **URI**, and any additional URI **Filter Parameters** (each filter should be separated by an \"&\" symbol, no spaces.) \n> - Enter the URI that corresponds to your region. The complete list of API Server URLs can be [found here](https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf#G4.735348) -- There is no need to add a time suffix to the URI, the Function App will dynamically append the Time Value to the URI in the proper format. \n - The default **Time Interval** is set to pull the last five (5) minutes of data. If the time interval needs to be modified, it is recommended to change the Function App Timer Trigger accordingly (in the function.json file, post deployment) to prevent overlapping data ingestion. \n> - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", "title": "Option 1 - Azure Resource Manager (ARM) Template" }, { @@ -308,7 +304,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -333,12 +329,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "Qualys Vulnerability Management (using Azure Functions)", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -493,7 +500,7 @@ "description": ">**NOTE:** This connector has been updated, if you have previously deployed an earlier version, and want to update, please delete the existing Qualys VM Azure Function before redeploying this version. Please use Qualys V2 version Workbook, detections. " }, { - "description": "Use this method for automated deployment of the Qualys VM connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-QualysVM-azuredeployV2)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **API Username**, **API Password** , update the **URI**, and any additional URI **Filter Parameters** (each filter should be separated by an \"&\" symbol, no spaces.) \n> - Enter the URI that corresponds to your region. The complete list of API Server URLs can be [found here](https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf#G4.735348) -- There is no need to add a time suffix to the URI, the Function App will dynamically append the Time Value to the URI in the proper format. \n - The default **Time Interval** is set to pull the last five (5) minutes of data. If the time interval needs to be modified, it is recommended to change the Function App Timer Trigger accordingly (in the function.json file, post deployment) to prevent overlapping data ingestion. \n> - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "description": "Use this method for automated deployment of the Qualys VM connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-QualysVM-azuredeployV2) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-QualysVM-azuredeployV2-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **API Username**, **API Password** , update the **URI**, and any additional URI **Filter Parameters** (each filter should be separated by an \"&\" symbol, no spaces.) \n> - Enter the URI that corresponds to your region. The complete list of API Server URLs can be [found here](https://www.qualys.com/docs/qualys-api-vmpc-user-guide.pdf#G4.735348) -- There is no need to add a time suffix to the URI, the Function App will dynamically append the Time Value to the URI in the proper format. \n - The default **Time Interval** is set to pull the last five (5) minutes of data. If the time interval needs to be modified, it is recommended to change the Function App Timer Trigger accordingly (in the function.json file, post deployment) to prevent overlapping data ingestion. \n> - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", "title": "Option 1 - Azure Resource Manager (ARM) Template" }, { @@ -518,33 +525,15 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "QualysVM Workbook with template", - "displayName": "QualysVM workbook template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QualysVMv2Workbook with template version 2.0.2", + "description": "QualysVMv2 Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -562,7 +551,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"1694c013-fbeb-43eb-89c7-1417bb59150f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"value\":{\"durationMs\":2419200000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"resourceType\":\"microsoft.insights/components\"},{\"id\":\"a9cc502e-223d-4067-834b-a34a85055664\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"severitySelector\",\"label\":\"Severity\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"QualysHostDetectionV2_CL\\r\\n| extend Sev = tostring(Severity_s)\\r\\n| distinct Sev\\r\\n| sort by Sev desc\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"364f8236-9b9d-4e41-9767-ab5f404dcd4e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"OperatingSystem\",\"label\":\"Operating System\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"QualysHostDetectionV2_CL\\r\\n| distinct OperatingSystem_s\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Scan Detection\",\"subTarget\":\"Detection\",\"preText\":\"ScanDetectio\",\"style\":\"link\"},{\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Vulnerability Analysis\",\"subTarget\":\"VulnerabilityAnalysis\",\"style\":\"link\"}]},\"name\":\"links - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| where isnotempty(Sev)\\n| summarize ['5 - Urgent'] = countif(Sev == \\\"5\\\"), ['4 - Critical'] = countif(Sev == \\\"4\\\"), ['3 - Serious'] = countif(Sev == \\\"3\\\"), ['2 - Medium'] = countif(Sev == \\\"2\\\"), ['1 - Minimal'] = countif(Sev == \\\"1\\\"), count() by bin(TimeGenerated, {TimeRange:grain})\\n| project-away count_\\n\\n\",\"size\":0,\"title\":\"Detections by Severity Timeline\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"5 - Urgent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"4 - Critical\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redDark\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"3 - Serious\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"2 - Medium\",\"formatter\":8,\"formatOptions\":{\"palette\":\"magenta\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"1 - Minimal\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}}],\"labelSettings\":[{\"columnId\":\"5 - Urgent\"},{\"columnId\":\"4 - Critical\"},{\"columnId\":\"3 - Serious\"},{\"columnId\":\"2 - Medium\"},{\"columnId\":\"1 - Minimal\"}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"5 - Urgent\",\"color\":\"redBright\"},{\"seriesName\":\"4 - Critical\",\"color\":\"redDark\"},{\"seriesName\":\"3 - Serious\",\"color\":\"orange\"},{\"seriesName\":\"2 - Medium\",\"color\":\"magenta\"},{\"seriesName\":\"1 - Minimal\",\"color\":\"lightBlue\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"name\":\"query - 2 \"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Status = tostring(Status_s)\\n| summarize count() by Status\\n\\n\",\"size\":0,\"title\":\"Detection Status\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"5 - Urgent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"4 - Critical\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redDark\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"3 - Serious\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"2 - Medium\",\"formatter\":8,\"formatOptions\":{\"palette\":\"magenta\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"1 - Minimal\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}}],\"labelSettings\":[{\"columnId\":\"5 - Urgent\"},{\"columnId\":\"4 - Critical\"},{\"columnId\":\"3 - Serious\"},{\"columnId\":\"2 - Medium\"},{\"columnId\":\"1 - Minimal\"}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"5 - Urgent\",\"color\":\"redBright\"},{\"seriesName\":\"4 - Critical\",\"color\":\"redDark\"},{\"seriesName\":\"3 - Serious\",\"color\":\"orange\"},{\"seriesName\":\"2 - Medium\",\"color\":\"magenta\"},{\"seriesName\":\"1 - Minimal\",\"color\":\"lightBlue\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| extend Severity = case(Sev == \\\"5\\\", \\\"5 - Urgent\\\", Sev == \\\"4\\\", \\\"4 - Critical\\\", Sev == \\\"3\\\", \\\"3 - Serious\\\", Sev == \\\"2\\\", \\\"2 - Medium\\\", Sev == \\\"1\\\", \\\"1 - Minimal\\\", \\\" \\\")\\n| extend Status = tostring(Status_s)\\n| where Status == \\\"Re-Opened\\\"\\n| summarize count() by Sev, Severity, Vulnerability ;\\nlet topUrgent = data \\n| where Sev == \\\"5\\\"\\n| top 10 by count_;\\nlet topCritical = data\\n| where Sev == \\\"4\\\"\\n| top 10 by count_;\\nlet topSerious = data\\n| where Sev == \\\"3\\\"\\n| top 10 by count_;\\nlet topMedium = data\\n| where Sev == \\\"2\\\"\\n| top 10 by count_;\\nlet topMinimal = data\\n| where Sev == \\\"1\\\"\\n| top 10 by count_;\\nunion topUrgent, topCritical, topSerious, topMedium, topMinimal\\n| project-away Sev\\n| sort by Severity, count_ desc\\n| project-rename Total = count_\\n\\n\",\"size\":0,\"title\":\"Top 10 Re-Opened Vulnerabilities by Severity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"[variables('blanks')]\",\"representation\":\"[variables('blanks')]\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| extend Severity = case(Sev == \\\"5\\\", \\\"5 - Urgent\\\", Sev == \\\"4\\\", \\\"4 - Critical\\\", Sev == \\\"3\\\", \\\"3 - Serious\\\", Sev == \\\"2\\\", \\\"2 - Medium\\\", Sev == \\\"1\\\", \\\"1 - Minimal\\\", \\\" \\\")\\n| extend Status = tostring(Status_s)\\n| where Status == \\\"New\\\" and Sev in (\\\"5\\\", \\\"4\\\")\\n| summarize count() by Sev, Severity, IPAddress, DnsName_s;\\nlet topUrgent = data \\n| where Sev == \\\"5\\\"\\n| top 10 by count_;\\nlet topCritical = data\\n| where Sev == \\\"4\\\"\\n| top 10 by count_;\\nunion topUrgent, topCritical\\n| project-away Sev\\n| sort by Severity, count_ desc\\n| project-rename Total = count_\\n\\n\",\"size\":0,\"title\":\"Top 10 Host with New Urgent/Critical Vulnerabilities\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"[variables('blanks')]\",\"representation\":\"[variables('blanks')]\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| extend Severity = case(Sev == \\\"5\\\", \\\"5 - Urgent\\\", Sev == \\\"4\\\", \\\"4 - Critical\\\", Sev == \\\"3\\\", \\\"3 - Serious\\\", Sev == \\\"2\\\", \\\"2 - Medium\\\", Sev == \\\"1\\\", \\\"1 - Minimal\\\", \\\" \\\")\\n| extend Status = tostring(Status_s)\\n| where Status == \\\"Re-Opened\\\" and Sev in (\\\"5\\\", \\\"4\\\")\\n| summarize count() by Sev, Severity, IPAddress, DnsName_s;\\nlet topUrgent = data \\n| where Sev == \\\"5\\\"\\n| top 10 by count_;\\nlet topCritical = data\\n| where Sev == \\\"4\\\"\\n| top 10 by count_;\\nunion topUrgent, topCritical\\n| project-away Sev\\n| sort by Severity, count_ desc\\n| project-rename Total = count_\\n\\n\",\"size\":0,\"title\":\"Top 10 Host with Re-Opened Urgent/Critical Vulnerabilities\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"[variables('blanks')]\",\"representation\":\"[variables('blanks')]\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| extend Sev = tostring(Severity_s)\\n| where isnotempty(Sev)\\n| summarize ['5 - Urgent'] = countif(Sev == \\\"5\\\"), ['4 - Critical'] = countif(Sev == \\\"4\\\"), ['3 - Serious'] = countif(Sev == \\\"3\\\"), ['2 - Medium'] = countif(Sev == \\\"2\\\"), ['1 - Minimal'] = countif(Sev == \\\"1\\\"), count() by OperatingSystem_s\\n| project-rename Total = count_\\n| sort by Total desc \\n| top 10 by Total\\n\\n\",\"size\":0,\"title\":\"Top Total Detections by Operation System\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"5 - Urgent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"4 - Critical\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redDark\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"3 - Serious\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"2 - Medium\",\"formatter\":8,\"formatOptions\":{\"palette\":\"magenta\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"1 - Minimal\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}}],\"labelSettings\":[{\"columnId\":\"OperatingSystem_s\",\"label\":\"Operating System\"},{\"columnId\":\"5 - Urgent\"},{\"columnId\":\"4 - Critical\"},{\"columnId\":\"3 - Serious\"},{\"columnId\":\"2 - Medium\"},{\"columnId\":\"1 - Minimal\"},{\"columnId\":\"Total\"}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| extend Severity = case(Sev == \\\"5\\\", \\\"5 - Urgent\\\", Sev == \\\"4\\\", \\\"4 - Critical\\\", Sev == \\\"3\\\", \\\"3 - Serious\\\", Sev == \\\"2\\\", \\\"2 - Medium\\\", Sev == \\\"1\\\", \\\"1 - Minimal\\\", \\\" \\\")\\n| summarize count() by Sev, Severity, Vulnerability ;\\nlet topUrgent = data \\n| where Sev == \\\"5\\\"\\n| top 10 by count_;\\nlet topCritical = data\\n| where Sev == \\\"4\\\"\\n| top 10 by count_;\\nlet topSerious = data\\n| where Sev == \\\"3\\\"\\n| top 10 by count_;\\nlet topMedium = data\\n| where Sev == \\\"2\\\"\\n| top 10 by count_;\\nlet topMinimal = data\\n| where Sev == \\\"1\\\"\\n| top 10 by count_;\\nunion topUrgent, topCritical, topSerious, topMedium, topMinimal\\n| project-away Sev\\n| sort by Severity, count_ desc\\n| project-rename Total = count_\\n\\n\",\"size\":0,\"title\":\"Top 10 Vulnerabilities Detected per Severity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"[variables('blanks')]\",\"representation\":\"[variables('blanks')]\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| extend Severity = case(Sev == \\\"5\\\", \\\"5 - Urgent\\\", Sev == \\\"4\\\", \\\"4 - Critical\\\", Sev == \\\"3\\\", \\\"3 - Serious\\\", Sev == \\\"2\\\", \\\"2 - Medium\\\", Sev == \\\"1\\\", \\\"1 - Minimal\\\", \\\" \\\")\\n| summarize count() by Sev, Severity, IPAddress, DnsName_s;\\nlet topUrgent = data \\n| where Sev == \\\"5\\\"\\n| top 10 by count_;\\nlet topCritical = data\\n| where Sev == \\\"4\\\"\\n| top 10 by count_;\\nlet topSerious = data\\n| where Sev == \\\"3\\\"\\n| top 10 by count_;\\nlet topMedium = data\\n| where Sev == \\\"2\\\"\\n| top 10 by count_;\\nlet topMinimal = data\\n| where Sev == \\\"1\\\"\\n| top 10 by count_;\\nunion topUrgent, topCritical, topSerious, topMedium, topMinimal\\n| project-away Sev\\n| sort by Severity, count_ desc\\n| project-rename Total = count_\\n\\n\",\"size\":0,\"title\":\"Top 10 Detections by Host per Severity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"[variables('blanks')]\",\"representation\":\"[variables('blanks')]\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"d7f3f8af-5b1a-46b1-8fe6-a0440175704a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Vuln\",\"label\":\"Vulnerability Detected\",\"type\":2,\"query\":\"QualysHostDetectionV2_CL\\r\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\r\\n| extend Sev = tostring(Severity_s)\\r\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\r\\n| extend Vuln = tostring(QID_s)\\r\\n| distinct Vuln\\r\\n\",\"value\":\"[variables('blanks')]\",\"typeSettings\":{\"additionalResourceOptions\":\"[variables('TemplateEmptyArray')]\"},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"formVertical\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"VulnerabilityAnalysis\"},\"name\":\"parameters - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Vuln = tostring(QID_s)\\n| where Vuln in (\\\"{Vuln}\\\") or '*' in (\\\"{Vuln}\\\")\\n| summarize ['5 - Urgent'] = countif(Sev == \\\"5\\\"), ['4 - Critical'] = countif(Sev == \\\"4\\\"), ['3 - Serious'] = countif(Sev == \\\"3\\\"), ['2 - Medium'] = countif(Sev == \\\"2\\\"), ['1 - Minimal'] = countif(Sev == \\\"1\\\"), count() by bin(TimeGenerated, {TimeRange:grain})\\n| project-away count_\\n\\n\",\"size\":0,\"title\":\"Detection Timeline\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"5 - Urgent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"4 - Critical\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redDark\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"3 - Serious\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"2 - Medium\",\"formatter\":8,\"formatOptions\":{\"palette\":\"magenta\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"1 - Minimal\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}}],\"labelSettings\":[{\"columnId\":\"5 - Urgent\"},{\"columnId\":\"4 - Critical\"},{\"columnId\":\"3 - Serious\"},{\"columnId\":\"2 - Medium\"},{\"columnId\":\"1 - Minimal\"}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"5 - Urgent\",\"color\":\"redBright\"},{\"seriesName\":\"4 - Critical\",\"color\":\"redDark\"},{\"seriesName\":\"3 - Serious\",\"color\":\"orange\"},{\"seriesName\":\"2 - Medium\",\"color\":\"magenta\"},{\"seriesName\":\"1 - Minimal\",\"color\":\"lightBlue\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"VulnerabilityAnalysis\"},\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Status = tostring(Status_s)\\n| extend Vulnerability = tostring(QID_s)\\n| where Vulnerability in (\\\"{Vuln}\\\") or '*' in (\\\"{Vuln}\\\") \\n| summarize count() by Status\\n\\n\",\"size\":0,\"title\":\"Detection Status\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"5 - Urgent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"4 - Critical\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redDark\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"3 - Serious\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"2 - Medium\",\"formatter\":8,\"formatOptions\":{\"palette\":\"magenta\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"1 - Minimal\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}}],\"labelSettings\":[{\"columnId\":\"5 - Urgent\"},{\"columnId\":\"4 - Critical\"},{\"columnId\":\"3 - Serious\"},{\"columnId\":\"2 - Medium\"},{\"columnId\":\"1 - Minimal\"}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"5 - Urgent\",\"color\":\"redBright\"},{\"seriesName\":\"4 - Critical\",\"color\":\"redDark\"},{\"seriesName\":\"3 - Serious\",\"color\":\"orange\"},{\"seriesName\":\"2 - Medium\",\"color\":\"magenta\"},{\"seriesName\":\"1 - Minimal\",\"color\":\"lightBlue\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"VulnerabilityAnalysis\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| where Vulnerability in (\\\"{Vuln}\\\") or '*' in (\\\"{Vuln}\\\")\\n| summarize Total = count() by IPAddress, DnsName_s\\n| sort by Total desc\\n\\n\\n\\n\",\"size\":0,\"title\":\"Host(s) with Vulnerability Detected\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":\"[variables('blanks')]\",\"representation\":\"[variables('blanks')]\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"VulnerabilityAnalysis\"},\"customWidth\":\"50\",\"name\":\"query - 2 -\"}],\"fromTemplateId\":\"sentinel-QualysVMV2Workbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"1694c013-fbeb-43eb-89c7-1417bb59150f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"value\":{\"durationMs\":2419200000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"resourceType\":\"microsoft.insights/components\"},{\"id\":\"a9cc502e-223d-4067-834b-a34a85055664\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"severitySelector\",\"label\":\"Severity\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"QualysHostDetectionV2_CL\\r\\n| extend Sev = tostring(Severity_s)\\r\\n| distinct Sev\\r\\n| sort by Sev desc\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"364f8236-9b9d-4e41-9767-ab5f404dcd4e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"OperatingSystem\",\"label\":\"Operating System\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"QualysHostDetectionV2_CL\\r\\n| distinct OperatingSystem_s\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Scan Detection\",\"subTarget\":\"Detection\",\"preText\":\"ScanDetectio\",\"style\":\"link\"},{\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Vulnerability Analysis\",\"subTarget\":\"VulnerabilityAnalysis\",\"style\":\"link\"}]},\"name\":\"links - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| where isnotempty(Sev)\\n| summarize ['5 - Urgent'] = countif(Sev == \\\"5\\\"), ['4 - Critical'] = countif(Sev == \\\"4\\\"), ['3 - Serious'] = countif(Sev == \\\"3\\\"), ['2 - Medium'] = countif(Sev == \\\"2\\\"), ['1 - Minimal'] = countif(Sev == \\\"1\\\"), count() by bin(TimeGenerated, {TimeRange:grain})\\n| project-away count_\\n\\n\",\"size\":0,\"title\":\"Detections by Severity Timeline\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"5 - Urgent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"4 - Critical\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redDark\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"3 - Serious\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"2 - Medium\",\"formatter\":8,\"formatOptions\":{\"palette\":\"magenta\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"1 - Minimal\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}}],\"labelSettings\":[{\"columnId\":\"5 - Urgent\"},{\"columnId\":\"4 - Critical\"},{\"columnId\":\"3 - Serious\"},{\"columnId\":\"2 - Medium\"},{\"columnId\":\"1 - Minimal\"}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"5 - Urgent\",\"color\":\"redBright\"},{\"seriesName\":\"4 - Critical\",\"color\":\"redDark\"},{\"seriesName\":\"3 - Serious\",\"color\":\"orange\"},{\"seriesName\":\"2 - Medium\",\"color\":\"magenta\"},{\"seriesName\":\"1 - Minimal\",\"color\":\"lightBlue\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"name\":\"query - 2 \"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Status = tostring(Status_s)\\n| summarize count() by Status\\n\\n\",\"size\":0,\"title\":\"Detection Status\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"5 - Urgent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"4 - Critical\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redDark\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"3 - Serious\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"2 - Medium\",\"formatter\":8,\"formatOptions\":{\"palette\":\"magenta\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"1 - Minimal\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}}],\"labelSettings\":[{\"columnId\":\"5 - Urgent\"},{\"columnId\":\"4 - Critical\"},{\"columnId\":\"3 - Serious\"},{\"columnId\":\"2 - Medium\"},{\"columnId\":\"1 - Minimal\"}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"5 - Urgent\",\"color\":\"redBright\"},{\"seriesName\":\"4 - Critical\",\"color\":\"redDark\"},{\"seriesName\":\"3 - Serious\",\"color\":\"orange\"},{\"seriesName\":\"2 - Medium\",\"color\":\"magenta\"},{\"seriesName\":\"1 - Minimal\",\"color\":\"lightBlue\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| extend Severity = case(Sev == \\\"5\\\", \\\"5 - Urgent\\\", Sev == \\\"4\\\", \\\"4 - Critical\\\", Sev == \\\"3\\\", \\\"3 - Serious\\\", Sev == \\\"2\\\", \\\"2 - Medium\\\", Sev == \\\"1\\\", \\\"1 - Minimal\\\", \\\" \\\")\\n| extend Status = tostring(Status_s)\\n| where Status == \\\"Re-Opened\\\"\\n| summarize count() by Sev, Severity, Vulnerability ;\\nlet topUrgent = data \\n| where Sev == \\\"5\\\"\\n| top 10 by count_;\\nlet topCritical = data\\n| where Sev == \\\"4\\\"\\n| top 10 by count_;\\nlet topSerious = data\\n| where Sev == \\\"3\\\"\\n| top 10 by count_;\\nlet topMedium = data\\n| where Sev == \\\"2\\\"\\n| top 10 by count_;\\nlet topMinimal = data\\n| where Sev == \\\"1\\\"\\n| top 10 by count_;\\nunion topUrgent, topCritical, topSerious, topMedium, topMinimal\\n| project-away Sev\\n| sort by Severity, count_ desc\\n| project-rename Total = count_\\n\\n\",\"size\":0,\"title\":\"Top 10 Re-Opened Vulnerabilities by Severity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| extend Severity = case(Sev == \\\"5\\\", \\\"5 - Urgent\\\", Sev == \\\"4\\\", \\\"4 - Critical\\\", Sev == \\\"3\\\", \\\"3 - Serious\\\", Sev == \\\"2\\\", \\\"2 - Medium\\\", Sev == \\\"1\\\", \\\"1 - Minimal\\\", \\\" \\\")\\n| extend Status = tostring(Status_s)\\n| where Status == \\\"New\\\" and Sev in (\\\"5\\\", \\\"4\\\")\\n| summarize count() by Sev, Severity, IPAddress, DnsName_s;\\nlet topUrgent = data \\n| where Sev == \\\"5\\\"\\n| top 10 by count_;\\nlet topCritical = data\\n| where Sev == \\\"4\\\"\\n| top 10 by count_;\\nunion topUrgent, topCritical\\n| project-away Sev\\n| sort by Severity, count_ desc\\n| project-rename Total = count_\\n\\n\",\"size\":0,\"title\":\"Top 10 Host with New Urgent/Critical Vulnerabilities\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| extend Severity = case(Sev == \\\"5\\\", \\\"5 - Urgent\\\", Sev == \\\"4\\\", \\\"4 - Critical\\\", Sev == \\\"3\\\", \\\"3 - Serious\\\", Sev == \\\"2\\\", \\\"2 - Medium\\\", Sev == \\\"1\\\", \\\"1 - Minimal\\\", \\\" \\\")\\n| extend Status = tostring(Status_s)\\n| where Status == \\\"Re-Opened\\\" and Sev in (\\\"5\\\", \\\"4\\\")\\n| summarize count() by Sev, Severity, IPAddress, DnsName_s;\\nlet topUrgent = data \\n| where Sev == \\\"5\\\"\\n| top 10 by count_;\\nlet topCritical = data\\n| where Sev == \\\"4\\\"\\n| top 10 by count_;\\nunion topUrgent, topCritical\\n| project-away Sev\\n| sort by Severity, count_ desc\\n| project-rename Total = count_\\n\\n\",\"size\":0,\"title\":\"Top 10 Host with Re-Opened Urgent/Critical Vulnerabilities\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| extend Sev = tostring(Severity_s)\\n| where isnotempty(Sev)\\n| summarize ['5 - Urgent'] = countif(Sev == \\\"5\\\"), ['4 - Critical'] = countif(Sev == \\\"4\\\"), ['3 - Serious'] = countif(Sev == \\\"3\\\"), ['2 - Medium'] = countif(Sev == \\\"2\\\"), ['1 - Minimal'] = countif(Sev == \\\"1\\\"), count() by OperatingSystem_s\\n| project-rename Total = count_\\n| sort by Total desc \\n| top 10 by Total\\n\\n\",\"size\":0,\"title\":\"Top Total Detections by Operation System\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"5 - Urgent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"4 - Critical\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redDark\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"3 - Serious\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"2 - Medium\",\"formatter\":8,\"formatOptions\":{\"palette\":\"magenta\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"1 - Minimal\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}}],\"labelSettings\":[{\"columnId\":\"OperatingSystem_s\",\"label\":\"Operating System\"},{\"columnId\":\"5 - Urgent\"},{\"columnId\":\"4 - Critical\"},{\"columnId\":\"3 - Serious\"},{\"columnId\":\"2 - Medium\"},{\"columnId\":\"1 - Minimal\"},{\"columnId\":\"Total\"}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| extend Severity = case(Sev == \\\"5\\\", \\\"5 - Urgent\\\", Sev == \\\"4\\\", \\\"4 - Critical\\\", Sev == \\\"3\\\", \\\"3 - Serious\\\", Sev == \\\"2\\\", \\\"2 - Medium\\\", Sev == \\\"1\\\", \\\"1 - Minimal\\\", \\\" \\\")\\n| summarize count() by Sev, Severity, Vulnerability ;\\nlet topUrgent = data \\n| where Sev == \\\"5\\\"\\n| top 10 by count_;\\nlet topCritical = data\\n| where Sev == \\\"4\\\"\\n| top 10 by count_;\\nlet topSerious = data\\n| where Sev == \\\"3\\\"\\n| top 10 by count_;\\nlet topMedium = data\\n| where Sev == \\\"2\\\"\\n| top 10 by count_;\\nlet topMinimal = data\\n| where Sev == \\\"1\\\"\\n| top 10 by count_;\\nunion topUrgent, topCritical, topSerious, topMedium, topMinimal\\n| project-away Sev\\n| sort by Severity, count_ desc\\n| project-rename Total = count_\\n\\n\",\"size\":0,\"title\":\"Top 10 Vulnerabilities Detected per Severity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| extend Severity = case(Sev == \\\"5\\\", \\\"5 - Urgent\\\", Sev == \\\"4\\\", \\\"4 - Critical\\\", Sev == \\\"3\\\", \\\"3 - Serious\\\", Sev == \\\"2\\\", \\\"2 - Medium\\\", Sev == \\\"1\\\", \\\"1 - Minimal\\\", \\\" \\\")\\n| summarize count() by Sev, Severity, IPAddress, DnsName_s;\\nlet topUrgent = data \\n| where Sev == \\\"5\\\"\\n| top 10 by count_;\\nlet topCritical = data\\n| where Sev == \\\"4\\\"\\n| top 10 by count_;\\nlet topSerious = data\\n| where Sev == \\\"3\\\"\\n| top 10 by count_;\\nlet topMedium = data\\n| where Sev == \\\"2\\\"\\n| top 10 by count_;\\nlet topMinimal = data\\n| where Sev == \\\"1\\\"\\n| top 10 by count_;\\nunion topUrgent, topCritical, topSerious, topMedium, topMinimal\\n| project-away Sev\\n| sort by Severity, count_ desc\\n| project-rename Total = count_\\n\\n\",\"size\":0,\"title\":\"Top 10 Detections by Host per Severity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Detection\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"d7f3f8af-5b1a-46b1-8fe6-a0440175704a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Vuln\",\"label\":\"Vulnerability Detected\",\"type\":2,\"query\":\"QualysHostDetectionV2_CL\\r\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\r\\n| extend Sev = tostring(Severity_s)\\r\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\r\\n| extend Vuln = tostring(QID_s)\\r\\n| distinct Vuln\\r\\n\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"formVertical\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"VulnerabilityAnalysis\"},\"name\":\"parameters - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Vuln = tostring(QID_s)\\n| where Vuln in (\\\"{Vuln}\\\") or '*' in (\\\"{Vuln}\\\")\\n| summarize ['5 - Urgent'] = countif(Sev == \\\"5\\\"), ['4 - Critical'] = countif(Sev == \\\"4\\\"), ['3 - Serious'] = countif(Sev == \\\"3\\\"), ['2 - Medium'] = countif(Sev == \\\"2\\\"), ['1 - Minimal'] = countif(Sev == \\\"1\\\"), count() by bin(TimeGenerated, {TimeRange:grain})\\n| project-away count_\\n\\n\",\"size\":0,\"title\":\"Detection Timeline\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"5 - Urgent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"4 - Critical\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redDark\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"3 - Serious\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"2 - Medium\",\"formatter\":8,\"formatOptions\":{\"palette\":\"magenta\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"1 - Minimal\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}}],\"labelSettings\":[{\"columnId\":\"5 - Urgent\"},{\"columnId\":\"4 - Critical\"},{\"columnId\":\"3 - Serious\"},{\"columnId\":\"2 - Medium\"},{\"columnId\":\"1 - Minimal\"}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"5 - Urgent\",\"color\":\"redBright\"},{\"seriesName\":\"4 - Critical\",\"color\":\"redDark\"},{\"seriesName\":\"3 - Serious\",\"color\":\"orange\"},{\"seriesName\":\"2 - Medium\",\"color\":\"magenta\"},{\"seriesName\":\"1 - Minimal\",\"color\":\"lightBlue\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"VulnerabilityAnalysis\"},\"name\":\"query - 2 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Status = tostring(Status_s)\\n| extend Vulnerability = tostring(QID_s)\\n| where Vulnerability in (\\\"{Vuln}\\\") or '*' in (\\\"{Vuln}\\\") \\n| summarize count() by Status\\n\\n\",\"size\":0,\"title\":\"Detection Status\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"5 - Urgent\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"4 - Critical\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redDark\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"3 - Serious\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"2 - Medium\",\"formatter\":8,\"formatOptions\":{\"palette\":\"magenta\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"1 - Minimal\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2}}}],\"labelSettings\":[{\"columnId\":\"5 - Urgent\"},{\"columnId\":\"4 - Critical\"},{\"columnId\":\"3 - Serious\"},{\"columnId\":\"2 - Medium\"},{\"columnId\":\"1 - Minimal\"}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"5 - Urgent\",\"color\":\"redBright\"},{\"seriesName\":\"4 - Critical\",\"color\":\"redDark\"},{\"seriesName\":\"3 - Serious\",\"color\":\"orange\"},{\"seriesName\":\"2 - Medium\",\"color\":\"magenta\"},{\"seriesName\":\"1 - Minimal\",\"color\":\"lightBlue\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"VulnerabilityAnalysis\"},\"customWidth\":\"50\",\"name\":\"query - 2 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"QualysHostDetectionV2_CL\\n| where OperatingSystem_s in ({OperatingSystem}) or '*' in ({OperatingSystem})\\n| extend Sev = tostring(Severity_s)\\n| where Sev in ({severitySelector}) or '*' in ({severitySelector})\\n| extend Vulnerability = tostring(QID_s)\\n| where Vulnerability in (\\\"{Vuln}\\\") or '*' in (\\\"{Vuln}\\\")\\n| summarize Total = count() by IPAddress, DnsName_s\\n| sort by Total desc\\n\\n\\n\\n\",\"size\":0,\"title\":\"Host(s) with Vulnerability Detected\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"showIcon\":true,\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"5 - Urgent\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"4 - Critical\",\"representation\":\"redDark\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3 - Serious\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"2 - Medium\",\"representation\":\"magenta\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"1 - Minimal\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}]},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Severity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"hotCold\",\"showIcon\":true}},\"showBorder\":false,\"sortOrderField\":2}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"VulnerabilityAnalysis\"},\"customWidth\":\"50\",\"name\":\"query - 2 -\"}],\"fromTemplateId\":\"sentinel-QualysVMV2Workbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -609,47 +598,40 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName1')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "QualysVM Analytics Rule 1 with template", - "displayName": "QualysVM Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName1'),'/',variables('analyticRuleVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "HighNumberofVulnDetectedV2_AnalyticalRules Analytics Rule with template version 2.0.2", + "description": "HighNumberofVulnDetectedV2_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion1')]", + "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId1')]", - "apiVersion": "2022-04-01-preview", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "apiVersion": "2023-02-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { @@ -681,22 +663,22 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { "columnName": "HostCustomEntity", "identifier": "FullName" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { "columnName": "IPCustomEntity", "identifier": "Address" } - ] + ], + "entityType": "IP" } ] } @@ -704,13 +686,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", "properties": { "description": "QualysVM Analytics Rule 1", - "parentId": "[variables('analyticRuleId1')]", - "contentId": "[variables('_analyticRulecontentId1')]", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion1')]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", "source": { "kind": "Solution", "name": "QualysVM", @@ -729,47 +711,40 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "contentKind": "AnalyticsRule", + "displayName": "High Number of Urgent Vulnerabilities Detected", + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName2')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "QualysVM Analytics Rule 2 with template", - "displayName": "QualysVM Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName2'),'/',variables('analyticRuleVersion2'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName2'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NewHighSeverityVulnDetectedAcrossMulitpleHostsV2_AnalyticalRules Analytics Rule with template version 2.0.2", + "description": "NewHighSeverityVulnDetectedAcrossMulitpleHostsV2_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion2')]", + "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId2')]", - "apiVersion": "2022-04-01-preview", + "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "apiVersion": "2023-02-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { @@ -804,13 +779,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", "properties": { "description": "QualysVM Analytics Rule 2", - "parentId": "[variables('analyticRuleId2')]", - "contentId": "[variables('_analyticRulecontentId2')]", + "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion2')]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", "source": { "kind": "Solution", "name": "QualysVM", @@ -829,37 +804,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "contentKind": "AnalyticsRule", + "displayName": "New High Severity Vulnerability Detected Across Multiple Hosts", + "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('playbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "LogicAppsCustomConnector" - }, - "properties": { - "description": "QualysCustomConnector", - "displayName": "QualysCustomConnector" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('playbookTemplateSpecName1'),'/',variables('playbookVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "LogicAppsCustomConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('playbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QualysCustomConnector Playbook with template version 2.0.2", + "description": "QualysCustomConnector Playbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -2486,37 +2454,30 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId1')]", + "contentKind": "LogicAppsCustomConnector", + "displayName": "QualysCustomConnector", + "contentProductId": "[variables('_playbookcontentProductId1')]", + "id": "[variables('_playbookcontentProductId1')]", + "version": "[variables('playbookVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('playbookTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Playbook" - }, - "properties": { - "description": "QualysVM-GetAssetDetails playbook", - "displayName": "QualysVM-GetAssetDetails playbook" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('playbookTemplateSpecName2'),'/',variables('playbookVersion2'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Playbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('playbookTemplateSpecName2'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QualysVM-GetAssetDetails Playbook with template version 2.0.2", + "description": "QualysVM-GetAssetDetails Playbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -3006,37 +2967,30 @@ ] } } - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId2')]", + "contentKind": "Playbook", + "displayName": "QualysVM-GetAssetDetails", + "contentProductId": "[variables('_playbookcontentProductId2')]", + "id": "[variables('_playbookcontentProductId2')]", + "version": "[variables('playbookVersion2')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('playbookTemplateSpecName3')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Playbook" - }, - "properties": { - "description": "QualysVM-GetAssets-ByCVEID playbook", - "displayName": "QualysVM-GetAssets-ByCVEID playbook" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('playbookTemplateSpecName3'),'/',variables('playbookVersion3'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Playbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('playbookTemplateSpecName3'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QualysVM-GetAssets-ByCVEID Playbook with template version 2.0.2", + "description": "QualysVM-GetAssets-ByCVEID Playbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -4097,37 +4051,30 @@ ] } } - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId3')]", + "contentKind": "Playbook", + "displayName": "QualysVM-GetAssets-ByCVEID", + "contentProductId": "[variables('_playbookcontentProductId3')]", + "id": "[variables('_playbookcontentProductId3')]", + "version": "[variables('playbookVersion3')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('playbookTemplateSpecName4')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Playbook" - }, - "properties": { - "description": "QualysVM-GetAssets-ByOpenPort playbook", - "displayName": "QualysVM-GetAssets-ByOpenPort playbook" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('playbookTemplateSpecName4'),'/',variables('playbookVersion4'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Playbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('playbookTemplateSpecName4'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QualysVM-GetAssets-ByOpenPort Playbook with template version 2.0.2", + "description": "QualysVM-GetAssets-ByOpenPort Playbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -5063,37 +5010,30 @@ ] } } - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId4')]", + "contentKind": "Playbook", + "displayName": "QualysVM-GetAssets-ByOpenPort", + "contentProductId": "[variables('_playbookcontentProductId4')]", + "id": "[variables('_playbookcontentProductId4')]", + "version": "[variables('playbookVersion4')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('playbookTemplateSpecName5')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Playbook" - }, - "properties": { - "description": "QualysVM-LaunchVMScan-GenerateReport playbook", - "displayName": "QualysVM-LaunchVMScan-GenerateReport playbook" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('playbookTemplateSpecName5'),'/',variables('playbookVersion5'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Playbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('playbookTemplateSpecName5'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "QualysVM-LaunchVMScan-GenerateReport Playbook with template version 2.0.2", + "description": "QualysVM-LaunchVMScan-GenerateReport Playbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion5')]", @@ -7727,17 +7667,35 @@ ] } } - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId5')]", + "contentKind": "Playbook", + "displayName": "QualysVM-LaunchVMScan-GenerateReport", + "contentProductId": "[variables('_playbookcontentProductId5')]", + "id": "[variables('_playbookcontentProductId5')]", + "version": "[variables('playbookVersion5')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.2", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "QualysVM", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Qualys Vulnerability Management solution for Microsoft Sentinel enables you to ingest host vulnerability detection data into Microsoft Sentinel.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor HTTP Data Collector API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n
\n

Data Connectors: 1, Workbooks: 1, Analytic Rules: 2, Custom Azure Logic Apps Connectors: 1, Playbooks: 4

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -7770,13 +7728,13 @@ }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId1')]", - "version": "[variables('analyticRuleVersion1')]" + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId2')]", - "version": "[variables('analyticRuleVersion2')]" + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" }, { "kind": "LogicAppsCustomConnector", diff --git a/Solutions/QualysVM/Package/testParameters.json b/Solutions/QualysVM/Package/testParameters.json new file mode 100644 index 0000000000..c7efa9ba74 --- /dev/null +++ b/Solutions/QualysVM/Package/testParameters.json @@ -0,0 +1,32 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "Qualys Vulnerability Management", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + } +} diff --git a/Solutions/QualysVM/ReleaseNotes.md b/Solutions/QualysVM/ReleaseNotes.md new file mode 100644 index 0000000000..ce77f22af8 --- /dev/null +++ b/Solutions/QualysVM/ReleaseNotes.md @@ -0,0 +1,4 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|---------------------------------------------------------------| +| 3.0.0 | 16-04-2024 | Added Azure Deploy button for government portal deployments | + diff --git a/Solutions/QualysVM/data/Solution_QualysVM.json b/Solutions/QualysVM/data/Solution_QualysVM.json index 20c577eb55..82442397ed 100644 --- a/Solutions/QualysVM/data/Solution_QualysVM.json +++ b/Solutions/QualysVM/data/Solution_QualysVM.json @@ -22,7 +22,7 @@ ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\QualysVM", - "Version": "2.0.2", + "Version": "3.0.0", "TemplateSpec": true, "Is1PConnector": false } \ No newline at end of file