From fff0677290ed33b32e3c65cc2f3adc87fc1f0c70 Mon Sep 17 00:00:00 2001 From: Manish Kumar Date: Mon, 26 Sep 2022 17:24:10 +0530 Subject: [PATCH] [SOAR] threatx solution package submition --- Solutions/ThreatXCloud/Package/2.0.0.zip | Bin 0 -> 37738 bytes .../Package/createUiDefinition.json | 89 + .../ThreatXCloud/Package/mainTemplate.json | 3043 +++++++++++++++++ Solutions/ThreatXCloud/SolutionMetadata.json | 16 + .../data/Solution_ThreatXCloud.json | 16 + 5 files changed, 3164 insertions(+) create mode 100644 Solutions/ThreatXCloud/Package/2.0.0.zip create mode 100644 Solutions/ThreatXCloud/Package/createUiDefinition.json create mode 100644 Solutions/ThreatXCloud/Package/mainTemplate.json create mode 100644 Solutions/ThreatXCloud/SolutionMetadata.json create mode 100644 Solutions/ThreatXCloud/data/Solution_ThreatXCloud.json diff --git a/Solutions/ThreatXCloud/Package/2.0.0.zip b/Solutions/ThreatXCloud/Package/2.0.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..f8a94a33eeec8d3979a37b6a51b1458d8608f6f7 GIT binary patch literal 37738 zcmV(-K-|AjO9KQH0000806cvMtB zX>V>WYIARHtygVt+cpsXK4AahpbfAb$Z{HB*bpo&ytHTwq-)T4?SME4Xo9jtHb5f8s&1qp` z^08DjPDI|k)6?VlNqjPqif$OKrss+hLw|eyoUT~G3=>8CrsRgb&*ML|D836KXDcH` z%Bixp-mpXoEmkI;Io+OyMtDP&MnzV5V61s9i6S{QD1;K9>=7O&qFAwYe}G3!e_$Vp zO7U<-xTaC}W=S+lv@eW@Dbx+_*^U zzmqFGWCi6@Ocpvhy%1}mrzW#u-rsV3iuGo_2%uuA$x!`|KgfH0%qUxDrh9(6C>F)h z(XYbL)1xD}oo7^0$jKI#6t3?IQ5C?nE~&l=TL;M<)=p1#yvQe_C% zs#t>&U^1rRsu7Gpa!ND>MOReSuW613R|0LbLL0(4UW{+8bLbIV&s|)<_dZlr6*s}U z)JP@LGBJ8OhSncIb0y*KH>cp@OGus&EHsxI|SdsA327UE* z_72WPQP9Mo0_(yhC)=eE7!|r*Wz6QlhT0?{>GM?QK+~jDXafWm*+q?x6Md&^ES;Ac zg~7oT5SA=~nUuOWsx8u~#k=M7nT>6dcwKTp&1)@|5y{w_-M#i--0scUG+okPIHvy-eW#8&! z7YTn|XxqnnS_yThB}u5B%GUan;1D$LN=`qgZJ@$c;WNUnj!tsLMWq8@@TPxw@Kc5j zKn|u0$11T9-hE*wI7?INCgUrX+U{wUL{L#!Q)~omONIEdNW?K$!_?rQg)S8X?;Zw0 z1skT>lGAotKjL~@(3eV-a?gJpPojEp&opAjE(4=VUs3zB`Ozxw_dy2@e=!ueZEV~a zVxSdkg?y~E(+p#L-v{;)g93(Lu$2P)obUeNZhN=D&7lt_m zl1$jG8oYclA0iWXv&o!Aw2$xz{pLhNER9B9H+*daJtLA$8dh+2a(r?;IsR#K{A7d< zAF6KW(xEC=Us=F&k>^Neo+}}rVDx)zmc(P2UraC3gkPi41E%hIM;{qhSM##_`6A zN6^TP;p{0`R)i*WXvBrxoXtC|{5XR4>>&QeC=fD3bEgMMo~B`gqS2>Co%2O-x(G%Q zSTT1ig3%&~7J>8R@Y{zGs=nF5sl_%^G~J&Oe#ZKdqcQn9q1;=#G2zjm)%G#oT$uL*62_nwQwAIgL1mz<<@&WuaIBOW5o z?2_DDtGnA{FAWnz@6Fy?d$bMbDE*7&ZF^UQte5lN#lhD zXY9Zg$i=w?h6gS>*dkhy!M+e!8In|VwXIU9DOM1LrRme7qoDi*_Rg{|Q6 z=$f>33z=uS2BCP&&@3Fq+7=sQF+qhC3Q~M zAAD)Qzia-}=gfY7S-t1=M-RLzmvJ!6_k;g9-0fdR17>5twEr_2oQ(r7{66gI>8@%g zhX4q?&t>GII?g-q?B|Xnt=$*c)L?BCBYdJ9EYeB+(V!=7=+8dP<2<=#>Di^g?=n8= zg1vP-{nr0H-u38VcrdI$|IpFE-N}XgTb9FZ(C^2I#}b3<6;s-T|8glH#KQlu7$O|j zND12;ZnC%LtKRa?260=UjbX3>f_x+0i0H&S-01*HH0BvDuZd7G$aBN|8WiD!SZ*J^aS#zVvmVWMunEya{ zCc@Pr+Y%rN)blbDLMsBX3+i^bSyF&l#Udo#sQ*5RHp{kbS9jcgn3!=zlp*shU!E<` z!T-NnqsQX_dv%f80GB6j*VT!#xG0nHNWu9`vbE{X6Z4AUA9yuMqsR zT7XMNk-KqPkuBKh{~(^<>!*RtN(<0LDyQZG4Sx?|%UDKcO` zAZC#x5db!@kvv8cBg+sY4IlH|hsV!ythc*j*Qf{V#xN#6N0D! z@uDmThFwWTau*Qj%Goy=@(5!MR8dg{PIbOBShySj zt9rVBc!`>C_viilUw{4m>$AT)@+T+zINE;d$m&@i5<#Gc3}9jh=|)Dd%RMWDz62>i zUNTIC>ElHpsN9=@yhz?1?HG8K_1VqkNF`Nx7HyS z&lY-qE#Uh_$G7{Jo%>%e$#MrPkry0H^l52$zR+EZJS<*IJJ*LI%j1xWqX@eCScN{= zxyb*R^IG9;s%r$WR_)9<_D{7EJr&D$`_!?dj&1a3(B0;`M)scK7OHb~7ZYHyFr?7y z#JWz0OQhfb`f&dkSdaG)MdYmuaE#<{SDJ5tgGqFy{31&@rROO&(#z|&`xmcs2}lo_ zXawUZ^BgzN>X$so?jMj3V7`xn#~w^-e>{Jb1?I}gua@8X|1HlA=U#&tqSL zy3O*b+p$}a&WzUbrP&&2cLnUMN0^2K>utz`sIto8!}9z;6cw z{x1s#{HKBe|676qKL*3qg?73Ap}y}&Oz#_$m!qD`QC82d0B2XXw2^pMJulY4(8op# z_RCi!)y4dgAKq2lD|aBT`qR7bH_h_+(v@5@=7w{1XCIba&$dByxtuQr^Zhk^qZ+@G z{$AM0;?l{0hY0B=N%r=(I!pNRf;35ESk7|~yv6&b(fR!TJ92ngWmooO?+-XG7>*BT zD1RXg>YJnI|7tv(!u{vM;^Dr2|8Rr!+(lfc+5e5mfvr7=?2L`q3V1ys@=gSRpP{aPIB?h*mWVeJ$_xb-wx{4@D(o)GqQD1 zj#y{y4~Vx!c5#7}MwC}GspT4xa~!`ii~2r+`-{BZ*@ z3aH^Yte%aXAqE`wKoH!$Mf>CR!jCs+J=^Wr&VFrX81Wmg^6S%SynFKEzu&;!41sxu z*s)bq(Rn;OH24wx_F}EGL5nm%4oIsnCf{yh{`CnNFOe+wpj}h2F1!>{CIK*@q?3pG zF~V{ZlmnLD_L!pQyh32|R?pQV$gMApe*OB|1Gk3k%O1Q=p4~V*c9xeG_Wb+0uD^J( zx+~5w?;q~ZujjWzF8=b%FLxqHH=YH~*X8%i*OM3K>(Y3J^7^7V;f&8C+1P%pYIyYQ zfT&smQtX51T-x6*zZLWR6LP*^mzpo=-&LMBP!B}U0$9Q;!#&iHR|}uQd&m1Buve5{ zK^lVmc@E9|Jf1)2@pBJ4+7CSVei;7_Ppa$Xpn9sb{wexT5A>%beRkeIBj_u0P*qfe z=VL(!>9bG-hiJXI{^{{PlJwy*ZZUiXw>mlvJDXEOaQEu{OY2{Aernw_;a70z4Xl;V zFfk4yuiid|@|x>IATMOMV7%`$AH67mE#KW$>wEvvxAJN_kAA-;_uY{9ad-70@2PS9 zpixwTSwG(4-NbwQIq61oaBWlQzx2jCgCcLnp_>!S+c3Q?=c9K2Lh$x4 z61To-+(Zon{?svMRrh!9^k6fKWXFpdfzu9>#NM%qOp6G%e9`VgdHOmIo0#r=j5r{# zC$I)17VH}6Z&6sCY0krQ^~1U$*5Y$-@Fh` zH}xcP{>y~zTf6z-DLqao8`Gf^ci|5!$}TNC@M%`P_hYK7!QWKTT@*@1&|R>i&=_~q ztZB9RYC(v28SO!u?W)|68ZTFi6N`3rtAr066h=vLSDUPQ0$iZmt|$vVW#j_FMD_iU z&{eR+H}g5MQo)*o^KL5}C@zl{y~b>`CB(eH;(2~27`*T3wRpl1>j^FM;=~=K-G$tP zYB0*~1J!pln&aAIYD?L|cuYGgR}P76x+~;0ic{-$F6x`w(01$F+8!rx5&+N5t)d-m z(e`>@@3c`|!ir74G{GJxJ9}cTVqu2w6SBT(?kFdo;=+hS8TbUcnH;;koQ?-nFrHGZ zLXG8sDtk^MP)@4y)L_b6v@xamWIAyAuILPUYT?jR)zP|*|L6T*&RY&qHsF*UkY-k& zT$%IweC{)O;jR-)AUU%+UkL4_+sumj*ogH_nPh+)k8ut+8#rT4Q%EzKuR~n6a6Iad zrs=k(U=wuNtdk?bGFoJ9IVT7UB?V!;;*FKES9|?oGwlS~GT=zH$qd^$owwa}R4#O7 z?$&os-rLP^OV4WZ)IjAHCt=$~UoRq0T{mmxN>uuincEZP{gqzF>S)@iri#28VGt!5me#GKkM%4V~V zmMh#Ui5-n6je(}nku6R8i6r?$yrYbjPpBM$g*MC;Php>?|XotM%akA3#vVtCFs1s_v3aXw+d-zNH|BJARlcy z*bECX)vDR0L2iw%-ccy7S1@)ew&!z&n_?PCSc*q)<^eN^Ns?}lnq-FQ+Crn8{%F|h z1w&yUX(FkTn1@YhewFxG;bF>NT>3)h=v0h$u@>ey#%83(?xJ5`?L$KGr!fc{EeGGt z_zoADaw5mMgiiO_Y|@)s{;(x)9Di7-w$ z7R@B^YI$ggJvNJziM2HuG@0yo^RC+5qw@iyj@U-Zj+H^^568_BXV&bru=NS;n5k{d zd#Sf6HlISs>5 zhBLY;QsI#IdVRK~Gr@AmO{5u_#w#Ht20$CoeWoEPJt7{o{ANqcwQd})qOjWE&yRuJyqXo{T7TvSyEi4`$5^|aNrTVF7n;l8u7`a4=ou)elO zJCS0}zz%JM0O+w24b=rR53FJ_VA3cOM}D_R`7cAmu@16A5AF17vLYO)9>V;q~I zOJ5O`GJxVpH#etLT*Ab)N2sI~sm!a3Sy8f9OrrfRyMx)e?{$2}5^5}+gtB4RDSTjt zgElHEs-$b0;{~ZSq83xereli9P-Dg#>d^PJo)))H0aP{BT+cJX)2x+`r2?~_=ZT6 z%WY8B^VQ69_tGRJN3(XYo^DM!4n#(4)ZIv;+O1$8`{KIZn=wQdkycLbBQ@Oz#T2uE z7Pyocd!SqM#6e=Lv6TVLt&J9`Ix+P@cjP)Iyn@ms3&I(uZ%GR05^UY0lXeN)o&HwE zy6aj?DFSWp=QUkORf>_<3N4!>OI$Wbla`iJjnKCH7|M-izQ<}9Q{%?cc!aBkzj9Y2 zcathZBOIt%*o<1ToJ9tKZG3v~g)Euv6mh}MWVPvUU`M}MFIWE3A~9pp+V%@SLr2!q z-lvS~5`3cIwWN<4fudlYL|iVHbW0zOy@_Y(yX`8_m&{bNU?=7mdq?XPqDsVmhr)-Z z%*m=t4ccWArSf3S+p4?Ss^w^c0=5%3Nj09>Zr7jjn<81YTm6=wyWO0?Yu3~d*0S6g z;?Y_H3s%)=4cNV?%`IavX=vNhoiN8 zz>G>j1d^#U>T;ann{m396U~>RP?(ls*Rxh4I^88{DJ!^+YJF}~lea48C%cUlk4t9i zlHx96(gxwy*7YHnG!uW_S7~9;8+YV}FNEmM(Aup%#-jMhk_?G=gzkoPm%hg98v~Zm zsT(WUnq*gICN!P3-Vd3~-nDHh^@HJjqBFfIa1CRYY?r#9w@8|lJTX`W{ydi)v6K|B zl7_A6A`v2)2+H1s8aI>LIOBK_Bu!UXZJCBE%kW~50^dkSwm;q_tm0tnAtjSJ5A%*x z8vC}vN1b?^E9GK`{tpZ1u_GyzM9~jofp^QoL*hN`@ZNjAe(0G|tJJDeOPzWz;@)#I zQJoo)yszt9+;(=k>tAq#9JC@KMF2Q`#L?8-d=tTdeYuQF6ZiZPCxY;K*@!H~25tM>&?Sb#_Zy&7gL;NX-8ww2d$eQzTb;hqk~@imGAjF2F?G!$)L=3y z6fu`%6@(sj6D<|-{@7P<-cTpmR3l$s@t+P-rL&Ek>wVN>$4N|(*~beEj+*KpzeZ!G zaC9fN386U@TJXflyH8ivQ?ubs2U*j2FD_|COSTQPHlff{Hm?yAtDfpyJS@Jxc?4h_)L$uKos#@F4M}5uxicH7iTIp5sD;{6 zD6=zHd&a5D$l-X(l+7_x^(4No{1l5IW`f0gVLg0jaenx$5il(|N29a;=ZQe8IkHsR zivNf z0*qBQQb~gNSMV1wWZOo!m67C`1vGnX-eu|<$k2D7Z#4ycz0zps%CGg8c^xJU>me{X}(E*w`j{LBA-gJf(?k+;@O}{~tJV6+z=n4eF z^o6eJuqF%?ts<|A)3aA2WTN;@$t`SY{Lya+geG*j1o((d36-_Y;GIYcB*Ab!@dIhn zN8j=olxeql4a3Ew`isIvFckpMrYhv>_=fcRk6^{|nVc!;T;83a>d&{028~dW%!cb7 z`P37V>yMpL-IK|kSFYx6XMR+7SXIWj`3$3U9-px@*^n+Yg)Eiv=NEP@9i<7FhW2_Ln6=sMCP*t@de_WWf%ST@+fvGy{!j{k=^o`gT7t?{V5 z<4lDzAz81=StqXlyX6mat^FS0y7(~F4-S<>(a8eE^aO_#aZk`kLD)wnoH{&8ouwr{ z?DWs3+X2fc5B{qzssu0qtTl&hQSds!cLm52L=3DNg28STERv&u8Fa7U4)t_fgThKU zr$7`&?>wDkHL{@Ir1R>5KSq3$y0O$>a$djcCvdl8x2=1#b}=JH7`b|3?;HT^N?n>G zp$Melex0V%40|TaJGyoX4U`zze@Fqi<7tsb*=WPZm75h$JH0{Eg*3l-5~zfX}potkao2E=>Zs`FT|RJBONS+#gCu2c&CMRtIc*)h`Jj zr@4#NomTsJ4y2CkXx>INK>y6UAwlfRYC%P>x;zfFYz}~$gL77CCx_C4-Az?xqn4CH zZBWpBwcBqQ#1hOK^EN?f1L@W@P0a@k5ClM=M%%}HFMo!>vQ4_X%B}WgF+LeDOCd&~ z1ls$X@H#mj{lW|^C$e&)J6`swYF2`IR*U-L2WQuLzx?a?&VHJ$Vak9k4q4_*j!ADk zIk`f_L4nH#?`O~h4V?z>$r3+Sm72+ocxzg@1tV8Vy>ZNq*MH#DVOGngiQyM9uDh~J z&+1l&*zFGR3#Z?!jgT0|K*2)u(~jeL?i{EQR!EF-SpPjHV)c8My_*@$B8d5v-8D1l9=xw@Yc%V_yyxlHkp^fV?hlkIyU_}R)Kd3@XLK^F z6c>ONG&hBs5oVh=`7#fdA^_Ewkw1v}&M(`1OoM*bSBds|{WWO_gDHaD-O`8~fe#QQ zY9#G#K+$l0W{F8AvGS$t5LaVlA2O=DZhImMND! zVyNkbzl*H;xvP|R&IsY>_lR@;#w2l-XweyV-jgQKby2L`6~&o9ND}%^pJeO2V?bAQ zo&BRpTcYxIe#3Txc`}0$P{0S7ZGt>D2aB>7Ti_RaJa+PJYO67>Jsyd;LM}DBy(_y( z6H78Gmo$6Dxl<6tv-0Vo!9fp_LtPLwYPQWGnBvr8U;(3f$rxKGHNl26?=LROJOj<4 z1kuj1cWaMGe<;#|Yuih$)ywt?yu3YnzV~4D5v{b!cCueAk-*_-DXSKbvKL^&Fyllr zv{Y9IwF98W? zUYO6Zy0vPjtgZ~RnR>D4=^}qHLo|RDH4h^@&o`@fpOidogDV8qMo}7lVO*4cVycLQ zFJbma+Tq7;Q$?XRs%XBFld7$C5Bi78-IYBHCwbDWNNQkQaIzzSNX5Lsz8dnhVs2gi z5xyljgj7C$ZTUjQ*E=dm3gr!zU{{txVa`8(DBgsKM9a_?c9W@`&d~@6?+wB%k(0DP z?{*6@k)7)|S&6%^3lU{8EE3UmFQ=Df_|a8e!UFJDt`RBi?Qw_jv~rpZD>1+zNgdCQ zkQ&UE01>nsS$8ywG&ZQN=|6b(U34j3MTNnsc?|AyU+xi-R)1 z!{*{5u4x00(rHzWlY@bUkv(1qi+#m(~HH8$%=79CmbjUc-d zn<%&bry0mRz>$4}cCCDp=!^=~cj++vMHO0A!Fr&LjWXW5;C$1cq+~up;ZMyC+ zO#}{iDk*H8B~C6?SCD}ib8@+V1{t8z88^AXuZUDHgGe|=#{QbT_1zxrrV0yQM@d*g zY~y!=MkAloo6!2g)Z6tQ`X&_^28aob#CS~ZSXTeOMabr9DfN~u zHjB>sbt2n8-N)Mkvtqp6=46(Q*w<)>W4L+L$xegdgdL!RZjm6@C=Pw7a?L6_g z2Qy~`yK&>NBx*KL$~Z?UzuL-py3v~8%-iCKu!v5@tZ0JDAgmW%#2&_KuL)5EE~(!@ zaOtS#d?hwVF4dmUXT~2O#jIOPjd14mAH9Rk{8vQ#q&qBK_WWZCQ+OCPTADU$g>w;+`-So zM`HST{P0VVWV6)*H?i`;jA)`qLvuT^7h;uVbOtI$)Q!PkMJj}Z_BBy9WN9J(&?}Bo zB;oPOHmD;nkmr_?o_Y7T-^z65&JjK2dfJA71g{#)r$1b-O=)sOtVijqm=U+zfwFtr zoD)HAQKwiL3>*>_pzwq z!p@_zTo#A<$gp+S&p&_w7jFpoDCF`g^KSLHgNv)8@&YX|pm#EIN@yZN$BONhFa1@vw8@*LS%H$tN!rcNbCKB6`k!8)v^3wD%c?4jWp`hq!YMtwd=AKFYrC%4gt^HEGD@0~y4Bmd zLl(9Qx!!yR9iVc#;Y_!P-!#T6o3BfRW)*xDTi{0V(3K4hPf|u53_($?J7GO-*aMuT z7Pu26QpNyEecm5IltV7WA|_P;lDp&F^=W#obES zUIMaTHh(mQ{b_Tfrxeh%Vg{mn#JujZ2BNsRFYGKJ)f^zdf;2(`IW8D7O00<1f=cvP zPAZ5xDiFwj@gXT0sB};ElJTs~2Z(GG1&AmJ*(l)2*F@l5WKr6d;dVWN48SN&X$>s0C02YjiZFGARf5o7;r5ee&rCUeWEV&-OZ{u1NA@ zVzy3unt0!*yZpgDtb;^v zl+GZ2I!lC>Ic)?|d6+v41Ud{fik9EkjlJJ2gM4~^Umx3)VbQ5o-GJHjyJMmw9rHpXsSn}I)2|WMu z{Q=R4`mid?3tGOf`x=O_+NEOHQgfIeq!bd$uv4fu=%lfcAU>4`H}pe4)$U`ZJ2Nr3 z%Q6s=li(0j(#ty#UAO3iPO>fA6P!pXqOwq4-%d4DpJFoo_MOU0{$6!hhR7$9;;!ZN z4Q(+89s~g%vvJuE-&Pp=`zTg@@Vo)R6PvwAA5WY3MlBL~aFECBT8N$fHdzRqbcPiFAk(GJzLYnX-$*{%l68Of@J_4 z%>f0l_XObkd_w)n0~XJ-k${e`1ny!nI>P{~{Z)AYDm@p43BH zh|t+1{WTr$_tsmd9> zDKRNS^n>F#mF(_T1+(ME!h1R*!)V3vq!B&fo_veR@yLGV0ZWARu0QoSC~4T%xr4|2 zK2a`Hzc8`tqL|!ZeufC2!*xg0!l0yr?^Z})*~ka#nf=&#*Y`Iy(H{YKW-m|1!y);h znukCAx+XVQT>S3U{Nf1~5tCI|qIIlD4y0tC^;KSZrU!Nl4wbnjg5Tyj-cKR1gK_h*%sF zYul0HmFA#Z)#@6k;yY0mE8daCd5@&p<53jCjc*qZ7U(ZIhkx(feLG`vn9fpKee$UP zfFeZcYnC8%BPFQhLJf&s&ATv)IkhfWe^+=I02#)cUb3O4=3Cjv^OWgMcQ=c-nq9G7 zt`wW+`E$>1p_CnvpBo2?)=*UjEAMNpia&7wrGErs1FvbmR z*--9Kam?d0L)U*IsL4eRH?-~E-}lYm$BVj3#j9$Yhp^X7c@JCD*JQyudZ!HCFG4!L3M!DVda03>!vrsBB{28HLa651?`J=BTr&6#X05j$nSinVKEC`G zW^@e(Er21nI#8vRU@%Xq;=XhQ*A9T!f?mN|l{K^E(#iR-=i|atHEh#c%1rc}KQ#Do zyN<~(KhCg6Qw>xAfDu*pW4}Bo@25P_2$6J9a_33w2<7)6K35&j03=Qm7km9UR|O5} z&vbyfJ_eYb7Cd3RWPzwO57$Tj0|Qit();fe#nnR(!iyjre$ulvCXG3gg(eZ?KF=cg z$-%}gbfU4pVupK!@@u2V&hAjWMFYrHK&! z4_O$BQhKC*61;=E-p{C@@yFJ1ydi;U9@Z&q-UnAjnF**ks2CM$0gg_X&!NH7Kq0pw zv|ghs>NkJ6nRZsFL9d%w1HPPtA&29_7nlN|x}i<0mwYUcyDt1N8;c~}ByM z2JyRw4R3WQw5Q>Sf<4qv4NRtY2FR>2inC4R{!=3hBVa8O3D`_`HeReeL-K#ms-Eaf zi#%Q4(ojxu_~Anf2k*E#(Pdz*4Lr3m9;cAwZ**Tk;(HKjOYE<)fuB|I5E0PrV%EC? zjR7&RDL+tm`;4P8h#=0jV-2J*WAX;RPFVU4oVSr>xBrePj4&);q96}#VWqcpzhE0( z0Lz|zX;Na>5x+M0c?V~#SMhAep&bm6Ss+8%CkQ;q zU%6h-s9E)UUYd#U+7KkIQ#un~d<(Dzt$`z0d1<>X;7DjBO*uLPf4)`71w*gx;%ta4BQWsA|Kx1CEl{IZ z8w|Q|SPTBi#5AJccHuLgYrpoFtHi`tDCZ~FZ_C5N zWTC*g-jl}pIs=SacowDWx$Sd7(cs2P8p|4E^hQQ1Mm$HP)~p{W@r?SL49F{1s{nw| z;XiPwD;?yLAGL9SCS2)z$jUId7CO4Oa-nsThr`TG(U*hiWOezEW4}36pJH!Rh1KoPpxHZAp5AtUHliPvmT8=F!3|eB)&$IBnx0**Z{(jtO@rB@}%Z{J+ zAHi_%NHVjT%iwL2X*+*%^vzfAfRfO|r0_*F9LY{VJ((+o7X<$`&BUOGjcZgcO|N_Q z4IJ3p`NV8$0@l*Ing$SVyHo;8Dj0vberoHcB zYYMv~Rk%d(0_m2lFX-Iv@Vf)*im;QzkGJsna5W`9zWGX#=yjz!2H|PVD6v52$FDTK z764uTE0svb_wJ`>NnJJpMm1y!pe)z$JxO0`PwEe=md?DHKcS`ax`zv3lSQNDvv|*|!XB;JV74^VGLV#V#G`2mb`X{`=ha zYM;D&B758&T4ElHGKUN#|733>FRzO8fW(43ZX>EMn`q|WqD4X&E$#>1TPn`83Sk@T=J{_ve2P9TTD)$?8z0{G0FN(7M#{?HRM;=uM zGjQqkZ37Tzb38eBX+q-_!96oE1amFIXHEwsYyQRPsR9P8(ini?FzlIb77OrD5x2c9pRgBeeG~xvFEkL!8~D{JXyFTpttSc^eXm7HMzy z8)=+D1AewVubi-InW6QL33<9w^qWU*F|KR1+yaJ!M;*IK`P+n99XlgHA{a>7$jEAD zjMVdsU+_GtKWs=QMuVvsFh79{23uZM4wJBtNY*1v1q!}-`_i!k?B`s1_Axtou|6$npK zTxq9i5Xa4NQth1fe6w#*U0Wla`hcJcHYPphyFRCkBhkc;@;+9~bn(So)X8|L1K;;p zdE{x9q^kV4-+|0ma*Dif%M7F~JaJ-dU-$x7_A(R$^XrV1w-%4>-JsDf-D9}$r7OzR z)!sRxiDi)+DjAVyb5U&oWsQ<{B1_qHA8&vzIByNKZv5I?FiMk55m!mAa@UWBSIWn?y@Wp`8Br+9~0?(^QM$(e$rf0%XZ>N1dS~&7gxC{ zv8V--f+y)7>8>J)@YAwi!z;ZxoO-km#kMTf)b~`LmuApF>y*Y1Js1tUXuFr4f&RtL zL)PGQ2PUoVH@AZP76=4pLv;E<(@CF^z3Pzkce-}}-U^b$yfX38;qv*gjPRe@Rr|8c zt>N43#65rUJ!%M0<2}l?GPSLp&jIjpudyDU+KnX4L;i%#<8gNOLa$AjS%Nt@?3R8D z@Dt}eUt&L;aU87|S>2C3oW6Oe#VzEEx>RLadX7^V=t=JY77vOVsv!ccV`LE7rwll?XjUHAW z&TCKAKXd2P8~FDbxFilDTB73qaiN0lXa!O&cQH5>)+F7X*tL7}FF&$%X=*VFhKr8BpHXyjfMf({w(&l02rgr4sk%jWZp;WcO@iG!jvgK1v@Bo!3Ay zfWKk(NlSk|$(?t?AM6RU*|pdG{X^I_JM$wiq-MO`6@Q;Lw6(9V6DEa(sIzmzuzol-DNjVc|8oQD^8fA_ zfe#eF*M>RQ^#F;J{=={riIDx~&GN{PA2)wox>gupwKY(AyR+EzbJrToWPBViDKgt^ z_7i{1rD1m)zXFwgL*3{1F=bYA2{z2V;(nPnX}}e1J}>taFyGfKT*t{&QS*y>DU~qp z77$QGWO$q5)Su8xn`YL-Veh}8it!r>3Q0x(>jLBU=kJTL!9RdB8FgWqOd0rObG!7` zk=%110>Mx+OBxhnQ}uDKvHP{%W`6i#gs>PqOJ1Z3TYPgq94y69)v077g}yO?hqhed zRkawF5Zvjpw1oC}>0fA{xwK`L*n_R??!b?48mUXD{Q==@3oiNH9%25B^jXLtC^=f^YGPWWP6Sr#kJE&-@6!LmaULCey6j}9{TJW+dJ;`t)- z&((2Dj*K=lZOF(gJb(z8>j38bO47%uk^{Ct3E@g#z4oaUv#b-OLfdQek=lbhJQmxs~8 zQUa7nUm=}fNA6J=Z>O?r&FBw=q2}UPNXEhW&XRvpe6Y4E7WR*!0du%+{O=FH7Y0Yi z22dk;@A^KB&wE!Tr~QI>`B^^ko5zBl8Iu)b6++>D#Jxq_VQE9>D1LYD(A)UYfR=TS-p7KSO9mm^bw`xceS_N`S{B=Bq7$a{V zC7Ph^uRsG(?7ePPj_H~$K5*IIwMk0m3uLkV6*H8&-LSy_^W0esEwhMpHkK(U8wJUfGhYym zHc-n_#9vidM&h#HWb&C@Sz1Hy&pSuyaQ-sT2;|5pV{E#i-GCJuIRD}~*{|z@_M56@2k;tR71?9< z=Vn9K5tQL0uilxOl4;lP_7XwmmjKUGj<0>{0oWN|f#zG!dFsvF?HVr@rM$*=$cQ&wVR`!N1{*cAqw&Ciw-TZ^KKJ%GW{Sv_kZ%FP7R6loHp&%ndF?f52!0=Xw zT};CJ_vrl6KY6lQn7gqfDN}TbV4Did`6QT#{r0y(@Y*nYj$WAU%`d4BM09~@PG_axz|Z`{U0K8T zjwNt1_cuXDjKnWekDm(9zkc!faTrlGx1Nd!gdGqE3_PZt*0qibDTk1d66XLoK*zs~ zSRcvPlly6=y{#qM(4-%!L6LkPD09sUBA39{hupg`n3}7HKASHgnB*k5elq#6O zcnJ*sYUL|%E+qLfeix1r`-3PY`LAm|Yu;tigaUevG6aa~$CHa#6$$nB0O)QbH63Kz~c;-H%V>WKw(M$T6o=Y@|9TvlUPD zAT3U{BOm0=B$fp;w~;_9D;%ToITxcL0iur(n`=5;+eKP$P-Q8 z1%^3yHqd(8)_*uWn5vpKQE~4ZS=}PFf&R0uFGq?K=QALW>$KKmx&2!;Ge2dbeT=gm zG#wKJxBV7j`|&m|B326CB1XnU##A+vJ@(;NIj`oVy!o-kT;g>HaZO2lOX?$QhaYc- zE(_fs?)CdO3@k{dq_UMp+WpxtfeW8P)QbIsC@8&Jk2Yc5Fvd@loybuVX*Q7ZJa55u z6&57}a{T)ewE$jHj?>6YSO{(ryFemd`Ww}Tjp%Y1!-|=K0KZ_7VnqJ#)au}$On#SM zQwgAk2HgKVp_|~pPOxBY4bUH*eG~v?mZ|=I4vq%q$QzEu?bG6nk0GA8xbccn!$q7& zdSW3;PZl{Q`;8(jUELUe*oTOeZbywZ`-e2?El8k+z;hPX`$P^MD?H`+-S~gwFqyz+ zO#AQekbYbjqH|FH36&Sfp>C*E=BJGj)5yO!T{RM+`*G`}M8n^Ei4-o4ckxRtL)iH3 zw;K{?16|?_P7i*Y1pbj}!&1;20c?;277*mW5a6_P1Dut7%^LUj^yFwtH*>@|TBpQ* zivgGJm|As@aRXH`R^T{D#KtDk&D5 zsWbo0_X?JxNX3EQILUJRidNGN{%6JGh--&vDA{SN0p~HOP@D!~G|qb-+4ffvk1VmJ z{6}Wz#Uqf3O7xkE_<0|`+9NU~b;XK+;?4KKUPVJ2Nrpj^x5|wN1;H^Yfnz`G5k@K7 zmmR|SmBJp*cY_qB@{>Mv5}jfebI0jU|BI%|>&Ram0zVlmCC${Ha!Y#1aSon}3K<5J z;nn$~MYjF1Hiho2E`cAe?HL)vFRQ^!0p*zug3H^@qBM?uOVA_OCiv#y{IWU3Wz^k^ zn3f1X;qK)IbA+}>S8L>WGF(&d>#=^w7xBSH_a`O&u2+}?%h>&&t`tONr(4-HQ zJMJ^arJ2?yjD8c{kkKTkuER|dXTHNuHNZD{?YgdRnB6&{8`J{9X5ThIvbhI=;v%WE zpj{KZB}+==&tD8q)+g1(K;%;ZLQ}bzV5O|6mzR(NOhB511$3k|B}ZGaC(&%RH?>4d zUah$5Qvjp`P{uOlnCL65U$FUem%oydWrcwN7JelSU5M^kwg-ePK~}uHCN01OsqwsO zhtglDcoPXAy1P0=aj9Wvz63$$N6Fu@?Y=k;QRJjD6rbi7q*HzMH4OH>RmbwBDi}wg z;MbZ|`8*^*9_g$IR96L`c}dbpQQ&lf)C&AcFyYMG0l|O z*wg+e8XBmw`Oy*Xmmwdq%$ZP!rr>5Fxxs%^c3Gz`A1X#UtYFwMn4slKkj^SgHqz}? zH(7&lT|lh@uZ|5qHS#9SX4GvCag_lx72>Y>AvJJjcEHlV-fYBDDTZqCCq7}8QDgbi z2))Ox4b;puez-s``2Hm~75J;w;Ijp@;cr`7l0lJXz;=LkPyGczh-t=COLSr%W`wOM zVlcMAVY+8Jf+*xy0-yxIjyvm1;K!%Hd_n_QnfzA5EecX5)|CJ)fu>3#?|0fq2%?7f zoIhwdu%L=E%s~(^&NPJ$HNFwW14oOu%Hq1w?NtO*YSU>4O>XextFdapvjahp$8s>{}S}gk(TZTSQ zV5r`TO<&l#)KmJjnvbB%(3qn|M)3(mN>N!SOO?f(zk`&)HqsyMvYp-f`}g$wxyRq4 z`Mw8_b-_A3GyTY}jr>4V!&tou%$Bu%olT7r50AA{W$O2F9dBgtO+(g?u0r_+7CX0f zeu#t2e^^o*IprZwIW{eS(R;c%_(vOC&ez+%fi(5q#Q5joIQfS;9%ZXZuYxPhB=S0z zaboVo_(DVl5drnYi3*FwUAOl>b9P2YbZuRkD>GNFT$ziMl*DPwIn$8PIAaG|9;s4&*0svA z;8rES0YHAWTChGq?pMH}@(F6Ef5eXoJhF|>%2%TxpGH(yonhM~qx>NAjzW)j0H3w= zJn3LlB{#hko2+px+w&Q_2S=q?GT|KT6UWUk+Q|cUD2)Tdrx*zir^L)h60k#~z6^*( zprta#ZVGS+5<9X0as~|Lu4e5hI;Z0-GP>Ji;!YEZH&JpyrPGLqgfh&Q3%uL!D@)~I zbRoJkcUXnn2#AjQiDHx%#t5!&mmEnimRs_;2PHY`ZG1C0X2`M^BE!zn*~sWV)S1On zAWN(_0o07fW&q>^dt~g3=*Y?v70`KbC9Wrx8LkC7>a%tTjZy26zyv{rif>B9n9mJn z%^rGI+y|0Ca=}=p%dQ}lfVl?{Q@1947&n15Tx^k22UJ)`Dlt!Sg+?0eZkMi^+;niD z3V8RaD6Ft-E7RkdepvK*C?K_wzD0_jIqi;w9ffn_8Mz_|%vc}9UgdvFc8SU~yruh{ zr71F4hb<*fE?gwgv$6_qaGEGB4xktSCkL#%fyB;yH@4kkz4kzMBo3LixAw@@v@38h zy&~CN(Dy5ExS!)o%9^5rJ&rBIk8?_s;GCu?HC#;*4in^{N?m4Ma9RZu(iY!r(zUzN zbZEZe!ii4xMMa`H2o0@(om3H&ByIUoL{+mR0db&W>i|_soJ{tMfj_eyMf5poHb*^X zT1o_lE_|CAA9^O1h|yHnEfVM>Qm`EEW7N}6t~LPxg-7CTT#vPu^<_Ia8lBOlmU?1uBZJpihL#9}=a`M?mpg5^PCg~LTh<+_d)kX6Rc%&FOE zVwryZlicl*7TOQ$z|+44iOEl~WTesfl%q__Nj!Avg*b5iaHh!Era$UJYqK3|3bP=TVK!Q{c1v@F2;CD@;b#3LMNyc}4%fSrr?jOkjVx0VMA5GzeVl0tP` zWF1`)7pf~#ltU9*D*E<>#x@K#D+U2LM8nZE16cfMo7|Gp)1IfBD8s9Cphj*c8_;Gj z^#xkVtAM8~c!0OucPL!IrwrLU3?a~*tL$Xg%}06OW4dE` zOHRXLSjC0o&dhOdx+#@DMoupJFxI^wh5)}X1jMLh0i+0Q0oE{ zUDRiN+_3h?u-f~4%6U)_E?pyx)% zRGj(93}n8??Mkn2t!6%hCWW|wOk>JphaQg^v%nU-|xW z(vy~fyC}yY9>a@Fn{@jJlw4Md3>K;2?8>ba^jCJE+FfH^g4$+RhD5n8fRIS1%*+lF z_0XLj`mCS0IW-*cYIP22#$lYQeX!pT=^15-bCy+gwBIYWz)0h+ClKg(WbFr-9H+Uk z_tA)&Sb68@Z$}2ptV$d1&_S;l(E4t(3U?%~Q-upsMYttWobczuc%&V6q3AHQoFWU> zQkm6$c|h3Xf*8U5bk<9EOrmvhw91dAIWz;(Dz4ishP~AcJTN$x((F26z zcsN}6-K0o&OG01Z;%-N+WeZQmr4j?E-dnl>w8MO59T8@s@Ks7S@VDUJiEZbYVtMxv zK?SIrNuK8fQF6nzN^d|OEHZlMy6%i)M~kgK+fMK`PR)p!E3W4YaoPpDT9`0v6(5yT zdCl+{S73XMOydbuaYY?44#w9@ksnFJ)T!T%#vG5yVAd(z1K6W6kf+v%Xu>(e*<>}Y=#+-N0v*WQQv4LK>-`=_Ds48ROJzA zrNfmKZ2Dum3T7to+yDVhcf%GE4jN^ZNDw0{9K%Y~+vR%Y^JeQ{ z+2z+N8Df&L)H7;0?J)hR1eqN(CaP2+Gzp0ukv+*+ERiDuhEOapJAoI{&Jpc-=*UYs zBkwO)4y|GixuR)!XE~i^PW6LwEaF%_ESzl@PX=s z6J9w8q9qNXEgF!%X%h9muOnNPeu zIoNW9w+Tk;!BoUuqu)oyGb|EFvF}n7#YV}kKgJ!Tm#4jiz&4BJhFjnhvd z7+ffdw%;BkiXYPCBr-G?#6UC~?E-(5>*99$Fwb!~!D40A=^T30DB2eiZ%M#X9j`Es z7)A~-Og6q^mE*mu3>+4W_hHgON=qwtMbVo(Jf07?*gT{a2(AL7h+!dZ%?*;mmCzo` zfy_`IZhN9h89c#FD0v*xUN$<8piUkw!u=i&jznzjXudP*FOogoC6}9x<`cbAa2J5$ zjpPv1JN5!i-H4tdM$a-$a<-LemJDT8kL)F|C+oKW1&Xj5tyYDp(8~zT1=x-0tQ#NT z>dbSjq~C=)G_mc9g0W<<4XxWcuf?`Ebf<>-R zvp_PO9XF;t-}4Z%Cm(3MMH6eQinZJF8Ups~#;q4ZR}3xRqd%%$!A(2=?fygjauQD-w9tKDk3HwTc( zldOsy3vJs|BB!s)7$Dgc+z<3!LXkGpo34Xcfbvk#$rUvvwj3B~BV6fo7RPRgxyn`DvsUH2$3{Y;!$+zp zvDJ|^_FdlGC5t{rbu2)q*`ODsL1@7tIxHMFO2-8T^yLw62si@{3Z2|%6Ws*n8`k95 zVY+gASr!P+IxHa##I(`)n9Td?(q;r&h`MVyjdlqV3JmKOvC~OR2(S;%l;2B?vhGmG zb~g7mi z4hA(nt7~qmSi9E%!DYXk?g^_nkmBn?G zXlrc^81j`3*2^YLLfiBNtB3Su4yDRX>E{IB?Jr(30 z=q(qb60Awxw;ez2s55Kd@6UU-y@EA)QN>VmAr}vVu?H+=z9kB1M4D^3G_AQmIau+U z+K3Ar>C&q2Q(3iSj0e#2Pz2JhqRL`d0~3uL(sQ7gFB56w$UWOUPMAX9NU*io%(e?_ z#WDO`bPvO&&&~xs%)}5OwwWCS6C5w-6~nCs-6e{!I?)(cTw(a?5b_>}Nirs8thOy2 z1Dq#W=rF0t`$3}g*l|y;)-6JK2pn*FZ*$m0$=2f0zDUA#Ul^fV#QT|Q75PR^%=Oyu zk+89k*4tpgF#e%HY4iY!oSlRP>d$lo-U>rtwcWuYy4{9Da1fwyk{T;>l64JQi9NWi zB8=l^zTeK2uxHJeFaeUtK0Gpe6U2ukp20SR!xD|*B?AZoiy;umt%&G2!;(x>z|2fk z9V!7O(ep7vTE52W!yJUj4AF&yMCaow%mr~3*L9OT;F6}pIA9ek17mjUZ0V&5POjq~ z1}-6-7&(*qDA^BYd@ww&eSbZ&eR04L^8rst*nkbB;bFYyOk&8z2Y${U{29p4431w6 zroV81C@!sZbY>yw(U9c{8CguhWG|k^sObS$QUF+{C;Bq7nohzh_c;1<*chyVvM-|$ zZ!PSRyF2wo8d7T>okTWuI2``#zpi#?syj<*p8DKh@_M7JYS?pID?W1Gb>+HfP5IlK z7G-C6+r;!lPzubKKEiA5eYeBYnD{6i4qEgvQ?K7YLf^OEy%=PAy8jV{>g()VPc!gs z1K;lkCT8MXwyynf;JaqRX8f+r?8A?5A9iJ-t}j(3(o0v?bJj|1v{$*ss&5`EB3?({v7Zg`^a~D{#NhT z4|>79(*CZe^al%dhEKFp!)vd>=N6NHoSe!hQ=gDd3-f4blB!+lH~nVtOTXa?C5ck) z*6^3sitz`%l-~@0?txrmyfe((xZkbtcPjV{_4+P6;V0S;oizUH{A0ivM#{z6Q)+IMq+x|MT!xEBh+zt)c(?e84R+-kuDfy4;VyydG+t z;qfJeyXm)@o5R~(^MZIw+MmilGj_9qcQA88YRga!mG6?0v<1QibF%L{n$*a=&+v8? zpXY9de#^37;IWktui-8~Uc*~?&NDZ|zUfU*gBr2&mW|5JZlm3t|Hgn%zy9RQ55M~0 zi;q-rnYKvjDQEkttmTvqJghana%4uEbfr0B<2>a=^68o6uMDN(7X6i>ybk@TPQZV^ z3?+JY2DkB=`1*Ed+n1=XaRhr?dADiYK9p`U(mbX-jlM`RqT7D^747>3Gi7pN6Pz-ndZb=3H?(D``;~OU9sRj{qSSv zf{o^6S_!I4uIUs%UeZfGn$u||YGC-@j}`LFL30YN#Ea7^o_dm0_wzcBYw)E)Uh>hL zPAgIC`{5rh=PMJr5g=7YC6f|xd^b@s%?G$-Mi?0#B#|&Gb+u+GbGQ`oF6FNB?HZfG!{4s1RCwxX575xN zdD`(we%bHM=J_7gzZdn`#D`tN88yT?>tVy#Ud zPc>ryt|`Qa}-X1?MIo|$h$;ww(!Gh76JU{kD{ z`PCU34QsZ_?{><`h1|xx$-?dF|2u1o+TGFIsxkWP>t97fpCYt9D;_6N_8SlDYMxIoIo>S9 z-E#TcL@XysT2Mw#!tZ4U(i<-&RLx-&myjJsv+M!a2{}9Q{Y0A!|*!!;N{Z^mG5lztcO7RX=WpFv$bQH`}ByK03n;|#W z!>RVAUaNa_(Yn_BtwgW0H>dC;9b9wj4^8e-FF}`__|umOT*6oH`b3HX^T(uv&r>%; zZ!A!~NhAO8qYmwh>6?*gESRh%jqcrF;LAihP23E*u`r2rXmQi_g~FUBZid`gn99W~ zMw^?%3wc`9WYy5NE~|#SZbZ*;*S+W&&RS`Ub-!lL@OHV+OthiVbk)!B=(nsytKn{A zKEqoX{pJ;EHMA7)nb#jHV$$Fd@mu(^aN!J>k9}W)pEeY3R!)3_#zUJg<<))B@abMd zhMF<+F0id1?c7GZ$-(W}|GpZrCK%01q<>YD{XE46KV>;q1JXZp8QiTQ|3cMdnpd4S zH>{~;LD^JG9wskjKijfz)ZZAdalu&qlfD;Q{l)6?hC&Eo%JUk=Fb5gw%G=*6?TsPm-$E&otYhU9i~l65%ghuRNPZQ_Lm{bB1?! zjF(zzM&xFsbsE%&qqp3gZRa-TO%`rX|0{)igJ=*wASTqUnQtMONzPMZy4q7^VC{Yf^7E|yH9?wE`wRMN`>g+GRac9Gfi~KTpEOsN zqJw|;OI}(R6<(3`l8dHf+DTbuF;80Fu4wMdg?weADU}v79yGrSHd8NYekXW_FZ6+z zJT#@!Lc~Z5(xmn8#D1PFeZhZIA}zFYR=yvprdLHD_a21plIj}nOss2o%-dpIaO$P5 z+-@yvxL8l!@ugOh*6?;s^TtbAL-XaV;j!gTuHh$BPjf#|!_C{~Z_q}Q*WJ{&ozj$2 z^En^&%9CnQP&w3lPn^GZBc8l=Tdcq4S!?(!-nEAJx1Y5bZD=%K(;6NfDNdeZt@-oV zZ}79}>YFHS=(N;V-2vc9I%t2%xY`FMHN2Jgf|WLeS_)kG729lidr`v|3;WDQ8zLq++je*(Pa9%?)3J3AdktA@G^`o#Z@GScfOH$R3HfhM>!~&yFE*3LG17eo zcb}Pk=xZ<7zD?)ms{G4TT0(&1e||UDq{{Mdd_sP&=035G%OcT9RvkkRi&`h2VZ33k zAy(r8(G$I=n%=MS(1z#kcnU>)GywUV7Gf4qmj1nDVcp$`rlD&)yBwgE4m4lCVG2s4K1r|Z%5cS zx%j!tTO03&A6y9g(N`a37}q|&^5MIW-hA+OIp1xASA$=gO614Bp8UzYM9h*it1`EP zk;K5!kL);*6fFj-xFs{IxHJZ;09jI{M0&6ODpWLu^LrF)+E5pQ{^)}Be?g>Wrgpr7 z@)Gj>;~$FeRZ-@DTHnxl{q~=~{|0>Hm(!FqsuIjsW`FzrnZj>XsBbERAc)T| z5wBu!Ppi}OKYsiDp-xf%Bd#La?`8@dsgQl&o~frC+a>+;{`(du|>^epF$6@>Z{JoIMl&zwYZEs+{x(NR^34O~iIgum0)rqmd** z{J#L;d5%B7pW_Y>cKOc>H~RYd^B*r-d{x&K&$iai783(iR8U!UqH%$yTwE@^_gj_I zLMy*@G33=xUD+X<3$k=I4*G7ZJUagCTVEgl@$HJ?(!ae7`5y6oq1U5fs;cJw5!Yq6 zp5}-z6yEQKSK=??zwT~7ykNs;k;{SK6QMEwx)R?Jdx`-hk z{}H`T_8-69T(s&CZ>I1IxBJhpG2Iv89*$;WJiKuA@N7j7(4XBuyWi=ma=qRQXK$VQ zOUQkf)BDb(?cdfdw-f7Um2 z|KodS{SsMRnDr;;JoN6I|NdI^&B64#;PeNV3NMMIAUWwrd;3bH^(G_x{`dAqvzT_`%*s1^5c})Ue!vwzC^dhqGl+G zS&E#HGb?YlT$S(l@%~|c$)N!P1W7y^9L|ii5z3XUhIll(8~wtgYw*a!U0lSZj3-4r zXWx>NP}~=q6OFEUb4K`;(D|>8Zhxi{MGnX)2Xmw{UrdS5g(MkFj?a6MQNO49-u1R! zvus)5-pk~dlkc5I{LokeAW441aKoK*G7+QikmQDZ$QR@R7=E6U$z7D)#;k5N2Zr1o zav!~;oI=GH)LN9hN(o(4>_%xyR9l}=J3PN<>P%|-l0+qWh||=GboI|B1p+DQG_tGW z!0|894WFi*Wrb`CjW9{1gE}&|0tZu7)v9b9X*|l>Lb<55sd3y+W$)pHq_K@6>UeiP zk)4hYn_W_`;9Bw*IO;_GVQYI={qtbTBKV=m7c* zljdZWu-58KG%Hd&p|Cq6MQy4dHLkIWj-#c~VVb0{09h~E$cd;iPBQANK@f#@$L)(L zL(T~p7{Zv-O(g8jM306e2O3^HW;D=-BO&o!Sa@N>!V6t%BOrm|MvSi7JYH1>*s{0w zex*;Mbrq~_Yg3=kOSQ&pKVBCfl#WDc!h0qbmqkL0@id$6T{Y>BzyXhdAxjnEMRkEN zxL8akaXi&0$(8pEsnr7$&{v|mEy+n_1vaHT6Fq?|%-aKA`j_%^zwo zbf&%prEBsZfOFDxPn7yL6JJ*PUCrk9LoUJ`dC7Oh_4SO$X=Lh0lTj#Zy38I~v29#k zU3C>gS|KZ|zJVc{LPfNSI_3%E$K8k#gQt z+ScX=72bEPP*AH`lFb%#$5tLc1mf833ntX$ypAUC!bQQtp~oK~rQm7x>+2%j+WyV5 zQDi;ybmu(P)lh}5s-%uF9jioF7vO07Y7{ke_uDH)51ma%_6^9s$Gc|H99~Wi_5{_( zEdO|7IT+-%+ofmB$R%|sUqNt*E-8NVmZgh4I}hi1n5R?zp#N-S7hBXFj3f3gbZ`tT zMUCF5DC6*t7cYMf^BbjOaYS#l{hwE(m+wZFO?5ZutQH3!z-9Z~q0pw`3m3B}D+{`~ z%uk?$H&uHxV5}`>d9jLuA74sj+IuG8c~z3@m~F>zjZh>Sl?tj_Z1HtmYh-N=9DnNr*?kBGV^pA!T|s{cS)%$ zBt^LO=4ji+Ye-74sz1c@@i`T};Wuei5#k$3l3(s9+p&Kgxv0WA!%zl_^{jyXAcbBD z4z)xvT98!~^f)Q*xy^rE>HTj&=)vma#~DX&VIfX!(oObxAD1OHaiOewKrr{jI97 zH~ZQ_AJhwJE6CWhmXn<`WRQ70-&!&&qp&7&!Z^0V`i^UyczZJlC5AOk5Nf@5`C zhtF-a-Pfk|L7Sacs$Hc(2>WML&2KxVhf+DLrqPD_+})TgWk<30SV7Gy3sF(w(%n6& z4Jt(cAiaQS?7ZFqqI1&O1o)n8xP=j9k-p0}YCGReG2_g9*@DCO<5>@;16 z-o-4_W2IKWoB{jcI_AE8NNd(>dQ-lAoVpBRtdV5(%)>)h^M10|L;8BiU$PQEmb5+D zOLpERDM^+S;0`#;a2-n*c8}x*nF((<&*IA6jZ(Ujr_$B^eRf^W{sZB>y4R(LlApoQKYvs>$3cYm16O)EK|CZW&yW8tTM^9oNt+vP`J8bb&u0HyPe-{ zXW|8DW0V_|r*GJ=K&`Zt%IjA@Qay1Ol~k3)SvMZ~EBT6tJHL(RQIeLmhPjT@{6Tyb z(NbkWGBajTBoHulYa5q{MQa*wJ+mGyvndnUPrLLDmDbS_eQ?A@2~%9I=AqR`<_`AV zt;vQ$bD-QP8reo!kM8c$uJj+-D`&z**DT7V{MAOS6x}iV0fg_#$ zjE0?5P&Cp%shA{VB6d0!McUf!Sk+bsPq)+1x)LH(dyyj>u|A+6NCZVuG%Y6&VGh)V zC!P=V*UfcBE-#VLsf)RF+4DzbO{;n99_N`}Ik;s(cQ;Z`{@R z#6s^Nn)`>|ZH7QgJrAb#T^21y)UDMNpoqYEAb3MSaB8IsoP@7WSVD`fFAw%<+4+(c z+qsXWsE;vy?Od@23<}?^FAhwfmfw6*&oneQpD4WQ-cvjcT|AHC_dXHQb?rDgk13E| zrnd*j5P~+p$x1?l#J1x^t$eUbJKIiqLBD1(+iDWAK}5XICEK8&6>$$$j8(?V#{HZc z7=;KwElhgH|6Fm4Va3!F+FhyxkqFo0)7W1UrVkI3iYo^23)?fWk<5C1#pb->M7gr} zoH(?xfuI|9J0t`1rLg$#WN0Jai(B*_! z7lhp$!^#j=86iiYUsAASiwG z2hz;dMKD~1TbVhFi-8-ZvM||uOJ8|C40w-4(q$-ixEqAhv2aSx2CS_OB?eCwU34u6 z9AK=b1P)>G+W`y@VYM;{UGTB4&@i&vwUYY`*TQ!MC}yQ+Jyp^!%PK!nyp*6QQW=V? zoADIxRig*hX~mjJYA!@5I#HZ9KQE|iZubC+mm(Aes}My&b_>N*L5gA`0Pq)Pjj08> z(<_QoMT&x=8nQnmaZxH%6eoP{L6K@olw}M!{75S_5m5Tk#mkS~W>FZ zpw6B1t{kpMR@12GzH~QUUcY(iHL1@;(81lmRfQqQZoQhx%O~i=WjQjsNR$&vh_QKD za^reMWQ2myOl}=wuke)pMFrypd*X^>9B^HUI4MJ1tndW%fopy^UC{9{4+l^KMuGkB zt~I-iutp1N-=mpU`D`VF>SJ10)kYSJO7*9@AaEC%t;+$4EqR`x8~($*`mk~YA~!Zs zs|2-~sh%Tb=tf>!9`XR;3XVKk4=x~&IxTa|$v!?}SJi7j6}OW**s&&?ptH>zzlrL9 zgV+Gmk|M_*Kg9~2NO|i_45odK?pgNa&$5TtdzL-=@`=cvkf#tBLb}uj;HM=)HpHp& z;qP_xVEGpDXnXs&J?;h##mZ;!{&bWk ze~&AR`i8xd0ncT;e)XeprG{X0?MPIT6p464^l@15HJomT7q<{(6w5U?EdTqQS&{SN z5s98lz>Lr#_)W_NW`=u0l&XxwPl-s>;M}e!?IeNjh~rHU%dCB z9xYc%h8k-aOvoF<&i5*rPhs$9Ce#=26Dv=E3xVp*2cFN)2WGP+IsTa&^~Lu=^C!ZL zf+663b$%aai~DOkvn|7s2JU}mIeqcIE-$8(Wb^ozQfSjmXM0m=2p&V+CfqD<4Z3&G zYxlA7gpwmL`n(1CyalQIWSjSLTaflwT)f4N{z~4`Vy3aR`L8BWD5b*oTCNeoRxsOr zbKRq9NG2du@0Iqv(x2c;x0Bp=r8kZTEWN&cZR5>~05puXO)Vu0M0FfhxZb6Xbgy14rkJtF4rJ8#FFU9bg3{I^9?xFbBQGK0-M zTeiI1)fB$A*L~}nga^Uw2tfyDjA-w#v4%N*EADx?==n6&k&K{hjT#%McCT~8+Q#G2 zbMMvfUS*$%=;262PWM@y@HE}^aepOE_tGK;cbmXP)u$iPQZ$)uh0w=pccg?UwCOfhVBaxQWQc#!oxDXZXS$985h};vB-T?1#93w z@KRM&*#p-?a5t_tyyZFn5Z*;4LVKw#66^?)lDO*euQQ6tGK}1gjayYh@llsh+yqCf zO(<3tL#k&dWNd|xp_MbYQgRYwF_o{s9i7ywpx~95%?F^r`N(O7QEW-^#$^v&U+{buBWbA{lL!#-2#S>I;eo zwhZl z>E~W$UJ~zV1>w-oNSdQ?)<>hYr(=f8No0Ia`p6}`C9c=EF6cY%~UENg4OpmLiT{4c!?e>o0YThLfH-|oe_o#sz+AS zXbpYlZoDZ8je9nWHR%XwE9ot?M`YCb1f}yD6C>5;uIrtGx~zk$P@Hn#NqlF8r>q)I z6mKK9IfRc|S?GS&{HPl!sBeLrP!*_`!_D}V0?Vvu%(u!NWKu7j13s>X&p1{%%MZTD^CXHWc8&FJ8lN$E# z6L{%huZ2xEgOgdpT6Z64krb4e>%r#H-xm}vIR2K!={i_JR=cPM9hL)}-LIVRCUR1V z7Rg=|h#&IeT{(*;@mSOtCs|5CA8kW-_fZzz##6=yCn~XAQ>hVkjy}o|M2qX>#k5Mnn6jF853C z=ITmS5a((1;X2RX8TqHigd{k)>XSVn?M<3LXm(TrLF^9WTKGXbc4SJb5!@wHN{q1( z-j~#8gI7qzauHSxyZUija-F-~UU&PFWu+Yu=l@uT&jS|)n zEfEZ-M}nZu#fOqQDks!~yUjHAt)}B>mMC*P+&}nYyifl-&=6r7gZW*)G=yXN$wj>V zr56YNMs@1^AqTUF{`L?px1&w34(TT=zHN zd0&cnW;%y!LG$FjHj23nFCDFymrhs8OCE-1)7!ZFMV#w2t-z zGG_h#ywQOro(23uxyo>6+1 zQ48>HUhYY*E)|!J!Wm5?-D#=LIz2q3ixmEw74iEdez2|A%AHg(A%~}K-bis3DXJF* zHD@K9qaERl3P)s2ji@v#=UbG*$$U#8?5wJBHa%qBQcFr}uesMK1(nM1%1}3rpy!tf zztYxi8;ZuKqK2^#A*jTZwUyr2A| zLcBu?${uq84-@e0cJPTOz9eVoHTMWLIy68X?UJjrdsy@lonkqUXKybk zW@0ui=!U=54Xr5@tW$2f!1$HL!0JK;kZ&AK6dTaXR5YJ1;BJ9}&DO$bpN(ekM1Nb? zHW2sQcDH~$MpZzG0FNP*E`OLI197LG2KyW4qQc*VoqpMMfeVJn>ls~c@nyngJU5NL z9PfX2xxfDv`|mFu4vwprkhSyEoh%6;6QBc@Di+%9@Vl%?CU*><-Ht1U(|n;TNAoLF z@kIYkh!x`}2(mh6QN(E+mGRH{T(3=3A*_wO)>2ND(bs8|y({%DTb3K-2$Ao66ESML zN;@#8{;B*S|5^P*C{j5+joB_@!R6k(3OZlR;)&u!ca3stk$={3o@*mqqpvQNZoy$W zYM`g-5o?Wi=@B;@c7yUF7A`g%+p%zWD167_nSB{ka z4MZ$Y?XJJzys z8OD`1+CwtGBLXNP(8%HLep8AD)bYp!U~LH;{7$~IQacaqmt7uVf+2U=Nf2-$s&D1q z;r;xn2y?`q+8mCQ800W;x^IKA1$ zt4{IQE>yN%Cz&{jWF{b5{dEU4oBHf?i#NW5i*tmX?;u zp)hE{*Ts-0<~`g|f1zQ}mX)dJJ@0A@h}pwKOno5I{uwM?0TUxG^TVk1U(LF* zY^fzLW02g7;orM4VHYAa=f+UDupAy-IhKA_+!Vh0h}^;3A;}GMA|7B(P$yz?7iG6` zXgf++QRQ4WDAJA`(BIxTwt-W9Av=}yzENyFFfX_=c*Xua9Zf{I_8l?&EnOIyF2`$Fc zL>9Vg(!C=EJOZXJRfHGSLm$e8g^p?@^?M-HFoFr_D^cB+WY#;kz9zqpoB4r2#Tlq} z`Q;hG8VsE?AVKLm1qa~1=nvo#%(V!Dy%?dGBQI?)9hi<4cM_$#$1#~bvSQn~YVI~S z91P2zgbCovAPA}ITpP@7``U9WML(CI%2a1#0?DhPFhjy5o3PWBsChS%Y*OKUXV|u_ znqjUT;&N?HsL6R9P2PnNA*O&Fe}wB#r`4~oi*#%IH_K^c^C@_;v9y(qizI8xR4LO> z3aXF!4R1}zR}`-!*?PuwUXxWW-P%)tIeTKYPNvfka;nn#!Ro zk5#SS@BOdKpMDJIpnkeqP}2%?0}qO3%d{>wI-6Fkd8x8CnB~eUVwNncC{TY=+;aoP zmQFK4JtIK9;j*Oq7<&7|?Cax?{DqDVB}Uu7{b6tRwFAX=EFy&itLP&jSc8=d2`Cmp z!9KgDk56sOs!REDRuR73JLL;;CE`rC{03Xw*gS%)@;aCFC7bC$OZg@*?jzvv0I=vJ z@J*55Gp1D>2Fjq+)Ct9Iuj8_JUs`|n9z-}bv7NK>A#$JRHdw=T5`42VT**$(UV{r` zpakLpxsET;6m^ZSn8yf$WENJB_%H{u!Gtl}vcSD+5Twa{0z7}PzwfTxPVuf|8To7) z{XbUUDVm*<7n#hR)jjQ>&>e~!mdz@`!4kYf*_1{U3EvMP;k*4o#l9j^(O7l?X@B6X zW@XrPaM@%yo1E1Y@VRYpR$Ya%dVoaq09;WlQdg4osv|UnthVu~9u(B9izT1yVSQi) zxhQfewbU_gID&W*qg{dv7WoTVt|$$O#G{8u06-_DG6P7bKgd)@dlXf?`mF+Lp`eQv zR<)9M??rN5y)tVCy;09|g#2A%gB(74^*D{od02^ceW%l^f>*bHE#W;N>fghgRCI3^sj`M& zzbS5Iw(5C}u_zK_zx115UnO-6qFdVvud5)eK3*KQAG(sWipz>rYy|srS)y1+bhwco z?r?1e29M1NcH_xv8yg&byPf5I!#1b?(k2$?BtJ$E1@{vYx#=0*1^X$*Q`JY;+pn za!InPzI{Up%m*R$rB5ooUXbw;M1?y--7WT0)%N0&1Qu{)=dW8Dq$`)mf;B|cR#|vuLx$g_BPeNExJb^8!8I|9MK1onTStCkCkm8Ae zDb1Eg460WuG*Q+mHCbf52Z%j1B`-_pOI~>Ps$NZ(T=cy7A()pQ`Kp^`Q*igqY~3u& ztT(er~9^h>pha>duM7!UGZgM zIT|M6WV84URc%>$ih`wV3SR&l`(S+m?IU760aZ8E`hwX*sCq)lx6d9ieCn3mI>E$O z_L)&{O{B1s$8ejf|BdRZ*k z?t=tY2C%t0Ux$1ej@!A z3mxzkolwWlNmtd4t-D`SaI1~sGWJ^uDk`(I4vDA3VTxAdc)M! zSRtmzxgvr;9Y6^BY!O+>6;0B{TJ{#_Fe1e7ND%3Ln{&PL2b;4OldspcZg1Ir)56sat9#51@-6Kh zHRll>LiX(y?8lOZ6`Vp`857@{+SWII##CIUDX=_G9Z${i0$c|nI4KEdbg@|Fv-R2% z9YOTLyB5n$jxl6zaF=+%^~Y+Ot{b_VHWW#(i$)$QMGmBZUdV7UmqGDBG)$$sSCDD)eqzFC?hG1f>3`>>#bsTd28C%0dwV;w+yVW|5qtrK5m$HU^?E#NKWG@4D zAfmw|!a%X=9(8_GU!@*Eob_gv&C0YVz=odp-X9q^dKv~R<3lU=ZNai;V3f;!J+9_GmzxRQ?~fzW+R- zxaSHbxG56qe5WEm$|?bJSHi&Tx0!(HQ}l?KyYIYR{<}-e`yBHKaQp9kdAX}8d~L7m z+A#JZ7}5cDX+5(KtpA|>S@WX~Jj4UW$mfgQkJ#8!GdQ(|bb|ncSBBI$t<2)h$F;FZ z3v_SV8=$GP0Q4HiK8#4!Jn8@L`zEph7@5~>IW+cY*1-zSMC!|NfV2CR6Mlsc{=4!X zG^SD`>Ktuou*|#AKlYN06s$jSFfZcbeFFTz%;(#k5Mnn6jF89}o{~9mtHxu7zFkfS$mBvBjY|sP}n)&~d-MDUv)2ZA&gA4=*bpOj^C zo9VKdbvte+iahvYy#GZbQKYPDNPH;2_Y#YE^Gh!c`i<&T`9lt7k^Jo;T0x&Sy*i}V ztjQKA8aj4JUL{}ARINotFOun2@=y{%B!PdUgWDA+X(wtOZhjoUCcPpxuQFUC|CT<# zNmr^r1wL^uvZu)&eWpbe&z)tuxfDB~Dg7m*(|NCrrYyrtN9*OK)0Og)hn;ID{ZRbn zWT7P}r^~HYwbbLjHo6r%T1Wc<8MFR=-sr#_m|_I1my~LJ$|R&&WXkcRh26GJJy-^~ zF3&F5KKYtvvw~HqOI;_qx>P*2dyys8y-p7g=^};yW<~ryi63n1weltnnfZ1`il<0X zy(p+TE8!gN2wznAA&{68?xt)}3Mbm^nE8%t3oLj3#E*2nMyKas*OSmLw8GwrKqa^J>#D4Vvrd-Tsd0~teb)g}rc|luPoU+WtM7j9i`k`%;>mr$*!bSS5Okxca%*Dq@2m%yabt2 z0F$(YEZEfrpc1l+L+32%Ha||ll92Pm8l=o=f3&xYm#4I^DE&~H0e@11_#B77JqztM(p%EPH3dF#c7vU^JB+rm6 zj;AFIbqy)NXKDU{0zWGfxSf+%iNWDlc0q@w6<5*6)2qwe;A%v5SEIWQcge~58OwV~ z!OF>PJQqJuy$BD^0@8CxQCh=QuJ~j&)!}@B6&6~=%&gpPg?`op;K-M z!T1&bu)6O=YWgbsddbt#SIwsj*zZ=b*;;1pO<;CQ=i9orfwfj0vF7h*K848CR}51L+i`&!DpBI`(LsD{?g%K+wmfJ zz`!wT6+-PcwM9mQpYyrpHJ{2LV4@{WZmDw6cng6++|Vy{ow>j+;*>7(n8Kk~JF2wS zhG=VXs0#DzG|JwUdfzU~4I+Zb(_lo5+OE=$;HiHqf5?AU{}38iPH$NI-ovhMddOO1 zUV6w4^cl@;ac(b@Mn86J8F@L?xUYEJ+ZRR#+V>4@moGm$q+2G{oZ(HM3o8 zv+fXt+kbV>Vf+m|s&aNde*NmlWhS7BoUdsDwfbBJeoeHtY5g16_a-UI`T62HP0G7( zt6V_Bnm9aa$SyEDa5beWX>)c{g4JJCtsPL^5Z~s7ZaqzNy6!WLZVg04i2U;(|3^+1 zl&_iCAX^tNPhNHIqt?~O!o4{!sMcoQMFWj0-o!s^1P&FvA|{C~iOL4&XbSShT%5h8 zKhyvIA5cpH0u%rg0000806cv@6CZZ2wbZ*EXa0Rj{N6aWAK2mp6~I#mFGAou-?005?*0ss*J z0000000031AOHXWqy_*0ZDDC{RAp^&Y+-a|E^2dcZcs}F1^@s600IC40E7Sl0ML>E G0002QU&NXK literal 0 HcmV?d00001 diff --git a/Solutions/ThreatXCloud/Package/createUiDefinition.json b/Solutions/ThreatXCloud/Package/createUiDefinition.json new file mode 100644 index 0000000000..a4f48f931e --- /dev/null +++ b/Solutions/ThreatXCloud/Package/createUiDefinition.json @@ -0,0 +1,89 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#", + "handler": "Microsoft.Azure.CreateUIDef", + "version": "0.1.2-preview", + "parameters": { + "config": { + "isWizard": false, + "basics": { + "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [ThreatX](https://www.threatx.com/products/) solution for Microsoft Sentinel provides an automation approach to analyst for remediate the attacks happening at application level by blocking the suspicious ip and url and also empowers them to gather the threat intelligence data for the malicious ip activity. This solution includes SOAR Connector and Playbooks by which the analyst can automate the security operations tasks\n\n**Custom Azure Logic Apps Connectors:** 1, **Playbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "subscription": { + "resourceProviders": [ + "Microsoft.OperationsManagement/solutions", + "Microsoft.OperationalInsights/workspaces/providers/alertRules", + "Microsoft.Insights/workbooks", + "Microsoft.Logic/workflows" + ] + }, + "location": { + "metadata": { + "hidden": "Hiding location, we get it from the log analytics workspace" + }, + "visible": false + }, + "resourceGroup": { + "allowExisting": true + } + } + }, + "basics": [ + { + "name": "getLAWorkspace", + "type": "Microsoft.Solutions.ArmApiControl", + "toolTip": "This filters by workspaces that exist in the Resource Group selected", + "condition": "[greater(length(resourceGroup().name),0)]", + "request": { + "method": "GET", + "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]" + } + }, + { + "name": "workspace", + "type": "Microsoft.Common.DropDown", + "label": "Workspace", + "placeholder": "Select a workspace", + "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", + "constraints": { + "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": true + } + ], + "steps": [ + { + "name": "playbooks", + "label": "Playbooks", + "subLabel": { + "preValidation": "Configure the playbooks", + "postValidation": "Done" + }, + "bladeTitle": "Playbooks", + "elements": [ + { + "name": "playbooks-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the Playbook templates to help implement your Security Orchestration, Automation and Response (SOAR) operations. After installing the solution, these will be deployed under Playbook Templates in the Automation blade in Microsoft Sentinel. They can be configured and managed from the Manage solution view in Content Hub." + } + }, + { + "name": "playbooks-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" + } + } + } + ] + } + ], + "outputs": { + "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", + "location": "[location()]", + "workspace": "[basics('workspace')]" + } + } +} diff --git a/Solutions/ThreatXCloud/Package/mainTemplate.json b/Solutions/ThreatXCloud/Package/mainTemplate.json new file mode 100644 index 0000000000..44a7ae7aa4 --- /dev/null +++ b/Solutions/ThreatXCloud/Package/mainTemplate.json @@ -0,0 +1,3043 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "author": "Microsoft - support@microsoft.com", + "comments": "Solution template for ThreatXCloud" + }, + "parameters": { + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + } + }, + "variables": { + "solutionId": "azuresentinel.azure-sentinel-threatxcloud", + "_solutionId": "[variables('solutionId')]", + "email": "support@microsoft.com", + "_email": "[variables('email')]", + "ThreatXCustomConnector": "ThreatXCustomConnector", + "_ThreatXCustomConnector": "[variables('ThreatXCustomConnector')]", + "playbookVersion1": "1.0", + "playbookContentId1": "ThreatXCustomConnector", + "_playbookContentId1": "[variables('playbookContentId1')]", + "playbookTemplateSpecName1": "[concat(parameters('workspace'),'-lc-',uniquestring(variables('_playbookContentId1')))]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "ThreatX-BlockIP-URL": "ThreatX-BlockIP-URL", + "_ThreatX-BlockIP-URL": "[variables('ThreatX-BlockIP-URL')]", + "playbookVersion2": "1.0", + "playbookContentId2": "ThreatX-BlockIP-URL", + "_playbookContentId2": "[variables('playbookContentId2')]", + "playbookId2": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId2'))]", + "playbookTemplateSpecName2": "[concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId2')))]", + "blanks": "[replace('b', 'b', '')]", + "ThreatX-Enrichment": "ThreatX-Enrichment", + "_ThreatX-Enrichment": "[variables('ThreatX-Enrichment')]", + "playbookVersion3": "1.0", + "playbookContentId3": "ThreatX-Enrichment", + "_playbookContentId3": "[variables('playbookContentId3')]", + "playbookId3": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId3'))]", + "playbookTemplateSpecName3": "[concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId3')))]" + }, + "resources": [ + { + "type": "Microsoft.Resources/templateSpecs", + "apiVersion": "2021-05-01", + "name": "[variables('playbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "tags": { + "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", + "hidden-sentinelContentType": "LogicAppsCustomConnector" + }, + "properties": { + "description": "ThreatXCustomConnector", + "displayName": "ThreatXCustomConnector" + } + }, + { + "type": "Microsoft.Resources/templateSpecs/versions", + "apiVersion": "2021-05-01", + "name": "[concat(variables('playbookTemplateSpecName1'),'/',variables('playbookVersion1'))]", + "location": "[parameters('workspace-location')]", + "tags": { + "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", + "hidden-sentinelContentType": "LogicAppsCustomConnector" + }, + "dependsOn": [ + "[resourceId('Microsoft.Resources/templateSpecs', variables('playbookTemplateSpecName1'))]" + ], + "properties": { + "description": "ThreatXCustomConnector Playbook with template version 2.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion1')]", + "parameters": { + "CustomConnectorName": { + "defaultValue": "ThreatX-WAFCustomConnector", + "type": "String", + "metadata": { + "description": "Name of the custom connector, if you want to change the default name, make sure to use the same in all ThreatX automation playbooks as well" + } + }, + "ThreatXURL": { + "defaultValue": "provision.threatx.io", + "type": "String", + "metadata": { + "description": "As per documentation of Threatx use the default url provided (provision.threatx.io). If still required please change Do NOT prefix with https:// or http:// etc" + } + } + }, + "variables": { + "api_host": "[[replace(replace(parameters('ThreatXURL'),'https://',''),'http://','')]", + "ServiceName": "[[concat('https://', variables('api_host'))]", + "operationId-Login_generateToken": "Login_generateToken", + "_operationId-Login_generateToken": "[[variables('operationId-Login_generateToken')]", + "operationId-Token_Refresh": "Token_Refresh", + "_operationId-Token_Refresh": "[[variables('operationId-Token_Refresh')]", + "operationId-Get_Post_IP_to_Blacklist_Blocklist_Whitelist": "Get_Post_IP_to_Blacklist_Blocklist_Whitelist", + "_operationId-Get_Post_IP_to_Blacklist_Blocklist_Whitelist": "[[variables('operationId-Get_Post_IP_to_Blacklist_Blocklist_Whitelist')]", + "operationId-Create_Customer_Rule": "Create_Customer_Rule", + "_operationId-Create_Customer_Rule": "[[variables('operationId-Create_Customer_Rule')]", + "operationId-Get_Entities": "Get_Entities", + "_operationId-Get_Entities": "[[variables('operationId-Get_Entities')]", + "operationId-Event_Logs": "Event_Logs", + "_operationId-Event_Logs": "[[variables('operationId-Event_Logs')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "playbookContentId": "ThreatXCustomConnector", + "playbookId": "[[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "type": "Microsoft.Web/customApis", + "apiVersion": "2016-06-01", + "name": "[[parameters('CustomConnectorName')]", + "location": "[[variables('workspace-location-inline')]", + "properties": { + "description": "[[concat(parameters('CustomConnectorName'), 'connects to ThreatX WAF service end point to runs any ThreatX supported API get/post calls and gives response back in JSON format. \n\nNote: For better understanding , check https://support.threatx.com/')]", + "displayName": "[[parameters('CustomConnectorName')]", + "iconUri": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMoAAADoCAYAAACuAXuVAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAJOgAACToAYJjBRwAAE6hSURBVHhe7b1ZzG7ZWef3vPP7jWeqOsen5sFVhQ1uB0MHx7StDjQQQyRaQkgZ+oJL7qJEUQSJhFrAXUBcwA2CdDeWkgYEOO6ICxCdRIIEgWOwG7sKyuUq13Cq6tSZv+Gdh/x+z3738eeihtcu6nx16qz/9613T2uvtfbez389z7PW2ms3zp8/v4yCgoK3RHO1LCgoeAsUohQUrIFClIKCNVCIUlCwBgpRCgrWQCFKQcEaKEQpKFgDhSgFBWugEKWgYA0UohQUrIFClIKCNVCIUlCwBgpRCgrWQCFKQcEaKEQpKFgDhSgFBWugEKWgYA0UohQUrIFClIKCNVCIUlCwBgpRCgrWQCFKQcEaKEQpKFgDhSgFBWugEKWgYA0UohQUrIFClIKCNVCIUlCwBgpRCgrWQCFKQcEaKEQpKFgDhSgFBWugEKWgYA0UohQUrIFClIKCNVCIUlCwBgpRCgrWQCFKQcEaKEQpKFgDhSgFBWugEKWgYA0UohQUrIFClIKCNVCIUlCwBgpRCgrWQCFKQcEaKEQpKFgDhSgFBWugEKWgYA0UohQUrIFClIKCNVCIUlCwBgpRCgrWQCFKQcEaKEQpKFgDhSgFBWugEKWgYA0UohQUrIFClIKCNVCIUlCwBgpRCgrWQCFKQcEaKEQpKFgDhSgFBWugEKWgYA0UohQUrIFClIKCNVCIUlCwBgpRCgrWwG1NlOVyeTMcD8jbP/PPkLtuhqpcR8Ob4PXR6pA4suPIaoZvwpseOII3O3b03LcKr8ObHPqm3Uc33nDHKrx+V2J1f4/8HRca58+fP77c18RRIjQajVzWBDG4r9lsflO8W4LG6tEt6hqnwXZVPh/ygtByM3cZs+UKa1U5OT2xXDZuniWq4+wjUVNxs0qCa+Svjs1pXLsrVbzVrQGurA7chNtzQmu1t8qjWh6NV+19Q5D/N+C9X62CfC78Z2qrA/42LSSoc4om17PCzXw44D1wj3cw7yE3p0FYVEndTKDpTTkG3BZEWSy+cXMlxOu3bz6YW0gUc8pHmw+O8igo5I+45n7Xq32VwMfSMucRdlXlbORleA4R+He3oRJ6d7BuVKWF66zSX0TLa15JUJX9ikApXObhsfrkanX1k0eqvWZepVkfq6Gw3sRN9rFvcTQeOR7ZbKyuM6//yPNZcv7NYhjfdcsM6k3vw6JJ2U3QyERssGw0OZfrzDie7CH2HQduC6JMp1Pu3zI6nU5uTyaT3O71etHv92M2m2Wc+dwa8xaAZ9VCOBuLdrS6PPVOK2Y87cViEvPlLFo88E6H48s2ZYXYCgDHG5BlGRznYS8W82i2JEQjpk2ui2VzSfkRsgZCo1A252ggavHWohXD/jzm7VkKoem05g3yMQ9OnbUpUotT1KzsMJBPckG5UvgkGuWdc4xSpfClxM7bxGFpnBUUdk+UMApwbiZZvb8KtItGzC0/SxVNk/LkfsrQnlkWtCknzlmOuxygzGqXBdeS5ULV+scV5L2IziTzaXDdSbpli+tmaSBNsopJcxbL1pJzyPAW4z1PFLWHN0rNIVFmkGI4HOb+drudZJEgbrdaPBrivuvwgc744aHPl9OYIUwKy7KNEJq/2sOH7wNvbOaDXaZGmSNm1e1upoR7bYg0aaVGME4SCmGQiBDN5ZLlfGOJTM8rojRm7FeYFEDL0TVB7oF5k45StYAomjnmA5HS6rO8lLMdoywDESgSBzgtGsTJFUvJvYVUpMh1WV7TNS2WriYjKA/XLvGz9jcDyESp2DYz19nVbMey10meeZoVnGWXLPlcuXFLrnnSHkAuro0yJjdJo0lhXVcruT5vTymy6Rai/D3UZpZEkQhiPB7nDZco3W43ieJ2Hd51kEWn3YlOsxuT6STGUWm8RptHyENdQObJdJwPebN3Ih+sREnDKZcpb7ntsY61J+cpMClBpsX+SuAUQDQWf/PFlMofAmqSNFxy2LQRfS0SNZdKtfVWRCFeu0HtnSUAEi1vGREkAvstRUehZ78Edtso9a1V6N3T6kyjJXlJI32M1fkVRVwlLQR8htbKCowTLadH1TYurUQWXMuwNco81DANyeORzB9kLcR+NEpmUad/C3FbmF61SVWTZYYgilrTHCXKLdEoCLs1aMNaWGkiYBilgGhGVM9ynqZRj78sPeVazvUwKqJUwiYpiNPChEMwUFPsqx5HJWykD1k0YpaYlrJgQZwGhFq2q9o+SdhS3CrhWqCBNOnekCikNYcp7daKKEnMVe2sqkm/SEEnpbznkMRF7lugQSQEe9EIapVOd4bViTmkYGvakaSE8fxlw/tjMchzTJm8HM6lqKxbUolSLY0/hnTC65lzokSq/BML7sn8ct8znWrzluK2ceYlhCSoieA+iSFpaq2jaebxd1urWJbZFAHhgbcR8rpslmM2Zx8C3Op2qBEp6wihtDxW2Aq+5VulYzkt+ZRrWCLUqVEUbHcSf4HJ5YrC0mddD21OHMkiNY2L+OITIH3WukjhjHhvrVGamFWsm4n5UUsna72vkEzimN8syVSXNMUW4kvcatvqfjkfc82aX5xDuks1HcfdzrLhh7QpV3+pD1alVV29pSfffE5ZGIiJicZyxjlZfLKYc9z7kuzgYBuSW7ok9C3GbUOUWhCF6wpnrUFqQdWhvxWwHJ1eN9o48WoJdhAkMQvupj65D5kthAt73+cKaRqUU9G3nqTeXNWYEYedBn6OfoeCYVQS0EdQ+BBKzZeewkoaC80PhGdBJsq5ZG0hZPj5FKEdU7WLB96QKNbWLQTOApFHi7AkXpVQJYDka+mmXYiixtL841qUVYnfoIzo9azUl1y31+tFLHwe7lTbZLWfIs3vIrqUpYkTnmRKwmAicjS1KyprwUV3Z1YDOv+UxWOkpyvToIwLKh8SynLr07h+q/GeJ4pkqDWERFBI9U0kRm1yaY65z2N13HcTaTQgRAv8hfkYQZvawNvKhoV2q8NjbsR4gqZDmLsdy6dTrklGPJZLBKehaaMpxfZkt58E8TiSljlkPtTgSwTVejTG5KXpRnU7lwBJCI4p+IsOQelp4hRjxL0hUUiTzTlkarHdkIypNVg2qGCU8tQYlr8V0z6aQn9oxtVwXy1vc6azzTVQDsvkdTVw1i2u9JH2eW+SlYD98zl5TPaRcuNSxrS90FjUHtl0TDTNxd60W1UEEEo/ziQWPnvus9ejb9VCc7Ykrpd6i/GeJ4pkkAg1YSSETcIudeptAXN/mkMr3+XdhsKQzjWhg6C2FD7ljQetqFBgBBEB4oEuFiP24LAjtG21AKG9mCBsOOZJGsxH43N8dTaBX/br1CoxTQTYmlxxtBn6sAs3qZ0XzU7WvM0lBE3ThXvQxnRZESXNliMaxaZWfYflbJPNMS6LWoOg32PqarFFl3TaMbG5lutrUps3SasLOdrzGecto8fSsnDTU0OZRZaZ67cCo1B53PLAErYncJD9kHja6MS83eE6vETykfhois5ik0QonxqT7QYqcsm9Mo30yfizOZ6rNbNbjtvC9Kr7UTY3N+Oee+6Jxx57LE6dOpUtXjWOmmLvNrxhs+UkNcbW1mYsx4u4cvFyPP3k0/HC8y/F3sFBtDYgM37KZDqMDrVnH8tiE3JvtJexg9B2s5JHJK1FJ9ToadKomaiPrVGpObP2VDTmLeLj83BtBwjvZbTBIXnvI8RDBHgyaVNJKJQ66p6C5lFruVSqSK5pM619HSuiNCVICx+jMSIHfR7vG0I/73EfEWiI1IRAXWr/LUypbczDTbSB6y67RB9ThgmmmxVBMxs4EGp/tZkyPfNlu2eF14gR2gHFGAeEw+mcss9jgOadcQ+itZPxvbstrmvZIl3SzH4c0yZKY44PqlY6BrzniaI5JQnq5aOPPho///M/H/fff38SyH1HCSNZ3m0oDD7bORpsNB7FxkY3RsNx/P7v/1589g/+Xbz0wouQo4/GQedgevURrOXBYZzb7sXj95yNx0/0o3mwF1uYPH3IMsOESYHWHFOTUGObh7V3zfumJotREM45GugAYXqFPJ++MogXDhZx0NxA6CGnyoSoWkTETo0gAVROi3Y3G7cmwznEbUFaaurxYUwWYzSDJOsipD1Ix32E2YvpILqTw3hotxtPnN2Nu7rL2KJsPcq8TSUgvcZoRTtfyRHBpoBqFU02nwOaIP1uhRuNN2l24zrC/syAcl/fi4uDCRqmTSVA2SUH5y7RME3It5Bg3BX7hrJvhaTVKxIvb8Qtxm1hetmaVWuLD33oQ/Gbv/mb2Tv/V3/1V3H58uU8LpHqZuRbAR9jm4c8U1Agw8f+4+/hMS7j3/wv/zr+7f/2O4gmWmRjJ4YIYWBmNUeDuLvTjO84f1d8/313xdboILYQ0lP9dgy110mzahiQLKavwKgKFDxSRjjTxCRep2OXYTNeRtD++tJhfPn6JF7FT5ktN9BCvaqznTRb0m8GWRA2e+TnvQ7OfiMmo0lsQZot9s0ow2iKZoF83W4PoYcoI/LShJsdxvZsEP/oAxvxsQ+cgij4XFQMHTUpGlN3fIINZemb+DaSWzNsaTO3sgxhfC7273Ra/ThYduPitBl/ee0w/sO1vbg0QvSpUDbaW1iKU8hKvmhBiTK39Yu0NM8chWCjwhz71uvPtG8xbgtnvm7N2t3djY9+9KPxi7/4i/GFL3whfuu3fiu+8pWvpL9Sd0beCtPLLCYj7HXMmJ3drRjNx/Gf/diPxP/0s/9jPPPMV+O//+/+h3jyPzwVp0/fjakxgdQjzC4EanwQJ6nFf+jx++MhauyNw4O4d6cfo9kEIV8gpJWppLehwEmStNEVfAkEkRyisiBfW7euIIDPDBbx5avDeG5/FDcmUKO9m90vOEUIHEnggLcIiGxMMfsWnDfHlOupiUlzimk4QjCbaOVeZ5NTIT9pLsfX4xTm1z1b/fjY2Z14/FQ3dvRZZppkS0iFr0GZ51NKyP2Qltkczr8VRl4AUr1AA5F9NPpbcQVSPbM3js9f2Ytn0WpDNEwj8K8Ci8CKLlvGyMN0kyg69pRI7YQmSqK4nlrl1qK1s7PzL1fr70ko+BJlNNLE2UjT64d+6Ifi61//evzpn/5pfO1rX8t4WXMRZtgN73aw3yMbEg6HEGEGEYbxyiuvxPl7zscnP/mp2NncjSe/8rfx2sWLPOR2+jHIdgypnSfjaWxDFomzg0OxRc3fmA8hCbU1AtZFSDoIA3Ju41DWqgpfB5IoVgqN/QxSyD6cbh8NgEQuqOknxBnq4CNQthJ5quZLtnB5j5b6QsTGLtMPWky5lhRQnPhuPxpoKk7O/RuTK/HgRiMeO7MbT2Aq3oPgb5F+j/PsJ8p2BspsIwPuC86+LVI2A0BmSqcsV4M0KQOmmRrwAibX1/b24xkqiGs65m00GM79Us+eiDlcRnNNqpGAWVhRpBZBo1QdrOAWVIavx3ueKLXJVTcBowHjh3/4h+Pll1+OL33pS7G3t5eaxpYwYVz9lnc79DqYLltbmFeIL7XfpSuX4/nnn48H7n0gPvWpTya5n/ryUzGVGJTvEDLNqLl7Pco3G0UXk+g053cRtJZ9KDBCgWhT42ceXIdawHafaQqcNTdEUZgQPIfE2OLbw5zqILVdTJfRdBFXIVF2SvKnaaTJYqNBCptaiWNNGGgTr35BA0HFlkNoIQvxZ+NJNNCA97RH8djpzXjo1E7c12/F5mICiWdZPmQ8RqRFEqRnut7zihQiOwtZn6Zg2wLYxUwcx7P4ac8dHMRr5DvFFGvgV9mi5/U0IXNFFM8pRPmWoZbQB1F49EHOnj0bP/iDPxjPPfdc/Pmf/3kSRtQtY7VmebeDjjwLhLwRV65fxU9pxtWrV2MfQfjoRz4aH/muj8QhGuflF16OPZaHOMbNLmTf6EVjhE8wmUcP57ntCGhHBWs5ol24zGzZ0T+eKrjsnuATLJGNhiQisBvFYM0d0SeulhYGF9ptEZemxCX+jMKxyG4Le9QlVaVhEEOEsoGwqlkaHWp1SO/RhePTxsPYxLz60F3dePyurThLRbCNJmpPbUZGUNGEuBmYm/g8pmnCppxCLkHweyCi5J64jYYbYjY9efVaPL2H5qXcA7RXtDYog83R3JMVJd7LRMky3A5IkwcyqDHUHpJHLWOw1at2+G8ZEFCzM2yjGdQwluXzf/mX8dnf/2z0exvxL/7Ffx0f/kffFePpKEmeza6YGQOMqCsI8d9d3Y+Xxs04QGDHMAUxTeGaISwKoQaTtrq6YcZ1G6YwxqvUcc5ukgkaC+1y11Y7HtjuxX1orDMI1JZ+B2ahZpSFbOBsa+Y0tOckuiJHni3NMNK1pU1H/cRyEh+ANw9gbp0nvc0OmZDWhDTMuy6b3Tpeu8Pp1SDZeZh9O5YborJuvD1+Xhgv4oXhLF4ZzeMG2meBJmk3qDDsqTcdKwnirn7ek7gtiFIToCaJxNAMO2pm1YRx/7sesOVt1dJv2jvYi1OnT8VwMILMU3yQUfzJ//nv40//7M/i8Se+I/7Zj/5IPPjIQ/gSWykRU5gwa2zGXmzE84N5PH04ievsG1BNT2YQIsdtaTIZfDwVLcxPTTKbaFD5SgHXjSqZawLNJ2m6nd7qxKO7W3HvZidOEr2HhqmG6SOcCKidjVTl3kog4WzSJaCFGjZzo0nOdpbx6MlePNjrxmlibFBB+Z6M74E4IkCCNBB+27iyj8RA+m3NLw5aYriDWZeljBsQ9clro7jANV5je4QZ5jspapIOZVMhObw+L+6bUD3z9wre86aXUDg1d2wS1kf5sR/7sdAf0PS6dOlSEkSNU/szbwXTEcatCXh06fG3S8NnOEcoFIhWB8HzYVOLOqQD+yAd+4svv5Zl/cSn/knsD4aYis/HcDSJfncjcE9iMiWvdjeuY4Y9bGceiWgO6Qz3qGl14hUiX321f8Km6DbnLdEgGiudHhUFlcOA+HZCThHiFvdhA9t/ipAeYtoNSC9flEKsNdBspp0i0A6NdwSw4q5mXHBfG+P9ONGcxCMnNuKJMyfjIczEHc5vQZJ2y3tiyyLncH8sGzocolI2yteB1F1yyEYGbyUEmKa2asRLe5P4fy4OYo9nOMTkGlFZLCBNB0en3TZ/Kg7J6H3lh6fi7fQ2VmlJSJeaXuzIR/N2z+ddQJbvdkAtxJowdSuYy7rvROF2WzLZIvVmwTR8MIY6rufVL4OZjsu3Ctbivo67sYkJQc1+uH8Y3VaPZ97KNKcI85ef/Jv4g8/9fhwe7Md/+k//SXzvd380dvRPOH97exvZbcUete0Bgvb09WF8/XAc+xBtiQmphDi0xcaqfIkLgfQlQVvD2giWcpLNvQTNHQVSrrcWsziNv/PwyW48sNuMnXCoDFSyiZYnLfE2uFetYQfSaYZZm9vnMYyt1iTO9Rvx0GY7Htxo4vugQTC51EYORNTVd/Ru/qUmWEYXDdgcUxLuxWwDgYfw+kVNh6ngmzw3mMaT+0Ocd7QvmsR2awmW2tEGh0zfi+Q69D+4iOy0lBzacGo7ttRiC+1Ma6hjIIm4LZz52pFXiB988MH40R/90ay1n3rqqRTMEydOZAuUzccOc3H9jYLHFVLNN+O5XR+r/R4JJCnN0/zeLGhy+MLRCI3gcJrt7Z0qzf5mlqe/Qe2JObO7sx3f/4mPx87WRjz7ta/Giy8+T03K+UjtEJL2yfsA821Geid2N2MXs2kTAWqgFebU+mnvQ0YsIsQMQWJdR9c+DDwQRSfL0lHqMaEQ0djd5hdyXDk4jIOJ/SddKmRFdJkjAZZDRLVlaxc1vx5TYxDneot47EQvPrSDb4I2cfxXRUTKakgNJAkqn4mbEE20llI8xi+a9ygX64vsV+nGBQT989evQ5RJ7Dd3OQONgKy3KaeVi3zw2vy16CaeGiNzYZMI/qlRc8RxhureHwdui555Ta/aPPrkJz8Zv/qrvxrXeQj2o1y8eDH9EwmloL8dvNG1Fqo1hGm7/y/+4i/ir//6r1O7vF1apqE2khyf/vSn4+GHH840LIvnSuCDg4Mk0U//9E/n/l//9V/PUQUS/N577814+4cHsT3Yi3MbrfjQmX48caofH9xqRg9/Z4HgT61OIVUHJzzfIWcz3951abkpyyw74qjVvRZ39HpxcTCLL14cxlf3FvHytIvm2sRMtNJR6PsIO2nHMJbTgzjTmcXjJ7rxEc0u/JwTXp9j2ViiOzIPzT6XPgWtOce5Oey9gR0myafYk100YhNSXhos4y+v7MWTo0G8Om/Hldlu5iupcrlCjhIG7qqerteltmGLa61sLn0pUcWl9Lm81bitiKKwfexjH4tf+IVfiA984AMpiNb8+ijGc/3tYBzTqrWGGsTz1Sq/8iu/Er/927+d5FOI36r2Mj/JYAfoL/3SL+WIAZuHJc/Jkycz7ZpMpu/2s88+G3/0R3+UIwo8N30v4rRmQ5zmadzXW8YTp3vx3XfvxBlq6c5sksP47fdIP9xalqeVZGDpjCTJI64lDRMOOrpYv2Ha6MXXD5rxlSvz+PK1WVxAwBakr5B3+7uxGB9GDG7EznIYj+324iN3b8cHd/txDsFvjydoK/wYxVLyszSfNJHIyP4RN9UMGxxvTtAqI5gEQYf9bfLbiz99/tV4jfNm/RNxfYpZejzy/Q+G22ZQZO1/WIN/6lOfSmGUKO6XQPos62gU4Tmm63mm933f933x4z/+4/Ebv/Eb8dnPfjZee+21zNPwRpBkpjEYDNAkD8W/+lf/OokryRx/ZrqmXxNEAkkKocn45JNP5jHfXzGNDv5KZwbBFuN4aKsdH/vAdty/3Y8zeMcde9Ixwxwm6XgtHemsbPmpy2fFa8ORb0hO9aiR2WZvJy5ONuNvLk/i8xcP41kcc/2IaWuGb7Udk/3rsYEme7jfjv/o7HY8cXIrzkLOLV8BcNxVSgUaAzLmqmYV6aexhIbzXRGd+y22+yPiTCMO2r14Af/kLy5di//v4pUYNnvR6u/EYGE/mIncvrhtBkUqFIeHh0kI/QwFrXbA9S9qwrydDWucmnQuFVZJ8rM/+7Pxmc98Jv7wD/8wNcrbaSjP39/fjwceeCB+53d+J0cH/MzP/Ez88R//cZ5nsFwujVunpYZxHd8wl5qQbeORX29yGGcaU4S2F4+f2YpHqelPdqkorOFxnB1RC1/8Jz7Xwvmu6/SbulbLlI0pNXwLMlyZ78SXrkCUVw7iGe7THI0ybU2j06NCuXEt7p6N4nvvOhH/+NypuBfTrzMd4ZrY+05c1JaNE2ov89Cs86Uq91dEUdM3ogdBNif4Hc2NuDDDL7kxjL/cux4XxouYOOjGnv92NWDydsZ7nucKfu1H6HzrKLuu8Hmsrpk1ndxv3DcLHldQheeoTWpymY5pXrt2LeO8HeEkr0FCCYV+hpCZj/tNtzbP3K61kPlIoOyD2duLPuVoKkidPr5GLy5Pm/H1G2PCJC6jSQYIWHatpNrIrEBl+tQ1XJpj6WKrVny7pBk3xtO4MDyM17iWQ802zCTjSYTO4Y04geZ4YLMdj+xsZL/LjrpiMo0ZfpFD7v2jyN/Iw+D5ECX3sdSfmGCLHbJ+HUJcmCziacyuV4bc741drmkT3wUDrk7kNsZ7nih1jayJorDVxBCaM4ZaQBVO479ZUPgNxpN0dUtXvc910zaueb0ZPGZ8z/dcNVsNty2TSwln2epyCdfr8ifJ2J3D6ZGmaQst2ezHpWkrLgwm8eLeOC4eznC5EU78juyJJ6TZxT5Wq0Aavmfiu+exhPD4NC8MhvE3Vy/G08Nrca29iHa3HT0i74wizqBJPojT/h1nduO+7XZsNfCXMLdsflZpocNSkxiqUrPkeswTHZPvvKTvkq8Jt+Iyx5+ejOLLB4fxwngeA/tKbA62R5RQ0fr2Rn0f3rOohVJBU+gkjaSolwqbJLKGFnXc14ejwlr7C9bwCrNpmHbdfCxh3g6WSzIY13Mti8E0Xdbkc+l2jfq4xyR9JZHzHGoyxzGYN7ux6G5SS7fi0v4wrnJtY0XXayAZHWtrda/EbTmWXQ4m437IskRDXZ5O4qs3DuL54UEcONNKG/MIed1i9RTx7uc6Hzi1G7tdRH80jDn5d3uUqW/POY4/6d8UcMvv9bLIwZnstgGhhd/ShpQD8n8W7fgsPuOQ+9HsbMR05PVUmvf9gNuGKAqVwlILnfsMPgiD68ZV6I3z+nB0vyQzKMSm6XkzhF3SSLraPHszeF5NLmEaBvfXBKlJp/YwrsFySlJJbXBfk7gOw3XSPNHmOhedXuzjZ7y8P4hX9kZxdYbWXD0qHXYd7amOO/7IzAkuFtW1mcINqHRhOI3n9ydxEUU34tqyM2/O9ULSPvG/Y6cbD2x14y5I4rD+2ZT7Bilylhgnp3A9M/O+aFraPN3M+QGcxKJJXknYZidGaLqXR9N4hrK+Ktkpuy9pOYTFl9ocHHz765PbgCg1OQwKoXBdgVPAraGFx9x+u6C5JOqavdYuEvFo7Vfn9WY4SrDa1DK4X0hECVfnK3nqc1zWpMlRyI614txuD/8Fp3rWmMW10Tgu3JjH1/db8exwN25Mu+EMWlJ4jLCPcawN7puRpuw5bLXjbxHcP3vpSvzta/hZ7Y04vXl3bM/J++BGLCcHsdWfxyfu3Y2HN/HTpoMk6JKy2VDguym+aSiZethySwg0mbKPS+phum1Coq5aBUaq08bdXryIA/W3N0bxAvGGrU3u6UY051ybvfOoMBuaq9722xvveaKIWsDq9aMCKep1l28VhOl4vkuJUqM+7rF3gqPnv77M9Xq9rNdZ4UTiLqY5hiynN+puIGi9uIFmefHyHloFUuDwzx0G0nKCh1Zs2WPPuQvIMUdzXefcF3GmL48XMW53o4VD3Wyi0XDs29Nh3L3ViAdPbkQXM0zTaQm5qvmOIXnqEe4J+3NOMorUauNvdTT1yBsC2akoGs5gQb7XRvO4gOa6QvrQEsJyEmVwvi/9GV/oypHJ/N3uWD2p9z5uCtURKHzvRLDfKSnWwdvl4ajedr7O6Kwms5jN0XRomuYWtXNvM/aozp+7ciOevjaIl1GeQ461MYG61PbtCZqQdc2d13Cqv3p9GE9fxHmfoZX6u/j1WznrSYwO4jR+yhOnuvFd5zYxw+aVU07RHCKiR+KQeE06W9jqPhtJ0nW6mCbEm8xjynnOmG/5Djnh+b1BPEO5ro4bMWlUs7fktKuYXY44dqYWdXRFr9sbtw1R3q+QRpVHoJZTSG2epWZvYpZhDh6iQdQQz1w5jGdvTOIG/koLB3rGvjnmjmO/Bq0OJto0/u7KfrwynMQhzvwMP2EMmWajSfSo5e/dbsWjO524fwMtRF52XOanK8wZsoi5nYvkbfOwY8l8c1MXSufdcWdJEso0YP0yzvrz+E8vHs7iMJukO5yLCcdFONhRevi6cc64/z5AIcoxQ/M9rR/WkXmreEycGbY9zjqEcEDjtNtHIKfx1WuH8erBysxZ9Y0MF+14dTCJZ64fxvMH4zjE1FoQ3+nrxoMDVNB+nMXvefTUTjyw0YmTZJbZIMBOlOc7JOZpY7MirVw7EBLKoO0UerQe++XSEpNrhgN/DaK8sD+MFwbzuIJmmTQ3o9nG9+OYpmNlwkGWuYM78b/eB1wpRDlmSI65M6VoTuGbtDBbprNhTMdDanVqZRz8ztZWDNpbaI1FfPnSfjw/Qji3T8Zk90S8QM3+5YsH8bXr09hvbUdzZyec1rU1HUVvdD3OxTCeONmPD+e8XJhSk+olL1vbfM893zHBNtJCtJ9G0gpnqPedeofoe8yJJyatbs788tW9SXwFB/5F8h61etXrxA2nvpBkNg7MSB+Cca6jmH3p63ZHIcoxw1rbWlxnOid9QMDsPV/i2GPIZJ9dzz6Q/lYMG/14yV57zJ2Lza0Mz+1N4wV8k8NlJzobO9HxXfTZJDZmh3FPZx4PnezEQyf6cRKTyVkpZ5pr1PjOIpmS7bp5Qox6Aouc9VETiij2qfjS1Bwf8QBCXzwYxUsHk7gwXsbA8naqF7ScaslpYvOFFJwfW9LsBLVhQH/odkchyrFD2wYhRVAdu6VJ1EZQfdOxjWlkD8oc7aB/4MtQB5g9kuPJy4cZntufBMoEU6tNbQ6rqMEX40FsLUbxwK4TROzE+a1udJX6mRSp3mXX5NOc0uRCzpM0VvwOnffTevk+CGVRQJYdW8QacTCaxit7hznt0DW0y0xNkiTh6BRy2zclydRWPTQSRFJB3f40KUQ5dlQiyGOAKDnQEeFUbqt5vRA6BDzn7BpPdI/xP7bjpcNxfPnlS/HFl17Fefc1YISW8ycTHXw01AiioB3uR5M8dHozTvli1WRsvyZCbP+TTrsUcQdLJDmtI/LWmdfJV7NYOiejaMEoXyHeG03i4o1BXBna/NyPRttXjPFtSHg5H6EF7TfCVFNDtSEtS/NJFt7mKEQ5ZuTMJZujmHb2YzTHhZ/1orc8Ge3pyVgMNhF+NIAfJYI5tkKNcahfiW48i7f+3CDiEl79wLl7NyCLfSpsP7yxHd93cjM+ghN/bkkt78R7aJhmy3f20RoQpT2b50dJW2gQ5xhznjBnprcDc9BGy2hWqcUw+662e/Hl4Tj+38vX44vXRzHqbKPtTkVnsY0Gw3dRWVGuxmYfTeL0tvOYHaINpxvRWUKo94FOKUQ5blCLO4jKWt2fypl2IKF1tc20Va1sH5+mkvscizDVB6BGN+hGZGsTPkIfst293YlzO5uxiwPuxA+pSiCRuiqH8qA1HISSFT2HspVLU4tNu6s8OrU/x+H07W5cHk7jWTTJxdE8pr1etHub5EU6+CypnSwjydkyYRntS9HByQ8Pmc/7AIUo7wUgZdW74WmEpaBKHo2jNFz4yYDg5kdTHbVL7d90LjH8BKXTNyWbk0Gcbg8gSTfO7Paj32unVrCDsgXT7OMYaZ5BFMd/+Scv62H15u13J529Us3iRHf7rL+4N4wLV4dxEJ1obexQXN/eRPstq3nWoAdnrpDKg9TS8Xn/oBDlmJEjgVUJq9alXDQVZsdYKcba/3YCqgkQX+RPUqkR5k1cfeUR8jSnkzjTmscjJ5pxz1YzTm80Y9PmYA53EGanXTWqgx9dyU5FVnI2I3wjDlcvgHHY79o32404hFiv3DiM564exmtkdNDeioNGJw6HI5SH8yNL3DcyrMjAzN5HKEQ5bmTnBYLp9KLWwhBknuPp5xDBdbSHNXiOA5tEm31tfAY9ZvtfZs5jvBzHydYsHt7txHfetR1n+zbJ4lTrh6QzDhvknBxx3IpgWyLaA6/ZlCYf0pBEIUoHk2uGNrl6MIhrg2Ec2pnY3cipVAejAcYh8ShXzpByB6AQ5Vhhu1MTrqSBj7RiCiGkmkTojyRNSjC1v0PWHQfmA0vhJ+LcfgtMoK3mLM71mvHIyY148EQv+vgHy5ENA3o6aiwShVT6D3Yw6jvosSRx1CrmSVDmWSRZlpKMnb1uB9JAYgkFUe0gdViLrwLn91w88Q5AIcoxw/pYU8fWp+wNhxR+0DRDE7pkba95g6Dyp6mWphG1vd9W7CPAZ3vL+OCJdo7lOuM7JqartsFvmdt/ks3OUtG+GrSNhPD8lTYgBqYYS4KdhO6dT+bR54zzuztxz8mt2PUtyMl+bEDKnX4fEla97hT3/WZlvSEKUY4ZlZD5GNQqiChapTJnlGY3lVwIghZRk2StP8VxhwRdNna6yzi72YqHtjtx2iSmM+KRIprDFrMcOMlSP0UNJelsU8sZ5NMhIj+OS5YkCsHdziXchZSn+724/8R2nCMPZ2hpz5w1pnL+jVuBBFao1kzT68iN9wW4JQXHCiTL984rI8n3BhUwzBp8FFup/AiQMu6URr73bs/9cjSFLIt832O7j+Pe78T5zU5soTpGe4fhKwntXputZQ6PtzHAEccSxiEsJJ05ab5JjoomGnsSSbMvotdsRx/LrjObolW68eCZ7UBhxRSfZYGP4ufxur4PT5qUqLoOy8u5ttZJyIopHHgfoBDlWIEgIb2zzjBm7RFyZaOstTk+wczB8B1Erp2fxMZnjxi3YtHxnXqEfTGI8wjxd2MGfedOL7Y7viw8jW0ciJbkGC8R9lZs+NFSzh+jTZzRsWnHoI8dk805jdvEt7nXl798zTiJSSmcAbKBmdWdTuIs6X50qxffe2IzPsg5naHvzdifI9EoMT7Mct6K6WiRGqwDgTb6qLe2b/v7TubtL2aFKMcKiEJlPmvNYtmesqqgoll8ddfPWi0robZy9mOiCqMtUcvWNHY7y7h/oxWP9LtxDr/EsWF64R09bZx4v9vYRrN0HAvTRlzxJ2aZEJoEYuTEdmqn1ALkgtqqpjOVRCoDyAZxnM2+h5l3DjI8srkVD+1uxrZNXvMx2aBy7KFsUE5CpUXUjaBpH1D1XkqlsW5v5DUVHCc0uSSMlGCNVYU59xE0j5Q1v6/S8mWsQz9pPYh7d9rx0JmtOGXNPUc7rEY6+u13E7GD0SlPMw2dbluoZvo21PiQSX3ltr3rHqti2qCAecX2lGVtkM3Zllh9zLu7cexPw5ReY8h542wU0DVy0u8WZPKFsxnx56bNMln3PkAhyjGjegDW5pgxCGMC+dKhdpCkPGnrYyCImvwtbLAPtEbx+MlePHGmG3f3GtFD2J3t3g/8jDwB58Xh79kv4wtUpKducrqihGYWmsDcHFIveTD2UA5Vs7TiPSUt+1kcPyahGvNpnOq14v67d+KR0924Z2Mam/Ohs2hk2U3fMqqVKE6+fJasA+8HqhSiHDO0diREPgglSikVCr7E4JjfJZlPx5BkEqcxpR492Y8HNnHiW4vwm8B+Vs4Rv9HAV7DvxaEuCv1CcwthlxK2CXchCFrm+ngWgzThmgh3G22AeacGyFPtlccXMj7i7+QQFsaxXXpMZ2DkvdudeHinxTr5zyjXRM3iRaBb0FYkRd6OQK58oJyY7zZHIcoxQwVAxZ21u35xriBvrru/6v9A44z2Y2txEPfuduKDp7bjrg4Egjh+gUtSqR9yxhM1BcEZZqb2pRCcKGKBwM4xjZzF8cJoEldxuocQawFR1DzGtwPR7O1g1PyzDye1ElhC1hZaog8pz3Ub8aBTsW60Y6c5jc58AFlHsMPhmuRtKmgZ5x2WeHL3dkchynsAVtqOs1K+7PBLqCBcJmEasTkbxN2dUTy62437cai30CbLySwnkKjksPJq9OX1GWyqdebJCec7rmuC8B8gvJcn83zZ65XRIg5ggqOQFWxbuqj6MyUbAXRvdHscQGl/jITt+KEiiHka8ty/1csXw851F7EVo5wOqeG7KMT3GygaY/nNSBsH8kJubxSi3BIogJUQvh5qDmvclKcU1CpkaxSrfsBHZ/2erVZ86FQnHtrBoUab+J1Hn968jVmGArAuV9DbnOfLX7LHlGTNvNOJvWU7Xrgxia+8thdfujGOpwbTeB6iXZ8tY2at3+5kR2WbvBy+YuZTzKmRk/ORxhYHe6x07bEn3I22eOzEZjxxdjPO9uaxEUP8pEllqqGlFsTVGps64uCbiPKNa8xQr9Y4ckgc3VztOhYUorwjVI8OseZXaTgiEaymgDhGCsHNOArwkWDnXhXVdXbJDNY5I/fVsM/i1GY77qEGP4WPYCuVzrev3Da6nKtPYRok0iKuY7nUKvoezQ5+C0Q5JP3Lg3G8dHUUF8fTuIz5dQ1fZYi6cC4v32Kse/6XkAPLjIA2gUiqlm6nFX3SShMPorTZf/dmjzL1YwdTTP+laXNyWm2YX5xGMphsNhebqP9VGb0feQ9yuwoezzhHQm67OLrvmFCI8m0BKUomVC1RfmKt+mjolIeJ+aFXPEOQMW3SBSaeXrsCkS9NOaDQP8dy4Ygsm04uNE0h7zod6aKbjVWB7b/RGMb924t4BE1yT6+LT6CCmeY0qqlUyN/Bxpo8tlf5dqGEywkDqd2nRBos2nEJE+2F4TS+PpzHHvtfHS/j+f05JlgzRvMepIN67J9RrilpKxg5/1eKKsVf/bSJk24L19DBXjzZa8V9O704v9XMIS5zB2NSHmd5abfmEHDENQ65Zn0p7sGizwU49Wqf+8G9wX9a4udU84ERbITQp3K/10iwDC0I5/pxcaUQ5duCRLGeRKB9+Pmwx5AA5xqB53ni+LYItkllXZvxtLHSjm/OqKQV6Kpne9pBPCGZL031ln5UqGt1Hs3pYZztDuNjZyM+jDCeQ0NskoYzNs4kJzW2k0F0ECInolCKskMSSbWnfdbEeccuuzicxLOHo3gWIb6AkE82OnERuf3a3jKe3W/GlUkrJuowpQEWTClTR78IEe2qRVr4OJhjs4WVAUTpNmPKNTia+UQbEp/ejO84aflm0RoO0nfyHHgd7c6U9RGpcz35OsEm5dyCZ5sUl4qGiiJfK0j7U73IRVGBVB2ejhJQLaFBCd527+1xoBDl24KGDbVuVvtoDmtY9tk7na1ObmOCNCCQPeYNCZI80cnFHPIcVFGOjWLffG5zLFqn6wRzaoVBdJqjONlvxd39XpzZ6OWIYOfZ4ox0tO1J9+vAZpatTB5RwM2INB2FbB/IPvbPK06cd3k/+1jsNGwuSQ0fY4zwXRkN4uJgENcQ7gklc0wY+iXTzfrbizF5fjSnKELuy2vgj0vEf2nEme1+3HNqM86hWXw/Zo7TP132qBB2IM4GMb0hVigjCm/wmzL2tZCKTcmkk68OV2zNkPMJcMwKxUaFLEqW5dbDEhV8y+Cp5r+iUompolPdTkiUZGHdh4t0OZDR6l/Rc3i8laeCIUmsZReYRssmwkstPA1MlcVBbLWm2V/x0Ile3NvtRJ80OY341szmWOUrSCqP6Uj7HXqlydasQ4TsCn7I89f24sL1IdoFP2RzlxO6EMmpUSNePjxEq+zHhdE0BqQrUSSlJDZNq3BNIFvA3PY7jiJNIjRXm8rCCcPPbXXjkZPdeGgHf6oxzqmLJgtN022ueZsTNUHRGK0xxTvgQoYcQ9tIEr/x6H3x/nAx9it5iRm4nRKUaBmOC8eY9e2MSkQb2OnpEyDwciElSQFDIDAo0uZ2Zz2hnLWwpKlqUEnmn3LdQyg6WFt+Gm4/uot9NMk8X8S6H2f5DOZNn7zUIlop9Usj6jXP9yHi32dtm8Prce6dH/jV0TxeOBhDhmlcp/IeO7N9o0/cbjR8g7HTjauYcc8dDONrB6N4dbKICQR3KIpCm+lRTl8sM1tfO55BfuSY/cSzEkDFdDHJTreb8eBWOz643Y77bAXDX7EfZzqDBGlu6fHIAkjUQptIGP0W9rYc2+YhyUIeZLG6LxVZkiTuWO0/DhSifFvgkdtBJwHYqvigaVKZJ+m08+dIXB1rH7wvSaWg2Na6euK+b56k8TNuLJfzCX7NME7wVO7B7HpgqxNn++3YsG+d/LKznGP66SZxFO7SwnfmlAm+yY3ZMi4MRnFhfxo3EMRlbxN+QRScek29plOh9noxwol/DbPrpcEkXmGJf088+0AqkUxyV957ahUnnDBvSes7LpapQZo9mHqSgt2z2Yp74cWpDs7+bIJDBMEdDZ3X6/3yFWdYa28q0ATN2+H1EFzUyBL4k+fWO44HXnbBt4h8ZjzZJg9dnaAw1U+0aqNxac2rFmDp++9SR9PDFi9q7aW1tOYZgpLDRmCYQ9pPIkSPUis/vtWL+/qNOKkEUeurnbKnnvMyF3ZXosYS7pmffRcDwnXSdJb5525AlNEsBp3N6GztUpZ2TP0evL4Uedt83ECr3MB/eGGEY783ieeJ7/zCYy5H0qeJSB5OjTqhAJUPRTmIo97xe44Sxcm9NjjhA51mPLLbiYexts7gxG8s/VyrrzD7GoDVB/E5N9Ml4dRKrMPdvI6jyOvjmMN4FFTj8X8sKER5G2Qb/xG47Z6cBghBcyRuTgdELd7IsVZQBwGwxWZh8HEj7NnCRXxbuXTC0xHn9lt7SwC/7b7JsfObkARz65FNnHhJRK080bwjU9P1NOOnC8RSYSJaHpO2fvvxFTTJC37W7nAe1+e+z7IZbYPaC01j2Re2YEHAnLiCY9fmnXgBp+W5w1G8BGExkLguEycIzqlML6+h0m5VQwVko1AkFQ1MrW3K9cB2N0cQPLA5jd3WPnEOSQDtoqSnyOGv5GsEJOh1eZdYNaQ2Jl7ed4IViJFqkhiOA4Uor8NRYiQpVuHoNj/63eFEDQ4lV6d0ur1od5xiVAnmoP+sOotKAuHKDkX3pWhAFgUWIXNOLgcVbiOZ925uxiM729lnskHaM5zxqYJDbZtGWwpOFsEsKtOHDR+kaSmSl/bxN/A7biC80zY+CWaWQ+WdKX+DMvs+Sr7zPh5VtbvD98NPd2OujSf4KqMcTJl9Jqt8zDWFuVrLPG2MsEzOnm8sy9Yjzl2b3bj3BAETbLcz5Tx8knwpzXOpTJb4ZPbSpApxr/fGG8ZWViSaqxVJMh9i5AQZnn5MuGOJcvRLWDUB3FevO6OiSzvucsAg6yIHCfIA7cvwE20P3H9vbG5vxuVLl2I0Hker2/GxEl+tgYmjYHOO77xLDnu801Z3H/nlpNY48JsxwoFvx/ntXpxi2ePJKHjZyGSepGdSSkvVLKzgUk7KZX+KI4fHMPMyfsal0SSuE8YeI1+JmzNEej2styQsJ9kQka1yDjlBI45wQi4PF3EBs01fxTcYbZZVQFNY1R6EiuDVfiuGqnNTw6oqY5v1kzDmPn0syNLh2uyc5MLxwyQK2tfOWs9lv8HKwzFpWQOtVKQUcWkR3Ko00vHgjiRKLfQS4Oh3HIXHZtS2fgxVAfCjpO7LXmv289jy4Y2m4zj/4Pn4b37mv42dU9vxmf/138RTf/Pl2Oz17bTmfARSgcD77TS3otPejjnmxpBt3zRsoz26XWrs+WGcmF2Kx3uH8Y/P9uLDuxvZ5Hp9Mo49zaNOI3ad8wuTaaSpxXkLO/zazRhhgx1CtDFkmLe24pVRO/7ixmF8DYHfQ0tMFUqcaf2AVqODINoLP4/26CC6MLDZ6CHcehqz6HW4F2iaC+N2fPHSMr4yaMRLlPMaMazMewhvF+Hu+JnfbDBYZJ+KWsVpkdzHJcceO2+Q5wai9eGTvfju02qWcezEMHq+o0LZprMuJlw3Gx6a+GTtLmYZfM4vdqWWcVYaAustVGnmYYSbI0ZvPe44ohwlh1/llQhZIwLJ4D63/Yqv8fyy7+7ubpJF8kgWTZfHHn88/ov/8r+Kf/aDPxS//W9/N/7vP/m/4vLlS2mupM2Oz1EREvMJUvmxUNPtoYU6nN/0rcMxwkOa92LY3wdBTnfasUmtaXOASoOqPoVx6mu8lq+L39BRotAGOM/LCduk6TcVb5DOpcFhXPFTcX7s1AocwQvNIuL48SCFOR1/a3fr67SrIHR2ktgkoQmFww+hL+zN4mV8nEP9Cc8xPmZgc+p8X5TPNlv+vcRWC9KlPiGfJemgqVoEaBqnMCEfOXUyThO3PcMEmw/DWWC9Doe5zMh/ysWpOVssbf7Webc+su/Rl8AW+X4MOyhH9aRuPY4r32OBRFD4NUPSFGFdwa+36+CntCVH/Y34+pv0m/gPEsf1j3/8P4kf+9H/PL72zDPxuX/3OUyvK0mu4WgYc4S22/ZdDIVP7TLNwGnR7VEr+8yno2hDlE2k4oET25ClFzsIQhfJQ9GE3x2xR9+XniSL83wtERZNEAVJDaOcNzH1RsR9ZTiKl/eHcXC4pIxoRWpk30HJb5VoLiVBOI8nrobg1ApoG02g6oPwapcuJl83Lu5P0wTTz5msJFTN4zRJEku5VXiWlItV1k2FsqFp3O8+097ttuMRTNO7Ntqxy7HuAvO0UX31KxsSuL7ZDIJRKO+PsJzVCumQteacZc5C3yz4rYXXdMfAGr7WHrWGMEiGGu53ezgcZhiNRrG/b8sN9S3ax/Unnngi/vk///E4d/Zs/NL//Mvx5Fe+gjPfiVMnT8bENGe4xv1eah6bkZeYUEtq2LrvoTkfRROSbCA0Z2HFIyc24j4c4F2I0SNeB8lQZPVFtDbUJlbgpuWkc3ZD9GBJV62Hb3IN7fLC4SAu7I/jYNyMwRStQApqE2vtZTZfVVU1nheCSEBoK7kjYVWGLXZLx64RIMtrpPM8GuUCQbJoltnrnx2mVPOINukg3Ei1GkTjSK2S2pA4ahOd8U2yfnijEw9tbsS57W7sdEhsts/98FsqnAU557A4SU8RLalL/r9BaIrnffAeHBeOMevjgcKuplDwhaaWGsSlGqFeShY1jnHdJ9QmjzzySPzUT/1UPPLQo/HZP/g/4vd+9w8wt3Ckh+PodrpxGrJ0dI6XtvJopvnwV7Ul/oQjfxt+6Gcxinu6ER86vZUvQZ1CzWzOqK19FwTBrYbAQBaDphoJOa3qGFIo4t1+N5ob/Wypeub6QTy1B1FYHy/xO1qb0ejYJNxNsvrh0XwtmGtaUi5HLJuGrU2VzqvML8099cMcgh02N+KlQcSTV4f5otchzj6OVmokzSHNLMXHwZ1abr7Toipwv4M7q4B+wlTb5ZqfOLMVHz67E/dvN6I/2o/Z4DoW5Cjvtd/fU1PWREnnnRVNr9Qkq2D5jgt3FFFqcoiaFDUxhORQg7js9/tpam1sbNz0VVz/iZ/4ifjE938i/uqLX4zf/d3f4/xObG5vxeHhQYYuROxil8/RKrZuWVP6vXbNDIfgL9U2pHeCfX4y7iG0CVYJ8SDIHPFF6hRgW7OqPzQM5bN3XN9+MiWO6+Qzanbym4pfvz6Oi8NFzjS/JO/8HAQmT2W+KYDkmyRRn1QCWBORnRnHPG0VS3NPHQYp9ol8AZK8MJjG5VkDsjhosxJea3xNJJdqPG4S6Vbp+H1I01Gyc5aX8TTuRmPef2KTSqEfJ9WcaNS25qjpQExuVaaXUCrJW+K4pFgJsjg23FFEEZLAoIklcWoSaIK5nOGzaF65LokODg7i6tWrGffjH/94apMBZs5nf/8P4kt//cU4sXsyZiOnMW3FhHMGh4ekjw3OQ7cZlhzS3NN+9z0U+0x2eq34wO5m3LezFR/o60M4dF7xlBYKn+JmEzRLzBfHb1W+rGV2zFYjX+t9bTiLr98YxiuDWVxHk0zQJEbU1EofAknz40IVSRBYhY+a3y9rObqY5FaVNRKIZvBrvn5aItr6EPNsxboOcZ8/WMTXIcslhH4s4TEXPWanpM64JpFBQa9GHbiCrmJHdQc05hZxuttCo/TjQTSo07/2uE8yRGWUphWnyQU1FP83y+dS0ljpHBfuOKJICEkiCRRgt9UiLtUgZ/E7Tpw4cdNEU4vo2H/sYx+Ln/zJn4zz58/H5z73ufiTf/8nkMmWrBbnY3b1+pnmjHRmUwWAzBAC+yrcUFAlqGJzGi1yz5mTcZ7liazB6z4LNQ+ioenGPj/rkHNjcW4XKbI7s4fG0En3DcUXr92IF28cxlWq+XH3ZDS6aj/qdz9hjQu+QBAdP+aM944VcwbHbtsBmNLWAmoqIcb6T9C02Rizi/Mafo/xMMk+7fTjFXY/fRnT7mAS404rWph9E0hvkAjV4BTMMJeUM5tzuWzHsaWf1l7GaDhCi0ziPs59/NSpuHezHz2rBXwVP0Vxk2xKJEWTdHJZctQtYW5LpuNAa2dn51+u1u8IqEE0tfRL1BKS5vHHH48f+ZEfydYtyfPYY4/Fd37nd6Y/8uEPfzi+53u+Jz796U/HJz7xifjCF74Qv/ZrvxYvvXghtvtbsbO9necZNhHi/iY+AoTIzjwfNvkpAPULVRudZnzwzIl4aHcnzvXasYEpNiGeYotnAtmoXjGbfMtwqr/Cvp5NqUhODpshjwFlfBWT6zl8k+f3Z3HDgfGbEIXrWjr3qvkivmqwhmUhcWv3DmaiHZ/sSSG2+ThrajVfE3JBSFuxFPuFzdktzLh2P6b4Rc3pKHbRJHfvUnGgBUdj4nOueSbyYiVetV4NpGQbEuDCxXBSxe9g0kZnI/Ym87hGReNXjn1V2QaG1HJ5fkWQlfVWLdmWJJlNFeuWokEN6TO6IyAp1B5qCGv/Q8wkiSMJfu7nfi5OUdNpdrmvbh2TAGoVNcxTTz0Vn/nMZ+J/R6MsqB132d9E+GYItOaFfggshBQIGlLhEJdOEwd8cKjNh1/SiXtP7sb33H9f3A1JNqezaAz2Y7nlW49Lak4EmHwlTH7gB21iKdQEY0xCxx7O0DbXHGqyB0muD+Ilm4R9pbaLA6+tr9ZCmrjUlDAJVq0bVpLGjhy5TJ6aY8hhHnckQMo31+LgxzwFrdaFNGcwy87vdOL+U9tx34ldKoVO9MnL/pIKxDexVAdKdrWa62ikOdfeROPNO5uUP+KFa5T9yl68en0vSTOi0pEoJqE2UbPcLLdwyfaKlrccdxxRNH/qTsaZwoep9MEPfjB+4Ad+YCVgCMsRknh8G63hOX/3d38Xn//85+PCyy/HNmZZNx10Hi7nOXJXz0L7X2HUtEkN0EYIIKTTj+5g8tyNX/IQgrbtMWrZ2egQ3wITqaXTXZlEyoQlyBe0/EfWfI98hjZwqMk+UuSnrK8MqZWp7ccQpI3p5xuW2H2VZlkJmWnVyPdjvD7+8rDVNKh+iclKCipbU7SYzn9jPIoO5tyWL2ihGU6g7U6hNb3+jiamQ+kTnrUKSZhV5pA9pxPooME7aMpmLzDq8s3LveE09g5HMSTOpLuVlYzXap9Pkpdk0hRz1eTYzqFzRy/qFuGOIkptdg0Gg9QotmxJBAUdEzRehgDud9199qNIJjWKQQdf597zephus0nVF5DCjZA6bsuxVZo5rJEjx+woXChQOPzk3+Np7yANfYTPqYH8fJym1JyqXFu8FoKVDCegYqWlONbu4LQjdOPZMg4QwLFC39uI7uYOte085qODaK2I/u1CzTLB7PI1gOYcEwyStCFgd+F7/VwDBBLo0tyuYMFfL8WYYJRbj8uWMcs/5f7Mmp2Y6ocRrFiycUEmwAoX1Zlsklwu6x0gr2y1fitxxxFFzSBRdNT1U1yvNYmmmISQCLXfIXE8R8JIFImWRKLWG010eqtORd8CzGbROUvSy6ZeHusE27/VJg6S38RMWUCaBul2FD7OwwtAI+ymg17N61UJRgrESlBIEEKPs8nY8vjpB90XyTNFuNoQxdHLth8vx3s3NeK3C32pCcJsKWxizkBh7DhtkvEMLaIf1sX/6HBtOdjSDs482RJrIKVOpdKAXItBzhqjIWlzhkP1l2iXJUTx1WPtvTna1fflPd0KQ02iBtGHkjDCe55+SrV5S3HHmV4KmuaXLVwur127FltbW3lMQhhqzeFx/RkJVTcZSzA7FLXhs4ebdDWx8juM1K4O5vNRWpNq5Y8gSpM8fUkq31HJvhSncUA74MNovs0W2ylENwVgtaKgVOuYjJKAmty5fJUYW8QcOi+3TFtH3fznk2GS+Z3AVjCSl5/k107iN7iGbCHjuBPjpT9DNvXbj44IZovA9pHxMs4604LkvkLsO/0SJV9g85qIUvXdfGMkQr4vTzJO/Of1Swz3yX3HXpqNudxq3HEaxYeudlBrSA41imTQya81hzWypFCjqD3cr7YxfpIKIRpM0URdHq6ahMfvJBG+O9Ga2i+isFTV4qiFaHCH7ahLM4w41q2sVOYVUVu+w57n5CnuShx9MPlNd6lHPNN3Yjl+MxJ7cPip8xFMa241wDuBfTetmR8AsjIgFy6gem2gEnQKAVchvteRYN2mvczWC1WUUweln9XCeTd+Kjqvk0rGZu96bgGKnGM3k1xej1Fcepuq6Jm0xFJZubjVsOh3DFLIeFpqCgmif1IPX1GA3W9tLDHcd3R/CjjBcw4O97Nz0QfsQ0shUSzYVka04FlNwXJ0b9bIHrQW5kk75N0vlOSECzAICz1NsRZer0PsW4bsncAcYZ/v3reQmoZVq56xJhDrfkrbwcQdmcg5mjn1pNrvFCqlrjW8V6IGmaPRuA+alNmZKQmo7rPZ2viUweuoguWtrsF1zbP6HCfkyPf/uScOQetD7p73iPtjyVc8qjgjKcyeZZpcZGSc48Ado1EUcgVWjaB20FF3W1NK7O3tJTHcrslUH5dMMzSN28bRLJvY+95D2Nnn+x5+DUsfRRPMWthvjmibtNuOUM72MOKibezL4In7aWp2QjJq1alvGrJEEHwYcsra1/V8BYMVuMu5Or0QhnPMtxJR0yCpHNpirQsR36E4WaYOku1o/OzfQHtZm+fk2wo15hiZxGI849qMxEnZHAXSFnTpCRAGW8mh994DI6rVHW9mJEck5HXoD8l47xu7tF6TLMTSL8E548ft1RVXl31LcceZXgaJUBNHErhem1615vCYpoPxfWISpdY0wnG4ta2dfRWQwlGzTtimQGUanNrKPnfyQ24UbUQHAaRGJV5bs81zMc9yNC/xFUDPU1hStGqhw2wzT/dqXqVmamqwQx52+86KJe56Pn/vBHY8LnKSPMq3SsrrpDaA29W1uYkr7tVQPrSc6kGNo4SrBozA0pHFi3zhhH8qiGxOxwxzW6/MnnwzsTffpcQUc4iaHaBVxOr+wdb8tEXGuLW445z52coHMYiaNIZ6n9ok91M7ph2dtWBFHk0zW2rYS4JK9uqxKQAKx83t6scP++g7JCrZyaUja/MdDP6SFBrl/BtTocjzDZmcAlQ1sZqt+4zjeyYyy7KlU8xBX6KqNc23i0prOQ2eRSAtyma57QS1OBbBX7WiJhUFSEJbDqNnvCwC2+xrLqZZ3pwFsjYNU+C9LtZN0HMTTeoF7zVmL/cnCbq6f+kL5umrNG4h7jiiHIXbNQHqbdfrkM/ZH+B2apcVPCPPyicNMr5xV3msNv0sg3vSyljt902+NFX0WVhMO6TNfk0dBUH+KRrJHYJucT2QMdN4HTJ9j5CJ/oxnvBPMuU5Npsw874VENAe3KTaFkzhOfkfsap8nEtfbkQ0AbCYv1OCEo73uqwJXcN0LJQW1a3WS9NQ/tBIwTibKZU25P3kC4dbijiLK6/F64tSoifN6fFP8fIA+skoo8sHnShUnN/nx09eqAp3j5BmbzoWVafm8kbOZx1hXvJVzndf021fpVKaXZg+a0O3XwRwr+TGDd0YS4Tg1Oxtv5g8yeX7crl9db6/akJ39pfYtJHkO7GRpsV2xqVfHPJGFXS1reC8c9SjSQTFKdUJWVN4gn4kNG0mqN7oL7y7uaKK8I3DXfL4pC28Cb6xCVcdJOWbb/ak9WLo+0+0hUgqZS6P5Q5BsrtsHkz33bwfMwneK7HBsa8qtykO+aWJZPspSy6od9Ap0HvJiXLGsLFzPy+WntrbeFF5kY1IlnrWEJ9R3x4TYl2rWArxdYu8OLE3BtwOel8/XWvPNgnGyFq4D26vdaWEY56aSWi1NM2VDQTSwmf0HIqXuLUKdyD8A8gUuVJ++Ub6vj6C6njPzK7QrVtf3wJyz6PwQhZ0UiYtL96J+j/fNQp7pupqj3q5BylmruDy6/9bCUhV8O1AyfHZvEfi/KTQiSQBuPm7vvpVlRqz2e16eCDwtK9dMkOVNVr0R3urYt4qVOQmysl+ti2/kglGUZaOcR+J4XIKnTLPhG5tvKeD1TUlTS6KYQr2PpdcsKbVRc3k8KET5NpEC8RahfqQ+d80WCeP+xGpdX7hyeKvjCfblOsvK5GIdQUvRqdXQGwWP3RSwdw5bqGyOtdm2MVNz6IxXebmu6NiUm56FWXtBq0WWYmVaSjk1UkX2Nwh58SzVLHkNhvpmsORQ1frhuhvHg+KjfJuoH+WbyaY31efvM86hT6zXUWvZdlvZa2e7b7Uu8hghK1Plhz/l6W2HmN889laR3h5V/5CFYMM8gasp2yyVacmccwSzJwnEv3zwvijqnmZ5s1nbY2y/IUwwtY6tbG6vGJYpscObYcJqE+crXjXh32ocT67vE/hc8+dNgousfFlxUe9PQXOVn5WMpfbIsFpPofQYy8rkyFhvHZJpxn1nMLWcpRHfoklou+dIjZ99K7kkP3ebLahLKVxWgVhZ/jcKXFy2CHiR3zijKoEgjsRJTWL840NdooJvET5On/NbBW/u0cdbW0e1teHBNK/yKMtaTlb7kiwEOyfTa3jLTIXLjPSOUKWmgBMoQKVfqvWq4FXvkppE88yNPOSRVfmFyqAaROmWP68PgqUnS6ab6WvQeXylh1KtvqlOuiUoptc7QD7b1frr4U21ASf7TgTrtXjU59WH3EhZcV0ysZIdjyxTbtiRRo7H3hZrRXpLOOogy5N5g1WSktqy5oIfh3XVB/PXY3W5XXqB1Ap53tuhPiEv0hNcsn3zJq1wTKZXIcq7jKM3F1H4ZqwOZi18BH8v3k283aN68zO/VVQ6421SPFrwI6tvec1vitdf2z/ctfxD4HjoeQfBx12Hv4fVgaNxDG+O18d8ffiHg8aef38/jyPh6OYRvMnut8HRs761M28FClEKCtZAIUpBwRooRCkoWAOFKAUFa6AQpaBgDRSiFBSsgUKUgoI1UIhSULAGClEKCtZAIUpBwRooRCkoWAOFKAUFa6AQpaBgDRSiFBSsgUKUgoI1UIhSULAGClEKCtZAIUpBwRooRCkoWAOFKAUFa6AQpaBgDRSiFBSsgUKUgoI1UIhSULAGClEKCtZAIUpBwRooRCkoWAOFKAUFa6AQpaBgDRSiFBSsgUKUgoI1UIhSULAGClEKCtZAIUpBwRooRCkoWAOFKAUFa6AQpaBgDRSiFBSsgUKUgoI1UIhSULAGClEKCtZAIUpBwRooRCkoWAOFKAUFa6AQpaBgDRSiFBSsgUKUgoI1UIhSULAGClEKCtZAIUpBwRooRCkoWAOFKAUFa6AQpaBgDRSiFBSsgUKUgoI1UIhSULAGClEKCtZAIUpBwRooRCkoWAONc+fOLVfrBQUFb4LG1tZWIUpBwdug8cu//MuFKAUFb4PGEqzWCwoK3hAR/z9b52UjLkCmYQAAAABJRU5ErkJggg==", + "backendService": { + "serviceUrl": "[[variables('ServiceName')]" + }, + "apiType": "Rest", + "swagger": { + "swagger": "2.0", + "info": { + "version": "1.0.0", + "title": "ThreatX", + "description": "This custom connector connects to ThreatX WAF service end point to runs any ThreatX supported API get/post calls and gives response back in JSON format." + }, + "host": "provision.threatx.io", + "basePath": "/", + "schemes": [ + "https" + ], + "produces": [ + "application/json" + ], + "paths": { + "/tx_api/v1/login": { + "post": { + "summary": "Login Generate Token", + "description": "Login Generate Token", + "operationId": "[[variables('_operationId-Login_generateToken')]", + "parameters": [ + { + "name": "Content-Type", + "in": "header", + "required": true, + "type": "string", + "default": "application/json", + "description": "Content-Type" + }, + { + "name": "body", + "in": "body", + "schema": { + "type": "object", + "properties": { + "command": { + "type": "string", + "description": "command", + "title": "[variables('blanks')]", + "default": "login" + }, + "api_token": { + "type": "string", + "description": "api_token", + "title": "[variables('blanks')]", + "format": "password" + } + }, + "default": { + "command": "login", + "api_token": "" + }, + "required": [ + "api_token", + "command" + ] + }, + "required": true + } + ], + "responses": { + "default": { + "description": "default", + "schema": { + "type": "object", + "properties": { + "Ok": { + "type": "object", + "properties": { + "status": { + "type": "boolean", + "description": "status" + }, + "token": { + "type": "string", + "description": "token" + } + }, + "description": "Ok" + } + } + } + } + } + } + }, + "/tx_api/v1/auth": { + "post": { + "summary": "Token Refresh", + "description": "Token Refresh", + "operationId": "[[variables('_operationId-Token_Refresh')]", + "parameters": [ + { + "name": "Content-Type", + "in": "header", + "required": true, + "type": "string", + "default": "application/json", + "description": "Content-Type" + }, + { + "name": "body", + "in": "body", + "schema": { + "type": "object", + "properties": { + "command": { + "type": "string", + "description": "command", + "title": "[variables('blanks')]", + "default": "refresh" + }, + "token": { + "type": "string", + "description": "token", + "title": "[variables('blanks')]" + } + }, + "default": { + "command": "refresh", + "token": "" + }, + "required": [ + "command", + "token" + ] + }, + "required": true + } + ], + "responses": { + "default": { + "description": "default", + "schema": { + "type": "object", + "properties": { + "Ok": { + "type": "object", + "properties": { + "token": { + "type": "string", + "description": "token" + }, + "exp": { + "type": "integer", + "format": "int32", + "description": "exp" + }, + "user": { + "type": "object", + "properties": { + "username": { + "type": "string", + "description": "username" + }, + "active": { + "type": "boolean", + "description": "active" + }, + "email": { + "type": "string", + "description": "email" + }, + "requires_totp_auth": { + "type": "boolean", + "description": "requires_totp_auth" + }, + "description": { + "type": "string", + "description": "description" + }, + "current_password": { + "type": "string", + "description": "current_password" + }, + "password": { + "type": "string", + "description": "password" + }, + "given_name": { + "type": "string", + "description": "given_name" + }, + "family_name": { + "type": "string", + "description": "family_name" + }, + "phone": { + "type": "string", + "description": "phone" + }, + "super_admin": { + "type": "string", + "description": "super_admin" + }, + "tx_admin": { + "type": "string", + "description": "tx_admin" + }, + "tenant_admin": { + "type": "boolean", + "description": "tenant_admin" + }, + "read_only": { + "type": "boolean", + "description": "read_only" + } + }, + "description": "user" + }, + "customer_name": { + "type": "string", + "description": "customer_name" + }, + "channel_name": { + "type": "string", + "description": "channel_name" + }, + "features": { + "type": "array", + "items": { + "type": "string" + }, + "description": "features" + } + }, + "description": "Ok" + } + } + } + } + } + } + }, + "/tx_api/v1/lists": { + "post": { + "summary": "Get-Post Blacklist Blocklist Whitelist", + "description": "Get-Post Blacklist Blocklist Whitelist", + "operationId": "[[variables('_operationId-Get_Post_IP_to_Blacklist_Blocklist_Whitelist')]", + "parameters": [ + { + "name": "Content-Type", + "in": "header", + "required": true, + "type": "string", + "default": "application/json" + }, + { + "name": "body", + "in": "body", + "required": true, + "schema": { + "type": "object", + "properties": { + "command": { + "type": "string", + "description": "command", + "title": "[variables('blanks')]", + "enum": [ + "bulk_new_blacklist", + "bulk_new_blocklist", + "bulk_new_whitelist", + "list_blocklist", + "list_blacklist", + "list_whitelist" + ] + }, + "token": { + "type": "string", + "description": "token" + }, + "customer_name": { + "type": "string", + "description": "customer_name", + "title": "[variables('blanks')]" + }, + "items": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ip": { + "type": "string", + "description": "ip" + }, + "description": { + "type": "string", + "description": "description" + }, + "created": { + "type": "integer", + "format": "int32", + "description": "created", + "title": "[variables('blanks')]", + "default": 1 + } + } + }, + "description": "items" + } + }, + "required": [ + "command", + "customer_name" + ] + } + } + ], + "responses": { + "default": { + "description": "default", + "schema": { + "type": "object", + "properties": { + "Error": { + "type": "string", + "description": "Error" + }, + "Ok": { + "type": "string", + "description": "Ok" + } + } + } + } + } + } + }, + "/tx_api/v1/rules": { + "post": { + "summary": "List or Create Customer Rule", + "description": "List or Create Customer Rule", + "operationId": "[[variables('_operationId-Create_Customer_Rule')]", + "parameters": [ + { + "name": "Content-Type", + "in": "header", + "required": true, + "type": "string", + "default": "application/json" + }, + { + "name": "body", + "in": "body", + "required": true, + "schema": { + "type": "object", + "properties": { + "command": { + "type": "string", + "description": "command", + "title": "[variables('blanks')]", + "enum": [ + "new_customer_rule", + "list_customer_rules" + ] + }, + "token": { + "type": "string", + "description": "token", + "title": "[variables('blanks')]" + }, + "customer_name": { + "type": "string", + "description": "customer_name", + "title": "[variables('blanks')]" + }, + "rule": { + "type": "object", + "properties": { + "id": { + "type": "integer", + "format": "int32", + "description": "id" + }, + "name": { + "type": "string", + "description": "name" + }, + "description": { + "type": "string", + "description": "description" + }, + "version_support": { + "type": "string", + "description": "version_support" + }, + "classification": { + "type": "string", + "description": "classification", + "title": "[variables('blanks')]", + "enum": [ + "InfoLeak", + "BadTraffic", + "SqlInjection", + "XSS", + "RFI", + "SessionHijacking", + "DirTraversal", + "Evasion", + "Scan", + "DOS", + "Scanner", + "BruteForce", + "Executable", + "WebMapping", + "WebAttack", + "BadHttpCode", + "TrojanActivity',", + "Drupal,", + "Wordpress," + ] + }, + "webtech": { + "type": "string", + "description": "webtech" + }, + "state": { + "type": "string", + "description": "state", + "title": "[variables('blanks')]", + "enum": [ + "Recon", + "Scanning", + "WebMapping", + "BruteForce", + "Ddos", + "Exploitation", + "MalwareComm" + ] + }, + "contributing_score": { + "type": "string", + "description": "contributing_score" + }, + "risk": { + "type": "integer", + "format": "int32", + "description": "risk" + }, + "blocking": { + "type": "boolean", + "description": "blocking", + "title": "[variables('blanks')]", + "enum": [ + "", + true, + false + ] + }, + "tarpit": { + "type": "string", + "description": "tarpit" + }, + "interogate": { + "type": "string", + "description": "interogate" + }, + "beta": { + "type": "string", + "description": "beta" + }, + "tags": { + "type": "string", + "description": "tags" + }, + "matches": { + "type": "array", + "items": { + "type": "object", + "properties": { + "match": { + "type": "array", + "description": "match" + }, + "op": { + "type": "string", + "description": "op" + }, + "type": { + "type": "string", + "description": "type", + "title": "[variables('blanks')]", + "default": "boolean" + } + } + }, + "description": "matches" + } + }, + "description": "rule" + } + }, + "required": [ + "command", + "customer_name", + "token" + ] + } + } + ], + "responses": { + "default": { + "description": "default", + "schema": { + "type": "object", + "properties": { + "Ok": { + "type": "string", + "description": "Ok" + }, + "Error": { + "type": "string", + "description": "Error" + } + } + } + } + } + } + }, + "/tx_api/v1/entities": { + "post": { + "summary": "Get Entities", + "description": "Get Entities", + "operationId": "[[variables('_operationId-Get_Entities')]", + "parameters": [ + { + "name": "Content-Type", + "in": "header", + "required": true, + "type": "string", + "default": "application/json" + }, + { + "name": "body", + "in": "body", + "required": true, + "schema": { + "type": "object", + "properties": { + "command": { + "type": "string", + "description": "command", + "title": "[variables('blanks')]" + }, + "token": { + "type": "string", + "description": "token", + "title": "[variables('blanks')]" + }, + "customer_name": { + "type": "string", + "description": "customer_name", + "title": "[variables('blanks')]" + }, + "query": { + "type": "object", + "properties": { + "ip_addresses": { + "type": "array", + "items": { + "type": "string" + }, + "description": "ip_addresses" + } + }, + "description": "query" + } + }, + "required": [ + "command", + "customer_name", + "token" + ] + } + } + ], + "responses": { + "default": { + "description": "default", + "schema": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "id" + }, + "codename": { + "type": "string", + "description": "codename" + }, + "actors": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "id" + }, + "entity_id": { + "type": "string", + "description": "entity_id" + }, + "entity_codename": { + "type": "string", + "description": "entity_codename" + }, + "ip_address": { + "type": "integer", + "format": "int32", + "description": "ip_address" + }, + "ip_addr": { + "type": "string", + "description": "ip_addr" + }, + "state": { + "type": "string", + "description": "state" + }, + "state_update": { + "type": "integer", + "format": "int32", + "description": "state_update" + }, + "seq_blocks": { + "type": "integer", + "format": "int32", + "description": "seq_blocks" + }, + "tags": { + "type": "string", + "description": "tags" + }, + "interval_time_start": { + "type": "integer", + "format": "int32", + "description": "interval_time_start" + }, + "interval_time_stop": { + "type": "integer", + "format": "int32", + "description": "interval_time_stop" + }, + "is_embargoed": { + "type": "boolean", + "description": "is_embargoed" + }, + "is_tor_exit": { + "type": "boolean", + "description": "is_tor_exit" + }, + "geo_country": { + "type": "string", + "description": "geo_country" + }, + "reputation": { + "type": "integer", + "format": "int32", + "description": "reputation" + }, + "geo_coordinates": { + "type": "object", + "properties": { + "x": { + "type": "number", + "format": "float", + "description": "x" + }, + "y": { + "type": "number", + "format": "float", + "description": "y" + } + }, + "description": "geo_coordinates" + }, + "fingerprint": { + "type": "object", + "properties": { + "count": { + "type": "integer", + "format": "int32", + "description": "count" + }, + "last_seen": { + "type": "integer", + "format": "int32", + "description": "last_seen" + }, + "user_agent": { + "type": "string", + "description": "user_agent" + }, + "cookie": { + "type": "string", + "description": "cookie" + }, + "js_fingerprint": { + "type": "integer", + "format": "int32", + "description": "js_fingerprint" + } + }, + "description": "fingerprint" + } + } + }, + "description": "actors" + }, + "last_seen_intensity": { + "type": "integer", + "format": "int32", + "description": "last_seen_intensity" + } + } + } + } + } + } + }, + "/tx_api/v2/logs": { + "post": { + "responses": { + "default": { + "description": "default" + } + }, + "summary": "Event Logs", + "description": "Event Logs", + "operationId": "[[variables('_operationId-Event_Logs')]", + "parameters": [ + { + "name": "Content-Type", + "in": "header", + "required": true, + "type": "string", + "default": "application/json" + }, + { + "name": "body", + "in": "body", + "required": true, + "schema": { + "type": "object", + "properties": { + "command": { + "type": "string", + "description": "command", + "title": "[variables('blanks')]", + "default": "match_events" + }, + "token": { + "type": "string", + "description": "token", + "title": "[variables('blanks')]" + }, + "customer_name": { + "type": "string", + "description": "customer_name", + "title": "[variables('blanks')]" + }, + "limit": { + "type": "integer", + "format": "int32", + "description": "limit", + "title": "[variables('blanks')]", + "default": 100 + }, + "ip_addresses": { + "type": "array", + "items": { + "type": "string", + "title": "[variables('blanks')]" + }, + "description": "ip_addresses" + } + }, + "required": [ + "command", + "customer_name", + "limit", + "token" + ] + } + } + ] + } + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[[concat(variables('workspace-name'),'/Microsoft.SecurityInsights/',concat('LogicAppsCustomConnector-', last(split(variables('playbookId'),'/'))))]", + "properties": { + "parentId": "[[variables('playbookId')]", + "contentId": "[variables('_playbookContentId1')]", + "kind": "LogicAppsCustomConnector", + "version": "[variables('playbookVersion1')]", + "source": { + "kind": "Solution", + "name": "ThreatXCloud", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ] + } + } + }, + { + "type": "Microsoft.Resources/templateSpecs", + "apiVersion": "2021-05-01", + "name": "[variables('playbookTemplateSpecName2')]", + "location": "[parameters('workspace-location')]", + "tags": { + "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", + "hidden-sentinelContentType": "Playbook" + }, + "properties": { + "description": "ThreatX-BlockIP-URL playbook", + "displayName": "ThreatX-BlockIP-URL playbook" + } + }, + { + "type": "Microsoft.Resources/templateSpecs/versions", + "apiVersion": "2021-05-01", + "name": "[concat(variables('playbookTemplateSpecName2'),'/',variables('playbookVersion2'))]", + "location": "[parameters('workspace-location')]", + "tags": { + "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", + "hidden-sentinelContentType": "Playbook" + }, + "dependsOn": [ + "[resourceId('Microsoft.Resources/templateSpecs', variables('playbookTemplateSpecName2'))]" + ], + "properties": { + "description": "ThreatX-BlockIP-URL Playbook with template version 2.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion2')]", + "parameters": { + "PlaybookName": { + "defaultValue": "ThreatX-BlockIP-URL", + "type": "string" + }, + "Customer name": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant name" + } + }, + "Keyvault name": { + "defaultValue": "", + "type": "String", + "metadata": { + "description": "Enter the key vault name where secret key is stored" + } + }, + "Threatx Key name": { + "type": "string", + "metadata": { + "description": "Your Key name for the api secret stored in keyvault under secrets" + } + }, + "CustomConnectorName": { + "defaultValue": "ThreatX-WAFCustomConnector", + "type": "string", + "metadata": { + "description": "Name of the custom connector, if you want to change the default name, make sure to use the same in all ThreatXCloud automation playbooks as well" + } + } + }, + "variables": { + "Threatx-WafcustomconnectorConnectionName": "[[concat('Threatx-Wafcustomconnector-', parameters('PlaybookName'))]", + "MicrosoftSentinelConnectionName": "[[concat('MicrosoftSentinel-', parameters('PlaybookName'))]", + "KeyvaultConnectionName": "[[concat('Keyvault-', parameters('PlaybookName'))]", + "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]", + "_connection-2": "[[variables('connection-2')]", + "connection-3": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]", + "_connection-3": "[[variables('connection-3')]", + "connection-4": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/', 'keyvault')]", + "_connection-4": "[[variables('connection-4')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "type": "Object" + }, + "Customer_name": { + "type": "string", + "defaultValue": "[[parameters('Customer name')]" + }, + "Threatx_Key_name": { + "type": "string", + "defaultValue": "[[parameters('Threatx Key name')]" + } + }, + "triggers": { + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", + "inputs": { + "body": { + "callback_url": "@{listCallbackUrl()}" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "path": "/incident-creation" + } + } + }, + "actions": { + "Appending_blocklist_IP_to_oldblockip's": { + "foreach": "@body('Parse_JSON_of_blocklist_response')?['Ok']", + "actions": { + "Append_to_array_variable_4": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "Oldblockip", + "value": "@items('Appending_blocklist_IP_to_oldblockip''s')?['ip']" + } + } + }, + "runAfter": { + "Parse_JSON_of_blocklist_response": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Condition_4": { + "actions": { + "Add_comment_to_incident_(V3)": { + "runAfter": { + "Get-Post_Blacklist_Blocklist_Whitelist_3": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Provided Ip's are succesfully blocked at threatX .
\n
\n@{outputs('Compose')}
\n

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + }, + "Compose": { + "runAfter": { + "For_each_-_creating_final_payload_of_IP's": [ + "Succeeded" + ] + }, + "type": "Compose", + "inputs": "@variables('payload')" + }, + "For_each_-_creating_final_payload_of_IP's": { + "foreach": "@variables('tempip')", + "actions": { + "Append_to_array_variable_6": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "payload", + "value": { + "created": 1, + "description": "Blocked by sentinel's ​@{triggerBody()?['object']?['properties']?['title']}", + "ip": "@{items('For_each_-_creating_final_payload_of_IP''s')}" + } + } + } + }, + "type": "Foreach" + }, + "Get-Post_Blacklist_Blocklist_Whitelist_3": { + "runAfter": { + "Compose": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "command": "bulk_new_blacklist", + "customer_name": "@parameters('Customer_name')", + "items": "@variables('payload')", + "token": "@body('Login_Generate_Token')?['Ok']?['token']" + }, + "headers": { + "Content-Type": "application/json" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['ThreatX-WAFCustomConnector']['connectionId']" + } + }, + "method": "post", + "path": "/tx_api/v1/lists" + } + } + }, + "runAfter": { + "for_loop_-_Checking_final_IP's_to_be_block_or_blacklist": [ + "Succeeded" + ] + }, + "else": { + "actions": { + "Add_comment_to_incident_(V3)_2": { + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

There is no IP's to be blocked / or provided one's are already blocked 

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + } + } + }, + "expression": { + "and": [ + { + "greater": [ + "@length(variables('tempip'))", + 0 + ] + } + ] + }, + "type": "If" + }, + "Condition_7": { + "actions": { + "Add_comment_to_incident_(V3)_4": { + "runAfter": { + "List_or_Create_Customer_Rule_2": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

URL's has been blocked at threatx :
\nDetails provided below :
\n
\n@{variables('finaluri')}

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + }, + "For_each_-creating_final_payload": { + "foreach": "@variables('finaluri')", + "actions": { + "Append_to_array_variable_10": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "tempuri", + "value": { + "match": { + "match": "@{items('For_each_-creating_final_payload')}", + "type": "contains" + }, + "type": "uri" + } + } + } + }, + "runAfter": { + "Setting_variable_to_null_,_for_reuse": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "List_or_Create_Customer_Rule_2": { + "runAfter": { + "Set_variable": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "command": "new_customer_rule", + "customer_name": "@parameters('Customer_name')", + "rule": { + "blocking": true, + "classification": "BadTraffic", + "description": "@{variables('randvar')} - Blocked url by sentinel's @{triggerBody()?['object']?['properties']?['title']}", + "id": "@variables('randvar')", + "matches": [ + { + "match": "@variables('tempuri')", + "op": "or", + "type": "boolean" + } + ], + "risk": 20, + "state": "BruteForce" + }, + "token": "@body('Login_Generate_Token')?['Ok']?['token']" + }, + "headers": { + "Content-Type": "application/json" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['ThreatX-WAFCustomConnector']['connectionId']" + } + }, + "method": "post", + "path": "/tx_api/v1/rules" + } + }, + "Set_variable": { + "runAfter": { + "For_each_-creating_final_payload": [ + "Succeeded" + ] + }, + "type": "SetVariable", + "inputs": { + "name": "randvar", + "value": "@rand(910000,999999)" + } + }, + "Setting_variable_to_null_,_for_reuse": { + "type": "SetVariable", + "inputs": { + "name": "tempuri" + } + } + }, + "runAfter": { + "For_each_-_checking_final_uri_to_be_blocked_": [ + "Succeeded" + ] + }, + "else": { + "actions": { + "Add_comment_to_incident_(V3)_3": { + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

There is no new url's to be blocked or none are provided

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + } + } + }, + "expression": { + "and": [ + { + "greater": [ + "@length(variables('finaluri'))", + 0 + ] + } + ] + }, + "type": "If" + }, + "Creating_array_of_blocking_URL's": { + "foreach": "@body('Parse_JSON')", + "actions": { + "Condition_2": { + "actions": { + "Append_to_array_variable_2": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "Blockstrings", + "value": "@items('Creating_array_of_blocking_URL''s')?['properties']?['friendlyName']" + } + } + }, + "expression": { + "and": [ + { + "equals": [ + "@items('Creating_array_of_blocking_URL''s')['kind']", + "Url" + ] + } + ] + }, + "type": "If" + } + }, + "runAfter": { + "Login_Generate_Token": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "For_each": { + "foreach": "@body('Parse_JSON_response_of_List_customer_')?['Ok']", + "actions": { + "For_each_2": { + "foreach": "@items('For_each')?['matches']", + "actions": { + "For_each_3": { + "foreach": "@items('For_each_2')['match']", + "actions": { + "Condition_5": { + "actions": { + "Append_to_array_variable_7": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "oldblockedurl", + "value": "@items('For_each_3')?['match']" + } + } + }, + "expression": { + "and": [ + { + "equals": [ + "@items('For_each_3')?['type']", + "uri" + ] + } + ] + }, + "type": "If" + } + }, + "type": "Foreach" + } + }, + "type": "Foreach" + } + }, + "runAfter": { + "Parse_JSON_response_of_List_customer_": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "For_each_-_checking_final_uri_to_be_blocked_": { + "foreach": "@variables('Blockstrings')", + "actions": { + "Condition_6": { + "actions": { + "Append_to_array_variable_9": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "finaluri", + "value": "@items('For_each_-_checking_final_uri_to_be_blocked_')" + } + } + }, + "expression": { + "and": [ + { + "not": { + "contains": [ + "@variables('tempuri')", + "@items('For_each_-_checking_final_uri_to_be_blocked_')" + ] + } + } + ] + }, + "type": "If" + } + }, + "runAfter": { + "For_each_-_refining_uri_strings_to_array": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "For_each_-_refining_uri_strings_to_array": { + "foreach": "@body('Parse_JSON_2')", + "actions": { + "Append_to_array_variable_8": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "tempuri", + "value": "@items('For_each_-_refining_uri_strings_to_array')['match']" + } + } + }, + "runAfter": { + "Parse_JSON_2": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get-Post_Blacklist_Blocklist_Whitelist": { + "runAfter": { + "creating_array_of_blocking_IP's": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "command": "list_blacklist", + "customer_name": "@parameters('Customer_name')", + "token": "@body('Login_Generate_Token')?['Ok']?['token']" + }, + "headers": { + "Content-Type": "application/json" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['ThreatX-WAFCustomConnector']['connectionId']" + } + }, + "method": "post", + "path": "/tx_api/v1/lists" + } + }, + "Get-Post_Blacklist_Blocklist_Whitelist_2": { + "runAfter": { + "appending_blacklist_IP_to_oldblockip's": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "command": "list_blocklist", + "customer_name": "@parameters('Customer_name')", + "token": "@body('Login_Generate_Token')?['Ok']?['token']" + }, + "headers": { + "Content-Type": "application/json" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['ThreatX-WAFCustomConnector']['connectionId']" + } + }, + "method": "post", + "path": "/tx_api/v1/lists" + } + }, + "Get_secret": { + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['keyvault']['connectionId']" + } + }, + "method": "get", + "path": "/secrets/@{encodeURIComponent(parameters('Threatx_Key_name'))}/value" + } + }, + "Initialize_array_for_block_URL_strings": { + "runAfter": { + "Initialize_array_for_storing_block_IP's": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "Blockstrings", + "type": "array" + } + ] + } + }, + "Initialize_array_for_storing_block_IP's": { + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "blockip", + "type": "array" + } + ] + } + }, + "Initialize_array_for_storing_old_blocked_IP's": { + "runAfter": { + "Initialize_array_for_block_URL_strings": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "Oldblockip", + "type": "array" + } + ] + } + }, + "Initialize_array_for_storing_old_blocked_URL's": { + "runAfter": { + "Initialize_array_for_storing_old_blocked_IP's": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "oldblockedurl", + "type": "array" + } + ] + } + }, + "Initialize_temp_variable": { + "runAfter": { + "Initialize_array_for_storing_old_blocked_URL's": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "tempip", + "type": "array" + } + ] + } + }, + "Initialize_temp_variable_for_uri": { + "runAfter": { + "Initialize_temp_variable": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "tempuri", + "type": "array" + } + ] + } + }, + "Initialize_variable_-_temp_variable_for_storing_final_uri_to_be_blocked": { + "runAfter": { + "Initialize_temp_variable_for_uri": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "finaluri", + "type": "array" + } + ] + } + }, + "Initialize_variable_for_final_payload_IP": { + "runAfter": { + "Initialize_variable_-_temp_variable_for_storing_final_uri_to_be_blocked": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "payload", + "type": "array" + } + ] + } + }, + "Initialize_variable_for_storing_random_number": { + "runAfter": { + "Initialize_variable_for_final_payload_IP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "randvar", + "type": "integer" + } + ] + } + }, + "List_or_Create_Customer_Rule": { + "runAfter": { + "Creating_array_of_blocking_URL's": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "command": "list_customer_rules", + "customer_name": "@parameters('Customer_name')", + "token": "@body('Login_Generate_Token')?['Ok']?['token']" + }, + "headers": { + "Content-Type": "application/json" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['ThreatX-WAFCustomConnector']['connectionId']" + } + }, + "method": "post", + "path": "/tx_api/v1/rules" + } + }, + "Login_Generate_Token": { + "runAfter": { + "Get_secret": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "api_token": "@body('Get_secret')?['value']", + "command": "login" + }, + "headers": { + "Content-Type": "application/json" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['ThreatX-WAFCustomConnector']['connectionId']" + } + }, + "method": "post", + "path": "/tx_api/v1/login" + } + }, + "Parse_JSON": { + "runAfter": { + "Initialize_variable_for_storing_random_number": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@triggerBody()?['object']?['properties']?['relatedEntities']", + "schema": { + "items": { + "properties": { + "kind": { + "type": "string" + }, + "properties": { + "properties": { + "address": { + "type": "string" + }, + "friendlyName": { + "type": "string" + } + }, + "type": "object" + }, + "type": { + "type": "string" + } + }, + "required": [ + "type", + "kind", + "properties" + ], + "type": "object" + }, + "type": "array" + } + } + }, + "Parse_JSON_2": { + "runAfter": { + "For_each": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@variables('oldblockedurl')", + "schema": { + "items": { + "properties": { + "match": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "required": [ + "match", + "type" + ], + "type": "object" + }, + "type": "array" + } + } + }, + "Parse_JSON_of_Blacklist_response": { + "runAfter": { + "Get-Post_Blacklist_Blocklist_Whitelist": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get-Post_Blacklist_Blocklist_Whitelist')", + "schema": { + "properties": { + "Ok": { + "items": { + "properties": { + "created": { + "type": "integer" + }, + "description": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "username": { + "type": "string" + } + }, + "required": [ + "ip", + "description", + "created", + "entity_hash", + "entity_id", + "username", + "expires_at" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + }, + "Parse_JSON_of_blocklist_response": { + "runAfter": { + "Get-Post_Blacklist_Blocklist_Whitelist_2": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get-Post_Blacklist_Blocklist_Whitelist_2')", + "schema": { + "properties": { + "Ok": { + "items": { + "properties": { + "created": { + "type": "integer" + }, + "description": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "username": { + "type": "string" + } + }, + "required": [ + "ip", + "description", + "created", + "entity_hash", + "entity_id", + "username", + "expires_at" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + }, + "Parse_JSON_response_of_List_customer_": { + "runAfter": { + "List_or_Create_Customer_Rule": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('List_or_Create_Customer_Rule')", + "schema": { + "properties": { + "Ok": { + "items": { + "properties": { + "blocking": { + "type": "boolean" + }, + "classification": { + "type": "string" + }, + "description": { + "type": "string" + }, + "id": { + "type": "integer" + }, + "matches": { + "items": { + "properties": { + "match": { + "items": { + "properties": { + "match": { + "properties": { + "match": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "type": { + "type": "string" + } + }, + "required": [ + "match", + "type" + ], + "type": "object" + }, + "type": "array" + }, + "op": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "required": [ + "match", + "op", + "type" + ], + "type": "object" + }, + "type": "array" + }, + "risk": { + "type": "integer" + }, + "state": { + "type": "string" + } + }, + "required": [ + "id", + "name", + "description", + "version_support", + "classification", + "webtech", + "state", + "contributing_score", + "risk", + "blocking", + "tarpit", + "interogate", + "beta", + "tags", + "matches" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + }, + "appending_blacklist_IP_to_oldblockip's": { + "foreach": "@body('Parse_JSON_of_Blacklist_response')?['Ok']", + "actions": { + "Append_to_array_variable_3": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "Oldblockip", + "value": "@items('appending_blacklist_IP_to_oldblockip''s')?['ip']" + } + } + }, + "runAfter": { + "Parse_JSON_of_Blacklist_response": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "creating_array_of_blocking_IP's": { + "foreach": "@body('Parse_JSON')", + "actions": { + "Condition": { + "actions": { + "Append_to_array_variable": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "blockip", + "value": "@items('creating_array_of_blocking_IP''s')?['properties']?['address']" + } + } + }, + "expression": { + "and": [ + { + "equals": [ + "@items('creating_array_of_blocking_IP''s')['kind']", + "Ip" + ] + } + ] + }, + "type": "If" + } + }, + "runAfter": { + "Login_Generate_Token": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "for_loop_-_Checking_final_IP's_to_be_block_or_blacklist": { + "foreach": "@variables('blockip')", + "actions": { + "Condition_3": { + "actions": { + "Append_to_array_variable_5": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "tempip", + "value": "@items('for_loop_-_Checking_final_IP''s_to_be_block_or_blacklist')" + } + } + }, + "expression": { + "and": [ + { + "not": { + "contains": [ + "@variables('Oldblockip')", + "@items('for_loop_-_Checking_final_IP''s_to_be_block_or_blacklist')" + ] + } + } + ] + }, + "type": "If" + } + }, + "runAfter": { + "Appending_blocklist_IP_to_oldblockip's": [ + "Succeeded" + ] + }, + "type": "Foreach" + } + } + }, + "parameters": { + "$connections": { + "value": { + "ThreatX-WAFCustomConnector": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('Threatx-WafcustomconnectorConnectionName'))]", + "connectionName": "[[variables('Threatx-WafcustomconnectorConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]" + }, + "azuresentinel": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", + "connectionName": "[[variables('MicrosoftSentinelConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + }, + "keyvault": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('KeyvaultConnectionName'))]", + "connectionName": "[[variables('KeyvaultConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Keyvault')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "ThreatX-BlockIP-URL", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', variables('Threatx-WafcustomconnectorConnectionName'))]", + "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", + "[[resourceId('Microsoft.Web/connections', variables('KeyvaultConnectionName'))]" + ] + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[variables('Threatx-WafcustomconnectorConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "kind": "V1", + "properties": { + "displayName": "[[variables('Threatx-WafcustomconnectorConnectionName')]", + "api": { + "id": "[[variables('_connection-2')]" + } + } + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[variables('MicrosoftSentinelConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "kind": "V1", + "properties": { + "displayName": "[[variables('MicrosoftSentinelConnectionName')]", + "parameterValueType": "Alternative", + "api": { + "id": "[[variables('_connection-3')]" + } + } + }, + { + "type": "Microsoft.Web/Connections", + "apiVersion": "2016-06-01", + "name": "[[variables('KeyvaultConnectionName')]", + "kind": "V1", + "location": "[[variables('workspace-location-inline')]", + "properties": { + "api": { + "id": "[[variables('_connection-4')]", + "type": "Microsoft.Web/locations/managedApis" + }, + "parameterValueType": "Alternative", + "alternativeParameterValues": { + "vaultName": "[[parameters('keyvault name')]" + }, + "displayName": "[[variables('KeyvaultConnectionName')]", + "nonSecretParameterValues": { + "vaultName": "[[parameters('keyvault name')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId2'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId2')]", + "contentId": "[variables('_playbookContentId2')]", + "kind": "Playbook", + "version": "[variables('playbookVersion2')]", + "source": { + "kind": "Solution", + "name": "ThreatXCloud", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "criteria": [ + { + "kind": "LogicAppsCustomConnector", + "contentId": "[variables('_ThreatXCustomConnector')]", + "version": "[variables('playbookVersion1')]" + } + ] + } + } + } + ], + "metadata": { + "title": "Block IP & URL on ThreatX-WAF cloud", + "description": "This Playbook Provides the automation on blocking the suspicious/malicious IP and URL on ThreatX cloud waf", + "prerequisites": [ + "1. ThreatX-WAF Custom Connector needs to be deployed prior to the deployment of this playbook under the same subscription.", + "2. API Key . To get API Key, login into your ThreatX cloud instance dashboard and navigate to Settings --> API Key --> Add Api key", + "3. [Important step]Store the API secret key in Key vault and provide the key name of the stored secret during deployment" + ], + "postDeployment": [ + "1. During deployment you need to provide your tenant name ,Key vault name and key name of stored secret key." + ], + "lastUpdateTime": "2022-09-05T00:00:00Z", + "entities": [ + "ip", + "url" + ], + "tags": [ + "Enrichment", + "ThreatX", + "WAF", + "Cloud WAF", + "Block IP", + "Block URL" + ], + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + } + } + }, + { + "type": "Microsoft.Resources/templateSpecs", + "apiVersion": "2021-05-01", + "name": "[variables('playbookTemplateSpecName3')]", + "location": "[parameters('workspace-location')]", + "tags": { + "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", + "hidden-sentinelContentType": "Playbook" + }, + "properties": { + "description": "ThreatX-Enrichment playbook", + "displayName": "ThreatX-Enrichment playbook" + } + }, + { + "type": "Microsoft.Resources/templateSpecs/versions", + "apiVersion": "2021-05-01", + "name": "[concat(variables('playbookTemplateSpecName3'),'/',variables('playbookVersion3'))]", + "location": "[parameters('workspace-location')]", + "tags": { + "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", + "hidden-sentinelContentType": "Playbook" + }, + "dependsOn": [ + "[resourceId('Microsoft.Resources/templateSpecs', variables('playbookTemplateSpecName3'))]" + ], + "properties": { + "description": "ThreatX-Enrichment Playbook with template version 2.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion3')]", + "parameters": { + "PlaybookName": { + "defaultValue": "ThreatX-Enrichment", + "type": "string" + }, + "customer name": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant Name" + } + }, + "Keyvault name": { + "defaultValue": "", + "type": "String", + "metadata": { + "description": "Enter the key vault name where secret key is stored" + } + }, + "Threatx Key name": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Your Key name for the api secret stored in keyvault under secrets" + } + }, + "CustomConnectorName": { + "defaultValue": "ThreatX-WAFCustomConnector", + "type": "string", + "metadata": { + "description": "Name of the custom connector, if you want to change the default name, make sure to use the same in all ThreatXCloud automation playbooks as well" + } + } + }, + "variables": { + "Threatx-WafcustomconnectorConnectionName": "[[concat('Threatx-Wafcustomconnector-', parameters('PlaybookName'))]", + "MicrosoftSentinelConnectionName": "[[concat('MicrosoftSentinel-', parameters('PlaybookName'))]", + "KeyvaultConnectionName": "[[concat('Keyvault-', parameters('PlaybookName'))]", + "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]", + "_connection-2": "[[variables('connection-2')]", + "connection-3": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]", + "_connection-3": "[[variables('connection-3')]", + "connection-4": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/', 'keyvault')]", + "_connection-4": "[[variables('connection-4')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "type": "Object" + }, + "customer_name": { + "type": "string", + "defaultValue": "[[parameters('customer name')]" + }, + "Threatx_Key_name": { + "type": "string", + "defaultValue": "[[parameters('Threatx Key name')]" + } + }, + "triggers": { + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", + "inputs": { + "body": { + "callback_url": "@{listCallbackUrl()}" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "path": "/incident-creation" + } + } + }, + "actions": { + "Condition_2": { + "actions": { + "Add_comment_to_incident_(V3)_2": { + "runAfter": { + "Create_HTML_table": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

@{body('Create_HTML_table')}

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + }, + "Create_HTML_table": { + "runAfter": { + "For_each": [ + "Succeeded" + ] + }, + "type": "Table", + "inputs": { + "format": "HTML", + "from": "@variables('result_entities')" + } + }, + "Event_Logs": { + "runAfter": { + "Login_Generate_Token": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "command": "match_events", + "customer_name": "@parameters('customer_name')", + "ip_addresses": "@variables('enrichip')", + "limit": 100, + "token": "@body('Login_Generate_Token')?['Ok']?['token']" + }, + "headers": { + "Content-Type": "application/json" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['ThreatX-WAFCustomConnector']['connectionId']" + } + }, + "method": "post", + "path": "/tx_api/v2/logs" + } + }, + "For_each": { + "foreach": "@body('Parse_JSON')?['Ok']?['data']", + "actions": { + "For_each_2": { + "foreach": "@items('For_each')['rules']", + "actions": { + "Append_to_array_variable_2": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "result_entities", + "value": { + "Source_ip": "@items('For_each')?['ip']", + "blocking": "@items('For_each_2')?['blocking']", + "content_type": "@items('For_each')?['content_type']", + "contrib_score": "@items('For_each_2')?['contrib_score']", + "cookie": "@items('For_each')?['cookie']", + "dest_host": "@items('For_each')?['dst_host']", + "js_fingerprint": "@items('For_each')?['js_fingerprint']", + "postblock_event": "@items('For_each')?['postblock_event']", + "request_method": "@items('For_each')?['request_method']", + "risk": "@items('For_each')?['risk']", + "rule_classification": "@items('For_each_2')?['classification']", + "rule_description": "@items('For_each_2')?['description']", + "rule_state": "@items('For_each_2')?['state']", + "ssl": "@items('For_each')?['ssl']", + "status_code": "@items('For_each')?['status_code']", + "timestamp": "@items('For_each')?['timestamp']", + "tls_fingerprint": "@items('For_each')?['tls_fingerprint']", + "uri": "@items('For_each')?['uri']", + "user_agent": "@items('For_each')?['user_agent']" + } + } + } + }, + "type": "Foreach" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Login_Generate_Token": { + "type": "ApiConnection", + "inputs": { + "body": { + "api_token": "@body('Get_secret')?['value']", + "command": "login" + }, + "headers": { + "Content-Type": "application/json" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['ThreatX-WAFCustomConnector']['connectionId']" + } + }, + "method": "post", + "path": "/tx_api/v1/login" + } + }, + "Parse_JSON": { + "runAfter": { + "Event_Logs": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Event_Logs')", + "schema": { + "properties": { + "Ok": { + "properties": { + "data": { + "items": { + "properties": { + "args": { + "type": "string" + }, + "content_length": { + "type": "integer" + }, + "dst_host": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "js_fingerprint": { + "type": "string" + }, + "postblock_event": { + "type": "boolean" + }, + "random_id": { + "type": "string" + }, + "request_id": { + "type": "string" + }, + "request_method": { + "type": "string" + }, + "risk": { + "type": "integer" + }, + "rules": { + "items": { + "properties": { + "beta": { + "type": "boolean" + }, + "blocking": { + "type": "boolean" + }, + "classification": { + "type": "string" + }, + "contrib_score": { + "type": "integer" + }, + "description": { + "type": "string" + }, + "id": { + "type": "integer" + }, + "risk": { + "type": "integer" + }, + "state": { + "type": "string" + } + }, + "required": [ + "id", + "description", + "classification", + "state", + "contrib_score", + "risk", + "blocking", + "beta" + ], + "type": "object" + }, + "type": "array" + }, + "ssl": { + "type": "boolean" + }, + "status_code": { + "type": "integer" + }, + "timestamp": { + "type": "string" + }, + "uri": { + "type": "string" + }, + "user_agent": { + "type": "string" + } + }, + "required": [ + "timestamp", + "request_id", + "user_agent", + "ip", + "dst_host", + "uri", + "args", + "status_code", + "ssl", + "risk", + "request_method", + "content_type", + "content_length", + "postblock_event", + "random_id", + "tls_fingerprint", + "cookie", + "js_fingerprint", + "rules" + ], + "type": "object" + }, + "type": "array" + }, + "is_complete": { + "type": "boolean" + }, + "last_seen_key": { + "properties": { + "request_id": { + "type": "string" + }, + "timestamp": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + } + } + } + }, + "runAfter": { + "Get_secret": [ + "Succeeded" + ] + }, + "else": { + "actions": { + "Add_comment_to_incident_(V3)": { + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

No IP's are provided for the enrichment from threat X

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + } + } + }, + "expression": { + "and": [ + { + "greater": [ + "@length(variables('enrichip'))", + 0 + ] + } + ] + }, + "type": "If" + }, + "For_each_-_collecting_IP's_from_incident_response": { + "foreach": "@body('Parse_JSON_-_response_from_sentinel_incident')", + "actions": { + "Condition": { + "actions": { + "Append_to_array_variable": { + "type": "AppendToArrayVariable", + "inputs": { + "name": "enrichip", + "value": "@items('For_each_-_collecting_IP''s_from_incident_response')?['properties']?['address']" + } + } + }, + "expression": { + "and": [ + { + "equals": [ + "@items('For_each_-_collecting_IP''s_from_incident_response')['kind']", + "Ip" + ] + } + ] + }, + "type": "If" + } + }, + "runAfter": { + "Parse_JSON_-_response_from_sentinel_incident": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_secret": { + "runAfter": { + "For_each_-_collecting_IP's_from_incident_response": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['keyvault']['connectionId']" + } + }, + "method": "get", + "path": "/secrets/@{encodeURIComponent(parameters('Threatx_Key_name'))}/value" + } + }, + "Initialize_variable_for_collecting_IP's_to_be_enriched": { + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "enrichip", + "type": "array" + } + ] + } + }, + "Initialize_variable_for_storing_result_of_entities": { + "runAfter": { + "Initialize_variable_for_collecting_IP's_to_be_enriched": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "result_entities", + "type": "array" + } + ] + } + }, + "Parse_JSON_-_response_from_sentinel_incident": { + "runAfter": { + "Initialize_variable_for_storing_result_of_entities": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@triggerBody()?['object']?['properties']?['relatedEntities']", + "schema": { + "items": { + "properties": { + "kind": { + "type": "string" + }, + "properties": { + "properties": { + "address": { + "type": "string" + }, + "friendlyName": { + "type": "string" + } + }, + "type": "object" + }, + "type": { + "type": "string" + } + }, + "required": [ + "type", + "kind", + "properties" + ], + "type": "object" + }, + "type": "array" + } + } + } + } + }, + "parameters": { + "$connections": { + "value": { + "ThreatX-WAFCustomConnector": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('Threatx-WafcustomconnectorConnectionName'))]", + "connectionName": "[[variables('Threatx-WafcustomconnectorConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]" + }, + "azuresentinel": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", + "connectionName": "[[variables('MicrosoftSentinelConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + }, + "keyvault": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('KeyvaultConnectionName'))]", + "connectionName": "[[variables('KeyvaultConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Keyvault')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "ThreatX-Enrichment", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', variables('Threatx-WafcustomconnectorConnectionName'))]", + "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", + "[[resourceId('Microsoft.Web/connections', variables('KeyvaultConnectionName'))]" + ] + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[variables('Threatx-WafcustomconnectorConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "kind": "V1", + "properties": { + "displayName": "[[variables('Threatx-WafcustomconnectorConnectionName')]", + "api": { + "id": "[[variables('_connection-2')]" + } + } + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[variables('MicrosoftSentinelConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "kind": "V1", + "properties": { + "displayName": "[[variables('MicrosoftSentinelConnectionName')]", + "parameterValueType": "Alternative", + "api": { + "id": "[[variables('_connection-3')]" + } + } + }, + { + "type": "Microsoft.Web/Connections", + "apiVersion": "2016-06-01", + "name": "[[variables('KeyvaultConnectionName')]", + "kind": "V1", + "location": "[[variables('workspace-location-inline')]", + "properties": { + "api": { + "id": "[[variables('_connection-4')]", + "type": "Microsoft.Web/locations/managedApis" + }, + "parameterValueType": "Alternative", + "alternativeParameterValues": { + "vaultName": "[[parameters('keyvault name')]" + }, + "displayName": "[[variables('KeyvaultConnectionName')]", + "nonSecretParameterValues": { + "vaultName": "[[parameters('keyvault name')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId3'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId3')]", + "contentId": "[variables('_playbookContentId3')]", + "kind": "Playbook", + "version": "[variables('playbookVersion3')]", + "source": { + "kind": "Solution", + "name": "ThreatXCloud", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "criteria": [ + { + "kind": "LogicAppsCustomConnector", + "contentId": "[variables('_ThreatXCustomConnector')]", + "version": "[variables('playbookVersion1')]" + } + ] + } + } + } + ], + "metadata": { + "title": "Fetch Threat Intel from ThreatX", + "description": "This playbook provides/updates the threat intel and essential details in comments section of triggered incident so that SOC analysts can directly take corrective measure to stop the attack", + "prerequisites": [ + "1. ThreatX-WAF Custom Connector needs to be deployed prior to the deployment of this playbook under the same subscription.", + "2. API Key . To get API Key, login into your ThreatX cloud instance dashboard and navigate to Settings --> API Key --> Add Api key", + "3. [Important step]Store the API secret key in Key vault and provide the key name of the stored secret during deployment" + ], + "postDeployment": [ + "1. During deployment you need to provide your tenant name ,Key vault name and key name of stored secret key." + ], + "lastUpdateTime": "2022-09-15T00:00:00Z", + "entities": [ + "ip" + ], + "tags": [ + "Enrichment", + "Notification", + "ThreatIntelligence", + "ThreatX", + "WAF" + ], + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "properties": { + "version": "2.0.0", + "kind": "Solution", + "contentSchemaVersion": "2.0.0", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", + "source": { + "kind": "Solution", + "name": "ThreatXCloud", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "kind": "LogicAppsCustomConnector", + "contentId": "[variables('_ThreatXCustomConnector')]", + "version": "[variables('playbookVersion1')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_ThreatX-BlockIP-URL')]", + "version": "[variables('playbookVersion2')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_ThreatX-Enrichment')]", + "version": "[variables('playbookVersion3')]" + } + ] + }, + "firstPublishDate": "2022-09-23", + "lastPublishDate": "2022-09-23", + "providers": [ + "ThreatXCloud" + ], + "categories": { + "domains": [ + "Security – Automation (SOAR)", + "Security - Threat Protection" + ] + } + }, + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + } + ], + "outputs": {} +} diff --git a/Solutions/ThreatXCloud/SolutionMetadata.json b/Solutions/ThreatXCloud/SolutionMetadata.json new file mode 100644 index 0000000000..9c713e8386 --- /dev/null +++ b/Solutions/ThreatXCloud/SolutionMetadata.json @@ -0,0 +1,16 @@ +{ + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-threatxcloud", + "firstPublishDate": "2022-09-23", + "lastPublishDate": "2022-09-23", + "providers": ["ThreatXCloud"], + "categories": { + "domains": ["Security – Automation (SOAR)","Security - Threat Protection"] + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } +} \ No newline at end of file diff --git a/Solutions/ThreatXCloud/data/Solution_ThreatXCloud.json b/Solutions/ThreatXCloud/data/Solution_ThreatXCloud.json new file mode 100644 index 0000000000..2fd038107f --- /dev/null +++ b/Solutions/ThreatXCloud/data/Solution_ThreatXCloud.json @@ -0,0 +1,16 @@ +{ + "Name": "ThreatXCloud", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "The [ThreatX](https://www.threatx.com/products/) solution for Microsoft Sentinel provides an automation approach to analyst for remediate the attacks happening at application level by blocking the suspicious ip and url and also empowers them to gather the threat intelligence data for the malicious ip activity. This solution includes SOAR Connector and Playbooks by which the analyst can automate the security operations tasks", + "Playbooks": [ + "Playbooks/CustomConnector/ThreatXCustomConnector/azuredeploy.json", + "Playbooks/ThreatXPlaybooks/ThreatX-BlockIP-URL/azuredeploy.json", + "Playbooks/ThreatXPlaybooks/ThreatX-Enrichment/azuredeploy.json" + ], + "Metadata": "SolutionMetadata.json", + "BasePath": "C:\\One\\Azure-Sentinel\\Solutions\\ThreatXCloud", + "Version": "2.0.0", + "TemplateSpec": true, + "Is1PConnector": false +} \ No newline at end of file