From 0e02ee9d578e9631edcae2c7014e9c34d400e8e1 Mon Sep 17 00:00:00 2001 From: brsteph <96074545+brsteph@users.noreply.github.com> Date: Thu, 22 Aug 2024 16:35:42 +0000 Subject: [PATCH] [create-pull-request] automated change --- checklists-ext/fullwaf_checklist.en.json | 2 +- checklists/alz_checklist.en.json | 4 +- checklists/alz_checklist.es.json | 13 +- checklists/alz_checklist.ja.json | 13 +- checklists/alz_checklist.ko.json | 13 +- checklists/alz_checklist.pt.json | 13 +- checklists/alz_checklist.zh-Hant.json | 13 +- checklists/checklist.en.master.json | 5855 +++++++++-------- checklists/waf_checklist.en.json | 2 +- checklists/waf_checklist.es.json | 2 +- checklists/waf_checklist.ja.json | 2 +- checklists/waf_checklist.ko.json | 2 +- checklists/waf_checklist.pt.json | 2 +- checklists/waf_checklist.zh-Hant.json | 2 +- spreadsheet/macrofree/alz_checklist.en.xlsx | Bin 49432 -> 49543 bytes spreadsheet/macrofree/alz_checklist.es.xlsx | Bin 51777 -> 51902 bytes spreadsheet/macrofree/alz_checklist.ja.xlsx | Bin 56853 -> 56995 bytes spreadsheet/macrofree/alz_checklist.ko.xlsx | Bin 54925 -> 55078 bytes spreadsheet/macrofree/alz_checklist.pt.xlsx | Bin 51773 -> 51897 bytes .../macrofree/alz_checklist.zh-Hant.xlsx | Bin 53736 -> 53853 bytes .../macrofree/checklist.en.master.xlsx | Bin 503239 -> 503669 bytes spreadsheet/macrofree/waf_checklist.en.xlsx | Bin 201482 -> 201479 bytes spreadsheet/macrofree/waf_checklist.es.xlsx | Bin 195132 -> 195129 bytes spreadsheet/macrofree/waf_checklist.ja.xlsx | Bin 215019 -> 215015 bytes spreadsheet/macrofree/waf_checklist.ko.xlsx | Bin 207802 -> 207798 bytes spreadsheet/macrofree/waf_checklist.pt.xlsx | Bin 196479 -> 196476 bytes .../macrofree/waf_checklist.zh-Hant.xlsx | Bin 201213 -> 201209 bytes .../alz_checklist.en_counters_workbook.json | 6 +- ...ecklist.en_counters_workbook_template.json | 2 +- .../alz_checklist.en_network_counters.json | 1880 +++--- ...hecklist.en_network_counters_template.json | 2 +- .../alz_checklist.en_network_tabcounters.json | 1822 ++--- ...klist.en_network_tabcounters_template.json | 2 +- .../alz_checklist.en_network_workbook.json | 1112 ++-- ...hecklist.en_network_workbook_template.json | 2 +- workbooks/alz_checklist.en_workbook.json | 6 +- .../alz_checklist.en_workbook_template.json | 2 +- ...hecklist.en_network_counters_workbook.json | 592 +- ...en_network_counters_workbook_template.json | 2 +- ...elivery_checklist.en_network_workbook.json | 6 +- ...hecklist.en_network_workbook_template.json | 2 +- 41 files changed, 5730 insertions(+), 5646 deletions(-) diff --git a/checklists-ext/fullwaf_checklist.en.json b/checklists-ext/fullwaf_checklist.en.json index a542e8a3..bb6b852a 100644 --- a/checklists-ext/fullwaf_checklist.en.json +++ b/checklists-ext/fullwaf_checklist.en.json @@ -26083,7 +26083,7 @@ ], "metadata": { "name": "WAF checklist", - "timestamp": "August 21, 2024" + "timestamp": "August 22, 2024" }, "severities": [ { diff --git a/checklists/alz_checklist.en.json b/checklists/alz_checklist.en.json index b75d24dd..e9ca44c8 100644 --- a/checklists/alz_checklist.en.json +++ b/checklists/alz_checklist.en.json @@ -2114,7 +2114,7 @@ "id": "F01.20", "severity": "Medium", "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview", - "training": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview#installation" + "training": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview#installation" }, { "category": "Management", @@ -2826,6 +2826,6 @@ "name": "Azure Landing Zone Review", "state": "GA", "waf": "all", - "timestamp": "August 21, 2024" + "timestamp": "August 22, 2024" } } \ No newline at end of file diff --git a/checklists/alz_checklist.es.json b/checklists/alz_checklist.es.json index 8094dc17..d48a2f82 100644 --- a/checklists/alz_checklist.es.json +++ b/checklists/alz_checklist.es.json @@ -2131,6 +2131,17 @@ "training": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/", "waf": "Operaciones" }, + { + "category": "Administración", + "guid": "aa45be6a-8f2d-4896-b0e3-885e6e94e770", + "id": "F01.20", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview", + "severity": "Medio", + "subcategory": "Monitorización", + "text": "Use Azure Monitoring Agent (AMA). El agente de Log Analytics está en desuso desde el 31 de agosto de 2024", + "training": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview#installation", + "waf": "Operaciones" + }, { "category": "Administración", "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb", @@ -2756,7 +2767,7 @@ "metadata": { "name": "Azure Landing Zone Review", "state": "GA", - "timestamp": "August 21, 2024", + "timestamp": "August 22, 2024", "waf": "all" }, "severities": [ diff --git a/checklists/alz_checklist.ja.json b/checklists/alz_checklist.ja.json index 3950b6a7..e096a80e 100644 --- a/checklists/alz_checklist.ja.json +++ b/checklists/alz_checklist.ja.json @@ -2131,6 +2131,17 @@ "training": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/", "waf": "オペレーションズ" }, + { + "category": "管理", + "guid": "aa45be6a-8f2d-4896-b0e3-885e6e94e770", + "id": "F01.20", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview", + "severity": "中程度", + "subcategory": "モニタリング", + "text": "Azure Monitoring Agent (AMA) を使用します。Log Analytics エージェントは、2024 年 8 月 31 日に非推奨になりました", + "training": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview#installation", + "waf": "オペレーションズ" + }, { "category": "管理", "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb", @@ -2756,7 +2767,7 @@ "metadata": { "name": "Azure Landing Zone Review", "state": "GA", - "timestamp": "August 21, 2024", + "timestamp": "August 22, 2024", "waf": "all" }, "severities": [ diff --git a/checklists/alz_checklist.ko.json b/checklists/alz_checklist.ko.json index b7cfe9a5..25138ed0 100644 --- a/checklists/alz_checklist.ko.json +++ b/checklists/alz_checklist.ko.json @@ -2131,6 +2131,17 @@ "training": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/", "waf": "작업" }, + { + "category": "경영", + "guid": "aa45be6a-8f2d-4896-b0e3-885e6e94e770", + "id": "F01.20", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview", + "severity": "보통", + "subcategory": "모니터링", + "text": "AMA(Azure Monitoring Agent)를 사용합니다. Log Analytics 에이전트는 2024년 8월 31일부터 더 이상 사용되지 않습니다.", + "training": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview#installation", + "waf": "작업" + }, { "category": "경영", "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb", @@ -2756,7 +2767,7 @@ "metadata": { "name": "Azure Landing Zone Review", "state": "GA", - "timestamp": "August 21, 2024", + "timestamp": "August 22, 2024", "waf": "all" }, "severities": [ diff --git a/checklists/alz_checklist.pt.json b/checklists/alz_checklist.pt.json index 1974dc2b..403798e4 100644 --- a/checklists/alz_checklist.pt.json +++ b/checklists/alz_checklist.pt.json @@ -2131,6 +2131,17 @@ "training": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/", "waf": "Operações" }, + { + "category": "Gestão", + "guid": "aa45be6a-8f2d-4896-b0e3-885e6e94e770", + "id": "F01.20", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview", + "severity": "Média", + "subcategory": "Monitorização", + "text": "Use o AMA (Agente de Monitoramento do Azure). O agente do Log Analytics foi preterido desde 31 de agosto de 2024", + "training": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview#installation", + "waf": "Operações" + }, { "category": "Gestão", "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb", @@ -2756,7 +2767,7 @@ "metadata": { "name": "Azure Landing Zone Review", "state": "GA", - "timestamp": "August 21, 2024", + "timestamp": "August 22, 2024", "waf": "all" }, "severities": [ diff --git a/checklists/alz_checklist.zh-Hant.json b/checklists/alz_checklist.zh-Hant.json index 43b369fa..f2be1231 100644 --- a/checklists/alz_checklist.zh-Hant.json +++ b/checklists/alz_checklist.zh-Hant.json @@ -2131,6 +2131,17 @@ "training": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/", "waf": "操作" }, + { + "category": "管理", + "guid": "aa45be6a-8f2d-4896-b0e3-885e6e94e770", + "id": "F01.20", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview", + "severity": "中等", + "subcategory": "監測", + "text": "使用 Azure 監視代理 （AMA）。Log Analytics 代理自 2024 年 8 月 31 日起已棄用", + "training": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview#installation", + "waf": "操作" + }, { "category": "管理", "guid": "7ea02e1c-7166-45a3-bdf5-098891367fcb", @@ -2756,7 +2767,7 @@ "metadata": { "name": "Azure Landing Zone Review", "state": "GA", - "timestamp": "August 21, 2024", + "timestamp": "August 22, 2024", "waf": "all" }, "severities": [ diff --git a/checklists/checklist.en.master.json b/checklists/checklist.en.master.json index 8ef6760c..b5094552 100644 --- a/checklists/checklist.en.master.json +++ b/checklists/checklist.en.master.json @@ -108,8 +108,8 @@ "guid": "12cd499f-96e2-4e41-a243-231fb3245a1c", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "services": [ - "TrafficManager", - "Entra" + "Entra", + "TrafficManager" ], "severity": "Low", "subcategory": "Enterprise Agreement", @@ -138,9 +138,9 @@ "guid": "5cf9f485-2784-49b3-9824-75d9b8bdb57b", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "services": [ - "Subscriptions", "Cost", - "Entra" + "Entra", + "Subscriptions" ], "severity": "Low", "subcategory": "Enterprise Agreement", @@ -168,9 +168,9 @@ "guid": "90e87802-602f-4dfb-acea-67c60689f1d7", "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/mca-section-invoice", "services": [ - "Storage", "Cost", - "Entra" + "Entra", + "Storage" ], "severity": "Low", "subcategory": "Microsoft Customer Agreement", @@ -199,8 +199,8 @@ "guid": "ae757485-92a4-482a-8bc9-eefe6f5b5ec3", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "RBAC", - "Entra" + "Entra", + "RBAC" ], "severity": "Medium", "subcategory": "Microsoft Customer Agreement", @@ -215,10 +215,10 @@ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", "service": "Entra", "services": [ - "Subscriptions", - "RBAC", "Entra", - "ACR" + "ACR", + "Subscriptions", + "RBAC" ], "severity": "High", "subcategory": "Identity", @@ -277,8 +277,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", "service": "Entra", "services": [ - "Entra", - "AzurePolicy" + "AzurePolicy", + "Entra" ], "severity": "High", "subcategory": "Identity", @@ -307,8 +307,8 @@ "guid": "e6a83de5-de32-4c19-a248-1607d5d1e4e6", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", "services": [ - "RBAC", - "Entra" + "Entra", + "RBAC" ], "severity": "High", "subcategory": "Identity", @@ -337,9 +337,9 @@ "guid": "1559ab91-53e8-4908-ae28-c84c33b6b780", "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain#vm-recommendations", "services": [ - "VM", "Entra", - "ACR" + "ACR", + "VM" ], "severity": "High", "subcategory": "Identity", @@ -353,10 +353,10 @@ "guid": "f5664b5e-984a-4859-a773-e7d261623a76", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", "services": [ - "Subscriptions", - "RBAC", "Entra", - "ACR" + "ACR", + "Subscriptions", + "RBAC" ], "severity": "Medium", "subcategory": "Identity", @@ -386,8 +386,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", "service": "Entra", "services": [ - "Entra", - "Monitor" + "Monitor", + "Entra" ], "severity": "Medium", "subcategory": "Identity", @@ -417,8 +417,8 @@ "guid": "cd163e39-84a5-4b39-97b7-6973abd70d94", "link": "https://learn.microsoft.com/azure/active-directory/hybrid/how-to-connect-sync-staging-server", "services": [ - "ASR", - "Entra" + "Entra", + "ASR" ], "severity": "Medium", "subcategory": "Microsoft Entra ID", @@ -433,8 +433,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", "service": "Entra", "services": [ - "RBAC", - "Entra" + "Entra", + "RBAC" ], "severity": "Medium", "subcategory": "Identity", @@ -463,8 +463,8 @@ "guid": "9cf5418b-1520-4b7b-add7-88eb28f833e8", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#identity-and-access-management-in-the-azure-landing-zone-accelerator", "services": [ - "VNet", - "Entra" + "Entra", + "VNet" ], "severity": "High", "subcategory": "Landing zones", @@ -478,11 +478,11 @@ "guid": "d4d1ad54-1abc-4919-b267-3f342d3b49e4", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones#rbac-recommendations", "services": [ - "RBAC", + "Entra", "ACR", - "Storage", "AKV", - "Entra" + "RBAC", + "Storage" ], "severity": "Medium", "subcategory": "Landing zones", @@ -551,9 +551,9 @@ "guid": "61623a76-5a91-47e1-b348-ef254c27d42e", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations", "services": [ + "AzurePolicy", "Subscriptions", - "RBAC", - "AzurePolicy" + "RBAC" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -567,10 +567,10 @@ "guid": "8bbac757-1559-4ab9-853e-8908ae28c84c", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-group-recommendations", "services": [ - "DNS", - "Subscriptions", "ExpressRoute", - "VWAN" + "DNS", + "VWAN", + "Subscriptions" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -627,10 +627,10 @@ "guid": "49b82111-2df2-47ee-912e-7f983f630472", "link": "https://learn.microsoft.com/entra/id-governance/access-reviews-overview", "services": [ + "AzurePolicy", "Subscriptions", "RBAC", - "Cost", - "AzurePolicy" + "Cost" ], "severity": "High", "subcategory": "Subscriptions", @@ -658,8 +658,8 @@ "guid": "c68e1d76-6673-413b-9f56-64b5e984a859", "link": "https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservations", "services": [ - "Subscriptions", - "Cost" + "Cost", + "Subscriptions" ], "severity": "High", "subcategory": "Subscriptions", @@ -674,9 +674,9 @@ "guid": "c773e7d2-6162-43a7-95a9-17e1f348ef25", "link": "https://learn.microsoft.com/azure/azure-portal/azure-portal-dashboards", "services": [ - "Storage", + "Monitor", "Subscriptions", - "Monitor" + "Storage" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -690,8 +690,8 @@ "guid": "ae28c84c-33b6-4b78-88b9-fe5c41049d40", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/get-started/manage-costs", "services": [ - "Subscriptions", - "Cost" + "Cost", + "Subscriptions" ], "severity": "High", "subcategory": "Subscriptions", @@ -705,8 +705,8 @@ "guid": "3a923c34-74d0-4001-aac6-a9e01e6a83de", "link": "https://learn.microsoft.com/azure/governance/management-groups/overview", "services": [ - "Subscriptions", - "Entra" + "Entra", + "Subscriptions" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -721,8 +721,8 @@ "guid": "5de32c19-9248-4160-9d5d-1e4e614658d3", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs", "services": [ - "Subscriptions", - "Cost" + "Cost", + "Subscriptions" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -790,8 +790,8 @@ "guid": "373f482f-3e39-4d39-8aa4-7e566f6082b6", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-app-delivery", "services": [ - "FrontDoor", - "AppGW" + "AppGW", + "FrontDoor" ], "severity": "Medium", "subcategory": "App delivery", @@ -820,13 +820,13 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology", "service": "VNet", "services": [ - "NVA", - "Firewall", - "ExpressRoute", - "DNS", "Entra", + "NVA", + "VPN", + "Firewall", "VNet", - "VPN" + "DNS", + "ExpressRoute" ], "severity": "High", "subcategory": "Hub and spoke", @@ -870,9 +870,9 @@ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", "service": "ExpressRoute", "services": [ + "ExpressRoute", "ARS", - "VPN", - "ExpressRoute" + "VPN" ], "severity": "Low", "subcategory": "Hub and spoke", @@ -904,8 +904,8 @@ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", "service": "VNet", "services": [ - "VNet", - "ACR" + "ACR", + "VNet" ], "severity": "Medium", "subcategory": "Hub and spoke", @@ -1015,8 +1015,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", "service": "ExpressRoute", "services": [ - "VNet", - "ACR" + "ACR", + "VNet" ], "severity": "High", "subcategory": "IP plan", @@ -1079,8 +1079,8 @@ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal", "service": "DNS", "services": [ - "VNet", - "DNS" + "DNS", + "VNet" ], "severity": "Medium", "subcategory": "IP plan", @@ -1095,9 +1095,9 @@ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", "service": "DNS", "services": [ + "DNS", "ACR", - "VNet", - "DNS" + "VNet" ], "severity": "Medium", "subcategory": "IP plan", @@ -1112,8 +1112,8 @@ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", "service": "DNS", "services": [ - "VNet", - "DNS" + "DNS", + "VNet" ], "severity": "Low", "subcategory": "IP plan", @@ -1128,9 +1128,9 @@ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", "service": "DNS", "services": [ - "VM", + "DNS", "VNet", - "DNS" + "VM" ], "severity": "High", "subcategory": "IP plan", @@ -1177,10 +1177,10 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", "service": "WAF", "services": [ - "FrontDoor", + "AzurePolicy", "ACR", - "WAF", - "AzurePolicy" + "FrontDoor", + "WAF" ], "severity": "Medium", "subcategory": "Internet", @@ -1195,10 +1195,10 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "WAF", "services": [ - "FrontDoor", + "AzurePolicy", "AppGW", - "WAF", - "AzurePolicy" + "FrontDoor", + "WAF" ], "severity": "Low", "subcategory": "Internet", @@ -1213,8 +1213,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "WAF", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "subcategory": "Internet", @@ -1273,8 +1273,8 @@ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", "service": "Policy", "services": [ - "VM", - "AzurePolicy" + "AzurePolicy", + "VM" ], "severity": "High", "subcategory": "Internet", @@ -1290,8 +1290,8 @@ "service": "ExpressRoute", "services": [ "ExpressRoute", - "VPN", - "Backup" + "Backup", + "VPN" ], "severity": "Medium", "subcategory": "Hybrid", @@ -1497,9 +1497,9 @@ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", "service": "ExpressRoute", "services": [ - "ACR", "Monitor", - "NetworkWatcher" + "NetworkWatcher", + "ACR" ], "severity": "Medium", "subcategory": "Hybrid", @@ -1622,8 +1622,8 @@ "service": "ExpressRoute", "services": [ "ExpressRoute", - "VNet", - "Monitor" + "Monitor", + "VNet" ], "severity": "Medium", "subcategory": "Hybrid", @@ -1783,9 +1783,9 @@ "services": [ "NVA", "Firewall", - "VWAN", + "VNet", "Storage", - "VNet" + "VWAN" ], "severity": "High", "subcategory": "Firewall", @@ -2055,9 +2055,9 @@ "service": "Firewall", "services": [ "Firewall", + "DNS", "NVA", - "PrivateLink", - "DNS" + "PrivateLink" ], "severity": "Medium", "subcategory": "PaaS", @@ -2118,8 +2118,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", "service": "NSG", "services": [ - "VNet", - "ACR" + "ACR", + "VNet" ], "severity": "Medium", "subcategory": "Segmentation", @@ -2134,9 +2134,9 @@ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", "service": "NSG", "services": [ + "Entra", "NVA", - "VNet", - "Entra" + "VNet" ], "severity": "Medium", "subcategory": "Segmentation", @@ -2151,8 +2151,8 @@ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview", "service": "NSG", "services": [ - "VNet", - "NetworkWatcher" + "NetworkWatcher", + "VNet" ], "severity": "Medium", "subcategory": "Segmentation", @@ -2246,8 +2246,8 @@ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", "service": "VWAN", "services": [ - "VWAN", - "Monitor" + "Monitor", + "VWAN" ], "severity": "Medium", "subcategory": "Virtual WAN", @@ -2277,8 +2277,8 @@ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", "service": "VWAN", "services": [ - "VWAN", "ExpressRoute", + "VWAN", "VPN" ], "severity": "Medium", @@ -2338,8 +2338,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "service": "Policy", "services": [ - "RBAC", - "AzurePolicy" + "AzurePolicy", + "RBAC" ], "severity": "Medium", "subcategory": "Governance", @@ -2353,8 +2353,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "service": "Policy", "services": [ - "Subscriptions", - "AzurePolicy" + "AzurePolicy", + "Subscriptions" ], "severity": "Medium", "subcategory": "Governance", @@ -2382,8 +2382,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", "service": "Policy", "services": [ - "Subscriptions", - "AzurePolicy" + "AzurePolicy", + "Subscriptions" ], "severity": "Low", "subcategory": "Governance", @@ -2412,10 +2412,10 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", "service": "Policy", "services": [ - "Subscriptions", - "RBAC", + "AzurePolicy", "Entra", - "AzurePolicy" + "Subscriptions", + "RBAC" ], "severity": "Medium", "subcategory": "Governance", @@ -2429,8 +2429,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "service": "Policy", "services": [ - "Subscriptions", - "AzurePolicy" + "AzurePolicy", + "Subscriptions" ], "severity": "Medium", "subcategory": "Governance", @@ -2459,8 +2459,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", "service": "Policy", "services": [ - "Subscriptions", - "AzurePolicy" + "AzurePolicy", + "Subscriptions" ], "severity": "Medium", "subcategory": "Governance", @@ -2501,9 +2501,9 @@ "guid": "29fd366b-a180-452b-9bd7-954b7700c667", "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets?bc=%2Fazure%2Fcloud-adoption-framework%2F_bread%2Ftoc.json&toc=%2Fazure%2Fcloud-adoption-framework%2Ftoc.json", "services": [ + "Monitor", "TrafficManager", - "Cost", - "Monitor" + "Cost" ], "severity": "Medium", "subcategory": "Optimize your cloud investment", @@ -2517,9 +2517,9 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "service": "Monitor", "services": [ + "Monitor", "Entra", "RBAC", - "Monitor", "AzurePolicy" ], "severity": "Medium", @@ -2535,10 +2535,10 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", "service": "Monitor", "services": [ - "Storage", + "AzurePolicy", "ARS", "Monitor", - "AzurePolicy" + "Storage" ], "severity": "High", "subcategory": "Monitoring", @@ -2553,9 +2553,9 @@ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", "service": "VM", "services": [ - "VM", "Monitor", - "AzurePolicy" + "AzurePolicy", + "VM" ], "severity": "Medium", "subcategory": "Monitoring", @@ -2629,9 +2629,9 @@ "guid": "a6e55d7d-8a2a-4db1-87d6-326af625ca44", "link": "https://learn.microsoft.com/azure/governance/policy/concepts/effect-deny", "services": [ + "AzurePolicy", "RBAC", - "Monitor", - "AzurePolicy" + "Monitor" ], "severity": "Low", "subcategory": "Monitoring", @@ -2702,8 +2702,8 @@ "guid": "619e8a13-f988-4795-85d6-26886d70ba6c", "link": "https://learn.microsoft.com/azure/azure-monitor/agents/diagnostics-extension-overview", "services": [ - "Storage", - "Monitor" + "Monitor", + "Storage" ], "severity": "Medium", "subcategory": "Monitoring", @@ -2770,6 +2770,20 @@ "training": "https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/", "waf": "Operations" }, + { + "category": "Management", + "checklist": "Azure Landing Zone Review", + "guid": "aa45be6a-8f2d-4896-b0e3-885e6e94e770", + "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview", + "services": [ + "Monitor" + ], + "severity": "Medium", + "subcategory": "Monitoring", + "text": "Use Azure Monitoring Agent (AMA). The Log Analytics agent is deprecated since August 31,2024", + "training": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview#installation", + "waf": "Operations" + }, { "category": "Management", "checklist": "Azure Landing Zone Review", @@ -2804,8 +2818,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", "service": "VM", "services": [ - "VM", - "AzurePolicy" + "AzurePolicy", + "VM" ], "severity": "Medium", "subcategory": "Operational compliance", @@ -2820,9 +2834,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", "service": "VM", "services": [ - "VM", "Monitor", - "AzurePolicy" + "AzurePolicy", + "VM" ], "severity": "Medium", "subcategory": "Operational compliance", @@ -2837,8 +2851,8 @@ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", "service": "VM", "services": [ - "VM", "ASR", + "VM", "ACR" ], "severity": "Medium", @@ -2883,9 +2897,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", "service": "WAF", "services": [ + "AppGW", "FrontDoor", - "WAF", - "AppGW" + "WAF" ], "severity": "High", "subcategory": "App delivery", @@ -2900,10 +2914,10 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", "service": "WAF", "services": [ - "FrontDoor", "Sentinel", - "WAF", - "AppGW" + "AppGW", + "FrontDoor", + "WAF" ], "severity": "Medium", "subcategory": "App delivery", @@ -2973,8 +2987,8 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Key Vault", "services": [ - "AKV", - "AzurePolicy" + "AzurePolicy", + "AKV" ], "severity": "Medium", "subcategory": "Encryption and keys", @@ -2989,9 +3003,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Key Vault", "services": [ - "AKV", + "Entra", "RBAC", - "Entra" + "AKV" ], "severity": "Medium", "subcategory": "Encryption and keys", @@ -3036,9 +3050,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Key Vault", "services": [ - "AKV", "VNet", - "PrivateLink" + "PrivateLink", + "AKV" ], "severity": "Medium", "subcategory": "Encryption and keys", @@ -3053,9 +3067,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", "service": "Key Vault", "services": [ + "Monitor", "Entra", - "AKV", - "Monitor" + "AKV" ], "severity": "Medium", "subcategory": "Encryption and keys", @@ -3070,8 +3084,8 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Key Vault", "services": [ - "AKV", - "AzurePolicy" + "AzurePolicy", + "AKV" ], "severity": "Medium", "subcategory": "Encryption and keys", @@ -3161,9 +3175,9 @@ "guid": "4e3ab369-3829-4e7e-9161-83687a0477a2", "link": "https://learn.microsoft.com/azure/azure-monitor/logs/logs-data-export?tabs=portal", "services": [ - "Storage", + "Monitor", "ARS", - "Monitor" + "Storage" ], "severity": "Medium", "subcategory": "Operations", @@ -3239,8 +3253,8 @@ "link": "https://learn.microsoft.com/azure/security-center/", "service": "VM", "services": [ - "Defender", - "Monitor" + "Monitor", + "Defender" ], "severity": "Medium", "subcategory": "Operations", @@ -3255,8 +3269,8 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "service": "Monitor", "services": [ - "Entra", - "Monitor" + "Monitor", + "Entra" ], "severity": "Medium", "subcategory": "Operations", @@ -3456,8 +3470,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/considerations/development-strategy-development-lifecycle#automated-builds", "service": "Key Vault", "services": [ - "VM", - "AKV" + "AKV", + "VM" ], "severity": "High", "subcategory": "DevOps Team Topologies", @@ -3557,8 +3571,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", "service": "APIM", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Development best practices", @@ -3572,8 +3586,8 @@ "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", "service": "APIM", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Development best practices", @@ -3587,9 +3601,9 @@ "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", "service": "APIM", "services": [ - "ACR", + "AzurePolicy", "APIM", - "AzurePolicy" + "ACR" ], "severity": "Medium", "subcategory": "Development best practices", @@ -3617,8 +3631,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", "service": "APIM", "services": [ - "APIM", - "Monitor" + "Monitor", + "APIM" ], "severity": "High", "subcategory": "Monitoring", @@ -3632,8 +3646,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights", "service": "APIM", "services": [ - "APIM", - "Monitor" + "Monitor", + "APIM" ], "severity": "Medium", "subcategory": "Monitoring", @@ -3647,8 +3661,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", "service": "APIM", "services": [ - "APIM", - "Monitor" + "Monitor", + "APIM" ], "severity": "High", "subcategory": "Monitoring", @@ -3662,9 +3676,9 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault", "service": "APIM", "services": [ - "AKV", "APIM", - "Entra" + "Entra", + "AKV" ], "severity": "High", "subcategory": "Data protection", @@ -3737,8 +3751,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", "service": "APIM", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Best practices", @@ -3752,9 +3766,9 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", "service": "APIM", "services": [ - "ASR", "APIM", - "ACR" + "ACR", + "ASR" ], "severity": "Medium", "subcategory": "Business continuity and disaster recovery", @@ -3768,8 +3782,8 @@ "link": "https://learn.microsoft.com/azure/api-management/high-availability", "service": "APIM", "services": [ - "ASR", - "APIM" + "APIM", + "ASR" ], "severity": "Medium", "subcategory": "Business continuity and disaster recovery", @@ -3783,8 +3797,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", "service": "APIM", "services": [ - "ASR", "APIM", + "ASR", "Backup" ], "severity": "High", @@ -3799,8 +3813,8 @@ "link": "https://learn.microsoft.com/azure/api-management/retry-policy", "service": "APIM", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Failover and Caching", @@ -3813,8 +3827,8 @@ "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e", "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Performance and scalability", @@ -3844,8 +3858,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", "service": "APIM", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Performance and scalability", @@ -3902,8 +3916,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", "service": "APIM", "services": [ - "APIM", - "AzurePolicy" + "AzurePolicy", + "APIM" ], "severity": "Medium", "subcategory": "Request Routing", @@ -3946,9 +3960,9 @@ "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", "service": "APIM", "services": [ - "FrontDoor", "APIM", - "Entra" + "Entra", + "FrontDoor" ], "severity": "Medium", "subcategory": "Connectivity", @@ -3977,10 +3991,10 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", "service": "APIM", "services": [ - "Entra", + "Monitor", "APIM", - "VNet", - "Monitor" + "Entra", + "VNet" ], "severity": "Medium", "subcategory": "Security", @@ -3994,8 +4008,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", "service": "APIM", "services": [ - "Entra", "APIM", + "Entra", "VNet", "PrivateLink" ], @@ -4153,8 +4167,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets", "service": "APIM", "services": [ - "AKV", - "APIM" + "APIM", + "AKV" ], "severity": "High", "subcategory": "Data protection", @@ -4183,10 +4197,10 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", "service": "APIM", "services": [ - "WAF", "APIM", "Entra", - "AppGW" + "AppGW", + "WAF" ], "severity": "High", "subcategory": "Network", @@ -4212,9 +4226,9 @@ "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", "service": "Spring Apps", "services": [ - "FrontDoor", + "ASR", "TrafficManager", - "ASR" + "FrontDoor" ], "severity": "Medium", "subcategory": "Disaster Recovery", @@ -4303,8 +4317,8 @@ "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", "service": "AVS", "services": [ - "Subscriptions", "Entra", + "Subscriptions", "AVS" ], "severity": "High", @@ -4388,9 +4402,9 @@ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", "service": "AVS", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "Medium", "subcategory": "Identity", @@ -4403,9 +4417,9 @@ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", "service": "AVS", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "Medium", "subcategory": "Identity", @@ -4418,9 +4432,9 @@ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", "service": "AVS", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "High", "subcategory": "Identity", @@ -4433,9 +4447,9 @@ "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", "service": "AVS", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "High", "subcategory": "Identity", @@ -4462,11 +4476,11 @@ "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", "service": "AVS", "services": [ + "VPN", "NetworkWatcher", - "ExpressRoute", "Monitor", "AVS", - "VPN" + "ExpressRoute" ], "severity": "High", "subcategory": "Monitoring", @@ -4480,10 +4494,10 @@ "service": "AVS", "services": [ "NetworkWatcher", - "ExpressRoute", "Monitor", + "AVS", "VM", - "AVS" + "ExpressRoute" ], "severity": "Medium", "subcategory": "Monitoring", @@ -4496,10 +4510,10 @@ "guid": "f41ce6a0-64f3-4805-bc65-3ab50df01265", "service": "AVS", "services": [ - "VM", - "NetworkWatcher", "Monitor", - "AVS" + "NetworkWatcher", + "AVS", + "VM" ], "severity": "Medium", "subcategory": "Monitoring", @@ -4526,9 +4540,9 @@ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", "service": "AVS", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "High", "subcategory": "Security (identity)", @@ -4541,9 +4555,9 @@ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", "service": "AVS", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "High", "subcategory": "Security (identity)", @@ -4584,9 +4598,9 @@ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", "service": "AVS", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "Medium", "subcategory": "Security (identity)", @@ -4613,9 +4627,9 @@ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", "service": "AVS", "services": [ - "VM", "Entra", - "AVS" + "AVS", + "VM" ], "severity": "High", "subcategory": "Security (identity)", @@ -4683,11 +4697,11 @@ "guid": "334fdf91-c234-4182-a652-75269440b4be", "service": "AVS", "services": [ - "DDoS", - "ExpressRoute", - "AVS", + "VPN", "VNet", - "VPN" + "AVS", + "ExpressRoute", + "DDoS" ], "severity": "Medium", "subcategory": "Security (network)", @@ -4713,8 +4727,8 @@ "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", "service": "AVS", "services": [ - "Defender", - "AVS" + "AVS", + "Defender" ], "severity": "Medium", "subcategory": "Security (guest/VM)", @@ -4727,8 +4741,8 @@ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", "service": "AVS", "services": [ - "Arc", - "AVS" + "AVS", + "Arc" ], "severity": "Medium", "subcategory": "Security (guest/VM)", @@ -4755,8 +4769,8 @@ "guid": "a3592718-e6e2-4051-9267-6ae46691e883", "service": "AVS", "services": [ - "AKV", - "AVS" + "AVS", + "AKV" ], "severity": "Low", "subcategory": "Security (guest/VM)", @@ -4795,9 +4809,9 @@ "guid": "d88408f3-7273-44c8-96ba-280214590146", "service": "AVS", "services": [ - "Storage", "AzurePolicy", - "AVS" + "AVS", + "Storage" ], "severity": "High", "subcategory": "Governance (platform)", @@ -4906,8 +4920,8 @@ "service": "AVS", "services": [ "VM", - "Defender", - "AVS" + "AVS", + "Defender" ], "severity": "Medium", "subcategory": "Governance (guest/VM)", @@ -4920,9 +4934,9 @@ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", "service": "AVS", "services": [ - "VM", + "AVS", "Arc", - "AVS" + "VM" ], "severity": "Medium", "subcategory": "Governance (guest/VM)", @@ -4948,9 +4962,9 @@ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", "service": "AVS", "services": [ - "VM", "Monitor", - "AVS" + "AVS", + "VM" ], "severity": "Medium", "subcategory": "Governance (guest/VM)", @@ -4963,10 +4977,10 @@ "guid": "589d457a-927c-4397-9d11-02cad6aae11e", "service": "AVS", "services": [ - "VM", "AzurePolicy", + "AVS", "Backup", - "AVS" + "VM" ], "severity": "Medium", "subcategory": "Governance (guest/VM)", @@ -4979,9 +4993,9 @@ "guid": "ee29711b-d352-4caa-ab79-b198dab81932", "service": "AVS", "services": [ - "Defender", "Monitor", - "AVS" + "AVS", + "Defender" ], "severity": "Medium", "subcategory": "Compliance", @@ -4994,8 +5008,8 @@ "guid": "c9fc9d1b-b780-436f-9e6b-fbb9ed503547", "service": "AVS", "services": [ - "Defender", - "AVS" + "AVS", + "Defender" ], "severity": "Medium", "subcategory": "Compliance", @@ -5103,9 +5117,9 @@ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", "service": "AVS", "services": [ - "Storage", "Monitor", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Monitoring", @@ -5132,10 +5146,10 @@ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", "service": "AVS", "services": [ - "VM", - "Storage", "AzurePolicy", - "AVS" + "AVS", + "Storage", + "VM" ], "severity": "High", "subcategory": "Operations", @@ -5161,9 +5175,9 @@ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", "service": "AVS", "services": [ + "AVS", "Storage", - "Backup", - "AVS" + "Backup" ], "severity": "Medium", "subcategory": "Operations", @@ -5176,8 +5190,8 @@ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", "service": "AVS", "services": [ - "Arc", - "AVS" + "AVS", + "Arc" ], "severity": "Medium", "subcategory": "Operations", @@ -5217,9 +5231,9 @@ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", "service": "AVS", "services": [ - "AzurePolicy", "Monitor", - "AVS" + "AVS", + "AzurePolicy" ], "severity": "Medium", "subcategory": "Operations", @@ -5232,8 +5246,8 @@ "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", "service": "AVS", "services": [ - "Defender", - "AVS" + "AVS", + "Defender" ], "severity": "Medium", "subcategory": "Security", @@ -5246,8 +5260,8 @@ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", "service": "AVS", "services": [ - "Backup", - "AVS" + "AVS", + "Backup" ], "severity": "Medium", "subcategory": "Backup", @@ -5330,9 +5344,9 @@ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", "service": "AVS", "services": [ - "NVA", "ExpressRoute", "ASR", + "NVA", "AVS" ], "severity": "Medium", @@ -5346,8 +5360,8 @@ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", "service": "AVS", "services": [ - "Backup", - "AVS" + "AVS", + "Backup" ], "severity": "Medium", "subcategory": "Business Continuity", @@ -5360,8 +5374,8 @@ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", "service": "AVS", "services": [ - "Backup", - "AVS" + "AVS", + "Backup" ], "severity": "Medium", "subcategory": "Business Continuity", @@ -5374,8 +5388,8 @@ "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", "service": "AVS", "services": [ - "Backup", - "AVS" + "AVS", + "Backup" ], "severity": "Medium", "subcategory": "Business Continuity", @@ -5467,8 +5481,8 @@ "guid": "e2cc95d4-8c6b-4791-bca0-f6c56589e558", "service": "AVS", "services": [ - "AKV", - "AVS" + "AVS", + "AKV" ], "severity": "Low", "subcategory": "Automated Connectivity", @@ -5482,8 +5496,8 @@ "service": "AVS", "services": [ "ExpressRoute", - "AKV", - "AVS" + "AVS", + "AKV" ], "severity": "Low", "subcategory": "Automated Connectivity", @@ -5536,9 +5550,9 @@ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", "service": "AVS", "services": [ - "Storage", "AzurePolicy", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Automated Scale", @@ -5605,8 +5619,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", "service": "AVS", "services": [ - "VM", - "AVS" + "AVS", + "VM" ], "severity": "High", "subcategory": "Architecture", @@ -5635,8 +5649,8 @@ "guid": "bc91a43d-90da-4e2c-a881-4706f7c1cbaf", "service": "AVS", "services": [ - "VPN", - "AVS" + "AVS", + "VPN" ], "severity": "Medium", "subcategory": "Networking", @@ -5676,9 +5690,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", "service": "AVS", "services": [ - "VM", + "AVS", "Storage", - "AVS" + "VM" ], "severity": "Medium", "subcategory": "Architecture", @@ -5692,9 +5706,9 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", "service": "AVS", "services": [ - "Storage", "ExpressRoute", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Architecture", @@ -5708,9 +5722,9 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", "service": "AVS", "services": [ - "Storage", "ExpressRoute", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Architecture", @@ -5829,8 +5843,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push", "service": "ACR", "services": [ - "AKV", - "ACR" + "ACR", + "AKV" ], "severity": "High", "subcategory": "Data Protection", @@ -5845,8 +5859,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys", "service": "ACR", "services": [ - "AKV", - "ACR" + "ACR", + "AKV" ], "severity": "Medium", "subcategory": "Data Protection", @@ -5861,9 +5875,9 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", "service": "ACR", "services": [ - "RBAC", "Entra", - "ACR" + "ACR", + "RBAC" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -5878,9 +5892,9 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", "service": "ACR", "services": [ - "RBAC", "Entra", - "ACR" + "ACR", + "RBAC" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -5895,9 +5909,9 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli", "service": "ACR", "services": [ - "RBAC", "Entra", - "ACR" + "ACR", + "RBAC" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -5944,9 +5958,9 @@ "service": "ACR", "services": [ "EventHubs", - "PrivateLink", "Entra", - "ACR" + "ACR", + "PrivateLink" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -5978,8 +5992,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/monitor-service", "service": "ACR", "services": [ - "Entra", "Monitor", + "Entra", "ACR" ], "severity": "Medium", @@ -5996,9 +6010,9 @@ "service": "ACR", "services": [ "Firewall", + "ACR", "VNet", - "PrivateLink", - "ACR" + "PrivateLink" ], "severity": "Medium", "subcategory": "Network Security", @@ -6013,8 +6027,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access", "service": "ACR", "services": [ - "PrivateLink", - "ACR" + "ACR", + "PrivateLink" ], "severity": "Medium", "subcategory": "Network Security", @@ -6029,8 +6043,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus", "service": "ACR", "services": [ - "PrivateLink", - "ACR" + "ACR", + "PrivateLink" ], "severity": "Medium", "subcategory": "Network Security", @@ -6045,8 +6059,8 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", "service": "ACR", "services": [ - "Defender", - "ACR" + "ACR", + "Defender" ], "severity": "Low", "subcategory": "Network Security", @@ -6088,9 +6102,9 @@ "guid": "976f32a7-30d1-6caa-c2a0-207fdc26571b", "link": "https://learn.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", "services": [ + "AVS", "Storage", - "Backup", - "AVS" + "Backup" ], "severity": "Medium", "subcategory": "Backup", @@ -6104,8 +6118,8 @@ "guid": "fc8af7a1-c724-e255-c18d-4ca22a6f27f0", "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", "services": [ - "Backup", - "AVS" + "AVS", + "Backup" ], "severity": "Medium", "subcategory": "Business Continuity", @@ -6120,8 +6134,8 @@ "link": "Best practice to deploy backup in the same region as your AVS deployment", "services": [ "ASR", - "Backup", - "AVS" + "AVS", + "Backup" ], "severity": "Medium", "subcategory": "Business Continuity", @@ -6238,9 +6252,9 @@ "guid": "b44fb6ec-bfc1-3a8e-dba2-ca97f0991d2c", "link": "This depends if you have multiple AVS Private Clouds. If so and they are in the same region then use AVS Interconnect. If they are in separate regions then use ExpressRoute Global Reach.", "services": [ - "ASR", "ExpressRoute", "NVA", + "ASR", "AVS" ], "severity": "Medium", @@ -6330,8 +6344,8 @@ "guid": "91f7a87b-21ac-d712-959c-8df2ba034253", "link": "https://learn.microsoft.com/azure/virtual-network/quick-create-portal", "services": [ - "VNet", - "AVS" + "AVS", + "VNet" ], "severity": "Medium", "subcategory": "Hub & Spoke", @@ -6346,9 +6360,9 @@ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", "services": [ "ExpressRoute", + "AVS", "VNet", - "VPN", - "AVS" + "VPN" ], "severity": "Medium", "subcategory": "Hub & Spoke", @@ -6363,9 +6377,9 @@ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", "services": [ "ExpressRoute", + "AVS", "VNet", - "VPN", - "AVS" + "VPN" ], "severity": "Medium", "subcategory": "Hub & Spoke", @@ -6380,9 +6394,9 @@ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings", "services": [ "ExpressRoute", + "AVS", "VNet", - "VPN", - "AVS" + "VPN" ], "severity": "Medium", "subcategory": "Hub & Spoke", @@ -6411,8 +6425,8 @@ "guid": "71e68ce3-982e-5e56-0191-01100ad0e66f", "link": "https://learn.microsoft.com/answers/questions/171195/how-to-create-jump-server-in-azure-not-bastion-paa.html", "services": [ - "Bastion", - "AVS" + "AVS", + "Bastion" ], "severity": "Medium", "subcategory": "Jumpbox & Bastion", @@ -6427,8 +6441,8 @@ "link": "https://learn.microsoft.com/azure/bastion/tutorial-create-host-portal", "services": [ "VNet", - "Bastion", - "AVS" + "AVS", + "Bastion" ], "severity": "Medium", "subcategory": "Jumpbox & Bastion", @@ -6442,9 +6456,9 @@ "guid": "ba430d58-4541-085c-3641-068c00be9bc5", "link": "https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview", "services": [ - "VM", + "AVS", "Bastion", - "AVS" + "VM" ], "severity": "Medium", "subcategory": "Jumpbox & Bastion", @@ -6458,8 +6472,8 @@ "guid": "9988598f-2a9f-6b12-9b46-488415ceb325", "link": "https://learn.microsoft.com/azure/azure-vmware/configure-site-to-site-vpn-gateway", "services": [ - "VPN", - "AVS" + "AVS", + "VPN" ], "severity": "Medium", "subcategory": "VPN", @@ -6473,8 +6487,8 @@ "guid": "956ce5e9-a862-fe2b-a50d-a22923569357", "link": "https://www.omnicalculator.com/other/data-transfer#:~:text=To%20calculate%20the%20data%20transfer%20speed%3A%201%20Download,measured%20time%20to%20find%20the%20data%20transfer%20speed.", "services": [ - "VPN", - "AVS" + "AVS", + "VPN" ], "severity": "Medium", "subcategory": "VPN", @@ -6488,8 +6502,8 @@ "guid": "e095116f-0bdc-4b51-4d71-b9e469d56f59", "link": "https://learn.microsoft.com/azure/architecture/solution-ideas/articles/azure-vmware-solution-foundation-networking", "services": [ - "VPN", - "AVS" + "AVS", + "VPN" ], "severity": "Medium", "subcategory": "VPN", @@ -6519,8 +6533,8 @@ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-point-to-site-portal", "services": [ "VWAN", - "VPN", - "AVS" + "AVS", + "VPN" ], "severity": "Medium", "subcategory": "vWAN hub", @@ -6625,9 +6639,9 @@ "guid": "4ba394a2-3c33-104c-8e34-2dadaba9cc73", "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "Medium", "subcategory": "Security", @@ -6641,9 +6655,9 @@ "guid": "b04ca129-83a9-3494-7512-347dd2d766db", "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-identity#view-the-vcenter-server-privileges", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "Medium", "subcategory": "Security", @@ -6657,9 +6671,9 @@ "guid": "8e477d2f-8004-3dd0-93d6-0aece9e1b2fb", "link": "Best practice", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "Medium", "subcategory": "Security", @@ -6673,9 +6687,9 @@ "guid": "00e0b729-f9be-f600-8c32-5ec0e8f2ed63", "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "Medium", "subcategory": "Security ", @@ -6689,9 +6703,9 @@ "guid": "0842d45f-41a8-8274-1155-2f6ed554d315", "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", "services": [ - "RBAC", "Entra", - "AVS" + "AVS", + "RBAC" ], "severity": "Medium", "subcategory": "Security ", @@ -6736,9 +6750,9 @@ "guid": "8f426fd0-d73b-d398-1f6f-df0cbe262a82", "link": "https://learn.microsoft.com/azure/azure-arc/vmware-vsphere/overview", "services": [ - "VM", + "AVS", "Arc", - "AVS" + "VM" ], "severity": "Medium", "subcategory": "Operations", @@ -6753,8 +6767,8 @@ "link": "https://docs.microsoft.com/azure/governance/policy/overview", "services": [ "AzurePolicy", - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Operations", @@ -6796,8 +6810,8 @@ "guid": "86b314f9-1f1e-317a-4dfb-cf510ad4a030", "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/resource-abbreviations", "services": [ - "AKV", - "AVS" + "AVS", + "AKV" ], "severity": "Medium", "subcategory": "Operations", @@ -6856,11 +6870,11 @@ "guid": "0962606c-e3b4-62a9-5661-e4ffd62a4509", "link": "https://docs.microsoft.com/azure/azure-vmware/set-up-backup-server-for-azure-vmware-solution", "services": [ - "AVS", + "Backup", "Monitor", + "AVS", "VM", - "AzurePolicy", - "Backup" + "AzurePolicy" ], "severity": "Medium", "subcategory": "Backup", @@ -6875,8 +6889,8 @@ "link": "https://docs.microsoft.com/azure/azure-vmware/configure-alerts-for-azure-vmware-solution", "services": [ "AzurePolicy", - "Monitor", - "AVS" + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Capacity", @@ -6890,10 +6904,10 @@ "guid": "7f8f175d-13f4-5298-9e61-0bc7e9fcc279", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/govern", "services": [ - "Subscriptions", "Cost", - "Monitor", - "AVS" + "Subscriptions", + "AVS", + "Monitor" ], "severity": "Medium", "subcategory": "Costs", @@ -6907,8 +6921,8 @@ "guid": "01e689e0-7c6c-b58f-37bd-4d6b9b1b9c74", "link": "https://docs.microsoft.com/azure/azure-portal/azure-portal-dashboards", "services": [ - "NetworkWatcher", "Monitor", + "NetworkWatcher", "AVS" ], "severity": "Medium", @@ -6923,9 +6937,9 @@ "guid": "f9afdcc9-649d-d840-9fb5-a3c0edcc697d", "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs", "services": [ - "Storage", "Monitor", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Logs & Metrics", @@ -6954,9 +6968,9 @@ "guid": "b243521a-644d-f865-7fb6-21f9019c0dd2", "link": "https://docs.microsoft.com/azure/azure-vmware/configure-vmware-syslogs", "services": [ - "VM", "Monitor", - "AVS" + "AVS", + "VM" ], "severity": "Medium", "subcategory": "Logs & Metrics", @@ -6970,11 +6984,11 @@ "guid": "2ca97d91-dd36-7229-b668-01036ccc3cd3", "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal", "services": [ + "VPN", "NetworkWatcher", - "ExpressRoute", "Monitor", "AVS", - "VPN" + "ExpressRoute" ], "severity": "Medium", "subcategory": "Network", @@ -6988,8 +7002,8 @@ "guid": "99209143-60fe-19f0-5633-8b5671277ba5", "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-create-using-portal", "services": [ - "ExpressRoute", "Monitor", + "ExpressRoute", "AVS" ], "severity": "Medium", @@ -7064,9 +7078,9 @@ "guid": "fb00b69a-83ec-ce72-446e-6c23a0cab09a", "link": "https://docs.microsoft.com/azure/azure-monitor/agents/agent-windows?tabs=setup-wizard", "services": [ - "VM", "Monitor", - "AVS" + "AVS", + "VM" ], "severity": "Medium", "subcategory": "VMware", @@ -7108,8 +7122,8 @@ "guid": "ebd3cc3c-ac3d-4293-950d-cecd8445a523", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-network-topology-connectivity", "services": [ - "NVA", "ARS", + "NVA", "AVS" ], "severity": "Medium", @@ -7153,10 +7167,10 @@ "guid": "e942c03d-beaa-3d9f-0526-9b26cd5e9937", "link": "Research and choose optimal solution for each application", "services": [ - "FrontDoor", "NVA", + "AVS", "AppGW", - "AVS" + "FrontDoor" ], "severity": "Medium", "subcategory": "Internet", @@ -7185,15 +7199,15 @@ "guid": "66c97b30-81b9-139a-cc76-dd1d94aef42a", "link": "https://docs.microsoft.com/azure/ddos-protection/manage-ddos-protection", "services": [ - "DDoS", - "ExpressRoute", - "LoadBalancer", "AppGW", - "VM", - "AVS", + "VPN", "FrontDoor", + "LoadBalancer", "VNet", - "VPN" + "AVS", + "VM", + "ExpressRoute", + "DDoS" ], "severity": "Medium", "subcategory": "Security", @@ -7281,9 +7295,9 @@ "guid": "7242c1de-da37-27f3-1ddd-565ccccb8ece", "link": "https://docs.microsoft.com/azure/cloud-adoption-framework/scenarios/azure-vmware/eslz-platform-automation-and-devops#automated-scale", "services": [ - "Storage", "AzurePolicy", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Automated Scale", @@ -7354,8 +7368,8 @@ "guid": "95e374af-8a2a-2672-7ab7-b4a1be43ada7", "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", "services": [ - "PrivateLink", - "AVS" + "AVS", + "PrivateLink" ], "severity": "Medium", "subcategory": "Networking", @@ -7512,8 +7526,8 @@ "guid": "0c87f999-e517-21ef-f355-f210ad4134d2", "link": "https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/installation/GUID-4B3860B8-1883-48CA-B2F3-7C2205D91D6D.html", "services": [ - "VNet", - "AVS" + "AVS", + "VNet" ], "severity": "Medium", "subcategory": "Pre-deployment", @@ -7613,8 +7627,8 @@ "guid": "70cfbddc-d3d4-9188-77c8-1cabaefef646", "link": "General recommendation for storing encryption keys.", "services": [ - "AKV", - "AVS" + "AVS", + "AKV" ], "severity": "Medium", "subcategory": "Encryption", @@ -7644,8 +7658,8 @@ "link": "https://docs.microsoft.com/azure/key-vault/general/authentication", "services": [ "ExpressRoute", - "AKV", - "AVS" + "AVS", + "AKV" ], "severity": "Medium", "subcategory": "Encryption", @@ -7688,8 +7702,8 @@ "guid": "f42b0b09-c591-238a-1580-2de3c485ebd2", "link": "https://learn.microsoft.com/azure/azure-vmware/azure-security-integration#prerequisites", "services": [ - "Defender", - "AVS" + "AVS", + "Defender" ], "severity": "Medium", "subcategory": "Security", @@ -7858,8 +7872,8 @@ "guid": "16ab821a-27c6-b6d3-6042-10dc4d6dfcb7", "link": "https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.storage.doc/GUID-01D3CF47-A84A-4988-8103-A0487D6441AA.html", "services": [ - "Storage", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -7873,9 +7887,9 @@ "guid": "eb2f9313-afb2-ab35-aa24-6d97a3cb0611", "link": "3rd-Party tools", "services": [ - "VM", + "AVS", "Storage", - "AVS" + "VM" ], "severity": "Medium", "subcategory": "Storage", @@ -7889,9 +7903,9 @@ "guid": "3f2a5cff-c8a6-634a-1f1b-53ef9d321381", "link": "Contact VMware", "services": [ - "VM", + "AVS", "Storage", - "AVS" + "VM" ], "severity": "Medium", "subcategory": "Storage", @@ -7905,8 +7919,8 @@ "guid": "efc8a311-74f8-0252-c6a0-4bac7610e266", "link": "Contact VMware", "services": [ - "Storage", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -7920,8 +7934,8 @@ "guid": "ab6c89cd-a26f-b894-fe59-61863975458e", "link": "Contact VMware", "services": [ - "Storage", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -7935,10 +7949,10 @@ "guid": "7628d446-6b10-9678-9cec-f407d990de43", "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance", "services": [ - "VM", - "Storage", "AzurePolicy", - "AVS" + "AVS", + "Storage", + "VM" ], "severity": "Medium", "subcategory": "Storage", @@ -7952,10 +7966,10 @@ "guid": "37fef358-7ab9-43a9-542c-22673955200e", "link": "https://learn.microsoft.com/azure/azure-vmware/configure-storage-policy", "services": [ - "VM", - "Storage", "AzurePolicy", - "AVS" + "AVS", + "Storage", + "VM" ], "severity": "Medium", "subcategory": "Storage", @@ -7970,8 +7984,8 @@ "link": "https://learn.microsoft.com/azure/azure-vmware/concepts-storage#storage-policies-and-fault-tolerance", "services": [ "AzurePolicy", - "Storage", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -7985,8 +7999,8 @@ "guid": "1be821bd-4f37-216a-3e3d-2a5ac6996863", "link": "https://learn.microsoft.com/azure/azure-vmware/netapp-files-with-azure-vmware-solution", "services": [ - "Storage", - "AVS" + "AVS", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -8065,8 +8079,8 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-outages-disasters#geo-disaster-recovery", "services": [ "ASR", - "Storage", - "ServiceBus" + "ServiceBus", + "Storage" ], "severity": "Medium", "subcategory": "Geo-Disaster Recovery", @@ -8096,8 +8110,8 @@ "guid": "d5a83de4-de32-4c18-a147-0607c5c0e4e6", "link": "https://learn.microsoft.com/azure/architecture/best-practices/data-partitioning-strategies#partitioning-azure-service-bus", "services": [ - "Storage", - "ServiceBus" + "ServiceBus", + "Storage" ], "severity": "Medium", "subcategory": "Best Practices", @@ -8136,8 +8150,8 @@ "guid": "4a69b9d3-39ac-44e7-a68d-1d75657202b4", "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", "services": [ - "Storage", "ServiceBus", + "Storage", "PrivateLink" ], "severity": "Medium", @@ -8177,9 +8191,9 @@ "guid": "1549ab81-53d8-49f8-ad17-b84b33b5a67f", "link": "https://learn.microsoft.com/azure/well-architected/service-guides/service-bus/reliability#checklist", "services": [ - "Storage", "ASR", - "ServiceBus" + "ServiceBus", + "Storage" ], "severity": "Medium", "subcategory": "Best Practices", @@ -8291,9 +8305,9 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies", "service": "Service Bus", "services": [ + "Entra", "TrafficManager", "RBAC", - "Entra", "AzurePolicy", "ServiceBus" ], @@ -8311,11 +8325,11 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity", "service": "Service Bus", "services": [ - "VM", - "Storage", - "AKV", - "AppSvc", "Entra", + "AppSvc", + "AKV", + "Storage", + "VM", "ServiceBus" ], "severity": "Medium", @@ -8332,10 +8346,10 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus", "service": "Service Bus", "services": [ + "Entra", "Subscriptions", "RBAC", "Storage", - "Entra", "ServiceBus" ], "severity": "High", @@ -8352,9 +8366,9 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference", "service": "Service Bus", "services": [ - "VNet", + "Monitor", "ServiceBus", - "Monitor" + "VNet" ], "severity": "Medium", "subcategory": "Monitoring", @@ -8370,8 +8384,8 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service", "service": "Service Bus", "services": [ - "VNet", "ServiceBus", + "VNet", "PrivateLink" ], "severity": "Medium", @@ -9339,8 +9353,8 @@ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", "service": "App Services", "services": [ - "AppSvc", - "Monitor" + "Monitor", + "AppSvc" ], "severity": "Medium", "subcategory": "Monitoring", @@ -9425,8 +9439,8 @@ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", "service": "App Services", "services": [ - "AppSvc", - "Monitor" + "Monitor", + "AppSvc" ], "severity": "Medium", "subcategory": "Monitoring", @@ -9440,8 +9454,8 @@ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", "service": "App Services", "services": [ - "AppSvc", - "Monitor" + "Monitor", + "AppSvc" ], "severity": "Medium", "subcategory": "Monitoring", @@ -9455,8 +9469,8 @@ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", "service": "App Services", "services": [ - "AppSvc", - "Monitor" + "Monitor", + "AppSvc" ], "severity": "Low", "subcategory": "Monitoring", @@ -9471,8 +9485,8 @@ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", "service": "App Services", "services": [ - "AKV", - "AppSvc" + "AppSvc", + "AKV" ], "severity": "High", "subcategory": "Data Protection", @@ -9487,9 +9501,9 @@ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", "service": "App Services", "services": [ - "AKV", + "Entra", "AppSvc", - "Entra" + "AKV" ], "severity": "High", "subcategory": "Data Protection", @@ -9504,8 +9518,8 @@ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", "service": "App Services", "services": [ - "AKV", - "AppSvc" + "AppSvc", + "AKV" ], "severity": "High", "subcategory": "Data Protection", @@ -9536,8 +9550,8 @@ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", "service": "App Services", "services": [ - "TrafficManager", - "AppSvc" + "AppSvc", + "TrafficManager" ], "severity": "Medium", "subcategory": "Data Protection", @@ -9552,8 +9566,8 @@ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", "service": "App Services", "services": [ - "AppSvc", - "Entra" + "Entra", + "AppSvc" ], "severity": "Medium", "subcategory": "Identity and Access Control", @@ -9568,8 +9582,8 @@ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", "service": "App Services", "services": [ - "AppSvc", - "Entra" + "Entra", + "AppSvc" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -9584,8 +9598,8 @@ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", "service": "App Services", "services": [ - "AppSvc", - "Entra" + "Entra", + "AppSvc" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -9600,9 +9614,9 @@ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", "service": "App Services", "services": [ - "AKV", + "Entra", "AppSvc", - "Entra" + "AKV" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -9617,9 +9631,9 @@ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", "service": "App Services", "services": [ - "AppSvc", "Entra", - "ACR" + "ACR", + "AppSvc" ], "severity": "High", "subcategory": "Identity and Access Control", @@ -9634,9 +9648,9 @@ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", "service": "App Services", "services": [ + "Monitor", "Entra", - "AppSvc", - "Monitor" + "AppSvc" ], "severity": "Medium", "subcategory": "Logging and Monitoring", @@ -9651,9 +9665,9 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", "service": "App Services", "services": [ + "Monitor", "Entra", - "AppSvc", - "Monitor" + "AppSvc" ], "severity": "Medium", "subcategory": "Logging and Monitoring", @@ -9669,10 +9683,10 @@ "service": "App Services", "services": [ "NVA", - "Firewall", - "Monitor", "AppSvc", - "VNet" + "Firewall", + "VNet", + "Monitor" ], "severity": "Medium", "subcategory": "Network Security", @@ -9688,10 +9702,10 @@ "service": "App Services", "services": [ "NVA", - "Firewall", - "Storage", "AppSvc", + "Firewall", "VNet", + "Storage", "PrivateLink" ], "severity": "Low", @@ -9723,11 +9737,11 @@ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", "service": "App Services", "services": [ - "WAF", - "Monitor", "AppGW", "AppSvc", - "FrontDoor" + "FrontDoor", + "Monitor", + "WAF" ], "severity": "High", "subcategory": "Network Security", @@ -9742,9 +9756,9 @@ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", "service": "App Services", "services": [ - "WAF", + "PrivateLink", "AppSvc", - "PrivateLink" + "WAF" ], "severity": "High", "subcategory": "Network Security", @@ -9760,8 +9774,8 @@ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", "service": "App Services", "services": [ - "AppSvc", - "AzurePolicy" + "AzurePolicy", + "AppSvc" ], "severity": "Medium", "subcategory": "Network Security", @@ -9777,8 +9791,8 @@ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", "service": "App Services", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "High", "subcategory": "Network Security", @@ -9793,8 +9807,8 @@ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", "service": "App Services", "services": [ - "Storage", - "AppSvc" + "AppSvc", + "Storage" ], "severity": "High", "subcategory": "Network Security", @@ -9825,8 +9839,8 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", "service": "App Services", "services": [ - "Defender", - "AppSvc" + "AppSvc", + "Defender" ], "severity": "Medium", "subcategory": "Network Security", @@ -9841,13 +9855,13 @@ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", "service": "App Services", "services": [ - "DDoS", - "EventHubs", "NVA", - "WAF", - "AppGW", "AppSvc", - "VNet" + "AppGW", + "WAF", + "VNet", + "EventHubs", + "DDoS" ], "severity": "Medium", "subcategory": "Network Security", @@ -9862,10 +9876,10 @@ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", "service": "App Services", "services": [ - "VNet", - "AppSvc", "PrivateLink", - "ACR" + "ACR", + "AppSvc", + "VNet" ], "severity": "Medium", "subcategory": "Network Security", @@ -9956,8 +9970,8 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", "service": "Azure Storage", "services": [ - "Storage", "Subscriptions", + "Storage", "RBAC" ], "severity": "Medium", @@ -10064,9 +10078,9 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", "service": "Azure Storage", "services": [ - "Storage", + "AzurePolicy", "Subscriptions", - "AzurePolicy" + "Storage" ], "severity": "High", "subcategory": "Data Availability, Compliance", @@ -10142,8 +10156,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", "service": "Azure Storage", "services": [ - "Storage", - "Entra" + "Entra", + "Storage" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -10157,9 +10171,9 @@ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", "service": "Azure Storage", "services": [ - "Storage", + "Entra", "RBAC", - "Entra" + "Storage" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -10174,8 +10188,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", "service": "Azure Storage", "services": [ - "Storage", - "Entra" + "Entra", + "Storage" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -10191,10 +10205,10 @@ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", "service": "Azure Storage", "services": [ - "Storage", "Monitor", - "AKV", - "Entra" + "Entra", + "Storage", + "AKV" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -10209,10 +10223,10 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", "service": "Azure Storage", "services": [ - "Storage", - "AKV", "Monitor", - "AzurePolicy" + "Storage", + "AzurePolicy", + "AKV" ], "severity": "High", "subcategory": "Monitoring", @@ -10227,10 +10241,10 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", "service": "Azure Storage", "services": [ - "Storage", - "AKV", + "AzurePolicy", "Entra", - "AzurePolicy" + "Storage", + "AKV" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -10245,9 +10259,9 @@ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", "service": "Azure Storage", "services": [ - "Storage", + "AzurePolicy", "Entra", - "AzurePolicy" + "Storage" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -10262,10 +10276,10 @@ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", "service": "Azure Storage", "services": [ - "Storage", - "AKV", + "AzurePolicy", "Entra", - "AzurePolicy" + "Storage", + "AKV" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -10295,8 +10309,8 @@ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", "service": "Azure Storage", "services": [ - "Storage", - "Entra" + "Entra", + "Storage" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -10311,9 +10325,9 @@ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", "service": "Azure Storage", "services": [ - "Storage", + "AzurePolicy", "Entra", - "AzurePolicy" + "Storage" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -10328,8 +10342,8 @@ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", "service": "Azure Storage", "services": [ - "Storage", - "Entra" + "Entra", + "Storage" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -10344,8 +10358,8 @@ "link": "https://learn.microsoft.com/rest/api/storageservices/create-account-sas", "service": "Azure Storage", "services": [ - "Storage", - "Entra" + "Entra", + "Storage" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -10359,8 +10373,8 @@ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", "service": "Azure Storage", "services": [ - "Storage", - "Entra" + "Entra", + "Storage" ], "severity": "Low", "subcategory": "Identity and Access Management", @@ -10375,9 +10389,9 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", "service": "Azure Storage", "services": [ - "Storage", + "Entra", "RBAC", - "Entra" + "Storage" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -10391,8 +10405,8 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-known-issues#authentication-and-authorization", "service": "Azure Storage", "services": [ - "Storage", - "Entra" + "Entra", + "Storage" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -10407,8 +10421,8 @@ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", "service": "Azure Storage", "services": [ - "Storage", - "AzurePolicy" + "AzurePolicy", + "Storage" ], "severity": "High", "subcategory": "Networking", @@ -10467,8 +10481,8 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", "service": "Azure Storage", "services": [ - "Storage", - "Entra" + "Entra", + "Storage" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -10585,10 +10599,10 @@ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", "service": "Event Hubs", "services": [ - "EventHubs", + "Entra", "TrafficManager", "RBAC", - "Entra", + "EventHubs", "AzurePolicy" ], "severity": "Medium", @@ -10605,11 +10619,11 @@ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", "service": "Event Hubs", "services": [ - "EventHubs", - "VM", - "Storage", + "Entra", "AKV", - "Entra" + "Storage", + "VM", + "EventHubs" ], "severity": "Medium", "subcategory": "Identity and Access Management", @@ -10626,8 +10640,8 @@ "service": "Event Hubs", "services": [ "EventHubs", - "RBAC", - "Entra" + "Entra", + "RBAC" ], "severity": "High", "subcategory": "Identity and Access Management", @@ -10644,8 +10658,8 @@ "service": "Event Hubs", "services": [ "EventHubs", - "VNet", - "Monitor" + "Monitor", + "VNet" ], "severity": "Medium", "subcategory": "Monitoring", @@ -10857,8 +10871,8 @@ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", "service": "App Gateway", "services": [ - "VNet", - "AppGW" + "AppGW", + "VNet" ], "severity": "Medium", "subcategory": "App Gateway", @@ -10874,12 +10888,12 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "App Gateway", "services": [ - "NVA", - "Subscriptions", - "WAF", - "AppGW", "Entra", - "VNet" + "NVA", + "AppGW", + "Subscriptions", + "VNet", + "WAF" ], "severity": "Medium", "subcategory": "App Gateway", @@ -10940,9 +10954,9 @@ "link": "https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/afds-overview", "service": "Front Door", "services": [ + "AzurePolicy", "FrontDoor", - "WAF", - "AzurePolicy" + "WAF" ], "severity": "Medium", "subcategory": "Front Door", @@ -10957,10 +10971,10 @@ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", "service": "Front Door", "services": [ - "FrontDoor", + "AzurePolicy", "AppGW", - "WAF", - "AzurePolicy" + "FrontDoor", + "WAF" ], "severity": "Medium", "subcategory": "App delivery", @@ -10991,8 +11005,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", "service": "Entra", "services": [ - "AVD", - "Entra" + "Entra", + "AVD" ], "severity": "Low", "subcategory": "App delivery", @@ -11024,9 +11038,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", "service": "Front Door", "services": [ + "AzurePolicy", "FrontDoor", - "WAF", - "AzurePolicy" + "WAF" ], "severity": "High", "subcategory": "Front Door", @@ -11041,8 +11055,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", "service": "Front Door", "services": [ - "FrontDoor", - "TrafficManager" + "TrafficManager", + "FrontDoor" ], "severity": "High", "subcategory": "Front Door", @@ -11133,9 +11147,9 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", "service": "Front Door", "services": [ + "Cost", "FrontDoor", - "AKV", - "Cost" + "AKV" ], "severity": "High", "subcategory": "Front Door", @@ -11226,9 +11240,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", "service": "Front Door", "services": [ + "AzurePolicy", "FrontDoor", - "WAF", - "AzurePolicy" + "WAF" ], "severity": "High", "subcategory": "Front Door", @@ -11350,8 +11364,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "High", "subcategory": "App Gateway", @@ -11366,9 +11380,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", "service": "App Gateway", "services": [ - "WAF", + "AzurePolicy", "AppGW", - "AzurePolicy" + "WAF" ], "severity": "High", "subcategory": "App Gateway", @@ -11383,8 +11397,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "High", "subcategory": "App Gateway", @@ -11400,9 +11414,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", "service": "App Gateway", "services": [ - "WAF", + "AzurePolicy", "AppGW", - "AzurePolicy" + "WAF" ], "severity": "High", "subcategory": "App Gateway", @@ -11416,8 +11430,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "App Gateway", @@ -11431,8 +11445,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "App Gateway", @@ -11458,8 +11472,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "App Gateway", @@ -11473,8 +11487,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "App Gateway", @@ -11488,8 +11502,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "App Gateway", @@ -11518,9 +11532,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", "service": "App Gateway", "services": [ - "WAF", "Sentinel", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "App Gateway", @@ -11534,8 +11548,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", "service": "Front Door", "services": [ - "FrontDoor", "Sentinel", + "FrontDoor", "WAF" ], "severity": "Medium", @@ -11550,8 +11564,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "App Gateway", @@ -11565,8 +11579,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", "service": "App Gateway", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "subcategory": "App Gateway", @@ -11581,9 +11595,9 @@ "service": "App Gateway", "services": [ "ExpressRoute", + "AppGW", "VNet", - "VPN", - "AppGW" + "VPN" ], "severity": "Medium", "subcategory": "App Gateway", @@ -11848,8 +11862,8 @@ "guid": "b94ee5ef-47d2-4d92-a81b-1cd6d1f54b29", "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/sharing-metadata-across-different-databricks-workspaces-using/ba-p/3679757", "services": [ - "Backup", - "ACR" + "ACR", + "Backup" ], "severity": "Medium", "subcategory": "Backup", @@ -11955,8 +11969,8 @@ "guid": "d7e47431-76c8-4bdb-b55b-ce619e8a03f9", "link": "https://learn.microsoft.com/azure/openshift/howto-create-service-principal?pivots=aro-azurecli", "services": [ - "RBAC", - "Entra" + "Entra", + "RBAC" ], "severity": "High", "subcategory": "Identity", @@ -11995,8 +12009,8 @@ "guid": "483835c9-86bb-4291-8155-a11475e39f54", "link": "https://docs.openshift.com/container-platform/4.13/applications/projects/working-with-projects.html", "services": [ - "RBAC", - "Entra" + "Entra", + "RBAC" ], "severity": "High", "subcategory": "Identity", @@ -12009,8 +12023,8 @@ "guid": "0acccd97-9376-4bcd-a375-0ab2ab039da6", "link": "https://docs.openshift.com/container-platform/4.13/authentication/using-rbac.html", "services": [ - "RBAC", - "Entra" + "Entra", + "RBAC" ], "severity": "Medium", "subcategory": "Identity", @@ -12023,8 +12037,8 @@ "guid": "d54d7c89-29db-4107-b532-5ae625ca44e4", "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", "services": [ - "AKV", - "Entra" + "Entra", + "AKV" ], "severity": "Medium", "subcategory": "Identity", @@ -12037,8 +12051,8 @@ "guid": "685e2223-ace8-4bb1-8307-ca5f16f154e3", "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", "services": [ - "RBAC", - "Entra" + "Entra", + "RBAC" ], "severity": "Medium", "subcategory": "Identity", @@ -12051,12 +12065,12 @@ "guid": "aa369282-9e7e-4216-8836-87af467a1f89", "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", "services": [ - "DDoS", - "Firewall", - "Subscriptions", - "WAF", "Entra", - "VNet" + "Firewall", + "DDoS", + "Subscriptions", + "VNet", + "WAF" ], "severity": "Low", "subcategory": "DDoS", @@ -12136,8 +12150,8 @@ "guid": "ab039da6-d54d-47c8-a29d-b107d5325ae6", "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", "services": [ - "PrivateLink", - "ACR" + "ACR", + "PrivateLink" ], "severity": "Medium", "subcategory": "Private access", @@ -12424,8 +12438,8 @@ "guid": "76af4a69-1e88-439a-ba46-667e13c10567", "link": "https://learn.microsoft.com/azure/openshift/howto-segregate-machinesets", "services": [ - "VNet", - "AKS" + "AKS", + "VNet" ], "severity": "Medium", "subcategory": "Cluster Design", @@ -12451,8 +12465,8 @@ "guid": "a2c02149-9014-4a5d-9ce5-74dccbd9792a", "link": "https://access.redhat.com/documentation/red_hat_openshift_container_storage/4.4/html/deploying_and_managing_openshift_container_storage_on_microsoft_azure/deploying-openshift-container-storage-on-microsoft-azure_rhocs", "services": [ - "Storage", - "ACR" + "ACR", + "Storage" ], "severity": "Medium", "subcategory": "Data Store", @@ -12509,8 +12523,8 @@ "guid": "08fe8273-4c48-46ba-880d-c0591cf75ee8", "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/quickstart-connect-cluster", "services": [ - "Arc", - "AKS" + "AKS", + "Arc" ], "severity": "High", "subcategory": "Control plane", @@ -12534,9 +12548,9 @@ "guid": "d55d14c3-c492-49cb-8b3d-1325ae124ba3", "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", "services": [ - "Defender", + "AKS", "Arc", - "AKS" + "Defender" ], "severity": "Medium", "subcategory": "Posture", @@ -12549,9 +12563,9 @@ "guid": "4d0685ed-dce9-4be3-ab0d-db3b55fb2ec1", "link": "https://learn.microsoft.com/azure/azure-arc/kubernetes/tutorial-akv-secrets-provider", "services": [ - "AKV", + "AKS", "Arc", - "AKS" + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -12602,8 +12616,8 @@ "guid": "e209d4a0-da57-4778-924d-216785d2fa56", "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", "services": [ - "Subscriptions", - "ACR" + "ACR", + "Subscriptions" ], "severity": "Low", "subcategory": "Workload", @@ -12848,8 +12862,8 @@ "guid": "c851fd44-7cf1-459c-95a4-f6455d75a981", "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/approaches/cost-management-allocation", "services": [ - "Cost", - "Monitor" + "Monitor", + "Cost" ], "severity": "Medium", "subcategory": "Cost Optimization", @@ -13000,8 +13014,8 @@ "guid": "f7c015e0-7d97-4283-b006-567afeb2b5ca", "link": "https://learn.microsoft.com/azure-stack/hci/concepts/drive-symmetry-considerations#understand-capacity-imbalance", "services": [ - "Storage", - "ACR" + "ACR", + "Storage" ], "severity": "Medium", "subcategory": "Physical", @@ -13380,9 +13394,9 @@ "guid": "074541e3-fe08-458a-8062-32d13dcc10c6", "link": "https://learn.microsoft.com/azure/backup/back-up-azure-stack-hyperconverged-infrastructure-virtual-machines", "services": [ - "VM", "ASR", - "Backup" + "Backup", + "VM" ], "severity": "High", "subcategory": "VM", @@ -13672,9 +13686,9 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts", "service": "Azure OpenAI", "services": [ + "Monitor", "Subscriptions", - "AKV", - "Monitor" + "AKV" ], "severity": "High", "subcategory": "Alerts", @@ -13816,8 +13830,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching", "service": "Azure OpenAI", "services": [ - "Storage", - "ServiceBus" + "ServiceBus", + "Storage" ], "severity": "Medium", "subcategory": "Elasticity segregation", @@ -14037,9 +14051,9 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction", "service": "Azure OpenAI", "services": [ + "Monitor", "Sentinel", - "Defender", - "Monitor" + "Defender" ], "severity": "High", "subcategory": "Threat Detection and Monitoring", @@ -14123,8 +14137,8 @@ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512", "service": "Azure OpenAI", "services": [ - "RBAC", - "AzurePolicy" + "AzurePolicy", + "RBAC" ], "severity": "Medium", "subcategory": "Sensitive Data in Separate Instances", @@ -14216,8 +14230,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity", "service": "Azure OpenAI", "services": [ - "AKV", - "Entra" + "Entra", + "AKV" ], "severity": "High", "subcategory": "Secure APIs and Endpoints", @@ -14317,8 +14331,8 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Azure OpenAI", "services": [ - "AKV", - "Entra" + "Entra", + "AKV" ], "severity": "High", "subcategory": "Secure Key Management", @@ -14426,8 +14440,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs", "service": "Azure OpenAI", "services": [ - "Cost", - "Monitor" + "Monitor", + "Cost" ], "severity": "Medium", "subcategory": "Cost monitoring", @@ -14606,10 +14620,10 @@ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md", "service": "Azure OpenAI", "services": [ - "Entra", "APIM", - "LoadBalancer", - "ACR" + "Entra", + "ACR", + "LoadBalancer" ], "severity": "Medium", "subcategory": "Load Balancing", @@ -14719,8 +14733,8 @@ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", "service": "Container Apps", "services": [ - "FrontDoor", - "TrafficManager" + "TrafficManager", + "FrontDoor" ], "severity": "High", "subcategory": "High Availability", @@ -14889,8 +14903,8 @@ "guid": "36cb45e5-7960-4332-9bdf-8cc23318da61", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery", "services": [ - "ASR", - "AKS" + "AKS", + "ASR" ], "severity": "High", "subcategory": "Disaster Recovery", @@ -14903,10 +14917,10 @@ "guid": "170265f4-bb46-4a39-9af7-f317284797b1", "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", "services": [ - "FrontDoor", + "AKS", "TrafficManager", - "LoadBalancer", - "AKS" + "FrontDoor", + "LoadBalancer" ], "severity": "Medium", "subcategory": "High Availability", @@ -14978,9 +14992,9 @@ "guid": "daa9a260-c3ea-4490-b077-5fc1f2a80cb0", "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", "services": [ - "Storage", + "AKS", "ASR", - "AKS" + "Storage" ], "severity": "High", "subcategory": "Disaster Recovery", @@ -15068,8 +15082,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", "service": "AKS", "services": [ - "AKS", - "AzurePolicy" + "AzurePolicy", + "AKS" ], "severity": "Medium", "subcategory": "Compliance", @@ -15140,8 +15154,8 @@ "guid": "cc639637-a652-42ac-89e8-06965388e9de", "link": "https://learn.microsoft.com/azure/security-center/container-security", "services": [ - "Defender", - "AKS" + "AKS", + "Defender" ], "severity": "Medium", "subcategory": "Compliance", @@ -15182,8 +15196,8 @@ "link": "https://github.com/Azure/secrets-store-csi-driver-provider-azure", "service": "AKS", "services": [ - "AKV", - "AKS" + "AKS", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -15197,8 +15211,8 @@ "link": "https://learn.microsoft.com/azure/aks/update-credentials", "service": "AKS", "services": [ - "AKV", - "AKS" + "AKS", + "AKV" ], "severity": "High", "subcategory": "Secrets", @@ -15212,8 +15226,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-kms-etcd-encryption", "service": "AKS", "services": [ - "AKV", - "AKS" + "AKS", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -15227,8 +15241,8 @@ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", "service": "AKS", "services": [ - "AKV", - "AKS" + "AKS", + "AKV" ], "severity": "Low", "subcategory": "Secrets", @@ -15242,9 +15256,9 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-enable", "service": "AKS", "services": [ - "Defender", + "AKS", "AKV", - "AKS" + "Defender" ], "severity": "Medium", "subcategory": "Secrets", @@ -15306,8 +15320,8 @@ "service": "AKS", "services": [ "Entra", - "RBAC", - "AKS" + "AKS", + "RBAC" ], "severity": "Medium", "subcategory": "Identity", @@ -15322,8 +15336,8 @@ "service": "AKS", "services": [ "Entra", - "RBAC", - "AKS" + "AKS", + "RBAC" ], "severity": "High", "subcategory": "Identity", @@ -15443,8 +15457,8 @@ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", "service": "AKS", "services": [ - "AppGW", "AKS", + "AppGW", "ACR" ], "severity": "Medium", @@ -15489,8 +15503,8 @@ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", "service": "AKS", "services": [ - "LoadBalancer", - "AKS" + "AKS", + "LoadBalancer" ], "severity": "High", "subcategory": "Best practices", @@ -15504,8 +15518,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", "service": "AKS", "services": [ - "VNet", - "AKS" + "AKS", + "VNet" ], "severity": "Medium", "subcategory": "Best practices", @@ -15519,10 +15533,10 @@ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", "service": "AKS", "services": [ - "PrivateLink", "Cost", + "AKS", "VNet", - "AKS" + "PrivateLink" ], "severity": "Medium", "subcategory": "Cost", @@ -15535,8 +15549,8 @@ "guid": "e8a03f97-8794-468d-96a7-86d60f96c97b", "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", "services": [ - "VPN", - "AKS" + "AKS", + "VPN" ], "severity": "Medium", "subcategory": "HA", @@ -15565,8 +15579,8 @@ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", "service": "AKS", "services": [ - "VNet", - "AKS" + "AKS", + "VNet" ], "severity": "High", "subcategory": "IPAM", @@ -15595,8 +15609,8 @@ "link": "https://learn.microsoft.com/azure/aks/internal-lb", "service": "AKS", "services": [ - "VNet", - "AKS" + "AKS", + "VNet" ], "severity": "Low", "subcategory": "IPAM", @@ -15695,8 +15709,8 @@ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", "service": "AKS", "services": [ - "NVA", - "AKS" + "AKS", + "NVA" ], "severity": "High", "subcategory": "Security", @@ -15741,8 +15755,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-network-policies", "service": "AKS", "services": [ - "AKS", - "AzurePolicy" + "AzurePolicy", + "AKS" ], "severity": "Medium", "subcategory": "Security", @@ -15757,8 +15771,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-network-policies", "service": "AKS", "services": [ - "AKS", - "AzurePolicy" + "AzurePolicy", + "AKS" ], "severity": "High", "subcategory": "Security", @@ -15772,8 +15786,8 @@ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", "service": "AKS", "services": [ - "AKS", - "AzurePolicy" + "AzurePolicy", + "AKS" ], "severity": "High", "subcategory": "Security", @@ -15787,8 +15801,8 @@ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "High", "subcategory": "Security", @@ -15804,8 +15818,8 @@ "service": "AKS", "services": [ "DDoS", - "VNet", - "AKS" + "AKS", + "VNet" ], "severity": "Medium", "subcategory": "Security", @@ -16170,10 +16184,10 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", "service": "AKS", "services": [ - "EventHubs", - "Monitor", "AKS", + "Monitor", "Storage", + "EventHubs", "ServiceBus" ], "severity": "Medium", @@ -16188,10 +16202,10 @@ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", "service": "AKS", "services": [ - "NVA", "Monitor", - "LoadBalancer", - "AKS" + "AKS", + "NVA", + "LoadBalancer" ], "severity": "Medium", "subcategory": "Monitoring", @@ -16248,8 +16262,8 @@ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", "service": "AKS", "services": [ - "Subscriptions", - "AKS" + "AKS", + "Subscriptions" ], "severity": "High", "subcategory": "Resources", @@ -16393,8 +16407,8 @@ "link": "https://learn.microsoft.com/azure/aks/cluster-configuration", "service": "AKS", "services": [ - "Storage", - "AKS" + "AKS", + "Storage" ], "severity": "High", "subcategory": "Storage", @@ -16408,8 +16422,8 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", "service": "AKS", "services": [ - "Storage", - "AKS" + "AKS", + "Storage" ], "severity": "High", "subcategory": "Storage", @@ -16423,8 +16437,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", "service": "AKS", "services": [ - "Storage", - "AKS" + "AKS", + "Storage" ], "severity": "Low", "subcategory": "Storage", @@ -16438,9 +16452,9 @@ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-multi-region", "service": "AKS", "services": [ - "SQL", "Storage", - "AKS" + "AKS", + "SQL" ], "severity": "Medium", "subcategory": "Storage", @@ -16454,8 +16468,8 @@ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", "service": "AKS", "services": [ - "Storage", - "AKS" + "AKS", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -16469,8 +16483,8 @@ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", "service": "AKS", "services": [ - "Storage", - "AKS" + "AKS", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -16541,8 +16555,8 @@ "guid": "3b0d834a-3487-426d-b69c-6b5c2a26494b", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "Storage", "Cost", + "Storage", "Backup" ], "severity": "Medium", @@ -16557,9 +16571,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "service": "Azure Backup", "services": [ - "Storage", - "ASR", "Cost", + "ASR", + "Storage", "Backup" ], "severity": "Medium", @@ -16590,8 +16604,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "service": "Azure Monitor", "services": [ - "Storage", "Cost", + "Storage", "AzurePolicy" ], "severity": "Medium", @@ -16635,10 +16649,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "service": "VM", "services": [ - "VM", - "Storage", "Cost", - "Backup" + "Storage", + "Backup", + "VM" ], "severity": "Medium", "subcategory": "stopped/deallocated VMs: check disks", @@ -16653,8 +16667,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "service": "Storage", "services": [ - "Storage", "Cost", + "Storage", "AzurePolicy" ], "severity": "Medium", @@ -16708,9 +16722,9 @@ "guid": "a27b765a-91be-41f3-a8ef-394c2bd463cb", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "services": [ - "VM", + "Cost", "Storage", - "Cost" + "VM" ], "severity": "Medium", "subcategory": "DB optimization", @@ -16751,8 +16765,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "service": "VM", "services": [ - "VM", - "Cost" + "Cost", + "VM" ], "severity": "Medium", "subcategory": "Advisor", @@ -16818,8 +16832,8 @@ "guid": "733be2a1-a27b-4765-a91b-e1f388ef394c", "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", "services": [ - "Storage", - "Cost" + "Cost", + "Storage" ], "severity": "Medium", "subcategory": "Baseline", @@ -16966,10 +16980,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", "service": "VM", "services": [ - "VM", - "SQL", "Cost", - "AzurePolicy" + "SQL", + "AzurePolicy", + "VM" ], "severity": "Medium", "subcategory": "check AHUB is applied to all Windows VMs, RHEL and SQL", @@ -17012,8 +17026,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", "service": "VM", "services": [ - "VM", - "Cost" + "Cost", + "VM" ], "severity": "Medium", "subcategory": "Planning", @@ -17028,9 +17042,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", "service": "VM", "services": [ - "VM", + "Cost", "ARS", - "Cost" + "VM" ], "severity": "Medium", "subcategory": "Reservations/savings plans", @@ -17070,8 +17084,8 @@ "link": "https://learn.microsoft.com/azure/active-directory-domain-services/overview", "service": "VM", "services": [ - "Storage", - "Cost" + "Cost", + "Storage" ], "severity": "Medium", "subcategory": "Reserve storage", @@ -17085,8 +17099,8 @@ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", "service": "VM", "services": [ - "VM", - "Cost" + "Cost", + "VM" ], "severity": "Medium", "subcategory": "Reserve VMs with normalized and rationalized sizes", @@ -17100,8 +17114,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", "service": "Azure SQL", "services": [ - "SQL", "Cost", + "SQL", "AzurePolicy" ], "severity": "Medium", @@ -17116,9 +17130,9 @@ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", "service": "VM", "services": [ - "VM", + "Cost", "SQL", - "Cost" + "VM" ], "severity": "Medium", "subcategory": "SQL Database Reservations", @@ -17187,8 +17201,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", "service": "VM", "services": [ - "VM", - "Cost" + "Cost", + "VM" ], "severity": "Medium", "subcategory": "Autoscale", @@ -17272,9 +17286,9 @@ "link": "https://learn.microsoft.com/azure/databricks/clusters/cluster-config-best-practices#automatic-termination", "service": "Databricks", "services": [ - "VM", "Cost", - "LoadBalancer" + "LoadBalancer", + "VM" ], "severity": "Medium", "subcategory": "Databricks", @@ -17318,8 +17332,8 @@ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", "service": "Azure Functions", "services": [ - "Storage", - "Cost" + "Cost", + "Storage" ], "severity": "Medium", "subcategory": "Functions", @@ -17404,9 +17418,9 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "service": "Front Door", "services": [ + "Cost", "EventHubs", - "FrontDoor", - "Cost" + "FrontDoor" ], "severity": "Medium", "subcategory": "Networking", @@ -17420,9 +17434,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", "service": "Front Door", "services": [ - "FrontDoor", "Cost", - "AppSvc" + "AppSvc", + "FrontDoor" ], "severity": "Medium", "subcategory": "Networking", @@ -17462,8 +17476,8 @@ "link": "https://learn.microsoft.com/azure/architecture/best-practices/monitoring", "service": "Storage", "services": [ - "Storage", - "Cost" + "Cost", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -17477,8 +17491,8 @@ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", "service": "VM", "services": [ - "Storage", - "Cost" + "Cost", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -17492,8 +17506,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", "service": "Storage", "services": [ - "Storage", - "Cost" + "Cost", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -17507,8 +17521,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", "service": "Storage", "services": [ - "Storage", - "Cost" + "Cost", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -17522,9 +17536,9 @@ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", "service": "Site Recovery", "services": [ + "Cost", "ASR", - "Storage", - "Cost" + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -17538,8 +17552,8 @@ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", "service": "Storage", "services": [ - "Storage", - "Cost" + "Cost", + "Storage" ], "severity": "Medium", "subcategory": "storage", @@ -17553,8 +17567,8 @@ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", "service": "VM", "services": [ - "Storage", - "Cost" + "Cost", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -17568,9 +17582,9 @@ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", "service": "Synapse", "services": [ - "EventHubs", "Cost", - "Monitor" + "Monitor", + "EventHubs" ], "severity": "Medium", "subcategory": "Synapse", @@ -17584,8 +17598,8 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/availability", "service": "Synapse", "services": [ - "Storage", - "Cost" + "Cost", + "Storage" ], "severity": "Medium", "subcategory": "Synapse", @@ -17599,8 +17613,8 @@ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", "service": "Synapse", "services": [ - "SQL", - "Cost" + "Cost", + "SQL" ], "severity": "Medium", "subcategory": "Synapse", @@ -17657,8 +17671,8 @@ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", "service": "VM", "services": [ - "VM", - "Cost" + "Cost", + "VM" ], "severity": "Medium", "subcategory": "VM", @@ -17673,8 +17687,8 @@ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", "service": "VM", "services": [ - "VM", - "Cost" + "Cost", + "VM" ], "severity": "Medium", "subcategory": "VM", @@ -17688,8 +17702,8 @@ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", "service": "VM", "services": [ - "VM", - "Cost" + "Cost", + "VM" ], "severity": "Medium", "subcategory": "VM", @@ -17704,9 +17718,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "VM", "services": [ - "VM", "Cost", - "Monitor" + "Monitor", + "VM" ], "severity": "Medium", "subcategory": "VM", @@ -17721,8 +17735,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "VM", "services": [ - "VM", - "Cost" + "Cost", + "VM" ], "severity": "Medium", "subcategory": "VM", @@ -17815,8 +17829,8 @@ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", "service": "Cognitive Search", "services": [ - "Storage", "ASR", + "Storage", "Backup" ], "severity": "High", @@ -17831,8 +17845,8 @@ "guid": "1fc3fc14-eea6-4e69-b8d9-a3eec218e687", "link": "https://learn.microsoft.com/sql/dma/dma-sku-recommend-sql-db?view=sql-server-ver16", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "High", "subcategory": "VM Size", @@ -17846,8 +17860,8 @@ "guid": "e04abe1f-8d39-4fda-9776-8424c116775c", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-vm-size?view=azuresql#memory-optimized", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "Medium", "subcategory": "VM Size", @@ -17861,9 +17875,9 @@ "guid": "2ea55b56-ad48-4408-be72-734b476ba18f", "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance#counters-to-measure-application-performance-requirements", "services": [ - "VM", "SQL", - "Storage" + "Storage", + "VM" ], "severity": "Medium", "subcategory": "Storage", @@ -17907,9 +17921,9 @@ "guid": "25659d35-58fd-4772-99c9-31112d027fe4", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ + "Cost", "SQL", - "Storage", - "Cost" + "Storage" ], "severity": "High", "subcategory": "Storage", @@ -17923,9 +17937,9 @@ "guid": "12f70983-f630-4472-8ee6-9d6b5c2622f5", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ - "VM", "SQL", - "Storage" + "Storage", + "VM" ], "severity": "Medium", "subcategory": "Storage", @@ -17939,9 +17953,9 @@ "guid": "4b69bad3-4aad-45e8-a78e-1d76667313c4", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ - "VM", "SQL", - "Storage" + "Storage", + "VM" ], "severity": "High", "subcategory": "Storage", @@ -17955,9 +17969,9 @@ "guid": "05674b5e-985b-4859-a773-e7e261623b77", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ + "AzurePolicy", "SQL", - "Storage", - "AzurePolicy" + "Storage" ], "severity": "High", "subcategory": "Storage", @@ -17971,9 +17985,9 @@ "guid": "5a917e1f-348e-4f35-9c27-d42e8bbac868", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql#storage", "services": [ - "VM", "SQL", - "Storage" + "Storage", + "VM" ], "severity": "High", "subcategory": "Storage", @@ -18002,8 +18016,8 @@ "guid": "8b9fe5c4-2049-4d41-9a92-3c3474d11028", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview?view=azuresql#azure-only-disaster-recovery-solutions", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "Medium", "subcategory": "HADR", @@ -18017,8 +18031,8 @@ "guid": "ac6aae01-e6a8-44de-9df4-3d1992481718", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/business-continuity-high-availability-disaster-recovery-hadr-overview?view=azuresql#high-availability-nodes-in-an-availability-set", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "High", "subcategory": "HADR", @@ -18032,8 +18046,8 @@ "guid": "d5d1e5f6-2565-49d3-958f-d77249c93111", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/availability-group-azure-portal-configure?view=azuresql&tabs=azure-cli", "services": [ - "VM", "SQL", + "VM", "VNet", "LoadBalancer" ], @@ -18078,8 +18092,8 @@ "guid": "667313c4-0567-44b5-b985-b859c773e7e2", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/availability-group-vnn-azure-load-balancer-configure?view=azuresql-vm&tabs=ilb", "services": [ - "VM", "SQL", + "VM", "VNet", "LoadBalancer" ], @@ -18139,9 +18153,9 @@ "guid": "b824546c-e1ae-4e34-93ae-c8239248725d", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist?view=azuresql-vm#sql-server-features", "services": [ - "VM", "SQL", - "Storage" + "Storage", + "VM" ], "severity": "Low", "subcategory": "SQL Server", @@ -18155,8 +18169,8 @@ "guid": "d68c5b5c-2925-4394-a69a-9d2799c42bb6", "link": "https://learn.microsoft.com/sql/database-engine/configure-windows/server-memory-server-configuration-options#use-", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "High", "subcategory": "SQL Server", @@ -18170,8 +18184,8 @@ "guid": "8d1d7555-6246-4b43-a563-b4dc74a748b6", "link": "https://learn.microsoft.com/sql/database-engine/configure-windows/enable-the-lock-pages-in-memory-option-windows", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "High", "subcategory": "SQL Server", @@ -18185,8 +18199,8 @@ "guid": "633ad2a0-916a-4664-a8fa-d0e278ee293c", "link": "https://learn.microsoft.com/sql/relational-databases/performance/monitoring-performance-by-using-the-query-store", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "Low", "subcategory": "SQL Server", @@ -18200,8 +18214,8 @@ "guid": "1bc352ba-aab7-4571-a49a-b8093dc9ec9d", "link": "https://learn.microsoft.com/sql/relational-databases/databases/tempdb-database#optimizing-tempdb-performance-in-sql-server", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "High", "subcategory": "SQL Server", @@ -18215,8 +18229,8 @@ "guid": "1bb73b36-a5a6-47fb-a9ed-5b35478c3479", "link": "https://docs.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "High", "subcategory": "SQL Server", @@ -18230,8 +18244,8 @@ "guid": "816b2863-cffe-41ca-a599-ef0d5a73dd4c", "link": "https://docs.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---require-authorization", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "Medium", "subcategory": "SQL Server", @@ -18245,10 +18259,10 @@ "guid": "e36c1c81-770a-4fbc-9c0d-43918648d285", "link": "https://learn.microsoft.com/azure/virtual-machines/constrained-vcpu", "services": [ - "VM", + "Cost", "SQL", "Storage", - "Cost" + "VM" ], "severity": "Low", "subcategory": "Cost Optimization", @@ -18263,8 +18277,8 @@ "guid": "7ed67178-b824-4546-ae1a-ee3453aec823", "link": "https://azure.microsoft.com/en-ca/pricing/hybrid-benefit/", "services": [ - "SQL", - "Cost" + "Cost", + "SQL" ], "severity": "Low", "subcategory": "Cost Optimization", @@ -18278,8 +18292,8 @@ "guid": "9248725d-d68c-45b5-a292-5394a69a9d27", "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/sql-agent-extension-automatic-registration-all-vms?view=azuresql-vm&tabs=azure-cli", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "Medium", "subcategory": "Azure", @@ -18294,8 +18308,8 @@ "guid": "99c42bb6-8d1d-4755-9624-6b438563b4dc", "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "High", "subcategory": "Azure", @@ -18309,8 +18323,8 @@ "guid": "74a748b6-633a-4d2a-8916-a66498fad0e2", "link": "https://learn.microsoft.com/azure/defender-for-cloud/secure-score-security-controls", "services": [ - "VM", "SQL", + "VM", "Defender" ], "severity": "High", @@ -18417,8 +18431,8 @@ "guid": "eaded26b-dd18-46f0-ac25-1b999a68af87", "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/frequently-asked-questions-faq?view=azuresql-mi#can-a-managed-instance-have-the-same-name-as-a-sql-server-on-premises-instance", "services": [ - "SQL", - "DNS" + "DNS", + "SQL" ], "severity": "High", "subcategory": "Pre Migration", @@ -18569,8 +18583,8 @@ "guid": "829e3eec-2183-4687-a007-7a2b5945bda4", "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/tde-certificate-migrate?view=azuresql-mi&tabs=azure-powershell", "services": [ - "VM", - "SQL" + "SQL", + "VM" ], "severity": "Medium", "subcategory": "Deployment", @@ -18673,10 +18687,10 @@ "guid": "35ad9422-23e1-4381-8523-081a94174158", "link": "https://learn.microsoft.com/azure/architecture/example-scenario/data/sql-managed-instance-cmk", "services": [ - "SQL", - "AKV", "AzurePolicy", - "Backup" + "SQL", + "Backup", + "AKV" ], "severity": "Low", "subcategory": "Post Migration", @@ -18706,8 +18720,8 @@ "guid": "9d89f2e8-7778-4424-b516-785c6fa96b96", "link": "https://learn.microsoft.com/azure/azure-sql/database/long-term-retention-overview?view=azuresql-mi", "services": [ - "SQL", "ARS", + "SQL", "Storage", "Backup" ], @@ -18724,8 +18738,8 @@ "guid": "ad88408f-3727-434c-a76b-a28021459014", "link": "https://azure.microsoft.com/en-gb/pricing/hybrid-benefit/#overview", "services": [ - "SQL", - "Cost" + "Cost", + "SQL" ], "severity": "Low", "subcategory": "Post Migration", @@ -18755,8 +18769,8 @@ "guid": "a96b96ad-8840-48f3-9273-4c876ba28021", "link": "https://learn.microsoft.com/azure/dns/private-dns-resiliency", "services": [ - "VNet", - "DNS" + "DNS", + "VNet" ], "severity": "High", "subcategory": "Azure Private DNS", @@ -18782,9 +18796,9 @@ "guid": "74faa19b-f39d-495d-94c7-c8919ca1f6d5", "link": "https://learn.microsoft.com/azure/reliability/reliability-traffic-manager?toc=%2Fazure%2Fdns%2Ftoc.json", "services": [ + "DNS", "ASR", - "TrafficManager", - "DNS" + "TrafficManager" ], "severity": "Medium", "subcategory": "Azure DNS", @@ -18810,8 +18824,8 @@ "guid": "f7b95e06-e154-4e2a-a359-2828e6e20517", "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", "services": [ - "ASR", - "DNS" + "DNS", + "ASR" ], "severity": "Medium", "subcategory": "Azure DNS Resolver", @@ -18824,8 +18838,8 @@ "guid": "2676ae46-691e-4883-9ad9-42223e138105", "link": "https://learn.microsoft.com/azure/reliability/reliability-virtual-machines?toc=%2Fazure%2Fvirtual-machines%2Ftoc.json&bc=%2Fazure%2Fvirtual-machines%2Fbreadcrumb%2Ftoc.json&tabs=graph", "services": [ - "VM", - "DNS" + "DNS", + "VM" ], "severity": "Medium", "subcategory": "VM Based DNS Service", @@ -18838,9 +18852,9 @@ "guid": "23081a94-1741-4583-9ff7-ad7c6d373316", "link": "https://www.windows-active-directory.com/azure-ad-dns-for-custom-domain-names-with-advanced-dns-settings.html", "services": [ - "VM", + "DNS", "Entra", - "DNS" + "VM" ], "severity": "Medium", "subcategory": "VM Based DNS Service", @@ -18855,8 +18869,8 @@ "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export", "service": "Azure Data Explorer", "services": [ - "Storage", - "Cost" + "Cost", + "Storage" ], "subcategory": "Replication", "text": "Leverage External Tables and Continuous data export overview to reduce costs", @@ -18897,8 +18911,8 @@ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities", "service": "Azure Data Explorer", "services": [ - "Storage", - "RBAC" + "RBAC", + "Storage" ], "subcategory": "Replication", "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.", @@ -18963,9 +18977,9 @@ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration", "service": "Azure Data Explorer", "services": [ - "Storage", - "ASR", "Cost", + "ASR", + "Storage", "AzurePolicy" ], "subcategory": "DR Configuration", @@ -19018,10 +19032,10 @@ "guid": "56c57ba5-9119-4bf8-b8f5-c586c7d9cdc1", "link": "https://azure.microsoft.com/support/legal/sla/virtual-desktop/v1_0/", "services": [ - "VM", - "AVD", + "ASR", "Subscriptions", - "ASR" + "AVD", + "VM" ], "severity": "High", "subcategory": "Compute", @@ -19035,10 +19049,10 @@ "guid": "6acc076e-f9b1-441a-a989-579e76b897e7", "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/azure-virtual-desktop-multi-region-bcdr", "services": [ - "VM", - "AVD", + "Storage", "ASR", - "Storage" + "AVD", + "VM" ], "severity": "Medium", "subcategory": "Compute", @@ -19052,8 +19066,8 @@ "guid": "10a7da7b-e996-46e1-9d3c-4ada97cc3d13", "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", "services": [ - "AVD", - "ASR" + "ASR", + "AVD" ], "severity": "Low", "subcategory": "Compute", @@ -19067,8 +19081,8 @@ "guid": "25ab225c-6f4e-4168-9fdd-dea8a4b7cdeb", "link": "https://techcommunity.microsoft.com/t5/azure-virtual-desktop-blog/announcing-general-availability-of-support-for-azure/ba-p/3636262", "services": [ - "AVD", "ASR", + "AVD", "ACR" ], "severity": "High", @@ -19083,10 +19097,10 @@ "guid": "4c61fc3f-c14e-4ea6-b69e-8d9a3eec218e", "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", "services": [ - "VM", - "AVD", "ASR", - "Backup" + "AVD", + "Backup", + "VM" ], "severity": "Medium", "subcategory": "Compute", @@ -19100,11 +19114,11 @@ "guid": "5da58639-ca3a-4961-890b-29663c5e10d", "link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-zone-to-zone-disaster-recovery", "services": [ - "ASR", - "VM", - "AVD", "Cost", - "Backup" + "Backup", + "AVD", + "ASR", + "VM" ], "severity": "Medium", "subcategory": "Compute", @@ -19118,11 +19132,11 @@ "guid": "dd2e0d5d-771d-441e-9610-cc57b4a4a141", "link": "https://learn.microsoft.com/azure/virtual-machines/azure-compute-gallery", "services": [ - "ASR", "ACR", - "VM", + "AVD", + "ASR", "Storage", - "AVD" + "VM" ], "severity": "Low", "subcategory": "Dependencies", @@ -19136,8 +19150,8 @@ "guid": "fd339489-8c12-488b-9c6a-57cfb644451e", "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", "services": [ - "AVD", - "ASR" + "ASR", + "AVD" ], "severity": "Medium", "subcategory": "Dependencies", @@ -19151,9 +19165,9 @@ "guid": "687ab077-adb5-49e5-a960-3334fdf8cc23", "link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt", "services": [ - "AVD", "Storage", - "ASR" + "ASR", + "AVD" ], "severity": "Medium", "subcategory": "Storage", @@ -19167,11 +19181,11 @@ "guid": "fc4972cc-3cd2-45bf-a707-6e9eab4bed32", "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", "services": [ + "Backup", + "AVD", "ASR", "Storage", - "AzurePolicy", - "AVD", - "Backup" + "AzurePolicy" ], "severity": "Medium", "subcategory": "Storage", @@ -19185,9 +19199,9 @@ "guid": "9f7547c1-746d-4c56-868a-714435bd09dd", "link": "https://docs.microsoft.com/azure/virtual-desktop/disaster-recovery", "services": [ - "AVD", "Storage", - "ASR" + "ASR", + "AVD" ], "severity": "Medium", "subcategory": "Storage", @@ -19201,9 +19215,9 @@ "guid": "3d4f3537-c134-46dc-9602-7a71efe1bd05", "link": "https://docs.microsoft.com/azure/backup/backup-afs", "services": [ - "AVD", "Storage", "ASR", + "AVD", "Backup" ], "severity": "Medium", @@ -19218,9 +19232,9 @@ "guid": "10d4e875-d502-4142-a795-f2b6eff34f88", "link": "https://learn.microsoft.com/azure/storage/files/files-redundancy#zone-redundant-storage", "services": [ - "AVD", "Storage", - "ASR" + "ASR", + "AVD" ], "severity": "High", "subcategory": "Storage", @@ -19234,11 +19248,11 @@ "guid": "23429db7-2281-4376-85cc-57b4a4b18142", "link": "https://learn.microsoft.com/azure/azure-netapp-files/cross-region-replication-create-peering", "services": [ - "ASR", "ACR", - "Storage", + "Backup", "AVD", - "Backup" + "ASR", + "Storage" ], "severity": "Medium", "subcategory": "Storage", @@ -19294,9 +19308,9 @@ "guid": "5a2adb2c-3e23-426b-b225-ca44e1696fdd", "link": "https://learn.microsoft.com/azure/virtual-machines/shared-image-galleries", "services": [ - "VM", + "Storage", "AVD", - "Storage" + "VM" ], "severity": "Low", "subcategory": "Golden Images", @@ -19352,8 +19366,8 @@ "guid": "829e3fec-2183-4687-a017-7a2b5945bda4", "link": "https://github.com/The-Virtual-Desktop-Team/Virtual-Desktop-Optimization-Tool", "services": [ - "AVD", - "RBAC" + "RBAC", + "AVD" ], "severity": "Low", "subcategory": "Golden Images", @@ -19367,8 +19381,8 @@ "guid": "e3d3e084-4276-4d4b-bc01-5bcf219e4a1e", "link": "https://learn.microsoft.com/azure/virtual-desktop/install-office-on-wvd-master-image#install-onedrive-in-per-machine-mode", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "Low", "subcategory": "Golden Images", @@ -19410,9 +19424,9 @@ "guid": "90083845-c587-4cb3-a1ec-16a1d076ef9f", "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share", "services": [ - "AVD", + "Cost", "Storage", - "Cost" + "AVD" ], "severity": "Medium", "subcategory": "MSIX & AppAttach", @@ -19440,10 +19454,10 @@ "guid": "66e15d4d-5a2a-4db2-a3e2-326bf225ca41", "link": "https://docs.microsoft.com/azure/virtual-desktop/app-attach-file-share", "services": [ - "VM", - "AVD", "Storage", - "RBAC" + "RBAC", + "AVD", + "VM" ], "severity": "Medium", "subcategory": "MSIX & AppAttach", @@ -19499,8 +19513,8 @@ "guid": "e4633254-3185-40a1-b120-bd563a1c8e9d", "link": "https://docs.microsoft.com/azure/virtual-machines/generation-2", "services": [ - "VM", - "AVD" + "AVD", + "VM" ], "severity": "Medium", "subcategory": "Session Host", @@ -19528,8 +19542,8 @@ "guid": "8468c55a-775c-46ee-a5b8-6ad8844ce3b2", "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology#host-pools", "services": [ - "VM", - "AVD" + "AVD", + "VM" ], "severity": "High", "subcategory": "Capacity Planning", @@ -19543,8 +19557,8 @@ "guid": "4e98495f-d3c0-4af2-aa59-a793395a32a7", "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#host-pools", "services": [ - "VM", - "AVD" + "AVD", + "VM" ], "severity": "High", "subcategory": "Capacity Planning", @@ -19586,8 +19600,8 @@ "guid": "b3724959-4943-4577-a3a9-e10ff6345f24", "link": "https://learn.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs", "services": [ - "VM", - "AVD" + "AVD", + "VM" ], "severity": "Medium", "subcategory": "Capacity Planning", @@ -19601,8 +19615,8 @@ "guid": "b384b7ed-1cdd-457e-a2cd-c8d4d55bc144", "link": "https://learn.microsoft.com/azure/virtual-desktop/terminology?WT.mc_id=Portal-fx#application-groups", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "High", "subcategory": "Capacity Planning", @@ -19616,9 +19630,9 @@ "guid": "971cc4a4-b1f7-4c12-90e0-1ad96808f00c", "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#azure-virtual-desktop-service-limits", "services": [ - "AVD", "Entra", - "ACR" + "ACR", + "AVD" ], "severity": "Medium", "subcategory": "Capacity Planning", @@ -19646,9 +19660,9 @@ "guid": "38b19ab6-0693-4992-9394-5590883916ec", "link": "https://learn.microsoft.com/azure/virtual-desktop/configure-host-pool-personal-desktop-assignment-type?tabs=azure#reassign-a-personal-desktop", "services": [ - "VM", + "Storage", "AVD", - "Storage" + "VM" ], "severity": "Low", "subcategory": "Capacity Planning", @@ -19662,8 +19676,8 @@ "guid": "e1112dbd-7ba0-412e-9b94-ef6e047d2ea2", "link": "https://docs.microsoft.com/windows-server/remote/remote-desktop-services/virtual-machine-recs", "services": [ - "VM", - "AVD" + "AVD", + "VM" ], "severity": "High", "subcategory": "Capacity Planning", @@ -19677,8 +19691,8 @@ "guid": "992b1cd6-d2f5-44b2-a769-e3a691e8838a", "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop#considerations", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "High", "subcategory": "Capacity Planning", @@ -19706,8 +19720,8 @@ "guid": "b47a393a-0803-4272-a479-8b1578b219a4", "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview", "services": [ - "VM", - "AVD" + "AVD", + "VM" ], "severity": "Low", "subcategory": "Capacity Planning", @@ -19735,9 +19749,9 @@ "guid": "6abca2a4-fda1-4dbf-9dc9-5d48c7c791dc", "link": "https://learn.microsoft.com/azure/architecture/example-scenario/wvd/windows-virtual-desktop?toc=%2Fazure%2Fvirtual-desktop%2Ftoc.json&bc=%2Fazure%2Fvirtual-desktop%2Fbreadcrumb%2Ftoc.json", "services": [ - "AVD", "ExpressRoute", "Storage", + "AVD", "VPN" ], "severity": "Medium", @@ -19822,9 +19836,9 @@ "guid": "8053d89e-89dc-47b3-9be2-a1a27f7a9e91", "link": "https://docs.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", "services": [ - "VM", + "Storage", "AVD", - "Storage" + "VM" ], "severity": "Low", "subcategory": "General", @@ -19838,10 +19852,10 @@ "guid": "c14aea7e-65e8-4d9a-9aec-218e6436b073", "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/identity/adds-extend-domain", "services": [ - "AVD", + "Entra", "Storage", - "VNet", - "Entra" + "AVD", + "VNet" ], "severity": "Medium", "subcategory": "Active Directory", @@ -19855,8 +19869,8 @@ "guid": "6db55f57-9603-4334-adf9-cc23418db612", "link": "https://docs.microsoft.com/azure/virtual-desktop/create-host-pools-azure-marketplace", "services": [ - "AVD", - "Entra" + "Entra", + "AVD" ], "severity": "Medium", "subcategory": "Active Directory", @@ -19870,8 +19884,8 @@ "guid": "7126504b-b47a-4393-a080-327294798b15", "link": "https://docs.microsoft.com/previous-versions/windows/desktop/Policy/group-policy-hierarchy", "services": [ - "AVD", - "Entra" + "Entra", + "AVD" ], "severity": "Medium", "subcategory": "Active Directory", @@ -19885,8 +19899,8 @@ "guid": "2226a8e3-50a4-4ac3-8bd6-ee150553051f", "link": "https://learn.microsoft.com/fslogix/how-to-use-group-policy-templates", "services": [ - "AVD", - "Entra" + "Entra", + "AVD" ], "severity": "Medium", "subcategory": "Active Directory", @@ -19900,9 +19914,9 @@ "guid": "347dc560-28a7-41ff-b1cd-15dd2f0d5e77", "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#session-hosts", "services": [ - "VM", + "Entra", "AVD", - "Entra" + "VM" ], "severity": "Medium", "subcategory": "Active Directory", @@ -19916,8 +19930,8 @@ "guid": "2d41e361-1cc5-47b4-a4b1-410d43958a8c", "link": "https://docs.microsoft.com/azure/virtual-desktop/manage-app-groups", "services": [ - "AVD", - "Entra" + "Entra", + "AVD" ], "severity": "Medium", "subcategory": "Active Directory", @@ -19931,10 +19945,10 @@ "guid": "2289b3d6-b57c-4fc6-9546-1e1a3e3453a3", "link": "https://docs.microsoft.com/azure/storage/files/storage-files-identity-ad-ds-enable", "services": [ - "AVD", + "AzurePolicy", "Storage", "Entra", - "AzurePolicy" + "AVD" ], "severity": "High", "subcategory": "Active Directory", @@ -19948,8 +19962,8 @@ "guid": "5119bf8e-8f58-4542-a7d9-cec166cd072a", "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity", "services": [ - "AVD", - "Entra" + "Entra", + "AVD" ], "severity": "High", "subcategory": "Active Directory", @@ -19963,9 +19977,9 @@ "guid": "e777fd5e-c5f1-4d6e-8fa9-fc210b88e338", "link": "https://learn.microsoft.com/azure/storage/files/storage-files-identity-auth-hybrid-identities-enable", "services": [ - "AVD", + "Entra", "Storage", - "Entra" + "AVD" ], "severity": "Medium", "subcategory": "Microsoft Entra ID", @@ -19979,10 +19993,10 @@ "guid": "6ceb5443-5125-4922-9442-93bb628537a5", "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#identity", "services": [ - "AVD", + "Entra", "Subscriptions", - "VNet", - "Entra" + "AVD", + "VNet" ], "severity": "High", "subcategory": "Requirements", @@ -19996,8 +20010,8 @@ "guid": "b4ce4781-7557-4a1f-8043-332ae199d44c", "link": "https://learn.microsoft.com/azure/virtual-desktop/authentication", "services": [ - "AVD", - "Entra" + "Entra", + "AVD" ], "severity": "High", "subcategory": "Requirements", @@ -20011,8 +20025,8 @@ "guid": "f9b141a8-98a5-435e-9378-97e71ca7da7b", "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios", "services": [ - "AVD", - "Entra" + "Entra", + "AVD" ], "severity": "Medium", "subcategory": "Requirements", @@ -20026,8 +20040,8 @@ "guid": "5f9f680a-ba07-4429-bbf7-93d7071561f4", "link": "https://learn.microsoft.com/azure/virtual-desktop/authentication#single-sign-on-sso", "services": [ - "AVD", - "Entra" + "Entra", + "AVD" ], "severity": "Medium", "subcategory": "Requirements", @@ -20041,9 +20055,9 @@ "guid": "ea962a15-9394-46da-a7cc-3923266b2258", "link": "https://learn.microsoft.com/azure/virtual-desktop/prerequisites?tabs=portal#supported-identity-scenarios", "services": [ - "VM", + "Entra", "AVD", - "Entra" + "VM" ], "severity": "High", "subcategory": "Requirements", @@ -20057,8 +20071,8 @@ "guid": "6f4a1651-bddd-4ea8-a487-cdeb4861bc3b", "link": "https://docs.microsoft.com/azure/active-directory-domain-services/compare-identity-solutions", "services": [ - "AVD", - "Entra" + "Entra", + "AVD" ], "severity": "Low", "subcategory": "Requirements", @@ -20072,9 +20086,9 @@ "guid": "5549524b-36c0-4f1a-892b-ab3ca78f5db2", "link": "https://learn.microsoft.com/azure/virtual-desktop/administrative-template", "services": [ + "Monitor", "Entra", - "AVD", - "Monitor" + "AVD" ], "severity": "Low", "subcategory": "Management", @@ -20088,9 +20102,9 @@ "guid": "3334fdf9-1c23-4418-8b65-285269440b4b", "link": "https://learn.microsoft.com/azure/virtual-desktop/management", "services": [ - "VM", + "Monitor", "AVD", - "Monitor" + "VM" ], "severity": "Low", "subcategory": "Management", @@ -20104,8 +20118,8 @@ "guid": "63a08be1-6004-4b4a-a79b-f3239faae113", "link": "https://learn.microsoft.com/mem/intune/fundamentals/azure-virtual-desktop", "services": [ - "AVD", - "Monitor" + "Monitor", + "AVD" ], "severity": "Medium", "subcategory": "Management", @@ -20119,10 +20133,10 @@ "guid": "7138b820-102c-4e16-be30-1e6e872e52e3", "link": "https://learn.microsoft.com/azure/virtual-desktop/autoscale-scenarios", "services": [ - "VM", - "AVD", + "Monitor", "Cost", - "Monitor" + "AVD", + "VM" ], "severity": "Medium", "subcategory": "Management", @@ -20136,10 +20150,10 @@ "guid": "55f612fe-f215-4f0d-a956-10e7dd96bcbc", "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect", "services": [ - "VM", - "AVD", + "Monitor", "Cost", - "Monitor" + "AVD", + "VM" ], "severity": "Low", "subcategory": "Management", @@ -20153,11 +20167,11 @@ "guid": "79a686ea-d971-4ea0-a9a8-1aea074c94cb", "link": "https://learn.microsoft.com/azure/virtual-desktop/start-virtual-machine-connect-faq#are-vms-automatically-deallocated-when-a-user-stops-using-them", "services": [ + "Cost", + "AVD", "Monitor", "VM", - "AzurePolicy", - "AVD", - "Cost" + "AzurePolicy" ], "severity": "Low", "subcategory": "Management", @@ -20171,14 +20185,14 @@ "guid": "51bcafca-476a-48fa-9b91-9645a7679f20", "link": "https://learn.microsoft.com/azure/virtual-desktop/tag-virtual-desktop-resources", "services": [ - "VWAN", - "ExpressRoute", + "Cost", + "VPN", + "AVD", "Monitor", "DNS", "Storage", - "AVD", - "Cost", - "VPN" + "ExpressRoute", + "VWAN" ], "severity": "Low", "subcategory": "Management", @@ -20192,10 +20206,10 @@ "guid": "611dd68c-5a4b-4252-8e44-a59a9c2399c4", "link": "https://learn.microsoft.com/azure/virtual-desktop/azure-advisor-recommendations", "services": [ - "AVD", "Monitor", + "Entra", "Cost", - "Entra" + "AVD" ], "severity": "Low", "subcategory": "Management", @@ -20209,8 +20223,8 @@ "guid": "04722da2-9c2b-41cd-922f-54b29bade3aa", "link": "https://learn.microsoft.com/mem/intune/fundamentals/azure-virtual-desktop-multi-session", "services": [ - "AVD", - "Monitor" + "Monitor", + "AVD" ], "severity": "Medium", "subcategory": "Management", @@ -20224,8 +20238,8 @@ "guid": "c067939b-e5ca-4698-b9ce-3bd91843e73f", "link": "https://learn.microsoft.com/azure/virtual-desktop/scheduled-agent-updates", "services": [ - "AVD", - "Monitor" + "Monitor", + "AVD" ], "severity": "Low", "subcategory": "Management", @@ -20239,9 +20253,9 @@ "guid": "d1e8c38e-c936-4667-913c-005674b1e944", "link": "https://docs.microsoft.com/azure/virtual-desktop/create-validation-host-pool", "services": [ - "VM", + "Monitor", "AVD", - "Monitor" + "VM" ], "severity": "Medium", "subcategory": "Management", @@ -20255,9 +20269,9 @@ "guid": "a459c373-e7ed-4616-83b3-65a917ecbe48", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-platform-automation-and-devops", "services": [ - "VM", + "Monitor", "AVD", - "Monitor" + "VM" ], "severity": "Medium", "subcategory": "Management", @@ -20271,9 +20285,9 @@ "guid": "ebe54cd7-df2e-48bb-ac35-81559bb9153e", "link": "https://docs.microsoft.com/azure/virtual-desktop/faq", "services": [ - "VM", + "Monitor", "AVD", - "Monitor" + "VM" ], "severity": "Medium", "subcategory": "Management", @@ -20287,8 +20301,8 @@ "guid": "63cfff1c-ac59-49ef-8d5a-83dd4de36c1c", "link": "https://learn.microsoft.com/azure/virtual-desktop/insights", "services": [ - "AVD", - "Monitor" + "Monitor", + "AVD" ], "severity": "High", "subcategory": "Monitoring", @@ -20302,9 +20316,9 @@ "guid": "81770afb-c4c0-4e43-a186-58d2857ed671", "link": "https://docs.microsoft.com/azure/virtual-desktop/diagnostics-log-analytics", "services": [ - "VM", + "Monitor", "AVD", - "Monitor" + "VM" ], "severity": "Medium", "subcategory": "Monitoring", @@ -20318,9 +20332,9 @@ "guid": "2463cffe-179c-4599-be0d-5973dd4ce32c", "link": "https://docs.microsoft.com/azure/storage/files/storage-files-monitoring?tabs=azure-portal", "services": [ - "AVD", + "Monitor", "Storage", - "Monitor" + "AVD" ], "severity": "Medium", "subcategory": "Monitoring", @@ -20334,8 +20348,8 @@ "guid": "18813706-f7c4-4c0d-9e51-4548d2457ed6", "link": "https://docs.microsoft.com/azure/virtual-desktop/set-up-service-alerts", "services": [ - "AVD", - "Monitor" + "Monitor", + "AVD" ], "severity": "Medium", "subcategory": "Monitoring", @@ -20349,9 +20363,9 @@ "guid": "dd399cfd-7b28-4dc8-9555-6202bfe4563b", "link": "https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/", "services": [ - "AVD", "ExpressRoute", "NVA", + "AVD", "VPN" ], "severity": "Medium", @@ -20366,9 +20380,9 @@ "guid": "c8639648-a652-4d6c-85e5-02965388e5de", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/wvd/eslz-network-topology-and-connectivity", "services": [ + "VWAN", "AVD", - "VNet", - "VWAN" + "VNet" ], "severity": "Medium", "subcategory": "Networking", @@ -20398,8 +20412,8 @@ "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop", "services": [ "Firewall", - "AVD", "NVA", + "AVD", "VNet" ], "severity": "Medium", @@ -20444,8 +20458,8 @@ "link": "https://docs.microsoft.com/azure/firewall/protect-windows-virtual-desktop", "services": [ "Firewall", - "AVD", "NVA", + "AVD", "VNet" ], "severity": "Low", @@ -20460,8 +20474,8 @@ "guid": "cc6edca0-aeca-4566-9e92-cf246f1465af", "link": "https://learn.microsoft.com/azure/virtual-desktop/proxy-server-support", "services": [ - "VM", - "AVD" + "AVD", + "VM" ], "severity": "High", "subcategory": "Networking", @@ -20475,8 +20489,8 @@ "guid": "516785c6-fa96-4c96-ad88-408f372734c8", "link": "https://learn.microsoft.com/azure/virtual-desktop/rdp-bandwidth", "services": [ - "VM", - "AVD" + "AVD", + "VM" ], "severity": "Low", "subcategory": "Networking", @@ -20490,10 +20504,10 @@ "guid": "ec27d589-9178-426d-8df2-ff60020f30a6", "link": "https://learn.microsoft.com/azure/storage/files/storage-files-networking-endpoints", "services": [ - "Storage", - "AVD", "Cost", + "AVD", "VNet", + "Storage", "PrivateLink" ], "severity": "Medium", @@ -20552,10 +20566,10 @@ "guid": "0fd32907-98bc-4178-adc5-a06ca7144351", "link": "https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview", "services": [ - "VM", + "Storage", "AVD", "AKV", - "Storage" + "VM" ], "severity": "Low", "subcategory": "Host Configuration", @@ -20569,9 +20583,9 @@ "guid": "36a5a67f-bb9e-4d5b-9547-8c4479816b28", "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#azure-virtual-desktop-support-for-trusted-launch", "services": [ - "VM", + "Monitor", "AVD", - "Monitor" + "VM" ], "severity": "Medium", "subcategory": "Host Configuration", @@ -20585,8 +20599,8 @@ "guid": "135d3899-4b31-44d3-bc8f-028871a359d8", "link": "https://learn.microsoft.com/windows/whats-new/windows-11-requirements", "services": [ - "VM", - "AVD" + "AVD", + "VM" ], "severity": "High", "subcategory": "Host Configuration", @@ -20671,12 +20685,12 @@ "guid": "1814387e-5ca9-4c26-a9b3-2ab5bdfc6998", "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#enable-microsoft-defender-for-cloud", "services": [ - "Subscriptions", - "Defender", - "VM", - "Storage", "AKV", - "AVD" + "Subscriptions", + "AVD", + "Storage", + "VM", + "Defender" ], "severity": "Medium", "subcategory": "Management", @@ -20690,9 +20704,9 @@ "guid": "a0916a76-4980-4ad0-b278-ee293c1bc352", "link": "https://learn.microsoft.com/azure/virtual-desktop/security-guide#collect-audit-logs", "services": [ + "Monitor", "Entra", - "AVD", - "Monitor" + "AVD" ], "severity": "Medium", "subcategory": "Management", @@ -20706,9 +20720,9 @@ "guid": "baaab757-1849-4ab8-893d-c9fc9d1bb73b", "link": "https://docs.microsoft.com/azure/virtual-desktop/rbac", "services": [ - "AVD", + "Entra", "RBAC", - "Entra" + "AVD" ], "severity": "Low", "subcategory": "Management", @@ -20737,8 +20751,8 @@ "guid": "916d697d-8ead-4ed2-9bdd-186f1ac252b9", "link": "https://learn.microsoft.com/azure/virtual-desktop/set-up-mfa", "services": [ - "AVD", - "Entra" + "Entra", + "AVD" ], "severity": "Medium", "subcategory": "Microsoft Entra ID", @@ -20766,8 +20780,8 @@ "guid": "9164e990-9ae2-48c8-9c33-b6b7808bafe6", "link": "https://learn.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files#best-practices-for-azure-virtual-desktop", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "Medium", "subcategory": "Azure Files", @@ -20781,10 +20795,10 @@ "guid": "5784b6ca-5e9e-4bcf-8b54-c95459ea7369", "link": "https://learn.microsoft.com/azure/storage/files/storage-files-smb-multichannel-performance", "services": [ - "AVD", - "Storage", "Cost", - "ACR" + "Storage", + "ACR", + "AVD" ], "severity": "Low", "subcategory": "Azure Files", @@ -20798,8 +20812,8 @@ "guid": "4a359836-ee79-4d6c-9d3a-364a5b7abae3", "link": "https://azure.microsoft.com/global-infrastructure/services/", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "Medium", "subcategory": "Azure NetApp Files", @@ -20813,8 +20827,8 @@ "guid": "a2661898-866a-4c8d-9d1f-8cfc86e88024", "link": "https://learn.microsoft.com/azure/virtual-desktop/create-fslogix-profile-container", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "Medium", "subcategory": "Azure NetApp Files", @@ -20828,8 +20842,8 @@ "guid": "6647e977-db49-48a8-bc35-743f17499d42", "link": "https://docs.microsoft.com/azure/azure-netapp-files/create-active-directory-connections", "services": [ - "AVD", "Storage", + "AVD", "VNet" ], "severity": "High", @@ -20844,8 +20858,8 @@ "guid": "3611c818-b0a0-4bc5-80e4-3a18a9cd289c", "link": "https://docs.microsoft.com/azure/virtual-machines/disks-types", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "Medium", "subcategory": "Capacity Planning", @@ -20859,9 +20873,9 @@ "guid": "ed6b17db-8255-4462-b2ae-e4553afc8339", "link": "https://docs.microsoft.com/azure/virtual-desktop/store-fslogix-profile", "services": [ - "VM", + "Storage", "AVD", - "Storage" + "VM" ], "severity": "High", "subcategory": "Capacity Planning", @@ -20875,8 +20889,8 @@ "guid": "2fad62bd-5004-453c-ace4-64d862e7f5a4", "link": "https://learn.microsoft.com/azure/virtual-desktop/store-fslogix-profile", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "High", "subcategory": "Capacity Planning", @@ -20890,8 +20904,8 @@ "guid": "680e7828-9c93-4665-9d02-bff4564b0d93", "link": "https://learn.microsoft.com/azure/virtual-desktop/faq#what-s-the-largest-profile-size-fslogix-can-handle-", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "High", "subcategory": "Capacity Planning", @@ -20905,9 +20919,9 @@ "guid": "8aad53cc-79e2-4e86-9673-57c549675c5e", "link": "https://docs.microsoft.com/azure/virtual-desktop/fslogix-containers-azure-files", "services": [ - "AVD", + "Cost", "Storage", - "Cost" + "AVD" ], "severity": "High", "subcategory": "Capacity Planning", @@ -20921,9 +20935,9 @@ "guid": "df47d2d9-2881-4b1c-b5d1-e54a29759e39", "link": "https://learn.microsoft.com/fslogix/concepts-container-types#when-to-use-profile-and-odfc-containers", "services": [ - "AVD", "Storage", - "ASR" + "ASR", + "AVD" ], "severity": "High", "subcategory": "FSLogix", @@ -20937,8 +20951,8 @@ "guid": "83f63047-22ee-479d-9b5c-3632054b69ba", "link": "https://learn.microsoft.com/fslogix/overview-prerequisites#configure-antivirus-file-and-folder-exclusions", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "Medium", "subcategory": "FSLogix", @@ -20952,8 +20966,8 @@ "guid": "01e6a84d-e5df-443d-8992-481718d5d1e5", "link": "https://docs.microsoft.com/fslogix/profile-container-configuration-reference", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "High", "subcategory": "FSLogix", @@ -20968,9 +20982,9 @@ "link": "https://learn.microsoft.com/fslogix/concepts-configuration-examples", "services": [ "Storage", + "ACR", "AVD", - "AKV", - "ACR" + "AKV" ], "severity": "High", "subcategory": "FSLogix", @@ -20984,8 +20998,8 @@ "guid": "5e985b85-9c77-43e7-b261-623b775a917e", "link": "https://learn.microsoft.com/fslogix/concepts-multi-concurrent-connections", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "High", "subcategory": "FSLogix", @@ -20999,9 +21013,9 @@ "guid": "b2d1215a-e114-4ba3-9df5-85ecdcd9bd3b", "link": "https://docs.microsoft.com/fslogix/cloud-cache-configuration-reference", "services": [ - "VM", + "Storage", "AVD", - "Storage" + "VM" ], "severity": "Low", "subcategory": "FSLogix", @@ -21015,8 +21029,8 @@ "guid": "0b50ca97-b1d2-473c-b4d9-6e98b0f912de", "link": "https://docs.microsoft.com/fslogix/manage-profile-content-cncpt#redirectionsxml", "services": [ - "AVD", - "Storage" + "Storage", + "AVD" ], "severity": "Medium", "subcategory": "FSLogix", @@ -21086,8 +21100,8 @@ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", "service": "Windows AD", "services": [ - "VM", - "Entra" + "Entra", + "VM" ], "severity": "Medium", "subcategory": "Windows Server AD", @@ -21262,8 +21276,8 @@ "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore", "service": "CosmosDB", "services": [ - "Storage", "CosmosDB", + "Storage", "Backup" ], "severity": "Medium", @@ -21374,11 +21388,11 @@ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", "service": "SAP", "services": [ + "Backup", + "SQL", "ASR", "Storage", - "SQL", - "SAP", - "Backup" + "SAP" ], "severity": "High", "subcategory": "Disaster recovery", @@ -21409,8 +21423,8 @@ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", "service": "SAP", "services": [ - "ASR", "ExpressRoute", + "ASR", "SAP", "VPN" ], @@ -21428,8 +21442,8 @@ "service": "SAP", "services": [ "ASR", - "AKV", "SAP", + "AKV", "ACR" ], "severity": "Low", @@ -21444,9 +21458,9 @@ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", "service": "SAP", "services": [ - "VNet", "ASR", - "SAP" + "SAP", + "VNet" ], "severity": "Medium", "subcategory": "Disaster recovery", @@ -21460,9 +21474,9 @@ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", "service": "SAP", "services": [ - "Storage", "ASR", - "SAP" + "SAP", + "Storage" ], "severity": "Low", "subcategory": "Disaster recovery", @@ -21493,9 +21507,9 @@ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", "service": "SAP", "services": [ - "VNet", "ASR", - "SAP" + "SAP", + "VNet" ], "severity": "High", "subcategory": "Disaster recovery", @@ -21509,10 +21523,10 @@ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", "service": "SAP", "services": [ - "VM", - "ASR", + "Entra", "SAP", - "Entra" + "ASR", + "VM" ], "severity": "High", "subcategory": "Disaster recovery", @@ -21559,10 +21573,10 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", "service": "SAP", "services": [ - "VM", - "Storage", "ASR", - "SAP" + "SAP", + "Storage", + "VM" ], "severity": "High", "subcategory": "High availability", @@ -21577,9 +21591,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", "service": "SAP", "services": [ - "Storage", "ASR", - "SAP" + "SAP", + "Storage" ], "severity": "High", "subcategory": "High availability", @@ -21660,10 +21674,10 @@ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", "service": "SAP", "services": [ - "VM", - "ASR", + "Entra", "SAP", - "Entra" + "ASR", + "VM" ], "severity": "High", "subcategory": "High availability", @@ -21677,10 +21691,10 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", "service": "SAP", "services": [ + "Entra", "ASR", "RBAC", "VM", - "Entra", "SAP" ], "severity": "High", @@ -21712,9 +21726,9 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", "service": "SAP", "services": [ - "VM", "ASR", - "SAP" + "SAP", + "VM" ], "severity": "High", "subcategory": "High availability", @@ -21729,9 +21743,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", "service": "SAP", "services": [ - "ASR", + "Entra", "SAP", - "Entra" + "ASR" ], "severity": "High", "subcategory": "High availability", @@ -21761,9 +21775,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", "service": "SAP", "services": [ - "ASR", + "Entra", "SAP", - "Entra" + "ASR" ], "severity": "High", "subcategory": "High availability", @@ -21778,10 +21792,10 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", "service": "SAP", "services": [ - "VM", - "ASR", + "Entra", "SAP", - "Entra" + "ASR", + "VM" ], "severity": "Medium", "subcategory": "High availability", @@ -21796,10 +21810,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", "service": "SAP", "services": [ - "VM", - "Storage", "ASR", - "SAP" + "SAP", + "Storage", + "VM" ], "severity": "Medium", "subcategory": "High availability", @@ -21829,9 +21843,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", "service": "SAP", "services": [ - "Storage", "ASR", - "SAP" + "SAP", + "Storage" ], "severity": "High", "subcategory": "Storage", @@ -21846,9 +21860,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", "service": "SAP", "services": [ - "Storage", "ASR", - "SAP" + "SAP", + "Storage" ], "severity": "High", "subcategory": "Storage", @@ -21863,9 +21877,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", "service": "SAP", "services": [ - "Storage", "ASR", - "SAP" + "SAP", + "Storage" ], "severity": "High", "subcategory": "Storage", @@ -21880,9 +21894,9 @@ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", "service": "SAP", "services": [ - "Storage", "ASR", - "SAP" + "SAP", + "Storage" ], "severity": "High", "subcategory": "Storage", @@ -21911,10 +21925,10 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", "service": "SAP", "services": [ - "VM", - "Storage", "Cost", - "SAP" + "SAP", + "Storage", + "VM" ], "severity": "Low", "subcategory": " ", @@ -21928,10 +21942,10 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", "service": "SAP", "services": [ - "VM", - "Storage", "Cost", - "SAP" + "SAP", + "Storage", + "VM" ], "severity": "Low", "subcategory": " ", @@ -21945,10 +21959,10 @@ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", "service": "SAP", "services": [ - "Subscriptions", - "RBAC", + "Entra", "SAP", - "Entra" + "Subscriptions", + "RBAC" ], "severity": "High", "subcategory": "Identity", @@ -21963,8 +21977,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -21979,8 +21993,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -21994,8 +22008,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -22009,8 +22023,8 @@ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -22025,8 +22039,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -22040,9 +22054,9 @@ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", "service": "SAP", "services": [ - "AKV", + "Entra", "SAP", - "Entra" + "AKV" ], "severity": "Medium", "subcategory": "Identity", @@ -22057,9 +22071,9 @@ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", "service": "SAP", "services": [ - "AKV", + "Entra", "SAP", - "Entra" + "AKV" ], "severity": "Medium", "subcategory": "Identity", @@ -22073,8 +22087,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -22088,8 +22102,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -22103,8 +22117,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -22118,8 +22132,8 @@ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -22133,8 +22147,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -22148,8 +22162,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -22163,8 +22177,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", "service": "SAP", "services": [ - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Identity", @@ -22178,9 +22192,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", "service": "SAP", "services": [ - "Subscriptions", + "AzurePolicy", "SAP", - "AzurePolicy" + "Subscriptions" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -22195,8 +22209,8 @@ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", "service": "SAP", "services": [ - "Subscriptions", - "SAP" + "SAP", + "Subscriptions" ], "severity": "High", "subcategory": "Subscriptions", @@ -22211,8 +22225,8 @@ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", "service": "SAP", "services": [ - "Subscriptions", - "SAP" + "SAP", + "Subscriptions" ], "severity": "High", "subcategory": "Subscriptions", @@ -22227,9 +22241,9 @@ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", "service": "SAP", "services": [ - "VM", + "SAP", "Subscriptions", - "SAP" + "VM" ], "severity": "High", "subcategory": "Subscriptions", @@ -22244,8 +22258,8 @@ "link": "https://learn.microsoft.com/rest/api/reserved-vm-instances/quotaapi?branch=capacity", "service": "SAP", "services": [ - "Subscriptions", - "SAP" + "SAP", + "Subscriptions" ], "severity": "Low", "subcategory": "Subscriptions", @@ -22259,9 +22273,9 @@ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", "service": "SAP", "services": [ - "VM", + "SAP", "Subscriptions", - "SAP" + "VM" ], "severity": "High", "subcategory": "Subscriptions", @@ -22275,8 +22289,8 @@ "link": "https://azure.microsoft.com/explore/global-infrastructure/products-by-region/", "service": "SAP", "services": [ - "Subscriptions", - "SAP" + "SAP", + "Subscriptions" ], "severity": "High", "subcategory": "Subscriptions", @@ -22291,10 +22305,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", "service": "SAP", "services": [ - "Subscriptions", - "TrafficManager", "Cost", - "SAP" + "SAP", + "Subscriptions", + "TrafficManager" ], "severity": "Medium", "subcategory": "Subscriptions", @@ -22309,8 +22323,8 @@ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", "service": "SAP", "services": [ - "SAP", "Monitor", + "SAP", "Backup" ], "severity": "High", @@ -22326,10 +22340,10 @@ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", "service": "SAP", "services": [ - "Monitor", - "VM", - "Storage", "Entra", + "Monitor", + "Storage", + "VM", "SAP" ], "severity": "Medium", @@ -22344,8 +22358,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", "service": "SAP", "services": [ - "SAP", - "Monitor" + "Monitor", + "SAP" ], "severity": "High", "subcategory": "Management", @@ -22360,8 +22374,8 @@ "service": "SAP", "services": [ "Monitor", - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Management", @@ -22393,8 +22407,8 @@ "service": "SAP", "services": [ "Monitor", - "SAP", - "Entra" + "Entra", + "SAP" ], "severity": "Medium", "subcategory": "Management", @@ -22408,9 +22422,9 @@ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", "service": "SAP", "services": [ - "VM", + "Monitor", "SAP", - "Monitor" + "VM" ], "severity": "Medium", "subcategory": "Management", @@ -22425,8 +22439,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", "service": "SAP", "services": [ - "SAP", - "Monitor" + "Monitor", + "SAP" ], "severity": "Low", "subcategory": "Management", @@ -22441,9 +22455,9 @@ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", "service": "SAP", "services": [ + "Monitor", "SQL", - "SAP", - "Monitor" + "SAP" ], "severity": "Medium", "subcategory": "Monitoring", @@ -22458,10 +22472,10 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", "service": "SAP", "services": [ - "VM", - "SAP", "Monitor", - "Entra" + "Entra", + "SAP", + "VM" ], "severity": "High", "subcategory": "Monitoring", @@ -22476,9 +22490,9 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "service": "SAP", "services": [ + "AzurePolicy", "SAP", - "Monitor", - "AzurePolicy" + "Monitor" ], "severity": "Medium", "subcategory": "Monitoring", @@ -22493,9 +22507,9 @@ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", "service": "SAP", "services": [ - "SAP", "Monitor", - "NetworkWatcher" + "NetworkWatcher", + "SAP" ], "severity": "Medium", "subcategory": "Monitoring", @@ -22510,9 +22524,9 @@ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", "service": "SAP", "services": [ - "VM", + "Monitor", "SAP", - "Monitor" + "VM" ], "severity": "Medium", "subcategory": "Monitoring", @@ -22526,9 +22540,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", "service": "SAP", "services": [ - "Subscriptions", + "Monitor", "SAP", - "Monitor" + "Subscriptions" ], "severity": "High", "subcategory": "Monitoring", @@ -22543,10 +22557,10 @@ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", "service": "SAP", "services": [ - "Storage", + "Monitor", "ASR", "SAP", - "Monitor" + "Storage" ], "severity": "Medium", "subcategory": "Monitoring", @@ -22561,9 +22575,9 @@ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", "service": "SAP", "services": [ + "Monitor", "Sentinel", - "SAP", - "Monitor" + "SAP" ], "severity": "Medium", "subcategory": "Monitoring", @@ -22595,9 +22609,9 @@ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", "service": "SAP", "services": [ - "VM", + "Monitor", "SAP", - "Monitor" + "VM" ], "severity": "Low", "subcategory": "Performance", @@ -22611,9 +22625,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", "service": "SAP", "services": [ + "Monitor", "ASR", - "SAP", - "Monitor" + "SAP" ], "severity": "Medium", "subcategory": "Performance", @@ -22628,9 +22642,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", "service": "SAP", "services": [ - "Storage", + "Monitor", "SAP", - "Monitor" + "Storage" ], "severity": "Medium", "subcategory": "Performance", @@ -22644,8 +22658,8 @@ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", "service": "SAP", "services": [ - "SAP", - "Monitor" + "Monitor", + "SAP" ], "severity": "Low", "subcategory": "Performance", @@ -22659,9 +22673,9 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", "service": "SAP", "services": [ - "Storage", + "Monitor", "SAP", - "Monitor" + "Storage" ], "severity": "Medium", "subcategory": "Performance", @@ -22676,9 +22690,9 @@ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/announcement-sap-on-azure-oracle-performance-efficiency-scripts/ba-p/3725178", "service": "SAP", "services": [ + "Monitor", "SQL", - "SAP", - "Monitor" + "SAP" ], "severity": "Medium", "subcategory": "Performance", @@ -22693,9 +22707,9 @@ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", "service": "SAP", "services": [ + "Monitor", "ASR", - "SAP", - "Monitor" + "SAP" ], "severity": "High", "subcategory": "Reliability", @@ -22710,10 +22724,10 @@ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", "service": "SAP", "services": [ - "WAF", - "AppGW", + "AzurePolicy", "SAP", - "AzurePolicy" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "App delivery", @@ -22728,9 +22742,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", "service": "SAP", "services": [ - "VM", + "DNS", "SAP", - "DNS" + "VM" ], "severity": "Medium", "subcategory": "DNS", @@ -22745,9 +22759,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", "service": "SAP", "services": [ - "VNet", + "DNS", "SAP", - "DNS" + "VNet" ], "severity": "Medium", "subcategory": "DNS", @@ -22762,8 +22776,8 @@ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", "service": "SAP", "services": [ - "VNet", "SAP", + "VNet", "ACR" ], "severity": "Medium", @@ -22813,8 +22827,8 @@ "service": "SAP", "services": [ "NVA", - "VNet", - "SAP" + "SAP", + "VNet" ], "severity": "Medium", "subcategory": "Hybrid", @@ -22830,9 +22844,9 @@ "service": "SAP", "services": [ "NVA", - "VNet", + "VWAN", "SAP", - "VWAN" + "VNet" ], "severity": "Medium", "subcategory": "Hybrid", @@ -22847,9 +22861,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", "service": "SAP", "services": [ - "VM", + "SAP", "VNet", - "SAP" + "VM" ], "severity": "High", "subcategory": "IP plan", @@ -22865,8 +22879,8 @@ "service": "SAP", "services": [ "ASR", - "VNet", - "SAP" + "SAP", + "VNet" ], "severity": "High", "subcategory": "IP plan", @@ -22881,8 +22895,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", "service": "SAP", "services": [ - "VNet", - "SAP" + "SAP", + "VNet" ], "severity": "High", "subcategory": "IP plan", @@ -22897,9 +22911,9 @@ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", "service": "SAP", "services": [ + "SAP", "Storage", - "VNet", - "SAP" + "VNet" ], "severity": "Medium", "subcategory": "IP plan", @@ -22930,9 +22944,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", "service": "SAP", "services": [ - "WAF", "SAP", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "subcategory": "Internet", @@ -22947,11 +22961,11 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "SAP", "services": [ - "WAF", "ACR", - "AzurePolicy", "FrontDoor", - "SAP" + "AzurePolicy", + "SAP", + "WAF" ], "severity": "Medium", "subcategory": "Internet", @@ -22966,11 +22980,11 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", "service": "SAP", "services": [ - "WAF", "AppGW", - "AzurePolicy", "FrontDoor", - "SAP" + "AzurePolicy", + "SAP", + "WAF" ], "severity": "Medium", "subcategory": "Internet", @@ -22985,10 +22999,10 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "SAP", "services": [ - "WAF", "SAP", - "LoadBalancer", - "AppGW" + "AppGW", + "WAF", + "LoadBalancer" ], "severity": "Medium", "subcategory": "Internet", @@ -23020,12 +23034,12 @@ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", "service": "SAP", "services": [ - "SAP", "ACR", - "Storage", + "Backup", "VNet", + "Storage", "PrivateLink", - "Backup" + "SAP" ], "severity": "Medium", "subcategory": "Internet", @@ -23040,8 +23054,8 @@ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", "service": "SAP", "services": [ - "VM", - "SAP" + "SAP", + "VM" ], "severity": "High", "subcategory": "Segmentation", @@ -23072,9 +23086,9 @@ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", "service": "SAP", "services": [ - "VM", + "SAP", "VNet", - "SAP" + "VM" ], "severity": "Medium", "subcategory": "Segmentation", @@ -23089,8 +23103,8 @@ "link": "https://me.sap.com/notes/2015553", "service": "SAP", "services": [ - "VNet", - "SAP" + "SAP", + "VNet" ], "severity": "High", "subcategory": "Segmentation", @@ -23135,9 +23149,9 @@ "link": "https://me.sap.com/notes/2015553", "service": "SAP", "services": [ - "VNet", "Cost", - "SAP" + "SAP", + "VNet" ], "severity": "High", "subcategory": "Segmentation", @@ -23168,8 +23182,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", "service": "SAP", "services": [ - "VNet", - "SAP" + "SAP", + "VNet" ], "severity": "Medium", "subcategory": "Segmentation", @@ -23183,9 +23197,9 @@ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", "service": "SAP", "services": [ - "VM", "SAP", - "Backup" + "Backup", + "VM" ], "severity": "High", "subcategory": " ", @@ -23199,9 +23213,9 @@ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", "service": "SAP", "services": [ + "Monitor", "ASR", - "SAP", - "Monitor" + "SAP" ], "severity": "Medium", "subcategory": " ", @@ -23215,8 +23229,8 @@ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", "service": "SAP", "services": [ - "SAP", - "Monitor" + "Monitor", + "SAP" ], "severity": "High", "subcategory": " ", @@ -23230,9 +23244,9 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", "service": "SAP", "services": [ - "VM", "SAP", - "Backup" + "Backup", + "VM" ], "severity": "Medium", "subcategory": " ", @@ -23247,8 +23261,8 @@ "service": "SAP", "services": [ "SQL", - "Storage", - "SAP" + "SAP", + "Storage" ], "severity": "Medium", "subcategory": " ", @@ -23262,9 +23276,9 @@ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", "service": "SAP", "services": [ - "VM", "SAP", - "Backup" + "Backup", + "VM" ], "severity": "Medium", "subcategory": " ", @@ -23334,9 +23348,9 @@ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", "service": "SAP", "services": [ + "Monitor", "SQL", - "SAP", - "Monitor" + "SAP" ], "severity": "Medium", "subcategory": " ", @@ -23350,8 +23364,8 @@ "link": "https://me.sap.com/notes/500235", "service": "SAP", "services": [ - "VM", - "SAP" + "SAP", + "VM" ], "severity": "Medium", "subcategory": " ", @@ -23366,8 +23380,8 @@ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", "service": "SAP", "services": [ - "SAP", - "Monitor" + "Monitor", + "SAP" ], "severity": "Medium", "subcategory": " ", @@ -23395,8 +23409,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", "service": "SAP", "services": [ - "VM", - "SAP" + "SAP", + "VM" ], "severity": "Medium", "subcategory": "Governance", @@ -23457,11 +23471,11 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", "service": "SAP", "services": [ - "Storage", + "Backup", "AKV", "SQL", - "SAP", - "Backup" + "Storage", + "SAP" ], "severity": "High", "subcategory": "Secrets", @@ -23476,9 +23490,9 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", "service": "SAP", "services": [ + "SAP", "Storage", - "AKV", - "SAP" + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -23493,8 +23507,8 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/overview", "service": "SAP", "services": [ - "AKV", - "SAP" + "SAP", + "AKV" ], "severity": "High", "subcategory": "Secrets", @@ -23509,9 +23523,9 @@ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", "service": "SAP", "services": [ + "AKV", "Subscriptions", "RBAC", - "AKV", "AzurePolicy", "SAP" ], @@ -23528,9 +23542,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", "service": "SAP", "services": [ - "AKV", + "AzurePolicy", "SAP", - "AzurePolicy" + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -23545,10 +23559,10 @@ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", "service": "SAP", "services": [ - "AKV", - "RBAC", + "AzurePolicy", "SAP", - "AzurePolicy" + "RBAC", + "AKV" ], "severity": "High", "subcategory": "Secrets", @@ -23563,10 +23577,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", "service": "SAP", "services": [ + "SAP", "Storage", - "Defender", "AKV", - "SAP" + "Defender" ], "severity": "High", "subcategory": "Secrets", @@ -23581,10 +23595,10 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", "service": "SAP", "services": [ - "Defender", - "RBAC", "SAP", - "AKV" + "RBAC", + "AKV", + "Defender" ], "severity": "High", "subcategory": "Secrets", @@ -23599,8 +23613,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", "service": "SAP", "services": [ - "AKV", - "SAP" + "SAP", + "AKV" ], "severity": "Low", "subcategory": "Secrets", @@ -23615,8 +23629,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-encryption-key-model-get?tabs=portal", "service": "SAP", "services": [ - "AKV", - "SAP" + "SAP", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -23631,8 +23645,8 @@ "link": "https://learn.microsoft.com/ja-jp/azure/key-vault/general/best-practices", "service": "SAP", "services": [ - "AKV", - "SAP" + "SAP", + "AKV" ], "severity": "High", "subcategory": "Secrets", @@ -23647,8 +23661,8 @@ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", "service": "SAP", "services": [ - "AKV", - "SAP" + "SAP", + "AKV" ], "severity": "High", "subcategory": "Secrets", @@ -23663,9 +23677,9 @@ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", "service": "SAP", "services": [ + "SAP", "Subscriptions", - "RBAC", - "SAP" + "RBAC" ], "severity": "High", "subcategory": "Security", @@ -23697,9 +23711,9 @@ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", "service": "SAP", "services": [ - "VM", + "SAP", "Storage", - "SAP" + "VM" ], "severity": "Low", "subcategory": "Security", @@ -23714,8 +23728,8 @@ "link": "https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide", "service": "SAP", "services": [ - "Defender", - "SAP" + "SAP", + "Defender" ], "severity": "Low", "subcategory": "Security", @@ -23730,8 +23744,8 @@ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", "service": "SAP", "services": [ - "VNet", - "SAP" + "SAP", + "VNet" ], "severity": "High", "subcategory": "Security", @@ -23746,8 +23760,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Low", "subcategory": "Security", @@ -23762,9 +23776,9 @@ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", "service": "SAP", "services": [ - "AKV", + "Monitor", "SAP", - "Monitor" + "AKV" ], "severity": "Medium", "subcategory": "Security", @@ -23847,8 +23861,8 @@ "guid": "aa359271-8e6e-4205-8725-769e46691e88", "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits", "services": [ - "Arc", - "Entra" + "Entra", + "Arc" ], "severity": "Medium", "subcategory": "Capacity Planning", @@ -23947,9 +23961,9 @@ "guid": "9bf39d95-d44c-47c8-a19c-a1f6d5215ae5", "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#identity-and-access-control", "services": [ + "Entra", "RBAC", - "Arc", - "Entra" + "Arc" ], "severity": "Medium", "subcategory": "Access", @@ -23962,9 +23976,9 @@ "guid": "14ba34d4-585e-4111-89bd-7ba012f7b94e", "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad", "services": [ - "AKV", + "Entra", "Arc", - "Entra" + "AKV" ], "severity": "Low", "subcategory": "Access", @@ -23978,9 +23992,9 @@ "guid": "35ac9322-23e1-4380-8523-081a94174158", "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#azure-subscription-and-service-limits", "services": [ + "Entra", "Subscriptions", - "Arc", - "Entra" + "Arc" ], "severity": "High", "subcategory": "Requirements", @@ -23994,9 +24008,9 @@ "guid": "33ee7ad6-c6d3-4733-865c-7acbe44bbe60", "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions", "services": [ + "Entra", "RBAC", - "Arc", - "Entra" + "Arc" ], "severity": "Medium", "subcategory": "Requirements", @@ -24010,9 +24024,9 @@ "guid": "9d79f2e8-7778-4424-a516-775c6fa95b96", "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale", "services": [ + "Entra", "RBAC", - "Arc", - "Entra" + "Arc" ], "severity": "Medium", "subcategory": "Security", @@ -24026,9 +24040,9 @@ "guid": "ad88408e-3727-434b-a76b-a28f21459013", "link": "https://learn.microsoft.com/azure/azure-arc/servers/onboard-service-principal#create-a-service-principal-for-onboarding-at-scale", "services": [ + "Entra", "RBAC", - "Arc", - "Entra" + "Arc" ], "severity": "Medium", "subcategory": "Security", @@ -24042,9 +24056,9 @@ "guid": "65d38e53-f9cc-4bd8-9826-6abca264f9a1", "link": "https://learn.microsoft.com/azure/azure-arc/servers/prerequisites#required-permissions", "services": [ + "Entra", "RBAC", - "Arc", - "Entra" + "Arc" ], "severity": "Medium", "subcategory": "Security", @@ -24058,8 +24072,8 @@ "guid": "6ee79d6b-5c2a-4364-a4b6-9bad38aad53c", "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment", "services": [ - "Arc", - "Monitor" + "Monitor", + "Arc" ], "severity": "Medium", "subcategory": "Management", @@ -24073,8 +24087,8 @@ "guid": "c78e1d76-6673-457c-9496-74c5ed85b859", "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-agent#upgrade-the-agent", "services": [ - "Arc", - "Monitor" + "Monitor", + "Arc" ], "severity": "High", "subcategory": "Management", @@ -24088,8 +24102,8 @@ "guid": "c7733be2-a1a2-47b7-95a9-1be1f388ff39", "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-vm-extensions", "services": [ - "Arc", "Monitor", + "Arc", "AzurePolicy" ], "severity": "Medium", @@ -24104,8 +24118,8 @@ "guid": "4c2bd463-cbbb-4c86-a195-abb91a4ed90d", "link": "https://learn.microsoft.com/azure/azure-arc/servers/manage-automatic-vm-extension-upgrade?tabs=azure-portal", "services": [ - "Arc", - "Monitor" + "Monitor", + "Arc" ], "severity": "High", "subcategory": "Management", @@ -24119,8 +24133,8 @@ "guid": "7a927c39-74d1-4102-aac6-aae01e6a84de", "link": "https://learn.microsoft.com/azure/automanage/automanage-arc", "services": [ - "Arc", - "Monitor" + "Monitor", + "Arc" ], "severity": "Medium", "subcategory": "Management", @@ -24133,8 +24147,8 @@ "guid": "37b6b780-cbaf-4e6c-9658-9d457a927c39", "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate", "services": [ - "Arc", - "Monitor" + "Monitor", + "Arc" ], "severity": "High", "subcategory": "Monitoring", @@ -24147,8 +24161,8 @@ "guid": "74d1102c-ac6a-4ae0-8e6a-84de5df47d2d", "link": "https://learn.microsoft.com/azure/azure-monitor/agents/log-analytics-agent#data-collected", "services": [ - "Arc", - "Monitor" + "Monitor", + "Arc" ], "severity": "Medium", "subcategory": "Monitoring", @@ -24161,8 +24175,8 @@ "guid": "92881b1c-d5d1-4e54-a296-59e3958fd782", "link": "https://learn.microsoft.com/azure/service-health/resource-health-alert-monitor-guide", "services": [ - "Arc", - "Monitor" + "Monitor", + "Arc" ], "severity": "Medium", "subcategory": "Monitoring", @@ -24175,8 +24189,8 @@ "guid": "89c93555-6d02-4bfe-9564-b0d834a34872", "link": "https://learn.microsoft.com/azure/azure-arc/servers/learn/tutorial-enable-vm-insights", "services": [ - "Arc", - "Monitor" + "Monitor", + "Arc" ], "severity": "Medium", "subcategory": "Monitoring", @@ -24189,8 +24203,8 @@ "guid": "5df47d2d-9288-41b1-ad5d-1e54a29659e3", "link": "https://learn.microsoft.com/azure/azure-arc/servers/plan-at-scale-deployment#phase-3-manage-and-operate", "services": [ - "Arc", - "Monitor" + "Monitor", + "Arc" ], "severity": "Medium", "subcategory": "Monitoring", @@ -24204,8 +24218,8 @@ "guid": "ae2cc84c-37b6-4b78-8cba-fe6c46589d45", "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/arc-update-management", "services": [ - "Arc", - "Monitor" + "Monitor", + "Arc" ], "severity": "Low", "subcategory": "Security", @@ -24247,10 +24261,10 @@ "guid": "94174158-33ee-47ad-9c6d-3733165c7acb", "link": "https://learn.microsoft.com/azure/azure-arc/servers/private-link-security", "services": [ - "VPN", "ExpressRoute", "Arc", - "PrivateLink" + "PrivateLink", + "VPN" ], "severity": "Medium", "subcategory": "Networking", @@ -24321,8 +24335,8 @@ "guid": "ac6aae01-e6a8-44de-9df4-7d2d92881b1c", "link": "https://learn.microsoft.com/azure/governance/policy/", "services": [ - "Arc", - "AzurePolicy" + "AzurePolicy", + "Arc" ], "severity": "Medium", "subcategory": "Management", @@ -24348,8 +24362,8 @@ "guid": "667357c4-4967-44c5-bd85-b859c7733be2", "link": "https://learn.microsoft.com/azure/governance/machine-configuration/machine-configuration-create", "services": [ - "Arc", - "AzurePolicy" + "AzurePolicy", + "Arc" ], "severity": "Medium", "subcategory": "Management", @@ -24362,8 +24376,8 @@ "guid": "49674c5e-d85b-4859-a773-3be2a1a27b77", "link": "https://learn.microsoft.com/azure/automation/change-tracking/overview", "services": [ - "Arc", - "Monitor" + "Monitor", + "Arc" ], "severity": "Medium", "subcategory": "Monitoring", @@ -24389,8 +24403,8 @@ "guid": "195abb91-a4ed-490d-ae2c-c84c37b6b780", "link": "https://learn.microsoft.com/azure/key-vault/general/basic-concepts", "services": [ - "AKV", - "Arc" + "Arc", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -24405,9 +24419,9 @@ "link": "https://learn.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal#option-2-create-a-new-application-secret", "services": [ "Storage", - "AKV", + "Entra", "Arc", - "Entra" + "AKV" ], "severity": "High", "subcategory": "Secrets", @@ -24421,8 +24435,8 @@ "guid": "a1a27b77-5a91-4be1-b388-ff394c2bd463", "link": "https://learn.microsoft.com/azure/azure-arc/servers/security-overview#using-disk-encryption", "services": [ - "AKV", - "Arc" + "Arc", + "AKV" ], "severity": "Medium", "subcategory": "Secrets", @@ -24463,8 +24477,8 @@ "guid": "4b69bad3-8aad-453c-a78e-1d76667357c4", "link": "https://learn.microsoft.com/azure/azure-arc/servers/managed-identity-authentication", "services": [ - "Arc", - "Entra" + "Entra", + "Arc" ], "severity": "Medium", "subcategory": "Security", @@ -24478,8 +24492,8 @@ "guid": "5a91be1f-388f-4f39-9c2b-d463cbbbc868", "link": "https://learn.microsoft.com/azure/security-center/security-center-get-started", "services": [ - "Defender", - "Arc" + "Arc", + "Defender" ], "severity": "Medium", "subcategory": "Security", @@ -24519,8 +24533,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#br-2-encrypt-backup-data", "services": [ "SQL", - "AKV", - "Backup" + "Backup", + "AKV" ], "severity": "Medium", "subcategory": "Azure Key Vault", @@ -24625,8 +24639,8 @@ "link": "https://learn.microsoft.com/azure/azure-sql/database/azure-defender-for-sql?view=azuresql#enable-microsoft-defender-for-sql ", "services": [ "SQL", - "Defender", - "Subscriptions" + "Subscriptions", + "Defender" ], "severity": "High", "subcategory": "Defender for Azure SQL", @@ -24640,9 +24654,9 @@ "guid": "ca342fdf-d25a-4427-b105-fcd50ff8a0ea", "link": "https://learn.microsoft.com/azure/azure-sql/database/threat-detection-configure", "services": [ + "Monitor", "SQL", - "Defender", - "Monitor" + "Defender" ], "severity": "High", "subcategory": "Defender for Azure SQL", @@ -24656,9 +24670,9 @@ "guid": "a6101ae7-534c-45ab-86fd-b34c55ea21ca", "link": "https://learn.microsoft.com/azure/defender-for-cloud/sql-azure-vulnerability-assessment-overview", "services": [ + "Monitor", "SQL", - "Defender", - "Monitor" + "Defender" ], "severity": "High", "subcategory": "Vulnerability Assessment", @@ -24702,8 +24716,8 @@ "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#control-access-of-application-users-to-sensitive-data-through-encryption", "services": [ "SQL", - "AKV", - "Storage" + "Storage", + "AKV" ], "severity": "Low", "subcategory": "Column Encryption", @@ -24762,8 +24776,8 @@ "guid": "c9b8b6bf-2c6b-453d-b400-de9a43a549d7", "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-overview", "services": [ - "SQL", - "Entra" + "Entra", + "SQL" ], "severity": "Medium", "subcategory": "Azure Active Directory", @@ -24777,9 +24791,9 @@ "guid": "29820254-1d14-4778-ae90-ff4aeba504a3", "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#central-management-for-identities", "services": [ - "SQL", "Monitor", - "Entra" + "Entra", + "SQL" ], "severity": "Medium", "subcategory": "Azure Active Directory", @@ -24793,8 +24807,8 @@ "guid": "df3a09ee-03bb-4198-8637-d141acf5f289", "link": "https://learn.microsoft.com/azure/azure-sql/database/security-best-practice?view=azuresql#minimize-the-use-of-password-based-authentication-for-applications", "services": [ - "SQL", - "Entra" + "Entra", + "SQL" ], "severity": "Medium", "subcategory": "Azure Active Directory", @@ -24808,11 +24822,11 @@ "guid": "69891194-5074-4e30-8f69-4efc3c580900", "link": "https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview", "services": [ - "RBAC", + "Entra", "ACR", "AKV", - "Entra", - "SQL" + "SQL", + "RBAC" ], "severity": "Low", "subcategory": "Managed Identities", @@ -24826,8 +24840,8 @@ "guid": "88287d4a-8bb8-4640-ad78-03f51354d003", "link": "https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-configure?view=azuresql&tabs=azure-powershell#active-directory-integrated-authentication", "services": [ - "SQL", - "Entra" + "Entra", + "SQL" ], "severity": "Medium", "subcategory": "Passwords", @@ -24856,9 +24870,9 @@ "guid": "afefb2d3-95da-4ac9-acf5-33d18b32ef9a", "link": "https://learn.microsoft.com/sql/relational-databases/security/ledger/ledger-digest-management", "services": [ + "AzurePolicy", "SQL", - "Storage", - "AzurePolicy" + "Storage" ], "severity": "Medium", "subcategory": "Database Digest", @@ -24915,9 +24929,9 @@ "guid": "4082e31d-35f4-4a49-8507-d3172cc930a6", "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview", "services": [ + "AzurePolicy", "SQL", - "Storage", - "AzurePolicy" + "Storage" ], "severity": "Medium", "subcategory": "Auditing", @@ -24931,12 +24945,12 @@ "guid": "9b64bc50-b60f-4035-bf7a-28c4806dfb46", "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview", "services": [ - "EventHubs", - "Monitor", - "Storage", "Entra", + "Backup", + "Monitor", "SQL", - "Backup" + "Storage", + "EventHubs" ], "severity": "Low", "subcategory": "Auditing", @@ -24950,11 +24964,11 @@ "guid": "fcd34708-87ac-4efc-aaf6-57a47f76644a", "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", "services": [ - "EventHubs", "Subscriptions", "Monitor", + "SQL", "Storage", - "SQL" + "EventHubs" ], "severity": "Medium", "subcategory": "Auditing", @@ -24968,8 +24982,8 @@ "guid": "f96e127e-9572-453a-b325-ff89ae9f6b44", "link": "https://learn.microsoft.com/azure/azure-sql/database/auditing-overview", "services": [ - "SQL", - "Monitor" + "Monitor", + "SQL" ], "severity": "Medium", "subcategory": "SIEM/SOAR", @@ -24983,8 +24997,8 @@ "guid": "41503bf8-73da-4a10-af9f-5f7fceb5456f", "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", "services": [ - "SQL", - "Monitor" + "Monitor", + "SQL" ], "severity": "Medium", "subcategory": "SIEM/SOAR", @@ -25028,9 +25042,9 @@ "guid": "557b3ce5-bada-4296-8d52-a2d447bc1718", "link": "https://learn.microsoft.com/azure/azure-sql/database/connectivity-architecture", "services": [ + "AzurePolicy", "SQL", - "PrivateLink", - "AzurePolicy" + "PrivateLink" ], "severity": "Low", "subcategory": "Connectivity", @@ -25060,8 +25074,8 @@ "link": "https://learn.microsoft.com/sql/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql", "services": [ "EventHubs", - "SQL", - "APIM" + "APIM", + "SQL" ], "severity": "Medium", "subcategory": "Outbound Control", @@ -25091,9 +25105,9 @@ "link": "https://learn.microsoft.com/azure/azure-sql/database/private-endpoint-overview?view=azuresql#disable-public-access-to-your-logical-server", "services": [ "Firewall", + "VNet", "Monitor", "SQL", - "VNet", "PrivateLink" ], "severity": "Medium", @@ -25140,8 +25154,8 @@ "guid": "18123ef4-a0a6-45e3-87fe-7f454f65d975", "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture-overview", "services": [ - "SQL", "ExpressRoute", + "SQL", "VNet" ], "severity": "Medium", @@ -25156,9 +25170,9 @@ "guid": "55187443-6852-4fbd-99c6-ce303597ca7f", "link": "https://learn.microsoft.com/azure/azure-sql/database/network-access-controls-overview?view=azuresql#ip-vs-virtual-network-firewall-rules", "services": [ + "AzurePolicy", "SQL", - "VNet", - "AzurePolicy" + "VNet" ], "severity": "High", "subcategory": "Public Access", @@ -25202,9 +25216,9 @@ "guid": "b8435656-143e-41a8-9922-61d34edb751a", "link": "https://learn.microsoft.com/azure/azure-sql/managed-instance/public-endpoint-overview", "services": [ + "AzurePolicy", "SQL", - "VNet", - "AzurePolicy" + "VNet" ], "severity": "High", "subcategory": "Public Access", @@ -25261,8 +25275,8 @@ "guid": "7b5b55e5-4750-4920-be97-eb726c256a5c", "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/sql-database-security-baseline#im-3-use-azure-ad-single-sign-on-sso-for-application-access", "services": [ - "SQL", - "Entra" + "Entra", + "SQL" ], "severity": "Low", "subcategory": "Permissions", @@ -25525,8 +25539,8 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Key Vault", "services": [ - "AKV", - "Backup" + "Backup", + "AKV" ], "severity": "High", "subcategory": "Deployment best practices", @@ -25540,8 +25554,8 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", "service": "Key Vault", "services": [ - "AKV", - "ACR" + "ACR", + "AKV" ], "severity": "Medium", "subcategory": "High Availability", @@ -25569,8 +25583,8 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions", "service": "Key Vault", "services": [ - "AKV", - "AzurePolicy" + "AzurePolicy", + "AKV" ], "severity": "Medium", "subcategory": "High Availability", @@ -25584,11 +25598,11 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations", "service": "Key Vault", "services": [ - "ASR", - "Subscriptions", - "Storage", + "Backup", "AKV", - "Backup" + "Subscriptions", + "ASR", + "Storage" ], "severity": "Medium", "subcategory": "Business continuity and disaster recovery", @@ -25632,9 +25646,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", "service": "Key Vault", "services": [ + "Backup", "ASR", - "AKV", - "Backup" + "AKV" ], "severity": "Low", "subcategory": "Business continuity and disaster recovery", @@ -25648,9 +25662,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", "service": "Key Vault", "services": [ + "Backup", "ASR", - "AKV", - "Backup" + "AKV" ], "severity": "Low", "subcategory": "Business continuity and disaster recovery", @@ -25690,9 +25704,9 @@ "guid": "67b23587-05a1-4652-aded-fa8a488cdec4", "link": "https://learn.microsoft.com/azure/site-recovery/azure-to-azure-how-to-enable-policy", "services": [ - "VM", + "AzurePolicy", "ASR", - "AzurePolicy" + "VM" ], "severity": "High", "subcategory": "Replication", @@ -25770,8 +25784,8 @@ "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction", "service": "VM", "services": [ - "VM", - "Backup" + "Backup", + "VM" ], "severity": "High", "subcategory": "Virtual Machines", @@ -25816,9 +25830,9 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk", "service": "VM", "services": [ - "VM", + "SQL", "Storage", - "SQL" + "VM" ], "severity": "Medium", "subcategory": "Virtual Machines", @@ -25833,9 +25847,9 @@ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", "service": "VM", "services": [ - "VM", + "ACR", "Storage", - "ACR" + "VM" ], "severity": "Medium", "subcategory": "Virtual Machines", @@ -25865,8 +25879,8 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/availability", "service": "VM", "services": [ - "VM", - "ASR" + "ASR", + "VM" ], "severity": "High", "subcategory": "Virtual Machines", @@ -25881,9 +25895,9 @@ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", "service": "VM", "services": [ - "VM", "ASR", - "AVS" + "AVS", + "VM" ], "severity": "High", "subcategory": "Virtual Machines", @@ -25913,8 +25927,8 @@ "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests", "service": "VM", "services": [ - "VM", - "ASR" + "ASR", + "VM" ], "severity": "Medium", "subcategory": "Virtual Machines", @@ -26118,8 +26132,8 @@ "guid": "ced126cd-032a-4f5b-8fc6-998a535e3378", "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", "services": [ - "Storage", - "AppGW" + "AppGW", + "Storage" ], "severity": "High", "subcategory": "Application Gateways", @@ -26147,10 +26161,10 @@ "guid": "8df03a82-2cd4-463c-abbc-8ac299ebc92a", "link": "https://learn.microsoft.com/azure/networking/disaster-recovery-dns-traffic-manager", "services": [ - "ASR", - "TrafficManager", "Monitor", - "DNS" + "DNS", + "ASR", + "TrafficManager" ], "severity": "Low", "subcategory": "DNS", @@ -26165,9 +26179,9 @@ "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", "service": "DNS", "services": [ - "ASR", + "DNS", "ACR", - "DNS" + "ASR" ], "severity": "Low", "subcategory": "DNS", @@ -26227,8 +26241,8 @@ "services": [ "ExpressRoute", "Cost", - "VPN", - "Backup" + "Backup", + "VPN" ], "severity": "Low", "subcategory": "ExpressRoute", @@ -26256,8 +26270,8 @@ "guid": "b2b38c88-6ba2-4c02-8499-114a5d3ce574", "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-standard-availability-zones", "services": [ - "VM", - "LoadBalancer" + "LoadBalancer", + "VM" ], "severity": "Low", "subcategory": "Load Balancers", @@ -26301,8 +26315,8 @@ "guid": "927139b8-2110-42db-b6ea-f11e6f843e53", "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable", "services": [ - "VPN", - "ACR" + "ACR", + "VPN" ], "severity": "Medium", "subcategory": "VPN Gateways", @@ -26329,8 +26343,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/considerations-recommendations", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Use one Entra tenant for managing your Azure resources, unless you have a clear regulatory or business requirement for multi-tenants.", @@ -26343,8 +26357,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Low", "text": "Use Multi-Tenant Automation approach to managing your Microsoft Entra ID Tenants.", @@ -26383,10 +26397,10 @@ "link": "https://learn.microsoft.com/azure/role-based-access-control/overview", "service": "Entra", "services": [ - "WAF", - "Subscriptions", "RBAC", - "ACR" + "ACR", + "Subscriptions", + "WAF" ], "severity": "High", "text": "Enforce a RBAC model that aligns to your cloud operating model. Scope and Assign across Management Groups and Subscriptions.", @@ -26412,8 +26426,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Only use groups to assign permissions. Add on-premises groups to the Entra ID only group if a group management system is already in place.", @@ -26426,9 +26440,9 @@ "link": "https://learn.microsoft.com/azure/active-directory/conditional-access/overview", "service": "Entra", "services": [ - "WAF", + "AzurePolicy", "Entra", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Enforce Microsoft Entra ID Conditional Access policies for any user with rights to Azure environments.", @@ -26454,8 +26468,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Enforce Microsoft Entra ID Privileged Identity Management (PIM) to establish zero standing access and least privilege.", @@ -26468,8 +26482,8 @@ "link": "https://learn.microsoft.com/entra/identity/domain-services/overview", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "If planning to switch from Active Directory Domain Services to Entra domain services, evaluate the compatibility of all workloads.", @@ -26482,9 +26496,9 @@ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor", "service": "Entra", "services": [ + "Monitor", "Entra", - "WAF", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Integrate Microsoft Entra ID logs with the platform-central Azure Monitor. Azure Monitor allows for a single source of truth around log and monitoring data in Azure, giving organizations a cloud native options to meet requirements around log collection and retention.", @@ -26511,9 +26525,9 @@ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", "service": "Entra", "services": [ - "WAF", + "Entra", "RBAC", - "Entra" + "WAF" ], "severity": "Medium", "text": "Do not use on-premises synced accounts for Microsoft Entra ID role assignments, unless you have a scenario that specifically requires it.", @@ -26526,8 +26540,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "When using Microsoft Entra ID Application Proxy to give remote users access to applications, manage it as a Platform resource as you can only have one instance per tenant.", @@ -26541,8 +26555,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/network-topology-and-connectivity", "service": "VNet", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "Medium", "text": "Use a hub-and-spoke network topology for network scenarios that require maximum flexibility.", @@ -26556,14 +26570,14 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/traditional-azure-networking-topology", "service": "VNet", "services": [ - "NVA", - "Firewall", - "WAF", - "ExpressRoute", - "DNS", "Entra", + "NVA", + "VPN", + "Firewall", "VNet", - "VPN" + "DNS", + "ExpressRoute", + "WAF" ], "severity": "High", "text": "Deploy shared networking services, including ExpressRoute gateways, VPN gateways, and Azure Firewall or partner NVAs in the central-hub virtual network. If necessary, also deploy DNS services.", @@ -26592,8 +26606,8 @@ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", "service": "NVA", "services": [ - "WAF", - "NVA" + "NVA", + "WAF" ], "severity": "Medium", "text": "When deploying partner networking technologies or NVAs, follow the partner vendor's guidance.", @@ -26606,10 +26620,10 @@ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager#to-enable-transit-routing-between-expressroute-and-azure-vpn", "service": "ExpressRoute", "services": [ - "WAF", + "ExpressRoute", "ARS", - "VPN", - "ExpressRoute" + "WAF", + "VPN" ], "severity": "Low", "text": "If you need transit between ExpressRoute and VPN gateways in hub and spoke scenarios, use Azure Route Server.", @@ -26624,9 +26638,9 @@ "link": "https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1", "service": "ARS", "services": [ - "WAF", "ARS", - "VNet" + "VNet", + "WAF" ], "severity": "Low", "text": "If using Route Server, use a /27 prefix for the Route Server subnet.", @@ -26640,9 +26654,9 @@ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq#can-i-create-a-peering-connection-to-a-vnet-in-a-different-region", "service": "VNet", "services": [ - "WAF", + "ACR", "VNet", - "ACR" + "WAF" ], "severity": "Medium", "text": "For network architectures with multiple hub-and-spoke topologies across Azure regions, use global virtual network peerings between the hub VNets to connect the regions to each other.", @@ -26656,8 +26670,8 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/network-insights-overview", "service": "VNet", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Use Azure Monitor for Networks to monitor the end-to-end state of the networks on Azure.", @@ -26672,9 +26686,9 @@ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", "service": "VNet", "services": [ - "WAF", "ExpressRoute", - "VNet" + "VNet", + "WAF" ], "severity": "Medium", "text": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000).", @@ -26689,8 +26703,8 @@ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits", "service": "VNet", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Limit the number of routes per route table to 400.", @@ -26705,8 +26719,8 @@ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering", "service": "VNet", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "text": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings.", @@ -26720,8 +26734,8 @@ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-macsec", "service": "ExpressRoute", "services": [ - "WAF", - "ExpressRoute" + "ExpressRoute", + "WAF" ], "severity": "Medium", "text": "When you're using ExpressRoute Direct, configure MACsec in order to encrypt traffic at the layer-two level between the organization's routers and MSEE. The diagram shows this encryption in flow.", @@ -26735,8 +26749,8 @@ "link": "https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-private-peering", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", + "WAF", "VPN" ], "severity": "Medium", @@ -26751,8 +26765,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", "service": "ExpressRoute", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "High", "text": "Ensure no overlapping IP address spaces across Azure regions and on-premises locations are used.", @@ -26782,8 +26796,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", "service": "VNet", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "text": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16).", @@ -26797,8 +26811,8 @@ "link": "https://learn.microsoft.com/azure/site-recovery/concepts-on-premises-to-azure-networking#retain-ip-addresses", "service": "VNet", "services": [ - "WAF", - "ASR" + "ASR", + "WAF" ], "severity": "High", "text": "Do not use overlapping IP address ranges for production and disaster recovery sites.", @@ -26812,8 +26826,8 @@ "link": "https://learn.microsoft.com/azure/dns/private-dns-getstarted-portal", "service": "DNS", "services": [ - "WAF", - "DNS" + "DNS", + "WAF" ], "severity": "Medium", "text": "For environments where name resolution in Azure is all that's required, use Azure Private DNS for resolution with a delegated zone for name resolution (such as 'azure.contoso.com').", @@ -26827,9 +26841,9 @@ "link": "https://learn.microsoft.com/azure/dns/dns-private-resolver-overview", "service": "DNS", "services": [ - "WAF", + "DNS", "ACR", - "DNS" + "WAF" ], "severity": "Medium", "text": "For environments where name resolution across Azure and on-premises is required and there is no existing enterprise DNS service like Active Directory, use Azure DNS Private Resolver to route DNS requests to Azure or to on-premises DNS servers.", @@ -26843,8 +26857,8 @@ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances", "service": "DNS", "services": [ - "WAF", - "DNS" + "DNS", + "WAF" ], "severity": "Low", "text": "Special workloads that require and deploy their own DNS (such as Red Hat OpenShift) should use their preferred DNS solution.", @@ -26858,10 +26872,10 @@ "link": "https://learn.microsoft.com/azure/dns/private-dns-autoregistration", "service": "DNS", "services": [ - "VM", - "WAF", + "DNS", "VNet", - "DNS" + "WAF", + "VM" ], "severity": "High", "text": "Enable auto-registration for Azure DNS to automatically manage the lifecycle of the DNS records for the virtual machines deployed within a virtual network.", @@ -26891,8 +26905,8 @@ "link": "https://learn.microsoft.com/azure/bastion/bastion-faq#subnet", "service": "Bastion", "services": [ - "WAF", "VNet", + "WAF", "Bastion" ], "severity": "Medium", @@ -26907,10 +26921,10 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", "service": "WAF", "services": [ - "WAF", + "AzurePolicy", "ACR", "FrontDoor", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", @@ -26924,10 +26938,10 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "WAF", "services": [ - "WAF", + "AzurePolicy", "AppGW", "FrontDoor", - "AzurePolicy" + "WAF" ], "severity": "Low", "text": "When using Azure Front Door and Azure Application Gateway to help protect HTTP/S apps, use WAF policies in Azure Front Door. Lock down Azure Application Gateway to receive traffic only from Azure Front Door.", @@ -26941,8 +26955,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "WAF", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "text": "When WAFs and other reverse proxies are required for inbound HTTP/S connections, deploy them within a landing-zone virtual network and together with the apps that they're protecting and exposing to the internet.", @@ -26957,8 +26971,8 @@ "service": "VNet", "services": [ "DDoS", - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "text": "Use Azure DDoS Network or IP Protection plans to help protect Public IP Addresses endpoints within the virtual networks.", @@ -27001,9 +27015,9 @@ "link": "https://github.com/Azure/Enterprise-Scale/wiki/ALZ-Policies#corp", "service": "Policy", "services": [ - "VM", + "AzurePolicy", "WAF", - "AzurePolicy" + "VM" ], "severity": "High", "text": "Ensure there is a policy assignment to deny Public IP addresses directly tied to Virtual Machines. Use exclusions if public IPs are needed on specific VMs.", @@ -27017,10 +27031,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", - "VPN", - "Backup" + "Backup", + "WAF", + "VPN" ], "severity": "Medium", "text": "Use ExpressRoute as the primary connection to Azure. Use VPNs as a source of backup connectivity.", @@ -27035,8 +27049,8 @@ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-routing", "service": "ExpressRoute", "services": [ - "WAF", - "ExpressRoute" + "ExpressRoute", + "WAF" ], "severity": "Medium", "text": "When you use multiple ExpressRoute circuits or multiple on-prem locations, use BGP attributes to optimize routing.", @@ -27051,8 +27065,8 @@ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", + "WAF", "VPN" ], "severity": "Medium", @@ -27068,9 +27082,9 @@ "link": "https://learn.microsoft.com/azure/expressroute/plan-manage-cost", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", - "Cost" + "Cost", + "WAF" ], "severity": "High", "text": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost.", @@ -27085,9 +27099,9 @@ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", - "Cost" + "Cost", + "WAF" ], "severity": "High", "text": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU.", @@ -27102,8 +27116,8 @@ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways", "service": "ExpressRoute", "services": [ - "WAF", - "ExpressRoute" + "ExpressRoute", + "WAF" ], "severity": "Medium", "text": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions.", @@ -27117,8 +27131,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure", "service": "ExpressRoute", "services": [ - "WAF", - "ExpressRoute" + "ExpressRoute", + "WAF" ], "severity": "Medium", "text": "For scenarios that require bandwidth higher than 10 Gbps or dedicated 10/100-Gbps ports, use ExpressRoute Direct.", @@ -27132,8 +27146,8 @@ "link": "https://learn.microsoft.com/azure/expressroute/about-fastpath", "service": "ExpressRoute", "services": [ - "WAF", - "ExpressRoute" + "ExpressRoute", + "WAF" ], "severity": "Medium", "text": "When low latency is required, or throughput from on-premises to Azure must be greater than 10 Gbps, enable FastPath to bypass the ExpressRoute gateway from the data path.", @@ -27178,9 +27192,9 @@ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-erdirect-about", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", - "Cost" + "Cost", + "WAF" ], "severity": "High", "text": "If using ExpressRoute Direct, consider using ExpressRoute Local circuits to the local Azure regions to save costs.", @@ -27194,8 +27208,8 @@ "link": "https://learn.microsoft.com/azure/architecture/framework/services/networking/expressroute/reliability", "service": "ExpressRoute", "services": [ - "WAF", - "ExpressRoute" + "ExpressRoute", + "WAF" ], "severity": "Medium", "text": "When traffic isolation or dedicated bandwidth is required, such as for separating production and nonproduction environments, use different ExpressRoute circuits. It will help you ensure isolated routing domains and alleviate noisy-neighbor risks.", @@ -27209,9 +27223,9 @@ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-monitoring-metrics-alerts", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Monitor ExpressRoute availability and utilization using built-in Express Route Insights.", @@ -27225,10 +27239,10 @@ "link": "https://learn.microsoft.com/azure/expressroute/how-to-configure-connection-monitor", "service": "ExpressRoute", "services": [ - "WAF", - "ACR", "Monitor", - "NetworkWatcher" + "NetworkWatcher", + "ACR", + "WAF" ], "severity": "Medium", "text": "Use Connection Monitor for connectivity monitoring across the network, especially between on-premises and Azure.", @@ -27243,8 +27257,8 @@ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution", "service": "ExpressRoute", "services": [ - "WAF", - "ExpressRoute" + "ExpressRoute", + "WAF" ], "severity": "Medium", "text": "Use ExpressRoute circuits from different peering locations for redundancy.", @@ -27258,8 +27272,8 @@ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-coexist-resource-manager", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", + "WAF", "VPN" ], "severity": "Medium", @@ -27275,9 +27289,9 @@ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub", "service": "ExpressRoute", "services": [ - "WAF", + "VNet", "Storage", - "VNet" + "WAF" ], "severity": "High", "text": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated.", @@ -27290,9 +27304,9 @@ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute#active-active-connections", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", - "ACR" + "ACR", + "WAF" ], "severity": "High", "text": "If using ExpressRoute, your on-premises routing should be dynamic: in the event of a connection failure it should converge to the remaining connection of the circuit. Load should be shared across both connections ideally as active/active, although active/passive is supported too.", @@ -27306,8 +27320,8 @@ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-high-availability-with-expressroute", "service": "ExpressRoute", "services": [ - "WAF", - "ExpressRoute" + "ExpressRoute", + "WAF" ], "severity": "Medium", "text": "Ensure the two physical links of your ExpressRoute circuit are connected to two distinct edge devices in your network.", @@ -27335,8 +27349,8 @@ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", "service": "ExpressRoute", "services": [ - "WAF", - "ExpressRoute" + "ExpressRoute", + "WAF" ], "severity": "High", "text": "Connect the ExpressRoute Gateway to two or more circuits from different peering locations for higher resiliency.", @@ -27350,10 +27364,10 @@ "link": "https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-setup-alerts-virtual-network-gateway-log", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", "VNet", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Configure diagnostic logs and alerts for ExpressRoute virtual network gateway.", @@ -27367,9 +27381,9 @@ "link": "https://learn.microsoft.com/azure/expressroute/virtual-network-connectivity-guidance", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", - "VNet" + "VNet", + "WAF" ], "severity": "Medium", "text": "Do not use ExpressRoute circuits for VNet-to-VNet communication.", @@ -27382,8 +27396,8 @@ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about", "service": "N/A", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "Low", "text": "Do not send Azure traffic to hybrid locations for inspection. Instead, follow the principle 'traffic in Azure stays in Azure' so that communication across resources in Azure occurs via the Microsoft backbone network.", @@ -27411,11 +27425,11 @@ "link": "https://learn.microsoft.com/azure/firewall-manager/policy-overview", "service": "Firewall", "services": [ - "Firewall", - "WAF", - "RBAC", "ACR", - "AzurePolicy" + "Firewall", + "RBAC", + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Create a global Azure Firewall policy to govern security posture across the global network environment and assign it to all Azure Firewall instances. Allow for granular policies to meet requirements of specific regions by delegating incremental firewall policies to local security teams via Azure role-based access control.", @@ -27446,8 +27460,8 @@ "service": "Firewall", "services": [ "Firewall", - "WAF", - "DNS" + "DNS", + "WAF" ], "severity": "High", "text": "Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols.", @@ -27511,10 +27525,10 @@ "services": [ "NVA", "Firewall", - "WAF", - "VWAN", + "VNet", "Storage", - "VNet" + "VWAN", + "WAF" ], "severity": "High", "text": "For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance.", @@ -27528,8 +27542,8 @@ "service": "Firewall", "services": [ "Firewall", - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Add diagnostic settings to save logs, using the Resource Specific destination table, for all Azure Firewall deployments.", @@ -27544,8 +27558,8 @@ "service": "Firewall", "services": [ "Firewall", - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Important", "text": "Migrate from Azure Firewall Classic rules (if exist) to Firewall Policy.", @@ -27561,8 +27575,8 @@ "service": "Firewall", "services": [ "Firewall", - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "text": "Use a /26 prefix for your Azure Firewall subnets.", @@ -27576,8 +27590,8 @@ "link": "https://learn.microsoft.com/azure/firewall-manager/rule-hierarchy", "service": "Firewall", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Arrange rules within the firewall policy into Rule Collection Groups and Rule Collections and based on their frequency of use.", @@ -27591,8 +27605,8 @@ "link": "https://learn.microsoft.com/azure/firewall/ip-groups", "service": "Firewall", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Use IP Groups or IP prefixes to reduce number of IP table rules.", @@ -27619,8 +27633,8 @@ "link": "https://learn.microsoft.com/azure/firewall/integrate-with-nat-gateway", "service": "Firewall", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Prevent SNAT Port exhaustion by monitoring SNAT port usage, evaluating NAT Gateway settings, and ensuring seamless failover. If the port count approaches the limit, it’s a sign that SNAT exhaustion might be imminent.", @@ -27648,8 +27662,8 @@ "link": "https://learn.microsoft.com/azure/firewall/premium-features#web-categories", "service": "Firewall", "services": [ - "WAF", - "ServiceBus" + "ServiceBus", + "WAF" ], "severity": "Low", "text": "Use web categories to allow or deny outbound access to specific topics.", @@ -27677,8 +27691,8 @@ "service": "Firewall", "services": [ "Firewall", - "WAF", - "DNS" + "DNS", + "WAF" ], "severity": "Medium", "text": "Enable Azure Firewall DNS proxy configuration.", @@ -27693,8 +27707,8 @@ "service": "Firewall", "services": [ "Firewall", - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "High", "text": "Integrate Azure Firewall with Azure Monitor and enable diagnostic logging to store and analyze firewall logs.", @@ -27708,8 +27722,8 @@ "link": "https://learn.microsoft.com/azure/well-architected/service-guides/azure-firewall", "service": "Firewall", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Low", "text": "Implement backups for your firewall rules", @@ -27723,8 +27737,8 @@ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", "service": "App Gateway", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "text": "Do not disrupt control-plane communication for Azure PaaS services injected into a virtual networks, such as with a 0.0.0.0/0 route or an NSG rule that blocks control plane traffic.", @@ -27738,9 +27752,9 @@ "link": "https://learn.microsoft.com/azure/private-link/private-endpoint-overview", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", - "PrivateLink" + "PrivateLink", + "WAF" ], "severity": "Medium", "text": "Access Azure PaaS services from on-premises via private endpoints and ExpressRoute private peering. This method avoids transiting over the public internet.", @@ -27755,8 +27769,8 @@ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview", "service": "VNet", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "text": "Don't enable virtual network service endpoints by default on all subnets.", @@ -27772,9 +27786,9 @@ "services": [ "NVA", "Firewall", - "WAF", "DNS", - "PrivateLink" + "PrivateLink", + "WAF" ], "severity": "Medium", "text": "Filter egress traffic to Azure PaaS services using FQDNs instead of IP addresses in Azure Firewall or an NVA to prevent data exfiltration. If using Private Link you can block all FQDNs, otherwise allow only the required PaaS services.", @@ -27789,9 +27803,9 @@ "link": "https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway", "service": "ExpressRoute", "services": [ - "WAF", "ExpressRoute", "VNet", + "WAF", "VPN" ], "severity": "High", @@ -27806,8 +27820,8 @@ "link": "https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags", "service": "NSG", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "text": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity.", @@ -27820,9 +27834,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-landing-zone-network-segmentation", "service": "NSG", "services": [ - "WAF", + "ACR", "VNet", - "ACR" + "WAF" ], "severity": "Medium", "text": "Use NSGs to help protect traffic across subnets, as well as east/west traffic across the platform (traffic between landing zones).", @@ -27836,10 +27850,10 @@ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", "service": "NSG", "services": [ - "WAF", + "Entra", "NVA", "VNet", - "Entra" + "WAF" ], "severity": "Medium", "text": "Use NSGs and application security groups to micro-segment traffic within the landing zone and avoid using a central NVA to filter traffic flows.", @@ -27853,9 +27867,9 @@ "link": "https://learn.microsoft.com/azure/network-watcher/vnet-flow-logs-overview", "service": "NSG", "services": [ - "WAF", + "NetworkWatcher", "VNet", - "NetworkWatcher" + "WAF" ], "severity": "Medium", "text": "Enable VNet Flow Logs and feed them into Traffic Analytics to gain insights into internal and external traffic flows.", @@ -27870,8 +27884,8 @@ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", "service": "NSG", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "Medium", "text": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules.", @@ -27885,8 +27899,8 @@ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-any-to-any", "service": "VWAN", "services": [ - "WAF", - "VWAN" + "VWAN", + "WAF" ], "severity": "Medium", "text": "Use Virtual WAN if your scenario is explicitly described in the list of Virtual WAN routing designs.", @@ -27900,9 +27914,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/virtual-wan-network-topology#virtual-wan-network-design-recommendationst", "service": "VWAN", "services": [ - "WAF", + "VWAN", "ACR", - "VWAN" + "WAF" ], "severity": "Medium", "text": "Use a Virtual WAN hub per Azure region to connect multiple landing zones together across Azure regions via a common global Azure Virtual WAN.", @@ -27932,8 +27946,8 @@ "link": "https://learn.microsoft.com/azure/virtual-wan/migrate-from-hub-spoke-topology", "service": "VWAN", "services": [ - "WAF", - "VWAN" + "VWAN", + "WAF" ], "severity": "Medium", "text": "Ensure that your virtual WAN network architecture aligns to an identified architecture scenario.", @@ -27947,9 +27961,9 @@ "link": "https://learn.microsoft.com/azure/virtual-wan/azure-monitor-insights", "service": "VWAN", "services": [ - "WAF", "Monitor", - "VWAN" + "VWAN", + "WAF" ], "severity": "Medium", "text": "Use Azure Monitor Insights for Virtual WAN to monitor the end-to-end topology of the Virtual WAN, status, and key metrics.", @@ -27963,8 +27977,8 @@ "link": "https://learn.microsoft.com/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan", "service": "VWAN", "services": [ - "WAF", - "VWAN" + "VWAN", + "WAF" ], "severity": "Medium", "text": "Do not disable branch-to-branch traffic in Virtual WAN, unless these flows should be explicitly blocked.", @@ -27978,8 +27992,8 @@ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing-preference", "service": "VWAN", "services": [ - "WAF", "ExpressRoute", + "WAF", "VPN" ], "severity": "Medium", @@ -27994,8 +28008,8 @@ "link": "https://learn.microsoft.com/azure/virtual-wan/about-virtual-hub-routing#labels", "service": "VWAN", "services": [ - "WAF", - "VWAN" + "VWAN", + "WAF" ], "severity": "Medium", "text": "Configure label-based propagation in Virtual WAN, otherwise connectivity between virtual hubs will be impaired.", @@ -28023,8 +28037,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "service": "Policy", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "High", "text": "Leverage Azure Policy strategically, define controls for your environment, using Policy Initiatives to group related policies.", @@ -28037,9 +28051,9 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "service": "Policy", "services": [ - "WAF", + "AzurePolicy", "RBAC", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Map regulatory and compliance requirements to Azure Policy definitions and Azure role assignments.", @@ -28052,9 +28066,9 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "service": "Policy", "services": [ - "WAF", + "AzurePolicy", "Subscriptions", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Establish Azure Policy definitions at the intermediate root management group so that they can be assigned at inherited scopes.", @@ -28067,8 +28081,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "service": "Policy", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "High", "text": "Manage policy assignments at the highest appropriate level with exclusions at bottom levels, if required.", @@ -28081,9 +28095,9 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/mcsb-asset-management#am-2-use-only-approved-services", "service": "Policy", "services": [ - "WAF", + "AzurePolicy", "Subscriptions", - "AzurePolicy" + "WAF" ], "severity": "Low", "text": "Use Azure Policy to control which services users can provision at the subscription/management group level.", @@ -28096,8 +28110,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "service": "Policy", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "High", "text": "Use built-in policies where possible to minimize operational overhead.", @@ -28111,11 +28125,11 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy", "service": "Policy", "services": [ - "WAF", + "Entra", "Subscriptions", "RBAC", - "Entra", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Assign the built-in Resource Policy Contributor role at a particular scope to enable application-level governance.", @@ -28128,9 +28142,9 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "service": "Policy", "services": [ - "WAF", + "AzurePolicy", "Subscriptions", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Limit the number of Azure Policy assignments made at the root management group scope to avoid managing through exclusions at inherited scopes.", @@ -28143,8 +28157,8 @@ "link": "https://learn.microsoft.com/industry/release-plan/2023wave2/cloud-sovereignty/enable-data-sovereignty-policy-baseline", "service": "Policy", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "If any data sovereignty requirements exist, Azure Policies should be deployed to enforce them.", @@ -28158,9 +28172,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/sovereign-landing-zone", "service": "Policy", "services": [ - "WAF", + "AzurePolicy", "Subscriptions", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "For Sovereign Landing Zone, deploy sovereignty policy baseline and assign at correct management group level.", @@ -28173,8 +28187,8 @@ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline", "service": "Policy", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "For Sovereign Landing Zone, document Sovereign Control objectives to policy mapping.", @@ -28187,8 +28201,8 @@ "link": "https://learn.microsoft.com/industry/sovereignty/policy-portfolio-baseline#sovereignty-baseline-policy-initiatives", "service": "Policy", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "For Sovereign Landing Zone, ensure process is in place for management of 'Sovereign Control objectives to policy mapping'.", @@ -28201,11 +28215,11 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "service": "Monitor", "services": [ - "WAF", - "RBAC", - "Monitor", "Entra", - "AzurePolicy" + "Monitor", + "RBAC", + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Use a single monitor logs workspace to manage platforms centrally except where Azure role-based access control (Azure RBAC), data sovereignty requirements, or data retention policies mandate separate workspaces.", @@ -28219,10 +28233,10 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive?tabs=portal-1%2Cportal-2#how-retention-and-archiving-work", "service": "Monitor", "services": [ - "WAF", + "AzurePolicy", "ARS", "Storage", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Export logs to Azure Storage if your log retention requirements exceed twelve years. Use immutable storage with a write-once, read-many policy to make data non-erasable and non-modifiable for a user-specified interval.", @@ -28236,10 +28250,10 @@ "link": "https://learn.microsoft.com/azure/governance/machine-configuration/overview", "service": "VM", "services": [ - "VM", - "WAF", "Monitor", - "AzurePolicy" + "AzurePolicy", + "WAF", + "VM" ], "severity": "Medium", "text": "Monitor OS level virtual machine (VM) configuration drift using Azure Policy. Enabling Azure Automanage Machine Configuration audit capabilities through policy helps application team workloads to immediately consume feature capabilities with little effort.", @@ -28253,8 +28267,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs in Azure.", @@ -28268,8 +28282,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#update-management-considerations ", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "Use Azure Update Manager as a patching mechanism for Windows and Linux VMs outside of Azure using Azure Arc.", @@ -28283,9 +28297,9 @@ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", "service": "Network Watcher", "services": [ - "WAF", "Monitor", - "NetworkWatcher" + "NetworkWatcher", + "WAF" ], "severity": "Medium", "text": "Use Network Watcher to proactively monitor traffic flows.", @@ -28299,8 +28313,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", "service": "Monitor", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Use Azure Monitor Logs for insights and reporting.", @@ -28314,8 +28328,8 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/alerts/alerts-overview", "service": "Monitor", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Use Azure Monitor alerts for the generation of operational alerts.", @@ -28329,8 +28343,8 @@ "link": "https://learn.microsoft.com/azure/automation/how-to/region-mappings", "service": "Monitor", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "When using Change and Inventory Tracking via Azure Automation Accounts, ensure that you have selected supported regions for linking your Log Analytics workspace and automation accounts together.", @@ -28344,8 +28358,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", "service": "Backup", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Low", "text": "When using Azure Backup, use the correct backup types (GRS, ZRS & LRS) for your backup, as the default setting is GRS.", @@ -28359,9 +28373,9 @@ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/guest-configuration", "service": "VM", "services": [ - "VM", + "AzurePolicy", "WAF", - "AzurePolicy" + "VM" ], "severity": "Medium", "text": "Use Azure guest policies to automatically deploy software configurations through VM extensions and enforce a compliant baseline VM configuration.", @@ -28375,10 +28389,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", "service": "VM", "services": [ - "VM", - "WAF", "Monitor", - "AzurePolicy" + "AzurePolicy", + "WAF", + "VM" ], "severity": "Medium", "text": "Monitor VM security configuration drift via Azure Policy.", @@ -28393,8 +28407,8 @@ "service": "VM", "services": [ "VM", - "WAF", "ASR", + "WAF", "ACR" ], "severity": "Medium", @@ -28409,8 +28423,8 @@ "link": "https://learn.microsoft.com/azure/backup/backup-center-overview", "service": "Backup", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Use Azure-native backup capabilities, or an Azure-compatible, 3rd-party backup solution.", @@ -28424,9 +28438,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", "service": "WAF", "services": [ - "WAF", + "AppGW", "FrontDoor", - "AppGW" + "WAF" ], "severity": "High", "text": "Add diagnostic settings to save WAF logs from application delivery services like Azure Front Door and Azure Application Gateway. Regularly review the logs to check for attacks and for false positive detections.", @@ -28440,10 +28454,10 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", "service": "WAF", "services": [ - "WAF", "Sentinel", + "AppGW", "FrontDoor", - "AppGW" + "WAF" ], "severity": "Medium", "text": "Send WAF logs from your application delivery services like Azure Front Door and Azure Application Gateway to Microsoft Sentinel. Detect attacks and integrate WAF telemetry into your overall Azure environment.", @@ -28488,9 +28502,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Key Vault", "services": [ + "AzurePolicy", "WAF", - "AKV", - "AzurePolicy" + "AKV" ], "severity": "Medium", "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", @@ -28504,10 +28518,10 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Key Vault", "services": [ - "WAF", - "AKV", + "Entra", "RBAC", - "Entra" + "WAF", + "AKV" ], "severity": "Medium", "text": "Follow a least privilege model by limiting authorization to permanently delete keys, secrets, and certificates to specialized custom Microsoft Entra ID roles.", @@ -28549,10 +28563,10 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Key Vault", "services": [ - "WAF", - "AKV", + "PrivateLink", "VNet", - "PrivateLink" + "WAF", + "AKV" ], "severity": "Medium", "text": "Enable firewall and virtual network service endpoint or private endpoint on the vault to control access to the key vault.", @@ -28566,10 +28580,10 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/monitor-key-vault", "service": "Key Vault", "services": [ + "Monitor", "Entra", "WAF", - "AKV", - "Monitor" + "AKV" ], "severity": "Medium", "text": "Use the platform-central Azure Monitor Log Analytics workspace to audit key, certificate, and secret usage within each instance of Key Vault.", @@ -28583,9 +28597,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Key Vault", "services": [ + "AzurePolicy", "WAF", - "AKV", - "AzurePolicy" + "AKV" ], "severity": "Medium", "text": "Delegate Key Vault instantiation and privileged access and use Azure Policy to enforce a consistent compliant configuration.", @@ -28614,9 +28628,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Key Vault", "services": [ - "WAF", "AKV", "ASR", + "WAF", "ACR" ], "severity": "Medium", @@ -28645,8 +28659,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/reports-monitoring/overview-reports", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Use Microsoft Entra ID reporting capabilities to generate access control audit reports.", @@ -28659,8 +28673,8 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management", "service": "Defender", "services": [ - "WAF", "Subscriptions", + "WAF", "Defender" ], "severity": "High", @@ -28674,8 +28688,8 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/plan-defender-for-servers-select-plan", "service": "Defender", "services": [ - "WAF", "Subscriptions", + "WAF", "Defender" ], "severity": "High", @@ -28689,8 +28703,8 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/connect-azure-subscription", "service": "Defender", "services": [ - "WAF", "Subscriptions", + "WAF", "Defender" ], "severity": "High", @@ -28719,9 +28733,9 @@ "link": "https://learn.microsoft.com/azure/security-center/", "service": "VM", "services": [ + "Monitor", "WAF", - "Defender", - "Monitor" + "Defender" ], "severity": "Medium", "text": "Monitor base operating system patching drift via Azure Monitor Logs and Defender for Cloud.", @@ -28735,23 +28749,38 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "service": "Monitor", "services": [ + "Monitor", "Entra", - "WAF", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Connect default resource configurations to a centralized Azure Monitor Log Analytics workspace.", "training": "https://learn.microsoft.com/training/modules/analyze-infrastructure-with-azure-monitor-logs/", "waf": "Security" }, + { + "checklist": "WAF checklist", + "graph": "resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)", + "guid": "a56888b2-7e83-4404-bd31-b886528502d1", + "link": "https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs", + "service": "Entra", + "services": [ + "Entra", + "ACR", + "WAF" + ], + "severity": "High", + "text": "Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management)", + "waf": "Security" + }, { "checklist": "WAF checklist", "guid": "1761e147-f65e-4d09-bbc2-f464f23e2eba", "link": "https://learn.microsoft.com/industry/sovereignty/transparency-logs", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "For Sovereign Landing Zone, enable transparancy logs on the Entra ID tenant.", @@ -28763,8 +28792,8 @@ "link": "https://learn.microsoft.com/azure/security/fundamentals/customer-lockbox-overview", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "For Sovereign Landing Zone, enable customer Lockbox on the Entra ID tenant.", @@ -28777,8 +28806,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", "service": "Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "Enable secure transfer to storage accounts.", @@ -28792,8 +28821,8 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/data-protection-overview#recommendations-for-basic-data-protection", "service": "Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "Enable container soft delete for the storage account to recover a deleted container and its contents.", @@ -28822,8 +28851,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies", "service": "APIM", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Implement an error handling policy at the global level", @@ -28836,8 +28865,8 @@ "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order", "service": "APIM", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Ensure all APIs policies include a element.", @@ -28850,9 +28879,9 @@ "link": "https://learn.microsoft.com/azure/api-management/policy-fragments", "service": "APIM", "services": [ - "WAF", + "AzurePolicy", "ACR", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Use Policy Fragments to avoid repeating same policies definitions across multiple APIs", @@ -28878,8 +28907,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs", "service": "APIM", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "High", "text": "Enable Diagnostics Settings to export logs to Azure Monitor", @@ -28905,8 +28934,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor", "service": "APIM", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "High", "text": "Configure alerts on the most critical metrics", @@ -28933,8 +28962,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access", "service": "APIM", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "High", "text": "Protect incoming requests to APIs (data plane) with Azure AD", @@ -28947,8 +28976,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad", "service": "APIM", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Use Microsoft Entra ID to authenticate users in the Developer Portal", @@ -28987,8 +29016,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal", "service": "APIM", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Use Named Values to store common values that can be used in policies", @@ -29001,8 +29030,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region", "service": "APIM", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "Medium", "text": "For DR, leverage the premium tier with deployments scaled across two or more regions for 99.99% SLA", @@ -29028,8 +29057,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability", "service": "APIM", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "High", "text": "Ensure there is an automated backup routine", @@ -29042,8 +29071,8 @@ "link": "https://learn.microsoft.com/azure/api-management/retry-policy", "service": "APIM", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Use Policies to add a fail-over backend URL and caching to reduce failing calls.", @@ -29057,8 +29086,8 @@ "service": "APIM", "services": [ "EventHubs", - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Low", "text": "If you need to log at high performance levels, consider Event Hubs policy", @@ -29071,8 +29100,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling", "service": "APIM", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Apply throttling policies to control the number of requests per second", @@ -29125,8 +29154,8 @@ "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services", "service": "APIM", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "In multi-region model, use Policies to route the requests to regional backends based on availability or latency.", @@ -29139,9 +29168,9 @@ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits", "service": "APIM", "services": [ - "WAF", "APIM", - "Entra" + "Entra", + "WAF" ], "severity": "High", "text": "Be aware of APIM's limits", @@ -29167,10 +29196,10 @@ "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management", "service": "APIM", "services": [ - "WAF", "APIM", + "Entra", "FrontDoor", - "Entra" + "WAF" ], "severity": "Medium", "text": "Use Azure Front Door in front of APIM for multi-region deployment", @@ -29183,8 +29212,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration", "service": "APIM", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "Medium", "text": "Deploy the service within a Virtual Network (VNet)", @@ -29197,11 +29226,11 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support", "service": "APIM", "services": [ - "APIM", - "WAF", - "Monitor", "Entra", - "VNet" + "VNet", + "Monitor", + "APIM", + "WAF" ], "severity": "Medium", "text": "Deploy network security groups (NSG) to your subnets to restrict or monitor traffic to/from APIM.", @@ -29214,11 +29243,11 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link", "service": "APIM", "services": [ - "APIM", - "WAF", "Entra", "VNet", - "PrivateLink" + "PrivateLink", + "APIM", + "WAF" ], "severity": "Medium", "text": "Deploy Private Endpoints to filter incoming traffic when APIM is not deployed to a VNet.", @@ -29257,9 +29286,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations", "service": "APIM", "services": [ - "WAF", "APIM", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Configure APIM via Infrastructure-as-code. Review DevOps best practices from the Cloud Adaption Framework APIM Landing Zone Accelerator", @@ -29272,9 +29301,9 @@ "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial", "service": "APIM", "services": [ - "WAF", "APIM", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Promote usage of Visual Studio Code APIM extension for faster API development", @@ -29379,8 +29408,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities", "service": "APIM", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Use managed identities to authenticate to other Azure resources whenever possible", @@ -29393,10 +29422,10 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall", "service": "APIM", "services": [ - "WAF", "APIM", "Entra", - "AppGW" + "AppGW", + "WAF" ], "severity": "High", "text": "Use web application firewall (WAF) by deploying Application Gateway in front of APIM", @@ -29422,9 +29451,9 @@ "link": "https://learn.microsoft.com/azure/architecture/web-apps/spring-apps/architectures/spring-apps-multi-region", "service": "Spring Apps", "services": [ - "WAF", + "FrontDoor", "TrafficManager", - "FrontDoor" + "WAF" ], "severity": "Medium", "text": "Azure Spring Apps instances could be created in multiple regions for your applications and traffic could be routed by Traffic Manager/Front Door.", @@ -29437,8 +29466,8 @@ "link": "https://learn.microsoft.com/azure/reliability/reliability-spring-apps", "service": "Spring Apps", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "Medium", "text": "In supported region, Azure Spring Apps can be deployed as zone redundant, which means that instances are automatically distributed across availability zones. This feature is only available in Standard and Enterprise tiers.", @@ -29464,8 +29493,8 @@ "link": "https://learn.microsoft.com/azure/spring-apps/diagnostic-services", "service": "Spring Apps", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Monitor Azure Spring Apps with logs, metrics and tracing. Integrate ASA with application insights and track failures and create workbooks.", @@ -29516,9 +29545,9 @@ "guid": "32e42e36-11c8-418b-8a0b-c510e43a18a9", "service": "AVS", "services": [ - "WAF", + "Entra", "Subscriptions", - "Entra" + "WAF" ], "severity": "High", "text": "Ensure ADDS domain controller(s) are deployed in the identity subscription in native Azure", @@ -29530,8 +29559,8 @@ "guid": "75089c20-990d-4927-b105-885576f76fc2", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "Medium", "text": "Ensure ADDS sites and services is configured to keep authentication requests from Azure-based resources (including Azure VMware Solution) local to Azure", @@ -29579,8 +29608,8 @@ "guid": "53d88e89-d17b-473b-82a5-a67e7a9ed5b3", "service": "AVS", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "High", "text": "Ensure that NSX-Manager is integrated with an external Identity provider (LDAPS)", @@ -29592,9 +29621,9 @@ "guid": "ae0e37ce-e297-411b-b352-caaab79b198d", "service": "AVS", "services": [ - "WAF", "RBAC", - "AVS" + "AVS", + "WAF" ], "severity": "Medium", "text": "Has an RBAC model been created for use within VMware vSphere", @@ -29606,8 +29635,8 @@ "guid": "ab81932c-9fc9-4d1b-a780-36f5e6bfbb9e", "service": "AVS", "services": [ - "WAF", - "RBAC" + "RBAC", + "WAF" ], "severity": "Medium", "text": "RBAC permissions should be granted on ADDS groups and not on specific users", @@ -29619,9 +29648,9 @@ "guid": "d503547c-c447-4e82-9128-a71f0f1cac6d", "service": "AVS", "services": [ - "WAF", "RBAC", - "AVS" + "AVS", + "WAF" ], "severity": "High", "text": "RBAC permissions on the Azure VMware Solution resource in Azure are 'locked down' to a limited set of owners only", @@ -29633,8 +29662,8 @@ "guid": "fd9f0df4-68dc-4976-b9a9-e6a79f7682c5", "service": "AVS", "services": [ - "WAF", - "RBAC" + "RBAC", + "WAF" ], "severity": "High", "text": "Ensure all custom roles are scoped with CloudAdmin permitted authorizations", @@ -29647,8 +29676,8 @@ "link": "https://github.com/Azure/AzureCAT-AVS/tree/main/networking", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "High", "text": "Is the correct Azure VMware Solution connectivity model selected for the customer use case at hand", @@ -29660,11 +29689,11 @@ "guid": "eb710a37-cbc1-4055-8dd5-a936a8bb7cf5", "service": "AVS", "services": [ + "VPN", "NetworkWatcher", - "WAF", - "ExpressRoute", "Monitor", - "VPN" + "ExpressRoute", + "WAF" ], "severity": "High", "text": "Ensure ExpressRoute or VPN connections from on-premises to Azure are monitored using 'connection monitor'", @@ -29677,11 +29706,11 @@ "service": "AVS", "services": [ "NetworkWatcher", - "WAF", - "ExpressRoute", "Monitor", + "AVS", "VM", - "AVS" + "ExpressRoute", + "WAF" ], "severity": "Medium", "text": "Ensure a connection monitor is created from an Azure native resource to an Azure VMware Solution virtual machine to monitor the Azure VMware Solution back-end ExpressRoute connection", @@ -29694,10 +29723,10 @@ "service": "AVS", "services": [ "NetworkWatcher", - "WAF", "Monitor", + "AVS", "VM", - "AVS" + "WAF" ], "severity": "Medium", "text": "Ensure a connection monitor is created from an on-premises resource to an Azure VMware Solution virtual machine to monitor end-2-end connectivity", @@ -29709,8 +29738,8 @@ "guid": "563b4dc7-4a74-48b6-933a-d1a0916a6649", "service": "AVS", "services": [ - "WAF", - "ARS" + "ARS", + "WAF" ], "severity": "High", "text": "When route server is used, ensure no more then 1000 routes are propagated from route server to ExR gateway to on-premises (ARS limit).", @@ -29722,10 +29751,10 @@ "guid": "6128a71f-0f1c-4ac6-b9ef-1d5e832e42e3", "service": "AVS", "services": [ - "WAF", "RBAC", "Entra", - "AVS" + "AVS", + "WAF" ], "severity": "High", "text": "Is Privileged Identity Management implemented for roles managing the Azure VMware Solution resource in the Azure Portal (no standing permissions allowed)", @@ -29737,10 +29766,10 @@ "guid": "c4e2436b-b336-4d71-9f17-960eee0b9b5c", "service": "AVS", "services": [ - "WAF", "RBAC", "Entra", - "AVS" + "AVS", + "WAF" ], "severity": "High", "text": "Privileged Identity Management audit reporting should be implemented for the Azure VMware Solution PIM roles", @@ -29752,9 +29781,9 @@ "guid": "78c447a8-26b2-4863-af0f-1cac599ef1d5", "service": "AVS", "services": [ - "WAF", "Entra", - "AVS" + "AVS", + "WAF" ], "severity": "Medium", "text": "If using Privileged Identity Management is being used, ensure that a valid Entra ID enabled account is created with a valid SMTP record for Azure VMware Solution Automatic Host replacement notifications. (standing permissions required)", @@ -29778,8 +29807,8 @@ "guid": "d329f798-bc17-48bd-a5a0-6ca7144351d1", "service": "AVS", "services": [ - "WAF", - "RBAC" + "RBAC", + "WAF" ], "severity": "Medium", "text": "Create custom RBAC roles in vCenter to implement a least-privilege model inside vCenter", @@ -29803,10 +29832,10 @@ "guid": "586cb291-ec16-4a1d-876e-f9f141acdce5", "service": "AVS", "services": [ - "VM", - "WAF", "Entra", - "AVS" + "AVS", + "WAF", + "VM" ], "severity": "High", "text": "Use a centralized identity provider to be used for workloads (VM's) running on Azure VMware Solution", @@ -29831,9 +29860,9 @@ "service": "AVS", "services": [ "Firewall", - "WAF", "AppGW", - "AVS" + "AVS", + "WAF" ], "severity": "High", "text": "Workloads on Azure VMware Solution are not directly exposed to the internet. Traffic is filtered and inspected by Azure Application Gateway, Azure Firewall or 3rd party solutions", @@ -29845,8 +29874,8 @@ "guid": "eace4cb1-deb4-4c65-8c3f-c14eeab36938", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "High", "text": "Auditing and logging is implemented for inbound internet requests to Azure VMware Solution and Azure VMware Solution based workloads", @@ -29858,9 +29887,9 @@ "guid": "29e3eec2-1836-487a-8077-a2b5945bda43", "service": "AVS", "services": [ - "WAF", "Monitor", - "AVS" + "AVS", + "WAF" ], "severity": "Medium", "text": "Session monitoring is implemented for outbound internet connections from Azure VMware Solution or Azure VMware Solution based workloads to identify suspicious/malicious activity", @@ -29872,11 +29901,11 @@ "guid": "334fdf91-c234-4182-a652-75269440b4be", "service": "AVS", "services": [ - "DDoS", "WAF", - "ExpressRoute", + "VPN", "VNet", - "VPN" + "ExpressRoute", + "DDoS" ], "severity": "Medium", "text": "Is DDoS standard protection enabled on ExR/VPN Gateway subnet in Azure", @@ -29888,8 +29917,8 @@ "guid": "3d3e0843-276d-44bd-a015-bcf219e4a1eb", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "Medium", "text": "Use a dedicated privileged access workstation (PAW) to manage Azure VMware Solution, vCenter, NSX manager and HCX manager", @@ -29901,9 +29930,9 @@ "guid": "9ccbd869-266a-4cca-874f-aa19bf39d95d", "service": "AVS", "services": [ + "AVS", "WAF", - "Defender", - "AVS" + "Defender" ], "severity": "Medium", "text": "Enable Advanced Threat Detection (Microsoft Defender for Cloud aka ASC) for workloads running on Azure VMware Solution", @@ -29915,9 +29944,9 @@ "guid": "44c7c891-9ca1-4f6d-9315-ae524ba34d45", "service": "AVS", "services": [ - "WAF", + "AVS", "Arc", - "AVS" + "WAF" ], "severity": "Medium", "text": "Use Azure ARC for Servers to properly govern workloads running on Azure VMware Solution using Azure native technologies (Azure ARC for Azure VMware Solution is not yet available)", @@ -29930,8 +29959,8 @@ "service": "AVS", "services": [ "SQL", - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "Low", "text": "Ensure workloads on Azure VMware Solution use sufficient data encryption during run-time (like in-guest disk encryption and SQL TDE). (vSAN encryption at rest is default)", @@ -29956,8 +29985,8 @@ "guid": "5ac94222-3e13-4810-9230-81a941741583", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "Medium", "text": "Consider using extended security update support for workloads running on Azure VMware Solution (Azure VMware Solution is eligible for ESU)", @@ -29981,9 +30010,9 @@ "guid": "d88408f3-7273-44c8-96ba-280214590146", "service": "AVS", "services": [ - "WAF", + "AzurePolicy", "Storage", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Ensure that the Failure-to-tolerate policy is in place to meet your vSAN storage needs", @@ -29995,8 +30024,8 @@ "guid": "d89f2e87-7784-424d-9167-85c6fa95b96a", "service": "AVS", "services": [ - "WAF", - "ASR" + "ASR", + "WAF" ], "severity": "High", "text": "Ensure that you have requested enough quota, ensuring you have considered growth and Disaster Recovery requirement", @@ -30020,8 +30049,8 @@ "guid": "bf39d95d-44c7-4c89-89ca-1f6d5315ae52", "service": "AVS", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Ensure that you have a policy around ESXi host density and efficiency, keeping in mind the lead time for requesting new nodes", @@ -30033,9 +30062,9 @@ "guid": "4ba34d45-85e1-4213-abd7-bb012f7b95ef", "service": "AVS", "services": [ - "WAF", "Cost", - "AVS" + "AVS", + "WAF" ], "severity": "Medium", "text": "Ensure a good cost management process is in place for Azure VMware Solution - Azure Cost Management can be used", @@ -30047,9 +30076,9 @@ "guid": "6e043e2a-a359-4271-ae6e-205172676ae4", "service": "AVS", "services": [ - "WAF", "Cost", - "AVS" + "AVS", + "WAF" ], "severity": "Low", "text": "Are Azure reserved instances used to optimize cost for using Azure VMware Solution", @@ -30086,9 +30115,9 @@ "service": "AVS", "services": [ "VM", + "AVS", "WAF", - "Defender", - "AVS" + "Defender" ], "severity": "Medium", "text": "Enable Microsoft Defender for Cloud for Azure VMware Solution guest VM workloads", @@ -30100,10 +30129,10 @@ "guid": "41741583-3ef7-4ad7-a6d3-733165c7acbe", "service": "AVS", "services": [ - "VM", - "WAF", + "AVS", "Arc", - "AVS" + "WAF", + "VM" ], "severity": "Medium", "text": "Use Azure Arc enabled servers to manage your Azure VMware Solution guest VM workloads", @@ -30115,8 +30144,8 @@ "guid": "88f03a4d-2cd4-463c-abbc-868295abc91a", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "High", "text": "Enable Diagnostic and metric logging on Azure VMware Solution", @@ -30128,10 +30157,10 @@ "guid": "4ed90dae-2cc8-44c4-9b6b-781cbafe6c46", "service": "AVS", "services": [ - "VM", - "WAF", "Monitor", - "AVS" + "AVS", + "WAF", + "VM" ], "severity": "Medium", "text": "Deploy the Log Analytics Agents to Azure VMware Solution guest VM workloads", @@ -30143,11 +30172,11 @@ "guid": "589d457a-927c-4397-9d11-02cad6aae11e", "service": "AVS", "services": [ - "AzurePolicy", - "WAF", - "VM", + "Backup", "AVS", - "Backup" + "VM", + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Ensure you have a documented and implemented backup policy and solution for Azure VMware Solution VM workloads", @@ -30159,10 +30188,10 @@ "guid": "ee29711b-d352-4caa-ab79-b198dab81932", "service": "AVS", "services": [ - "WAF", - "Defender", "Monitor", - "AVS" + "AVS", + "WAF", + "Defender" ], "severity": "Medium", "text": "Use Microsoft Defender for Cloud for compliance monitoring of workloads running on Azure VMware Solution", @@ -30187,8 +30216,8 @@ "guid": "cc447e82-6128-4a71-b0f1-cac6d9ef1d5e", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "High", "text": "Was data residency evaluated when selecting Azure regions to use for Azure VMware Solution deployment", @@ -30224,9 +30253,9 @@ "guid": "e43a18a9-cd28-49ce-b6b1-7db8255461e2", "service": "AVS", "services": [ - "WAF", "Monitor", - "AVS" + "AVS", + "WAF" ], "severity": "High", "text": "Create dashboards to enable core Azure VMware Solution monitoring insights", @@ -30238,9 +30267,9 @@ "guid": "6b84ee5d-f47d-42d9-8881-b1cd5d1e54a2", "service": "AVS", "services": [ - "WAF", "Monitor", - "AVS" + "AVS", + "WAF" ], "severity": "High", "text": "Create warning alerts for critical thresholds for automatic alerting on Azure VMware Solution performance (CPU >80%, Avg Memory >80%, vSAN >70%)", @@ -30252,9 +30281,9 @@ "guid": "9659e396-80e7-4828-ac93-5657d02bff45", "service": "AVS", "services": [ - "WAF", "Monitor", - "AVS" + "AVS", + "WAF" ], "severity": "High", "text": "Ensure critical alert is created to monitor if vSAN consumption is below 75% as this is a support threshold from VMware", @@ -30266,8 +30295,8 @@ "guid": "64b0d934-a348-4726-be79-d6b5c3a36495", "service": "AVS", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "High", "text": "Ensure alerts are configured for Azure Service Health alerts and notifications", @@ -30279,9 +30308,9 @@ "guid": "b6abad38-aad5-43cc-99e1-d86667357c54", "service": "AVS", "services": [ - "WAF", + "AVS", "Storage", - "AVS" + "WAF" ], "severity": "Medium", "text": "Configure Azure VMware Solution logging to be send to an Azure Storage account or Azure EventHub for processing", @@ -30293,8 +30322,8 @@ "guid": "9674c5ed-85b8-459c-9733-be2b1a27b775", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "Low", "text": "If deep insight in VMware vSphere is required: Is vRealize Operations and/or vRealize Network Insights used in the solution?", @@ -30306,10 +30335,10 @@ "guid": "a91be1f3-88f0-43a4-b2cd-463cbbbc8682", "service": "AVS", "services": [ - "VM", - "WAF", + "AzurePolicy", "Storage", - "AzurePolicy" + "WAF", + "VM" ], "severity": "High", "text": "Ensure the vSAN storage policy for VM's is NOT the default storage policy as this policy applies thick provisioning", @@ -30333,9 +30362,9 @@ "guid": "0e43a18a-9cd2-489b-bd6b-17db8255461e", "service": "AVS", "services": [ - "WAF", + "Backup", "Storage", - "Backup" + "WAF" ], "severity": "Medium", "text": "Ensure data repositories for the backup solution are stored outside of vSAN storage. Either in Azure native or on a disk pool-backed datastore", @@ -30347,9 +30376,9 @@ "guid": "2aee3453-aec8-4339-848b-262d6cc5f512", "service": "AVS", "services": [ - "WAF", + "AVS", "Arc", - "AVS" + "WAF" ], "severity": "Medium", "text": "Ensure workloads running on Azure VMware Solution are hybrid managed using Azure Arc for Servers (Arc for Azure VMware Solution is in preview)", @@ -30361,9 +30390,9 @@ "guid": "925398e6-da9d-437d-ac43-bc6cd1d79a9b", "service": "AVS", "services": [ - "WAF", "Monitor", - "AVS" + "AVS", + "WAF" ], "severity": "Medium", "text": "Ensure workloads running on Azure VMware Solution are monitored using Azure Log Analytics and Azure Monitor", @@ -30375,8 +30404,8 @@ "guid": "24604489-a8f4-42d7-ae78-cb6a33bd2a09", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "Medium", "text": "Include workloads running on Azure VMware Solution in existing update management tooling or in Azure Update Management", @@ -30388,10 +30417,10 @@ "guid": "17e7a8d9-0ae0-4e27-aee2-9711bd352caa", "service": "AVS", "services": [ - "WAF", - "AVS", "Monitor", - "AzurePolicy" + "AVS", + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Use Azure Policy to onboard Azure VMware Solution workloads in the Azure Management, Monitoring and Security solutions", @@ -30403,9 +30432,9 @@ "guid": "aee3553a-fc83-4392-98b2-62d6cc5f5129", "service": "AVS", "services": [ + "AVS", "WAF", - "Defender", - "AVS" + "Defender" ], "severity": "Medium", "text": "Ensure workloads running on Azure VMware Solution are onboarded to Microsoft Defender for Cloud", @@ -30417,8 +30446,8 @@ "guid": "25398e6d-b9d3-47da-a43b-c6cd1d79a9b2", "service": "AVS", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Ensure backups are not stored on vSAN as vSAN is a finite resource", @@ -30442,8 +30471,8 @@ "guid": "f0f1cac6-d9ef-41d5-b832-d42e3611c818", "service": "AVS", "services": [ - "WAF", - "ASR" + "ASR", + "WAF" ], "severity": "Medium", "text": "Use Azure Site Recovery when the Disaster Recovery technology is native Azure IaaS", @@ -30467,8 +30496,8 @@ "guid": "8255461e-2aee-4345-9aec-8339248b262d", "service": "AVS", "services": [ - "WAF", - "ASR" + "ASR", + "WAF" ], "severity": "Medium", "text": "Use the geopolitical region pair as the secondary disaster recovery environment", @@ -30492,10 +30521,10 @@ "guid": "d1d79a9b-2460-4448-aa8f-42d78e78cb6a", "service": "AVS", "services": [ - "WAF", "ExpressRoute", "NVA", - "AVS" + "AVS", + "WAF" ], "severity": "Medium", "text": "Will ExpressRoute Global Reach be used for connectivity between the primary and secondary Azure VMware Solution Private Clouds or is routing done through network virtual appliances?", @@ -30507,8 +30536,8 @@ "guid": "33bd2a09-17e7-4a8d-a0ae-0e27cee29711", "service": "AVS", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Have all Backup solutions been considered and a solution that is best for your business been decided upon? [ MABS/CommVault/Metallic.io/Veeam/�. ]", @@ -30520,9 +30549,9 @@ "guid": "bd352caa-ab79-4b18-adab-81932c9fc9d1", "service": "AVS", "services": [ - "WAF", + "Backup", "AVS", - "Backup" + "WAF" ], "severity": "Medium", "text": "Deploy your backup solution in the same region as your Azure VMware Solution private cloud", @@ -30534,8 +30563,8 @@ "guid": "bb77036f-5e6b-4fbb-aed5-03547cc447e8", "service": "AVS", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Deploy your backup solution outside of vSan, on Azure native components", @@ -30547,8 +30576,8 @@ "guid": "26028a71-f0f1-4cac-9d9e-f1d5e832d42e", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "Low", "text": "Is a process in place to request a restore of the VMware components managed by the Azure Platform?", @@ -30572,8 +30601,8 @@ "guid": "7e7a8d90-ae0e-437c-be29-711bd352caaa", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "Low", "text": "For manual deployments, consider implementing resource locks to prevent accidental actions on your Azure VMware Solution Private Cloud", @@ -30609,8 +30638,8 @@ "guid": "0f1cac6d-9ef1-4d5e-a32e-42e3611c818b", "service": "AVS", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Low", "text": "For automated deployment, ensure that relevant resource locks are created through the automation or through Azure Policy for proper governance", @@ -30635,10 +30664,10 @@ "guid": "255461e2-aee3-4553-afc8-339248b262d6", "service": "AVS", "services": [ - "WAF", "ExpressRoute", - "AKV", - "AVS" + "AVS", + "WAF", + "AKV" ], "severity": "Low", "text": "Use Key vault to store secrets and authorization keys when separate Service Principles are used for deploying Azure VMware Solution and ExpressRoute", @@ -30650,8 +30679,8 @@ "guid": "cc5f5129-2539-48e6-bb9d-37dac43bc6cd", "service": "AVS", "services": [ - "WAF", - "AVS" + "AVS", + "WAF" ], "severity": "Low", "text": "Define resource dependencies for serializing actions in IaC when many resources need to be deployed in/on Azure VMware Solution as Azure VMware Solution only supports a limited number of parallel operations.", @@ -30675,9 +30704,9 @@ "guid": "3bd2a0a1-7e7a-48d9-8ae0-e37cee29711b", "service": "AVS", "services": [ - "WAF", + "AVS", "Subscriptions", - "AVS" + "WAF" ], "severity": "Medium", "text": "When intending to use automated scale-out, be sure to apply for sufficient Azure VMware Solution quota for the subscriptions running Azure VMware Solution", @@ -30689,9 +30718,9 @@ "guid": "d352caaa-b79b-4198-bab8-1932c9fc9d1b", "service": "AVS", "services": [ - "WAF", + "AzurePolicy", "Storage", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "When intending to use automated scale-in, be sure to take storage policy requirements into account before performing such action", @@ -30739,8 +30768,8 @@ "guid": "1dc15a1c-075e-4e9f-841a-cccd579376bc", "service": "AVS", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Implement monitoring rules to monitor automated scaling operations and monitor success and failure to enable appropriate (automated) responses", @@ -30753,8 +30782,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", "service": "AVS", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "High", "text": "When using MON, be aware of the limits of simulataneously configured VMs (MON Limit for HCX [400 - standard, 1000 - Larger appliance])", @@ -30819,10 +30848,10 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", "service": "AVS", "services": [ - "VM", - "WAF", + "AVS", "Storage", - "AVS" + "WAF", + "VM" ], "severity": "Medium", "text": "When Azure Netapp Files is used to extend storage for Azure VMware Solution,consider using this as a VMware datastore instead of attaching directly to a VM.", @@ -30835,9 +30864,9 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", "service": "AVS", "services": [ - "WAF", "ExpressRoute", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Ensure that a dedicated ExpressRoute Gateway is being used for external data storage solutions", @@ -30850,9 +30879,9 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", "service": "AVS", "services": [ - "WAF", "ExpressRoute", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Ensure that FastPath is enabled on the ExpressRoute Gateway that is being used for external data storage solutions", @@ -30865,8 +30894,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", "service": "AVS", "services": [ - "WAF", - "ASR" + "ASR", + "WAF" ], "severity": "High", "text": "If using stretched cluster, ensure that your selected Disaster Recovery solution is supported by the vendor", @@ -30892,8 +30921,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", "service": "AVS", "services": [ - "WAF", - "ExpressRoute" + "ExpressRoute", + "WAF" ], "severity": "High", "text": "If using stretched cluster, ensure that both ExpressRoute circuits are connected to your connectivity hub.", @@ -30906,8 +30935,8 @@ "link": "https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity", "service": "AVS", "services": [ - "WAF", - "ExpressRoute" + "ExpressRoute", + "WAF" ], "severity": "High", "text": "If using stretched cluster, ensure that both ExpressRoute circuits have GlobalReach enabled.", @@ -30934,8 +30963,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention", "service": "ACR", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "High", "text": "Disable Azure Container Registry image export", @@ -30949,9 +30978,9 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy", "service": "ACR", "services": [ - "WAF", + "AzurePolicy", "ACR", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Enable Azure Policies for Azure Container Registry", @@ -30965,9 +30994,9 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push", "service": "ACR", "services": [ + "ACR", "WAF", - "AKV", - "ACR" + "AKV" ], "severity": "High", "text": "Sign and Verify containers with notation (Notary v2)", @@ -30981,9 +31010,9 @@ "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys", "service": "ACR", "services": [ + "ACR", "WAF", - "AKV", - "ACR" + "AKV" ], "severity": "Medium", "text": "Encrypt registry with a customer managed key", @@ -30997,10 +31026,10 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", "service": "ACR", "services": [ - "WAF", - "RBAC", "Entra", - "ACR" + "ACR", + "RBAC", + "WAF" ], "severity": "High", "text": "Use Managed Identities to connect instead of Service Principals", @@ -31014,8 +31043,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity", "service": "ACR", "services": [ - "WAF", - "RBAC" + "RBAC", + "WAF" ], "severity": "High", "text": "Disable local authentication for management plane access", @@ -31029,10 +31058,10 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli", "service": "ACR", "services": [ - "WAF", - "RBAC", "Entra", - "ACR" + "ACR", + "RBAC", + "WAF" ], "severity": "High", "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals", @@ -31060,8 +31089,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli", "service": "ACR", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "High", "text": "Disable repository-scoped access tokens", @@ -31075,9 +31104,9 @@ "service": "ACR", "services": [ "EventHubs", - "WAF", + "ACR", "PrivateLink", - "ACR" + "WAF" ], "severity": "High", "text": "Deploy images from a trusted environment", @@ -31091,10 +31120,10 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy", "service": "ACR", "services": [ - "WAF", - "ACR", + "AzurePolicy", "Entra", - "AzurePolicy" + "ACR", + "WAF" ], "severity": "Medium", "text": "Disable Azure ARM audience tokens for authentication", @@ -31108,10 +31137,10 @@ "link": "https://learn.microsoft.com/azure/container-registry/monitor-service", "service": "ACR", "services": [ - "Entra", - "WAF", "Monitor", - "ACR" + "Entra", + "ACR", + "WAF" ], "severity": "Medium", "text": "Enable diagnostics logging", @@ -31125,10 +31154,10 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link", "service": "ACR", "services": [ + "PrivateLink", "Firewall", - "WAF", "VNet", - "PrivateLink" + "WAF" ], "severity": "Medium", "text": "Control inbound network access with Private Link", @@ -31142,8 +31171,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access", "service": "ACR", "services": [ - "WAF", - "PrivateLink" + "PrivateLink", + "WAF" ], "severity": "Medium", "text": "Disable Public Network access", @@ -31157,9 +31186,9 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus", "service": "ACR", "services": [ - "WAF", "PrivateLink", - "ACR" + "ACR", + "WAF" ], "severity": "Medium", "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)", @@ -31173,9 +31202,9 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction", "service": "ACR", "services": [ + "ACR", "WAF", - "Defender", - "ACR" + "Defender" ], "severity": "Low", "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities", @@ -31254,8 +31283,8 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/configure-customer-managed-key", "service": "Service Bus", "services": [ - "WAF", - "ServiceBus" + "ServiceBus", + "WAF" ], "severity": "Low", "text": "Use customer-managed key option in data at rest encryption when required", @@ -31270,8 +31299,8 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/transport-layer-security-enforce-minimum-version", "service": "Service Bus", "services": [ - "WAF", - "ServiceBus" + "ServiceBus", + "WAF" ], "severity": "Medium", "text": "Enforce a minimum required version of Transport Layer Security (TLS) for requests ", @@ -31286,12 +31315,12 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies", "service": "Service Bus", "services": [ - "TrafficManager", - "WAF", - "RBAC", "Entra", + "TrafficManager", + "RBAC", "AzurePolicy", - "ServiceBus" + "ServiceBus", + "WAF" ], "severity": "Medium", "text": "Avoid using root account when it is not necessary", @@ -31306,13 +31335,13 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-managed-service-identity", "service": "Service Bus", "services": [ - "WAF", - "VM", - "Storage", - "AKV", - "AppSvc", "Entra", - "ServiceBus" + "AppSvc", + "AKV", + "Storage", + "VM", + "ServiceBus", + "WAF" ], "severity": "Medium", "text": "When possible, your application should be using a managed identity to authenticate to Azure Service Bus. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", @@ -31327,11 +31356,11 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/authenticate-application#azure-built-in-roles-for-azure-service-bus", "service": "Service Bus", "services": [ - "WAF", "Subscriptions", "RBAC", "Storage", - "ServiceBus" + "ServiceBus", + "WAF" ], "severity": "High", "text": "Use least privilege data plane RBAC", @@ -31346,10 +31375,10 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/monitor-service-bus-reference", "service": "Service Bus", "services": [ + "Monitor", "ServiceBus", - "WAF", "VNet", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Enable logging for security investigation. Use Azure Monitor to trace resource logs and runtime audit logs (currently available only in the premium tier)", @@ -31364,10 +31393,10 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/private-link-service", "service": "Service Bus", "services": [ - "WAF", - "VNet", + "PrivateLink", "ServiceBus", - "PrivateLink" + "VNet", + "WAF" ], "severity": "Medium", "text": "Consider using private endpoints to access Azure Service Bus and disable public network access when applicable.", @@ -31382,8 +31411,8 @@ "link": "https://learn.microsoft.com/azure/service-bus-messaging/service-bus-ip-filtering", "service": "Service Bus", "services": [ - "WAF", - "ServiceBus" + "ServiceBus", + "WAF" ], "severity": "Medium", "text": "Consider only allowing access to Azure Service Bus namespace from specific IP addresses or ranges", @@ -31436,8 +31465,8 @@ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", "service": "Azure Functions", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "High", "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", @@ -31450,8 +31479,8 @@ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", "service": "Azure Functions", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "High", "text": "Ensure 'Always On' is enabled for all Function Apps running on App Service Plan", @@ -31464,8 +31493,8 @@ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations?tabs=azure-cli#shared-storage-accounts", "service": "Azure Functions", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Pair a Function App to its own storage account. Try not to re-use storage accounts for Function Apps unless they are tightly coupled", @@ -31504,8 +31533,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/concepts/advanced-prompt-engineering?pivots=programming-language-chat-completions", "service": "Cognitive Services", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Backup Your Prompts", @@ -31518,8 +31547,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery", "service": "Cognitive Services", "services": [ - "WAF", - "ASR" + "ASR", + "WAF" ], "severity": "High", "text": "Business Continuity and Disaster Recovery (BCDR) considerations with Azure OpenAI Service", @@ -31532,8 +31561,8 @@ "link": "https://github.com/abacaj/chatgpt-backup#backup-your-chatgpt-conversations", "service": "Cognitive Services", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Backup Your ChatGPT conversations", @@ -31585,8 +31614,8 @@ "link": "https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans", "service": "App Services", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Use Premium and Standard tiers. These tiers support staging slots and automated backups.", @@ -31625,9 +31654,9 @@ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-backup", "service": "App Services", "services": [ - "WAF", + "Backup", "AppSvc", - "Backup" + "WAF" ], "severity": "High", "text": "Refer to backup and restore best practices for Azure App Service", @@ -31640,8 +31669,8 @@ "link": "https://learn.microsoft.com/en-us/azure/architecture/framework/services/compute/azure-app-service/reliability", "service": "App Services", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "High", "text": "Implement Azure App Service reliability best practices", @@ -31654,8 +31683,8 @@ "link": "https://learn.microsoft.com/en-us/azure/app-service/manage-disaster-recovery#recover-app-content-only", "service": "App Services", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "Low", "text": "Familiarize with how to move an App Service app to another region During a disaster", @@ -31668,8 +31697,8 @@ "link": "https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service", "service": "App Services", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "High", "text": "Familiarize with reliability support in Azure App Service", @@ -31682,8 +31711,8 @@ "link": "https://learn.microsoft.com/en-us/azure/azure-functions/dedicated-plan#always-on", "service": "App Services", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "Medium", "text": "Ensure \"Always On\" is enabled for Function Apps running on a app service plan", @@ -31696,9 +31725,9 @@ "link": "https://learn.microsoft.com/en-us/azure/app-service/monitor-instances-health-check", "service": "App Services", "services": [ - "WAF", + "Monitor", "AppSvc", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Monitor App Service instances using Health checks", @@ -31711,8 +31740,8 @@ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-overview", "service": "App Services", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Monitor availability and responsiveness of web app or website using Application Insights availability tests", @@ -31725,8 +31754,8 @@ "link": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/availability-standard-tests", "service": "App Services", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Low", "text": "Use Application Insights Standard test to monitor availability and responsiveness of web app or website", @@ -31740,9 +31769,9 @@ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", "service": "App Services", "services": [ + "AppSvc", "WAF", - "AKV", - "AppSvc" + "AKV" ], "severity": "High", "text": "Use Key Vault to store secrets", @@ -31756,10 +31785,10 @@ "link": "https://learn.microsoft.com/azure/app-service/app-service-key-vault-references", "service": "App Services", "services": [ - "WAF", - "AKV", + "Entra", "AppSvc", - "Entra" + "WAF", + "AKV" ], "severity": "High", "text": "Use Managed Identity to connect to Key Vault", @@ -31773,9 +31802,9 @@ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-certificate", "service": "App Services", "services": [ + "AppSvc", "WAF", - "AKV", - "AppSvc" + "AKV" ], "severity": "High", "text": "Use Key Vault to store TLS certificate.", @@ -31789,9 +31818,9 @@ "link": "https://learn.microsoft.com/azure/app-service/overview-hosting-plans", "service": "App Services", "services": [ - "WAF", "Subscriptions", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "Medium", "text": "Isolate systems that process sensitive information", @@ -31805,9 +31834,9 @@ "link": "https://learn.microsoft.com/azure/app-service/operating-system-functionality#file-access", "service": "App Services", "services": [ - "WAF", + "AppSvc", "TrafficManager", - "AppSvc" + "WAF" ], "severity": "Medium", "text": "Do not store sensitive data on local disk", @@ -31821,9 +31850,9 @@ "link": "https://learn.microsoft.com/azure/app-service/overview-authentication-authorization", "service": "App Services", "services": [ - "WAF", + "Entra", "AppSvc", - "Entra" + "WAF" ], "severity": "Medium", "text": "Use an established Identity Provider for authentication", @@ -31837,8 +31866,8 @@ "link": "https://learn.microsoft.com/azure/app-service/deploy-best-practices", "service": "App Services", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "High", "text": "Deploy from a trusted environment", @@ -31852,8 +31881,8 @@ "link": "https://learn.microsoft.com/azure/app-service/deploy-configure-credentials#disable-basic-authentication", "service": "App Services", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "High", "text": "Disable basic authentication", @@ -31867,9 +31896,9 @@ "link": "https://learn.microsoft.com/azure/app-service/overview-managed-identity?tabs=portal%2Chttp", "service": "App Services", "services": [ + "Entra", "WAF", - "AKV", - "Entra" + "AKV" ], "severity": "High", "text": "Use Managed Identity to connect to resources", @@ -31883,9 +31912,9 @@ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-managed-identity-to-pull-image-from-azure-container-registry", "service": "App Services", "services": [ - "WAF", "Entra", - "ACR" + "ACR", + "WAF" ], "severity": "High", "text": "Pull containers using a Managed Identity", @@ -31899,10 +31928,10 @@ "link": "https://learn.microsoft.com/azure/app-service/troubleshoot-diagnostic-logs", "service": "App Services", "services": [ + "Monitor", "Entra", - "WAF", "AppSvc", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Send App Service runtime logs to Log Analytics", @@ -31916,10 +31945,10 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/essentials/activity-log", "service": "App Services", "services": [ + "Monitor", "Entra", - "WAF", "AppSvc", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Send App Service activity logs to Log Analytics", @@ -31935,9 +31964,9 @@ "services": [ "NVA", "Firewall", - "WAF", + "VNet", "Monitor", - "VNet" + "WAF" ], "severity": "Medium", "text": "Outbound network access should be controlled", @@ -31953,10 +31982,10 @@ "services": [ "NVA", "Firewall", - "WAF", - "Storage", "VNet", - "PrivateLink" + "Storage", + "PrivateLink", + "WAF" ], "severity": "Low", "text": "Ensure a stable IP for outbound communications towards internet addresses", @@ -31970,9 +31999,9 @@ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", "service": "App Services", "services": [ - "WAF", + "PrivateLink", "AppSvc", - "PrivateLink" + "WAF" ], "severity": "High", "text": "Inbound network access should be controlled", @@ -31986,11 +32015,11 @@ "link": "https://learn.microsoft.com/azure/app-service/networking/app-gateway-with-service-endpoints", "service": "App Services", "services": [ - "WAF", - "Monitor", "AppGW", "AppSvc", - "FrontDoor" + "FrontDoor", + "Monitor", + "WAF" ], "severity": "High", "text": "Use a WAF in front of App Service", @@ -32004,8 +32033,8 @@ "link": "https://learn.microsoft.com/azure/app-service/networking-features#access-restrictions", "service": "App Services", "services": [ - "WAF", - "PrivateLink" + "PrivateLink", + "WAF" ], "severity": "High", "text": "Avoid for WAF to be bypassed", @@ -32020,9 +32049,9 @@ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-tls-versions", "service": "App Services", "services": [ - "WAF", + "AzurePolicy", "AppSvc", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Set minimum TLS policy to 1.2", @@ -32037,8 +32066,8 @@ "link": "https://learn.microsoft.com/azure/app-service/configure-ssl-bindings#enforce-https", "service": "App Services", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "High", "text": "Use HTTPS only", @@ -32052,8 +32081,8 @@ "link": "https://learn.microsoft.com/azure/app-service/app-service-web-tutorial-rest-api", "service": "App Services", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "Wildcards must not be used for CORS", @@ -32082,9 +32111,9 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction", "service": "App Services", "services": [ + "AppSvc", "WAF", - "Defender", - "AppSvc" + "Defender" ], "severity": "Medium", "text": "Enable Defender for Cloud - Defender for App Service", @@ -32098,12 +32127,12 @@ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", "service": "App Services", "services": [ - "DDoS", "NVA", - "EventHubs", - "WAF", "AppGW", - "VNet" + "WAF", + "VNet", + "EventHubs", + "DDoS" ], "severity": "Medium", "text": "Enable DDOS Protection Standard on the WAF VNet", @@ -32117,10 +32146,10 @@ "link": "https://learn.microsoft.com/azure/app-service/configure-custom-container#use-an-image-from-a-network-protected-registry", "service": "App Services", "services": [ - "WAF", - "VNet", "PrivateLink", - "ACR" + "ACR", + "VNet", + "WAF" ], "severity": "Medium", "text": "Pull containers over a Virtual Network", @@ -32176,8 +32205,8 @@ "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/storage-security-baseline", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Consider the 'Azure security baseline for storage'", @@ -32191,9 +32220,9 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-private-endpoints", "service": "Azure Storage", "services": [ - "WAF", + "PrivateLink", "Storage", - "PrivateLink" + "WAF" ], "severity": "High", "text": "Consider using private endpoints for Azure Storage", @@ -32207,10 +32236,10 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/migration-classic-resource-manager-overview#migration-of-storage-accounts", "service": "Azure Storage", "services": [ - "WAF", + "RBAC", "Subscriptions", "Storage", - "RBAC" + "WAF" ], "severity": "Medium", "text": "Ensure older storage accounts are not using 'classic deployment model'", @@ -32224,9 +32253,9 @@ "link": "https://learn.microsoft.com/azure/storage/common/azure-defender-storage-configure", "service": "Azure Storage", "services": [ + "Storage", "WAF", - "Defender", - "Storage" + "Defender" ], "severity": "High", "text": "Enable Microsoft Defender for all of your storage accounts", @@ -32240,8 +32269,8 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-overview", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Enable 'soft delete' for blobs", @@ -32255,8 +32284,8 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Disable 'soft delete' for blobs", @@ -32284,8 +32313,8 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Disable 'soft delete' for containers", @@ -32299,8 +32328,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "Enable resource locks on storage accounts", @@ -32314,10 +32343,10 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/immutable-storage-overview", "service": "Azure Storage", "services": [ - "WAF", + "AzurePolicy", "Subscriptions", "Storage", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Consider immutable blobs", @@ -32331,8 +32360,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-require-secure-transfer", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "Require HTTPS, i.e. disable port 80 on the storage account", @@ -32346,8 +32375,8 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/storage-custom-domain-name", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "When enforcing HTTPS (disabling HTTP), check that you do not use custom domains (CNAME) for the storage account.", @@ -32361,8 +32390,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Limit shared access signature (SAS) tokens to HTTPS connections only", @@ -32377,8 +32406,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "Enforce the latest TLS version for a storage account", @@ -32392,9 +32421,9 @@ "link": "https://learn.microsoft.com/azure/storage/common/authorize-data-access", "service": "Azure Storage", "services": [ - "WAF", + "Entra", "Storage", - "Entra" + "WAF" ], "severity": "High", "text": "Use Microsoft Entra ID tokens for blob access", @@ -32407,8 +32436,8 @@ "guid": "a4b1410d-4395-48a8-a228-9b3d6b57cfc6", "service": "Azure Storage", "services": [ - "WAF", - "RBAC" + "RBAC", + "WAF" ], "severity": "Medium", "text": "Least privilege in IaM permissions", @@ -32422,9 +32451,9 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-sas-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#best-practices-when-using-sas", "service": "Azure Storage", "services": [ - "WAF", + "Entra", "Storage", - "Entra" + "WAF" ], "severity": "High", "text": "When using SAS, prefer 'user delegation SAS' over storage-account-key based SAS.", @@ -32439,11 +32468,11 @@ "link": "https://learn.microsoft.com/rest/api/storageservices/authorize-with-shared-key", "service": "Azure Storage", "services": [ - "WAF", + "Entra", + "AKV", "Monitor", "Storage", - "AKV", - "Entra" + "WAF" ], "severity": "High", "text": "Consider disabling storage account keys, so that only Microsoft Entra ID access (and user delegation SAS) is supported.", @@ -32457,11 +32486,11 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/blob-storage-monitoring-scenarios#audit-account-activity", "service": "Azure Storage", "services": [ - "WAF", + "AKV", "Monitor", "Storage", - "AKV", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "High", "text": "Consider using Azure Monitor to audit control plane operations on the storage account", @@ -32475,10 +32504,10 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-keys-manage?tabs=azure-portal#create-a-key-expiration-policy", "service": "Azure Storage", "services": [ - "WAF", - "AKV", + "AzurePolicy", "Storage", - "AzurePolicy" + "WAF", + "AKV" ], "severity": "Medium", "text": "When using storage account keys, consider enabling a 'key expiration policy'", @@ -32492,8 +32521,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/sas-expiration-policy", "service": "Azure Storage", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Consider configuring an SAS expiration policy", @@ -32507,10 +32536,10 @@ "link": "https://learn.microsoft.com/rest/api/storageservices/define-stored-access-policy", "service": "Azure Storage", "services": [ - "WAF", - "AKV", + "AzurePolicy", "Storage", - "AzurePolicy" + "WAF", + "AKV" ], "severity": "Medium", "text": "Consider linking SAS to a stored access policy", @@ -32523,9 +32552,9 @@ "link": "https://microsoft.github.io/code-with-engineering-playbook/continuous-integration/dev-sec-ops/secret-management/recipes/detect-secrets-ado/", "service": "Azure Storage", "services": [ + "Storage", "WAF", - "AKV", - "Storage" + "AKV" ], "severity": "Medium", "text": "Consider configuring your application's source code repository to detect checked-in connection strings and storage account keys.", @@ -32539,9 +32568,9 @@ "link": "https://learn.microsoft.com/azure/architecture/framework/security/design-storage-keys", "service": "Azure Storage", "services": [ - "WAF", + "Entra", "Storage", - "Entra" + "WAF" ], "severity": "High", "text": "Consider storing connection strings in Azure KeyVault (in scenarios where managed identities are not possible)", @@ -32555,9 +32584,9 @@ "link": "https://learn.microsoft.com/rest/api/storageservices/delegate-access-with-shared-access-signature", "service": "Azure Storage", "services": [ - "WAF", + "AzurePolicy", "Storage", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Strive for short validity periods for ad-hoc SAS", @@ -32598,8 +32627,8 @@ "guid": "348b263e-6dd6-4051-8a36-498f6dbad38e", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Low", "text": "Consider checking uploaded data, after clients used a SAS to upload a file. ", @@ -32613,10 +32642,10 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/secure-file-transfer-protocol-support#sftp-permission-model", "service": "Azure Storage", "services": [ - "WAF", - "Storage", + "Entra", "RBAC", - "Entra" + "Storage", + "WAF" ], "severity": "High", "text": "SFTP: Limit the amount of 'local users' for SFTP access, and audit whether access is needed over time.", @@ -32643,9 +32672,9 @@ "link": "https://learn.microsoft.com/rest/api/storageservices/cross-origin-resource-sharing--cors--support-for-the-azure-storage-services", "service": "Azure Storage", "services": [ - "WAF", + "AzurePolicy", "Storage", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Avoid overly broad CORS policies", @@ -32659,8 +32688,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "Determine how data at rest should be encrypted. Understand the thread model for data.", @@ -32701,8 +32730,8 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure?tabs=portal#allow-or-disallow-public-read-access-for-a-storage-account", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "Consider whether public blob anonymous access is needed, or whether it can be disabled for certain storage accounts. ", @@ -32715,8 +32744,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-account-upgrade?tabs=azure-portal", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "Leverage a storagev2 account type for better performance and reliability", @@ -32729,8 +32758,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "Leverage GRS, ZRS or GZRS storage for the highest availability", @@ -32815,12 +32844,12 @@ "link": "https://learn.microsoft.com/azure/event-hubs/authorize-access-shared-access-signature#shared-access-authorization-policies", "service": "Event Hubs", "services": [ - "EventHubs", - "TrafficManager", - "WAF", - "RBAC", "Entra", - "AzurePolicy" + "TrafficManager", + "RBAC", + "EventHubs", + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Avoid using root account when it is not necessary", @@ -32835,12 +32864,12 @@ "link": "https://learn.microsoft.com/azure/event-hubs/authenticate-managed-identity?tabs=latest", "service": "Event Hubs", "services": [ - "EventHubs", - "WAF", - "VM", - "Storage", + "Entra", "AKV", - "Entra" + "Storage", + "VM", + "EventHubs", + "WAF" ], "severity": "Medium", "text": "When possible, your application should be using a managed identity to authenticate to Azure Event Hub. If not, consider having the storage credential (SAS, service principal credential) in Azure Key Vault or an equivalent service", @@ -32856,8 +32885,8 @@ "service": "Event Hubs", "services": [ "EventHubs", - "WAF", - "RBAC" + "RBAC", + "WAF" ], "severity": "High", "text": "Use least privilege data plane RBAC", @@ -32872,10 +32901,10 @@ "link": "https://learn.microsoft.com/azure/event-hubs/monitor-event-hubs-reference", "service": "Event Hubs", "services": [ - "EventHubs", - "WAF", + "Monitor", "VNet", - "Monitor" + "EventHubs", + "WAF" ], "severity": "Medium", "text": "Enable logging for security investigation. Use Azure Monitor to captured metrics and logs such as resource logs, runtime audit logs and Kafka logs", @@ -32891,9 +32920,9 @@ "service": "Event Hubs", "services": [ "EventHubs", - "WAF", + "PrivateLink", "VNet", - "PrivateLink" + "WAF" ], "severity": "Medium", "text": "Consider using private endpoints to access Azure Event Hub and disable public network access when applicable.", @@ -32938,8 +32967,8 @@ "service": "Event Hubs", "services": [ "EventHubs", - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "High", "text": "Leverage Availability Zones if regionally applicable", @@ -32967,8 +32996,8 @@ "service": "Event Hubs", "services": [ "EventHubs", - "WAF", - "ASR" + "ASR", + "WAF" ], "severity": "High", "text": "Plan for Geo Disaster Recovery using Active Passive configuration", @@ -32983,8 +33012,8 @@ "service": "Event Hubs", "services": [ "EventHubs", - "WAF", - "ASR" + "ASR", + "WAF" ], "severity": "Medium", "text": "For Business Critical Applications, use Active Active configuration", @@ -33011,9 +33040,9 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-latest-version-for-customer-managed-certificates", "service": "Front Door", "services": [ + "FrontDoor", "WAF", - "AKV", - "FrontDoor" + "AKV" ], "severity": "Medium", "text": "If you use customer-managed TLS certificates with Azure Front Door, use the 'Latest' certificate version. Reduce the risk of outages caused by manual certificate renewal", @@ -33027,8 +33056,8 @@ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "text": "Ensure you are using Application Gateway v2 SKU", @@ -33072,9 +33101,9 @@ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", "service": "App Gateway", "services": [ - "WAF", + "AppGW", "VNet", - "AppGW" + "WAF" ], "severity": "Medium", "text": "Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24", @@ -33089,12 +33118,12 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "App Gateway", "services": [ - "NVA", - "WAF", - "Subscriptions", - "AppGW", "Entra", - "VNet" + "NVA", + "AppGW", + "Subscriptions", + "VNet", + "WAF" ], "severity": "Medium", "text": "Deploy Azure Application Gateway v2 or partner NVAs used for proxying inbound HTTP(S) connections within the landing-zone virtual network and with the apps that they're securing.", @@ -33139,8 +33168,8 @@ "link": "https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2", "service": "App Gateway", "services": [ - "WAF", "AppGW", + "WAF", "ACR" ], "severity": "Medium", @@ -33155,9 +33184,9 @@ "link": "https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/afds-overview", "service": "Front Door", "services": [ - "WAF", + "AzurePolicy", "FrontDoor", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Use Azure Front Door with WAF policies to deliver and help protect global HTTP/S apps that span multiple Azure regions.", @@ -33171,10 +33200,10 @@ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", "service": "Front Door", "services": [ - "WAF", + "AzurePolicy", "AppGW", "FrontDoor", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "When using Front Door and Application Gateway to help protect HTTP/S apps, use WAF policies in Front Door. Lock down Application Gateway to receive traffic only from Front Door.", @@ -33189,8 +33218,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "Traffic Manager", "services": [ - "WAF", - "TrafficManager" + "TrafficManager", + "WAF" ], "severity": "High", "text": "Use Traffic Manager to deliver global apps that span protocols other than HTTP/S.", @@ -33203,9 +33232,9 @@ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", "service": "Entra", "services": [ - "WAF", + "Entra", "AVD", - "Entra" + "WAF" ], "severity": "Low", "text": "If users only need access to internal applications, has Microsoft Entra ID Application Proxy been considered as an alternative to Azure Virtual Desktop (AVD)?", @@ -33218,8 +33247,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy#how-application-proxy-works", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "To reduce the number of firewall ports open for incoming connections in your network, consider using Microsoft Entra ID Application Proxy to give remote users secure and authenticated access to internal applications.", @@ -33235,9 +33264,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", "service": "Front Door", "services": [ - "WAF", + "AzurePolicy", "FrontDoor", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic.", @@ -33251,9 +33280,9 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#avoid-combining-traffic-manager-and-front-door", "service": "Front Door", "services": [ - "WAF", + "FrontDoor", "TrafficManager", - "FrontDoor" + "WAF" ], "severity": "High", "text": "Avoid combining Azure Traffic Manager and Azure Front Door.", @@ -33267,8 +33296,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-the-same-domain-name-on-front-door-and-your-origin", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "High", "text": "Use the same domain name on Azure Front Door and your origin. Mismatched host names can cause subtle bugs.", @@ -33282,8 +33311,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Low", "text": "Disable health probes when there is only one origin in an Azure Front Door origin group.", @@ -33296,8 +33325,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#select-good-health-probe-endpoints", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Select good health probe endpoints for Azure Front Door. Consider building health endpoints that check all of your application's dependencies.", @@ -33311,8 +33340,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Low", "text": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application.", @@ -33343,10 +33372,10 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates", "service": "Front Door", "services": [ - "WAF", - "AKV", "Cost", - "FrontDoor" + "FrontDoor", + "WAF", + "AKV" ], "severity": "High", "text": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals.", @@ -33359,8 +33388,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#define-your-waf-configuration-as-code", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Define your Azure Front Door WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", @@ -33374,8 +33403,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-end-to-end-tls", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "High", "text": "Use end-to-end TLS with Azure Front Door. Use TLS for connections from your clients to Front Door, and from Front Door to your origin.", @@ -33388,8 +33417,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#use-http-to-https-redirection", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Use HTTP to HTTPS redirection with Azure Front Door. Support older clients by redirecting them to an HTTPS request automatically.", @@ -33403,8 +33432,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/best-practices#enable-the-waf", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "High", "text": "Enable the Azure Front Door WAF. Protect your application from a range of attacks.", @@ -33418,8 +33447,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#tune-your-waf", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "High", "text": "Tune the Azure Front Door WAF for your workload by configuring the WAF in Detection mode to reduce and fix false positive detections.", @@ -33433,9 +33462,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", "service": "Front Door", "services": [ - "WAF", + "AzurePolicy", "FrontDoor", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Enable request body inspection feature enabled in Azure Front Door WAF policy.", @@ -33449,8 +33478,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-default-rule-sets", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "High", "text": "Enable the Azure Front Door WAF default rule sets. The default rule sets detect and block common attacks.", @@ -33464,8 +33493,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#enable-bot-management-rules", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "High", "text": "Enable the Azure Front Door WAF bot protection rule set. The bot rules detect good and bad bots.", @@ -33478,8 +33507,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-the-latest-ruleset-versions", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Use the latest Azure Front Door WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", @@ -33492,8 +33521,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-rate-limiting", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Add rate limiting to the Azure Front Door WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", @@ -33506,8 +33535,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#use-a-high-threshold-for-rate-limits", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Use a high threshold for Azure Front Door WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", @@ -33533,8 +33562,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#specify-the-unknown-zz-location", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Front Door WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", @@ -33549,8 +33578,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "High", "text": "Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots.", @@ -33564,9 +33593,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits#request-body-inspection", "service": "App Gateway", "services": [ - "WAF", + "AzurePolicy", "AppGW", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Enable request body inspection feature enabled in Azure Application Gateway WAF policy.", @@ -33580,8 +33609,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#tune-your-waf", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "High", "text": "Tune the Azure Application Gateway WAF in detection mode for your workload. Reduce false positive detections.", @@ -33596,9 +33625,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings", "service": "App Gateway", "services": [ - "WAF", + "AzurePolicy", "AppGW", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Deploy your WAF policy for Application Gateway in 'Prevention' mode.", @@ -33611,8 +33640,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "text": "Add rate limiting to the Azure Application Gateway WAF. Rate limiting blocks clients accidentally or intentionally sending large amounts of traffic in a short period of time.", @@ -33625,8 +33654,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/rate-limiting-overview#rate-limiting-details", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "text": "Use a high threshold for Azure Application Gateway WAF rate limits. High rate limit thresholds avoid blocking legitimate traffic, while still providing protection against extremely high numbers of requests that might overwhelm your infrastructure. ", @@ -33652,8 +33681,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/geomatch-custom-rules", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "text": "Specify the unknown (ZZ) location when geo-filtering traffic with the Azure Application Gateway WAF. Avoid accidentally blocking legitimate requests when IP addresses can't be geo-matched.", @@ -33666,8 +33695,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#use-the-latest-ruleset-versions", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "text": "Use the latest Azure Application Gateway WAF rule set version. Rule set updates are regularly updated to take account of the current threat landscape.", @@ -33680,8 +33709,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#add-diagnostic-settings-to-save-your-wafs-logs", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "text": "Add diagnostic settings to save your Azure Application Gateway WAF logs.", @@ -33694,8 +33723,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#add-diagnostic-settings-to-save-your-wafs-logs", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Add diagnostic settings to save your Azure Front Door WAF logs.", @@ -33708,9 +33737,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#send-logs-to-microsoft-sentinel", "service": "App Gateway", "services": [ - "WAF", "Sentinel", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "text": "Send Azure Application Gateway WAF logs to Microsoft Sentinel.", @@ -33723,9 +33752,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", "service": "Front Door", "services": [ - "WAF", "Sentinel", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Send Azure Front Door WAF logs to Microsoft Sentinel.", @@ -33738,8 +33767,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/best-practices#define-your-waf-configuration-as-code", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "text": "Define your Azure Application Gateway WAF configuration as code. By using code, you can more easily adopt new rule set version and gain additional protection.", @@ -33752,8 +33781,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/policy-overview", "service": "App Gateway", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Use WAF Policies instead of the legacy WAF configuration.", @@ -33766,11 +33795,11 @@ "link": "https://learn.microsoft.com/azure/virtual-wan/scenario-secured-hub-app-gateway", "service": "App Gateway", "services": [ - "WAF", - "ExpressRoute", "AppGW", + "VPN", "VNet", - "VPN" + "ExpressRoute", + "WAF" ], "severity": "Medium", "text": "Filter inbound traffic in the backends so that they only accept connections from the Application Gateway subnet, for example with NSGs.", @@ -33783,8 +33812,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/origin-security?tabs=app-service-functions", "service": "Front Door", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Make sure your origins only take traffic from your Azure Front Door instance.", @@ -33888,8 +33917,8 @@ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", "service": "App Gateway", "services": [ - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Configure Front Door to optimize global web traffic routing and top-tier end-user performance, and reliability through quick global failover", @@ -33928,8 +33957,8 @@ "link": "https://learn.microsoft.com/azure/application-gateway/create-ssl-portal", "service": "App Gateway", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Centralize SSL certificate management to reduce encryption and decryption overhead from a backend server farm", @@ -33942,8 +33971,8 @@ "link": "https://learn.microsoft.com/azure/application-gateway/application-gateway-websocket", "service": "App Gateway", "services": [ - "WAF", - "AppGW" + "AppGW", + "WAF" ], "severity": "Low", "text": "Use Application Gateway for native support for WebSocket and HTTP/2 protocols", @@ -33995,8 +34024,8 @@ "link": "https://learn.microsoft.com/azure/app-service/environment/intro", "service": "Logic Apps", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "High", "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", @@ -34035,9 +34064,9 @@ "link": "https://github.com/Azure-Samples/AI-Gateway", "service": "Azure OpenAI", "services": [ - "WAF", "APIM", - "Entra" + "Entra", + "WAF" ], "severity": "High", "text": "Consider Gateway patterns with APIM or solutions like AI central for better rate limiting, load balancing, authentication and logging", @@ -34050,8 +34079,8 @@ "link": "https://techcommunity.microsoft.com/t5/fasttrack-for-azure/azure-openai-insights-monitoring-ai-with-confidence/ba-p/4026850", "service": "Azure OpenAI", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "High", "text": "Enable monitoring for your AOAI instances", @@ -34064,10 +34093,10 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring#set-up-alerts", "service": "Azure OpenAI", "services": [ - "WAF", + "Monitor", "Subscriptions", - "AKV", - "Monitor" + "WAF", + "AKV" ], "severity": "High", "text": "Create alerts to notify teams of events such as an entry in the activity log created by an action performed on the resource, such as regenerating its subscription keys or a metric threshold such as the number of errors exceeding 10 in an hour", @@ -34080,8 +34109,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring", "service": "Azure OpenAI", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "High", "text": "Monitor token usage to prevent service disruptions due to capacity", @@ -34094,8 +34123,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/monitoring", "service": "Azure OpenAI", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "observe metrics like processed inference tokens, generated completion tokens monitor for rate limit", @@ -34108,8 +34137,8 @@ "link": "https://techcommunity.microsoft.com/t5/apps-on-azure-blog/build-an-enterprise-ready-azure-openai-solution-with-azure-api/ba-p/3907562", "service": "Azure OpenAI", "services": [ - "WAF", - "APIM" + "APIM", + "WAF" ], "severity": "Low", "text": "If the diagnostics are not sufficient for you, consider using a gateway such as Azure API Managements in front of Azure OpenAI to log both incoming prompts and outgoing responses, where permitted", @@ -34135,8 +34164,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity", "service": "Azure OpenAI", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "High", "text": "Use Microsoft Entra Authentication with Managed Identity instead of API Key", @@ -34214,9 +34243,9 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching", "service": "Azure OpenAI", "services": [ - "WAF", + "ServiceBus", "Storage", - "ServiceBus" + "WAF" ], "severity": "Medium", "text": "Estimate elasticity demands to determine synchronous and batch request segregation based on priority. For high priority, use synchronous approach and for low priority, asynchronous batch processing with queue is preferred", @@ -34281,8 +34310,8 @@ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability", "service": "Azure OpenAI", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "Low", "text": "Deploy multiple OAI instances across regions", @@ -34295,9 +34324,9 @@ "link": "https://learn.microsoft.com/azure/architecture/ai-ml/architecture/baseline-openai-e2e-chat#azure-openai---reliability", "service": "Azure OpenAI", "services": [ - "WAF", "APIM", - "Entra" + "Entra", + "WAF" ], "severity": "High", "text": "Implement retry & healthchecks with Gateway pattern like APIM", @@ -34336,8 +34365,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/business-continuity-disaster-recovery", "service": "Azure OpenAI", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "Medium", "text": "Deploy separate fine tuned models across regions if finetuning is employed", @@ -34350,9 +34379,9 @@ "link": "https://learn.microsoft.com/azure/backup/backup-overview", "service": "Azure OpenAI", "services": [ - "WAF", + "Backup", "ASR", - "Backup" + "WAF" ], "severity": "Medium", "text": "Regularly backup and replicate critical data to ensure data availability and recoverability in case of data loss or system failures. Leverage Azure's backup and disaster recovery services to protect your data.", @@ -34404,8 +34433,8 @@ "link": "https://learn.microsoft.com/azure/search/search-security-overview", "service": "Azure OpenAI", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "High", "text": "Ensure TLS is enforced for data in transit across data sources, AI search used for Retrieval-Augmented Generation (RAG) and LLM communication", @@ -34418,8 +34447,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control", "service": "Azure OpenAI", "services": [ - "WAF", - "RBAC" + "RBAC", + "WAF" ], "severity": "High", "text": "Use RBAC to manage access to Azure OpenAI services. Assign appropriate permissions to users and restrict access based on their roles and responsibilities", @@ -34445,10 +34474,10 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-cloud-introduction", "service": "Azure OpenAI", "services": [ - "WAF", + "Monitor", "Sentinel", - "Defender", - "Monitor" + "WAF", + "Defender" ], "severity": "High", "text": "Utilize Azure Defender to detect and respond to security threats and set up monitoring and alerting mechanisms to identify suspicious activities or breaches. Leverage Azure Sentinel for advanced threat detection and response", @@ -34461,8 +34490,8 @@ "link": "https://techcommunity.microsoft.com/t5/azure-storage-blog/managing-long-term-log-retention-or-any-business-data/ba-p/2494791", "service": "Azure OpenAI", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Establish data retention and disposal policies to adhere to compliance regulations. Implement secure deletion methods for data that is no longer required and maintain an audit trail of data retention and disposal activities", @@ -34536,9 +34565,9 @@ "guid": "2bfe4564-b0d8-434a-948b-263e6dd60512", "service": "Azure OpenAI", "services": [ - "WAF", + "AzurePolicy", "RBAC", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Take segregation a step further by placing sensitive datasets in different instances of the service. Each instance can be controlled with its own specific set of RBAC policies", @@ -34563,8 +34592,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/role-based-access-control", "service": "Azure OpenAI", "services": [ - "WAF", - "RBAC" + "RBAC", + "WAF" ], "severity": "High", "text": "Apply RBAC to th data stores having embeddings and vectors and scope access based on role's access requirements", @@ -34577,8 +34606,8 @@ "link": "https://techcommunity.microsoft.com/t5/azure-architecture-blog/azure-openai-private-endpoints-connecting-across-vnet-s/ba-p/3913325", "service": "Azure OpenAI", "services": [ - "WAF", - "PrivateLink" + "PrivateLink", + "WAF" ], "severity": "High", "text": "Configure private endpoint for AI services to restrict service access within your network", @@ -34591,8 +34620,8 @@ "service": "Azure OpenAI", "services": [ "Firewall", - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "text": "Enforce strict inbound and outbound traffic control with Azure Firewall and UDRs and limit the external integration points", @@ -34630,9 +34659,9 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/managed-identity", "service": "Azure OpenAI", "services": [ + "Entra", "WAF", - "AKV", - "Entra" + "AKV" ], "severity": "High", "text": "Ensure that APIs and endpoints used by the LLM application are properly secured with authentication and authorization mechanisms, such as Managed identities, API keys or OAuth, to prevent unauthorized access.", @@ -34657,8 +34686,8 @@ "guid": "93555620-2bfe-4456-9b0d-834a348b263e", "service": "Azure OpenAI", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Implement network monitoring tools to detect and analyze network traffic for any suspicious or malicious activities. Enable logging to capture network events and facilitate forensic analysis in case of security incidents", @@ -34722,8 +34751,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/authentication", "service": "Azure OpenAI", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "High", "text": "Key access (local authentication) is recommended to be disabled for security. After disabling key based access, Microsoft Entra ID becomes the only access method, which allows maintaining minimum privilege principle and granular control. ", @@ -34736,9 +34765,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Azure OpenAI", "services": [ + "Entra", "WAF", - "AKV", - "Entra" + "AKV" ], "severity": "High", "text": "Store and manage keys securely using Azure Key Vault. Avoid hard-coding or embedding sensitive keys within your LLM application's code and retrieve them securely from Azure Key Vault using managed identities", @@ -34804,8 +34833,8 @@ "link": "https://learn.microsoft.com/legal/cognitive-services/openai/code-of-conduct", "service": "Azure OpenAI", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "High", "text": "Adhere to Azure OpenAI or other LLMs terms of use, policies and guidance and allowed use cases", @@ -34818,8 +34847,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs#base-series-and-codex-series-fine-tuned-models", "service": "Azure OpenAI", "services": [ - "WAF", - "Cost" + "Cost", + "WAF" ], "severity": "Medium", "text": "Understand difference in cost of base models and fine tuned models and token step sizes", @@ -34832,8 +34861,8 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/latency#batching", "service": "Azure OpenAI", "services": [ - "WAF", - "Cost" + "Cost", + "WAF" ], "severity": "High", "text": "Batch requests, where possible, to minimize the per-call overhead which can reduce overall costs. Ensure you optimize batch size", @@ -34846,9 +34875,9 @@ "link": "https://learn.microsoft.com/azure/ai-services/openai/how-to/manage-costs", "service": "Azure OpenAI", "services": [ - "WAF", + "Monitor", "Cost", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Set up a cost tracking system that monitors model usage and use that information to help inform model choices and prompt sizes", @@ -34887,8 +34916,8 @@ "link": "https://learn.microsoft.com/azure/search/vector-search-index-size?tabs=portal-vector-quota", "service": "Azure OpenAI", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Plan and manage AI Search Vector storage", @@ -34940,8 +34969,8 @@ "link": "https://learn.microsoft.com/azure/machine-learning/prompt-flow/concept-model-monitoring-generative-ai-evaluation-metrics?view=azureml-api-2", "service": "Azure OpenAI", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Evaluate, monitor and refine your GenAI apps for features like groundedness, relevance, accuracy, coherence, fluency, �", @@ -35031,11 +35060,11 @@ "link": "https://github.com/Azure/aoai-apim/blob/main/README.md", "service": "Azure OpenAI", "services": [ - "APIM", - "WAF", - "LoadBalancer", + "Entra", "ACR", - "Entra" + "LoadBalancer", + "APIM", + "WAF" ], "severity": "Medium", "text": "Use Load balancer solutions like APIM based gateway for balancing load and capacity across services and regions", @@ -35152,9 +35181,9 @@ "link": "https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps?tabs=azure-cli#cross-region-disaster-recovery-and-business-continuity", "service": "Container Apps", "services": [ - "WAF", + "FrontDoor", "TrafficManager", - "FrontDoor" + "WAF" ], "severity": "High", "text": "Use Front Door or Traffic Manager to route traffic to the closest region", @@ -35206,8 +35235,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-windows-hpc", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "If required for AKS Windows workloads HostProcess containers can be used", @@ -35247,8 +35276,8 @@ "link": "https://learn.microsoft.com/azure/aks/uptime-sla", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "High", "text": "Use the SLA-backed AKS offering", @@ -35261,8 +35290,8 @@ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-scheduler", "service": "AKS", "services": [ - "WAF", - "Cost" + "Cost", + "WAF" ], "severity": "Low", "text": "Use Disruption Budgets in your pod and deployment definitions", @@ -35275,8 +35304,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/container-registry-geo-replication", "service": "ACR", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "High", "text": "If using a private registry, configure region replication to store images in multiple regions", @@ -35289,8 +35318,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/aks/eslz-cost-governance-with-kubecost", "service": "AKS", "services": [ - "WAF", - "Cost" + "Cost", + "WAF" ], "severity": "Low", "text": "Use an external application such as kubecost to allocate costs to different users", @@ -35316,8 +35345,8 @@ "link": "https://learn.microsoft.com/azure/aks/gpu-multi-instance", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Medium", "text": "When required use multi-instance partitioning GPU on AKS Clusters", @@ -35344,9 +35373,9 @@ "link": "https://learn.microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes", "service": "AKS", "services": [ - "WAF", + "AzurePolicy", "AKS", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Use Azure Policy for Kubernetes to ensure cluster compliance", @@ -35386,8 +35415,8 @@ "link": "https://learn.microsoft.com/azure/container-registry/", "service": "AKS", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "Medium", "text": "Use a private registry for your images, such as ACR", @@ -35466,8 +35495,8 @@ "link": "https://learn.microsoft.com/azure/confidential-computing/confidential-nodes-aks-overview", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "If required consider using Confidential Compute for AKS", @@ -35495,8 +35524,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity", "service": "AKS", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "High", "text": "Use managed identities instead of Service Principals", @@ -35510,8 +35539,8 @@ "link": "https://learn.microsoft.com/azure/aks/managed-aad", "service": "AKS", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Integrate authentication with AAD (using the managed integration)", @@ -35537,9 +35566,9 @@ "link": "https://learn.microsoft.com/azure/aks/manage-azure-rbac", "service": "AKS", "services": [ - "WAF", + "Entra", "RBAC", - "Entra" + "WAF" ], "severity": "Medium", "text": "Integrate authorization with AAD RBAC", @@ -35552,9 +35581,9 @@ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-identity", "service": "AKS", "services": [ - "WAF", + "AKS", "RBAC", - "AKS" + "WAF" ], "severity": "High", "text": "Use namespaces for restricting RBAC privilege in Kubernetes", @@ -35567,8 +35596,8 @@ "link": "https://learn.microsoft.com/azure/aks/workload-identity-migration-sidecar", "service": "AKS", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "For Pod Identity Access Management use Azure AD Workload Identity (preview)", @@ -35581,8 +35610,8 @@ "link": "https://learn.microsoft.com/azure/aks/managed-aad#non-interactive-sign-in-with-kubelogin", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Medium", "text": "For AKS non-interactive logins use kubelogin (preview)", @@ -35596,8 +35625,8 @@ "link": "https://learn.microsoft.com/azure/aks/managed-aad#disable-local-accounts", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Medium", "text": "Disable AKS local accounts", @@ -35623,9 +35652,9 @@ "link": "https://learn.microsoft.com/azure/aks/managed-aad#use-conditional-access-with-azure-ad-and-aks", "service": "AKS", "services": [ - "WAF", + "Entra", "AKS", - "Entra" + "WAF" ], "severity": "Low", "text": "Configure if required AAD conditional access for AKS", @@ -35638,8 +35667,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-group-managed-service-accounts", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "If required for Windows AKS workloads configure gMSA ", @@ -35652,8 +35681,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-managed-identity#use-a-pre-created-kubelet-managed-identity", "service": "AKS", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "For finer control consider using a managed Kubelet Identity", @@ -35666,8 +35695,8 @@ "link": "https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-existing/", "service": "AKS", "services": [ - "WAF", "AppGW", + "WAF", "ACR" ], "severity": "Medium", @@ -35682,8 +35711,8 @@ "link": "https://learn.microsoft.com/azure/aks/http-application-routing", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "High", "text": "Do not use AKS HTTP Routing Add-On, use instead the managed NGINX ingress with the application routing add-on.", @@ -35724,8 +35753,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#add-a-node-pool-with-a-unique-subnet", "service": "AKS", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "Medium", "text": "If using Azure CNI, consider using different Subnets for NodePools", @@ -35738,9 +35767,9 @@ "link": "https://learn.microsoft.com/azure/private-link/private-link-overview", "service": "AKS", "services": [ - "WAF", + "PrivateLink", "VNet", - "PrivateLink" + "WAF" ], "severity": "Medium", "text": "Use Private Endpoints (preferred) or Virtual Network Service Endpoints to access PaaS services from the cluster", @@ -35767,8 +35796,8 @@ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", "service": "AKS", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "text": "If using Azure CNI, size your subnet accordingly considering the maximum number of pods per node", @@ -35795,9 +35824,9 @@ "link": "https://learn.microsoft.com/azure/aks/internal-lb", "service": "AKS", "services": [ - "WAF", + "AKS", "VNet", - "AKS" + "WAF" ], "severity": "Low", "text": "If using private-IP LoadBalancer services, use a dedicated subnet (not the AKS subnet)", @@ -35836,8 +35865,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-multiple-node-pools#assign-a-public-ip-per-node-for-your-node-pools", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "If required configure Public IP per node in AKS", @@ -35890,8 +35919,8 @@ "link": "https://learn.microsoft.com/azure/aks/limit-egress-traffic", "service": "AKS", "services": [ - "WAF", - "NVA" + "NVA", + "WAF" ], "severity": "High", "text": "Filter egress traffic with AzFW/NVA if your security requirements mandate it", @@ -35933,9 +35962,9 @@ "link": "https://learn.microsoft.com/azure/aks/use-network-policies", "service": "AKS", "services": [ - "WAF", + "AzurePolicy", "AKS", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "For Windows 2019 and 2022 AKS nodes Calico Network Policies can be used ", @@ -35949,9 +35978,9 @@ "link": "https://learn.microsoft.com/azure/aks/use-network-policies", "service": "AKS", "services": [ - "WAF", + "AzurePolicy", "AKS", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Enable a Kubernetes Network Policy option (Calico/Azure)", @@ -35964,9 +35993,9 @@ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-network", "service": "AKS", "services": [ - "WAF", + "AzurePolicy", "AKS", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Use Kubernetes network policies to increase intra-cluster security", @@ -35994,9 +36023,9 @@ "service": "AKS", "services": [ "DDoS", - "WAF", + "AKS", "VNet", - "AKS" + "WAF" ], "severity": "Medium", "text": "Use DDoS Standard in the AKS Virtual Network", @@ -36036,8 +36065,8 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-metric-alerts", "service": "AKS", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "High", "text": "Configure alerts on the most critical metrics (see Container Insights for recommendations)", @@ -36050,8 +36079,8 @@ "link": "https://learn.microsoft.com/azure/advisor/advisor-get-started", "service": "AKS", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Low", "text": "Check regularly Azure Advisor for recommendations on your cluster", @@ -36064,8 +36093,8 @@ "link": "https://learn.microsoft.com/azure/aks/certificate-rotation", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "Enable AKS auto-certificate rotation", @@ -36078,8 +36107,8 @@ "link": "https://learn.microsoft.com/azure/aks/supported-kubernetes-versions", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "High", "text": "Have a regular process to upgrade your kubernetes version periodically (quarterly, for example), or use the AKS autoupgrade feature", @@ -36131,8 +36160,8 @@ "link": "https://learn.microsoft.com/azure/aks/command-invoke", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "Consider using AKS command invoke on private clusters", @@ -36185,8 +36214,8 @@ "link": "https://kubernetes.io/docs/setup/release/notes/", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Medium", "text": "Do not use deprecated Kubernetes APIs in your YAML manifests", @@ -36226,8 +36255,8 @@ "link": "https://learn.microsoft.com/azure/aks/monitor-aks", "service": "AKS", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Low", "text": "Send master logs (aka API logs) to Azure Monitor or your preferred log management solution", @@ -36267,8 +36296,8 @@ "link": "https://learn.microsoft.com/azure/aks/concepts-scale", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "Consider AKS virtual node for quick bursting", @@ -36281,8 +36310,8 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/insights/container-insights-overview", "service": "AKS", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "High", "text": "Monitor your cluster metrics with Container Insights (or other tools like Prometheus)", @@ -36309,8 +36338,8 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/containers/container-insights-analyze", "service": "AKS", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Monitor CPU and memory utilization of the nodes", @@ -36323,8 +36352,8 @@ "link": "https://learn.microsoft.com/azure/aks/configure-azure-cni", "service": "AKS", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "If using Azure CNI, monitor % of pod IPs consumed per node", @@ -36338,11 +36367,11 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/premium-storage-performance", "service": "AKS", "services": [ - "EventHubs", - "WAF", "Monitor", "Storage", - "ServiceBus" + "EventHubs", + "ServiceBus", + "WAF" ], "severity": "Medium", "text": "Monitor OS disk queue depth in nodes", @@ -36355,10 +36384,10 @@ "link": "https://learn.microsoft.com/azure/aks/load-balancer-standard", "service": "AKS", "services": [ - "WAF", - "LoadBalancer", + "Monitor", "NVA", - "Monitor" + "WAF", + "LoadBalancer" ], "severity": "Medium", "text": "If not using egress filtering with AzFW/NVA, monitor standard ALB allocated SNAT ports", @@ -36371,8 +36400,8 @@ "link": "https://learn.microsoft.com/azure/aks/aks-resource-health", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Medium", "text": "Subscribe to resource health notifications for your AKS cluster", @@ -36411,8 +36440,8 @@ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits", "service": "AKS", "services": [ - "WAF", - "Subscriptions" + "Subscriptions", + "WAF" ], "severity": "High", "text": "Ensure your subscription has enough quota to scale out your nodepools", @@ -36453,8 +36482,8 @@ "link": "https://learn.microsoft.com/azure/aks/custom-node-configuration", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "Customize node configuration for AKS node pools", @@ -36494,8 +36523,8 @@ "link": "https://learn.microsoft.com/azure/aks/quotas-skus-regions#service-quotas-and-limits", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "If more than 5000 nodes are required for scalability then consider using an additional AKS cluster", @@ -36508,8 +36537,8 @@ "link": "https://learn.microsoft.com/azure/event-grid/event-schema-aks", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "Consider subscribing to EventGrid Events for AKS automation", @@ -36522,8 +36551,8 @@ "link": "https://learn.microsoft.com/azure/aks/manage-abort-operations", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "For long running operation on an AKS cluster consider event termination", @@ -36536,8 +36565,8 @@ "link": "https://learn.microsoft.com/azure/aks/use-azure-dedicated-hosts", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Low", "text": "If required consider using Azure Dedicated Hosts for AKS nodes", @@ -36564,8 +36593,8 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "High", "text": "For non-ephemeral disks, use high IOPS and larger OS disks for the nodes when running many pods/node since it requires high performance for running multiple pods and will generate huge logs with default AKS log rotation thresholds", @@ -36578,9 +36607,9 @@ "link": "https://learn.microsoft.com/azure/aks/use-ultra-disks", "service": "AKS", "services": [ - "WAF", + "AKS", "Storage", - "AKS" + "WAF" ], "severity": "Low", "text": "For hyper performance storage option use Ultra Disks on AKS", @@ -36594,8 +36623,8 @@ "service": "AKS", "services": [ "SQL", - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Avoid keeping state in the cluster, and store data outside (AzStorage, AzSQL, Cosmos, etc)", @@ -36608,8 +36637,8 @@ "link": "https://learn.microsoft.com/azure/aks/operator-best-practices-storage", "service": "AKS", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "If using AzFiles Standard, consider AzFiles Premium and/or ANF for performance reasons", @@ -36622,8 +36651,8 @@ "link": "https://learn.microsoft.com/azure/aks/availability-zones#azure-disk-availability-zone-support", "service": "AKS", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "If using Azure Disks and AZs, consider having nodepools within a zone for LRS disk with VolumeBindingMode:WaitForFirstConsumer for provisioning storage in right zone or use ZRS disk for nodepools spanning multiple zones", @@ -36636,8 +36665,8 @@ "link": "https://learn.microsoft.com/azure/architecture/guide/multitenant/considerations/tenancy-models", "service": "Azure Monitor", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Data collection rules in Azure Monitor -https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview", @@ -36651,8 +36680,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/multi-tenant/automation", "service": "Azure Backup", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "check backup instances with the underlying datasource not found", @@ -36678,10 +36707,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-microsoft-customer-agreement#design-recommendations", "service": "Azure Backup", "services": [ - "WAF", - "Storage", + "Backup", "ASR", - "Backup" + "Storage", + "WAF" ], "severity": "Medium", "text": "Consider a good balance between site recovery storage and backup for non mission critical applications", @@ -36694,8 +36723,8 @@ "link": "https://learn.microsoft.com/azure/cost-management-billing/manage/direct-ea-administration#manage-notification-contacts", "service": "Azure Monitor", "services": [ - "WAF", - "Monitor" + "Monitor", + "WAF" ], "severity": "Medium", "text": "Check spending and savings opportunities among the 40 different log analytics workspaces- use different retention and data collection for nonprod workspaces-create daily cap for awareness and tier sizing - If you do set a daily cap, in addition to creating an alert when the cap is reached,ensure that you also create an alert rule to be notified when some percentage has been reached (90% for example). - consider workspace transformation if possible - https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-transformations#workspace-transformation-dcr ", @@ -36709,9 +36738,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "service": "Azure Monitor", "services": [ - "WAF", + "AzurePolicy", "Storage", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Enforce a purging log policy and automation (if needed, logs can be moved to cold storage)", @@ -36725,9 +36754,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "service": "VM", "services": [ - "WAF", + "Backup", "Storage", - "Backup" + "WAF" ], "severity": "Medium", "text": "Check that the disks are really needed, if not: delete. If they are needed, find lower storage tiers or use backup -", @@ -36741,9 +36770,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/azure-billing-enterprise-agreement#design-considerations", "service": "Storage", "services": [ - "WAF", + "AzurePolicy", "Storage", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Consider moving unused storage to lower tier, with customized rule - https://learn.microsoft.com/azure/storage/blobs/lifecycle-management-policy-configure ", @@ -36757,8 +36786,8 @@ "link": "https://learn.microsoft.com/azure/governance/policy/overview", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "Make sure advisor is configured for VM right sizing ", @@ -36772,10 +36801,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/manage/centralize-operations", "service": "VM", "services": [ - "VM", - "WAF", + "AzurePolicy", "Cost", - "AzurePolicy" + "WAF", + "VM" ], "severity": "Medium", "text": "run the script on all windows VMs https://learn.microsoft.com/azure/virtual-machines/windows/hybrid-use-benefit-licensing?ref=andrewmatveychuk.com#convert-an-existing-vm-using-azure-hybrid-benefit-for-windows-server- consider implementing a policy if windows VMs are created frequently", @@ -36802,8 +36831,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "Consolidate reserved VM families with flexibility option (no more than 4-5 families)", @@ -36817,10 +36846,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access#prerequisites-for-a-landing-zone---design-recommendations", "service": "VM", "services": [ - "VM", - "WAF", + "Cost", "ARS", - "Cost" + "WAF", + "VM" ], "severity": "Medium", "text": "Utilize Azure Reserved Instances: This feature allows you to reserve VMs for a period of 1 or 3 years, providing significant cost savings compared to PAYG prices.", @@ -36859,10 +36888,10 @@ "link": "https://learn.microsoft.com/azure/active-directory/app-proxy/application-proxy", "service": "Azure SQL", "services": [ + "AzurePolicy", "SQL", - "WAF", "Cost", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Check if applicable and enforce policy/change https://learn.microsoft.com/azure/azure-sql/azure-hybrid-benefit?view=azuresql&tabs=azure-portalhttps://learn.microsoft.com/azure/cost-management-billing/scope-level/create-sql-license-assignments?source=recommendations", @@ -36875,8 +36904,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/roles/best-practices", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "The VM + license part discount (ahub + 3YRI) is around 70% discount", @@ -36889,8 +36918,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-best-practices#send-logs-to-microsoft-sentinel", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "Consider using a VMSS to match demand rather than flat sizing", @@ -36903,8 +36932,8 @@ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", "service": "AKS", "services": [ - "WAF", - "AKS" + "AKS", + "WAF" ], "severity": "Medium", "text": "Use AKS autoscaler to match your clusters usage (make sure the pods requirements match the scaler)", @@ -36974,8 +37003,8 @@ "link": "https://learn.microsoft.com/azure/network-watcher/network-watcher-monitoring-overview", "service": "Azure Functions", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Functions - Cold starts-Use the 'Run from package' functionality. This way, the code is downloaded as a single zip file. This can, for example, result in significant improvements with Javascript functions, which have a lot of node modules.Use language specific tools to reduce the package size, for example, tree shaking Javascript applications.", @@ -37043,8 +37072,8 @@ "service": "Front Door", "services": [ "EventHubs", - "WAF", - "FrontDoor" + "FrontDoor", + "WAF" ], "severity": "Medium", "text": "Frontdoor - Turn off the default homepageIn the application settings of your App, set AzureWebJobsDisableHomepage to true. This will return a 204 (No Content) to the PoP so only header data is returned.", @@ -37057,9 +37086,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-setup-guide/monitoring-reporting?tabs=AzureMonitor", "service": "Front Door", "services": [ - "WAF", + "AppSvc", "FrontDoor", - "AppSvc" + "WAF" ], "severity": "Medium", "text": "Frontdoor - Route to something that returns nothing. Either set up a Function, Function Proxy, or add a route in your WebApp that returns 200 (OK) and sends no or minimal content. The advantage of this is you will be able to log out when it is called.", @@ -37111,8 +37140,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-operational-compliance#monitoring-for-configuration-drift", "service": "Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "For storage accounts, make sure that the chosen tier is not adding up transaction charges (it might be cheaper to move to the next tier)", @@ -37125,8 +37154,8 @@ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", "service": "Site Recovery", "services": [ - "WAF", - "ASR" + "ASR", + "WAF" ], "severity": "Medium", "text": "For ASR, consider using Standard SSD disks if the RPO/RTO and replication throughput allow it", @@ -37139,8 +37168,8 @@ "link": "https://learn.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery", "service": "Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Storage accounts: check hot tier and/or GRS necessary", @@ -37167,9 +37196,9 @@ "service": "Synapse", "services": [ "EventHubs", - "WAF", + "Monitor", "Cost", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Create budgets to manage costs and create alerts that automatically notify stakeholders of spending anomalies and overspending risks.", @@ -37182,9 +37211,9 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/availability", "service": "Synapse", "services": [ - "WAF", + "Cost", "Storage", - "Cost" + "WAF" ], "severity": "Medium", "text": "Export cost data to a storage account for additional data analysis.", @@ -37197,9 +37226,9 @@ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", "service": "Synapse", "services": [ + "Cost", "SQL", - "WAF", - "Cost" + "WAF" ], "severity": "Medium", "text": "Control costs for a dedicated SQL pool by pausing the resource when it is not in use.", @@ -37238,8 +37267,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups#management-groups-in-the-azure-landing-zone-accelerator", "service": "Synapse", "services": [ - "WAF", - "Cost" + "Cost", + "WAF" ], "severity": "Medium", "text": "Purchase Azure Synapse commit units (SCU) for one year with a pre-purchase plan to save on your Azure Synapse Analytics costs.", @@ -37253,9 +37282,9 @@ "link": "https://learn.microsoft.com/azure/application-gateway/overview-v2", "service": "VM", "services": [ - "VM", + "Cost", "WAF", - "Cost" + "VM" ], "severity": "Medium", "text": "Use Spot VMs for interruptible jobs: These are VMs that can be bid on and purchased at a discounted price, providing a cost-effective solution for non-critical workloads.", @@ -37269,8 +37298,8 @@ "link": "https://learn.microsoft.com/azure/load-balancer/load-balancer-overview", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "Right-sizing all VMs", @@ -37283,8 +37312,8 @@ "link": "https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "Swap VM sized with normalized and most recent sizes", @@ -37298,9 +37327,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "VM", "services": [ - "VM", + "Monitor", "WAF", - "Monitor" + "VM" ], "severity": "Medium", "text": "right-sizing VMs - start with monitoring usage below 5% and then work up to 40%", @@ -37314,8 +37343,8 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "Containerizing an application can improve VM density and save money on scaling it", @@ -37368,8 +37397,8 @@ "link": "https://learn.microsoft.com/azure/search/search-reliability#multiple-services-in-separate-geographic-regions", "service": "Cognitive Search", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "Medium", "text": "For regional redudancy, Manually create services in 2 or more regions for Search as it doesn't provide an automated method of replicating search indexes across geographic regions", @@ -37382,8 +37411,8 @@ "link": "https://learn.microsoft.com/azure/search/search-reliability#synchronize-data-across-multiple-services", "service": "Cognitive Search", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "Medium", "text": "To synchronize data across multiple services either Use indexers for updating content on multiple services or Use REST APIs for pushing content updates on multiple services", @@ -37396,8 +37425,8 @@ "link": "https://learn.microsoft.com/azure/search/search-reliability#use-azure-traffic-manager-to-coordinate-requests", "service": "Cognitive Search", "services": [ - "WAF", - "TrafficManager" + "TrafficManager", + "WAF" ], "severity": "Medium", "text": "Use Azure Traffic Manager to coordinate requests", @@ -37410,9 +37439,9 @@ "link": "https://learn.microsoft.com/azure/search/search-reliability#back-up-and-restore-alternatives", "service": "Cognitive Search", "services": [ - "WAF", + "Backup", "Storage", - "Backup" + "WAF" ], "severity": "High", "text": "Backup and Restore an Azure Cognitive Search Index. Use this sample code to back up index definition and snapshot to a series of Json files", @@ -37426,9 +37455,9 @@ "link": "https://learn.microsoft.com/azure/data-explorer/kusto/management/data-export/continuous-data-export", "service": "Azure Data Explorer", "services": [ - "WAF", + "Cost", "Storage", - "Cost" + "WAF" ], "text": "Leverage External Tables and Continuous data export overview to reduce costs", "waf": "Reliability" @@ -37441,8 +37470,8 @@ "link": "https://learn.microsoft.com/azure/data-explorer/follower?tabs=csharp", "service": "Azure Data Explorer", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "text": "To share data, explore Leader-follower cluster configuration", "waf": "Reliability" @@ -37455,8 +37484,8 @@ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#create-multiple-independent-clusters", "service": "Azure Data Explorer", "services": [ - "WAF", - "ASR" + "ASR", + "WAF" ], "text": "To protect against regional failure, create Multiple independent clusters, preferably in two Azure Paired regions", "waf": "Reliability" @@ -37468,9 +37497,9 @@ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-create-solution#replicate-management-activities", "service": "Azure Data Explorer", "services": [ - "WAF", + "RBAC", "Storage", - "RBAC" + "WAF" ], "text": "Replicate all management activities such as creating new tables or managing user roles on each cluster.", "waf": "Reliability" @@ -37495,8 +37524,8 @@ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-active-configuration", "service": "Azure Data Explorer", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "text": "For critical application with no tolerance for outages, create Active-Active-Active (always-on) configuration", "waf": "Reliability" @@ -37509,8 +37538,8 @@ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#active-active-configuration", "service": "Azure Data Explorer", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "text": "For critical applications, create Active-Active configuration in two paired regions", "waf": "Reliability" @@ -37536,11 +37565,11 @@ "link": "https://learn.microsoft.com/azure/data-explorer/business-continuity-overview#on-demand-data-recovery-configuration", "service": "Azure Data Explorer", "services": [ + "Cost", "ASR", - "WAF", "Storage", "AzurePolicy", - "Cost" + "WAF" ], "text": "For applications, where cost is a concern and can withstand some downtime during failure, create on-demand data recovery cluster configuration", "waf": "Reliability" @@ -37553,8 +37582,8 @@ "link": "https://learn.microsoft.com/azure/data-explorer/devops", "service": "Azure Data Explorer", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "text": "Wrap DevOps and source control around all your code", "training": "https://learn.microsoft.com/learn/paths/secure-your-cloud-data/", @@ -37592,8 +37621,8 @@ "link": "https://learn.microsoft.com/entra/identity-platform/msal-acquire-cache-tokens", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Use long-live revocable token, cache your token and acquire your silently using Microsoft Identity Library", @@ -37641,8 +37670,8 @@ "link": "https://azure.microsoft.com/blog/setting-up-active-directory-for-a-disaster-recovery-environment-2/", "service": "Windows AD", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "Follow VM rules for high availability on the VM level (premium disks, two or more in a region, in different availability zones)", @@ -37678,8 +37707,8 @@ "link": "https://learn.microsoft.com/entra/identity/domain-services/tutorial-perform-disaster-recovery-drill", "service": "Entra", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Add Azure AD Domain service stamps to additional regions and locations", @@ -37744,8 +37773,8 @@ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#multiple-write-regions", "service": "CosmosDB", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "Medium", "text": "Leverage Multi-Region Writes", @@ -37759,8 +37788,8 @@ "link": "https://learn.microsoft.com/azure/cosmos-db/high-availability#slas", "service": "CosmosDB", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "Medium", "text": "Distribute your data globally", @@ -37788,8 +37817,8 @@ "link": "https://learn.microsoft.com/azure/cosmos-db/how-to-manage-database-account#automatic-failover", "service": "CosmosDB", "services": [ - "WAF", - "CosmosDB" + "CosmosDB", + "WAF" ], "severity": "Medium", "text": "Enable Service managed failover", @@ -37803,10 +37832,10 @@ "link": "https://learn.microsoft.com/azure/cosmos-db/online-backup-and-restore", "service": "CosmosDB", "services": [ - "WAF", "CosmosDB", + "Backup", "Storage", - "Backup" + "WAF" ], "severity": "Medium", "text": "Enable Automatic Backups", @@ -37821,8 +37850,8 @@ "link": "https://learn.microsoft.com/azure/cosmos-db/periodic-backup-restore-introduction", "service": "CosmosDB", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Perform Periodic Backups", @@ -37837,9 +37866,9 @@ "link": "https://learn.microsoft.com/azure/cosmos-db/continuous-backup-restore-introduction", "service": "CosmosDB", "services": [ - "WAF", "CosmosDB", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Continous Backup with point-in-time restore in Azure Cosmos DB", @@ -37852,8 +37881,8 @@ "link": "https://learn.microsoft.com/azure/sap/center-sap-solutions/overview", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Azure Center for SAP solutions (ACSS) is an Azure offering that makes SAP a top-level workload on Azure. ACSS is an end-to-end solution that enables you to create and run SAP systems as a unified workload on Azure and provides a more seamless foundation for innovation. You can take advantage of the management capabilities for both new and existing Azure-based SAP systems.", @@ -37866,8 +37895,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-platform-automation-and-devops", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Azure supports automating SAP deployments in Linux and Windows. SAP Deployment Automation Framework is an open-source orchestration tool that can deploy, install, and maintain SAP environments.", @@ -37880,8 +37909,8 @@ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/data-platform", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Perform a point-in-time recovery for your production databases at any point and in a time frame that meets your RTO; point-in-time recovery typically includes operator errors deleting data either on the DBMS layer or through SAP, incidentally", @@ -37892,8 +37921,8 @@ "guid": "c4b8e117-930b-4dbd-ae50-7bc5faf6f91a", "service": "SAP", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Test the backup and recovery times to verify that they meet your RTO requirements for restoring all systems simultaneously after a disaster.", @@ -37905,12 +37934,12 @@ "link": "https://learn.microsoft.com/azure/reliability/cross-region-replication-azure", "service": "SAP", "services": [ - "ASR", - "WAF", - "Storage", + "Backup", "SQL", + "ASR", + "Storage", "SAP", - "Backup" + "WAF" ], "severity": "High", "text": "You can replicate standard storage between paired regions, but you can't use standard storage to store your databases or virtual hard disks. You can replicate backups only between paired regions that you use. For all your other data, run your replication by using native DBMS features like SQL Server Always On or SAP HANA System Replication. Use a combination of Site Recovery, rsync or robocopy, and other third-party software for the SAP application layer.", @@ -37923,8 +37952,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "When using Azure Availability Zones to achieve high availability, you must consider latency between SAP application servers and database servers. For zones with high latencies, operational procedures need to be in place to ensure that SAP application servers and database servers are running in the same zone at all times.", @@ -37937,9 +37966,9 @@ "link": "https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", "service": "SAP", "services": [ - "WAF", "ExpressRoute", "ASR", + "WAF", "VPN" ], "severity": "High", @@ -37953,9 +37982,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", "service": "SAP", "services": [ + "ACR", "WAF", - "AKV", - "ACR" + "AKV" ], "severity": "Low", "text": "Replicate key vault contents like certificates, secrets, or keys across regions so you can decrypt data in the DR region.", @@ -37967,10 +37996,10 @@ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-s4hana", "service": "SAP", "services": [ - "WAF", + "SAP", "ASR", "VNet", - "SAP" + "WAF" ], "severity": "Medium", "text": "Peer the primary and disaster recovery virtual networks. For example, for HANA System Replication, an SAP HANA DB virtual network needs to be peered to the disaster recovery site's SAP HANA DB virtual network.", @@ -37982,9 +38011,9 @@ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-service-levels", "service": "SAP", "services": [ - "WAF", + "SAP", "Storage", - "SAP" + "WAF" ], "severity": "Low", "text": "If you use Azure NetApp Files storage for your SAP deployments, at a minimum, create two Azure NetApp Files accounts in the Premium tier, in two regions.", @@ -38010,8 +38039,8 @@ "link": "https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-faq", "service": "SAP", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "High", "text": "The CIDR for the primary virtual network (VNet) shouldn't conflict or overlap with the CIDR of the DR site's VNet", @@ -38023,10 +38052,10 @@ "guid": "0258ed30-fe42-434f-87b9-58f91f908e0a", "service": "SAP", "services": [ - "VM", - "WAF", + "Entra", "ASR", - "Entra" + "WAF", + "VM" ], "severity": "High", "text": "Use Site Recovery to replicate an application server to a DR site. Site Recovery can also help with replicating central-services cluster VMs to the DR site. When you invoke DR, you'll need to reconfigure the Linux Pacemaker cluster on the DR site (for example, replace the VIP or SBD, run corosync.conf, and more).", @@ -38039,8 +38068,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "High", "text": "Consider the availability of SAP software against single points of failure. This includes single points of failure within applications such as DBMSs utilized in SAP NetWeaver and SAP S/4HANA architectures, SAP ABAP and ASCS + SCS. Also, other tools such as SAP Web Dispatcher.", @@ -38053,8 +38082,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-supported-configurations", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "High", "text": "For SAP and SAP databases, consider implementing automatic failover clusters. In Windows, Windows Server Failover Clustering supports failover. In Linux, Linux Pacemaker or third-party tools like SIOS Protection Suite and Veritas InfoScale support failover.", @@ -38067,9 +38096,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows", "service": "SAP", "services": [ - "VM", + "Storage", "WAF", - "Storage" + "VM" ], "severity": "High", "text": "Azure doesn't support architectures in which the primary and secondary VMs share storage for DBMS data. For the DBMS layer, the common architecture pattern is to replicate databases at the same time and with different storage stacks than the ones that the primary and secondary VMs use.", @@ -38082,9 +38111,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/dbms-guide-general", "service": "SAP", "services": [ - "WAF", + "SAP", "Storage", - "SAP" + "WAF" ], "severity": "High", "text": "The DBMS data and transaction/redo log files are stored in Azure supported block storage or Azure NetApp Files. Azure Files or Azure Premium Files isn't supported as storage for DBMS data and/or redo log files with SAP workload.", @@ -38097,8 +38126,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/sap-high-availability-guide-wsfc-shared-disk", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "High", "text": "You can use Azure shared disks in Windows for ASCS + SCS components and specific high-availability scenarios. Set up your failover clusters separately for SAP application layer components and the DBMS layer. Azure doesn't currently support high-availability architectures that combine SAP application layer components and the DBMS layer into one failover cluster.", @@ -38111,8 +38140,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-standard-load-balancer-outbound-connections", "service": "SAP", "services": [ - "WAF", "SAP", + "WAF", "LoadBalancer" ], "severity": "High", @@ -38153,10 +38182,10 @@ "link": "https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services?lang=1", "service": "SAP", "services": [ - "VM", - "WAF", + "Entra", "SAP", - "Entra" + "WAF", + "VM" ], "severity": "High", "text": "If you want to meet the infrastructure SLAs for your applications for SAP components (central services, application servers, and databases), you must choose the same high availability options (VMs, availability sets, availability zones) for all components.", @@ -38168,10 +38197,10 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", "service": "SAP", "services": [ - "VM", - "WAF", + "Entra", "RBAC", - "Entra" + "WAF", + "VM" ], "severity": "High", "text": "Do not mix servers of different roles in the same availability set. Keep central services VMs, database VMs, application VMs in their own availability sets", @@ -38197,8 +38226,8 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", "service": "SAP", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "High", "text": "When you create availability sets, use the maximum number of fault domains and update domains available. For example, if you deploy more than two VMs in one availability set, use the maximum number of fault domains (three) and enough update domains to limit the effect of potential physical hardware failures, network outages, or power interruptions, in addition to Azure planned maintenance. The default number of fault domains is two, and you can't change it online later.", @@ -38211,9 +38240,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", "service": "SAP", "services": [ - "WAF", + "Entra", "SAP", - "Entra" + "WAF" ], "severity": "High", "text": "When you use Azure proximity placement groups in an availability set deployment, all three SAP components (central services, application server, and database) should be in the same proximity placement group.", @@ -38225,8 +38254,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", "service": "SAP", "services": [ - "WAF", "SAP", + "WAF", "ACR" ], "severity": "High", @@ -38239,9 +38268,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", "service": "SAP", "services": [ - "WAF", + "Entra", "SAP", - "Entra" + "WAF" ], "severity": "High", "text": "Use one of the following services to run SAP central services clusters, depending on the operating system.", @@ -38254,9 +38283,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-suse-multi-sid", "service": "SAP", "services": [ - "VM", + "Entra", "WAF", - "Entra" + "VM" ], "severity": "Medium", "text": "Azure doesn't currently support combining ASCS and DB HA in the same Linux Pacemaker cluster; separate them into individual clusters. However, you can combine up to five multiple central-services clusters into a pair of VMs.", @@ -38269,9 +38298,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-business-continuity-and-disaster-recovery", "service": "SAP", "services": [ - "VM", + "Storage", "WAF", - "Storage" + "VM" ], "severity": "Medium", "text": "Deploy both VMs in the high-availability pair in an availability set or in availability zones. These VMs should be the same size and have the same storage configuration.", @@ -38283,8 +38312,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-with-hana-ascs-ers-dialog-instance", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Azure supports installing and configuring SAP HANA and ASCS/SCS and ERS instances on the same high availability cluster running on Red Hat Enterprise Linux (RHEL).", @@ -38297,8 +38326,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", "service": "SAP", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "High", "text": "Run all production systems on Premium managed SSDs and use Azure NetApp Files or Ultra Disk Storage. At least the OS disk should be on the Premium tier so you can achieve better performance and the best SLA.", @@ -38311,9 +38340,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-operations-storage", "service": "SAP", "services": [ - "WAF", + "SAP", "Storage", - "SAP" + "WAF" ], "severity": "High", "text": "You should run SAP HANA on Azure only on the types of storage that are certified by SAP. Note that certain volumes must be run on certain disk configurations, where applicable. These configurations include enabling Write Accelerator and using Premium storage. You also need to ensure that the file system that runs on storage is compatible with the DBMS that runs on the machine.", @@ -38326,10 +38355,10 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/disaster-recovery-overview-guide#storage", "service": "SAP", "services": [ - "WAF", - "Storage", + "SAP", "ASR", - "SAP" + "Storage", + "WAF" ], "severity": "High", "text": "Consider configuring high availability depending on the type of storage you use for your SAP workloads. Some storage services available in Azure are not supported by Azure Site Recovery, so your high availability configuration may differ.", @@ -38342,9 +38371,9 @@ "link": "https://azure.microsoft.com/ja-jp/explore/global-infrastructure/products-by-region/", "service": "SAP", "services": [ - "WAF", + "SAP", "Storage", - "SAP" + "WAF" ], "severity": "High", "text": "Different native Azure storage services (like Azure Files, Azure NetApp Files, Azure Shared Disk) may not be available in all regions. So to have similar SAP setup on the DR region after failover, ensure the respective storage service is offered in DR site.", @@ -38356,9 +38385,9 @@ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/optimize-your-azure-costs-by-automating-sap-system-start-stop/ba-p/2120675", "service": "SAP", "services": [ - "WAF", "Cost", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Automate SAP System Start-Stop to manage costs.", @@ -38370,11 +38399,11 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", "service": "SAP", "services": [ - "WAF", - "VM", - "Storage", "Cost", - "SAP" + "Storage", + "VM", + "SAP", + "WAF" ], "severity": "Low", "text": "In the case of using Azure Premium Storage with SAP HANA, Azure Standard SSD storage can be used to select a cost-conscious storage solution. However, please note that choosing Standard SSD or Standard HDD Azure storage will affect the SLA of the individual VMs. Also, for systems with lower I/O throughput and low latency, such as non-production environments, lower series VMs can be used.", @@ -38386,11 +38415,11 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/hana-vm-premium-ssd-v1", "service": "SAP", "services": [ - "WAF", - "VM", - "Storage", "Cost", - "SAP" + "Storage", + "VM", + "SAP", + "WAF" ], "severity": "Low", "text": "As a lower-cost alternative configuration (multipurpose), you can choose a low-performance SKU for your non-production HANA database server VMs. However, it is important to note that some VM types, such as E-series, are not HANA certified (SAP HANA Hardware Directory) or cannot achieve storage latency of less than 1ms.", @@ -38402,9 +38431,9 @@ "link": "https://learn.microsoft.com/azure/well-architected/sap/design-areas/security", "service": "SAP", "services": [ - "WAF", + "RBAC", "Subscriptions", - "RBAC" + "WAF" ], "severity": "High", "text": "Enforce a RBAC model for management groups, subscriptions, resource groups and resources", @@ -38417,9 +38446,9 @@ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", "service": "SAP", "services": [ - "WAF", + "Entra", "SAP", - "Entra" + "WAF" ], "severity": "Medium", "text": "Enforce Principal propagation for forwarding the identity from SAP cloud application to SAP on-premises (Including IaaS) through cloud connector", @@ -38432,9 +38461,9 @@ "link": "https://learn.microsoft.com/azure/active-directory/fundamentals/scenario-azure-first-sap-identity-integration", "service": "SAP", "services": [ - "WAF", + "Entra", "SAP", - "Entra" + "WAF" ], "severity": "Medium", "text": "Implement SSO to SAP SaaS applications like SAP Analytics Cloud, SAP Cloud Platform, Business by design, SAP Qualtrics and SAP C4C with Azure AD using SAML.", @@ -38446,8 +38475,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", @@ -38459,8 +38488,8 @@ "guid": "9eb54dad-7861-4e1c-973a-f3bb003fc9c1", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Implement SSO to SAP NetWeaver-based web applications like SAP Fiori and SAP Web GUI by using SAML.", @@ -38473,8 +38502,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "You can implement SSO to SAP GUI by using SAP NetWeaver SSO or a partner solution.", @@ -38486,9 +38515,9 @@ "guid": "23181aa4-1742-4694-9ff8-ae7d7d474317", "service": "SAP", "services": [ + "SAP", "WAF", - "AKV", - "SAP" + "AKV" ], "severity": "Medium", "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", @@ -38501,9 +38530,9 @@ "link": "https://blogs.sap.com/2017/07/12/sap-single-sign-on-protect-your-sap-landscape-with-x.509-certificates/", "service": "SAP", "services": [ + "SAP", "WAF", - "AKV", - "SAP" + "AKV" ], "severity": "Medium", "text": "For SSO for SAP GUI and web browser access, implement SNC / Kerberos/SPNEGO (simple and protected GSSAPI negotiation mechanism) due to its ease of configuration and maintenance. For SSO with X.509 client certificates, consider the SAP Secure Login Server, which is a component of the SAP SSO solution.", @@ -38515,8 +38544,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-netweaver-tutorial#configure-sap-netweaver-for-oauth", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Implement SSO by using OAuth for SAP NetWeaver to allow third-party or custom applications to access SAP NetWeaver OData services.", @@ -38528,8 +38557,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/saphana-tutorial", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Implement SSO to SAP HANA", @@ -38541,9 +38570,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration#connectivity-with-sap-rise", "service": "SAP", "services": [ - "WAF", + "Entra", "SAP", - "Entra" + "WAF" ], "severity": "Medium", "text": "Consider Azure AD an identity provider for SAP systems hosted on RISE. For more information, see Integrating the Service with Azure AD.", @@ -38555,8 +38584,8 @@ "link": "https://github.com/azuredevcollege/SAP/blob/master/sap-oauth-saml-flow/README.md", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "For applications that access SAP, you might want to use principal propagation to establish SSO.", @@ -38568,9 +38597,9 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial", "service": "SAP", "services": [ - "WAF", + "Entra", "SAP", - "Entra" + "WAF" ], "severity": "Medium", "text": "If you're using SAP BTP services or SaaS solutions that require SAP Identity Authentication Service (IAS), consider implementing SSO between SAP Cloud Identity Authentication Services and Azure AD to access those SAP services. This integration lets SAP IAS act as a proxy identity provider and forwards authentication requests to Azure AD as the central user store and identity provider.", @@ -38582,8 +38611,8 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-hana-cloud-platform-tutorial", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Implement SSO to SAP BTP", @@ -38595,9 +38624,9 @@ "link": "https://learn.microsoft.com/azure/active-directory/saas-apps/sap-successfactors-inbound-provisioning-cloud-only-tutorial", "service": "SAP", "services": [ - "WAF", + "Entra", "SAP", - "Entra" + "WAF" ], "severity": "Medium", "text": "If you're using SAP SuccessFactors, consider using the Azure AD automated user provisioning. With this integration, as you add new employees to SAP SuccessFactors, you can automatically create their user accounts in Azure AD. Optionally, you can create user accounts in Microsoft 365 or other SaaS applications that are supported by Azure AD. Use write-back of the email address to SAP SuccessFactors.", @@ -38609,10 +38638,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups", "service": "SAP", "services": [ - "WAF", - "Subscriptions", + "AzurePolicy", "SAP", - "AzurePolicy" + "Subscriptions", + "WAF" ], "severity": "Medium", "text": "enforce existing Management Group policies to SAP Subscriptions", @@ -38625,9 +38654,9 @@ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", "service": "SAP", "services": [ - "WAF", + "SAP", "Subscriptions", - "SAP" + "WAF" ], "severity": "High", "text": "Integrate tightly coupled applications into the same SAP subscription to avoid additional routing and management complexity", @@ -38640,8 +38669,8 @@ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", "service": "SAP", "services": [ - "WAF", - "Subscriptions" + "Subscriptions", + "WAF" ], "severity": "High", "text": "Leverage Subscription as scale unit and scaling our resources, consider deploying subscription per environment eg. Sandbox, non-prod, prod ", @@ -38654,9 +38683,9 @@ "link": "https://learn.microsoft.com/azure/quotas/quotas-overview", "service": "SAP", "services": [ - "VM", + "Subscriptions", "WAF", - "Subscriptions" + "VM" ], "severity": "High", "text": "Ensure quota increase as a part of subscription provisioning (e.g. total available VM cores within a subscription)", @@ -38681,9 +38710,9 @@ "link": "https://learn.microsoft.com/azure/quotas/quickstart-increase-quota-portal", "service": "SAP", "services": [ - "VM", + "Subscriptions", "WAF", - "Subscriptions" + "VM" ], "severity": "High", "text": "If deploying to an availability zone, ensure that the VM's zone deployment is available once the quota has been approved. Submit a support request with the subscription, VM series, number of CPUs and availability zone required.", @@ -38708,9 +38737,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-resource-organization", "service": "SAP", "services": [ - "WAF", + "Cost", "TrafficManager", - "Cost" + "WAF" ], "severity": "Medium", "text": "Leverage Azure resource tag for cost categorization and resource grouping (: BillTo, Department (or Business Unit), Environment (Production, Stage, Development), Tier (Web Tier, Application Tier), Application Owner, ProjectName)", @@ -38723,8 +38752,8 @@ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", "service": "SAP", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "High", "text": "Help protect your HANA database by using the Azure Backup service.", @@ -38737,10 +38766,10 @@ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azacsnap-introduction", "service": "SAP", "services": [ - "VM", - "WAF", + "Entra", "Storage", - "Entra" + "WAF", + "VM" ], "severity": "Medium", "text": "If you deploy Azure NetApp Files for your HANA, Oracle, or DB2 database, use the Azure Application Consistent Snapshot tool (AzAcSnap) to take application-consistent snapshots. AzAcSnap also supports Oracle databases. Consider using AzAcSnap on a central VM rather than on individual VMs.", @@ -38752,8 +38781,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "High", "text": "Ensure time-zone matches between the operating system and the SAP system.", @@ -38765,8 +38794,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-guide-rhel-multi-sid", "service": "SAP", "services": [ - "WAF", - "Entra" + "Entra", + "WAF" ], "severity": "Medium", "text": "Don't group different application services in the same cluster. For example, don't combine DRBD and central services clusters on the same cluster. However, you can use the same Pacemaker cluster to manage approximately five different central services (multi-SID cluster).", @@ -38779,8 +38808,8 @@ "link": "https://azure.microsoft.com/pricing/offers/dev-test/", "service": "SAP", "services": [ - "WAF", - "Cost" + "Cost", + "WAF" ], "severity": "Low", "text": "Consider running dev/test systems in a snooze model to save and optimize Azure run costs.", @@ -38792,9 +38821,9 @@ "link": "https://learn.microsoft.com/azure/lighthouse/overview", "service": "SAP", "services": [ - "WAF", + "Entra", "SAP", - "Entra" + "WAF" ], "severity": "Medium", "text": "If you partner with customers by managing their SAP estates, consider Azure Lighthouse. Azure Lighthouse allows managed service providers to use Azure native identity services to authenticate to the customers' environment. It puts the control in the hands of customers, because they can revoke access at any time and audit service providers' actions.", @@ -38806,8 +38835,8 @@ "link": "https://learn.microsoft.com/azure/update-manager/scheduled-patching?tabs=schedule-updates-single-machine%2Cschedule-updates-scale-overview", "service": "SAP", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "Use Azure Update Manager to check the status of available updates for a single VM or multiple VMs and consider scheduling regular patching.", @@ -38820,8 +38849,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/lama-installation", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Low", "text": "Optimize and manage SAP Basis operations by using SAP Landscape Management (LaMa). Use the SAP LaMa connector for Azure to relocate, copy, clone, and refresh SAP systems.", @@ -38834,10 +38863,10 @@ "link": "https://learn.microsoft.com/azure/sap/monitor/about-azure-monitor-sap-solutions", "service": "SAP", "services": [ + "Monitor", "SQL", - "WAF", "SAP", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Use Azure Monitor for SAP solutions to monitor your SAP workloads(SAP HANA, high-availability SUSE clusters, and SQL systems) on Azure. Consider supplementing Azure Monitor for SAP solutions with SAP Solution Manager.", @@ -38850,11 +38879,11 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/vm-extension-for-sap", "service": "SAP", "services": [ - "WAF", + "Entra", "Monitor", "VM", - "Entra", - "SAP" + "SAP", + "WAF" ], "severity": "High", "text": "Run a VM Extension for SAP check. VM Extension for SAP uses the assigned managed identity of a virtual machine (VM) to access VM monitoring and configuration data. The check ensures that all performance metrics in your SAP application come from the underlying Azure Extension for SAP.", @@ -38867,8 +38896,8 @@ "link": "https://learn.microsoft.com/azure/azure-monitor/logs/design-logs-deployment", "service": "SAP", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Medium", "text": "Use Azure Policy for access control and compliance reporting. Azure Policy provides the ability to enforce organization-wide settings to ensure consistent policy adherence and fast violation detection. ", @@ -38881,10 +38910,10 @@ "link": "https://learn.microsoft.com/azure/network-watcher/connection-monitor-overview", "service": "SAP", "services": [ - "WAF", - "SAP", "Monitor", - "NetworkWatcher" + "NetworkWatcher", + "SAP", + "WAF" ], "severity": "Medium", "text": "Use Connection Monitor in Azure Network Watcher to monitor latency metrics for SAP databases and application servers. Or collect and display network latency measurements by using Azure Monitor.", @@ -38897,9 +38926,9 @@ "link": "https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck", "service": "SAP", "services": [ - "VM", + "SAP", "WAF", - "SAP" + "VM" ], "severity": "Medium", "text": "Perform a quality check for SAP HANA on the provisioned Azure infrastructure to verify that provisioned VMs comply with SAP HANA on Azure best practices.", @@ -38911,9 +38940,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/high-availability-zones", "service": "SAP", "services": [ - "WAF", + "SAP", "Subscriptions", - "SAP" + "WAF" ], "severity": "High", "text": "For each Azure subscription, run a latency test on Azure availability zones before zonal deployment to choose low-latency zones for deployment of SAP on Azure.", @@ -38926,9 +38955,9 @@ "link": "https://learn.microsoft.com/azure/advisor/advisor-how-to-improve-reliability", "service": "SAP", "services": [ - "WAF", + "ASR", "Storage", - "ASR" + "WAF" ], "severity": "Medium", "text": "Run the Resiliency Report to ensure that the configuration of the entire provisioned Azure infrastructure (Compute, Database, Networking, Storage, Site Recovery) complies with the configuration defined by Cloud Adaption Framework for Azure.", @@ -38941,10 +38970,10 @@ "link": "https://learn.microsoft.com/azure/sentinel/sap/deployment-overview", "service": "SAP", "services": [ - "WAF", + "Monitor", "Sentinel", "SAP", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Implement threat protection by using the Microsoft Sentinel solution for SAP. Use this solution to monitor your SAP systems and detect sophisticated threats throughout the business logic and application layers.", @@ -38957,8 +38986,8 @@ "link": "https://learn.microsoft.com/azure/cost-management-billing/costs/enable-tag-inheritance", "service": "SAP", "services": [ - "WAF", - "Cost" + "Cost", + "WAF" ], "severity": "Medium", "text": "Azure tagging can be leveraged to logically group and track resources, automate their deployments, and most importantly, provide visibility on the incurred costs.", @@ -38971,9 +39000,9 @@ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-test-latency?tabs=windows", "service": "SAP", "services": [ - "VM", + "Monitor", "WAF", - "Monitor" + "VM" ], "severity": "Low", "text": "Use inter-VM latency monitoring for latency-sensitive applications.", @@ -38985,10 +39014,10 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide-storage", "service": "SAP", "services": [ - "WAF", - "ASR", + "Monitor", "SAP", - "Monitor" + "ASR", + "WAF" ], "severity": "Medium", "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", @@ -39001,9 +39030,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-management-and-monitoring", "service": "SAP", "services": [ - "WAF", + "SAP", "Storage", - "SAP" + "WAF" ], "severity": "Medium", "text": "Exclude all the database file systems and executable programs from antivirus scans. Including them could lead to performance problems. Check with the database vendors for prescriptive details on the exclusion list. For example, Oracle recommends excluding /oracle//sapdata from antivirus scans.", @@ -39015,8 +39044,8 @@ "link": "https://sapit-forme-prod.authentication.eu11.hana.ondemand.com/login", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Low", "text": "Consider collecting full database statistics for non-HANA databases after migration. For example, implement SAP note 1020260 - Delivery of Oracle statistics.", @@ -39028,9 +39057,9 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/configure-oracle-asm", "service": "SAP", "services": [ - "WAF", + "SAP", "Storage", - "SAP" + "WAF" ], "severity": "Medium", "text": "Consider using Oracle Automatic Storage Management (ASM) for all Oracle deployments that use SAP on Azure.", @@ -39044,8 +39073,8 @@ "service": "SAP", "services": [ "SQL", - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "For SAP on Azure running Oracle, a collection of SQL scripts can help you diagnose performance problems. Automatic Workload Repository (AWR) reports contain valuable information for diagnosing problems in the Oracle system. We recommend that you run an AWR report during several sessions and choose peak times for it, to ensure broad coverage for the analysis.", @@ -39058,10 +39087,10 @@ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", "service": "SAP", "services": [ - "WAF", - "ASR", + "Monitor", "SAP", - "Monitor" + "ASR", + "WAF" ], "severity": "High", "text": "Use Azure Site Recovery monitoring to maintain the health of the disaster recovery service for SAP application servers.", @@ -39074,9 +39103,9 @@ "link": "https://learn.microsoft.com/azure/ddos-protection/ddos-protection-overview", "service": "SAP", "services": [ - "WAF", + "AzurePolicy", "AppGW", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "For secure delivery of HTTP/S apps, use Application Gateway v2 and ensure that WAF protection and policies are enabled.", @@ -39089,10 +39118,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-network-topology-and-connectivity", "service": "SAP", "services": [ - "VM", - "WAF", + "DNS", "SAP", - "DNS" + "WAF", + "VM" ], "severity": "Medium", "text": "If the virtual machine's DNS or virtual name is not changed during migration to Azure, Background DNS and virtual names connect many system interfaces in the SAP landscape, and customers are only sometimes aware of the interfaces that developers define over time. Connection challenges arise between various systems when virtual or DNS names change after migrations, and it's recommended to retain DNS aliases to prevent these types of difficulties.", @@ -39106,9 +39135,9 @@ "service": "SAP", "services": [ "DNS", - "WAF", + "SAP", "VNet", - "SAP" + "WAF" ], "severity": "Medium", "text": "Use different DNS zones to distinguish each environment (sandbox, development, preproduction, and production) from each other. The exception is for SAP deployments with their own VNet; here, private DNS zones might not be necessary.", @@ -39121,10 +39150,10 @@ "link": "https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview", "service": "SAP", "services": [ - "WAF", - "ACR", + "SAP", "VNet", - "SAP" + "WAF", + "ACR" ], "severity": "Medium", "text": "Local and global VNet peering provide connectivity and are the preferred approaches to ensure connectivity between landing zones for SAP deployments across multiple Azure regions", @@ -39137,9 +39166,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/planning-guide", "service": "SAP", "services": [ - "WAF", "NVA", - "SAP" + "SAP", + "WAF" ], "severity": "High", "text": "It is not supported to deploy any NVA between SAP application and SAP Database server", @@ -39152,10 +39181,10 @@ "link": "https://learn.microsoft.com/training/modules/introduction-azure-virtual-wan/?source=recommendations", "service": "SAP", "services": [ - "WAF", - "ACR", + "VWAN", "SAP", - "VWAN" + "WAF", + "ACR" ], "severity": "Medium", "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", @@ -39168,9 +39197,9 @@ "link": "https://learn.microsoft.com/azure/well-architected/services/networking/network-virtual-appliances/reliability", "service": "SAP", "services": [ - "WAF", "NVA", - "VNet" + "VNet", + "WAF" ], "severity": "Medium", "text": "Consider deploying network virtual appliances (NVAs) between regions only if partner NVAs are used. NVAs between regions or VNets aren't required if native NVAs are present. When you're deploying partner networking technologies and NVAs, follow the vendor's guidance to verify conflicting configurations with Azure networking.", @@ -39184,10 +39213,10 @@ "service": "SAP", "services": [ "NVA", - "SAP", - "WAF", + "VNet", "VWAN", - "VNet" + "SAP", + "WAF" ], "severity": "Medium", "text": "Virtual WAN manages connectivity between spoke VNets for virtual-WAN-based topologies (no need to set up user-defined routing [UDR] or NVAs), and maximum network throughput for VNet-to-VNet traffic in the same virtual hub is 50 gigabits per second. If necessary, SAP landing zones can use VNet peering to connect to other landing zones and overcome this bandwidth limitation.", @@ -39200,9 +39229,9 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing", "service": "SAP", "services": [ - "VM", + "SAP", "WAF", - "SAP" + "VM" ], "severity": "High", "text": "Public IP assignment to VM running SAP Workload is not recommended.", @@ -39215,8 +39244,8 @@ "link": "https://learn.microsoft.com/training/modules/protect-on-premises-infrastructure-with-azure-site-recovery/?source=recommendations", "service": "SAP", "services": [ - "WAF", - "ASR" + "ASR", + "WAF" ], "severity": "High", "text": "Consider reserving IP address on DR side when configuring ASR", @@ -39242,9 +39271,9 @@ "link": "https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-delegate-subnet", "service": "SAP", "services": [ - "WAF", + "VNet", "Storage", - "VNet" + "WAF" ], "severity": "Medium", "text": "While Azure does help you to create multiple delegated subnets in a VNet, only one delegated subnet can exist in a VNet for Azure NetApp Files. Attempts to create a new volume will fail if you use more than one delegated subnet for Azure NetApp Files.", @@ -39271,9 +39300,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/expose-sap-process-orchestration-on-azure", "service": "SAP", "services": [ - "WAF", "SAP", - "AppGW" + "AppGW", + "WAF" ], "severity": "Medium", "text": "Application Gateway and Web Application Firewall have limitations when Application Gateway serves as a reverse proxy for SAP web apps, as shown in the comparison between Application Gateway, SAP Web Dispatcher, and other third-party services.", @@ -39286,10 +39315,10 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "SAP", "services": [ - "WAF", + "AzurePolicy", "ACR", "FrontDoor", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Use Azure Front Door and WAF policies to provide global protection across Azure regions for inbound HTTP/S connections to a landing zone.", @@ -39302,10 +39331,10 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/afds/afds-overview", "service": "SAP", "services": [ - "WAF", + "AzurePolicy", "AppGW", "FrontDoor", - "AzurePolicy" + "WAF" ], "severity": "Medium", "text": "Take advantage of Web Application Firewall policies in Azure Front Door when you're using Azure Front Door and Application Gateway to protect HTTP/S applications. Lock down Application Gateway to receive traffic only from Azure Front Door.", @@ -39318,9 +39347,9 @@ "link": "https://learn.microsoft.com/azure/web-application-firewall/ag/ag-overview", "service": "SAP", "services": [ + "AppGW", "WAF", - "LoadBalancer", - "AppGW" + "LoadBalancer" ], "severity": "Medium", "text": "Use a web application firewall to scan your traffic when it's exposed to the internet. Another option is to use it with your load balancer or with resources that have built-in firewall capabilities like Application Gateway or third-party solutions.", @@ -39333,10 +39362,10 @@ "link": "https://learn.microsoft.com/azure/frontdoor/front-door-overview", "service": "SAP", "services": [ - "WAF", - "ACR", + "VWAN", "SAP", - "VWAN" + "WAF", + "ACR" ], "severity": "Medium", "text": "Use Virtual WAN for Azure deployments in new, large, or global networks where you need global transit connectivity across Azure regions and on-premises locations. With this approach, you won't need to manually set up transitive routing for Azure networking, and you can follow a standard for SAP on Azure deployments.", @@ -39349,12 +39378,12 @@ "link": "https://learn.microsoft.com/azure/virtual-network/vnet-integration-for-azure-services", "service": "SAP", "services": [ - "WAF", "ACR", - "Storage", + "Backup", "VNet", + "Storage", "PrivateLink", - "Backup" + "WAF" ], "severity": "Medium", "text": "To prevent data leakage, use Azure Private Link to securely access platform as a service resources like Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2, Azure Data Factory, and more. Azure Private Endpoint can also help to secure traffic between VNets and services like Azure Storage, Azure Backup, and more. Traffic between your VNet and the Private Endpoint enabled service travels across the Microsoft global network, which prevents its exposure to the public internet.", @@ -39367,9 +39396,9 @@ "link": "https://learn.microsoft.com/azure/virtual-network/accelerated-networking-overview?tabs=redhat", "service": "SAP", "services": [ - "VM", + "SAP", "WAF", - "SAP" + "VM" ], "severity": "High", "text": "Make sure that Azure accelerated networking is enabled on the VMs used in the SAP application and DBMS layers.", @@ -39396,10 +39425,10 @@ "link": "https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works", "service": "SAP", "services": [ - "VM", - "WAF", + "SAP", "VNet", - "SAP" + "WAF", + "VM" ], "severity": "Medium", "text": "You can use application security group (ASG) and NSG rules to define network security access-control lists between the SAP application and DBMS layers. ASGs group virtual machines to help manage their security.", @@ -39412,9 +39441,9 @@ "link": "https://me.sap.com/notes/2015553", "service": "SAP", "services": [ - "WAF", + "SAP", "VNet", - "SAP" + "WAF" ], "severity": "High", "text": "Placing of the SAP application layer and SAP DBMS in different Azure VNets that aren't peered isn't supported.", @@ -39427,8 +39456,8 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/proximity-placement-scenarios", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "For optimal network latency with SAP applications, consider using Azure proximity placement groups.", @@ -39441,8 +39470,8 @@ "link": "https://me.sap.com/notes/2015553", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "High", "text": "It is NOT supported at all to run an SAP Application Server layer and DBMS layer split between on-premise and Azure. Both layers need to completely reside either on-premise or in Azure.", @@ -39455,10 +39484,10 @@ "link": "https://me.sap.com/notes/2015553", "service": "SAP", "services": [ - "WAF", "Cost", + "SAP", "VNet", - "SAP" + "WAF" ], "severity": "High", "text": "It isn't recommended to host the database management system (DBMS) and application layers of SAP systems in different VNets and connect them with VNet peering because of the substantial costs that excessive network traffic between the layers can produce. Recommend using subnets within the Azure virtual network to separate the SAP application layer and DBMS layer.", @@ -39485,9 +39514,9 @@ "link": "https://learn.microsoft.com/azure/sap/workloads/rise-integration", "service": "SAP", "services": [ - "WAF", + "SAP", "VNet", - "SAP" + "WAF" ], "severity": "Medium", "text": "For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Both the SAP vnet and customer vnet(s) are protected with network security groups (NSG), enabling communication on SAP and database ports through the vnet peering", @@ -39499,10 +39528,10 @@ "link": "https://learn.microsoft.com/azure/backup/sap-hana-database-about", "service": "SAP", "services": [ - "VM", - "WAF", + "Backup", "SAP", - "Backup" + "WAF", + "VM" ], "severity": "High", "text": "Review SAP HANA database backups for Azure VMs.", @@ -39514,10 +39543,10 @@ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-monitor-and-troubleshoot", "service": "SAP", "services": [ - "WAF", - "ASR", + "Monitor", "SAP", - "Monitor" + "ASR", + "WAF" ], "severity": "Medium", "text": "Review Site Recovery built-in monitoring, where used for SAP.", @@ -39529,9 +39558,9 @@ "link": "https://help.sap.com/docs/SAP_HANA_PLATFORM/c4d7c773af4a4e5dbebb6548d6e2d4f4/e3111d2ebb5710149510cc120646bf3f.html?locale=en-US", "service": "SAP", "services": [ - "WAF", + "Monitor", "SAP", - "Monitor" + "WAF" ], "severity": "High", "text": "Review the Monitoring the SAP HANA System Landscape guidance.", @@ -39543,9 +39572,9 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/workloads/oracle/oracle-database-backup-strategies", "service": "SAP", "services": [ - "VM", + "Backup", "WAF", - "Backup" + "VM" ], "severity": "Medium", "text": "Review Oracle Database in Azure Linux VM backup strategies.", @@ -39558,8 +39587,8 @@ "service": "SAP", "services": [ "SQL", - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Review the use of Azure Blob Storage with SQL Server 2016.", @@ -39571,9 +39600,9 @@ "link": "https://learn.microsoft.com/azure/azure-sql/virtual-machines/windows/automated-backup?view=azuresql", "service": "SAP", "services": [ - "VM", + "Backup", "WAF", - "Backup" + "VM" ], "severity": "Medium", "text": "Review the use of Automated Backup v2 for Azure VMs.", @@ -39608,8 +39637,8 @@ "link": "https://support.sap.com/en/offerings-programs/support-services/earlywatch-alert.html", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Activate SAP EarlyWatch Alert for all SAP components.", @@ -39622,8 +39651,8 @@ "link": "https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-on-azure-general-update-march-2019/ba-p/377456", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Review SAP application server to database server latency using SAP ABAPMeter report /SSA/CAT.", @@ -39635,9 +39664,9 @@ "guid": "62fbf0f8-51db-49e1-a961-bb5df7a35f80", "service": "SAP", "services": [ + "Monitor", "SQL", - "WAF", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Review SQL Server performance monitoring using CCMS.", @@ -39649,9 +39678,9 @@ "link": "https://me.sap.com/notes/500235", "service": "SAP", "services": [ - "VM", + "SAP", "WAF", - "SAP" + "VM" ], "severity": "Medium", "text": "Test network latency between SAP application layer VMs and DBMS VMs (NIPING).", @@ -39664,9 +39693,9 @@ "link": "https://learn.microsoft.com/en-us/azure/sap/large-instances/hana-monitor-troubleshoot", "service": "SAP", "services": [ - "WAF", + "Monitor", "SAP", - "Monitor" + "WAF" ], "severity": "Medium", "text": "Review SAP HANA studio alerts.", @@ -39678,8 +39707,8 @@ "link": "https://me.sap.com/notes/1969700", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Perform SAP HANA health checks using HANA_Configuration_Minichecks.", @@ -39691,8 +39720,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", "service": "SAP", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "If you run Windows and Linux VMs in Azure, on-premises, or in other cloud environments, you can use the Update management center in Azure Automation to manage operating system updates, including security patches.", @@ -39705,8 +39734,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Medium", "text": "Routinely review the SAP security OSS notes because SAP releases highly critical security patches, or hot fixes, that require immediate action to protect your SAP systems.", @@ -39720,8 +39749,8 @@ "service": "SAP", "services": [ "SQL", - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Low", "text": "For SAP on SQL Server, you can disable the SQL Server system administrator account because the SAP systems on SQL Server don't use the account. Ensure that another user with system administrator rights can access the server before disabling the original system administrator account.", @@ -39747,11 +39776,11 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", "service": "SAP", "services": [ - "WAF", - "Storage", + "Backup", "SQL", + "Storage", "SAP", - "Backup" + "WAF" ], "severity": "High", "text": "Encrypting SAP HANA database servers on Azure uses SAP HANA native encryption technology. Additionally, if you are using SQL Server on Azure, use Transparent Data Encryption (TDE) to protect your data and log files and ensure that your backups are also encrypted.", @@ -39764,8 +39793,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-service-encryption", "service": "SAP", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Azure Storage encryption is enabled for all Azure Resource Manager and classic storage accounts, and can't be disabled. Because your data is encrypted by default, you don't need to modify your code or applications to use Azure Storage encryption.", @@ -39792,10 +39821,10 @@ "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/lock-resources?tabs=json", "service": "SAP", "services": [ - "WAF", - "Subscriptions", + "AzurePolicy", "RBAC", - "AzurePolicy" + "Subscriptions", + "WAF" ], "severity": "Medium", "text": "It is recommended to LOCK the Azure Resources post successful deployment to safeguard against unauthorized changes. You can also enforce LOCK constraints and rules on your per-subscription basis using customized Azure policies(Custome role).", @@ -39808,9 +39837,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview", "service": "SAP", "services": [ + "AzurePolicy", "WAF", - "AKV", - "AzurePolicy" + "AKV" ], "severity": "Medium", "text": "Provision Azure Key Vault with the soft delete and purge policies enabled to allow retention protection for deleted objects.", @@ -39823,9 +39852,9 @@ "link": "https://learn.microsoft.com/azure/role-based-access-control/security-controls-policy", "service": "SAP", "services": [ - "WAF", + "AzurePolicy", "RBAC", - "AzurePolicy" + "WAF" ], "severity": "High", "text": "Based on existing requirements, regulatory and compliance controls (internal/external) - Determine what Azure Policies and Azure RBAC role are needed", @@ -39838,10 +39867,10 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", "service": "SAP", "services": [ - "WAF", - "Defender", + "SAP", "Storage", - "SAP" + "WAF", + "Defender" ], "severity": "High", "text": "When enabling Microsoft Defender for Endpoint on SAP environment, recommend excluding data and log files on DBMS servers instead of targeting all servers. Follow your DBMS vendor's recommendations when excluding target files.", @@ -39854,10 +39883,10 @@ "link": "https://learn.microsoft.com/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks", "service": "SAP", "services": [ - "WAF", - "Defender", + "SAP", "RBAC", - "SAP" + "WAF", + "Defender" ], "severity": "High", "text": "Delegate an SAP admin custom role with just-in-time access of Microsoft Defender for Cloud.", @@ -39870,8 +39899,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Low", "text": "encrypt data in transit by integrating the third-party security product with secure network communications (SNC) for DIAG (SAP GUI), RFC, and SPNEGO for HTTPS", @@ -39912,9 +39941,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/certificates/certificate-scenarios", "service": "SAP", "services": [ + "SAP", "WAF", - "AKV", - "SAP" + "AKV" ], "severity": "High", "text": "To control and manage disk encryption keys and secrets for non-HANA Windows and non-Windows operating systems, use Azure Key Vault. SAP HANA isn't supported with Azure Key Vault, so you must use alternate methods like SAP ABAP or SSH keys.", @@ -39927,10 +39956,10 @@ "link": "https://learn.microsoft.com/azure/role-based-access-control/built-in-roles", "service": "SAP", "services": [ - "WAF", - "Subscriptions", "RBAC", - "SAP" + "SAP", + "Subscriptions", + "WAF" ], "severity": "High", "text": "Customize role-based access control (RBAC) roles for SAP on Azure spoke subscriptions to avoid accidental network-related changes", @@ -39943,10 +39972,10 @@ "link": "https://blogs.sap.com/2019/07/21/sap-security-operations-on-azure/", "service": "SAP", "services": [ - "WAF", + "PrivateLink", "NVA", "SAP", - "PrivateLink" + "WAF" ], "severity": "High", "text": "Isolate DMZs and NVAs from the rest of the SAP estate, configure Azure Private Link, and securely manage and control the SAP on Azure resources", @@ -39959,9 +39988,9 @@ "link": "https://learn.microsoft.com/en-us/training/modules/secure-vms-with-azure-security-center/?source=recommendations", "service": "SAP", "services": [ - "VM", + "Storage", "WAF", - "Storage" + "VM" ], "severity": "Low", "text": "Consider using Microsoft anti-malware software on Azure to protect your virtual machines from malicious files, adware, and other threats.", @@ -39988,9 +40017,9 @@ "link": "https://learn.microsoft.com/azure/architecture/guide/sap/sap-whole-landscape", "service": "SAP", "services": [ - "WAF", + "SAP", "VNet", - "SAP" + "WAF" ], "severity": "High", "text": "Isolate the SAP application and database servers from the internet or from the on-premises network by passing all traffic through the hub virtual network, which is connected to the spoke network by virtual network peering. The peered virtual networks guarantee that the SAP on Azure solution is isolated from the public internet.", @@ -40003,8 +40032,8 @@ "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/sap/eslz-security-governance-and-compliance", "service": "SAP", "services": [ - "WAF", - "SAP" + "SAP", + "WAF" ], "severity": "Low", "text": "For internet-facing applications like SAP Fiori, make sure to distribute load per application requirements while maintaining security levels. For Layer 7 security, you can use a third-party Web Application Firewall (WAF) available in the Azure Marketplace.", @@ -40017,10 +40046,10 @@ "link": "https://learn.microsoft.com/azure/sap/monitor/enable-tls-azure-monitor-sap-solutions", "service": "SAP", "services": [ - "WAF", - "AKV", + "Monitor", "SAP", - "Monitor" + "WAF", + "AKV" ], "severity": "Medium", "text": "To enable secure communication in Azure Monitor for SAP solutions, you can choose to use either a root certificate or a server certificate. We highly recommend that you use root certificates.", @@ -40034,8 +40063,8 @@ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-zone-redundancy", "service": "Redis", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "High", "text": "Enable zone redundancy for Azure Cache for Redis. Azure Cache for Redis supports zone redundant configurations in the Premium and Enterprise tiers. A zone redundant cache can place its nodes across different Azure Availability Zones in the same region. It eliminates data center or AZ outage as a single point of failure and increases the overall availability of your cache.", @@ -40048,8 +40077,8 @@ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#persistence", "service": "Redis", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Configure data persistence for an Azure Cache for Redis instance. Because your cache data is stored in memory, a rare and unplanned failure of multiple nodes can cause all the data to be dropped. To avoid losing data completely, Redis persistence allows you to take periodic snapshots of in-memory data, and store it to your storage account.", @@ -40062,8 +40091,8 @@ "link": "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-high-availability#storage-account-for-persistence", "service": "Redis", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Use Geo-redundant storage account to persist Azure Cache for Redis data, or zonally redundant where geo-redundancy is not available", @@ -40076,8 +40105,8 @@ "link": "https://learn.microsoft.com/azure/azure-cache-for-redis/cache-how-to-geo-replication", "service": "Redis", "services": [ - "WAF", - "ASR" + "ASR", + "WAF" ], "severity": "Medium", "text": "Configure passive geo-replication for Premium Azure Cache for Redis instances. Geo-replication is a mechanism for linking two or more Azure Cache for Redis instances, typically spanning two Azure regions. Geo-replication is designed mainly for cross-region disaster recovery. Two Premium tier cache instances are connected through geo-replication in a way that provides reads and writes to your primary cache, and that data is replicated to the secondary cache.", @@ -40116,8 +40145,8 @@ "link": "https://learn.microsoft.com/azure/data-factory/source-control", "service": "Azure Data Factory", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Use DevOps to Backup the ARM templates with Github/Azure DevOps integration ", @@ -40130,8 +40159,8 @@ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", "service": "Azure Data Factory", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "Make sure you replicate the Self-Hosted Integration Runtime VMs in another region ", @@ -40144,8 +40173,8 @@ "link": "https://learn.microsoft.com/azure/architecture/example-scenario/analytics/pipelines-disaster-recovery", "service": "Azure Data Factory", "services": [ - "WAF", - "VNet" + "VNet", + "WAF" ], "severity": "Medium", "text": "Make sure you replicate or duplicate your network in the sister region. You have to make a copy of your Vnet in another region", @@ -40212,9 +40241,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/best-practices", "service": "Key Vault", "services": [ + "Backup", "WAF", - "AKV", - "Backup" + "AKV" ], "severity": "High", "text": "Familiarize yourself with the Key Vault's best practices such as isolation recommendations, access control, data protection, backup, and logging.", @@ -40227,9 +40256,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance", "service": "Key Vault", "services": [ + "ACR", "WAF", - "AKV", - "ACR" + "AKV" ], "severity": "Medium", "text": "Key Vault is a managed service and Microsoft will handle the failover within and across region. Familiarize yourself with the Key Vault's availability and redundancy.", @@ -40256,9 +40285,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/disaster-recovery-guidance#failover-across-regions", "service": "Key Vault", "services": [ + "AzurePolicy", "WAF", - "AKV", - "AzurePolicy" + "AKV" ], "severity": "Medium", "text": "During failover, access policy or firewall configurations and settings can't be changed. The key vault will be in read-only mode during failover. Familiarize yourself with the Key Vault's failover guidance.", @@ -40271,11 +40300,11 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#design-considerations", "service": "Key Vault", "services": [ - "WAF", + "Backup", + "AKV", "Subscriptions", "Storage", - "AKV", - "Backup" + "WAF" ], "severity": "Medium", "text": "When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob can't be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography. Familiarize yourself with the Key Vault's backup and restore guidance.", @@ -40316,9 +40345,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", "service": "Key Vault", "services": [ + "Backup", "WAF", - "AKV", - "Backup" + "AKV" ], "severity": "Low", "text": "Understand Key Vault's backup limitations. Key Vault does not support the ability to backup more than 500 past versions of a key, secret, or certificate object. Attempting to backup a key, secret, or certificate object may result in an error. It is not possible to delete previous versions of a key, secret, or certificate.", @@ -40331,9 +40360,9 @@ "link": "https://learn.microsoft.com/azure/key-vault/general/backup?tabs=azure-cli#limitations", "service": "Key Vault", "services": [ + "Backup", "WAF", - "AKV", - "Backup" + "AKV" ], "severity": "Low", "text": "Key Vault doesn't currently provide a way to back up an entire key vault in a single operation and keys, secrets and certitificates must be backup indvidually. Familiarize yourself with the Key Vault's backup and restore guidance.", @@ -40362,8 +40391,8 @@ "link": "https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-instance-repairs", "service": "VMSS", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Low", "text": "Enable automatic instance repairs for enhanced VM Scale Sets resiliency", @@ -40377,9 +40406,9 @@ "link": "https://learn.microsoft.com/azure/backup/backup-azure-vms-introduction", "service": "VM", "services": [ - "VM", + "Backup", "WAF", - "Backup" + "VM" ], "severity": "High", "text": "Consider Azure Backup to meet your resiliency requirements for Azure VMs", @@ -40393,8 +40422,8 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/disks-types", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "High", "text": "Use Premium or Ultra disks for production VMs", @@ -40408,8 +40437,8 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "High", "text": "Ensure Managed Disks are used for all VMs", @@ -40423,10 +40452,10 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/managed-disks-overview#temporary-disk", "service": "VM", "services": [ - "VM", - "WAF", "SQL", - "Storage" + "Storage", + "WAF", + "VM" ], "severity": "Medium", "text": "Do not use the Temp disk for anything that is not acceptable to be lost", @@ -40440,10 +40469,10 @@ "link": "https://learn.microsoft.com/azure/reliability/availability-zones-overview", "service": "VM", "services": [ - "VM", - "WAF", + "ACR", "Storage", - "ACR" + "WAF", + "VM" ], "severity": "Medium", "text": "Leverage Availability Zones for your VMs in regions where they are supported", @@ -40457,8 +40486,8 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/availability-set-overview", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Medium", "text": "For regions that do not support Availability Zones deploy VMs into Availability Sets", @@ -40472,9 +40501,9 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/availability", "service": "VM", "services": [ - "VM", + "ASR", "WAF", - "ASR" + "VM" ], "severity": "High", "text": "Avoid running a production workload on a single VM", @@ -40488,10 +40517,10 @@ "link": "https://learn.microsoft.com/azure/site-recovery/site-recovery-overview", "service": "VM", "services": [ - "VM", - "WAF", "ASR", - "AVS" + "AVS", + "WAF", + "VM" ], "severity": "High", "text": "For Azure and on-premises VMs (Hyper-V/Phyiscal/VMware) with low RTO requirements use Azure Site Recovery", @@ -40519,9 +40548,9 @@ "link": "https://learn.microsoft.com/azure/quotas/per-vm-quota-requests", "service": "VM", "services": [ - "VM", + "ASR", "WAF", - "ASR" + "VM" ], "severity": "Medium", "text": "Increase quotas in DR region before testing failover with ASR", @@ -40535,8 +40564,8 @@ "link": "https://learn.microsoft.com/azure/virtual-machines/windows/scheduled-events", "service": "VM", "services": [ - "VM", - "WAF" + "WAF", + "VM" ], "severity": "Low", "text": "Utilize Scheduled Events to prepare for VM maintenance", @@ -40550,8 +40579,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/storage-redundancy", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Medium", "text": "Choose the most appropriate data redundancy option for Azure Storage based on your requirements", @@ -40565,8 +40594,8 @@ "link": "https://learn.microsoft.com/azure/storage/common/lock-account-resource", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Low", "text": "Apply a Delete lock to prevent accidental or malicious deletion of storage accounts", @@ -40580,8 +40609,8 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-container-enable", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Low", "text": "Enable soft delete for Storage Account Containers", @@ -40595,8 +40624,8 @@ "link": "https://learn.microsoft.com/azure/storage/blobs/soft-delete-blob-enable", "service": "Azure Storage", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Low", "text": "Enable soft delete for blobs", @@ -40610,8 +40639,8 @@ "link": "https://learn.microsoft.com/azure/backup/backup-azure-enhanced-soft-delete-about", "service": "Azure Backup", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Enable Azure Backup enhanced soft delete for improved data protection and recovery", @@ -40625,8 +40654,8 @@ "link": "https://learn.microsoft.com/azure/backup/multi-user-authorization-concept", "service": "Azure Backup", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Low", "text": "Implement multi-user authorization for Azure Backup to ensure secure and controlled access to backup resources", @@ -40640,9 +40669,9 @@ "link": "https://learn.microsoft.com/azure/backup/backup-azure-immutable-vault-concept?source=recommendations&tabs=recovery-services-vault", "service": "Azure Backup", "services": [ - "WAF", + "Backup", "Storage", - "Backup" + "WAF" ], "severity": "Low", "text": "Implement Immutable Storage for your vaults to protect against ransomware and prevent unauthorized modifications to backups", @@ -40656,10 +40685,10 @@ "link": "https://learn.microsoft.com/azure/dns/tutorial-dns-private-resolver-failover", "service": "DNS", "services": [ - "WAF", + "DNS", "ACR", "ASR", - "DNS" + "WAF" ], "severity": "Low", "text": "Implement DNS Failover using Azure DNS Private Resolvers", @@ -40673,8 +40702,8 @@ "link": "https://learn.microsoft.com/data-integration/gateway/service-gateway-high-availability-clusters", "service": "Data Gateways", "services": [ - "WAF", - "ACR" + "ACR", + "WAF" ], "severity": "Medium", "text": "Use on-premises data gateway clusters to ensure high availability for business-critical data", @@ -40688,8 +40717,8 @@ "link": "https://learn.microsoft.com/azure/architecture/reference-architectures/dmz/nva-ha", "service": "NVA", "services": [ - "WAF", - "NVA" + "NVA", + "WAF" ], "severity": "High", "text": "Deploy Network Virtual Appliances (NVAs) in a vendor supported configuration for High Availability", @@ -40742,8 +40771,8 @@ "link": "https://learn.microsoft.com/purview/disaster-recovery", "service": "Purview", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "High", "text": "Plan a backup strategy and take regular backups", @@ -40822,8 +40851,8 @@ "link": "https://learn.microsoft.com/purview/disaster-recovery", "service": "Purview", "services": [ - "WAF", - "Backup" + "Backup", + "WAF" ], "severity": "Medium", "text": "Follow Backup and Migration Best practices", @@ -40927,8 +40956,8 @@ "link": "https://learn.microsoft.com/purview/concept-data-share", "service": "Purview", "services": [ - "WAF", - "Storage" + "Storage", + "WAF" ], "severity": "Low", "text": "Leverage Azure Storage in-place data sharing with Microsoft Purview", @@ -41019,8 +41048,8 @@ "link": "https://learn.microsoft.com/purview/concept-policies-data-owner#microsoft-purview-policy-concepts", "service": "Purview", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Low", "text": "Follow Microsoft Purview Data Owner access policies", @@ -41033,8 +41062,8 @@ "link": "https://learn.microsoft.com/purview/concept-self-service-data-access-policy", "service": "Purview", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Low", "text": "Follow Self-service access policies", @@ -41047,8 +41076,8 @@ "link": "https://learn.microsoft.com/purview/concept-policies-devops", "service": "Purview", "services": [ - "WAF", - "AzurePolicy" + "AzurePolicy", + "WAF" ], "severity": "Low", "text": "Follow DevOps policies", @@ -41100,8 +41129,8 @@ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", "service": "Device Update for IoT Hub", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "High", "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", @@ -41153,8 +41182,8 @@ "link": "https://learn.microsoft.com/en-us/azure/app-service/environment/intro", "service": "IoT Hub DPS", "services": [ - "WAF", - "AppSvc" + "AppSvc", + "WAF" ], "severity": "High", "text": "If deploying to an Isolated environment, use or migrate to App Service Environment (ASE) v3", @@ -41631,7 +41660,7 @@ ], "metadata": { "name": "Master checklist", - "timestamp": "August 21, 2024" + "timestamp": "August 22, 2024" }, "severities": [ { diff --git a/checklists/waf_checklist.en.json b/checklists/waf_checklist.en.json index e7837fd8..37a04a4b 100644 --- a/checklists/waf_checklist.en.json +++ b/checklists/waf_checklist.en.json @@ -10493,7 +10493,7 @@ ], "metadata": { "name": "WAF checklist", - "timestamp": "August 21, 2024" + "timestamp": "August 22, 2024" }, "severities": [ { diff --git a/checklists/waf_checklist.es.json b/checklists/waf_checklist.es.json index d622e244..ac054502 100644 --- a/checklists/waf_checklist.es.json +++ b/checklists/waf_checklist.es.json @@ -9500,7 +9500,7 @@ ], "metadata": { "name": "WAF checklist", - "timestamp": "August 21, 2024" + "timestamp": "August 22, 2024" }, "severities": [ { diff --git a/checklists/waf_checklist.ja.json b/checklists/waf_checklist.ja.json index 1c24c5ea..6f1025d0 100644 --- a/checklists/waf_checklist.ja.json +++ b/checklists/waf_checklist.ja.json @@ -9500,7 +9500,7 @@ ], "metadata": { "name": "WAF checklist", - "timestamp": "August 21, 2024" + "timestamp": "August 22, 2024" }, "severities": [ { diff --git a/checklists/waf_checklist.ko.json b/checklists/waf_checklist.ko.json index 7837d111..7aca3a67 100644 --- a/checklists/waf_checklist.ko.json +++ b/checklists/waf_checklist.ko.json @@ -9500,7 +9500,7 @@ ], "metadata": { "name": "WAF checklist", - "timestamp": "August 21, 2024" + "timestamp": "August 22, 2024" }, "severities": [ { diff --git a/checklists/waf_checklist.pt.json b/checklists/waf_checklist.pt.json index dcbc41ad..088fa990 100644 --- a/checklists/waf_checklist.pt.json +++ b/checklists/waf_checklist.pt.json @@ -9500,7 +9500,7 @@ ], "metadata": { "name": "WAF checklist", - "timestamp": "August 21, 2024" + "timestamp": "August 22, 2024" }, "severities": [ { diff --git a/checklists/waf_checklist.zh-Hant.json b/checklists/waf_checklist.zh-Hant.json index 6d618420..5dfa8686 100644 --- a/checklists/waf_checklist.zh-Hant.json +++ b/checklists/waf_checklist.zh-Hant.json @@ -9500,7 +9500,7 @@ ], "metadata": { "name": "WAF checklist", - "timestamp": "August 21, 2024" + "timestamp": "August 22, 2024" }, "severities": [ { diff --git a/spreadsheet/macrofree/alz_checklist.en.xlsx b/spreadsheet/macrofree/alz_checklist.en.xlsx index 2733af3385e37b3d07a80ec891a64d84e1df31ab..e2ff5c15b7cd9975c11f28f948a63be3aaccbea4 100644 GIT binary patch delta 17471 zcmcJ%by(Eh);|m)-O{Zf-6&3)RNN%8I_cH z>(((j>S!(6;IY$Uiuz1wbMZ09g75;Ju%h)B?_pXqZsUyFN(0PrrRGe<9;H&G-lK*L za%HBE0jd5S1061sEJAb(@dvX0UkSa2jktzsSvP_7pr5W6&PFcltIu4VZAd@aF?H+N zsSlr@UAnR<2@@!jqFbx6{>Vc8IQc?J;MHhXRoCQ+d~wdH_@mtC9KSqVN)(3%bv^G( zJl|5pl?SXM8~43aIdu9#0*xZrvABCQuHibjFTNbG%Gx$9Z8kx4h-J0yQETwnj`7#N z$2DY$@GN(My8aU7zl2nd{-^~77cM68{*r*NIS2@~43EJaC8XuQ(MZgI4(}3#C=rY>B`Vi7(YE@8=)M^-NZ=S)YEbxE?d4{1U`O9`#LGaY+5$ zX~$h69@-)0G6L@4kE4XnQj*d(BH#U^>16MxMlBdJp-;k9>1?#`%rRu{lbJ~E3w79+ zoNh}7&*pWH-m+3{o1blqi zawV;MK2#excqKiZCKu6E`SQZRm+Yy*=Fv>?3Py<}enz4Um%;DMry!pwp&~4zh7V%k zIeR|fR8AZ_ka&$JQ>zdcH!9|{QS~oA(P=7z7)0;xD=A%?U$xTBXf`+*%*({k>bTp+}KQ_!7X|ooRh11^5 zv@O__8uo0QIcwL-eqP*E=F73m$!|J+#7yd2U{tYy?M4ha1(m!2lk5LtqdtjuSDU

(X-XFj3Cka*bwp=(`N? zo4N5Rl{9aJQ9p%a2+52;b{nlx>ds^J_Y1~;gQ7|o61#zVDPkH+5-~_;de8lGXc0k{EOW?=X0_LT4P!1X$&ih=p zoRkUC7fVu=rJ}tQ8Dq!!Oh*<_yZ6kDsem8khq_HM;O<`G@>2sG$sg_xZ%7R{5_l=J z{3k4`BHOo2hP7=`ym|9RXe6 zwR7Lrr^ntqHpy{;WMKXz|jEoOogTi*eFYEX)j;UUzvUVzHL=1le_Y46I4*teJ(+ z7?*y}c;-cwnLk>h-KUv0OOZ8>3+)_Rb{_%rw)1ST80I(ZMg?S&ki{v^cm*4pL4wub zDtin3$jQT|8(@`pQ@H1k9n zCM&xQo*7jm{Ml){jR#pl_fWhjtO>5NgzI&i=RTd7=$fHEVUFt~uV9zx3?sQT{!wjS z0C+FM6s=aiC?k|3BBs|e$gyn!Nf?<0wpz>_^5C&KKR-|xFqZ=fAL{W-yl?QKUy#2_ z9BW1f&NlA(GVL%O)Q%cbI=9TxYE9ihTw5ZPTC;YR7+2o66Z*%`^g_f7l&mD zUKM*XqwCu#WuuoN^7m}N-7?W!tip1SLeh)PVxd-ehO{u`b={%~TC$CoeWCgrXm1=I z**$r%{1%PUMdK5)78$W#Ay#|Q-t~5cSC=z`A%+qN66W~^MdRzy!2mTLv=px5IY-BW zVQtfvkxDyiktw~$-_W$hS0t!I5<^Xwb`eX-F*6?Uhx#`UzlMy9mYncsItu?pXXVQ8F`^T zA4hi%R74P=Z2^qB4nx`i%T@w72ap1rQkGS^Qs1U@ZR~hN9&?8V$E(QeU?8!g>uw$Q z`inKT$PxFE8{bn7^<}ktk*aE1N_Y9pchrNW} z6^l;{X*+0SXNHLB+bl=e~xyNT7qv3Efx4Kl&71l2B%M?x0L)O@5=L6nF;lPR6MG2bh5iG zQh{gyQ!AVac7tqDjG{4WeODL@m)g2|8>r^W-QuJgwu?Kvz!;k{b>gjWUghb%p%%&Q zVYIq5Lo<4o@9^PLn`-n;=A7PsU8n7E?tD3PTC2IOe%^1Utz}H8MF^A;A_+Ku-H+lj z*-b&{+~q6Vbh;wwz7g3TSZi6uR>1WaeRKV6E{q~I(m(Wt`tqe4lJ|6Cne}s7Oq@~~ zHi|2-#y#SH{5%OM=540&zcpTq-cuZ$F|=HJ-~s4=>${Y)KiOQc(Fn@)8MVvNDt3(Ey+&o16b#p=frQt2JD>3SM?DH zm8#5%$m2k>Uyi1%R#!1%^2`-w{aCq7p;=t}-g+l7APoE>!0yyE2U-qUyp}qAde-Q! zQ2N@Y8DS^VPE^p+8R9BiB2F;BiA>Oc3M{JS?JMj28V8*?aDU;glV$jue&tdvFO!5# zO{)5Oi0%IJUXVte_2_;?8jx`xKVk;BGi@GRx*K}mc;$Xqafy4`9y~P_pSVZL`VDTH zM9PN^9|B(u8ltMCc{YJd1z9DDuMLPl-TF~KewyEb@y9lVD_4H=Agg;s15waP7rd|6 zgkO}8SlGwM&)mMbZz2@#Mlny`&wE_F9fM_$p(&Y{Z_-n=IIk@>rdl|?3yoOK%&!)P zboYH-uH0T3TBEr+x?A|&{bFOPbaA*;@03KhG>1)mr>p9eU~fSA_4CqS&o9K!hy`Qu zYzqtM!Xfh0+V;rTysZ%iNkBl&6}iKvZ2{N|`gnPb2hn4E|4y4mWFpY`H$C0}pJdbX zTpLdwPUkF6{P!I-DdpugDt%*{3X*K+e`yA1?c04K9Ww<1LzDXXWd*kQC}3u-$(Crv z%{|!ei=HfmL2LArL^W}dGeG|*NXswo_{n9--r`x01bb>K4$!;OvI(lg>h9oeXr&oi zIPr&pl|n|3Kqjb)zFY z12gbeac~eyHqxD6`%6yYMp=16t?8GO4(E!oj$^J{73+p{@Vp!63A+t>x!$p)kn+}9 zuPL=t9KCnlOA$G7dMU*1Ho3W8ieBJB79D}}R_|GhsWBwgRb=RGfG{iY6b2JDBgM1i z#Z7i@N1|zS%*{Jzty3h91tD##ZY9bkGCh0h!V*!nilkh{p*(SGzG?g}0Yx)=M(I!g z1QGLt=8~<$+4W^LRDEl5QYT&_vsP{raoLgE=lAt0t@1OK?B?vW#y?Y22SOIXJv5g# zrQWK}Uw~{H$jrZiR$)B41vt&8cXuj<&iQfv+ABBalOw{WlMsN-gT3tR_W(*!<8vKN z{P_t7b}!cafXaqS&fK3G_A+uAF)YMKZWR^99H0v-Lc#f8NktMhm81%?17W`1i6Ay% z(AW=OupcucwDa|}B{nxiTZz(ypXx8hJIrl>b;H>gWi{x1YlbTf96v12gx{O^PLG*- zkFWD@@ElYLeW1~LVM*1=yPsM99_P&R5yjr^S;dVU`~A%g)tW09g}&)J{)}0)Ty5*C z@SayrK<7u8{s!pgsEGGm8+4>R#ax@uOepW~lgs2f*f1dNh;$f?B{XsTOLi&1Ui0Oa zVFr(KL87^}xG&vKwfP4+=C)U|+7ilp&hMx6_PlzTBpFqzNDM@7E7XdI_0LJ%CU0Bs z-hRk5G;}OIbjW3paD)E%8-QUp zE|&fF3lLzAqgtzS&8f`Bx_YP^TS3^?eR}*u`2bDY-Qf%;Fl; z8|?SBX!%!5b!QxB+|hQSpnNv@_C05mt?NnCSNwQuhz)y473rzB{Nw41*g-DSI>H({ zHtPy(R^eD6joTz|+aOGu`Zyb_6|$8x2k$$46qBEv6eis&o-2v&*Ofa>K>+ppFHWor z4h#4K1Dw*jcEd})KY`_dJ!FTkF8uI`!&Tq@sCi0J68iORt>P=@Z1qpf<-BcQ<^RZ8 zD6{W*Y&yUFtf!?J46MT0;+G1K*3$7#*(7Fwxv5Sf7){@$1=9KoUc7WQs^!R*jN+b9 zgqqVduDH}x>vH0*W-h8?U)*S(LV0Ok5rwEH*Rhkm7*k|@&A@`Y6UM_i)?PCUr6(eD zj+a+lP?!2?t&P{2|87SsE%DGr!@do!DsJAzP>FatpZ3`Ak%x5}?M}DfFlCA-)t>{Q z^H#IQ;O3o4DrXH1KwedWvG1%(d2wr*a;OD)>unT|8l;`6l=zsbk~n8v=awm_Lx-g} zZf43zo9T}g`3#ts4G%MXthgYbTO&3!t!+5tUu)N*7G?qQ<*&Tv6nUG4pGVpK{e)=t zH6_6dsEZpQGseQG`ei6Y(LM(#hG;&6QJOL?Olp}TVJXDCJM{R)Ri$Kv)A#qiADMTm z0`AZ#B9Hj5P77`Kn+t0jm6yzr<3_#oFL47d$x~Te8pNF9)|I zslix(#;9`PJat@N8y@M=WtK}=W`(!GMtag1eq8dK)|q$)&sOmnEF%NLQZhN|cx%PX z9lo5&zM+@sb8DHW+aZl9?8AH?fhu8Ks$f+g@Q=Kp-p_x98fK9Z!14?2re1dd$fh6@mb{a1c`a z!egJ)$8`C0t8ulN>Gm6i^s@tRmh*2T_0n3w7%BlOHqz|C1E)j`{yN2Ao5uNNeYW^! zHdY}ziS34dMfJ&eHoBN?YXk<+1Z0vz(6kJ43VA?eRseYE^R2NO`S?3iDQR4z+LUiy z4dhPcweDN%Anh*4XMWVwE&V!cuLV*n0VVJa^`z;35{5{8Pd3=Ohr8nL?*3jMv4QcDk%7^_dD?QHt~xJsQf0 zR}qzw*KAbFk;yBo*EzDaGs{m9GvtiV&{I(dfhNXWyuN16Z>fi{4(A&My^flECbaTM z7)1S`V3>NZfW8=EemxzLlQUL(?*_k<^LmyO)Z~ZRx}xp43v7DVRfw?f_q>ukphoKJ zwvmS0RbSMNp!UmNrz2$QYY|q-W5riN6QOwYq**fKWjB4}p(Cy~ z(mQL!ebstJ>$_QZ9v3~DxNB8E7s3R{^W0(<`EMG4KN-98W9*xu*~bow0tig(rANds zB^3R$??bSW(*xQrQOz&;c)$3nyn`a;@LU}N7RU zm!lONVdOuOOMk2++Uh>k$f*YbGAyn6Fh{CI?#{SqjPLT7JRTFyuxyaAL}z$F!jP0~ z58-M*tDVH{&N);vbIP)6(5W?o%UgB8Ye}cDGLku>VCiNgSlp2SH~A~Z{maB}s-4^Q{y)2MO8XnHnLAg^k{$UAg5w z_-B>@6qUR8G;SNjSW4JRx1(jtzeC(tya9P8wbID>IbP#$C!;2!qTk)36^Mti?BGfn z-D=&U!4U{3&A!w8_LfvX$FD+PETcqxq3GOv+QAJmPN2)YlgP`eC-)Z;Pccf7^8HNbR(waGwq8NWqQlhArmJ@J?`N|n%L5Le+V>)u3xA#f0V zb*+WOC@+0aad_lYZuuadn?(Rc+^)=J_1{4DGR(9`xy^8fpW-Qw7%+#aLAAkL1{hG5ve0Y{8mw@l~ zc149)nI(AJR8{ZX6<7d$dVll%S-E9sDZ;SuxJMkGJ2ApTgrN!XRy7>7re??t?$QcE zg@=4!G$HD?g@ni&%u_C@HQSAxme|XC?Q<_0 zr4^~jt>>%)myb>AHBfi_>{7I>D3kS6pIqe|Tx8Ez3!aKPj9aFC2dd{5>kM-sv2~5~ zDTVg-Z<`be%e;S{xXKbI-rVBoMUbNwzu(qfQ~vwGW@V1qk?x0D5W63gGY8hd-4H$t?r)ZC?%$d=KTQAa2wUq!NCBCUrE_+ z?$muDT${Of1fpt3uIq+j+Ngri{dXmeX1*&6>gno61C}ZqLzh7kg{#0t14Un}8Oe9z zXHh2ZNy5YlB9pQ@sK3L1xKGMHD1sq#q>Uo0o70C5c^S@$Wl2xBT*?pSxSOM&ovt7C z(h#Q{Ov~Kn%mx+Zaov?kqhFi- zS{2SqKxDV|SGIM@sC<46Ib0^K32w5;Rhh|Ef31ePbZ_lAK!o16dKOo^i;smZVit!{)Lah z?)#?SLdj#*ZDIV0*PkV?y}y!E(;#Vx15pSGM@^MAfN}43)uXA(ZM}%(vVD?sKYaJ3 z%P)$$c@0@Wu6bV2_YlfCcYE%GTKygOiFmji^Y$BbOKN+Tr^zl9{nsh9;?e&^l<_W! z9K216@z(Y8`(N3xeKO`zbNpoY;+pD?pWz;t`cZnP<;Og7@TOByOd#g~<_u0M3wJbr zBdTn?@wmKpov9c82)MM4h}HS|rR43{)on`RPnS6B2i01dq*uWRA3ez;7>y_wJ`S8g zb=|VDZFGs}%~{H!pCw`kkBjCG?1>vxGO6^=s)A?~%_2=XMV<(|(U-_M% z!Jg_tj^dpCmMx|Qz~#SEPt3Zvon*QdpVRUyt;>CSrWdiUmRnJH&xu->ID?qw0v;Yh=`V22L~&%12i!85Ml2&SK} z2|WvF(B)Hhg4oW=LWBLfP)Fv$bYYA@{bAD*`oc=#$GykhJnKy2lCuZgK)psulwDF* zK6{9eWjBN<=^^5+o@1Ek@`D+kYqNnxPw$R^*r7|3 z3UL#pe?V=0no(f`{Idey;}zysB`eW0`My0=N1k`Oj2SUL8`*2soG{dRme6dFZ0osw z6-qH;4zVp1NqMIO9ol&RObp|jaePqNe$5(=n??|z7ZgikJM4|sR)^gGQXb#Vnw1m zOE-8qSp`A*nuDVoktDb%A9t{6!Hib?^Cyo*z${T(5Ot6E1mAv2Ywpcy;dps-5pS{e15koI_Y%M|>k?UTGq@!pYnPg&%S9 zaI^*FT~(MbcIxP21rggPGe;&i8BTy!Hw zNdmx_yS-{B&5?5sT9RWd>?$gK#ubP7{9qwM{gz@C@0-bpSM>&^q-H1WK0L`Uq-=xc z5;adgd*waGdm}H_otQaa;iZlcA@j0Kb8KvL2K8Z>wfH!>2@LcTeIb^yDjc%woiTy@ z``&M33%}>bdafr7P}^Wra{sZ4GZJfT*nPh6wngc}99W!;9PI4S1TRKB1;USIcL9(N z*3{x8B!KUy?Eo>09hrF~51}saKSy~RoAZ4;#u&}wQ2A}>AHdvceDgN!$Ws-o716F7T?N=so6L>rEhnS z6GRE`v>jGcX51xW?|#9{Jxjg2hObLB?SE5kY)zbNk$kd?x8OY}-*V)>M95tnLtBvZ zbqO6QMO??$yX2%s%g&cnRq3JSwE)x_Tqdr*>Tg9X4xkw`vc86h@T)E$bl4Q}ClbqhINAG{1Mx_UVe&v-$GxoR=i zCT`f8TbnjhEnCoAeNrXzRED>7(Nw=Nl~qGvLE7j0?v%=vkhocoIU+aWx+y4?J#xEYmQG8G*vvC30e!`{_eRySl@cz&}w38^9MOOZa4oO>{U zK<~gaV5x717fm_yJheVsZN%J%uh06_)(b_l09U-f@+R!vxIT9^tR=;* zbS8ymb_e_NUhP(zsh-c=wFtYZkIMtRi*`n{8)mZ8-EjVxhXBRJE zDS@>MP53$84x1ZY_#~&!%ngVr7{N}H)DYg`B2^*y6`klde!NEy5Q1SxUr>Nh#P2X& z=3rxB#m7Mr#uIJAjx`)F8Dy+r)T$rfjQ$W&WOp7G*IEBb4oKNsR$w2S9E9Wx4PQ$- z8(ek`RMl4c_RU;DaAA|j>WKcJSx1?^$;Ux5u^YBig(_PPaMdfT{(Iw4^1(qi5Wc0ad6!k53Psppg<;EAAGM+ z=2rt%8NrxiD7CIoBIAyyu>0~=(OgJlHnM3fd~oFpvbP9s+0%Y=uE8}*W3edh=c^TB zJ0T+duM^CJJ%PaeieGA&T`Vs{;j>I7VF3uCFnweCC35gFg@D6MmivD&@d|6}5+fLCi|H=3D9f&g*NmCL$DqZwqSy z-Io0f;jWH$uSgR&JhC7@ zR-v-z*1p(A(eNsd#l+7Gpg$`@Fl3t_a%H~Y9T$~}#Y}u`%J1?MwM1~xt$5?+m8Byk z@J|hxD00FtwiiocWgv)r^?v@??wt1)L{YBha(&@Y1{G-W5`x7F#_m6zbhIriDh5UH zF^F*k5Y_rzC&Uq7>rj~YfBF}76K5*W3ryG-3Y*U(+tSeFWJ zMGI3uqQ==BGG5|B_=EwOGpSdkczhSzQMkcK!%)pnp%soHsi}eE`INA-iQjqLrX%F= zp_=g8XF3#mbUNkwcDxqQ^><{)HIpg87X_Mk2a!*fH4jXTQnhp}uC44+A;AwF)=eQy z&nHR~Wrt(!RUDL#YQ!&0Lm)MIl~>pxuDK0pPrr^e)O|uv+q!S_A=%h1J7pmuA*sK0)mALD4)VT7}ajZXu3E=p>lR zXy?330Teo`AU7BQw5?Bv=R^aPV2Ym#SHDRM42==VAL@mW*|IUbZ$eXO!*(RP zb~A35CB~`OvPT=;CYa_K$bbu2-_Z(c&oZfoQGV)_9`<%yGR4N$rc^ko;pSLg>1s{o zO}$}^ITP=QUD;@%Z?=F^#>GUwO3SQhF;d2-41AgpoDF2 zZc-sQzD7HXhh{K2YcbL4eBbwGV_n633Cd`3r)@qUT<3-0X!!j#8rVb8%eg_m7Qbhb z9BugQf<-Mi)|&7I&_^M7O5tVkprvi>4}&{;Cimg(mb_@!c(+#DU5igy`XwX9ac&b* zGG!CI8UYgkm}6;Uq%@}#{w*nh>q8bve4AjdyJ{Oq4XtEZZr%K4*GXTs&R>LJcAg*Mk_s9^nlbBgGORK>+5Q*krKY@b69b_ z4+Jg9oftOAg}^X^1A58^>NHH`Q1qESHx(|OQDztX7Wv4NmPuWmR)S6nGTtNlInGpI zZqg@zT4_{Jl$~gD;k%(pR9Agj@77+r>D&c_akebOeLNU3}c2Ng0AoU80gu5V9L=2zFS^bhq@Q?14V|WLWuad*zn7I`645Q6@rW$V0|&n z#W!nj=6jZUUgh3J11ux^^if*3OL>zQp`ii!O8Ek!(D&*~xLi^NNbm_i5rHN5*T00K zD_#i;Ea6IawKJJTA0Vp`Z(Ppv$K_bT!0(e5>SH+g@!DBl7E@AJpDS= zcc4dZ#OuJ{c%#m-qXv3TS2);lS~IBRYbQC8H5Z@c`w^QIGtdswg)*;A`WTLh2Jc&D zoFIGeW1gSaJj=8Ex-@1a_57W#Op1K4=wHHf>T?0IrVs-O3AFJ!oK^#-gg01&HXGR zlpf+H^f+)^89_NNIlyKjC`iLi*uY+A%Z>oHi$tP4Prw$TA!XNCe)T8lwW5%x+#siq zyj>Q~p=;chXZF(9>$9tgLy09nQ(5ei_t`oelLQ$O_tD!EZZ@DY@rMT@3s((^S7(oE zXCOTUV|`(EHX<{JFHJX^%JcS{ex#PTb(LCKnuvv#*HS1T9hpyWcnX1znSd67f*VL= zCzm*avg<~BSbv%pyLssl$D)zJY0f(x?=rsJy}ZFDdBn)+y-Mx@+`ihI944%+cOPAi zTf+-qY!pDtjZoliiCfJwj)D&#VR|snMR3>BXA)nF4B!m&Y0YSDF?Q4lB0IoM5qcA} zYZQ$6hfD!99r(eKtt_HKo?{l;`*?h=iSAHnCSg77pzvK>{MjADh1!9`&VW~~pBCwu z4OZd12+ew_MCA1I9&zYNunpaH!d1bxmC{nkl~(VblNKB3#Y9(ST^6GdYesJI+k9mm z3+Mav9CufG#O$zB?ke5ZWOk3ZJ_^nx~5eh6yQ|2PLbXHQN)fPBVi*%W?#E;@3c6!#(#{6gsxjsmX3+W-y z$SG>IN3+laab*VDmhfK^6}3)|*9Y?)OZL+b)N}aB1N^HEbD|f8dYB$-znniJZ zsQ}b6vV@r#)V_Yu8o;qPA2Zo!)xm`9dF$$HsO@V@-($4~xymo}X+Mvuh?o2^6tf&F z%64YcDfjuk`9&Q;Y!o*|1E`Z19&blOcd#3tCYP7cToTrHg@+^#t@HS~N-}-{+n2Z2 zYl-~fl0DEN)KU-h<~yiWH|d5P7+B5cI`}i$nrH_}rgt<}Bu=&F^IFOt&an`HuK!tV zRj}N{+3knr=f#_bbtk7px0rEMaOc}aUW#_(H*Hy~6g$e)A6n+was+H`!ER_Vtj*#xXnZR7d8|EJzW4=I}**54R^oot>TVCs=msXxzYCM`BoTY#0TvbA( z6`l^cvl)_P1A~9nzxVY@RL^+3edeOIPm)Z}E<)KX;5MzY3ubpJ&2vlGkwx}IV=IH> z+x%|~pXf_ki^L5tCzL0S#F*Wtfm|4RmUzg6Eh*2}VW|Y}$JZKou$Jr*9(HuBZ8U-F zAzmCqbC;A>Ql0KvpVYIZD`=;|AcxyTcKi`m8F&CFhbEdS+O%W;y>Hk+f?aN$XxbmO zMU_qWV9?Wl(1z`SUy8Q`9ZroZ3P2k*6%mp0b9)`h`Tt*K2xYsxPGp}|~x z7~p+co@M&Yn>}3rmn~tO@GvZfSBSHW30IphCuPK$EJ?b8KpAWONsaar=9PuJKanBu z5AZpmVt2;d;)}aFqQcpw(n`ueZ|C;4g?x{VT=6yF3|pjIB0ecn4Y6O-Gfo$1PwuvL z3%Q9-k*3SBJs5J0t!7l*aO#XS2`@aMtA|v4F*#pJ9=qx@CzD-$SF+#l=KP^{bg$s$ zLws?+<|`K;8Q5EBnCQ0%?9Atf^O^WsoaM%kl2?p0S6@2K{B;aB_ZNwfP+y0i3GQq9 z1v-BvjI7qVlX@U5D2NrV7eyVT{e4vI*tb;Vcy=Anc>pg^ieCz(!4XE z3i%0y-}qXy7CZcUv6}^Ufe=_3p!wINsVSZ|jIbK8BVPbU{}-=Ur36N4E5*i|N1C!dx18rIwED%%iMOVUf)wiMJHSG3$R4qXR z>(i08-`w@^s0O zBr&mn3S;1#6gt%qCq~qvXGh|cyAY_1%}ix}2vwwi16+{K44k2iQ(z~stBa8>o$uMy zw@Yf07+^S(ZSwjuatogRI%?1qHraTE{s;#Fgl2y$QvG3CTN(}SsP3Sb{+d4)D*@Dv z7+bn(3EQ?}Gk|Y7!2l)9BYdr2@P0Ar zx-n#7sV5MYykCZXY8&zO4bCk5QT!WU;N!~sq4G78^EZAO^Q6k@!CtiThELxa7Gs^> zotN|g_XbFsRg7!g`#5hrb66VlW*xAnq2`f%#+SxZeI9o^PPeb`| z6&{ir3@aP4^JY0V)n-hsh(C$%>jcl9_RwfL^_Br+KEC@zOTzZG0=rvCb6lGN{lN*> zzYaEKpx0n!7+Bl@oJ6lF1m>OhBr>7w&_1*a!w7;9Neo_TBM7n6W8|AL2PS1Otx7Sq zC-kS7_H@?0dB~}SU6~A|NVXcAI7TPU#?pQA7u98eCbm`#6sp~Zvb2Ur+X#ybz#qCH z%jg&aUO?UA_-?$+ai)eG_u=HldP6ao6HVPjWIrdpW2n+K*k)w4c14wQJ-GGa)E{!Y zeNGiY{hIy@*H*Ov&xctwSFgccD-pKoiU$`s421k0Na2uoedp|KyctboXn@a@s!Ubw@IU&R_GEv}}6fU&|?|lUS#` zwQ~RJSmBQ2*?1Lmj#uz|uE$IadmS#w3m5FkrAiW&ec=n^oB*?I@F*oVyxpN;nzZik z1l&&vzrz_Y%)cd?Q3Ob74g!el4T&=2NT3r}&H(xAl#S zAAPCXpp!ZO)2|>u{G`<*brgM0ip@=K%-6L^oS7$+jo%%Hg)8^;KR2^t5vicKr_OvP zLl@pfx?sXL(ZjdwvC;@%tP9-u1LNd}U6ZvTRoY9Yd>vLnBcz$S;o0PgGL#M;UREK8 z|3S1XE-U0LfAJs74$wTUFxUTcS!!g68_GYI6&HJ3NnHQuGFyz=5aL(=q{{iq%c}F> zU+Y|im;Fr9M`Ud!4!B{}|2C`e5q2512rN1rn2ooGO8r}IY>5|41%CgK8)fMv?7)KS zL16A|LcV{Ai907svLlLg!So?;w(X#RJup=a{X`nUMQ-W>8d0Yk3tdSV>xNCgor9Hg zh;aWBoZ$M2V?X+cD7ZD7h_{;b9Y0TmV5E>O?0zVn|I8KqKidoV_g=oRjsAV4juf#- zp=bYb?6-80riwJ(DR_TaAK3~;jY!~af${lot%^48fZ>E0sblE=pJoXE^8Z|8-Qn1; z{cuVGSVaX0Q&76aP$483_5W6Z?i54}eDVL#&W;qs|H;xI!rv^Zz$IYm|39Vqz~$fS zE7MQ*Gl3xEFSP{z(M!Sgf@nBne~cbx3jeHfpcKH-O0Wy7Uh*9}I@Bjo>Et1KfP?&nWYGs1&z9Sg24|7FLN&Yzg1 zZ$e=z6rD$;@Ha`Rf0KMT_Ot&*#&9nFLt`yN|4YW;(i~ziXC9`;|A%`%=m&4dgB3i@ zCwlw06+E2lkLVzg9^;`xbpNe5WHOYn{0AndP3k{=54dvu_Zl!h^cf!<1RrjkEFJGZ zaR#Oxzy7Tq|GKd7hYJHsK#4T}J|uk8|FjqU|3z?cD1*uFq0viz_gb=18|5{tvByS*is&Tx8ziuyXh_Ivcp^{Bsc;V*UkXBTz!E ze=A-1KcLJq{D0x0>u(;$A4IV7zliq_v>6u={aXb8gtq^8dq3D(rA!09a~Gh&jP!T> z_ldW3U&2hM`xTru^Ez<{y{BYVEjgw%)%I*0Zr}WFd}`jNuf|Wr_0!&~E_y#KZl_<8x9rnknNl zs)384Y0U)9_Ejdb$RA*NQx%Ax{^sWL<)t}E^T0t^T63oHclD|e`um-<`x79?)%n_; z_}#7XJq^%{BjgD-L%YmclC^spSn#Qbh0ns*v;uYNDCI5-`sT#VVD zN|u}tQngr$i!AyQx;A>BUkm_cb8n{_u17$!VkCWQ3;V0qF$RtOdkt}sZ+kzaLF)BnLO?1pP0CN>h5#*ZXrEYfhg1Mujl?lkhJ!uRq)2 z!yynFsB^wnabUTRHV|1lax6GxIcBE`p;$6&IyHq> zca!KAS)*6}(z#pI4kvJbcXZO9eps+3nY2KfqmaL*AN6wYZ;DVDnwUC)0BWpw~U)2IFPgE1*Q+HV`KY z;(Z8OFuX5|PCJWspdmggiZkJG$iLUnnRYw;t#$9+yqF985${m7crc}OsuUGKVxl1a zqua8{;NTSZg?W2g$6d+R4^GvBvuz~c-TU%IRjTO5o3PpxJ0G1J4t0b}ru*&l%A4{v ztMV_n^#tCIc=>w>SNXYTpLNDBc5v@e|NFHKv?cnFkzlWFC=aN>Lx%qc99z5o@W8Kb z5b@!GQp486gO`m;e;!0Mz5MqJF~B2D0uReDnkf)3!3@o`Pyg{22n15tn>7CQ&;Mfs z8koC;2>crj8CO{W@ev`?-!Iw#M>kVE3MzqpOb+g8#?pcBqw!@^ee*E_0uvVk0`|W) zf&KJHT&+Mr@UY`_cJZ_`cjoZ0xBJI#+SRf$+Fm^8^PVC;21eD9R$E5Zt?W@4>w#Y{D3vHVpVLEj8>{ zte7zqR6qmS&X)w;tuhG97}{hPr>{7_Vf8*L((4oZ8696?vIhH6MWqgJ`I#Lx;_V#OQ2{% zb-cQj56h47rbCk=-@JJK?b>brUi5tlbWE51Br^h_K?M>B27HJOi4!_=lR5THKkkkW zi(t6PGgt_M<&BFtu+S9Cyhw6r3ve8-Jcu4EFXnmHG6HtIF1^PQDyzw-J@w6et=YrF zCT)a~o?r4~rqA>bLZ$?p@*AOYvqR#q92N65xA?>%MM?_f;#!Wq59;aCkkm-oCLO6a zmFh%^A+65VxHDH%i)SvO6QlLIp_3d!r13(t61(-`GOO$3Ju0|f8S>fw)y4rW88;t#0esF6jgTL z7AVKousyy{n#20hh?Z)>GksrD8vS+Hbm=l?nK*uCz0^zn{VbX=pD6wkY{Di7 z_Sh*~E+B7i0t=7`%8{jM|L_zyF4XX}%hIb%@HqqWN#t>GjYx-csGs>U?e<`m)FK1N z8LaJ8E(m=joyr{*K=aD)tITHGSagMWJekT@kz6x3oKlU%6Kg$WbtZAH$p;bkpkTjp zJgn7VJ4lmZG$&OTJ{Fy5!tLR;g`vpWl1Vk)YaoVHK7O@sC%{T_F|#2hn#Of-@UZQ4 zQct8xUxXOumgeO68T5THlaz3yt#(X zE0A~Ee!vuZJ)dt;O8`SV19xTuKrg4|kVW}r3P8{K{D;@Mhx9mbII%I9Q@v6{P!hO5Ih4kmS5)2eqZiSm7A9&h(5^;$gr?KznXE9VFK z3%8gH1Fn-N*4?WFn1ur@O7OASC^Zx^vOoZ2X|?Zfx)xZ^!1H1;71Lxq`r?{ompO#BB$G7}*N zhw&gG^@(KL6DK^G7H^4;Gl5>vbld$Ro=R5=1>yjRHs@3d92L<+%(C@Dsa@GaOy*2B zUMFL*MC1YV6GL0>hv|Md)1TCZ z`+}dUhiYl1^3#$}fn20<9PUk1{R@!W^NI7$CyO`AT5~2X;G`o9u4IdaA_|lH2lgoW%Ux5@xx%`j*tX|&3xD&NWoK?r2tX4r zTWXA>2W+bOLGrmNXOA^2wKf~Q$-qM}AtBE27KvJXP;P|JaelLs%ypT*2rKZhFh3`= za|tZIAACc@=M`hL5m&5nCOM(Shw9B)JPh1BqwB1A2KS*1J2N_F@t?zj0~pD~1o+F6 z3+659&@e;1u#lAM2Oq=$sZZ1D5*wpaZi`#{5q;fJWII%e}wuWReg!`_ZRf$0R@`Z3eMIUogtvDuy@|_G) z;T4wub}A?mn~Di45qHcWvi@Db=>i;SYAZy9%#3Bdwqo;rIX!@WD}j0Ddxn7pCxL(& zhHlx`YBj;C+z-cqEj1){tLfccP`R7BRr`&c^^qV%qKpF*{`kCNZ1k= zc{IC5{$<>Olt$&Ghdg($&fv`ar)qBrxrv_&W)*llUlb?;n{&Y!k8AeB22(_6 zbI04)=)@QNv`!c;Bj}$vbx!+QNrHJ|uAOC{XqJ&Yax8^=`8G$RlEruj|Fv_(5^(w> zgEQ#ER@p!nMWI-FK{_!j6VWi8izgmYy=N^?+su=YN8tz|egS5(mIQW&)es`2S9i<% zDWbVv1sGMYHh;g#P>s#5c!NIv?wu;>u#K~(lIhkmf67+T3x5PNHq_c5qUtoiN#~ip z7Qb5Qe;0eGp^awM1U7ZJ=$uSm#BIANgY~)5 zuWgrB!X6;BUu?f=u~%^4GMG4AfGUYt)~FO|_`}H>sJdvT|MCHv(?xP1={RzPR@dPx zh?FGJLm%ExdS%sN$1-@&NZ^!HF$zACX?OK{HVX{}P375AJquPFrLCDEWCfiPq ztQ`12aQB=>3~#@hrHZ~uA>v=$kvx#tyUwU1zFcUGpQ5Wac<(A*Lj|g=hcrByN`GN@ z-h2;@58h zTw3wBQ}(dh+bP?L+ji>o8m&H=8N@5pSOzRFjM_i83Vex5J!G5pRq0Tl#65`bYu!vTry6b}YJU z1r2S)FRc{t`?lfzhQY`!mQkHZ*z z`?OnTyAl#NBrVj%TRr9oM#RTU8Qw3+1ojjNJI0rLu+^mVYvKx0MyezllfKCF!Vug7 z8`|g84cocNV=Y{en=(FxE~l?wFSdfJuy5u`)o)!|a(#YAh#C;bzVcv13X8S& z5CZl=1Ime-MQ?VN(=D_!=@OKUl;0fAXapmrc+c8)}1p5CD5+}h#3{;7f-Tq&0%!%~y z<@mrNYZ_JSi$KBR?b=&ZCctD(Ty@CD58hrpd)`rWz@;tduF{~`O^Yt^w>Dtbi+-Pa zk*k@@S?Ov>zV>~yh{HrJ>8)@rclCTY`#NToHa^klrqa#q2}PPvdwyu23k6&~y+ zfz^OB(-@MjU!Mx{pEnh|Nka(=WQ_MM^o4QCzdVF57=7}p#sb0Tl1neyLgv)RAGjf&@(cXyIddW~BBkzW`t(*^=%CTNs2!!0Nf5YccD2pda317J zFjN->Y2b&)uT9nI*7Bxw_0{31d)%ZvS=`yK!A$PafI_zHX4O_ICJ{O!C$~$Lx~AFl z#&`B-j&qJOZs%a5kLbuu_cp>4Y~j~X4(a~zM+6{aVkoji%F^I3RhvW|aVjvhpv5}A zcw-NMDpoyIKkrbz^&;y*>g#EJkAtI8g=TU0d4nmfQ}j#D?g&5M?(T`9i2mTULN>R} z4$F;f0V)23kP<-vk9N@}A}O7dWA zgT_@gU=}IsdQf;xFA2>(x94Hvj>&@g-(`vteH?@Y|dhQ2h2C1=wl8S`x! zU%1|CAnh|-urARBavHx7Ik1kR=~KA~-W@$@tNSL4ysXM!WLCFroHHIz0DmvYo)@9! zW!@;7|CwKsj`^AT_~znOeLqzt^vh(8-wZYcq?(_l%6b&*LU@Ya!cyZ?|5?MnTZv;_ z@fPSgm6vrIA6_T7rE1Mz)t$GfLf6()>Jmgcn%zce^ft>@b2uM(RaTjX?`HOie8-88 zK3BLP_j*@~nW*Z8*kZx-p3Cjna)}_5`@B~5mY+m=5803mCj-N&&%K(x%1fMYHfBc=1a5l&(lWLFVq`FJNafb9co$m-3 zP+}?#J&FTHY`*9XSYnbfJ**$_s#HNw*fM53B2n3?(moj$R0#HN9Nc^*vdJ?3eh8@4 zDsYIT>iDKQfA+H@=T4QfX(p_!O0;*EcOjYD@GU+?> z@#ot^1iV(YrwwE-{2jcyZ#PLwt+|VMP8$r5yd)%n75x!8lsxCNcJu7!0JV54Fxf;d zCHEy6GgctNfo>T%$N9q_S+hqeTRX}Wk4HJl6lKG#l6`R!0>$GD5qa^X?sF_0+edH0 zO3U@^4!9G*)&?pf;n0k%iZ@vT`bQm|s$?hf&0JY-xbe~ihNI?YRy%HGRCbk z&Du_Imj(VMp^m2kt(~vFk|p6<(@n^qDcHHBvR!1lWSbW+Upd_xRA}k;{x#W* z{c_#*U2Jp#%Mxyx+lbex`IVUY&Qk=E7vn}}4YIqWJfy#*yguF(~-V_xL`brx%4fO}QB4p5DX8ByCC%U3GcE=jl|BTr_`8R9LB zXV4%R|7Cp4m72D~;4U!!6SInu#ArCn^$n!%JtR~5E)~5`3{*__&!pxk&vNC__KxMu z?~z;BMky)yrA^s!5rK1&#>(<8Opqh`M`Ldrtegzd-s*!r5rxdxy)*AekL!~(W!}PF ziOTT#&?_?Z=||IJJR@$p*LU3}=35SKW0zF2VXyjb7)xRyzjwYUmB{|FZ#|1gV@`xr z0cEy3jwq1r{ChbgV0N!y<0>T<=bnsgQB$`<^y9A^w?9Mu6~%sDHCOn2A?<6)%NhTm zLVA6=@SU`sbI^c1cP9Rl&oA>K%}I*47{KJiVq3+Vt@mjMD? z;+(x*|4)Eg4aK3EcrLCFyFFg3NHLEMa!M&}?j|zvhj>kI^t4?M6kfcr$!WD4{CqXK{=)FaNzXZ-Y9Z zfP4%1T!tc-V!CppC~w-@5F^L+^^ivd`1Emw0KisbjT!2PtbiKEj)=D7cXNlFV%dzu3bd&*6n)7d4q7A^ba>_T{zy}J zZN_rH>pK2;a97f>tFhcH5c=fHS?=s$3+OCGI4nEDQOo%Q)eI$*fms#u*LMb6w&G4~ zd%;=hV2N?Si!(1Lq;PU9vSMWCo;pEmG9w^7YkZbgyi zSrN5#9D(oyVo$RgYxr5emrp%|9P99sQSKSm*1i%JTdt1q5x>Pkn##E+Q%wA>$s2Xp zBHowgjLxv$??dSeM>nTy?}XzY74zPnkETafXH*to=zq$`DqjjF#2`A^Y-U@-f;lZ= zmBD_v(Z2!CQMe{hc0k~Z4)HcD@x)a^atYw0n3CcW8|>OX*~39oJ1?>yc&$+xyow`ZjnAe)-f4a`It#alh zdbylcdN+jVdA9PDycoNNo@=H@b;T;)p zBm}1$Eb%pm#^#5)CJlKcLzLg#!R=ocq#U}r^m8Tm&?!_Q-BNqzWp<(Jm(bCYWJ+Xp z0fayB2MIutv!)*(THM49U%gdG=iv8Nj-{_OX_Jxu6L>-3xX1%n8R=Olv0xBZ0XMKz zjWkfd|D4{p29`a{%PH2fbF5shCin!aMR%C`=)`GL0!(CeQ4Yjw99@ZNTPdFz7I<$i z*HSryk62W$WjtRyYnR6cJelC|$|oZ3A4P_~Pw{<~s1U*}xV?|I{`rv7TlqG>rf~&q zSUHoQ-yh&prd4g5O$1=myO%FL0$gDzHCYzMqEIeZ@flEvQ)#3W-38Jt@e#FIw^Hc%5e+t41>F(`Df3` zIxo7c0JbaOd9lmeQ`IUzNpAl2ayDF5)#U3#^q5=aoPotXerQqV#QGYl!A_n)BdGi{ z8{_Nh+JGEV%|J_X+9Yw&-JJx;m$8h)pz03~tXw;ZyLVTy49ZY_nTn>O z>(ec`TItJ&57-TlOa8T9F;z zYC=)9|j`kGFT0A6l6f1s*v=8YRgLG3f-&SZ;z7Todalw6Xw+$Zw@Z9hA(oRj$V%-gV~LJE4b?lNPM| zx&(k8E3*bJ&x0S0k*-X^IoV8bZv;c##*7a>&3UknnG?YXyN%3MrDj~@iTbvMaN8dl9K||jnl}xm?J?+ zp^9|@hImRq<7dCmxXbCnk2s0}Hu(3_c$LB3#N->O9AM*m&5#}TfNGve*c=p}Hxn!{ ztL!NhTcw`P3-*^$EOJ+~>w_7NTbH~8V$9IPj4!S6Cl@^_%=Sp z&4bdz@qVRwHm2bH2a5Zu%-VY=Ac^$?&91u!U%Z3|VfC*`0hBz2E_m`4$D&bBL<$9% z=y#zr>v!R+R5Rzt0q{r{Z;ON8QQlXjH%659w7S4=3aY?~d0I`l*tD86`LHV0HKwSV zS)mj~$gjz&;;}*}Zw>ka+++|6NLSr6!q?SI){FGK@t2Z_BL`-ibbA zL{4(oi08Nrs|wm2YDj5@{t6phn23b*bWFyYN7B&4i@Rc*Gqu-&8k%ebkB#B0u$FzQ zS2{+aIaoU?1WQ7%*Ck6gl7ttRyiQlC> zQ!|(;*bqrRIB*9zL1T9#DS?hzi~ZXMl4TmU`;==NCFUj=QqCHX^21E~YRn?=EG25Rs4AfVol9O3vk8Ot?s znewHC_gn8ByHBJDt`RqE?l~YbZ&tqy1?8O3X>Q%@tU^8H+|mF(ZVT*>s=gtH7J^7)=a?*?iZ~WPbF5fXo{T_3sLJ+tWo=3k zSLD<{_sx+=yL*^>4q1yjc$a5^YIO5LN5Y0m(ki#Uo|5H`npge@UF`uCEYXZ z13U#8#LWwO6t9RGXzhliXdnDLScvg>wy!XON~y=c!gl5o-jw&7P7q9K&>Br!CF@o* zXFtzH{dHC!)+xYtXs!rLn1RXG($~NTz!@ML*BvgyCB+!?=1^y}1+|!9M4wb&8LxO` zl9hp*OuqBn%H5elt>^Tc%gfpGt-PHUr&Ox`&6n`X$zUs z`=@kyCbQJ&tX!O@z`=23lp;1ff{x1W+5HJ}`O#qhTQJ2_?fG2bW>X*fwc|PYxIq>! zx4ENr#6o_+2J^H^qMOT0#fo6^YxRe#>4g)c5=Jm?#o}E2xII-tSoq0aQsTk;1HOSI z#=h6bNplYd?tj(B&AJ;u`3`;s9&ra)KlQ8$V>{-qaTDqDyri#?6iY^1Q^WWOA8dA~ zNQL-;sKySDH-NcO8Vox+^8)O~I#EL;2VX1qA0l#IVRO|H+5QK?BOk_1nCK5pg`?IU znk>3qmT6QiArUQ!At<1%_mBpwLl(``mpgT(?`COk&W$$z%2US9G zb?|7-mmUqOmuem#4L{OKWkQdmGq9aF4Ogg41mINPT-%mfDHvSj7dZHMsp*~aJsu)w zOgICKdM89>VZTTSGs!nyLNBv}xRtJ5y)vJtxa)^iL*I?7C&-YAEf0PqTd8p1zYZgR ztl@HbW?%7BJu2oqrQwTtU|V@Ta^h&eKvuTvYN%qF2Of5kc1dC6WYRoR!id=K<}YO( zj=MvIKE$njkWv%sCS$?*2rI*Qo0by1J1)GLoieZQ`EgWefdIPqaGG_IHQk}3Xd*cM zOG&oDxvPq}Y@jR84WoF2NeTJ9n6vwP zBol5*M3E5cDsUl%z9{6nKNxF&!bb%cYP|5_KoSl~;l`i2Mw@=;`_hbgU+9kT5R5n00tQ{JT-=009$=HnE+ZzD*fTgD>ke$jVcp_= z7!8x=j_ZL%L!7PD9wmF`JzZ{ap2b0&iP&xP!>{ve>2NDTt|~PVbFU{)oENw`-dq>S zdiVtDnP8+8XHAs|Volvm5=(%k7V$~N%JDos-)#m;=>XosCOuv}h&?Ob7!pGV#3M

kXc1DV3@beE7V@g{N>SHus(9pQtQ32(`};F{>jfS z@lrqwNR^dJe_fK}UhZXpY~3TkVXZO53~-%@xf=^6ZuJ%D9zB0jzcX6%4#Z@fKbg9|1dn!EGMbZ(L09II&O~1n*E0=cXt~X<9EAP5 zhH{&Yj>Rd7iG`bHx)=&G;`bh{2HI_XF=dl6wRS)Nk-2ES@f8er1A0hRCQ{uz+IqpNR)DB23w^>4*gNAy;B} zL4H&Zr~;0em|y*gbrxO}ivVjBi<&Uo8k>5bsh307$mfS9ltDla^nilUX64-4aUR00 z7lG4e)vCwzt`Q2=+||0&^7=QP+4R>ins4)LV9fYr3m&bF2@#cN4V}A5fyw%(>2|%; z-oP>HvTw0;QN5hctt6^qq<+0K>-~^zQd8cpat7&OpGtXQH&90X%Lm(~b zXa+0`JalstkZm+Xq&B4qZsR}+sR}ilXAjji5R^{s7w5R%hBZyM z58%^2GD!f`cM|C@u~2C6-7mTl(A4|0Er7`~uMlKCrUpk--MIehK2v_w%kTBpH?lS7 z$6MhjOa(T2g620Yc`meA&5k)Tb#}(h* zv|ehDym0YtlZkX0;?dD=f80$@$_XQ!Wuwmj5%iv}Ycxufn^bmam3*}FxZP2JDGI)W zu1=}3IZunZF)`q|y!lZ7Fz{uNd#cC^z#~_@t|#{k3m#Jlf^V2#VhU4vDfRfj`jSCR zfJ}6HjTEa+;^A2J;8S3}dS9=4XD(3);cLW>xr(+R|Gs)DG1ErA_B02J=DL|BMTOcg zT`YOwds5an9%=Rutt|{S=}a#zNGSPJpNW_8A{yuR-<+P>t=I!iX;g3f3OIYAtO16{ zQ_1psYOlq{>D5xw)OZW_(35B^!Z7~ zq)`Q@BZ(s9JFrN3TwX!A1!!iw*9P}F2=TseLETw#%92OE==(7a9_LGbj!`%N<)xcj zBEpj)GXdO@9c*cXPeH_L6ikqJnX&y5y%sj!C7bH+ZoD#|z2~CGIKS^%zNChJtYlc@ zRFj;W=P)mp9mokH6o4~Q$1E=UnrD-t(kn@03vW>;80yxkGrjgc--_>kPbVhj?`k_) zTOwmwH|t0Jy72*rbolg9QN(aT_e~XlKM=ie(FZ3~fm3PQ{JdqQ(I8sS$SAT{da6VK z%lVF?S%VFDF1WLw7BIEw2QcE#i=1`{1KT4F%;EzcHc^*9LWhq_)*t#yPMxB~J)Iar zA2>wAA{y;6qLM~_G=P?d8&1UJ_}3^N=UJq4#G_t6$JE^zeb;P)<`Q5dfJaw0KnCZM z#@>Xb<><^3r-uzZ{)q?EWdS*ktf&1x-n}@Q1q+4^Ym-owj|JTJF3!E$6;y z`c6}DS+k0how{qfBO)8=oMZd23DoULP$>pF{D6JogARJ)T;_)Mn*mS8en9vpEzGxx zfyKgFWMe0)Kzg(6d(zt{Gf70jf0G9ye;5mOxa>*9MVZ)^|KBkWFQ*_Avl{ao>9jL#bGcm4M$44|Rr46OrQ6ogz zv|Wrj0|_Ose%dRRPe?quVLUV0D^1BAv~mWva^;MZXs3{sx(9P$iSK;?s&8P8OP#PE zYmE=5wcs9?$IU{^bP4SXBCK6yqny-VD;XrKW>gKV-blRL+myL4N4RBTQ|rH0m^#jW z=h?NKs;TV>TlAsu!B5W_!MxknPgz?~e?({9c4sr_dqo2yOH!Y4J2srWzZyOV!idv+ zHp*>=bB{JkhUlmO%q!v^fhs5^SZ)~QhJRoy$)HVgWbO!OEomQFnXE&TRoP4EAHXV) zekJ(PjKs@$_QLE0R{6ov1ShPR(}Db3)pKzHc(U-_^TXG8W*Ho5S7F>! zfV^b?a+TH?>M&y8SDwt*H?}R?vy%;tT6dHylOyP*p|7 zbQnm!uz)SyoC}Sm(HEfj9B^uPu88*F66(LE#>k_DM!$l7v#0pnXo0zZ=@$d722cwk zO;)epF4Ja7{7(3_`_AWCtwt1tkG9mrT41c4M?zCNs$Tlc7QbVQm5F;hPla1}4YQQQ z!tE`MpmZa+GzIGlsR<4oXZZ`E5NU~V0pULFf!fmNgI_t|EX35Mm4x}JLuCu`(ctbqra$|>p%2MEu}#wXZT@=5EbkW~SjHv!ILPE; zLIB=U?7eK#B5H>3r2($%Wj~zlukTQ{4dRWO+ATh1c82{>?YCK zkaiQar0w2)XRjd3nMg<#!`t4#IXl=6m8q@V#YUvn*NLak^aLJ$YVZSGcoG**z!xzT zbE50K{Y%GzGsCZL_`V5*NTZ^1+T9tCgi#H-P1?{hrFhaoEwi!$ z2N7-8K{`kzq7m6hu@twy%ymeA9V=*iv=#J?{zb%s_f zeQt4Q?7!g81&HlG>KWlfC2Sd_Gx^a?wBBU;hMJB z54WcyDoN_tK`<@9*-NeHz6K4lE(PfaBeFsi6$|Los7owm;zMqW`z#AuY3PCoazA{2 zVTKN4tgk7^em$egK+UN1d{?V)55Jh$*cP#?>#GC?I95C{qWj0q;k(q`32`SdwW^KrcX$r> zG+$e6tWrg1}%9y-DVzq!_lY_Ga-*hpNHh_mca^5cHiZTc+E-!QmnNiFJWOB{Ykk{;*#E7ZSiXw;x zyKet}|NTD87fOoHWJ$*eBx$L|NqbCJDI{1YB>(KY%HVQ|+1=Wrvz6ze?9bhl2b|FJ z&}Q1ap#)Nf`g9i}d(_ec?I}OeGfb^tyH;vZN`xzC?WZk>*?aBz-Ar8;dVE8#nlm{o zoU-%GPcQm5PWg1a`81{3MR;~F%Z1B}ApTXyw?(hdA4X#pbJyNywfoD@^8I}F8S+UU zQ8yf=*T04_60(fby>(<5da%d4gP}0~VHE}4gNAtwG2TCV(vvG*zGV1McQYVyl@iLeBkG7R_gFER+)`Pv2!=YP})r z*4TU-@0{E#r=N3-OR&YY`m5lUJoS0-D%<$YC-^syGMLsF!SigNl)&I)ufuxAY+nVH zpGNc9J3U`h_JIOeY(|J}xsz^>2fv4w#2@;4!r@>RI38fG6xwy#eEcKbGZ|WOL>M;~ zG8c5!mGT@Kg~m_rVP`==$D(qQWD`(BoXXi z47o=8xPEC`t zzgwim`1TfzLRI9qR9UoAPr`dhob=Ih6%zUGU z@v`uxOv0a&403Tq@Ga~Y#aMP7Bs}|FluI?012!_63rNC!0crCN4wMu|uoMcnmo`tYqDISydlnU@gG#ZpcGd|2#$0g=f6^}7Fh8Cmk3jBt_usodSY z+<%Wm$PT0iHkOkfXa3CrDDL$AV=x72A&V{$(%*IaH{|{@gE8b@F9`4NrvEn}>HbKG z_Fs@h`i*4lyF5afKc32N{{HXCakl*@a@Y=kko&Lqh66_o{C~dcH*N@Z|K(x-Rkb^T z{tZUbrT>HxO&qT6zi_na0@402aK!r?j94;=LQ9c)<8~%UZ1R>wQBl&mb5d4tDiMX|UY*Yau@DBq~I3wiw z7jRZxApHLYa1Z_l+}*wZBa)^5i=y~{fhr0AelMIA|Kn+QsDAthsvZA{YWST)#+DZn zBEu~PcR*U)KLpLU`mfJ8{>PdKrT!h9|DpgV;xX>Aw1xi$4nl{2fn(PNV*g)&L-M}> zr{}+b!~PdIdVhiQkEh*%6aEiydj1PI|8Tj#KkP1A|DUh=9jyp~{vF1;Pl?#bH=nD% zSfVI9VyAe%Rrum~*}MM!#@4Rqwe}!3*&wzdC)?XX(%j*2WcbJZW_E74;@i?dpP^fr zIpg`MQGI69rA~P?PLSxr!#BaQJ2n&DpFh{Y#?jSyT}n3}T^pPS4@WJ-;tqeUb;=x_ z488l6yVq6vPNzKUvjn^_s{!L=YhG^%o&$(mS?$8oTe6J4t+WRd-h!!b_gOEZ#&1M# zm;G+jfgZ%S8$-O@=ZEss>yi;b>4pO&i>t=HaN9+ay&<<*k$LyAl)l^a1oOxpJ(v4j z_gZ#WPDP_cuXHBa9mKgF-0+eGp7lD`!z}l7vF$}f{I11Xx0-P;_7|4zo%WQ@mcMz? zPI*f|>u;~5rrHzv)UeR(eYN^z?8bWGdcFHedf51;n>&n4rc~c-bm5IO@M)gn@d1+) zS@RXE=cBE?B6qtpl)VA^y1{pKjh>Sm$a9?3OWdMMokrE#%o_t!021Jkb^4(8}CVy{XtfO47CDxz_Zi_UtFM%buYO$~mAx%*9GtQLbbAuA}( zyQ6%%7kFm@kjHIdU-k?Rqg}~@^Fe0w4cB?RvA1v7((KRqCOqQL6QVjJ>^T-M_GGD% z_H;z74U2fPYG1D?Od z>D^tt*}uVsM8QNq-1wu711YHlPk#|NwqBjT^_!7yX*TF@)D8`7%D>UEG@6B8OI+_= zufDyOZSkob^lSAj0(#*!;ptqw6%h#=G%E$xy&%7NdJ>$Qc173iRVuQdyO+kJQ!rPN zXuzHr8}Saj_z{zadd1+nCI(nTCd>lu-0jk*_-G~gzJ;-XCyR*t1`l?N^!L{-#FXiw zAj4m`P=hl=$C`7O}5ddG1d0Y$Zp! zij8ljqxr|%8}5<7UxM-1&-)Lp4`RQT5yoz};v+8m+(v$%unc~LOh!=_={^DS|GY6n zOFepBbsgp2J%*R}?&17(J^c53B-g5Y_dIOaoLxL^0M4u)wl@E`H1*I?(Xi8ZjhG#or8}1z3+GL z8266*7h~gM?YW;dpV`Z{SeWKGm^X4#FfY-cJ$nZK%-R<->P_oA$PaZ4K0kH1=aApN zc=qgF%-ddcz%OdZqJ#0RuWr{L`hj>fG~e})njTba=(uLPGU6$nlQ)9%Ya54!wc#d%@)} z{ilstxN=lqe9}L64s|*S(QuJ2B^--=jz;$w)ngnb0cdx~Lw-5`any6#+8}mvw7~Ya zqUzDIQX0LwymkhGxzXgX5zG~7`*PsEOml$QKa6+RbWfj4mgZgvyvQS?Uv+aTlN}k> zbbl;!m&S{)^x1&bACQqhap=P;j6mBrd3Z6Y;=FJqu;#Nt+deC7G=*{U+HB9QPUoc+ zf@mGIHnN;Hmlr*$;;xLDZE4GH^H}#xqBjRe{X9^?xk2Eb_<1ym zdE<+aicb^<2K5I$F9pSugkLZ)pE;=d%ci9|may5t^1@*{&J%9>Y-7`J`QEFm>|ppr z>i&87fotD=HA1sAx16f=hF|J&&W9Kv^{k{c0e^-~eOqkt(pUpc>}3j-(L@+{dwA)y zpKLsnfMipr6v2x9pv0;+=$Efqn7oxR0eBSLy4xK0d1AV33hg}a)^mP8$9FGMbtyai zuz>3YEP2==K3$u_n25UT5#tR_%b0_Kz8VpM{5_ZU*YtUFtWb~gms0!q3r*($6OGJW z2R)cGEfAO-lU=`bdGvA4s(D`jOV=MsL?4L9xJkp(!%P1bP7;2@b9>i>5MSOS*n8XW zD)a->6v=To5YOLX#5S4SWz|4Id5R@CfZe>863pFS2nQ*c<`I?N3MR}=6P)nOjD=H^+7 znnLpTbhKVOEv5X79K~M&EgAhvHqL-Kp(0&|f{?j|bZqV>-n+Lln#roR<^eydSoLny z4$VJ(M*1P3b@W%7ByZ(O8^>Ovxdg@b;M_agtaScFujd{m92uxe9R?0?Y7!d6tOiq- z8FhFOE((jjA|xb0xx|i$`CDlbJ=vToo7zLVRi}ee6%Cx}5 zGCZc!Jzjzlsz*LmB)Dm>DhC5gS-*3gX&0n@F~B zzPoroREeF#^MJ84J3lh+g8P-l(xceMe(^lXtE-S~0DptF zOa}u3;phjhhfdcYyn4+&q+7Bt+S-REjWcIC(^I$ww~|ptf8yEPA{MFoQL$%*m+s`M zUMx$NT3F8R(Sl}HV(74jLOqrk1w}`kjAZV`M4!`DZf{1tQ#Q}yWd8|9Yc2&xVswir z{d!wgHgyRCu<+aM^l1-9DuhZm-X@2eFEd_+Mi3;(q*CEEgzs}w!}FJY z!^mP2Eq~|CD=r{dc%|Z_qS>K>GXAmu=7A-|*tbCB2jJu;jlVY@pVss?Zd?)RXT{xb zoAW`bWBcXwrGw7W*hH}}CN^R6{5MjsRXF)TOx1jCuq{kl28dAgvy>r2 zGi+x6?cx34rpszaQQMsx&MFwl)4_4EhqQklrP9`{ZTG2 z`C*Vg5Nk}q`;+MGP-bp3n}6`BYXeN$g%ZGOTOLU%Cc{q5ul_DFM8}iwF+E57>|sm( zteVa00;dL)Se5BNoCzK%!eOx1&WMpuL8Td|QWa?VZK^RF8UF+6G;l5Ge5at@H0=hZ z_9bYwiXVo1ZSRe$UHcJ;_FVK`FN5x%s6NJxKO(7DT*j?}%|50$G6Mj1Sb^SLP*ptQ zsJob(ENpoDLIX@+`5U0wHH84BJzm3%h>iqJNtrxLd#FA z@g%6%xuT~BX6Bl8dSFNTF~Gt%8?aBGq0Rs>Y@_Om+~jEd3O!q5_u@AlNA7p`N4yz*`>YZa?I8 z7*!vP%xN*d5~JGp=q{$}nY3DcFnvv%VkyBXlo#cTTBE?qloyja8K$}iW>ijsXl4cl zatOr)f+Jr><)}T(781w2+mUZ>QeA99fJppbBV-6f-3!O3i##){?6ri-%&;v3(XsiV-h=yl#EAVyx*JBjf5%+ z5Qo$5>0KL*dI=G3Wo)A?`5lDHdW!@O0j7PvGCqT*N0TQwD}RvB6prfK&qz@=Ixflp z$f75PNS9 z0Vi*3IvHXbHtwA!U7TLUDI=`YN_nGI`4LRX*0T5AUl!gydNidR@8sk;w2dNjOW1do z?j9-asO%IyZ&KJLxn6f^iPAm2`!GkaGb?02Tw=y9L?m@ugc7jz?ZHk2AUqhZ5NgSI zbEAfN`7YnSy_N?C_jAX4kP)v`&)`|K(>j>sokOKY2S;xuO+&i}L!bfa z-mJ1fQvzTcMKX7=mpouPJutwALlcpFY~k21#&XRr?LgjWR&2K?^M1EFq@YZLr5`WN zF+9FppBihz|4QyEE;(N}QTf%k0S4iLuSITrnKqc=*||a^3RQ&uKRc8KgKDb_iQP4s zNK~_;6DFF+WO;YQm__;zKkW=rX&h%Ah*bn-AJhT(+iP%Ku;%EQq?<)Ir1cLi{OK&1 z`LFlsmaNB|zuxgCCj7uX7PU}6Y^{D>I#+5#LNUI27#FdqnzY7!HOZ28W)(pHNeu5~ z(uqwW4JECPAGDOuBSQ(yTN%{O7|6TjR@J)Q>*jx} z-r9|DH9;jVjP7po7&hhdFPv$)%|G-EAsgIkc~VEuYA;Y%?I*9IZF#dHFIVSGjB|Wn z8k@AKf!EeV%b&>06nWaudl&#&8rNysX5+BYo_4+kPHo29)poww3}ZjkL>IT;9HO(yOI?B*yiOxbNHSDkKOqrjpwl& zNYWT^imwZYN8`GJ=XKl+aOton`s`=>780PIJiqs~Z5Bx}K6^f+#b2qTlQzMz!A{ro z%r>nh_grY6;Q*Ght0*s;nZxwp73Hbcwr4!kuW(l^W(L_8<98p3k>|x*>p2%Dbbpg~ z_}M>2T-vBnCh1!#^FY-&M@liy{^)y+DF8k_00FHhNtz(OHkNaah%&TcF4j234o$j_ z$SB_(X}O1+^>4&nzU9r$`p8W%ubePal)&JWIuJr*eDWA;a{pj8oncuy?11ymvM~Pm zp7*+NbR0W5cI2F1ru{yov4nGs9MA}!$fNgW%0LP`G zH>b^pz?szXQA52c1x#lJ%L)mPRNY%o5D9yxq1h4H0^<>vgU36OU8i-<#g$qU=#sy3 zF|~SEusm|l%{|Elq&(*rPnjp0Qu)Gdby+C6nEP_eohG=E#(~}AZC82ShS=qe_Jm%c zcGq69W%bN4@VU((Dfw`W0sFu%2^Sg$wtQ{#UP%p9Z7DL@aHw!lI@PM84D7Oorbigd zLHpplpj2#1L80n+Qq0rIgfpY4muR-QqKah+5zs}@$lh@FzSH`_d5wKx(~?WyxrNz zIiA>bfU|jxtX5g`YCY?02Dwdj4>~(TGS4As?#RU{+{asY5g!~&oN|l}Cc4Of(-y6G z`98c0AluD&_<0s%A@YDF<41l2Ajkx43WU4gbm)e7K9=5{?5=E}@RgR*vuLua^a4HW*F8WFgAbO%A*u=y^hd7`4j z*j=OKTQ<>;HPwn+i=YWLg>-}_Jy44j_X$7PEpER>{`oiQcm;aTsSzcc^r`CL;4}M3 zhX$GA;FfF=ixaXXVUK8eAeqKrscDcJUv^6P1A)wtvbXI0r>31txciI@fyRvc6K&N4 z2>V3q;_F@6DI=UXn>9m{Ovr)F+cP=zq4G!ug%dI(yL?xiFde#9A%T5Lq$UkUtzEd= z%Fg1;As!uXEStRH56W;Krtl*>ss=LpR&WxI9t1g>3*kC`4Zha^rr^0)T8eT97maAr zk`nzx2i(4jgn9IfnqunZ6F)@(dz_Wt3LULkzWaxRpu=+)lXw@*mT}>l-2%5=R{nvl z&4vV}dIr93DF!>654$gFpDlXY_LYJuYzJF(8IRQB9;2!d-n%`i%!q2j zaR%neYn1CuOdyLPF*Q%-;U^32^b^%0DsG1yed>%>9&)(M9jBr*mb+vFHM* zl_Nm?`qd1$9A}m+&}%7!?vsx0l_~8fZHvTM)#&4nA@^Joy7lUsV2hr@7?g1WNipS3 zlKT!_fd9Tc-<`&+VqZ4AL?v4Tj?n$ z$75sO?_YDqDCt`^KQR@&kiF<)SLx-I+EL0GJ~hjZR>L^VKPVx7X&F>8$%&EMLl>8$ z5TS;V^bF;_=Ju|9ELhHL6|?R>S1ay(F|~7*1K7|mznr@9Yg6o8T~mdU>>@=8GvX%O z$owq3k*xj?=Rx;O!b7ot`v!6OWsOkp$M|v01evr}QyWYQkVFrmrMPXb2})4)&wp-^ z_}1JOCgrBOG@z=A#j*f94r@H#%q1qidss~AVI;wYh21gp?&oW?Gu@rR3kyiCM^gX5FMIqsDkptWgku}dYb-5DAZuS(+7PAL z?WmO{N?drhAv)Y>)Ny)7ymERk;T1iE!G5~2P?U_2)HLv$(tPPyj)#d)40QI5HyNu3 z2J{+QBiYcB)XwW@9CS_G4*-ZmD)a_%>*XrT1X|nW{+d*K`g`BZFCq@J3w3Jq*X-Nl zl(6f^M_Oj-V~GOJCZ@+I)W5maj?F&}Bk7pdE~8zVB4`ra-_+j98}r{xxK=&BKa}&l z0v`s8n&`5U!E9VK!-r@!*oGlto?z0?<)o3uyP$AnGL3nG6SG(dV(=D2XX>3J zIrk*a|PXxx>`P!Vc{%&WBt46Q+5=RH& z(U-aIE)lu;G^8CDFTh^d89GLHc8ezG#~+)l!dMTVPiJZbJjZ*qBcM4LLH&7yd*STr ze)IDN1@V3lHf5J6;9>(qg{^EETIl!%)R)R`P^h5`D{j4dPX1l`2k18iue}>{60T#S z_a5t_%S*LmL@2k!M#0Cpv*XV%onNxond*w^nFknzUpCiNS&a>zYEi73;p^>2O@yg9 zZnE{cpo}cz+FV$fUxJ=l?L1x<2p|aHcV>>GR$K0zNPGXB`cl88jyKn-Qu+co9&l_N z`p7-9ZG7A@$HJfC7@69XBP-}b|Ed`U$;&zeTbda4^~^OSiMB8NDBG8x{2bh~CTc~M z!Vv>wT2koTrM*j=trWm4Ov)tQCh6Y$W+@Ccp|=#HYPlmtJZXug7q+A%&;r(u_&YvdzSU{adU4x#s4P z@!=k?dLF(BrGR+b^XF>X_raI$1@2+Pp82j1QZX|ZOn+9@tfMflkDM+!P{xZ1`upT@ z=$&1LhiP(&L_^YOy6UWBr*~#Tq|uEn*FG$qDI*4|+{UVf?vY46rWFE{uQu{_8k$Ra zP{zqvStPVHyt)z1_O}B~?K?0=%LJqr3zqU@%|mCg+FW}WI3#N|7`)4lG?pmk~+QA?yH>A)Xtgx zT4pY0Y6frqelCDqoYBc$78v-6hcyMeuJmJNl_FP_r0RW91OjFbqrymm4ri%bWq#yRU0?xEPalQ>Zihj#T@u5cQ+w*t)nkTmOXG zI61HbyQ=V9348lv18dyn(yPSpbh>YMCR|lL1{bWwRn@%~KRljQ zzk~`Tr)dS|EKQHR<*u`%p#&q zS6`&=p+7TMWjvZOswscu42i1CTUJ`q3^ONP;&``@5JQqmxchxbQB>VnVvg!j#N9a8 z8~b;8VRS$4l4>CN@;_tNd?V4=p&IQ5!Q!wPbU3P!5dIA}SAHHNeo70V1c#%y$p@Px zW26!IQ2~CkHdQ>M?6wOm24{pN9{%_0YbvG74<&1n>$?(oD>8;aAv<5wW!9?}{7;pZ z*yBT3is@%1s-GT=*#VHfKg7DbwSU}BlfkCGHgekV2W7D)dt*|lbE|N%4sAt{5C1c8 z5BFrltF#iS*1+L8J0Qiw;-wRMIx?LA9i+MaY1+F&= zZT>pYg+3Iuw5l@andcp@&K} z-(jj0fVCSSj9x_}K^x})NY22s4eG2HXzXsz^{vbr9jNe!kn`TBggRN=Bimu9fuJ(? zD*Nih%4Rd=v?R*a(?pdS@kR-}a$tVz&fE9mEM6+GtKy%k(cAw%7du+eOH?*?e_xn1Z`fHN{EkFP(Bivu0+3twb+c_50g%nwbE1;5A44&rHkO z&KR0+8y0g~4xujtH@};;LPudK6f+M3^TH#i-|g3>>Wc6b z+c!XSZVD8wbJ;b_lhpB+Bb2WGaLW!j)qi#{KX6gbLTWCY^fw+g;^(%x6jjr4*hX5e?rwyo;=X-p71 zDOgP4+9WLZW;ZNG!W84$A)V|82%dK}q!;7in|JVO$8pi}DMqAs8kc`sP;oEUkI!J%UciTobQC zIRm&&m*8Yv_y@NH3eTxcWi>h0N~?-q{D4=hx7go?4Pex&hqNXjxz}jNfNB}x)HYrg zEG z!R&h|7TPk$BMONQMUtyyYkBmEg277txk@t)RH8ub{qU9yz^76IZc>4?Qa6^1G=5uMlS3>YHTs)jWlWQ9}DzF#c7IepMW6k4kKl_lG=aD8&w-QbLw}oknrA` zK-ohn&GgimqF4I!azKefc=b9U*JQ|Wer#{+$TN2ssiuSZ zBH~JU%~H)(cM9uBILF*nMrtLy5VB zxY5O|3aat)#k$+Fo3pw7Vcl|VQn5r^p~80F#L8lMtsCDb#)#yL-^YZp&#`T|6 zbbOjke!K}vs?I!PJ~P!2xv6`NSa8oczDZcK?Zg45bJlUENPZFgk!4@lnf{bvv+&y> zt#m-V*-)LlXS3EIC$<7yp<{Fv!^&a_-0_>D-_?ANumG#pD$)~0;Hfr018Lbc)8GWv z9Jr;4DiUMK&n4%;VM&rU{PYD>e;kOFFKI;;CAP+mm^1snr%F*c(Bzv$n_&4kH~kY@ z=w{a=TXp;bV)BoLtlF2E+2Yfa_{NAo##MY8!OPJtD#?zjBi_0@L&<)JQJv+IflL`S ziN;%SHLB*6g#gU1MiNbS23{WPen*C*hbi>49{JQ}{8|;M1Da{BLFf71vR~f z9Z)9r>IW~B&IP>Q^q)6+1MSS(ZHbnM zn$c@0o5z&qs5i#3o3W zO7rPk2QCi%_s3YG7C{Y6T9PbpiF3OGXaq7e1Qd=o+i|ktk%Fwj&TVP0u~46cb#cu~ z6WL_R>rJfc9#D)ZJnty|nM$C~1vSZSutm&==-Ep2h5f<>Kmdpq3m7cn1c9~+ZoXE zn2&mshURR-?fx~hpFTmDezb#{u4i! z1ZCx}m7*Y5HsXVF8MGK(5hR4s%5vMJ8pSX$R~1~IjFM#m9QElc1r>g7>A*FCc8q%{ zvsf=WjoLX~S#Ydn&@e?OLal{SMTR>aJy{XjA#0wdCr(`NSqH~x%@eH;J!4ubYm_O~ zm}*Pbtea*U-Vu2fG}mO07;i-ri8?xnh{^L%%Kr$HFWeFn3<>WsIicPwlB2fj&-rbF z*(${X(18?d!WR6JrtOlLpR$#jqr$h$iHbHt+(q^FD&$E_w}r&ohafsEYR7IvjiKcU zZuzONG)*E&YuyJWWx+TQZ}v^rd_BCQH$nT9AfwKPrpHMd$7u2Wo67gNxk+4p!oJFb z|BkohCO?rhXrA>!`$Pwu$b zSIWq`musCha}NPd?eQ9w_Lk{mHv*h?82Wz9P-VnO8QoULuD8NR1p4ESUVn`<-z`#?tg@~}heCTdM44#B z)oMg+I8AICh+yl7X6Ho!Z_*9K=_T3a;%)V}iXfZrR7M)al5K_``?v~BQ~k~B!Y?3= zA2CexqOKb{)sdRhul-ckF7+{j^nuc#uvFKWM@8O*Z-&n0uHer3 zYwCRe%}+0=CAZQ()zB@|M2Zezbab^t%9Q{lzy9?|kv^x2Tav7e5cbISV;29j9m$Y@E0w*k8xu%L?4v_ z_F1`N)hi|?OHz$zjql+2-W<on80J6`n?gA4$x}r;d;&0MX%I^4k+X z20}>lGim}Z$=(YzyvkQyQp><@zMqQgNPT_;393B8SoC@r0`A-vzc|r#*mzLi zuJh9(F3TAEJ2+=3~*&LkfXB28MR@I5%UqoYp8 zE6pYc@lg5M?^CN-CsKb-d4ZNbfe!@cVc+0EtB{r~a&~HYXhkjrpDj*i{Uhe-!fQ!5cKbfE*w(En3Q^e2(O(a+P!y1EY&NY|dC!-A@-Y_;h zK|KeDJjB?hml8BDOstr*oIl<`kE%6ch$>(y3WdU|Y@e?Bp6Th@Sz>ksvP89(AuK zP2y#lIn`R#Ju6ioXysQa}wo+!;)Z){J_^hV284vS<{oy)`_AkD-@dnd)~+O8C4 zOjC~k^1a>X8=1eFRlcQjBXeP@s#dwV=RIv@{#{m`Y~?DhM5IRC_E9kok$ojZcY!i| zppw`^{(T_|&NhHWpKa&MEj3l#PlM)sZBSgObeq;#4L^6?G5_UR#PgikY5Ce;Os_1d z{~~aTU7Gb7#KAFg^5sS@BC9}Yk#605*|4amYlHtAeue0cL;;LRC~^R!D|6iATC-k( zG?Oy*Fsh;CjBJPX)$`3r=Kj`{p}#^Bb$NTMvO0N>J`j zOC_AwmIf~PsuJ&Ld)jtsf2S~}t5|O5JYvPQi335`JLO}WT3i!tR4sx>Jc*}W-y2YQhEe>_Y*nBp5t8^AEsq@Of z!UaYyJ@9X?WAoms_KPK?8w-K#xfJP{N5HqZ=rWLY?hMQ@l9vU8!tm>1p662}VQsl!M8~^AlCHRa168AMdhaVjiAr^l`0ufY_U!?)%%f*RwfTI8xD1=9fFvPu$03V6p-f%#HJ`UW!3Lx*~R#> zC3>=(1!Odxwg+u2d@f>YP~aQ#`|R$?o?;tO8;j9<9s2-7pPU$ILpett$g%k{)=ln+ zcEmymi=YV0lCQJH$_i$nP~%4Ud+daT<;Yxhl0@bW^%*@CtQB$#h|~=9v9=CJxcG$3Zwo_E2GLFH7Xn*EAntduj+TzoSga@87py-4L>+M1HVZuLMTk#%TMIHXykdncJ;&G9CtLiAd@X!>~}=qJGN z(62Sw>=>L$FDvu=cjN^9hHc$z)c#MZbB+T0!Nm1R6V2(UvFa;FC zCNV%ZU#NjpRE+VEz0YQ74ROOSIsXBir;v*fIY(Jr#`-QFM6UE92!ZYH(SAeXgz_eV zDe0j{|0fW0*oUCP3C->P~jfPRyO(CLn8if@WQQB|F zz%{wv$0LAB2Iv0E+=i}5t6SFX_=BQK^9)Zs7}Zys{$mhxQ}Z4CmlHz-Qix(^nkL=w z+STG!44IG`p|6Ikqt`yiJL|-|J(@g2H5BcE_?Pt_R8i<;7k0}E<3piSFa)%2+q#Fl znp_Ov8kY7fQQPv-S@0Y8xVco7K#(f`O)XCfyO-vL z?{dab}&ExirY27C`6zq;Gook+)Tv_LWYqP+QNg@P|n=bK$ zI{TD`gcqh%7Jh22r0(Lq)=5*&vruP6rj?_aJX^RYRc>X(W5j$t@8SQ(tybqP0DX6p z(Z`6jaxHDZlT!&YjVLH^cxviG(-~Hkk?UEA{6dM{u;!PlJcsw!|xQ%(klf z5alMJC~lRvP(@l?aIEYF|1jJF`+B-IC}x~UBv%Y#rPwEa*ZJk63>3Zp$A(*LDtJm& zYIw+z9nQG8%DpZJ`;n|3?ug)TD)x_s?&;5rr0Dw9AfH5rv@LdgoC@&+G6hq?0|7 z2-Q^`5y?L^md9$k@K9I3?DsRXaRYB_^r#8%4{-=Shw*YJ$_s`I*oamI{Any9Xv7F) z)im+E@yc|JYaVr}9$L1Z844DK z*-P76Gg@+#M1v{t04p~koaGB^QY2CU(X^KANdc=VG4l&(4qS>#f+#D_h<*FlB6Q7E zke^%F ztOWK=I+}+eB?}RcOW6;UzXP_7!XGELwQ_bVwXH8uPC7a41ndZw)n8U%lg=-zUY9`+Rrk6~iid`=L!3UaC)`LRqPp4w*;Z8c~* zNAT68sDc6{^c6be&c-HeHmpp-3gM<@1%?tmN=fxV90kz$4X2Q5KQbJXbr)}`-$o_a z-u~NZPZfDpPG`fZhzO1YvXQ3oGtHLz&s_Q#iNzyCM)+1WKUPT?XVb`Srfg&^Dh3HR zY9%_jnc1vN=61fNG`{9g7N4svoZ~M~M1mA2BE9^-48U+mCmu_YI^SEhXO(m4kBfS7 zAaZ!uFiin4HYjb+eGS_UTccU!`(9+B=1XOY+}PJY zaOEnEn}hKS8x`v)wOqdDntRWGUB^RK(G#o!3f@V>GNlI(It!V9i$ydzfD47wZxtH3 z=pd7v7@AZo{4rs-AX)wb33@3+WnNB?OO?9JO7*H{yjik{pd~W1nfDX%ag1{RVM{`i zQ7l4B)vvw8AJJ}XCB=^8iphD35;Zs#ZbbtXeAqRAR_p(Y+0sSXz)NitJAcy%cxjGk zw&bENM>u$-*f-4;40vKK#5&V6El^;JLub>LeS$c_*>8}%3P?p9f<`4ctaxS9>^ibP zN3`LgBYl7WH_c+ldqKTT^Ck9h?}}SjA&oYuaFC)x#Bhky(y_8zv%;S9bX2C7>|=*C zZy!T%jXIx#j@$P=)1j9jz*z=SOR{95ux9toln_@(wcOJTRV0g&`~9Ax&pN@%u{>9j z;ME~@*4v^RJrNZX$Ct-iAaCfXvC+%}1$F~k|KdRo+E#tcn-DXAEvy}(FT-mF#wDx^ z{LjYCyg7++jQi8)azW`WK2;&5oJY<^t`93;oO7t=4NPoYWh@uu+nh(GcIOQrw4r!7 zDsRirW^}3=YOCoDs$m&>nKh!aYGK1dBc*0zZSgpQxV}Cqg&*?yrEGWvDj+CIgBk6V z@)b#<r&hC$qFETdC?AJH^*TjR857 z=FSV_zs%yLG*fmj-TF1=;u&I1Uzr3dOHS*zns936yoA2^fhCDJ9s~NS#SiGqoibU} zDJDu_y7QMvlxP8vc|kHyUVHZUhjm|#MgD!Z{~PrvL)t5Kte0j|Hv42Pe&Y*X+5$)34Tb4OMs#@mQ5gM0K7u4E(GL9inySk3Kt^hk?)`ki zqDT*Vuz7ljO<}aTRiL@h{H*p#Lt+#(OgrMm!M?j)bgNPWShT;l0~+GZKen+}Q)`zv z(bZfA)MHvUFr%x)rv`=H)!-MT{&3!%)?Vj7^xZkdS~)=fp(bUtPrdjd8F>a3GG}jJ zsLJEVJqDyAy4Y6DRc8N+P%8Q0HK-}?saqd1oSZPm_j=FrkTCtv3DTjEe7sPOtqICP zwuYu6swIveR+f{j37Dyih5{M|KmRkCR_k4%-^O`P^(+D#1vSFj2>a+|I77$t%G^W) zjKAXUxdrcN|GgR!uh4SE zz%M0Mabff?XUOM+W2)vH5RQ|gsS1jTBx8R#lnZQ*)J6NfANihf3Ky+T)Xy6k!R#g{ zfjSb0x6v8IOnra1dS9gd3bmHLsI%e?fs1yBpV||%1hV&W$7fWXwADVof_M#p(L31p zIP5Ev6dw(`M5bb*m1n#xh2qMP){)&Avna%E?6>1GLxZ~75`TXyizs33!+MDLF4}yk z)%lXIwNl&)uPP%rDw$z54RhrEKZupDnp3Ym^qQWI5pED2?w+7%6sT-_t+18y{d_1| z`X-BRt%;LFVm{k`1aNB=K<2$6%&Pgio7(ydR_bi9>fpg%EklPwZ!8~Ic@!i7 z-W6@OLAg%npYcgU4Bm{krb(BSX`Q%~7`=~lZA<2co&isIGbJim7-XMYl8Wt@D$;I0 zM+SeN&w}7(Y9QM>3AtIPUG@VRYDAZFGV@a|LFe4F4Qlg5z=1aC(0ehrVS6gFV{s-+6CfEW)+4?#-z;ya<)289wu46sgNe{%4Uk!f!IQd#Dd*tcV~t z@t?VkVVwjNQzj2Jzy{_(8D)8u)LATdjN>KAX62vysgUL*=BAFk5+_}gK(E;XA;&Z{ zojrKVB;=d4OV**g(QEhm1d3n0q`7e5+-OKs2b&-M4tZm&QJJG0y&jJ#Zf0F2sW&0Z4NiKuu<&uH z*TfOE{_W5}mo|-bra@-?KJU5!YsG5eR6AWUX1LAIZ;VIiw9Lg3ueaZIU?lw|n?ukB zP4y2Q%cXISF9jBWjCnDJG<+Ee^qOkql{kmN9so9n>qYv0WhazCp1;j<#EoW4v*^Uk zUa0UxE$UwdVmUjrH+6ozM0=mFD9*8E>eDRQ_XW6;X+;q(`>D9IjVmP_scdP?xu}0z!2_{~wNjcXWjgV97B3082==gpELgynBtD}3yfDNQ{!a{#mz8jhkF|fUeY!0Tn(!u zxuG>a!}GN@a3r=W+L1xS(s@*9Fk|kP=A!srv}$iHA(ODQKRaN{p9(DkDZ1`)=RoX; z{GCF{XD1W&U94u{?IA&C?u1S5aNc+p{cj$%V(3_pU1le+Dr9FWZOqBLMWNUhZMDuQ z5ZEY_EHeRmjzkV!^fcw*otrtG)?BVJGyU-MmO$z&F+P1w!FQhso6yje$O2f@!MA{Ohl#+|Cv%Qn*Y zdCmr}5i@Yp(azM3v}iQJso-e_5P3wbS{Oou|BLD-F-HR>Ea6+7ZA8Y~$e9Vu4A;*6 zPI%q8yECdPq|A+n4Vj(EqEyc3IAFF=3IU(ZZVVp)32cu2+dR5r5()p56gdPxs+=*d zw4(Eh@?kcWFmK6jAwsW?32MFW#6Q{`kofJwg_>XwF=^;Ig^X#3NoQbT+SQ9QT_a?F z`rCoPIq`ovAyUzZf<45TY*^L0gPGlcnlw50VNbn83DC;Bw|6zcY|V2dPw4EXQu zNW-Ui=%WWb+jj{6mXt*sGh6JV*4AJ|Swgq4=@{#~c1lElyz5yDMucoSK>F7qnReox z!ed!~1zOGg$MCaZMSo&1P4%*_xqX}$;c3latnYamGDv%8Yen5)c6R(fy8(Z<)3ls&7I&wm_)=-}=u zs_-|~Pasv!y1OMk6|33fcsgs5q4ny(p`S*Vr zKzI88w-FF-D2oEwX2}p*jma7gJ}$YUxN zq0k49I#=4iVog#Db3Rv!f`jxcS9d zz;n>Xj@&%1$zcca?yXBtIoTv2k}kCu`JU)+PfEDw0^XIy@d0SifiHt)Wk-5*u+cWGS1jwLPd-Z(6EH* zJ=U8*dVPynE~5GHXx34Sig(5OfHMK{C7ehw=ayj8i=IWdZ??VRbX;CIcSp^nC16$2 z4?sOIchc}1gZ2B#V^8O3bc9zKy?!^FMw@*f>3o6J`kXR7i&VYNd}!$-#etYDz}Hy` zehr%E_=>@1tncLgm1;qjq82<7A?b?mISAD66)o+7F&#BX+|h$ zSTYbo%dW|Ix*r^lsrT+X$_lvP1(w}#Ja^ppa@OG!!PYO$)+fgJv0z&60Q=WHz}did z>Z+z)dC_z78$EhcUVB{q&eVTEnsQRUcd>XUQQV)IO|l1=D>Cv{-p~CRI>(b0QGUs= z?(dUuC(kjtLk62sVj=e9avoyf@E!VcNk+m2;p{jpP0=m{L@lHANIRgbe_C?_wlu3 zxqwongUH8*YbIJ1R?X0O95CCmuB&m^ygASXC|=s5ZRGrAwDz5~Yy4`#o-Y(8QZ!@| zb!7(GUodGFzNykeZ?thEw1E{=^D|tl$Zn16)d$koq-(#`x5U!A#=X+^^7OLO;XZ{W z&KfV}2raoC#43^0yW%ITHN25lwuXM6{%Ej(&hH;e3#V_1EZ#)1XxI$s`0%ND+RYu> zlz!6~<$}ACJQ67Z+O;CRj*$eVvKLTBu(gD>#NcjPB0m(g*_~&J5pM83u#Q<`*Q;*( z&w@V)rOi4dA(pA#kVJ0l5RyodGu|fZ6x7e)@nguqHsOR~1rd&#aQ@N~PYg!>6$TUN znBq3|;<`aXhH?S2#(7}b)CvrSd%Qt-T1i4KcT`bsSJQqB`Ul-UMeK0 z@W=wH3Qt`s!(f<)Q`57^OX2tJ@ow%x*y)LKJ8?U_4qtMNk|SX;7{7Oy!EoJhEy6P@ e0#fIi3hy>3>{KmABFGVS34_}rJj0dnFa8FJ`DX)f+zpI@m;b&a=2kM5_R7G`tQ%QnzUL}{^?uTY;od-nR-3IbXv4*ICR{8V9V*m+Z7{qz$AbRGWa@G|V7)*Ab ztF`2NoIAyBO-)!NN*-(7>SZ%kaTGRLR`iLud3?a;uH+emznC(s>P)85R+E#HdGa^~ zDVup8kLU!~<6kjW6$s#W{9S)9<}Bo1!)LMlDY z*n0m2)ntR6$aW6pR#+KtnL+_BDLV1ioyMqd6O*N5?+|it+~#7$V9(x{WD9Z4E7-n* z6IGpO%X%dyfT6Hh*RdXWD>&fqW9V+jced4!eL5*wqdgf&tgN~haByzl z`Esj=wO?szbxx~HYKol-e{awzjSA77$LV?X25dapFJ%v-l$NPBigVW2&RSQJy_3Jp z)1=(tVRq*N&mYeBsOP5HP@(N#$S0!Qh&NWm*XvTCF37Y$oNF5&*saeB zr0Vz4th`;-CC=FqDb29yp=8qm6q#MJ{KfN*>vOlfLyxM@3e~CBy^R+M$<_xK%t>(D z8spaJdk`7W>n&S9#T}|i#=b&l-Q3lEPx|GpU>W+ETPxlBoEt!qPg1T!kU$$nOf-^e z>lFhohW)P54(jDC*-_bRP2u5qB5EJh!k7S<0@=S zNV`Oo$@ox!gjbfa*Ui*!?i59q9U2gsH(>kN!gPQ#57fv-BoJ{HzpuK$nbfmYaQ}vP zX*9*id^ZL%p(_Zw6n*L9cBHA`{DNz^BCOd+|8I;|K;3X0|D<|)dX?$JUX=L{67 zU(@;)QglP5kwed3ku&Xov?PFk-G}_Q$@S^u5yS$7U5;9r{a$fLAunt&S5&9iWfz% zin4u!@%6uf&itgPqTia5Gh_iBdcQ_N)xYya&8+CCFqC~_0;)c@eD5oee36ks<^fB6v3KY{tdhrsT45IRgeGM|U=*yVI~FQR94`z`RxgEd>WNW zau!eAAH@BBeZpYL3z2#cy~^7OJlY5EJC&*JqPy-Ij^x*2zj3%{=5G+Fo@j4Akxkem@%!z#C%xIx=> zPT`fTcrSuA3H}hK#dAUwsndH@!Fp)h|INz{YJ?#^njXMbXe)nbLXDPs67nYz4%er~ zkwEzfcC4P)*sWvIu_Abe?q`kMrc(vTh87_fqc-g}We=M1?mHR=CHMOPx`3+OEpA_O zZVfN#qfb(uIwKb?d-%Wa>|;iPV;%^%P_({W*J-WswA7e1ionUi1O%nRMv^t`_*-U%H3P}V!n{DW$d389gxOqsR9 zXwZgh_{G3c9BHEU8ardM;kB$L4Z6x-BYyz={HZj&o{j2<|5WE@(bR0J8d$?_NvsCV zmB;?>!_ErNefjQVK06n8_@)x|3($@}NXK#_89JX~`zywGx%t~$(yZrN!<~D\Es zG=p0`l;n_Lx_&8vRDcBuknY9jHBQlkGlL_Xn={cpm)#Yy3155O7Gu;C5)=nc0YOiI z%vh&mD)=+ipD}KM8Dc!zK%y+1E3S>0;2*#CG@SY5EVhh7kF5eFKh(aYUHi5?@KW-W zrm%l=6t`a5KbfJqgzD(CM6}GAUi$CbimE?N(oOd5_2GS?8A;Vk32!}^FJc0&00v}Qp|bSBA0qrq4~ zNBIL=-2*^wk*Kkj%5j3U>Ws|3cMM70vPbyCa-ri1UK6SU4dxs#DS5~x^`uw)b)IwrVJ`NP~gmT8#rb*=a(r=bno zwGE>-v9ryBjZ4(yzM5&;oc!$$HtIZ4n|dY13j;As>2FedGu zWja?dG1cbxI9qbxVCl%84Q0A`PyPluvTjHYdWNZ-FO@O-!-xx(#{|~?~KC$`rgA{2b*4af9cZLBDyX$m>?&!MyUKDf6jq<>7&)y>_?Am973>yLr?OU@lG~Hg;}M`i^~w+Lq((v4$2&(n z*ok*y!c*UanEXNWu%&DcDc#;no3jGes})(pu&%PzsL#pQHEtvu_F{Zg>I-JQ%R}&# z!&3mCEO$&gB=e#e9xp#4N%Io7qV9sbbK#Z@DE{VtmydLt?X|)JyIC|=J-6E*QSA~3 z?}Jb+AW{CHNXcyoJI&9>HQT0M`+UvE^(k6U=&3+n;Dj+bq{3?dg2NiqBD(KNIlh!I zan^j(#m$h7dp~Mt9}9ltDOin0I=sIo^X40rZ<*1g;Ltu)MnQj&5Kg+bI`7@q5Zga? z7YoejFK?tg3GKbSa{Hi!tv4`N0|fsOXj(?*FxF6BGTc3b+QX)`@&e~BW01YYMcl0^ zZn729SM(nEtB8f8yI|(3-&$7~Itt{^;TS$$ZOjs+SaoVp>eFVgxTc^x*5|p&999xIvP0~9U=bn+eijyL7 z^NbF`@0=~aat~ly_uRn8VURvI@ko6GWARa2BXMVk_A=tAopmNfA$W<#UzkJcL}HDH zeJ9~;I>_D_jD^6fk&ajX21Dk7#7M-F=h?7pl76$)?kj znUN>boPX|&7T3F3HoB>F*EQzKp+86&O!FiTUCZfBtI!br8qeQw<&nCl5j8=O=-=9) z5xDy~1qW||d`ueNvcUH$+uzfxt4zap7ZWMf~<%0aXb8^6klE6d>{4X}pr~{wG@}&4(O&m?=y7x}F!&$(DenU)( z(HN$D9J4JTYFF%RX@2FF8+4d^3uu#{%gFIeSQAxEcWoK^3YzxLyImR*K^ zyc>9^_K+{?eMrwM{qjJYwo`iBLod~G;~IYW5XHlNmvF1Ia&~6m64(vL2K<;t^n|Ok zj+{*Y#By%M;wcT;Jc3-iS1i?wi%^Zse{~QkEX*9!?sXXYgp( zC5~lxm*x{W$5$^ss14(zZj%m2_+=`4_?m^gBE#AY>IQPpOu5mov3OLrr*4l#d1g}3 zEbWb#j&>WY`R$>1*`MWae#6byxEH^dY_PjPu0PUX#Kbm&9s}xmd*hrHxC}NwR@)i2 zBVooILBp$^fvScFdt~{a*gIQ=jx7IjsyEK>L4lPCe5ZEu0d)ili7}br!N?#bxywVd-nOy{RY%dc2lNnK84=*4zG$lfT8Z-;!97==Th`(3?J&1&&YM}Wi+ zaG6urq7xvo{E-)T_g;MV#J8SDZgx+!BeOBWjlgo41I+}j#9l$3Lo>xK>_D15pB-Z- zI=!+xR+B%<^$l?Bw&DYh5!+{bXXhd|4y=N*R&DfCG7lpD3R8UsOyJ118p@`(^Wl z3IoNz!Gsl^oRZ~}l8LUO*WKl)N1ZMtcCG@B>l$U}QiU- zGpDwk>4CTV9&vwgo0%mKI#Zl8e{%5wi`t&UBw<;jRiTMI6%Ru#1ziE0A2 zYQGfmDQ@)zCp!1}Zfx;4Z_Gztf1IZ@U+=3?;d(dj8gnEyUbmcPqq~7y*6($ktA%?} zMu!Sc>0!2cc4_Fgj3c@s0LCk-!CP{(9lo=64+41pzcr1zFD$>i*SdA7Eq&#Q{jh;B zTsO}`-6&@UGq5`}?7^DZx~JWgv%^N~lyu}G1-6>G{qg+Tfos&&Htq80y;mjw(GX7+ zW&F1LSS&)=&zlcarjXjN_9cOMlilvC!DAFHNxO1Hu|xobN}ph|d#Pz$cP(zojb8P) zFu_24S9J~jeN$UYAH@X;5ejjCvghhx;QC|a15H7Db1(fe)d&yXS4}}FEw##q`KaP| zSkz``Jp-!X>Z5k5gtlbYYrGh zkAY5H(UVT{Avv)cB*lg@W3=?w8Onh!pSZ;Y#hJ4(%; zNrt?RU#T29IAT&T(08h9oxttR!NB6dt--px8KqJql4uCE&+XP}?dH++1GhTbi<$-9 z7d4Xa7jAiFnqArqul;PeoP87!3mw5G0SIdk)JVR*qdMhJU~86wC4ZN2br3{~E@fE# z$#17evqMAZ+gb5rOXgL_X>l_--iox4c7!XE{VQJwvd!%SGqC~meX0=!l#uD?(a+fy zjhU4+Bh4@V{4Uy59Pu?AdC?kuZ&h*~`KN;y*OXeO#utBN-BArM*DR$fT*7<+P*`!d z52bTqL+h(JtL1E$UzF4y)Os~_Sg*|?GX?kOT{9FrGV zb62HOjyXp0yQ9Yv&d;g~Jp^tz&l4l}NOvdsh7PngkTr8zyF#IfZK+a!G^~ zYA5H}I0_P*6Q~^XQMalURP~f;8D!*({9js({3Iu2-2B#1ucLghb?zk_sE-=iI&7#*$fm+7nSteUGZFAD-FpA-sj0>6J zrro2=hr;=-#2vI3!W~#mQCEDcT$179=Sw^dsWfYH`%%--GbVio)7E_wBQPYrK(ZM5 zgFa6J;8r96?zI_re4K9P{lYnu7T4L!j~AboG?zA2zq@rDt1SadG@vpCzcuw0J!&QI z7D+;Jm&2RkM2X_V4xVwxT`GErLNRIoiu~}~0?YM&t3DN#4@Sb<+mWGF3*D<79{P>Z zIOj$_YImw#(mR5dPH`_DR>M+~TP-JIIpAjX(`_*UgHy?)6gN^-&%1gq55s&~Q`me_ z>91=Q<$40-VjqV4y*@$REq+&>xWS;h^aY3Tx)y_@9*1Rlc-sf5*dSbY^uczJb46aH z^?{LOsub*jUK`6JFSEZBqZ9vw*BG%fKRGP@pliC7j5?*&?}JBA9tce7Zp)sshHC}y z0!-0%up6G%Sb4Nu5xrz#2F{zk& zq@&>2^rzSJjHr;LRIlfOjO9S~LHS=)llq2pkOx9H>d^buNOQC}G>s%oxoq}FRRh%w zqS2@JLoVeG*I!WWfAa7h?Sop&S}f(E1QvF~`o@!wjrT3rV{>>0+CU*h%cN{P+lsc_ z>b8`%Xr%leRXF|YgQ}7sk;JRdnt|%GyrYFdZt2tRP|Cj$!Hpto7kLtkYAk~&VuOrZ zjE$(Orq(SvA>yd1`jTg2jeh~P*;k~|ODV!BVGiqeGXhvAB`n@5$qYMylB%FiG8vcL zGXr&qiISZIPUa3SX<^$T)odx-sB@D`^9%ukA(~Bh8a?lOCge=qSc>k7x=;J7Fqki= zX7)5XVlA6vj}sl6>Q88!uJrsFA@KGN-(YFhJ3K;4P)M?sPc&o4fHxvbE{b2y>R$O5 z!V^tBAt13q0yIT_nVTAwUg6Be#cXwvJ(x$D-Yu@nORKz7t)cG7Jop}T5{*u+s6;$* zwxhNCa=i)tI%m1lYP=40k=f?HlolXCv$o6)8h0Noj>IauL+myKo*)QHF<{L39TiOR+f$OL^_XxwDM=E(7%0%> z*s*8pfLqj<%%ManF6I*^FX_kPvN{p7mF6Y2E$M$lskQgeU<{UaCOc2ZFkuS(VDDhY z6w{ioxkjYRNKmrt14)!U#eSfIf|&j5DA6=zb@;LQPl{`h2D5yRe1MuD1J))W?b#EC z!YRwfleSAhKM!7BA{6#9BjKH6tufbu zeQsg*S&9sSW+nlO%qWomu}Hq3T!V6Q)HS%kG)u{d6fmmDle?jc{&Q-CwZn9cw?a{> zj1I}#1+N$AsyfKCT4H7DDZ)$j*&}(bzcRe3=j?O4ix&IVRsK|o+oE-JmbX#*8%Ti3 zDq8maD4TKdFu$Xt4JkPwE)Rtr#qDSJe*Si2wL@`x4B&1N4nO0l+BqIacHcZ!~Kvl^qcm*gNRqT%6|E;vdV&4$c(;HV3c+ zoiVqtbpU?hDufw084Bw=?AGISbLH3KU(&2`4#ZNoD4vrn=(j^xpn_$diqJi*>{Ucf zkq$Gk%kF`xNt#Tey&)Wro7)3_6{ZY&thj)RiV&$lo_s?VQ>Ihh`yfS*W?Cz7K61Z; z&$($F(}!gBFU?$aiE{h;wq@7aZ1# z%0>uaT#z>F!DD$V&+npVFs|a0oJb0raMeu7`Ifys;d>KCA)_zkNYXxfC@5=-Y^2~Bx*2hyq~{-N>SB~W&k#w8Ki%G5-SfL$kzEh#lQ(f zlDN$Gu>a+_v-fmK7Jo$9)#Ny|jBc_e6~4=wOdcvssvk6ueq2|^s87!dWx(U!86r~? zjT~x@z1=y_kvb%KIGM=ldq^q-u1~iNlg>62z@rX8VUyD0MM91jYYe~K2bEc-KSata zrY?qLQ^?(WYC4W!GWR?pc%0p8-D-WH;a(=*%3;pPt)xiqOlJX6%PG`UlP|LOD~heA zg7d2Mw=KxT1zgYu1bf4f!>Z!3WF=DW1o`;yF;Yqh=#r+Tz_~XSJ_Ao~o;vqzzOaC* zml8^4{M=Q3nvA#foBy)Ntnpb{v`br~1Iv?P4PyNd)F=W-JDB;tq<3mvip7VG^m1nMTBfPpEFr(jya5V$bFX%+XZ$$e*Tu4+_aykYm->UWZB zzg5`l`_su{W6`~-yFs_ZNt0AdEoZZGY z`^sU1o+xX-Qz;ghT z_Uh3^T4aAtB)6g-6TNfAf>SKu+rUa5_c-I$7bopZPJ(OPYTjtnmfC%AxD{^5_#L~| zz$X#FE!LrZ3%`7jUv-&AsdOg1i;EZy^Yb-ZJi8-O1{=Js@pQy!p@5{S;n(5xY$_Ka zuZ_09IfAKUy=|4U&kF!22}h=vr)~9x%d|gh)QWQw{nxK0?1!?LUcUXR>Xut!m3Kz8 zp-GcS_`0le=2RYIq0h;L9)k0x4y0KXx$e+WZz86hoOh2X;(zVMRPYy4LTF;`HwEG- z9Z)VWyH9Y}i-FCr`kqX2DxWq?M!~~L%17u+PnN^X1}KrVM3le`L_}=@xiRHL>kvcS z-6c#SY4ms`u;MdCr8Dahzo6LryN-Qj}v`t3&nhBHZMmQ%m;J>@?KEqu3J9KY{?oS_J`OP*} z@#A0V*f2dYk=sQ&8@o%vcE1D6|>UN=czs> z!!#@+FYweXUGG)t8-8-ZQ|IyfJBQZ(JN+EL~#FK_{D869w_HGA#mbD7+Ci zK?z|<1ty78nhbV2jeA8m|dmzzStx0cI+vp6w*i>aKIk zcFqzPma2+8MJmJWV2Bb9Am&3MAnud8OXN93BDbujP|#cDQLj$5gzsP~qde?WE@#Th z`c^luJnsghvC}D!0pfWseW&sJ@n3#VjD+6)v5h3ler4|~dH#ztd+EN%t{uc$VsDl_ zcFn^o`BvA50fI(o39V}?Z&=N-U-x^PUs2gbe7mx2H)`vSX9p~EYdi|2|2pIuvK*No zba+wQHKG!7rAMTwYICLW%bPF9YlvBVRt}qa*4N&Oio^bR{p0QGF^tHVpP~s9TpZd; zd&I&XDMHP>i)G=1Bd@PhnAXRpx|RSzmAHn}uKds~4u>tGtzn|Q9&7_hEj-PWG@G0- z3vTs>H0gvOsIOZ?(U%WATKClGm(Vw zl~-Tac)c;9_4qjsJ0D4(%aK=Ddcocx1ntsnRiLz`0(Zmo~>-mk|}gIDY5u8eo4O77$V5$Fl^O2O)lG~ z4GKlR^Qr%u*wXq~UR(wq1f&it1T`#2$^F>8(z=ET0td*4QtyW7L)9P#K8AkSzS=*G z+5H@H_FGh=$wI%G7tWC}A9s*WkiG0Of!&efKghlXepfJZ7}dxiW9<(uaJn%u0-n`c z)g1BIpmZDdfC_gIPgoSbLbkAMa*9hF_U_a(gMPn!u|sy=7aK^FL;1#2!c?|$6UF2_ zO3bp9l2Zf(@_5Ku=vNvVVie8+%=rWxDJeA!#(uspSzerFb<5PR2nz0r*??PRz*Nmw zqLOs#J5`n!RhgLJmc_=l!mzSn9%0o)EVR^x z^Qy|887bAil{^2*YuWkHs7Ur8Q^E3D9qQ#c1HpPsNz|DH^oOgM;_{3&bYoH3`sfO} z!cA%=xlIpIhuz+=ubepkj`li&z)%_H3QDTS|BU19_9Y26T1Hf4(;GzmDUn?qO)G1zz(jY){T1lD?o;1L2qEHoK2Jlt5N0v{ zCJ{m~)j*+GOO9!~%*_v5^eQT=ar9oy^sSGR7Os)6wI`%IO@6OJB>?!;zd9jLx!j+v zCD7yS!_0q2A_%6!X2rHG4D5n@SnK@JwZlPqaQX6|r!II`o}DE;JzvEp@3jQj1j-ew zyE@b6#+f22AD1txiUq2Ltsdl(w&|Axm+MJG3M$^4$`G0%VQpd1WLSH%i&dHB;~q=c zjLRzJopU$?MsLe6{DNOT$A2kG9-Lv_rWZ6V`wP-^vf7~66nL&;VVS)4@+=KsK*O(6 zD^seaXC^3c*!?q`zE{{yE^;hAJ8pYo9Q8vNSDXA>*?iu3;yLf&CNKoQ?0--HxSays z_kJoxW0f003E7swSMXjcE=OB=cM8K~T~0yQ47gyR)+5FGmO3bUHG92muNS;^^2^(f zhCGWy7OmKrAdRtlKU`^im#9w__ z6SSE!z%`Yh&KA}DLi2?vW-zjAn^;gZ-IM85zX*`8$ zE9vL6jH5oBIt3atnPd226XWlId%#DCN%Um z>JHRmTvf{(8c|C3@OrU0OK0u8+wYmuF^+Jl9%C~@@SiwTTYo$z{VCU50zy6WWG$mY zX`p+Cuo0xZ8;0rsHdgP72EMUWp6H`|sw}Ja$(w#m`o}`as8DA>xnzt2{3*l2Y#Q?& z`3&i+R|4dO*{U#18YLOFGWagpUl0|1yxq!amvftNk$MteTpsunUESy=$XquzURsV% zej_`%vk0B{JBLoE(96z^hX-AS<+TG5_Y8 zh7%P%@fyTQOd4FhdU4n)`FMUH3=GqGbmtE(V4idu1~gxvmf?}C&ykBTe)P0ZpAJa?vyD!-Ag@!l3xNQTryhJSc8I_MNIFLd2fh9#J*Xs76Y#gc3?Z z_TBpWE53Up{y#=`4nX=l0v2=i^-Y3itXHMEU&nF>kdj&yINmyQ=)YOLJWHc*w6|*g4_=06wy?v#dGk7t@{8&YHiNQ+j z?GTXEQe#%zhs}RQBCqBT%Y6G_vn~Q2b;f)ex%acF0V0zIT!QR8paKbuqWel_63+=S zE%@k!EE4D5x)fJ3Fy%ePMrMvpGbtEd9hknDnBk1lKX22Y&cekoC(#u-m+ z1OvMk9%71#c0Th??srjvY(}Frk^(L>+*z!_4kbAnVk{eQP^3juK6;3F0|Yt+hWsP> zN92r$a>+jRxT04RS6$S8>MF_PmQH9U>ugeT6TI$@-`e!tKLQYX`Vr1VZn5nb}cl{ptKXtWJFMfb(EG?Ff~ZU z12VvG8U9`NW9*b{=68=7=40zb#!yOcguNw)7uC-*PjyA8U$jW<{6a^aM>F=;|3K_U zN(DI6JXGNpdE-!rK%75#BTt}ab*sGi8d42kT7=%9JHDu%HTMqskVp>i-eV+}Tq`$H zrol2s;tD1*%pQf7-jLOhqXz1=7SVR&`Z?oUuxnbmsvgB?l~Q!gR-G?T!kO{~mpHss zjxu&3`wiV4i1MgenH3OKQab(?NI_wiO+}savta@F=X_Ga%?8~c z;o{K%r2fKmdD-pBD>qX5JoG1g`vKTzV$8Q?I28-_LXrLIv4LQw?HrB!K}nz5@beRp z)fCqEIm1)*TZ-K_P08!@_*}|9!l4h!c?Y`oCDNH8Xx@;i&c%5m)hUW=e`8$Op=HlG zW=aIzGr4W!V0NM~1Cyg%N{+uZE)o@P;LE=O zx=L-c@|(gYb;mTrC!y2lN|Tr#_^B{cILTrfv8aGN@wF*vqlz>l|3uJEI4&WS^!ZIU z9N)xCjncy-IKIa&$|RiISqL@8uc<)%lJ=$m&>w~ArLyKXknVI7ydyvP0Lx(dqHE8^ z3v^Y<{)M=$8_Qi-e9tV_LfXGb)>L!qQ&Dj01CFtC%UX~30DI)0=CX+M#0Sl5&*=hH zG`OWGw3v#9cI4Kd53=x}Dy3I-eR~kiAe)nPB9luJw&T$r1 zhch~LbF8G>b?GhZl^m%V+=hO};#MP7PpTyMHp|=lLPt*JcgEN%xH3U8uO3}sGm*%? z&1W%$c>_59;=t`Kt#*6FI0P49l|bv?o4-u2;473QE}fiyeXCEI`*~2~go>T^JF`2Z zT=tir@ScQav9vE#OHK)&xPI5iSh(}FEL9v+sv6I|M@B6zDml`X-SN<=o$0(WFq zxw`a~@}KHbd88*u>z;_{S5Xq#5Ldzp?y@n*D`6oh^a2>|uRO1U zezvti;8ZWPKMJM_YDjh>CGxgLj2ZhdK6$4QHgMF`yO6xXkh8KdsE+(%=QD!Q_bx8O z1{|I;!vvM`F#_AePYYEfRD52Ki(*w@jHeYoFilJenlVhN79$ngQ^t`rreYQ3ih?Ag znRXHu`YopeY;02ddn*Cr%B;l3V*!CaTO@rog=h1P_21ZZ&|>pO4h?V%YqF0%&^>lx z%q2|A2l3ZyMLO6Sn9W^gw{sI35m*$2XX^`=xXWVUAs*-s-Q3|$Djd5dLS)})-rb(Z zp*JqbMT+oAvwAEF?s~?o)+|MN5DK#Keq-)mS6I-go(&W{R8wOYK_6YD3;k9E!e5U{m=!le8!l{h3?$ zU8~V|V9$vcC3~lPI=XBJjBK)nt)37YMpdIKPbR!DM>7TrQtKntTHe4l9PDKlj&*5*pNB`!Q(AMpF7043d-!Sg^6_*`7?RmD{r( zk4p7^wTx!(*PZ%9f^)Q>7YWIOxMxGL<+y;Nl0l$q6D+* z6s_!(%U*%=A{_vi;?viSloeISfNP%!@-cZ+t`d73haji{pQutlK8b-!sO& zk4A$y%))2XgFz9#gjuX8Re1F_&)Gp;oro*gl;J|e-XE4aDsP{fM1!Tol;z@4pA%G{ zYxG$}KGaCNG|-Mk4#zIx%s-Uek}q!{Pubj+W6#m%?8|9Vobfi;+O}*=)={Z^eFF$+ zh{Q3VPMpSwQn9d@WHHbjvN&_@hs=}6=tP~Ud;CN?RISh%$Kw8qmKF^qjZ`iWkYyYW zM?y=l%sx$tm4Y#x+%piR4Vlx_Fxp)wZtLmVUj-y0y?5`c(h5UfbGeiqy<{7K7Zqv0 z^h#7>y#GjKnCt;PVOppSdDmP(8*U+(Xt|hbRy=RUbHDr>4D3nW8%aZhWDBo-1+dT) z0X8!skEMzn-%$OjYYbGH(N|IO>lpOK&GcFgqz#+Q$=feh9ZU>G(EvwhlF!Zj#ksn0 zgx9LRJnpPaNv4S~<#;Y8jQ^gM`6HCCpUS;iMAlriAYe5F=70Fbq7vtwp(!R90p+L^ z?u@Q8_)~N75y}H(jc=lCUnIXMh=oK4^h!0OZKHn2t;ve)Gkk^vQkwZ*x`ktEDc_f^ za@uI`9-qRV%V$xRel|NGU&#ed?naNxCvS11n5tG(2n+P4{uHCKe)9@Cg-{J9|{|~=N^CN z?qA_07U9IO4|_-2pLsfQL$J9B7w+=YK#w@uWIJ`Qya&GQ@i73tpUn9sC0q68h3_Ft z)R;Uz?Y24hpe&lHu*^|%;ZOKtMvU{e41k}SdP|Uw9^&6^T6HBcenXs(GD;0J{5KgI zF=>mcw2{Z-og7UmKy927`HU)MFvBbM07NOuw-+$nF`?7`iV09lr)#L|Vv&7AGt zNEQy&JAnj6!FuGeGun(S({rah?8k_jL&|o1;e|mp#JE^~<7eaU688Nha1pg zip7JdZygc2YErADFo^BKqlQTjte9ke~fH_C7uYs`dF_Y6U!HBoX?f<3P zbx!Uq*Fr<3+753D_+?t{E?u){0LrH|fppK~lGe9kUgeE=B4!mV_X66Ksf#h@)#0s@*&!@bt|*1~ zfA_6PP4d9Y7?b;|QV^FXrLPn_0g*)7o`2Y=xGbl}aA!1dfw_)kSjl7PmykhFWfKhmV@bkzk1 z#C?jU#^w>LL^ltOp?)Ms52s5e;yt`g`z3{0I(lP7kP5|Qn5lQc1e1X~A+Je0hFB$x zjy`fM^0kJM;SLn$Cv>jARSH|xm(XgFD90jOhDx3}HmtdQ#m<%M9O<~cPKUgeR?0lV+^BQP)_*FX*l8p=5ZhV}Ny(J_XaE zuSND^%daSE?})Ri6zSf#28cuIm?m+S_H*;O=U?4-xC&c!M0Q<*IHm`yd?JUlT@*yY zi?bK409X?82ZEu|A0|F!X*5i`Vp48-6kX7X2-hI17v%(){!&#Oj$D>ApekZeS^tns z#yf1|>QqJz+T=)Hhbc?p3}`8kR|+N+$bIXyZkMa~VRwjd!@{mOS0#17F5~O@sG8Z8 zW<)$9l{A4}1(4$BF4Bt4GMX*O>cwzk-jGVzM{f9b6ZSQa`qeba zhpV!m)<1c4jvoIu^Hxr*(G6>vd6 zyE*mS7hLAe!LggI)#LwYRB`7eabZkL7e)B8Rg{HggIc1^TL|7YEnEn}=zJ`V9?U&9 z6viK9xP^|)s$PsI7-Xef-SgTxdM8UZB(Z0R2G+M8YF9lDqJ2;T;oFMHqgJisB4<2_ zXS;Qi3F;G=Dki9&!xJkP0q{@DP%RU(dvjKW)67*5XC6JHE9I;a<~JAeT~cTGk}63# zsXp`30O3Y)w`G>n-AXF;Qk2{Uuvt4pbJKPU-xc?am7UNWE~ZCLvCeRF@bENvlE z&#!(Tkc&*N%9eJ=6L@+>u?@vI5^@=KC~aQfp*WBGjpJQ$D=c6rfTc&YHjFk#wLTIp11?Tcw`w>|vc}|uVuK~zlCB`6bB@f{Y#r*{%PN4VS<%coV4>~u& zfIxfpc}&u5NMAx6J0;!>#`~O!{sA|1KYr)pCiP+k+AlIKZ+AR)LSlMM3#hXzDhfU& z^%pW7?igH2R*49Sh0ZS)v;Vl6=n>(*qOC^`?rNBp@!69k6~7OR^o!^S&wC?lpiFz` zVN-}R3XeLU&Uc1z{X_O}uyk^k_0+n^6lk2pf&~4YP_aUjXq7>gYE)7`(~F))p5OxZ z(d6#uEPiOi5Vu=YkI&LU_oWgW2eGO9hNQLF#QkBMM_k7Zxv5?n((z$@O2CVW6SAxv zR)yA|s(>A)jRmJOm>pq!q>awZ$b_n_24}_1WRMCwd$IgECy&u#`T&q`tJtp=W&dj+ zV$iRM4F5R&XZhEpo7=!XS5{>Ub6k&guEZl#JxC35R@Efrsym7L<)(TNE%oeuhD-KO z^c2U=gwEGmpxYBNQ4GGmyS{|cJQX&Z7Yz6?1Hq459-LXx789uFMNH`;b0fud>zHe~ent5pmpIQ@K?o1LNiC+YHyI zwr{YLnCA|m%93l)CMGqVs;*t&n1+`fQHYNvl5Dhl=Qe)E;{r3$QbazRu<0p&2Ad#! zP&DSEuH8?<#UFZSAzteY1oZVikGyK>2T*g$f+VZn*kc?r_9BB=um*FHS(xRQvid3^ zbB9pS!BcOP`WY+#`hXTi$B(=4W1ev!A@pkv%Cqw zzuqC3bxGHDGshw99v5`@}`{!{0;m{B8NHNT?^ZkF>q()Z~qbKpr z5WT8)W#=|}Mg#PYAZ|}0^LQ|82-{Qiu>2~Do#>(`{bC!0j!8{l-?d%LTmQC)J|~c` zGZb@C?{Ok!)u{&l4?W2r|N2sTkEj2Y0scEe|2vss>_^3(90=z~ad78X?7Q@TdGNI- zH7}l~8vm;d0P%|dlhFT62G6Dh&DMo=)BB&U#rO*x%$Zm=KmK|a@My`7|J9O4!CoxRdtgh)D3Cms|Z027sLYzmowT!vbu8 z|39I>G8KZ5C;t2M4T6pT>*ZK}u|BEECHVLg5C07r;OxI4^xu)O7h16DO5_GR=s)oz zh!xDJgB{oQn(WK%kFkGT?)u+e z_t5~5kX&3sK!~aJz00d?K2L~;_MOLLZ z`u4BE%|wI*ZV<%3_51%&IDqZte=y`U7-GSu17k2Soxb#=MtAtxe*m24aBq2Z|9QFR z|Mt2Ny&=c{U&sKDX$EqT85qyOXZ;s){rlx0;rOWLKhW*}UIs9efuP&}=^)3>4#h#N ze?zzbgxte#{(~X^9l04h{|j$`|AKC#AO8m3MnC@bbsr4?IsTsp_@B!BzsLj}tLDrSSiZoF^~$g{!Dge--TdRt=M_|%}Eb7qA7=3IWstH zn}B*w7~NS!h=3>Xra^R%V5I`lwV($8V>N*7#UsYJIM{TLL{3nik?9>m;Nj5ej?8vx zMjok}6;UIXAkC8Cfw_QG4>uH7{ep`>20+BC1KpZ2&nKB7_KK~+Y?Vyj>2#X<6|Co} zCo|Y_3JxPvvrI=!H#g4)ZH=&cR`~#J+w*`?t22P;1Y?UqTk1+QTv!Gu*pd-$V&1Jg z7mYQsQC^K7ZW|7_rShP6^4>CLmJymei*gi>6r<_57O7g+Nx&`wMOyT{3>7su7&vBro1oL5U7_$2 zE4LS+15`vg8d`1ye%Nq8pP1&Zaqy0;G@Hy*+}Fm61jF)Koc=VWAiT$3P|2XJ>Aj8i z*se`Rd=Oq#tg8Fza`QzuMm^Cw7nf%p)@V>4C$=RjTdQPEXkAE+TnzLT&8G!a9KV## zSIvH@jGIeC!nH^K>QcFO!$Lg#c&h;F)dwGJIh)M%+$R%B_(fo zw=`4bN%dJv$q?6H@~7%ueL-}C%rwTC$2}nVCN-zJuX$;!fg?+|6N6 z!I^2=47?szf@}t^B2Tw3!R!fYBxmt;X1+!Ed#&oe!+LaR9#F0v#$Mm9Yi||m z6gj5Vt8fGCP2|VWPR>>i1A`M5T*)D18pud2M5ouxK= z%qlOAFW<>_X9GqE=PZF&--wkZ*nFzC1d4vbKS8i4V%L)f=8ABZTB`_S1%X4NL)ibD z!OVuWf2WWx0QZW0EFBW>SyqY-3ib6~l-VA(JB4&7@VwZ^LM;$utXVveDaM@K!E&RP zO1jO>{njYd8@o49g;tMxQ7B?|Iw>bGU}sH;wX)u~=RdU@xNhb!g`lIv-GU8}V61L{ nA4vQ>cc^z2m=vrP3U%5180S~0$^GD3zYEwXak9HVuygV^fa_%C diff --git a/spreadsheet/macrofree/alz_checklist.ja.xlsx b/spreadsheet/macrofree/alz_checklist.ja.xlsx index 7710628340251ba0074fcf839bb3cbf7ba3c93a9..fd148d3f786d225aec161548595ddb515dda48b6 100644 GIT binary patch delta 23953 zcmY&fRalkZ(^Uj1=`N{5mm-}~!l9c3(hU+Kov(CvcQ?}A-Q6kO-O_*1-*@p{dEtH@ z=AD_nX05g7L^r<4YiWYt5QBl?wJ!A4iJBD?-*{I_EU|O)R$zW@eWtX#SC1O31Dw-vC&;E{DjcMH!=3`TJ*+kHuugeFrsU` zGz#x(@yPGy2f0?!8f&0pq~hGB7XN2MD9N7?s0hhu4J&f4c?t%E&tz@hP3}!sd~6k) zPIrMyk`WKDUr%e#4Msh{AAs=bIp$$}i&q+QEh69_2DGw>HHWR>QqA-Y<5s=pmH@Nq zN*NnHFC}eMH3T?HZ}@vM$$%(Do2oF9Ur_Sh24WCWh^C^9j0pthZTdT*I&69BA!(Q` z0E_m+1ocpqp%OGxIDO@(H-k#(Eh*WJ@@E!SCb4Q?q(Byj3`G?M-;u?t=+-uxj*aYF zcn=dhR&$rm%i=XAoBYhtu}Ckv)&R|d9yglH#I;N_#DO#8yW*cdI8@>4$x=(Y5hQ;e zD_xO_&I1c-cMICxe{RzP7HdBif+gvfmAxvg@y+}=Ov(Ni|QAPArX^AZQ>Z5hUBwt85n&iE!5I8QWux-)oSmWj6n4$+my zf|#y|Bua;RMv$2Z)()X?rBD{~97vX)!kd_AI>XSXdmY(7c`~BpjBjry3JNsir(qoB z%DJK~tH%U`s+L<43c3WTld0)w-{U`OCVffP3;Q9^2lwlAhdfsT(EpxusOGwit-=@} zL+Z4<|I?<1XmVMiVT?lh;z7H=)tGgcZ>OMfB_(TymE3!<>%H7h12@Bd{8coV$liyS zlzR|VbnowCxop%jDHqyKR2{SF`@wreSud}qrb z{0Z}$V_@#=eT;h-;x6g?&RJU?pDIs6!O*I+fQ%3VZ2TkO4~Tj%0E8BJn|_>e^`=Bj z!}Z78I-U5QQae<^=Wcfxl;*~D!I~E+lxxNhox{R$Ik5XWP=Te1D$RKU%mwi>L1v$p z95s{Aafy|<^0@2wm_d#fDn3);dbUZ!YP?LvEH?rnJnPK-(sG-Oal*QAqID~yUa*|^ zD_f98{$yaz<*N(rbYjM$A0!rg<`WtAg@7>)3GUqCwA5}cD|jb?LI9&Pih#hEqmY?C z&tRKUB*RFUe#cYRCtV$pCdim-2eBDJAa#mbD;Uk3i&zDE>U8N!Q9$m}r1;!n-beO^ zw@_oA*E>l?N?-37Fi4x!uU5Vxhf^hVk#_KeLrK)s_Lb*2H+4Y`)}<^EgxCF#Ah9<^ha;p^r6&SpIIy z=85i1cPTg3Fk->y*dzT8PdEDZ%})+Ij$=+vUE{(pjWA*6B!J4UBuq9Vlh=ml46;&Y z1oH9OO>d3)d7E@i$o};}x(c_6?un8Z#;-3orWd9=Nj+wv4BaN8eSAy(Na0xBidZR= z$EtBbw`wBJ0kgThhx*~mX9L&dKdBRg*EJR%|DjR9;BQ?HGE|F zgB)EW#<)?Yl@f3+;*yQfT`33;JpduCxnXPn&l6`G$}QX4Wt3hqP=eNpr7Kq0T<^<9 zPty=E}W`8+H1*Q40?_eTHvR$dMHtp)*&m9!6)7JkdfKKCe+wo+e?d@#&kZ5vcDHUqYf-}9(ebG;3mt^o}nY9_lZ*lqW?ChHZa=uU(-yR|P21EQO@EcfDuY|y=#o}(ASc>g7T zK|zJkCwVdQGQ5&A@{)UlLa5f%w=+WPCF7RPsw7m1>+c}AMyQUg;BV|8bC40{Ta)r} zQPe)90d5cwb1(P|Ed9tPR5wV?2z@2bjb!f2V)HoCvjvBD+|@{z^SO_W)f(r^hdZ6G zW_%Tdq!p`FBVsnP?Qf6WUG~rPa%Ey)F*jeFQhSbQluk9(5?rVv>`r$oTuRuQM@4-q zl9gsJ4Fif>VBs^6Q7~7%c=z?Ze>q+T>pXy?s=ou3h{zgkw@JDHL&%h`;WCZ63W4}p z;*zt_3bjikUB;gq2R=K_ILH<(@2;LX!*g{!=I51!RAiP=*-s?UYvn}bYeK+sSq76m zQF~zGZ{JA&0wu!kg2^|}62Y(ESo>ATU4^!b*LNm_s0|QCn2bkE{Z1Oj-BO(G^L{x1 z9j;8Q@C=2PDOYcHJg><@w@Lg6$4WmAypaaZ)z}*$E8pCf^^EP%-T&r$1{7%?nlXtR zn|Ra`^ygNFFl9ifO3Qv*^}gP|;<1(wO79LG<|OLs(KC*n2tyD2T{{e#domzhD>T8& zO(UEnPeJ~+@TVep&6$p0a^Q37CP2~}p$%t%+g}yd-f0)HvQiiZohV8(5b=1~k(r{1 zba?Ta_0#P&$>s2_v6$|SUk}sWa;m&0;0)l(6j&tzi`B!C z$6T%kj9P4(9nwn!{Pwy+;R9P95F1;@oIrt2Q>Dafvys-wJf+o_VY%V}tk38=cT_k; z>fY7;f~%UEN%aUduv`)E%H8N!FatS#=|WI?X(S4{;+f7u7ScyrUA*s}aUe~NNa|nh z%tbt=ibWSe0ayj7{U4&fk$TG=VivTiq|35~jz`EL9oj@>lGY^C>l_cF`&4h?;rXxo z28y>`(7blg{MA@^7@HYs!eC!J$2D!w_ zTfV~r@5B-8Po$(H?#nGgJvR1R%v;ov5IuYkDwW%uJ^xcY*M)huSYbZNf{D-A-~|C$w8W01@gBVczpCa0pUCh z^+=X?807`)ag5{4r=PL=PzzcAYx%^5eAbQxT7^KhwLy{ey^>E^}^Y&b6#0Uw=zIxAai6i@vQpEke@icV)M>`3vT zlJjdHW8`2#g8|g-v)feemPF51>p;G_OH9EZdM}fL-k(kdoAEJlsdcX@AgAN4`>?<( zlLm6Zi$}20D8PVp)Vj)+J8zjqesnN1=$+DdJu|7%^5j1(_q3h4TXJgS<>^E~UHj<5 zq5IH`PIU%<5HHO8_mz1-;a0fZgfonP(!KgMXQ4kf{j$iB9C8S3i*Flc$a*pr>n=n? z0F=NNH%hc69%OZNc^mH~^yA z*#e#WwW|wW+$QOEcdg~7{4KKim0K3qq z@toBo)90+h63h$eJBpuVrJVO~cdn1HO;##&c*!2APOZdd=1ZwWb!>l_d3zJc*oKMn zH5^J%T8BXZxSX>FBC2C7M=?!Y|)G0C(1We+E9O&N-k1V_)g?*m4F|{wUD= z(tXM5>Z!nP!CVM@g%Nl{&6c=SA|rh| z#``$T5FFGQiEqC6bSWzC=P2~`-v9Uk$dalasRd!|mt#~6$ddN-=2Ktbx-TBp%6aEe zQQpKsD&S~oW_>rg?g)Pe*@!v6r#7oAaxTUY?KctQV&q0S+^2l(98&3Qcz0fF9ND8z z{0UvxHGim~f@%hQk^T1@3{YcjR^h63dobuDvA8?42TZ3963w#}c3ZkeZf*ztvol}f z?G}SIk>ivW&Y-pvlU1exPmqvSEpvEl0aWj9gq}I?n{)fM;w&L2C!m zMt&f%!D9vasW5^)+9_;Nrv;RpC!OEW`)_*w2W=FG8=lXIK+N(CZ4{!_*27|pXw}l{ zdotm*leR=|!Ba?#sNt9)7t1Ni8Z8Pz*Lw{XVPrZ^gEX4a(|?4-tMWd~JgH!{H_l@b zDF2DqDiZn8_8lECApWZiY?x2>eb>aMVSn6@CV9*y)Klzd6vw9uBg=?Ph26%RoT#PE zvvV*ZB!$gvTNXikjmm#EcAKC@-dCz1(>YM_8kZ6Ypq3Jg@}har!lf+c6A<@{{`p_v zEr(G*)8(v1cB{xeIZn}a8dG6%aBv1g>6u#2ZA)Z}5^<%J?`AbK;3gEY`F~1Bw6qv|%y1j7< z3w2RY8lpdDVK2Fk610HOLn^A`2~t_@yMO9%)GxV~o<$|HA}xHMApR>0nQ|ouG{`umdP5K{m3!G?A7M;Psm$w<=ietCs+WXu`3P`bkP3b-a|JMrYGwu~#Z@6N3W8ko2?Ds!jPDYE0E*8g;uM{(lUI z#ZEAxms+q?C*e6!1Ox)GBEZ#+j)rPFQD-@vw{Ls0ff9}n{B?h=WHfNeF-~3iA&#%X8nK)%?h*(k^kO?*={VUo#P%1g?i)S^^Bsa%aL$X*uHDpjaVRsblEyXhX}$SFkyUBap+&lP$BO*B$GX2#rj({ z0Y$(;{bbNGWJ0F}XiD#C-a52S{c&LHgO@GhMzI^TK}`Ru%po4zXA;zo!qE@o+nh$~ zZGiIvqevBIYg`skhC+@X;WM~MMKm};?*>e<>P#XrZ~Ydj7!bn2ygHk_QyI~EQTl&6$+?;5==Mw-{A$vH)nOK2X+aC zo%R%;@}A<6R6dSG=tRZ#kU{3LFl!fyDl=2~)+F@Y`qfGzL)rs8j?C<+@AS@$(N~qd zyuXf3wKJGmyDm^6G6n|lu-=94ceoqi=>fFAkazh?*oR6X2+stu?NhN*0>}yW0b4G*+aNM0{WnX8F3rDA)=il6&nC-^>gr~B0U!}_h2LAj%)7$VMHQ%y zF_!lSCqsPrY1+F>na{1#NL8RyI&%Rd--VduHU*>ikg zw}c}KcDi5MYuw|eS3gS|lYz)y_dBD&|P&UNvG#v_f>UTiC;rmU3?bYPU- zBQCpt)G47eg8T(x6(T^{+jY&N{XeJlLy{se1r8&fqKkA}{MPEndq%%Ne*8mNdE;^E zADB|4oC#?!<<}yRGWBHQ;+}=CU%t-uqB{Fjv8Vd8+4@SKY9_A!gve23N#GL8DGhGl zeXzvhorzQi;@`w_0Rumbd9J>!O;`ZxW5AInGY)ZQug#>Fl3=(1g(8-e0*92idJH+u z_kAoH!BDkI6SW(<5xNYev|P#}bdP@|Z&E)OJs?LGUTU;=F#`<)t@J6R#Gdb-TT=1< zmIM#N-;v4FC1+R5YRLY(tX)F*J0DKRdCMnj0L@4=h*zjXY9ss+;`vSSihZoeqfV%$WNcfJko*d7BBo6Mzo=o2;xxK z(D7kDHfn#!$Dl{Mg@2JywQ{I_HY@|Uo!wkB7Q0bzu?+EjVk~TVk~!|F#=6zoxRl>{ zVu;_Cc(Phldb)WcvRi1uBu;J4<%c}-K7Haf(xJh5aUl~1y4SDoh>K&Xu*}UtXo%V_nw-!@54;+GSWf}!nQY!>a+5tIJwKB z=@6QeDt?jOt=~UFB|g+^5yyjmng0117v4udH=?|X^pGx|VAl|blY15??JFogmhdMc zptCr8C$hO2C~o?cn^S@AP>fX1{kHFf^XC*vcRWXO$Z8aYkQRAvD(v3Jlqspv8KpS- zMDNC{&E(#D7&eKFH83dtdlcegn*qV=z=c_M(f&ts&34yIornCJV?DX|kHaCZc`{p% zGM2xeCho2}j%HSSYHXjV4y40x0KeMn6 zyk=ly3jAR_W2vdE)XO+IWW@i~FMc?3Js{I=`0+sbvgFC-n!Oq+h3d`roUz_}D=H$6 z;DS5ApaOPI@^ee_L<(=!#Y_1Fn`@_Nd~Ein zgQApZx;1;jy==CYuX|d*nEFAN<&BKs-2J!ruQi5*)BU-n!ibS-1cnN$Pz`o#M2m3Q zfQB9p(@1LHXV0nDQ|@$*7_t7;j6hk!(Anoft@G=b#ZJI1NNt$s)L3xo8QPCI??iO=1$2O4KcmI^59T)fN53^~) zuLm|;Uxq87)x$64TQKn7j>+9VoeP^c8eSC}Ts}w|{FU2{X*q)5lI0ppzHp;6|9TXmKE9s?8^HW7weU(?9=7A==ejxn zar*9vEytw7$dsOxr6lL0B(J|0YKYxy?zo35t8M#yXU|Mfyql~lMmhVo*s)!FVKBT&ph=vtv)PeF7y*p&z#+M)@FK99wwyr*@ zfro(kNeal9eFhflXP@aitfAYion_Mfe3R9skz4K1&XEDr!;f83rk#!vX#5OhaTys1 z0QYR)Xiw_pt|7x0+6q7^A7*GzF}|g>_#PT?>H8mBNIAIhEmP$(7LdUnZ`iT^k`!4mrX&k zUt+g$)(7tH1paeGTp{O3j1#Jx8r@dhT1uLYE9^)0BE8l{UmohE_#xD`I({;@Mt7`gZZgb$dtT1Y_Y2NfF zP6#ZBvw|ff$rx|dKQn7^P4DjgIr(ncV`;^IGBmf(drUPM!Leju$|y3_VlmC! z-#i7cg>;vMg{m+^XT|}uiRlF<=7!sYuhL>qo>98+#FZ45#aZ+W^~g#|b10acu0k0m6a!;<7b= z6_&!CwvvLl(xaCmsKOV9Z91bBhEB!wjQ>0H{GJS8%U@}5ubP=nH>w>pU?ur+E`&)vxX>HOX~ud|SvbnlW1O2K$u9 zMPB3bW;jz=`tUUG&#HgZ6+*<(eVOnshxB&6v1>SdQAJ<`Xrqm!{PUl{rfatW3AJ=) zBA5{%)^zYqU~%eD=D0Chz3S`7lB034WFoBwQ*To3MUpa?*?R_}^;BsxVxLTn739IM z%39f;F2(^vryWvdCRaUgmYPELWhM#qx!!2@dYakyT$*awUc)-fI62RKzc8rjvzpnC zReD>n%vi>U_aZQ46N=@tL?Jh9=%r8=FdE7lonTt!=3l>l=lnbJ@4Y$J?sj9gNTzz0 zks+&f#xj0Jt+NaOod1Tz0t%WcI>fkso<*!3Ht`m#LCz! zw+Qh_w+I~InfL?+|2a0k@fka_kobLUKO#f&YCGaR!MuJx`HHE=HI=ta)EU9q{_P+4 zN*P z!Q?pe#y?feh7pz|-_QZrDM$%S7vA`c+8uO1S2}luz6h`G-!&x$oQCPx-{biW*z5wz z^an0d4cZwJT6+iEHTLwQ;viM4&3=M<@d6FTtul`<;TaoUDwiIida?akTBZlGveN1L zO}Uhi9`n=as%3>pu+8GL{j%sDTvCxupi)tHbA4WayZN1dhp%cOra`x)!O+QBO65ao zp+&)E`ch}=?v|6bTJyD8q(1j{vkoAQwct_JVBm4N_%gqo*fo|+QcEMsB;iD#x&pe# zS#fZrN0o!7j$+`at%ayNWQ)C{md2$=k|oo(pYzsbVX~8zxoV$`*Xzt39-K|JW2zj~Sh{Mn~(Jqw14; zQ$R1zIq0LD00)$yyfN@Xpb7B?vuc>cF2Cw#)Exc@p67aRWLi?oRWWA(NMClK}Tr&zJM^sZae*p?M$ouabvJUn0 z`Y@RlpT8ljGJ4R)SYy5}b7pd(+EmNh=VMHKDcdB^rCyu~x;ZuBA(Z|1U9=zeZP(0L z8spoWJv~lb?FrH^GRO1Cd5KbI>>8x4G%2qv!cZX2WcyIrrnuGDr76eAalXE`B z3r?6==p%43hbnRgh*VANsN`3K6Y`J2_Q695wmIGsCRiBFjVUWUOr@vPvb6c3A<()c zEACx&`eny$U4Qbyr3%;mI~}n*dn4t`i2Ju%EedCmltoncH&plYPa`y8Sg$zC+^B5g zzw1&O$UO)WIj6sR<>JQ*M7*@!DXGRbmWBttXW4+bF$)C^QS2kG0yzUxV0p-8IuiV} znBd>e!{n=+5TjHu1`P#Ew)y%<`}il%){WBDX4KobC7ndg8EwgEM5ojsuC^F{u|1xd;R$EdREIzF1T!20)o>q?yBhcr12(?OsaUXF zco-}4Yc&@5-ZzESM%?Z4U86QL?F6& zuN(G?3mfSB_i0fNebS&rNzw?`=S%gdzq8?MZ|Q~$cdbzoAu8p;XTDj#Pj-CU+9Dwo zA^`FqjLzMt_iWPrVyH_w@}`JM%+~}@VWr!ZQFJ-BLtGkbPsx4ZrhWGj8LmXQ9!BJ3 z{Rl#xxK z*#699DxX;iFcaa;)vH)8KQCNvd+SBf|57sX>;Mw_#5|I|{=(h2QC}tnOkL1>bTC*= zMui#uLR!%c{&`U4ujjx~ku;$GtuHyVKi?&bZO_=04ZCUAFjcfXo*elCEgDI!dy8|Z ztG;`zYI*klKACpf{9y;~lcv24(^NqO!MS za)Po*-S1KxrgywykKc8cdCZ;MwYDGj^DWUGmnQ(XYZDFjEKTBoH&utm+gO?PBf6MK zoHnewaD}$7i};HEcs?^-zq7TR?~UER#16io!MC?l88jjIM^b|KZsi&a#CbP$x`_YV zO5x$|(qi^r8(HjSjWRNB%xq*oH1}_-ui#fZGAo^)=2Dv6otih=6q@_k`5?oOGKmco zM?u?(eZQYn@jG!sTUIUq;C4%I%6lHU#|Dws_rZehmoXBpnVIssnkUD!+ZGBQZ5hv9 z^}OfL1sH+bn;&mC8ime8d<2HRlcPM z;n+HSDQ{YLn>A12W_q$&cIa;S322uIzvys*F#%N&R-_`VPFDejA|rU<1Er=CYqnO7 z)s&Z$M;AKpzjl%=%}*9)N*2s88tdKPo@PT@(|3N$L%u?CGFebNAIDM7W>C#Zt4y8! z=Q0vqgB}@+XznWxRz=764^rD`M6P$uGy4lXxf5M|SnP)=ZFfslz$y1fkSm`70?+dN=ER>gM0u0+g@_l#=`8kljm$kSR z1JzWSa2As!^ji^~`h$AVBS~sTjG{u(#(&ONmTB&Wc&_XZRhBatu_^Ig*0XBgSPaz7 zeDb4YIw1cT{V2LY%>n~YD_YURNZnB&`4ewwP%_d-!J!cAN8wVpIX}~+en(%M3F^DI z6)lGRC{I@jYDS*Pq*C<}dYYL1Wr1#c0DtAk)Sfw`czo}G6m$k$LM0AT&9^WW+BN@i zZYP2caBnPt)wypOhudEf3k-EyJ%g|r4zzA3dUqZ!My;i zB2{_%*Q8Xq@kz@=Wm_pgQ-SR^|GG+xc8jeSel~aYj}g^ohWfO4-R)Pf5w6pZ_dFdF zM*+zZ%gyrAsbGELek#R|%$vFIsR+We$WKB-G!jCFD8qZXuY?<*d#dg6n`;+vRq!t` zcT60qGPZ~azt$^gelAyG%?@Ht7XAXj|FzzdBFan;*QmvBcQ*rP18*mnzU&kz)&x*E z8auJ|tbv~q!)rDv_BH8X8To7LL-DQoF&HKJp5n{>3$u`}$p7$T=&&<#7jq44O+Hgv z=gl1H`x=2s_N)X~FUe!=JmXKD9+HB^OgPUYnQQ3vPa8AVi7^%#KzSf?P;<{T+2doh ze&_pCb&61z0IUT>G?AEc04bMKmPd0$LELyEqI z5~U4&Hp*P@(c@(jMVAhmQKlDvLWFC{K+;jY>s4bOIYvrfB8q5}58r~hvHgQJZFlKe zQY_E1lE6ab(#KrLoM}b(!LAd!0o@C4(azZiLV`G{REA>8mIk)Yl{}_*kKz@IEWMvG z??gPS#83c&Y$;w(7Ya(z8jS}RL=@A+w11VUhb;g15-&C*y__JOZpq5-5nARr?^a_F z!AOyv;xa_8^n*CLXR$XL!J!}WQ0Ll{z<*@Fuzq0I^C`h0qx}>`hOFM)PKyvo)IxMa zw&qfar9LUJc5(D5;`zDSH`3zv=d{ZOSc=)Xp|af^@MTC#cFSnW;|`K9sTiUic`PTB zY}ixMp+`^ST3WUxfJAX63(`hV#y|bG9(N-?^Uf3NOJ0y3hK5JoP@=KK*n&y?;^HPt zEzjj&fEn_`o%@3&N(&nWjr1}ARjzitTccf3N27eXx;3LKqI|F*v`4gVN%OJ2M$*nv z{99K!S~)!CER0%DwQ8_j==b zk52|NaZT&X33DT^3F|tyM{@94RW83_*HTX}SNfwvWi}*mXzHgLy>bH;SNHR-m+DRB z4l|RsFWxu7Xy4>Ij)k0JQicP6Cviyw7GZ+n`d1LP~aR(Bh}o%VY6WM4R|EmUDEc-#+}=8Oy-8Y@}BcXJqdjW&OMGT+n{VIH$k z=)Xmx%Y}R)g$mqJ6c;TQfy+tDbYxzp?oW!T&wC*k1_~HBvMteElRo+)pM5c*a}Zm1 z&5lax{MJE@7T)w6-;<61+~{bBk-2OFRQvvfX49~&H#$a%*YMW)){_XAuHv83sd}uO zMLwX?22l#rBUeFC$lTZ2q_VV?%VI{siDeR>d zaczh}DmJ1HbcYn#o!5)_*JQet9$h&`(#zs~__FJ0SzjJ{X|1w*FqvuQnesN&7*FtRr6g+GEb*rw0QbAMdEGSZ!-3PJbW_{qKD^pJ5s@I`eOuPrM$gp2JB@ zjJ2$$l#@-#aOUPdV1eU3)~*A+sQbo_!a;Q9B7bNbevrvpc9uWEa`2+plKbxKL}So)??4Lte`;G|L1vBCQB9 z;+F5SLWSNwf#AkHac4&ZFmVt&#{IXJ`1_Yv;$cs5uDvxm#%O~o5x$RrJ;^Lht556( zFP$(Eofq=*Tg{l3YdH=7iKXv;m1!~Mj(Tia$^-!>TIA9=R2gS(9TlNT+4oT*2S(4M zc=#+%lQCOCei!~W`m7+p*mo4Ay=^4-XX|4U$p%J;jAGBkCt$p3X|AXn?SjW!93}MG zC$9BM*}Nm>{iKzh)i5}ZJyMdXN1cIz8l@2>^1NIi3h@?bH+>h8;r|VtT>$-$<{-km zyHEAEViS>D%{_aHY&~gTvQz37mD8*waRCzM z3F}+Mpd~;oXGtP>uo+Hj$Nri#eBZXs!VNUWnS3KQc(0v=uN-|8pU3bX!40>Z8z=1C z5&mJ-ZZic$UXbOL-Nx62wrIY4ZGCm69KacdbkznaVGBx!8#a^*(*8{&{N3TjV)*v) z7z9;YHi!sgiTf;D`eX0Pe|beCfdu4hK^occ0C+8`xP?ns>CNTeBmXMl_zT+dxe`Xt zCIZHX67L)u`1&)5=73F-BXq}2H~~`p(D%ll@!>{=3JOdYKGs^lx&sMQsc7X6RDazS zQ(EFnM(B@ZM4?QXU6`B|ih$ z6sSrar7e#iN8^s1z7A18o#pR3(&Tr3HgdXNh@fQM6z?7ni&1A z@L~3{)6ha6O1EOnNyHSIY=rrM+N)=(^kEx{v;0(1BGfrSJT3eLpIfzX+onv$pTlzF zeI@?K5OJ6$)Oi}5V^kSRm1XY0z6~5VfhdgZMj)92{~IJO_b`tVwz(|?&ROfmQ1{Eop5{bH&|w(oiD@GSvD=a zKvU7xwBd%uRDp-%g_p4wg4{x**YZ86ps{*UaO!amL$077hF^Cn{kv=i+ok9#&xr)w zwm+~lw+-tk7@QP@DLfu#A8e*dZpACkny_iy%zTtXIqOmd&^CRLsYF?$v^d41-DI?~ z!k|xha_Y$q55Vg0(_)NMW+fh^+fk|9F^!#5z&0%LLgvv!2}A;03dV&eFSU;idk}+a?xp5(A$-3gE=%z0klNSb--r z5aqYL@j`W&K7UP1(sPH_Sq$S0GyM3UWk|_8V&*LIG#y+mKt&}X4T0^oW{M!&j3WPL zoi{mSM8x@S;mws6lS=a$qdsMltl|_K+iMI#Ijp0Vs=;~ig@WfNRN!XC(=3r(0r|tP zHzT^QAgHGKAD+j zz!ogo>VaKA&nkZ{85xhP2RoWJeD0KtV4Ks?a522GX@uFVn|v0f$0Hi+G`N_pF@ss~ zqh*F-NG=q(a{zv(N%U>{rhFo#n~AO8rclsMYTez?j-Z+dtG|c7%0jf&WRtLj-jz;2 zZ+{tY^zyquc=rRa;&d5Z%QzQV7EGV&6x^_STr+3BYfK+bwL!}kc|SATw5mBoayY~i z3ITNo5P0IJmw|?C%9*OouN0$n$bVgZV#c)s%)w)-zI;Ii4t4p)n)A_AKfDtB>p&x8 ze*0f*Yqyo&{hm7R(v{z;xC_F!-9AK%wom9I%Cf=0`T5z(M}6_uk7OC?8EvMZ~AuGGStX7=krtP@Uq`-glk?o7+)uL zBNf6`Et?pp*HlluAEx)EGrBzgaubvNro0yTOhtA2ju%@)_IeBu#l^t(74<0h6ASOA zFd2_x6rj@9ahTVb?PBKn&q6{(VZ>abskFlmmMldi;I@LbRl`!&zLaXvqE2A(cJooI z;`>ymE+!aK>|DoJJM3M?bqKk?w}=|O9Z7K%bhKwymCg^crjqOayBWX~KI8P2pE#t5 z87-2Q9oWBKSl^D}mdW0|kmU5IKSIdqMBseUdvVOv1$jYh0a0!OO;J;{6yV6tESoj5 z;)GiIZ>~J4i=~565K`Eew{6K?q_`glcu93=_G#8i%;^bdpJf%~N0NM`(@g{SU2Q2J zFAd~-HrOV-aTy5QppF=DhpvMNf;I0ycHQxSJp_6Cn*h{%Sll!g;MD|ew zS3}PWH#}hqr-KS)KJOo z;)6yMCJ~qdWl?K{R;t*#J`(X}>+ItFXAiLepG_2Y1_py0-)7@+5p7s10jgi}RmqV# z-nR7kmv62xFZFb~zu~9mKx7hvrR0jai2Q9aJqeMu>DQ&@7S$MbA|YH>5UG&m)eisR z5ZZjKw|)tsJ!*{}KmHTGeJT3(EZpNvKcN6qwv{X(@lkRaiq*(aL9+3|?&qdGwpJe6 zLL2Ce`=6c4joa<9R0))6n}0d1=fKXo2@XF4hy%|~?5|1$6Q}OVkF+Rshq?lIUW#E4 z)1qyK=LKUJmgY|oQ6DZbAK1lb9_psj`uzWYf0$BE2koh$gD{s|7d|tKMbA~m_XTq~tq=6%CSVOhKyX&bbccbH=x)G&wn*%p4ym*-gp@C17IBw|R z-}#arxM^-2KYy1pzPMR!F4gp_xDxExmAl^nIX9(WvMX-Va1g`~v-A;yMoOl*}L{;ls` z2y?9;b}Cy}j97~iLWv=e_Ow(AMR)MVNjyo|;cD=fmvAoJ&}frpu-C(ey&;3r)#~cf z0gxm=S&Ze&F9wDEtOy-e1JHF9q6hWq3FTQt01!*jn~@eq+KEBXjZxoNW|1rCiWB^xz80r)s9cU$jx@awfHj#w-m8fpt|7~RUx^MI)3j$~Q z78|S_?6I$kdrw(apEMbw5m4BU=|z{VJ0!@hOCS4me~6aO zf^Ml^Zt+S+;p}hheGC1so~T-~l4M>98|c`DnJ-c3R#B>#>GspDmEm@fgrG+_35W=? z2dtL{B#^<>U_yvs{_TJRszU^MnT<4)a?h1^pBhY-KhIWJ1~uR~+c@IREsc?SU?!gfl*^o>0-V^<;EYkWA?HZF=AB`9gy|K*T?L{>p;? zY{PMbu{Oa$_Q%|wMZ>U6NiVP4l2X&iSLur(&m)IR`8>pTIR{FzYs#cy#*V|(77 z7QhHjcRyKBKXD~%{299$&RCM;q2Diq%x+acTcUHK5NM|Hhg2+7Htqnz?W?1^Akkq7qq3 zs~aw1AS2zOHqKH1D>)UdwAT4*G?+qyrcH5e!bKHCxVU6+Xom=)%PQ)_>|~PPJnxMV9gN1;hqfCK0B3o$K?c$%(*aCSk@$8PdZt zyYrE?0wqqm9lCHY6UmRk-;)eEB0?C=poXMCBZ4bkg1SybAfYJ3X==wGDUkF(oG3%; zME#Aa3m5oBH}`AcuixS_ifjQ0Rz!U**RdcnUvA1o%r9#u2dYG;4-O3+DFW z_0fq0mlcR-rcpBU3YN~Xvrtb;FJ8S2B>LKr6Vl<6F|Z9 zt}bu9_U`Nd?A}QCi`GOzC+#smnE2TpoE*wXg}7hlZD}!zUsPmUif)Je1UIJFkAowH zxgz)WIZr&obQ^7qOixKr>wb4ffTpSAv}%#S(iw7pQ+WU`Up(mVkSY}7?P`KoIa+Z2 zUn5r?6;&7QDTxn6Bm|^G32BfnK|~}4NohVokPe5EtF&~eNJxE@fP|E^NSBmK4kMuq z-8DnJxr07O<*oJj<1*{F_PP6&e;VL@`sgu7bJ{RsVCTX~+zS-~^scrb)??clb zxaoObqdbfOVTWTUpvy;u15whxu&SH=v|A+QHW|)`CX~#{@_{pc)7~Uy)86+RYQvxM z@419!PM;~bqw_RPY!N4CtL5L@YeB=sj5#6)-~M zUkF2mXjr|6fAbbEBc!EslYI(--cC%6mE_g9y;}1xqTtbbsf9(l7&0eM4rX5yPP~D1 z9Cu#e|n!K~E-q7iyv`~M_mUq+W5|_(RzOz1X zo57oTAT|Ugb+UrvLNX1n=bDE1MxqX=G;^;^rZPpaNImjre(~6-W>2H;`c4u;8Bp?T zVp+bh3g9)Wkq?rBlhi@t-kJ7vMKCQu#ZaK5R*vlYA~X9na#3~{ljy8_3<*Iq-dD61 zN1FxVKdfYiF9=Tsl=k*KTKQUS35&)xWTMBv>+EFJDtKDaTkhr_eyc)$APi>HbIhlfQ?$-T_whQ>I)97nM)D+yiWBjo2JsJO+ z3ap&7HF#Z*?sS|{TbwcX+(eWUeq7@q3Jw9sts?6&yDFK&MQfM|+l0IEttj>NSgLwp z%;DkcaPQQ3YQXcm1iW*mB6>~Lnyu@&;cMpi(f}h1F0V$}$||}ymD{$BvLZ4wi}S%k>~ugY|;8|>rLzB6x`5|?xYd!JBjRTUqV;Cy<@ka!K&3#H^A72gh)1dI+D z(^c9FZ{U+I>KvB(be1qwYm5r)%l(s*ll)E7$?v7=?IFt@&xuUklv%u~ryB|h5P9N( zATNTH>-N~n)hOc8Lf)&kNluZ5da#0hl+iX@ol>$?F<-#p=6j8@I9ICJE)Oo@&)24? z5NvMM7G4A`lIOu&QKQ%dlIH=K!t}cG>f>ORh6U35aG#?c>q%7=?G@*aPTbb4*S2Lm z?;Lh2&G9;iq}DcqOu6Bo_49G_ylfPzZ?8jg`pUATC#nZ2yOyPC#ctK+KZ&{njS;4m zH#}%5qfEjwxTq znQl{=^>HM>O*$A43Y|m^+Ke6czQjR2OzK^zhH-PzAyy3B%qL8zGPfXkVbO6N(j!n? zA*m7=F0l74fZXT`T=JXdLio;ziEe zf8?clbZBgEKr>M)p=IY-OX*HBLh~R13=@Gub}cH8#5;m2dWHV``Kaq9`&_S~RA&wb ziCC5U+6?G^++-Q?Oh3E9ODO?}(9xkNW^WI_%NHS889XokdbYbl!v?s=>-Eaz*4(u( z&f&4!_%&o^H5*FU{3g62un!w^`ZWtrFF3%R0tAEo5(E?GUW9tK7V5;F@rnXkGBmk^ zwzfm$w$5ZBYKo?x=X~W{w!hm9xf}o)Af`FsRPPPBj)0yisOvEk4KFYO$e&Y#Q}J3Z zOqY+=GeHz??_>!0E?9*YcJ&|(*zm!{r>CpzSF`ha^i>1%b%kr-<- z%`90((wxk-qj&Hx0)jAw#BF6KZjgXEmTbn!SrNFG%yPRK>Dv`eXjN~t^}Xv;Wj0;Z zBZ=H86=Rk;e1O{=(%t%r10L4Z_{$A z{sH2!oK|2+MI4ae8^s#fDMWqDf$ zU-==OSnWmDP#N_E$^En|yZ?O$qGKSLYAW7u4QgSU)Y4wui<1>CchwrxpvBPv(g?>i z4&YhQb-$ICfIG^o z5eyb81MNQV#rFC8eR%0eWJ(_M_8&HFyi_`bx>j|RY#t1hI$0RFMDi)PAxLX2dXl{7 zn}ex~Y6;nLc72Dyt=hHN72w}yNQzb$9+PwG4uzjW#>-E^UpI9!;e2M!W7!7jhv)WF z89E@>=kSG^O8pwvmfuq)YucE(oj1H#c}}n={Jh=q3J>kub}PVhNlR!CnJ}8R!pxM~ zJsM4iXq`X00ipaxx=~R-`@p2KX&%B{C{$rsVx49|?!kp_VLJoBG7rgC>AJC9)yi`x zcY=C+L2>A_lHov5P*GrMIeH`4ggfU!MG>xcVVpl+lvzv`kCno!!!F)wJKd}bzl0Bi zdOzB!dN%7#LlF0N^kjB~qHnK>-KT>*wLXRm&uH4Y&M&Z?KbPg zfw}B+`)+%$^eL1(!>`goONycYIfYb59PGavOb3b&b9_;;w;^lW;FX1Tm0{m;z^wmy z-jpd#t&ANkfI`KKZ_j#>MOH3@3%#1yxW@alcd^s7VFxZ=KUtFqj8vh8O~(Vnaoby zI(9y#@^Gp&vCVynzUV=|I0Kb!DQA%ubszopp{EG-zU5S-o6QmgMs0X6uQGS7 zI$TNF7?KU|%4+VFf=32zT8hi}JLOu?KC9HDUy(iFThP;-zP!PZS~0`UeP?5>D&?8(@1=|Fu`KfPiV zO-*yZOfVx}R4 zi45UQu^I7^M8z7~_NlIuu=`#c!BiJ^n7QwX9DpJCLO{OBXH{S;^yE9s+L!DsO?v1n zF`6VR_yt7>O-*}$z+-pes2NKf%Fqo`#poYfX>A0tyx28Sz@M7;w58;$Ixt`8%*&82 zm4x|10R6_*n>g-V>;L;kueRnUUgc2Ijmh7w*dvab!v;~$Uq<{`tANUh^`~u?N?lPc zADR1c|3_GMO+sreV9z+(@97a8kux8gH@~ z$F|ZF@Kr6#@6? z3L)h1LcT6NWSEDqeICzBtsd%sM((?(G>&1U+(t(NO+pL zKoHYhY^OO}0@b-t_%8>YM>zuc%R?ags|);JwFjGoNgIpPXaj05Z z9+-p{JdMyGh-t32)13WRZ?yX9AmHZ+33dw*{f%Cy)*b{g3EhTb$S*?w;4=tf(uU?V z+Mqz-CvQ51Q%QV3;{72eB20>k=fNkY#->v=#)E?_3P*3#gCj|z`6&)cWTsxn9I{dU z|4)^u0rn9Z#3VGuPkUjS3j{IErS|{ojh9C-dn16JbC%rDC=17B0ajrpB;SG;)N1Hq$r>tnRQr zR^pqMBEhT}sPXUq52Bca&iTz=Kg@*&G0k<_wDDJORQsFHz{ngL#iZA%wFf~=LYMC* zh*0=NarTnXzZMDVO<~g(ZgATm9ckR|g_C8|Li!_!lO>d&S=U_?X0-oKKc7@B;d?)6 z#=(W>Xx*%J(`9$Y+s%Hb40u$QdA1E!?_o&K_rRv=%`i{U{nCAxs$&EC=*4B^=oAb} z5Wl)2`FwLBcTQbc%Foa4=tzBYe5gT!9uD&r_8BXN@J!9Y8Z-E7j~uoukC0;a7Y$Pp zbL#8SjYsY0I?Y7eSC2Q2_6~uAn4{%JNAV3aF_ZuFA~`Z$s6~!?0kN@4r}91<@1+ z81|Ot3#5I>0SL^A@cY0%pD}WMem;J7Fn3qeN%q>Z=KfZdjcS9PXmS;S?Nx0(m`v$b zv(&BYy^U$%z4KInSHNw*c$ur?P7#_#^DLej1i(o1Oz$~rkFSmW*94ZnqE=_DD<8#Ww4_7tiiQ#nNDD>%ntZ~Wi+#wIFT_2n?XT`X%W-TNDX%rV&r)4{ z80lPmtZi2A?x)s(9C(;ZWH$6MlzE^5zwhY2!(H}bhr3yDpvkPg@||Wwck|1O2J?{W zQ$v8zr!(%e0a=z#?r?WLcS5qA!jgF(~<7RbGSs5nSK$TXVQw#s<4if6O*KJug zdWf*ru?KATi+%EX5zf-}EW1pAQ|`=~+|f)g;0YT5j>B7sU6CBpXIGY}Lx6)}isfaK zQlK$Mv%*$yD1}O&i?HM`PY&eewvkbOs7!L@IpI*%0Fkiq zMJ$?~e1qlq9jzIrW9r|NVRQFrpTR{X!!82`$k0FH@FQ7&g{m{Q3kPy2v>w z9S+5CJP(xC7*s`lhrl%p8w-mA7Ypm$Z)FaKv9LVt`5{iO4=kOW9`JcO*lVd`<51%M sZyt5S0#jGMa#W#694xGhzZLF{&wz5F_4PvOu&d+ep_lQACP0z@0aH{_rvLx| delta 23833 zcmY&fQ(#?P6D?vlw#~*iZ|tODV>L-*=d`hH+}L&+wy|wCZfxsM+VACmx)1j}?3q2Y zX3d(}Ij!>izoo%Djg_fAi)I%$wf`7}1D7VPAeesUZk4!bQ&z0{SwYAJMzprFT72 za+iA$bcs|wQQ& z1NH7F6w<4wsMBZ_sXO1ivHw*w1ruihG+5g#_0;=6huGR5O$|ZgpF?`e$ZxA^IhS6k zrIv0ABp2Ur(X2)IQIDrP@~f%D)+Zu-Bd)FFtejm5ytAxY zcre9?H3o#fv1@X$ngH*3gQ4IfoEbCWZ;p!6jXR#s8h#-&?Qr=iaImn-K6exX#j|uX zR87nsv>#y@$RT1o6a|sj`A8_V8T=?ID8yAE{IGm5#4j)60@OaENHfP-koZp=sD6IZ z$a=>bJ|SzNE`GB9-QU^p+YjmW+1NM@=@kZ&L*>E3{;slgedtKBSErf8`E~lv}teSeY%9y#-14vHYXur19V$9tx(SF zx7F}J>{0O{fBk@}cV1`jOHotwbC>hwBkFF&eE&FxA$htT07Hv=l6qJ>=~EaQkDT40 zH&;mnlt%$$ifrS1Tuw@ME7mJL`!_~QoQw-}hsUf10tCORY0pz@xe1cRv4=LlxAr`8_e4klpKEniP^LkEd36$U+YoSzZTCazyq zb-;S< zVmXqO$KtPt)?5PJ1HaYle1tId*dyPv0oEfBk1nfnU)tdZCHiw#l^K}GAbHYj-<))K z7@Hy7iUO6B=uSp`Mh%k^%lbyRz|k}DdYuq|e-te#n2?lx>d5_&m<|`q?YG?&paeY; z!&$nUWcg1_PJo;4Dh(oXy$(zs_CRe^_0|F`{H_KGeJ$>mm5DQl(~3ra7--j1dNyrY zp=-Jwl-#XNq_ll1izd#_&@I?O}=7JK7aR|^IlKJE|v~4 z#hy7ykgB?6fIi2X5M3Iq+IK~;f`;@XwA$Tr!{ayJ|8fN7kbJ+87kcP$-@GvBneFyvdi5Ly>U)L;_)Egc~=!p$Jx zRMDp=SHSe#`iWV;?A(ySNEcUUG)Qv{I?LbhvvGs=w10*wxv5pcSc*g#o>d^%AZcH+ z$xe@3shJr4A790gELnJ(FmtLuIr{#Yqn2?MJwY7lk#s(LH#QE%nT2<3vu>o;qL~li zSw`y&!z2wkQ=?;4sD`|YuG89MabFK*329KOEijCxd@?>mkbs;*WfL~b8|;bl7cMkQ zb!;<|i`1<%7RFk1pENlg>r2k}9I$ZortaUnEo^Olhu+r}EIa22ihOKX#|VC!v)KbP z-GlGzxuwF-F-HenpKr}w+5kTMR&)MVLkm(rOjI8W4u0vJCIrx*J7!icvdFHH2@1gE zFu)1xu%JMLUe52IO&69_a=H5cY~wFBNmK-kh!0)O8KybM9n_R9p?orsRa-;6d({2#%lR~OdoS=mcqU`e{89T&owPDB9PB9EkRiJ zjJO~-nDDrR`O*Uk(@NwYAn^Cfmx9{is`96)^{q#l9T~6i-7;xOu_+o{+L7OHyeSV* zAQeDC#6xZH{eJUaMK?COc})!Or^S3}&9T1j2mC$6lZ_6R)_Z_MG!Bc~7aHq(Qo3}1 z=;MZ6WD9&ldaDwi_4E7UKbFPXW|t=*a=MfETRopIOhe*Zw{7>5h8?Q9ew`ikzU{{R(E1uhWxDit!Z{+fY#Rlk!#|$7!q4ncHu>~jI z!DJhBb`qchGTtOFpl%Xa8~ZR(A#!HLKA^Ekf|&k%r$|J+(VFDajZQtEYiiR8Q|`UA zxj)J$*{Aj#OGUmwXW)A+RONIVJ((x-21mciHEv~RWNuGy39*UZ|BDrB(H*ptbzB^4 zi=sSlrI2TNGjx_gsERn3!RVc)ft8+@ktTqe$AAyK7=cyUmN}SYUq?;q(RjNXntYLx05Z00={D=;%7@&eg~Wx6w8E>+p>iu6(T0w_RBw4`oebOS7v zVk)oFGXH-ulxtg1mZ$GuKl2(xcL5{1z2gOeiUa6iy)p0<$_JOcWj>c9MU_(t;6~39 zRZDM`Zx?C|^4K5TCyc^VZD5oDo%Xa{XX9G+bM~RFckF=to&IZaVFXbw;)@qCGtM3Y z+^0?%bAnj+_6?S!HC;}}?w5@`Z;bBoAy4A2o?6p53DAr{AK9gR2u!;xDEKZsr|5G&&&TLlS35Jt+c*wg~chK|WZHNPB9TyV*!&cV+h4NysUk zs&?oimk3GG_X)`257p0)%v*J}>dnS00#@?)b3w4XPkNXk=w>>;>uOnxQ*LLv1tmjU z$l0_G_sLaX{eFQ4rIbeN8(_} z{QF25!9+{SK$X{@_K_C7cw0$}r8p~H-F|APK8NBUU9)3shL42I?cu9BO%fx;x4x2T zUiB!+#{nR@iaPpFf9~fXBK^L!&w_}LgSrjuVLA0&VWn0{-*VsYNYDg}v|DEGxO(>* zYNo20jULAa8LpY{yu0gg`NdC}0F4}YIO*K#^?a*MFh`(qU^&B7vrw`PcCDy@L)bZZ zSog2LhfbJ!4V??PcUpd+XpOFG2kJZd+;LkZ9Z4@v^>W$Cg_rgO*fGp~DDO;r^P6Gl+?D{?vlrndY)bG1@QU zN0q=4PE#deHv`IO$wB^b0{q1I^>tFLJI=3UM&WN;DID;_?t?It(N-PfBam#-GGlNt zdH}k02NiCzb=jh<>%q8X=T*_8!S#|l&P27_x9ODE>RHTQl4)D)!mHx&`eCo=Bf6mMK%GIh7M~IHkW) zlKs0^O&izq$D%+C@+joIpfymECtSW`d=XS(V;pKRKF)%f0S7aj^f4D!7m9Ds50ktI ztsE}MH#dy5J>tS7BmfcF0w+}A6=wVs4!a6|X^;r8M^3~fARZ#n0SK+j2e+Pw6$uA{ zRRupEeK9X>r}9*z%-F|cwif&NdwwY$Uw@qIvTK>lrDP~6p%Vffa0L}y z5bQNLH|(TaAsgWo52sX8ZGbilzt%dul@se>fOl5HZc%otk-x;}1AQ2*;ldu&C8>=< zNug$P6dfHULxpk^0SfV^$@T8yx-Mh9^re}K3kC2_U&=qU(GR-U^8d9meTn^scC-8? zpzSNO2*eV4Ar$twk5AHEALav6oQpG12Kb9`AMDxcc0;P4@wXR+qY*se9XZn9 za;_=D>G$6JKzQrk`lzZAwsNmiLUkJ|4d{uTX*$BcRH)y#fmqBAP0pa`lgWdnNU0;& zxJEr??jg<77SuH0^EiXw-*hB#;~lp?Q46ve&Z#ALQwbi`mr5WK(1Cp?Aa^hl%A@<3 z;so^6S1RyFCsu}v+i;B{`vwdy?C{ucenbQfniOPt9d;4@xb<;O^d`izK1&)jl6Y6j zROjY$waF9QhW=_p5yH9;1Af2ygR75O^?G3Amro4)x~()$w2uup-1-^ZRgUN)@UXwI zEmAh~HvGsD$O6Z*Wu;=ql2pA9H@(4Q00pEZx+V|Y-@H>!nw00k^~9J^I;Unxo*Ww~ za-$zoGB|QprNowH@MG@d8|Xo23qz?EpWrl7kZwU9o*?U7vvl-w(3t*Xl})z*(@u%)n7;JGA69R?7Ko{v|`;DT?6Xh@Q&aKQ%_x$)02)-|YP`%mbERO@?>X-?Z zd89#2Y$_)!uUhz}gacYbcv>7U-fsvwmG_!OQl^xRgy=4rz-?D3!o=8adM*}8(r7m9 zgcCdut&?KJmd!r!1zve;ygZbES0A!*9aSLmC38|)Id1hxNyt6O_&F|-y$JjRs^aZ{ zZuoijPgpmvrygmcm&)$9%}JA!sWl^mD&`HsUXCM2j!p8ji>iEv6h7EP%Z1Q{h56^w zn?-q8Y;1OoFg6h1L<`4V?3})hMOXfXLW31K2{G5nD6M)d@-vJv55V2lN&H`0I9h^@(t9>h!j#73%7%Ll>R zs%QS^C*or52}@@J%^L3Y(vV};jkOJ4yf2%N<% z=q8DxZGC{RM6v2xtofY-^3!}pGB06)4nvApG8ehZm*G}n2ZFmggK?T`Kl^D1s&#y? zb?>$ocqhjA7L)E@vl`%uz7QNQQsdb>B#FkxQe)nA@Oe%PiF6~ll!}vjc*oy+uKy{A zv9l#C{X+p@);Sm=zv0&58&Xh6(=@a4Ja8&$0Hl>Z8_Pc1B})9(gs`FC@YC!yI*l1d zQsoNvhK{gj%w+0iBf*@2=@T?b86(bJ)3zBNg#3|($2v$A28!X06H^+|phFCi1{Bc^ zNf7^mkpV6*iJUn)$=t``zag0EOM3rM2^=YA$>n6hi2HS<8>=M-1fLA}$tqzp7W^nE z?_JQ>FeM#_d2fP|oi(SM_Oa+)e{54^2OEnTJpnp}VOJUc_jxoN_0FVO6e=B(12Hj< zU^uAPg|?SPy|jLk;yY`p=y$Gpl07Q`3J8o^ zq{%}jcFa)8X2%IJi(z0)(N4WG82P19XSa}uoIpny+^{XwCmnu=8xd`kV=vX=&>#!$ zwK|M}(-kS$G}5axTmRmDcC(>XTO{#l)G@a~J5ni;1ZeJl{z_~v;ZyRjZ7SbUSoRfA z3Npx5WPBG$V-J*yXJ-yU`#ayY09z{wG}qu34GB%*&)<(iBcFh$;h%r)@iTU#cH zzX{eW6F{sf%%Lr&X~=2`8mkNe>BS?#`ef?_*eLh@5Fq88DkO)<`8*H#da#cn=?A22 zP&tbq2VQ(lk2?N^mfsH9oN1uTzR}S?Qn5Bu6{?T^X%q_j1GiMTv>=&xj}8xE_{Oe z=ga&H65ssz+^U{t+ROZX6*mT6YD4l~4=ufs>_+!<2fiV9QchO0Bo!Hrt+m5vZ#!da z?At%*`jatr04rXu{3L8Hl!dE`cfZTv!_p+z*NqHqjd2lJdo|L`F6j?cTMR{aU_n04 z&?R*TjQgXX2z%b!ooYihjYL~pr!WbokV+bjzRpvV;+_^mqggZig*lbkncArY15ZhO zX=05ShHL7sRbSy3byl7GeL`Ev6)unL>Q>L`jdb#+0n)>r%X}P6nZGIDQzyI5CH-z4 z^1*o&KG_0O{exWyAAM|LVJ!Jrs;MSDHIJ*FOEOL5d`U3lfyEXj%JiWW zCsfkW^Y9G(wt30-j`-vV5}K=bGE0O5iouhtZqYoNmYt-Jr41X`n!T%>6!;Pn|?U|u&EUn8~!)Tnvz%qpal(^iV33w@G z_YXyd8oiLL4mrdVlhiXJ|CxweH!0$8`XLxHT<_Jy=oL_^EP}mk!b1A0Y}|Yk>tUFm zC1Es;Jz=>}v`@eqPr+_?8 z{MMELbnz7;lof#JxqZe&L_Si0bX>vv9=Vwkq(Y!TCGa{mZwGD--m&Hy1u2()&|3E@4xc5reu5{Jn=GK|JM!(TLg_EG zedUw26WqL#?mzxWkdn!0TlooxX{q*1T|RW@cLbfIu`uPoU%Re%4-eL>(^&230?(E; zJf&xydt@OCoh%Hm6-w<85^-K5;Kz!%D#}1xEBVM^l-s(~hacaGs03itdtN^JtMYYh zIJ1;}g-cHO5e+=aRek;FFFLQ3JXwL+jZ?zy2~QyGQM%pEZ3F9tpi`aJ3gr7|#sQ+If@_sY zxO=8Ecbto7%%yXaXRa@U&kxU6i^HpDy#>ef$O!<`lkDgx%>l?48lD+P_etFwo5gG{ zoIvD#1u;lToE+BtgLs5W00|d=monpDbH}1;NO@^Aj4}Tp(8Dp9CF8Aa%k?U;v_h08 zlW>XDu0gOk}tBX(G-sc+!L|!$MN8mpf-cnDknKU@SrG2w? z9TkVy)W}ktT6R;7faKJ10!ehiZq;4vrTr5{R;P(a@MOd&#z}J}R39UK#`h z4F4JJ&wdzQ+sAi73?Ea(=Ak8ddkN-dK*s|}Iu#Aa*R#6A;!n29(+c~CW^LS-#{*Bf z5yxA`=FS4I{M5PaV{r~&Ih_c6#-V2&QS6ewJ9)5f#cxL2Py2LN5}I27_$i?5EWm4F zV5|P_}kw16)g=g39(`pEz4f0*3AKmOm5qcqA%$`dY1b7ZtOeo(Z$cHCE51gn! z7h}q?H62~1^XX(O&KhGrDv8pCzHJ|C=ZQY^(2sT1u#3v6~j zL3>NCyy8cayVvCo0ZWnR=676ETf#sQEvR1MvYbJ+ z6!{M2yl}ClQb<+kF%S@Wf)Bw}inuLw4H0K+nC3$~;CjqUSggc&o3 zB)jFYlrg>6kL?xAH5_KN5c6 z=-jc@SIS*Kw>uP`W(wO#yr1Vy#fFfbck#RvJnwor-5fCOqCsm#puo)yt@mhES5%*I zrP1Ej44^`I)@fRU0l}yI^Y?h2PuQZa_H^_{P>>j$@$~W?{U%C7pOXgtB~%UmXcWVu zlTa*`b!!uLy2k#wdV#}6UkfAH=A4`~;n`Mr0*hc)&hP9GwR(2%9mm&wkJeXwxNi?1F$4ehnxO{u*G9!Y+*(*s?nnEXChvE zfiU~<{|SS>3%l@SHEd%(!o%U7Z=u*Rw5-C{b-5R!u_yLcbI(R1(~Jv$?$3rtT`Vrx z6i8A5x{Pf;&EXac2g$fHFvBGl2r3GsBz`&Rok->0fDSM_m4CB_r#BX9r|~!p=%=(* zTs(Nme`*}O#oH%;)khGJO;#5tvY1ahNDVQ+){#RpxDnq^&{&{T>SZ!HqZ_1?|Eq#) zw!G=a#tB?nCk_5xr)M>UqEyJ2-z&~bfUUqYUy9{4<2D?n)0^Vww~8HecIj7NJEP;H z7cPjg5*>&}dZM25RjDO_SZef_=DhJetKgRfPI-YkTb;*G_%;qr9`iDS`tHxw)_32}==}#Y7WS|-T^o#Jg za`VqS8VkwIXSw{tt$!b{m2K}9?CRWu(q*@&rO^bf|&(lNNnPaNK*T=%dRRIJ$EY&Rbhh1Qbr z+<9Tao4v-+g3Ea&k`HY$Ohu$Pbww1$Iozij5(_c;`tFGL~4TGT^-CaCf4tD&Pw>uq}ayP zC{KpRt&3;t5`{w&BxiZJ=fKbGeY5jIHZ4DA^>5E5&1}kMy|d+77BJYHQuIU|fK2aA zL2O^(-w-`dm{!{*Cff7#y7`)3vA=9E>Rj={e$JtOj0mBh5vLv+)ak?@KE7S4TLE+8 zd(B(h&pF?k#DCvwkSSGog|Uxu`DN(4AN1P774?2Hn3aTb*{SpoHn2}GUMy0~P>KE< zEgeqCXW%Da_G2#Q`J>;Q9ZpCTfmi6kfp;YZTv5e=_tKA$w3Ykh zDfk+KVyKy5oX&%~Y?NchoXn$ll*Em^E>B>rYW~5MXj{Z#?ffZ#zVO9?4DF=u2iocM znNEY9;LZ1ull3(*_8CyH{P`(DS7ooIJe86JDcm-;+7zo0`%&+S0~->C4-(J$CzQ_` zNu79lrG?6cWOga%%WT)<>s< zpUy~puWn)o1}}aAWtwAmDbBydcG{*&^jB8Sgy@ouy9v}+#?+Lp9hf6A*apxknA(c5 zJn@@VDVLQu0)0BsrDr@W!uRyXpOXK(Jz9^(rv!P-RiB zYS^X8D!(Do5%PU=ag)wrs@y}eb-73Rmd7Y3sLkQX5;#&lWzcNa?$I1Yd}WF*lQZd8 zuuM3E{$CIDTg>UT9h8p7@(oL!8^Wrh(g1ZVdnS2+HLAJH_Wb@z`veZ2Oof< zMG`_9Rba5zx%SB;x2V;C8xGmU3h2q6&154WCDS^)Y_r+m~B;6lQk-dL&9{FR{-zK`|FvL6U?#q+s@o?@A zT)BM-uozv|bg--vlK6T}o}$9FzO(H1xMxVv$t zCg9{96QFa5Gc=z>za_nsR$1|#3%94!DsV()KH96Cop~?c0CK(H&uR(L>L@AnH(8@7UyW0oocu83 z_-{ZApz~BuI`*iT^9+Z}3QKNB(@ItqI^*8c)^Wsa^xhG3gM_HL6f#67tr>V{EVJ8r zrqB{8v6;n${VQUnm%-Ro=#vlLJt!OG%CfIs`RRi#u1xzRs&ss7jnV##7RQQ!-|8hs zCrfgB7^!B6{20)LhjRM{SCfpGFy4Gat^y=bUz1kAc)!J1Cd%xivm0!96S4nBH4&L< zE`_k3YP3KtNe?dQzlJQ(8MogRE`d58mfsS3MgP@y!U=EAq5!Y zW0q1lgn?dFgWXq;(~+s3kIDBcSb00vqBl&*O3U|`>6f(Ufn>V+DRHU;nnkG#Y! zF}s-Pzhddiu@yK^kJvNto@{Y$2#gG>Z&TS#1Cs%Qq7O3?Os4iDwoTnjO+H{UqJiWm~NuU;eF^oEXz(R4#Kz=<>qY9B4HrZG8 zo;<{drxZ;qkTEFYC#uPRn=)_bL2(;2TuyUzIaoth_e;_LgT0a}hVwVxHO<*@ zDmJ?kxusyX@9kDr`Psx({^jDgHA; z#Lanc%oWb5@JF-^_2`(ZjGJvrj)*U_IZ!?ULC__KKUb9|My1AAl-_H7(wqV8`r|hH zA_RH)ph*%cf1jYylxNur%E9{dM-_jPEt)iQ=#l%d4pOPL2LOIUgV(M#05b(Ls9PZ7 zS?A$lP%wYk8`~&3%T4anpOcqCq5s!7ho$f0ebzFDvj?0*wP=DY2_;}owKked)Q1`# zK9czn%Vpcy(XwCJ7k{~wsbu+=fitFs-u%Mb#xYbPBY-$)S*DtD(&~Va~c(5SRMTW zC9l?S` znxmNDXr5ryjy7tYI8BVMV+yp%SX#`-|KETdjQKSs1CH79kElp1ofR!OlhS=Tq>9ygza05x_;l| zm5v0RBKN|A&1t{XLcj0M%}eJ{yYb>FUT~B+nOCrcpvhWijk`~5RJVAdLO$_f|B#~_qEdy0QiU34I2-}FFv7UA zo=Y$xw`g^t3_Yy96dUhx>2`rhjb)FbYme<^Z=$~j-KgmUJ33`E5U`J zhMt)+JjTrL8YVSg4;unN7a6a;^Y?BV940mT$ZROVR{SDBJ)>z6MmKndQU~B-<4-km zqk3sQM7}WE|3*8S`!E3LHv2R?e-XwQs?>JA9o0ZGu*Wt(~-=mTH1-DC_TxP93wn$8s zCAT%9Xo)=>%P>xu$;8stz2yzce!xG5Fuh0n8x%98#J$w6%O)%Xqeh+fr;l}AlGs$m9O z+@o%7p`@5p%|`N-E7PXo^OKk4?izo~uk0)X4!k_$KB8H3;_wd0uRL*;l}hvA73_Y; zOC=7ZpFq@yIVKVY^9!1>q9sCV11fw#8Q8IE4&xuUiz-i_V^0=2u(W|7G73$bw&^6d z7U1B&O_3}nf8q-Nfs?s=_gwT{2- zS}u_JGj!xM5Y2e&?S+E()8&Q&6J@hygV?B`bf})dm$!$GXovoX20)y9x^)7VQzC}& zM1l=0Y4YQ!#dG=c&yFsOt+#8RW4e#|sdleO^d+X~g2__*lZ75rKVMdK`^bqf3sR%g zB#T|bzY1JQ4S@`XuNX8dD$Y&n+MnW>`eOhOsk*HPenm)NkX^Djjgb!n zOTnOWXTJaXwl~ESSP?jeu`(P*%ipj2WETFw)-Lljl{S1qUckMl|9A+a1z{OkVj40236&@PphMoY+r^+FP63Q(eyaVWRnM*ijM zcIzl0V>Qtt+sSoZ6F1%tgF^n(?l}_@ z9wDGCII}JCy4Q8NXyJfXb2D1d#?+qazSl6e4OY+oBg4c$o25Jaa}ILKc4GUgLsg&h z6V4bj%)3d*-?bbrW9q(N4WnzlsJRqF%&y=2qF)wreToeHWvZ(fOH^C$mdFspEg3F7 zZ3e;idz0F-9L8P5f7~yqI}>x?0D?rG6bkTvEdzRnI5>q$Q>ka2Ms4?Ul!G>Jl{zBQ zHqR$imbraDPCxBBrEBoPydfu%s)YKxr_s63HB`ct-xX}7mp>CKB@&t>CLG;-8k3A6 zoK3}3`u4wM6EiD#D>q~*2%lXu{!LHTaYk!QX7DJjE3Sp>La$4L9H9;PJePqTSd7fY zo--X4Vxaik{e2%c!ApzY?*js7@B!LizqkJ31^EI~Y0=IHczHXmAjd4kW3^H1kCG4DD&Z0uGYbe`|eT@m1EhM9hCU)ZCPP~dO9h(OyFt9zrH zWI)~Q@xEN^;Os2Z>K8c`A0>(FdgnPi6!(>1_8{O@19z2-(Q&?{B3GL)u2k|2+h@RGl|^u+1&ae4(5Y+|uc)P}bF677Ri8#n~T z>R6x}s?s;*z?WzRQ8Ov=)j}ws(p`od2dt=y89wR|+wCBqHag#yfRCCW#Hkv%^ zZI*a^Y}a*iM(bws{?b^1O=*D({n9_#3h_^RnGl}4t$;I4>mr*ybE~%FI`ms>WC(3Y z&F7dFBmYVh|DPWge+~j?*Nnw<&I@=*$!Md>9JWINQ|6+~hgMy?XJU?xt3d~3RJTU~ zq*t-9-ypHXWhLN(v6eH)n{3bfz$*qEx^`wb4B zU;n-tD9{WKy#0}s`19CS<4B1mTUy!`Y0e1$*I|H{V8zM`f+11>l!t987H-c#C=tuC zA8BKL6>Jh#$nUSv72PedFu!|Pn9y4cUYh~^BTGzFJ=V}ME*DU>tRbo-tTv$5Cu6#s zj0Lyy@!#g?xfbk7N~G>c%eDmNXFYg171_lF;GQ#w98$ zOpXB#8pXfh3G~Tnl@30Y-Ir6^?#WI31dG!U&81o%<;}TnRrR=8NX7RPRxkT4RKJ{T z4#{%x^<>Uy1AQX`&{1gFIfB$5Vo|aMl@Oy&aCQA|jo${N1;!*IF zRNM($yb#$gdwsR~sD)96q1y^IpEp2Ha=npT~YT* zHoIU?q%{KijY9LZB-l%k=~J&S%)NwmUSwm;dG;cAW}~!-`3{PO4U9sDP~mr+D9(uh!oZZ~66mVPHjsIvTl^@@B1SuvDd;ef)M&LGH;2d0*P zn4BkND64+JbU1?eoTgUoug|%S87+B0Vxv1)7P$}^I}asil4Wux9Hk$-AyvN(W$D1Z zM37y!t|EUOXl1(_XvU7&^m8wHi9adSy|S11 zGdYzfE!!iAL>Lw8%NO{n^fpmA2m<;Wan{i5VT6<87xQyT_7tw0X8X_W+{90 zIySs6Az)3^vH!hYBF-U%m(R?rwlIE&S&Qy^{JSEsNyESdo^X?j)X$UG*+wXRv&df4W?eyJLq^5*>}CFvmyNi=t%1h= zmhO&|hh5s+DZAHfHxF`7f$bo(g$=il>;j2^6jix5XfmKz_S`V{8vjf7(H?$qx=^Xf zWFG{dM}Vf4X5wh8rfOCQ`Db0k!yQHpBOUO#VsaNiV)RLMxW=rMMoj--5+w%%J{K|q z?GeS97cwF@d!^yeRD87YicD})_>|U~mP(Qs$kNj)7;)YP|G=?W+Fh0Xd)r`sG;HC( z5@^DtW}k8Clv!^l*x7Dxspd-!lQ?OrB^r^FR*b6Rhy}=RTXQTlWtEjIymzGGk!a+IW=_J#{I!8E)XXyCE* zp;^wj>KH0I#kwkdu5SFfUOTE0kR&jr5U>MvnXD1BG+~7=dUGfBPF&KFMx|c+fqT8- z`55jQdU(ZIJnrrK&{EU`hx2Wd@`k+k{aN_&+OVrG zKrqrGO}~vgL@!_%&Z0I!s!=?kIaEjL$g#=e4#lj%znO}A)KLyNEcq|f7`tMI>$JhA z^4fV&=wPV-&Qn;_r?zMJ_r7DPXSBGj?CJV=axDoD+RZxr|!7{zr{lvLw@MBuHp-DF1eLz6_^av@T5l3=+c9IUz*w= z8VkJuaqRe9;KX4&k3JDLc%O^ZA8kwNlcc!PuIQuA%V+;yNXX7N_c;_O_9f%ld7x@i zfQo6vAy_Fchb;b}!!`M#YnrX=>j^u_F0kru{u2s#7S7 z1X)BN8|)439baA)TDj{-SnfSmb@qMg10;JbSXi>h`G{xsG-C4}`pGIV%7deq1 z1y06uLzHH9T#z{|t`1Wkks$nf;T`E5t|_ByaO4K*d`) z`r}~H7lKOz5s2Lz!q9Zcy|;tJt=E6<1qAdW&35yTh*=|v-1S_HKk_Lnf@M`I-&txK zFHh>vX@A}xnnp*nZ729_0`A7L>~j7X%!2%Pm1GX-&cJY1E=e=?OY;CScM-6Y`>-0= zGWY!RIo=A*J7e~-1fnLGd*Tp)(=6R_&)5Am>ZSv=_8rG>MoA8p(-GuQHD_`$e*E(9 zf6J`SknIh0vRQqsoM*VrKH>#4(7##Uh6`q*x#be04hoqNE=t<$nY0$|El-D;skh>4 z{#b7jRTVxDfNnf|>SD((YwC2k^fA-M2;y%wFaf)H55tnDN>Bos?4^Ca1W6WUdn+2+ zq~LbeBZ0)r$*jj+b7KMPYsAqcog2`UdoLWE{kOZdH}0J={I7!mmE|)XV?Hz-YnEsw z(cOa-0#5q*{{rVi!sCL&pK)}l&uT1Hyg)x@CBn4$Xyq$)rMW5|E)Twj z`y*RLB2dhz6e1xn6{_iL>dnMa%N2Zu@OQWvikUHU8-UxZvB7dI5ZZ=WXOZfdj1-Z!2-$z*wd8N%3S99~>LNr6-bKpR=4jR?}ayqr?XU`US3S1+Y2?yyf8*`4>{Wt8z+cvo z(SP37X1e-Ra9A9@A8OkI1}LLtX&~FK(`^_2rRhXmwoAMj(YdN~`+v@BL_QrGf&-mOM!+%S*H!7^%hVZH1y& zm|;{c*8xEsd&Tqn^dFy0FqHfPdes<%*$jk37S#N72R>#-+;^x`(@q+f+}4SFkl3|+ z0t-gLtRAjfgf@T8;Gaz%c#CC~PLH`9BohXzmH(^%d~clzjtfiLOOJ?J0na{Jpp2An z!>Y_IUXx=5)8fW{dEIRnhW7kMR<-%M?%S1^f z<$Xj~4Ap;wifI1+SYH3l{+HbB8Gm;+YRV0HwM$#0tr0{#g_(mzO*@^)>i`Qw64zYkPt&S9Ft#`d}WrhY+b zhr4}e!CTdeS@PAFEv1LC%<>4Dw-A9u0$;71pBXq)U2fekC3T(Jjhf|LCdTZ6AIpb( z>@}Vx0XLT|k(XSr?cu36p`RT-7GdyS(yBaf96CmgX($)cdnP3OiirY9$0|bTze*R| zrdLHl?WYuo-<+#cZo-(a<|7!6i}TUmsYjYpI9aP`Oc z9i$$IAuw@RJc%v{h?;f5^Hx;CM6PqvZGvNhjb&9h378bjC4*=7XBrS70R~gW#NPf@ z>MROB6h~iwQDT*s1JV^)9;tx=~&)@q;%0IA6A%a7R=X9wJ>L zx%_Wb2^$i*brVenEB-12W{Cghr1fCzj#Lo@gK??NTC1vY?cLx32_=#WvhHg=6UnW6 zhQq`oh^O41uFTEO6Q#w~2HXl_OSGMy^)wUv8psmVAvD0qj&VaSTl!m0+6EH+P`vt< z^RV}M<8lyDfBDn(d2vyb;@Pp&1_Hx=I#`HuoWzme$dO>R=eo9tqJ|Teu$Tk{&m2~7rD?Y=o9ZlCFuLQB-%f+ zCjhQ%8t>fv?IfnC8wdfjv@T!PqVg%yTgk^dwi%%B}Tm zQTxrN3Hk)g)l>lyJ05l`S-}@(^P3?yHv!WZVcU@r%cLb%Shx?T{MUX%7m0^rSs!hZ zBHMx=YJc@(a@C?eFDD1$p{!6J(H94er}2Zv$6~&uTD}xXxNMUB=;8I#v3M7o*AFrt zi~P|P(>t*JAYZxvzC6Mm+sh=CQ0X!{6f4YpkW-p=+`Fkc!4lkpQF!C9$({%(PJRwb z@(CfYo_A`MvI~_}drECjivcA;pxKq@-NmTE`PIpALIwI`xPl+O4fNrPR%81evFR5C zD`nqLaxl_##9t5VWhAm4DG4!@oO~*%-66;4Wi+!WRYJoepn&t?QvN~L1Y52~SqN8S z?R_MTuXzi46c0p5UM#L-8#UeI$KT+uQzxqM&oc@3TOQ)R9QW=a^>^Ee_FEg}=`%nll7 zM14wH?8Lt+RLwW2I}<6}%2y4H*o4-L$3ImC9H-e&%OsO4>+c5Lx#Vk((5z7+OohM3nfsS?@@^Td0E>cYgV01 zXy9#OmdvZvo*mQ1xIEiR0`avZ{*Oi`-|6{M)apLEw&DX%9NbPrM$4R75O}jgp3ngE z%Zm6LEFTsY?|()`FF5(HLW(x0%yikkQQ(Qf*)Poj^;oxP?VXH`IspJS;)%!6`rPy- zsFK#Umv?>3b2}{sT6!56O1Hz_1zFz{E_1gGGM(Mxy>z&3_s5z%cOJ*?l11d=?yzE< zLrhs+4rnvGg!LZ8)K8?pU z;+dO#Fu&K|r}h29fo~c-cf>l!sqb+2WNLVjQ#9cK^mSFM0-AZ&Dg6)$XiZCPZhHOC z_oTG0t8KWMS&OI})rmRf$IaM2SCv|;(5L%xE+|YnJ;s}FdA$mHzWIpV&4XvZD+dQF z&*uun`p8AK(@y6Wx>bq1TA1_fW-!Wy9+^Jer~&jAmzf+i#COv*Uz{FKQ9&Vahp;-v z!Zj;b$0Xc}=@la8qQcwXISk9gxF7?XhFFUDmYZhw4`IR@bJkHOXdCsRgDgF7h3WTIbaI< z2r(4OwLgQX74+3l8p(Ngcd}<~OztXIu8^}x)vX`z>5n0X*V+F_QB8Zmqz*SVlKGCV zbV0ppd=2@sXn34Q@C432xS)OEwHM2gWEP!krMdGON`>O1#@!k3*k<`L8sUtpen&5- zL)=02)C=^V<90`mN({_D=D-3VnhcE^T2eJ{2zMZ!S2yTNKRq=;FhuTN+C*BHJ-WG3 zYdts~5RJbHiNp5S(U{=`ET5wBQG_jdJG{gz^+wl^V>kZ#0xFjrpeN0+&9$F)7W0dp zJSrY^0PkFJbr*Ncs8*ML{kFQgCaTpOOh?HNL$3;$aH4GT03ZVfN39omc+3WygKl~- z_4yjLC%dQHZl~9Le%bn0T69*FRYHk$Pu_Yjw=G*tZ@&> z-u_|o#s?Q);N`qQHZGi0eRpv69rCo^ee~&HMT^@C#G>98b(SQab0ih7)OCGp$s!%C z#X7xbj_2b}i)k&uk(=?MbY)ycIOrId`+iXFn- zc`g%;e#BM%*{OXAfZP&H=#L^{e7DkiAaoZ0G?UlSDxAaE=)naozq#65c744!zhBsH zj*7OTF$0sf3OgS47=t(2)!wKE>q;co1ht61QG1bmgTGnAtyyyf!8Gn0e&JN$>A;c1 z7KYo7M&NK%Vr=#({Ec>+@IbNWp_WzR`dhMfIl?u`Web9K^9@Y;NLq)7gan=pZ@QfS#*D=!vJ|s$w$Y<<`|jJvPp_Hte!P>Uf14{NqIfk# z!P7^G`;-7qxu#L}5TUC1X1Ty1!M1gb-GINHvj4erJy%KlWsyynzu?V+wYVIk(D$-S z^9};2K0FMan={4H9`>Tb7DTEY>Y?Ig^JD&6lTp-Jx9t$wmN0?%BzxlPJr>75-Q$_R z{o^pc+uHZHJ9c*B9w#Q~T_{x0eEb+)GC+f45snsxlFwM2yGVw4Omdj}VXt9XU`6?qB z=El2a}s+D5CT6dwi-M*8RO&w)kxR2NhhU(h|QT7C8!a`A>?M_{nZddr!7lCXqQa-W2p0KoKppmP$Q?2Jv;=EaPF+bUd zCnv_aX(n+4W;z{RC%DN!KKKMbj5X^-(j*;^GewhzABO#*?}IIfb_Xv`ZWIU>Se}b} z=WP4=fd7WNrroV@M^jl!NFBB^iqiNYb700Ui5n4FR*YzeSzEQbwc7_WX%tePLP4-krAz{B|ByQ5pq9njyviEWlN$Xe(kCSTe~#I{#sNP zm=Wzb%dEZz9PRCrGgC4YkPM8@I><$}Wv_Yw$z|8$_b%O%J2GEU2!fhdXLfFgMMYOIMf|9Y1yLJY_LRYO3+t z`8fW7Ulfz{CfvyagpW+`wUFORxGn+s-IH~rv}~)-dp)jyls}s=!xZHLs(aHT8nq~K zL!6JOQt@b|YsmYTAu*%`R>C?Y$eK^BziFiWpq1FCE8X^gxfonY`mSRn&O^cWz! z+~d<4feE@2Ha7Qb%d^tV#90#Q`4gH<>DMYkk-zG7$}~P-$Js`dleaZfmNQVC_L;}j zq#4onv+U|nP+jspuht3_CojkHUT@*u0M*u$Bfl9J(oGWnj4ocD_N%|zo}iJiTO|vB zI*P(FmZKPcW55uWjjWe}GU;(?!1~hAhwjYzSM`Zd;+P?Lp}P+yaq0xqMl@xK#C zdWx8*w205W96b4ZfJhuXKxPl+hzvQ}tozx;>c=|1XH4$Z2>hF^hA4LIMfL4Is7jNB zdns|~f1*U>ev}{zfnQMF-}>KBy|^E$WZ~WctQklc?F zBq52a0Pz|xGFSJvp5)SARGs!il_cCdfa3RyHA(nm07Xe>e1~__kv#-{mWBP3{hMFl zqM-GkWS_EMvQPO>vZtv0sgYQSfDp1Fdr>{MAF3qbUP@g0eay;E?UU?J?MDf+@E=eC zVyW8S`rng%?}lzFgDT{K3oOAT>9vdg{R`4f{@$rJzFU@LvX zV}{Kwtri13n{U<&eZRY5w}E%q>boBD40@#=*8XRFQ}8@a&KlDlU<{N7_71?e`vTS; z^Dq~8Z53}LM_F3O(bcE1(|{s%?OUISQXxE8?ds4 z^IU0`h5s4k9EQEQgF^1MB`%K-L@({G?tI$@2#*O<$ma)ec7vWdW_Q~veL2qVbjglX zm%T)}!oG&7Lg6>tfE`8eb8RzxFuv5V^US!>OmAS52itv%BTM^`ts8sNlGiB00RQRe z`nUGwmFVtT)S|+-VZ@c7Rk_W@=c7kDbMQ8=R&%EM+Lmh#mUzbD@gteIFW&l(;1*?r z-fI#4@6AKD-W^l%=49>P4ecImyYhME;)dR)iFcEvN^SnZO+bw$6d4^o&x4wK4P?=d zEPX1#uE1(7%jV}wLK`?X8R%Imm90ZcpvBX3of%`S2H)S(rq^6oTB-*prY0vS{w=JB zhF7>jkv(dDc3a>H+nqcW_b&uCU=6XLf2<)tomDM6gehaYeWW_ZZnRpfCjyz^>B|8m zA7GU(Pg;@!MmZ8?hZ$@e)*wusHJ#-RuJkkfpYZnehiKM3XnTr+ut|`B0j18Al$8PK zWO49nV&@3vkMc6f*v8}b&?(cerMu4cbhGYaRJ(VOJCJpo0Nixh;}4ss#+fd*)?_TM zUD;w8H9*eHW9ztGYYD`?aGY;{ZEK_5G!kmN2>Sp$8DBea5}m0A%;1H=i)WyvmP!n} zpUXVCS#2jj7ZG2GV)VB3XOE+F$gjbEKpgmMQ*Po`@HK3K0c`y|<_mE}N;@;5u zh3C5;;EkA2SXH+y@*H7MWj$(OyB7#s zqav6=@9nc%=1*mDSJK>=&+Tjg)TEoI8UDSZyXsY^(E(cG)zei>y+_C&5WIskWC6oa zH#O-4Vr2LWSKO3~@PB^7s0oOQ zF@AEJpZ8lIpaT8VfcQJ?77~FQ6C$hQLW8Nf5prlDUedRk-J3O;rK6$}mY||y+S`NL z?{5Tv29vv_qrt%K0V*mxKW7hraWT@d MbBaEAl+^V903NQs2LJ#7 diff --git a/spreadsheet/macrofree/alz_checklist.ko.xlsx b/spreadsheet/macrofree/alz_checklist.ko.xlsx index e762986591957dd57f4ca2cae216c7d9c1c383bd..7552a3f399d0b05c6a5eb4038acaa12a252bad3a 100644 GIT binary patch delta 20927 zcmY&fQ+S?T({0+=wynmtZQE#U<8EUcjngznW2>>*n2l}wPtx~0_>Z2GeO=GoGqYya ztUWuj>{I@)PjCv-pFmMReE0zQ!6pDb7VbCH>yIWHZ=fbb>3$s_pSo;UR;QRPDD3W;i6Pc;+~OQ4)=E zVD|iRO3h{Qn19`GlcsY{#AF)n4ED>ud!rtxHO1Po`$NVm>UH5Ve)App|8r6`^vB=e z$Zu{6ib`>FZTaxQM-S`+=7;#@DeUTNNCOMtAZw|v^7BjL%4Qiw5p;f!9n%Fr?(02pLIs|NoApdDQPs?^ zeh~<5?5=R3_6K3JL1`Ima$-?EW)^;Lk^!$dhpmsm9QK_ei zVpv|Or0uX#Sf&AmI9l^F9#^5}UFcV~@|pD>jpmw4^qWXDcg= zc61P;%qxG7xR#9%Wg6TFuH$i?*g*>8Rh+m0yC_GGYWv&fRqCZucJekQXZV9c+BPWk zQr=%t&~yNK_KR7mPZZ)1)2R8j744wkxQ@^lJL9CY!E;^Vq?7$*L78*H8_D?dLFS=h z??_QiL@CAuETYKrBN5GK4C=uujaevfUIt8cOy?okh8vpx8rd=ELT1OgO_?o*d$S9` zS)=y4WzeX-{#(wTH z=;^giEX326`hE-?8;@$&7?k`1?sSuLW3cp|*~#@&Omz^5WPX%!v`>&+c=glQn!gih zZ*r*`E%=Z|H9JKqJ|=YwexW0B$LO5|x-=ZWkHvKr?kUCQI)0qo3=RZg)kNPO4t)Oo zgaRVHPWbvYMl(?*@_LYU;A?!mtPbeqX z<84dU2j79yxiNf9kt4k3x4qFNyk3g9vh{0jO4VyUV9HZc-^CoX&agT+=1l7W)cgEu z`x2`=w#Go6L9AfH9zU-ppB&iGm}{3(N>(2a^r4LY-DxANS1;WW)+P<0N*l?I1hYm= zm4<|#L$5s$Rh8Y9RzO^Zl8)n06*=dj63PrWBe$V7@K*@?F$`&uYeQjh(XIfJ*3%?M zc=W9!{e;q-wFAQNIu-jM^gP4%XJqE}g`kd5~zu@V$~k z*Uhjpt>;+#bfv+Fz2PzCD;*WiTsPBY^Znv=dqn81{Gnc$Zli7;2$I82t(LFG@wY3_ zDD2}@@XMb|>?o{89_jpq(P{1j-EKKypn9svtL4Z_?l4&i4u_2}^b*jkKj& z|1DPvwVg@L|nubM@cK<`=!i=UZWdZBOy$+>P{}x=v({kqN0FLFCNTF4Az;!5kS+3Mzn^hLu zO0UsVcTN)MO1jN~(*MQTv=m+w)FQ2nDkn2`OsdpV#Sp$@Em*uU*!gDp{cycK^phlp zXS>IW0>$&6S@Ia}mBrLi>5=8)#vh9*X`r1WJnb;?pDm0Pu>!V{g`x>h!x^Z~!`$^o zOXbZghEZ z3S?`Uz^pt3lv$2@M@M9~ub+JsIGJ-=qen3|#$%>HGe{D-CQp&!0$gt*`Fl!}Y1fVH z^HVGM5nOdwv8TsqZg)G%Hu~1Dw$+TlMnqr&2Byfb#`z8AQWvH#luPd368+GB2qP6l zj2A^yErkQkq`^J*xbJ_)cfB9IqnJqq|d#ztz zWokQSjN zh2TI)Vu|YEr92>CLL6TZCCLd=G7Di7EJzmk(W`KoR?AT*WnO$61evC^C9&3yQ~|) z>UdL($P#-#)e`=3NK~=EV+PR;mC;7uNS-e}GQR+0cG^`@lWZGGgZfh(hU@DlN167BTMYs854Ucc{l zh__sCzJ#L{{PKZjf-u48&C!vIR1>d`4mEpqG&X_d*cHsc`IFZ`u9l#78Rjg1RY4S< z*3Sw!Yq2Hd?Mg+tQAUank_WA~+Y^`H{EI(uapIeSr2{}YfdSF?9{&o$A%{SNcjpcT zeBPZEszQK)tQe%A)st*z3HQ`4mySohf?N4|mV#*2LdcSgCZRqww}2zA7w*MU)dR;7_lh5`@EVt_<_q`nZgVpup$@9+^& zL^maFC}rjF8P`YC41%aVg179!N8bAed0Sx_PRZS)>w_9td^im$?*>6Ygx zs6D9~uOMa5Tj--|lzCqxzYh$&h2CRdfC~+3yQR^kH3t05EBXF-LJ*pV3N(&T0q!(Hg9r+?flKU&x_L#R3d64^$TzAGn|{2yvg0Mhd-C+q zBrTl7$7Vd*Qv6+5$aTy^Gk!mC?<;op(o93rhoz#k0o0P%S9<}(h1J{$KTAb=2}BRF z9|-lN9^bnI@bjRa^aWPYofN-)cs=$n+$jr1v3`Qfq5Zn37IaET8}662Y|Lv{5E=0B zgH{rDYD4GoMkfO+q!ZmX`m(4;m&V8ZR#oF-M|aDS>sL*->sPnR6-u4LWxhB`JTwrj zwj-+Ib!vd(w#tA?xpp?%huy-|+Sa=?>@?o8haaA_&bIAtj`=7vd~krSwT6ez5sJ>U zi~vT(Id}fP&d!uwyN_*Kd%d_xX0+pHa>p*u90LJ))C5V~q(Eupdw67iNGG9o0wgFa zeofG}_+(WJa`sXRzkf}6)2x63I!IeFL(mqOC2+Q6EL5RnJIS`p!6!T4ngtCyhh{7(b-_m~Ni9Amcw=?!i=Sg8wV0NWnnHCOKvT zPr5MfKSN*{$-a?Kh3nd$k_x3yM%Q7r2v`BK&iv@?b(iIO>g9#zd!U)~*^I7}%udQ< z-CParwFTI;ewB0PFvVEvpr79I(mWTN7WLaJQDjKn@|=2!kXGWLQ@)wt-|FZln&^aj zTo{6(XG!*ltWW?I0^S<`R6**v93?XR0i|3)DiV0c0<7inbIv_}i@EGy@K));B!ALc zXSQJ?s!%_~9NbZ;w!}i6V;ST%Y_27;2(O`9O_5cUsiG>UKPsu*kx@dl@L0a+=yb{) zzc@hO(sE2(oJh?AvY$Kmr@cVlT92(#br8JVZuitVlra#uiIOFvcq|v!jSx17ivV3I z_358)CSo(BNN|T+_=BT<@$Wj@D%GD;bli#SRi-nTb=xREVsgu&WtC<*U*+|__Mm1WrIGP3JQ6iqVmjIaM8wj# zzaE+G_C9eO@J{pI!JD?R@xLQKvge{-ni$zGj1x4->uAVsf;mjQ*`u6(Z#V?d$t$dL&Rjl1 z?#J+F#Is!&onEFW55gZU6Kj+#+fI=%wBH0)(#euo25&muGU@o1nz<6hJ08wi@<`ol zAKRT{$2NBvg|});H%)CBm|j*P)0JzFxulSrOFOJE9<$ITS{O^ew7Q%m$*WdP{7Ou3 z{JhOSoyQR`>3vHT1a}5(+?2#$=UJC}n<6xK?icvlz#XXaLYd0L1$uTc0P z_bHQW_R3X5myh@$w@J7)m+0Y8WodX~Ruxz7^cJ+b27|+`%B)cCW0#2>f7X~FmcWTB zDT1oZCvVYE_J{K?_wX4ZrXO%>eX3YG((oZ7&$fuY-Wj?6G*bx(ypl^y9!*jQTrv=c zPp&qbK~uhvB_T3lJhbtJh4G{eiwGKhAAg_ ziQOxM5vYJ|09k0r8QBuuy;5GI3HHi!(62jm1Bn9Csqcy;>9euf=TgpZ|B6g>tK>^mlNvW1YRNA!rz*t#+{$3hw;kVC%uB-tSN@X2fJsh>Rwmu~f1w29=M(`{7;7gya!-$&Um<^(BVAp`1l;TD!J+v&^Jj?~f!ihM_6= z8_g9(TKDtSbFz(1alS%JbCU>t%ghUv`3v0KD*maG`MPG2rlPxvH|IFPjg;`PKN za5;+n!y!eMbWl>1Cy8!l{dim0g@1bX!Ed322wfGH-xFs6TU`a@y*Ff+m8)jSKmN3T zPCD4~O#x1l2^94Zl8oMPK&kL~4&%=cJ`E(afVNnu&>xxYQ35Xi`tsQ;_X zX&I;_xWZwEjD>xXU}bD^O4Kaq>k__(WJ;-`hY)UkIH}L{aPs#0;b8GElU$lI-dD-$ z=XEUhB=_V`qOJUB>`sSx>j7kR<_}N6VZu4Zb?&zQsC$ zIy;VT<^^UL5CcjI%Yy@yh41ObtcK%@447o7azW6uTHezwwM;6>(9YVVUGG8g(Niwg zd7G(U>_a}O;0lWzBacW2u+pQSjGkhlM3#7b8_HTsvGMwOo-lGt5bQFQ(ILzl4H zf4y)~DQpg$vzzt=bK1p^|6$>^sS%i>iI1Sx$vh}ZH3{#eTT@LpM|r;euKy=JAEkZS zVTEDHTj)lPZ{k@Y0c@u-D*r_0B+lI4imnKD=7sGB0Rsl@Pj)^bwtCMiLGNPD>N`6W z^U^+{s$^%auiJXq>bvK^_NaXL)+1QRzws#VHuwVU`i^iJ(D1kYx-G8=C*1b`9-Zfu zRJ!u@HAfE|%dhr`({?-;>*QJVgTsATGNd(>$q3!?^n&yB>8RJIL3opQX9IPEAG)J0 z_m4RA(#5xF3SWgQCn&4pci~E>>W_*jx>VkplZAT>^Jv~T!7&sdza3YHWA$<4h~1A2 z(092)rz&s?RF(m57yW+^j?jprk(C-e>uc&t>j`H}gKujz#Z_!juAJ&4b; z-am+J46eNaayy<$h`(m_%M4l0gBXD{qL0%`_dZC?<7tbfzpwVMT_S=NpE(pN7`7}v zjYx>MDR{4|$DQwNiIUV84I`J50z|RfJ@f9e!;%Lw4|6ag#`S)#=!`g=9N_9I7^_f_ zOKyapQfAH)|MaH@_OU&y$h2oJIrg;fB(gBtvT=rG9ILiZsQ@<91;n{SgB=|S+ zNyJr$b2Ba*T6g_VeH^JO3sIP3KP_)mg)`(osv4V-;Y?Zeg_T*xwM*$oNzAeWd)my> zQqpyjn;U%xtFQwhHt(ZFx_d%3J*f=sMddBA2I6)D6G6ix7Lb0oeS=VPlD5Cb@7?2x zqX=EpexIXx*(>vN=W@I;U92(*O2`SS!=%9-IcaK*#8yLO%B&PU_f$GbxcPg+RF~}1 z?$Z2iJ`8s|$UlFS^}^SOs`)dSkN)p>5Ee zs=q?pD48J)k&xcnDV9}PIul{(J;#~m(^>j7f%;~`Up9pBkpCt|i22YE;_&OwUAQbf z{aCmrjFj@)TZw52rP0@LIoC!8`N;i%9Fy)}21R1ak^qXT=IlnljN!yBNr#M0EeAbO ziv$gi)kJL}iYc(fbRwaY2CqO$ycrbD!&b1Z$P$WI>FBle(SL73#HxSIqXXAkDj<=+ z!U~Q!rs8_LB~gdSI@m?}O{&$yuJu8)j1vhJ-=!JRIzq({{YXK-)MDR)3w$@ws0aN= z?{>%J>QUi_^k{eOUctIMW@MU^Et~Da!&&K>=@T9h6?41DZxOz~rk&LxdX5^PJVSUa z*`jAUe%#jWPFu)kDG#!6w^uF$)z_6MGtvlcZ3XN3N7@|c-nt;<&a{?XK|^baWU#s8 zR~A{cKtPURZ&o&RC{XczWPKUy*Ex11joGVgvz9VO#jR9Do4xaNT&G8?aWAM^E*luX zqQi9HT3w8zC@FegWl}afs8--SWM*7zntU>Ih`3mE=FdjbJ;ch>?bOvHYX)@O?tlp|q`I=xPx^pyP>^FKZ z0nawtp?0*`KkuGpzVhN?x9hmsbrfTzdrOw9B zl8wE=QrY~<&fn9ns>?j=&Ud--dRhS;#<8k}GFJY~2a%` ziznm16Yo?W9+ex+n58rlsOC@zg5cZ`sMOOeP~?o+IVFZ>x}0QO5;Rq6K33#WZhnGZ z8BQ%H+_Xz$UOyG?KOSwe-p+F-Wv0eUEEK@Tw$XMAB`#f~cv0&t+B{CX|uIEypG1ly{^11g?oVv)J zaZA9+cL4-Q6fNmX%kNUUwguj2oTel285MlJ%Y zk8aH}uVqyUMVjL+d|^sNpGrhtGP>Q&DI;1mO)C)a4q};WR$iF>>7#bNq^M@-d(AgIQpEj%&379r4^~l#dtuAK$^b_)>i>D!{ zA@F*s&X7$%Hqs>?k!RQu9hXrigwkEQ$XvV0v^z-YleY;yA)p>_2)a`RvD;iW6nQ3r zvUEL%nnG5bn3=$E5ASu<0ABAbHb}VlbiLvBGI|KjPbcimg*Haf<$^^l|Z{_4$D6Jt_T{#ZtB0Lj#iLnE-n6o zuiIY(l$@~NUuReJyMW(j7|^S21jX5esx$1L?tBbzm|8FodHSP76du`>PYu- zsq?%!g>iN6Mx>3(AD-|xlHUHJI_MAP9qb!n4e$KH>1V=G>xhFNr}^jwNrG8i$2!fM z(##CFHvSH)n9^OZ)}w?v2t-Z_OdIb?G(Aq01P?F&uZ;}Mg_f^dg_P5RbNZXm;i|Ou z;MqE_H_P&AB+=`y2H_d1jP)2*GZ*U~Vgpk}LLs46pG<4}c@IyrjerCdP2ju{lEsg3dwzO!AQqS!rVP#y~0ft zr|}uIDu@4<0<{^#uPHG6mIAk)2IB;)ZO@f%>K4cN)6;Y;eWwYOtFcR?KhniC_Xuo%2;1K7_%Q_;e)jX-!41h=Xq8e2`cTXg7oSf&N2KMUIB`Q6L>#<64vdaimd@-e zLm%NC^e_DReTg%g)&H#FX?{jlZ}8%f=k_Xt@m!b}WuC6hflZDNrm8+(EjzwE=iMGS z{y`{k=4E!*3DmlK@N6~%N#g&#_EpsV?YqJ-9r-Eu87R&=%XZgd0;ax~^CAPHf_O8b z`hRvT_;4#A5&k7N9=t1Y%PlrBPq^SH2QE1H)7eq<>ZMRYDZ+R(?fA=)!$;=r3tWwv z$0~7f%77rj5FD*2M~YuBVHhNBq4VWrhh~FLdUz%&u0&CUDVKpLRT{Z<8vO_b5|PHG z(^c-a=-%wV)L`g>#cBLe@ z)y}c~h#~s*r6L68Km287gwV7Fg$x# z`-D^#k4l|NA#m7bq~lY&gB>&s)LQ(;l&fFF6rL-#d~_wLDnq($KiTjyT1;qfB!A_Q zH`k%Q#MVtSs$sqn=5ANT4Ed!6DkvWkp>>Ex@i0rI7)j*5(2c-}9NJ;)U^KD+E@zH_ zLsYRdR#Y)`f1OU(Pe1F)R}aW@0YTEM#L52tcvaJT*gw$J1isIrL{s0}dzmEpT;1Un zcCQyC*5zheR~6!C_7FgUhoI4$lg?vm85xPdsjvQOO0{b&GsavC z3S_Xi0l^DTPau3sG68Wl{JTmubw~l~IFpi=Un1pyo}N5Rpd4ULpzQM337!Pc2bo2{ z-m0Om21)_4CMloeAZjx%jy)7ti=B`z1petFJhi481@=&nMs@tIgaNhUo(I_r8t2Iq zyGi{vE6vS-Aez-$^I!?2>`&K+GkRT^D6s^t*OT-&0(YP1Tk;NUhP#Tmj@){z{2O%h z8`6-khHp2S3_Hd}WHeoyCCk=;-HU#R`SS8kfHzKAI_}^nE)|!ngU_HBj%_7JNAI-i z)$AO9hu9xgT?KI+Bm+j_b~ofW%VwSL&5oH@nl%9p7u1?zaBLaf8vbO28VO&MKa!}X zD7=t^iV9g07C>#T zfVc2@VqZn%Qw7`nutR6&(`s7n4_rMhLVF5oO~xW`bzU7M!t&LsrCD}08boG@LNCL#Z)%3c_IiaG(+MOmRRJ z!!3U=U8OzW3Ts7MWwX^G{I1~O=&3Un31k)V$vL-F;2s6g16@dixav{w?IMfvw}Q>w zvSV%O>{fv`zPYWmf6b%m_P7)JgckM#lYXZQpu}4~at&eXbgtAjQui?v`O^UZ zWH~~6MonZOg+>qfYrR682wUF|NGa7@WltrGTMtD)nXG%VP1oVb{D$JL zrIrLX!!1QB?aw;M&3bZfPc_S>H|%a{YE!F@1nSwmL$GOS!QT2WNq}Ygra*vH&*y287Tp5YHuQS4QaR}Q z@?kiq8rWaJ^X;F=_49q!bdAEwk-$W($0yuy|9je?1n7c-5ESTj5?NXxsx*iOp*v82 zwz(My-sR>Y#tE|A)tqLi*(%<`Gb-TR9{MRyYIze{BHVI4D2$GsP|_rjJoBP;h2?uo zW-zj}32GKZpq~65Km_JTI~T$8V;`dMt)w>kl4+Z^Lf88CEto2U6RaY(2tO~Sjq()x zl9Id5V#7)!NN)5kU}1~E>fGX@ip)6#ucXihy&=~9a zsmiEO7xf$aRJyu6(Pou*@nFVi+gi}U9~(NEUqzEl4;|0d>4V}tMX6m!dt&O!)Vs&@ zJj;5E<~Rl65Z%9JnmQV#0tq^sE(RmcQ7#s5&EJfg-aEghKpJ{E=GIs8#<_E_^j;B5 z9Z+PVqH)sf0zH`gk8Nfw?oGxCS}3Kx5a}5*XCNS~2d&R!(ggLutc*9O%mfEm5VL%1 zQgN-zK|MR)pOQ3IAFB9fg2%tk6M-FmwRizv_E%!%TPY%q?KyIRbcQ0}k1R@fUaZY0 zcb`~eni9eciUT!M3dgUEQ;e%#E%F{Xf(-%>S^cSl^QU0%hZ0(@<&QZ#7@UQl%*Z>O z&>5$o#ZtJ+=MotU7h?=8u-}9i!v&6En)?j0_y)5l#^w0gR0aSH1(DT=69SspFJYRD zyRW#t+?jJ08_#)fqQzU2@Y5fg43I(3C)*Fnn-Inm^QXd0(eO@(g_qh;j z$9j+3*sSh=wXs-l0iSs}!snq{n}?XIRO&7GA-m*J7~qK*@e4QT-33uR%cC5mj2H9a zOm4yibDn@kBKW^T6*4N9m;@UZZ5=XdhUhy@NAKF{>&CZlJbAM+?5f=1iGMe6X#@4A0j(QHu?5hEo<>lcu0j0FI=Fi1;U*a$xb=wsA9hBQp3va zGg^FrnLijZ!G0? zxAfBJyR#$bV43i5*0;t^hm-B;=i66puOH9~@w`@Y`|cA;X(qR?v>B_GqJ_nJUp-r~ z4{etq@_GXvqOZa!$rH`h2s0~>OOcz4oQA21qhV?S`>vVx_Nz_SzM5-pk|s!JuxSVd zYg#j^=$q$UcHzMUC^?nbN9b;H)22mU#^rlXz&ByLkyC2pA>t~CnM}<{nEpMfQwyibHWKX3n5Sa}2wGjknw*0_1T+R<6 z*nyWsmy}tj{GmTaZ8DNS>-%jB^FKvc{2=jrX@k! zn2h>3G^>BafQ$l7fH{76$}eJ!rmykYGLXVfP(*UbM>ml1vDJM2P*fjR4aq8{)Cj|i z`bW}1O@;pZ$M{kcp*IIezBxd$tBauhT=lW;`UNp=|Q^)NF``a zf3g8@{Q49eEWTXyvCl3XP7&Urn=EV>)5lR+V3C+$@N=Y6x&8W88vfv+)Gr?l@lQ0E z%chky5GwI<*<=68Sm)=~-i~0S)yWDC#Ch?=6hSKuz)e>TepyUV^34#1jgku5t#eKMi zFP*CxPuKUMqC2h=@#1B6W2Oy1LQy~nn*N^Hag z(vou!+0`Or~;+HL$veXVAv(@G7->Q~`1_*WPD$Ak5|zkGF#m0jH=u zjMR=4y2+jj?hi)!WTRqu=~ZW!@N3{^~`7d?#{Fi2f$gKzt#g zOB|>i)0rk;!r5QPiirOfe(`h$r-3*pxU#ruLJVA;PhBsasLogC%lBq0Y8nl9(rRVB3qa^IjTi7?+ z@Z-SLWV@i`iyz%z3R;A>M-3rak1ep_4AhcqTT|(Jw8+S_Q*QL+iuj2xDgbICCq?n= z&PY}T59I64$mH#S>g^sjHetA+XZ@fVIyPo^p+hVgQDRi)PF*g;$_lQ@46Y73L8%a9 zIvPLUy80Bw!`YM1-k(v{DaO%;eatrsIiDj8#`=}7s`q5EX~~Wf%I08a#I>D7H?2nQ zW`vO$M^}`Q#5R60MIuujsN%#f;#VREouxK%lFe7hQ$B9EO-!5d-@=a0CY6peoKHj#A-awUqlA@!v)rP=?7diS*#hxXGjgpb?G5kK zHF>8FLVZ@R@jauaao3jZqr#oe;sJ8)fdpFp>$TK-*-{9!?~H+u)~mtwEMn~Huj=sp|RrX#Yb`r3Trdc$K7!PLw$r>4pFnDR(l$5cwR43th2_jr zN7{6r?%et~G6W(MsLJ_fXOgQ4n6HKhK+sNgvZ4GyFNqt>a>Lu=8JJR3K@IUw2xC;u zW|(HpWk>hdV3@9$>4+*yD2Y9W?}3Z$+)$zBUNKeM;+p4%OPYVCoeJ6_L)W$ywAmPx zen&)g;gLsTx#Y=eO54ws<6S_#RQaPsOx#>_VSUYKpATjiz|k4kzWbim5qn| z;+7d4Bs`4#o3wvV8}E^i1K60?e0u;54x~VQz10@8{~=^QtB|Y#Yb0pjdkYgfrA#(#^mJKokUX$+p;{kr5z4{7UA3bKC$v9(J1RC(W@Km zmwpr4T_!CQ>ympM`Rel8B^^A;lDC6rWr$UT8M*(o{$iqo2KJUT-iNZ!3c%lFUxF1I zySqh6i!G1ZI}ttCE1MC5l=JOWk4@@S=(50rsAk{D7{7Vz1i2*IS@}|Eu(FC@AK!1K zp@4R&&d#)$@uH$Uk@g8vx4}3S!`AQJqF5q)4H4Z<(Eo0wdx^t-bv6e5>NG-xL9et_ z^z%D;Y6&;qj{J*gfkR7Gp=273%vdyX=66=jo`vk>k}SJTa%jhk zmjZ&I+O1VlaqHL@Uq+5fw~V?pAL?cxXs`oIee1)U+`U+W>%MA%!r#Ja_t<3;YBN#{ zQOb5AL6^G{nOE&KI+U7ikDg6S>-xS3bcooUsXmJ|P*Oqqnqs9gwZfg*5$9EfKKu{~ zfj#j5sb*EEmHtj}mHw|7PGC)+D!&Mxw^D9x6W07vo*;06A6N#2Z(YDb%z*B#V}Gi0 zTP8(KK_iZx&UC5x&}mdot6{DK0{ZUhnG6DU(}j}u-ptOmixNtrUyh5xTS#v)u2jII z)#w`nbI?3al5aOAb$E&!-$54@#G3K=Xtb+=5Au%4{py&Kev&1teiB-6EVCbLf+9Hr zUd#C_K=WNrM9VPYI1N>o?QupC>G{%;`+j1aH{!+8gkH&C9LI~Hw1@iD?{tWGMJHkK zG$3`;g-f}sFI8?mw`EeL5WV;(5yYu|ZjG3QsYwYi{ofb=%DGKnQ1Iwr$TVbesZ8J7 z2lt3M`iRxT`fLmrF>UvGSZ0|V!OR)^gr96z0E>rFG^DTlZfhyQL+N3*10`q!^;-{Q z7tsgBC=1YS%kAb#>&I4RakdxJ=h02;FJkiG$13$ay0&$To}y)gb-`7!KXpq%-(nK- z^Wv*7*+wUsBHnAbLgmB4w8BJjgD;ygWR?bXfWaQA5C5gpL>Th#)*$5HMu;*nQEiTG z?OIMNFdVX{kSV25?h3tB+xLJbG=huI3vNfimaH&%OF{`9-eCExp) z*(t-NnS=8`vB~%av%;^UwGLanW--p|LU_Z=Zh+lk@rNx5cy>E6t)bE(-f&`I4d?P4m?W z%&VJ^&(zx;Gk6@9!$3{(83#P&jMx!EF=%r-UC`w!8PsK*;0AWqr~Bp)5rNk-a=lM8 ze|XGVHUAmB()}u!IsNLicJiL#tbx2S67Q;J0Q$4@`FYp+wyxR@FN*LIk9D#tedf`r z%3T14VK`58a2B#Go3Ae~EJndsZEJsOxZ?D_H z2U>6({EJ4~wCm6t+vZ(w>;PR&m}c@-l|MJEMh5`0#e04Fp?n^f0lk}E2aPFh=5ie} zlC-gI<VHJ(6>8*imCicX!!pX3WD-o3KX~BaL1U>AoyM$B@*dYY9v- zwnt|BC+uxtl0hxDiXmU060+ek^YpWF1gYCOpg1(*g<~^!#>ej0k?1OvZ#I1~g$ERj z=Qc`wrl)d{Yzh~K9tmyJ*g^GhT20&MhmXXxYE$)MlTlKT3f#1LWMIs2*;{em0$*p| zYg9|+T92kY<>DbZ8F}xi&AeY)G&F67RC(A>y!u%>=P4|u%RZC!Rh{TmKaBo?vkC`cYZ8HwS6yoF)_P^|G-{g>v3Qkk`0kvs=$f}>@hd}0c%^V`4OnReE$ z5SE`nz+{%b&T zlrCmaH#loGHSk>O@mU%7ARlYMQMJ8#N)`vhf;?k!_-3v-AI^i#oh{r1))O#k~QTB+VD?sV%2oY0hoKdvcu zZdZMm^Ugk}p7t}>>WeBY$D(Ja@M*fB3Qa9M%oDIOlgN>t?IZ0kK#Qe~w6)$i3ueI- z(iMv0djFnt!D>o+1>GkFbjM>OB`vVw4%p^jHWfJ6R|K*)%{Zn*;}@3KN---PxYSTz zXdRFn*IrZRBsKDd%{G(ut^4rcH!8NgK}E0izDjPpE#Gnb7PC=jmJ3zQ2cXB@ZaZEvH#`EJ|3Im#Hc(IJE&|ldu}%;bQAzE1z##(i@Y zyJKMJ-h9yBsIe!7$<~PTEmV&HStiv^=~b9H^k``CYg1(S5Ibea5K5j48<%=ZdyR+@ z9+MCytY17hw!DP9@cNpNU)f%cC*bwzid^_6$wXIZfk5G$0@zV&>D2{PDy z;zAUq+f4b$a}Ekg;OM?P)M)=Zm%}dC_QL4XE4dC!1bZjf*vkMJP<8P@qK#sS)^0ng~%!HE*PSw7(7I_WCFX3ruN(; z)ex6snSSXKQ%hs!x+WA1p=*^8X8~9J^qoRR8vvd&B_mEweIoPBtFtG3NLK{vL!!FA z)aqBWJbK#dx$c_3s11VkL`5onG~VM1q@TwwcD;0%Cu<&@_ueflz7$nOXfwUQ= zBU1W1jWJd=2LF0$n;``jIez->_-+U5bdjdZR#(?mU$>vB-QL(#)NoyrrQkT5qL~uG z*MWG4GVa8+rMf?^IQNn-6-XwT(zF%4+@eHUpRgiw(nZ!ZoS7cM>Ke2zdeJgopGcez z>+=L=RiD;D_vL;5!Aq<8_GD}vfX?hjt93w*gHhtPm5bc?+9tCdA%!5V z_TM#$KTRB(okkTCxIe*CA?&Kj`{0w&Ik}uv3#VNM4Df2S@8V5#aT?G5U7Ny(T1N%S#piUBoaJkw1$8nid5a-8L2jW_Co{NqX)1x6gVP7seZJ zBjFR>S%*8&=_TZYF^nkm+&-nuK^{32)Zz^_xFt zp7}nXbI$vG=R9+sbH18uhDr1D)7+Ch(f(bdu`nW`Ei29vdF@CzG zzWnT)fMuenJ3b4u_IT7k)(h^FSRL}=>y5BZ(?@TBw ziJ|J18nIGPusTM0zG=jLNUiM`I!UJ0O|^RADH2gb8j_ql9CLoCTz4aTo^V$PWd2cv zOw$<7p^Is#1lYlqtasc4%}I(jYLtpd{90y;DJNT;^I*BIPolf4liI%Kiqi_VM_(Oz z?CFl3P`0vY1fH4`r);VPdzH5I*QK@H$>_L%h;1tQ^a4H?*WZ^ejUGRDE9n6a`=oPf za>P*vYu}Ose|Y9pSEvmlBoWKwh>M(W1dsTtOIKY|Yt#-SzHa7>CXE~ZWnF;#i7Gd! z{>$R6OcDdhEd4wR*TW$sQOx1z zssa*cNg4KBZqJ;$*TP(Mr_M*0fcQWC!g}oJVe~3*v)R)(@=NDzWnK-pg6+77dmi+k zx5?R#iI5Cc6DrkSH~Y8ehg9`$JlF(HU97F1ymoUrFXvDXH02(|B75+WBhH1KB(mxF z%%94$PwkpZwxd-lMC;BqohUC>I5r2@4B5P+tLa>Xirly(e&0#w%z~@Ol2ywMvdceV zhwIA^WH;M0IeTrygU@SAN$?Gjww6x&kEn-jHikG*sYVOPTNWVxq6u5ENnH@ahF^F- zCuBzy(A?*pO=8^2QX~v4(J6h+r$_fvcH4>_h@DJWDXHnpiHPW%x$d8MWKZ*GfWI|C zGX@@A#Tf6fbQc})7fqGyEH65olTdJHrK51V)W3p^N)39swekWOLjn@n?PLLh#zs5a=PLB6xnE2J*n$1+Q#;#5ApT018_<(CYux?JxOXA=%9HUrshjqys`m(J8{R9z zvP#NX@CiTNbSuBl+V^7Jg!?SLbZ(%EEzh)6$JUYU&1C4EKm%Z>@WokRm%ZVuEMQd>7-Ju5xC+ z!uYTbbGM?mQn%d3giUEu;SC)H(N@@vJ{d?Q;qZh!mDK=YH8H;TrMYh6H#)tf3?aib zU~^qlhgd8p7SR`QFng%r(fB%{R%%50B16K|W_7>auO-994N5wQZtmD(8Y=a)rGqC{ zPWeo4Ko0j#`R*j5lG*CrZZ*+zb3t-f*(vvP@p*cJ1MXv7rpcQ%rw&+0&)SW2o)9!} zRR!43y+4w5Jeq|}XU=RhJtjEdIwof-A{CyV;?)w66qUT2N^lz!Fy*8onR=3@JXFBI zt|Ro{6mijy_BG*UBj`aY;@g&!iWsVi%)fPc%Si(KmM;26sg-Y~z#%kL-qL8N(Rr$m z;E}x-y!1-xIb8EP3j3Nm zWMeCg1pKo?~2d0FFSm zCF_`etC~E(T7zg#9sqCG9pY2u&${0_G6kb`ISVW{qy|kLZ>$Yaabi72EhV-MV(!bZp}nIyhNJ?0a|;3}LtxM%P#MfhEATjTGdep2RJo1+?K6npoSY9?-s z(}DN8o)4X#2nRB!DVP;K9~!ee@Nrp0+Y@%=?VF0OaRF+EW#10l92pd|DVid$#_!`u9}y zjdZ*=wq$80cC#I`EE9=0P;_)AIgSU_FMH2`(jGI(Z-yRd=?^T2_3#d+3Lt~8eAQcht)+U`=DBAr6}#kyr>o@i ze{z_O@L&v)6)wl{Poo@oC_=xgLmx!xh`cj=hXMq+M}2uZyy>r$5tUW*u4Zi|+Jj2y zOLu{nB~uR}jBSn;HQbZu6W#oo8hvGvuo1}y#$+-ehsu?$TM`d;MvV3izJAx)xWe?H zp(uT@S^VLF(kd5Z{|sTN{9|dwtj)r7f9pxV`xHj$A9oqY#*P@=JllvoYgp8z;tE?x z2C9qse4YdxJAbN&F>gGlK(+PJ6YUTu_-SK9vk5)Eoo%o>XBcLZ&{dd%DJH=N{cExx zF0!WW#|u+bHN;Bq41$s8&^my=Y|>5u&Q-h9V9Qff%wL4=m5n5xK)TALMCgo2EoOzG zb$iMW9Z_>P*V|rWEbi7)2HLfcR146Cv5dALib^waM}A?GGx*t*kBc0C_@p?xMRX;2TVqpua9fWm2j|`gX(uQb c1ag|?8?k>?tKSV`y2QcI9?_o?aqKhy1JOQc=Kufz delta 20907 zcmY&fRali>6ID{WLqfW{ySp0>NK1Dk2)xpbbcb|zx3n}OozmT%{v7;n{;P9w_Vc{6 zC)doZT~GlTSq_P$EC&gN`R2`=cW;&vv0{*Zz`guvyB;ywA;ipl01T}CnKAo1!)_~N z>acOjP!{KUl9`jMsvD!18dxua$$PFBnOtWydFMWj@!Ys8HDPhZTO(9z;#YM*;t-lt z5^R}aoV0Uck__Asr^tzkLOYk1n+WnBA;0hMoI_R)I>VDWm1iEGfJ;tJ!Bvv(GS9nf zczTCQAcBG(?;er|1?bg$D02ajBgWGCo9q;kdZLl1z3@ z+4*|d9+)2yTZw+mr*p~I`h9QkRva@?8DOsp9UuGhd^#uC=NiNoYZz-HAveR$v|IAX zUyXf%^L;93(d{pq793+-L|yVkTVCHX))`_^sY7!n&#HX)6RzW3#>X#Hi31hDoBvZ( zEeymD7?eLRs@kz}P?~Rj^9KGSbewM=Ztc-KQ%m3|YpJ2y_7{+E?^I!4K%0!+IXIHS zgH_7MaFdW$w%L(VaxqNjGdL5evmZ01nBMvPmi&z$YT`TZi8F5vHH^hl{I9}}MkkT& z*Vq~!5Q=1QD3yxqV`4ZnICT{|9pU_UmKwYmvC8^YPR|d=|#5Bx?FWN^8N z)UUUD8?NXghncnYEV{M~%%wOGW!}VLJ9E7)j#G5z1%!yU&dt_N-T&q|)UG7o%KqXh z%dNSk1XW!(@zORurhI*7`gG(R07`TeWHb1rf*r7pF8T$(HbN`$1h2+Rs}s>U7PeU_ zHC`)I+icsKe#lQbEPLdgrI#($(0Qk-N@8D&;-3TGuBPtqAI*NW8;BIxdTI)1#Pm>_ z(+2^5Lm z@v4qWtXOIkA>)jF{kqdG(J^N+oL29j&MdIJMjl5*_lLeC5j%LG37#7)dIhfV#9mW* z!#G5NNi&tgpu$C{!x%avFIp8jvZym$S1WTO@S#7p$19OQQXwgfJOLw`QivY0Xt0La zobeL&IO`n<9Tt2WD!&Z!vA?nuj@SphYvQ=L5w6if#Cd7Qai9U6@{0;yJBh>3%39yU zGh5n@n3Y-tMz|cB{n389Kve&AY(0Uf-Z3k4$5@)4zTDSKqDg2G9Z)tq(2XM+o~H*o zc(Ka_D$5iCraP z!AL@F_;IQNM}s4qNkqhpie6@29c}O;@0|x@YD!)8S0quIAXc)xn1+n6qkmx3(%XZ&{fH*gl(j+R{l{Z19MT?6Z?EW8R{#(rX`ouF$IJGVITE zSq|*8!)~?j`mzzW{O8;pq9xD95My}aWZ!=AFDvD`Q1urEw=K7M81deWS*yFYCCGy- z0*)mPq+O|IdrGU`b8bNR1J_w>=!rNMTw4iwhXF<2DYhWZ#+);bel%tWpuKqT$%7z3 z712~uI#-g6&j|AE& z$WlL?#x+h_WH=R{Qtk+ZXUQIRU&E?mu*%d4HODjz+V>1bQ z82<@fQRS>ZO|Es)#_J5Cnm;DKNgrxr!Nsvs`%NP0%`R2U4;VAQ%f}sxi0%(_GiLrv zhvlzbHXMru3u86?*0{dBc1c;$di$zbIWKw`pZB3vU@eYoY635?qY^kwBx=n7b&Xi3 zvd^?RUA0ujJqIzINnmv7I=eLESR#2O6;P)qXD-X+g_#;*kI(z54PTWaEMhNb~T)q5L@6pTqiYlp^4R$R8Xd)lICk zw)DZz{;8X$xN)g1z`YT!Wab8z+3P9r6_m5;Ao*0ZPZPq1=x0o&7J4A(8%bEO3AjHP zXt1Gqe)O%#LPj4EKlAg)7kPqOBS4bf<#fJK=U}`Q@O6WvSE%`{+Ea%gL8st1oCUWl z+hCJ64XA&I650nV4wj zHI|GYF=aSyj*p>gFC+C5mZ2&7KM(mN&S$E6nm`-(BHCaGB&4O_!=GTR%e_0>L6L8% zt%sdgQ(uuzZk@;87KvNCu!bh6Jlr*pW(c1 zZM#8;or06=jr7lpAgzoV@rJvHytzY_D}yW05HDZ|KO450xvstQOX0bsRVWx+S1z0Kd+}6@ zT;2PECjAdF%s(;K`BW6v19#$@^qYJQT2!{u4rs1nkDaMCtwgBVMDc%YsR@}A{|YZsP-R)bitay(x9HL;5wCqwbR-E*#qYWeqa&4`1n zd9?xLa+Nt4PBJ^Vi#cklon(x!c~|;g7Z&$FL^R%H5TMjTi~*gqC{?H<>ms1&ttL_C z*Q#OKjeTiNG9L^L1=_;EuFNw?m1r-Y&6f$gN4EcQD<8t4kD4m?jxzXOMqiPV1g^(I z^f5OxXm;6i^n>X7b@ltJf{B=LVz1y&Q{`td1^n2 z+ZUh?XGPPU!Alq1tqh~@@n3L*tv5yqy%dJ>0@X{zXRKEUqEJmp)J3}5d`7pZ1!Qj|!2anKMty0@%Ebt9(4a;jFWQIvF|3_$#je zfiTb=q?&7m^M2!M2m9*kA{pzrR5Lb4vyp%b^LHxvA#&v5ZVEVW*ifPXp6u0cAp!MS z^bo6q!zJu-_%j$H)P2fk0qjn-zcHYD%8SN`8-W89-g;bhTFf+eWeyb-R5y&}mZt8q z_363Az#{(Mn&DP1-TVpv+4eM5v-%5uFUtYKjE)uGl9#u zm(pBpZcMnex}b)H-32@eXMgn~QjB(M+kQ_v736+i4|og1!4 zTdYC(9Bl>Sqz;Qffv6#}0k9nVY6=!qm~g?an1yPi@B9^QVL03Y6>pT4T1p516$;Z~ zkyssG{O#y?aglc_$U9K0vg(ZPl%WntgvaRp?OO}hsN(w4)i4QY6^Hh(ZVm zNi+mn1Q6ito|K!5TFMT!NjRy({eAM(n5$S@43^5p*y=8T1&}!pRm!1ur;=HRl`xHh z4Fu)C{imDVpNjct$Yv{9Vp6k2F1*~-A+XxMPmX>P zQP#x~z?7bmIjkpgzFe^qSMhbU@s7=L@SuV+?P{ORy0RlbT_co~b9;fsc#Cqq+X?<{ z7cE@o&K<%mRp#Q4=$aP%G)0gs+@qWku}*2EjII&s*2s?y)Q;OA^pY*%%O`tidLT%6(E!dF0V_Pn}Su{Nxir4XE2Cb#6=|bFNL&t{5_eZlAQg%k>f*SPy6)MCQ9rpTWv`8jhY0esoBGgw!;sZSTxK4J&Mt>H9zOSVX;!Eh|Cj4xN zrqhA4>~ZAaAeos8z_GTfGCF0btkmA5@F;E^A6|}{#xaIS#kK@iY=jI65dd(#>xz>= zA5cL@lgUqW0;lEB(I=IO-K4F6>c zeUzE>mly>|>g1`i&3thl0`iBID+}qR)44x5`Z2rf3K`F{n$2{lV*FRfblg(o9F*A| zkgfGzEZFybDiDolpe;rOReGaf)bB#?ARSkmTQ|J!!;+Z{QbVlEZt@ahw#iIMw5uy= z42LJ^)1h#ftr9Cp*tog}o1CrUD-^ip0cxeqnk#nkYo5GX%W2wjv47DTthQjxK5+b1 zZ*7C$jB-Tw4xV`!Z@g-;Z2P$Np!?)*CmZ93+>LE09~tz;#kjs^d@7FoXmXBsWPZYU zKwdp0p8~=U&cDpSvOX}I> z(alr)mMM%#YPzhhpzK;}<-@gZS2%z`5>lid-&CC!%eAAYW~AM7s=vtmv#ACK3}YB; z^VOY0(<#5OL*8A zeY5^?(jDM)2e)-)NCN|o1BhuqZx+IRe=HS|UHp`2ZYHt)*lCGPDE;)$#3X2PEdODb z_IVkWZk9Y;Y=6%s(1aBkO}^+SlBi7_P11brULObdw(PyXQ>Rcj^&sXurSiDGUM;|r z%w7(XE608^YwAJGk!@gwL=m*^)UY}ZDAEANN_e0TEN$7Gc`OzD5R5>Od4oe7Cm+Y) zH_YMbu;SVI&J(+vLscN9Qd(cIQRgldvvNAvv-6=c=kejM3t%Ie{a4}`JMekcuUYpJ zlB7xhSK)k`6^X_O*BSn4^pFh~-G(brRxvxQ0 zO_M3E-yABo)j#v!i(}5iagc_Oy;n6Nq%vEt#@)0~F(k`CL|Twc0z4mjF2|KyJV3&h z=uLyZYfjOUk1t)~d40~Y!nRc9%yLW@MJ{_}jQlTW%ZEVyr5KNg(l+&HaTlzsyz0JD z$)p|rpmiehw{Vc-lE8s+3(n?E4y+2Rwt2!>mt16O2LhLU9VW)G>tccTz3(`}Py<8O z{B#?ys1ViwYD}y61-j8_cwZ}*qkX?FjT7Ng9 zNVK8RL&ScTyM);D3nIHYVB#0Lq-*?utHfh>u9VzSA9-N~A0T5qz@W=?Ikd2}#?+mI z|1a6N)y;+4d#&e5lyKG8n*BASqX4VIS<=yYVqk-zoV z%FGwpLxs_D+dId*;^#_l{ln+6b>gWk$LB)6EdX%oG$pJ`ATrQ;)S8n(y$~50nBFwz&Fn9F+?o9GeJ51tcNPj`y8ZLr^SB=c zurio zucy`ag@s{iqVL}<94l>>Yg6*JqgG1RcUP5LEenq=2c*vzTlZI7p2)>-%OSm^g)D1x zm*%j7W%1>l;;P)6xU-AIecH#6&?f7a7Wu^yoba?_A(Mo9*bKOUFjx&I_+?smxXI{z zO-{mF(|Qx#n#F`>$H)W-dpYHzeLA#dRxvW@tp_AZsJdy)h^x%nAI z7p#k}o-OBfuNj*cMk%g>oRU9)mWcdcKT%T~hb)0zZWc6X2cmVss=?nk`<p_@Q!`$al`fNk~hy6wKB_`~y!J;rA>KRt>tT7o8N2xoO*Q*yPJY*qa+7Hub(8&TPF4nUt6hHZkm^f${ z>YrXMrWA)Ukq)%zEnGfFvyoy$`U}?E?$|#koD6>x6VF|qd*4dJ`ljJ4rdZgys$TXA za8RFj1gr}V>WP_QM$)mpG`4Fg!7_%+f@bH|56M@Z;oS5absJ*`clRW}v_zVQIDX-n zZWGg!f=3<9pUM-|U;;FVs02%eGHdTQ!qU-~wvEux{wrR@d}t~rzdB5l{exh6{Qc=+ zwk%8AoZ@1yeszdU=_8J)L(Bs*1qcL`vf{Q0r{Zon>{?ZE%{BZq6>++BW2MxQ=yWHo zPI9{eE#G6=#HlgdD^c@%JW0db8^5j;yjvup+mUM~ELxChtVRqZBP zh%)=gEu=aL8h~A^-Nx6Wp`Yv6X9K>_1&^teY$Eh!&Fb<@IJBHl(SCig!(^+R*|MFc zD;aIEw0>gQmCpQryxqJ_S;OIZPb#4?ABWF`nMv|EQ&}N+R=WE*)WiF(q=>W(_T8B_ zPIR*C+q0$Ut2dT9U;mx?w<6d{%E)8{YApKLynJ3R+<(WxU-ZlG7>%6u)D%T}JjwLE z$2UDLmTiWge|!&=ywZ92aWyO`QEriZKF$=kADm>!Gl+yWRZZ3_Boc5ZT6?*;^6RD4 z53+0GHZ4??r0oPTX1Pqtg)@JquYpgnv~@5OfNNcp-Th|yo}Sf_Erv9wp}KGsQ1OEf z!Z!GXpk$%zOQQRXIL-!{p02ihrp8d&twu)pCOI(gWl+IO!?w^Bh&FXMXHGS+U$ zwir1$8T%O3JU}^b|CvSDHhUWqnhuxbCH0JavUrea4si7(5j?nxt<`6WYck2uPnBf) zcj9&avfyi6Xc!Sx?+9SS4xJL46Hw349kA2Fo)hSciv;QO2JsciTg?iDnOij)bfsxu zUqW(tqAgMa#vT_c0cX3p zfT&OPKcJp~w??AYq54Q_#luJOO!`dm#Qvzd5DN?bfQA#p!lk)QI;H+1bhOl`7Q7m1 zmPyI`FB|o56N^5k;7Z+5uQQ{6^UL?T?kl7X>WPDIjDIwZ5*e$ zvY+XrTuog+KVeLPFKAJBZC>KoS*H`Ibd%4$@Xg>mWL}sV;W8{tJ$n;Y4TbR%<0543 zM|HbsGk+uCba%5rut1$kei1DG0HD?up9Axq9#|ySO$=&cIM>JN#lf;7bSK zZ8`r(QwBFicOobtE%;|vc1r1(_O>t9a(>LEf+ri1(HDHFkAbTgDAT0u@$n?7V$xtmIVBD9~=Uo4Nz!A&f zHIodg_@f*`95(1|6V0S8`)D6aKP`6XbM;UDx@@jZbO^W?WM~8)X1yc=5EU39rK9_f zlRu+||A2z>h(>6Chas)pN)IPJl3LniL=dbo<)X=QL5%JDU&;GWhvC~di|VV5=mdkJ zBh!J24}Wh(#bwOTsXo3Y7;0Y?GHm>p{?<$v4F??5UUu;{?TtK&%sV3RtROGw z7es2<4>00@&=OnZyk-z6jM|mEYaB2O@1viE#v8eT|e34O%o(IbKW zC5=rzk&0f8gRloR@g|covmTLB7ios&oZ9NXSDO3gHhW2Ip72_;!TDLiu2pT;1)_bR zY|}G&`Z)*PKy0uyHeEqE>+lb9DkpOQ!@Jh^G&CBnK1C@g<0%^FBuuyGeA#>?bIF(< zcL=WjrYp?EBJ>&Hau))%K}^$b(k=Uuw=C+jUbON0M5pA`imYE-5$OeoYec@ELcMDdilK+&t3{k6iBA^=>&WZ5JU2 zWtYjD#S3Bm&VXfm{qUOVm63I8OOg4F{n6L90AVQ6zK@}FvVL{R?f_*(z-P=rpSnKP zettal^oM6T@I~7eFww302v@wXl!ntg3o?TN8>R1S%lQy7D4IXQYJEUO_`IzoBnhXv zQ5sw0=xr|6@W_AV(qM7$<#Rtr=wW#LD`8=t)}9uLJlzwvk5%-JM4b_pLeB{Yj|he= z1GXUP?Uts8G`Ti|07mLhxHF`??qj~Y#ml8Gt^mK0X7kbCirKcy_~@RPcVd{0RMCe^ zW&Kv=g836G)lp>vNb;R)kD-U(^4+lwoDi;wv^-(KunvgXhZ`SYj1JPADO;~3N__ZM z*=LZH=EI$TkkYk5J2kXAyU2l1^@xlNOW*yvLhOxx5K#%{3B|FKKnW(#>-Rc}p$6dh zs}vto1(hz=zDj)lFH1O7VXVD4_nI~$D<~~vGUyCnsQ$fx%%#qkoN-$7cCw(tYWIW1 zy=5h{v82Wo2%lWeI!&ogj~==8^KW}k3M3UIe)TlpER;Mz6{gkA*zsHyx(KgrEvll5 z>|pp-7@WuZ7P6&3%QH*>U8eG?PM(=8pZPZA@QrEfU0s=#Duer7loMV?o5|YxxDyt~ ze0_e=w>sO%Y7>N)Oh?iXzVEd@qbReBkA^PvQ$STc{HuIyvTF@;u7q~-JhEKFe+F8d zmuXnHmTsVjX%0Aok+esuZ&Z*z@RRPw&yNYFDy6-AUw{Q*3OruciWac|k*2ZK^@C*Z zeU)E;mebKwP->kFKzzHHwdb|E{CJ}zw8}neZMQA-^q91f^*a-$dg|wP3UZ0&hGV|u zYZ8}OF&<`Yyfi3krg)a!EA-UUx@%!a(0uW=uTM=B&5LFFA8Tt7Wj8VZ&%yy8dO zYT)NatY!G)cM}d(xnOb$RJ2C=gKoOmqB2Of3nSbAfaE7ZK3f$pB->x7#9B1?-0YFk zuvU7*T(S#DN}u=}aeIVT(;n3c(6F=LmK$RAzE!S_?4K4q(x}wm3M`Z*EVAj=MZf3rFLF@`b^3{C*CP zx9?S{R7Aa)j8*eXh%;4%`{gY`@c+>EzM76P6|`&x2{hh^P1<-)cBFTmmhrzkMrxkJ zcT3Lm@!@gz{?sYW{=9ITP)^|03Y};gd3nkY-%|ZbhfHHq3 zJJ_X#fHK>?Q501LY?Bb2wOVQg!xK@R^eGyltaHHa8|K!zDtBI(^S;sMC2E1BzJzE# zX4DzEVihI)KVCyduUl%-CSEFaxQOSkIDI=@l*)z(b3tF&Ap0>Y&AA+bqUZT-%WxQO z+nT_Q0D*^2E^9F!T^;-;jD)ge^}5nbI-2NNCeSf(ke1by^o5@lvGpOuf=kcn+YE}% zZZhOld)26LDS-xeiDX@+8cyxscu&PXxYciD@%$B2|AOh=uc{zFR^-Wt#j~aL+HLl} zB8Ac4sZblwlOyzD3A$kORToj;$t4?zd2P>Qj?`vHDTq9!_LsBNQfoT>SH}SCdNn7C zS!Jh}LWUNuQ&x?mId)A@R$^R~2U$3G zPJJt3o$PkHsP0&A<)f0BpS=^WymB@Iw+yJf-bX2KH=Q#zJ-*Mp>xD9z4q9f=8urxl z>DY4I*2G&qPf8IR*A{Q5tmFgIcN#`62t6#H?GsLlSsvw)zKvSV&h-(|utYy%Jl&rz z$}EDK=43E_85bviMg0}F-W`xq-fJFY-G!)S)yO+#V_T-l_VOq0f5lRVuNdTnRGi#L zjDuF5U=hLMPvufpzIfDFPPm&kpYY>IuaVG={!nW_)_Bouo)jqfRh2ycn^1gwz(3ou zW`3*D9WF5=UNl%&aC$Fx&g&)Q-8WAri}a8hL+8I>DE z*ZdG&Gu=&5eX!+XzFy;?`%MFuy%uXG{XZo))cj7Tn4L&RLJ{rkwwRobC1 zWXA;@JdG|FVAVG)4PfCivG#0lldR5mZfD_B@t|g_I?8dN+0R-=8uXRFFU9zAMCaV| zj=}%HK8WD?V?645f$p3C^Lf%PD>{9C?Ps{4)(WZ( z*}Ye|XB70eo>6+GoynwnY4XOjzGW0=`uKX*O9cB+fNVNQ#X-sHh5>`og#!h|flCRq zQcXR}_*Xq{JZ+XCTkH@dp^1RkVSA2JR8#e;pAx>v zbMTjGvG513R3DD54_h1k0KU<+`h$D^f&3f2_6i-m`~XH+svPv}lyN5X!}>vh+ z5WPR;+Pa`J;dp`#SJY9LD2XrN=rW^a@+x4@mxEu9zV(s0ap@jHyjOXzrNT->=d4}% z{KK1fAV&baeady_`=!rHEn#&b)JtbmaIq$`q`b7?+?W2j3&8i}`h6d5r4&G^oYXL; z8BfZopTS{yX!V{mx@IwY%GF7zGy7;J_Y@CmtwYkd*z&W;`*+`12Ubl zW$`juBy-YLlD4-g3(8wfcpR^Bhx_-Z_5FWaKBk&oD}<0tuFdbrQ7KU4+P%tjP^SBB z##;Tj!j0*MmanV_qXq5}y88@@xF)lwwWT<(G-lup1}cX!4=g;XU;H!$-#|%crOVwk zytn(_uQo3wV#wd+V~I8Top{&KcU^GU8Aw8y_{jKLE-+wt@-0b^BJ}ts)p0DbgU!sW zHH^00sA0eUsCr^_u2HD9k1VIBgdIFw3b9-NY^3bLQtWLn;@o|x(|&IZ2a|UjQl8#a2T`_*|8${H+-0WM;`jjupPUD=hllmB*-Z& zv0CAa{&Z%>P$}m(*J!OYk^T*hHgFXn&_7x&Os2kSyJM`g+1e4>R6%@^Q*Aq(-y!!0 zMHvFTk+-t6z7$rd)jiVXQV53#%UKa8P&Jf``;UAfRURNU`b}>vm(ySOM{Z9KSLfrh zul9^Nb*2)TuAyb{P`^A$W#i6Sx?DVRUUh>4q2PAxjb-am`ocoRK5Y@wqJ?)a2-a)< z_OfJfxumF-@9KfW+uLqsd6|0qbFDZ>uZM;6e(Wmoes4|xH{$y7HVc1~TVNvG!^y{Z zv{AXih=^BOhL^S1{WcRr?xF#h?7{~l}n<2Mh^Pv3OySAM3;X7dhk7>=}g z{eCK;hp3>`=tpjp`vl}}1?$MYmzYeg3UsPG}o|0p;} zI&dMWM6KyCwlK|KVSh`@Xei28#qV^yyD^9c zOmSos=6f;Vh-8E5J6t#egi2iAF}*C+K7^lElHRU0%ViKf*Xa2e_my45DlW<4*!K!; zW0E#AQCQbzVhTMvFl=)SGu?2LAg$TRv;3j_;l>5HWPMr5Vb617Cm^q`l!prs|CsGImk746z?KEFqw zrBA*3R!LL>8SLU=1p0OXRS~M|OzB_G$=NvCna_;5jNtOkG6TX0{*x#!Ml?t(dU+1X z>FxUk1ZnXEn|@?l)}ryhZyDcA2k`x5-k)tz`6fvz>-Awr>W!`!Ts9H5S$r8_>W(fnq=!xws^ph5#zLvV+LqFhL0AvX0w_3b6+ z6l;kE?5i6M!#_ag@tt3!aYM_xlLy$lE|@rUvl51$NWRVfR-)iazh7h=8fB*FJ4yJT zVrW9UX|yJGz=|mZ?E=oi1zA;sCRtqb5qCf4P`COC&hTS?K3voXh?}g1WKHpn4ZCzs z@DBfnURue3NT%i@uI63aBnCWd|QW~hDd zK%fmLRx|sjUzWHCbtg?bY+s!Glk^mW!eM6}Xw{GppRY%<&GcMweVdUnIK(q0lLzlw25JO9(~eR$SFvuGA2I%?-`wr{RF zPu1{L%~%Eg2(;gyaWf;I7A-?h-n<**jY@c?B9o(C0_R<{m_6DrL|&gS-Zez4t4V@Kx?(><7qze>L045C>i@E2?hw)Rhi6Ze+4W{VRS}W z#VYUkv2(Gt9R{VyRkOqXYm^;}3mx`2F1fJ%K@NLWshh;70CkOOw@hb4gQoRvh5pn* z$qMIj`M@e;Cfy42G=3&t#bj06(Y2TULwC|!)mqZi*fPg2Y$ykg^llDS{W@$vlMw^2 zxE;2Qf=X^7?ONArx}$Tny&f9JhCJsF@rH1n1S@l<_uxZ^p;MC}li?BE!2NvL{ZFgE zRYO8PYIg%b;k7|5H?rmNm(NBBY-&bb$p2c$PqYR`CDuhw^f1+iB}VT92-Rq`$d(Di z@JY`Giq+lP-j)x!)|BIw{dkfnLZVZmZ&>nM=-0^n0ZvQiDvQIk25~E$Y*R}Xt6c9@F1@*;LqUtcm)D>1+MAd%A{Yop2uO7w-P$<3(FeT;XG z8ZJW5ZD$zm?%8NN%^26_)>)y?Iehg@8E4?nq(}ymU};m~WM{1id!?}mUQ-Iqjz3PG z-1S^1c4owD>T9NrZvw7bt22)=H1-uKQWZJH6D_UBO$W2@Xp%=I_e=(zo_b4^C*Tig z!Q#m$o|cl+x52?>r0U3C;wv~6(#v4Ygv;p0i){K2OP7^?{TCwiIlHv!*1NP|)1j3f zQ&8WojJI-|t-M2yfr&wPi?&jM+^($W#PkSoM)C-FNi*~&WPTQGPiY67 zS1Y49SlgyBzWOHbIXzG0DPnf)2Gs21H~o`$qOM!stwyJ1tuA-|t=)t86?0#)TP1Dy zv1mx)zMSQYRs^6Ddi7&&LqSd4;EoXo5^Ev$1sFKv150}qRnGyz2YzrjYQgaOM8{Qg z(iP*oiP`q)JR1Fv+)B3DW!`Te%7h-5>m1Ssu+U$x*n_1kLAEs=wz+t|5qme_It^zF zy?QLfD(85^z$VjpXLa{Q?+nPLf^;wWn90bsXxpBnX}YLCKk^F%_Xey8shzh^vi*T_ zKn}0jO*%#vCRROWI5+a1J5zE~LNj}Uf5MwrRb&fFwT7YpXb(dFVH|A~^#N~l$_uC` zXvc9#{e#A;&3O8~TW#d(Z;k8+t9O4X{A?M=j)+#A5I+7QAb9FB>Q=g0JKXH7UwZx{A6-w< z?Oh#nOdc@6RDa%sg}Fm#YS%RR)IkH#aCUm1xf4=Np`6r>whG#b3cS`tyV1x70?;Ty z^|ne383QBH){uOq;FuW>s^=Bm>>$Q$xwP^&T3p!>ai9;Sa|{~o7Q&rS*QSO-6*_?xBu?(QxpO(J9nG9)^Aa>-u`+*9 zWhqIXbeOuWRMK8g{Uaxms;D+ETjx2Uppf#RbFQPX#UP@P4$}l3ap~!@h1$2skD|fe zIIN0MtW35b${1?pUbkpMj*U0WC9XC3@d0)|oUf(Mh@*})XP#iO< z2c{HxfkAzf^pMjU!w7+YTouW`4r_o~X6~3HwkjC5dM$ZPq@s(Z%`-d=2pK*CO(mmc zMyNLuT1I$o^ea=Ng~@Gxp-$2D0peHqr4{xgER zeR17Lhk2uEZ}~MN39w<8Dpa?YC+AcQ%f;GFH7=&Am@DX2aE6DNN@3sGX`>%$jSvJ~ zl!18x9bro6ZSvUU0CGF@nKq~KVIl%+O1xd$&p7I=H+*nA+G78-i>!8Dwrstrje_E2 zN4V=RZp!wAG{S^Yakb*%E#&Z{%IZMD(M*+;Uo7kJdsMjUk20m^vApK`nstK8JNhM~ z6}AbUX{B@@DvMrJZ(5DWq|7&09~zdS1BHprugR}OcQinEd&hF3ws3Vjkw;XB%L;IB zEUc4#gbErMZ3=p&`-B!HNNi3QFtoSLZI5%v5w;$bjt1?YrIAgPwW?V9%vAo7lE-(ZhB1LP3s`SfQj>R=$}SA zlvT4|{8bbM<=phP8=y_W``wME2E&!HfhDiY^a~x=RBM&_)@j5K<2yrU40LTo+8d1)>cZWnPF_A#nglC^V5!o z^+)3izk(a?{HUU=5OgWULcXW5%>dW;Uu&YBapERv4Ux^}TnPi0t1ACmSS>D7e+*U%(aqH3a&O zqexC$#nVvv?hTsB?Vl;@|2(2lcE6r4okIX719`-gke4vISGe%~-}{nH|HWn1SW9R4 z?xw7$C5ad)?fr!1j4Fd=wlLsxKeN_iXpSQl+IvO94?aVj?;$n{kbA&54hKWKS^FeW zquq96wvj<2#ydl(7P)~bZF;+>X2pA$MiIe1jpiulev9eunM{t&kdOf{6#uSjiOc9p z()6ZA@7PMQ=BrEt1Ms!xXw?@^(Q%Z24Ia(4AbtsdVfCPM?ndD0RZR=W|>FXVo zvzGZOEa&mZxIXwU2bs0Qw`zOU#p%3R-tBN`46BF_9VE8KdatW7{C6xY(3AF}{wmT| zp#u_DKjXaWXQAr_!qk48it@SQ z{{3{CKsre95rD4aR%>&_7=ATU<*7W6b@?ox8h<(l3V8edhP1fH5M4p~Jvqmj_8|!) zHVF-3aEE$AR%2%TXEohz%?KGQ8vq?21A+B(VDSR?|gcoiWa%q zrJ+JD>L$=gR_=bM9%(XhLi5-Dp$E2}&=?55A#(HoU@%O3-%hl9tyQj4-q3UqCiozD z!c744G@_>s{czcj|D<>1yvu=p-R_8S{VJ)oa}j0zn0wxmdO`T4`%d{@mAKVn%*LH- zy+KFW%X{(PPOaLt7DrKS$DqSpP~sJW()<_gjwu^K@$VpQFaj{lk;9#mPzI>-P6e{? zwj32>7p_7v`leW1*C$*@>N8$w`EZzY2(OPQg|SS1x#;0>{e@x8+L3*cz~56NE`%fm5eu2IECZ$Z$w6!i=(u z3jJ0ui?k)vfE^s8%g<}fGpz)!yhPjTkftwvw=0WXiBUg!!}m_B3O zi?jquKtsTFl?gPMvqbk9U2CdeM*5grAxK>~jFwUQsELOo3i6&cg^gB#Ui-fe7_mZH zv(0F52p3WCMReRHQAjfMtnMF2^LeD_1h@Rq8C**1`61*6UEN|-Qtb(O!JpPnavK_W z4C*{wFbo)5JzQ2M%5%=vO3YgH%*_Bcl27H~ePXrmcA`pMUwe2d`At<>pExDg3pKO# z9$p;qUIGEG`6^G|7(Gxz^wF!Ex=LOe)Fh!#ugk?W$`B|}=KP;*y@k8FZAKZxxV`2i z5oj9Y1Ro^Sb5h!=3z;8Go|xR=Ow791v?bo2P$DHRIy|{$ZjM&2AWd zOxs#=o{!g?hzJ?H6oVgxU_2|lCWF+eWauw39+9mljNsa0t0<&1DNQcZXpi%zZ3|ZT8z% zouiK5d7ZOAw&(SEeV*s@{_OL-zTfZje7?^|$*24M@Z_^wkpZ{cL|;9G4lTwxN4dYt zYKVzx+kF!b)AEmSg+>_f97;25f|t$|L?z79z(+!Za`K}$*~xe~Z=DQry}6zDRK_Cy zqVkUT#^Hezt}SVpX4D&asQ1&C^=UL2~Bj`ztV_YUNP+_ z#e{~ry?CH(1)mBMr|s=3=DpVp+?6}sIQ$}t1&wR^&*R~MORj~EEq3hL&sk`A7sCzeW+wd!Wv|5cg$ zG7YVrN$?!oOV_rM(nn0iaohq*4VWt>gHjYA+B2RsJdlp{5sBG+p3$C}LQpKHC@O;= zdpV@)@31iDWLi_)C})P*%43Q9&ki;m(@5(*x^?D>#o0;MVs(Y3Q*KED27ka${R&1x zWJaDXoD3P;bHl92Qc_>OAh~VG5E^Kp^DgkQy2|uiyvjeLkjp+EB(#f9|jH~!T zO%W@OxUJ3UcL(hu7Y@SpEe&y}B=jEcsQF!F({CTijF>|$nYXi5Q5ULCMkhUOV&`<& zyz_F|t(Dsv;1IL#a4Y1di%bQQwVIC7*gR5XsKpxgo_(0bJd`L6y@hPcp?s^@Y_@1SF?&PQ*o*&oTrBSt6ce7jWBF^#zQjP0Y-Era#hbe2 z({}xISyC-E>tkLi@WC0Xm?;Bz{Y^_&)Ct1`smzUMdjr!OK5y$@bA=!CnYUf6aS=Va z_iA(|*ODjI_DGIA(Le}N-T_Bus(;#;FB!JFABmhX`5PhD{A25@{`;c=O} z5i>ehk(t7x##V2OhxMP$Wa%uf)f*au#3on4>sq#(h5*ZnEgKLDYFxJO6XtDMV}JgK zY=94BTjcC?+_Csa4|Z7(WQ@rUVh^5U%q|KK&(6A}(1&un9m0z^ zEISSxy;7PAts=KlmPbc@D*6f}^WYo=WNMsit6FCY_iG%nbZb2GI3SQ z1spP*mB<<~3D`7`DV=`gc$*k>Sy*(nNsmw%0Kba~pn3~WT_Ng;f5a6zUNNdP(=(Hk zcxxWPY-b}m!+pk=Rf@OZEh`dXaLQ3g^p4aw;+U&Qlk{|E&%-UOsd^2JaRL_pUbvbz zVI&;E$eL*<&b`JAOlH913AoW*oZ(VK>cYhZ|8AzPog<~P;1)^F%4`AWL3d!>arJ?x zP_n@bD`>p6e;VFo-|gIH+Er$avs9?XE?Vc72$+D!Y{cpn1q<^h8tws-uzEM| z5zIWLEVZK7W{hEa_!xuOg1)||5wY9=vyZc`j+n{^69 z(!`Se-Dh-hFMA%N;i07wVg0yVYbB0NBfOI0ujjG=qIX`TPm&$5tG^B67ENE=uLx&E zrNdcOJqi7sC1fdQFv6Mx2Pcca9mEv4^x;jWR_8F_t0j!(#hRpuXAV`5Ko{qoRuIrs z5G2-Qmb)CnPzPQ77MV>&OJw4~{0S|l9D8MtF1m`<2sNaU7FHKV5RkXms{(ehn0jEe z)@0xBxk&w70)f;>nIzm~S;8k6+t`Jj{f$WxJ^i)T)lXiF$$BDVgVDaXc5;?DYYOCX z>*5s!*8w+e;58B(B=`+f7HO0(h;L~Y;5ATgZR32wv36^L4cxMWD0GM6U*!i;lnz}G zuNWbIhXgiB2ml}`0svCnN`+rOkpgVgflg%*cc`^h_yE8!3f$kwn{QCTo$7pZm`*uC zQZ1^oa~Fiy#W9g;Pu&OrXy^a{+tzjwn5YK;LjAy3u7>&fT+t4N`q>;85Zu1uQ zxMG)_AiEi5+$GB&*ttv2WR%436A}<~=}bVtrFD8a=eY-I7jq5W6$Aiwer2$<73J6V ZJ&M#N${%llJA76firJ+mL~rLQ{tu!Ng+>4X diff --git a/spreadsheet/macrofree/alz_checklist.pt.xlsx b/spreadsheet/macrofree/alz_checklist.pt.xlsx index 0c0d90af695e4f56c9cda78c64785283715d338c..e65a5489d76a13e2eb49fd221974f4c4cd9d054f 100644 GIT binary patch delta 20318 zcmZU4Wmpwq*RCRpG}2unAPv&p-E6wMLAn`fX{Ea)HXEc%Qo6fay1S$gTYb;>o%j6W zx|nCrtXX-ld#!1Td+{Uw1+t>d3s}r&&z`-0W*dn875OLp(;rPNz93DwuT#XppjA5) zTA+UCZ-)K^42-}v5p7RuHcWhr9XZL=j)@zgxz+W9qPnQq5#i{RA#IPxG7njTgi8PQmxldv zN+*uJI7QJIdu9(X6KXE=hXSkq>$Gh%q9&7ACrB2%?mzTkZKzfb-EY&EF)zW3#0}T4 z{vRb(!o&Q0g$`BIs&b@wa@n(I@_Mk(aG%9S_TX1uytXv~YHjTnBrAd*5lWlf%qesF z$xl$c%-QRuv}|;1K6f|qa2U1lDm@EB=ff1j$X!@$c~HaFdoAb!LL>8_Y+Ffi?h(!I z;q58rj+a_I+&FGKsdM-eI3*yJO!nv_5%i0_3QcQLHwQtgRYyup2eWfCPiF61## zL>n~nrE-M^u->tg)WLcji%Ts1(rcDM$S$_4LhlT@e(Bfw4rX*Z!q#rrWBdeGErR=1 z=k^Rr_fUsIvULGVqQlsi&dWJNDYTiXIoI}?(f)R#V%(q+1d*@UyT_seo!~RdFs0Z@ zM-hK5ft}fGiA1X<8$vea3WsFnv_xfExxnAT9s~K*KzY6+`n4{<8K!fO!J5W9np2Os z#KHWIA9Ffu=%0AXI>wzbC=YRIPX0(tOF`Chwy3Hq?|-tWu8L+`z}WKY2n_tnD!g1G z49!3+E5;D+$M;|T9{TRi1((U|V3f?M+uScce*h7K!xf{ylFp~q4X&S?tg1~hH;7wj zL;;xEX$&nMH<|2t$yYC!Ni2R0lApc(I3W^pB@2%G0no-Zj@isTfg>!Ey3_I98fWvPg~zA zG2lIcp)|2u^T@DQu<c^mdM#)CdMhJ(Tb4pjl_H}X2mETkS}~l4LD0ZObfwss*+sR{ewL)pWD~D zD+7Hzgi(bf{j~&>{i^$bLqJ?m2|=05?rj1_m*2~wntBZ%_-w3Ta{39w0N-7iE4hh8 z$|7-grY3!^XX*Otnn(h7u5*MzcihJ}9a702AUK8f4`mZJPL}%_MON`Fo0c0qRmS5? z)!7G0W24XD4bt;>uw^NjK*0CEB9Z$+%olII@G$hD!*5rxPwEwfRW&oTV#?a5)E zbb}tSa^E?7Qj?ITu4O^DEY9U1J&K!J43v^BbsbiaC+jdna(Z7J4Zm zsqHzlA2XPtre5@+3~o0G-r|L|kQ|3aPGokNBGjTy=(d;-TJrowm$~OQCp4YRj7EsX zoIxWM!6TxYOC6OqhaZMF$ebvf4O-`1HAtrt_9zlExo=d?Y};*Xeuk;M7SjT^W8Y&I z9Hvss%c(`$0EX_s0VYc)-}I362HJ_=QH)nF%m!)$3i9!34_qg?GrEAlQ33xc+~lVm zUW)vv@mg%<=UfK5kR4yybtX_E!XJZ@hitOIx(qC=7bgK)1oS|R{9OTL1q67 zFq)Pj^_Vab`%Zy`%d%*+RfUyFEHTZ*Ri-Az_>{1mwE52orBU&{zRji2S*F2mEX`k( zL}us34~9!>S7mg+NifS)PP`&=zV~uQ?0FF`BiGLHwOi5QJ>guAzaDMH=MC1$B}qJZ zA`0MJe8B39Hw~i8Ae^Pu`42CqB84q9MHFLK0(tSG`6w%6nVnWCOboYS>8d-E=6Ri` zP@bCCk)WzXx_AC|n7S?gq{;yU_s1$ozuxDutGf~>aL~=-SPZP{Ic?tsvBJFY zI3soqPfF#NdO8-Y^`f(phY=kS6NMJJ?}>Z?IiOGeqx6^sOKyIqRHyN9UfJ_f4P zfoiy6Rf-|}H-*BB97;hc#rQkzpm%5PGaXbY3Q6-ZFms0`*zA3j-f&n#3upQO7u)*E zq~BEZD7Ao;{yb((l&hiOPb7^U%f^?^fs;g#lfVEi&Ma%Np+t|?F6TP%6aZ?0g zo7VBTRW`~ko;P%=i<($p2x0k4V768d;9;$Wp%!LsFI5lxnNPc{PBz zp!l#=-zo~&b#|sGzW&aHX$fSb_??dj*1uw2W9#*GyTC)^(?zObW}9$voDmIV% zep+!rc`bcQTBQY05lMd+`m*HIG<#CtWv^`-kZR6aqYL^el0t{O zM*ThB{AimMNuVb!|M@8V9lgT(mC`FB3n@%Q$;c~&AEsbuOcX06p%*~iM#)_ghC{V_ z=HTRqn3GgbI&Pd!N7-r8Zs%C0_;(*1?>yeK8U7>;MWp8HT(VkIc{s}*_RI6enCDdUb1gSc?rJyNt z^W=H0JHEn9hXUW`OhWhXxyq!}kKJ!daO$)AO2S=Y{zVPdK|!oDGNe&Yo_nTi!ooO% z_&spFNQtN(AeX(AptjeIq0m&J& zQupOn7g2qwVR=pK6({5*Zo5AxFFV%Eo5)2U`n%*@!RS|v#*leE$HIqx0?2y6x2Jd! z;7@HcHZP`Bb00uYgQobI1M&euI& z-0%aM*Te)Bw)2|WC>QbBA7_%8>^jqaBphk!ZF8=bHydcrf1D2}pFt6R0y*v<1pbixaH3rst*S$Ujr%z(V!fnZfK-e&%)AU2)uNcUE?t4|0VZ3bvuTdB+`e zW^3TVSPvb%sn$Im11dt76u%Pw(csSliUhFGQMPu@o# zx4ZEGPRy#KnIwxzmK(|Cxbn*FnQ$?62r4}2_F3=U(RV-JS0%p!DoUcjoet#IShOX{WlvY z#&al)SA#ov`o#`q^yk9G10NPY_acVSoc$WX#&Z6O(^n_v8-$`?O3k|V!#l9gvZ10Y z;hqP;RMUJUEl|(`e0yEHOVy1Eta=OXdQt(#%%+II1lDKYA6^Z$Ar8|3gYs}{NReIH zi3^|)`D+NpvqhwJnF{n&9VUY|RA>X5+6;&o$*p-&@BB5yDVvLqBuCj7HlL0K`~ldb z3YA-Uxu#8ZM$p#^hA94&cvQi*OOKya;Ku>A60iYqV5_l1y{53{=qiIBN1NQ{!G%V_ zb}R`dApxBH82Hc7TgmyyiBcp@z;UR5%Cb65o~FSKgfdEP(Xxrac!LmX=;3qNa#J~* z@JK_XQE=CR4?C@ZMQqV;w8UuJaTKBP7Va;a1{}J4@wtw$SRLD;#fy6w^eZZqlQ7(ov>5Cy>xBkkL$YlzVhLVV zcd6TSa4NtbQKnxnKnwu1kexRKp6hq5a*e|#d3%7}QJ~rZJ~0BzNE1Z@YHx1MYPo0z zndgiZ>S65cescaC zCF-3gn${Fr+;-63#3e7Dx`IEmlMbz!VcHFybNb9x_gcr9U`_<|5ERAQ!d=};oqK;{ zEdl%Gl~O&l{(h*)7~0g1o?E8`v`sseRDDv0B)>}7_p`&9$|Wh4e{3$gdSA44kv;nP zeJT5TUpw8Zj4&7T!M8%np%!m<0iydK-19luzrvHUI30@cN8GN+9+epvn)bkF)wF;! zv3>&{Ri)D?)~x!`8+~@S)BuZtXYkb9>?`<<(HH(*3Wpx6ry-D6DgO6N}#nPc5ym_eOkrW-`WnOlcqy6GJR2HaoX~ z^>tr&h1ee$myM!-5leqV*_$0&igX0L(Z{nHY*C!ias(v{G$!7i$?Zc-vb6Sx8_YdP zu_TSd%D_$c0j#7ir~r9eHSr+DnA&}NVtLb-?M5f17A}t_i^qpQNq9P6S`p_}cYL1# z&jq7)>eqHhQjD)gt?PXKS2D`ezN}8va~^;&RgJ>mz{dN8;=-K{xU;iHgFh|jp3x1nvZ7(>kH>Dg$~GuVXU68TLsD&4bKR_X>6YH{Bs!4}Q! z+mSPZ;7>r(CX;58&Z1oxLqas29f=xJsFpra7<+qzHD0sAE?}fY9r)C|u5|n6C@xcM zvz~k_jQb_?yBx@*&!OK%`O3G?C8oJCDki;DZ|i-%eUvE<_);ecI_3?a^&9U39+0Fy zQ(-D%EyvMaSx0TIlXeTGqFGGD#4u)rJNd$TUDZAZ1aYx`e$?CX@{uglZ+lbtqh85$ zd_6~(9IGsH$hQn6Me@0rgf!*Wv&P}w-d?48I?{dI=m2A0$glz`!5k$vi&@c}o%3PA zLvqH;+x5`%Gw$|xg*8i%SqAMR_<0t?VHlzSYQbva>Q@_FXr;XTQ{ z{+R27ywa>=C65o;q4y?XZFKHer?q3b2LVv^Q#b!4quYF~>}g#fK2hV)^T>#r?cSP2 zv~+JknZ(e^G}7HGR&6voLy@5+cIpB^VYA0_Fx1@I5NZ)WGQlQB$YzBw+h|4-XTbw82UEQM#aiqU?n-$li@E0^&$PMP&FgB)xoIsGOH z#Q@)OO_u#M(cgak{DV~+%~$I*9HJUMee|T6oQNN zFy`{TOzgPiuzVusPr@O24K~DVQ{-0NTZ8>~##9CgIJYcwQqy#<=*knt-Jxq<*&Dk> z)7Q{be|eDtUx?;%t~*ULEBn*gF>uVNc+C<`IIy>jG3iJU)LvAH~y7JbJxV=ag! zSGJ6)IvpKz@b@r7w&%?6C)-9>>SmXUuz>A#MaKM}y3BOuY(s&5Fu{GAf5fqNCR{S> z71+gD@5I2}F98~DC`!xP{7fsMc~=LP0bvRr`zCvkaJfJ_t$fhit?kLFF;WA}`4a~J zHXAP6S(!Fd98!96&Iah=&4DOLHLR1*m1%;l`H&h` z!PIw+3Xv~>1mpmWq%w3g>^?Ph&7lGy1tbY*qT#BiGN*cTYwY`O%6hIg29?amt>U@* zyZF!;roJi$vOIWzwwg-anGFIVkLA1>+Zr4I&-9IByh~sedBWkJsee%Ea9pT}$GM`Y@I0)V z`^DrqfTLy(ebtXtMPLsrW=LfZA*8COaBP)R5%f%cX%4STCI)rVzteAqm54zbeyzP_~8iu`#Vuf60_eDq5>5O~i zdna;6IAw9mALcnjUh(5W9)qFC0AN(b#d3D+48MHl7P4Oj$D^94qa+zy9>p0Jm#Hjz z?cDS7*2k&Q+=|ZXJEZuF<3^>Cfd`o}d0Kq8`?d>QMgA5Z9eT(U|Asc4dpPI1;7)%g zMf@RI=Y}pR5dMtPm}+xDAze_PXtA5z;cuX@55wMzuC@w(t=qY0TmkT6zt7os96G3+ zvnfldzE6)pEjXp?F|OfDAn#IsA14s$U!y6E6)x_S92RO1x}`4Ilq!_{73NBFs;#vi zahszN#x156PUgYT(jI9crmD6I+PPREY?VYWGKSbG)8HMh-NoW}CAbc9s~TN5oU+sU zTGRU$!p4Z}N-ADVU;_q0btlGN8FT*G2o9W8FKZU5KrsqI=`(uwu5%QRJ*Md1aXRSc zcUjt-*PQFhABz~ULTT;^C`7aVI~Z}p z-8&bZNmbn{yZ#%i7XP!Yt`v*41H3dZFbh74t)DIG5@D(1mo-cMx+PWPvm)0_Mz3r3{7Xoc&yO06&;GXVQ(yMB#?~9^&GL#zaa6ILrR3|wfvtG zz+b+s`}(#wE5MJ%V*FNr{qB|aqrSsovC3om4OL<1EQ^jM$-c#b$EeV({f6aLRWYdw zF^6SKQG}nQ*xd%T>%}I1lYRS<>&x_YOkP~AhN`1NIl6X=)>cI+Cc-(Gd0z)%XNjV6 zb*nL!l+rY;57N13`;<3gBJRPg5P-opUj7I1D^5wJ!Kf&qGU+;h(ttQ=1MyRSJpMoi zM6hS>#!J7%8;Emm#?w{Yf4n2$8I(SzdC}7}BC#^gE-7#FMdmP8Wbea|Cl~ABMLtk)6Qx zCX$oy3ULUl{og*1Tw@CXqV@ESyeUpl99Z+s_OWW ztvnR%-S8eIMxAF=VOW!IF;cC&yk>QVv(c9_O2-z2qiisf&-}AqckK?Z&KPWm12yE; zuc%!h>Fqswe<|8LiAALHEBDAikzwM1x!%MAx|Z_ZnZmm8PTuQ~0XHiL)GQ=AFqG&< zGljKFnpsH-GnEA+C4AQ8&FInh!6Oc2h*r^W*+DlDqW?#MvfRL11^D@EJ(*M#@0Iq^ z&aWz(Bb}q=spOxx2THsS-g5@o$iOByvZbnj#?-8&16YaC%|o4=$U#U5nw}VK^y!XU&J;fg9jtWt_8V5r=q=H*Z(fquL|=49)a$Z0 zQ;+xp_%8^MCm-9Ma^eB84TxB9&{f@e_clp)bie=Es^8I74BNRj7mn_+6oC7-dB0Y( zsm6gAUZ&HyMgkOQ+5)X{ydD(FJPwO&Ys4=3sNRVV8TkX7%(c@i+*s_N^~(1D*+oR` z-lU~faJKZxE;-}@-=nM7Wyd-SP>*D)?PqB|yg9#$g2|h>#P0jj*nl%o=+GJK5)C}^ zmr=%MLc%BTG17t4Agg&5co^0BobdrY$M8m!@4etBCVEi3*-979xMCJNoDx;6LJpF| zLOzzsH2vXC0vUk--U|%mcrs|pKM+{o9&2|(tjPabsC4&{3ZqcvuAS0)%YBR7-?V}% z;Qelzh~_efAV}j2(i55yN+)t#&`?x4sE(J;LEyvt0KlhSH`DUI;ciR))PzeX`7hO@ zsR{@=GAVws@q7&b3<)7ko>{x!9zHsXqon_iqrz?K^>Es5!M3^)UfE7 zQ}govdVo!XYI$S^O&JBwQwsBZuL>(9h1HA-hLLgnm$5*j3NZvoaqB5dB-I^P-(kEw z>zQU~WxBrvu931z&_;_`Hm!V)2zzd{zc(VUQ_=m?(2+mdN zUcJC7$-inzLPokALS!JBfM^>lt%EFhqf(VGwCMU(iMW8%(acid`p)iLpv9YbP@-R- z|1oc_jb87{u4(4fqmXtqEm!7+p;$vp9} za>4?C3fNMR7F#{Buz=VIX<5jD&CEQiet*o0*%%%Jk(tpJnLl_e12);kg}<&#lrEJY z?$GQ%!#(D3osKuA?~1aiFQ_um32@NR2Tq94X& z_Agt%No>5aO?agv4!G%@dNQ4;Y_dgJ?DY~Mdi;CC^(BQK0u;>Cl%-O1K}f!48hw6g zqMehW73&1u#C7sifbaXaw-t^-G#h&Rh106`m)vq0cbh7P`$n_Z%fs; zaW$rdvtIe3IwYS8tN7qg-Y*2bE5{X!8pxhu&Yw{Vjw+8JRQ(11d->1U|BJMMtv#pW zytO9)DDRN%^Cj~Ba!LI`ygvHAAI;(6I%L%1L9AJ&qWvp*PL37wvds=p9zah1b!(N7 z{kif_X@l{DBuPUsIxe(0wI~iwBWaxus)=W^)Y9U(gpGRzh3sms#t2~&s3>YyuJD?B zU9`{(DCe|AY1Ry?k~%ZC+(ZcUMc3(Y9yJ_e8a-!*Mk_d%rl6Br-VjBMhFOe;MKQUD zQ!MDcCrvAi(SPP&@#h$5AunEbGC#1IDosXMwq?sQ_Mv6M}yiWA;1i)06W@jKj9 zR9)sNeWb?sxZGC!Joz)_lGqyBbY(US=9H4Fp{6QA*nEfva!mj5Psqy~OaFGi6oc{GEzGjz6ZvUW zKGYJf3;*NT_D^E*u+2Vk*Bv#yxp%7I-;%ksm13{DI4b*UnpILzLxagC&1OP_hL8p;I6%u_-VAc1+Yxaz+_1AZDCEm9 ze}JW5a6NhCJvepVTF&~G!IH@4cScp!){C#sJt-(O8=#x_ThabLPvkMB+&Y9TBjZX> z%qi`-Njf!!BggZ&R{(TT@NC&|g&BaVXjm{%YBj7k(BUwb#jnB`JJ7XniX276dR2=! z%(LwHKcLI)KCpX5aHSlI+j+jdheV$SR>@zJwCWr|uu>Ez)m_hj&u^GGaRC&VPKQOt^#HQ0R~7=#$q|4#gS~BqZ1>h z+-j|u2Im`9u}tusrr;2US!8#WS<|=bOe@%@Sz?7oWJYP(11=P2v*c8NKoM3z>8<45 zA)ldQk3 z?EYGaR`gZw%6Ro_wv`DKSl*{OP0h2H&%C=ry*rMsw*fr|ReQ|FV$694*O{Q@lcz+= zoPp*BTZJHK;Ze{MP#1>b&Wj8a68S<1csWj=86;20v>bU&p`mTujeK$UNv!+dAk%l7 ziW>#lf0qBwfN3<51j&rLhg2Y+4WHONB+gZQ@8G6V@>eQnoTc_`L)u;Mb)k#@?)A*` z{%|>C*6TY(59UAUyJ2xB1=pf)_Jp*>*pt$|$+3Q?5ZvL>Y{Zkqg$fYAc>&ebQ?rfR zg)#4>!eh`@K0WZ&GCFPOr}1-BPKP%7;pcvT&ionGe9neybKCG1EugjIylj@Fvf)MI zp-f8h6WbO5>NY6+@$w$%m>ylew)CQt$|`>00#+tTHp7f3M86J*0cZ6wlBpr4z6wkf z2o4Kc$pWxvYLa0d$eJr8QmTr0%D>(1UW=FF=pNs|KfnsZ5yC+fboVO3;P$q9puX>tBu0PsjHvlT52J5^UCsV>IbbTZHOxEEY@A ziz|6`hxBW-ocNm^Z4K?@nBn9d1Xq!E0;}Q~$MlS*qz!jc+OaQ)f)bYdk$b25lKiGc zv-5(7blD19-P?z|U+*4>yoN!AwqIngT^j{Vy4SELTz>553}b~a!Ux@tKo)95ungBX>O+_r* zDX0$>2wus&Nf+;*bR8Op1KvCMcn)MOY95fTt8?08^M5HW$65Zp-He7zjaO_G@A=Np z%@bFZpu>6L$2e?ZvEFSF_gZd=jt)XB!dS*oc-{?o~M9OE&8)bA?jJE zHrXE>^SQMHQL=+IX^=>LF})IGgZTBv@T_hYd&pVBb26mO+$|Mu&LuBP7>jFVmv=0- z0@3ufa5KY?96Ari_5`El8r+=*H56q~jZ7R%W-WeUJaeQ8^_Vx%Pm6^-b}4K|H(5G? zZ6e-}x220cC%F1aKMOp`sY2rtsF{s#eJu z$MA^LhCe|ho>n49FG(f+VAPPHn-$q8E$8TEkVNDSoPbcARx>5m zaehLP(RKzeV1kgtsv-cv3Ug<~p|~-~O;YmVR}>IdOS7*OSG5_6U_t$9WhdaSq%W;N zVz6$AzJ|;A%cg3R53af3AZ^XPTG~n2>D2RNl(-TjXb_1)Xr>~%;!?lw@D^##ApVvMG#cH0Lt`QKW=T)9gAcK!k1iePJ#)=6z%o1&u^v zZ)mW@#3awkt7A8?5*y0I`q2wEh`R-%&F%NQdsP$23tpl=73Qa8vc9AG&RQH!A50+L zV>F%2G)a--DSFEvXu&dX4C|;|0Qd@UcE@?cAb?}-BG{LpDg%eePq4`xIh&^trIVTauq`c=9$3vV zfOxQ6$jcksX3s{gus@vusGvJ-WMA|=6`phgYs7Q{1H-IAQzMl5p5Q)LOgyI^){Y0u zOuG{aTr$oT<~|)kCZ40!Pb!Bs*;>G_EB&~8FM5rvTc(%ra{YOHO4mHw*KWZ)O5!JI z+Z@OX=?i1a*@_kl>kkv)^ucL{KMQQ0!eJ|doDUZ6y!Ztj4NQP)>EaE;2^#w=D}A{k<8+HHIcD@kQ3B_%nq3z>?3 zG@=JB*!Fo+ZQWxj#W|0I1evFlV*s^kISaljefYc~zG^(9FRxUdd`3hNnexeJRyvD% z=o|R1ceBfYbk4DWpg@Dk=Qux66g@+sJ>rh32XE9@y#TJgP}*6)Rm9yzsqZ{KhI_Nm zr5Tz3&a3y)SZ55&nxPWy8$i(Jsq-`_UUs$#RqGVih;$}!)DVPCc8-^Tl|TiQQckiE z^<%T)+IJ4y-=*zlu;F-p$7^1~u0QKc=>i(qzP1aN|54cCct>rVWoco=+q`GqsrtR4 zyx#Qdsdtk8*nAR=QD|pD+60OYPzhTtvg6E{(T$k8x3Cf0MhxxJ9J_05#|*cxpV2V< zlh7ND{kK6`F;qhD5fL>HPj^UBT=efsq@v%|+-YJhaXH22>{wYq*%&89>^MrC`YN=W zuJz1$#1KumxZi8U3Zt`rT}p=?MlBu&x2e(G55q`Dfy#WbgoQHmIgniDZ;;p2%6FOD zrz5E=r^udPsht_%6BU4&GdRDjo}}JU35u!*HC}C_# zIfNUF-+loUhI9+R@aN_DX+E@X8(;Wfyj7N6bXk22kQF4pF4=WcbzO@+5&DXQ`K zoIW=^lSA>34ntYrP`sevXhl~Vr?Mpd(W@9rO*jWU(PM988n!)4>tb12cNPE8Q4P`# zFTV|{Y<4Ud^PU^$r+ijMRpJ?upu#9d`Ok*0u5q;!iw=wx%Lz>L2Pwhu%jQRw%hr^5 zpE7>)^1IUmcTG3ns^51zX;!QVwas%}Uxx(eGx%j|x$q$KPpiBJ^TQrXW{DXT0GV%7 zpVR|AyBkk(=$G(x+W6hYJ5|xt7Yl@Y98j#XzKNpHICF-9J+JfX!=6hI44G4m`@WOF z8(+eL8|0_iUQMd;JtcIu=ipSdve_<{LWxmyAB&ypNp+;6Q>B}s8H~2OLo1RjqBNsh zo;|FyD_CyYCms%bTcl1^y7#?)kRvO8!Ha()=S5f3GfoB^6OF|kGq zFMqDk*SOJC*eZze8$Vc@ZjC+O{UbZ?4}xz|rxl+(#uWep(ytS9xa?FH&8_>g9&)Qw- zd29`U+S=XE@JM-^i&5Mi_yiu9_GZ#t`EYH$m?VDt2VvN^O*mS3(8&#RYefHN0hp+u zmAhRmkrJaxv)iD6tiyBcj6P60>22k9B(||>^$bF){ zYuZw@GCW-iD>6P2m%2US=AMQ-ye*LG!$)5L-qsd;M-7o@?zG>cy492W!L*56O5Vpi z-2#CFlb{@X6c0dUGw^}uHkCG)C35MS_{uDSD^Dp)4@oHKIp>d#PyPp4Gu;UI1$2BZ zSw`o#Zo?QAP``m`1oG@-IP#id&f5W1+m~f~K>iHpAPS^>L*_H^%$i2d%|FxtoPv&G zhkNqgVZr4Q(ZS_jyI=Me5pSF#*e_D^U zeq_$;6}9IEm}a;_o_PqtUGE*YGF}La$BQ>cV3%o)IZGsA2k%m>WIfFW^G^IAn3^ipk9rh>9q#`1@;_v+Qe&R`h!9xuuznijNzq2!yhqu)PqqhuG%qilZ zeB8kPZ=f0x*y2ZB&DO~W>Uco5KDmrXwX^E3eVy^t=4C4ko?AXxe8vSBf_ma7(jAh| zU(&Lg7vp2~t(WJ&f%ZrZf%5pC<$PvKqCMSp#$FK$F@bp*8qooq4nA-;BnEPC|HJ>g z5TtbVew6$6q?2hj%R7T{sgfNHeV6wjzQ7Du1G>3p_Bn-|ml7xEKT6x4|3uVivuNaN zr&(5ne+%s~4jB#Uc>K3@4%bXCGY@fzVTq#V%-kZ>3k)=T1cS3pNXnk6vHaO9?%jS> zLmxQozWZ+AL^+j43g}%}lJm~!Xmj8+cwTH0_;=D(CMeR&iC1F6n!G&-Ln&rbL%TaD zF#n-`$=Jp0(egn{moU9MOSIdER9=425H~;sZllioXeB{_%S- z`xt&n*~hsv^F) zI5aF!s2+GNZ$kE!S;VD{WnRfyh(3ly+Rt>p%6r(jiD)KXgWvA=_F4CJ!Dwb?m8u#r zzoa=TB9gx3Ep2l!dM_p;jjcwTVunLWHKmwNPB;NG&#tahh;L?7TWt4{dhDzAQWV2&oBcZXjxG;tVr47883)-z5bBn^b$c&`(6k3|p4%ct5MdXv zxPK1#>Gb_4k#^xjM|Dt8@SlJMgo#cqUL${B5f+IJU0NTNF#9YPd=(kgCY_VDJJ475 zNcSe+2(bgMd#-b*$0b|aGv7$t%f_~pFrO~)Xzw6ZL-Vz5i-x9#9K{8`PgiwW9qNa6+WlAKbqU$q!jSw6Qbj&7h zrMNClydA$LQJdDBI(tae!XVaC>stuCbvFB4`E!-HaBpsI}h%Oc;vh3iKh@fUr-~AYMfcbM)l%e z5g9%7Yb-0aq6sB%Czz^D4u0^nZ~g>!0#_kNJw<6MkzD7_{$W|R}VC$UBbbW?WCU@}spR>@# zQWpYrHtRakL6g;^)cU)+U1RXoeDe*fUSNv#C=y$^^O4SE5g20u9RlOlvHD^B^G6g; zkoPO-c8?eDrHOy{QAhk;xa<`~e^%(}%MkFYCcK9N+Ye6;AFLmm9(j%u4TP^0V)md4~ZmqIUWck*ILpXj!oo>WcCaI~KngFHlkMpMGZAj47+d3N& zLo;Ocq-5E1r`hIH7CQ^!FA#jLjU8pn+ywy|-Rn>)_0`MOXSDH4JIzg#9)ha-+=YpX zNC#0H%g^u(o~P{SG2?17!yfCTRARoGr>)XJ?zvL^r+)L~A7Lxdn|g(hT)| zTd9FAOF3@Z#jsEjk2jTiJkU!te<`gokNLr>RhX?g7`?P6zVSxNsM3Ic^|!-vm=8uD zz%POQknCPsXp~1BId>VrCoZ~&HV9{>E6y`G;c;Cs_yXai)_Xn$sM5XIi%ylu5LgZ@ z`;b<1t4niU5sc9E3!3-enGaOl^n%Z)w43L%4~21bYYSvW%Xa(Uj#V^Mx>FdN;y@`* z?|JQ8V{_s7nnjZ~Lh}kUvI7(znT7XKj?NoF(QG#FAg+^Vn+s$>OG3ruY!JKkjco zYY4(BH)WX%?WbYC@VdzO9Ha&HEjs;nD#OMaksZ&H0dpcMLqqgH8+1x<@=DEV7&tz9 zx(WZknbqA$1Z;|oW0fr17)F)SHwLirDScP7jfu=3@F^m8-T8W`;0R(do6lVsVJEDk z!8T70wsoA$UZwj(bd|0{G~`}FI{;**75OyIs^oNK{pO!obV;&w*j^DAVLO;rm*3LHC~M$P7gJai6RtiwnmHXmu{&F6vrs6GZMiEPy`P1NkB zpLz>N*Ow=26A`F32HQXq@1nq^Cm-jCIb800S`4BJtUcBL68D!j9}l_7QU z1EG08zJWi38wyO09q4*keCe2`h-o_gp|q*}*5Y~ghMdUSu;)P4a%6O3X69Tka=JrMe=0-Mvc(EfSDQ7`KC-XGxuV%oiPHy4c60X8bs9Qr{;k zZOafNCN=*89b5i#f?c|KiaES4D#|mQID7xfD(PZat$@zuj4D< zccaD%QU`}I0wTqf@<&(i-+O^+5THo|)hrmO@5$_oE=5>2muMvcZ;755hTq-BeBhQb z)rzXKC}xw`zdp%e{{arnMR%@j7*wL~eJ}SzcEL%BB`$-(rnuW58n{DtJQ&^K(*q=M z3>*7oYrgvx)dLIk%cmw4Sp|p$d*!5mn?~o+5#!lcY@>?xOi3+)46+s9MZ^IaPD%(h zq9S%8UCOR%0ax^ej5tScdY6dsGh5)@d1e+F#CREcW=bzkEJ9(m4Cd zc1rPv%RmYVBHoPze>{gHm3}#`XZ)k9 z)x>%MZ=t8L7mcWH%X}4~(c3q33+@uZ8)#l&{-<5tC+>p1)L9-#JWhM33DM4dbe~Pi zP%C>ebWA3c>BlIPlRJfVDZt8Ad?la5wsKt=+k%&(~V)H_OEYwpiP zMTEi(2^(_Rtiom3%E1h$Y$K{YeGn)067iZ8%0d;g270@e9yTY&hPB?k%Qa%Uc1W~& z2QSGXfL%Uh38>e=QYgQl37E1ZbR2K6`}HkB|4Ju_^}w~uxx}^dU|fEtD@Aczyj*!&!p0iOw%WVvcJN`Jwd_lqG zYkI!e8!j_t1JeU5g9z>DG~i`?eI361rqfWN@&l@6t6}DnrKqgoXHI5Lx;$B0$Atf_ zv?jCW2GvLja(t0R+GHfd2#^X>+@+cQerXUU*YRzam^u^a+d=u|p28ii9Y5`>{!#YZ zugmRW)J}#d!jq^iQ@8O*NcN8g#z5SHJ5c!D<7vqvD<2Qv{EvyQFo`v|U^U-^>@Yxr z6a3^Mj0&QONQA7CfT08i!QMNln79)W0TV9WFlgj44QF523Cwuk0?y^Y&v=Mw6PV=eR$@A=k+2t;{JRa zQbgb=Jx>8oxILMV(nWCX5e+&!sd8jY4mF$ajzoXIcRy!R1-M5&x{`D8*Ji_hSE^XZ`F@wRVv8YRzQGdGVJp za&;gO0@zd~Po06Bjy7knNwIp?j7H7BHgn}mu+2F8WEMdWSw3+$j>BguE9qMrY1SiazSB=SN0+|2&?2@Q#xivtz#ST%8A-CS&LC$R4bpkU{;BA%71klxVLPeA5Yd- zcz=MTdQ(RUKgtz%aMHWufF;YOu`RUTtHx%Q(4pq@;d#4(U-6E(9BsYG%ZiUs9#%in zOfL^%RS5hb+vzApg)Vb=eJEeW5x(7!JJdF2#F#}^yaXNG{(^*c2K|~!;!dd>2(@ip zb+%<5MqPA?nUlf~PzA7{hyILjM-)YxtXsZ&PMbWi;IrVSZ%Gh`+iF^gO$rrXd1DUu z!0wI6e;-O6?|hzA(We<=Ev@^Y7p0o7k=fb)pjc%x7`^*x@$4uo22=Z5*(K8}IXb=l zd*j>&!*slrpMr26-CS_EL3Cevp_L7s62s*PZDDJO2{v&31FV{t@A<>M+x099yLJP& zFQ9?-=$#T3Pp{-B+VYW^bIYVUNASYmq3|Nh$d7TvqPT8PPj9Srhm%jnsH=({MxRc~ zn*WSwBFsISyMxx0eyGdu_4soe_pdX{skCAwGj!d+*s)LH{2j?v;|*JGho{$0;-mrt z!66NouJ4-rO6hWfO9XT1PISva_;*y=3OODgK0|7^nyJAkl-+si9 zqwV#tcU`@309nQL2F8KB>9@z6{*kywYeHxDOJ@~Thbv{?57I!;anP6wrToRT^j%rmRP&c6Y~hH;!leid)8x!8~S+C>|zpD+F7Wh zWZ}*26b`m(SwMk-vUUumA$~AjWNaXpj#*-Mi)-?+$~>}(PPdP?j4jHP@V|j0_yjFxEsH&G92Z;4Z|dZ=L&00a^tP(T?D^|zUgGyHnkQxjyP5*<0HH(<7+4PNHc_78 zO%by;b(=7Ci>2Dla+V>i%8slh9?QCvtG4Vs4;9qHqfz@a3@(+U9i%Qi6u$CN$`({$ zD5a9)KdPSIz$K2)J*P&n%NBMJ{c!3+fG75xUXd-5+rQOn1HnIBP3o5ukG#g}4fdOe zPGOl`I>~hmhD)F^lw)d|&WgYe14)fm1p3Xfza==HC>M19Df@k}8E%U4Hogc4TkdUR z8QO$UU%vuwedk|)9dH-v+aa}GhC`BLW^ErK6q&}YFC<%xFs@DuShvh%at{9s$CFQj zmj;E%^HFhAj4Xn)xq?fWomE8Y@w)3t;ot!We#33-zjKNYYsjY20fB@hOst(FNFq*1 zy2ji2!OkC|*a)z4Qyq%yKmFeayR2mST>O7Gs4yNr6Rw9MOZdo@Fs43*N7bQjv3*R zD5u5FBSx^@KUVw0(u~Z<5$XN^e&@A#ML2ps-?kC@;6L9Vdvz^#Y2}AcMg6~bv^0Zm zh>i_#2L9)Uz=tIbBL^j|`~Q}a)A&2-V#Hb+#^3hg!&+q8cqbQCU_Ne&p+!`-HPYh5 z7rQQpr%@*6$^VwGhf6ojN%+5BV=Ikeh>Prh3?e?Xv-))BC#?YgOD&vR&JIKH|4Vz0 z@;F;*X#Zt3F7ua9ih26~pKp88@$A?C-2A^x=Je;M|Kloe|K9t5dsM1Jno~XSe;T;r$gZY4jiX(^!;a8#qL4y23NYdR6pCn|)?o2Y7H}Bnd@44sP&1PQiCh?hR z&?2}vw}O;t(tK?`b*lrPMvTz@KSIojD!C9H2isoaMKG)XEG8}QDuR3F##`A@^V{~R zj|POZKt0pyHwoSBA)3I;k;?q^#2WGN5eOPx_v7rmCpGDIl!Va(SV0mL)9jX7JA!J@ z;4M9&yv<4hN;gMOx`Q`E!hyySmLY(_#^(SAFVzGLwmpXvs~}E*TBPVylR}FVNZ_-I z`f!L3B3?tBAVS79IpIQB1U)yx0$?nkWeyS4nFgsnTDY(g#$)Ov7MyRIKKF^=SO6Ne z0|E>NW{y5!32AMqwIhfWm}n9n%9|!zhhZh?rh6BnxT)_)*-}VFuyO6$vPq0A)dUQ- ztt+B}bTuc`|9=f!^Eeu#v6qBa9r?;GO46bmXnNG|YVS?0#<2OBbR*P1$l_T!5 zy#=97_~-0+-{*dx941qg3_#T??+`I~xk|;r_;Yp@Mm2;FTnfE@d-enO^s8~B<*EVq zVu`&(k$t!|U%tqvc}V0P)%((8Yn_*6N7Ly^WtOZ#)z|1&N_AN-+Wg&` z9^2Py7rc8XjTnCMoYAjJBDi%|*dL?Y`+aG~-X`CZD^tP4 zJ(z%ZC+eOsxkWV;Cz5OX+V%;6#x@XA;?e!UWOryB;6uI!Tw32}62Ct!b(QD8B3~J8 zR4$T@u1$`z?c?2{iaEExO~Zj*p|uXjuL^p`oHB38%Ol8#cC>828}hv*YTa-x`{Uh? zg`HeG0jV-fy7_)yuUGM#udIDN+`%8^!K3o?#>L9PCmRv_vhQ-=eAIT`p`{X35hIvDu10dJg0N1&)7~Q6sq|n6x3#I_DV=h zVbblHE9erw8De^pk26^Ikd77LJm7T<-@fE(X!fu*7ht3m*N50B5kchMp#{Ld+HmaOiHjK(HS1IKLAYgh!)LdmxW2wX8PKEoyCz I@qBpjKRHZMNdN!< delta 20208 zcmb5VWmuG7_XesUA|XgONOyNjOLuoSNJ~CSN_UrZch}I3bhmUP-FO)Eci#BFAI|wS z*EO@}*=yhHUTd#<8e$<^Vj$njNkYCteevSOn-{C_XpwK*V4gnImEk|o!A4Hw1GtKay#j`D6U zFd^(CC0X`^^U{k52q9=#$6pC1sDN(e%al_90e(1!=h|7~!ZZD%J0dug;xS)$+5a?u zitiKc`w|Jtgimcgc2iX+5t9`qY^0#^LA!^t7fgYYY8)D~*{0hqpFdlrjZ=|xiuh)F z%#ET^$5~Z8@>H0dVSHz*T&n$zgz>FdUIs@{-LCgd15w&bWi0v`JAys=dVY-IRtHPO z`TN-^#Q(sl>NP~$Yh*A|^0=0f*yS%?lxx0vf%zg@wjZtP@Qu9@U~6r&s8)GTt>u2n zN7P7zY&*NoJtjS#$zp}HpLQZT6dwv97h|UQ>PNuhQmYp=93q4s9-8n+5PQeZILAKW zj6R;eVy;;6rK8PX9Y4#RBYda%#S;mCdy4t3s#L$znAXn32=SlVe+i@akY}DihP+es z+gB(#RxZ8jCzYkSE$~rm^Y?fRMp;Dv7T;XS>13YPj?x(%M6l$m%rdNnMU}JMb(msI zC-|VT3_OI?$aJO|8DqNjY{KBfoX)8C_j`b|Tt)GNhC? z&dhXKl9BT)9BL$A9JL|KPDm%zXO(rKAXuvimPPp9x3jAnbHenn>naIUhl1|0o3oC- z`sB{Ldy=@(wN=Wz`9b|As7^HQSG<1PL5^6!5MDZzN)i*j)Z(l(%}C`r)CwNWzV9f6 zP$asAodCOf-WfnvDHE+sjN!Ng;pu_PgKLN_nuo&}8;bb)kH#^F`*J6Z+uF?)xR;@9&D=vMx0R3f@u){~R?TJtr?K zm`-UKz(Tm0IUTIyD(_=)7SvI#bSs?Jyt;L({nU8NmdyYtqE5#Pn&}Aa5PwRYg)>ZJ zTG%4tcY#_D#9$zFz!^F7a5vg_U*c5L{R?k4MO`vz(i6qApuaFMQ|dVU1GT1nu{%1N zQ94q_bdnZ`ntOUz((;Xn-<=092CaL&nwNPa2IOYF=VtsTvnph_oP5%F6JF{LU-q+F z=|VuO800(J?EU?g$!Q|;)2lPluwGpDkLo*(FEw*Pww(I7YO7X7!Bg??H1sIO1!>uK zazTzO!k*@p7DkX0cd?M8H%_tLzm|@Brv&=SAj@P@P!q*me+lzJ!u?>2@4>GxRG~CX z69oxzv#}~t&xcXszKwV>ZJuP)E)3y0mGlV!i$sb{;XY04GDjTU+<&=nz%K8H>ZbC+ z2&APl@hKX!{2i*`lTML@ z*a`FR$OPq{RLY3CoSyD!i{8^ndBv?XJl3 zx`X7$H3xjFbDE~e)UC~(YIq=M_xyvhIy4ds&GQ z^fCq9GosqIAVo0gq+>Qic?P%m&b08EOgG@rX{-aF49pv33~mat_*qw27LDMFIsD|Z z{WPq`r0w=VfoqdSQ+??ESAePvq2i+AVY4U#((yH!YXptleYyGA3;Hk*IT}IoldHUk zN%F^hY&q0`u1UMw9zm-2(8ZFhOW}dIw|ffDJd@av)Aj!zmRQ6)xSc*N8l1i{lYfnm z2VzL{G6KFSoqk*@xUd>8qB5mtYj;xuOG`!?M^6mTXkhnI5HPUbyPn6_{U>o$gT6J!5Dof?ko5JAgw; zoZ(|sZ4X2M?+v1NlJ`0^J={&&8s)+ASumwUkauSE8aXo=$)xzwz^8u6sl~KU4j3MP zsSYz8DrojK<0D*6LPoO9lO-(W_ZLQD!5JOpIOmiH3z>8hR!a8sR$^UHAQjanMxwFtIe%Av)%3n@98w`jI-%AK+=`8FfQ> zdnvYSS)?^SMg#vQ;UzV1Xx*2v@;uX@rHzFTO%TTj-(t{p_`;K{8Y#x8+*)$zskE6%`g zEq2V^k&=2fl)v7D2#ByrlAC#N(o8mYoXZ87nHRjw)+35@Y@BdHa(WSxsjO40L#k^= z;H$EKoFi1g`exjnP8COI>Y7$EGKOON`Z8 z(v#^RPt)u8)?SJo29iFI7Cr0$$w4c;s?FYG3x-^)arhf~0q8J3cr)RzKf*X9ds?2< zE<-oJ&@*ecPP`Hn%e7L0(n_GJgr^u=$WiJ#CK7JJ|5jN3OY(3kdN*go{8o%kQ(@(| zxZ*;`OW>tyM(5mqm!9il3K|KJ3n~j{P3pO0A%XH_O#=JNTa;APeG)>JviAwS(2Hy4 zJO;%47YT-%`0J7*1~wgdV)Z&Z-c(I=)8cX7 z_h8jInT8)#!ppgAI$5PVDm`Qhv_%dS;fpkK!63#+7SZ~$T9cXFc~-bY+}RfBD=43I z@%8Vt?fT4aPVJu~1fxafy0dXw>57ox&KLVW3I}u-3V=yzG8{*{{`g-1q)%a~%4l^T zK};%lw3OHieloP<`W_Aw$pKwr7E)c_oR-4F zd*`}Lh#3pgw82q@nu&Mm(HC~Qi5aNPZpj`?7F97TH&$ZZB$t`mZSuz%_~`GFY>-8p zb#!;%<4!(F!?SW;?qBA6;IMKIkIlzjE-1jdAi7Kufv8BYM@Yambk)ELFVq_<5KN6| zdHue+4eSa*bJCr_HdeMtsz+5_XvLVQc8Veo)u7?47&m*30xI+(OJ#ZU8cTpjSx6a5 z&HRSiJxahq)cPPvMrs`NptDs?veq=tANW<$fHQq}`O^qZSy>cfn1zZU#*LA(+55PO z(_eiqt!Os42?vH`rgFHmySVFh_mS!c^%yh@#jSGdFdBNm$Mk($2hC8e?RGUQRl#4g z5!MUC5S$T76eDv#9bLYg?M6Jh+8KrSVHmj*(1A1B%R_~^zPY-s-e$qT-6NHxZM<+Z~!nBylT zxy7|8>B$z-5bx_n(=j?##S!=V$zlQUMWWW6%reTHKg(6|`PpP$b+}1gJYB9kvt~E9 zgU<(%ORCK%NeHO7D8AuTih{D$j-AI$ns1TzrYRFaZap$Zy+&qjp`3|RcTQCQo3;}qy1f50co^32& zqtxblupWEJ89(=hDM94aiiwTP(Zsn9lEt4>wYrKSZscElpljhmlg*^!l^wk8J~5m} zpuhaFi^`Bo_ud`WOGD_`%Vpu~R@qX<H4Z)i4 zSBpAyUi&3w_TuBK;A<%tGonb40v{OM7VUx(o#(N8R`8*?@&(4h-8PSDy2#@sdcqzDtJyyKESF$r?b8H^<3ABz%lTRf_wJ?0HySP0 z7=-Kn2Rc~dPGA0%rcMlfFgZrs@&0H8o2-43}h3^(?=C%Dg-!Ykd!TKxQY zfQI;T%EU=7$*{Wj8>tHzqL|X&F!obXrcYrH30yJ(G^>H+>t;xI0PzfhAWr_P@{NBW zI$I)fS*HGYB*lgfJ->k>!3&z_k$;oY6m-54I+R6lL8Di$!Od3}SDHreWZGo#{RZlh zs!+E{|2S;LRaBUyRBmBC#QTI^T`t`>T0(CGmtDeOeEME2_DDf+*tZ%^308P^> z^q{w@=Z6%@`1!Bl3T8{I=+7H0G0q;vF+e3`LY=B$?X6Ll?c5Kg%*J_;9(=J&^e8W% zzEK}k<%^^J8+BY4CR>fMiz7&T7=Qj9d_ACNd7IcV?VS~L|FdNyz05$7406-pH^?&= zTHz~8?wjEG1%3%grcZ0Yq=|6^9I0#Py5*B4pvpI|Hgi-Ri3$Yqt71N9ydJm7B5}@9a$VaO zv{#4_^YU&e-Fl@I;FOSy2pa^t2Qf);P9&p_vQM)A8P z6UYlBkj{Cf+Y!D5SRq-ya8>Aed3ZqjvowivYgl_e~y+33$h3JoE5~2w!`2C>8 zSQ8JE`q`>aWRSUEdb7*LM?J?xkw%N6hvFA^?w+$UWiKNp8tomAO?ZHoPu$y5982M2 z_^ z#6LB1PBUxL>s#-vp4rdq%%@(|t(XC!xE4)R;BIr> z>lYxta04x3d^WXpomhXC=&;BaB`Ooz$$kUqPLbix!!LL(S+5ZFuOk;a{o;aRVVch* zUvLv~JUx{6^u35>T{~3P5ao9hY`B-fo>>5tn`3+ZL{j6$9a}Wv)-x9u#@iDZ8a9Fn6a7@%as$gmj(tS_a5l;R(uW-s}7NM?j}!?cw?@ z+Fnc=CFmxeEbnVtDjnsQx%AX>3-qU8%)9BbeN@t4rj3UF(zrUBPW^x+J6|0ErT0p3 za7wl8tm0|a^VQNVv!ql75{F_hw)dqHV-=c4|g8Fe+K)HS`n+6$SYf>S;)DO_u8w1 z!+e{G?Saqn@>tYca)i_}e#I68pUbJjHcS5|LgdF}E*H`Y%F)ru!YTB2_CB=sr_GHI zg*9aI{1F|py)vhp8^Wy9{fJ|%Bez9sF%Hhi8D_Ox8>~pm$~(RqSAq4T^=cSy8V3C~;|K0aopY)Jp{_|A|s(ZPW*fR*svDIXJ2*;O%mB z?B|-XY&txDJ8`Gx%zPU#*n2eT{+pRcw$VBC~RIqr&)UqA~Vdj74& z{$>+Oa!@A2z%F8;OkSZ+CP4pQl7@=Sv$h@-xS}cxFUHzgOV8OzZc2`{(D^7q6JKph zN+5W9WW-x4L4`u9A7id9D1o8^n8}vzSSTrrklCH*tjsWHc~HyB#;A?MXShNUW^SZ? zTAGx_Qbv#Im*+8fIfY(L8%_mR*x~J#*%f8-myPny(JXgloRxtT(h`gD?{eCwe~9)7 zp%RRhMiJr8)3>fD=k)B$k9~(N3MwT^@qI%XE3ZzFOhXF!m8XyjI4dfIxf5q3RaX>I zPliTIVx>!|p{Mz+ppzW(4bOT@v2nUu-I<=VaQxMRRaO*dw>@-sT!E;yc4VS{H+FDd zC_y4&+dg%gzfiLNf(a}o6;%av`%FLpHL2?ovyL;DhUt~@7-?<)>1B+CICNFt597`; zRdm&*T{O#@*M)iXK=H8uQ~7UIMn&gr(m=^Hl2ge%QZc7nKSC~5MA<}MR#z?c?VrMK zW|_^N)k^j-+gQAK(>?Mn(=63a5vpPE{k=Y@e>uo6DMZ;2{$@Uz?82i^QMPKtBP&|K zb?)Hfm@187pGyB^^C*WDX2s(IN5E^o-J;*m64L|9n46CF-Dj6Cu9^<&p}3Xfwd6lW zSA=n##-u9<-#E^~UH0z%YMWG>)KHcu+#E2yX}fF)3H+pjyPh#~*q4-MTK*9ioHX%7 zH%czpt>+ApyAB!I?^fxdk`3X!O-*p%cY^SAawG`uB7Dv|lXy@ZQ39cPMb>h!T769c zsamR5q~tv1<(ZG9%6^Va%Xq<6?`7w1<-TFU<%~Y^z-pMnDAQm|8B>vg6b`d^S!E@R zA>!*4BUi?GOc%Gh6(%VwCE)w7PPw&$Rg{cLWny&*WRXHhDyVWT$aA88+T;>UF-%um zP8T8%uAtSapK2PONRmdd>}h!y=GDFcsJlW57S1No&y~M*f*k=}MwADYRoCs_)jHLU zHGTA|&qfr-I`dy89VmLjM=K`YU^{N4{q4P;zg-N zvTp49W)aPv5CtD3FQXRIP!+>=HR*In!})Ny@hDgv9S2WqMX*$?l z=1fYP+!xO)fInsB?PD?@1h;|j(#JsL8IILM`u(DM(IfYTtU_>=Nc}j^?AYvCrcb4A z@Whe1yg)98&A5ju5@cl1^_hTG;SW}~m7o<{d#*XfUwUST zSN*>T9o0Wf5!2GYX`WQgA-(|r`q$aM-pxfua4YnE5*NwG@g0n6-eS#9AFemlHlY&xuD|zsBu^OSvF+|cAcd39x_tDt0}$)aLM0GhWJSV1nIGTOOq~+O zVIsRj%s8iW})6tczh+t>*1uLBSI~Ey6ciX&8LK%uX043g%;I*_f{9k zNN^wR3m+DHHTz~C2qg&p8hX12fKhjbW}`y*ZjwyRb>Z1pYIbS-;-s%mvmg7mBqf;c zGkOp3ZDheorNlZ#v_s(}#u^Dte~unpI*`Q=oRraW>8}?{-Gy8+PRXOJaveG}u9xzA zn~6bl_fIe-&pu~6s(5MX_B%MgPj5drDn&f$`ueA5#wD$WF`4({vch-N`DHDvO50;7 z2MaB`+M|1oDOKAW9;l2N(xl6n(79lW0Z;d0i|funr#;!{~VV>fT#oCt`QITrov*^{kXs znuNJf5vh^5GbLmWbH-eFLJ9jp^@ELZa?Y+d6pD39N27qGa5S1Rx*SM6Zt6hEAZ|vQ z4Q}@~`sYe>LLq_Xh3e0}5_>CRon;Z1Rt$d`6G1}SAlP_pwT9Cb5y-#`{OKJyLd+8dFUQ6ho=lqXTt zF1dSm+_;nByFY$ftCRsRj^5Nie0$qiVB?cksQJXVq1Uh7^Jw;bByubhhZ$Gud5d8w zHPbBPjW4f!TD5=Q?=GzZUXLsZ2wVIBaO>VcAKiMCI#jA6a)PdHoR}G`q8<@Ugk_G% z03Fwybc8r~?gO$=DVWkaS(<+uKsvV3-wCg(u z4Smim#5NSQW!R?}LI6r^$j5i1BrI7jBhIL+WA-93mV~HweN@&LWUcyT6DaxXQqp$F zY~Q*KXg;|Vd3~s8#v16Xq8&=lyFj|J>AbYz)fjU-1za;P6MYpl6m9&+)lg)Gwd!=u zmV@|kA3^CdWK1P_$(D#qKb#*TlLliM68$BNOx zrr&{?am=H~USWa6LaJ8d;O$p)wcjoLPxpCmRz`talaunBG7kFs1$n$RQ*$cSd{okt z$J&xBk*SzXchw?ea=-67J9iM=tP;97KxJ&ds= zX$gH;dA3U!w*_vf{^Aj^JBrGA89#;>-;5t}ALCl%5U*j6Siyqv=WHTJOW6&8zN~ra z?gQ1!Y-HD)uL8GjyDIR#qCyvY?&)T{JKIE+^kG>=w?j9g>dFHKMJV%qwtUJ>$_tkS zzwN1X8wu_+UuhM2Qgam}KrfC)XIsf>(}*27)(DKuWVb0oT6#-Q=o{pNlJuU9flxDs z*+rrsyOp3VeLAZ%R6^2q3S@3vT-!{ICW2LI(b|r~`LS8?BM)O$t{rUUW+YtW#@Om|lJ4hcZ5r=6)1;O+}2Am(L&~OR9DU_cwlwvYCI9{1Pm=(zw92rtERhCa@i( zG!Q|=y+-?MjTcqo4c1Pnv$1%|#BF$Hr0EExuNuBpBQy$d9t#bQj;xu1jVhI>R~INz zM^_#!Csd8AkAowG)31e|6#faOkm5yW{*brP*PL#M!7Y0eZxVcUHf8nEsu$oD&pku6 z@5yW&2L*50S^$Zccf7Vh?CH$em-fj!M-ghu#*0)7f$IZbS+DcNvUDT93OX75$CWGo zRE$~4GsDSkL(lkl3kvnEJndRecrvV#%h5Gh{%`!(7&XNTEqN;6_DwAs@|e)aZV!K;uHaqiHG~Vv~H>Mse^i1*)`LW?n8ULl{f*eB=cI7zs8Lwa$l+p=UBfumuGpN z8=d>3l4D6c*=6BiY}%C@Wl|A}tVhv!?rms(kH#sYu{>6ri`pzWpApb^NFXW248`1* zp+ceHHW4t(vjQmB7^+1}H#72~;gbJE$Qm9q(zCdisBFp0zmY-ANtv0@rrA!5zp;ic zO0_a>)Vz$L(}R*AR^E~cOH>D_jw$KPe$5t!76=Z4o{}abU>%9+YS22Nv$W$Su+V>~ zG@qBsP|W`}vW0HF5vhrIjaJ~6N znf=1SY_!kI;-Gw&a!}8}V;WLPR`oTrFl>|9jhF=kD7SRgqQR8jFa}b!M)$PSYZE|M zaPBcAl|PZL=!h}OiDEJU!SpGA>h3BE_|=a z2bapB2f{g%FR%6w!`Zue84QH|1^s?h+7TD~Rh9O2yIv+WKjx5Jgn*ZnB@556Gv#53 z%EASCWSeRQ^>}S2A>&Q-nb5jg*I5N*97b}F+35}F)Zn=|N)hXlEdoJ~h z>ejIP)h;7_nMG{*UjTs-r>a`NhT#iC(`&R_39OXpdQlK23Ik>v$$aQ%ebk?u2lV)J7c`mwh-;N{iCRjcUm7 ze;kVal11!2d|w`|acaz8#x`ytqWuV} zuaLb?!eEN{@mQ?d9yZKAaJ(4=7+H!8wNYojnEYbgl8eLE{l?R{YM+jFSDEa`N?MJBf1Csj5?txHe}iDpBk-?~Hgi2i{0@kefS! zLOVG5kB^XWFjnX#kJm0UJ&<4e%^9c%u954ZJItJF2g}=ui*Ax)VR#KFF`Ms^roNsx z45saLLI&FZj4VWcB%dmDQ`bdiO!)jVFyVDo<94C3Wn7RGox(~We{a4m!ks!;B_pS|v!jxyOS=~b8uYd9hb8 zaYYV~6_$z;Q3S{#4g?0qjO{ajA~{{C)W5vPvrr0!WW8~h4W+^d7gDJK04>o1Q8wUI z3I3@B=<24P7B|+8L1jl!IqM`U<>ZyqQwBmDN1~AJ{-Z`$H*#078fDp)Qx1=IUrQvTg{bEo7-Fu7cr3PO`C(<bXAGZBAOkLAtC8Mm2=)wr4@3D-H5 zy14Y(c)6MQgqjF`S!S2j)oP)C2iw|*5!~@_v8K8&>^>-y`9I~EfO2AYKc}by!WNBK zDG35BZ@wx)&EA<`2{}UkK-V9oA_eFg1}u+DW(8uD`xJb(Dj6_Hqu;QE-IU0kr$n>V zSqSXIzz8V4vU3}C{m_<8KMXXMhEnASLSNq%MlcLv3*Ox9O;Hu;r zAV-NH2T|TFpf1%Jc|>eO-Rw|O&8GKMEd}a^Q>MbX4h`ZTZO*7#$LD&_+Z61}T#46u z$qiy>QV=OAhN@UM4@2do?!6u3Fc-S8yHG~(Mm!Dc?3R1kFL05663r5+C3`{f$DE_? zwqeDJ3Pw-xP{UN-O?sd;0&t>tg+qZ2y`Oh_rC8r)r+syPk%>Zq``4aNm&`t|HOT`` z`TfE!AZGQTQ|GkbisvnfsGhcb#ufLc)}Q60ycq7zPhu=4EgC`dNKw-taMElVp?&hg zZzZ_?#4Krb^VwqJ-*ihav*9s{?m~xz`?_UBq-t!u#(-{}u^(b;^DyA#gWcuxT6bD{ z`Ro=`f;ycL`kTb)E}`_hz+dYeQ^z@B<<%&E+vr<0q=WLnLvDYUf%~+A?D58H?xcYq zOullmx>y4Tr%A^eu150AiBv%~%LDlUw(_@xK=P?Tt>Z^E zSFpGOS9!3yN-M$6bP3VlzMOnEVyux<$K{-8;#bl6+k{wLDQo}$*PMP~(<}DbM6cmw z{kW;}KK@PiN+mHiIH+TDfEe}SVLD|gzwugOCcw%;Hu3fEq<*b6hZ3l~Y8Btt#>}8w z5myvTOzdBRMx`?4d04FVb4C(4%hq;PoZL?Xl6ix;7gNT6dN{S%s>#uXdhj(#27;bc zzwK5}9>s3O7cy73DhFHp(JeT|xTf0`enc7@;3ZF#LT6bcZUJv}%Rg;|CTJkg$`tRa zLrb#$jR%VjXVmgq@h6NjnfEadCRsF0J&`i4(p~ydePl~|&KDD}9o+YeG! zqzmEfDFSv_WpgSDU+x7!df*4MfkQ7fH*bXR<0pz@c>GRALrDHvNQ%LQ-7lG2MhwTu z{*EndrzVYDshT87IbPnBHV&bKIWaq4JUtjP@NDBw+hx729l74%rb1s=CsyUCiwE0A1@}4bf|H?j z|BokU{=D+ZnP)=Qi9$a(#gU<;?zZV|qe2`waLu+N5Zr6g8pW7*4Vt}#11P0ke9be; ze320>{H=Ad3G#`e{H|{>k7I|0R}7A}DuY`IG4w=8!5bfSU*QdEOVGU&mpXY#z(n`C zqy7iVN^LaBSp14LmW};O6(vFN6-W2WLTgl)&75g05f0wjVziB=F|^+kD|`6>7Oa^GYlpkWFtpGl${47)&icr1wMn zeE5#atw$yLiziYyH4-rtD$Ptvg}o9*bZ?RC+_n?PwisG2Lx*`*RCy=T6V@u5Z4?Qb|qK zrHP&B})5rmeOkuaw zSkh!%RbRxB60J`a&PQsaOD{3^e{4<3A57>Mtx+g@p)Y(sg}vrh;ZL&Z+Bo){3V$wM zWGX+bHKfoV6|KIY-*0)knw6)|D%g<0-JnPMMbg+*U8dk{$gpE5n(7qa2I7&cr7jen zSC;N-I52;%t<&F00Gs`!F3yvx=6=6*CJTM!xZ%u>Cf>$l#22w6O;gpEUkIK2sa|~6 z%g=k1h|F!WuUv@!x^Sse1zj&~zDKRU!p$f?k& zD!j`0C<{$3LBzo$_pAJO?QP+=>T4XuxABwaa3b%!O({#hZ}Hbnwe0jk!o3yCg^ex6 zcqL%PsQap#k-ecF+^T0mm6YOS_nf_)1Ox-AapDglkNfy=+v&MatoRd-84L_Z)ECvxKl zbQ~kkd{s$nYKr!r64%N1&xz~T<4-Fv23xM<03JPF#iyOH1V`Nw7@wSYI;X>IzFK(p z=cP|`3~~F@B!Gnq5SY~8MPF3N)L>zkf3;A0%aRt5Bq@)`dggen^oyFFaPeIsgiF^N z^Tanj1hWgY^mc)#J|RLlZ{q5SyB+CoqKTGM)mrexb7859;Ig7j>9Vx0h>eO?!R#2F ze|t0uw@sToIvn*7SUfddL$lz?3W(hjC0)avn-Jjc>j=cmi8qH-R8EPt%_P&Jqk1vJ z^KdDhrecEn1DXjL%92)XQF92+ElPHwsEl2s5;o;!IIJq)*@nVm8i8KUIQL;4dlGWK zfsWV(a!|%n#y!q^NSY7KOVngOAP5$4-oKOzzvhH~ToyBZU(KoQ2U<~Jz7gZxr5pk3 zqR#x!?vy(;Y{!~tRlLD-U7yb=Hh5s-X@2FCW9@!`pjNN^$xz`-!zmCv83 zxWQT)#^gfPJ5j26MyWy}T-4gM1A#cx>Dw)2O<{Se$zJoltL|5=d)k#+5^L3q+s?hf z6#tI0r;CU`F09IB2adsLetBbt#8Qm4ka_2TX|x z;|Myg@Ip5ebKY{EkRr#w{4FE)6z{2mE_d$Q$=o}ZzFlR`GXkZsrK`6K=qlccqQ)A= zdqvPsqlNklwsRgzQ+38n^MS!sY*X$RY2W-bz;2aBw^K~Nxmsw~t#rr~k6d3L+1Cn{ z%!8y#eFg%WmzHMI`)?j-Af0b~fno6kP7rz0!1xree2Gd)RBSGUSC*3V&&VT0dnG0l z&74JGR35jU3f(l(-`ai(v_|t>Mk?DVRFj5!3bESX%Kr>Y;iyhbRTu=dq0wN5(xCSg z5S;z&)9^mML|0M#GhtVwRg;@rDb-@4jPlK)VXYvI`S3drZEYiKH=^j-?^x?9CudpX z`0T7vsy>yCWTv)_S+i4&i^H4_@jJjxzt9I+OljsbPbp$ip_fsSu#?w?0jXu(T9b=1 zDF(7Sp8_7G@}k66*Z879jPT^LBGWYox)ByXI;Q1StiiJ_)ScPf%Iz@g8#70R44d*A z&mZ^vFec`~u;nwFOS5QU@S@N9)KkaQyVVc*rlW!jtWNK};x=ur(+Xg4Z8Kutc$N8rxS!c7dvk2FP(6Dz|I8XqPO8U=S5HLC!f(<4M2W@>NwQLC5wF3iiP4QsEsfOy zsj28hPW&u64I4lEVFJmhCm&;8J#rv>p)Ara|757kLvm<0iZ>_9M|TJBuZe52`uMFX ze%G#sOe-X&5d&_@UJIw4kk;CRas18c~W#_KEe!BJFZt=*sb*rR8io48f(> zVFEDgW2yo|?kWc3m>lXn2BZ5SzQYyw{?+=ppZ0{|+-p{O*+z!M)-QBYWLesxk{o1( z6tHqz@k4iqv3Z<`Q|80PI!AF-GF#HOmv=yx>{z-^;hahaGd z+jKM7h8f&p{k9Pv2qm@lNF@Rl-_i5Ng^1Q}XCu_rdu4R?B(eX67x0{7v8@$Io{9%O z;hRD4)1P^MsiHyj5s$gG0b90^4TnidHI2kb5IiPN_v4Bpa_4pvhNnuWwE?cT>|(PU;a+Hm2cSy+XY+e) z7pP{cS>smd9Mt`Qq4Im(tp>F}-iQ`Ni*6u1u(ocI>ivFGIor2s-M@gm|0i75@i1Sj zQ8(Easq*S~U~b2jZ){^g2ab4?Iw7kKC{ce;O?0e|`GSXtXPZxsLPPsECWsW5)&R_s zUpeyjcj-MMGchJ)zsV_#S~5e-ofYOO=qD}=2AO#@DzLJ!BR0HSujf}G`rX=Ud8s%OHp0eQQ?WL7{WT+2x2bIHIkx>hh%!bB z3EeWGJ3H3Z<0cLcSzohuzIOrw^!u*OvTJ>{(eng`x<2N9ByvoR%)v07RipnKrLAQo z>5Q|PU%8z|wBM8R7%`|@a&!di?Ed(PA=#095Qqpu-)}XqcuY1_4#^sLn7ADQRlIQ2 zi1|70%5H9#n&O0T+G26Gpwu+j6C^Rg%U6Xvp{f7_o)263gaI_DOazZ9?K|n#O_e+8 zgl@*v3drLTh}1G)6`JYN+R0i!R*$>19T+qe?7)^s8*d|wiw0wSP0aG&u= zjd%uKh6#HQjpB*72QhYa#9-s8-If5_Y<>QkqE+bvIo+7!Ql%B?N(&K;bhy#1d z11RW&b=6lW;MX7DxjI$m+Fb_ zc%&|}{m}lIejG2P)Ux(@T}5x6s6nqQtdYx@Hz)9Z+Iwy0(5{7UJn^ZHa|j=MTh9eE z_B0Uj^WeN5HrImYoZ=Gb*I+e?>r(Mze%Yz_wRl%ln!3>ws`5F%&G-n(^Tr!TD z7svKdMgy;Te&KjbPP)aiwZv`4=#dGV2{ZKwkq3Pr$eau+^iey!p-78_nJ!J#NM*}A zgJckitwNtcZM-kREt0C>3+z3lv+Zx>&xdp#Y4wp%DBhHu^0YDLbB3+E+@y1- zK&CPtV@ZK_R|=C>He3ias0h#zf6GTw)i)wiLNzrtc*8wiBvw;T+bf5=nBz+Sjce|s zD1=rZ;MbEY+u0TCx!Lo4=EJzJGO0Rh1w7Le>qR>uXVAFrs7*ZRkRbsV-C%kd@C=^u z(&2^=wAgEip-*CIl7*Wm!KU>&GEQTBs;U5C{+)*X%<5V3P~9m`#+8wcgR|^N7&(AS@YKD)3W?2d_>QuB%#l{YSLEsH=oFD&6=%= zGW9-$U3O~tnY&8YomtxPD0o$^O^Hrb@xkFj6O{ogLA^!_YWztemd00;#x6ColLEW` z9A+Xows_eB2r2+I4nLAGwTy1XbNkoJTBATrTp6R$_6!zE!@j}H$j$uJysU+)_g6Ma z4s@gg99j@@Qe>HCKLxDWSKMNi=T=mvGV=9e7)o3{NaU4a#V9f*9P*8CFt6>#+Y8p< z=S9y1M3Ry&Ie4G52Mr&}$kINFDl~)H2$Z~E+V=DNPU^@eK)~o2@F$8*I!TI|5SRxc zVqzPbd1p}imohqP3N&K%T5v-5Pw*M+AP7AVJ+rQ}wj}!qOA#=z^o+g|QiRtw+^O|; zWDau@KtNve=o-cIe}0qLvd3}&9~y>}PtPnQ1I9lWv$1E?8fw=B*AigEC5gKJmcb4G zJlZ`SGNXinFt7UiO9rDq8D^5f4z^GoT6VHsbEmf8)Bf(0e=^Dvtg=ISZnO1Ykp4ZG zNqS~M8J6%%DiJn4CzmNcm!1DEVa;1M=)(+;woyzW6nJSy$Iy%g*zq46%YmOp$A60f z@JsrCCId{GYvWhH$IkwrGgD_EXt>?~yNJ_Fc-7A5FNF-@r5RYdM_K)Cs6Vo=fBxDd zKuz>75L4{xYP;4lt8f2PMw1>e-+qJ$J%b25d1BV}nv{udPIBM>Jc`}0I{3&>-~WRl zXI`*_%$t8H?@4zd>nRf=lxt%Dc8oZOMviUY|2pn4r*?{i;J@_t&yK)oVwEJ`Le`)If!x1^xb!fNGKRrGB--(oH_Y`@2WL|&Q*!jmP13y0h zk7dbrDGqT@Yyyk+Jav>ezFZ_Q1HUT!Ff7|jub_D)9qU{vEC%yd#Ti5@eLasEZsVj`W1Y~N# z#HDCs3_)>RP>~^2#!-nYv}GXDMnyrQRr?%@Mgf&7u#MYu;&WRppm{YX$N>it6_CZssMn$TAiZ@0mmV;aewz@ex z?l7ClqH*jpLjl8zI|7DHwF3;R?dX{_=`bfC^l#LtgSj}c6~h4CxIHI6yG8Zc^gD&L z8V62{wften|CHtEzvC<)%y2?!+ImOJKj{pxbqKMS#+K!&-Vdwae?Z!`#-;m`6PUD;_`=@#875}uK<=H1m$C4WfU0?-?@+5$E zHJ`MG*7@zDvzutU(1-o%IK;bV=R=~IibU|K(6&foPF2L>k~N5lH>LYPLqz#^TbN}z zLg><3X?k^BBK-wYB=OgC3W^hAttl~Qs+5m5oAsIc2X9V6me|TpURCZ}2(!cv8-AQ62#e0G?5?6PuU znGU?SFRy>a*D;SE(2&1NJ9!B)oEtq!(^4#;TZCbqQccrbF+0#*se78Ddb(0Pxiux( zsD~<)CA#35504Ss-nF_Qrr!4BJG}U-PPC;WNxC%$y5F=27{RNDSla&iAj`1+nj*+l zCyKmv@9OPT+1x1;d+ua4t#%k#%rjF7L@c-RClYgIO?3Clyx zjB_$uU-^Vs_{K{@IipHPKa~1J%qD@!S$o?~fKbn@Xje8RI<2d&ZC<&UP9Rm?+JR(QKDx80 z8-nG#4HrE>q{Mh$IryGoPRv%>zU()*)?Y}1G<`S2eaVeE?xmFev{*w}YiQcGLXQi5 z;^ptC>!)3%H*1QB2{kaZy_~-rir@RVhZw|r|8XFa^QAeK2^IDqetF#*S{VyMDN)*g z*{2Z=@6zTI0><9K^VDZaeTYJmst@WtW}pj=+>lyIk=v1>bPL^@x=1*b{h@!0=KAxW z7P8~?{J|SpI4#fS+u|XhSzRLADG_ zE0vLPX1HE9$9sGWGg~XT;lVvF`2uZd275J3p`wXO&k)@vR{&5<0&Km`MhEve5sqk> zAC2a0&gx=z*>V>61Ar}UWN>i>6#$SNzcexF*Z4h&e#!gdH-_QxU%8C*p4%!4?L95E zO_+`c0QZrJ0Kmol{SbcKK*E;Z*FeVSR>Kn;DcHw_jbuDn3nR6&Yz^ARl!Fg8l5s!6 NnT_+@F4v>g{s&yD2yXxY diff --git a/spreadsheet/macrofree/alz_checklist.zh-Hant.xlsx b/spreadsheet/macrofree/alz_checklist.zh-Hant.xlsx index cbaf290c05f8926c9295dd3c915c8bfeca45665e..50aea574db78f5394f3cf556dc4d865e24d9ec72 100644 GIT binary patch delta 21244 zcmY&fWmr^Q7xhJ2x}>{Hx2FZ~e1GoD^UQhX z?t9LTwbx$vDEIAp-dkiP*|*SGZ{ECte`6nn6NlV|0Qu0y77W&gi(4QDj@$IIpamKB z|7IRd#Ka8R71Q;m<;23bI+mAC>zlh5S=re;D{YDfPl?8)raZa#EzCGs3$}TlbeY1D z@g8kJGq3ZlQ}8KR$NEf>o3R?_G}jxvi&X5)RTxsNemip2mV>WE`z0XbbKiKMt0+A$ z#d^|()MpTu_mmOK6gk5Ykm~D}+iw>m*MmJWR~H-H5IfpIJv+6jU$=K|jEa1iO1KEt zstm*Va9fqGaCobgfdDoY3`psq&H|NUROmgE1bJSH5%} zeqS1cd1CPlHK*aWdM>;Zu*cA|ByKj3eTiiC-Lu&M+Ky)X-18xQ6YI8Uow)T5_Ww4i z76GaY7UgxDsQpB6FB;#xso1Ptgr~Oxa`8HtYCk9F`4pJ^dP{xx#_+a@Mo)!LowtOt zcjGK7`2&G(v5c)cy{<~4{?o~OQetv4LUbzDQlHMH1U`&60e#!;UCqB%Vu(YLQMJ(+ z?#R@%$O2*3;~#(O(%%j8yBK$0N`}M@mI$TuJ+TMexUytBJDA5^uwecis$e)j1U?Fl zN3bAas4=|s1JSX?zAqx4Rc${1rIKu z8rv^}zu8SS^9RS)jFo61GMg-G4&JkPi5 zlcF9q_;Pu&#r`huT7nauRm`4LM4lWV5WlQBqQ&u+Y*O+T7Y@#t5W2<+%e*fw+}L$I z^N@ydz$4|@$v;&*5>={MX^K`@d*i@Fs0FOo?bHV9kbK^E z3)cb4>|TgWrbYEs`DR8B{c2~qF3RMfL?k$fo1vyqZ_3G2m}SulR@PAViA3wa@`K;U zr7w#WF?P7}yJy;eKuO1wnfx3fNV|U#-n~?8uP5OTa?!MCt;fOVl6`wpE1Ggaf0G}c z7+iOOKB6y@Zom^ko&YrAK1(qg%f$+KHU-F&O~mYur83Wsjd-ygUAuAz2ags4Hd( z`ILJ70x`()()b+6;kA4vIjOcLr!Xb7iECoCgG$E1NcYa*wOODeU9-p0DdN4ebfW#K z2(mq0y3^zm`K()s9V7SJ;P+~UZ`4wy-^W=|*2WMRf1N=cpx*A+eO3;{icx*&iPRSK z)85tnOtZgBReAy)Qq4j-8ApNh(z=%DCb!mO|@)t6&g7`>)c=Rh^lsxxdP zJkh(9KgE2EJtD;5N#jk6szk-EqSi#=a~$zRx2Bf&_xLxOCY%`8cZ^YX{q6RS4bq(i z$|{z5n0Q!!t4+l_iJPe0R!KfsiTC2+M^=$<7zYekv!nvW(f{~|I9Co@bH;psFN62G z%@8_HpO{rK8Eu$j&VZw}tV!lTkfgO(4Xw;@2>_!ZsD$GU9t$~RSg2BTb`K&R(mr)q zOh-QHMs_U&u1%X$ZbsBPEV~Pgc{P&m$R517m13+XIYy~0Xh`b2gu!NM0^LTv6Yos) z@%r~1AipxLC@8*qK+BFYZTk~-2;)8)h-E?r41fLS$iwp0Zf@rt9>RTni-(@Q9(+pA zSorO;WqsXNW#qp`HCG)NidYTAKZzgF?^x#5k!z

FeX0yMco2O%$j2>^z6`w60NK ztsL7gxPw@EunDm;d6eoyyYiq?Mk?@j1gJb@^<-z+&QYOEnpDJh91rr>_Kfr+-f9=_ zw-J(8ld0+698fFuHWQ(a2imE$rXm5Rvqnh2xxu#q{bSp?k!WPvm4(twqU zWOG9}fY@1cUy;zLJzj5$6tf5h%_hZQ@&_7iJ40Mc^3; z4xlElcy?bZd0hQHIF66Fm+WH4h%*Zm~^ zlPQpbkgql1xP!}T=WtV6nOG=753l`REHRz&dWiF#A1jqfD5D%Z5Qs*b-A7f@9xLO9 z&yK6eUKOrJ3}hmf_+2za97ioek6=&vouQ{1iP?os!3x~R_Gf<+s5Gj*=8?LI6p8UC zJgSz;Dp&L$)KIz$JHH1H|py_`YB5;wNh6_<3-B%BNsz6xzqfkn7KNn zpUsjrX}r_5JC|L zu`?IV&fQjQQDQ`7!2`T48qQrPLjq9=3*K37hEXH%ea_XTJxcgCAuN;#*CR05J9tam z12ht%F08MyZmO5Noitwu9R!EMxqfW7btLR=B8YLau>qd8?C%!vxqrAvNLrvov5?3UQg|Cs zCez}`QPvu=*Bl3fOY9<6$6KC(Gp2<5C>CSQC;p64EN&KfedKPj%AfKySIs;LyI~c4 z0{MzPOHI{_f70zcbl&l^x%x+t^igH7x^k?0dhj-Byq+$=GLaQ$n_n&<(2+A7p5#vvX!=%-Mhr;+-Ark9 zNFxPT;h7w)*{6~~uroFsWr?het_7u37Lrs@@Q=TEz?8QYVVmMT+2fIOM@L+W7{%Z{ z##OimtUn`;-Vn|=9)%?A6m=E&l>3ZM3ev9?@R;x2EO&}EmcFMyv1pW@%a0R6;>yHf35VahMgfLLCBYk7K$ z;me+hv6UEsOiBjf9D6N|F|*q1Hw$Ke>t=`mTB~)9>3jKGTvWNKp|Naqc4EcCpNW-c zySy=bUwN>|yC<^za@|D7x)jW=l0SAVNJv)=Q-p{(RBVA&CQA(Qht_Ac_HZ~?kjcGd zfE9|1{k-#duwm76E5=vVA|#6B)giBrx?28-YnzUZl~M8NDSk3$$jdZ|aXRQf!uXko zO8ZzDL`emtw^I9}GR(Tb_t&z>go^^VX#Kj0T!xqXSHDY^>KjN~D}%P-+hdcU@ddNP z>6eLdEs;1@i#Unm(toJ(&IdjKXieSUrclh)w{(3%33<0>?ya=H?}_2YMz}62@}B8a zI!Uoj=J%M)k@XAbabU?WY`R|$w;!XIVLCnt$9--))vfVc@!hV!bB{zwb;*|^`8j0o z`WdDVF(9sbEG4(}^A#v_jVw!uF0h1BIaXZcoAP(BTfMH{kkHpvXuwwl1?K>@vn26R zKn8A+o6W_#4@{;|LQ3TGXwQ1Vrys{>%VKauL*2=No4ij957su%d?%{>M#6!iz<))U z)Ho!V<&xd7@4U2yBYY{8r}4bnV9}U(qHT$0`nYGB3F{}a;i(qYyH{MnQp#lwO1$#$ zjzz=grlU(+p-={@&6h4suGH1p4w`%|QZF|v0|i6CQDnkt0VqmettOY@?$1_QfqCBv zrfjm_)6=ZzZOu@ybonf{!Vq{jl(g7@v0W#@A?wBz)IK3!9@U9^58`dZ4l$!Lf7dr->2O@|k zisDTL%ANwW#|Ef@hB$PV) zp@mN;KsS9B59TuV4k{c)^7k>-dIB9f%+Z^fo1=32>e}E#_g~iSo7a5^dIZd9mwpen zII?wQb#rJxGc~nSskOxe!Y;Dl#(>Pb)MN(g18#|G_K6a=i;Rg@|2%TBEKQu>J|iD=B}nliHhohhv~rvDik}M%l$s69YRNTp=qNK!@5U@fEuwj<=Rc*n5UHB9 zATCSO1fH8mO04gCbO*arqr3G&(8W*Wad*a?kSP^0t7QL!>3G5Upv*e<+V%?g)@Cwe zcHJ6o^B&ZdGv5G-xqq#N;+pte_17@(c*P2c5mQ3|i#8Uy2fVA~>0RI`txh&O7el0X zMr2zSedmv@t*1PdqPh^Ja}YSn8@+8bGE_WYBKlzTjyRG+%YVoXv~3$2{A2yRCmS{Ep>#861( ziY-oA8W_aEVKp0(Vhu3+z{X?eDGgbM{0i+{ApkU5A9_01)yDu9mJ-< zZ~6AVy3X_}7U=;#Fe_Kk(OQ8qWWst*nr5>4g-ecwYRHG z8mTZ;J=Abn%$kc%2UKn0zGiK$#X1vIRovK!D{}5?%{UMjnYG3-J;ErDwM{D)-9Uip zzXC|<5U}fs*nJ5dHAaY^5&?(~CJgE1j$sp9h+4X08%dyc@>HYLNgh;U&MgK7d)3k6FC$hKc{R}fd7RsM0cmuh5}M*`YL1g#Y)*;4q>KO@Nbq}8nv@D4 zLtQ}eebRp}yW1|PtgfyA&H#tx4_xfNPz|Hhe(%BoOM_l<_dTrLrQhbXG6{W*-K=apj!BhE5Hvr#jeh5T&`%66#D zq6^X3Vz@Cp=_A;s_q+y3o%!WVn-6irX13Q;($f6~q=0roF%0gptM4OSTWZmpOVrf@ z9}_XCV63;MH&!%tsDyFS@|C|Kl2FPF_(C%ZyQef=aten(;zm1v;s5jrrQx9iHeBsw zJS3F-YVucO=zD|r#cQ!O&y-Lkx+?7)BrCno!X@{GKxF@89pe`%1=zr6#eO2>+nC;l z=f;=TO(9@Aov`4`(DSFq_WP7{sVX#l$Z3m^xi;7=Ih%BZW_kxnib&Ly0HkrI=>Y>(PSjl1xo~k?Dk$proaDgbjq)T z8D=memt_#Bhih>>oUCSA2I}-2QxS}jH^-cLu;EqETuo*SIOCsX@po%L33B&tY3UKE z7YBG-YVmf1J|)pu#V3FPdE1ZzzxKtJiaurGGEs9-b^fG9#!LR8ZP|a@*M42;8P4r7 z3rN!|I`9gXCS!lVW=_G5e(EQR7*)ETz_7t_K!m;~N5(!^Kvc9M7 zUVcl;lhUZJN}`#!V_OVS*ovF_2u#$AtIrqrQX20lf&ThvfJ@bZ<=wv!=9xbO=4Gyr z=9cMu*Nb}r$ZH>7xnDwue^Gzdqj<;b0uCMmEeYl|3+b-O?(X;AOVYc^oAB9oO>tDis zmd568UpSM8fv}s`J^t;L!kkw$zLptjgYM6rWl!b zm0ErGMhcu2hzqm`dob3azGeSn+}r#9O|<0a*An{vvo41yTZNy8=YKpf7?JI7I@pMs z=>qUqcDU~xxktY9W$dO?YRKSb6CrPQc4)$0j2~}&+@ia*LnD0p%}rxcq&j_(^`;*8 zW^ybOd%_{9i8P)Qzc2a=Zh|?qfTj0fK{Zy&FfBZGLN;(&f2D!V>xZVS9tI;b4BX# z+t0arTPPheA8w1y+V1AA`ua<6Lf?xd9PXK3FrPF{&JQ{-4EEHM2obpkYki#KS%QXy z3RzBKH8n84N{X4f4#1!?Zy@enO`V-ynF#-8-4ad6;`) z*y6LcxnVw5XUIJgR?9xKugP}gSQxID+{hNQPV?ZU6kvY$>iy^-wS72Bo1M=rhHO;Y zV9&h5kw&RbDy>A+KatJ`KP;b^8Toaa2;RCajsgC-ls)I&s-5O$5z(6=o_B zb^nLLbo)TALrX63fhJpk-Ex@S-K5!_@q%;5b?o~>MCiI> z(Je$lDhQbIH)^VoU>pU&j9KC!_yiI4&fZ5r8_`!y79}0#U%hl34GN+v2HgB$UgVv? z2On)is!!9~#i!r9T;aaWB;}AMvEf-CX#8R0_M`XJc}<*Lm0O_Ouh%m>ul}0X&NK{S zqy%yRJYj#*Qv&vq)Ri>+wV)oLPR_~xaAdH7O~>b8r{T7@fsx!hU8E>{E~X#25!IOO zoX`---_)<}yVzz1 zeR9(!)V|+-$>=yXz0cTr;S;kHw5afdXA9~zOFgAgQf+DuSKEO%+AsmZ{E}NeRe{cUH>kps_|LO9l0~3K0m$I!1=wx+vO& zhkNf1wei#J##Q1ZL_`C57XoTb@nKXabWcfsz4yU610d2-u+2C5mW!J|dkfcg_+LwO z)IEmIx<*$!?S=R5?i-~jVt7GGHFpt3x)jMd0fZX%4}M%Wtkt#lW=t2CJ+&!}%ZF`35|Az7K4>^ZZz+ROWsytlf+BZ(-Kg z6LU5efuZZS`*?)o1~aCksbzM38kGdizkZAr)lmV#*uNc^f z<4kzAzt`l`*%F3X3C}8+zm0_<^#Sd2^GQ*Abi;WOC&0%vKL&~y5RqjpeL+&_?RYAP z4wu@o`si|hXyb0yL1T{`qvne{F);3Uao$pEi`_v9=Y=0{KT-a{&eOgOWmp#h8d%@f zS{tW$v5m*3=u|cFn|=S|!7*hw-yi((_42+Cw|0H)`OIAZr9(JAlC)8AzF}?IU2ao< z7F)pBamBm+VuScY@feXW$>|#=0>p-8CYMC{&Wr%3Hu{u%OE8!)a971Rpk>Ed96)j)b!q zhXy^#@Rj!Fs*p~*GTQ(=&sMMb@7+iiz!n^&jCg#iN0V#@g(g{68#wwL&U@EKtoNKx z3=>#df@MRzOpu8ct3wNl(^)^o!@Zhi?4MI6F3}W`4CHO%pu(HfCgHZ8pEF3R+L*xQ z8F~AU4Gqzam*SI%4;7<8iDa$lSu6+(i`pIT0cX%TW0brw4m54xnn+Fa? zqy$ur6m;@6#R)7yx$o5($Roc?eGKwnEk+#V{a0y9oWHtA7lyffvg-R%!u-|p2#@<< zBYt}}-EO|wG6LX~957lnNM{TLvB2<*K=9R!AVak(Fyk%r@%7acJwNK!52)9|X70fj z^!d{hQMQ1g$H2AQ^~_Qm8&}five%o?_y6uh{OR2X=|cDquXlnY#IL5wG`;Y)c7_HR zt%`{*H>t1aP<#Ss)@OhVzuBQkqG(yAC-5!5!_u^J+o396op(-lav z=NzzSfs!Br$EIk3n*DS|!BSYM&7&7&!_-LP;O|e*ZP;WuweMbC7&OCp#G~)qAaTs@ zsFV#L@fskebImGd8P2`E~Pr{ zDd;i>MbWPQcJgpsOrE4ci@-_)9Xvw&Jak&RgndNCC!(j7&sBwf&6i~`G^~Z6rPs$!dH%}FZ z9Y^Fycff(lEHyHI0);kZ(7fpnRczSl-B9+#9p*V7U$O#vXu}@Kn|A!`^tb2&wB4P`9H!$eLY8FhAu~f5Z}pYzA_Sr z7eB{BiH>5$RDRerWBQjcDn=w5K2P;FY^NI6DzYh1qonrNdYROhjM{UE)> z=P?+P!hpfn=@mRUDTb!80iInsjQTf!N*-;k!R;Z}TIko#hfijuXKARr4>z;VN)BA< zewLP`gcGlvdq?7z88tREADUG>_)zwLeh2IP&JyBxmbi}4GAS)v^!yZ2+=zQXHG2GR z>9%49ixM_04a|#!GrMQoq;^xSpj6&I^0#ewr9+so#(PmPlZ9G#7oVz8g4n~CAixyT zLc?pBP>XAqa|`su=lYNf_Ub>h#f^Axw=DBoVCX+xJ3M%;*X3znj0)BoYaMbP#((g} zVlqB48(cb&<7~x}J$og?c7Ta_Ozl}WwxHima#m^~c{Up8mo@S4w9(H!ANgCli$2bSfQ|>TZ#=R}EsQ-H_j5zqjoh908I-al%SFXlY+?tkT}H zr;972N;P&7@r1F!Xs*>LCTHh7o0-kD32^R%>v4a#j`9g?vmL{oH>SPc<{*wiP&h*V zftxt;I`J&(E*q&kAQR&#@!}g;q0z>sqAWUTKrCe}*7Z@o!jj$p`y^t-qicCr%UCL2 zp_0s#{y?q`o;`NF84{nkdXC;7KeIjKa~HI^!cz%f&!dSx?5X#i@FO8*Qhf~|1bh7t(9IjgBFh^G zMOMKD!ohN4BlysXmf3-fCAj|rJtH6{w}b~*aL#IW9K%vyw$o@f<;Vn+G)3MFKA>Nr zT6MtwL9|^iY=a=9rXA^=9}r}mx26FzrKsXEN};Bn{Bhaani2Rx#U(8yq3W!~y?@$@ zCZv71zWkR3M_S{vK_Yce!&eGC>y#F8y$tazb`tL6<)AS)oWX1w57~^{5mlg`Uusu} zQR#4*4e!ycaV{(f{Xg$#^-n^@1-zOThCdKmUA%h+?)*VoU$&J(d|zy;p)@JS zPhqe>eRch@K|1cxUZaWHa-@SaK4zX$J_o(Jq03Y8QG~@v%|eJwUWZM!$*i($P7xpD z7hC4iCgis_f9q>oMfqrn%wvO49e1aU=5c`( zo3;RL8yDk?>4y)~xw#zZ@hJm4r0y)w+%#~F?HHKFjA5i9B{n7{jcA(RACEdncr~`R z*S_Kmk~hiS@Q5j3eEk!;JWaQ!**y1?ft?eXA$oI#_JuPVh`>Ts64X!&8cxD5uaS#Z zT%4B?M6e&^T-&x|!CO1RU=i=Z)to-}3Hr~>QDcadvk^YXE&@L2QnG@qzA{qI(3IvBLvhxioJKVUjHpjUvIReS}1VxGnuG?KT%d_L@y; z)BHdrSLU)^`mjYIC!x}RfBRyqai%QtG$47FNn4z))me=OX*de>>Ld=NpF+F@f|4|0Pb@@7OpQ46(?eS79o<`s zQJn4Sv<>hu;ZHTILPQP+tIW@H(y0OqWFJQ8BP+{f=L=Bd%+b>_fycHdu*IGmM-i1a z9m{D|Ktj39e5g_r#13?g-Wb7PV^t7nwQrSOD%wqFXRl*eX$m!!;WY(w}LSWJd!Kd z9Ap9=Zj&xb=cAKMcQt;?=nH)v48!&`-vK#1->;glT_4^ z9kunP$}hk*dC1pZy%BlZOR?&@)d~GtK;>xUQgRTP(kaHfG@HsNcJ)V01hO^aJynCEJtM^E7U# zr+)x1uOeru%mXua4GG7$KY@wt)&M!YTaZpZaB+XzZ?x?u`U3a*`#|`}tp&}7Y>3Ub z^i$g&i*%AjflGTSPN)P9nS<2YYi5+&S45(O(wt+E+HWWAgoY_&%T-9MxGxFjvj>fp z68M-DAi??kJM9g(ceg_Wfrzl7z&-a3H!Ja#EVgnTv~V}l38k|({*5Engi2{%Vkddd zF-Ai1F9NR8y&_!ka_WA!&?5Icv7)0i^LKSMEO_0cI`0Gfu8mW}Z9#pdB{uA>g1DyC zgg4tP$S7kRfVsb|fkX2N`&5ZviLgJtN9TzE2ukUOVhAvT$$zNF1`MkfIBc&N4XJO1 z6KTamIe&eOPXsJcqtxwh^}GY8n+D>!F`Tk0kC5tkA2P z9X7utd|CEyzO%in;dLEMWrN8hXLkd37)4TNT^W6pO#4QGL5RUBwB?ef1P&7Knr4FV zOwd<855c|%s@@OTel{Na2e*&s&y>|@Qu|3Pl+l4zAAAXa{}CDVXx=EnPm0RZUN-{< z9{p#i?T-de?Xe2O{kC_z;QrvyDWmP$r1;UEiw^g*9uMoio!|=&QFP#0@%7k4oN!nd z{wkx&$unjDsS>QQ<0d8kS4!>)Hm9!Skw>SQd1VQmcmw`R3F4-BnfdDYz7gb1@T7Wt zX}9TpmWvTh`Yx*}=t1Cs?Ijmhd2wjoH{>;$>h)Ug{cvg&B;+DRUNcY67>#?H8-mEf z7z+<~=XM2tvl5x(zdxkk(gMWM)s*ogMk&mO^S87j-M*cL zJV*&9s#x=nIa#oEiP%4WgKoyBQbv*(;nffux#v#;-nkpq)BSw$e5EC*${@h90dqwi z|7p~Y)9;B3C-BM_S%k_~T~Y)CCg|{mrVZ*1-D(~gKvoqW7D4gF(UO&Ra`2yx2b7bL zy%qc##qA99H3|-`Zzd$CM%<6E#M?cCQHiF8n_BIW$v(%Ru1(IL`b3N>oH2os6ZnI= zl{SqQJJpj&0mfIjTA{xwq}en7jB3!$w)if#PyC;{fR+@%r zhmCQj{i;b;!nupqH7mG~G||qO*DY_u>6On}f6)mE)bT@tw2yCN%`P!|Mq$xX6NQE~ zv}I-}zXlYAd(FS$?-eN*3UNjPLX;auJT&G0zv@r$93TWO?)gdmeMV${QZPUPmwH@u zm}C3nO{(Ymmlc4)Dmdp_(ud~1q^q3(7BFkcHfzmeD; zu-jHiY9lJzl|hI>4Dv;jojvJ6D?Si|f~;h)naSEp{>#SuU<2}s&jX%fw9V97Ef7K0FeJxbUL@Tih|Fsp1T5_5;zA~qQmL4)Kg2yYP& zUhf8kh{cR~5Ds2%hx>Xv$i>z#b`7X}`vzIG`GI*>kKjSI80$VSTv{<5X4>eJWV{=0 zn6IrdqsQSm=-|uyQJJH3ILUS`v?zLP2XCXT2bu?sw*WE6&5<9Z(>I1SCn!{>%)ffS z{3wX6*?sM=D=`} zV8ETiac<*6Xt?T3!~tpn8_-ls9;Iz=ve`7f5v=rZAobaw1%HLQPaxucdD2IB>pjE> z7qrioHi5t}rsHhq5i|7tH98Fz_cM8dBg&WE7!N-P22CjQ5sV9*=kX!5Lb_j_#B$0LI^o`k^Cm4F>1XliKCGi zTvR93$U{B3z(|IUQvv9N9o)ahgw7D7$^%K^Ah{5c7{5}|$gGrWXvfpcy@jUSkHv*u zR@*kP&2W9>3}dFKt-f%PbBx2O$FxMt3;(M)cL`L{7@ofgQLq~9*HInU=w0DKJ*AOz zXA+`hTSPj3VhAO+727Qv+*anv=5RiekoIK%pmxy#@8sjPRPUa0Z@zBehX#Lh1bp2( ze0ddbnI`A2Q+Y_zspj$G>Z&#U#LnA^>1A2OL}GuGfwAff6r~8_hs+Qc)!2>p&j+TnD2zp<>Oh)s2e}aAQry6z$>LxZ5F;B=pXSQ zBmvMzGT1;hnkI$dl9fE*Ha#7``9~^#NG`zEu#(2>@W?{~A~v^(Q6#B`i0ytsHJv-ka-u`&`@^FusiXjr7wM7j;dYcWIMXz_+R3i+n*mw7afb|W`N zGde~}T7N3_k2xmQy9Uu)HvFNflmtq0PjjJi+AHe|52;)kr4$fwIn5y>g4TkYXWV;p zcafn6&4N5P<|6!#gI(|Ba;T@%`8mc~JM<>fSlb;O;8smX)kGxQ%A*3O4cH0bfQPG$ zC5?yqDzV-=r0xMl@9=ZL1gTjF_^K?}QjBnY`e*#^{FB@M1goD3rLi)oEC=`nL zvTm)|XU}Vb7+&i|k_?AL@;AQ@IvW(vwC3q#V{@0$)m{Q+@ zCmok+c&<3zQg&ll2$N>Mq`U_8`MI^qA z384@GnoQ6O%4EUt?~}GltE0R&&2(*jU}IdJh|;3}H`Q#4yKQnp6l{Y~(`!5%VHj2^ zt>*NM)X3(byN*b=jf$1Rf_1l6J~h7JKpT%Sa}@v)pZi0^Cp?mqjloJdnz&yY43W>A)cs}D)k^YfD`lc@@uT> z7H`#b0&V7>tSYsmW6oO{&ofO+WWe;uiC$j56mfZ!SKdcYoMtlZDjZ4Z(D~fG(eh>U z2U64HJ9qjN$S|tsVV&eRN>mj+lH~SP!FVFCX${(v_XD&v%*og*m(`NU!VJ#Jqth2vK0{h$qGSxRL75 zQOYfDLv-8`Y7QO9rAGC)zs0|qCIHk{{&ao$k}^p`y0BqwY7gFx{;*WFoB9iP3@QjX z_OH~FI2AxN(5k;EubjalFP@lgwT9YUYXN|};Aa0J%ZNiD4})tJ^F0vP@4}gpc z-}@?6Dn2|^0mlZzq0x?Z^U-s!)^n4AIhEQEkAR=klJcePu3~)39F68n_l7Q1aroFP z14@KBdy*?~B0_09)8WoxsEb%SQImJ!rnqie z4tz3AsLddhG9YW``6H1c5FF=OZlotin0QQ!*1TEFbrt<93eZzrylao)~yCJ~oWZ8|$hjbBI8G;G6 zEWso5+32DB$1EVnHi7Z5Q&Z$9xsHlmPs*6_A0;89E{MgpEa7w5e+XL+C|xsPfK79* z(u;xp3#BC@wBS+PvIfIK3T*e?{0g)`Bv!<7TI4)~OaU`lkpSFs5d9BL|N0tB5CUV3 zQoT;~1eRzpHk*d6q9wjuHoKcupK-mvUx{gZ{t>bbOm<~lPTa`L_e3r_Dzk|JLf5Gg}C0pB6)egq1x*$;+Q-_+PT$+%* zB+F?RJoeSMCpn!)so88>-3X;xUSP z#`F-x+xcCw#`fj5=G<9l!ME8hzeGh*h(jfh z4!>Isfu+;k5CA5D-_zvD%>?B=aw?men8)8|w-Hsoo2} zJtWrI@izaT6$^4k9`kiHua*h_fz z{xAH6YH9ZMooAw4(f4rn>%dN1-s8G4Of(x9<}_f*$WsgTfZ}N>$qC_W6%le88>yMl zpp5dWHegnj3G|i_s6?4jPoc_(+xVe%2>%yUXaE%tapkgIT&?<)pwcJztSmz>6_E6E zwX?_;GDbw-3W=%GUy*6H4SEmRUN`3!e>RT7^@Sh9xKO{LLZ7|-3Vt6X9ynVqmFN$ z+Yz*bC)YM*o@4@nFJZJ1yHuEcDG+JkB|53J_PiOioezwa7u!|MtM(U`BWJ1W&8qV z>1^b0ZT~AbT%*!0q3+y$;qy}KyA+~I*_vG9o7M@ zD!~(AC+6-^%kGFp6Xl&3Mm54_|$o-r0oDlXc?txIk?H#RKV#Th z23L8*`pGbNRYI;l8TxsH*ADHDRFlg9nm#Z~842(J?e#0Y=s$GGCx~s#!)%@w=_=XM z65%@Vp;v~_QBrj<2G#>e^^ok9G_M_&s$roPex`ooaoCcM)4k=DJWCRDmmJ#9vKA$L z_JH?%%qr|+*x=W~R7Mio?Y8-Ne|xB%^j*L)AERv4PsQbB~2`K;cwdZ#@q;^N#gs`!T%>-q@5*@Lkh zfeviG-=WRYkJ!@cyg!M)sfC6PdC)Bi>~tfosp)jHXrZ6p-kLt{L!*ku*fX}p`gmz!il4h zqZa&1a}-cBQovTMfxTCk6#O>yxe8|cOv%Hq3zNo;pW3$hoiZ0&&oDP5R>4Vvze-Ep z)`etw$FJ|3_n*ibdO$j_;TJQrTU4IIMS+b>SIamHGPC~}4$RDBWyhIGX0qYeH3l&K z8#|U}_}*48E0NfblvKayg+#NbBJt*HFxV0ut=_*I@g zKYr1dQt_f)E!j!G%dl_+c@T-Ntii3x6Atp8vfH~q++TpmyhFp}x`JSC@zs?7Z_#@a zhlNsL!?TLx%Ef+x?rQ9J^LFdcZk*vDk6%~f&$lWLP2O8m=Xfq|`Zf(vX2A*VuOm}x z`LfXhnUkPA27_&@e!`vjOmwd2i2scDr6&Y5|2Gfsaz zu~{1>hub{H;Gv&mo^r7F1p%FEbxOc^04i_PLkf!8SVi=idMK!HpQ-N>3c0_-AU*<% z#+k4MHw}aIixC<2^}DZD><-n~>q6l-H!5C{7}Dy2RxgBZCi&OD%XwUg(G_xBA+I+< z+~=6?8uaCB*1oN6Pp}pZ@~aDZ9p=mLnd8yV&RER~d8sfkumhe-^z$ zMK;{pLNLnU{4kjH0OCQc2Th(!OK;d`r85jPz86P{+K&9U7$v2Tee?*sr`(p^uXPxs zI0ogs)$lD>ka57>lX1eXU7md4j}->Wd(*NS0HMb9#?zkx!Aq}uXUPq(Q#qjm>Qk4r zI(Et_X2;M3il}RplG57xR974Kig|a7+P#9MtfUMye!?VfMad7lDy9~=LC)650)oOQ zdm-^aMg`-;luHGH4q^E_D5^l8ftgfs`aj*>BL(+l1t{*T{?pB@ zaU)eI)1BV6zMm1BaWM}hwTXVys9a$|x!bmhXHj^kB2&T_0T?DOr?s;_^KtLif&AOQ zLC37O%H=1$X#u>#DBE_Lt-4DE6K%#s6=kz9ycV{`cp8tWJ~wZJMk;q_9vfnazyo9> zLSJhU5|D`NI8>)Na)9u#%sDRhMt_eM)NiwY5hBxA+;AY-q^fBYLE)6QrOdow9{Kw+ zzva%nH-oai^Hwrx6nS=xBs>STx?y7*AYhs=pHm$A#}k|;iqj=&hPfCgNq-Mp)iXfe zHY=AVX))m@CgLy>5r#Y!FrW@1>b1d_8By24IB<)nEH4RS`Biv3nrD!pZCa?#c=V6y zsawJP8M=FaHEiXk7bpB*IUgl&beo7k<%oBoiYso5AJ`%RG0<-kbBvQ82h-N$23e>k)*Laad$9y9YQi3f9GOqsirMHcjP(uy_X!&RO{a72fN;w?oVXx_+ zdRmExWAjw)dq0ITshw%amBwrhB|P|MFEo(!b=1|As|5y0(ogMUkUpCXC#t z1pqnJRo=?WAUudnj-6nSU_HBSg+nEO|NS2RMAUG=1O`A0rbcq%U{Em;#>^}XALUU5 zv3rs)Fi4YE9~WQO;x8us7Huj*^eWjbJ((INwz3nX4p%ic9Xl2fF3aOnKxHdO3wYl8zq46i(43uR&&aaEy#lb2VNy zjZPdL>ZDScm^y<|%tKsZJd;6;iD4Lzarex0E~Yv6_D6UA*faCnYyH;R-@QJ+z4veJ z-^%jX^wPg!Kx4bsd$ZM;K5F+yGiOUhon8Q(d5fM-r#hl{?@4Tq0SxbXrn3gu-s5>`Y*Eq_HF4r^i7H3Vh8V0N^I`0L0 zgPBxH(_>06WGdp>&HKiwxq#?Z+w}W``Sk29>s^k#OSqx3(W@kRe-3WhyQHI@ly*cTNSBxn4X$U6VO-OF7e^>ceqmni-tRT$ea(K6YE5 zm4Z+;*mI9Op%Gmvxf6$V;8fi=G(}^9MRs#SifY}{gR38wESC_kL%DhFx#rosHPK%q z8_~bg3G9L?5;&V+kX0R{Z0jd}wocLH4%iu4e?%`njGT~5w-44U4KI{ir*t?>$X9oQ zDbviuFhl^{7g)2SXA+9dL)=;D;7&|l;G=12!z2E%JtPv>d@M;axj{!YvP@E$o=uC7 zxHd&J@da-CRV4|6Iuw#>=y-m7u^1}_K%^aUDAlCe8A@(FK!6NQUxJ$BXa7FC*W8zq zj-AwXN|Pi<5Y;hu0SU3Lic*vbus^|$=FizBy5e;1>TKV@RN_wMc0|8}lgN}<^D{XB zL?_5qrU1Lh5ieVq>wp4IxHP)Dh7 zn-;q|55J9Pg^-f+^49^MfJEDcuu^2eIt+pb7L!NFB7aSqysXY()l%d&WRVwX&d01E z*BtmN^54*)ls!Ons_7zM7m}A|DvktmP<5XCTb`BLSCNnV8}btHq6D`n=Ce-8Ab;?S zn3vTV?3EOG1zF@pnhVJ*Nk9PqBj&%k!A17y3V;-OX{KWGB46jpxALqGe--)U|4Lp0 z9$;ko$s+$n%**NwRwYFqDvP{Gb0K--g&_$1?P&9VGWgjZUF0el@_@L`53J)$reg9U zU+2j;@vLB9MLzK>$TPA;!#p58&ewer^RhaFQKZN#%OWq*Tu5GXA$bW1K*l)#?F?p( z;kT%vlQn2#I)z)}X}JdR{*K)Kb)NuM&O`mZF!TdWKyODVxL={%e@Szlu|f9pb|8pF zd13QUKoIFYFo7RuGl$PdaFVxY&U~WxS)b^j^9#Lr(7awYo-=$n%Cd-H*ETe_sUlN& z!7wlPD7hl2HHU)l;}>vS?Fo?_Gy~0Rr-4&0y-N1LRBHPWoAECayMQ|hABA_A=8T#G zbF)5Z*Uq4o_7#E)lOsN8x{yll-29;vx#y1S)q=7RJ-DzvvZ)kV{LUhxMU^}}#=bQR z==-HoF&dSDOAKslxIp=IFZrbPGKaWL`q6j2YS7Qrb`pBxYrCofs4Tr0yf=ya>Kwzn zx3%E|CPv_>p?9*M5@2uT9h>bPJq~n_&HGY6bkJh~7`18)&qqH=CM-rl@y0@;+ z<0DOb*(hvWhY`7!z$)PGebDw+-nPN1ncF?W@55RvGQxIEubUYyX(?*TabcZkbi0sG z2)v-rqR{#xo_ZIX4!xdB{)cs_1KxJK!zYT(?Vhw$`+6g4nZUnc7`U_SH2`qdcKeWj zGmQ>II|Gwd<1T9D`8QRa@?uqP%~rLP?)PDp)-Zn|rv`@*gok!3!Tu=GTmDWv&8I}I zZL%vzE0de)D|o3~cc!xM)wq7r3|3`V0lWO1ZV8s{`>L)el8EoH`2&E``JM@}SDlB7 z6-n9;{E)K+gX?$s@Z=Q9fPmvuZ4WiXl6_4ESr;udG=cFN29mG$6qtF^_TsT$?)XQZ zr*ITZ`Bayuy|KTGC$((rn{cYyKY_Q*{pG|NO6-}Idz6e%NZ}EWCtXV|&VS_8HaN5; z={Ev}SC%UTRr1>TQ5Ca2S5}oxceOY0YP)SoD|#`W0O~0#IC2(PRZ9a`<+5A^V=+|V zecq12*=`hOhCI{gLKTu{YgvF2`qbQ&ah1{DwYtk9M_&m|=Y)09F+Rg~MJ-2yTi23| zxSh?*S;h93Jm&0z2qfSk9{I#prqsJ=wDRRb?KUq}DiWl~H!e@@hprR^#ElOgo z!`2DM+IbOFo53WV=B*}K4@X#2+~B@l=+m83(>G#+VSx7|jBQPzx?y_=gnZ-$-}!0b z2!3wa;@X2zFPjwP!PklmB95h~wd&9Txg}8f|5S>^`7*WTx^b~g z!($?K&-8weegz1`$P5Be`AZl4zART(1%aS~Ohdz>g3g4Rpn`*>I`VqDZ!q~KD5|~$ z0$H(0m4*{CwZy(^*K5m_;w>W` LzwtW?L!|I;YSmGq delta 21074 zcmY&fWmuHo(?&sB8l*vLNeStcX6afQq@}xSrMtVkJER+=yHgsZyFvbo{@xGomu0VO z&&4xm=A8SUxo4i$Jm}xK(C_7?pkc6}prGKP){(KJ-*+NF{-}eHzkEWBo+Ac-mFi)_ z`q?45@1Byk+J~%7qU?c&=;G$@j z--dy-T#_cqrqkDUw)Q+~rn;P+vVCgU_PG*@C0I(0Q)40T+g_WCi$%s1Er3hZFUMnX z0-G+uqWTYSwejVLES8$p`WN&ML1hZE1VZYz{qRj>8E-&%jPtf62MUb>AI3WD%~6-0 z7G_cZpPy=B-*&=cyn50Xyld{>b#^?F8GRg^+6sn51^Qd2VMT8c}By$db-N(eW8A0)q zag4vY;p+Fg;v{q#@KGB?&F)6TqyJs7UAU$=D8QeLgcO0wGQz9!yg##_8C_NwivY5r zOZ5m$&JuUhw(S7#-kO5^^kTByF66WZW(q^7b_UbnL*n_cJxjev;RE5lMXPt z`Sf*=GggMIA+S`7`Zpq#Qr)?@Ymq=b&&P(ZmbkX(1#){Jth0*>G>_tI4~)SIUf`gt zp_(pgc78xsr`Ig3-c+5Re;RhSmsaeEHHKn>I<}OzfBFEps*_lVD*%zs5G^^iGs8>D z`}xlBlL&jeetbbL_jr08D(*?}us#d_W381Y|GvJ0jL3)rfrNal1O}?npLjc*QIUb# zWWK&GL0mX*3w%+$b7OtH)w8{OgwS(sdcHBa*r4+b+7F1$1+>y1+*1I~4Vy1%%-et) z#@Y5?<)TpFQl~?XL%Bofv(`@vhjRN*d?qc6)X2lP`#~OSNS`AgfWkRddgwHkEQ`ynui|-zT3Gs0A7~rE=4|vs z(>zzNmaU4PF7CQQ@oTe*y2K-T_6qjQj(;w-BAC)?Is>VXO!DJzf%+M&%_q*WvK^Mu zk~Balznrt0*QqWiTyv_37piKL`~-~m4$01Rd5Nd!P$8rCE#40JD2L$;? z58W~D@CoHWFNEEKNFhDi?Ewvxw-iMQXqGV*yw85_u>A1btcab38ylFa~NJ;`)caek?xx>FOQ5 z$5x}sXtWUv&dV#dr3WdbV}W`%SF3kPY~?`vj@js>HuX=!pUF zi89a}a#AvcdT(*c3JKJ4I2CgGL;XE6tQ2bl4F04K2{bS$vD&ijTfT?*{Vepvb4(|D zVi_m1c>O&GDdE#Tn1OPXGI-(?R7R-ob&EZ`?$dG z;L?^wb;(=#-2K)>+$5rE@yYIk<9JwH@MNl0k;fUX%a^YBl6M0W3}C5lCJXk+*V(?# z)llEm=1C;qN}4RU0yks&lTiY>%)@?)mEfT;FdNbY#`)PMq=+Q_4Y>$?ese>m)3V(5 zmXzqt`0|?Oap0mUlJ;ilqskCH`)+p%_}#})nwQ`SQ17^esb~%RR&z7!&;bR)a<5L7 zBj;IEQ`IhskUus{(y+`WiKoGzbfXnn%oOL&7X*#y_JljEqj>IpSX?kyyad_A z^fp#&1)0ZCApDIqS;Zfxg_5V`+e5x$C-9Eab95&E0C;w}5b&$<@Uy^g!;gD6k@b3n z^8iAgX>E|k3vEHqAUc|c89Z!`V0T*m901hUFf_#UG5>@7CY<_~!i_R48@!0E9gLqH zGPcTqE_cIr&~HsDaZYKcchjDhQ@!II(K);xSU*_Yo&)K5)OVxJaUQxU^aJUoKZC(h z)Y-k1X01_@j`;Sta&%R}io{?BV$p}9BI0N&L0SY$ibJ~YCge}-cz`;f9p3AWN*Tf| zP10r)KI@Dv47ensH@*h7m}i=4!cOyeq*sosaLT-SJ-yllqeDxV`rSVAkrO3j5($%W zta^v>ddZX6@45i8O5b1M3yg?ov6E1M<~hvzE^x3yx72pBHI~Hq3I=iE`i5L7-SZ?g zB)ARZIhtkoOQtzi3s;knFP?(r+~8s%xA3(o?-?rIVbBb#g2HdY(G6r6I0Np96$(6f zn|P#mZS13-9Wkhi9f?ptr8}p|4eZn1{En*XD;O>`ou1i@+v9ry^P&w1b3rPcT##tNKzqqQm|Sc&EE=e(L1 z4ab$3zg`?2797gVRUR+X(`Hly{&bkY%E-%?1%03$sw9&wsFS&G6Z6(D0bl55^nk)l z3wHt_tHpHx~_R)8LB?gNuk>cI?oH213oAvrJ zmhT85tR8a;r`T1i1d{@Nl7vc!vEj5705pr$km~rH5ANrrB^*(+nSZW!=$=V7LJOS| z6zhrBv5wuah0)|ZW;n>(Djx&ovlPU&Jnyb0Hx-5G7>ylr@%IcOqO6VJ@uyM%-&9y- zXVKjqLCeLu(Wo?{NTO!4K6QRun zv$f{WlxR_5%ZP%zaFEsBJ4VqEl=7^8sR^<;s^%N?zbT>! z*NfM0dxPaCR6_yWrhXeF$_9s%eI+HEG~V{h(|B?c7ge{d$@iMjMHi!uOKV36EVvd0 zS4BneYMEy^sbQC_Mr??yU2FB{%Nz1>z~E4%2|)t3{o)btcecg9QO^E|+G~|^v>+PG z*9VP>%wmt*JJLT**|uZ;=rTrrPln!|Z5wsDNDt87f z{l>=le*46f-YgV<3pSb;OgUe8xS4i<4Be|{cC71hG|?X`QMPe_gZSVi=N0y23=vT- z^T|czaO5i&LnX#hzt<4&cTP(6eT5hb$__dcWp9;1<~eR*>V61fh5^=O4hdUK(#12M z4&joykoAet39RjEF^lk`hB4C5WX9e)oD(s3pg`q?59{-i9fdABRU$`vs*^l$h9da*hjD&h( zqw`3AW5Xaz zA*6mz(Nb(^@FD)_cdQ4*ra-~E;WYn@vQu175Sk_b1`GVR)2|yEr5V3zwvbb$PL-C% zHMvzTQH-!7H+EM|M_2XsnyMe-mwY7@Z6)aW!t9Zm|Hz~{5y#hEa*Hu_z<{_tkED1@ z)WOIC(iOMcP`zQPhJ#L@+C$whQ{ZSU_@g&c#5T^e^4$55QzmXV8@z1CoL???9l~OD zK(vg#q58`j*~3N7!AF&3v(6TEXa|E2bu83G3(_D&!n?+;L-}XJYqz*c!eK8Hi<}L| z5}y*G#oiM(uzUq<-S?Rvt!gIx)OACsa^T1L!-vk5rmC^K1U24ZE#5x6^EweZ?&90_1!+4!Y*@3>N(ellP}QJBd~$H+9r5FLT6-IuuPt|=_l&jo}x zudet*9cS@tty<3ee~6+}YlU&VAezJXkkaNAl{`#pjLzRC?BoSU)E?kFa0*_KCYC{s zIf$@ry01y_gq6$V&&s@-KdH)Wh3n!^b*-|}d2UK%#&L`UBYmp-99%?DVV9j{{kz@( zo$VEwhp#?I793SjJ>{i09XpCHBobg4FUGXdV0ukh?P1dA1pLdqp53thx0$V|b;xUYdde_6?}mm|I! zvKZ%5LF*?++-$a3o-+Tuc`5C5z(J=d_U1CHrVK?@P`;1O3_MotgZr)K!7Dk234yc+k-!4_qu7bJGE_k^0dz#3l= z(Skk(kOe{vf@|Ly+E3xQ4-#oN)dk8?4=<|zggGFo4Io1*THR(vQ3I#Fs?J zyleaooOzB-u)h^Tw0-lAJpIH%gnyQ{RM1N@IL3$d%;a=YRfAFhCpBLoEd-ZBvQHm| zUciZYmCB>>z(%7YxJ z7ln*EZA7+Ylpv;W$nXYrI?xgXO>Rvch>s6(>NpGqys?NJ1xj>AP0 zy#;d)Qn$|267$4Ws;d$KvlcaT0iV{RC%)8cMYrXPxXX{Wm%Iyo(!!-|$8!5Q7v_>b z70dSNM+AptFH(=%DX^ezaOq(I9sULMtd)z%g%s;Q0E`C%r(PlrPZ`dISmpoY>(D|j_aAjoL!20iL&P~Cj?-stT405vA| zTEm5X_^!z=#8Tnu?DB?_5+ke)s=bD=iN**2VUy$Dnq%mYJ7X&yOGOeln}}$wqg@r{ zbaemMmvx$R3pB#5I}U(;k<#R8)|(${*W>gV*j->N)ke}dKK$MYZ?$-%cdf>5{RP!n z$%FLp@$uP<+7I==akboNcA5m z7Olp}#GD_&z~wke*y0+iEz&hEAgl21zdy}$$dbkmtiB#|AJc0* z7FS0a&kJWn3hlFH@fV&&S$*(vOb0X`DRd+Fq2t_f9Eye(rRK3!XKZ zaFl8ZuR0ytMscd@{a0*Yx0R| zZzgL#8+E!4UwZSMFdy1=4Ad5`R-IaOZ7x*tvXtikBr4#_Lz8GBC7mU3wjHfi-LK(%Dp-+2Sf4N&B&MyQIn-Wvsk5>Jg|AwC;o`15P+yp?16<5B`U1da=QAa~~v&z#L5 z_?CJ(IlnXI4k}gs>DFvotP__`RQ2bt9JC4!9l!~JuN($aSB|J(45hVMe6$hqxxW3+ zKSV26w}Xuizr2b1;B0l_;L;lxtHvcHhn*DPgeHr25pVRL)wJh8B}pEA ze%Ns>e(GS{wXN)l)#Ym)c8sX)qi};rQtvW49R>b0%8-3M5wF~Isx1f4lPrKk8~CC! zT3akAF)dbgSNUFf+5ITT#9FF`0trC|L+4E!A`s)=2sg-?5d2;qbR0Buzp;ALK7Y^)AI9JS}B(0!`a1W-4)7i{9q5n9Q_(t2d13 zK6z49VkgwJXt< zKvZT5P3JKAT~xfBqRw&hs(I_2z3RcD>>20A+y7+cR?TivmJGU$FK3XgqqVvZI`x2f zoJN_o#F}0Tl!!reMl^W_aiq}0Ul6VX+F)|a%x|*rCsSkkV%x_{QsrVO6eYP#B zg0N)3K)vRSaFPKIF_Fg~fFHdgZMKH1>9N-Xs-d)^{cp_$7n#F-XpV6n`=5Vih`TEa z4Gl=MefmnLpx*kcvaE8=Bbt%#B|CYHnSG4cwy}+n_Y%k=2T^ofd~8wTDL)PN*RK%r z|4K-8a$fk%9pCnqV;Qvsk;-+6c&^lu;pUkM9Nyky!F8j;+X^VpvNXtc`qNj;@XA~n z=!wF*hZ4p;5`}>iboA_AF*sV-#@dxH->b9o1##*^Tuz^Ql ztrcNA3S4_C#UbopsMIjZ%4%6wyn1}7T5jj{&0Ul-wpfgc4_`QNB)=ujz>BZnj=bI= z-=CX0P94%PYd}CpT1LA6*gtq_HO!~|r-_JUbj+8N4GvO)eOiPA0BFed=;Y zTiM~-ZD0)g_D%6p0?%^9ev5g558y~fv+{OzdCR~0AtQ8Dz{Y7euFbqDainQYa+*eV z$r}QU6WZ9TV11!(0x6q(_Qwy_3|%LKc~>U$s@?yV{3~==j}z)*Wuxo1n1Y~XA_2z> zSnQ|%9k$c1g`2v-c=f>?39Fz!$sKZa{zLI)@k$QKKHN6|k4AcM8afs52_oLEBUIpY z7s+3oUC?LDFaL7=;id7@O7C`bka28`3YIKZA)jiNr3wgtdSe&BOOBMQ3C}DaSgQmE49(13Hn3*0eq_4 z6d=Zle+_Tv{_@-z$!L}8c)wxVB2ae7XZpfhCzsxDtDH z3u@Zo%2V3r;zR~-egP%!e7;H}u(uux+Lx_ASfTrw$0^fgw73<=1WbARN+~w`8Sx9n z0^@HIM_li{;?v=5+}^wbbq!Cl(3i$P5%M~fJX_bzuI3iM@KT3QAbh)BZLOPUDjq9vH5uWu*4Ac}&3=|=(?Rx6DAS}&ZKNgq6QZ_|HEvg$$QN7c`ZA+y z2mNK0ISuZ3p`aD$d5yHz{OB`xjHYB^qiOGv*jZtdj%WC?eRFn{55*e8$APJt znM0!=h(9>|&_1HfW<}yo3DpE^*70A$5~W;4f1_ua9IK|1jmCYc*H*KS!GdV}5X$ss zYf*&Le#^~BX1DO`WC@j5=TVto;ImV0CX){9MsVfapZnIugSNaaNr`E%U;N}ly~%%- zedF)-GHT+JA#t`-7%5cfG{XfS_0;1xXf@d^;k8)P@ZS7`P%!m0!)LN|vd`UmXmCS> zB!*cI&-c&EneMzo!qvIC2O0w@y#_pz{Y!SjGBA4x`#1N#7w$cXl-mJ}Te~hJ`3U~# zlUdjqL%S2RafV0@oH16ru7fMpINaD=+6q{Mw_jqeSB7Hm$LBQ>gyd$mBrRq0E493Yb|zz|CXl{dPNJ#a5CVSe6k1L^Seskc zoAE5Gq3^NY%_d%2#fQg82dX0v)i`NJ7TagE& zmK#@c$MSC58q5L8&zYPit+h|hroh@?iSB)*78fa}8=jM;CJ64bPGM7HS22>dId8#` zdnB|HQOdt*sMq1m$Hv~Lf+%e05TVJj@K=GFyUeD#K3%)Np zv(o&>IBbL(k46?2mEy6@KCMGw$zQ2yyEn znl}WyB}F87$*hcWGWUj-KOawO5ab%A-Si%hcSRd5`em9i-Jp2`-aWpuHf>f3OL>!S zrWhMzfXX99X^tO^cq?`k-_5oVr{IgP#1yOLwv0HQ5}KPqpH>k=ydXeCf} zH-wTW@5ME5^Q3QsYj8RC@BQcaU)YP{#8mrOvRzW>81HIFps)WR|F^z2WcAe;XseG_72r7QtAqP+Pvp zxwphEQ)-0H@;GZgw{u4KZ#v3Rk4Gz6l$-aXrEyS~h~KALFNC(-{-&0JF)FC$gvBd+ z86B(!R(7^n=rAUha8DICpa}q8COrl0%32?qJ}`_K*)U&o3d_a}L#Z}(VsiT392Ic( zjr(Sf4gdL+GF`7^YA!Nq`T`D+s*S~$1-%wZK{LugzV388p(afo+lDmP9c=p{p3D_l zGfvQ(f2nU&ie`xryJ$)G9qD}3k}7+Ni~UFj)-hE`&C_U%o4}AZ!JjsWB|0KGgsMI)NF=1}>IvjK%#@=IjI)RFSHjjB0kg}>$L7&?f z;<0(WHeThgM$z7BO*mSX18Q&CPFL?pq*@JBXv$Z!z5! z91TL;B{bi#K>Sb|Ry#+ri1kW}U7Y3!vWhdxwYuSaS9{OJz$xkq0fs>v+IO!c{g_$< zL$u)-fqPr_HU?I2kUn+}+dcDwMcnD6s~8LXAMd%ZDALr>DAM%7RU6XzUA)jt9CIP3 zJP2KNNr)U#zMrO-8xxCM(yb;bn5N&E%i+eyI}B!1dn&FiXh8gllTBLv)oHn~XVhca z2#iN5)lap}fbM@8@8}4ngdo#sPfSq9@rV2lP4>3 z54v{Nng$4)T9YP66!BIk;8`A=<^{S$7}#zG^*jeZelm`w2ID^?*c@Wo(zPK+c zP%n2rCfPBz*Q`i+hI|PryCV`#VE}Xp3Ju z$3b#vd5kDDbsmc8a&)M%=&fa}0@RO$1<8$6z}AvNhRbDNX5(&kViaQ=-2z|@@84q3 zKC*=$x_qhdVXM&Ywxwc|3JTPgo`ywO1-2if48<*FSxIfSSZH*QVoBWCMtRM_8{SMe zT1>@ZFj~6OMUj5QD_4vW0qqyk-N=Tq@NBI^7X6!4;j|hgT69tIhTh^tzPJwCielEk zQ#O^3cc6?_X5ti&N6<-2j-YgnL^d)UO*eo~E7+*AfD1^XkohZ%xq$iff(oKL8lHlG zRr5@Z5yWoWIS_Hc%Wp^|Z|F6feNC^rNmKr3ja(tS8`uv6#n2iJeK z`lHcqfwEd%0H*IO7?4h9#4SZA;>C?xq}mIDDHI7~yj!7~p`byBG%O+4+xzL4*T>8z zptV4q+;PQ9+9@=6Qo7J1EBqD0V@drP*5f*lF|Pn6Pt$^3W@V_kDhM`lQ!#q6XFlK@T1k=19qGrpuZW z)~J`VAjVLWwmz_LTsHt0son!MQl^+BT+S^CLh+z))scn&PW)9R#qxGME?m>I^ABLt zvuAuklOhQjf}ON2Y6iO2@WmCSC&-`IUIn`?UesJg9gW3MfNK@43`DdCX5Zn+xJKatE7CXTYJy)hE8yjKV$ue znyHZIpPw6f>_OoLSvNYuK?TaoP~GMsm?_}%gty7!z#;d{dG#TwkY!Uuvs31OMXC&! z>1j)(ww%(Iua+R>gMf`T&^N<2Xj9G4Rsrj_M_lcRJv#p<5%*Fku4!WgAsTCdz>C8 z!tU$ia9`7rm4S^+EkfqF00^!O=s1piT~80#S~m>MPZ-K4IqSb`&Nkej(4z4P8^ zK)3gYVg6oi7_l}rv~aT-b1~iZOTeQFG*H-jZ77Iz@*4bH(V}Ytn4QlVBo-L=F9+LdQdH`bj z%+1Zkfm@Y8iEl!1#Sg*=_9K#0rk;xbqzryXRtsiaAo;w?@0p@|lA3N#LU4HY92#7ppHr738OyO!D;7Kg!5tQJumje=o>N zA(T7QkX@qawym|U)IoGLL)E$%6fL0*MwiFJiZ*zy3&|3>mi+Z%%hFB zQTUJz#EW7brVcJCFhq49VAFQ0@lkaAYi*REifLpS)kN;AvFeZ+vH<;xc%9LX&vy13 zdt*bYa{iioNzg+}+7-**Tm?}LTd!$t<<8|3w8+WBgJs+s(G&dc47kLCkH5oUZ2sEF$RT{1c zcjEVuJHC+k=|YBjxSa#ar1(YJNFZkh3>MLGmoj);N8OAr#AE5P1)QryStLz!Hp(PNNl?qkIqH_VHBX0#Wt_7Rd5Ykk z^0V^V%}`v{^u^%koL;WN0^?$y?rNZeew9gY8KWs~ENx~^_>iXHzo&%!SdR_yv zM|^y(bXg;C7BY1Jb~jL<1_wmOUzhXRO&Vfe1VtL%y(V(!@C=8IA+agSdV?MVv$W)< z!<&;sQbT!Gu_b0l`Y0sBXa9BNBd?r}pK0oDP<%y-0S0VqI^tbMXmv<)({YDy-MuJ4 z_+sxtpmx!@P?m;$hJzrzKrDkN`?~LJho9!TWs$(KCUbuq%7HOsBhhywElMX#4^>7K z)#jNEEj<~8sb++=sFcRvLV*rP2T5`xy^n#1D)@QNBT0xyWprB$jc<{buwj~fR3&z< z74Cr~*^a3(H5brRmJP!z<~*vpf;|6K{2^KW*h)onL=asKF)-dibjx8hjzXyr?37Vn z0eEa%k%|GOKM=9Rg=L4PidgB9u@B2_;uzTTNkcQ2(=vuUxDTZX5UC#AsqNxS6@|)y z(mcX^izC4Lbx#?UxgMDY-SyEvNsS_ z>%B+BdDj-R%oL~j;{$m-EEN2W>L}o>`|pKgIu=t8`e2d{VlD93g2yd{-%wH;8!%fA z6B525C;F`#@n#?zFYadQ@nz3jj|fqf*n#cHeD3SF$HQ;xzW=y*Js$}TnYXr~b2oS_kEP25BfY5fO`a^CrYjN^%6 z(?q`n4Le17g-OpEh^Zw47*D+jM)n$y|8;CN{-w>GFtY0U1|bSDAxjv7x+1iCT2z8Sr5cTL4V*xQ zNJ9jfAXSy<4@x+K%5y%y`#OacyD%K!A%n%F@!%qHTBYA3kYhm_e=himEZ)GHAh+}| zO34bVc*TQ2rAz3K~eespW_f?cg!(`LV?Q$(1ve|@q8 z15n7<5uUU>YzJn+?F3af3)#Z*ZI2BNHIl^Fg%rGxi|FT75`Uu;PaEwJB9 z3yG*uGF8a;oI!nYT*MvrsLk>7Rweu-ja*)pm>_8j^E+SmTv`%_F%dgl^4OEh5iYbo z+#4fQUWGK^^&@ZpN44A|UGYHAaUko^Um3kcOr3qOmM`lR{E6V@O3h{d0%m^n2AT%c zt+z*TlqvN~gy_f;YOGVy=(QHhA5y>%uuP4r2{sqnqS`hBcw&eJgi6>Bvnjayf6&OVmXf31_^i#R{z<550s#u7plE z!$2@3aSaAu4g9SZL<`9;RvA%%+;A|bp0Z@p8QWSgrSTsj)TkfMu5qp-NQYqqLXg>v zGkjAH-0lZr%-U)i>q28e*8EEu&97!4CYZgNpw=TeOCt>XLp)o#Rcq{FYd`z^oO7lR zDA z%ia05eV%?yP1?l*55HjP=RrhZV0l>BCGjl5iP|K`MQ@XQRNnK1%nuF4gI(6&pZa(+ zh`mUh-u^84b${Xz77R^?AId$owe$l2|PO;(xG?-Z6p`OG zpp=UinhT#k9qitIJFUMZ@kG?FPX-}Jl2F7U(*WmaQ`t7lV)=sC{=D_I=RQNQvTWlu z2Hl@4e{QkjyK)(@Yx%h2cglK{54XA3RIgI&-2fIJ=?<5ji-Z@ zz}-f4`W@G%LMpa17)vgA#U1&)DEdKtgjj!l%(r93w>yV(OU=)n$Rf z!bQD6TURWNrw8y@`XTEQ+hmbg!@0pC07BsbB7Z>7tO7c|`%;r{ojX zjqM(*(beD3G#m_5g&*Upl`(Xr*tbBynA5ohnBPBfAzXCTSUW4vwd9VbNC-HcWHLCX47Gs5W$BHrh-6 zSX6mj{$#XO1fKZyd<$+#h?N~Cdy}oQUQ=AMQfaRL6#Ts3&n^C{XUGxO)|Ay^0}X!l zCl1F=W$B=gm-;$@jDh>!9K3T}LjOj@3p)z!kqaicxRLd#y~kAT>S}xLC;}=bEp&1; zzL%EU2q1}q27@$)$5YICO#@YB_EWb#A?9vG_(s)(_UveZb$KWW{U zsJC(5H<*n%Pk3?7`TC*M_I~SP25PqguOj}5yO{9Uwu=^`v$5VKAHd|AEWcF}#sJ4k z>Vql957x)1^f+X%MyZXIUDcXl8y_KrtD(u6%G7X=24&9Xj|;hYF)os*(Tn)~yPc>O zazVJ#A4ME+4SnF8w2C-yIt!F%3?qCgx>2di6bjfMVtYwK@2eLkx>Qh5FDUedU)zxD znfro$2Vda95H>*V)Z8rwsY`SRaOBJ8CgdG?k*Uv8fcEdZ5Lw?LR&k^K$6y0|j=D^r zt|J33*4H7Va3Xu_LmlG$M?#s`4xwF*8a6Ea1jz@q`~)3g3$eTu!CebQ zxEqlQ+yqzNUeL6~OZV^0?+HI0j&yBNXz>5F&CIK~LGICU`lNSvvs@R=&SY4wHFf^d zsrI?b>UK?Pm-&W_;#k@q1RCGFIE&8IxyTvRPI-4<#qZ#rp@BA0;?+XM`{jCf3M^avLaV3v;6+>QSb1MX_mW z^>7a|j7wIRbOAt>Hk9O0f?E}^V?e2J*|~EIWhN2HxsG{AZeA?DAh%*1x zqp+>&1mZfI(cD8CLat@0Dy2y??IeA5*+%k9&J{xRH2)Eb)@p2Az*ckLV56I1NonJf zUS@A;p)iz> z;*Og1hj?y-19J;!Zh<0f{)%jABE^WWVv)3rniz^!6X3eOI{g7Mi6&F%-!Fo`C&!rD z^WfU!yvbkbybNf^ZU8X46RWBoHhU)6rR-hX5AO+E_*4FP-3M`gzk;Tyr5G)~;;woD z<>1nH46p#uV3$6R*}dra@2Y=qQr_*u}+UHd*&24NF-I-#{GW>0p zBcgy>7WtiduEPq3gdaDM_FwF3b-+Ka6Wyl07&%s#0+bmKWuRM2fpM)ZiGYiSM7y3@ z=s>6Oq|#KyT5M9fvLkgL9bMM<|rSsw$L_i#G5D^*}{+_8eY$7> zZYdh<;`&`o;)}R>5e~ekd09y79{ao%n?#FxY@EIqYycx6+74K&sqvC+{H)QYrxk}~ zJ7jYu@&Lza9G%5C557S(X`w0&}r1IX!}aCD(aO>OepsoW^qiiNQ#mr+#$e0 zt8!`!(_?q1t|iDD8HIYqoUdg7)@*;AG! zo#bz9cjC#h^@g^ai>haDlE0jR& zSnxL9-=6Y|#Wp+8c3XS-$1>KVc|f2Bm_C!guE&0EFLAVhE~Rsv8R~w60{*qiYS{3p zu^jH)DqkZLDy^af)gnry8BUg1bvGAxvJ=Ys{MR?$o|p20@6g8Ry;D|-%IvxJi_r65u=6U&v@7Rj%9DFBnofM&kLDt7tebIfM6ulAvc z6U7W*OTnh87QpO~!%TF{!1{J3QlT0pqCc%P|BbDJ@!a1=f$c&WTv;Lf!9A<`I*CHo zKa!ym8Ub_kyeFM+@-(wKYp*FO%57wilx~azS|j*1X}G@m7#aQ) zG=yAz`G>-lv^$nEb1B`%@=g5K)9aj_UlDImY@>zg$nbLFlSn?LX_~0vEUS#>978#s zyWl+99{9hx7uwSuu;1FJ7XuGknGHSq1=vXuL`-N$lFmJ%n{<_sr^zM5JU{)UjBD=FnU055j-H&J!$Dal)|#*(Zjum= zwep;uFk|=k+gzKqdtbfI>+X-e_WSPp`|SPj`F_5??fctz*{$GTuigIbc}lIHz199p zeOyM}8ld&YfaC4GQj-rdOsANx#Rv$ zdG3N%+23x|bMYZG*Ul&DCAMkzKBP4$@n%E6Z%5;o0$^FNt-Md!9aNHO=IWt#+&tUw z#Wvm3FCS7!mc9OK-+a&vV2kMyA`ZsqnesaQ*=WaIM@vp}%$9TE+JVO`HfAkx==d}n zBe-t`i`lvUSy62(G6cnot5l&Y*zP9ga+f&3PWtED7(jHz+O2N2c0T z-hKH#yfh@H;3nzg?eL!PSH1=ArVi^5e5=pi1KqDl-c*JJQdOa&`TwA`H|#0gYWvQJ zfJNl{a#!0;BI25}hG%N|@k*BwTpPkB@z2QwM*NDnjBlH8CT8?zq+K+klG%Kg5UkGB z^~pFw9W~*li!YfCyU8$@>$wTU!VLrtqLSVWMlka$MXT!^zRr(7U+4fI0HEy&yvMI( zX6Y8ca)+~am@%6-5=KmTzvxgH#oLLxI&JZA8z1qS7I8A$bzPuqx6dg;p(SBtN5uKU zWve<2Nv@k$lpI42?h)Uk2%@W0$skqs$aYi7*56%|DEe6Or*>c10ocFCeLAmE&@({hQxKJ4YpOKW6!icv_+ z2V;XLE%qv`@s>7)5!R^uAM1&ho00gvGEVu5!b^by@9LF{{r?4OLvOCyyq<-HjDF9? z4gFw)DV${zkyZ$17I3Q02bwnhK=GvsW_}GpUwH%(sp$(=?=X-Cup^SDMPj~RX7^27Lne=j4DjdIEKvM;et;Nx>HpQ`dsKsSPKtMLfR?{*ZWBREmQ;?pV?CHO@+-p9f!m#>~wg)e$BcEREE({@2-=lVhW_Qc_}26|J~|G!!-t zd#1gAX*y50TKLCEjxg%hsuaZyI&t3__+j4u<8sqD!+#9uEA4Mb#pifZM{9zbJO|#i z{+<>;y%*u-!KKGzEIkwRJ>&l99j7?AOu2Z@3V#3jK_`pTl@w~R^JveWiIgVy{riS{ zJnLEG1}oz32(|+u1vIUy@CG=q5$+8Tn4Ja2`P$Z|uwm!1h6Zfuah&;Se2aBWUhLJH z)L<2hf=-|-u8bDCMQCuJ+oMgc|^#`oL;s`yVX z0@Hy;cKzKC>M{P=)Q*yOlXi>)lR4;1sVDsDzW$cC=@-YG=UjQJy+%$UABP)SZ4*@O zeg%Yw)of6&Gu~5&ClY3uYF-hO#AxRxVxH@`o0E5tbXhT5c$qg2G7wVsqk5oVANF-$b=BZuyb>UdMJqvKkh%1h;pEWQZ; z+B^7N-4UNME0U0%_3l2hJnv-1-{W~cU;;(LeX<3?u*tJY#-m`B=rc=d%4}5J*{Tm0 ztJq(nFs|4Lu6^*FY%Np-0qYHh%89lBQ+W{UYS2dnDx-2D95N`R_2YyhX2w52lbU_M0XJckmG*vdr5#KyaHW#NSgR1G!5 zk&j2S+~T;lCt#JYOg;%K_8=C0DV*L*>t^(9f21p`AEZ@%v+XsZgZMcbeN>FDnsyIo zcJao!7kX7;X!GU|Z~t%QZhrSWg#R~cG00Z3*^t1Xk$`}p0i)(=%jjxpW@q+)-^~BS z?YEY!10E-GAJ$2L=7ru`JE6pZkhZkfS|bWCwexq4)O1V_>cmt#5@;pza(!5IsTh6O z`(;sOHX(4flTyJSLctvGD0zCl>8NR|QE1;QD1^Gn`*HkpaS$cDHR|)o7rBOXk<*vu zkE88yx#Bc4zQ1>QIrOVmWrrtH{U!yd=yHx}X0C7ueqPZ0N@P}O0KKhT6>?)uckVFK zA`P}DuWKMtFsd2z3?^su+CFo3h4)6Y?rhU*Llsk5kWvP-_VDIMH8K&@IQ}CO&uvz<@JSA0-TTl!NhJDV^t2DW(mp9r>aI3`WN$#yJ{4-&w5h!hf*I%! zYFtQ6)Kfj-qpKz(ew%ey`ZKgkcmCi^Y0T656b+tHYXu^C08Pyd&LpQrl<hddhmYr7+5M|+f8Y0e z9e#cEn|lA}vn8T{KIvXHOTWj9r8^78{?C{Cf&%Lugm}d0YrkYeqm99_AA0EnVC-l+ z;Qj(p@7O5fV55PHAnPpO0zH02o;k|bWM2zJ)D(g16A{qpJ{k)oi-GqLP{KOqF#j^u z?ap0a(;YpGo$vE^7NFU?Bz66s!>jA;=))FzP05pH6pNAFjouUY!ZkWS{$mxyByJU4 z1ijlnC6aZ}d)`wh_A9A&%0&uzC03U(>h*-CB(iSps`+c*oT*xQUs!?~xh`y>Y4gC@tt zcG$}rmR*i9|0bzX-P(yt*2BxSEGgkWqb=$UV-_E)h-q}XDnpzJms5QC2CsDpxx99S zsba!zQ?4mQowme*E%?~xERxyw7g<1!&+EZA)K2W9jna7|Ll@MNAoGWMQy z%^ff*q1~C^WrbzmkbagI`rU!vKOK<2v!BXORI}6hq++2bqs8F3y!#PiCJz@kuLn>0 z(@fn(Yw3-sI@`_XxhcJ~#*D!xE8*J&9RREPX@qhmIrsENF+r(|atz%ess|c15vq&e zWD>74_&KHA2)=!x5<|D3n(i;pJG(Yr}{ZV<;+hjM^<*C~bwT$1^=^A&8lMAp>A{~|F zutwO!!c7}~gMD>N_jT^AY&1(qyEZoLoU>|nIAaaRJs^u>mYSSC*HEzbDI_OoTFW9W z1&yeZ)0@-tVtx4W zf3ow(e2tY)wUpdO%Vl4Mmbx0M*^(|V;>t9hr|9d2Iow)HpJ)`ktbR)A6Il2w>+>#~k@8pI`ppQsy!4%^o!g2~yWf4TAlDrOd;@ z*~Z1v%*@q=@!y|+>)AzbLdv>C^4FL89dj~?dGU8W)p zkTCn2RWU|k8SAkh@4q#)z664Fqr!lu9$$`*ip4I;nHGZt6E#)!G2YD-0Nx|czD0&S zJll6yf3yVLM63_*ekiW2sC(01dOq~@VDVZ_OuQ2ajtf3=u9)RxReI``jqx_}>hi{j zJN9Df_)`J&+;lcH0%qraj8t7d23uG|d*~3H#bb2~z8%h-H9z{$(zD)>^`kLtK7H)sHPQ?AK83tT9EG?!x%em%>3$y0JibZTj_lSy&I^Bd=}CS} z6f}$I3sFeg{TBb&Lt^|bXqQW+Nk!>4%NX{g=JsKy-hNnq^+)_q2w!iHfY(V7C0--O zsj%spZ-3h1=GQ|V?k&r?=R3)cliCmDOK+8QBI1K}_@Qx^3SuTqhR-|Y9#kE#`w1oe z`GB*zumG+&LcZ=#d&p;rO>M6{nEH`w=U1B~0{cVhPeU`(p7X%1xcjn1>OkEPekp?5S?T-ebhzMu^ka+^d3&2efIh<>^nzdUv1c^)5Q}U; zL=otU7+ghGCLr}jC-o+T*doR5NRf~2h({?Hg9d+L)?}L*9AW~SX&yruv?nSbn^}0O zAF(H-d!0)O6GW?Zxf2=`e3{-lsUQB6O`Jd|>vO{w9Xw0uMluC%E$A&`hJ8ypA8wVe z{5mI!8!%{?J+|oomh1o1Fk5oT|2}ulAbx?*d^*%&*{XkSAnyLrxt2t6@WjS{C*b+6 z@6Gi0pblh2Ku;Lg{7MSZLBMmELqhS3!!}ny-}LA0aRQH+-$DNg+2Q6X{`31<(h7^e z4=Oj)fPux$o9ni=l0D@0{2X{qK_5B!8lTY*Kqalj8DFQ!vXEG_w%|F zV~s{T>3aix)o?*Q(rvDzA@8IH58)e|X-{5XoS|nNPTwfJgLR09{Zk#s({cC}^YHo$ z&HI*}yL|f^^QO7S4oCOzTGt0@LcMX?$!lCz-x!>&j#d6ac!zT(;j4N6h0^Xa*+)o* z%>~6w0{48TJcbIQ@nYhUyl{V2)Z`v$qf8G5e${V*^0o4GZQE%Y^k-`KpLQ-WuJV*Fdl zDpmwk$hi*SVE{>Tf#MVH!M6gAgP%Zl=uVHCHPtvH19F=P+92x$z1!Hs#L-Wq`$y!t zhmU`NO>MlfLzkkU%2t5i>#v zl1XYk#Jd=)Sp+q=FA;t0d;RR*>D+xinBK|tQFi;OR&7XE6(5c3u~y`iB)F>YavWo? zUu`JpI)=U9px8axYdiLN{lPhZ7x8hV#P(Jk5TP>F*X-NVR>8(D(|=OY*_Y}JKHetg z?57g}-a{xt$j4y6&C)#I1Q5pbg1pVnC9I1M-k(+-e|@@$>&`h*Hi#OJ-p_-D`}jYY~jNXn61%F*!$eUZ%9NWArB;emZ)Ve_v0h}nn1fM+EF7p49Ra6#1{b}qN! zFafpf&s!ri;qzP|*0+9HPvE{`W^6!kurPC9bj`j9m1Wr4xAXKC9B_d{h{U7&y^Tnc zSyq(NFh3=nPRo?RrH9;AR4^(p%uYm&U|EY#riN)4mbHd?_=n*Ms0JTo#~vKmN`>Y^ zPz>~^*?>3%9wfsM&KHIuq`>n$5fpyM^Fw8S3th(A?d>bs{4MQ>Tllf-bBttq=pcxVZks+uhnNs4q+99UOE4bZZ^ko=aT<{`uwFeQ zG_6-ob|SghqPd>fPGBA=WB!>95K@FO&=4{^_BucX!3AGv()0 zQCE0L6{IImCYiv*SPAki71|D4#uK*F3#Mo?8q9jUUV@hs9myCLPK+2K%XHXPgmNFU zm3?q7PaUX>(gbX4jq=0~)6@NUeprtS*}drsLsrL#$WLn>LRK49`ve+(&wfThOcn}` zU_=Z6pX_J)?eK26qi;^N^s;=>SFK0ifYqqp(FOD}b(a3!wY*$}3OBE`-4lc0+(H~f z06ZTDEZ@ki($1j&F8Q^gsMd0N)PN{g0Lt}7dckT@4}*vF&qthvexm*6`?^ki@bT4Q z;(d!GvS2z3VZv4CuW7t2!zhR@b}K(~SLH)(x`G6koaBi^w7ylC#c6YVl_fIGRVLoo zMKzW9k^{;j_QnW`LxT><5=w-~5^93L@*p!^J@pD{Sr^Dhj`Z!3wz|>~*RpE=-LF%y zqLe_HU=gKQrt@p0mNO(IvRODjR2aT-;rK|^Rz-dw*Q!){s~PFuq7jiDX|D|(q?}_o za}ck7+j!^%3u9DP#-a0aiW!bsu#dDH zHij+aSLB<12($_%?60xc-A#_B#2cJ@jy>(fkv&t_J`VP&#bjrl@>4=VCJGCLcSzgf z0Z$`b*JgTnCbWtDezr^#zgTYC6@eaZzOE;4Jz^U|_He3JvkU8uSkrmZKJ-oX@GD?3 z>j`^BBU_feFrGJ-rw;8kKKG1CP=@R%ir9j0Um!*_t1wjg!o1Hxi~viVV6sVs-e$3h zS?i@@KTd?;D!GD{W)*&sWN!l7IG~@=5Yn+33v8{`PkvOGBtqab-#|++mG4!e4BQ#k zUZjWf{?xzp5^HpVUfq=11`gtvun=qPt1O$?4EGL?K z)$pHC9(h{!?H2X>Iy_|%iTP)HIv))#aGB{FkI}V-B#t)HHi_@?zQ(JnfXe}89sNtbHCh`bf{5f>5E~9S`TOBSN z4S6_ilX9p{y{ge^>|N24`%=D7(=UCGWg3n~6o$5!-Ow2$h#}jML}xQ0Mn{r+x|G}; z8@kkfrybzBxfYL^`_o~p2X0e0AGGt$=%6W&ErnWkdQXUp#p1^HE2ScXi!LwJ#%*UF zZqkHg65Rg|CgA*~B$2j*+&K=G1H3cxsU#^TvgAa=+<2osm62VYlre}>$B3d7B4vef z3F4=>+r%TM$o|Si!ArqUT?vxKcE&?)yu^8{DR){Th*j}gg>Ff!&h40c!_Am?0%U7} zDowNA+j(DBVk@ToZ-IN5PI};0N=z7C4TJw2Uv7&;sLoojdCNokBFn?(b+lfldi3j@n9cSXghcl~EkDW-R z|G}SUKIHSU_Q-JlHW&|D-48}KTlluuH`+ix$|~r_%I$D}I5{`rk|WNMA%rF_oG*#$ z=X*DTXog*qj$y4;k{_)1PWUokwb?7SfY22g8S3jDZkz1=Y`ys^F9s9Z>?E%TTlC zlIZfd#moWEvgOtYh>eQvZv)X)S*6To=0q`PN^F%Q&Cc_7(@g^#Vb~mSVb6}xnh#p%ta1J$KOY=Ds4hpQd#1(|5wrg63S(HvMObj zh7PRH>X;Ewy?&(u0+iteC_NGqY+x9>ye+Mg&&!4nw@WX!OFke2BASZQ` zBi~5TGnm@as9eFa)slo{Yrmx!MDyHswt~L5_BE$5q-C5VD_dp4cj!;tETy zs-zus#h+ID#?F%pgsv{njZ~ESa`BQ+WM6Hg{wz|YMwVsa!RZ0@Z3!teN#wL}#4du^ zzFVK%dF)a1EEMOCPm(F0Jhv3J!FD^r3l%SF9Z_aOg8qN0C07!;K1~s|uGRoEE`}0I zL}`Wm`Wj(sV7g3fpM-t}xYOyD@%~FaNjy;$NK;!}a(Lp)K_>(M0y1^yucpWjunbGiuv|(W}zGOr5&p9R3 zVZz^Bfa+I%b2?6bbD~*=xW>bogLVkLBJPPZipJZGb9}R+qzr3lC@l-MNPHl^t1_5) zhpG@#D{VLHwDW+#7_w6g7;Z$J*Y~HR7#D3U#>2R|XBl{G>~m2v=4SUsk1U%9%oPDs zq{SJKrO<&(5c32a3|JV$)JLbXUnN7v6K1{;PI_U<7ENKI826=<(;8&rU@kogi5?`ny3wZTSX#P+W zIDSrVcSv7({vdF3b7ghwaP!_t)ATRZMUAFVFS3eV^<}2u}3|KFzh4cKI9z_b=33*V<8x@$LhHf&9sM$%- z6yJFvNH%4IxpuQAbP>hm4a8!hk__E3A%&5<+HyQ4$VFgIE6l>Qmn+Onn(mV<(MdKt z$w~5HIY6U;SwT7n|LeJ8{kCrd^K^Lj8_`dJl?ml=uZwDxEhnkCgORE})kjC3OysIi z%W@FA`pzStC++Hm5ycAu%vY8AsvHt1vvgGxiMztep8umpeXcWM0n}g_EpM%0UUYlI z{XGRjFfsts1G=r_Dw;}PEEk4SCJW1pI%bpHP#T-Qn0z{{AX^yPEapFKC{nfsvcdKr zHX!2y*&qUB1N2;vD};xXWE^i7h~czR@2;-|2LwwZLfjYJRB#0Z)GyhUg6K1;52{P7R^OoBFs_g>}x6)q~gRZq@DC4SZKEj)T zC1{$W8mF^cCADlBJjsYA*Q41V)W?l?^u2o<2YfyisM9YlOqv;eL18BZYH>`W7y!a6 z9eC67KuP0pO1w{hi!iF5!9t1%Jt%|R(~`f!?+a#g(=No zAKC!PB~XrWS0Pr^qDjXyT*zhrvgF~pL10Q9I0C$U!xsxtY#glJwP8umsM)bBKuCh& z?R|oX%<5*|sAe*;!VzQk$&KUf))mrui;$1Buw@`6|EF@>+IHwT8@=Q>xv+l@iP<=c zVM3|4TURl456L9(i#NLEN)5KMK%%0rt8=}VxREwCGPJdCyVl^^^fP9?HI|fvtH7O| z3#&(+ZFH8=IP{i(lL3o+T19gDBjHExp&>Gp27X&$B426F}7%|A;{yi3wQHj+4C57}pP`r^jSc*}G zptplQhsxNOn!3(X3Apjpklc%l(LKUp}q4!C+h8QbQfs_g2VlsE$wIhV)FDSc0I;j zPk!~OmZG9VU9CN`ZNfvO?+koy9*oR23JU;Tl!|bQKn8$#d7TAFY+2JBkY}6Rwypp# zKJ2_d;0_q;PizQjj4d^9YScrit2rnzho#*RjJ<33CJo^;J(D^OnPZ49sw;54wxF_4 z5@I4=|4}~_D|E)qUUJ5N)Gz5D^_z!3;y!#;(16D^Bu^yUCJ2@5MEp_ONT1lh{>xo{ zdGsvpg9oR2?7HW(oFPF&6^m}i);_Fs`aqFKrlI5n5EMjax>efol8R{kF_>!Ie-JFdJ{_R;zs z7qZae3-=7e_I0a1sp8mX$E3g($`s_Yn_O`%{BkecQC(~gLA}(?_`m*0M6z*xQx>?z zFhnDEh3w9|B?z6Zyl{6OkQV`oF})>v#cPx$%Fd#_UrJlZK)NuWSQ7iAhWYHzC=jf( ziTE2$&JVBZwM|YiRnjyLp|nX=RD5N%Ol1vNTQ|AY+yT#zYn+bCEZwq+Yevgd$FbBY zE)s)$+*YC17c5#S3larm?o_rW>)cor&Hv#}wz8@FW3s6`kUQUtxE2#o3CNC+l`9BB zoy1oS?3X1jNP1@6k*4cU)H~OIqL;5RS0HwE+EX}L)U!0{Jg0HMeVn1zH5czy3FhTS z3~hac-~=n}@pvuVxLVRU{TozK-SXUiVuE>Aamx@GgNUQF<$wlJFN5H~d0pc{ajOdk zVG~7GUdJ#z)+lj-JJjcTE;$j*k)nwdI$cxXesdo9$X`WewnUEuGAQmJ28EcqAbyt`#YEpXQ4 z=f$uEW0*2*Q|$}sU`tz5;I5LBvI$0rylZN1fAlx-_YZu|IGd*}s^*LA@)IprzWOOV zq$;mMe}ImZp0mZd9*dyDM^6=32*&)RP!tN@KqhRjsdzt`8P;@I2}d+gQ|asF z$|UQ7XpryxaU0FF=@1n)165dTzaEeDus9QIKozk?!F7-DoC?Yv>!p0uw3^_Y9#*tJ zDh;v0MCMQ)lK|1q zg6Pur$5IjwwLQp7DLtNDcLPF)`)pr5j#M3@nD^cB_T_|DsEs)vl0nMd(+G(n7azI& zm3MgzmsUoQs;Eaj0kMog2mUVt0Wa5+@TOFQ`CYcIPS!Mogam;3Jkf^oTuF4_wet2+ z;R@}Al|5D{J`?#NpKSJ9x`m3iiOj8gc2XRfMqoLvRDLmjz!;?ZT|PknBSQc3dk&+9{iLpXp9_pH+rcF3I9_Nq{bd)U*D@_ zUtgNl3^GiNBr!Ug0c2z4z7vRKX9z=<%HXX&n`!3Ks z0Ze+HMd4AyF`Q{s35e#WQzQV@X_Mud?iUebsH?sXlUp0*5p;RPFj!{0DW&&0!q==G z8~Y&>r86Blw4pG@WHuwC+|@}Jk%ZAx5z=C`GG)>ZtkE9=oP>ae|CC*s66`-)6gYp> z8r<$=Un+<1nT=6UP9*(T(A@>E@mAkiz~u^hf;{^v3Ov25Xu~Xgg#BdU947_0(;Ek@p-|k zi*Q#8d%>+lhK|kNX8jx}*k0njdNJf$W(vQmWHw|KaiCe~4HzPvpEBy=G$P`3b)bV( zBf&nQ&S+*eFy|gZo4p`Gp+h_<@E?EQaOy-G`Js|a2oU;vq6C@}>=WRLPShH1DnydT zqQ2$U{{#^YWVt(Vr~rwB^k(!_7vbE1qTRl=r>*X4&@2DK>nP~qTn8x_GF*Em?y{ky zbE9mF;wvnDxOff8l3V%R8JMRIh?Tj{AI90hw#I%wmn^4~H_u?l%q!PJkpyh*k}mO!!d6%S)tz1_cv zuNiCxv+RC>?lh%=Os+Wg@axZDNlB4vs9!9yb5)|Zg<~k_!BV8}+rEnk*oJ-H>+t&( z?q~k)LwvR1Q2*oh%y8kMrLUFm@LGijyDNsRadp{A!lCy`9;+R3I(N z)sXSUEHL^}iMV3z@RU5+5reu^DU7&tsaE_?gT)z90c@}~rO@ptZNL4j^d$&cc%q9UOQ6oDniU(KWG;r25%|wlF_erSZ&Ca_242;P$juLF*DPT^ zA~)IW=wdSQRkca9ofgzn$;gr}zRIZ0K01UoB53r4$H&7Dkox0pXOHMo*yLr}@H04m z6W6RHn9^ER4c0(8)u{6m!}KluJ)Xlij3gL}Y99!#-Z@rQ!!lMzbPicvM&l|3MAyL^ z`~`&>MM9Zx|A8Y{GJXbxa|VPnE`}jbnPergVJE= z9b-*p*+cv3?Ql(v))0%h1ZpGFq7wE1$A(@7DLQPv0+qRQhKb8^r%h-1uEI)k5E*ps zSbF9($ijaw>G#})qWMWhskJPzVi!PDf3udh)N4;m|L3%kOP9KZ_K@oj0v>pNiu;yn zIA7{l#mz#{@f?{HNvP)gquB%M<9cW>D$XskjvM7lygq=;A8RPD$t z95r=OA6UnC)b>>phZ=J{pPmD z1j$aFN%@vK`e(?bs)bE0T|tiwZderO?XL-#b3qT;?j{c@faM_Mr@rNn%4c1DHE_KR zT00-7d60Q2dAcv}{q**eWB!ftAj>y2QzebfzP%+wNC&!(U)8r4y(7~8okmj`AtW` zMCcBp(6O+=Dt{`^2?y#bzx(|wBUb$|HiedjZ_jw6$ewBVIqvY_G@JR~ag^E`-DoR(+hc2h&?Pk=YYogdkJY>mN; zk@jrE!PQd);$8gL(tNc*zdG0ybGNcv^L@dC@h6Pg8P&rj zxm<`lsva?fBtZPWzAAzVXv@$WDs{bqa{&j$44^Y9-Z-hb(%f__QHZ}^F`kZ7GWOfP z_4JH$Oag@g`vU?3z#mkT{dO{bMxqpsdj3~vgtG*rHLnbkHG!BB%+!cc0plRxN*s^> zi17Ah)qY?8gfRX5SZM}3UGKY=2s}R3Q=T@R4QS2rO~KghKr0lv%&o?dY8q>6v5lSt zE^fDb7wqY6Na54g!ye9VRe-c!M==AYV&q%pg)cC!0f@W>&iPzf=k%U9!d0F5W5i4C znb6wVp`(RFYIrx$MLUTE6nJ+tW$kmfs!#P5(PLpBLa64pvAi5{m`HTDG1UM%=jH zq@48A{95?=$uA}-fk+IDM~Ic!nR&(?4fD9~4Gl1|^6(M66LNd=H?$!$R04eg(gFfN z4S$+E+)n`wABfni=4{QF`RWZ$YDIIX*SI`{XQ!<~`bL3-UiMyi<(mpn z+`{D}$d)<$C((|To~e%+Wg@ccrI?UgSv7}c0k_~_(w5Sm1;jO+Ey|Ga3`d=Orj0Wu zWq_D2eFz8!GV-EOx4-dDWQ%UNG)Qhx0LEL|1?Jo|kVJ~qckD=XF|W49r%!MIU#_)f z&TQGMjJC!=YqavVF)b=&(g!`R`b-(ukhz46)VKJtubBrMUyt7kvw6}B1z=hJBjHF~ z_4(pNDg6UqfcKD(gR$yyO4E&TF`-C{JDD1_nB-Pjpj+{J4KEuVoC5?sAxaaSf>~9b z=1gEg0vP@ObS#4w=mneo^nFTaD;Qnu;PDy!GA zw5Bd#)^fQGu3-|1E#Oi9c9-RQu=(92AHxwGWc3So#^bC`JG;^zb~*Q>^8s;rN0C;q zJdILwr0QT%kw+wn0s7N3HBZZA&i4AWvls_enTFp@6^f;)QqB8cN~Zzy&$~y3sC51n zBCXFzka-7}$)T|U=h$k%lMd5;bM6;(G*uem-w7*KeDVBi#`k&E!5<-ex-|SahS2CR z+l@FlKXX=)haK1&S^}Z#pUP%OwIIzUkW;f15R5>C%UBkGQvc39=?ZwBIFD;vG7Xek z`zFH?0xc{o*h?JSGgbU6En?HD+wY~F^4d=D`IXhHP%hgpa#pJ~9l zG}h9o>%}sFTsCzGPzBwR+W7@St0R=NblKZ$4Hytq){&(l*wQwIm(PILIjGtcaW$<8 z;(-Iy`{RavprO!#AD6Vc5fF~?coWB5V=0eI7Gq*e@Wo{G&H1ts?|H!0c0C2>MMeJ~ zt~JFMj{>g2VDqV7JH0EfAM@(@B6&j7YuXzStx900rh4O~ zz4S#&#i49bF<;n3ZG@GI)|^&sK)|34gkLJEj<@;SKdRbTXK9tMBJI@w%r*N_M9zCJ zn#mj8MkUcAWq^0ny36Za$!+2;X{xlsIp~}&Q#w3)8NK0n4h5I{_p1}R+60CK?q2r_ zK-*JYD4SCrIpRSC>i@PTje)8#4D{xMbl$HF2K^@;;|&9yKLC#L(Wo!!WBX0}soh@a ztel8NKkba0M-;)1;CNxd))5HoQ`=rEs6hWFWo`m0#Zv}4h0@@UVQw7g2p3?WrcoaM z{OB)IP-3KC&eC0$9MKm0jzys8gP{~tv&E8>s2xQJjp)3oBn-kn2?~)#10(d0@=AeG z9oNSaS6~)8Fk6D2WeX-EJ0F!6$wAv0d=M!f1n7Z^v&2FNTZ8_6+lEAnNd^vCR|QV! zi%r+fTTPDN8K+}=ejJSaILg*G=W|S>BHm$ub)Jz(DvHJDGVM9L$@k6?eNoa?-Y=4A@RhcAE85gn>W_y|QEJ)F^LB54^5n_{ zZtT}s*gfGSJ~x^^TJ3k1FXr9#3^+}s9K>IYbkt}{7Th{X%2PYD`cfoX&bPxEekpT8 zOLiMp<%1ARvSgM}S`G5G-@r6Hy0<5p61)yryB7za}?76K7Mp!37$YORh$oCKQV|O zE_lf2KG8bmrs;Q=#ka4oko72;+dik80%{5E++P6~+=z@yplHq$JE0a4r69}%T*x2z z|E+pLtkD}py2%^B5e+1pm=dmKB*=L9V0)^8y!Go%Mux^R<5fVaSHjzAz}|YT{hg+U z_hB3LkKGPZ{=@roTSV%HMH`1~(1uQ{f%>)|8a?X;|eBLI41U zoS-nbUy66uhp6>L(s>z7O&l4SCYWhL?ThA*%>fg_1S~pCYKx&5vE*m{?69(&XVt(e z=)Vjz*`~q}c9g~d#jwTwqfGX_%!d`?OX}76%Ha=a%g}=9#({1-DY%Qx#|CV~1ec;} znX487o#2Ic=A;w`u3!tCfgB}}u!mxCVkmWZrG0S{iz?&)gN0p~J9eaHUA#F2F9rGI zK&!%%m{<(F?f9#EV%Oxf2%=_6!zvustzVH*xT0{BQq!p02G9>J{RepGhkF# zuq6vhJ=4f7tMc%WFS?nH?awb5rQ-jTJYsC|R3rxJRNz1h9E_9-0fJTPF4dv`<89(W zV#+>tKuFBH8a=iOGM_^AQcoSfMr@0b1)AA3ZR$F>Xqw}= zWZJACu)}p#(a$0_egub*N>d+K@(Dx4wSSzuv=ZnLl{;0|*7L97O*3tH^J%GBnQPEN zd&MxU4z1({@;JlhiQU*3aVZxF8Ha+;QMvm#O1lHcp}5E>!dArD zgRYbg3BiQ6d0CF>t0j-cUBpF$Av!Ax&~#-zPc>yii9xPN;C>O4`jd&lEQ^&WMu{wG z`SJ0lIFm)?z}*m*iUejT)cbTL@>>j69?P}cFE73NvZa7;Ks%IA+C9JR_)x5R)cYYt z=<%2oHS>7Z=^%Liv|Lby`IRwSG~dQ8@#DPLzfIxCwAC4oyPp)T=o!yP;n|On?%V*P ze0O<`<&<;EnGf^N-d@nn!JdZviepW|A9!Y7#_2r#?72$q-mW6Z{AL68TT57cRA$9} z&8rG~bd!NI#HPzxr7$thycXO@hc*L9J;dzJC17e|f&ZK35nV_|K?lo5Lsu9s4CL?m zrWh(hc-G?$4);t&J}we?w-OHc3_Z(ROf+=c1ItVtJ$GyWo#qwSP)jO!pqk%VzrVqv zb#U{c*SS8lp{$yn3|u|Rxb`k;Rd#2;%@-tgYD}&&zTPGNxJd`>)E33fkf62SYQF?{ zGR>GG+7!7Hwi*}lYvq_74%dN>Bj*^4soDC~$g_vE99A+WJe{`sVBYFU+Ljyn^3bzL8&{8A_gi*|%{yB@0gcOHW&0tib%7Jma~kc%%0)Az0f`yi~)jcI=a)Sp;5pes>hDmv^ld||!BQzVC zIgfD4!Q6kx6dgF?Ou*b=0_H{tUX?2k4CfuyajH+i1L9O!B-H~TPeouWt*d8x`W6$e zdTe#RJJikIWhoKuAjvsd6~q+a3d2GQqyBT4KjRbwzT#&t-R!S%xzoyiO+FhNS z*3Co)-PP?y8n8TPXGjz9*qC4BVZQue^f2?{my-XPkxRP0dBdNIP*>2?!dE5T@N%_a zFMX!h`b-eR7PU=PSlYH640%6R2`8TBOYWKB>Oi@)-2{{%;&bP+hk4tJq?NWHrX%AYFLGsIEzYd(t+cWU-W?Bc2v z@P7D0wdSOReF|w1p0tS3oi!pJl^{1FO;x^5Y9yV0JlSdni7zFlV7ni$92t%JA7MS9 zQWo))Rt5u#g2Xfig%T)LY;J{Y;oFDydBT~0%5q9Zc5c(Lm;U!IjSW3&;agjr>!{0- z#rr*w75jLbGQb1W!th*_Jk(HSGK4GDgkwB;kn@M0QtB+xTOGHh$7h8vyAMk`!A~-`yLl!lv;y8($|0jR1V1qs`{uBH zZoXCmZg5s`7Md-g|1Hgt#!E)Ln%d9FgGu8~fCmD4~(c{$U;Kjwkix`k@AxV6{m;$hlha_H(VRb7Qn3<0j@7m{f>i|^Ru zMdjA4vx9WQ+`r%f&oQ%~bH>$M_b4w~N(KoyAIeS=Qjx4IjpJ`zu3Fh%)ORdn=DsN6 zlkUSCSi)zeolcGHVxu^JjZdRpDi>MLcdihi@mY^7glL;eG*7g+WNglUPEtc&Z5H^c z;|4o#sM+cRhEPYh`7r1Wt0TC_8bLIe)|w({gN{eC(BLT2A-!eHbQ`#;9A!v#Z>17( zN`R^xA+YP;#m|E}d{b|IC842!fuWXOu*wrgGCAT#H6^8-$U=kNU5gLI{2}pOxRm@a zk|gugRPvthsi8n5R#XT-K;|crla%_X#*zIS;8#+Ls#HXo=xvlB(^;+M&+@PA&lrZ~ z0V+bQcKmRfL0!Ob!K_NxnCQz)79tU zn;qz<(`Q@5=Z9RD3DdeT`RC_aipBEUnVAnEKk@z^$;~F`)NdTNjP&}%MT-qZ0!%K2 zOCM>F)UW&N;7gx{|9dwyz$bS8Gc;rIQ)#fQm!Aq_YG6IYkz#x&mG=dVw`B!K7hKFzOIp&y^0#-{~u1oZ+fu*F+N8kAp>cBkgtKKG|~3+Q<>=fNriei(tG zJcM;I9A`0-LT(OZSy+(7gbbBJBKG%2w=qi~#C9pZhynB50gm)! zcHLNC67_b=HXM@!`gp~xw~(eGEpAJ!WHP=hG@jwbUtgs!IWYXJCo0{t$#)A!5VA1d;irp94;8YJsC^BEos{qtPUHIv zVAm`)nX>15as-f4`jLgA*DSKbqF&WBAyi$+(+xk#+;4FhJgSrx^HK(K)Oy+4$IK_5 z7Edj^)nVu^1XjX!yUiH4R%{5AAe68~?MtX?$=EhFqw$s;H6A{d4%KF+A6t0JZf61B z#ciquqE;5qCZPp;Xymox6e5fC*qY2)G$*V9gTeC3E%~0I$eBm~GASwz*Bz@~(*|*^axZuO2WM%8H55P@E0W zexhwe?C+9yzXoBCG1HdKYzkBe<_L^kWEv$=xzzZ?HU~f3GS=?U@?avj7G@)rHk_-BB{2m$Fp zJ1@o5zT`8*7a4iC*^>W{scQ<%Gg`K7(5SI(+in`$wrx9U8r!yQr?G9@ww?R8=bZMw zCV7~dJ+o%b`u3j4%KwswB)UOo+m%|DV-NNyQnxoBwvP_I#b0ai$9GVQOL!?WE6rl& z#Bt_oi{~#gV~UkgV8z~vESbgBg_vuUK@BN)5R|{82EgVNmM0Y8GZ|^f7&7{gkVy-W z7Pjz_A8kFYR9{th`yfKGRvOZ&z^)_Ui)6;W{IfUWMU~1tT9J9uq6st&LgLI0Za%_A{qtK0Sv0TJ+$pV5f`}#;lnL-f-kTb&e!HEE8 zURx%x;mzojl@b&*DFCi}Gy7nf;FdhmiZ`ZOW8;}X-IU75crq!m6eJ@F^3Q-%6DIig z8yj#g8uF0eM!*sr;<=1Q3COf_bfEu?g14l6hRZ>K(JY#7aRO4QksbYNztsvJPb6cE z^C{vt?Vtl3-*4Js*2zl-`);kPR6YIYLn@r>%zPf)Gliqq|8o8tTzS z&_!tUlJ=t7jVfxSK@}>~4F1m;30z{-U>b5%!1?()h|w^B95LP!s;~JLP z_;|f}IgyNYWN}n>tqhKSLjHLySu}#-;xD0?mgTD|WRFA|cZ2Fgf6NrDCz(riLkWVM zD&V&W@{Dq&vK@yy+{{o%tvA^i#JfWP-=B<4k_}%dQw{OY=rjys7J$(#zmtw!%!0vB zo^h5W_go@W-k7?^Hjf~uVRa{FmqHu%0#WYg(GWb8?M2A%j6JApelNTVI zIK{E(fu9=H31)lTabfl_b*t*8+?FFZfA5Y$0}2C+dP~eyB=(3`oKpzjsyi;JU2}C_ zCM>$4Dp)i=aJ)f&%58-|UJa=#*!4ufyfZ3!J^3uw&IFP9`rIWb^(yAyhj7=KE&H5o z3mvZ`!wSCkBZ;Exdtgo2z6c!vPAR&AfRNU}X*zbkSW(z@ozf-9OYuag5}=^_+EL0_ z65Crawq$GkzftRuC1eCwGiK!XsAYwe=ncLGzQOB|JNQ^Rg75WZ%QHm-qh+K0!nvay zC*Sm9g{6sB{jGY@@WC*f%^G8^WhHM6BLUr4riI55ne2;X{!1=D;Mfn}<8GAC0x`4w zK7#OGX>&vr?et`ZgL&ymQJ}o>rv{vPs@MgF<-Lo54bPz z?S5I{_SPN#tg{g7tk8AV*%Bs8GSn?AsY1_Ftwe!us2_*MbMMX}xSs6cAU z?AW--*T$K=g{?+Yk-|I-0!5M+*x$@LADc-*8XRYSv{8$*3-65R-&zdx888l*M0^M6 ztT}Iq4R%{1+h8Sdhw3HEmel|hO`Fr$W3X)R(QK<(|15yfz3N;$Z_x`aQ~=& zq)RRm&=fH;5P$*%36p~az*z?f{J8eF7)r91b!Hk-ARpCK#U^T<>x)%1QsljWi}ye4 zQ!D^z zfW~n@hG0-W(#Tz-B?4hU9jIx`TkIO{DhhhPHBu!RhD;pYs}zqG4N5=eD^FzYH2#6m7a+_oF#doKrb!H@<00<>;W~2~R-h# zizjjgm&MfMxld>@%>-4p|Exy`T2y~$k#|5at89md5X~qs7SgL-l&2+%v@CKd>k@Bn# zpiqk8Oq@0%jrnVLo>$?{Gm8Aq zXNiEh0bE1|^!G^L-F4!~2-@?=enPUGaesGo>D&PJJ1DJT;KtaH^Lj)5gs=yVo-d!> zw6J#CBo93$*w5g#sX_pwUhi);(T>VBciKFo&g=gM`;-rSt>h>etpGFkD)#*jW_N8s z3AeBW8!(*gu$zGmKRKHUq96hV(#lLYPRwy3B}JXebSu5RlW*FOUxb|XFuvu$+Z_`y zxD00;GN=^pd>XiurE6RH_LM`@KI<3&H6YD3q3epLw|~W@6Kr`v75+9EdZwcb)(o#M zix2j%16yDd?*`G5?*jNsj}pP*rv`)!vIYb%!s>WA;!p9-#V*&tT%8mh3Gz=kDHK}* zP7-&vKO$^`QdU?yic2vJR-{v`OwMWoNBPb#M%sD}92fPO)vUi7Jqqrj?xOm2T`0VP za>N;O348Ohe|)>-EJhB7_u^cAAWguB zL|v*a-S-jT+M@U0*-d`W^~-w(qD?d!3}AE?CfdNImAZg?f-;S~(7cCgIxfBOB9;Vk zobWQ);4aL#J-ebke>^BW({|K$+c^n(T(_6@t46dTky}VC_QFGZun2roH41FNBvREm z)y2w{!~B=emASHVsgE&om=ue33-H9lo!Y{Fr1ia0j)>U_ix3|RYS=yT+euxV!sBLp zh#T&h%-kI2cCK$~@Twp2dR{(R9H?dnz~UV8@iYM8?g}d(Kx;Xvj>68^uDuf-TEsbI zgO-@L-7Vfzwi zVP(4twovo+x~@Vm^GJsMIQs+eR)6%mu`r)c;SlvQN$#qH zxR(^lz5<@8{7^DVmho2MZcSbtB+Q^d0!)oz2jKpI2_l|gPa$q@BO2WloOyEBEc(o2 zsqWtG8|FJG$!HI!egMQ(?Raba$Gyo%Xi}uynP?4}!_K6>ECFeLMr_xYq)f&QCznlk z+c>a(iWYhbU%tPhAy}SW0>c;4IbBp=Ifi8-D&pL29kCV!6R~GP8?ool8TZ)=ie*2` z>W=e0q??Zm9Lhg{lhnLFJ*B-?qO(qnZ-7eKnXuVWEQn49M;b3B75I=Iy)jSKwv`M7 zFDDOuqVqxmQN^idiu~TvtDivBt?NT8w*r;B7!h9LLsIow*JcKiwcK{5--LrdSr&-I zaS>E@-&`bVu!x_Gze&&iEN`c2%!y%irPYWAeZF{8u(>ouVw?ba;L!3aVOAmWRxT{I zHvCpd6ejg{pF65n_ny~O?-%?Y8+?omxx9V~r09nYy}Y|6i4MW8L^gJQ@Bv^i1_;#t zqwHwTAZ!w$UgC=>TvJ8$r843oxI|GF#D9$eE|AUnZH&*6`Ctmbm`TD+DV$7`;Z|X9RiiUB+)Gah?o@pOJUoX#v}vXcJ@z@8AD$C6!>1vnJ(VY4R-aL9(JPI#(YzP=0{sn$p<$&X43E07mk zg$x)oc$CqXkm6gnB;{&dza(bv(N`>C@~Bx|RFHwnY+iy~7$3qdj#aS;hl>NNi(yS$ zvInEIJO%FM2MPBIKBao2>9M&nxGU-QhcytTpMDm2B9^+Fso-9P!{2jiTDj` z|G%Tok;Om*L^t}-yhsNST@isMIT3;S*2zcPIfaAgc-(3Atgmez^(?^CLGyT(QflX4 zGV#z)5^Af?>v)Gc94X2IOYKa~{M zpm}hO^fMtB89jVXhE*^Tk7AtJnR*h%5m3coT(|HHan*$u6OQ=qgT^JOa&T8p zRrsGS?=T@zjX?yvfzQS|SjxorxS1LZDuGV!+ny=Q;r;KZ<l?=r;u{uzX``<;OBO#mr}q0 zHQ;P@xbdsB$Lu0?#L@n+*UX#dqVQ?XIJAd)_nq|v@X#VWf2^~~RErWKP~3?cdP&dN zF`0Y~iN!^&400cmJb2UdeS%B*giwdB*2M!V1l8efyxa6X0%w!B*di&Vh`DJtr%9o2GQ zcC-LD8GsMBQq0hyOI6s9#ePLe**vbUMr~TCcygsI`U|p42@on^OeGcM$YL*Y!@gE9 zd)|$YdEO<+xsI9chXnvruaIY+I=Ol|y*_~L zqj9fBe&UV)RF_c^?hH5eQH)q>-0u7#wIiEYNYm&{PsbXiO8a^@HrD2b*io73IatY= z7y!7)c4#&Gj(tJg;eymu#pKCdEs7O`^HIW-Ywk*qK}sKF#j*x$T4ir8%=i(%K# zC~P!^KOt{bhBOVr(w;6e_SH&lryzXF;ob=&KUFqR^YZMLIgZg_HoFmVORPP;{W}+9 z)w6^EeNA%3aY$zR-HwrUdkb~s%GX_nCEwRJl%vd)#-vAZabAYz{k7@5D92LCcm5rU z@M}j~LX7uVE?=pyzpNO-DCFdf*XCh~CpZo&teTIva~HZ|uWeS$-Kk0E&G4~81f0<` zl~Fcuta#xagkC|u^@{p{(>RQFh2+f>fJo%YzY%#c~BokCcG^_)$n;i)V_Gw2Z!(-%cOG(oxA z{9XJ)*xggE7&z0JS|o))b=YiFuI6PgD}g1S#0t62`R5W;7|KbC4B7#!xSWB3>P9>W zV#$&rRA{*3bt~j4K(b_lVO^2=q2T2OzdgDngqu*2SUO zrYZfA2I`tfUkk&J>WXljfCp+X&L00D#mJ~7T--?JZ^!h_vW-E1$%#RySQY?Jp-Ilx z5Cwk*+6$u>%mJE3{b(}aYnz|V`!;C>#8d<|Hdu6x06NTi2wM{=A&<;>Z_xLZ zBjqPV^1_iuoY^NpP8eojE>jKrV!1WB>EgIt5wJSpn*(9mLMV@B z{kMLbn55_dk)j7gDoA_=nK6!%w=ZusJnzzH4TEC6lmzzJ$yxDDy&ggE`_js58mHC; zY~5Mq$r}cUuZ<}rb4&KANevSy_HPUk%=T_&>g&%ZXTg`Wy`e){((6j|PaQlZyH};U z4g;+|qkUaHaI&J(oC9IWfuoV+{V$%$n4~fFwHGn@hp@o=7l_M~Ddz+sA9)L@^G*eV z-?Y>@T^~Fb0j-mx#tZ^a`78o`fUeK4*(x6@fOlbP{NM{W2Dc`Gl9{}s!kkfPeHwt0 zvC#OThX{nUVM{#N#4ZlBVU&?>NTrs?5{tW{o7C%M)|$z~>=W+d3ne2ngTZPUR>0Vb zPWru?mg0MMj%07@5fIXFd@ttlJ)XK}oHjIFyh$EjxrWMkyVcxXnq*lBc90lSi%OOQ zCwPXY=m?70`P`VAbFo?EV_rPY#qs9cXERl1?{C#5ayP1OMROKg>5pjT-pK_6p2Rbh z6;gK}p zc-ajkclM)2tFa#fY_KRaNw)i}d5kuWcW0K}pHS95NjCcX?BJ6}P8QvQDE$EIJI8|s zYG18bt-kPne|ozU@+yivi~8)4IAiVV*z~Tb5Gda`t>-=&Dk=>n$wKzP>ah^yb#e@j z5D6oqNQRkMDU%pZODc&{ne_)vz!}wBfk0(SPats^y39rs9@2;8&-WH;cnZKwdF?20 z!RW=@WJaLSZY%XCyCQ4{Zjva%VdAIw!9LS#xcx{``X9Cgg~#G7qQ>LMOp*LVgLg#h z1wYV*!*n(3%WbKd-)Qx4%)dJDY^IizpJX+dR4&P=>MKvROs*r&P|NzI9L?#XJg1CD zjr>Z`!mz<1P}@IS+@7;gK#^4YX-F)lPGJbsz?s#(ozv<`D>84A zIQqhm?KY(Z$cI-n^fOcHv%-*Xd~kWwl)s(2A8z>2Znj zo)X>KNqiystkMs?xNCV37u$N!yZEnTrlh6R|H;k6^fh1ul-q3zs8ku%$5rvHVNPF$ z3z?^M#taS^`MtR86uSmGCqw{+$wpOH{a=Aja!MKMYAYD>3Z{a$DewpK9_BkB_)c=Z zjarKw%!IrJx4BL{1g0;lV~(?8OOz*njlU~qTOAfP3Jt$_jMy05kyPCzZJ+Uf)=`v- zA1WC>t1fRZqfi|h?5toTE=k`-{7k2j!K+Ef!JJ+;4*1?-At66y?sO8Odg$L!&c=w| zfakdph;i{Xq?M8EX1pm;P-2cQ0HI$BC20!Ecq_L6`M;emKx;?k@m^5%QK2sQP*4C{ zh_>4mtxYK7Y1r*;r~j+207w#0sa@aQ&qW-R?9UpvAa_@<$~dtQIzh)f*4dGyWX29p z?TBB+R48WbDCNIFjb9nvJr8gUnbnARmNYPoLLhu5*!qb#cn~BxfYtuEb1 zOljG*6gLEopRhw6G}kv~qJ zW&Bb2A0MwBpnpFLWq2<(L8MO&;s{&vyP-3Z=DER~UaHc2!eNpd;QZdxq6#-rlVh~i z0AWJI_9{ou)f@aW8)U>exp@jUWoP)uaKv*meSqi+rdSK78mbNcCU-|=ubUi%! z!wG5n15GFSp%52d&Afgx+Pq?J?yLP*7L)dqbfh`bc{mqasx;qXKzAi!d zB2)j=|6rugHk+)Uy{s$<03*o|WCM9^r3m4#-Mm~~4bu~deaJiv(Snn82&d5OD zA)NEvIR31u`V10@n>Ri=Xgq9FW|h25-2|0LRFf(0i2GYfa|3bgT3c_N$2PvPWz=iZ z7-VkQT1K{492!MC6pTKQo+BhWKZk{F!KiM5O@1r0e=`nb&g40P$$LU&n~&5mw%DH) z!G72V4U=0CHjh}y6w+!1SH)_cRAs3{KX4t^TX25kLO3E|C|$(X zDD?l^EL8QFqzd;m6bc0eQO%S2P$Cf(un1 z=a^M-E+dK6u|S7b{PHZV$)V)#^B7$j>3wVPkm2GY>gl@EoOS$avz0dVO!J53F%Kk{ zU!>H=9&b+51V%aeH)IM{q|(!B2#nrfLnuLIFmP6LlR~3rWZEzaY)#Y5{+-wG%+l&c znv3c}0sJN>sHg{yx$@WKqW#RNKE?E}Z6nxQeMR1#uS!~$K6GjGAaIjBK@-<^uV3j- z>&lDA!#iPUDsuYo?qR?w_EF!}_qgF*ZGz(&#q|VTy$yG}6g6P7w-Ics250beaip>K z4MjV5N$KtRCmIdikPg^?ay5lOF_+u?m*?!F7jE0plx*kZNDAP{1v%!L-2T8dx=qgA z%}IL+6*8Jc&pz0muSXng4jv4hps18JgqnaWN)}0;0##O$1@26=B%v&wochhQbds~n zS~`KA_c(x{E5DAZemRaOX>6&z=)cwCF(%bNVB#A2QK5o6J+AR9f+uKgYzt*|E<|v_ z!H~Pz>-yCCexsV>s6Y|Vz{`ST4{8JgM=~tDxnDMi%=hQ^iu9|T_wh_0uFimex!Ai{e`?1tMFKthDI@bZ(B>~(D1V9)w1m>QIq z{vfy32D$&Fwl=LclDiANVs#=HXO^!r6FDLA%s-|`qu8rQd!urdDNJ_$?>uCnnuxb_95M_*NV1R7zYw3KhHp)*jqbWmlkB1iQ-xCvQ|e z53mR8e30E1Zix@1LS&SS8Ehdi`!Dnb$nV_hjtk!D0-%qLSr}J{J(i8R0yYvo7hHQ# zWTV}>Q^+Xy8a6%EEFP4pSi--abDg+_IjQa>UCiGMe0URx#*B-fj8V16KjODSm-BU9 zcc2SY2?oDP&49};w%17Nyni&*bsT{wT$PA4zxd##du)^$2U|nuUx6%5c&Bv^Hy3q= zgs@y4@CfS&vd8jx_jbH7tVb0d&Pu%~Sk%T{)QUNNR2|nlKa~a)AD-Z9zqd9|i%FTj zUxX-Dxy!ssrQ8#!oxa;#TbSVwDHl={Q0wb7{U}W-qD1TVA8H}_Qz^)(Mu#Z@g%y?v za?%v3cQufrd<0nj;6pOUuBK76Aho~~x;U^F{bzK#p^LV55P&@#1S9%Q2H^kl6bXYA z-HwI={db;bv&Y~MCkx=0@C4A%noIE&*QmW>J*@<|6V`im<~o!| z$km42(lFT2L{0eoZG9rT5etg5pKfBRMz46~z00Aa!Rx%EP5!{ECQTLkK=ld8oF;A;Vw(dv-KKA04W5$`c^wyNItHUi>5 zq?FM~>+NkT>h%L4CFs701eq}cDBQ<*%2!udO2v>;%OBvh*YdnalqX&z&Sr*&v~u{? zz>~zO%VnhF(<3i0M&ma{B=zVZHe+DS+djd8oT_&|f9hqsGYkeZk_5*Rs>yA5s#v7= zIDlkdHSlCJia)9mIQk$PT#jT)aGYb6${^Ur9t9*Lox^n7D8u!0f8Wr`KlZ>o&UW44 zE_=-aU=O>a_}22{zN>lF#{DN2vheM5Gr_e>{l$ZdH&AFM1zXz&=EtY}lMKlg;eSlv z8~Iw}2t{2C@+QUy^%3qL+NWFn{S!!`(l3yDj(a=hAc?9Z`$X4JGQDcTk9Z>b2Vigb zgVj~$p1$I_e-?ZmWHYOGmo;MsSny*sTSXQg`#h?B-Qp#8932e|Q#P>rF)m zny*bvy?9jF8I`6>`$e^cQT6D^jh`(o%BZyOATq+woUfvKHZjb9S*I}?Q-r~pR-Az( zKtJHMS2L6uNBRPPzHxcmbG81J%kN~R05|^F8`vNrL4ECKKu%c_FL0rPJgHEk5D8-m z;C%|9lZ-Zjp^ zcN;)(QyZP`nzWkb=X~LjACvKHNY06w&g|tTdpHs)6vZx?Q|i7zrwk#{@$oc>~N zwCqa>M}ZB$eDeq7X`k_iV8##ft$;F4C5&!z{!F`_j@eSMg$4e154|bRxeFhW`;2We zfvND&q_-^~*{t@cPAEY^{t=hS2jD8g4e|-kveQhybc7gEhyTx!seX93wNL~%fFtnX z+q*eIEQL$JuJfK(vg7GqWKOuFoh(1c)Ca2Y1{KRkw{Tsnxyg@8)!R{%Ar|1`x}I8R zg91>TNN!xG{>UI{%@)!D=M=Ui4gRfU7RhMFP`^Ob(cA_f;UiU#**a0AxD)(>C$fSi zW=guksM*xf{z0z=`T&X(?J!CKKng(#xeV2V+F}c%_OtJRW(;PU^_*9qD3}#FlNus@ z$4R2FE6CzdU0Wz3a$53K{l0)U=Tx;a*vy_sV|u&#{M1lX#%bF`%^0j>7+pLL`Kv_6 zf@e;Gm;NDQNQqf#4tWL+yr+0zHXnv}(cqY#J(whbheAL@UMtuo{Fhx zgjm{%zeod(=AJC3=fA6f_HRMUFI$R^5Uv8{+Y6Dqjc16a3fGyqj&q3% zsEUPl+gUq|^)%IgwxCd8zq1vh(w2dm+>LmWXb%tZAKbPwT;+HXb$p}MaM41tN1^`i z6(bleVZIZ#q>Iq<`=VLuudrse1B}0i@t)d=InaDhGu#aD%Nj70rF|4+h2*hL)9g+WYnT0ZR?_g*Qqdm~n|3 z_yWfcogCXJDMjNi=NZ`QZ7sI zDCBAtS0Q;g5m#j-LzY9!X2W(J-tKPF^vC1jqw)OaI#}2feBucc^d)y62?t5<4gpJc z+6-yp@DS31#Hg=6l)Dz})T&A^=;GWRm%eOdf|lK=-ZR*#TnO3LxPb^;fh$5l6l{1~d# zbG%gGlgYsss$IpQX|#0%cP|;x>YH3bNxN$e7AID?U z2}2>eQ5um6C%oGg9sP81pdf*U>zum-|4)kzYHea=B7w7Y}R3KaYuc z;$k^Wtxg`!cyOI>9|vS^1Tj6${qO#XcPD`_{JlGBKCS6ttSGJpEpKVV(6Tz3+wN z{d6=t&OIV|SQKO9mX225c1k~N-@uw2+q`8Saz1G3lpawv?YHDQvz<}bHN4c_Kgu#{ zGckZdHQ&8q&^hX`3|V-gi5ShsnC|4m)6$Esi@XpA9Kx%O=@r8=3koI;4z$}OtE0jvn$ywl6+h`lW=`|w6VsI2kh6;U2ENtF zb8M9rIuxx_;ok4^Vjk;ykBDNI(7#uaVyp*;|Hw5u+g%{fUeBY5o>WNQsAGMzZaVs9 zt#11rXZ4XB+YDU)7w3GT13;szGk7`7C?@K5bQVrUb9Zy$(0p(iUEz3aPLE=1lz-Mu z3Suy-M$NN(i+ZGTG>?q$4iyZINu~znY4jBn*HGJ%vx@tYz;L!I#dgw+UBW6Zj_;OF z?SHB>Dp$mLtIHe{n`Q=$$!@olH4V-cGN!d~(R%7`4<44QHQ%8qQMzcc>8*Qn5NK^@ z#rUe*XK3*V0VB&TWhisOKFA*RHBGe2jd1ihq3Ccb{q_B;$_b!4!4AQ3O&-yB(% zL^zKF5^9~gI5^(-+$4VMHhO?w8S9^bm(8>utuKp2$lg&k8Je%RViR+SHQyQt;oDY$ z2P^m*R09`OLw8S^ps3Z0q<|uQ@3latF*|8v{TE1>bZ;}i!2vlMjp+7n57j6P>W-PaYiFkSjY&UFbm zF{6GRXAAQi3(rDU#dPK@#Bs-RheS2$YZKfZe*fvvb0-`}hJS*^+0i~QKN)DL=W$9L zk}bt+lZ*&9YKcECQM`^_ykga4sCa^_VmI4FNE2x8sFXi0D&POo54bSJNrNoyt_f}~ zHD5lu(2J~)fI}sCECuxh+Du8neKjp8;7oOJlJ-kG z=a}l5Nz3G{FR->&hk}k(Q`}E91e32BuWYt~UXx7^741h5S`$6A_%-y>in8DgthX^C zg1p42#k%p;1V#Kx1*V$|ym83cPosuGnW6ujK}>g|p-8*aKms@ujL_CVTaeDPks6i9 zS;HOe@w2t{sf8yNTGwzH{a39O<1_XiLk#Y`UAt3UEt5)Bg)}Ccj13j+312$4wdQS+ zMBNG)R;7=1NwSwtMF_50PCwUv$$VhSAFobIYO&22W5FtBlTh82hV-eTBg-BQv|CrOp>7`}%a{g>Q)&!{Pj~tiq#HvTb597|8JY6U z4iOCdS(W8}*V5K{EWdg08MY7>n&MSgt-B+Ct%=?eMsvnmAum#H~ zT9;Y0o;(d?RNG~n$WTBq#`J_;F6f04gNi0t1EQOt{!0y)J*-7_z4^#AdqTz5>Qi++ ztW#xy)bn8h34~T>Yv#MV%`HsGoJa6+2NU&;YmZvBAc^*SJ!lK(fmgnGGGHo3aoWt zB~o_l!ob;i9t@`w#DEq4w(|+3rW?jW^6X8s4QiZ1Fc;ioT3ktKe;O79g=pTzS&ZoNe+<>6C%VGm_?uxmw62ssX2P}FMbMRV@F zU;HG!8G8K60YPNpCfC=+?)o)WrIS4P2}eA)Od{qx(Z0e2yw@(sU$l}iS&oi1nI|L# zpcRP#_H&j*kcqT~lkC_E)~G%sOAeTd+5HW>_cSf}7Kn~BG^Bvg3uDy=G48TVD|E&h zsi(BFD~@9rn*Jwn&tpkr7+`x6z3`Cv#+QD58RXen~DVmUDs1(Ra}60Ny;{H z7|IK{+f@i?;?|QwCU)$)C|(NMZmwLzTNFOc7@CqNhH%fYTPu3Xm{%-4&kh>K*_7 zlj>f8*Wn9sjZF`|yMo&GG-RS(E)!j@X_6-srI9qCGK2&w^U&eXL>UQ|VXsNaIy$dO zWju?I*8$BOBifVmltp0Z+4<`wIK)GQJ4|f; z4)X@L9v9me>2UZlO$1f`%R`gjNuG|0_vmT?CcH@q; zl`HY?jg+796r}4%c=^{59nKlJM-wHGjN>!HJgE%=zv;l0l#S@I0a0Ia*6kasS{lhS zZ<3V{g5AX@-}PoIH@k=^D|xOm@%AMyV0oEJMSMKPfI@i@35&hTS1YKbSM~IS+M}%* zCr`Bz*O`R^tzX-@`1FW@2)yo($;<)$!fY7Qo*1iPWnC@~OivtuisS%)!H)T z&(u8Z8sTA-Yq93O(u1TOlL&LwP}LN)0LIul19J#+D+o5bwZyNfWaJO7iY}w#B}x81 zxQto@-$KQ30tiBC!HWYCw+5LhsBKOC#hYa@RJxgVIZ}|D3*2(4wi5Q84Q_13lk5oV zh0dNvgdBBdmsX*9}OHe}|&1qk4?P{7NVajpmA z9-%v_0_FTOC4U2&hb@wt2C)2!Bu-X+* zVTe_84qenvMOts=B})M`b-(vRw~X)5SehEW^L~sRDgFsm*u2gbHXzjKSlP6m-eY)o zjGtZ8+7`w4BnYHb``4m~As*JKpmKqVHF0(fX#a+ht(&QaH6#8s-z^vGzhM*xgt1_P zsOY=`OOrFu1je`+vU3AxVNbttHi!*t4un^&Z{bchJAdZ-Te`GN41>WbOTMX|O_5x}gohjgz=AV6%V&Bov z<{0|FKz;c_AKnsfoNraUPUhQ`|Af8dv5Hr)8dOc*15(q#R>?}*u&%`dyHZR4lAgv( z_6l5+X1O38#pPD0s?#oONRJCTun){eEFKP-39G_b^QTOqow>~2!)8k9c`H!}iV@(u z6*{F=(3Ht{6pw1iD26%i8KUhN=}>lVDgK7U?}f>YIU`;R5R&e zxR{C(X2Bcd$yzC}1>tS$r|7ODHG%rA(?C}(K}k#H`#vXg@USf1LE#===mF=KZ0F>i_X zR_li7W#JAd*mwlr9&<%dv-y3$bVq4sRC#7RHIDzI)kS{W=Vileo#z(s(3DcP$ZJ$j z!U`u1)6oi!$1Zn^a9)?LPJv+UnjhuZSl>kYVB>95 z543lk>1z@Z)q#8IVc-T>Kliri$I9=RSW9HJ@uugS#t4o^>cB20QnKPGL)b&%B&x~< zQH735h3B^Yg|yAtnaOn*rMkr9aJysmKVX*bHXQEKH5`6;jvD{=70cS)i=y{44E>#w z-P&3PsTM?=3cr(2y(DY1N&LFXG4E%ZxAZJi_ip-#H@Qr!QQ@*`?f=x8NYD#7%x*tO z)QO>0(ihXgP43#Xt9VdxMp_+!tTF+M=rU$;505n{_?M*PCV$!OuLWvWu#Ssdoqmn5 z_;yYxZ`Hd96lwBN?DTlwO#a~JH-X;~dUn+OA*T9Dd;n|xD*$LF;zTu%cel#wrMbhc>Dl8@IFZ;gD69#)L`iO;o5G_nz z`tMtFRN(Sm-OG_GO2c!8$j=1SkXj_s%}P39JN5s9MK^P~?4s0~00>sne}aW=^gCD* z{)aG1BF!u*>u+ralSj`ozm9)0ex8(%#rps{Nch#mYY5{$M8hbxDyNTIi)+4*@~1uD zBktV5r3HjTV6ccnZ9D*FBI6^i2Ce`*x1NI$fpkBCEa_Z;ZUMfcrSv9>0wIQ4B-IRCZz*YSfWf9(_50u51>j zzhy1iob#KGvb@?3Gxw7(BxPxc(||Y&_H(giV!0`fx$HtI8LFbswomMEFa`2RHRt?q z)Z=}W&ehmaC08zCrFgZ@)hOQI+2TpJV-Dn*@}hcOsbzlYfhpc2RM%F`Mdl2)Cp^vTF*ZNPt0Q{hYI93#H)m+K18r9wINQMX$%9l!?oL0X% z22OBWkT(Ssy!@wq<=@EbAj~u^xG0^+ABQtQEaeJfQqPf+@%I8f*G!#z5IFc6WcWXKMV_yXGlhE{cA(cweBPF<7~yH6_4# z>a1aVaMkCyUX%$&c#~y2X4Mkdv0Nb?&Jhk3E7W9vBFi+pIk#>7Bf zGI&bKEh^l(;|(y~J*)KqtJDS`4$>VWnC(x$#9uH1Hz1Wt*#R|+_G~xK*wou%Z!eSf z#Mk{h6>%zrb$=MW191tnW>Wz>(&{_S>!%K=78jJ)WabwM5x6(EC!H@RC*m8h)KUW7 z^0L)c;CXk!c!nA@p(+V(URz+cGLZJs{vZbq|MPRY^SQvbWvDETW)9QPQ^CIbIcPub zuFY@OvtxLJ1C?=f&wCGy(H%EF;Gy#E+{SG6-0rgS>{9Mkuml?zqjiZ~ajnBz??!PP z!tgux2D?ttNnzoQC_cwPL*o||+xD(htp<6I5#GxX?yi^IH-A*GZEb-a*Oj$|A@_Nr zHeXY;*PfY*n24Nr2o!4#pWZS-8wKo?ST>Kn!F9`@h~2a4e92wC81O=W1jEnkQSXf} z+lMh~u2I&!)fjZuk0j~pk%J!W5O7XWXtYhPcLgJ-+FU2!@{OJ1>XYLV9_psZl^#WBjTPwza5y5($Az`9jh@3me}kea6C zBs944t-_O*485>3@YWfX{3)!HNY-6!7G;n5c-+OAo|)jHm$c1ACqA7O>U!*&PH8<9 zCDX2u>2Q_6Wth?ZApMnp5u2l^;3-;(Ee?_GCbuGFhJuO-gaw3M<42r{T}Q-I+q zTZpSKMMUUNTPj?YAUeTHb2IfU?iy%k)&{OI>aO1P>x@~khlTfjb))k8>W;;5>Nw7g zr+&=Z;VKBmG~gXOugciuYCk4bYcu;D@`i%DJ&(1@VK zdnN4ypV6~m` zw11P#o-b?EQckL?h6qX}i3oH@5x$D(+GXpe8;XrVzDw5VU!5eFlG!s*4*#wbsJS#7 zlpOXwsu^7)X!5WW=qc=^@VeN8lV9F!j$Z4H9p@@SQU?#hgRd_NWsMr@G98#)>Bdl! zCEK!X4qC9rUPUk-ZPDe5GL1xr2fOo)1L(?R+@5DnMA5I`SI$Rjg`Uc|&u(Yecu5{)J@x z2Pp{fxIVm~q8z=5HHET^|A3r`4aOsV9;@P#BE4c~U*VUbKz`9QI*9|i@g1nUQnH~tSByLd%CWosi-OvML88`E z*MjY;<@lxR`e%JLFWCF)_uwU`pQGf)mm-3h6#F}Y#Yb0GNPHnx~5v#MiH zDXC*CgS*-1DIznP!c=-0+fdKVJY7Ex_l`IsVCEqzdqRki z@Y)L>UzV4=vqp@u@R@2zFZQE|_jctGXq~DwV z-OZ8v+L^h|nK=iy%A=hUX4-xjBO@r0^_CrhgGh3+&+?WvKXF)8rr?P3!G8aedn>2C zrz57;uNo^(RvXi{uwm>DIoZNY=*pW4NhbbK9pkw+qaL8#)FO`V=ml7?RKt~rG_K$> zV~C~{6~125!AO?2KcT+Md(is8dp|CxX49CW?DW&8(LNtT8I$Rf)>xsbrLb^P zJsvGzhdKzdk9KjK@&NPf!g}X1<;F0R$Yl`+G=P01JR|&WU(I9JPG3jBp%lHbLr2QC-yVtk32Km3N3KSu&V$k3j$DB>r$!N<;XX zZ(!9->ImT>Z>H&8^R26AO4ZuBkbO`sALv)J^fOSpxp7`Cu=XZ}Zg2Ei`sDPC^o2TE zpx+slk6@b{)`qVCt9(`1vJU37rcA@4nNXEPDckU3`EJ^oX*#t1A@bs$l(k24Ga)HZ zee%$1!=PZMRM7G3^p)g`Vp$_=D zXiv$l-xMKEvgE)z3##zQf2Spt6zrc;MY92&Hp)Vuc&5o!l&Z7?wbl0^vl}ILjlvrHwj1($ODL3WYq}nGt{2b`R zIa?|UbJX}<3^uCQnxh%1+a@JRS;F%RSHW>JtHw7(Tl$Ayx7eel(T=v=W5x6Ke-p)d zq{Dm1Xu7jGkE*6aqVFf1Mcs4D1hy=Ay3%lgEtrZj!m=Yy$*`EYV%>l;YRpp~7<(mU zk}p6NKzH~X`w-5Cq$_RY{|Dp_MVgRw^AhF5*^c(@Flh_3nxGrpUJj&BKA>As!7nGc zdw=*|?~Tx6=U4MRnliVkp*yklor?`UgEjpZ#Z6BlkL`mI@}3ZCXjLlCX|%`NL$^(8 zn&FBqToL~}oPHkMuH#_W6SGA|96 zo&4aI#PDiukn8Snty%HXrQy6%FBqwXhE>%bV(e;YV=q`h9yLgawo;~>;M@WUX7`^B z&*Xw#?iIh|0R=cFbzqkYwu3XdAkU+Z@#AhK_xE`a%o>$e+soBc($A0+>CF0HIk<|t zD4?Yi-^`F$M^@4Zw{G?zSJYRpBtw2i_<~*G_wtfDnMh{*wIdyi^zok9l!)F#m;Dt& z7`E)^s6C9nmpJO6y7~N7$||^Z78mh}-9We;V^aY!pLkTMtbeuxCz&-drD|*kvK_xb zpkul9#a%fUD=xbs1kylht*6+s9dV@g z^W{`PlVWs~@faB0$-wGZ>kRtw=7rfDzkYi7K{M6tO%N}^iBD=-Q4eUuYF{biKf zhS{-zl|-5od1=Jz4Danu;nUQ5Djw@(J=_@xQ=Gpa*q{pkb#5b@9-%64?GO7~&g?YE za>$kP;Q_=oa{K?_9gq*?6_qAlc*$n_GE#+`X>5d5*ia&=HS+Kh&3QWao5h4pHD!wV zceeWz8q?3`F~#FYU%sQ4y~oPIRZ4cbq1wzNANIZ{YT1hm=-c6FHM0TZD6{Zej8S*_ zG)OLwI5ol5U2PD>%$kRresVHgAW2q?)mhwn9O${D9Qb)1;Hbqk9ttHb0f;~sCMS!e z;fehq+xb}e{;Q0>7}fBMzC7N}Te#`2H<-J=G+zv0pTX7nrf`9k?U31sL)XK!my5c` zTEJUsS{_gpIh1$YVbG$gRye&E_sjfh54YJBw>f;u`18x{)gU?Rk8ED^VFvaCyOQ%y zp3QSn^Ue2ZnMRshj$zWJOs15t5|4e(;bQx3JpQXg;{KP8bmNF;yHKn?Eh0J~P3{Bj z?iL@Ti`dWTiGRL;e5!xfOo=HG6d3&~_;CTrK-`FP^UFB&vO2j1gUfeqmWn47+okMe zwfEY;py)eY@!s}K#Z~1q`J!KwNL~e7|G}cyqPfM2guuE38~Kjz#&TCv-KeFF!0f;Y z!U4)K~C1K>1s3m;o`Qs{gI|FkA3*Z@KfV91*+@DfKXF= ziLiq)&xzH6Kom8-t*4M{_tQ_I$tF+W*&X!rq0joC>d1eb7mg&h7ycgF!;KS8auMs< zkeY?8THIjac(auHBbG$&q?k{6E?G;lKUPXVDV~-jCN#~PSauB#xc(|@SI?REP)R_F z-CZ+rzPl&86mf3V-LNuiz4PWiXj_rYh`34>&NyrctGTJ~NRv(H#M1>>pOt<$CYT7q4-EutHtvVxZL?*IQ~O z8n2=V?vg{l_MSTLNAgZwH|?srY#mM~SKl2iaFH!_rq)#W!c~J7!03Z9W_xb3QNC-bSjmVk@^9=6l(h+1{tK}U> z7yyP+(P*2b7W=eodj#SwKQONTnxc~)t)12%I#dD-{ljSs)-Z!HLxXt`PS=qnN;?!S zraKhg^{?>ETr#!kmYCPLUVbl=C4X^x=#1=G`2L)q%-&+}BiKV!G*o5bFd%7AOOY&3 z(Uy!T zDCH4^vV+8DmOf48mNHVYRr^loj&hJe(x7cBNKnmS7wK8^BCLAsNvc$-os(vwwY|sC z2rw(POk6#wWr$RhmGxgb^9b}?*tQidf#=e4kv~y*_Lce_5KkagYXmu;YG{BBH>Q^y z5Tii|4JA>Pu3JM{IebIH*K4Q&nExm9T=p=tF+=i2kj$sDpam0G%+0uFxC4T-)GM41 zn%kdud5gUJsGxNnvLM(W6#J60_y)Olq*$u{gtzQv%ZJ^iLYmR0ZEbJ2og_}|z0Vn$ z;k1NDz357CJXbcSl1&}NLx1=JHtwHrZ# zrA=of8CEn~9QM&74*6JPRZ94aB`ApjV`Df(zWv1bS7=-Fn1a1EQvy%jH{TlBhH;^6 z$viT=scL)XS*Z6-k$duu#!FpWCK*n@Jo6MGdy)MuzT>jt@pIoI9ka)4=#l&qZx%?!kuh5Y}s=t=o} zZxBA{J-jz47r-OlVb}tr?_p*CWJm(&Scz*TEIEL(R)C_y(2=Q5#f&vmg=Ld@y%*TG2X>cS9S??U`Ao^R3T2>DxfL*bn*P zNREiPF@Gnh11vwY^XZqPNy(x_$sF;ZdV!1>WL?!x;s&@&g+Z=vRrHQcy!N!w+HUM9 zTNNZk_G=Mce`tm67OQ$ADS$Y48O0qM-2D+P#qDR-2sPJ*6+y{5t9@)?0oNjMnuCy_`wCX6 zYh7s{4OZRjoXXKhwf4})lLK>+8?X8g8#|a1|TlS zNdCgA|7eraRYJ0~V_`lWP;HkA{Cq0BA@+z0-0i<2a^q}r9<1iR+HQfjw?5!#dbUqH zvM$x1>PAJ$h)N=w_B@OFXZ4lgoPada+W&|PZ&OK5)^rau;W-i)Tt~XhGySJ&GGJ6$#QO`tM94-;ea@fj|G(GDc#S&R$@5B&xe&}p2NqZ#HLpDIz+58U{W;1|(7mLwibL1)y+vUI& zPvwb~P(Kac;(=0FIjyu=Lo3l={+dKD-Fh8FG*DzYUd+D?n*_w%HU3uzC@&JrZoRL- zJ__!h>^ltp!98Dk2xBeH)|!29T=!e1jO6|G^PR1SZ!KI*=s0 zSOE+NmO8^J8 zm~W`Ai z4ta^|>U6rt8mjhZW^U-9LcSwUkc1|`wSGeu{mSrx;h??fmawE@?)c|dF9~DFgu&?k z%%f9{^<+DFdNZo3e{}<0{uK|R=V|~gjN>O=c|^p2txSEld@zSvyuSxN!)j}h1|!B3 zW8RB(PXbKSGX%&!5D6Ogeer%XplL_Mu@=ss>@+dbS8V$q6*ddPt-FYh_a4AFgmTQ& z#e@b3cnj3LM%h(b`^Chq>!<0K-4|=k#^BDqc{^g0s$%%n0;T4s*kCBlR4h8I9 zc5PZXzHiB#FvlmPoSdRvZIz~R;`o*xtT2@C4u0(1wVnwqp7L#)tNOCv8?KUWN*|`FU%d@n70quVW;= zm=yCT7X)}+34uqr(AFSr>pu(CJgCxl*qp+GVJ|k_T$meS?Q&L3N|bqSx2;&=*)SHj zHvGx@lgb(l8pr~P*){>Ar?o@Fin<9Dadbw;S));q(}2@csMx1eDD>B;t$*UC`YQK6 z=5D4fKz{yzVTZ9cy+@yh;n%W)mEMu0E@Ss?wghic<5kSpU9)YB=K9g3AYHvMel3chGY2A~Xkqo#z>?LzgHa1!^;mqaZF z+&mnIYEA}v=N33+78xuDRTIPfbsJxNwB{U?z>PB6I-x712JV(!Zwy16s}^|~MZau+ zff_j=u5^@IT+T7(s^%}Mea_W*KLNs?qdt&pM4hhWBzo(5#Q(*fgxQX@zj=Ybbj#^gQn+w8(5_>*&gd|r?iG)S%;O4qiPz12<{V$ySn98#h2_T*7TZj?8>U6J{;WPHHakddP#t;sN%4^Na z)8=kdt1k&Sl*g>IPE7wbdYQEtN^v{$mUUnoL}>qxCcDg1a|xqFh@Y{Fv+j`Sh0y%O zFB6;7@ZRV6&n_z$r!oxVM#u$WF_N23!c_;S{o;`l>%mBg-;LodADN$_)L5>MZRS-TCiM!QspONs4(7y3uuz znV${d>fUuKYz|!?-*)S%F-Us9$BHPCGtQ9^r(+YjG`R@-tzNKVKxxR?5RU};smYWuWEV)ZSOu2ZICB7Ep zTAa)f6v=J8JQHckUBAL7!EciL-}88;3(%b;IsXLxL6UkOo#xbSQ5^KQD!ed~EObW8 z;A1sh4}u#dv>BO&d_!JT1|9S~+KaAVUp14-WU&!ai63eKhHs_Vd-_dBMmJGDiODc{o@iB&Qw&~(bO$H7q`CmOMWiAfk3lU*z zDTTm?rwK7;!$F2eYbyvB2jOL0yD*@7RmW@R91HWZHRIv!T!^1@pN@dse#$daTpRTw zsSL1>kbVrUUv}Bh>)Am=c{C!@!WhLEy!$ML7Xbz?-~Q8)ghUI*4IEC2L(($4wNp#! z%C6Aj`1d4Y{*C04n~xA}4hPqEOs#Rk4#;c6tNq2`dFpJWMtWU+Y~ zOor*{>#%y`Xq-Ik+pRp67?bzSAMd`h`N559Wz`p;Nyt z9I3S<=GnGn5fS%5h938{`%|^r%KGr?KNbT50{FPC2$~qMm0HCP;TXQD;EVY9$0Su` zQo1VzSgSmEpF*7{j`ca4y*)W_4>{s!Y)}t`e|?wc+}B8RtrWNs-7E>$iJ`_k8IeT` z=MohU2L{Ap%zviGdj%E}J6?_1T=c<7bW^`tI&vcBhCH%&v^NTw6|M2{eM>Xfpwj|B6tiR@&uU{5tf?=Jgb-aAiELq?snEl|3 zbU8RNbrEaeq1^=0{0@CaU4&kQ{jl1@r?U~9M|pj7i;1;T%OSVyEZW2fdmK=ExavnI zU!qm3p5u@`4W7u;U)I@7xV@=eDeX02jDAk`4FR)nlCHDjh5N(JSpsLoVXuh!z zn%=_=1BZ#0{oAJd@hi-?Ya^&=kQWW}0grC$WD7nU1i8|?R10n!eIJv>)-dGnh>!GT%2Xw!4 zzjX9uC> z)fkV%VnH!$_xTlqkH|W)-~k&47=dM22FY=%BalTm?hwuuAO1VNuR>2nf7ooqIF5p`yD#XKjY{xj{U7?K$Tbfxa$`MzOTQd!KL2VM#cKyJNQ4>E zdX+e#LN8LP6F%(lun}1-7 zNRp#q;{dz-O2WB!#bQur5O_awc;R`s>v~oHQen`x8^t-|D+9N&XD}Q+M${n`41`hGyvU`X zsJK2+*q$*v#v(1}qTgw_WJNZI%{vmyK>@Y5l_cl#Z=Tiw!nVvnVS~9*JD-_VP?UbDH zpoZ}y9}}Jd`s>F_SW67zlp0QrE`nK#PbUn%P_sIoDunCPC!iYYJnlH**czVuKsh_A zpXNs_R*5ARpBC@Xv+O{Xl%ANh+X@ZS_!QFiDE>F_vkFIM`ZyenDAzI%fSK5qNZ!Q! zbe3w?dcXGsv)M}O93k?Uos_RdsHrTRDYf=x(7d8x{!C-;z@`L2OOWljc0a&*WeT|G zvC|yKj19IJ7diNF>GUUskYMHkso%1xNd0`kI|7L3fUDn#q5XTUt$!?hA&#{&@U`pw zA(8a^(b2X4R21mQ!-GP24M9VLlo+&rAC%OlKhy9q1a?tx@v@&pLjv%F-s0=)nG8~2 z)jiQdcH9S&Mzw=fNCoF%53 zwGE|TtLPyF@3eMuwI@m~W)&rqD9lwyux6+PeGaQ30g_^29{PFY<+)UUyC>MH46Ds2 zb@)KzX;+%1C5<-;DG`zI87gtQt8&=)O+B=*c^nWvz{?HM_fh>SXwVtS{5i=6ohS)$ z+16{W#)q!J!zeH*+c#kGhO+-Ls;!h5y+6|H6G*S6%U`#adGq6<6beoGwwjK8M|@Pe z_8>YL27l49a?oYVd{-)NFy)cM!|r-An!Yxx)^)8Pt(jYh7CL~dU?NO4lyx=eHERk< zh(6&?t}DKB%5BBUwYch$K&9z$9`jn`S^lN`RqYdPNye}&U7P_`Gh|`28a)5{&kEC8 z^yC|%w`84W?=-cexS3)mDJ%x{duzA2#ekiw^eQ!_$7Np`@ap3PW-iBEAwi=93>o)r zqq_1aDWAf(#E`*u5+i^ql$TuuJmJ_jDL^`JI^aT$*IJs1H<Q8Z*+kh+i3QN(;p?oaL#b@2o_R zxEfQ9(0{$ODoO7xyMX};e91IhI9ap2MTUM59hv-Q`RRL|dm|NO%*IqRI5G zM+9qb@T+OwbbOw9*QWphF25bcu*4*xijIYi(0~9fYe-A~=z~>raxtk9LEHXW@$Dv+ z`y=P#3v}%Cw=dfuxiER7&M9iH=xb$W{t#6#$Su6{2pvMkaxk+K-7=58*N}-TfCEvgz@$&j64#ynMnhMPo_9;go z>um6AoR1X`VQTK+K6m=HVk+F7PG=4)!Fp}iqb_Vq@+h$Q0cequ+y%q zEK%pA?Z`(-udFv{GS;TUw_}a}@IA++ssb}}2uo#%F39|30{GpOxbze>-xRe9<_O=f znZYDZ-TIxIyJ#jtj^QL#{BElG50!Q+YM#97;MZMt*(4*R8N?KEwJ75@pl@}7CmdPjJNZ1x@9e|ToL{A0Aa{-~6(*~_HWdLp~1cw4f! z*27wyorrRo>8vZiP@wnVchxu&Kq7=h#~2t(AU&991bTaL5-3rU0_24Jf1;Ga`P+h# zCPxCKdMS|Vttc`n22*~R#Wg3yTtXU4JzN;t@;fv=UsAHU?u4K|luqO~NP~JQcNrGCOZ<5v{h6$P^_^s$|*1o3j`OSfTlnS6mHp~ew zSTREk$PLcJ88w&rJlkvvc(35beWqK*%j>hp!Vo%LDE=XRhhB-Sa#9)xG{au zmj3?fVTAqJO`&F6vF0v(_eb@|T)DDvsg5Crq-BWrEm#_(4qGUD#W67U!QkPPzfrGkm56z4kA?}$KeNr*xm$;s1 zjtDaU&3;fHpx>^A_NUyF*#%R0nZj9&n_YemxBHtp@VjV_ zDBCCF9*?trW&YN(;OJFJ$YHF;_vI$w>MUe3edo%d>0x1MMfO`h-+e0z8X@8hvFSec zYrxFQ!gb~54&_-u_YlKgu#AiAL*~9FDml7?&L40|!RCwxCJ<+kc$!YBicQYz6g9@A zr9eyP+z|q})}2fKK;6y%;|+yQGm&BOrNA>*J)fsb3b=v7LY{=gGZUDt_*EClmB{2dZ*DpsCl7+K1`**XfF#RtFi-4F@=ps zCc6<5wDRoL8f8Bj5dv>}sr24X8F+$hfG3q1s)f2LufEGimp0 zoAat!dW0Uvlxa=c6yt!#44GHn97-Xh_m9JO3A}5+KeI+wpw{JvzCIs!1B_q;@PsRO zX}KP2fi6;9>g(svpIk9aM~xZSi6S25>H~$Dmxfn1rl6$tcbzK5A?s;X>~F0Yc#l=tUD$fX+z>E zRDp@o82$j=e{*!7#`(>l{J+BN?w$_O_3iK8P(1m(ot-KQx$i- z@sK%a*xe9{6l%!F-3TTu%m?fJf1d`6dIvoe<&Eyl2u5t@f|-laJOVzd^X(Tr z@StDKLejlLS{4Dt55eSgBsia1L^+0S)o$IpLn9r~`wb+Eeg#dB1T&U8`A;jOSo>i9 z?}8&`whE5_jD}sn65^R4{BR|7QOo2Tifuc*3OyjzeE;WLs{RkfpF2&go_~(R3k8hn zrA}p(QC!Zj{OskM#hz=F|4ieJ1K=f)pjP3lg>_!A&X4*E2;G&MWY_tC*> zL{-?HKThQ0`8Vj~1(X8p!^7*L^8cI^>L|VmYqC&DD^YULbG}usO(6QZ8*V)3*}mTT zx6ARLwm0^f^riU(1JbAJ--9r;1f}|-)ne0-bL$8QVdnM&D&47P#}mn3r^3t`Hw#n* z@y-$9`kBL+%YgiYouUdh!pMEAZuxzm2B{^Ahzk9%`BAL-Vj_4Mu8rX@TBFg5Z7TkyEB6tLQNf7k*TM=j*A`qFx5 zw?4fFI1qpyh>roE9wu+*LNgoBqcgR|hSyo$ffbpE=${BXNhGrby1(ioYvU!pMPe63WpE*=bszs#qQz^)~CSN5W}+H%CeoRr}grQ)t5GOIg>gbtHZRW@Df`(I?P_6nYLNSBu-d99Va3Y+}XA?SNjs8@M))a zeC=ue7>;f2QubZV{!eAIG8zLn+}014$(9FGdIzv4C!rI|ZQ2Zt1r_NN_^MgnuM}6P z#c~C4V~u{`@qfqp3Un2VC8sUayW5hk49<~7ud2RwR-~|?6}Pn$0i*}~?>x{G%V3w8 zVqPl63tgtw2SMki1zY%AMNWRwP||KOP&=I~H7DJ<|WNtpdok33gUz~ntnun?VCIc z@3I1Y_7xIQIgdoVQ;w0(e!G~5MqcSQ)6jaKLUlb?Q#GmM0XAS==6^*nq7^Pi4HjlZ zkt>lNwuwiI#PEzpqT20#T%V&}S)_I1XAFk6d zsk*O_%Rp%V9TCOuU;xdQ4|l&x)U=Hv0j9CW86yI??XwST-r_%zbaL6Lg9udNE0M1N zkVpWiaM7;uEv0ovJlkcnBB0&yb>wYPGaM5S;=Dr6%qVOkFOb)gvZd#I4cPWMjknH@ zR>%4eVZ2|KzV-G*Bl7N4$EL}cH-5LhB23X6U^j`%M4g+eOUYU-7c7PNUQ0H#Vle-5 zwAI$k&IKXW9;LMx$gF~4^|yKho$M821x`-_TQ6W0m5)Q9NS;D0Q!~8f*_kaBO%0n> z9yl`Ug<Iuvt=#huktB-w>5UWUw!-8Q%t=GGiA1aQnvfpM@0FM z?@wSjtc@Rgl3C>g{zITe)V_p9SfhQC;DVyZ!oaVCllh?;X3B$3TXEk;!E^~`J$^xn z25x@Ce+%9GoB|3$3=Q}5pYu^E5?^Qu?NB?ZOZoEekqjHd_X9(LR5$*brx-07$n_;j zJ-lUGZYu@b0s8y$`;yHsDo>fb*7I(aYsP& z4@2aL{Rns$>W2(KelY!FB^3fPf)=;K3G|cw@zhhbv{V4=#1Krwt){X71?5)w?Exg& znJ`rOI0vOdjINg{=YzAl?9g4y;Dlo4^)=c{;7ev(XjFVHaOdwOoU%1U(cn8mnN-GJ zEt`M7m*~+pg?c^JonZhcROO7xDGOFP*bBSBqo=R*51RVK;?)+LD&guR(zV46q^8ta**W)`ci< z$f4UNc-6x!?+!waLwV;1O`M0R2WFU;-;07$Z2g+o4o!L2@lWE59xq*zm0web=F0v#z$b{ z&il_&XuXhMckeW1 zAxN=|$OH>e+}D0u==et34G#<#M`XRIx7L8 z*29sHt-_rvILt!-O*5MR*^Ji-)%*F`8#`Ag3bfNw;=kDYkSkt?o7qtGO2nT>F}JD5+CvLL{yKrH5@J6G!kKRzkoFGK1Ll3lHHb+L zeOCL48Kj9vOlJ8YdZ|Y0_X?6>pbtW={TM%?3Y1|QEBc{rmd2H%hTmlyz|Q2m^NIUb z0y|kn7{XECcsKq_2h>g{L%+!Vh+s|hb5r=3lIcb33w6Op6cVqzC3Ke_X@lWKHaI%f z2fSDW=?Z5AGOH5<676@Ae;lPR*vxN*`N}i)(N6hgy3#|?#B9CxNf*ztL3A-5SzA9E zUpX|)-%JPw0Qk7Mrv1&!S2Ie zlp?{v;t1=|2plAW!P$?5ukoxPcHgZo-ew3~=$P#RW!U$$8H<#Pa&h!na$Y0V_j46i zrhE=j4S?{oe-KFN$k^&+7#gvEvbq6z@b&-MdzR#*fMtiG{hkEULx_2ri4OdEu!bn% z*UrmiJ%^*)WxU$quF2b3&@5~R zwT5?pf$$D6lt(VVg+Z%@?wkNC*8nd)B_Qm9T1gv@fcaqkDQ~kvl$q?@I`*GLNZPv2 zdzh=-6hPgXmTBlG$FaRPm!RzMCE!s7$Vf3nS%iNHtnj#Pj6Hx$AJ9*?-HEtbw~M7Q zcOTO1Qe27O#M!yaM+@z#VI2$jk6Kx*@4Z+z9(X?osjRG|ll^O#%o?haven*vngT3l;Ik{2x0UnvP)atffa(d05Fr!m~@~a(;Wtq%(w$bB~-v z6dECH?ev)wR|p@!ipLnCQO}p|$AC71``&|TqYeMz*MhO&^mCQ?!54i+xpF38LYz(A zmN&<`ln<%n8=z<-;BV0sKeCcFpfPXP)dD5+g&K#P> zS+LMwo$;u%pi!JTK*Hm0-kO=tD6_(@0aqbRDM4&9Tv`3nq=AHJ4T(39)yn~dofRc` z%~A2eq#NSa$~6SqZLHCu;cn!C6s>lU$8p7|20h}VS>@l{sS@WCAOp7lg&Sy`J;Fb$TNzF&vb_mmc&>fp>OVG`#;NF8 z{#`lq9nV$5>X44OypDQQPLp3pj89VaW2}wKNkg*1*Wb4vP$~nH#zx5i*FWDn^+vRy-Wt64Jo_7P=$?XL}Zhpr0JSd9~)oMn4Q&pdY%exMKu7%9^n) zC)v@W9Ppeg(REa?nY`DN);BHw8?@?#>6ycY*N{Wb0tZEGVua|U4=&Ysqa?7Xg(!;O zXWDhaS1u*37LfyH|D8c+xnluz2DU=Jr1DmtEP@%R4+|J7brs5+3J)|xrMdH3b4z#C zB`6y7ePiTgWBQN%gWt(lYU)~BzWY{2jmT>JS$Qa*Poddy@44BBesNoq&U9WAd}-^) zMaFo1f#Yz|hA;P)j!-C&u!;@8SJ8{r8JYaMIg-gLmcB!^(NBACkSHt|r#zuJ_C;(m zK8GNC0#i}e&)_#CF;h^VD(4&7Qyz*e5jQ+MDf=|90v(fS>0_{@9t<) zRh&e@R|mAVIj-R&XbT56(qqv6Bs7ZJOdDkj#YeBIG?$!XO;^}o#1yW-C}H*EU)BNM z1~Ed;ENBZ##k{2r3qa!$QIZ8-Xe)A$fHOQrllvM~8mmQ=xb zy+uo-1r_dvVRv7L{k^QImMmLEFYqtA)d1My*8XS+Xxo0pgI0})I$hhQ4c+%Lu>PdH zZ;$su19nw1Duy$BrE1M_{sGGDd!f>{KDfBQSM*TS2g?ABKjt6G;*%C$hDR^hyu?DWJtQLQVciM_hcaNA#Cdj#E}6yLPj?Ua zXvTMW1P2=9jQnc@yPJN=vEMSJQEhB=@u6k$DAV&1cBTzL#Cj$}x)DqJ?Y5u6|&v@PbJOeb^VtfU^9 z?6Ch>zdg}EJlSH_G7m3EKL-9}gm&}*IW@x<8V3C0B%hkid{&qcJkCAs`M~53^pTc0+CvLl3 zUMP`8-Btyvq8!1(PTDOJXdZpEd{Bp6@%}jUT@kSPp^! zZT!k}4DZ!)*oiJYUr}&_K@`P{csxaHAeU;gsWWz%8w3)tE}uB|ZK|=cFWdYdu6|4jVV_oqy1DUAYZ$;E*Z zIZnJZnE(gUv^7I|KBFQ}PhwwbWKzNrL$vLPI?wHOH|+g0If+LZ9sAqf4oH zZ-nus6&3f0wicN!5Y7%CJH~M5MRR;zX1Dj=Q!=oPnbUnY$8a^k2JZF|bC{euU8)P( zyrOiN2i`9UYf*Y~q6W@wdl>`b3u?k&{GaG0y6R(J2AXMu9>*hwX&&DPY`r-KqI<4L z4Nhh^8&1Jf|);vqdv->0y6k8ud0WFS$p`F{(Z_SSn$b)0mQJz1h zez1Ugs5Kp(8XttU3O6F#y7casc#k==B=EoSX9}eaPXsSH7-wR9uCg zsZGa-K9-{bN$IGXc)KtJU_C$IIDR-Duj0 zC!5H-3&tsF`_cb7awLh|MSL} zjp^`T)n$b1fkwR>av*`g2Mg?2ZbNItc2{();?t180V9C49NOI1#CSpczNLSXndXXD z=Y+Ezx(T?hI|ktFC>W)zE;LnC!xQ$G3Zr5bQpMOqgT{IL_|%tbS^!@#DHX{olT@J{ zw${*|5Hnt8=gqgf@w^nVK`WHzwn-KGF%HVkbyma>=TlW(cOKiCsuE`f!`{z_T+{*j zj~!RHhSv%>u8-f_1g&x7`Ry83Mi%+|+J(VzBsuLo>OTfuRbYQh^09#E0B%t^1!CH6E}l-*uqzyxl;? z66DM{DS^w}M9i3pBSGKI1o&PLBK6fh@wlQ2@i+yBYy(+#NE40cm3m=j11_0)J57&> zvVt946iPn`jvXCRn`L0%lI49)`Ak#bXmZ|s{IrM-!*YIe!iQn6g|YEbE)+fu<~t(X zH~^-od;8~;@?P-22?IU=Gk!xwTU^`QUKTTBNFvt1U`T*KxtQ`GGRI>74y_#_75hZe znijMy>i-w4H)r`mOSOZuIJM|Na!GbuOE>IjkF%oG>s3cAV|9To zj*y0YAb<@WP{=4E`1#mz^d#co06`(7A$;E4DmkiAUC%-o2leWXn z#F{jZyk744U=3G8(`c$0WQLCdM8Oi-9ifighLoa}Qzk%=Gu1`=%en+(gn(EVDt_8o z`vgcUmUMdf{F+NiUEFbg1kjSJkt`mk&C&!NDL zzLBugKD8TE;0m>KK+%Q(@JPjV)8Y&cKNv{i3V>lb_BTksif z3V2P~BPzZ21;^CIE!3U?juThV&ho_NrB)!V=L2=u$F!$o*E6y2&SbpIrX;W8i9IXe zV(ZR}MLe62Yi-M=2xctFe7~;>dO=LK!H-7&A?h}(B5}wX^~AJAY$>ugt?;`!1a_OD zM*&!QgGTdjv(p8rd4sO?-AIm_&crk}Jc?plIeC*BScrli&qG^_gEGXg?g|E)&QPAK zU-C5Cm4k)zlb?QCjzs)H?1L@n(CH~;HVsC_9|m;-o`uN!VN0PILVk@W&)69Vprp|i ztw8G!FpK5CA7%+N(F`Ezce8!m0C6Y(8&d1G3?Lc)Bub~{QqSSVGq2}NB z)3B^=LZheM=`k?YZh*3Ow{UM>WT5!k&ZE3p0)~VR{)-C7<+nOB_`e5;`@Ebf8^Z?D zYyod|e>HvX)V&Gwe0Rq&I~Cq*xckRc>S=Vd!*4! z$5OmvLvS0#+hPm7IfQ=SL{GE=6EYSnaL0l8vVKy!y{-^2JQ4FEXj)dS?{#$_(!>N4 z%cR@H9SX~XXPlzHQspOqR&jk;_OlkOXt+W+g+`r9j$c4b_+^F08!gq~>QDa>9?O^W zB=6YLdywD5a!(w)8!Yj(Q4z%;a8GD~K50=Wj8w#Z1ZFRyl@G~1aILIlE~OKT$=;8K+5X@g~)5DQ9|`>Cu>{-B_aqc z0I3tO*Iye3=LZt_W6{Q?n-v}pA~d5|p54PbZVz&K5K74bhn`sDb_Juco*mF1+gY{C z8VkpK16Jd7Mvbo0?xPGhsT)il`%hStv;C@^3bLMeG_{%=7?$nnJDS`SPny7Ym%3yP z8mZp3Z;Qi5C#Ba_$B$ZsNc2;w2xU%7PB&FtKfJ^s8QG*v-6SYJ;K=wsgg97^1-+d_ zr=@=T>j%pqD*AojH`%-%wC>2WX<$D?H@(1r!3YT5MmJ4XqU>PWOqGY@AsoAmIv(f) zohkx~HdC!vS>+bszw;wPjaia__`l8Z+hN$Loa-uI@mKgZdOh*+B-akwlSdP7%yTXf zhC&!>gKQCgpJhF2@e0Q$S4KvC;e;TdIi4zJ8-qG+b{|EA(1sJmr`O1e+YLUDZd_yh z;uY1u-MBsWA+AHT6SlbQik|D#;i`F?smK z0~{HYLx|zu21?0qo-DlPXzQa)bgwGdF2ib>WJ;KT$n~|G8Ay%IHkMP9p?)%1yaJaY zFseIXtn`E4h=VNsc1DzB_*_M5Sld3udG&VPAj+MOYH!^csx^XQeQY10dzV2R@`3V> zD#2iFVme8jDI5a&G7I{`LewO9wdMSQcsZPf$k%4KBr%&eQFaS`AhlrtI4{NK@fY=D z%EKGLH@=>uCOEahVDW{;;i18OES%j>U6l_{p{tc4_pGC{bDf(wDp zE5I$EbumnyBpJCQT1m>qz~J`(1aZc#ZaahV?aZ#gthR19X7`c<>C~NS4S$a+?qOOA zLwo0?KHC-}%!H0{h{<*~y+XQw$k2RmQ`*vX#Dnu8FkDro$*-r@l?+9y9bxV`giQdz zA80eBO`#ZLz96?2%*O1!Q(!0IPEJ9Q(QmuyrP`h=JG?m;SQ&04b8Yx)hppn5pjbp> zEeREcq5|W4c}seULNUbV)|Xj5AtQ)}MQf)ov(~OZ+X#|&F+Fk71oA1{;CD6O+Hm+( zEa53vDwg}c*dpU@-i!!y;T?FC(DiYt_5n&6$sdHk!5~Rd=%Kzpj~%uzmL*^B$WX5;6)OB?DSCp9j-BIw zBBgk>vSkOxjUYNfL}JVSD-zgRxRKsan3h3}Dy5h4ATMN3kZbbo#>0@qm z1Og{rzj0bm*F5GFyAU2qKI978LJwJsIdKW^)IW4 zwxb;#$p=m<>3*=ke?OrvuRy?n)}?pZ^~k@4zr>1nNt_1ogh{Xw)-#B*dAynGpR+MM z6Pd1Z_fupUiA@W+UC~!D)AN?4utYw>m?E$C5kbK|1y8otPofFeEg_%jnAPcT7k*6b z5t%jq4n%4xdd$5NZ=O)?Ghu6TN>5469p%oj#HQw)m7CAcHtFL>I)e%(nDW@-AB>TV z!z+(fei_=p^dc8aM8hFVMoLQXR?aN)^SheFN%dg)7Z`}1r1m6ck%!4=P%IVrAZWa| zZ!`JbDepymQ;eXeb~tLUxviK@XOHp%;GF4;iP&0nrn?8d6%<+9%CBTfwr&x>?AKko zEj{iY!j!zH$g%ECq$^CmWl_%r0J($J2w3#`LWZ4%!M_Hxsx4gU0M0SkoU%SKZ%0^zT(R?mRRpk zfAtlpwjhSPinWwn(!kgqqh_gn3Bv5ER-VxBTfY>Aak$qdstRcoCI0iw-~Y%AgxqlQ zsMHjMoDx=-a7qJ(gtcc3N@JG=F1V1J#qn`X0Ik>&^g$mT)07N@lx!J7_4VynC@TIOflk|V_ZC#cBxOkj3 z{Scv)abdFga8%*!uvX9>%ycb;;$hmS+s=KBDU{ETf9tWXB0C%s@&No4O*-;Dp|X+= zsY$u3D~n?1)A*RFwxoEeY+B`*MBH^7R^iu-9<;ak@<#7Ov7Bpa@(L3_b7&9-dM~5g z?Z0%kZf_SKonx-*cI)OoX5ekJQZY6HEF5n6*uO}LoQi5?Tes-w-ke$$4B{aS*LMB} ztnle*DuY_HW}9WjvA#i>7fHFqI{jHMe0V9t$>(l*52xO}kZ=8P6>n9&@bE<;ag^v| znv-3M-1b5+XRCj~8N|Eb<450ZbI1gz`0=z?rvv-NdO7O4eMZ^nrWG!vLbddL3q0HkjjPdj$hZTVs^_-4v!-si$9Cz}Wj}}f(~~oU2q)|aO~`znV0!_scZ-ZC z6*o5N3ZAF7Zk0vVYEnWahewF+hOP0pmZ!*>Z#x!lFS63!Wvpd$W^dT84Cn<2q>E7h z&Obetvbz#=6v|F4-U9Ql;VI>MyHK3QnE1u@O9t7oBg9{cskc8$X7&}{NT~mZ9vMab zWKEiz7>z!B#i@vx-<6$^A_us@8Nmv82q?Z0GzX<{j!YQny;ox^yWNONJCgtk9&|^~ z_0b}vAAj`qK8@DdGHu+{qN`#0t)UrQmy-h7Akd4_p%f^oT;QDdmW70v(A6?6Ht~Nz z5Rh{?5qOkjAzrS}VnIjgZ#}N}3D+@-t_;3G*>=x*1nr%L$EGJ^j$7hvpdHT@0>9SR zZZ*N$gm8GxPc`F(woB`AO2)y^(|ELd)yTywFqP)Wh}8;Bf~5(3Ktd%0w=J{QszCL?CbnB^Vzn#qyTYr@)M zZZ%GScbxFFx9PV4PEk|P|G^^iaxdy!FPiw+{p5)Ku&}N9hBk5vlBI^HVOqU&CtcBB z+O@9%=QY|-`-NIA$4o6q7r?njR)Y()V{sk3~ zX*p##?8aInmiRXUkQb|oB}>EU!oNb@tQ=_VdDUbuL6M{r&Wl`I5tws$D>`;OheP2!XCL{`cCvPO*|9)pNrQOGWs+;;+m?~cF{3ICOc z(?}+Ehy!P7=p+N_E6jBbm}I3PEdvD0$p6PmYA)FXujKJb=UDN|usJ&%COpL``RYzt zl~%6GO9Tnp6lHv!F|_x-SWyu1is+YbypBx`+HcQt4e_+HO%UzAUs?{&ZW{cm%00pF zSI$V4_V)6PH^XaRTb55a#deG$b=hd6*w=TCrv;a>hD`+M?5V{_LPzN1DmM!sN%?+r zhBmP?50;VbM%3(L!M9-Bjfly!5e;FDq|nx!m-6z5!E&leG(IVFg*SrFq4hDpf4fn0 z^Q^&#Z!IOoCHgE1C4TO-KKMIQIZ2CteJZsQubt}^ZoR*WW2 zp4EezA9C2J*>wp~Pj^b>VH8mx%{1xUJSpYly&72@c6S9{eZ4@JbVH;+!craBCRd)= zq`(&au_h(@2DGBTOT??N%!HQHhMFRm4ucqD15uGQ7w%FufzbaT!R-7!QiM(L#F@8t z(%a4Ot}_~(q|-p;7b=qec(m&Ljl*HdCxHBC9i7czdPZis(MZSaCx_XT-}KC9Eus-F z9h6akp@7Yv*zKCVr*IP=uJNx$X=@J4d@gnm$wU^h-99gNXCGHAxgA#+>Q~;(wCdut zH19q}_ubuCjBRG#kyD)>jnMuaIECbvFgNwvaXHzRYz5hti3}a@Ii#MZb#&2tRY3ZDVeP#W@d{;CwOwigbedS>>Yfz~9_3DpXgEcw9bSeMa z(pe&VI^vQm3!j+g7sjsa>1%(sSi>w9K4bYeLNOax1x$IA+(VxVRLf(NQW>e+QfXh4 zxN~T>G0{XrxdYmt4ePIael2t?e-CkfbG(Ebp*|LtjjQ>-uWLJK;^htrgCLd1AWHJ9 z5bPFu;EQyf(tM5&PexC`8PAHT$KRHa?0&!~OPX?x^n@LOiT}&&1@ro0JT;A=A-Opw zWf+Eo)By=)V3kOqP|K%J=#!=O8*k^h<%mfZP(So9=*uM5+nba4TdyzKc={Bfc)sGA zD$U)7Hd*)Xl2cn`Jjxt-<^jH21`tb20ni>j0N2~>>)F2odLov!c2vD$sm2ALTG_C2 zCpl2DHT&7yCXOf8$({|3x$@$vh0)&^VrWSf_@|W6w!nLcp)Wej7gr7rHd4Jgb3-UK z&1Upx3u!kbGPC4!E-;Gect1a7Dm=Lo_$l6Bn0aHU*?F}LJ&FmATc*U`nHZlvF0lPg zl<1<}fuv~Io~VlWC6sYl+erG&u{A?3kuR>JLv@p6dE#wF`Jm9Slu*ieGnV4O z#SmY|7C1svg~%n)WGxVZO{kETNuzBwmb+txd=S2^`gNHnWDfFyP<&0f&(6@NeeS2F z4g;_JT}cc^^LIw48wT&Y$GWe>#`+{Lp_Mp&mht7L`_o6R$zR3HEYSsBf$p3)Fux6m+%)w&rzO zxNoq}atshYSG$@*777}@_kGd$qBb?MyLS&O1tlH3 zyX}7Jw!wWh^RkwJcu$O}?mf0-whXrS^6Oo;Y^C$R!hr!3+Y^%6{V%;ui52L|KVo{s zc~}im;>x8kZuCZP50X0o2{sLtvAv(MB+w&f2ZAN%5G*kiZsa2ZE2>zhIPttzkf}RJ z>3b;Qrf70k<>soVaUDs}wsR}K3+eUEc9oeinfE8~x=NR-hGJ{?v}*(E?AHO8%Q5z# z5Ki9ccG!5@Vy{BchRO({{dCCoi@siv{hKi{Rj5450;L24wvrswJ@}&~ae7rJBtBC* zjK~Y2hgYi0#nMq!T}e}UJPRoK5#z^MdEgdAKui&cfTxNoilw@jkE&IpW*hr71Eq!} zp=%($vU;v8-{c1;8w|*`2R~aqRF4PePAcufT>w$mP0QVzV<9f5mF|EI^QNy1C76L3 zGo96YSr`|BtJ?vdtJbQ2DM)Cs7$jX$W}X?xMdpxhOEeENbPt(p>`2z3 z;}?^_mKZwjC!%vB>HH1%cxBm4x9wb2b^t9D>lzMUKOPru8ap9xKmEl$5xgZ`IqGRa zveQ%)dor^gxch}`(%<}%f<;uGj33Ft-)VQLv#tbP@z= zU7)l3uKp`00qp%r+qU(Q)JqmT0_h&0svpglY1$my>rY+?;#WGj0aR^s_UJ_{ zAi9s)LO#04s-Y)MIYu(~HIG=Y8kDPy?e%QLK+l-@vkJ)rh!Jytd)Xe)lb>Un4nU0L za@2ODV_;Wd^MK;@>k%=#WZ^@|EuIQkt@SavybQ{ybqu7mVdqU)0+N<()x0vFa{hx> zK^#g`Hvpw=PJpgLH==u|tvH`!&}1%d7Is4%p7e`uQdEOOD8|>|@bn>^}WX5p4L8&}y z%As8Y9QL8v9)t-Jx&JNeMOv1p%ezN^}Y%{uN-a1?~B zh{?g0K-M_cpRp(*PuO0WwayW{Jq|xhW47@z>XPae`=5%H`I%3XS&w-)K<0ynl z8;xT>@b>l3WSHnaKH-eWglh`kZ1D24FCcD_ZiDs1oFKjcXCGrG+tnTi|DytxLS#)e09{h3^|xZpD0H zX|v*={5vErOL)4Z;oUQDG8z@Q z6KnBO4lD*HZ_JxEB6ulSULw*tK%eyUrT}=w#{DFZPXuALb8G%p><-@AhT0IgIJ5n% zSv|J1RNJ(6gs%D(Y1Kq%543t;HKKo|TRiGbr~rbOP^mUIw%oFSWWyllsKOh-XE3MM zdt%M#3KRO4Jiye!IBVeGnRt)k0geA)L=O#VKj8Df2hU$t0-ofx2q6!yTk|huHyk?e z31XgV$+n61dCi%*yjMJOv``-5yR^c(YC8j7ko;wMdZ}mE&mphujWab*aCak3+FRYp z`Io7t!H+?hswKQ&LX%>Kx+V6M6slcrq3kawh z3ld@M4C#S-plBxN$N zQt=bFLD2HM>LS46lZfaRPcj|Ji)@4@?FGm}Vwx%3Jiz47D@(DX#mf;=C!or{qkd~h zI^H;tKhHk4Ux^jQ{pONk3|kjInrr|u#)y#mAF_mdk*Bs`$@X0gNwF(9M9G}e5UkDX zh+C&P96qXs@MFGtP$wL<+^?{5Dvc<3VPTYqr!M4LGOxF`RB%Ka4Xu`IzEP;#pHSRR z9hKk^K+7|`Wt|oIXGg1G&Vt+*l>B+#Gj2AD4U?OJ3-CH&2VkLiyp z3MzNBX)7>}oQ zs5TZ>sB=CuY;<=q9?DM7o{?dfABcWuu2uI1*L7*+%t&`Z1LZb-=0fjlx9#2D36+oZ zn@J4=B~V-O zm1yQX3~5G4jbq~*Y=T43T?kcMGqYuIBoV;_QO*#JZ&>S(rgl0PUv{ zrCOaytNg2eiH8!dH?W*Dt4z@tW^xaeONkd_Gd~2YlW5e}lV#qJ3%9E7gDszS$s&B) zMIOx$?$Zg5=k9tD9vYTJ+V6*j&o}Ji&g^&@SS+t2?{aD=hNZ{;B3mO)KK2&5zi&&!5n87@>hn40MBPE^QSl;=k%aCkK9k@ge~VYMod06 z!>$lELY%@XbeXUVAdc3=o25Ufb33~aZfuNN@T^*)5g)zi`MeB} zVi!3B32OyI-jRPn+`mN9)f)2c2P4G?$Zn%Sg{pVJzCH3yy8A_(y*dBRsN2G}@bY`? z;hEdVnz;uF@)7OfUV$?1SlY6i3mYUU#ikm_;aOJSbi>4injn!nmCWyxxo}HaND6;# zMqaB5R!+TEe|`2RHZ75*g%%10zE9{~zqJX)RaJP=zt#_M62JCjlXkP7qW0vLoj#$`_FvpKW7%{|w7XQgKKFnyFQ_A4KZ>pPNV zJt)DsZL4Da)W7*)c*?~!W;>Ani^JL7uiby;^4+bLrn7E~o$JrN0>;CIBXIK_5#h!5 z3*iXQqiR*Tx1Sd53HeeW)RRKxH}yoiaY9NjmHCe7OutFagKz86PZP$`alXe;zh3Yv zqY~t6JVD5Uf0U5?NX@!4=`}Y5Btsz}`BEQp>18{;`Pjkj0Y2%>6mk@I&EC|J0Ul+O zPb<92F8G_4n<#1(n(%gWiot-J$dd%_0 zUBq(RyPgNXqV@S>_Z|#0C;LA+?go0Kvla`CfQm5p-IkJGUS)vyhm>A$qrDgFnuACV zAMZ19yU*$Ggwxzyhm_((4APu@?B&h`9*ZJpXtxP{-&m(G(;@nLxQ|}#f0qNRXVC}; zwXi;5ZC5Ok#lA(P(EqjS<90oC=|{UWf9%rp!VKH_&(l4il*ZuzVt8z@nZ-4irt2t$ z8}5zAbd;YRSghaE4ea4G^z>xW?mY9=6F*WhJYZN31ULoPv0#sWJJ0?4g0~I8cfr(qFBONAxavlMVw(t+Cw}b{*8n8?tn{~Jwn#AQp(~;xrbn#y9siTLw z`HaD1WZN^vS>Lk#J;=8xH}t9k@>AQFz^xvSB719ut)1=Y!Jeexv+6py>IuF-Os*?K zdK-o?69wOSG$EI21fW;a@QKhgwpK}|>h&+x8y`K-@YlkG<2%Iv5h-}XRf+9SjJZyb zkV(<+YFp8py^kilU(mT;brmALSF~d#AlO&7-u+ZoxD__?{*yP?i^ZD!;CEr*3!JD(zBDKX=GRaaT#{ec(pd{5 z$ZFSh`#*|f>O)M@}$ZVvkrc(Oa%W5$+tbi1wI_mB->d#Wusv-{AjcPlszL< z2~oCI|Ha+eh)sAu=UnU}dAn)4BUjLZ*J=DR8pgI|*vg*Gb#k)xA@2P_vNZs|Kgxp1 z$UMN|FJogu>#N1WtwP10W2#kv-i7px%hM#DJ5A_VVG~&a@Sp2_XQ60b20(WjHpmt* zQmcG}C#Yg#{io-~r{q>qf~9N*l>VfD9MjB`&2@iMob7YF zW^ta4@xXN3sKSNyuwgCz#|p7KbcGn1fs#*+=Z6L_NWigRIngXS-e8v8kCoby5|=6C zr$(7XaJVD&5xRL}wr=E>yB2zg{+vR^DPr4ED76Hkp1$Kt zLfOrPRpk_KG9~{te?38iKRI6Q#n0CN+XKGF~I%$q66rvx? zHUv>7MO9H-w>gc>yt9(~Q_`vZeA7faJ85nUkZ)A12%YP*PS5E+l;6XK%+G8LK^Gmw z6mLR5KGX;h&)&die+dDg_eW(=zwcgPBmM*Dr%K)S6lmQ+sHk%=b}+B;DPB?g%ZIDG zJH+pE3`2kF1f>UWJi|liF)1pZ9#Syqwh)wV$;;lBsyBZPwjHwg$Qeb^Mqzt=fu3@9 zTjG%!>u_2ydzU5~f^B8CsK7)8 z%L0SglZVPSreXb<%(|Fg#J$!Hoxj4apjQbFVIQgd=fr(N!OSgK-F+7dA?#E3M);hq zm4?GBpC{PN2qo~nXaQdbzkRKjk&SE#p*h=-6Z>%lBzu}3nQs13ce}_^d7+OiPj%nl z<>K@G$qN+h`u2!+RmB#+Uc|~Da(OdgWgS}O#fN2t-0a0_2d+N{Jzbf7Gvb7rC^Avy&nA+dYoCFst5iYr1x+9vbNuoEcQCandEDD0AYmt&jD)VQi^7 z(&?V^c|eSD*TE_DS_kPHyb)>fVRfyf9yYAv!3(ap`Du$Xg?u&#DH7K44O!75$!I~( zOW4GQ?fH=zpjl!?HzOHO1uak$|M9^`u>^YxrLG`Uq&eG86a&-1L@e~m{-hvNBa&Xf z!S&xiKZDV=OiUn3g=Ck*!{lQpm-SV?ovY57{#}^o+tG_|{(;2zg;cC_4VNpp4`bWK z!15}k_Un_&?Sqk#qtjDPVlVGAF|v`Qxn7lh$mgHdp0e2xKR${0zJJ+#3E=Jb9%t7~ zK^y(E`vfBcc=0CJfdhU{%*1q1d6??GG}M8!T@!j504{BN&74lY=L8ANMHmgzgn@MG zS!%8mD!afHku7to(f#%|bVIXOK z+}Y|l-oF_lO?ngZKNJG$^4`@wLV1o5<~H@8U7yvg!fVzIm8cw^wGiln5r$F`*aOjm z;Rsg-;jE&FwU&w)sIM!{QUrI_Tt<85@&bivt|d6YFTrr)k{npO*`RN~fUkAoyKvR42EVVfE57)r_a1u;Ka>jC4#*SP zhapew#+$T1h|2wZsn~qgQOni1dSIwFzz$u)P>}SAuc53KRuOoITi$rX>adilF_P^i zc~>08FaF-bh(!5~<8tU1N%akD$!OwX$a!x{5oRMqkTi)c!k5w=0AsHI+Z; z$$5g#Pn@ruZYiq)e1jm|LK7J`FE|}~vjx%Viii*(vA1r_N>dK$Grn_Ifb4?C{5`F?w-lgmxWJ+~MC!5uJVP0Yi~k!GIn@b@H$GpbJt zK#1pH0Zg3#1cG6RMoGQSQk8>CaOMe#?=$0zrt^%l07O3*9xRS>9VU{-dCS*+Obkca zIRf-Q^GA~)yc$t#j?9nRD<(@BYfte5kM-I(;G4GO~1^b0$?^CIUY@W=pU% zRV-djC_Rx1;rF(z)KdKqfskzkn}p-4`U3|z5Y06w$6> zCd!)xS}GBB%OKOj77TnTI+YD%j52ro>r@$DFV1#l?NXv<;sPKQDKHw~9o~eNZjXV> zh<38NXs}jwI7W?Xo4MI9R&!l@eBrz*{%25V$qkv2((Kx6@S*d1!PCZ)XzSTPaD<** z7;G$KR6W2X0zn6W&l<}t9tK@?seT4IMW9EPoq~>z%U9BL=PEbf!j}ga%@4QwE-k(j zW3FNq+^Rt%lXZJ1EtL_sv~Z#A-oOFX0{X0-$_{a3{3>(aqDf?#(<#LkD1c z0w|kk&8_FjR2$R)elh7fjh0dlRjt3b-K(k7+&Ox%QMM$OF5~+q80{3wYwsc_8^_wr z_0_WQ;oOpu&2nLuptG~B(3!g&?Tu0wp;O$WOjqWoqMr?8vi!Z)8h?VGtvE-mF;w~| zC4AC{4;&JX^jcD);CaZGJdPWbLIvQW2LJgrj*te#uNi*(HGRXWcgP#yXZL6lq*`Z# z)W*U4EmJuIaeOS9)Dv4;1O#kS)%hRbh!5Onb4$HmE^pEUQndx$M)sB3i#ULX@O76{ zMEoH${x2aVCMTVvSLB~YZXM8gJiR=J_c@yl8nOs-O?vUJY2&X}|7`v~l>4pBN zlQ^j8oHA`P0$;vD$(V-RDLOW`hw+G#! z%NRCo5(o8P+RGR&K0ud`-irSex@? zUG8nQye;`;9)w}LiKlsN63~A3!>&2Mgn8n7L zW7+<$tHm$(VG&jvrV{2feyC0$6Pupw3MTFHpL8gmHTuppi@&AAvj^={(gnC#H6Ym= ze|Zr%pWJM`WL|u)dN8M=B#b(VlVbag{#))ZjfKSMAbX!G_`6Bf6t2z>I&Wr=w2uxP znmrRv?Mq8*QxmLXdYp58Y$mcUgwADFXeK3fHd(~Z0+#7WIzQzvApSkZl@_Cd^g9v2 z1-z`Yh=cmop-4C=*%N#9?rz1O#Hc%78d2_l4cN}MI1U&Tkrjb29UqjrkX=7wM}8tf zF~&(a!hDy8b%9b|Z|PIDnzhiY<~`9}ny7TM==sTzf7!+5i<53AysTZ3W2L1x^5m;g z1aC0%@-~4(kUMvz?CKz{gl z)csOOmAwtCWB?Kz6tn^1ROp>iK~ABmv6OR1MUcv9VV9=yi@Ly(4V^VMx8=3uN}YLD zM~8PwdWR7q7ixGi*G+m{>Cv%;UKo7MVXDQL(zZLsxx(p2e;NjvrY*zSi|G4O^6?pY z22c)Di`zeoGsvL4>ZuCF+Wj$k*7dq?O``|U`>ZsvlB?H!*YY@2bH`h%*^2DZf&4tU zEYs##k-%m!2^?(GY8ocaA&6LyDI+>U=3?&l^jxc*lDDPcVu$8xpR%<%;`(y^Ms+mb z)2FT7oxAss(X=$CaEuuZ)kah!3%9q#v|uR*T?}v^{TUPA^mYMI!^zPjGG2#bPT^2J z?@`oN^6^28YLO5m%lG8y<;9vwhK>X})p^p)b)poVU#q8D`NA}GD4wNfqkVqtF7$T@ zzQh}$TqWfW&VFmvYIzBNJ}a)Whh#5RZO!Hsq^X-N(uFciH()Nb$MO~pPcdu?<*unsjMYU|^Tr5QHAM#gb-dtXCM;e}4 z@c0U($h11B)Xp?dbut|-C5QJB2>bFf>7{}r*4FC}1=m+bMDU&z_(#Q=tbRG@x9K%R zKXlqzVN@VDXZSp&r|e8^QC@u+h|D>)c8-G_E+l=ls$YL$?N&Yli@bZyQ+LsQdhL82 z!(+$&{;*y|s4l6`hru=GVr*6LNZ$UCXN8Ayy8S>z!SL8YDGJ%R!&j(XtnVcE&OQZ= z9p4m_I!-fD9j9;`IaMG|mRJPm6*X&|$J<*PAA5!(cKPSbXk8Mb)~DI^y3vP#Xj8g( zaXhFIZUI{L>}Ao)_@`kk7+0iR3r$WBs1NLJ*AAN5CG(%+n1s3M#V_<_T7||@P|~cn z;H8@ftiSzv18@`KRGM2Hoy$kwmRI-a^%>Y6naNg`e!`&^mX3tr z>8OMIMjgxN@f_0)r|9&q^b{LT*SRrbL^tTm4`VNVa&7q={aDoAqxT=LAIQw&&sc5r zHI6new!sA3gvMzfOxhFUOn+F{#QiD2m?A}S_W>61IW3I!sLSJhEX|+`Kc%$cqZyLh6!{80l)^{4e%wC{IN|cDw=-tb5~0hA)%z62)MfUuMYyMKC=M8p}biN>RhM zxs+I+G3e!ykS7F#S|RN=fdc(RvyG1@TJ3Cd6kakVTG{VP=SbsyJQ$WVAGjZ&Gi(=+ zNo|%F;lB9*$<`0v5S6=DpF--qzBje${3P;MC>4X54?)2^m6jMv_9W*+aA7M5X_6-G z193UoN|f=xPX%$$0b%p^N&&h+k7>$WwNdvihj>cs1rR+}{)gIYy z=+|#~DPxdTdQ9W4#qcGw0yyQ6l$f72yG|}-#omZj3(>3qA`jcF7z-28aIFlwP7KAc zwOgxp5J&YBmTQ$W-)m=$Y}-=NALijfhgBuG&4{Lq)Ju> zm_xG=XU|3I4Wz>PDi5DK9Q1~^Emr-8GR#ROuq}F!!x?6-{|!AYAop2!{zT`9y<75u zlyj`d@XH-qJPnoSY;%uZD}MXs+wkov+mDdI^DC*)XHJaJ9ihtwpQzXDIELhWkvhVT z{Vc-}tjS{lI4vl+x%u0;E{ zI)2p!-mIYGEt{x$I&}g(3D+62~;nqGavbF15h& zE2cSWRVR2oC&rJM>+Rrv&He>+s87||rkKrfI!V{rCV0P;{)f00loIy$ZdzsoZUtG$ zNT9qEvtJ(?HX)B9{&FRgGZu}HZPtBID&iJcCG4xy#%@>A`>(19*9!xIeQ3|`U+G6` zo1)l-mdo;m1NlIDrD6oM=MlHNSrfvyor1xZS?|5RF$Sn(B@;e$lTrHltFhGt%I&_a zv9q-Gu?u4vR)`otZg+T#S$BP*U)ddkaN5IoF0iL*TU~*5u0P}H^zBPQHZHA3^Fzo* z?y8f8Z|jlSgGKYg+l#d&K?NO7K7Wl!o-Z`S9o=l(9{uQPb;%0{n>RFLhcs;idKN8J zNo-z*C(=oD+;Q=Kit^&0ZP5YMRQCf}cBSDNywS1a?*GWqA9GMrH}YVc5A zH7e_b!Sg_Ve~$6gIN5Eu)Ibsa5!w0C{>VTZ!A@Bgf({bj54P&xb6|ZW3qSkJvQ&q?+)Kh|9^>ZPhZ&G&PBh{yWXzOn?Y z(0A@u0)(v&!_3qfiB_%Ly~=CfE4pt3aT zA^Me0P?fDhz4!EFYSVOQz}L58`0%NUrOK(YSjlkGtD>40zH4eCKvhR){*monaappm2#+l>{a*`rX$*FSkaxDJqUSk?fy* z9TX}~E-E2{#efJ@gAJmpbzY_x9gC_bp$eA$Z`9JCqDe?1L(*@QOOnL_R6?O_D9b02 zA>t?SI2%bwiSiNmZo4>Nh{o*LJYlSjm%zz$x~`_~QyBqBsR48JVRP}@yC8P#6vYJx zV(E-8-SSpz_m-z;XL-}FwD$M=Dno@knVT^XX)X4>m(o7Tr2ODonsvz~pSbHm@QS+> zwDwZDZJ!`%tVdNyz%C(pD*$z}b6ZEq!!nXFc`s^nyC*HQFSHR{O`x^pTto)BmX~ql zLL%P(ka`${0Dks|0^MsAm7P-5VR=quDWJS&qTV{M6h%HTk4PI5Izx8L%PZS=u5zzcNWxm*=>JnWLBYxlqDTcP+}*wR>U z3-Pua=Y9SO&9k~DUwkuFTSXhyQqxH;opkMN-7}~wiEf!&=SAz)kNhO02QoU-yEJ>C zkG*}LNp`k#J63`S;DzSW6voh5JdT)?$E$VwQ|e>S4@7S-(;R4QxG*tkM8_o?S>s#I z109nPdSQ(+c^e=LnEo5=f?wUdYB9wU5}4EB4RoE>;k`WfYBhZ{IGXR9Y6()nUOcd| zb2S?^iXiBsv$jfFj3k*z)v<<&bk>(Uad(#_UaKv#yc+ zm_Lpt|8|mR$X;exU^NTOh4K2iO^5N`UwCC&{C$;-(B?UWX5I6;`R*2@)8oC}q=b{_S+ z@XA)JR(9V67Ckei<|^v%$MX~u(ST$YQsA%UIF{Uq=4f^q%H2)>zzn8vDiWL~oN_$e zli)GDs#2IZFJ(+xxo_fOMT&L;(j;L85te^v#iMb~i7l~o1?S>;d)%kvc&V?vNG$)z z%^Dr(g*nv{ad~Kaci$i&_Qe$>XZ$8ROsKS)bWPA7BX*_DxS3?hJ9P*fgT?a*Ci$cX z;s7YIf~UV7VDSn>9afVXk7K5Xm4unWju?b2^s^~U5$65^xWv8(L#?9tckb8Tzj7NU z!F{ulr9-SYAM&SRZ6D?g!Kt4c4D_>H?K{vDIYf`8d(b9EJ{xDz2jiLj5W9w+a%+80 z@U4C@Q`p*PkUoV;mTE|L8H`(iZ#jWEte^zeZ zR5pe{v-Yx&AA+u%U;3D0=mKQkR*1T1S>CBEBrrt)shSkt2z?~J_#}z0bdqy6!RvjG z!xo}uqu%<@_sOr=p(!ZLo+nJd(d}uEQHOezU)WQhm0Z}TO0>^;f-%6+HXjj6)|%h= zxVP?9L_;ci`ZH=zb*ny|%wc7M7&kAMk~LhvzGaT~%4r+&*~MK>C~|om(YfvO8eXKC z!}y@JSCich{QhyVEK0Z_}OHC!RNvd2WNu{T?#tlJddc^4$Xv z&xc;>r^1?|7P2O_k5;%KA_J>>+*dAS+B%Z_axurT|BVOFg?g1cNFAjfeq82C>03J_ z#A6$uvVDU>?^vCDyqULFM8>32;!kA_Mt!SGS;X_A(6j5NJoz*uyPD#a_%UG@S$MaRuWyxU2iGYYKuOS+s^BlXG2sNHi zY^*N!PuY3~?+qG1PFe>RBi3lCBfMPXF7a*up2Lu>Jj?&S8c>;CU@oG$mA5e3e;8tU zzjXAtI!V&!E$m#FVZYr76=O!^_Ua4oTxu{&@&}jp6%xfrGTiiAs?F6dpCZuaIqaA9 zCiEpL-HT=mrzIbE?d%2Zxs4FBvugw=r@5s|bMV~A+DMw5P1a$9M(ZOz;N#{<-gME` z;ZQ_{(s8;6{dYKb%B=#y7cZAM-b+0!@8~6R^$(;2-mZsvdCzC&;I7@ekEe%=+L~>b z)GC>$;r}qHp9Er4r5-4EDMlK8H>LqKysq_w#TNJUP;19^b0U#S!rK$YW@L^3QS@K; zbYobf5baVcZNi9)u$2)IRF^R%OIM#9xgKqEKjc~Q1Q1(bsuoViJdI#3pE4t~c$^w_ zE4HaGu%x4QEuUfu42`(w-!PtQQLf&eYJ*1D_TW$T#p@p8u4s(^o!6u`E_r6xt}LMF}Yexwjsl8di{S)U1d~U%d!rE;O_1Y!5snt zg1bZT5Zv7%xLbe#gS)%COK^90cOC4_$+?HTUp1`Nto`lkvaYJGEzE2Cq^#TaY{JA#`#!`@Pg5qL&(!>g7wvoQK(=k66Mv5qNjZ{*Sh?mG1ozg5jiq8 zSt1dQCWa~+M~=tHY?nedE+fQtF_QU}^uHJFXm^9Ib(ir69C<9aC-zM}9iavSS~-?7*U8-k!ofaU3<0sjubN72ecB^+crwY}4hc}{H zHrv|V&biERNit~7Y%<3>U;dCuw#uRL9u<^FuT3eGJwp2ALHPpGf-mcCAy@un z3^Hi3|FtOUk$eKow^GUsJMvqRNN<^9+QA47ui{liYib`@h8Q6L15Pp*&P*RGc&RuU zgTCrVb!%?PUL4 z2KCGsrXZtX1BfZ#w#m~CqS9T)HxaZ=o{4?w?yn*OoO@xxYW*Og+>UG)>(ODID|6Mg z%yQFSq$TMd=uQ3pwfw~W_?sF>lE;g3&}!{*CIq$Pa?3O>c8?T^;(5I0^UQK)y8u`| z_)?b8L#>{$DVaYYcZX!9K%eA&<0=n(3U)D+7VL1r{M)lqwez=F!dE|XQ zwf35l$~&m{Hgg#$dT$9Pt?Zz8&DDyq?bcEqb7#!fgbo*m2Fnn4h`Xo)Ys=phoVz)d zdlRP6PEiwbQFpC}G(?2$h}$a&*lUCAmV{G3;;*L9Pb1Y`j?W#Rh`9t=ydsqQW6ik1 zX^1a5w={T4H26=I#oyM1PykvjA(zR8dk6E}lZHGrB?<^-DBs zr{v%@G(iVmK4Vz^iWOOg{gi^5A<7-@E?M}9f{|Y*0|I0-md_u;hJDPUXM-9LZ<{85 zFMAMLAuoxZX6L{6MMc9!AGwj+N}LT_`YoqVa?_#btm?FN#!9}6T0>%su;kFjH1yS4 zZrfJ^CAR;QH5K=;^2(;A33FsyE3cc&$ED_4uvpQ!}XevO)$^#w+a`|G{_&Td-zV`di;Vgp;F)ElEJ zuLrc9Q5)TpDwz^8A_C00X4DhC)D1RHQFOR`EbmOq>E>4#J{Mt_(>Ym9Xo}8nn%38I zu9J;qWxfcl(gkQ=slB8jz<0Z-W)7G1c|ay7ITW`Q-9WC=Y%nkrMNnjiI>X>bI5G+u zEJZRWWK7K4!z{qlv<|8Z>+Rx+P^47RenI{c5G}D!>G};_LR!Ft?bm-b<~@dun{jn( zR9yEMDVqdhZC^{S35o_Ut^~a^lnqp^=4Rncj-n*SW1WGy1Vdrgvw~tg>^b?7V_{3o z{ZEhat-J2?vZm!mP2P*t?iRmQ%^{!^IGiaV)V35yoRNM{I%~drX+Cz85t*ZuaI3xm za!zYE=tne!apGxxYTr+4cER!~w(JjXu0h>o*h8&qD9ky-oJ5h>$1$)qkc;yng3Ujt z&5sU{WjkdcL@4{4IAZu@Gm{KarnAd1Okv`j^w}hBhP|&f;2_`z^As@x-N6X2J5SWz zUjMbGcwDR9W^qmo+;WDa;8OXlH){>%lzn)|I^1wxb`q(!vbFhv>J;$`Ma7yU>u@5t z$Qk7i5hE)i^ea&HiWBD=I_CAElg!26Xi#Ao6fzUzt%A>nc80=LcoV=50=M8IP8fyO zVS+@d@zV~rlzl{L#u8o|XOn3H%6COKANe_<%wf;4du4&}qJfVF8^VzJ9qcbL4MsFu z35~jtF-qtRX%b7>56W-m=PA2C-z|2acj(El5#odhl&+CIN6N#R6=>jPJ0y}eI3jZV z>Q#+xQcrw>vSLIsgNzEkK#E8Jr(NItM6N8fuDT33iuWqaRiy1=1$SW+{0oHj8X5#d&@G7-1SC~oXmbi?wBx#q z2OI<>)yG`R*vaeFv@(cg;{4aQ=QXNkBGa&*Sg=RBCH7%iJ_8n&+`BqGQ4JvtVDH9n zE^zcx{+GgJM_JGKZgVN$gLZU}=GRJ_)b!)m)rQOuA}c+QzY(@>#Xhp%+6Cm{E$i$W zC*K&^=Mav>xM3M4-V}c4A%lU_7 zODIQ?DA>~!^Gyc~6n9~?h1OEr?}P|ZDD04jXu5IXo=uR`zEz04X2=v;k75g!DXiQ! zd>%1D;e2aQmv(twbMKtMsuzT!*~Mty$Ds=Q>w1fz^lL&L3!$2I%)Xje3o$`l%qifo z)Nso_Xd;h7$z89hrxx_R#f|f1)`h>j?b^}ot^29w2$sGSz78j0fYT2AFqh-j!xX0{F@<@{#+tHzR&mS^TQrurrHb^(zRdnf(rXqRYL?57rU0*1< z^O=8%4~B19$7DACKMM-(eo$GqdZVFsirUi3L~u=X-H^&eP~mh*0FGT5Z+fRc(P~#% z4U=Tkhv0vJn5Uxmp>;5%xzxos2h^3b=w@iSA*Pu%>=kliXzQGaRN_|cGjkP|*4!=9 zVYbA)i^x{t#z0c;Cu{&|wI8DO0ao_v7ioA7W_(dxaZyGn{x`-zNYyu~un8ip07-@V z4nt=%ctTFRBUB{*&hiE?B-17$zLeQ4v3Hr&P{32zAk&cJWZImk*4kWeL&jksKbr`r z6JGN;cNq~o8-y5jt%enUm+s{$@JDVE41tbDG+t+-!myF*7^9mNIu@ECh%lC9^a@pRMhfYh7~e0@RMmpyAge7$&mZc|gKWoRORnf}yp@eCFs7%3xn zk}*DD=B{M2{v=2 zs!;frme4E_?cK7xISSPzMjM_>y zgh3$g2!pt@^nR+dS!s3JXdul=7ur}4sF&)~ENAl`3$+w9P5R6>Ey4rH>XinRD8G`D_Q>Ou@`j}`&0TT`>3eRl@ zj|A1e3+RP%N;xkge+a)!3=m!fw`cHz^dw|3iZ%vn5`~2tJTo^ux7=IIw^{dfw#ti58cM}rQpXS;SUsr2=* zbD3$@Y_&20yV`%@zCdm(`$gmr;g5&{!t;L}oQDBVf~KPkrbx-}qfnVd@V$Vlg*&q%`t)r^TRzl<<&7vmWu35ua1RXR`*f`f#`Ui%Y!0XAl zzE9(cYaU3X84l$4#06e6`u-uN`%}glV_b2$8m!x-cFXeU3eXGA%i{iJMO`g}WbHjP zQ0amEZ|}+!KzMziO9b3z=u8I5fjbwkkHE3jLSG3U(~0?D?4tVi=ix_B?I|aj6w(bI z7vnZXIKJAujHOR(<`9pVn|h*m<-Jn+e7riz{u+$o$!$7Mo^<@R`@)Za_j~k>o#7fi z7Ne8-+)}Tke@OZ+y=P!GJ*-@_Ra!8$tu{*hAiGou_AOSCkeUK%d>38uJ)5z_o97m} z=8}2^rcgM;tdb@ozU&=b(5yYr3=?>%LVeSG{&f;^6K2{dPzd(a|G+m=trZkS)1?Vnzp9m{&qr)PGr+RA1VC;$I?e3Qoe=K_3a@XKH1BUbMt>|pC&xS7%`}K= z3OZf%JqdoY%5b*NZ(M_2m{gIrruKnwJM1+VCERy=Yw zR|0YqX~-6F2;D|uj<4iQnz$VfEKdI<0&MCdp%vy&NS43b8b%lmg7zI`n@4;Pez1kX zaZBH>h66q%U^otfA(h3x7DMr2mR~=2ttEs})z;f1O?kCyC+6uw4<#a*4=z;X<>sw+)a+0hn)yVMPi>C!lD*>EUc6!m-AYJm*Uv!X-ut@SeEmg zes(x^OLDntKqo;}bfYwq%GJQfvOpKVlY5{twTgWUB9ixQlP`hGlpx)rOhhF1{Llf} zpr!?FVRzDBttySnQ?XqB@uPmB6`XFhH0Rt^e;r-ird72ady>Gq^P>Ri=`QbWkpTlU z-a#DOBn_hw4@HE7B{*C~pSxK2DN=lQ^u()SpJY6reu>PvDnX z*skgodloOg6x5*R>PoU^%B$@6^$`V6XMh&H;W-Z^T%su-a{}RM^#S3*W1yiMWB1C; zP7LXZ6P!k}UWRP2F0|0?s0)LJQ}6I}?LCtmh2q+=_@OlUF24nOJ&vt|#`K30%e(yB zPZVKHs9qXeSvHnQ3@CZC*nPPP*;Zb?oeyiFV z{vy#B5ZTYCslP(MDJGOElL^z3yGXx?)b8TQlW1H|8@giZ&Zox=Jn~Q04~v^#`q2Db zT{@zJWogZLrQD9SvUEA@7L{MJRmQsep;|&lA{KB-s;D%Xlb0hQ^E(=#qBBr1NEd@8 zK}{QfFO=YugpMvzCfrW#_g>(Y##HgId@%0E04{+!l+GcxjG*?(%@5L3wv2kX_BtJ& zyG5>^54TPVr-UeC; zJFV-j1(JG47RG+Lr5`;}*N9;(DV&=0m<4_{Nna$?Ki zMYsKA#ZMn~YVX;Yb=R$WeoG?`ds?8X2(@(6Z=W~uQt3=7_2_hZ6ex}c(t@H)!e=bO zc*}nE>nZsi(5(S>xU~@SV?r}I71AHs_-UhP8{3(amEi^n;`9`z1wa4OBES7J!T3v{ zJcV<}#r|F&C+aiW252s7qeZ;*wcG#`cet1PcVB4FQwA+e;FYTwcd|2I`@ZYGZVzuA zfkCF+RpcIOm(mca++_wbOip#=rZ`+Zy}`y#+F3u3jd1$sM3dE+{~ooMNp$VfzYc66 za}Jpp-@}dSIXj_0u~c?t&L#p*x-JFqhD8u@U-pk1*k7C=Z+swG2RO@oMw^Tq6||K zgScWu)F}e-eTn%SQK|oYf1`g1p2J43&tSk7-X66uBMOrS(-3sMa=;!|ZV#Om1RL02 z*X?-?J+KahAP0%hqaJS5QvXw*v&9zHqf4u}x0kzLGPGLS3R_9o#x%u8z&G4x1O;)w z=PzO(4BZ!<5osJC_JpO+Zt%@*4VF8vqpS&SR-%$REb^E$lKR$3|BxR>xZr`NagCQ~ zg?t-WZH!uCn5469=sJax@x?jRq#m)LwST+sq%->2Am@y68>PaN-%YtJL+o<48Q{sW zf|b4JPVCq!oBqXR<%D#8zBe$=V;O!ErK8KZ6x8>PkbOI)m{q2$kb&#-M9M{zK&cd* z6xt~hks-WMb~soB3nW(NAHp_>%|vZr_4K)siTPZG)FVk8ex`sx7=)b3f%FvpCZ!$ z&H&FS7hSLS_Y1Qy%a)vD^21t|Si8K-Ye$wB%eAiYcnJ@rr<{jB+R!}v5x);p8%>3S zhFw8oP5dEjBiKxA1|^2*@j4XW`eV8nrNqd+aA3s_gs2urT0@y&0Y-n3QM<8$kOBTd zrV!3)q<2-BZ;P zCu^kGKKd#s^b7W0vP|vZNYH-POh4wf(qz4OM~A(?1rupTfOt!t|0!BlL2>!MZ`p{0 z2xr{myA8@8^7$$TtXqsH(&=(QTB?YAE(?}GtS8_s)iwd(W*^5V{ZL2}v zx-;gz#1S<}HeDR8o ztQn@m>!g3kk344Zz&`2ajDau~R9R|*%&P(>LR2@>LJxsZUqz^%!cowQH!o%rNf?2n zmEO0_z%q)q4XCp*|(zW)M79iKx$EQg3U^fi}xuZ8evJ&O<#p4%ipXo zH@&B;v`aEBUTJ#~?i0pV{QLK~cz?67(Qfl5Hl7x7%@D@o()Od#45nV3Codk0mb1O~ z)wYu*gf`9qhx&92=LQ^^4uz#><$VY~lll>7M!tdbVh`J#>XZ2d#vMoNPv5DeSH542 zUkjE*?RFP*T43LRLh3*}l<-BTa2!~K?0-V)DaR3M%21EYXY4%g5IU`cKBF?Up!iVq zL3+8z9d z*^6nzo4M0+$t$eOT>#2Y^WB9jq94^eUyglmzKeO+J~oT!Bh>-ClohBp+13h2wxld3 zIO2*{&IL#Op9f7@VT`j2|4Dwto|Cfull+KP6&l{w5*q#jC4mAA5x*3N!{BLzcG!dy zklgH2QNci7mJrV_eAA>v2_zYW@~Ave#5L@1I-2yG0(3+FQ8)>vKPRm&%%eWr!{1cq z0s4EJ2~t1DZ=Ml{tUJ0Dk_6D;qX8_Tv->lP9t0!SB9f7UKrH4zge@DFCEQHQH2^*y zHNejPDryqjhZc3C(Mtm(^0MpQQWDS|)cyg#c70I3ZdtZv2 z1=Tm}r{pSDXXPv&|Lnri z6ZVWd+Gj<~Tn=hX;-Ikgip0BTtaUsg90_7Pqzkv|<8LLW(Q0XWxQ^;=Un6>Db$S`` zxGcX5Ljs~q0v!Y%VWF z!=+%T5sq`Z+ab%x+7-3sorJVEf>V)YXn2#HHprZW)I==@JseltIc7Ra@Mt*9zD>hx zU$gYr@yJO<|3-D}@^p7v>=wnZ@vPZcTOKTJ!#b3lq&kvHIw|s0!ACAmL~4Po_L+MJ zrQ;{kVg3WW91O7q65`y<7zaryft3o5!oKA*5|2Qyy6Nzij+uPwzENE~87(-WTSoEUeoVOH{Wh<#>sQfffy~h%IIo8S zjkiv0@x!kI46LinWgViJ*kDrT6Z?CVlm|gQ)&mTYvX{dLI&6Og8)VG**#`72#rKln zVh2AeI*o;`dVZU?zjLcQ~V?B`3!i1|K?$=Ws3H4e;}GE2Py4x7nZMldvD zO-PgkI!q%o%s8L|DDydzlmJB|cM@lu3AF?%+mtnloA6Cb@^hgzo_>%6f^ND)ZWFPE zpV^DK;}W64xd@??A!L+w0h7PC^b_((BBg@2e=(kC4k?Ls?2_YG@*&QdlaFpz^o}PX z%Yc)>EYGPatryeoOH&tz+{&b612a+S5phZ9$2@*aQ78r7pc^kb4mqeBnSF&>KQ>4C z^#HBQy3I1QQPFRYskd5GTK+wCK45dE6djI0)N`H4Fw!xW(f3h%^ieGsTOx<78%A`6 z{y&1o_nul2;2RO&SXwqE_^o?R>>G%sb0h#c$5ca;;~pfRDA3sXs7mzYOWjG_)@XB} z5bkd6B8%bIyB(bbd;ZeJuZFg(jZlvr9@rcy2;G5P@OTWq`oj2u2)5W9|ckzmta{B%0%jry|Pcp z`3XD~SmWPIz2qk0DfIA&hXw$-30M}$v)-n8)GTL~Sf@zj*PGVWg-F_rO_^s?!4boG zy22@52v`&4B(m*+T+g_u*XD;VWoPq32vjX87z*pv^4w7N$G+tjX{DF=qT)g+ULv{d z4809;KPEdwd9Kaxf!B019}LN+O^f)r&ee(@?#kOg>E7()4bJGgQC3A2Z-FIE z4U>FN=69QDrczHwiWj|CKa73O;*aAWDr2SQp34gg-^)K<$QqHW7#pV2?Oxb64~{M0 zAiZSo`8|hBr7P^~;mDFnNx5v~dJ0MJfIm7(96Ud$(9DDn|XMgb&3+ zEXi1OyHI6AS<^^DOEBHa9lZpgRe#xJ&ZBN|4^*e0`LM(OQ&rldY0Rd~HiX?If!4{g6oOpR$%CG{JVF)&+^4ks_=b%W37LA$$b#{C@85$XW*I!(I zJjhn}Kx76GuLQqbo$0w)@Kt7vvUPceA(_yoUe=jg^#x+*}gUo!LlvF55BTUlo2 zbaIK__obE7dO~)K{J0n882V~r&V~cHcvf=;9X3A4!L$v{1zb!>yQATolUkWJ4%ia2 zz;NXsx@6LGO~mq{e+n)K@j9~YuVO2O`_CPGho zt31BU#t9ZnWz7Tybgy-kre(=%UX|s0`M+cZ--w1D%R({MlbIJ^Wr9##gHTvwhh>0J ze8=XxUQBrRM6X>s`2!BKk;Nbho?zG2=eyu;!?*Ylhu)3%wJ#%Vv$57~iQBr2)+k&9Eo%u5emXAsgZG+3k4wL~EkV@mtG?LJ+<uAeiSZW@4#9JCx$1o0*G3UVA9S$jW_EtCbi-GUMGQ4|V2?putYJka-Y#w1# z#{RXZR+MWFcSFnki%lsaR?N9WNR6}_i`~kPMp@*7Mwq*>_#-K-g>bA5ExI=^fjPPH zHG6LFE67X0fxJXjw4pqmYwS06vWJsLcaK`%&0e!yS2Lmxd60yrcajKkSqqtwSc?`kh9y}VF`BEY@Q)(+W90&#&@MtA*3H=Pv?6S5 z*uO%QiE=gIZmgSq`BBU=q8$;z9Mi~sg@4L&T5iWq@%wV%%436(eGM7gGLKYsg4mSP%VlgCb)IGZK@JUj*=broElRWb90 z3PBqaW^L#>zW7C;)k zEPB|wP^L^!zTs{JoBEUGq4*@iT4R*i#jtWFd>JrLFw!{G3i2vf@vy1R6hTN3*Sv4ob@inp#T!noVS)bk@L*0jRr|Tc%Bz>F>;b? zJMg>$r?grUqK6h4fqs)MgqbM&WTL68A5+G30GPdVnBDmys9=m^m#|u43R+AiTcp6$ zKRXX45+Dj;M%%de-OMB7SP0sXq(zTz4F+2-m3YYWcOzccsZVy^n@4OAgJK71Gy6ZG ztDgzsTsf}ZRbo`3&P2VDLmx{JvnT&r!5)(l<#?L7lFCCn*;JD0hp(@%oW@B}nWELq z)6o6$*&^6x{ssjok(r_pfwbLBsFB0!hdU(I_Eg`!_6>(`TbRU8h=-YvI+>No2$TEktP$;`CLmOKpQu-81SAWl2jCTp!uVv2h zM^9>?|0qsZ=S=WBHNOt!a^1ot)xo3_yUr?U1GC0dd%1xwd%Z*Qu1=M=*U~BmFB2_C zDg(V%nFt$^bLm4w`M$d!!mnT_AhoUj4s9k2E1TS5DmQXzQpS$|t&qjg)` zE4W4k32!YErEJKOs#} z0T++=NPxIh`?*!9^A9ar3uI*|ZHAlvRKDfH37^m+6t*4Se)~ITnF|$!yn~Hy(~X83 z6rw%J&^93NkvA#%qwqR+&$CHneZFn4O6x3RsAb%! zjp{vSp6vDo+dB5ksBOnzb}1daD|@;DQ!9cSR1V(FDWvz&{5{%Vx@|3{RT%u5fTDJI z*(d#-V{_29C!SGAi#xKx4&QbMViORQb?#@=YvD<(JNlgRq0vS?4yqG$xy2NU#)6b< zGgQ)CE7X<-EY~N*0a@(@7)&?Qd$!BGkfPe?%^4cwnZek=4^-V%{RvYc4H_lAb@U*v zHUBmEc5JNQ=TjhTw!n|oc59V<_pGQU=2~_AC=yb@ozxrwsmr;3 z(?SNFeTnH0au?*JkOvYvIW#oq!upUh93~WD0`dAHk!zy zTIR{z8C_Mus;5S_iyLNMRdb(d-Bk$~Ip=Y~>mjZ_H&)__{>so+}q|CX8b=#NYixzf?vPd`K6>B zFN9t*8C*hNk(tF`lVBDUPt5Wcio==RjD_@+0NeO-7GA;mt+nx!_&Kq+z?nzC zxD6PoZ2H5WKZk~pe$8vns3JsO`*=UPHOvN@M?qLTiMAK<6wL0%O>$l;SedizzBF*h zApy_JM{LV?P1ysp@34ulY968)(-9u*@Gp15h;<`{+wg-txWOKpB9A1aq%gUXzH7NF zqSHEu;yY7xkIRB15}o(j4q&}$tK8w|wx=5s-J&ooH&n+?CBBegLC_C`L@I@W%HP*3 za4o^m_ktqSSGy{g*(@nq=_n1}r}BqVeBkXTJ_k3y$Uosu#WGY5ok~Wm?&}6~K5qFz zUes6v98G$ZcdOeyI39;=Zxa~5d2^4x*rh!0Ks@4oF{6x!0=w!~8PH13mv)sHZ7>LG z3~t!6cUdFtU(kKqbm`pgm&-Y0Z_uWj(1JFd8G{tkly;h3FHb0QpilX!WKGXKaGy8d`r^NcbYqG%51$}SmPb$(;#0%k}>cl4Q|1ASQ6`8 zyJ#afar`fy>K%AP3tt2LOsMX-%TSlNIUKoK6P}w=SV2bH3CiWb?%qZUTORI zV@{y70i#b?7iS}R4 z6@njJ&ILLA!#PQ*=ryS-?gKHl26uhWmG~&yJ+F`T4EBK1i>f6`ur0lB$@`7fg5EI$yU{y&JYq%!_NWQxV=qg}P8 zePcq5o!Y#HpkeO$dh=|3zH3SgaLu1~U9l$&{yxHeoVAj!tkml6s@cxTQkx-5*SaRz zXyDX*a?!;lXTa+gwbkeLdK2q4S0f-EQ$NwhmJD74sX5|-o;W7z1InWRN=Su6x&lII>Onz_zJA+>5f(`#~i_>QAi&BUO5nnk3DL+ zPGZP*YHSx>Kp>HJ9>>ex4b;uN!koGg>&`(!P7);iFJbBDP|thtav069(CgBq6hW24 zi{dMNM^j%QT-MPjH&MGue68riUqI=u2>#A7NJ=T~v%sOIlt~pXzSa1gMuPJEfxVP< z6rOE?lN_*AYDsODi8goI??Y<|9AU8VE$c42y~MI$zGuF=&}Q0uVOgJ_4d4f^>66ZO zycM2()$~jyA;6C^;FxY@!@|GSKJ21XhlEM}=W3L=2=ZMVQ4@~8Ez=bAp{4kij7V~Q za13Lz$F>eqjw%^jWi9_w*Z-(&y+bpc{Zck5c6kzY;ORP^2iDx{&r`$WA$2v^QsSy% zo{I;jO43Y{9qHPwMd~zex`y`)xiY^anlt0e@#pumR4Hs~R{=j<)3lj7$r1vDZ0atr z_@G?~A?bSXNhSiYcl#WICNcd_N9?P=&ISX}XT$)la5FfJD)ZeFqH^u_$7pXhK23RJ2dN&{xF;&J|BmWE2rKOp*#fm z#Seqh|6|TE>EV2DF>5Rcm6PCRK#evsiFk7cv&1|@-bCszR~S%4RB#jm@Lvt4s;Jm! z#{s5psrOqxjAfTSwi&uLRiGdtxrKi71OoSK;}ehC^aT3gh)PSQ> z<~;v^76gKg2+pd^>#HR~+9GOYM$vYqeTMK-j!BluK2XY6RM*VRFOdpvod~QHINl~{ z7Ou;V)s6sZaj5MdEtU`eqs8c3pWpYvYM^6krH3Cak=R>kRCL{Vs&d^*Zl|5Naf>t8 z`3PEnrV;&DliE1v2|_2lJVRp+zfI!}^wn@ill0-30x?Mp0$@%`wyy+AI1zjb_yd=B z50!oxLjATOIxUjC8eUsj?|Ql`ej!>be7zj0TAhA<6ezWBLWewluS`Y8pf?tX_fHPK zLkEHrl!M1Iq3HMk%E8Ze!c_%BfzjO$>I-f(57RA2m#W5K4N`AP? z>9YBPg}gT(j$S{)X-ju4uBr6Plsy-&#w`&4YFuD3GrsuNQ>ZK zU3yPZ4HmXB|n(PVQHM&F+xPint=QD{m70g z__qRQu%8iidz2lejJ4HQf$vE!EN=jRh)Hn~{3)C>aA6-w=vm6u#dpH^&<$V!N>y#@ zJ#EPHNwTU(yFY&wwn9L*l!VbOXfGt1Ewcswc4Er(x>kMe+fM}ynllWwjzj#y7?NhR zyQTH%3S=S5uQA?=!-2A&#!?=`RPu2MH<5rBbDA50Ih*is%o~rfvK3s zrxidqFK?5A`W7q;AFRjS9&N>ekOo%a=jRB?4*|A6cD4AMIIqU9j!S8`{FclCbSN+A zj4-h6!~tMila^0=%1Y>m_$}kl_2+QT@VV<08B^kVm8uJ?U1OU*>E^e+TX|h=n(GbJ zCrcXBTC7fz!ZT(#5gE>nU`^l{)mntGH^t(+n_M=o%g2GEnuJ;~qKPdupp%J^BfqYF zS%rj*fG}oI__xd^I;qcaGH1+C$j}$@o!ed_fH>m24w!5aLCVlxS0b?Ey{BSMVVCBL zK!LyvR!F#7aPe`Z8eog^279{#ZKqDhtx@u&y5#6KEporjZSw#47Av5lUh{46V@o72RX54zZ}?W31e{Br23 z5GSTzGx$N>pd11ID*~e3f6|x-Zns#DWCxPQl-g?_3y<0nCpo0~jTk9lTh>{G7u4g+ zmGitwA6~cURg}_m!r0|+AVXxb5uR(KVZD)3KA)#fk8QBIm8`G}VQGo(l1`!$(s#87 zCH@mRDAi;*_Y%fo^v=TDN0txfIIGcEth+ST2l9CN!Y3jQ1rbx39I`=+5CphoRiqza*^Bwl(A8!uii^6Q>G84tSly>htML2a{ zd8)F6*k*6RwmB@&w`G`wV_CZtEMsDm943lJFJv0af+i}Xp61cdmaBmNzA_KSdn{LW zuf})%H=$uoFthbT#p!EbtqEiA+Hbb~bhba4G!GhPdO~YVrOE*ot0k21sANt=atb42 z^EhMyix8%O1=1>THCLH9EQ@%F(J%Y3ySZ9lNC)i`$j%~cC(++z^ynZu@AfD*4yjLBQkKJaoik5#^6F5k@jza-#}Fpb|3cu)8L(x-xF>oQ}tL(mN*kQdKVJ zu)8_dy91FmJw$}{rxSKcNG%p~B`B+;Z$nwf_~~qlE^Aujpfa4y;#sy(FN?{Xqe~{0 zc&vxkmjKfE+kaX9X=m*G?jD}Sbq^X&|}zo4ztUJbS`7fngZ*Afzl2;c#x5x(-Re zG3)Bd@$2y0G6JY&RBIBH;be7_wWopm#Ps8~1yr*R#}j-h5Ckj(o$~7^iXt665gl@W zHO({rK2R);8dTx8C^GQUZ?&-i!|V4zolTPI;^Bfhq9@fSNbz^HL7gQLpYO7tRB76z zziJ%8S5t$(&Bm~|J22AO9ztLEy0uRJx5VE!L86~JN2ULd?J@A$8ls3O&s)JMl4rum zv06K)xoC_&3sM5f2~~l4aTs`gd0s7AYADzo6h4mhi!u!thI^sG@y*LJkZX}Kp%=;p zC;rf5n8ql(5;3xmCv03DO3Z)&Kf)23jbr3;*|s&f@jT7AL#9F<-N)wnd+eLyrE)m_GvZtZAv zRf;%T&l7g93bm(6kYeo!-NvpSkdz8DYM0sic`@Z-5IIrW5+}fCKoKU*a2gU)8*ESW ze|EZTd_yyJZch`$D=i-r$%gkTd-l^9MvA4ej0=jd3cA4>xag1F%>vS%XQ|_i+BZ50 zEC~Y@+koS3&6zLl59jGO#9i=cabVxsg&(b6Yew{l5~K2YsxOqG`jt{eT#Ed*3K1jo zdC=1UVkFK_;f8cnhWas5lzjchncHmxWQ@p&o8Vk&e@z^c!@2U_&4qGN7&8$uAd*N= zlq0`G`EplJ=W`9~LgUC94V?HUqfH(f34@_gKmiue4mCJn{8~{w$a#V?8df}rm=0?Xl!F+G&UNiNj7Qx?(hG+ zO+ReT=InjWT=#h98pu)IW#43EuE_af8mruXi+uvnfRD}fVgaH}`_|PUYqHI)WWWXtk&)BhS=|tmpm)L3w>Rm;7(gFZ zlB7*vg(kC!5Bly#l%W}aXwz?Nmre!&G`JNFbVFxbw$Hh&O9k|4n)u4>{1$nVwTRU9 zz4Mke^of7!=w7`zUHl2fH{uhukRBb+%Po0A-!DyoPv+_nwLro=r^cHO@RgG1(m8{zLFHrla9a#K$zO|#9J8i<-=n3#EebF@-G-(dZ*B$W$bVD+4 zha6c{CN&b@sBlbEt6)Nt0@^O`YDPsbQJ4DWHAN zrpkPTVCy+}y8f^<)mAhRoqgvgu|-D@q`_|rq`wTom47ztdJve^Hu;W_;??wqcrMbF z^JsJnyJP7ecfTYlXtiJQRng@V5z0_1ZCa7H@nOub)K^MtP_a3XM5^~;tQ!(Q-d|OB z-fvcZE`7L$W|6fPR2|f*K;eW1D4f7~M6csL#!BGpro=l_yIj^{;qZXf%Barj zmj}wqw?d~yHYWW&5iYk_Xt9eyZZRmFaE2~8md!RY8dAPCH(C;I;#+*4J4NVfiK|11 z3oBc}*I?2vtFBjq1g~Eb$6cI~#r-EZ ziUiVvDNo`$wD*?Jj-nTdL|s!a6HcYpx_*x@w~R`YexP={wc6rZ(HAvF4iCt+4{+WU z4h{2)w2>9w-{8*RZaz!7a~}WNEh_8?b8&H;n;rTrl}b#o(U0b*@rgcCychiEM*!nl z(nAfs#|5vIOn?Wt0`EH-w&4ioW_^9XQw7*IOg6>ydD6;7lu8I@12qb`F zMDd-D-NtofoFaNhh9NA$>x{4OYa9p}s9`0A-$A%QG#ZaSR?|;o_RPcXZ?~x`CoSJy z7($Qxi6CC4`rv1o&imsf?$Gt{o=NE3wSINW@6Ftg5ytx`3>M+VLhKL!MJD0mhn6$N zQ=`&D_KfVgkD0l<_qmMew!Y7I(JMl(C)-QS_vbb1Ukvz=46!m4CEFXvMnP&1>x;M~ zNbO5`Qn63*j{_dU`Y^ zUmQw9P?p2UaFW+paBy=mzQSo^*CMaq@F8N}%MU_GOQm2Ea z=QnUJ6|y1A7G=49Fq!JqQhEDYpKD#(R(5`Hf7^2_BW*ktT|4bw0ND_+V27n5Zgt$XjQUfp&>f%C9rRYD=Sme-g-w05d#C-h5c<*cRLsU|P zJ2d=n8ov9@g8+Hn+ZQ?U#CXuZti<7iO#awjYGt4a^?W&ZrU4{&Es1?~H>+mRb z7(7=~10_G7nhmP{Q`B8(bQyx&y6no?(Fsy+v&!Ms1;dGoq|ZR6yd|jI=iz%x*qjXn zME9&rfc-7SFWX2tXYU~#CXcD>(Nus!cF@7axb}*|e%olK21+UWKP?%JTzuRmSp1)s z#QPM>4f?b5`Ok1tP->wD%g+AYeUC4@Do)p)b18!8*=)eiTa0qU^yMWf&YzcBr!pI* zXFv4<4Sqq{z}<+*+jEv3@8p%Vz%JZ6D9sOu$j5%*I9HR5$v*rq?Zo3ooJO~i#nX?a z-Rp@8b)_~8dgA?(hdv*|$}3TL(qI8=Uv&!LjmbDd~R)?07Fkp zVBgtL{b#lR-8qZgxz&BPN9X)(erYNm56~x_YdWI{id%_nx-@5+9XdG1&TN`H3Ou2C zDw$&v0hH_VmD3H`0>KNtwlDT=^|op7n1oM_igu7Z1x$|lGJXE40EC4Xe}ZT)%ER+?7=EyoviRBE5jfh?Fnc`nsQ%JsD)lxI~2ZZpUQH|8FMtIi|y5xy-9KB>5u`+*Vyt;3${_FTM8U{_Sbd_t_9<6MbHbaaZbUWQ-0oRD`ldS_o4zuTgTK_XN$w#ood>G zKleWP%+ya!jL0nK=+yF}v%6%z_?KR3!Gn6DZRw=~k;0{Sb*T_E)z~SQP^prHIsu{E z!QF?R*gNK{oA1vXxQ)9j#I#-lxu66w#vU=qA1osTD_G@cAfNU1i zSIAy>19cb6RuCc={L_a+1gMLJO4F1?emob|T7oIpFh5XP)8DEp$D>Q2;j0NSw^+j*{SNA7a5g6)<-Mmy8#)$`sQ7I+^dE0TV>Hl z@jg9QduVts8cC#2fL4jOm&(m6@6MKl>9;beh^3wdD#P27MEh;_PA4>XjHRcp}uQClo$hjg=QQ;4+z>U?pASQ|ifl*wtg_L@QN z*tB6@8tBuqN5ekdF{}y=t|tT=Znq;Z-s_-m9LVylDWv>x@>b7&E4FsuDvc(&33~Qj zN$A!>414Xb95cCgjq%eSdx;lWYu8UWF|nUl*Hq_>^d3qrEt3OcgG>|u^q=r<|H31z znE53sFV*zmV>y|}_hyM=Z*QS1@nVP7EYiMju_uFdCou(Z(8!kft9=Lx=`^HP(6yPlOzZLipgyA-Ye>ZDCs^!B>Fsv^-yk~&Cc z!S>}0BHS+;aY|(4*afqdN#$PbcEMGda71(Qlr!b^w09 zAE&JBXO-#Db!(9SmXxme$Ey);3uJlObj1IFEHB#t+*UUvJq(6jk|$ki_^4xADo+k; zW0hfLe+fdoYNZJ0Usc#L5tkCoCB-vXE6GLU7&*@`W=tx0j^<7! z_RLAOw`w0@Q{0ZOv;CwTTi4V_);dD>cKZKJY3d0AXX4)KCgnxjI}DzbHAB%$(Nx+i zU)2;*%;emyFk6oSV5g)J!~V^an5B03Z0mD`W|F#A-yas{hJd7hw6gqk$d>1edFS<#Ytxq^KsCh9?f%G~s^V1T(pO4lm&zsnGs+oROyQ;p- zyz2E3&aw=d8>B-#09vk|$Nhh`&>e^bM^DNTxa~c3HgaXUU%0Qj?@4qz<6%3QWVv5} zQh)$ow6?ZeEk?cbVYk6==OH%5p!@E|9x%U= z7Qx;ZU5=WBr`XB2yvx7%e4=a<`ce9mM;aNKyWIL`dmip0l8x+CFFLb5CWPy8br2osAvR@d9q<KS772I~H0WF*}@i2X-@t~gmJ zpFjk97^ia7A_S!aBZHu3rM?U{^GWE?C#PDvggUt%#aTYY3&loAwqWMdN7v!ZrYG~6Wj?y{ljW( ztoVT}z;AFaI`(8RDlUbNcW)qWonUqGt;152b{iof6GVqLEaRI0=&&w+Q|Y#~IXrV} z(JPY+S{po&*2>6?WM zgtKZ2DNpkondaw8jXIiBFSnJ7KM#4t5XxHR=6KJ?iCDRpDZgEoNR|gMN!yanB`xTO zMJjaieYN^HsaShAO_BO0CeX=8_jZ2ne?w%DkXtPZFAsOF^I?>KIoY`D?GbLu4bild zr1t#h2~5^mW4X+&@qa97I#NEa5tNXfN2{X|dd&3(h`iMoFqpi!A#T#EK?!WobZFR9 zqj=9>jBV!AzVu{P6oGdWucWFbtHH9aP^l(6G<=+Ng==W((erKedA@3<`Gbu{~0F)evF6Zt=E5J=s9fs=6sU$K55 zD1rNMh@m{#dP|_;k-xX^nFscPd(qJp?dVGxoZ{B%``a+U*c152C+<=o9ih*7JrO5dkyb#Ww$wFlYC|T5R`{ef9RsVyZ0Tw$;hG@JC-!?b)+d zA+>v_krQ6AHejibRkQN3wr3Z_26vx`KwsmADnojdJ*RxH>rD96&IZo({pTjx*HRhL z?8vf+O<>oL3{50lI#ys*C6UgHC*uhl(QWJr`YDVaL>?U34K(+R(C^{}?~aPynJyeG z4KMyQh8ItLdm&-}TQ$88@W>m#TCN<`7w*4DdjzeNnFJKZ^pP&aTluNsC}x~u6{HyMB2+T755a3s6GB;+)n7{8kx6!$Z*lYMCjJ(eFk%tXVZWbNWQAaGzX zP#{8Y_!3kdC8`XXq7GQH;*se9-5Gb7+1~|3Flp*CqFDO=`@6 zjZ~$4F}x5t#MV$u6`Qc?LJmcrFnU*^hn^V ze8FDIwC_1l$6(t8xnnrQ9*-Lw53_<*O+SZ5f;_ni&=dh+LVOK=`!d6%L(kddzW0&cQ8Tj-g6`1q0(37uBiO+8}AgR z?zt!R{g4qy4-h*p*8f!srhCTKtNqW%eeNFUhxX?}kcGj&@h`$SDc^`{k5X7 zVP}d^QxC<64k&+Ikf%V7H)G7&=h~4`u3|_S2g?oO;efSSm9?Msb7Gu|Zpg{R_ zKy^>u^c+6N98;ZZMbTpCvQUWa-A68|r1kK-ry8OU(0Hr4Uyco8^lE>X4k-Fkk775z zvcqhc_|{~$?aM!uE}+!AL6-mYb?KVDnB*MIFQ2G5LNCU7%RCY}GWxUB@M_dua(~I> z`l4iH6~1vSYds;q;GClO0y)z|2jK*V_cmR7gb$!hg~-xH#*Cj(vtE588r-paQ+S?8 zdwbBSTy6VAcjM-mzF~D?U0Lt6pC2$V2L>i9WtoE6jr(Y!(xWnFHaIxWfQ?cZ=Pi;1 z1Ewp=+iPU`Zq*3k3AA|sbQoFkZZC@k7DQU`e>yan##m|fr0(?hkS1gU_T={5D-;#x zLWw^MwR`6<=HSHr=&6j!>=Yc7z>BY2{Sng8rP@9wCQ=6UvP(o>2_EG;h<=++61AF|#8VyA$~Ahed>QVV)AI{_v&2J6)%B4*MA=}Y?VH=tRD~>u1U}Kk#!eZFdi+K? zLRoYt!^!gI*^)P}#bFtpia|~`FbkeW>CsEH#t9?!CW!z_O zR5E%!ngVsm9abibBY5n?f979pGG^v4tSv;9MI*IK_TvN*&ToA-EEdIV*H+~xY-=vW zYlsl5XDfAXsku^oyq}sk2OVaUC{^^kFMR~k=Fttn;hCTtxdEC z1#Hwb=`o&IP0o#QEh+{01*C1NiMBRTQP=PydhcB8KT-M$8SD4y4HLvRvOC$Xxm~lP z?9d*8b$5aNwPX;f=Qj4B#`SX~mtL0CV&-Qn9YR3)NL}I7<&%}w*2{+CmVe@m?H_5$ z4puS=Yt@a6-zkJdIVm|4=Y{J;<7?&&efYn>W|g%;nsD-Ut@_-hoir0tR_vVRcm6Ex z-ap8HJ>sIRl4N$xzMXHQGIv>4gYo~WUv%;)D>M)z?~`#PxzfYRfwYXDET+jITllPu zfVE_a-<2Fnw0NO-Ln7#_uHVfgttzMXwys0x_u9t#+fZgAd~GeelS5X@lg6$kx!paT zC4a+L!2GBCz4F=kN$aIxUWSy2E40t%S?o%-em%N~Jot9U!zhIN<$piuKVu;{To zb=~V|SUB8Lk@vUs({LfXnznDNOFaac+k8QMZ|lTHGTIAN6{31MIF@@n&Z#zta=t6o zm3BRolowx$&hEuf%$azkuzaEXv*yV`j%z$qL0_|l<@ElDjD9=2e2_yS#C%Q_O{p=C zaaC3&WsMQ>7Xst`5|wYzw|141;q{g5wmQ|{**8>JhwO7=FV}mw-&+M)@g44tu!=HH zuyUOYVi&w2qmw~1AevUkIfr#z)d^NhSY;o8c&p~(g01sM2n;|csba!nFK=a4PFy{+ zT!XKIX^KPeQe~hN#%iX$PT;L02R6(6o+_aVK9IgQbad#um zR&rke zoa!FwffftEU%=~&(%M-4w}_6nIo)o;8NWX+I6C%%HiLdWvk~=vZrU3N6vKWUpy0V?HwD`<8o{C51cG+Cg`BAcdiO>Q$t= z(sFxNCk zE&GXR6j^lVSne`sA7odJdmj+(bluFlOk27R+w>IsQAq3stnOS(E$Rj{{?ChsfthYlVa z)k#Au?0**1v|1y&{Z^xJt;$`gC)~k^LIeaTA@ME{*~gR@zrmOAFXClf@0^|MzA$>z z5HYS!EkZ-9bSDQSU4oJga%@x)D(UsY%YibU`3)O4{D*6E8ihPRZwQb}e8TLH{vK$K z_<(P%P1KkSA^Tc9;4_UPhDmPHb)xma0FBUrWK=Q#kHpigN?Qfa*ay=E@RHE3c?4mV z^-G3EfQfM08hS?YW}MM)-Q2Fg@+~u=pIEkrRuE!sF_%;)vb}o(2n1YCx|r}f0-NUm z3sNBYjRt3n02h2Q%FO{ucP{K-GJ&qf(TKs?;blqN5x=CgHK9 zoQglyj!X_moDv94R-k3A?=vQBRKE`Wq|cC%_N9$%3lS ziSIeOhbQ~)qf0+e4JX8{&I(fsf_8W8svay*QM~S-TsZ71wxOAXEB>g}WXoKe>6Zpl z1rr3UnmT6;aUm3I3%Q)aIMhsU6`@XT7NPEDe(IOV{IuGu)V#+BEowX>Oubkrfar`V zp1vY`SSM}Dxd+t}%)f0!*hj4#c8M+g_il=KjSuvE5L`)PHY_vE+7YPqPZrl8KU(qr zh79LTELoOr46-TwA;ae7hai`T^WK(P_hE)Sq}WDW{#EI38xOw0opT4Y&JF1A*B@aj z#K6liJ>&WEy`W|J;DOsZ%sYROWka?tQNz_gkqkKCmr1_E72*?il}^5+yh#MX6$;0; z^(5yOqSE{l%J#`}b5f}w)Sjrve`Z35Qq|-^>6{}jR4$*!=aE0e4-<3h3n{V2Gg+2A zcqlgKe^QBQ0jCxNbz1bojIUh?}-|3r}tv zI*mjXpK9`17BVfVNj&OzQMT?SzQUIxPcF-FLcw))+~@E`v2%xthPeFP`wV2Q4WX}5 zzuMJ)-?`pd4KElfqI8_}n0}}CM+=-q%#jcI&W(Y~SRe{I2lU>yxpY8gn`UbcUJ1SP zhOk+kU{sTXX!3A#l2h{aLa5*osGE&B*wNwR|8=v)^$|F*ksGq|22(-(DMs(WhrbF$ zypoUbK0TF8i;iFVrO+Y(F^S5-{h8@x=g;B%*N zI1=sY9}V3>5*%GEG)X!82x{4ILknMm{+@t2GWdwjti~zj`G*jJEW1g+?5IU#IE&h$ zaj~L~Ef8SuD2MnikVWT)#ycuN>wN) zqrQ}+ToyUE&MED*j_33Zg$@)Nme6|!Br*Pf-@81wRT<_jB4yWL9z2Si5hFlBmliy} zRqIA!S4Du_$s}g9>GjX8{Lg`fTHD^HVsO{hQ>^Y%hCZl7Cb6z!?qUxGZ6w6%&(*F#z=(9CjLYcAHJoq)~Eb{a~w< zk!sAZf(>mbkWkY2CZ>&sY$gGjq|PlWGku><7ZK$de_AoyfK@*Om!ZmzN=?_FPyZfN zBs4>qNyz3`S%M8Gq!gr|SfKu1*ON3gn(X*2dpqM9ee>F^Ha&LfO*iJY4SDlOG0Se@ z$b{m)SkfNiZn7S?BU#cuYg0$t-&gS!O$%ekQ2kr5IvSV;&-!n@i(>li!|FIZRub0O zHcRJEk^wepVGech@5J6e4^W>~sj~tRd!GXQS87@ZM8=N^2ihu6F6(eY#-UfnMIw|b zl>%UBJK_aR*vi`Lk4F;s9-juc!$PtLUZUs-^Fn2`7)go9nKD?ZLQ?$b2x|86-$4ti zikd=7pHDqKr&_5*4{zuZb-5-9j0PSe3YFhQe%~4s_(T6SCs zgWQ@6jarK13e=NySPRB*hjb1a{y`)hV|pozJrFc0iO8!m*bxx4*a&L=aX1NVkD%Y` z759|VslTOV4js4}=huFLPu0Nb+wJ#e_el@kkNM^~*WEHc7@k+#3BENr{r zo3xlv)8cmOX*HDYOZX9vg~YHkpFA0p>&_z$+LXjUj;bbLr2R53A&+qN!zb>G2zpAG z2>BT+GraYtyw>%joDoiA`-`4k1)_Oo?U?YEE4F}vuT24aupzgJg{ac34J>UxN!eF4 zNQ@m+wQpidXka46-LUUi03cA?zjw*P``84+z$v530aad zORzAPVjQyMDk(jR1YJ6PXmJo@wedxpczqRQ$!cDJsVS{LWYJ0D(;LM>aTohOU~mDD z%qPVUiNMTPLW>cV;D*OQqgInuV17wS@eHXhsUdaJW_;0Y7b!8A>ram?RC=eUsU1uR zh@MLG;Hc@ciIRzI?l_nr6q_>+v6cf~4z%o?PV4CG?GKP~NK}pFv>T{o1(!;V!g z0!rB>zXQZg`C~2Sm0uX2JUhc;K+c3`)V#7UoG>n4T+ngL54oONGtw)v6ux+(G5#4Q z>mB~#)IW>oc(T6BtNp2G%l`p*JGNs=X?(2N zOgWx!HLWEZEfFOYXVI@RYok@MWg--d)u&=>NFD2_Rlx*Cb_`u+_z1;#Q&cKBS3|9Z z*~aMJDc#c(a)TXO{MS`jm^RrAEdHaS1rnj({3XVn#IfZ{;)EuXe4cW^Jmfwnni9$?Mt#oMXQPfU_Xdvv#Pr`)f!%jYn1yBw5AoCYNlo&QTDPJCg0 zQP3o6J}*CF)%`po8m3=6UJIQlXmDRLv>;&hr z)@=CxP+k&oo@m3P)Rl8jB0kMPx7862Dy&Zg*SHoM{2A|YIo}kx*0vi(9%l98)E;td zh+rbE7SHG-9f|_>*s)Oo`JFk+=Y$}|CC46MVz`1jW!3v zhxpn3v5R>&FC63l=*>Pm;IBrL&@Vnf8B+bG0>)VNB0{vILNrQDbj#AAQv^6i!okTV zyIIk~7^$c2hOOM?));cEiukCd9%;<{!kFfnFY~2OlO~bw_%+*-QfnHn5kK?s!*Xr*0c5%X3Xq5&Mk3bWg(2qbg=&D z(q=hguMWciQpXX$d6(N}2yVF|gd@#Q3cxR<_HgFdr();KHQnkbfoQ>ktn*KLhX|G< zm_SSqMcj}^4`dgJOzqPIp%_y&q-C&XK_?(?km8HM(yt{gkdB3Y?aYqWb;NJmjf|s< zA=AW{s^JdQ{gDSfUmLo3(>%Ixqj3nZ*<0-J=t7mO;f~S$2d120KY~f31_XvRIc#=p zLH41pJZA>Nw_IASU=9*kg&%Y1H8-XTYGHBAf*1Sig7ymVs$m<*gvcWZw~n~bMmfcrDS^C? zQ$leRAXJXRkKps*Fvs=Nj0?O6>V=Ozde0YWp@OHM;QYj(iP+*+;;=_ZSh``+_qfT2 z9i^i_#%UqMF~7Kdk#Fk?C=MY@TQREQ!j@u;a(BW#?jJYplxTl%6OQKgNYtmhRIs5aG8D zz-s+Fwee5L#_!0G<+Z^N-wfnNHmQ5G#Jln*JN!g$^8}Ae2#-w`rE12oC;evJ(*3Iv z;BXLhF1U~^a3La^f6VEc5Pwn3Md7y@Ov!!`*}p$%UMJd*$!>+JHv*=A36syG-w+13 zDaf}=^DCe36n^;(8_(K!uVepm$k}RL3~DTe9G~0yzy3d){^R9A(AIY25B-#7*e86x zyh%6@d8b`3Z4U?;SyR~ZcYeG0;FVS7EKx>Um;$pZ*<`7?kLH2=fUP( zN|f`+_2?!!;0u5*h0G>U<=1Q$BVFs~={2*X7YKo^;N!9el=HG3d^WiJ>cy6-LC96WSC!Ny z3Ws>Fyl+mU$DTdj1!+gjOdyB0{}(M|oe1Fjt=xP%bfBmg=ysMkY)Q2g`@G#)z(=VE zZm~vN;jG)MbMX?l#W?fxAcqp81F=BQObWFz?w1*}2#Ddv#fbFtb9p4EWzcV^@15d5 zuXt3*y^X(68wsF~BzTK#j2`6hRF}}-cOFRW6$;xBT5!BG}jmWFWOa#O9 zAbWG3c4?S|a;veqj;|^N!5vDH#^Ade5PFXBr!T^wf+l|6yDY#MlTPxFYa(3{3)Se{ zRF`U1!N)1KMnB9pFP0?m3c1ntI33Ae|HAh$ZPEt8_W1n_QSUr!f*INC%zG65d%TUn zhS&u+T8=IYGG_*blOK_R2UJ=`xO(aOBKu?Kc-TZ*!}v0P7VJV88l^b_DWR_0)3o4E1=jD zl|_{!j|LJY6B_>W?%yEL5Z7pg9aA*nBLr%Rh(=+hfp4E6OV4kN)mFZ#yt2{zF)mOl zz#{{G<*{-dWAS3M-DedZ$Y=LM)7m%DyQujH3CG2Tmo+sQL*Pb`t;%#HVX={P}V8kNGESj>?o#;)9H+n<4(SD$58>uppCoKqqp?kFKcC}Gf<3%}0LmUzM+KIr0zfaevz*F`5PS4vE%K`Fsy9 z_Ajj7pxG4rIITwTbX7jw$z(L0Ca(tS0T+OvpaqrqS)f)MbT;v<7eIAD!&`&q8DK4d zYsl?k0GwMVzJaPvljOhBo(|Lm_GkQk`IC#dU{GANFcQhPiv5MQO?6NW!3C zt2`~RMSxf8XM^TsT!p#748-}f7S7Yu-7ybQ4cp}3=k04XJ0wsTcsdSs77!UPgx;Hm zOyKP0OY>bjQHC1=#T^YdQ+rZvla)l?jZrl2bvjK%s1A|cx6kN0QxTSDL7pLxidLmG zY{hsP{jYgC%iI<3g~5S3E=uy=G!;AyA9gTJ>$~GwhJ%JRzwXt@&e)hE8Tux7JfT-( zdkE}^PTLs@MEx&45QTRJ8VnB_VZudk3_1lpAuMElES^YXejPbyQgj*>u_X_mx zNA5~ciLyla_fBJd--b{uR^MhAHYm~z6G+3{UhRJsxIP5~R;#kwla^qxxx{qfF%N^! z|2u-B92Cb}y_5n}-lcMm4m9<`rO@!nkGS|5#{nDq`QdswZ?u%pKm6Lb!a`vyMWl*THKIqowZ4vK?)FtnbMw zmIPoSndq{Z;>#sX%V3gF-heOvkttkvEA~ircH8bGHAc z40^d|=!Egt!r-iB9V~WH=Nq&zm7>6F!-|+RcYd1pfxKbmXy0D{omNgVi(m0U2Ufx4 zy%fcegaCJ5U&cfMf!U6PJ?gXeC@bto>&+ji1)*CpKev~vtsBg&F(`w8#0^67p015= zVo|XS<|-+7Hsf={G_u}kW}knQ$cyfw;8rIwd@62vLNlYaY7wrYl56Z=pvLGo{22 zn~h#^k90f$Ipz7vU{UnP#5+>s2BhasUBKs{>*OF@Jn3-D0Fm7IghuvTNHz|V3=`~a zpP_uo_b~VR2L#8eZ2mAPd2*A?_$+;JS`ZZb^~SCnUEui+h>%tNX<=EgqsPxvy9V8H zRyP}oW0ia1D^n0IC@)yETbD22`<+2bEjMI$EP27gUDh0)jXjj1w=H7e`@b;D3Wl>O zwf{RPO>snvW-MBRj#j2y94}T8YOw!m=(}NQNHM@2h!rv;`|M@ln%%mu*GV!EJ2`DJ z9}02{;X1i$J9_4<|+wwv_AqCMDlRouMJJdb!E}m1={#6N`A$ zkV`|AW#;&?>>yGaN3nO4N1mbCKvI-<_#LxO{P)ozC@ySi^Xr&H>U9-%rIqbd%Y^|4u00eL(DUSJ~1>{jWIJ z#W=;CYicc}_dAc%^h9g8F9)}M#P-AvZ7F_6-8|QW&QOsBy%r^+!p?c%XGq+Pp?^cn zKrR;t9t#>qDJal#!%y*?CrGjmJXMZAaekqcwFlTw1NSTE?SG71`}={3S#Z)EZ5L%V zh9y};h$-4-={UpMRTnFz`At{ltk0ROYtmRX?{Z0D^saC_dnLl`G5(%!V7g+N3)bFyRi`J)83ieI zj!IG5ZENa$vIYo1Q!3JYK^8o9X9u-O?Qa#z)dpKs4xE!D%S|cVMvoj^^GxkHvCqAo zM^l-JC?G?z!u~F-AVX2YBfG**+e@CCcU7&NON;_bcmtOq<2^>e`n?X%5t4MN%~S8g zRqIcvSRo&;(6g4(-RS5)77$j*$Ynf{A2=$2r-WX++esN>N>&Uj{kL?kB|gN4x>p!% znZGj&kqr%cX*m9Y18rO4NhEHZM-u=#;@63w#``@O!d^^ZH$xZv@QXI>^8a)o37THD z#vmmTKBrv zsdb^}9*yhMOIvxRm(yrDO=jaW^SQ}ylg6Aq-~U(lYK_U=bGZGSA$Db*vnLtSvI~ee zE~Zf(8>E#^C*yVp-8`X*vbAlk^%_#{J>$~;ZQv`~`MJzLf+wx%1~aY;XpK&F#e?csmDEMK#noE^p|NvOH{3e`<(HRw_JlV>Hc zS>wxDIv5(&>%L%!{Ni(v+)KiHx3V}J`RiGq<5r8JN{DNIM^S!J1biihPoHJKkaW$T zuLB%Rp)bL3l&m){lh-}2FLisW>tnSm7fK}q@PZqTk!(gkVh@bkjnd)Z)lCnt&it>j zfemwH^$Xm%7P$4zo6z0nk2Xi$74#RnC})e9N>ap@Ka}_3?OYWTHBzla6y-bhHr>^CYe?c#sc|0t@pO+y zt}v%~g0$WO2g98_{tKQ!H_w~Z2lKUF-(OLsT?-@V+nuwJ+%D`b!|ZPPdyw2F4Gb

i5s(od@pJ@e}Ls4V8YX8mWt$NeM?iwL7oj;~vfe4(dynw~t%?}~Na zQ<}%;VsMzBvpNY74aPe{*&Rj#hZ>*fnbq_+OLZ@zJCi)lu=yPKwf-=Ak{gt9^QiW$ zr_`)HobAO;&2;J`%FFM@Q#I87t+Gz=&^;q{#Bes+67nKCHL`3?H0F3$eKc#s>%#vZ zc?I@tc!@0LA0RUsC%~EDEqHGFTMb2WCbf3^1kx_s{SqihX)W%6QJ`ro?`Ntyg3g?x zN=(?W)rcEe8;n)&D#>=gCw*(zS8t|xU^~9=tjjV`{DFKPnR&IKqQ8p8vlHk8oKNDb zh@7YOe>AT zFjZ-Yr*m_tV09Wo&w13KpH0%O|8!~7*6Q+@!ocA&z))WKwV$Gy*F{UclQ*m@>jeMT z*Vrl0Fd022{Yv~u2U(42-QWYpBj=mD#D|2lNFuUmUvij;+~Vkxy8Oa6j*@y=p}|za zDW)45&<4o8^bt1B8&w?hn=(U7twDN4l~}BFzR3FG*qe!eM52Fz?g3D-#YO8r2Hzxr z<|OS_1L6u`&vE-Hkr-w{5~{9e@0 z-iz#bEW|PXKjNPZ;us4~q29oKU#6e()M{s;+d$PQoyNH@O!5p*jnMjIx4)Xm^M_ju z@m=Rko!BrB`XpSjJGr9!<<|4UDc(%3<#=3Y*eEh8XK+Zm{;rIQA-M3_u<5ClaHRU= z-jQMx*5kJJ5?D>RO>`#_nK)P$!}23lD1+oX^5Ih2aE(?LiMd=ehAi{oGj;fbT(^YD zMGC#NN^Y@spZ4~XzLJ;7Zo3;=ODx;qKa^K3LyG~322ri&Fdyv_DB}mqmLO_VsS*Z9 z;f{A=;`CCTyuFtzpepU+FAm7Sw4cPMUXR?!mi0f4$oFx<9CeIlNoEt2rZX6H6|r$U zZvoA%tYRy=w!^^+5&YOy5eWbw<)?SWtqMr9LC7(TFzcq$oziPt(#wUK1(e#kz+w7#1bZpzUoldgTamTi8bc_x=HokrCeZQ0Yd$0YhiCQ(PYK~E}jJbX@anfJl z;Hr_yv52R2Al%je__oTmZMk z3cU*~=MoboglRci4D~W)PzU1We8ZA|5*`a~hf*Tx2Whjw(chsu*Sg&hriEWU3UZYd z4cho2HOAVDQ-RU0vUij2<~K(1r~OfcBu5D`^4@X7)KdHPrIZ%J%!)`mzu>jBR8gu% z9xg!r7SGRrt(gct;hl}+TZXFa^==Im^O*dx`p0$d4gse>1q%)IGUtjle8XI# zZ{Mxe+!1ZkBk@`%krb3e5kpMDdE@`)9fL1kXRHl65jdVfCV9uS2WndiI_^Qn6O)sW zXCcq-J56lf?bH2SHbYS3{S;abAa(e?n5O7dHNKmDE^<+E%FyWS8*(1fpIh`JX?2-< z3Z^(LA~zhm7}n&E@jr`zHVkV5st5xQBZ@pR^FL!6zz?Z4*47vgl=D%YVgcOsPzWYMNGeKCqfuoE>g-M~H}E_feh(Yk;O4O% zkzdogwz9_I&C)Z&Yfo~t)(%kX2MfZ}d=AxWBQs|02n)(&v2=P1llO2!_4ZUZtpEql z!TX;Dr{F3FF1S}ZxYl(^jv3I-={(5@|CxQNJbTqV$?G@`Vqdq*JV^l!N{g5GaySg_ zQ-QDR-af0fgD>>g;!%tLy2|IFQ43H-MtB$}9U{v@{XNF)P?fQu`b%xyXQFXS9gGO} z{DVS74S%k5vct$DXI&%*7L3Ju-2cAIJCNSgSo3FG|hfPgV+l ztknof0ad7bnwMrnuQC*I6lXED7e&Lo5b%nMV&;72(t1 z(i_O8is`XrGM&5)XFx1-{s$L^5QlUwlVaG$a2sR7H9E!9uf(hWd13k$GjW*N53}>< z32*2zfW2r%T~nz^c5h?D>$0^g^Ut}jP!US?qrU}|RkM(gi$oXF&#xLm1Ms|%L1MlZ z{1>P|0@!9^Mxj6;z!~DuKfQ?yhCAK0kFRQctS~XN z{JvvFhR2%$-1pY&ShMjlF3RyS`)qp4?}3+cH82NV1ab4x+O_02vT5NGw5E9}Y$nq> z7`x)^{}ZTmi-^M;B}GW`oK|#S#o78yA`>LRfh_AX;=Sw=3kBeN(Vj$KG&lRNXbH>` zX}(o?xV&!<--#SC25mV|Tz3j@E{N%$*pKXH*b~J%YuFTw>TbcPsB0+}uiACLHPP;K z236k5aCA0myUvvYfwq!QjS9U&`~LBa5VrIer&^}Xy#lWB$8 zxnP43d=NYapx#y~bO5xmen@BYpZaGYQR+ta- z0i1B*lZLB)f9~No5E!T!3)rw?ogmUFGz6+T2(cUroL&0f1Y_7VnVm9<^6z`xLCGlT zrLCv+%yIo2===x`J#nDiawz`>DM-MwV$hCUJp_&A8;-Ds0bvlR8eCaYY`jkDUoC*S z%A!A!=q#kG0aTgSPo!N?H#+_A(oWoKsu=KTtw`BysCe%r^N_Kofv zoo1mrHQZX9VxUztwV8`kxaniY{Gm*!X=~4vgoW+YVm)rakgm8!FID>~iRImC>)BtRo)H6u|g`0Bk|4Y@7{_K_JsF&(3Ey^G(Kl*yuAH0jA>M-H0LguaQ1Q4n9Glu z%X|;iSn8`uh$tl*SQ9du1=5SzVykz3{~B|R@_n)1TFnK`vRYHM7>(R;I^GQXZC&_t zg6^<^)7XCZa;Z#|8UvPP^IAoSYJ%)n$c3D9K>3MD&-)Eujk*uiu_kB~Z!t4Tp?Y1B z8v?(fz#%jvsdJ-%CcvCK$jA&HEW8-Em2_$Zk&4AhEGH3vH)bQjcwaPxa<3s^^pV~) z5Mc)A=+d55+*yq=ie0LD$U&0vUvEx$Yt8J`pKiXdI`upoZS`teYq?o@q_el*+IL}&J5g4*-RI0dEgJY z-0!5Ss^QwMQ%Y8h+aL(<#g6o@a2p77kqUL|)$+KFY}=#NJjzNuK?>q|wdjM*CJ90$0b zTTbof&%v_`>O8^}G@*0|D_h%U9yzePw*9uiFQrr|i#5ZS-B~zp8g(+!wujY8{0f=k zc}PDFKlMtFAbuEW8&-&+m@D~jBp0iy63k23N$#5Ev=ptXzIRl#5YoGm5Q`|=sdp=B zkdi$;e5d<8w}t(T&SggzHOi?P71*0WK-xc*M^*^7Xe+b&pxLV#fb=pfX9;aKw}Z(^ zz~`sDCvx=#PoW36W_|HiXrSxdP21rtI+w-&tXiTIlYB=;tISSa0kwGwTeJYykP59h zMk!-6IucnqJ1e^S55 zyACWj-d;;cgMFhTz&J#?`<;ZOI0+(ys^6()v+e-w(2U{1eD3bBLrI^jt2uoB;pBO0d5x5G;gx#V4QA zd}%3^x*T4=@mzRWH1tWQyP10ui#wYm0T2$AW3&y6H3^KBc30%r32q8Da7{N`yCHm` z>#+H`LPnVRX3*t3f2A2r8w+Ay9RNbIk_r zi%l&i%9C3LBL6Wlku%ohid6u$2@1$W)>ntyMkU8Lq7%TI^oVyD@@9{`BHD?0fU)e5 zg4iRpLUJgY+Lk7alEckq<0K;m?zIRyWke*hfRcR$Cs^-TAf) zZ0dZKD+DH22~`Uv_A}6MvKG<7hRKPvpY7Oo_~BVlSO+(SLY<=>qv~${NDe&hMlZWP!B%NRMoZ;@`6c1sPw4f?7EUDJFG!gNiigS77(b6Um{>|MGPHWEqb@7 zf*{#E5KA`995`X6k|h#X2jhXi3;*kFZt$!|V2aXHP?e{ijljkCOlksYc)^?)Pq;u} zZ$t8xvLkoscD6!l=)8rbZ`XFGPm~z|0d+ z;=p`&O)Txx9|9!L@tRPO8f3l%nj=hQesk zh=<6UV0oX+h4faz!s}Bv?nCE@{D6_hNQ{P9P1>V{`~+B-C1o0MrV7=9oVzbLvmQ7> z3W<~n&UNd)j}53}7Zj@c_B#$&E@O{J>kn?q_(eJaOAd0nL3>E$D}^zay5mCxe#4}8 z)+ok^Ercfq4I+&~6b|gkwwcTgNCNn2k}kSZCDsef#H`#ess5qx@nzZ8PZ4h~$91?h z#j_`YFj~ms$qV49)kF~vcf#W3(5%a9I#xI(g@GG)g%G4h%p-K5-zdb-*2mSvTf9I% zKU5fw1@Kup05rAb8;LkO5tOJJIk@_sQE=0d`w+26U28t*v^)pG`{vx^v&%7`#w+Y7=pq4Sch4QaXj2d#GeB^ zWas_>dXjgbC&>_FCko?Hi+B${+`ZB4dLe$XR~{7^!7*>t5g;H|x6aIUf`#AetnX|P zl)ov*v5aM!u}#59AyF2-U3SkA%Hr6%_=O0StbH?7hll`U-LWCC#2SunwDM%+da%{M zr^s#p-t2r;JNB>+)UQ_Whuu)E=x7QZ%XB3WWBC(?2zsQde8JH7+3Q$4Z{{1JA_r6& zX=O8=o*-B4KQFiUcXuWlt=g^SY1(o;zRk*AzW}FMD*@aGJvHgKeSPKGSrAU4gvK;l#=1T9o!wlX z>~Cea8vwS`27BkIeCMYJz{_eUM6STuUP_$G?C`#khRv$7Tl4RYD&i_wr-krzTIC@8 zIfYVL^h_OBLtlMAoi3=Hg?dL6-7#b3yW)4UvJ2JfXAM6i%jb$5`FDD{0>pfAIoVqE z{O$@EMs!zscU6Yt-ZfJ9pCBZ73?NqSt56#2K&;2O2wzc8Y=b)h?( zetmUhZLoh*bhV>RD6dQ83JZh3a6Ue=m&qH;>rb?o$87^!$x z&KGnArG~fVzgn(N(+BP7n=EN`=NnN?4hpj6*QJ=fsE4e-B2Nu*v<1~MtG9Jr|54@} zltq|?$TGrNGH^yO(`rm&$;GQeXFAv-3-)Q)rX1>MS8@Py;FlKx-0?7NwOiDE{q1&L zz;XH>5z>!<-g}UaNKtbsiQ2|~^qudsj&q{j!Dq4!T$)ifssygzdBIf*Flqvf>Ugaf z2}8W8h(da)(5DZ)dnbc2mwgOd<|FC_Xzw9#ANaNq8}+jv4MdYH3c4W@ElDNJkV)x z|J9Wg$_A6cl;N4}o=HX~ysl~6lV4FOCZS?I#VSsT94w&HoI$4o??2 z>_)7A@>(z0s=*M{jhQc2tSL5W;k-|C1P9snrp}KZ6SR@vmi5-FZv<9D12a#z(qnDA zj@B$(BcQl`%v2DLLHU+aLD9u5KIu@1uH|}%tf=g2Oj@&rdvny--hospV3HYA*DP1^ zkrdNdmdzgel$`=bSBmayv3!v0ESm>iVil+)dNZ%w1?wFhwy|QzaFST6i?2o?7KM zZtUqu;(oQOTx%CLuTBwHzJUtb`Y|qQ3P!}mv6+17#ogW1Nn9#eTHs-4nl3`&YnEWE zK{Y3=d5e&;5i-?(K~wz?B8k?(B02&N9_N@+~Y&wNiwmuc-VVbOg^h(DhJA!D(Di5^4!g6Aycw?kc)>UAbp4=u&?A0KXQ{%D#zzJ8yH3vf~u1ftIR)J$7j`_VNrT79<1#Ohrd}u7S z@|XRb+W^Q}jB=}CLOxsEp9gAbwI_2rHKR-0jJs3A%$L*N54>e!MKh9s@5d)^89G2CFoW-~<%ydw{Z*j;JV|)Ej z`sPNW1;Ng}Sd-qVzcL&040oV-Fx$#ErfhB&6(JnoohA33N-N#_sCtmH+kg86*tQ`l zqyWNyCVn60c{gEp;?1q>`&q`o23OqomBj58k;@(U>3H}ZsEKJ|-VATXanmWCEC~^I z_#pCw`t04?Q{#6gFYQnKuSoYh|gZTlv z0~yR1rd8zW*9-Q1Rg0|dqlA15_lc#-j%?+x8a(+YIfAxK9)8FVc3M<4+nzBTi%xn} zL+O{~@2am8Zq2$$EsGi?N|r6i?Rz^pr?p?d0YbR45q@8->y7=CrRC7MS#Eq^%P_D;^hL$sgR(0) z3OYgpP3osFe({A-siDE^bIFUG6va?d1jIZEm!Z^lFc<{kHQfO;_nD|ONR8quvQ7Qb zX3BV|j0Z2mAVLoj!NsUYB~~-$QhDZ|$i<{tpIf&w24gwOtJzpH_*&d#$dxr9G(WTL z47W06qz^H|Z%mkd+dqL}$&6hPc!HKk-; zy-cM~KqY{pTVyJ-Jh329g*A&iZ+qa%9L1d!E z_Jf)w^4+JfU6RCvf0_q((pk|V&zUvyC}*4h2;zu`3Syck=g9=+h&2z!lr)hvN_&?g zXYj&Sv#r&k7z`9L=P2gW6Jy}rX?D^ba(o`D1JxyYY|)LEQ5mHB900k2YwE$&6?P?x;I_Fow_sZs3MLjNv# z6)s^0ZJr=m#y3M81Q&^nj3%^yc#0sI9@o;=4qzj1?pl!ZB~PP+s+(1>4AN6Y2zJsyBnq*8?8tutzqpiav0Bui0=y`%_e^_=P>hxbTmE#wn( zli<$9`Hay5IQ|TblJH*LfY`!SWLWbv12X$)De)gfa5AZgL~7ZrR!m~>=2wk|4SeUE z02R(~4paFRgY|U2zj9&gc!K58d*sy&X8h(O66KevIB?L&QGq>@vLzb=&~qSje-5?_N#b#NL?)1*vr#0`&Efxl0I{ZFNb84=5YH3IUL zKP0mc@&_I=T;h+*fYBk}N6}w{V&rhf&x9Wzj&rd6L-WbWv$y*YWmHtje@0;yl@uMk zoJ41meRrS>r+w3?5~qXM!EnVeSZgAjxah@}<-YJm?cADw;y?9L0Tos7pV4WtIvR2d zz*P_TH#ojb+l_ED@pWEB-bgA^vzjq-*0Yj~33*0gbv=Pd;62#g9qW@68y|8oqmzTn zb#vik2i8o9uuh3S^C5%D_&9Z<8Rv%Sg|q(6W@9VA_C~FcoP(S*l4S@EA&!`-xWjo! zxhD$qDamLd==hn!Xy+K^I&FuFHk_lm71W4UJ;PzAO#Wvns1cEzStI&i`NcE)%zxks ziKNI4iqA4B@U_VovLR;?C1bAmq1sCk_5G#!kytmNvTS_9V}N&ZX3B6uKC)rI94edb z0os_ASsm7xZZZZX=~svj6O6a(QtsNN5Pk_omh-y_py>+M~k6;0-$h;mYsoc<&9WWh&)*@ka9a!+P~y!PJ2<53J-ELt8mFb3RyAoKm@Q zT*YVuHZqegBU06U>yDCG9n21?`{&)WIOojm%#c>>8S8L;OY$uJ1%#y|RkHR5?9{HJ z1D3mJZA&rhW#ISGv7T`q6sn+78OGU^VZqDvAa?Oxww%HLDS#^A(_ic#=xn5n`>|8t zq03Le`fkm{zHBF2wa+x>yU6~Qvvj4XJ|WCkKHkhRcawcwGF)&2Arx~HDm?M5^xRmG zktEOSoAFEP=f-xcjX8{|>=C2h{_PfkFi1g=2?{P_d;PYj_?^VHN_-n8hqsmg+umZv zeSr2W^@le&>>ngy+j=u}mQHTY*sqbz?Y3s~j`F#S3^|4?26NixZu z8gvguXi4RVv@`RuC!8Bt<1GEiMfbB%EJKU`fCbd#KbZL- zjI(&3zSu8o7k=^dPJZYBSo|GEZ0u*mu*GOJ?)s|nhddr{hdjep+@KJh0aL{F=Uy9| ztsito(#$VI&`#aO(CxT0!-q}j_o}#SjaL^YAVY^<1I_YIsgvn<4WI^uxz&fv_x9rF zf!$mj!veK8((?T5!Wj@CU1X?K8h`-VhLa3wutqt4$NX}Ul=dhx5yc<# z)v(X3`PXuTlB4ziAd$;A<%aq6vai66nzhjGbHFh8q1*uULw`ik>Pb1RX-*4mHL9wY zf1Zh~a~6GhX+r!(G|A>N4%1b$|J9c19es{XG}WY*t|@S+5I`z0i9{*M$XhOaBBKkS82N3@*ON4Eb}TQ=^-u@a)9LWsk`J4=k}kEnhKll{6982B`J zE|&)N0STP7LUha0&n*g^f}#`f_0;4&s3+!)9LiTmQ66VFG0hU!Oo82NCB@&eMe^SC zHxq6R(5J8*jdc3s)5d9%#WPy7N5Pk)y6?E~(t6=D+FhZa7*!Ywk+4{5_;HEqTw)Kc zXe!L@5O-K##+@#ZJ7A&Y$mkvAys8#7&KOWbgavssu0vV~!QNwt%B=O6czWoGV|foh z3gmeI&(M;f(t$%`(He$%Ez#OhI*IHjJQnT|O3~uKScCW<-_ODTm{Y^XB2)Hg;Qwn(gV!spSV3N|7jn z4N9Z){jb%GSqR6lc;G+dmqbSCwxf4mq?}{!3y_Kih$8eZx9Fa<41KGr2^ya?#Q1VI z^2M+_+c&-)h9!STewcCur@F~*TZx(bn|ney61X4%vp9-ntDMMil+wp*5 zR{ar_?I)0FD=nF@7T7}60%Gb%`;ZK)L=rC2H#fmlL?3g*+H3^%gS&$86OfZQq|cAX zlh3PeY8c@|DE@y+GRjqWcf-A722BnHt-qjj|J9a6A1B7r$uNWLS$(6FL z6LPgmo}R%RJ)Ph+WKPMZ%m^#EG?b*_MG;~TJKfFC>c3$eos=cFJkv}qDmhmB$vWHx z#{Y#&XDeuDCF!VVS0XzsQ%Nvafw9%%bJ*4Q{e5p{d;h#Sq}sU#lj1< zSpVO4nodrPxtu|Uy!Q4Vwf)o#l7CbQ+w^H7lM&N0;D+g626;=oAki&A^OoU26uv4z zd>@vENK2dLtzkStqCqO#$SvRPi!tP31q(p+FPJH)cQ!EVq&D zJiMGMos1P>gufCsb;S(~NvYXLOeYpqXMU*n9?P<6TpawQR`%ttMy8t~IUCS?-$QHj z7H!)L@Apd;fvPrxjQ?TM#`pt3`7ow4Hlyo@ny>=j#m3Wj!{zuRlKLC?2W_$5YCOWT zR+c(_e)AK7Lygbh|ixv|cU zCp{w^*JVBKW##!_X8nrKGSCs>lCpIPQ_Vtw{(X0UImQ9r@XUA#4O(oVFPD+Jf-cAN z64{0uEBgs<&5Nq?j~!n+Qpff%_NnYJmtS5;{t0-nIg?!+xPE@Cn~U<@RmHBx2gS~y zHHaC21Eg(IrWee2{~TrW#cSHa225khy@1O`2-l1J{E-93fUl z5ZtYSaNHpl<`YfnZLGxS(w8HYfoKXms-h&yCqu(!7lN9E8r~0?ADRvG)j5KCPq{VB zZ#3+2412U`28{2Pb9`7SElLZfnz=4%JZpi`KAsKspQJb|pgJ`{+lAQ4TI$7jLVfWF zp*xDEMbK+b`9mp&1UnyJ(6U%HRfgvP)&2psi-kmE`BV+4^vxmrj=2dwe62#@;swe9 z^&+?jh~t@!o{U1JK&^3fw!^4NAVkPWWyec%t?-{{`o4s z5k|-TnU)zFi1j9Rbp!=Ft;V~G@3CleNi4Eh`JHK7hV%4o(L~rJrrxm}pr6(4;c%F? z*Pu74!*!jUEGU$y3}>`m+W6+d;gnh<8tC}a8UbK>lG!v2EEWR_c##*eEuJ&>6@{PD zz!yxxAG0X+#;|a`(>+7nfrDF=mN07|*=gg7OGM^Lb zF&C3h>gvb{aau)A22O~XN5YuZ$}f))4T(X91kvb}uLjTh7S+PJEIh!%AN%pxdYDi6 zH=(|61vN@U5}!dhD&u_j_wFX9GV3u*@HLPT5(&nIfu+Hf`@VpJ?|O#NF>VoLKdO+6 zB%>wPa+^r4le7nbc|Qgt*0*eW(?ngAzJTRPFqKDocuPUGOx8CNDBWhlB8R$9Gh&E{ zvb3y&d3}Kw!#J)-E*cs7EBJPMu@)w-*49~wk6tbozm8Q{aZ>^1e3J406yLkF%lHS%ok&yD{Va%SEMX_VWSywvT>|RVOdM zpgB+_eEq8FnwKnOCJ2vh_!wszka(mR^Fg$O_kJS(_Hak>(ppyD>i2K<)6kkKyZ(i4 z6W8ddZ3&hq88JWev(t;!ES*!iW5JdRT{-t#lBHG+16$QYGD&Z8yYM#G64FmTAt&0p zN{~ed@~EPEEHk|5qVk^y=Jkctq_@lnwov<$SP&O67J>Qo%sVnj6&!5dK>F26R8jd1 z`2R^l3d)y-XR)!p5*S}pZU;k&fK@JFZa;E5cmq$nli$25L*E&%*LTf8TGe=pY#k`=E6b%cUQ>E6Fd%jW zONF1xf6bb6-l%HU$9&RXZ6He6!iZ}%!(_>2T+iT>Ky`Mq?blaFoo5j^pN}>W8byn5 zy_f)A!RDL>$G9?qnJ5h=ooOdv!xmSS5lw6A@LvrQ(&01Wgs-Cn!f`#Zvynb3n*~3R z@Sf%vLg}DNZGZMdpH~G={{T^(WUjgK3k;XK{ zG%sqby09Tk@)(d=jj@&w!=RXJZ;)GEAqUT$UzrnL{JLz*6ezWvjVi4PaUJ=5KWRom zo2$6~hpm*of3yzKR~b`o`1aQ{$^8b|9a>sD%GH6y2%1(1{kGxQyy)XMYYH>`Va;0+ z4f_9+ctQIHK|Oc0M1{Jn#tSl4|JQD>P;N=}a~>wq+}Dntp=eJKXpVS$`q`U^%ez>v z;9@|?2wUs)iQ!uZ_r2dqkP04@`K@}=smy}39sOz5JD|U2Z8rB;d$t?BscCU@(O^H~ zj!wa1D_6kqMEgFnYtqjh|B6*o8z7?^=JXLABqIc7FXLoW9VH1YiNs;9C!kDpnF$|w z<_%<5;5H`EKwDHQ*M|5%TijM#=_$j;jt1J|)$!mU**_ImPNE>CWB_ZqnQtng+IRbX zyzt363xkV;994-?3TyL9chLLKO#H4ZpdtOvP7 zD-%O94D?^*C8m{A%pVcZ!cnK+#_!t+_lKt&^=BwqC?{nR;+F{2AAR0aJ%wtBF!3V5%fKCN)unG|!;6%Ir;2{8#i z@}!4w{4VgKYybJ@kEyGvL9gta#$8j5wlD;rrcK6U`VL(MV@*%r5{RQ$Q4C7bDBi~U zU|be<1t>K|(4>XHB+x>8y6SKXna#etWcl+ zmK&eT;eOBp0qAdYd>wK7Q?7s)Uo2K#ILdcF*JI?BoP~drPGB^g2>WW>I zslT~+7`zsTXsj_fnLYVi4izHX?sI3?T}6BU;^#`$>;&)344K|ML)`rSu(%5&ut-6?bk46k@*^$-iJt^luIR7Js$?Y%`E#-vzHTA;bKLQ_{8s8W zc1M9U%)pI{C(j}7Y4jmyE(M7+AgAqwHr9*|_?XxKw?)lw;8lh>;z~eUq{}ke{Hb5D zn}lyrFkq;5;Wg%A_h-nrK;leMOG>Z`2GPZX z=x&Z6UXU+z+S)m|K+@N(1kZ18xk8#pU8ie|2#WK!n$D26@U83Wk$e+zXRn^VeI=dILMl^;vNHO6BnuO;Bb^{+ z0W-vowXcHPH);;49jSTiNL0p>MqYGh)I zENhPAurLb#k;o;&1IdZ>wr2J8XHCG3lu>~&p;v`^rN<)I=|fx2Wnnt=7 zZz=d>*-Z7>!N6^#V`BiLaBR-WF8}+!JTht${09cxqAClMqx)^MnYAIS1LD!Z+p6FoyH_h$Un2eFKhiQ4(O~SX0^Xu zv%8O3e60C-X1#>`^I1X@V4^d^s0OxLt`j!g(bmY}+csqnLrd$dclxT~gU#>fwAWSR z0GQ&O>cZ!Gm1Nt$oPk?I`GKCKzB?|2s}tY*xc}XFZPXj*XmdAIm_#dI&q)S(e+iXc zgI;#eU;O!Jt9Q^pU>wNnFg#VgQgThvP*_nt$Dd!J#xdENQBDr9v)Y(-altMtZcqO6 zhfz_=9d_y|zT9?R;bP@YSBlDvJf9Lyjj@l}MCU{-@rA^KAA`}^pk^eBdyj3op`T}} z;PXrk{0I@M^W_@BYwY0fk$6z2@N3-d?dqBK39W=1J5>&S$g4;>eG^Q98pNw0ITgIj zg0ctT+ zJGQmS%`D!~qvEFMAMsxYln}9w91ZTr$)^k5gS}+7Mb9s){Hu+nzk@RP?d#dbdvJZ^ zevgyP1gKSWm|Oq&B8x`uJ)r#S-cSWQVHDzM|P@H-zI9l zD!<86z%1k>e&6cyjz4QN_CMpOw#?Z)-@Uado-IXNPg4DAv*eZ3HR_9^z9dkY{~wi`Yg}@HK@P+@ z8o5=?zDY_r>YhYGElI|xvB3aQ^cx9s67`-TYeS854#Z~}+A^0*dgfw0xqv2p8fF$& z>CGn3O1|1Ns&S+Fuwr2UNbg*&F|JIm1qJ%4#*HXGdRA8`Dfgjjf0kYEzgADN$F7H6 zw%P_U*)(El!aFX96&h+RLiVtFOh2iUhiQ`IrIKdKeyc!!dayzG;6xuJweVr=$ zkNUL|%W|rX+j)s1qhTXDI0@W{lkNbZ5Unh^(GYOpM^s{$WoZ|7mhE^*|GDNG>&8=U z!5Ix)fU|>PGtC;k7wg=oCovxU^1-w$fHgcKVnz#J)FpI2NO2?MU)rr`oE5H-GWmB5ox@J9xjcaNI z;X*r*D(~8Q<@lmort2il;9O>VD4P-A%5Mnyo2Bh7kKF9C-rj>Ao0w@Rrj95Bk*I#R zB}+G}pT6{)XuX}6D|DStIO!>d8`Gi(O1)y?jcP2cIbm|bWckI>XyayWW~Eh#U@d`nhldHw#FX5O|xbVjx_g!$Gakt2k8mX z!SIqqvD{rzKr!tZA~P?SM~o@X8(NP{>jk+g$!pI5I4``Ratm2z|9G}kskgR+)5^icBYtYA-j}JZduQ5GKAP9N8?(|@<_65_9w4;}_o@Qq*qfrvDzGt4~!5`BfPj z@&1j+&!r|_*i8Q&&m;F#l=8uZKV;}fwoB!I#AoZf?)x%=rN&Z8^s!Ay|FUHex0_ur4K%L?Vcp}rytv3jNs}e z@OE8M;r9x*e%2p6b%>zfB7zb#*~^#e3*M8PcaDa>?m_Gy5l4eb&(P#- zcGB*-nW$R-c?%!K-<+9lONi(K6MWUE*Azi!7y9SPGP=Jo2#FPq7t%HR89DUh)&j!Fr1BhC33C zF$iPG2_uSoTWzpq`+UriG}T0x%cAFAy%eXiEmyoK|?Hlx{eXt)fz#%3OSOcZ4zqxc?thRaKbz;G^^ZIMPIFVlI! zTu<}s_VdolJBPansd6b+>R)K#xO;Yn^*zA0tYr>P?jT<|W?xyhHX7{z&)X7bID`~E1lU2oZrB6J1U$6 zMG9Sc6e-QlUh|d@^xKrG7F(cwalx)z{)#R@?{b3tMUvtSky9>jEl@?~YGqd(x~W-p z`w|1Kk$yVSz6zL!^3_%u-p~b zYl7^K4E?pq4u*f1l`cL(=PEPengmWKNffb$IkB*s7<)p=EI|$61LNi~V4?X5*4uTY z4cAbkKf`+WqDL#Km4v|2pPda3=b=!ROWINivFji$`z=Vre{n2*q0QIuFCNRw&h9ERP&s=kaXPf z1Ib31*98StZ#QRTEzSQ?igzGdq;g5?aM)gTWfVnS-)@;?*P#s7ZR67c1+Ok5jE1rp ziv@9=4Ha!$$&8A0kKexp27*uja1-`+EJIo$G3P$#IInE${^Ctu%%dlH>%e`nvu4qL z?9krHaMUHeY z_(;Mr=n8np#HT==FvW&?wj*7wNToV2&?%&hloW0!NW4|1j~&3V;oMVH1qv#>4FQV> zNdU==mI8-pKdG+ZR^I?$r&vQk&cGA#mLq#}=R|uYoQ*pg}Z)K`rE8wWf z4~+sY`J)Dos>egzahGxPTjauypErLFOobj*clh2Kc(y3&gm^|61F zL)3xXz*)x%wRQ7E-UGXl-#-73sb>z)y8pV_w(T|Bwrw=8*|wT(uX&Blw$W^(W*hI_ zp11n_*SfyfboX_x6c<64fEnS$_?vB}vOhEY|})g>$|R zoVe2nO4QFp2x4AXF*b&ngVdAYpS#k_@7i?C0tC)geKO|o89V3M&s z{^|mAG>wlg*RO4PK?AOXs`gTNS}Cl&^Kl<9h({hKtd8{UquRKm+N!E>os$%HYF-Bm zpOGrrsEw|B?Y%Wl=0AR<-?isJL!Xf^+7OiOAbM^jZ_B*Bjlzg)zEJ&za$@)*ez|f8 z_4VaPZ6RQKWbuY#I62Y?<`_Ex%;opygIJGi9VMLxs+mI!ZV{cd(wCl62~$I)BKv4c z8E+lopnrpcE;!i4Z+k2viRETpbX%naEL9W@okS~lwy~x23)K75#dl>|bMEyk_NesK zg3fb|=HjEw{~ccujlf7c*Y)~=9RGy{BN*o*0L=!uCO6Z5puNk42QVf^))r~R&DuRk zhVswSp<4?xZ6U&310s5RK;Y1lD|QP+0ps{XAQdQI zJi4zNqECK;VyGctfPcgILI~TQiBVcjQ1#Fh z{jahF-^Jnt`byYwPw7X*69bBA+18q+JWKLjcnq~4X#Sq%mVf(OmH`pVZb)XwEHJ^ht0<$Pk|ZxYe% z2q0oJJMRSn4OllKkGA2@j(Q+tUiL1Ju`yRW-r)oUt(*v}kq zG>v#Rddo=Q2ZR4ARD!AC{ObgLF$BR3y_jc{q5yOqwtQmgm(Os4QmI59fwFw>XYiX8 zP`#YFDg!W@l&a*m(SY&bVCIQ!xf}@97PHLtEtE(WA zqROBi`B_`qXY?zn@#-;|w3`8aK{O}Z<~ss?E|oCBCk)iFYrE@Eug`wJZ}0Bd;X zwpA;Yk1!I7lV~A6sX?)WG$_pbE%^p*yL1`u{)3JS8RMod!9_83BmW9Mn|gt&rwE^t zVtU#Qc`gpN@waYLKGJ9AJYY{q#jUNN0zbx{dV2WEb5#Qq9#^LKk)b(JwMV{sXdy)5 zE^j(hl@Q(dZ=1`pab*Keiok@s=|blii1NcU%sWglGw)Fvw7WaU@}Hi4dK>YZ`@C0G z);S)r;6g|&h7HM2TgPO~Oi6`Lnl@-WOXlj8cNW?~S=+PcLfG@L@=wzJO1d|0Aubxl zfsnS`Nf8yt%(25tE-~5#SaP3y2=m>xC;}sv^&1( z*GEM_ue@%d+FNdV+p(q-M@Jt3YGgfVa!7af;Z5=ieKTEm#FKlp z7c;3~ikJ-9r1&s(JWzmhFeabmcg}WD?fEWpr$EZ>f^+|K9%O=&3nd(uvScxO zt|nO%S=UzKY7k7R&R0Mc0aW={lxg4F47-Oz*%rPcZO+0?r1Rk`ZADPpSje7I# zSz=f%xO&N&zPgOMO2AmO2cka{jA}-}5KAcgPfB$NwceWA@w!JFAS7+qVK*O#8&99|t^o_ft9Tha3t z-j?7_4+$%A0ysE$7{F>T}YPqu;kLm+y}o`<#b+c-x5H<1+J%ZC(HML&QAf_YO*#uMYUq_k70*C6urn(~oM ze`@L6=V|8zFyZ8uGFUNkSFSs5Ih-k#%0&LGU*1@8b*ubOYyvgcyKv_Fr;kGyPSCE7Njbb+=d4{=KeRd~L4B(!67!21=vlBo zN&#jy;G@XDD3#3f)3NlB(OW0%b&(I}577{-H5o$1W5n1mCKXCzp%tD#HwmPAH0^@@ zO$jEr^NHLqASCs~+DRZMNj8vX-AY~i5}^fEc8-otrr}>jgcTa?A<{E6=csr-pdNXM zQ>*JbOX=S=XS7L@n4v&xvp+*>836~!?8ZJ#nSM6_ez#_#8N*3tTIP;Etqeh^~%?A%Q3S-9>z+O5D|0bAl90Eef zNie?-V}fud9@xhUN2mDVmhtxE3@o#U38-M4$$@jD+XLLldSK+F$#C@=bcBq0yOFa#&1v*4-tW2Tt$=l#82KJ6fYnSk zx=m@6jaYhamUgsvn|=jUng4I+6C@E1O_V`Glo6T|YLdi19-AI45d{n#LtrVI39=nFEG{+zD?YZ?E>%VhrgqPNn}lzWC^3vP5eT|E+Kjt%~%P{U6c5lJ`BNqG|8V3rFcO0lF)z4yLg~h z5=sFCS^&qN*!oWCRq4ZvpqU9{}m7Vd2AgEI^)h4%7C#PDE^wGJz$-QfPWEGCbmQJX6Udc z2Y>iT~$$Qe%N0|jbq@PafU`83YfMt8f4cI7nT(u=!lyC@!s;PxxcODN$l2jf80m}8S!ODi)YG$t@$dteFHlnVY=N#HwJ`&haWP-Yae#kX;` z>MK`tilGFE8G0a^!SL9?y&%sdF%Vsy@e8qx=NMHfQh^0l_E(%$7vfYFzGAN-_I2;E z&wltJBGqkv0r!4)ErOk%ro)|XeX|e=Sg0=^Lr~AnX24W(yS6JvIysy&Wk?yl1JXSTK!IfaC~f+0A(w9XUm^LGdHqI0{=o zm5?1wl_nx$ItG72D{mZWi;M?hc&z;-jV3CnXxg6P_PAB%)&`&xY_pY)@&C621GVAC zrO$g==o1g(nna^g`o2-cW0chdz;PQReeCRlKS~@lcJvy`g_LnGtI9`?C};BJn)_)< zvJg~evqm`l?GRb*CZkOeQP-9jVk<+Wid&$j-7WTM2wTEAELT1VXKqnaM|7K6M@x8I zc_Z5H`*-kno7B&pe{)q{$3l^k6|eQvb_+BZ@_g%4wjbiv*lOmW`>$FCco1|@y>6y# z6WU=n)WK{>M}p>@zJ8v6^!KYG+6T}-H55Sqd&sKUU(cu?Cv%%UCVug3RdrOTXt;2F zpJv6xJ}^K&q2oJKjTV2n(cxfXLBvR>r*Vz;4X?O4X=fMk*wh!KZVLST_5zJ8c(JOo zKVt$^cqSxJWYDfC$^e@Jq!<%=#wZ@)H}wN>piu*~mxczkz?ds6S+kT8=AqsPLlb0Y z>}V2Kn=P2(QT+nP7tvN=&P(%cOZmc7Rp-!G--ow@vFt!v9RB>XHjDDx&l~wW3AG15bk_I~!a~+)_7RVI>S_e9eI``50x%lu z2=q!8Ri+h(dUOY=T~ob@pZv4Vr!?NB+QaDEN&Pp4%&ktTZ;!ht6%Zbdmy1fNotCo8 z88EsaElpFdLshfKZ5DL%3soy9-^`|b9A%!zn$81AWtEa2>LknvWr@BS5(V_3_;Avg zx#&6ieb)b*a2~d0U@xa^hFa(YEW(Ctkow^oi|C^es||q`o1XkFI|}R7Mgxs##*i9L z5{85~${NbJNKw**o7iKgB=Q0Uz|>`m^< z@zA(;nd)t~5KF&E5N0Cj{P?$nYqrOZ3fGOG%mPsOO0OQ8`paTSZ19_?s%xOKkc8>7 zDKatDA_~p}`BV}Hb!x4(Q+3z!@uXD?b%f{GjZwVImjKa`WC0~g7{@z1>Er=U=!7WF-!JyJV%YzV2|+o!OL!(b*oN9;+S+w>no`9*Hz7Z)`_v@zD4WOXaZ6hQi0m zh-CWaI!@0Y;Hsn+O*zZKQdmS7-&V(M1ejkeFOBpxAi$r@I9YBixtGq|Zxmk|_O=!zuXKoaPje+zZ~Z5S3J4C9M_iP2Juws z(U{oJ^qNQ~!M?5C$J22OcX(ZfsZG>*m8fUEZg5oYdo(=PyLQ)_l%M$=GT%I9nGoG2 zXwvDcm<$APjB4(qGtyitCHm}M4UJdWmLp>L{!g<&o3)Q%3jxI!!0wK30KHzZ%)d2K zxVv8oH*ZJ%+^@cF6ETl78dq*ep}3zL+$_&lQ8t#*!W(eNCl#g5&d;tQ{*7sDyp!7S ztYOyBZU^)Xn7Zu57^cP_gl88oG(xJR_^25XT0BDPzodTwS8uX6mG;7B#rTVBFJ(5^ z7X#wNCM37IutImtT3S?5M0CCE$>Zl;L=5?VSPI65xDh`aZbOY+Nr0x2XXmCTT%1k? z;Jbig|UEQ|eoG+KV;A*Kah0s^T<|Ey!#d;v|t$@LT64}LpvU;#U<9~}4fcSkb zdJCv(00|j8I0Y6#T)dONzGtJdr2>x+FbhHE({>-@+o{l58GN53u87w$1krRKvtUQ& z8jCknWW?K5kMbO%je%W^q}Q`1wo`NBk9&b;w?J=Hb*-rs!jvwZ?^l=ysflY^NRXmQ z&g3}N@L>u|7RU9AfBr%2miaI6cc%)|#s}XP zM&;U4%XnV_(MR)VvVywLuk{BIq zDY98~SQFhdIFdbqR4R~#`jcl-H)2ZoKdif(LR0`)EB(eglB7*3kNig_C7w8|Z{s)k zkI0B>0?`hj9CvL2_Qgte+EmS8&r4b~9Igsx}-TnYwMx z$IJOr<(FcST8tbUv3RAa0G?SWiBv~=%d-I!)Mw*~bq)A^vH!vOAmlswv*9#00B0}q zHl=$Rmf~}FiL;k$nUVf_%02z`IeqLWkIl~w(8+-U-dS&sjb|kMK z>`2|}wML=n8d?KM6g7g&<;dWRCW_OaxSN6xL~F{rUos65{jGFVg?WuPnzzjj;r=TG zEV~V-AuhBA1+DkXDs|5c8TnurR_Cc|YflL2k=BvkT`~#SklVGx{EJN)EPm?t5EQur zVpC9*9vU!mJ`z|Bqj&=G70q1OxlUfLy}g!pa9g9B5dRtGnC} zTic`dfks`;xgTY4S7!x+4CI((h>}_iM(P=Y;Sy`l#@rORqv!PHh8GmjOtrtMh{g7J z;e)_up2+i}!s8Y!z5b^hcAHkdMzuf?-M4qsY3iiz6RWTiiGtWdlE(p}dR=vHY6F@` zOa35cPygz1;L#=Bw=q7LD>;`u@Env?pmqx5p8iHtI=sS}au4N3P<6aR4Z$tm8*_dN z(D0mfku7LbJ<#l0L{_1Jw}@JH0#We6f#xg+1n<|lgFto`fguKr{R10@Ycs-_Pdx+& zbm-|cHcgPEy(f));!zFvO*HkEhhvfCivKO~fX0h=0ja6QW(e)}DQ(7hI3?`KbrPhR)IU-Hg@P+{ zJsQeb05sn&bs(`Q{VuRqA>9dq1Cfr>ZfG~$5><@ZAeRU@GQC(`I1t&I(#!8<=+@5= zcp|!JAi}7}+=J!6GzE%-m+R6_hS0p#2GMbW9(dor%2;q4@B^5aZzBv)y|mZ0EY)WO z#F-5d|1vog?C)zoLw~qXO_DJBpGz6`B(9zYK9VySelSs2ujK7Y?hc31?dVOaWANoX zg%IjtFc!EnqGF`v3k}IPQ7uu7cDZUT;b4x0_nHOqJOyM zVZ)IBLqz|5zzSW+F5h-{2T`c{Q$*8H1dsGmg@iIX=;a2}1oOZZN2FOkqP=BjcbJ{p zzd%E1q1`(g*-7qu@)5?0O<{a{gvT|XxS3cvjigU-0q?A3ue@M(t9BPMzOxR zM2IjQ2l+^jR2^T&RzVK7wM;+9aHxh$PtZ89#7 z3Va6hZi~8E;XA=m^KIJy4C6-*dp2l0b0WwrO>B2&eyFqzi~ukjrP^6I((j}|IieQZ zNsIR2az91>j?{pBgcCBm?uE<($kP;4)RZJZo|1n#$@K(ZE%ZJD2EGoq$2*U2^O2uy z-v~U<=6BhmD}TMB4RkE7;l-8gKQKIvB&E4^3sr-iaLE)9q3~}UibihNVji3#;cl;JY zev%UW?NUuoG@H&_3nRJ(kt9dO&*KLHFK7z)SH^9TI3YEo!$GxGe(C8tJ^5a%WXl`sMmL{Mmb#A0o5#?9KztVsujR3w>yn<3`i) zgHO`1hFKj9Jy`m$&84OaEJ*TINQtgMSTn*`)M|w;lY`?>1xx4yY>uzZ!+$AKj@JM# zmDfrY46){l&zyndzW{Jsz_ZS`Iwg0aF1=AnxJANMFS5XLgh2Dj)q{8KGaqIC^4%38gPsTdM!lzT0 zFfvC8Zm?Bg;-1QCd`zM;4rr%XtYtU}6a@CZ^zFwFSClp{!%)<>z&^N8GBq9+vA zMc}2 zona9-P)R!efRPInViWMHI}5p2Vr>Njt8Eui$Q_Xf4`#;aLxU*UE(in~S|52Er@DU| zPxCi|PKQDGklAof%B2t$`h&=k+{f@UK(Zp?i#|y^F~pN`WlC-EB@D_Y6wCI-H|$vs z#lol+mre%7`k=G=Wcx|#hJ4ZgEBHSd2z~0##GZc(K15l&ic=H#1MiVZ7N>FUVR}>g z1Uj3Q>#RSdUyWXwEC(=$QTzJ~#Xdydn1Z%G`JN^`@!t)vZSrv*E>!GWf@6bW!4wc1 z*`pj~?4|oXL?H?;?`kHmOy-$lB85)lN|Pm1m$Mwof`_@?t|8h3Bzir_l722jr#CF; z;(QoBh?)=1!N2Cfmnxs8_dDm!3B@fTli50MgPAGm!UXiyKGyy?a{zlxLGtKV35|(@ z*nUGrhHUis2W!-DjxVa2HC1*dsqB9NK{J4?^E}zKajMoC`Qv2h@pWbW{?;Xy4u;CqS?ytg9_xdhvIS5+kG_mPw74r=N z7P(T0{eI&u;3L<+M7(G9TdO+*Z&haH9-s#h@wp|$MLamh_KjEb&6n4MrZVJc2SinLRPQ^H&Z)PI|}R}abroG_pr%HWxOD=!$sM`Xx{|7!yf z!NWWN6mtep%uk>`1sZaJ;n0l7%RxYx_bKEjdZymX+c4niG{x)vv-iDeG@Gxi!EJP z_!VjFcY~bD3Ghm?s(C}&O7~@!*0HWaev@+U7W0ZNe*6|x4;NDe4!-u%xW}}879deU{02=UVcai8*n55GsVoWO7r7DxgY9G zxqqY0SM1DJ%mnUqjlSmPSAv|CJnN^P+h%40*x#fpIFao~U%?sv^rSrO;6W(2{8iPI zUZlkI&H|k|I~YnjXbgs5-V5tdZRH>p;SVsD+7~~BiB24X|6cZB@cU(t7s|Z6s?RGh zNQ$9v`unDRxH|*0jakrC6J3l}lK>-61O_tb?k5Zl_2sd)q&Kl}+E#;BbmEc}K9xYM z=gxhFwBCD^c`%kTabJVFMn$twQ36XK|G_m-q%<8*cqA#7QZ*Zz>Y$BISh2TDNG1P{ z*lF?Jt84D&S6|j{)DoS>2n8K&9GDxvV}^=w5zpC}b7gqS8|F8gRdUt3f`h7Ew$jUl zr)ZU}L4H=-=8p@W-mjYsU+-nT6>l~s->RQ-MtD~*U=K0c_0Hy=u+Ep4Usy3Z%Q*+; zS1LV8m0ot#ZQG{{z=(E_P637LVG#Sd#Z4ZTu$2ra}d>tX-47k zk6Ow<`qJ`)-W509Ae?Cs)kIDqQI__IN0xbhKi{;*99ylA$;43mtL8Ubs-csN7|tTf zJeEPFFNGu2QTfAu`D2|pqLOpRn6j19STcYpf&8EdwqX#C+P+c@rs2^V;goCrHZQLi zUXDZZi7g1<@;vFoPr+z+$y$4qQ&%x^Lr;Jgapo5zcZ`(T2W3iQRh)VBfXm-RikRE< zx6gaUu9r-{mrZ10s%|A9N%-Tt#7+qa6CPZJ$pM^N^Ce@FOv-8Cr{pmxDSdo<@~E1$ zI!TG5Q2%tL>U=ja7m8vMdf~s21+y7DZ`bk_l!)7?Qi0H!_ML{e80)j{wruSqL$}cP-ybp~g}3TN~vw zWZt3dfv>N-QZ&Aj9VNKFzS>3OxnVo{&nDCqXO#*prl-Z}@J5w(;VS!c3WABrj?aih z4PQ~(s4P^hjsq@8%5x&D5DwQZXGgFNsu2DW$hcw%6@%Bc5`i*Pad~}7Fr~d>UN~rk zR@3}fr6@aguI_I6&euoHyMf0yb(iu_;V~W~vmDE5+kx-aqat;Cl(9br1vRJYc`=;J z#OLGnyk0idO2|hPViZNCFa|3Dh)62FKMsYY4xX~(xmD3iWjxxna9KL-hAR>QjbJ&+ zEkMtN-}v4*bT&O(qsn&y=5(YDf<6adcJ}2`EUKb$4Sv3 z#Mt!|eim}42#A|N0dbQ+?g&aCkct-~atX!iQK0K1;krxlqkHqxPahpPD0pH2Z_tp3 zx<7d&wc(a&Uq5E}(B?A3S)n_SS=IF-6dYu8WLP3gF(`0=c>Q+NoY*TWR*VgCv;%xe z9o|JlbsXm2QOAcS4TLeXR&8p0G0?xvG*u4j*A~IR?{ojCVkGZ}`|vaHb46Be>?bL| z7;65dnSvf+ZIl~+wuoM*XSX1I-?OOIjxqz{cC%reHAPpPO|MpkkoAf?U4lyfV&5%x z`WFPDSE}rXL&=-{Ls_Y%v;MoZ#g@rilna=~;#=YB&uRvT@PDivB|L0N>vpT6D?q&LH>D1v zsoykhxQdrre~8yUUw3e-KE8hVk!2NB?&JH?qTTkBn?5`FD4o8Y-`HCR0W;*w+GEm* z)3HLJ*L)PT-bTmd8qqc_Mw=e(9L#+2^TJcH*_rPt#nO%3D=Z=ARzb%K;O4s6 zy}@q_0|)pI8ipQqM93WIOJZmx){sq~(NEsT{PN3wU_2v2TZ6JIejfsm{%S+P2POdk zK|_8M6g-v&iLZJUWpxle3wpef0f@2i2vqHKu_4Br}$0d}{%m!L&2My#SorOsvx${W8&IWYy zuviqF$Y?xa)Ma0c1HqIlSkc*Ei5Kei>j2Qo8$c^e?8>ia0MzofGDZAur|iVw1y&fb zc!@PGPQ|KDUh8pQk9;3fD$46?y*giu)v@02T`24pKDB>8Q305#&DqE3#(s>6AbhJa zK-ADN7^LS9)gC~2t(86Cyvjl=B{KAhe*zQZi-G<0cjt@+ALSK#1xkiIh(Cey?h{a+ zI%37b^YfXYW?*&^Yo84ReDA(u=-~Is0pr@fU(eTDhIrxww)v%376u zpDZ>i%vB>Vgg@FiGz{WZML6{BDoaL1gd>g8yC~s{mITF&9sW(&q&G247PELed*y~U z`^f1T@K3eTxmfd+9JQA_53<&+$FeP&A2Ejao6;@>ANU3s);Z6nPmRn_5gJTQN!1CA zP$wnW2v8{XW{o>?7T~10VH|sf6(7B;)r=t)p)vN*51}BDV$q%Xj(kbKSuF zwX@EQ@`-x}%@p*_?o&&GuNkA36=M{XzntVN))}6z+0L(gr11pdPXriOTQrZu&;=p5 zyVg;@v80x+O3Xy=gQTUCL)ejbdRVH%j$jR&ssks&i1gO6*kU2PB=%dbj$JZ@YsNQF z$(x|>m%fBa`wMdZ@qQF8<1g$Aa&HghE@U+6-)S@-X9ks8t%HLs11 zSl7^+LNj3IFduhZ+K(NUN9R)dP1~o9_FlvB+kHCR4l7}m3FZRN4*h=cb$HJ{9km`_ z*sf!&?2m^kdWP`vAL*`mt)n?za@qij5H@`LYR}&$W2PJV2qZW7m=OXAQ-}>~CAHBb zSj~Kx&5<_?Ds6!H= z`9h8FBM|lmR z7ae!bgo@jUL@-M)yuEL*$Q$96so~!MpX2;jKHA;0+cXK#@Yv*j-7(FhZ~3^F68zlT zn$vK-gtgWtKM054TJR;^XO_L!Yuzp{q-_3S7eo_mDKzj>*ft@?d`}GISGG@r^BcLZ z$DJ$d?mVhzyWX3PD|OJ=koY#=0vcoQd+=6_$jB|lmV+FonI7bhToerGa0tB=Cs&vg z4?pv$!OLYd*;tWO>C5!15~R>QR?hE$@sgUoCc)@D(?5A74Ud0y z^1gmzj_`QXb**?)s@pte(?5G9bw2(?mi%-Iz2>?{VN0Q}m-1q*TxMJOb#W+5{mV_c zcg^S70Oe5b0&`tO@fcy$afwR&P|9V+TK7zWAD8)(@ojV(iL6Kw5wxbxh@iAqhvYkL za6%U2B(~HI9=Q4D|D_&rgFF6%P^iB?#h~2iZrbM;QN^H$O2#O+t$4d1$YNz}uVvrt z+2!m;A1xfU&n#^=>eZRI`gpP*H^kT*cn+byB&-MdJUddbbFI}?8nr5`Rj=R?n;WAP zAD@QjZoMaXu3@=&WEpEvpx@{|QK6KYPHCdlHc<%;T;-bjn@^LQCp5u-dm1nLRK7+O z5b|GfZHX6aF{=x(3d60q0p>zsnO@7SnE0K$zgabC?aO7(P4rdor}9i{_QUpYXNXf3 z(+AHQY_5*R=JoE5p+iI}k_>heXZ5eJjetUmdb#k|W6GrpIYJXnt)UWy0$2UR@`~O} zW<3!q>4b`lf@Rws)azqJs@^}ou-1dCn#&(W*UA~ds0z7R78B=uN(<)&Knu9eypwkR zr%n4xn$1_Q6O4)M2ZvH0nNMFD^2OyjZmO^9D*?Pf5at0`bNmpuMF1~SyLz{|%)>eM zX{Dg|wj`<&O+@RMMAkjts;iPEg@gVYVO&)-LeTA zo2N2;;YMg2bapD&t2o=y>$vrG-F(#1mpF$TjZ|m2?uW2^U?1!5Qq3prSijvRiCU-Y zwtXhGHP1ED8oADFMmp!mc^2s_%3+asKSo~C$?8AxUVsQ6Br<4`lYK1VVJo480_BQG zY*Vy=qwjACzO4~F^SHtD?hG`Ifk0#=$q8PV(?w!l{hfut!64NY7&FuQrxt1wBU3ph z&${ zInxu*irbs>TD8&1*I`Fks93uAY&E9ScILP7i-i92?B#7HV=L76eymaZg`PtC!lhi8 zC&~)1p@k+pMEiFMWsWG@CDBTa;+zG4)_PN%%QIu*0nqE)6B?k6N^hwY&E6-f=IWdI z^WrQmUd&Akpl)hiOXsqVt8a31*QFp$$DIcV#ug*nDi2>y)2PcP?ckDUqBn%$wz~5w zt~P@2%9aa5w=B7;b@<&arTD$(#cbws1*+zbD3$MaKv^H&o{+-0ryW1D-fqB-z8a!G zeiQbr4R$jp;83!_UNOOQPEd# z(2qta@R0LxIz-y+GF6}W5tph9Q~7BDc&ri(@GnT0s3#^g`*enO`-yGRDy*2=5K&Qd zc0t6S-j1y#jIDoR?G6F8qGu*GeoKtHL)ma2kuN`V{{hU7?CfoIeX`m5$}z*8ryQQp zz*8sHO7o>hIka}TN4Fz{yXyI3t-W2lSn2!CgXRMx$<>i*4RVBf$1w`)smfieUKv73 z-lH-^s%^Vg!(*e~&wNwm6WxahieyjT=f;gl7R%w%9bLwzF08=7cWZo!83@Awj)91& zlQ7H?QQ&7%dI)Hkm1<^@vZ64-L8m$LTb>+!1{&D>8^Y1@cWnmLF@4LjaL=d17|qcv zT)R})iIhSQq0$Igz_+28$mF4H{`D!#PwO&sk)c(GM(op*!g`sKYCgMYBPJZ}3rUS#t4 ztp(IwR%ZP&1^}n{4SZOASAzsb9uN;b(3|MhwG_ef+SR4wtd?S3jXp+P`)n-4v(rbY z<|w_mnOuBtWn2@hx3p|ImTCMi!L^lX1WUDnfozFl|As25&5#`m7olAGHVaC-)iI>C zL@H|_TWLex@Q5>Gt?*uOitB`M(za6zsAqnWo!#3$V=n*x^b~GvX>90VCubN~tNM0% zE9Q*+^^K_CW~Eqh<#d+Rb3wH#^h6(B`hoPx(9<{M`ef>^#xbXXuV}5LXghi>&G|oO z+^0IjFdU&HR%mC6yC;SP>{;m6anJ%6jgUq{2xgKoQ7`xTaIth%;QXyMTtHL+aC!XB z93?-y_vsmc3(i}(iiNS^^gXJ`B2MRMe{uS45 zJpmeABXcFt{?1>K@Z#Ux38(WUF)2gvMMRnu4^t=IWW>yoX@iZbcar@4)Y z+^Ejwqt=OQRkN4t=a_@~yRo^F4xAtK4cLzA`=^&R)(Gr{KLaffC)cz=O+z2%e$LCL zuBAEtmzN!Imx*LkTV(mqR7zcF%9qi+ZvOIf-)hVz;FialQ8NsA_D#DO)8% zG^abg`DVaQ{=sH240o=Ds*zjR;XT`F!4q~6t8LB-*u4}9F~nq~a}wKaQ4@ZY(9}Es z3OCIr@yVi{q+7+xnLA`R_q|z2(uhFVyjek`IO+71mXdoK!Wjz|2a;BCvt?+#(@QWE zFk?zl#db3Gst4EqwmG_&Rh(gep!(!N!xlkj`*1t)BF^ zi-cEE0d9dvd>kXXd3CPj(>dCSAb79)EPIGHV9o8n6bcEv&Rwil6f=AruuT=@J_Ma6 zi5@CAa>=9gHtdE|jD@g_dwgWb_BR``2!evJ(vx6NO%cH?qici|o_lm_OY6cmE7?x4 z2S>vvWZQ+&q3dkt6V1@VJu^}i6ynZ2>O+^uv3@+c^5{ISRJ-wcX~x#?m?|&tJZ^hs z(d7^PN%u)Xap&A{>EKgi42v9&H!^6+8AuAeuvs7c??h#g(tx@_1c*d4zpM26gt_3W zjT^2gZRCnyzkTHZ)|bc6v7wn1g6N^8ywE|IHGeboaA1%=I-Vn;dFFzyH1%pdOt3I5 z{>p18dyCK0AewGm;E2I7DRkR;psM{V3ZLw*KC#MHv15cM_9kCm zc+JZ$lj&5sqV9xZGX>8-3l&~LAle5mZIBlQH)BG4Z(9xd4R;|X_!9|&V?V}NR7*tR z^`y>Oq?UCS$sR5Q?}s190VVkVsho+$847@hu#(f@i<aKB zL(tz#&TveaTCj}YF_EY8fl$&ya5Zqr0xo#IY2u*^Vv>F_#XS}T7moOgxS;8Wk0I#nY-ohJ=J2oM zAs-@y#|k)x#fcwEZ}!8OZ6f^^zlB9V|3O5M7$P7Z?1nEEh(g7$lp2a6X&tRaKL~^N z36E=lKw|#FuQB|<6T%LP4}fn3l7w>>xo8LXAkjgTHIk5-j+oT;@l$Hm)sKqMwDods}8VGE}tpuxm1%6q=RKFa{|#D(Fva9*zXU#?(fHBRR*) z!T-!8E1jvIz)P;9{2WL7YSFHBJdfkakQ+O45`9OLwCefm=vQUdYDMd}@W$)x2-S9d z+8b}+BaG5l!>Y_THlcg>m+Pu*iVx2Q?kHMsB^fgFCCl7}#xaRJO!P`{o0 zXVk8*#$l4fv4muBg#9e)-P;VXn%%+1?z#|$yJpzs)#5-hQh(%t1&AyS}q_ zy*sj67=7`dTs#d9C(u5-+EzU@vw3?ptT`I})=7(fV^r4J@scP2*#$~=Q(qJUJON7f zuBL(?P!fsADTM=aSyoYJeu6|qFqpX$F_ZTa!d+6%?FRBf8U!H!DZ@}g!a|Omhk%l) zE`SMc9;Y7*Zl-U?RNpf|BFayh;odlFtsi-`>ds2L^DLAU1PrU^hJaDaIf>(7tRq6LgT7Ses2p8fQ@Nk52Is1&QDLt$@C&}No)3nGuUV%9tg&YDEieV2B+5l z<2ww??CFh(4bvRndJ$0Ij?nyMCV`CTiL^%R;Xy0z$JXVC2Hf&&~Wgy0U{Q3Az z_z076vl2MG=S!3D@&=}`EQ6wcH(o|CEm`8nM`pd7oafJVzL!PFt76ax2F=+gFsz>w ze-jy1~{IRbj%m|Bp zKSQjD0lYIMw1i%%Qq6=aso4pd`J(%{nlT#fOjv<0sCDC&BADQZV5} z_%12<{Z0l!zq-P5K}4}1i7$h(X{Cp^xjt)ln@ptVM{7~_Fr>JEQ}#IhYX^x#I2kwz zbH$b&0mmS-#^JY@J(JM#UsF26*yU(#cAPQY2x*huD;2{k;GI#>sl-r2yp^%9T<6SY z{37*+*Ua8WzF_mb*`I&P;wyii=RS&mpE`=u<%GCn#_z-Cch(gaz{68e;`D zfMw{xG!QZHb00V&9Od|Y_|?EZV?MH2urHs|2B*_p1oE^fh5;P%Z_)z{jtRgI7Jy#> zqTQTmBZ7LeFX`yp?J$>XQTQ+WCQfO$>Xt^`XYD7As?cAgB+?yZaayL&S9zO4KrEGk+)g5PnEf3fe^s#JMaH1b5FMyJUVbSn4piPEv2yKBF)L=#aP zNh?!%`+mAb(Jf}@E%QrLwA_TBo`EykDQWd{vxjpzg{m}(U}`rd;Z3|N7LLg5SjFy3Tt2CDlX$%kwX|T9cp-`169aEW91&LqiV#qQ&*J7>iJ0+} zXvQD7BZ+W90jKgC1pSSbhUP$m=v#<-#OIv-%d1+H?zToQV~iiD1VX8wCVfI>C$U>9 zHdg=(%s!mEG*cNzEoSP;j0Z5S?m>E8p3{k)_+YebYe)g`yHB=kJO`qOk)ban4cJ?n z6^n+>8$35T1cF{&9|&&x?Y!&;?hJm<_(UOKZbUG2U?AP=>3x+&oh|LSVg^{hvs!F) znfvCkm9LVQV?JOKK^MG#RHNXYq3bRmXWLUn7o#t<{B+B^srI*|9^VYlhOW?o_~SPr zIKX*ESo<0Z_#TFOhVtIbtlhf4{jmK2=}6OUPo2MyfPI&8cy_4VwSzfPpcTb?3VZNh zrQ06%KooN#0+NG1Avjhxwk*3-(a4WBsewjYQ-Jd*-T{Bs!Q#NUAJ^8Uj_gbn0@ zqOWC_0M&@B{H_1y$(v zdbug!B5HYsJ44QO75DyHtheEkH$VWmqIcu)Hce0IL=&eA*L9w{Q?SfckN4|OJJ$WZ z9qSIf#~g_;b1dMi)pU+B9PnLYMT`v_ui6v8!0T`Lkxh{6^#e|kudEV=$9FEO>$hG9 z?S;++GpF*7zqQ$*AB}%%oI1E}IP%fT&7^LcUa*!2{iRcEyAmv)Dq(CeMY zOh|i*z)(PCZvNzBT+YrsxsTg8O5Q5E2d(L47TX4=y{y3mlb!@96tAV1gzPp2qs~?&5H^8JDmb=UvBM|y8YR)O%R(rL1J5) zx)F+fXE6m~tFYPAz{yjCW^A318A|9QfW?kw;Cp`a5tBitKiSWaRJw~JiMAD5F}8@f zEUlz)a{KH2gV1vTE8`tbwlQG-EG`H$A@DB^fs6#;2iQp=N?Yh4F;9mf2`Z_cB|2lC zrtv9DLR~-}d^X4v`&x5_KIkqLp>v*Q}mG3+lA(FAs3 z7jT>+07l}<&t6x7pcuJ6Cm|A3^JCu3Y&hMy{1|>Y@O2sRj-x*sS9e72dg@8>oh^$)ad*3W z=slbt@B`*~lF4L}O!6jQAC$2?R9H>eS^XBp@PlOayb^M9B$r8eVlygb2S#_h6ut@6 zi<2L?gN0&kr|^du+JLL@^ujhj8XxJT92mrbxdjgRH=ax7d!!VHeNaok^mE{MZG^Ot z_T}zZeAYV3!iC*hH2fAj!+G^OW$hbtT%z>=3({b~*QfKKA`QrQ&X@NutAe(0N!(Fn3}6<7^teIVUQr?hU__PvHl(Z@xI=>BdntVy6X)U+^rB|GsdJ1G{?ggF;!M zNx5Xy#jQ$dv7#eb9h0x4&iw0Ik|YwS6);d(>N{5`{!OGPyA$|_o}hJ!L4@3m;&OIu z>fRjBE4~>jhQd%_pL`&}yD}zO0Gtx0;po)*$IEg-nyC?`{gz5NWYkCx0)51&kTJmek3aPc_>`~7kh%z(QC_EEz+d~yv|p5PJS0S5PUr;$o%5}8)rQ=!=*HD#8fDmCw-jM9%)YgxMAI+$eR z0%Dunm5W!(w;YEiIUrwBgb|WC;4q4^68%?Mii`jR<6j2RtROmk)`PExwQ))|kf(b6 z+4rBCMti{{yOsZ3sL+qQO&#Odide>Wt@1lFIHhfZKOffUobzvXrj+36ReNY#v$%u& z{zt1ls5LC1|A>1gsldLbSwVIAO6iITU+0tjB)IpoY0b}~0ouI- zZjy6m-M9{HkN&70lzzz~ed7QY0+I-aVt0kcU(HAz8RavR&y$KOJbh#83g}CoXpso~ zCb~-^{|eip@~@@w4{Yv+a|%Z4!a4nLZG?eWejKFf6pY6BMP3v4z38+;91i(=_rT^C zdFA`Ftso~5eGZ0j3Wv?$L5}$$Y|T{o+o0$!X0jY?3nT39Nf(98DhLfav?tJ0>_o{& zt0et*@muJsn^{vqzAYAFu$y2jQm5CIS(|0+m;)V}-<}fTA{BHYYDpCr4pQb@v1eQK z&mXYl325QWQfEbvtG}k{51BfuG?rVY2hu2HM#^t^(oB&ev6%h$5I}-YH2N$y1bGP5 zHD9lN>iX&f<*hW!-kc(hLu-#H+#4$5@812;0z@)hpBZkuznhXQZGLQ#BN=#aAkbFQ zq$0?bYmic4OEaS+$z*2Xoh5Ue)U-#{#ZNZF@2p7f7;3a3z4KEZn$ z>nqb?SDOPkYi@bz0#@~Wt9RC`(L>wo3jM(jCNdlO@v_sO6d|?Jci@$aMi>N_J|VnY z)`ht8>(#R#CWL0eOEqL-p=c6zGEChO3j`=i{A?qDY4m8Y8;uN3ru0)H`c8e_=@Qt=&h9B7-#vr>0BJj*QjDZp~pC1 zbWgm~r9Q4BPd`P_#mo|^dzu6Eio02(=bHq^%EHSL!$x#XLMmU?p6Y@uXrX6-v>&ky*cc51wWRD?a8z5vIX}Amw zx&|Is(=CL$yL(=z7eBS_evC6&&$l?@Z^lw+%q`^A&uTEZG$`w^XpDQe%bM%s;|0aV(Z~KRkMttq9FXAe2Jo(}dEd0$FOK~g|Jofx5CT{C-+ zwJW(*N0qpf%hIn!M?mSmIc$b3;Zi}cQ4}AS&8**o3B><`aB&SWCZroQh5f^}rr%9j z+-vHFX&aD@SCb=S`SdA~oz(Tipi;hMxq1Vk!%}}^h=1Qr|N6>#HTw4g^Pjf0u9$No z?!G{`y5)T%|Kin$otuXqCXkWT^1A52LD$NyVs3BBfOI@F=s-~N$9H-aO@rA%%ccZ zR|hX18ME&ZQP2yqEoPQ;puACF`Y&$CqSEfvga;detBwX)rTN1|mb_2)Z>yKz&zC0! zCxX<w|i{F<4^20qle2yuC zJN%)xFU{U@Dc3ZEiUcfSSZ8SyqcXwHzS=&^S;uzDERyB9XzdLBLmj((I@K>b5H&reYc z%I`u@o=VtF5uU4|Bdn$=#sf?=F6duzY`)1#cI&bp@40umA67RxPYOg?eXY`AO^Q3A&Y?IX|Z~K(!(^tV9;}(?+kxXjx|2zjdXT^ zeJXgs!ZCTX9C1CwzE1kf4Pk_SZd~i(>kj>9W=aV#e*iyvE4D4^6DpP z^~-$H*ix;srSrpJvVm^6Few~A-2<+M9;~Cm_@`-~dRM3Qhi`Moz6Rwja!m?j<-muI zKb)REqZ$j>idvc$r^}uft9P|a>1je7!8fe#&toR#$#|Z?4_MkeU|< zqa)~baB!ymSJB(!9$KHY9th8cChXiygzGGI7HEjA-tVO_r9o@X%CY{EYD3^R{8V`J zoFhRaP2G}X9Z7k^VL%M0rB01xV+O9}KDFU=9uUR7jh5b3Re`-c<9SVkV#2q5^Q&vngMV z50zfwcv?Qz+HagztIm=1>J`s5>hf2-uDktq^t5(C;u&*7Ob6u*{BK!pkIr4QnhnJhyqT?us~#_8Ds#B*FFYt(H?>pw zfGtiuHW09m7yJqInfFH3(9iUC_Q}5}=P#Yo1`%=XiNd#e^syf0qN4NP!`sX2K43jH znDGy=cU(?Y)9>>@t3;i@+-iw1=*g6i=d%)+fyK7GqD^?d+ACpzENbKcR3gV z5m5Zn55$0d6Vv~$*dDAYb3tlZWUHbo*MZAbH@d0O(4P27xP)Nd_t7FF+|%K2L%dQuPoQoZpx29ma_8Yy!=?y*U6(`h%IH6;t9LP7k zpG(`f#A2?JwKtjm`-|TPKQh54-`s8}f@q`WI4$hR-3xEe096O6z7Z6B{{}=wf@AQp zdXkPBDc6~$w!BIs4@sM3m4GM2Ve}T)TTBDo(->&sGv-a}%h6VznFDmf)o_cqz6KCb zniI*9u?@MtkEj$`yIwoZZ&<9GDcY>mbnADS0~Vw5B>!}Jeof}W(E->|M;0j2$j!ZD zr*J9E5Wcle9W@(qSC{&QuAPR96caI@eNEdVPx9{*KCS>kUQZHJ15fL=RM+(ilI{AN zzpUpt3G4FK2i=nG^=kZqiEV%^*4+n$^b^^Tse zf~r7S-Z#US93$DJknd4^)tYStl2W-%<8@cM!5==`4i^FVLpIdkW^kYABB@c`pklniZ7&PSjb)I&`rN?w%>Wq;Cyi@!EN7e9l{3jK^-Tcj#ivbhd^%@b}xS{%A z7gj!ndfG%Xf8Kle0f99iK)|YJE{$We%gHXMj+N|dE;eqr>qpc5I%2cLDa+>v{66Xc zy>E>^`bR0z8gf-!Hi1E9SGO&{-hhp`KNZR32%T#~FOyaxczEbJ%%C>`Z?-?VTv?)g zFyI(hW4qUbs)3*K-C$l4FL#80e2x*KIq|QDS&maMI}Q4#=(pNU1Lz4k>x*Ignh~|S z6X=IQoiW;X6j`XS{{;y(=1})$jc|{}Lj#&lYX9Fn-m z9Cx$giqYl8>&j&}#14JDKY5CHWaqn`ORMGf28CtX26Jr-#bhDKYN3WFu1!aF+sZ*- zbiN>&;;-bl(`8%y(+2X~&Glk>k9K-Jux2^8&}Xw z&)MZA8|r?X&~W(UZ-Rxt_?T||g<+Q36y*VZ5bf?0jQU1RI^TESp$PHWa{E2ejUR%Z zD7Q{g`!5QqpsRenn%*5#eLUW*>f1iryqNez@!sZWZbaWh^{VTE z^>)4a`diWrOY2^^wib zIFk*(GxtavNRsr$zV8fs z8d8;=%*$U~M8?!wg1+f??^fdWAkYqSJmLGZr=;Vy=3KfuzSGR!^{j6BQ;^zk5z*k< zxys<=)Lm-{N{5lh^dC8Z*kA;I5&*fbA;}lOZg1i7S^oG%;dy+7k2f2sAvdis>rnsy z`kq@Z;t)iPAUIk~SZ#dcpqRBsY94Mm`pY ze+loI95VI))>HiCrclAVorhCi49kglrIVG|a?Gilb1J>1#ke1IOzh zu9>g2mc7C+NSk!DwAbFJG4N5&*n)}-0P1#Oky@6Po3F3c!N!PH5OdT|EQfjV+Ck`Kmd$fMcM=P~q zCNvRBLG6BCwjUMXHmZB*@_K&_GBQ&{+qlWg@ZTG0icYt<>TBP7$_qX`@*$qzi#*wI zEvqW`RZDp6Z2&@v1zpRxF<9kA>fi6BwfHg~7CiAjn9L3fuG_b1?ji(X1WxdrE-6Hj zX0Gx)JIEl!knPW?W1DdNbf?so8QkV+masVD$edrL-G41|D8|#uxd+g`#?OASRmhaE z?hwZLrPR#H@Ih3A6{Vis9SnEjUaH>Q2Xx=so(fdpqd*YptixN(|CP?L$vjhkwVq<9 zt1lL#0bOQrw}V#ZN&1Y48(7fNJ^j7%KFDK%xX1P7w35j>U2onQK~75!;8#{kI$DLS znJsxzO!tTH_}aJ8cXf+)xQFc#szZxO`)zwff%k9e{y}pDcY5QS zB}$rw4DLXm?}6S|k(Y`v)gHQV+kJ8_soDa~Y=@c}`nJZaawQ8;e)h4iBX>&2PVL5w zw}BBg z7N0eG&fnh(NId1rBLb4?un$g*j(AmL>WIlz&b0VtQz9EdX4oS!5VGdwCguCHr$t42=#!J#~lHx>+xypJgFrU7leA`zbWU@1*TuYEDeC$5G<@;u%JiI5fw;NrHWS6f}hY17$ zPRNJ2!kWOnShj&qSUBbmnm~y5h6gyP&Gg);LBpyzSPpfHFWmKz>t537UBq#>CuWd# z8&tSKhOOjm>Tl2T9bTdzRgAyo;X=7sy2v%GSvuTo0HT&9I9ouVe|Q-QXu+FnX3$<9 z@;h-y#(61jTj!8iM`{okn&k_m#TAa6ytS}my?PbN<_z#b&;3n}C@llbalM_YJK`Et z`HB(Z3x8H{^zaz^j&g`GrTc-1pX&Zmp&?S}4<}uz+1}k-;Z?X#g5L*7i)zQk?s{F9 z3^+h%uD8{|rR<^@-Ws|Y;%2m#FY-; zs+@!@zD3PQ^JB1$?t3^PN6o(2*BdwgS)4}kz2YIJlcT>^WW|86H9vd&2-H?l>;wGb zI$8)e_iKuqr2eHbyL*_&)pMDksv8t=n|1Z;eYECPo5z)s!|}2VdkfgF*;hNvH|;36 z%6YWCF*!)Fqf?sv1|@{=p_>5dZ`Q5Skh;24+E9c%fD$ttl{3X)kBTP{r7!Zgg&ia! zbT5}gyEJ=*q52QW=xF8-hubI)Q!*ro&gAKCJLB+!baD|IoB>fK8MVt!QM%21QW1xP zg^n@1hD&65SjhAl6C?{Hg5A=_?QyvwYZaCHaIR77;71{w z?go3iUKd)tA3;b$%g3=t!Mfe~8AqKdP$<=zdIEI&(G`+{GjVQWM-xw>7Fg zw47eQ{pmKhq&^o7eV*mUThv}#n_kVFeV%KSSgGOilt<=-ihjH2^$AUSz@<>}BDL*L zBYJ4#Zfby3qoTWgAs8m%%d}g+QBNB6UkH$`VSIHbwUJ2dmw??+SWFak@tStlm~B7| z^5{o{Yl#6J3MxJsO~ZJMe^FZWwy4tGYsu6Ukb7>l{+CSwTa3-JCC{E5TeIZ^GqUgL z=B>qk#37M_SO$J1W4D_w9aD+IPqBOsG;W@zpT0nQj>V+V@cuC@qN89C<@o5+yp{1g zi(J@HG4@_BEmeWrDe!N{DB>?9+*B+8q9V&?-iT>dHOm%eBzqhy(^=Fjk+_IL=?89v zGVD~W|4=-bu!_}9G<4Ext} zaey%Au#@48$LP>D;j;Tyq7l_tu=KI5tgGSiM4#F4e$YUlGwVE=F_Xlvp~$1#d6SpY zMYzs$jV0QB**aa3o~1~-?L9w(;}-T`&=F6n3V@|Z6C*QkL*~t$Z_gs7jb`Sj(Op2X z7IvtSZleTw#ysg~mZJZvD4*dojYZ6Wd;7{eD*IriE3!6U277dFRb#<qnv3eas0v_@C=44D`5@LG=!-kNBT)kzm{hxLwXCiRLR-& zU`$(a$rNv`#3x%|FdOkbrQWi7oU6S7^Ls}}Mv<&W= zwthz^fd_Lbc+H?cRcnquLdy+0>bey~Rv?=jmeSkln!_-|)hNWj^D{J~5OMJ_0f^$& zBVWj)vci*JaOb@f}HBz+6_jc6_v3(L-)un$uWXwf8&1y;E0kYd-wOtY4LEa8W?) z3Bf^|`-e2IFzU%n<}UYP*d+dA%2Y3cNLmg8yij`MHsu_^*(FtU{L589*f8 z>XFm$uh+tYDPsX&rxI~~5L&&D{$)cN8RfKM{|o&kQ{U{>iH-}0=^73!;qX*BEF7YA z!`du%zB#n>RZ13M+LjwZID9SBB&Kw%!BoGTQJHc06^iT-q;j^A-|~kU%v0ZaS1!5b zs$}vz#(FieD9cgkIsOoc4i~0c;8(y1;2FFBE{&C?U=UqH^$qXx!X?9MeLI-YX^u0M z+l2Dvf`%8NJVhf;`?bdv4VKdKE2RAJN(V@}-$rnC&<#IsintCtlwzr`|8dDVyJZHm zFPDyLRq{$|Ft5DzX`D^5v7a^A_!e_G>CAMu*DRuGuPwXK3*5fyH`ie8tqs zPaou4P6qs}c-Z$(0(fMpKcd6sO8ItniE0OA5yEdjRsBKFnNSj-2%B@FE4f=`mr&>% z&v}{T4)GLAn*R>LI(!X(Soon4<+nmXPsZo>YPiiA^iom%RhDO7wfjC7Izo1{S4syh zJ`dpUO9}*g4H@qlV~#W$_9@6DFLHQi2)g$oc++u2-6cPBGJZM!8b4AF_eJA-dwHaG zZSIW4fevQzstb0tdVPQ;3PCU1j||At7ux1%2<9~O<#NAdRXMHHO95vq40A1r{`@R$ghmGUCo3a(C~omGeG1gZTkDV`&N_l1hhr(@KNo^>a_Ak{HV&Jw$u_9Ti5W zzF%O?PWzVjFQN?xNmk1%7p&$s@IW-EkAfSiqam)MX z;IHaj?mT=PTFTIRf0xvrV&BFJ2;TySO1Vx8?J<_PNI2ZhBrLD=EL8jnf#nU?S6bfP z&o-}V17Zec6tuE>5637h9NIW(cg!LLD6E=fgwhnX7jH)1i~C|i1_YQLN-FV33(m2) z^+(uEAh5Yn4YGMy21-k$hR`UNrU6w;F(ndMnY6R7eU}iIJu9+H<_Ueso&GOCi5yc5 zpW;Yu<}g8sZI}oRtZMn5-JrunI#9b&+}*r%G+5iAYR;A`f>%jA|3_{gJ~pzQ%%M)7 zso))7XXpg1Vn530)x4_&2?j0dgA@qc+$cRofp_8xz%kyLb2sVfnyOQdDK>^;9lByNM)KJrk9dSI?@PvCBRm z={<3!YWIB?>jKa^7P&f@1SYZJUDR8z_?&-K%(e60*7uslbFD-uYp1TVIA4gu2hu@6 ziZf{;HE3=WD7bEgJs^*^a>mc-JhUG&BRG~SAHh=QBor=YQ|S${lijg`J%6JJKqeZ% zoBcMbe3z`BiqI8L#VuozT~#Rd)gWn7$k_g6LHkj^S6HUVZ(G&95{WFwf2c`N*h8>f zk)ppL{ks6!74vQ-u?g(Vk^qO1HLe)^xou4p6~KQRT3V|M!jJjv(N+ z5!g$rOK2t1e|;y5P5o{+YOqbHaeoCa?NATR0lwh}Ij3X?)hCvGNXbcgAc}+rM2`n! zBsI7t1cR8M>lQTR$uBca|2~{D`Hs>;MkS2vYh5}*@RA<}V$Z+52&V?D$IB!BEVT?n ze$z>L<9>4@M%DKqk;=M7uJd`TQi9DUK_ch;BQ>E`_@kw&tEFStnnjre(#kPpE1RuQ zWgU*G4IQnt$Bgn|o@KY}GT5x@dxWgbEgXRC1g>FL(lvmR>_ zyN;HdT%RBx9{C5oz>!xnZ!Auw73I$0bN5RX$g*bbS|U=>6bH>nC}gZKOK;IvlQZo~ z1)n+*`0rlX*8C@s?fWg2)s!WvBTT5?ypo~H?zdX<=qPb8BpJ%q3UbTzI6ZJZna(la zxLrBvA0u^0kN$1X+4jRz4%DzTSL$#G=}5dh1NzNx7eW^{7Z)m=R|T+-ym~fI6|5sT zhUtvtmX)mv8PpEQh34OeW!L+ScdKWrM^^z*SuO3|MVe|Tjv%h>0*Gy>y| z8?W;wDoiZ+S6cT+dq3gMG`-#C?a_LU?|AWgw4g)kV30?VP13|a8rb8?;NDT1@>k51 za{<^o6smNc->!wgSx$(gp@lz5Om&MKsBfnu4r5s*)YV8;u86mKb}{Z5+=d`_xu zq|PF0`z9Qqpg?X@x+e{pQpv*W2Vs)26$aLFF`}eI20kx@shUereB3KBhFs|IRNcV;cd>Glrv!rH zMX^gxh^0))28*h>1oVnHtT+e;#D23lkY<{zx_rnjX>ro*SSMY-~j13f&@ zW$WvmV3tMW?Rg0Ze)nVxZSDr?NWQQ&Tm117wxxl@Z!$y5XV>2zY52}ktWzi!?ct(% zZ-Nutn&r7BtEKgL(;_H5!n<{UIq2Of3s6zYMy4MPQ}f3xgA)1p_YE$A5|L9IU0t^y zg~_#5^ulOfuYV5Y+9*NvVj@uX@!}ZWtGek;PTo+yy9oB(52ZJ3^4M=k-iI8;;Mbo1 zzWnqNY9wM10qwrBE>-A^xd?qGa>ui`;!YzAVB0u;6HJIBrlBOOUUyp*oxY?~=l&?p zWjJ&>I=v5(uajI>CI@Fxz5Lh!rNyvUF63-+nyKc zV0(Tv7x#IRX^_{i&ycjLPT=N{jhW(%N!|2ZO3*2{aVr|p);7hJ2X=oj`ehl*@C&^S z5cDvF-ez7YVH6?I(ax`gww~3c%Df}iw((SLE@09C&HzC+x#H08#u;DeJ-C0ybuR0o zjs{`!%->#5cl**{NNC337s?*kz%A0!Z6@^@iPwe8DcL!2#4~};M`c(o02wi`7s|S9 zMxBv^)Xs=Rz3rG)+cN&}i5iyk-X2aazbPC>s7%7T4cxD4d%?a1{M+PO1TTHJY+dJ+Py3CF4G&6d$NPLr z2qC~jeFHV~8moE6<^6Wjx^0~{pT#CD2bF`6ERR3G5}%XM^Jy6o@3!8@_ud!97qG_! za;*l|<;A{>giWjAm#0#v_MIqwl5nvdV}4^?i28D+?_mo8tt2XvYA)YyO3JlWwmNpr zKio#jr{&O>-8z`%k3NPz-nqj&y48Z(5)C#^$8E?y+PJM>MtkdBWx4mbHIQVY=W}Ix z{w85X$--oRj@%(lnROUc<`e;`KZ5lQhN&4BImRs>iPRgdy5sZE)~W3SX=~9J#G+DP zk|NFC{;9!@V!w(@nVfl)LEneNYZHe{nAtW@>%iL}w=1x~4&LYURxR79NHAnX6g1&x z+3Gt!aL{R^Tb0HiakuvT-^`l}f84{2I3ZZgpHLQ>XwMfP-{0s5MvpZGblDHb)a#03 zEf8&7$PBW&l<%)R>Wg&_`wWQ=3TIyZ>nH7r#a9-0L6$FrhO@XQPhl=t*1FdWdt_{jX<`}@m4}bAw7{^J}vQ< zR)x0UxXwY|Qh+=iyO$`AN-AWL5Cgf2hSOgAXNT2(D!wwW&S>C#HtoMk4yhvuu0J#KW;AMd70 znHUR>L3>kV8x^PR$2RcOy-o@!AG(b&dcVtd5qlnP`3d;d9Tj7&!i`T0I^M|#E zy`{FL9en5f^w3e0kkLdU+h34K%F{TiIvC#w1?h{zHJZ|{_QlVN5Gch`4<$-7iw#ScUG!1-~}RFQs%XDp^w`rQQ9`zu(uW+)L`)^7NZ#gdeQq)Ku9A zhC& z^={-{!T5U;ovI94#`?vb0Dxp#swb72)nN|sEH;146Ne-;&!7~3r2J0*;c>ReO-McE z&|+29KoxZCo6OGoJi}pcoJh=!B4kJuhT&`m!1LPlr}oaCxEPN`b4~~VIfLB#3!=9X z-Iy3^(hDaG-cU&pPKJt0i@&{BzOSzLSqxtA@g*@2i9jEX$^^|$eG$u2QF^k1G{MiU zie72&-%Ta!aeJ>u&L}>hk9=pflKg>@v5>|ADc+IL=!8bGvQaH$${LzFg3Wbl2~h6o zl@m;b40&Qc&(5+*=l8{!+6#@~7)SkQ7)oHHAcjFwQcZ&Ag5Q3hxJW;Z3N?vLJIT|o zzw4ANa!IyGw7MKJ6mM|VDHKQvEJs@M*fpiB+k#+~Nn~l5gI>G9_dJ6D4(wU^%&9ZN zkzC8sJceMiH0qMxMy@v*aXMJj?$XOjFxBxwGwP+1{98zHwqCRB{3_9C(qCMPh^5jy z_Wnc-&Erci0;ynK#lBu6`NP;;NdBvx(SaxJ^7IR`2hvkV0-UJaKXNXNeG-a))s;8vada%z z9DlHe8ecbza9x7Hdyv12*rTngQ^;#*p^5Tbeeh{eTp@JarDtByY^ z))z!=JoH;cpTlnB?3cX>s?C4;<_={e(HQijxRjm>Kq_dt-TP<&ku@8upUEadtTCFC3#(MoPmGpgf`=3~zw3pCzT zfk+lFT+Dqf;vJiB9wW6JNdTrd2GPX#v1T4577`c*Yz;YEQ7m3BMh@E8w~{^b5hW+u`cWJ>Q{++;0qXwoPRsmlCB~NglP3@&T;T zj|4ahSX(Dg{U8umb2Qamwn4BX*JTu6!wRm<@lJLso_z{vo$;z(!qa@TjfjYd99sQE zlg5gE&|Yaj)BwsGLxL&}ka+0B%4+`VxMiNWEN&)Au{;)1`R#WrEGN znv0ol%524bHfZD4Fa)|D1Abf-PI%q7SM$%@_tL=B@my5tv{#%+L)?m`Nnsk$)oci` zmbvu-1;ok7`5bk3aKb1K2)RbzSb!#KqqvI?!4hM~Muu(t)rfe2OGWT#WZcY|r@G-a zJ=y4KuYVa5FiW`$8%;FE3s;0Vew2lfI~&5mJxT(EgHvWvNQ&V# z8{tf;tQL(yT7Coz1HFtI<^;KN1^q~yt7s|*Yylczvsx9uz~*TZ$x6~eD&6Q?tkhfA zYtbiTBbKMN9{-HbhW(ER^dUngzsef!*vYIuqWR37hJ$d($e#2S{qO9E9#pPHQ$3&f zk3eS$?9QG7i;P7kcrb!RCG1)M9EJ2(hex9rc9lY;gdB z$QHN4e=Pe!8moMl9LAJlLyZ*ChzR$MEELg*M?7P71yG%=vA3q_yG!03S9|2(2J>)! zSnT}xS}s^Q-NU`RWCG-9tx5l@XJA!M;JzC-^_m3`b7t1>SvRkT^Z(1LT*eDY^a zhN#J3V65?I@N4HDQLRP$HVJh244<}@@}th6qB;laN9K{8b^U~5q0WuZr4J3)cglQq zUgmNo)*WOm;Wv$yy<-Ko#S678v>|9C=2{l=sLwpSLoqSN?)ym}7+xWYDaBbOjj=~d zDo90x0%sJLGag$hi~GuaxH}b}-p=rCXhApq2!OBa=br->RzTuXZDkgR!KYcbl`fTG z;}gF-Gvl9R-oW`Zmb2jK&MkS1EtF>xSx6>E*nQpffx%|1(eC8Nn^J0B)aB9yXJN$S9AO;bs3CM@TJC(jhe1=-d9N^FiiKU|qWydOO~adB=700fUJk zKbz^40w15#5EgL8QpwF?y+scf)2j&7f~yg5FafhOHSQ5FyZ*Du+to`w$zxfU!0cnJ z(4auWlFU;Bw8>4SngV17BPs)Bsl&;jHoe~da{o`tK&-w<@Yj=W(S^3iIPqM!rLo)B z{O-4^5^Ehv%-=+{`*Y9Sz9dHKZ=fV{4W-Bsg0 zxW;zu^HHPBf4n;Js6-|yelezJNNI`%)nAG+%H%(C*;vGpOx-oULSaip!1r<7&D^BZ z=@GZur&~b_-=xEqe})hGft5nBnpRq|d*k&zucT-ibf5#~J`|TY#??KvEZc9AbPzUN z_J0nj6X)<0P`e0iQVbL_Tu@Q0>s-2dfe5dnb$KP5NZgC)3AO zzfhyZ$BwfpxW&B4+=^Erdb;GcA7$tEb*Lx%1=hjLw!^MC zmcI*vvNxdxEwi zKR0S1xlC4E`n;VM$qwmm7*Wap+>_O)=2l94IGwe~c2P|FfFADY zCu=%Q@CYMSM@l`X3Vmi2WGah;NY-bSdSjIwA5k{9RgZo8qxoFsV^YbkBhF3t`y%92 z^cN$!r;4d?U2Ta;7E*)^7(G=Dkf?S2-DDt$!LI-y4ri4x>~G)8jg_$>GP^mttMhJr z)C2DpI%wMX2Dg9p-8A0+nHx!EQIGPEbt2Z|hvRB;k40r_Pew)e?h+#mjtXN?Woe%x|n5xVxiE#Sq?~`2{J&!jSom5w0%2P3!bqK}G#)3G4ey0DVEMK5@_B|_ z!SzfO_8+)i(}XVqn4J2e9f_-KgEBc~Y>K9!G~A*Ym=IL}s}-B4Kd$7oTEm9vGm%;v zxM2E`x1JZxLu$g;j$!p=Yd#w|y?s*m7zeGv4kGHCuEy-TbnTmd=3@rTQi$7?s{O^# z`fa|Oo7(;oqM6T+@o{vU}=9iGYOi)Hx2eje! z7#6qHNEh5TqB|8_4foe}t}=)i}Q@A3YN2DAqJ8{X}eY5|-x6Jje5a7l zNN;I|j82yyvNt}_HflJil!4k%sSOY-eG@)c=7QDE3n4?{oFXC?eTM#U)f|o$g|^)e zH{7*QeeDUA_Bb>34->g@XG(Azp!^x%TrFk!$mG*wn=uf!44 zOz4%20GNZtlu8VxDLqn-@aTdG|z5zwIH ztiP*i%jTH@kjw?D2B~{&b|FmlvM`OcRs>$D`hI5S0qFx1sXFW zqgeNv6yz{Y3WHag&AIQQ{v)Vl*+Ex-`AvrxuaK60NIO?KM*A z4rDOqs1zqibE}bJ`Hdh;q&Z|%!XnFlrL@v+iTS&+^FccE$~v-NQA2R1_p5C+25(^* zx|8`-2i#51>kuIWV=0C!gH$1seqek0A)k2)dGnP>om8pl-l6-Os6Cm$OyTlZ)xJ=$ z{`2F8ZhY&0E0&M|d)FTSDbnzsS@c+lP?E8I2eC zh}ie^5>IU%B0b{0>wdy*BC044IhBA63e)p39v_#}iDYt*SXW)??s9dRM^9mhhm1em z!cq6pkW^bd0iGYISXgiQEF5$kw1z$;mnnYP|M_)|x@bSzTgZLC<247cr#WZYO+iCj z4OaW{>LkN5rm8Kb)T~L{PIWKr_LW?cM=~>J&Ur>xRfNaKD(V!_&0^+TLtIRtJGTmV zLfG?u(%%}sVGWe|iAaH2lKUe^G7+w%^np+@My*0LXGVEvZi~bTQ=T&L-yj8` zA}{^(k0doE?lyq~G`>L*cyJR`mHj5e3H}W<;}bH8kOKClin|}b-4p1fli_6Bk8dEn zSzGzOQSS0jJJEnD#mLq72+-jEaYPz*-IgolX}=rvU`kq?K(F+K@J+w>mbXOZ=AQ@q&e zOrb8Mb)wZTnwb{dWZ~yE4)WwV-k;-GAW-W!2^0uXa+~ApiaEgigP-MLPTh8#!jLno&;z->EFuxYTf*j7K22x1pf~ zFA|hN&G}5+ZUWFO%cw*3<6Cp-F8uLQY}Q4;Mv?*1t?4e_dDB&T78e(}4=So%L1{!M z&^E5K5pma#==)H+A3U@;v`O9YlRoV#sztYdE#Z19g_&e%(hg8zbW9<$n94aAUFs2M zIQcX9g?La4FJ7oV57!RGyFJE85(B8!Aig1w6u1u2J{!uww_W&!a3){g5K9Z^NmJbL zVyaSOLDLxNR(7*gV$+){inGul{%dpU#5umftrIB+LZnMgSx%enEhr?&T1@>QKnSHE zF5^=;MDqv<67KeJU^`xP~^$_ zSbXrQ&W%(*OZKpk*C)RXE^Jq-WjU82Of2Ql!2X#=fDvYNi}B(z2hBvu`rhZE*Km(X zGhIq|rr())8Y*%R9FKnqn)}_Oc(O{sCFoft=<^6VDME6cCjg3}yYx|>evS8CTASHc z>UiKdY0v&fPo1wmmFSC0jg<(4&9spxFW6EreGR+opn4iNQP|a9qP?_xw3*tHQvN#0 zR!s`6Ys7%u1YhjuVWJ)BI>f9zi@P*H<|jTarpXua?`3L3;@vWo(&swBsW^@g<_Gd!%#G7vKNH zYq^-&ojG&%?CfWK2-|5(p=|G4Fu1(jjy=sw88esXmG(sD=$v)t4IG9y1&T|>Ub$IU zc-?h$eoB62Qr|AI#_J`T)Gh)URU_p`^?sb3^#AG+$jTJq2sCts{85xcdJ3~R8kJD{ zIA}Y;>6C#omhduq=H#s?J#@6Uc|OUC2|14x7p5O)U5*xh09MdtjB}k)>;xX05Ruy=LyKzN0Xkmvf~!wl`Ci^JF4fDcH+W$dA)baeddkAN54naH{uU5T-w>DwH!mC5A!lo` zX?zAOP3GQ0?fC~2%pb>}eVgqYgspP{A{y=4&1;cYvw^YtFZ{@f6slomfkOrf43(>a zv0XT#Fa}V#5yB~RXxH#%rD5{lC;|c{q=&Ihker<@W#o>Qz?$4B=~kly>N3yy;fDm_-yH^f>FWfX}tP! z=jHsMuYRb>D$XNk-Uje}z73 zOl7AiEME^LWWjqlEE*aqJ~&mgzTCwx>P$iB0{@d9nw`yAx?tn+*8SBopvxJtHf&z^ z6AvCAa)7`_9}yP%K~_^8>e=3&JD|m4(~{>*MaAt1^w{`g_-abWnwOdEYR`}L%^*={ z4$HZIt%lj3M_ZdN#k4<}yI$R5j7K*=X)|th_YS^*qKd@+dNcF-j=XBqY5CJpIgzAT>iT#Ct z9D(!~0m}09ESY?3x}dsX;uoWf;Zi-+qgdzCKM+fkgLJ~9BE1YsOQV+*dirOSk8&BRY%5=iiT;SD833lHOqVcEDZd>0fY6h;85 z^wv?1Y+Vd>nwY0LiiG4L|0cH`&I7^@^Dcf0>KlJhA5TT~8;XPzphu2#h{+3&wlP++ zc8C+`&X#~Nfs9p3LCdof`>jxH17(0VsYJGz=i;%P)%4|KW91d>eWvJR^Mu1e_n2&u z9{14)9}CA&(ASFoW&m%HUMp14IXYDTNG?k_uIduBnaCD>F1Z=*F#9W8s1%m66WADm zE)L2YQt^K4bRCM+<)$BZD81ILxsuL}k((|o>$JMLl6qJXgq1^z?DcLj8ptc9TID&| z{z$|~)_%F=pySDRD)1}?oh7%c!ibfStMb}OHP9;P3Xs5C1mVfZAX@=@L zsI}YRvQ&C}8vo;pV9B~ih9)y_ZSXBx@(od5DvGb!b9 zv1X%ree=^;)k@@H_CH`C>35jWzD9yY8AoJj)mUnal`6){c0B$-T1t(CxxCSoR0D-S%&RhML0 zf9yqZ9g2^ucHUDhQmhB@om+%&`LEa)uqbQ^W{@1N560Cgzh*A|MgX0eR2ZTzn9Y!O-e{{5%F!*NR&_G~ zf25Aqhg%}zt7xJ|=~Wrd!@X6q;RlcMt1w?$$5|l6%CU=ZA&%DxMEJ^l;mT=q+b|30 z88sIV!{(2<$mK&&Q$QtUZ_C?V`?Al;$JaUpHR1ugx$e+R&NGil~esEmgr zh=i%==)11>p=)l9@UiQVFsPhSyu1`M3uR`!REv{s$~jQY2*#jg=PsXBEl(luoU@PNh7(9rX$1DDaq*sDzfFR`9>AqQ)}A&Dcet{FlT zYxMs@4`WmYIgW;vWZ6(qO2?2*F*BYeF%?}gEC7vAl^JF38?^CBVN&NZ`Tv$s%cRh; zTc(hGgAznShosf$d5(tyOPM}DrFYnDb=;G&c6`t~FIP94LVBoQ`;@qUr!%#=Mj%(d z{ApmodUZ-$3+t3|gsT{XZG}6;Ze>#ZT1L4g6wgyhQ^sx&rMIeWL|AHLXw^R$7= z&VBiE(`anxiuzK_ApwKjre%%CbXaiSZvFW-)!0Q}3sS{-Cvx>}*-|VU66b`X1UG*2 zn&*e4;KFgObc~`&KE@xh8-HdJbs;7QW+*18vVdqpouZr;I&mgfQ8-{aEFScTFX=RS zsM7l)prNb~O@!kcy`e{vi5b5V6{o^70dJ2CygNNu>u{I#t^r!~=W_e61qsTmw#L+@ z{)&)F+It`$#LgDAbYrh_i(%xp|J>_hUa-y5u@_eTMYZgc!Fw7+H~m|f4AcDa5URfj z^%-B3TM6e}8m%|p2pDr#PRd3tHCGcGUmwP5=72T%9l3{%)!R-+uNUJD>5;RDzwJk& z%F&P4QNEY*nUJ#ry`9OZFtr+m@}+Kn3L?5O6vp;!c1LY}-~@8aP-9Zna24Ucdy=u` zs?$)l)+&ST%lqbzj@N`T)z}VDqvOt4CM_Blmg{LVgL6~f!Ox<{#_)nPa%wlK*+qJb zYZUz8>%{%E6OQYYS@+ga?9nS@gqidO9^d#-))x4`)oKXJm|ZDlMHpUwLxtSR74XP#Qh$xlDj1QrTEPlhQCX0! zjYGJ-Z9M?}^JL8MvCZPA>%!qJ94D@M`X;tp(59WvN9-dhB71dwx2CeK5J&%evGaWG zz=LNMpj8WDyrk2kBn8c?Wjd@|(6I|~SEoFUbF`%m`M4U*pYy-x7;@h3X`4L5VInxz z&$cw{Kohagz7IIm`l$BI#DM_KfNudG&x$=Ku2=T8TIu~&M#9% zzhn%`{3o6jKP(-)tYvLwxi*a$QqA~}if!r@#%p^bLexScM(evkeDmU%$pdLZARCdG z-luh&nucZP_=P4i>I*2oAB;eS{x}rZNyQDA9#+lrCnIL>G^PGu8jsocKq1N41O(}W zkQi_BWa7&ci4d{+I)x#%;~5*BZr)MYj{_t^oozb5+D8@63yw-EZL}Q&+<8gQZFxSP z!WdC4+Ya9^G6>BaS_%(2UNf1zngvZMdk!Zq&%O`U$nGw}Duq3h!X)9FTp7l;2`%I|e>AZ8b!?4-`|u+2Z?Waxd-P8d&~I zyoi`nqh{L_R-E%q1lUsh~lcpmg~jiP zeQ@qj4#v~icVtTUpi$t|k7)}#zUptZPBr9e9V}*>WIn6a<&*M$O994#3=$B!bDbJ^w4k@}Lum~z{62#G@hg)D)+IU$_Us<9~2 zLb{HaZ>ddV=vP_DE~pAZR7nywz@FYx67sc+LZ)(b%1gsq2A8&AEr`h#k(;gznZH&m zRUtnJ?OD1ks(M1t@R&Z#ZO4($N@_pO79})lMskE5tELk46S*IIdRfA}^IAR|Hg_Y( z))KR5E3r~bPSneSQUd%i$IYMlC~#WB``*gnY4F+0xnO?3E73$I(@g~=SShejz~ZRL z=&5}a(FJ1lvq>GMoWtrtQ@2m)EZvXP1%mJ? z4)Rl>^|vqT-<|0Lc<_i}d*Wd&e>X?W@i(G`$BL!m<_kU6I`eN#2BEp?ts!^b+n8hOr}9v_x3I2WcS6W+KjL zX?m*PfnWMol`zTw%S0$9aLE}w@B&aKQh<^F)ajGJbiz;G9i#b80Y&3n{gUt%ohW?; z+kvvP#c_Vjzqu~>LmZX!Q?<>*Dsy}$L$l0iwT=IU9|&ctXqenbu`H`KVs57}2s)VR{#44{7khiUmnLZ~tKf3xnpe5(-e6P5>> z9R!EEQ84>=iN7UQsuzT)F*^hqC@5KY(971E50G|FjbDrp$#RZ<4s?mrzXbX&N2W@i z3Yly+i8x=c+CLk19N7RxRld#w$CkW;n=^K7oH{t1d3jDWpMe*(=?!$g^UwE_VO8dc zr4mgKn6MMA341($$SNel7(~lIAEq%qAY)M6dxOzn#Hh{7ie3oI^Xtcj#i)^N&BbNE38KG(A=yz+nG=_3 zFsIt)uATmeSLcqeXRBX+jApoL3-W;ANrzHi(BTV}JQ-GtbvvINYN2B`-ehdrK4alL zU-UNE-m%bb4nUNrb!~88S~Yqk5PrsObmCc{S$zbxPK?NwyG(>n(*QS%L~-9@a& zY~*cnEA{J&<13ezHkWohC7n;C-3riueAdx_I@c3X#Ew|dn#+jszU*z}dzUT$NSm^V z+p@yP?O1e9>ntzBGf?~)$?1|ZwL;mKLB>(4>Nx7c&>eMPhoj<&4|KQ3Iq};GSP85s z`P8GO1kZQ~`QLsal~20DEdFRihyvuWh;h`Dq4Mwh$mvuw@=1(HWTg5yQ!f!B#Q)LD zDrwZABhe6YP<*%a6&jBB zYx_NNyampUp7hAv-c`5T(y{s@uR7hafhWdM_~O)0%$j@m)srAXVi{HM5hj8A8M_Fw ztZ9b$x z6P7ZT+FFA5sKg_bdImF8@SCwy8ja;mH2^Wv~o==hE7n~oVLK14KcuykZ3Z2j}s*CV14I016 zhy0492Fb#8mXW>9HVZx0jJx0GrXCmCcGEyYi(6FAIpyMrScUfZb%Oh}Mwz!^wA9yl zPZ+_Dsq{x%?X0WCu}UAk9Ymb}&dW0OI&EX5okhWVfHAebRTiWkKtNYC2ThN=h%0#< z`R`e55?vDdQ+VlK=O7ay( zQOuQkY2>ckHwEi?QfMr2@#n^4_0L!H7S%S6st(krd<2ftofJ8_(twH&Ds&Z955}~o zw|HqSbneG)Hs&9FPnEAHUrF0_R%%-$SgS^Ofa@Yn1QHH1&pyq5aW1P(1EQWodz9Eh zbK+XysxNCZ_YxR0V=COH&hDxogDds`V>Ouve4oKosv@_yc3iB}%FlG*5-OU>GN%)b z_zx8vq|}lp`HaiMZw!XhEDCMXftVB&6cI@WW8FHjaY4ADib*O0F~&xw%?oP-gF*R5 zQ=hOHnoI-L)2Tjqr+v5fm)P+A#*EqJf2|vM(e&|tg%J_jgnrAEOQq)bkvXff4wDM| z%jCNr`HhmQ_rIQzXZv0wYI@b9Xri$xXUR=#RXyKHewt<7>{Q_rrPmk91aM)U zXAPHk2XsP_LX&vxCS-d9*H@5X;D*Ggt-Ure6p%l1las(J#Kt%weSLOBSdEDhr|9$Y zOUqJ((IPRm)-kY3OHmXCyJ;hP=s(>M5s;;`qQaSJ)Gy~^8e4ty^)rKMMk)z~b=QUw z^rK&@Zkb%IM+@Rb!*7lB_)lF_rBEc>}>|;EYNhZ&3#w_8K zY=Zx?2jO^7x2?Er&ih?m-C8fDhIQKhG@=N&x1U|EoUDEZU`3hy*Jow z2&{6n;P3K|gAqHsO-0~>fivP(iNqxMg%C@@Y28c9BIWud9B7KiC6=)TYRmFpOy^qB zYgkVq)P0%&b4&xb?$H4)Ec-__L8(#*(N?<0WuP;(eHUO*>TYl3f!Zrbr{$pvbo3dm z6rjiuKR7gwuZSZ)YJ96B#F#k~3e<^m`F3I?xz!SK76n|wXCpd4;0xa<;4Xv#9gBFH+&Kwn9t z5O^M}MaEwXCLtBxSY!G_gl=?^TU~g@&<<}E9p$Rk&==~lS9Wew{%+snw><(fLt8u8 z_kiejNz6T5*b$s@7i!}kjAB9F#MS=a@KH|T4$M&h;6k*+g z2yjtmglpG%5N;==juV878^(r0A7Y16P-T;XAUov{{j>`a<68fJlY~t^^TihL2o0s) zu|iiOC5>lDg3aQ%44NHhvc*Wx$I!=#v7;Oru}>SQq}KpvJBz6?N2S;XHF?`wVgz>T zsB)c61!`TRFW#ticLN`UASMh&dDoxXVxV;i1}71f=0FI>JQQv`3JFI&)Ds5lrH&D( zg7!Wg%RwE5IhN)u@^ae=|Mhv7i zQ;N$-HyEexlu@yM#D?o<+G2q*6y%Fz9htNfuRCR8D%O0(#LU_9Jq4y!1Ju$R2f91; z>ox@~k8QbP`doIkeWbloCeMyVYD0Ym6W}ihaV%oTP@Pz#;orkr8Zh;QA9t0(bCa>h zQfN`{?7`?myBpzTo-~Z%J4m~uIZzH0a~pk>LEj_AvND*m4_8TPa4Q`wEZO*kNJ(gF zR;q@+Gt^9T`N_a7I2e~JOj8j?BU+!(t#5nRhOw`0M8T_%PR4k1Q& zW#_E@^&~%{ev~;{|LfjsC10WYvP(LPV@+|TdXbScxP2zTI@HQ}eb`we=#O;?;2W7B z>sYFd*LZp*-hC7?O-LX&s3+&WR?P@X^(*vA07w7!W}W)*Sy4ifH{CD>pq|M{SFf2d zu30yiQ)^it|1>F(*#!PbJdq;hw)bU{+EDeuZtXa1IWtRg>cANNfF;^oajK>L7|XKv zQ157^e6#qq`c{}d+0^m%gu#O7-EkWqAGfn+ds~&|(iw9IC-4i((`TSAwviNOJC`av zvKfzgWr;qVl_aLWu_Wevnw~S-0HzKFxSo>=IxQ=do>>w)R-nB$8l_nhm=2i-Ko#B` zFFZ-JzPo%(sV|}I%BByf@7o_JkO3(+kl)BtqcUFNP-E51=+WO@H-R(fw=GHi^J)gl zx%~v$JUKc%{KDs+CEFrU*U*(Sx68kZ(ocZ$C^N-$*Gp^vx0Az@WX!6!?PwC=(d_^+1Xd4@4Q zG<9Rw@J}#*{!}=%=UJ8-eb9yA;qryMl0s#GSez5b&8YJWIOp9=(s3d6HHxYmR9;7x zSl0dWk1a!&^0EmAw%k{i_ft)iA?<;pS7`5<5jVag`i0~p&}NTDOJF5r*nUtOHce9& zML)V_uKl%(^&V~ZZ;btzC}PX?rhAVDxWdmO%Q@+rUqgwhNJcgYt(Xe>1vtsF#=1P; zw6X7fJ>+pHrC{4e5v%oi=^ zc+;Jr0_v}LyajMRwmi$UJwrHmbcwGr03f;BYTn0OR6Le{S!K8^ISm?fE^ESdB7zUS z-5+~(J@w>q&*FVWI%|MN?Hxy9yn8(HA?C=wF6L}mgn)a%;-3@)6X>4?V!>cah)|du zEHlDO#bLrL!v}qTM=_F3^&J`&sv%Njgh4~^=T7A}2)~yKFai2Whi|{dsShzc_L-8n zyRd)zF5HX4mhE2gO-Q#X(GlGOPFF~uuGY(WF@{wyZDgYPlQyno20Qk#&SzmDM#z@^ zVDupyc)M5D`EA8Pgy&NWH1ZXLZFY30FKHpD9|aw~zm=RVOd0!up0bPy(QN3jyfk~> z9)J(`7P4c!fsoIdUA}7ByD0?lPE{H;rzmIIJADS~8?NPdL|^q|c-{N~b9&cW0?Z#a~iC_SLpL2?X#9Ef6TzC1Wqe-U_D z>3Aiwdl$Iw4TjqTftt(Slf=A?CivIfaU86G$tL0eUO&{JSvfb{M{@BepGgjl*m8Or z3AL0!%f!lVu;1Vw0KtFuvi83txv~jF)%X1t&m1G~+W%d>MwsL096q>(BhM(BBYKLm z=FFiZ3wTCTkwo3R)a{+u&`YPr4Y{nnIatbaH>|!vUD|Rc3Mhu!P5D%~8%#U2*z)|* z?idG6;|dDoa>)}Xo;oMs^6W%}aTVT+df^yNvaUhA`Y!h8Zevw2SvbJTt@FLAoDpH| zaUzQfu7f&ylPHj3^tCu~IM+aJC7`ZCvOX?1ArpJiiK~Q;U%(38X7RzZ!ILneecTSe zJHpgbw&_p$3+UuLRm0gtTO$x9<+{+)PnrO*3KwH8}nw z!HWIPOz^)^ziZMS2#(KY(9e(4Nu0wr*d3Q(7gHKW2Ct{Eg`soIfMrHdfF}R7w~5Io z`;AE$NaOOqsvr`BEXIW_GYv70NXOI-FwinW-13NTv{fR?62AU!@s7D%s*tZ_;(BGV zi^6Eu9d@06gMY#U&=4FsW^V6dj)Fh!KARz9opS>-W@=x4>X3F;j*h7yjhy3=7?UuE zOXGP!M=3_a=`+MIOIZ9r#>MK!RB+>`sqj@T+r$d7->)s(sQco#@r;m|oJ@2kiR#=t z=&$ap!9Na*=T-X0P3!D`%g*@1fbsubXqg|CZm0Mao*Xbfw6EtBBo?SO+VUW93+W$>k3aYBxc`1n&-qJ8v#i z0i|9CG0inXnyOzWxm2`VC>mJBR#+NxU9NwhIN#Cq>+t-J79`4fpaeJT>|WNp9ZG{) zPUZR=udJ0Gf9n2>1#3OW854?+RIb-OsVvIohsq$YM zO|!asM_jCSR6(k@!^SC7{Yj_kwCQS3L0b-g9~}|Cd`uT=dxfvRsku zR{{a-V|nPdE0*>LOrCEe2J?da$78V=bCQ`ABcwvF*XC=^0O;ncJ^zJxNQ=eu0iVTn zUudx2lOQMk-^gHoe-gz3q6W+d^q+{RU`!DQ92X*zDqh4?FuAhg8Y1wadCCE1t;52I z6=-T;{PJ%smA?>7*N0du932iFQi>QbJk20MZ0aUR@0%?Xa~>aY`ZD^ptn6VYGx*fu zw3t^SB-r{wry1!!pP1>u_r8^+9X{#N4$I0aUzxiy%!eXqhb_MU=C{YRVGp6e< z1D1bUf>)g8AVEu>*^4Mr5YAC=3+($BraPInuHZkJT|?bsaZ=o3dy>f+&$}1Cxty;12-m zPSkySOqJwx355(?l19}p#xL##)KT$-}X*9JIt~cjTW@#L-iQmnU7LhVD6_Exr zI?GP)1 z@L}AY7o|z>c`3QHt*qd%+o*mC3>YDvnlAg>-?E;gIl{_rSa&>?xJNmTTujn)qDMz? zIP#ytYrDy=V#u|kv5?3ld0$}={vl# z5~3M4Vmo}5QdL)JNxtx{))bW?TG>8YNZKVBtT3dvF#W-vp=e3s$H&vtrbgY{wy+LZ z2@e!l0YIlTV{;9yIhq})B*!niP1jFXFBWJKaku$YjM3Xr^PMW|m7I3=+&(DJ-)Py7 zjNTxv41KiyBcn8&qAnV)39$aU)nN4~3LB=?3JvRJn@OLb(St_`dD6j3=9N>2Utq6~ zv3RRF%k4_`48qj~y9?Oxfxlb?2IeSkMCfYuZnVHk^r-HERU9ST#m;I`&6nRD&p=mL z!dF%l+D7VsxykJwOEgWKba1%L?X|q9hUwhXdY!z;Io0mHZgfV8U9)32JC!rRQa}LO z8n<>JLpw9I{=($0u&&;`AfN?{^hg89EP6;w{E>0nAtMM}VuXdniB$i+iJyJ3g^a1* z{9C=vHD*n0v&yl9w-g)Ht3fjS*o)Br0uu%;Wg>a0Q;S=GV;dW8LR|MS=bA+*iM*B9UvOC7jqXoim>a{?%&vj$-eJEc)zS9zw_oXmKz%6R>%M&egNDmqV4O z94iUA_Y9NGSL9oDisQsb5Gy zg{D9N-9f|N^pj1__}diyh%N#RKa-faWkx^ah5z#LJ=8qgt#ySjMkaTH|Ax#}4Tr6zYNN#*@KDQFgdD*#NVOz1%973~oj= zH(SOY?{SUCy}${unrHNW$Nb3^D*yqO#$GjQUe6PYY$*pxL52gy`+HmoRWotL_vh3y zr7WX96F+kTk^fEg>bGe<5*XJmbpf@h=dO#GG19{Q}OJ~dMNIzz|Xj;q=7k*ZCGWO4sJBqaJ<+JDMd3MrX43n30uC|H{n2yGT)hEEqW6k*YWr40q2!tR;NN6DdHI4><7b-Y3 z9bvvY1xKh9A4x(ojRFp1sQ+hOL3y`$nSyaIBC_=OYUp=R4gZOr0Y%xmA!jC)5;*XW z8RQWG?u<7W2w>ukjDc`DV5&n{oT1hMd9^>8^m%kwXinqgeWb$zV5TERzpyBjA+=R0 z7q;TfY-Li(&K+hsHsfF!J65iLwQ1r*qPeTJlRtgMWfnVSe6*n*THa6dE#+b=BgDIB ze;8OiPtN&7?UdyS{16ZBvO*a^1XFr>ccoPn~g*AJ=DAQ;?nK@g?)BvlIDSJN6 z7rbJcX;e^hnk57t>3eAg`W*R%KYfU45`wMFNVkvQ|28t0^xQ`LLgjQ-23YM{_d@iu zx%5wpOz#kE69bQ_m?wUn_6ayX;@>`RCCN~pmHN8R9Hi&bW}F`E2w;n!$S0h<_II34 zhmKyfJ(W-aE1ihPH070!cGPDAxGWL=sugD45b4Ni%reB)W~t{)>!9W%o4UEL)O27E zt{nX^R;XMt5z+3>$M-mTFgVD2BGd5;WyQCWw~4sm%1E51fw*ASFF_HC#>nWMs24#z z6B2Gt>~Hci(i{Z*-~yt{xJsX*kDx*Stl3q{PxwF^9P)qd{4 z+1{KFuZ~Z2<=P791gK@4Yvq-{DinQnc>fle&V!%9huYbCVd%tz8gzhI%*pkuJ6I7w zB#FkG0KFfk>LgqXq)flQ zRGSPzXjF`p%HU)M*pTnt1l)SQI!}IY(lsYaskEJ~h#DShI&NN_=$Y_{P>BxkI2sQI z^*=|a)kQOSP&b_AyjvIY=a4ZVEEg})L>88iP)pcvCv7;PQxxI9W-(tE`lr}L7kN-? z&GO@1Gh=Oo%FhA$$w3l<-0=@Z&pTzhtfsF9Wj9~BvCPemn)#*3U}>dLbkJuN9}Qag z%A&{aZTP%jfcIaVD4MN#KY9HC`(jNZTr;JnQ?r7r@HZ|#H3y;MwkwkDwdl{ zNRq6`vJ#@JILxIHODMjVKY5&lTU$ypaj0$0br}gZDf&wKSUmY z5|)Vr(_74igz&d!erTM`o)z?0jDU$OQ*8evMn0s!zrlnku5yu<55x?}$+E|SWTS4F z%>EY>eM;{WKA2-gG~XG`LDckMTMzVh|NhW#9c0h^oytLC-R=nSfO&Q0;(mPe`E22v zAL6-{pX{bR4qqhNztyhn zPiQ+VAIr5|IzJvvo@~z^&xUMTxGkJqnSm}onBO|pVGg{0y?$-|Ciwkf{xu$P5O40F z^0OOK2VUO$53f~s6rvKt5Pb1fgmyG=3}lkEOd7F1#sa9pY=aPc23dhs|FkL8hQwiZ7_p zeaFCj{8zu=4N}@U5QgNDmQQ?!rCfY8H(;`~Qe2dVB9_qu>mtT)iK#g7=#9DNsN5qJ;ao;&FN8G}SN_H%+DIVAHQb0FoA_h|Euyk1H;aL9L{ouJWfe1E6c{lDAPU zOI0^;_;L?AFYz9exEAxN72Z7g7Ke;K_Ki=)PPqTdt3TYm;jAuRvQt~VD{zxI%gB-I zILJYFX`x@m0`6ly)Yb0Q-vyeHl4hIB7_Ni=Lyp@bZe2$VLey|SHzFahWY6->?%%5e z0{qW48{>5Om<33_n2i`kP-BW0HcU>%>_6nHS@$)E*KS-~LjHciKyDktZ2O@3xo^LS1YiNpEFW9LzF_ z;NR^ANTCX0s^t$rgFs74luOlRMhhd#rU1Ku!%8%dg^dyf*8 z1WUw)%)9F4*9jQH?QtzJKe{c~#Y!z11LM)cdK&ZMK6H_ajqx{rHUImL45|ISybrgX zjpmPM62~K4&P$5ALDr}mp0trfI@Ei9T*GE7=hYaE$d$@ zEg~^(PC;}fExWItZ9Z$HK#wEkCgPiXH|U4`4{3wt&Ov6ml3*F7_FzMS5P;b?zlF>WyB_e870=l*;5D%oyFU=FY|I_O8(d1DhyK4{v zNfeGv+->kME|Gjh*VWIG3Dmsr!7qKf0aBaC7vOd^Xy+cG<>>!nOU1v@o=hJyIG3| z6Vrqfv=sjoK@57;riLC% z#6aQljRX-O0Xf9o6@j`q-@lr_L9>s&5^&X%`vtLl-UmS;Q}fdNrzZEp5}^T;vH#a6 z*O6aq46P(tHy4<9En}-vlYE{QE%NVIv__itoT+w~A1c(3q9lpvb$(SoJU>OSCU^Ke zgfExy{jc;sgrkz5^v_17UT=DI;Bj=!OFtK)JYcUd_cp= zPYT1_ZzEArMB~!%o_PXSoMqHo+$IQeW%pWR%i4Q>5}q&YhtW$f=skfV<;cG- z{_)@r0`cqYR1eRJXV*n)TC-6W$>}*-iiFUBgwX8#d4x$0T2!|{|FCj6JGF*6AxhCLq{KSs1Z0lyi0JGF|3Z$z7Xwbi^5nPm@ z=YcVd8h*izlE>44hC((#M%ZuH!*!}XD+p4Kms_*M=`QVxT7ZL|eABqW9kcmvaj=WdsA0UPNaAu%HRCI65^}gU=9Cf;Bb{n9-+@ zQb@}BbNazE!t&3+|J%-<+|WqltU*!s=5kLQQ~wVBPH@O<<SRgnY&T!`D8h6mCzFq zUMnEx#;KG(hU&kcH%l?52OqUshy7>3kD@1#0bYL$a4_h56rMvc?V0fNw;I=0cCvkT z>0Dj-am~AIUD474(}361(qnPH^2o(yBe$~4eVuq}b>4MYHFt4h=Q z^k`uX{3{4qIs%k%G*h~9^bp9MTXVK&!9&=_M{LnxHeBpBt>p}~LW}hFTeyw3)P?-V zC%gdRIGSp`IC^L!z(LM%&QQflNvC{V2~Nh)4oTO9UR(_3`blFww12bpSVXVyfq{hv znyuSS`kcOJMhLX27Cjd}`>U(%bh}ET<7C-D16kCfu&?^64Qoz62s`Jnu2AuUuS-s% z2>%lMx+;b}y$m&vNMbiq8g=yAm~zr!s+V{vK8W7yl%{sv>c1 z4-9e?&|lTr6wmCNXWTfSY|*>@Xn$p?aJ*pKrp3>*yH@(K@n!$Gq%ZhV0x`1%%s>-| z+miS!ES<~eKT=uQ2xia0TdkN%LOzQl+t)&A9PE}ID~#s07b8Upin2#%jAO;W!_ ziTWOE+usW+v)zKPqr}lfyj<*NI>p$;Kx`>9lHl3e#XQxB4%NB!VRj|&m-elz3Q-kL z!&gK=ZG)d6VWF_D=|R$Di%Qrv9E6%&iES#<##8d(XgR!xOI&alYib%f2`@ zSZy)hK&tL?eVSkx4cChP?G>|U_-=3?I&y^HIG=+|z3GA|NLTZu*KguYAH9rV>)VY> z|Lvgmt|+3Oi83ZuyLVDgEDskR^u;Z5!sbk#-I=`RsP^S(?Q8GLoz<^%W4yEI>nY6- z{#z5^;ohNvbv;3b>0aa~83cbInUjhdV3JHszhZ@v;O0-d>1pq7%_7+UZ7?~LRsvdL zT9Sec3uDgL$FLbeA)|y=n4hKA_WwIl#+Bjh+@i!M#_FTNWr%<$&%^HWS(q|q>DB;a zmm3>0Sc#P1?z>Z}I|M}07!Q8ECYCjP(DFllW|haPJ@Z~rD_0-Pe1-he$FWOqxc-U` zcugjLA_ADBk=y5z_^~M@`r%6Sh#yyDw93}T6_)JldxJzjE$j7H{{OmKT0DkdDcILv ztEpu_=-^=3-iH(OAMJ&YoVGqCv)h1I8K~NRJYQ%U>oC4VCcb)f+e@v8ozbv59*6xe z4JsHsboJLEF#=HD<>sp6E9WCfebAwLic64Cj3>s54H=QATtTgF2t@fu<{Q6V_zub3 z@zaOJS77%;Sw54BqjI_DRAA3ypTLf z<9HE9IX#(JP=60}%QQ{9dIbTLI1J*4ObGE|cRA+TgJmIxWyB=(=Z6}16gnc47|Viy ze`K&s&a7*TvK}lxi~#%756YW5`RK2>sh(~uQSE@dmxH5y@#&fnQwzf(!5^Q^Rp4Xgete;B>rkQ>_4xA<67KxAk{yvPD>&|J%Tq9;3HDb013VJ6LW>*(KXR>4_yQ`wEwddgcGr11sO=M6y|Yh% zRhA6ZmN`OQz0y^J*33ZALL-)5MwPt02bfvo6OP^)ivjrluMB1KKx4Dnu=mmNc@9v^KmU!5B;1#lmT#-dI;2(HJ7mb_$Xy}6%M zTF*z5I(T0jwreaP8M2!FBmYto^Lvu|p$mWG+NTENyZYTnfx)=2Y9>T@P#g9ripqr? zX}LdrdF^{OEOCYy;VoM=m(n`PQSH#r;SJY9P)^Ge&8LAL~0U^ zp0At|;S8o6OXm*O6Y{?p_XzucOkH(URDBZ`Sn2NW?(SMrIwhn#M7o=$LqX{V>5%U3 z4y8M!yFvQf7r*oJ{>5R>-gD5PAU`w^iH|Wn%sGi6mj7Q7fj>rX%%+WM##}`{XD$ z`b%`_^d~VFcfQYdH|!!BGteeQ!9CqlMqDid;V>`kcu0MWJNPp>H1u+MkD+3JH0q%U zW$NcRm9en#VgAkdeJa=*YFQ@A*HIdthqxX&JF(wJD!NF~L3*a{l+d>BvlHHP0XOL- zS1?{4e$VH(7c?xZnOtQTAx`J_$BL2N)OmYS{_Sngr?by-L*ga*?@Y3@tQObmP+dQyt#x`AeztkmZgp7g)5v*SIb{3{bW|!{#L@T~^xuuZ6O=>< z9k0=ZB>Wb4GWAWA7N%w(g%J)OVR(R&cS4-#1MTQ7!eTKe1g1_$7p=YasGd5B+1Q8U z*4sakHxWdwkLwj8vIUvfA6Vuqi&`EP-x#V{192+ZwDQ@H*T`Q+{}z`ane$=O+&79w zWS*Lzs2BEh&1WBTNUqK7Xr3h^SavcutwL9?oOrBEW;LpUs&g^H3`FncNI_6A9TnPm zRW5z^2ui@jaM9bASJ>IJhS$&MfncemE!%^KYo^s}4eOAwiynIKmzW5%S(s-=*u3~~ zT~2bm%}@zms%*vhe&$H`SUpeUiqCwP1nI|^mZ7|j{ESS5K-9}H>zMX1q)9$DE{CMy z2x+0**J9USRC;JBVJW5ztBJ93RhQbBl8np{vpR*85=+po8CC_iEn?B33@Z2Q?Q zOeTK{#fh!V8rgbNTiJA`gOPYE3b`J=V}#B6bwJ!XUHG-U(U%vr9XljOuPo?>O|IZ-e%1267( zF2pc+xTs6>)K@qp`Q+=Fw$F*;hrgNfgei9`3(qGyCZX8qgO&xHOl;J?uN7rv^20cI zofAKJom0RzEcV2!NcX<7AM$y~n81c>>o*)$vh#&XizW;gSgkc+b6o?koN6`icbr>TEZAyguyWfDDk@P%n(G4R3bHvc}iSk}>!uN%_Pn4*T!q5&i6B_eG+5d!!u zpYLznMiSUUo~OWXrDo3eO&-_p=tyBH-=B+C-}}H!E|yb6&8QwFqmh?=au30hjY5xY z{>skh71<0$ne!M)RnmU3f=56opgVkb$pP(Kqqt~ec|kT?h4)%I;MGD>o(`KoG5lMZ{nvBt=|#Wvs0DmnGlX%F;E6?5ga{ut<0mc`T}`!9|5ttY0<&{=FOslJNf){7Axi z@2XRk!FSaRG&!WQImMZ_m#~9B&oYRJB5n$nJzt-k?w@yPtkn5xnBje;To|*~&A1l- z{g=9!a(mM83F!@mi3%XJOfB0jl?YkdZdJHK&%jFYNt20YB_qx9&##wowUlS`4H?x(5g;y9<2Cz{KiV4_w# zE;^)>w* zr-!Obl$ltzKetSuw@S7_S8ezf%tR_iALeo&6_LcZ^Yt~7-#dq&&!0#{hkEo!)W$1w zwQWk2p)cPQUc@$KNws~{?^Q0(*|5H-m(urP_|u54xn}@Pi2Z$v(XNX4D0!{3eeD^s zLjjm9Aeg4Twti@KYHuD8%7Gx5Ms`{O-cj-%lO|~Bl6iI0QUdq0y2u(OX82kq2^2{l z_$!G2s{Y~ulX%P)62(MC_d-wu24n1kMKa{qJ*47h#a;IPs6sdUV}D-cXlud|anE$g zQpt9%>TtJy`|wfgkFs+CuIru)<>LA`U2~R97(#BMxG$$E82)cj$He3yJMclF=Ubm7 zG0*{m6zXlQU)9^%(1=mgI?yeNVzg4vI zb1M9kD~)q!(*gGicbQ{bbwyL%K3e9}N1fRph?0Z7d!gSDEE0LYeW9~WbUJ1kt8fV* zq^>_W|J_9-m_IY{Xc?tNG*-UJBY=0fxoY>`MZprIDWdC$MNu`w;#M~&uk)d85xJ0?k zG|Xsv^qF*l``+gErTkJ%+%Mw5wPE&}Q)|U+kJ&!^L#Px(~u6pY#BIaiZ-RwTV%zJeD>M zAQtZi6on}NywPrq=~l$-b)=o#X!b1;sv+`Lp-*^| z6(E{H8j|8ErFeSXqg*35sbT)v6NI}k0Igz28q%jqO%8x|hiCBP{jOB?(@YRP??5q# zK(PW2e9`wRJhD`bs@{sy=sRXM&PG_aDbrr;t7{L=^6`l_yfb4`^!vrt5Zb+Z^P|Nr z_%Aa`G)GNMGbHtXem@Y!v&w%POg{>4g_o^6ZUO_0XfYqkRs)Goe-veh3vpo{{j7=C z?#{>x;jVgiw6=8H%1_~^@18|JuiJ9L{<1S6p`f(gtsVSM7kiM=O!qt~j}BF;T5t$K zsgDj{h1BwUp^enQc90DlqkzkY<6Lo!V39Gm4^j-Sio=!(&L4IxSEJn72FQC0=g_5t zs(*|Tt$N?C4cyHvyw{OD9G?P=Y7g|}lNpmf70(7@_?aCNRVx2#awSGMnE;FBSvqs+ z-*0X9oGLh@oRNKm&P+X|7q3@+X81lK>+Z|O;?QB{1kz{CPt`~eWg&7DCs{|L*5#%#jWp6;?e);Zaf36i{1x#dvbq4q;2#;z zd%fwV_m9z(q(4=$rv1vvl@yeW-N#Os&swgnv|PC)I{q{gG3v@t3&P zQFi8#b!JnubivYoOA8CV#h(xL0wYaFwKErhXFgF>UwiN#)WtuZ%(I~I zi*8~!JjrA>b8&&+Z@i;|O+!3#G9(m?&|h`XT1-c(eso8PfHT2qnm8 zfs~aSjMkwmFGJrIW$FxfXZ6$dHvAt3b_1DrS%7rhA1dFrc9ue1UN7)a=p*)!JU?w? zL)?dXH$hHuh3+=X3&_+MJUl@h8+XAy6YF@cnHrl+0`h;%_qd1tgFlnJsSWW+#tR+P z*d53tEop=AJVj~XlkRBEztT2@1?lt*o{k>(owMdUaI-Q0Kl1k~BKPDf!ar-+uzkuD zyS`&QBB%zx3A%BYGEX8)2&9G>k|r6;(Cj48km!dFGC@;k0O3LI#(7iG7CDBg zp=dArau!AYX-)%YVR}{oyJT^Vhg4sh-W{^RAJaBb=`scd} zVBIgy8qg}5QQMqXJR4O`Qmmr!>~S7u4aIpHH$6Y*qTgjT4gsFs;n(x^yvt^3YboaU zI#1b;R@5Jxv=~1boz7e}{d7Fd?sq$(;&r`E(E7MC03G90*;)Q{9(jR5=>5paDfDbk zTql!)KrBfXi4ZOBtEPEGmg8@hfeDN`SElU7(Z(O{Rzn%n>^E}~tHVvWD#$1lxY7lc z+twHhT+LZ=r-ixmF7U$1f>v+)Z z)B*pGpK(?Pw~)pjF1Q@5MZ7*|1yF|3Avl0qaGgWgXxol7Ic(2UO1GZ$GY!HXAZ!J< z6}M=u*(k?_Y*S=IKNgE!Hv6)8UVMF&g!}PPfNC9w3P1TOF32Fx(kw6(KO_>JJv@*! z(;k}cl8o$Amqb$j$gu7>5;_FlCEC&k4we1C@Ye4$(fdfnEQ|XiMh1T6%Wf~cc|oV6 z+pI;MugT1_x@|(Jqx4%cd8_KhOK8XpfNK8x+y1GzUDKgkTHbQZ(*T?|e5>AB-9`d5JsNdEbs^pGL##{lyltv@p`w9>X`XP4P-);nQVi zR8r*wRy2>bkF#ff(tr8j6(O*YX~j@2#RPP4(}S#qHm_%q;Dqaf17K5#ei~8T+hM#k zR`~$xJ`T&~$JoFc8bLxfDKZ7DnY!#=SqGnR>zN`e+Gqe+!z5`d3A5n!DdpmLp?Q6f~mrJG1OA;dg5M zIDRu_f&YQ^2H8o&p1esCVdm*4d0*Fw-^4E|16?Y*MdZBV@D9x&eY*2z&XMVO!H(h$ zP2ouX6WW{l0`?rDlsfj0{ut`!vovpPNufg}kr^Ji7$zzKZue6f2PMZYKQ)_6y7B%C=l%PK|o;(J=XpB}uf&?u1-6Pya8KO3RKXGgTjmK`I2XP zNxu?k`;>ScQLo^`ykOiaCE@p*NmWu->fMff+cnm@9mu~o#l_Gy|eei|xC8l9lbi^q_TGb*BVePaO|39RYEt%Cc;uzH= zm*SGym~9F8+<5MH91% zl0WqA*m))3{{<7~PSua5&u<&Or|q~;CJxh|P5e-syY&lfp7tgepYN0By*`hl-xi&O zi-IS{*_hD>CrGc7b^bVP;|NzApel)1>?{A92`)JG6W{OX1--YZGCt>|_K7XvD|t*s zvxB(cr0zYaLhg{^on0I(_I9GFhFLlY#R@{+e%=@@i0=4ofbHlfiu^`VNAOBGe?@u9 zeLO=x)YS@%vP8-zo&ykERoQvnMTg^~-0E7;U)}qvML&_A8+VDFKfRe|2eA! zFrFb0`r<4=@F#*GfgQXCCnSszAgA8Zc{Q9|BVy99IPnf~s3AY3Do7yoUziep*Sy4c zLcYWY_R@Fbn`7zIFF+2O%HoZ8Jn$}OyQ^7quKOLcEWp4E<7OvIJhAZPa$pd0Gy3-pswN{BLr%tq`2h`qtp3Z6(E`sdZEgSlPaLD zzA8G@Iq}c7UeF(~)q^gRd+Mtf+Sv|LS@Mz@84WEOu=%mu=ufVv$B5t!I}BLX-;{e! zyQrZG%tn5!y<^@)E_B+DOeZKDYttoiKyE1#@za6d@uWNE9tvjUupmRR-?BRi>xNT< zabh?bWm+ri&QRS!i{n2Lluegb-WLR^?%>h70P%y!ci1*!8w_=&h~>PI=>odd-Onh; z;VIE7z~6cm)s09`7HkVyuq}SMq{$R<9GrwI8rVt+itIBWMl3tiR=f?};@_OGzb2?$ zUQOI3PR;5`Ug-H{Jsu{0&jBu}EvaxFh&#hB5ThDmcFMv$26Ax_`m#%b_F@H z2?T~!w*KdJx^i`i`#Papf!?z5;iAb|t;tOw@%fDFkQblGmjAgT2)f?Jv$WGD1x+Cc zZp)70;n-^=Y!Y9@Qf_#}g*bfC)i{G)Ab5pu<>QH!mdKwg@)}Xf+*SR`w3#yQ1e5G< zw<>FR+yh;{6~h1WH{)WlSWUZZSft=%U%ArR&7Ms-+Mcgo{`n*iE~-7@>QXHXYxH=h zxOFus$A=YSgAU^d5?mm29dFQV$-w8JeSYnVNAV~)NNhm|@+TCLAX3;?kOy62)CH-j z%#ahdw627pVmGRg87Z#szn%1fS1EJ%cr$GGxM}ZhCF0%H41t1=lg2$y&SHV?EH460 zGSh-Q&)tAM>EtK^?PN?!QX^DUe=l{K52pbG(@1WCyg0{)81zeoY&ortol7ldM2 zWejKmuEPG|xb>%4EO=vAQNi0W5X>h(`n9BAWRvdlN@kH-rK+4JVAwLs$9*hFqm~Ddp+)rEF(J!C@Cs2-^-K zrh>9Q2|+SFOQbG29ddbbb5c=j0{%K>$YK2|iAxQe1Sd=OufKR2UN^^yJ(I_Y#bRM3Dcn)B zW`dDq_Zp5hmC>6vxxb5+%JHEOM;t8kYtZpP7#h_SDR=T0C;)fbE;>KM~tC}uB zW=Kb^-8iE}Gq??{Yp|6^S#SD^w0@_4y<@J|X(ED(C)cpUhV0T66h*`6BIJkOOuoka z4ZedWDfrbrHkyVRFIl=6Iknk-FJ#&ETqTc)ZRq%efJ_ZWI@#DEnqx>yINpBpH~ZDr zU+)ea3WFDaDeZdecl%G^)1%eN60qyB`>{-raEczcjEf;vb3c}P=hJ`!>uGoW^n9IG`NGs)a4CY1@D*U*~zyJzyOD6)+N~x3uqY*0obg zarF|4_8SMy(g&*v=Y91K59`}o8y$rc$e-Vr`X8~y{koa4QRfRQm@+xHh0%_h(%1gf zzYgUScfK9H*xo)f$~BzeqegW!+HXL#1sK|I>-k;JV=!%P9(u;*4N9`|b{|5TbK>~x zC3U3so%D1^0wOp*F{9(;i*M4Jk~#AWRuoXYe7ydy|USQ9)a`+6=Rm_oSj(d zh{3W%$0q8%Hx$I-ko7`d=tuuhVS%ZJN_POS37!fX3a%e=c)^UYv2hM)RPunYri~+! zJqk1#iDdmq!krlsulaRJ?>g5H?K&5nUzeaC>(a16M;sSu_y&;hRumtriy$E7Wg8L- zQIIu}Z1DRCFvB7T9! zyMgMI=n~rYXd5vV42T5+8UcR)@s3T`+t??`Ke6C+vWX8~sv;CCVdV{1QBD&r5$nbDyY$hI{6uFj*PeHO0}VcT7hfvu~(S5qdjp%evGt7 z{#%QuD*IAz{rrRe^L9Q7sZ!g}Pgi&Vi7>Vkk^s3b@vi)+Ox}#kAac4`5d{$khm94( zTTIOYmUZz0?xio|N`e#4Ryu|Afy%5{lN1g(%=-Ecs;|4t%nBEtI#xG=60rfcGKUqU z6!u!~BsF`3QOX;PQWQxFHiBF};m(a>B^xP--bJccWc65J<^cwC9J+V)Acf!V<2I=& z)O0nQYm21vv;3#8A8owONnW%M%?Nw~SDbm9B3B=oF3aDm-Rld-c3XIcnSL8&9iWQL zJK)f##KW)}(@t_9>dZ|(75n0j4eEZayV@-F9RECkIZkkX&FIatyJm!jG9Ncit^Jw% zN5g_q_erGyUx*3tW*Ex7UI~X9%}qS!MxIF2PW|?JM5spOpE~;^?6y9|efbsFy}5OT z3wKCCm=Djz?*S9-BwCBuJ2(snLN>G@TYAUNSj@#(R6_CBdOHp2#1ZjUk~f5!f!e}k zf`^|V79yvbtqo>mJ_$3`Y~K_mNrMyFV04I;ZzxJ^)}nu_$O``o z0MZVLDg!KCv|x<>K9^-DRoUr}*IPFauMlyBWK$Uc60<&@XUgsi)2BL|R{bp->x^u+ zSK4!|C{{)J$D|#bff6pIXfWE)LUR(Lokf#@W;!bKev4=+Ww*qY5W3o zMvAPJvV|8blX7pxKX{HA?qClRd-c1v=zUe#TS?j=aQKm!{p7i)4TPwUu2Pt>RDDq9 z{fJu=>a~>%8Z=eCM^qkobjur!vc$0My1eGXg zEJ68WYxZ?JuzzpOi$MrfvP$U5=GZi9Yf@9|_mNcKy$>p{6C6sSjlN;z9QT)N* zdUd?@r7hU=NPECPoB;Q3>bec9VMsNT!p~gTyk8o5pwr`q`8RRH+j<>Dq+A?s`5Ofu zIyfp$Q_=@pAs}ub38xEUXq}K3>fdf7)eyxIBs73@*vXjGU_@-eh)^Bmz=Noj20Pd_ zkl33`3(wPOZVeK8wSsU>^C8d|?K%q#y9>}h95vu4|5-(E{QP+dJirUC2D}}ZS#>?^I0}h7qqHm3&A?oZ+X}J_&=7E z-y7Rg{Rzl-4Z~pf@+Do!2IG4lLnq26H1ZmrO7~IO1B&+BN7v;EbIp!lZ4(g72H=H0 z@3;X)rKyM#Lp^uEr@4JbNqz(@RVgIX@}bAtyV`aQqE;)ZfU=aCJy_1i;in3D+kOCN|` ztpLH`H1hWh$Vv~MsvS0X0$h1dAl}u;anPpfr6dEb9IYt!IqZgz4uVn3oR8hYM0iPr z{j}9@5{qdiH?A*Jw&)^(SPP|Y?E7Dd*Flp{E<{`bKYP!AGDcj-Z`tZXMb$3!Pa8Gr z$$SFx{4l|SZ{yEcUm`g%rD@h>M#$#8RQ6}bYCcy!`i^{4Ty*akyw$i3IGDU#fyMbW ze)qR@W==8maRglrDwK}PQ2X%ECLMTU%uxn2UQ?6Fxv!fAv$zWbRqO3RSKD)l^u_+Q`1hcmXMAn2(Hu-l`-i|&>eGwTPP$?R704nl4BS>a=P z!~ytR^JPw%USY7`Ini#ArK=tcgT@Oz^^|Nr%(ITB2QKEZy@wQ#Hj^dZw26%u3PVit zd-qWCOD+pJo=ARq1=p>L@QD?M^NFoOyX$i^OdC_c=D)?VyTbNTv7l-4Fl$+g4{V%gEWo8317 zUg7c-+a8s}4J33uFxq_}+AUCl?V)3Cv6Cn()vL0ky%Xv1bc5)uz@gLs%2g8;Y1{3M56opuv9eE5tNM@nV{0MOG?5{N+Q(MhsdO0`=!*z@ZemC((&vlbLq3*-BgS?+ zb(8ciFw9I6``kaYj0Cpl2z68X6%3aZ6CZGK86-|n#w=%6adjM3cjeoAz)4P*sGtTR zwf{$1nxQo`K#hZyl}lWovP%KL&_Zb<2ur@YEkrr6tJ7r0&pwP7YR7 z!R|NTDq+|d&S{O8BFQ`gNh(NTFS_Iq1}js*k8}Fkq^zPj!)0`aRZWgN0l;>nV5N}q3Dz#7A?wWG!|>(i|k^JdLSL*l^)^+03^{~E!h4u z4}5{};>9CqkaQ0x>aa;*2MIGmSQPjt{TwZo8;Ky723TEe5bdSfV-WR|vlrJAV=Ve= z-(vaJ;K@uUU2WL!*5FP-JRr1~Jat8N7k77su3kBDukeGe*jNbH5=5}Ln6SgSnaTjs z(kXzt+H!Sf^4^F)=Jv9+;HHqH?y`%h_G11xZfAeazlIqG_MA~OT9KNbhN>-cS&dz9 zx}GSvIbe(f#(GvLL7IkT`e`T2+o;6zZD$;HC}2rywk~xEouN@ceac?pL6wPVy#Qyv zb)?)hKK zXls59NDTljS>uDb62oyj$$zMy84M6``C-u%eyOyH4=|sp-K6`2GzE}(VsIetp(p&g z)2{PcyOGFQG&6(P$sUsZ)T%qIAYjA6Pz&9s~=$~ zCn^ynP1p&0L9*jf(vV_s)u|saZ8D!F(EzEF&{EQC3%>~D2sLsoevF8PweVV64#){E zGA?1#NN!&!B^g858sS#m9-7y{F=yY>jHl5nnJzA)P3hdO)vqy5RRd{#+-Csq4GORQ z>r6YiQv{h8kM}p4)?@sHYDJHuZVm&-&v&Q8+mDAN^CBw>(b3}B&q_)@B+iu7u4SpR z^`|D-!(u;7F)}K(XvD6o)sMKple$*MGj@(i{!3kqe+|-ewY6OPD7^R;7fJO?Pp+Vd zZJJ|!D^6-`ENPO&MAbun0+NT9t$HTG>T)+mVe4;v?e#AnP~FG_suwe*^N82YTkB6r z`wkh247U~SnhfdI%WAFAbrke6EeAZ#`{MHHS>Ep~m8M_JQ77D!>wDa^Wgqk{(YRNl zt}OAKQD|FP+H-D)bDV$ENzu&j*d`{|>NkAmpkQ+0a&-*jSe4e}aP$Q0=if3RX~n?+ z5!}~k$(-DR3GI`}8o%NL!^$|@Sn8=KZ~EOCR*^3$w>1Q~yz)`-$VvYIJXS?1V7nRpVRNE2GZMo7M>5)bGaBp2d^4-ByQ^JtN5qyz2&K=uEaUo}MG0fUhz6h9)ELQTfwx3o+V>~Dc@Y+Q++g=jd_w*(g62PZ z!cSPtb9nvb(Z=xy4{P=I)FGv|D<3W|g97!3Iv$YTQX0pTVX%$kB?8A(MMjcSY4i!3 zyA+&)1TfJ@3|>=gt9s%sfqu&EN6vSibb*c{rpKiT!6U>R>Cga?dc2F6utr zs_JTp9RWn>xu%m0R77b)ba*cXr2uc>T_duhtwgbJXkdfM@Mx>&5R_x$$>gL7vL_!D z9KRdYPL~2MYcB3htbaIpwAN;?4E{X?YAz~^bWGN3U3cTChwkidgq zaGtzvB<0bj$m8QoP@J1`o_;5b(-iBEN#VgO4Uf2G6PNGr`SLUO#mg^$HTqs$ZPOG) zSkl2v^Tmf$?~JY!8;9BF0F>8{c(E85e9;Tw7jRmi> z;gO@U_PcdMWS~cA0apMP{8u-fa`X7Lp6Bt4I&ikV&9{1)AGMYw=wy+N+F3X!Upfq> zB41j^dL@Ocy;P!?a$qu+#=U8!X6X%FCmjNeqKEa&8(3Gz>1Ha3Hp9jchQ+GXeF!+= zU;xv?)TarQxykQ;txiH}`HKt~iHuaU8}c~d58vy4EG-`_>tH46TbCCN8_tl+1lwo>S~K^x+d@ z7!Uk(>)SqJMT08pJVcO@c z{yJ!mD+*3zQK2c3Xm}n4w3a$vz4kZ6X(oO!(A>I36WaP(t=r1Xd2*dki!_Wi609W( zt<*jsp=$gWN4y7sw29D1_J4Mi+75g~45N!`4jz|aMA)VgyqHLXVtIQ82dMs!VKaZ4 zX@n-4YosE6IfJ9daQva&cViq$!lrdm_@ch{gG-fLnG>?!0~|7JB?6cuH0w}^;FfIb z5XGgZO#;?Zj9hKC)pw2x!Rq*f?p=5?gqKe(-^ooNzmH9s!@*V@CHCJHKjQLF~=eHH`t&^ z9m}NvY#i*U90VUQpfuh<>A%4+ieXLXf6HFr&gS@;k~}Q=)nx_znb|m+IN2smPqmRd z;v%Lu-;~ZLnQ$VxWhqc&pRWf#{<`(fVD0k?&L}3Xg@7 z1CRuq{inQS`AH=#l}IfNR?aX&QgL@`i$B-;FK{9+O^2t*4T&&)L#-jRdgxb*b?# z)M#A$Z<~M|_%0V8jj(H=gUkk39B~(5Js)FVYx7PuKej~FHl9&j@eKt?{FNeT>)v&Q z&5?70Re;XiVwJzzQ9$lad2jg-a&zitNh-_RLnqLf`a^NJ^%+c%TqCY*yw-2y~$E3|a)BRJk zJl>KOesJPD?2MZ zK_AM}t~_3Jmw$MVLb9R~#5^7P7uHA$kjj7bfV0OApCiWs|BoId5$h23ds0+*rJQ=O z=wg#ozrg&Wfuph6n8C`8b{VAmmD^fm>)Uk%D4Jvim0KoYeVG$@zFQn!MROC4fl^qe zS`HB6Lw&)vW+)ILF4|_tfGD!ffH0yKWE4!LBVxb;{_Y4`3@PDNvvyALhe9X-eeexCa_mSSb~fi0RLn#C>(%2#I1 z;qI74k6F8#&@+w!->*XRC@*(6Nh7_N1kAIr$2{VHLxJjgvvEeLrshkQJa+bmju-?x zXpDnqD)Jh|Y%5gvl8My!$>1p7fYxdM9`0AxFN6o_@UbaVrCRnhoQBbJw*Hs+AzobT zKt|QeY)mPdobomPJgG5KTx&>cH|g*3hD5m9X&lg=H%!d2DD)hh2yp&CQ!$l#L;B8E zLm7i>)u;mbPW))+zTxXLDGe6?_}oK9QI40(csf5ur6Rz)9wT)__Hc^OJMW1$TBnvs z^Wbv3Z%nGxg*%Y{S=ptifDfhcyU&;g?SZe0uCl`MFd^>S-W+W40IYV^ZvrEBs8OPm z7hiq5GtmB$Jdem@tmEO^~#r@rB(7)JP>C-M-tbITRht3Ydl*YO4lZoi+)Z;HMkY~&*tVXwgmdksd|^?;P;Zhzt| z*K^>&M3-Fh7=^N?7G9sPd<@j9H2uDbgkWI^!NM>eM(?FT+|N9S%8lw&n-d((W~~l( z+tQKr6w6YRZe3fkL6okI0#~wG_Vn6oiMz%PpL?$lMgIOK!yfdAgK^kC*YWhRK?w2p zZB(dLM-Yu*J_lf`Ruwe}12}Byn|;Q*9LOLtJkWNj2ja@VwD{k5lDm$WG{2;)SGM zkK54OiaQJJ~Fc0>c8#;!@(_c&3r^8%vKm4d7i;80`^&@eFnb2O8^ zoCn*Nm=BwRs8M26)3*aYoM6AXx@wRXWBruQ`mJ+U3fAf?@cotH;^$uPUP`*i#9q`hm@-N&q~ zcnmsrZ8b3!+%ATyYiN!=JdR2urGVM;-^itWz9yXIS?d_zNirBZOzqrCkB`-Pf{hT6 zqwgR09Hck7{Irgdr7Mj;eqCm`xSy@PJGk$6t{<6qV9}=MsnQ}&+W)cCfxl5Mp#AV& z|F@#A=F=`v*!-s7&hXNp+A$}_*U-3o6NQU(DsjF$WiKACWM6MOgdoS-tZSb;S@>qo zMK&r!H^R0tV)*waS@xyG`);~WifBLL=^IVhuU1Q<6GocpK9yr7*D_)mHTA{e&5k#_ z-cu}Mb%_Nl!jdi|p;D(_PTjdCwH9K101S5FXgE9!`GF)uu|8;O(->I1AcvtKk{x>) zdh_s0!Rzu1@NGg}FcU{$R|igO(s31p*c zt;#8C!tywdbd%dUtMB(j=MDJ%pdX~bDMNA%8P_d2Kymr1q^IcNC8#c0zki!o$iT!9 z9V?=dSgHA0q~f%`ShJs`97Zn(`|*l&;*mvw*9j}y&F^fbOJuU&(ct+)YF1>|J8MC; z9Z?mquJ>Gfnc!z(&u8MrO!GqgU8@2TIj9@bDg%b`@?=P9vQ2GK<@$u^w7yXi54Y%s zOr!<@_bK!v)*Szn(ej#f$No&{D#muA=?@vMUpEZ0UV*FQpoZ^Y@(-0*TM$uirjbiW zOZ}#^P?Y(dxa z1JIqHvV0)K<77*XnpIMG0SI})O{%zUj01DoaUqgWK~Iq?V~ zY%v_vKf6-q9b7fQh*b#D11Xw#IIQiit?R#OhT~uUhWth+5Uj!o zosN%b&Mjc7?s}s0Lp|u9m?4{Oe82RFP$YY+otl;`B^~=cA?9XtjUyB+)YLJ-Y&kW(&qGxs?j;(fduNk@*U$`>(yq8TS zM?rATP*4>RSn|%aXcJCO4X()SobWioL%vT1vsW{TYTqpm3h?;U|?SjEP?E>mR ziiaT%#;9|KnI5&5Or}#+d`=U2N7uIdSvJ-T8CisEYor*{BRw5i(d454^M`8F_wjf| zgaK{7p1N+c0%07au*Lbrv11(>SrIRcQaS`sSpgPgZA@M$J`8a?z`H1p=9YT#cN-X;b?k4)>5?m9dVL9P587kwd<~V~S+&PIz}dz0lLv zr3dFiim9=?q-BZ>|Fw{mCOJ9GO zbC`O^bb;^ppDn*7qNjodc5l6>eOACcz-wv>0)77aP~~q@w*d*IpdS9}=^*}OX^I#| z8`bPl9P>ltQ6}bsHxfKSKsrD@m-G726wSlLV2>i^!XpegRKYGjsurGG6b0tJk5@&S zD7W4KujaTiusN>JPyF(WatvD@j~!u6WY@6ASz(kmVL)S+#%6O}QYxM*-v?Z_|>Z=2m(_Qw$X z(%o9>&;R2tmG*qA(9RE|BFb((OP7Py{ZG-vJC%0f>okvUa2h4~{pZ&xrLV_E}iU?Ujg z!Wyd1qO_c?j9JgFh!gb2p66pK(wO3U)lxCir@@o>$I(UK?w*tU+=~V~1+F}fC1Tra z48-h}HfuRuB6?bdQvV)GZDbfaQ3Fyr*edu4m@%OggBMEd*JK*M^;TxSDS)KKf<1=g zrg`Pa8&0bDV&$s&6riQoRt(n}bn$>im?p%q0gW!)a2^ZP$|pYQj*GrNPG-I;5ae!YqM ze+6G4SWPnAK%P9}FfC$iWfC1DNXcL4-H{8Pbwt@<4_MiGgs;m%fjaE#b2?Pz z4F+@_p=C$mlct(xe(rAbs`!b0RNq z4fYS)(5N8(Ly9R+Voxkf3gw?WD7gvP4d8(fiu`{n35rkISd-=0Srwp9a+7}yt7Oob z<1;PBc~T5(#QZVI0*t`YolV?^ISASt_%lU8AE8cdUroMOoE_$F^X{dF2P`Fg`0@H2 z90B?siT=!ym{2{5%l|Lq^dNKnNsbT7c$4TPr+!cP{(WvRs8l9{HJ1*8%^XwEZB+)9 z;{V3^Zc!fgi=@(n#5fY&3k7Jmk_gbl@m?h&!|{t8QExAGfsZ{e@DH{?`PM!m zqPsh93D@-${GS&HULSn7P@{qvy}}opFWg}1 zorjQKLnVK*8nBFqMjYqJl@{&;&h&qAKfV2bUxN^m@nWH+{sp0B(mZDhUwOxQkqu+T z%!|*#NLl2YjiF7>o7}1k|ESX+P&^d~=yg`9S?2oYt9JdW@YHXsq`KVMx<4ut6+4Z$ z%_Gy0iWIaZtZH*Ag_wb8RfKbH*qtE%YbBrrPed^1v#Nm~(JrSX;(x;lgSRe%-UcZo ziU-j4iBx#AzqK(^JEoLnos=U$?m)W&$lN>Um)fqruHZIbDM<7PpJAk9baKCSYr88V z7@^NSBbUTzU%4EY!ZOm4gzPRDR#YHd(I%HGrczC$N+8yo0i{!alt--ON|=ie|g z$KjtWlm!j^F@8A%|7V$s^W7KxjiHMd_F*65D*_b?_tG*z%vi75FjFpD|NH1!|8`vc z!JC$iGZ+9GL~l$xaXfo;c_7XSDSf} z?;ie($qlGv=68~iwwormURizg8q5PkmZ!E-H$0tt zn~m;^q=P_cjU2=EJ7!Y(9LV||?*3oxM>-hv<7lXb`+_rRLO*zpM7mZWFG3E(dh$mH zLQeUj5@4XaA_7+lg9k~T(iuT$Hae2o#QtBa2?*P+vu`Hyf3WR3;(%X{#*GCak^C~Q zFMu07cmLv=h9`QIju`TA3zGWtZ_nc5@SlH!2C9v{C6-BxENS$UrSx^`lGQ+EzsS|< zl!5{=!zRXvagb4+m_WIS5-P}y6rreLx!A1BgD@cVHVUX&P$8Rg!u`_97-mccJfNwA z*=Dr=z+asV&V&y0gDavA|KA+r9>y?0$-y}2KYo;q>V?a-2p+{F$m^H7eI?TgkEbaK zKFp7Pk}r&TtZ{EZ00oSdE;hg6P+xMgS?}X5|K-M{whoykmbXcN>m!=HOz-n(+YEUX zG7*!}P81c6R@c*P$Dum3nhqu$glOlUT`b6VENA|z<>4avR32UK;18c!-{*p!> z8!^sg8UyJ^6l<2tX3DKEOuP!v>DPZav^;Qca78x%EMo5eZt!O{|4OQ}3-LQEItP}?|aF20y{xJFT4n)a?vT-Ledh<~CwOnO13 z1SgT)fRu0ZnzV`?cx!f*#gLA8O5}xI}n&{Op zWckreZgf5!%KgtybYY`#{_~gKmz|YF8*Q5Vz7zKySY`LRyV1}%;UB&1aJ;)(P#|BN zH-3LN9F6NBybR5Zq78b>k>fX|Ws+P$0OFfwdV$;j6UORwEh|1RF8_D1>s>J#IMl1H z%mtO+%$+tmRjO4412+t6(^Y$&xI_N9`%Vd5J3xCcwfwUGU-!t@M#{upnAQi*f1{#n zuUDCOX-)UX-J7!Xxxnpu$w>o6tRlUJ-t`^+g458Ri7=}1Hj+RZtk5!I zqIB7}f28G9Zysljw160#XP<7PG|7D^HO}9mAOKtXud401Q$mIu*8#rY+l<6!0*Vr; zaJ^(d#0H;!z(sU8Jz4qK6Rl90`rCX@LPCR36@-Usk=Meo`+NS_-N@Ta8@yzz zR)*I&EyBEr*_(vkKN)Uy6i-qmq&wBIf4d~+&Q!BI0y2#tM8;@XYrGzK^(uRx(@XVs zdLO9^yj0(Pa`I<0t=P*O-qm25tyx6cg8wmFiu-H7P-O?=2^dU0P;O>NNaEZ0^5mr*zC3 zlchqAwS3`TAQTbr-XoHAB{c5720>V>)pg`<;=yK80B^1O9PXO-6p}zBxU)#?1%o-+ zj0qJRvy535xMLvE8o;hFnsq!+2nf=xQBGM?_E_tx=kfM3bzlyDi;+OLP??pOd$s=G z-<=HM(Y=4dnhk&t%M`DV?GSWIocPC$V0eYjhQJlKD@DJ57+u;kt>MA5ESlI@+PgMw zS~r%d1^d@*A8l+qhRn}kq0cRZ0?~itW@x*Cf7_E`EOdExLw+#((Fa<%D91l7R-Ozq zAK_?wr6>IQFo0j@Ki?;l57X5;UVp{&c0iX-lOF*Y3UWey8onD!FiX!S?_I>mZwiyl zY;)AIa2f%m5~l0f5pA_O81$c(kO|7?X>ii&*JvavbPAQK>`^TA0L+=G1CjW<9=zM| zPR&kTGYtrhy4U?7tyzUsBZM2L?W%!28+zcTKd+(NQT!NvkMOMXV`^?|?W!f79lTN1 zLHTOW#IWbB=d0=*yLZcQDD)##@6pc=>}o6HI_!-VHa>sU>|ldk?3GO?ofW~Q`ViGQ zmdMIqDr)(~n_+Nv5GVY6e$dr2h;HlIWX8WHjKz<|r&+fFx<$138j{jobWHly{pN$3PTioyi#>e1y_XSq2WbRsA~A`0amuio1aBvn_RQEf2vV5QwB<*chfJMq_gAlkD`?oCyXG z!KU1BJRWE@5uWuQCG}=VHNu&nsB@rV#zMAYVm9ArT%h2+AM4q!@MGsRA<6*>zjr}V z+B5`~#)uBvS{M)|UR8BOc#_lw->I*cr(}(Bb7Ih9<=`21%;H}jR*QVBy!r$`TMs)d zSsxms)S`P6%cRctUr;G6H9%gZ%PE{P$;x8%F{j+Ru4HZ2vh%sxsMl`KpWY z@e*};a*UOg6`q26O$~~Qyr)M?CW?;v@&$+fmy}XyN#MQ7i>xjC9#7!KkL$EPP3(tB zH+rHKtJmnd)yb>1qq-HVj##-XidUvRj2(*b4oUBIDi1DntY+v4y>vwJGItTzPIRk!J%eLYMn%$`+kE;xQV{Ou6@zAYSsE>AX$ z*1UCC--c4>eGQ%xAS=x&@kINc6vAbEJDnNS<#er8WU!|z?7Wt zQy;=l>(%gne^#1x+^qd_ORg{W%G6rl&*OM-{&ud%2~}pjB_eEu;US(X8L;2oPrm8& z=Sc9xVDOy*{&x~@_5#ddXksjSRDt`PCNBj4gHO3_IA)p0=W+jdMzJp7gu z)j<%_)a=qh5$d@3eQ?g=DNnvL*1lwo^Zau>i||BMjdzy-5vaZSl$K5}k&#!miyQM> z*sdA-yI%bxhd<@>5Zf$0JUH3tvRqS>1od0G3&_f$kYEcS+}xfZ*l8{fn7AHtJFyho zc*Zm!{+4A*=h8a}OXM6&CxfD);NZ%D8|)Oo02TpSqIZzs{|N~}OIKwagULT1!(a}t zkazzHP}f3M)MC~kQ2xtQ-Bq-LgTK1 zBF=zx5Q9|+D*)b7fiV>ER}!ozS^`W3WX=qD;1p7q_e1_AQNZ!27)^b9=k?U;P0|aM zvqLNXN?T$~)ofpv)>8EH_*qSL@3AY&Y^I%WvvO$;BT^;@Yg8-|bg|$2PN1L{(y~zz zf+4J0_9IlWPpm!&v4IXf{lWK^PVcWf{RRFF{UlZs{C+ALPVY$oVxqn|jSfn6J1(pj zm?8!x)=O@^+)dL4tS);cdN={EQniW}=$sdg?c&Z;66KjdKFH=xMdZ5`a<;eyWR-*O z8f@{VU)?NZn@$*F#tvpP`}0|m(@HwWiXky%aMY_0JXc|83s(aE1Y6-~DjHq{LP9bB z^i%a@OLf8P;;V;L|2`>7)j#!iFr;OhyNc*C`VtS@=@30@)S%&)aES=3TMm;5FvCWi zbCO~}!%W9G3z-c*`eGkjqGH-Xo=iQE{DlVph=u|OEg&>49wY_K*?n-p|4gX2;_Q=X za#pJ)=K@$|KIBzf_H_UaJn7c%{`e?05bJl{k)m~TjfDQym29)6J&*G}&<{RSdNPa7 z%jyZKCM0!hSL*`ZCT1%H@jq*N@3vx~dTh{oeO&RK;1hR08qkvC`GMCt^M!vqtzZ^5 zVA-Y{1;Z;R%DpzWGhmi9Xv`f8w5wn2)2>Hv;rIr~I5(nNv=*yFGg@$zWjLX&f{t|G zL@W=;KRPCH?<)2(tsi`eXWRKgbg`%iDGK}UBS)M9#?73n*twhz^Ei@=XV%fn2{RVu z)m8Z!rrv)CUsWQ=Q0yW`jrE<>$lpM$#1n~(AOqaG^qK+ zyp$TSBypZ}3QL;GVqx7185kOPtcP<5&P9ye#$?cAr&jxp@o+-X+NUFh#F1c%3ul3A zNY1Y~pbtRqieDa!&|@y%A&G9dUo1Eqb>U@;x~F8WT4Skfd!U2s9VyQj$=-pQy&bI< z=X1Qh8P2vymVERGw{Rx@=i`^SR*Zl%2D^zvT)BueWxZNZABPM&m)Bzv zt$yhcwZDjwDF&iMs$~ChcNQuYh}gQ(-1czRcYPnfara~K2ZcK(Cuqajs4Zc&(~=Z=Z;CU?OW-hDJg zW3FBLf4ufY!%mc{xgw$c;ggQrgiYJFxHEY8D>=n+V>|Y5=62_ zA6m%!@Y^15BT9CRMlJ<@)thihB5QI4*bvnC&Lj^+W!Az}f7J}UzP{OcCLEJmW7L4w z7jg4GsKsJRB@fa#k(wc@kVIh`BCSMbpfPfeTITSm;Rh)U<2AH3FHvtZUUNmyFGStt z(RPvODp2ubK1WwDHs_nls%!3^i_}S9b?6w8HZ=NZ^RZo^X)SHfN`kHA%S`~K;n0nP zgvRtxYCcY~gx)d#To9-hMOjZ_bR{eqj?^?wo~`euF>*hwI=34?`N$(>(XQR(DUV&B z76007qr)KpQImrMG>44i?6&*glw4Jg)dFV#iS3|wosM<0c&(d5jk2DsMeQ}w70V0$ z+~1JU5~VtX_iN0CyjSL_jSlxqg@T3YUS|diIA&MEMQLo|`}S{f4=cX4ecOk3FgL`; z8=dY~W}a;rTW{v89APA*RN^sovHjDYq$bTr4Ef@p;*2s>62IBR1tv-a4Ax!i_=>Q!3@pS{(U3Ipjd3?vo} za9qW*VMVm;}{k>l+K*-c9CA3_|dJxv8Q*P z=YuxBhhlTw*@z>Qy|_|GnPh70NTRzJPWH8>L~qJ}{Ch33)U>L~nvW*WWyitq<^tCR zIq-df>onR;Cj#lr3bg5{{<&o<1IBn&+;;h}B!u5m5(Ac8sMldKyhNa;u-zFwCx`~q z&}OtDuccMY8Up5K??r_Q2md7QIo+@F7at2$FjA8Qf91#(3|<^5a00&`8ifMp{EyTn z($c(t)iH}`j3h4?tc4n;vI=mzR5-5CQr(0<#P-w8eIZ|kR%k5s{S92J*Du^9yx?u{ zu17h(yASFBX(`=KB+dv!1X~L_df}7_tuHopV1gxSlkoglWHVoaQpiBlRa;16pRW_P6=xtA_|hwxJ5-1!_eR1o(vIc3IMIri9#AvE z+3=Td;4pZ2n$rCek&`QT&w?kEco_?jAJJjYNSL@<)ztd?d`FEe-W1is8F2e5ZU5t9 zyuskyf)4<%@7pm(XIq%NqQRGyv*SgqrV<+FUq?@^wnrc5wY0R&vNre9zM@5t4ddIH z@HY8!lY;33Kq{hBB=zq%t@d|!`aLl6c>XssnHvgjN$XX@WiQI_?swk#i(^N1RLPkj z#{@;_`Ih?!1E03`_0IY7=`=rgnlZt`RVhC1$*IEL?Nuln>t@gXfa7G3k?zlDQI{+S z<_v84WLLs~M)>F|v??%2ov+-M0K|Wdv$88G{L(9!KHsQAmuKx*T`Ajy>pzPGZmaiTGXC;} zwZdZUY%-~A7n}5~DP1RaS3t=IUHeB*nv4%iKTJxWAqKPp};YlF}zZKPS2P zaEg|~qOU!Q=@VrZIZu-iUC#t6j=9_M{iQex>DiXSlYFt1JUeS@a;H(<&Ie_6dy`O{ zO8ZDOmFbb3bTn{}9zAsd(pvs~uOrQ?0_}P7V$Z-zIu&yZmHd_6+R5iK9AfyB9cB%z zN*6k?VW?i}yv%j7b!YK^o&;#kNBoRIW=S&G&>d#{X&7mkGNX+gC&rhdh0;iB{^{g{ z3)YVZ3o@DCV-=TSBNgSRVib#(s9a2{+8+NH#)~2K()+e6<1{RG{B%7g5e!6~^g~*~ zaC0>w<7_|rxd(O-qE$pSVdbi?^b@vd!F@qS9kT0o#r?M3U-wGualzFR_OW!AqHZei zXhp>%^V?q)MnRI`mk9>o8V4n&X|)ztonoHGrJ_4d<@AGwBhoqaovT;yE7}FR`AYTg zS8 zWYq>01S=21vhV>zK~>ZfmJ+7}djpn^7@pvR5<1D-Vnb)kg-@SWaxZzcmH7-`*M(ii zJ!PIc3*Hl+#g|}}pN1T~f_wEWT3Yp36z%X;sfWj<^7g}Rzv8tVkdEfqT*E=x&a6Sb z>k-faTr`wT^baFb+$`^L+LiO5^Hg=L4Z0jU+xR>5`7m>8*0{0|I*YnxgSl^+hz0iA z%+sub#oioz|6Sf<$^aEw<_d-(B0A?*nsFwXLN4RF6PT{lUBP0O3fqZT2BvVzLbRC@ zxiH^4sT6OOS*YORHGE8LuU)rrA>rA>WRU7Gre$}%^5k0n38i)$UDmnzIQO+SwF#9V zrR#d!+L>^I{j_dn?of>l-?@9bwW0#UEM!As-F`k8z12p%ysX_HPAvsBGprrXkpKa4 z2R^W@^%$|%#})4Z5E9j!E`iw5n%%NH6&+JK|LbF5kNJ>Qa(%&qxm91KT#Cjc7_Sl9 zdg&#>A!Cw{Ram#NOEiowmUd{2XJ&Bf3FXVmaoSk*jpJm*gFuZ+@?f0~T&T)?ly%{Z zm1nf8OV6&0*R-mq%3$ll+%oy3Bg+*#Az7XIARRx#p|bL9=weO@#vgWke0AW{HMNz= z-AELuHJx3~rTbQwlRcx>_(-K&>Av4d0iDnb%2`6oUEFynXS+e_YsW{>F6IScK$8Vlzao~ArzL43lC~^XtQz0gOH^@YjcQdX6Zp#1sgA8V$p1@c)FSz-;^2In^_cg zW|)tx;7Yd9qK%sO?i{>siuWOET*|6_&Iw5n{k6ka3m_>C9%bcD2VN#V8itgaZSiXy8^egz zFpwI5wZe2gpf=yE7y*QE91?iZQ5_|qW&;fel2gtfe9ubN*Q@?LLGFetctV~|j|lIp z-Fr(!XD8Ro7RvU029H|V&uXv2J(p`^c#poppAh~6oRUo24aA8zvQOKc`}}rJ}gXJjPGHnof`j7!f zZ2NsS?r93I`NO7h>eaNtj_G^<0IrVCQ^T}|*PNMMJ%9N!hlts%^oUnEjVlFuslgNx*F0^-k`Ezif)?F&cv z1T22g4!D3*50Sc;_3>41a%mmy=HQ@8RN1eKQSpDAO|>pt|3cm!eCm>2)wq_PDsR;B zf>+zpT=~62Zqr>|M^Zp|t5!KX*!fxzyqMsigkfL!qmFN5SQMBiX{>nN+680YnNH~J zda9dWz}x5B1K<&xt0nI0QVe(s;MVF3`siUYPFTH0gZOt3=Ug!f8;~!RA*SaREDXYB zHqNKR9ZZNbK9u4#F&t-JmmA}aJRB_*$YmhRQcr^>1VO-l_c`-8-&0^MIx;R>?jwK6#C_6D~Y`%5+(L>V<2b z!N9=Z6}yb@jkXsG_$(~Hp?4!6P})CZ0}-v&omW<<+I=7kTVEECJxdv4 zy*qP1tR#jzWmfandef9@qJ4M7_&U4Un9S3`${DK>)x*}I3CZcVr30U?(zk`W4`LT` zPaZyCh5Tiy?V71E@G?!eIBcO^*o{Y^xhnIkg2>SF_4l4%ayb2oDeax%2t0Pnc&PC5 zV#_vga!hE)b)MIFYSw(!v@?(t848c&Kvd87(bD4r1IIV4ILmk2~ zegE~}EtL8BY);kqj{t5B@NJ3ERW zhRHm`ilk3q&u5V`K*9LX`#H+#Wu#36&e;`&<)xpGbSrL8VA;+soFOqQ*>pKpD2{9& zixcul2*=$WXkFFz!+gy92rZ! zPTis0aIuUksdH!CI?}Ru3f&PcHWHc&sW>+4Ju&p=;gGcVhL{6 z{vWl|Ro~z#n!wQbyibO%nr&AR;KyrxJntqr&&PYzake*ETX)?tLp;rBzek9*|CC}HGr^#n;f6=eaAly6bIHBtvC5TCC#95D( zw;=KU=^T>5XMGv#-MAv|wx3a?p4|V2^kXr*EJBiYtIV6J_5?kyU58LWZEojcX&tdTh=a zVmx#H|PP!_KxEh6;enK zOC*T^TDQy%I+r`bsd?8~l8~f=kyVH9;ry6|X-*2SlOlRj=JoG-NEhR$#j1>e@T0R( zSDJZK%-Hd!sJQF->k7sFit40?EnLl^xe1EpTN^N)!&zwsYbZw z8QKWAM+Y9c!a`(#PTOa_azL=blnRk@YK2J3XfShyGY)N! zBnvY|6%jg#zwW-w9SzDXVLk2I44S}gCwzpnouekaY<db>%@HMg=sJ z+P$9Vp5_iWy30dB%7|{#yl>EqSZnpGx<;WmS1nTQ$XeVlE=`tgljMLxP_xf%GQR1#~$RH;=aOaZ= z&IMKgZm03H_%i8*=En(Uvc|?giV!;d@@aDQOj8Nb;6%c%0{k%W^8nTWO~3e37|WD2 zK{DGd>X%rdhrW^&+?m0(aspwO_zI8u{o&RFPRPLZf(3bXw4FKNiJKYWxCjQtFCtwK zWw4*$OTKg{{v;g@u$g#by^zj9jDv3Y#w4dG?-!hAX{qF9L6i@bA*3jO!5hSlf+Y;8 z#MDUPY}HB*m^%0(tc8vai51j}AifFD(-@N#26j$f_V<0raKA7i>6J&Sj^E zmsi&L>lQ6$g1R%jBWB?E`5~zFO}M-Ia(s}{1e9*O5MRz?o8OtcYbg0b<9 z_*uU!{)p)kgW+K?Gs{knkA0jZvY~rO>jj(?uO)e&aypq?gkj^{J;C3R{8Y)1ilOFB ze+E4`>X3Pn+JZa7bLc@F2U?^B)RdA$ zrS~~<%Vlg!j2j;_EjE-531ChLY2CM8vyOZRY|6;)?8dAnE7~9q46^Z|#M6-2OW9-c zt{gRa?B-h;Sdkyu15+&}V)Lhp_5wEG!*UoN1SF9xERjJHnhf(w4|AYi*)R-=VpP(L z{Qc-1jfN@41eiIF1|%Ej>42r9YeB8q>@#ZKW7Qp@CKoJ!K=Df(DnJwPZ zUFg=2Gao%-pYUQlHb!~kX|71$(Y26rocX}Uf@u8_cYptJ%BdusYRylo1SAz(#0&RW z$c55?fPBmTAYmL% zgeWv)Pt2JEQ)tH`-=GcVt{!MKXs2p(;4-(?LMQqF379f~g%9Id5p1>}A5OH1K#F>Xwc9z(PUX6SB<+^H;dla7e^%3Kmn zbCp zrNDosS`v80kP(2R8F+okoWkBw$PhXTHd5w>+mLE0N~D(fWwDNvvyD@*G5O4fz!viy zep`&N^K4FJJo7P&1_|*_+D#(FI0P{d!OHRPx-rbWQF0d+*-+;(>CNFaZ{LdGb$mZk zv2-b(ec!+`OdFk{3u!JIU@^Cp>&Df>Q;$B{?kIZ8zvf7&dB?yY7$NSP+qpnyR@Yv0 z;jN>EMLRb_xA5d*@zlUt53!TY5LNqLW-pcz#zcqT{=+pe|;djJ6r zR7}ei%2|&QqPA-LMa)LKE9%w!6RbkK3JjK0aOe)DO1!9yTM`s)f@8EpLDI)FO(ZTC z>Rgl^M^I$Lshr%dKGab`xE4oP6^K^~F=;=kS_7rJ?a^1Ei?MSB=85K=HV)C1rwVx( znPX6XaTqj1uD6ou%}ALt@zz1_$BIwo(AX5yoI}R8;ViqAW_a68^?L?jv^{yIw7Ie$a;eTDe2u#c+S2@BrG_{?d<% z(!Fn^tsagc)Kb_%i=eY#7S5;Q`R>|1p-8paxjSU^Cy|rrWG&E5lc@cydP(=4tpfk$ zWuDk+98x70`~xHapLapO!>+fdD*DjN9P=lK=X%rQr2?Sw`2do7kVsa#ghszk+S{VM zQWDLa6|#;&TUmXg)S1s=qIVR;b>ut-1@tfaR{-j35Z(_j+~n^?_II`)-ORe_Tk^?n zu9#>j@7LHmnvno3_q`DoM5IRU-wC_CY3h&@4yLU$!8d}zfpG<*JGH$BF$T775vQoi z_HLb`$QN5iX`3Jp-df*3?*j+{$$a7%qRs{)0c4o)@ zaq>Hk%DR7EET}>AVq}H*`(W(z&!w8s>%QJV=ev}YO=fd-6;`)w?@w7IHNIdz=-^kQ zg!!~GZ)KKQ&w)jr$0nMSggLhhM0~H**>Ho7@{BTe0(I45z5|=fRO^F~vI5U>W!cU! zF`7o-Tj_B#CsxH#Ih|G)aKjVpeUukmX-iAeJ!Erp8?LnEO zUxTHPDa+LwG=ctpOX48@0`mhqUqS2M*MVF)_YG5UQ(UiQ3K+`&qov_+r8JjG6oZ$vXlmAQDG-PoV!M zSW7jIW(ZaR-QxTa37(!-g?~-+dV|x}<=bLaLyY|GYw|=(^VP0&N>R(UONi88AoI;n zjcy1%yWft=i|lZz+fok^-9|h8v#B{^fdl8SH2}5Ra#VkUOWA~=e1rgO7~ML8UKFC8 z>7|@_*H3@sGTu(x-DnXK?V|G<9|`G7eYp4@ z)>)jXu@r6hj}Q7(6L7jf>xZcNd~(y{dS(AUJ=Yq7a3H!aCjiIV6|6?03KeDsHAGG& zvO0&6NTDwDlj*A+je2Uq&yBxbtT-p0b^50fqEHM_HYv z`Iq{7u+L}GFY|;HUiv{W3%)-=x1I9ZX}`8nOwqzBvk?TE65}>}N{T^qc?~gp&ni%| zsQDc+aInr@s91q!__}VSG)+Cd;>#>_#|fJWud?go55<^K9jC2)G)*3;xp zd8bhBF7aMH#4oc1&lSw3Os8M&_{6nWzKTL=3JtdvJZQrwpa8@dn|$k34$08TVpt-C zyb3pThAeirC3)=V3dH}JoNq;ILzVDaBp1KE*N!5_GTzJHQ~+x;Nrs2u7Nzl z-BSGdu1k~{U?(20IZCLt>bv8!r|%`iy$7}EUFkAA@L4E?Ef{Q>f)u!%|M_u@vqU8K zD!gsgD7Eu%u6&pbbm&KA4+sXShEm^cVb_f!OXxM1!yn1d=%`>j1OwI1ATO^0dKD;{ zfvU+l?UZG?N|&IF7m2(R{t1uV4m89xk8rRNxX;0RgT_J1&j7ta#-ZqjTP>&VCaa#(aKj3fbgRN+b!k3YPQ0 z%ebpuFl^HciRd%tl6XqipE8I?)H_e6xcL^#a-TR7xcI{*>B#PhEddwEK?5>@HBSAz zs1rMd5%@~VzFqRU1*_*O!e&lY>5Af78q}l>)ZHbnanE{6Sg=W*wX8?Io&GBF9$LP| zdtnlzzGH-V`cK;s7R_~63`<5$clY%MF;^5_TDxhv>orZw~)E9yl$YdNO5rt08R zKLy&BlVX|)QVjJ?M9ib`+uw7@W<;w$&}3u1_N!vVQA6SAqgYbhq*5ChfWB$R6RNNc z40k3Jc9y~1O)vWjpjAl0o1owtxZ=rnnQ3tpElsqpU1-*tm~|I!Wez>Q2Suf)==p6V z2L)unHr29{c8@MBNU#!R)%ECKxffrUPk#M)a_S=1GFnRJgZxy5i6xluwen{lgTZQzbUH0g z$G*hj6;;m0&5Vtp&yv6h2Y?l#S0;||@7$kFoG~&i@d%m5$ zMa-Z{#W&l5Zt#@eDwPa-Oq%RfwIuAQPQ3y{J}=D{wnI#i!Cu7giY3sAw8$jS$lk$QO(bu3t;jKLLwq{h75lA?S6etm z)mv~h1+;}!&J1P5A^8iU`&JCDN8P8LMM0L)qx1Pn(ej-0h+{#&u+8B1D`==HTRad z>YsMr{Cw;IsIofBC#YH?31&KjRSr5}8pacM&8Q5srb33RIvEn=dC5qCnPV}n|2W5H zFQ^7_ZhmWXNY|sVWpbwUw|ISrdlA?nA_c{d!KlP--=kL$$fJyx*KN!-FEgXoHY1A1 zLzr}kwk06OIkE69L=|^vKk;ofPSLsBR_Ol4YWF7t$WZT*kWDAYJx*P))a?v(X6%5 zou>|A)LP*F2^ThJe!PUM606M31T7V;Ag|jpl9TOw^WoB){)M(BEu%|_tSx@c>#&10 zHL2DRzU~bSCRd^9c=gOV_(Aer)cTdik7wBVZBA=eUzwDrhm9jTY50~!EdECB~_>CTg6wc$6$dTq_=M(V%h z;LxE>RhxfqEBdZ>D0Ot^CpL7NoC)JXwSUHoBbNB(mx|0Z(7t)r%;8EM%Fa|%p!w-b z*xjvfOEw+fFVtMomR0gtMK!47@H$M_JKAO`+b_fB9*TlXErV+_db|{82GO7as32~G za{+?EFE}X*mq>4x!K9k=fGjuJD)xeQ9-Y_E*@jB))jtZpba6#u9rL@oQ}4IHg1wx< zN&Ia&q3UJtKEEESkgpdDHIS27$PecNiHqqqfEhfZlEs3fqIPGZkFcioR?T6=u^@^Y5jK$;tC0d3zEah?j66RGqAa%ibg_w@b6 z;^u>Q=D3ZW59Fj#Wb#hjdjPv3x%-zJRgiCm%n<3_(ZCJ99%+psfX4{h?*lWK>P?+WG8=i5v#4C)+sH4QtR#_1zQ*slkK z=uw81DR2G!Fra4Xd%G^EFm+<YpX6huiYxY1AhJkVik_TWGN@Z z5U#w?Q9gIPFtxTlo7D15*zNYdz;gyY?bT_Gq?xX%NZ764e%-l2g?68tlgN%LM-*8u z^ZKl>N7=grc6;IpF4hrCXDXgW%KXRCFw{4?Kf4YmjlWB}YMe|n4;V+j$Cyi?H<82! zQ^XgUqhWz=XAkV}U;gQVq_2*miDrVbumrY-^(%77Z-5M-n^t3dg&*m>NbUDh z=tl~G`LZ>oGo_lQ=B|q+n*PXqZHvJwNbXuvfCD)!6^F{|^=mHk^O8p`{Fe(=+7r&0 zGMZ+g_D?i~U=CvyEO1oQv!-^Mi~c!@VX1)c9kH@AC&j8DKaJs<1+~O@zTB>&;?G5r zN^pzi0OJ)9?-$3T z8;}(PKn9D-B4E-iD4CydzgngV;4$1f&PHqI^U<2_DW>T-60JE!$I%$dF&#%XSRU{R zFT4*8uio-CJODvPPEPf{_6~v5_xu}R8pXzjpD#SLHa;q~XjB6#JNN^H1vI_B!a{b2 zLTTG19S5)$f3x&et>++=B;9GcHP$pg#(L`3w}-kIdgH<#y3#-$MzESwe_u(xf|Yj< ztKI6(Q2%UKEtc5X&xgtlRiHHse96?e_aC?)lLW>a#=1SK`E zpES9$!DBH%G_WX53&yJ=WNGa4BH$$e8r(X<25IK=L7MI{8!^<7Ow=wWDyes1J-@T4zsm9SWNZ~pq* zNqME`Qdv#!THhU=*9{p@gk3A@DZ@e|FQvyP9n#;+J4%Q2PYNx)s62ByiRyi=Z(B4R z9^si*hBQ-iXXyA|pD9#*Kl+ z&?82b6%IXLS&a_=Kd!9kXAfguh5!K#mUoKiiXte(*39b;_%hl}QC2LKw0viA$F9vJg>J6e4jJwTH{V7U|hA$dM_g zi8M*HIYp#tHcEFCfgbth%k5!LaR+FEp66PVJ_zqaBh8GjVryUmQpB(a7{vUrxYD2p zG-(B5Eo@i;p%bW;-#%G@rL|m~L2Z4%s(10>>zCI?NA#5#YT+ISdDN`;Wc<)JmU^V+ z+jUcz?%zuB7!nL<3M@6srsB}15LBT&5vgnZrS~L7htwd??F>$jn4mspv3rgVe}P5? znjG3{3{I#LlJB$1@;VS1OVc!CQ4~b1h<)kGWO13)JWq-|ajTNhRwc6mnIlt7Qzaya z<`h-(>|WsRAvD(~J?<<21GuNY@y!n8M&7QcJ92luOuh(!4rxc@yQ=$E(X`?;C&N3( z>Yd&=wP>#&RraGVMr-O!WXyL6WgarMJPPgN1G$9V1 zqa|L5LiAj>gL?2JuEI>jA*=HexWTK8<#~{>gqI}`(x~R#3D5|av8^gd8qZ&D4c*A~ zy(s@!uTEaPZyi(gp1jr=M5^}MF^7i8ZdczR!6i3Es0(WRxa;9K00*lmJ?=NF1p9Bz zM&kqIul`UlyWcdcX3qzsD56d`+o9JXvjy~!2{JRQ(>J}cGGTee;F@DmR);JPQt369 znY`xIE$9Ad6Z@m3z)R2gXveW};~%ZF(f5RpmKs0)(K-%*_*|(G@`C9*-1XnRIHHU6lLVoP$!swh2 zzVP1Mepx_C8Spf#y;J5L2?8|VaX>{!cb>YR<# z!l84%V6ufWS`&G}>M*ZZl*bjzqcUY>miu|h{W@{?CJUFD{RLB4i)Vbnko#e7iS}3C2HV#|aQ$Ee$Kegz5mI^WUg@@uM}DkK;*xcFgYlPR|DG;LthW zDcKCzkGY5;YR1C|Q2#OGvG7^ohj~$@MX~fpG;MBwrxfDg8QbqHxJ>Jle7NpnAP=_l7q&-Qhx@7;uput zL85R~41iVAgUg`bdX=*%2msO$X8zJ`3ivjF!6zw|rhld50D|$al$zriUnw=k_*d#U zgN66wX1C>zkChty{wMFvjaQh>FXX3+UoV9J-fNmKkNxZ2?l0c&iV)cpK+9neu_8X> zb1(zspb4Mx49vhUj+KK@A#NBzZlq5JpK)EMj8`e7@zXH$-I+GuPTKoq-n#GK_@ip_ zxt;o1lZoVORVa7r?!9)5`_dDg6JPMzX?t>{PPsXdz4X{F+Ww=a+x5PJrK=M1*IoIo zs(lrI0?~nIh^$oW+G<~_gcy;lCzt-UOVlHMNNF)90|&kU&>yb5hSZ==q_3;KhW8#5 za5%$X0j%f!V-IemfNp@oGw^@uXFfKqd@w^e0OX7S=vhD)9Mjb1UOt$@3bf=ozIQy# z1R0w}FGR0g@U-GUXq@M#CAiFZmDnbdCNm&G-k&BD_ih`kTcMR3d1T_Ml0T<_5WA2drLr0F^Dr-Q(8 zQ&$fKjNPgxiKL(?+*{+ey4@&V9{qFV5>lNO4!7NE`;1o%A;gOI&J_HrNnf?S*gl9I zlmhb0uJx@JLiN+WLzRO5E#9ZG zYOHze_*D>;trRajTv;MXC_WoJ@*~t+o!%N&6|J%3kUIFiRN8CvhgEChYyGD6_6QAk zK2X4)#f?O-949;opmwm1@+FHBX-e>_s+iyz57V@)MByY*3w=9X?^CJ185)k7a!kX~ ztV3fOjvhIt;mF6Q;tb@7uZ_uzd;E?=MZXpWT_%kPJKa_8qe;I>D;U|`Apv5(;e{q^ zmjdvFAL(~PN%onq6l#vj*}Z$_3pE_ZnzX4`BX)}4JdN(@r}0QobSy?~lpb{T2Hb0#^CmwBz=Tm&m-usQNU%+1@(&^QDZE>xrT8QpN^`#G5A0zEGXmLX~ z*}uHU!ONrc&H0c6e-?oey>gcLMG+Jw^CK>uZ=OioDy}kC5*^WT#tDzWBXN9TUI#^S9QfuZ8WeVKpr;Wv8X$?(Irvv z*VujvyFvq{g8=tKf9}*5dw#;-pO^3_SB}D@SSDf2$|8zcBx31eC(Dq9LBvaum8Bny z+>my{-*;!)&-!AiDaXE8I%z-l#h#t+KN{&>S)U}C*+(5{^dYjv^~lUUve(|o zM@6Q%zj)UpF4&D@`1qGap20O`dr>2RzqT|@MQs)VjFW7nEg&`8wu_!CE2iztu{Ww6 z?cjgB3)P`mdU3BOxuSHNz*Re(0P&4b2npVrGzngHE4{k($VcfJN7}K+LNadUqe*?< zgS}3DT%G5{0Yun7%UC%dG~mwz4Uj9x8PCfg%~@VX0gH+vVR^MISrW%_5=2Q6h9gpH zg9iMOZ2dV>N=-Q?rDXPgnv|Xm8=%jClu~L0^=T7=cqlZ=n0}n%1JMofPRXL`K!W{< zmDix#QxE=UIBX&Phn=bsUv0iY0=cD4eXp+otM=GcMmq=#!)u7xXT_ST=7)~wD3st? zNxAOhI2-9AiO#oFEhx;rdi&R3rLeb1NZ-X{v|Nvf^7*(5e;%%aTsclc9#v&3U5+$j zQ3j$M1e{fVzRdlECrOmMMcKwx_#=RZb3~b%a!iy-fWtIVJ{wtaG;(0dQPYCd4uw^L z^tE5E$&Vr6X|opD(GD%uKLa~7G>t5tCS9mB9m-(JBXKrF2U=i8bc!XBE^+LGrrjg- z0n7&XhFOJnKt(5~Ux5;Vm$`-*$)h2-*C z5u_}wgfvC6uwWT4Lly@G=XsIF>C$bA1U9rLa1y1QrN782NAwptZkqlghmYzna->T6 zA{w_V)wT#^PMay@Y^M|+)Kg-aBbFvfB~ps*#Zw?_$3}CA8(L`!EvE zJV+e_XK5M@qCaJ>q}QrJx~V$nW!dbZJ0R2uSi6-Ay!&$NUAz;G6d6^CzB6CY>r3wq z@qXZhANL#3Qma}$toklaM5MKPl#}W8Rj&Q!<^x#0!(%hlK1*%C(wRCf1)igcnnA3_p4et3Qge$ z#HOkd0yb+pt%%7Fb6gPz^U!1D%2CdFw#)-ol~4*%Ho#dQ!f zi1e^341^SCUP^cjJ*3F}m zo36~*`^MKRO>7Ne3&^lqIallr(Zw6_<73#n0)<1t+fddXkr9`?W6p=21@rh^#)eO4 zZ_tb`$~RT+QnRJ%vB?Ma<2dIoQ-%p8aWUO61u0zk07jZ2ds;V3Gq9cn>(PFR8mmvS8G6V4z7f@+yZUK zrPpCk-w$~IJS1Z!$J~x`g!H1&S|*nMTn}QQNglHOr!8 zhU_g@CpbVols+P;zAMwj={8ZqE+x)iL?jXP<)#e|&=Fv%e zLQeJ8Kvk|gsETsXC)6rkJLbJs)KP>CosFrYj|3g`eW6;0DcAbVZ#Q(I0Xfr+02dHq zZeU_{%@43A#2dRR@%FdEoJfm(hBU`$DR&d(rVG!*&R}l6##K&dfz~Nv;s=Tm5Ook61W&zRo3CDc6j`5D}-uj|2qWBwh*ZV7j~zplXlvB&-2Ut z|2k$y$0+B?&&@3J>z5C$3N8)?Yi5=fLY}}A3!eTrJ;ejCJ8cvk6_rkFy*TAXD;Q<* zgp-)1Kbmp!=%u&Xq1$?XGQFu*JM%+jXK&A>GE}ZqcOg-hwQ_0!>MGx9TR(Ys>!y&a zLyUqACebkgRF(ue4Eb*9ihpv*1O+<}r$w$DV~-pz&0^n|dabCz45(F~i88J7vMSv) z7lDn_3fwrYXX!N(pEXmjQS-X>+S%AGa%3NK1O?~TXyma%q^I>D6m|6YgKt=I#!990 zGf3-a=+;PRENZD&gN(>4By3w7_f>PcRVtFyAqP-3JYs7|$eDDc9bJm^jR#p1`O9uw zYKGrF>h?HCV@w0fuC*sbx8B$Nnrb;3&jz#&`FP`SVJe!TJG|@ic)p( z_p2VdiO4qj<9Y?)Hltgx_*X9c)9r`mZuO_;)4G<&AT%t#TMRP3Rt~0=4vez;w)pXD zR&KZhHt_StCe4P^twf1&wg$kd*ednpK2;CBOV7Nf&s=I}cu$9K$foGKU12G+{$4KR zhxi&c&_|l_jr4Y-dO4HE$48Z_s;teIvj3 zM-|P$1fVKkdU%vm0dRP`Tb1iBTlESxo3w75S5UgNf7s}j1@c2M$G;V8+|Q$wryo3* zu~@fj7;%NM_{Uw#;1ZU%C4@8eIWU9qWfsPlxB|$ImW~oba?pfJU>@|5Tp5U6potKx z^TLO2qnzFhuNVM)J^gh|u zPyiBgCr$%nhRSx5)+f(dH4-;Pg}v%He2XB}N{b;_AF@Kt(zmOhraawv)N+?`n#UEHRpm|p793RNNr}Hk}@Cx;Kuu( zA6!4&I=bqqoYe0ha3hA{ z_;02@Pn&~3fGuQgM5iuQZqkqt_f}Q=h&D(+;8y#!@HZX46+0q!$eTBR1EihVz^yVb z!8S9cTq;JVOj`&~m(cBP+o$w*(6zZw6d`q;h6Q$pu7VH9#{-oIlXvT1dLLCcCos0K z;sSmJq|WkHYP0Fco-!sH{=;_FHk*zt&y2q9jt7qf)^}S|s^_8h{h9IouWV16(uvP* z3rP=|pcLofhRKzKm={41mn^9x!6HA&SYB6^w4Qm!qXMfc-Ad8M4F_)A@UxU6i5H%! z6sdXLO7UzMF?}SRQZx;oNZ*;9Lix_vfw1?K(M?lr7C@S8WdL3&p%mS3PHoYs#C_WZ zqfl4$nn%vBq!j)nl=s!@mP^|0-3UN;aI9Jc0DrGT+MP6H0P%8(B-c`a^~k2Ls4RpX z5Ci4^S-P26Yua0gl*FDxyhaY1AhYuT!sNrA9P?;zMRwlY- z)&>X%Zh-K!WR?U5&y-neUboDijTd&T2Y9=#AsbpWAjYKRlH6=tu-n0aUpHXYOV6W) z_7>vqiTJ38mpUQD)N;@lb~vvV%-#k$GHVe1x9P9!#etD>iOlENxxK~i2CI#UkMvKo z(kL$TBjZb1^C+ihjm_bWnJ3rRY)Xy7;Vl59clG7-C!Ke%yLr$D>valD#x)zfF4O+) zqxb0++eQB1UHGpJ7!eEe1{nb4!PCuOO5}A^rkx7b$g=>Kiw-*>4UP$BAr7y1!C~&!g)1TScc(gJ3`}868)@UyL^5^YaR6jefF;eEPhAJ+P#KbgCR_*e@YdwYamC{- z33FERkh3UHe3s?Qf(3b!gk>!JrL$*l7}{{_&<(eK&TT+WHS;zg=QTMuz_p#e63C&W zR|0)5*I(?Lpi7BRR{}XvN7wnTS<8p;-amk9M&HfoRog2$eFKoQzpr&r-dn-E7TxL;i??BM81-+d0&iS`X?=+y;V)?28^*tP>acQ9#8$M*S`vU!A1nD6;eKkE_vgd zi{gVp)j7VsM|%mh%w2@DhD7DPs?pVDdq*2@byk++S!y##eBzBAcF)JU%y$ zQRCWZWW64NLZ~J3NRZ7G+EP`uG6kgzaFB&zay4d-R6+{R0a`%($pL2C z`+M^5eu8IHyu|I*Ef7{>5P)k>8#)?721Fl**{t3t{06+d2d&*Y49QyipjaU&Hw8gT zuUu`*{ex;`hv7c0drDwITnr9HLtSu@`9scMG=E}E zAK+UmME<;{loIvEoJ#3@WPUi05SCmy$x>b{Q(##xV(Au&nDIPWvM>yzx~j9X93g`W zZHRp6hR8olDUoRMnM&#Tq^&oOQR7O9e2$~|;Pm2L$Kfapy^a-GieMNxJVQm1J!7}n zkR4TgR|0MhP)Is%HNQuZml!#fE0~h?`J-cdRY`sz2jyzJObBsiFV$>N#+nzjd zh&0xLc;knG3@C8ee*4(8L;)_j4{6-sO<=X2?APtoj4uD}(03>|d|GU}p#XI=-UN5P&4s%l=JP;V+k8 z-+F7ll@DMzhXpnh)2JCe48y4U2e9Jts|@6;JcZeoODm%oLa!a0aes>qBB=e>(jjR2 z7~+LWN=2^^c_e_)%Ubai_y_K$A0Wy0t9=#s*Km1omz}CusZJELKsghX-q`UI%Yra( zcBdW_U!q1TsjS;ACK#=+sOidi5SOIMh)hupO8cOI27|X+A{KUwLgh5!XJB8r2!lWR zMfaiL1RwBoQ2#vqCKf1PW^+Ag3KD(4-(z#oUT*t0*lH}O*eCO8e7kdr)(O)=~(Q zqbV0dzvS>jwQfkm&1z*LPpXO^P-~sInN>fKE;)!Y+Zt79IN9VKtnbHr>k`zteykdj zUy4aCK0r{(R2lUtG;|x~-k7Z)EiLF)+>3!)#h;$6j#4Mn#n@5Rzv|F0ua2=a8Xh)h8v9A5G+Egbd27AZo zzB?g}B`SRSy_-3~g;#O0|J>(7pF zg9f~lLnf%8c~wB<%Koy7M3%;^ilyR-{3u{N&0|&vMI!1tjOxtIf)UzPK;g?(0g+S9 zRYBCeZWVNP6%c(SfRrL*8E zUtUirm{BZF8?lq_9K$r_mAzZr{$dJm%N~UQQqW89dcTD@1EeY8KsweC6H&K~uno49 zQ%6%i8OWCfW<6bvwNSh1^yY6EgkQ_6MxjLH#=b$R_N4Nm z6Q`k?(F}qZ43sicvoc%?nNJ91OMR72i|_pUqHtb)5xH^@MnPT`DGP$kXHl3+_cSg` zrm$LtpGgJmR=0M2QTTH8MdVa;O~JKelnvUXz*yASo)V1EsN_?VW*pfxq2mt%%7_5~ z$Pi3)^^U8}q{3@@cY{i3 zhlahufAng>5eTJ#mAmb#usa6WD0r!dYtWn>pNDM|sTJfc(Wy)jaKwCe)2ayh?!Ku= zbR~5V4*Tf*;-YX~aS^$4mJ~e5q-o?wan7QpA3@i%kYyqcmw8zhRqiHI2<_sc@a2k& z$f?`{OO2W$u+-R5fhC`s6j-uyr`@d{G#!Aq**_HW8+c_qa%ipsRi z+}%JTySyWMx$+KjDyKY>qbA5BId;@1p&y$PNODAfgDL}3e*607!qRh;LNLL>fS=Au zFnPImd#DfibUWaKvT8VnuKW+)?}{?g^OxSY_Oknf#%g|DW*!hHdd~v5p;d+>A{-B z{YM@FS?fcNm>{F`fc50cF%NiE1SJba5V9yp3I=QytmIK7{3K86k>qA%1M8!g1J;vM zxn-0ZHAP0pS=I>=C7+tS``jGpiWOCHI_q8?ljV}6c|R;q9MT;=n%YRdvAFvNTfo%c z27r`;i9e;+hP|(i8wWLt%~oEI@Gq(Xi6ZS%uAjd4RLSL6@$d*_e4Q<;J`eSe2*VZF zW6NwrmF*4oLWm^w^t4Ex4=a!6!OF>%^P)P74<0v0xccX~mHUI1l4I$lL*) z$cB|iF9$0pr*exVHEN1Tj&r;dB1t|qDUu`={7`TXb6Gaj7cMc?(95g`$=RuOml`CoFi>NG^Ux|`QA24D0vJ6=bd@!OY!i0}lt~Mk& zdO1ikIh9)ksZmoz@NC#I{n(@o(g0tKO{n%^aB=KRI0RxH210To+Ue~dE4V=PwLu6P zwXB)A-SHAENh_=hB0Y?L9%WhJ_F{VdjsfyXL4A;P2|5sVZ5s~>TcFe1y3xe9^fRl< zdUZPE&rgZ%^I6KtArpjl9!`&3SyXYEFQIQw<#QHE>6Z6q$)PKvpXWgk`dQ)@S{tVq zy&O)DoXRb<)Tk*!OO5^9x4R^Smc-D#eRJ)AwUFa})F3Vm3(-IeeSAzGAN%yUTbWCU zeQlaGA*sYFr(rDEun_uRF@WFRbAV#YgEKy8Z(y!eh8SX|PbRKvUwSH+31Y;-QGTU& z3%}~4KZ{O0gXJ<(w)D|wa!`nW@!QS&*WR{Si&uRXv}(%sAPIWVmSig)nw`-9!*tIH zW||*dZL5}jt5)pb{%5c+3+w_f1Wv~o;f?hUTJJ&82lYuLJOQRo;B;X?)!s)VGd--`80(K*b^nBGdo)r^EhasIZem^PZQs8-b7Eh= z1ADq|)@$$p?hji<TB=^A2mKEu z9t#3q{T025pBnVRzvy<$2)czweWidnpEgo+1Nr|eOBHl*U5ikt+LwlD4Fce*8fbG^ z+1{GcRAo0oy~R%GvIpqEvjuRWxU{L$DiyX!wD3)2oq99G6)l|WXa_O_UDC@w_MZ`x4F(Mme7rh+Fj-1M^kf>2p6cR~nJ!lEZClln()BOIp3Y3j*b@a^I=`lJXjaGauH`)n#UoFs~})enq|PH zzhp&{lu25MIFH>VT#*gyie3)ZMNZ`w@ENc!a_o2r;@P+^dIZS?ZO|HB_3@f-?)Hul zy<=0DCo>b8wnV#oD??@`NBKc)tG>X8D!`<@puJIt$b#(Gs>{VyfM7S_Kk#J^ATJ#W zmD&gHOeGC5Q4T#N``uulVyG8Y8Ma>ED2^`Ok==sKb|a->@CWX>X!48x=j3zh`|P>yDTWo6~FBuOjZkC#;)xjTzTHb^Xb zIgl7Rm0SEttk4P2A)y6GrsvUX-c2?=!Tq2nxKZ7Iy*=>63v58D!}MmRd_hpjBzUV9Gf$2EBEkgDP1``iD3 zc#X!eVsp#x@dxe8l*4kGV}-YxWYw&t+G=(rq2SPnuKF8TvhgV&x~{?=)Ck-QP6t2E z!N`$=Ca9x%7&&s~e7VfREW(zLDT~S?WYWPXnV)dKg05h7UOUxMY-8l&m&3@BQ#sWU zIcmB(BBvNtNA%NE`iC5$Yjhs_CA)x}mGgs#I<0KTiQjLC#NWdEZiOjoxi~}=dh&q@ zThUQqokRhDMEtoMW*!gv9}*Wm{T3aKbted+h%_s2G?!<$4@ypkrZeI^hL-$HhCqQV7bLeo%K@&8_ zJk%b!a*_x?uA+(oe2+y{5ilN#fQ3O))X;2-k1%w{Hfk?^In*9Gm0M$wgrL(k2EA~5 zD#G@o>#@mu*tt(*Jfrx8+loQB?`a@zggT(6?I-DAcHg9ZE2qa|jy_;+uWy2G2Mv%d z0HFrg?W7z%?o2+yMBRGN9Rd$v<{OQtqY_973xjN)q2~KWY$>68HYkrAF+t+yf%3?e ziz-Zll5@t36k4GBxxAyfbkF@f49dJN^J+xmY*1eOa-ckND!0UuK&|N#cP=)Met1&u zs1Y|R&^&L7S)9`V?`CSWeD_HWfY~t&HE7Bpt<m}!z1z3nJm0JQ%a?hH-kp9 zSRrg`5_=TQmG65$Li?)6?W)DHWAfjyo|0+H^8kGV#1ec*UrFas(~*NFh}=BL8@Y0j z_(8@~pViCSXHm&Zs9F@P_N!QAVIZQwodu3<$Xon!kT-HFx5$x1a2B5qA!=tM-sq=x zdWp}&yS)>e0E(iXSF=bi@(J5|8pcgnNzM&4Z-YAJE?RnOMItu~L1WzP?&+~ZiNVY; z55$?#_f<}~O5r|$87d|)Stnh;+E2=mN zxnE`?9|_plXt4O@&|u_LZm}bQS>s|y4ILLd@~O!ij()g7snN%eU%U&v9N@F!Hi!vZ zNZyH^K^TGi)C^*l!1gL%Q!BQFNK%`CRkwO26_0tq)iJ)g(QebAQ?T3$23ZsXl5X#a za#kx2B8_r@XHw-HQb-lS&-xmb@z`LVjgEA?H|Kym-| zz1)+yl)Dn1e4Ia|5dZq+1Mc9#>K#rA^Rr=8nY zOCGT0GGEqG$P2%8*Z#*gj4FOP7!^6yPt9HfdI@1B@mEqmm!P$w4I;FeAtai{Z;^o% z2aL*bgN{R~K#Kai3vVQKMG>+|?!zLb0lqMRGp#lKIKZ*+?dT5mMi6!45!kj+80EsJ z-y&~^VbV*_UQQ=20cru4>GuX7qy3@p6Ra9TKrio0?{{P%upU%395f<*E%h-ln#V-f9BBvTv1SC#tq9UNik6-N$fRjTX z5Ti~59|+c-9w*h4YFXSJgx;X`3zV#QMQdpTa(wx9ay6r^rTQJ5T36$)j9uRK-BvZz z;E7AA=k1X1N5QakQwzgU*l{*1*IHWr_k3Gv9<5p@Yg_Na%=qr}uU+6uiu0yy8XcK(jt+X4gTf^I!Qy= z0sbU*<>hOo&3cXg<>qtW^t#(~g%Iy;Z?%~xc#YVyR-^i<7trZm#CLob@~85DjSAJp zdgfIaYF0$Y5&G@a75qugInFcO!2v4k_XZI2PiQt zU3t^3yHd_mC2B4epHUB#Y*Nok`yl6ItKxasDstr_%!(|H3&#DjW>K(=7|)kJ3wbPs zRYYl26;9DiY;0BXa@Z!5Lp3zSm@#FUcR079f=WP#1FelvW1*GRMF{(-XJ z$sLh0M2;Ajp=2I}id?xYsw~L@F75R~n(u&$$m@zTzbfjmDuKw)oqI}b2vzcO5Gr!2 zQ5hm(NE2m<8b2;WphodA3B`!hT3>xARW;ymA)mH`#LZN zaRw+e0CpcO&AkX_ zT)7C-Kw6|Zi}EOBQ4D=_L!L9?FY7u9qqq*-CDnkZ#<~n|BJxXI0{Me9>4SA+QJ%tBMHWb|ABQ zo|O)ef#xaPb+{c^M=cGhXl&!4U%Ew??Y#r0T)kPF@V1ZKQCq(BZW_gWro70KE3wuS zpieEwqBetgAO3|F>-O|o*sgKg0;N-jG|?s0-85J@A^M554UgMHfBj^|mm%IZ|Da1T zC{utsciPn@hfGi`^PpPf%F>>Wid0n0FRKa^i(ot`D^_MzRK;;o`q7ADv7uVY%R#ls zsYVqGiSe4KSkCUiO^*C=v)gj1S*~5Zj_A>+qjyIFYV{S*$IIoZjoD>MhEYbBG+=92h$@}f)&&wSqIy2tM=Yx+k30RsxkOMRX>?JL(~C~ zc(0VXq^Gc)n0PrXx4KLfa-v=h=Ny$&u5jz{%mKA#0{wxjq@ArYv{z zR1HU?xt{d3PRtG_aw(K@kp42X_uKV6Z77<$2FbR&yH=*&>H%Re@|mDmsnu+3+lD`& zMC*d&wps60{Q3PxajB}O@4B7#&EKUg-;4F*L6>TD=DP+S%xnz%m7?AMfY3PD=SHG@Wl7YTw6S0vaCg_uS&^vPFFf06= z7YSP?P%D||^0p82h{bWf%(5`|6ESkz+t9n@<)C-uRHOQYgtbl7Cuc+O=%;t85wdma zeuIECjE38oI%M@ZN||Hiyz3TVdK9KOj->O>L4Ry9KK>}Z zchy!M)-(VbtvU=;M*GeD=s7N>DUTsN?#U-vJ?tMqSJnU$P_af-XxpaRmnI9=CC1?L zA0PlP9&8BvYeHx6_AXr{VxfOLHmQh*-f{)k% zHqb74IiMXm)u`Og1lp0~$L)ZTexojroErKYd=*cM)>z)Mrr{$xq&;)E*nC@Un+=Uv zr{;IDmjJ2;ZuXuUOc5dJQ$(I4wT(l1#1p*a-W!WzNR3hnYPslrv#wgr@(NG15j)UV z3v{dZJJIu;pe9musutS^Me;!&szXB0N5CcX5OCzm@+vL-vPxJL)Y4p!pr$xYawbBa zjt7E`HII&Ftxg**VJs(k(%tKU>E0?*v?UGb59}!i{ zIAM8I_)O$c%%eEZ!qi=RmDq@?0Owns~R?H zTCif`YapNXs?_scq1_DEmenb;6IT;H1`1$ZO42hJQZ%5H>^>WEMUI#tyYnDddX>t%E=qGIoy$1Qia@%U?i5jKL$1=7gItkQjma)K@Or&M1h1;j{gp_% z-Z*9$m0tS!soRbop;$IMw63ART;ol&LDW@)_90TmKuwi`OeuUc5tVYB>egT@AGK;z zz{jI9$)4d#5#Jcnod^CWI)OIiWK*jC>&o(Mc6_a$ql&ZD1A zuJzQ(KLvExl%1V}eaNAGTBykba^-@^LF00r&VzxGD;GuX^DwNSTMuWE2ujAY%x7{$ zQm5szEJkSRQX2-Az8nmUoN83ANf_8`ZhyLo#yDOo^C6H1$t_sej*jzh79`-%Pg!-0GYz3eCo-627T*wkR5uP*=+zc z4LN9S;QV|VGz%H(y|>plUk>>K4b51gsfN0?^XC55e$f-tk8;O^jtlOv=#&z4X$-l@E znqUQQ+7fpTMtIj91cO=Xuj!%<*LDm;F8981d5cRq0xP4RvGp!$zJmbvY6J9~#cNHv zjph=7S}kh<`fkF>$U&M|1zJ>>pKhh01OM;MrrI{E>h-05X#d>ii-_mW6 zA54ddHB`D-ly00NN;IF%3`UNaAeZytX5`A);yO-Zmggd7QJfWwhiL_z-LZ*!yXDe` zo24%YHzTJSl}i$CHd!vI8OG)E+2mm42*^iqc|To)ICO~}d2O&=!xT;Qz&18?CcH%4 zm$`TK)knxJ$xMb96!;UGmJ$~;8QXTzsRmuxX?q;X2>@#!(VyJgNIL<0^~g8h?|0$d z3ReA%?d>@(6*wY8N;NeuPV7`?0y>9w(`aAovKP3(9X|}Ia_b|+`4eMdl z9Qw)n>f7E^x%A$Or$(NDA1`&|4|&9kqc;L)P$>Akett@mQ15{b!IMKKsFHb5HgaW% zyhlZlvoy&Ci$b0N%XY>f^lrk9ZdGDK+0vJTvXN7bsuB{)Hd&QWGq^$V^uv>SgdCy# z6O0RJVufMla;>dq{CW}5Ma3aVV4gi4z(8~aVg00dUW&eD7+4ib)OwIN1Q*u}1wqq& zv#u1f42XdH%fDNKZ^aOTGx$vhb*K9GAl$XT@-4Y0r1RNGHgd!S;hcwLBUcWKFagvW zOLE>$mF9IIvNUzK7fo#>Tl#WHHgc*_;UqhZijDNbPI=llj#1-xyMt+s zkV$HUl@;6Q2%vrGv_t>Y>P&?<(P>QdJNFJ1EF7+4wMOqzFYJ|$A>k0mR6`b4eYMSR zfL?XE2J99RMQwIypWvqNrSEGOW`n;>i5azf$0c|^!YiGJ@FG`^0ucvwl(N9Daux+y z31RtyRdL{pDB?lR-IPqJjqple4&g;kH7aLhw@s&YW|oKpZMHoEM5n>zU)+i2Zp$C$ zEd|S}lrzqYFi!m_%DJ0&AhjV`>B~W~$f-sJjqD=n6tuH}SmelQfNXNO;sQ_y_m6$E zGuos@_tD;xfZbC(D0Y##@LK*y` z)jx-=NwM6(XCQ~1Xvefdvy&9NXLofZM@*2pc_1rt-8)=hCLAzF6Ox6&#xwyG*U-xZQU}ZbfqRc###2!m(k*9m($z}Rg zlt0%yX%~ZS%b)fB-J8F?wpufHc^zG_(8{~-?hYHcZS)=wdcYiraZPkqgXq=`Od{@7 zJ_l$KZ>|SP9gWG^@%10@zwksj-G>iedB0kNyA8(+jEYeBiD@i&0e0SOm|!vlh23gJQXa7MaH5k=Pc){VZBJAFe#R4=+-PY94&o0 zI2t+Ch-M*oFio?Z%kD)EG!@UJ4Naowv?l4V&`-aj=pJg5$+_-lwTS$3GI+!L){t^H z5H;$vxvFS#_>23MJhp9l|71A$KK(h0Da#W8mW5%&cva`DEQ2uev#LmZcbP+G1Ix0P1D26fxuuZa!6YdphmT1i zIdDu0$$>hZsc-CepFg!jvV03-@ab186$E!-FB(Jqb-mw|3d4Y`_otc2FSdXtzAg(^pC501^1!+M5X__+9~StT0fS8vVeeU*~D(BgMb(%hvf0OIX@@j0y%wPbfPM8DC~g76xgMM`;c~Pq!S}K(OrPfMDcQBXUUYV456K z!$;+ign*67A>BICGy^xawOv-C=c*|H4ngt0_VV)vO0BMrPk!0bj{Eo@9yBcjtCbKo z@_1{~dPkw*s?T{vr96&y{jAN}r4ba~+Wf;Y6E`8M=ir*iK@&uE9;8T)R`W@h7>vX{d(kyDL`D!GGcqIw<)7&)vLR5}nv4(?1> z`BkqlCaRL0rlBVmF`Q~k`u9eD%|LXg?jq&L5h6<-^C>~ph=|UV?l(5r6V~R+_iSxT z-K3_eq0KStFLA%Eg>~xSPp3t7A~inwXigD5AL5kFgE)~Zhf!LUak6C4Y>GvGT{9>Z zWPV&#LA|VEk-EvFGaKTRy&S}eoN7cw$sJ4+QEK>zh>me-k#{MH$LhpW-DEugq4y>2 zeE!hlz1#B5u5ZN)#RCK9li_#zoYkh+S+~dtyxuSBUpN&c49CL@-E)A zJ0Ro)hP^j88e5?O(rRy5>hPd%n3MUt79iKy)MGl%E&+~9b z%90x=j3EuQQ~-v_~2 zLYB$5Q4i-j6uS%HwX>#&dt4dU07vB8E(<%TF78_o!&MDCG*>!Ca#3q+bXNGFvG_$_ zX7ReyZyJJe>HTN3SD>o-LXR+=MgzJ>Y-D-}N6k_{7`vWiBd zzPT}XhTQun>!Xr_`s+rzKo_5WeXX7hNmaWy0lCG+kOd7ge~PyOTNMzCTllrrMt#h3 z6Lw|<108FQh*8~NcQ9d7>!$PvFMp+VgZZee52p}yqpRUepuXcYC! zMhcyri#i?i!mv*QboWJa8CoQp&GAPvhdcM-XRX?M}t>~Q4B(Tj)N zao2nI7ROuk;r&lk{& zh+i~eVNKOIv2>}=>o7rIiweb9bgiIV&^YiibF zZ#F2nQM#_|aVeAnItR;04w|5X=3yDhl|`DSbrlO%#?T18NBm)L<&JHq^6XV9f3S@eC^Wg_eDld&Rn4{lOS{#eWwo__Qy<1c6YX@H zM5o6>Z)-oMS2GK(I3EPxv_0iPAJ7DQtLwN2dZ&L1^#CWHU9lv>gDvp4)*i|OmsbAj zx~GVT> z=Y=2nJY#vrrJWf{H#84Z`NveGe#z5{r|v?!+y?#TF9-T1r*bQBa@e>6cMKhIKFN_| zI-GvU+PlTxAnX=ws!tp5;`a8_Yn73+RQO`dl+!_{-flUq^XV4{RWwHMc@#+yLoPN8wQ=f91NPAYD6|v#h z3E?7;lID#gSAf>aI{IuPNT*>MY8@SMUU)w%v#yIlFQ(}m9qe}*pK88S-sTCNyBP4! z9opPI4drCYdGerWSCJetL7wMfrOA~A&y#@rvFdpgB^75pElU>WK^P=S5d^V2%$?g< z>HOue(&SVl@=S9oj>{`Wb0n?{bsk{sJQTv zxW4=R$r#xxHq#GPR&q!52+8BGYxzh!#bC8SLcH61d5b@CXbBJX5n4s)q?c4LzjGiH;@IQj zQmP7~2y)oaLr3p8|r6P4G8o%9ZbY) zRd>9Ca^wMRt<@RTyS={tcy)XI>ElAHw5w}-7WE3{f%Y`?rWY%f>meVT7TWW{uK7H$ zE4gwQhEWZC0Dc*S(jWITmK90Nf-DY_Jc^b@G-5K?VAuTRz^>#}&lOs7o-v`N2965t z$j)81!e~QeeI0l4qk;TBxE|@9WBT81^!#CFK`pre86LR2$1t~ETos!B=!O|tvDzU1s| zIJ0~&l-eZ4!xhOqA7h-)!x)n*Cm~;Eh45LjTt+M^B8YtC1*^j#%xlht@4L$cavNiu zzZ}Mxoa(unlbmNvbDqr;I=1zNcP(Xn%<3VJvTu?#jNJk3zN4;&Bqf86vv5wGcv7Yh zwHBl|%p_>u^xl^AUcR#u)-(A~KrBCY45lXS092rj_g!=7BilT-qP`ca?Er|YOd{km zGNlQ7-FkYk1xP}d_oCXbq3K_%pu$l5hRtQ+vnqItIbiRz;D4y*eRa+74+UHcsuS8C zc(`F^;Q{&=rs@XvUB~neRq^cg=U=fKwHb%C_^ns%@oVfB(Q`|6^v!Ttn4Z>06Prhu zuHhd0q)A6iDuW)U`6N`H<+D6WER^bPNC;n3>ggQ(F*#_0dYXqnCRa}VFe|cP$^2zd zvPk#|D?}*&C=!vSz-TN+)RT=r&R-6HOiuM&^+e7yrk+S@QTcrkdTC_O)ASO(t}gXc z5EZbWo_H)1Nby{iV5J^~|68nb$%pLckPi8b;J7P#u6K7bb^we-cIK zwBK%Y<>sL>GSFhpzSepdQbu1ZP7Z9rBgZ^x%*?%b=yevhyH^v}H41k3^H& zvmN4wI;}@@TJYcUtmLYls<-)l)OW0afAHJS&3CcAy@w`VC+EhLeSc|um+#L+ttiFv zY_?c(#00G}55P>W9LIIy2en{z;KwYgmlflAoJb`j(yGdnqAc9Vz}yBf=Pw6fCZ~F? zRw3sZ(<&rwE3H*rL$osK6wGfQ7oJtdPpB9Y9c}za_|}Jj1JE^6lz7GNo6>s_K2e1o=H(Ldflis7WOfYyn!1?j6WuU651}6?? z2Xv3pm0%#LD)3%UYTtI>apm@ApsM|76`X`YMHe!PNM(4bTGCi;AYs#3^QCsxKayH( za8I=0SC&F!CYznjc55$WdQ>a20O{Y$--GDjxc2{J?_HPV#*sA9SK-;QnUd@zGI_sr z+nzN^DOJf@w^7z*cK?ASm>HwUU~Di#s_dsC$jrZ3rRD*F2$uZT9U z#{2?xl3{3n47uMO3(_ziFd&3kc~gu-%fmU#WXz*R|Dx zZ;d%Z4u`%ktNE@CE5*=T7C0q#kE-g^X5M_i>MfZn@>)p!S011a^4(**f~^uAT31;8 zSnck!(E0VC>nr^GyZnl-&Y>*V-?Z3Ph!a$tCDPES{xqlF0XC&9|5N@}H=o4>AG~cj znC0*R35~@erRbaFBoMg#rh3R)1FKhnv})ozVvF&`qSV1#Bx-!&9{yAH$jpmks+8|1 zZ_Do~PA77|(w1^M0=bxnKqhBSg0kWbw7kwz`A6PxR+L4+iZo7mmO_6j-(@Ld-$Ee6 zKc2}_(nDQlDIMduEhQ~Dl2;gAc@IVC-N%#mkRC^R42!nb&Q@i0{CHJ=UvyG+`pvCT za5?~g(h!b)XJ$!AnPmF`d5ZBP41^edw@pOzTad=#Co`Si?b5Y%;=S1jRi$>J~xSuWz3@uc8I6-tv) zIT60GAK04zYzSX^s7p1U9A`}PCvqN-uH2>Ulqf;~kd$pdeljipeK9NhqRFx%m9CMXXd|H$;Q2;yw_*tkzmJU@5G<$B^IbZD87sRTOyqAPkOy* z4LFgA+~=~;LF68r82C3q@Rteor2XxX_3L7KHCIPj)nS6Vt-9yT!0Bj#_nZ3ShP{bj z=O1^!-Ql-?P|W}NP6g^-3~j^r>ZZ4-hHP)OESw#m_cTC5nNOny4t+}5b( zC&L{93U%1xkz-35xz{!=uO29SK7kOM7COVE&jNYVGy8EChBXhFwBORC1JP~~h7H5k zz$LFm#GQ0Xu^-wd{n#hMai4$ah8OBfE`lg6{)>87&>idmE6(BP2Xi>-b!*k&18x568MDTWW~H`gqI zZV3&SLcLRV=~A#eEpdiXngw>JXRdsCi;Rkri3F~hX_2$CkT>k8tcxIzBauZ;mj2j} zY@_sSV0U_`OO4V*usba{>SvCE-CYSzTD)fk|1R%r>dGZO4EYqBr5Q4caK17P=(FHkKa#dMWX-SCV4b2Km!g`MR&F!C!6G>55^XKeelo&F zOkftLh0ZV&vry^u%yl60D#`_`iYS$4BF$J4L>2S>B+cS75Jfz49gS@>@ocDcdZW}(t)@c}MAxCIt5$jIH3{AO1Bou*7k+caKBa#(#KmG=XA8&%)s7sLX{ zXZiYZsB1B|sy83r;|1kP0R=h$3S0s96uy0cVhhsWb05X_p{;K^yEXOD$K85m+lNiNyMM4VjIgENyuW#K zt0yD0pZtnl+CLfIj-qq4pPHG+Nl`^v#6%`)sr^C9@~Dhhn(!jXL{*B|S)LmEiLL$5 z25+Z_x>Wlo!rN)VQSCnm-tN$TO8i$1DcXxh0Sc(6S_CD1@(M*pkI@U%B>;GDM0cuY z`e)a7hGioP@?^O8b%UUNWDhzB14igLjD$z9?YGMTcSw_OmZnZ-Ir>kXUNgWB;Cb}V z5l@7PF~y8giOm+e387ctZu$oC`&I;`@KDFk6o#e$wWv5Go)C8+KT`Ni{z6sp9x&x= z7^pOdExsTeDD(k!xdT^Y|CJ*J8{ca7devMLtf_uVEPKO+b#}~fcrTchl+G9{pBM&p zq=!;{vo3p-HJSh!r-jb2MzbK}^vt3ZNnF(#tD8`;I4?`at0-Z4kR(M}7C{mTw>3&_ zYxHc8aeAmrt|l}&mY>&|=sEAl!kQ^^6z2pw|K;n(n=(Hl(%)i=DRN@S!} zz!0wqvUeDVI9MBrjj*pTDwFp6?f&G1rc7g#w^YL*AJ)cSiJv!x>+d(r)qpsHre!r53 zzVx5_0{cd5pTUs~keRFFPGsuH>zx+4|39?%-Ydv%Z=rs@2c!@-gjnAtupxQocLxdz zYuaCjY81HlZS$qr7~ISw1Q=UI1EvV6_u2h0#EXOhoerxsPtuTeJ9KgMZ9^BaVZ)_O zBiF8+8WXHg5fkn3Ko)1&>bH%ZeH26C>WB(~8@fO5Ep&ymrM-qPjS)nH*0c~wQ58J$ z&M2Q%K$@}N)>qy;0TqiHfvPY7_~m`IysRtl?Pk*g9_bCBA=d3;MK%m~Y*3ezG8y8H zqH~NFHFF+hna`V&RWX$Di#TFD$WxZ&b(kme8kJ^&+j!-+@p?9hH$Bv)#%p{W!g$dX z(qqPJWXdx-Y0zVs=&I6U-A+q)eds}e%E`yisE|j+)eQk+n!4yjIS-q5yIr1s2S3xR zIBlnZQG@U=)MVfS4H#;O*(z5ZFT(%E?yz@z6qf}Z}P4xe1jiBG~n{PAa5`eD1>RDGfcxQ z053grkmo^^`6+9%DrV9Zs97PB0Geq@M<7N=z-bx+8^9YpAApw}>QfJYKWz)93Enyc zM{NNqxnH~R>GxOW`ts#;5d%Ha9>lzWUY3B*{L;w8gK-maKj#p4354c6WK zw56aHaN0J#Z!Vk^8nO1(`PFWNTE6!jx@i4i+u0! z#;NYg^h^((G5Bj_R`t*Z%FJR1`*uKei)2{&;flP|%k#nVxk!8{ZuIdhe#QIWeNz= zM(nd~C>r4#>y%Pm75B7{P+eli)93A8eRnCH*dL1;fd>P)TDrw693nZ?s9H`E zymbgV8SQDYcY3?+dC2q;OE0_kLZQO+#x#$C8Vs>nK@a-fwrqEBE!^;?SycVy8EZrS z2ce<#)9#hGD72rUCEDj`G96{LTEWpSHC8G!ob-E+>Q(O%n3t*Y4&IATcR#-b?Ysfn zl1=;P6JE%n!>T8LWzI=c?XMumHyWx8Fyi07ez;OqAF3aSYA(`l+X}%*ddQx3V5cgP zq0*+qQk+G#*qWq?W>MI9rQF`~zt?i7B1?s)Z9fbXpGD`dTHFaVhGkcAGUDHyJ!1Zju~o)T~Vs zymbhUdmH3qQz1Z7;;lNAHCHzBXTv=hPVHJHrj(t*O%9yfgwdj(Me79ULvR1~r_vf! zJ{{D~!NjI%BoHi#%{ejo!@{|aH-hapO9m|-uf12M0gxdF?up%`YNAd&?ce$P794wv zo4b&IF~$Oaf=gnsq~|ml)OSLI9_YP1ZZPISEy_eWJR&^t!7ONA zqm|_!5y=Jec}^4Fsc+UiruSCcH4jN~AEoZwp*sW=cGfc}x8sK>y%qnyxYzmnPA4FH zpQ+OoB8{mHF)aRsYED5O()(syIp-k{$(ge#%~CF6mZk*|7v&HE1DuqC9ZZ zaRfH_+To#uEm$wp*&QmMut z{pAL)BGzltTxc+y#V)Q!G}GxfDR{Sln~|brn?fJ3?*$Q7iTaAk`b}C}#!b>ZkR&;C z5=KED@Iu}#vRM9+NRt#b4a>O5sICA5R0vjY5JReAs9BR}gO%l9y2##Mc$j5ep zAxWv*7F|||OzcGxuDrXu51vX?3}r;OkSG7bt8W4v2PnSokJe+=(~3gatdTc2#AQtQ z^r%YYq`nVP3*H&_Fg~;;0tB@BsiJ|E=AkzqJ(f|u2>DFCiBnhvc=)w?_{H$>Iu3LA zx>Wa3RhH2K&C;&3;SwdUt!|@#uH`2L!jDeoP0FV=m)9`0Fc9xo*7p|0a+Sl^p(rFR zE;sYA(xf(q2p2pk`8->}>nrR1DMPMG+xzMC!Qai|ThnkMP4CY}k$(gGv6?Fxyk^*YllQd<8C_+{>VVpKWoF?2|(;nE^ z%i#I2m*h~RHgS^RtwV4;QA<9y(5R~Dox2(cCNY45JQ~t4fc&zBA`u|WM-cZ3D5v4r zRfc8h$;;&8aj#M80ofWb^!9T+N=tw&xO-_bfO)8}ZMXP4lKT^Se<`i3V@Hmw{X7^Z zIdc-ES)NoWYj^=EB>4xgZYz*eRg9hiO9pTk}jOA#pFTT8eskKf0X2_DDCD8EkeS33#qW2W8 z%LrSND(S=f@!x+jXM4vVh5k}3z=yhW9!-eFCx&MTS}gLFjT}cxSgenG1Q!TyV){#x zvhrPidAmn_4KMF%C@eO&!TzlrnAaDEJM%o#X{8 zf=n8sFs)f$Hz8}9)b~TbiG1#ce}*>vGkiYyCppxZNtz~j>ku6EMCiwMf=x)V1H&Wr zxo>j%#RNhWabMS`MxayzE={KSDb{3x%9t*wrwtRi2CHIfi2fXYfhN8E>zgldbNcP} z%k@D&R;+zB`V7HeX;4sqrSkv{N3dp|n>(8vfGH0}URmU23kWYtxqj&V%B}8khRyJ+ zcx<;~SdJny#PV}1H*^h;tzQV`Xb8pGar8?2W@Ubho&WG=0TK*D9Tt~WP-&}P_ZJbQ-<=r) z2cWTpNg!dSJr#4Gat8mYzXNEmq9a@!n>-o0qJe#1Y~(dZnt?qg=4(|w-iJ#tUA02a z4^Vhu<^w`|pdeZe?bD1Ukz0Es?8T0~87~ zfc7cVbJGh*M?t*;##GpxZp5HC4%83b9FWDss`fF-a9 z7?1OaCA=ykOpzb@_=ncO2Jwc^2jV4%8nFgW*35IP!89l@EoRlX%Rm11I~|Fo-<}F_ z%H#7JbmZDRsfw_pkmh+k%IJA+@m=$y5l8$wE zZ4y<$sDAhWwkv^ml>R|%{1uSGhhbP(II<5Z@Q2rBv2Z}0Bj4xC1M7btJ) z^Ge)qz~38Qg#qjgWdBYR2Wg|_0xn56ypt!!{@>UzE|c4W4c0D76V~&Z5N3_q9AsRX zlsLnx&BO4LGy6>)g@vE7A}=e*v*(Q0Rl>NRRy+&hI7-|p_Rz-ghR=uLC5IZZY9vtd zT&p%=-nS01^SFmdam_vSt8{Qc+n0Q|svZWz^Rrlmm^M1YmQhn2jLprkeWO2RwZ!Uy zV@{{S~}J2an%F^Np?dZ~qd+*@W=Rb}{_l~}T+ywU(+GrE0{vENI3X$E!p{1VG9 z?lss?c(3JfSN*p9^~*=^#drCqvXcOGyvGL}m>?)qFog@16gtBi%me6>Ge;>;c$zh= zEDL$#sgsfwNh~iwRUBtU9;9XH&N78IKsS6ofG#=Ih&7C|G2?+Z@vaTLaYs?PJ2a!xf{`PhOtAmEwR_XoBa-7S{2Dl$A|3LG-igOmxtNV^COWPE8^0@dHktc6l(a_i8Smg%70 za2}|aoH>Y+I?9WJ#bp$*IIbgBR(ZqxFwe7qM@dnSD6|dg4WAFxOAa-n&?Ncexe7fE z+Dkt<8OS6twg%bWw@ufPz>2T8x~O(*0)H*`GR9z@kYX77gl(|VRNa_rD1~CNLvbp` zK`lq#2G&ddq}VYqykOGD`#rM|pDVCYz{8@hfmwK^SKd9ezI(3y;E&jPQ}GHyp9WsGn#dR&at!FG5^4mbrK>KLHz=E+j{I^Y%W7j_!{@`ml0%JXFp0uDSA!?a z`_}d3qz2QF+fJ3js2E!hZZx3R8n3L6e7z<)^2o8@H@XxTgO>t;y4D&z)kwWz`d-V2519eFjZQFW)E{D zpp@|A)epW>)xd*slokX~WXi+XYa42Orww`fPhsjLh0d@Z^U$K?%vmMEst$dYCuPjy zCJ$L2=7Ob3l4nsWYLU9zvV}HUG<-g^C^^)K^&nXlM|v4dneVOZiAk$LNuU>Nf_R{~ zfRZ#YgjegeJpLf|_HMWA-(csxxPA5WOTvUWC#oLWR>P{SW*?7jEtW$kTTS3&fCgGU zm5L1@FVH;s?H*(u)M>5!{w3b|2fAbA4ac$UA7a6e`Z+xARX;B%K7YiHX9KX^FzTtA zJ%AsmFa*apwbB&k2aCG4#s_n`1M3XoPHByBtxL^8us5 zr!v9VtzdXC%7jcI040UaFd_4hr{v7B2$MSV1&fMMnvl4OS(&B{tJA8k<-d55MQ#&f zBTvKUL!OdDjhGM;em7=9rr}QMCq5(lNn>P*>RjB^eTnW+=Q@|vD%-V$=&KSbHz z6I8v2b*BP2^Okkk7e-+-e+7W&h>(`7ZL zgG0l4;81dA5fpVD#W4#DQ8H)_%XlbnF+50uDk;lY#BS_FWP?Ma=L3h5L%FR6DK=&` zrp))&^~99pK}uM(AnIthTA2c%QMu;>k-kQHFP7q7^i}+h!~!|-A9fod@Hy&s_0!h7 z2MtgyKeVd>b6XC_p{IfR4e~3ndVMqiD(mE{?+*GE!3Q7tH=!CGT9hC<$FOe|tZLoe z7VOi4j0lp?Nk;@pk#WV0<^dbYnYmxpWmG0C7G(&3_)KalXAlbvvmh7Y;ff9w(*`z@ z%bTE>(}0ci3mQ|*X^=+xi2<;1Ctb*Dvsi0~7mxTJ*YNwtvGblBTxS4?bMwuz-KiGl z_{=9tFNSXD@}Fd9XL9-@P1ce06RR+_Y~B8wIP9u=1(*l#JAfi|?7|=hq#bB?kOtUk zcUwNqwf6_O=zC|p4Xv~)+w?2=zFR`2S*caJ=MEn50Ltr!heGd&KMHlrz#b=G-n_qp zZjxekkA?m4L@iRbEr)m6HYXbwsb%OG#$v0kb=Z(ubCc@i<6R|H_@_w(0D1)s>t+9C z@d%EWV6YgbVkoSG!6`#F1)oU@ongx6;WJ6OAeX<)Gr^JyI0C9LWxOaO7V!wPJ z!kyfRY#z{v`D*-QMi3Eh*0x{@lGKgMI zR8=bd@?AC<)z4Xu~3-=YvI( zLyaim)RyW~=6mZ9)4KQd^{Y274IDv2TKxB_-EWKeGtD6cgM0F-Dh5>Kqw6t$c2Bst zS0|+^nd~nS!|hlhA>~B_RCcd**Ok}yO=XooAdg--gSx7#CH5LREc@E~wN+h9t@{J^ zE3#%sVcn!v9oQ!~lf12CzT)rgN?`CnrD+!k1F~8*>)y|1{MvhuP0j!(G+ZWLe0l%z z<+c2Y6zA%JzpdIIOHr$;JeA7a3jU~q4c!{%D>e2Tc>>mmZ-g$fM{UkFg6l4ic&$3% zhldB&wQ%~Sn25v+cyllH8-bU+cNwDGg^O{Hq{JC!Y97v!oVnzjmsygrAdjW5z{{NF zMO3q@XsV(P$}$`2ZxGoy$LRTRj^t1yW@>6n_bKzebv^NT6qA(wYDX>my2)-Uy=;}# zV|=%LXg7<$!&bIZ3501P<{=s+_VEy%^z0)dYtSZjdxEkpwV=I-zh^Zsx$0A({cXtZ z{P@PG-XFK1dIy0`qnOGZU}AKmD_N|^)%bEG48v&SZZ)Jp%6oi^`VhuEmkPYT)%2Kw^zk67pQjsv3Cd$ohx^w#Lci;wSKDXgv3lAfqR2isq~ zdG)gQN>EV=t#_g(!H&pT)FiKlD}fFZY_N`_6bM`25B0^l73>+5{(e0!sdsg_{kfVjDV?Xu{I7cM9>I!j-MSf$n)PC6PYTkTh>+2 zMtW&ug7;gakZw#z<*F0NIj)f1E)hJqj^wCa^^4$ z0za&MR`|S8u0a`=8O!Ua5mAwe*bP*OY@}rLd`L-hD4iJ~^v}HjET$tAkdho_qZwPN z%PpWpRb?|!maz2(qHfh*t551Ves&BgwNGXEG0$hPf>qDL2fVnTAc`lYpY#OL9OM|Q z&7vF*z+>_{N^7P-1WBPYv}PVekepebTd^n#sWn`LEY6|xUlm2HOv^0y^O85h4KR*u zh+y=55J7S%x7xTD;8L5(bdsc`qLv$!=gn7_22rEvU^)=IA!`88ldQzj#?J$Jnrf1x zT6!Z79E8FERBdWE$jp@sUC6A-S5=>GlUK{9&;MZtzpGa2Qt)3-Mjlea?R%x8(Qt z8=)aln3(IA`sw`}Wg-v<0ECiINGQOY#d_$wisNnK#n-#Lm!<$44H-&8vqFf_Ey|s~ z0=@t2Au%Qg_qiJ;dh_Ks5@K*MRV68LhC!JJ7$j#-vOF%+inByO5n)+1EH9IoRYejf z^7fuZ>4+n20|uk#0}PTwxebbY0iVQH`j}3;GPzIq*n(Zg#K9VAFL|H7(L}V=QEGl= zns;j~O^@QkTX9d)D%FaJA^+@N4&we>Je%(|*TEji>+M%>z1sl#wlhtA^b;H|2++(3 z9R4AeOG?G20PIMiGqh|Tz>b_b2Ea}prA&ydP^~_TI^rx!W1f^5FS&4gyRi+hi=Pi* zM-JuGvXKRhYZ*DfsFsZ_*r8>ls6)#z^sDhRZ(eyXAV9oW?SSt6m9?K=nr_w@f>s9| zKr01$9j#SiIY$;e+D(TXpr=oEDXKXNkHVUF3+d%y z?DIf>jy^fCq3%aw2@NJ+^@>=;P_hR`Vk-s+o_aikyfd!2ja2)A2j+>_@Z!~{cP|am zvMC7GN1Fma)2ov~|vN28bG##ZePvaZ%K<8(kCI5V!dGAa3MP zZbL#zz2R$Kffx5>DKC~J&oU`LdPN^wuj`PfL~ncCg+_Bctuf_gSiO+MYmbcGXyzGo zJ=CnHli6Pk7*;nF{)>0Fm0HR-wfD;{VvzN}?(S}}4$t(|mH)o>-mV|SBlcyeF&}1V zJ$jb0EAO}EcEg#XJv(e!c|^El5`ktCcx*#zwrEs}t42P9C&Ps-@A}HF$log<@f&%I z-{-QYQrqMgeOuqH-&{4W)~p z4@yT4Re@~bzhldnDRCwbol+fb|P@OD|A1%JfTdvu@|9s{U=z+)FRN!UIq12iOx{BNa}7URZI@4!b-KL8Hz{(4 zb(#myBWDg9UZ-JMv&8pf7AH}~q^laUG_LbB6j_t-k;sP)&x@ZAo<|PlwoYV!>NBkq zB|jec7+J5&I#Hs(tLS+j*OzIVPY z?xYuT2RE$!$)$#Oi${RswB=UCB=%b3J@P*nkJ3@us}afgVeEZm1NkcNkB zfDT+irXTmPjH|siaQ*E`g%<^lTd<;ycB435{o=|)(%}ARzC>=i7I0Ucz~ScNZ+lu`lqj?V)WnwV!^bCq5mmR83-SAl|@ee)y#>dQg#$ zoeV2S)dPyZ!$&et)UD;K_I4|z7DLEA=%Kcrcx?7pkk^2tf{*ERtl=@fU3BtlghXvf zHu&Vdc>U(~>&rerioMs4P=v=~olbw0V%h$Mx+Uzb8*TPjZ}wP=&uRUjT2<>U z6&1a_-8Ct4hC!K!P9$fpn>ee(x?o|R2P`gwij_$nFp5kSaV`F7mTuWgqvjzcd;>;iZ*OLTaurM-byaZm2sT z$@$bA^5Pr$KflIWT9qC+(mh@H3I&6U^#DCk}8D^FPYpKm}xj=W!;ylO11 zDt-l%?)wQDXteemqBJoEXtxD{Q}+)_WvO@JIA^EB3FCQiLULw55Gl{&S{|%*!{Ruq zSzZ)S4-jNQUdtm_Bu<4*Y&c=^d~iZ?D5t`bQci^>rA8h1u~iP(f9z~_T7w?dg!yMY9W4L?kt4}M4v7lY86B`k_1J1hUAwP6Yrw-nFweDz z4+3JJeZs-bPI>o0nMGagtw6Uqn6ETGNGg2YiVo;PO{LBFE7OO39}n!EkSlM8yc~S> zyF;PfAqHEQED2OKf`M-aRH|mb2`*#FKY)CJb(j47o3~6 zBx*r6SmKdCdG`YNJGW2;i1-B<5*+}YZIkN-MZA`~1TyRJbi;4%{`Q*!GQdScy^7P% zX!2-WUi14dffh1pKy+aYADs_awOp6|WcUbu2c>K8wIUS3?j`EIL-J6MCD$U5leJG` zC=hhd2!vNOI|r&52=$qD?V%DIh7X_^+FJ=ePt!_^=fRrY{Guk-2*y>cw;j_zU=@tX z@VO}1CAllfVntHo48t}Lb4kuzhIJ4I31=b*ViuP?Vny8~EKfvLS9MX=BfMaVjk!#o z4|7Ql|Wz=yl)93sztSTfw%=&+$sW>)onS8CGf5 zt_BNt*g%rQ9b19Xxz`(@%+ypSGMP=_qeqKcJqU9eR8T&3R>L0FIY zRyLqBp^#ZUOQlvbi0wTY6G%$Bwl_(yHss6T;L|%6ac~M7*DQfn63jf-H^_r&tz&|^^cU!D z_r_3xz@TS6i?P39!z*F>kpBtYdH_fSb%MZhOsLNk zUO7_e4E31@ZzE?;{3waD3cB}Zg2h#uLJL36vY_#spb|k^yBl^SHoPq%8O<(KA8MRS z)Q1FPIn`$}zKxW0sSk;XQw-YDeuLSU+i>qj2gxOc4CUUN+fT#}ox;0D3Z1b-=YhV+ znIjQF=}FA0Jd41<$BdV9n}&5-1xb?xVc}+wN^H_Z0L{5WC*!|J zN!Jb~aXyfE?Sq>Oe0xuZcnM%%i)(Rx1x*tcn%Nx9a~~kMf-Jj4+>a}pJ~NTq*LL%*`P76B`wGGJ*H26a~OqDl>GRAf%{X;|ibjNl5Ca3pIcm=MoJd`&yo<0h6h`NJ*Dv zr(|xikKRTohIsM+$Tv6;&SUKxGIe;1uG<;6c?kG-Ppj%-)2@&>G~-Sy3iM zUJKS#Ndc`=A^um@EDTCN%l#;AMrtNf8?BL&d`A~s%sE6X+#A^j38ZAw`@)S(jdRIHru*ETzmcgi z#y7Hac48w_G7#0)?t)zKw$l`w#Lk?;tV0T&u`}modC8egoQy?HAU)bdj zJ5`dG?mJy-XL(acy7aN_ZeO3fGpTVd*_qTBuYvpgi{U;ewj`a29ov#)uYlNJ!9M5x_`76J>vsY>kb%XvUZku&!8yrdsFb1kBRSH56b1#Pl)S&fVLS(|@CHf!N#RguB%cAJ)-?&cIx1 zzU4q~;l22``|V!??Pf%eIj-16f4OqgYzvFx5cUI`vr+ zL_A94qVUs^%b1;QOC5{~7wy|;$hMJVoV#!7ZcAhPcI+)+bquk2DcRmIs|Isl74^a& zo5hx5*CU7eXvG@5A2@AXxKIdjSD2-~9}M?{>}g5`D28Run` zWKf>QM@|JhQ<#!1hc48vXUG(iW1Op9lXHfnZ^5NqBwxhP%B0`FxIw|uA=HcHu2^$u zg9?i=3B-QeTL~BwFu`c`Foeogq8c2bBCCb-`h0F6``ZRc0uD zIM}s!OZ?{QXcoOPRj2)E77iSYnr-ZA4|s58+X2&oq4zWIKD?3-@@wloh~?Vuir6DN zA!H5}Nmgg_MTd|H2wdpc#))O>UWzb9>0v&PklwEoJ$H^ zp%bmhSvQ*}tg4Vwa)8b0uWYkeE~!#&dKb7({^=R&bY6yf3HD4&GXsh*Vw{3yTw9=yxr#(5$p{{W=9!3-4qS+xtT8<3&%)t@ogW4cE`a55O z`U5q3za%4wjUYMHCm6OgE>*hfTdvr3hQPeOho3qK1-1QmFRkWsiNCbxff`OEicr+k z%O{1ZI_M)u=rj46T>4B3jq7tZBc1 z0&Jjf*G# zlwT1#DjLuW%~aJf4WGL*LNFBC4ry^Xm@W;cc(M9O#+jzeed(Mr3s}49ZeS}Rvi86zR)N1&gT00hxtZIeTkn^p! z4_aWcLV?4{bUAgq0!aUELz%8A01i^<4AV6O!0};ReB5-c`Szi^QGW4YsN^@p6jMKC zt*9A!D#|EoQs(=KysFhj$civeS(YYAnuT>5gzo4^W+O*3vdh$k*6JCMBjgz8S*yvI zk6h4=pvuMWNbJU;D7P;x9%nSO{7zW^+5+-)m~2E z+HlUogC4tWa-9MhWKA^GlwkM4RJ7*QHHmz=PTMpc!jsK_@O&5-Ki{oV7-*)*0vU%b z!8Wb@4TJBQZRDG#%oO$XbsQA|^x%VDTr4h1>9nQNsmiJ{591_G12JNzY#32SQYgIo zGHRMgq6vKgIEm|i;}U#xcSjhZahMWegB%Y?m>oBN#v7m(*x;ED@5m6UK)cE}(3Bl| zuo#g8)lAwrFp)lr$Z3AU%$B6xg<9dyTztFw+WGX9P9a z9{rNtO0Ddv+loh|hUVUGrP^U0&1M<{K|NOAShtfd5%NDEg$wVUoW*L@e#d`ad;e2M zQBLO~ANwO|$YL&ZjZE1}YrWEJpuHD}t6{2{g|&RjqD+BbkwRx!lo{}=598u4iy|%m z0%**R?rO@MRJb2m$Jeaii#PwHlg7Og|9zj}{FI7(a=ex}4gI>xGbV~ynwm=FERVyK zHIYa~QfFnIyZJaX8yl99t**{6HDrgdF;hcMdi&}fVQR*)XN0M7JRo6e+>OurAh3z3 zNHu|%RSUTRo^(T)mG?m&+kc`m>8gus{M2p#DQ|d7-n$Kd6xbO;8JKo0R!r>{=|WTw z(rr=?DXmJoRJI1xT+InpY26lCZ52nB4jIFI7DWrGwNuz6NTD;db_THQ!??K7+IxAH z?@Clw{Nipv8M$j`esVmPRIEf4Ma|MMu35|*!HS?Rm zvqd*wwWz`lv=Fnz5tVFtTk)T@!>;YFJOVEp2EK~4>y4#CUjLGZ|#>mX~=CMp<@ zfNL`6AuFPwVTs^%BuWuQJa;Rh4Z+LECQN52AtgIk38`^=`3)_9>yRJUL6UOgJRPLO ze}(YgkPfi%VqCWW6E*MS3=&GA$i%r z3xmd#>fKT2-xLTPDKw%TpB$o9T;?JOGP$Y!lErmdGcFRJWo4B#T<-iLaJNRtYz$mR zqOQ)^-jwXz?d?F7owdCuW8vs0!fh#c_`iS9J(T(kAnhSigPH4BUw{o2fU3QE-w|4O zd0lhtpro;FS6;c>njH8~svXmjC?wS}e0BgFZ4X0YNm=91-vS7Wx5CS;|&i-a3gCIpZ9i0V(`2E`HYiRt5CMs>48lR)01? zF<4LS$c&w3Mv18?8udoXGzsD`s#u;RA&bMhWITxzmQ+B5=*u5wBL>ihI%Z^(qcaR3 zB|FyuQsbU$04GBpNlA0Q6Q+)2hItSxt?jz{*^XrYufESj^{^1q6dX~osB|87a_G6J zO*chjnhrHnwWimNEe!NP|4`YgzpMHy$UNYTYQzOJX6hjdh9Is+tF#gWN$Cn&z*T5y z)rMEr@RDUHdf0*DzUPRCmEny7&=KJFP!?tiRSYR~hK-qlvHUPDeo+iQGGD$ZFv0^>Wvp5^0%zxAZ;S$+6kjEe*ar>@0LZ_>NsOC+7#>fTYxBJMv~ zZ{KvE99XJ+#(&@n3Da_UKPpn>48t-575QOY++|plWf1C1*ua-?BfVMHg&q68UNPP= zesbX+&}x zubGpLqsEO0DLd1MkmH_dL`eBjBSK0JX5-c0es>f!Ii@z(qi^EL`;N#c-L663St_xC z4!7_b=|@N{+=wkW6dT=}N>wbG3sl$kSms)O^l81-ASfNk`|9XJ{flFrBvT?OF|MQe zJmMm9<~l4RKPVDb2EeMp^M>&>3t5<#VHpQ$!813pb8ce{bF%Bw8Ja+10%vLhHSW2Z zFd1z~N?Hf#Cvoa^ymJVD5n^+6;2a+?CeEN6nQO0G{K>&{yTU6qaf^rR_;Aa=eSJ6- zI^v!7#KHb5w;VBqN6YBs-T$Y~H5{c~Q}B4C&>0Fgk5Gx6*-x4v@TG2ri7)+CAGYz3tKgFQq;7wGD98?pZ$=EDv2j z_A58aGq<5v`3&e4DLYpwsd3L$%E|Oxq~uv{EhP*U9B+7RO#FhhkvcRRfU79c{P12yr_8a^H z6InkkmwhG)Ub!h!16hRx{lY5&So2Lke7mxT_FgphO&S)6sVL}D@cs*?$Y0;8ynEG3 zjgzj!HO!+ipHih?Ql5f~mX0t!6R}?(l<0rOq%-+QewgH_v~W6;f<;aTrBkZ#LxVf` zJqJ*<2kDrlP@qh#l?R#%tmnY8*dB{XeGbjVV$b9ZEIWX2>Ac-mF5&O0D<-T#dI5h3 z{vErDtE!2+n;64X_F>oI^LwveLvmSu?$zC!JMaJXnevTend3`_t^m*;%+Z*aIWN>p&m-TjN@I81D?TG#Ly?N{*N%O6;8muo->t zp?OyBx8IfsTJ6a=de$866{vc9T{3dz9dzt?XFmN#eHzB<>ru>5I08ByS4X}_yN`ua z#zg`1-haLW7T2xHNPBm?g)UwDUCy(Ww&%Un-@A%0ha&xcM#2VN4wfTD&agrAz;a{a zQ*97O;{ex8JQEmSJ=Nuf7aX!7SsMFc69lZPX*||2tNfCI4jhKv=BPEZr0FEmTIflY-w4#GhgHfkF_W-d&Dzk1|Kw_<&Kgj#uPLQnb=fMh{t5Bt8gR}a&}*|4~U>(Y3uC0ftu zv*pz{L=&r9j=}?)RFx(v6KNh(1x!%j=sjt zM$|2I8}%BMyBr9^dZG|*BY{9@*;e0rJ0lI;arV>je5h1t{}Gb|RX<+XwpT!>-qThT zR(pdbM|+Dzy9b-Z`2CdGx*T*zikxA#=7H|U#Aj5*_s58J*)l&HyHODqg5*uC(jXQ^ z!qP0wSX@G9znsUcD3U0NqME0rJEBwAIJ{y84v&CEZsiQp^-7 z4WI~gXmk-1=)buFfl>}Z5^!PG(y4%G4SEr4Q2|EJJG#JoT_sk)m<$#83MY*4ildvC z%}!{DM2_l$4(HwXu8iR^o?W%ufLA03G(O((^7g$xRoai0PDEvrdj&vH)*>s};qwvp z$+?wI+b2?F+&&fas1?V=|B070@}&e#7G*(Juv}yfi$%a0kNk>>gs0MbiTomTcQz<& zEMzeQ3rWh(wMNvq=USu5SV&TG@K-*_1LQSd0^!yv(&%@NK|Z$K_Jo-@%Qn0KQ}yzc zg6djkkM}v~_g|nrU!F)z{7avX$+u5Ua{(>$`nx}E|)r*T)_!^?R{PW z3uL#rU%^#uRjEGkoho2Zq=v{xRGO*QR^G~Fw{&slAByAv6=bh^R9zNL5i1l&>B>#` z`Tp=P?###bpYZN)zfoB&=cXg<)^r?aF^^YqO#HuAl@$4&c$Sw@9R(~3GM~k96S6X? zGnOU+4~r(Qs>V${RM@D~Vg~Azl$~qJsBzCVWs^~-q~t}WjHL9lh~MSCNNx>`LrXg$ zwO+B7)g~eR!B$N|`CPAwP`>Hd&|)4obWHprgC8EvsJrdD9_|48|i;e(l_eW z1U!j@EDl(bM-hvgGG<&v6$|Soi=!Y-s%YdQV}n4886Z$ncCNm;P>kp3+hhj_Uc1(WsK0;gu8vH^;g66<;bnh$7?w)ejLQM8q{taIV_s`o za^_sRv}sXA%+G{WNl^u?Y#In5iZCmsbK8iK^VSB87Bc{&r0iUkbhfBHLnS8zMoCGn zlBkVeU%z?-I_WxqNyuyKt>n&mT>RN{amc&okeNh==RHb}LnXNO{wBoQJJdxFHKwo4 zQ2JwOC!{Uau#1h?{#YF=7ojtk<1$H+GjwJKC*Oy0@qhj~OTC(^6n;{cf`xuj%S&tF zOaDF2SeE5+7}r6NW^U5J!p3(NGw_|H>|CXuiSH!k$CY{-zLOODpFIJZc5F{Ov|W$N zJn8Zx)y{5(T-hcTwcfOUE*{~xh^s~dULf~hlPB5~RzOnd4E>x3p&Sz*r_1R0`lb&X z-SqE^_3w-Ii4;NusfTaE&<}jyXSE;8W7X#=<5|I3omF+^2W4F6sapeWC}S}L%1Fx2 z)xeohMpAxU1IM6@4i}da?Q0wifBmtuXu`Xuoz80aSOUBdaMM7bQMbTCtrAqbb&WV8 z^CQzz@PIpD(b$(~WV~1Cp&zX|Vv$1YU@_;f<;C`4BZP{{ixu+c9xP4z^Gn$DIGn(~ z9Wczg#Xcgy8}{(j0gEs4EGiN~1rwLA#8i^$?vcn3vTlC}-HC0pQw}&5U-PN(r&?gIWOX$d_#-R%=I*7v*aFuh#0-E4jZ6Vvj?*MX z&MA(2j(s9Fn8x+rZ&)rP%+#3{8pv><0i|S{3E?wT4_F zrT&)#D@l@jkE#2f zmYuin>2c57_q6=jzNaP6IaO$Bv-33+qG^}Q_6L^on1~Yq@O8teqiB@Dp%-}4 z|G)O=Quyejf@v5kEGX5e_&?JgP-_x(oR&qDu_A~Bi~S&HMU{pukBW$wew2wM za@&K@wg=O3Q?%?{doT|-Maz%dgR|NC92SA(8dSk3?2S02c}{>jP|b+@U#os|lwQU7 zj!Gz5H@V)BbifJ*U%>?sn}mdZz?eaHO>>7p}pel1m~ z`P|)ySCqV;t&u!`R zrhZaK+*u`%_=&CM(@|8k>|8A;*W}dlsn{u6@?0&azWkYlGft%uvE zwLnZ&-;WN8eIN;{8zew+_7eD)vSXH(OerK#nXN(ZM17rs@{C#%o zCydW6fbvEW+T#!9($NZ<_ps-tV9k`gjj}|$@4$Q)y zjf(%n*}W}BiDR<9Q6dTY%_TwM$9bADp80~s4fk0YHw}wK8Wv$5r?tC{P2y*^(U=Zg zqh;qB4RTFRqcIh(MoXS+H0TDx2IsANvFSL(p?beSvO9|&=IX?K#r*6}QBlC9BM%owg`W9d6#NXZK}Pm2G0XB*T86jPjc`K z;BK_|ut<+%n28BHaxt`v7CFO?%z$=%a?Bj?Dy*f#v8pID;JHg#$%CAQQ5kT-vpg+E z;(xiVhtrW$wCo$;3i!O<$}j!zXyXZeqvZdMKd%3}D!Wtd)o(}UB~;BN;)?8%q;-n4 zQbCt=gQvSK-)xywS8cGdhmg~3vRo;wKp6TcXzi#nuV|SI=09gWwpg-Wl zT|&zu1DKCT}zH#;9wB2NTf2)${j{Dx@}O-CL%V>Z-qT z;zUDu?L{A<`^6L>+%Du*N4~$OmtaEV6M>isjT`e}8mmi_fmKmhSP?u@hcx-RNo^%1 z#7qu|fgiX}=)eYH1v5Zcr0jd_7N>7) z5U%V_-B910F#@5kP^M++za9?VInF7pr(8nuVQtP6;Ya&RXtJ}5ZI`x zUEfVMy@zI@s)s?K`@ zDyDh`;a|Nk(wPG%^~&pGzvYu=b5x)Ece#(Y8xS@PN#4Y7)GbimDqr2|+wtA2j~^%> za0(oX6gop|XTYI8IcClhpO*nInI8fDLy^?1h~;@zxmQ6jW}T;?e)=-Xv6xJ=dF4^a|I@ov#>7X6-vHdsIZ_8vC>_-3Y7 zJc7igl1Ds)qVs#GPB3jbG4;S|bGh6H1rjPqy{{-txJbf8 ze!)=;E@R4gB0?4h5wAp6mO(gj5ZQpBUYTyMD`a?ZzA<87KdCjssg-AwFu_B8&YofCB{ivx5H&b8| z*w~d|26ly%JzsyuMj-TuT(nz%D6vuf8DS_I+PT?!bf61%D@gbha(hGLwG{$cb*6w& zmkIPkw9pwR);tKvnD~Fu6N_dnD$*^>$>pi;i|4!W)4OSrOC z^V1ve#`~MtltS*eo4YTc-v0dAd(q)1P=2i%9?CQC=Q}y>dv7J~+wDT5v;@%TEV{>+ zUcD2bLsZdonwj z82jXS-Y^RCfb*CI8FYzGiEsto z0vn4H%)sK1vghmO*a(Dfl8bihCM7oNACt@6^NV|D`17ls-1J6Q2e%kF3V{7&uPZU+ zv3K3JecZo)PkLReL4mun1?|jX9l*~q)r>gi&T21Matz~ z&l48pO`Id;Pwr&1O+p)k63)P&kg{j*_0bVd?{#|7&b>~GjqP=MnWyf6fX+C*1<7$- zTaXkQ--6*hUzQ22`T$4w$9X5|> zaId6E72bR8Q=1I(od%)rWs?Y-ORn0v;irQx!Wp28PmYnCU~!fPtf-Qd zHAR>gL0QCMRYQ1;k$&<1)!j?$LfPMgaYFFVAwDWr7P??$NCheA51YXy z-#!3}R@FLbN8J1MVSzkk>HvW*nLyo-3x9Pd1-F2CEZ6?7V+CBkxbjp1%X9<^AbJyLaH! zyg$9n6UWWn4j=d(hZwmXcvK$&TRPZQUHn%ovx+tp`uWNaUVDEi%8Pw#e+Bj!oH1V4 z-b(!N#3PXD2}N&vYW|+sN6iI|7M4$@359B}w9{eTcDF)uvEd4WRWI!dM6BWtC3__G z(PSIEC{5s`Ro#(~0eL;e$%)#3m=vgde*oJED|z+J#9zfDUo86$%qO3gI((*}BuJq% zRDT8o$S23le$WI#nKdlRYhYtf;L4PxEUrZr6uhh>F%l!NAq(LQ$O0+*ai}stZgGWb zvFi*7OF%AWME2Gp`<JpB8-U5X7zcrIkDO=~Q6`VI`>1ga(w0Kjr%b8*ucJ)-ct= z)?xQ-zqq~u*PfmZWeDd%8OFpf%UkvogshY1Ot5xy&sVxO?EgLtAIH0~!?{=b*wG7RGDUAeA*6`F?>g=0^Gs_0!FgBgqg0 z%HA7=vS-pE;5U6amDJKbwIx_)$aiFFF&IGASzHF3abK!xT_kl9R~aDH-KuIs3&I)D z0#bIes*;O2Lsco+QB`%kf%8In` zoB=x^Whd(`xtKHbmXaOSTgMwXsyC*X0?0w$DsH9!y=%7|7$Y}`+ED>WzCq~BzTR0k zTGzLPd!;J(-AMOFcu8pE#a)MJku$V$1`OfDxcK<#s=&EJ=`n7| z&CTGB=uhnVy*h-wRB{AC@z# zbh*Riwr0!eQx9+ULs>w^(ReEX0T{k{B7!gELP^>SQes>)qj~5Ia^_0J4KKrn#Ze?r zr8+4XPk6ziI`E@V_>m~xoQ08%&LEd}&h{rCZR++X7jwq;r({RBzvB&@eJYWIyl*VO z5AJX$8iiaPF%tj&@uyC8xgL5;qW<(pQwt0>@KJT%JxDbvA<-wVl=55?^);*oecprQ9>793ly(c}ft*9OEYLP_j z_~{UmXdVg1nD~sa%Hsl~UE1%14h`}O3k4fc&0!jwG5vZkx~Y+`OQa(7(;#C}nx`!0 zP0Wg{2w0OBQNn93k4krhC9-iZ(G1)RDLYwB$;F(Zrj+ccno@!`r`!I?`0Iu@&7x9| zd8!=monzQO#A3R-YWAlszen#6so$V_;=bMJaQPl3l%k2ki`-wl*Nf%y*Y?W0g?@Zn zeB&?V7(JQBZ>z=j<(2o=in+Y_(o??ySshZ<-O4pB+co@Ne)?DFP4WWjq2X^=-Ybhx z2Y&K$|3{yHtl(2}*#8vO_LEc%;-EopBZ zBBR9J^rF=&wbsAp)wkU#^2m3NA$}3dwW+&Obc_4^ihUKyfJjjDm{XiOaW8N0LyDZC zI`cR`#>6L*=<8D!U)L$_{6pTU3xlKN`wAiY0{d4$`xDK; z{*bblsvFr%h*r1B9e+qk4FDRnZlF$ez=Fu(6f8*lwWm6F^$e(rDfzSX)RuBK`P19i zVXvZBDnv5?hODy=LowYJ!EY;<*J(Lm zH`X$$Wl!H`P_3(9&v68(mjl?U< z$Pang$V+Pk%{615$m?sACafx;OLbcDFdT^$*(jZ821>LC@}BrJ@Re!Ai5r}eX7}e-}G)M^r5!z<;`VCkux^$3^>jw$INk9M_DL+ zIUezh#Yx?;vT0Hl1X(1qCX5T=PQOJq!X=u4a3N(c-Mr)D5Sw>$KNfmQvwO!7r{oB? zEp$=Go0sl&gzv#R8TuHE-9KITb5%8I;!h5q%#~N;V5SrL?bp}0s-3L1zX0^_ECE&u_$d{RBwhi5ukh2k1#ckge_P*l@d`u)33lIduhXdc>T zO#GkNbe4Q6Ra9lXtbCRQP%$0nDa(sU{>>Lb9@J@)L?ih?8(tI5fY*?+m)eQ(aR@tc zc^4U{h`#jc^%C}h9zZ*2rgL*GzTa#i17WIERZ4x;wtp9z9UMAvKyM{@OReg1&wavgMXZ#oDjn#XiO&dlQ?sGBNg1rXcEVGzj+Rgf_u8o!8(rifEF3r%E0PNEr* z6H@lly*xe+v6rX9Oz0WUKJrNN3w4_^6mOVGQ%n|cB$ZFd7qy>1 z02uV4l_%8o(N7d-M%TArHl4vtWm{*eUX`HkhtU_n_2(2M9EZ9(%&}v#!z}qH8+mr^ zz2AE4-BuUbDN1T{bj#aQjlE%e*(>R+R$L#jPk7pH#P=31d8%R%3M*Dm=;W#t;;vq7 zk00eHC=|rzYJ^@-A@(4J&QR@n#2)0#W#%Vokmf863MevsC5VVzV(mAH$g zVjH#+&w#CvvKOlM8RMK*ZBlSdwdoo6f|OL2o)rJBSEb+9H7JTsV}Qa`@G_MXDHVB# zN-(4lcldb~Mv-S3GLS*k0r(blstY?Pp)+d?KqtqPE)v*@jkw=I6TvlH0HN0Ev=Yz{ z?oa|!Xj}>68Q_%<&k>7+^GYC-~g)*6X`}JjxB>7t6IzaXvR)-Cj7f$I-7Adb; zoX39Nhz!_w+!|^lYvLKm8dCOB4ILkc(9o%98hXajXo+J^?Fd@XFs!fT9kj~qSF}&f z`TAilsf_@l)*HO90W+S=> zn|6g#Uh2U}&y?FyT2vppc%-EVhq`;d@QOSw*?jxQldgp*s@0>~%~92sLv>-$LF=^q)-fKv4- zL^7n%8QMM%1vDl;D<}EbZ`OZ6UXpxgf$oaK5~zlZg}g@RMOCrN>WbsG1~wEZo&g0S zWiPb`xs5cer)_U0#WJh4klU2lh@yA~qKK5e z)Rc^Xd}vcb367c)O7NK1z!_zx#yMTGId~mv26a7G`fmbTO7rEJwLneY2ml%&+sU4! zj#FvNqx}w`mD5ZLb_qZGAwTJLVhiJR>Qk8LwV)1bH7u_mAh%ShOHIQ&sg#R$sZEdo zq!f0UChWl!0wGf942v)i`ZOl)vIzJy4H@JcY0=@;Fge#ozO&7)0$ev6?tlbpkbL$; z_by@yR(8g9%!)h_EVOzTxpmxzF~u`rOr-3kI!=x=rsI_0sE&`!cm;?faR2^5l!G${ zKn(>N{YKr<(F@ledruIgXYlkC_MO7?MmA@)@h5sLk%~?q4z618DSNT-+$K)X@hxd7(D`>F|h8 zZgfHruLU*-29qXKn%Nuu&fz2SwKM(N;h(F;8vmod0H(hHW`6-UC1>lKAdjLW29*E9 z-uw5sjVtNGUq#pjb`qeOSihw`*!Lon?#Tov$z+qv4DP;ov7jWXTPJSYYuV}a`Sh1n zBqiGIB5mp9-TmVNyK~arE|QX2#bVV{PYu?9dV#6#0>KhM4kuAovNCR4R#;si+}6Ox zOC>Y#Ql#vq*1&^aqOHMHyp(T7->rcX|ESz<>EQpD^zPvlR{ptBXM_}MRLD@?QF#+r zO{R4Kj!=@znTSY{GgM?AHp(Y%4!>JzHTD&rb@=Qr<%@um4S!&t@muNfVEcUsZ@rV( z+}&1)m(Wb+<*RQ{X2{;@lkJN*sSY0;FCx<|Bv{MKj3u@F4{wTsrB(|Gx5nCdsAL8n zij=)nW65!R8cPX!ag)9&uYy;fKN+=E5Pd>n$tCR7S@lWu9drqjn)C_ppw_){C)eeZFy@%bi*YY^qLlWzHfb(mAS-v@|#Ne~MT**b$YpF+%&-LwC)1RDJMkCs8 zr3f<>xAd!qD{hrvOfl$~O`|Nplomy#&>1#h9($2b{DS&770-GQ%OxA`wW6`=XbH8a zo;?W{ys4%0+f<2E`zUD{&+3FNQc*V|PwO-iZnd|eW62EY7%6+H+IxUpwAxQ=mgJjH zDhQ^H#L{(x^*2u1-2rQ@DTo7oIVgY|xogdILqci@6YB(a*N=ZXl|?f^OT4^dP)UA% za|hg?HFEu`r9g0NyWZd4t@p~@RHjyTxxVe{C--A{851PKE&Uc<8a*AamCR#6@`+y* zt(Mo+6&pUodj0*e(J`73o~B++p(#Kaq`c&fHB6*uE@D<%6rfIpPi;V1Is;Hf%3i4O z^f(@cCk1_%RZ{R=^fNhthLG@Ego6S)vXXAIu5)idTT!==0sD3!1duyQUTH1%Kts!| z0j1+c(&_GdsEqIK!EfNJ9Z+NIfOP;qf%fY4t+-oB>j&HzE*Lfa9XQmN6!NQYIuB{) z6Te7(lO=ClYd%3%vJR_Q(4%<~!z)+cC%t zCcp0xjco@uDP6l57)DB*p=k3clE|4CNmYncq%4f^X*P z_*FUsenrY&x_7B@{Ck&@^xik=wIAO%iOuT=U>)4dt-P`9ZyjMJ_e4Nn;i_5b}we zf)%;oEQ`Y`&l{e~TfbWeZO~IX1N217UaEuCIDQ?RCVAsp`(c#U749L&xcOc$_YGF| zD77-=CvCSB2NyN*UEWf6SY04}x!Wz5zefm>bnv=w-FA=6)ACRW-mYLweQ&%6TKQ!o zeN2w-r43V((W<^;;3wS+k`@-?v~c6jV(%NV2eoEOEs1n$FH%|ByU`6_f{K_ zq61QR%t8n4UTW>2D^Lf7Arz%9z|nrdXC&3Qg#%L&;USFYKuxS}_44akt>v*CE}})0 zEdmx?OHTn$S$X_weH!PZl!AH|+K-%$1xn{N6C-D?7f}v;eXLCu3GjE7tcv4?#buL4 zDG!q}b64M_HWDYDfy5zYFVzTY9KS|Ple}@Q{em-$8sms^M{mzprkj@;^`PM9)#vxm z75q-BkYVu|qZlg1vDd97J?TRF;atXlI$9>3hnDe)Uy>|n?&Xi*h95)UhFFpOgYqpe z^eL&=(>A=V!Zu~G5JLKtX~K9>m#h(05k|SFYEM2PwXrbi3@i*Od#OHppd}7{oF;kW zTKjp0HKhD6`tmj8@eRv@VesO^0j4sBSQw*{&lrxp15!TZ2J86k3X=M#Jw{8v|I{TM zn5gVw`Hxb;|NQh^qh}Sk7Os)s_;QaPtkrK^K?KxfuuwCFDKR&vonkf${z16LbhAEoY^UNpiGDUym>~9-Q`g@$N)LuR7IPYIt`-cf2gT<^iVRooj z5yy4f=w9qGOWH-lswQ2qY!NQnrWSSNGdnikD4l^fB4sZ%JJZOUt{sxzw1yXN<&o zuN~t7XJ(^sXN10zkKx1}&@(=%k&$b7^XFCY=c```#ifPwx`~v)WXdDV0`(g#BKh+z8T&45yoDTX)=Yf8F z;+Iv)LiLg68fOLrRM{|i)^=O@-j_=P0YttCC}Dx#WDJ^NVPV)UNz?VZb<#!v zr85vfr0i6kq{h4c@R?A>sq9g%seB1U2W=FbeMg04@w?ixm&R4Vxii;bd1M(HZK=3NFZpvn$n@HJ-#*7?~G-jlP z&zQNUGR90k#c6X!3d1E}Bu52xQY8RVnHtqreBbqVsv5!WZ2GJ>ZB3i8w*~-~#KvmB zfxg7>^K+FP!m-vs;N_d;dk*~$2_4FR{YJD~jAmtPPZ_#@4b?~T2i#9Jbt*o2zl`&u18l&FE10XPqj7p#UcD|U2|1A zf4f{)K%p-O3N}J)bwCf1hqd)G6n1zkbXlH|Mq{fwpKsS3DbEk8;UcnJ7);UIFQTsW8YU3sZy zk3L2v5DF_U-8)!^4JC0c=fDQ03j+B%peU>g8`p=mZ!K6cyF_>9-RKi0IUwr=FC{y; zQzUiw;UAtx*tVUJJq@)yvw&!9NHyj{qIr}=wJ`!(ov%2R zY>G74K&iwg6(K9pBD~&j_e&nCL~`ldLgCNj z##2)v9F$+53HXjl>6wFm6^#)bV_LZ1T<*Jo?lVphY*ZHZuA$Tpu2m zwTwY~L9c1=TH2`N5lZi(G-OJH|Cwp&dSwH88U|x4B-^LbvdsMvt>v7GLFRAzyih4D z)vB_AEVTJRy9H4+)9BH$)!j~Oh}W2;Y)j*^yDTwNYBcn24@RaGy?sX3MZ^~60_xfK z1@&VeP#w%9XYgB-EJUnm<=awnd7aaAypRcd?g&#;YNZB-c zzQY{=Gv-VG&I#?#w0F?m0NlFO6q9ro=QR&4sXos21KO72jJWN})_rN**$(WOW`)M$ zXS>Bn;o4F{JxUOG;q;6U6Ih#!>x<|oJb#enw^Ln_s6dR|V+r+JWoS)2y5-uID|he~ zne_rHC2=?RXNv_s>KuhnyiI~0#(e579}exJA9M$1fJ9G9%F0tg88f+CdIPDnkXnfI zpjHp1XvSz)`6gIaI-KB?sQ{wnTDe*{_RZBOP{i1;MiD-L6un&!dlZ-=$Bd%OQE#%? zSAiP!xjXCt!qc|$_^?}D$g#W_J`E~PsYZG`T?t=qpYDv%%7<{hBK2rLjPVY*1KCD! z+=Fv;DjSMEk8$;aUw+UKm%y~Z-+mykpnl9al#Tv8ebvfrJ@lFWwf`+)RMwn7r6q=! z68-U*V-91=14auhhYjGYAZW@Tz}K5Axgf886OlM4*k|PYxe-pE=V_Dq3JV5~YdmRL z@}G_s8h`ol_79+};of#Ls7_ba3&=7{X!v0zaQ4airYkW%YF2!hvZyeRq)9n+VfVP z?n-aJ$$MM{jE(qgMN6)1pBMtvJG0wDky9Kz;NxF+H$2)?U)n-#+hMh~>4@MVCW9jP zzO?q#)Jsn&j)`RkP-ii^yFbMY@J}Zxu47FQG!QJ*u}~{tD12B)%0tEmOvnQ~1k<4w zM24~iP1DH~kp#n}>dfPVLo${vh#hetQfB=8;~P+9!8o`7_^H&$S)MmvAZ57L@_;X*z8P^B!P(uoup9wH6e$zli)iPSJmX$Cksnjj)2$sX#KcI!4nf*<|_W$$PDk78)+*Ojiz*-}?i2n3U zASk`7h(hvw=N534J!7i8!eiUV0xQ7v^RdE$2)z4E{seCK8g2lX$}gitlAnYC0Z6iY z;V(Ra-_AgoV(+14OhJQxOBL(H_1?2~0e<3#VY5+{ONI;10l4?&>?;eu0 zp=BX^KD{rf-cGu7uj|y-b390HVN^f+Y%}0;_{Ar03!kNwFAcmy2Cpvyp>GkU2oDdBGE_wvLF8!(HV})|M=k>B(DS}SW*hxq8 zveQfuyzsIQOs$6N0suZ;9Dq+(k+$fDKTJx{U!9he#^*#)LC$)P@vXY8m1*bI3_9ZP zES)WBi%0cAu$IY#+0V9mqODI9+>5?X{6vZXDLMD8e1gVn;!KsUFQ zHV7QM$07vqI4g?tMjkYv?~yiB2JQ}9VtvS1!`S&B$OsFe&dnWZIXc=MvLTPGs%h95 z52;dI3w_OD>P{8CcB;@u4t5K^h~1i%_#Qkcvl0mWZ#7z#>u7Ni6PuHDId*w(A7j@eNk6!iJ-euzQ> zE!L(Lt#4#ur@n36jlZ5ydV$(X0)U%yWtIXELr))ou<=)0wJ`nv;QO zSCD$oR>||YYJ6>gz60e3&yE}@22CqoP1+BvQH{Qw*zn!7Qx1lMv7IP13zwXOlL<8M z2`3)gzIFBHVpOf>IN?mD{+jG%9PjUXb+jg?g~7)ucWVm z2InRjEPmy(aAl_ds*78Pg0C^gebh@GMvVFgp!LNH#x&EHvx3XbD@bGK>s$&S9C5N! zX9P~-84qZuqTBCWB+yj)i(D0dia>Re%3nNH!wL=&qrf5-qXPVuK~dzugVIbz=R1)L7uMVuF19-PtF z(@&3P!?LF}1(4_EF|C2{E#1z=e&Ha@C@JIVkzo-L+LMvaaJ;X1W4y1Vhb>y*Gd29a z9`L9vv+nYjw<-6R5RbUuPm_-ST%kQ*wTa?egtoVbXIUgfEv7o)h3UkD9ZNnD)V(O2 zGx1o?dEcAZeiy#wRgIz^^Lk9aU5)Zc6v}VP|M@sH4o#h2lpdA4zlV=3ghg{f0g5?< z2>|gm$D7G><&jR{Fg8)cfTjLSY^o3eD2$m7LU0^21H}Ml(kR%v`j`=IvBjw)e^Y5l zWb)G*L*h3;fIL%Ce7fv4qwDSSpuN=Z>ub`ft+kHH6^_NusRa zxYYnr7~CXQGd?VCSQN8F5myLmsr)h+PLi{+zI4d&~)Rof7XU{zT3ljvCYNJD9#JG(g$@-1F6daE0hGP8;{CdqJ;69VXH} zO*prWfLmMmkNpTvvSWkCpO@w?T$@g31l~N|2%onXBd|M?l(gmR?zjFskEyo_pxm(p zjijon2N2*0&9oyRd8f)kIB8nbK4icZ>s;ahru&?uy}jfD95F&d5(tC!GVJ5GHLJ&1 z95;v3zi;SGoz91-c~L)X5Scq9!>DHBLv{4*`5r1nf%lDviya=QJo!&AeCz}6u|@#F z>>s}{-h>nj?Am)Vm(T{pZ2Mkw!(Q`wV8X0`r8mSU4Qri*CNesm6Za(6a_;%@k}X`5 zL*Ov%CLtBKDyRieo;oOn@<6*TP`>&=bzg_t997%^2N(!^ws-#6iBnd^ zLVnON4`sgmr|(F)RCi8YStK=#m0A%MM|)(FYB~$CVhWiBbpjjbcF!o6jWB#9R-7yGn0QeV!+L_LJ#Ne?7pp8)OO zBwTR2Kqx^FyGx|U$C&_ zM+|d$VOdVVBxIb&+p0=x@bFk_0xhvFy5vX(iwqhW3*`1jM>qzIJ3^e)`LD>eumMAe zf;hnOUUaDSDJ2!zVYpjU>iQ0olyye@c6N1=naWbgQO*LGnDG}~hN ziW6mTI6G z0bj4XPjSL+MA-eePcIYXyH=w1q$EVDM04FDsY}G6BP$m}&|6vnUJ-l2j^9)typR2q z_TjyqdwL^_tZ)j8#Z(1#Dx_yRRJ?$R;Qnzdm35r%Z_py~33yUWNAYb545W9+Y@P{S zZiqJwciK-A)h8Sw1}e@_iW_5f9DR2Y(}<*R(jMo1VD>Y?zjt{9NLMn?1UKV;D@WRv z0Pd&fUkJa8K%?Up*+Gs|gdRGxF&MG$va zvKh=#o0-fXehK%cuJ|m#c+f&4wt4EvgCU zyLFH_teh*Bt|8V}W~ia=r&$JY+^Wm3JUCe~sT@a4v;7O-cGKF!GP zsEqTpf5}7jdw2Y2bKuL8k}q?q3?>lTQzWsnkL!5iw$Q!2ro@n=s3Ib&i!HCDJi7;3Ik*n|#8t1PAsPt;fgHT;S-2f~ zf*&y5-reLThlofFeTiFfAjolVNsQ~nzZ|WHkC!@}44x+_{JHZ8>wl}+dGFtkB1Q2# z-M+>k={LyjHpmU&5Q^=zgg#0+Qd`=9`DTjb24{^zuBNm(NtneaJXrmaA1wxq)eu&U zkTV1%HHf|k*HOA~1---DUtb_RN(CCur^LOsXKML+Mqyvo1m3CL-rgQ6Q)~6S^I1%# zI{xEl7#%C>ybg_zR7DOGQ{OYe7zt67i6@8)rqLdr#R0I|N<(l5UEvyvv;|y94&6|H zTjf^W>m0@KqmrJ^hlVy&eT9@LBue~!nQMlnn9Tv|TJK+GmIv}g z%m8%FtvA&it!1Ul96Bu=&e=x_v9b2GvYM*J!ZDBB#(>VA-uifzqZm_U(vxjn_%GU@ zphJjEl~H-A{2xzkcY&uKwOM}3ZGv6j+rdTzJN}-p+hfk=of6|l0HPT7s!PZ_m&3w* z(7v9s@bU;QA7T+@*rJCLC#SJx8Yd-8O#&_qofg?7jodwXv{)SOl2((GL|SaZV@co8 zbc&w{(CSm!sOa?fbl%QYrY)Vf{aJLP&r1@uqta>AKVF6p(P`}n0FJgpzaR>w{a0ed z9YDlv`Pf-^G`I}eb!B0G+9#R0L9eLF6-92!?TvzzJ^$c$c=t)V)uxwg00S^H1ViOY zDA(s6zutxu@cvB@xXDw+k+@dWCBn(@tamFQha z4(Mw5Y$MhN#htsM6XV_&ULNzI zdBxim&q4|`PiC!_%Lo(vjOlCf^=}g;l3nvlG7;fu^$%?D4ZYZDa71*#XW={SaL*dp zldP7&V8ljD8fNr;>WWPf64c&c#qiG@F2 zTur+6&763!bx)_yWjB^>rV5J6G#kRCM;g0Kqsw5B{@%Xx zX5g-8@bDs>#${KHFNW#L<}6YUzdZ(_C%Ow5W2+v83X36LWJTG2KEM6-tGQO_0`uL5 zZujVSt^a;0lKJrFik$@D9zbOAvIWfbRJ4EEifGtYUk&GGB`)pRH&s zNct=E9uHvoa+)Qxcn(K9o;NJ+H4v#W+z_OHUrp9lJ`F0dw1RA;_u`)N+H;!i?&9~&H;8FlT%Z)6se7nvvl4^ z{0kmnUau#nw(}d41wTc01#~HAe*3pZQ7qr~rgUiiPB|)d?ZuN%GtQ#>teei78>8qf zp;`S~R*E;$W|dgZ?;7`|qfjT=g>m=Rc_qNVNP(%?FtP-zESZ)9?h`IVW?Kp|9%-k} zjNlshxopp$T&|97F4Ad6XlCjHehyRk%7TbV5rIj5cm9L8Ov;0_VGG@2McUT@?m)0L z;ucm%kDOH^ZcUPMq;71^^3ibNsp|No)n>K!o6Mi8o6K)H+SI;C*F4|qU4apEU$I0( z5VX3det+bf@C|5HZi((nayJ+}c(=Ov5Zz=ryUuT#wgHltlt-KLKJYIV(rd@sfO=(!mY3uRq<9Hts zYIfln^MnUO#Xu#$^`Uqlbz_pQTMrt33(h}<<{@;~H z)5ygZ)P;CZz`RlheisZX$xxp<^L3cu7IhOwfs*+O$k|=A4@=wBv7I;OvXJ=R;s@eI zTovfv_uQQ4t$FO5pr-x+8s7b)PGCItW!)2|hs;rF->mQk`^jTK{UW z?RZukU%r4S_qE1n6#gg8i)#Wy?uT!l59pvvI~%C}+3<~je&km$xe^@VtEj{Oh3__2 zsg?vMyiKLhY^ozFD}~}6qkg{y054Qe_GtNoR5sn z<@>YJ4fY$zMA#>D%cJtCL0vxI$&Cj4NIKV}LJ#kOLvDVYb%>Hn-1R$NmQZCe^{jPx z*RrfbMJXQdFPlOLH5CtWr$0A7o?q&bHs=eo zm!_aR+F$qw{8!s0CE{pD)ookC7&JaKF9n~cKEp4aolh+vow#j12bF*3dZA#gnxBJ? zIO%&~vQXTZ90;tg)Kr$Nww%RuYc%b;LC@4)vd0^#Yv8gZ7Oc*<3ukm`&|~yFb)i9S zgn9{1u(+{q0t)_K4)GWK4z5R;C!2HWcVeCYRd^MA?0?CJluV2~&m>}i-$**ioHskJ zp%$X5G_u+_V}lR9!6O4X$ze>92{{@D|G-%O1V;DVRL$Uhop6h1UbN*p812d9O~55< z8wi()4IGvF>d5wSbya2_Xaq0YR9~Cz1#Hh&tM2m0)_!9NQ?{<=o7`7Aq?3Ht3E=D` zN3~YS+E?F)J=yM5$_PWn$bjHkbn@`Q05l$1jWmir9gJ4heTN|FKis8-VYm&6%?rN^ zgt;l4-SUQWEKB)1B=L&H-qT+yh!*-pi~rVRd)FtQ+#t`>#AZy-cjXAM|2+*fBiHy+ z@>2hC!>`-L7I=MeY}qxihI^W$eC`W~gc%J)71p%B<1Lrz<;v;bbCnlk%s<6l`Vwcc zR*24t>EMcm7&+=5|E^`IlJDJ=Pif*z_laR`^ftQ!svdi-jx$R^otkKSjT4_6Cq z)>mo1R-SQz9lxx7!zE``b1{c7sG+W;taY0x|5sw3h~;c=;;2epyEQO z=4?gfoH%5FCY(PPl5a`@)IA%L)9oO*U0fr2$63LWUtRilU*s;vQV_b1HR=~Rg(m31 z*4(oSTIa!~B@ZiuLr~&PU<*i5*ba2iL!LUHgAq94O5WM4OYG<}02Z@V+lNm`QH=L( zbb*$ryErN6$ND~LCggi}*@Gl=9hBIB0A2dhux|~hEDusnL@b~O0(dav4_y+6zjp-2 zwNo&vtP4`^SSlBy*d^oJnCJ814gk|^GhZ7=9|UX=hBAZp?f6?<+ug?j*vDF2W36FT z^JsW}*|VPnnRK5DX7xUgdBVBLT_BW>=hXike| z=48(nf!i7=rF6e419$y6yK)n8>^+Bpvyw4wx!cfdLHQanop553<3(=t9JHB!6JP-E zCzx~jz6(HFHR7%u%SCC^%%@2+mgb~-yu@t>YK2_8$X%TmEpQvRSJ!g^(!{}?J=7Os zQzb$de(kDUySe;bJ~8iZU(ZW8Z-t)?+n?Xh?JPLGU25UwGX(sbU2kyw4;QHn1pFw} zp1;K+00?0tGw0~rh!5qVW7Xa!&$1reM6)Tv%%8Pyok%JYmiTiVGSrkH`{Brjnv0NP zcPjaRw3V2(#mhn=tHyDg&{o2216YXkS}qL(Tw+d?mn@$t7jrt$()+C{*yx6`gBGO> ze`Ie}d8h-{{3-hmhvqyY%d&0});i6!SoCWmP+2_$t zk^k&vml5s3NEA0jlr@zk#U3eSG;>HXLzE5CZ}@{^%_yN`J!zCF|58 zna3KB{DHSY%KHo3ZV31l*tg}n@%2G%bG{DJQ7BZL3l9WsI#2+RKF&;zu(r)>WPlCm zqeYq(qN@@rS@$maHRQJ?WdfQ%0I22zrlTYaBILdzNSTZRB}#)v_H1H9-11u0K@ER8 zcbNzqOBsY=B?6Y^K8uVknBbyA@HzkKRUkY5O?A9K9M-~f4p))2Ss1Ga{)J7X`0}BP zhI>mElA8Z2e|fzuOF-LMYnbN^Y`=Ii)4R{CfbQqP4G+VJ_l!Cn$on=#@%$N#F1(IE z#SBaeUr{khD~Ih)ChNzcm=sld7Z6S?iHu}=zgWFR-Zvr`%nVRIxim&$1fFx^mAxGK zx}@mG36drB^}u#OLe0rP8c9|n@H-C zR!L;Um6P`=!u0=X4Ou^}u!raXD6v%Kqu490EDYJ=8WMcF6*D&yw2ocB)co-#TTB#D zda{~L*?s@=En`-Pr*^jQ>=~__L+1{P?(WP#o0ZeI(lA3)M1L4=-pzyZ|sMdR7$o%L< z5Y)GLOZ$BDy>eUn!D-{pq8udKiI6O0411dJw8U?0kn_t$!G>UG4f5Dpw+zf4z|yAx zIJ`y9k4{G(rPG1GGda1qj6vdVCG=n0sPV6+`=sgRd*C{_Tb$3)Jgw1T{*vyrGr4Lf zoe5Xx)@^`TE46Byzd;gprPRjOmYO~ClSoY_{DoX7Pw)ewJfA~hep$3Qwiew=D+8Jz zYD4ku{Zpsee8P2TQz@5jZW9Q_VuA-6aa2OY=r61FDt$?6Y_+BN712$mzLW!M=gQ(} zM`*LWEWplS$q8Kh|Gd2IML`Awe!rjTw=E5|<&F5K4m`wY$SBZfdO%*H|2v(?#HhdugO;m+x2n>{zW0JY_ zT$D|QDg#)#z@)Sy$8~6-f?f2#sEYYcZ_2vUlz)oiJEgOj6$#|7R0uMJG|1XZMOR*o z`>OJjF1dj_A8Q(D*-+WOsyv8Uo^`9Pyvbt|d^uEUGZY~@pj*cNX~Su`b}K)B+k>R? zd`#!_69RWXhWhPt!rMi2!3>o$TfVXwCEu~8elH4V=U>Nm=vmrrqcmh^Ti||5k^5@m z?74H)&bJx;Bpr&NZLBnws(9EHmB3}7s3lJOYcl1oOs9^i@`1}jG(qfofv3SiW)2n? zg^qizNJfD4f3E%b9~3N7DEzBo8(ynlOSf=)gSAc=@io=9`>Lj>H;RbrNRM3rVL{c? zA|Ykg>VqTPxG=k4h}K_IPOj8t2WnJ9O3yHScEsiu{+Ip3UTi3?^C!^EU1?c>`m$H= z*f@TlHE*Kbe)}0`{g9fek@uo!&lj~zCRu66)m&|)6SqV-^JO28eX{ vQdp3cXZ zN^q|e=WdQSSSWtp{Ge6Wtc-%R>_pvhJ`0Ki3B#eJiZsj|DpjRlNGa`PlXlzRk$AY) z2-Ci5Ktz}tg4myXWUNLDPnBFdlXghFF<9xa87nA_b(UN|$z z#CMH-fh@q42C4F*v7e`$t;WbySVzKfd-rt%F%zi{DJ0oAI+)SExUt{E zzRUhZ_Fr@Zj~X{#^+`EteB7Ro6LMgsq40zS$W1qDu`7UqZ}gZPTQclMe)s{>18c?-*DUoc8ZFGzC#Yr35qy(wO;` z?;>@mcB?LCyX_^o0BO|v76?0f6m)x2*M}kCArH&2hDBc=*w62ACvI~zML0_A)hJrXd%IB48L$lCr zoz8||?o9;GMdP2Vp#FtukzHzfj|~<&&DY%#B0*6K*)v?P{5j(sXU?&DTCFWwuTisC zU6CSb-t+0*biP-akBI64QAb2e797kk-T_h(*myDpl@ZXB(e-M-4ppL|Ekor7?lQC- ze{M9G`y0Cr5=6agNb<8;jiXPfbtmiFx^3Vs)@o>Z#ZfVRPt+?J8m2bv=s2b+LUkX6 zZwOGlsNeymc=<2m7V1v4lw9l;Ute_0nJ9(Z$bxFH#!|0xI$u4(hD=xBsisplu_(Z& z>LQprt!VNN>{TH{JeO4=BMIE`5UtU87sRuknue|{C1BpXesDk9OC!a1(c~RR-vMP? zeRrfj-yhzI!>}^r@ zr$|yf{EN4Tl-uqGQc+#mDU8zYSEpt4&hb;D zKdk>32>D$`zl^hs>(8wD-V`nLk4Io(*M|eVxYcLoNHDyyJQ0~Jnq7aSWggUVd_Dma z>wGh7Rv{XlYtU<|uiD#wYATXz;=IAoVW=1;OD%3C1>ZsQmQhX=_ayjav#H+zX`H|K znrnkg0WKA)P%!+bVf!MI$AFcxf5mIis%_Cry8=&615Rpt;d%Y8ZzF>d`%s1EcUg^~ z0eGtt3|selSw$FBvQ2lzvR7qiS{m0^w%QiTLyyChC!N+Cj(q?EdGg7lODq(H>M!tC zP1-I$)4Ssh+>MYcayEwh3$vh8g{Wi&u3$0=4ykS9>-#1%Jk*b=xiV$0nQ^6 zEisx_VG_&;NEX(@(T31I_Bk!_`+PPe;Mwb9Qr)__U58t3_;E_KO8e?j+BdIPbX=^n zhoYP7{a?!45SChj-;?Fh_aQk9uRgt>>h2fi!@XY%V&^EZukt@LmBn4leV-cnBXk)o zUAs`KPi#R1xmC|`zn+H8$qp$z|5=n3dd{njT|5}oX&cGaZ;W?_pLepc)CQV|CSCSQ z&3!=N4Px|LT#@L}gd-4=eNJG^^!)t{7`jPfstxI; zxQ=z8*P#>6;sNagEm@qdht4;5M*77V_iu2dBg&D z9=8x2FI%Plcx7`F?*_C?GI% zYl;sg6Ji!|aC3xf)3)q5L13ZaGF5Y4)yh6wB4KO=cSD9;QlnQzrV%g4#U>iuJ&J5U zJbI3sCvY<;n63uy^=~l2kX)6ne~%bNeC3$hD<5PcIK_Ozk}8nYd|ie8Em0;A(_a7l zlE_(np|t`4HI%oLe6q3h=m2I8mZRb_`m{w43*f`@wJ~9oX_?mh4fF7{AlR(Z&!jf- zw{cCK3I6EB5L6syUid{mDsL4bJ4zJpr_Jo+9L{U+(yKls#o!7k?C^sjS9n71)!CR2 z$Y!Q@(#)LB*ps8{@$~4wqlCFsc)g6qqJTE;wXeic>$vmj*Z-_ft`FSXJ(V^a)2Zs^ zm&uY>=amzmi}JP?&A5FJasDW_Pi3?8&C`>Nr#EdH38qDG+yoTw_B}Lk6=@Q~v)+6{ zZq-Z`RR~vuy8&mt*tfA)U6+e5Aq znS33UES;uCdJ9aEnwXSyuRk^%41f#0+P{S@Q0sr8rrH6aJNW35eQ8ml!r;p1F2 zb*3W=Ni+1&2Yoo@Kr1qx86`+9?xF556+v6AIej5TDhZyB+iJR|AMA#&;g9-azRbdu zL}kbhU(ehef&8O$!o}kMgnWUyxJK;zRQ)I750j@b!??)$GSK^B^nAkIbxD&tbx;o_ z(d>Lk4OJO?kg-6+MnMfCwP5u?Ir0J$_#KZ3FlVErHj~6?9cei7$O2;`e~I(*J#xcu zxnv1z5kV#dMS+M;)d1ALl|!iYIH9ZV)PfN|)H`Ke<~;jb9hLD^^6{N7YRnBrZb#+P zjR=;KzS0~b>Kh)MEaE&DP5pyMm~a!WRkfU_ujM48hI~TSXD6}zJce2+wA}oo$!2F!btcQ{}C*f)o@aNZwydAT)lr_1UsBc?_x@h z=J_+v1>({v!xbi(T;H&-gu!8_gy8F8XatqujtQdlIZt;(5W0Gwl;=8`$o$^gRVa?w ze)N(Fp>I57TPhZ0wI;#y#vKDpu6J6QY>@ERZ{KhKu|D;oaSJ;`S@GO~v&kP2^qj|n zIDqCqU5EyWlK>>&^o@mXBNNrp6;-+N9IAzC(e-)LPzW38LmphwYw^S$L8t;eGVz`= zyrY;jXAMZ@3`;&0e$!xli9q0~YHb`8-zPTbV<{*;!7LEmQ@w`_zo9#a9+ii2bYY16 z&GLNgz-Qe1WAp3tMhSw(>=p@Ut5SJ>FhGi5W_AouevW+BZqfN&22z;xp%3wJ$~kA$ zfsA-W7{8vh)={mb%h-TyfQ>$)C7Ku7G>|C4T^~y6QwjVbR+ti#>{OM}QS9gJK#)9+ z>xj=^+Y44q(2{fHDntDJ(ZiZC6LhH#icmE?yb2wO2g zmzCJ;v2re50rU&n!PAf(_F`Zw63<#Uc$8co49J%IL8hnHF6%>%mc3uV&CER{`P5%8 zb44kT1#_QjVhnUGU$5jMEF;EI;y537EZx6?z4kzf%UgCV!JY_#MpqjAzz``S3PbWh zjFXgY0uW)2fNw9+IpU`7HVe;I{>j18={Q0f{%Y5=5$y#w`6#iY5ot)o{bz7j3Xq_7 zCj@ak=BRC;WH5y`y%24oXzsiV2P8T`b0wqP%(Vc`XKXId#$Swe z@3XVoqaui_1~OQw+Te+0F=Hp9ii^W0o6Ix2>{A~~UG90aQ@tpL88!hb-Z{~-(C=(5 zc4DI=tV64=%|B%(_GKl5evQXR2X4cD3oOI9AQG1&#_^}|jBUnxB^ctiJTPsFX@H5ntoA6EsSm7@ZO1+0uBXj!tO-HP? z&{(OanZfgxfpZXt;*g?^YcclJWN&BW5aEs9HLGl4F>6-#p}=PRcN020X@Ab1zCunuT8y8zvz>#jWhg0wD=~Jh$DO%rVq5DNAUO& zfFvLSm1kZbXL(svpcv6nA|i-F}^>Gpi|Gz#>KE`iiX z&V2qz(&`=OrEAz`_wO+6XV z>xCPvyF!GIs$42*=no;vhV{x0L3Gcp@Ytn6D&gk%>g9nwJIcfn^=N4lOa_FC;pOsH zR214XSFK^|PjE}2(3NOnp^>PT3 zKHiqaAbJsx7%#O_S5DrU?CHtBiOe_^G7!UhN)!iSXo|ENm>7|w*ux4RN6V7j|9fCx zH#>{e?F#YnoK*Ak2haTBUEaz#QRFr3n&$@|XXfYb4m7`!^uT{!bE*3q>o75PI^|?= zkICiU>Kh}!aFLb|PnEiy09+!yC#Mc$+2ZwWm!*jc^okv;fCq)HZ!n~%b$bn* z_1dI%dXtR4zR$Mgjf!FO?Q2|6f;wd7<4Yfu4iBeFS`q}Cv82}}7;{c$fhnXc^L{3I zc?FcXMRTU5;}iFFoiqQhNy;{cH@}L8tZH~F3~G%$5$qRHOJ!L7Y7Y6-kwPFW>tv{~ zZU0a`JQq5g<;|cTTSM6tss+5(AdNVK1+!3>NPZT*|6tVdSN4LcuKSF)PKu*|VF@Rc zoN=RpXbqrMMLdKN4HGbaii%z=6LS~mPD`Hw#zU9! zf5&5v^p;hG9*>N@zK!xvTl}2`Tz#|ZqlbHI_bl2dqn>-_L)mS3vrH3^h zx7*9f&Y77|4ewWCfOu=hoI{$7IB3zsED*p5J@JCS(WRl|8ye`WLW(T<(nn}!3=9i_ z=iSYLlr}3N62WTm0`OTmDBgVS#fg&wjp=4#eUqeC``sIB>AY&LsVcbG!DqC*6}pE` z`=tL~fyADxSYJm2QW0Pv{K9Qtj&M9@5aJ{*PcVdcKt87RdqBhS_>?{fkj72w5&vZ3 zVKJqIIpm(sqoX{asf`8clK3J^NHFHz$G`ywxg7JWiy|{o25F!*ka+yXlWTBM0w|Cl z3b7%y3q;7<^2x=V2BLeWI%;umG4w6Q#ZjPBeSaw8L0@kG&rAl^i+kJm+6FoHU84@~ zq#Ze%rk<)FLH&vo`o_!tH^>^t4B7&V*a=J6Ip1lSw_=;gIQE8}72_$s(H3HjU*nIO z+f(=@@yk$LUX)|D)^BrU8`>33oK3O5unzcA$0E#bZv+v5i8-Aay3P)e`|mQ;{V@CM za7rNy$1J={TYZ+kBfw9spEK}WTe;|TyPJ)RC^J-!aJcklyPWL2D9`nUOV59YSb3iv zK=ih|t{FQF-rMkIU>E>y;ev+uz#EqyLT*zo|Kcv5$O1@C{!B~XBr*$sS!b+-JCWsK zi71uIbUfVii)v+H3%qEoyKFS-R0`H9jQ!f!Y7C4y~7um$qySozl~| zDOBie%w^Uoe_ZAm{ScV?5HdPAUQ(JHJJ-4{=>hhb1e7SP*DN^ov}7_Q+v{rr8q=1? z4Zas~v(hxGt?Jhd00`;kc?s8-0m2ziFE++?^FV*nTPNJOtg|uCJwZT*^m?`7gY9wO z-Pv2lZ!A@?duSTm5*Sq$h?53Si$Zi-A5s!Dj}04xymW-TIxYZpFr1#!U7WjJO*y^BG9kgdDwXB!Zo-%Iqv z)=L71kFdvuWUy^rS+|c8&&IMh<+}&EjT>EuUQ}Ou6^dmJ1KOP?v99(H@fLtodc)@nUw0}-?!l?=zIoq% zy!~Cp9Z2=Mdge7AA+~u*8a6Y#@!c8hH?6ln73D3Ir^GUt3=#2^Zgd8772343vex!eNt)LR!UGbgjQqn}eE@CCW_Azo$ z0p(ngb3v;;%E(hiab_Pr_F*8gSc@Lal+UJ;pf*$PSicFGn86gUzs$_S9^A1E0n6|E zAzI?H_t*b@>q~AVlQ#DG6DVk=rX<1_%^#_gPd|@6;DRo6C}s7`^T;|(YCeXuwC74A z#p!>Xyk=Q5lURVu#>Y6}-~NOO>f(h2D2S%2kk`KM)~hUs>uD_C?-$n<{@B&K71x4q zXg!VF%fjOv!e<`V%bD6*ex%Ix?gSzW(aS4~H$$zL!4yJ&%ocCy>Z=A@$9j!o1cvc9*H#*2>=vP~c zpY2|#9)YTs-a*qTh(_ybwVkSe`YA?6Vp=txU492x0V}@_NdfpSkW??##J^+RdE%X1 zZnCpDeRcHG#l9?&m;s}fVgC|t@<4Hz*)iS183KN~w+okcCv`KDJD)mMqJP=LULb`$ z#tf*0SM$zB?p{fO*II2y4%$DL&*12@e?H)psMik)_OkiT{xwYWJm+HthY|o}wTq5{ zfydGtd8`_l;MRy!QmCndS(G9R44iQvs-n&l%yK@G;K0VV1pLOuBCwYYiX@OeZGUaB zzyS$F`rBYDRUA(Ba)e+`hJ>hNYD*7Sy4k6}ScpJ@(T(=rEc*RhtLPhFj8+Q7qBf5;%SA<_^+j4trq*VVYX5o;ai$jsX+3gWPps? zb|w&R<*NgTPUP$Z6%`zyFw!$4tQf}}NeLH88Cawi++DM)2S_b**j1KUL~^*K;vBO@ z5W5yql3#GMRtfJ&BBl1o3(LSkDOB~LBuvvME@HS z{}y>3Y)qnqCjF2oZ@7teW!SmX|G`F%#I>a466CRCoQ+B45Q3B*N=am98_89RgI}+~ zGF#SA{eJ+%Ks>(~4;RqTys4Wo;tSzP=jAq{BzGf9CL0m5Y<_)A-9H!+5~iWrA->iZ zUv>4D8-t7{T)PHy8y8aS-`^3o#8s7lv~rzm#=tA+@s-@*-D)TQUuPZQdF*_GRI)~B zPDP~dfJ8-Le=|mD3Hw5~E`SP%^}bg#fO2l6O+(i~DplQW>;3&VjnPtHy@`fNcR;kT zb=9&En664Ka42OSn?3p#hT00q4U}7glmqyf5Wn~dXcADV^&`FrF!nJj`IBx=VE8`o z_D#1|22MAik=HTZG*c~8-b#j=JQ!nOeeY^b?gM3}P_5c`(kJ@1U#`TKR~<4#!bhd; z()TjxNVtMFhm=v7g1sSy&af- zyc|8tzwrCbUyh!}c54*0K-!ueFwBE064r%U!rK+b0x-aFIE!8R9emtx(GqB=>SinC z^#%NiHHJ}M1iwMgd8jEc?uqXqIz6#9GLVYN7h;Aq1IV|t+~2RXmvmtJ*2*FuzJV8k zLDibh+89W+KN8#t{;gYr=e7~6rZ)jt69l=ksm@i5N7+ayl~>m?C|<+kL3&C;SG5iG z5ek0+k9fzow;IJO*QA!G-^8QtC8-}ymt-{GVA65Havw4Be0!5RDQ6{&+R=FE&HQ9<%!=jSC=RHlbF;(>1 zA?mS>q!?)%U9C0jbt`+a>k7Can`pnOpwJv>Y|008b@{?OfTc)c^$ z+xEtnKoLY4uZt;2NQpCy*F2;eIdd78VcVn&7RIRne2-w|g6FIbc@(!rQP-gxeqGo| zwZe^5n`*qsVI7c}*RIu=)A0-9U4oCpDR|n9kpsES7%6rGoBr2*)nll~hx{Rj(Z{s% z{NU~*6@Y%U;MuD$ADA6 zyI7|!6JJS(V+r?FZivREZ8o<=X_P?Axr&{4tH0?r=zN_*udep}9^&HSPI_tb2Dp)b z728!0o}GZ!VdDxE@Cj_FTHUGV>(RvnS6j6ds4xJ?mkgs|s#yq_D0#zIAq%Y zSigR+v+8dF^Mj};8@4be_;;`fc~!#|$RB_Ow2@Y{+2dnM-x5}+5CAWNx9Z0SuAIet zzEU64Fn(pG#)Tftc{NN!zh-y_{Wb)*h8kcPYU=Sh2s=h?1cx1)4goFZK|slwo3<_T zq$pV_8t5V|q#bJ-&WcPFQ5aPb=b_t<*$~je4FR2O#~eUOmmTwoon^l zUyB+)nezRM`U*I|+f8#ez;587bLi&Mxqe@3?@UouxQ5~9^ z25&ghpcyX-EuIw=yW`vYcE1FVO30^Dty9&_49opC%XPQ2?cOVVlvBAvIr6Ol2XCi; zQaxxeO}XCg6hk?fj)TX6sM~r;;ep7P zWo<35WYSLXg>W~lC~P=x;fCW*wgrw>MlM@GiT!bqd3gma*gefXMh@e#243c-bF6`b z!$}9)sfP)k{qgEKgh!j9*ZkH*Rdt|;B%XS6=2v-?!W!pRp&*SSRN-!OEBn^-)XF&56|=x+^%{aQvH3N)JT! z<$$OV`UBvF=#HU0XsiGd%8AvtZo6LLk`zg_fe(O*22fO21I!SLCJ~>Hx3PO9A5u#I zD>Mb6SVsacZpN;({EBd<_Nou-0EVePRr zHaNQYG2m!&SdXQl#4fZn(~#1%*ck?f<^eM#{n~1*+sjPNfsN7E8RNkif2Hld6V`_W z+d9G-mW`pz2YeRQ@990KcUT?B#`lM&Lxn(wUX-T-NOm9!_MUu$<{gdqB-3PMczbBa zRJcXB$2ZrWVNk++Q18-VKBmK#i+QkRa^||I(>4qvXwIuYwzcu_p}2G#E22MrFB333-7xncUT_mGt=d_N_{M zV0EXR-a;1v0Qpv;=qjl8K%9z6r}3SsG?2C=0E}5H1#i63JeW8+bCxza@fL=WZ>OX-eH_}D-1 z2v^YctDklX7@?wBqiH@J)z<+0<8b~J)Z-wi?Ow>|d3>q%&xzAS?>~j38@Jss!7JM; z_rbI4pI`OQRjL@Bb=;fs_fT!j0ds*Ld$?QUHze=Ma?`FAq(b_sHmU=Bgaf<=Zg4gB z(YIj=ml1wv#?~jq;LcN){bJxgDRG8bp9kD0XRa4LJ%rMz^D zq*yc_bcGGvFMbSgpB&a})+s^NVvD2dBKXQ{;HP2tX|b~lgB%Z!itc!n;F+`}&%yM4 z6`P$-aGly-|pOJ#3<^J zuqg9Dy->%sdO85VmQ_CcNCf`=@L#iGutR4f*a+dkL;{Nl#| z@X2Al_JI<-+&)ah*wbQQA85ai5(6;lsRDO-j=p~X*XJkL34&*GmggqljyIxi1x0e; zC+vpTP%AX`;Jq9ioS+a=>n*G{VPi;eerp=CX*F*4It!@i`7LhqRz1#8$OxLMKW3Bl z+gzMinB>Qj!PolT41UdD$9DslNxw0D8X=ThR#Oo^dAFvhDtLx<1V{=B8A!9SpT7v+ znWY`va~}*uLp7^I;x{|5YgH^LKXHtDNT1oD^UVe@i5B!s32Q}tHO_15bf|kV59&_N z9Eqk%Lg--7rU^^(x@Np6LzdP>R7Y(Tipbr@ps=Ct#gBoylf!!L6(vZu3?+=!G|)RO zMur3F2bFpR-RJ<{yuS~=y!$-#HPt8VQXbpDZ(^DV6DEaxBX?pzPoLRPwHG^upn{lI ze+b~#R3u8-jDR#ouyDEBPTiIU2WOA@g11miXkhqi6xB-S?(~xn7uk^`30BRQS3`Hd z2eJJueXHe_!PV=(yngqV(roGtIsB06DDYw)3Y?rd&(oyJ7AZ?};0vzmiWN~9voxyX zvMEFndGxxpQQ+l|L4lLQzE$j;r}XNzcQvnSyvAQkiw}2TLZ`_=+&WE)Y3fo^wMoI@ zKpT23z)c*U-|7{sn@$=w-V@oj)9OynI<`nTeqGYR(F=KgawP&Dbct~SO``f}IUK6^ z7a>cBvZewC?j`bHLmip&OxE>Ywcdm{KXkir5V4Za{1WU*k4D0vd|G$|W*gt)Zf&*hJSKa<0HRMbNYd!C9;gFlmE15n7Tt7OAX z#ooimcF2R$D!Ofqa_%11Iy1-X8c4x4p+1CFPecx}pq(2^S3-|zrq+=n%&ejhdT3?~ zTe`P+yzOfNC|$LNwcZKC6#lS+`c`vH0`>=s@$vU6&et?Ar56p5n|sYazFWW4G_!h` z7s1naq{g>ea$Fy#n5@@x^fF!q`a3&*&wBp5ZZiZL_J?l*i(dBOf*)c=LI|xF{E_Z4)jko-PvZj!u>~61n^_NMv$Yk4f=R%%HD%U&RcF89egClDHbYtWlf&1hDJKjCz0#2;vBA;@xFI8%$LIV& zw2caPxm0OGi_0GaEhdNcC^rf2HTkq*BNB=|4OC2unN9?+KVeu=gNr}?{OUEK=;Z6f zt$(r(=vd2C+p6_`S4pR#8Bbu9UnBILd~T)Ma=_m`nr#Ys>@QxGQ5o}tcX37fu5yio zem)Z~ZeJXS@tzOq0Mj#cB;rxz7i&PQ{I)^>4rWVK<{ z`D4Jx4rf5; zK>)rCAPD`brS&g@kIq%z3u#pvRT9912f@E8wDP^?v#~yl*O0;F3>8dJFd*#;5OQpR z{(mQjfVc#p9OV7xfj_GFg(iapW56J7dbkdC(=ct7EZg=X_(lGEYueZ&cZPuZdU!d_ z8kpjgi!@$SbSA`lb3?zT!&#rfm!!sEe_MCTN?~iX{&39al;N2|xJ(M2VSDBwm&uun zA}aDG;jE~tf+bn9V7!qxokiTHVVow-V&S>u*vRGb#~_!U3DrQmu7_!5#cnEf}kuwgRbmRvNj51y^X0q(h?zL3m*QWD1*d z6%&}q*@~-q;Qd%(`676u{;3Guj~0R4j8GrdDZsae<^gHr>Kl}A^%hDRU+_-92Ql=I z!$~!d+JnG13~^rhS$X+F=M1B_Qs@j@Jr4y<&b$ys8pp*#`iT{E@TjH39<>ci>pU*Q zx=2Ost}-cY6mNeceIB(m-?P(&|pyQ~$ zr0u>MfwV)hDCnlV$tglcT|7?MY!aCLe{J?`n=K7rW%h$|72n?9?-gd<{MrC%{=t^| z%gD{Q;{ZX{)gTHhtlkBJ39l@wQ^oQNMZWTxkiP&*V{mhia3W3dNpiW7JIZN6rvr}5 zd4OYbX5I>DD-g3XZKMU|b;%&u$KtpNiz<#pTe{19OB--p{usb9IjqxyQbKR>E<~bn zNI8$~JO^4#m`hT$z7x$}5%L(PLTwX$X_E#JvGLoX`d1oI{KTWFP@tdnjrYacC9&or zd^oJJgz~QsK!Y^=!4ymkBMA5(2+5f-EQMVS77iVhBEX^8fLa?X}|E?ZpIRD^R2Tu=8B=qYs{UkI^i_ms^DD{vtNV5ya3BGh) zT&QG;4W-SpJh8eJ7991`RMwptx*KTuC<8f#@|+Yp!$8hMT$3}mMU%8G&@FLZv!t#w zR^?H}>LRSGB8$=_@`NI7#C7>&5ZC0eP6K(d(6vLzV;wIhFDE6W_8=;AeY@owX=7l| zN?r` z%E&cv@R$f|0&b;#H>OKAe5;bDhTIZi2>^M3Ob>pff^Z_J^zhlSm7TE-V0TWL2mL&T zdRJABSmoiXN6nuJtex8@gEeUGULDt<4S%5w&lKo1DRhS6 znFpOFXO7Y=Zj-WL0^GAC5}cJHuUMLfc~OLXk@3iFcx>o&`D38d0i6D2b8N?Fp6JNWv;Kp$fE6vae>m-9ZY_@_X>&LYNtnLLD0iXs-#cijN!R zXP9BHG`%<9J}txttD;wC`6VWux?J~0O?Agc7)4sor5Nr*gBQdYZtS;mV>719aIOAw zV|RdoUj};sV7t2RzxIZDNdWa@MQ1aq_uy3K>3HdK9$uQ9xmYA^ou<%68R{U4Bw}S) zhb#|cdC6+avRpWoIbT?KY53s>C^J3myY=lY#rE%5jP4t8Qk!Wpr#5>Y{p=7GJ&p}z zI)SP%4}~EXU5aUVOch@SGMJv!>NCE#6B8jJS#NQfeZ#;K(jv>?W)A` zShRB5=F+>=VRLCAugyi#={A?1Iaw5uh{J}(X)A3mPfAv#i<~uam`8P8#tWXgZEk4W z+#dpfr-yahTyimPn>z{dPK#*>iD~YA$dox$(+|xH2unf>+adkTE4fc8`&|eha zp|b!W(GM-Nv>o!B4_-mrIq7*x^#RM67s~896=->EnZ)h+|cXCfp@A8Cm?FOogH467GT{Bm^cL69iZ@b>*HIY zsq7z4wDFmS7J#GmQ;%&H1E!I&8^gynd>PU_j*NtcSqgGU>abz#ML^g@T1`)*>S&2G z4B{;KK0R|;Wl2@13sz+dAPJ6}rhaDd6PIdk zhp)(!Uw*j-3EZEHUP@iRblGG8H^)mbCnghyvCTm^$C~yUf82o!ydHPrOCo=9*{n8y@NN775$~=Seuz`{FdKZwgD`lQmyx6mEtp4i{c?0gnrxBcLIG75PPLj33`N2ChGSL9^m_Vjk977Sd)x@_~frPR?i8hWqGiy%b%ZZ#hQhS?1Vrs@ZwScsc_ z4XMB-geBLCZLZf{)S-#7`dAMxkDO|~zr8!|!Juqrqh2i-LAcRg$vdt<$8^Xk&@60@ z&FC^ulPeHVbdGtVW^T(&gi$V7ndT8xPjgnqQOer3D7h%xtV*06)bmARo2MUAfj|%I zHcweDnOvc&M;4O?ZWw@%D% zQrm|8kV*!6Sho!$s|q|eY*G;eEq2(Lldxhm%lx6{A-UK=W>IZ@(4rbZOt5=-CAJtn z83H4>LoSiJ$N3&Q_|1esg4bXow_s9UKM!_--y3X1t$7z915hKD{U{0gO#b(=TCcz2 zGF3~s;UoR?Q%TbMPXAyfFUN-++fOMBfYRHsJ(X$GNdN)p$9AgmWRN?G&QW7(=CBlX zUY9wm(<}x~*oGBRyI^V3WTFluk*6M4B(v4{hk)GaVLyl+TyJSjrm4OaC($werX0swXZsjanKc1h4N@V@pF$sl`@mYsjsoepavP`B76!)imJX-3^G#w%dvaNak(# zOP#L!tjQH`^qR)eq*Gz%(Kh+)e<`-SlLs}2(I~fA@BK80V@>HjrVKC+CJuC6(6Mud3QUjqr>qs zdW4HwV+Tn0Gf-r}c&4Mn0b)*heb|PF0(8(jm88FOm=?cDo`ssHXO8NuiPMa;FfV`z zC#@JyqMAu_T;xq%)TNvLE??xfN&X?Id3so{Nu~tPFv*j^^PV?wfa>tuXKJj!3b7fK z>cp+_^`Py+M~xRy)Cz5X|OsiJn@8^=oCzW?~!r!TKQeEC;vQccgTbaAk# zXpoHBe%!9V4-x0lIB9r;?j)>i%ke<{ficq!dB1m>@Pde7gKzf0A5AQLK!vQ<4czKp zFFQqf3*9;4MWF)=X*nQCvL>W#0a<-OCe^i2dX2LwwpvyA63psQef%~H$TnXszyjEcENw6TDjFo zvkrYMLEHikA%{|D)q_NzQ##ddP91b0Pc9w+elSgX2tb*T>qnnBZMZE0I*NNoUl-iZK5OJbk0TdgsDb9o% zg8jyabvhMH@E6TZ^-2;gA&zAh4jdOVVmL2v-hHq|aZO4eTrmBZ;P$n_T|yA#%| zZ;p4?!S^R2iEmwxng(nbaE7kBjr_73{(T6}9)+t%J>BXYI-z`|S);}T^03$2%^ST< ze1!Wj<|1cc>Mh3Zc9M%Q_4v$H8HHI)Gs2>@CUM%p$%`MvVtzOCtGupR&a6%{FfsMP zx53n-!@8U#DmcwaqT+TZiHkWA^{6P<_}&}pkdHbLjJkrH)&C)0b2^6XLL`ks95ocs zQTx9$W~=%8l=YlVSdD(V_Ms?74W^*aHX*gX;J1QWyl*yyocf$!QXef|btfzq`^X=Q`FK^#od%wQ^c-=e9YZF)?g2f6) zhPjm)yy+J6aJ!Xdz-x5oFixvFk3!NU&7L z*0rR0dbFq^ymPISYTU`_C`liiG0qyY@vOL2jG9RH1;2#!mk6-XFUou9loui1j&4;d zP)B44dCmAS<0P%8NRtV?DRJe|6*%UspIRMEJ1_p&QLCVoeNN1wVDA}^4&i3ub|=fA z)9B0*^>aUGj4+x}5@)m|WnD2+gg#9voKf&iO z^tAGXuR~%IUk+^&9)0K~d`RK%wh)_EX9ro;0S6M}~1F(5C8W3fwsfn7J99nYn zD>M5Jb-9MRc-3lO9ajhO9O@*-zfCw9cK2pdeCU3wa6d4$Ravf2w}k$S*BS)$PLH)m z0IvjsAc&(#F@Cmvk(_!jDiUWV>xM=Zx~m1^Vdo&GaZlm)u*(qB=*&SLgb{0ELitIG z#0iT?o;8eQO`OC{n$$&R$MpmzVmkOXh-q|Kr-#J^N7og^!OjCt+h4&5*kkdp*dTDQ zLT_5biK|vbiYg@) zi~J}lvWjN*+Ka#hZ3o{5w2cny^dy+z6i+e_wT+9pGgB5i@+tnqj6g^{o^Jf~ncsG{ z{QjYu#?-aZw9bkFLYMUEy!rMgM3u+~mjJgbv5<$yw?Aomsvyj4gQr$nK@(gki5Di{ z8!Tj&R|<9BNe1s>Xl9(B_(4Y;1P$c4I;E=v5@y^pXtOP9>Nf9X0AO@xnnf%MYbXi@ zZlNOeNtv*UgiRb$fCM&?BLrgtfP-%X07i#(nl~mm#k}VsfN?Rmd807fDdsKdMP*`m zErXLb`x7^`YjIT9`BFtz(MpUUL|N5uAT9wPM_d55?B9*ubO?K%nURlwa&rXs3nmZy zvdg_P@ZBDYsYE}#d)S7%A^Rihumpehh=o?MXG1xN7)G?MI(fL0$wigsn4#5s3E3l9 zy5Ok$s;f~1Pcsyzvij)hr!&dO2J?ZNtdn9MFUPiH2Uoy1E}Y|tZH#x z!hF)jFl5}Y+zx3O3>lr7`P}0Gdw-NvIf=`LpEvR}A*=?npQcK))RDP1VaUO^fgz*A zIvo-wIK?5&!y(&W!PJ`zHi+WEI&F>lI1+PGVTHI7bgkbyv;)T#*P37VO9 z+pHMN<7Sm({y2{VmkE1 z{T(zOUQ;{{ayj}Kw+Xi|S%yAFXD;(NO41}HK^!p>2Q=q*moOx0P)9L$C|MHNsd)ku zeH?rn^f5ZD)0d#^&J%peJm@hl=5QZ4QT8}!v1%^xAtve$@h9k4X7MNA!Ri$xtrE4U zXW@b}c}5*E_wxaE5g?7CIP3$Yhdp1Y2*#Y`*zi;n_U0@OU_P=oSca@cXZDk$d5z&?Itvlwc)ox)}q7S3>^qiTYhDcf8SQ0%l41+9srfH zdjMPvt2IC+RGGQR1jyqpmYOgCRaquB~krnfd8|WN2JGDi2*4)5Y@NP0#PvDL-J)KeUoOs zm(4NGAdb(zxM6uZu%UY(smyZ&WUP+}n)k!kBEl(Om_+UWLxgC}C7ah8*?kC}LDzT= zy!mqR!*ZbJx-&4mqd~9Fec^p~wMP#sS!2Jb3WxDyso2tj2RiQ?Ee40&vrq}QYYdkm zgwdI!tV~(yHzY}-n#6hDkeud}RAo^%MHca2*yFmPi4YFI4MG?lcB*Sc<%h~X#68YK z3FBg@dz``=Eh`MEB&%B8ZB@%g2vKZ~8&Ab;8m+%u2LEv5le@nlm1nZq_G<6_qbw$KkxnKF|q#@5h>n})01Rzk(2A4tQq-9)Y3<{P(B5)I1ap)VUd2}0+(a=5HM!j!$ zMu=xrmC>h^y-(2LVALR}{kj$3+_v_N<@d!3+=;I?A~q$1KlDqxf;MVj1QXI9@GU}N z*-(dyd89e`VpM2?Q(A^EMrTeMmV|lGkj8Hc*S?m8&A(QCMW4o#GR)6n36{>sYncg7E&2LVjv zt`-`xz_%-^4$Ma&=K-0Rp0Z9Y0WT!xNDXU@u`OcJOA&7jz#2z^qrA|tHim)R;zQkqzMf@h(L zjt(8@=!Y%c@h?VQ%6eyrxIk>Mo`0`1s+tiuh>an;a3CHK6Z**3E7^(=bAlI7_XZa_ z-#z0;d5e9^TGdGe>A`?5#kyP1hw+BXV7%zeO-+NEvXInO!L_uGbG}24F)LlQIYb64qs%!ErKV znO!+e1Z3zyKwhSt*kG3^CpN}wgfJEra4Y7i~7nnr1ABD&J31hr=|HV4(vE zcA0u&gI%JY*cjH`920V@=&9sLMUi38JIz;;@%C0Qohft@zg@k4|K7WWXxpZ5quEix ziR8Uq9r&B=JNqD7dofxFm6)Kk%g{pT%yAj8B91AElLC}BW2DSzO;X@BEu%DX-jPhS zQ0PDlU8c0yV3#N@3cIl>Ehgkv+EdAq(qhAk(r!&;BTk{WJG%euajjs2Mt#J!*A5N5 zfFH5!!@|Ldvq^4uZrl{HdRE0+^QHYOF*MD)1YcXKQ2h& z2N74rq$WkhVv@ymS(SC3=Aj*&7nuoYba}H>5gY6hRm8@a<_S@8w_=`3juaCc78Fy` z0}GD+8&PE}VD1)#-A|SQt=c$0^B675Jfdo~8{DubA& zT^r5JW8}y@UZ#!MV3%kkHiqpWi3+)O5KUCt>R(VPP|kPTW>34r{#YGk(=LyCub_4l z7y;L!_f88?t3BH>Dl5KZ@Y53OL?^T=@BB*XPgIjPAG3HW~-`tZFyUDd^O5kq%}=R&lrchv$l} zfvo!6JrSQIJ=Mc=C{qIsL~I3n8#?w+ARJ5LCgqMk=C%^nG%WJ4glMeYR?MVTWKUYb zQO|or#WPJcn7<%%g^uw9KXH0Ds)i2p`m-}wk0eLtg0}e7qy}$3y@b{UD`>`1J$N^& z3!8B+HeV-VIdigCsL%w-xDL2S&+~vpS(C7|@~g72Q$j~( z_A0VxujXj!Uy#DWS9KD0NAz@dLhF&_NKdh0;SlmCqz|CC=N8W&2-u7UL90huxl#z| ztau6m6`7#5%Q9T(%q;PvB+e=V9b=%|Lr97s$_dRv-*1A7R;lA0VrIA^dxmR{*8T-) zE_4i)bbmKA7C`iNcG?S-v_V)fq4T*084%Ox0fk}_n6Hl?`jd9o2X60=(xS*rmqqq;*&JPW za3*-4+FiSD?_}Y;qYKh2_jri1&rYDBlD~aG6#b&4+HgpRDiMBZ6fj7MSG;BGhWsSK zkcK&XACLSjx?$dLA38})E!zz#)-^=kvB$8g`}{;(v@Fqv&dlP7201NARfqgQQdA8o zvoauAUFKnuBx&fNY>doATVzkP%~5wpMgGO=?ideI_t~j8R1z<$MMW^(hSms2{evLM zIHe@yueVod*>6-La9f$dqh8hS9sqkRq<`xf+D$`1>;PS?%?{@0@1kY-J9K8sSe&F0 zB~6`2B#sL1_VY3%X;`Oql{87-f=4s?tu0UcD>X_BZUS}}x53{jpn`$M$Umf5EBx`@Ac z%Wi=Rxz#aVmg7Wcj`F;USeOu&`_M0=<`?3+iAWRGDP@75_@y0F7n?cG7+u~a>i8Gr zHqkLAspIU-CMt=mBPP+S89`30iln&GBHC(8^&+}DKLZ*s%YdRY*DRv6 z4jADoo0FJT1u4=rC0V4=pRpYp5}O&&7)`BRqN{&F<`W%blCI9qfTEJPuA((-T36vX zNJOM@=wKk|8~A?T5p@lH{c&JkK-6_k))N()ps>rbp6JXH`57mqsG^J?#UZCtrvX2T zOXOz}WcC<&Y-T-Ud)Bi*cp;jKNe{Pdj3Ww z-_Q-8kV1E4aS-mhs z`=C-S8_vS~!heT%@Wi}p&8o~nl3Xy6OXUN_i+}6_sSw?X8183er=I=Yd`wDuRhvT9}~Oif+mXO@A>c6 zGVs{&=M?O#U@NK-IThZ$kI76oEoz=@U?iQlsxbag^r5U9!~EoFyexT&&YYDruA|&1 zSy@2yOMt`pRYbx%XK_&lL7q7-foAeFwkJ5h+R~>7eR!({&Cepo%d*Jm%xMs(d00`B zGM^vb8g4vA<3|L_*BWj`1&tgQWM+|LdluPcL1?Pdb;ZU6e}E{wKCQ2|M|~0jj$@T+ zs^HtkOlx-X7+=wFr@8iSk7Xx{D&@`MM-eCq>N@;9$`*pi+spNi>ql)pi9@|#?hn;9ix^7Fw zl@I?rSaHqtM|8^z-I87OF1=&G*Ct`pu!*Uz?`oK9@o<9eRu`>^Wx@=6J8ehLd%FEf zZ8Vqe_vTBygnB*lP%D??@)vW`@TkxPf3YkLkIq~$?iKtxBvI(6B(92>lri*9 zZTyU-G^i5aUOpI`Y53TlhIjc3Jpb(Q7ntBue=$4zj=zXo>n#uyduQ~z8e$V3y`w<# z1sk#eHq$j&|Aqp0bbI8-N493N6Q4SZsw3#N(G>zNjzoM=-X?d){T(wWX&8kH2|;K$ zK5%2UaXHsJDl)+`mL=xVnZvsA4;S6gO!IN=85bwSQHcp=u`D5u&RmrZEz;8Gce1!3F-sd#2!yWBvVw0GnV;M1 z+7dG%p4bb19cF<_yUYR=Txb^PxK6XcSELV^R`Wo`e;qI=XAV4~W464jnNX0rWvVf~ zLY;%s>#zntoGIyzJht)UV&ePW4x%Ug)kwNcV7HXVQGGTYA4}D7^O^VZ04U&t!l>wj z*aT6&%|Z00lV}`qXx;ByemQ*CcUaK9o+NRZFi~h}BDTiKD@BYMedDMxqY`doPL{z5 z(3x4DCPf_tBx61>NO7~y=T$zS`kUA_Ro^py+1rXwdtX-6d-eX^wRh8gW&7KEwifrx8{n5; zV|F?R41x+xFx6#X5Oik036eDSOA-Z8j#IOgP>~7tu?!`G&RmsQP4lYZ8(7MZjxlMB*F0(^X%gn2(IcqjIE4p$8CJH24)N=m4v%I7Z;`*- z^P^tHw;=gJC`_aKeq&KNb(kMfZ5!+cQSJF~k7OC#1D!d|$}mdujQ9yq_i%SlD7SIa z(45A3Ue&B}oYG9VM}h+<=Bf5yP$_R&lS{Q{!$43;RFP3eY9?B->(ivz6=Z{t+d=cKt!m-LHCoo8^__TD+iHD;i<1Y1{K6C^;GoW0hqFxy~-rs!r)u2DZKp`@q8<466bXKd<&d=Z{%QE=r%t29? zX%OZl2ve@Keq8c{IArjPi2Au7hnb@bKw@U_6FlWTPig-G(rU|^1n+)@1(ar|?@>uB zng^8y}%= zH2`A79x~Ynk;WKAm}mK5p+BT_5fr`j7SZ=gkhXG?IQ0G*{(5_}!&~UVR!x4wfb1 z3DC9g(O?P+C$T)@x%fx1NbJRM15{#y$t{B$pfihBA%UNeG)pQH2dp4PQpO}H@+fPX zjIzw0p-fGbKSY0N2V7w7OrNr*eC3U9`jMP)VJK#H`QqoLhi; zYW_sc=hb=}#twQ<>R+X~JsGTv{0@HJ{LpF5_MoGg`IdA%@ag_!su%ZezoG{w+Y}FL zYWH_^yZTd{H?Fz~OZ=j~nT`5pyeE9oPZ2{ymyJigP!YGKrOU7Y=*)4QXEDuUzPY6- ziNiW2e6RBf5YVKlWWlgonu!HS@#Oh5OT*;tmWD}9w6xh7e|%!h!fd?hH(Vk4xd@I| zzpf8^Dv}RUJ-Le4N15Wo%?PD6kQx7XdJBW_uFPHP8E*_O`l=|N75^2nvdc*kP>~5%whRG) z&Yb&6Sm!w-SyA&NWL9RRD8rD@gr*tGXwGVTh#@r*04bg_pJrv4yxqz$sfkuLJI{|# zj9HnZ-}DDnO*<$rbWZMd9=9+%@}fVS3bv2FBC+eMccne+qFh~rIOJmlR=_AFlkbGi3*KUp=y}9yKnaga$x&S zA4lQ)%obXa1Mssu^pG4~MYV&^G*J0_?R8)2PX9k23%k(!>c1GDNmtp2Fb1iM}aB|v9pew`Fq z1T4=LBQda)=Zc#=ZL%t^eAk|6LJ3kl`996AF?qXPV^S0CdNyJJl@xpvZo77}=$|39 z>f?`!xK=ZjOQI|81|Eb#szBsfb$V-k(F9_bnp3or@BLaE^0j6e<@O_4SyYvLU+*Cq zE+7E^6Ny)*@?YOJq6Lkxl9co5%P!g!n1T$KOl0aupXqG2++7MQx6^VZ$wX=a4U+sz1*nrKF|fe@&q74e2keQ8(R+aI?otZoEPbaEJUwl9S^ zJHcDq1me1;ii zTpd`SYJ7^=+~s}7QIQE2w+yv`&YYGsto$(G##ZqE1TiH=%}O@I%DTwx3GmcJ zZKOEHVVcEZ@^*_un-fg4xY@uAR8rPU{B~IsNU@?j z`8}=hgC_P|7HgdkS4o$_RnVD3nwC{XLsBLUaH$21&?c%$U5L(@S(O*|HYceGS4nY* z$24oj&q%WiY6v>*s~sEsN`8x8KoKGuhbxjEuzdE z4=VF;b`g>u1_CFHZm0rsrDvYhKgyYK`Kgo7GR>>^9I%;DkcX5Y! zRAPd~EkmuKGnaK%mVOYDCMydPC(I`W3lfsEh|#Dh!YXuxO-Egx4IN2$Ed)eY{A=kgkne%rVNV6*xYlbjG5q^h zaLVcODL|jWG=SGfY!l@~v0WJFBV5vD2p4o_ma@=KlafRx-;xU1R?l0*>L=<^^J zk2{97jP8nb{>hpKgXU9Hz4z)@ARF22`crIo=A~SFd{wK>>Q5NHUUmE9K+-1bX0-W_ z_T|0{6l(J5dquZnRKjiV*)p6BI&)e_Wt=6HBo&~vtCEqTC`-c9xUTcU4_R&pk!B{& zCR>QJLFEC|ffzdqFHwoMmsQms&-X}wZC$a;*c}ri7LOu{2E6sA1roIZKc+JZ=YZGh z7O9@K6x*g|Ml&z1h-A@%E{1sm2$$F?fqbu2Z*X7$4FFAMqp7 zZdn4&_u`d=aho?%!Mn)KoS&$VYYLec{x$9e!)s3$E-^@_1a!K&Nze7r$*x#$Sxf#z zp6V?;*0uNbepTH=lBX0tivJRMRB__C;{!fg@+q71|AF}r)Rrwr22^N*3t0vtLTA?Z zWKvgUK;kB=Nx=^ogt8>fOB&^MZ0{MDnINKUA&3Z-x400rnaMO4G8;kUniz2*DBOo{ zgxsvW*OE_T-BzDX%8x0uj2fLl@h5(3TS3>Y?o@dDWEB!5J|5n?XX{;G#)0p_;QvP3 zxHzl>tb>1I*wVXxo>Fta^mIb#CXTkHK{xUFP^4@b6bYRD#TPzTT15LBQ**GNE#E1oAQmP!ps0$Q3+{se_;8gHG z?lJqq!CXpkG=;LCZZHKH-!fO*dL=33B>lIzB_0NX#%r(J(p`7o z!qpW1xY74yVRFVED+d<IS;v|Plw9$9Y2cG0 zEejGP5x4$rj>&Q2DovJ7c;=Y!7XYBg%yki<^!5xqP}e79nMDqxz=4 zj`7qC75_+m+OACD+idw!bOG*}`(RX`b~$$!q}#6DKuXu6hXWr?*q|g}77-!6BZ`Sc zz6P2ii@T_b1`EqJqR7LD2Dct`A6Exy%r56(icp~mrnwALgw9;XamgZn)uUn7kT~a7 zSr$P_Sm5)!UgJkJw{vY}CZ;G`h$%wl?WT#g)3KT6Y$Va;)4j0>z1!^85+5ocKIGT| zLiBjJZ}+OI&6XT9q16>6vhkSCG5 zy`)1|3zEqeDTJ=;8j51tuVASPE};WS5UTmITC+PQE5g)+Lp)6_11#Aj-Fx)zPCJyK z*GKF%;CtP#<>bO3dkfm%PWC@kG z8??P84r0)=fl8=k4{^6zHYPn-_B%sx+J;XqL!~4E!9oTEV%A zZQ5G0C+mQT+V~JNx1*OHud?5hAq894E5#wZrVo;cLh_}!^w zhljTYWdQu+t4`96(Cun>T=zu+#@-`+gT6QSr+za5e651Tve%#D zh7tz6RVCo1K_Ge!rFLI|NSgmEoyWs)E$;-OZ@=tT!!1=O!2>@Uusa+fiM~u6A&H7i zu<>PhEp+BAWJ$=PlmtOt6K>HJDQH~si+C8YIHE~T?Re(Q#A{^>@mi?7-NrE~tBub_ zX+4rO>E+O2hrNG4OmNykyeD?1`|5rLN(^<@h%w`&MFW3{2^uzs6iBREydKT7OS!F9 zM^RT}tniuFv#_l66G&(l-?Yi0T{FODdK(5bUaM}yEp*6a>jJp`yWhbUyO#$OmG6-` zaXvPG2XKPW#pN>kM*kQ-b2fK0LWh`M0kc}{ty!#gK8!0{2IE3!uEMA&s<qEfHfmtW2vSYKP0>abc=Qoss7{_yhE z`TZG{GY<3HX3zJ){ZZH!>@}~Tk?fOq^p%9}f26xreflwbT>(BVeRbOSR=}s$aDesr z?V9zt%EwzXkQZMYpo_HxD6bAjHIyu>9q|n7N_zNz((yz63O31S{BeX;$~y=*$JO}p z_DpgRLc@t|51UY!iEB?hhHL>LSTMx>UY1O;6YS`CV8pJ`_hpN|p+auU&X)nU(3u++ zMp+HXCS`Wt)Jld?8>9mA6|q`cg!+NU8v0-?Q;rs3dyw zMkQ{zl_)RkHyX?;c9#xtk)n5mi0>Kp zb7r~Y;-5#(Ky<|J*mz>y*vUYn8FVmbL0EiZ?n&;rZxEG&Jthk?)H$#yRA_>sE`vp( zGXol`$?Ak;X+cTMl9bSrg0;p}12*i2YQm!Og|H}8{%6TvfEcO`YNVCtE!Q_-L`DpD zHaf~S`P<(SlSR>AvMT-Dy7lQ+oHvh~fm2h0HTcdI3SgfoDCqwv3;|NYB8k*~-6E9x zZ!L@Z;Xzf)3!KLG-0Iwm<6oZyNsAsZg5YdaE^lyu%JVU|!6Wox!|k(L?W^NP zeduJ{7Jf!>>o)Qj-Veq#4pso3No4%^up8OkTQXMk3suY7)@!+M^J_Eo!U3cuFsJf; z{Oj;xXvobZZ#DxrreXjB3`?tfPr%C{d?~uj$#w|c2o9!>_oqm2O*jwd47yoEoPzxU zp~1cvgE$dE&H;5yb9zbPcIS3X%g|!z%tcgXX_%)Z%4ouG^Z~yclzvQD+yr?NM|s8) zyJIrZV);U}7%FdfOqkRKj%hY%%r^Pk-+P)H#6zLzIOU@^&9!?M~&r z*|+?Qe%-d`8lSzkF4|@Pn538znemN9u8*J%RUU_apWO8Q2)wRcAN7TqUzY!I+$#DI zQT^zC>bLkBygxSUf8{1ou^0bkw-?3F?7uvElSX>4ryxH|8eo(?8|i@6Nko927FCo? z)sP*x{bA*q_fz{7eABgAs@cz~N;SpNW6wmIu7qPn$+z}K1LmF_9(L-66#69fRj{FZ zDm!LYprb?g8GiJrWRqCKW9d%Ld@h9p5)lbdYVpxWuSy?8;3~+y>fN5nFY(Fk`|V?S3FZqyf~dURi=lnRe!fK<*KC9! zD*1t5WB8%v+T)X|hJK%<`;nZqm_x(H>jNaZ2b#exB8e8%@QU+xFFwpC*S|-c7m9Fv z7$+Z2MjwhubzqdMn@ZzrG8ABRkZ(blvut*7_UOX4wdz)-utOtu-J08DHF$5hI6`YT z$Z7yQKnqL9)5kFNJ!k0prn4Vif4S6w7Uh6tuM_ueMtjZ2!QQ@74?F5$uN(If^U;d= zGPEK(vqmHmKsgb>IT2cx70GE876mH-T--GP zjVB&3bt4wR#@~!xf!sOa4>$YO7b^IW_zw65EssH``P6#+@wnx{AU%(ow6`I1*rz{C zE-0A3#|s#sL7C}X%k=^FP@TY(QB4Ou^u~4#uIHq0H}?{%afIz{z{2|ri>8Y4MnNP9 z_~FcZ+9nDH{1TPd)F=eo#Lc2lD0if$IrJDb1@gACULuQJCOmdhkx&_p9|$BpM9x^W!RXf%a8aO!{C)eZHXTtz#*o&Aoj!LnzsFPo3$X zz|8ok1R-Qe*D}VU&J)UT)u8CkJ*S%>u0n1bTLv&hXV#TI1ZoaQ%%YO-+hInUyewD| zlu&YDw=ol7m@fnvqVjed!=!%v11{R#$M!st&1>s|T_!ej(l<6yy(9LaN7XW-Y!C9f z47dR(PF0N9GJeRlzTFtV6bE0q+rf@yF6jIf7O_KXdqa7$Fvo^%_o{1KHX>;2p8vv{EuRdk7d0)k?>Me&oy6ovWx+=?PGpKk zsS@_ziya`lyl1o)Ov?xQnaRqgRWo9g(VvI?pL-0={q@7!8>l$gugW7-4gAhTHH~%roqMnrKcyoGAZ8cObpZ zT=#e0zF5gj$c!@^+p`W#AMwSlT{=9y2=TD`rafH4HCaHvNYSKD^W4ZQ{?Ka#4rIW^ z_c)PYt_CrE^gW@sa$K#Qc3&)mN1`)xXPZP7zcJJ-Wc*f6DWPSQkSs{zf|dpF2iWc2 zghv(&;gP7k-R?1|_i!WpLEZ?@2FG4om+Z29+q8OC#LQ7q-M0s<WiHn<^v;(Wxz;uX5A2pKo1uZSAIzHxF|>v#5Ad+ z3R<|>-IocBEEWPIQF*)j!dcfQxUboeNK~>%7ECxqpj>=xt?426d@~j-)Q7fe*ViMK zTwr|Of1zuczk`f9KkSNtn(#3E7!9X*C^5Y6bS}LVr{^7ah^&*5Nm1bp-emlHNNhpEAS)o;*2fHCO$M#@5S4(H^<~%EAglecQV_uYFeL!WV(nMPW^EK6 zbJw)0Wt&gc{zB1}R5}p>LHUyLwS8d+UBjiNdJr^UkeWvnX!Y+)#wfY_Yx@YsxJ(iR zAHT~UKm_jdZr>MVis!{V0`_8Y3^cAzZkMnOJ&4YnmqC!{Wkjl!0y3y#geGwe6%i~b z!a9m$JC9jmq6dqG=s{H8?h?>WpEo}{^7obnyIccG*$3z#JQj!|9nH!IbK&yH?#Z?f zME(QpKg^oZm(>S-u5M@#JPP%l-R<65Ryo4iOj_j-#j97HisK8(lVpB>iq~2FYojrR zNd_@W@)>>HMzKMN6+%xRlPW<_6!jf3Fsq)!Pl&6n+pd=({?M6=Fbkrh%t;soK8eG+ zBxTAdX@Y>IO&&)qaYP|Z#9y%x@rTOW?HcWQ>bC3I&_COxh)H7-0ERj3wD7lI`y=*Q zGZHo}D~gQbA)~suFD(`$%Yd9#am1Lh^_}*%fVHtxS`=8FHc3%zy}N(t6wnuzwQlbo zm0hcd0PW)eL*qpQF(-IPxM&a37bpRvK54v9_k3j?p4van4@hq+Zu@6m7v=)6_hoef z^RaowGHf0?a}#G_SQq^MUIqNLA5=9d!k{5ZT!uwi)GR9Opx?s8<`oz`>Gzj!_%V`I zpV!>KBi4w?{?b!RBF2ab{+|RE znzqk28m04$-wB?JwsZVtKj$ZeBY&~arPY)Eg_Evocl@7{-|KhJLn3Om;f7w5!9l1G zA!dQSn9Q$&q{s_WWns#9MgZ3Nbwt9r%%UtQi_o`sJ1tB&U4bI7CYS{#>of}-o#rqL zTklcHJMu}I#LJ-wqpv#$I;xSC^w2A1PVZiOpX@4raq~`8VuF4zKu^7Qi`(>@!RvT# za)~`RJ%FGBCPPglSpnm(%I`f#^ci~*Y2+70l9eP614`nk4hVPd1<9JK2>{lW#debT z!US^_C_HI`K4Y>@eYQ-BC^9DTYu}doJw!?GTWEO&9(bhPABJ+$J|WT34dWV&s_x~K zXsE~p-CckPdhZsu=`Mx0_k7*Iz32Q;#hvh>doG!ClnNW#J5*gEs*AmcEN4MbL@~69 zr_ctsCOK;|LMcm2a6s{ z+p~Vt8VcbAa9;Rb`4wCnJ=h0jKd-*{+^G8EB2M)cqVv_)DSnaq-nU=Lp?%(N%a&gr zh(;%$RaN|%lR6JsS~nzZ(tw{D8h)$}SxBNF3hS_lN@j=DLP{6!D+6qUqw_h|!y@TDQkqGs^?w z6+ZdQyM+UtxERVNYC1S%`0Ka(7HF#BGo$5VdXFvDqW7~gB|>zG-aEu?dM|$WT;%nh z_hrESftqaYHvGJ-H01md1Ap)+=59GmVp4@!P2xCYP(Die2|CGwBoUA@yYh#o@?)vz zDawyF3$!c0WlBWFF^ONc>j&X@1vSFBjl$u9Ywzz6h!8D6?*TxdyZi}c_ImgkJ_|?- zQ3ZAEb1=h^T73{vYixNIwVsVN5TZ-e+9B>%Ykf`RCyh0qi0}(G3 z({AkfgOFuSkw>KAM`^Cz8F%e#fl)rv*w@r7GLCAiQ816YudfA1Eb>euBf8`K@bA@Y=n={)wxahVn+ts@dq3WVk? zCp66&3F<6O(~O^LN-N4I_hVD%(H!#xokv^b*>&E^dvw#TS3rp6GyuHQo;=8$iEzAX zw|z&Cm-2|dgXvZZ#{%#=(X~h1ECp7l8)DH0wLf}fxj3~99axvi zaB>;$Jfs@lxI^8s*N{XkFZ`Sm76M039#@1P*;7(xxu2Is!;;FO?un`HSki5Zx?{2q zb+=53s5aiyPO7#HNHw%Nw2%5h+4Oked77fj*eWc#JUf{xM3?BYLwvd}%l2Xfe5;_J zA@B~#rlFYPV$U4-aZ$&9L}(F02goQUMO^#D_k)~PDJ_^iSe^T+skm6GXo})uvJS&-usj7TTkQ_RF_}@SBA8vz&!Uo z)G+m)kt)Q6CMfuVRN;HK_;dvqQ5No_N&klG;aD=9>@ao5-hgbG6eT3d8-6Uw_))x2 zAci2Un=oU{;iofG-RGw)aao7D&rDe2g6|s9k3crc<+{o}Np&w%+Ak%_=CvT(f(+#A z762~ZZQt^zRkl&fKj;h7wa32D^-;p`n5^45tcIQ;a8HGNI-uTB&psnti3?3o{YBYI zr}%W$AC4&Z59NMk=>6B#wr;<6;$F)3nC_!AAL<-Jz~_^gdwo)HuTLWG^fT`B!R6a^ zKR0!MeqIunb?83Ij-cW1P9wlZc&A{QXTAQqz3YZF4mXwq-yk-m5=pqVI;*HPJRAQw zE}K_{Ffw8$DnIr|sF2~;RS9&F-F5~Lxo%diV6k^A0ai0xf^`BY0I|-k1l~({t!(YX z*kMdwY0OkXM^dwWup_53S4M{H7?4nI>p_&Rc&<7hp&UkngR&;A6lZ3yb6p6 z_6dq2PhxWWQljGbh_PaCD5x60%xg+Azl4Y=Kav$OZAe}hMb%V!L7C%RR+z>*Kk16g zI*j$wlq)VV@Y(@m+J^1#B)m%=rT`VQXY@0Km6l?A-u@xCOwOv$jRaPQ|p zWSS6BCdqUugkn(@J45HKFe^aUZFBmlklPM|Wm#R9_;fpvl_G=c>%11}WIIYM!G%71 zl=xA`(wr0#oV}_bA!U>WBnD?bok&fwh?Pq4t)9qS* zx|H=d`jWU2r%1-U)g6qtG6U_ss&mBrC#sEBg-KmYbpRH0pa zZ@6-ODCYd@t(z5M)bzh)GgCK4P~V%Dc?U63N}D+DE7b z!_`4!;dBA22v^CAJ>e$TGdrjiJoDZ)L$T+zECiK+@e#Q-W>^=uwZTOunANhRvP=9T z{Qby%_4YLaFeBE5J%3i$DZfNSghpvhfN+i!tfGX)IVTGb-!Y zD9}po*X^y%W-vLqQGj$`1YbwONz|`S7>yx<2uF@;$xApVAcH=PCzSJe+zE>T9bE}yum$Zz}<0G zNm391Q4#@EkaXXrU7gIlZm=M)i^@8@ zBbuHaoh)8{l&%u5h{s1#sQ4`duBSbPmfBv)bqly5Mn?)bI*iIxxs!y$fhaH)=W(O& z#DJNX!nYz>gQ?r4JsNO{3A(l{x$6?Y=sX|_l7NR)-V=dom)Y}L=z~`*PNTXkNm=FG zb5_IdEK$(UKUeYY)V{d=ci?ZWocQL__tKr50(cX2=o34<@!(&|FB~(UR(`J zP}|&dbp_F6_g7qkAL#x8rTVM-T7FaA3t;GCd*}-IO#O;~Zu13dr-Ym8e`m<5-~J4R zX)p9go^AP$`cF4fM}|Kd)2K6}`p7>$hye97$=|+b+q=U(i1QQW;feXDYwzm$)ziNR z|Ixnyb1^TxE1{249dE^7u7)`PPynn(2R`(ZGZX&H`tWZryfAypMSvBAUlrv8_kxIz z!M?5{D2p1}j28jp+i6`vC(ocE4b8asNzyp2tUd7Zz|5To3v%bE>s)ujYdMZzskjxK+EfLOE{InRk_0w<-Io07eR2iYG}K+cSBp+^ zd^?6m=oDMjw&${wBMMX&)EJAt*_dOSljKH)Ciu2xNp6?;@k%vX7{D zudg{6E*5e4Q;8%CEz?(tyL5zh4h7!}1Cs=pLq9=8yQS)RbA*7MWZ!LoF=OZ@UQ zUZ1hhai;;(fhjch^osJNAXQNEji9Pik_Syf1my`8lqdG6Q)s5L!v(2qRMvS-MzW-EGk=_p}j_q+%@>49g6M4whz0@Jy2Yrj{FK~wG_`UDTijMDkPXeEhh*%Q( z%r;9xh1`}DE=!2J#J@uX_k-p6&!2(C;cwC@c=JUaZjD2!`j~R1H~OgXPky@GZ1@fR z&%TX?gaN(q#J^9TicVBDa>N{oz~R!16aVyZ={Q@WuR-=oVo))XrX)_FJTNMK(!^;R zmqA^`v6V(C4^3=9xBwe~%DP<&-VmUL&IC3;f_60k3zr*RZ_eV%)rs7^_+RfJNO-xA z;Qj?O+Btc8RA_?HF3Z!q#J`i#V$)x6aTVW?_<~S#Ro|y+p5j-pE-+3*K$vEfUTm6Z zU3$&U5n7nBqRja5m6fEdn}$RI-|tiI1IoZ2S_(}tLbw2ofXcc}b0!`EmHSoIrg!Wh zs1>eW%4qx0OGH6*PA+a&l9$lzJz(zWSau0r2cBI*MJ5>UGAM#e{5u&h_Wa*<$29{@ z>N|$ujuEN)&-1b>0yW-&okC`03Ka6U(Z^IFEq~Ha`y+db_yO#_Rash<2@MG?SxAC_ z)r2-QAbuE!v`XgQRXTLt8$G}9 zzI@fO3eNuRzLt%8*|yq0><$BAuiW+5^nvXO^xBrJnr67iEP((baF}c_3+q1I{`jNh z?5UPp-`}K*Z!1E8aD7 zZAM=}&HOqkvWQf5T#>jA148{gCqa}o2}`TEY8=;Q6RZ&~0BfMK4g*39`A-eVl8HnI zc_ZjtG-^+JW^E|l_DU2!DBk=h5Gi7RQ227L6?z;oyQezaW8^N!)v51pV2Zc|i3l#x7xc6tf_Pmu-zsj4LB z+YY}3CU(qgXktIY1=tT%)?po1u6le|!6^g;N%XcAI=QC19jLg`@JTeaI-ffbn}AtO zv2H6}DknB6R%3d6IhOz`GC_-%aS6D@zcJ_)eQ*fr16G>=SewKlSK~aa8zM@p6%&$O zmrdYFxBz&9$~tt}G9{wMHh%UIxK3163tlhXxNNPp)7#VSonm;=ZddeL5^38fAK$$4 zf+EP#$mATN090s#_AbMcxWvDu_I|KD_|glKichGo_ZGYqzr7sV`hnkRR@IZo>2vX! zr;kMY#Jf{=oQG%KQ}doSTFB$y_qlt0SCcm{xUp%yyzXme1Tmrj2K1ze?;xeVs`q@I z2pV8?i4z~)&;vJIU@*U9e|Z1r)&Kn@@c;XNfA-HH3;91!g1@Jv_>X^vfA`^^=`u#s z5QPgMM5wGYy^l(|;ygH`#L%hXbn8{e(y!do7=Qb93qMtR23`wJlM*1mT0ihx-2U!S zD5x79W4-4=iuyHdb(TGOKG-N+1~zhue`~LH8QAFm|6Xl8`3Ks4?x9Gdk6sT@q%&^I z6#tjI!@qe!de&o}I>r;fIiAslL_)vI2nh9nPOkzwy*Q{depg5{A{h0W1X4zJGRe?H zB83Z(NT{qkB#k1GZmrh^Ow25!K7U^r9j=B(*ZiBVR~;3^*U(Ik3qN=rH$5~MjV;0A zj^^Wo!e#g%m-uvi5KzWk2nj+TyHRAnfYi-^h9)FsUY3L!WWRO=HX%Xb0!R=l>w*NK zf}->d*I!Hw!apY0opRFPT7(x_A4mNHC6B4(y}s&O!PF-7{6^g%pe7BJ-WWwSWv$zwvJs3fUDCuud2$OIWh3qVGwto;s+iU|X;2Zd1CiB>X-37y7*R)e`{(2%sJ zZOgZQkukpGlkok3-@!X()^vL7)o1pI63sL^_^>v-kFcOGGQS~_3h-B$n{_5#Yb!os zE>Ta(_Shzbz9E~9p+asOiJqI#eqp8U_*WxDyK*}?LZU;t77%Rw-x$OQdg27+;kf73%1`q-)BekG8h z;P;L!BY9kiu4X;=tKA?>3`ev8!-2{=4po*Zue~4mEtYFAVhEV%P>7)91qG}qZRhIV z*U_k^Iu0G31DQaDCTQt0$b?IL$+4uAFB4Ny?3o!0Xq6-Zsp2|;Ug-@f{U{-|PopaF z>pXLWp(7I|5iLMTpt24X#l#F}ZC6wqx5Zddh4+-Tf8O&jg_E?1HDkqH=+IX6oR3n7 zmZ20};@?O;KUkjmf7PtIYF34YDg~Wew3=R8w2FRTDWhe<%9LbjSdutT7|9vUNsv&Q z)Ft)H+HtWlVI|Q5SP3fYa3?6N#O%Q$!U=Eo?e_4xwU*5Xbb2w478kQO+xIYdrt{R6X~|n)+b&F#a>| zeOrC@YKSISr{UKu22nT-7#0kkvSY#NkcdTHOuK?gOfaWqP#Kr_H#8>{E>VUdO(@@3 z7;shPtR_Vn`GiGz6*Xaz2cex@C^F#^(E_*xD(f((nOF&YsbDo+OrZ}Utn2~#_`U-W zZTp8HIuJX93O?JnhHE3dwi#jtYOf$7V{=N2Ai~-09TRi+-3q|^Wblsv^Z+P*y=iS_ zw*h|EYCF~Y0|YeY46~fe@ffJc1k+iD$8d>%V~iyF;9-As?vVtGXlA<6b^J@YK zc>u`QVc@VIGlw57$l;^14*Nkf@q)V0Wks0ua1J{|Vt6wqG3*}gH#a?-;maOy$dSKdF7a|7nfD8HY}y@|D58%1YcKS}1h$xl9@mFqK1HT3 zsieQEEl8zWS8FK1f;KUI?o^z*pkXdQ&>gh!Xsv^ssK`Ts_vq`gSlWEZK(q`p;1a(m zFw@t?O%88k&t3XaT=@atQv#pwDQQGW8KsP$$)Y%AN!Em+9Tygxn1Of!W&oA7?MPQI!{w zJ*pL(>H2s-0%&4uWN~ygMDvkNf^Wdn){;1YR(Wx8SZue#)Z#uxL%3zb|o6hj3!H!z! z^H>aHetJJ%mfm-X&)fiHXkLC@m`$KO6;(oWKd(uZ767aaVnX>9gH#zUGnxcGi|qx3 zv6<|T7bN>pS!ewMDmkvO{ef1W0ZwhNv_%I4y&ZG=cFNtaHgx}BT*7;dmeO`US0}s4 z4E_5`v6x=y3*J%#U63t?iwaH9@ntD|m-qq>w#mih=+j3@QAN;6EECl_K^l^RMycol z!0!{V57;yLv6;z_7i98LS?8Ssm7GY(fUjB+GKh$4&%QZQ`D(SVjzFHq4=?>E6a;ao zmX$HvAKvoq;c(cmN5GvO@*RUHuX{$g=E%=;0{sv6dh#@@t-N_bz*$pB;1ii3&E7X4 z);rS5IeD;W@Ar=vSkn@;-rhCW#@USwcj!YU+q3z6fX9y^x8eh!E;+e zgRvU4ApdnR}WN{IsevsN* zv&JSiBwm0GL1itLJ*`WQ%d$~81f;Mv;{83mc5$}gC+U$b3rI$NtmNmwHsK@UXstEj zTA6tNn}Nt#6QFd*-LBmqI{C53NUG5qFyqIb#A5vOksa|eWQR-qdl~;_WGH8i-@qAIB-1z4KXPK#@vqz5)?dJ)laXrVj+^CZtyui(?41`Q2Yh1 zO)vS(%;t)?_j)mSFs|wS=SPqI0-pN%lrcq*Al}*g-t!H7x&7x~Z0H|P`kxeMF5(Qa zue^y_R)i@ftcntT%t;xcaS)QEu7fOy(y~tNM3=FN?1>j3dr(<-XayxSnHXBZ+Pj~yE3zObpSm#O*qns^z$#wGq;E>lj@lmB&@GA~n5 z#Lu^m&bxZ~?^iP}P%we}8igXCB;q3_K?J?pve1V~OJ(e2Nz!pHNwM zFb9*I>R)WFl#t%t!*%GMA7r4c9C~U5zW27=i8yY}9YiHE*@6E&@O>iwAkI@Vkb8z7 z6mvpzx*(xK6P(a8r_Vx`ge>Cv4y}*kBri!pDvBuPjbHengDI7uUW6O_b+FC`1$OQ@{#;AxxH64yt?AnSZ`)Eouy zjZSyvp4;!e?18MhFATJ|y{SBr#~J#CuGU}{7)}XYkxj8tA-7^D%aBSg@g=2_{Cr2$ z3r7y1=yT65m+a4<=Wf!cr_0~q0BVo2ojG7WHO_(b&quK|*ZB^8=D5zYsK{cHm(a^7 ztRa||G$aW^nkI3PH>tgXIWfUm$pUZ|D(g05%d9pt#>Bvk#}+JVaA3pjMqAnwD#(SN z%YVR>)h}Sb;{T%NI;X)ADm1}dm*J;e;@{9*f3`d~Kb)m$-Q=Wda==j0f|SthBTZNp z#93Yhg&kFrm>8;L0fq{d#pA%J$VG8rbdsmESmiavK1ZMQK*98 z264hTx^1_{Z%jrzc~h@fO~W_+)4-y(p=aK^gRH9%)lZN%WikOP7t5EYkXc^cZp0QZ zxN+BO_GJasblY~-J&-K`t4cU7t~#^?3Vlh|on=0bDOrYNa*2Nzi^HBi_hV6RPN3eL z#95ha2H}>>pd+bt^e0Dd}8p z`AL-CSq}i%0PiHaoA$tPsyOjQb9fDvQchj+CSH3R`WfI;8d$Egv#Mh}ReKE;JuEOK zznsAZ6`7#o3vdh{EHnRQw3}ljk3jq^Vd6xG6J5UhEzhLre0nXuzEAMAo15ktrq1Dm zYV$rzxH;09E4{^kUTy0aYt|e@O`rGV<0bvC#Kb}|NAGV~k9a)sxTA-G;|nws;y?Xx zw-Y}2Mky#90gOk(KP7g0bJX!0AMMZhDDYr!=(-arq*b>)uGf}NKgBk59Mcl`Nmb>9 zQbtM4SU~bBqlDHW-{>>iRMZZbPfScpvH;V9%DR2sG)#-*evb`uHeGV9YE6wBx{lMT z)(9o@R9Ccr)jpAZfqN0(|EXCN3kL%c@I7cz{zvYd?wC%n@EPQ$XNoDJdVMhP-nX`fC#2HBo8j?86BT~fBPr7cRG>xM$uIvEI)Wp%G3ve{3tkXDA z$%%moT)t;V@wl(|cJ~h*GLIun!$Z;s4BO! z<)e$V9l%i`x8A4AFg7mn?-6}NpS}!}yz!Hqltq&QZ+=b6Ft15b_<^4`eibzir8iM0 z=>pUVD(hBy%dCi+J4k?jSV0VGQyk?q6@yQQwUOxptEn$+iW?zt$ zG@>}XI(CP41DDXfroY}xeebi3QtvT6p94-og(m3vGH{AZ{JZEmHhIHB8k9*y(x$9Q zT%{Q)lbl~QlRD!kFrOd2>`D97gs7woAS$S=ThFHjMSD(kEYK_$=WHm=gxC`LQ&o&)$mg(fKR zGQfvR{JSVI_Vh^@am|eyQl?1&jmT?~`&B^ruY)Wri=aAvE2m0q0zT3OfDcsGt;A@9 z8EfDN6;oQp-u35$xo;n%;f zbiKA|vJJDLnyIK!K!xuh9ocKoDNp%H2Z?Jyx)RmgLif5DHMxM($&a)+~4Sho8+y48R`1-IpDe837K(5JE-!so+5(q(WEm-sj4SwWc};pMAq@05HQu@`L2SEBmVqq;TN ziR~yB=D~zIwRHZM?jSmq4*)+kgg%!W2yuCy7gWv={D%f&>qm3(E#)AJi=KHe#Wn)_ z%-x=Dk88RgwKLl=b{KK|K@7B~Yu1Gs<%3tVHM^5wcD@_Q5Azi^qsLQ&%G!?p`S^ym zkz0%^_h{Fm0U@i6mH`L;Tg;Z{02NT73D&#}sNfR+*4B(YctYb6ip~jCokJlyCA11d zB8qOI=C=0j{B@}bP)HX56i``*HKVKv6LvXFcDOhXiK-plAGU1o-BNmMn5hbV_KjqE zbNe7#cYHX31O<>Q1pS$M68q#I-3@-6+Z4lUl zr%94PaXEqNasu_`gvNDFMENRIuZFd~F->Y_vC{=vY*f}^5SZ9t5TZ{yZWY)7aP~9W z#CdzTLV~`^liA~gAO8%$VDjxje*PW^-~b>Y3!w(f;+o!8?OOK_c=O+0|E#tGz1PX9 zhCYM6m5GLC&|)3BsXZ8rVRxe5}tGYZ7jfzY#t7Um;m-x3d zs}Gh3zW}VHPY?R=fR(YE$eC?-tJ=6clPRkkp$;!za0NKB3n?MdhX~@jDDvDVAz=99 zjOBy|QB2a1W_6xaMeIPhWM&dQTaZLYW$nHJ6`QbGqOxbMgg1a>Ic~t}6wwN;>y^ql z_B35nU}a6S{lbZTVoYo&C$??dww;NMiEZ0XCeFmRZBLAQ{)hX%ccZ$xdKG%LkHuj8 zh%Q1CkE`(JHHeI3%WUF)7nCxIUQr`1j~cTo61+t6yLGVf$n=yIJYG!mrv{_#e5AR( zATva?iYnaYaZ*ldEau;HKW>V8)xzJ%dN4PC;@3&&0jc0}SfpG7P}ZF@Gk0~f%%|Nt ziom`{e=Cw7O1A*=@q)bAd+6yEm-{2aUp-g|>8g@hrn?&v8N`T%hGlv#plSZqTIz^W zXVCqLe7oFFvTJ5wi?n*LrF10s`(djzOu3PcMoM1;wy#!AOhs9HWKy3oF+=LhR_He< z=#&mY0UXAsTl;)CzP1#7ilGzdiy)x-~EIi8@L2?s;;;f1u`?h z_?Q_o6n7k=Cu}pNcQ=T`FE_+1>DN%E@TX-dLP)FKG$Wk#L9z^3?lH_jB#=tp72rJY z=w}MeBxT0!_y@c;P0=+dL7A1%AZgkSm*+_Simm_M8IYYGLWm@IFTemcmr?b#4McGi z{4D#^@V7yJlE}8_=1=*FSH)`zQ}ig|sPWxHBElLt+2D_f$!~)icxGr$jRRshvaL{( z`?B~v{dQ}Sx3V8CKE{jT5w*kz;E6Uj(x>t2d3!71dX5uMA62}sm&hM1lLT>ZR|{pq zZJlLXqY9fUHQf9y<&Cq^{zGLH{FOvH$!-XtG_!@$fXeJ|Y05;*XhydOF+XO@qsv&) zHn%~QYHp@4ED;50d!8SIuU{vxU>FK_O9A?PpIzTXjm*KOgdYPMu9i3PCBpNtC%hnP z*c2AOHr?5lLNfnqNlKr@znF^~uWfPnZS6b!50F1M?_JlA|qMsFiD8!x!yrzGBs<;rpeG4j9WH+=vY*fE& zMq|}WYcUoJFa|tJri8EQX3-tDTP7bl?O7C$71$W0Lxs$jl87aXN+mUo&s;GrPlgDX z!S5=RSHrJ`!y)lhcj==M3@vqF=liWx4#5=WboNelEp_m);?ugXUi5a{{e`x6eI0S1 z;L4{~wH)y8KwvvU`yPS)@z~$=v*LlO@-=08Mk+f*_uEf9F&|;Se*A-z`U;^fBQk9q zbGJlMt8CdMD0o>xrl<(QPjgGi!l$Xpq^_cFIpMWdHSWK9;!EVO7=?biu!!Px+yztH zbq_pArR-^Ho3!KSo zkaA}5f-2?J2f2sPa$NaUr!XXb$9%{tmNx6vUnsdNr&fy>mHdf6$Gy2CU_n@*Y(h{L zWb6o1U*Jz|FFlIMu?m&uIxTWV{^i*h7a|0(l`2iGElIqwW>df9+T9>M|74iHKF)iA z{p1oT`0@QqZ8on9nV53eMWy$4;8FR>@^J%hkUKUwD3Jy67o`5~epBX)(A+E?bs?|I z;g;-}R_lMxVdLDy!{vuVIjDf035F5pXO*8Ab9*n4CL=Xv|M>3}yz18fX#?IOt9oRs z^FE}$8gHOzH)w(X!J*URXj7R<98kH`Yk~Z8$`*vIBQyhH-kLtB#ze=Twj#rX{KyYc zYQ&_?QnYCAYLfS1VIQvP$6zK_L(&pxlS39}@V8nZxb#oSH0_-xByzy~?OObTaYynM z*;ywg0b|L-5kwdMn=0~KFAO8Jz%YuZY#5P-O~?uKA`s|gzg%I9A7}Y#gbpBMuoM|D zrjeYEH&n|eqpQ4Pcg}z{9>)v>xq)rVn&x83P)STtVZF7>-$^}fSBZF|^P=BTj#vw3 zjIuh6$)fT_OpY6BdfTmAz0>FC9Zi~aRKLe#oJ>XSspc85FrV8D2!AUx&3j3PF6zA> zO|$8`oAVZ8cuNxUpU6o$DF)YQB)&d05dXk7soUxMcs*CGeeKf*cs(zvpJKxsw==EQ zQ68q(8L2~LiQ3ivnzxZM!Ny<<*1s^0RK7hL*{ERXW33&57z?D2xAei5Hd{E!#6V;} zL7c-7#julb)=%v*>N<>kVxo%~GomGNR!mckn9R!D> za@vYPB1Or~)B=P!sh+Y1+~P<3pjGhr{2fL0Cw0@ zJmOK^1tX7^%?;e1B9ey5OLtMDbOCNuvQ2Ls2SAJv=E=2Mom2r1pd&3C z+O=5QQor=2wyogEtJ$!SP346>V!XK?k^9KnG!BuGvF6Ut$8puxSRjV#v!u+a#DC>u zlk}8yO%U!26o2-sn!4LUS+y-nv6d>U%4I{OH>K{9o(oCDePdsP>!XN@jozoSwU>tV z{zU{T<1l>ZJ#vY0AXV=M>+wvknfOew%^_le${SWUQ73{PRKLTsdiY2`!KQ2&J#4OP zR?l=as^-pQ75B9IT6WW2l*@V0AF5)jpS>7U_asoV9lwYGSE$Z*3KG@};AxW5$vZH? zk+`-n2}bhx*(l4;*z97LX4(`=^a~v*g8hAW-{ff)-v{#oQTnL5ON+?=d4z=H69%`ggxPidO)jQM+krKI!ND8_!G2*d_Mml z$JX0he~C8H$XmttS)pGIr3`Pi3NSlFr%N=NF2Mf#TkKjS>PkANr|+$aybC?6^Ge@8 z(;CtA+P@n$mVRQDRXp|RsF%KVx-BJW1`&fxE#lsQ183ny|064Dps$Tcf&%X8qjDU6 z$x?h>c_kzjH_ktltkHZ+GxI0ElJGO8&fd0gLu6!7|MWzTAEzxpp3eT2`7<@pr#`yJ z)%cG|(*WV)!2X`1^1(EsMGTr-+m2ujn2s_fT{_Tz=*I#7jDPPM!deag_GN6!y;q+S z(94^{wi?a$p`@nLXUER2h8im&ekzeXjtzs&B(<7WJR#_t5Nc_*jA&yM-LlXwE*>A; zv@1-I99(UY?{PM6CUG`nRGsqyB(ylg`bG1g_XqbK0*UB%qYh~SR`BZ$VfLQ(9YW&Y z!~{m6ad=w0X*_4E+?0B7Up#cTHzYIhW(*&FtgKk(B}Jw?0=axB@qKUul|MPpKJJ0z zGrj{7CS3BLOiJf-5!K;&-tL4HM?ChE|M9n!j_>{K{hFzXEzA7z_VrE|o?i6{X6@u* z5WF}1Gg0k_k5ls$wV5u;sRFzVGO6AKfO@^Qrn52Rsd-K0Pz$VBGiLM6=m& zmS3ghtCNby0=9NO6HoJ&=8tOsN>D17@>@;-1;SDTxCxO_jmiLeD8_vy0PkbM1Ax#O zBP)Fyo6cyah|^+*sCms>x4Z#hH8NjcbahRVt*~a-mwl8c@BXc%`FCpsJEvu8!qKh)tAl$?3(LviqU{Aa{Ik0Ydt#zPhluB9(kJk4 z!G7p-Z~p{(QX-28g#u_mFud2YoiWqd+L!eubxYXiQNmhn%I3ed6Yy-HAP`u0efi_5 zi}M?HllH?@HZ_-}Zl*U><$I)wXye~oY}OZYYnj#D=hxpe>U@X>zSqqg+vmc7Aydcp zCJ}5PeXjqv-`AM`y`O^*J-`3Eq>GrVKUV0xp4qfPb%?QMW~=%8EZ5)nTFem&y7Y*) z#(g7G1Orr@U}N+wXxu|^wKNr;AJEXWvzLG!bvc3=!(QJ;4vt){n?T?w(St!fzJV_+ zZOo6B)SK3Q7$^RdRuY#k=2u5U2wl zmx(x>kbekf19<|+Gf|b`UC6-W|68P~)zW=DG@1mBfE6?X-%$~LgrZzC^-#$%y}_0lUD^5TKvAPF7f4+nD+K-U23#d9=HJjyxURar^3Z%fs~!9I?-TC7TAJ68U&9 zT{K#!P(X!>Yl@M=GOEgi?CKq)oN?X_G7 z^FUo|G!~Nx_wAip@m_J)#DjG6UOhHtVZxPg`l3Y0i2Sm50q(DSiydF%@H8Aumw|<> zVQ2iT?A-J%43scdfFIlYXtaiqd}VkPMT4`u77Gw~@C^b8K@Lyo!HO~%qPo-d=hD@A z%15gwb}Em^7DXl1o>M2rsF@iobr;>eAQD1z-vNHfQvm@E;o#^k$V&Lw7D8sA*OrWq zPWv^Lk3V|a{M-Vdvg}+ogKWGL!sRRuGCx!aE@ctxoX#uYZRok((hj$Z@^Mr=^lX*k z_ygd*i&@4vtNJ1cTHg(k<)f9`_$-Rg@gib@7Ix}1mV;CmwW($*sdvukya>|!v_ZcW zZCT)<#JJT*-&YF^H3lfij;H)Ap7C~uMq8nS_(tLD)~-IEEV~wS2(qRqYg_DkcjGsS zH$$0V@c@<#?#rCi*tl5`G9>XJwcx5}xTk_L(D`XG!uBV(r&Mo{r$AB-7KXo)9ktO& z6i=qwDzlZQ(vypyaD?Cv;3Po>bb6EY5biJgFKX*Ytb8xEj1LXX6%w(@M5je>?sgkr z$7bSI^_MwC!NuF}PB1D<=(3eivXb5JLqf9CV1sMYP>-N?IE7(7k!NvDHrUE|eRY4_ zo(J`%%30N<(tJeMGv$yKcG4c}jo)L8A8)tKovXHY8=V^3+w?B)i$Nv)8$b4V zg*Vy|f1=sP`>~`E%RWx|5#g0tez0!>%XmaRpqPq!A-NnqCv&)koTh=&fUCi>YHCg4 z95^g5qsTfV^7o&Hvljf=|DNDU}Zox5axd2Z-BWwiX`h<3k!3*o=KDT>oPZ-dt^JGqX{**Gq^S%n(wgNA;4D zQgTjN_?=oJi%p{@d3|JWjh{uq5yl&@A2UL~kJSMG4tV_;2UJ6xo+)aFxQia4VYl#Z z;&#XnSU83;PF(VOulaIYunhY8 z<8_E=&~X;#`3rlJjH-5~s~WVBOK}Onb@u6y!5uB_h$U8m=LqBZXRsb6@8Gu~&xsak zbMo82-87G6dT_U!y4#p-fA17(>8-W)ekCW+&^6`&9)F6{5_(jFD>LbK=hwk%QyRMs zx4Me5Iz1cC1w4qODWb5YP&q{{k&;tC9N*yDX{5m_PC{I4HI`VvGxglU>39j-!v6A_ zwQ=1%?MbrIl+gVl1&$U*a^$dNsVmV%IWLWPuT z;bRmSa`{>gW!p9bq2fypAkmKb;14sB$La2*Po&LhlVH?

$on4rba<3yrDCPFmt* zoz>~--V{9Xw`iHQg9MyngFQ=skn@q6&E7~0%UB7{9R@!jZ9VOgdEZ+ann0u79CKnP z*>S|Lh@X|eSv`M9^!<3R7UNldqx2t9?F}O7Q+S=aJ+_%5S4qYiKdaC{_CadN!Le%W zrcdP4tio#TWa1NBB3={@RCG=OXbJT#BOxiI3p#@^YOG;u#-Xi$r4^?JDeG}`U!!}2 z!JoBk;zgREKMGgjhCFt%=#=x?USDp+-67DoGYR_LOgWE>;Ic4MfQ0x z*K=~mQ$4_}Z@9^SebGqcsRYwh8Rw~tX<=_nl^N9cLn73y`v^ym!3-C#z=Ho=F|Ywyig<@kd8 z+qpPlwmQzGWyN;Gx=j8vs)tW2*gBaqB$$s&6mi63?A3aqdq!z3;0Rj+8$`8g1kiry z-;k0nR90FVD3`NBZcx)lQ1J+zH`YvqsbrqaiQ+=Q|7{((2r))C9W;DMWx+tYJiq4H zAYHqp7~FdQd-G&&*0fK0h<*udOAu=%$}u_q58>#See<7XYF9%I? z`g_^S%s1sXw@Uz>an?1VZu)fRj|wPhB8Orw4*cxIBS_2(BDm=L&aFpW?Dj!#o^LL% z;GO2lA$xkdu`62v4K9;7)+_YHd&Z64)1e@gHwQ&=bw7aQ)CiSdcj#R25vx0jUO`MfDLo zwGC%-%7`gythLm3r1*X7LiWmC$~%^Z)GKDwd{#ZM=MzdF`21O`7zNQ9Q_dea^p}exM7O)817`unp(>Om!^1w z*pTV%H<zl5%omPs{jwv<+4 z>5W^ae2PS)-X5%I8zf!Dy|jOeozi{qab4dQ8pqKJzQ2W;ed4GIyG&*x=n;$ zHY5}hWR7B=6AVL;;n7T;Iba*Fw;|+bD4(7XyGHM}g6TGl#)smC${i5}KqA4&iYgNS zrJtTYP{H_{Y+uWEcL*51&+Ll(=4cAMTMn}goIPssGk`V6o;lvAbDW;_kYJ3<>Hf|C z_P6aCw`7g-8p82HA#b>5)}j>|+jl=dJ|VXrxwu`2Q=7;Qc*Eook!go~JmA z5LP!HDl@Q9vB}^&)HjcHD?NG+dF!!nOY%~hNFB!KeIVnEwywri(8)6D*OZD*n0y$c z&@lV0R(%^#uzHA*bp+<~dN;mWQqem3GVK4d-i1_<(SHas2eO{m+5$W63uuoY8TB(uX#WpjmO&(uc+Eitej;D|!9OW5`#6 zVF2IO;HCdcA4hnDs9&74`Xt0Nbmm{?Z1@a#O8}$CpMnIO2OBkgeKh{(1db9JzOhl# zB#Hmd*rEh{YVf4Y>Lg2SSo)pVzor`bN?I?Lm1 zDlKm_74YxwSUxKBs5jDgFm`vJ01{q_0z;ld5Z(CqTmxHKafAIvCp|%@aXs7Gb1T#!aT5 zQPwS~^&BC4<$7{s5i+iQ$lpM5+fp`gkSd0v$7><=k2O4Eupr;BVveRwVP!PBRwuad z?Fr}5XS87o>KO0uc?|KJXYrfv#JBSipb$!{Iac#@kZN%rvaqlgwT=TrvLIcBf%FER zQF^wDNkPG-xGyxo|Dtma>Di-R+=e}+E*Qu7dRTuQF4x=+84fuw8(|qN09WY+wd~w; z6+?TUT1<$wbhZ+%M(RaO1;*O@vW)!u@d&j<;O2&D3)SyMze;-9O+ggmb-KDH5=A;u z+O_c9tIjngovWa!Rd=sitl_V(1xAK7Hetuk!lcuKarfee zO@DxI_xRUO`z6`gl%A*^Vr@cG}?-j zl|9r(bt(>+tIbY17&KmDm27zx!9w+ZHjnxa#l5Y7b_ctc5%J4n9XHVG4a0JYs4pUz zA8SVe{FU)W7tn7sZcb1HBc`a~7&XO0B+!KdWKQ+;RGN+HXkh3^A@G_^qR4F9)MT=g znH1nrZgC^-RCX032`fM#s6K-GK^rCKh&qL$yZb4n3qQup{^mKk;?ii*U3QY_^o5Ue zVpO>15u68g66{qrmCzvt)=TVRPT*oAQI>3QFojf*XCM%e`nhC_{ww}eOH+Rr^a}HV zYW;$`J-!OXP4=D}|C}yy7i;3e2)q!|Cg(!+CJr?EnzHxJY|(g7V-=_6$f5Shwp_o3 z9q$FN%xV+u+-WCp)JD=gJT;uaNRhp_VjTMS8gUvQcTd%9k4}x_P2uVy7!=gk{q*Ej zRlL7^pYOlBJE_=xg`_KMmk>y@wk#d{^*j-r?uYZ0Z5|%eBE*DP;2+f;VI0MCLoyAeMHg^`>Kzr>AY1LvQJdK}Fy5aV8N@eEd|fQE_v z#vTJs^=m6$arK*f^?UMZC1Y#G-v7=Dm0Nc%JcpG&m0MTI@c#A}Ng1q=du#2a=NOC$ zMDDBq>a~lZKt?=np}<6CFi8T}i(5!+E35b=d7K6)@w9q@Uq}6Ne)b+kR&INBO7Cc@`ELu44eBG{&}S(8p}cn*|r?N_O&rp=7ikvoZK%51#r=aw%mb! z?O3zSrlv&7!>vCatSDoyq9X}ay-R9#=`lHiDo-niIL zz-h9{dEkKRn-n0vzT|gGtwt~^KmIY)$78E*wDaGA@^U9t1d3_~K~WHXpLC+WM|PT+ z9#GC$J=A{JIus9kn8E^(Ti?m5BIuB3mNr>8wzL>5WolL)@FE*@c5iPg4CEhrxNOP6 zv3U3qBvog33fx>(3Xb(-8{C+7dAc^N2<=6&Z{F1mnW`m6vId3P{cBtl%XYEwm7t}@ zc`19t%Cj^_6x};-cXz;nJ@t(FS60)WCJY zq-xdx)SX7rDx?Id$OtFygKCwWgNy|cQR9-=fqWlQ>NoSi0M}J%A^7ps74)9>3xcw( z-_6k70)(p+XB-zl6V@i=ADF(Otys`u=%3TY17(1l-=M-zXpi*1Bi8$?fghgiD`PKz z9I!rV@f+D7JB91@IzYqjyRF67 zLtoSPri1%h*_6Cr-_j>)WiwGD zjQY+W#{eH%B*nY4$D^GMLdj*l&qJ$azZ@5Z-pKh;RJ-HDq$xuksvNzSvnIL#cmCyt zGn=2_vb9YH{Oh@AkwnnAI$wKlFQe6--7VzPY>6s5fk;u^DuyS@)Gq=n?SBZnE<@-;B!1Gw3F_jb zcB%~>hYD&(7|-Pfbi*AGR|4)(sDMJ=2*<3EWi%tq^9MMWspSJ2!5~%VcW8aX{T+cQ zVT99M3Le55@qRG%wF_^uhGL3%#XUva$Y8=lJ*k768~YUeU?3F%c~K)QAX_prv`p7~ z?C}ht`hzcr{fgAgL4RY@#8sQ_ud@W`7#r?9jl}rK`bQ3W5SC>1l6G)2qr2Qa+#kAmgA;J&HlRCEUeBUI#mbTMvjd6>Tn z1ixlDKlTI6%`@_-%UQVaiyDwm3B)scc%KTi)3$PhM$>CN4*g$7aaM0gcSMS`b%x>u z6{!odS3>Tx(eQ?EXtzcy2*r(6X-Swt?!$Q^F=}Pe+NFw=Qv+U+zpe+~gk`;4zRPxS z=my>BD3wE62mq8|?bgFm2W7q(BnF-n9Sma}DR$*U|MQpc#2tT=CMV8@>8=1V&@iOzt|rxQCJa)b)$ss||q*Gn_##F98ttt*L(M=DVt8R!QvK|ulwM=S7C z%8LBYM{Mb~fmFhmB%}b+Rg4NON=`OpEP?rY)OmEc&HFfq9~n0=;76R-yTgg-0Cx9~ zM0}7rlV?smKh$>_4b!Pfd=w8@=?*qsYS8s0rXW*X! z5RB2^jis+j^+T;46!b{HM|w7J*Ei)Arn{v-OxfVy$U&ON^!s4Mhrgt$c?6rs?fLi0 z>%-bRsPX`g!sX|)(x9?z&Ov{tzOC`T3 z5y^7;ccPrKaYiv@# z;Dl2EgoaEyWe!--OgR*y|MRJdAuLe+>jG&KDg53m5&{cqYWIQrhdrD>YThV%&3o9- zAAaL4B)I2*{A0eS4-*?j@NjLH>7^JLlY4ZVhj;8o&MXlH2EDz%pdNrl^$zP4yc7Bt z`oSf?Zt*PBklx%er?CDc;fvZiwko6;)xLt?l0dbn3NCZ1v zSN4+UoU6wE3vu1|waQl`a@k8Jvd&(RZEZ{s@|RvZDA~?~3_nDc2soofJbSw}YkHiXQJmaG1Yl z=KylFF}kdTQ5q|O+bn;lzX>mqJXebfcJsE0Bf}NTaHF|}d+v!M+M!S=eZT4*gG0_Qo)NS{d(PJmHDDc~dbZDtv zpHx=TcX?YvZi_!@*gz0Kb=6WEJr=u}A`swR*0us5pva7P^qSSu5RY z2}Ma#O10=c+pW>w>LXn<{Cded)CVw3;hE`LH?8?w1*;*&cBC@!IG@uOR6zKo>iA+* z@Vkj6JwHI!hP!&rU2n9!cStQN$UMO>r-}`#PZpZXG6H|~x-Jr%Z^`st6@3z6lq&vB z)<#`TyG^tly0fSPPIxbNNpC`ZOkRZsEg9Lb^dDRvb(EYUp&N-mo>Jf~LDv9nS|H~V zD_)X(Zv{k)fZKD+UUyRvBGWXZQ&eF-PPV}bhFpKZ_w9d=U9)b;k-2=-LT^QOgD{L0 zWNvfKcJz4kXt915v$WcEw^4;rJb_*LEC1YY^r{%Btq!7qZrt6)9?E`U>%iwhY9l=Ngene! z?ulGki2sn0+sYiFs`8-b{>GDoe`0t&M*MBwl+vklobQc}@l8+M2P~cwM9cMY{zH4W zA1`}ju~mKI3+dVxN=PEi?ZSZc3v{hzX0#KIlc?nQkNdjqo$>9~v?w>u%Epl^FXQR3 za06fd=6cw4#gBtzZ+|ToyYXfu@@_;x^_FamFY{=Sj$UCT3o-W*b!egNE<87b`gt{_ zzcS$PoRWiL*4f8A51WLn(t+P8toNw`REhn|Ej$;V^}| z0zzstGLvEVMG4>WT8zo*SzD69*7{kIEoFGLml}8t*e@gkcIZ@|_6q>g^>bok^m2AN z-1_g{im86-qiok4Iw=Lb^|TZQH{rWVkx}QKfrc1k^uvBbse3vndY}6knZ|~nM`iZk z7onS4`y%2(tnE#;0j%7OH1Pcs%8A-hm;=F(MkSV#YR`5Wn0|Br?#idRAGeliecM1* zm;fWyb|gZ$C+g6$;=pf$7->7P6^nuHV38%WjU?#zcEF#307uZ6)9ymZmYUqp(;%HrBm_( zz@Utgl?~q1$#O733oS5wDg1gd*w1u7LKm;I+vBiA6IUBM7wU^F&<2`jZj8HpOv$@O&dWDru3gLH)AzRK0#Lk0EvKd1REpST()W8`-PvydHaaP zAuIFIZ|P0h#_NY%Wmn_xPWn#XT-Vu<+FtX}D&%1boM5n-ja~^cqetBOwKvl`qS%6C z?REv9E1?~$n-7Rc`~Bqko;4I-C?Ms;^+Y;iKEyXQd zXejz_v0N2TnXY0BsLL{I?1e|X@hcjZ!Uoz+18HH#N!d{dQA{u*FPnhVEax@=Pd$2| zVB32Re^8wD;QlX+nE{&No!6as%&aNX*J<6O_Cy^I-&5O#REWj9B;2A!G)7!d(7ghn z-wfInX2Wn4o^rTN@;E%@B_YhGB?HdebK1(4>Al2bPIl2OHYvzFz? z)hY0<_;g3ENz4yPfs7Rt3DvZn=&vQv5>BnUn&NIDAn2&|QESzcSQnQRhGLYYj19F_ zN1D>yIxCG%`)M!S(xX+-3i3e~zn+Vc z`L_^7Z`x~r3=nlR1=oNNN=&6t2}UyVV9);eUPrjlVM;)L3lQP}TD1Og`izXN0E5sL zaO>yn)#S3#n#&{!IFsS!;2GIJVX*NKn3#52|FjV5bT|c{Yx_4=)lF6?7ddw`$UD zwO?k>6qTrLF@nE}`8VNGerWY&c>FDCc8R+^#((n`Vufx!G6gpUiWx|{IC+U++>MJP z=Penw^IzWFgw@w))jYN00Ba$b7i$|!nvi_l7~|7ZnnamFW^=4jo>^StI-^#HhMii= z9!Sc7b0)o&6qZ7Nad)(x9X$&oF?9M>Ywuka*6>`$Cn+*_ zkW;l=aP0vX^mnq=^u4YFrHKjU&1ob*cmz8*XgQlFN%#^54+E!8r9j)aJO-SOZSUyd`y;RWc4WX9V)t$1E9N>8*rpaQy`BLu%uX7qh%r z?rBYam=J>LJeM!VwWW!OgaRK&N}0DTFRs~jtb$zvL_S*h8gW3CPR_P0>a*gCeX*$brEZ(6nelr!tQB0eti zpqH3pzWh&Y9N_rll6aIXL`=rIuOJ_XPMZ?9h!k%@0w5<6+4zpDfwDS9GjO5%cpSi1 z=CtF57d3JPH-|l3sue<m))NOS_0&Q`(Zv$b1};C2=r zmF29Z&{e^aIq9#B(YD&_G)LG*;PPB{L-S{KRZFv&&98z%iIt3_apx|1Epds`6#M%) zm3jAhOfaefOl1Yvog-EDlzciPfpE|l!dl`DQtvo`NMhuxvUhvW)Tu)Zck&zd9jg_7 ztFFE<#H$fH9L3nh5fba}~LfaBun}JOAdXkwgdGgkI#WQ;isx6RC!oVg6mBuz*)nBY`|}*OW+H>(2jbOR6LfMqBCw0 zzYxH4VPZmGF^Rd(mJO60^|Pf@{j&xK1u}f}@2lnUNibrvIU>Sfm2G~`)dHpm5A8-d z{pG*(dBqVil1rg=DBVDSrN_Loh}~7v0Tzl9HwojOX}r-qp3?yMbUOqkmahxm8iGTpDM6m^QDd4a;oZ zSueY0VR$YvI<6uNRytE0yibrA>o`W!YKpp~W6wx;z_fs2TK#mN3OL24iuHYatk?O0 z0{5M?R@^ISnaJ$9tGt8QtH&h_d&%9t9U^RwVw_VN8z-B^@1UlJx)qEoCFB+4o-Ie~ zvOTWNjMEmQ1+uY#Owg*K?;FeEiG|Er0PUW1@J=R$NUCW~S678SSJ$1qs#!s9RkB+n zJGXP|?h!$For?FW!^FUq>i!0puu6rcj8s0R-G%q}lzDy2R@sPaxs<7f9s(bojZHmlp(k*;%mZ!NZq11Od53 zl;g9kCd>A`^o(ca|2a^t()N^FKV>Ur0Si(z^9wdRkWIGDEHo!SqftvIO?wTlY9(z% z?KUJyD~uW~YEWD-r)9Il$ja9u;as1)tiG~~vR(!7Eq%0*YXsVB!I+gV{#NK0|sA?YbcWJ;@N z8jOgEU|LVxh8}}_281q6M{(3Tj^HW8_g(Mh`1duLti)flyZ7^iAkzrDOg(x!R=Foj zHRi&I!#YZ91#BeYPU;D?;q#z(O(YTXZ6J-;Cr0yV&gZ8X6GHA8SoMM1-uq?%dWvZV+2p zL+uadgy-Y2JbRx6q zoiPh6&O~F>r)ABe4&edc#TIN8j0)<<`?lM9NW0$=TF|WvAGdq5*o2!|ue=6GTTRKw zm#g)l9Hwa0fxmBiu|n8;)ZGf&B|}E;6*Z1&UClsw-?`xuPQ{@L(`18$pSV{`Sy*-Y z!5F3rruCPP8xp~R{!zMI($PofECyu^MWh<+SMV7c=2FzsO#^J~MlDQ0M|=6Z9A!VP z;b`m!MZII%MKcV%wqGV9B*hU(hvWC@fMIcB?IliGJ0ur)L={wLI@pl^;hF|{B@nK` z)pi=E)ntGya5F&Nb~Jf?l-q)>naC!m%TrW3ro{ja@8{@n3+p~a&H!;~=Ep@uqbM8b z?}$cuHgO3Cv4zSYb)XC%4KzOD@{;_L^hRQi6ED{nOk-~yaLhy9S$7K+2=fKOje%9m(f?e{DN?_ z$qo&}i_c|+N-%?|5z`=aF}NH#eL7~&QK+`Ha{M7ie6BA!zhow)s)BJmsZX2A5+pL0 zQHPSFWE*4ziZX`{;{y8FswTd6tAcXO%8}yn_hQXHGz3kLTtpgrwEC+FY&+1QJ&EzP z3#mZGz4+Q?R7IpKZrjr9%p~i%I7k)Hx;mk+cuAZ1XAim~(L#6sFO*$HQ^^n!Y-5D$ zpnO~xjPKVgKzDLKN9mfGHzl&cjjhmNy&)4>oRHPOsXH&AblCfQk+YpmzBN2s#Qfk- zBm-jk%l5SQnwz`cj;>$Q2v7GO??$WGOodEEZLu=ZpnbQqd^T}9Rx+ z6{l+^LZ$)`y|~Dxw7pO?IHr9Bt6qlvPYlcv5J;=cYiF}cL;ifs)8~ZgX@hA> zjb8T6v5bw|WS!H9Qc*5PD?HlBW?FwdMn-xSC#Sy%=>bG7`-WP^8lz7RWNlIu|3rX+ z&)m3EZEYByj5k5k)-q-FHKR5UOpA5bA11@yq@7^-O@o8Ab=(>{;}+ zxXFgS|L1XjpWxal<*|2bPl`*%00qvn>PHi@h!3{vBX$uYJ!YWm8pG@JW~) zd9b8fmIu)YWe@?<#k5BLdXsG*>jq9c2ZBZKrtKjj8`xadjCm;Bz;zGux7XA6<;|5j zj92q9&6>lTAw%D{acY+iR%x=Exye*5vUWJLt$92jcB;O}bK9jtyuUGPd)A%Ns!qO` zJCt6-aKBx%dE8mBmnaiC$87G}*7TQuRq5pIZInEX6HOKE=F?jp<5%}DwmDhJW<&Wy zn-Q!n7|Rhdt)hMjaeIsfHEQe%Y(_m)4xxuQ46hy6W`{Qx?HkbK5Gel|Bk~8yDWElb z{-vgRu#lMXaOW8bW+TOVcmK*p+r;nBHz}n*GqX9CWnUVsq}2%aVU_(iCow~v_#ThuQi1hHXaxlwuj9s4!i5;NjE+*3Ey}gAEaa$~%0}@y zD&1vFw*xM+V-+5yzcezE*kss~q@F{i!L5e3#+Tt8hw)R%6fPGnxF+A32Ki~S?x0Qk z(zm}1JuP(RHspXknU{$o^wkze-*;@!?G^<-^^BP;2=$*@BF#kb>t1U$3Rgk*yMqPswR_bGwZHV$x8Q~(sNSNehsW!t z5qx4U0Ksc>rA_p6F7U8SL$yij}{v!K-&lV?Xu#ZhEsz@)k{&t`S z@%vczi@F?99PSuXibG}{?}Ylt!0bzBvG#9ig+i>h;eYCqr3*-tHn(pwqJmB3599WU znjQ*!Bv)h##g&nn+pxrpb!C?~PNdAMRCa$p;#spz!dh-_V67^QUm1g-uPj=L?x+pwDn4 z;HxKp4{(`EF{wWnmUZqo97`XM(-lt{KMO-RmW+%z}KtYF|VJlt7w8sxbk}PFw8=asoAoXQPRtDyQtI9I5=X8)6>@`2hS90 zV($$b8>>t^R<-pk8DFlIFDbxLDK2PK^dr|MMwezrwrX8nLFuPR-VdqUJMVRIy8MYc zG)eiv9c&|b`$nU3Ol1LNHqfxHLjFGhL_xd0PrOrWIw1N=^xjAD6*9l3;o+A%VcWD? zTMS_qb|VqRc%cX4eFR#SnwGk1NKr^|r?ZYQk#|JaMXqTjpiNhl7)9tpC|0--P;8tS zDD34gR}mhdu#gAC=ICwQDN<}ROx3|%lGP`z?;eDSooZvaG(X!j)>XtfxvHMHMwQk` zw-);^?`&0stNr#KF7nh^?68E5jlLdd5&9Uh^$7)~d4xiZRm`|7bF-}E5aeFAkbz@t zAXXc@xHtck@qMfaT?fSq*8z%6@aST{0g4DcQL8ofHyi zDxdP*&N|j@^Jd>ueE1Hb0(Lw2f`US35CMZ4Q&$L8Xwph(Ag?8d_?(7xZQbUSav@kO z_1s)Jl*fw|@;Hi35aGfA^$6l&nG4SV>xP7tVI;@Mhs_v?DtuJL6n&FDdHee1hpR`E z(jzwzT?G~@*zY4ysY`RP++&Fq$zYMw65y9iuH9gR}LlUVub{aViPa_ z!a(#0!k&F!s#_>A;ASou2IDJ#qdvITZRa`2zP1*#HdgL66iAvdPr8E^pUCxA3q;@E z87Hb}Z952KOqQZ1qG@$2xK?!+KV=l5G+V5YW>IY7{iBNRpI*LtmL*I|v{Ry++i(q6 zS1s$nO+R`*;p7T+)_gq@ZwG$9f=Elu>|3IxqM#XX9D@p->#CKS=#sZkN4+CmRhN)` zFS?d@1&=0|m@9{3Xt6>JMX`xDj%uj(jpHvnhI4TuR*M+2;b!zvo5{XAI=jwp_r8V* zoG+ks1EgZ#X$h$(uHPB*?w1IrC}_sJ$DpEP1+Pj-L6lIc%Dj8gvYb>+U+bppyN<__ z?#-1$#j{wUc%sM@Jwt z-aH!KtazWR-WdPT*`4whih&DGz@^Xowqd1=`^kz>ax7Lzjwm)!$u5FStPL3K&EU_0 zhXeFSeSAq6Pl=zw{&V)iptnvr7`-TtIocTxQkXxWoq~A0#C_z3B9vGf?(Co|L~L|q zuKPmOnh_8!3CNaaEh!{n1?zH=cc58D8C8Z_Ww}DDM6vPg_XzNp5AUCi1$+K3j%NHr zP`&JjU+>IDF?@s|w+QdhtNS%4ybKg3GlK@2gqJJ#J7SAP4=(Wjv?=*AW>$^@k>a~R z&hWoOq$%{iaQdN;^ooQ+b=MZTs9GXBSrD4nwK<+Db3EZyBUsn9vX8GwWvEe>D>O)vNyhVj<+6SAM3 zD(9j06C^$o$b3BG_URT8LN19##=rYCB{8Vk6?IAb(q}W;f*xgEky7wdl%my&$K5Yw zsFs#1)KV0iq$H{%CMk)NFrlcvI087YZx4?Atp2)~vHviKL7<`)_hObclY zuADTquOL{iCY@|*Qi-lM##vsJO=8Il1=(_iAd6y?{6a&5KgMh@{9Yk-)zz^Fub$K5 zK!<&1Ua@7@Za)TEnokyap1Y4b6CFBFi|Z51&aPzW^24tmrxMnXrxq~qiMeBUj(duP z8=yBG*(jImxG1!4s*WmY&TFDIh8F7@!mCOURfwDyjc6L0Sd~H@w_Ks)qS*MM4TZTw z+n84tHR9207$Y8PbZ)j9(iA79_T4E{e=`;)@)o;0;Mv4RTfB3Y8gTlQ>vEqx*+KhZ zUp*}p7|c;}|3xcA8%Cca!l~ujFbZwVsUHsg1Wx@>fDev?x+m76_fZIOPKDZVxk4L8 zu?bGawc&Z3!mg1Zl(<)$qhSX`D#6=7X^Ic2hI0!ls97Q+G(pvCoF>Z!WfUr@v4<*1 zJglk)>faZH_eD#1lS3YU$Gcj_X%Y&`ue}D|e{lRhUaeloVGhnix_JbwsR!DbK zyS*={1k2U)?8&367zE914)`**MD|8OGZ>0NTLx05V5Dri(rk`RMMR&Qg-i-rbEi?n z85+vobfag;BLcniji)u8r$_K3q90$f6mwmG0hBx`h-$P%<%vPPjy>0X+Z zhm?h?pu$W^c;0uU&0C?l79GvwevLAetjiUWHHuBV;DwSkihJcUJiJ_O9URW22?83- ztDg2Ea92RDa%1}X#meiL8{5`(#2_qK5^{@zX7B)wnXO9Rx15<1lWiB)DI#h(N=akK zKq0F_#VWs;D~AGhxkA83u?ZerSW-HIFgCA%qmP}zW`3AoE8qF+ek%^!uZ9pu%Mn-v zgk1!l_}Bc@dN}>h-e3LuQ`lwf)+M%>F>-ltWzOlr8$cJte*WJ?gWVkpvS z7v%(&!_;Xod-BV>?}n$@;eH4GXst{9F{|QndZ4$2ZxkpbO%4=Vvqp9$FNl_fu~kK( z2x}WndSkIdaXTe-+!CllJsEYE%pu3JnAg~l2pQ1+fkXBKtoVP2LS$ohzUx|HQ^JB{ zijQ-FXsDl&_q#-%ML{#(Fa~XT)wZ2f<}}hmuAhMD_%0_}sHV|Httu7kl4GtM%Cpr9 zc^1Vc-Y{C|!I#0As_VqhCHSpRGa8%1RyDJ&NjBj0G+TxK^=?17{lg|vz$UTN$LCY& z2FQxH)bYi@jM;GK{GZ)dKgc7cdd9^5@zKD;Rhc8poj5>-hQA$T$3Y)3vZO56Yf-2u zh3X1f5mi=ZziC8ISXoOVDAh&7>t3mNxI`7|wbcr}7R4qAhpM%4exWc>K5R&|;lXx) zZ3Q$4o_wHtY<8VFaj1z*XZ=YLUP8T0#Hj@IoHi?jF_&w#C}aj>FsL?%Y%05gDBV#) zLELAu>WM6LE{TxZB9h{(g9IE4J=$wrmpaOTxdO*k-s~!9}4Z*O1#>l7fLW z$67&H-nK-PUCn9TDM8~3ZWSuH)d~d{#U_{*8S+_XBQRV$uX9)V>(~1$gnHNojWq-) zC)Y!YGvsl2cjc(MnZN$<>&F)mgE7{cbN%C{P(XwaOJaXf&W%p;%Zftk zU`a$%m!z%BhEtk%w2SK`RVdX~E2LT!o8SWmODs6ClFlN`T|Y^+Ui*SY!EnOz;K_%V zf48jzUBS!87n5hBR`Lw&W&hEG-MW5yHT@eQ$`ZvC19>Gb?s_j;!ueHA}OF5t@~yi}hd2vKD}+sg6g zYU670N9eV-y?bR%}SLYJ3a^u~gH`4_@pPd}Ry9hrjuxzYeFg7^olr z+18Ig>pk!|3DDa>Nq{2KBtW5}s(INKjOa#}5N~XjnzCt0BQ$LqUTDVR2PPWo!*qo{ zjA9ccKr16h*A^7^YH$622fydoetyd4H2MBHuIm3(;^#7}X56VB*_-rsa}8{w zw4tBwTcKJ>8dbGW6$}dd%a#b)X>)$+bd$#eFli_Q(-kr>icP?M7?*9I*?=T_;?~AawdGPRdj@w8*-mRr z>_u-P!i(i%FA7zR(VX=aY0I{PKG%%!rW2%Od0Eh!=LL-y8Kj}uOIL`!C^pRt4EgdZ zR^l0jg*1S|Za2avoLKeW%zeGv-(TNk|LcB#6h0mfHj(L*((g&;qu1tZvUM1gZHr{v z%R&Piwnd_zB6{rkqcDDOdAF-yVT*rHG?&?UWjkd4|O z#v_EVco>o3e)J}z*2Qw+7KPTTV!Ez+0zwO+iZw)(jrl`LQMR-Poh43@ zP`ITlgj*DwqzEeAhMNn{7d%M!k;O!e+lV+=Pm!g}4FtI==tpf{JuDg8pM+sxC<^B* z;ofebYBDrw)581(PQo@Nz%5Ylp`HGc?e+=_%tr4uN}J^}E(#r`H`sTKQ6d>9j7vd^ zzEO2m)S#QhX%ou0bcKwIVqfhah5V3!q{I>wJf)*un`OhSEQS(6!^SaQF0?*y361!l z!wrQI-M%*g7_taKmgu%9Xa+$r=qQ>IP(RGpV~#GOQ!VMbyeRv&1MwqHkWja!D|A~F z8zD#xk|YQ!_#Q^l_MmN!mqR>&< zBA|R20<;AYy3wS}>!K~27KD#D0YXKUu257_Y(nt3IARt>Oj-x5{XRn8r*j=PpUv5X zyxr_RIWfz+&G zMBjTIs-5);wG+iAOMS#fef-s@$CX5O^O13FH{W?YKyM(@{STADn-EIn^)lPrE%A89ZH<_3W*cN#%DYVgZ%Wl z?p^dE-n|?3;o=s7)5?E&mx@F~hmWlTC};*7FeqhR*_5gwQr118wc&+;Y6hI?M)~59 zaW;gqWxYbSM6n4rpsmb8$1NT!kKzO8?Lkfw`dCBlvY}SWuEqz_>Yx!u)#hdLyoP#@5?NdvbJ5 zd8X*r%c3^Wu_7D6a%B>QGS=snpo)}InT?>Sq_O=wNm#>5UW-ohA~E$tWwKtOOrqH2 z%bp#G8d(6aYrM9d1MGhPc5h7ko!EXoLMNt|*LoL=Ql35SmxPI;pczcSpj0cKD`BjD z2^|Hfq=a`(M_N|MPV~Bw35~iA1;~1Z0EuFgOu&GD67tjiT~NVhp4^09&s&Ot(xmqC z-bW|f%!eRaxwC^$S`>687)gTL5HpCgM3zKBGl+xAl8h@_w}Nonqom@k>-U$JQm94< zT@;D^B9tZT6|y9XO;``8Quplwk}xP^A*M-dQtl0FHnuNd5c>|jh*w4k;tv?3%5o_Z zg=#1_48?{O6dR^e2m(a)l5=xQv3MmrBCa4k_GD!|J8r9V-8k_flr4dj8 z(h>kMWI`z?JjIxVFkp$+h=OJ?0E0>>It(R;J199!tEMMhn_b3M9ri_M;|vJ3#(IU; zh+-2Ah{lNGTM2rnVsIgNPGEp22>n@X?_D_$P?=m2(UY(^c3Cz=0DTJILr&el5mH=U za2AEkpace$P?rM=3`40QC|y;MF7FFsYYh9^p>axt>SMh^eMGSdN?fcyq6kZ?;NE91qLTt##nSdf5#N54l_m}L+tFd~pb2BLju5>vB zHXg?IBiZye9!7s-QXI4x_PZwoR>Kaxlh_u4g3>HNp-^_bXlYB7tQ$h}##S9ShtsN- zs&JJZ;w%WY$!3K%iDFX+5fnHxHxkABiY`hFH{D(wT$ZBmMJ4wKtcF;aO6j`-BP6)I z85IhdK>-XpcCaJRn21m=H8Drgg0!k*WnEL~OBAO-C`dLd1W6Q|qyQ@C&7=T^_Y^QM z*q#K$Rv(~a9ZdGIedh7T7!x=9t#Ut~dfdAYM`LmCPW~3N-hB95_J`}^A6fn{=5{|{ zXYcgw{_yqmGrR1-zuNp?5Qhi)91%t>7d266(=n=btw>K>MQEuwVT>6|qmZgrg|4Yc zFe(%^n-!uaicK;KZ5K6@QHg-eQ}$FG*b#r%EDd(=R%(as*v9PbU%Y|IU8WVhfR({^PD;&Z(pz!hp*IGEvA3 z2B3vcX_qTrQ6eg8_Mo-Qaf&rl(+N{t+QEZX{7|<>h=@4!d|7v{c z$SyLvL|hrE0g7*j)w})3Q@O#3H$Qwfhm@c0J4>b05eVVQ5&;wi&0q=!?HbVuRhbn+ zsM?sRQWDN}K@@A6rmgB$)(L|(6hNC50w{`2GG$pxJqml%X9^nZdTTTLrav0&4`YzU zzh-ZS?DI!$tC3}=TZIMV1srb1U-`=P*&A=ex=5@s9K)0E-w?K7w~9tup@wws=?>zs z@df`OuieJ(+LA4nMTQIZzt%SGH^vG&wKzdu|B|G46f}bXXi-xygc4Sj5XoI?!keNX z(lt@)K_ZJ2AQVZP6(T8$O%ebDj^5cB21z3O-3#e=`@zZ`dYEdfdnfD=7PlK*SET*@ z(T4Wz`?Iy?dG^D`Ms{u^XiBuk>Pr8qe-*qfc)-m8n)v4IZb z8<%zFODzQHN=LH=S$MEj{mp&ql#Yb(WJ$~^3Yx(a3_7-%CxZ2m{R%Osx@AO~vvpN< zsuYRD`8Jei+ZFOGicRulo;*7*@(jJ$DInQh!}Y4Nz957=C!U=(CpuAM>hLy}YaM-@ zsoJ~v6UW%IT&zW*1+=MWij!Pub2`!`ut%4~#u`DWkrZ*iaT|)Y?Fz9L#m4={C~R)v z8G3}Zlc6kuHm9kuuPgbo2+>ZIvK`Rvihfj)ZXZ_`Q%oc*Ktd-31&(G0D{?Ti1=hvWXmFB<;-{Q2|$fpBI?Y$^(x!5Iu% z>!yP!L;_)m5NtxB&Vn&UAU3VZZ5O;aXF_SVT_Me)*feKQZ8ln?1%;igjVqY_Q&ANg zmk74RxAj)08kDwrkC#l`HQosESV88WA~z5v!E&7yh4#?p5PBSf-UdCSYSOW)BnraP zAS#U|`o^@O&f2cfSy6171Q!dfD8jyf7d>KgVf{P4+X}OO*j{tmX=MBUoDS0}^DGme z_f8&x{=7#qd>UY9xxJS+@ZWenK=j6N^&N%GU4G%vL8jpYD+m>b6uf+1G;I9QsM?=K@Rxaip{2*Rv4s#uB+SO4y;4wI?hA;Z#V|4J#>q|IoM)zJ0D*#c9XZxVq5bC2`WIJ zF}6OTpc&M|pyR2AfRIKgr4Wq5daI-{-7?V8;?xUuR<=TCMX_n>VaVh`7e!77pFf?u z|Na?=pX}YsKV7|ewZFan1>z81ywgWB@Gvq9UK1Y;J%jH-U zI!dktlr>}UFzEasw6TB6R{A8qIGsW{maULuQEZw{81gI`80QoQ_Zi`i5D&b{VPzO^ z3mG#gQXJyWuT2sc)6g4go^1ke_3ApdFTvfsPt|`OB456xwxdn?trH$RvdJT}OmA zr(>J2=`;A^FF#aL*$O2U#in0=G#nOx^O0^*r{=n0onl`kGP6mYwmiN+AN%Qldh1iz zK=(E9&3xF3BV=JW^UFQ$eW!AG*&d&3lC^rmt&(V_9TzFZ|m zq25m`2pr(z(sugX|Z zZo8MCd=DV~*&d>$wEYI*;NjaC8oES`hqHqXLK^I*andYTRZ*yS&*o;!$U!}6B?LTk z61Zm*r;|`sWh+!w6q_W?#iA;T`01Mc?RK6IyDDYhD{N|)t} zy!MOBilT@auN{?5TW$+`5UA`ysId}>FlHiDhv}gFgE1%K!R{=SP1y?B6vZZA`^BmK zC?fLOCxgKjn6}mBT;Y3o|9jhweK-o2x#>dPqmj}qIgg^#s%N#z!x$<=&k-NtoV7hXIK+*OwIJt zm8~D+^L$;C+wnJN(Lz42$~?C3IENHg{V8(uD2Y%+nnWnn`{NXW_;+J()S8H@G@HoD z9~XDM@K96bD>PLUn=EK6F2+A z<~MO_%>|iwTS(Wnio6)Uj%|*|zU=<6Vn2L$e}Ja%FYX77CfIG_G+C~HqEKB*$!kRk zlW;t3c|kfUa?&@lZfeGLUB{27Jk&q=3jGtsCTW6pQ94uJPZ41_b7Iv@PyN{Jt^$YC zL7UaY=jT4c7hiqlt8Yv-isnZwA}!0s6l9tG)C6yWw{TWw86kDYIOqMWJJCBLSI)oC4}6FJLR; z{Rerd(()B5Es9MR^hc4dXu*9q$iwE&2N&TyLhs!*G=&b9zCr;o;KU|-z9wd8dS*)( zSYv!|J;Ba;4m#&Pz7V;C+Ze$xg!elIUtdtW6Mc}F2LJ`l;1&iQ)ja}gj#-YNf)0e+ z>uPcdCM@w#@8v7>UKE?=)~xnZ={!{Y?q{)UvpXZ#QGC)5)7FEwb+8%%1%0uMPWNE6 z1xw*zW9ejsLrY?8QP2zyVbD?RBOnbCT5v`>(J>Nu5EC2<)nmRwJw~x<4n;;q*n-xY zHEgiC7(vO4t=W~%%%ahtf^wj)`N*`FUA=z&3M?XP`#>Oz69=cujXkJ5S0Ky*oKmi> zH;B&OBr~T0u;eqjy@vq3lSPjtp`s5I<9~{AbLA+O2*^-c_=LN z6~Z!#P4nquWf?_GH6!7W_1Tcdb!GmRWriA$^glc+ry>sW#u(7@2#eGcZ&*Wi$N_Ri zFk&nzmwF8$(FsnuwY)(sJmmS(Z)95+}D%dgd#nXB3+z#>Lt* zitwj4+wO2@MwR1I0Y|NSXnyzW=Jx(}Y?nC&JOu%|6E7x_5wnDs#O$J=863c%s?58( zku_;MT^oa?E{Mo`b9!f0Eo;`uE}r~VaMN2b9P^Zp!@BaGU z8nVKkW4vta*AVls!K^7;aTGhfzaNZ+5|j%3<=v1yG4SjyeA+HJKfU_*?7!1I&q(IP z?1OrinKuJJcqo4+ehGU)9{<) z@oxCn7cZcS_wM=an1%aX?r+`CUfk{#%-a{!7fZx%_D@B8F9DdZ#7x0ozrH}2kBu&C z-rAl(Qk8`Eh3t4c+kw?$rt%wMjk5`t4sTpW_IK zH~^pTSw_v+No4$?Ee}6+G<#C#`Md7UX3UsfW_WrEX|tI#lcNuIeb~MK4m}85Ph=nJ zIPTX7R~7^}0kf!m0qaj5oY@YhLKv%>aJj@paq70MzB2KIWQSoj&kH?d=D=GG!yB zp+uTK4Tza|3-oXtG=nr4ROr0WjfUE1aJ(#gN_bhC^`>O9uw~`TXe4ZrHz8@3>)|*y zO`2%g-&r+WBXv~;9^_mrLGzJs>-G#m721=x$ET%zHoG)ZYZSk;h;*?~?f;8|uAvq- za@`g+ikh^6``}BSm7){u}NyhMtz)BC}J+FfE-tEUyj`f z!9~5@X17{2dpz3=<>nyoH>XZRJGXinE8eo}Ow72s z?+~*dy|DFmu|kkX zv1y9Ui*d&(h89&`Pchrb-BqG-g=oB$hLP%W#U6#sAk_-R{(WR*Nx9+-@-Zt_5L%Tr z5uzvw?HWy0-mv=N9X%vfsF4>dG;$Q1CRJoqghptOIpDwmr4FZJWyk$iAFO6I=p#s^ zzWR&HqHGj15eJQsk2x_|YO0 z6gi%!$Ru}kSs*Nx0WMYE2!aw4NIr`)Oo2C5Ig&mM?4&?2BPl@2jwmt-q_@G&BU(-8 z2rQ+>u}lFFrRRidk4(UK^NJ4MDW1^-qTZ@78SWuRV1Slvg7En|CQ!dSxd&RDJ@$+jm$5 z@=fR{pGIl#whIOGE}#Bv*7RpwA>6Y2Rmx$#^>TN&kPBAOh;NTqIKFw#$AjlI`#Ahf zZQ{Ts(C}*8-FU;&j~q>x^1WZFYGI@?!~6+mRbWk>z&SZUgu6a7BmT_)`R8^c|BrWn ze*N(S81I9enkcrTU#i3O&QG}n^HMJ4%ykqeVG&gu6FtHVgRvU0Yg%0D1z>j|I& zE(Z5cTCF}H&BJz~kls3YW+%)KYWw-}Sj_g_$ZST57kjgH@CpPx%jey4`Qr1gyT@np z6v$5@MXDv%RoZAkLU&K*g{MU(Xzsjp7CAFes6k;a%L)h@XJy2SvJM%CPQXB!B?{lI zxpq1$n32vRWk)oZ%z}+*D_N(a@3YGm*yMqW0(3~zk~HncZhHnz2!vK2LQSb@z~@m@ zysCj|tApDy6g}t?OX;-LY9*KfGutlGZ{4@MCAP5#m(7F-Jy3kz3gK(}O&|deyaZNq z@cy)tKZxypTldxFgl?anPa{Pp==QvP8aZ<*d=cgH)Pu@k763qgHOM5yMSpK6Uke{ly!0`PNnA^xm-; zTHi^LaeWWxB>>5pqdXHyC2AIgX$8@uh~>OVSQ+|NS`;}?V`sr(5ZVdAa7F@C3LQMf{Oj`_buM?%+l|L8i3I1)02**$ON69mvkg&PUYEOMLc9p9ZH=pL&5Sq z^I5=yFbPW`>SkoGw3CkEjHDweJEGH+*jq@Wyx*0b_75~e@5jaJn@iJ2S`FyX1zwT3 zx7|QqyB=wt^lp6EXYoO;((?2!#r*;sVi<~Hv8vbYLaKdFL1C7md!`WjdU{He6d8x= zlcHr*iYlsO){FNt!U@Ss;Wvl@r=I$#6zal9U}$I5H<`r*dr1lvcKB zdCFH`K4I=ftSVu)v_{p1TN@;ycqCoeYT56PCU6Dn)=y+2;RfxxKO0`NYQsFQWB&|f5 z#BSxb^OWI?JS8bRqTFOfk0Cjjrr0By#CpN+R&6JhsgsxgyE~~og!lvNuo&vzMPS#0;>#%NtrBC($rDjX4Li>q#6J+fFPSB2G+yJuW*rKRFuCOOBE= z=RD5ysum2Onk){>N=4g(Qe;^ZrXmp|UWc6=4QC`rN!bxQA!*NSFXP9>MtqkVaqa!` zli0fKg&OX)R-DDEl-K_Lgg3h@ZrsK%fH?^(q90NPnR~8I6>0a(?-HVPKi$6bdN_c2Ialy2lYY4{C*Nl^y{XxMh0}wr z-T~QGCm*~z=Cr(bJgn13&d*|o^Rk%a%wbT+K^-Q{_e*(}_!(zq0aX^UFHe}T@Uy}V zV-D>sW;i2@Ny?7c2ubTU%@e1@2^DdMG{(j{uI-D4GCU~Ez${9wRd>V)-#gae)XVd8 zeBrztA31YXhj{_fHR!d=;=0UPo+L3#!v-3%0yDF_+$^+neBq27A1OPcmn1!$t(PMX zjw|cNS2T*__Ah@`IqrVTwKd1P{0s%$y9f9j0em5+Rvx|fC#-RZshknJbBfeRp$WP= zFRMq++*HsMIEon%ghK<)l<_KQ7*IKfiS*B#v51|W)eC22^+?$fT_r2jdL+mj(E#iB zv5K%C9Rp}j+(@Hm`+7iQfe&4|6d6AMxLeBKDM0w*D1X>H*CXK2dke7OU{GKAKX+1J zmk{CWjH9Abe&$|kR{1P^GHrG59jl|bqG^c zKW&s$Mu?&&;d2WxLH5bjpJH6Hl7KwRc);y+u!9iahOH7 zgIcY0wB$hf2DTp1**D@*zK@^R5SfO{pxlUw3m>^G*G5bVjfd?>(Kt>55%7=!xK8e* zMZ|cPMyyDq48V1Ot#hlGol_$%V2X;Jms4|1NvIel0cZSf&9*H=PS>^W5ZPUO@_K)_ z10}nLoWr)Q+NEY=-0%kh4kV?1uDOuOPtMfgx7R7w*v6_1wpJjgy_0hx7xl5#Tpuil z(!0~k^hl8jT1SZ*v?ha;E{hYnv6b@1#Hu=oLf#~h(RFK`opFn1WZX#E(UK_Ftc2oG z5|auzS~gA)>iU#?i7@|ZXuCxc=c-m)aIVpY+B{_D`25&*`bEJdA^w);J`I`S%<$y z@?)UVFm1G2+#iu!0~4mmvd?r^_&Whd=K6ktI7f?W{l@!IcMf^`S9s!QPkDW0SsH5~ zZ&2UmIsj{9nEe)5o9eyYLA9#Rx#4Slq2KOC^jKR(+l;l+8&U7%wk}O|SdV`5u%><~ z(A}6n$_Lkg44m{u|8R0eI-`d@Eo+nI&_gwCy9MyXmU0Nr$mUpg?oK~Pc7`sRk)b1HNBme?3>D#roud^GEe(F=vDybD zkpw21l{z;}MTK4V0EVu~MUH)&@91g0-yW8K?AE*zFaNOC-B$mgcOzp^@`3tjR&QL^ z^wJZyS9arlXmFE(W-nOu-F{!GDh_Pd3Lk~&?G}n{^)P)D7e4XHaOCcnfRsC=-8Z!z z^hZ@0F9MRE4}RxQp7yn%d#`XI1&JErFE9MAMxUTAhJ zb0C&t`yIF*_>syKbBn2j2{KaPt}-;`9Yk8xfzd8}+Y2JenNG@ROj zsAo>9K=33fS)B3$ngTYg%(-A$or$=Nv!qN%E~$1>H=2>uC1po;AiBI1aY53ipeLVh z(rBtO_FKA5+N;P~)5msU40t1**1jSF-H-(q3<1_)CE$eM6xRVY{_(vK?=onL*y>wa z%~1oqhCjTzRfq@pZS8%LOH?o8_MXeVQvn&EGJVkA0&A z)gIKTfS{2Ah~8#T_`~+18{$LQr(Dz`9q}viF){8&UT+aIhBW z6ycU+?Z-Es_gDOa0Fn*Vz|X+k+L7C+O$aMk7JG{%ouYHH=%mnuEoep-{o}a!)bteZ4R0`>djmwaeyq~TD_ttLtJ22xhMh;>%p)WBn;W)lVx~o_ zuD|XP*D4CEjq;+iDs+$Rv7aq}YH{p3iPd34b>-3k>e zZtiY8c@N&n7rt%Ri^{`(eZ%)cTKVZE=%mO58=rwt`8X~<-Nwal>!q9vYW5cuGg*bf z%(qW#LB@Zm=Wo&=!QL_=Npco9MZ}6Q26pKv2!gOKmO;#2QV`}d?LCcjH}{Fr=X z-UOk@8VDUX(nE;+zRge}U4)>j)6h*!AKM_Pcm@cHlpWbWD6u{0^C^1>HQ?+0CPC|i z+ErEHsxPgPaRYEcl7F}rkyOlnS1PTq!%N10^`ENQWu@~VFj%~ z#FlMo?8q)di%qy`kkb8@g8l*85=K;L zkKRg+V8MR37S*EJGhl&;lMV2M6VOa*J;Xf)Vi4#ln9@I!!GYv7i3O6thBn;KS#~cz><-Z}h_9_<#N3%@^B9?5_{7=$or57^!oB$UG>bR zq%EHV1|)?h*z&yYw`1a`cfU0rB73-d*fQhxQYK7N`SYal(GmGnV(<@^fK5Vv zwsv*E)vs!{Z$JJ#p@R*%1p2m2icHYndFVuP<~WSj)D=-7pZ`s|I_L;)L=Vh^owIieRn75m zt<)7x-R?mFho~#%d&g27YIHurg^jlUmxEssBsWMGoG~hgQR`}AFj>;%5o2r;l=AWDmlsK$pf#+a(7rav6Dy1jN}n1JFXa%ggWIkVq7$W1!YktMNtcX#Jx%E z@P0BQyidxG>j5R{Zk$ev{a|8!Ks2*h?I6AbN6GWn=$Ajde)Hw3M?vZgIU@hmF(nVk z)vFKgl6P_)w4Y3hOi-kG1@Gj{S>p3DS0j{1wy%@}{oV2jqCp?dAN~aWXG@2Z5V$H?f1f$&4T`DLbwbj#&wnpyz5-wjERf@2~gr=-)#j{PX2=(| z-gi;%mz-Ke5sDH+AO>3Vc@e5at%p{n^CP^;ya+Eja~Xvq;5?986htge{gCCkbYMfd z>pLy^h^io(+ zMVu!*%<^y~Tw(`%lNrHYQg&RK9J3NiL`j^T>ekSRfhyxMgizgMlGi4O+L zG<6`I6LlqpCg{Mts4F>h5N3&pdBL(W1*fJ0z*SYVM2H}-99?60B+V9% z?POxx*w}Wm8{4*RXJgy8ZD*s6?Tu~o&Ub&zubFwey1M$*IWJD#7fK;%^AVm1SxM?H z;3%pqxv4-)Njp=-~0niMH^CEj#gTa2A7W!-B82DdYX#C=*(X{3#@dn28! z0H??e*`Ip~$@k!Gr``Pw+)YyVl~3X$9?H_b%Pzz81RQ)PnDL)yEs2!T6`oC5 z3)B{{yE`!%IfX(`VQpX#LGsL{1l-?K8#>}2RMQt=H`qlA@pOyhu-j2I2DhF@=l?g4 zVn81gnquNi@(K2z%RLwtkOJDWp#bRw*v=nJ$+FX%Vy>$Yq-J+0k%wX6(O0m)(qRHu zdt|ce9m1WId6R)-Jp_)mQ$#5?_6&}qqCmy}1o+_!QA%K@jpbFCi4+E_80*lrW1(Ra z4nBem8qcVzmMg}Docc8{q8D=(50J-boM2kez(~=jxC%O6M1m+|1sed)AyiCjF`jx! z0?8Aw+Yt;h22V~bN*__5_}qTi;^7CeBM+05-1HRaVKN)dB#@zfd&vZl?p9A%HcyFd zV{GcW$FB?Txk$vP1A_!sV$pOtd<`X8AthJ!PYT~~Em6uh#cH;^C?s^z3-PZeZ5#Q* ze<=XoFJkelE0R5PWEhC=7fl6Xg6r5U3HOcWNl>`MwE7fLwUq5{A94tvn zb4FuScEcPgWLQRXSIYe3r0x+aSCSvOoV^aBoXWhh+0(ztk{YiHHI=4#w&HuE6&Tb- z8v}RXS+Z^-c@=Gkf!ctrF@x}A!_WBs$dd38B|%>8FmesfT#997ZfA(-vjfQFVMk^(X^-G6(ZILGj{#l=cM;57gkCZqzNtN2k&0+(43v(M7+B zzqb#y%CSMqcOJosh`zA5Qn#i)xrM+bte#|L*5_`wbpK3<461gYj&aqNp_nV0+#79Gal%RizX|7tCv_9>A|@x@id`>tVKhB0HHk#C7Vpjq`l!U zdA5p3hYf6=L!fCU&rCyGnsb%sER?{Ok^3<-MKf4vBPg=eCMyyOdh3O>37 z8F&2{Y@VjEAr7TXU+%WS=5|KK06b5|s|sV+bJ2u6-0UX;6jeB-F{3JRxj8RvG&soc zBqn0hm)9zom6SNCB%D~cpQ&31sX`v3qsub!ukSTZxY_FNl=6@zOS_kC$yGc?XX~qm zAUewzOA|F3tn>Gq^r}%qYj|}XPHyK2fUr}G@B7A(Dt4$?NYX60D5FBnYoP3;Sf*-z zR^ilv%LI{`MacPy-oqPWregRVXDZ#XkNQ#Y|5AZXqMByAD+oy5CxK2oQBQ zB2P{i@VCG#fY`A}lr>4rb!*RNU7W?d|5KNzKla_Hnv;5H|4k`ls=;KZ?;n%}b<%#c z-HbEd_8Wy$XN9^}Tg>%Iw@@%Nnjf({hk3(5&55=mVm+jOuK)ZOVQF#vAD^{?mS*dQ zGi{?sV`N{_v3HoqRD39BzX{f?v^#S1FphXt4e{#!=wva%&~il_&@O3jCR2d z%DHRN$yC5GGAFMZFxS?jQt*?2thdb(SO50G`fbd~udGldY35aW`?;tzBFHuoG4Gof zrbq7`5!<7Y+)*kR*P2PmFoOwE4l-apf%&t{j#Qj-b+G$_p1bL`P(ydjTNXbhJ4N-c zrV3>PwW#8oajSv3c@xf>rjpw*rbK2^kJn}8PpT3@Q7nB2?);YFQnHkgdhk2`e1h@; zOyvH3JG({x*~^xUMey2AyDrbpr{#KFR}}^Lg60PoFKXapNS&U1NMv1sL{8$H(uiLn zi8|N1TJ^(hB$tH;of-!vifCES*tU@R@`qN}X)|XuR#3rL2%P`?x41{%mQ`#9>z|{#~Fuw8V<|B zOxmzK@sYsIOm@{qpm|zgs;liG@>cU+!ZN|XlZbu3x6^Lrt#E|S;Sbx~L^_6w zlfPy%g4^d%y%e>)5F&&wZN$v0iCZulTSb^{6IROLX-@C!eRTqTM#*_>AQbX5s|r%O zTTQyI6EsP7HrFdnUW#{{?C+1Bf@b7dvO8%%jjtOp<#|})v*LN}#^>Q?4RQT9|95v8 zu^WS(?l3fDAO?bw{Ela@HhTOL-%Efj{3r0ON6N6~H{;<)J<&TSSdT3qXgPC0R>lGI z{w4K!>e|=XRX*hTkYj&_w1kJdjL<^?LsoS3seU<~apnC9_LgxdGeKo*6HXbLYJ7q6 z{jyM1x6S)X*n3a46^cPWDl?#QWJDylssi$EXh;OwJ4c}UuMVMizo4c+d}d{ohlN}X zZkWR8$sZ<}M1A%)t#!o!f^V~?AKaddk@#iS9l2%%m)Eso;U-^uHn{xi6)x7)ryW$n zAjrdQQllH8axC~*w>Kz02LS7{tt$PCyBo!&Rh5f?@B&kh^@&rrF7yr4hWO~-9tAIY z6XgT6*eQO@a9v{bImgoj!s)2;2z%E6<)1+V@_THz(T{fHL4dLz^VV3y<|x?#>kSML zo#_>gxV)q+!6mrUl;PfvkNdM|^ONnL5Th`%8U;HPOx{kzCiUIFt62r$T z8Wh}NQ)QpO#U8(lJg#C>R7z1YO1r_!CtaFDSYIY6C;;;*Kp-ImL^!TJnZcaQmI|tA zafpvKbtbemGgeT+qnlviIv+Q}P!CuQAc`-3`zaf>XZYG33OuuoP!*b|ZCo0)c&zdh zpZUg+1#Lrek`$bn$AoqePyS;e{C&13d9urWI0lRi4A}`;-v{ZMovOG9bI0C2-zAo_ z`QL5NcmCd3qRN7&5j`MjRo(@9^PwO0FSc}x6dHuKLi;cCUCCIv>=-n^uZ|Xs9$nWy z3l+q_o!UMZWM3!higkJdP%8Meu^wHSMrqyxHRam4=0XV2P- zaWoU>fie)AN=Bbtl*$y7+YH4Ub&PywFk{HPwA}VSM}25@BOw=Mf(Vbe&;GdIZJKva z`x*CPhKe6{O8BasoEqfR>E;^#`7<~8<#wp8GU8a>ljSNtWw=}P`tI{`McZbihBz-k zFA17tI=D}mdi42S+_kO>m8ULQ-wm4kkgzED1>d)AkhPkPVZb{+R*T;7y^IVM$cm;4 zf=Aqpvotl{$}-=jF~w!PKoU-*-R;)(q%rltcc|+0Pqz9yGDvQHy8YADjj@MVrG7Af z?bPqxv~$~AWC*YeOEJ&{5AKA*#PS=NV5`6>21QVr>49AR9q9vA7z6}q!K51I1SB4; zuqHbPJ=TYQZfiBmhBq)?z~9}cX&V{mODrCu8I6loYGX0H@3!0l1M74k`NZ1u(PeoJDVF0AUs^8NNz2P7JD*_iZ zaL*>CYU)cw(|5;fPZOd&1Kpczp>|Ktq__w)tKP!eVQsF-78@DD!tSYakE9!4h1eDD z>b2+7_i~tcOfWS@Il`{u2y(~Gn`qP4^9|l+KBMUCJC+x3U{ zMSM74sc0C=Rt8VNmEnVOpzqv#8&o!)+l%PG@S9<1*anV{3&h7V$xOo`+fY}}yo18?FAwQBSjlY6M$kHEEmRbafJ@<# z;*Pm7rA6_MG5s_6@D^@Mw{*GZln=ZJMdj=Km>}$5V>ZN999zFpaAaL zh#_D`f+E+yh{o^(!~aHRVg{l3F764z`Sq@z`WIyyAHgoz3!5w)T0)yQSU%#fW+)fTFJ93qK6N$jncEemq!?Fo^k%@F zyq=4M1q=n$mwfFY+)XseW(vX+`C-Y9Cq+Sy#4&X)bTx=r)MovVz%90fVnkvAzxc$O zH`t?~d%V{#-=5dvME;N*D`X;30m`#q(9@l_qoEc-7<%e)90Iln4qSGq*hqCt(4l*g z0Cy8>GFuX(dPtS+sEEfTw6$YA=%2rw&eAVzD}{12Ao;m!@N&{ivUS-5;MTRNwdY!Di1I zIZD2mru;eRV6*&v;|%IgU~`9Em(xO8{i(~&C^OvPzMwvogj9uO*bU+i*#!B;X*OZ` zLljt=%H@NQf1TZR7N%}~P zrf73|QwgNPp|4==rZg#$i?E;g1eG|3JVk%i_4BR|+?R zGvocfPr0rC%Z;Y@p^44yDvQSkD^m#p3XTvZGagrx^wwwzsX&mDEQBRA=ZwLu*b69@ z8=)8(b^lCwIEOro+x$DMrbF#iZ>p_CD~zmYPDr>jpEri?;G}iL1KZ;5bpD=yB8j$skGnF)u!shI<7V)V22?>jjWOmG$ z1FU~-Zf>0v>UFSKEAhUn>Qu@842_ThcM~3j+a4IbBw)vV3+0Ut!^CCB#o*tuILRoY zEJsf;r^krc>=GxBp)99OJuscx{~-mobLtY}XMp$jRZ~{WZP)@|8Ld@hWfr~k#|gC| z)4_ar0ut0bq4P}n{Pp&bIopM8!PRI9N|kVytt?An0;2UwAHT$eR02g)B^#e_ zDw>1wPk)t)2$Jt}6zq$mXnbl0wgD%zL!r|QV8>tSVKTKt%i%rJ&?%qH`ud+$#FmM~ z^h#}qVy%bSdEh0$#S{+gfRCSfN{CnnEg&37vzJGu%XI1}Xg^$Jh2~WM>)cAkk86NE zL^|+$CB)J#r!#^hDyA8-|EFMOwW=UOHNdrVi<%Ve(OV?ySM5kCP^^4Y9ZkdUj0WhC zvK}~No(e$zVIWRzUuX${a#h2C{FO6aHXCP4ARuTgGZ}lrtSM)^QkjdJS{#1qZquQB zg|Q!XF2l?-HKMdBt=em!#=dNz3o=KlT+NHu@mXsyj#XI=`0?>cVDg)p_HBDa^cS3s zi+Tm8&zqLwYR3KE`U2Mocvi=)08;@es7TdYc02ZHPk_Z=B&IQBFt68D|M#TkTNyr1 zQC6B_a-{7HEetaN$St+HuOn5lDdVm@o7LOU+(EERQ|)fLCgVFuwG6V>4$EOfPBt^} z-c~QFLsb|ncj^YMm?Ob1|3t7myc8l(9n zv{3}XtqN2d{XNk0puWxp*78tLjthQ?=Y)b0*6RTk7mrRPTMbDSCzc7Y5-fDm@-qnI zO`Vb4@V=li4VAxB3=6oV@O+K_CCnj8F-B_idWkexyJU?JK;t2-!62K zc;NclJJpccFw~Ysg)J!R5bwNn+K}5r^?Scgm&)4I`KLZ_UWnz!JNU8?Gp>J~=!#4x z0Q^zZ4Z0+C_*(9+pTVje3~tjszkn(&NP&yIT}BAq)7@Xlvw-!k<2VnIT6gWFA;0?t zLV<4$ju0M&pFd?5NYQP~)s!-Gapp}t8FTteBjGK1?^I}tD$NWPI5dwWE2Ja}H8X5^ zkEu#5*HAaOyJj;nKifStq`voa?Y*djR~W9;Rv9L`x_w=}DV9#M6qa-+nqAZ(LVb&< zaZhNLa5yy1-0P7o(I+8I+!Nvgy`7BM>r}6z=Ro*au11_<;6;8Wj|ir~w`;nr%3Ghv zl3w!=B&_AH9CzpC<={xnaa+k_N~Sr|oRyo!?*%+ajNDOAYv@u`5FPQs<5E#sogBAn z<>ld&no2Hu$(W@pSo07?^E=wKQ_dcxZ!4r@!TbMSz>4E zT(awEp3Gtoo$o((UP|M@%T>NBa`4d88?*oM!rtBfwAfb|RW+1pF{6ti-v@>&_01p+ zA7(@Bm>5Q1mz1eWDizd-qM5_>?iA{0h<67(ml(J%<0ao}e$|_s*F6$C2JU+jZKo%V zi@`q#3uFJt7^nP0a3YKMRsNPfm=esz&}CiHaf6D^Of2_w;C2QKP)Ru{N@eDl@f^R- zGR0%`Wql#r^)>#`qbTA+sHT`)g)JKzlr0A1(6|Dv2zABjU`+{HG84WS-5W-&1`QbQ z8c6Sf{&xqdcl9UrYP;=L^E0uviqN#Bj7V8(==}!S&svUC#@W_&zNcGItwI2;A7geM z)v7HTvSm^WgkarETA97c;KaWIjPCy?b%65k%8S_4*F}7IlK4+{*>A;!Uy(7^^xY%# zcHGS`(-zmfZC|Q6l<8Y8qlk$tC$)E`#jMD%&~rlM z*ytE2?LEq;T(5uNd+I93(*;)6IB$z1)(*{oYjd)HIzC^dxSP1akYtoP{^nk)Ibc>i z?GdJISHm4Dv1D;Kbr%q$Q1eC0b2&UPP|7j#YLq$pC(Y-CqoXD64LusbVRzziQ>PFP z>*6pkkYC$gRa{jF_uH*XCd0QQIE!Cm{vrrzE&!z0D9Z#oO$2-Ol-pm)bRICz{wXu%LjE?%gt_(rq3x;y zPXy(Ltc*5~U1NekNFs?(<%^(Gxr{jD@&RZ2cX2|I(ig3D_i2o$B(K(&?d5b&MtrCk zO~7+<#EmXa0iyCc!DiFLze^va(!jc$ht0fYZ{W>ur?+27oU9el3Px!@XLvSj+hhdkuE)H@#Z_QzooUkY>Dr=~Dd${sUFE@l29w7PuX`Nr zN{J2lfXk1D>}BW}{Kva`&HdirH{PT%O_q}sI)ONO+|sA->)_1K){-ETG5Cz@5U5P=ey&+_dde(Bq*tRdy&PljXMatpU=R4RqwQPvf}39C^Teu;5PlJ{ zvp5s1grbx@j)>5!ibeX%x*Dys z(C1?zkg9kr0>$M!HuRXz`6osX1RSIihxE(B`;6)>|!l?Ttg zSh`WjDJD24x`O+oT2`hdVN%@*uiyVE^wFwkk%=}E;n$5heT%<6XNW}7PS896#%!W)5Z2p6+l5-@h>xgp^XrfW~d-NxsF#pe9jwi zG9k2gCv5|`!dh|I%<{VSa5&a|_2H6YMn)2uwjm}$P}-%ht%S{aZma z2sXeUfFp@a#A?hJyMaG+uuhQFrx~fKPncWDV?%c|?-xD5Z4}5`5K3zM-ZoZPoIliH zVG!Zy*~P|27?WrYG-cK8{bo%KZBqkaDRV~if^ITv6F)h@R#fq;TPtj>KWZU%+Kh9$ zdx#(T1~;1{hZ)qCMI9>rgkrA0_5n}eo_Lzhm&gZJrQ3Xqu-r|;smxLZlgjjIwFYE} zDDdxvm0<{-8&5Wi(#+tlz)`N|COPgdD%&Iz34i^|iUqg#seV5SXE~JY;@R`xe^&oqt#Os?;M~7oQ%ip5O5CXhZe}Z!n z@t{ow$HuebdB6mlbalfoq0*rX8fhqDkKi1vZ$TM|N(SM~q5?w@NU4yd4$rS~B7WbS zc>@Y^#)Iu@hr6+t7S!`rZ38&~OZS*ct>QvFjbHPjWMf}?GFZ8g>asx=r`uJYpMv#|FG#V}(4D)bKi zES4U>d_;M?L1vgR9@cfr@H}UUZ=9mcg6liBcU8(Z8l^7`<5AMPS9hH9{@D{)1VcGk znUOQBbFS+AgD+RdM+`p?CwQ&6xamQZxozE`Zn>2-^<-uekw zP7=(8;OcrnK(_<0pf_(Ew3yc<3Hgae!1;L(NbZZum9^&RNK(}9RAU%B# z7l|axIU|g{dJ*aLFqg$8H*N)*8RTlDE2!7kQMLJJAt)mpz>V z-{64`NrBrT!#GG9wCBPA7ao zrgJVXa&3$PjF*M-HUN2_B@G(=E))%)9o>M6^iBc<;N-kUz@f=8L$%gZ|b~k^ANt65DxHrJw1+(ZEsq@SWMJw@gv1~kl^7vu8-T2}`E%fEpDw|J3 zbM5Q($?mkTGwl!7Cxv@zUU*Pw(*c1%a8brz;1QgHM`#(pz*PI{db0(zCe2A_>+@hoD1L!iuP8Q+wJDsNKRzCxSRBm-;i+=9p@;n%++o z*Sb~E0+n8O@2S5MB>BanK#oI|>M?+zc%*V@e@Y?#xkc@>DD!!C2yp258`OB}1g>$7 z^>dhL<2nR32R7?voCJ5o6Q?x6z*4u2{wXQokT3C@_KvbfR!_2{>xrg0>GfZhTMlGSIm$NU28@sHx|an>Yn-}ugsBKGPDSW8^i(r*ljrd*WtIjT!`8G zQYoR-U>4QrG3CE=7?90PCV?OZAS0O}uYMe&5s3zWB-&EO|c zDLYi1`58RmD&Aqx4_*6?iu^Tk<9Rr?e>_0-%9uKdXTw+t%|b*ld|k5iSkAWn>}p7< z3trzKyOqBSM-ne}M*OEqz;VB)m9q4RI*+eGXk|`ji zOSWdHgJ;`GSh1ox8)zhX9tOS!@jXHQyrXRWa*1L2@_DCX4x)-mr)1Xkv)rr=qvY6q zcNamp5u329X`yR>LsE7e3d}JH#8^gA=M5dBh?=VB^d9kqMlJ_V)koz)j8w2kh#`G5 zD%d}S5D*&P#w4y%at;(3qg5ehhexBihh^ic%p6#Xe^CeIKf^CRaC4Z^5yZfRz1kvIf!|9&0VSo12~8Py(sK!1B@yi> z%RG_b21~WMgeohcpIiupff6R=_wyf?kA(LZBym(Yv&Fd`_84>CpVu5dzSljUwmr#k zjkk=)%cL|J1&b%wSQ@wxf!Q-J0xGt%BZ3BFmu6J87)&S5)G4RTH9X{qOtX6``8L-N za!f#2^Uln~OAwgT@{dU($@U}lrQ%R%A2=6F4~QoM<$I+0+%fQ@=&1F?Fz1caGFQ;k zdbfrq=G8?wIMzx}QSr!O>}kW4A~Lb|q{SBYQT)d<#;f20H&qf)sG$6dh%=x{d{u1C z)+5&h3-cU8kf^~)Ped*_iP~{4ukpILDI)!ib!D%@3i=96^2fp$}ZuF z1SVqa`e5X)8&j=xku1a+Y9l>KONd8>HX@z zIhl@riFBE12c+h;bb>S=m4=o|@ScXLc5?r)096w_u2c+qOAx)1)kG8x#9D8=`f6uk_^ z`DOqOf3SgmF|_ctvp6I@&EH7-NC8r-zJ9;z*v#v*n3x zN13IJ_t2H4S;?UhbnS@dmZuE zB(@{KrmEC-w8)9j}FjB-N#%O~px)hbsKPiAgX!Z~!_Zqg#n@KAl7bEuDaF(l zEmJz_evs!cYB7SZ? zEm@^X)$qQ;wKk&SuZS2ZJAS;Wx2>Q+=xCI&N7b-2xs}rDy1FsU!uVy!%n?`%#(|^{ zVPj8s&~=sfo;Cud)##b$;mVYkf6wUux~Qw`EogP7EheQ$}5|iOJgc zChz)R-xDugNoz{fFa|MGy$Ky88U0>qls%h+wz znLz${5p=gDoceH}Gi>3Luc@w)ut+Nl@i79C9emMErYG>Xq~%~zq-i%;Y#Nt&cQtx> z;#4FhhG%Nbrl9SMI2*X1@Ib@9Y86STwgL0_kw#b_c1sg!Dwpiok}_Zm zn@YCvUTKXleoTMy1|87D_Eegs*#jiX>~D&H69lWFg(CyKeb+d*2sh(E$7Tg*)u;9% zdeTlV?}?m%6D$IerqT~W6~riT{p|v{9dp#U^Kvvt%#{-Fta?SJTZBbmo1I4actpN1 z-+!#lbvu!9QA?an*0b6p)Ve`;=_^)Ky}PwdZw~~x6i_5`Nm`+c7neV!%P|8c08o+0 zMp#@iD*p@she>5s?93cPf0dvFAXO#jJ&6J?lxyRquZug6Go24^JOLU`RU(!kgztgcQ!ryvY$k0g=uob6v)hvc?*yq47(=sXe-tuF z5;NPC<9B+U1-XebF=hfNeetorXF8SR?TP=Hj))SnDmn+aI1k)a(rPIE@k~k8L|wE) z5w#I5-ortm0R}Q}65e<@M_!4I7=tZN+<8Cb3Q=R6c^Yi`6Id;z4h0NoxCZZRh|M>= z&Dq17zeZ%elK`YPFXb;k3oD@0&%i;bR-Yd$F{~{H|A=KQeb(DV1Wzt`UyGxm06{ynA!1H8)Yh^Gac(-F0TNfkW|E%o)JOzM593Bbia zs)%$9-ksmqrf6;t$AS%*QQ%0~WTd=!e~z>iD3d)*+)fM%cz-X8l&kR&-}Q#1F|A^F zQ^l>8M9{=u&(rRkG4tPfwJL38KC!w*lG;)9dfV@4OG@XB1(QM2gakx7Rs=QW6&Ma( z{ag1Y0|1OZE4@xI>oa_mz1#d>>Fm}v-^+YtN-H0&KZ}9EY4!qTG?{gxi$$H7T9>3| zPXz9w`Es~Xc*llJg&ezrFpvX8l2Re}fKxa;5~!I{V@Ey!_V0j@){I~_2>s0+<*V38 zI?1XA62ynFKuLwdKowx>h~(`-uX&c(h6GKfiaV_wsdeXhFXhS-5EWgMoHH(-%^-I(wh|!T zq;Zcr#C%!57MrwUJszE^Sd*(=I@Gg|U%4ZKSyJj?gokZt!#%Lab32nMu3n`stTN~lghC0NL+6X;fd+d88X zcF6wFH}Ma6{M|XDu}xFHYDfpYRAS9^-t)X&v2f%P2?Z>KF@MAr24;8E28BSU%={RG z8Wsl!Kz19cLINNaQ&X45ERBac_i*YNmE3&bNfLCE+EA<@s8!!UIpEqods8_nZ*sfU z)%>(lXis&;zRf2nMS@nJD&HO76Q6f{Ll+<0L4r4J6NVl483wq))VL?(lwj{WKYP!5 zn1?7~a}B$Op(r0?o{PW?Kx1>=O&FSJ|(R5dKMTGIis%dZ1$|Q!yjk~!6@ea zMDB(Og|2*2LMf7yy%@_9bCI)uA3x#&l@mUBW#SAPN9Ib>P1I)iUsM3c#1KFo{J-8k zat;%c3{XvC)2(qZB{?3{>#w8LdZ~dn4^5%V5R{1CQH||$-U@=9*Q96cLCDv3zxblA zhhPlcl{gcucl5bD|ftj}=5iCvv;p^l_4&M!=hx zK7sPq8F|1fA1lc}*?3l-zc(M7PCv-nKE_$@rAI-kZ%aIxigCKTld+PYx>j{?(c1@a zc|IqYVq1vb#~Vg9#H5uuVDAGHQQCJhT)Yp*6U7wKB08(V-6w;Gr+KMZ@1}u3hZk>Y zcJa2!cBlF^u)Dm7ifJg{Pj5|AW-x?X`{HZTKEw`7-7B^9Tu3|?K*+b4Lk3P^QDl$`)mFOy8IR6%&&_Biyvg%GQb9c z*c7F{DX8ffG+%Y?Gy=~GJPwLb#f}V2#|&;D`kq_0$s3_h)g@OooQ0YnP_7T(=pP0! z9vV3j`XMX@TF1p&(gm=U>|{%Cz!J&b#kt&Eptq^dhkI*$PR!v9?^8kc*=)mYRe$a% zcma(_pl=)A^>gd{Ps}CaKVr_PxBf#MiEsVwzP4T3oO-($xdlPOTq!MdeF1IA=#QJR zVSDRs!R@)7HRSx~*%^tPh_d?a1RODe`xcI1p)X$>oBK6~LGzKX#u$U|r3(GAKume( zjuW*@w-#+irbnYN(?@4L0>4YE+&Cjws=u0yQnV9lld_yoBO^;Y!Tvfebnn)DqeLDi z_5PZ6-w*Tf#;a(te;?;%_eB{8SfDeCcPuN1?eC(+JFc6!q6>VL)P5*Z$;X$GRs{|B z3~U61n?UUXwR3B`mXrkaj31|I>MOb17xwO^>b98H1c!th?-dC^ZC9}qg|-JRt5-*;-f_i#8bYeoai~t{ zbeD~V5ebXv@7vbLYkcIFiApv#X`YMFWfJ&Pdw57A<-dbz?NBdX1*m~Od*Urgf3S~^ zQ*F!cG`(Cuy$8X6e(4E@S;kDsBT%Pdqo|5@+Nz>xfA?`?5D5v*&6;MW1x>!`n{`m13hui8=fA4k?FuU({JMg z%!+bikMr1tnWe$;^2I>dYlBwf-8DMXa3BEWG zOSum*Q^Hm%%HvIk4w5U{v0Y_cd43P{7s%#4Lshk8db^di z97qdQ-M=`D4*UP{Mtz)889w)q3-RCK@58z5Xm9oA_c(v6!tzclqWk4}PDYe;4eZ}v z=Ls49(zjXA(uo|;b#6~Q3Anp3~Dx@~dYY2SOThgN1>a1NJ#zWjf34&YVVt`PXL*fB@Vy z-lyr`uRg}xFH1jUvt!6IErLfbzcY2qgi(6f$&ir_Hva7cib*omG{YP!#S6R0gjIuB z6R30`4dnO+?57c1^GPmX=(i{(YWWnOp#F!FFV)fl8jG$*TsPaa(k? zPu7o3!GAFPQc-<{FrMvj{1U5`32rjw@>RiH6 z0qh5E2M3UVnr6U5v>JjIcA0XRC^aj$U<@{u_^2v(PIx=;&T>>Ud~PaZt9TG(j*dP1 z_o%HkNakf|U6mzCZ}-WkH!E#|RpxPs0ZPlhQ1M1#yVq%)j0B~{f^40>TvxTT8#pNXf|HePGkqz8+0&G5%pN-RfWp>kiKYW07#q5k-}`$CsdVTX=K68?DyY zN&+)Wd9cC6?~@8X|B8npywfGCm?;Hv)C$TB&G-j`eE$q&Lz@B?FBEA$i4u+@FMeRU z4tij7(8ug|(o~Tn`?{C?T^wyKX02xcZXBw!s~F92>%`Opb-Nx9W9v&-1rT;!1555|C^h4nV|d960Lb$_^JYMwwX0$CDyw8o zDv$Q`z$~y}ueK!Y8%TdS{eXJnHF8kjL8yN3DNr;M?|~L9_fTU8m2D(9bHrb+J}Bw7 zNaOq4s6eiIfMj37QAm{&cmjMTQ;}j1*bHOQ8ReeqX|2+ zkZyy$3Z8PO3ZL@H-fs6r4RZ|NP!3J(5Zs*bCiS%lTXB21L3-<8kuWLW5*g4fUg77i z0&vthfnaYynLT+j#o(3I>s4RW{12q2&y0=i7&k@ztzRF)-4NY}Eng$yZ-<4wYTvz| zt=^V5=_|Q9yKTNE(aRDgnneF*R!XNH-RSxR--o=!bW6RA{V#9%_e3?_$0p=XzxU_vghS?R-BT zT8{O-={wIP@q`4K-cg_H>(acLE)PRVDXN)Ne&3?)Ov`Q**494hH+uyS`$^JZV;N>+ zb#!A(_*GU8!%-tuif4zDT78VVn+^uEziYTXiM{rJNf{5qjamC-7l1kn_r~avkaT!EM!o(A#GNHWm zIqMoBF8_D>%n{1i%!6`|8U)^CYu&0Dic5BR5f(s|DDvlXM0JgvNqD7if$vNl*Yv!% zZd8J)FHJ*64uPaJ>54pF5}e{H!8=p0yq1T!5UxOSJCov8h|rk#60!GR=e^Acmm-Hml8;)g6LOT*@UfSD5#iUbEj zDO&*;)Q+{t`=U$aR9+Wj2nHV6ii{^^-VX(ouGF3_6({F^Y{L5rxHBzI4!9fp)uRW; zydt6Y!W(dh?m+6)@qJ=dX?-knyzGx`Yuud>N+|jZVaA>ApOB!ue8~Il9vVSvOiZrD zc{;in?h;Rw{3Bfc{>*j1RsK>;$a{&?X;Yjf`88QL!D9dgb;MfzdmE4>0O+w1rAThh7ru7DBw$o~|Q z*0Y^+yElu9;`xYB`ZF=}JPkI^sV|Y&K)I2Nj!q5Ab@Z$fRX$mQ4{>v|y8^LY${d7I zYVB4^V7!&Z6tB2Tkb%W=qxErH&0?+>>GFRZU1NBrJrk{M+qP}nwrzWBce}N<^;6q+ zyS2@&-ENKVdB0!xpInnY*R!E|<}R6PzFtc> z*ny)g;DSJ?d3~^yQBd0!!F%0)T~%>MmEXCB245M)FC0m$ZdR+~j?b}@yj1gJ7FjMG zoRYrtrwfm4+aq^GXFFP`w3S^+GrxkWxBgGbt1ZCVTvw`jgKdJWDB$u6b$l{RFm0_ z7^OL$q%9#>X9$ImwERJnJXU#XjPjGnGd&~)cUTnUCM0-Gi9Hf{Zqfg%Dr$qrDG3n_p@ZMy;B{IG)x@16J z>~{LVu!VPGTT^2}}IU<$-qLbSHTTDkZ6^Uxd}*F3XDX_l4HJZ?q8 zD6`J0MyPh{x#@_U0*Pct=tjU&xLD!gmrT%QD+{@g;vnnapRInwLL3-QA9X)9Ub?^~ z1&kl*aDivt0kx(pT}H;OW?I=a`{z?siI=@?YDVa+`o`g=LPG+j9ClC~|D5V#_A#X6 zhcv&_%hA+{Vv9}k9E#LD4U3K;v zA;q`@hYS}uqS$07_+7~wgCluVAz(&hzmX)a zB1tW|jL33AGJrW|7>Q^(B|fPvP>{Vrp9lbu@16+#Z?ob!RanCAwACT6rscfrgx)me zuxh|zkO;#tfEdR)=H22ubtX^zrx*~p>huky8P5VQc;MMbgkNYjbv2mSv_mhgR=AMJ zA2)FFaWX6aGoxqC-narhO;;3w^n-fR?tCVCF!G;?xm|O;@oI3T7wGq^4#p+Z2o~=490GX(c0T_T*Kd zWVC5nqm)5oZ+g85s8Rm*_MslaC+fpl+N}~-bN}IMgd$}DcI-aigzf^-z9grR z=!1=b{H3nNhYes~JvkYxz`o#xs~-SnqOiJo?J~h04OX@|4{Q%P)z#aC>FoSdQpNJcS702n*_J3znAiPR zngGmUGNh?i6Ay#BmPAoE%#m+is;RD40zYfY`q_Ykl;3|u)@8gMqG~=zG?)G++4dIR zhobC>)_p5EXimC+(av`OPy3*?IoIgPdKuzvGs$>4z$n4=Dlb0&sqA$0Rd8D9fzyzBGc*0`a)YN8cQ>`4pCD>5>9&FYCT#4pR9s zzzB7vEyQEETnC#%>jmQ(znAnm3W2eFEWc%);TZ1dnI6t>z<{VHv8T#s}D)TJ=Rdv*D z(LI^`2fJk)?s=QF?Sb<(J^+#SVnsyFAr>lmu#Y=>pX?XG_9TuSy)@qTJY`p)9= z?N@{b$0c68BXk3XMHS1%3p@ySFv>!Q9T~Z#QOP{YnsR+tl*+gsKqih>%K_KZfPKQ+ z&6bLmqc-a`-eE@hXVw%M;wO!=j>>ZAi0Do|*{^)US@Y|1Ng^)tS_3C)jC)*INFYNv z`$-8p&Hf=HGv>)=kHDMDck)JKb>i=yrImI2s>g@D?&cu&arqI+Okq2AyNdRdw@(n_ zcws&Ba$jYQQG(H zyr0P0ny_EvFM)Rc_sdUOSjTb-4{W@}GNX@Ht`OrMet=5eQZN7fj^oQ45q_#I7v9J= z=x2L2_6w z?20#@^mj9iGKiL=7&JUh-HeG1kovEhb-sZ&2F_3ElJq;A`qSy3BV-9v#`lx6cK#AB zCf;acsA#c+=4FRx;yVoRN#$8wp4OJ9P12d>u?gL~Wk|P~!H-UwNVNrbHGCjGCzzM9 zL1O(BXtd1BtfOZU;{kRM`PUV-z8=H&2-_Dm&57;LmXhNUJFxL(bbd0Y2l-W^%z*Xt zm3g&z-|k3`0e0XW6|ih%Io@H6dh8E-4t7EY#-_u)AeVAjFN&x2w@X#@gCkYIhtsfD z%_QETwtu`a@@V^d#Saj$Qy2(Xn+N7+sPx25cAk$n@vi049KY_NUb!b3FW%S$SHHbJ zLnPv%t>mIX+q|F;Ec*`_$kBrV#mKmSmb63p3p3A?{CoUIqDD^Hsw+q<8xyz-U@ z7|q1wW{r8~m3s~+m+iZCP10+XRn7wBUa~wIA1wYzH@GXk#^<5~*NHv_=&kJLG7Rc1 zYiO#uoOe8J#6rR1gB;L0er6?U|93Iy(^342TRsvFT@Kf%PnM6OgJZ)oGj8RB3QFNK z2{P0a)jQEm?!%dFib{e%S0;nNT2?@40LvUScIRsgKsL0=K=d zZ@epEYS8~OF}{3Zb%4G(QuypeuB9bOi!h_v=qFpsH~FAMG)sD$QTY?L7g%d%QZS|E z_Qnk`fpH@R?HgO_eWE3KK1j{XU@X?RQp4@|H_dN`arhMum2{Qx+%(A%-CwJ|FyF>f zPBVLhN~KurYL&os^;6Z%oS#8(_lHSI!6Vj}y7<>oaVM7q@FL$hBmX0rUD|aZtOQO6 zjf*v|xX>hmd6{c6u7n9q^=|a42FvTMDKqH{$d;FyhK8@HrMVmm>J&NwPa#Pwu3AHh5Pp)5)3lzRmhx9x0zjc{?*)V!+m(=Z4$ zCDc@ma?T<9^jj8St3}FhcaQ*!cVj(d+H!&!jIvA8N*5Y=4=L#*-6fPjBBHU7g8N?) zVn*f%zqA#uPid=)d1NG)qxoFDb7(G0ELq8If%NZyncP?gwHJtgyul0|&BwV!0O0Pc z$g6wvPc})5f&Uy@E z#pAW4=dk+lrwbx-&c~%1C%HdMfwGpfGPcRAnFcu$zLEW%H;=fItE0X!4frpYB|H*T zL^O-ed8i2RWZ9Fovy)1*1dV>UF5!3DHppg^l%6HvKez2pf{Fa*%!3SV5!y%o$z!dx zJuMM>6juF*dbgSe);?f6kug0IkBsmnVQ&yVYsRV4)=S>fqD^I8_jJ#;0hJFsD}UJX zOCaGzZpomD9|N-!gwxlTUZcsP`!8dBd#mQHy~I$o6P;4~Kee>vj9xk9XYIxAw8?S( zqQ<6*EMvo%JqTs3K>ix=Ca&+3_$!fJ1+-tQ)PovEVVHpR(*=5USh9dKmzk;u=)C=t_McsJ~kph8I>^@;PT_s&_RPmqI3G2n!q84F(j>_ne7? zV835Sh@E0re~8c(zPAgC;h{vKY$RdYR^QS-FTPOeQiJ@Oe{v^i;;p5C?F%>^vl>Fm z+TNdaHz5Ok3U|HyX$8)WPzn1T6^Y0xX#O-+UZ6_-g~vqZt8)noqHQT> zxb8``*+5L49wi?5XEECZ-qPRj=_uk_ND8JL2nr^zkmm^aK4_!Lutg6xSewjABHnUo zh|fjSz4rA_TL?;zLzuw`D^v{0I%$;J4%ZfYd6%J7q~3sfQ;E%6^X>b{jN0QFYUxBM zdmhQTe+Ix87s3j|jC$q{r2{1%eic_Rio!eP|=;$W#jGnIAfO9zZ#mEVKOpF z4sjL_)}R;>P~*lD_Q|kG$l{7eIaggl2VxHoF-P%X4Qo-LQi zkegwdpONldIrVfn5`>_YCbEzyWDygAgUJIlw-Lw2povwCljR~84~mv~JNa}9u%K7e z{PdGrUiCa#dEY}2JYi}kGXB}|S%vGg7FT>Lr3FX-erY38egf=V zWg2r%8P~!elhQ1+zkZ>38F>xTK+UVo!5TSnwsV!+74f`ndv}2>wSW8x;f*PYyVe3F zf4^eY!}B2wczb`};e7hB*2S~F@G_*m>nw|Jmw9Oao`O8EjH$s6RAh5wg_VIjy*R_P zg#1Q(|JYn44i)2k0t5J|j_$PNx*J^0MWvO2ms1EblP{`f7;GOwThkBrLEkR^>g%G- z2d^GZKf?e-(A86U#U!t_>v7OM=#;YJnvJ~O@oA8a#dEX@x(y=do7itpgZ0_N7X2PQ zXIBIxQKLgKY!jBa?orMt>Xj9ac725m$J?Ds%H+0G6+`Yc#w`171gK?3!^xaf2_H5O?-71%4xHMjydN;QNMATM5T>+2r_8fCDM zdfpG;>SHS-O){zST>II?jTPI+-!O=U5-1+M)MUgWj*}#Sr?iIqGE8MjsYKfrI#p5V zioCL1nFG&m1+XJoU`G)O?7${oP_mh87mD>LG3tnz0cWCU1g8g!<=%-}hmRTqfefyK z(-uUh$E=h$A7|1$8U5>cu;F6}9z2~-%AkK04|bAIJM$yUd^tD(S#7;oTQGx^%?sQ+ zka3p!gOwFw+L}{tk&$KUc-dBSa}}2eowe1oqmYME&D3l~CK+6OPlMh=T;MOueSQzN z_$rHCn|n*bb!KT}D^9D*ka^B%o%6v+Y3(3^)u~7T4P1_7ds6vry3(QdNBN4{6u_x(vMjCpg8Z%%{@hEiV<}uimVxHV}*D; z8s>XL?GNd|zIWvjAS3kXFPD}?E`%^-FJvCy@K}T30)bxqWrG|k_kDqVOHHW6EY0Di z6_hHxeM{SLbav>?)SEKg0B$<|#DbAM~+yqGqV)MA5SQhZK^+EC1DidrwyzVGdM8o~5}j0krK6dl0%E_-^R z2M+#jo-iB#3vYJ%yi&a}yaCDUp?H5}Nac?4mx0n>eOTg1ESKWsuD0{3@`c%(LUC9h zMOUX2wc)9^Tlbrs;*gdp7vP-Ut5jV#rlz+w{x<#eODHKdDt86}MVE7PUcI=b+IYPHQeBWDoj6un)#z5kgIqLO^1F^g#f;Bh-%REw@sIWq09}P#cPP3?&9$b~s zR3ywLSa&I|bg*qi>MT>I%d%3LsJJA{EYzGQ-s$b5wbCU~_&BMa5|n}F^UKB6L~isV|g^z=yDIy{!4i*)A? zm-$j~0oEJzR4XYOYT=&bvQ6s3i%J@#wBp&7tnclXQ-^EWWPmD#MVXK5-gVN7vIs@Q zB&3tSey0y!=0ns7xU&!5&^d{3UqAJ9%`GH*;HkW)vD0XJsp?Jz4LTu_f7G`0nAHVb@R0cv*1(w@yx^Z2HC%2NoX2?#|)BjB`r3h9|_1n0-$v# zK9tztN*9R&PNGYK=aFgdPz+{Ew0#x$0J;?>SYbT~^Pq?gWtDp$NUma)Q?aU7xepVq z+nw2LXPQtcKPQ>|VCE)>A4c7zI7B|1cEk73en-iMZ0q=+Xl;M33F}Ajk7nrfEIyr~ zyef*Bf{Cm?oM{pj{IpBY=0tQDV^x3xQ8kYNbE;Z0f-!a-Gw2inWZwfN7XT%Lq3ERx zB9kb1*qfO-u}Fo9b7MS?uCLYX4iWx?flv3XcMQtRxke5&W%+OwXnJ2eIQk-m=_(r~ z0J>@BzPbDW-PMiFNwx#}H4HKZSqy|B)_DI78r8SQvR|FqZr7SnC%{eyarkm5BC&Y- zSvuMRKd*hOWxcbFR|$*w=vI~ynTQa=2*rN&${HkM!j=!Y+VFkfw)*^#QxNZRMy389 z3|a3Z>poMw#R@A8Yua)U|7hHR7)L_K6&KmkhH*-a+GPB2W5B$0iliOdSBF0p6o9SZ zj`5DSB2bNipUWA0EzZ_I)U$Gw>_$ehszsI9$VSt?YvqiDHJp9PQlIIY-1|^nmpnC8 z_%25K)fDt@vvABaM6yEk%-%K2eht-*DB&a==_A<9AlA%$6}BGlzxyy)-mwDHn|=bX zk^~Qup1~}_x!PGXh4SZ@Ttg%aC1O%@l7x1;JykWg!1S%wVt{B`60?Zq;xbCb8o^X3 z99ZMbkj8;!EOz4hFPXM(Vn2_aK^F-aIVyI<{;$tv^O?>2Ef6|4P`7(G@CqxfhlMoK zThCv{W|}V2k1%#r|MQFq@&EB1w!45xeiM*=mYo6S=hSR{V-RFzy zuDUrvgIqQY6v1H(ePR3J7Zl~Cf?(Ik;(&H>kAA4H9W<04p?8(Pmc%O4f11+eW@IQ$ zbNJeR+UUWWIqIr!yNNH-^IX_v2Uf5(B3E2GM7YV(hssMFoKpvvT|}ta42z%x>Eu?LL@n- z#WZkrVKlswB=rq8f64_s8f$&o@5X?OS}Fu1=YQ!(!y+Y3&(%l+iIL7gfk#OAQ7N>_ z^e@a`qvEhgh%gOOXcM7mQ|BrwTw)`hyu{u&v)iIbQB^3>mfj=p2K9{Q- zjc&SadC@~6FX^X<<;g&IJ0wV&PZtQ8;oaqsbD#IFVlv7}w$ZjQB1QWz3m4LY&!_!Q zZ*&7md-yA7#>_2Ogn?(tz6`rR<|4?1@fEoae&^-q;Z=&vSl)U4H$#Gm7nPAc7a5e$PzF7iR0~%3a}0;~_Ia!v|{(%9`am@^Y`hXV1tlEp`Kkk^vlwX*UmU zh+KE~rc)Flbs)8dayrP~OdtR0^~3WBbS65=H!vKA_+!idq|MPE&u;#z+nam8ezl>C zvX%&cu!NKmYF4t~@DscSUF3$xl%q~rZOK;_PNOL!d!+_$z^gde&gy4{9ESuPwOnzy zW`b<7V|GaedomCZ5ZJ&{-Ucqp{#sbVS??Eh;lqn+;X%5+;^4hpf}c4JQphmJr;BU6c$^|n^eceXqO#bC2y;>p$c&#R=TB3-og z90GK%pd9yTuoYI<_RE7b-i|ete=4aU$P-9L`P8|)m#iXjYs+K8`N)%kCuhXL39o`w zRr%Q*oSzZ6{p`+vWYy%+jaBR{#zJIMslFb1Y{b2n_a@k zconti$XeLL(-RIoM?C4RfDbFt-d7B)Wg>*h*}P#QTOpj`2PQoda>wXdOYf7Kmw z@ks9-2B&O;pPIj{o(d=A<-n-b;ueO%83w0yAAtd~^rtheLuIZ_6J0c+-4DZ*9cdIy z8?)QacEGt5nd;+@!05UtK2tkG%1y)M5YEbl{%%JF4LRg4m-(PqjkjLRR*Ad%8+4q4 zjXVxGK_9N)^s`54uDmx$2z-Ih)S((1?lL`abkB9k4Zve&M`2INGZtnSsTXO1Y9y2i z^iRR!812J0(`m5ePds?A*vY{ zs2sczyU$cr?d`J*WPGS3CUt{*U}VT&OB|JHMS0$b79^uY6;S?0GSau_lCscAy>Y1w z+m%>Fb_53UA)sV)=#&rD&DpVS#k&J_H1YNWSJcWFY&AS?`(Fd=fM3Lxg70*q%z@OFmkg$hiZESs`ar$aq8 zL1SL+yeRaq8l!PR48O|S2ac=suPzj0;^a)fJ1cdfTsINdwS)%|DJIUFTOXBaZ3uDx32J2Fq5U zeE3MR`#zlx;flJR=>ve`Ms^d?6Nu7c&~9@Qz3kncz}S4jc!D-?2eRlwSX`)&ND+4! z_=CDArlg#S5Z_4r<||Q00$b?0rt8p{P?p{g4r}5! zY2-uA*@#Tfh|Ns0cga@5K4R>>lhnnDlL6D)z3zK&ZNrV=q z7r@b$tbSn?G%j$8A0R2)OSj+ky`Bw*a^52X1}DTCPq{ zJk2$I<2sMF$mmTc2QY2>wTFAif*$&!^ee91gno|jFD%t&;wJEd z^V?3A+6|XY1qNVOIxL};b!czsuI_$QsD~SYplq9n-fUYpJPEc8(4r>2-Me7GAA00V zi>l#1gzzuc^>jrW<6N(ni7Z!r~SRwkyf(e_ud8TQrU=!mg5wBz9R z&Oa>InBAiM5gEH%4DCCy5cKSZ{i+MQHVoKMm|}D z4t9vITWk6K2VIBUZj-p@dipvNw#=#pJjIuKHwZk0A*6{-A7()#H}Y&0j=W}P#}_lD zgcDNFq#}-0rytl@E37ud3%8m~>Jv@|K3jg$ENcx?;@kAQxEK_((-UrR6oG#${amMiVCx zZg3YzUgwiID30Pk5_|)^reF#v!@j>RMbAO5i`>#!+vJxS!?uB*!qg6OpzWXOGyl&B!VC__Y@~-*JYjfIJW0)87 zK;!l#Z|v;QUd&T_IkOwKIrju^PrSQmdm+s;vRbuSX!;p!`kWo2RxyX*_d_=Nr!O9u z18;TA-};CF>CP>^!(ayGA?NI&eOz7w;Lw8N+<7X7jeB-6Q}+B{yvE#MY|!0E#dMv$ zpAY>;Snq#!92~4pzmYz*LmpN4S%PTgoVAF)@IaXJL3|=VyAskS`2e(3quI@Lh;N@dr? zDoN-$xbuq!XXMRe|1Gx(K_-6W_I7OSw&%=qOKf_$tbqMo%Q3gj`#{yYm8ghVZsFK4 zi|&n*R8G*kQ!Sh3#C}l21tY|kI?Y21l9dVY80;uC{qHv30GW;-T!v$n9kImv)ccXF zZ-nEaq>bC;9)-c&e@ogWypAaP4^g~&yhkswlQ-082Vanb)(z~tO9@!^s4zAb7WwP^ z4}-)pmgb}ZoIH*M9Ee8| zBLVvgyyISU#Ekiy%j4g!;ObjM+<(O5{DbC;2utRBL?o)lu#2nK_!pYPi{P05H0>C#FpbZt8k_qm?sD z8&9dFjDYXx{TX2*{N&Vyw*jDzISYb6`{hJL4-JhofZB%l1mg4o`o@RC!KiFpNQPZV z%N!VDSDW3+I!P~Mj8hK6o=h$s=VYaDo~sCzkdLl5yC zOx3h^Dt4f>rJIW=LOC=1Z9?BK8C5V#ZwuAsW@cL6dSV~~9vlo-HKBLqGF)?5554Bz zv@K0_V8FDvy88T0Wc_alfi9ZhMqB`fJEY&nm+QZ+C3R{S+1gObncbWZJv9`{UYlng z&TXWL2>FxqDm2cPPsE}GTxC6@9_Dj(n^d6jyPs~ysN9p>N3MqVS~_lQtA9tDPKYZJ zG3+0>%pj<*fBXo2TUQ_mS|cL9W-?r>O3^F1+>z^D#c`Qsnqw&PwhX*4xuIwn9VI|R z!>6b;?hNl=t*%RvBYE5Sw|OgG^dDqBA=LJ7ZkC-#J$);Ha0yB z_-BQ(FF*fWz@okCZ5iENi=e??YH8Vm3E{KqV&jMU;jM)_Tb0g<3Aw?EctBgs%!U&P zG-ktbxPcmG2ilIL*PD+g8*OX;aJH_K;I^FMk-ObNNJeY4_@qI=lID|_KQ@7n)07Dp z|E_Sz>IlJ?1=KzvPPM@x80IH^)#xqtS8+^?7u$2oKqaK`fWXB7<)rbfQ?sb#_vNx8 z;QX!W#nsWM{>MeskC(-%u?mv(aYrJ}^?_rfo-g$Y!V>nwg-+A3{d!|srUaZiJ_n*W zb=;PS^OHnh1+^aO_)p39Oq$G<91!t+1EBYM2L znxo>Vw&)RdR1oWZ7->ocI@L%c-L>!<599ObdwOB0X8S4}jTGHpYAtG@%h{t-seRbE zAA)pUFwAlOEGjY1cVNBCPcY?b#{S@=M_fFP-#9mpi^v_Vo6{M+`B?nHED1bLwdKc> zM4X9sPT7rE`Tk@G@JV!+3~b%iu+|Bsoc6hSwmvB8c19K|4?rY+iyZ5ucUAdXebDdM> zMygf4SYca+5s)G}P~2#n0gai1zZMBAWN7iJ{ml~THoKyqseR7_@_{t@X&OBKDfl=$ ztb~h>ogoE-_?P_?$OK7a)a;V~?*}CMzja}R$`PZ9=>jf?oL79}V^V?AzehOO$?t|k+W z{7Ks|#D!*Ko_0CMHixg|gZEXIcro-m634uWsgZm|*r3ndOpxDrmZFy6(_$O?F#8p_ zrL^|!G}3xo)c)iF-|%vn!;f=)@ukc_0=ED66&eWh!JK%q198Ls1jibZTy`CVOWSCs zLYIWq&Q`T0xstJJj>SjGl%!q}OKXx`m8`+*k6)FaTxjS?Kflb|HWFE&T)H0Se~cn~ zq=p4v+W!h*_=b8qa7)JNse&l0o%P`G%|g;>;t17N(h>8W0xzSJ#7KPil;D{K09=^_ zjT*A7__E^_py~Wgp9A`36fL#Pm@#@Yk`l*M+R|KJgYwEqD)MFE zm0PE5q!LQwpuCsd;uMQeY3#vc8d##ZHF|ZdEU}j9qvQB>vbGk$WAo129_88#2P<90 z%-3anMF#zR*%$csxUI z`o}yQ*mR&d88>3Dtx(a#IQ4($q5hWEFBOmA*GThs1LId#qU5nWeB=qkts;*5nv1mc zi%&ZouLbQd#Pd++7ll$MkP8Fc4f3Iw>Q*Zx}Kt4y0qg@A-8=!kCy^Vr3dZ*_Dsh6pPS zIb}QAur(qAd#%sOYvPC!?nWm?l3eKdiEWY4Y7AI=bWdzGYiIas?es@n?r~ibSOd{x&0{O@uSC0~XAI$+VkQ!qy7Lve~0r zOXQg9j=J0zJ}aqB#FBZ~Snhc-Sez2XrL%qYheT^1^V5wr4pz=#Pe_{9Rl6SFb@ERT zJZQ^6;T;EO#IBdbMS&+x0vn9MDE;xcft`Wg{)$~EUUo- z;kt%I+kmAx1{aYmWz4Z>z4w3~fQry$()L`$ssu@8opN6E917)hzlv6gUPh@`uv%8X zqt~$ZAxcIS!rzAod{a4C5z+leib~e-%)i{8KZlp9(}*pdu6k&jcA4jBgYpxYstBo?<~qz;L?iY;RHTOGsN8jtqzV8J>MaXBCKzg=y-8s2A^D9maoPEr@|^^`y&#!3Vf9( z!!V8ygj#^l-E%=4GhsEe6i8z(o3tcTur!h7PrDVpbU-ab(oUrMgsQm5VrogK8k=eN zyxr)U0P{d7-1TZDTKnL#q=$Tg=aaTT`?gp73&Yfh!^5Q4kx4f*UM}qZE+b8JtlzSrxl&-tj%(*Y4jSM$XYmI3loyI#2$cU zBrCYO5s{QO*p46gR=Go)_%kN0QJ~}0BQ$JE(E#brH}_zbyAETX*W5DZLNN-f>MiK) zr`~*F{v!Rd{o~^~^r7=h8RnywHeEV`DcG2(C8Gn(sk6<*P+bIiou9RTQs)LLa^UB*kHc z5M7-+tC$Puf~3=gs`wpiL&b0x$*$$D=gw&!QWntuXKx4?7DUl85CXz& zn@+;mZ!VMB3R{GPNX&%FZOc%jlZcC2{$UHN*`q^O92H2D52GJ0Ac!2n1K9~Y1Wj$~ z;FxFJZK8R?3E{$5*nC%u;)K^Tc;P@L0nvy9sm>Q^sd&y4MHJo1J z1Trx4yW@q}@9lNzU>6Y|#c@||`=;T-@KXA?gqbYZfiN>~MjF;8S!&J`Q8)nzkJkzW z;Vob06*b?5a)?2Dw17Ps+e?+4=-ssf09nV@oPWzTp@b7Ajbt!NJ;?h9Igy6EzAs$; z=hTJnB!tN-bd1n{0<&0R1n7WLeDL9AqHBs~`(<$g&_6QQ*p4ezBWHDTX)$ZqDr|sp z!I7-22=r&N-c7sbVk2=C!h?5gU><|A#Oo>MKvxJo~rR35hx;L zDO#N)UE`N#**shaE!&Iy#&@Hv_YmwhJ9Yg;5}k8P#s^-agncQv0lNC<5{&W-lP&;O zbAov|yQ7L{P%S_zRUWvida}OduPtEcCJ2jtvtl@rH2n>(7)y-A(~h08YWjRmnbZ!v zqHwMzY+_;$_&(t$agek2kWQVu`?;O^<^JsUxeI}f%UT3#n{Hr8gWQED!p@G<5Blq$ zWf%T0B-8jvDDWG8%|F4DL#sG1v%&FwF4`>04|l4+EM=gv-n3F8ul?Q({?4CN9A~$M z4)qQuYYoi3at-^Xb4$3K+0)AX9f?QgDxKAY3j8@a1MYc;fTwYA6nJ)EdFlPSX8w0s z8fO=?-fxpQn+u}AWCku13H*f0i-@U?1ZcBBWQisc>>}rp@+*^h^x-OyZ--gtQLZOR z{!*Mc9CPF*Z_$Mv0h5SC8#C9XD0h5&b}_v7r$b=Z>ztg)O+u@J5TbD$ajkgLXB~jj zL?nz5c>ucV=R>5#D5g5%nJ`x3w%aHh9HFnH?6r$EId+r2RR}ZqX?fDaX20>%e8QuB zFmPdxJ##w>tw|fYh5q{+XujR-fDX+WnN>WoN;v8m8pQb>UN!cUaIF10O+LimW!+7a zdwHtszA_9{IjS)ac<6OF%k>T=*B1r+?-m#<8^z; zy_Q7+el7S2G!t7~B8{J*kjr!|KE1qij0s&jBK^}JLsMVYI*aQ@m5#9zCeQOfyH=~wbTmhu*$JzJq zkf4cuZ2oP}+nh6(wT54K;u{C5RKQeBnW^7-uG1@a(|YrY*;^I)|aM4sd=pdU`Ag^0{021uI|3Hh%HN=$}L({g@uC!2C*>##1wcroFVI zG!>Rjc!k)In5q`)Qj2Q4aC0g_t?V=hxX_C;GXpOo2zlU#?C<*%V?#z)Uwe9ZR(m$e z&)>W-0~{F|I-5}NMS`opR9GZrX-)S~pEZ|d(q>AUl9f^21WDtkX2>mQN#o^nQSQgb z*2SS8_n@C`?}?3j-=g~u;J~ne8Im}<5Dc{)Wl|hk9K+$op)5+6Nu|{>7Qn}{b=0dU zQU>K%AxHl~Ffj2WBY4=184H(wASqlr^4GRqjOj#9VF0O4crw|1$qeGSH-Ri~nVjx! zFAuBBjFJYg5(o6|1*(^uGS?gpO#Enf_ z!R1`g>KZ(S?T$&gG4SRu#gae~9-#^>_w@$-BU7UvQ>^Al2&;|Wj3TjSA6h)b9tB<% zXz?Z8SwfN<(-`s`c~vPDRxnv~wf*GmY=EVtUI00z70c3GvjaahtPH_rC4ql}-AeS5 zBq6dO6h>!;@u~p?hiK~2LnJp7eC`ma^3)!OX#XWSr;KoFi^=T+k~4KCVAB|)(-K5Jr45=SS$w(#J-*Ud zTPV%=$(i3+X$py61Al+>>U+MMGmtR`33P6nF8Wq00Db9&ntZbOf1yZt-C90rY_;&5 zt`)-qWwu1l@pi4v$qP&AFhJ@x2m2VacvL09<(4W_5m!70^_@(s+fkq)*I}8^A&NGK zG+bOqVh8-Q|*fZkK7LGE~8^h72J|n}iXs_UH^#rWEI2 zo)zki^4X5tnGXfbfMo%6q@^Lww305Q zlM*e09s7bU7PsH(jhW`#9x2$GWQ&3qH^Lq<9RE;_*)@L-MLH&vxCo^7>l1LgLjLM_ zppJJKG-eSgJYs{3zMwVDmWD0P&Z;uB_i!=9z*vzj{0jFd@pL@P23V2_dZx_NQUbGg zO*ObcVH7B?+z-8hQ9)`sXsYRdIgHx)IK8l8Igei`hL}7pL0`B09uQ&LUv4g*ku62Xpqf->Br+xPI}A8xsQ=UkgZ$L&VK7u=Mi zkhL2fSI0v^o3$&q=mE&CJ5NL2hX!-&+Cjn|p&z$HravCx*TEmB>8r9H5v;af>0WLz z5q{q%=Ro?pTPj>bnQs#s{;NOYRKwkS zqX{Ye`O3nKWzcK}{r)3q>~AbALHitJqCAxImrxP!p(`v)lq7EOs%zfv?E96gchmgy z7gdm#umW+!CJOw(E2j`rA~R|PkufwAsL^EilH*yIp3T%0INDW z&>34sD%Uyyq;{8FbkTp!67kMfE5xOR1cH+UHbSI|t)=&{KaSUbv!mTDu-kG|k5W{K z?zxVkBTf(8$< zQz^I%B{^;Npx(*76V-KKT^`f96s6HW^5;-?Esq}Sm4}-o?2ueVZ2@p%5+p2Np?sEE z=%~Z9NLvH^nQq{A@25!gmFDbn@!^rCtVFmiZ-qM^stCqp%(SuGDo=}?NcF8_%k&0L zl}h_6L%}A_Hgo6j)=T*4t=EteH_*%FuW?Z5yx-@A-@MLC=+gFYy_C_vek(nb=G&^% zTdTEylTn>X)h{*B1GLD+`cDSG?-z3D)_eW{XfKQ`>#u2yMP&H2ZZdNM?I4mJvp1>hcPrI9~op67aRIis$`*7tnv67Ek2eB=pe(LG~apy7owx}T>!`F-Fr z8Ej8Tu1K{1lh5CNx$35&$2GrBmw{nJY&+bYoza%69+OAxr4&vJizNKKs13KUjeV(X zz%fM_ABgDC8Xhojh=uLm#Q(6(3*>=9_Ho9BFE=@O+8eCe)3(P42nY%M2vYJOIPx%L zsm2AW)HfWPyZ_V^<3pZ;niW^CAI(HVmYq+}N>=aL5r{KG_yPt6Ev7dt9t6mkC(LTgKXtdAE(1n$1ruHZ@3*9Lw8_C881b33BpoDDWo^a&92PvHo7l zL9MA)$B+X6@+QNnBvctu%|kxdX^m%=o_y*z?Ijbqj01c!YY2vxGrccPsM{lhIlTPE zG^lM8+1Yja35D^4opZ*zwEhp=q-oJq(SY*gmTsvSB%57KPzY*hda30wqLizL+Z;Ic z84X43))vJ|TP&L7pb0-u7=j%3Mj!h7rn83kHo+4e-ZOWfnQ112*4=tr@w?u6(2f}o z+kb9nD!(~?igR_1=cbm(d&CIl+k52^JL+o6X~al%F6+K46dTad$%jPGa;{Vo#*V!= zK96kmy}429JekgeRd(ga2!l+zs}sFH)+XkLarC8jf-A^ONzvvjR-UZI9m3{H zVi_`H=I>;YW79f`$KMz^qY*OreX|cdyKXas(b7k781I%Rl-o935S4b7XGO>xesZZrc^= zGiGcm;NYK?tJ=k4Wz_yM2=z=&J=8bmSw+3`5pM2(UM>s{|1)sczkT_G&xK~)Z;ZRK z1;?u@1!ujvN)AF>Fe+%&gE=4j=kEpdv}=H|*|PtIv14Szd40ObwGN}DZ0V^SpW ztAbVjHtcJ~up#8BzM96E_1y{W^Y zbB5=NG8vrZdqasy*zIBWYsq!evbC6W*Jp-Q1%a_M?Kj?_lK;+SV8rAOII6c-&upu+ z=THW}gHrDCT{d2{{kFf??E@0oho9qup5n%`C%C54WbRz$5()dft3LV>B3Y&eAndN& zj!s>7amqtMwYy_#rvs?N7xc#6ivo9yL=)D(7W8i91GRv$Etu`)F9*0WlzhE@7a)|! zh@#F8cTsLVRArM{C8`t-NyaifK>|%*nKH+y#Cpz|^qj_0?{_@V47|t&17aiXp6`1k z+BS$ECxs}A6;ouH{QTbUN*&fwatR`@kXn3B-Va%pG9W!#O-@Map36Q_R^u>zkbs2QZ$O|-sUo@Bg*tMS)J5?9(WHHk zFSVduTmqgCu(z_SGx|4oX+jxnvmtQCaesLK_RSzZXWGncB=!~Lw7FfCl_ji?BL@j! zqX|i@@twSFD)#UDb?~IFKki}uSA(xfgxyWoM%gza8P5GiRm+=mE2y9R`HI5tLkUA{ z;0z4e7RD5RBtjZ|1U~=Dzj~wshKm}TnjTbi5}+A4ygsJqG54LZ`u=brI0Q+K5$(jC z4A4K^(Wpkl>EF~J%wCrt4OyJy7KJm=5y~|Y(0&ii~ z-Y?rXmrr7_l!ahy=3?eSz^N|`@%E<{|Ga*~=4DHLyEQiS7SqL+9luCPAsm|9qgP9g zS^Xu@hxi_Kd#u;D?|J)NsJD9yv!mbFR_tz9%!}KGY~JT;_*)9?t17{zz%_(k;&G#k zabZ?YLAF7&s908$WUY^#Rf?h|0SB5QKg?aevKUV;@0FgNQkgUCDE-lg@5Z z`U-?JDgu*MC_xdvCt3X4HJo|&kvuO(SfE)vdgUHnjvbe@PrjE=fuXD6w9>&W4bbhR ziB%}n%H~5y`Rq%je}%?@z2a71=RH~OfichjK*?mQy(ig5S&_RF)Nbcwr*Bu1G`-`iqX-ZPq*Z||~001i*e))yZO`!DD>dFAfs}RBL<{6QxkQslH zsfs(Ytl=_p+5Nj-#QX5smxrNE>@#Kd**Ydv^$=z|_Y0^eBPP@PfH z13_SNlL?vN73||6`%w7&Q?d;KTzF(1IS%Y1sc0!F<&B@soLzQ0;1I$FbbR&uiiY?z zyA9UJ!Nhf*xtU{N|6R8WN5-~a(U!YMB%1IGJhFSsc3IU`Nf*bjCs1x`%YX6Qbz{8i ztWe4w*r!o_+aZN}hV7%i>l8Y`7TI^uy}q`et`K%n|8}u%d9Z0QkFff>o2hU3`DEVf zy&$Tix1ZotT5WOrSiWJicX2<*wvWK$dhas*2Jn;>w&bUVB#QOcl6GTm5IoI||6T7; zx^8DA{<*6_M2tbm73L3uiCwb(xe{b++Denv8(HX||7Y=E$$U0!! z)oG@uwyy)(?`!r=k`kh{G`1?S<#Hi}iJ8;umY+mz4~#D{4NH_`el3*(3(*+h15p>^ zScszuh-GiK??hLdxPhPV#2z1sDrmeX{Mhq@Q`OAS%rSu5^brOYW=oIPJ z+*`|`=-vVs5uR1RvO!;a=*;0{@t!Btvg zF^{%eO)dw8B6UVLC$$BUR2bMU9hbK^Z-X>Fa+KfL^hHOTF_lwjvdw;he8@u-Yu?pp zWIWVH8JiA(>zb+BKWP)p>A#=jDK|H_GPQz96D^m+h945~l!R??_8ma3;IJ&`a7U8GR*fgvY&ndDKyvS!r;+Dn z4>6LGv>z03mZ<;_%p&L=y6WU-$}`AXs>!l9+j9HMNc^Rvsc5dWI@j*k%X~PRXNR4Z zN&@2A+jRJ&VN$rK&A$!@?FXkxx?d}adY`umkp>oHrQhJJ-n?NXRcAU`Yv4cX3 z`iv`J^We)J5qgLs8jTy&<3J2)-`XnqHtu#fwM&Yx_Z7!SfUoZYfm+FFX;3@ueACGf zU8(I=_cvf5^p7dL2!$CWMKx;foQkUQRC=0aZqV-o9^eIg#*_#7xD+2N0u1=+)R1&~ z+HizY?)iT_)J^xBkz^Ac9}n_*XWzAjiM@gzJ(136=N|TMAMiWeHR6{a`8UxIFVsV; zGfQ?7xu1sa)s)~MKQJur^jL~Z@7It_u%%xjwIiS7E^8QMwkz3Z-tOSwAgj3@X-k!h z5eBV_g)zEyaeeRgulFHq?`5fiKjwMXNO=HU*8U8N5(QZwF&Btn@xyrXp(+7wbm-lR z%Hhq*ZP#sgvN&W3!zS)uA7Q?n{}CUODiY-v6X@;ShQTrcLTpIjM8Yn- z5vc?}$M3~}Ra4XYTMl$;&O^@2QH+3>`RTO_<(89M?@H_DbZ@5_BvR`dRbZ1`R44^z z`Q%-SKY-?at+|IJw#mZVXnI^)zWalG?Z4w(A4ba_Kz<;dT)h-EaZ#-lbq@9?QOq;5 zaGJ{}H31BJaES?dw|+8T%aeC$Lign|b&oA02DSTd-wQu!AKoP{TgVvi6u58W7z{DK zx(G~$30!xH@CS4!iXE+40PY@OMt-S+_Ud5djqv?`k?R7KsLrIxiSX!o)UKC6)zVZ@CF9^1I- zV0~ERlOm$oacHxk1Zi79UQRfA-Ls6o)OdIZiNb6HVnYf+duNR6MrkG^w;!^CMLtk} ziXRbyCZuVJa`X!}SHg97A(C)9C}Aj5unXO%#?lqdtz=LxiAk6s0^wCtdxSJ}iy&PL@E^n3%aiv#uo%ijGwkCe(oRZf%#fzT)q7Or{!|uj*D@z(M8$Hqa@O zyIU(%nj{KCtGGJQ9Ws6R?r>V%YW9A*>OuJ)u4R&kXUfxSs5|#M_v5zt!?3>bbpF`= zjpn!heBJ5$xM@1PvVDz&JS`#ovj4r&H^6+*rJx_WtLFJtGTeK!54jHE-Sd*N9$4lB zQwLADa*#TG{Z)bG=RUuEQ50wSvRH(C{Lyjf?tFi&=+w6HO!vI$F1~@c-Lr@1e;F>l0uO=cFT6xl=n*pLR&5E9z+iLLk_<&uu?xYu9@8;7XKtH0hJjO|r{*?P z%`mlJh_;=I1{kj8LiT<3eX0NM<&TC5e?h#_6u8QvGDMT4 zlwcgni1L}?^330XB`6yNjD7vP|C9(WgBvxVg4nj_s_J*kyW2g6ra5!1=btf~NxOh1 zQ(g%$)k?)gfuvbNd3N2(TVDHN4-R5~jkHgEUQp5K53i-w)_L$>t%IB=8J6;7p(S2T zC)vhAa(zoG3B8SVA$bi#I@5Y7yu%>75EJViFhoJ0ZXU|GrzCRBFqGQR)gw^*==aGy zRqAG_vFY~xLkz^4<#+nUzQp6M-_m1+XTq{$xK-_WsN+hVc@4-p`d884o#M*BC1c|% z6BnB3^A8OpQba)OI-uR|gOrw2>82OsWZzhpo?Fn?<_BG1S^jM#*Fz#VX{{n|ROgY1 znsbe-s*^HU(*g)7IZL;jn3_r}2Up7HQ*5{R06POM>s%pFLej*`5N=ZD2Cg@FrPv@y zP$GAmZoVtK=QYHx$-Lr=y;|5bZo ziHS4z${TFsRBHc?F~cO@_jGUzj3O|pjYLJNi9)O?NjRM=GtX4AW<|3qzreRsk;xlE zqy@6fly*h<4x2$2bsFt=DvM;S@rX*_)1!f8?9GwtTxCgIVNgUS2U$}d8?TJdk`Aj2i#pYJ# zmn1KDAD@RGjWLwi*qAW8AQ!YnC>TK$4RDbb_2yV#MAcBPjs2k?1F>o7_B;My+lA-`yc2L>{A(sza z%L+2}$uh?@0@(|z18{;_v@=o1JQjQZa!$>!vt(Mz6pcz*0u31y?d*l06#0P;txH+* zH})TCT2b$lAA;!%nw>C&4!2fy4R)3fZ``c4(~j((n-;*V?>`A^Td97$8^d(cwcw!e zWrffgU7oe#j2`nb94?$}7T}IW4_33#-qQ9OcWn-uzph_mVdpnCC`}_;7upzty3_@| zp2W@`BVN;J%t>N-EW5ixE8$Sb2W4$tDT0d?Hr?MI?`3>dNA(2TTh;Z)DLQ@Fqq(O$ zSl5=NWby0ZEMDjXL1S5nG#pCit0uD#!#!1~wGvG=}2AyA`QZ}ZWxKuGKG5Enms8t@o=3W>_v+xEUsk-Yp*Ok{U} z-1Q$svhUL~T(b+Mwd~6f;dbdTml3jcfVU@L8VFt2hdm>ICfkwKVsPx4lp8} zxO3?K*Fqk9Uh0PARb<}Fdf1YMU-Xs$#Y~nR&g1^3DHLa8nKyLdI zM#WeWdWwRPE8o=ENF&_ydu#?uL+cB((YvvkHDn=R0$=~ULYGOnCQN#%dhXaezgf&< z@N1Zd_SUQh+=Ic-3fP1SUh$1IDttu}o86+Y|Ifs0m@Yp`pdm*Yho;-5Q6|Ym7V_E^ zrAIFC!KG1sY9BSqQ(o0B&aZMezrQX&q2j*1b}jZ;T3@eyPRsAd@q0t+ycLY&J)s_2 z9V#MocAQYTIL3;Qo1)Gq-t$$M~U)_1lm61!fHy4BK2{@P9J}{ zCrP>$Ww!5%@KM6jnaQTx(-vAmA*%JA$fQoSoVEZ_JsoCHt1)BU8-g@F0Jq}vF-&HCysMHfqi<^u-WGo}sRqQ0L4WO)EuGiAX{Z)H~r>a>nf$@XE z?7(VNkvkYmwWh<&tVqpZuOX2D2*ElhjEa;%fh-BBw5gIY8WILJ;1h0`B+ICCZ=_Ret6P|sL zH_H9W=T7vvq5l?-+u%Q|hoE}IV?8y73K20B5pcrR5^hqwQas8S6gH&1Y_vPppm<4+OmhdVp2{{}rT*6qEyLCCu&YpW_4eACC?)W#oTarSMpvBRw z9R9m*8F{}uEXf;*WPtR?=h5<)TiyC`-7+r!x1z!IB|&KUVYUFUw62hq`~4Yq^81O> z%X@pUB@JhszngxVxTpfIrld&@T?>s63|AGMLQRyK>+f#L?bh@Q{k&Spgp@i^6Cuw% zV%#_v4vr)D4BH=XZQDO1i-#91_jCSn)bI_Q=&#G&aRS1e2xB_?+|=&12g zKV)3#hgo|ZKU6w-GOx__G@kbxWC4~(bAxqxz4iV`fCQnTzbf3Vns^ISAK7gO>&HE@ zmM^!JRkbt6n7Iv6OpL@h2Areo?t=_2n1okP>-{A70!jiuYCY%c2piV-*D%i8oV|4M zxjF=@U3dn-{PwRO(lC6KcEt!P@%nLK6~`U9x^r$S+t}yUo1tWAem?}8^;vqfnsjr#lYv6Z>|#xksFD>HaqHx3C3;lC39LD0{<*~!=um(F z#IuRr51}9HSC!LLjg|WHamd@2M=wCp@`a@(&y^Jf%4Fjil1ziD^ldL< z&{%oBHtcx#J~!9%;pwGZY7$=HDLLX0yi8R>WP2{d$9S0q4(n7@Vto8|m?@rTx{av@8tQThCZV)9>%Fc@k z_{CEb7pVu5$ge}RxY4+jGE+Hg(GQExKp_Dm-|1vP2gu0HP^>Eb+dY>5sJyyLU`|s5 zBcsA+LX1fi3OYO$ZNZ09_M=PbuDCrnO4C!1zw&iEI0`xMurT0rDIk}58m$L$xPmsA}dm>0IW@(U{9PT3xyrd>hHW< zMuw?RCcF|(JFvura3kt@CLgUR#19-#Vuwx-i%7)9gL8pd&Ca5@^rW6Fc3L*} zxs8K)OjQg`4IA6-UGj-0j+hWF-#51&*CaHC_d4eDjU(YzpD19w5udmUdd!w%${@oo zL?{6Evs4u)m*!YwM+jnOYOeVNaksYraie=||4DhWIoa$~l)Km$Ru;iUT+KSr{j{Ai zTV>@JSu26}U#=XS_~C7<|hl$n@X!sDhIZqw`Q8YNq0c?|JT1y?S>^X|2xg_}`}KaVxmg z^CnOrgiR}zF?pDR7=@p2R63}_!4b&v6TdhgU_C|5Iu|s?gpc$+Y4bvLOg>O? zvwo%i!WjD5SvP!59V?!`0aN}}z<1H#^g+KhWH@5@ru$0h_i=TU#q-3*w{kO$2xp6j zPKaM%bceu|Ol^PzmeL}D!+6*V8MrOT{rCWA7eoylpAzCuKZs6|m#18_;X24-exP*2 z5kb)H{Cw;$6U5q<{I`#ed3o7xQ1e?i6#R>jlk=jb)>|-m1Ldn0sYv+xjZV>YpF7SY znNYF=OvDYT{RBhh|Mb($S_2d1OW} zM%=9~59~PQE||mK`X}MYgvm&>DY#HK0|&wr6l~2K*Rr!va-C< z3&UZu(w5tro&wPte4uPyR|DT}HpYf?6xTH=HMJ#r@k01Kw zjsokGJk>bg560Km{q9IFUP!YOOrI@16_;Qt&!@Z*ToGAPCZ}gU5l25Tt(OXrGGn2q8{blQ|^{S(Xsj&BO9k02CB@waBjaeur@b!cbM|C-Vv z5GlZz(e1i8DDQ_&I^$Qv=0o>VN1Ujxh)cm&i$2lyXI#|^)s0~I=XlTAA_;!3P|efk zuGzNuJW~uz?0Xu9oac3osegQ^^>sl-L(doU@@G#R?Hd4MzsrTh!{g%U4+_)?oer`? z0X#@fN{Z8iFxuiUlBUuG{7? ztLb33cIhQhoxeu3{2Bc`yze@)xm$n!b@+PUy!<}-Ja6>;)gGGm^i3g(-simSO7ctp z)b$xZ*4#-$_$TBa)GQ!D6OG}e{8>)vj+<*YX`}&stNZ=lei)Wep}k<|rk`2A>PzRg z(>B(&fTU7PmvBv6f(Rce1$;r+1BbFY_#kZKu7v8U#wezSK_yLPonq8ZBdnS!sgTt> zjs+C{Li(@H(LS-)n`U9r=tt3HxUYT3eIsNEn=ZH=e7H;!j7_`#Z4^0!+3Ns!{eaQx z2^e6Zg8H0}!=4o^5Ea0g{?j@f-e6BFHw6Md$6Uff!W<%H5RjbD; z<(EF=ym3;yzNUWA2z^&emy0MiVQ$v%ugN#^PlQb41)WeXUq{tQIOGT*a*sw@ZVu2X zshBISNv5EOC>CR(3%50qmR*I*qL(~$$wVo@fkg$v+%V;S{iSCT^z9@UlP@Pc*Nt4i zT!M^3@A!b*M+TO?|JZ~}<@AIP+w32e1{ZRym)|che^te@Eb%DtD!`o*Gz zu9m;ivMl{x+&i{tZocibNS7}|k@iNs2X+eSTKFu^_@R91sL9&HAeiu-su2wQ*WUz+ z?f=BZBq<{~<|5hH$9(b@=WTdfAYZXxQ0Zb-=dDR&E#;-%MdBZ49OFuyAO*d3SR$}ip4?AIL4X&VXBtXJt zY7ju|?MAr*@o7Rl8>gZ@Sr(g!dtdYj-Bfx@F9p{uT5lczJ8z=nw)LB*U6PPejD6Ex zlTM#oxs>nSS&hu=emov=uQJ6V?h7DeDXOIpJRNo*3Zb0^EY+aUY?NPh+52-D-^&rx zz^d<`^mw|ZiG2~Q^!RB0jSkP-SLEeT=#1>&foM%SqC5s4zR&z#Aq}3Hy7Ldi~d z3&GJlrdGttqc$D=;o~^4OZ7V)3>`fy2lvh_4)^zjICy`WR`fb_(G%@=^yqECbUyfmUWTlv~N@cV(6{SOy zVx03Ec#|Vt1&y!+Mbb?np}6fxd%>|=3d{h<*h$L#rJRONf?mY@?$cFFJ~x5(t;c@@ zkhrza8`Z6)-rfISIVDmc#1by>7;i#2#la(>b`toTlC136&Vc_pe%f;6z|W@jN1ee+)^dy1OG67wc|j$!fq2kGPpQ(>C3wJ z0gG^PuAkgi-jdj<@u)jK2FK54rmOGucM@f`0Wlb#I%%>(5v*P=rkHRmH%H}y7Kms@ zW55L(#ss4y;Ox!F1#nbK!X{5P7tKyen-zfYZ^zrpTG%iBIk*s}W9AD8rwuatB~m?T zP^Spb_Vv`=(QAQ}RMOvMf8BT3aUAq=-vQlZ$b&}D!9qf4uL+HIgV4f4%JvZDU++FV?J(<4w1b=PMC>K{LDXP*m+I3_#d0eBhV9yR<1rgx#d<=1E4-rE zw~rwojcrTd6D9KQqjh>*L;)f19cY zo6aSV|6rS3aGJclZn|l%x|>-K$l&u_aue({VySL`UZN&$)EIfAPUG=!Hh$g`EZLkK zC=En8`Waf8bR`k}ie{PV6^Y2|pPt#X_eC#`QsH&i`g2kDT_wL)o2HzLQe4R>y`-)abf@5U*vsZS0FjcN{GRLLRm_%a%bRA+X{>N`) zNsc~ui=(A*-=i+^g_R=T>va0Sr}rOoim^@S2~RJ8fm?g!JFlzN)(%g4PW&5giic(1 z2|p#~IV~r>gGAS@)!n9b*~vYxi_30<8U!+8{s(|UYBkf)pSGzopm3m?G$MoVeOK&4 zK^F}jG9W|!_3j|a|7-v9Nl~Syo6$fOhyU(Op@h5V7v418Y9ifzryVZgGJT5M@LYL~ zHsX&6^`%lXRdzFsb~ca({l=Kz$u`p3VJg`hw-PdXt|)3hKLQ%~=NtI(%bqjI@|1#| z;p~fNP$QY6W@8Q7D~f6@ngWHD04g{d%#8hTOJn7vNy3l=KkUToqx5g1O|WRrm4f#p z_5XPqosSgGMVT_w7C|5$2aqzWwFff>RdBzg;8OUxIC{KH9|Ev<4M7!Oe}6=Mj1awk zzA0iel~0371u#ud6Ps`(?`HRF(#nM4&9*}TUO=d*=I%eM`sP1z0+^ofxN3mO{cgT8 znry>@sAE_E1iGx53}Na%6`bgLTnoaGXmK>0$e-kUoRA#>nA6nx35`gq4)n(kYt$8W z?mNzq-}3`~e_XO#9Bep075=FM`?qV3_fUS{9)7|X?{9;gu~PR5MH7)GA7-Or)3^jT zPMp7!YI2g$?29uZ&oG8KaG+JwC&6J4fV>@OV0JwHm@XFpPGROqf2@S*Rp6_E=NXcP z=g@fV_+?LbWjws$z>yD2I&U{Bzm=_&`B=;s9GO~nYG~d|%fuM4l?hnSrZ`ai z>^8?ex^l2#4K-}uz>p8aW;j%hHhoi3IGzc;AY%6zM_vBeMu|EUj!#S z#``w`?e%fLfy_{E{3<7mi&+mFO^eogJWci|tmP;B$XpsASS)S5XmAmtg0YE3rJ~Z= z3IsS&CSM)Y&)SW@G=+;=o4qb)P@LQ()04D&mUCllN$_zps~iCy5{Lo7^+`765&1(M z;ohNMWZquC69uBDT{N`D8(8m*_6i(`mYFHx8eK?eWOIG4nh4vFDb#=SX)^B{rKewZ z=XLo{U~vLdt>qZ2OjP`#G0A6Fxg|ET_*5bL^jM30lS-R#dW1f>l=%XP zl(tTg{y4#skxJjv4p%_8W(*ATh?OS_%1zR~2_pt&$OmoqgjAdVO;m>(w*Rvg16iT) z@gEPmXYW_DG3ttKijmTy%m( z3m!{oHGKEu(klNza%UVct$nRq(Fj1zf}yfNXO`*$%blu?SF&bI5DoR$5UHhxA$??{ z77Z4y9FZ642@dj?fhnm!);0<4dAlnAP~dUCiOoT6tl?|H8pSrB8QA~y1P>=NPFy1O z(WE~?(4F9nYUx|M#~{@%>|4nkcX@Bv1%G@JK=1u}m$-o9>SHOe9XFdhPLoZCokZDT;!K8Al`R#=2hYwBzM;}D^{Lu>LVV5Zf7e?XW=g6=d?)YnS_Adj5Fg>2p zO3G1mKxE70pHU`rjIh<4PB?gF=Y-@d9R-tRr$n4)e3hkwnldEALW+qN*f0(eGfxNj zrhmzd4k4||tEvHm8*nqr<3{mo&0fi|ll5#CY;4aUKhgDQy_&?8o%J6`4mfBecd{Fi zfm+L8lI}g8PBhGW{s+SkNLg&^Q5?m_KyhuI+kcUb#SEKXW@)~OIA%n^88u@MVY*1O zlCOfELB+=Z;p{vSK^L9}4wNH6(Qt-ukCp&P?P;${3Ld_{%H-;wDGbgGt?Fn(48xz5OrDQJ5K zdJAO41NP?NQAf)D_Zz+eovnqUT6I zGFRQOe@kY>xgP9`A~^QMmIoRj^>0G%k(kRe=}=fT9`SY0#to+&7Q2JtJ#8s`OSKYt zFa^XHP^KBXi*2~p2XI*&x^$U8kJ6rcN#KRlu#EZ%MBS8$gGw6Q<7v)^#8r zY^IFjsvLBD8NBJX?sYXf(tSX}Mc0_zojjaeKE9zvuqb`{p+ELKaxi-Y9exzo1(mj} zW*mT^vDpt`rXC67mjVXM2rI#U9^aDAgub_bBa}HK8x8RR03H1kxQ!M8)fN?GFWI!z z!1IPVT@{!}mn8xcq*vu~ITx7XsWk%9Zb`fhSE130xvoC*O9CS~+0}w&HKN5}o1a~> zlGzniH>BsGgP{_8rqIR}3uD`g0pJYk_sZ(g@ly|q`rM9zW4bLmZNDdQI_v9wpMtQ! zmQJV-sQmszvbk5?nKz!9%96 zq6lTj3MT#IXV=2yXe+lP_N&2xb}SDEw>@=^P+74o96`bTJ#Y6&iu`GSut-{ox_%>T zqzGoKYZm;Lu;6mdy;}`OhO#w<83FILR;-ePy_q`3t8ztxALvF51v7>*AKyiIut>Hl z4Mj+-Qn+V|iqoM8xpLAtH#t*QYzfb__GnSKx@F3ttpSGZ{#B~Xg^VR@k%|mZ@$4PQ z&~(A{IVa#^u`UluixJ^xDlmtFw7LYsk;E+y?v?Pn*9Fqc1QKD@A^O*C*e>Zo(EyIc zt_)|F2d$ffVlsZSYWU#zgU&GsF&_l1`0rM`>@i)QrgH zriSpHX0NGFxJY0mC6_dhH*XkUI?*>mA7HbudpI~dcR~MV*V}hOSLsK75>4qJ6RAB@ z!BiQkqd)EZB6T{{=!FO_H18gK1K-4W7SDpb3*ZJAo5 z4~|a_Nisi1LUA@e40sbTMWeNFMO48&{W_ipwR8C+7GM7QbYc~c8ts7g6JQqr5V6mEL5v(=J zAQdZv!z@oirHbA3>2j2pNzDkn#3Jw;d_Bd6Yt9W9e4*XD)-)%?Vu*S+MkY%W6u7og z!U>%a%VM()J86lVWE!t`1fSwAqn!=R^UhDQHY*#}9wkEz?` zUSIDzIQ|2xZWeZFjXofIV9Muu{Sm3kTel}xt2by1My97V_v0=*szlTPgWptp;g@SV z+-XinQcH!tqs(u$Y$@%qD`irRIkyAtr@t0+<8*;LUdvl>i!k{+&MO~vZBd9}%qTF( zW1wso$d&XVa(%tm3|;Kl&SA;1Ig?BDLeUF&4m{L7(f(@zcIdBEceyz-9)5?!Ihs7g znyI>`+Tqp4g)t_nNAlxi6N@d-B4@gJ;`@6* zn+QA6N2fOQ1zM>@FrV)JkxyEw6Yu4$P@DUMSH%A4@N6_CNse4vSp(rto!<5?aM5$M zp7Gdoq6lVA-L9*_`SCPbPXM@*cxmBwbY-rgm*yrj%o0kcw*gBPnk%`wl|MV z`IWIXZWmXJMk!4BC80&)$x(169$Ov-1l(a_of7 zjSVhM;5wgU2dW0k)lNZ@yqAUmI|w^?bAZBuV2j>QIeDY@(che}%21k`ToM&dwc z5Cub&i%U_euwXueRF_V?qtaUw5XHZuZJark2_!jwgU$Y(X|%I|nM@|+L`n+8L_1+3 zwcX3E76kr^no0!FQ5aD zpgeb~vlckTo&LCq#Ekf9uV`ucy!Uiij``V+f6XWxMW zzyE3qZ*d>}8~Tj#ae|U*f*2Mi=va0L{*`H<2GoY(*lxna9E-6LCj=g-v^##Y6!T!} z*tUOcN)T042|RFfC;U6ad)maLcBj33Jq)$ks>aWI ziIAz{t1<2j(R1z(yEI?^`4ly$cLtC*&lKKMzWO)wFlGusL5GfSW4sHNbZaKdQobZM z>yauthXWSXQFGb6TBHz*+!6HWR@{LTQ1B7w`$Kj zcv7%9dxea(G58at#}mUlMK;^`??faVS4V@B<2Q|B6*IcFewrP=ojDeFBMu~z%2FLI z67D< zh;O7SpJ?E8WF}0Oo5wf$rSP&DPt{K#WkrS((uA<^ zN|eJl=bQTT^!!Sgq|=V4E3;hxrLV`vxapfJQYgB93fJ^nIZjl_zM&el zV;T`D9c(B!#EQ${vwrcFhr>Zfeg4-1JcF9m*#Jx`#Lu=w!)l#df_##ld;~zvi9MH( zZ>zu$CL%qiQ)4|A;W1`W&Kshilb?9M`xo z%#GeZ%|yekEg!^M!5+=R^G%1}vU?>v{m``zT709D&X!a(2g_4F2Hs%pPIGFWI;kxC zg$YwWS*6uyPQ>&n@0BNK|7tdkE$o(g?{J#`+rOOTgJs0)f8zJ3w|2Fu%6D)*(ai$B zH9rmIVvZ$#1>lN?_#h=WW~=%U15K_}PkG3LF*8ar3XV`$?K!D!Il|WF5mHL01gG2| z`f2~7dfN3NMt=VQmD28MR7xCBIuurL(Qph|(4b~qe#0Jchjro9G*G#1OI%Pm6u$#i)7ZV#?Dj4A81TzHlJ^d^-+ zw%}mE5vbQ*F8*Uke6+DJfr@sTOam^VzHzLroNxBmMoz%UrInaq5w7sq+v1G+Ft-eB z1$;DW|N6CV11QxEomdWBCVWQApcS+Q2ER*4paqx-mU)#{br=i_cl|?LY>7V(sHc3- zDlzn&&RZ0|j_i9rx)Kq^|J0W4cj5;e6LP#1NnThI0W(wls{$O|h0M!jM8)?CQ59`vr;?P;yS`3##a3y;{OCW}zYWF|o9##`U9k(8aQv_=Ut^6W_E zo)K{ahp0VjfWWj(mydkEW+}5i<{w(33&u zY^i?KcNMv>^Cf44Iqe9#H~|2Fo0mUdCv!`?mo<3pjKy&}q(64dPT@J9qy1%>D-qpl zI}X8A06EE#AJ1Gh*5YR7SLn-_J#0>Cfc|`LEDT+-V2+ z^=d-M9Pv-~{PNE!hY=~h5a~m_hTpZB7Sg%3Fc)(vTtME+zvggB&0quU50>;$NO3+m z^jJMbd32j=mz(}q2eYv)a1b0`_=qp%oNiHZbMx7W#toZ};??tOe6c2&DApTbgK)Y7 z)<3_31UScXgpVu-`8Z%6Pi3{fp^KwcU}+kJM2}h1JuV*&!ugf!gJ`FC-^X>YeLa(F z@(gJvjyWh3=)iA(5-cM|sbCw9ID?YW%Pwi~@7khEmV{wbwaU7_Myn9eoVU8F+&wO4 z74e&SSr*}f>}5UxP#{E)_d3sl4Xo*UXrw zSwp4?)g8dB$hx#ZBlj{6H{^`7Pvtmyk`iS8dct%-Y+ zjotDRP%Uw&EPX?&Cg!TKQ$PXP8zgP|71$dU3Hf9_bL(&ig=&yyjUS+DQ8Fik< z4!OR#rJ%nCm6c&!?X747eL?Xl+wr|7&oMukYajZ@1AKm*meIdUS{s0UYB^Y0KjY&T zmr|yK6ONp)pD%pU{62hb9`G?>NYLY<^IRMdAFQN|(bie!samTy_DnVN%sz76EBKzc z)G-k(N|hRWi`nngA*GS9{88|&=&IhXbZ*LTc!q?O1rqA)p~}m9c*gnk)x_jR(=}8> z3Z?&l03bo%zN{Yl<%2w_Ne2(|WNJW#bbRG1qg#mm2@nd(-zc}S(bvaJ?nVWiNC4SR zltc1&V??1S9nC3n^Os+wjSa|HG)BPMoIDnEex);?SLq~I&hmt(ZBs}`vw#Ldu%I~R ztc|L$igKRkse8IpVOKhf8I?{_)@wnoRSz2vDFMc_Z!>BjjSh-hrHlyN(9zY?P*WS% zPx2c@a<%&LnB#=JAy7Q)lFzJaSllm`d}H+1W7?KsxU6Ez7LAWEWo~-BN8M5M)Wr6$ zbgA09A>!3ADaCn;8DeErPZux|@=7RUti@iU32aZNnAV%cJ>QIyGMF5DmympYxQF9b znJd;`fDYSypZEOH8dS6ZTZS(ayN}mm(?N3pP`SQe*@5rSh!ymWUSjB=_YKi5AZLz=wgp?wDU z6_IxX{6(5+5L5?zK-4T`KgRqilF<{}&_pbRvCx>ZIU&(b-aMY~V{)j65iw)d z7thRL0Rst|$KV3Tw8-Cm`K)-^zI^@p#U+kUfRFdz;BV3Z@v*U(q(3izCpu{cTb(0% z>QLw@G(R8*^T8*y{efnxpqb)Xr#30gtQ%bHR%rVh{tfQ~dnNCsX~VlTY~<*~o0H(h zVP+I;p|tK+E&!}z7e9(V_#)cfs)cE2T8&-+U+dxT2j1{{x58?2r$_FfUL456>0L=) zY&%U*xD2kZKMa>oU)vf~b|Lget#@sca|eYK?MoFhfXjyaJB&Vn@p0x+F&csIZ%Vw$ z>&R_u`xyKV6+mppm%siB`YGQM+$P%q0Bv6i^;gZsP<-^5FB~4_lK1#WYX3VQWl_vS zS&%EI73XDG#jI^g0h5DUR@QaFk~+?L#&a0ZJ z2iM}^=e4S5YucAav&L}gdCT8II!|SL`}R=T_ea+aE|+5=Dd_9J%Hw!=s_J`oV3)I` z;tmT_(Ry-k1D@!Q#;@22*x{y=-WV&I2j0B?#F*H}=_CD;Qsnb-8pXVkY(DW5`&8iB zS+neSEraiY=uROYH^UKDkzh#**3-oqgRma@mW4DU-bnw!Z9O(Pq?iE?A!Ys6bMibk zQsP>`k zJRf3F%6ab*TEpkJr>`vgO@lEj=Zsl4aXR z_HD6}uKvIjI~Jw8)GH|KsuNk0vM5XuDIBtjmobZ*BrVc541G+Sg^e31X5a=$S-{uVs8Azn({Q6n@UNEkNb4^T2pRUOfeeDJx~U`>P!Zpu*&=>vT_wL z%V7880ZM%Y7waoxfd_&leO+8+N=7}sE=Gu;+b;p!tQJwRZO0ok22&W!=@<g`n_rH$}{KO;=@>V|d-v})_zbIYID@v0qXGv9xT%Ln% zoXBIb1qvn@Oqn-v)D{)5>fFuAS=dGCVn$J#l=W+oV^x|ggp_)Rus~n}ff=j{E)A*P z{qA`^X;yw}36XDbp(mLtuKi0a{hFRvocpY*t(REY8Yh+SUGi_xbWJJSInAo1&=LAJ zuY^mkoQG*zO1GYMY2323CV$WM;7U7AA*`8B7USG6No76pefjGQGQ@EH|N z!s@sxSQJUmK93uiI^@LN@xxxf#=;m90fKiJOP=r@14A)Qz6bT zW0dpC805-DRcBS%3f46l&;-Q|tJ9`saa4yz876s`xtm2xyNprJC}WVaeubbUefa`X z@TzS!Wbox(3?r0_{uzvi5r!Y3t=zCfKj!Hv*U5w5=w zI&coDBq?-+4$SL;Bv&@UGfO&PUe18jB^D`*MUqER(`04sc6>`aQ(n%BjjOaN=mZ4Mmtp-U>|@K#ClpM)Ok3L;xMkeF3s}P zOsq4}aeDhrY6(9E&)2 zn)B1R<-9a5xpLT6Ny?K{?k{o9q>K*!}W2Np--I1b|_nY{Ar~nud%rb6M-j@7y(w^w+ht!9)28WLcPaAuS?6+I)|p(n=50~}cR-dj z4REsxR<(=-}pWfV=&rYN_cYd@ic=M0h}g^p0dc}Z(>jU7hO?T!ozr1+DYqjM$(#;^(*1Y^Q1_LH+MboNhs6`ZmP@Rn^-Oxk~)c2 zO{E^T=-J=*tyog~>oF^sVN~`-F$F&LGUIg79bdvsQT?GU%#7_8-!El^ISiNxe+^Jd zn7Oy*OM%_?2)NvC`qeF=ztsIX+{N=#;N`p&IJt7w$qlqjOBQEBYHyT=tZtH+#YI+% zTnO+bo!VR3De!7W3Y?VnYA-3Nwyx{fj(wDr)$GMLI(AU~@-21?05ssR&XQOAD9>j& zqYsfem_~$=gG0Bcz8tyKa09-6ZOAVM6Vb4zcQp}LJh|A*;F|c$<+D}voe4cXSKl}c z_gZqau*(j3E88rV zOKScStp$#gjTG|l4b{9N2e~p&3z4>wV0B$oGEV3!R(EB=@=8Qu64yoCx#NV&E^<^e ziX5b@e{XQKCh5K5cq&BlVtTW<8cAu?HHnjryv$P--{+}P2+>+y86t(rzvGj(B1Y+f zF9+2nIPv5dK|njfr4;Z06rHP?W15Q2>Y@V=Z@TlJHPsuFuXxcg!^}G&TepvE`6k$EoaBNf|IN+Wfpdzs6ZHaYKe*95wlu|?M;lCb2XxKC6b3O7;G13#xOObQ*bCCqEw@`)esIw*t| zYY>^tR2vuav@!Ue*+#x;YImTXzD<)VDtXD8779vLEgh3wIu1osmvNe~PO_5(Lx?i;bf{w$asa`ky^>mP!Pt2Z|{FR&SzXZF?rL4OkNh;Kgt#ju;CH8l#8j^lqi@ z4Ew?d)g!iBp&mb9&9t>^)?by{9i)qZ?fo5W7JNMP7pqnOpgB+eLr2bsOBoi?;8+A% zXdr9d13Q;c!~vsMgm(kZFQnt9+ow$Zobo>@bcCtT>wNQxyG&hf$@6O zjj01^U+*^jUf@{Lg=XItE2i7)`%MEZADgK`ei}Wl)&xxV0OZdq6*uPZU_G&VSZw+g z-WFv}=XBVSLPwa>ys42sabr%m^7Px)XhrzNy#gzls0IjgpdL$Vd?u=@WqF*+Sekc& zRZ&|p5f!{`vN9}uv9yh`sAga+NLjzbOi6m|ff6%;G=Jt7YqFIwR+MK(ND}UDfUaziNHqf_LdyDeoRaj1f|TS}q4~w@Y5L8icTx*6 zyMbTXAPvtzkk^$AcPxFz7MWkRLMs8dfm2d?jRz1htS3+|7x{h}yx=0e6r> z9tHg55N*=B6j4-2y$NfUwsp(6$U;`sP1bR#T$N{XZe^o0su}1EQr53Ql;l`6`1cP_ z3C=tlD0M~SMo$#(NLt1>?U*mG#rB&Jt0(-OitAI?uYTBKqw_OSD2QQx;t768DxdTT zpgtbl!RN7IZ1U-+n;Gj4E2Q8%bR&Dc){3Ba#!|XCeyB6HQ z$j~p^Y~>9h%?sFJU-wPF)@4j}&)d7jre$jmBwgT&e}gPVhX;dDF`QMo#8ZPZ%+rUE zk|IZ(3p3y@AN=A+#VIOLspxf>DWkHfjLIhV4zsB-vzbz93hIs2c^0K{(y%hiVwT2j z&3Kk(ENkj4Y(n|V!n51hFq~=z42P8U?>3aAXGR+lo;cp7W4JlMyQC$(~#>RT0;Z$hR z`u8bK*Gt|Ai?<1Pol|Z@v5)Rnprd;nsc>iLi9#t8&T`6<&*^_9g^sZ08Q`A}e({rX z4i@2#{PLKsE==xmD zCqHK!>-pFrTGnr@Bu?jzG0&^N{7RT7y{hr3f0uFL1A+wfU}o*+He$1tx&)t*N1{~p zjQ~H}MApH7CY-u-;zQSiA zHqSQD=NqPp16R_slLxr=*2H(5)O(2`4-sWSxHLs!*RP*m3LUsXdvLIyOhm8;N238d zwc~P>DxZM^p@ojn=2;El^vYq@MNudfInF}q=Y-In74wMId69A%%!syjvTWsHVr%pH za12`3ug#PsYO@z|4mwwiyI@<-zCeZUn9yL8h5;|C3b(FPN-LI; z8pFZe>~7sKo6i4LtPxG!Ba`PDqE8qM<&jU$2}2^03rUhibyu()Nb1tOg)&XivbJmF zIRON;sk2OzhpBBy=OY(rS-&Bj+Eq_Wd{U127!BLmx2=UBksvpDa_ZT(#WW%@l8an7ZF3zlVJDczwEW_x8R ztCB92=SP@^jT5nxhncPS=U3}#S-;*>l0GMh9C|Ai_sx6h4x7}iafY7yDi^TA3vC9F zPX{=xG?XoP;PCY=`Fg_A;w3fIMgB`WFK`LM9!@41phb?bhgsEiulNZ`V72vk03y1_ z`spCI_d#y#wSlkjO>?(^Nxtxd0llAS5!9Q?vpnj`v|veF!zjoO_*KG?WxP$Aq)wBZ zdt9pAwuti!_Oz_uA}C4C&Sd3`4wDShSAZJHUP%OY{i*Z=nVn~;RR!YKD*y6{c!SBH zL3e$jv5cq9>NWtR(uOa`Z+YZ8|MlaT>>00&No?@>V36JK@P~2QvB?XAau~=u$SSza zXWj@v+D+5b`;~p^;G(nR8@NGCECZ3^`_EWddVQ^`RZTB7Tb_b1VI2*uk*4#4I`pU) z?J)8)5da^Q=zqad4gE-AoRy+YLe>eGJ(;8(D~q~fS=m*PE-FRnEY;*;VO!(*&;nZ4 zZ;h0svs6Qiy)k)F#5g}ePAhn+ERPX{|w~+ znryKytoFUtrVS#$i8{Dm3~Ly5K$TJHSLiUVv#Bdkbj}It5&wsmUSeiIqR(ZX`=uJr zs88f)*F5bore1oPgke)l^DpweW@%Watd8QGg>74Q@UMz{+|$xF|MPJnw5;F!Ny-ej z`Mc&a-)MWmoP_~sSQV4;>qnf>*w;DsJ)7Az*wUqOrkCa)1~~D~eEN<0G+b*0v6@Ta z74Q(fe0G-h`-li-#0sAA{^uKDPui+FPH?kZXdwEpa-FTT@%PeBZeVod*n&2$NZ9(x zkO^Ak2wR^8ned9AYwH}15W*AOdl_Fnw)KgQG0C`{r(xVh5o;Rhh^KLrFdla~YjObp zmAuXhPffM5ZSj261TE{gMG`e(r5PPwF*!wA6&CeaRim+cCmkG&YDOttp9G(FxHH|* zCOe7nCa`jqW#5OLUh44`_xI5CWi1%UqY+B1*cxiP=zBog5zm0ASgxDAETZqR|9Z=t z-x0Q@9AgCtG2=7n#{qa3VX!BYqR=8o80;)ugjf6@?>G}ij0^uEx%xx=PX6D4<>hbx z%GqDn^1tRrt8uh2bb2X37SYM1}J{I?!LER4BU7s&2F<% zL)MJX^8EJpy%^O(h7f52((JwiU~K4-rs3)HQTqTnNPyl4&WD{uvxr^1;{Qayo_r}$ zS0qJLRIC(5$5Ih-#*?sNBICI{jgzp7oy?edWFumt8HgBC)^GJrL=5`$ALNGknlFKJ z;1DC*JI6&n!r=7h=6IA1Uci>{;*cTe&YpmeWu^C@VZOme^-x3m&NCAUwEe=v1m z8CJUH?NTMBsVgp*I-%CUiSjb|c?I+{Fy{_j_*J83Pz?%^sn}Go@w+xlt*sRK-mvGF z!EdUo4i)jqD7`zY%LGu>y0t=$r?)SEabrHV|AaSx`GrcLli!+Se>fk=6U`!Y@rwVK zf>+b;i5F#^v`NI0s0dk_b}_57wqSV{@wn>Jrs;iPxgj9e^4Wr+m`q-r-_zwzR5uN(uQjfYNI<*UUT!K1Q$?j9r&U$UQib-|mF2 z@tCDBL>&20_I+i6*b1l_Kb=5Foe!s@ib#}MXT$R~apuFe#?nRW-*J+yDF#NIb} zqWw^>rb&yYNxOt~QJAqbi(xcTCRkM`VNoY#mV1Cikqsn@W&nvuS-<^whG0+5B$Xg0 zub{E0-(ZqEP~}38H(18L`5*M45c zF$sKNTI5>u6#e>fxO`@cPk*HbL5{BGbgPtYo{n%LMUJq|Sz}b_l}qUWmY$5;-Z$WP$xV`hm9DDW*~-0S-)@%n2dI=I#8j!MWdKlrP?ue7g8tj;x&9Jrc{(PC6gfgI zXRva7@QeTRj|}S7G_?q`x)v-Bt5!x4RVcl^v|vS1rg7RvQC>J{L-NSR_CzzVJ*2GP zZcZH$PD}j9$jYGIpu_IZFoJOoI!M@;yjvj=n~A^IoBsRa9{!53H6)P&O2;+1FQ35+ zLJJ*X0`rhFK5>7~qYRZ_jiK_Z@qMxJeX%h~ODH+@@Le2-Q5c4-4O4kIggj@ws5onj zrftHgPTSHs?L3cc1WPmn!9vRVmE5ta<2)dx3`*1R4?g!QOxDQI1Fv@XH2_Kgkp^9m zEzSp3`Q_cZ#j>{fl^Fx@q$h3B+0hI#7OG zo*FhAnJKBTqS_;*BCmj&6*=CdCa)Ty_>>L#H1$*qoZq8-$cZyUU6ggrqnTO2riU0GDQ|i@Jd69~uf%CJHcbX_fY)aPdbq}~ z(|1Pe7b)V`uXxs=8hYidjXR#@4a;&4K}VUgvg`ya;vz|#w9IRte%Tm@cm~FSl=bTu zJzM68U6PbG8m23AT@TYI5%g=~ZNL#~qUdL_xG9TXK2QH@swTJ+@&OPV7tJ!r!$;{AtAPz(?;D0A?W#V;W~8H+L!1K}+^HpqOfm8`J_EJFUT%WpG0o+&L^5q|gy2H?Mf^6aQzL z9Q9H}o91hX1-o;fJu^f994>Qf72{nTon$Ro2S5G|mL8lel7{ zDC4#kZJ31~FUqcT$1^J3q^#dw$O#wTRt0*|-3s#}7H7X zb=-H%dsqyZrj>UC(|1Qs9>ins38+#JX6dOt;B!dMEd9_HeHV zcX#(}7+Uraowf~7FQZ7BmW!rgMO&mSE!&duFb!E*rco~Bkz18+ZqC>S1jI7{0i>*d z8*q|+>`#B7_X02VhwXwscPF1^;9y&@cLh@m*&{z3zvP#}O>YH5V}@ZYtxoNQu(JTT z$7(Y)z=bD+6Vx%hIpqA>JB75pM~w}l%QZb{$JZ9#?Uh=BMDj$v`XfRXP= z4jbA zm{HYm&G~$@<(n;&MufR*752%ko*cwWU)`CyIKP4&&#PdQD_3#WMqSykFzOPPa=AxV zX(QcT>H7M~&i-v7_g^*YTFrd=aAnG=R>cP@GMe5D959n5!KYm!r0e~w zpY18y5E;oon1MQ%BNN&RM_-Kj7JF#trM{Hhs22(f1epD%r$pqdqrQw%jEP@M7>5hvrWAc+hRbDTo4=ms0BaWt*PXuBn zIcRLzOs|smi)d;@i$>INY5H~3rgJ`cA(=NFgOsbvqUe$=VR2SPEEQ$V%A|~#kj{S6 zi8cx&&)H=o1dSA8}#CAR6U_c1hYgk(qRg&j*(|Vwii46=$W&i_7S&!9F zV#iqxCH>y)PBI|)*{J)C)a(6*T}5;X?8Ym;eB3UYA$SAot|*W3pTTG8WPtN@8NAjE ze2_m?j4bMN|1Q7N?FNJm-|L(7jS3a?oX%?ep(8A41}fl_W91?X zc^&bZg$Z;FR#_`UYq^g%WffOV9fd{f*~jhDdorW+PRe>Tk`!~RBH31cNEJuwZ3dop z8+;Qrp_%U%{bn&L7Eo&c_{;lgys}H9s5^3M)cKY0WL_oQC;oTZlS{cLi%lcXJO*u6 zw*dMyBP%d{%32e7>;qH?JD}cI5@%dwaVEduBn5vaXFL-zi=%`$qNwXA_Uz1dy*!yw zFDGR^cHk_Q({@0K{qyXAx+A9@oIk)J`FnPI(~6v*sK_0>KthSBhpj}Nr7dq+QRWb9 zMh&ZqgtIQG>o82Zrt&a`BzCnonNjT}Wj#uK-dqP#%ur1(4k_~!g|r7Oz^9Nd4rta_ zhFy?lj@Y~Bl~8@+|3&w1x*@#Ei(GUplnM^57cJv;9LWtl%fhq?n=*FO zs3&&eG?`I2C1pKo@0(}f7*wb1tQh>J$)Ni*iDn&PhDrWe_ zfF%pvO=>C!C?r?%nKkupoo0Pzef5J9{r|x(tAloV$RgGB8V0cw>sN$XQqLPFQ5kWb zvZ#PTLwS|53TA(CQM5&y0tZ~-HcPvzo6M-{lCmDNB*l&}OG@_tnB{!4Jg2Np3LSCU z&MRw^E9XsFH+7dXr0hxaumW=MkR_rjG-HpO$RxGP+Ubn4HYw{i5L(RXu90H9`~AQKK8sfM8VQ9XZ`h@9q>x|X z(s^ZEa%G@@%G$hRyvn7cROMVMT$!<`?9vjuwM#cWRBD%T(-~!4Qr4qz=TXs@U$#@)Pa&7vA|;<7-C0Lpphr+1OCX$X&0BR~-kYyxbB{aF zrQBmg@Ls!HrucKCA%A&Tg%e#uDMIN!L$#T|J zaal!W6-t-Ut$cRnFr863BxOCyM~b<%juHcP**~kW!DKwGG`r~H_HH|}ohlBxLnTJ& z3^*J?|yEK(tlt~h6n$WpnL)j6x{yk>RBqpWVruJCk& zr*=gxol#LEWj)$7tD;6qD|Xx;Hp0qpz5e=n0!qUk1_d_bYiqSLBNX8C@6FB!{ulgH zm!r+Db@Be{<^?q(5j{9a=!lh7o%38$mE^|VcXHaccYuykP;2d~nL(?1M}Ap#bS-{>fsXd=z*~@3G)!!7a25;-WvOXeb`YuIY$&|cvjr%_ zJEw3+3LRm1^9qOL%2`##Q3%+Nstj4$HIQ$U)|bU8&v=%Hjc0aYY8MXE8HGbq)?;|* z6%I+UgTACRIYJH2srHdVN2tL(re<wiu zT{lZ-)Xhj)j~aMrnmyV;md_6Czc)MF%-(TGu-OR{^%2-yrp-p<|68@s;HCmYUgQT~ z2EVCZ%l+-|5;iFC6nNVPEAcH5_do_B6v@<~^~WA=GtE{;(~pKiR8c(dbULcvt&p@~ za#Dkz5rqdL7K&BLK9l-rQk6lHXK?hWkvY#19%FCqf$le06bQAxL7OY9dGou;8;N_q zSdL?P4n8fl8=q5bB!!MJ!x^oopByWPQ5QvZAw#&b1&+TAoa!QHX)Btj;&qz{Pef-| z{?ZwhKT`H*MOk*ZhxM&P5WoG;y;PD%ZH~ucPRUCOjnWg}<#T}TeVnkSKPu)wSZ`t5 zj(EH6W>F0+xmdmkng zpL$I|E?9;!5E}rzI!X&Te<~)jL>^2{1IRkJ;@h>qbVluul=UjUyJzxPU8k;Mat<(% zScZ_W!^o)TJLW}S#c~-WMua+F!${A2>y;3kmCJ#XV zYQ$+v>)10FqOX{IM+R8R0PDxn8m1A3(nQ)SYqPW|0P5#95xWkT&ZxtYvR)G*D{;qK z2XTSm`~C7?hBa@*pa1(>zHum0{rCUt1N6>7!-{=*oXQJ(Td-R#R0A3Oh?D@k&D3{b z`E`ol7+E^)3jwRF)mIh>>C)ZE>(%}D%dy4h5?Ox&!h}vICMHFWFrj&azJ20n@_+A{ z#A&QK8s z+5kuqzX4?PMp^sB{bz^*O--FUc-U@UO^2@j#GY5BGi3}1BoLNBz7&IbWnIx!(z)tF z=~qQCiz(qe$*S0gsmkn9VK$>wNXmLG!LcZz_LKySb@+GGc|cYmc;U<2o3HrOIG5GT zw3e>Y!$QX2lUt1(1#&ySd)RwGEyR;D^&!fhjlgaEtXEvkINy>Wl+p#F2%yeVqpynZ{Z{DK7f;x=g zFsyOF)Ze72+9SZK3lxA>wn}SG9`v5CKD`Srar8nUwhg6Kr;q(5MUK#_c`c7V@fmUF z{Q}bg+GPNCP8o0j{1dRDh76tQ*L#v*O};LXi#W`qf+cyGvy^u!tBNXOU0Ed=Z@D}H z+#zUYS81~uRa#QkYYLR0Vv+c&1}LjM;>Hn)lGho7PBS<}_qK2OEjkWJECEo<+kT^S zWqS?pstF$b?0*SfFP6)%{bg_sJo#I+mkW7~u_f{s8N$A}4BlE%=*8!eSOQ2fkP_os z-qW&Q!{6nnzXJE`1@!X3zb=C-t3?@p^J4#3KYv@nr{rb-Dw^#lseY6*e@;o16gt8* z=P@k%#Q*VK`Q)>wB1+0gy6J$uW@*GZtD+)habBfK*OdUhcH5aPm z>Tg#K{OScnE?fS)u*(g|AExC7Ee8Z%T1F8QkFx^QeNFSWp9RgM92|)wKt~28@JTgzZMwb*hLT_f2 ze?K`^PUAKyV(C8cgcmH$+74!~=PZhfL=-ZXtvs{WGrOXi&8Vo7vi^;glAK0b5voJ- z&*IcSH5G80v;K4tB?h$i04qI(^6h5S~P&ugtDSFVdN z%cHzxc~n7HQxY?tMJa3Ax{lkdshZ4P>0?9e!Sgr*iW~4g!egpsmi#>ICv-JvdI8-5{?iPhzmnjkw(b zGyfXAdjL!ms&`H|CndhOE>k~i8TlrmxHG|OqS$c-4x8I)TuaK`LZ6oYDW-ugL zMibI$sc=kmnTBO2a7MJ-F6<(2KBLG>%6jdBEb_XK8G1eKbXWiZ>=oeyjD8sJW}lqs z18mU^Uke+neDQ&Q9!W_V;X|e3#sDR^Y{dfsvp-@6rWrS`chC92l zm9iV^!ALKNlsLj@<}v8{#AnQF+lc#qD=cL5i55e>lS0!%NMosMmWn)Nye&BkEm{b- z#n@%zd`8)rl=WH+*<9MM7E&pthxYFuylxtGk?CO3mzx^0r(Q-G>*_x~AI3D&mtP*3 zjC=FT&0A~oIx^V(`v+qZFUA>hRuU2tl~d!R@7Bf%3^)2$=3u1E?VL_sQs@Yan^(B@ ziO(uC=?_PQ<7u3qOes@J5f*CIV##-m~S zhaixb!fB=8r@j5Y6|2GUT_dG6Jl4y@f7=0_H5^`i0PwqL$GB*Wc)&Xh^p|TU2?iIx zetcnd2+M0v+OaoNSf%HndVqrzwezW9Q>Nn#hOAmc7w&~32$tc|xP92Uz6J&-AYnJ$ z_--Y4f#u_5{LdbeGHvQr(g|Zy~LNk-zV;}L;Rh_p74#_N8!~lxz}q7Ef!_BW!W|Pd`3;4l=WH`S^YI9zK0Bro}yb}_7%F!xX|HeH#6so~VCDGc57Y^fvdoa#9#bc8X@o8{{hH^wCGh$$JE%uBn&gn{(g!59-yO-%9pf1k0avXSbW?cyf;l62l#C; z!fz>~I;XRo6gtAF=0OX{l?#CX0{Axv@Ne3cQX4bgGQ|IC?4ny6ZD>J016n}Jex9NL zLLL7u-P+_;5GNob9MdPX*JiQ72+M5JSmzuS=~+7@yi6Yw~04u;K{ z%PASK0PCYN@=}wBbkc*+&(k})Ns%M8b6(ZoCvLXKN4{qxr_J*^+(9w`?Ydvrqt>_jjMQ@|1(XLvqdS>65PK_yd zPubl$M98Gj5tcWv5!@$!0&res4Zexxl8teUXssp}!q}*1Pot2xjdZlyI+ey2ryb*Y zld>=qO)HA5$ztI&w!#KQ6f-~(q^z69iWHkt?wFqzOJBr7UTGpY+ui}slR?yj&h8=T zC$=ZE=9vB-6Jok#wHT&99m?4o7!L+37|6@dukV1hr$Kfsbt{7zf7kDn$=9aQW!c{@ znrHElbiM`22}Qq3hgFe6eyb|xb(j0ZPs+>5uw=!?&#*y%e{6CIPEW*?xC4%oC*vSZaOs=z-g$xNF4wzR&wKkmQ5Elj(i}e z(VP#aDCU7FeBvh=4Touje-k+Rd0>hIkJY>OR%}gW3WuhjTPh}BQ&vkTeQ$;ssbM+ZXFetNqg@OfarYY| zYQT{u%XBD1OX%D=7ywe}2(_Ds0q}{>K;7t3@+WSf)SCzkX#{PSu%v|;J84T+7J{=p ziRz+gc_srsw;9-#{bELCpOp1)pd{}&CZxPEHYxx1J4~2Hw6aoY(=OXBmSWE{7vE)U zvPJBsbR%wM5H_glxb!U+4~xwXnbYKs8cb8G!vlq1O*H zvttxJ-o=Cb()*3dSV6H;rOBX`MM#TWj!iQH9s`T<@b;f{;^@}GQHuukalFGU)_9sp>Q2ic}>6d6f~+_>Q0Yf@KgiH8*^@W=a+zsc_m<<_$gV* z_Fn!7PTx~Z#Tc5)KPXS;L=T2~JzdMYI_ff(2qB~glckK8O~qPKmr-1Zy7470?E-Hx zqrgkb`YnO1@cL20r0hHGWRC?h(;{eC4*0lftD*p+d{tEk^DcKl8iM=@3x2zTYT04` z#Img4G#(Xe5d(w?kJ7Y$`|?5qq7+^V!i5LE+@Zf@jfhgUH?b1Fi-C9Xq+yA+^|ET4j`a15bn@ z4D1^40Yq;>(qmYV$ILk;Yf|WlO<*1wx=-A-3H+6_zpgdu*3*iF_95AV^Wl}HKTH5y z6c(-sgQs3ak~CSX$7dxh?ZTGTZ5FaTjKZ#ML=*cA-mak+GivChtT$;&wuzq-xKkJT zuNAnTUKuAvjxd6Gm2sc=X_W+39AZdkE$$Zso_%|VBE)nitcQ^v=6#=dG*a)YEvv4r z%9h26kWONqhKyISkO50uS4o~_J_3}&E}$1P3h1P)r=~|%&ux_N)q4HoZ!SY|O(GuD zh~Cx;B!2q(_46wn%Q7hDADi#zN4^!`_+#)8tH9r?w8ML_DuOtZ*bLDCT1T;h1COHo zB=6FBUYuXbF6Nc8ed4Eexd4V*Q|~cT*{*FMA?p?!`QDdHqOMK82ms;&c{v02a@Fh) zKwO60&YD5XX#=HQ*Dhz&wMkjuX+a8Jf4Z5xL%Kph%D-3J{gb|uABI3)7=5?wu;9QL>2BN=y8CulmHAt^S*p(qmbp} zNtakYAuO=~W;{)d^dNuiAYtoY7DS4IVO?5*aZEz6+Y^p0%)Is^%f6+ z8JKQd4V{IJuNGcXdh)e64exviKsgTr;1mDn7#=yYJ1(=bD@qoHSuMl9EM|4VE0)z^ zm!?Toq)F{IJiF9i&M5VhvfhF%DY_EJIT2n|1-g`a+IzkbgHGWf)eeoHrc;A>QCDA5hC;v$KnC?u4WdLC%f0;+BX zT-_|?5U3Sx%AiZj(1N&?)P^IJGvElMtk=7u1b_YQ>XRL=(R(~~1@NwZ)ggzxn8j>k zZ@My+Scz|!a(mv~DlTJvBIrXIV;3m{$?}yD-StyyhHH?3~|_@DrC)ESx(8a1Qc}+O5sffL$;n6{lxgS-l3ZvLXBIdLWSleypwh zHQ%)35j0jjtk*)hZ0BGTNTDOlaUKPMPuxEg!!U$=<172$jMwtT6V^&SuC&a$DcYDd zNea|fv0!Bvwem<2NmB~mHI3&;u>ld~3_t`a>$O(0v=1kWFAVacBBtp@roq^x4Dbwr zlWqtu4wd+llcYE1H9@1eyuyK;aZo*5HXd6kfa}mK*o73mI-pp6lW39x;hO8Y~;oUjpX z9d$Y50;qPYxMpP?6|9ubW0!?>l(!!Hwm~N443G&a>$PtZRWaH3{=rO`I&~fUJXY}b z;c&DxtbsdJS!XvTSD6%K;5fp;xHiUhvFgXeQlF79Ql6QfIde+>Kfhdm`G3LcaSPF% z4gCA!es@3aIJz-tz1!lta0hJLGmHg2W)phb_b1kZe_N?B;^b+2`TG6;wV8ke1sI6DCLp=3RD-=T73r)TU~z%-~*}z zW;{8h$GJHa(f;IE%b~>QgFwo8AP}GU>GV=&Gu}sk5S485!F4}q#ei^;rA^COS!5vt zCO05*gK73|RkhI^pT zP=mL00rm9Z@}$TS>N*dI;S>Mo?YSf*BW;jrkO9>oOT(gNRT5_mh|>&Q!>P!X4aulx zKr%>KpCXfjDx&aX*Xg^yTa1O0wwLNVqHw`?#?IQQp3;h?xJ4F#VOOujR!{p-H-Y&B zH3fP9Q|OwD?+a*vHXpb0ZT5h)m%-I`EA9aiJT1>5zZg99%iTRps9i3DjxUywVu0HO zpZ~sBn5fm^^@+6(8zcFqTs}Q1yyG3E>`NZ&4@hG_@KAaKX~;U@LHM6$gg{=g6E5c z!Zz6)p(ev8Eq_Z4mn9#{X+YVpDauEg9l^+`J0McV7ruX-20Pz7kk50lJSVHBl z;8w2}!`g6~Vj4=1&RlF-2HEgw@DO!Wor7H>WYMQ ziD>JtY?~zZoH{l*p_&0sAZ0z4MTzYr)!)d7{N1KsZLj;@H6xw8oOKYvWdgX4vNZso z8?-sXM-}2n7k6!3`k|68c0K7sNuN>H*@P_fdx=`g0?wgnAcc;wfO+T!pZMu#jSX2h zJq6S;Lp`?1J28m(fu6m9xwSciDGP?W-E9mu2%?$+f*@r*#z2W3YTG!<9Hch>N=Lhr&Zv0VIqxbdrh;u4y%MwD@$16Lr0jxf%7a0Q?Ee-Yy(=P&RU zsk9kzX|uG9B38vo#DD?bU<=*GX(JY@8Hfc^)(dhaC65LWl2`aY0K&gJfRKFGPWwI| za!}2K9QeflK0O~%$oBu%fe*u4>BA5PO}!9NB(0DKE6ckCXo(}~3ukf8gbWztNHlHR zx|{tg8*EU`02`39p3{~R!&nenC3kBBL>kKmpH&~yhsEl5msd<(`s>s^h+JLr%lsX$ zJB?JCznI#0t+R`HhXvA&UAbC__E|3J&5Jl1hdZzy}zSg${lsl+?j6; zlDXOw(&II-MMptQMvsWtkItbTA%%|EkLDppeBx(SFUOgQx}T3Jr3TcSCR@-daiZ5j zGLke|lJi8csD{eCC<|6)4QEj%+Bz-bENa{!lF9~=R5L&%q^#fTa8C7bf}%*#k6`l? zKY||9A-{_yR9B^`SlD8D;2Q(dw1qG_2B6M%Klszmo9ovfZ`@qw2AE4Vwl?GFgTPACfBC`Z#vCjxvsEKU{*rZzHxX}?0YT4rv|1BK)YG+ zMab`R6#wMv7<^i<|q}52&Bu z_Dwee-tqHE!cRV}?Rv6V%4E-BLLr5YFxq(l9G|$KIqTU$1}~kdmyWa1WUPc&83F%i zz;VbI1g&;342{7wG?u0^T(0t_WYB8|6SzelRxVpDLJN)qKb&i;w5-!s9b*5RymxJq z8%NS~|4N+NIXhKmLW#HoJ=?RUlIkLxx{cIbV`sjM@fK2SWoG0?WJ;y}^#=gS2zX?? zWCW?{Sv%)TcS#B-NYI_Y&OPPLrHmTyCo!f`X> zxtYyRtiiHVn?x*mLD7(rVQW5X?0Hk~s)>l(GM!!CTc+3sVZ@8|9Q z=5ME&W}nh2libG#3<2HUu%@t>PQ#RJJ@eMOlut9Xd>c0eksHGNEE+63Z3v@@G}r`? zSgb@B-^K0GCve=44Sh57xZ<;}3G}hZac2cFH72Ije2Na7x+`tmeZ`R8&q!IpLKkTM zqLh_M@ypLY59?+4{KhM-wz;i3Qzv znknwqv6#GN=?qHW3~F5WWv=`4^IWj(wC=+UnQ`48ufOs0FMrAEZ^W;77c1<``9}TE zqj5d)9M^{9{%ExiKYKWAsE%=lE`*=zcCWtK#`A<}J9P*uq=tpQskM ztx4t9G(S-W%f>Efz>LO3E-J%@FOf{DJO58A4Ze>}&qxoEV@Ix`5aXB8lD+~B1BZ6F zLls1_5j(ov4`+O1i<7i|kyF4`TbB{3`VC)f@f(}4ZNlQ0I*4`KxLC+-zmFlk!%5~7 zr+gId?<-PTcgQCg_nSji@NR7!4oAd0>79w)a(O6AISdfP3HRl$?;AI=6`gWo;CD0f z8JL}tlSG$%1{RkU`Fnf@U`CG7wX-hy85Ijw-!d;67uHxSy)??p^~9p8^UuKij2tXG zy{L|idV#+Y%fDXtMnGMO$tZu^+&%uWdiR*xXm=-`qP29k{jBc@e`q4y{dzE!XeGDp zLsuZ=>&^WK_4Px2{~xIo>qB{azh8CU$7oXpvJrICBQ`QSGbV{Hv60W38FL6xy)R=w z(PR^C86F@Q!>6XY(&vCCMHQm-P8rr{uDhCVWh|^!H?k;$ zZC&Bhe#yzIp7y)YVWEjN|45bN^fzDbzv`>?Y`caE-2hLViXD!uzWn*^_g_8hLTO#0 zo!i^TyJ7v>_Vw#xFX3Sa(6#00i-dGVeD02GH89*6NiSIF0@GcP^z!q_$j)k~t+z~T z&6$dQ@T$s&b%hQkY-)0 zDqTAdQT_H4^etRnx&n(_pd$+s5q=&SdA-(LnyO(4|Ts z%XMUaa39N#=*VYiG=eWOXbI^ua>%Pawi|iYCk!4!g|YuR&>48cV_%lp0sADnL~GE< zb-8X@;lrn-DA!?QS~twux?sgxc;6VgE?PIPH9psx`2lb&J8{Mx3sT*|YJ=o^wMhw4 zSxcIJ8BE`sw;hZAIF$cC)RRMMb9KcAEOLR;EC?9?JTkHqjjdeMvPQ;FjVcS~WKl8c zT2Tar5oJAE{nYY263Z7vVxjDm(m=ssQ5s#3pmeV?eFLze*6#5rPsb*|{nW2dtNlY{ z_;;{J0v>7XI|GHLRfaE!c>X*xa_xi+m|HSYwXr9uC|PBkVkNIzSGKMQE7Z8kCB9S^jPQuommhi{CQ+# z;gzgR;}~xwk0&KOE1T9b>snI@({OLb{UtmP!0`nEI4C=*Gf42V&kQc$|3qWD)`o4< z=LpBXPnYa{;Si&`GC!`y7sS{dSW2OL?0ZvTR?FJFufMN;{;+}(Wow^%V`^&)%*9uDoJ z<3Gk=a?llca14(zswVT@-+Y<-drJKBVj;1L`1XFEDu&piuyUkg2!3F{ZtQy9DAtrb zY+`(@QY~%xTs5&okE%826JM&_wapi}wxR5_c8+?tv34S{%xm|wL2JrL9l&Wnq)&7y zM%_}CaxA`i@#{}**ZVa!Pk#RP?ThCxU;G7W@f=Su6uLl*7af0`6o>6hilPwCdc!5q zQ}jsTlgU*PzM?7~hfq#7tSlSBoGV1FT3Hv|j_YaeV&)56%use(PvM!egC{7W8dlgT zH}es{@($x!zv50oU%ve5Ez-jo$KJ5e1v@AtYQ(x)7i-5fZ^91Bx15zhZCF+5W^GHU z*KYJInB}>;?V%1S?> znz>J!FYrl2*=f~W=#+-?rxCCH!(+4AhV5L~*ugE_jDt#8=mLdX=68l8`_@;LsvT>+ zR9#QglFOQzwXJO}U0bQqJ|9-(erK`3?+j%p6$46+>%-K5M}>IbmNzl7A0J@fFG%qp z{^MnS%I!aX+T3lr-vFh7BaSHz6q;5VvCQ)fM_%*Ni?Y(p>%s>-)RsB3UbCtwn^qcL zO_W-(BKJIt1)gUpJDyuIHY8r)pw#QG{Bg`z{?r+*55%ruIH)+j{dy{8LJ7?8_&wHn+Dy zc~f=sda#_KtY51Ak!3w2vzX)Zhe8*a#j>L`Q{sbJ^oKGId(igo`Rymx|LybN@3tRr z+U8xGdRRR_9Gy(>iQTmy_an|7`0$1Enp<8l>tk1zu+FfuscKf3#+IrGyH!2f>)DDt z>L3Ua5I@OVwj|)Vz*~j`Bo!uOXy8qml&28A3q_}wWQr7kM z@$TVZNC#W%^ZLmUt0vXn8h+Qye!cqk?pVj5?5p#|E@fRz_3XI2*iOC6*6#}qr2_!n zFjc#bD%(BBkP;I3|J^1QA{cuPWRYklf83t?T)!TXxWF72oW%KgWMp2sN_y4CGW=n4 zUPd3Mmy!jVtF(}9S(M|{Ci0MsSP+tdvJG?{Uv{Jk}pJ zQ4kg3)8P0X6uCebmmLS05{I4%S#U4BN1h4zM7p%5EP_(kZ4+3cZP(0~O0sx{%Nr9< zM~)xl5_zaeEC@A0*$Ev-VuxH@lFKr&0HBL~dspv1-9HSzdYYNreMI-i+J%pCQ*`)U z-~F}iFA;Y*LpRq?U$0&?L3hJn#+r)HhE6W!p%`*zFxvyg#P#4WvF_r1nT~&@LT=w4 zum9y=UVZ!3lYLYwNEhuY47^IMOwym)Y%NK@8xoDO)QJ1 zO^JWD16T2E$<5zNHmJ#=xCO9KG$Zxe=%#fo<1*5IEKDAV-^ZhtRb9uj_Jv z3&L$scEUoT*kpnk6eYC;bJNO-nGG@F?zeCH0*b4j5&V1Ua4fm7nw)j{nhC)!q+u4HT19pHlVQ1Y@`x4vOoHw9CwmaJ5s zr_O1WYf2{7d_3^;=Z(bZYluyX);C zyoBB19P+Mhy6xJziT`0_oRLLi{t*?is8;5r_*FXFd9YYNTV3<;t}fv3?I-pjPVALB zjOL|oebvaSVnrPzqB6RS+e)yQI@q>l>@zl=ZYuJKs8|pYg|ZVm3>&QG?JVAW^WtUL z**#XV$l`rpqy?`j=$c(MjFWTwKmPLaU$SHCZw_U6@8f~~{bNGu^zfTP^zg`Vx&iZ{;ShB(jmBx%kW|Hdk2G!Lz+xGQv z12VCF_P}A&w%-h~k?s^@8mO;L(>LJw@@03vakbmtv?!Jf=Vx>|nIFp)%VN1x;#Zkw zSbcj_9O^Ci{^s447743!3g3!07^C1;GG(lZ$AS$ro>$7tR78K=BJ)77SP%$?vJ(~w zyTaxcIkCjR7bTH+-1NtFQwitT*7Bh%Ds%t1dv{du!`?4;O-d!^!zVT_ zL)*K&4^!M3cGqZD+vJVskwtJOkdZCqz8a9Ubfi)L*VliX+) zxTIud)fOz)_7jC~lrP59Z)G0+hYx>=vCND9W3lL)%bfzxf`+c+Rt%J0!8adIfgCC^ z9Bcm%mrE{7t4WR6VrH&>V9G0_5 zGewtq)wd@f$_%CmV~;Q0dXx5j|110j+l1G-xowBwWiT*c)-R)b78wY-lMw@%pC%xe zr3p-lU$vR*n`C~tB^$Xz(m)vmsn^mCBuKLmaZgW>} z?#r7z@DpBK-NjK;MnI}S*&Ygd(Tk*=RnJgxshD$?6bfBn0?QHyro{hi$sf+k;Du(< zF~*c=8&<|nbJAE79b?fiHf{lV`hi@KegI`BEMT;HB({Lj7OqeIU-vBu6{bIDypsOh zwRlA8e0_`_id>+~%VP9X;{V0U3~N624qO)fSxmLDggLJ`>sn0c*ael3D{~&HmkT2G zPbxr=dr1)5rA^&`*?{e2OunQu_4}I*ulTv8%wEp;)!=KNT zPJMhDru_Pti*wSFqT5lO{QTK!zfIBm+sA#Eds*HjpIOZPZy(-oo4%ppaB4Tk@!!7v zAw2^!KQucd<~Kh=FPBB=r^IJAd5N`#dt+Q?e=uZU)!sAy<8Bohq4p)2T$vE5zgcvyD-cNuk~_>4kp4*$>YsH)q|ma83+6-{b2vJ zHShj@`+HYA{BR>F;PPR+Nmtr5Y5zPR3fr|esg6${^#m4jeLesbxxhk}`6mzQKtn2$C*3m09ZXJ0tfLxFa0A(kv1D>kRd-neP z+l#3zPk5o%`)$hlM}?&xf+w|2Z!6B{%~EXJzosvgpVPP+}$XwTk6;Vwaevj()6hOUZ-uazT(D z%1&4c6eGbEbkGutzod0w1 z%svf=aNTioSxnS=8ri#UrvxWTx0Q$~k}P_sn3CEv=Y(e|b1Nop89Ux4PvsGIwIIR{ zWhXR#NwY{OJnW88pVTMkVGbLoF8QQ=h@gD<%j_urA(&CcBg6as5HugU4&^Np-al5S z&4Xf*^G*FeW^eZWAi4~&lrNT8CAZ(MouoBb-La)!@r+a7zeP$KF- zyYUt_-841FC%u2H!bBZr0a^O>!FwojfvGPG-cN~Nm&E@^Sjr9rbnHxjr8%Q}aklhA z)rtvS3#PbVvr?>!*lO9OQ?heYx)?Ei!at`I- z-TH2`-EE$Qo!Oyt`Zjv*9(J4RF?d+nk6L^0wJ*jaKq^lbPz#a;pzMToBC#iRu|~Y-@FIWN_BqW%+@H1;I#izN z2Rk_H4j^zerTYDLyKjd>W_^Rra<$uTV)31G%^0BlH)Q~Vu<_mn+Uxrd3L>8hY{jX@eww6^{y)l zl=k?+F5}Wn3VCnW{SnysDCi4uebELea>4guSsiaUa;|{o4DdU96<{x-khogQ0M~1Th^!&j@(vO2qz@7Wo+ci zYt70^wM?zK<4QW)>WOc7o>ZU~Bo#o}X~jd5`U0}Y;dWgc2OIHh1`-(|XhAo(`V)QEP$h<4L)UA}(O{^Pv)`MD* z^#En3&39x}V7W-*$2RWB!|L$eUtYvw24U1x4*u7h@>8|l{+`iJDk}9|8SAQ?yRRQc zMj6$S`MC&cS;tT~a#?xqrKnk?;&@oAVx@DONxRmqsf)VuuJ%gD*XRdD-3Pmo^m}O<#;mEBnq*k$Juu_(( z)(PghbgZ!LMS{K%;R>#8-GH4aAnd7eFWl_b>O5<9U$DQ?pxHFWU)~Z>h z-I3IJjr!>jj!I?UhaFBAmThm=?1$|>Zg^g2n)BxIE*&53%fSytbNl@q(5pGs)}hb^ zdbO*&}vgEGxtZqbD-+aAhm903lP345v+KBad87Q3xK=pzED3qPnDd<) z62;OmkHa6*7JJAP7~H0te&^pgPGbe9_vMGSEBOC=j8@j$`=gihx0v_vMB{+M&8cG! zg)UIIWvxr$$Yt9qZDh&Tjgw4CA3kKR63mFkG__u9F2?J*=sc#U7sT|S?6ks-j5-p? zgJQ4OeID4qw4c(UhkRk{j;*}?@kLad!w+JlE~Yg_f^0f%8k{cYZ~Oc4@zWJvy!vkS z>tQ<=hdrJ$JC>{*G`iUa#r^c~KC$yQGn4Fa%~8Gs_x_}1{8(@5&h2{4eT!bt=wj_W zubZxOV;C10#MOt8p~MB&u&j(Y99d}P-P#23ESq2rwkcVuWW{Pzx4f}s>8pv)ZysyY z3u0|hcG?=Q?(7OBjtF|w{;`P>x30c1(11C|aG}rzO0X;x1V@(6)v^_uwXP_bihT%u zvzBZv8&kHt&_y-gj8NyHAiW?I1ZAg{U}RLF1W4kb1ZTpNozuBnCzJQC&n|+lW;hCF zN+@!HhAfM4z>%9)mSw|R78J$B)1#hwV+^yB%epAEv1&XKM&}U@y&%E?Wv4Y{WK^Ib zNaCO&ueuTot5f$famc=UvpQ7Y21+s~9sz|eP?Kfx2skoty;7yp%-7O}y;W;j)fgW3 zRtm!8{kXO+(55qd#90?JOS36jiQ4`X{QB>r7_8%8Z-jn%Z-*#{UrmX18^Q~oiw zG1^D(dh9q9ee?Ur`hCo8=yG?vEJl)E^X%k=|?a#by(3nXU_7HRmL~2P-w1A_9m-BCBCIdmrx1;4 zA(FjnKm2iXa}##kcTL|uD5fREh*DD9O_x~TXZ8%ldAXL8w3}2!_z=ZKsyWA{4}~sJ z&SfrrII^uu)ks$`TgAE}rK?z3)RKwDwaV9=J3F!G&RzO?flD9CPAligsAGDG#Nq*m z`1wkS*@JuH_nT~HLw=!@arUm=2I{?k|EcqsbeZ8Pv2@iu?oN}$PU}KkqyFg=ooySC&d;gw3xzJw z`DH-~I5M~E%9&EIwo=i3T&lQ7P)v);i&B)_sd1e*c~HVE2ueWNNu7t1SCp5A*Ld}q zI+_ok*u$Ehsz-lHhm(f01Sh$godQ0@N+bJYTad1vLDL-_IvP^?q*rYhDk~edjVT1T zvEN5SZ{QkTKCBDx9yd+Ofjh6v@Zral8467+vso4kfg>BPj1zUqOk0HA#X9J*Ul)?q zVcW3|3hhfdq0D(K#4Lz~K-pmKFf*#YkVEAETS+nTFi(Apv<9+y4AGNZp zbN=kG)h+uk>a+Npl>U_^?mtWV*X?MBB0J$bpESGKe!NQue^P>Px@x-KUET-hW?MzG z2pgdIpIIlJcKFHm@gbg$jUW1C+bN?m7Px)vdd#JdcYlPgzs$2^Ri0RiVY}U;<_Ep{OOd02#fD#nCz&Mu$l;Fs|4JKGLf=Q8* zF}-4yvSl#S!nUU5wJye!YD^wbG7ADqP7}|eiWpQHu z+M(1zYC{lzIBa+9e`kqgvtS(piqESkWW zy5g)Z)+RdECG(}PnD_PCc<+syAW)NsnaqMP6O^4+!+BvQD3*VqGQDYzRb~2(e%y5r zP154trcXtWdgzPr!M=&UkJ#hv(^Y%!Tvw;QhF1r7pu`0_xGcB>N3N@N=}lFHUABt- zGtHX$lo(XB)`!oaE!=o|u*rivWY_A?a`WN3RvK$y& zgO)QtB4(CF#Nf!SGup?(__i%#iTq$gPPsbl@U`MiRaR!oa`K3nSr8F}veT9`)qHls za*#MRhq!mHA9wLk-_55XCwxc~-yV1SaR>eo2sYaVr*!iEyxwsiA1yLER-Vz8eNpcY zM|Zn@c6FeD&0Q0QeT)IQ|Kv?Fj2S}Zo*&FJ%Yu1uWTk7NTjAq6uul78R+fcg#oE=<9)tN9?UZff_YGOTDg(rw;zI@{SZiMQoqp^em&j6o;2P|1-iR*nM2j@ynpgG zeM{pZ*Mx~T;amIl>fA+xO>}K~!@m1yR8{-F3}51|2W;cJZ#YKx-L#1Hs$K&kFTGtevMV5-lh)e@wiMXRfmjXPV^EA zU0@f>qL*;wV$HRQhhZg;DXvXxnA4?Yji}?n^Rn=b9Jh-+dTAC!FQM$TU5qwXMJcXO zsy}vKK0a)3!{@m^92ttP>vFRjwEunlyCz(J^)~L#S8wBYdv`d(aXuXkj`{)*mp24| zynEl4HxKVWog8EeHW4;X!4MMECPnJM@#$E4^NiGd=>Q{acAj3Wchhv}o1SYADu1K-hm15dEY1eC8wsvCMlZQ>sg0Lx+owfiZNwz)E z5|H$vykzH;8;%NWSGR53SB^aDJFPQxJht@PPv;Uqz8@L(+f3id$g!d7Ll`bLQZ4U; z%HQucWjx$X?`gYxSKe*@mbO;^xWC{QpOnA+GTbz3#|m$I#8opt9&47xW8uiEaaNU9 zF;^MGlxPgAxDM3JMQKczA33h|c|6uEh{r2u-dg!)O!-#L+zB-QjDi-5Uo}jQ5`Q=bk|81(NpZ>KY zgmfgZ|6|(7_f_#yTsWl+|JJMaPn~M7UUmmwHy`?#?jcg_{n!5g1{#0;5iuxofyOV3 z#=?Dp$T0BjzOwF{!LPc!uHgM*J%%FFdTf^kV&TYD*r`ibOSTr?h5d@Cn3G1bdcAJB^_BJ$ zJ*sRTh_wp>u~2qek6}I3fBo^a<0#Z>bd6Wr#E@l-f+TQu5R8IKd!EmQF* zy6X?1o3*V~T}-VNc|6rFh^Io?X&Xb5DV6d<8-pb{M~(~h2Z(mV(azy`dUuQGxcqUqN$2r-^P1Y z=HNRNLyh`#2xFZc;QO%w5*{2%DIKc)ZTr?$>%)FysBkv8caAzsJUL%JHMM6?$oJ@^ zefHEop7oxfx0|5;Z~7WiUjhBUz7!@Dxj_4uMSJ1Mv3E{gh(N;LhyUTKjHNJZ)@rMo zx~>{;$5X~^9__UYqP&yPHJDo6WQ`Hx$Mee{K7~y-`|bI! z?>}v#kNo*>KgDJ*Uv&}Jn=nIf{_+b|(PI}xqGG^u;B!5_LLb^XRI!ZO9yVu(yZG|( z!@tCG8^5GhF5 zTh7(zLZL+5gS-syzK-A0H>o5{dHjyoyG`-{9hQ!Muhbhy?y{`=ivXKI6?h&h2>xyol2WvAqQ)S9ko(H{fC45s5_t5FFCPwMLf_G?JJHE z^DW{qVSzz*GN;TX6uQ7vmPM7}$gOEbVRXf0X-!xp){2!TY_wYErH?(SjTvuQW%H=A zT@Y1{xnw@h<16 z@5#|Vl*t?PwmK)orRE%ZNPey~m{T&Cv7 zw(YXmHXPYBvQk!;OxN)YOdYHI`>JBCQBC7~AzC+H+QsIvZMz`04P~co?~;z8zyM*l z(7xYHP>b7bJOXn}p%|Q`2jcEnJj;>j$6a;psfTkdIpY9J9SgTdRL?4<4`Y1!?{D6I zHI#Q73M%(2R|=&Jl||@YG96ida>Ra}+;m}?+SCu-R_+Ke>4;kFVzsFsZ_4OQe!P3w zrIV+J!~I?8|Md9KPz~o$dAjd(AB$K24LsHN@v(;9c;UlRrB6oqOYo>^F+QzFefGfj z|3v0I=Oi^0y1=5B#qQzA16Hx7t~gU`+c0m9XJxC6t4iq_HD15Y<*|FWAa)OBCoLLE zPFpk-jcwP0makrQiLN)>`u98+_mVSiC*28v72`YD$I9%TqwwS|&NanYy>D;s_lGDx zT%o!a2-zZ+wv{o68-8(I@Q!8ItH^+Ht9eMOM@t-h6u87eiD`py%aQ=#$WFIHaM`ek zWK0DpV=h1$^MT1sK(a_=;|7r@0k{Q808n>9tKsxt^@$|prlvOiKXsh~`jgUK z##etR@Zf7W9u15&bdjQ?hro(HKN9bjMdIPegIj?`pkgW@6)OW$F%yU?0#)RxaYfG~ z@oqsR9?DKDI&2p@t>{P;D0)14k8~Pc>YI36|ExNfvHeA}>5dt7$NCdtJRDEVJv%l^ z>Z0ej17jr%$X1~4;whOV`T+X28GjEuxVn!hl(@hSmc`%U$b-*-#dP(+G(5J;tvuse z2BcX#-_+wwte)ET{WlnS-3SD3@%cA>mE7BaA94@(v8=vad~v# zEr{+z*=d8h;2bzG7$o_6=yuwL-C1DPUCh*dzuomGCNkzf9{A`pa{HFI>2PXScQJak z`l?OG6WfPmD_~6Hi2>cH|G39@ID|acL7u(ab%hi98|oa)oe;dQXI<;RXg__}bnp;F z2LG_RY2US7hJF9w(NWUhMzpUi{`qw7POJ1l5V`u$IFz`+%$B7Qz>!7WC?o5NRaNbn zDr>J6dGX+AUojoZ2IEPP$w#eBJ{?H?if6?ccF?sTsg7Q<+I!N|H@Uti9u zb13Y~bsIy;eO3N`2D&xz%-Wi6FP4lbyMhyO)?y-Q_<8L0o17(goBPL`Lz-#!EXbU% zJ|+((E->e1xeah+QP<9KWm#bg8@HKtJSN|=Sp7}Arcv5Wm~)=n;1=XIK-pEW!&MjX7Lu_1zFO?a~kW9!cRJeho`VnNoE2+nW#A$$*B5E#`;T&m-NP zhp29zo)m}g>)Mj_YnLYNrn|qm40g@vhoJ4jd)6oV48HRxZ55BM_h+$J#7UKa*dL=0 z@{PI6LG{2jVJe)Fl%jy>O1GG6JvztZk-r6(=6`^#lnA9shxJ_NbD624uURCYM@ z5GDUPI^@^8@Z`J4I@a+*7Jqe42b8$L;+N%gz>$YVnnlwO`(&<|55~`Iu>Criezg2? zi_dd9+=84AC_8QOFsEa*@jMiZp{d-e(hBx2s9r4aQr|qLcu%%1ej0d6`@r6)*a7_F zb-=e^>{e2Zi}AZjVWE_%k$)}rr_JEQuTuJMRox=k35$%#RG>uW0wuC_fW$U1VnoDomCtiC+=AQ;C_An4Fzo)@i!qf)Vz0WB z2|xF(wT9&B7+~6Tg(1ESSKfcs6)*~$&?d%Vha)_+Ja5wen9@n|tbyXg*^3ot>KL&e z{DP@PKo*xiE*J66(y@oQR16DK9X{UC5t6oceI0|e_e}TxkJ-wV)fE0v-fWug=ue+o z)o(!Sz6bH@eHoh-gnRqYK0NeAHU_EW){jErhWc^3TExSAz283G1d*Hl_E0s7rf)^T zr*pY)%iEi{Jm;+!hv!AcdVQG!tW(pbx-69gj_fMVovUJ*;ZiYW>XwySh5t%z=0$2V zKW?gdDu-K;$^m7kP4((duu$S@x8R$!b@?G^VeA$RRAEjQ02I1F8J1-Mz>)d77VA1} zP};UMv9zOSm1{gJW!uz(yVgwP_4qssz%R%GfU=XyFgEIWWq=aDhBZ8W9#R#Emtp%G zzHl+^>?YQ74q9?v8{qZuhXIOA>w;ev0EZ)&RbgydhvnPHx>c1o%tEx-c>-&;=y%Yu`EN2&GXmzIpiyq!+^r@vm1eckR%;^{)MR$lMTL zuYTIZ#iu=4p*9cg?S3V{jxAkd$*8cDs_eI6e;R9sf4Xm*cHI{??EbFY@8i)#ef)92 z)NV0;zq#M9%<&)I#S`jrfsE(p_bdDLs!Kcx``>UC>i+64>yE#PLHqh4`$u3Ib55^A zp$lwdS1K+a32)wUFYYBO)#VHASD4}_vsHKS0DL$&W|ShWzl3fvbPo2l`EOxzGO<3 z(SNTkbK!$4R3n736JO6fn(P-ulcDUihQOFGsfG!ZWb8!su^H5_kGl_>_G5sBbkSA3 zYW#}yT??u{6xMw(qjx$UeoLR3zPWJ!@dUbbb-isUae*o=i?hO!O(Tj*o0@4;#xp^V zGv}){bB$|tt(~dt_?aM|$65V?I4hK$R;8<(sX~eGwlT0cD9$0Pa#il?_nR2nNo@g= zZ}m`2<)rMrbzD^Ow)am;N=b>7ghQ9oF-UiJO9)5^14yTUA|*&kH%NDPcSuTiOAP`; z{`Pq9Irp4f=iKKx_x|oZ&;7^Onzi5G&-$$I-ZO63j59C_l{kKHZD7WIRl#C{F8$6$ z-N|seh|PAkuG((4)k(MPJO6g|uVU^;q3V zcqxTfVHzSEE|Ur6Mv4@=Y}0Xmk78bIFspZ5Hm+eYr8OtT-d87eY(Tqp9Z`NzC1tQL z*h2uK3aJ$rSw^M8@EVVbL?Lbvr6;aeIO%&o5i02_)rMn7^Dbt{rnkOydOV4qScze>fBedXt3W_8KhL9%HxR z(wc?6>9f7CBrwc;YPHdB(Ve+YW6S5>E;k=Dq*Z(|_hS4lXUS8hna{98Wx&$YnFerq z*UAWuYQ1{UkA>ovNX~(hWVxBw7*_q*c_6@Hs90AQv)$Qlx`0)| z*&@s)WTe`>W#ZAGl1+cLk}}JQO=D>6yAG{&`_^4g)f>`tBVOK0W^gz&QfyauZv>sZ+@+q8+~RvslL zD8_hYvUeIU*)A6kwm(U2AapnAA*0`_c;{zidY(*Icett;ZA%kG(o%geGdO1HS%4A)Z z2HpgMo{H~*_i`9dIE}>{$K|>swo8;-+J0eJfMQK-C!ul(^f-f^Wps4T6v=C&O8FM| z2fKHKEHrKs*(|^Zd2}ziN*T!A9h}N{&d`m+1}X-oUfJMRa+_92%|{%Gx*rm4Vl`y~ zuT8oo=bwOAy!l3+oYbDM@mrD2-GhCOS{bx0H!pXCp5aIGVb$sjMY!F$X2r`T z99~7%Cl+s%N%!Z!NHrREhd!uc@4Z04Ei;M2IW<%k9~b z7x-B^oi>R;8}N2$KbJ2nxo(_|ww9d^o}GRWZenFov=NtjZ}tmotnr9z8~4M~O{|-0 zKu`AbM(Fi*E!AFmIDWKO^GKmsx06fZjNy|Bow>cv*R{=|sb5Pj#EM9#(nunjHII&P zy^UIg@0@>ahSo0oR9{j1^JEA<9?ykE7`F_aU`dydjRt+^*00@FXmTxLNq#+Ds77R? zSv-HTsk#wiT;6tqWdW+T2A*kpDD+5<4;LT28$W5ha=f-z2R(Fe{V8Cw*xT7&RokDz zFz3tu_UPXF*LkmT?p(?Z2LxBgH@&aw?xRJE2_M7|Lp`LxJm+o4j0`X0L?ENiy3NG2 z0pom_Afn_U7BQArJJ6hO$vLWci1BqnGOw&%2eDT^%a7XZT_)R~jW_RSZ|RS+zZ47$ zTa(~ap)Iz5JRfp>8fw92&UZTZBK+4h*GQ208&=`M7$=s40W-`T^$OCT(`yokV#HVm zeSo%S$-AfGA*0Q!{>b4B{a*1EI$LVNw2c*ZlMQ;69sL2QzdjGSFLOMV=y$PA;57

#6HJ zU{|m~ZR@WB-!i=x=%?nlyto;?aLw@9fLjP8R;W^ERCrl(5{*?@+f5HJ8H-j`KCW)z{~t?S1jIGYLZDCvPO&u4vtv z>OE4waX7yo{pQTeb!0Zjw=B#SSKqtZC(pbXH0)6lUWV6ZU?)M+B=zJ~>|w^%*^`B+ z&8d$!Rbn*#(BXvECs7I70l3C*&4*Kt-jfV^9Xo8~&|fC^c^@MYGb9vd?*z;+FgEn$ z$O#DYA<&mc(}XbFAg^KF-q-Q0eDsJYW`VxPH`V1pifF3hNq^+dA=Xxb?-WjKcubas zI>YCCCd~X5zvgkde1Cn`QK^)@-CSJnzBhuClvr9;*wdD)KFk+jE8yv@xY8#-NGcG8 zrijAg#;N^v9JN&SwR8BYmJv45))IM=M3(T)K_5J{Ea(~}yI2<`lp0Q;R`1V7Y&PgCB{&uwBl<(A3 zs^&59AsoZa3Iqajck5Vb5EOx+rMZ6Z6PsIjL#B;EdP(JbJ!QI(1|Lkf!&&0Z|E9UxXD6F9Q~z6BF2QH=*ajTv)3C4l4vVMazmkJ)(~Bm zhd?)7xnJB_6gv>c4GfcU$`to$fEo>a*E$$67~Jhni1TEehYs=zSHlY z(v-IR1!48buE&5SX1FB*LE8(7XfJ*cPQ?%-p8(f|85uv=4HS=hw9*%f6)_;>1_HYt z;}{*2g$K4bT8Af7)Oym$z92Ao_o`Xlt#-^6g`Q2N&%$4T?{v*0j|+FQf0QEsJ#Z~O zeU)yn_tdg?Csl?ZC^>&wq;P>L^}1YnRT4Tp^O8kPo8@|ta#Av`dD>*JY<@?Rs9?H9?KGVJCg(qv<+Rn>|c<#Y(qZ8(?U)z zc^SoUCLP|5?Sz=OKm+4%1*fH{QpnQ3K|3WqbnDQ8OGcz&q*Ibi>NVSphI0s`A_cRu zYe?=0&O=}$5;3W^?~`I@rHzrxKEY0yn^}BNfond*aQlS$p}1tcKB^GGi&sQ4hiZih z6ono%vPDRS=T7mW6y84R5zs7c58X3Npu$$;NR~F)gHLSQ(mGEa#3-T`a`yNH)llgh zF^f#ZLj&&)yS1f3I6EgdcnLi z@=wn3RzD9+W`WDP+P9QPDr*!s#>vM)fgLLX&i|TmcTni$n>5&zAW2pmDK8O?XV^X{ zBaIVtgC9-Ps!GsYueiv$p2o_>k?co5Zs8_U7P`lF;SFq4IK?=W#=Gy?Zn0f=GmK z-kfRvm=f6~miL1o(T^0Llg0I6fp?--EeXl~d0AaF;Z}rSBcls`EdGr*eJO?%LVQt4o~OhE#0qMjejn`1>b2c3DqnX zPwnH*8=by$n)zXMuDwas{9`FFa_i8LNThc8F-%P$_U_KzcM2<&?v5+0(fX=RqQG}f z5qz7sx@*)3?q)Z~9tzg?0sfC*>zq$hsB6mI+ONgi^-kq>NayzLas2Y(yLrRAc#AMz zUnljY+f)(KMfGl#+mqsB-#e$o$lLp0xXU;1FV!!poZQ5le7n{cg<+w`_+C^c4Oq+L z%h3D77O#7Pn&w8ZT>#~Q5wFnjk6m`Jb1cVmlBPZ%n$i0}OR(y;FHJ?-4ip^qLwN|6 zmVW>`zfpERf8=@xdUhQGzJHW7YT$UsYyNIjnSFFSJ}u28N|^%;?xab3<>T{7Ql$Il zhCI|O0tS;MhS5Qxl`N;aTibcM8xupLqm_Nzy2)vlQKOZ7;L(7c6PSA(OehozWr4aA zZ*S{vL0LvdD~EnFUw<=PX_k&Yz?ZI$uH6U?dZljuUNHE3K^(9k3bzO5t_2eUGDWBE z@XRKZ1t>GHt(%%=89Q1j1RiBdvvl`K)f5@syAdk%N}c+>pb%I9b=LwGd|`*e+^1ne z|CHH=76C3swslj|EK^1+1;C>MX_nqTsV*X;S2sfYUa7xe?mRG|eJIrS)O~t;`^RVc z;~Sx*f0^Ha76D%Rw|@XFe;KXh2ai5Wvvl%FwG$cLx)GZ9N*#u|*T9650HJ=P^?#Ou zy7K_iTToj-VtD%p&`#25r7(DuEzQ!?C)H47^!!Gs(JS>Q%>5lqXdVhZ=*vC)XPHy? zcYwqu^Z;mQaQg?)PTFXtAb3 zm8~>RktQdB#O({}MksB4jGRd38!?X&UqIx-5uWgGN+CofM*}}hqVxm5jW+KL{W$88 z&jtcD|5F(pylAX}J(EKWNr+!mvI89&bw7qI#4kFzj1G;XA43u1_a*t54o$QlLlxo| zlgvSnrqYk03Gs_fcA!Ty=_mRX<5v%|?MF0#h{cny(1X1C5ltXs3FOqzKwBsPdAfzRafzU4dF?=Bi>B)EuXy^kN?;!{o3o7hS6FfUI$o&{VbOVT=ARU?H zZ496n1Beljjx2HnMv%k+Vl<>9n_QF;q%nXP2kFQm_hST^4<-oR!Y9Y47wRWY=elEkyEpPum=&lAY$d@ zCM+QGLBu|YSOs}H3y5V9aR?$-Nxs4Y5*kDt!$hhg$1A3m7)1Pz8Bj&eQB18ch&YLf zR86i@Osz49IE@(q{0d4jwE;823}#0)(*I4ULLK8!ESjML$UG45U&wM`Sk?1K$_%tY z#S9@RA!1;VtJ6v^V+aq;Y-0!y%N*O0wIv)94v#=8A$lQ#S*JCI&bXrY(k$E01~ohy zo>YP-W#Gv=Erb#xK^nT9WBoV7m)lrF&FN6!Y5TbfE+q?>`acdOLfT&Jlja~zG?~R6*!hX znW?(k`-%XgH3~vZV z_pdd?1#go<9S;2U;nZ(dk@1m3ac&GootF9laJDcknA)lnRdSL35K4R`TG3O~(LgMj z3Y7d~c&5Pe=UJLAOo!rU_@=0JT8~OJ{cN~b_5QnuJ7dhkuR6Kp}7&RQ{%| zIvB6;fq@PBKMUi2XMY2K8WJ$C=*jC$B9v4INTKee;@dZ3jdD)RdbxcM(tB% znf6qzaWYvd*idE#^i=I}GFdC^Q)XrMfMO%t7bfO<^UFAkeX!-9e5sf24#x;3(^yI< z%SSY@0m8QGxW7>-8#V<$yE^c*`|;llU48@7aNu8trbQ1NifIjO5N8BBs)_%KFe}^z z;jd-?Bf9^~3e5dLb12Sg_EuS^oLfYzKFqlFR)JE^t)f*QWeEGIAXCk4qE#RB??REc zQr}&@wDYnmrJC*gFeGfdDZYgToI92`@Y9$HKaKx9REFOW=D}|W%kohT_R&N2CYL_^ z4lzRY+N%E{`zIlz1yaec7%s#akAX-(8{t)Hw7Tg>KF)t0{%pVmvWZT9HqGgy=vzi( zmMBi_JI@2^K`2`YGah1!I1a@ip$#DH5dXKs>~#Q;Ov4{)&ICkK9X=o%>|?m{0jB;w zL+d;xpttiq6oY;1c*VBryX?_t37&J-z&#+S(GJ*W&#N$#Lt*b8sM9D`#p1jCapjli z^EfV7jD5lL8Cqb}AC7{P`+3y*_8$^&3F+?ERcg}$Y==bh%}eq3+A50i!M+Wwn4&F;Mv@FZ0q3`~>a^ z>4w%-_R|7Rk@s%ZRs2MUeKFl6HRtoz2Q3Yndb z>+&SGwUtLitEtHeL{6Gl>+=6;hq3N9yBsGP@!_F8#-`ikY7O-(sz|*B;=o{`JxBe| zZIRN7_E-e4ll(!umttVb>Uvi6_wJM1HPm=ps#)^^Dhbjl_E-V0D61P-(LcCP?$=OL zZ>a*GeE6Ioy$BpIrL1mbMGtkKJgTAQ*i!AB4;V|3rg)1LU`AQp#EKs2J_)U%7Tr>v zm=D1FDs2cHFsH0;W<~$vK6z0?t+J)M4%GN6odO)Npsa3TMUQu%ysn`(*;0i9HNHwO z0ta4GR=2XEC%I4F*HAlbsUj}~jD3}+aKH+%q^xdZMNe~|M6RXw+fseB5P+8`Z3rB& zqO5LbMbC1dM60F#yroLJ5TKGModO)NrmXH@MbC4e#HyuE-%>@=U={^gnk<*zPQne@J_+&a_{Lib6cTIvj%$hkG* zKtAEUP<_0OvwTkbmo&-e-M0hVy($Hjv5zzMvCQH)Z+r|Aa7_dKXad7=f!Fzzh8? z!W7)&ndoNAu+vv!MysiMewiN*= zFDw8JCj5q-f5Y~Nfb#6HFaS5!=K;#R7XW;^l?uR13qXUjNuGeRmy{!RJBSecwl05R9#<6`@ zh?bD##yoZWdc`>vKMYH0`|)_)ipCLs1eVe=+8O{{i;A-G0cw4yfTO4Nc!2yfl7JRm zlua?9UcLc3;3y6YsI&%o3iN8ih62DtLFq@x8NXqk-|)5=urWIZG60+!`sh%~i;cn6 zscSm`!Ylp1;ooo{l;N9t`U1YG{}eL9!|31H-(dycSIc7&x=rhdO9NuyT&KwoERvtp zXDv1#gzy!fbeWnmAej4-tb!hWjAr~(8w+gpF(6A-6 zP2-SD1NFPukE7gw%kUS*J&ni==qB{iAnlla&B?o?^>>9Jcrnetn=o9NxobNSa(b^{ zySQOxYQ9ahB=;W6L3^Rj7qO1}`y_3#UvR#C2ZW@Z?WLdAQS>)r2a)3;E`L!iA4kY( zlfN9)eZ1dVgk6Atcv}*b2W#5dc#%eulDq}Y{4(KXb=#Cym0jWp0&IDB8~SpX$zX`JK?o-_BL@e=}r;qKGA9| z^7e{%cv}&U|0QVn0&v9(ceUjSI7&(d3Qhp7-ojle!d>kGu6W_DasgLMa995T0lmG2 z_vQ^g{NXY7hewL=PIv#HnG1Bf1n=~^vwsVE=THG_0w>!7>*|NL6+!WEk_)H~{5PW9 zFN1LM>u8b^8{nYd;=dGX1n73zM}E3A+Em!OG1 zQ-Y=bi_W0J@Ya>#t?vS5gblZ#8F_7|^YS z>+%4)|7Fmn2)xuN;OER8@FVgT@Usp0xoQIZq{00_0YBbL|9Q}Npqw$hoIJeTE>Mmg zUM>gl)B^Vu5BK!n9EyY+=LC$4z>W6;#$gG7aVofRGoU-KA)veeCm=Aq*GPEhS-?Kr z?Et&-KQuK1ch3!XKMXWv3~%WFI{XK)%CUAMI->g4eo~;a!zgWL3>b*Q#BNYG=2O#Be!~#HA;41J!e?-iHtPq_2D}rTqK&RChaN*MmRKM{7s={tN zfNIx4K$QzDK>dgW5c?Al7oLN2!tk{p;23-HbV)8{fzXT@fgd1V`G4t^EzkR^4(?AbQV~o^jG>5xJEeqV9!4u zG;TNnN-eqprR;?O4PHPa=RbnIhpV*%YDep-#c0BCAxgLqE?fu=Uhj{@*$U8_$1zY3 zj>!UqJN#fOJP-PxnDTKO^GcO0d062w)zt4{_mwg!lYZ!Y_v|VRIk#9Q1{bj zo}umji#d)o(6Y@RlHaRei6}Sx`2lB0!sr(z9ALNlfrBkG!7w41(Gx(b5m@Ey3LHFy zA6$g56a+Tb6?kIp9s;t96#wVY?=rhkK*bxlY_ms!QfKZ!DG}f)`F$HGbtMFpN`sgB z7f>i18V4YDI3x)`O*;TY0$0iel#Jj?e>adZyw@3^DHu1x?l?Th`^VhG;tcT5>@y%G49AoKY+~XcQx^cg|MJgL{|fatO{D<0$BOqx z@IeaP#1Y`@)^m6}h3djm_!PLILW4j0SAgFs-%DT()g5=*#RuQv?b}s&FaM!=%wILM z`7efsFW@5}_>2fX&k=#ob3OorDHwd{Lj@lJi339)FZg&1cNv%w0kaGM00v3GECT@G zgCucakOa&!006GSPjz7{{2PZ)uQGt?l?Z%#^#Pb(!N!2yqJmGa#DVFR*A6h^QubP? z{FVL}AlyGHc`5(FS<7!%@S^bPRmNX(_Lm?LAv=*YTxDRU@c+Y@=09O7BoCi2!G}=n z@cB{>FobG>5251W-F*j!P{!~f)V~EC!2$SGNFF{q+66{O?90Cu+yMmC=YyGBW0CuHU#gpV@Xe^P&ka=he!tiF{swA%fBwPucGtM& zcJ~AO{W{opKJES{zSZ~k=RW)Wec@63X=|&`_4%*+yW7Uro3nNB{n@^+&&4g;{oqXL z^4)b3`0o7u{chgd`}0Anmb)vcvhVHrdTm(p7DVEj;m*1h&SlncqU5-t~UjN86RYb{jZvDV#j(c7(Lch}khzAj<$ z#S~aNDq@By{>o7I8puzwq6JOYtVr#v=lxFL}@P@Q2R(&+99>YrPTs zT*zH&%vPm*T6#~^khHTPS$m2Flne^KOiB~#$ZRN**JRAY%5!?i|6AJ#wMP@P7ij<=W=4t?{|$H2W5HJ+7)J_w)?J(KE0*w1^DLe>MWeC+8)d8za!SOD&v{GEMRVoNr=PlVo7J5TG zu#f}GyWXdt1QlLsO^tb_&1;BHSR;ZB`Z&?>)?@=6M?yFft(R~y1hH2PPzQNmi0z1p zZ1<8}@JDn|kn9-hW;-A%NBeN{UYL$rZpt$_q8@kH0tPmFasvsJ3(=mleertckeI(L+7B zh<_XLi=TPL>PMKsPSDURTa|SFlbUVC2pqnfnpHB>pM)BM$F!cyxfHJ(wUrDxFQdeB zA9hEYaoI8WptuA{cZqepWSV=wPs(pAPp?OHRs1>yiQ?P(uXnkc6DHzox*m-4ML%p_ z6v$pi&6C&=nECkGVcC6lFuf%sm~!oo!~xGy`V$8;D-BIPQS3tan)NkK#2Ozn^y#-3 z3g4c@*Yxha9IY30ZX9z=nfo>VI7}jLi*a|f-n5T0vWragIRe-9nT$O3{BcTw-Ldha ziR(q0dOmEtH-q-gnG~H`DM?PzBZ8?XH1ChStI(#x0FkIv1LoOm=uDW-- zOLa%M$!pe8? zycQNOIO98ed0Y}TOv6H}qzE<#vkIFDe}m-Hv>S4*K}Bz7@9^;bVC&l_ z1&o(b#dM6-4j*)r2LzAAM_(Sn9E;L*KGEHi5j|m?jz;Q>v}@;ji1*@i&+D59$Vp*T zn%=T5m9B)z?Un_fv1ap3R7eDZ^nq`cjUeI3j%DiFvFvC z)LMJJ9l`TX_)NOAilg$JYLEBsI3Qp&vfb``gY~OnNa56>Cu`g(lqEQY^=HQu$s7&4 z)BOb|+7^;nkP+v|)K&w{16}R3?*1_T>J}J&{Zz`!5o-j)zeM1rP+m#4wLp zm}=)t=SU<;;*ZcJn<~>w8NGBtz7$QIUSB)D7m4TYhrD_^lHD2e( zpB8$^{eu-UY>({j9xbTe)D1g2Fkc#TaQJj>2Kk+s(Z}##eWZv-@ED8?IIy=D&2PwN zrIJP4?vecQt{;g|COCUz{%lJ_!-5@WC2vXlJoF@1IQzo-Y<2nG_@tI#>vh2y3!4oS z(rFykwc9|u)egZy1P-CI&x_4E)LwpB2AP}70Y@2v>G;<(Ejtf|uh48h-1vZc+-p3> zE?B3qZ}La-9}jW*;7LfeuS(lTTreH03O_OIA4m|ITsqC-SEi^VRP$-tt|nd(^ii;y z?5{D7cPJ|`ugq;bHWLyTtar*wBplJBXW&qOG5ulBKI53PsvrCKp;4$ygPx^+eUx>u zKPn-IPuTXQTGks7)tjDYL19!GkGtE?u;g9mcETIirToAt1Coj3_(ra8Lr%|5@oBUb zQ+o6eoJwUa_b8miCPG1V`Ef6gr4opHD4Zh9CeF&%$HtPf$=+dTx{6?*AoNx`ZbUy% z7iirW`k1)tdOhV<^}$1&Yf9;D2!k*srqt6->6i#R(Fi=8lDZc{P6pN_DBnY!wz{l@ zE*%?*>}$E1&+b;z_#F{1lv~NhG8=EKrl5%dC_|B!6lr6j^s!P9$B|?sVb`ai6DaK~ zY4=LqR6D(poTt4w)%kXkNR~=n?=r&Q84ne_v}DDIroxBTQJQmlQ8=5{@oh^t3b?A} zFBpa-+a#4xH2+c8<=H&5cTm=4L?jDgCM2RBtK)x z--@G-D+slGKOd!rg8<(wF^V|6Vlaqb0Xb1LZ30zX^KAXv@yja;EJNKvVvL`xst>VG zLNf-nIJm5dyXC&z_$|wNNAY8t?dT9yC=K>K5f4@kTl!wEatxguu@|jDFw+Y_T)=py zWbQ0|YC&_$6PFFqjA@WHBf|v~oTej)@d{|J8D?nBNJ@hu1bv*%A`j=Q>>6pa*;G5Q z=5*LOLZYcqPk!KEHjgK*e8CpqJb9n45v4(YX3WRoGZZLy^UG<>?4goiotul{5wh?m zANrp4$|KfY0XvFU4E>7ku@=$Jp6983=spbMvLJEm!$rh>G%H%|+u39nd}Y&1evEi3 zZFeoEgM7W0;4JM+EDQAKzMgXP%MC9t$8#4k#ycTKXv`nO9c8R(#Rdw1Q`&i+Pf15C zT*T_C_Znefk{EL-=JF(m1dlUA<@sa@Wy9;+RrS7(2MQz`Jza7&SG!mfV~ov(+q{Bj ztE(MW*|K37+Wh}V5KS}ReAbgnO@(YDv8YHCxa`RbV)o_QA3~# z0gbWG8AI1&a$-U|)MSOdE9>=3M0u&axk>i@8f?-U^o9Pewmmw3X}V&J?KWHm4+R9G z*ZH4>KfkRlnLTbexFP-iyzQ7)dK95EvOx$L8??8E`*9pe>)eISzd+B+z37$qnBGHq z*CBJZt;{L87|9yR*ibSRP079T0QaY)YN)pqv+?mI?WQX3HrEd5su z^tWL+8(r$(X{=q$S^^{EIynoNq*@`1zK`DxLN;|Nn34Tx+0%xWlSdi)aq!-fcY!;exJpP+*_Xy zDP>SUVv8?qhS>!;UqV_;@*fE=?Xj-N=zaZMCh8L`H%?|Pol)`1J*|S{m$K}Oo7vg^ zSadYzH^mO-9n6hOq+bVGQNFbraKwZyJuYH)PV+}hbget`y@zaxMTrTZ$&U!?d zQ<1DZ>l`RfoNh{78Yv~7inZwAsS>XzhffU2ls-mmpo&*pKQu%UCd{~hyp`)YAL2cp z`k_BCC#|bVo3-Q{Z72%H@o-d%WpXiE5xO`;`XPO^fMIl;K=9t=dVz43>*_v%IHt2s z7J<@enHFP0!?;+_MSfIZjv=`T0SK&QuIk27E_Qo)?6WQ%L|ICCN*zy{g0B98@zsL} z{&ZQq-Fh$3j3v`xe>lN>MKP+77#brVheoN7(t2CSG?TW8lQS;KUAlbD15mWfi@U5r za=+^OZ-WZilGxk2>KadAr#guyuPN^4BtcgxeH50tTf zkpIX@*eHS{^l?I}wJEWzJ6_=O9WI87GB_G?YYcsn7e5&uJXKo)yY106!<;Wbq*kQ_Wy{%QcAc zWJI_BB~>=RU+q|I*NaU%QaT@n?c@HZ56UcXLYafv*ap}$QbYK~Wv!}T3Z51yIUe)8 zqHo#4wn&c@s0P=5!$1yon^b0LAsH=MaGH8db));;i+l0=6 zSCB1|PxkBk1=ZJb7y9&&>Hr?@(Z_od;Ke6vn+TkU<8`pcBemf+6>E>^*DJlrsdLyI zh-5eJnYhi!iRFy_CY$`?+%}o`Js8wcL5yVdPCu)?%Svuu`9G`R=PPG^Fx(#bHD#LI z8j;tznk{frwD!?}jff>ftoJE{imvY0UwC6#a#vc|?5}s#y65@SpVykU?V63}>WblF z_z-?po=;e*Rei_~qSz|I#-l~}K`5hk*Y? zFEkL@nMO1Z1>Js07ZsQIDo2b9{y<8+ox5S_aV8I!%}>ONqDONkJt_%ad7R`Nq?b~L z$%jThboOYfIA1DdTjz|v+XdNM5fFjx&o4Ks)Vlceqz|)o^BC~fbXW4ZDE;)bH1ji$ zk~6X|zX-&2^@k`^gwI|C=z5U2SQehU-jvZ|a<@>ik#6R9uV0W>f2*^Hc8dzWAugPg zyf#?Z~rTn$;Wv)9*pX60{aM(}CS+R-P!>(Z6r#Fr$hG;FwHOGQkg9CP-Hfv5LT+KP7%oY{}OZ?;{RKfK> zSj&LuEUL#hD$!UdKb&a`3@oIxfIwwslHI6|!VAB=jqd3^eE!ygXm%1Cb>3A6|3x}uGB$q$5T;Arpqd|s_l>zYw+?MQoMvCN@ z{FeDUlwAb#xs&DDio4j7OUOTZpK;IWmwjYk&6H9$)oJhL7mvE27_zG_u*eKs3*7Db zu|!0$K^1H^99VoEa)Eq0)JHHIY5t6S7>9M7!;%3_dC>hZkK}-`H|gh#*DC!@{LHbJ zQRLGl!`^Qr&_1A5Mu&nw+EaIN-USBsgs7anUTY*uLqqNF*V^jZajQLzDk$=|C)Aod zYkD&GSpR`$TYt}Hmzg`See@f3x7;@*4n;rX!Z-@K#OrSj=cYbz&KKq#3f#;>$N8|0 zok@Dtr%-1P+{T9KdNsMOK#P|4N;(Et zP5U)nW0y9;6Ht$bEv{atm|3T7Kv2&%_OH|T!Fh|XITg#o1{Fg2il+;5uTOmW^cgJW zog71nV{(<&dt#8JSnJ2h2AIDNCB668A1z;gge0&tUzIbyUCqarhT!n#tX0G|% z&vm^6$^GZg%wBWD{;jQEDHn^4a>VdM=k9JA8%`vNZ>H21tCgr?!9?Pw0x|LLZu6vf zKDdU7@H0;OY1+N_?!Irg;q;TqFxBZ@X=@{5-9y^#iJ>fFa`nKDHC@#iG4XTE{z9>3 z{z_-af>k3d}VS; zE{z+$*i!fXQ;dY1%2h~?Pb>;M}lMSf5&(WptsW07d`BVO_o0e^mAU~8M_ z@xzBZ`T=4iWvOkd8wsWXdA6)h2}ty8=9z6XJvU3&l^KW%jNuhZ+KjTV9#0eU%^@wx zn-{vS1qMIq>LgQQ8{-h&$Y87}ZZlBETH5$Xco%*W7X7n5Qi{S37xc59Y0!M~S%M^So>eW+)HaFlbg(SXrDT4L{yTw+U`!8w3zF>Ty=4P z(n`Oo3vb)vux1-kBVYmBJ0lda445Xxv)b~pe&S2|_)YiiYeC>&5GhpF9s`#m)txZT zZyb|atc1E|(L6j7%jZtBOJ4nDnVpC$MxPcQcgd=}jnz!SGxg{%GZkNvs9v8)HF<>w zA=bSuk{OfNLZwu)#_?W`ULhrR!@IxcLDw_i&r*u5_;#C4 zp>`QW?_J&E$1J8FWTbr3ptmS8rZ}+qQa}}JKhlJ{R>U}36nQzc#xEcG+yvXwN?o{8 z#7^Hr+WWK_Wzb`bLwhb(&wkNVZ0N*>gpy@en3=tePx?5qE{SEC6laP}@D{aH7b3`C1LRGDjSr&A7Rxvvgl$9p~dGIm=xF*Y3*d zh5YBsQLjU9l70?VM&>?WPPuh=&mDZOOIKHJKWc(NK4*TC5Mfj1-j&8l*cVO!^;_lT zRzkT!K2K`6-%~bbvTbNJ%f0&1`g&9Bb=lsa+iircoX@+W@vz-EM2n|$<~Ona=+9B9 zBewBE;?o%S=hrqZTghmiH1qG8ca=qVGE7fDlBr^l532}5#g%_TVg9uYrG~9q8AaOM zkc(yZcu%oyw5s~c0hPD?#O2Z;)&s^#AYWVd?bC=l*o}1q>2(RI5e9a3gSn2u>gG!> zmZal{qFlUc{CR$rS((7!rzWqusKuE|JilYZNm{qh`kHVD!@%fq-1FJR7dSRwQML<=AVub7 zPI&K(be&FnZxC)=%dS47=h1+1adD3ZnqiU6@gz%(#?Xnzbr7o7!N*25l&@$SD&<6Iw$m5@+bS_X$8Iq6LFqY>)9)u zMez>UOFNTKK1T5O?`b80b<-ZWs ze2H8K6);Z7+P@|*L~OF%KFunl3J>bMT*B{FNfBZDm#PuX zL;WSi*E`EmBKnCJ^>c(q5s9#6!Xul?=r2-K()>589xCyQ+kH{8sl>>|=@VE<1`xs? zUNF^&Q{FYXhB3r5Xi`z@4AZFQW6SBSt=Z)z=`fNzf4qaw-GL6k(~8$;Q9>(B;Q@LiC`AjbRA|36vcX z8dB5I8<9x8UX-#X%MV^oCRl#zIQ7GFs{^VNU%t9Z`JeUK=I{UUw_h;2d-Hc#5Yw;f z?61}Va`tCiaQJLhro{^BkPrGkBXO{!IWN;a{QN!M;rk$)7#)dT_X1OsUACWdblbr8 zuoEFe9r14il%aI^Hv;qR+*$Wc zSd%X6@Mob!G7 zMl9uL5)VJpb9kt_(mqd%OMP`|>c1~F)C94V)S3Ln&SetUq&e*WeD;f~#@b2E`j*O(wy7s;wq1pg*&0V5zzK@$&Zi{Ks2yaeI3yu5Lem z5I@d;z7#hf=kxRTpYAR`U4II()Lcy_$ZUFfr~hG{iP0vLs79vQ&Pqfg;b)EUJiv)4 z*!`ZwF%_RV)FY|@YVvr$bjj$(Ise`K+zw@U@rxrm@Ur{gpK&MyE5a=D^sD;QuRogW zw=lfn#b5vN7x?6^yZf)-&42!2UjDp>)%ZKqrXyO9ojvEUi$=q;2HVWc{cBakQ>ATj zE!k$6q@2M@Ml;|mj*`r;?QFbyb?N560eY>@KH`3K_BUBK1<=Ev;!ecm^ z|5d^71G6nzjasGgZX()^ykzRwkix6|R`8D(}rTqoE-iQ&3&>U`d$l zf@Yw1#0J-hXk~jf8W&|C5iyFF*)em#?a*H^n^Y2E#&nUWq!+7cs|4#VU_iy#u{>tAVjjUu=3kC(Yc zI_Me~URu_m|77)t7UdVOOXSQl@aiWCYxsY{LJqH`5i9yD9MIR|7dRBIje?Pd0{a@h zk4@_CI(QB=O21fj^uvGt68ZAvu%qSv_DvoO3Cm{h$?is{Jt59N{`}L$_4_Mv_wnPM zxcceSkK)7i{Jof8TwdJF@9utj|NbuMggC7p^ugBow~zl7UBS6{9e)umw2oM{Fe)tW zA8)Vb*LT-Hirc%NeiktOE};c(F2#>GHy7`3etv&_{{DR!?n$GE9>INm5ckdXj~_ps zzrPb7E-yZatMjW1ad&b4UVQlY^N;VZq1S)9`51iHSB*;m#y$+7q%`aAu;O5z|6&bGu+ROaGhE{qX#a#0`TLOIwuthT+V7vRq5cV@ zDBbmU@b9~K_}?q||IZi?w(eyAe3*@Ch<5>|7mljY!wF6iaXznlLI{|q|aG9&b*!XH~0n&q;hk$b^FfU}4pV|C)_8ca!T zxR+s6IH;Wa&uB!tk&>6@-WtwrWV=mjk0WR1kWpCyk$28o@D3her|0>_r^}B&U)_ig zw^y*U-re4c+l%u{@!|aH_U6;|)z!s^4`DmZYxB&@IuU>CLRZPYdUZ|dk661bZq97S zkU#IW3E7E1@3nc;i9e4yz4<1VafX7-$JC04Xi3Y~8&F~X2A#>AUjV_ARV9{b2KXM* zX8k1Li7QsJ$*O<@mrq_%St=K4h9-u=Yq2Ov_QXmDd58&qyO(=0uTAZFWvXi80Cpv_ zQ1u|l*vCo;Ik4|$_#N$#iv4PHuzw(A{vQK zAAqcicnjx%EsAvMXpxnRD3@swRZ{AK#J3jRP2$5ZKmNA4KsrbsLm5gbdo80yt3|G~ zmY8Zkx>~jktjxOWc|DUGnPz^3V4N4p99c;$KOHy>?fnTrV&_M!XzWYnqohJZx34%V zEe~_Lb|mPGvlsLBOu2SrAIDrbSi_W_jjoSHzZPVb=&Q-Jm|t|XlPLMoEgEHaRj4nx zfro?vG8A`yP+8WeBC4drXsm{M2zj`j&${495;G@47TUS+Q1d&0nu#<=U!ct-vQip_ zjT|sxuRrUFh;427h>`DlN2F=-B%`BAcOkC`78`}Uam z(XwxknI8fB_L$!a9qVnHKHkS=*(Bm#k*BH2^si5aY09A)7j-7LroM)Y4O0dDCQL0# zi!^U@;XG<2@VCgw;3zTEYgt3zT5%yvwO^ODGnaMdUJ^V%CKhnkaHHB^3oIscHJK>( zsbB{|#Yzlxmu61$y-l+Q&4YD`7VlnZ`GlkNWZK!MwuM*L9DZ7>rK&?X_hh2kr=lF? z^t)R~aQsLYJ$F;%rvWIm5X04E0@=p_S_Kn$QdMd+cSj5KpsjoNnm6kGfd6r|UhJ1h zwEVc$9$NUnu!zyp<0IjofOX1Jud>Oc)~PHEQiSDmT}_~GC2?#DjOSWr<%0o^FS;uv zIDSlOuOqQGh9jM78r6w76rUwD8qep#;Q6`wF$X;!uXvm za9wQ{D9pP9)q(Wc1LK5=Qec%FM5Zz{U3CN5`pT`-PRL|~b9s>S)AI`Vc&b$xN_LNW zzgceL=wU5^J86M$PVe|v7wdisM7M}(^cll~{Y0evsFOnqe?b=Rpo8c82E_=pmyc+a z%%3o$Cllx<;o7nrkp_y0TGokLrUguJ`}PSy*^;Uw{c5t8twkgKs!+<*oOew~ciO02 zH1Ic{&<00{L}JV8@EEWr2w!Bz(36 ztV$~dU&XvwTkd9=)))fhE z+)6r)Z8FL9Cm@DRE-`_gBx=|JZ1a%t+0wy%_#0WLa*@$}j{6^$lcT`Dx(NDn`rfhv zle}QM_8B|HtBa~X0XIAo70Du-)GWNTiu05l8UrNiH^BY;xz5^%pMdcV@Hs!CWrabn zGJAA7n}{M&N!s4>>SFBA7}Oo~=(*b$E0K4i!_#7em1#_uK4t#C0fJ@^vHcbM{s~yw z^0575x`bc8ZPFOiL=$+J{-G)3@4uV>EUkLh&-R<}qH8C34fnkJU6+L!?tASs!}=hY zjl)-pyhtYE(-!l}+Ki==p ziH&+cnT-BZkfP)6d1&7NgTtKbrHq@wt4HEg`@vnb@E6GjcngHBYXE;ubeEpHw7t6g z{j>0!E`2uSH$dD5U5>@L^;+a|ql(A+orL`cjBhrIUloPE9(F*JkTfH6IAhs+fr6GuFp9_pM!jO3kJWPw0&Xj)7O1pkE7^@X;g0ah3YZ#}493FFtJcg0Jmz8Y zUZ%{iqnhQ_W#gaJEVc$~bYK@cS@QG!t1HnT82@r1WBGf8owb6_#dMFhn%RGB28jO% zkfH{S4C_oz{A<56b){6i?)F|+Sl7ma3-_Vx*%D zst3{m>WfK&xi89xOeHX#7gCew3syS$qaAyAzUuT=#PG5nvN7?X7ARE{p=>eC=LFaN zqWR%)G(6cXY?<1Ce|85C^Z?>Q9(4L(C8mGu^x^7five5`7eCgu-(_A*D0RiKwOA{e zHESE_M?&Oe*g6W)ror3&h(yGRSRGw{hBmFfAY;`w{$Mf0KN!Xo`pIguxQ|jn9-=YnzW9YKTcSLSjpjkixWO8&HHb&%CeHX-|s^Q4gp7_dJTbc{_k0d z*q?x}llaDXXOiYH6tN!;(IIo~in{l@f;2o%Z08%mL40$)k3oImN=#P7r#LbDxJThLrp0d|bwtg7vVEk_W z5uZvzvkyjN=TY+mCc3UiRH+ zv}X6xsYtB6>Cj8{C~tx^K5i}2B0*u!nXk9eWZKu-ppo*XL@tZ^~VeJI^iQ?QQ^mlw|*t;esE@|VS zos%EsNs>}y1PywD;7PmhgYB)8X|=z|(L@%bLx^xYj&BG!w1gf+7^<`T+yad0O(Z@V zsXF|5V`C0Tb73gQKJr}p((`z-ls0WCw&8z1`yezBouM52!81vPVrBwnYTd%gE2nXB zqCVYtT&N;m=d!+cP%)IpCfNC4)GjT?e?$W1$9x=?$ZnJ!G+&D-n4~k5Qs1O?)52Dt zODt6b{bnOtOgNfT+XTL2Vw0Tpr|veCS$}W2JURN9p_ckiKl`jmM;ivQ*mff#5%Qx& z9w9~_!yLsFyhLRR1~Fai$cz%Evg(o+Dr2ZpzBAwa zmS#^>Nr?$5qL4HlWhhL3r0=xU;UkhgCplWww?7`AR@V1DLwWFB9_Hc#fQ!jS2F5@z z)Bq0{pt~}g?jCq$ChS0Cb2bhw5D#k;qGrNJB;7ikhz=T5;gFpA7U_bQ`;NCx5u4^n z*XVxFPy~Fu@ET6)2SBe@(k15WnQW7^>DYqz%96m@lc1erBKD>)RDCdO+bE<<6P%~M zRH-{}8eKBFHTZHT-x@IYPlv^cHyxe4zWyFu?u)Mn0-TCB_0U`%V_HH_C2sv0q^EW{ zy3yfWJ~Uk7-Yif_1^%s7;|96;Rke!K%Cr$0K!v?Qqc{nf+00NJ{Adn}GZH3Br>mk{ z?r_GFC^-?aM}~N&R%U&&qkFhZxl4%L_`6BOoM_nVAm+r-jw1FuklU^TxD`WX?wwPg zJ;j=UVtQ9JJ zzGfxc{mA%6T^s-fds}bn$0?2592_faExN*m=s8CzYs=Ak7ms}w*&zJs*ccJ)_;J0h zf;yWMCp(DE+IV2J`ygJ!yiY%P8fnZ0aq|LJ%>)ayE(YHu+mO4ttRD`dYfUWrk|wS> zNre2!+ZdrN%3_-%nZ*wDTY6_(8V0=2WR{f=uyUA`Tl3l|$i}0unpm4%-yqpcoY-H` zDYmVE_$LQWuq0GYw2!cXTd4~2_;$@u>iY<$eH}PoL7c?Mm*fRwob@`aeot7+G{c)H z_zcCogB-x8Pf&&$-fDvq2J3dA_k!Za+dGMkA0ZoHdvRCCHA9{50p8x)?N8E&&(*W> z_0gF`_<{{&Q}E+jJ5Aw^Ui(RBb`EDK8%;6^R`T9-k2{qXH1^}d4J$S*YTKE;j5V_{ zjY-sHrW~^}AM{Ton}Z**8Z?KO!{{&dnfN3!emrV`%ts31BLXE_u34#r?;#rWQCgun zrBMNL``44{g1@XT=ZByEEl`s4nxQ24;chfF&R{R?qC3~=YAr^}CdS%3x`HBhd~5(;a^H0aHhDn(Kc&+8;K*5qgaZK=Eva%f!7H7l9!L+K9y10I0| zb%#JZ6)e9{;gJS;Ac>bB?OE1k(IjPA?-W`v$vc+Jc^YqXwsy}m1N9nun)2g0N6Sy3 zwQL(@(xgzD1=TxDVO5e*XOf5CHgF-kYNE5fE56#KrG~@D8j_je)G5jHJu7MOE{i7f zz8IG)J;?B%lZg1ysjQTVSjY@*G4=Re_{zr54)qwUP8;oX7Qs=(`@oR&#tC~hEnuSS zrfy?uh?xik}0w~KuHb*cBbT9$_e&w;$D|I8 z)C1Shm{el5m~PML1gc5U{3up^M5x(=r8f<>^4iBo>N3&hKjEX5A6I&zjP`3*Qrj=P z#PDM?yH-n+_6(i&WxUduD>E#Muy<7;AEtQ#KgRP~&{^qlhb%-7aw*KgPvFVVMgNA% zid?f2;3iJ7a#N-WDyb|?{UVGl!(Y(lOk?y|-x4Hpe%$EM^Sj}*aG)J#kO_0j?fM=Y zz!ZJ4p=M+Y@Z(TNTfj?SI`M9p&NozXQhq8Y7-Y-A^Lq$GQeug64JS2q@cTfo>3Vyca4g6X}|v z@b{x#=*^5M(sqiek)ZeY=ELb!GVwM=HoIiIoNMV9| znstqW_E};)?tP=sLxLZ{drp&Ju#631^L87m0T>FXKc@k3r%abyvr4pu&4T>;Rb*vQ z{f=vfLhFxF3fvNUZvqMKEpf$H;Y$ov*dOigXOLxvGVI^d;?7W#{jr`MZR5edGlshC zr-Pi0FDI&zDQ&u7DAaz!%ngnUwIt!sw5?T;Y`sJRh{cFKG~#}$Q7OM(quEZ&O}}61ka|%r`{ULNPH^mp{}^-T@liR}6*a z58>L4E9{Iv7+E;W%fv=B;2*}_5~;Sc|Bwy9k1^4i7sl%yYWHBMM1K&WJq)V4rb7rB zYR?~@jSsLpxF7`#qk`j}Xls(XG1Q;$x4r>k4PIpUF_o7{Ph%)9e`pluZPug}`pI!D z27`MWyu>M(B0UMq1ZO1AgAqdP0sO+PtxOLr8B=@N>LSXmM#nPd{e@e#KVaaHMKOEA`vk2)|R@gvU2P4 z_Iv3E64X>g=t+t?MiI0!^5)0Ls z8a2^EiYmIizPY=>@G_!Rrs7#oXqEkyTsP>dU2VGxw!?O@1$*!;zD_sFx6196sb)vC z%2X`v;o;$355Y7BOz{;wWquKzU%|hTY#MA9r*x3042DOX;ifL+3RVK$9N6+k3;?N4 zroLdiubZ5rtT&VC&J#n#DUG6%m}#S=d??IG3fsl#lDd*j&i4ZhJ8CxUqqaWI3XeNV|4>aGC?g;GuO>|1nAp= z#el>(72_Ig<~=BwjJ_T)b>_I4OuPN~FCQ$kdRtH-oi_}%+3_#I*Ov_%cbii9le}}F zRIvZXX(h8Cs&rE}`g>WIc8iI#l!VKVM)h!egqmIfwE2zO@^By^wJbLWYX!aj8eSGeFHUb7D1@BIia^!2Cy>pVOohMcH&NCtJ-q zCNm3e7|N~hse7QBZ`p(T{YU?M=*+MmLQHtuaZImw% zl?eMbZ0d5dD?Q&Ab;D3JeU}NjGG5(fyQKsRtlTgZLf?gm6}y1F!UDUh>3YXE3p9%rpN99>Z+zZ-^9=>39Hs}*j2+XI)xQ1_h#${L|esb|m6ZP`fwkBkw89VsJmz5%jzc-U@GHxg)8$G21+*0WR5t*5f; zVd$-;9AP-$0L?nwv!@d1$@JNujnsQCJkr^4SuQaV8~0>e#7Hj6w)ySwm&q1-10Frw zLij_H)_A@wRCfVyFHtxY4kG1hD|BTFpTonn3GNIeDhx&4d!l0EYJ2Mq-?bjA5)=t&+90@alCEch;+Aingpu!v18f0=kjr2x-qBy-`nLjH+19&#!N< z#r*u@?&3nI;Ng)7c=hfo!o{XH3H&CD#Gb40%_HCatt@`)n)5g30`3e8{VeDg zNncqWc7R@U!F=(zdJU^9+0u*%o~+C05(5%{v&QZU7xA~o;A{`$ zAJo?K4YNeU+SgzAfy-%V6TAU(XS_J86t?W+E*$%D7-W97vwbsZmM&GijWaS7g`sM@ zi~g(Q2t(xRLScl)=N4l+aj*6T3A{gpLO7Xnd+-oF?-NK=5!c(w5EIqJNzi~~sMwyU zrNWtJi@IVF)SXM6c~=;+nY1Aqls60&+z$@c1`dvOiY9^kjc_?Z=z7|~Wvc6Xhux8wdGg%0Y>6ImB9g}Dn5~^Y6Eo+%83`mdqM0y{8XJR_Cl$7hbVW?R? zc7GO4TFC}~HhLaXy%mK@SL;Pt@4O|E@?${6T$B}Xe+j=z2k)K?<;v+X+lidm_#Aqf zd2{4v(36;}-qI6Bk$|HQMa(a+_Bn<|~FW-KT8)<0NpI1y%*S;V9cZgx!rR@rjrtrLt9Ygs1`vbNP0;F5{CBGI$sP8b~<-$&~>?cLrL)E5>{8tPijfv4keU%(XOk67pmNu%lXs8o*XqZ^{fn!=+gz(Re{&W2HU*;zN5@ zt+(1_!3<&y$tK}Mz`~j&Q8s(thKZhVF5)LoerRYL&zcK?oyF_2G;(HGWCobX)_)?p zIBOC$JMMJ|b&NX}356ZCB0CVaU>wZdLQFzrpeo+sL><+8T_rFv@6+fXfB896WPyhp zelp>MPI3x*Sn@R18xc0@I1!?wqi&7nBB!c0-WK#jiUn;|zEDY`645A`Tj^uEFFCUz zyUTecIUyTTX?8N@?vr}b16sF9sB+xxWHQ_@Ge${xoLI^(JY4T1z$7q9QP|n0OgbWT z-bzvW+PD1lwGZxUo?ISWW1N_}!Jg5gdAA(&w)<`FmrsB7#WFCPA^OzSJl4^#7-{|Y zB$w|hO_c_?olJ~7fK3k+H+52UJE5`Ddf^L{J}gP?)LVXv-TPZS>}~)EF2FGvIyDbd zs=4K-&b<%K3G`TSreKw=*fgK7=K@dt@F&TTyxYlCyI&tEXBOj-I{hf0<{iB6vtu-o zT}sS9SZ-{9SD5E@`{J(9(2jr@IaT=yckg#AY=}j`cF0eB`@osW?i67ef4BVPwf9dB z8=0jEZ9%!6Oi%lS-m#Y#s!+?6-sSiSXCFSJ4=T;sNSA+PaW zlW4Ti!+xF6UB!-p1Ol6x*qpLz(mc$mcFRym`UHJ~2URgR&fpw8^m4aUJ=K@FhQT+&J-G8tnCM1k_6UA)u|sWcMht z?Ksh?Ba;ecow{rJqH91B8z*|z>*`!yzwbv!mrU)e1P*TOKEucw;47_0fu35xk+JixE85pO6GmuPNo39TUJ>7B6Cx8;KQHAzuGGA5j!%u6NO%C~(xnHcwz#;j8U^~8b%$B7SOrW&eBgm^{PrD(FGVkR^?R z%2SbN<4Y)Oh!vUqTvc-=;ype1p>C645AE@Xqt8%Zf9)6m}C zJjZ-~0U*{WR}+x{m~x^+M;2#=HHVWST4}4^GE)6=R6?k)>@s47aA{(`X(Pgut{3Nbe z=5rG9RJ;hw7>w~^KtFbH%ZIpGn-ZXq)>um7drMrXlbAx1n-(n^ zhLcoF=Q#^=1~JsU9t1A6Rd58>WYX6ALoyeW%`4JdW zKpQWeqMdy^nXEKrZFd13HYmYZ+kLefk(KZt0FuM273}3`!!kiG=-l3lZs*7Dw};C4 z)!mgzA|@JxH^JF4*L8=>-({LDY9;SQqMYNKM9PoY^pbWY5#^{U{qoD~WKz;WQ*(HH zwDWUxRP@sJJ`zRyVl2ikgiq9BQz#hB-VJtfd5KXLM4L>-iXJ&)8Sq(_!xvYrgw?kw zH#SBKE)JXp*8S%kFgV)b2|DE5#Zi{}#hhl7$x%OXly{tPr??4jzbk9#92C;(LpOv! zzS-c6o7-D@u=C?twpBXC9^2Vp)#adK;*Yt+OP{!JlDVda(JPw7dWwPzU z{S72|-VU{-OEg8owF+>!aMZFM0FrI9#?>iEkmZ(@Xtf1%ueM@? z;zAKDIjWXfblTB|p^o*lAx*`W2EG%w6E^96Q{F3bU@;V<9)uE`B3_Xz(*o%m44fH6!wCB{vKctpf-<#&85Nf+ zAUj5sZO>7e0Cis?Nk_v0iH#vMAsDH^6d^ssgBaeJy0ixb{>5J~QPNFYz*q=#*m9Js zezB+tj=I!AolFAb%}yToOpfc)*0y|H9+05PP@Q^gZ9l=c%usmRVcEc05l(^*Qd*eR zCH?9YA+X}E%!Ios$f?Xwdpabj6!uU5PnPAdU5>0DPmC|+s7ifw;&#cGC}!5h8;Y`6 zl(NRjyEB#HNFt7Wr-CEp8aFPpE0L`<75}0vDyffs@7v7URNR_#wpk= z4ND1_EBy4jsVLEbJQ5adRR{A@5&fyTsdxPJzRkK(8imrb-i?no#XlVrBcbuLJ|VP| zZJ>AjWWMd%jwX5-kQu%7@go|K4Kn;SNt=h+ZZl5{3|=C&#qL;1XAiogk#&P9#+9jwSCu6h z@O#Hf0oy|9CrMP5urCY}gYA3co9~Z2Bt)j11(!&x;TP6ZJekYMFx~`FAyM$7AziXZ zZ1&&*s=$f>cMN5vpAU+osI;3lX49!)2Q?K;&Fq=U1PFy#rpE6n7nw@>Pf4geS;Dci zjW?O3y3B&OKO4zt9G10eY?T=-X^ka&QrNX@yt64vf%lPsc=8Bea;~c^K`!bHg`)i= zyU$@JHE}YK%^}h7BMiP8f~oU?(XlP+F^n(cI-$|%7@F94$573g6a?zr6K;JZG4kUZ z-THr;vcw%n>1Kf9VMs|uhu(1%WxlsQFU-@h$8nfaE2nHj;h9W_IiyEi^h~`Vs~Fr( zCdd3V<`6nzIBF^bEHn{irR*oZ$kUb00uh)H5=+wDJDIR@@KP`<%Ayxz#SHCqg%^6m zS5~f4axdm6z`O$#Etwd#l$9~;!mx0ZZ9!(Q-f`4a-T`KpLR>?B2d0jFXS^()w>$B# zVGWoh)bGhrOL+%9?$D?n;46$h3oc(0vZ~9r>Zph>gdRMKc~X)??8uMaH_FWkP*PwK+XdFelSk ze!O$>uAwHGfDzo#`E+-z#FH(YO3^|YLs@7uKS?GC=qr@_FnBh7L znW0I)7A8Mj*5p}%p_nplxa%&seL}QF`ng4a?*jUhgv^iZc-c$*-snyEpyWq%)E6UF ziR%Vh9FUpfG(-Esegc8%$l*7<6li6$nMwRSsm`&pRamj?yUAph$&+cF3NPcm_I|JBC800h5X05cS6h1KHh z9k{TY%)v&+x3Ie|Ic_0Ot$IA~@>%n(RtrZqJoo3%MxC>dki?^?42daUy?cWKLJ> zW{^iJ{3R#y2lPnQv}b{%SZ}gPHDGlAiWRarjJZ~%F_WW0FS1zZiFAo}bR}R_2#UgE zD7$N>lBLtmtK%FXu)Lx8C^^^|%I}(E5*}A=G#=*o*7P`ID6ZQ9NplQJX{%K&>0A+x z%DBVydG$r2M5XYVKG8xYbs69LfAJ_$=Ejkes46SB_*3X{$d5wU!)~7A5jHJ0pbo6lrwul=Tie)j|m z{aUX&JV8mVV0gi2q)UA=P1mD+feZ$gEeso8$0=|dSv6L7ElQ(As6T)Pou7|+6 zqfh$PJR)++9|Lt0yDSd^iX+DsOnfzb%jWA^xiK#s;_O88^M9LvH~;9bUYwgNRQpUO z@k#_eS?V4V$HY+GwOiVa*IgH~((95uM={iLH6*qwoA7)ehFYy7AB9N|CP6S{3&AJa zQ2Pl(Vb*T|k|EC+fgCLL2VfeZudnoYWoVapnv0sDSgN;Iy6O_>#ZY6xgC__vBEpXMBN%k$$~zj z0&Iq4XL4L;*+XGPfN66w3zyVoN+u>XxZU2iE0!XA+8=y2K^%9ZWEI#{4|G zIFII+(Zf28*J6{K>UIJSk!_ZURK)AD#KaMsS&jV`FoSqf4_BT>-?v^tTF?BFI4E5c zxH?WIBKk;NH>`b)Sk-CbUfQ1!VA%jTJXwiPscc##>HjVdJknQ@WJ$Xt!LVdcm#&fk*grxifW zT=iS*R+n2QBz$BWMYvXR(E%Y7m!bCOi!?!oW>;X@nx5ngg+rg(1a=jGsh{D;eX%!t zF2oS@RjrHxW9GhwiHJE|NCKH3Lvd2Zjm3|MF>Wk=EYGMa_eMVt-yNHP!ve-eC^!Np zd0L>hr}>LBcdRN(7yfA7{zU`yBcL7l(ZrV-Gz0POy}@!)v1(`|esq&x8}Z|={Mv{g z;bqrG3?**)wb37kMSuH^elnrmCvWt5EKw2KG$ckTr(}Epp!^@Ae8Q0UAEJChWAP)( z`$ZK3!@2;?o1?p~hesC02y^qHztO|h$kmEg?g8ZdNbGa^kssZB4jO*M@EK@W2?_hs z3eiFp@j90%OlJV*v0ezNwHj{4GntFIKvzpyWLr!fr~!5-B}uQA48@0^)06zT({VJj zULqPpEAv#FbV-zYwV&AgY0&(r)N{I!AJ^&q1%sDDmsx9GZ1N#Dw!UZ@CO?*PjOF8X z9W{WwPK^|A?lfG*qD|o0`iDjQ{de=9%~RmtWBdR<`fY(60bVp^{O)&M7XM4;)xW@- z!0-F7(arnjXwy-~-074%4dmgCde(o6V#xN6K_8-Q^x8*#48JKlwbPOgLFK5RY<118 zjk&D1@RS9H9<9p<(Udp~3p76KZ4qM(CNfT!KSrbFN7eSw)@7!2U!Vy(8yvTrNt=GgoMseSQ&fMRC({Fuq%oYzHKtpSKjN; zeL?pV@bP1Id-zbm3|C|8(&`3lzLWx%rPQbZ(NmM5^zzZI%NYQ%K3t9IzUq`HNrr;U zdtHh`ZfT~5`t*bCHLB9Q3qGW6o(#p9sg0!q&VcgFj%O^l1CyOEQ(z7(0}t;8J562{cwz>){hhWv=#UK=jkB9ZtfWTy8%wKX5K zr_lbSS2vPMIR^0jc-RZE+F4brT77O)oub?hYR1YjUlrns_Tb4RrcDFwG@8$u!f~-q z)du0A;z5>5VCw)$VpmFCprOfR7)cJF@MMoi;Qu zegy8@7+H2o6w%VL&^G+I-nVHRW4=ChPv)qr{S@kNIhx`dhtKlKT&sP)&ik-3#b$51`o zB|{k<#(C)3|&f6J_2L028 z`2{p|ezb7kA8q|a(W*tnqx@mFtJ5&~F}#7J+6osB2}|%9l%dSIuiWq;(STU*z8|=V zLIu+RCO_6i>*{2vZrmA>?D`et5ND`?{)`|IhBD}0%fsq$MOJ5jd zQ6+t}&sxOh9EAmOjg^~5#g7_!CLVomaj$G7YJU`qGDIkjqj36*F+GO*=s}^#Mk-pk z8*&Nm^(VIySmlmci{^YM~V00!ZaKOI?YmaQ%4IK-@^uL z?cWwL4U`{IvM@ZF*rdOn&~yCA(arUbq!luD_m3EGz}Y%ot;H!s z>4Kpc{folm$Cr-7d$Mfl1w-xn<1md%rK#=dVrPYkqpf6(?#z`cSGBCxY3w!BY4rTa z({c2euDAwniTj5MS&%lKX0KIf*!&pJaoD{uc~eXL-YHDm2-su zqx3h0ksm*D-X*}hXO3{SDWgHfEbD;E@Z(*%ZCCcfwv2fyJam?;98(GKgq6dmr1SBD zp-BHJCB^UH(s>bmPkacleB2j zuCZss!ICY~M5uSp^tDWSbMj7$**|Nf@bVjb%h=7)| zKwZ+!xPA6or5``;+w=2_`RsFB)^LE{lubZ9;041<5Ko(Mo5HJNj{S;9=H96J(riID z6erG(jpH8x?PC(Rq*gAC4MXVwBnB7kU3j8(ja8wCN70X8!9IjV+#9h>GklXaDaufp zuRgIUSk-d~Xo|etsO|&P4*IFc|NBvF+*B( z4x+OvyLaO#1{=&{gP7$_`BJ&df%QpTFfQP_*C^QjnBU1Dr^pL4oSRgE6X?ab+R2;rSA0`)Cn^n48?=#$lNVA~*^ zDCQCW92RzJY6-6sv5Bje1~nCPJfyCt3K2^b?uk(>*eXH;6DZU&ZAjI;3sz+yg82_F zQ6}4Okl@$rHei&Due&H@hJ@#_gJ!s)f??eV-$YIvAnF2yVJy3ALxBLB_F1cBEos9Q z!@?4YTB;&J)`|h<7>{jbTQSJKG-x${``MqCEatR%XPs)^X~ zxFpw+O!PRKipIgu^7lj_{Akk?fp9XikxR?c1X~sjR+ZBC@QDe%#6KsN^79Ud$kSPj z{-C`HE!L>`XYwFqu0(EL^Gr-v2-96-RYywWA{?Sbta>8L)Jp#EzS6gk+5c{oApl4&|h^?)j>(R&X zfDj`k!vYeIo$%6JjkOAP1EgSEkpgcs8BsKRPE_)!y*e&4_t*#lmS%e>R*pt_$Bnz^ ziM~FL6(SxP2#FeI%)5cVzfL}5_uyDn;^kIQ^R@lubEMo7=JMfKpyIW5S&oG&j$?0O zJh+euw19g4b)q?pWATd9m}c(>KEyfqmkbQ)n;8WU{~)@NrlOvWiq~jhtC`GDC7&6kKl9l=b9ghjM zu_|Ppmc~nLmeIY%GtNo5?+cCvExKvqsYPU}xdAjR%hRZ0e-)&0awd=+&a5;Z{W>3L zxF0=4(3m+D5L3Vb7ROwivtZ#0hE*gE^kcI|DRyHyiXZ7j5-r235=o&=g&Cx?@LKeG zdNdk-6zn-@_>ro5Ae=XNy(>=e!%p3D0DeM=@(Yd?A_m=v2Fz?@@{R^tl}RyBU#hIE zRUO?U=wU?)|1q4KBA0kpwpt7>)1Wz-$R*a8Wlf^HAZzPU(i*w z^Qn?E_rB8~f(fE33_B_spTn~v+!<&Guw{q7=IbI(=wtI_buNwu+3t4Yo=gUfX)5j$k{;TztqMw;H z-M?={pnlw(VeJXKgcqujRb@p@BCCY%Sf;nerCq&lQ7IKtB5}^J9L4T@!>~^*Sz2a^ zDnyzGbs|4j@*=SK@(mBGf}<=70w4)}8p7mq{#>6^U4-&AMF}2*0kC_=oG4Pwr^`tCD%Nd+|T4RE^#7el1JVl{{xv72@y+ z^gU+(943N3Y%n^}a7{BHXWcD@N@_IGr=}17bDvV zjZ1!}0kOB8oC=7&;p9X>lNA6U0d;)e`UwmRA+7&&hNAtuJ!E`Ws7`}kZyWFz;Od?; zl-%EE6qqGk0vF!S)+J{7grrE%8EW4@g6xO?{PkTP|CT1-|IKQ#FTb1wmOa<#v)4LU z$bYrX8Fq&QsjYQ;{C*K<+!ly2nZu-jiUPnG4U#%SO3>y3X?@9rtRb z!&($Dg83U#i0L}2u57e8Y0&(PE7oA$slK=rkzt^;%WrBII<8ZzH0(8CtVYc2u%~`} z6WunPEHt5UC4QppV4sasQAzBqwA){9J^!K4PoCAvekkPL*XZV96m|0oOCu|h_Sc>X z?Bj0wiLlAVidGt)vyxjMV+vH9r6KZnc7 zR|4xO%qP=DKN#M-yXADI9Ichs=C9C**c+y-R};(3*GYx3SQW}E1^6{56G=bR zS*xsslc7k9Wi546w{~WCUHAjwO5mdYeg{5{k`Yrn5|V|1^jR4P@`1_p%L!HMXC0Vm z)a+Q$XbY;9lPed)%Q{Liy%N*6Ws+zs>z}wZV;VAli38N>ll**o4`Og6f!0!?s}iJ2e8G>(n+T4y#!)~~2WzCpWG2ofVhjq&gy z>LJr8`8nyry0UH7!U8Lwj`(iykTBj2dfR>*J zZ*MRsd0M#QX`4Run}){E0e6`0;h!MUu+qiORUV~9(-uGtFvkfWD>I+)d8(0zp_KK3 z1+~<%9GI!;sl`yGdN1>!k#(~xNGF`#m%LA{pv9JzqV!1% zuhRo@HWC^re?t)df~3u0Qrb$ZZIuMsxF%DMKGhhzky&a7W^b3J(eWcXrVJ`fIakSj zS;I&*p80P3G;Us{v#$c#9R8$k3C0S!XlM@-C7MsBDIMImAra>cwWJRuiKVM`fSGkN zCFv7%6y&NXO^G*=l`9x-GTVj}e49@u7X2i1YhD&9$}1PEANERX&`{ZXuw3G-cSZs| zuS13>BcIg?&PZor?ZcVq@Q2AXoL^>Ra8LzwwFz4GMNyEuquMKNcAZSc`SrV+9m83s zwR(V4R8-YvGYCUE**q|reslObB$rCGbtbY@)5m63D$LzGae4hd@}=sduBJWww<_Vp z5tYTFly%be;^=IFTrKrAY)W{NfPtGO4{1P7_+)y_-+tsWRAJsXqL*K`zG9uTo71@X z8-6gFZUOrR48evhb}(nCnfw^78-z6b`AO5B$%K)^m(ev0zDkDl7e8XN&rR)8YD+%O zlm-G0+rwJq@=KbxxkwA=*D+;N&4D-7p50(6b`0bRi3DY(k{rCBB&y2Ftx2ufB&q1X z*WD@$WO;QP&;op&SY5t0bnZQ%kL#^vzQOVPlZh@rd8{8vpBo6+HZ@kPNJJ*vBBrN1 zD~VT3>FRTqSUSlopY*>t)#yS=4c|!6f4TgUNkBg4*LwQ)Tzzk^` zBRg%xgTm?tEh8T~stC<9C~;gmb?v61Yx7XXnT|jSA2JIguTo01H@RRW-T? zWtWzj3EOq4vA%E7%3dbRc+dhgYEHbyqxL2XF-n4&^;$li@mzGkm#8ma3-tx-1qW>= zoD`rv^1Z!(TpLq#F%>jAPQ2&Pa2}v?A~^wF#>t|y2g(Kw;M=yY(e-l*wc(@#-61pK zOfgU!_4IMbh~tFR2Ad7^c{ThV8XzaK15c@Cr|i)MA4j>yqKmO{-?$EK%6k!^75a$uPCB`XPO+lf1|bUMva9Hc1HVv=>#mkNvEz#N<*36R|| zPE?kfvdS)yf(Flt`HV+!)W`UWwUSx09)uO@OrB)dm`ro}kX^%6M%Ah@b(^qM-0q+@ zwyOQonJ@r=`IJ_+b57eoCexmt6!cW&XHw9d$kEO;-p%Q5TAb9fvr8U8pVVna@4l>r zsb3BBRGey1QtE>ZCT*~wf!&+pEzphaqAc$A|=%Y$%w7a)HBT;lWiI1huOa1A` z-!>QTfUS|Gv@RKnPR9m=NEXpLU9CrTt!J=5(aeLPnDk?qTt!S#whd6|0C=2;6%EfE z;ZU#jp|-WIS3!q2h8ob%ADEmhL%W!aPBko@u;_?PZ4_OEC zBB_sKSUHf3ywyX4)Mf(c|4$j?-XXc>4ii`&Ru#WbJTMFHglGte)A5}MXoI{ z;dW9Q6F)vQ#)N&fPxdUx2fd7KWo83&51e%^rOJ^p+Rf>6rF0G>Lj~uFI-DOD3hVHC4P3$)LD6s~q>i<~aFa<(e`{R)cogmT_9_uHI)3bFH+*_rD#BB!F7>n4jhU8RPE1-fYE_4wWEo0K zzbbrwjA;+PmQv%IZOz8$vQiS&UVX4N4U!*y`UW7U;!&9Vpx?o-Ht^=>7dO%QO>{B0 zuJCc?J}*dYHd*`}_;8|QSt(2Zzr1^YekWoqA-}{OIz;}1l^pdGdv}odJiY-fswGxK zq?>`C(dzMLFuQT^@Mb7QJth}*s?~7moehQl?dZm?#oK7GQ!%MQ_J_fksEv_sTdC-m z4}bGHA9xxv1KEsBfR$%rnUxRG-+%h>=`TOM%W0bpL&0id(wgCF?K)i?<*0

gtuA zFsk1G`J$U49PS$+TVuGojbo+tQsRdi=C}3C!alZ1QG)`Hgtj%xBHNzO68w1AQJW>4 zCz5T1J2j%kh|J+pBl4y81pGG97X%Hg|9;6(`}&d4zK3<0sh+ja==fQ;UJxBCU2BW( zb6YlW{I&mtyZl&5S!2RQB&!r(U}1{{jTYVr?y$kfKP+mvu>Kyp>i=)=U7H)nv24-5 zav~Hp-;hkpuXIf0&B$Bbedk70pXoEzb3e?N3W$Uxlu3d~ka9YI{n;B2K14|XWjnP! z=SEbeE$U${00h>4tX#0@~ytUSCy1Z z_52Xm@QC20{1NAyxR_e?anQCRswYBy86WV1VBeW*f^yXdGroDMOY|tsDfl8NN>MXiC4?pTATW(dU%L1F3~yOM5I zt3`Ar;teT9Y74{mGIlpoZN7kQbzJcVQ?gtOPk-I_KK3p`m$&uH^4IArOym0av7twE z#y4cn3vT&bo<|*pHx#w00g~G#6Lb2xfP}j?F0l;*q(^YZa|R4tz}GHKCzZ9u7e+;o z!Hgy;LD#)E=J9vdceM(Gqeo_Z!__C;abOP`bR+Z2GJY4i6rY(W@cjPu9~e6^57_T% zEm4UQNy>jVc$`br9jb+}Vm$w=<#@#Zx)o`#a^mJ<>eO#s5PU;Wo|7wHD+J5YuqB(Hd40dUy~13e&>#_HMOLcL z<{ytAb<7rT<)&6GoJxADRG7e%lC`!tvrOqhXT$x+@pOWqruCd1x;uJRrC<-U1tG(P zlJEc!^B!v zvYwM(?gftBQpI8MtJaT!Ik#W>*951D@XUul zwJQIG7uCP6j=gGyODL_|Vl{Y6c<|^^xG}vE-z%kU%0BENm?#SND10Z_H*6wstTg8h zK`Cx*GCyqn?58u~usmjvRD!D9$DyrZR`H)1@F>!^SDHC`)NEa=vdNUH?QaZ!odJj* z37go2@XN4_WYEys@6%zJl-Sl`m^@A4Bn5~fWBswytAUv?LoKo`k2quLQK?hXXC~un z2Ye}d*%B1q-k(oz4EnNToBeNsoU&m?V>Ar&Qe3GJUHM|Eu;y_2@#^*#MHEBdm^wju zk&@EQ#bmY5pO8y&jq|@TJ^B!zJsL(wk3pQS+6*J2MwE7LhT^EzDh8v~o zb_b)R`TN&@{PAyJ|L4~~{_)$_fBx;?|KsmTdXwF!_xIO)eZz0WZMG7t)!psQr|eEF zvzzrzBCfBluCgUuzP-Qtcy;q|d-X9*QE}$xZneH%f7muf{sjdbbMaY}>_2}G4hTUR z>u}iH#e2Io?t0W1i(71D1Un`rZLPoM-3MT!dk1UKNzinDwXU~Zt$d0~r@?Ov%fIF3 z0)Y_Lug>=u^DIhz#vUmhRs1roHmol+)}XM%^Tr;VbBCh?axT_ z{JQ%uRSNc-&B|i`6gs>CUQ8$3snBq5Z4+W}2`n@@JFE%V1N3 z_v029MtLbh^}-aFQC5o+dS_itMGb=hxAue2WVye&jkuvN#l9wN`1a$+<#kXQ?dD?I z*N0oZ!rnU|jXAz&P=;%`mS-cgn8?Mnt|#+y^>Fuak0nu|Z%og{5}8e6M23Fw-Z9Zj zR0dHKRJr~cs44NIvru>BFjfTbhM*+&+he8|a+;GN)_WS!E-X#vr%e(oTpmhz1n5Pk z9KBDFNT@Q|XZt|*>gOuTQ9)1@d)g8%+67Kf+S)R;PTIiNz4poV30UKg-3zphX+#CS z3F=r+=MGC$U$tryd} zK9O54)}qXurlJ{+Sh%4UddH#v@`{7n8%Lvl8f0t0RYO zf4DN-?FvAYgC*YBl@KRHbVEu6d)NYUx`B^V`NGKPv85ieQdQ@NcCg{Hgwhljp4OUcm=o%1E9)#T1QPO!)d|NG#qERJZ=g z1cIQj^-%l9>i~dt@Dc$Wg8J632?~clZ0K(-G6{#PdF<3HP>lnxV}pV+!Z5m+uyx46 ze-i6{2FwEfjFuWhZxPFv5^XvkvM0&FLsVOuQhYXR80fL9i1ob@3NClSx-d$rZYnsD z5}OQwNr9pk-&%=zHG1JFNxQPO^0=ep2JJnLIi?RrY+sbf*c{-U|ISEy0~v|HN{My_ zj^s?FMyK2+?de{uyWyJ+GSx6zg7hjdvwhclXINm^-Sq4VPcA`8>mXcs`4cy58Lri~ zA9EP!rD)ZwC?({MEpyJ`r^VNa*pDJEm$!4CeCs-Im_mtJ&Fbs+|8 zWOlv*`)OMV_W&9s5q^S;$!O0RlHP6LT(yh74@bH0DG5WS#Lpb${hkyyrj+@9BQTR} ze0mM?1zlboO2)g9C{@XMP~Z24pxpM);VxuVxsL;PJAH-}ypUQ)nV19>x)1DkWA4Si7wVGbx$rdWh;MVW{+2m8Sz+!SiO@`+V$UTTIb~DWa6wZV4)dPgk;e zZEp#=$c*isg*`SRw%&I^f8OARB`7I=)Tin8;_dUQmYExsy<`@Qz_L+8k|^FpP=tIs z{a$Ke=cm4V^tl=?JdMTdu^z^icI#W+27Az<32K>Nv_5F*?KHuKmqTq4}302}W ze+HYHm)cZx=KNXIeJaS+(nvb1H0+(dy_jJ6i_%}*(S(PPB_Wx2+S{xce8OEAi5kPM zy_TgI7>lE)Ss|LO3R6;o0_J`CPhxZEgMr6eg7V}86s``Pc^Q85(b4rRw*>XcgWwKc zW!4E9227AzIo}09OSilPf&p7rYUD5D=kYzzCu7lq6^P-ZaFW(7K~?bs$?IIp6qjNu zstCi5l(P7dC|@RaB3D(iRZop__tgQ{zICK6-0`zyT@;`cPb1k!IB@H*MC~m>{qdNX zZ;L|1FnaoNMpfi3MYZvx5g#|xu2Uo$vMv0KxPj@BrkEKu=3P${(S0!|q(e$${In(8 zMe?87xQ|g7Bt25JU(K-h7%QllY3&~2OeL!eetPBhfe*Mp)l)9DlkQnz39xw>hE9nf zb>$l?*ju*+N5xjBHK#>x^p{XxY9czo{PT-d4M&sPn7v3BzC1h*lo-{kjKdX-gSOc^ zn>Ob)+n210SRC{ySuf4y(NCnf_KRssoYbZZ_FGzOvw!pvw4x5wboJ zUgJS$SoxslboHzrhpbQ3VbD~m+X%D)3PjBbIGXaGoWrTU_Dr=~Cgatx=HD1&JlmmB zI(bvdD_fipk=S@kP|Ez!NIjPvUTT*He4EEP-Jos>s+%9W1-7`vStfi>x2}<47$8-K zH{J!!rIBy|JioWJU2O6|Eu?$>{|Ju;Ju3LR(@jwJ{D6i8p8pp2uFcUm;Z%}guM%1t z#qH=j_+kp^uZ?&u%WR$y=PfBM^`o+^9U<%w?u6%0{8{^>91be@E$6$4Q|V#?>$7g* zp41Lw?0XxUOSkV-RMsO`RI4%6(I_A`U?*9>7oKsjJE(TEo#Vl|n8f=fi5@|f_;WzV zZ-noHu8m@IKL6l|n8VcAF;^xDl8Zu?vVc7Y3(C>m5Oq(y3+6X=burGf84KcFP`|jH z623%jl&rfh?0B~JwLRg%co)nsYB0=d#~LKkmyz*_eJv1O4RS zXc3gTKc~Pe`c@&OZ$D=<=q!UTfqn7`w#BW;^Tqx+cAY#X%O*T(l<21$wW*2>YK)h* zA$Gb|CezWhlY&Fn$P^Y;Ypb1Y)No;j)T}AkaB`7tgl(K*M{?LuAUr^nxN4Z6Td?j2 ztdI?ELNii9FD91%Dsa6&8upCNVHSo=iDb@&9KStMqLy<}I$09e42SVG2G|@`ls+KFEvFS~8XemgQq-^bBpeL{}(d zqaJOBJ7Plvx9RjhneiaP{mWt^1_V{|56ro0o0V$8=JH**S>5LGiutz$74r|E^z};J zOdbj8XHuKMXVtE9nfe<6DDAUqYuvEGSjl6(;sj;(sSFK4{rzD{+wnnJOgc%UM{w`e zVW%HK-Ti)PblyJKOYHc$7r#vql-WPy0NlGJWW{!x?e!WTZ=?}R;r|SVM^K*s0L*Ug z;?qC~>hhnsmEG<=+1J7_DN(yOgh`LIb-uPWCY$0%qZOI9z+Vf2CvW<=Qr~Ald>4!@ zDm*8PDz_m@SAUe72p#+(^By>`auE?bASKcN@|ss8XeZYmwR|H zF2&*ky?ov6v_CEwP}?NVM~~|xl`PG=pd_vWc*1ANn~=9vZ!zgo{_|{$-{tb=)5p7D zXVzPaeFKJZOYxoK9@6#UN%~b($;#eu=d28Zr0!?HrbqIoyF)6|EOC-kkt)2m1lt1~ z*!C)OSX8D%fO)`N&8|5jZAB_JR$eI;?hSWKuvx&FTYVTRJ=S+zUP_t_61U0k>q>P4 zGdcsp13-@x9-Qk0h9ZM60&|Ol0gF7H;e;UAD`1N9TPxE?Q;<5)PGgOL{Tff@4tDqk zCfF+=Rk~1cvaCAb!%sMlLJZ-4BrK4dEW9)|pXCUGLD@NbTnHMg0NGkF6=_5PnRi}dKyPk~L3 zF-?_eCa{deYD}xUTY?Jx#WS*kbuPY33{E+<&1gnIP+|WxqQ#{3nQ5vbOV?WjK2DFH z#vXVPT!9`n3Jio64X}JGWru2;CehfI09uOx7)H9SRVja1--c;EW1hjjwDDcj?g)zU zzqDKO9YG2H*W9Y^2+Hrz!MAXlXfqZmJ>oPA@EW!(n>1|qFxM$7jGG?AI-~}NE{U-Q zsa#~jIOKs#qV!!IS1)u&P_%yv*l7mjqKP-p?+B{$zZNoj#3^=>nkH4TOOqa(dJ~xR zxKi9YT~sZ6piwurY8OGM1aiVjl%Z)jXGE9F{Ql;)M%_dYSzGKMa&aDN;JXa zlLRfU=o5yZ6n-SM1qKaa+kqVkp9mwRM}*)bq;q5@Q?KTXNu)=ACX+bAhi67SI(j7N zB)TvldYtBz*%3cc^q9rtMJ<{^6RSnk(yc2uvnMbBIkcg1Iz9Xnr zKbbMtQr&!&ti^6VVkaW1knRXd(mS4DMG5*bD9qT$d~4N~O{bs~#6?hh z-s8gL7d`SgVSWUM#aTNyMHn4D?r|KQ5hjWSMvr;CvUyHW{M{k6Az>8vG;&+2_Mu?c zmnRI39uJA}E;)Foq#j@7aw4efel%US7Cd`Sa$aVb{fuTq;^J-`o=OHPhbv5w_Qj2| zY>@-a&H=iksN_COeHvL*{)sRudNk-s)}L*7BcAy4p=-v0i2g)>2X}O^Sqz`T45&$ZRB&7f%D5jI z7jJ>F-7*Y`9+}$PgVv%J=m#EN)`+`nDEA~*SfA+5aJ%Xk_PATu3Kg7{3hGSUky359 zBjGCPv5n(29VRO^ip=0&cEOy!07wjBPOqqf!0orSw249Cyb5~1#{VhUA<)D z?@qsJ{f;%w(oFLfr#ftu6Vy@{-z%6nU4u2?*%R)!SVDX_9hD8=5k^dpGMzv?y=f}Ti6*L;N@rv*NJ{?BW_oEv}%lE z^awj00&%LdGjhc52r8AIf@&2qFxzQ0NP%+3UvwfdMY-}AE|nEOl5)q{HrUeej-a+U z?lk^v9sF*NoBY|W-3ad+DOK<(G~-~~Gilfk7@~hg#7#+wAHC2QW2k;3N*IM?oE6RX zd|2UOp~s?LWmtOeMtBJ5(W+M&f*kgM#+3SphkzcjI(Gr&A1mnW^&?xv}|HgEyY%etPS-~-+D2Kj3h9hyb zN#m6bSSXeDiJJCavJI`m;0Y4IeeiHspcK5(Ikq=S{0%};I(;ACxLHo(;#;g(bIhcc z#-SFmjOmfV3DQoqu4}gRJZKA(RI-Sdro1DisxGjtSmHq?nL@RUF7h~Iz0zZL(+yqV z=Aym&Kl*z8njNbD`z~7UWnt*_7+vTrgJlaJRi@980)uxHRnre+oLO;AQ7C<~&sG)s zOTLf8aOO%FA3dTK;M(w~L=79RcGU`<$Z?}8+r-TDf**)q2M2+mu6bY(4$6qZPTlhf z^MXEV)s0SgFz7L-EK_<=|G57+KF^h+p7|@g1qlk1kD?Nz*aOf&FmO^OzJo#3B~|(u z>Y}fgG%Y+NyhPbngezFsLX_i3M&E;QSA`ud1f|U_3@4c~P?YPqBOAWL_xAPX(fG-$ z@Bq-GWP76g`;RqS^KXlkmrQm>A#;JNZpU|exYi+y_BNc9YjayQE+HX2G6Wghka8vx zZidaa(cRhSFU;5q2{JZ=aeo&WB>Q=J%yy;ITH2G*$MB65fd0~`^z)I$1W$eVQ+N3& z`+sM@BLuD~`=Q~nBuEn9?O4(yq=8+@fo8E0bb?~+p%c2`DcFW#Wb~-xFm7kczW|N- ziBI_ars$cYM<36z6O2{^=7Gox-kITKN1><3EPp0?dUWw;qNm3d$EBUlQKy;le27A7 zp?mR_{uo-+0!y3*@FSc+1U1z$SJQ7_n5qeHGqwV@MvRM)5L8b`PzUo)qggFMMf9Le zQ^IX)p|s7m0ldr%1 z7yAcF7fPWQsj90mB6^JE9J6WEOV^tfA@KJECCHC^dR%BF42m9yIS$IEYVSMje46%= zQv1c`Nk6vXfuKi!Mgw6?edn7@l@9W`dxB!*$7dFJs$Pt)9M2HMBBMtgV|N_W*de>j|B~V>n68=_sLF6H#6nSVNmqg#bnPfB#JqjbndubdiMkc&!FIKiBjDj%j=wx8KsmkCe z3qvAIIJ^L?u;w+uiH=MWlo&sLFgH2M4CyMaSL{7Of$`(mFi9|lN!!5Uj387LMZ$-n zDe;{b74}<9MagTal2dZ(D*<0m>>Uc>As|dpFdaO@a*RA;D(P~P{y57d-;_!>GK~O4 zkB&@wGj#gct;|s9edf}mM?5Cv-`0qC%HYNy>k4CCus95p9vSiV7WlsIfhe;|0oHiq zhM>ZCs1(<)SPwQn-T(fl%XuG|D|c>p%>)cnnS0yOBP*d8Ezh#su2|S z-e0qRjW&EU==$0v6S3j*LA(Ujy<>AKDVl~K)$-iZmyf4_p9Mi@3-zJx(NZ=^6@+AQ2Myc@qi zJ@13N(=eX7uQs>n$sf+In@1F2Tf?tv#*9+p zGxM-5hAY`$^h;WT^(i^l;Dk>bf_l_r)n)Wz`tDxFqiGY5@h^tK(IZ8Nz~RnRiw3*B zV2gT;1@FX{hOhKzD=WyZep&wNeqAomV?B5|YWkSB;606Ze|T6Zv8&1PRB!-OimtlU zeDsXdiXMGByOm!@Dj9rPI}oq};Df7N;#e)(Dnn=5;DzH}km1pyN6#)dTK^+BTm)65 z_v1f%kB3$0(f1HRN$IEvf-Pt>i8ILnw{0;6zu7(2Xl?yHvP_+z`t6M_9 zO^Z>y(b*kFNROty-61sCmoW8WG*T?9ftUXF<#nRz)TdPHW5$tNjw&xB#oqcbm^s!s&fqF;{b zJur#6m?-gygRvTf*qeW0K=gP-OmFs%GP&o%IO%bVOsp}TKZkfc^5wJ#B9LQ zG0wIb^Gc6*9KdTzKStMW2U`t4b1a6!7lg6W<0FUXwlvDRlVX7|KuYAK5Jh6$Ma8C0 zT;mI`!_;b#bj5~!Q;aY|dQ_#m`>eYq31gtgOI|I8{fU&)vnXMq9WPvVd2*gvf>kZx zt1NIH;mDUiMCPtx1-jDtg&ykoYF`V(8n5;2a zVX6Uhouq(P6|lwTDt%n3@6rCyPXslekH%-dwbDcsQ@oMQY_7wqcAp4pHG71sT&-NP z$)IUcm-@I@Hf7Gw71uIldv6Jk0X+s32< z0Dh4L=5J$K9RoIOhQZ3^`V2d<<9TaC1gg$r_62%0Yi~3hGPpHN*>}VQ6J%XuNU))c zM*gt#q}vJ&)*vi`D$b{GP+K303wA_07hTE~aTe>3mHpQG2qg@55i^{=bbuUX+)pVn=$f(P({AO6&; z1ly!;qr||j;v?ES{)v?&KFpD6>f;03;U`!tUL%~ zCQk?tVs;MH0`_>xY{qF2DnW_uJ*blwHDOGY7$EKQ%WDjk+yu;gb|9~!$C^A7twmEm zN7lQ3BB=5mbLWF$1eUyc+^)iVIzdhE(i`c~FxQb9 zUJuZ7lUi(_;yH6cmSuxzFPRZUlwM_uvik z>BrB6u~FhswE613VDmtHJ3P#kxE<|bKB6!i8+jll-A;R?onK<0;vF7cN{p8F=wfeF zv=^#&1?FG3Yeafs2@2Tn)32`3*j=4{^w8tcM>8C}f-tVA3jOH~ew#`3*Ij3Wu|dY2 ziJhwS;;^)Cc$~;HaWJOvVAM^UNo-pVhKBFL6h=poPLI*q*)ywqn7-180_QuzVjw7V zA7e@tt)V-E*q(Ozz%nYefuNfGnXto9DY59oSsb#FX!tPo#C2sBvr8-ugQLV|qF-fH!I+-2BYF?zm}t8oqKJ`rpd@bj?KBR8}3 z!(7FUmr)DiCD>KKpg}OnzEs>!$qZ!=SF*(2$@f-u0e-^=`k@Fzr$>5@LdS9qw7NAf z;4V=+msVD+{) z3U(W{=uN#v=^vP|X?Q^B5vrpD;zTtzN@b%#VO`7QFkE_k>f|i|FvnOUAkrgOC2u_A zHNSV|(yDD%3XGgl-@7nEN^Z1>N%X#~23@st!U_ai48TM+uouJOgAN2E*kDSGa-}sk z@WVvl7{3C=1_M)Q(@V2j7=5DH7$6Fz58pBqu{KrttZMZ(h?t zIecGIRQ8WsyyHs2Jtup3JrmUN|4G2<(WE%wwaUk3XlX9PXz8(}188}v%I8A0aPG7y zqGS@Q7QOH7;PYYZ^yt$$OMLc})8kZeuw7$1cqWsLP3gBY9eYL->;rHBxmN>op7JoN z_sXwkrK1vT4G?*=+9hf&S~!TDqgKB#Ym{I!fVlC{k8K1xdbI0+Q0DlOhl=e_n_6XU zocb3j;s0S>&9UI?N`>Q*q(uLRpy12>Xid&xB!pv6#y+3j?LZpCV^(f$z}{ zD#L9^H|7p?{byu3N*rJtp*A(Iw&4SoU=IOb`?dmdSir{0H>k?oQ^!MQVHhVp3UwH# zRn=5=!*c#C>OS*Gl<=LffKZmQXbXl?#!>5?9)&uLe0UWW_(E?v3gx)dc$7vOuhB=a zPeB;HU)cUyv?WZieZgV01A9me!-=l!3HNxTP-QG+b6C3~+5Xc)gYiJH@4?~0*fSr@ zvo#PERMrg|6AuJiAsmJ|G#+A2r3X??5n}IOS+O-NU{Ocpc07>kk}#^$Hh0{*Ee$Ky zN%xzRE$I3rsI?I>i?}1HQm;3FN{Ls+u*?qfR2D15J~7S@%O3NlwK1w>*+!gJ52Si4 zjP(hs&g2l~PS&b4f5ljdVOW$1*Qr&WiOd|pnOV~do4BzRU477@Ib05gB=F29!xe8aEh!2>g0Q8><>&3+r@e^OtL4}4aZs^iG_{n zGpy9-l~Rw|h`rlH%8GO3h;1kA-n|GWe)EUkrTUNE)rU-_-@~}+u_-RQ6zl~5DwlmP zVxH}=nOkqBf&7~=7zk~`Jt&+yEq=0$-yYH*uxT605ed1G7l3iIv4<3f*z z9T*qaRQteTG(EP$kS|5d2DboT@s$6W;B;+ZdaVrK!m06@+&cdhKt+!LkDN|QOl&%x zx)LJYc4x59+&7LN=ALwOiy_2;*vs&8d^N@c!G;dQ@%UEqfa5MXiQTT3YFo^m_ns*BfN>pPpa|2TkW-E$&r~w-)a$A&rtR}T2keKRQG`y08NoKuQS#N9pRTD z*_ohUr9&3m^Z+BrMfWu)Kf22Ip13@|VP>t1ae&-ZfJrLAo&oZTr zu(L1__8-UlVM&UwM;j`<9GN6t8KfHtFkzz25`xm~oi^|qGYasdk+)Z<>m-alDXUgpk=(_v567{b-W|i=zdQh_Zn=}gE#H4N6$F@!0J9@ z(a{D!Fg!ezC=WVXvE7j$k}lo3pL!cGu~m{0Vk-{>g}lexui>YD3Aiw=nLOV~bivz9 zHXUu?k?O|}1QolFEPM|QHC3IZd9d8df#3H;DgX*!lGDxWs)3nxXLWBC&uF5w#TnUK&Ogy8R!sc713E;4K zV=YoynL$FosP7Vp?S;d|(FCQxkJhd@*P&}~?C<^r!Sf<+w58;JgHx+}w zRY;9C1<)0k{xEpz6znv3ENdWiOo>8}7|YX(lBQeqxEE%8qLg(**(Ww#L&A ztjt<7zbZ^@9b51?S+p+v6W6NmfuM-^F$1m3(@N{-DsH+dv9p8V4t6#;!wx;rWOn-E zgI#9BgGk+lrM(4kT)VO^Y-VP*V~XvVnVFgGm^o%_CEJq z*mYmk`|F>oSt?Df?pcyrt=7_~PsiDVT0z1c^_o~XCR>W`R5utRQ>et3t05B}IJE^Z#DQ(e%Gve`)S zEl_>{rv^e9+BskXQIbiBL9V)Yw;TDbfAmJ`Jb(*j{O)czQO!cuxHw$pVUVSUiA>DP zbSispTzTXmSKsn8a_2o!s_u7p*Nyp@NAR%>%=`sz{v%u&(3U?^1{Dw0#3~Yw*E3oI zvv@A;>-&D*D^}?<&{jN>fuvxf79~88v0f5rduTQxPD(ut%lk8M-o2m(x`*9?SxuEd z#gDu`f)Q(e(}FP%zd%zR8S$BseV*0A--fPh-qHFI*_YUHcbE<6Px-;x`(P}}st(=0 zvD(L@g@P`S34Yxm*Va4c>aKZQZ?iRPRtUY8jk`to6Yose@Jjk*ii5^in)EHV0dr=q zLotqcXeS$c0Zaf{qYTS+*icgG)pX2N9(xOcUJO?1v)$qJol{<0F|ixYyu z!hw+dPFqk9RMmOJvBv<%%}(@?Ox$)C9;>JI@vIS_J>nJ_oOYFgiBt71fw){8^pZqy zG~ar7Q&2VI)9ujD>E@Ro!+|9do_ZCf`1NxKEOo6jvj=RiwVW!C@C%PVU0dnj;H`-n zJH};Yc1T>6|7-~0^YAe{dvbX0TbWhkgqlUmxWuHafOOq!&MIX^Unfs0Dw~-8c{hN= z^bM*t!$~UsJJ23Ul+P>*-S{nx@U0A|Hq7_Y0YWwmBTEUB2+Y&^>;%PKO7g26BFDqH zMnT``qA08Ie(7yo-g zCZ?<*6C7CJQ7f#TvgZ^WwhKtM8;tIr1n0#G-hECXfPh8_PK4ow%n4z3&%L@D)llVz zpOLy}_nONx%R!y^1_Eum#9A2TD5&>Q`HC;!q5;x~QAktvq6mi0&;syO81+C$ABfzoFNb2k`&Xj-FQpI`obf9`k0Tsi>@4I(n-6{EW`H~}CSI$uYy zeGu%6D#pJ53hoW&KwmWRQ&Hd*GJI5V;^Ce?IIx5$SvxM$iDvjwxW_z@CZyQnGrYAy zyb|uA&Oqb;k$bX930fVJpx~i?8dEdHu&& zX5{`yV86SU;Xss^<+Svi-V`4=pk?NK=J({_S`xo+gp{bas`a#3|*bk(%D z8ZR*JBH&u1Qlf-3+4hbTzO|r!K`t|aUiv-6u<)7+)=}jHVE05R?F(lBoa4byR>s@X z!{TM%n}^aUWp8NhUex~DYDSRz^a%qH_0{n{Da67?b})W=tyTsNuJTYGIyEleJuc=H z#(44 zcbo$4K~)v;0%WFs5njEIua9GZr`0`G>aA$CF|7`A6GPLu5ly=%2@e0oR%;dNto(Up zi2T>nkn8HTz488{@4MgHC;I6@M>?Z7**sk&bt}aM?yJ=U`*#2mqzt>yg;=|ef)G!C zx*iF~hB&g9Z=Weyj&XG}0!2+C<_|T;I|q*^Sb%0hKZ#^hsSJM2jW`A0RS3_aJN;R> z_cvvl+gmC?`^jAOO1}$rC}z7@g1$jPZqhXPd_umjUg(m=&4{S(k}^D*)0njupcL_=d+0QGDPwpWaT@)Mr&8pVxe~T&e#F52GsF7EzFIJ&cH1C9Sh(7-fLg|hZ=u>cvKBt1 z7~Jbx>i$OBH-DI{WA$Xey(55&tHsd%LN=~M*mFGaM|Hnhm9>2Q3%4>&wG_i)e080A za)N{i%NMsu4Zr0q1eZmJjjrO?T_PO^-;ITi^ZYpgxYIVAb<8T?&-5-Hlr+H|LlZWi3^O%^0bTdaYx z?`bfyP#FBns0IY&qK5rhYsxDsp-K18bn`#XE=Me=$^hZw5B?W)yeeEVd1JKTX>a^N6HB~6dkTJYO4 zGd)6e!{LKY*xv52Ms}YZfCCp*JfE*wIGo~dF$UNp| zf_Iz^vD3p{#1w+Om#r4d=od2kHRZHq22J1aB?h*L9FL}nV9|}7#n=6yRE&j1gNlmk z3`_=hS5aaFOTHd;$;*rovJcWAX7X?fF!e4n*dUa3cENSaZG5Ld?ZqlmlJ~@bv zAvbbCz{tipfcx?1nwsAA!_13m@2-5q$y|Qj%h`nc&$d|3uwhwBSP$ujyt@XR<_y22 ztBX%eWo&^^2ZjK*p#$!{hhDys`-CAfJ*ELirFeH<+R_LR>n9R_Z3P$~}pt#BUS zieK_<_Q8vmDtCp9L_cErPhzHynB|XjL}Mp9^WC=E^FLI`+))8K43x_JhDTD7h&r-1+15QbOGCd#$}(EUMZrx1gbLLH-**!~ zpU+o%-`?wpBWa_9h-Q+;@6(50Q^(L>)e8d#l-WXf;Xp{gzpnu^ zR47i}c`TqJK^(vD_e`+T+yO?}sB&i8FgQue_(A*NP;mWMCY)dG^TldH3mAU7 z$#u8Y!QrKqP|!ItjQ4ELYwvD2_!>PWRX6_rFNJn^k)G53@LNcw8Bx#!a2*aYNsOR$ zhlUzxVp7MqzV%d~@@1$YOJ5v=us!YI*o|R`$Fb2pVkIIS=%S;3(S#h}xFRp5qFUTx zFIdD%9CdoaK7PG%&E`88dZ68gMMW5@WI+cBoPhN$@Gv7Ox(WF&dv9>F4%7%Nu__$DL%QkIwQbEOAj zSIZMoW4L+4O23Djo){rKFLpPK^B^b8iJ2)4*V%d6O`#k7+s#%mU&n3}2B&wZto zwsBzTv2vIUFX)yR2|kr^;N>3uA9~miQVRM~Di4vHW5222IikxSXeuW&Luux=a}%pW zAZ4EY%;Q9cmlM7f);5w-;(x|8Kuw0*cKd0PF`quMw-{GcvrZvK zXn0Km&btHf-Zw()55SN*kDw3UX6{kmyRrg4^PkX2F&-QuofjoO!q zg{gL}NqB-k^Q?oSkrs5sX2;sP(%tR+=Ld8~*?y)&2Gx9_`C%iaWQ}e2Ri;*V5+DX` zkR&3PAO0Yo#DfFA3|tE5QXp(vG-rkm62(gInp4lp3`@FC!w7K*yX+ryTL4XeA&oMj zXw)i+`}nGbRmo@=E34Y!Ib4UP7YTvsT=SxhVZJ!-SVja$l2Bx6(+=fi(EJTB?LMJ5 zVMG3EP0K);<%PGL=?CxU5_kc+k|NV~bCuFAa$=O&@xB+>Z?RA|5t_S)4zU8Jj>C%` z&BGvNv89CtZ34y4AltH4ie`>fhxaX5arC-AjGFLTorJ>mT=vTgz*}^G+~+lUWAJJ^ zh2Bv z4|9@;_c3v;fyYzq2qBai?hUlVzl|y@?GP`FA}bkAI}QO0R+tQ=cJ8gE&-0gsZPqGpzXF z<$w`7Ty!cuRIUccycbA!+$>dZr||X1N8mSpVe0skPFt5$RwLVHt&y&dfe<~$K9g>8 zs!mPYQXewLX@}~DB6qe&Ui@Hu95=Iak{#dKtzUG|HNjkGBNpX*(;nJ6_o#W zS`Xt|au&Ll#7i?OrdYiAb#yg|3q1o?+{_w(A<&_z?XN8`QueBcuuMOQ@c;xTgB$N{hvFST z>Wq?R5Q|MIFMheyWg+SzYwKeLF$O@OJXFV1jPGXjw%h+|Q>AyB3bmMkLW&4?$RBCY z`!R4oZ) z4S^A&TQi)I&u_Q)79faHFG;+XBb2ZqdW3 z5qX)85B0edCh7XE9}btUQfqNv`&-N4FNIhjw{BEHiqpLAj zMv2V{%O-TojCJKY0$tUerwZ<=7L*{G868S6#-$SQU$sH%bh;NLQK@UeA`6o*`Fpeu z8KaEj6mW3(h#tw+$@WUwNWAwwa&KHplfL$Z5+Y7wYG$HCuLx(=?pPKzjQp^Jw$xcO zZTERd%>Qk}cT(4~!e35YL}hVGAvU(5#EmHo9`EB+TV^~q#J}f{evCi$)Ft;@^=-#F1)-{Lg;qYNM- z6o(XZvBGqVn~y|RG~x=y+BZiqas|&A0HQKzBNexiee&YsKNx~KPsa6Q#PZc%_gKlb zM!Ro3h)D~<)@WtLM9{5Cs}|seE99Z?{KeHLXC!X_JBe7q&fYMq4kR9etJ1)@{_Q=g zt2wI--#(+FXY$y8~=fYx*!CPIx?egiJJDHl30QWycTy?u+B$g5O?&V24cHX)|{mDRyo>PU3r zbRdg&3dQEXSiG@H(Iji8#$&A9?Bx_^pWTx!!9SUp~;ur|S++43d*@UJJ4j6d|{qj-stN;E6I)i|qUfXLNN{!1qi#7SWbVmQ_f5rHBe-X{wcK+xt6O?IT;I6ce(l ztD|_6KQ%r2tOC!b?<5AkG9s!FdtU~BxHn8%U!%91CVn{2)p{5UDvo>dLS?L0*k6qT zYySMsUh!D1fs=}fTE%opBTw~4>G>&9IIDCWxSM@Hil7HolQ)iZpt?J~{UQ2K;u70tYPFdk_U%P!xtHb%Ah6xzkvVkTk50q{a z+9*-ot|4iv4AX^`t@HFTjIEx&?D0D7246PSQ;6kd`ggPF-|u2JQG?7C9a3u7@_b5H zCN3*cAa@P5u|CFq$@4UYP}2P7c4y4fH;^nWJ4;R=ZrTgPM}2}fo!DDWy709u zpa;Wc{V%u-!g3wEK>v+HUIC=@fk(+=(J))DG>VV1LkwhH4THJqR@7=85DWi#`1xV% z_V7jJ^oh|{TD3|A2^4`=n5ayz1Hb5WR54d1ij)lR>QPz)z=bJdTk_t0Yedo*yjb zk~#p^eI?XTnVG`{fSPHnlxI<}9(o+y0BQOC7C<;i)|62ODIK{{Y8R5mYJo~%X-Kr2 z?3#yI#0yp2vxj)9YVgnqP^YW-h2Q5sGe7@n?m}vZQW1Ys_*j5jANBm)d@=|3ROn0j z$2rG|$b7`twY>Km!C5ll14u;gGS(5f zof2;hsW{EC`|w%qt)@jOrB<3|$l*;XykXHevpetmlqsqsq=Q3)6GqHkVEe&jT=TELmpR-nuyoxGw?dTQlt(XY8l1K$HyYt15Z> zFiqW*m6h>v8t6qT7fJs-{R~}5e!FVlu^W9~)nHh!Uc2t~VOyT+)gH<7%J~38?|JdY z43&%E7Mmo)A{xPVL&dns&6mNv5V6oHB@}A7T*;<8`vq;P*&vcB^(k#b<38dJxG87J z#U3b<@TE5{MZwsJ{Uw%uX@=ioj(Z{FEvHEQ%8V|rD8pkra873rdjKIef_uQdB)fR;5APn$q3(GCj>XGP33*$s-aWOxBIgU9W`{pQO^p@T4Y>-%!0(S=zHtMu8Blfp2V5x}5VG zb>WS(`GZ=j8lr7hz*ndELh&rBp%~9lfp3qlE?NgPlocS@}^F2{7x zb!OsxXE#Fs&LXZv`}$*`Y$ToXhHa#FSIu;57^e}M&0m>i^6<7(}Z@%{XRtbZ4<9RGdP%oMDe^vAglAI0bGN}b=!tG)n+VIHCo z;Z>iURch74xwA*I4>BhX^xIO&!BE|qn_$lX00l8Ef7unJ)>h7~mu=*$lHjDc*&e}$ zRI-U!(rj!f&D}9BnNXZtcMOu1J2^~Z(?Nxgf_6$&ZcFgo+?{PVCAa6|xpoyEqu*uR zb38FMp&f0zq&vke_VWj+NLh$mAdmIUeVQ5~c59wtr8}PS89K(pRVjRD8?Ij_tjW5n#kP;fW$i@N?!)t_9GPUPVBPzeZz!#K_z2%!?2mDK{We-VJ?&+Z}$6ps##2rXlYd z0mW}Wf<`(-w+ggiz75~?YQ;*t)oCX{efw$)1E=3BEp&q@bZM1)Sv=f5|6wAJEQ)m^ zgCTT6$~SRhEDOLn^2ptmDE@ge)(k-`2V zl?EwFzr`0}vcraK(JA`7a^^BLGdWav+hydbG~YlMAh>C7Vt{c+$$gUYZ55N>R@%na z{NN*5aIp~qa>D2$G-~X-#MUbRw>5IAC}GP58b_SwwwEkd(P5p7&CcAy*#`w3 zeB6g%9nTE&GXpe^)W<6)gRFe8yH;(@M0)9wBeZuKxN#|1&RY1{R8!nYdqi^|b*=s- zH2?9DUpBYYJ`qebq2Xiobg54^y#Q-1HEc!`$QV{uJR>{2g!HWZ)>tx<`gpv6AJlWP zYWA5$Qf8e#hl2>{!qA`*)#%Zrspiu0?fTg**0C_lQ7W&fS6uAu#Pt30?&~jQor5F<`4Lxo%EFYh#b;Omq_ALcTaVn&j&j_A2W4+ zZwGC4pKlwzpCda-_mrIq*VlC~e?oV{H>@ett2#Hb6xMPy%{b1pM0NCabxmd3y}kS% zZqJVP9?y(33->3dwk&aw9P*&don1iBj47Fe>1Nx?!LDVg(&GoDt0pt znIB6U1}! zp20cqEAqbQiO2E!5Fce{-X)5;NwN+sfbp)94} zPG}bixuP-qJHJpxyg#O&hGZX^gg@kpH^a*$y;vj-!li|w5rKLFhxKc8a$2I== z?mr!oj;biCL%FTNQLX{#$*rxjHA(C@E_FVRK48nw#!p~2#&}8rc7fc>3mpLLbnkF8 zaT|IeigP?RJNxs=dfX;#qp+%+(8^wr;YhG;qHQf$ORdjeH4jEwD_FFOXCcS3gQ?X1GyxM*T=gvXIdB2# z<93e#K@#$@0#1Yg#O(KNSQ){9C0^Gv%<|!Yl?EXpTtggP*;Vdey8;m|0^nw#e&RAQ z1#RJnG7;=K$ZJU^yI(5l&(yTXLRQI;}& z#|lXIX3Z7~lCDPMC!Y<(;=vno4oWR*Pm%JuKByQh6sf8_4K`mBF`rV6ODdlHbRVWI z{fk_qIEtO=8~=v`lh3&mDqX1uz#Md9e%3FRxNJtrm8?9N5C?`1uR7RWZ;9D>e95o9 z6xD2EdB*f-P0GqpYcALw!XLMzdSoChr$i6P_>{O-*P*tBmOPakWM{a18Z8DS)S~yo z+GVr;?ml*Hs6HTI^kuo$891yr9XE1*t?Qrg_)RJzs0pA-^Fki&)g$XY|M6{aEf2+D;$$iNj zbL)KAh@`+FBxI|Rc@*iKZKhuE!v(9OJ00yQnwx?IAuf~c<~!=0XdI~A%_?nc^mm=P zV`!nROG)!6ag3BoE=4|X(&%KO&I+%k78A?wGwGt9_h!ryWZv}-(}EIl``Mz{P@=#$ zb(K3Yc~qVkrp!t`4@6Blf2uzz|Dv>H_c_;{sDY!;4qW&d6fBuvb799C&c~iV>Zq;XEyLnoHup7#dQ;zUW1s z8n|GVUcgWD^Yd=jrg9Lk5T_DXr$Te{1=wo*5uwH-YgHULAZXLKxRS~1`6VXO6+K8| zTFBPLo37<6BVD`hcfMvp)K<(|st*!`w&ekeApL6?P(RK1IJy#-ZCV*I+uTDzF|j!% zvEyWG779vzYKlD4kjO_XsQ!CXT$I#aiIfObN2dsxA{n_szat1n=|v_toQQH5 z^@d?O2JB!%2M|kM#z+-uvcGzo1>iD;k1BF?iX0R+hIiT!jtO}9<~X%H+^^66!jcV$ zBQ+l0A|7I*FKr`W@nY|Aod8^N*h*C}ULV9W8fV#vh6g6EJBERoebLD3(PJe-GQ~rU z3naC>sr~_lkU7||f$H^A!ibcqV@M25kgr6TVJB6Ad%Z(0PA_E?fo3~&R)O(Q$nfb_ z=UOPejY`~rL9GHs_uJ*`ikSh=VJzoq`9{P(hGgNoXqtWqH~VEsphKT)4Vd!F^g zcXb7s)BzCc+t4-;cP7|96v2y&+`{-qdG(s%MWk=BWD{5wm$zWC?|QC5)g23$7sCv^ zRYhBL-vf*<>`z?j+Ix~(Xr}a;B7OolKX6Vbs0I2^E0u{PcU>$%#-K<=hX_i8zTk+? z)wix=A95<1T13GycJm&%v{DVZakk^3HWVc#ihkJD6Du0o)wKh!<`Tsn)_tQdd&@Q! zMKpV>H$x^#W1=HcW0ZNsB_tH_-uwv4x(Lph}zy3FFU#82QJbd8I&~IA6o8fxv{>p5; zvI8^g-3;NeNy@u?JSZ~KhEIQM{&}nbC$`Nf0Q|45N65L`sMD1mCFks9&dZsI*d(-4 zpG%F@U7ha*rHP$Mi`YxF{Aa;e!Auh?#dm2V?CG{M8U`5YSIIkW$0)4Yt4xE zB;M!@jFHzT$F!~9e{ttU(c*Th1qKrkLY9rN=maExZzRWiT}Yz$8g|a-vc5jG>mqCJ zVr#Q6ITR@D!{{}vGwKRGHbI8q^Se727V7^BCQQ>wNY8p zAbGmP9Tuf#o2sO&LH9)gzlAFzTvX%%qqzbw13HhBddw z8SN4`fTKv-V5^1)o^l0FXpd?|&hy3Y2MODaY{cgViqG;&=Y2jg9ALFN4x>X8T!x>c zhJBRW6iV#APaLv9r1&g2Q%yB(Yjq0;?Nla@9{0z4rSG2bErvEggw8t7gsn|BA;1b` zh&)A_3P++f1Z9s#9Oi6vI1d@$k0`(|NZ47<{Cwtp`ID&seXS?AeT6XVxS&*eK$7P= zO2C5}1#h@!se>d5{+Ju-DwsCh;d57lHXR8|)_AO#DYE=5_OpPmLsthE2?OyFs>m0T;1++o z@Z~gXSLlN?87z6QGHJK>_V@<#`oqrDZ=MQv4ie40`4Y{n4x4G#(+$;qi_U0`uuzV^ z$24B63ssub;6#d2un0w`|6c4tz^pf!CZ2G}84Xu}p#or+n+X?5JUK9Ij4fmO*6i_9 zepQmgWeNuw+d^66JGk!B&9Gr~%Ts*py_Dn_?bk{d9Q2=R53SW1Wvo+d!>0zd3{{bK zl>us4kSp`*vWcu|Eun!OkdwTjt?DI#@3g*m}FnD)pU950u z#jNCt_me}L?M3FLIys(v0G}Ynd8V5q)1oIm=wnXH;|3((%xIOD$$JNlK|pZ2i0U~G ztdRjak(jr}%z|jIOPW@DM=d4{gCTu(X3UX-STj>9JGp@sO92%&%>u1*a-*VU@o?C& zxG7~5XFAK_$tbGLh-&@He_Aym2D6NX&3z&AErX_#ZFcT=0FOf~wGSrNr=DuAbNkkm zu!pglWn)G^~o))?uTTel9+6Fl;1Ftt8>dGu}*(rVyaMoMnYGlKVd@mYgnYpnirteAk zq@KRIQ#e!~IXVll<&$cPqd1<1HDhD%>sN@K+T#nO_)|`JML{m$j_>Q}{+jM^)vM)t zA$ir~*A=+%f%O}g^YWS}FJR%r?4coB$Jx1nkat0N<5#$^W7o{!MguCZTX!W=ab**g z2lEoQa+M{U!!_f4Z#cfi`tv-qHu|`vvR}yB%Ck?_UUuTIJSck+YR=005SH2>+h(s@ z^c|%g z)ieldc}cLpB#aPkJXCqfyJj> zIKp6m5RisoBu**=QCKvPR2VkF35P+>AcTI_Ym_e#k)rWnbLSrMMZC9A!|<}CBSJ7J zuwMiL4uT1it4OGlA}F9@v47;rm0EHDrdcwnmU zXlm`mK>yb@CsD>0j0r)o4$V|wwqg*Bsd}|uBpkjy;(Tdt2*P&38hD}D0u7EXu_F)x;_UMjcln!9K+$QVv zCUp;&aQ@S&+0+dV;{o)!7LZ9MEuyvN;LjrSIkh&B)Hq>hEw(`PyoO5#?Qj7xkoUDV8UdVlZ^Bv4yd(jm7KPP9+rHqX^o=hvFJWkMP&z0dvO89*hggruEVt99b0eSa3W zg7r8dLV6{ixYGjWGk zUw1KygHsYT*kz0ff=QY5>F+%tmVkw15%z9MQnkNnNjTCG@9oUJh4DS2%A zsXHa*u-mr+eyaOLJMv#Q&C!&HuP@!nP8{c`N?}VYyLO>RH80x0+b-S~Ca_Q8YrmP#}zpfub!Z`(L zZhcnR4?d*b(dvgT@|4(uKLNa(bh5z-1=L>f|7W9C={eFj0~<32XuWvYfl+gLJ3u}UAzix(e^OJ1S%xU_sA~kl9?(=xaT${Z^pB%kHPP%^?@sR3-Jb)49EoF3t#`QD++|si^rvTcwk34HQQvbKD%%3M~G%Z+F ztx6Jy2+Zq?N%xW8zaLOQo2I|Vg_wu$2Ptc^@3M}g^gERxjalsPG^;74)ocf9O&&j0 zBINd|$n%A1(yb_-=agJj9N4h-W0MAmCGf@e=~ba{i(5&{>1cTA`>2cwV3NBb;aJNK z;)08oPD>+{5M##1FnCFhsm9wl7yh`!Ddnz;N5WFnJK{WGUTmQ*fIFOah#E{6)K~?H zZ*nBh(M_NvVvgSF9D{<&jEY3qDn?0Ak+JXGW=iehiIathm`oALCC~8s4O^hl6?oRR z&%5^&zy1YX6~OE>sqe&pyJKl`n)nw$cDQGnlnfBb>93<6?eXRPRGXYa&dXm9^l<^EH8q8M@>`mZ~Iwuky}QDEv1 z3i$8R#&(XT|C@LeiiJ!j6j1uhznb&k8vH?DfJ%Yh$=Tf0#`IrTrvFWW+o&g7#3U3* zZ8!Db6Vd-v5HJYypYH9yPfPz-Ejb^}pzos~AVK=DAY}hm0ZjctgO;HF?Iiz0%fGtT z-0-@^YFzw}Q%|Lo=erH8u;`hV;5 YiZYNuEBb5jh6h;!nqp)%G%)vn06%!Pl>h($ literal 503239 zcmY&cmb8r)tbvpyGx6B>-};Id08*@Bm4&aJ8AE z9MH_%JDllwevxe_ZIH%@sGC*0CH#e-t3=L|{FHn>RR7zM?x~P{&R|f?!6N6Nh*uk4 zlaALF-d1KDh8l9qp8qZy@=ADW%y%mC!Z(+7kT@_AXgH_KR8w@lI?&8(UqtvRAn&7# z)SY+E-C$f~H067V-bToE$pXI}9bu&uRjOT2p#4JqRor}SB|BNy?700~H3)OKv<9cv za-rE_r<jaFq|p{|{Uwvbl6R)F*C4ARuU;z`0p5IQ=lOHu=9#rhlM2 z)0DQw;Xv-f`s1r{3Rr2z7vB@ql5}6GMd6`xC{za~W4cns0j-H(6iAD8;n2TF>cZVF ziYT%Qg0uelDKI1$!2X7k1?WshOvUYVjIo$7iS~z3@}1ERF6wr@y@+K4iHQtyZGJxuH?UW0 zITBGXjbQF^KbcW;VEjQ`(}{UNItb_@c-$Y->E`*>9bu{dd*8*qiUB&8GC-9FI}3y3 zws;xrheP?V^|A(DiC(N*Pnt*ZIB$%O=AIXtM>z_e6dQ zQ}OX?%12yunZIQ#;RhD)t2SL$>0E>0+_&fL!g5;t=TsuRncprEnPEjhf8S8eJ;rlI)m**$IIiSH`QOIK!BRr`pDuakv zE~L(81FX^%^!j=*a&CB9p5Vjhd2jS+SFhNydTd?Lyqogjx!CsoXHxd)65Z42Co zKm6@0iWu0S-#o}FvznjlP}s4ZY(@Gde`rM>xGn)6wa$Yfe}X7@2Ob5ST?W%{W1aTQ z)fJt={ixY49|wNwopWNR!VDfA2Rl#Jpi2twB!ei7^mg=)=x5Hs*^!}T5Tod2aAEXz zo5V1dUXNKf!6=u8pSYD29M9nk zlbUGLGGUY=^SlGOxz4}_Iyj7?@hNjDS?@evLSruyCE(=z1!DZh`ouHN{}wbMI;zD+ zTEFOgnCXnDLV05=JOO}{`JzF35Gnh$ixFoXH{-OwRIz&ePSq)xuA8K*s08`0` z&9YcSkSb|`6MGmnFX$Biyq?XgX;?bkENT|w$~pZ4em>5;pQ>2)Cl4z&WhwB|YVKI_ zGz=n3^28`W|KQ*>6QcLI2MzU0BpD@rujX zptx3RcAGhtO-=G~R#2fWolo*u_SP0df zsJZY;P@eAW`BazOT46$OnHH-yPCJHG{y0Ffl#qFJB_FHMMlpCGbE#0i;)05*R+13!8)D@YjiUtn(x1A(fOfi)8g1hKV`2aN(9xQaFRJ z{X%tX-o0H_3%6A+jjYrQNZXc{Y#cKx*58I}4m&{RMSo~;cwR!o*(4JELDO6mZpc}j z{4R&^MxSOf5^P0;BCr26WBdjipNaz{MLrSZm~rZzw5Pc*maa1O^+>Ky&WiHn!yRSg zizJVd1^$rOM9XAbhWUOmxNfxT7xM^!2!W%PGwq>Aaj==B-wxi=)v%`m$TsI+qng%= zq2LYu@W@9`e1gc{oIXNdjAsGpCjDgD7V36HDL!8fPEI&T2QRE+kMwR4>FODqtA}f7 ztx{{;^pfiM@K?xHTTs5aonOqt!_q)TFQTcg&1hfDxNyg&m8euLVY*oy%dmB^gNfe^ z7;_f=naWGaxBJPs^IrMPHd42G|fa6i}E2Z#|Py9FJ%GDNi`_rP#}v9R3KmfPs&_v9V{Jx zn3y;@GW`4Xub!QDA|$SgCy>9Y+ts7Y&5EU@KSG&G+;r6$uV`sCefKzB&dP8t06}l7 zB@WjO0M5rmznrOSLdJo#qlQCKPOsx&p)skk#E17S1y=Ok7{5O`w!Ubr!`3!;SuL&} z%eSZawya)Ud^kBO|8zC%FUQ*NT$a+-J!kh~_*h%t0J`fI?#QO$vm3T|+nd&JnNloz z=>b=dt6Hkxa|;l{Ro5>drst8_E%7Y+BhLulug&gOL$i{S(;nk(2gU^|wy?C*$NGH$ zR>7=lp_3sO_+2O`*Eiz=%f3H+G%%Z8J@5J__1?XvZ3m@JKRg)l_HsC!_qt!XX!bx= z9Of70_82}c$KL10!e760l}7te4IGx;*_OA_2>3SB)Di5R?_W*6>z}#Tp<2eDixu5J zXlvT2QR$6eiPtaY2=ob6-^JQ3Cf2>e5N(jE7FbAr5G;P@3D z0cC+GUxFwfOK58{Ae&`nAnfGpm3tIpu5F;EBf$hb$tADnGVWf^uD?QP-&aJ=ViuG?1HgCFL-PL`XT(;-} z`vo?HaF0$#39h?e`<9>;-YTaG>Wsu+d|W51zvQ^`zWo?guedvI?w8Z3z7T!3 z2dKOVY@Y7(8}#oo>Ycb<{upu7_QvkLgktfE{I;vw9)#gDtuM$CU1uHV1gbi3G(rZ6sBbge!@jzxSzxPECKxv-7j>=yC)=)!+4P(DkO zYqaHF$UaiZXv!487db@5oj&B~`aR?AbVJnLE#&io`Se!#&gbTo5VyH`w3#(U4_TVuiR!V6`KU_k$FhX-W?zo2}Ir`dq?M5DX$!1`XeV)$W8J9SM zPO7Unv>paMCS9QpZA;%G)+x9KE8(kbVV8b>ACJydGqvEhg1N-=9-0N%$GZ8-$Gj#k zW4u5Ip74x0Pd`A<5q*4d_ALQtU&nLoyYZ%C0UBncKy4Dh=%xKZUp4f!wDZ<$9|}8h zuWMlueOzg zy9#FbLeDvi`w@L%MdC7_qBEM6(Lh~?qCw!&nw+8i&URl-L;9)|IY+jIm2!~-m5?wQ z-n^4x7ND8*wDIiHzG;85j&ovGyT96b6z?V*m>X#Dr0qJzYAR%T+|}o2Pv)1Ps?6chs4$X z^o#NJK(av6P&l<2>ZcoD{D>@&*O^~PC*Hlc=Ve&rkEc=XS$`B$M2!axjQYeTc848o zLDLU{M`UWkqK&H%s`#MpVDvN;E8m?Q!4I8Y4CmHN8TO=`;11Fv zWcj(vVb>Waw@zFo%pkmxx|lY>DmrVJ-BZ@~!GD>k8Gxq=%mdfCLf(pCfYAvwjE1Hs zex37+gjqz=31WfM2_gVl@(d>S*jg+P>@d|~sNCGVkjmcBe7S}nzT9OGP>AwJW@;gj znq%_~<>N#LGw4qpMnev}JQE=VJv270MPda6Yd0=iM!9oGsITOUm6vCNm;QuW-)xd<& z2^l(h(tO0fl0Jm1KOh;`8ulQ&^G&e@Zf`GOqU58JItApa<< zWnIRdBDu)7dDd)bcEuWOo-|?W))Ze4+DKo`jQd79 z0-Fw6G|^*J&?5qm0EvGJOW_ZVGuF`*1%co9B-!Jr?qm9LU9?6{wrL_GATZ>4pNTwXs4bnSO*b zP;jV~bOaub9n?7NQ6BUgH98b?5CI}{kP!m&oz&FHLMYUaDt}&54z)v?@=|^5A7%Y- z-mR|YuR;ACG<%Vn@JvmYxmoOChiynS(G8ijW@}03+1tXGNgrO zesa?2tQejx^08ZrXqHefc`hP~-Vk#83jmbGZ#4^fM17S*1sC1n&)dagZG7)2r$kmcpN*)q>$W~ep7TooGGS;knQwa1%g7kI*d-ZT0y zKJV){A^9%fQ3~Hr80Gm1KlR`151m`IVrRh0#9^Ry-xJ+fag60C_? zViK;UMlOxj8Xz=+p@Z5A1)1TeBl_AqA~v9SOT)r+u058LP8}cGlh|03pcF8gp>7di z+}X9;uAO&vvLL^{X-r>$e7vgekc063sKK-|nFGvAtWr)dcGjU8?P#M7s~rK^g1=P5 zr1N@K=UW_Wsy&UMeI#d9HY?@VFMwtJgGLilCzPq(Jn6}98#hQ=^&+gzeP4Fk#NwBn zptj4&>6g0fN(^oCYHdF0z)}`H9D8~}d-^}at-xuA?MW+B9$q8exMJF!JblHj0ULA( z-YIaBDM-pGgZ~mX*lLG76`V5A`bnrQTohl%DHQt|_~=V*yabYqmbNC!5t4kWdwrWm z#N+5kryCYpXjd1A+$OXYBFL|a(;?5gU3AT-?;~FnEmj&cnTe%`h~V@FzScI-;6?(L zzyA}z3(6F$i^|t89q5iK=<9YpvD;hXgU05;6FVbFbJv(=&cLlQH08 zCwzQoJq&To*3 zJtV~V5fVo3wsG`O6SHBh0Ctd{(KA^`j(x=MVFnJi_!rL)*5;7ZF$j9(@hb-n95ZNtlg;W zs3RBk(uVD9dcdM!}kdYSwtyQak?+_b)s}Mi9f%{298Wjk&RCD2gv%76Tc_snUfZzU2FT? z96J-RqMX~pcL;CPK!FDNb?KQp+&Ae8Xy|Obcs9aM5lr6e6JmOa*WEs!+JEcRCHe4D z*K+N!urF#vKfNozfi3tprQpNr{&ObS(Tr9E8*gGQtuL-9li_I+iJ9THK+n+&ijstK zPAA9*CQ_l6#4Jd6&kmE!d?IK>Ebb+oL1_ubgwh1N@jo2{BIL{Pq!h|1_imV6D`CDs zzdcC_@Kc23pmacqvw~r4uRfT^-k#BWHrJf|_PFyfhhR*wqGKsQf1HK$V>cmRM9pgn zs%;d_Lz^j#fY7pNOz)ty7{^+KyIp#oP-}CGNMLSEGTH=fm7J#Mfz}_Q0; z4b_$X%A3fds<0SqMfy2!%kkjltG-?`h6VQ%dz5!|&E~$M%$AWPcvdKU6;Wu-rStn< z%th@yEX#p=j6Sa%ShC28Gg`C5_r#s!tLZPW)9sZkF)= z0co^qq(XO%m};J{MeK3s2xA*&T;+K^Lo*oPi-`K^hpJ~UODd9D+he>;YlOAd+D&8j z@m1hN-QK}nSt|sS_xAB*Io4u#GPGEhlF8OB*kVe)(u`@?Q|VSQ%k%K+n}9YANV}os zo5F_L9mAo`Vp|6tW2Ok#-aMC(y$x+3F5cK@o(PLGkE~>tFikZGtF?s0x$3m_OHaD{nqq4>oxN|GU2Z;LIJ%W`?nMz zyMJWQ6i}F z)77Mv-v>nnrkVc@VO8q8=Upj~5NR;NMs;9r9ONVBE-Mgqy!2OrAZxN(45G=oOkR@m zlvCfrAB};Om&P?TX*bov3ilLNyW5_5XU0PSrT;n+%xM!zA8(9KGW5C30U!@NfD4wd zG!vmnZi}-uzUMp_!sV~un_&s-IoC<(k%PnmeZ=HmhH zD$4EwWvMTrW)rE`HDMkPP<15oO-x%dw**Nw5?2vsr8A_uPR`!vgs#9h9%`zE<3i98 zK?;Wco^`&&%U1q`2h5hkQ=hh2&q_NH66&O2mScLhUZCE%dD?NP$dL8}bLwB->`M zNu?Z`K<%5#sZ?i~O$aVfQ!e`3WZ=;C*uQnq;V|azh7UmiSTTP)Qt1f(SsXe4MVL~1 zjc9qNizeR<)1Ew&(nNRfC#_4OADIDbWCACaj|CJFkS^vg_k*Bn2eYK>20ytk_(NZm z1V(Y~oF6&g{pdTlD7VGhFGvta#1n)=mOB18f2$vqGr72S7IBm_QDpuFB56Fz-?xA_ zcDag{D*-}Xc}}A6ay+YhYf;pc5358ioA(ouEVc*C_&oGCN=rtyDU-`qrV_jeZnP7s zlDNQ^|EWM#DEsa#X@~C5C=^USqbNh}>MRj{RKf*Kz^$q!Q-zdR8nh*z3j(dhZ2sJd z{SH6Ym1~YD)Hs1WFWRvz*J%71iQg~Wvc^1TDSq;-^hVCG&}dNrHP@IfPU!l}>x+eY zmAC?|NwjikX#T9mZ%%IDXO7wb$+7Jb#v%FPicpf>Vpd>p+btcfsBNA_(6=&$d$%P+ zLLNw72bS%6nUlqm&@}vM?qS}&z%{48P5qvE%>6Fx4p#> zYNqxRuBzvwU=etFJd8<*^6*UkJxelf45I0$@PsN)^|KU0MK50!nil^g%+FSGw1Yw> z9@%QbdQ?1ko`}7UayR%>!zo96u-tTJ+=>QgkR6<7Z1=a4Di@&Qd)K8CdQ0`?q4V-k zWC=x|=m*=js0o;MkoVumJtI;@#U54VI*&7<<<4p7=-lVLzBFwBXFSvw6a&h@9UOAY z2OTT{i)ieC#WOU9#k=?tX_bXhEYYUNuA#!W!`bJ3?}eEZV+S%LAuZL;nvMP3-ujl9 z2F#`C<~4y$mxmfu(|3~xyVVl$EEw8uVeM6g)R51XA-A3Qsj5Q_H`O2HFqSd2))5Pns;RBgbYlA^!@Sv4SWrLgKJT18`{)x&1itN^%5RWWawU61y8 zY!=8;VeM+4O8 zF6BdjEo%#Z`ZO3SmUCWeQAWZya>aCRXOF8rBr#G{O2zaxp5UTSszHynB@}h#U{j;( zAa=?%NxNBy%K~#YK8=j_IkbPuW58hia2nQ=!~M4qdNhLr2$!uEUe+mo05Io&%9RcJ zYHnTndhVY>aRd{{x;_(|tW9bk1wE7+X;z&e<8lTz+j^Mo^Mog8>?}ET2A$ohu+4>p zBs*G%%X@jpA$7bN6lljq)i515bLq`qO{rc5Au})>>H0I9vHLDAH zgR1Gu9GhD2hvrkOQV>-w3km9&v@5Kx$IY+UUTppwX4@e{e4Yte0K;wFH`;9+6xjWr ze}zV@P^iP{A)&+RQ)oo7zy1pQj+S}|w9TsPTnY}1nh}lmYR6*U|BaI}v?%z_zu071 zN3T|WyELlNd4shs;OyR!-lh*~=151|xrp?qVH3|-rHcls#!Afs))epoQ^g3h3VbS# za7Tz%-CA^Z8;3sNE z??|nTixZ=xD_mlhLs7;An}VBTTfnK@<=s0Xwa%IJAG+cTX1+7X`5;f}LwoL8%Lu*R z3vn2+l{5NYo8~#MWYKSC+q9tO^5jJGyIhfVoN_m;5v`0qZ%&FXJQkX{$z&FqX|wmygi+s9n?ZK(AEs3^>gsZO{B^5r>S!y< zntLxSET z0si^Q6dES%EtEU;%VMR!HMe8B3qO6n!(tZDnn^qK+$N+dvIM9Mmc%;pEnaJbj%cqi-lWGl*;)!!}@ zDIJ)4c21Ud_SuD6Sp8Szp6+*MHB5Q-OPGl&Vc7|%$`_kEk=n1v!6&*^QgmSf`?~XI zI9kyj@`$L}76}$a#cnlgw|P&e%Qb4-hoNmV0kbgF$bpt{WVn8Kunzqm`DR13KstFm zHzd>O{qcgpw07mkYv9csOd*CS3 zr*vLycr<)7i;P2U|HZ73KFh9|2C3OYwu>HTtWti^#&^r|WcWAu)Su3{t;EY)Ba-b_ z9#V$m_o9f_-xweZ1260Z`LaFD*`PTB-flKf%s_p4JoYwDwq*U-e>y+Wvhox-T-WJ8 zdrg(fBb=*X@a$UhZN5ot_hfUGRZ|(?TQ=fvQneRa@Z~Dz=bkP=##L8Shmf!2sC4yl zV)5TIDPwiiQw6B<(LMhv-FNmd!wcO6LwQIXe`6IqJJeC~%Tp>nK3T6j4|i)k>ALRp zk6CCNaO%1fmMS*`3dp$US!f!P{G<>(6QLyqyX`KZ4=VOsEEs0Z!&~F`FofaeM9^DA6W-wd*jP^Vl}x$7P?1SjN(J z9#7-~Jr{yyk;>WOW)yz?NB>|0J)d`<*Z8fYl7X~qYaI)RoFS69=!XNPN*LE7{DQz) z&G4SLBPxEN(vo31@|0J6A?%mk0n=a^>y`SNZY<~thYed@&(SjW%&4^{8X7urQj8fE82 z|FOalz)#of1GVu#l`s^6L-N=OG&@v5#rD3--Q{zg zRy016F2Z!>7CKnC@qL@pP~!R=CpdytDy;VvX_yvI$1^_$v!%i>LtMwRx*B7l3tl{-~ zqvgXzf~6NE-{e__t1Z=QeSgJr-G+a^Pw2dadX`T44*PnB{=~Or(g*V^A+8x8Dw8HKYUd zI!D>NDRQ6$Hz&I37%-E>b(gsk^(V(RjX?n@TyyXjUP4P&-p47Xj`~sv$4n$&hAQR?Ep>eIss%#{PWLiC4AlK3>@Ak*VdhqWu7Ld|g|SFCqfmkkkB|Yd)ek7=`7ttKS(|$&JsA`y0@2ss zST+nfemg^Ow~!&O|5lJ`tVsiCeoN!sIb1htm^Dnnk9cboZdZyiTB>2%;^&&mn1~CV z-77_#2X{9z|G)B2=iPtBAVS(7@`T{vmqJBE==`cOY=AFsi1}2dU$)1rq7%b=lfX9? z{r6a3+yh&#Hpp79K93bA@$0wbNJdX&PTNhhiXYTUlL>UcpgXM-MOf5W$Am&a!tYX) zJHb&6C7yo?KQG5M7ZkL3*r(>HygpfwlDLIZarYsDHCJI~ggHhD$$J+`lKfR2A2W!{cfE)Rpu_ z&w0N+>((VumhlvOLyf(xw?Gx2Y;I0~mhLe_RMoo@ zLFt>ry^QaMKfWme&GJxm`9O8Z@3tYr#<5`7R(iA$m-$VOm<5bYYV84L$48kgROqMY z!Jsf$YTSpCNm1UIlf|(3vT*oI$$vK}2A0V7o9(3bIdJT_O_XhXu-a&k&&sav$#8a7 z#`vAr_?Fp{8)82PKv|+Q4g&;q1falX10mfW zmC+w1U-3c?$h?69v47`#1*ogTPU-8z&wd6PY}lFj+0NKM3bQz*pQ}wGy;7OLZgxYHWUv zI=Un}#)1KUwjdxTG5Td>G)~5M$dn@CcYm?WogfgccwmsM_)K~TGc_`-iLoC(WyZg> zvu$25P@mq<#XQ=b9mh`Ic%vnPVn_EXz#NYOS-g6j7HK{F4US6o1iVz)my!6@NKb+g z4bTPzJ3R?0c-it?McFOz6|(CnLPt`FzH7Mfe^ON-I7^-@Hgm!mvm=Ud0e9Lc?pR9( zf=;&2a0V&eJtnb!SsJXUtx>pMZL>oCRx$s7#4iq8wBa+*hR;BuON&(!I0EJ&V%|RK z$wEh>fom-#S&x*%hRgR(`(+#qj8&~;~^SjP~} zt30TYtZR;Iq0)lWS`@E=oR`gpR`PoIdhc`9^G3z%KK29)Nk}^IB@GTwx|#`A%&^&{ znE1o=Qt0Us5a}OFAPUAU$U^AAH0^?hdD!)eHa4(y_a3zsczyNP>;+7J+6mu(?1UBP zqs;zpBIt8Z=(TmwFEh${<)}2cr?c8YjiK`PLI?~b{fX!aLt_g^zw?M!mHn2g26z@$ zecF}UO$_t9J`c4HWQK|*f_D!(-&J6Hs3i?eS*#iv2YS(k(B>0mQVw@a zw$l&VB!bVSbB^$Sab^w>kuBvrBXT2)M!)pfH3^vH4@tKi!U~QCMJRasgH~SS+G(Sr zvB)-E2nc!-(!3z&zm_hJHLT`bFQMjh4TvbI40~ei$N$}9Y|8VR=y*cypUYhX#3HTV zf0$2r=P(wlD|b|$md6Hk5BMU6RGldiYEplpqUavkZffGeH&s=o57Ij71~LCGy()13 zrNPhhxeyWvp8lNDCnJw9Oe@;3jtzdO#TZ8f{Rr~{PM@QB-G`75`XPV}8WCfPNlvIF zMzl>gpm-_p|If&G`E9`Lfnn6_A3o%idbuzQ59&0?h<1Z3cvIT;G0-3YOoSK-s=2<52sAZ<}T&?wxU7J_b;cVrBc?gs_x(5=rnGozjzw;hmp43{-8<#u4tM*b5@3Wm-5z9I{K>D58d}d6Kub}DUI=b z%v3Aos;Vo{;HIH|rd8x{{PfPlBAD;xd0gTF;y}BJ{|{UHnu{}EKLdYA$UZvnesiZs&n0u(v>xqSn_=4S^kE38=IBc)R~YYojy0Y!^sve zNqk`yT>+3tB zG5%r(@$|k(<5^7kY;G!E^buZYx*jTLnRk44m`<6XRC#GEB*E|^HA+eDs`!nfAev|f zSA}X>3v;-i#f-wKE`HgB_t-kV11guVY(~0%&u-iZlIH;%&gs0-FZg0gf$TPwKg1gv zF1-Ji3*INm)(r*ur6M0-wK{gE>qe5ftbwEf?(Tc_ZU?KhTP_16!?nS-x+5aySAW5X zcSfe$=q9Dh{scpFRFJbSq3Uf!Dl2wj7N#O-6(=|ao9B+|3>d@Egv!eide^0oJ;x0~ zlXcg}R?~7D4AfV~=pOa51K_vYgKYi4h%1@^zvz5FX8`Qe&m-<-o`q%PVoDKaReaGb zbR|QV0>+Ws*ZP_MkU&=X;j-+4?FZ7Q9>-sH{FH&UsJCzkfBSu&#}JSNxaI9a6*cEO zt}9}E8W>5+827i1u%27wQ7#r|OIA7Si>-7z$s*{!>3d|k41$z@^C{;)UIg(3?ce6< zM9EZm6i>@a?H?utxjil?uXFQ*gDP1qpy0r#`6~EnF^XZJC=aXQ4@)TXEZuqOdE{C% zB$ym`k<-`6*`;4e^}A{c2y517w#CicVZ}@Rd{q`=ohhqQ4y{1>j{H z*Ipp|v3VZx_~#&Z;&@w_Mr7D+{_c@BrPo~?F?_^QTz6Ob5q}eh5NZVZn z^reuw0c`7TK8ut5cQ`G8>7gLUxyJ~0f<^vk*)jL_1kXyMzf+ew^%-nz!90#eij3X9v(e`um z9|d^M0d@^vhK^xpdM5&@JOap1jr>iF+@nMRk=u?Ie-3o__GIpA@0fp>j<*gAZ$k^= zPY_cu(LX~{ZWH{SY)}!1U!hY-UzK}@h)~1?1xP)pVDb4#&}9ifl)GlECt>&l$IdtL zP!}kL5#E-~tT!|9+y-JNmyQtusv=hkX$g(ndJ&TbM*EgmVv*F7#3Sc!+?0Y*4bYH7 z%&(v8fIupE-!b<;6iY@`{l|&Zd-$#nV;wwO9nlA=@PZ<7FJb`XsNlFiZp?EAIz`+v z4R8V9{GrGm{%%tt(}nilw-WYzsFyi&i2`N?MIZ$Ezj{gIPcl?jRW@JSe@rZ$+)#&= z$>r~~0<_y6b{PnwOi)TY=gZ9&@It?7luvAhAE;T)-3bA5JU-uy8ZF?)9G6s`&SFdSbF(7WjNJ;pqZgp+sJ{E1oPE?=o18Or zTKX40euH)`SziFE9_4o{sF~+T;h9don7rd48$n={6T_7c|Vwhn7&wN;!Y&PT_O0JT1uLh?onNc3qdLDc<| z284v4G+^{+mCw%Jmzp$dyP+dtM2_E}f-ETWHyZ_dYGZiP#2-q3@AxxOu%)reLiwHl z{P*Ej1DsQ(TEs~}{+RpEJt@;%!KeHA8DC0S*Zy{W+7*1f(a+GDK8+eHEVba*!F#ef zy)G9!mo&`4G#1nbR4>7rRpo6+n`Ba2Ns`CqeY+vCgu3PJ>>ee)07OS^y#n7{NIFmy@A>saxk<-9gq1%f^q&0 z9N^xe6S@;|0nGEICkq@5T3vV5Wx=E4rioZuc!eL&xfhj*wT&4b zAplzkAWIY2iD#_ol4}#>4Pq)W(H7RP(<}pw6Yq&RjzS&NgR-uR5Wu>b=a#%%O*jiJfZz`zmn2k^eXP%ny$*uqDLbL z`wA+wB|k@5$Hx_oXlgLV%Om?OC*056+7v3OBsysn4A}EOPH_PW9()4D>9x$ebO!2na(BiZV((`<2%MmY zPiBWx-i>7`@!LoNbj>W?>(dqttd6RKoNXM}Wvn!wo%(=qMsaMFFfDrlApiEFHS~zf!o|WoB zBvj0X*{Br@Lf6o&_ApJ#{S7^L-uFMceQq}p^WQ^L3g16(dJK3lfCDbnApU1SPr%J0 z#2?@Z5=bLA0q;(kR&@CuOYPi8!@ZO)X|EPoCkkJ?r+EQIqc1LBe=X3%iSfn`?q{~c zJKsz_SHl6NK}HfutWv9X0g5m z+UYdQad^(Su*~Hl25};4ssCyE@qwbS+hk&}pQ-xFr3w^;%w=>ar1!smv8)s*dy&;r zuV&>k8NTWG?p)m>OC@w|_3cv1)zHGj-p`U}m`!=VE%0dT&qxvYwuU4aH_)9^EJ2X# zgPv0A50cLkZo}JKNf*afhU^LWe0PTT36k`BCeX>k*De6(DP_vE+G!Bmy-?r+ap?L+ zK#76@A&~W|wcm{x*K~D8g7uI+gDbmVc{QGek%h2e2jM?R+x&RHccADhbqIY{@Q8|f zpmm#Pi$ueXE#*bm#lv1U>@)IywOcUK{nIy(B3!?fdaGA-yiEbUI;SILfDha2h%!yjXb=;%-`F<5^ahfoe?(rHl{}v5#?YML+9M9#Z{o34)mDu-02Uqu%1=M^7%mNhz|{|)@& zGw@EJePa7PCKICKPl@l8e4+6@GVD}3fdP7E|G@#0wx z4&$UFR&WX_cwffxzLaGsLaBNv6o^rb89C#BdWLQEEa?4L)y5YhYBE?@D#Yz;Yxe68w&mZrb&Y9N=X(4a%6oKnzC5N?BSQ9A9=6iJ&NoYzyPRc)2mch7^=GO-JA z-c*v^j0MUA?*94`fAQ9mA?hd~a7<#qVMaK34JznMeh2ye<0w)Y{>?O~Husf+(m z0Bx+pOIqbUx0WsBX#NBz={@u|Z{WYX*OdYxXwKZlr|^dK-|}|7d6@7`-c9li3Bzh_ zHBjl-Z3iEWdH}p!YXJjtU-kOqJ1jJ*)e0VYncmr2gnm zQpniNv0?qgt^LDn9C4^Y@c6t|Pf!$~u(Z#6BQ}tW!+CQ`Yiy4kG|{*|Fz!t#`Hkm1 zq{I*AKj(M8Y8dB7*-_{h2FHGGEd+7qsV#HzT{t^q0hOX%Y07rYLr7Jh1}7_AJPpqY z77uXy)=}t128!@>91G`Jf|7p`Tw90#>5T0nDncFb=}!#qCp;4pC`6NZiSqW$(_I1) z`HXcBxM;%@f`rV4OJra$Qll>esNMf(>Ki8{`vi{c6FA%sWTBTWlZ24a>&5XRTOU@; z-TcgLlGx=j&z7|^aXx1`Fk7X&Ssj9O`JrMtiIYYt{p}M+z}GIo{ff|a?Q?AtQ4l-ib$W%o6gov%ydWdfkG<|1p2_`L}X->6Ov{EX)r5eRN z!zSqm5hb@2u8^Iiq?2`$q(i{4LdR4R@~nw-IFmo1 zywD{q%v66M4qj}|IcdT&6FXXnQivoZ>%ibCf9+5$ahPaIMt$o_!N306RNhX!DF6+( zZIH!=z!;G=%M*dORR~sy4Tuh#$Fs$WFCh^sLlHAt;QV|g`xiPJ;yy1-%i)-?T@h75N(3l>;@{K$V_LWAOK|9?zEzFNh}>n zOCenV3_F-Z=m+lvp(f-+t`OyAC};%K)wzoJ?Gt~Oq_2YF`Mv4<{6zxrsK;m46)_De z@>qB$3u|dNTKibuf-?g>h)mSN1KRQ^k0&HnIR7zhQNFkHf06Y$`~^0+0@fU3!=H%4G@m9T9ZivaT|tE zDlrE6n`yLiu(Osz$@7+g9t#K+@lI<}pMhurbnx@RD{M6a8X`dls8uHBYBz_Ev_2ID&~cuL1p!0L1|zz0^DNhR7qS1EVCW>B%f$TBf^aksnGug zUHFOrKG6*60TDnH#mI~bzYuu(X$Ra`xuge1Lv(k2cdsOT5p1PZP@HH6Y;TTbzx0&F zllW^qBA}JkjtR;0re%lyRP}0HXdfw|_ocL~l^*klxqqML^KMaNQ8Q6=NpwlWNYx=M z*$m*U$oe*-Itcm4dOHCQzS?m4a&Z(3ETiAQFOv`rko{;58AdAZkef=(wLyx9vCM5kE(X(32Mb1#cLq}R3#&?AJ3bSmcyFsG2N~YFGNLDR>mjC*1!ss z^f5DkrtUWhxVXZWvalWNp>!HIi(A2^z_%J%>rF8it@3#b{<}*(a;Z;sp0uaGJ+;Z2 z1k)`=0pg_`DvXnT%_X=2DgB>BfrL4DTj+s1k3^DR4H>X&nKn`&%hAvvVMHUph=631 z*jNuGUSnW23zM?~{l`f)*aeXxw55?b08ZkPz@7njMqbU6>w;RPucAJINg*Si57Q*j z6N3R70vY)jrz=D18Y?p|6Y*Ae+IU%Slzp;^zxzgeM)VD>tR1?1uVu=VYqzL>E>NakxJNe1jJ!fjB{ zdgHetc6A<$#9nVD@MvXIT+Z#!{&;^7Y<{)6r;vWNwe){IE#X63``JZW33l_$2aPk2VIx{G3d;p>Ix+6ld!$$=1tDZt3F#{vPUSDn^bg(a5ocX42 z{<=f1z!%Y9uJ8ZbjfKGydWxnMe*zq7>n8}i+6v|mpd+N{TaW&>^QF-rUK-?_ivn4l zRVn=8NV=T+r_@6I_ZIZB;(2 z%EXo}Xyv|@Of8M6iEBd0@n^shoAc;1;OMX?I^HF5b?J>Si*lDT#;&i#=-(!>jQqfm zXFd1UG0#S26XS)(8Xc$Az;8n8Lj^WfeLn#d0<$o|R}Q|D*YR5Wov*v#WeCUWc+pg; zt=gRRMvF$%hKr~z8Kl+(`x&$Mz&pXMdl;w*h-C=>Ux(uAj{-bHiV6%!#t>0T&=&+7 zKOvu+K+Dk-8+jAvaV5$LE46ddj)lQ^Wn*RjON7M0^8t0U*nPFxn1XxhVazP%4Sc3* z#e-y%F|`jz^Y8N#I}=!i7p`2Ngzl|+Kbg|-;p2{Rr}a%2XLMUn1>W4Wqk#agnC;uL znM9q9NKub-gzx^)BShEUZ!tq@Ka`E6p!+wkgaaP*cYVGlb$eE-k%tfh16&OqYliow z(8(D=I=fd2F*u1Y^x9Xan?%`Fa3)yDm`}vFldR3-A9VygOH~fs`^nI&yMt{SsU3Vlgyz(i zVIXW+;R&!WxkriOHRfhGR=`310)^dM#*s0syU>V{w5^yeT2EnMhTu=L{(u3$o=`|A zD{!&Kw1YWrIz*BCZy~g*utaym$s~7x!K*LoAey(BbKr@#m!KQcLMX+f=z+KIQ<4|= zI<}p~*RxQWcP;IO6ZzVm_Ta_uukszL{xR!zU>XjR_0>MB*(G*3ncMSezTgMPihF~l zaM!9yfbCs3?!ZD>4%y=;_8JH`2i@PNrC+M>i>;5L(8{pPoVROI+HZ8YvjT|%J4VG8 zqvh*(|B(g)me67}o%kXk+(8J5OyMCAvj(tG4`lAY<-DbTK!wHHTE=Yf=QS)Bf*;RN z9O({!F(17v4XQq5_PEWIDtdU;iY;+g$f@kwLQgNsL{SmTz&hw20}_}PC4JClNa^$u zxY0i5@}qv(M4^$4Q+-C1ld3| zeiAtuwwr_RQxzr_0fYNTF4xX-bHPt>FP{P9#12xwhwU#r;-sF*$IoBE)IuAP1jH*= zdK+t1ZoBaglFxb88&=tr7|YA=0vKb9uN-3eQ}K_vojCJ?>T*?{C&j`~iA(q&34W-0 zg8ufqFg`!P7zk!1%Ip2pgvm+U1=pql=*Dvs)H84OZ`l{k-;!v*nXC(4RC(5G;U+@d zI9J>wTY(J?3x3IuIn0Kxb+=6VwXCJV$zJy@e>E5KX={J{er18JgK8FVsK&f8xtVRt z=-ad?O7>4wVY#JZvfK#_4^m@14|17pF1s|7sw1U`Rdw5OFdV4{pDcE6No^5GfrL|HH>Rx5>8_QLCcV4&pnEC_o}q%$N7qj zUvV0b%XjLMnqP!;oCG$?-%!L4=RWJnzqI^J?{itH>{IpZ8~fO zpBlKnmCO}7YF{ZIW?=kqJ1KgB6vQ!TeFA(D>u z=!gc8Hx9@+A?GG7L;hk@$L&wtP3h$loiabb-EzZb;o-EfcY9YyRC`R+_wvo*L^n6& zk>oT;qy-G`u2Bl158k+FPGHX2Z@iNoS0y>+6g0bfsn1Rqy0s!zhkSA6!Z{Mw#p<6y zjN1{DAucBX17J#I=O1?xEKQUV@~w#fa0g02!be#G26;$KdYFG%{3 zKQ{2DGR

g;TlQdUFWwaktbTCSGV;zv(D3h4z-_4XxH=yR#aMAq+0;8^QcO)?C<`Uez5^7T1A?rQY(6Ywg zL$Ea>21<7S^|`b#unIVX$x1l#y+geSq=LPAA#osx^g=E1^g>V6w8QG!G&!p_bHUE7 z?-q?iF61^p*VYgUts=ESoNH*G^L>IAY$Jt#>?p(YZ09a& z7`~`97shVEHhvRu5}dbt++I>WK={K896|tIcnUlX2HcP|ki;dAQlvA`+Z7BiP#e?V zdQ{uqm)V7yhS#(npi|-t_&1~K{(KU=D|s3W$lR-Nh1%^WVOIrYqdr^%K?Lis`aJ1a zE~fBE`f0PZqcZx`j`hm8(X53+sfx(Y#C|+;a}*z;=oVk8>!nJ#D&RIFtoIS4QK54E zQ->7;1OVNGM65m4*r|n~2$ldWbDR3UU6-Z0J5M(3FJR=u4?2S&$m`q1j>KON$FJxN z_=T(ShVsWlxx;xvG7>!G{_wh9QyyzOzL$gYco^l!LnSa!e>)7gm@&061QO+REf|SW z)BKu*h%kT36Nwzkljt7G6L8nnKn3MmsJhv*_#2+Rvh>-=4|rYkcaVLDn{MNE?lo_0 z_R-v(ky1@jesbO{Hv=s2tb)fSq3Jz&9+~+msn0&w`2-_3A%$+Bv!r~m}4+V^re%uA&feLeL^DVf|z}%uZuFAaIecUL2k)Q z6Quo|s2vo|%CVzr1$x-;YHwoZWs=`1helU|??lAm@J}YUzD@!S&K_23}3ugm)PI7J3_r}c>F3V=!f z&l-AIBo=@*5K=mVivVjtiXeH!#7xX7BVckC`>-fw0oS(x$=u?u*SU6P&sp|@LC+C*7;xG|(wJ ztnCEsUa+u8n2qo_kV_vb_66>2F77(k;hwEbdnARYGhHUD4xRQzMOCLt;somG-DVIA zshai_i|#6x*rJl|UGXP)rgVrT0)wJ=?Cvq96>kvu(;W0+svk^iiZ(wX+Z0C^JDkF-RNU#cg<@YI*O-yo|&ERkb?v{v6ON}O^0tmF?$YF-Zw zys#9L5F`KU6J|@AJeN&C%Rr2bxGf)=wKton&z?c%aYTg3lW3W=ujoLTRlniF5R9RQ ze;Bdgx4oCjR#cn9)QUUoIPtut02AlsmfSfX7UPnSN*Ho zl5ew&)?->)$7}Sptdy|ttL_x{a8jxh$_flstRSKNkK}Y6)sj`vzmBg*UnCd}UH$1t zS5ZyKNtpl8SyMDBBle5GP-KMSYOyS=(?>S?O6Q$lwJUBPr8|Mn$3d%LmYd4AHS5>` z`on)dKw#6bgdh;dYAfBcf&}bO0C>hr%N1%$ExU4aD*{W45znqq3U3$Fpr1sz)lRFC z)Flk^A9K~KU0lJWp5(7WtT*&XORhICrcGU$#(Wj9a^~lL!9s#$G{?t7tRlga$JN?* zOy7d)V1UNl$)r{5jb5N_q0KcuM=fnx>{>93yoh$UvU(Ez(a*BLh^10%KcDDKn7Mt` z-b&cJQq$(jTn8O)j}t0V!kh<)&3w)pcf6M!Eh5c##aH|LVFE^c3K&CtzSknY~zZAJt9zBlU zGKccvWO1#Jbakx>>b0NF(%0PY$v)(^USo8c;b6BU3TMtsHkdZWy{;*2b#0#86e?=- zR`C|kvMRHQR~SoEVp~nqL?Rq|Q^^A+^O*M|Orj?81hb0QRVfP~Ej_q$(=gW?2BfL; zPkx>=i?QXiwr{VUSWuXZlz7^Z_a%C8@$hr!b1J8A$qAtlr=PS{J*}woS$9o-b2-q< z^wlJDkD0cJ{U~({50$M!A&Ixxq?LwJYknE&w$Ut<@1nI9?)Q#!{}HOUCLJU%EOA<~ z_L94=X0f$^`%TN^j?-1);*!&<`d~o)OMqbPG3(y#>h9S)E`{GzNOn&!JLQi@qtK3T z@`G@m`8k&hwPCm(%(p|#51pL+4Gz6D_^1~dsd(`8x5Vkg+9Q4`Tocg5$%9$Msu>5? z2(DFog(5(X$jc%5CC=b%U+m__OgZ~!_+M}vSHSGJIil<10RHfxk)T>gY0?m;Ng?B^o zghn(F=6!NK1aPI0v^4}XZuXC+uO?(5TRqqL9*3edp|?J6{AslVp^Rw5OdQYCCZ*}b zPXSc=wsXM$8FjiF&m)CupreE;D2yE}t2B@2k*7)N(f1aey!)j!9Lu+h(h(m&6-4~W zP2+<1Hj}g1MraQBVTH|Ri#ym-bUdxTD6YerF5mpi*%`!HLD^~8i$rej@yPUijA2mD zg(??<5UvP3=t}+|ti#fLhWA=Gw7Glad+ z#wd@ZrdTE?9I=xpa*DwI$5H(KBuo#&q)bW;u?WoCjDoFk2zQ_d5e&k4!1Lh0S_}m` z7v~Fjf7pWHwG|`6o(eEAmT?RD-oUo`|0J4I9gN^nXYh|Q-b@+Vo#oSJn8QhjOokYg zLKp}&c+Dv616e0{_5yyonvmrn8EjqUAaAC>B%L^(gLyryugyWw%xbe6U(5McTW zDd&%0>hfo1Q5?AefrJ+LaXpKIom{jWz&tqFuWDG2>0oS4RG+_WQai$gHqgX(>yW+H zTI;9`2qS?OW-ylj!bmVzZx-b>Zx)4WRSX4-PC8dJlt`uEmjMQ2K0M-~w3*ex-b)Ga zCM9~@2*`}@GVm|3&Beo-FOF0J+px4>bBE@F+48|C{-8m#`L+i}!AkqJ77{4zvIWU- zJ%iNOhG}|=5p7Z-eKh-=UP_;fC2Kkx;E9f2FpB?qViN{AXBize=eH*&U4ftuBz9pd zzcPTp?0f@}BE_N{k*B3G(Q!F-ogz~iL=z%~(xQ=TI|rMtDl~#+c|0|)TvKWk?ckJ% zZg#pdhi|M%cM8-Bu9|s&n#x*G&i} zwGLn~x$<-NpZl{kz_iZUi6HiXi9M2-iQ z(f${jcW{bofFxA|gr)%9!jD|^@06KBbazo(06?D`^u6_MHg7k)sGS$XZk3@GEyx6o zJZT?X?Bm=9h8{h}Z4MraXs(#HP6a$`sEWr7l@DHQE4nJE)J8{os@O@(D)*6r=ryzW zap^f(a4V+(r%3^_YsSLA6BEVFMD8%tjxIc=MB9n$b zAAPD%^dDHALA6)s;dNJ~ro=PhA*<2a0Ic{=xJ6@{2S7AI%BU#1X=U?soW@Qw_6S&chi$0E=Zv2P}34uvp{h-3YD*j;zZp$=Ds!&VMY3|AyZnsaRJmVf3`!vyes>W4bLvaDqDFfZ9VuLhy9X}%c zTB<&={7;tCLUHyxf=vlKfhjfEQHTkj3-gb)qJxqDeExFck>--Ew=?Zhb6m>Uci+~6 zx~8Oh>MdO`U2_iNX9^H#P5SR@`AwbK58ytg3`O(^iaiRus~7R;RG?4V^@e= z#Qcv-#8~)E=y{SY;Lh+tg6P);Nr%5HEp{$*0}rai#(sR5?e~({v5w!Yn}{d5O-R;< z2*-}3;IBCAP9u@qO>8ORXrlQ3Gl2pQS(qIiFwvV4@goA5fKtqiL>PUP{B3E`OzkFF zN9WzuY9_H_1VkY`yiH%eR@sh9nEdC+l6Pq%f_bq=_t6j40>zs$Js`X#7}+n9Il2|I z)u*Z^H82?K32VF;N6K?Yu>AU(R{XehQ3LsnXn*`igT&=JB?f`};Zo_p0Hs@IR#;X! z8(4d%GoG!Z&{z{C3h#1Pufjt^f#a@%aJJf}&}{5rlI5l1@t(Lm+P-bMX5$J*7y7bv zG%ahB!lnJiJIN+FFRoohxiF2N@3gm+)e24{v6d6{aIDZoD`nh6Jho3WD7@`iNe80= z<`TTJuR=ytUde}vE*e*a`dRftgKol`4O}i+JS*S3`};@p%2swc!zpcZ_I}92!3JR| zYW8X1_coJ=W~Eopa&Skh6I|}DSam_-OUnMHHY4-)ZCaeT5ii;Wx8*Ck={ty1zxK@X zMLd&R2PS=X%@LN>oha(Vvba=+ALB&R*`*p{mKTrkZCJIO@Tu<|PH!gZEZuxI@CDE4 z?2FBs7M6$eVpfkgq!9{Bq83d{-8^lHvhKu4#K2uG*dp58&}ulXKh#(oFpu2E^p{-T zxsgt27|WM&HH!oPqN=9PELD7)> z)e^;n%}@Vb3tid2I$t_h$YP=9cs1KbS;eukI3?Q6J+(zA89ppH*pR)YE1WY5k2Zrz zeJe1^1R$^u+2ilE6uSyITN=g*3$$|2O=8cCC!kFbZ#_i)79xr#WGtt}`%{m|*J0#a z8leB?BvS|$*||L})p=fCWB>(`IiHa987;Hp7V~RL*j-o42GF~z@(*_Z#3c&?m|_+n z&^!3ua1S0na2PJnMWt5}U2ybo@_XN#f&9Xr1Aoc5MGN6+>K{nOsmgEaV7l3&CJUCd z2;ofJFpB}+@C-1nHHhGK#axA)zl6L+WS{9)kQ!HaXbX7&(XCJz?2o;sw zKeW}u$gk$)3wAf|1bV82nN|lgPbqEPXtEV~;@>qbGqh;!ngpa(ySdNqV8!)8(A50O zW&4d9&1$aE$;sjV&E{dNmh+@YnZVG?a`ixR91>4DBJ_mbZW4zanwtxa2GTI?#Hh?t zJf$`j_lWz>fDLMrh8;Y)BloXz4tnY*v6&JkwE-yS5I*4>5e~&b(9fAUT`2K4Tjx(` zrvhcnb&JY93C+~N?w=~H&AuF{+yqoEIZ;Y9DpZ^dn~=TdA5tY#>DR`)RXk0DptykW zujcltyxCb{I5B(P?#!&x|0&rI2X><}+@}XXMn-LPa7{C_82ey;XZ<(=_-GvRR0^W> zS>Tkn#-;sv8C>=PA4)REm05@aaO$pW~h13l(y){1{t&!m(uW z$08PObN`GaDEwWP?QDG$1tBVoF{9T>YE$Fe8E*Bn>IY;E&_>10PM^DMnH(ZT!O>O! zIqcyH9$A$G9aU9+Muhi65mY6C>G_HHV>tXeX<_7^^7H z#>?aW_Eepkqwu+#TBY}a|DMZiHQclo@CbH&X&{MCW?4#8gzpY;m3dxN4m`TZS=x{5 z-z8TwCCB14yA3Zs=DWg5MY6IO64DNZkXVqyw4}cWSqiQz+^wrFlXWm;`e0PNB!z?l zx*A?Tso+0%<^G@_jd744MF6-9N;(z>;4UcncZTm!<8iN>Cx>FxkhqJ%_RY-$$y{D? z83+UrmX4O}x8}&Igvq)^7#h3CI{1#6u=Ffo_36`5Z5^>bpFfrH#BZmwh%u*I7t>X^ zs4rFNmmPKyux%uAcOthnjkGPJyjqkm|GLg58ixC&)=QRvEHCthC1=r=&DMe+zDS>V zM-C4aIItxrlzWaxj$M5=;14MX?0k!7=0SzJ_9D@W-@z`#UR66C37BZ+xD~h@jd`8C$AP=NQW8{ zgFBk5Ju4an2VywLA!*auY&p?Jc{X{}NJtuy@MtP-n?*P#EjYPIg{PZpLVE zw$jg^Ij_@f;K;o@Uryl87_x=+3mKzZ6Dgy$19!?OQZtN}n$O|-HM^LV}u?S{P_@fGQ11Z1#r&a$k7{*Xq`^6n&Ldk&idV;H;^Ww;C zw-eCxv@)9_|ESYGD7JYcJgyla_5gEew{-i912WhRCT)}Ou&c@}nT$zR8R4ol@|@z- zpz!$0(#}Wzanm}MKPEtbK^|EYH5Dg4{)VLfWJ8lN`B0AuOu*i_N?Ni|o7^s7=r@?r zK9Mer7>@f~O%mFQ|5VR@bXbK+D^vOZS@1PTzI-EGp&VcVkReoKnmt*`g5cxE7I8!v zaGSDp1?$4ZT=&BDS)v*k*G7Gp1%t^~VZR)Nsm`L$(R9uc zMOy#qPYh;X=XXPxKJi6b{<@}m$HV8YVaC)!M!IR_p-xqLK3Jk}Vh~}BB%!_Hi~r!# z`#~Sq=q?|}0)XqYv{@oQha!ehi+BHAbg(7iirzFg4%5{X3N8N}EH~kdDOpPT6!4*Nmu~0)LQ)vb z1kaWvvUQc+{w}lD{NKSNy#a>wQYVFUGN8|8q5!&quZPcYu&?-fZ=4 z>%n8*6@cAwN~PJYxOk^jFK%a-nmgB1VSJL6-sg^a@t*k18B1-)-!n6`7TWofo%x2E zE}4o_zVElcOnK)d8(T4FYz3+%5xz6I7@PQps2)RPyG8jp8FCqw;*&}gtzjI%#U&rWPr-2%FUYtfrakxpSRz6hLrjG@z$9|u}InN7$EzKkHXUb1#34H$~ z5Sf(@*cZX%=L||>^!g-STSsA-g)MlJN22>fk*xlGy&2cA6@nZ$|E~)8Y}_w4d?748 z3{U~OB6cqF^y#ztKK4V!UIBZ6H#iz?R5GW@tY8Bgze=#&{66vnUPxLxae2`h&S~scN7W*!GuOw}rA1*s{^8wCAqz;QSL^t`B!`>ndDb^F z?fK~agWJB;BVh)U8JK-?HI&f?)~OU+vfOlbxX0Gk@sx0fs=r{Ic0qRNWmsJ1Wmr(H zwy*)AqIx3BMRnQ$k3HY5C@4Qz9W=6|`$dI1-ZB=prxn7U_fsv1s$5kpjxOG_%$w(y zYF?rR!RTFDyh{!}t|RH>q^eHVe{u@jr`vx6!+F0=5U6~&4N&A8BZnL)E zRC(_1h1!*BBJUncV=>fOc%Vc|^n)0^HGF{U}9{Pg?!G!hq5i*m~G_p>#JdzAc(^$|^uhR;JY z*E9`=&p7$&znZy+?~0iwlB!AjTTx=Kl$7jy@mmC@lIG%!8nbKXZ=v}@{1xWOJg(U` zYDbCX%|a!qHOC@ndx(p3Pj)IyITz9kMdKXVV|&9cbSJ1ohn6%x(ND*CdjWbGVsf9; zx8sqmGr;>g4H8{|BRmPnrd8GR`G|ZEOm5bhW@gm4l7e=aq?@L*(lxYloROr z4oC5qD*mtM{5^6yDJEf0y~b&`M2Ju4>pp=URBBlL>6X**WdwI_hpExfK~HKxO6t3_ zP|5cB%rysQCSZMP(@=7qYO9QD@_uy(8WIX}ku#GpWqR$YwdnRyONYJ+m+|S+?wn#a znhht#w2;ZaTESY(){bhNcna`iDH%UQmEI(*lz$J+Z5C5s}_L zpglCOogX#sa_X*i2S4A*R?a`Zc&b4>b#0X+6YxDK-acw*xz(?ZeyiNaGJxh|D&44h z)myl^u+5k+NnU;R{FR!+Ir?}|AhWvm;`uuLdfp&^ygPpWLs>ep)TMluZ$sOz-TN9a zE~ZXIuhPLMBuYE?=T0)vty&Va~ zhrv8v65xqREe(Bz>lCnf4|6gn0rgq4x!>zOmgB*#N`l|NkUNzOJ@sdqx{@yfN2NK% z>l6okk1rDv&@l4a*tqN7DYEId8o+b2-79u1A&fY`P|cp@AFlrqcb@NF6bF&KforAz z^JM45b!Csi=4|`OSzvcv<|J5;Xe?z=J7(-&aJPQGl1BxK4h>hrxC!NL9ggaYomrq{ zt2~zKSc3!CPQ{UP$tKO0z~jUwlsbO~NkXhrF5iis|PhM-8CR!ccEP`ttK#b+*A zkDVN#L;Q4STU15L6-!s$HP5&GY#hy)A2qv-i*FFYC7Da=H2ah2`VL0Q!E7PYJHxIe zvdqSci{NfQerJ(|BGZB_#!3JyHi}mXISJf-fln>)02asqR+9Xf>wsVp`(l(R)9)Yu z`3%Ny+x@$JQ`km{q9fanO zupPdf2c$9*CH2tItKD2G-+I=Y6kt{Bq-naG>6dLzjou9JJtB$M;<8fpW++qa>ALG#4$()OXF0)5+P=5kM5BS_%0rx7-p!?q)kFmMxcldm^6Hkqd+Q|>aSMl(&$ z+}}QaiV6E5@bL@5+D^Du$RgzKshN&0x>~dI7d*Y-e_pZl#+V9ENjt0?K4)9RNnNF6 zdxf{NJ{ESWnc;cnCHnD^^~P=&?Dga6RLgS>xg#rBN5Ie^t1J(}(E6AZHQY~vR-vED zKv*ugLTaw3+Mj}2;5Ky}fe$@ULQ+$GN5MMbGa2W(rV{&ED@7TbBr@sub8RUu?=Ch% zaTh~(qGwPyw_7J~GVH#w1~%v76UGQPsNh@z07dD zgwTgqpFNf<>Bc$u3FT`+>G_ml&4m{^WX>!AuW30o2}%cX`mEY^U&AuS_fIovNq!F7 zxD{3~p@crgP_PYzlzcDKw^I=jR(h$uOsAd-d~zfE%eeHpW=E+2#$}T4R7*o}staMv z#Xh5mSxQF7TbUqNZw3>26}fSxnxC)ie00D5(aHD|0{`fwftS_(!ljdv&U=^tlVla! z-RtBUa;B!ySWG5QMKjn^;fi~*2sbnzk+5eA!*m@l31IY-OR6#bLPzaEztD8$2fj4> zXb|2m zcPcaqH{x$l=3_ll5gRyA)P8JqKIdtur$P&uES-(ERN z&vl~4IMAGUkNiCOF7{1EDAIW#l<3TW_D^y-5|!P1TLn75*B(#3< zvtZjiHTWGs9s5o?Lw%Acys+g`_W7A9Vcq7_?r(L%O*p518<)HA0MWZsQ*fqUA`k{l3K1Ryc{kf zH=?N^c5TK)qd~^(F)&L=6h{gf$T;Qbi_XaTn_H05T=qzl-}eImxfM_%h@Sw7cpf@Q zdvjx+%8_)EdJ2@3w)C9Acaof73tZFv8H_0Z6?6GA4&I7l^YipYepm5Yn>XvAd_EV> z^Yy&))hkgJA?gpjFV@IANAe}Ii~uqvSNK0Nby#eysiW*D5EkmW@%lOF)q{*C%59LF z43V_RKcXQ2DzEw?j+*9>D9lb1{Xc|1v$DV@MH>emly1^kh4n2^rW38kJCL5f9BYR5 z9ZYj*qk72yd@k|;T{HW2*3pn4IY>RnVWs3LXC^Ycg(8s)jgOw!9bTumcO z-2VbdpKq4p$xLl5dv9zef^saAia3+SOnmw>M)+9`CFTuMNyq#pp?>T^ezRppv0TCz?0QV4EOw6%s{X#TirGIo=LC56dirXx-4sANh7B z<}g3lG8$`J#Y@!kLN(!f(#8;9&XF7_oLWl*t*8RlcK|fq$0?*@$Nue~tD=}A%cG4C zP64jM4LweDB+27B5u3lCIYFGc@~1UDs&FG*tk?#h$znW$|DwW|fuW@!c^?mwF@1Mj zNwJ*a)WveF6wM-JB992s99#-}Dw}jhqX<66i`iV)_xqh-sCBY?oJce9vV{o&G zFuRBw!uICp|E6kZYoG0-T3j68Xb4bV>iCi};mJG_3N;LO(mlJRI`&A$=U?&(-w%m{ z5TknX|3>+_l;C#08lr1ib94-+r$2%OzO{vyC@VfWY|(ni^qP}m+UhT8NFPbH=kE;bUSFr+my=ss?u8dh@PG$Y-W zD#l<&p;tO&S;reuzsYx!$4Q6kM`LM@O{)*8Y(x8Fp4Rn0z8=j z;-$Z;K^Jl^=FC)OKkYQKE-uh$8y#DBLo}mF8_@%awuKSW z;WtFsZzKLk8C9OdSwq~z^^DU>fbSx#&%Z@k@}6SHTMvZD%bj~G_ik1JWxc|CpTkGr zwEMzHc!0N8yBi@}v`U>w6oq$>HENnW1}RuZ-@IBno#;z@%KWr>2soS3asy_ub+kj& zK%P1_1;{Q((2d$�Ep#0E?4Xi_fLmkRy9P2eqk8knF}7FM?>qTP}^&Fi^$LZ!pN+ z|6z()6x(@SVMw=teE{(vrd+@aPex3TW$nt zR&nOtLKcPLI{DwPHb4cR!FCbYHzgx+%02Kj>N}5h0p_qkaKCpYNqy#*Yt};m)jJQC zn?O&(${lXeu|<0p-yc@PXshCQw1`k_{s$+*T*;cN%4yPRBxA^baKh@3MPfJvKpI-v znJ*$js7w){d;qCUu}&hBL~oj-rBo}cO^Ei^K7W!KRmkr<0$Gfp`O`}E z<4&*Q?cJG6{U{F4ErBgpLcj8wIfXm zzm;y5*mf5_`GTH`l6yaT!ybWsujQr5Kfi7mCbs2sG~jC}bz-kqox0vH zBY9o9HNAp&nSCt6!QmI|zK*p_-qPK)W2}saRs!u}fQRg*f6@oE-KBO7Y-B$+bEamQ zM~MzaYrubwCt^pJ2eg7kkJC^JB?%iB56x)*tv7}eXkAr32c#W?Jz^t**M<`tXbvaS9A_J z%>E$h*~WlhJLL6W#UUoVAZCxjM*dor+^UCFK4cj#e=6@xtuwXe`A&ucGv%T@Q>5-rt=XfVXz@Jory<90pCou}t0W^3^9$>Uu@ z?Tz#Z-sUw3crI#Ot$_6wY(F|MG&3Wr$8cAkn^453zG>ccIHD)5QTTVWScy21kkTgU z473hUy|kt{xP8XxV9gMW z-}v69pSxOhRp|i4w|&Zg@r@f~{??ZYHG^9bV{gU$?eQ^#zxYycqYQcq^sB6u-y2hg zhV`R+BF9hC_6c@7$w4QN`Ra#u`~2gKb5X> z=AwAdUIEpllw`zQ%|8Q>=1iAeRj_^=5V~fnTK3!`xh~ePa4u@4r;(*(spGXR_^4v8 z@h0o^HP=XMT7$Vg(=sxEZ>mMX00-LJVhr_9}+LL zuADc^;i65=_q3O=WK{cRPH)zGYj9O-A0k#G#P_s*JB^P>4Pbc;`y(rV|KUrjl;5^? zJyAsGa=c_P5v3}IA*Q4o=6GTN1ri<9EX`L_)C_mwzhyr@WvFwg-o9GNCP5rw(mVdv z^*&D}lL&A>^?8lZU=IS(kQFX(9DdEebcbi9rkr6;-|V#+&XG9_A`CB#SK{r|6B4{{ zHLbt8pfe;6KPvD0!JA_l-oT7oH<~+)dw17_)6?2sc`ZxV9}Cy6hOd>sr1oX^eXDPS z+Et~6>6kat+efFNE(4epmAR#)0YShYgu`**KZ%>Hak zuPPKn7^gCh*po=}&CXD39Z46#To;rQ?KPo2TTtsSQ==P;a!V2mkn-SmK=LQYOI0Yx z{N3qVeEnxIwOr1s;|Cs6$)P!w65gM8w43=p;qOkaT}RF}$AAmJ4`|~M?i@6M&v5sa zE0^TbIO9ycX^Dil%-(yp*puE^3~N!=ikSY%!xIT5i#A(ncZ!x*ttTKabjNF&C!56! zCPMzZvuA(Iic9quFH<`rq^z*8Kw*MPSy0M7d$obO{~P9|gwv3)7l;2P*G0C-Icehq z$I?xTv-~vVMN#JBifAIIgTjO3!nMkqWLNyepvP*!S2Ha)E&}%Yd0x-jB8(o@$|mtZ=|Ao?dk}f zxuu^6jk+(Ab^4oOy!FpD#YN?PK%&`b`VLeG+A86ujmDNO!)x+m>oJI`nDKG*;v&5St+9oKPl zOV;^yeTJP9r5)w-0S`8s_mdoylr65j2+;n{K;nq78yoZzu^ zSme8sL1w^79B_IceEEZiWl+P$t#CqJ-O?RJaq8=V7<@7LNvK~r_whGR>Z8P8o(V;i z=4R=l1Gsj1X&u?b$U+uHSbviF!&Puo&tcF+>)DrwhZ{GvZ5lGliX60QLw=1A`i;a` zFA=SRVk6|fM zGE_eyO;Qf0I^Q?TBwO6c(nITc&4}KEu@)#MIlq@AzrKF?R{e4icdB_R)581K&-ky4Ua%u+ki&7vz>*hJJVG!xXSE27KkY_p zmbe~$EKB!P8UH%qX_T3UBNbH=;DEOPbD1Z|nT(rwvu|v#;4^4%g4KYAKYO;0-~Aeu zok%;W>}zI5LGQI}qc^b$ACS_#wbZ@)+YCfIbXj$pkMoj5W-rU7wt*oDY!7P$)q2!>PjMRE{xkaG7eULpR4k9g$ zm^@%-dD^7U;f-X0hK)M`m;|DUHxw<|qvHiOazmZDCg5*>^SkeQ`M818hP!QCVYB

VX6r5|puuHu{oxU!ZaGxh(9> zgnBySFp}HcjeyQzF^c{dt%#L6+HXK%GIctVLFmp_amLyFA}VMC zGAeK!Y8wp!5fxN~QBQ$PsLM7O)66&Weom5 zrmi}y>gVaw-CfcO(t^OHLnNf6ySux)yQEthE=WpuH%NCk(%rmQ{C)BL_rmk+e0F!v zoS8Yh`??-8FbPt6rxPkF?m+gAHV`|75oV=AGGCvHfDx{4Ua-`Bvn7OJ`1K)mUEC)x z=&cEvkqS-Btnia*Siv?}uA3F_l{)}IH15iT;@MBh>W!v_6OGs+@w##Ck+}qVZntAA zhjcb6{+wNuq&4r9l2Sk4(lhX6EGTmP+XQQR%pLvBZvLB77u+(tf&4e{N%Y!34ZWIL zD3qQ=myH)m|u)ga6YT!BVEWFsHP0xa0yF2hK|>E5S158E z9`T7i_~+q76QWo4ir>;f9v-Imf6B9a%j^hhw86bzPn@`vviZrjW}&ddtT1hgt0 zNG+aJE@o(VB2HsUrn)*Ud4PL$;(~cjcrq$fw~iP)PK(hxS;5ioCP zZ$B%{T*!>dl@_((PkZ=CQKO3-{I`OkXbIMJSQ|4m?Ypu5-Y3kAG7a3MTd?m#sz9U) zwIM>a1o%&8HN?oUe`TO*iO%i`6&o8M`+#cUwtw|vV6b#k!<=ex&2=;V-tyDv)Y^u~ zlL8AiHpAQA>;}a>JkOZH%4=JcOFAX9M3aXmB!0y@3sJv~lbV|xuLv#DWe^6cM%N%OjvmsQ@BuU=mqEO+D z%UxL2fC0|j+d<~|FEIZ!L387z?UDkqw0R3OuBkNJpC(ELWOBfqMx1*0=ik!D*cjFf z2urCRKG^B?J}k}l-qjkZ)cLLTUGptquC^nLHY5BBzr9F3w}$W1)<0wWm0-Quhx2rH zY_W;Q-u`-4T_-UgY9vPtQ`NeL$Kzrp@-R%0^B0|4CA)Ux4VvAe%{t{yOXoCq8gw~j zTpKO9+n|o9uLwDU)Se^i2vB|%K=F^d;9-+*)BSk-(x8en=#m1b{7r})M}=A!)ulEN z^5UPrnNEP+*(-Wyfc%X$`}R#qGVgJ1uj8C}ePJ4qB0)>L8ED?h=d>uFX;$?tRWmlM9J=i8VEs#^! zGC{C82T(NFaqu3X{%=cVFe5Wa8wCu4wv;qkiu4&)HtM)s@D*QCGweB1i1EA{SWRv9 zVX?=hqr8#DyeawNQ=pxDplNg&pI}GJbHzZq*Ga(=U%Hm!E#a21X^*_U#>rK#d!t&>T+uZmi1IW6b3T}jqh530=G zLeSFU{Oz5E{)>`%y_Mu&lC%=C;X>)&2h>OFh32fj&a}3~#McvhMXWSXtt!8Wjy+u= zVBhp70>l)a>|)GsKz7t1SA9^ddY48z{^UJY-hirmX@WdSYkSSLHkGBJD2etd4vy;m%Ny{o*tXTds;v%OrrAtMvHG{SL^GX~)Cee8TJUNfD z2DST{$Hi0hpF{OxSKyEQl38&*J;rEBhAh`Ril!NzQ;idM1iYC27Bs~JS(ui53>5R! zrB>=b&QFTd;9R575iYTHqFeuS(*+YaXEs_0kek-ik2R@D0$0_lS)8h-mV12VhNrsd zwfgyZONL;$@Zm;NbAFL*-3l6agiKw*KJ7ANI~4_>Mrt+yT=&+AzErH;8y4I0e~cai zckD;mcgXo!doCrxn8~E1X1u|rJ43Q=Ixg%vOkrpck@^>BO18U(oes-(nF1Pot5Bj5 zz1+Kt_;UMe;lMPEYIT{^^vQ;B5tA4P_H@aN!b~fTujq;RU)cxbN(#((qbi8qKWq?v znCgDof|Aok+P14S*il<4T7J7YE!!p|(~jKT>hq(}<}uMu)ogKM5UbVn3FL^($nVwr zuXe>7IRNz?29a>Moss@yi>~03db^jvOfZJLSU+1n0ZxTWFoJ4c@U*+UJ0LRT=fACgt;Hqg8vBLqA5XE z#_*Ry5L2-H{4w)Du{LX8{ye7H4Y=px+0D7I54x&AGY4pKdK5tBSKas^!(rw68|pq( zKrp~)=^zcK$6OlFD&;9daiu?8_ILU+wl`<2R?R$9Mc^`1v+p{c&kTc`BqD? zOjMjb!ERNDw*6TCaRzPP3A`(F#Xt~eU?wqTYJ8(VX1?mi-Z)}`#WnS?^XO>Tw9vse zpLy(+Al|few2^6unawMvaEUsfUYqA_1pz1TxT3f&Ym$4{t#z@(SAgU&J&fC|D-UU} z?ceP0dF=LsZy;}({pmr2=Lw^Bb4+_YTPOus()jmQKf z5l8kLVZFvLRNq^}xfT8}<#I%I;%c346dxwOLEzeoe}fmOo1HreenyxaLSi z5g?hk*7}^upJ(iCeZ97#nEv^Q?y()svo*hg1^JK1O;ye!fOwG1ML8&5e_HX5vhJDkwK-S|5Mf4nD zIgPZ}o|(va6z+SosGeq?N#CM8zpyi(j*4D339qa zd8>^KL1Y8pf?2I+VvEIVEYo0H^78}h9V_tGpKdM_3!jFX+|88?4n?9ZZTk0$YAw-c z+Ta~cne<9^B+LKqU)F8P*?2R1%OM6W7}_rIaSK6&5n1)|ah-R*m@RzbmpgJ&DLMG1IjF*@T%aTy9i_aR9REo#4lomALzzC60hL+*5N^ z^`#}|V7EI@x+kWxmS9KR4sEiGbUrLY6hdi{V7lsYj$m8HhAzBXW)DPfhC$iu2s4$ZCwSsKe8>Z|uGU%@KOL0Oa9Q4QP@Y^EOP^+c2kD4%!W}+l z2wc;wIGIb{oS^kI(d$am=@Xb`3=gD$R#FXa%(*gP(Kk8v8nP-H-q>YovU*kvIFdG; zD=BXsv95_{rO`4Y#cq4B(`F^Ecll?*IaODb_4l+p zWj(t$X5Wck>J^dppCHaEX>fubQ(4I*o8fAj@&~9RUYsk$(E2UT%ONCQ z?hg3#Z_$U=0e9wCiqZU;*Egw_&d#ekh7BI_c%Pwb8AJMt^o^~&K=&YpOoF+3( zOO~n$U3hjM4z;nYh;DdV?+TtS(^Fxs0X#gX9_Q?JsV%ou_#u3pH0XW5*{#hzJCY_% zq6SplrO1VSIg`(DbP?*Nm&agmb2em^n+P=b4K0I_}X)-NV{& z_)gi@#k)dv;Cy!d+kr( z^(a}S=7}*aAd_$My6VJ7f7J?+7}TI+>4O?3#r?QJUZhOk@e%0(3PT{3Tg=J)gi`%K z3FJwx*bdBO)bOsD5XjSnK4u(c%m_-OM`thF}NzsoXQTU)A&en+IY6_P4pR7>bY`h5kQjetpC;rxB zvO2gYR%6f;?fT-8>G;jB!}**YjqLESf{Un6HNT%CZhB^wrYbdD2uPu0t^O<%Lf$NQ&S-E1Ir^bDgU;PUKq z@d)Rj=?Y^+nZ+jE6H0wS8YT?S!MYlpJE!n?cgy3qWw*=ED=JUxAU3)EV4q#guA1fP)Q^95jqZpV`74`rFJxx4?7b8t?kS$jG$ z?^QzmZXudpzCR8XOO1&>4`Q9e7TEtiF^_~IR{0BY)9X~3sqYK8*!$J++_}=Pvj6Np zFvTePV|OEY#l?q4asufZ+IxXTX*~ajc#q%IGX(wC(pTps8pNIFKC2kO%CpPsJcNkb zolzC%O%3OTOtxx5vBT1DcAWesm8Im#V0Fj{g@Tckq7)v>av~3idB6Kn*|)W7?0H_M z_0eoZ|B|Ssq&46JWVgeW5&tpzxuC#3XpWUH*DPRy=v0)?q7BGHRdA+Sj$w&Llv9Qg zp$~0d1vdg|GdGcrr@|YSILetsuc&7Nu!}D)=Xn-_T+qr%PLaI zbsXy1m4K4a?A%KOgUAwPc&(7xC4EJ8;uaYevW1PtOk0b!`Xde2?98_xGQ;o(sI*lX zGhQXBG@stEc$njyzQeR-MdB)Y)3#(;oN)>i(bxs#Z z&gF;s=Z4P5%=d=PYB`-DGk^V^auIy`eTeUttS7uT;kNgs9C@U4gNS~n}i`m z`)F%Wl;ipx9P2}~lZ47+vw;N^4*%bAcsr~ z4)DaN_&B1PQRqE>MlQ76n?v_+EP(K|T{wr&pHJ^if}Q<4*4LuXQ-b|zT5$(!vA|zj z?tWWgX}MVUcC77(wUR-PL}UuPm~_VJ5lG{L7oq5mdjdMJYV;vASqQ^U_vy!J(ws!O zQzhL>bx7JGs6XDmsnMt}8+PHzbM7;3baAjJPK`Ji@zGG+wRhtj2=4YwNV(T zragtcberE=xWWUv`X^yTb@}pqSr4 zHsuT?TxR+METrdDz@<@J_yj)@IMMCp)=Vq6M*hT*cum(w+ULu_*l&J18p(*P>*#i; zCGRc%Z<*ZVm>Qcz} zy!VWc&31E|uIVg+5-BLsiBt(;<&1bK`q3t1rcX20&Z{9h#E#~XCwcEL^(j_9*}tP8 z!`nw24;I9bac=GIkj)Lp%^010vULJ1m{S5i{p(~2uV07jD}GJcw^$Ul6btoq8mvCv z>#?v9ub1_!^wP81D9Si`_SKrPRD|fwZS8=m7@59ZqP;Es`rvrpM#>%!+0DwhGq}v5 z;k1*##1H$UVLZ+D^tvfNHg%)+$2pyzL@7$@{2Uw;U5kjK3~{8QT&BZNddZmS-}34N zvhk%?|DX$MZ!r%<84B4asLdd6c6B~U(g=_^aNhi(n0;z$Mr zY{NkbXGTipKqcY%+mcv|ZQW;VjEJ_QNg=a#7h_ZZx@zT#UoR4->I4pxT}<~kZHfv@ z5BjT24f%MDxgYr@V0N;2e1lMQGj6ygR5WG;OUnck4aAa|5^-Y)g9Na!dxo|e^m6)F zxj)kUmHEYnxV~edy^sKHF6P=zoR`gIzmb@P)GwK8NT1YA^S$jl zCi86M%Jcol#{Nk95$t3;`~+o!EG2V(Y1d7S6B2;gU5s&Gm{N>MPKhveOSx!^d0;0p7og%wQ6JQ3N!ri0J@pZNy0l+B?gqogHe%famz|Tcrc0IWxM>>WB?prltybftpuw_k z)SbL-+9eE5C*s?7m%LBMa@Sd|nNavS7mj=EWtZA+nUlZPhf_~cc|IK078%WEF+JQr zA3?2_egFsDa`oi^BqutILPXb^a|kQ5zg2CLOK$W@Q_PeNy_e-CLVC?+XGR%YVFT~0 zeAncyaz+_}A5I?{)?VOyDOWWTea)ius7ACqa*%HjrDY%EL%NvsE#YvC>32VHbso;b ziijb9k3WUjKbZ zGo#LDUl9;(f`@n^GrkvuHc@*E&Ig309@1>YAtuZeZ1@wdf@Dh7TZy{&GlPNzM&(6W z5dlA0{a#|lLiE*1bWi{8ABCi1OE1exnX>#DlvI^%!X3AvfIL;e@sy@aYApCI0RLZj zAX}oyc~t2)2G*WNw?u@u{Q1(23Jp5o;ndi*TeazZofQoX;ck3R!Ook(hqf9wXK+ej zZKQf+>0E`2Z%QKskJ8%4CNpcLR!x4{X{@Oc{x3ky!HPe<+z+i9wLHh%Nr)7lzOs%c zlC2HxN@?$Y6O1!T2}GRUar%zBGv#ez;#foUAQjbK1^OXjAHV+BS@Q!a%-@0gJ?I$oM6(gUYU?wGP_MWMzQLshtULn{;&-RFpvzr$j7uS*$_)9vEgg=ylT?$Wn+&@nSui&#{ zf`c|)L@^gz3Iqyn&fl|eOaa8|2crnMAO}x{fX0nV>7Y0MFy}mkm7mp>#~|dakc()D z1hk&1=JPhNhkr}t$pROzboqLrO{`1kcWTr_@Z~}F(6^L zy8`hb8zJHd(Kp!9vUGYU#~+e(PWN5p;>xVoJ>Cx1^Tzix>&U4rMMutj%EsqEvL6fi z(f-qv7@l^96^TUgH_0DXFG{6OX>`u`^`sNSGqK>@n*72W(lRD0R zRdh#O>}q%^x+a2Hgm7O^LnS!3--4f)+Y{w#b?n?1%QcsZ9-fTEeXaDju5s)h6fGR4 zQf@9;4?k4O)|SpWE(sI-CVI0p_wV%7{HK)}Uz#mEOyHE3x6z4|y6T zD;_N5_f@w6WNcLP{xG}EJlpefS)g?Zne697=l&DE}v$1z&_zd{psK0M?FbfTI)?rxd#6 zah+b)rkkKV`5aVQ>_0Hv#Gc1-+4ppiy{p_IN(pwGfZn}V03b^QKtk3}$p);e2lbj7vtdCS6Arz)8dnGjV3 zqo_SA6!oRO^Fz)7>7W~Esc>08ffXuM$eb7Db9ETUxBjD>Q}pF`f}Ca!b%8t|Mcy4V z`aw^7)>@%h?_d9R3_3(!t=9)>$d~!iTy@kZ>1-z8u3(sZV##$KaFjgPdu@OC0AM4L zUad0QfphKCW};;ly);}Sl22r`Mgh`xa1?GAXD)j&9dUiTcJ7kC3%R>ob1S+Im=X)JFx& zn^Lt>8nZWY3ENc3xL>7rg{@2x_VP(T89}FxqCEDZjLOT*`pbs~gox@x1_!7y>HM)3 zRVP2t@-PN>(rogwAICxg-h{k1jIXA0DEw6RM1kyt_v8)kAs$PO90N+AK#;?!0o)fqvcrA8+89vl=?A#-Xv)bb;Gs(6qHs z6CXpr;BDJ(w^vLK$()IRUWy}OT0W9x_IprcY4B(|ztfZRN7S%X>5seXDP z6~7CS9+z}+{3p_8zOB8rAPOPJz^CmXjbkZ{tCF}OJOB0(#ho$2V>FG2xy?lCmAI6D zCmzNh`eG;BJg1B{wk1xti=%!)Y_VKRx{i>^wsj}pf7_qWG2rqm%Z;kIL}WSe$-ZcD zAaetB(2r-&oXfNkHj=1)@KcwrbzLmMQc}0_dHP=-lf-d5@@Ue@8D+HZrn9e@*$h>I zk#>y)w>&}bqL6FQF-|Z*G-a!j&>{YPpg0c=%M!2Akha}L`k!Urh>!7y2HgHw1`o2V zWHUjc_FDg(&r<<9dg%9uY8G4|61MzS*_C&1?=HnE?akx?gXCU9Zwpw^LL*j!p~wsofDfNEh=tYbRCU z8<>dnKb=LU>#hkCt?QRd!wqSnM8?wsHH@9**x|Bq*%Xb?-8ET(2(2U3p#X0o6{nT< zm6JC}S26Q>$;%QA=JywJvIE{qZ%D8F?0}PnV~@mU64);at|LD^Ab4aE3{?IAg;t$G zLM0^wGmb4TQudIt`VBOr>B>%CJ+X?n9`IlAMC6fRO~RJTbFHd?&K94OFRA6imT3K0 zO`SPd-Jg2gmqD$>pK^`MPq_@Nkq1C^XK8Hz-12VFw~k0r{<%BAVJDZzX4iTSrp&5v zXoNe}sHs5CKbN_A7=3h7Auv)61DO8e0ppIM8&UlioS?VcR2MW>U|Ogh7c0x&9^8?$ zpb%*w!`WAtd`5#k;idVKTYY2F7s?!pkLtmQAf)VCik|~-ZU0Y2U6L163R9I`EN{g& zEogrWVOIaP;*e*)$%?)U+jF^e=8S7q3Ve=MURbQVHY~`f`c7v5c1iBNR|>8g^bqd4 z^MO=7+~Ygb$C9j+EIBb+=EE8HXtvAJ`@1v?E*4J4yj*0S41^sc4ydk3>%fG&#oe?n zg72SU|ES*yhm&z@7qA0yzaFwP%-hFTH}%g>GfM5jK;@~u^Tbn7=yOiD#c2RHGLfOA z8(tjW5K}oHvS;y{ctf}ZUtllu_q=qST+}$SVID~RYrYsVB*itCZrNYq7R7eli0QyW zy9Ym>=2&of7k+T{xF=KMG=fX!=#e91mw6UrMcmcyg5d_3pvdf06M62Tu=Is&o&@w> zdH?Xy{M!s2NQ1Y&-cM{?P{Gg5J81DMu9ZAds5~m}LV_&_h4iJla%X_L)+m(5sVIko zq6N+y*?jx#paN~6KuX92Q23Wd1y1CI`l%G@f*`9it7yF_(2h_(ob{Lx1saPXab$01}3+3ConAoCf z^$G0RY-HHjqJh(XnBjGUf7* zBb$PyK$=@FvP8=O4qP2?ivLF!6?iB)lCZ_{K|7v?K#W&SVOf%8NXmgQ8uWc!*xg`* zSwM3rr)>4}BcZc`;vL44EN!2yhnA&M#zEkf+6{b0&sU!-r5z`-M~PPNJB@?urq79u zei%5glxdkYA||Hyhp|7)&#!ZnNH7q>J3Q-OSy3GnZ7(TH-P~T}bObFFLxUW$>UV z&fW%p>&obSiInVvICl_!(UwxS&%wT!B_3*+>1H3sYNc+m+6e7WWub2g(Y#2#z9cw0&x+U+KHT{!!K}mzzq)tnMM+eP_&MqtzI{U;=mQr&q ze;ciLPwT&R{s?zU{75L3?WKjbF61R2JW+BSCiuX%oY=%cqG**KV#5pmY>~>vcYN!| zNokkmb*)R)upjnye9IhS|H5#hg4N;*-eXaCE?^GIIx>-9D+yjXw&^7jv-*IsgA-LC z!*?Z!7~o+u#Ie)q;@nlMb2;0zk2lbTB~httr$}Q40CfMIVR-lJlX<6D@FAjv_ihw3 zc=m1CLIi-#tGJCd=+Od?-i1rQE7dP8+i1##H0aaF0P9K{je-UI&rA_}wNz$HvbRm- zvfArU`$g9-m+$wL_J8TsTMDR+Bk-a0IKH`@d?XHWHS@)JslLcWVg4kO`V|NzpaxTv zct)pN;eJ)cBq5lPuh1{FZ}=HcsY!6ZI0zu{&p4SC3gb>Os6)i;jNPbE*K8N1WPzS= zj%_PH{r=Rfj5EC{vO?kpq){hiuUT_cpr8pu|EZ zgcfY$h>n-o#g<0Fon~XoN?E9oA#X|0kQQ%(Ux^l4ar!0h>+#z!vNHabNy(k~1&Xgh zo;1yE(i9M)>LCEYe3V&}*g|{Tam&UO--K@uz~r%CTl7jV45I~#oMApFDy{bs_U$># zgUa^HKLIy@x@iaMg#umVA7ZjE&@P{^7idA;|AtR;i#7tlpScS#frf9FSPK$jTIsR*#_oq=m>qO@wW%*I3oyjF|rE*Mga|2Q)C&Egd3bL-ew8hC*(9h>4pPR|pCYnedib_B=^er4&)zjClT#p2cxn|yXhdkEh- zny^7+0!)W;Ujp)@o(JO@fGD#wZ1 zZ+H{`m&7+j9u>mwevSoe-W!v=G(umJYy2q8KIQzep+EJL5c?FdW{!qboYt4OR%BY; z6rks^*Nf=@Mpvb71=Lrd^7d2Tu=UVoKv{Mg!9*VhPo?njuRj;2;O{i(eM&RyN86eC zrW44h?;QkfWU!5ZlYbT^|3regdB+_#I8SeSj=|Hh#{LR7!RN#eIKxP-GLLgz9Pz65 zvTGlKiKpI~LhTVy++$Cjn*995O^=Npkk60hD;bVUCZ|`T?}Tn=wtrzojKCl~SDNkF zpS$vQ=m1Pb^-e93JG1`uqu7>h@EAID>Vm!3_T`1dlo7TIO4F*13SJHdXXgy2)P2N#&~5 zA4F}n)4si1V5#USpb5H=CrjG?^xW}yv0rog4$OuNA6J_BCQXlmFKgbuadV#!5cI8V ziu^NKX|I)o~em`McGZ&Gj1z0FJu`r7nbK z9k5C+!^#c(!ujdDX>vbbN3K*X4O~un@bHK?ruD1ot4KT$3@ORpAk)))j6HK$(3)dM z_?PGokqqTXt8{>-#AiCKIA@&zYfF{9g&@fW&8G9RCKabn`4Gd#(9eXkzg7nG$KU0G zw-K~fLsnt09uVEWiB$GsJl(#LtbC++1nfR@_JxS&Fm98Z<)gf`Psk!!9MDH5KV!)$-727m#pTK1 zf0`?eJMCjkPJ`^?E_tLxj7IBC=6v-uP+*tC9UhvLd6XfO`uMEEyG!b?pzihcl5oiW z%@jKRaO?@EZM*b^E$`~|&oB?o{@W(GLDc@qg2`0p=Zd?}9_y8lT_-u^3rYx=RW$Gf zT4ga8c<54VF)P!3c1tOppZ+wSEq-kffo>&tMsHsW@CjZbM^usJ7cTd{4?hPQW-~07 zhe8tP_gxW>ti4|FBk=1Q&}3|g5(RpF*){vts6q)_gUvtGgnWj(Uvt9yTJ*!k!qq)IUZgYpzqd@z~(>h+Gx_ulh zk69zoDRKQ=tKW!Ai0&%_eI(2*cQc7C2u^3k9Y**StSc}3doZ{_wbeLbEFHxMzT3xw z-L&S^{%M$X^gZZ?nVSJn#GB<_q1|WhQyz}>4Y0(iB1c5%38Q9c&bCL~SbC6jGC#w9 z-FPSQ#Gmm-CD3IbWm*K${TMIf_a2iy3?O)oYcN6yo6>H$-qfCaXc&gM1dh#RL_$)S zumw>dov*sPVbKFhWMO~LpcoR6^?VRKOC_klHVa34A#63idj20G(R-kTm9b>r2-&pz zhR)DQXn!Kdj4t3_E81!JER)PmsY^s5^h&I~k9GV{hw#XzNU%@j_l^@`9xk4Sz^xFm zWsw_k!(l5*=Qgguj?qYw%V?5LB%5`OkKL=WgNAAABUiP^>NN*(0b8zaUy;bWnwNq8 z$jIls`r&$ko7b!uSJO#kFG*u3aW9e{5lcAy5EF73-R9@^Y$RE8?0xyKDdqeO#OnaW z4f!N#=x%`FKSrRl(uuT@{NWP_>JN&Tm)=C4yHQ9`?H~7{6egl1yL2-E>GXW)^{#{SxdzKQQ&6cO>z{HLK<-pbLjLYIX<$wqp~>r42pZH?tgnn-zDCxnci0Mfk2e@BBbw5xBQ$d$sn!Hj zwepCA4mU&h5l3{jI5ET<{HM+e-|#}sn%QGpAW)yC) zSmW!9$>#X2N3@Y6>=#tY+7tA`#J=`?Xu<2f(S_JJU*!CvH)B+-W<*!=&EFtoR0XHo zfo^d=N<*I^QqTQ0CZG-QgfnK~Z{*zF*8)0R$8J3u7fNeU>5cAn8s`dKZMNa=`LDj% zTZ=gITjt6*uX#3dEL+sNadzWOVbj$wG?sEYd{DVoXb$)g_)UUpuV`PP5Qb`gq;KEg0C66VkTKJ`)>d{l_a6B z!5#Fgbeh`P^yQ(T^;Eaq~UDhej+^jZY^oe+BhnESPR`@i(!<@>e znFw`e`9_Ng1t2h$m57^rXKFI5%o@KM!Wd;lI8cM@*eXk-6voie|987O2L$T~x`=2= z4EG?`B#fhiA!+wLxJ5=4vVqX}G!dQTJK2v_Ebu6UuiMy% z;zGM#-%vSne{>xE;CyRoY5XRmg>SZoc`snPL>0;Ig z$gk@pSR2&*mPOA>-fO4h(%p8=)i!u1V<^T=jg9AQ-}nFn*^b&{d2)0FddL#h z^Zr4mWacr|p89$i#icl5Rhf`Aw1TRVb^0$;E$^wQf$E*dfH1S$qNx8up4ji;N}t)6 zhlrhxsfZxcpaZRPG<-aTL1gyn723;>bS(OZlnJLYC6!k)WTN(c5e~)hFHatwfR6zN zN)rcV$WFW#`#gz*r*iQ9EckrowrU|xOFxb+XTF>3yJ6whT=SOH77Vy(ou)UmgQ^>` z#w0hto*B;qJE5Mv_#=svAWGIIC=~WF((-b6r;`kntL*>w7m(8O#H|w;$dntHMRT%Y z%-l=GW zCDML=-`5qO&`q?rl^U1VN02aXG^zkNH^3@2l?+d`vqH3*(SG09AjtrwCFM}mWr5;O zl#&C(j&n2pi|8f%K#~M)V-Tf?!x=L$Kps)q2Cf=}q|x5k^j9`)(?yuceAbM&pr7)G2LywX!^LlvQ@c#QS)%hN3xE z%;WC-bH;2V>oUskscd7GS3y&Ec>HhD6={>e(5}+puf69>UD7;`ys5Wvz9q*UsZ4Mh z8ef{~|5;(mb2WJb&uH(}lSm`o=rovF#6>RIE4MCvh=+EhMVsceE)yqli=`_(x(y`Zm76^An~4elgGtO6r$N(+#A zQ%*Os`K38B#}{#}@qMLiZw1Fcbekt;OB@OxmU)a2p-;C(2~oW-UY4$>!Kjuib>+aF zAN#;A%oN!w(}^FZZT5it0$}Lj8&>dm!rP>-4k@2)?0f$HJH(TI5 zJ;9L7Vd@Hy1hOm;oFt>$Yz3?3L$%2`ro10ynNZFjaWT<2g^o%O#x5UM| zqlkm#Kw0xqB&yASYjEM_ug=Uu23iB+JNp1d$_p!>)pzRH@E+M&*)v<`&W%=2N7*e( zcKh1SZZ$vBSH1^qw8mDn#*eyJbL9IrWD<4|Edq9gBkbwwesHk=EhMpz)SL8UEkf(unqmVbL{ppkqAQ2!i4str1`+(Im$?X@yeD*tsI;K)s?%Q zapW;kM60>9h{9I$j~f)cXaLd86TYoDQSFxF(ot#rA&+U}iUn$rFdG|-<&0meE#$sk zR+5CNWL?&uzV2-uW#*$rEfclS}_FME?WB3MKR^>==?%I8mK}?d&<@&yI9e8 z!~d&cocI#2C5%Yafwq$y_~(Ek&OHkR{_xOx9kA<*CFO??vbKSyOMJzyXj{ZgS2Grp z4K+85gbv&a3VD9f$0K$0T~+6>d_N2*;!*Zh5)0(MH!1TuRohof9>f_W<&Xqz7PfDU zSt0ko7|3>KBg)WCRv+gLdX#%cAUJ^gzjN7D=+w&3lyo*O(x1 zaZOrpZzvkMZ^eBV(xbs+YWJq6Q4OTyS%F)>1eJTXp$`39Y*Ws6Zb~JZ9`11lM(tx- zkH?LFN;?*6I(asvb`th(6@o`fT*{fLqr7+nc;trd`^dpOD27CRVn$F0QVb%>3EkP+ zoJX$-$KfpoAD#cLsCejx?LVrs%A?MZj-LoxUR3LB8xfb(oQ0tglp5=?85!r#rPTXdQ{w)*xiql~E=7%snu;th~?Eozy3EobZZ=rPz<6T7ifbGE7 zGE3HS=i<0nl3L4xQ>#PJ7@&aj_v7?(M4rM8zay(}-B-z?5*FqAbDpQU_0q#G;!6G^ z@|edV=5h+ys9htt$J!A`3aV|ek^#J@tJ%1yuVm66wYEB&67edzs;)+Ey=tgfe*_V{ zuf*N4sz_Y2YVA*MmvcK0#T_1>|cR8sn2OT<4SO!xqG$-1V%!J*W9=D5ORc$S&R)cE+=^L|YavYU-aQ+H^r zw|%&!hR#ihv0C`zh4z`L0|(yBN=kD?b@g9|tO7jASB-U2O|Pz>nq67u(#2J-NK!+>V5|hD)?zCL>x> zosPWf^v?v?7;NaG@4WSvbt0f&l9*{OYdWUxinh2mh~L?Cf{BTst1c4*xJ#8~rpd&Y zCeJBAr^;EDQ`eRMt61tmo%t3-?_Yo?3-;(r36m|^dw z=<=Z|lxGYu+Qz&as7d{zepitrnf4R|L}Quhmhh4>R=dbwV-b`|l(GaBdYGJF+^+eB z_b_awOX3Ga@kD7>s!qH4tzk@G6ANTJuxi5cWnQA?fdX#I9nLbyFSjfpY5m#WJs2U5 zZS`5pRUX71$?^?!Qw?s3jqpntxPypf zG40<(gc?Z_vQ)nF8PsJD_O?S%#<2ki$93^C4$evr0rWyQ!e3!x6_F?HL%KhU)MbF$ zz_cf6>W)x5Es)0qN%a27E_L%=)QE|bLLW;0+~J|w=$TU)^U!GsX2@iG@A^cF=u6UR z;l3`Eogi^4h8B`R-SIP2w$Mn1nIkqKYY&H^_@Uzm4f>>I2zRXwIr@JLR-@NwngXLr zOlZC9CYO_9J=RpJn`$Z}RJz22k+(>E(Q0yBsn>`r5r#4*GjnW*^@Ds7FHf}#`%`g`%%G`DQhsIY?UU1){ z8GJ^1&jxWDJG%%%d-eN=ySVqPb!PVL z*)`9zNBb7ckOGya2Mew1-v)26 zgkaafo9C{acGO$BOK=dQn&+}$4;Y=xP>`e=e(QALA6V&VzGD25DXsk=7QD2I_f&9c zl(t9QMl!9I-V)tinI_lBUvlr#$8-`=yWAxzq+`$nXFVN#n{HSO@p&GoOszAdq(ev` zyd|U@f{$koS!AR4Q0JfhAepvJ9nGU&F)%?Rz5f2uD@1nNCLZlS1$>#F9fV;LmkmOq z&JL}NfMvcz*W8*)N zmia-Pq))R{bT^H;xH&uJ9=kWqxIFw=x*Kh5{PHdk+GY~IKXYJO5D3wGHCcO^<(rK` zhl%KQTADX!DGZz3&EBCW?_yYQ*ibYN5VDZaMV0ip`@v~Pvv}R0!$9fZmr;-gy47iM zggDj)>mxqmN9f-@>(eP7)qYoGKl7M&YmcigpHO+@B^TnpF;Qby>8QnIX%XY93A3A1 zPu#44;JYikw3%L=6Q%?GVN^JZP@A9O_!}BnT7D)#>IMj=7bKRrhNUU4Xe6cvE7dE5 z^CI9LI<&FqT`Wr`wkO^XQ=8P+O5rL-e~lAbFJCA_nrMusD9hNfGu8rU8#zIg1j|@* zs6oxmFRAaH)h4OkFpT|Ll! zvHN@sdM7@Fdt!0i8V%9>wLH;vzaTDC!K=ChSBVV=SB_|^ zJVpAz6Q5Mnm=C6dWEv64=$rs<=sD_s#rR9j46U87gCPSZc{o@X*cI0qE7ytUyu|HT z`IqN+1g@iLJDVa8_5p3_MdhlWi@Y%{4@0n=4;>br3iQ+5o?=C$35__Bw!4d~!};t? z&-DSZW*CKO5LY=oA_Oi4@efs^=?a=xh5Ch zncOU>x&$m)(M-c*=VZP^2>CqBpGfq;-~Q+VKPvHkd=CBk6Rl0DA&5}o@!G#s1t8q!i>Z0vVR`IiQkv?D>!s?VxDSU#=^4|f!T>L;K}?myt! zFMJ)__YFXxqfrqkAgoDcqz9bTd#0JU&m1CAYf#O!L!P1TTim?s=O#3I%3*A8(%~y7 zy}ufSV0aHf468O)FGvzzL$b38*I_bKxb}s)U!ry=->RE1>4;}{ftf@y(PQuDOJU-q zFPqu|CGUXCFV0^p6sR{QsE4xF@Ruw^zR`~am}G<2wBMxtn6F&*`4Py|(6>a}H}v`2 zPv6Wr^A6GCTPPSfNEn+3{GDpo}j@I zkHm}GZPdWyPZgsd77=caw9t==HH04U^(q^T%aO(-H9{t3eOSDdPIQ)9L;MEeJ4Ad* z!xi{fI#sBy`d&n~;Ri{GZisUDd_GbfBurHt4kup0A~*26T1Str({Vc|2n5`7LfHDy8Xbzz3$-D`fdCrfBh2kgO+Q(?sfsM+^+dx16Pq zYJEn`O?GL?DLEr->1LQTZ>Oc|B?Jb;9b$)};Z0<*tG7c*O^lUX!<+TLW6+9Fjgw+X zDfJi!@ZKt!AOn=&KdMgL;YMstWCD!y41%r_Zw(Un-Mb8K=RxSU#i*g7{V=Ka!036dGB&j zZ&(IAh0kc*5U*9>ljqMT(TMU@{8EMs5mp^N(pG6st%ggZ_vgD?JA~#SS@QWpS4l4_ zo05Q!QF?7Qp^vP6mZ&sn5?-d{m&~}q-Tk#Y6lr|fg4)z`2R_nIeXYu3UB>8@P~X8A zHM!x!IKgE0#=l%W{bfOlq$qy{a)|~$SmPEXoMSRZRmI?Z$QNn#`6%N8?I2O(-UA)n z=Ot+IDz0seP`QK_pLBJ350Cw_YOa1D{ldz%Vt=|_$BL5wxPEkf%?Q(!Z`Zl~j^2(q z^SNXdkq8o@(uJ=@F>agXOZe4p3ut} z!~Sj$#@RmtvXqql zRv@8=;D$N9SP3+YXJ}3VmS>MpKj~zBse5{Hymlrt+vVjtfl}skVZqu8|s9Fmu9>7wGwK%yvbmuJ<`kl#kJSN!IwKH>yP`^HEb~#eM!0io;%h z0qva_^$CVtiEu&dciTskp8iz4?X#M*${T`3aLeYYXhg%gaSQ+?>?*?uVcu?cp_5Aa zT|p)`^GY0KeB-6&o*Hb}l18y=h;Osn$A-gMoVw>w;*TwzCzjj!5JHuITj1+Rh9UXl zkn$tI4<7&Iy|-C7GQFr55J+9|4a!x*%;DP6&MVt5VU}dpj;G|KHKiodn|BL+#B(4M z$(MGUJ_o}uUINWrxCd|+Kp%J3vU4Q716fZd=;Sfg;;r%dX(=#Yw;<7gZ?n!xFY>>d zJ1kVQ*W3I=OZe^XNbB9Qf%*Rg<{x?(lCt@IwvCh=z;%XxO66h`YZ#7G6JW11SDrkW z?6!I1xUWvM35R)gQiZdn|4@jqL^8~hwPl)h=Jg2w*4>U8=+l;cWjz^p_IB`=d%-5u%!HQ>qQ(~ui;)!z$dE(Cm0ZiHkDg^e6n%y2(x zSb9O$7eK9vArbn{?3ax~e2wbmR9#S>@4wYLBc|K=fPnqHTJ8pspzYy8afoQVcG4+A zkIz*dg|Qol89d3FPdS%C6?BGQ-|w5&lq~;T@U$8k6KM-yIjjyfbe?4HBOa(_0S^Ir#A7<%LV%alG)HrZ910YyNTIm9UCKA62WmR#sB_dWb_9%A?$dqHF)OS zQCDGD4&!68*S^-Nin!4?a0xWjruoy${?!sWyp{d_FOs72er~%xo z!n8HgIG6OFc}EbB@ma&$K;;qGT%6YYqun>WQLE?vOh#)7ka3>bMQ1U^8tXxnnCbLP z(%sV1cltW0+vk6y%T)qC{?TTPED5m8O<&I!yLc<@=$6Pf_GCH5!_|kT0g94tmsStv zhL;r0_$?oFEkX~+MBNV&ibThkI`AL9!F9X3>$|AKlp+L7a{Jo-3-Zi zZ%7$*VsJ*LoP;s|(ti#6?e_zJ@%g7IcB&H+KIGUNx!tfs-kM2DH);%PLOB3?Ga9kpib9D_;cy+ zkJB({?%#1yH@GPFESb$5+KK4Dqzoo@`CP>XF;=nMbNtSR_qFRw5@-_1p!&usEB^MU z4GFvT5k(xwNVuc;>HoTw3nP9ivvE zd0zcmCO%QQtA4>db*=X96ZzEl3m{0Ny}#9I>&S>6IgavP-C0=RZ&_Ka99(j2FJBD; zPYs1;GtM)#A#Qtko^P!7E`Q;4-4@{sbK6r1?`ahvs0Uz6I}|dDdE*|`n(L3+H7yNH zKZL222JdMwT*q|xxZH>6sr-|0-bD|x)g52nfXx4G$%f-j$HxRc9$-rzQFl9vF6u%p z#9W!ENBZCUyH*dIcsLqDadHAJ1@H;wm*@m-iH9t1BaYL#`3>1 zKTIwUe6m`WYS|O>aYip=Z-^r*zOwO*YJxU&WJz23J;JmPtM{2v=WhI+$2K~B#<@wb zX0*J0^nB`)(0p=ebQdnKp%@#9AWv*OQUB&uj$<2F_w=W3s_pR~WVf#1n;ZOB$O)Ld z2&%)(V2z&gb!nh%+XcGPy0EJnl?nZI?vk2kn%uwerY?yck{?vLDvzXr_vl-UjkZQW zwqKv-pByykc6@l+SC$_De&H6S*VC?Spc9&#-IheDG~o2Zd_pF)S@T#pFBEfOux_T3lYCCKLK!6zy?K+@bfA+3i}9kk13RVTb;y=O-o`6 zv$x$&(#wDmDxtJjLQ!pXaR<8ox4gkeK3y6F?y?LSFP zkajg1i16E4Z$W@$cQ%-F6gvEKXjG2w_>tn_q?&ovc?4H$dN66P42}Ylp;wt-|J|U3 z*>IS*>b?jip0seui;FJjEjVzJml4hoV=9H+!dPYOpP(mScA2m8gpG%q&JxU)lU@uP z-Q#Rs@lZw)(5})P#&Ppn8mn)e$z48fSg5D;w{QzW;hWwUv*Z>>38bBh0J$lJ7HA_p zE9$K$f9Ex9X=p&W49)TD2e-v3ld8&~U*_?`!TcoDx5Y~9`uu4-e+HMlA(|D1>A^2_ zF+j0qsSL|-Y4|X?1yJ~k(S{VXS2pzbTzPAPxa2SXni0|=H_K4W1@=U@%OvrxK0uF|55pabR*Jxau7lDdQ3lOq-Y00B95aDNOhiNu*Z)Igln z`y09tO+sqLF+Z6^SJ#3}e`D1UHimKdIk)Z@-oI{1)E#x;ywZOYa7*X{ja;uzMHNI# zKb$@4Rm<1y_q#&x3*Hku8hkA|y>GtHqPLsfhG#kk`?=Dubal7UPLHv%?%H0BWJQ&o zjk%1k6*ZU96{8z*l^Kqfy75n*J7=Np-P8*4{fRhuQT6~6ypEvA6fcz9m2GfBm1UD6 zDtjICD4~fcu!Y_7{hI{v%s<(!yJcs3Q7Qtm3%v$p7fkJ%OXfNF@S6I>NR9tTo=%;e zWA)pgZ8qK#lAox-6U6l=t3DN}oDSAEmC}3!7hZXWx}U3XH0X1lAguOerI%fAA=>Md zytvcKMKL~QMqMw$Zf&?dn!Eq;pp4!dZskUHkWee1m57oz_hCI!@)@LLI$P*s^;ZK< zJeQB4Ky80F=QbnS#YyX`^fmDm(;C!7nhK*J*gkJ#5dTR9f89sn>k*wf@6L9k=jQ&Z zC%5sKdF|l^?jgv&J2k62__h%wQ*HLvNkinpJ=`=${-qbiq~BZ*@pH*Y6KK(S#4~`g zw;c=HX~swStsPV>A@n1-_?aTxD-&pM*}I{ipxMSHZwQdVqmo?*aOsBVSM? zBH|(39ivEX){Zl~K&$f9mEI!ILH+4+KIgHw)>F0evEUQEx5n|gv&!`X1l(RRy20_( z7;CCM%?8^C?+N>7n^~_&^|2{2Q2)gDLy+wOOAcADJLiRgKN85}PembT zF>lwGe#~CAU6n?`Qa#^96T8rj2e#D+jl#i(7;K+# zJ4+x)H}bWM6WesD-max_;PMlxkPQ}O1>tYMux5>1K<$JDZ9kvp{)vzUk8CVE6F{7R zy^f~lERy6bEjrz18N)l%7?)Tp)=AB?&f8u(VYiQH^K7I(n}-3libq%-K=P&O{F$}( z#>IQ@iO-Nim8bb9g9{$YHGn7nrUk+K#H~2mAv$@t z1?#swJM3f?Oap-u>>TgD^hY)+5nV(!9S$<0_CDG#mUDGkf)anM;|I+a3q|&V&BFmy z2{22W2t$C=TMY}-HyvAq?99;@5S|ij)M3yH@PSxgqz@C%fcpN;u;EDGyfcBB1DIh& zJG3GB`fW{D&E`WVRO;r`(A!%_N@9)$zR6F%oSF)IRTEz3=QAENCFc~v{I2eQNgx9tbN`EcX- z^jn&~>bIXh8b+8sNi?LJ{&J!JmZFr!*D#4Jd#@PISTyWg<%E=>aq6&CXiSmiTSZX)p{i) zN#Ss2L(01@LtvTLAkfP^lc$9tYn{k`@FA3%`@;^^#-s&LcP@mWgA~MP41Gg!?JgC$3o-p}u=Jv$9EfQ&`^kXKf?V|ZA!y%GI zsZrwGQ_0JC)K;aCvcm|9#fK0`CpsVzGSiRMPX6)iVXRv(rfK*|IyJFW{0Kq}_z5Wf z1h`ng1Kiwe?OVqx3z<$=|v8M%{NA>cHNHVgE$$@c(}WuV>sp4gWthZuVZIr|IY(tZ@|g%Y^9 z$q)T3q;%H|+Nln_uD4+upjYf4?F}PFw*~;5AyBIr11a>`WQJq%Y9dUH0HyEm=U_7J z9%A~%LBj$Xa!qxfZ=)StBXR${QLY>Bt9A?pKn2Cv5R4)uE-2AnxyV!n7tZhUd?ahq zZ&~v9Fpn($F})V=%TueNo*f(xlQqogM+R!dg=)Ftf~=w56v_Zp7vb@?VoXw%9#* zolwOJY{S%$Embz%SpJ9>N)5I+Lw=chd%Je)<;CQ)?ORi@5;DTv*dFo^s;Mr=T2BYH z1gWptZJHmB<7cfntu6)TM?YppZSzKk4DUZLM1@OMcb7nDutmt z*oJdFhR{uWw6R;+)#1>{jbcOl)!)F7tg%1gl-|ZzwY^A0^ir}g)kzEZpi0H$S;ws8 zuhA=HEfzv?aF#wM2`itSnu_>zD;l(iLYrc(<}20Q)xFW#);w$z7>@tyks(tq`cHQ4 zYvUWf0rQF)zGllNtwy+-|YYP+VNUQ7ok&c4ETU3v0t%JujBJ6FDySRtq zBAQ8_DR97y;h$hl8_V({^ z@q|(NHq?bji#=&YvQsewtzTJjobHhaGQUxJkNZINea+dyEWOLzjdRp0IV~-@9CzUZ z*`{zgc;;2m(-u76YiI40iMd>vy!jic5AxNIP={-gotiEw@SgG(Hu{ELQUkfADa23t&Nof=TM5OeNL;YuqCESBBzOtM;MLX|x6 zAc<3R$v^&6DO}_eVbCN9vP7)K+8E!O3aY~Nw3?(^xR*9g2|dvVo-C8>`I-NW4O{R! zaeiMVObHN*D#@}_=U%h20=J2|~ugwuy1e|LK6+@HdB_8D)^C2ctWkLg>tp(;->M^|7r6Qe+U4gFAu z!)nA!Ba>J-Xvi9pOM}wYfE<&-nJ)ED96eXbY@U=(OS#ZblL|zir6EYoeXYTz zT(a%>gd9u4{_UF5i-Q&woZie={XjC(-+CUqYs$GP$Muqkc=cHCTWbRU6!wRVsNo9j z4EqAUg(Y_mg%pV+rwKOFUtcTFaD9* zpGEvo+?}YVbY@>6k+1AWLQiMJ-<^r-e?>x<^*v2-Y+}SK6-c3r#47e6psY zKu-+Ef5XD>@kBL4s`Re|7O`4^t;pahcFXBPt`lJI&4@bRNzTZeL+8_LSB7TH3i)@* z1+wN+o#yyQIB&pkXAZXyw`qMHw|hBdY*8J=JW>^-i_C9|YN}%X+b$s)q#GdFgubDm zsZUfjlv))LR?)3yJL6TO(ot^6g?j8I?g91w^Bkl{O6F?`G|!<*FkmCmbjN|KSeN-) zO6&|(CFE2&>-Nqat#HUnJzHNW>~4M0a1umrgH=&il(;_Cvt_g>t2KR87+D%LQrt&; z$q^9Z5cN~&gZ+g|^M|)P+DEwblStN*J$v$C zC$Ln+)(B8eZkp#jt|ycH#8aKTBp-D;P#IQv2Vh##%e65VdtNt3dmktZAd^xO#F0&5K9MHM#`Efly-FC5v!PRVyX{2_I`}(lv`xP6z^sjc zS;O8?#xFiA>`t0*FUQ!?Mxi#zFDKYXP+Y7XF-!dvUg*-oL+6}j_e-X{{URmAeD zE}RG->iLc4Lf705fa-V-Bnc(9g$Xl|5bQ^`V}5|yGDGrx@r|Ru%Jm}9he^T+z4q|I zB6(?J|1Vk5Ul!T!qR+7dl9gm#pjVjA^u6W0oY~dpE*#I;0xh}WQUUFUDwcR&j63SI zk2($P3dcv8j(M#46`n0lQ!~x3#+R%8EZk>EL^5Iqw1jsYWu zRh=fu=9kC`eO8J)Mznk`)}@HWYn1VSk;Jtd=?7=Z=t#iQdgk7IFR5FQ!C#4q*zG}A zMLjn;jUXD5r9@xXAi9x@5Cxl80f1K^P*;lZb9jw19RQ;NS9Z>f3{y5p;XSFqogLR@ z+B(H`CfVQlZ)HUtP`@Bm!b~eYJi6PZ&26N7`p8jzI3~+h@Ci|&`9czed6;Hh@oi0k zX>R__^&HcjHFG5Xm`2aYiwyv{2?R&gAiNpr`e4eA29uIEukr;*Dxy0~?0^LE#30YGDI7AvshJk-AWQ`;3282Jtq7H$#58C8`a%`)*eU3?99 z2nXTzdqGA~A=(1yEN7uaroZv#&&NBvytjG84E0Ho8NodeblmaH1+#A%=0KY%XZ@=p_D-Fmd_ zDc2+RaHEWJ*LozWTwjx?G`-1-k!9nE(I#QzgzZoL=%Iu3019$7j4X9YvTz`tT@raJ zC)cS5H=mIc8sOelx+T{L5dDz2zB+eo*Tw#PC(GAm1NyW{GloALxb`R5T>&BEt}$zi zc38hT>GSs0*A~Pmu8SX17#AKWhJf!Q27dor*#O#qbXt!k=z&UgdD}t)F*nk70>Z8K z>cjgu$MDt()-Q!De7Gv3QfCleWtdjaPlv}xTXOVkI}f!E zjKE)>HFV|Z252=vaf-R`RXx1vESazVXD;>^q+yxX=g|ei2@D9nlU9RqbKQ8Rv;Ry* zA79{`CX8-za99w_n6&{OW^1&*>{8+wGZnrF-W@kvnRI0tC!Az>iy!6rqo&}%kucGt z>hNUqK>h7BL)DZnlr;H$&_<&`%2Vq(SuNd_@)I?a^gPK|!Gm2yInGP(ejoNdzg309 zxrYDcq(uEw08-}&refOC^{wE0JO#{NWm;tux|fN(5V^g?N1%#-zQy`@?bBF-H9H`o zMLUPPq?7OvfwSPF{Q>$tDXMkR!Pf+z?|cBxT^+F9O>$;QF7a=duWVV~naE z{&gcu4ReA}Te!}KOWy*wm-Y~dPYY?JuR6YY`N%z-+_ugxM>D&b7BL}PEo?eMParts+NpR2z$1!6Gig(-ykrm#xO#o)MU zY)C#gUHEhC)YTN!Bc?9AUhH{VRfsSD@^dZ;>z5K6MSZ?ItV*yp zbQiO8Kgv54nZ!X=mbi2%TNUdS&m-P0^k)vzANSv5j~WwJ;s0Ifq5cWB{y6zijMM77 zr)Be?-pFIsgvtmUMGw;tDv4z(hOQ9D_8l?%bI*I#4dmtY{VA8U7iyCY+*tD5525D( zwOf~_Gf89{@Nn@);F<-$}7VpPgT=6S;ud z+6Th_XM;Z;<=C7i`~;P*42;P}SlP1aCUQp-!r=^yHphHCQd`p!T+cozv3%o2oVRHEB|@BQbe3Bi~L|O4DC$1tP(O^^jqRHyx0zF z6Zt}C6Cs_sJbdb3|19qmpE6_H^SLJvS82(qT;$#lj1IXb1yu~wQcQ-P74A~GV+IH} ztukEw>u0YeB8fKd990>jHNEHhAu*HMy2GQT`*^(19)vMmM zSL{jc2F>2a7;ov?kg`O?DDzSx(&*H<2RpcrWTCg|+Nq?wv!o)R7rXTnc>?DHqd6t6qu*na?t=vq7j(#a~-CEyT$DX=H6M~wP;xkCO9U!p8Xta1P^V*%bunAv)__EL>W0DrYGj{lkZ{G zDskB}0}u`_*vP?N5FIXNF<>@c#maQjL9zC$8F#t%TaY!YtQP+>IqA7UgT3m)zW^!n zz_Pa;TZjI@7>yzCH1{#uqI-y&h!qTCridJ0Tarb&7?H41N%PCp zY;hdkmuoL%)joVtcsaqt8#G0XUY`d3taXG<>I>d8gXMI!bEn&T+pH(O|Mfl3!qN1D zkrNi-WS%AJ9!)JR-=E0-!RaG&ig>%Gbn@WnnvmHuA;joWK=jCr0Wd=vl% zrz03q8J14CTrwx;jW0tK{Jm|FXpUb1=g#(i}1x?!OF|-6Mh9d_INj_tlTPh9yYZ##E7z9hObs&J~%UtiM+H{UncXR7?DHJ z^=(3{)V|7kg?C)=| zw3OQ+=@{4l%Jqi$Y+-?5R*ShA-a5CvFt+I^UD-T4jOunRn>k$!^d&R?`~_*BiQPs6 ze+Pe&N<~z((^}n%8IzO4WAzB3?`;n`O3cs;?B8NqNBeE z8tolqP}P`j%ULTv6L0>=31ti#JC5Eb6p#~<0c$a69c@yBCMX$!R{7BKJ=H56x|WXw z%#`MrE4P7d8=dl9miq1Ado|y=R@0NH!@VP3-FKZZ=N3*pBHBC<7bcRxE6IrpxHS(2 zI8s2$mJ_KGjv&uMh1IL!qOU}!EAW7As@)J8!YrkcZVMDuqSkvJ3&}cZ#sB(bf7d7j z*$Pn>hO0Mk$ca>P}P0GtUNqGrmhM{ExWs`n)1mBra@5QJT2>G z;$wG#k7M8^E|_eYkRveboxxYj%NLVO@#?haKskUF01uX^RD(3CU861jR>%SK)eMq`P$IMoS==#)LA>#IQrC_42ki4+K z95|f!;mM+s1U%2zD{c|x*4kjDOZUn2+P2+kd1q_H>SV!$_+)J>YvgIYVxPH)ip1%x ze4}v-u04dPh3>%i_QA?1H!3b{vPk%?FIDZBm_1vV8e$b?51+YH#RbgZ_^FlAet-9x z%M;1*a(Tk6g{SK$`iKWr%dEYuR=0U+>qDm{&aR&JApy#_R}F>YDIBZqIxCue)+-*M zw3q03#;*#ib)`q7ciqBqEr*mjgEe3WWSo@-1m{uZDM8}TO_qNjF+vmU>BkQwFiV%} zb_EtI#c4xbt^2~iuS$;@41=GhkxfqG-(pW z#9&<-gO7JaR$DFpJb~1GGSScTVwt^bHcu5iAD6#H^7*B;ECjP-n#9h$LN=fVeNI99 zVhq&%BnLwqeI)U&9(=KR5j8Y{1G?aG1r@iD*jL%YFnOTIf zCIlv;1jn~If(oC0_XamaOyh5+Fszpk%5Q0{-?9aWn9TbvL~e2oa7H- zcPmdh)Lc)>TVlUZbi68b548<_?IJdlSZf$kA~*n+rhTl1rf*&ZLL>(j%)CZ?3AHmR zm_ZP+ctDFarXyx=HlnoQVo-QCN}CEa|IBp!b1VySloK(K@Kd~0m&`k4S`|V?n-aU@ zEv{YMK{WbVOW&^8zy0nOr337DCglf=HTly(hYA6=FPIhsDFO}>RT|Xu zOJEeKtjxi!ckNPM5JhQ@3)Gn3Od!iL)!aaLlYwP(=Jyv@D+=w7Dn%l@o@)_{sk$GX zq2n$U;bwF)7=sV^S1HJD#3ErH%rX8LB%!FdVBkpG)mId25UiSianI|Gi{aU;xp#LP zb4*>J?p%QE;RaO)Lyi7-QPD2=FaTp7A_;b*N9i&{<9AzBfhJFSz)id_nD0K?2odT@ z*F$vFSTW?Y8e7}Hukpo2FAK!=#zm+aNg^_Vf9tZJbXG5us#Xb!5=F1VqgdBY1AbFE zs&_fU9NaCmLx3<5FeSe-3@%&Cb|5f9@FowLG$pDHnv;C?I`qR!8XYCQ01W_M=uK%f zl0X2NI3kK*$hfhX_ANthv~A0-w^Ga^U;&8r)i<^0G~-ylSDS`fbY z6X^ixf0wTK-0|rTr-9%CzV|}fpKOZh@Wo_@Bxgg_1@qLS+miQA#qo>wo$W_c8)yIG zO5Hb-rdsDxYIY#(H%*JLtv|)w!Wg2kq`e39>SIA8ijQ9eEeb~=%q*TLuiTPkweWWc z6j>xSf1!av4LSuX;ovS$N!H%Ze~ttsifS%f3B#fMuqRLk5K!PUKG!c>VovTzrZrUg zvT%72#qOFw`jd>!&wnoCbQzjxg5D=mwH$j`z%bM>CL1kFO{c~8p^WH!;3r19Loo>5h?x9tqmUfI3D7_5#(;q?Ao{Ii4(@@R^eON)TDo{8K zE_4$xh?OwohP)>tRQ}sgq{&Xg?sr^tJ&4}jVBoQ;AGCvc^&(f2u%Mi zMIB+U^3zxTN!4+MNR%ndC;hLLSA_GrmCc%bDVFu`9$Hf)oNwGKNOyJ>8nA6VP zN#PJR>ILC6VJVlS|MDCk!}UNjV)x7Nb@-A?^O|gP zIB0OH6U)KU`+L%q=R1X}RlWetv~*>*%hDh2{d)Y-ew`6U9H=gy19s$6jI0=hDdv=E zF=*c@u(EyKWn^tp((R$r>#~^9-7K|2`Yb6xtp8#G^4-^QyA(#Y6)}pMs1gxIi1t#i z2JRsj$G-Jp#dje4H?cB+^?FZX*So)n?C~s8*iJ`1-KusI5Qz$}9OJG;f>dyCTj_66 z!1Qg&x7bz}KfMkNQ`n^tZdQn8D`qN7*QioOtz3QHn}*WsJWWR)Sec}ss1*>D9ZkFF zkdUak&VtvvDwzaQ9~TtvSg-32)8Xn|yP#pu>6C~s1-OcGv>xx=@{aGL96~Z$xhxRl zsJgwnk}n6fRXXq;S6K4*tk!kC7LG2SdLOMg+dW`pJjRpiP1>FWm)|dww|62`K2B2(_q>(vQ`t9;9xM>z-@AJozO#@ zsTTW9ifH>D>#dEFZp8Ji)DJ5=k&6U@1p^3^;iW_n&h{Q!UkPORiY5in_S>3pDnFSz zh@3sH`=^<4|3HPqJ-pMWA3pD{*syx2ifaRR`&=BdF9|p0FnAQwz1mAKA*>d)jgk_u zU#i)(=`1JEwCKnA#~<<`ape<8@97u;iy)E{fkkppB~+{wP$7h`Ju+qx`x+N24wpe* z%m8iqVEc;GDuc(vfn_~Llv*+1pbg<>YodHlRCjn`?@>QlsF9_*UinR2#oYYR-a)Ec z0|_Gk(DsJw!_m3T(@saf{oVxz*rv_aVi4uxTyb_O0Ph9I3@gA8Ly{h?AJ?`L+MScH zaX}IqrNZW%64gkD62ioVltJ2kyM{m#ialh(WxX{Vs%OTVGuq9Z;ur`uBlUj^kCE`9y^wnV3n!pXs*3C|VJ zcZEBwi@0j=8XFvm7x^erT60r;H9TXojx%iOyP`DB3(|HO@WxI&16!gn%~~|-upyb* z!mSv6e3g1)5W61Ut5FkOGMM`u8i1({QFO%plkj$g_-10t88~foqr;v=a-#>ddsbo& zlME5fIj3SOUAbD-hb<@ZB&&m-7&9}UY9F^{jC< z<3lu|FT3RD!#sa&V85g#US^XbTm`;%BWJIKUnrX>G#2!m zu5;zgz{?psi+(j+K^KGn1_jcIe7ZzQWqQ$(}Frc^!V_#<`1SO%5_jnjU@ zLm5W3#83v27XSv*f0SoVzDJe0HYneVsqwn0xGcURB02V~6R+9kJtUeZ*PYVmn>&_q zVS&h@4d5}-J}a83`3WcZY<@v>&ZcH4=pQGI{Q}=T7$tT|l40!Ib< zmG(yH;@i2KhRnc+^8Jd24Wm8J?`*ojcf~h`TK+cn|FB0;s?w%+satTbCr%)6Zv`}SrlL32POTLN~+Wbu$ z1*AqjE53`xWkfBYj$MB{?Dosysk;Lx{^z6U8D={*+95&1j+KV) z$6xlNK3?IRy(LQDc$@FL&ut!MKXsf7wzylX<9}OQ@qjwKb&7hsRl#vMdI9jO_Sxe! z+EZ;pTpv{Eu6I65&@J6@pl*!>HHr5Z+XO)+w4hH(T-cJLe?R-CNJ^|^$&FqPlXGCRzO&^DSpv_9lkat>qlD4zXbTf|pCEaE`{Yk#Yuc03H zoZ5NZT>dEE?pw`6Rb+6l6!0|DD)1l`I7{{#7AuCs<-4ksLEEb^O!LZt2MgX_rnXTx zQa?mDTINveTQX?G2%GR8?UkftHQ9WU3x8(MFk$8N{btYDAL;6#=3G{UD5_*c-QrF; z$9jEW_63@WP_*ZA3qd(;mQPI*AIjI2GJp1ucYT2wA5o6RapOZc5NzsP%d&AEmgy4c zgl@9vXnq>5R^!~)2zW!8U258vqew&rw?GDrME}>OF}gRxw8VjzKx4~(j#0tC*_P=A zv*B@SGRxFWgDDz7IPRk~XPI(NHI-d;?|mU)mB93Y?`hVcNZuQ6A8<^5iiI;Q5^XkEv^n zt}|NNjg!W1tTt*I8kRY}>ZY6ESvhrv9@9N6rPC4IgQ|T^RfComN(FF<#7PCN0P^C?43TeS{za;6Igztd8cV5gvAx zJMs~7?@kqKzd|+Nz8>1=5|4pHkU{zVi0hv;ZI_ojWVMU5e=^W>%`0?3*Zobnll3q> zT6M57>HA(}hiLLIIVtOx4h_*;iBxKm-l2NV;X0kwUrYNctSO$a7*8AZV>ytNPHSy* zxF7mTP^j)lez;G&99>Ly9d|WUW%e#LdY5!ZjO&{yb`r|GxPNGT!lPYxi5({`4(#T- ziKp;{HXXZ#{Dhbsn&(>}kJ5|d05Gs_gvCD={wq)6n`oVjR53b`JcU8VYm$_9+iln* zP#tm_DUof^)Om?9RKu0Q!B@fmsc}NXk}y&a&BiZ-({l8zh38iLtS`>r4aa~8y#jU= z$LkYd9r5P{uUP#A%K*tU`AjnF}1|~qj)6ir=f7Z6}>sEYKh+RkLHt06q zvQ_|}?`l3ef(#@*AuvpM`xr`ws=W(a85Rcow8D?9>u+>t8$k$uIxa!=T>S-1w{x(~ zO=*9z-Wk2s1tsbJ;a~yFiOo?^-kY0eRePsKsmJK40$iROnmLVrSzghjn0|e3xo7(& zO#DTU8o7P%g14K~=-S5h)2UJ!q7jMJ=FgQg!xdv`iSF}uXUTTo$~g!QWx5jhiiH3U zLgErCwFn#~#q}eK!wPTXI*Ud9w8!}Pb5ssrHW}TF!!zgcY=?DuRpaS%mOjxBX?bJN z0o?cqceLPth%NmRS=SbGB=s2=1H9I8buos2LWgb2#Xthh3+4Cr9&0hchu^Oy{U`S* z2=wdTC_f$8G!^UnWGk49+i>iupIE3Zn65yyEyj zeN1mT$e1c3{7YMV?7#Jdff+KFcJaM);{gFJa5k*cZ6!mJN0Nx37SZG+lrx?SC8$-- zuVVEEmi=R2+(%&*xz6tHpgr@|ndfweL`f_cpA$MvA$q4WmEUuhO=oo*k%RKv)f&B= zpIRlyL=Ar~+U84cnU%Ys;;uSdI>6yaa3|5Ek<3)qu>`tz$g7McC=d70)8fdI(S1?) zVQcj0mskByNy7+nPoxD5=^Ws8(3&LW5Q|zMr;(4*=D2&b{LNe%>H0O8uY=CQJh{K% zrMih~uk*DAo0$+9oT*(bSMIU!_Bcy;u&lpaYa|;=7HW_ILg|~CNSbhyEIK^I5b3upprLsm2ptgb=9s7`(w-6`DhQ?*Yjh^dU| zm-Hm>B{r}=R<$0MOrY-5wzd8J0@{CC0@nL4{K{TG+TN17nr90nF^C{LNmU7K|R4-ig0a@nuZR(7ZWon*QmUz~l zXMspcqGab=lOjr!bnXX8ufm}gtJVDk8pAtChq3(x{(ybkM0Q)jC~*?419#(58;_8dW6iv6|%$hVAKaQvVG5eMpROi#OOx@jx%7b?tUk=0$TF7+y?66@hs&H z(`p;z4VBz_Wgy`^g?!6Kn^$<{U(b<$BgVyhE1tbN>E~;OGLJlBg->&4zxd(H2(=#J^=cBEHid_uDNpe1Lre-FEx+*)lEw=sreil9$gD8T*Kx^M?Q= zfasJZ3Kewu4KQ@#1}YeSdcr-D125S-Ikt+*BqDx!`F~Z8{u`kL2rO|rruQJQC_@L>R;BCR0SizuH$_Wg#ho|fqwtKQXzWAdUlr9M>EVZXmGxyspO$m(uH0g$GNmU=2rta6f&QmT^|V6AIo-n}NAHuCme z!y`DKPbKbUMy{eDWbZ8(zoTk{qMr0yUf=7C+6}*-*QQ4N0sX zFq+rG9>FbuB}x~1q9}E&uWl~N5xI<2n#2|J$mBj^$NV9HFd+Izi*7e%p;9AZWp^5s zFoPNtp3lO#s@AFQGmUvaL2Li1Yo+_gQXen0gqA*OI?Dt$uQ$@b#Y1JKZr#xn5F@EVr;s?Ddxf_I(RgLRFZMZqu^P zIIIZKweUwBw!%$^O^Xg##U0yr)_%V`7_sa+pYq8YfAia5!*j>>SB`q&LcwcwRUg(9 z;BI-D59%KhRa?Q+-SWP34!&%})LIJ;i;^lu*P^i`-lZQh&At>N}`)r&V`Wre6HKo2{2QX?XBWttz?olVT>Cw}u!h z@mOgTQ`!ID^|e6VEcF6femtmt?^qFjM?T#C-}q1tc-XzVYrKUl%fEEK!8jH<(*b>+ zc{?wJlz)s^i}suo_T9hw_7R5^7R_%sLXSq82trIiHintM1?qY&Q4d|d|Jv!4^{E6CcjtFNAk&NV(XpcIjulYT5zM(4Bh$(rC4x zryqt)-n1?x)vWx0UVT{p%lN<1u_S2<6|~}PSQ7ZGZn>=mijs5^f@5|_W#5#_VVElW+BAl55-K5$*>1OhKr?WShmR84(oSVtzp<+b+; z&42aO&4t6Y_n2`^RD1JAzeK8cTYh8iqMF$v{X^ari9z_2BBF0UR$r-O_F;Y&IAJk%AOQ6HIy8`x_>TSF{RW-JAF4?5iK%uX7?l z)?tcUTNJw#U_S(1Pu)u>Y5?Uo>1Ql>K*wlp;PSnh?`~eV@E-ye83hf=L+!RBLL!@z z<_-q0ly0FbrbRBH3tf#@LRoi6iDc{f4}ip}UeSP)-8>KglG$i#GS!f|$TMi6cbhhF zMj^{hpX6NXs{@0>%@Fj0-2AznD4k*$6q6CXpaC~HT9ALp)|4q9UzT`ZfesS}jdOcw zf*s_tOIxyVW^ryV^$y<(Rmi&#p1*Fa-h1vNrY4>naczIl18f0Nw$44TRjr^~6xMuo zL{MBM11`v|ErnrRx=XW~?f_mtzG720HU z+AJMnd70@dF0o5m&>Lbgq}3wWPB1ow{vloLqrO`-qcf_Rs`)fB+)@1suI^MZU9SSl zrPMObD0d^&U=!;9Of;!`y0NX-L~IMB6{---+x7j8mgSqp0TORGcg+uP$vdG(sFbH! zEss8?p}jm=O|gYVirVd$ocdPXV;f|NB@WIy#Y5vy7CRoToUm5JmkI(QpDp>4H{F^U zOc(2F_uh;;)3haNoS<0}86Z-m6`%p)I9ft~$ks<=zUcVsqTGBXFiCXXYPld(hxWPI zw@WQmF;(H17d>&`xcGmDCYliRpIQ0&AVUK?-R<&WC`jzne20$h6sy2y%z65W4?)&e zE&tKNCe-VL_a{!)3x+QG*Rp2gsWS;6oxSordlS$YHvioBlEbm@ZWl}9$5MtNk1@_z zAq_-&4FYZMA7VSgNK83eETM!8n`NitT29F|{0wD)#9F-m&7QZPEmWq(f>~A~85ati9EDHDxG`(Br}EGNx-~+M z$hpyLx?)--+G*pMH?)Z5rh@Kt${{F4 zlN7!+1}ctpZrL9E&XT})L#PIa=}g&j6N&f4LZLp3PpWD)%9+atJNtBROZ~4pf_pEC zJb_SwY^soy{StJvHF_xP%+?$|oNl|0ik)&-5<=@*p@g=F+s>zdUs38RNAk&P6Rh{yeb z@0j3A35>DOE5g&DKvT)UkW1s<@?f~q*?`?}&NFUUoJ_x_&Q$S4*gFFRXSgR)0z1ID48MmKGhyvwtiBGU2dsF}F zQq_0Da?r1T1)=gKK!AW@vtx;IBQmG)nhIzJr6CGNA z=F@Q+`(#3vfiKGOAS^~P7$Xx&mXXfK(M;pE^DQ=^G@eFGa)Mf2ghpbG)OLL-Jdogc z4>0quWSDeBlJWc~M&Sgv@+lN)Kzm0ZG0sA_weP;ozmK0O^w5Pv>gjo($x=nY&-Cl% zvxIY68Ox~(GgWB#S>Eiuuj_&~?}bY4FMBM#$wgD+&7u4X<^#mqWtqs@jAzn@xLr$% z!DShls*D^8GH#zZ8u^Mz(j3S*zdd&WlF}i`I$q)ue)b9HzcTN_bGM}EO z06Uwe{BqD_B_UB%^f0P`VxkRayzGuo%N@Q}*r?E;N8GN0*AntMh{B(j-%$*L$#|o7 z4cqy~?Y^U+cqfB-@1G<;2Cm*xegi(yHgm0hBuO}2gCZO{_TJVP{cj);vk3usxCN5| zq7jXcdeHz&ex|Sm-z67)Yl|A-QrFj}+YuGWkjjB;D^TM+3vt=N|Mj^1WyIcN4gap; z!;4eTIK8k0@XY`0e16WPGQ6QN$*p2D{9MY-q`tPOJg#$ zuySa2n1k`rgu7z}%(CS4`<1fM*rZ|s(lLu@farhRWgUT~JU{aN<}T|ucjzGQva)N` z(Rdh0F7n~z6_LHZ^w(Y&_7}xGfIE>zy4z=87{(Q&?GTudJT)m<%gu*^{tX@VRV?9e_Rh^NqZUIq}$=U_uQ2Zrso{j2i}bPjS}om@xG zeHswVGUGz)Y)oPXOn6K9b&DjoA%@!M#tqO}~ zvjO}f?_J9(tEcIg0d^jL8seu@yOW#h#W=n%)gd@oTQihL&1Ihv744?5z5jqa4{rhD;2`ub&R7uF@CYP$PTAM70c}Ug~MXsU9 z>oA&M)Rs@^m(FB$I^G#li_g;m*!)WB(p-&2R1O!!?JK=zvrB1 znt-Eo*kv{-;OsOlb617%3I{Kk8-Dk>dE~GnvIuumh<2!$V1_Gd*?K4JFmSTn6bqdw zvZl{7@?k;*M-bl_fllBLv5RN;C^sPRikZXn&gnaU{w~UL%6*`SU-F=H>Pu~Mj`aAcCyL#fS9FkJ zvPs4>GWm`-jl*ws{1Nk8N_a$GXYYEzN_?eu8e5QaO695km%9a*T%sYr?>POIsSJJQ z1DB+K2ucx-pudR}MwH>PDvh1?1UQv;A~d5xg4~&j;JyUV0{4){oD18 z$3J7XZy&@!%vv*TxF)V@2}mhK6g49{iHbF%iZ+7}fGM!?CC8l$`eh=jM9fjWx<;KB zdJ;boIz%pe8i!sdYzzM(BonH^kh;g@Ye`(?AASk-pz$7zUH3#kDCZk}u*Y$|QzZwj z_;)t2yL%eDdUeFM^fftrXUp8jPqIx?+I>1RaauYzyC!~ou)59v!B5ARZ4zu;4Gu^2 zScbY( zbI+%WualseAVp*Cm2UnzM%eW2;B!XVGW>mTp~pFOR3P7`9vP#rBn$FQuZyU8%G+c!HMupiACX zuoG_7wmBg`UZ)2h99p0L3^#Qi9EZl@eSE6(IY#ufu8W|j5JM{UT(ewU4Z*}<=ItzQ zkDK4HHLsL&JryorxGaTP7D$PT2(GQ3Mi~_84X^r51o80@;VhX;nuwHVjL}MQMv0}9 zRfRF*5;Ui5M!BAFrWOc)RNGiEyc&FnSLY-(l zM80>K{&x(IxKH}wcZP!!@ZFu(%R_o{mMH~*l>8no`5>S0x+&?XSq4p+6ibiQS+HAQ z>8~gEK>}F>u@X5CuWEEF;0X3qENkE}7mi($ zxwxv@6vQIk!WN>~8lh3;zrGB0G92m7@YHH-j?@737E-6!ncFNG-VL{$W{odhzN}6g z_GD&Bk0|`@P)pGYDE@Y+{qssdscI>uPI8-ik7TViE=aydB9WXR(h+YYh<`H zj$R~OhJ>w0$sPrcAYL-Itx?8J{v^wxr-i@&PL?BrlI75cu~t8JlDN?P6M8=1@aD6E z%NLIQ0#{F{xXhbsV7mPU3Q6#?|5h0h-M?EndWj^oK<+~eIgB9EntO|GX7yuxnhUVJ ze$3n|socfR{CSXrw2HLj>KZuvDO6Ez$mVGs5G8u{VZtu22nYI&UaFLR)qvKJ(eYUF zSb3-uc!6307l+gvl)Nc#@V1ip(Hwb-C1G)#j+e+~a<$#vWo@<5X!ydrPuZmQ2kJzF z2zK=!0$9aGwfu^P={Hyw@0L)cw$<-%r*7_3A~1;=3(rF5Zdz+}CvU9GRS6Q;FwX9~@lsru+B+o=taN(_Z)fOqcPm<5{27+0r9? z{^I;L-mxmNv4mQg5-}(OAjH!S{6n@~ErqtKM}7s-&0=ie2~PJn8Cla%V~OjG^u(n* za8_Y$yVCqm@Q7`NA%h}|gN7xNayo($wtZhi3*#51@a{twrOK)|+(N@1IaKsRcJFV# ztBB^cRJ^`5#63KJWlr;nuzh7|3H?KQ9u`Blbjgk%6R-WY)aAfl9WLyblZ zKLx$)O9x(8{tKSs2;XqEvwT2_n`Jnb9#l?}R0U^7t1U8T0aFpH8PD5|PS)kFbYzM0 z+n(Z-mM+#o6Az6<;_y$UJzkoeXKr7R^oXo}*$~b_p9c|&{{;SbdMZ+=@)(Rx-g4L1 zK#0m|;XecwsZ9j(^6`z~SI4;Bu0-mEs{U#C>N#vL?JI?ep-Ycd$)~8*b=sLhZkJ8J zkCb*=)If}~y}O4ScweKie8v=vX_2>LjxQ_C&PE7+YPRsjcj&1_~hKMO3CCbOMrKbV_I`%d*X+W4t)mdsXj!GQEvWwMf_S#w`4T*C)D2HBVQys#5u6o7HAVNz#!0|T;O|5TsRA2=$ zRySgcTl?awrSK!Hp$DDHZ0iirS$jX_Oor}F2!2Yi$j(v7McuFuROb_(xMg4sUuioz z1Z3h#>a?zxLK!SXWrD3Eq~j?2|1q8tVS0c;A^RryfEyybdljNhkg$qk0L=hn_n1^&>lWhlEEEMxJXhJ^l2jRkMD`fn|D2 zwDemL8Ibo~a^U1&)TwJI9a1P9y6t%vquU-8vGO~_6mz7&bmZXdK42v@G-2#2faXFF z9d%c2kM>q6VaFq*j2}LBaZn~&ROlW~>F}+enyA`w#`{|N!cNn+a~TFyy-IQl$2{n@ zUfL4pVEe2}dyUKXveu+~BVx~1lE`!hmmMvl6zK|rKEOS)IB_kySmp$y>r8y3yi_kv z4`6rhW@DXXbweWi2wI#wgOy~UCBbKIM8^Hd;_3F70Q9dx1v1~6Jb>LrI^Ca)RZM;+ zO7b~27bQ?F+BM@aL@EycVGKvI8cgW8#M}M&Q_egvs(@#i4j6Y_d+Ht#JGgQa{qs4V zTfOc9?k;72?`u=CC!*aIiM!7}It)e!H-)zBae`m-?dkq}6}d#g1w@;Wz(y!srTX{&U;q|gMUR0X zemJ5X4eQ4$wTTSGM(!l2Gy%pmY`g=QiqYITWPw$}YjrH{gcKLE2P93zdSQ1rj+llcM8yFhj(OBR~Qm=H(CgirZ2(E|YMr7S&tGw_O ztQ7@&es)qHZ0914Biv!~WG~JU6|K2F;FQJExl>~(n8U9XUK+L6V%7RS8VsNXpQi;x)p3xM_?Pwh9hAfD`g^Q4oQ zAK?Ln?^_pm1;-*2x#J~YoGyDy zWpBMw66Q<1Jt&;Vv!wP5VD4923T=J`!h8v~6~ymBRON3XLD~)m1mdBgSRWNIF2N=l z2MwuJ|4hK!C)KNnPos>V9+->?Lq*#DtIK=*+^}q(Zm>x}|108}*OM&p@?uYZ)&hL9 zjUZV73hGv)^SyxuVZx4y?!4%I#v&%pNsay@?S#J69OpIG8JA3t4t{rJ6}}fDc3ve( zWJhq>)FO(gt{~_G+>NqpMN&)2CGsoJ#C`p)D|$L`^?TG!;y6NluYa0?>VEX~ z{_5y6NK;^it`Ao9MAZh{XSgTT!$0{W=+1YvG8j*##+r@mZ(p+6<`q%SEwq(2|MG64 zG-!_{ZJqBPed${P+8?oKA+#fL65tL{AJxMn;6Nj_BYk?uE6J9|yyY)kF{VZ?7~-Zw ztRBr?v1CNLZrkMR6)O1efWr|%c1P4DbT4Qz!xokAB~JYcU7I5l`vk<>!T)&2Znp#F z7EWKLCeZk*LlD_$6DN_R&sqG&Dtb}EyS_$!Qsw;x`Kq;|wK#T-dvBo~&{gEA6_eye zQadx2IQK??EO0?y_f7kjz&T{!)}rZy41qI;V~Db?1@;Gf7Vci&>hXsb4ck^9k+-QKNI+xq{%3%WkmQkNB6J943R;NQ{496|35q|&o%3yw z_7N02CkY_JzRuXeH8+ zU87O^(>6V}b8VEiHC8w)m&URz%z`h8hw4>7ABwvL@RXj|q2yLf-%O>72e>86k9QlW z#16Lu;uH4ODsNIesrT6WC=vt8rVVUadb;P$Fq?3c^=i@()l1*L*U3BrOgI4_YWgdi(wLti3fqWTHe>0v@iUqLpJ?YfC&`(A{;t2g( z;)>%*O%^@CO>cbt^6uM8EFxLwVs;3j&ry~mYuZ84*WLmkL}On>Nsx(7EdqGScJLj` z7a#1iWk8he&}S#M_{p_|!K}?AT?{YchgUPN#dhZClcM(qu9d@4%*OoTDGRWs8hOf6 zUjvyyp-r6#9$96r``NpNaL0eVD_Ka0Ck(ZaI~MI z0x~52p$9}Oi*Z%IK;5!M>~rniQXvBRHq7W2>#7z=KTAc(S%tn=7JN8wIQbIa#!41H z=^l8s^2q%ld)ME>TVN4;z0H*VIEp%J#$bTE9co_po&gkZF!!L&hVn@THNvqq52d7y z`U^Y9GYyAF7tCCG!Dz{xQEp)q6wOj4!`)r$+4I46}bUp1)Q7~ymZh64ykZVlD(rQ9#5 z<|&h@Ws~o*@pE}r<2`6Zq{;AEB2;n;Q6p1D02a8Y#U*>0aV02)XB&-QDKmf&TW$xo&H17QW+#?1k>)o2kP%qi6#+$DVm9 zy~!zjE~L`R`)`p_rU#g2FK?Ua#_YkkUk2pJ@C74O^ovm=b3_2axTqgW5qiY{jD{si zA!8F6(GNLE46D~Y#PtF6gXJ)Ta`NWkk_@z;vYBf#34?Llxq>B}_|+$I5uAi~C2M~6 z3nzSMdw5j|d&aJwrC`UO5X4a=)v$RyLv-pWjf%JcCvOSPI1#iumaIvIsJ%(vlOtG_ zwpY$M{KEMX*?@!Pb#EEQwWvya;v-703WRQ(@dzgp1&oKBd5L&2mEU->b$HLv3^P0} zyJL>F0{LGxH66!&zl_Xp-0i5}QqAWz*++HOwvboaj?`m;wh2;&NLklBEQ~4{zE%XR zEeovF?PEl$c|rOzEjG<4b7A5t`>#M6E|@|YQhcp{HoD$@%i`v0iyCC3HIz^n#TPX; z?qfUHmh{5RilWf4RVvV^nFQmW1Rvzi_aZ7l)AKm09=+$z#=UMI*0Y8z5T>Ix8cZ!( zdWu)So@}>6pCFsC7rsmfY-?9;X1yV$_1hP+XpGf~0A_K27-*2Cn@89dvXCY(tT{Mz zXCPi1B{FP_S9tbZr`Wn;7%|p>CIFeEZ%h4)?@Xo*HS&^7H9+xQEpe)kdG|Nur^gPr z%-#n6z?23=Agz7_e_byC8?4R#e#lXgg5m^kEYp8f|L6=dmyWJ9JkbRmw|#4 z$UlZwi75s7$I!M4PLyDhbuzRyQ=gMBMDVc0yzV0CAXJvDN1Dg-ZLq5lxALj~#+a;A zWXgF-6v`kT@IX9#K^FB2z011D7Vm{x_U3pC8;B~)&{cjz|4J)_pV4_BkYAwd+St#@ zM~lf2YHC}uX|w-RB?3uFDI%L{lbzeyXBA6#UN4o9CmlPIlStp>q7qCQc5gqmt&~bp z9ia(y(xr}2cYzFa%6p_Hq=F)^7U8X>j>8(Qi|o<1DU%KgaI8X^y`RimA6^N!eg8rg zT-f8```O2>3*^7jW0tZTQ!71*E0S<#)uEN%UZbi~@4O9$es*$0C-1=~tLT-1A@5No zsnFKz65@cPj{yZZasu-A{7w1|JkfNA-V^>>0Gg2iy*TWWx&RDj)JU?5zh*W?4B2j< zE~-gE`&pkb?#w*lc2)fQDYsYm_;e#CI!Q6hJ{{H&T z{jEbe<06a)I51}r#2p-Jwn1mkNngL#$`A(FtkL*2q!d-@gn86bPxONI6oOMRS9G^k zK~{r(nNLgsVaV~#21s{Cg?%QTdscTmVX316R(AapyM)Hk zyWue7L3glUZc%3yge;BQ;Q^KCSAp-gz-Xo(1+++nsf0?ha zOVu#`&c02Wbpc=kPn-D|^|SB1^K5;%6j-d0rYNC14AX2gl-xRduC{T~+v!}SF+PinAbP>TcVIqB zqTBJ|Y9FvSs>VF|09ThS2Pg+AAz{^vboWQamOL1uBfP&?cd}M&dT;+i~-F&WL4fk zIiRE`q<1UCY}yxbcjiJ0?VafLMBMi2PLxXEY&-PNI-67{vp%K7+D=b~r%}7Rq)G!H z_K8>f^p}0eCp;kw@&p*L>t5+0t+XO3H}Q!k!;t3CrdN%)M224_D&>t*%g#tN414`$8y8G+L)*ZDd@^nTyuLbOm+WXTjlwLd@n66~&tKJ+`YOegjY|7e@O^Un+mxnt1zxP40k?xc_lXkX%^ zlNdyk*E9^!pz1vq6YA-KrH!sB)V`F~hs;)#SZ`u>5z+2^FVbpJF>+Ba3f`Z6QwgCkNiFU{PnSDV1sGV36dbD-& zfghdcaF0^w^i@XsehEhTkUyzo(4i1dTfOgYH0@uZ7S07Yf`r-v5-M{6%g_bXa{3Kf z=}V5M-0_`e^Be27__crXBURNV3fRQ#M{fM-lV0WN4rvQPCNIAi0?~vAwA8GJcJ}Qc38^w2KAlT=G?70DpG=qbj+45=n0Tq8SHaT9no< z2JOExJk1R`zDgQ&{4GQ5ui2aMHSFft@P69AFY)LRf5>RnMO6Rl^>Vg;ad}`)o$6LJ z=dpebKp9?fSQ2jJEy;2J>NeZP##o;{@wr`B!cEV)@$6^4UFL%G4dGzM?fEs#OGOEf zM2yQcPkkCh9kk}SJw`H}h+jws(hn2N_iIqW<Be zu`}z1nZF7ZJVOxT7&0@Xze@HH>E-+FT%mqNTm%|f=3f={92AQ`EQHf;SW#q;s zviGxJDi#4GWit#ua-S(a%2>lROu8mQ1+&O^7MOPlOeVNdJ{0<9(UsBv zmA=z2u2mCmUX+bHY5Ts0_478y+?Sp){T2cR?izNF$u_j*taF9-gd+N=$5jcUVb!de z)~jM^22gGoOU8@{lm7|3#2 zfO*9MJlHi?tDe6oEqu_HKn&S{7`lWeg*-+C z@zdsa`m2!B)ZqyHiF%PG?nW~V#+8wOGqJ3peF-NmrA>IzsHtR6_gh{h2LbsTF8(e4 z2MKQsQ37$!RkinYtl2ft>rocoJ&! z^klq2IFK=K^F!9yxfoaq=Q}pDqUnqthST~ss9x%{}4Q8AjN%6?`n2+wYa^)J8B9r_-4pt+F=QEZlu;&iXUbJ%92+Kihv! zqqKO;S$x0qd7QoYV%+j>(S~GC_cF;*dLUEct-$D@cvkK}!~YrbkkJTQaM_yL*-tVP2>J^ks=j5nHt)iO_4Srpp8ye4lP^(oFTZZY~FFCV&3s2SM2dcCVYd}Efz zegu0j>^!5u%a=1$3;6&BCLAoR0Z8@7sHg$YdLkK3m#ZRPYl^uD$@PUNaPi{@trPoi zKAcF1o7dHjGWOJ91z9XP`VIoLe_({33a2=L@2`m`Vm>3t3ooIEb|F*Sx0*A*OqXFS zC?8R!p&3-x>CX)YaG5j?IXl*rQQ4?TFo3p_doS*{pZFiHpyLhj#kRFjNDy^hb!4{h|Mf;jW-Ju7k0QJ`B?qw(GO>i-jbcZHASFTCw?j_Y=)EtDPjyd~WV zC-v}Y=`pOCfpi!Q!y2T+w7xwNARPt+x8Bo<7UqIg>t;iOf4^z0vmI<%8`dT#g8GZ8 z4@#~HHR-?UZb9rS58J$#D_gSp{(Si82y<*=K@{5GsU9fMDAO$Uz+e%Jk$EYUAyp$W zZ36X5c;?L&ZP5F9Q7Dhei7Qfqk;o=r{P#O3NNG>2E^{UyM6o~Ap#42}%kxEfSLkGU6||)^hut4z-v8_Xr+c{rDBXv-Xx3Z~sN&WA=rbyS9ajZh1=fw$^RlEdYW6X*X%K$%Yu@hVSybBzbip8TVtR8QwbUpa~~^sxf=U4-(MF~Zc1B%k{?6! zxl6o0z~P~qzL2MiFAKxG^isv;7f^Owm~3Sh__ zow%rwPC+|!cCLu(imz%++2^*6awLy_We>c(dJzix2Q&=(e}g2ISqS#CBpCJ*TJi}E zcUjhsHPaBHUrXCDUmrX2FUAKe(QC7g2dbu@ceUR3^Pcs+FpIQXBihz#@oGyHGkNKD z0DUZtMI>AiDy)@Ox@n5YM!FB=K68fPGP7G&M80g}zBUc@C#{;XIR!fvaX?nrrQLv)*qB15k!e#D*Z2K*Q zB9lBld0(Mo%b6zj1P=oe!T6v_Y1E>o{aYIPui5LA`iE2!d%JIT@lu6@7GN6 z1ePDuQb?cm=a)pp72Z+L%ngVu;!#Lj`7@7OqAvTDwULj&Hw=F?C3S?lR-h$C-ESV< z{x!fV^Dn_>#LYc3=j}EV4>VYD4;_fVrMY;DJ%6I(Mkz7$63D;G9_~g&l|V#GWdJn? zJG7;ZA))Dy6zi?b6N(a8$jp70TZtZ^?>lzYBpC4t8w3l-$(U0Z_j1&qYIw}4IB1@{ z$)Su2$+@{3%rhNIk$Lem6Q>u7o|CDahRMESVKi7;eTU zY@m0j?hTc6L(pSs(n7!$VgW;Y^<1*@xmM=a_%ekR75-9q=;s&1BK0`l*ummoJIU*~ z2koC7W)&h(sCV>z}wtK%obz*P>bjA>GJXQBUas=>IYfy*J5fPx~oqrQzlwB$Apu#S9*9 zWS4&9SLbx5%o{}Wyl3PCOtYx;c??A`%xs+}f=T-xS`N}YTHXTRgPTmak5CI=R`;S@ z7*3%_m(`d(%-Fh?)jTlqKrz7DJ5$3Dw98a>>08#P?`{t!y=(DLG|#MPgK<{C-vUS6<6M>8CQ!7OoLe2cG23q1KTv@`k;v9d#}21kFy`x z?$O6CKrq_7HaD3Takg}0p2n12;J0q?I(-@1^|5fz6jIHv`00WFf?t69M-Vq3LEO~Y z(b)XvX1|S75c7SZKl7O;&nIu1y{A{Le(XCq;7aOF*Ls=xnb4s@*EpCcbR4hhdl}&` zPTw^yCaog#UL57yLXzZ5CW_Jx7;sNOm$GZ$M>yFsFLY0r*> zHognyl!B!jwL*n-d#4HoTJ;wnvZAA$>WR_3Y9(xG+a-$7!p=mP2klemDf?ZhW%m_I ztOf847s1WDLL}iQ5k!o>o44nOdZ*V#-aDxXo%0cm1ztSf*|&RrpZE~3 z*0TFGEa#wo&$8NN8zzAC?$eW zqQoUl9>|G#57_+npOel$h;S3w#IkMs^s-i72yoM7WqaFpuX0nT; zY~Gk}+mQu29p^o?N3=+LV?Wo#(JAA-Jihp_2EZ~&$w5c6Ae^l}4)O$e>9J=5X$BMt z@MWD;wo8yAi#Pz8Ksi?n!l1REOo>+M@j=40DVO+JL9tJyQEhyHP~qQ>U^=P8gpRT<7J&f1_2ryFW~2l#)2(Xg zC9!?1^CW2#uH|s&A*$yYdwV8#c6SRr@y{@17Xe`=Mu1P|q@tgX6dA(-5CNimFsIIt zI_StN#7hg^w??Tdhh=K`**11Cv;7J!G7DP#PvP0!Ka^ZweW04}k9R`H2w$1e53VepCL1sI=3&OWzg2bFv}UO(J-6I%DM47c zRc6z4BKmbpI2V0ADV0HpL88~-wKN(Yqh#7ylq6wXbf8W*WYW)9}ME4n+yW^dv3#}WGll5`AIb8 z+!FOqO7$MQrB8YGF+Rg>jc=IFh@?Bh^FFuBdo8ymk1w0sTDlX49N}(KFoz5o%3Os3 z*U3nr50FtQn3-8t3KRZglJi`7V(J)1Jn-oPj~nDwwJ1DkUEOX{e}CKl|CqYUusD>R zU97l6aW77BS=^z;-HN-rdvS^vcX#*VR@~j)T^E;cd+$A*?<$#qsqI6+ zq63<~;Vk*Pv)%O^pms++Qk|Ejdrk}}Po^KN;lXuAR;6V+e!7nBkqM5h`k8qGE*$B5 z9V-l*^esSLZ#i&SVL4``k!%dm2(=99mMwOXx-zJ%Kh*W`?Oiwg?0#90Zn7ZVIKd}x znj!@P$?)~`?Bq+da*ka>g{^1TCAEO_CyuIa4wfhZ&;8mf@r&w#FF$yK+P=UqSQf3H z5^_(kTP{PNAPlQZm@r9lo;V&Ll&THUGwvV&Bst@JXTNnsuUxV%>K3~9_XQPq33pCe zZev)N=$Lo2b>gSxi~Iw{n7~;flss(bkp!ian+QtNCR`AhktvkX9Prg2OIDlq618=( zTLU4reBla9UuJ5wy5)3awO&iVLytCREcr_)P21RVB9z3!^4nsO{Q`9ayf-R@KDTuG z5;>x6K>yv^eqjj`nkQ+v6UIgkBq6|$<>4)e#)*2Xbvi&}iGTh#$MGj51*t&_Qezid zWP1M*4Aa^@PhgF91S!OM-aJnC>^!Rz$r4I3Qinq)%4r#Be^BXK67#iX4p4Sx@YA*k z`9?+BP`5)3Ng{_+`Uwh2qPbMy8x}OV7Ji%~tlZQb1N9Y;ZUci*U*It_$!wJ~TX_b;=mOWNe*=(0|Ec%MpWWGhz1y|>S`t>gQs~=P zyh6F8&?Ku3vJMx@3+XqTAJ}T>s_?ZOv2w%cBk7wwxsVSgkT4jJ295js@D3%6v-% zIgOx1z7N6eIq~X2VRX1oMk0DQcf80aCND&&T%DC@zTV6bMU#W)G~SJ_2#jL{#3zc9 zAg2hi+Q{pI|M&?of(d&N#@a_-ResJ6yAGxwBWi~9p;GY5&`V(1goKhLJF6CYOoMX9 z_|0>}%kO9LrwQN_@{cpbklfr0-|apKmxO^Hl^l|g!2zF4V1~RZdAbhdG{PfU%qv5f*7sJq5}fyH2L+jzj9t{b|s&4;y9!cJ2stjry?@L zb#wl^bvzgL>oqfs>w&`a1M)XUnfr0B1N*s%L%QG$GSo?L%-xD|NQW}#DLMnG2)__p z16qroT7zD(&H8aupM}tZ&OhmKr`{D^7iJ7bNat%g^hQG*pA=I-+eLfz&neJ$(f&g* zMHtq7nRI$(&9)Cdqn782yjHPLx2eUBy#d{g{UuHp0>Paz-EA>5M9go!|2u_@S^p{-`*plzJ?+P2?jVeL64qGr_c5!czDVPchp*2(KsiZ$(7H8 z8FLl9fA#{r-Exz>d}=c_RTs+smJn&7~R=+a$n;=$IIXSlS+;k5uT&P(+$ zk$6w3!ha@y>(>2;Jg+VCRRQ%yoHSMzka6lFr8T4YMoWtCzp4~4$nd!X9u81dQ6=N}h%z4S3ddzXN@IB^|K zI>j3m3coC2=nR&=$cnQpvvV^_H@Qn5Idy0d8BDG?vgF(Jw7ETY^3VGzQq(@_t#W)H zNI|nx$v$(5<(;p&CEXt+g@Ij*<87Cb|P=iSrs}WiHCFznB-9(cI90P&E$}qFnax`hpbw9 zVdo-wlCQEEE-o{pKUBp*AnI@N1WRN-FIQvDDinz-vm5|BCa&w06GIw1tm&KspeLvX z8yYs9LnssG4*6wBST>*?moM-K?JNeB3w9#}TOOL;hFv=>`4#=29y9s(Tn?>KJj{J( zaA#b4Wigr}`L{?OXJ|_eQ)pznY0b7r@yCxx)s9h9!dFBw8Fv8XjP6NG{Ifo&3&FZk9DkS_a1-hm zd^CoDaib89OO<37_WESfwt44hLQeEH8IDozQ!Lxr9Lt{~dnpzbk&=1-roB3t%ZM(_ z%Qu~KRIlQaXI&6BdbVK9m?uuNm|cQL9qZB4+OT{e`u6d4c%}12;ED#=B@+iS z(&BXwo<}2D{BMUyHs{8gqSw|~4T8-(CdU$$MC+royp=8f6`fi2_06lz?h{e9nOaIi zhPTGd3%GH>@mQY0#{Q%B5iT+oW8mIN46reld2JOLTOzx{$DFtUdlYEPI{!Uz&mE9* zylGk?p4HTzD&86b7(Qh*(%#7rZz&!ZLHVRNWOPb8lqu&EcbwQu&lPw>h(GH6AJfHHW(<=5Puxue<9U8tqW-)ev?# zAD$qx{gh(Ua5Cx4un^ZirIKX$e#rKFFVDj$ zR#^`x|2sYRGKJKT9Ffn^$S3r6LYaH_QWza%N>ARj3m{DQJpBsQH9I|e%r+x~1CNoh zdKY^jLGs;JjX<9&VDsN{Q8ExlCraNm)5^HEOJiyz!x?;dL3O_DhmQmc&| z18yVw;GQ>|c$Fh}q79Jy=k{qf*XqhzW@Kf=x#!%jV$_!h9scdDhojn??X|J83iFmWpLdfn|h80Pqr7QflYtf!#bZo zg#&45t#97dr)b7T3>4(hk6vlPYYWzN19McXwa06m7+*AJ5^r2R>eFv2T1TPUsw+y* zmpW4C$+!wYJuc4ZaZh;J%I6mE76n4Kg@v&hJr3+MSxUwiK6I&>moa{LIV0{8hGlS%5dqMeLuG&p?DnYppn;)SD(pMg&f* zwUkK8cAp`eN_WKmD#1(uHQj^YiHv)ak+IKJXXFvTc}QcT=wf(bhAY`g751x#w05_W z218%W4T9j9&`I$EM?i7r@ z?ML964mmQnYgA9wyx=cItbhu|r?5-?8*@JAscwvOa0u$PZvsD&$%%Wda4_U|m=C$3 zu3IPcV(722jl7RcBF`75pcPm8FZJJ}mqKeW*3*vJ)wuNKLmpH77ASgAxBp_HI3JsK zo3U{Ew(IYX|E6-5t-90kOK_c|aP|;ZMsm_zZC%^woM;r~t-a)!dG#Ci@TFa6@}m;EFr*LDM!5EP zzl_Ea5n$tF+qYKs!&nB4>ySfYlcwPizu|xg%I?URF#m@La$-CmuxzK>8 z9g^#DVAMky%PtW}@z?5Kju~z)6C~h^ZB5xr7(qmRbadX`*v~BrybO*@zI9|U)K0*kaW%tw5Y$*(oUQ$#jn6c#Fa zQ%xA_mBPHVmvnZg^A7_Maq9oBge{69L)^YuBP4-TYEg>;Ik$* zRzif=o8H~ubojD3fKhUYC2GfFF~_fjnW^5mgS>far_W54s8Gwx&-wI%sh}ER&uA^k z4wZ9c5TC)eR!9-Y)_%M09kwVoxSFf=(vj+%56(x{6#CWSmk0SC*Y#P}pfqd8$?fSW zLfb2h+F>m5Y<}^I{F~-kd1@>mN3Rc7`6njt6B~A(1j^0*hs4y>Zils$T zVwY&`CPB+s+N$Kt{LcKXdgscgDA>hjx1;5y@^xGBs#f`HHg$G0gzt#I7WG`qIMIe> zzd)bG)slB$${8sKCh=&A_ux9^lb%5}%HQEUmbA_Ud z+mRM?Q~1aFo$_Qr^g+R+g^Y} zyMn0ZzT)CX{Q~5+jK5l(+ZBMcXr)YQM>+yogBQd-&vItp#Vi}7j{qQdS*8gd0DS%bUl?a%xQM+t}Oo`=bF{zpRQH(Dm&Zx z!R8cXf1LU}X`MS&du0sWZ0DEj?g#1#Mi?@;ud;&83sQ0gyO{8-Qciw($fSh@(&x~8 zoWJWc*I_dS)k0Y++RuUeZmVezSw2dMYWzpIAFQyG8#{lzhRWuzEh}U8zmB?ENo#SI?Kss2q|+XXYvA)&htDKn zr34bPAc9WO&CqC;@8`|H8OWdc-SFzzB2%}_%eN4&ho3taCEjCNSwp|dM<0&w-=NcK zG;%KKO0~Sf5*=)y&FiN}^%`50)EyX8^KZ_t((RkZv1Nfk?+Q#i|UTJhfhYwA)%t%Grdza7wvL#wYE*8rlO$ro8z!prKf;8 ze|5*9?1eFnX1QQ>%hiH*c(TpW593T?v$Qr&m;J^+HS3ls$5N%x4}Fh07X55@O?-qy zQXPa9E%3i%g&1V#qrQ(e|D--ehkOk;ezUFBn?Si(?UmL{rl!elKJ%&WAh(5uJc3Wf ze*PF{Hv6Ga*kUwy$>SMOycq5Dp84@&5v z4eJnMBEV3OP=Wy{#E-b4-vKt({eBABx#RuBe&3?5#{d1_CE_U#Hfa-e+~w!>z9wS6{&fx?o~ zkg!nRURSXq!eYY7D*NGumW4F2>hkT%eXL90p0jgsR~NHMs=namO&j0lxN%FT@0qBh zz9dz$n)&=w;$p;J`zjsT^~G0xa*voza>0!SOLDJEsP;&;gi*MueFhSEu% z2Z5jPo}3+IPx$Bici<%yK*;c7P&K=D3F|!oHGf3}?@xL?m%KXoWbzp9Lqh=Rh_~Jr z*RO9LL&4O6R!&R1qa^f8Apx`HU*cBNr<@20r3b?`Gs7E3n?v0TTIc-Nm$2u`T@U8I zG(+gc*`;Rbo3tt1zBQNDTOJAxs=HOvE@b-b?Drc`-zaXBs?*QKbKE8na`1INeN^Ye<*6pzXK40qq+Xj;N#~Q*o4Et33AMPG%;u+%Mk4QSx=tmP3|P-Xv5Ku> zI-OWM@AI~?ILu%cGf2wnG#hYVRVZkv9<-ESPx5}lI{>CWXYY~jiM>?OI6Wb&)aGPs zc*c4tItt(NCspLmrOnLpVWqy!*Ci*BBdv4qJTqV6yM8e8L0r zYMwj~G$vr_o7`F6Bl!WLApe3vjOPwmfWsqL*I}@HG<2$8E%7$kwMYe_Kzn9wL?UPL zFbg5nMOgcX{hRl_%>4rp@Un5fcXQ~gh)fJ;q;v5>!<#qJaa&QtB)DeLcwJgzOg1kW znIs4K<(I$@fh*lk4mc#vduvI)0$oYh_DUopKT2WDnG5>rmyb ziVQY4Ve7}M>$_KcF-@76K69`Uk{1e7FW8CZgFk)tEU!IkueLfZ*yU4oA)QAK8atT% z;vUT{+1}(fZK?0Nnn0nTt$o){K4KQi02YYl-)t*-)N$rgLYwfj zc|^@6sV{ey&}T)`vYcpr4FzQx?`P+&Q#A&K7r(xCmsTG^R4uE$)w1&yE9e5m3VNGf`5;!t_MaWL9ii%US~;DB~BNQk^rSUI6}I%hTz3T`nT zsW?CL2gJ=5pYdlci3I`jtR|eNF{Yhmh9u(+J^u1`as^v0Hp1bK0S#?{Fdl;hs zM+EMAiQhjPZ;bq1LkXnMoeCx>Hp-(%_}J9oupRAs>HLbw#AQ=n4ElNB{{7kXlj7Mj z8tav&pIBu+tMSzgYzyzvlGC~Dp^V$~;&BSQ@yqKa47{reja`I8cJhrTbAENA-m>-)h#&WM|ZRtU}x66;6==(LwZsN#ah-omof zm`C5NYK0gt$bIugD zC#tI>@F=7x7(!R~-y3a}M3W=61z7gAgD?YHhh*+KIAVxJtUbW&diCBz-30$x6EnWt z3h~NB7k*Fgiy+mNx5V2kpzrNVaM*%7(3|qey%5vj4EZLiGAOxaJazxpO|D)qTATr~A{l z(`|*rymiP`HN-P8yxkKkqblXGCREeAjLG#*n;y?x|mR`a* zQXpI(V~fkUO*WRn$Y(bAQ3VlyC1ljH?>5qyUoPfQvCoY!U^7x;C<8hR(!}EHA9w zu29ACjU)!&dy~G;lYLubCe>&5FB45NkV)~!O3JtDO?)k1dD4y@tp6xgpr7(*I&;%n zJ3rTzirL!7wtPk6c*N4FHKic|7SrvWnPQYrv=}}HuMhjy4ROJHG3czPNP%7L$`Uyi^sXE4p9QeQu_n#g~$?IYWC{o%M8(u4efvaa?X zD&)8B*b@R~B0n-;hJL6;%cLpfqrEgybqPlI8H-4g@GSAFO<7zELJ~9Q!#VjdLy>w- z*RDl18kEh=?+be8h9c1Rk|GdgJrAW~DQ^NQsD@yj2?dS&qfjy7sa{eo@z97ibFe6B zEe^wPf*mmAYZ$RmAGCrisx~sf2Ti>H-;%|q~pTS3lWJ$$T31P>^ z7vtwP5kyn&SmF*ghbwi~k9WVs7FV}cnj`LzD4N1$dZ!8T!@`?oeIyT{8^TjH^D^rbkCUTz!9_P`m^1yd?wXH9tLIShW zx<-|y;G;(~ztS5yi{V2UOt|rdJ`L-i;t5+!%q6HGW^8Bi zUS1%232Q@sTxwh)-wo&60k}U-xPR(@QFplrXFpO&z+xwHcxXEr;sHByzITSc3<@ji znJ(Ry0RaxK&gu?;;F!G^`~uVw?@P?uHH3Zo&;-Kr=@$cxV{7xoIW`<*A{qt?FpxD6 zRAYQW)-bW-V)%T}N|h*jwol@4vSN@?ehh2FjuXbNr(sL2U;{z)h`QxS`0fRq%emJ= zenvSC&MLmeY2@G|1B;8mq0KaqJsc9m&L26yAD?cBf3~28xu8N4XUlAhe=svy)5-0s z7}QlfmJRz>heA2ot^8R7AjcWT&&c|alF4n*cXksqm6?1Aa9hTdTY z`tKDIaw}wX_<4Q(Yj7#@FQ~d=Qxy<@s`g&;$lXn$hkcGzn}{N>#+biTZ|0E;0g3AO zW^IeNSBI{MkruzOnzd6HuptZcQkj(ZEfAp%egO^ILL{gv7k0_Ugu@j z&M1dkn8XkS;#GfR!G43Ydxrlf&B^_9x~a3N@ob^(Tl@z!=&vhI8(4F#nZFIq&eJ(b zrys9-u(XgBI~smWC&0{DRO;MkG=`6LaTG7yo4PR#vz^!{b(E@A&@;w$0EYh)4Hu^z z0tuLEV^$nU;|H0M)l7pQPY~Ddzzu`KYBk?Sy=OCH(3De8H{bdJ{Xr7yUO}0=wsf=L zn-F6lC?vuejCxQ@0VjU_n#OV$4RTvyTwAHR#gIbBAJL#8zMY8pB&^;;2>lJO+^?p& zQ((#&ExPV6#w3s|@5VE;DQ6%FtEmF_iw7!vdKRxJ#E%+M{2`%#>b+EE9&##mpN3Mf zbZN|}Q;OX_O7puE6Dv)Tjy`>pyqWNbxIQaT8Xv5zk2i$2^>YKJnWohKj_qGIS6%IF zVX7FkMOR!kWm3c3)K#v7EBk3%Mbq6?67r!G|LmUrPT`a7waNfuGD>p)N*ym8nE<<# z2tY0Hea&Cpc9xiaQDbB1RJuX~yOA8}K^a?G2VUrVM#bQr`~j?^@HMr1SIiQys7jqZG_n5d|_z|o5i|WIO4gq@l@PSEYb$kTf2e?#m*Wevq^%dm+@18M>aaM{TfEMm)cM zajuM>u)08S_`BeU0|@^eYUJ$&h?6eBm5oFyJ=0M zb2ig8!%oGJr*Rrobi}I2MBCK-cZ`cm+c`P)nxHXe4to@1e%1@c7U`~l$OWyb0P@Ol zj0C3AWu4uMA>D?Dp9nX~!IRgs!R!*;FhMM!7uYbr1Z9!p`~6fAltV=l6a_$HqM|4r zg%Q)$#2qHqNs$*;BBKqAeqS1ZWqyhLB%_M&_pe)Nd7voOeez4e^8Kos!lW?hKBY`L zSij{YfB~A@mTN%4(=B?BnWWc-F|Gw+EeJvrn09G9ZwR>Am8ruH{Ar6pqY)@13V_4h zq*4;ek|W^ky7{iLhuM(Q{Byvl>BiykW3u-*coX_ap?@=+CSK65!h}ZQ1q|t>aYx5i zoYekGYcdq9%>@n@uk6lU%B`&oKrjmxbSKpq^3y#`qSXXCDJ% zZlX^c2k^W*vmW0yAy4mow<0J^@3UZT<2*z94@u7U8z?LB2h4>Fi?~Rr6Vz?RFam0f|r;JTJ)qa zEVfzWhmX@XUdf5>G`TOGAR3ANY)YY*DXbCG$XMm~(Hl8Nm2FuJmbih1gj2{mXJ$?w zqtKSQ@#lsTzUE5AU{K&TP+Ptv!d)ztL_NYJ?g@N!tBhJ)B{QCsvgxNkY3Un;0E%4rH>7+OVu3P6Kka)li~Hj>QTWDF2AQ) z__=m^% zHkU2>8@d&r8#>)jX6U)|0W0FzERcGSWn4oEhL$tOGBNFu{os!8Q44frSZrdA z!%Z4kZ3@ZSk{3cZtfcS@yWh{K_EChGee()>pcQq-lnIx+VnBcq#CF~SJt^$)V_)%9 z_la0P&0K5Ri;^h7eaj_mo%edeB%QRYa&SZOV+}UiHsEugs-Ql8@E;I#(GDE#_ybzO zx=bl`BUV+NEhGzfIPl~4K;WfJr11aCdhC(Wwk=4iL4GWffgCCy+8T-4lX8ci{MdST z7kngmk|Ij)a7D@dKmlGKdv2}96z)-ZW@h7>skf>byDGH{)He;^p1{_DijXgVOO^Sv z3&`q&6)5*tP4XtIKn}Y|w*B2RB4*My&MEHfXp1i={Lk(`Anfjos{>yI3Yo40o&ph9 z(N3PYbFJqjBFL)usWv%A7Pu4w1{lg-X~!5MC)9;%;rWQ%1YEr|bmi~}5g%;ntf;^i zmvd;OI$q`~$H4o9`wfhjYu7-uXahnYBJ=+Z&27AN5tY4Ddr-tRE_?}MM(12Kh!$(( zYwDSI^V57RCabcDU?E?v*rULY>LM9p8UD6^E)M1m9mAP+!;z%^yOMsnVG~uZ}_EPlhgp)X^|sHM#C7v z@c7~S$5Z-3t+)@$gH{v6aV}34OCzy!8K)wAUFdbNr#U(qY*lDNv)*Gq-!(Xpl0;-^ zWX+}xn7X`C5l_#ki~jq){}-@Y8yZiyI`SbvT8?SP<#AihSne3UhRq1^GoSeFgcsK? zBGAmGt{s1eu*^e5Y>04DgCH0FzHP+j^Y6vf@DN#Osp&wmAHN*a>p<^`&0R-yhhydq zji;rXyA>r@Ob(pE{rC+&bQqCWI6ouLBLx9Da;=bfIfFG~$z(I^+f(6d@BXe#li##M zV0_vdNEuo=rUETJ%#>jE^A_+)|Kf|6UE&&>=8Se~RIXlx=*t;hv&wajl&{S}7u7X{ zW0-o5m{<$MpM>2D4u$*$NZMpH%uz&+n-s&XwW@LWiq->;Cg>?|b$HhfTp~QG$3Ji3 zQegppWoVm#88M(b}_{ezz`Yc59ABsnd-@Nl`gHU4#0>Aq_>7!HZ z%euiQ_q?E!&$=Fut?z7rZ38=Rk3{Zd;XFJ8ZFs&amqzQ>V{lPsb~y0LO)CnE#;5 zt=WI(ZEKDU*2itp#ckE)8L~1yLaOWC(~}i&lhpi&`jv;|#I0Lm&EEJ!H~IjVi(*Dq z>m~Wp?{io~PnMtcOUjal(e|Q!4~7|5bFH@Xj=y1b)Q03ivLCx~BSErVd?(rwCYMLm z8cJn2hkH>y(EWsB$zYS@>r64Hd7!R6E5eE844@SIvdT@7@xb7uxBe-f8A8gB!>98NVnzGiF39dl-2JzcyGHeyv8BU_Jfh4gqHhx@vBthG^=%b`hex`uY{w=sdmu z&OTFh-J&*}8ad>9R?*&9clS^NlU`Qmu2!KJ%KGWJj;RY7ZgzddCa}`QhYF25)whu+@=~o5=*hL@40~M>D_?WO}p2Z{5-~`rl zc^VPqiq?IkW-Um_^#1CQz5VOVl2)Ieyt^6L3UtAYr@bfz5yDBgG%&H|yt$q;f}^C7%-lyE104Z`+ErY!9(Givjr&c3 z1J}mU)#K{gtD$I*PEU@nSbn#?ZaG)d$ zlKI^Vd|W`ZtwHEIGZ@hdoc#olvqy&^Yn{i}@|{^RDVx_4Y)l!S{a@&`sz+6J+b4F= zI^$A3T#8hxs3FsK+cE+y9D`pfrMA8V^9_OyEV(^9u5l|#u5wm24o+J;QQGI?Kd>+k_Cw% zjllHHa~P}%BdS5pCDdY)g!a#@(%Z*885GpKrB}1D)rztfioT8>H(tuG>MnvqFNhfX zDdGN~w7Q{D3?H|Mv)bSwL8$)2uxa}1BZdk;ZJ*_qzSroTs7BoDnuw%@p1SPgtfRQd&x0v?ZG zY0UtxccFSmT)d8B>S1H@V0(G=mArsB)-nA6>xFG%t8`@;f?4-I_%Fikb-8hkEk}FL ze41~`yNcg)`P2EaHxNPB;Zz!L;IBtxC^Kl)FrfHYFu|7~Fa>OEZ8eeJ-PYz{(|$}t zGZKz*7>|n7Y6@>|!(MH>on?YZ&IxQiqjXWVaNS&X_w5QiXiQ(h8pOT_t`cLfrMoeB zy5Q=JwxS`P&G?d`&fApV|GQFQ#(&teKAq;I-FfHl&`?T%1WICa*-1@vU;kzh(rLY19dxVjra z30hJI9%x8On$1^@t?Xc{G^!q00y+__QQESPk}T9k0zk9PG0o776ZPELx<9rYi>#a3 zxybtN+MYT61)LU(tTdf;nOPU*-!h4jVKS~@QzSgb2$+LxlWZYL=M1h3K5P`vK}D_m zxQ3lH7H&yL++#tQBOw)WmVN+@IgHTV{#7lS0VPgDyn*pWBAuED1{=$>XTWqTVIv|sU$rv&>7f27fHXW2pYW*akmXi_C@@zKd<$uLdNU*M zc$u7qob6Z}aD*c3t1wxWTA=%MZE-OB7qxHvd8_fq|C{tyezSyRE8AO#CWs4 zHVQ9&#}XPZVfC-F^@#!blPYpiRD3hmTyXPJF~-=JCLb!~S?#Dao#SrwgrS3$ zE3y5?SNYlFCicDE?I?}PHS$FM@5mF7XXcK)JxV%oot$A{fd2rPr$qX}e#`iwrGMCH zm9q?pKAOa5^S4U9j9!+qpC8Uo;d~;jNehCoEvkFzIBBzrUH<)x;!zdb!KLsdL`dC} z(xm$?Xj$1i^oY;u8=u$N$;ltsXvk7lm2VpIH7zohCpH~leWSmA`ZY*8+@f<9Y`rW& z0`{xB2l9d^`M24R)C3hplN=5h+qG+n-CJqLZgi%}&^ZW7uFb%-gPGNXvJ0G z!77SGFj~$Ok-h>D9ZRx|P0bo;s^0eqO&c}(HPrZfBQ3vn%E)^US{+AN1EwW%xrf@m z$SgAT({D2~wtC9O^{jyhe=2)n3Xa`kAA7~}U}@_ic($hE+u@#1DuZ*2()BOhswm+c zg$%7Zs=-5xuL}cNnoZ8G88%U=J@MC0ZwH-68r~)hSrSHfv|Mghcu0|{Y?kE&XMvgp z!_Y3iR-8?SiHOb?$Df}Ua9rWhiY$&`PhTb>c^r8f`&iL1!VTc5uw$VxmMDhteEPf? zMtDE%vvm0>iO_}q4A|8^F%gXMum&O3ywdQ3Q}+I6OK1$-6@U*4hcyb7T*g>v`y*{j zE2WkmrNq3Uq@PF_n+;uGG2z&<#i&0Urw3cq$GzX0aqzDn5P^$H;KM%?x6TIc0@t`~ z^u*i0oIu<2^=UteMAq8yMHx?LZ#S_ORA1wmOg{ip$0!#Z)jzq)1BR2a`k>&iEc?)q z$GSY{fw6R`@|?BfCTY_D>SV&lvEay;9Cu<}><3;azsbdD_~6_0R|`sgWMk`P#7` zy8G;0;$)h+5>S|MHN`gwi@Z~sS+F9nm1g`9TzQ@*YybLMv+7-X_oszpfzN@7beXc| zygivaMJ+gTe=ezSOcOb?39vg#NoA9f`cw-7TdEr~!4HM_BS^oFGl9|Hz5wC${K&e<8*-DmmxEu-#o<1@Zml?QA{AMlUH=MoG1Fo?(~Yd z)~s{8986%(cxn(=BWsA|#p2A`i%2m3*RiVk_zdi>l4YaEw?5zbQ%NV`84<#74VY-g z`8BDh1e$4t;M8Q@+Fjw8r)(EMS!-xWr{gRWXFeDz)Wonj+mc6d@T6F=GgP4xYV?pq+!WXO}UjTq^)(9b7GP(UA3dNL%UUl^V4QrS-S&bLQ89A zs!QgmaE+{YIO}aFK2>w#UQ|I zL8+r`ef_$ppFu}Ye|S+Ld-ySmpz?H4GT-dj%_+(_{(tU)WfK1YC>^0xGit}W0zLTQ zJm&8UMH+&Q9N5n@zTfnU> z^|b3MM+22+k`b9qmNRkcYcvMT>WkHZdP;{2yCCd;=V5VCH{{{-rrFL3ep+&PT6#d? z!=9EbkDGJ@Wg*olZf^6vv{*lqOS@GA|6I;*^q(zSlI(vnTTWj)Rgf=&y{5K4GnE)f zo$f{%hh+QzH8{&BlaL31@CYTgzIWUoPm1*%CKt(1pNq$*$~NdOycnq3i0!mmLYDh+ z^xvb5ld+{g$sV$P2%8za7v;Cuulh>IKl+E!zv=HFb~TYX&gW~c5jL22mni0WxP23t zBQ;@0h^S+dI#`wC_LX1ur{|UuU?*w7zhmqO3(VQh~JPY`?A`KD$*+N za?l=$WSmyIT9%8Eo{`oLX5BrClxV%xHdC5PRzG8D_d^f=5 z-nDy8Vp=TV=^{cG+-q_BlT7LP5Xm5sNN!&|GPSbLv!k8nIxxvRMkFlluu|74Em>O3 zyX*hahYtG>5guTd+T=ws!<^T0NKw0pT6PWPnLw6};LB7AFn$)6s@+3?@8RqYrf$jK zOd3eSvBWj$Kbgkp$O;Ov_BnX{38B_f388E3yr;4K-RSaX)x?3i?K@y`SfgqOO}%u( zFC(doP#R!ku>ZTdO38^3c8!_4&otfQ)t2d{Ka%jGe5G$fVR4? zVsFrj*b^(EG={MFUym$glEHwt%~2CT=@p6F>6O|EPvqR8phcrd93~HoHSG(F8~=#_ zTV$8>|JJM73h_^<9ynd3v_1@`5+7V-U0TGXKJ-C7kig_Vk!j>-!Q0`xQXiPn%jQI6 z5oN?5+Z7Ftzbv#qty?17OKUL{ryrBiQR1Iru*Hw?_1lSIvx!*p^I%KE{CAZU0%Ty| zZG}KObrUbDp#^fLl6w#MbxNxx6#rZ{I$Ma5e>zdG5eGo^lxQHOZN=J0 z%9lgST!wyTyb8LJvdcM)rC#&oO^rC8H8vgjKc>Ditj=X;8+UhihXO?xF2&ugxD=0oJ|24 z(cVf+SZP3}=eLX|lw9bN5-a=bP!U{9l19F)LaY)*qIf5rj#;VcvMTXBN}&H@3dc60NNCQwGuB5woG9!;RT6}n>K zi2vWy*5lx)?VmIO5vZFwqD^+qOa z`Tt@xU+z(}zIuWT$fJj3owTd5!}-g5F&umk#?W&+)Xv~VWIfwTNK^P)tBw^~&n?2T ztOUs8jNu}D^J90r7|U~xVSICNAOI0=7(eU}lo5UdK+cgTW-hR#|DZbjmM%(MrF1

`t`FZ0ct1Iz~{LJ*RG>3NV5gEf_bgA z+4{-tW$pK79b%-a9~t1gO*W2hsL9Et13~3zcV=GRwqW_8n~-2d_!j?J4-?on5{F46 zI9Q+X#9lwHQ3l&(DFztEmbo;L@({;^%c)DOP2UO@EIZ(@PlN>{K>D#wjc<|6jsQj{ zfdvkR*>1jHg9iZyIcmNL@BOWyZ}_oY@Cr~~ujrc{C4o%1VNED6_FwZd7gP`fIpJTl z;TGCtud|Gz?aW~pe<*O6#(pLq7$roe(;mnzJK;bB(2@T=WB0#M3B`W=rjD>kZpwWo zyc!!`dhI2z0JE<-C~i=Ahlgw{_&#(&nx-%Xkz-T%_Io}Dl?|U1@lRnw^ zQ*!1z%tpXrmgJu90)a*2BDW~kLdu*)%i8yzI)wJ3vp z^wcq27p+@XiGpQ{b>B7ud6Hfr-=;Aez{&G(odVbiul z_8b+p8)k?<`lX9`_m&}ahE2h1T0odg1nF=7yOcq-dNSMys835K?@X>9cx}qttJr(w z3YC9dDx?mwir!;lG4HsxkcIM)V3_}6a$xa(4IpT-#Hoqr+?J&rwU`i$;L{#s_Eg9q zcys@9puTsJRff%!(_*YCB=2@mr~RNz4%=ySJhlSTVstRJaT}mIy7VIi@WzrY_JQc| zY!E*8AsYBjnX>M? zhR2#pjTie3J`^C!nmvet|*b%NRy+_MHisx{C`Oj2wNo442?H^=^ZTL~(T?0wre=y|lgx zlBytg{{;k1#6+SNE{28*=Rk-@mn%|$V>9UqII8QF+QZsjhdtYqr5?K|b85F;jwr=~ zMp|_FU~E+&`UcdEx*O*l9eKf$42@4J1iiX%p>w2qg=k`sD(6*IrJTcf-uC)f{%|eZ ztC+s;)TS*U6Agbic+?()oNW+3fm|UR30~B6Fp3QR8$2dO=r0f7UU#%Grae0q9Buqk zcCVZWG+MF3f5UE(Y8Y}hZ)s7ggKE--^5?oQXx1|Dnw8f}0xSn-26b%rZ}H-K6B=e2 z++P7OUl7{FB1q3Z&4)689uDABNvM{X`+1sL?*He{bd&DSb5ghZ$wD^$R!OA+TyK^+ z_}?znV*_t37#L&vKJoPw@B6}Y@3=?L2JbI^O9FvaAJ2EKEFX8A5TEy=euWmnXMhG- zAaB>ELkW*SMyBu4S=7t0(Hh7m4P3`U$d`jq3PxJbq-cLeCGh<^hlSYv|V zU%#p0Gm@Kp!^sKqxKOs!UYV!lRVLnCZNsvzgW3zeBX(Vgx+`^35K5}S=GJH~_&8bb zM{U+`oFQ;a;>*~e+}+m_JJHcttRbIowW#JC*N0Wv>KjX)EpRt|e!E=dk!`8XG5Gm_ z;ir&ze%bBZeuN4kb1EWLocM6`@U_|Hr;7sLgr~`qeNW}D+B=eG{}~repDUe*A&(-# zmn-(%dZowQQKxPxcZuWvbhB@aTPZc>(8yOyGby~`kXGSuiH)ST0j*!|W zGOV)2GR}%3mP>h!1=JS*H`s!7MFv_uCT6RHPUkXuOdhi99<0-sEgXXLQKo36Q8Cfp zdy&FlMt;@2=8CRbgooJUzRt2Q3jznvsWoRxec1Mka3!EPXV%{y0&pC z4EV9zOUr@1I~Edl;p~nB($VW^=KG-lN^UB=cC>=AM>d-NbwSd2f~1Mj|DQBnaH#Q&#ErwIKXnd*b{pVPTngK3q5}oJ z-)dqpIrh7>yFZY*YQTIDE~)|vEGnm0a44voBh-&xgAXCNdbdeqY%5f^ zzr`!qL~gj6jhE+uE4ote6u@xXlXbdb8GTMeXEM-47-`{aNKmjsDZ0*)9kF+~`3jee zOvhpy);LqWk7iCCmZUXC4wON0&~TKhPaH7D+1I~pQcJ)vlN-jsPx`DGYFZmTN=DZ7 z1s^CQ@mEo1$Qq81iPfec(USjBl-YkoOAVlX56%LoefLrx!zQ3vFXMg8lIdz*(^x<- zyp(!)fQnLpjNiU(pJ(h(L8*$~n&6tKbU8P_-_4sv@?Tc$jDIS=CI(JR8eN7kZ<%+d^48W{k zD=qWEp?~NfjLOKuB0-E4mEdVwHZdY95fxKDbqu!m$E;WW|9P*~p5#24p(KlRFKA`E zunUh%7dbM1h`&X`S!ts8LTzlwO#IP;NMMDH*m-7@fm5(M)vaz;DO7bU9<4iPlI=H* zVLWQMJ-wTArMep@a&+}<3>vR?O*O@`_^CuFHzw5Epw1bL`|gGQia>PHx91@LXc-K{ zT%?H|&!JSrw$Ik>G)cAGM=rY^*Xtw-Q$TX2MRZdf8d6iO4>?JWm-4V(6L z{c{WV*2#Et8@8W?_O>A4KR}ra*Rv(VFkXrS!U+G3HBc@&0qZlej%}c9s!dY8z!&CH zzQ9p6CNIcqAHdt@mU%n{CfJDD9=lpGuc+6i8mx#H$op>X{MG}xb{gZFa#$E)pG6xM z_RZs@8YM+54bD485t}gPFj5kr$)7oh9cN$b9_%zk8OVrYTD6SI7NJ}4N*YF_F0R35 z_!Yk+n7G@%7VvL&PW)(PKU9>qAE^p_-ifk!#dT1EJrz)>EsNd`CFvu*V$MOW>UtzM z--mAlO5KMM6%r4ZV|9#tX%QH&=&7h{*xVFs;+`tAaz&zK{ApdiOhKG+r`PQ>io`Ug zG`63lsp-1=i4GyeL1}^e$2VsNu$QyDU5J)Ot4y6ewtY90XC|f4;2YOm2-Y`t_6LoY znkF#L-zZ9x-aCaVU~yzCk2)ta7Q(GPIuKP3Ts0u*>x!cP9gE-+tDl}sxQ zweet)xS9~(%JkVQvfd8v z%A?aIqW1?Cn;$j$9*gspx2y_p6W6A3ocAv13g8(5;%2WCopnG-4?f@Dl7=8s?xJBh z=X4c*3%K2dIJ2ocP0q!mejY3xV^Cvo<+rrLX5V*5%U%^?A(=s_fF_EIJXC6RX!(~K z(A&+}!t1H91^su2gtlEgDCxryc)?51>Fn0?^sU)Tf)MkAVFJQ7eLPoaic$PuLvQqb9DR7_)+GOd*^I? z6BVPY<+15G3$gutv+hRc*)%mRmK1w1=3b-NOh!Ih5k=VIgMuq}u1ECMJkNV_o41skP{?-+ng z=@z+k?XX;ASxVj-N)=A4Hb^$WON?I-WL#O4l}E(e*+~O_UD3>G0GuYOSkgQsdM!z~ z{hhE_IV{_fs%ui0qZCuxFxmN`Pzi4Seqx<-!;Q=&O?IM3=3K_nHUEN zjHoIVq?!q|Xpjm0>2SY}6uTkyAB#or`?ftt;%F#Ewei#2pG!%^6sbDOmP7-*?p>2T z;Ja9Bq**XMuASOKnW-4!91O0MHAXYogZzpEjC_aD2d|PvJRj)5r#KpicgpNr(w*#& z@a@-5<#LsI)=}kwK)E(1S%f?h5=5t8RwG2&w{d@?G$(@Wk7H_{4^Wi$i<|&;Ae&yy z?;rISU5=&IM1$M-3L@bJM~i4=Eeu?Xl%%fEYqDN%Fs|{P?Qz6KIxM>Te=8`?hYAS1 zZvR;{Q~d;IJ}H@`b&C$njDxfKsVlI^7KUlC{FLW%ur;u!0Qmlq=5$>@{;+2Cm85n* z@D{n6sfzoV#$c2sN(fc-`_J)mbOh#Z7yXO-HR63tjD>~oRg+6DcVQZiZ?_ve23zBj z_c|?%8uq%M1{T#FJgjWmyL;ks!3R-CD+kDGP!Ri>4Cz@QV1A)G{j>`El)d$T1Z^RB zeLtptdIJf%OhJGeR6}3vTj@Zl);O>L#w8TroXWu5u!p&`+qIHqS@vhWQsAuVds9@N z)04--+ogUWkYv$8W~BVs zqr{A0;Sz{ot9mWqZi!&MfEIA(zMG}#XN3B@i?4)@`sMNWDM(p}M;Bj@L@EA2^H(3j zrp=yRPaz)NSrhnOp@!+*b$aW5-y*q}yq4Riu7v?G#uJB&c#`21H)WeCYq65m;DJ{V zdpJx&{Jll?Z7pyL)8?5#r#~Uhf*;AF3=VsA_<~)Z?^#7OaG_&#L1b^Bfj9jJ|0x<8 zPW6?a0n$JdIY>ABsz_hQ79B)r2$ z-2)s5M>9N_+sn2sTTZ4g+;w%?p!R)+=3URX@&whpf^MHv2qm0l_uVPIPwf!yAxYBK zS8$`T>e6CG>KGTyYh--V)J8;W!Z@1JKjal(pg8%c2#w=yr6N|e6CL}6fp*S?u7myR z82@Ia&FGAFOTKOCaO9r`tLLB#2VY@P3#3`sDtjdvCT$v`&9O{Dr+Z;Iw}x}#_JpQ&rUP?NL_eB=SKXm`vRGev{F3+1C$oR zXR4J5_WBY3hKNe5X!?UJ^gr{n@4nE_xZ@=&Bq0wjyWSX2~t2ti5%gVdzlUD3mUYvC{cVIR0*c66zbxT!zWJUDmWiyA~WoMOR%Z2y#INqoY z<}CuEZ5?U7ZpLZnrq1-q*rHe~DH8HWZ9E#1PhE2Bw^xj0u|GPMZ?p>1R)C~cZ{XcF zzRU|6`r)y$>_(J*_`93h35)rQ^E@0ZQ-x@Jt>Wx;=%&PVZ{d>GLdLo;=!&zxgKhVe z!_B0h3*K0N0APM#Skh`4ussUV8@k7eTr+V4=j>%FqyX8+|FW>Uk{$FFrcz#7!NBkNhK{tD5jHUTILe( zc2v*CYvb$d-QktN`}0|y-^c4(XB@ZR$6H+1(ALM}#N-kpRON6QPq^e6rm=1wn&K?& zV4EQM@E!c;0!7w+9vB;3oJW38F%CSaP_EP>in!9==l^(za;sy^-89fZci?kDq{XZF zXuC>PK{rEJhk$l(u*mv!Yms@EOcjhFy8`e{Z%-zlqJ}s^qLV$rn0Bfy+H?DO+j()? z5<2fH&YF5I@z_x_O+uvC*t;*#{RbA=a0%Eo6}@n@EV!{Q0ve_YSdx28UnmY@|6o$o zP_dyEzV;c^xnY1T_+Nb2U;GOKT2C>SzvCh*j@X`1to0KFXG)GApZaqH z5b~tm%}eSb0LP~oW(gLji2miX!b%*i^1VrRBk5l9TYCO^){kW*6byVK>P8M1)zV6^ z`BQg3t?gu=zgjh%$v+=qkzOgwz6*k$dGs*+9MYkJQX_Cn{XDZ4Uo8T;akXRs8+X`6ak^b3P;c`P45GnsW3FYNqP;r4Ak%<@V*6kqv(Hz$cr*wJ_Fa|Xg@!g zWVe%!09?_$ANz0jMBBh`+2c_Tb0-?pol?IkqfG{qNw*778b{ym{LKsuC4*2&QFjM~ zQ29#hcPobP?x{MuK8K(xa&cA5$#6;W@CJl#wtHu~m+)5vUemu^XG|&F(yNy~d7(UM zyN=j&jd#MEX{6k?15XC-1CJi;FI`;{A#z8wR6n)47<Wq&3Ko4oz_#;ZVr)_bQgMMw{Fd z5xYGSS;gw$S$L!*^0e9RvJ3k`FXq(P5b#4m?_!AMYICh1#$KxoeXSOJ^E6)aBAN*M z+q{b@=cV4hwSM2VXHnqFKnt2Rl>~+5i;(aT|03@hKaOT z;2IgOzT|cg1QhWN;{hz-T+|7yPGJSry76c;c_Jk1w=-TOzP}zIJLy{ElO10*x?3TO z2H~XScehoT7HMziy=5310BM)4=W3Y{rf>F3poisoWA7w?s)R2v7_A8~+0W5%iStio zE&%zcsOZ0yeOp6W0`EVjXryo2y%O!`&|H~y9)>j4cYmH88emjtrllIQWlJ{ z8K`9^Db9gTjDgAVZ<1*cjUR>u4ESwF^M+bVT#2u<_C3E&CvsEZ=@ zE||YQCdg655{}@!veF>>{*X`Yr9+)to6;w%T$7RBw@x;XZ1>He1+R#4TUj$o1HYn ze*|^JL!0Cdga~oAAcb*Y-isi^!N4yJr`GS+J_mj)$wK62KvU}V0RBC_ z!UcU!3NQ)Ad9Vno%Rn`g6!d)N^$5{^tVZ^gHdG9{LT5ewJMHx8tGVth-&LbZQ&Ke2 z-uGzc(Mk<{#pkIZ5(^hAB4pR?61GU8rvU{NFPGi7TnqL{AtnMwvLFuLjevIyH7RfR z_(yVF19R36=fQ;y^&Il{J0+I8RIOUPK?&IsE0f;{q68x-hI=Q2V-~y)fpZZ_($2e3 zWtg;p902+8pzjGzft2xKgpveje;U}~ArE2_)3(TA=;g0&1{r(a&wq^_%z8Q^NyK^g z2z(h!<@18Op&EOLx*XSK5G$J^f1siHbo~GxXK7PUY^P`0ftuJ}YLuC#r!^m@ zu@g)NjekaINB&zWI%P(!q7^HZ6h$qB0e8$da9RK&AY%|h!5+sxu*n}Y5Sr+bU(P*~ zeM(jZpW+Exwu$xI5K~+~YxvLECeZKM(9wTWAtM5&ZBsPFM-Mpm5JWjn5-bY&9q^=> zm){{4QDIV8y?^-LKlX|-Lu1NlX^T$A;1v`VXl9Zyvvaez|Lh0n)4uehisrpADN^J? zTSBpg(wXX`AJ}Py)}~3gVhx;({Z*z?wTPku%uG^Vn6awVxY}NT!z`978%U2M;VmxN z&KQcK!}=-GrppSSGct7jS6e(W`sSs5JzBG50Uv2-iCIB)CMDb{6AStjnEMn@weV52 z+^ohStZQA&Uy6iUO~#jh?2TEVI0ZVTCrJ|>LLITv0>XI60ly0JXebz<82MR38D^Pf zyKIIF*PWsO@~WUnH4GkT^cN-#qC-Y;VhbO5=j)IwU{8uk zXmVqaWj%Pnnj6&u#mlUB=gi11t_?VD7^au4XQCzYKmBzk6q66)|s#o!Xf9*Pl*bew^aN1u*Q`_Ne^~n=|v91Mt%2 zPuWnk`rwP^t=eq!!SES?s|Y^pjKEY5%$W;P5u;IRo=`SehmXi$Y{M+M>^_s%FNazu z^3^`Oi?GQ*DTo<~sb(8#Y)hJ9x`Z-!piRS zH1kaIh~V$EKn}58_UxgUzeXWX$aJ}XpuL_v;mbjsszGdGtZ@7iYPXJ?j&6(Fai646 z;dN47JE-2Zi^;H&mGnyierq*p6(!$f^paLhfQ2(Ii+3!1P!(^LkSE&72zJ5(*oMF# z46$hoJF2AHpNh{KKS;ABbU6>9vLpi)+gp(|k;J7RV~H9*6nC>lC?)I$W}HNv6}}c_ zGG~$M9@sRPB+YaUWgbBbkmV=W+7-@Xy76cKPQxD|-#*305|eTEt(Mdi^k2`HgPR8b z&%LP{M4kJSUpCuuB~E@$Yxh5H_rVBr=Kj0m^O%SAq9t$NQx&^ZFKiu44$P+|q$c9aZxtep99>3q?{rKbjk@SRK_GF~UO z(DPO3GGrVYHZ8w=%fL^sTRH8uu0BY^mL=sx1Onmw%un-r_tKq}>gKHH2OGwUg_e{% zXDW7X^tX`KPMa^wR2pp#HbJb}*#9(~V8SIzQ{YyakrZR}n?|QRdGzsfGw!(`N>Yf$ z!aHdEA2bxsy1qXt%{)Yv`Gwp@3&RnszqG!8Y}f});>VlIU47z2fmgRs1W&e=OY077 zTTfl;RchS<|2vIyqGXIch8$O6?Q}$HWIper!v;Q=ADEo9g-)Hne$A<zb+dPcso3gdRiTG6)8BAcj!5c0$<9FIo5V)O*i+c!kNo$1aB1GAJ{ro1Zhw zaV3gb%>+V^=8w-8?n@Ee%8QuD7@cuXI?%~E<7D)jZj3n|?Y4oek#s`cU<)K=Y{y%R z`Uw6Ltz?FG9%-BJP;Moq2%0Zs7hc^`{t^(%aAJ|`3Q9uLi<8_}K}o1wH2fDNrkaPf zZ#q}c4Lubf97l{=u2<^KJhe-cR9i0OKb+KSmdc>EN?Qb;)#1bq^hON=U)-*CXJ`Cw zS@hl5gZSPm`YH&?b=!TBijpgKSw-+XnCSZh5BiZen6MqtLp6@&95i_Udi-OX`q{ZO z^AeDT3X&{dwV}bA*9)0TrA@^%SaS(G8h9kyR*3GotR`V+q4ybhWEGN0k8Ydc=YA>p z60@xABvZr{ZBDry$-e6yM5-ZuqVlh1zIzR;OaJ7?CsK#5c97Kz*GbbVh}VBAhl-PDO(AQn%XeD~_ukggsF{wyX3jMn#> zphV5ypq&@VrkMMDuEIf*@UOqGQeKlaw<;MWKlv_9EATxWO^eqtyJfcTn63?UIj#2s zUrU*}ivD<&dBQr9xuAMNEx;{1x z8A!pKaaXEe^J(i-035Zf|gAp=@t7f~d%E>R+5&7B~UcP?cZr)*=(k2XQ z4khjmZ53JMq1Y&s_U99eTHi>gyE$pyH>{)6GJvKKb=!0Ah+D`6{E&A;o zom3+oR7({xz@b*~uk714_IGn>N2eg!1Cl_p1Im;h#)e@4ert9bH&g1O1l zzmKam!-9}x)Pd<5IcbbX-yay!V2R|K(_ww0TtxawAJ(`}M+>pSUP)5BV+V&NRjtLh zD8=>IKh*k8WZ2a&5A>AtpY3%?HS$H4BWhmvFgmh9rrrgMlFif{?4kB2VJKb45vm(#cAAjLe#E^T5bTe@$_NUhhB z$J~~Z6W8PpkQPfocr{(gh2|Nwf|@bDpIH!VJss=zT0;Vf_8G-K`cONT--h1qN5qLg zEd_9hCM$cJfu|t|(YRAy5KDb>r2Tl7QKq_Jxgc0aK6_Cqk@AW;SB+i>FD~Mwpsz)j zrnMAP(WOk>B}hn~4#y*ggY;w%a&C-H3m9=6olf6pH{@PxKw1jV|C=y0hDuQRc*MXR zG?Gq)51Z^>(^H@~Iv{ST!Eu3Yz?H?+Aiw+oBEQm~bZuI9`ClMiAK9s=4JkXl&*WAn zc%Q~DXltGrz?W|~;i6Wl0y)J;S4i5>JLq$41?~x=w=qDiqLr*R8!ClaNIX<>LV>#) zt-M!Oy(H)FeBoaK#n}g)m9_T{kw4VkQHdrb9i~s9=kdHSCMq0x5Hf zx1}7QB_kODDx!TxY6M8fvrKe1{tn-1(m^j3k((D~kvkC9ZvP*s&IK7-^7#el`8HNY<2K@=3u<1k4)lNA|z}Pi4?CgwjA{K5^anc|aJu{88!)Ixk zaOr5nU~uZMp}`Tlo2eL#>UJ_hEdB|$VbZ#Cfq!E+8bag5KLhRrL)&flW!CJ^m2PzMm#_`dHsYp+CKf==cUF6 zpsp%NI1M8VL+@BX)51L5f(rv>J8{En_~Q$f!`d^M)eo)W4NFk#Z-jWX38C1IaYD-& z1x^JtIgeI57h!$QNur0R2V*dCDh~LXDeAq z&kHgo$cXduFEML41r=`{@rHQ&$ zYEWBik~U*a(ld84Jp_F0S#>r7{?q&44_4`>K-XPFCAE`LAhP@?AN(Vbtj%v4mX!&opA zow66K=UqAsy%)7zt*BP+O=~9aQx2`0j_UhPW>cQRg7idA zBMip8dM%&bA}J2{mqXjjDN0R1hz)M1Zz45`(?-TfVD=Fcwr+g}BSivKJljUc(l?^7 zpK;X(xBm;+5dXR(NPpRl!~<>7VRswFxBqMrB!%WFPL-b5LD+}yEM&krD0}@J3JJQyit=*;UTcfw+RPJ~g13n2-T9}*h09Fd zAO3Ic;~s$Vo^M|8{2iOo!i^O1n!$Bh>T?Olpb>u2mQ2t245>+Dp@PAY)ZqfHQeD9Z z%wpai=#7KeW7!0W4I4-v?vq zWE$&v2-sHv8Kp}X^;VmpuCZxsp!_(ruSBC$KeQTy=;n~1HvuEgiSz1k8NG2rk_n+; zfpJ1CsH?;b-CSQ~G<_6xfcMTnEk$m$2WF*O>a|yAxew3+N*8hZ{@2I&h{f^yWN3(@ zc*57))1hJXKZq;r_FQo#lGRrOvk|okLY@($250RwFP<_rWyc7DmD3b7w{h%2Uf2CX zlAqx8T6cZ#nLmFnNHDAT9j8lvS^>6~sKqVxRF+FQQM$5S20ENocE`uR{a9!BveOx( z!F7}=Dri~{NET%d;7*A|TX@Fif|M`)IR~B9>7ar*0jD~{jzx{%9W-b(=b zKoF%6XB$7DhS9SNdQ69gFi=^XIFRa=!l1sKjsoYGXd3l;nxAYE8v~pEV+3baj)RRj zs~UsQfdDw-3J+B?n6571>mDvNRoE@KH=7UT-jXdR=4sPFfwbD zSdaF)ogE|s`>Ph9zNIdGm8qX%5i`OlEZ1Y?OGp1QXUckjMJ8=ahmZE$z3T}$G%WnA z)AZz8aGPg9R7GiEP|jzTjG8hgP+4xN31m6q_&k1RAXu*Vb7=C$I>uh+z6H0YxxzS^ z({4QFR#U3U1z@K}oGq*MbDWU=QNKT%`}S3~%t28d%Ux!=){)J>ZTWSYM4_j4?mFVN z>-?bSpjFYcuc;9~l$>kGuCwu-L@1$^a7&Vq(d5{91!jhxEfi!1z(Tgr*fG(IPohFo zd)e@<;RnwtPQ!1k-|Wze`DMQq7*M%pi<=>}{eME8i#?as_IcC<9%zdIFS~4^^n2|E zgs9nqBSv zhlQp}WOkJ&*FvvQ|1ifU9mNk!zcLSmCUL`m*i9VLW>DeAv^$~v=cB!UBbtm|2b0Ji zfLEULiqH`4ftRm~#r*jrO)|;>@$Mop!D(WBt&ML2SK*AiXV3ygS zYwLSe2rZX1H(eV zcAu$WT2#xO>(_;--bf+1mW8(r$bQ}dubRrh06pHV;N=RKtJW7Qhv3}PMAS1^l24|} z+>I1LRsf6|B@ED*4{^q1F+aAI=}5AfqryLPgLhgQP>$_KNBDdEig;5S9N5~a9qW}< z9I-VPA&JNTBW0lIP$U2FbifceX(X+&@bzeNEQyr0a}L1pl5aoz&wlSohmW-^)oZ_z z38@i^da@knYj7Z!E>%1uRDVNgSKz@D-`VkHp#q-NkZZXaR%{5)Qd-_4XQV9(J({>& zcGh0>8*0`unVD5m#wK8HJd4ldxp7dvmat&8w49AC9CH#+WVZV9=5^GcG6wuEZ$1d zXeC*Z)T51Qy%w_(^lK{Fr)t^iI7VHc%ac^#)I+fytLT2%MOWcGa@#GXyl$66&PV{0 z?>VZi@3a`&dEF#Yq!B`TT`$88AVBSRW^g&6GP{s?sJ){Nq=#DQ^k;3?he+pCr=13V zMGTxa-(QL4(b|F&?D~r-8*l~vvAIQ_^M<|O86P!L$s>t`ji%7Z(7o+fA=;q?NUUGQ%U#5cYN2|Aax`u`!w9 zR04R+*NB_$80usRZCbKMV5PLz1bkExA?Eh8I~!{8Dp6w{8^UJ$6lFRo&mm7yUJ>RQ z-}cJ6D+Di}E;rksoLWPD)^3a06J|L$2K#jfXF7GV#gT?&-XGVP~a<7pc z5?WB!;53qL{=Pme(FgYu7}^1U95_rYFX`sM+rbwRd%5fEoVK0)5k1beu^+oJ!pnA|U-?uZ@=KcPYzxeiOeS74uU<|(c*h@aP-clv3wg+(WGxI;@L4J-$xZSYY+$X!3*1r-8UtVAV5%5@9OrVRgTZ3ujGvZfRR=+ zkM(kM`uS|}{f^54t~C&TW+uv!m|K|nhdQO@+<$V)tf1)z-{F}{O%arMmMuvVKmP^h z>1Vob!pY5uzTuXtn?uK6q$sCiGry{nMNzX%_x(oyO{EU^{zM+RT*H6GZ+pqq%kdlP zUfG&C*UUXflTbhUvfo#_!fDCJIWfG@L?@P`%w6ZRs*8*%yn<&;9s+N{xKg*G|FAu8 z@ypyg0bOg<#~a2t-!guGV+v_?Rl>x`)u_I`0X@yX?HIATvn-30xva! zXl$+E+5$$=yNdhN_ZMx^-vCAbam=?wv?84V_*H7DY5lPQI#kNxC^91v)}+3UZ~>eb z5fUop;V#o}c}Dn3-Suo&{V~lD=*WU1gW|nX zo!rFrNfh5<3L^EzBfi5jw;jLHZaAaqZ*}CGZ4l2HiZO7ryfF>b8zS)iqR9opB-M)F zB2b}VQYB{LQ@mU6J@2b<%eytZhTUw{>1%nFd{)#VU`#EfM3}H^^{e@eWTlhX#D+(G z=iB{DC7OB^y?Tp8$xXV53~~6Ydf|_YxELTGjJ405I^DjDR?QN!{;Kw%Pb?=vt1vFI zjpN#M9j{QYQ`8?$Syi_U zV%5Sryn3swi3RXK4zYn6mX|Dyt;Ns5jJ8l zZKdDN-iiHcf&%<=Vm$QN5?gP`ahJAMVN^t;=vo@&}!A?F10<8 zQQi=sEGJETb5Aqzx}9)Pxr$F;+~dxpJ%mzvsd|j9!GpId{mM+;t8%T|FLgj&_j`wT z%{}W`HWqec&gXA7IY;_DAjp2cl_7`d#eO!jij5(wP!Mel8jcxzywdx_F+SFdbBQAKJL-BXmq z<~Pvs?(kEpLXrK;%*SpH<1Bx@+TeF3-wl!EEu(OukW*Psk^zED(Yq3YJbkb6b(1ze5c4 z$)fQbvvGLwkfs#a<2Y77#~zPoKPPOAyW^QsO5)!+j`Aa|ur$9kQN8c4P)*JQ3$#*E zlJe$F{55{xF1Hf+3BKNbV22c3eOND45*O*iS1v+2SF3tgCNRR+$)HvaNG+E=F|W1~ z`}z*Kn(&j(cNmu}LTqsS(gYf~d>(OI%C`j{xe#r+yD_WVf@PTMtK?KW7iY~Kj1eV# zqv(}hzof$8UdZ%CKY!fm_8j;q*n~JTZ{?g|a8>AxTE^js( zp~{1Szd~|S!4m1i=w)BE!U3NO`5ViWTpc$57FI4=gO;{qyn@{Kf;Lf-t2SF97u*Ne zjQZU{9b7T31Ef8AytI*)ezs1tHKO}Y6!*B3FTS4P42LOo$vY97c^SPMCsW&YJ^|=% z!|xC;7nX-U?q81svLoU>Vtz4H85DWD@0q#1J2nZ{4c^^y5+vL|IrM%tgIpK|YJQAZ z`2ohi-V#n-9bl^gtAu>3^bL4PV+nKUNar`xHtKj}p9+&daKm{0rZf_Q&R*2@czXC3 z_ZsI3>h-RTyvm-2PKTU2((lhse(vuw!0=#;TIe=fZN1@ZJR>u*Y^p^~Ev-@BvlaQ? z3b3$$|6x_IVR>eDD6jHKsV1z>>epFx&irGDN1Q;TQzH4x*I&AM2cH(X1c(c!-stv? zfX2CBTuR7{_!&i|&$eT zd&6I&Wi%z)1Dk>s9O1j33S~2by!b9Leb*`~2+sm#G4+BXh3ol7%iuh3I|4m(40XOE z>8T;l``vK8&T83Y`@g=LD1*WChRk(pnyoX-$;2#_#^dUOW#_33)(*KfxPnUeDV`%F zr1>_7zFzAmY>===`n-!hA&0a_^4xk4>#=1fE-0H8IiRjYu1tkl9+13671Js>Fch!Z z8Qe$sN&%}e*=XriO-A(Oic+tvz%T7k;l}XgB6L*wVcPu^`c%?r`~6erH&Cc)w12Uz zzS&UzK0+!*ywDO=j2G3If6#MY!-l=XWU6EX$aLFN0JXu}$i?c0L2R*&qVA0Ad z%hETl7Y;kiQK~xUT!YGYDlXAj>5llMnA8BM5Uxuu4!kEdjtrwr6IC!wV~Q-~c5?@U zYKc;J@)nL06W?{;=1}IRKyNYf3X~iQqH|O0oX&XHec6ct3NGM}r!=|qu0BT+`?|H_ zx>;FQXkB+sYHU{O228$-)TOD>2i|o&(Nr2ht+C4nAEvu%|tUcpaVkubB zc$5FRY&6TvcFf{$_qNcHtm2&losX;4wB9>Wk^)==k5s2PSUD^rHg5aAM1DnWEhuRc zGlx?g*ZYRBvyi_<05bP4Ec?i_h{#`l)0>f%4`T%?(mx4vUec~A)hOE6IJz(j8L(t)UM>BsTr^bHnyPiNni;x>^J1t2r#-t1A*LO% z&i^?>K!>^{?2*Kwq;^(NaFLN@fx~;gbGg&|YZf^`Quo^dIvb-PrZR~bxvWb04mJ(j z{M}yQlO>X)ObTirN?hA7gnv&v3O|>r#wJg#a9HlLKqLB<9gE*@!|QL zzJj&ZDAo($x?;zh&7ue8Oz8{Y&La?6ia>zrORKboc1c)z&VHKE z=a(vPbFQT}1@jO&8rKP=O1?rg_ju97UbH_Vz0t`~DAb={@;Z2JOcCrYJHHkoYSW0A z=SjRHkJ1PtVrXDqz;IysQvjOijkL0!Voq4=OOc1*d&#B~akwMH@jVe^av;Tmq*m+} zj#}p=RGXPUt%PEmDLo>(!~vrTi%rm7ABz@FXdLv>-w;x%wm|GwUm-%G-4kXUJvTI% zE*KHxfChf9e9;~Vp40*Z1r~rwWr1an)hngM!10q)m2;&4WscW}LUInbH+oV3zi+ju z60*1(%C%I;OBMXo{+7re%;pcjkxXp{Ax+ZHFIUKPi?Jlw>_Ct8Z`_enu@Nuo!9p8S zs4HM%g_$cD`3buRjbt=KKn;(2FO3?b2aUPAx?M0csH$CGoe0Y3rqOYkh)b^3ts{92 zS6}^inKHD47|MOZIW~fT*~r3kuPK}ZZA&$)z?J-zOH8V4m$JbKZrTltOkuJ1cVq@n zYq?6ABc5pw7s1azoi_Rnx%#Ac4f=8|SCuT1&1)`tVVUvO2-INsYo1=~&+*$G4sB88Bl zKPe|}N=e`0J{E)1=2p9}DcESc8GH%_sz1a8Yr2I!f7n!j%15rWW2vC>(fKYx;Xj5V6%&bSh4u`I+FHSu*^~&Xs7q*nUk3`+>nR|=F;Ms-)=q%ZnOx>O z{WEv@J=A8aN4QkSpekMVYO~5p{bnd2-wr#X3H(5kHgR(Zpg{p-b;l4Kc1$AJmWX4G!4Ob`_b)Y z6_zsnmR^?PqmK4lm(I1?RyQ3aa!n~hsk>|9B331Rq4NWbanPI$>9!@)TlV^8^V|5% z0;dwNABvVTgpNStKU9`zR15xzXuWFjb$gZcXS@cF2lO3nkJ#NVZ5CW?+H|#QKQhi( z{^_|14{|nz`lW*{X;wMT6W{Uwn7Zb;Jm0sS?Pc4`=CbXUxvXW|wr$szd*Z6aWi4yj z*88mQZ`=EC&)w&`?vuxPoY!^U8Av8~ATyA>-3D;}3fsZAprfC@fxXS~fM;?ug(8|q zy$g!T%Nlb_!VLJ2}>{F>c-8reTANS#p(n{;-x6{r_GDoc-3A7TToCc{n*wEil0)Aew$dU z_1%f7Yq1{;1X( zYHY^V5i`B@^Pksdjp@4i`&(6x|Lmw`-XQrgP;;ly-VR&gskKGI?b&$*eh&)}(y456 z%@OP;Q1qCyDj0`U1p-r9N$DU3sVmJ`NThIB5HE+k?Va;yAQrzXv`{HZhj>Q3yX*9MINa_SVWMHfR@^2 z#&Q0Rq5tbKpE07!-XvZvG<`T$^)oxGt!XIJzm}_%OMd4@+i!H@suYgTsI*YKkpdIG3x) z;|Qh(?Z43AzQ~aT_d;CUTbBBM!+m=s1()%7jQ7;!aU_ivzi72#eA;|!fez9ee2s|X;+Zy7B^$>U4eZ5hMoXfx8euv6_pNpJ zuU?29&CxZfO6h?_3n695zSyDV+s>~Lgs&J9fFZgFqfXxQ5oIQ_gVf`*qH7t4Ic>lp@#&mhOV=;{%vt)hZLFlJGhTjPcYiX zV8II8agRUDz8HYL1v4?cf@{{v-6t2rh7tbM(?(;Y11tzfdpYrClYG$DM%9+$i3_eV zO~p1)nGWGPYIvuK%ay#e#c7DU7E17cuzs734d;beZh(4-gfBJ--?9UJTNd5Q;5bv1 zxFGVj6il1=d#xkRf}}xNq(Qo{`je0vZ#>DOB{&sc-EhilTr&bFGVlw~;rI$fZc!!A z|GCrpx$vxX4p9ZlFz8X)p)V@c6;bZV))&m}u`$2PRpI9m)aq({IYhE9%G2Rp{fx}3>IoQFTVf= zs+@WNgkr}XUol~e!Y{#60d&Xj#jrSLM>9Vo6Qj+Bq>MF~PYz%NIqo9ye!Xbm2Y6P` zr+vt`3<{g2dYB89wHxs=0a^;z#?E!|oFn++UG2g!wg=)L^T-EL#9)azc0nBthUuX- z6d>A5%$OKO0f1qtl@u0~tcJl}PeA_{>tPn+iXa5#5`^6e!~LeoX;d#)zwPG%zEX>x zeneA)qw(Dvz1*vuBB8JjF9-9XQ*#|soS1#z0X%f8HOu3AXfrTx*?2M5P(Q1A>?YE* zGz#TcWxQ-`Lw4X+Eybj574XJ5lOAjzV5`j4?>5jME;Q}$cjsZ};F&XDvQ8L-B6G_a zqq63Nkq$kjpS^3>W9Z(Y|7VEZnb+^O|w!F?cJ80r_m&am+p%u zShFWUbOwJov-uJO^=6jenp0;d`LNdPndLr&Sv*b2yqixvloPzrii2-``n;87YM6m( z1jXXRt3lWOjqTs=&Z^KN++5z z;>wtEo*s0NC62Y4%C?vy9?IEYA;d@wUHMR9l*(}8k#=u0?KC^wwa&+!&Y>8iQBX)z zI$$n(ome?!&{83NbQ)AeTSapk&cwLjdx@L25E+bw{&wF2IT2B1&Zb4_llJ1>M50rp zN=rUz4z0enoY1XGvcKvGcQn?1j%z@rC8#OSGZ5{qhO0}hs2Xhzi9A@o_ge8V()TOd zG>PLJQpJUuXj6XBc2{%HlQ+ec)%t0rQA-=$b-V$u3r})2wZp+Tb*rPDrp$JT!nCyCJ%_Wk0WdrKVN(OK^*+MEN)n=52AXYDS;g+6zN;Ro5Fb)JBHyV(?~ zA+sW$B?(wXwN*8ya=-|mu(v>T&V5i1DlBII5A3a?R_E$x7rO&b8J7q9z)?|)`XOUo zLIkCm@9y%A%cKT7VAm0!!KIwj8%qroa@~lgJ>Fb?2f@1h=hC2nkTj}03nRkeOUZSz z4(0Ysl`njO4?g23d>gd_RjQgUOJAngv2h;_fLEshM`|$=_ihaMIJjZ(W2wn>gI(cO z*H;4A#QbM=#27z&>R){z!}Hv1X)pI1{H9z(5un6EAUaYtlNRh%B`7-A&2{;}x|||M67{0?6f79loM#EB61>yt(8Wl7I32MY zY!<)v+8+Y-v5GW1AnJT6e}UVTNu>02j}wgEO|^=3&N!^xooAS}tKAzhQ1?jD9xo7| zLMi$(aIUUZs}6Y+%%~FrX7|;g*k-afxkTFRW6hlKDq3q=s_WJ10oQG^z)ZCX{Q2ja24Yk~j-hXVUL4wlm-5L`UpVP+SDEgnWzd`g^L_P!J1Zf!zYZgVk3rEuiEwM4t)*1P=H@y!*!w0-#)6Ke!XZBB%yKf?U)eBuOJ)}4nh@NJL}dy>z!S15cY1#sQGec10Sp?V{w$MZ`}f`f`9#_``04 zXZp|*JsYY={#t?ZwHvHE3y~Da%(BgwCyd6aWRcV#m-=(UNJUQ9cG<5D&=mE03+jWR z&;b4Cz9Z+?np$0#xG~bVz9&eQ%_`T}=Hvv=^VbxTfB6_YYs(EYn(t z3HIhvzU1-6dVW;W3vb4l%_3bzI3V=?s8pS5RDCzRY%}R$%pdsM(Mk#rg6+||?gz22+14Z+b^hkQgI^i*uVV^pYW6-* z%2ALMo+>O$*2EOp6A z7%w`>PMEc0FsJ~O7RdlyeoV;FLJYKD2ET&}-})?)iM6}<%uvs7i%|+my9*q}ehRPjZ(d|2p>6p==NGqjbg^XE! z+(VCbt0uUVzz>vbn481*JN3KyeS(Z?Qczr|z93v^9op49hzw2bfn-XW!Ikn9NG0Q? zZMUxWa1)V6YJrd3eZ*jkEfpbcLjdn@lfAfaqv0{XoF}l7)VRXJc1C6v1(e1QKCwv~ z3RR{wWd(Ognn|7Pm>LMC!#H%p|D|pTm@Izj_U4wj<^xOocfE9wlqxd}fe!$b<_|wmcz%gC2RV^%pwA&V~odU>ieK- z6!L4}Vz0z2RsMrpKf2+&f?Cwc$-j{1oSE}&;lKxS8T#Yx(L1o_?Y4Hnh;BsmG9&U*i zfw@3D%3Q*HSHAlk#+=m?TcZhsr5#%!L!yaEuR-js#+}#}8qedkKAvND0&zrm-siu! zR!2aZHKq`a5{oC^c>muqA@uIWCzA19WLS=_RFiU)@Ie;F*z|tz@diFQP1Ue61Qh`p z5tBVI^UHr%wuStmG6kP3tbKrB2t93Jw>0Cnuv?MC7a0ynvJ-N0L1n=&^+pFK;)bD& z%7@StDPzgDVwTkTE8k?}AX|Q`f0(AZ$F1nKu1p?=QBFHG?)GndE|2W>H)dNVdiyE@ zBvRI~oh-*X@xqH9&t(MpM0zG@IE$nRb+~Tb5WE}a#4r~fDX;yyweSDSj*|wDp@PxJ z3c&1$KfUmxdg-%{EqzTyEnoUHTOXuFXtFGv4LG&@Kn)q1r6s-s_sK9AuNp;s9i;S0 zrLb?qfNk%;#e>1KE`f`4QCZ04OaEOT zM1)oflqYy*<6#Gud-#fauv~c=x4k`ifX6MEVaWQ7IJ?ILqWREiRB`7WuTCrl!J0lW zXN5*~a)YsEWMuo9$>yO?u{DrLGu=w|VdAXCZ<>*`XNq~hZXkocoN;rI#g>Z|e}hoWprsNL z3^A|}HuH!^Cl6xXd?(5Dk{y2MiZ8VYiA%u40=I^Yie{n{U`!4u-d#r>C6oUxKH53Jhs{rAZFrq1?O@xD`Mzh zp|q+TRlwwCo%l~~jlh%bZXLx64rtW5*I*$&*k>?0JMdFsPkt(3{EuiR;hN;Uu!kYh ztQXVS7RxENRxhG~2fJ^Mx{NyKL)uEG7R_2xU?R=J_;3jLao1A^DK@uLXYt#s&R2#e3)KC*$ug(c)>n&+JotP;6K|w8)Yao(Qi!%s@L8MT z8Wg56FJ3gAS7}~t<}11t1(sr6)&Zfss;eWCUGlH>I*;x=$kH)otQF|@h2f3=l_6i& z`xl1>^Mi>$n^|m+J&~K(>cL>PNPSo4jQf!Q;e}Zou0gttgDU?^^l!}v{vJ`-{AwB| z8(8!GV2S=A#eN!^vj17WH~4a|??JzUVB*`d@6xdt#mySCWZ{F%-wPTKGy? z9cV_Xmhu{WO(iw~?&j2?!l_akE@c$56Y>xI-5OT*t)G2<))F6aSItGN-g_5!m(?3> zegI2WO1itO!$KA&O~Eae-^%l=Sk0)O-EZ@HR)6vG`5Eafhi!$$)#7+G6x=9LJ~$Ps zQ@B|8-}^ak98JQQ$BILEve7yU4vWN&>9l6R4J+5Fo+Y>ghIEnPgs@z0J_R*O{JR}Z ztP#kM`^lXBV~_DxXr4)y&swG#iZTUbnB4~EZaU6M1>tyTq9^?~wiB+m zAJ$od?>+;YII*3sR*rZQ^PgYgYF%6<$Sd3hMgfkdCAvt-?eq<89usX^paBLYB}vLL zNHvbH51^7lQj>1?QgI#T-};L=_U-*o6By~UQ@$I2v zXCrA9YPU|3nN8Xo=d&=svzfS|v6;9dB1RgH95ZVM+UTdGJw8jX?_Puw^f6OW7(N6I zWfsB=#c|AVuagjnKb zK(Sa#*`n&t20jKb%sH0mCsM`&o@Qv=s0?9?m|`@UWHnsK3{cAqAI_PiibduhipLZT z+NHw^61WBS3SqzK_>Pr!mB(jX(syr{A$#v=X6-xRx1(}<=SHKpadDV@GSH&-#Wc_m znAS^QBqY}4&Mtxpl%J5%IPvA{U1@Mae9PIunMUc{=3f_fYV2n7VqWp*&T|WSd={>J zf9%D)ht37}zPK+kx^|A$0DazzJzOENyUzzG4ZpS<%Jua}_a)9UK23B1ysKnZTk41m zN_<2OGe`L1*hfq=4vSW4Mh^2#)7LP+=6*^4bS%}W5(O&q=e@*!fkI{Za3Z7u-%D8K zxR~^c9iK_-Ee5Z1NyY#gF%0+>ozb+^qJpLQWf?e$$va;?NqKoX(U!hE_n!ibhJi zV^4U`gVN6!n@OpV8Af3Va5GMaSns4f!4tcmKO0I zwOjJ_R-pCOGxw)!heFH)du3~ezqrsqZ`qLM&;AFqR!RdOGSN5=_mrI*r!pMz{(QDU zEYK>4)-xy}HL;CAF z22dUDH!E&VK-U2g`I-vHG!L?;YDn8Hi{;we`XlQ0Rknt%ua5V+F+D_tq%_!-?h}CX?=>tMqBjF4+L3cix9R(?T&vxq?ln`-mh$$EPieU(r&(n z=mMO}8l|u5S$^k?cpL*qwD#iJ@bc<$r5-}#d@w@nLFXhs^Ir^r!B(1JD#$?%^H4%p z!rX?m`j~xQ3&ULr-=h`B>0b7#A(75cY#>S??L?ofSy44bO^kqYebi2JpgI-<>Tk)2 zfl^~QQ{Fq{7vgb)IQgEd^WilS_~IJ!oss3|p{yE6%dD&kRxLd`?jfxgQR~BnE$c$0 zU@1X1qnp&!nj4kf?{>td(8JL?AmQ24=t8IPWhhc;E7{;U!E5*)ZFRWS8jV|kY6;G? z>UOMP!mu45l6e|4)a4R-So5&t>>J{~eqRa}&g%T%I>bFQ?jhxuQF-GksOWObe?`xtu+tidKd<>sxAeGk|y*`Er zmeo2A70MPPl@?}l?{;JUpD9ukJAvaY zDw~CFPk3t{xo-_vBLz8n zmMXaaJ87tVvrvata6AGwtuUxE^4`Em*Xqu|($iD$S#F0H~{4z2v?W%=fsURW5<(<=)n zS&mO}Vw|w|a(G+1bncNvE(0HI z*tI>I#F?A-6Zj$pe_e{i6eN6i4H2yvIO>>2L%2ZIowg_|I2^4Mu}u0(F9-=Q7rCWP zAiE{8gLxTJ=Dt6eq5)*W*f!B}C}}UdRqjo5{IRWL_)eMJJvL23lw#YJ+#*@!G(jxf zTOF9P5H{1pTvkDK$YhSAHh&@_E^x%Z&F)(Ca*?IW)l>3MN;MzHwRqa6yVBkF%{v~o z6GTrXfc%HkJzrTQ`m&#W1QU5alZV%Oow=a3)hqf==j|EB)}6;~5~Q<&KG$<}{MsnO zfD=IH`>$jq^u~$D0KNSiOLEnh@A`VPD1{iNEbqwTPP=g&N}JBIUFZl|S^<8f~I zn46$AnVXSo+!~v(3=Wyd6DMlDW3R5ACx#=e*F+@5#yY4~$}|aI6O|$ZZ+~QFf&CL; zw_iY6(tSBi5-JuapEXDmRqrhx1ADT)m-g#yt$NIu!-DO zaN-aT2AHEHzk=lOj%O>0E@S}x*d|J;AHOh++n@A;&E~o3yB4+E=q6JVz1>n+uo7Co zJBnFAs0*GkI_jTy9vT2gXMVM%CI$L&bgd|A`NcFxiIS-2t6UPEo99~g&xh11h1L7V zK5mzFi&02rg@GKG60o;KdCgV=<|GTb3xR>n&aUu|opPeEMM<~Okuw&;oNtHEI*@$A z(vx8cU&a5gIpz>5`ro@2f&o)Azc&SjWOD8e8#UiiM)-pad+*9G2x!6QhePufyu(-h z#p(zefdd+qtxx6=$Zt|@G>TvxMAw&B^a5NM(;Xz;fBo^%)4jwRuSqscR#b|lw+@tm zspKy2Pj(#T$-BEa6+c&E=gqht_Nq~JwF6#gj)Y3>Z0cc2)7Qr zqb_!^cSc~7YHOy2-RaDP2&}wvo2x!5(s_|g1vo8|-#86%i{Jm

0}$`-{_%3*d%4 zUZs;_X$4o50((XF-dz)+`2pT1dX9xKs(VlY7G3vX^iy>#p7A|^$4FFT9iOaneLiV= zw63}&JUP`LkF$0S8Q%nKL_Ilo>Me)U{l$-v`%9#K#zx&ynrYKhMv15aL z3nlS)>+KY9D@ES4ajnQr&5S-7oQ+#&LSLxx%UcZ|Py8~QH@3Ofus;aKGu>@QqS4F2 z`^4mNQr;L&nGXTp%GwQ$2TY)q^~~MoQ(vmMk+bZBPV?`0D@v|->t5}OA*)rlxx02g(J0nu9;&=D4( z8cou&)}TrBIFZO<02dq4BWeWJ{j-YSg5k`gn;C^>kkWq{^#I!@T=niN$`zqjE<;GtCR`fTE}lFoW4J` zpja*towd~wEif|C{55xzM^G9KFHYqcV6?r_NN@y3+vRt`L>d)zO~^Ol3Af5vvvh8H zYR^Zo-m}7$Yb{p~y4|S^@8-1;7u)H)k&?2x9p;C&^snu88Hv+6dsNQkqknO7yz|BW zdd9}qLIp;jwa@#eArbJBQ#jc*3<&SkFD%lDJf>1Lc90_`g#%Cprc!a@?wb;=$iLdb zrd|J-zIeXjhc%3~XaG=F2#6X}uB!L@KRyWJXSL@`AD{w`)1nAbtK3`*=UrZx5MQqa zpJnD|wY32HuhW%LzR2zGTCD2zmRx8BqO|QTy$6>!;mw7SIn00=Y0X%;wmV2q2*u;Q z!WNG$E+z%3Nj;HyRHSGfm&H=sm{nK#F%~s?+K<1seevw~gAQiyaPN9r_?Q0oYO0*# zJMY$olOql)+J|$%BY`*du?wZNs|HBNV=vZ7A6m-F3^}2z4p`%32IX0qgsS5rGw+0D z+1koGdoTYL$+e@SuISfxR;I54L5$5GPhU3}YhP(~RfVL#K1$(F=p0?N=Sd@TO;r zS>IZX2E3YDTmafLb_g=SlHpjuMg072FW1cC=WtP*7!VOy?CGa_&V5rz zebvulJ6U_O5pfdE2`28AnT5|rv`r7#g>H&(b!dDnG_{`4y87N@T3OiHInK;HjsT@4 ziMMQ_%M96!s!{u=8S6C9+std1k>S;Dgb?$#@$U_ z+Ia#U>)3yrI!2(Qc*9~c$PU=#8U5JD0TDsddR)#%z9^%VBAa2A^k8>O!A)fYMWjD2 zKU4#*SVN3c;dCsmD!OnTHIgw=N2dgDp^?#B34nPVO{0FOzs@*;``I@ZY>Dvf(5~mg zeY|rpV$`U&U+?HE7ON+y&*!WWQXYHI?>cKyDwiAiJ$Kgr0Cf7SU ziQsX^X$HbGPDUcSm$?y%{f~^XMRvLA-wac}@EHbQIqmGoHY_nJW0sveCpEK3deOB3 z73zi~^S|nGXr!lm1fu?`+x2O1Oj!T($6-eJ`%qUwoBc-CHuu~ZJU$nRckIt)b|Lp2 z8^VZc)tBF)8{i6%Lw7<~DTyYBqoJnwpD7PtL3^Usg_3VbbGcMZIk` zeoU64Fay)20*R4JlC=N@N+TQWCAlm-d(}4u_QmalNjzh-!i0 zFr5F$t?g<1b(H}5wuMqrZ>+ndvV92#pS7-~XDM`w=lzFYx8|7FFYPCquf=9PD>i`D zXQ_jQZ_@O)D;RC3!wReNfDVSoWp|D zek7$Yg(jC={slW?iRA9Ob<|d*m{?k)2gER%3o~*9?s!2{84|0i*4JF3lXd^qRIw7^ zvG1s-z7bL#w0Ccb0%vVfMI;ak9!|QhwtFsHc6&B>T~{%NK9alYbm^UDk3)4`XNWCd zFSi>udq;sUict~@ z;!n<~GU<}+f#Vr*-{eqPa-iAaMH4xMGW(rBt=Ms3d^|=%W&4i@7&{x-M^;(uGx-zvY>ENN^Nc zg%r=y;I5+XDmHBY8#{dE5gm?67(0MaPALwKf@Al%Ed~tpjB;;@B{i^p#}%x2=8zYf z0R9vGpIWn$3cT_i*W@?#-*Pzs%0(S07j;+ft4G$zn-QbvlezZneevOWpN*q*#?*sB z@{~_>9#=ss$h`W8OBl{qO#OX8{Am~#NvJYG=5ehsmsZRBw+i`4c95OLCcop+V&0g&@JXY-@k5=8* zwpjqe)cg#v^ZDFgbQAu=8d*K)PK#3Fjk zSDyZQBw+L8^9#edr|+maiAdY{O@LZzhNS@|VhGz$KZX`Bnci45{;mYsmwEO(JY^xz zx}n~lmXX+~>^Jp3;eLewxEdB~0VaA-T3u_+0suUM%vWo^@UNb?JO@$qwYys`TWC9N z?k#3xG5W^FyPMw7Px3_W@xG_8xvL0*PkrWql>=XHt%&B21e+Enhjp{M=WIWJS7Fsi z=Rj9!(&$9&=oLXG|JWfT(Nsq;1W-&A4{QiOs*?*QKC*%+QHn}!3a1KywTR1S^ zlOn5@*Ck#8)wx-_gl=H7aENHi{FM`4@PIIHzsDK#>w#TU0zPt` zSXy$`XKu5tjtF<9-5JB;EGVy-_}WF}-$KUUtZw`|R(C{XmcJ(O#T9V!mF@srfcV;s zeEtlyyt&W>o(SSPoirU5(@&&(e7v)6BG?3 zIw#{xj3UXRO&qq%P4<6yr$=zfrLA(AJ0#3UNoe&IkVa+_!(0JcXX8Q5=Kt19_}m8b z0gV?;$qnZ|o4gA57Ha&A+Uw#4HL=kE0&BR233f;j-9I^%$KnsTpXUkRVUuv}QF+oQH$qo5nHtFM)CMoBp^Gl2>&zTRQ{_CdT_;$BJninhZPTz^@G7Jbd zO1GcaN+yeAQbsEX1$Cacd&zhY6qPi$=0v)h`9#8IxUU^F(#W~0O%;3u-J?|fb<82( zLU`$*%3I3gWiEj9Mn$X{3ovwh>3leI5Wo^<6B~%2mYJQ=Ve?>TFchd2(R);ywCCNz zH4ylR!*0O^7`P4trdhoeW_C6oSu4LhzC?`3?qjh&+DzS`OEqa;-;#dXs=axrVfCKX z66Al~azEyGVy`$Azly9L_?g_=?q$8)Cr9&;m+|0qi|M~;=)>OT{LajE_vc$-#?HI@ z6Ku2<5@K(T+#xZ%!@zK|OkUuORh>$yO#GGw@m)Fh z*bc_w|Ic1;K!MMrEKt}|9k6i6x%S}?1q}Ji&OMyfHJxuDoAg*T=AO^+o_6AfzxJe# z@YXKPf2`N~3_H^7y4tncDHs&Md&+s;c?|0BCf>}qwim6Wz=~7$`f}drI<(~0f_Hx% z*QXSV2B7C?=hyeB>}yv~d}7c@Lc%HZ=C=m=YZJqTp9jToVq(XV>T2b<`+~ z=;8bdjf1eKw1#cF!`tXy#|*^Y;@G3RINvc1sX1aLEKqkz=u9ZJ@S$i%E+wC-wrsM@ z_&zz+)rKze{o#`fVOR|=0~${>`B{6j+$#@)QA5hE&)r!4`NvVdm2M%p7t=n2rH$dr5$FXArA zfv3VCl|aZ`{#bx~;Rmh{N5Wv6ZRBu@&aGmg6?3t4-oihZk_F>}ses>r_);;gAd zq9~(X4M7Xc#A*)@JlS%_$;9r1j{jB({X&AC5e{CFx=bL9?GF37A` z)WRDj%eOf3akMR@yg-1E_Q~v8Sd8&HTPUt)i1Zq+Bp{0Q3(Q-iDz4{;QCR-BI6q9p zG~kCwyEmy(qxLMu4(ecfiKW=K43Jr{wf}A$js^S^a|g+n-y1gx(?;fhHEgg&W}p8N zY2KM%z98(7YCe!+OR>eZeRsFGB{%&Is&U|cK)B=a>HH*4(N{4DB10sKPgx&~K`&^$ zo9vBwtOo^;C4nLo0dr%sem6}VB>${bR}jYH?J8F&1T!YIUD?zEDuN3HkN=k^$s#Yx1}53^Q0`Jc${ZNI*0jKKk?% zL?mlGDc^IqbD!b_PeyP4m9L4J&dqA)DXUKP6}OSa00o0*V8`Mp`EpGhMzA(F z=Zb3f$Hv$rk;ZaP!4zvsAE*@yG!vbaHz=R7Jtf6|&1SH)Bm`y}9JHb$(4w?mT21^A z61tW+`r1R{s3%!tj2mh{DXG69g_?<&q7N@2K~)z^)W6ZHLBiiELa=u;@V)%S*JIbi z)RP=K(_cL`LAc9AHG3R@HGaFfN2)|B+2_j*wD=dm@rh6Nu}7<*0q%0A;<@pmw_bvgJFp^xnKd~+@u3}{+j5nygcu{%94=r;&phcO6X>4z|tL`e$CG{W^Z za6sLqXEYfw!7dUaEY9$%g9epV{M-G3^amBfS&hppI%p$?$W@Wi^OJUuHsgH^d*X!Ps4$4w%|!ru(tKg_Ikew&*L;hg z)(A>t3Q3PP?ozk~wy-%(q$cXXd-zR0m;`D##gqo%kAI?|xPxK0b_l1*`|>u1FnIHM zlUVq9bYJpFBD9O8QW*2I#GS4eK|4>$gJm0`jD5dF#vgm7qtN{cg-&Rt6FgrV$Y!v4 zM55nvgf@;yw0MJ7x*u*JkChvP_UyOPipW%<-h&n?Y&*AjcG3hx2z3bN8JNGoe+P61 zdlkhJD5~yZQMue5aaSiVQ#s#Td((RfO`nDDx$){}&MTiIUmQKThQ8=@(7OZ{cL-SY zJnT4kB?emiEv@m_@U^zYeiyB9P}y=e=RkeKC#=RClad^)@2riq=M9s>qVB^HG_x>i zDrZH*zw+(X4~daME~&Pab$7-jqMkq}`Ir!moa*?GPE> z=S!4-^n08EyY)^j$6BK8N#!y1J8%NE44EScF&6)#+8d=a{^HhME|7`1_QqK-yfPfdUX^cGTtBlY_%v6R8D6TrtLFPYC&W{%mF2hSI3FJKUscX8K2S8w?-*>z z)%G8MMp02Yb`Cw~`~K2m^j?GZrL4Xa4kI#ooVZO*uuHtA>ELnI{VN;@8M4R-Sf<_U}t^u;qLUd|<{^FZGV>c{9adiA5aHoKgMiCAI* z1Hae@BQ621EzdV`4M0boieaxs!gw(^^MGF3yySudbJgt~XSMLr`Vk)dK}GN< z?@@W~NmJKjtPl8yw2!bcDyZzfKU%s}eKm5y2nX#6XDyE$%(;-8e)IFO#$1fO_Ije- z?&fZc5vH-?_9!`tASjC4LavUhlIAS8T;0SggLY!s&0_ z?KiVD7HfDYr11VEFYvM9^lD!|`X=AC;_u%s^m^&B7$sQfdNWsPYxu+S_Mw6jT(<<& z`=?z~Z97?zC28IESDlP65X(IQMM&7~3`7rB#%V%#K@3h8KE=)Cb9C25E0-RMSYdQ& zcZGUzMxdnTKi^sl^K}6ZT`*fdsQ!$QmiW&-GC?4$Ggf)(!y4%f~Y zKs{V%Bs>nTZLln#>XmD>8E+Y%1B9E=7H2^aVz~t>s#TWb$Ek_lQhv@LwSJHiAne0E z!d4#}?~hzeh9}Vm;`dWc@zLVYN5G$n{^&D)51JadkEGu+oOs6`pVL+GL`E-|#gNr= zWbp!=m8@xp*&ZxV+N^s!4Ys4&lMJx+B$eFb@m|(bCG^ps8Q>q<}PsHmK_B(lU^8l%1hmLsq z7{O$Kw;494VVoJaOh%nr;xoDFfv*m?9>&(--Y0ls?9^j zP+30A`-j)_zDUEMCKE+H?Ax_@w*T6GxfJBx0t}^I?^bfdu6u8cbmky_Mti+HzEq|H z`#6+*S78p-#~;$XC?uG5SHKC0tP+UC`AbpUUY>a1j^x^zlJdEp)$a{rSKc!FVH<-m zQ-bts_Pc9e#_jl!X&zBQj)-N}iw^5R#p}Zuu8~DC`~8uX#r89(ANCr`hu<0gQB-bv zwJSlOXjlOhV*Ah<7aX?JcFs8##nsr))~r?m{Q7Hd6~qmN&zZpa+N@|E?@Fbh&AMnd zg8@bJ@XyX6^>mYhdoY|_IO!0fY=W@xVj9}$o(-Bz`;RGOI z%)Ec~i4F>NWZ)&@5(f-kFdt^v2taEfpq1_o2j%#Bk01!&PJm@1-Hh5{cu}BY+qi>%>|9A5&Ky7xnY>LAs<55TvEM8)=Y|2I=lnIu4{$ zx=TR1Ly+!nX^;-dBae>f#GibhfA95yot>SXe9!EDd{xG0k*6YYWaQ@#d>DULXw)Eg z&HndXr7!*EoDVH~k(cWjM#8>+375_lbTKwIcs`E)IT!=T?PHOi=49b=grS=+X7;L@ zYG9o}eoSa5r4v5q3hdYw(Bq5gy9d@xuzXP%(7nGKHP%zQdr!%Cvb}J7@{oPtkeTqR zaFH=wMxYo;CDA$PY~-ul`jk`? zYL_7+{Qq=TH4Hv;D_O)Jon=a!b69C`Pg);Neaq;tiu=ua7uIW&;-UmJxV8a#voV*` z+-|zf)f=SiYE(ZqUbA33Gc?*+jd#e@>-Kt@vVXU4)Zz70AW7Wopc}E)nC!d1M;-&D zgGt;}9?5+Zh0iS7(J7hFc0T#-%iH?!HNIzAK}TP0yb5x74UrXMDl5LeE{#)XRd?^n zwN zFAPi~^8@yEPeBm*D975am}1wQ8V4jM2K2JXyU}Ukuf^B1Dxv`TbyjFp9n{ZwOf6Ff zNU=U=eRD}=>E$5%XJ3@?3C9CY&@4qE{z50d687dPNq>&X)yJnQPix)-yQS}Ju<-ZW zEp4OdvS|8Nt!y0vtAB=ecWQ9}>Q2@U@j=Ns12Xe0AE9+aukWYU zy*zHgoqU4u=4lTeloGC&4Z>BH%tF%~vBureFc;KO(%Z&-4;`DC#lwyjtM`+{@U)L3 zx90UQJJIA=1c~08@lvK6^v&rZ*+!k=#b= zsm|tEgV&B*&(`FjmYbOOB{sZ){FYbRK0n8akyuQny}uVpugVd0{()}2g8YzdFvvni z(^U)b3w9npSEdS2Yc!RZ#9^>p*D)cVrBAt#_N5j3Ct$hKEMHOM2$h3Wb+bl#@PbiX z4q#S2t1|~$#EV%R#h~bfP+xRogJzfHNeL_TKwB$WT*@QhS>3(2t=D_I@;w=+RnYg1 z45su&K(>#x{2TjneihxiBuLxWh1=PmAQ<4`zfh@g*5M?BWM(phR-TAX&Aqg?7uh;Q zlF%E_icMmHBC%38(%DNr_}l-==NunTptd0=d*nGQ~l=pgSi zQ1b(*oaAc`H*?)`)5zpPlh2Mlw&uC&aXkY3IZwM2Sd6K#NfcEaDgs_vA59XG%Yo}E@-5%Nj^H!(P<$7RP!5bx+Tq)c!*vP*x~1GRO$ z31?dsG9Lc2LXmKJr^o-0IPY49Wk-q=-%gflH2E*4EvPqH-;cE|p!4n}f=7xFOd;PX zhp|;Eadjefk+gDo6x0G*B&+bh)1nYVXKC9EN+wa8t<4VYG{;}KKZ!c`oI`9za+h2L zPcIR>rPxESx|!B{5XI4#=Up~zt;}0AY@jl1&dB+IP*Wc3>c6{YX|fBwn)D0fICn3#jzj6n5dzlK@92M6OEnkn z?Cg4(TKL$qryOIvk!yY=(10yp|23aa4>I%jLcgTVygr6;h1u16=CKFF>@lEMa1~wB z`|Wa^>4-k2507n_W>~|TlWwliuw$0^?kLlg4~T)yA|~x^%VXmTkNDSxL&7JOV|km5 z0hP_$KXmRWFmmUzE6R&f(>>dFa&9T$DcuhBpI(y2hYA=#gNEp(-RQSC56#O~96iM7 zzew(+0l?_8y3Os;G|+CS701e>W%lLv4BflrcTL{4xAowwE+U;45Hrfln;Vc7*?r_D z=~Q#s?jti!((Ejl2gHkSST#9dG|*31Qvq9&}b+* zEEDE;=a|Bt4DF=PDF`J7eBY1(G!bzKRhn<{misgA{g&y8@1)y4&)ciwlUlj?cmN+O zhg{|+E`MNr^kn(bifwU{_t>(0K9nBp*&L>zkE}zW82NIN8DYW7H{}R!W(3eTSqHiI`{pFST+AjFP8Vez(vx~Ne7ko(# zwc^+A=>33TybZ*Ce|l)=_DiE+Z|4*~b+kSmtn;mT9xU$Y(g$!PSKdc~%w56-VUz7$IXF(MAB+>q~_JvhHiEPK707mH$ zO6lYagcR=>;U1#@g3&4jB0UeWmr=#m3v;vI&YS+MZOE=xpO)fLy&AmehrY`XZoeG@ z7E$d9A{DZx+j-e(5$^c4YgFiO><{h_h1_DxEP_8qc^=~!yQqe*b^7d~&i}3WeL|hj z!>^V_>K`TLkvsZHU%|~tzfNPI%cY+&%w2SN2MiYMMg zk1aC@FAxr4^82JAA$o0f79Yjm3Xlgeg*&a}sq%{f_HndH!fS@n>U3PgUzJQ*6$-zH z;-*0E5u48f;turP%u@w&$vc&-k10PQfU1T7OSlZaIe0N`^Wq zT#qVQ>UD8j7t}hwi*K2`aD3JP5(W*#| z*A(`Yf!@9B(V{=6&oO+qnD&K4)M=#sH1(~v7wVTLO-7Ef`nv_s=8|2R`(dX{15VMm zLA@L#(%sm|X@5a3hu_ff+n=>%7al+6n_)SZcQo-7m!J7eJhc$mE zd^P!uAC?Rv{zJ~sLvk_f1bM=RKWxVTw%`>27pzXTNBltx+$xGbqCXRmo(m zYc>=8c0(hCt~GHSkJM)2j=v@I-rrEr>^}s0gn+@7GTp?Ygd`PR8dtUF8bUS8H2Wk5 z2{<6`r0HO0&S|9tedv<#xI%{{p1;b$NBzQ9vqgIc^ZRAVgU@n!_2Q`Kwtf)Ik=WNC zXCF9G-U|mEW-OPp<3(7+9!W%QOt%RQfG306gqQ>Bbx=N;Yq&C*muaB6jzO|rnNfFY zDVme6k~dGDeIy3{t}N@%BrIut95}WpHEF~&j)^2^fYtg+T?B&r_AKxfAW)FnAS_1c z-*w7GWPN+19Jbs@Bl`YwK|vDnvJ>6JkWO?Q32I>5(R*U~rqY-BVsYuiNUxf(P&3cb zsP(sT{7dM^Mb7j7J3&?L)z{%3wqUV~g530|>nGuoR zvE$Z}t?PrW#*tp`Jz=)uw)cA4%9eusav-cwU-av1n5^Rlb`yj@^|X>PRuc$reGI9; zTt1ayi_IXVLJ?GJ+v%qJX$IcUyjXbbbm7Zx0ePnZKe44(eU zYz1ru>+)ZRK(K;+P+zZ;K5}}RFQ@NaAVeN_*Wk1<<1J=1d~vPf#HbL;&P88gTEPNk zhYIBH70#@OHnXcBX#b%kk5vUiNgh&ud2~uN-=sXLH>ce1YRKbb6x#@8a^V3|5;lrn zaYp&ic!Q$68fcXyrS9oBiTQN74Booef3nt{r!cZAQTW5Zzn48$>Djb-JVp=lIV1c$ z091Gt#OYWjs{<$E&O{XS**lK71_8_!ItOwjt@n*f14(T*ijxPstX_)S$)?^V`-mGY3BD3bB?N1@wmvU}gZ5?~c@O{NML*-sE0nm`gb3V4bB%$)#vZYK3IjuX9_*F}4 z=o9q$KYcxm?%NbG_|YY1zv3N_tB>jbh!mTRbIMc@UXJQ3Gj=?jBu;%KPx8q0p5x!A z+V<$EXhYveIO@9}wVt_22Hk|~HF+v4@)3=SXA?hwKErfHl{jZx) z1rOsx0RO=D;%dn4RnM;^1`LVZAb@i_4<4DU8| z`Uijd^x=?`+WvkcHzBy|efAy(!}80^mO}xnXoql?&!{k7QvunpJwZEidZ@eHJ`5=bgynr|^6#<$u7Z@FbAD zU_+j_UKGFAZx0ht{}eo>s1?(nI&G^P(mW$&FXHnhM)04;qd-BAZaGNoCsv!^EXtrq z7KS8XF#*JUNrPjvyc%hz!kcD?_l@)PQF}r^ge83h@PuotUj?}e){mArgSNebL7n8|t1ZY++Kc64M=xc|)mKKKwS>&_0!+kd61S7vOtTe~*7| zoaDu8Uypf4$iJz!ylun-{>VS3(89MLo_w>?yX=9hm{sFVDA9I2`>>}VD5l|kn*B*= z^|EhxVen|k+j!<0T^J=pM)sj$lEQIhJ2|D1u5w`))V%U?M`42qeLYRwi#gWX%D&-B z_hro;5rB9Y-LuV8&mQoY+20;xSQzEO%9F@L;r+Kdf)#OYioZLA_^krbe=4bU>}PX` z7Ez(5vWfCNr*x_&mjtC33uJuwe?9;M0jc*qV~kL7^{(c+-ql)aXH?~}1I^nlj05wX zWe;#I2>$5f8`t1(uRL~^wHw@JGZ<$giHEG!p+=fmW2GL(se%qirHP+Xg?c^GdOl-wsrrJ_kuNM^;Oz;Q(Q@xNmtV4F8n@S1tp3^PI zU7Ud=hHKdxp*IMN*BfFS%*DosJJ%{NFUz=(ey-Ym18s7KE#`H9@P3`Bv!C5D2^?_U z2fZT#W42np{87F)*hZ{!y4w-h$}cwfIs^)TCbyLWRFa`2_!Jr5M=1$X%-<<~^^l== zOGg|KC)_i2TVu}*60PXLGaSh!Wjc_lV~^N-b_TC~eD_T2#leMx`S(YEd1JB`>@!zm zuDk_8pz!jJ%bG0(=W#8EwGlB@?W(LqvL86XoCZ~7Ch`ds7LYJC7ol&t-nkaJ-V3%a zI-c!gkQo!cOVu<^p)Kcs{1Q=AoPGqh=oHsmbL~dC&I=#n$KZnYjW6;(~E3w~m=_aYiTJ-f?!;`uOzbqAU7jCVUemJmmroYN$ zkUl%_qY&`g6?~wLXZT)k?>F;1xrxFDfvWUqcJJu81!ru`)^=COl@ymrPN&V!S?Tmy0pH}l^v-c3u+x# zV%Y=M+;gc$y{N(Xx~B@tqvrPE`+cbR9*E0~^UO`dZcQS+sHVPXDceD~`*5EtOm8V9|Y^sOuS^CYeam?sCm&$X{G7%ivQ|OgvhFteGi!Qb@hSe|!b32d-^X z4Rx_SK(%QxeV}a(%kvsaYSNpwZnbRW_#mI8-*j}|WX%Gu{Hk)Z+r65JYTy;I8`B1Z z-O|Ed_}4E0vlb>9zh|a?+mbW#A@fAEp%s_G?p|{QFtwR&fs$e_1L*Gs9_oG(`Oik| zqrYvrOZ*D45pQPN)YQ;_YrvH%nlI*N9s?bDlG=8wH>bVabry~omvpThf6UrFF6@MZ z5WeZPJW!=<53Ds&P*pw{ZJ( z0^=jY;Hpdryb123V1E#O@=*0Zc3VmL2~i=h^XzqQ z*b{{y==sk`uu)RBAZn4(RGwiihP&wL?ADFOt?I~{{81ANZWhVoXAc}z;O+6LHn|&Q zZTu^BHNkX!Tox8^P(G?$e2Xw@r>W0RHImQ`*@j)RyJ?Sli?$0bkh5LOhTY@wGIB<& zan1V`$UGXr;-Q{h(@-U!j4Ky{iBA>p{CiC%JwRnrUp(7{nn!0vRR1?{RFt43#*Ne@eg15F6Tj@=&2ZXVG4h?k ztry=f9Ar8^8hN@GO+HE|pM8p`&u?Aq>8)0nvNLLm>gP%9zCn6?623P!6^>NiQ{v7V zdxG@wQ*SpCr6<{TWeysb8K2$kE^ST%*sZIV#)wIw|Z8O|2Ao2iKJWT#JBx z%4p+j$n_-tFrt*z;Z0z0e1jQ^%9*6UPr>Vl(i{HE+_tv?(XCVx?ZWio1;u~u*p8;Y zuz-5;7e#|Y=u94NHq-XsiGMCYFQ-AoNJj0VU6gt&msrI9aK3HKw(bI14n`R**f_K^ z1uozT8-JDz$H0Q3iNRp7KP#fm-5?}DuQ|LQGRnUDzUi}%)Iiw_L_Y4i_g2p>%7Z!;NgNvAnBBGsA=k0>2=V5@t@!-Vo=?CI}Y##V5bbqrq;Q&J^sw z&^mDgh06AH0}%&5T0C2-{eVE$D9!ZH2*(t22E;H`4vD?K2JeKN_H@$cvQh}XgI^CL zuLwjbigrV^?vHPDo*`dFMD{SH5Wi~k^MKFv>w=RVG;c2zW+_)}gns~KSH3lAy6;Dp zt0>Yonqr(Ofsb_2>cCN#9?%<#52wYu-|BVN4z6khN3iqhXEBRlQm3(lExT{kC!It; z^GfWstSN=E7a;x#MXmcg(v3dz_V}&hyitsuyCj?eXmzazd{Q?T8Oh;6-DqTdG2eX= z?awRm&#BIhW?#iYp>RBBgIIzb8*u=Dwg1wz{`aU3Z6}>7+pCaw0fReztd<@+1ZXvwmg>#{KL zmh#c8o`VXbXhuGgA|2^(`dK~_srvsCwBi+V%BO49{joTXq<%*8RDKzMyd;+5?o1|p<>wp4edF+xMB zgrld=%sQ`=D!|BlsQt_dXF5Z;K;UKrTTrPlY;X?rj8=VRQhj@SK^u zGJ<2bD5f-^&vG#ALu755yb1Qb8SrtT$iwK!1zAh|2{R-w~1 z$QG!WD9H3%b_4(Rt=xXaaB2_=HK<*Zccm8y}YWITaC@Ra@yE;N*Bi2}p!b&g|#G1G4k3tX0a)LQ=P>#WTGzyiD7 zOM#EQD0{*y{Yxfl*r5EOg(dk!irx*4+G|0ri`JX6EUx|A0+*#$p#4u!euVSlNLoVQ zCB61T40`TOu)-UX$fou3!Z2G_jS((n(}U#HCvwJ{6V zoN+4EYd>3{5cIHpPnlM=VWm&}-#DxoE&tD2NXYwGHCSr$sR?x9!yc~ zicxSq)D{*Q&(ZL-msXgXUQ^BgiUcKk5<1y8F0ymlx}Mi%TLh8Jf-kbZYrl?lHR&oS z1r08*{i&f^IrlF^+=XeR3ns;>Zr)OqUW#(X^%LJ|=U0`a@+ONjgGa4knzEv~KOY+Y zo$#cNj-XE6UnES}J#+>^5y#f2mQ7phpBZGo(4{ZlLu6mplnUmR)7s$Y$kuKCs`7J}IG5?TZ@yT?0lT&#@4QiG-b|(l?T7K* zVE;6i{CKED<_+=j08~5dnUbG}r=Wz!YD5c$?KBV1A_l%8*6>}%@zib)LXwP(sJra{ zYvb+QZSUmH9qTWCa1_WfbY*p}FB0qn!)QexC>3cKn2+up-JTGWn`3YjPJ37>ng1%K z-?LB(NrQB?mejlJBX}mG;?|Q95$s2$5)b2bu2! z4x6#m0M}sP+c~A`>nNyB%Gsr_)x?TeoP+W?AzQ8eT0e1eA~#C6MGP-VU^^@SO|7|0 zLceomCygi#J0(#fx;^5fK~41G?{`*T3?k;2=gcLVHTSnWZ`li;U2VAqw-PQhsq;h|%*^bV?}F(QR>Pc~+eUp!>)P~Ru)wjz6j*Mpf_{;uinr-v>lQ(0!4 zH>)RoW5o8Uk-zLXTfTe9F4is07TbeViXJb{ntbMd=NF6#pKwgqhCXmQZc z%^6u!XxVtvX<{z#t@u+Js0i;9Gi`}8j(@@n4W?I*bU z+=jwp8f}&Nmak<4USG{v{X0p)Av!${|*Y$K{bcNA4R6&p^q@dlJRcPqSQJF zk3OkYuUV+_X2w!8Md74z$-vGly|KoMKgqj3z(z{By49_=TB@(he zsO1a-53XgZe%ZSUhFy0OdN+hhQtHikE7v68f$2M3Q&V?dv>Q}_S+rW)H_Qu$3k zntwof@<-x~KhU?=s=uB1@V!5-H)%NOy8?bJUIb(sA8_as+5XoP?c1M@zLt#t95;$M zbc?c8ms)@tuIa}d9Dpw|n)<=bx$nBwUIL`w7iguiXPYgt*-l{R z2MH$M43V?N|A{5Bi);*mls~CZG?h8X!u>^Ah~dbFOevI8a08{w3c}*b;oPX99^tZ0&Pwy){)H(6juSlE}wt@E3@nLXvy1M7MbeP_YtPR5=XTm;kjhT$j| z4f^pd*ZJ)4a;aIjGnc(kdQ;Qu-}^UEocqaVi_~Y(^i^_#?sQ*yDAb`POJBgs+(+ao zN(}%QX@G-Vouk$4l5@#f&xD2nV1RT#UJFCyLIQ;@c&1DEpkw`=R~TK?I-JtMtdLAU zi;}d{FZ@(|)xzL3c}#@f)mbuVD`{*q$mxtBQ3_ipi96cYars_e%^iv&{;ks%mxc8Jm{hpN$m?)bR%ovmQ6N^5U_NW`6pbvX#_>@50L zAZ()(;Z`kq>zNm)hrV0Lc6}d})X*d&mwwc>sbViA7aq3iOV??q(8y|~+>l@Ky|1=$ zejF<3x@tHPDz9q-m1Z&WMrR^8?XUCIKPp3B<}lLJynJZX7H=x)4bV9mF+!^=WPKqC z918``5kNzdoUh+#3rActLGrzF$GS44yixn{(}AF13WCBlR|?HnJ@PnLT8zs3U?E8D zD2sIk?r-hr+P&Qsu70Dbu$bwbU1{-KRz>5lxCe3-VE(eXPm(>iII)sJhChO*o@=I# zQMW|Zb8z&Ly)fi>!R~R_C?W(3e#9z+gCg6k7y-}9ELIz zL5^75BG~i62V|1N&sifKp|``Gi)3c1YIu$5g|4?MfW|246r$o=zVpzCIGUUTm7Bcgo>kQ355M+BgYxSH8OLp*HemFNOb8uC+#O zulx{V_&wTpdVxpoPJOD>HcqC>Dj*jLnJB{^X+= zJ~`5O^S$GW!>ZJJ)r~nj;C?4rv-BVEJO5cke#TVFWF1pr&n3?*RfD_n4N+J-0a%D>$ApP^i~`X9$zp#OOaO%Iosw!22MQ`Z83J-sGVXJc z_PJq#cTSHDvZ?OP_1g}*kyv%#f_7|n{;k(l!=}22(D4Yvx4X^f{9>g zek}<(6kf1^-2qVn7N-&s51nu=9eCl3|CTVIDM2C7K&x+$C$8)FOIHaOE$qg#sR41b zk;#HAzIY3KmqK=Y_@@k!Yxq1X#k`zcrLk?l3h_>JYMGoCQ6E}~y9&FKloH*?lxZZ* z-OdC2XR{HCaG>eN?-EfQ#&+UfImb)Y`tr3{PcX4iMcILFJ?Z_}Y)~%T?r8txhtgCq z$vyF@BY|gy>@HzC-r=Ixf``vpA#Xu`KF^O(I2&_1)F)p@+n8=xnoAp76+fzmhVH|_ z&-aC`yxT%0`vOKv*ag*SKPwTno61;m;s4i(xjQv8;fow@Cl#oqhFO;%mSt~UOjT?z zxrNXwR9_V=HsjIm_3W?^82-)vl=CMWHqijlho2z& z5cEeM)^J(;RNrPeb!NKJEWWPTq(xc(5t8OhZ@$RCi5RE%eE6fUqxB{ZrJ0NA1{;27 z>;C3RDjom^-NrB=CKio(1`7`+*x;E*r|Sx}D+-QVlBh}H&*UtyO+bs4OmOv9sypG9 z;u>nwcUG#4w|{Vt24LEICw{w8#~&5z^`|r%{3W8tVY_)YY-fyW{j4G8-Jq-`>ixe% zoLxff9_GrEgreT}*M83HxgG!cLD2Jx9tUsa6WB@3h%)uGL5FjO478 zMpD_T*o)x)=-iS})?r-3WO{OgavdB?DmDFdgp`W7<$VSk_pTh8FE1vU79{$ z|Ey9Uq#5n%ZR8i+Be|ER+vc%9g00W^u;h*2dVW#TV<6L{SFSc}(KvlHJDUfAyA@~E zM|ZU_78&)mHeHlyTWPm77cbnbZZp;`wq&Lp)qA$;0H@C`PgQ2q$M%Ic^F0!W@~9u< za~3c5tRJni8l{p2bM>ZG#~sbao6RH}hjLJM6993?17Jl-oa1UCPo~p~Pqafz8+f zjTTq?*YjPP`Sf=fW^7wZgw92Z)snnwL8blJqsj!h^4Qx|Bz~+yRR5XWbUxDIoJCBC z-GMcf#MSUga6uXe8apr+D^|YUN{}T z+i2~*d+U-NbQ34%-4#(?5ak1iUc9n9!U*h)+szuB-RW&YXK9Ea# z3VRkf4?n5(W-n3TI>1B+F%1w(T@2OLf4P_;WQ zP_G~Xhb!ICe2PmO+b+Qp>K+q%aS%7dg+j|HH^u&gN4$X>B%8;{YH{wXE0(+X@VdWC zjkq8=e3Y|1%BbSf%J;F&&2yHj-qA+)tb*mD`=C5b=7%^|bH?lY4%4P;ug$$`X;-k2 zxslNe%62(hdI`=q^IKo8PhfoUlsEtY?4nOXPPIe!A2CgCbi21YI(2=T6Z`6&87GGy zIMQK_6i`_zg9Kj+7#^XPelF9BirvLVpR^#8%MC<~1i;H+NfeQ0lSl-V|BR2fl9i5? zBq)3L0f{6T+Siif{X)C)OW8oBRCl0gZeV@xMCE%;b0WbG$CTgtK{+Bxiu~*SuX`1F z&tCH9*C}Vsxy(k@fbp6WAInP8Wwh&9Ts(!FroZFrI@XL6aKmWV5Wk6oAW#_s9BVK- zM&41mHHR6;N@gq4FcQ$ZOHKp7#3q=^Yos*5iXv{9eXaeRN0f-1%Tcoq%Z*|moMxC^ zImZ0)TA98zno~?4(ZPg$;ciW!l=-Hs$b3G?z7$^NON*9smghnn@yq?4F;}KEm04;8 zp>Hf3B`P&~+AmrBss;_ZNRH zVJT!y9U#O0y!&fc(bT|tijm6qa|JjJUPV6oZd7lUQLo;=JXmNW>3Q!S;XYl?dlo}A zJ?_fb_CxpNxnQH1r7cyJ~l|T8`5=NGn0atRD4|g0XL(*QVz%V;n)mOKb1=ql^QWZ*9cvs!H z{;Dr`?y{*;RhM7-D`=1A+ioU@WM?PDI zrIufVi`Wa`>&yfpz3;>?2n7VB;nDSF6^OZxCUaN{;NKBy4jLA*ykkdKM=!RU}=XXMhbQbP&j_={y|V2Sp#!Hqz47pcZ@zmGu$dsVmixz)i(`9L;9TBU#~pL!Rj^# znYw)Qve|9nR&xEZSTzB2$G>$9jO??&sxGmzNzHBoFvoy=PQE|J0l zkThh7AlK9cOokwks{>VW+d1_5)W;J(O5Fw?M`Qu0X-;zq(uNpuhr#ROgAa-O9eTjDnp2@R1q zvEAstr!6>U&CgrhUP9WCux`i}5P)V|uD8ZP7hX=^Y1J7t~d4 zCl7$e)_^uRuajovfVZP+hn#5t(tob4&J#N{E__2|q^NK@cJ^rGrGzMCgtFYj8IUi% z9qD%-P2%~_CSm%jMI^-LAW`|q@Lz{XX7zFQcg6F|{?!gcbxn3x3t_q7vR`AMkG5JG zXL+pevTe!zxE1N( zhWmcF(v?}bT7RDVs9k}20_5o>7I--&I`KZ|Z0E2pE1{|7U11ui_DD9H>68PfZc)fq z&F%*zog<&nmDZ@DoliVn;L~Ywlp2h1rrn&ydC#Xtst8wrY<`7eGXl9WDsaQWXtA_v zq+a+1hT8>N@94^dMl5MJD;v&bloN{hHt0?R?Gd7k>jJrVYRN=LIN@i0d=$0xq4IOPdj4JTO%(swwiQDrQE*8G z=l+*sLC)n?UfX^9WtmE9-4SiC7-qS{f>L5!+|H@mc}Rv6=fJ%9n_rGNj+OGR!Kv}1 zJc;9MhMDUQm%q!I&0cJsaNVjM>OvSo)og{dSwdOs;udYo*t)i2u285-Q<(_{!FtvF z39B!1ldy0?^;vf6uR8gXOLrvR<|MNFgnaeO<=o~fRzcmi{F3v477-RfiP5Q7e;B}< zUqDt#CWsbGCa5dBvcf)U;wpN<93@})nV4aO1!rm!ze3ftvIYv_s89FAZmsZ=EH>MKR z)u(wa5=7yo>+xwFr-;2%|H<+ZQa*%?Lcp9SD{9aJVYq6s&n=6_jf=ZBfaeY_*wkp2 z>qbQUk@4s^=1W@&gqK!r$#?Z-b?O>9ve4Dxldfp0?o->lmDr7nYyA2Ms94P#H(OF)G;K=(GXUK& zZLfTRJEbXM&$k3JRZvoD%8RhWw*Dj}$g#(~Xy+_N6dWjheQM&t3mu#)&f*!|g0&M} z)lbk2Ls&yhIeY%X-xU*eSpv~bBdIxG4HtvV%U4Ei9L0%Rq^<%J47wg$^qNM`94Ue!Mdo-`bHXbm-@-Vult&Ssdlex zWTSt1R?JhVWjp%_AoV&^i@1=^yhs-Ig??LVS=p3vB3#J{u{O@!5swlq4|rr(Bxt#~ z`lg@nl7mkdiTj1CD3MhMQUWAm^d<7H=i(82AD@MD8-(`_J7Yk= zBmwuY;`Im=kqvA)x3ZZdCrfk_6OZDIQj$OEJu~EF@dyJfR#9njI*Y>s%r_#%R&A2F z)WhgT%4#L!=FX}&-`)FkVBvL^d08W#72Egc8${WC4OvU83#H{22AdJ^et#U~5-mdxhiEx7iSf4*u=#nbluX{1 zGsSW;@3!hS$Ueh3m~hcUzI=8ROR+gv8Zlq};YS}J^nCYJX+38dRPP}5Iy3<2bTav_ zO1oK&@nD;vyEa$ox?0b5OxER~D$A|`v@$=rCfsZ3Jl%1bS$BITa~@~A7z|8b4)e*Z zx8;trcM*!fHd2J7|g@iGb8o#@E)<{#*qgDf2vjS-&^Ui9%k=LTK$0CD<#4#L% zBdvQ5lQYma0{$JA)8U<)A9gQyCsGy9P)3x*%{Yl1X`5Gd9CD9)cyEUnx~}kvpiB6r zE_PoHjv3V>SM`Hn-KSpa~4D3iE3x^pp^G+k9` zzvnOde%$hdPfWtQN7kjd5&Z`rkL4*JQ_E+uCfh0U4*H{{d@%9WrQ2NzzZ&NaU;e^f z39@v_sujG#NVhI9UEZgz$rT;Ds5_S*yZVi}uJprr*oRuiN-vVG2-1sco6!CgEZD_A zDp4F(#gA1EsTc7LPqeRijOa%mOjSxq&%U8fc_&Lb4vmR|ILjNve{oBVI7c?@2BDIl zX1X~gc_~%qosh5)Ya!*mHV0HH@HkfsufFPtk*4+c-Bk9&B=GT#euxm>2`kKQoOUA$ z_~1UxT5_k!`QhWK-llC@#-L%8k?Z@A3Gi-3T*q+T%twtOJzd@mh4hGD59MDX(<@=N z&tIGc&k@2%F;ua8|Gg^%aQW!Q$wCpBH!O6#xrX={ABN&ZRaU6A@NX#5-l?V1Bd-sm zB6hQQ|3~yDTQ>Rz;Y9EsqVYT_4My*O3bIfWeRH?y?63wI*1J8T5|Xr#2mx)uOZO45>LjkMm((o{5XG&=nfDPHF>${Xl~ZAt@D zl4@HQD)x z=jsmY7)?ECefhjD-a+cXufb{(2~bQvu10-h70pqLd!MK;!8jgD8Mup6U^kwv6H?Xb zT%XJoA)&@1=1+No$)%^N^=Rvg78NRxCFdwQUZa^~VLrL1OX&XyrBU7vc211t7{DnJ z=N<6lA+sFbP)q4iOH7vi*vAt3%xCsXMd|J*+o`3hcCPq2%wP`?)nvCBt z`W=l~tKx{1LLbZ5|45rugzCAH^o5Z2n_CweIEnPpe!Rqo|42dmXBdJmLSY$kJ$3fH zcg>-`8!F?Cg72r}%Kb)ftmQZl{AHwk^oq(|i7|CqY!uqvCUO&lbpIdpePcXxMpBaL)7NOwp#2pk## zX(XkQMg*igq?_-kzZbuMpX<4SzXXf77-5C829xmrfne7!0baY5u6yQ&AF)E%nAo8~=3SvJW5z>jK5p30T{y z9ntmtQLEzeQVdjKCz5R5OwRxpmg$Y-XQOcM-safaa_Qe{+;;6hi+`TAymK_6pyCD_LL-lXmT|q+$ISdm< zW~8+>YLUe-2;eGRu#VgF^9K^VwS@%n}M}~!~-AHOI$b7eI$AB%XN(-PA z_4oqGLN2)O;Pr;Hdv`&COW?=o7cfzLMNTJ51v}zYI$nwhhY<;;2=A?NKEmr|V9#LS z-~;~4K{JY|7r;W;p+<*rpK3ex5y^~tZ@jN@-p(HQWf%AAMs=R|ZoT*bn zc8I=#ucyF)b5=4E`YQ!iZv2QJJux`3d{FVCRcJ91!b*DIh&ndRTvnXiYTZh(H?Q%I z4$^jJLb7s@dOa8PAa-`q-{PSBK`KA+7kH!%O1PL05*9$V>L$dgsIP|NGE=N6XO!?;VurE#6BQelG8l)YBa(&65RY!5^Oehzl@ z=dn1#_=;T5>+%m1zU`lG#*Hg+GSEm=Jq0OMgn$w|J?UVy!aCXr zVU-RW2p&O335C1r@MpJ52C@V|?(b{qEt?@9ob*&+B9YZok~z5m1;z zQ2~L~!-J5&QI-JGw3BwxPo^$5LfAh^DAoJD&w$bm^w2o)rA&fMw&>2eXn0O^3fbxu zW4?w%<9?&$=a#+TKVEWu%XN6d4?iN}de`|!`lKtB7}ZwaoS0fRL>j4rQ2dxCKauEe zC|5X?AopF3#4GJ#Ji{huqcNPi1)|n{-n$mdUPHkU)C*`74irA45C2 zCkl~A68ie-SCRi7vEW1L&&7}DD|e~kCcKAhKatjArv4DSw(kQ~S^<)K=zx-FR;of8 zMj2oQf+4${43%%*4J4D7YJDnky6qz+v+O_3A+d<;CE*vif;DFWSE-Qt9TL>kpYwe{ zzYh`7WC9r{>iYbEYx^QlzwBzLELubBNk*-Y_4V%C!~mzu((v0htrgov$AASTCHP|m zH{y720}(?SH3^@?9bo+aLeMnorE0;Zik+TPCj-lqakJ#o2PpQB2sl4_i7*wh#y5%n z6d|Pu=|AL*otZ?wb`+16m6?fXs+U9wGcU$}g;Kr4ikGO3va*)+Lr?$luLiA1Pw*Lv z{VKpP-k=JDE~iBPFc9Z$TN#yxxKdS@HT?>GJeTvdCqVlFvEk!A%m>Ks9BK^7Ys@>q z`V(n;av9OJUgMae5|YEM#qKJT@Gh~?VY+Wt{rtCB^5Hw*%8QsFI@cKusAVo6GBqS2 zkD&giktX}AWkU;GF~>PRK~_KZLgdOJz&8yw^#HppmlieZ4;*(j$U9e)1O+otYM~4C z^;I0)E}_OgU}`Q?-#Csrh^Ggz23O+5CZZ$HYEd4c69mb=ZU6x$J&~ksp&)X9pQN=rJqmu z>bKgH$?Pm+XLKK94 z!oH|mw5OlG?8=|-;>*=;St25C^Oy3u)NT)8ILUXYJ-QQ#Ie?CxX^FJq`lZ=5qp3#V z9dwiGv1hfHO?fX{DCBb_lTC#0-#)sSO=R)3Kx6?sw8U`_tDv*X`=;F}Z}C{Ek}ohd z=T_6vcjZ_zAKL1evOFUhHOAGnW@JvpS(5k5ZyKHB^%vk(Ygx*CiOmY#nG*k^MS>j%K7!ZQ!e$I;ZpOXEW<) zCVn;-C?_XkJ9DvRISrvN^T0bpe8S>exwIwP43u&YzcC#9q<@EPfR=V(Gixco(JG@w z1deM9-=uTUl>YD#t~aO)KTkzixgT`zo^lyL!J%)l3Pf}&Fz|U~K-|fkZy{q3nC02d zqihk#b6@f-mm9z@dB;#su-2!)b(`+R4Gg;9OXL_97IxqYeYTu7gCVjfe7(C~K33Ng zzYH~2tT(A;z5>r+qj;7k<%UT4Q%Ub*JC=U;A_o^P^Z7&N7=qOn3c9^VB5Tk z+xhfkU3AGl1&tTe%nt_JOB90e+tj`68 zrj$|d7e$2$7&7nSHlZykMmNDtF{xN!a$yZxRCuW)DU;#bGFBp%`_}pC zGf3)I-1NxIyEf=;!=9=u((}HL^K6F(e=C>^4Q9)+%DUAN`-xY5eC=8$k)}E;wFmSF zmq`RM+Oy{DhGgX;D}Zci%OHD;e19x+fB7CO@4njFi-!_RB=vP%xlO=7&4ZgL%f{zR z=LO}5p+t{+*(PaX=4YDR8Raqu_X?XOw=DGvTe{TZ8~0|v1djzjXmli`RMV5MtYk7d zb*kX)36;AyGQNQ&tCB-0La3ImKSd+gyWw8zh!5AI;{iYwN%Tmg*+Ryam@i@Y)~qL{ zl*?4Ij(cL5Sh~{V0|(+KRSw`tF4sF(%;+xQ`cH*9J#Rhar6F|~?Khnf1}>BFMM~}m z*m@U0?W3;Kpneh( zzV1_+E2^Kz;cNm3;H8i){Q*%_KpXSE6b_FrUHg^{NKq0r3a6r+%mDA((?C+?+eknF z*#apk_Meekr{PmsS$UJQV@97>{s_!{8tu@l1;=p^_nikW!iv!+d|*yBaIXw!bs{p-yNwaNays40}otmBJix{iMF)rQ4u?EMkm zT3?TXC5y93x8)Si9H-+}AO79d^if7<`9APAvu=(QFP_DrZ8{rVOtq=w*j(4U_gY|Q zl^RMBGiK!o8=Ao+Rr5nr0h-5{>xYI~>PTQZN(QHB>EKAH5LAxx0I1ad%|ndJ+{T-n z6$?BMf?%?eUZLCO$N74kA6Ncm5tfSdOePw2(OAmvJ0{T#+9^ujSwoxrh#A(3_0g(% zdiGw{RxpXKw3ho1Mcmf@o2J)tZlBj^a*!>PL(o&nUoC?p?YUKvn$;Fi>y|t^N(DqP67t;r8H*n}`c}%h^otOuBeH z+C$C5-sHN=OtvO#oY!iJ!FHhXF6CTF2z_xy$s}skR}IY^vdz0onR0JHld8KXYv{cZ zt7%t?UxExH=4!9kH5`)gC~RDr;T#hRA}y~dMi*4VG23pPq(uU~ z)L;xe^2W0llC^Ze9i1UaTeW$mY6g8iU{CJr+Nf02`8ZDf4|RB7uS{6aXxKtrt&HZ7 zr3o@oL75>paXMO`?u_Dkjf&n{mNKhGaS*#Vvnl_!YUyf35@zMh9%1V!h!T^Oo0MTl z$&6~U3W1{YoAfGFxJVsKU%!+~gOKuHAmp(#&hIB|( zh=wP&w*nw|$6NvbU!u!4p`<)^Az4NR7A#lFl=1vQ?neG_-DuO}l78vvxLwHHY_w?* zbXFYxa&R^iE$G9;n9A@4e=sT*`O|3NW;RW zX_|wT_%5f07X;x4nV#F13m8WnKcx7xlHPaBI6Tr+)8xh!AXUv<9ZB(WY1llOu5&vH zI;!9bSv4W~zzlJmn3wX*cKR&_Giw_fPGrAV++Lmb6HY-@=sU|e%fwn|llm}x%WfVI6RQv71sJWKM{z5ECnJ<0k0N``Dy$37x_6y*PC4qJ z3iD!M;=}fI`f!loM+#YSAVnux&S*m*uDrs_f{#97*ns8b0Lwc~pu{>Vb!${I8 zQsg@o-a}@xvQo@)0+e9!KdwWZ6}%FY5~ok9$HLQ}p{$NyzD1kbbw>L2Zth-*7`aOR zRq5j8{bE&h$G)K(s|ywOp9G=~Bk#+m>8s>uT+ugF9Iq=Vuqb5c!$cZ{b7+ zB6Nn;TqL59sIXs9$#NIIC4D(U9~|fod^$r}XFis?=7BsO^RaJ=yFzuujVA6;mdaTc zwggD3cJ2lTaR*KZs~Hq-$8K2Ode5v9gjS?1eTjZd%Dro+_pHmjz`bJz1`A|bI7!9x9+ibw4G$F!hC>0$C{bZM8+tnKCFdC7!T8S7 zhIaHjmmU9t>`%nEedd_;7;=3#Y_UChj=qo9>dBif3_s?SE8M7k*!J|qFOohLBp4Vs zBVUtl_{^UMo&PO-TnszL8)xUU+|o+g}QC6LKRV#9WpL4w;7} zUYtciTty+&LO+3dq#~2LL^N}B2zr3@MXzc6RNUt70Z{uBX9N*jwbdIbJq85C4POf@!NtUXg(h5S(K5XDf z`IqQX`6#^Ig;={^+%R|x>v6~8QcCv4rdmA{7wB_NWlTQTPz*=qAT}h&g4( zigH!WPv+t4z94@IPW8Q^{-X}!LcfC(VS@Ha%@dZ-GO2Di`;#8~cQyoZ;eygdlW+Ga zC-pcG??Jb57(Sl6^jB%3gvCqPH=)?H#&~G92;DBMwcOSl?t z=16fTxid4REs{ccEeZs$%vtNwTFQnT6GOC@tjaz2G-@%{QvzHq9>!>Zd~Ni|zAn1Ml@pUO9n^t_$#YGGE8`dBqh3DXWPwIW*#BAH2ETw5oba7EnA=xWa`K zDCElP1>ezZ%hd+;K7-BpFXiw49nAzQjEA+*_>@{?3r;^+OpQSA`l&UatC)u0e^Ww;^GAx%}#h`El+}>P|)ESX48Jg*CN0=_Wb;{i7s8eUY>%8`ee1!|4EMh!CIt+1BG|)K;ZXPP zHLxftDPz)XXx3_^WqM=8Y2`p9(haQa0y`&S#%4*uLDI^9TFSI!hK;J;h!;P_>lM@T zPqMWVde#yZDyKDVw>Be+LDJfMIjAGUL_DtM6uj&=xg;gd)W#X+xx^xCTMhDF5L)o^ z@ZRcpnzGZteV>+GvF4}o=rliLE>{xAxlH!!@lyd3$(`){-9>&U!ps7oL&jw;xYIys z)dah=m@NQ)x-z7TgyzUqi+77qE@ZA~JI(7&L6?#M_R;+hwt1xKB#RVvH>_lu!a6cq z-yTtoHBtl}?GmT-{(%O`!LRQR&AxF08Jn%bbh6%(1Y`y|h*_)$<$efCFdjzqVk6C3 zee_yrB2f&26+c70N}3CRfVcV;v}IqUMa^u%$;e_CB`j%db5>an;7T5F{}h~gXBXd_GM;>B27wDvO#jPL zmo<>y$l7|+dnTI=B0}4c-RzYxiQIrK8bt{S*;jN?Ex}}i5E_ya-D~N3=hV^xry-oh zY)IkJssG7?gsRBaZLclIKY8BzO75$)MrDKtWo{c?weTBHNDFu)zYN6wlT$gZgG(#B z3#TZ#iVU>H#SCb8Xt$Q-=lORI<9mG-6N7w8d3v&&+Txyr70X2Ih`)LRfc^0vE9RUM z?&NVAUHI8S2bAYh8I*{FQ;Ex|)k9DKI;k-poj~a=2{tN3Kt-`gOBB6^I_nUtD4QFr zw!T_n)K3&X@j!D()l{Ip**E8C&GbgE`uu5gC;TRKl#6!rAi(`s#n}zz%{||r^@tAH zHvQzJnbU*zl#Im%{ zMO?Rj^ZE691gtKvRxO46SgtvBX5-ajFh2Y4ay_#!Yqug@*C;Yln87S$j}7|IGEiNG zhKc~pWS*ni2*k=>rHzo%Q&XOfa+vw$1yllzFebVqP0SmQ`POYn)CdBO9exP1MC`G2 zSX7#%a4eLEdMbn>GIk&u?M70P>S=-$NLfW)mEdDphSED0#nq+UK#hRSt0JP-@5kMm;IX6N%+``RW-8J zYj#zbSCUaG#$D)dbaI@E6c1B{3hEc0~!163ZGEh$K3Jfs{|;X>UU4 z&Hj3X8cc)^*dr>0g-0MuDG8GPhk$ zmQxzFbeiUwUs7%=lTLl`YINz-7FcU@=RLnrB|PT14qD+qrfKAHv`vm7?G~ax_7b%@ z1QU?Z2nW02f4OgPr=~2ji1Wg16MOb}{t88j zle?y@TC|$?O&%R_MNeWIk=0Cfvv1u_wD0r39&bOKF4&)3b=EGY#ft>0Lnfu%i0P<> z(JNS6Pk~WI4F*pAw+_1#hPkV6=-}Z%4N1xwq;PT#DYY~yk5SAr4FKI(hz!}61!vH> zQLCQn!qSR_!J~e~a_A$HH3Ouc8y0kXogD5jyXAhLyfSg(YwudA!C7>Fd_%TSd|B3l=LcucdY7LO z<6nh)2k`GlA6HeKl_$)?X9oAfQ{u+*jBLV@n-AC|nVA=T6ZsE6TE2a}DGZ?ZMMJzG zC^EChi(Mh6KNs=S4ssjpKhiaILkdobO;oZxrZ>h8_)+(WS@LvD8*hAZ?{$$ekuxIa zKHqxxLzMiEsR+#vF?LtaN}RX=t(PQjgd{?`A|Gn_A>CYL2!1EHB&Jlxg5rxmF?p7s zLjjt|-(Ym_D@%UYT!>aDJn@SMeZT7F>>jfIa>|mSj>DV#D){;%%KO{XHLk^V+oy;e zrC8o7nSf=FC0+H^ikx&z1!Xgcj;0Sr>hUl@Y z_gRd14OuR8z+WeUFfZOqhP|BewK*bMH z{ir01N$ej`aKZnDLl-S2NRemFKoa0CkI_4dluN|UPq=cOKM_xb5B-ZmW6nI6=?BF;qIbcNDU!w__*| zG0b>c;wfk)CY#|Zul&v#Pl?Oy8FU@KAvAD$oMJwmJHkAh1m$iRQ(zwd%$gMqH8bGB zVH8;Ky;`s?_M|3vrSiFu_qc7oufUSWhQ}3LH0U5--q1o_C09$8{9c9A1dy2kCGEiS zXdBONOk(V25Y`1GG-Djqs?Y`atrB7vO-JyG;z`2-p-_F4ZF%3lh4?~MB{g=Nio?LxdcpOb)88!2rq_zfIQa|K*Q4HPgtJ?ao3h2iF1u#oZ8V9@s&xhX?l~gAZ&gDlQ7pVpeK+ zIP7Y8pXZRQ13z@;MWj=(BwOdlnPt4fp)8Nk2F{A0rcdzTk>gK8yqJp;wA%KY&sZ+u zFuI=w};BdTtXpMV3U*?4)jM!@sk!zlvfZDB#mCvC*8^DG_+Qh zbwMSC!_2;{;`WeP)IQ9@x4|*$lX(~G34H08yw%-+kB$n0-XTWSoyIE%Om=Mz4&`5Z z7Cb82L!k99?-H|oQEiqULr$yl4j(5hYvPD1eQN4+cw6)F$3TVBLfJ&Kv?YU(v&))y z)OQ=I{(x-zpv$y&)$aM@TB3#g%QBw(?@$LYKy9XOCq-4?o!S~H0vL+EHy#`x7U2ol%0_pew#*XN&tjEk~mNrzu zkLN?E-Sv{1N4^(hp6Hn2FzGF|fUuSj{S&5rqekBK+0rI^^3jTIs_&27aX*j!nO(S6 zt8lvAl8?V;Yj%I>6Sa{8W>yFmRjOu|TNzlh8x1+^xm5Dy;sqn#6D%|l1|XFY5@|yS zAKGj4y*h><`JEo{P@^J3;Alg1LqJ0Gmc@}96`OCt)|-*+hZbw3Byh`0qz{1P`z8s3 zU?2ehxz0AcIReBhxT!{(AQF~ZKz%;LauOgojk*sV&if~ef3nlzL_1e&h2x6Xjr}p< zY*MJ_F7LBO+iYHdQjSFB-LrDnis%NTmt&yUvJQW(2-rzDYr^^w85j%$Yd!ZD#6%jf z)@JE6vyK3?*4YUWBNO%m(=>(3H7h;q{}g(zsM8L?N9Y;p1y-n6;>d?gZ1|8Y4@kH0 z<;@V|qZOZ&8eKou&NGaqyb`r=N1=;?MiMtUL-e2O9{I?BqHvCl$uSh73pU9p z;kh4axa?Fpr2<^+)>}?922%f|K6Q#*t({Qpw)ALU@r>_&bvSXZxXC0L(< zDfyAcjRhaV=LTs29(%aFRjx`C$ztNRm@ryrHn@$^OD<4j*@WxQM4KvL+z}aS^#Z#c z+y+Kc<|%(Y%3nonXvn1h%nnUCPw!WK4Z+V@+wJggxC*reMqzE5#eTIxh2a3Jn%O2K zkXfQ~x*2%Ryg=}{?vTsxm(82Vpl>KDPu>=jL zrkYTxweUK3*W1$~cKX#0Wr9CK-H*zjR39$#eY zo2UC=8`~@>JXOo7HMeGOt|XVHzMp+_H2!58W8wSgS=iaRAy(SmD?eYx!|zF2 zuNLNW^r7*8qyN3`*G3Vx@7SdC^<|Y)sb$jgY#q1R=xL{cU!N_U_RdpM6Z{xA@m`Rq z!I7JCUKF6`{ob!mIl`}Q1p7NSV#s%F1m;F2_hh4snB>ejoAA9dzIZuUuGI^fg=PHN zHu+|slf8DnJ&cBXtet8+KaZ!>b*;{byw+zmYMqM!C*#4QyDa!NUd?o9^e=8jH5gx# zJ~%1@3i#Syaf0i|>PTZads#q;r7U3n`*m{_-GG$=O!0QfL)_K0a^Xr3btA+yqcI@S5##`fUqO_S5CSGZIe>Jak?yVR3a5h4j-QQ=fg>nx z1@fxYY;A_xDEvZQ-r`cw1_h?^P9L;giJ)`QQ>)x)8@KMcKMiZ_kGS8o83w)WA+`K> z2_JwnjGyuyNP}Bp+{U=&%v6VnDcKRlROjHSK~cj`kXS0)Zv$@`%kW<`$n}irhKOdm zXXe5$@TqXYcQ^K=!wYkEXL&Bd?kNV=_tn|^usfZ{>1QiQfz@@EQ~f|dg5#@q0J3yV>}=PCy(=*)fuSH4>TUR z|8b{Pz*4A-CC>hM$0MER9>!IBS26tW?3x)}wXF(zMPrc9N4U$^LsRM}6s$JiQW%tw z%2@Xmv6l}sL#I`VArii_!H-VU`_xl8)*(>RD+*vq3ee2@U^H^_mCL$dLp6N0TAKiU zxLwGF*Lvip{aayTDC%f;iX!W)4zrJAh+f#IccR)^ec`lWMKjSLlF-ZL3Qo1PVG zC1Dy$3!lOtqXcK>lja3sRETJq3`pXb7lWK7XJWZ&6c(T)^~4iIJXRr#$+9KU!m zC6A-l{S+;G?RRZ^j1s})9bX}1_q~|7{!nASg4hl3uBP-b4Y6YR))SAj)A5?ZnNKzC*Nv}yTpvdyXFG9&55z#N zRn8uFp7eh4rM#d3nPuHR<#Tk;zHqi=404UJKRQQtE!M=yJ5BC?v$tRS7C7=1;msGOlm1Yh{%jpR~EO^HMxyXoRT@)J1=_ zt)`CZv#NkzcLi6P1u4cc-^j+jGyMB&IFS@op*PzVc zGhkEBK_0Cbta`wIG&{N(QN~YcwJ=H@G4J+khF@!Yzt1mdfN)GyW`yd$)sg&b7NvZ4 zqoYjG+jhEIr4D=^=eBrhC0l7f{*ip-p$Y|E{iKP>v;L@ytha??y59`9#!h_<^YZns zX~kXGS^Q)3+C^haJKZC6FQ@flsSW)S|BTG@@yE9JgbD{!UF%(Xwm|o{!eWTfc%3nj zuNjf7tW1Q(Vj!!gm`6orr&uH4Uw^L1MxUiP3t@<`N<(<3IMNgNQjwlB@LLFrg_66D z^++%5n43_{6f!)hGGijVOAR~XV!2*ijSAVl;^Fk$NmJlG-G{ie2N}gxyz8uKMrjpx z4li_l=6dq`plF_UvK22-?py_Jy%L;h$~2Kl^}|H%Pxh>c0bFpMjIo9aQW%K|hX?l` z6$GoVMQ-qTkFS3W*YsPty^+n=VM26@TAtlE_1MO= z`%UT?*qJE8j_sO;@+eG|A=m&D%VK8U$ST4Yfl_A3;FA(G!M(2C{lIO^7Z_?uSIkh0 z>V7|>A0z4YKDti3EV>S2_XD9H-q(SJu#| zM593pc`->V3hto_=`yH6lfA+AV)~!93XIaUF9G5D7L&FldYH6OaIlbna7UWq$IgOI zS79oZkE!t&_6uv_Jf?1``ID8-xvaKvAHS!dTnx(g)a4Ta&6_}72$jQ?+T`V1<=@Rl zF7EYVC?!C_6f$2L#3`(r{RnfAY#CbwH?7)QvT}}=rZe7K5hU)#p70klaiLbaRcn0=q z+kRpKc=P-3$X9j$jckSb(Rwrli}o@RT16EdXmO{XsGCQxDj|HyYO^NxkEV$K=u2bZ z8pynF#xM+yJhL)C<{9~Nzq^!-uc=Ahwp+(YHFouz6{HR1B7S0bE~vk#P0BC*PQ0{T z3CucQ^}oA_K5OAk-Mu@lbJ~J>*Aj->uWN>Hs^%g2*D_)qOvKB>&`RLQ@#-ru>2;G- zrJJW?!b4~E2^A73XkXJ@`|XC{r7} zdBe+q<OWYH~Ti>^qY`#s@_}ms+;Nzif zrRHtbKX0_F^%Z(A4{wAqAr`*`$D77B`fn{ms{ZlWaTH)+iY|m|6hyIqJ;HifX)(hr zJPgCA^uT`TOhF!iR-wK)^ehC1GZ1^ZtQ;J&sboopJeOAT0U(M^K=g%d{!T+>+ zDixEI0^?5=PUJ)j$4D+)&#apmXeojk&i)n3xGrAzM)qH}SXAmuX&`=Fz_V{rf>Ss0 zVY}>uYRc{igbSu~!LSNK8#pvmRj?L~itnd#?x#DSi!fiG=Qkj2>Zc{Pl6(Cr?6U(H zq=_VI+wivuPHI+A1}Ap3Sf@X+E=VqWo3fwaz|T z$R1+J#F#+x0tiZ!YSIa0fQ26QVDT@i@XohW>SwB$sEGM-Y7Mb&2_u(ueOKVK6W=0N zCf+`gC=S;7xLCD9r@UcEcrdG)u!o43Z|&S-SSA?@(xUn?B=`pz#yNrYj*~HBxS@xj z2NH#mS~8YsbWu<%8E#36c;~6kS1|;K-h5y^$_r5X_{d&;%S!Om#vEO0E++vSU`H&Q zU)uR}EogOqrDaKPi}3pqcH?RO0PUdKy}j&pT-#F36&!)mozYYB!z8ZlJmg$6YLJ{E z?@vDuqQAsyhvOO~7_R+7VUa)-$PL^S@X=&2&r+eci3ALl4-8Q~>}Y7pjqi0m|B+qW zk50gi5VnqP z{|Gruok6(I=4~^4xm^7i+X%Sw*c^upehp5OL0w>!4gjO{>hEe|E5?E$LaP`7hFm=- zPqjKJRNQTA9#T$A13o(wU5ERhAjc=PusF-1(0zr*Pm&`daX$Kit?ZtF(eKrV#O`Z) zvzNe?&c)b9ZkoFWf?kin`HhseA3^E0I`A0ed3(fd!}^HV2V0q`9rJ5rB$ z=ke2dHw$(a!Ji-ClubD6nL`)Yw5J03#NmFIJ>%BhP-v3C2xd`|p87Ld3&dLpl7R49rw$Mx4dtNKspnpD z6w(QSZ|)<_L>(Za;( zlLEH?lZwwb3R{xv3t}D32tg+a+|PH-^s9_*Q`@I7m}_;Wd>S@eAObHgeXFIY9PY@x z&p3n~9}vuq5V<0jiJNNp*ngj-vKhZ>6b?y*!HYq)N;pfHr=*ujD=(5!(=cUK!FTya)djAFvYGM9p*kh#n(;{}u197}*z+%+LeVM%$ zw)$nzom%QCa;3oDtqTX2$Mdff8~RS~MaR2KitcZ~U{u?r*W?jDa7F(hC}(3B_(Ccq zlThYRYqA-y-k6lL4f?JjYcho~Th%I4$q^bI_}#z{Uwcsh#aJ~Z+@4)3BvPP7MmaVB zQvS$&tIa~|yL@cUobRIDV0-iWh*F+<(2_rlcGiRAnOUV3dJVTsz_WUGCbY3R;$b)k z^b>nqvj5)|Fh$(M){*XlBYg~JgXb@6BY2U>$6#qYh z`&Y_Ew1eoKiOQQ-b1uSRW#d&|oCmLo4i(~Aa2meoJ$R2SuY#A_J5s(QH9nRAHmmR< zSgHlJ%K$U>xO$7Gb$LXvnTR9$QDrY=i+)LMb>f8Eub*4UlzGYudEABWZgl2 zIbBC+JnOOhw!?Iv%Wtx4*8$yiNU3uld1E8s@t|BF`fWY`0^e6UNi|X*3Tp}|(GZdp zLd?XZ`iqcvsp z`X_Td&j=%nd74)VWko4Z#ZFaz1-$FD9}jO6@Im*uYd+V)|Kdw1YUD~N6;_sc4vs@} zO@~X*Z5a3A(;FzfXYsVYL2PC9OjgJ=hztz^4G@oM_l1in%wvDf&&A0P;=?Vc9;z;@&1==aI>W zB~LjOT>++fZt#w88sajkVCe7+R&CQJ^=bRR=BWN|d*j%#vn;@b9pgq4qmf8s?o!

+X_HAoA!oZ7Q0^WU$Y7JbGqSG40uo+eo>#qda` ziq@uEW9<)1yDyUN?iEhD5_^!fjlVqM$j)|&NQW+Y4EVEU3FcQtNsu$Y&BF!ZNKnS= zNXoS8mV~k;4+F=*+v6&Gocjp?}Mw_=)!>=?8<{W=6;)^x09j8&_HUoD&Uj763I z?!i0c^@RRXFcxJPKK~I1)VY>Un+c$+pvq9$d#q z`WNS#8c~Dm!cb$-L=#@=UscY9F3%Kai9KMK zXG??FZaNKlanc_@)clz{;e{e3ymDLW*8K`?U_PzA{nF3**38lDF}!Lgc3JPF_h`Gd z?X7Z~QyW)1aJBt+ch!E{`3&7^)_TXh5NO_@0u&7GHfV~d7Qr$4{nq_0!k@KY+y$00 zH!+8?^k7PoZMvnXlF?~IguJcCCrV?XrGN7*q#MZ^$h!(G{ihFnzhTS)E)xW>KG=BO z-!;wd-t==8nK|}4xMnjSg3n6$!JNh)xf|J|*v*gS>~TCC7x_^Oow(7*fe$y<3fd|^ zPKw-BsK^<%EpwfOFJCpBK6zPIJ=`vH?Xo$Fpw(UJ3Z5S`ko_UT+E#nW27o{oN$oyo zEa!1k#ljSjDxtNc>bTr`4LT8}(||aV!Y3VV@s~vN_=z?eXEju!uaJM@kz3Bn={Z_h z{K9@=IbL6Y(3fre^5dhk>RLKRU-^3Og4Pk2K{f2VMi_yLR1!{E^)*Dz6KWWxiC&x#eB^y7+A(<3L?w5}mY}@h z=1zj2=#KNSQ?fc&p@Ohk-w|7R^_I&fuIky_$L4I!7rl4LAh3=RiD(Yhb6||H8~Qik zyw%c!Xy>l`j8`xzo{B(cC9FwW5_-24m10ehIEo^gXsI$P2JtDD5%V8m>~WbQ8to`r z@OxmJY_f*WcM@=T?w76#qx+7S#cgL7sG9dTW757*?oFsx3w~9r)*f)L{~$D>ebD5q zv0W>GD2O#t!i`aSv_*;L93!csq2AAJ-%hi<;T@@z9trzD&F<2M0#^Z|y@l=bdHK^^ zM?3SWg1G45XD+SfyBC?rzJW8>BPGTL9&gC#xuQkGYcI{{`P}av^f=d<-&L7kKWjWiHf(u`Ne=dD3j3M0F<@_LVnf(B=X-@50xYl1j`RwOlVtD8UxDFAg zE)sTUveJLWO5Tq<)SB_k42a)~W4s}FQU8ea5N4j7L-2%&iazVqRQh&IsDb^2^unyR zr07zoP-M8n+lkwYvfLu3>!P=hMqT~~kCT^zGni}Xt#{GjmjIIk=9@bdm9&%XmgDqT!CuNz){c3XlC_X0cN%AyXGTPjgII{cS_VUyiZTT5^0L8RM#Jao&DJykR zUk~I$+iwT<_}Z;1S$cO&#ahLv3sI@OlED zIOVJ{Q+hZ1%j)}4m*pce7IAGO404}?ZDS)J@n1}CYB~*y3`3De6;zIhvUE~Tq+@6y zP`sg}O)jPqVIV{MP$1t*YHW*0{4XNd3v59rXPpLVV^Zre#lSDzNhFZCUyAB6l`(On z2Ms=@^lX$bYf^JWDSx{(xzhfDu{+z#!tqk1uz&f zz+yL?Fd2ylWkSQRATZlPLdx*#K=+2yNCMm+B8vE;Y!{G{^_NYmPb9$pp?yR%D9r#g zjtGO;tLempfW+#jg?Em=OsgFj291>gw~ieF7h%s#*k9MmpZtUgJrMc8@7UgjdAx=F z3y4=hcjmg<5cnSCGvP|lK8!-ebFzJYrlec?+b{7+NvygRz3mW7dJ7^ij^S`m%a{Hm zl(4Umd(q!SzWa*F6s``WvSb!c?(q;PNG7ZR*(8sBcI`ga>mD$Zre)^#m{-=z=t?q& z4C?*cSOMmiK7+N*;A83hvi+mjn1govsFy{rSt*XM3Jmv_7H&{SuYEc}RFaA#!#Z-y}_3atj@` z{rmDRbYZWJJ}AZ)t)H8-g#nYZgrk3(cmvqP?F<1-zfJrVV;J`#^opYJ!1J5uwUHGV zp7Qh1_rYb$Ne~Gk3_r={0I2%%KfXx(DV-ICf$v!A0;A!f-n?g_AHiahp|qE`QlL*N z*^3Hw`&_{We5V4%?Q9B({V&OC`1sS*8RH!qc;biPiNEcFGX_sQCpIMd)mxB^-)+an z(vwx4f6jy~rO~Rjr9&}RZObyQLc)plIvPjv(5CMPlQ~Y}L5EPD`?JEt@$=>CCaTe; zUVoQ?y@c}nr$P6LtQx7uvq3W<>Qo^je|kfoz%52|@+-UAt>rI&rD$r0u>(u7#Ued< z9g;waWnzMZPA4myPF%T}C$0^vqiw;#&S)G2c$ss?)-)|e`U(KOukf?BzqNeBRvqXl zZLoTPA>N>d>Pek6!JXkkV9B9Rl3kf`=csR}f&cjN;r%?(Af8zkm-O;|= zH?^0zz5$vu;Gf<-J!bL6gP&Tu+r9a!>nC5<8Gbm>96K7HdKp+ZBf4%D7~N2Y)Mpi_}Wxx6tT@!?2K`Ne&pMdE2*RL3k#cLkUNqkfJNi|IZC?Xd^$Yg!c6o ze#Rq$Z~J;Gjr8NRy5zPNan-$g4)N;j@#$`FT8hbW9B(@mq6& zk=bdH5a=1Fm${X`QIh712fH+%$#7we?HHXVHmm zu%NxZ1+)HhqIPZx-07_R7;Vh?_J~k}6zoJCVhKI2BMfDpU(3N*f=b4n&#yAk>gE zjM_xEsf`2k2GkkNE0xiZ=2Ii|aQN6AXXwJsF12@|R&<#}*ql0l2m`@c0(3>Q4Jo1D zKz{QV#+Mm?nnra;avcw6Z+0Ej6y{u6{2xn;Q$|{-T2@VV%u`w;Q5o%wPNtZ7_yL8gHC3xa=D$r&FV9~yaYsKz3*SgC zkEslwoC$}MJ=_=A`nvFGdXhP6#mf7<{@Ud{Nu#aI%7RX9_DJVgE$@9TK1(VQ;>f6m zfo!SVtb7~QCCQ?>Zwt@F;j6BpPKWnJMG<2ZK z>pK!(;NVgPo23;P5h`Zy#OEHs>PXD%Oupf?wI96_YD`pjKjxz6BFt<03t` z;cZ^m1aY7BX7X3rn!CYMUmaiCf(>?J1dIs-R$=7KO7g74cle6uad`!YqqbVX@=D^2 zd1wuXK%QTJMQrQ>dFEG(VBiiK9wG zXU55=IIAKra^#yNLYGqaB)S0w5b*80!D9aa^jhAt>_$uWCpuCc9e&n|6! z&p*@J?;4+g5087L$Q#i)}ioZ?rAHoJmi_cGw1T_{B>jIay8b88|^ml3~nPLhIOSrGd)SBYM zL&mAffCz7lzo=R4-FtV)m<#oGMf@k*IV+oq_*4p04%qov0}XTRl7-8A5|m;f=Eq^I z8Vz?g8Xo8DZX(i)$2~^07z$#HQan+&g;zy4o#JzEV$KE-42Fiqq*~`LcXmGwUP|q%c@M2U%6I`-RZu10>GSCLo>L286wGcHF zUIJCu;rG&XR?imKG^`B#&5kktEZvCf2_AjE$xM0;9(^vLC)0X`LydzK5ESuw5{tU1 zOI1}9yU!k~V*^~Jd1*zw%23W-kfT!mjRfzm(AaOnEjf+U$%x#)E%^5#uZWVnJx`>R zk4H^Ku0#ONx5h=Xgh9xyzC;+2`DmcKUPm9;Mj{LF(Y=mo@U2UScAV~V_Z?SWd0e;p zwTG@A)j6$m*Y|hxhxsmQGeujgwr}o#gjHDA^R)fq=d+2v`?AS7-!xsKs-(K3{5-Mz z(+4hiXL_bM)+_mm(y=d)ptZuN{@i=sI|0MTb9XruPptahVdjtdhMuX~^HHlS znkJhCy*fd-@)VUYLp=$8bsq<(STpr3E&gGv+v4p8F(l}Ps)dr<>?tyyA~}zJiEY~` z`|^H%-E7Y*o{1yFA5}&l$yFm67e1GW))P8;D8%7=mwE0ew7l?VIKumPl~ie(Ylbhdwp(y&=Zx-(4TiPdD(*zPbRTNwh&C*y0pm-N znSQx$=Esf6-W|Q6E94DJs_X8nT;(B=oW4(y^;2rz1>e(M38gPF1+lHl@^W^O;QW8r z;T@nVA-XgTq#)+~*0S(h%FKm9zGeY~6L?bFr;(?wdr+l!>kllhufjk!JS$>9%NR zA?D|g*J#0A8t}I`OHgg5(?-?+{5%tl_$)1#tk10MajQRN?J`8wv?PR*%et^TgqaaI z;s0ATk`G3rCdC)*_3FmP3eZ)H^rG<>i#xJ(ftGI zN9e3Af-3V&63Zu6L-L&OwD#e9^A||mJfgRxsooV#t*023uiakp9fkp#2x?%C|*W6JXPIJVCAu2zoGZ#;Dd;U^yyE>i89i>;#%>&P4L zdy?iu5Mux(j`X42xvI{W!H-Ab0R6D+Bp_xkPYvEX{iY#l6R6x6WW8TPJ4f!&5(foe zomF%XDwcd&zRZ%0tDjdSd#C>rt+(U)MVw|BA$sFH@9(#Xry^qPU`e%@;b}E z9DGVp5xJ-3SeRDAZNrSIr?;xM<4vF__F%>urE#^cQOpIN2Vhmbh3qm<4%9pjp%Nm4 z2gqT>(Zel#i7ESTA~L=|CAt|tF6#7NR%nP6s%zB$NdF3<3A)_F{G5>boWPx2$EM3)S9cN85(u`t4kQV##_w%v z-+yNrzn-e)V&QpjJCwvFuTqVq(P-OX{cTT~tdL()T`9az6oP~cPeEE>ZxRA~vu?hgI|q*Zr^sEqv}p6! zK8&8X^2_|*rKDH#xU`iDN9)Q7rP;bc1n@sIsCC4lB=}-eov;9>KiUcEczmhlGT;)K z^D#CFl3kdM6T7H;)2!b`2Q~Ds~(psba3)~vq0*<-139IMLOL{_|X-nFTEb@<3ND~~N zFTR+!-)!;)(XRzQC(@(dANH0K_2j!$=i=f%T2rXZ5IMb=g?i(+x@PJ@yS!ohQZWA(JXzs%u--lwIx;~J~Sh;!bci!$dSWET4->hDrM!zUXmpPrOeJ@);cpmY6 z&dg#}*7e<UJQ^<3cH<@C)bR3;=$qNJVpBM;cC+i5H-G)e|C!y04Bne?407ypzmA z23i<{Z>lnsx8$iKa_G;DzTxv$0?Y9K$lM-%=j{_34wmA>7Z3-!dzIgU#kb{^%cQc^ zy-V=DWS3dQ`<@o`Ek7sm>|D_#liu$VeO1YhlRo`?-10dJ`NQU*yAlwxP=nE@^cs!w z_&6n-Tld%DonNKD>_dD&T}6*j{uw>+4<;U--_VDGP5eCBTsKp2+Qw)pT1ZXVk#6-wqcLU%kcm4;8ps^ zYm3t>G4oSyTJEvgp9j46rB}8TEil7*PGN`>z#l{cgz)iQ#c$PZfracfboslOTBMnDzN zhb&r~$LO`l%BoF8@Qx86gn|dOYu_vG(X6nWx#avoL{;MXl{&dhP|!5pA(i|ir>Q3Y zP~z@+Os^&d$9`8_$~jf_id|49l#r#k34-unI7E4Kmuq@YnroW&hMva!qPEaZ{+dyUT-~8J@L{dLEUO-y5n4p>2X-jI&Ek0?+8O`iJs+_Kh__ zoaUTBSLaC4uzB$BJ?jM0)EuE8m6N=JbxU-ozNtIiW?x1i1}1I3BdQJ#uEQgrxJjFt z{ng-)-eaKpKWy&2?=iS1?J-DuQ|51VQH$jLSD5`Z?k{D|izjB#73h&58Fhb)=M)tE zU+LGZQSto|iZpKOl-spOuRHLUfIOyTDp z2qHb;r-xSCL;98G=CP;-u1>VsOSILYl&=93Ps894k%0czFohVn zg!|=mIDO!#iGYb@8Ry&@weoEkK82@*tDmu%CJKq3d`y7S0x0G$%v}89mzr;blhQB~ zJJ`ncDoewzs88&C9L6F1)htFwh6>nU#gh7Ek^>o$Z7u4 zgT3!wU3p%pU3sHnvyp6fS{(cZk10S~NGIb+(k;1p+Z!9o`qd2~lTaxIzIzvq=yv`= z&D*9eNwsJp7HBMXa_z;P4>I2bz*Oq63$QSW1cx=tw5Y>_z_klRctok2(;IdrO;~M9 z5vvN>7#6qeu8;52O*HtH^_RT`F)W*b2X+j<{VX-t)fj@BYB=RO0)s0;A%Yb~Mc%4S zSZi^cgF3HZtH>?Nr{nFPLNkm0Fl-6vpPW?9%-*|Kd`d3L`R1kTDC+J5)d;zU8dhC$ zU2wHAR6mRG6sIj9l|j|`uuEljepHzQjWW&)s5)TZtw@;an0<}(dw-sRA}%dpzrel zv3%piPz>!1A;|R8u{EpkY;QgTLJ*KN${#H|mrMvl43c%BxvyG?haVzF8*7F1#dI(S$p#N%2KThK4#aTd%w{?Dxjiz6mb-FK9&jh6T&6)L1$}k=kBiEn_izLgw{hWaXb*WA zqR4zbFR#?33!r_bhC&rX3YbJmpa`*jLG~ucjGG;ufSdf9Y^R?rp|)nVJ~?x9`qERH z8l9tdLuz!MD$8n@qXh5<9qryh&@Fdr9CAX3I`rk+`#f0Wio07_9vq5g#q;>~NG;_8 zKIM&0tvfC}K$3%Ltx#y4+Y&l&PQ!hJ%3t!UP)GzjvE0F#(_Fhs`}iQ`U6fdE36Y|6 zbb+-btarAU+r#Kt-9~f%u^mEPY3A{HTwmbkNvND&LPXZ2S%|_JGnnv z9$svlcAe*FWGNjMi1^WS(#?@11gRa}v^9aR*s2pz+;IH3@xyX7MC1>S{E%kazz3o3 znq%AhB`om%f}%(bVL=|m?OAqOuhUw)D>`!M6K{z#=*jvo_1P=)5>ItN6;B0&h<0sH zwUTW!f6aD^1-;7oy{foQZGv|e$kHhu&!GC)_gCEy`1iouvhF(}-n>CkoutgxpG~0V zYOW*1qcL#i*vu^C;Q+Uol9Sb%$A699=aNXz8|{WaI=C@xXoFv%he;t6OOl|554sBa z&lIz0uPtmx#msHFX|>d6tNRqer^%eM=a~$~6-@qELu8lAwv2wIAAkPoZbmxFByg+W zmB-p}tu^18qc8O+=*sNJKtyYTK{FSw_)?(A$4&4}M5Xh!QvG_r99P~7(hMToArvv- zb3ES5SyouLn1@j46nGH*F6XXo4NLKM@{S>Eq`KmS3r7d*#R4GR2L+iP{_)dN{_e3x zxNZfopK9PfnjS>vw{d|@ci>26oNc5_$~2r|Dw3NSf57n^N*-@3pJ>p(JIti!iH7(f zd%77*g6<$vWE|3Ir6)-+ii-&4XdJ8~fBa5ZM>zh>oOS3|ittoBBtvABam|sEOoVwX z-?vTudHAo5hz26pQ9K1z>xe)6&A$lR#$X*8x?ra@C%9V}c9Tcf$F`v5tusEk>TK<5=K4ot0WAZhC-glQb@a4k$D~B;e z=PO6ni1z1Ogft`VA`I}wv~u^g=kaXZZDhMj@$RWy>3B?xvO1Ws_WjlZRU)fW0Vwn0 z5o*yQU;jSdO65kAOjWO66& z;R7O*_y>Zx| z*<5O`X&C8YdfS53R3qIkVNLU81*=$?d?yb>MZ2n=j?z+`B&R2Oa`MPqRp&ee#9hb$D#{L`DxjZ^a+7EoQ1>G?K|I2 zpkaT*t}9*55pl%B^Z=J|2xCT0@K0R=yBl(aOn-{kuopoB4TlbppNySu!eHdsE!RHX*I8 zBhIBNhB}*rL5?7iShWd|H93PqgT9I$N`}VnP$SFD5+fRRAkp0jzXB^_+_HWfrMe?nhIl7Ilik-rDb@Bl6pCmCrxU)L5*@*kU$sxVq@y zv(vSe#M%a^;UiyOuV2Vk6`~4In#VWUpq|%ojiLQPO%JZl8b`0LA-2@+E9;C-i{y(> zoYyXH-e`B?h^2b#jTm@QtDSRFP}aR1q-WNU*wa((|U+R=h`3te-U%vBsJw znngB(?fX#K5#)bVdpFlcho&?(=UHPh3EkZ*Hk<_H&njmLU`aU#PW&kwv7mbjC#<12 z;qn_EZ!f&A_7CDcOTyY>mjU^*pqhdD{7%jwc;Lxy0$$L8+aW_?PcJ~B5KKBu3Gfu; z^?5aI$M+k!p)(Ftz4|})rT|YMFU=x1h~(tbI1n9Bs{M)=uz7xv7Wy>R^|RG+-6H?B zIXa;yhv#;|r?2g^(vMn*wI{n~pKctHQOA@~Z;}i?SL*I;+Yh>aaia?%05VAprgezK z1g@RFg!d3SFQg0)RHO{Bt7@{|xqq0z9w!Sw=F9BQR`SeY#w>rfRE|u?g!0{nY*{Km z_zJg-vc;zhJC3JT&gFpoC#oAGb}n0)JX=-eTNb=hshr>y+gdC_4@8pj*8s_Fe2Te*L2aYvhQO>6atYQCy6YO45SstiSS>VO3!HZXd7x#~}*bq)LYL0MIk3DENn6@n) z6Pwi@(U=r-)^&#gSi^~Dl|yeWeos{jakc>4{aKI!MqTy9NJx-UqJvGJ6oW?U?I)Hm zBfQ^Nrj4rz3YO(lhrcURHvn>80t7VU)m?<}32B6I+M6`2gNs_dQkKk1qa%-w7L9`W zm5v=ADyp};>7NkU#HVSpzQ}~qicNB11lF!^r}=)6I*qm*;*dmR)%{A;A-^yV*@IxI9;8%IO_XxkSV_RRK73i7>gK&w^L9j;V&kpD*AMZgK(x(M zICzp5@57!cKyk;)LIHcGCi`}gNY9IC#w)sxH(axqa zXDvQHGR`v_4Nn**hN0P0OmcT~H!(sX-04f46`#LVZT5ie)rFp| zR=-BUP3%t5`fCs@5xk6UhO2gY&0R$?&%E!~M*6;UR(F7$;vCL$+6WiO{7)Sz4H%Uv zVF%ztlwi6d<4D_vL@@n4#H;?)>lRZIzI+etZV*EqkG4iUUWCP?E%imk{ zy2^Axy~+f$>RPrt_qkc@@#Z>eKgEK1g=}sO`?-@V-14)c*4yUn{gL?|G0|vZ%>6rm zk8fNhD1V&JgSC_90`7fQf#I9{bUTqHCruj(p){$qaJqN|J0ANqUKEx?)p0V7e;A3o zV}{zEZh#sXb1uyZ$|~AM!(D5{HBUySv?%uixDo6+o*idrb*_7t4cFS28KOkP`ROFpfS)eMlq=D7n=(EGSawOR#5N71bC; zbgGg#Y%#5L#a6dgK1Dq4Q&CWAY-Mw(=67@ZiqdvISxsl?_eIBpGB>+p>a!N=^l}Z# z*LTEaN{Nz^2u6kb`;_eAUX+G0b5x<|0%77R>Yn>_(IU7)S)%`IIgpeoWL+=_XMriN zaI$zt5Nl*L;beZTywGC6-Egx}-z$;;+PHgy4P@}q&Kc^Lk9pkE6J6903&4N9l@ZIBKg#iV>vY>$gN=E(T&wgRPsBWMEaUL%u@bo*9Dn_E`OqyDk${brRH_j zKBg|zvG~g=caWN4R?ZKlvAQ%SjKoaS6L#Lc1SAxnyHbS{(ozL*#qLSAzcXZWtTAFN zv`pnDrwZc6;kkiGl&fU1Ty46Z4I=z$9$&f;7rI~NFy_@N5*|KhZ9dBl`#>so*q?OA zE15XRon(Cqw=EB^Ko27qiiT%rI0XhNd}G+mIrgo0dSF$Cp;Dr!CrhAZm*p07Oc8zZ@~@=HKabq_ zb2ZfJ)RFZqpb`Yu_kaG^$8G6jfK)%`DqbI5$Z5BE`bD zdB@7Ni%mn95cN+q&X-ru-PHpbh0d2gm?@j@AL`x%5e1}c^`AQDU>kKCbQ5OQ<lkO!k>v>mfqrRISfAi|ni9l1 zqip59|B$i#%Bf^R|Frk)uXqZotE@1qh|Z`?qd)PDL4tEXWB zA4y#Wr)TXGqg6FS8=4xqb1>VgYQ>sbRRIMyYiAg2h<1cLjcsr%p+P^+0G5{n4f&r< z`i>Imet$fJN7!=j)hJKS+)e`n0PTlf%}BBkWuzNmM6s6265dN;oJNR!<}lWKtAoiy zviuw-EU@kz%OjZtmtkP?&udC}z0a>8f5VRz<@id9bCT-$`&30v)7(@#pfd@Wtd6;O zRrW&|{$yA>7Um}~<}2G9IZvo4-YA|%xJBM#)nPP-tuk55=!lLAL<+hcJd1YY;w-X z`l(Pz_{cjqi}O}jJI9lreS^4Qg1J>+z~G)>(|tZDxnAWSktZboU^2-~?afcEvwB=_ zVUt#KsDfrEn&;*p-M#SrYjk2aMR^M2tWE@Ey346Wp?^q`ZmNOh9YAGjj)@JLF}jh! zA)d#6uw{Ns<1i0WM#O2=As&|ci~D!V#D4{H%_#b*K!yLvi!}!pNGFGPpm!w9ZWY_= zhx~*!HI>c7i@sBj^Gc6-aWtQUMKB}#J&?H<3bKBki+Ljr<1(p|<2j`xr)QC+m{BHN2qgyMj zQl{#Q1Ui1z#B3y7E{N*5^^YL;(?JG=W^l)l(R`P#z5%@X2Pbz=R7ku&^7rg=w~rG4 zd;p6wDzF}kvYR0rszXmn;>$nx;VV*C6D|CyquNfdbkBMU3Qvg^5wUzym*48<*Ub|x zS#x1T9;@bZV(~Lo?68yTl)5@-5CT9*Y0ef6YnVFhZ^;7-E-YI?5yJ~n>|F?YdLxM$ z?|GK03NAClVML%1NS7!%{fdp(#iYq(UiM8uSPaJOX&{jAJE)v|Cx=#O*GdRx- z=fb*H!$|(=(ppd}0UF>on<7EG%_ezf+u|vmPkaAfxCw8Mw`m1xJMr@&zZ6xv-<-+ReGAG+FSsUcMsspL?&edcuHUXN5!dCV7GZ@M zrpPV|BE!-jG*GjKi4jx2y@6X~i6N=Jcb;1MBBh>BfLsMEdgnQEjhOL#;r(3&b}jwZphx?sN5o%Wij)PHRe0iq5(=rmxaE zagt4OC2DF)tbrp|HRiqS1%RsebLwag!=bf*Ey;m(pMJ;l{^}?%wFaqAl&a{VU>o66|$f z$mbhh;0sDBBkjQICV31NElmhbl67!sbChQAk#99E70~(i3r4Scqji6iL(b0f%`suR z;PIRKd3cvDJVA(l+4J`m3rJVZm+Mc7h4$%h@Xi!hhT`N~kBju7X+x#aY=aRInYLaR zm)pwEi2bSVU}q}{xU78Q6dsUiGvr-imvM{7XDK9$G(hS^=8t=v*93noJHNw#uF3ng z*^EIWHvjX(5aL&2V2);3S~2PaxDomPby6nEy>owPM9uSs#2hwB!zg(-@QvXgdh2x= z^I4JJst{V?OTK2aEpTbu>BL7q7`bBvrV%Ka;|MMW3V+85?*y$r~kXlBB`nIKopNpD%sMYMvf69*t&l+311?F2C)H zW{T$A?)Lp45P2kNts~o)nifJ!Wnt5dQDauU9gbchG%tfMeV(Kn)9WgV9}Il0|FQjR z1<9Py8Ddm>@{}hhLdhZzV5Ev)gelzMYCj#+L+4=1_&3m&h7RjZ#mUnfd>|Z(R#4y! zQ^wt~?I1xdfy0h&iE!&0)7W^0Q&Te^N}94H6=W9-1-cFYuaHC{eVNqWnU~bA<^NXN zA~u-B!K!9d>@KmGmH4J{BsN%-SUQ2~DruJ;*F!QklP~HA=DxRTH^ZK9fq4uZ%3g6k zdcjAjlu~}Yj8Eb#^B!^5VY%)ztqX0NGmJ@jx)yv}aNNX_15N7EP^nzhIDZNs(5d2& zI=<*U>HVwg9VhedE{qw!e3!THZ!QvZs0v7g%<4{gZTengD-SyuXPogOXzq#Hqc!rQ zc-VcdraAuvl1S zEUu4BC3E+!FiQ7I*Iq2W0fT1KS8$yW#_r#;cFOe5&x7VCtzOF19fOUu#DLhIWo@mk037%S4=r!#5%133O}g$G&#!dEi78nUnJ!1{uJ0mj5#iA#!)PzczVj znbt{-oz3>ngx*lLde-8}&NI9t^txe`&KGufe%03xQN36- z9&5Ig>uv4@^}LUFkFX4&Mr+Or4ShIi=I^ee!GL=9h)-;h!^@KIQgl2oyEQx#+eZhh$4Q`vO z2ZQ??5l(4~0s`y{xG7G&8>fIs)oX*??vyFXzl5$E9Yf`t6hU z5S&M2)DU}j(vX7Yqi}yBSU$vfG9k1tI5C6xU9bCSA@^DX^0g~u1g!V4>OMw)>V{}P z+m{$((|?i`2rna3R|}*3(X|=~!Gth1Scvb|!_>*iJmcKxwDy%z_lqery(`I7<74)U z=PYU{Ykmn<#BHqiH&_RyI~Fu==67lJb})hPL4ZExIR!MBVXpYUHVYFXd_f}Q`I@b# zFaE0Am%M{_{g%%8D~<}6Dsf<#zY<6obQAKQ$&kQbghsFDg+_Dxj|oHSI=K?SW1|xy zvf0)qZw`4IAh9jo9e?(=cz$Ktp@%;UD_P{YCO8*VQgm%pqh16-^M*#p_Q3ez*cnGv zVK^!Vr9mhvKU=oO+%@zNPZ(5F=t29|AkhKy&-T4DKnYb90f~S=i3p%K4uMP)WWY00 zV8Gi5DB7Zl(I%JsjNTEmhVqY&u)UBBT`iEZe(Oj?-A4}=`+KRd$cT1p{tguVMlXO; zagO+B?@p@VU(*Et!1R{WFDnRr{+Aav;9|W2xrOs0aZnKwNMke|4wNT;A=7%xyMUmC z9l-u;{-JQTI`7T6MFKK@>tXn53;B?Z16fb%gBJ8`?tZq%rl$IaIM!%r+S~Y3k1q(o zU-!91^F-6^nWGVJv7ojIK43L%+OepP9HwPq@tl1`K?J}nk~U>#vVuR)f$tYI=MIlC zz}QcZ6-9LrC;1bM#Zf^@*k}=5irrM!I0AM#EQWg6HxYf#U8?Tz{qm?DaNyIIu>UFS zWlLr#Ve2I;6|&sWVNA?VW`?}Wu?yP?pjGB(;ot)(Q35HgH<94K^yP11*iQYJ<^ZS1 zAVmvoNZLh{z+T#eRiE}-SSVNkm*Si*8q)B9-(N#Pg8O7383QeX$W=*x&tw2(8jF6* zbo0q7lUYJ=BP5ngZBGP*|Bt2MUkv!I=MDIQEd>M}Nsow+Jp~Oml*{CdL7p~f(AZSI zpcq1%z=Suk6(9iK>Q2EyHTKj$Ddc6HwF&sNh)3mBbrp0oG^vlu#8DHF7G>x zs~ZN&(KCeg_-zjolh-5vvxoU>;3orc7u*YM z58Ka7nXvt7Eku=XUC{D>!Lh!1kFrYH@ApDrZoH={VZ{?DV8IU5cTMROb@fP1@!f0n zx26`v?&GEsHWbTyp;xB|00Hv?^c22tT6jWuF34L6>YVr2o6;2t36pA`$A9PPMZxv? zeY`Dkk#09dhkd5nHpu?2{O6z^v*mRp6&$E!E$U4|Le#^5jDfFZ>?xdK8kdFmFU1ln93uT_5 zK9p*GiE_2My4ctqS>kqXV;vnstK{-W{|HnAJeyOJ|j206|;vnbWC164@mB~YP6-LdxUO|punb((d4{*IYcXg&CqMDW9~ zQ0lm01Fy~%P%LB>&00{GHg`3-2J&w(1pm+xVgN0U%Wi<5Yu`~5B9=~>fZCW+No5Z{ zI7lhRjxvply;>;*j{P6l^IkH87EdsR{tbJ!V^U0<+XE==Z23_8Y$>#&PLldCXX}}E zHEu@tj(xA>psYND1r-5K1SGmksic3~ak?p)aN+rmLyP@>pU@SLE9G5VpcP z3R46D;aiJAg12Q7qKf}^V~+U6n3`C{6wNC25Odi0SNG^+8Y?Oa_|P_{z5}5zlOq)v zGYH%D+m{vpuLC z3-zH@vU~OXQ|A%gKvIgyyYq+PuMC9wbYVwya)-Rbo`)#DYbXDB_=eY$o}M*Ujb&UM*VA)1Gz;k}S?gx7`*OFlu)Bc+Bi91)az8b4c*h=Kg!VwBvu1T)`d5FTRb<*3%iP_ah{~2q zoXQU(WT%NTQ}2Nk=^-@x>b^VXtNdPQ=$5!vZf_qp_(HTMebTZEH&3VJ3uc3nAZz>gZ0C{i>lrI#3YG(J7c*4#n@cRf-M+Po!GW1S^jS>|~ z44t)tn77&;ySdb%q`tEF6pCdEH@AQh2vp$NGMuO+d$XFAaEl#04s1m`srvM)LSMU^n# zh;E{=6Is@%OFVBYLwN|lgsEe1Tq{lw7=+L-Y8}opCy`DoD8x{XdE>78L6EG2db+V8e7US!kG;;j-wB&Dd5I;jCY!>U=10{~(=1_eqP7z``1 z{gw%-BlB63n{FP0u>cuvHEcy8m_qpD$LODYAOL_v70mE}!;M*g86FVM#$47;#2As| z+xF*o2Du%VERAP&DxDAGLzAonzA+$T$WBDD|E6Y8fOpH|HX8@OF}|PNAuOBDsz1@C#^wdt{Eb^$^kUYw9$G%ot zmM5~m^^0C1BVtxGrwiCfPvNH`!h{@Ng%bY9{w!H^U@vzloO zezi7#!R`K^IoZFik=3lYZ}JOO>*zcv9v=!xb1rQaV`nj~yYx&c*CvS>iI(n}o!-V4 zT+iP5iqaZ`_=>!+;ol4|eEqAXH*i-UWGgAbc2`ZV^e$7Re@5`Iiqr2G*Jr#Pw|+lF zzf7pk^nd8ro4dn-o5@2du-zACR%Hso82{SB7@^k2Ciqz85BJ6)hEqxF5qwc-73dJB zWB)j(3p}5RbbC@kR~2ud=&ViHR?>(n3^nu+eKi`|gLu}u@T$lmrT`NqlQ=PPQ6k&7 zD>d|Q-_8$YVDue;&N9pNPForS+8g>DZT(&PTM&$1yqNtlL@OjDJSg;KfR9A+A}R4K zFDa4Rf9S^m0Tc!HAm*&<_)G6N z)fSCpjWxG;c9TQz2a-0C>jRGH@O)~>UorUjNqN(WCDRAR;l3bhhC+t=xmm>2yhT#Z zS2hvMk67*<LRV_F{`I%$Eq{F$rn)%d$;vpJ)ZV} z)$PF#GmmF6Z&odfyUXX_InWVHMmF(()i98^{A)29f-$(-3sjiql9BZ4p^%Z_0#09$ z%zKvnPga7Kk>lM)semHX|6*c+#@euZuJ}!#Se2laVmOQzf-j8P;OG1Fuj%F(@ZXX@ z?0ph$rd+UZxZLfV*)Q^SelH?4FheM~(%8@O3D2*ssJ@#*Ays>cpsO*iJjr46cTrSi z_gFTX(}fbx{@Bm@ZQ;UrG&U2?mgv~Fz8*ODEQXX~d$8txRI_p$ZnXdJ;}J)j=96VC z3TjJ4dAt8(>K(%?ZGyGY*!IK|+cqb*ZF|KwCbl!N?TKyMww+9T*1OOC&Ub#S>smkh z>8h@(uCB&ibq$-+NPWU_L?%C<{P5uu>e2d3FJ&~RcJZKb-Zd%+ z%hliIIjdI3ypvenBYf9`(IXj#_LB=4Fe;Se!#2CksUtr@EGYN?7lMPb`}lLW|5B{F z4;FLulTv_bGqzm(Go~PFYlj9MY#f zxS|BKn?$$Lb{r#!BUE9_OwkJ-E6&~jT%EogAPfUxgrDsnY4#}p@>xyf6Hg`|J_3fu z=uGM_oL1sgI2}i*L936PZbp7Y|1Z`v|E0tCriUq5$;L70MWHNE&a;P_c~14e9ig7I z0$z zz`%J@FUf^&PnOxVc)+Y<0#kNeMA zbWnTS_dzSB&cuOXU=pO$|K%Aqfm4 zPB+)zEs^R^WZR#V*)vrnqmHt>Zu`;7%D_a{3mf$J|AShR2(L;6!J|VoLs1g-{@A+B=8Y-%1dfJm60J>@9N1_C-(DWyvQVWksG4u zo0X*H}6( zrVaQHDqv~^H0B_Bu2Pi$3(&Rw{k94)lFtW<$aYS1)+ma)cvkh{`G;QW>U~)0i(=n< zFMU~MqwxJSvMo~YP&Qtfi(DV%2~-Pw%Oil+6d+3r7rGuo~*G) z*$M3~XMp+wQ&*qM9!asQAa}s2D|9m!5n1Fa?u*xdSI#M+MKJRFul&u$;7foP^eVJ@J3wY@jXczSgC_R@SA!7+%K} zi*1$X==X5_lH&j9FrFuz=QQ$aDL;8|955NRgG8TO5L}}MM_}vxOz}S)h_bvAj98Nb2NWvsNWWv5r56W9JpCjbDJq-HqU{7)pJgI|k_8Es zLm1`%7eJG|K`6b?Lnr|Q36y-=nwmfulc2KyxyK`VFHs;ne|`4lTPVd zczop(SQ%~3dY7&Km&1;-4iISr4y(V0v-ObkH5JcfJ}vbB-l{YGVp0UIwZoP;W%M)A zpb4R#Zo75q9f8ITAtZafCc;c%hI#*YzY)Rg3sn*01e=S@kX{U17F2$|8*siS`P)UmGLz@*Mr?u}9if3=e7=>-V)IGV{9PZx7KJ!CI}<wzM+7^bRa7yKLa7zaa&5>PH zS@%QnA6hNyrP220(+5y2Or4$HR!jV^BzRt)^c){|q5N4>eo)eG^irHQ+$KFfv`Dpm zw^6x5~q7g&~B2<8( znfjcna;S60akpj3HXI+RWV-~!PoFwW9V$p|16ojH>Cao&wdk~ELDjDd4C_z3Jn3CO z#>1M!Gw*SZPI)DJT1&C%$6MdFT`rIiA!|6=G$M>*uN%eNAKM=)CkB3rv>12%nC~?t zY#%dPpEuipIOyE-Q~R)Go4re z{NPIP#7}fY20O?5k^$Y5a@_Jt_znH)MYL=-XL|77CPU{z$^4LBHWl9fHlcpbR_3+T zJgmGX(q{3lY)cN&@Ro`MmYa?pe`__mle1EB(o4Avm`F0|jWha_wHnQ9G+jW3Ri6Ws zH!^#>M%l8C<9+vf`&%m$B$q0*LBO+rer~o);`SkfrZr@I3Va9Oh@dtWFVlqO%=_I~ zWm77-^WY-KC#vI`TGcF@M{WuEqiI{X42U99=x$G8I3x!5KMJqEy5cQxKm5xTGrpn*RO94>vrWJm6)Waah>=r_#zLK?`kb0b`hj>%r$1^8^J}-7Puss@nmhb!y zOrW>e7!WoyqrG3((!Y7pxV6ez+#@1+y%AT|tEF`eb&nxnk4hQg0OX$=rS5~sIZtGG zE=TRa6I&1*f`8evJMW+Dv(k0JkIMNoa@iKD31Lx)7SpoW`o{2cok@mWPJ32+#gZD) zw?rXx0yKD9-146}K6lNzN`aG^=NFL0wRc@HKqr3Ajj zr|7e*<1%VvjRfN!rQqL%mvndPnl6E>Rln^Hq%F(kBqMwr{Y?w**;3ba_1DUs*ndAr z(I&RY_>eBQop8+raGn`9w3aUCtWA2|S$#ETTF|r&hC(eBk389T9c6hLF=DShvG92B zb_8p0A3v=F^j4x&>|u}UjnI;2NJ<4{S`g7Uk>op7CsEat(l?A8B3*bzzYaRp`A4qm zQgs?ozzaYg_Q{MB>}JxF$hC+)koZ8?uigfQ@D6_S?_4p-0KZlVeQ%B!Q2P9Ze+{&a zqH)+h&hWZBBSg+Ge@%zx@Rs07fzK`&7Q_1CF;JV)_bj00A!t?|r8e~wzm0byBsvti z^)Hh9{0*MTNhhrHZCQgHz_u8qS6qj}IHbyd!(g#R6v2dIhU0SzrO97&onL<#5Kflk zuRb>B$;RD|n%aJ&8T_(h1#Ln$&BM+4hX)uvZa(J*$FylP17V5)WtsV%msyO*vG619?~hjn1P!mM?hn+ zj|+T;Fr$q8b5u-iEJ4c6*T?i6x8N7Wc6Nm!*wE;Czw}g7t-SM3<_MmcF!1TpNdYE6 zHTFdsAnSGg-fqRK9?51++u%r#XPkaHrI~+fwPs)YMV#D?orSZH@lQE|{74sh_+8EZlR14?_<2%F z$jtz{24xqv&rXqFaOM6~-!77IvLPT^DQ)eEGO5;p@HVR~JCt(2Zm%;f6R_xM!M{)#Lud>ruA!oRtG84=aX=+%yUIwF|E1_)(A^W{8%{jr=V zC%s>s5y4u`fNqu}z?w0KmFbM{sGqRdrYnVZ5!^k~rQ7|joynBPtX6@;wB>3lWJ04d z-0-V);MM>HaMbYLT?UF3c1g>n0_mO>Fd_Yjn3IgxQOsE;E-SAP}Z znV?JSoa;>|DZcOh=VYV5WW-X?1K7LAf4%==R>O74C2Cs)N?1v3<*j?`L;1>+#_zM$ zS0(ms=WC<6U&EZAEyGY1Yn0?BbxZ+=j<_{io9-Lng<8%}pUUMIQmM1^j}Qxol8K>* zv1duq@U4Y@5LOl}u52EHl8f;+q6MEf1P~j*A!KF9MxMyaV;AffyFApHY9_SxVnuGn(HVzC`!M1?*P0KtP>v%p$r?PEO0j+ zN}9gPco5=sAbKtf8U(0<0LzK)lVAC_DikamM*8vQbO3^BfS}VoTf{-cf|GkG5eP8z zFo+mX^qXFIz#dQ(Zc+2%s8_=U|Ar zjdO{<2JlE|SC!?ikj(0>K(u0{X_F45?BDbLZSDs*GZt}qHa&N4^FG(&J)L1W>NkW< z$b;eaPy`CATJ`_qXJm?K*$mUf!B?Dslt{0mO1iiqZf(2zhm@_baL`JG0~`*{f5Yjq z?2N_lnL$Pn&^Ss}Y+GA8B#LO@8>%z7QR7Ko`jcjmtBz*<2n;uD5V;;I+a%=jf8}L@ zyTVvDcXeK6N!a3Ng`g@G!yf$WWFlDy;E5VJnojM`X5KBzXPSxI}B^`MG%^+)Q!Vjp@Edcek1s&3*EP?xbqZU~BR+IZvaLV;iP)b=b>~?7R z*DI=1)yW9;Z;mo?t_rBJ$o8tbUBQbj;p8KwZf4EB4~YcT9uNZDijmQuP&>-d}yh-(inq08#j}l;x+k-}m$si!p|ydU}{yg>O#l<4IO+ z>fuaS@moJf(9a_%gk@E&f=K^p$o?w*$~}!(Wo<$WWxUx@3L#8lFnW{A2%bqylof17qq*3}VmkH%VhFKw zN4*dD!&_{of#{I-qrP0?rO^6uqW%c4noiLoqfthj-=Z39|=xYXzTw?l?hgnETYHr@862i{LXl+#*Pisor?dW zqbAMex(d=X+f9AiL5hWR&4P;`#j?1(( z%MHydTcMzVUSfPZ*d>PKXm?S;X&8An_WZOrK|>Hvq4+!H>B{B;q-7rrq-A65*g3<; z8I6N{WDr@7B=!`rutL7+hqK(JiG$V5)@R40wrKZC2dq-*tu-HDATQq=&Cq-LPRQ zQ6v05y}ys;m~AzZ^mO)AbJKlmMS-oXCTG_ddEA z1KH+I?t&-1OTkVcXZ&sTXiCBdrtwa`J@@G?u$GfA@S{IMB45cAR)tTCG?SAwQ;(!k zr{5M`#ZmjZaG$P>ZNTY+B{fNU%V?=)oiZ)RLg6*EPW;Cc8j1mP+(!G!klkD=KkvyV z)(@F}A1Lp|XmP9ljFB#nV|YO+lDGAQ4PYY=v3c7%*15d7R}NWTt92Zk{g%WX)QR_y21kUrtmxzsyZD0E-Z*-6(MEpx+H~?V8iz__C1CosVsOroVtKW-eTi zN)o*5@DjVYs?um-h9`FQ+9Y#v9=+0AsLF+AH^N8XmQfzI2Vw z#R4G3GU1%%DTUKd!eaz*$_dvxhNmpiy44pHyWA62Va@HkTX}yL^$HcZ#B5R))Jdk9_}~Id|GAf(eQ_k6Rb7ZtK+Y zt=ISWGpM|dTkLk4<8$)}`9=-_o;pg+PKBiCaI`M!vH%V;GOR%VJHOw@S{&RBCbj<;H`%Uvbr^JBE zI(1MPRbrK2X01yft2(V~dz%Si`JXMkbn28?P9!jj(Md2(_;RLHdbaUNhd8jJ!o)dq zPCCb#gL{55m4`#)PeC!7-*5+GH-c)xzwx362v}C z`m%-6F^cw9u}LPUskcUNgv77_q1d)9@k#gi8`y7fB!b-IQaFHXYnPHIqz8?!E(wC; zj-e3I#l5W#&TK~6gisX6oR!w)1bd!8I=8wEfq1D*KqVth70-`#Ew$RBskQ27W_C5p zkC*la<=3u{G7kPLMCYgMIB(aXdf(Yn_%_Ds7X_)l)+geM1B`uMzLt-UGS&F2?28W%+#xg^rMt2)!TK|izB=vT&E9oy{ zw~Tf8XIawQpe_e6{YjJiZO@gMxzsB@*N4UDbQC_rKQP9rVp@}bX~oW06JQGB!_xdr zH$@qD<-@VZ2TeWtz*jIj4Yj>I^1+U{fPa|eI9x#@dFW^)%3O#?-yH0?O?$EB)GJyJ zg-J?x(cKgOtb3b~ZQRh$r7*rE0fEtJAe2tD%=w|>u4MBstre9nig1RwGX6JMqQvO{)r+)455v?lqGFhMnw+W=7+7TH5a zICZ1Wor^8OOpAv>cW2YhH;{1|Guo77q;G!@qNyjK zgJY8H<9RQRSKqLv+?7{wIcia+y5X8IsZmES^rlVC7)Z`t?k&~Kmts0R;K+#p!srh-5k){s~E#rqD!cH$rY%@J-kS~rfOJl zTzd&IKz3MMV{t(Q$3`E9s$c`vo$k1aZMpm}g(nfyA5YYWPOU*SR318)u0i3R#6j4TWYV@E#)xFXRK0C<;VW#$?Q|7(UHbT<*xtja^=`lnJ*%DgMZQl zd+q8Vq&*c9dG@9OcLhdP5rZ6pVp5BH+p`M4$qe;&bRuM?VbeJyZH@Wheq$2pit2$? z=U*EI%#y{Chvjq78Iy2EIs*Eyvn3^Zep!^9KgpbE?6X0Ts%lD_cdCe7N8W#0iuML> z$v_(z2`+RxmRr5K&vXiE)R$`--yH|4X6CBgNFmr2(Go5-x{4HCTHo-Ex;(2gL@xDj z!$$~*Cf|Cl)L4FQbWz_W<>Hc z_Cys6oP~*F%M#c$qP87M0i{FgATt(B`84Rd?|e|`>kS9ce%WmT4~2Xt`c!GhPT9kg z&2}4O=JM$_4buO7p_1Y#T+%Psi+-2a#Ng%Y;w{a$b5wBKJ;ZTVEuT&mbZTKc!2La- zeSQJFYmfIB()i7(Yjk`aeZRE@g4|11j%_Yu+;0vL>eL|EABhMr;rTXlSL`0W6PO~V z>3KN4A9rQrI{&*pEX&Km$%=;p7zzmxr@xU9-MzIwqt<3goJM9m>b?{|l@PTnIwhO) z=Cb2KHdFjCCfFacoGJ6=s3>|d`Q}r{TyMBK+@p)tO@*#8_U1*ALD0;G1Y%4B4-OxP z6nkbW?&q?x7e3R0<`@@)c3Y_JB{g`+B)r|4Oc2+e<5s3KxA+@a&A52bnidX(@aejJ zMFz<`1|5-Hrr=gH(5dN7lu3hB6uZ+GEOaf^o6#zrUl_CMK7!?E})!VduswZt>y8nr*aor|Ruu>Yds*PwTnT zB<8rg?>4X}8@CYa`ZP{5FOj=-S};y0yoK)}cvi-zZ+}!F9s3oaKp4h=9uGT>gwF|k zcG|sjviwSwWy?dOL_txQsDuiwDibHI`YRC@U0|Iln?UVi*eZO@bY*J9XG5PUAei;v zDcPS`Llo&?)z>FX`(9Abjnj6Kb(M|-LBZ}O`wJjYEe50Z;rZd$-SN|T)YHf~V4ZYm zL|~D9Cm|reJJ@sc;moUS93qZ4t|q+Y@?jO}r~I`S0BFQ*RMnbL~{3JUM+k^u01r(qZViUl5r0ab_mAqsv=PU=1vP|AToiz)v`v^Kk%i7qWh z;>g9#x^P*K^M%|F<=QT859Ey-9xaVVQu;sR=H=9~_Bv+a6B4T)D+a>ZZv6`6yzm$2 z!En-|{ruvcq1T<4X6W#IuWa)ti}oGCnWWVjO{*svM^CiLi?upUGbS}CAA)BOc z_vJg3ldmV}$CBtt1o*7?*H2HYU3oSl;uF#m>{2cG6;EP*o-c1pPxlguQE;c@ZEz9C z^un&45&v`wGG1s%-2|%^rwSBYmUgyBkuF0?Qcct8WN^` zim!#e#uVjme_C!YP^5a#fdZ51(5tw+Y z2+)+1o2ijeHa(|j=ai9G+^fDk?mmusIXPi?y=u3<6X}v!_D|q%ti8xnWHu)Vg-rru z03HwKam5{mwrsMn;S72mHE=j=;SALfkLC;B;J2IHD~ZI0qON**-Hhn#Zd@sf*36<9=y9uwswcju(8t zhA^v|fgNT`;E3wjXOJTF&rfCzp_(W{&2rk}C-BYQhb1WIOg5U)w%IO=1cMNvkoI~K@9>d0Q&Z(~?(gTu0$(b(Ac?!F5)0B=06eaDr))4OOs^S;c zWyg)Jpk>A1X>F}`06d9#@o%^T+s$TzpQ^usRW)ok>nhjncj`Cv(>lD}?Kf9Jr0S$i zQZz}W-B!Ndf@ML-%9MkWH7#y@R&!eDJJB*EO$A=b1pMBEY$>`dEi=B6Qn_{QMykA0 zZtD6LA5B``z@%+c6}=uvar!weq21j#d!)dP7-fki-60In^kK6$AQv09T>6L#DVUlz z1suyvnwaB~e*om|XDFQskyM1R%^9liVLj6S=xb(yvH#jzy8U9su!LBUDu+KRSMd{W zlTWYF0@hNXuG@uLMC-WSc3^WBZ%u)-u!w^gpc)v&9i<`~Ie~aXeJ$E>>v3IY|7Y!q z2CYhMy<2>@3*kB=E>b(!AbQT;F!onp<`{H+Gy$<8OgJw~TnV+2WajXDV!u;%0cC&F zzRMhZJ@GYw!vZ_$Y2AY|#Elnk;TRV{w)=}?>0c6q`eR-s#E#(Zf_T??Yw)2&zYdp? zAXdq0@<)~p|8Bo>(m%+AlG5|Lis8qwg@8~uB+7`7ihK3|<`#mgUu{q9+_|{DkIK?R zjy=p`TuZkzI_2fv4^K(kS48{-0f~Cnf&y$Ku}9t#QLqKP$V?Kkw!4%FB*%)0eHP+4 zX0nS$_$k70pw6wQ>j7=10*2FTL#A^CHz6onPKj(HfKs7jn6cta>oK)o_wqlt;}c-5 z(;nN_uwP0TBRX z&R1k87?!eyp!O%sAViFLLE@>OQ}qU_D>0s2e72`0H^3A;-3aB&A|XO16?!7#NbNA3 z51IJwCKVr#9!PltNSTiNAO|H;lpQ}M8`Z0WSu}u-3Ch@%UeC4_7cy@8iCz~Q7a2LW z1&a9+T(~ggcL>xuU1RXem5$zF2b*oqu*}a58?FmbE@*=>b>y6-9u`fg2h{S8-Vwz$maBSWRCmHH@*-v=E9nnYi$G0GT40H5EPEWq#*8h{4#XF@ZdyLA`77H zn@{-{7_t@ot4vXgs4_<26Y!aSUxyYjZcMnql5 zm&Oh0G43J}YikfzrZTPRO4W~|SVmjOIM8X~%42BcEQgEVo?^!?rnqaSL8FtRB?+V! zDF($(_>E){Xs?!$BEtt{rsAq8R)Y&vc<4XyGEyfcO8yfk3s9US&Ky_RYxDFhq)YQ( zzR0^#crLPFk+z6U9CFPXp!vbN!cTtXc#a0W#cX1tiiy8!{^d%{mr>7C?7oiHm=ZQb z;d8@^>O=aB0R;Exq|rP%&DbrLlp(Ar#NxwAw_)+tQYIzb{v&1yBo^ex5&R!9OPAtS z!WNMIVpu+;c(K!Tu|5)3tW(U-2blS@0P==02&qhHO%jRcD3<8pAlB)qWO1i+RzfM- z+R;=`&6GB(hlG)2L`~^q@YHNQ+0>#tc^D~NMi&Vfw53^k$wR)MS3W(2*>@|gyQN>= zDtW*XB0C-{4mCBMl?Hy@Zx>Hlp$u&Gm{ZTGqE7{14w0YMdgY^kXs94A8+fO-kqMNQ zC6)a?A0+qAG%0|*P-lmm{l^OlViZ%tF$vRhscWAH0}U3o5q|NHL--?kYFRrv6&|9A z!%O1|4EfW;zZi*#BSrDHr^zA>OVE!xLarS;Z3`W|&W9bhf|3{*ouC(Je#_f-M^b_e zvWHaPeEnkbb4Njxcrj5bJjf!VvDvRusHXROYRk=r2?paA^wZ81=Vq7>Y*iHryK2^= zmh-PDxIk|@^tkzvy;&%&5+BDTUgdZ z8r$w={e(taG-s?%Wq!a&R1>qtZ&f2+hL%vc- zOS9=~&5C-jc?(lbNy9h2OeEzLWc~SPWWpP=$hZ;?1*Rj#^2b-Ao%qIO>-`!4_7+5B z(BJhk3?^xwku|sYOu1X_qQKO%t*W>1+(If@P579iOvX-8k%tHasFDVj0(csEm0vZ_ zAuND`ApEy*>yJ zJjiPzvDuL{QlD%lC=#Y9Ql`59vSCqwIgLVwpl;n;lIqOAj$#27c$9Dsk%h|Q!B7@z zd&<#hRX278mtdrKhobrFJ?-$A^EU>8V2+ zWq+8)`K>wOZ`sk-8AQniw_1N=3b^)L2^${C&j)=DV#vJOaxdnc{7jEV1F&Kd~-sck6T8- zbP5VpuTYK~nSMu%tcib&IwRorh^9jdN{r2#cqn`xs*h@zM*X zhQT4ECd6fp(h+Um>gOkaJKXiZ7Lh1@r-h5l4NSGilx&8p1ClIRlzY!Q0^maR!w`ks zObK^{PT>$S8$&65ND4++xz%y4E(iEpdIY$T?-lSk!D7ecQNQT0=)~DB^AFdGBmN;K zkpNckTI93(=qp4*I#gojq5k_+{La}TN0~4{H7TOF#_R7WMQWrAKE>aQOmBB3q^Va;)DF(9pb5K#%e=b$jmOH!IyHYMeeab zF@;$+)9suYJ7)~@NXry8DsQ+7HL?gucpwh52xj63J~&Q`QQSY?;n0?EwYH2&@OEe% z^aa1+73vSG1Mbk0^k(J4y#r9$6(wgmS)2{UOYC{6=$&}he*?!QGbzODi{l`$WgWiG zSEYe%wrXqEk@mFyg0(cv0~*d=`; zTDz$yyYK^vrd%nk-AP1cmd})mT(9pZ##*=J#mGwtE|=NGq1rZKwWPx}32Q}# zeFUHJF;6QO;P7<^@OrwPW;wVkijSt-HyQ80rwk^2zC@MWo2$>30OW7iBCiH0_gscs zOOR3bb{}9hirE&k-Cd&>_R^v(?MC4OCYa<#DmszWhxA6WYIvAr(d@w;trn$3QQOOmesdHZE~DGx>2@z|#Wch(NAROd+?v7EB?RVRzcPem1w zk*$Tj7{me-o=-+YipU{7D=3>po|2UZzjpHOAKMSsQkp8qV~JELjyyimKnBSt1LFP@ z;8U^Thg(i~y4bML!j; zC-jbn76p53oGk!|5kpC|zwDht9&&0fWuU=cS5z zKQ70QO3t2!d3V|zw|47|Pt@0ovCWq(p^Q=5fOzPq&m_p*;y4<5I5jD@Es?PQ${cr>xfgZQNbq(n zC^eXx43-bq=7^L1HY=;=YkA<#<+jFZS(Pm@dwS)-H-nhcvaM#8w%_j$4r}=DxA(0I zlOrx4ntZhdwR&~DUhN_{r&)x+4vdt)k!$BmGt}A{;+fsMZjo z_rmXv7uex=Qi|mhR^}^Acg4d@BlOEb&Z7a|@fVDq>QGV{jU)&GC8P{EwG$y`p2MF^ zSVrmXZL_R+XX#TCJnbFnB?^+mwXkm?!?^8;ge#q}t|HC<=HH>bjRlNqu6aF2SBOo= z#XUdoo{rGrBNTB+!N1J6&K!8H_r4mtK)pc?!Ebk_dO;8=3uZ5h6WXu{ibN9~#TPTOX^s9zAS= z5cA&Uj?;Y~`2tuqeHi0V66YKKJzq=7BZ&^g_Lysh_8$w>^`jK%7=sAAyZ_19!KaL& z6J2(%12Ow=!gs+(-bPSba!sB(qX&5fF}0@J>yM~JFX|L|6xN>6hiu9pwXB>X)Qx>n zYd*IH9Z^>8K{e#uHMG;AOzp?jmT|CV!ofIqXnrIjvrBpASU9!c&-E(4aD=3i2*a_5f=fYD zvTie*Uf_ZEQ8xuUUr1FJ^UMUM#UiONX5b=fo3=wS;vf<`y*AE_P}b9R&m$BOm>EKC zr?^USm7P=rK53ynAO@$y;a*AswHfb5uEw;qShHagpOc-bBN&3R<-|b!m8ZRsanmi zfUd^iJPv))scahC-I+@TX)UT5Q@)ua%{Sl>T6c*nF5lbh?P6!_A&~dcJU4A-z6=z) zk8LHl=02)x=78cDNdI9?F;8P7!|>8L5q#<=N8P-jlx&&=OJfHWc|YLskVKFX{wg1$ zT!^Kc0=y<=G7?7(o4+noP918Vndj4j`)1 z3i&cNKoxuDGtKHN(&%&Xtk1Rs5pK@@1C%Mg>fn<4crpgILn|0`0ERT2x6^$0mx2*v zY^)tgOZzhH zMW=LuT-rx;NQvHE_?|dXNHgg6OT-%Nr+MtC=vwjiM0Xz=s*~Q$%ae3B4{1W(7PY?z ztEjZ&!5SevLR__0i>Rmlq(!_mKk)PIbglvgF9rlvWf5Z`TXoEiG8rhZY0y-WS~SmN z_6m2o5RCo?Wf>FkGHFhrR436kSNOt`!c;YLIT}#I%x7@K%bi4fR3gudOb$wKsmoAo z9o}Z;=B6c*mA_GEo0KIwo$mMz*2=9Zl&s84U?RsW4CRQ9Rjkz)$#QI)k<9m02s2Az4{2c{*Z8Wb;*Pz5v58Pc zz2^3q;Lfs`Y->nt5gV{h<9m~(M z!)-ptYr~@gL8PaSNW0k6Nwk)X;jy22*R6=-EJ&JQ7&V!ATlh)QC~20A0PzjOf= zb*7%$Fjyz`xr`TdlLZNBNr-w=$D$frda^25ta+8D8%kzQEP#|hC3f|X9nVUa*SJ5D^S70c~{wQ^7GugDGo9-{Dmas3oc$eztwTZR70`luUSG$;Dy z|Dw*YY5!amg`v>AO zEwjQ57>;5D0ZTz?f|=A2XmeI9yMn80XRJ8>!fS);b-5g;#*kaZR;5Ke;E_><15N7c=ff;pIrSt^>I!QN-yDPA|NwHhO#x!G7(&_A=Hqx=Mr?Rb`b zbRR(tz))0-W-a4&I+FZ(MGPcrxD(OzF#X2*X<)Q4$g(koQ5q8^5^j_DYAR8Gw4#>0 z`h=7N7ZVnFS7w@nlYSY!Bns1P2H}k{k9Ul}-TIXT+4M&t@ktkoejEXVwbfQt91Iw3 z3EovZT`UMK!LQPD>VZZntpz96duz$k?aMs*!ZaPu*G(R#ir4Xs>zkhP!QBRc^>nT8XrMYFYC#sP%vLTYgmY^*w1=vloA#rGgftZsGMb?|s?P zIdi+$N)vi{m*52-j9oh&kM6bA8u)PzvJJp53l)*%VSf@7`c?ewIoCmkLOs7SxXoec zU7_7*(CV`g^e!TRg|hecP_ijN^Zr%58K`l6$rYmWgfm&xjBJ{p0g!mPluX=~ z$`UJwu};%ffNz+CAZL!lNW$la2cW_!HT2Ga>?9ONGp13?cq$HhVqjysV^>ew=>i9& z@!x958r5PBYQ{< zmSrxHSQW0-*v-p@t~V-9-+h~J{a|Q;2fissZchPWgZu%L7=tD~cik*xgZ=(jTn#j! z9(2y1yrf-^VFWd5I&j)Jv_6Pbdkl^`^l-!`3^>1p>g`;stz@8gYt}) z#y}5o19f#4T!E?fL%}om!qr0vi7Z9r2p`F2G^pEVrjYBq+R$x=q})D_pEO2Mo4)A)6xXBQ2u=Tm+cFEM zOjY*C#Nvk;scN`Rf1nZ4CFIsuNg87nImI6;HPIFHSC89%*a;B%UjT(gLmIUfTh`#b z*IL7kPGbw9^ssbheM<#bj99Z<8fkXgo zaMVuKT7W3!KjoG!(52fem9ED`zKsQ_HVkR>60CyGgJOvOX^*>EsT_BwvPI)>qYkb8jCw*d7l}HK7O$NNF>E}N-g%p zXA+_gSj(;NgiEWEOk|OV2PKAV1zA&^@)1y70B(&yN%Avq%SVb%ZL3Objze&i=xbyn z!~Urxzw4#xz=^f+0}}FDLxPcvVQ!(0(D6VBiy`T;LHU*zUC;UvGgWa0x=2sdZa6Wa z!{H6wwF)FCpX-i!1BPkuAPEsYC!V(hpG=Td&o6AWBC_Fcs`W# zU=i^B1*nK5R4QIXs2#r?@irQlp@!!On5UJb$FgI0fuX)4^8-q@$rL37J*px3i!XVu zN7}`4%YbRGf8+Sk+WS(y3wVPu$f%)`7KCgjB>4mSwZ;S+C|{V)$eJZkF53Ueg+QW! zz4Vj|SCqTtU=(ZuTwpKsC4X-TuR9D9#q`irotO z_PmB*!2lhhg$r6bQwyr(7CB%hNt-)PQG?}nWD%+PloA~ixrb6s1--XtMQl+!-E`43 z+_Ehgb*FP8+Hwu1hikuPoh{t++^dQq3|?>FvQ0%u?JFb7I^<|55*i}rEA@^*>l;-k zjqGS;@DCSvTYc=*3dZmAG#2m)qBX9ZY&Bb{~Lr0988U{>u zeLuebDo^X6CwmpRgtf;9AcXs5$CUufO;V3!DwMpk{Uha&y)uz|!6KhcK3wNUKH!rC zPyH=cN2NJTClee}42!Llc-TFF?zorCs`j z(2`(2zLA}%+SmHFMZ@6%Rqr92U0+8HAvrXssFIUwfjg({s0B{9`^vuo_tba3*@4{1+x2)w?yi=} z7Xi>A{m}TK^1hWftvJrf@Xj%Mr#Frb+N%lREs(Z~6ll4rE&mSHP8QyMQ^|M1N^1%< zNjS1t)NAo4a*io}7dw$l&Um#}Aj<8aT8;u~yq1Vi-EQ^*|&B8Q*YDQ7Xc$yT92iY?4qc~ssPOxRT3~dE48*Dk! z#WV##l6X#00Oa^CUxstqBgIhZw$EA&l~4oJ*y`=?RSl#$qVr;R2mS{GsfO?P8gvxY zH~gyp>2v>2;Iz~cSe4j*bOG>98>n0)rG5c=puAI&-2Fxw9}m)^fDOQKrWs9DKGmy( zf^KNxttf;9y+-G=<7_k`Hl3p-o{2*A+-C>1@FcFnOvE9p^AfnhtBmD&kg$Z8B@fc5 z=G+O;2$zwqDo7g7UvCWE$km-FzpYnCFVHuRF8Y_e))+*n_R7(RhRAML-yy(toUr@a z(SH2tK~^XK6_9!qMYyA#m4f}ZW~1=|@>ky!%K#>XvgK+Sop{6nN=`LpzR*8$YzpLf;b(E!BSf z&^k7NIIdI+dBOA*?)vk(Z!z&jQ6%XDx-j$tyeD|OSAP2*glBbuFGw=Nx)!WM#G`F$0CoqByJ}0k>dPo=AnQ^tJoYC-$MI&@3k$ z`thpK(4NUlx!}1{BR|+FO^xCP9GaELW>mCBQ(Yi##%q%2(1Y z3?EZ^JiSlHOvzsyV>wNovyocZbj}GTODLl?kr%8E^NK}zT(LYVQ&wiVpO@UP6L)R0 zaGBaCn8I3|aDvBq<;G7i)kpuKl_IHlS6Ii>oTd`_tj#?L7^G^kwqu#U2;bq2uEL#nA(uZ^) zyfctAzdA;)(;|<>GGW4x<>3_pXMk*BK^6eAC0NG3vw%yu%%G4A3N!hIJgRtl!TtAM(|mdCUvGDR@%~VR z$R+_=HUp2<@ncMm=Q_q@qw!KHi)72<{g9;276+%6OGR7(Wd|-yLc5 z?V!C+P0y;|__HeVxt)5f$w2azN|gIT9A!HA-UV-n6MS~qo^06#>*=r?*|zhx|E%eD zy{};Ds(}1emwu~qU&Wt5bl@2xD^#EP;y~6+;_V8B#>v{j!!!uGqH9+AR_`iH-J~XXdm?0bhaz+63ET9UGDQa^k z7pAZREs2nR?^w(P8Jk5fM2}qXwBkT$oaeEWvD}ZOL6b!+uJSxBi!k>?w>9qD(QKcJ znaz+fGUz%YV^q6w8KYZ{$ru^dcHrjeR$m)=vbbimS$MhvvG)P02yU6WE95?w>pfcF zgJLO!G@bH&ItUy$dG(OM*o|s}ND7L=y){m&n~mb-(LYBnAysMNaN4c5&v?ZULab=- zOv10~^hMi??Y-DRDj>h;O5bWBR6p%2R4M510@Q-oR12M<-#n-kKt;U)MRg!c@NrY# zZJQ02&DJBEd0u#bV643#0w_zNcxL;+H-o|v8o>K>g}T~ip(=7J{+3ResJ1WLSEj6% z8U>-m{U5u1UA4$tjX94UzY2n~mEwiPl_ipd;@V)z50Gzld}^3gw8n}l?%~* zs6O>U>tm$71}$#rCi{=~F!*?szBwOq;Ljp3qDRgWzbJyDWPZfu6^17{$$JU)$--d>tocxZzs%GQEgf2I9%lw zL$=YtiU4`oz>7uQv5iiNg1^S{Q&<%mC>;bmKlE{@PVD&se}7)UpBy;~lVX{KF)NEG zW|4^H6FXUkEDR!EimWXCVC06h1OC1{(tg&7rMetDv2@UW?8KfO?tjwKyR?oZ8QDi2 zX!Ien#q}o%lfgM4)Wn)NRObiO{doa(a%4X%$k+t?l4iy>O|KeSZJi)FV&Bsp`xd&I2?M1Z!{@T(M6}4Fe&`+|F zwt&=V+s=EgteCbl$6l*)w1fZgUaAVk@)h@L(o>W!6S!)J9U#6D5+UKWCQX7D-AFGk zJaQ>L<48NUEF|MrZ#1dTd$8BB!_~cfiPoPZrBs(=Qc6ber%CDAumO4xNGYXSP)C~(#6zJ` z#`MFKHxOMA@0cvA3M5#MSiKr_dFsLc44W{Wu%>L=xTGQk9@E_v+1Gf0M%AA|ZX}kI`~HBFg9E zD*So43UcH)33*hNseE#z5sNYq~Nu*00d#7o)gx-PK;2iM|ek$9;o)%EiVxqo4;0W+#Je0Q~h0|XTQ zJ--g6zs`r&`17DOjZfBJJ70fM zU5@E566G^Zf1M4jAzOCN6NHFC+;>15LzpQvM=)-2iDskWW3p@AaDSY^}cH5k54@8#X<_6{tGFP}f* zO1^yk^lD*>_CZ*sMNNRq#sIVaz5F{-OL^RBf9at~g`t_Pcme$M$5&`uL_Mi>7f`R2 zw$$aty_fq9Dxob`)rXOI=3eR;*h^Dr5Z_bgN_wRVq?@dBUY5-sssloffHhk=z`HLu z-phBQks_lq(RU`<|J8-}n)p7j!w>rnXsK1L7OT$15s$Q1kFqm8zKXS9Uw;6rcerha z8c5w3`uZ?2FvXR9p(GuQR=jBB5){?9onWsj78xfrR9+R^-J|ynPytuE;L=w(pFsNo z^@+B?;4y54=U0_-6q>>hh)q=?1T5A>DB|? zSOf`=d6J5PI~8$YqsIcWuH4y*nC$WdG#S~)dw$HFeC=p4s)yZM;L^Ed%RjdK!MhgU zKWXv{%{-%v#YqW}0$ibcTSZ`+ib!Uq=O){BM83NI$f3v$lG;MGC7^Q(?ij&vB=z?unbiG*<0!1!pT%dw^+&5#*rzW9dvZ-LOc2+{VGK23x zq@I$?jd{LIg)dkbffUz4%)rybsxS~zoOvk?Dz_Bd;JM)W!E3Bl-zV_#@=_nUTI=$a9cox)rz@dZHUg_h=-41?FtkQ1#d%H zdq759>W(2NH$f!k@wtpOpU&Q(8C}%dR6UoPEtQW=F4&LboEN#z;!tEP%9k1ABFI>g zMP(QkNs(r58mPcVy9LjWb|bqyMJT8~XrVY8@%E(UKqyG)o+3X2x5h27E-EI(A82mw zfL>BbL9t)00mV7E654VLv>g{-hdq5i;QjNEyzvTX<9kB-J`_Mm$oa6PU>?88So7%; z(sLImz8Gc-MKeWh*D_Tsi;@|#wp@|dA}%B5FQXjtwU#XBS-^rajMAuDE^FWYE)Q({ zRN#i&{Jz@mz`-Qd=C@t*;G{hvyLw}wDpws;MLp0b(ug3k?1tgiS0)`WO%XC>Zzc&*Sv)_Wd!{NZD?-ow6- zs_Ra4yvZ;Zk*OhdX2jGpsmcrPBEYr1djYYa}!lHPnkiMC1h$wyn+cRdc#k%9GR~ z2T(OUU};E*nRKKbU5N9w2T>FG%Whh#hu=Ty@;Fc0m;#nvX;1KOy|4Q*)o`#}jB}{? z0^++1#Sya5L64?bLnY8!&hm%yQg!h6%O1Lk$Ts=odIjJ%qgycfR}TF4=0kJ4`cw01 zUCC__8W!IT1`%H?22;uhjI#Q+c=$CdH{1am_<3WKX2b4QqC`Ji1K?CFm3nlZs)pW$ zXFk(sF10g!r^7E~Q}o@eFqK)KmzVM&zJdw#o@V?az1^rjjw#p)SqMW`T}wps%EL?4PxpGdT*|-<#~Tl-V6)?s`RD%2iX+>hqt>`x$dG>FHo~d>$Z6T zsZ0C&jV@Ur4}#hLtytrH9;5{Q{tA?YpA7XYF6$*P6|kdQlZ92hfHwv)6zxzDPQxJfGPRmb611gTb9 z48i&krP4khj9i1Wr`hh{jf){#Icu(-zPd`B3hfS70spqYADY>^II>#wh4-J$9wX2{ zbjPjP7p(G(H^@e6Gkcem0SN#%-v9jI`r+30J&n$E8I~%LH_9SNZZ1hQO17AwBIW^E z$&vk~N|9tD&l46U!iOS@C5w2)^Rz6(%6Frq0~^R1xPh!EsR$ClI#Wf^g$-RQ;%rgNx*5yNo&HI&B33*7P2OyLzgNxX-J5BtEzoK8>DY= zqu;ggHyyqeDq@9_-jWRF6HZ!SQ%15V6TX0X8Q0;BohxB()wYd)zA$6UG z1$Kt6f)B{$fy#rD@7YO9Jq1ACn-e|FFaEzQvJG>;@L1_vgPpc>?*K8@2Yw`V+F$grHs!s zRb~OC$yNsNDkYSn`^%~68I`ziJ7*N?ieB@`{*{!%pM-jSwYubze)etzpgTBbEdqeQ z*CFjr8Zv-*xj>R@DZsjA(`Qr`!gh#(^8YNKnV4(ZTZojzo&*AKqIdYuBDam@y=)3ks8=zY4ua*;oIFa1{rjEISOg9rff;OXKoCGt8d(@r^S zq&Ij2o!V<_yZ8-;C(Kly&eD1tOGEBu_{zId ztKyj7>TaM1T0^bB&H*L=?ou9*PaAPSBxYO}N_kxHwT)l^<*o$R->s^UF))QOY^04(m(H5GVPM0p12^3I zq}zamS9)55`wcf{^sd?)p7ZaH^@n2;Z(@1GeI)wM%!xjKi*cU7vOOSNI za7eei#W4}Tc{D6VXuMO)iqb76sJnTnW^&}J3dFLCE0(5y1)hGvq{>^e5~9EnkGLPX z!@Z%6Y7X6~=2P??+0{&aNA^3e@5rX3`i|Zgr@NnO=KXoU{;7T7rTDl11tm4X0Qg_# z{d$1=`d5Dc@E7m(Fax|>sCQiPk@J;`PX$ml=0iD{1_NSjv)M2?vHKO|9drdi6?@hK z(G^b+B)a<4VQ*b};101H8?b4*y!XzF4+d5D@a2h&QM7tujx#cG{QkjXrr?s+w_(os?N%SBh(VvUTGi|y2GcAb>_8ut7pvn ztUwgFQ=gz9g~0v8;5+doCr5_U%5`dn>>q0ho442jVuL?IBob7n%}%DlCF*-gTdJy7 zCZTiz4`gAOT#cC{m5{=7fEEyca)6ok?>+fjCk0MQuUu`*{kkw32}r9^56mr^<(nIFz0geBW0S;~uL z3M|V-ET4rUW;{=pEDXb_uIj8TN64T;8zLXNA@V0FB@#_OQz@NJ+IsD1HLjG%EwRvW zgM3`=H*|Rn9h;*t^x9WsDT1Nn@C+42){Na^L3WUN6v#C^w`!Zq1QnIZMD1RQQp2pa zP#JY69`p-_yYwtL>?)J`sWdJE;#9!Z)=)~;4>j9D*I-rCv339*T8EpUhL=jU5W{%H z1=yV1=3$HZwH+|5^D{jG;sUAeKqDXBnv0>kk9gghP>S>Wsi~t|7QKY%9#y@+#jD~5 zacWmmHAjqqxRcGg7rd|4A@S98@U zS$&WedDe9RxZGB4ht+MrcpDx8M;yR4`9Tn zpE8i2@)%}Y4y}x0aJ_bH#{Dfe@Sygmr9;s4KE#(QC>6arm)rgewi*j+z4-dW`}8P<@+f_RuhxnkaC+QIfqUwoKFA{L1A;KOfnvJso@tgc zQsK-#g7Bm(cp8e~#9PgaJ#PA`ja*5c4OIFl0BnT;=pNWl*eB-{#wHt0uutY?KanHn zbs9%$>9aISDi)P-!m=deEcK%(jEicSSMKm%XlFl#&zJo~b~V>N8DWwp?31&zpXe<) zv`sJ=mKDTK+BE*Hah$>D`+-H?Wx)rv$ORTV#>);e-C zt9l?^a1dp-HLB2XvdKGG-;a0JC8%Tlm^CC%iU}^>gHy?58TBDFd^XCtF9 zQ&##=GBl}5mM6=Ar9AaTEqtl2-1Y22J4+{gzAPQGtGUXGOn-4ItFyCo=q;J}n4;QS z7W)BTm^RoC#eR1b^-icSV$|bNLt+|;VDE5^yA{$%lFt+Uu=KtMM{Mp6rjLlUr|^Xi z2gQ38ckojy|55fcOb=M;Y6l%=;^J6{^%uw4paJh>lL;zlUKS8JvcIe%k)<)KVySo{ zKMEL6^O)5^k%+nuqdIf5V1#xSQ22aVKx9{QRS?y$TLqn+1w?O2hm^8WQX@taJq^of z8h9N}ww+wu`Xjc}&?ox(*SD{r#1Fh!w3~j_+Rr!n1Na+=({FV4AP#_bftFQm@YItm zE{)F`z+W*h5U`IX9%wrObTAJ+Gwi8n#(R17<;$xH2{VetX(M*>Ima+ed1=qqw!fId z+p-5CfE4t?yV`HT&j4Xc*pQAj#CX(gBW!~u<&Q==p|GL&ILMIAT7#Zk308ch^)Dx{}-ohkbN@a#1)hxriJ&O9~!j(lqj; zIA_t)kD%&V$TAU!%e*X$Dt8kpgm!XK_=#b1(wX*X?Lr8 zO$Xp@_Vma0+OnNZUsbSY0;-&{Rn)pS33xB$S!`d1gA%xvc zw#dTz*{yszJs=Qspm=ch9W9M^1y_b+94rGQ{x8@2N~d+0TN~#{N#i-$9b}^k@;EQM zgB&>zlB6h0&Vn?mS;V=|cu|KeucTN;QJI#RyBbJnr+0+Um)=2k<(5aP)f9O=J9~p( zHYt#Fl8L!Nl>sTwzP`CI^&F)TOmHyZr*jfa9`4;9@&i8I4EUg|9FE~r{wMDbMH%V& zOYeJo(fv`O{1)CvzWpY4%I<}Kzp`^g2*IMJ>J+T=^9aIuc?9IheqM6FPAV3Mek=t` z#4L*n&cdjQ;w%OoAyhFQ z>NsNEk&Dr1^xgQ^_;`>EWire0rCMnuMx(O``wI+;)%}Dw(B^m!&_a>cs>ffYde@xm zV51KH5fV~6(7f6t#Z+nM#>x>jg09a!Js6X?|Hv&MbA8Ab<1!k}1J;ux$2{Ow5tJ+x zLCB&YDHyO-u#!iS@RK~LM}nJ?4Xlrz4_Hrj<(5&Z)f5>WXIUpi)PbERq|(iSu2@kO zr?alrF#39|`gUOBL8;iSdFa-?#Z2(9qnD|q^+OYPudB#DGVzZUkBm9dh zK%z*y)YDI2dn)DftGIsvGQQ51RmVg9Bf@Y6*4Q!=QE7XFxey{rt)3Ri^I_%DJXkq7 za$ZzvQ7nBH)M>$@JQgeiDy=vY0q0?y2btTU6WOrx==osfWLIvHq*_f8$#IT%LL|vm zlOjn{!4C!JKyFGPsUKV@gY?p#Qx&}=KYFfqyH7%tsTqA$Ik*tQhm4PJ8${*|hgASe zJuCeTG{HIh{i)}%`fpQv5^w=qgleg!De4=%o=dp6HBl5Hf9F7w$wm`Ia2_O?9J!K4 zzKF_#`IRV{d;=ydUzQ=Ofe%I$MVRmr%hiS?N6!aICcAQrAk}J$2%Zf)rk731APw+E z--Ie31{cT9xI@6#VIU+&yq(_up@IuUUmJv=QNx;!+Z`{#lC<2aAkstc=aVQ4++IwN z-!VWwDyR>VE0!4rmk|5fG;2aqiBXQjSg>Fr)W2c?zrEuC z#g-dq-k`mKxl$2g@R>duzp8!dsaPh65r>EJ3q4!-Rqy>-bmAE-myxoipB$5eMEsY( zU%!9lZJV`t(MLh6rfd&_pa*41w&K3o3H?7z*PLLc_`&72YT5T{#SZR&2J^DOF7QEM zcZ?C1p+^l&*UUa z8DIJ-OLv|ry%DD?Lsx}owuvn`)FjQ zhqW7H{ei3MpKxuDd5X!w~zuim!>c4Zgv@=yJ;lx`m~_ zP(Ykd8>zX0{Qrfe3Ocy1MJQD5OT)AV4sewXv^mUdZ%t~dvYQ~^VkdOk161JI0=Q6I z*wks2a@#4?vW+PGf=Ur0*rc^{GSxQOVuC`N2eKna7GV{NWfrk0NE0YERj{I5`YbNW zI`DH5@ex9d$OhR(&j+$2yK*Zes?`*QL=sz%8aoa;Z9)-IEeJ*QRq*@vJS{|m6?=`M zs)HP|)3#3wj#?_lWDcFCV^mR%3-1OAW!0+s960sJumCQrRwr2W!%`)K9U$P=e$|NmBoX2hwuE>UUMb8K8 zBD-=6_zYMV*>>CoaWbxpZb33Z8?;83eZ1zI+r7g@@0b+E$xMf)EYa@HijbMkQGO8H zsxR=N3NT?WC~wpuvLO1k>SA#fAlQxj58g5dke7~xO3edjrh0_=fZCo>D$?3O3~)meMP#?m;%@grxSD7XR}>V$nR17&&rU zhG9~N1*G}Z=V>wgmxgtI_~0lkM}ENb0fliaLvN3 z4)cDyq?b#RY}4qtKYj?1MG$@!>NA-4Mb{d2fK)m1>9B{lM#prwe(VyK3xUK5(x||6 z@Zzz{1A2e?$-}b5st}Hj`e7-{w%4A+{BaFlJEUs(`2OZUz+a;=tXSN#TmGPYnR>7s z=UCybCRsIOsj`|KNhmyMM3?;yEZMlq`>v|62RQ%S`EYV% zS5Dy~TTK@(vWpv0?zg15Pc}Qm%DEyL^rG?EYQSaR6p z(qpKwQWQJ(SP;QL{#+E+K8F^s@5g5ULh}&8ZHSN})Bm6fpmk4Lsd1_>vmN1FV3$zD zO4Guq5(3DvIoJ*;%vvWRVVbkO?m5=@I6!=h<+LJvi{+H73JNgSvR+j znor=d-HChe<*#4g-n<&@hOU*McHp?ipf}#3F~~;a8Y7;E+9O9!65+>HR55_>v8XBn z#zPUXFi46TicRqmhVIx#?ZwZB+9SJiYYcLKrfUp(;GjDdf1tGgz>udFL!V} zfSGSJp7u&0B`h?ud4`%F8?mK??qpCN*(6;BNtVe1SRK;7b%oL_j7qibNM{? z^Drp$y3DH)iL*g@@$-T5$gbQHM*_8`OWe8GJbLk@+)*vAm7{q8wdpQkBaej8Id{Oi zg8|nA zX~v2wX3G%hv&tw+g`4*wwn208^MU5buG}I*(w9vak+ZRL^y*0&p~u2EVxy!IAlqm` zb%ZH|csRH=o2|xYL#-$@@P=FBsXbYEwvOOK66#Ad;1jFa6xK6EHC=o$I}KQq34)gxSmaPPqk6_bjb zlk0Jc-T7#+cpe&z99cw37zS~~LO+XHwB$Z3{9wt7Do#S~mzl^%95yx@EPg&T7}=Fu z>_`f=aj~PCj*FcG4MvC@y|_WD(Z`Qpyq9=6z_H>shzUzb-in<;7{T+Y8Tc%L?NxrJ zR%{88q$UBQZuLmYA9IhRqknUwpG|{G!E!3-WKj%Ay1XOGS*oMoTHlb@}d55M~m8CG~R&S{uqBLYWytqG|jV=}4iPxNp#LC>2Oie|O=Hq^>AJ zHp%U`NNIpC4B$*_O+OBBEc`mULcI}09e4z`EfhvM@bRz6+o7BE!n23dflGi|z-9WQ z!DX~R^>u<(VF;+@ec}Cq3@PT0M>2Xp$sg}jvLFf%? zzCg)}SG1NkAjg-dldB$WE!EH9*ti;ZW$f~Da_zea`XWIgjK3^gmF;|TqBI_VhMWP*O1 zhbJRPjzpeCc`OZ`u#|=luLH(;oC7m!80Ik#1MVgri)}nv{Cs#ava3=3Mgq|$>bG;b z$LPhAs*PUbwl@TZmd?U}EiHx?t7bd=gwSR*KyOp8w)cIJ)+`E^5##yNXCaTJu!<;+s=_UrHnu8$K5P}))u?Ea zpsb0ac{a9+UOg$B^dh&~E_X>L;sh~IyWnz7B|O#@i6tSOUbz)F%EayXqA@{2U=k!|6%oSiSW(Zj(g8BiJcYXsrvu}tp&=BFWgPTJ zx9GCHcfgdZCuKCspi?mjQ-Iue`l(AcnV?waLAA({r9B-L zsi>G=Ruw1~!FW(stjwyYisPd6qY=eoL$#9UgKCjojVcxr<26ySoLzyNUOniRpEtWL z$BH9_dZAhq-n%CPYSk6fg((1RY`NIpMhEYbRG+=30@G2dd)=RLxgvmyFef>&LRHaR-L3OXj0I9r}tq=#f+7Pe9 zfwXh}mCD07hWw<2{T!|~ve5)_p9ec5N6u5fEF&JV!mlAU$q!h*6iepwDo?UyRxg*O zTik8fS@L|aGqS5uaVPO=6UF^(*crWg((I>NjEi{N3(6DuBIK5wp4}@r!;uIdm`K1+ zbxeGDYgfv}Qe^vLy=w1Fw7s_~tQ>=%RQ8j}GejK#f%i(8OS%i|5fd+m=@#h4vu1A2%0a%D zp}gO&=V?RH)Hz7D-QATk^;Y)?gOO{3WTjTKv27cEj}omDlG|pzSN`Ys8^xunR^L@S z?Tf!lS-unNhl48B_?YhscrY_DtXGP5|2;zEV4fRQURl4B@E3>Ev6Gy!RQC6SLW=l! zu&5v!twmsU*Iztc7^aC+9=&l6lZOa^x^8{G1mFTPBbzndkDh5A%q{alXv5 zF!vKNa@*U`yX5(xcVt(i`h|4sWU&@$GkQA&>F@LB8HqS#=oG0BE%8Fi;u&Zst$c zaUo54bm?(Vu4Hw;zXx4e14uym8d0Hbn`&R0C|DO5gUf$_0DO6GL)c#tVtaZ~P_oGc zxt#~JBS#j#?*~;;v9#bz7Wsi-c_HOi)QMO|X%z@QVh7kjyX5(Rc4Swhayt`fN46ig z101wvV>SQ@)q_*k;G>r%BF4$dlX`@^a1Gj6;cyfJ>ea0Y`Q< zDxotGaAf=OoAqSgF|x&gSn!~*H2R;lDGg9BLMBN7Q*Uk~$rymeOm8~kHKY-QG9loR zvbj129E20g1dubLEz$E4RmnU=6*+R5OIb=%!F)tiE#rjcQQkJRFPec%F9ed71@4VUZ|FCOO$H$TUW_RS(Z}i1A4;FSbSZU(kxST5Pwzo!0~mx zbByzcG#QZwPu^mx3i4VIc~#xOW=1G+$7f-Ru4>q*DZz??uYr8lt5WxOiFPwwTUMpW zPF#)q7$|^sDoM{^NYQ{&vU@V*ifl1KcIQE^$dQXEn*u&QNt5gut`zZ&A>Fy>f8rz1hMa6l zRexPsp3RQ0^*TC#cX#vJ_9~QX*S~{x^?n|`HaXT~C;t@CT~l^;59~t@Z9=HeVbUTS zO_1w(FfelDqR4$7h80xn;VcqC$#|CeEKHY4otDe87@?_4Z5UYkd@wMwt1-DI8%~yM zvWHQ*rq_?b-#_6Y*M4d6<t{r>sa<1$b8rld*yDGgnCwi!~%awU$5%yAJXd;f}H zVyj1F%59tdwiMQ&8tnm^1#uHSb%zpmol2#wUGVVMy&qU!;IBZ<^9wdWH-0N(FJSONYRH-E8m(AaTFkcWfyK8Ge~=DuV%f zYN5U(<=ln{`wr7AtVsZw!lr!e$$tiQ>$Q^|YMa?*05lCbXl>y9d>j-D8S1?^SJz(- z`2r2iSfQzgy0Y`_!57tO9)xZqPlijkk&VW6TRIOfM~)20Rvz$()fM-F^Q&fgRptz! ztz}xKxnH?G->Hq4OP>!fM|L%;+ep0JWZg#fFs|E9CjTN^Xo3~IX-k|r7~x%Y5Oij# zzowHmT+=ZOx!n8C89F4lu9`IgTHd0;wBtfA7yq;&HrqD1p# zW-zkF1i73CHzP;J64!AOvpg3ui{h+cJWMO#?2e7s+bx$i+$?=QxEa~is9ch8v&nKv z^)N1%CzFGbEg&An<^6O8;?MjcAXkd@xRW4`xH zXzb}dT=1|fmNQ>U`(79QIDXE4?srK8dz$SFRXq$NY{PsQ)rVeLpMBfER4%+X;<1rC z;Kxf{_(N{-;>j0*Jt!1>Uaz0hB-D4HUGQX+394isl#Lu2JnvBvploDUqpF02vQ1VcR1a=YJiT~QkB}|Y`vm<0npk0&xm;_j8BZ@F zx(Gi6ImDnlfPrWa!unD1ycB)OFt93=sP!Oka4xPF3WBEVW?d>|84v;Ymwz_|--;mw zXYiX2>Q2?~LAYywE>$mF9II zvNUy<7fo#>Tl#!RHnOWx;Up`Jij91Q9eZhCJ6et3?T*@_giKN`tf<&VdjRcAryage zt;$q*6CKAyzjMz}!NTDxR%7%p>V-YhQ%E@YF;$a=m0xZ18{n(DTmyCsiJ~?;v`=u- zck=CPCuYNYnG!Q<_Kr*Ne1umz58*|Q90ei{>L_J_U*#+cvJ%|#1*_t~7g5B6oVzKR zQXAowJ|Du1>}pib$ZDHTIU{jaWB3qy&7_=-*VnukJ1!T=hp0nU1{hbGzjacaIlR8h=2vZPB%{3e^}&L!&2t zV8(|fzi>6;63N5~a!F2y()p0AbRHy&9J%0Cm_l8FI4nyRrKMn5m2$>;5yq(>MLBo# z4x~0DD}6pl7TMLPppjK1oq~2Y5Q}U%4UkPXS6l#U`mYYx>TR@R$u22TQX!XxwYEmpWa13OVBjuP@ zXm*lfcXCxnvc&|Mn+LKYN6waUSY`5Ym*o}6ToJOo5P^K=@gS{Jo{QW~BcIwJtMvIm zR%BQ2L2DkDfGgJw4niV?=$&2Jksf$Z=H+*Jz;vD>A%i4FOg(bsTMIB0JIuj7T$Fb$ zZ89lnSE`E18r(K7udmuyeOVQlfbD5fW}XRRj|H{JMP7Syn0^%Xp6efJF9*|>KkMIj zumASSD$U%*b#%f)EAPJBTP)zV(Q`bg0dpY6HBng&yj$1MiMUnq9H2$Kz8VB|G$v=q z*WciOVMW;8hYwzPw_3w<8@3l16(R8x!&vYE?6}!5z+?yz`vTOMU52|wsTFFEowxb< zaI|zD9E}{g^dl~KDp(SWj73$>S6m%mZi@JEF-%bkwS6?)1;7UJ}QL{NSRv-M@l8?8~feo zPwkK_-+~x?`ppUj!Clyk#t?s9?>D8wFd*waA+5xWj!Wy+LFq$v;XX7#=B;e)LcUJF zUDhkO59JY+@7L8%QJ2?xSqjPm0;**btDz1YVx%0N0|X-*O_0NRKrnLT)DMz)85InW zo{)ANGQP}~EDX{hkJ21~o=!Q;Y#>?I|>a~b<{zFiaUT~|a;Yv+B^!;4YBmqoM2;K;LBcZ;vUtfO7V$D70jL5D=rm`o z0%D4tNBHwmV*gYM7z9($SNPT4ST5!Uu)LU-oGhuR8sv zAs83le>Qsss=8~m@4c()!&NmPO#koA8VGmk?EiIh3-`YIhXrO*zJ2}gHuIj!nmFu3 zl~Olkg2vJ~_QjBJNMIf&EP3aJORwUOvfmqNj;#3>@*}KJ_;5-#Omxa98jbq;+T0m( z?w_nfB?a}jjeG*V{Pf!^wK61C?Y;!W78gSnG>H5u-UcjHKn!l-*H#;KnB^qw$Ot+* z)*KO|y1wq9!=~0n=?^~sO6vx5sH}rih`Q0)a3)c&>rQrI9Su`L4iAl@e%VN&lYLRU zV?G$xNr39UNG?N*WV3mCNXV1c;(u%bKup4YNb#iMK4g;#chNjp9XWCkWO)(F_g)dF zC5!4ZVR;-S%ojcnMHs~)cgHO<8&;P+AFPh-YUC~=XE5z9I-4Di9(c^WBpY_McW=O4 z+a8Trh<10WRf&nd0Tue=rc^Jnr}h?c*-*2vL{z(A5Z2?i__V#(^hTZW_S~2(xR+Sb z^s(5kFlnw_H~VUEzqV2V9X9@%7q2+u?8kt4^x zpBHr|SXRdwi{c2FW2&5$qV$ubtd?ouW{$~h#9sD%h&{5a5fLTQFfF_)xu*NZfG#6BKA|5ivKFMg^)i3FzOv_pne-RM_*O{PqPA!M#H5@NIm(5 zh9;&qAeD`<6%4`a?P@1Fz-=q%(!$vv_29mII$3gUnu23!r=o$$*K2uv0j-GmMdKFM zREeXDiDn#tLWZny7tb5=t~}<5z)b!pfXZx zO+?o%CX@>~1B06ybY;edd{%Uf*%cs8pmJYm*;lbw%-hum#>gxFyI3I?K=-o-X@oSK zsULmJ1Uocqjw|!SUx8zd(|jQ0&N=Lo^TC$cJg_A>a#D&Sj-rsoeh{-L4+54)5fH`} zMG|CjnDUVzuno4%o)2tEb~U0DXtd<0QlOfSSR_uArAzqfsiHG$kW7cK`tB7!VlbTc z6?7_rU0PMaqnp~keJeX#SEUmTuYBd>0Qb>__gRr@S;TjG6wBIaJy@A+*#~^>xUPvK z4Yomrq=sdkEiXXV&lQ?AI};tg@UAq0=GrD6u~zr;P4EWv!ka)oiMTFD)y)}laSz%2 zumD!a7$*1X*b3!*?smI}_NU8Bxg*=n#l6ux7t->&nuDYaG@23+`g zUPaM}H{M2WX3vM*B)b|>Q&h7FYKm$)qNdKpY|;%?&M)L814&=+`#hx2BS2qd$Ewg1 zqM$ohADROk56{H#)O&P=z5wJmNUHXQ$ZP(_>GCj+*Pd(uL7K-7#zGVAbd$tKkA>dW z@0ecAEVSah7ktz9ln1>-6YQ<7;vVRoeido~N7k-b5@BHr{H-;I^597;e|6PU#91Q^ z-dc|yW|^6Kw`$Men?4=#`y9|O*=T|Sp9lISN3Qe2k9?l7 zJmb>N4COO44^#QaRHS~%(~76=M7qod{btVx`X##>QQ$O&c2t4WO~)Re=OTXTMb_R8 z)&^lWU{ihCcrR~mKD|;AIZK5v#!NZwbn5LELgzbH&WCZKBok@ET7z$&bm;No~iGmBG3s`4$&Q3dPd$Oklee}_lC z$yA2DUjbtu^sRP=&`jsRpvguPG}Am7G&yoy=XH`TIV<>5nwC+Jv!bX|sh+BInfh_! z*KVHM+=fBt&j*7hyK-wLve~$1BAdEROS0J%T%}{ojxb5n&mLyV7#A)ADQVs~$MibS zxbYwzhiRyBw8wej{i4je&Ii4irf;;f-(`HN{*JvikLcXRfOqcD=I&`ICsWRo8$~}A z$tL6SoX^8blOqeBCjs|kRr4rHD$aOXmMqMJFi4Uj2x7OJJGZgY`SW3=$*xA^ndVd+ zm1nx?h^0X=bz7<5)8yb#uyRG}GvkP=|w z-IQB!nw0zjZELxtono+BAR*q(oxH^#IFy8k{0OZgbkIwxmp?d=3304(aUoR&kp%T5 z0cwc0{PokvW_!;+_29an`r(>S*=-1+lixXG?g)jniDW7>ymII4Z9hMleNRy|a6sG9RM z75+d7`!Zu5>IQL3P|lLW3@Sx&x_e}81t*Aphl4&`^AgpD`k9pj0`*M?9r0S_9j_oA zc|cohRYvu0uC6{_-duf>8>dv-<(1uw`h?qsMMH0Du~M-fa@n-do)31-=Yd_xk;5>I zYTyI#%OI5RaX({Ok;E*>;vmVRXjw!fCW8%j&7TkKN_KUs(31U(2`$xdRA`;BSGT~9 z7DU$9apyl8$nU*tN$(up|6!x&4@5TM)O6js1Xz0*~xNa|hsOJ?sh;*xGl3m~RIeTZrp5=F; z)FvsA4o@c8XoBXPhcPBcPC~xS3gNS4xr|s;MBw?z3s#3gnAe;O-*=}8*WV4VLTHL1;p}0$6#v04nPIkct13UKC;bYDe611+75uY$|OQABa@o2 z*QKWiQ-C0Jc_*s<8jAk43Mve_Z&+Lwj#a^1i~)O}1^=ds_tiDSKNN5+s7h#i;Ngaz zg$L+g=&EbjR~^$cRLQefpMS$@)TSNg;J+_1kE>Jt6hsB= zCwa_oP&B1zH=7Pda{M?G(O+`BuIEpE&ubwSAz%tM4I}Ck$PPf03xmVDK8d1p+HW^H zbMsIc8ECO)Uu(UWQbu1XP7W-=BilS`%*>s*?{yZIyH_38H41k3^A{Sw0j&o4vmN4w z+N}q(TkzjWyN?NCsN6Xw5sx?C<`|-Ft-8B`SSso$*xY-Dr7%n zT7{%-rM1e)oEILdmp)D3(lvyNp?d7zk8sw9fCJDqQj~bb?wZoO7v&w_tlE3D4(|34 z_WiNxmCln#C!u?&iM%+Xd|uebQF{;n4iGdbYiidR(8kIGJgl01i+|BPJV=QizJd#! zv``og-LveNSQ+XV_@!bi!8(AQJG|K{h@5;qO3MVD#{--n?@9)$oN9Q)LGOU>QMwWg zB$Wl;>q-5#-FIBMy&0%-KUxJRVUW>U>hFADbUqIl zO^%%AJjoKlS(T?g1lX2R{qcfVom3dT-c*|^HbpCw6XtJwQ)gRfi~FDINVFgyuVm z3itSzHd40&m);7?Et&U~dN;OhQ?B^Vs3YWX=<2eXZ*5p9`r5Lj z$yAcpO3J^o0JW3v7RwdvRMWn6g;kH$u09KuUk|Fj!k@q6cb!04uD`O_m538moF!7x zsQNU=_5h1g7Jrxjs*BHJfDd+Cc4irTKtf}2NGbXzIS4o|zo{CsR>x`!kXB86M{F@} zEVeq>MIy%+-r+CG|IOaJZpW=7X`-*fGrhXEy^bL9eyLh>X33Vlw^#Yr*1q)2Kad2i zY^Rdhd9kA=Ac{~1<;&dYS zD{U#KBan-E2xM~RBq%H1K+EeamH(4BoE2peup*5Uo~6*A%6D5z8-ZLr9|D;i>QYNd zjx%H_r!o-JFTu(y7;ESP4N>Drk73c)+S#hCjvu%6_r+GKPPe%=3Qh;$2}9`q&diwd zZ7rXmQHYAN+c`PiJVb!Ay4#>bh>d5vOC44$94`u7p?3KlQ~8go{y;i9k5bG30Dr|a zl0Fc+Qss1f)rZ-v3`TE28+-{}5EIy!6jbxdYt6TZ9Wg6;aa0{K*L@GNE8U-VyQ6$0 z>Xp%&KONy)%tQE+Gp9jN*J)m{gvTX|!z5(6h-1c+f)`aN1uG}QH})-rFZ}RKnokdP zndUpjace#;IH38CmoSu3q(u<|fTV1P`7^ox%~$NevF1C7;Ha0P>93qX0D7|5T}T^= z!3^+6cV_;Jm25mn%6nZ_9tn0#_D=k{USfgzgW|h5yd}c<{-oE7)_@a<$U`m*9YpT1 ziGhC;1b>-OPukrMS+_2xS95ieRqZFJ+iLrq88{s{@P1QYT)#K*>-^*Xw|o5dkBa#} z-K#*|i@t66LEY4t7t&v6Z`5|Fl-pM1}=FmBJQM9 ziv7Sg>CXo8riZ%Jq?6+ene?fcZ^v60w&^t3x+f$P-o4KC$=mE#(BNo)iMuq0u^ zsj+_@9LS4$WU-jl|&;OVBb2Z~vft-`*nMj}7gX&JfgL2V56%J6?3stN5`!4NGK{LmE5!xt_CC#G zvo&S{!}-cIpwEIY`$XE}kTri&gKZV{xD?g2v~rvA4Hm&cmuPE&_LC7dVgj=`Ei}SR z%tEEpGuMI0t0)(&Dxy@Hi8NzH5LL|glQfIVKos%7bu_Zg#IvE&>7gz)6BAMCwBVqb zn1xEG#e2AT?-p3ZAOm+#@|#&5cA7FFZPR!i$zk<{RNfEdZB%`ipAicnALz@6zOKdG zs$Rc;hZmG91r*ozjnh7q>Z>vuP=@APDZ_LG~+ zrTvrP?I=1&`>C0EoD@}*MNDL(mf9brERV{Fr3o*BOjM>{ zPlkJ6HwZdJ_Mn5%V}wq_NO%O>e!CoSk2LvaY3gK_qyMzkYX;Z>Jdgf8;)yUZrkF7* zvDra4A@u6oP1hj)(29T*9_sj+!m#we5*3HU6XFi!M+%?GKd36+Bc^-}1C{2m#TSGF zg+8Dz_uy(AzH+2s<2%h>ubOLuHPugvWpB8!tsOJ$-wS3Xr8CCLCx$^C>7i8Ltjiu{ zjV3_GX`vC;XclCgo>`P4iK{webrT8}=Vi%w6(uYWlB6ihB1j_Pwnm9Ft+H|kpc*gw20({4!?%~4BlwAP<_K|szgRw1q|_;Ao~{M z5Jzhxu@Uz5MP<@{zdM|q&~)lmlB5{4$Ot{3g}tU{PNS-6nxK-}ofIrCM8onr;nMY} z>$nzCS_Mv&WbCK5oJs%#2(DSKO(6r=8w}TSbx?V5%*Off4X|Lf+V+7HlH7!I^R0WT`Gs4$SB(N#`bfAR)9VVIxTPTDJJ{I?Hniz#XR zE3*(gq^^@&$ffI(@ysYXN7t#D!x&u^!Gf%)Sez6ED}`UPq{zTksYDbGI4ZfV>(7Q~ zriZ#z*N4X;be#qb59zv-`q{1G7h#8wJLqVpEAJP*!tX)WYcK9>- z3GD{J_wt}V#1+WT)V8192iNDvhsjqhx)%_m!8qy}%6$EFFD&@+l_wtg0;{<0Kit2( z!YdOFa(GGdgdDBf>G~I3yh7-G6GDI9PZ5j&OG&~!Cmmcb42Y)AQ!6d;uhv2X+a8n2$ zR5*P6{gy6bphr63*wGZ|x@C)Uj}az;7%Nk}WEjcY6_X2iT)?%#x|^+L+w`uv za8hW*+EwRQ`weRO!E@*ed8p$w&_%0~|LCD#9KKs^VL~LM@6#>vmBSmSx+~K!-Kooy zA-O0zN0+IY>l#qEP0g}0%voGlIV+MRVQJ`xWh3Gwb@KwofepzGo)3~s4mG69(**Av zf}eY@@4PP4j}5x4nomLH(s}(QrF;E7e0};sycaO?OT~wUIlZor`axFnywbYXY=tw< zr9=%E_`#y&i%@<-zz_m1C_EC>_ zIXCZ#^M2Z@LDlLUoB5&!4vk_1&d(Vt*`Z1RnI@YUviQklR;2L)W?eOKO2K#q1*vt7#|w+MiVRrN$2uH-9qs^xSX zVlWSfNX}e`VOG~c%)(N7%W)M3zynpVf~RrX#8F=G%&nF-4l#H>93nZ?pju86ymJUT z8SQDYw|cwj0Kf8(0hnU1nrt>9>v8Y`6W>MI9rQF`~zt?i7B10H%SgPXx1hP z-Z=z^y$$lQ&teJQIwanxLs@fWBY!sBgW=S!Rboon8QkQ+xlI@?`dPG2fIf8g?{F%u zLFLm??Ho*OnnnV_lGu!i$sZTaZFwWuezRoI;_=$MH4T6aIdDhpCRG!4;_2|t-?iX4 zSlrx&{EIOb_#0djgC#wu$)LUy8uUQ#~aKI085(nRj1~w6qI-q3FUl%5LM0nzZSi8|?~S%=9+KidO5L|ZcL*rlTF;=|jvu1*R{ZU znYOw@q%pN2hQ*&y%_+!3dfyBy=RD*gIdc}JS;|Gs(zF2Lq8uWCyk zoP<%32fUDXi!7G^lSq>kH4V$S$f~rCvN&?%i~<`Z89X0Ik{oK#Bux^$a|jM!Fa}VO zgb|{o?pkzNAu@3gNx1Uv@85eWQPGzX-9euGGq1i0a2%lcx;t7=RZlAlVY3F_TpyP) z;nR~Uk+b^VM=ki)u!r%!EfFA~)o&FItTYdu`RK5W>P5(B>P(!%BEZA1)x$6Phu3kK zDg&RH^L%NV|K|_6}r#^^#O|>>i8A_#qt#86x|Lv$GhfWi2Dz( z)G%GL7H=xp!9z8A6&r*3-a>EY z>T}oR^s@9#ECWrDx>a#0Hd*LP_`z|&KE0{5x+dBw5iu@Yu^3;kS}=q-}QcAW*hv= zH}S+u>A^J%vO1UC6i(wd9S7MD3u0PmoVQwo zPttb*+4e2BOEu9U#0C3ZTBseXm+aMoJf3^f82LOxG)G`0&hq67V$?D=GQ%z{dK)zy^4IqVvZ9q5=O-s(qgD4SEl(D?X1dF4fVntS`EU(IxhasjaXtBP(wdajU>CmHEr8{Cui^;!<0D`GfO}Ba zof!iMps|EWAU94&#oVQw!GG%R0NShA5-yHSo{U`4K)EkA@|q*fzyTBUwW=QP!X=ol zS|R5LC_FIp0iium5Uu+5X~vSst-X(*spk4vvJDb6}!xpjc^@6YmA#qPcIGQ{Sk%E=vl>R#-; z7k6*& z?_GIQpH|{-1O8tBDhyz!C;NArI7k~U7jQ|s;ahoP9R7>-<1)D|Sa0p3G+`aD31QZ# z%|XVMNr@3wZ61b~oY`;cC@lPp6?s`fo;_#0t`f%mwBlJ1$5G-=v4=K>H+((}FFDkJ zRU?6tW3AeRdEYq1#&Hjk;+lKtSLxt@wlDd9RXy~E=V!4BF>N%$mQhn2jm^!lU86r` zwZ!UyV@{{*te}GxQV|!A>S~}J2akV+<{LZj-~J_tv%i+@4p2p^$DtzhgFobd^_0J1 z(E{y|?e9C@?Y7d&!Fr^(qIrGb; z)R7T*uN75wTUN>n?M9RzqMD|hx;))YBp~bq$+~(vtuZ?=A4D<{`Ptw|DX`B>_fjSRBkdwEknyEu2~>YCvldFF$*n_Q zTBd_~!+D@ya^@gP>L@P?7MD@L;<%1jS>+A$!#vLd9wkLRpwKp`H+()&FFDkJLX+f= zV-08Km2V$f;Jo`Az}@689~W>z zQO^Vk>8?32D!d%n425w;bp`lU@JDRDsdxpUPXjMoO=JuXIRx_+kt! zDKSEW=V4&UnR#5)RS;z?%K`Wi#ZrSq>8eZR4az2{BfoTKSwkBG8$KTfmKXlNwAzZnvrwM#b1VaH9de)_7%o`;d3&n_9E?+<;-pleiw3a^`* zsON@TfAc6XU-}SR(0sJ zJSk%qH+jhNFc&OMl01u2QH#{wmMyf=qT%zQMaiKCtOv=eIMB;r%6xBJPfS`3N&>xD z6T}0>1(c+LA>6Ll^7w<;+uQxJdxKl=#og`CF9{RkoTz$eTMetSnteRBwOIC@Y&C(8 z0UBuaR4Uekyg>8hw|kUzP^Y!>`Ze~AS@>i6)tSKYjz`1}z&p7p?X z!>Fff_5gmM!Vnza)JjvBA1&(I8XwH%9;`EjJEb+kwJtRW!NJISV8E3Dg}IJX=(k~- z7|4~iTa^jMZUy~=Q6^*x0VpXn!i3C2o{}@iB24Pc7c445X+q*AW@VZ-tWK-CmOt?# zi`*u}MxKVxhdd>R8ZaRw{BFpEOv9bhPdp;~Nn>P*>RjB^U5RdA=h~OW9AK3Q-V$=& zKSbHx6I8v2b*(>uOTZ^T_cs}NJJD52;C~DxR zacx6ZW5RrITu)3o9wa2Rrv*_*yVc4R0FBB$?}_v^(tEKKUqx5N?@BCC6aQhi5dxp1 zZdX6;ysw}Es^y1vHDGSb;W+j*P`^Qb1y-+%20&$ ziW%9!#_0KgjpR^n#U#as6m!aaZ(L&1d#pB#wf1$*!FJ_A%)hTO0c-=Q!{p#P13;Xc zub1s!wJ^tLK2v(pcSDyylAWE&=}$CSN7B!%!ql>D4`0V|SJf-PJb2#$6rp1m1~DM* zK)Z)Dz+SuC@@cNUKfpylIOA<-rB&IcU%~hN5-QC~tE5nDU@zxyTxoI?JPq_H1PD)iW*_O|UE3fUE$|`?A9=&n~byZhO>@>7r z_OX#zf8RN{O-fcYxx@~&ea2dTeUxyqE=OTDwVkt{80rPwriNL)Yxz230Nb(5xT^l zv^m=duDd+qwd#l;9v)cN!s(Y{A`&m)&Arrb1YYvNWr%VYF2*^M5+lsiJe(srbICa` zvm|3d9!p<=mpRLesAg5sR7D+>Wj4^?AhL0e(evRP$)N_!)YO*lQ|5c)dg9?ICMo;H zj#_qgliQv2vQ<)#@%`?h-7NkNTiHq_5T=QkhiH)4#Y1$`vx|tVL7UX=3CgzAf(|17 zp4GhMs!M@(w;{Xp<7=aOf82rU9R)UxVk&chiP4R&WU(Gs$G`XPT+HBZ+PrUEPmXdjsN7SH$?Jr*6zU;gbR8&Iiov2B$BXSls$!&in&|!iN)^U`gf!zqdSHa2S z6zI8YzQ!fiqEax24xF?>5j9XZ#F-!^f*v|Iw+c4Qs z%jo%_mgG&}Cnlq%14OB?`Qa#j^7oxA^v81@NgAaj)s|ACv}C zPwCXa=}^gN9#oQ?IShlq4{M(lK5vw3P=;m3@;YinRAeG{0~I10DH%N)`dEMe;nMBS=`R-e>!{OlM~YM;vRW1i1o1*?vQ z4|s7wK@?9)H|ZIoImj_qn?>0lfT!ejl-5jv2$Di0v}PVekepebTd^n#sWn`LEY6|x zUlm2HOv^0y^O85h4KR*uh+y=55J7S%x7xTD;8L5(bdvO(2fe!$wcPFNFN6kBqv&8d z5WFF40ML`H#L~vk19_TilA~IBBM%&e!T?llYI04(Z@6>(8z?FPHGaUV_R4 zc9%~RUc_Yr5x5~gs%%Oq;BYe7KY5;Q1cs{YiXrLcE;aFyLF*y8n$+p`2Q2(yu?BAN zbFy$4R}TyEUDRF9zbCikU%zgIhD2dvu3PHIcdwO+KpX%NNw}}^D z?(bik0&Fy7C<)C9Awst(_xcL-?vsbam>k^aZ9mcL&%aR+1M}keoTm z^0-VZ&JqDdgk{yRyi8(N6-k`P+j|zJ1CFo_7>u3|Fh~yNHYn}|d=xwBV><21#)cnab@77qF4#kJJ;*O+MsudAK{@J}8#QnE;HhfsSjLhx|N1`F8~*el2hDhg|klYMcCmTwVhyG(y?uLFveuqcjMrJdi5xb003w3Cn#E zvxo;dFRD7si^{F+Hk2-YJ}4bIlv~*;sjc-b?wq5IVTEj^Ys}e zmex&EfpG6@+X5yQPGEU*W6j>RS;&5?xP=ey@JqgdK!TJP-VFluSQoR~9cI;m_mArY zHnNgDuH`*s3*-d471Y!QP~_`%xCGOYZ1FrK8#%M6(=y2FlI3BNusBXbR)$ z9*594Zmrv-6FR`EwUPxm==x@K28E(rj4pHtKEuHPHkM`ibY)tW1MkV1*9JtZUAGu4 zv;mZz>ZB(&n|8D9x>mu1)d#I`yx)JhyZH}zRt;F{XCPl0b_O=#eD$(A7L%i%Tgv1u zL)?zdTMyb_=u9c?ZmZ2N*h4_a_z73w-b0r_c8wr}1-I-FL{yESIrU zRyaBSV7P-E1 z@pp7my8NqdXRez5t@e+l{6*Us^z(@sy;iwaG&0A=3q%02swopVYPSb=HwJ*J*riqg@F8#W2XF_5dco#n(@QxhHZE{HB zz>y}0k{@=690Xo>X{I(6|LF+Gsb5)73AoJS6>y z-`fRtzS^|)zEbr`9h%ney;Na6b>HPpmk~pXpXmhVQ4@0=W$ii&6S_z;Thh8X9fB9n zgW!=f=bYE_%&%Bh0GLSRDJ#+}Vo6pdvHVw3CGI8(v5motpAUma4&~NGN=k1{LIWrF z>ZTv~Km%{@2?!A>Z*}ed1bb3oU5Ww$c`rWQy?y->&I`P|U`dXBfro7mZKJ9E^fNv2 z`DmqT5^DqTdPei(FLlv@igfIxUpcBCQ2ZS~l6j)-TE1#;zd~v;gxrH3YU_!|W_Ja7 z1vo1Bm`=wU9^<>kR$h&es13;mpS%~ZUf+Fr+2u#E_u2`H@KkK8(;uZ+wm+_2Eeo3M z686@OHhZiyd#uIhw0=>os`ZYFieBFCniLsfQ0Ac%$(idW&g!r(SeWMli_4&5Wl{%B zBry+*EGfiLw8KUx#?OaNB!_Yv6iUi%P^OU=(oZ{lg&Or_OO-oIb``O;G^vr3Xes_<;N$j^?IeK^1ZA1t$Jp>|G@ zhYu|B)X13p=>w!s4DBlDd|U0|V&H-fUml{ILK;X4jZoWp7(jC7JZjR&k24mALa;b1 zYF3m<#iBF{{Uk2aqIC0)#x@2pem)E!Ih0#%DJi$wQc{Em{l@jA!zxR|47+L=REted zhAZmhTkG+ql~6)zuFoeB<1TKfJ0QvV)Ex5S8~H!K!dhCD9yrlGUHA$GgNt|_k#&?@cDW@G_?V|vtJvmfD_xrH4MZNn7f_)%iAU5UPOj8I`}vOA@yN98g-P*5o) zu-|NUj=E82m0NS1a_k=EMxMn09}qofrov&B{o$^Q>ojX`U!IBux{E(cvj$*in3zk>VnOy|(^i9*0Wl<1Sv7e+_>;@7f zHvBMoKKLOylv9~WDW@`%QiIA&Kk(ooOp9WCsjG^Y=aTf?G0SA_A-^%& zqL3oP7A2X7LnLQTM3EB^58h5ZN=@VPcX-Vu zF5uK+&WHN!W$mGY2XKJsf^*ZBL@me$OFZ%?@2dd*&K*<%B7OmeLQ;R7g!4pxHC)3nm! zd9Y?Tzo>~df^ik=-InQJunNXx_*@k1lH8SKu_7rk!m!Q5T#_@FVI71)!kGwyn8hWJ zSW!0#%M(%6Rb7xeXg7kD$4jno$O zr`Lb^Nn1|uO&?wC)f_$~{scWUSx&<|25m{ZbiU44pxetXgBr%-30s8U+qo{Mv#_>qr&Yvq!T1#VO=UFdfm11 zf)!Z7RX5}*RIxIy3zkZstMr>92MTQH`8zfr7x73NHJX|yyG z0Ql4Ql0Hz;eHHH)CHNx5{+`0vM+%MD-}4}WMkA=RB_R zsutByG{S}iCKL?l()~@1bIJZD(QmhR-mCC6vAri_0!c~N_9p4o`g|E2e0s+s4o+d? znkCRmf|G4?lX zcqL39@;{+l4*-dvP7qj*3H6!6D@O{AP@j45Hge{~kCHg6pnGp7SX`wkwD99B3mU%( zDiNf$yJ1IS!`l*)(d(1;y65A;RO9Ek`@PhwW(Sp)_?X1tW!G_2DqNSY)F3payQVuQXC zlJ)Dt9ZHRJ$qps)Sk4_f8UIB}x^^gu^MS-`7u;On+j}y^O91;?T#M@~XqvFl%;spG zy8yuzlzDxHUX@^d%eMX2!H>_ir2NIP6gna>9dVS*LmZJaCsC1$RQe}1^ec;N5wIdE z1C~}{P-g`%%G6!Kkl2W$ghEJMx|^wSF4@gw$52fnttte)Tgoq|c!v}kp#k&2JLJr%AIEvYbJoOREia_GU`1Z}EaO>Jh9Qr6lDRd&2Ja*!_0xqK zK#g;W29SL%M{2-iDlbyfwfiZVJM5#k5sD#R{6F#y_Js3T`-V&%-eSAm8@IU+_-~(9 z)x)M;E&fjNko@A9+qsvg<64q=xE69|k@38)W6mO9NZ%x@B36b)#)3fJO4G0sLip~z zY~xxIlJDuly-baB$zCSgE{@#Glff>eq-!sezzT$iA+rrr|LMysbwLGn!J9%BMGB4B zqVv!iKIWtx_TWSJf;GNDu| z4xayo_-d64SLeLqMN%!h42-C4s&>DT=60b$gxXzbA+P|Ps>JTToCkyy0RBJ$zZtQ& z=Oz8fnQIXhyz&LhDrnPHR|PAQG+|ljho&&!y|?Y8UrN$&T)4NNA?ZhsF?MfHPX7(Q z1!8ZL6Yf`id{{>lwg%=>^Bo6z3-86heck;v@Lobt?DM8Qw~u~tOyac3)3a^qylfje zGmu5ZJc^|y4pR+uty7;RLByjpE($*#xQyA^wv@~sUAS+bA=^fdF?Qe5-Ij*-?a*6r z)WndoonclD=DsNEg+Dfn9mTFk4)wu`HF!U81h3-j4vn%C&U!K8}Orj84%D{xcIAz+NJ%eFk1x%|bobeDEb&lINfGKJ*KC9flF zkA@r(aaIeK*EwgLmr;^IMGGG|73@r5O12!jP`jQXQ%H_6R=XzW3SsCy!YqGKsMc~#9JL{Oz<@=Xu#xrCc$uY)i#^kKy;9DS+f)smb zTj>yCo8m1VKTGU1!my{g!vAmOyTmK(V_OS~(Q(ua-+^6ZzdaZf)0kUtyRROge&Wq{ z`PTP*37ky&LvZJptNHWF)MH(Fub>t{uI_%vmjXFXR6W6_Jxd|=%fMGgsMPc{W;!p8 zNzPm}@~Fw&aHoeX%#vKBLcsmRtx|RxGj$a6U!+pckj5m(7^_l~)0l&A zflw(r`>9%+>8r6}PH*HB02Yu?A2K&7ohopwywb4wR6U!IrusAYb%6BCxweMvSRYXG zd(;JoTXSJ&$Ez|!@#Dd+y*uJBS0}URm8m-IN3(F?VAO15R|mj@E87m34h)^2dH?=a zKFF`F_aK&QyDMUc?1YdxR3urQ$roFMOhDj5$2QI^QwJ+Jd^J$I(!GP*&+innQy$ew zuXy@0UOjacnQ|^EaD`5^B4^!fp0KJyO348>=fASeV!5PBwdq~pI{Bw(sMC2FYI0^C zXCkfx!O9XEIYmvu$|lcPT8O}p!ZHh+fg7itp-#yTKo^>+XUI^KW4z+kxBXfkNKoMS zl`>M3^V6iHO<|~AW3?2*YSDRav|6|OT?<^Ml^%sU?cHP;y{>UH9!3-4qPazgv>X}k znY|;(!zaJKNRbArmZls3@*tHvIaUL-x(J(o5@iMrsa5|u zwRS8XS=9=wA?I7|9<;z>g#yQu>2m6J1(5#zhA>^^m*O&Aq|mVG%4PsK-Vcipo31tA zJ#253U)&oi`OPrJ)K6F|@{xHe$|!15=KG1fs?|lviZD-EmL^G>g>@Q)?&wEmBS$i_ z%hZL|>KTwDIXI zCQZzfrOsdkBLC=@+7&sy(P z^L|)-yj!I(&`gm9G7ejUZCd#k2H!K=$Tv-yDQfaMj*0+!@Ifyw78j*-+EVFMWmTDn zaT2G27%)>dj3^@+9&SGmnkJHdL0@9GK4D7uJScBWrrRt#^zw)Lg^#lVMt_)LR_BxYo_W!fTbNX@#pZf*Nd(e#w5NR`#^riASV{=H7m#+F_o|W*P%QJyzFPcPm{YdO_*R0!%H~(WRje8~j`ys*kITiWncr9@n z`gN6OOcb#+HI>L&9)~GwB9V%u&dNG>^KoW2HY_7sbB!=HWSguZQ$tRAcl(wwHN)65 z!qhk(kT5mw#%Em+*hEyMn!wAdh1>v7x*^QUdoPdeKT(-<)x|Y_>aP2g*S{t2?S?-J z>TA*u)IHmQe{R;67kTLWsY=7g%W?G9OO6-Sm18N+-QMGL95Q`jU( zp%Gd;16cNcSlnpsS9zB2OH@|;;%-10xoc;BbUc<+tV9$=&C)QgSxC{xu*T*ts9_c$XNPXSYEgw9Xdz~aBQzWAD2EP&0IWQY^5xf0f2F4Cn`Cxm z_bO-#&7D*$x>_s+niIT?2)Tcu3zTjf@#@39x8zUon~k|=s8=J$!;3Zn!1%@Sf}9#Y z9fFt5gW!=f*Fn~#O;j)*0oP>CLsmpV!xF*kNR%RqcEaS7;^ir`p+4zm?zY#PN@#Nt%1@iLxdOc z<+5|CG3B`9DO@K85fDq zva(7VE_Z$rxLYG+HU=&uQCB0jHzhlFdpl5Nqqg^CEF3ARwzozZQ+C5>&n^2+_rW;uie0^7O6!m)noG-aYEFUAK zYS$VHq1L>6SZr#x<{Phv(yRLq=Bia9}>oZY3EQB-# zClo9yorj$qIxcF{P0^U9W6e~p>2+fZ13l2cRJQ8xs{RTx4>+S5aRH5)I*5WHh^x^m ztwc{!x`GyP6&hN#;gvPKWEqMcwx_u7IO1Vtc%uMx1h_qvg_%MXLkf+sF*7ih?}x=N zilOzU1in0GZx<%5HHOnntaPg)Z5IaBsQ1Kq=;w9CS(e8Qi_mDC8!L&?syJS1hzNXs)B8A?i`<$3cb^0$9!_dB6ouirnPqs4pcdav@b zAnz9TSO@JN5H{Ve7_vNVm1R=JIg3YNd`H-`e0=b?p0quykKc=NkpSVeZL!mv^se|4 zNhf!@ca*Y-hY!`+H{B-(mMWj|AGkuov|QegiWC`PSZ1Ii-w%ts42!Z1LVXDv_!4fU zH_Nu+mVIBZ7~eAG38PW5KPF%Q;=4RD)&es`gb|_MNy+`J^8JhjP2od@V8J+-<|Orl zC{D}VkCM=BL~OifMq(957!eX*In#)ct)WI5k;%wSQWA{_cF#iFK^8PQrZ(53Z{o@O zj>st8u0h{fDzSkMx9}P1M@TK)h#fc-8{L~qRVLniLvVuzVh&5;?P< zG(q4?-3k+5`l~*6UE%>N(=6ulvMlP-P5qqPu(+ITl{7-ZNEq8p1*66tt6-A>a`fA< zx~#i&%+Zs{FrO<2PAcr}dhNZ%{-P$z*X5*+lFC;KYOC?6R|Z@Hg|cTxGw@w=?0nYz zrn?0+J%eBVXb0Ry@;S(ph?E$iDD%K!L*f@*Lo2McGNt)r@=(?FSi(*r?it=4SkuTA7EHL=OL|z#3x3HP6E!)6D1LNDxY9U;^)$> z^;1^VNz96k6R_9{pbb`@?Hsw?%T(j*Okln*$`HfAfIf!QKu=c+3;?pSr54A~+jv2SSy8FBECk|RL2_aM2e znroUU4a8hek};}mORM7bk$8n++O4jEM~^0A9qHiR{r;f~!*(NM z+6%n+#p-+e4gP?Mte=+4E|UbW+!U#StU`i*=9K`f`KBAbUD-o>FBsnRbgPr*e?M;M=p*su3W^#8`BGxySogFET26&w*vJ9Tt=N9GZ*8fywDvb^zb9_4Yft zgukn(aPa=oRly98MoL(|?1%UQoPR6{< zd7)l<9{GM%O0$%uX~|+gk69UnDf8<(Z{S}AAGmASV8DC^7?6~mYnGhEcq7cxWH2Bp zIbfD3v9}t)X7s&-=2^MlZd)Q~wIk!`SaY;jpz7^)$;g#=)Uo5O`Sfe`X&9@kM=?X; z2CSi}br02^(}d zSdJ7KVT0y@<%Yzk+8~a`0j`;NCNREws>=&6IAlYzH1@+L2v}9g3soFe5#wQ#vML3b ze9p@xbE8&r8!wm7z{`=cb8Uo^B5;I_n2eVrCEu55SxF z@vx{K954{Lpllxuzm7>BAnF!OkV?)SR*ziiR;-VYP%Cdu=t+M9kSxgTVc)k7>R~!K z8y2^4T^et-MC%xRcD(wAXkvBCQFuVp3YLBxKphj-)|!`G04om%sf_&i->P|7#W^|A|YH|DCoNm@Im$7WA*t-8iF1LiHLh(o$3` zOtXN+1((aI(t-uCU*@99>nI$^jMz}Udema~_6q3Kd)|t|YHzUQ=wOj(_h6G4zn?N&mxJy|kr8HV9_VgJd`3llcZ^t(8NZ!OM4PsFwEX~r4#U*t1%X!R-B8ieHs(D%tM09K%UOoedN6OB%5Ml|tHTgMnK5sC}Sd`9yU+ZCBu7Jo7XLP$I8b^-^Vus1cV- z9Zjy_1itn@t$+n`yZE|-tJtbiec-pMfI*QOA|Fv{rdnHhE0f*Q#hHI7k^@wbgX&Rr zSu{ngP#mQzH{th(!@syUA3J=)`@j80Wwo4}?!4V1MTYHGF^^YqNc{hbi$*qBLXlW;;)+^Ss+9agk+p0+@pX)Ud$~PSwTFk?S4vAl+e4tcJy&U;#wrW=l z<(d3sBmK`w`bMoR;7J^0aln#1idfu~G2f^rZ88XylyqNY=ocXxP0gS|+v=8a>hH^qx{Z0HhRR|AMD$L z#-N!-2vF>CN;q(Jz&NmdX;Ubu_E24V=7es+YuB0(_4g0ks}mD({43;9c-dVZ`lV7f z<8pv2DKf%l%xg_c&YVk^HZ7`%`I(R^DXM^#O#>lB5oV=yZW}Rh-r9iCVg_K8l%1=R z&K9*JRB|$4l$1nu{PODd^_2(Oi8|>zfJw+}>#gL@d0hP2adF7IW}lfvhUWuHj$hK%%~1MdX(yyD)v$|=*Zx?YDi@(Mm*X-?kr6sGgOl(5u=qd!oTXk( zRSG{TOTj|FsO6=#@TLDAXDrL|IE?EcNHaHSU}57siy8P%Qg*IV&%}3<^216!4c|$M z{m+g7O*^*d9olV&$~^1xBGt}*g?x?X5HZ*9P&maU+J2$FY8HCt6e^&c|Lny9B*V6S9#HR$;xEBWTWN_(*b zu1AO&01+CM0(9t#{6d9rZ^LjdyGjk#D>m^VQWx$9M<_*hB>14!JQf4BG zvz)uhw+b5;Sj>P0lCpEPYbGp^lpoeECxf4xcZ-z$O(&Yk?TSffET4LJckTVGbgXU> zwYLUEQ@mSect<Bhjfyb9GlvqM;O9xDp)2mUIPLZ zU)L+3>9M`9_vfqq|JtET;iHcVrn!*X`+ZRZVyiFz`$gUv(bqF9k_HVbPedux0M!t* zxj@Vo#a*yf6L4e@0z)Hj(C4iI{W=_hE?Q{N9-!!SdoU>e&$9>gOA&RPmPM4YB8UWw z{UB#Wm4+;jiinqfl!+vA+k?Qi2h(v=wCr4aFb_9H%MaTFN^*Ri9zBNY)~0$R_Gz9o zpbk_s;{MmFznr93F}|Y`O4d!TGbCGJ1%t2Pfq%Dut!q>cQJ92kPw4PU3yo0i89=R% zj+vV@NktYX%&(e~#fem+-1l?lC-R!d!=Ngn0sRSW{h5w~qGjjm&paFyEkCS3lW2NH;>Mh+Z@%0s!4({7?aGB~FsNkHb3uOki>SR{_zrvk zu~}~xTXQPE`0~q}_XMDrej=x`Oa?xo=$v!#A4944EaxD}pVy>$EXs-%NzGXtCW4hw zSTK?0VO@&aPy7MDII{J4I^>C#ovX*>nv~flw0A1dX>h*5laHKvzrtXp)fmxqS(E=X zm6WQXaP8gS-|1Y>d2U;I1pc;!X6f=Zelw@?wRgMom~`P}{cTT10GMlI1IBNToXE#IK{jM_}?Q(UO!)SK|Lq6nI-W@%F7 zEUpWm6>${Eb6fhnsh`vlcUB1`er#*`bQBdWJ6FreH956>Dt2mczCkUgzVkYlGft%tj(wLnZ&*N+a0eIN;{8zew+_7eD)vSXH(O{${Mn z))*mp2gnX+`1|bEPZ*zD0OgG$w8vk{rK1%z?_sgUOpaWQTw_lXiZx#c0xC<52}a5y zU5p8%MMhYpS(vav@k=o$5Arl&-yc;Eoc$x)Zfo{ExXdU~FC&Ypnv1GpS)Ii!&g-0U zKlWLk$3ZHjPg3O0jueTX*hXnO3XGPWYm~?}IgQd(?APFYgGOnP_t7FF?7%GS*`WA8oZZ`ElsF~p8zhpT-&_(Dew?Qn9)8V$OEu)%rjUTiuJajf1iknGN)hq*d) zUopSCS5y>mX?ck{3s#^Mhc*IkNnK~S`xZP1jM!}#kMcvx>TJbszqSZ}b$OR+P;IKc zuX@h|GS|RpflqSu4B&3G_^?QiW0;8vJ906!ixwGSM`l2~K00O&coo)C;aF9a8Svbt ztmHw?!l(?m;8~s)1M$Di*2C$@DO&b5a0Pr?@8p;MceL?@zESf3#vj*zU6tE&9jEUG z<|S0kCE`*s5=x~=D;0D}H+Z_=@y(7&<;C2T3J1uuZc7yk(W5(~Y?I+eC^~0LQZpA} zQU^_5F+XS`7IS$>6mc#u)Vyqb9yGj8oh)RDpW9ngS=Db6(}yi4YYd`n@gXbqbKiz+iqv=4F|>j{av4C;j4p=E%HWL?XVg7b_eWt z+iKD7d*-mMyyYrdj4qA4h7cDzkmg1VwR#u;wKk>A~X0{kI>pV#{xdJ6Inrt$Js$1}acR-|3%PprN# zHtkCHp;AN1<7lCZqwJSNsXg_jQN5&Si4i(K3u;BroCS5|`&G^2sDSq5kijkDf`!nV zT%?sB4W*$9Tj!@kt!UY?I#0AY)RLgy)wi*%j@V#y1e+K&u0@}L{<;g#!!!c6Qp z>vk(%TIdQ@Ig6t(JBED!x8M4!jKknE`Sx6-~&?H4<6)Z}eO-WYYQaBl*(aP|EC zg9@qjTK9%2rMl{_oH$V*UVG6+=zcK;2zLv4)se69=_QyD`9vUQLgU7Kn8xbTWMEYk z7FGn0FE%iix$;>LtfHov3&{6drTpVD%u@_Talx^k>BYC zk~KJx_t@5Ai5jQeNDEmH8gekRyd7as&>-*O{h8mLNBh#tpl?E?$nd5P=7F4s#4n%^ z?&B%u1+mAkk2`5;)D}43E`@&frshFiN}so`iiE{=oHGtZErmQBx!)VL`?y&hK9u7g9^>KKAW-vM74_t}7oYG(z`g(M1i4 zPs+2J7vHxy>tmKG2YXV0w%WVEbn@sjEdb$T{@(OQJpxT zEzpWDpLUCC>%9gQQ@w)lpWbKb%z=}7<#n;&@=3Efs?Ytq+()|&2%Cl^ujAM17N~BO zw|Dw>e1H4lJ>dhAkK)wY>2RoE1{~_6W9BUJc^UAM`4P}R6iLmBSe{o^UW7$e27Xo# zoL4sHD42mcB4x*G!O#eV7Lbc}Yk}ig-C95{^PCoR?XnnLrfTnpC<&!_yJ$CyZcjrS zte<~-2b+I*GgB*aZszGwpI{!;XGr{+j-Xr~L1I(MBc4Ig`B$h;Fl{+8^}uR#xjX~~ z5-Lc&uP98oNWw&Z!BGq@W6F3ULKX%QuS8asK{#*_*?^#61|W!(9j}5zBM>S`F50bv zj%RhNAi2zcnhH`Ya;o6uK9nf>e?W)Q3w5Z07f9$2^{|B~lep$J%kmT=89~L0EaI$* z%F_3vrYhV_fk|LvSArSX6;gJ*{tS&k=nuJQxBfVu)vZ4R3`KoAH(QU6bir-~37LLjTo6cFk%fqsY<8gXLHgMbW)|6h7y(Tqh!nx&#)zSJ!!+pHNc!$2NeN#e(q zU*(~*v04(?z>i=C@Pm{cuW>^o5E@4=+O2V9YsJ6)J|b4=?64?R$Z%(ZreXInc>}+D}qvLtQD98iOV-{r4B|0r)RzO2}F0wkSW1!>C+!n!xpae4@D5UIo zi!d|-VG+nhyDb8VCmCfCDCz&-BFwi4Q?NLs&YzgA&ZcppY{ITWwOO z4dX>BJ<}rPaZve_nqjX?=!U{FZe@q2w}1Y)m~i+1mI$FsWkI=Req zcR)aA5L=KM$GHWk11o}gzzT9^p2b-eB|gjRxB^1uiWL!WSX4xHS@A5ZV)qsdZD2(> z16V=Ij^2WUBb?uY^rD?x(Dkg&El3J>wK82|2VxWE>7_689sgl?NMA%$%)vgUs3Jq`ga0ck&qhsbOE4fI@ zhSj_&Se&H+E2<=AO%dirkQctZ7q~aP4S5J>Kpsfh@f&^`E0sy-cLL{%Iqu zaPg~OKlhbNV6p)qU@mcbtDE+b@cHg#fp-o6)DRwHq+h(dy?<$4D7$+wP6+-v#7D)- zLKh4SsUQX2Vbi95?rSeBienV&rzVI~@n5aXD%w!!=PN&W?fs!B zFAlB!71(2N#&}(OEAhhvFti9 zpM6^D@R@>=AcaP#{tO0?kB*uBpb3I9Ygm-mz{Z}yl_^VET#G6wcv(kcAVy$A7Qz{j z1yc4yUuA&Y;tJJb*BKC&fLzRg?43jQlVWZ@FZgEcq=t(fw&&+o?&5Ri<*j2hp#kOM zPx(H<2AsU4H4MA3b=dvTzqq~u*PfmZWeDd%8HU6!%UgC7glsF#nPBbaD_`l_yqlQy zr7jFhS(shua`0h70jbvnwC}ke0_zr3KLv3HXK%qo63IikssIG;RzMrU5Y9j_kg}5% zkX+0N1*BvL6>!v~juJ+4025)8M;t^g;KY+J1Nw0voJ7dy-0@)IMa!BQZ(`ruMcuU) zk{2NPQg?=U)2gY0bm3BJ_*v)U7spEJN-0uggtpFV2Q(-?%t3`UER5HxK`LuD^8Er~ z%#HLN>Zh9}N0K21l)X0!WzVETz;C*8DygLhYD=)pknhOUVlaTJv$za63 z@(n^~4)xBu;d(E`wN$&E6kS^6PrrYV+ACGL>qdGo!b?IMFYY=-i;U3588C$R!{WoI zs{-ftrN_7-H#faIqCauq_v#Qb!)A<>T2e2?RFtqLs|xAf!ZaC=19q8gC^a0K+#=RPg0u+6z)*gl5h|XOJ^jB5rsY zHY|=Jc`DUO!Fa+87S(|tg~E?S>E~~v{hZM``(hMKi$#P0)q{FRGoJZQcX%o^vNrwJl8~h4NHek zx4i3aq*H1=f3aFi$eF9M z;dPLetO;YE#bMbn9@IH&;wG+yNYkKlhdCn~8A2{^jIxoBHdWck#f(rkN_J4$MosEc zG@2@7s~SS8U1{?&%< zyILd>JAOKZB$`KpF(f`Ctn#?PXqWc;phJVa!a~6YRCAcdW=y}{i*9Pd#$-iH(! zp*r(8KZe97lIZJG7GKvn?)+oksSAUn_MH@{!pif0akn3c1!-BM5d#-a=$AGGsl0QjLZ7C;|zrA}E zb}D+MLNq;K$U5sV6tmqS_-)14+lLlF+3nJMar^h%3V!txZoWJIP1qSvBv;mQTP+9d z##%)>?AxM|8xdOc<6aC>>I0glUh;4`0KG*EMYkJog`cT{V^5!z6$cW851CI02F>@T&Q5H&H zjz>IWaZ)#|Y?_n>K^BRu3FAVz({GWDaEWFhTu9kVH}CK`#O9sckA!uMdE3|$Py?w_vvxvH8p@h1mQ=E|#aFw+VB?#rt?)lOF1@zeI_?YSXO zTC1B=3qN+!v)yWGfpOD67l43WKB*q;{WG1cLUE0=`*(L{D5~i!{r+7i$#k?$G!Jbv zB>qoqI!nHkDylMGRzAxDsF;rPl;uSv|K*Dy59%~YB6mJ8vf(w+40sJGd#Rlm9*3|K zmv@nIifHTLKIG^Dw1Z|kH`n6(%?>gUrb<<%)K_i$ccIzAp#ul>R)V+GsxAjzP-wq$ zHl88ZK_>S|i4kfxkLiM(na4#?H&x6EAhwUgAd(lVAY(!_ei0W<5vOhzn#hKnL^B{K zr0k`8d3YRRFHeP;&@+xc@<{Rvb(=C2Z{fJ0&H5fr ztctINUE}oPJ^#R8ss)z zp}gdSk)A0jF|4`qyv8&`;*&@n4My~_-3hBA>N2$@-$|zF;iSfvC5uJsGhXMM`4&B# zTWxKOPCNsnL&{#Nw)B_h5WI5;4yrBr)c^i|%*jg1_b02C@2QG<+KX1+{?s2&+jw^! z(XO!RHah^K-T!v~rV9xvwUi4s>i80ZL^!#XEr5(d&yg{-w62fjz5bQ)3@BBfLL@^9 zjnMXaD4-$nSvkqaZnORa@{;5`3v^c;mOwRREaWvhFRF@FR#zOiHL#&T@eC*sDSN3k zAjcW922kqkP#z+($aeZ~okg)z-AK!fsXYO0UoVZ4aHQ;LzqIg4CQ!lpb zC4cf(da{0G4r-3w)B7OA!QFy7*rx!ENTCsmJOgO-epuWnveeNBIC-Hq{^|ILPi}NV z5U&L`2L_WSRGQfv{m$Vd^0hPl+Tq95VvYY%UjWlz0JFb?2?I)J4X78G z=q?Z}2IO!YrUfgareV3&1;T9&Y`j!F1209&UTO`EIs53%}H7ca5?G}d1^68#)6U-uPbSx zG{ zmN}))(@cyW0qH1I=V^ZofmBA$zY+wqM0rb@<=xy=`;bx{@yX zS6DMuvyv(!;rq+%ntRI2cCu1C$;u>ID|P19ttpTMZSKgDMwIM$|N4V&03;-(cu=aUqce1x4kt3Hdag)Tu-lRo1e)VeqJ1>yT4D#Jp#+yYVb z=wbKbN*-rBNMc?0aDMGC%ayaL48F+Am3)Y5CH3g(rM?|&`jaD%QH!QsD#A>~Eqz&Y z#jWzj6oU@gG|B=@X;DN9onQmzu@{YrpHcs&;#rSkv0(kZR@7Dq=JEPIuo!Wqf-N zegj`_ff`!}tUd4vv{$ch#qCmBKj6l2!Kmr)z@@&^k!JBcq}iDGS?Viy>*DF}g5mlw z#VyXtU41LICTk6Unhs&1mMO`K5K_~u;vtkeHJtH)m#h&*og}p%SCP9;FR_tl$qeKf zDSM_WljFGW%GZ-6Zyb`RMV?4;IBS9Te#8F!FvNU^9C9-RnZe|DEuyjQz$T$<Y8Z_c4^%@T+77{EC!4ckfc; zjPG4aa`e7QN}hPlB;|)x=-%zl-oID{CpS1ZSbxD6^1`QYnRVN7ESB3CQ3K&Ok=J9X z6JoKEn!T3Z@dRu`9&>#OpflQ4O5ci$l>mR zH34%beL$ywiU+y%RvQ(@1ssKn9YYnYkal6w*V_ts4MZ%#9yloC)g%r5UhdS#@d;nA z@Q<(mWwHHB*Vg}XyZy^+c^85QIR18o1)0K^L<*f?LFP5@B4_4hneqlYtL9Eqy@H#|FCShi_?=WC!{ReUF;t3U zr&~*oqzmaU#%27cqh*qLXqhqbbCL!1z5Ef}@I&ZZA1ji7P`>4vJ|(q0P0gD!Xc86) zA*4^4#Ej=v!D>%?cNANWmOi7Fg3J2u`ZnSnPVWzRJ`)5x2y9g<^d4N~ybXc8s=KP#GaK6;20IY9&G zp@+uA&&xBa)G@>EP~yJr@c7^J3*d@xVolJ#)U5ZJ-T}2udDTHvAR_)fDMNH;keRWImQFd%v#^h2z@1A z!-+c}#lBs>L0ajz-%f4(Ne%_>0x~O${vALifBX9N(`#&r+bN1qo7nR$--<{61^9E{I21Vc#S%_`sy77rl+MF*I_M{v2l^QkKd(v_s*g0+I5QZa(uTpa zrrpSOUn~d&5V;Ug!UDa?7&IqSTVdW*~q_*{M27jd%U=3!#cr z*`r9oK8bjI&NmLxck1jrC`|pOgQ0*a#{6LkEQM_cAtC9y@+ANTw0qmflHhzrGoZM* z0XiU;5C(#!v`6X;sRh)@J{b~GOk_6PVr7Kyb79Cb6sln0v;t*bEf-Q;{;XVR{)oS9 zG^U^*4h=)CSo1+t!2>-wb3mo8@`Sd~lxPl+?Pv=&J51MH7& z1r$Cc#Gm}Won~x0(kYpTbQ%+%khl$WcL^ zR0)7ordqWX-?iPHsz$Ioo4)8wThn^ztpR`~v9{W8pfAz?{8A-{aI6&&d8^WV@uLz7 zYTQ}{eO6e}WVqUmw|ZQ9@VNhxptNyy5K7c43LCXS;bi=)!1^{EYnN@oC}NZE;6PmcH7 zQ@Lr6efQT6p;0^uDQRi`<<+sa25%g~?^hL9mGifYRS6XOax`x(#6}175P4Wxi=nW? z8==ecgfto()%kq0;z)VES0z8l8Gk^x=eDYh4pp7QmhA?*J<~(zmavPzIbP7E!}N|A z)!}p=Dc6|zL`IDVslZHsdFO=%$fYp-R~d8wVX>bEtcZZ~k~c9F5JG~_t-m%HES&)c zBW0)RFWKGArN7gVWH+wI|MSw(2ZR)Rw>1|F-BLrj#JVpC+z;fyz0w`V;gDEM{?617 z{mVZGss9%hog*~t{APIcE062fJe=2l8`(_E+v^tQ$-5?`R(%K=ov=|gLnI< zzHiELEIvs4(2@7ZrFguM$J6Fkwad{bqIQb#;wohzXSEcfKQN^^27vIv8L3XNy@N|p zpbzm~4~ZxdOzeGA&Mh>A)#s?{c<_i#6mUA#*fVwuT-PRzNHHEZQ z4+t}x1`5pzn5co;b}N6)H+6pm_lZYqSqPVzTx;iXI~}x@&LglI6Cdx5X}Ikk`O^M3 z0F4a@^8{X5yUqXT@ z>w9bmC&Cx+BW-ig`gi>=gCs0iC|!Y}M%ijthCVG4z50rLYaqxldg-_Nt=UA-Bc04E zAfZ_>IG<$?hvvPKV|{&7l0QRfsF8}4T+urGzaSF8z7}Ym)((T9po{+=1=SI9S$+2>taPs1QF21Q)?z1 zP(4cCPtxz`qCs#LxB5~E;dq6|-?IOzM_bdeZ02{`bi=nP?G`a;$h!GP>=*fI_JJ4F zR+#{OX~U5Bnl>c?x>GwCvJM8sIy#{`6)LZ!dhR%I4G8sVylZT-aWaDp2e6r?2$J7y zBvGZ8YSrR#FV`v15{F^hWV?OQOeDi3Wjx2PiDRSsvUKH%IVM?X|H6oQ_Te-^_AxjOELv zAkZ9Y>n-OVY45Y`MMC+Uc1laeli}Z_&-4M38daBp#{R>Zx>T{D6k>`eHgHd*VgH9- zr7ur+?EN`-!;TwFUd_H_oZ;ZUkkei!44S7>%>DP^(t`b1Lmv91*pQimkXs?D^Y4aX;hcN4>iSds}dM;Ey*e%WhD}a$o3IfCmE0)P(;;2!UOPdY;@Y9 z>y3@h5ODrm^WsVe-Qdz?dWr**iFJED;3_7L>}zZ01S6YN*~-E{9RFf)ju$NhbBjcm zhXUQ;7c_bg!|4h%m>)eV1$CdemE(@PlHxZn9D%jaBa#3P)nEclI^p6i_$--L?d-yv z8DT_xTJDu-fxvAQ9MVds z!u3zu!nCy!Hxsz+7RMwXbf~8WK$gcOn`l85H?AweyXeWtoS9-0-oEXMcW7SCR|9dM zJtD9|ybymo9Ecz{qKt3o?!e*Sg9G!#ivG#3$_m9XKMx~2`GQQ&L6{RK!S3ZN0b6b-lSZ?H!(bNyDy_N>WF3et*i zizZEmVyI%Z(4#x;?mJ^dUvP8R3v2D5Dq>TCE8CLv?3-ze;_OPQl{aT5G)RWm9X0 zWl^&;96HYDQ-bXQf7n{)>%Y-D{abUo`>2!*KYR2#bCkRgDDy10l*Lq$1hK`gsXv*V zi3~ZQ6u^~9N5!!dWda22G~{Hb82k7QIVzQV?{Dr`bcAk?uyCL?5dE=UVm7#V8=L>l zi@L7;h(yBpS{wiKNCaCHi8dEpyWrbf)ie42b#UiOY+FeOii3WTaBxNRlLM(Bm=#2o z+4zwYp9|!H+1PYn=nvFmjV*hJAeHzu$>GR89aAB_&3IvWk#+EKD+Xs2P$V*-NIGyf zU8p}rdO|i;luSYsz5<3X4F7?VDC4({D#SrbadFkU*7?P`4?{)p58pdHBHM#v3B(Xz zqz!mo>NgvDXZ$>3t9u)u{f7#Z(4q@DIRMI{t$Tg~-39$sX^E?%p6?|=<9Uz7coRRE zqVD%6My1c>$HvX*nh4m1NG}l)^Yy$e7w;Zt*fA8M=^tV+xlZU|~ZZ7UA(FlP?zNzCC{UwyMFb4H! zUP4w1JnoLXNGZzpqfh_4W4L<@=XECM`76%L{Wh0t(x*EantlVh=Tw8PY+cCvMkTAh zG-7@7uUy!Cz;WoPdbQo`*OL+VV>2h?!TC_F$F$ma`H*MC_i*-0 zdw0to4(TAP45ha2Azr=k?F)Ue0S1Ml_7ZiwEryxU{kUkw5Fwo32ES#%GdGrkY*w~( ze17Jh1teX1s-u^BvXl;Qp|dJ|Ft;KI+ylvkP5Kk@RpDD;CCbLtq{;=1`E0FB|bcH*E3Jg?|;!n1Gu=OEZkbi^&~p2YMaVZk$;S}Cpt&Xw!kr8c0r@q@n=f+X zg*B?&7t=g}tM)o7qaCxvv}G{}#cja`5)VA^nnYeE2srQ;J6)4asMQ)08^3i&QHB4$ zL|ZPGoUZsWG4^)(SDqX7c0F;{Ct>(Pv2JDEw;4$DMR!J^^OYe$c9j!+=I7Qex)Rqz z?GJgGDsu#7A5KikpM7F1k#$>+JOvQhILrBw{fz^q%^o&sA2@k~p-@wP*kq0>3Tc#L zNRa3&=7&jUh9e0(*YLov%A5|OOKwz6%Nrqxr{kmKy#^$>tfF=*%(U-eV!^UYxud8% z8g+u&r^dhaxt4c9VIl~Bi(>DH_0w`c5q`|2TqyZS3*-*^7R2*R9UCK!4vjVpVm3os zc4^R3SGT!qj!(}2)_0!+KW{n33KSAY5i*XpKHAA4CY&^#(S&*x$C4^Gl1M*-QIZQ~ z2lpygC3MA4&zudSOm0M9P6|j@cBhb#TAptK8O2OW1!1&VLwyljv$;(q^>ixC-iB-k zc%0yt#e#4^WbUI6;m}Kr)iLlE`5&TpD2Tjm;xG655kWY~eYg?f9q^4cC1#0F3yBd< zs4O9@zm@TdZbHp<1ZZpb*1Q$+*9ISg;ojCQ_3;}!CvweQF_>xvR^?~{IOawWkJ+3; zfu=(&1q~{}RjIw{Q6op2@OS;FM@YVz|_*@3#@Y-806vcsxhDzYQ56m zB4w%okzQLEe|Lu*f;-)NmJt>PWg5a-fW!}W|5L0^5^f9wLBRVinsg&mPz8M1t)6=; z4FGpa)N;BGei4Hsb38Q$MKmXu&#<&gb~5Aa5gD?5D#5LuNM3s}qzBwYG2r4*SX}E@ z&igH16w6;UMd3;4)8_x~E!rUCb*RBt483&XIY$*x_xEIOaEp1c7sOwqZObx%MWuK! z!^CR+Mel%AY(=$JSV)C`@D7-BVydTpxqUPkvSdTf{d}@6 zX(_CKF{!S&Flf1md|htU`KE5IT)TgFKdEFEsAyBHq?ZwuuD)<{G8RPEW%`Uj@MRB(RZRgcp_(?EPrmY}LZEmBNV#B;l&;ePmjPehWoM2IzMFK#Rd zt}H#FpssSSJ(8A+#Ce|ekRb2M;c;>bCYl6et!r;rZ}H4mnj#^xyPOR4U93Q-&rDK zC_Q`hCU>M#pT4iT&)N->P%c+Kh~4VewXaYT1g8_9$ZyfD6dCcjPzzyR#ZR!;lvQ)o zgqYFEvuObYKR?C7g>-Sn-TD~V+5qwu5hY`C>$NTStbj=^GlRVJ4?6X{V2gOJ1xHDS zjWpOrOk6f&^q%xFTTnp1EC^lcrFKplo|#>f0_6@Fq$1x3t#!AdyOi6ayEzS*#_FDs zkdNrPgsdRAfy8`vqi%`B^xfS?O!zJC`?FhJP}Gou)_Zc`9OUL987Xh;^W}vq4dYEj z)_#rlQLc0j7T*I(?Z1fL`lu4tKdx9y${-SHkOwVeTIsRP2#dTlDxOh|^~x~A2pC|r zzB3V&(75aM2Px?I=@|UueaQ<_trre}PAQaLJd{p@0+(U3awmH=6)V3IEH-9Hpd~ZB zX%>bYwX(}NV!`+J8TPX|)G^fgqa`rg;RE6Mv<;`ES5g`+?bU#`jN|3yX;Ge?nMpwt z$p6@c0{NYaGemM_ah0~*P5_D#jJSIobn^CRlDj_fbnS*thAfdKjUEycpyffS5L##JVu_f zhoHz|tw`1zH5EYQqp_IYO0K`9(aMJ9;FDgNyOEZ9t$~})I_`u7$x^_*c5F6y*e2yFiPX_*B4vG zTNj8Y%H#cA+|xX;@hUdrJMUhDfVUvr+qj^|w3oNZjLB8a3`5$utmImnIkh37r!7;E%dCCMdcC2 za?ak<9gr;8{x~Aj>nn@NL+dthoS*SYX2~e7obH^)rYzpD73Mtdg`&=2-$++ote4sV zxUe?1>;+cuVp8#NLsyvcic^$!5FNEe^K~?VbCZ?c7GiVG+1|o{{B~_ z-+Ior1eKS34OIVH;lqOd;goz|Y+?p1JzB4kbCwx{VopSwV4XxN)DaH8sc|_V2KS6n zM`Q4sv8!$E1zdnFyr65K#gX?gb;Jq zdT_(Pf!{J+bIWou(U=VnoJfs;(=0^NAE0N^LMt54T6hy2bf6GqVys%0jD4EQ%`wt+ z{vc(~9^CP{h58z?gbPhCQ8LR~!D_#0E4fupA@@5=pN+3Gb|>WpMa2ED2&s=E{51IVfz>!f_jDQBos?A{;B z@ivVQR|z&OKkjg|B-Q^J7oZODQkUTO2L9VGs@}wA>M!6Dbs#PjfV3c@)gPaofFIn? zQYaeO9T(Vb7TTk(F`L_t?t1<*s6u&WuKx9fr{hry+e}v*Pfz`6fpkqplC-+#K%h@+uK!uEt3c-I0<+9 ziyqlvnF==g0d5KpTnQ zRPUi`68S9qcgcf8Y1vwpkHqw^7|KMOY!&uG?sEYIPG?F99cd51PG}?il5CG5Az$YX z4}}6V92;G+5HNvqqU%?TmhhyIx6nai4oz{Cgp3B2F-7}qo=C_NvVB}`KDEb~!iu!b zkaAq^(!mhv@rtzUrB3x$!c(Bei@PT^7X04u=3=j;6NzcFP>BpnFx=Xkkz(}Alzn&= zVd;)KdRHhC^p@^VvAT%}F8dcky}!Y}Ki^u__Cf-Hq%Fd+xrJCwHm*{`86UD6cV=?wJzLf z6w*(Y%EDFBR!7>ggRJCT^76K)t^G1iE&QkT+3cj<_n>~HVGrdWUaKu>t7pN@iXq9XPVrdQ`E6jLJJhe09`aJB*fc znh5SPs2is1X3$V8=wcEY()u`OA4~Bdl-&7+NNik%ASI{U*GIM2{TGC}SU}E|P03TE zs$-Fx7rD*RPh#KdU4jR0g@tjBAsSvO&#xqT61Am_vt<*fmQ}Tf-C=a!pl|`zj0*Qk zape_dZPs2eC20s;V&w<~;TKUSBFgY4S&AoB-HhL%q6Cd8?&B=QVi_a(p>vcfcABD1 zK`qBAA0HP-X@a^hZ$1kfl87}Gk4UGjJKq6Mnz8ohuDh2Oi2QonNC!gGGrxaJVIIY` zZ;N2l2hhJ1f1Emudu{@je}4i9+B**>b?3Y95o}wY!;W|ud*O4@y;z-zZLc)cmg%?M zB@Jq|Eq{c$RRdNIwJ}$r6iUxH+;8TwHDkgDH*2s$`T%nm2mGeg2l`5G@p-RO?7x{k zL^~-q7&B`nd5xQS7WosmsRu;EM0FyV$H=hCwc#*$X@ABR{)&b1eeReRv&e}&Gs2C$ zG<(>?nKve)YRNAgo>B%_BEkF=9`Gzo@>qT5y8ip1~(?xE}8w7HDa(nj}975Fm(K(*&)RfL}EqR|$qeD{4kn4^=yj6kj& zoeMdKMHL^Cd&D2Doj5EUi^*ZmzYlZL>Y*To%40@tTW%^I>7j6bD;!(oQAPePPFN=S zmgZSSsyZuC=GuVg-;i{21GYe~m_4(=kWik(`>LVA((1))$H)rtNemP$k#Pv(x|AQ&Ez+=#*gjQ;OYADJ~zWlNWIg-edD-n~ftw z2Mbl*c-xF6HiX^y9%>SoDSS4FNANM0m(kA>RPG$R^;jWN^FJADfifN|3~2BS$>Ch+ zu6`Jo!XwF~snV<*7 zKz}L1YE<(uj(_|CRwxEOLb(6l_tWgb@c_$|=oVR{tfm`?hv=^J^1oPxf4hfFTJ&w| zzDx)VVsyO52DK!UqBL~>D4L6t$qr)hrb3N@Xv>jxb!*4v-+#NyK~C(gD1db z+r893^X|`s?Vr{xJ9?EvOBss9jyqrR1^=!tRuv6l(gg6yC1i688=5*Lf5jw}M@_5r zw)$4|5G7kqk>q@@f9Z$PlCvkB<5Oa!hdD_ED66YaC)XsFTV$vI(p0e}6|-ZNb_j1F z)$2!q!T!OgZA?hci{XJ65Q~AYtcBKFwos2^d#=dmzh2dSvoC`>Rm*kNXtU~PT%LFY zRfWM10jjxXFY>52{T^C4T79#2IL{NT9frj#f_d_{ab)P*cTnxHGm{@J)QUA$Oqq=c z3O9CvA>4`;B4s<%d&;Qe(MY8r>KP{pT@+2x6s?O++aOdgztB{8r*j!hd~10j z7%SvB^aIhCgxbxkbdgl4pC4u^^EI$ZC21Pb?KxZoC36@|rvlQvPYp0j5rI>$TWLq4 z#taT4F{z+YB_muhe?pQP1Hsyn7K8TQ$%?A$r>Tz#{b==j&Uk-=#3N|>Y^g-R~S>5@7b>%s~ z*aO0SKAEw5OGpDR{3m`8OfFIY^1(>abRXUKOEi|$9{D&61PxkULjrHOr7L+vIF|-) zBxTH!Ea5;4qLSa8z74kCS*afZ$Zf*64k0JZuCIs=aE>Mfcbwx4zWi&1f`kJyu+gvq z;s2|_3pBKM2-z*7J^)17^J3X^xwR&cKyF2_Mu(vC&z+9BL#-V-mNacu5`I{EK5{*o zgu>hckSLMmjy9>p|1wOlj*GHxW=Y9LS&lAJ5&|wFGMCdlv2q#wCaz zF!(;6Vv9w8`d0cTmU2p~eLyOPz5|SrJpV-wr`&!CU>&)~MFr++R9-zI}-y($f>h3%*y=Gq!t!0fW)3dM@g6 zc;O;7nmejZQJCroAGveP?X@IJ7b_b0ml#tZeDjSdE$(1;XFl0$abgI#Oe5_()_2vP z7F%MC5IWwnmbP~=Yf!IA#^$SU0N^jBX?I zBOGR+{ZM)8oN8J-H!3?V?a>{z4Wa(1LT<~(x+FIQmxdasTpfiz`u`~xu~JconpT@8 z5gQrIhl$kfMcEF-kiQS=4(P{hl_JGRbx}qZreAeaQej3;Wv3Es(6vb5z`@D@g?Qy* z_$&9Frc)uFN~#9N4D+{?9U*a#{pWU-15p}9QI@7kJK60b0gAF2Xf zXFi$};pdvcjhrVX1=30AQ`7v9imPsM}KGiKemwQ7Lo&*^!*_w7J2iz&$-XbsjY#CzaNO3#q{|!;t_h9K*M1<58y{ z&!A{$lcU}r?Z}m2*8Zhi6aGDhi5_?fP3&5RaLqF6RmQcDA z&W^4~$G+#TDGjf92ul+lRK<``dA-hcwi^61fa^pLG)`6~NN#67mB#@JK3#&|M|bnb zY8oRxYenU!;HtpSQljnz>le)-k-TcaauxdTF@t8W)#DwD7O;i!X^kp5$QdNHBm8~3 zi_p znV>d>hIJSM@0OzL`a_C4Wy^5Ub3Sj7rE#SHh4*G?j^;nbiS0|C@jTlkGxGGk8jVLV zx@)>1!+hYbJ}uuF=7_ts2`#iHl-f#(5ziO6*|KQu;5*5!`~%NJ1Y}$s`1m{Bg&8G~|uu%WR9GMj~MX4OZ3Jd`+vufT@3fKQR*x(xVs_1{V7c{o-Z_4gIk6;cT6G!1m{&aU2>+|{9)=RTXd)G(kZ(5z6JKF0 z)IZvqr3@lWqgsG5@B>hM*rc#2byf_2vw~+BK=~uLee-Xlyxj+Fjn;qe&Oj*s%Mw!y zWeelXNYqKM#Cq-uw2?`z`gYiRlK6W$3UbTLxL&w34K+&#KbyjaxEoRMyvDmTY@E$k z3gl(%302A@jn9AKMHkRb5|MoTkFCxuC z+Du4%+?Rn(!9T&x`Zj89$6Bs2_fRlk@h5ldN3?4@1EjG1P2n#6^8j;MIM_Sh<@7o* z;s=@hNEfq*kv;wk)s8>{3W$1>C*GdGcBlKb;~nxq73>QRr}(}s2LBD6A`7A-Yp2zM zkOke|ll#J<^(C3;DIJoCqxpPW!SiJpyQ+n5N`5%uxAxpH_bPJ5R?=QJJ{ex6?~p2 z%|48V2_XTNthQ8=ylCRLD@1i+$X0uGRs;My7R5KkOsx9G5p(DvRW&spoHMeP2vQ3btba*N3b5*A;Ht9nVf;7$d-CTvBP>TMQ5V z7j$_2(ayz4<=hR%B=gM>I(4ynH-AE2S4_hSy8iE9WJk~9&1;TK05@4gfcCr7mhabe zi%GM2LHsW`OOD(U%i3`Mqy0uRksl-^T4gm>RZ$!fQS5}IWQg_^%F_MF3QL@_erlUz zD=rH5C8f0*QcT`lwb&GxvEt1}hdz^zj`NklR80FTNY}&eSvR*jM(=&;18zZcx_e-w;|+e%euq?e$UPCausz@^rS-T)(T>T z+bON01_cFO!*H%KR~kF=YP&5x-h|?OrDiYsF*~cLI6e0;S0(9bBhYfAu;FY@qChA> z)0)s+8Ka)PvQ%@VIyudm;hS8gx1y;SHvGLJ)=o)5obpLgRZzuG?w_J4af%g^K@6&f5kJ^$kzp7Q)!5x6~7)yc~MuPZ?D^l=Z($SE4UYzN-jtH$*bg9 z!Lq!D`Ey8Ds|jD7o#3zM+SThWU$0uNi#WsNk%O}0knL7WuZ#7cRb*)J+U9HSU>kM! zME2PGPf9xAsoIOf8e#2J7}SKW6?)UF@rw>ujJj8>x%vHMuM@$i#U{no%$nTP8b3N> zaMU6if~Ef;kxk*9kk|*743XrNr64OpE3d?%6s$5aqvtG-k&g(QyOBA^8Ba6~6~ZKN zghO|e7;FNZ4q;0Pn3|&$D<*Eo>Nwrqq&4sS!UJwtSKWtjLGhC zmjg2nu1%gvxVAwAJv44mOP$J=flOg~CP$^Cc0qBXN+voCOL@v#pv~)kSC!%dymG!KLI6IOekir62qHvfgy28!M=WMCsErt7^cu%e7G;B`CwmzloMgLUi(10h%gb?x%kr_LT-2Nh3CJFVK z(v_d^B#P5IMA=RjooTz0KgB7`_Slcghon*qa+k|K7P+lYJL)~>GOzhS&^&(B7RlKy z`?h5R3F2PzTEU^kF{{X|NaE3jxPvZ@#Q3g>mr~}b*B`h1*_k{QXY6wMp#I67y+VRc z#x`1LkAIQ?AIO%STupg^gyW-YnY*NExoH1Z#>%1e{Oo3G$O2#g>nr)%wd4tNhceJ~ z4_uj<(jy|c0kt9Tiysis`58xo(`e2WaWlQER}*qoyh}Pk*nL?qC$&DJqP8=NyD4PU z71IdM89=DCBurBRBZA?Vc;7zFi*|k(>cc}2c7u)Xfd)R`JMr}7SIR!QjaYPEA?M$w5RZyjiz0(`-&G1qF_iFd!H3?s7P48AS-lt0|vb4Yev5iIr!aD`EDyU-y z_=_)cud>1>W<9OQy7f&CqGI%V$;h2qFHio|nZ7(Uz4${P+~Jfmh4{!tstBEwkEZg_ zJ$t3rNVUq4Gi(+?o5i|OxD}CBFb45_jkOt#>W~A03AGI-h%z$y%lL57f?k9SJ!7^ zl~Z!MBnd&l&l~9?=kC}OW2~_(`Gr)G#Qb6Nye2Ya)%5$u5E6l*(`_G1Q>=aOOh}cF zK@_9#t?|hGq9CQAJ7*a6+!&KWLxQC_nP!ogXLGQ;xM|h;;1=soUq8eh-U!I3PL72+ zlrC_Ae$%+MdsS{$AZXb7!H)pS<4RX2C-Gx8y%a8Zn=uW^MDKSEO~(@C%!OH)kU%R7 z#2v5`ZNPOpF>&PDed^w6x@QpFNNZP#6iUaD=LMdT*^ooIWSH%`F#kX3cu*?C)9N(i zWY?hmp#8_nl!vA(xNKGBb7#TkU|<#z&#?$Tkn@BATO@BBoFshaMnNV}eBxsfd6=+(eFN47)A$AgpKMkb9H^5>K3oFI*gFur5g~ zaOdC-6md?8xO(&vJw5WFtXOJ=+vfGrgYuJR3b|6zFg9{`HE*=*nP|KtP4?*r!ZVIh zm(I0U3}^5cl79KD8?!h+GJ?pAp1C$g8krgY9%*b7tEmK#Bqo*2s+iv~+e*CO?tgt^ z3aX6`4p87EVdLp={_P)>&%&?Nq3IB*f1mt!UkB*u&0YkY!ORE3&4 zHQ*3QvM^em60S(|=Y*(~KKMQYPm79qel4Kh^}@{w%TcQ*8qJ*3%0cKss3IC+yco_K z6wVtE>7!2i;iT_em#zE=MB`}sl{v@^{q*7#!thQhhpwWxnQP!Zsaxy4F^O{cQ9;_T zrr6^A{Rg)^O&Xqk2KXk~7$l%SHoB7WO8Ze}l_kj&3EwVU36&R>k?#0Y!Fkw}o-EYW zq|57&v-W>tm>EBWOZgLQxh6cyn|>Hye9CwZm^;YTMqY zTNr8u_ynE^W`7E#u$@S#i_0X}H>c-2=y8T%%HTCE)IHD~E9Y8X3*@X-o|qY&XJH7r z&MqAMy3|&2vYTCC66~~;nWrD?HxUkF8iLBA$295ob~!30tw2uPG;DoCvcW7Gq^>dX z;($Z_6zaJ-D|5f}1%`_3Qa`Bl9!`zS8yPhpanvE;WLV@tF4%<5L*-oUym*{*Wo5ik z4$p4CEM_w#nv?(neD*Ui2pKqnn@(lK#Idld2;v<#=yeHGj^{4*E3Z?9L8Ji>n(iZl4Lt?B|1 zW0*$bJ^Z`7Q&Sj~1KEr{wXb^H;tsxtW2agz6m^eC*Gd$dOhBrqdJ&MDf1+@F)G?lg zs7@8S&s3SBJa*5F#t`MQt2h8-)4RoMebSNQ?d_oAr$$W;YrqE~<(`c8@vt}we{&4& zbmCs1DNP$K_}f9~`^)R-3V$?8$5Q>}4Lea$kXzT_IdXDtyza{|EMBGQ*I9*%%qN!c z#N%gFcfGhgMmxDBbvw_LUV2bxYC!jRjRR2k{jpOqsFb33ri5lM6&nc{KTn9QBBdk%%y z6$*iJTT{ooOf-Ehe^o%8sV}nA5=Ob)dT8yTpeAYro=v?REuMoe?Zb77^I736#<3lY zeMvsVoj&-l3lKPKHMx{mnWt|iqd<*7=&I)J5JxOUDj3!<3i(A(ItWn#Bto#P`~~2E zkKGyMT5ed|(p|;wK!yki zc6uL%^IAZRm$a+a6y68@m@=6LjUg9M`XG89vtq)?$s)sLPK|KNJul~CJ^xXW2>Dd_ zsLf8;kvJvBn8=o6A_Wy@&cJvMmT1l*R;;-94*`$MUf6^jJK1{-QpL~Z!P#Yq#p>>~ z1ZCq)ocY&EcjA5^!BWv)&(&Sm7QWAt?@P4~4fLgg@&}@}fv1NxTx~E0ud&qZAP122 zvlRgafItFR08|yNI-s+S{lm+RcaBhv?Up)zOix{Y9N${iw{3Or7R?1QrQO~ zcPuu6HU?h_PWBfh+!*+1696(W@OHb;_}##G*f35ctr?hBDVt*%Nek0l zX9{^&F=#tI>*5roPm0i`@6G_8HqpGa+?~F8(&5UnaxuI7x5G1A`bp#PgKYo>gD?R* z_rt3v-sFrZNT+g@cTd^0|Kgp#@-lX)EhFC6DXLA*WQEzH+GR7{PL2ZaOPM)>u0L(d zUlzU3{8jwkz9=uIrEbkj_fEg^3>+0=h%${azwcV{4U8Q%5q2_(5ei@O!7pAGelt*c zuy%;o=J5*v@@FP%Q`iQfBF-J5j(|xI*%&Anzi=*%XiTOj7+i16`2N>pf6C?9J#>LE!@ol9^?{qUk*o?~Z+^|SSDHv^B1Tpk)U20II-b%wSY zL$)Af);{FyPVSfVmL|Yi*CivZp#LPVq?_HkH4hNJ$d>77IBXRNx6UIt&N<#28nRK3 ze!@Z*i)~Gk?Ci#d^4|Fi2%eY3N1zBEJqS9KgWiFE=>#lWOk!P$?Z%$mza@esF?HDl z=fN+5E3tzf*0@>a0WYY|$4A!VSw*EKcH&dX?CCwR$d48*ktDuYctkX9`)l4CZU*`3 z7zMT5@u-9`Y(IQ|_I7Ws@L4XR@P+feF;;w)80txTy!HFIq5neoMEp0{H(=1V{Sq4t zQ#JhiW`TC23a3bg?ltj4uEo39>TjScf6zl_R(^u~$&u-JRvgzX8sltsI|eAQ9E@e3 zj42G))`rQ6>7w^PEfv4cR=Ke@ga6RNZox|0)Udz7BLp>DrEroHS4bQllSFr7f@>>Y zAG7ZWXgcE4UteQ(&;*M&HRQ|y zTlW{A9P!jYFdFbzFB0@KP7Pk(GjNviP%A_+{%G%p9)_i>FDc|F&rt%y{l*{AIuEB3 zVZq~dpeR}xfC+GS4A=-N##GyTTjN=IbJNF^ZZdb{eBN$D2YlW!K-ln7hg}J>*;&t8 zdL6&3*2@BBs}Ks$j0PCVuy_tt`WF_YS-Zw-J8MCVCV)B~`yQ4gsFmw8ZX{{LFE1l- zAKS(CbNxaiHczDF959RXn3}s;rcgT9&TIa_I(0bZG!D8T4^@-HknTyKG4>NFR2Qip zPQ&~BS~hJR_t?%LA`3W|6c*|JmPc*38x*J&qwcusAMRAz@NZ@21xLz$AA`_=(uY*? z#?FVW^{ApvmClVlf1aX160uc0Stwmj@8fM`K9HFSn_0jVZ@tgXpjbYz4wb$>esXb= zHGEV3|G#bpGEO*IS7;_6*jdmDJl@!m<~<0Uhf77>>yXIl+gC9S6xY4-mz!=l#z(q1 z%$)HY*cr@Z=B}?PLS?~YWtfxZrE4)4nsW?6Uw7M|{9^N*d7bR-?fr7^i#ObkKIii@ z-icMr_6=EkSgP+e&<~{IYnslK|d$8G9o&{eEB@9E&-k1U z>jRFnVqW>Ecue}X*MMizy{CKHH!_6?g>{$q(yPhWjORBm)8x{ov8gJY!TCk&> zN!QQ-?Q_(vTeast%-29XBlzqMei;!cXyk**N8m>P04+ex*+G4+dWe0_uCf>mvd&Ke z!sD7}6jXo8dYwvDg zDUdyn&KZC|i4ps&`6S0C-`?{So*P&{x^){&@Re`UIoz~Qmli_5RghAx7CI}PqGL8) zfk#0vqcFVkn;@iw2wYy_&4Uug;S`x%2)`U@rMgKS{i`O>(L9mOT9d;cvvm}a6<0jA zMH4grrhs@c=czJOcC$E#-n@1O{9RN+{rRTvIEMqYLz~lyFMJ!vUs+_!;vokcQKYi)gSRS0Oeb|at6(+8MCYEP#>_g&7 zv@xkRrtIH3HOqC3N5i_kad(_dm_kb`VbMxX4LUic0yEhI3MDY?*T7tTS_~^14^N$w z@*o%)ar&YPN%T54$<4rmT$Yuq*sKwibn;j;a_O@hmDCuoif})z=e4T3cMHdi{qF`x z=4N}M$@f=&J!NgxM=14bhXq1c2$A6!;tpfm{kQuH=+5X2wKQdQ__3P!Ig+%R*E5%C zYI;4B+XYxfkk%D12RO}%&IY?1VX2Dx)$fgMA*)~MZ|Cyta-HDC!GEfW;DgVqmcSxa zjvIE09E~gf1Z@d-P)hRz)xqAy8U|5;rs?$V(<7S_hb9YM979ChOnPXx(VOqNf#Z1- zF3Phln@;G;7^Xm*KGxjWmyP=uPGMB312o>mkpaUhc3$gbY!rTK8;t%;q48lqtz4yX z(`eW5ftU<{71>v8CRe@7%1;Q$jsTBUE;DwxTx!xXCNWhlZdREy$k^1tm4)xiwqBb^ z2x4TaC#Htwuf>iAf4XC{HV<3!kU(&=!Lk#zO*$+M5R)Zc5c98$8TfCaORT4^trGvymn(hApra)Q0fLxu$?tZDgq&?fWQWklC1zvduRcktH zV<6T3h<7LWL%RUaZ7r5{X9BP$2y$UlovRp+vXM|KudZcKyoSev^pu3IYU}GG6#fEU z@s4k9HHue0lX^V85>L99q<%SFl2Jdvq{9QteaOJPO4m(V(yd8*>kR-a*;Qi6H|!GJGuN>n zBz{q{Fb$;@jq{ilJZl(l{5mXvqG^OtCbPj-nHy|1*@{xbqLO{!9Zj+^RrJ~+I$|41 zG14}=T5H(PsjQwrM`yQ`+xl*`!KU}i)si73N^6}eSW-w3*vTt9+zX&xCoPTRdALzz zIY=XKOFMG|)D?`js&Uq+VQ|nKiT3eu!cQGOvA^Bp`j^Scl?_e;5P>o zmk{li*Y&{x)tCmw6ata5JE>FmyXtNzc-R|3`JzI4c$jVg0NlO&p}k-8YHO^w?Ts&h zB8W0xXH$@n5+@k1c}O*K<{~PBrcQhoM2P@=k6?w*GgbvWjG8>Js=y7u&TOPw=0>Vb zHeS@Q26aLhF7j#2>G&1#F5aj96eP^pG~gO3b_1LKw_Vv`sOQ3Syv7^HF#4EQo*&$O zqyo^d=DoQ5`sw99p95jM$k&xl+2I7&Vt;(>5)aKrxl$fQtgpXu<-MRpH@IMXcd=Gm zCccyo#{%xF+z^dR+iY%$(kOwJa}_&pmw(gGp!0PKy}I0WJBW*mJL#p#8{k_0Rcw|W zcyhYe4lfKOmU)zck&zYbkIaJ5xSff56Ne8DgZrkaI-iIO*b6|#`eJ2ZRT14v!T z7ppJig}9Y3q0@=d&s+!&<-HawgC0!JP!T90km&p9q@ z>(?K2R{b4deh?L9!xn}F{}vuXUe)jk#apoVjkA zJd5*!6{3bN(n8v?y5=lTMIHuW8FC)D?U)S#&D{{t$#%>Elyup#F|m{E*fcaKEw*pR zoUAS6Aac3Zut0@Ti1*E7dwx-ORAuZ@pNxTifnk;;S6X70Qus1vq$H z{gdiJgK5guW~&&=!F24s4n*Bn3knZJE{?+%Oebv0=MgrMGgmx{!=`Rn9Rg%A4l`B; ze!`kcUdg1L;J$D-tjKLRZtjNTPPPS(Rz@ycK#BdimwCAa7VM7Z9wUbtu?D2rIo80z z;iLoY)XR7;{=9q%;nBM9HNP=YRUPOdiKpJ4_*EXHu!gx+C`h9SRk+*S${yOT)dKBO zsx)FCdy^)eimmhq{v-!BR~73Dq;4b_S&{nsAcoP}uG{I`oLJtWyMoj8$G`cc^gvW! z4u}e&KLB2c?ik9w+6o|{oLD}zo7EB@Ns&Yw_yCw_07bPGzzm^i67l(X8@osHA@vAg zCHv=GuR3t(C`)sGyDC!T1WPjy98J#5)4&h7$XF7^6^j#IN{6GVKX-H{WY&^6>%6{%i`nA^-@HW{rk>l4&y1uO8Yl z6>bsk@y)fTACxd3)LJ^s$8^|oJ`c7`&RpeH(gZ;Wjaq#cH(ADtFpXIr6iFFZbsBJY zZAEUwmh+zjTPBCSadD|!xt>S$D!4Hid%|!`gE7-$RF;dBkQaE9$z9%BNsmwO-l@a~ zR(IOzEp!n8kZ&c5F1&IF#HpBc8rDpufwUz7V9W|T`fR0hjxPO0pCDK1lX}(HL>#W4 zO1o$h9{Jk^e>lp?`u2?Pq{*zrVR_1? zt?m$4U`_E~JE@=QI&{io4t-$c(sg2QspTVJNf>^mt9zjzU;hElqgNc(fr%9b5KV;zZl*N7#vog&h zRy0kN`$biRBYda14HM6Q4osXJcGSMoY;p&-hA^XbEk>v*_tRx`IfjQ5i%{z4RW_axOEC@*ZQhG21xI?%9g zFhlCWzUm4RCWqApaY*P25nZeW!y43Qm<4F}QE_mzo-C(J0R~LrS-&&}#)QVQuWqp) zQ5CXXuas5vZd)*;Ffv+{TltJwNoPs)w*E;OoUhk6CiSL2HK6O)ax-*b9pC6y;P}Ubk=ci%HKn^F$c^Ae(dpXh2N08E6Yv0QjiMir`o6v@DcX#8o0sL z*azQ+DO^VQof%u75WPE3S@yGm`=rDPW_=!TpPae!qe=u(%0yHrEEYk=$|g*hs0(@N z7IE&^ZgfR%1NZZv1KcNv9X0EeplY$jQFRe~HEQ6eVfSgVlM90!FOQ1ucopx3v?MRV z^nDlWtxj+q+hA{<)2Isl(klP4=TwNR!#Ndt>HxsohsT;0x)GXECD^tb-5wCYn~NU2 zC3PJB1g37lF&y}~wK%MCuKNQ;UeQ-oYu7^_FEv!p^9$c1%hE3wXx&%4t-gEMME9EJ z%z|K1=7CyJ$F+Jo06(7xz$a&}(jewlEUkhl8|n5zouJPH7DvLb(lQagU%Tyt4ZzQT z4gjAVcGNylg6G?ZX&8H2Ogn&tO`ya8OnR)qU7n*?AO8CC2s?rILeBEi-oXh9A+_GZY7;hw1m`!VA)8j?dZ)91ik{!%HgDAH^o5L|srq9! zS-;K2d4WlOEE&AgYt#ERe;w8aE|cTN^m&9(Zdpx5_-t)WQI+=s>j;n(6f%%zW50am zy*H1xch7w^5DnF=4vF9FyslNTp!~!k>LGn*gU&Y_z$9AGGbOAQ_0>49snenE`8=pQ zIddrLG7g}FL6gKR&Z>&>ya-rQzVIV?x8-v`2y5~O!>P`+jYOg3ks%0o)tfqn9 zX)!V!NWZAmBj`p4_~zZc_x1gkzOSi1VHfh)27VLMM3^usOzHGA1UM}Q4v2%gload_ zw7%B@+{EGitzNOZ>7-%fJ(6uB)P1}I=HYTl2S-21%cD;s;2jqjC(tCSPnN@>ihmKZ zv@dHaVBlUN|JB!#DbHk8?NsYci1S0Y3kMM^`A*KGcRKtzp9g;?XReAeFH?C-2<629 z3N>n0#=g&LQSdn8NnF(K2ytP-zRnI^B}ceY z>^*#FhukZzqT9wO=k{@>GjqJEfD~L4>O)xdNaPR;+PR^0J+8;(6a8UPgqf%4ybhY# z!j|qV9&h_v07_S`;92j4VG4g-0({CGlYsrfVto9)iu2X=Yw1M;{Br4#1nwa>hmBv!;o;D0$+?+#Q`PY$S5=bCAg7up=gAgc|oW zlQIp7OpA@2`lR3oaA!@K^-k5J*WNDW+|Oy!F9t56TGRs-5n^q2OHCD`njQ!)cY)nNz>Ir=^4P3Oc{TUCOKFb^Eur8V^s*>CnF4m)CtNTy?bK2s)W8rql^8}lt_Oz#xm0+arPk)dY#!|oL!Im^p3XK@<)jMws}<3~*rL`hux{>UZAMlKgW2f0iR`(D(yRM`V5)cXwA zt-R_I)efZei2XT*dzr96;|-XvY$&aI_aV#IhyQDQt*#FeT4Yyx;dP>~(`2aXge9yM z^;D4JxZ_<p zHib>OiU~~QY{jQ}&ZLoaRS)0w7D#W;+D$^$SwAdI}1f6gt6H&qG0zGy5V>qA2&JpIAZ%k4if1VNex7M9OJxe_P3{r zV1tgM_L8>yVgSaPPg-u~^rcN2K*Yvx`s!b4K=Bh#rb2;!*SDh! zYnQ~Di}3!i#uCcEJ^~F={|8er(T^bDe;_1h#;_E2*_TtG?(LaKC>*g2A8BLtK+HH+da54bUxd zUa`2UQdVYR$*Mf4$~+B|I2;K@+KB7o=OC`hVVwr@Y@ut1(1>+Bo4lNqklKT&%+>9N zuceKFJuCI>xoJ`*%a!~$ru_HnmbHB|Zi(*Grf7&XbvI!#Nr?JjqRpti?NeIEdK0); zOl+*4F)IVtz}{;jtO>Z4y6uoIS@Vrbo*HsXge3sv0Wv-KkrKj*pwj(khgNpRHh|qZ zW*+qW80uYBIbxNEFP}7jCa`vHo)vyU$oE21!0fkWIaX_S(Wi^|{(5m(gVz6rGCWhD z)1=S|hG!mhnw&XI(x{1xoC$Ex;!to_h^%Bu5@dNEa6jdt+wj=X>Eh==r^#WRhKCaR zEEH2bVS1*)q-inI^iUE5r`t0sw}FIJXhIcep=4jpc(a8Rpyl`A#f304B!xOQ4$xi` zUKO9#%Fi&vUTAu6zIk4V4^~A#ndO(5bn0T&88y`%8(|b_Jr|Lmfxk0qVWq}IWy%+vAG#XP(;IdksEO_e0jMj7fL z@;GEgPz5XtB6-PbilXpGl-b5h7e5CtO%D5hb$d&){nHPl`$iDjJPjaCi=7#wBB{15 zAkz_4g?T9qvFK7v!(*!WGLXTP(CX3e?Z`w(NY+_gW)B!xLRv(*PU@y|uUnugSR&L= z8n@zTyzSL6ygJ;$IP8F)3BU{11*r!(Vzn8>wt+O{_HL`l;GjGd?1{P<3@qIJHKEe| zZ`HMAa7Ls#seoA<+=gxkK#Hv$?v_`!g<+zS_DjfHi2UE-QSXJ=n*Jz&DIdC~*qtbc z&Luj!GqBOYfEw@qLX(YLm}?&1foc_P#}E~QKakoIxP0YROQ<$cODJO3MYHzBurrt6 zd;X+*qQKVy?veKZhEfFs%~xeAQx2I__6uHy@RfNfOxX7JR<&q=ajSvCOV`wD*se+} z4@E1K&7A^(CxuS1x$^+<OdTL5_Y z;V0N!dRUjubv%sA=F(zLn@fvXZ3%kZdvAgVNSm{u-ZA=#mKanBoe8KZhik`L=`E5P z_5MmH7Rty#XrpVBa8Ir{blCIM^6c02Z=vtg)_zH)^?lcJ zYi0I2JE$b&kvBPjNIqG-zACw)pC1R_sy>{6sBO1)cwJh6Ro!Fa5Nx-H!rQJ6Z-u6^ zzdzB2cj{XJ4%Sb-ws{yZjf~wGKCb@DkmhkpOvW(G1a)xd(XP})?_4$2n;XPl{ZUewn8vy0%sxbBb491bOxk?a)@u(WL^x$UsEcdG# zl?|i(2aI*9XH>1K{r9FY7+($)Cx^z`GOxVbuNXKu0`SXtabV<08-Foacmifee<=>{ zj21e<7|kj-pl5EXI*KztXL$y3blZD$nAf4x0gSU<+dZROp z5Ol^_t$H4KHZ$AsEx)sD16V+%S|5fg#TW1_iifNh`h8Q~3G_ig>{6o=^a!6#)b9nn zz{^*jy-aW~g_Y1WIb1% zi0fSislWw3(bDF2g6$mIg$2?IpH$^IfFcYjuvJk4LIV+8Dg6 z(8IdT6Il^3VxA@yAUMRv%@ZYhjwht~7LVJeF>6FU!2dvNbTLp5^$;s`Z?4D2!;&UzDp4kJk~;eg zXMSwku%A-NKo9G-VPsXohz*-m#6XMfH|8X)7|k-juX#u=wwGB{TOYKj0uU4IUS5g~ zMo;>{$ZelXr0#KJFYWzqLLlB1n8*#7l&hECR`7d+ji@y50%QOx#IheGL0`!KK9#H0 zcYI9M60ZM9_wrbh^uET9aw2Z^cRUKp{10 z(Gg{KqTD}i+6TEM-?z)}ggR5=y1VYDT`704_W<>VYAorGR66O^ztK=_h;h?}iQghY z_IiWeL;%NVDD`0t7b|`ol|(;N-&@kC?*Rjf*VC)m{ALH;;RZ%<&D??sEe!IgcNNQe zy=uWlxKllGv1!!8AR%~lry5%ta!M_>R9i!CE%mcnrk4jzDOJ;ey|wERmrc77kC4pU z>=rs*_eGN{-soox<8fFqX^!)(uJWpI)8A!&YMbPrf|{p?9W}|6;0Y#q5_sMrc3_gnksb6{e-&cg zE7g%(<5jQi-Y1P0P}B?k706;=z`g!Ad8wjy-&@C%y!-I!_s?H1KYsmJYf??mt#q-s zsA!Ok+J4%se)JLN!8mDngYG1(Y|G(5-JUVi4S9dGn(%^%V1sY=$e&CsyhnvBS2f(~ zt`@DLyoK(Zuu$m0LRt<;lB@|STR>JHkV&=4_;3`RV+yF5lO!vnN+hi0aLEdbl;w32 zG9K1(oRw9O1-aW4WVR{zDfn=D*ilnJ37%jICLzTgVhHdW?I}(Vps!n(KqqTo9H!VHRizIg~o<9wf$3>2$j}?dU+B9A5x_ zuvK~pK-rM%XP-E1xQziF&AnsrMty(p-Y@N+3+`v%4f3GJks}ytp!u@%`nu(lUQI>& zW48f81BVkHCAqoqzJt}qCotW^UqKo>NuB;@F2a zAbHJ-y7pO+R!QWCqV{tqTr~4@+o=2$>^D8^s8OK=e>dDzSBhwfFf5aB;I!C&3`cqx zpWb~SObayx*8YP>4*e>S9KNU7`h4@{D-4O1a@`*Er$3tsJMn+md-o={ktJX3tH9TB zSCWGz;r-YRg{_fB8pV<3wADH~;oZC5C;)|So*@aEAf@Svjr-YeWj%lbn^^?{BiZ4& z|LD=pL;+xCR#xUOf9d?%29E;~JLOUNH-1Q1Z;phUqwYeHyn2#Ddq)L}p~eD$qY+?$ z{+7hu_V=ZRHf2U*&bpa%Ojuh3O=} z3#J~wtkX$if)kzOEO@;|%+w9%dMo3=T@bX4jp(4G4MJZjEPkW7rVxXpiJ?Piz1I|I)f+a$MMRnkf`jK1+9?-LW~}}6OqxSbuDS0 z9^KTC-dX9Q8h0`}OVa0Nj95bso)xEx(GbbL;g^v95CInYRe29x@*>3B)14{>>WmB_ zZx|0V&dPdw2qm`%p zJ|rgb)i5UE(T85ahZO#92f1k#JIJmM2uO^`;c>ZH0RL2W1Diy}b+E7c_jUN;+2u21 zRzC-mjK3+j-7mu=qbu_$!A}5_%o)r#EOmgsjFv;j; zopz7%qEE5=dDvuJOpv4h4w&KY6W>vp^a6L!J70bNuje6ZdKfZa;IExEp?OHN1_Q_;<@6S!wA@df;w%v5Yz!%-2 z3$0cH)gr(o=PQ_>Ii%6a| zjATum#7&yiMP|qK1SVoS_&$hf^s-J5iwTa7D~N-g2b{*mhQP{+=s_<6ffahv8X~H` zJadi>yksjPZ`&VLE~Zeh*vkHOpIzkf&Bz`V?vud#aff@7gR^BR{u`CIJ9v@{IGab~ ztA@O=;6{MtIY4(*qU#e=SJ3z&QSB3G9)&Sbo>g&|n2^A2TT6K7x>KmoA#E=(tT1j* zvc!$#_`e0)%la$oOR(2yIit-7Z3oLh+vv(k669GNMPxxonqdSUQ`x_H!?YCvp;b{ zTZvFz*Gm;yMJq9akY!arfxHBK9B~2IZU5caO^3ASg%$br&rXiOe!*n0FQ?oq1K%H@ znM%yVyN7MK8>&B|4@>Z8k636Gdp5L#h|7qvRc8-(wz%lh95b|fub_Gaw=Ov9zUgih z0TkW>OlK%MizgMo=#P0S{xFz(RVx@=L(*mIxM;u$h(W*oV*vHs*L5w9OPEi(8itG; zmfImMgCV0UGoO1LVDFETDkpK-@OUFn6T)gB`)R5)OC6PK6NVgo9~d%vS*Jt71gAKp zc{pTT?3$Acb`iycbv_#NaVF-h!wPXF=-2hVQ#%l@xb9ike>7d@Q2tr<)n-i@#)GSV zWT&2n^av^^Ky*O)2o6M1J3gFeNdi zDL>s5J_(vUs6!U{ap*YRn8@1T`ygx4%iatV2vA#oZIS=bR=<_)?}!JOhpWZKFxCiE zLbaKTN`MR>`Z|KTbEJJ+t2(#Dfdmusad0Za@)Rhrv+Ydg%$4p@l<_$~Or2oX&3)TS z{$-f~ly2a{;)-awBx?Q)@PF1aM0#A67?839QGE*|5C!8s6koQ|H)-a3IUM5x;`ri= z8*Wc0HuMZ6Re5fJjP(&g^I`Z}L^|awlc@cFh!m}P%jU60P9K72&^?|5Z@#?w;dY?s zx-&4mql>OCec}CdwMP#sS!2Jd4u|n$soc_n2SR)!ZgAK+Yd%6aScVWrSB|nWWu@Pc zB#CMg=XpbNnp0AhMcEWt#D8GV>xL#mIQ%{cVf3;ST_Y|(boO0#kEo>GJ>p`RdqgEn zQXSc0NF`a-`fjI2HbRPGd)j&`Z_{Y~-7)x!8=u_$1*trf!?xE4?;maHHM*nevbRKU z3XVzp0}$uzH{xWnVHA!M`s5mu zUsCoy!-Rv;fS~r|AUyQDtG%N}8pdpRl6mq%r|D5IEQTm2rn~lwdhsoDs#>((qRUN~Pi(< z)y_&g8j({`9+d|{uSAuZyQJM|Tf#)K#ybK%G!)$A0MijTr|`Oht&o4{v^y}F@iJZ!9F9S8)CuhA082p}_(Djg{l?j0c}b0Zins z76!4vw=25j)nF04Dlbsf5BiB9+J$VoN|(zNI6Q~qfa*-YD}qMx;Ny#k?6=OM^PK?d zlaJpb<_~f1btFPVB_=q-W$0*h<*ZD~B!NEA44N&9&?hA;GQvuJn61JjrHOSWcov%I z=+J?Ve%R4H|6s{R6ak=ko3u(& zJIE|FVZ5OO#(SNDVi&tcL9uJRVPF5c$F^up$gQB~lHLnL5wXj@*V7P8z5;oJ;I3=7 z-?R_jN4<9#U2c~i;1|nER^^~55xeQ5%u3Q!|Yf{Fy@~jTIyQKVZlZPbCat53C<+tlmbdZ)nioz69iaZ6w6dIPmo zemn$8%w=9r1&NAGP|syZFm&ZCEm%a;f&?tjNgU;r&>~7nnr1ABD&J31hr=|HV4(vE zcAa`+7rRD1v1?d&b4&^SoD`t686#yzYmx%5X&I%7^NeJo zg+d2f=sKmvE_RL5qOcpA(qckxr9GD%DJ^zc(b}zvY(x}#yQhcWJgyZ?(5R2N_S#{9 zm;5j&YabDy&-IJt25^O)4@n7^K~m6_Gg_4_=DxLLFh9AfGeVn?kvz-NJWBE^NgP3d z2}ubZkd*5b7G<-$LSb#N0dqe^R2RpIxK#ICa-_Q0Wg#SZ!{kig+S@~G9in@4sK!vC z3F@~D5P`0oWl5DXR*zq0TH1C5OJOQp>$POs2_F> zGzP`N2`+^@mmDb^c3Gitx;O;T9SKer;JioYB19GEP*kBp6I5|o0UBMI22~UKaX|_{ zh`1^yH7P0ws;u)g5AEQ*$Sgodjso;ms)%0f3ROg}G0hXA;!eeUBxx!pdRb6R zNe?VI`fo&+v4FW-5O%*+5_ziSS(J04EeQ4a0$sP`Ir zH-QmwBWCZk0JS=>J)^SYOC~=pxlUY*Y|1;oQWPz#6rplD*-jwo$&W&LNobVSBJ0V5 zAb^~wU3tw)QS@h4iqMN)qrBKPCc4tuHKRw8BUg%6am>Tcff3f-_pQ#mhyMM2Snn=2 zVEjb@%!U(-~IE87aK+oyXRYt1AJb!+ZPmc>V+r=Ga|dV+rz^P zMb|*qeeIrzPm-SM;RUp*fd(SBg1rr$`zMf&C2^B-M;~)r32Pb_d00X=)^00i(JHbR ztsvC%-cs>QQw`=%s9d4f_=!iH-i_*^!@U0N3f3dZk-4BFJ~gSq+t06Hbio>iaa0f9 zjhez{#Kq?8L@Z}c^$Hc5U^&aGSLn*LEP^5mD^fH(2#M=}d-OaHNR%}RODn%B3p*ur zWLB>td-ZCLmi`GPEc~v{((Z_!&Ms&@k{szNc3B8Q{($lU%=X;j^#cK$(I9B`C~H>< z0bLa@A)q1?w02pA3tgEdew4&nMPOnKOnV4P5kxtmS?K#sP|+%N#35#dE3#L(=4kDo zQ079fp^EPBhrt4f-p($2p^`QT3np~A)*usN8a<#;ECTcO>0=*hcYWga{#3pgK@QBZ z3W%o9Ax=PrCg}RIav8dE!J42>Sx%x5V(ySdT-Sq&v}@LyC0`QFrVytm;0$&=xH#w4p1rIHEyL3sTh~4@iot zA!SwuB&*9jOp+uG9h8lcS!j#wg|<2B?&!$BTHPJjL)3kC=?#^{n`%)JOt)b)!b$%} zkYt=w67tvEE3}+9DiOG?tl&|vYWEL-Jr>emdWLq>5D+^+Z`Ni9^XqrfvicpmGG#1I z(uk6#&La{>1$X;-8Im-t)4EEUByeS|&H7zruiwqF1MG_L;JmDwUc_`+v}544*0 zzP`A^t2b}GoBoUd%kuTSFJi%g`9+&p-9mooc(1572fOWso*VLFY_Vpw>=Xqb-22dH zc@%6om7uw5pv_!0MIsi8Jq=o3Mi;>#0+JxxhoEj%8 zG(jDg)i}|Wqdc!77AAz{KFrIg`GL4@BGN>4N?G71erd% z14g*Y<|JlSL5eg@Nfv4JXKaUt#AXFFMsM#LUHua(pXfCv>FVqXC@P8TD%!KAbrr%v zA~KD`1Oq|e!1w!(sAK4xPXqG;qONnQo~Y0Sg6k>^bt-ta`@ws%IZ~A)1Ow4`DZ=o|xd9zIg4GOtjeBHFb886Myi(d|7$6)FLYR zmTvii6s9AKK)7R@M&=CRl-a+^C*9ejDT0$uak+sy_q0fwo`v=dm_T&7lDr-JLwnTY zgGzD7lD>r>`0wzkTD0~$+LixGA-)dkK@LV z9cEw_G-G=~(`5!|;qkTjJ}$!WUR&hM3O}a9Z!Gd|?MI&%wExxXOE>)1B6igQO*F~h z^Pg>G;<4e+DcD!RR@5MJD!hB2lbLQ>)QoK4O1f@UVf>-!Ls>V5`Nh+CS@9HIIV)*g zN4Zb3vVh^20Eh9bh=g^{;-U(IJhLAHW3zY~+l!|zi@>B^7GWz0PO*sD)lvL;u{;ba z@mY;p6b&jmYxo;~VKV1JMVPI!9JN+@Ny2}p*;>T(j*jmFTy+l*{cnznogqkkk6Q$= zT79Dr-20!7=7j|Hz#VJvU~cwG&HD#XCkgzg_8W@cs7K=#|mPJTI8sxFV(9C*oY_Ipa3=J)g zItTc?|^rwb#0l`gFd{~g63C|<7HK3bmcUN z(>$ywNtw@sw}u-}(fAR8_O*svQ9&bz1({Xk*j`0;SrA&PbRDrV!Ji-tucP(#?xZ6T z;5b&5rV74o%(P|~kMS3A`)TFfp2|)%Q_2&C!X$H(a~^n5rhCl?4~Gx$wC7vaU?^<~ zOoOZba6{G3vVza7z#c1hIKmhXdQ|gB|b{)irVp+~Zd*`;?3_}V0F8a6RC^<7QyV{HDGjQ`x3>?*W*I)Vm*HLh0$qdXSE8IAu~upK~93M6;yR5RdH*zb>;ttGX_;K+E3?&0=KVq&&DtC>)c zx@BrGy+WOX((AMa56+bIR)%dnTugl5+e7w*zZyxm3G9|K9M!SuI4o7+=5z1W5m3NK zg;CLg*aT6&%|Z62lV}_fv>pyEKODaACoJe$Pm;Jym?(@i5nJQrJH?FoYR+y{VuCR* zgA<@Dvph|TItWO{d|;5`W}U}*#ZQY#9MmN(Q-?7pCY&I#w@f>X8I^V!Gb*^yn9=Jx zjTwItlZ+V^A6qD#!>ZE(C~!9q18F@E5_=;RCr3EV9br(waH0Zx@c_^UoZJ1G5Z(J|Kk=UEUUG|1PoXg%&0K`Ijn~jY?C4YwTRll4{uG04K61~FB z`Dy5EvW{Rhkl0X>=ZEl8B~R4YVLe1kWI;A9%m%x3QEsNKkl|;z!Olwt%*_z8%7Ma{ z=LTK4A`s1s1S$*@QUWbtb8d*js22D0kq@PEG2nDGg60qa||2m7j;deg1|p_r-pA?YXNuR#`A4m^KGaRb6N(llcpjgyAvG|uy?W|bpKGvOWy4xE^$+J8c)yyc!;sy!P9f=Xijm#DxSCPuOAXj1G7 za=^#w*lu;xWncO2VEEQfjqu_cE&I^=Nj&RawK>7TNeaWZ&?#nA(KJ(^Dlw562EXzs zb}vsw>#ZF8)!zg(aw0}C2b_TlO)!gP;0$!-JPpe#Dk~DiB_nZ}HKc%k<+>=Nl2u`t zI|$Gd6P%IYFo$_&@h7z6qt_69b2oi-jhM!4;Kn1#QB;IoR!xThZT#@p*MH$Exjh|q zmJW1Xob@|Zyp^85Gpt6E1adooLxm{l%EWoe8dZ;7A4H#M}`y%7-7%(;y;I6qhv*_^U8-IDQj6k>F^9c^dvFkXEDDn5N;g z@e_|EM;eY@R%!T?SDSD2p(Eg#0p%(c^@*Y5{mGXf4f+rU8j%6rfOIXOt6G(Ieg!{S zR>4PC4vM-=gD@vSm~y4{gRqOW{xQUiCMu<@RIjDrTr5~t1b5=c=s0av1np_6MFFl&_|(rvc~eFhec zgwOSLbkSzhaw}K?AV%yFBdQ^OEdaI(JdOhB89RXj=*ff;+|O4HKsW3RE(c(PR#aD2 ztran~IlcO*&;(Ok1_?k{j5@lORfH7&;;#6B3YEW|(Wv zGTGLKm=-4gy4~(iN2EUpmHP70yM-z^SIdj^mT#@p~PRm7Gs0Uhr%~i!SrVQAQ~MrWOhMr!mPb4n|0tG;y&7(SN=z`hWpD#@Wicuw@Dq||Nk!s- z6{JYYm?T9WWlfV&mN_bvCfp#w>+{o04wJW=947T;eK^9g@*}P8*O#f>-dJziWp(Jn z9~~7){5f|3_0;@{n$N5Cwu~M1p47ieb9*va7x@_+F+Xfsb3Ev1Wxgeyj(oX4n3~1C zKdkAI$uY&lJ++5Bx?BGt;*BTWgj@WozL~B1X1u5Trk`PkhTXO$>op$>kSxOjpex69 zp2aka`R10UBo6D8@V(9_KtPkGk_E$RX{m_?Nb%zNBuhi(t(JyLO|vx1O*KTUqgcueUHr@5ob3X~|JZB^;Y92ynWk!lJ3<*tWnz4-LthT2ZQWF7?;wAHG zR))#jtqhZzXl1kO{P@C{l{w~3e^lMHgYv@UK??Q9wV>zAB`P#Z zrK(}&?!G-7$&nqleIAAHGdmbX4#3au*h6x37u6m<(?I9%%Im(-z5X}97!b@zb}2zw zTbIwp8-oWszZ#hF*}XxfX#;cE0fnkTK)R<R+UJXhT0X_HlP<-7Jo6H1Wc#rJ7;jmg{X8ZF#Uv+LQ2 z0eoT8u2J3zRNO{r)#o1-ajj-5mqb_G4Lk^gREfxo>h#X~q6y?KHK%AL-}_1%@=CLe za{H02EUHVs@Ar@l7f|3e?;R4Lt3K_b*?9qacQ`=4Q&8jZr;*&Fk3`YEbq>h|Dm1|g zm!Tfem01$RNu1Xtlw9joD!JCnTym|mAhq{9r6%ej#c=}DtPqp8TOo=um}Z5u!43Gr zSY(O`yloHOi21*6N39qa%u&r`m&V99nbAj(Z0LhuKf|DgzlzSo^;dqgeGEK2>HR}_Sl8kqOWlwq z3hS~R2D%QLQ3OqRbo*s`7C0CL}!!Bu*ILCWXZT7nI1J_A4THx{^s$xVAnLjt_G@ zlI`}al2v#WYGWpM^@Mm-VuHmjL#?1ImvvT_eh`u-D+>}Q%qIm45|Xos(WofGDs-ex zP1H)d5VeBJ+bs^ok4&?;*}xTiVQWN+kGlXE7`MIu=hPmlI90v*r1Sq8cnj@F2Hlyh z=i;4Zt)CtSOAyuz`Pm%<>NZGDsymRGQ+ZdSjY({3({E}pRVt!wm`J*BAtAcvUrTR+ zd=Ko72Pz=PwZ114!+&T6r<`t|0`wUy19*MJHc?I#+ktUD!X;gXa6wmQDGU8HDM>`L zly8VlOlZmjS(X=3L2DYPseOKEY9d_Hg$Nf^-fo`D5H6ORc9|!Ra6v2+CCZR65`MV4 z=chH$zn^6~UbgV==|MM;m^pjIB+)S!=NFfazcPgU$c|KGGBqw#7;S&J1l2mI1{GSi zr=xe;SM3%lA_#2sWe|(U9m7UucSSk>?4AaL=1Wt(_v%+52iffVD7L%sQdSbPv|sEDdIc(1CeJzbuW{>FO84r6yMeA(hrsn-ME zdfNht+JGO^6@^Q{YjuiL&svIYQ!}HPht|uk0lgat$RXcDhH0>Rji>+m>Gqi(sm5<` zYw#9}TBjb*Fb>iMAMqp7ZrK9O_u{pLahoSn!Mn)KoJZ8B4TZ`J{~8a1;kBm=ml&jT z0y;h1r006*_{?GCzbeW%jfXLlh% z;^WJE_iVH8+c@w&82sO88yCSkz&iLRhAqA8*C{pkOHU_+ZQ|&opqn@8^WuK-RxGJH~9J4I!A#lr@4+hGXfq~GKbw-N7xtPTKWK1YO8IzPBjNx1i z$6~u>nP8x7As7giw^$Y?GSRYTBY|8CBbJ3pA(jOc-Ix)f!+L<$`=b5uQ|5YCuO)?? zr2iJD#N$BFxbnIk-FNpb98KYuTYXLzCTHxi^5OzO2f3qfhc*1~M;IOoqCyRCKK>_L zhW|lV*10AEEm!+DLhrZxjl_ovhz~h+fDk<$@7sgwDl}3w3fPnCu8s z4-WY>bsJ#GCh6XzcXvLa1U)`tuL0j{=R=mVWsoIw<*=&bG^$EcmQ_w-T7`rbtRz(t z(m1MVP*cb8(S$5z3n5FWyxpMDAw4#Oo()t&C3}p!)v__^!Lr{=`lQW}+wCDfieyG) zcE(Lu=3Xayv}EGvw9^XCO>EoNl08``Ow`7Qn7JLj^!P6OJsC={b-h*`vK#s!i7bWp zf!t1cUJq6#C%a&PgSpnhu;lv~2tni{K%)E5Z{O#UGT-3A$hkSom|5{o$%Io!8wQ|} zT4jsm8<6|_g?K^S9`L(U$qo;14cY+s$Jd>t9ihAR{H)NdAmS1MU7XZc``d0c+)_;v zJo3ye~MFNa=s*!vH|0_PLNdtzsLsP5OG#L#Dr7&A^HNMJACf-EG%pN1QMFXH*IokHw>_u-j)H4*Sgzs3mq!i zx&f~L?)R|89%Nvm>OHb1&achi0YnhGxm;%7=+cKvRdoRqfbA*dX4PQn4A&J@0tVO0}m%*Td>!>hC#AV-_zF;y8nsp*Y)|w?0p6J zvh?-&;9CKo+CTv7@zXWyag~p^W*{$K8K8@e1SqeMCv_>=R6F7s)}8e5Z_@Fgehr)C zbN)EOD&-l3o8x-?cn2mq2w~vFu7^!1%*4tQk0D1u2o?-+zLzai>(=$8kaJmYth`t$ZP13zfH8HY)W| zWQ(K$Wc6o#Q zQ^v>K22U`Dk#E|EEw|5VeW*@b^`WzETlg8lt=q^jyuTRNIJg7wOrqk)FT0h~y(MEs zf1~QQcJ)T?+x*xJvv2@u3CyW{AOALd7zT1P$(zltqJEL&Y;^3!6ET80)wS1zI|OT#=R zQAQJfq7V4lp!8$H;wH$GILb4Y*d3FJ7Rwi+#ZY;>W5T4aa7?p7W2odnaAWaMC^}Ag zD6!{X@&sQ)p{M7}*@}t-aXlzy739@J@AfZ$)A2#y9ps4kxMSvIiKe)zWV z3#usp`0PD8)U!)R@$;D7`zwDaeuxm>Nv$$4_CQ2+9B!C9gtM2RaoeII*kP`8ps)ge z-tGCvdX9w0Ob3`3xPD$1uHtSVungCRu3WJ?2-B)2eiZWHq)AGWH^8w|dG7tvegogMGFvtKRaL8|2t5u=l<7(cD@wk# zHySYa^!Tt>C#29Psjrd^-7`5cvjQC*rqA%uqmn~n4UeTKIrFs?4oGAqK&iz?AH6Ca zh`>>hd)2!GlV9S~+Yhgv$r;c<2ngjAeiI^QIEw;|K3$Fr#o9rN^Rsj~l7*IA+ed!3;Q`IcyL=~aE!XQ4Bzgv# z!7U<*7Sv*j^Y$P<%-7LBN1PXmaC{gSAI`2mG?D7WC|5UC#@A#hz~~?!SeUaMc5pFt zVY^yQt5VpZ5xZ{9?XeoXHyj*cv>Q}403M))rQ_*ynEISEOnuYUkFGyl>O_ljz;f1! z`!u7y=Hp~<->HX%I@s&ReZ+jUV!jNmh_0*=i3Cti1aMA-mSsh9T7^ZyN&q?8eT0ct z%om~+QF*(MKqtYWK4Lah5tWqmORqoK{DB*>2sZw9>>quB?%f1W-^U&V!f~e(IB~3aX0w3_wtJ$6}%; z^M$BMRNn4btONKQ`IFh;NmLT$1x6*HPu({QS5JU7&rH6_Y;M zQD1JTdgr(mG3MTWH$y7fbWfe>pTNxcrvxEnNjEabqT&f zn)~agcQ?>+a9Eco=o|)i^Ifx%!{hsBhqH$8Vtwzy<2PWuzJb3Iv-3GTcDNe5?R*&k z5?z@_Nl`^vL|6u}h^<*KU1e4!47m6n7ZS|7!A$>ZK092k-FCkW9*M5Zooy0T{KQbRknvMFrG%DI zLb4!<3tASyA7Hin!h}Z_3*nKdyw&besSj`>{7Ie&FDA#{SZ~>3`POCis+Y|i7u9on zz&dVu++9Q09Tf4wpvTW6cXf>v8uI7HoCFihf7#g4JLwl6EouTFxV7DWcm>uAb03TU zD$`x!WWYZt%XkLBXmnVBc0hWNnLK#ZpJ>N#{?Ss1<)Jri+jMc=avEQ;4DyJsoMm~O z=5<0~>AhF(K-4?qL~Nkw%yz2nr;o`05NO_Evr&5kI%okMQWsJwxc4{Es|@?&bMIBh*Mzsy4KPZOP>3Tj zG^ihit`Z=UJ6iTFz`uv<@ym2=wH6gnv8KQ-==Uq`^~BxDS0+K0DswN^>W645;K5nF zKma|l?`GA{5q!kDD-sDq-v19d)Mfl#di%EBXvpX28^GWM7OO#G2i!W{?rRw^5?xsj zL?ST5g~XK~k~}U75(F_#>ZpPdE_U~20warsz(`cy?!Iu=wF&NPHY5_2>_G$*d>9I= zWE)KndElF|V4*&?Rl8Y@SaN~!`S6u)Wc>~*<~-OH2{qwico+>)JhT|zce<8dis*UI z9U|*wW>R!GgZCM4-oHpZzzv9Cp$B&Vf0x(Q)R+odAXb0W|2$e%mkLKo%cg~V$9ZGu zP~zw-mae>1MVgjNon+cx6 z6FifBfcywu1AMLr|Bjj&g}ngOc7)hP3=+E`VUQINZtE~ZSd&4kJ!B=|&ib}%ZIIRB zR4E8xA4~~=vbgsr#%66a9&^{UuH~3dHU2`;l~lSA0ZI9i@q7Eqj=G0SOZ6aVenV;< z(V*48FPWp{?yv1L7~?ic5PbYDdjJu*&$~n4kSU%Q^9b0B#WB#hI=NlKGV~z2a$W{O zo|h4+QVPhRiV>Q`F?2+*pa|ZspaZrJ4-EQ?x( z`=Vl_&Ij|xWytQyu@6N41?)e}TG5x?2Ysz>7!N#3^UUw>w zFC@>3`F#|xtNJTrFoj75F)H#IbKFL`LC6)tOdpdfK~NO+6EQHWp2JUwtF7Cvmm&Vp zm5VS7qN2=67z93v!@4A8$|z}qfTc|yM=WtQ49X;x{>)Fsh+oFg` zV-f&{IiIxfm%sHP_C+%iHZ41fjOHPuySQ&H7FU)DIj!P|F=O|4KHCEBjh)k?z};z+ z6wTKA`-e^eec`q??cJlcYn2h8eLi3qyl5ci1P=)p?LqniC1CU?jrZxEudKsM`{(rm z=}pCH|HA9STmbgItS(?aHm_KQ%|lmi;w%j7f}h{3fJgg5Rg)qN8j{3iSd>N0qQVaP zElg})fx(mh{^~6cBU$y^hWmHK8Zp_w_SBMyFJ=uMd;h7ofamXu0Ro3 z6U+jWb()1`QM*~#W{*nVk>RwNYhKfwk-35rC4{mXr?oxPrFE;(#d%=S$?u3us3(1_LRM^noq3a4! zUFLHv8%3$Pbx4t#1z%VAvzaDezq@%C@soX zCX&(K-C6_|J(jj-{iZcE!U^EK@VoLWSQ#_e2W7|97hBt+zVm@C#R6c<2eU-aQ zBgghdyDM9Mcpw^`jHoL1%t@VxEUg=oHfg}4hK7gLAqz>S|qb<=vjjt~#vuiar*I{_rFgeyyKjAS#?!#T7*UXQODk_%~wACaX5> zsn*Q$fOv&ZKKE`Rpc4l}IYdn-hYWxH?$82FHGF1t)0g!gzg1N4aS^B93(@&{?-aM` zz4+M+QP+FXw*mJ7HQC;6dAzJN#w;U!hslu!#aU3#eAEi8kPO>0L1fronR_%x_;eN2oROf;(lpI@R8v|}KDi&6I*-m7cv~L+g(4=Yma7ZPxX1+6UQk&6 z;1-|m+kthN43W!l<{{Pa#vSU8y@n)WdEw`jun;(M^0*>AWKT(%<$hik4NEGAy2qxv zV@0W;}e)ZMZqqT2XOJE__-A=S|8*gl#EWz*w<=V^*AV|QWE<=MqlA-Y7D9pck< zS&kPY;9CX#41sq@whhG;7klQwkBd6?BSMQ1CO}3pDdO5Ez8~bYN@>CD$?DusOvS}Y zMNM+71Weq z0au2yrocS+Gt@Bko>3~qg(fKYf>PlJxA=4g7g-kWqe=gU>LDx{B0Egou{R(`CPfKJ z@`i^c84tw^1!4%ox(PGJ9DX`A)qQ@+5|?$T`^MyERI>o1}{t%+vKa_{Hq4(d`ySn|>iE}ACV7iaee5g2tfX^o}_xhyZUY|tV z>1W*MgUh$;erD?a{JJDA>(G6iGebnba z0+8$6N#MPN*UHg8j2*}1mBvaHOe8hO2dhbbm^IE|roe?JSmUDFs#DxuTh&JQV)#0U z>?weR|FI<+$*aJKV4t8UG7^*9ml72}M~oGFLqXN}WnNQ~`6XmTc}P~ov>|z26jf8@ z1!a!7EH{mHe$f?|br|clC0ATx;I#wBv@JW_NqCnGrT`UlVDvX~x1kVQ$*iWD+^P8W zWkvCu=r>pC(M?iH4K*BIjg1CvRy0Ke8U{-g71=U?t)@}i|C9S%T z3l4Nd7j)a4EO2vZe-~(5fnVT8(jJ*&-8CQ#qw%EDS3w_^?bm$eg#9kamvsV_=&b~?6!bmRNgc45 zr38-ZB<6>8Qt-n%srgww=0|lnsoO2ZECmM(O2MeC!%{3uuDmb5vP;Xowa5v|OYi9^z(9x=V|LT8}_?8i({HSV+Ic{G(oeMm4990 zQ#HGXQxf$i$(UysQ)O&jmX{^1GC_;ORk@)28w`?&$Wj4R3UYh0DKP84!GgLkDvP4e zaFJiXyjpp0xk7#8QG_~lk6EkU{CeA0$Uxr(gB7CmjyXNuz2JLM--jSu>QhXT>hTe~ z<u}G!{-bpo(;rJlGR%ay_$yx`XH5`(|kNT**dI2^b%dTVsZG z^;jFr_uw|GWkqF|_*MA(k^AcHYXo3MtP6Yotgcgjh=>S{(wG3@94S~u35#=9)(H=( zGCN={Fe}W#f(kP#>)0sJPVP7DtuQRaW-vLqQGj&c1~TI;&6KHVx_OefVgekFy9-!b5NI#3v??Uh`&fE!{IQb6c1 zYE$J-5`qKKU@GEqWA4O&nU})1qF95e+qE+qaES@Jwye1862B@Q5DiJdLn_aSz_iQk zbuIM4D;B3wU6!P*a_%{+kP^zu3Wika=@C|ji99fCy1{~)E-LF#b!$ymsycpbwA6KF zcEwafsh-q(5oVAbZ`QwyU;sR&`7y6MmE6l>N{cOtEA9NUY_O~>>k|K-O8e3B-~(aa ze?q%Hbi_aG*~^zthFehE+zWLC(PZ~exC9UA{sFD}>v|=>sqQ5(bg=_W1$?f4#6P$F z3cXXpP4z!BWYtf9g~qg(`XkSG{J;8FH&RE2UmDA(m{EP?KRw6*^()Dreqg)1<2{J; zi1PT<{ME{P^5V&}e+&M-e*xyry!4(3eU$2WD}M82SOWkBz-n~lmwtL-!GGEu|K+6@ zX3w|?u!8WTqI}?95b-hC*Hr{%QNx(=B4B(wtt*)188oD!8TUR(8mE z?HrZ8VFyTY(#u_PKigN;2X(X~2Niy6B%aLUTzAH6InH0HycI-kssl$i#H#^G0vo<* zOMdh|JA!K(>aO3b#Uwet9m6AZiY;o_bJ@u&3RD*K7>l{tm}8q$*CSr{ffn8V~+9h_wn3Bjn9&9?oxgG(dqBukKmjcY=79uhH zHmqtrznmQ`D`&gJuP@{E6$_nr8ZaH0LSs*_C{GGf1ts4IsyZck&?H1qo=`z~;>bFg zrR-oqDI1k_AJeVX>~SvF5_meAjU{z%E4hAlUhMncsCFS!O+AB;N}>YASKYTifLG_n zP(JJd+5z{Xy}t(&2)Va^n)v=RNkw`;lsI;$ZONlpZYMIx)w9&0+y`@u>#q>Qbo|`+ zbxp@-y{CcCuZUUFoPsziG{KUV6~tZQKOlqq(enJ4V_*^dO^SlIUsZ5x1f}X@%9Y;e zP~ks$bh+K~6Z#+h7z+sldg+P3pFR_lsA?p{9Em`1>BWhE9$dO&OYAksSxF2!M$(kT z3A6`BrB9kTP2)1Ci#WE@DCMDv4G0%t15jC~OR=rG@@~1W<hv!0A7ixW^Ivgr72lBff>3i+-=}Gw z;zzHqFit~2m}Zn-Yntf8Mm0A_7-7bWGUMSZD@j>54T%E2->2LMlz~096q;a!Z~+(r zm35ouOgsWA_czs>-m#;gR(SGCX4{8ZA_}5&c5r(lc?r$g1Lls7RhQ8Fz^hBB$OPkE z21Rg*{~+VVmj9tUu9;|3-!UY2j7-&kT$WWCsPPW$6f!eYppaiiA5)FA{7F9_PV5=t z2e9{6WocC=G$gcSAqfIj6WY*#_+cEj&&b!gQaJwNcidfl-KV*mC~%R#+tR~;Vq$APd{?)n@0zzzgvZA(^7Gu>mh zKmZXqEOwBMbsukk{#kN%*K2xrpj#mA{ssqtb*Gn7?Ar}j6U^((Apk&yCitCYSPhr> zm0XEu$7Y!zV)Ba>?;1Haqc5Olew`FqM5;QjNL+^jp?;o|Aj+DArBz%t_G5Esf;GYg zU=38(VL)~|fbp3bLpz}tc`N8#G-^+JW^E|l?ulr8P`vq1AydSDr|{*h6nY#nyJx!E zW7ICk-Kpc|i3 zl#x7xae4{=qez2*R8^AmZHFHM6FcTLG_fDy0_+DW>#zpkitW_O2B=xuN?# zsJJokNes2RTssh(fZ0v4X)E0-CpIZoV|si&mjEgcGHjK{P1=^6Sk5KgAvH9;Jf1Q5fsJ2vXFqVRvWQljnnt!ewA1m-zSgYS)2{{{QdQ z#*2TX-ETbM3tB+{!}?6`o5nQhdU&kLjAY8Z6Qzv+72 zQ9*nS!{oT|gV%A>LzB_iEm+*qe0)&23?JkYpNWgrv;N zl2C)}*RH@OBq&?}2|{IEkRaQlqWulgUrY?rKPK0ma?;>hgcsSIM)LwCkE!Ine$tPE zsZHqljXFU)7Cx$7>ImiIxJ6rFm9&h|aBmkeoEHthmpdU}r{dx}8 z2o;)OBFnHwF7fYcBG_XGicXS1lPI^7JSH@XN|G9Ml6Dg@K}O*MkP#~DI73?zMz3Cf zvRMfxJJCu;Iid4h(0VWz4H}a6v}^g+FDk}&d=b7M@H2SF%$`nfv;K`eqC_)|4nC|6 z?-Sh6S6SbXNCo&Utj#);uC*1PFmF*W$qwiyGzW!*3Qe%FWhf+<_!0bP8aYvx4;ua4UWDs zlYoeuBwmjj(E8xD-*!T8`yJyGx36Eg1i$g!?ftqrKGUOf6|?>NAfS2d0G23JUfD0A z^XRRjJtwGyTj8T+2p*UCB!#c|*`X7ZOeFLDqwinVYV;`smeM?`8A)mu!4$FpC|+Zd z2dSSak`237o6r^XS*B<;I_bcr)tKOykBWCdHZ9=#ja}g9ot)i%;*JE$2Hnw^)jT+J zpp{W$$|PlyqLmTV>2<@ZhicQKv88{nT9_ZHd#ZHWV@vsge#i9iNpphbIl%y;{?~(G zP>~7xzYGN9692A26}oDwxL*lWDEPS}%Sav5veHvAXU+0-44IP;%iD&^z0+n^Bs1+q4y|rCYZQK@PMHSvt z_WpS_55gg=KtBV>grh)8mbg@ZqsUdZPP0H zeWi?+1uIjMrC~|pJYghfG$%nqX;PQeFKfra#)Oqb3t%OvtizqSU?nT>?V;Tr-?Z&v z!Y~%}a)Wabm-FCy;*bN6*3VuMgt9PZyzfjkcy%r!Q6LOl?@GbB{LAOhH!p7c0phA9 zm5vB@FwZrIlLQr-;JKC|Q(WR#GVB;^M5Jb$HRR~AjTN18QD>AE+!Er92b4gmLx59< z0I3ekiaN+j>j>LCGC?WP0#FJn>#zhn8_ItF?(bLH0(!xLmh+-X$RC>YobLu?;XT{z zwN+@1=ii^|=N?&8pUfVv|J?h~R=;^QWD~5*@M9K(ESv@m3kFX)vEclYh(%pZyMjtg zFsEfu8JGBXG$#};QHCK+DBoBZa8>23CPf+fghhE3HDQqlp`BbPGT{=@0=NV!>oBL8 zSP5JXtcD9K^dY2`Js=-HbO54le-}gtVrNjvXZzN$GSX|?Ay=UG3L+{t=d=hSo!#Cs zv35VL0IW|Y@A&^70Hv=tt(}}Uz+;j45 z&6vcnd$ix&^lXN&dcY-*yZ7x{6pN%0nOQk~I>A)^`dU9KGC|ds)%soH->^8f@(i1>x8S=Rz)-%lep3JoA=N$+3JL{ znO*bR(^2jVI=s=%Q?v)Ibc%-FD_J8M7MOS1^Y0QIxtN9l|ETT(_43^ND@<(KADL*P zj{KDu`e6cFOhZqbsA`>$ZEx-(*vW`6k9g<#0_1@1rVXKKDEb)!6UV<|HO{!`SWK zOyo%iSXCKp68+E_@5@Il)Iy&JHw;w7Z5Z*g^1e%a<^~{B^YZILYyy4es7h$==QXL) z0)Ul4OejBMkSe2PMw7s2vAuyXHjDl7f?_`^>+D~!t$Lxu779t#Z>K$CAU5)fF}H80 z-2Hk>4-dv6yvJxMZRcxta+=IAzpoUx&J2AP(KKGH3hKJH9;}kB4K*9D*jYt-ivfc>4v3@Q%*VfI6!DuFZFfvlUV-V%4XM}4`Jf0Kif3VlH zr&;gh$qN$BnnD6!$OLKjz5%iJIZy~xXo9sbgF?8(e~7hXPp|UHA%UbBi6L#4L)t7U z3e75E2SdjuC?Z|}ia=%Ed)uGE9)VuumTh{rTd)@I_Ah_yA!z2sUyMlXOWMf*t>nh? zZCyiK08sl34>KAbi>dk?SOqFHLDiSRDqP~ z`tRP8ulwB-Pc}kb{0LvpRGKF}fPt%(f?b%vjo(fReZhbIdCd-wf6f1KSb6f|$f_4X z68eJw3-{AcpZr9-b@gQBJ-Iz{HKm98$+H<;`7)Q$UoM7z zI<}AwK0F2Q(9rFA^YBc%ImTl!R)e-Yk*zVq=fI1|PeF*fd2%JkBl?J$A0}lShonha z!Osv)O3EN;NL3_RTm-2fr1sIQv55_d7hpqBS&L;`aUqi}8-+ta30ouHKfr4ju?3H$ zN46{=8TF}>p99;3kBHD(Yr;yIc>j}u$XOGhbf^8kJsdmvvByZN(LG?sk3EUS_~#=# z;$_GVm-vq|{_Dt4E*igqU3lVMh(U(mUyd=(FrIhZ^}jrFJpv6eDFVjaj|vhLJYUz( zR$8$TNl-WV9AD`lEd&&Qf@{;ad|_qtj=1-FIe0Lx>HX(NkNpy!dUej2qOTy{*@xcq z4Sc!%=U;B=?@#;xDb8HP8Dd{~6SJ%cQ%YDBB|OYY8KH3ylBBMKEQr#wPVGdOv5D-7 z7a)63S$As13htSZTEXPiOj0Vangl!^k3;$QbZPvko+YZB8mq?+4Rc@E($>S&e0)v3 z3}53C{~?DdC+W%mJWQE~DQM#7TSwIZ4|9|% z!h%$jAlljCViWlkFF-z_vhHM#mAzzwf3b~HLS}al$Dw;3$Us{;%+v^c?_IeUdEA;i zh)Ptl1OG+f`$YUg#8Wbndx0Mmb3${bAfZANoX|4llS}-EBrmb2&q9`jEaLhOqmSYw zFG)e;k_1T*usEVgPVHnTu?c^Q7r>uTS+~Ah*-j?tJ1P&Q3ZRY$2*$2@FxeSa;`n#Z zU;5qs{&d7M@ZR>+!PrjkPOy)SEo0>|+3EY1cE=m2Gz`;Z&Xc44&fSwVilhb9Con^q z!*zlRO)!*Yz$KUX4>1(%>8mg-iYl&2Rwlp-5&Olbv7Y5qf-c+8-aE5-R>kXI%hEqcC z$g0@$kxKD0q>@W~NvkA}?}&QgSO9w6c%upJl70Mn=_Gv~U4DT8)ShL#5MVwt;z0Vx zqgO6~zEGBsgvy8$Tl4(gpk|3mM5*K-s+B=vN6P%SS0B51HPBXTxYB6I} z49s|J!J-ETHr#Hsr9GvBT8;L0fq{d#q+?n<)-I>(W~^cq_N>1 z-5O?jT=MwyCH^DgE%fQLAg{_e z%1G&_J_(b&AbFmoBxD6YmGBdK6xmyl5)(s}EWl8qvUU`$ZOJL85?mfmB^vm%?%Iv4 zPK?gj!*P6cWYO$bP_5|Lo;<`gypwO3O-C5@2 zn382UCYSgRu{iAMb3YdC<^=l9Nt~4#DatS;&`1k?v^lF|yTzF}repz*36*sba@iI= z-({?Wkx`15C?pd?T+1jH@{V+=P;Q!w~wem0tUoaosaFzug1 zD}oA5(Eepm8JGAE(SCI5P1&S*T@@q>6Gmcw2qtBd=cLKQAZAU-lGji*!z~X)=^eB2x}X<$FVWq!2ZmF{i7$r3Yp9fR>XJ8cfN4Qx-M(%z zro}S87QM*Da>+{dni?l`ou^f!5lZH%sc8SKeIok`=OVuUQ?n@+0t1ooJ!(<@OYWTR zm@csJ738L8iYcOc9T<2YT3Q=xclT6K`^Zc~*&gplY^6L%6{!Yjfj8@vE01oD_khzm zD_25pe1N|m+ZOZE*R%hiA``syG7ybR{6_^M*bAtWJfKCKk+h&8iL*Q+MGW(#>n2Lm zI11y+4zNs298IzSM}x|`jnj&wnUILU zgXBbk3-sqOR&&#<8Jy>au5vqDK6;bZ0DL~iCRv8Daf$zs>>El66efA&CpjsLCI#O7 znv`K)lcMkgKW+RfYV1m%ny8a>0qO*mbt=7W)yry*N+>n|X)TF-xcBBd{eLAp{%DxPt;u8NM z%8t(KNsBTJ5=tr-MGWRB}IFB&1+X&13c;@slQ@L1XUr4OG^Sghj>P^5fq(y4hIBlTle?B$B!csPG+>BYW*R=P5s%Ah80Z zD^bHO^sI}~kPC=Tex}{=#ot+X9LV<8o1+ZDpRQ%bvOV0n05PfLERpeb=U!Q6*yhn%d`mfs=A!4`E3u8hK67`VyVHgqM&r!3j2%ZDe~<(1>6&$8M)}~?Y{Tv( zn4RxN^27WNo6+N`i^|@P{`vTZwv}6qYWHY2VgMnljgbLI{!`4B=KvK@p$XQ!45;7| z|K8S&J$ORn5}M8lbe%&ZIwiCULn4}Pq35>t?fiAA2~bEE02EMJhc%v*6KA0votJvv+ zDmE(XFbGWSY{vHV603ab7p$5z1 zn%-9JM$Zp;`+vUqRc!@&uaip+a|U}W69dg)#5zn-HCpWvl#Tfia|YzpA$3D zhUF2fy1ovLicB!8Wp!wm`1drckCq3&0<5H?2OT_MZR{p;X4l=SF)q(#$?8U^!^@Xk z0Z!~nN=Wn}g19b#7k{W#qI` zV0QN>kWI|6J54+$Aam+Vzm|X%z4a>a>m*hx2A; z^*&ory+>v3)`p5rur^e72u;sy?(;nyHN_6M*{tuxoC2;;0{Zm|N$?GcN$F-_xN=nO^+506jv&f$g+(TDkv*ebHI8h zuF#1R*a$1B=f{cV=Gtyq;VSCcH=b3iIe~Nz1REwxprn}_Zi+h^T1cf*@t0yyLzC* z7$}rXrvJm@KmXygDu8SRhWWue@~f;@5qLsb*$j(e583-d$hsici}=uDqD#owxF7kw zbk)p_c@T3u5cWg!R{)465bqd8`u%>bsb7C<;cCGO+}nZ3SkGPeG&^vpj9RFYM8DYs zDUP1CP>!q8;6sik2`7fd<5e?&&HCgbPNL0YP`#Sp8Hyz$6KT^kKK$-IVFFi0U|9L% z09>fQ`!qzcOq>icekLN?cvY`RbRXbF<#SUlQP^Q}vM!;GB4J2&u~W+JywR2YZUq_} zplEn;W7vjDET7<45o|1Sn(9`5HxC%SX|H$6Oh4zqENnX24>PLGKCVz9YuzFtv4Cpu zM)kOv^!{i{_?sup;Uw{i2%S3q?a|XG8#~YM8RJR~g!p%6B2N%J9GGi`I);}S9|#Ug zzR|g6tm9fj6f{@Jpi`;NA6EZ!n9mvcSYK{vWdKE zRSv^7=63c?buG22>*uKPN}HQQ3^3T~xA1do zG_R|u<5qdD)rk92Pj=z;5j*pnF+8?d2YbQ7e(h18R@DGxan0n4nd0;9FW3?CW8eVo zR?EDX%E@Cauv5AimWF;7ld9s-KzQv-F7TwRK`R0gMbyiy4{|u+Ie~(hYx(M6j7KT! za>@VfsVXGLjL}ONMhqP@ zeumX@(^u~r^E2hKbIV?%D351-V&G-1?hy4=x8Ake3@V?MEx8~}%ab#K9X2}*LD5-l zqF$HzmTG9>MW0k39(Dkraj|#DTBn1}E|%R)-e4R?>0~`tG{}jHCr_cp7i~f<#GwCU zMhv)BDI6y9Rn<=c3$XCWt@r&|YW$O;O%q;L)eY9G%z-W{`RN)cr;3MA+U_Q`3GS_e z~vbtM~A;E_P;8A+?eSQ2| z7?ouVrCG-tVhXl_XDvwb;MyTcH*)tId;2_WB8pqWsdolX?fi%prHpytcD{{>bzu0+kR2r*eh7}L7yQ# zUJl6wqm9s?2o9s2YI=w={y!*Zfi^&TI+Cnp4L!-UMz4{P5s@#kH)#=mvBJd~>#HB2 zVHgoU0W947pPC)Ut^A5ql22r(hY-##SBQmQz4T29=2qE1XWyUc^@%?2jdgUJzqfLr zo2}H;jc%(rcX_pX1z2VHT3Kd1Ypq^nsq;d?C}tQ=kcX??2s?Y4&g9pui~X6mr|^I< ze3k%CCI%-KD1jU)f3CtF3NCCxuohoJv4!fE;7e(TuJIVmiMW3jc4S#=|q(@g55)2zam?E(;6_7AWk zwvtXl4wwGH{Dw`26z<*7rb}ZEL$4#H6xFZ2_O55|PiJ4DomaDAC6guqf5ZZAc&zxA zy=fLI?`F%FpAYY@r?o%^(`QXXR7LnK$SLD3eyfTvoRt=nRmQGX)fS0Kj*14EcwLYoftp2rz}AK34+J;r#rXV z`@^G1E=-=Fl>Nmv`PV)F1WNtmB!&LZj^>fxQr_Cb=2|*cOKHmHYkqRtmEttys%BFz z^{5iSy>KJU2bfr~NAuQ*aoC%Cw{&|fnK9~-p*;jDnu7Go!I(Hh47tEiZA^CB9Z|e} z<{%qPUrM;75(Vc_ucdg)o>Q$Xm7CkWX$y630acP-i(pN~g@k}sUKk2P>u=LAGfe)# zMg1`TKGmFblO@|e{%w-*%|J+;>OhtBukC-AS00&{e7P5u-<5GM?F4oAO>-OHW!qci zo5%iHfj;w2go;;d7uUMZ^BC81R~KvA{w?U(k-9w|#97EFiFq`n#r+Zoy zNm37^{cQh}IP&<$qJ;3d9Y~l-yZWfDX;d!7F`w2+-Mr|0&p?^PbsjzseH(?**|rM# zh!d@-kW%h+-o3f@x^>pXM!Q`N$V*%cF}w)Fgd)zy2Ib@8phhI)KRQyHrHfwq$Y^^V6xk5az5@sIA zh>K!c{%JIWrh6h$RY86SiD&ykDmG8uCW-&BUqLIE$dB%fAYQ-a#o)VJg|s4$R-8<- zR(&6{41T=>>=1p8c{S~j6Xt-t+7RRF;i*MM`;!=7FE$#-cypKQZlC#+8RioT=cz5} zIswT1CXC5}OI=cAu_OFT5G|n(VW5(f=kMFUw6tSPA^ZuKvxp?M1St!_x5Xu&jFjtk zHi)OiEc&k8rx)QBz%N_;)7R@JLbKXd{_^3i0OW97zo=@y)tDj&CAx!Pk?(pszIcE2 zYGvj;9hOq5n#lq_k9-H9!qAop3>d#iK?-kh5;*9kUefw z;WLzb0e|2b#%rsy5cE!@%7{_7YW;&Yu!l#=jO@oo&-II@ZfE7!tk1+Pe_el=3|4M9 z4OEVfg`GMk#Q(Sk(Nazs^j5b+@csKFnax44{wSqd9a1?Ku5s|20L@!l-fKRTpj9sA zx13-Xh{+D%Cq_j#s$nz1uh4huVWZe3_Iu#jt~dD*R`;HQXMElHlK9uRW=LFQdX zeVz-S{UA=}&K+Ui0K`)fdu5@~xJ#q^nG7TpFHg9^(&2^cz8R7=<=$(Dy5UhL5}Vq{ z>FYw3&Z^1hm{b)c`GsYB5<|7Q<5}pch;EdS311fJ zYjq9o4^1bLjL|qk%rN~EK%x!!p%m|^1cR)hpj9rZ^^L^fe9Chj{W&I!)(q}$raNNC zYAA0Lw?tYTjCDh_#m@$crbXwFb5Y-$Bh68srUwwBZ(|l_2AIA=FffRh?y1ia!^HR- z0;>3yDP&j#yn~!%JH4$L)n{pG&Vvhbe1s^Uzi1)~SStlvlVFd2ck273M>!@=q$RrN z6AGM+ZV?U+e6T!qT(T=i^r*Vd>3YJQS;0m7?xrKl&*d1J30XBojDZBYa+|ILo;sTQ z2Ht&U40$$tipE~v9e6x7dgo&K2Tj=JztjDJrVs*MYSv9uYGz?!;hSQ|QFf~^p$B`# zX_p=hp$>XK1+x-kW!qch5pem+jW`R1n)y%H8t(0B*|YyTF*g_#;*g?$JEvD4ZMbdX zM{#-IJ%=!6o}g+wm_4ewcD;*f!I~)}j_tiQ z+Cs@ZGv7;KAUIq}eiy#=55^XS9-c6SmtZzQ_hjtv)it`!!KoqlD2dIK!lp4?QYZgb zHQrn4BYkj7Ab{k)j|iEoVo$%#3@B#^i=0$Pf*sLSSwq7Y(c$%VVx)8X*k14L>Phd?v^vOo)7aX`#5X!vRL5P`b3dE@(;B)0|1Nvd=r1+3?^=vL$-7gcxZr77x;Oeo&4(nhhs$%!@mVN6*q@2yY`U2mxN zbCH_dFt>Un*clpa{TeJdideU{yksoG!(>9zdJ=H*J(n_GR+KmMhaxeZ*ZK?gIQhADP;}|OPbrA4Jn(uz zsmwwvu^`II^?wcv%FMC^b|heJ!|&4zV0$5N5tzuXktsVim$17=I) z(T!GO?<*bT$N9CW2P}N>Vh3@d5As*F~%>17*^V@ zHIZ94^0j0AWj|lT`^bR&D*>A`2T_f=TShAk=e*-4ip3EQVp1GR(Ip*1qT(+qDMGVVZdGnrhnKNk=A>T4(~ z5KE#54|zccA-d)HkkHlI5tr|tJv|LeosbC~Rc*b(k%M#EcTdHAVyBNNiY%i}oML{2 zDaAcu(`5k|A1q~pA6pZp*5h)`#T76#$2ZmR=L~WgR})#|jhdW#q(LW=GOy2jBs_qY zG->I$d7^|b-{wQAe{Eb&{yE06zWDH@f9>O?xpgtOo56F#%|i(mBO&{fzMoP$1<7xa+rC9xcQC<;nRbv4oM7o`OZC&C6t?J6>KeaK}#h z=+Dg+ulSSytRfJtCvu2sAGZPVmCJ_(1)zyMJrmLnbsIB6&t>J?#8;R9ec|kjS<;fv zYs-hjQVsa|N!mEnYro&2K%wvpyDcn=Gf&kvkhVPvF9QKk#0NNX2s{cp1bemhUY+%%qCCz{UFsVmJ9LM zlej(X5Oh>&mh$B`&(yvv80aE%!n{4}5m8K@-m$ry&`$`$(Oy5@rc!e*D&UgX&xT&o z*yvzdJqCJBU2LD=1J1)I{{)VBMK=L<`T<9z+kqAh;TVp(a2_{vue_usKv%Q0TF)A> zlOtJ?`F9qRZ#!1|O*%CWR`{UBPmr&WfgZJHxN_#BYrQqJ~`_yx3s&?hO9Umhv~ovQ_Zm#6$^}9!F~7< z_;enVt{xfjLJV`WcWjN&0G zVf7R0NQ4cTrd>aDc?2Rh-nHbRaG8ZhVXmZ!PcTSJZ7|QEG*n%;HMP{PxeLa7 ztuO7wFkF&2Xz-pELz(u1*RN^`Yq z!hYp5d*SYAMOI+S-ylZW;D7Yvz}0%s2#dKr-iprN9Ku%YpF~(; z9gtL#-H2xAmcHnW!M)t)MP1|C=?XK)yol~>Wj5NYugdj@40LdF!D)4#OW#QCMs}M7 z2U)nx;$1UUJsvXrQdc1xJ|9y9Rvi%y$X#sJD0uN1BCRlibzVtHHkz8vEOd+Cf-h5W zBvNuoJ=T_igLG4O*5t@6Vs+{bzt2O>4lH7jd4mjT30Iehw9lb*9i#@gUjJOTSpu8( zDGo91wY(A~TZwYakG~)t1v$3-UZ!(b@y`__vpK_xk<&k*@aoj8DXo_fB`B0)BTt!> zHS}t9La5D*jMZmdUfy|$I>%R2Vo#o3s7{8^ri$7`N7Am zR`LfUF6cgzwut;aNaZ{U&*f;$`EB+tZmMe3mc9K2id)C&Brlo!NpV8qVtF8Va~kB9 z$^mK}34gAcw+k?5u84wiIGuBbw z;$wmF&%3;mve)WEJ^$j54s)qlA7&C?h76;qgMfogKPp}8JFPQer?%`&%Mka69Dgaf z8#C_Ep^UfgKwk9pgdXRq1MK9{Me=npbLq}j^)%SPvNkB?W=tz&%v$tf%Asl@xH1wf zL!=j4e!sT7nx?NkIldnf$M?NcRhoWG#6}dbxF)9vp&zH0f`?PH^h+i(?Pk^T*orJH zW;#`MQ40U4Fbn#QFig$!%|od~HnQLNad!9*w*2~_St;@nit$Vf%?1aEo|2|IrOX5p zw-25dSdW;AjkVmT9}tmb8!wLlqe!~Mp00rqXgWr1Jt9%tCM~&JK|wC`;$cS{R2cJ1 zBSjSZq>)U3kx(1Fv$kr6i9&i=X|k>E zKLw8Mm62z-l%f@oYp4;>`;{YfGe3d8aV1=1wZj`G zCI9q6EH_22k(J~X8A7dMlgST9q>E4^S<6dDdJ~0HNmIzorJ6HQ$s#{@>0OQgZ* z3|p`Yor>d8IlRY4?=$-R?r4WdRA&z}^vcCEvsaH%Ej#k#?TWoOAOhVnJ_HUdpG|gH zbUyZLYjw`BHR7(;keA;%tYidD`e(IFXVFx?q**-x%1uaE^k~Il)zPm+DUobhzKxXV zGiFdUt-M&M1q-tg6ircW01K#4=DN#QIo8)b``!+>F`$n+)I8_PcLpO+aK??(?6E+ukbL6CQpS1?UVw! zi&&zTZinw=-y%a(LeaKJmyI9l?Tk$Nu@48mTQ!(4Z z6DGa2S6A`1-|x1Kr?`EdAZh#?TmG#nA;QG9N~^C-?<=n>R!n({Pja}TADg@mpkB3( zqpg3y0q{))X@(g5Yga+C{GH2i@NhY;=+bdul#1{TO#2DZJt zwmg!fqDOiSbYr@e`u)4TT)3;X$z)IA%Xy&l5Eq^Z#5*+Fp}p~5eNnuw>D!!WVu&gV z&dS=~9yVV8nr7s4hlyfaf7z#+f2q{6jR3@j;Yc;S7+wc?ZDeyuEZdp>yq>OguxfvP z?N?CR%KjVWo*gMryDG%J!>!9W{zra*g@u#LqBXfIyGy)q6YFER$1f(i(w>0!c{@qz zmy&2iU;$Y&SK#Wiy{$Dp=5e*-`1Vny5utP@H?7UA zX?@qG z{+lPnTrlEO7HOLp^)+>#23M)QqywGtSg~^8)(7~KT#9!O|!WcMdTpxIVgq$091ZhPPt;o)K z<`~O?6%sh1(y-h$h$oP;bsE>lP!Bg?BJwC2+u$Y;PHPQmo?g;fvWr{VDXZ`Cb=vOn z*ufT3+Q2LiH-#G?W0w`7NY-h)nW}zWY>-q%ne^`zV_RYhbc{pJK*3|9!ETR4gDisd zd%6ok(X4*Yt<>3s{sy$@YL?+FAEH`P;2JzUu*ANnLj|&-IFQW2DfIm`2Oj|$*tXA6 zeq*;1=lQ)mf=jQe!JlXn&5Z>#uXV#|=cnTRbZAkJ^0W{+kiergI#@bOs7!~D#TtgA zX{|WGk|n0HV9w9{Toxgn^3mNh>Mngh@u;WSSnEfQKjvlWpctwWtx<@nIpbGSH8csI z+X9vbQ?%kS|EN?P04ae~nPYSc(F*b5J zuH!Fi7t~~tnw)ph>q$%Uz1XNf0jED_b4?mqxI4;_&!cU% z(Yt|@mPCbck}BHHu~Y0M!d++pwqtK^)!ERF2F89gBA>CJ)LCttI;;-zlfwLJEgoc@ zYVMNc;RQ%U)kl!94AF|t=pj=#ANeczj4tBw4RfRBy}y169ta91#NMe}0XsxGcAv*G+Dv`u}2%0!9c)cck6J6vQk zyS>6!o+aGEE~X`v2w0$bod*?~T&?gFEad<8NG8y8jMwhx!~e9)^y7xfYrbXt$5^mq z7$vpR!fPbX&fhF>0T)tvtEdS`oJ8rkxcy7i=`{g!Wr&q6kWabQ#ZoK0%T(?BX47a` zhm!c?(9>-~@zsqs#LMV?-OuWA%>>FK1esNfWecnmJHo{70H(GIO6xY<=kB}74^-{% ze_^r_-3+S1k-CA-v6*5&3;Te->Pf^L3h1IY;`C<zW2OvUXX!m+1qRK&8B0%TyBsGa}Xde9L2}kcOOM7m!v-RoYLL`|~ED7lGvp*0a`9e$(+YFkwGAS` z8>Y6>6u84G6yx?4^agQ6m%X-?@-=+YXtoqO++V=Tlj;uTShD>)_WxMIm zA0rekMW;0Hss7<7Q7%}D@l%NUo-ra@Oyy}q@K#hbDx&ZRw3^5hd2}|hklx^u~{O<0UGHNFl@}pbs_1eGrE9frE zgTyPuin|H@8%}t1D=wH?B`~v#A103=zd==q*b(7%N9xyal{^@X&q-&MBLs(Ij`4_@ zneiO|$G(DQq{9^2GTK0|kJpo(T%dJdpvT!BX5du|-^^hk&6PVSpq1_OuCM8Hvlg&c zwj>qMxBL!K*?iqdGuU%YVMsa^;xaS*VROxON&=1B=j)8C%t3m#mN0PJG|XKuyuB4g zq~Xse_*QfoWU;lR{L6A{h3@e%n>GM%)>27G_tF8eqzO^DXZ&B)UBj>VgdjN9j_JT> zYrj%30>j$=xh#7yuWA2wIgMvQLdgMwkM^Gt<~p6|WTAm5FC;?CAidrYVwk3>iew9E zIpi?)@|w5Y(~gjmvt<5?w{TjjpEdC+9T0IUNDyf$5ruhv@1wm7J{pY|IKRA550f&G zGOCWt)#bZkN1JyTQ`_uTNUky)n(C>mA%XBw$HiPFh>3Wdtcpp=L9n30KzcfY!(9A zG--Uq#^p5bNF&)8{<=q&wuRw{r&>l^b07W%>`7lT8vL?;SfFqkKBisMQ`QdAqYBZz z`*O1}ncw^PF>%p?nNk`**pM-$Nh%lbey-aDEt`N`@}cMR;edstg!n`27MNpPHacc3 zaN<;zFa;R205&Faaq^#E#GlZ3NnqXg?M}5lO8SXBzAQTDz>W)9-?B>3QMaFeL~ z{Cntvi9!sun;7cIA66e-ft;Jij0+Qd0f}otLWrk@kg8VDkXUf3!5FpY;UWa71yhp# zo}n)A?xF^e;L2dUwZ;IaE^N<8Re|?|?2Joui{LMR?bq8){q*lk;P>d6Gs{0VY6wHwKA@kLRb7Dr<9t7yEziqIEI;iQC+C{$vvg#b(l zP;}*=1+npXJ{Q`(NzkH$)-hpAqJognQMG?tv$#4@2g!4>6r0gHG}O@Y-f=9|f)RcL+nU(Xs}*nERl zTC4RylIk#p^UK)XFP}7BJlvot zPa%pN-d`Fiq{E;t3wLKxz>CkB72jyl}KBl*%mltikyHIoLn z5jA`p>)jOhrw+e`br*eu01JJ{=N6WhQELVCB=Z*QhfM$a{Bl{SgMS}hIP{A|Pb57I zr+D`}UPA+o2zcauY3c|hdj#bAV-D+--uzLGb%|q_(y#|5KA-e0s z719iegy-z=N=j5)2*-#*v=>uk11}R#o|G9k!gjEKotMt*tbP;oB#>jhg&9nE&$be6 zU9SBj>v8pwL@xw`XEDpI)=~oRXP!>>&S>KB8lkW2Ur1$UFj|oJ>`%a~_+IK2mkvJo zk)FJduDgg8O94<4u$j&~cIBWs-gfdW#Dp$a63H}lBz!o8NOcUFkHxLKbT@s@=ZQ=8 zWA4R~l%nE#t7up!PB6THh_V2H6(NRf>BdP4vfmBC-LFO=YH$ytz!|3236SO3gsz%X zYVVa@7dQGmQ~zjuEPKj&wA%}|uZ`RXF1IghCIT@#>ogUaergkq46ORjeCX zZJ&CJ+>v!8=a6TzmYSm$+e+vojLYmiu2=7H(sY+F{gKo@L9RLLjIr{aokf+$eKJ+G z5B@tBe2~sYoJ_uZ$(35z}GX5y`t?&(uIbd*?TW4`eUd9UTd zBmkEeT~CIbo@}EsS&dpP+xm2*1aY&S79jdGmIzmed9_aRwa!k&;%>)|tTy5S-<;m_ z2u}T^OZzYTqb))&WtqpdA__ywASOqsVGuE|ceCmszVf!kXphy20l5TAS9GU8?xEns?KHL)y}XU{;Ah22}ZAbCm!dzKLE(fAQIz>A*etzPAi z?l*;5;SnyPW&5sL3XRcgN>_UcQJcn<34;>4Cm{QnlKA0oUqA7o-3scWvMduz9xr zuk3W{YCMgpO&FzGD$uVn+SL+ofWI2@+wQD2g!5x97l!Sq9dJzjYbg0yfVir{fol%y z349|A6{B`G&x~LM<9@R5b29>HEBy3^gqiHshkAX|we{vOvZBSyRkrcu>$x^4s%!@N zn1RN_6Xc5pR@Fwk-@qgsr3B4g9L-c_6nQDh^N#pYB9MjafgzB}k`N8fkXQ&pE9&*X(J)xkXxg#)B@dS!i~MM5>?T1)CNu3blQ5Hf%F0pn}1{H3;+N>m+A(^*_g z&vM+zqs7qWY!vydyGmo!7S|caBr`K03;3&ycBjFWO*%9WYbuH))hD_$B!u=W&+w!+ z@S`=T>wqRv7w0(I<&A094Uo9R6CaH_8rT3_G}8Y$9XmFWLzINE=^Cld;Nq~e(pOOf zRa>!hpI1aj7%dejmmBS3iZ#e~4sFa*{|)vFwjVap=Rbcxf3KMQZA-Bt4YRF63jn-`TSv`U`^3{=|^^uC+pTN4tgvC&g>lvW0=6Vxw^4z_iKZRHFiy zM^nW&3|L89%x!HbjYM|WjNlzZAmGdmf{v(3^XH;INl0Smb>Hv`m+2QSK*OBf)yNh0aUT> z?ibMpI;G*S0Xd?y1JcIgN1v}Pt3Ps0Hk6#WU%vGJ0n}s4xL_}@y-j}x*00(#g1nCD zBU0~c%K0}uO<+^Yi=}A8wl!nbXlWHIEQ78O3@t2l8-n4DevVYDkD%DnnId&U)aQ6L ztBO(i_bHy5SmW^Efw!hM*IZrh1QCX^hism?8sJH^7`2qZr9UeD!pn}~*j|(fZ?C({ z<&FDIx0&9G6IX&=7JjLkT+9Z3Tz89oYcA&>kG@!3uWtTa(JG}rc?daWKiV%!Q{eoH zIHIVI^wlmMLjW3szJm=dUo@IUJVpXIgs{lONQj@rH@Yu08HmaaWFN_ALCYDG_0=|`NGH7CnX73a|M>ioMe$(gO<;Dl3tNeig89tn>vSE9X$ z$REvR;q(Z2KQ_REBp9`9C=sosFnl zBkbpAP4s&CE-FlB)%x4zJ*ptA{%dpK8NKAQ??xS3r9tfvu!uEuOMetm*css*w=X7l zMzm+8F$|owve8timG@2&Fkx!IW8YW?LB^Y5YD67d50zu6_mTYJaW!0V6rFCRN)ze% z>M(j`R44KrqQc>pvO@$-4p}HJrI`KP=+Pw78VJTZE{8KUb1bvW6yW4Ohh%()bX;+XU!Q;@^p z$oq0P=Dec-PRAghDrvj?eYR(sxVXUnWaKEn>Oe{~x@#@X9+pg7hX?6M9FIeqO-d9K zuStPTN_v`LImN^1rEKVnf=oB{!>C+)}wGf$1;Q9pVB8ycJOq}X9*iv zV>{2)&GA)nSat<8QdvM`my+LIx&JW5}G8X$$dT8dye&ueZV zb$p!jIv%!+NNv!o?m1r{iEszO@Ap(-P1%vwO)sqejE84255Qyio9L@8^UzlrK22!EpCOu=)3 zktaIM3Y=2XfYJo|tZ)qABUdeLsGdgXO2_Hccg`}G9Up?|kxR%qyx~$^thmc~E`5ol zqARFNQmxlJv9{ij!iMsKY>WZai}5E}!Y~DsQT84@qRa|4k2uTYH{_n#m|%3(bd2a7 z?qJY}PA$d-+{3g7!8T2|wBHS^F{b`-6D!b06Hsdl0A zw~Y;8Y--7+m0?RFm)_J@BB9RdN$s=^;5a)UdyV@~ubkx8pMbcQP+MZbxqx)_C5_<5 z_V>;3an~*pU8x4T*KaT%Us7cPg*;!$+S&flUC3?Q_0H8ojQRRO5vjhn|^{dK1a@y}QMZ z9*Qy1S(gmN9$VpJU~)224cE%o2nA~0u!_mTc!b@###6N|;8OEB8|5sEO2JJN@3u!c z_sG~cE-N&I$8~==7xDZMDec1NGuN(a6jcPFs->28sjDhWSoKtDGSeMdZc9XhDxl89L5mcN@ia z99GrUuqj0JQr88BD9~Y99<4a@a__UkZ!P<_%MSfl#Fe;7Kf;8%O$QBhAwBvaucm!lRg9g*yRlhXHwG4 zzEc{~cBi)+7zj$7)CDyFrim=gMqIuGb&3=)uWDdk)y*@P;|7eK3}iTNCn7GLkIyp0 ztwa;Q5*CQ1_YOur)K6bHaG?R^nZhbl3JkkFS$zFeOQ%+bH-Mcye6DkBORS=@3o^U7 zw1)#Z=nOTyC7j#>vGN&=i^FS>hJ?e^nK%Rw2%g|7M}jcIXVqG9uZVRLoA)mL&Sk*h z)+k+&5$sB~icA)oeP(G~yh65+lcpy6RtUbVs84XXt0IHj_P8F~x3*Z_a+@ZYEI_m( z=DwLCfn?~M6~FtozR%_5ukn4_}P z8roJu+U@uvbrP_4cqnUKIkhc|FDQ~b5+(i7KM!mNiN=fRF8r9bsI z+5E=$=hWda@rbVVD0R4q<4|#MI+9V3+Np@5&7k$sY%H!mtEykL39>e=Ix0D~`%J=Gk`=xTfv4gkc^g36u*AbDoo)0qt^Bv&oi)n%V6wcT(EubF_>3BJv z)q0zSO?BHu`>vb!Ve+n|Fkp4Hu%_fM%vzDP9vFvRo)6l&jV+~MNI1nKcTRB>@ieS@lmrPs}!z4EB)xxC-^cTmi>;f}2}+tOVL_{|bu7fOL@WMdVHTu$j_BVZ*tU0wN0pe!YI+@AB91p-i73)@Xi5+F ziRXQ3gTnf~-uV@$=Nuc><#n72T5|fq%^e8#z9lEzf$oP=T7~vg>zX&q)n-5n_-j8= zodr8h+~^nyYerNLV6TWaSa3N1`NTZ5`x@-yEHY?upnnf{>2)FqjWp~!o-YqYq9Vf5 zwS+}52yzR-Eb8fVNmW^(ut|odVyqHf)2ys|Jv;&)?y@JPir(sdqTfE{%y%$n?9p)> zzZ=NV)g)kDfj*PbW<_Wo!E3OL?lXfg0TJk%+rEu!#3uHiYtX2cDi?W}`y zYH#p=DZL6^22Ss%p`v1gIaCGb)m;q?_$h>D=?KkEeL53q-6YJx8>F3(Fn2#xdxSvJ5>STZHmn86Q?oj>8SgI?3UtJ@u~1%u5@rM-gKabkD? zY4`s;r&a}bu=VdkuQ}@loUkCMK8hvRG9wmd6|!1^^cq6ZC&lM7S#(?FCW}f6cy)2`>L|nOE$gJJv@5P-fj(}? zEW^JNt68hLT^}E|aX7&Z+r;V-J z69H5Gh!=L_d={{l*eT@VpB)#aWsKdztJD;Bv6*KkdHLJd?TqH@gl;*7Tl365hfmaD zRal2rR;)rLG110r+WdElgwX6lUT+!Rj{&RZ8FCJPm^uTD$0te(Rv~4y7Vo-GWwI3F z%o3{lYW~p^h9sq2v$eW`o<=3pMVw9@D(oiV0KNpG6A}*YhiSM2%cxHJI@#`;A~|R@ zg)2St4zm12kG20)7LO6ZA7-1(YRJAKoPnQUF^HAv+}z=AA&<0fy}c|ceGh7!Q=Y_A zZgPa<3{hmSu6X*1D(;7;5z2b@PpN>`0x~ZxYVmXom?=*$DW3Ip)7oJnsrDka!)Un> z*!htwPnFU5*VvFGhm2rf1}F?5js9CR*HV_EhmUaqVVfHe2?vcVban>it!iDPF(KQ|dYm`zkgX8lJ2~#F z=SL34CSiZ<^NF6`dKRy_;zRvel;HMP#CHA&q+6B)puHJ*s@&#Iz_HWkGo8r&oSWR? zhl`n%2%Q<$-2^;#9C_{qohdKFIR0V}`7t58HnW)7Gze0n-o{L- z%9di-o4kI-yuqVJpvFIK@*B&$ss++73_pF*BMst<@wx*q{PpOKrkSXT0W0r;TYNcU zyq^OCSzDD&DfgNIy-YLz7+;S(J=6j$8JFPlSiB4*L@=Mahg{IVbzCDB5X_00*os=$ z@egRKCUz!OGQEna5=}&KYcq=r&3GDsc@Q!_?TRG5ShGG?+Rm>2!R2zeyC(O1`a#g) zoPy)Fg@w`?inBTvz_NkRogJ_uDq~}m9IqvKPhYEJcd^nf%jl*l6SL+R4F^z+>1gSt zm@R0!X{*ZSTFAHiy`*yHw<=!pJlS;7qO0xrJ9*N`pwBrEMOmS$p!4m^iv?nLhH5wU zX|!u_RnLZ_aKXgmO5CiXt&nhIOri z_{Wr|8JPPI!_(17(%KeY%*{Mao*w}db2E~`&qbVKF%$0?=(EszjJNUnU} z{mYs=y9;{=3%|5?1besOhL&sxx=Mm3$M^Ra-*&>0h6(v9@Znmw4y~Yl(|wrFiAJu| zSX*DJ;N&!q=G4Hctdn4{P@n^7JBnvbfw&~<*-ChX4mCXkE)1~v;h@o1#1HwlYaaHO zs?HTMi*nY6{0%EwwgqpMYHoj=GR*mr3~P_Q;X8c^>_Bf-tZErXvoz%nrW-+*2?k>T zXDb(*7d6GB#e(^BJwl_pDH@r!U`NJMjRCrDyS-? z&1F=kVJWa0uB`N$v5has-YW~t7WRpH(iP4wEfa|(mQ ziiTBFcmn(YGR95;0U^k&-xNr;)n+5W%xoZ41nFaA7#Oz#)v&%g-1DqV4PqnyXWe>E z8mxG8D%K|ojqW=p+_y-O-C^a^1a5q9ZT<{Xaw^SFM>(q_bkr5+QN3|I)m!%T!5@mS zdMSaEl6m&h1-F>dDON7_Q%elWhlzLSgtOT098i{m*l$*G0yGN!=iMMeEZyKjJ{0bs z14p}Wnu$2`?kc9T9x5hnrNwmabj`JAozV{-oZ2W)|N z@xBf+e6QK=T5&kx9qVnyX#!|nA!EtlvnhAx;^d7@>0Laop65|K73Ra&ksx!ORN7*5 z>QwRF!7d7!RUS#))E38OzQ@uSeJ@|dLB!I>%JzPr8>d2V!hi{v|J`-|NxIDda~;Sv z<~VNWNRYkP93rMy2Rk^=_$AMQYV!%w*+%sW&SKzoG~c5HZy^>_v$>Thl#N-~+5PW5KS(GhBMNpphFc>(p8GEawCE|+n_ z&_+;R9oakv+v{vWAxB_o+6yxzHs6XS1J@jtQ$hUy08K%%zIsQxsxBe>UUV(*3LZ@^ zF;@=7&|-lYieeLQJlaXV=;7-q#R;^97V{ zfK=>zEg|*9^*ck}{T#s*1xmqkz^}hEXTMK|DG&tooh#*GYvgG- ziCXE)`~s9LFdYz@TpE2HflMF?232)l)wGpFQrbfA=92KDgy{XE&-+3O*(4T-P~R*T z=$j}uL6T_rbYy`@#7{#AqHnyq+pdRht8#lkm;-_R=)%ryFu_^I2=eAHjgF2$CcJqx zyjk%+SG_U*p|d;XEffP6oPbN8_ie*U8TXSFq2yRBkQ`BLqLN*F)Y#g9!CvqEIdHdw z{-}>H3BxJzGuVI5UfAokQw|0%ierv;hJzI54``<#9xrhpxuFOp=7u{v=mHTN9hvLC zP_UWwAh`M6pT!po-lk z{COK&yArCV$i98;R^1#&N>+Mk@zQnGLe;efDJ-?`%II``NK_9%?^9;v<2~ z$1`r9ZV@5m<*~@IXP>4d1~t2)E@@x-Y(`tqqpT}Z3SNp*v|91F`=t!k(sF@Xiegig zM1hY|avBNIYhFmga4lQPK|?Z965k$n+@K%l7kd9Oe&G)?$uAVz(?S}9D<=)@D+rdW zNhh0{RHCbmah4Zl6JPSmP>?Mb2(lNzbAbl5BNiY>b~ z+ab`>e6q;%+orGM}$-JwP6(6m{UI-`U#x+p#UEo2X#-ZMem~!;+zV#;c|gCjA9dP=(gS4~;d5s@nsq-3$j@IX zcMsX?S3dSYo!pZr1Ijt1JmC86FYh6Pal3OIdz@b{h76eO=k4B-buFa3sm<0GRD$K| zS@z`7RSbe=Ry%wdnJQrXr%x%|a%Hthv)D;tUOC?{b0c zjbalFy*SDjMZ5uH#%fU8K6}LB4FN8pN823GB9b*aOk@d~FIl5drgSgO%0tRRRZwB3 zBs}js(&nwuT#Jt8alb|xO4j89$r{BbUhquG8pXYI86IA)whj(w(gXnw=2ee-5x6U$ zSGh5L{bJ>H%$05HI$#hM%n7+gK@)g@#>`eF?_18yiOIGL>l6_+9HpeOW1x^#p<K^U7?z|qIfU^73=ua)oobzF5{E&UalaY)V*gO!09p5DoPU@_y&YvnXi7 z8^)k5uiCbg%A7`8$n_Ht9pB|d3)M8bs8yw6U2@923gy{qfjo<1<8K&+{pic!44vJf zx=v&fz;At=(byEWs+ny~vI3{4*(&sJ_uIYOKWq{OY!VxNcs7=9fUI~+9bXL0m<{*N z|Ji-@gFI5IXGrWHz8ZMADsyDH7dyz%@VA5PIOrF|mlPC|CL9VCrBGcVE27HE>^F_* z2`g(!1f{xYc-<=%50|Jyy%zPrP9fa90NU7)F@9mN7odFDkZ8k$_4dXJXb?R4K=)W} zI&?AqtwnG_*c6*O1#>l7fLW$67&H-nK-P zUCn9TDM8~3ZWSuH)dB?<#U_}BHV1sQy?)eX?pk`G@fPR>jWq<}CJao!z>AemVXdA<7)Z6a`Hn3I?rIrE^9rQnn3r!v-NGFTfMsmj&16;H0}a zQ9{META-Ms*aT6cfx@qJuQy6Z_ozgfgcs^F1R<*I7h5^rTyj_~p1fT_{itn!7{{^O zmaD8GK8ftb^~YT<0q$1mc$PkuGK*I2&{apa(1FiNxe`YsBkRJM|t{fkQh^~KEE#4EEb z30;@86BSj_ZUpAap}t!!(05U6f@Ub}|9Uf=>rt8|>L7ecpXRt-L_3p;vmL~ z^U!PiXiaXzKVs{cK3T6m!C{}=z_|=cWE|X!oC<<6$V92;1&jDwJyq{;-rIax3tR(!g}*JUTbLMPAgr;Ga;)`H?9`w z#wa$yt$105$E(K2U=T|+zWm_Dj=@*9V0`$SPx|ZrlokW^<3HQ_@n^jU5E5XwfsP<5HD%M1MrhhJywHp#4osmwTrJRtQEY+)@s5A!+JeDeZms`s z=l2}j&rjK$Cf`5DRsA1J{9I<$3_H~$dy`(TZh$TJia%Wc16w=h=*}o;0&_5EEhML9 zS&~W@5Vl$5hB;MESRptqT3XZz=Fm`grVDgu6q~FH6&v+&-k^wwbri%s*gLxwaK&yE zuVC*PinYqGQ0DMU9e9)L+h8JI4Rfl+Mw{YRDHYqQ#$qpR2K-*49|`Pg-Sj9lj-D}HoE zDam1L{@%!Y zC^BEAMWKrEzSOKGZOb4@j+#?VVT=w|%cd8+?syZoJZY%X(gi9licLlQ#|A~nfgwV2 zcnuC-_+ckj8|NGP;rc&T)&;*KL&{|bY*HuqIXdzUwhKRB;e@H3HmiC~t#3>RAw{(GUi(-=$iA%T1 zJq3e5x|oPz8xcF}DYBHgg&q}< zGDo*XK@$jqK?l){fcjy!9&>aNooY$fK#sk*8y1Ogn#4T8YW|^vM@}2_B~BEo zx~3@Fq9hH^&1oa=C=sGk1RTD31^!+dckR+p;-m{CP86G%@fd83kDlP(MK9vryHOu5 zZV@=G{NvkHBpNz=bRC#4TcS|Py0R%%L!_*GLTked0o4pR(~a`QA){=lL)o%kAX}o? zI2%yd$cDJ{7R3k7+npRkfc7T`t`7onjo=rt0lkM98&FW14JdRFstKr>gbHH`ibhqW zt*WA_WeZ|voDHFfSuYSVQEcj%85=Z416;DS>%ps)xY-z6Zzb)?(KY26qgyYF+Cay` zHv$wg;bmh`#`?SxRFP6Dvk^3vG`4>y32Ru%YtczwB&L3-Ox6pONfeuW*%)w~{OMp+ z^ct^h=K#Ckzu6koek0aj573F}#f{#?qLe33`#E8vC};u`FeufE=Smo>UqVL#Dk687)XNK5EF-U$JQm94`vR<|jh!;i(qPG>L%6usjg=#1_ z48?{O6dR^e2m(a)l5=xQv0x1&3Ca5wgq7)$qhJE2`77fk&z|sh)0BH$; z*k?j1Cp^WNgfL)^)`)^8FaU!}C^`%!hdU@aOsl3RT$^3SRvq?5XX6YAwZ?jZ)`(&g z42Z{wqALRm6MGke=L80bg3zDE`sm7efXd{Gh@OPSq06!%0_aot9&+mbjgaEHgbLFuZ3ba`J8TVvSQ4vkYHR3GaF>LZFxP~u|s5kxLAxt5f5VSUcUWX_T=SIJ=nRK6a-hg90D5;WBZY; zdK(X;zcDFxTI{!*Cwr`h9eO9xEn>bli9(_5c+t|9C|Ngz=8dg7ZVsnaEmh$vJH%NK zYLoQ>Z4$*M4zYDeq9_HLP>^gE2$Co^MS<9$Qz(GqJq64QwkH9x z);s7}2a|nhpLw`7#>DM*t=!MY9{29U(OBI3lfT8RH}C(E{psfLXO{n)xzo=#*;{?L z-F-d%%q~0duQvZT#NmN{51dgbB+V!k+H{O+T`SVlRuNh%P8egx(kP^=RiSGt5{wE( z&1Qk9iDHwCii(;O7?lXfJau0MmV{O1f@->Ed$BJ)?EPzN*R9QiYU_W4eprXwl?|Q{ zV?g*wNSB!HNQdy{a$OXKOyCO!~$zfHn&RP!yYF%Dj|%6!yB$6g1fN)@Jrie>B)1h9HZ7 z&tC7d&mXj{MwXp!6&8%=aJU(MW3{SqlAZ)>I6^*n)5fi9_L3z_s zS!+dD-I+zD=7uV5RhgBg>IJ(=W=ZK)!8smBOd8&tZ zqQLS1h3J4q@BaRa{hUuPefZJA9vS`#8mqQHlb@W30>x(VMdtF_rYK|rZ!oCfMW>6t zBH*tzON^kTE2Xjy+pg;*xNGCQ31!n}fozImle~!xim)TmifdR(px--0+^$#MPV82` z;6LQG+t^)OvcC+QspO&|bT)YJ>1gjFR(a+jL$rYMMX zO_X|&$l?SDMbc)0NQz>U1c)}}8W)Y2Ll(V+XM`8h@3(s^cj*0CTirWh_hE6nz3Ym! zJsxam-?l$nYo294tZZcG>OoT+C_c3TmoH?(-*2~T0vCs_e`a)hO@vEx!ah;Z1TJCF zK}scDDyW3bJJK1emK1@!66aDVvo;H4Rur4$QasH)8tjE)zbT=R%v^?l+h z)L95P#EgXnKb{OfKog!J-(aUduk;s8PMM?9qM!*R!l1Sv{0o*@$-oEuuq%&)EhEyLt*fe2 zrAQ>sx1l`SE|6zYY?3FbnA31cNga&Pi=6_J9o+S*vc4dMJSU!=H77bzW4y1STaRQEulzH3U?+totB65(CpJPI$-p@&sStosJA*4f#elJTP28~RYwA=BW|3wp(5KZ zP-IbT`n^X+Mcy}t_}RuNuh-eD52rOf>$Kj4Wi)KJkJAa+=F(f&o=-v8gC%0%tI2 zt(y*_5DA1KLa+&iIt#`af!MSrw_Wh!oC&4bc7ZgDV$+<7hNq%6T2R=@+PH?pU#m?QP2bippmIw79}8inazRLgbOVRtBg(Q(`Vxh2qn{Yfn}%P-9f?R#T6K;Jl}p!$BczZXy-qtk~k+V2oPTK&qJ5c)R(iBbQa75Ov!|IdrY z+8qTipA`)oel)1|rxE;R5Sm<`RF6U?kOYGcM+(;po*E03a3wgg`P0(apT_)*lO&Wx z+Xa#+icOOws)?R=S$OyHMeIn5UTI}4(eO&yPwQ=GR*w%_m`x$$YG$LRVr zUuQ+3!>NXVkVYt_5RAfltE4gAGSJbY)MKH}$`BMX0i}1u83wO_L%jv_|=m zs1WcdAI?Gx#OCUxy844LDVT0 z`V7AK%MX=Qwm?ZmvFVo|RZ>wy28Eq9*A43w`y!EKQS8BxRpMxYw2*Te{DCXmZ5jkU`)v0+LOr9{hk6bTD8R<=N6MX@QD zU2IT<3mD=@VW48th7fr%Hp~b_Mop5{WQoB2z0@)PBCSUu-sr@J-^4dp( z!4{ad)#Y5_dwBm_+l_sH5H54mg}TQJJD~S~zyA4}DGK%eG)sQvB}pT4>L_g@t|;w3%=2TFJ!*cYyDYR@$+oYuqNb?n(3u0TR+C< z`MM^z!*9-_g?wI>`P#nY98y^I=g7_DB$}_OqEPRTQv~AQjlEH8BC67CA}4=b-1Wjj zO_eRsR8ee_MDcD+SW7Mx_IfZUvfHDvJB9`b(6JWE0Bppak9+^&w-3OH+wE@kyEwJx zf=s+Mr0ZHmUhKaPZH|Y&?EbJ~KYV}OLDTo=$2~?9>^5Ysdp{)u8!G>HxRPc?hx6*!#kwOLJk ze(ocD@kNO4h3(8Ur1l!)b0b%ViEcd_C40A+p=HqRAmNvJoK@&oKv{(%(yT(EL#YXf zCWIXfqTPGRNZ|B~mqg^D49XYCpeQ!Us(F=AQP?Zpo1dI^B=foyoqt2GY|DvzCdq9u}Stt z21SU6B5e0aSDnOiYc!wEh^Cl@^5#v5f>|8gdG#AH9IBi1#1l zp-RgasI(|HSQ#1q?DlfEy7$3F_yUGr#WggA4wk+`0WjdiCVRdnW@oyxr3!0ptWWV z8*DB{Q1W7JcBM13XfUXt9H?tPGVW#9uU@?bi^$qO5Xj=h!SQlK4=T?U2y+0Zlxyn^ zqO&*2%xM5D`An{l5TJLm=#eB;^b1A#G+$Uop@WJ@Kx-ltqPIJU-VU6S@i>1T3d?+f zu#95Ue7aa!MiFDpNH}DDHl%S~nZIS3p~fTq56{Y}h@HGO2DCiDBK5=@){q^tgIp1e z7<0-cpr8rFK&9uts5@y+ZUxuI5E8j2qGpV=96D>3Wz(|6$t{$g`2y(~#iogIvG$B2 z{He{hJKUI2<*-!1QR@iJ?|xg|9q)#AnPb3H5THBqViXxMOL$JqE()5!0Sv0jysH~o zleW{fF<9z?h`cwacUIN1W{vC;$zMFwpZNm)8O0{gPf`6jTEY#5p5()zD(LPALQYWU z@7!d0xJg0t6aPVDeAxI0_*w5dIR`aK!;ari#%n$W0pQ+T3G0xC-h7lp^W|q0S}0l6 zqL3tSYfY%;Jz=yEL`tdZmRD`l#Y1{|C_nQB@-vD}hP|LjU$6<`4|=bs&UbJB{>~b* z!k%NiZ0y$%^RK;GQ`X`jHhO#98w({U75MS(K6_%|*&Fz@U2uMW`5)PTr+J={%!%1M zb(Iyl{lOctgX8xYkNZEc{pa%XwJ0RPn!h>d{`>!ea6G9RJ1)ph~H+?H@PpkObFT=M#Up>dM>9>EWe2ya^ z;sAWUXBjm^Cz0WYwmkgU(d%;E-EA$|6J&}E= zNT$vHvjDsd{1%v9QpiRvbfj(AX<&}gN6(=1li^8?BN~{!B$d&oBIgU;5b&*jK zt|ZDs*cg=4lHg0`39ACwGT!jst$CsER(tRR53k!E2B0qI_%YYy>hyspYHL5>l_?u3 z4JFd_X~4%#Jp8Vsq?xUU<4~dVLN^*}pTY66>?z@8Y1W&P$-)YB^O9BkGdCkztanJ-ijLx^i-bF^X-3&Nno@($M3z?Iy zl_g0mw8kcE%G{~=6snQ$EK+njnY03hw&su_?fIRY(;TpUa_=-$9Zb1^Ao#V zKwE!p2y_|DR9AF#pm4lo7Jf5PhRsyY|K^}e7={Y((Ep&J9f1=0gi=xY!b+8Hm1^?3 zsGJ;0=)kM!0_s*e)xl!5wBVBHK^ z9tTZeU9*gJ*vQaxf#;1TP;MV0Vg%{xN)p*BT_`4m=%V2bMc#(2o3HBQ*fi^A)#1Ql zv?FPlb`sd0}tE(zsoj*=37E)`zvjE4YsdZ_A4;(R-RX~pGH!p^6 zgy5oHud_R?J>kMI282Er*Y3a}6X?U1(FYruO3Iq9QG|6$5}MbX2-&x!)|!c;$~j}v z_~RnyA${ii32r5N)?1wWle-A zNdd+X{b@S$H(uzD zlv);4YtiUB8g)?=q3&KR(A`mNv=(!8NMoSCL=1Ek2BtRn2c59>a=SSQ^9iuLZ_KS5 z%X@VPM>zc(nB0$C`=<%l4lfa=l-on1{;glF4^C8lmKkP@w%cm&?6u+J?lP-8dzo$T z{yl`BZnn14qj>;UV}mJy5&7ZQe)PZ9M&mg@z#@pI%hB9xu!Q}~;ME}<+oG9+3<f**^4AFH(Ov-2U5Hcr{l zB~dJJNubySW#erKZPp{Y0HZ^$Zd}^oM|dfA!*-nTsX=C8bMDF~=FLGF!O!JmzNeoe zL;Nz9?t%15TmLP4Vs7_o=39M*C8om<4AmOwA$VgD>U-TEV2(-ZTwpSo;e zTgJ@#Ppnr3?rE>>m;yqC_oHV<|3&=%m+j8{C-#4N`Q|lD-a9iil5B@R)X3DE?{X=Y zxm?hZRYmKPSCX_1xLlg5C8GX+*?Sk>IC3Oi^sgl5p0knwQO@^c2F8WkcH73-Zo~5Q z+}%Bk1~bW&YF(3BXLD@o1UF=i9Av+sO*I4xmj`CriZ6kn$6Q%vA0Tv(zSSvxSDkjd^6Br30pu+ z4jUTP*`eFHP+K@4GWi-q^e?? zSkKzaNemLlybb#k1Hw!OV>Mvcw7Ap@klkJ63ta&N?*e{7m-b(m^oegUyE`Wpg$m8E zJik;FI&)aFFk?+jcnjTkS&@^Hr4eCq7KTle7Iivt;jmLtkw+>Dm7TCWXCCV7Pp@8I z2X9xxfp=M;i^2VqR;v$^=3%=~NN*iHvlHeAwf%H?EN1&|Vm711i@n);cm*6D;LC2g zeDP)1-^)h}6v$5@MVh6otF+O8i0+=u3y+J;&|JTC7CJLfs6k;aDJlpW7j;6an#F`d zCt#q=;#KI@Tsxf=d8D&Y*$K^c=Ca`HMYI*IQ_=U?We05Xz(oN%q-jaoZezDSgC+!A zs}G{4*fikts3~4CVA|^8b__)iy2MgAZA`61X28t0E9tlHyWLW@u?LsUga`vreBBD+ zTlbwy0v>pNQd98$w30vY?S03F>T*Q4PtT{JA~ST`FQ10aT=S48r8xDVGMJ>1xINbi zfNvp5t9ilPx^3svB9D9;Dm$Uu&eEHiyD~P$t6n#)NPZZ#a%+t;++^lcSMS$f zgK?MdTs2Pb9gA`3`}qmL$S(ni&YYA5&l=816z2^@ixN`OHY0T$HhEQ*G*6uchf!oF z03(kCASyed?~W-E?ZzYqEn0P}r-yC_EKRdBI|HU)Gt0}{P9Cp3?#kV>m;BBT@BS-;pL>xas^^~yD+-a(J67b<8} zV(9bzMEXYTGHl!m#R-fk8ak>vwhvqm*71IIu{D4gz5D5|t8ndl_3F*I``rkQf6}v$ zhzLks%k`>qei;p_p>xF(RP6t_@8m7dEd8FV0gh`mx_W%CL`9}`I`&ICqBG~>>~9hp zla|For|X!LvMfRp(J0R1nse5=_sZB#I>sJJM^tt~r!ld&kVbjGt9y-})(pKL7pw0M zHvt_^Q_Jhng}frsV7r05Hk)Xk^lp0CXYoO;(&F^4`TasR#4r@Ye8tw?La6;fL1C7m zd!``zdU{F|6`6+WqoQ?E^Cn>_X%pz*RWuQ)66g+@Wo=y0BI4Yg%8BiqWbBcXL}e!w zZYn1^`l3@A9dxMuJmssepJeWZuNrQ)v{u!HTN@;zcqm=iYB}tWCU6DnHcVt9;Rfxx zKbyQ}F~wOjBz|6Zt0D5GH_`Q8I_jv^y?3nAzIJS94FLc=s_Swi9pl0H>g zlQJ$#aouWin&l0zv(&BJcAhf!$Wx-S6UvRJ0HsRXTnDaQbRv_;7W8h_^+K6?arwWy z6Uu|AFa8+YV7G=^fng{E3Q-|0v1MM2UWq&m`U`!#yZG3NDb4T1$HmXWU!cn;xgy;y zui@~_KqL>{-p9CyUa-x)Aby1G4HUxcqxZ}(ge#9pxBUTei!tZH%XA5M6)yULB*_yx%D@0<^*g3JR~rwX-! zcCUBhzs=!b)UU&-mgR_}mps}~R69CKRUJ08|)Bj;x^W4|mWI&&PcG-7c^!mt)+Nmx)) zS5ReYtFWltFy`3KV#Xd>OjLHlMx0s9X`8^r5fyQTG$zM7uI-B!Gdw8FkXaO_ zRd>P&-#gae)XVd8e6e4S51qMTaaloh4SMa8l+`6Evn(Zf+(JWEU}kogo5gmHFZRgs zp|TTt>CExXye7J`ZghpCIBx&?HgxGfz1T0ShtAwK&=fdH2@r%s1J0b#CTj^$Imems&)cbpot@Q-J+gYJ?1Zj5 zvwClM3xwZJPaGRSd*WsY>Dj&>(OBR^H!ekn&p+;#;&%!VzBtMs_Rg^aHT2#BEI1g{ zSN_kP(AOnI_EpRC)E7pYB^Lw2hnEtCfzH94Oz&)&n~GhChn;@yi+_({LFS8!>j_JA-@=7n%{aLyPLtEaDN334rUw zPFf{|7I{LdJShNN2iQ8dirG1}*dwQg%1)@*$vHJt0?zo|nru5FIbGMfLu7v)i0l2` z4wUQ~at_6V&}aYG+CIFOk7x#p5geqyFxetW%Qjcu*UU~2_p+B-3qrdkC>udh;uNs}rwZ))9(}!TpooT$Ga8|Mq zX~UsVZq+=={XmhA(WO<~fhfy4lya!h3}x}Fj6>yko-tnXh$L+#Jf@~*;v_3$lIOH; zXq>0*gvXTFS*XM#3x&!~E6d4@bg0C$tpd7Z$W27XsyR{r2_C@v0ry7M?%v4)-F*ep zj(UF+NXjWH`))%eTi1xwxmQqX)-v!}d1 zvMh}?5I3kFVjY0BG0c7oS(_TX-9fdg&bi6g`a-|m4Ii+!indwSN^dyZiEUk&>bM^L z=3!04QlPsreH0I_0U2`A7sJDe73qwg>}knNmO~HKcHI`h6I;X~KvlzeY~XyH%0V}9n( z4r%Z+kJUa%5=mg9S*dfwR8-hy4`Aq;T;$ld`3|2p`2At|=YCBa{_;<2-EH+xdN(o# zC7xx7W(~$=O)orQdu2DlhgNPf(CkGPeRn@rs)|FlYlV+O^mYrywtAQ$iVL6kWH@s7 zOF-(Kq}?~Q9r#C88LtE+KOg+qE4~R3lRLGwJT5WA-aImWAE(9V^Jhbflvr%U8vQC> zSu>&wG#xR*LX5tKvY>5Bi;6^TS&=lUYT+HG1u1gj3ZzXGWqIK?emm`$c%&Us*$Lx! z_e`2Henk4X6~5KYDRcvDVSUEN%`Fs6@7sp1dU*r+2=z^YS$}Z(?c?p0^c8eN<^GtO zzjHj(YjL63t;~T~^X(7ddZ0%tQ`9kUZantJAsev5lPRjVeS>tb{l+z14-N;g<*UW? z1Li$J$~eBzR7Cv_8#q%JBuu>)aZ z!kC~LpYG16;Sc+z86zBS#$JWinm%?5W565Xvzy6yrL;#y`Fn z%Dap-McL|GSj|xbyoNu#x>bk=_$>>*iY2Oda(hq3-l>2LP?^5y53Vq#jksx7I1HQ&sh-we&RY1^40Yq=JC;VZ1(U0*V*{59B*luA)#XTaIyj*?4*9;k<>?JC-x<0QXeR^NA_%4KfhkzJ~qSNG`St2!^>8%M+w33~}k z1#vp4$yGeqqjktr{F&z=Z#80D8)^T6BhB0@4E3zoLFAy~K7T3pq3a=SI+R6NAGsQ1 z#3NA#;Cxp{60gW6io6x%TDP}pj$Yi*iB$(k21ibOM`N_ddZ%KMGK%xK*lc&=nI0sw zxDKfpK40^ihr;KPh-U0~ZKCH;TcS@56_dIb+Z;4?)SJ0V;s9B|wR%NQhPc44a!~{x z)`Q7jkT7Jgw`L987nevNy)#{!?AP)M4lM~UwRUi1D?A6JfeOvo3Ozs?AE(9Vdt*am zC85@jizOFdv)Kio$XJz(?Sa@ED9W7WVOx>BsdAE1RswAZBVpRaby77|nL8VzMu`m; zNj$(JsO-cZ=md)#bZb_w*{~^2Zh+X>5I7QFPrnU@Z$n)#6xJCjJb#Ce=eMZIlR-QvJRaLt|=iqzL zekR@lgH34wbSqRWzqz{!#65T?-u1RyFPcF1>l?ok)XGmUK}SVq*tiEm<>R#Yd>iM# zua{yjsM%jM#AFplGv7X~IU4`Lp1;kbO!k)HSyqy?trAkjDX>c?Q540j7Pm0Bh1)op z!~-XT%1&4~E@sSk4|wkCN{J7qp<$-ZL3Ua!XdN4i-+ zA+@z*>K)2z@p-A5it9LzjHszF&VzIocrRT!dnZG-l5@aBsL+hf#G}6d4}K%aw2|=Ju+>hm=`UCj$7d&B;n9zs1hzh)UZ5u6VoR)2rBUaL7}n}`-hWOT#P`j!MT$QFjH&Yp7a3b?%ut(ns#HWra{5yPgbJI>1-^{)2aHJO_ zb^_zV!%`Q0@L>h5K=_tyfUa6D=~=z5E)Ik35h7(nL|fh&k8L>57bHYwXRcoPHG4Uz zpr+0D8tT~f7~;-o=c_sy_fZjL?Y|tn<8h%2xR`VRW#34)Ly5LUJ(P3k9Z;be+lp7K z*GcjJw0j6jE>C%$R}F=xD$p;z1m==BCW+Yf%es!@By?w~QXBM^dVt+K_HXpU;rM_3;mz0J^7WGTJv4|^I}&-* zJ&5~I0QCCeU0n^#rI;UYuyGv z?^deQ?LD}~;2$gjnW6hhXQovdmQffImZw6E z+5-5hvYbS`3G*;)^CEL!S5h16mU>{_P}ylUI=PiDDlzyEGwEoB2`gEgjY$*I8TZ!bt7C- z8{v|AAY4${X>D@zue-EqqQULOtK|>+)Ca$;F6`!`l3!`L9Q`6OM?d66)z2d%wD6S> z4Z>!3Xwdo4h}4f@0G&B1;v_DG%Cu$Gg7ZvC6$)QEsgtyBi>lw_0lM z!zUU1*@C|=J8SL46$zn9Mwje73D3_&r+#z+=*($IlQ?T)QZykaX~lC==By-5TqJeM znmDQ_PC`2aoO)z{QQ2Qy48CvOlOpN)q zq9lrvvMzbvx(lUKJI9!MD}w(a(q-`P@)uYp7Gs6GC~* zNmN&LR#l9L6YfoBhxap&@IER#sRyoE9gWjbv7bz=4~S+Ks~yC5;3#?C8vXL8*KfXF z4Jb&RA(zNMbxer^a`oziyW|~R2ks}MBGZbL`4zmQGZ$G%>zLLgOe%5G(43JfV+Co- zDyFQC!eUC1>>zXI5oAVXrxnRDt9wI1CG8F6^*!Cb`|=Ic1@fk@)(7Z#uI&XCnxPeb zv14>*;lR>17spIP(^TA^(wxwY$0UvuYVwC}t*~RqnMdpxm7Ug#lViuIgmOz|SWlK- zLJp8))RE{YP8~Qu@SFJse$ko30uoSBLE0z-9Y`plNnVk-j4NL7B+4THG+9<`>~bXRec&N0dfF zi=u?2c^H$j6b@`Gb{&Y@wP_r=RmqO|2bp82H}ebjqBHZfPNGKK zg=3zGeTlUZDTS9pswSZ{qj6Ej?r=$F2YWM*U@s~=txS$t5hcPT&Q5h}Xv9dB@fbs> z?lEztxzS}f?m_2AZ8N{9EjlwTc+B%g+@&ix+FF_tTE;cW;)sQHlhkqOPIG5=)Hd^o z+M=@4Ds*z#7M1v5uuQ={r%Q1!mW##?q;sOKsL%`@@Qb>lGe>ce@sw7isB>^?8US21 zjAWcgB`d2cJ8bcIr~`J?HS>tNqO#LE;Ouf}3RazG6F&Fg?#Ror;(}03(D(fot4z|$ zIU>q)dbdDSWQOYa#bwc%lZ;kTlR*T9<>CaYYH|y@HUZ@41#QupYZlWo&l(bzNk-B%DoI^KF(PZL zNI1MzowRNxvV*p{N6;3PomL`e(AKF$nB+4hI>vFkI6@47sLJUuU{qv=uK0y=(V5$X z#cjk>A`YQcY&gK^p3#i(7>M1Qyp1b&C^xr5xw%Iu7nPmX6?eBhm#$!v8cOx20ZR3! zLnsvrqoQ&L8dxzFuhraClPDvFp5ha#g$vZ?9g%U5jsX?rxnZ@I(93VD|UQT zLB=35T(hi>l4nd^V|ZmmI+Z6jJCr70D}Yoj;h%$c_lp4&FBb63Y(gNC6=MgwuZ5&uGy|M|Ez%O)6Z zfu*bp9?6m$s!|H9?&oz1*Tt4%R1BQ9pMFCcFpL>D9o63kSfRzaCS`IY*Jd~#Z*cm; zBTRqZ#j+?ve8tuc!oJ(#X+%Dl9Jd)v;$^qVDzB@C2L(GMaCD*_qYRNj!#cvs4IvP; z)rqv>v(Ef7J_ewFZCq{DIVzvT>IcS6??u>${F+mOWrVJPiOAs2mlkBPwgcy|6pRej|~baArmebyXWLb@m3d z-zF(AAdFKr^1chS{g~{Jej`RL!tdDlBM8~#K>5Rb(>Won+04(k2MQ4zvdTtV?VNFg z0ru_l+Y!=i`bGk|8mvP`!DwGiwB(W~@>m3kwei^N<@HC-26xaVX(-^)mbt9{4ubfn ziy~~fdA}(Gzsq*+L-pg4U?~L?{ygfsSJz|ol8g$gqImbNf$BVZ!|KgZ>n7Uk^#-}R zl;<^^Skp{!Bhucyi|q8#+^Xh`_0GZ^6Gw_{_|a>(!P~!Z{Z!g<&abqg;&Mm43KDL5 zK=KJhCw%-=dkmoG#kutEcPve8yk*93|XxTMzQk#?P#9_2VL zMI*?hZ~<=ph+Qd=c<(Aa@WBK77${dBcx2;{ifhvSaJC-spIIu;Qbcx>tfw*(NuA9L z`;jO9^Lny7mHRXDqsZE?`17?Ljq#9iF!`16FOR%g2g_jNG_{Rjuz6aF0S8=mTSR$Ch^uS{Rg7eY zny&k+m0UTQk*#`BrxnFCJTI=gyXgR+VYk4;iyk6+t^NYzC^w*Hgs5^fm4I zUsroHQNq$es4Ji%42o56{xB0sY!!l>!RcdXNdkb>mh?{MHJ^2$juas~DNKYil!BE# zAMKlbI=i$WOD&qWT4fcwr=N5$bX*=QoOR=b=MPgKXU3s2i_{FS?lksqo5;6^7DmRw zpPh2~iTxJelO~o*%$6E~J~>bqU1$6Cs6(A_Bu?EGW!;vr^Q(?Q2N-Nm91mWj=DEs2 zRbkX7=rM878Ub(?a&nK!)UL)9yD1G3nM$L}It4H{LZO|60mEqp4-6k_1s8Km(6vE1 zVVd-K6i7JgAz%>_$8OPmcmIVUTPC;hhFeJwKx+r$z??szHGbkZ(-}7KY<@I^vDj%p zSY`pd_<^|Sh!eR`X?|e1+r0Wm1XX7;)m&>7oN%k*~#w9i@k7go4aEEaw9j@$l zX!LX=Sf4d57xM!#Wc6@QnT*AxMfgIpvWBD;=9&R&o!W+mU=~_E zQaEpr7s=R)H>+*DP$(U+3fxX*1^K&n2=ul!6ZZ+o#nYAo-mjv1$1bNjkiAkIAAMDr ziT+nM0StP2{y(2|eHU}}IWF3R08#QtsqwVcx&aajt#}Q*v_#VLm?jLj;+EUdN5D&J zM}%8}XUAGQ(E*(f*bX+^sS@d+h2h_rP)@(2>+wUsfN%8F_4)qAX;;d~N?O{>JJB(8 zNrnQm1}8j=DfsQ<%$r~8xw={Z{e%e<>dCyeBR(B6(ogf|os7Cpo0w~v;w zi}|Q|l2j6kWi)JCbkuB`3dk88>ac5OMm9MEUp*jd1(g{Ymt^8}`+=(9vR$I-3`k(| zk7)}ZAky1da?=(nEEoM?ADgbzrl*h(m#WVgYluuF|6k9nA7!7m~Es`Vnt7PJAw~^=9O)2<~d%#Dm=$F zV~6e5RnRcL%QKdBzGmg#aO7ROOOR!^R#&tf28&M3XiWY6IdDy~uTphNdWndAD z>%8&z^YI1vrijb_$X}ql^ePzXa1({jp1nAw>1>a5VReypdQebS7Q)t3wGQGzm+3u; zfu3Wlg}aITLRJw?OolBmyRBZCK1q58GB7(b2V&$EO|f~W@@^@Zw6^!g>qdmm20tR!A;U5y_v>}LFx%pE=dJB z+Y4zvlY9U0HKV`Y9<6JZz=bdA?xUDJ`@$tjRp%Wr+Sc?zxwq;tAa=s{`0WnN{z|%Q zx?KDxKM-gqgxJ|uLd%tMG!V@Mf;!lsGdw<#7r_VCcSH-drWN0NqL=)bbO0Ma-3(JQ z5V+NEo$@8OVqM)0jvMy&iJJs3Zin;@q{^*$$Ye*l@DW2u01W8)sX}l;iE>He^mmh1 zr-5CkISip;%5pkYHr_$~gCqb>cD>=Prk1#Ia|#s-eXG6aE1ip<66)gO2X&IaF%w^+ z>^a}&fysT`ENY*cjkbP0lDjnrIy!~sTxN1|4iwQvwq`te72#wycdi##9S1EKZ8rOfW!siobsl_-V6`C*IWbz(Pw#KLW7b| z*dWZbr?6$-I~3JBrU$di-m{v%jq!)xUz0C_OE4(sDBtmgDQ5K4?;Pyx(Y>)k_j6;# zsJ?2UPAAKubwr^BkMbjUQ6q94K%h*4h#p8BRe+N?F!CRJN%HDZBW?ysWOLEeUTGcJ zRp(VI_5K}Pl(3^CP`GjB{cA3ap&kmr*CL&njN3J2=s4!JgCGJ%hTzx#S%IL zCKWWJeDqYGtKD4db}?Sy<(QnAUK?`j(4;4DLqvJ%P6_ne7UN_tIJJl-cNR(+FyTX5 z8bX}wa~_XZ%E#6|jnDi!Ow(#r!+~Qy^bGv@XEmGm^XK;77ZTG%MPM(y3n;b1H(!4~ z_?79$dt!-P6VF!g;FYBn4Ks%wjr#Wcc)|F|cI~HJQS8U1iPB;C&eN1dY6 zCO{ez0Nul}{o)gEKv^?zP)Z>d zOGMtI_f*m=rdwx>wUUFr4>B%Bo6h*7gcMmZ9y{g6U-T6)Eo-mjSZ@=lBeI{u1mmgu zyB2*DseQq#Gz`0D8$GQUh1WhkP}SANoFHpdkC=Du2Hl%>Zl8VT!`gL0CLc$bTI)ox?0;4})uHQ{L!dbG>>65iDlfYa=W(8f9jObw$_cqjbP`|m zZ#XXGZ4sEJmgF2Nbl_wHrt6gIJ|CIDS9!=5UvI3V1wlwdXE)~7m{kPur~M-)nOp_9 zAbD7U)bhCk1YLs$%M$7fvVfGA{2n$bj0d=-5xF1%M~sBBp{D?4#|^hNRgmT!cz-Tx zg*QDz>=M|batm{ZwXrHqbZ7vR-|HwpRDkyfNmJHTAMfXy-yGQ6*jhn3{@G~VUm*29>Wd%nAd052EPswokWm_ z4A@M0*^40dgTS@MD#_lbSm#xUg{7$WYgd|r&%WIF7<^_h)@%m^2J?`6=MmmQj?8v9 z!Q}QIv__Fgs+YMZy{4eS$>?Tys5&TNAISm?uZW4hDD%dD>FK-;ZG>tc1h?&|QqDsN z{-h1%24V;Wo3C~fYJ+936{SLf&F7=5iv7+x0V9eE$se$#;m|I66pRFX6^aAGyF3=Q z^dVX9zMkW2@(c_G`m2c2VnoDeg`$mn-i|nC>+HE&A!5k9Mf(m&3VWQRs{1!ZIM8y4 zUZpVpR*tmoE}}K(qpBTql&FYBLdJ23vc+BLGhqISGe`)8zpy#gX6B?PtKf~QJ#+yr zvD>=Z&D(||#SM6|cC2=K(^%acQXLl#-1@z8GkEgbM}ZI%DRn1Td>^yz-ZIbtGn3xy zwLz#}@IdhhbMaGCf8uao{4*uFVHP}gg|y(v{an!Oj+vGpvNZrewKEpjh2d!!a}ipx zaoi0S6ZHc~QbJ?$$sKj-;B~2g`OyOM33T2u!W>{#Jfy!aMIunY*qlA9lf#AzCLSPW zFUQgaIsp$Jt$)yYi0xmNGeJ~gmw6BhqQQ+L~%U4-BM#8Y%-)faB{Yy z+(=T`Z)249>kp;YXW0Y_BJYeHxmY8b{+Gy>k$5v=E>owbn!8q=h%ML0&^*q!5G$__ z+;6IFV6;d?d=!c9#+IZi=@?}zCIc-4yyHE z6?rt)g{uTDiE*`Tx`C{io&PSbOP1o|+7bx*qs?=ow?Lol$;V_*ukFazt|q)t@ah3fpvuYf>j>Z#9(sp%I!gCC$i))r_5)W_6G6pBL9c_B%Pr-dX3 zf;a|e>e{#riXOe-fZFGuYd?6F6@uzxQ?^j2;`X7U08=AA+heiuC#6WZq0 z;BY$&7(UYqB`O&l4z?x^=KW(Vl%O=V4LLZh#EfSJHRFi;8D2~VeTVyfW^0%Rd?<1h@m6= z5Z=Rim}c(FvB_hxsz3bB0eST5st9iR8&wEzd) z&yZJl(W`D#td>_Rf0qo;*%|s|$BR*Z_L((!U!l9%^g30I7}Uovd7Ea3YkeC_gItUW9Tz~CyR9=piY(sqr>{J2r7siR&~2X@$4n;f?>7J6i z(d4D;euM7PB28k#c)6%QjKr(FF0ClcP;?`h)`c^HyFXfsP1C#jZfuS^64_R7RBytO z+wg3)Fh>R4zRsi)lNPO#ioAwgBb$*tyT~J|eh$g$BpJZqWphJ&D6>IRI;x41MgMk0 zok|RGm>wu7Zz$*MjKbGW$_4?<@-ASO#kkupMxxR;;`^$gte;V&P&)EaB|?9P zq)nSXERm{&d+QIMx`uV{JXvRh<3{9~Ij$7!1ZL#<{G4%H17>Ld{SFi`Lvrfqjsrmw z;Hr2^_$b;T(A4WuC$8EpHUUh<^(tM-66F8@Pf^#Re5I-y^=t*UOu(4)K*uM4v@b<3 zx{Qotl@mxl%s&ig6by!W{VA$$S-~r`pKi1Vkqf0i;aecO$7dHzVvib zE6vnuF06``J}+G;2f!<&rY>NzDGZU|&QuiPjn?)kQUX*Q>@H3{9ZN`4y}zs57aozY z>Hj~;WsmA%iu7l}-2&;4)@Uq$z)qF>Rguhtjrnd!$-YAvm3hBx zHi3=VPE6?mX_ojwYLlpi{Cb#KC!ORZYu%p*Q7pMdHZt0aq+-`3vAv)LBMW-k*h+Fh z$YldCUUmAcPmxuyUD4_=UCs_9AwjKTJq%T`-EQt!ah{tM{~TmIER{|*|HD!eb8fFk z0AhXeE9#T?TfluNAYoNqV;lqUYbn@ht(M}r7-;K$D5Ici+KA|E?&)M6TBEb2hPfIO zqHYJ;%A+QD)YiEFdH#%u-F^8Am(3CX%n%!1Lik?9hyY<`G~!YJ?LOLNrR0-p2%;#W zeh4a3Lr8z)BW0e*q_S?Hs&;BQ5^X-p$^{)Vqofb+{llU2=y0KJ8VktP53Sbjnw ze3=LlD5oHX{AjEe{}+m?E0Tux>MNIKzEY8C*|7?x19bUVIIayp(5wAV{tvF0Xn{|x z<=t4*YU?N*{_}X+KC6Y4+I^N||9&eF|7e(MU2FKU99~^PIZXy{qJksV29KA|Fj{K% zEMNjTFk-XH^@c+6-E8VquF(!)eaO?8Cx;Stpw+r>Qe>A6^?>F`lqz{~>%OWD&oIj? z(OEtR@J*wbXx_Jn1_WVjTr|o!z23EzR?{E$d1kqWKr`E*yXo>tfQ2jGvs$r6y8JAs zHlaQ@X;_`~$fSsKCbh-kB%_y>FRw@Dkck9KfVN7O z%i;~UZ8)Kfa$JMX{Kab&73rfU%Ua&~z@xc&i#veAXzdWdf>-YF>!XNe-7O zxl5m+l-G>~{TBnv099wg;_GA_pNX8b6rPi1)Dl@yOhtgG5t_V-BEn1l^+6iSD zU`T~&iACa3{X!T$^Lj`j^C!Dbi%PFUOHF_C>S`0B!SkbAIl?ZOF9;4XeBRz4DirK% zAksee?)=jdoIN;jS+;VST7yzZY2SNmdfj4M-G3hmT(?#B`wvY_KD5NPFdhzkgI^2J zCL?@50_o)kdcIRBj6T^}JFVLD-|Rianu*kc9vv330fy|>nJ^C+G6k*79$2%SHuMH^ ziF7tw)S%K9hFIDmpR;(wK2wA3$tU2)yhgkhnA!&ggqVo1d%l|sQ$S`=??YSCZjmqy z_6A$}(CqKiYObj)^jqjcMmtOq5MI)*A<-%CpqC=6gHFI}dSfGkpv-j{D>Q#n=72nm zHy@6)86=$w=)UuHd#4Igw;G4L$@Z%kNYmlHyr)0j*3ylr&kL6=9bK}Qv&f?aBS7bI z;i(fFi7LnLnHa2)o8;vexh8F!_yt&_Cge+-SXnRCt@#M)Joi@}3h%jN$3&52|jt|+G8CXOjyQDMk z((3|_Q{99bzWeo0e=@LO)mJ)CH9C&w8SIzQq)BsUmK4`*+~wzD`}aINh`Yy5TVD5h z6n~@{su8RUK>sMQeZ#nueYVimgqea$HSkf8PheTOCyBWZ!KQG3I1L#Y;oiTcJL$Uh z$DNpt>s5u^BAZs^13MB+K=F4nQznLEoCbn0o3bTF$MDXlHa{voF$dE^I%z+zNIUP5 zQW*NBU5;HXI>uvDTqG-xSRBW3%wUm9;j-k{0KG(NNt5IpDlM{U?b%u4hyJUoIVo8L z>^N`N;zcDULWY<41s~c5@JRBW#G_im(-J`&YQ#wWWf-FJa0bzK@n5BB?OZlIazLa9 zohuP0`onF{>#5tehOnynR<+#v7*R`So69OOJ#L=%0G4$w@r6$#*|c%1tux2X3{;pT%}q z)C7<=h(L|8MJJ}IY)Q*g&;)WOKv$yaArX{zIwY4_9b+a$+mfXa1!{{%}hM z+zv-mSTqa~kAQl*8{{ph=ePr20r5?@l@fVWQ6HuJP^0>o-+@o)h z@j6k5`DbT6jEI@zDe80kdYO-2NbnVaDW`!Yq!s-h&mvRHNpZ~)f>^N1j?aFG<#YNj zt=!ZE^~eGO6IR zn{Sa=rv7xfD(q9h)S$tkNV=ugWN6lL43f@!Cm0)+yM6fp&x2_WDHm~8rzNN)eA$A< zF137X_E+Ea8`2WME`WV7ynju_gBd?BWPF>2Xl0P3tg-on9AWN4mg(01wA zqWfLSx%O1=+PVqLW|iet#o1To05+%rWJY&u8;%~c)8{j@2Kla+HDpY%mqn*)r^#3I z^>rSYd7d9@4_$h_s{=yA(nT&xU>Kqhll~J}osOdENvn2Q^C_hw+JnYewSp|sC9&Dl<0)S}Ij4kJevs5~J9fMM$9!VVI)bBKGdrnCWCdvDP@{Mm z=)I%tQyY_tOXUMix0eE954JA9>}R%$M7pc>#z)r@Qs@IgGDWbsgqx2n&ZFJXSu$c!>-6q+xdf|bxN0Fh%GJ*Hw>u!%0d?wr93_yzR)<8Qu|G#cgm zoi>-(xklfd5dv}Ruf{$Qt|jAAngr@lJ6;zU#a|dpEe~i8rfMisa z57>p8H~)ea!37&Dw_mg45AUi;YCxc*DtJ{m^fpcE2INsGhmep$794Si zAk+>C^%UqDS8<70<@M$C$=nzz}9|<8s5L>pM9Oq>Bg4qCMp!wul*$k2ejHa?`#_r@QWnOmE zqsC@?G9a$G>O#wf5uvAB+^YzxmLc13M!bN(@d*^HjxJK7;MgvLhn{d(8l($W&D6QE zv5`3RzxofHv_ohfz;757$BK+lWxO}}&FbLwohN5rp;&_;4%{j@_l4>=U>{!XHmz1P zUQ3yOG;`R%Vz|Ct>gf@()>tREF^>$S3E_pd^W4WI-+)sw?lB9U&#V=K_=d-1e!l^w zj7FXS<*u1_LLY+VZy89Qvz1Az&)54G46IK%BS~=lCA}B4{|~z1LF{6_BFJBW74uxQ zF@Nz>Bh+==i>Kq+@=jxM+F{Rg4;yPEBB7P%1e-T~{sNJfGxdUJ0Hd2N6zHH|eThV* zT{_u^MCSlHvu-U@agO#6J1<7%PZ}(>XM7wICl_m!ASXmJ?^cq156MJ1Z0qD7gF%J* zv~NcG)*IE#JTstj{^v!<&h0{AA29P;IBs*O48m(ByD!AAxpHnvWP`^ubSF|epl(8k z9srR+o{_~5H4p~uT@?B6>{o*hBQK5B9tM^^)>jN3hBtpV`Tamk9_xr$Qj#lnA{C5D z0!Je;dP!Cg@(iG5BKJ91H8R{HO7MyS0MQEYRY;m6QFbOOxZwxepkqrCW|XZRL|g;3 z$$FA_eh#r!CNL015@0{O@)zz4fB)nma_6}vN`jchu5S-2y8WUUMeK7G*`u%FWT61Y zB(tO^|JJe(;-EE0i!lzKvv7P*v_R#NR3c0sHkXg&GFH<~pa>8tH^QbSWvG5+tF|0+ zS5`yCcEqhg@z_-ZoabczPeiVdhk=L#Piy=d5CeF*T{yy#N zL3ArQe{?rmt6PoYz`?!Wtv1?rtw@}4eo8sC?y>!p-=W4gY(yqJ86!~4ZhnHZoF}U9 z4@N}sgm7TlZDwNlsj`>bQYlutwz`qL$*&gLp>XY`T*>^+MnrXxaA3)G6yBQ*vl7^{K%IoGLt(J_ty-Ir zH-dHx^RC#DqKCR)28ZI+1x@=-BuXz4_(;-6kS!ydHfSKyTx=+A`R7FhrjS;pP`&>!DCh2oWmJJr4;R0>~F_}m-fJ>}J#S$AU5BT=TEa)h$(!`32 z!e2Ginz<{eWu*UHsn}3Hn8ca_SaL?7&XRc5?C}3cv-}i(0R3TKb@ye^nm6M$_Wfzt zu@L>a#9j-?ZH@4;xHj)Xwsn=z3GS20yx}7=pgNexJ<}W!1ju&!UoM4Hv9RSB#`{pq zJX5yE!sxjMqZERe_g7e8!uBvkX3IwuuU3OI6Zrx^bTwiIJKH`B#U#W^xZNkIW2WIx zJaz#+LSGYZEeVG-^^p{8QF*vVjE-28EB;R$M@HC_Vm#nd?cq!5?wNhlen;NkO)1+LiU z(9SGskv|R5YoMwC8Mvy|4txdr?iqK6+S2+7t_0=2^i)X3yN4>yI&>Mi27zl4QO^7({=-pZ=<| zFt7rFtP37*-kW82H>_rPMcpcvc#$Xq)@fv6Yh+(K=;hgP?Q#qJ>u3weXm62d=AZ6x zxIke$5W1baQ$T7uTOj_CWd^Zag$}Gmq2G5pSM}wnaqN8y<-R+rPkjsRwioC!?Sig+g-Q6DeRet> z9-Z`2zV)R};I8SaA{z7aMC`y;;3`_VoL&gawnG@2q_zw7B?k#gD?>8pJcVcOHnB5v zNPMB)2D{)_HAZ)z_lAJvw6}CX@;0aYeuH4L8U%N`pDuunb!o7j8TF^9w)pZ zD4sdV)Gq%sDqX&4SIUN0RsAcNdGjJWYr`Nh`Vi28A8gDP<7(FL+FO^H6^j)1g#>as z30=`2a-YT~rX&WSX>5l}6Pi`n9Nuv+}Qc<{JaJpTZ zje$?A<>nT`O0Oh5;S0pP0*QnlX7_XHGQ;zgyXgLvAjmCu2}w$539b2Z)6}6w0XhPg zvObsbV*vfhSz2 zA;A|&)TJYK3FmYfFC=b8sd{Kr?4{~LB5y^)(B2fY52OiDJVP$I8VMkf#tM?MEPGge zvo(+Kd5#{0L$K9Z5a5Wx>Hl=V>+L|=`x-C?2iOG2>}Zpbv!>vDT?Es?2MA7MzVWNt z&JOkT#cfQ*7*Olao+#2R7-_po;uz!&mHDl0pQY;qAiN_F)4u|MehcZS1cFR2LJvl4 z0{tWRePsdPgtW2-^lVl!dOminBtUIpE+#iHx<<<%a~0)!8DA%E*5h<%SbvPNAv%5S z>=%j9%;oUSHw?Nf;6eNP^I^ax1ouh`c-n9P`V};M*;Pad7Sq8q4mD6?1dUvIW zEtZ%#3%Rs~sGnOYDbSI}5xrSupibiVe^l9QZX1ZOYr}%T>(0R1u^z8vrMo}31`XjE zuMb_X?PfV@`DVH}&VN0A0XXv}pZDdblYEos86(7HhJ{i(;!MU5s!Oga;}+OhyMow#_3fMB z#Eq_}(Q$A;?tyel8Paw_S~V*o9o1e5e`52FI9n09Tc4nc=#GM?+lbdud7wN(waZM; zbbrU&17NSg=~{cJ;HNwk)~HF+uO~nxFhR305nN3c&%NomVx6)-3aO%iElz|H+Z7Tp&k^B4%urKS`^s_BpGb!lu7$2) zrYZsNEFp=?i<#b3?XMATo+wm@fUz)it*{cb8IkLt`JMUg6E( z`i=kqQ^dBeiHIjzyX$&60!I)(ki7F-nLc{99VB12sj4Qkcb^@XVR+Hg1dVOpM6{hS zcvX4uj5Dg&1=|2GBHFv8TjKo8L$6g06qhUXkYaS{pL7#zmf6+dvDVBcZVd52^dDyB z`|;GzJN4_|#`A>@r__HhI@VKDbO_N(_@Z})LCth$TGuUr)p4rly6brpo`n1u#ri>2@R zXg3YV2B(k63EKDoMI@zgM|3Q2{3_nM+g$0ykodK%=j|BwDvk?IaFr6|Me#+mNTu96 zQDnZIBN2|68=>jvK}W1;o8(7o)dX{3XNYQ>aos9ZQ@pQXpGKYZ6AfBJO2pi^8W&u7 zk0fN*0ghI^8Bbwm?F>_W*`snGsDI==X%6~kAR5^yr)NK5^UtI2kyZ+s@7YT!Wk?9R zPMYS@zp-Q)y39%|l@g{POoF#>*ihRjS6bHk-+$`jrss{!&gE`7#dM#};fcr$cfCot zuXbz~hso-SBD?+-@Xm8{>jGvb<}iNX3otWXq*Z6n-M&IU#4Uw)8)s1#Qp3_FPLLY! z=%Sf*wlJQ^O3IfiiNe)8IYJgGNuUCR{X5P#hukHd;4Desw-9320zn$S>N8G571 zWcI(2amnHsu|-W6F@()hcY_cnsHZfB2d`qi&&>&5D+A6y?W=+^&AX_!*F&g}eMdF9 z?-duj7INOS$O$WYI`F$IazOuUf?k#r)Q0{iA^qZOs7U}W9G?t% z7ah(3w&5Mx78Fk8E7TH!SqB=C(MHj3fGa19ERXikLPLE~!1alD?`2e63%^1`<=vEb zH1~9Y3gg8G3S4TEywfBh?RM@8?V>T95Nqd%fe=LJY769H0&@7hFS`Jxqrc4X*LugJ z8P&J$v)YIj`#^186c~>A@}s^o9h>OUcxbSYWmR#QzveTZQLV&qb>|PFpkOiAEBeG& z7nWvO!B^%TNu?wsawI>#EP#PfYk|l#G-7r4_B@GB0@3czfMe`-GFL<_6f2%sd%~Dl zY00t&e-zAg#&%#lGJ2kHn3Qam!NFIyr5H9CB1}f02nDEAGMMWurspiW@lS1#8^lMH zwSvw5{DD-bD&v+_G^_i2_~quvsf+OHEDz8Hw_=_lt-?4?y`5ofkiguZC@3*Wt zv{H*hYcWv@K$H0XyZS@pE9!=vl)Bqn{8EftUKYApaR~)+;l7yDA7St7l6eCe*$UA6 z8I<@e`)zO8`px4-7-IqqE5cJ3FWIqDlfa7G{;d-|F__(b>1S|~4al*el@!R812?+7 ziz~ovFi-E1|F?YD1iOiV<#V=I|7aCV7tW{zRhdc*Q&R(Tpsyo;i#5^_aIr`5hWK^A5Dm9PqxCzISs`a9Z-#b*C zIuNN?s!I4bf?ElhDy-lU4CoMKJ#3bExkGKlJN4`m4hx6Kl(INKxSGT~B%$A>N@X0> zO;KA(hV$XA2fC(HMZYBw!ADrH zBic$zthb^`sB5$Vc$1MFLogR{h|)ayN#@sI1JpE`i3`HPpydDIyGLL;g-)FTLu4qKSJU3?cTIxZfg`4xLMx_b(zUusPzwF5u#o-t`CKQQdB-$c4fS z;#q$U2lxRhWLKEs#zsewv4O3D6s%B;I=#m}tI-FFDOP3m-ngXXekn;9@q}_9_rf66 z4%?NG;(r9QYyj1t-yuNtrzLCL+xPu>g}%r}mm<^sJ15{}-{GU|BBl-X27iFt_0Ee; z`#e-!#6q4#tXaCC)c?M_fP&oCdS39Qg{`ch-f3l_gae2ENw6@#eqr3tcmhFpNTa5Q zWZXZRiE4xv_5<%z1~OlJ&oAsFq0_6cn2XC}lp$Ky(JNIQn=|kXd8Hxwe7P~VP6f@8 z_M6oGW1B}hM3exJIzbq!6f2d6>jNBztg3HMJ~`c ztc0vwJNJyT3)&~ZJd~+8O=&Z_3`FP*#tI!%*|5ZRCbjBuibGc{fP9H`7Gg9WIf?RJ zZa1FsMwW@5O4nohy+yK*30o4 zNYoEOUi^J5w?Msd8x^Q^iCnc#1yndpF)N57oaA9a02ovGD>FL)voNyt+fQHhYbYf# z(*aTBv#w{UxoCB1`H{4B(LDD@5HTxJGb0d`wdrkHg@}s2HIq`?Jj1^U;M`|`%HwmC z<;=ePThd@3(QpRKmgId1DlW~FIBFL)1sTNqWLLKdV(@`~1I6lWH<^_&b*Qa({RH7b z|4p2)O|xP~O#G})`nEBg{q6)8qz73exA}!XxW&%Sw-aE$X+Zr~pLzdx3D>KD}&t_C}o4OQmyEWv}KWoN| zu9xk)g=3cp2vyTzjD3kYzv;;gszN2y1dw`Qt0iGEU|Y!rK`|laLswSE_0`(yMbKq{ zQ-(b;Yn&dc4ipDS63rJFF8C&&K_o7!yFwo=tw5D@@*_jR532>LkdTe%(wEZ*%FB*- z@ZwV|P~fI5dH4Z^W`HwTrBe#wKa}Ijk2;)ArU44*9HW*bc-d9C+XfIr;Fz4}xL9jm z^wADNJtm~?4f<6@(DJf-w|Bps)whu50);+uwc>8|Vjox3(cXYc`zt2PC3W|L*EBleSX0!*Sb=wBZFN=8{UZS?!z(WWHW+5dEO$_OOjpm;L*c>< zVj4$;VK4yU2E}I)2TZ0gO0au2gY zbHG{YGs{QRB1vnLQRm+Za4R&>*-=%z4x*2Q&=mo2PgOS(t=%F!q@2Ny9@32P1Ju8I z1H>X^?>HtNH8(+SpLq&>CUBUhq5{)W35CL}j{}TS{N((c1a{-Z!!2TITyDK0+!!!F zhwjH(pHw_*Z~Ym!^4`1&q-I@b-`RxsnP80c-x-p~5Vp+)R^I<`bI13aJ157Rhfy%r$xqyhPv<9u?tgPpC zN%axV(C0gZ0E))xFnLJURgeCj)ZH%YT9F8J3_BT=#^@+-hYg^qhY++K0Xi!RED(m# zHB+8KQ@cn1TJu~4UXSO~dXw>LR%$-?H9zWRV%UrM#@5@XB%zXmdcWj@HfZHj=%ng{ z8ZyMLQy|l`|4j4UPnTBebm^%~E7`01sNMif=Y>_x$UU;2>&FejSO$BLyCYvY28&(W zbjBX(R>R7OJ^}KmbmG6272NF%smK6N8}YceJGVSm4J(urM^UMCRdA^X*;g7f?8HjD zak?7V?Ud{L&q?_hbAmA?fNfV_))yF>=J;M+-u@3A=gP40+EdX_D;!~~ycscxVaYA|@AMk!m zq&{Th$$^!0&mqdTa&AoHQv;*h%Xk0}K5j91kZ5sGgv z&W0C9&Yf0wj}0l8m+LvEah}+QKEu0Oi{4ergiKeOqt-x{MyNqY#tEsx7PK=4EJ{TE z(tUrlx1-}z&0LS3EA59h-!P%OX|1oe-OoKsn93?j%+wRh=z<7CA2cL(6ZkTR)@lm4 z)HoBFRhIBaQ2|AknXT$^r)9xpSKo$T=p^VZ0HCwEwQT=b(clsH>8SWHZ_vEhZQi^N zJ-6TjiR&W7eT&{)l+#)LoURqYi zN9I|i@5G?sm+$4|hT%#c0bDiPp+0Kq0#!q0($xMs|#!4Drtd_iHQWFqx7&Q2ZN^|XR zk1VuF{FND-M#*D;3_u62nN0R_D)V|7c}C(0h)EbU4uRi#B6U}pX{5^T2JVUSOEKa8 z22{tB&dsxp?vZ+godJxtIU-4COE z7gt>RJE2)gdOXcBVMPmc(VZH0tF(U-qREsX56})^Q8@x!0AV4!|0K8$`r6fv%-cFE zBG+j$>O9ON&|CeA4KDYbN6Q_?fqw#rgQU zm5s_{H`h6gE5k}~*C~4R*ES9(UI42HtPl1kMJbMUBv<$u|EN4+R=U;L6jSNXSU31N zb0)E&f&vCfz+sgtq z0g#iiVhDdml3odIxmE)y>1&6E`x#~KgNooW?X*=@i>AvX?vQSMQPZh$#S%U8ECF5# zoKw(6YZi8*QQ)}1(*TE=Jc(LF2yX;DJRn0_JrQ<)tFTPSzY8X_SLCrFUh%&-I@E}3fFRtyv^_8&0wG)kO5)h`W~wjf z*Bw_9Ox{b)e2UJ^vAh1G!=hybCTwVZH2&RX39M;;-r#9FTUp!)Un7Quq@lkP z^q1y~Er^rR)+ZHNO-jmHJI+;G>7y~vWDMeOkK2kWT>GB_&iv$f_$l{Mv42d_f$qF) zh;=|YV~ZU@e;h-%jVXJ~YY2lW}Ub?LDe|@BF)TYptJdHf}mnA!0r7!@zxZB!(?*RWlxuzrAe7b?saBKNm0U4?bHTN{G}T z;nTbm_f4GZmO+2G2nOrnV|jE%(uX8#!x6_75?~BPeyOcV^<=y{3ML^p#iSW@r{0;C z*(j*4el}?Q8#w9{N{w~osIC656^p{Cx_pp^3c;9<-Xy2d2)DgqtPS2_>=zKgsdmuk zB<-HN>qpcUi6^b#9&<;%OEVg7I+SxXe%FR&(trAJHD_8v=+I{p{dCfZprKMW=w}Qi z{}&(!yGSV}i<+R?cTGOr#7~*Fr4zpP7Xvg68b_Fq8k=RAH6`5S_T!Da^3xE%9JC8s zOuN&nQk9UwC1R|8$tX8R-;OA&7aN!S-iN+k-wXjiB&Y>aeU420b6DlMZ1vS2v}2hv z;K{&n_~OvGsM{c6_b;(_RtUJ)l)5S5HidM(yw9TKE6o2)dQNK{$$wwJ9O5g$^7lPGET_&Jd7go!WHoz zXnL0>5JMmglG_uB*r{6yB;#@Rm4+#S34u_cnXx$#(zCPh-KE;gnCI(<&JSVQN+@8g z%U$PEhy2|_jtR@{{+`Rkl@e!B zjHZz0!ac_rYKDZJ-S#Gg?jeC6EFf4V++?`^#U1Prpf{UuzF6H>x18&axuU)NToUYr zhQmNPDjA~3F<66v-wp+XbGvHbN5>RYX$XlCplww%$~@tg1aKRMzt2V}{HL?bJdlgY zDfv*_Q-}BK71_1K&!ZaHOdJ=2u0?I^K#`mffk0?@y|HEnh={aL1MoY2KhCH2th};_ z3_CCj+1`}OY?sU6Oix*eUMqRg3(QvcZ%N<1N`z_lJW}*!Ov+ z*|&?!sa5ZDqeov7{k6Ou%Lf(F;m%&e{}QcM2X@X`!Y>bzYF(epNOO-}6r*xP{1Vsm zjZJ!;#13`OSfntFML{b0E(%R+i$Y9irPHl};gDmNdRO5v+B#4%6uA_y3dN)b=B6nok9MfHw+ZahQlkd-PAs8q~WW0Ai@ zn2nTYZ^nQd3!!%qE#%XLyo5PG2WK-0ntnIN{GcUKOv0&bRMs#v`6VRJ&Dt`t&3{&T zV{=ogDvDGB-7kWBPH{2w>fh!oAp%F}`PNufUyPD69l=Fxm8q&%NiKdxlqZ;J4$KM2!VimoPl9*mdq+VKRJCq37eGJkX7mk zb;TXxCfDhxN|K63xEU6g-5Dw-HYZ`pjc`ao|2%*vP4ElQ`fx*+n_tYgE zH8N?qja0&7EpBF~I^WJKTBCs-ilhYwQQ z$B-mmF(t1jLv6&Cc@^IlkzZB5q_+CVJ9z_om64&B+$P=Yi0c)xGd38DS^oD}C~Ofg zD!UNdN7A*5LEvxB7xYsNDA)8fv zCc5CQd(bz3Hi2fcuyvny6RQt4zT5panP%&N7+H4nzw5Y>(=TQlG1GI>A1;Z{4u*Hb z#A^cqWTrj0&2dnwCNFz%+`)yU^@|&^WDk?OB*S_xHQEv5Vm%z4B7FERl!o)!__4B- z_EET&o-sSw!Ug|i{`xCmIrNVF68C@<_0|07zI;13Z$(nV{3O>vpD357wm&0PL9B?d zk=H5}@|2RwD`&m~exu0z3UwkZcZHGvZXMi@?I}6ynLzv^s?*%b96PrW(=NN3$FXKa z=67>kDb@`tR*VJE!s(kzBEkBh)N#TzF%C!Eelx9#E_2ebn_?w3E?!WhsW!=q+d>Bx zTUajXH~#q$aJ8KO4&hYxqKX|)f~;y2-xVOH`19U%9Aup*D$|vpmtE1&9JgHaf39{A zcewe_*WJjy6tb1!)Qof1A~={nmR`tUn^BjkXhl#=G)E7iJA&>ch| zDxGR<+1Z^D6wApD>?Q!13OM9Ib*0{YM(cJesr_jO$`$v?zF}mr0=zCMxa_i8vc`l+ zGu^RjqHMQ9b{gi|xkGNLip2izc@;OKY+!*oz#n;5g^Co0fs&KSK+cbL9TLf|0)e)V zDf=nYuX-HHozT$@f093HY>S}Fz028HN?4N4Y}yj1*jt}xAr&!6A5rwk?D*cc8{Ch# zZr{3qdm~H<)02qH^`Khm(Ms8NgM9;zQjS7}L>vl>u5#L|c=z9+o6!}p9SlZkmgTL; z*G2OhAiM`)CWZ!#tB7d!xW?*y$WrM{ghIcC7LC>RHC`5cgIxo2?cZPniG-!+e_2yf zN$8i%p*Q9m2A~!GY*9{B1ZkN~d=+P#F=~|ptHgk$IFFl5jylE4yEn$y>Lzu4jU zljfu^J4kvJwqqVKwP;&^?ZJ9^hag+(K(O1ytv|Id?EcApNQNi>7(^EDgD3;v5OKfL zM)c7e)<2;RfHA6DrTkMP88V4oN7*d@;xv=ayV_;I64$~lxznb0J2Rt??Z1WuhP*gr zwoO?Oh7`g}>?UM}tmO7Xxm1vK9Vc_Uzg}KQoF;Y)n{7p3XWg~87GriG#aXG%1Q=xZ z)@_rhmn&NCkX&DJy81B@rC4zi4sAicx39x4T2Hu!b+lcK)pg*gh`FFNt?uGWy4HN{ zKu*nAZkT6M37Y57BuBP28dd@;+M z&6HD=BW(ockm{BLbE!j}b&{K9*ZC`ocymWtQ{B@l9!6RJzX2y%e@$aF|9JK{$5KN* zVeicU<(u|EJX=v_&OFz`<9hyoIgD}wO8DvzXL|^X# zH0;$#w?h2W+zDz<=WaGVxq;sWFzdnHd*TC$FOnwzt;4?@S&o)^olz=H^REE99#vK* zQ34p|Tb0w4hf)^R#bkhutl^(^SX>s4R%NPk2|&Pq%h`U~a0E4G`k4&>RH{4dbMxmX zml{%d?G6#|QMH5aKYi&MvJq?E`269L%P*(vJ7m9bpSZa!71xgXX1^Z8&1Qd>`r zHx&nmKRQBm=JnGdNaaMVeGwfeOJiW1Ni2Fghf8HhXE$-W7>>0hPI-VCv(o~ox&MNV zh~r*Wm`hQ^&stJ`0TigRQEj6%4tBINM)Gbu3&mOuR2=i+D_2w^dydv+dDM0PszSzF zqvkfPq@&?4Bj9wr9X*%+-t!(?N_G)(0#t~PFkm^F}dVCk7SO1;we%vK!3sPKeX$fSED|s-Nm3Nyy)rtm-K$7%a;PSfQ z9DA)FQph0XeO=#gjJH;8{Kjzi?bz#d+Fsq=z3Oh%zVN@+Ogh9>vb8+!uC-9v4q8}G z@pOy*CrxmW-X?0nxKKT%Q_ya2yti^FA!~_YL2cs+j`8B&ttwm@ta(+9Q#pWR8`e{< zM~HJ+{Mv4#%R!f%pKg|Xvk^{!!+%lr<8{4=xxYXZb!XgkJZJ*-5Z%o1kD^ne6@@JUwj^GbdQh>C;rnSCYlY<3~SHCr>5P0>?4h0#68ew4Ea2?lFT z-c-MwOxgi&XffIvS-%gS(g8!2b-)h{>MY+i8%~M8ZjCFF07)yL!Dzk4t~^QCJ4w;! z`-=USOrhM!&qubM=+E~%0u>6|!F)4(xh}JzVGFZd;UMdE-*onD5KYwIKgmT?;iRnR zmoB9E1Q2|UJWrk8uyUb`FrT@i5rjA_ufDISZu>J)M_`B_d!8u^e3Po`r+exDY_+vc z;*3oM;3)cTYIv!Ly<75NaMTz7OO;|L11Dcf=Q{&{f3XHry}1>>(~?h(Gny#+K)xKT z2rsOWEEKqm=P4I{rgyj5Id4eMOMD_;t*y2Yw@rvbs)to>IoggU*`CIl+R*qMP5Sew zIGh||WFKOdm?~_x_q=Q1LSTOPz=dDF7=EwE=p=RH!a_(wYh=y$?Sv5V(iN!u<Jr>{r&l^h+suGyso`P^5?u(>STuez*Dbt%b$2<^ZCY8OBOv{C48ayJiOGqOhV#43Nv>VJ#YYb2z`;tu_HKW zIE*n+4Hr7jhEuW}&OBFbfc#JC4@^I8bsdJ3JZ}-P#KlQ%i4MA z9#>%NL9nSu zoT?mMfSl}!O7AA!FpzT8fBkG|w~u^nS>F-ZfF2;mWBCQRd*-nHh>LWV{>1S4*EvBG zAx>)zlhFxMqY>U(w<#5+*badJ#nH2(I>f>R3j9pO1gIj8olR>`ty)(}8QiC*uZ5T* zh`fChHE=6O!0*^nJ+Jn7frRP#Jj`^7u5()eL(?7sNjd1c5T$^CozCG84<9_bAA|va zFJ8Y}iJ`do+6CNEw08ts|2L2txJ$7%_GXc#nU*p{cz^NN(FaOsIugwwNEoVIQ}oh} z5o^vX%yr%EgOpUyiPb}pgvi>O0yz4;I{B)v3ODZEyE(k|d{H4+PUI94-B+(hA$Pwd zgNkd`b9Y9kAl4VoFv|h!qz>27pWL+A)$YeHGpMfL%8`J zG{Nb4y@)yXL$FY0tE5k=E&J)TMnFvi zR*SR`&J>0SLlAr>he36{-5bdMQsv}bxht5~o@dUA=6auz(JJ74wYNg4E=Jix>`DS5h$y-`z1&0zh z4w_3<%>)qk!5&C9OR*LjrgQQ>^?M9(LjPSd==xWWQhvH+=XjQ{(J*de({?@*Jgtea zWhopXJ1G`%bh}i3q=96f;ZkzcN?C1+GKY(M;k1&aku{%bT4tb7=F2g)Tcxu0tHoQU z2Hw`up5NX!?1rKC-}h}>hY&83pV&&j5>0vY{a9G63%W)<^lp`2{GXYIBDi`6e>%1# za3Y7GxubD=g+}WJ=JWq1TGGvyblKzIGgF64$W$L(Tt=@V+%vNZ#X1d%Q~YP2)#p*% zc>h;h-m@6<;3L{CRN=-eyg&9g8Kb01Ul^gr_&Z8#{=jLgQ(yK6rb5C8wmz$*@eLHR zK#Yap9wlA@UBb2`$4V`|oE0$!%Mau6Ea@7W*!$&{y{<$`p0ievns>JO>_+(ozc()1 zX8EAiWfNoGb(@~l_H(`0?e7!RSxVmxGDFUsl7=Z~;^*KXQy!tXXkCaTet*Ix`I?13 zKU5X`Z*Jy$ridz9Q}B2-v;ADD*rzFg+`9$#kbFtAV-Z#^hLZuhm_XQM->rV{>&K@F zW&lNwY+dIi?^E2rsj?;i&Y*=dhrTdNTQ{Q4$pN`N?pNkRY5hC{9e%H;y+3V3WrQLN z`*XtWqp+6aCiN;)jYUB3i71cy%rQh6Y@4sQeM@t)*4Af-g7sO71h!dyhQ*C8Yw;}PRz<@YA(Tm#;;ikpmTole(R(aO#f?4k8uP#3wq70yW#qc$cOal><@ZM}y-BtYe+0}@xOVJFc<>aNlI3IxVn8LQ z_EUU`+O(*{DEPKb6%?Zjk<1SuSgJM}&Y0b+PC|Z?{+m@^SrL*MWn`(FC(QSwD!B%WFnIWmwB!lD&yZl#t z`gHf@AjJN6QKf?+j(JOWw}h4L0|-mFD{m0wMa@~c)}W(OLETV`_#~TU zSQlDY(jci3%cf{?XYDEretsR32>jhaQ;vs?OLMngOxtqs(;?0~NFhtSC_vvQxxjU; zB#pJR=!k5wUqFuvh*t?q@VTl9bGq7$EHm z6x$INc{m6alPDY)m zaZL?BdLsDFFmS8y4L9DHxwgn&`VIdcc$z;q42`{up}Q-@@c>*Qhwr#OfK9b6ZK-C1 zn)USJ8A)I9!%gs?n^lS)P8BHJIR0!_Ay1Qlr=sBj{2)3cImE!B{_|t!aRcp^mA{@x z=vldzCRe*BGqO9p$P2BLfChCA>PX?~+t&I1B|Qtu5A-pV2oUuD&10X{giA zO(?e$)>!0x@}|g;P6prvPg47~n~4TseJ243IYQ}s!Sl`60)3iomMkZ68b)CU(&Gec z`#77-7Mxo_;f!CB=vFqex zn}pZQtz!ZY=uJ4vHZrj;Qhi*C_4KDc+u`nOue}9b8yJI$dvF>MEX2eFUO|@4*0LGA zxpb+PSVmH~^tyBr!vqJ`GEttnXO-3Og7Hzjg2q$p$dqyFiC{#i#_0jzK2Ed++S*U) zwk{HHSN#D;ad=r;Hk96v_c4>{jk`? zQ#>u3C7pJaR`%eUQ3@Jki825 z(sW#2Vt-XOGbK}ATSNSlq5+d0Ie4J~?S_$%_ZUoX?F<9Z%L^9BR$7@R&%KIgWi*pcInPIUqrn4^Kw7jW zG+gKsO-ycUD+VfAiM(< za>_XA%?xOI@$*-D9j+tXRD^Q$O|gW_P?k5eG+>`BQd^$UqZwG-+>~E@vsBe_h(?R} z-rmAx^7b)s+fer~GH9mnK2ZOHz6m`6dz*Ft%#7T1jD*@tYX|Xzh-h-f+~*?Pt>}x7 z$GZCJzm4vm%aGn=mW@lzAMnaO4F1T!-8S)AKPs8N`Z!MM1vbOg+AcTEw>vtHa+0uv?Kty6{`>Rc=rBus`u(0CB1$<{PU2(f3SeI>OnU+ z!g{XHJRCPe*4PnHFg01;#MQFF!O!O5-yL%=GBDTUoRITgbzfp~< z20#tEzr%$99zro6mr^P7*yosYTtrzzhh~BI_^>gnIMh03S+qFA2y z4YD^kz+-l6eY&cs7bSAa8AMob4eFGg_W zl~0E*aNDWhQa`_>{5}c0+?g)A}@5Y*q`kN|uXW2q?fN&1f}sR!T8=R9lt{r{-{Av_=Y&0=-=Pb?v#8 zXz{ePWkF+84I6z8*HF{(HAeZ=g`gk`ou~4ywxx8E+rbAf42dNdY+AS!4P&6BJ|(!# zel>^(zCh6UljwQ1v`-#IS1oDoi^c);eCl68+{^%Nks;M8-LwU6l)w>XXuSg*jZR2=3+4#{@1gYR?SqeQzpI!i?xO?m4%7l$DZ^ z+$5bLQ}vSkWw#)ph~$l>g&ygz1s{ma52`tbslr2hd!GolhvRxeA!IiPPyY1>FVF(?i4s5yn?)aSIO`u zpbJ@QSU1L8Ac|*5$21UVZLc$)S?6}+9g4V`h=VZKL&t#wTo&c*kZ;nk%`!41Abm~7~*&+xk!_~>{z zoO>=eABw|d{?KN{XSuQwE2#)cpd~VLHQTVBMpr!bNfX&AZaj5fOOb`)%^19Ix#B(9 zK3CArp}@;&`Ym=1f_Fzbsi3g(Vl4Ob*pzaZ{)_uNRECMP-I!T@^H;k%POWEvP8aky zU)|lerK;(7MwJ=n*AG{+TR>~iLZLTa-|@aXByb!}bawIKFXam2)|4i?SXI!r;md&wfyK--QtHz9*aQgcQ0lgtA?2bzxIADDSYMMCh2 zUEYOP+FR>)e%%&en>=jwFyw`?UAiyeVP8Hmz;hbQ>2AVe!5aDgvziusNFW`q%0ptg zenXVJta}d$daG*if(Y8Xd;0I1z&~nuDL)$idh`P_Bn&b#7{^d*O@7#NTsAb#{Rr{i`^{z6wDl9h$m4>EpI`*nWJ}9(ZtIlWnp&TG-u*Wj zGveo_LxMR98)57FtqRVVi{s)=~hgp~4-GLCU+lHap#>Z;50(ws~|*Z2DOC@+kNi zz?!<&d--j)qF^!U*=9wIQ7W@FM_VQN9Wt5#{&ep9!VF50YdHzUCbU0Cbk>|t=Q(cH z6Z;;bxL!NhQ?=nUC~cv))Ny{$&lYU>k|mD}c2O$tSy{@> zH$n?Gn+)sYj{DwQ;=e9w3{HSBzyfFgkSohF@zWBcM9k8uUsSmQdkGUgbK>|98n2B} zrhCWh^c*rAp6gLIJGoWfY{_4Z=a0oq)+1Ik!ZDI3ELgx8upxj+EW~vk#Z*Kt^WoC4?pwUV$Q}rKrv~mnr zrMEG}yt2^uhy5)d?n;Ah|L2P}ln26GUb0sVnkuE)F_i8E3U5O5)Qo|86Q=`;$@$m6 z!S=3ZWqWI5X^QK7({SiA{RIvLBLDzvf_h$hun5OFXivjaDNq4TYpFgcgvHp;4xlDS zzObN`3o`VSM1)Jt?K|6lLjv5gh6MR}`F~IS+z}^or`9;n5y)@spabuW`YxVxU@)e)mb!)kHde94-=e3lHi*r+jSkwLZ zy3fw?HK+yc`n36xDrf(E$!@m(BiQIUD@YamUX6EvVr0A*A(Smob=05wus*4dO`U_l zZ%P9WSp$0nJjCGT;veI}T|SuKwS$wq>+{!r#2MZa%b7w{+ri`czdci0G&;uk}V36%U&=>H=k2EUM ze@*hx2oaia-24pk4{Sy8-f6<$ z+gI3V{G&v9Sw8!|N}i7h301qN?^h!GB^fPTSj2Qn_p1q5fZGvOUZyPmV*sKIWXtS{3Eg zA*l7Kz<_dr^V;ez(-Ntq^;2cPNb?fUMa(Q9GAAD)-26qjh%^Pf)Mo}IOUsJYbyg`2IEA$nhArXtAltWwD*{)-i!LU@ujAV(q{RI!BZ{@B84eauE zFstYxflL`9*(e+hTOP#u^s#J+&MR!1mru=^1*g_;VyjUAd?B@_RB(Cx;(zjnM2}hg zxL@w{gf;$#N9g##cqVSNZsdN78KbKP@3fc%%!DJZj_QrK^i@taKH|hPlj- zCVg>)eJ%Y_5!n=1VROKsU}2eJr4eRf3Kn`HaHMGhTnDyr|K+Nhl7cabTEZHT+|Ua^ zSxxBPs10vDlQHht5#=q(9vSb0lyn@d2^RB43_+wU4MQaIJ#jt@#lEh6p|e_b#>6r^KoJkx(eJue(7qVBW`GHZpl#Yc5j!5a zRJO;ujb5w!b6*Vhr4_kc8$wgpRZAnedgD|`X7_{qm#`4tEU0ST*-+_JtG`D4Tgt^U}&GeLgvmoBKT z?)p<;`YeI~h|aSe;fZb!6*PBe3k9CJ*x4myI}``VsT*5@5D07GaR3?EALX-e7&Le7oX(-uEg2`kyK1|0HAAje$16V zFT?qkG9*UIY~hKv)Ol4s`NSG5_erdZyq?$Xvy~k@_viElO6mTO%0y9dGPbYv3BsAo zUyAks)3Rkt|A(KJWarY;QRPmPt_JE*V};q2)9IvKOK(sE6%HU9iTLa&_46t6{`8`2 zGA>Q1b&D5DD}^i2&jC1z6zRc3EqysTAlfkms?!P=?G&nOO*TWz0#@ z(E2ao?*CQ@sP&8M9{Gt|#{W}8%<}Kj`SEU8ZX?G2vHXH({7me!)Q;|ayZ%l*#oaoK z@)XsQQlLMLa4%*}4qc0Ct6Lo86Gz;H6``>e2$I7Y_=H0v^t2)!p8;-|9J; zR(l@Pd;Tp3>ReV`~MV^q{ za=|ml98z2o7mT9x9qd!cmJi-v!eJ&KGqK=SqA>QLmE#)^vuyFyoX3{Cq7sir_PTho z>Yg{PkQGu^)IGhq>N*VPZ5xq(QnlV?U%BQkg>=)xm)9D-suUs#hegH53ODn-hej|>SObcC6tkeJ$=qz|<-aS)>^hlZE?U^~D z!2xbL^n2UZN%w$fHV(ZRn{Z{94hP+KFBB{8o&OeB7L323gD^&>9v8bti;q;M6x5dc zU6ewNC{)98CBoA=_Np72&EuNbP|%EJr(%$;Nx`^h_K;etaui)u~MU$MeTh#20H=_Qb%1!xEV^T+<6!h7vNZ_1 zYqVfjWsM-6ZcXH85hr@zNKEzTVNYz~X7VHMQ7S(&L{FG=06w{M0NOiSgWB-mP$`C} z*gyGC$=?jo7TX$7me!A>!UF+<9|D-+z?ddLj+Khkv zRo3%d`+=ohErRjv)8d!K)Wo8oBS(6Ayo^tNxY zATO1icq(khBp+4kO4Z&^O-|#k<#)j)(>n-p5*LOj!L?Ps;GsK`-~ZrWVP7%E#WKqmJ;^MBC_3jN+5?e$FY{CoDQ^Pf(Wx>f#CN> zOfqrH2$iGAUgLij{&3|cnOWeVBY<`!YReWvH!|5bYWXK*VsgJ%a5=I|I{XhnO=Xd(W*e|^qwv|6q1NFpiSy{5;c6I`yw^rH5eRc-uD@I4In;Sc zX5|+k6(o5fQo9$YWKq3>W5^3cBlvT3s~QYo%nt(5mWF8245bxAA}BC^y$o>gH<`e_ z)6emV&4zAC0E9vj^#aSfz~02#(z5zuGt6Iu{?Ow=_yKA7UYn5#!jm2LJkV({EtOv2 zxPEk*=~e)gQpP6Q!cr*7jfr8Cd!Lg|W=qdMvBNK&4c`_gMWr@KY%8w`I4mU)`wlR& zB8>&9VZ9-x`V>{WWRB&X!6}&2!h(^sa6{fYzzkWbala2dQB>z8@eDI z#8JqyiG3|DHEDrj<%;XE+AbO!{ZY`EzVC2L3J-*W07t#veN10pjX(XvjT(5iiL|Vi z;;Tvz7*F8~oRpV64yK-#>tjB-r%Vinf+Q(?+rzr>FGwzsVqY%P*cMu6`4o$;UKT}? z(|N&nDMd9ycJv8nyKQX$FjWQhTo>vS<7kCBZEp?;H7gcOed_!QmY$9Yl$F=`nd9rD zmE7v=*QtAqmRJP;bi)tVnh%jpc=Q1%WR1!_=Xs?C^XECZ7SD#QWNfR9D&^prXf$KL z(&lLFG1s_t{1H~<@yYC4D{hplPwog>5Iq|a361{!<9v!85=TyeQuTxQm4zzi^RJl! z4P!PGA{c?f&XgJ~&N`QcS5wcC-mT351(%O=@8_(jvaPMw(I3_YvC{0D!C@qTqiW;E zoTRBIL|!{xUau3iKGG#;2Sz?ZwOaahIu1RnE&157ePeh{@j?7h{&5^Zs+N>@a-A0+*1xyex?(I@&kMdi&N&~AQ0@J0#7?2 z(zo~Etc_aY!|#rD?%QJ;DyuFj=($PX0&)xWlCp4bt#o*e!~&KV;yOq zl>}6lrH$p%nZnPeH)CY`>H>661WQH~6l2oG2Fhes6Oaa1Up0%_HB${xAI(&ue?q4W zD-3m~qsa7zw)_IYkm7VeD0)5cRIVXuAgOVd;4*TL<_s9p(MW5raIn>?FHdvxsJ-Z# z&mMzAYuq%a_tXr5(edpa1RRj(mW^a7TX0fkq54gOmrM#v zEPIDW3!|B~rj>@Q;+R{eNNsUr%x+uzGHEKec2i`%42_#>9dt+h`G9H1n3w(ndSzc| zgHHgwB(lgXhbu3DeaAj1S|gf6mQdD{Dg?H&oH7eRu4^xLDQ8)CN~?gLjFIiHBhVcK z1~+}C7}KG3BOy#Mr;!%RLn>lGZe+o(C8)u9pm}M#;GqR{>&S;v8FJUfB19|QAJ0 ziA{z*@B|9x56f2hk!=5_wFAP>gg!B}>D0v<%5YZ1Ln_AvD;R}L`^-L9FqT=A2F5bk z{uY_wyH#G}h2O2z&y<7dHlrr_DpOPg@`19{)lONK8`eeQrSzJ}8H4PYpo^wS!+dZ< zT1{DAV`cca8*gjN@|C`SY}G@~J=H9}lXh+o`5P*}P(pzjkZY&DDS@U1$bUhSC1P;z>Vx0ccBxG!Nu2hYL+$m5Pgg;qITd-{HqPlmb>4@cg2SU zkw54TTjA}KrB#50r`uli4d(EQt!5Bu>y$O+zdw;&%moL=7vqEzsSa&P|pf_`B=DRXbLdC+Ake z$MpsZvXbQ&`4bLT_@`-%$tO?eK>GH*&v0FYZ+d8T_};ob66no2hmsPEy-K8Gan{Re zyebn(&8#`rllW52!Gt_#eu1fgQki4n#gs!00%|S*Uqb%SBquns7FjAdP#%UZox3hS zX5Ga5pcc6f0r={AZs^R)EqtT%*}1c^#JqgInbWb3?eo{AjhFZfA+fvBpq)m(VfDN> zNl4quhCxhc@#zbxp!9t>^k8r+Y0W`k$*wg@=TR@*_RIIR({`?^0D}3Tu-{81g`IhV zn*W^vzm95l>+9-E)R|p>qcr6GLBY^{(TP^|VmSy=ICV)C$pRMxzHelu@XiQ>|~<{HxTbTJfts@m9q&)BUbgQk@H z5l#^QhiwB~8+xK9biDO)%8TRZ7jgV$blTuGFk3d1GtTh$ZS1-0IVj6{8xV32W)opF zWSmISkdjl9O27qskytREXiI;qn*q;8pg8GuthIeA+k8v7a%H~^rL0)9NBrU>PoczL zn^eV+a{B9PR!<9{J1J(&m^pC2OY+G%fgot)u7TvYtk4mGvI#Ps^;QM)7D^|bbTgYuOYq-5%gDKx!di| z1Gw=Y4IK96@i2n5Wm)Q^OR?4(n_Al5axiKQ-y$)#+M`21HT#w6S~B}aQmnySfepMq z5{BMb0kGOSU!3)h#$yxd>^IOE`(c>?L+xhV}hh zr9}4HJcYS?5jKh86VnvmD;`0ATk=QNXDa>+6kS0Z>)R&wQ@j})mK51S_6O$fjSs+I zv^V+n2#AiY-$byK>pSpip|2j?s<7`_ga0U-ETfB7iV;?HTWZ{O5RE6YFhOTo8Ldtw z&EK@xkA4*a;%Ip#79K-682J)FrLYU_gJYNfoGt?*KqK6|b3)-=no$$fTG+ZLQ0S&} zL+$2$3}Xz1hOKxR*w9#-HcGN%T1)UF^4`_#3{~{-U=?krH81pUr7=!XDc2iqgZft= z`#PBB`_`h|(MRMk3%aUCc0}JopLE4U`_O4hLxZF?HPxxqd6TEdy`z7gBN*wrlTyfm z|LuqV{319_%3JV7s9h=f^X6^H2L@LYy&g>Z^vbeiJeC~7F8pe4o$b*hZ~W~M-W z5I-@Tr9+d6tHIs|6uEq&0Z45%nq5M=IqHsdclpSQuNi zeC?14O@9B8w=8bD-|=%pBC%XNT?=KT$QLgdrAH+u1OAxBaVIPWg@Xcy{U?giwaJ@@ zzhO@Dx(efxbHwrmCAKtj7C#h$2+3}+^2@1tNrYM8Jk#9Dq+~a3dQe7tUdoV}QVUjs z9~#qwEQYipCPWmTH=YSL*+}~!_CE8dPvbPP$lyG}R{J1qG{{teLZe1{g&RaNgrFY@=ikA;vUo5trhXr1*( zpM(nzA0qw+CJYm^a<8@_Om$!T{cXJ83HY3P&rtci^7VW|8(A=FuF)goJL&lg`WvwS zBw3EUzWwD|-T`&!c_{hn;I?yM{CZ$$`!x0SXyb;rE%*;{z2N*-j(%(bZf>*4hzt=8 ztCiSPfrg@rkAQmY#B?zy4>d8#_s|Imm)5hV5iN0@H%HgD0noixX4l43=??)3{Bu|m zcF&p{fSE3y{eJCHT(M<*)ByVr9T_WYxzHmNqt+I2mSOm^ytDNs<^paMTn^ZY$1WB| zKD4w4&&%V4FkvCuLH)LYSZlv^6l4qykJS_t1+WSzk7y~Ksm7S!D zIGXDPQ&%-Oxi`Y4e}sF=BV`;T$S3Ug+mJ+fffCtDgTUO_*m2sQO&OmOH2yJLNW2*_ z=rzx|C+~OdEkb|Grt_H_5d!)kf|4e_lGm1nT9MMkTASCp*Ua^~sVHmF1-)R+CoZ>? z+Ek`RJuE6nmZdOH6@;p+!H{E~VG43F!hu0B*)OzHkJ;Zf!P+MXA=wWf=z2KZE&krm zM6NI)njgN7A{Yg_4XK!5dNPC8A#){94uf)NMHGStB|h33Om%x&uc4v2r`n6_RrVY` zk38F`5s)(|b*P#daQh;^eX<|+`S74QN`Y!59Xd7BXWg}7zcLgdCOo--7IBFh1UJrK z%z5Z-pK;_gP<}Mdp2}ECK~o)Tw2ZI{rH5sJSn*`zG>K8zds&gbfeEZWKU8(KLvz$ zx*D@&W(=2e>w?h?`p5xHQ7p}s6T{ZqAS{6EcH<&6Xdv3d!PJa%cy?a&+KAzVd?9n`w z_EUQ#@>Y`NZhNd zPh!Qp9^}`jqFB6i2dYBDOL)2kCxn{--A+?EM6}Ju;%TL!{}NDG;w%R1!-U>vbq)xnxE!dH;S@sT@3EEj~psl3rjqzdz~Hr25Toa-7RjR2KQI zN<$_>e5r4_=pBjurOETI<1-7${{K}mFkfV^yDuT+%*1UXvEpMc@JZ^0F}mhDgmnYC zZuyT3F9yAdeP`+r^zQDHOQDOF{b>Z3ZGdcyd0fu++a zCxGR9_aem;q}u%xe~9H^nvm9sYSSwdpDAFzDm1Ai^;ceA-Q9^7u*o6T-dZm?DMV~z zoVC5Rh^EUrr$X+$I}22g}REV&{C-S<(kE>gLjtRMD#$m@z+sF;4L$ zc|S*8f$DKFM^-+C;*nv`)X0cqI(L+yAr4)Ba3GrX4zWdLO2Z3GJ;lP<{E?B1@uj*s zbe@&FMT0?Yirhq2N|V5q9XzVBhw~D?ssxPqKKVY3Ehlyon*zvVhL#X(tqJYS@Y1+w z3%y`#RGRcN*7}35%!bzYp4{sN|I7M6zE1tHg!dL`zb$L4J=zz^u3{%EzMz&-iheHj z-VS&XU9zDi^r6xQL7Mm~2B#_su4-_8?#hRIDYS42Y~K+=9DulsA> z!!X9?{el<^eAtRn{4>r#B{+SgAis~cN5S&rRrK>#ywn}~BE6ru^K|$*rW>K!9+i0| zSXxh|$haY0S@|M0{9g)G9qU)H+YEOkH99X8WH%DGv%XcwDW*=on2D=o{~jbi zATPRa!)$0E7F;Zf2f>#BBgJuE`KXSCTu^5U{aBnenk7a#)!C{NE|YonTn(c3OceXHv^ZuK;}$(JQLu&DaXWuYr7frf6iIj_K0{N9~OvrT+1*= zN_*pEJQZAdA@|gtjx7eKJkTT%NOABjFL&90D|{C>MSAyBcljSl*BDqy({y9owryJ* z+qP}n+&CNCwzIL5jcwc3cc1tBeP`xY_f%I;SDkYzGxBocQOs0b;m;jU2sWSqWhqr5 zyN;xa6n@aX(YfzN$mdI)`*boJTF#RjJs2$YHu>+<3j+#4M3*o+TcrFrr9?RFxIyLQ z?x5UU1KuPyYaHu<1&d%Cs}!5gRT9D8^eKh#m%|OprS51#nJR@X9L+P}JH2M5|RNlL0^7{Z~h2OdwHSy6snr=>?I6&Z?=*zo1BK+viGx?a(AbZ}qT{F8K|LsaA zcSyBAVmp5$-fUm#>MGyGZnjdAaM#s~OI4AV*-|8{*qBSrVwI(2@)!#0%JBSh`sV=e ziAY~pB0-u@(CxK`LhS1YZb!Y|>#)94P($n`2p8mHc!-b23Apqj(o5BazL~j%bqE3p zX_*Dq#Y0-T&25cFkK19sBg|V|t^_RI!UB)C)5k+;z_h3%n9)83T*@N5E^BO`_xX zhafRdxZ!;FW|-wlhD4Zn(9LxTxx3mxoF&*X3f*Ch&%B8G;BnZ6sa#XhUg8Ng@2s^M z=r$5tpm|l?Ua>2&u3E>QwVLo)!S)55!$UG{-t1M8@NB7^H}W!Jd!>;sP$%K{KGq54 zg|R_W{y#laeYhl7lxel0ScxlPJ*V0)ObyRG4}gnL6r)zV%6ZG1@{`A1z|8}eXO7D6 zd7RiO`4E*$8Z_i0Sit%B#zm zpT~|8$bcBGhyD4m5qjJg;A7axd3)`+%Fi1xKj`sHAB(C_CGMf_n!b z$k>OeYY<-$1rX3x{j*CTRPeI5BY^Iw5rSWM_6*74zoUP?_TW`dHqpkY`p(*nzxXNz4CE+(xvukcEQd8%!33EVBPp)A#wII!seE#;GJ`!fg+2TEpS{i2IrJhp z&$uKA;7vn#vk>VLL}(Dr&{i^;F#|H21R>qNAe9}J+6UxQl}vO)191*fG}Q1I3s{xh zC)yco#-(pyX^9Ge(mhi06eWPySU2hg7$ zk2&V|2kU@9Gvh&OADT!$SfLuZ*_ob&_dzf5i;j*yPDZHZS}CpnfS>erY=ld;HafIb zWXK~!1c%X*wIcaqf3UMc<~6hCzv)7rf0>;qoD5G1(%gO8cj3pIf)=?1+tGxx7OmDK z{9fdHA{Vsf6fNLrEJWAHVE zQ$t$Q&z6bMJGB$)-`%0}QX^}d$kCTJZ`PFc@Vs?L|1d26Pe?Ss-i_L_^ZZtpPk-<~ z**!niD;MqQK1*M~~kRlR#OPWcwEMm`IOKpO<_(Km*A5gKBsm0kNy26Zu%Rf2q) zJN_D>2{-*^Pw#q|9zhYj^U39veY07{T|rf&yc?msx7))T%zGhMoQO4F<#^!?k9LfE z(|oXbPF&wcd$Mg?f1}?Aa|DEF`0Nn^AnBMChrhrMBMcZ@-7bZ1N6f@2tPlIo)BfBWaaQR$n7>NU=4_D+1|g3xK#mASKg#_Oi}iQ z^)zx!c%yz_u(~j(LTruxc(xXYZdBE&TiAtetjV#Mg2o4e&wYOw)qPM;>O^H+l3v!| z(LLLn?~wMB$xFb0eY)cOCtEc~?PIB3Dar@pi;k+`0T39&lyqiM_9h-K8gd&+HSP?p zQo6)`HDdW#$W*De+y<+WSToZp#kD^NmUsV%RrfClzE2+q*vz4B-kFes2KK{%%7*~C z@QYd@_J@&XbUSU5?9|Y4AP^}(ah&liLuFMa&a*oe+stVr>@@&pZ971Y5lpBjX-Fi{ zYVcbz_u<-dnHCnqJl1AE61(~zY!6R-{KWz{9b-<2wRtH=X}BYI=tO9PAzg|`iX*L# zzLeTBi5%9Q6;Fgku?v7Ub3jq@^P1`&Qi-c+8(q2>ZYq$Ov7VzZ$@c(9JTqYquvxdFfT!5=v)e{S9FY>XHqPupGuw1$1(5hH= zfs~JwKX_t>)a>pru`0m0IJ`FgQehrn$A!#!TP`B~3A2nsGlJUvuu3VKStgr~HOoH)0MeyJBiZsLiM*}}D* z^pV`%LtY+negBZZZVhp_mnC~R#eUz{YkJvUG}27M!^3_KzpU4$XyGT2ix2WC-K;ZU z83R!=P6k4XQ`*KZQ~5^g{)ow{;02YvO6mI z1O4>McF@ntLQsA=)%062iVvbG3PJDE+u?hyYbA`Zafq`F;#}}vJMlL7tQj;WLI7fA z$_T*k^hCOMC&|zJnL!*dQA_Aj>$~W^ksu(9?KO8Adqw=P{Z{<+>^QA>MwVP2h0Nvi zZ*bZS29Pg%ASo(7+|N*>JZ2rGxHa~;;S$JEnRo=+nZa<8dkTIfjkf5WRytie@V> zXEkMXcq29SrGKl4TIDCirOg{EPpYa2q{kFpdx^blk6&a7T^9>9d=B*(m2Z87U3sW^ z@lSF(!Uy^#0|A;Q;BzxJh2pSHBRR;%6cBk7Ii3>p(14W0<#C#^!TqYyiYIno;I6WK zniaoiN-x@mKkQxdx3CY68}S>ts@y(Smq6dpgStgg<_|2y60w=dpmL2_E>35bXy=Hu z8uAI;m4#oq1QiHr?dY(U)vm&VDIcj^_{0oQKyB3}%5IsvtpZa(Wj0%!@HV@(LQp!K*PubicPusYMHuPe_I>z5ClRcNoDA<#rC|DnJNzN!Vu1^ zWOYF!>#Ei!X_)k*Ou(*s(BSvwbg|0$xIw@Kg@xZBm>j`Pex3iR~LdK^|?nW zS-P-p;)4(p+WRbp79eIaD0bK)UXZziNUpp!-WEH0`r~s{*<ph zVQjGSwC)$M3Zm26akX;c_d@;Idb8v8wZ9P&-_W;%-^+&$zL)T00gF2L`-R61J6z@H ztc(D3FagsR_3~>U(;hbWp17OA(=b^_pzmW;|Mf~Ppb1f+bWa0OAp7AaZD)F#P;h+D zd8cNxZ3n~2!S^S+?(+{UIuY}55#!hQ$389;POtDXVWDT(uzR%?SR%dcb!!R)VZ|O8 z$3|S&^t`!U<^(!+g|4dmNHzV;K_QAkI!ga&EvLcz^~bHzPrN7JDfpZ$J&jY)-o)5q zFW{uH(w7z8e}Kjd(xL784Ru?+~hn+A<;0-e(%i3gLc-w8_@36mJyyQKbzXK z128n~9B%)h2mp`FbQGs6#vW5@*L)xEsG>5kt{q-qUlRqW^$}TYxB}N^9G{3w{Ffa9 zS7{_>X2yg^_a)F7dH#NGU;cPXcj9RIXg+WK7$pMHjNu+MCFHC`d}*pxn2za=7gcr9 z1dO zdA>dHKb3y2;F;1!jokl2b=^(WtV9^rBKRVl!vM4HrnUZ;$V5(+go=t0Gi%TG=un$SS6! zYm2h0U>OgZL90RagI0!8NTf%vrrnQJsMk~UeCf)n*pQI600L2=rIRy!D%bFJ8?pI@ z_$ybRjzga;r27ckMr3hASxv(F;KfbC#UM?-xw$@_H*9;8s~?X1VacB2G&y~Upcwca z!Lx@VV`O3@Nv?)K=;tDLA_2yR?1H151P(%K4yb~()qs}BaIbN|-@Kq*nzSi<0XsqO z$lBi8d0#w|as)Jz@*zI4%N2I&;aU^frUs-GqE3(`N6d|km>d;G)F@24O)@3q%JG@#(ljtd)KR)LbP?%O}A zd~<|ucXF?#&pe;6RHHvMP7&=oAppsUT0U*;rAxgv9{4PHYIa5QH6*K0N+d;gHycfr z*^C_OnoZMx69DdPI|ky3C^=Di<6imN_RI4TSojJh)6iE06bXjIfiO7(keEIvPUV|m z11`O9;Z0db`~J^4f_K2FvCJ-~L*CC#$(O}xmZi0dMy3sj7^iIL^N^zo>iY8hvK>61 z2hNg;f7keK8^AGDXX(*J^5df9%pV{X{BAyi)RUE^%fmoru(&Jx1bjXqlx?b(Jyzw} zRn=&k!U3?WS3Y~(B|Zv1C?wfXErJ=1m9!zJt;HE(hebHe(oOf|e!HT^CPS@FyfEoc zoZS1t3LnyEYa)XmV+`EX_T8>olLi2A!$C5T45l}gKFTN;vQCHTEMM9ueAvE}4sg3M z;PxFq5$gLb6O@2^e+^%P-uI?qM)!Ban`m}VeM90-#;k&b4}`|*yow7%M=EB=)PatQ(86hcrZc#6=_nGDo9ZPj1gRIa7Xgy>JHvS(?xR&`%ir$4S#ib7pjy&B*|3Hj`mMpeed zB`VT*$#oUzreVkwXo(_%(vp=dLct^=OZY9pu2b7l;VE8jK?f$e`#__Ss7<}vWEJXq zrdyefGS3q78-OZ6N>a{*`mNZ2DjOJ00AuOX3?v^+-9QNIvMK5qeW@bC7)Jt{n(-@q z$_8AR{pX7_fq%Z}(=aikwd!`wp&R~Mc*^7@gq0!S%j;wn{i1RXaeyP+MX9A223Z&i z-g7f;KhieCK7&nUip$qodTbI-1h8rNi6!~CB_R;f@Vq-M4792EnZdyjRMh!`#2et9 z_(rCA^t?mis<#SX&k#0f%RCYQ@CfJ~yFn90H%ikW>r1KjlC)L35!h!@X&7mkG1?ls ztiuZ>F3!?Blm9Dv49^(@Y9FtTt0Soe44-}a0oX76*_$p<#25vq8hy`gK3f8Q9m~6K z0k_@`H%wymCzt=>FjD*1{>vWMan5agFtqkeX&&F1c|l;ysaewJm}UNj*+Kf3kx5m6 zBhpa-Ul;r0KVtExl*Uw|5(F@w-?eptzr=rqe12{@+--Ecyli}>lMMa4Fv|MNRV5&N zyr-ey*a1lUCP?TT@m6}#l@jglLYQ38Y9dQR+tJKH9qACyR}mehyryFh3DWS!B$D0b zjf^Fk@xFlCe>-XBpjvo6H0<0=W;fsX=+x?|ESJCv(!0arL_+7(NhmklpK|I2)$Al=E z1d5Y%M8j3V@ZB*&6K(43jVgF+3x8?d`=8VRdcPFK-xo7_G0@mX60>YaGTzWxffh0%GQwoB;o@IM}!HcaX+qT-gr*D7KW(2VKYZdgF_n}GkswOd>LLo zt=)*~_Xr`WpsfOb`L4Iz6O>X;<;dpT{3OJW%~Tbq_Z%5gs{r^A^Zq;=oIaiYt4eKoRvH%4BEZqG(8hiQ6NHp43uVf!-jkwM42NFd>EwwAhzh9shB3ONrHnkW z!I@<#Fx*;Z|LA=&d`iYHKQqfPu-gG_PXv3wwJ7p9j&i0;T}eefHRtZCv;zK5;yNHX zcGt+&A0(ZPYd|~;tcEl9k#G?<PR1tkT%cMhM7RVtJh*s5b4wSLliU}@1hVG1cKHqIk;YTcPNnyO3&a^6So0E5J-v2-YRgA z!w6k}6QW?dH;3j|oo3I^c!u?aqIPT(+C2Epcaeg(2np1KAL}3uJR@#?{c_uX21Ebz zD`A3m_!oOZA|db(XFg=%z%Fny57%FT*S_8F(m7VMZ#9SqK#8o-!iidd#!0|(yIMpN zI+q@g4e7gjU!m)384edM1eNy@c=&A%N-}NX9e_t78ZUZMnx?nWgRa4e8$g2HGD@3|&L?Xjg)qJ|!g9QvifjdSlAePtk;ef*4Y3ZL z?#hpUP#6S!(+Kx1xS6hG+CcI>>ZC8gJ#r-#j1rq0#c)R>71jPWHgslcwUm~obWY?i z0&rVMl-zD?5Te7mqwfK$ci2&R5q>d-ha=d>;^#!Vn=paWx`9{S>OiUw0r0I|bBemK z_Lt9Qa(3id(V7Jy?Q;10;?!A4Y%tc%3$lOynD}PGDq?p40nk&MF)#n}QHsL+!Eq&a zX>~DgL|i>N7MWD-T`Dt09sS_%5&-DEE53cgrA=$OR4aa^_=pAEW9zeZmcsJJ%*=_o zKQP?vvxu$d^YC*KS0X;++iEo|#8#e7!8RjcO3S4{+s{%b)O zBEimqtYGB@ysn|(?`Nll)+n+wz1#1B8;_GV{I4madMQj1bRWnI=&$RU9mpFG{3fs- zRv6f%cuK*ZZ>dE;CN68PAG_2F;@@24_c^5sH*+1p;e(cs0S52}d!(2&SRmY;~2Y7?jF1UlgVxI*LZ#XdweHJmD>&aE6y z@*>FoZhh;;icRf7)ra_tD5r{9LW-XWVx%2MmwEK^UKMUdkyRq zK)g@Lyxtu~s2;xA6f{z7Z0nsj+=E!EXWUjRvkKN-rE~5Th=@>!o0J_$BfBHB{Wkr&i-) zEp0EbFCq>ez@yGZAm$A1s~WWY*Y!QIu*x+DPYWbGJM&NI>l9K%e(a2-!X6uo*9N>e}-3J*nm6IA^UzuQ`u8#OaWCvv-j=m{33Y|J~yUZTlW%_$y(i`T_ z#RD1O!KO^(h(FKfRLBI5Awm$z0nb*r#w!WiH-9nQBHEd}Sg$(!qBtsIY6Rs8*%na) zeg4yYYhzXa!EiWyYwg;Ba5+bOzM~-clt95_V{ip7Z}diYoUXLvvY{h~x51mrfp(Xa zl*5_OoQ{JfmSqXwBhLyxfBysn0JSPjn?!IFFxhB7vGmHF_&27xtFeC`?Qd=dJrG{K zVdkc0zgqh$u0WJu?s%d!qOv57&(3`%(5CxQN;{0JmABc7D@|_~tu^C@YskBqWm!eZ z&Bn1Mx(`+8^zvr^nw>PH;Qh-RL0MP7t-m`OrZ%~~-06bO&IdKjh}q&j+oc4@Esg23 zI{x~XhNM?6=&&;C^D{{E4BZWH{PT&~!xK9AFuK&s%Xiad`CfwD@AT6gOnuYi zc8NIec*W1g{=7nX-1+lSUPvg*v@L@f91&qp0A&=|TlfS7z)$_t!iLsuszy)O)>ekb znn2%oErfT7w5u`9hSq*K#L(4`rp~XMmE3JS#Y-;kbd3OJcn6u0>(Z->Kv(@Z=*+wO zcI-yz;Kg&_5)}07eD>~pv&XsI7F@cW|L!xj6!ARoVhF9K?YYh!n3J8Mfhs3rGJaT? z5InBxk>0dNvDY}EEj(>;^kHQb@b|nUeLo)rh!t`0g(-Z{zxds4semo5;x0zxQa6(- zHzIjU8lbAND`pe@Cue7uYHM_4#wz~wWQDBD5p-@Ua0qE9NZW%)F8;wnrrgJO2k2s^da0eJL{$#B`$hxctmBlT)LrW+Sii>tk zLCZ*(-9rt0wD1_*0K6XHcMjmRk{pEgA=tj>2v1273qjdaZhO}iyDJ*!HBhe=bOi_! z^QOkVzAAiEy#i#~PikaYL+xb44jy6@ahJcr3BJ~;rP9f*%4zjTzfp#(iCUw`>CI?u z8}U-ptzptGP)XWtLFmS1$GAm4Z~aGRrs4zVhp*f(f`_B{1H$eiX15)p?ZIWTy2A#q zCg1)b{U4$8|v)G#rhv)7f&E)bAH_2yIn7_PwjYC4!&Evh2DEz3gu2y?{^q^kB4`pbTBkAq;w_rBcy|3F*`RaKX_SIy+4Fq+tjx|CYmHGSK$cz zV?IN>g|w}_mgjsBYP3|O9T8xRc+S;u`T-m7{KXDI3316v2u`^OwhnP$JjHpNKHggb z8AEceU?x}d8Z&!9D@fk$XYBcZ&w$XTtiMX?J0n`Yt6xqUza1TX%3p)CD8V1K2j7X> z;LV?ra&wbU;oEafv|v@4hinp#80w=NDBDS4(b#HupoRu9FYJAH0-W0yBK$e$I&p`- zw6J^?+NMhAvH-}a+ue(w6!Gj9fPxy8N96pFYm z0rIBER=%*bSiwjH_Lk6;!#i^^{^eyK5exXfPni3cy`Gz)`KNM!kN`~B(0{Rfn^|6W zZ-^`5kbkl*f>D~ZMY;7q{a)C-!y3FY|3*mhbZznDApT^(qKOT{y~v}~l1KPe!YjGi zMb@z`shQv~qZ-az*~ge4wkocLa?4P(P^4JDGVRz60zYX!?I%QC#L9(suHwJ6-D-vy ztq;pQp{JLv7w=1Xx^irH-CDj#QQ+npgVJgWzHvDa^TFBksUma2^(2xF)Xmb*#cs|6 ztV7<*6Abuf$Y>v&dyTxFWukclh*0)0W?_|{$#Ci*Raszl1=sYXeuEAs_`9iNwMmK-YTVdMUrnBrq?cxfv>sf{B zkrJYzj6iv6u!Ev30!Ht4%JlGYdn)Ecfc5K>4+T%RaeXt)!&zva0suk;hivj=R}*tY zC&<=zD%4r|U79p8hEtkV`VixqX;6&)Ca%hHw`)ie;E$WUG-eVk$^V_v&0iBWKbUmG zMPnUkZLs-s(k5DH9vOx7s-G+&29RiS(8obuy4)`mv4h6a8wg$_r^(RU4_bhmv0Q>h`EBxq_ifc{+qIX+cuR;a_iP zkQ3h#0c8gHEm3u&aj}#EVYkv>i?|gg`gW8&?LMD51|=9}csaq2tpqp%J(`+|?M%fO z2+iaMPmc?Zw`)Nmj5S@v5n<(sjM6_vI~ikXgpPL-m)f!2#i7@7RPUWtgk{S&HL{V? z#sGXgHY!`U*y2X;(H{lG{1T*Z*lEGPT*6Cm;O!}6;pb#uqkc}5(<9p*yBnHm;;UHH z)612?SlW1%9WgnI`Zt5y9l7tymYjhsIxFqgxjX78u{{Dfm|PhfY{ooS5xef|R#V?M zm`w2?yl(^_&dOoHe=w7{?oYwR-b&_I%3-tln4aFNED~qudHex#W+@tQBUqFfE@? zAYtV44wSPF{f!hG#!qf-P@ZE0Rg_a{Rg;*&NF5eVRDR*2QjD^o2SY~^9Ma5%Yv98x zdl`)V91RN8X9fpTwIqO2TNdNhZDMb>!*hTFLk|tB4?aawN5U+GAqa+vq@EYbpy;ZM z1vFyI0!ZLG+v~P7)sLo*8nTH&i*iGf1rbjkMX+fSLJD4KL>Xk`U4NT=S;pShDJs1A zead)_3!Z&!^$mFz1kj^FpFTao8Bc{LwV&Kt5ta^Rw z(qFM8WGI@a3;b8z;UE5y0ddD{1V`KTE9Q1Jg~zSA(7xpWzn}LFuJ`~%wRCZn?}IaO zD9u`_paK!hK=Qg9*d@O3VlhqMzBrxJ|im9F*xcB4a7-! zhw$8~XP-E-e030_wVPsYi_Kh_tRZvR%<;!)ve#U4RM8X+I+S)s7#r*vo)YlkDQ;8? z71^%ML!;mQ1BbOA;HSZh#gM0Z77#GC<@j`MSNoi`&ekaa!wHD~GaUOU2+{wpPiYk9 zEzn9krZ}D}CZ^WZO0U0G9TozsxD^&vf8;va&{l(ZA6pGddAT4iWh~?RUV{X0@;WDi zlSvl~MUw{5?Nmkx+UkpKY(Bj|R4jd?Xm|;%f}x2SrGn;OK0DLLAD$>z1C&U^ejRPj zy4v25#|;!W`}c`C`W>6q(Vy|KUnQ3~LVQIKLK8fy6AgF;LMcOCTa`*px|+9YK(*CM zCU*G3tK3n(%BN818R=s$QF(-i*LGIRh_Q8;gFlP1L(t8j_BklmBlt78h@Ns;dEikB!Y;JLd zcB&-6uuNO{prBrdotVpD^70%LEXXzmUx)Q*V*7kr(vau!AB4J7KYBh{%u*H|nx$E& zG%s6&vF9o7V@vf#bj769(&tTL2Qo_Rwi=}!ciWJ?G)kk!_#}f?XTC;Roqqr>fS+*o zMe>-0vb7)sE^v}{^%oBOS;4@Ag=g#WrC&RD?*3g6JO^V>(bBIXT5ad;pv2k`Sf1i7 zruC;+TRK6wSx9UusPqhD{SMOx>zSfib5JAQ9TaBX33zATxJ9EydsCEM29o=f{gXFf z7e~kR+M+#$VMt^|Fj5O>V?DSkkWT5v4_0oMaj&5m)}<@N5vG*CAI4jPMSW#muPB7} zsXcSv>xQ5WmpC9`G>B`h7rCoH&RKSbI{mlEuZ+i7=W)os_MPIVm;iQT@IMqe=1{ko zxD&w@7Vt8?gbQol*)gJysp1pf?kJW{YcVkfJy*7+aM6Tc}Ai4+m^qGZNx(jK`Q<1#w zQuP0=B%9UBL}#Ww=rqyGJhH-XRZHsZDn#j06cgBHj`s8}7;C{Rh%5$c#yJ-&8#l4K z?`{BJSTAhDI@%&tY{vk0>}<{gH@*QThS9lk#b%{~zDPWtYV$#3w+;Xf{cxO!WdDUD z$eyib6u9g>h{*6dQRvMM_I{f#4-ZD^Ow_#G8GH1pEzeSyCOSc`wM6DcqB+;f&Ga^0 zz0ZW3t6@ZJ&5$&&Hz{=qxTXkj4Nvpa;+{-%=o-gfy+k=3qP>xN`aF2;EeDMcOnrt9 z@VhrQoN||X!h8d^JA|G2F#(Weu#C7vE0uL^j6i5N#U9je&eO%Jhe?6)?ncB87T0!8 zxj7M~`p}@H>^m}A&6E=Kx+*G}_4yhN_ch8tO3%b*_})jF@&9O()@}qm35A-gvxxoo zcepR5V|?xwepF`|;t7Vo&-yd-rXvK4BZ+}8HFWMkx6}!`-^!eJRHwb|5T|dIH^N8N zOptR(W2g;mDc4nx#0??BIiudd=Q?- z7=)`Ks=n2;Tq^BnQ7cAD~T5Aa@)Z*YzGN4v%&Zp8-AVhaQ4-B3{l z#)K!R6lohs;L=ZvN^`sV09(7|aENaYVvJm!Ff60Q=WxwtgFE}X7}S>`C)Olf-N=$A zsm5ycn)VzR%cvO7I!t!f%G>amsXlX(ZpZmVrCoHU@Of@Y6daYOu4{EQtx;#hR#v)R ztgJa2sg%~}v3S(3WvqewQ$Fg;O|gJ&olkUgNH@Yn3qMl{_>Md7SQl+Fd-0gZSI=Xc z{jiVOf%+>f8kWxR;oRBW#>Epkib?+a7sGkLjg8?g#N?Z}0i>K=6YDrInfZ1kJ>7H& zmuyIk0>3JF;LL$|KKzT!54ijZ!QWVq;1G|9KkTM+Kw5LkzizqJ6akTzK34;rT!SMF z2%C^3L>pAx=d2f`LVGTlDYs zo7Qq;p_s-cJyqYT7O+|H*Q3eZD-b8_{OYcjMZN0(8B2KFE}u} zLwsv>POh|VSc;aVCwN@90sGDF_CzJkeUUQh7f3sBtpWFbYmlcYWezKlz5Q_?Tws(G5pjc%ItkuCbv)zo=YiINn+?mIM|s_cy%dP2g^ zU|JiO94WxXmSYG9Y<~uZE<#WhGc4nEtq-o10w&0)kNd6Pu~FRtryR@}wb@tb5VK+p ziOWjOGVhqbJhtI#z49i$YD&;Y*1?h>j*ICwrHvP}AfBD-gwfP#r<0h@M-QtozgBBZ z!CILC*j2jZYmIp@)cryu%bwCheRe< zhelYeDGHBk2?L=V3XUk^KTpr27L;##m~WDuA<^DGq(;w!srpp$A@dj}(E_qIbMqq};`nHbWJg z*x0<@ktWKqFi7(&I%t9z@;v#>p7S}rBy$^sru^&u=%K1^N8sSB6t0#Hp>k8j> z+=R09u@UhC*^7~ZpCs(lJ7vZukVM1Yc#d65r=HJRAV;Z%CK^6|H&U$gF|Gq4|PjS(XEo7-C1b%CDI^ zijs#)sly376b&n-)av-cq>_@ySkDoaG|s}AdA4biJp$B>^`&B03HGQIx6`rlB{J!K zrs43+?EYZLxLOGUfbJ=7ndQ1S*lx=l`}>MtD737csDyTfQ{ed9%!*_7)s_DJ!{5-# z#=++n=za40hMZ0h|6%GJ4JQ(f+I@~7WCl7b7_XV(dEz>l+y*-9MjqL)$C)jujm287 z5>^^{fFrz6C6-C)ER~*_>XfEyfb~Ds_MlfH3-zDWzZp1T;vyIkArYj2ny(V7YQg*o z4cgK1wqiO)pvLFTs?qYts^HvpR`kdIX$Ib+xK}vj=S{u+oDk-za~7(l`%%UqvB|J3 z$|&(#Xk>}vzG&pR&g`y~Mr;wc)ShS438$m+axD)KCC81m}bE)8T{^MN%;pEyNp58i!Z^dAF@*`UBsw64)6{ z+xBY5yQ@TPE?_F*$s2d{{>+<`_(frc zukGsmoRy-uX-Lx%_2`>%*Q-t1`)xkW86aDRW1Wzp=~fTdqy~;#J}HVW?rqE4B4@Wt zrX!&2?J7T?4G1*}$K=!FsdDE@!V}TL^U-${67efUU$lMha4mjZ3)ur;6u<~+RjZkBi-u4;6Sa*~Vle|Af=FunlnR!)OMk!8}M zw!otpI;uy+t^Ra)l=5IfSFRp!Fmx z>NqfQ^1DlV372{AQ5bqi0f8ZXx(ehsZ5ACvh-=p8^Fqd5F|{T^x|i}TT%+B!!%i)T zDQhKAF`y4_nb_uzfEG~T~<$bGwhEr!5%Vy0QRq0p3aR&wpXn zWc!pL?{&vPg(Po{%oCezS5rGO)@e?HZYGOE))?W9vrT(FEW%b|FDS*Wyd)xND*1+d z_$32pkIWp$A)&JJq}B)>pZTdJkj4CY7Q(4-U=U5_((iZpkL>9+_Yo*yJKoCStQ@8M z_E^+A|0AcLA&i0qF`FKXd2bM@1G=g`vz0MC#h`1-3WEs<0Uoo)k}h=3>&|aoaRSO3 zKBrEOByN+OmtFL-?yCZs(24)1dr%T~4KfMnDk&6dZ&cSGCgIn*wYUZDP*c@CvPWYE-_0w7DKY8*g}SiHr)!&Qb&V{DG-R9^bQdcSi05|r_0@cHyV^EIS+ry zQ`MWOiFl3EL`d_FKu`vgbCBVeSEi?KY7o8}S2#eBVq%prJ=rMD0Jm&1I{Q$vJ$-`w z;;8#8T$?R{f0AgarRPd422W3$mD!Y1rj`*^T`R+hz}WXEUu1=QpF*A-p2kpqGWFd4!y}XhO;W7Cz}>nD)Ph zzHEcWvEx*_vDAfTyGDju?DT5^nUaNBE==;O0gAJIio*)Xle{(Z7+Z<);FKrY7?Y*R z-E(+gce3H_yOi6+sJ?nG{9(mIcZxloIu1Km)0t#!JzJK=8njW>EIx0bP3+UE(Gf zq->Ab(a?aQ$Inz{{HC2$Y?c)9`V7;jkg#l=rwLr=Dq7!FN& zx+rgQ6uF=xf388y@A$MQEt>1IzGtl=Fj=!(R4CxNC4#I`mEvT(TCSOA-J*je{_Aq4 zFXiv&^FZJJey<-@>oJ%^AC(@ANZ1ZikaMD{C0Rh)?4s`j(&0R>>ZP5=d{CG;#F=oEV1DJVto-VXrJI@vR%mgU!q9p3tfe4y`vq`Xb9&0{M z63|5~nnRcTl%wo>P{6nvr)+45G#FTkX)2hjCzB-J&F|Z5#4(r?V^SW9PdgX&KBuop zganG9geJUGhg;4Qi<-w}sEDUzebED522GUDX0yIAh(PC8Rz}Z#Rwwl#qO~2E!9WZB z(9LpH8OZumF$d{qMexeIA<;sSooYSfIe>an%5M4)74dcGD)eHyUDhv1#XqexW~(Fs zuGJDb&`zbL&UP<$X?UAp zt1+njE@vbUIvXa7UCa`~KN`-Vaj}g;0uO=4Vk!Eh%~9VH(O#14vkmVsU?WCYY!*I_0h62#(-X%6K`vGWMrqbj{f{Npql5C0?&&^B3#if?V8Cwz*M|(O$od7u zv}-YY;G2)l6O+4s7GGSw8q*B0{sP?)yMIK=0;)KB;6=EOURu}poBB!X#AUW{I64?V zgflSvl5vmcKLgoVxHOGAt^9n3uATkIY4cW?MQgK<_~M&bEcCR)=%yDU?^^Bt?3TFh zMVF%IN;P)q0eG`$xsqBx*ZZ1Fb41e7<2mBmFBl5dI=z}kU;1T=JiVIIIlXLN$q5uf zV6$+t&>)gUf`JAoIY2P=zf^zU^l(Hm`T|Rfmht(!Z|)Rajggs#Z{f^3!fsR(fai#R zvE`S4%{Y!p@`gzr;Wk**W?D++)oID;4K8UJ}-LK|h-GSJZ5|SpLq;G(_+u zDq5&kc`3_IJy}6{@M;lrKB_)cL&Zd|%49RQ(mScP9t=OyqR2U8t3yTnvaknSgxw;h zyzGE?vV$R z;17+Rt)aJjrr3FP5+!e-qTyf`?_q+0g(CW_Z zE4}+aYVa{1!$}UY+upJpEO6;+vTKER$fZ+q2`}Zm(Ycwc->D30I-FwNI20vZ3e2L_ zvFB$X6e9Z2X0a`+GHgLtXJ`xFP3 zF$^bf&5U2}v~77T5rAk`UTAr5@o^f0d*@`}@E?1L*TIXY%X$vRN&k@J(t=aFm1CGo z1O?kMs^<&+Q?*QUK;Y=_^PrkU-WcmnV(V~TyK6;t>W{|ImYpm%CwD+e8)iRI(=!!6 z<&L~caup~dlbd*NLzYId8ha+y;0x+~bk6g1#qiY)^;USn-qjG>hQGz^cgJl|DiKx0 zzXeum`u&CVP$ns%U@MB+fHWdvGI5+D#_RUr*_$w4Kp-&`t7X8)8UYSRW=RkNi?=`$ z@bVP1Z}#zi^$;V2mj^_6(>J(N47_h*!Ymb_|1Ix257)}`>v6H*pNgfw2*PoQg5}5m z0UAN&z5~rvK{Lg(PHj?}SvR=Ytv?xzShIv54_>^ZiUt4PLJF{y*QAC)4P(q*mjzra2Z@* ze;6*GzP2^!>_X^`TJPE>=MD-f+LtP10GAE-cNl#DaUuMq4?-AUpPF@LorYZ}>X677w4- zs-CTBUmDFC!=>jfe+%h6mF?}@Lq*1)9V=Wdmt!F*=U(xzm$Rhe4hvJ! zdU9_Ap6HLpuhtM3u}=k_oi)pT z*E0AXi0%~faWfoY6$zH4U_D)&F$n9SZ&^q);*Inl+}2}*Ly8&T5K`7}Jtxm&BPFf{ zOwPQNyW)db_G_iTFN(mv13uXOTB`!t~!x5DT~4sk-{OXcp0;}Nzx*1!_ddHS=hLNVg_!2l=bVb6F2Zy z9@K{hW4v<+;t1h>b<3a&SRUCAeWNoIe+aqlHb@<%XvN?+xc%}*RmJhwGQN>t&+<`I zQhzkxZ17%xZNY~{y&*Y-$s2P)i%Fp))O=p0nq0ZA<0NZ}kYyq&0`TPPD4CP8U#1)&p|&TN z%t?ti5VGF~a=(IYPJaE{17JUZB?WJ;KM|U7P9G~NbcANitF@CWCnCwRgr}@23z$ij zr;OK9J>oWRqO8lJxN<{p3cJ=`%&4`Kvi=S21`wmlk1?PgFDhc01) z*+Q4zaXT6voy$NCAiacXoucmhKSl5-VHdr1HH>{uP?8DP=pSS(OwzLf__< zaLJYPFilJ8*0U~+Tb353U{%?Ktl&jb$1zX2FMDE_aElowTvFDrZzq>W3qQ z^nVM!ihW)hT_Le2fse@n3r0^>Mt*Uu?bMv}t9He_svWtqC^(E^xJr zqDXr7dECI%A-Cq(Rl8zF)sB?)YmQ@8LUSkyJn#15D6moC3CNs%@8l(&3UPiJqnKC5 zAXhG`I;+Z7u&&8~CMa%Loi;6tqdF|gFv+{j-7H$#WsGu08H1GdDuioQXTE?GylPtw zIl8(IuKRlqg#y)S4#oa^g>$#&As9ji@Tix4 zgXjt(tA>^Gf0>ZsRV1S;2(H|kW2f-T87X{H)~`7yr|?M$q%TnCPH-diRD|n8P`+Or zS8?jV`3d@RUJoR>vI(A9(gE{w2Ba>rNLehBJc^noD{HsoTiTiOaz>_{l=bVt$(eFe z;@!8aG3(Mi249x^5n>=h2hJg9B!!O9fq9*3e5avmork!q^w_!PEIY;YwawOn~{jFSBfzrA1?mocKfF&cmeV7mrZ}@EBnQ4%6*rgQci@&IK>XyTK3Y+aVy7GIetDdvI$%ixz%Wp@;OzrnnRZo$(Cr@< zgOmrv%rt~`D(#NF-x{E!2xZ6K6u8FivagA0)AX&o6#4wDb2%^TOs-t>HYtHSAWNDC zxLE}&+mbWR>m)0pG_AO2ud}nx<&3N|DeG6{^E$jpv1@scn?=1dEx?Fc0bPKTlF(%8 zS~tLP@TMQ``(cD>8V$2DiY91Nl-tj>pHRYc21$`ZM=0UEq&2y68D&XZRvjy=7L>3~ zSXGOd)e(=2uBa>FVZ1Btq;)wXX-&%dmGI;!H^Gjna_SO%k)X$V!n5 z0luVLd+ii>IU@y5%KEj}H|R?4U)Qe*J*H$ed-08q9aO)3i`@bM4Ip%uOmEBc8P4cK zWDcegVdUV@?Wr$EE;ZbMuU{MTi@`)R?CD)i#1&62_AgLg4tjSC_>)BN=OHgz<| z;j7tc<`R4dS6|*Mpoct)knZ65%Xn=7NZ21C1yn0A);RcP^9UaVsU0+k9sJ5Ri{+A< zzeH<+>ts8>$WhKKa*!+Yv=C_<30BudCF6vyVs%#*EU!cqCUITFohMGPiyY;QA_pn! z-y584nPzV|k_wT$nBFX|Mp7De73yRo+ohhU_&!gSLWtJt$`C0`{vDsR6){Q=d^xBt z!HFlw2m;y(E~S76py*u99Me>ERu>(3c>8tcCvo#c(=Iowe|1SF0XSw8M zu(1!kS<|7X`?9n(s6QbYl(Z7@L%th4j5VfbYSn|!T^b>{6dEcH4_uo&G!|}V7>!+a z8=>v3ew-M5xMAy^y3Y)U)>iQQr%U58IJW=s@mB0LHv)WULvMwj{(YjF*FfYGKemBL z`F_)`Aio)=i2I1GfqZ11i#kcVoP}W~V}Q1bSrwN#EAlMMi@43B*d4)Eb_KGUQGq07 z{ab^RVRky_otp$bZ4Vqjh%+_kF`Cl4mx{_3D~8>e+W6prdvc5uTZwFCY}+$|ZNQp90566^al}|q&=@^Dr*|uL zXV@1$s2;K13ibH;YNoASv;L~o?jT(RZ13-2v*6>QzgVsM2hDl%pE`0rT*|PB2FD`E zLIYXr9@x2rA`Te6BD@=Lejyz<-9BaN=am0Rp(9LvUgw)n+-2%=OO}q(>h@WnpzORs zePjb)vr!jc{ZG}G{cq6GaxcGymb8;kj@Odrao9F8^cPhs_kc!}tW4vab&1GD))sYJ zx+mgRHa4M}flVM~y?cPO8IIlq+$6PQM$W|9Qhz~bZ4NqlmVJ;1-4E3A-&I%QOZ?RJ z_^B~n|>pm zVzCrxt!glY8oH$0D6U_Bya|^45q`5VjxW3tu&s$)oiLztKq92j5e765Btov-Mn#u* zNyUIBouwt0L17YgEEBvuCbzi<ok{|;G-4i5&QVmPaEiKhl- zn5PdRB}I-n7iPd+KKR9tic?ggQqk)$Q$}S|8I?`!9cEKwW;3PI6x183^DIi^q+w;2 z#Vn26n(-{nSk}~8*o5+zg=e?1VK~(c7!E1x-))?P#vV zg^(uqtglp+1CX&7Yy2>YMq>cRE#RpID7uwl95R7*Lj6m%C;U}`xFLm#E2=9Z-Pl-9 zG@J@8TK_(!>3YcOFBDhh^JvR+MSS(!9x86-Fs*nkuTA zOqzV-Zjh*Ks8Tfpszl2AE!+uJdi!H7)qVI1gxWaR=Q8;1%OU27caAIF2$=A?cP+5q zm70+=DBN7XV%Q=+h;i7KVFgCqoBX1{e|XgU#&hb-kvsfqIrKP*4n`y|kq-sWZ+TU< z^Xxy=xQ`5Ci}9DdRr!p6$2%lUn0kGV!}xrJPBjCe^T99fGGJwaLVXEH)&5F)XKaWE z_OMg4@`jKSN0`C9=4*20Hm;K} zsxnqb&_2n_j`6&RSzOj}okn@Z3n!gc9$MHI_~Be-qh)={=3LdB1)s#0b_3}vd=X;v zYy*A1VVXE_B|STNfNO6}{J=@Qml*O8Q5J+tQxtan`st<6fg7|32m8rH1bc8a8n9D4 zE_Ya!>F0NNWwel2n^E+9ZKhWavo4B4smO5_N#+%V0*dwUcE_Zn3sD zpAW~NW&PTG+`wO2mnnHYYHv4ADwj5KwO$ABU<~w_?HF^-Piirj3QDE%MkD3>G#O>@ zY6hNV_R=q!RA;+@*#vsti_^`ZpM%<7X^A5gauy1~D}GX#&|s5>0WYcwx2{u4E0&QO z!@=F`Zrw1O&i_@c5l!7Aljj+tPZ$j4kxzbzed3ejjkQUVMRixO97yWYyoEAN(XzH{ zzkReA>~@;4+ZvF& z5C6p)%`aD&2BZvtx*O8Zc07RJ0%jHGz2avE%Fl9Jf0IC&eosZ5bE)5gWm#BCcPNC} zURlbjq)X-b5vF0|MC{~YV(b0+)p}aiulLS!J$OQd_LD#<$rpYwp!X9kf_hVVmPcKg7A$FN7zNn@ze*Ug zjJHXX)M=7)k4u%>7IA*To|g4n1SP471$B@>(=^dnfEvkONd$KNsq_PxooA_41>)8! z|MH1=gUO&lcYUF;jHk`&HUOm3hA+o&dE`3(?c0xIs)T1CiqUFIZT5eXXihO)oWDo`Nr79Sy9J zrt^Y2^r#o@F!D1I03Vd-f5TD@{YYV)m7+~T)(MzBnWP;ni@IW2*;SA(Dn;ll)#PDj zTjTlA0$SE@jZSC*9oLXt!X__@80RO*X$3FUrAIU59FnU`p&&5W4yFfL>A~hB@`d^w zn&o28w5O(NsJ;%tZYyu$uWG&v+=D#Teis~!A1nZVbMq?2Al=@)2YmkE>NS*PMfe^uP$p60gspN|Wn zW&P&wWbL5M-!+%{M%xSKEDS)ys+f#lKjMVOzRt1l+03rNmM)Dmy)^$Yz=?O}({I$L z;aVez)m#d%fQRViv$M3{M?@$iR`87XpKpLYX{+iu!Od==f#|=)`EdN8ll9Bt)aGyz6Yco@eGKH<+{ns zBKjWtueZGU17TarF;;*OGd_cU9DsKb2759o3N3Pk!Op@(c*Xzzjx%AzxbQzGSN|Np zlmB;MdHLJFaQ2tA{I9tY`A@tR`QP(y1{O=+sT=y|@NNZn`w9We zdpC*u3-~R@Riw6ulTjD6$PwGaEYyWpd`7F*xLsTRx%r*X2`4O(Bynl-C>2%4@**!- zS_4yk$x~KUS&}75%X9a9)jX_hOFSQlLCg9r(Fw$$4UiHu=;o=4hzGPrKZBhauNjno zieKSKUduxg0%<%I*P;QWM(`}Q8b=F5r7Xfa0g??t2Tyz>TNU z>^2)UWXY}g5k&e;cM5WD=n z{d(%9L|u^-QBko{6dg-N#2HV*hKY>l@-$AuDt0ns=8=tviDn>TNLjDdyH?eW79Zq> z_?j<)a^Mgn+dIcaKEmMi=jM2n4PL;O@Zyjm=+2&ik7cFzUtqq$M)gob`_3~H3AFvf z!vyAOOc_?X=Iv4?rKu|}mpY-=z=`rQ_`Cx88JKeiF8r!dGpGiI$W&}9*!W$WrPfx8 zd~ewE%iwp_RfmfBWR%{W)nx*xYTa6)#?#xEzqm0U+ke8FKmST4(8+I&-XBO2|Naoo zB6RVJ|F?oy)9;BFWu3H1#FD58S(e8m^oIT!oWW$c48L%T#*1u&q zVMj;o7NiPT#D&t8mTw=kaMBc|VJQZN)|8h%*xFC%H?@vKzt6`7Me}e$KJka7q$_onN|OVqd6q^+8nLWQ5|(y#%D6~mP}+7ynnZclByQg~vH?KR z3;+-*>sRTM0YIe0YtiWrK#hr0KIwDsaIrUATGczHg!~#n>9v|`W*!6|BiIYZuFE6j z9-PSUcS6^A%u*O4j(jNlzOq1U1=Nh6PN1XChtp9-q{tEWGY?hd6F&`CXA0d+y94YV z+P79>?;AYPeyCT|q(#%DUBbF3%vhSmFq$Y6tg4f+sFO0wJwT$!1`V-onlw8*vQDf;c>aQVy>pZ-b>f*f7V=~gM*JRRXgiX35^v&N{M#p-y;?4jVBP%|Hy1vVPU~B8I-czIx-W z&i&%Y*i|W=|Ea`)q+@%{l~48TW$buCyNR;`R8s!)1+X~Bx3OyjhTqP%d@hUAfr z?TKb!dq`Qo-JCiioR;{{k(EKaL5JO+VFcqGbdazwdAC9$HWPoZH~o*rJ^U46Ye*sm zl#Xk1Up|8ugcdr&1m+=UeB%C|M;R)=8bjq*aGb z2zkzUQE}E5P1}S~owlWO+Ib$?2$pCDf`ydzD>)_Unp5q#SA)_t{DaTE3X?T5^uVj# zeGPyTK%_wzWQ+4bRepK5Zn3Ower3i0Jn2bWbapg@jD@P0{k=B_1-A4*xtZhdwZt0?ji1;CT9#9+?##0PBh zT=(CFrg7iwl&6NxMrKMXtf=+~smLp!W<`!SsmZHGC_ZIFK21H<0_XQAA9CW2Y2=%` zl_t3bju!~xfS7^G;FF5rI8M(;=0x+5IX>}!{BcUXnkp|+Q8aLVRyj+fGGb*Fhb*kR zG>xk)O+3}R$j0YHGw?a2tbeERv6{F&P$#*`elH+>CI;$keU^5ZdIK*N>j#+oSs~ee zME1gJqq3b~@(w98I~`9$iX35PvxW@OD{~oKHSU~LA0*6*)h20trZZhHi4z;HHA25^Aa zX9Rk<#;?Vb;HffpHKK-&W4$%yZ z11am*FCWIiy-QNkM#FSvuIpj?B!YfTybU-)O%(ks7B^+l%jfA|P1OWfLOuX$13SIa zPl_C&VDl>dKJkBGrJsB$b;FZ73Iz+hPR1f!G>kWq^c9-4ZX+HwQPMeeKej9V@r+78 zDeKjJQgTdGIaHq%_Mu`F;04Li0NVq{_w{RNXSNUQr|@@e5q}zSJMhta1%O#d19@1q zP@|u)_`gVZ9^Hd+z?jC_$jx2KbkLGL4k)G?;|8?=$4+aoWf|NM21mXQSC~%<`AsgK zS3LKL{{u~qd?}($^SVk3Rz-=B;eS-Js>x$kCRM`gFeyZqxJ}Nkl*cnF<)p0NB8b{GbK)z+xn7hjnJ;_cTPCAfm!xnH@;Yz9(gm?q_?zlt{a zg>T_F6PxvBF_;79;_EMOKTv2W@`;>Ed49b+o>%YoiT@+FbdoZo%ga>M4Xd(N#-(v4 zSe?Wb6Ga)fwP?dE^mtKrr8}Nc=_Y0U_Trv!;oQ#2MRzOAi&&ifhMipg)ASISF|;=~ z*E)TBn4U@Q>%T5xu+;Tp_`}@M%iwAoNL|pp>Yr~Ag>CKc{d4vuoAu7H*VY1Bqn=Hn zLaufoZNK?&McLQs6>C!D29^9(UqVN$`ehBdJ|z$RZ&;8EYGSErpkq^N|Q() zM$%Wx!>moX8&4S974&#U1)Y@jo0NMYx5Q{0#=bJoL*Qj3q#DNR7nDaAEUjG`2n0NJjf=+?q~u zV%bGGUi+Uj90Ljf2}j)TK-3jnHH}#6aT{tkfWI009gNw-J3x{UL*rrdIb*V70iD8% zZ4iGcZyom?^BxuhrfKEf!1UdblLztGdjhJ|gIRiN4>%njK#Cl(2h4*9_{2}Gjo!)q zn?2ks!rk3H8-|uWM5k>7)XON6rsbk(SkV?KOUt%oJWNAYmT8m=dE{25o0~JX0Riz0 zKmaN0-v-=dA7&ds{vCQR@KS%+F6eW2@>vEBwgr1vFtw09^26~+uzGGU54ghScQ>l<5d7g6XeD5Gwb-{xaKJ~t^_w1!O3ZK! zi~9wPd`Eg9vE8jLf-8;ARx^W4%hBa@#Nxo(H86ENJbMN>S8-sa>Nz${T!iJG4g?@Y zj!*PPEcTfW&cX+)U2R$-sq>d8U8^wpiIi}Nek@w^H)xpEa}ZPb+w z3!^S!DVKX>m6kGa;&m7DsN-$!<}--x3U)lBf=$Xg^ut-YhJ^39E&7y&y3%{K@jwS6 zxFq(>8RPfsH72eA2zbVQ(6k8N++0ryTQ&ZDq@k5TMYF|WPQw;RErw=AoN85kpdzE`&AJ1_O6`6O>!3v|=&Lb`p6LCccEWUE+^tl=w+mhXFck`zIM7 zb)_p9*^J7;z&!RwvF!We7pmI0+pPORys+w$s&53Z!t5;C&7XgrVu~lqiAjqm^Ock- zj5fH~f0YJlL@?KO2aS5SOgcE(j6CL#^e`+s=QuEA6UM| zM;uKrp9sWEa?seanO-IB7tz#+7LBOk()8=5P3L^@LOg3a2EB4s7Dbn2341W%`R6kLeS8?)ua=x1~Y4zp&AFOen&vA$lIVDW>UnjRLQ*ZyifcD zimWNnH7|(W-`;PfrK|6rV38%Cy=!^Y*3uhmn<`^zo0c+cZJ;RMHazU|Cd=LV<;1SS zlTUbzT2rzfwRX?Q@F2cOX`{_w6!(Lgq_^g`YWD}Vmj5qzOiU%A6NB>>wvTG=7UIB` z{jS}^xXMi%{$LN~x_FP-Uu=Wt{N}|tC|ODCfnGh)0Z%KWBQPL^jUY?&D2a#Z^;BVbOZ_al7=M%qYE+vL20e z*WD>so)kN%iX-(l15djRzKfdB%y)}^vltZ%D7An7_5Czn*`-m`9XU1X{7QH-uM+MP z{~PVerQDOnrjchJgEp&M0DYQ~6_`F{t%*GL0V;$YQ12^=GcK|?lV5O>fK=a2Lx-JD|k=adtr6k<$*&AK;MuExWyGMb1xDYw9wk0+t^+A%s3sSO zl=+E5+5;BgQ%DyFH0vuwJn8Hvp|j_7cauU#?A`N9s6O%krh7Nt5MJd)E;<%U1&7v) zmhn1{y||W- zKENOm3}!BE`}p)GcoqCvY-%CD^j9}uKE3_Cs2N^W(>&P|K}Td-S@#t-1ggr zh8hUyV_ppRFM@W5W2hI~ArQJSv7ZXXIX-stw7Fw+#sANjSy;(vb^&*_Ka{tzr?p_D z0B;wl-)>=4if#y1%IWtI|ASpt2kr8ZMXKpF z3}PqNuL!fGo;OaSGU7aCQ2~R7@+xH&%>Lq{Xp1%l4!FW?mUdM)nNigxWj$u;tn7Ns zl9K&jW;x$1&nat@LPwmo^UB)f%6U`PP2HsoDSOg9tbiOmWQnK>&Di56GD+;Rb~2-^ zP0D%<#MhNg*alh0-gDDN-|X|%PHLVpn8{0no;+x%-5ZGm)u-LC?eF&k6ZkAz)st&{ zz6M@>vo%r*N8PYf;m$APCiBX;smi%jxH4l=*`+0RYnN_%sKhSg zCNs*oq^w8b&ZD9y#SR9!P}n5&fVz%T56-ViCi7~NyaG+{DMOnAqV zDrxJ67e$l0^&qutlIe_^Bq{6G1J{!NG&CtaVu8mzFvO0gKqF7s2mGtqi44l*t{=9F zfcWeCo44w~yf#De{qOuC5%ji}5p{tJ|_GJl)`_T~SMCRMbdWk2cM!sFBi&9rve=u<~24zkQj2(y)g? zfz9~ZTJ6jT1^E1Xv-5%f1^?9LXtQfwyuZ46L5)a64-OJKVr5n5JeO1@xpDWMoVM*9 zpraJjTDxjy(5l{1VNwK8IpU39-AKVLV3|0w`#c`l#bG5~iyvU1qkTK@7Nivo6Wbe{ z1%pCaYMPcEL~1x23NQ6+0m|^sDIAhQM;P9`!XdeGR#kBn0`{XSLzZ?8LsIOZFDXrqP=j--eWcJ4YA}zfnOvC{Vb$b$3Ue!D z3>%4*RU%1QUbIyh<-E*0&uMPg&C(flGg8*02EMwPd;cZNX9xD*n;mXu?>Hpb?1YK> z2y8CXW~1@{t=eaBQ-L8b@`Epf-&L>W{`PkX8x(j7ylsP(_#TLRAOjJKWa`lRV-L5P zW-FuVM?)d1D4usZ9o6qvNZK$tsljJN;em*SVpX!wq&}KdWsu|<96f4e&U1vv*jsy` z`wbQaLap!6=E`c`{9*D&;+`*-<5-@9PfP8_=M)=Bp(D(2M(gP($I4;UMNwVI5Uy;2 z<1YiJy2x4DiYBUf-6p~l(b<*1bVlWml>MwI%MSOjzI8A93}>ns|3EFi^iq2c+4eif zC51-mi68Pg!1g{)Sks>s^B-JxVcU+iKA}tJ6ah)0BXntA5zr@oTCriIRAB>*m}dRv zmai6n#V`C-$|fu?L#!^dk-U2!CKR7~O+YSKhA|Ku0K7U%3pjr&CbC2xOicsGI=AB6 zwZC*m?T?i8D!#jC@|ofjx=vli7uKLTd{Km-AXA^&m>M`%^}}~LA)}61F}?PF{^5xARe&HL=0#^ zx2f0_xpYQFj+FJ93MDvE3m#!E)J5K^4)*`r^;-@EG#jiTt2_(eU?F#3)vdTCxDYR; zrf;R_(rU5)?V~i9jhKdT>|NmnVF0HyCzB#a7{I(y);@9n8KOW_Q|AsIwwqVep{qZ! z=T+%U8N&eylqFCv#b91pS2UG$uDVeART0c$N;prlD)wQjQoB@`&L|a`g{{sVO$kQE4C`1OcrK|L?kn#8A7Abqt^Q={O^O(hav!4Wje$7sX z?-083%_9}Ip4=HpN*tm6^Qw^K%8f`nUdJ+AO%l1;wpqn^#w(VzQJBOcOhoPGJIU-S zWHzG;Ny_?Ej1)X&vn4O`zOy_CaKI0+vR*#p?fUKGPlK9SG>un4l^u879{P&mqiP$! zlbTsWnqI~Oa=RAoOSo$os=`OMW}Oh9SibC?2AZe?(=t3wJ$duxSC!9yK21qi8K|Cl z@{Q2DJ1OGV?`&S7lU%u}JKjb`&AK=ZSsK?J<563(F747rh&+!PcTOg=3!T}FLMJKf z)o;h5gfi2Ok%O9tpuTyF0t@Oeg2S-J0aJgIqH2!-t1eIgTG=YCIeE}~zWVeoxWv&5 zf!H>bR-HcfmlQcdtLC*l`ow3%o%ah&2WXc8*g0ju0q{@2h8i+-reE(#el_{JL@wem zj|!ILWzJIGrK~Edh;?O^WW43_1aOC-nO&vLW>jfOS+6NL>$Kn0{A86z+$bUm!a%6& zj6tUv9HM*MxBM0z2PBpNsO4?H(Ydm{hIiEjkAC*Q2Co;(<+uJaxCWm5E!xY4yvEoP z`Kt_JUqEGJib5~GjKmVah=F_<*Ycj0{Tlu*Km853UoW7S2mW;#Tv;v3@S7L=zxw=r z1)q|a{flU}pQQQ`&OG@_T!~Xs=m^uC$FS@Z|ND34lh2-tC@CZ9rUUkxr4i?>ii(uQ zd6gzzR|53fZD)2-Hk(nDC1t%7a;{Y`gV((IW49(ui)0cO%e4VWDI+ftm zI_8w3PL$KBi%F3q)OKFOrceA#-b8(h;Oja>m-w`c{=`%b`MzQZOd%}IF)WpFDTBb2 zVPvY$8@H<4h39NW;hB{6tGahY@W@Q$s6mrgdA~QG@c<+E$Sb7Cz&=Ya0OmT%-(J6t zNAsBGHR?L7wZ~)hI&2a3u;T0Ct_OHpzYH#}{(9BGuU-I4eNi*EDbYSPxL!%NZ`o2{Dd%!FzRzk!lcjx!r6?HFe&Txxz1|`CB<|MvR&K@thWUB zd@JvL7=dbsMr(~c_7min(wx(2bV-pT^kzo+_mgAgG;Wh3mhJ;jc)`-F?O^tL&Z4MD zL?L6@$}@XCvn#6EjEX8L>)%+NB~{m6O7hR*)IT*9aGJCJbPy#5wDtfiJ%!}S;9NCA z(2SzG{`&e_4MCv>!0nAX887*4ww2kY@ng@1W?7t}nCSVj0DRH%Q4PVGp6S_LD9So^ z^ZwdgiW-$dzCGvGd46p-n^)WQiT?vfrI0VBNt%M!O~{G}T6j_!PRkft{woww8MV@^ z6L(%dvx~XejAAY+OEWRLmUG6;^itXnFjIb7@$hO3iAvL(p$bZ?zW=Mx)N;UO3jEDr zagZCihq+Zc=H9KGe7fX)kZE^P;t1uQ*L6s)%+o4ryC!87uo9+mlt`aBDwq&mSfy20 zrMbH;H?wP;*^C+|DeLtM{L^4vdpy~GsQhKa`GC1@)k_F_unZD$`_ysbLiGSauf=}% zt5T&8fVH{n<(B;N*>6GF~r{nIX;*U4<)F1L`Q(RJv-FGtz+Q{Q>EsXf3i^q zFN62nV7=RF5WAu;8wbQmW55|FqwJ;hi5jj?lt(;XHsYZNH(nv~0jIfoL|;lJ`FHJN z`}|RU0w6werxPZ1PHQD8bc9vSYpo<#u8T0sqr7B!R6$o$5;LAfDQnugj@zuMn#_%Z z&g^<=Hltoj%6hGe64cQsVNI^tw@QJ3UALf~IynkzijSat6=^;@RJ|$fzr)X~@KkQz z$Uy+n9JJM$S)D+>tOv&_vm4|!QJVCG+gcMpJRLiNt+<|KuVP`!EMaed+^ zc`JViv1SnZKTFRr_4eBn{T1r9q-}&<#|(x<%V`dGi@X zUQ*U)7p_GeQK(}*?Q~cG0qhmw1B`wc?`EHz=mTug4POfzt9v6ZkJ^1(UfV|8 z_gi5hn@_VC@|_f#7D5_JU9(i=A>(byS!mHhxGlym8|O31#-yy*V#vnY|M*}Mo8Y8< z>{pA!9JTKp7nu$gEk8A6PrZyX*42M}K8$IkFTXr68TaPbo43~Fb!4#nj}OKqUW_y1 ztRy5PDyPOr->r=k7;f~h%)v;R+c}-Oq|gx-H?MH*6Q5OP(BCQGrT_M&2J)Rnnzol^ z&{>cQ88($w)3C;(?R8tEUA@j{RIf={uSGhm*IHTCFa(U8T<01&QW&O{f}i&G$5yNc z!*`98*6>&_5C3fkbk=Zq@d3c^q8;O+G2#L5FwkGFnIsro{PyvM)gdgeJ!!|@OktIt zgX#eeQq<0;f=!u@GZ?aJ4PCewiXd2qN8|Qk=lU8LoPdPgaO1m`+y$18lkq=$NXoRS zS4k&~Ns%KAdtTYwCw?Z3TUoAH-NB1*Z3`FXEt*MeCz><$ree)`%xdU@NZTr7b(S`) zusDz1=4=l)#@(9Y_)n$1L6I0F1;SPowKP>vCHhckP zf1FH2Sm8OX*rd=Ab~vw&?-O^~A^uKdPxwaeqws2&Tx%oW*=E-O2#-w>2mwDKpFPto z$}GdCiL^~wRc3<47K^gmvh13CKBFd2%6cu!-wr;WmY>8HJdoe9h)8*{)b+rs-l!-I zeL(FmjxE;u;(@-p?a`VsI_8uzC+S!qR|&Z%wJGV&z6?GCj%=wWdCAYTi($QlxrchO z>B<~T4X0jBVd$P`OC4$FRL@DFBaCU@EMK3vF(zpzcW~xF>(}Gc!!3KI%Ma+3+Fg}Q zZewz*d!^qwd_=x>re8b!xLU07Kk5r$`U_z87x1d)Z2c-KljK=1>u8bG3(PbLCrbea zmd1I-s-){!X_0WcEz$-7DZvROL%OPz=ojVdNw4z1q)UktbI~a@mSm=Z z!!b3sFbTsmZ z?X_8KFv2pMG}bvsMS9j`0jQP^zNo)qv$lnt#{@i%n}cC<=5k5~EWrAxjJ(w3A)WLf z^z-zNZc^k3?VMNj_lcV=|5h68uErf6pZ%455wM@*59|iNl>xW&U$^kq7c#8bZiILR z)H*ruCKRI4RuGuc#Mx~#W_2O_` ztL~3(C(MLgd8an#uVPpL7qQgeuNZS!al+UUwVwzuoH45{@SJ&f_lq}j|K35${CdPg zYTryA-1basdpP?G9S!NW)&sZEif*w|^frnb?W*OfXZD@x)R=Pjl-->}giHz@VR`c! z!F}Q<0OwWK;Ja8Z*%-%&)@pJgjE#EsGzxj!NJp!!Q)z5*+A*FtDGM{vw4%tGEEaBK zvq2I03{V6q>!z`CEh%*qbJJpZRNmds&b++?o+pE-2c6wR&`)enX5BIUJto9-$!al7 ze>#-2H!vOyRxps4pI_erYfpphSn5^=GybmMDU+{Fqsy|tT{O?)A?bVzk`s!20Zywr zACi#I>n`_+pOlxAVabY(pJ9Xk{@COaoRNs5UQMaVdl)3xWrPx?(j62Dt1R*!x6#>{ ziF^iTf|T_JCr(0Y8qr3|=~6AfMVyfyFTK>QVK|5zH5!@P6dD!b$s1rpvnWUmeVj%r zO<$ibY28CJ**Fy#DBN^vE`ZZedyzT-TCC*811*~_XdL-KPNO*=Op(t6Q~1PBG8zuk z2>&W@^z*+y{4?FVkkechQ|Qa?l|Kx%dZnvn`Ld7Hi;YJ zU)bP^Vg|T^l=a3_q~sXhJ5MW89L^VDN8GUAK2CY9sY29Ei8R>eh6RG`?Borh>Ewze z{DGA4t9dc6H=SHLOzTo)B4bg~)GV#znDH);S;kAzbWIl~iF@lUY>+`Q17twTdV>qs zsu)uo29CJsN zDRhL|&BFlr#Al#x^eFk$Hc;|SgoQMMHcMF2LX4fXB`XWTS)N37QM5dh0iW9p?8<&I zqq0xR`ZrKFf%q7nQmH6X{_PK#FpX$srO>8bwp%R4o@Xw8$k=3y*iGq1+{z$qP}Oni zTPz+Hn;kNz$sIMArdG=<-UAcivX$-)N6*Htz{~5%%iTk-A7*C9D0;k$2l=J<8xxK`V=p7P%aoW&}J27USXVKk3BLt%ai&4eH}~hp&442sWnR}g?_g9&8N-ylE@EZU)hvmtj(2S&MCP7WRM=(n zVn*4Vl=a)nd7R&**a!ie3Oqr#llC%dDd3wiT2+b)?0$Q_=hA>WI3yG)2Ue-~6x134 zCQpo&47h_RjKeq&0~TD%BN9&*dE{tKp4Ow(k$M)|eL26>UCd)0Cs%I5xB%`D)}>(z zJO>r4lcZ%y)#h==qqNH1sN%vdG#4`p&7`bf7u}U+|GrJhKWUEEig9H~zRjigaKu+P zA73b3hg4qEZ#@N#Dwn#`BN#l@0P@D18{YXP;9_10*e8BURA_?v<7HE^R@7w_7ou)FiOa$+@D?))yrit(63Ah}He8sn z0!sFscCyC;nQ0L;EC+ntv{g|6QNF6GgL#)bAPqtOgayA{LAC6#e_~nI?;4MawTJ=2 zghy#wzkhw90Z|Gs1>wR2U+&OfvPMLy+M8MoZqzJcnzYOguUgQ9-z~RgA|b>Qp?u`u zzv?xEc89^rfH@>+>m3HfAtPiyg+|AC!c>X2G&FRe04y@4mf5C(P)_yD4}An7qI z$YbW5k~JxG#3nG04BaR0+64Z>*NX2m9!6o;Hlm4r25;BUiy1X^Qr4F=buD^);7(oSzgOUXdS#pxIl>6$ zRmOedr&SVEafl(EwYXmlc=qibiV)M8upUNwnD>3+(MY|owye6gDq9vOLOO|c8ZutR zLIx~tT_t&z`3O)7yMSKID4>(F?wX!!Nu*l)`S&BhzT{QlgdEg}-qs2ve);z8%PSnq zGAQOBoA2jmz7^m3WAG5Gz~8F0!+WqQf;f}d4AB5uN3ntfkD~k}@6vf*oL|Z==9RL2 z;-_`F0ESvq?=e%^u5BP8>lPdN-j_?Fu1&rO0OA69IRo}`)$9*IT!!4vnnBBL19n}z zm{HdzWxc0`pU@l*i|bD}g#J6){b9R*(pU1+0GEPZWAld<(5Wm22)+XtqYZU9?Np6X z`#300G1Nh2PU=5g2<*VV(qMWsq0Qyda13FkqT?2Q44gAd)AOl{b`uu?*i*k+N^$wK za@_cL{AH(0cH`yHHe1Ex2%-vi67)DgSxUaNQONS~q)RNH5SCZ~GoB_!dXPW%km%A` zzwdYOOZ`~D7bc%nKOMfIr&$eMc3f=b>m7G>RnOcAJcsdJEf<&)fn4B5-ZDZB1ONpd z*8-cwfu?5BKod9#mL$J#=T35d`M#J}zW0gG$d#`~n9{41nLoj|gyE<{T@d>T^*TCU zwMkevEUHVnpNJGDZMGfD>o6*+q^v99Ndnp>`(j4Po|N_OCzPPnK)s>-_DO7AF{g|2 zU?NfijaHyasn4w%G_`}NtcdTl2Y_4*X8K1v5w1c>UaT!nRy`{%dG5*l0{)w%djttSzYjoWp&u4X;KwwQacT=v`hWvj8Z=->n+&2 zR+WzIo3CEWBd_qGZ@B70yIuA*@H@&21#2NTI+KFf7Jc$A9su2fn6Qn|7=Iy+cB5uu zZF-KRfO{Qhlbksc_24E8H~rMqIH=4pah4cj=UaM)9QlAQ8zP1LHdM}|SMZ6S*%SI8 z4T$M4@3df$d=+M92?J_amWD8OJOR2M-lfou0M!Hl0zv)0xBb|FhjIqsft2;;NnNX6 z2A_Vra#;=~`+jSD+iBz`oL7o87F<+$;k`-DcJ>455#;X-Hu_)wDayk?shkL*;it3k zlOjjx_dFnjPu%FYbfX8pMzw|#-S8?dk|>HoLP@F1L6a6xbu-}VW+{h2t!PsQU0Q|~ z#I2+@9HE>6M<8W=-j!=ny~ks?_S^4Qp9oE*t^nTEZ#v|V(iXFgz3IwOVkN#`%I$e` ztGJByiJ%Wl^O|!+v2%V$ z!cSaIv2gAXz&Xe>YPU8^19riTRGgk|W%U}s%7*N->w!cL__4O~*L>5CN6=XDuwDz{ zvXSrFdEA_jO(^G45ctIXLop0P$alW7|IK(UUp!&0)ZboLL;**NFjOxpVwzrL8jMZK0M8IO>4xA!E;GCs zPZ(omnBG`)BO4=p3jMX+027Mv$7eDdyj}bp7~D8)21aTr7RB*0$Zr6&h`&QBL(l4- zZrCh4nO^`sz^fkM*SfT<>fQ0-Q6 z&B{6|SSg*yE(_}@Z$0*HgG|a9AQMv7Yu_ZQLOY8l;UUjcr>T>J3as;3!P|$!(bBL6 z?oef&-IQEqQjme;2nXZZ7}v$B9}i1?M#4yWW_sq#Dfxf@dj0kP0jtL?M0YmuAB+3l z{kY@k#-R0Xi|fK2ux-yUKGX`d$JlLlsJmSaj&T+Sw~JdD*2?>axvhg#sg>M+-djWZ zF2`i;6b~9c?!7n^8gF&-SN;>THc!ORw~!Wz1ViXZ)bdx~7p>eOaE_zGh!K0kIlvoQ zMf`iiJm8H_{G`1>eqGp$i+VQh5Mw3&WWWviS~}h|VcFzN@G4_zp2|QnYFgIuuo793 z@V0id2bDJ9rknw|A!XfFMN-Vqr$CB++12uF3*LXxBwnV?97b?x*bSJ-h>y_`r&S4{ zRQmLh3Z%#p3Ox@*;uAkfq4g;6#hUT9-2iB3b&Et;XQ0Q(SEAdY-n>8sH25!cqoQPgHfov5u?SBTUr@9SqdqEm=S% z7j>xX`9O?v9uUJP{*T*pNk~T8Ak!cNszH{9Ma!xr&KMA<8Mua9k!?suIRlbG%6b*q zO*UYl>yCJWyujUJER?jpRNoPW3%)aU)=u@5RxHIWvH%RbdL_1c+J~wkVg5i(LEirq zy5{1?0ve#r$E|#uJs|C6aJAivdq4zF%X7#t1`qvmcMlV4m&>5zizTEO;5NbMzwZ?$ zYIS&hVlBcL&p|VgLPwb6JT!w({Mb?V@;%8NjX|f`aNt){3SbNxPcu&H1;H>u7;(>_ zUc}P4j3N3L45!y>_A0k=+W3ZY2EKum^?3J`*gK6NbBuBzWhY3jxeD0BEgU>1*DNFQ z8Zl2Mrq;tq5Q($`gT&S+g)LmH)MuL!d8F|{Z>4|m>UZF^GMABG_f`eZ7Yl`LvN=Lc zhEH1lmKZKeK9tjd&POGb^H2#s@e{gH6t>d>BOK|0QP19%969J2kkA81jy$-cykJ05 z1sqjPmAji|D;t7P&43_~vToaOEvd6%2&z479i;Rjd@Lw43`(~DHrmb|jGvmaIT}rO z=rUMH9b`}~PaOcnZ3gT-`SCawd%nv>6jWD!Xt)DNkC~X>->(702kbmL33p%#mAisl zyyJ*3vyW+Dde}bY94mMCvGeaJdm-v+xE@y>gLxk zUp{~R_W!>5{OQ}&@;5zjM`hO8D<2y-72R&_mGP>y^wYCa@IivmkZ!}%GLmU zZqVikA61ASUEH;C>4!?X*!83jC4EL&XA`o_?BNK&A@S$)1kdfT?!{-~q zzZ(ICS>y0w+=kHBr}sb^-8mQrQs@Yyn}=cWiT~X?M@|Zm$oFGXZ4A;FEN#jPW}(y! zh9(&Lcei!gpoeM(=z)~=Sf>;6@S*4JYrcfq{l@JLQkQ`viW|3VRQS${n}94tF&rA5 zNBhIx2=Qaxt77P0^z<^gS}A|5AHm&vM&x3v@B?^3EUwi0{-H36e;S+5RWk^>pY=`# zRx%)%?yTW!h2Di-V!8O^aN}41#3eLijVR+h2d+R09bugF;0iwR|0c#s&R^gyQfV{b z(q?HHMXZXGhyeq*GY|`;tQX|!TJ<;pA$f)W1t9#J0|?1??X>UnAqUkw z$bnD%Z`1P;g>3(C9r!S;?GN^{e{#GKQ6#O92P@0F1ZasP=?iCZ&V&pY<481Z+q#?m zD;sQ3%>WyavYyk{v81tPyIgP?d{IqE9~P@WR4?UjO_(`#>2Fi_AaZrdFY^yvU>d2c z7YSe$1u}y0W%+2v8m*Uns|G|s=Eb!CPv@vQ9`RDIrS)4(<~mEd1QJ&D13=@058$aA z;+>zxD&G6+I}W2d9}P9@W}F#q?(^-cUH9@lLBr+Cp;vX0@y@)1s|= zesa6&E!(SqdvZB+F0fF7Y_oRUn+&Z5Q*BB^W;Ni_pRLdyER4ocDwiXufng3V9-2zpG1 z{4SPIU6rO{VTbmu3vw=adVlIH%HgTnY&01w;Z;V!{~2%` z@&!Sw9SlQbFb$2RsSKB^yeS#<+Q9^Fk%yJrR&6*=H3N=A%6e?o%a7t|swOY+pE^S#N7NGY~U+Y9i&J!VsQAQkoHE*bd6Orf+jjJYf~0?4#tKQI>O@SVQhTjXEt3MNR4?}4BzmnM7Gp7UQi-rdv~^hDLhf zn?*kW(f2DcEdTlxY4(U+CU%aGFa+xLm@|a|oQ9=|s904LCE{t!$TycE6rqKpfgjE_ z1X|W-2+mb$6QIR_i4MMt`za?d`D12ord?OOR70RAl4E5B0F41y%_Agm8bxiacCo{H zPv4Pa=ck3dnvbIAYra?f`2J^eUdsKSne_8N!SJUQ%wPv@Olb(fQwrKXzE(EAR(&`e z)P4E|8I+jR{W4=|RCYinUoh-J(ZitJx*yrPe?HEImi6nt6Y4_izMFsJ)8}s%{|4;h zs#d7!d_n*1YMhRErn6!4kAgvdY&$wsQ=LJT@R7GWc-=!kA-YpzQ2_@Q{(t1XYm?hZ zlCJqzxV5u0Rc1m7aYaPW={cs7>LQ!EjnrLZHebeYqr_90$vnwSsnoxIBLV=4Hv#F}_YvA&X94A_T@m0Y*?U4f9VH@6@3*Z1}9f2LBb z_vQ8NZq<1oqfO<^M%b60u#t;1W0L3+8~Lo6G5ZkJ`!e2oM@J+_R?(_y&mq-$?-%K7b)2@jny-n@SM z?elM6zQyjK!=^CoR-4_U3WagqLJlL!si7(AE_`?YEp!)zkhII&3tt z<{wl!PJi>|?yJ69&$er*&`t2fso3Gj>dT+se*e|8E|k_4+PS`dxEc1ZZC}4G_7WaW z09{*-zDP({#OLO)R};g%AnAn*onX2Pl3sqEnAsJ^nZg&DF-BxM_Q9*FBJ5*cx2+bY zPD3Z#z<=xe%e~%SIRxiS9;C|meI{sq}CI?-i7svP< zlWKCg`&%q?f6s}ZUMwV55#QeKQpJ!W&kHqCF@*nMzix{4y3tuvig1YWu}ZZn!t1Ju zC3VbVx)h^st4cW*-@N$s zr?%_;nwlp+fBW{u^OrCF!nF7jPcRiaL5mk%f1DMk?M(7Km#*+uD59tACxut0(0O=^ z>UbSOJJn=m*~rYfT-Lf(buNl&JsrE4#R3;Im7Ukq`S#?Ko**heDC_~h#vR5-{favU zefjdIw@eQ&xc0_{PB=j^Q7hNgI$yiYh$ft%d@Hgts7+Q?rdb!IGHW+^7pxFtcd=OD zE~c{c&->!LU|cjEr5>j?vZhL1o<+O>w$HVQfB5p}*T260`TMV!4qW0pra~vYixyq> zniZ$-A|dkJOZ)s=qMGa%DO2RWDT@Ga0poPLZi80JJd>>#Mi*6~{ETXjebQoqPnyck ztL8$dG?jlG@!H)#G@ETW&V_>=J;GgZQHcwkpm59l&U9wq`l`~k%UZ8=*VD8Vs?O}X zsEb;;w$hV*J_<4RJBtN=XDU0d7}FJb>HBJC!h=G*Z_BF~*^fV9*KbJiAO7>@_?Fv$ z{&rpTOKud^yIn^sv-&6HXx#MtvJ z7I>bi>~wAk73+67qA*PAbyxm4<}3gE=BC+x>^83wUX$NjE>2_-ZrTQ^dWJxZsTRmLolTGS@uo2`+H!I^Sf3LX`C>@=BB=SNQM3O z$s}DFOsc_`_`#{r2^zfUw#=;f2^E?53;MiUwd}C^&tud(ZXLvY*v}TOS+DE0%A|I6 zrgP=9(iU~rw6$wh8IOt6<|D^Wc)7p{Pi3dgXKKoc7cLchlj`<#$@hCNe9AQ*wDOm? zZ&&FAv`-+8|9sbm2N#P7#rwxWx(=V+#9p|MwK%^&ekDY3CHpS;>!UkBw) z)y?a{a)z>gsrJVx>zSAZ{bf^TL51ecLN2>XGbcWnMSm${e+F%Do?m~;`oDet`_1;_ zRolF4QxB`>`>T`bIb}EP$K8Z;hyM87c_RvuXN8YlS;9V(l}%M=xowJ4=i#(!CVM>> zavXJ#3!)BGcE&iU*deA#EriK_cc@NvAm+mc(QJ0Henw|E2cqs@_hoY(P9`ZX9=()x zy?wa3-y722*804Dm}1qW+FQftdfBg6-`*VR7?gc=zSyO#i>V%+_b#?m@3Qs#LPO~S zKsQa*uA|C!zhg)V3H<+V6AKYc{SIc4Y$bo(9(!HCo{%`f92eZg`FUbyQMpQa-NrKf z;c#9?AE#F;3p7_5soF9xr>RYjLo#wfNQTPJ*a8*nZGo5p6MNO``5(9cSzkB1_wChH zEOr4(zi!J|)@1ydzPwBaQ&pZ?K7n!oKWge8eZkxaoZM)8VsZ|#5 zaCvLv?a1kiTyh+0k_$pjRCY$kr{hdRwXvk}vst-xuy1ebyHB_GgRdSlbGw)5?ohk% zAs&kMpX2pJ(ar_dg-dq38*$sZaY7-WA zc{EKfi>A$qf3^!(@ovf0-^y%IlYMauVxeqB>a{gZ>)K4HNc*ucc_4ltuUb}h9m|r> z+$53XaGP8ZZlkg@7CIekn@TXFqEJh4Y+9pYW1d!cb!ul%qjI39? zexUwP(|3dkXQh9N2esjR*L=PDra!eE3@T07+sCT<6id&P4_Eiy;jqEdsoN%YV@|U5 zwnY#Ru6KyLjSF*M9E^yIxC`DPVTi;~H zGw(|`Sqm>d&3^uPGm_S5ROsO0I^ z?)~r%JAYE)Hac^xC7D!Po@N@g*2ux-oOXKXs%RE{H}azR9t%FgKU()F3#PA-q-%4M$<6gb8KsQ-xZa)eYksfQ1JcPFLq5z zCFa8`Hf}@Pn{gkecrxt9Xja?me}%uL&Vx(h%v9(EV^~xWb5{Jnd7onIBBfMq-MUP~ zaYTUtC$RdpSm%zLB1(>U2W$5h4wyn(#I+9 z!d7z?owA?$5-`_+DN-I+U+8kT`f~8LJ#YW${^P4vwt5xQ4X?v&tB;2&(Z3G1w6EEe zen8qYl20Jw%u)UQVd6JToa!zQu**foEN8{fsQLV;!1EzUnRT5?GWGUj{eI9(SIsCV=R-UEMK+jc=);-`|fDGhK>|( zf$S?W9BTg$gQp!}-#(zP%`gi7KRX-)V=<&YNPonE7DQ8y+~5L?N4>UeQhlY^!zEd3 zbVBqW__Xyll5RyObsuIl=mtB?ruj57rl* zrF|`p`%jOp&^*6;xQTX{O1X@kDcSZW3kQbhdx5O!AAZ*M4?eqY+SFqGnC!nWYp+SyE3rOe8_sk7X8 zF?h45^?sZ~K!5)!dVg6C!PJyfdd|dpFJNJ?Rb80y=OzN+5bKMyLECnr&m+=M2Vr$1Ot`F zMzc+33Lka}YpblRgSEtv&ftHZHk5IKfm)DYKxJnPWxCxg^D$GgS6%QV;`{#X-XEr$ zRiMtU`qAy(=BD13!O#BSf*v$WM%9$r)*)PV=Vf`rY&HcexMelA5hsD3z$ql;1)31!u6^D z>$ZhZVfyokSJI!m7LQDw&yUelkrR}8S&V*8{J&Y5Y0bypfty8tR;Jrn!dz4$>sm~h z*acNgEAu!~uNFk=sqBn0Pxn8K&Ru@^VX}YO4sNKf$zPWgAB!@KU*GAy-1Q9Xf{5`& zAG`0Q6q<2bfBehg&qqq9K0FOmetpQrdDN1kJ5fFQ__Nh+o1*vE54$e+vb;(@vzYte z-oM{AeM7_H)^3dBzkT~d`VGwd*y>D}-{lc{wJbtECw^g*mso4KH^yc5M?>~i?XA*H z;0_%trnEkww#u{CX{}pf!&XyI+ut~3uNH*tsqBpXO@{1`hC8`E(z2FAbTAQiN*-?p zsvZpW%Q*N~=>xl`t$BC1+uys|;rp+X0xlo6n>5mf%dGgJuBiwoy}8uYUTEZm$W02K~R=UMDucOVzp$t&(CH z;`{d5zS-Wf4!_TaO|9$k+wXpTrT%1V!)SZ++N%IDl(XAva*-1ZWm$B7PW*%$V544{ z&r>1jHuZ)X{q^p7bN#oyhbz2wvhe5sd0$q$KgVspBzIuwstmr_EIP6RloTrSwT|U? zVwaevj()6ZOBo00)q)^Bm7TE^CU&SIFqL&l#b09Mqk{uBwvY&W`_;$PCo}v_`j5Rv zKh8vc(m5}gSdib;o9)A{i*W?YY2q-Q1$B2^?%&_FB@Nco@6BCSmq+T=vPk`$_+S{x z2p$yvsL=k&n3e{n}^Y1@^EHVRSpnleSC58rV{_Lh7niI&0R}W!eNpuj+8L zN||Lbu}oEF+8V~ed9@%oPi1GUVKO*B#14olFxhw`EOrb}P0Lre+mG#C%mO1tU#eNOzsJ`MYD-C=RFn5gwMvUlc5i7k|AD;ZNHv*?}5v@$+( zPWmimZpFkcTTHjfQ{xD`S`cBUvNIaLpjjjr9!^KBPwJEVF#Cg3mweLRM^N7X<>)H@ zKA2I(E5p0p5HugU4vkwRynm=3HxG(M&Nub@n7!HegXl8AQodMXmC^W*8xQr}7P@HGuTR}g<@4{pseb>1C+_bK>XuAL3TKS%1p9i)~?- zjUe?Xd2OHAwqM5ctdp*l_M$FDuujzk;?lAXhS@liRq?8|_ulw?Is&A}$pU&ovH+Ex zvChe4fx&4$Qyhy9@|SI&(>%oev8~X)@=QPa-dVQ?frBa4@3-4sJ6tmB8*G-VyX`g> zvbnnt>RQMBJ>E(i3ImM({_9|QL#2;HcHD4nG>!RqCUcAnL-uk6>g*QWAWZe(-@mg~&PJer<0a^2=~T~9j$^*HlD zFUUNgvTxd}O<((&7~XX9!OJ(q)R@?}ot>pR)8P~t6G397#6!*bm*E+->CbP1o`$XK z=wA=fr5%oRzjqV%n{2;5{n}S4k0wUe6QLbH=sMHs?ia-B9R@;aB zDyzSsiaWbFd|6r1h~uZWaEgYJ-8PHp`vXvapS=ni(q_XE*2t*$q^7-pWp?uRtt~ ziN4%B%#)&p6XY&@^XS*@E^Xfs%Zl06sTC34!|rTixQ(4Iq(((tUANcUyKt5adtBM8 z=fh3kXne1Fgxq}-_P zwk_USXNGi1t#c}Lf+;P?{P=ld=BgHj3+9rUGPjwo%OVR#q%tE~;hRPUgYwg+G|sKi z3vw%{?7S&mUI>AT#(bgg+iiB(As*>Pa=v#;NUW;UvGB*gbyY}4yG_?T?%inoupw^Z zj&pwiEuwgrR3)H7Cn(;sMwN8twko7_Qe{OM8@YOs|C#TDhV%Gw<+mQh{EO zR6u3t6>qu}z*}}w;+-*v_jmHveHc{a0Oe7;hLg?oyF46nzJDaViHD5qHl_<~cGpQJ ze1qRpiuA{A)YRm3pBeYr>i*MhEJqkLdUso2#HKQmG)wt}E5w^^aa^YOxkZL93s+(xjvjTd6$ zo)pehO&5~>82jJs_PanhEe0n4)XmoI6iIT}4TrHu9?|fXgC!3#Y~Q$~syh`r!F-qX z5T!Ghu9mj;Ri<-`k~SHtYavhxvaeK zO4eDV;&@rB%1Y-%ri!&`ZJpPZpT4i6$MJr>Al^@9=XGRaR-z+JA|5FoQRnUEw!PZ) z?AX6KyZ1~FyGJmS=*;=;LaE3J8ndiyJDs^TxiUJ|4A#2Hbn9g1g>qS0$UI+*@M5*o z7dP}cCaxF6#HsAO#!QCAr>f*J$<-g%SAPmyZQcI)i`%<4xe&id>h!Ap@XKx5wEA9t z$ua-tr`3HMfGN2gQYP;A;eQ^g=lu()6WZU93cDlGsY~j*Q=t>IYFS-(IjiOVDm$-L7nOErQpYvwr+qjom3<#hI9*t_ zy;^5KY%I`KeS!J|KDS@vfkbvyqv$qyoV&B@}D<58Du9BIRjcsbPHbPF>snqq6e~Hy73;`o_dwulqc(e{Dad zOAq6Xt-H4J_Qw}dZT26Ck-C`H6bZ8Fv}tg<9RJ$iPtTu5c=77H)vx>GT%7iB%j{6H za?t2z8x;4`{rkku+mV@!F4r97J8_4rtaLXhupX5^^7jo&hxtIIyZ)Si9wuw z37JZqU=7R4h|`&+(cZ0X0MD`s)=)HMR%%scwXIvx6lLkFnb+?))@ByO+NkWjHJshq zl}a2C^s4=16C-Y2ePf~lmt4c8LMJG}vQQA6Svgm$R+_AJd7kOmhtM}`m914{%U0wj zucn(3nsF$|EC>Zr*?A?Hn3X62lh`Z4k?>^abnf=a&i>Rxa&cd0JikzS!%OV_f z=B8C;*@!j^isIt!QJ;BhZB{6u>O42L(9?-9W*p%#3nCm;c3wj!W+fWJB=#Eesw=Uu zdhA{XhwQ62t9|utq9m8ZBdE{`YO*XIL1z}N*Sgdu^R+6%*{UtFs<9%RtyHC~DZMDB zomFNWk1z}35ma_wP3B4yPx~LJ_;=-Xn6->GR?}f;7hv#EI&yzb`KQ>%XcxWfvExwm z&F>!S_c6Dj%iZm=7$Lpp*`phh&-%#qDBZs+oBwPm5cV!66%$oF|EePuIYAMZdDiL7 zwoyf?!a2q$QHLGPi_8_G%qr^}mutPw^^78pJ?mzHXPwH+Xuz8gcwmuYP;zY>-)@}fjCdsa!9*LMTGZJT&9|rxb&&e3Cg+5rB7!r zs!}(~|MJJ)O-8>Q|B@1GQ(41>8g3Sdz>WpxGuyw>YrZGqhkZp`Acg2QlS%cepyh0 z&Mb;`K?y25uk({ZiPOqU(=lE>q>kpp zD|Wx9r|Qw4(&eP#F2SQ*%}xRDW2KSZp)E*P&!Fk94jl|Bz0#|;3zd~kwv8zS*RkJ6 zgJ0krUEc2t?;bWy%7G)wd`T>X3Z0{thd z_NAIp=5Z{ftuLst;P()j5B*KkAnK z8}(WIOiKS6CGI~<`q!Okhax-SJ)bnY*?zo97k^TMZyGg?cQfvTbG5CaS%d>n{LfJ* zop$)h_TfI>j*Tz+WYH<3G8VXf=z7ehmv?`Kt{>*vp(;--#jw5Wj!bEWu#Ift_decs z`ipwwo(YEn*ZV!`9Fy#qr#n}5UuVuZF9|47p%aXASwM--?Au_1c_T9=Q!=L4S*43I zm}y?LwiLC=r;}>zIG|(~1eB=ktZ`1wI&r$9Vto_pk11W^&}v|4|1m0y6Z6;hr4CXX zg80GVz|)^|##Kf7JI;@L9*p`KbUhaj?LqctKopVw3QnL@WL^#JvM>{!SvG+&O(n8A zU)$(dSD7z;m3d#Ut@qx#83MKAFq2&nW}>q5YIs?giHeP1P$Ru*4pn9PgMK`94^7hI z*``lLk9z3y@WQ@|zK_`B?9*9i?y;`UybbAZpurs~ae@vm3+~XF>uOzkTjk-Dtz-X8 zyUu({49eTWhu2_{yXo{`I}YyH1;HIEJFkOtRa~dfBUJpahv4OreKX!Ry6?`{;}~MI zZM*#PA+szsKJKY7-ofakue;qpoH|UN$28=m0K0Tr4=P-Cr<&o2gQuJR)bjP}#eK{_ zy6=OV!+w5(Xn27~_}z73+;sN2yW8HSYgB!D{OxwPOVO!EYlp@r*_5#!as zepB`>TT+f9vD59X#e~8cg^azpH^?<>3sDzzPIo8S2&KRgV9-E z@ae`4!5?nkx8>FS`%jN9G6kCm2d7{N32Kuf_3!v}ExmaLHD5Zw2#1}ggY|Bj4t>+_ z+R+M0^vCd>;qtJlT^2T_GZ(E;wa86o3sZMRioL0HX1r6ydR>%lF>~x0hfVE*uqlS5CR@{*lXZn!G2U0t_rUpexi?^tK(aBbq*~qvmA}2)l<{&mey8o-yYgo9w{*1nr`-u(@k#m1FTovr3pi%|e#ecKMOhT0f4*+6D1gDm$fkC(%fogj{@25+J>Gigj#I;oZ{NN;%=#)8<4>NTa1{Av zUsL~Ws;Qs;wIhUdC9wZvI>`4`@lsqkr40YptM*TwYOh{)7hX3X`k3xMQtbWL{{JBw zfBqFQDsqCxFN?;~nO$yV<6N5+0dg~4R7K`1DYMd)wrGpewap9xjH9u3K{S@i&TBlA zoYr_I)xT(e>JwrPiuAA>Jdr{FxVE!#ySM880M*wp=rb91`vjcMwuZc#A$Q?^I~;ft zN{mtvlB>NhTRgb&JCx44(l>nx5mx1je%}c_zB~|XmjzxJQ;>UQCB04|*(q7+o z-A%euHpAtKc)A!WXVi6jdtdg>!7A2KJo=lzpO`gH6TWRM5wka=c%dZWbDVkiKJa7~ z`}^)If`s>PY@V_&Nz>Ew5D~tOpXp0)?>?5d!+*z$a{u;YpQWE}Y&O-`X|duDdpue+ zsYl-}67W^*iW*&^1FsLs5Q!7oRAVp|RF1hxcad`L+OEWPJUuZByCj}Ug-)=sW${!x zbDKBD7b;#SuG>t9ImH#*9d}1eoDr%@A-4w(CE}Jx7pS9a2YUGczTEl61(Bo9O~6R+m}HeN87sO z&0qqMjTtZ4KieboaDO#=tnTh&R#EEe6@E>3Y4C|C+jHp8n6d~eG;a~bvd}J_xivx? z?V3z>7wl`>U9hiQcfr0Db~?0Mj6=J{g3vCNowo=kIeB`bQn5}hlwN4I5GOlg8r=)D zH;nM|g^xu45wQjK6;gA$;RGK`>GUS|WZd|s@9SWv&!mz$LtVnI#bc_*cH6{HG~2id zP?f%#Z- zJEzWNAYt#r{|H^iQkZqtnnE{qT{XU#P8lo4(cWS~w3o`xYd@15Yk&Bk-;T9Z{%%74 zyS-~LwYnKKMu;!ZFMs$H4%yjn&wqXYX%l_q&wu+VHhcN1i@08e6?*fRUrFb!3D-w6(8d8MQqe&i3Ep%l!xc63cD;lF}tMAKI@D=d{BwegCPt+cfD%RzqMr zz69beh0V=FOqCel`imm_Jm|W-?H<;KABN7q7fMA=u$*O~WID4fZB@sv(3M%ot1P0; z%C%~;#+ydFx~SbuH>zSBN-h?JlBw*x<(z#lluE=i$jk8T>-a8xlS;yrhxd4Ww@DtL z{npW+m3reCyDaN|5MmQ-{%=0@p46jX;!th94O>Uj{6p8bVMg*zpLLF?IQD=Kc<>J= zt=(-~chRNz53q|+xs$|z+b%?{Fzm|PN{M2?tXmNr0;Zl zbgu6w=KAK-K`ZyYZ*JOnZzei;`ft#ApSo|AN-w7u{pnxoU^aad(VMUxY@<_Y6D(wJ z4Y8wEDyVaShsHXOv?x3Tp? zv--AkFLv2Ow^3*NqyNYUNz8+GEPXt9mvhwj zc(~qP6Q^kWsw8l{`ljoqb637gVY^4)>0n%8>T=kVh9&6A3XQw}JYAG$tMIKh*PFkk zLg$;^-NWGm&E`7&pxzXZ7W$tsKU$}hZc~@Xwu@!4Z921URHX}3W~PpJVCq=q-&a-E zTHQ3x=dyLvrCo|~Y`a(x+orPfwl{g#crq|TMPK&)W`bH=Z{ro1Lkh*$>Hczm7y5sEeQ2nLv#&hece;4#LaXspz7ry@|Gv`ZgQd6N5EP7e&p3XdARo2v% z$n?5sGGADqm94R^DwS*Wbp5(w9J??46_V(YH9(6l3+iy}I4)qxf`(>RKR-Ho0`Hj6vM+iNl6> zD7#)o28>6|eNsK$;?8d1N+nJ(h-FCtbY^E-DTQjXh-8@#P?os>Wtk65W&@H%BAYgd zaS}kWAPIoV&Ktz^ZR|;dV4{8QZmQ(cXMd*#Y`qq~=(X_WHl@Obw>D9CHvV1^rs&mq zchKGLqIA_J!`NHl)u+{P`>*;03Aw4MP5)0_r-1&ZbeHkfUkcp&8V*+jV+~!V=| zJzl*hI!%ZACSKP+s?KF>f6;8ZYewC*{zMq}hZ}Rx4vmt!==t@)SjhrLJ5V=xN+yXu zfWB?U-@y*(52toOCFbqGEsMX?nFpUi7Sq)O(}>tExAK`VDj?0;`KF#`8aIx=y9M!g zDm!lnlUJ*!GSsPLZw8PhzQ39A*f=^e9yDuws83lRQxO^Z1?FeoyBGEj=3_Wf-t4y5 zA5&Mf`};6jvW)Ihcw+ov+ei~7&vYz0oN%W1wIzES`REQKjxK7&V%q)Tk6Ftl(S0g( zg260{?$ep8*xgSBS}0|)&a?}*Qh8Bjt;ho|taDYm>3TJ89Nl*dqWe^K-e4y0flnF? zlYBjNJMF^mSzy+?n5p}Id)MEX7%~6h!bhKx+qb+;ms7jCi_xpqS8Y1n*xn~w5o4N8 z4CrS4ryc)>L&$R-s40p?`e!I5O26 zLYLFLZvq;RbKPC|y1a?`a#h>^gy>hi+i!J`&w61qjHVZitULAf<*Yh~!meDmF_hd_ zYv+V6vfSoHJZ9GMntYqZ>Tkw1jW%w^oX5EhZb5DXm7O=|$*!I+UcTwmf?oYh z(t_v!2V)MhtM7)OX_tP`_ecu=@N3vY%9NtB+g^R3P6j$nY%xEyexB&=JVbTJ=}B?= zzOF6oUw3KIuDb6Rx52I%{SdU>d(ZkrpTT$jq^;t?_5LjOig;8dAoj=TgM1UKkvahn zIe+`EkKcUivty5Um5d|Z_9NZxM|#p?yB}_p^>MTR+4~@OSHibTlNwzP-ABoPjt=?t zUHIj94|S~L#Vr2poDM2+g2gY(>7X+Yn{*aUKb(_=&U`TbtO&MW2h)$1KW*{joDR1j zr-RDQTl{qSa(26cip9{>*s9VF_AaPiEbvlaJ*0Tg=ve$T@RZJhy-{U*@QdS+cfr(G zNi{B}zfB4YrA&?S+hX^)8GQIuO5d%@s}#z@(7UX77*?E=dIbPOjLgtk?VP!&MNu+HLn$qcD9d3O-%S zU0YsX#qD|AdU5!@%vjGaQ$R&dFx6$L9CT(^3E^B7%M6z~)3$E2(&+GCsm;7hZRV#< zb)3rK7Nl}e*?ChvyAv#xc-k%aDji*Z2wE7s1rt@cBnyBFouCZMvH$8m{)RVP zOgp=ZwVaQKlzx~PZ{o#pc>vrk3xLy^%PO};S%>Z0$GTOOx0zE)#+!+2SJy%*F@1T< zjRW9rK>(b}&g;U&tV9=>#IJqloCB0b#rWpsE0SJJ2NGYeUf#7s^VXa8<34jke!co> z6E~ms(GIn_Z?AVN^>u9N8cRlntyGUb8_uV(X85PuwrSUWVZ-k4%H1wrO*DrO2TbiY z6`_VrV%edtBIu$y> zHkQTA>C8=Og(z~FS-%cj<+{>YS*j*e?YdYiQP_H>ahV^-%>9CxIhCEYjj36uU9nU$ zy)VnblNaDVDAv2q&k>toM&Ch70_5(~A0|fUZ%-;RuOWU}G?~uqi%OWvm6;U2%(O0} z|K1dt3nEfCQrcqr?diwSWWOMqOl9XagvNxS8YWSasTCLA+V`bK(BwNp$J#dfQau1XWrVXQeaSM&^~Vb!KcC?*uuK zIbW?a*SOZy#@VWvz7yofaaO+|&PrwHRq5ku2P{B^krGVkk0JtrWU5GvpO%r!L4n>`CX_yE1h%R6uvF&%;q!> z82SYPLn=G3FK72%r4qfqyo{0bE+yo}6HPfuJ=g@3>T!7h$}bB*(V3mMZ6We9E1I$h z=lZA~#x|MIjjFY8yq~GY>Bj*mzaRibW#`r7?8~)OqF0Y_kc~QUwOP0Ir~0ZrO(iZV zQA~wSP>E#`3OaM88lj{qvr@|N#;9XQhc=IOirc1X+R~MC$Jud&!Y_zWP}zBvn3$EQ z1nsHXsl-rSFJ0z5K^ZRb-BY0xlwq0gp3YpO7YF1xPM2^Q9ZsnMLjNQGfIU{P>*H)VmkBS2F#*= zDAPqaXO!BvnW?T$Nem`Xf4jehKXbzD{9mNqF;f=G*i z0-|(Eb3i%-ltwxPK^mmH^GJ)NAV_z2cOxO7q;!WgeD7xF-kCddXYRefZ)Uzb^UWXd zTW7t`de*bn+MKh`yZ7P19A8FCU+|{m#W{w7y>GhWJ~LTk@;WbdyAVSSe5d6+9oj}o zyAaXBt}^M+`VM!miI3nm?Y8gQ29Jx+7SGn@Yo|*rt}oiRwCJLT-K_)ZFV25&AKNR$ z{|J84{ypw1c*8+j+~)u|U3Jy%d{7MYHMunct%klCjj3b?YJYeeMtmNAi8RX!ZdVU1 zb?a1G7?xSs`Y`A)BC~)O2X00ZrirbVUF-81r4QK-^?cAFzWIdRG7+~yL&CBnTDr=0 zi7m{dN{OawGf`T0z!?~AR56l>nG~(Y3-k*p<#WjLS*S#xltZYUt2K7x(a=-~>k0LC z0&!ohh`pH_SAG6#_$_Nbp?)4=+__ZsW}Sv?pY%6x)w)f&_*BFnsJ$P1?<=zYEZfoF zoBz0R9{UsVL{C3l3cGspG9G-;CDzUHLWLB8{SbkQ+mRT+uR=#BOl{PMEBGNV~S#x3HHBxXDKN?2BH_OZDdiTHpR2xqb0+*&kp9gdeVHT$b^)VoQexdqj&KRv^4nC z!$*HP=RJ%&7XT&u%Rc@o|HF1UE#Ud0g5Mk4sEh`c%U_YlM$!iIsEWy=JAn&{33dH6 zazmfQ3SJ5x%Ff0<&nD%@~?` z_J$unz`q{d*bR3&PF`}A4HX-k)BkFMrowWrv2a~n8 zG=q)remvTs3SrU%R%;dG4CWk$47avC94)z9FEq77l^1Lzp2Q`o2H8INtobOXZ6o1h zYjOR?D|h!(;@(D-eoAQ}MXPK)&CN5}G?{46etz!KlGUGGWo2S2Q@c7(^{AH3h`H3W zCx2Pwp~Te+g0A5uZk#RQop0$);^EcYk=rwdXBi!DuAN4kKU#4Xt8PQ@De0o`F(#kU zRJU{X;eE@9LZ% zKOI$(Dg^25RBXIx8+mtB5LT~MP>5_+w)RF#AO2BuCK3xKxEcLQ;j>c)Ztq1ZI4_Bc z5t9(#B)*HBm(%@9TU@p`Ys*k=EU1_QaQc8v;*5`Zg3-JC6I)};CX35EkK0`0Chl!+ zhNrH5WL0`p9kysWdEa+H$l)$H;mTw<2pEY+vs58`KpOwvh}(fsk4Q@D{v~Si+ZQC~ zBJD^XPrzSzbax5g!6&vwGPh~%{L-t)tDsNT78%4~fNvNMyg)oN7$9LhlX8M`Ilg+& z#A@MztXan-8Xe&YxSm}1Mph*_ej+rUVMui=K*z#3W`2g3N^=3lNNsuh3p>t0HiLXz zh287U);CGu4DIR)+=mtVBT3(@HVQgpsD7KQsh^Xy@TQ*m*#oo7_kQyRFG83VU0T#; z$w{}~6EKsGG$eYUIeYnqB&Nc8$x`f=>-xudai!+)ALxqZq{3oK)gQ)8FzL9w?0d&< z(D_wu?&M3!!I^EvVwAM&y=Re1b59bbkI^FD+1{Ju)RLi)PT3r>KU915C>Hf1y*`(# zc6F?Qpf z7Lkn>I<1C5roH`U5&>piDcHzS9sE7;Dkx5b)!*ibP31xNPrFb1>;3a`Klj{aMWqIq z?4S?1MH*dc@Rrg|6y!}6JtQa;rl;6EAy;nz!x8ayQ#Za zMxDv(sUo=K9}k`$$Q-klW-psW8oPa;X>Grc?VT9_SNZ!Us$ZFp-;V244exhVU(XvK z=Tv@LmdLcWvNXBHKvb2Ky~%v;JSQ4IFwl~L2ajBKuG9~;x761QRcch@=#d(^n@Ns)%tCDXBI6D{Wts4aweK8-tBj@Po#QH(UT$+;|+?SWY zRu^_SHPFVmG|9*KR%Jcv$#BB6%h_J^{IfUuO+G3|FTx7pXjD3Kp{y?Hi(|gK7c%?B zOY5hSe%b8jk*fFE$E(5Qi>E+bQTMg^913^9963M~7MGL~4_f zrABH>#ka+mBc2Lf!wRsuKPM~l_5NzUUClr&Y^<$uf2iA<<@rd--8fRl`@3Z6GzMgi zXM%L`cf(1FWx9)VcM2ajOw}>6cL%+q&|I~RW?f2`-xP{Nd$ClKiVo6}h|qQl-;=`B z*39XH(#D6ey2cQR_*HWSJRaV}@~}1xklr?9#G^^>>AdEPQD4&We%z-JbWh1mT{K{z zuBu)m-Rxk>;rZt9LjDZ zL~7oH5jwbBII?8q^0-b;0Z98TCd}HqMw{%L^CR?iUd4H%w-MbzD=ZmFacEgfB?tsS zXoS?)4n#V!s0-$Aa=ddSQ&OEDC*&YW8-S&gd8ANIB6LgB&LQC>Ck_URJ1^#D=S)9X|s(V8Sh1QFjb!m2h}fpRa|UJ zI-Bw0gnJXe$9MmS|GxgYo$*tRt6(nF7Gm0T${X3vDe$dZaD*0B8e1j=iADi zpTmfQ!;++R2@_o*i|^&Bg{iuWde@WoEoIy!z*`SLO~Ndw0*Cc)+zMX>9a6*ZIEFtT z5&BX0T$?Q2oavZL$s)|w&t30n26N6Z9wFz=ZXpSeFJeS z=5SJh2$ZnIZ1roN;J*D%mW;$WG>>m3b2v#())DHQcdoJqA6$G!PEJpZYNjYiBtmmf zmh`q6KyepTb$fmFBoqH|-wLh)Zmwl#F0jn)m?uA~ZWXX=vcOiC#9g^ zth{y*GyV&%C(XkQ|D9ztOwN0-FjC`8wl$o>Hzk6`FT%4%yoTPm)w4*hssJXPs$^3# z!W?tPoO{@7Y=|XKvmB$wjEOrOPo#P_wulgMHG}vFj6s^8gmOLS6z@R;x8R|u%|&EJ ztG0siN4Qwb?ta$?Z9Y`F#*ytygys**z$?)sQsK#5wDGIs zKS_^6^#EPXCEKvxmGIb}!vS6OOT@a8rCVw*P65Z!hj){uW(=bdRT$djTf@C+0(Q&o zoUupTQ|T~=vH&nM3^{R^$I814x=_i@-+4__YFpS-B68M$SyR?C+<^u#uMS@nI56o}4dKpUP5Nf!YJhtKz-mDr?Zc|D{N@E)h8n&A-?_+A4}_593M z!WRUtE~_6$$_@927>EHp*IIwNSb5PYd;G|^UMewX^)G<~byb8Fx#@EoZJPL{cgk9Hr{C#pM@de$J)Cf*m@ywgZCxH;q>Q|p5vB%hb><@x{q$`* zWKmMdM%&WZTXtmv{VSD?Ks|r#m$>#w(54OF4QmD|k8L$P&?bSTP?{I(Ywh#YbUcM$ z*(ZYKax~=7=5w5!sHK=gs3CSnu0_en&%z1M;xBY86K*3VX^^Xm^R{s@M$1 zv)Mc2!hZ-W@Kdh}offIsu9`hGTYs{?)N&VGZbo?%>(>MwGW`kGxBG@n6u)*h{xpZZdq2N*mtv%7 zDN3XNR^sS-Hl5p7lcVoz3sAp zj#$9ho%zN%SMclWxtESa@eX4rXfODbCsH(t)5_x{diqKvNkALy-PpsUNt|D-y~@vM z-+oi}KIhSory4HSESo{pCR?+)VZ)%P9w#TOJ_gKiXaGlCi*p}8TW86{L}7D(O;ptK zl6yH2(yFgyv+sHCAFHoh59*_3dk)mD*!-7mC)G*ZZ)v z^NZSk<-GT969qmPL>|ts?c^Dp@9soxT!MS^?VVC64UQXY;nlEuf)cZfdiMjXu}t1U zkE^sxs>ju$msk4sE|uRqdUrgo9$oA%!;dzW2X)#;rRrJ^t(32NZBy&{F;8=9c>9|_kZLUao%=h73|GZo~H-Oby6c%Xj%(?{rv0mG4LVEMay4f zBGYc=&X;=AGTN3Fy!RhmDxXSNR;bQrI2{*Y6i)BtIcF!zd0f{~9Qo?t!AO>WaJXqc z8iQ@cQe3}1u`m3QvT&d6)|*yUcl*kExAIHJdyV#IAroAcIL9#5UhKl-OC5I?hsyf< z*G43Z{j-`eT#a9e#E*0Jv#xfP+8Qr-@;kS$&jKv3gs+}nz<wpHL&yG33!Uw04d8R`>SoRTk}I zfj{iV&w1k?b4>d6Z!L`7EU5fL!~-2;Z069#jl9l{yzs(O^1@Qyh5_fgf%OyKjXmDn zf4y*av#{|G3-H2HlEPBKhJjl@`#LAShfb(d=oqtW8@stC^*bgV?b$zDv>*TH3$`~4 z{WlBGz(V-McQPGgK5b*L!1&JVUwF10lK`}0(f%KyplkqjaZLgXTYL6Q9UJf9g|@6W zu8=+6>BSArCiTS=UZO?&iq45@;=)n^@R964U^U5fR`lxz+HV5E17j}jm4y@D+C5$( zkT-0in!91Z;%5E5RTkeL?L~Vg(3ty$rT^gCzKN(^+}P~g*aQm{Hw*4{17P8NkN2Mz z0!9z^?0+xXzX#;-iSM8>Fl}S`UBkM8WW*lF&jP~Hu5}~HLehfTrt&N_6ouuqsgZD^ z>3d4uow-}+c}qg{D5^F~1V{`#xH57dXwcqtcc&o}W^(eJJ)Mh9WZ-Mk(}+n=L3-ca z-Gclm(;jliB{B$j>TATMr+Ake7o7wWc27|;ris{B?1fs=>yX3SGd0Tcp(08lQa`;djiDK&!5+gq38_jEcNbqM**o(&uV5BMuvnV5c#X!nIl2pc3B52C-ZpuN> zAV5(?-OZtFq9b$e>YhR_#X!nO%2LLCN6?h-?U{>ULx7@%T9iww~d`)Q-@+sBm5zSENHPAKb(I=$mG^DCjkS3&C%JHgH@Css@ z$|J4vQ3_&w&1kIhsWs`n%xL}{DC%>tj_C*DNwNIOjpr5SG`f+}0EeF_v=9sy2npM( zo?wRR8%FzyQ?!eBPZ`)nTjjT%Jek)By88;GHTVK@iAw=3p;15p@l%?=l=W{A_&*y; zP!vP0nQNttK0&9c+)}YWS(#0TN(Y%FicOYP<)syi7T5|1Zmpcq`S%3yS08O9QZ@^mq< z5|@5ZH)UCVc<-+i`d4cJjreQj{>MUf1)-)MJpD7Q3Yk#<*`WSMXG24ig`h@s0Qy7` zYHd6;svadUs(%3`g`ne+=V zj)C=}tjC&Wo?@Ky8a@vC0Hyo#k0{)S;{afl4*|>o09i8^0Om9R0Aa$krTkWv3dB_o zaTP#Z|8Jq2BlJIuj3%`A!WnB%f-B#BA5*O}?qzBeta;m8(AY9nidp119joQleqOPO z$MCbtXhL^yfbs9XtpBLK5<=4|znK;)G%d!PX?dAp&ud_6n%$nzn9~rc8b_KSZ7Cl=-~X9OKyH{3@^Oo=UX7QF2ixKK-Gu za)w&=R|)$JwPIQ|7nN;vGnrySHX$bA4BRrHgU z{!J(WT%E@tcC)L_g&WrTQxyfm!?PDc?{-Z|BoSH!9U%ghMV+fuhS(0$q4b00ZG z0}QDsiw4Z=|JoD^9fKyS1`Rjx-#0bT+Dy?Wcqvt6s>TtEfrdL!fIY53xv$v+t9%;G z4No&n;H|2l{430&;yd#iXqvBa3+$W9!I|s-n*ULK2uO0fJ;A%V)k=D->p(GHgLZyi zv@9?=A5gy2Ob*NQ!g+tH$LLCabo$T?p5(4}pJMY!0^wExP&gkHJ~I!6-+{va z8$k_H%`JGG&zGj!{f(eFO#UkLmZU<_>G1P$8x6{RfFdnkX2WE#+ ztxnU$a^OML1GA&3)}ZNPZ5WTQ2btOLsMhY8Vhga+|G?}xN(7~=*d08We_(bJ)k^ZS zI2^`9zM$TlLMFeLw;~_j={SB!8^Ha+K+D61f4j5-#v|%Yws9UsMOf4UY$vjfizq6= zqH!3{KJvz86qQiXGH^SSZCpiBnH2qo@w7RUnVVoXlS{mwdQ`caS+R?6^7{4C{i#Vp z#DIzlv6j#M=69`4Twd#v$)8UnEjdoj5vBHn*_VWf?r1Sw_%H=B(-WYT@6oOF;H_8ee~gcIO~(!u$^9vU=$>nPgw7 zMI}$_N8>FJz&d#LV;R99nX|6ntAl^TF#$Q;X?*_~8u>xqiuoO(W%bc%vcSI50+1oz z*xb@qmu>Lu=Q4s(GG{}-R}cS&YXWkt)A-plG^T^RWAi(@%jyTyWL%C zxn+d6$($|yUL*V)z6r>gPU9F{XmSU6L>6~am(|&4$RztqEvk4@KN)X<0M5a)`DFyN zWX`t!htf;x5;J5iqRHjpf!vb1{0teASTbjO|HD^H>Z&tjo};A|RXn&~joqwmZ}U5i z6LST0MHweq+ajn9YAh}b6(t{a^dssCn1v^Z9Cnv(SMm6!@SDLCkng&TQ*fbC|IQP( zxFfr%9xy|eI$26sjg&gc{+?g~9ihP_ zqTQ1fEcb8$^tqJ*9LEb=RA6ILt`6J-HaV;_`4)@a3MT&*k5`JppvdBZE-@pAAWp~d zb6`?JruYbCKDqJUm@GHm(U!RbU2aA!fW0w=AXEGsc%?(c^z-OH>T%}cQUPMr5X1%{s}*^K?qU`n$NqJfHIm9!<8JX zRLpD8$GYOlt`o};Au1rAg1`zlU^C2sL7(OdD-dT6ne#WMC1fI2LSAdge0XEpLZnO}H>Mk8&fl0G;I0}pWUF}4FBB$QAg$Rbe9(ur zs?R!!#J87hBL3x#=?|IKH)f!W*G8YDCWfZ5|H3PN4ddVZC85S$oza`CO~F$wGs$RlJNt))vj$n zLI-JVDs^3%B5F|=ZG&bQiBn{jESgU=A30!ltl(9@W&vL#|HFH)T6CN6f1&?=2b?sZ zW{pD4N`{)XUk3H{E9k2qKj6*`tJsv$%o3afXZ@!%Bp@1mGuKEYg+}BWm5^2 zRST8He*=9BLFFN+lLiDGg`mk0biWLOe*J5q79Sv}55#(Z39!ykLaetSR<0XXVTctQ zV*SfdIRFiFEOXyP{NB`D4`CN@UMsRFX(ivEZ@Cm z6Xb%Q#O+l(wKd+bzJXXdZ&*nn)_#c9^hN+XB;XSyVC?T4x;P5Slp6;!ZAzeuqM(Wr z^Pq|hp^9kDKt(+2P(|GU+I&(5p}s;W{(K1a7DCBGC?^dF^=An$a{thx6N!z^!WAWa0+-ViAE^eGe zVT}8bNE6;Dtyv} z_4ZskPEt5l9*zdPMQTxVB_ZvEmhN!(TR~=Cp8gdv+OMZ|t4kayL`jLu2We5GuG)4s zp9VwZ1%5oDO>_c%LkcXM_qp&+I<>KfIy=FWC?*@{3n5y&!JS?P^upwRSh3V z`gVsbv3gFi&U!~*3*h4R%lL0F<2EE0s((uMM2f_wv)Rj`fb ze|($=5;=H5Vws9=f>myUgP~wGNGuZlO>jFD{J-FT-3`tZiftq_LD&rHxU2i>7-tGv zea-U098=Lh|CJgw;Yx0||7p-iPW!-VsM|~s&P;L4AmDwa1s*n<3F4eN^sfkC7o761 z&H{?d+U0{(4-j*>17iLNYA7xID*z`04Iug}6nzMylc9{GAceCtNFfg~tbr5)_5TQ> zNPd>m8Su4#1yTN5km7pLw%K+ZIr+*>@Tzl#d{7<7@$C5Ygd&ALxs-hOaOYqTCdkEa zEHJl5v66?zf4P`=B>9^qMWQ6&ls{6SZzW<=PY`a1bKpen@^O&rd#fvXH~I3x4Wt-A zf&t_u1knc&d;m$G1dw(Bc>=Ng0Wu6h-T(*(1c6xk0mKA?lmeDdfaQ-6EC4ZpSXu#u z7(hCU0K^|aSRocY!16~(FMy~)5J+w;fD}UzBLHE5SfE6IfXp(3rA8e17KbIQIjA$Cw~shX`=}GawG+gKz>+YybpJg+fYQfMj=OC@m=B^q)YWkryK?ov!X{2L^(Tho`J5I%gLj2bta6`&QxvVao?H zDc~tSV-Wt&VRl;pR`VOc9ykNo9RUCfAP2Df05;xvtN}ke(cTc|`h#mE3`)=e64)(5 zk$WKWha-rz;0KX^3k(g?;RCTXLvrU>Q)Vx#j5maFpj7{QQO9`~q!NHqkwd868|k=ZjM8)SAzT|f*us)94U=BIG+Y*1JL?cc3ORw502-B z4^Gc_Q%^7c3FcaeeQ>(yVh&23HEVUfI?=wre9(D3#gYQ6c?L=^_|xUpC9uHD0~X}& z{7KyEHWa}J7Pi4cdM%*(k96J0l1Kr^jsYCztJUs#^1Lh1!(x!4p>rX zA%-u5t**%sUz8yDLmmO_|6@Sz{h(GIsHh20;wdL6_`kL5hZ`u!0V?PRD9G-ZGld9p z9sOEN&X5=eKJ6Qy0Pu;)1K98=a2*~3*q^#qpmUx-b^RICe}Ib?643~W*a0FgU7&aU z;Pv#6u8DJSE+zaYu0Mwg@Bl^511`4{z(sKdah>-8E|7=zuJ z(|E8A;|^`g0M{CDSwgM^$dw7XP6aQ)n`wC%v|BL<-e@1PgPn{&aoOzySJDMQ(E?No z{Ja#L_W&2vq8Ct$MnQ{y{@=M~|ER73O7d?>`7`SNde<>@7IiuQ7NY-8-k13=*#>f5 z1-ni-(5};Gum&kpo&E*LH3b5Iy&?)|uSf*!6}g@WLJWft zgA-s7l!x{O0N{)t+B|?54nP{WkG&T4`>)1Yd%8v;yjQ_P9Pcwrsp=gk7ElUSDmUA6s5;?7%L6Z46#7ZdhLL zjl$2*CcuBxy!orcRJdD!LIR^?9P4Hd;@&Xdf}xtu9D*GqLmUAhB!Vi48mNpNSf_-Ma>#po@B;LFk;Ma<(ax zOmKGYp~3ayi23E0#qypEcU6@fPx)A*q~2RU$8)nH_v$sXP2AnxAB?pcUyNQ~HUkH% ztKqEYE%2au+Al#lTkyN(-YczzvYRf~w(d;#gw7V@#K-*luGTgOyN|Dxu6e3YzLu_1 z6umH-AN0iu%DKTaap^Y-VAIyHa z;r)zk^%w9GIgpVlWH6lgDIi7J08ESDXW!934$c|V3j#&n(tQW-^Z`M?4<|O=vw|HQ8 zsz;M_Ro;!r=IaWqk6*br!*e(~>uur-=BDvA-R)kD@9~-==4~4?KR%|R+7iimB#lUSR<2|HLE~T2wOikRh$DKqEZrgG zbyT{0ZY}rF6?w_*vMOto+WV4N>hYne*S5x`THA9j8^3#m5@nBE4zP!U~tpYvzt>dc0&OBHV2AGVWPEb_5U z&F#sggwT5{!Y?zxhi;DJEW?j@nCDEshw`ra_36D+Nafk9Sa}hChx?*po>c!5Ux{y* z%4Ih5!JBE-a4pu82$4+ecDMnX`4e{(d%wr}51T&(zn|k3zcc+R=x2a?uKHIYiFL~I0RS_@fIl73i1X-bdB)S4B8eDmvkZ*-x|X5 z>=P6i!RvbF`qlLQg(}zNkINN&Q};t_M_f*4D!lB8kXPgALF?EN!Y6`fKI`H%7TnX? zUnuv}t(i;G8hA#^C;WY4xEpXbICDHsTIMcHtV}l_`6XJnQ4y(E2M%46(-`HY zA5@=kb5}XV(c%laD?Q1Q@Y+SVr(OQmJ3uAZv;0s17HLa25-*^wyxPd_gr%I>CLNQj zp|XLWq$G^ZMj*geRk1c4M@MfR>}WUl2!jk3Y1bp| z_mcBBadA%5RQD@2lqV~{UHp~S-md!0X+7wb74u_b#nU}hGEynXJD*A#{;0^6gMPA? zdG9z|P`YDgj`UWX$LupD#a*h`Qm;(sL)8;|Uhjx(r5;~!t0*vtMS6qv`#R?|rQ zA~UUyXy=rtis814I~h3U_v(uup0PY+t!pJwV5eB;y4v;j9)vfWkJP-?>$k}r`|ZLQ zyAM~#;(I;i#}zD{J+(AZtxP_SNX-7~-JHy03nl8c5!tMcmk4wQp%k*2P87Gde7hs3)d@WrQHwRZh*#)h%jB?-Zx zu`c1?n7Dp$iqbE?moz&x+VPp(Iqtr9FZS-A7ZwyJmJd4jIwgWNWueY+Be{f8D7(gT zepK1*N8#f|;DZsKI!~UyY@KKwfD?WC9`bc!wS70DOvu5CH!<>6IHiIu$*$1&h zz>&>)&!6I02IIl07^XJn$tOP5+r8`6^Af*t@t*G$eGoM?DM8tvxbL19Ql^RVv4AjZ z?7B(4x?4+$EK>m~$a43CA6eQ(;K*-WF=a}Q@;W$T0KLvZ%{pu8yV-59}@J?D25?+x|yyIdu^AH_1h(d=4ORD8;bYmY9}q{X%y+85{_LsY#qItlcQSRm{83NSGukT=sL5$hYKGWX{}@Mc=i|Lk+WgI8$>xA?D}dm zWOGD@*e)NgS7Y)7rBI;rbtUxgzZ;ciz~(XhmR3Q4p2%}|+W*;<8*A<@95bm87l9u; zk0?XtH^9$ABE{Bvc+_)yp~2IakKms}#`A_~u8EzWy|*5KpKl6DE5*dX)3RTO71P&W z73L*)8#)kS{W_|RsJx(RHt5eQj#zbX&zcV9r>N1*@|&G!YgRUAik0?HwAW(!RtF0- zihUeISXG&D?3L6G&*R7bfYSECO(8E=ht2R&V$1DY4(M&j;;i-0L zvj&Q`#RcomNPk$JK^4J1x+Ch-9P^YRP)mZQ$S)$0cr>)kBwC9ploi_qX)uwAI46zb zCp-abLv6LkxkA#!GRRanPzOt^!aG8$^oh!+C6|GuZ$$CwEdJrj4>!s}>(~v6+gAl1 zV4}k0&9`nDVzOk?5H}_1E{KXdQ0qJ%u{4mPQx(fj;KQN-?YEx$UIlVdRWa#V%}R|&43leF~BCXf8Cw7_*Qd+YN2uxKXR zhoG&4`%Br~hel&e#65a0N;r5SB_jWamN>!pUEE^F#@ ztOl71B-k^~^{JQJcfvK9VQTj1pQ%L~E>@)i*;xqjw@?#h*U!qVFFa||70uV<>|fu) zdX2JesIO}u*+dmN?rS@T_E_MtCkDGxJ9$^-bo%6O&E^I12z%2mmBb)IE4+pu8H;v( z0lUovk^Y=FPDq)tfq%S6&?MhKgYOL+k?pW4P0u42(U=fY1={9hQ-7P$!Bq)&*JT!B zW}To6lKEz*9L}q!RK#Y2=$Nndp3q!|-dSo>9C`HC-az_kYbQ(VkPhl#l8#_k*eAZ; z5_*f_RN}flbMI5yfC(-6U{rpTEB@|r;+*FciWC+e)i`(@v_D7eFN++snA4Vi;AzJ; zUv^6moN}9#&a?a`x^$Flo|2_mmWi0g5~*Ji;VhChPZI2q>d?CTT`Zxg^e8~=;?m(D zrB88gRzwk5@XXw66j|G`d%+{t>8S9DIoWTwYt9n;(}>~-kw?#si+T-8!u9S4!#yI} zI)V}&bok4-=aZhWPX;~K)K3@Wu=(8Rz}dmnklW6Vf3K>{rb!QXk{Yplcr2Ih+Gm!=qLx-aV)+A}|uD|^fI&WW3FBt71KwI00N+v~r509{G zP~oWt)z%ZGXAC=vgqc@QgZwG(^VQ(Z>x$(Qgv&Y_P28taJhlCB){83Ay_(-#<86%0 zzU2e=L&8UOj`yy_^S2o}|N2EM*jsPU;6?h$b-tsods}4F$z8H&{lR?Hx!~q$QZ*r@ z91H?uN!g3lK1_ufmWXUj|Flv2LOa6wuTun^tz%^}a_BEr!NJav|5-jY_dKC0^YAAU5CJhM_#xdLBk`;8c^@;iIYFM=m@3 z#g~Npjre2pG~=qIz@+TT$6V6>n1;bUc8+!X(b61$0;S*`ZM9x|c19JQMnoHSmcY-`D+(aX$$L zAM8FJEqO5)9`@be79@B$FuZw`HuJloBckvHk|=VrrDLoiH}RGw35MToLf@O1uzX+X z;EuDL1&MaSjj2t8-tv^&Uwjr`{*l=tcJ=ovP9@>cQQj9%_wl$BK+%l&iJmS zzaEw&GI|UJ*Z0{{zo#0dQKK&w7TaFg#7K-wBo(fA#e^T$bmptP{2DeI7ekG>|BGSZ zl;kBYF&$TBl4 z>)mI1euc|es3|z)rq{!nkGbhO+Pgx#X|jD_##vXJh)g9m^WJ-C_EEK=wTy0eO0Su} z$QcwL5tN{xM10b!P4A1|u9RLfMcpz@X8-0Rc*)TgvZSYx%(J}HAoC0vHqI`_&Jz7u zu$)8}iR0uzl;XoJ4g_G#j0-`~UOLPkbL<03-vsd>1*BdbgtoqH%dr!D<0HHwgD z{dmrjyXl^;Q~ne#{7wcBq_4fQKcEcJ`yrh5d z-g|*}`TA?jS4PxACZVg5A_>#>pAE_Cv>52g6zb8+bpAON>6OpNI90H3b;U=JwOt_A zH1#BYett?QXSbS7ZO$wCy9&>v3+q>z!lvjGW9I3!Qte|=bHi~BiDBxxK{-*{^o_H8l)cdf`2vyXV^C(w6Dlu47l>IImwxEuPPN4=ZZ$yTONbgEyY( zVByESDb7g}YL=A$a&Hzh>{ViEB>&2fS9`T>oK*a8%6_w8~ z`jb7zbFwK~@dH+{#J>Af(4fP5CFj(*Q6%Ncn8>K5t-fbv*w<24GWb8*miPHq!LZGy zsPjrmYcv5xm{hAvt5^AY+vq<6onzRwbp|-3)A)=(2Q!jRhHXU9V_>} zG%~z8pX7a8b>b?st-vxhhzjcs>fE=Op&rX5lNn=b%G-(!WhrD6@wzmh8Vg{Z&h6ah zy_h^`=El+qChSxkL!I1A)ZYo(6;C!_bd$&0F?v$eh!&4jR;b672EF6yvE#%*B>u zbeYuf4K)Klxz4eT1fx2AN;+Wr8y30vc|_^lR(7g{iu%>7L-Gcyv@6f9c?Ar=Gz zQ+8PuE8Uo98}IepFC`8(`aNK77s{>|=gcpWT{NS6%XasJYPB zw&!TqWNnvmDEL&8ap>IwZ>%G=bB|umT0mlw=!#RLoZnApy@jP8RFNzBu7{(!ggFGC z#zp}h-NOsk%*ByviH^qu%dy4f$^4ialW%lKF}2N47XM_bYWDo#oe6@Xbb8*Xvh*u8 ze@@gp6`nAf5>7_z=dIWadf2g;99XzcCc&F8bql_tTH1(WTz4dfMs793#UH%Gq1~#c z>oxrLxJ5=Hl08MQ*qgQ!mP#g)ad$sm$?qM1FJ~cNe`$$1AR#&OP!))JV;wFz1Dpr6-Y>UW|`G*L!C46c0SS zpn;-oVPZ)SLHfR+vbzI!m2)S+d%rKHICFQjzM`(LtkgSyS)qoV;d9$`s)xO9urp=R zVarS1<*ho6NN1T5*R}n~L1g?CJ(hxN3R#8FXzybj<2!D~VD5y#Z1tTt)8{_x<(?R z0k=rXdc42^Eb0vF@~bh$^;NI>uGjuALotfSYwZ(nq_1P%eE)7dNy>2%UD{afJ!jnb zC2Sr1FTTxL*yZu|3lHA&UzV_xnDRAiVg#eiLBjRCF}hQsg~VWDKYP=KqTe+0ufvQV zHE>CcE&M=4M|Yx|vcuiKEl$l<-dc}KFgOwU zTRB68r;+nhJ#%}zr3J`DrB@@S{E2Iu&5NIDx{hKr#D8mgx2E9Rt6I3TyTLnFg`Ac) zqF&RcwfByZYrW6m%Xe_|KHtG+)LNf|v4?i@+P*9yxU=bAfp>{;2o0>(NiDD=H!{(_vE_4afW5!Wi~(SiOwza?<#+!P9~bBD*S9A&S3- z78^ssF1FDAfl@ucq(ACiahDuEd@FY){Mjr_hEU=q$zRGlsY5t9<3*VWVI2XYL|jBf z4m-6UZEAZiel8~&r;pxZ>bZ5`_YNT|dT0EF9Fr(kE;;vYpGD^o5>#iTI92~&SQT7h zml}_ot8?PW=tHt%5NvS98q0=CIj1f zpGL~~djI-TCcS}U_FBW83wC@=?}&Ze;<5L}bGnQVU7hE(2NOkbUUYYg z&7Ay@8v4(qsn}y= z&4!we>nEX}7xouVI^~uPC&t|lcO+97`_DDa@t9$E_FwEZ)Z|>fOoykFU0Dfa^=9&Q zMMxzRg5!A+GeOe^zk>@#v02?kVtPMpL6MHb>&k`=^}?rfhW=vB&o^dKFAj>z9N3+DV^BQK)|8!G~^@#^AK8{~!!0se_ev z?)Xerl-dNX?0y+FWOF+w3Ts&9)n+0rpZfBf_QT|NF`Ngf`)rE#>GJTc1liQ9F)z7x zjiI>pi$~ll!xP!qGpDB)k9Zq-=ax!U-LR1oP#(Obq#eyodBkAP_J073Ky$y@_}3n~ ztYq7Xm3W{BJ!}k1C`h2}h|rLlj^2nw>h+?OHCcY}ax%g4W5=lQ|-{so?eRbvVpPahZ8BDAdt{)iBY<6vY zQ@5GYCO)~Fi^05+(o88+!<`ZWmUNyejWWS1K#T z?3Y8u@4#q+)rKD%vVjrq@O}73Eae|09)6@}|4?`$7^_O4%Tl^|MV*u$V6AKVs zzMDtpSTHpu2(X*}?f?1nXYteZ_3e8wV#UqJj~C+V=H^1&&2N4bKYqTsxtZU5`swq> z%b@V?$<(O>LqGcn&Iq@4v!x4+bQHteNR<4jit^;yE%#LtvF{ea>_Fl zxVb6|H_7NA2cg_pm_;DP&0^bF0l)Xh;J86+;bYIxx{WEV^4+i#+|R{`Bh)=K3uRZ+P*SzyA!M+;w;V<-7S$AI;03*036Xhx%+p z>#_6a>_4K>u&lv0Gjso174cMQTU<-F873)bu#(XX_==+>^J^bAUcI_>^IrkIR%f4Z zKRWxXteXPp;g4~tAAu-R#P{me^_Txm!S4gQj#`*Ge9vkbm~%C49TI1%i0enwVP{yG zgvwR8Vy>#ZGuMoUhHOkhbplz~LVC|+jE%>lPVf5B{0 zNrV~GMWT{ktfs9JtYhVh5R))DxpQpKY3!szWud8ESCh#j2l8{DG2uE0V+~f8e$T2} z8GkRjp-9%lPZK#1CJAgRLei*sjZ1x7z%SlH*u3`;PyrVxo9N_D9zP8*~(L#zU zn$O=~-CbVmS7J-H$&B=-W$ZftyS5!_Cdb`i_0IcZqH$@zW(X<+6>`tm;Ko~mSCUzxpQ3O z7HI#36Z!j?;I@eJmD=y0u%Z45qbS|=cku7Kclh5c`2SBB54P@P|9qH@X^3|Lt{0A~ z(ZdO3N&<{D&P8zTnXAe4pzjyM@zu!`;!|$sSLfZ3`0=-7+IQONBqS zFf_|$MI-lufdICMA!Bvo=o(B(ZMc_VR5+;I@t@I%bR#7%&Am0)ZDhMm>W?F5=8#cY z0g-pkTksAZV5jH##plaUKV993kGEH_v)h|XI_0`qI$B$t<%xm+^ z%Q_K%?Lt@SzItt@_X%s4#m$-R80zP}x*GJ6Kkv19(~&=qIlcKNo^ghP%!ky9hiFO9 z)*Db^{sx`NoL>OJlT{^_X$JTn(q?^<@Wd4>*<@9K!R3=zRF=v`nxTtf@LDWNl0C7~ zK^|g)-|ppJ%xhD7UYV+zIDlQrEL1%Ra`v$jLJsV^8Gc7Qq+++;U0T?xV*ZYmD#7>w zbB%0_sT@Zun0xKQw82N4712mM^a04Kh#$cYctnvd9WAnQ5#=&1qDo3VkoeZ3yGeZf z<%i!k7f1(5GnAo}vezi97sF_G}JPWj$L{>_pu#p2M>{aOGUd+ix;KbIB@A$IMyE3Ca%T$0B#ZXB4 zn~(Na7nA0InI9$l_L%umv2Tx=A1(X#nE4T~Z;$z{(6Qd9>EnG|mQ5n=6=_XPrhk1b zOj8cc98qWT(bU&)v0A#($Q1^{>Xqv%rue zvMAscLmBRaGgj4ks!hn%3FCLNz;(4*pfK+iR0q;$4~!EgN`X~!5Shx*b=3`Idsc1_ z?SxD=IF|=GKRvH-k0)D&AHN#)ezV-f(ZgB-chUmi9N+P;F4lbtM7M}(JTry``$VMt zsFOnqe?b<`&_VmYK`{dDl1k|0>~th$N%dO^|Y77;_) z@9`AH(q72Me5o(Pv)siK;IgGp4lbApHQ2b3aZ>clQ}J>pJZ!9VWs%kkOEgPVkv3QFGKzFo#u1Y6IR9?<)GCewpyi|veDmnw?Qk! zS)0&DSCfgQpU?=}gaAIZFg{8;jcqc?^b-)nCYP8%PZBlk0JeEZ_-yImF8qzGQ@P0K zKF9qJ%gK@8*^eY0TJ@}->^I>>*G}*n z?s@mSE(Ugc$Fb#&h@Of^SLaWm*oKs=ek z*Z#19s#bZb2B87b5Y1qUXK+Jp)4R$CsVnhSRv3VY-U~M*y1S_`f%goR?|1q=OM$%C zk6q{*Eb3Lc|G@RA_3iy+()Y)ZAQ#LA4{tCGb>A`Dk*MDQ^#jbR&@PZZZtEHsx8KXf zlU<%`fs#+;PXC^vNdDn|e@<-F`^jYVPeF7Er`iwhqJ_Um zHo#jTY+VERYofdK?4|7uu(lq*>C)#yesu}`=XE(2UR?M8*s`Edb-M= z-Op@^S`X6;UTvvRoY1?Rh?$RwGl}M^i&+h>Vfmhw0{<2oEthH_0NQsN35pYk+5&}@ zhPoSsyQ)LS9w*AQ-CKPmc_;>O^NobSRn^20t5ixPo_j4s6eE?z`mAYp+sBbDC(i@2i(u1gM0*& zosu$m&q@gXDS%#;c3d`eIK1O5^#TX}W@*bC)AO4Xo3gFY)G{q>Hha=$-3fx&ZWj{T zRMhHal|AEf^_$+rI#Ay8{j2M@2k?*7uS13^7c%Wl(Jqy;s>{5>igznmfKAH#2N&)L zpR9nXVaZ@D?7V8tY(O&)llL-ZejV8?3~AYJv)CG}(VkuCXvxp_udYPDXZ*{BjOFhU zcGe0y7t=l3YG(hj86f^6K#CePGN?0OUB&*m&eWAs@w(f4U141t3ohJ;u4hY>c^K3& z8(a=9`|+NmYW|=({wQQF?^QjJ4p3iA63l&3K4dC^>AaAdv@clc6PVENq$DfPZ#|2c7`pLLOv&uoBZhWPP~$*9Soo|o@4w9|%S!Hk zw+|gS1RRa(H3Z7}zh@<4e+0fx;v3_gNt(k@#C|wLhs?Dr>fY-L((pL3oo@h-6Vus+ zH>lpFGZ8C{1~AJhiHj58c`1v6p|Jc2lvT^eIv^&Jy4wY%(P74_T~5Q60?JTLesAv$ z+!syBM9{dVHu%V&X(v4q_U}XV=Oo3d>B-kauIez(Qh%{#=s zS^!4k;>~`#dAq^NI|ENUiHkS;adq19n6!|MSOK2{tN18@yqQoBP%M=+F7%mG?}wL7 zoyI}VafZ_E2f7h2`))K^vpeZjBv#&Z=%sp;H$fVkTZ^uofd_O&)>q`WB+ zfz&*Vgvgr;ZJ*is157hug{)E%A8$f4pn7EvL}1omSScWGfYeLNl1TaSn?x;P?F9OX z;@l?mcYJBsyCxIUvo2p&a|@+7BO(#-(Oe zJoq*bb8!K{#bhG`V;~r6fCmiFZJAAX54?AcbiZdP0zO`N4JY*jpjRvD67%&;wn^G_Y{8$(QotFifFBt3 z9vSqeFI2rZYuhNKOB0-@zEr8RH;pbC-5PwklWz@}`^UrL#G4LIUSEF?F89UP0|8FO zn|f$2k1;KwrxLgR4AN7(9NlPtE+0BBac>r=qyqoes&Rwd{Hj{TX=U079iYPApi!KJ z%xq>T4t_8P#W@KRrPEc>Eq6HMNtB$3*b_rMQ!BGR+0i}RrQ9V%ZqB<&#GGi@>mcUD z&<-N@JCNJ10=N}JW$rDj&swo2pxB$T=A5jI%gh(4o9Sg!4J1E-r9kJC*trw0r?F#B zav=b4i}5L2(a9)Re?)}xH7nWfC&oAG;s7Yv+j>_&PHEicz^tsb=n5C&$vH|{TaMNr z@z`gP4Z@#}jS<0)AJ>mnP-k=EWP7n$9}kRnAH-{z_wk0Ok;YsQH!on-Ot3)fV(?9} z4Y|9^`r#nD*2JPOY2uobM97c4jScII5;v`1C zBrh1_tk+@nd%{wt8Qw&~XV3HY9{?XeK^bazs|`vRtlNd&35pwU?<6*UglvHA#g96! z8R~Qo@b=zrZ%OaBt7qfuBb!9{f(>L-@Z(xrP2o(h-J~-+hclFoCYb~)d2hPMok|Nj z`*Goh6&n_{$C4bN=r8q|_#`rZJZgZhTA@3oQ2}!M*OTdjzpO6j#~=SaP?GbSp(ObJZZtK{U@z^WJJ;!I zEk?>F#@jo(f+BY0s>4bfd=G`nD~UlpDUb*f3TwtR=*^WXMN$v#brKqDax{RpR9*-< zG_L2Gl}z`(^ap?ekHCVuL!g}smS3pQq(L4?;^jwsmUUS)Nm*UPDh)emv)3`3dxvJw}-{DU@bG^#`V~D#@sG$-{3O93i`EqO+YVzS^XvhQr4i zl9}PuDM|aDl{9#lMU(ln7?&$O$nc+&i1^W|tdxmZ$P9fk_4r-*%Er$R^%Sg58|?%Z z!H-Do8&b+?52JPh#vSq{*r^XP%Obgg z{{@d+hC1Fag^VAQ+BZ`7TtjD4iPd7dJ);w-CPDL~SoHy+W)GI$G}y{(A0Da8M4SJF zk5+zM>4h@duUScLzw8pjkIig*Elt`pblR8kN@K3fuq?vPRe^k%UtxL+AMKMM5p zLi8Y)!We!6Ek76i8!9Vu%}Riquwvz=OcPX6S(y4o7+Z$Fpv#%Y=&`;fNaXyu(UbPO z;j>`S4l~Gvv2we<#|AJ(Uu>uu*#i7H)WH_;(w9!W8z%I^C*(lGfB|ph<^|Fz7iWiJ z7KMLf>~^v}_|dC_?V(kMQSGa;Oh#=IER=A~O8Prs{I4vd3!ChSvzK>#yiLE42iLT33+tM zP(A#~z8{pnh3+TO@nd06FHZ1vgl8Uu2EC!F0pT(XWyB8xb=9hoh`_KVk@4eK&zZDM zJD9R0c7Dw2Nuzj=mkL`0B^j_4j7v33^R&@3e{E4FD2J=7z;VuxTRmqqbcNfOwwOhW z(j1B=T@0nkU!WNl4N3OywF5xnO#2?op95H|0(Asc`n2YgNg;7*w? zAI&P!7B&m=>sOJLLG?SX849gGMJaGg=uZ}VSgK09Nm%YHn_+4ypz8ky3r3x-1NN6g%Qn?}e-mDajusN4P&a)6o}foP}9 z7i6|D6mUPHcb{pcFjQ?n0z4WegQ8M?y+*g4mYaUR(joPxt{JMmKi6V=!Nz%8d~WA# ztw;<^MBnG{n(|!*sn2rFN=5z!?3QP?##>@{J44|`j%pZ6(m&M%j?actJ%$?dUU2_G z7Liwbbh^R`rhN<}6iIme=v;q5n48y8r)Y5h2{6*+KwyioIe;@ILph#Ml|3b#@!OBw)6jx4Zx2v(U}+K)H~Gg z!BB~QFG6b!s=B5_2pMY6@1KniusgUQ1q`DCb5FE2N!=Lg&-Yv3fUpKHGW?jzOQfeU z6qnyO3iCE=(hASXaV!RddmFsODVQQX3Cjd$B@TaF{t}QFUB>rxUL8Y)c(7yB7`Jd8 zp^QI9Gl6+f^h8BCsR9ZcLlO8PHidF|2?!Bt;OIoMrVck0+xNF$ilMM3}xR3 z_!n5D!Ko^uaya5WtkJfu%Q?ttds>roeB()aoUC-_cS|X%0&MBBFwZw7TuD5fC{a^O zlPMAbGjDCF%PK1$UEY2#{Xl}6iU^&gsACjC+dYChpMMAy)L|tJ@A4HTELC+H-|JrV z-f8-K@qZn|&!JbYspwLp;x+0y1G0@N*e4; zquJGnzFDjhT1hNaV`|hy3n{AT^7`iP2E(g}R+)-tozN<~E4gm)sCM<(Rj?hli!IoL zw)i^TDBmi#SElS6(JE81w1cRd8t7%;_G@Ra#QbbbZ@MzU$JS)9^AqB0mBafX|^ zkSkaTbhBs68!-T+I+^-{?Y?eulCn;wJ5LM|r!uC{ug))TFfjkg_PAlCJ-@R^VsVtFEHe%JcA~zBI2Cb1LgL5j z29RWeTBK&K8+!!k+n&XM#5fh>8f@l0D42}C9x!Ed+)Sq3e)yLUmRbE+P$8W+47J(u zFTvNB4LWz5Qg}<=9iUXO|Hf%0vkz6eDI5L0tV_Ga#92zhxV^%!Q$$TfOCy?! zJOOL94>dpD0P2g^0>^FeFGW}HF0P_+O%eDLIjjrfzFjD@fQ0OIHmMe%u|t_V=#~V)^6GZu6KOHPyqb^ef47Kan>5+=!$ar-7u6w?-!I>t#Ipm+;d3`b>B&l3{Tw* z`F67WJw82vnie`;tsCv?s|Z=g?q%XTm>#-QQJ*6=ia3oE*x4(U;o(ix78t0|ICb5A z8S3r`+Bg^rqmN{%ofpHZ5j$%Wk1D)YN?_r?8-}Xs2iB&pR9T!!dd;0oGW{5a1HT<6 ztecAVZMXEA{2@`xVih`Kr=mKi+Ma*3Wh4DRJ{}CqntJ;)4E9uv=m^-kgqd5Y-v*Wl zw!|ai9mu+d;pI$^d@)jA>PT#^X6_oSNj|>XHHXP}r6)3b*U{eowMWM05YC}>8f5Tm z@n|NftNC%OV`xXNkR%J4shV~!FceE4glR;(AuxTq=h1rUH+O!)i*-&D{HqfuEO<+YUWTn?7J=`Z#SU;McRAu6+ z3BE+GS=NDPzc-V~tslclhO`>prM9Mem9;p~14lGJH&d7ujCtF&>PQ)h^9_)#{lj*H zx{*M$I=-dqu%4ZYZk@`ihoQHYa)jZ012k)Y&mK#lC(~ztHd23b;gQaU%W{c{*tjR# zB1Upiw#{$*zf88!8#vLkErdTLY0b%(h3YQg?Ij9_f+13_9)+$<;d6MHHo={tM1|kM zUr$s_Ty5{)n)%R!OaU(ua#btC+9-^ZDY;{;TCI|`wD9V65_jIKWs1J6O2YnRy#l(C z#)P!?NAJ{A7^5nd^YiQ5YcW5+xVyLzs`%~vU6oJ*LN^SR+;`7Xpc_}V(r(AGNnHG5 z!wGs#BASX`+1kIuVVbxH`5=+xH~8eY4&QIxdi9%+4ZM1H72#sjy99odMPltLeDlP2 ze=CdMy5{`N9RYWag?<+Fi=?kC4?94wxnREdTfK(Wm27E71W(pwbcq3pzgcH@g>o~x zfoK1=DKq#ZVT<@=a_*-xINQVc2em!zK5 zFv$FTXS;6FEM2PjG0ws#NZ`*iNQCTNV&{DV zi7Mjyu`vQCu*s1rrDydSOj(JQs>?khHNHnhz8{iLk0J}gS7#}u};w? zaK8~QCkT(8Hn7={4(GV6PSL5xy@%}Wmz2D)J=piUq|A5QA4%)=s%S7Gkv0FV?}ynpFV`YZw-rx#9 zM$(#14w|j`*=zTqhG9Xvz*nTmj4 zBa8HF(B$N(=^c!C5Tq~?{U$*(r%L_aim|3XEd-uwehAV+g}=g>*d$iwOzGvkKn$h8 zU)-){C=dRv7bs4o=^-tW@dptkS!K(uw@xrdtYw`%$l6w0fJ-LkibT(j zJ7IKed>^gjv_JMvY81xNk2!kz9>sX?o%I1$B9_o3n7NkbPC}k+0CrSsUjx_*>rI&f zXt*@1BswohY@Artix2HtwSLql3uX{wNHqy7$?~u!NtDf=w_&13*hT#0$@dLybF$__ zU}y2VERCEQ7MTGi^5{PiU7R(EnjQDrhdRa`i-f|CT9F+HTQCmhZXqTiGEf!oaH5Xt zy{;0NnD=S)_n&{t6j|WmhM!FMpp%?}9+o_f^+tq^I!=V>;HX=pyU3}kjkg8;kYYhw zl`mA1s6;eM=2rTc?n};W$nJ7pNlwUyRGOVkx%;S|^nliF6096InGE;Kj8OvKEk9N5 z0X$sqBfumuNm1C@rc62_blyr)`r5br^tJcyYMxx~U1OY>y1|~&qItI*^tStL?w8Mh z@x?MQn<4t#)jZbGuNZ0lwhZKm18DB=2@I)$Z3v z%9+JDq)tD|r+EkN`?r(Hb02n3+NH$&gXP8sc!hahw=ZrB4Q&aC(NmQ(=W*Q%8)6Z# z9r6?3-eWV_ogysb@0Opu_O9iyky)D19+cb3^t6xY9ea793bjn>U5=k{_I?|EP-)Ia zx&#coH^5Df>@0SaWPAj*eq7XP5{(vm*sl}1tJpD+KwvWyn^RUznui^#-7*x?{$@}) zQ4-=r!HJ{6`&yxo%**o*MALkou(ibE1n!G7lSpimNiiK)S``~>XDpS(Ce@-YGu0Il zGi=qFU}Ouv0b=7WW7X!s8e6xlM7Q0*=;NMu`my`O1gQu@sC?WtX(O`s!;?AR3oy*i&?-;#wu zZ#l|)?~ZE>D`?87hdpyu;={b940XLjK$5W75wI75HJLIuRjaqE%$DiQVl3CYXwxi# zMHKd1KvC7HMxH5?M=_eW8fcaw>1L)nO_wTl<(%)%Z{B0#IngRpQLBRst^+rKo=WO$ z`*t!h?vuu>Qv&tGf&|Bj9(geYTlm4;fro0qjq<7y%dC8GFvX(H?oIxrP#c-G=sv}d zKcHv-d-Iq)!|^KULCTONje^Qkk!RyeC~JrnnfzQ;b0y-nY-XbwEW}As_P3KMcZUsk zlq51zj)o0}<{;iqrqg}OB*wEh=&6~b#8#QOS=VK|T30O+1z<9P>=R5D=Y=)K$q=oyRqt`fF_F<) zxT;&$2-S@@TyC!Cs1rf72q#w)ZIB14Dcw${n*Czqlph0nDFRUUm6*s@_{XI|$Fu@( z?lay|%u-~db}+hZHk6;l70Y~1BA$vDVHtxlUJU5R4vt(ILz{tzJ*>@Ay>5XO2;)-% z6w*3NNqldK3w07xNOIGnMaOWGYUxhS!VZHNYF-Zlm)a^g0&6m9>)oN5!NUqXtu(UN z5&rt<7Z*_WABLTO^mRkD_~k!7n(_Ldg;|~4efmQti`DmJperlA>#8+9<^Lsr`COg&rx`<8>cgFeC;zUjgHzzfr4p`^DEaZ5 z{lZ{oGhecC`QJ*-< zJ5IP&+yuAZm34Fu3TgGB8^W7!HaO$v_Ld&({CJjal}@q8c6J>N3UoJe)t7Ox9+lrU zy&*A_v9@GNCZ#2hLm_LKJa*yn!%@&{8Oa6g$eYyu1`<5)1GS_}G)2O-3OI1#sAW9> zB->_Y76FGJ&FyA3q`Qxs9I*xai$GJ9qZ>pnoO;FaCYK$!X~|M%6ml) zEQVs#gHU2q#4B=Ty5McF6NI7SH2i$5=~%0(90Uy8o`V&BgH}ghn+%ny(56Ptrej%P z;LIQzM%bs3&A`bQl&KZWsJL7K*)gJQI|r2sQ1>O0baWh$*cdVsf{_YL5z;d>#PG({ zr9B| z?MIv~GZdb7STZK5^>-=6_}K3+_=oHM7GjY{EPCaq(1h& zZ!_ytabw2$MaN-db|ZFvlZ&fsBdS!Va?AnpnawwJ9r&4gYo+Dz7B zsZ@f2Jmd+$WOCPR<9{a;$=(f>Esf7V&Am8ZT10>Q@#E*8e|(pds*0?Ht!@9MWg`Hg z|5vOf3T()YOnu1-@wE&PzT&52eE?dYBcGyo1T3mVECFp9kP**Mw)y}_d*X_f$ALc3 zqBs0BtiMI)@#8}KK_VdBCrCj2IM2YSAHH^512TSCFHx1Es@!Rz`y@+u*BqhS3QcIT z9r%%)=d^=Mb~h~mga{+t&^4VFHs*5t<)IoG*-rc%Vb5u&@fx=s>uq_)Zd5qgNc{X} z3>%4`L#`@yv#OQ;Ba4=q`jRes-JigdtUG>!-XW-Fqo5V+&~>_6i{WZY0_Vrw2EeVx zu7~Yy#eKteJlZjC!;7X-^!1K|_O~@KmW>pB?er>>kBhRr*8_8-k`e=uaAUAhN8L>V zHRELdn*?l+s1*L&=Hgva#$QPIQxQPZ+gl?*6#`M(pk^IeOrpa?V&TX0wjo3-RSx!c z5)nV5_gqB$DBCDOvQ|q~qrB26B+$lWo6S~7@?QIJi7uTIu93+3kuXGpDLq~tZe3Br zE_VzizAfijwuOm^*HQOM+_ww(`KnRyQYF+8+}&gn-ifU0cWFtv2k-a^bNl!q*q`CY z))N0>WGjJ*`&-=!QJO=+W@%VTz+B;{*G)x<4&;%rXsg1Sm>3C-pZ5u&9qj|X<0tcN*LHN#!+^}lrH`Yk_Y;E*e@)V6r0egFp{RFn zw&NrLI`z2clCZ3*OE4gD@+23#Gsy`}U@1Rws^9O9m8kdB+XFw3%)z$Mu_|PpmX<>+ zoqaWdd}4)23!}MahywC9{D8vFO2fM!^`?gfFzUjDdXOmiksU;_s#>?1rv(Ntk=kN+ ztfaFC-OnWbhSRLGr`a~%Ws>SL3*!E4B%^Uy)~c~pX0W6+mh4Gk*Rt`>rYHs8 zM*`x>BYerZuCfHVs52Cb_LJ;BhndvG$v`%TM8l6T_-Y8I&Id-vwy4K2zKrXHMyF$F zV&fe{HD^)~s5_o;>m!MgAK&QK|KpS;?l?*}0~8NKN-8?^j-x2^y*=~7JPm7(!<1S% zWg8L?PjcaM2c5RXf~;b2H<=vsY0M#X!f@1723Y7K%1YT!e37Rsn*|~;AtaWhyLU2S z<=~}YR+L3A#)=u*=?X9Oj<2j-rQ}}BQGj_1D0(t6YAGvY*o9%?DBFU}UcKX}sk{Zu zE`_*;{0>YV`_7!Qc;4>BzlJqnlF)Ncj#|oF=y8We^#EUC>{)R6l8{whwpB+(d?EDU zQOuK)>|;FcDCa4b0W1 zts>*y&N89Cq}o^yBut*{2Jaebk_i~W4V_PS$4Wfe!r7#C)1v8S%aca9#$?EOR9CeY z)6PQeIgS#`&|!w_EM$f*{aTp(a9NYK0z)xn+Hu!iaQlR4i}a5c&wCfppCn{{WXH>1 z;`c^x!UrWkqNBbTsY+Zo(Bpv26sH;b7j_c}Oh*pC;iW(;o6St(=Sg)A*;Zl2vhOC7 zStc!cM_FBhNRg6Acv6^Cknr@b7$XoFbhaQ7@MIh(^u=Ua$Mo*Ccr1eu@FWul_g`%s z3_$SP1u#RAR#+|0-hm6d$t>*eC(-j{A6;%x;4(d#81d6E3fXvjg+#!QJ{(vQX31kA z;eG)|R_RQWaw+gA7u^J^SUXil!v#Y_02%5C8%~dk7eX2PQZ%*1zeGae$r(^)$fn*2 z)X^>L^eg%TDpAW~MTZx0lm-S=o~t`=9SwsgdBEk~t#!ggf29FE!jnau0%bB0;BRU? zFw_Zt2~_+j!?u4ZNlJ||Dz2zXuno^j`gh9{2yniTEP|uHugR`7?)F^iwUCRFtloUb zQJ>fFA1CsMPUdvAZU%Xz!e4SCe?X5^O`j}q6zfeksRoShU$H_KhcVZRbY^l?=tUL_ zJ&`WakFEr)3PDkL3}tuCRI+s1o$9y)5Ln(&e3Tw+JQ;&AS8X&N=J?k1IAbWT+W|>) z3`%LMRW0dU5su2Z!}NLeMWRHd@R>f*LM3$>-}`^jlqhp^kdvq?D#j@DR3KEHCA^mPrtzG zRq9|D!epYZ`@lKVC;e(35jo|Lfx3xZmIndFkz)%cz8bz|^L4Gm>8}>OWy9%=!&LGUOQ}kb|Xu4@@KU^_3p44E++P9Z@qBOZEOrS6u>6F;t$m zc~>_Zo@stYK$1Q~nbXsQ;TX!1nxnIO-PcZCE15NG0?EZWLk-fGP~ZVzJUPV+0At8A zY--aJWqX}*(=K#er&gcE2e${67X#Q+F_S&EW+U}zk*~_6w_FC-vvi}3+77DmSlu1t zp>EAN$%3{}0X9RfaxAL^6b#7-q5w;}%q_(~#_<7w*z%5}x@9WPfn~YgnSA1=E^$eG z2NMjQF+Yzk&ZGHd^sr9jwbCc z>zQ8?2bF6=S4Vz~M8VqEh*g~??xp<+0gjD}bB2ne!%W^qSvSJ&kw2D8jXh3l0dGxD2H~U!(~#^tuAe*7PK2s2h4}6WCP%rhbMW z_qE=vU5F9rt6CWc#>{;U^AK~mkOVS6hT5cz8;c(iW87H$Se_A8?wx)fzB8ME!ve-e zC@=w&JS|Y#)BMGmGpmZyML*h8|Dpl<5zr3&XyVHZnt^ur&R{vJRyDK{Kf1}Ujreg_ zer?2$@bYV;e;kth&Dw~eG%nwbelnfilQ;T2mM92q8WMw)Q!+dNQ2q~5K4M7x4^cj% zvG@_?-I@x4QC)!M&Cy-g!y}JkgsJ(^-+02+$kmD#?g8ZdNbGa^kssZB4jO*M@HuEW zQ8-^&AzG*+Ugr{Z=?uU;)(auER>Q4$CUY?tc+^rB*&}8S)Bw9vlB8ElhT6l==t+i> z!-vt#dWC3=tjtqwvL#XJ)qY~{r$O_hQqSo^eq5(NFBrTOy3AVhVv`TKu|12XVe(@s zhgd#d*HHt=>(nUm=1#&@EZPK~tv@W{@4uV>WS#>59^wb^(Qgan2=JmQ<9EO7viN72 zSN{rc0>AISMmO)9qfG}Hb0<^oB#?(U>RJCOY9ZS@27QRC(Q6;|G5n_J#7;{(1eK$J zvXwQrKIXE1gr_Vp^k`i^h^E9@SfKM+KNc~@U?Ssm>0>lnepGD-ZCz$c_w|{ev*A&A zv>Q}80Wk6-aJv{4p2};VK;kN{V7#L+_agADTxl`NGohh#VtW=k_NFQF-c4aw6C-@v zWGJt^)1kY1?nmI`$Lx0Sp?(>z#`Z|78?5BLYNEO@_+L2e&Tg0L1ceHD>#& zW1=J(>MiedDeAbTnHtK|54P8+O7kxGkoI{p)MBPKmI^onsxv#Dv3wl3?0l61W3UWP zcsHnK15W|wAsbOBXgk=E7fNWD1DN)LZ;cLHS!0keW)25dJb*UjN9=amaM>1##6KZ3 zz4NIp`Jg?8_Lg4VNGjtP!1Lo_FT`qRRjq3EN1N&t)pk%aR*w0q5GVSBCsUX<4Ybv0 zK4%KY#X40RgolC$St^0810;!QRoFPOrS#oQ>?@zpDG(f`sJEv<0(NxTWrZEX1o-i{ zmjlO9xOy03TB{|@Q>>sqysW$F9LXfnLIE%=GH+Ue#{3qjUFD<>M@3&k#18=)OcN zN~7aP?p!jIkzp(g{}!+%Xyz3G2Xq`|#7ELRI2`?wZ-!T=fj78l>mKe?Cl86G1HZpX6~^A+6p0@TQ%S@@AYY=cFe#(m=Kb_VUvO72cO zW6|LGbYXr04V@n?+&z!B=S0z}MZ}~0VYjQ(F!?dO!9lgvEglklU7%DFGx@F3BF zSZ}`{91(@;r2$NStc%vw$xz(5b0XRGE9gL+p#=Iff7#wtA~tpu*26VkZW0wk#dOcaqd!{QD;tU0AH|}ib>aZd+aN=yF+GOz z=s}^#Mk!jjUV+c5ktdA$-3Z9KJBHj#lPFbU{9K6hOR9)Y@ z=GetH92Y-^GxD-;1<&_`mPW>q)bym(k#6T5$YoWbV~7Uz7PyO-V%uj@&mDK4nU@PKBhVbCJD_cE&7rroYRCpgQOv6#2(=5ef z>S!V3d)Q#D|Jx#_f$}3t7KTR?oAlQsdX67C8oFh7C6SJR#*ggm=%o$u(SZ2TnvpK` zmP&PaNAaUITODO}N|BKt5fi~s^W7Zp;OWj5RhwZZR)z(`8ejd)?r}c5)t@8}O25(k zhoMybsqCQhZNYCF<|$Zr!EEQs3negcRHGl9AG%`P-INd;s+tWz;zxmAViCLGC{Vwr ztH!J~Eno)drfv;Qni&z}a%o1ctv61?=0}JQpK`C@e@FBvKWg-1(D+d!t&p+1f5dL_kYfpf2fV+&(+4(vKha?fLn|eD+6M)?h$y$|fKl@Pc6_h|?zArtqqm<8#FW zb8pmqX||vniW6tY#_30jP8>O`2~;5$uuNc7hRLI=z_>D0cHnA{dV zE?AX;2AL4see+kjCrzV4!s84{kS49##y1;e@#zKNVTK-2{Y!&r9Lh5`XL z?XywqlTdY0_Sua-`FerU?zhLK6K1=rq`j#Rp3` zjOs#5)Od$M+?e2!bm`Oy^@#}i30y4HQYFu$VNz2<*7Etxcwdgkw9+0-I$!o+D>C`fPVl# z11e^!;3bJm3)yK#5;w;>4+L%tRV2!ah^alnjzP%zQLylxd3U~eF`yDplZEV8BN?cmXkQ#CcZ$?Fu>J+c*5M^ zr7ZM8u|?6yLICmSbT6@Vy@mjkq z$3hi{v9~ZDTu20ZKt2CD(jCUJc*Su{vp)yk$2oVG3=HX;83hmjAi9yJqMnV4*XVv| zp_?DK8moEVx0G09}aJm;w&4ICR803l^?mSVdw_KQ?QWVmF?n_=!%W(efjANuf=J z8KkrDTJ(B)BpQb0B%XtYAE~Mb!g+(&+u{Ttw(6Dx@FPl;UvR7tG3Z8gU}hVWC-Q^{ z3GH%WSPcSUb}knjt~;26nIFR<5Qj$Zb_B`x@ZJ7=FqRETUQl;0Q2Q;e+kCP8Rl~21 za0}g_QxU0$hlh7ArbcYn0vnuL%fyVBUewRmdc>nG?W%Mp8>CkDPJep+Zr$YcPQ|b& zg-J0`U#hIERUO?U=wU?)|1sE2kxM))TP+5cY0#Y9a{E9p%Pd1zk_{P(^;*^yjfx+| z8l&2mFX$@T`Bcf7d*A5~!30qih8-1+Ph$$$0vOV-qg%q)G8@*^@#Q@N3PN5mtaNd7 zBhVoEkvSTqH!5as*&qLNTvj5(8W|@yz>&xq^1P#wuggZD*C$y#9t)oz5j+Au3h%?O z!7qmz42x)-hJ!n=3dO-G$H1v>0>+ihBAv-D?mSWY zzA39{bMf0boo&FdgvHYi@`p|0Y@jW`mL2+PFEYDx3UqyWJ-;SZ$}c7>i}5Wxnjg~{7oV{` z-jpsp-e$H5m;Gv_gW;|D_XP0#c+PGy5SztR=2eTD!7|H&kg*H=e}SROCe7fdARRT{gd(nJSJ7mpFur9cO+|0MC8nv^%|T4#@=kI|(#|=*`%mu13Trm;-LQC4ZQZWji^uWKd#?)v4kGtGZhGLN<|{->3yu{++cWl0_- z&skN4*gpb&kJ&$miJ%V~j7~IM(+tR2cT1s?8eR0MDFo0J6wCoW-4y%?&URBY(CH?_ z{o~(1(|Gt(7#~V;ae-C)R;@AlfP2#`=Va9yg3Tf1q_SyX1X|revj@_+reZSR8W(%N z$%(ia`A%qD@(&sid*8{ifY>`ujs?WdYqG=l?Ky#AA*A}yNAr#6{^$VskaUI z3pnbYGnCxlWfYhtTmlz4Sjd01%^7yafz()G*+ir@@Hc7L?5Ri(b|Cj1;@x8<3-3v=&CG>oh=WAs1OeXNYXW4&+ zrID3L`zz0c$<*0TAU2y^tZ1d-IV-vKF{VJpSsEh$!>({FoQT*nXWyYzIrni`rd)sX z-b6XNLHRR1lpN8W=t^K6h52N<=zGI^x3`?mm7}%N+WZw75qrm!J=MfA^L0{TELMf` zN&)AZlZmA7>#S8)f@LVuVp&Vw)UBP_T^D`;TnSv%-*3SuQBJ0A9v+f~f%I7!2l9c* z^velV>t`8EG-`G%XtV{@%E^_B;bk4Am|ltL+cHVCmGw_tnlTNTzemf)RrFpu7p9!c z`d&3vCTaEG`D8lgdr(%j+N7BB49p0tFZ87uJmSBWSsFh^R*tGNZ~C$#G*(VTYAfUd zD@Bc9g$Kwm)F%%Q?9#T{o*BdeP}v{6xtMG`t_pO)O(tf35Ysp|)@z;F7+Jrf8ugYd-nsq;xg3ue!4GbSW^%^EaZ<|I!GS3GUghkn!0_#MFQr+fG(Xf&KSP_FVQEt<9fYJfRT_*j|w zgwJE0JPf6*_bjNTj^)5jO;0U`D%Crg2aT+oZ9zKW{Khmu{-owffEWrmljh({_oW(T zmca_E;2(7A!5;DeTd9!3$an(cZ(KTT@nYA4pgy8{D8`5RzEPB3tj>ay+Ibu^XACc3}2?SsEQb zqGQUS!jyBB+?O?sRC6-lZJ*|tSLy7lKsJXzsat}vLM}SmgG7nulW9r^_iaeTIYTY! zJxOBeY8~KaolHsk2pt8vDoRu0O=RT?hMUYDLkhmlCliZ4$=#ZlMT+vu#p=UOX$=}G z`x7jeIO`81fu7eP!;{gO)e(o0&coV=GtuD>lW91=%*NoL3g~JRwCszbAa_T#SK945 znTqr4cQrePvrKFC09I5~)nzjXLps_$FqwXH_&Ow)O0;z*vQ*P%Gb2ejoW# z^-)*T9{yXEU~xocu_$GobiFvTEs(3FzJ^T+PZBV2v*aNS$O)fJkNMk=T!t#lyH51- z%cHMY=lte0F8+=mjHX+_egQ+UA&VW%8EPg!Me7D3&3=B;v}ZD5 zvhvZS)@+hg^xx}ll?AfAx(#RnzK2*{zBY93J)n>4N6UPJ7-ySW03N;$iG@!S~ zqpW!L9=c#EfuVPaM$L&Z1);_&^QL@uo1_hTtOM2|b`GH(6Kx@58pfMrKb{TrJa(X~ zfFj#(f$vdu@UR_04dp}Axw;N0yCUsYXNChCsQ$LVWAZpfwNlA&Vr&grAg6fr|j zf++HH@DChi?4@Kt->%)xKSc^Lw7GtNePDOi8NWP@O@Q>he z(Gh+q4@(x9Ax&dsr;WH*Slyu93HR-tLgco8IhmewxN;qOLbTCS34p_%#o(&4Gcsvh zZ-CaE28=&(!KhDk-Uy8$oFc;qnLW@hDjJjVyG>Jq-7kv-u9MIw(|HaLM0%16&;U7+ z9iIRTSYlN*x(8*KmYE6Lb*ZtwZ_&$MCd+ux0yJt)yvC#UE(PNKArPibikLW zFJBAw1?vR|Z6=%)pgr=Py?9Cama|{gwzI`4fJ_6{2m%0C$a-isb#0^(FGqzxyGW4u{pkR z9om%lDr8*pqdYq%#9|)16IWkH#UC#RhFM>-l90BYxD`vM(=5e7iXts0Sx0@Tum}#! z!5NYO*$v}FWvMBv>;frh@SK>>cmzj%jIUTLnKkP{SfS43QGSidG^h9ZHB4nxtr}Ce z2}{Lo4{GD9+AW<40|1y$X=OX-wEtr=?deHDPepzv1ZZB66tobIN@Ni93SpV(fBxaO&BZ%lYh)>{ONOG;vB4mcMYK*=>rq|n8SGC1%!41ldJ2=Ph$+gp0SZmS zn@kM)G8dz$Stoc^VcclCup9 z4YD$UUUI-3D3M}V1WLpPgce>h6ks0BJD{;G>QFulBfpSlEvqPo2V#(1U@7v; z$>f-ym5+$HUm#Kaax%r{!{{GWmi4)ZDlu3SW$RjCg$pZh?17UICzESF3=tlYx?TNn z<#KZ?jgB9O!T!SGip81qE{_pdh@KvqlgTq52ByALux{!aShR8@5}gC+2-vj=AHe7m z!*7VHPB*eqfu-m#ClhNv+yM9LQEViTZCB|pi*|8iz+sSIZ!($Yz#0%Ha?%WDv$I^S zf#uPl_z|5wK|Q;ddhzryTFy|QdA#iG4ovJt)2CK;BCr6(8-gDZ8V_jTJB8V9dLhx#;VwOrIchn7 zn>ou+zj+JkBG(p}a62iDi60*tW5T}LC3_a+gI>nAvbLF<^x-B$C1;A(TBN#x^#?U6 z2Bk@1L<0d_pf~-f;1Y(S&LdRgcVaD#ij(eg*FIRi#_x|*H@sx5^V|gt54)ZQG!vG1PP3;&*lV1q)Z1@UPfRz;IpXONP46 zFA9$z`I*K{VJO`k$cr%A&FOQcbPgj!1?P!6oF5ko>+pIFT*5d((QziEjBac80OvpFd3aRE`H=_t7Ea-Ho1Vm?>r3Q*!WQ+%G1y#uh@k7V5FQX zo?7pq`ch>j`mgt<;QFekV)5t>o#+t7$#kF_6|d2BYztUdw!k*;qq=n-FkmD-fCeFQtyWtGJ!n1kT`d8zxpeuVLm3tO83D=I__FlVFr#r*slC2OfB;?BSP zY_4jRr!4^0iP+F4++@rS72zpVm-<=j#!SmDCnhZ# zwW`A`S%wnRuL_?ZW7>hQrPR1)TemSDSt*HXuRhqC2FZ^;eFKnF@hD7w(C^?^8+h~c zi<{{DCc2p0qwsO%J}*dYHd*`}_;8|QSt(2Zzr1^YekWoqA-}{OIz;}1l^peny*o&J z9^Zf-)e@^AlFcxg4E3qaV0Po+;muHrdQ2|rRIB0AI~xl9+tH0(i?`8Wr(#lr><@!6 zQ5z%Owo=hAAOGreKF}I61KEsBfR$%rnUxRG-+uh~`R55&2Sk0)Ct53xWpLf4^j?ef>me-^04hRL@#ybo{(q zFNuyH_4=bN8!&(EKjBAytfZ_l;Ubb%iZ8IRMS@NX?*w<);NuUA8ZNBAhpv)wh^fy| z(z@%eG`_d~w6s7OIp9*}qyN9XcWrJQ$FfEL%85|ad_yuV%XT^@@@C|%?!I#)s?YS9 z>bW20O9ezi63ZmPBuF`xzy9ov2Opv&fRdcro^vCr(iZiw761Zkzt#@y^>u$U)#^jO z)$4mzNy$`C4{`O62wtQ=!h91qQ>#7>+Ehe!M5rs{176_mJ9AG^uKHlcH;+|;9;GP- zUj#*|r!3JPalzngCraW6PLIG$h`NS{*>9#~eQ1jpw7d zq93r|<0?fZN+c=&S>th@qV7;7gc0NUUk%42{@0C&y_FM-o2gU3aY68cpgc8CwyDCs z()?sr4rFbUQ)-6a$PhT$|b8$0W=^NX+i&0A)`X(QS5w{Pbxx4#-E}0LqNZ=b3iK$?c>(tM#Noh_Wsb=ZcEG*GD!`;bc444ay zE3dxE;${-m7iMR|T`HTxm4aa8*=n9R@I8@OCh&`DwL-8QHCrO1uL=O78k51MvQcmR0)+U*$KGyFQO!`SDQVRdogSH1hpiqBl}S{cy-$kGWS~ zL}ym8FK(t}Jte)|2^`y{io@bots4V`N`<&%ez7rmw{Ux#LUGmP%idf3gGZ0T4e5>eUP@(B_F)gfL{YFu;XA>; zVG@Bur8yS_rMR)le82Uxo6d;C@|ZwU3951*hqi)Q#eXKiqe$PbG;{Q**{YI7ok&@k z-x&Tn0T4YBHnIufmwp*Zuc5Wur~NP~v8}@}c^tz@3J^uYx?`tP1JhxKN+cT|aK_T3 zQm3TPbjH;d_)_??rN@@`=hGR3uI$)k|LY)US~ION>VICH?C8fp9WVO$qkXvz$^S?1Y`VgKy>PJV9L7cAI^dq82AudZwUyu^5e#3Cr z&E%`$Mk(9fK`Uwg{`DV!{M*<6`Sp)~{Py*qfBX0U_7K6^d?6l^rC2T> z9~PgIM=?(pt3@R4@9yrBIb42ty8C#ycz(G17{{nMvv^#t?pGf+b)J1e0mn>y76tpy z-~9tZmsT7Pd)s(#yT)yg8f|flbsE5qNl9C)Z&~{R*y!HE>U9#-onMXXEt5-^qS9*c zo5J#MnZ5w*63(5+FUTrC_b$T!82R@N3_Uhu4Idb!@yakcNRicM5{X?32E2YFyw4As zK&ky1X`WxV|0N5-eluBF?4LsUH^7_eWLp*bb`KPVsoMaHPe=FR?9G*XRo6@tRz z*`%4?y6`0d*ltCiM&iKFC=NWoGvbP4>$G)&d6iriq@=5jvuKoAtPu*f&D9`-xaAcB zyV0MWLrhB7x_!j%A0Jxk)SbHUZz)swQ{4+k&l%sngb%=!kt}%)DH^$%@b%A-SX>ZP zxBkflf}pTwS66<~j%nbgFN)?9Q0+uf&+H^i-N0Nbu$fnSx_-xWJ&|_Bt>w7IETyBGPew0+* zRB$3iCK&*e0!1ahH7VxRsF|fC&C=A$u0S(S!`001sv#(cJ)UZ-n2d=BTlh<|+S#NoHEW-0 zLkz~qY<&af(>5vG189&0_z7+%qdjFvI=6v!)y}#;9L2t;#1EMgKeLecds3K~QsVlJ zz)Z5?>D9{@w0UtT8E;3TkOk*necuH^x$U3BUC63(9|vxC`UEL>o+=e&ViHv7KCs^v zOUbKl4$CSn;e(D6Zh9 zZh|!L13`80F*8^*Uj^c+(k5xH3un|0~H=WPNJT}D?ZI~iRneBm~Quuf! z>(_Rckd4fk-dWgVBVg-&7xd>XZdiJJ=%`QA?!}wkvPu&>DtpN+7=dMjh9p6}iJ%Di zc>0~xLf_lhKWO#1%@R@bH1n@`f_mg$s;H+`2W)bb&PS00^orH!=nX*p9_STVa$7`+ zpA?+Z|3FZe{M_~H&aj$?OzEw7*6Zu*9_mEC7Fe(x*&FZ!SLOFFY4Z8u@c~7NeMqPh zr|C0TSG-WVqBG+=QFW;xcXKW2EMvcS_TgrN{5D-gp+{v@pjf~w*NlGnLP zV_b@{C<6>TQp(~-qI`+iicFT#M!we4-d6`)`^J$rv&YYzwNZdVybfd^;lQo@615Km z^~XbEz6}Zu!|17(3008~6xGI$Mttl{+fI>a$TsjZ;0C5gnnGq&n|B>eMEAvnkj?`s zjq%f#Y#Yhnv0)!0KS+9{Xuq0a?=eB5)$$AJ=~y2?1* z!8jV!uh$8C1GTPMtLA2s&BH4T9tf(8 z9~dFy6X6vebefg-YEG9s`O;^7qVj{LO5FyaHBcaGR=`o0|709a^_63)?J^mzh86$D z7~{znjndJZVqTi!gn-1x2ZB=Ohem2waCoU%8t`pirgVdPAgFGB=oZ-E5@(5UJ>A+y zhJJul8QyRg)RzXr0r33Z(zdb51GSL$_5Z^^8uX~(m8Y8?89bmNf#<)$y=^k|O<0v= z*sFw6T5&u04!)TJ`n3_S(ju8A#Q8uzRTjD2rIv+4G&ippx>ifR;wI%)~T2J9r`_rfy{b_dz4H&Z+~H}pwPOt%CVr#TIUF1%5Q$e=B~JNfxNLMk zq@I4Vf3)b)$a4z3f^QX4`u0;cgVr+m;@Kx(VO!jYESv3*W82ANv~2vNMu~pfQ5&ns zpvHJ%8e+#AsWTmQJ1IDHwM=1NHm2IyL=9(pNcEb64JQ-HTA0QeW+eL!1^fdr5Cy zf&420qeN?tu0)q{J=C@c?^66gQ0m_2Q0dcOKR!y_^ADDC5)Jxfb&E>jqv#QC$74shmD&`+R z>FSl*nLHBGPg11=pJlVm(%9VyKxucfsc^#vVhhnsmF@05+SmLrDN(yOgh`LIwZ66$CY$0%qZJu9z+ZELCvW_+l;0;n zd>4!@C_IvstC<0y|hJ zCHLc$c4PMs6+Pmnb_FjHtrN;=$A_Wp>_);+*e3KkxP&GhSbj4U&vuF6cpV9@LWi~M zzj~>@YoU%A+gOa!k;0c!{uS4EOy+x->xz95#e&_SW zr;m@`&a4j<`v&ymmf}0dJ*4f!6LqVoOiOdWowG6slDeM(n;yv9M}!@=~eJAhDbL zzOGa|FoQF|KLGSN;la6%U?>v!A~3f&7_i9W2~G%ty#mH4zcp$6q6<=c+G(s7uwUb; z+`o8*s(>lk>CF@y$t}SQ zO^c}HTmidoTxKn6U&Oxt;0l{_cnTesvX-2TL#A-;Zy9a^_{rL`A!73BqQw&a7was8gKu}@-G@{w4^_gy}k`}hN z2z;CxK8-!_{9J*cu)b#?l&FE_8!0;k>`NQo zHSK|*82_c+k{=05@LzMQdL$^nKLy{+YN7=%(no@-{F4B$V9PQ|!)6b&owEG6=`pNB zYH;Y17;2EFvqWfzJa9>rzN^COg&qlt_KyKu&45hQ;pX`xK~?^1A)`l}LKmrSQWd&1 z>9MIdfk}@mg{{+B*}w;Cbz`G;;fG3(`e0Y3_WT$=V!HJJ3h%_oe789|g}oRFs_G9h znpKLSIsJa}V z)DD0xj#TEQ{t=)@fDVm-C^kkWtG_YvrECHa(qlYBgjOu$$PA*TdWK}&BSEcwm+I)G zwoQu{z^6_;)oa4#^0Uyg;i%j{X>g;n=4GCFg<@m&Q*dE_tcK4D zm?wIaXoSZl2^w7CCk#Cb6bNmGK||PfU`N6yyhsUZ;KN6x){z;Fy_(^ZNKglVG>HRz zcxHs7qep^HqVofy$7xQP9pMv2kI9TCsx_Y~fjq|e&chMXBQ4(=S#uS^JF(ZEexzFi zi2&K_M}k`QqZzX;)%90N8tmpHwj!Vk>5-r$z2(UfX1B^BI)gS-l%OAi!i;^)x0X#& zw+c#rT=aN|!-dH&YT$9g{0I(F_;>NUSkONK50eYmU9 ze_ZJCszc-AEHJj6dm$0jY2Vv}R-zK<2ku{1h`Vhl_bQfHpJ>l;v+8H&xLZ{c6`ZB? z>P$S6Qf)UQVJqpejpH~SCMgt(%-~PPb~^jy2BGjI#!(+HaH-)KVAUOPDxSfi>XR6YjTILVP$KmG$4@M@)}0 zoj^RkX-A0NaxX=Y?&Tvvee}TqV6Cv4gLO~>*-)-s8V<%qsOixy?2HcZGBky&NWC-x zw<|qbHAFFZgq;q7I916RIpU85mC8>+H3}J+?X>KrKw0B2IFXp5TzLqWO7b63vE^*z zZE5&OP+J^#8h5t#e%HrMwzF$D!23o@6?_a$JJ|M28ny+7=w9K!DM<-|U+9a`RKFGl zj6yWbie`I0EdQ|3V^LQbmd?B39|C%`>MBE!!5&cSQh)yt&?8po4uLKAPc!Z6=o<62 zI#7IF3GK*qN8IFFh8`cQWF}mjm4WbFaE0F^MUC?P_9_Uo*S8rnVA0%|nbsJqU2nQ= z*bvjrU=d+^8dc*S37@Awh1DBgvqHd#)sg}6QDB{5To@l}1wZWH7;mKMg{D8tKZf*( z-)Ia6;%KABD{HV&O63wY&AntAT6w`!)J)$84|fGh!E2pkbEAacAQYw3_wfyz4z~+thlBq zls?*L%M$%1--ls1eZ`ND9?|k}ZTM57f(=*MYK2zhxR#}9Vy1h+_r$OLgFufdc?RL2 zj2P_H9iPxI=%QBb=y(T%pvZZWNY$%<+*^(S3y&0DB26p8B`jp{3J{f-ub(&h$+l}za=%C+2)^%~HixYEDKM!`D&(>Ps!-&qo#$ zJoVvE)#jt@|DFAg5V)qyhx*5oAW3|;V@Z#YdUhoXnuSKt35v1%PUxJ+U>kao-Aq|M zEN-XEzW|N?iBGuvrqG!qD2slMouIWEFb^ax;hhOib`W}c%<^ZVr$-lmCVF~Yaah`E z9d(Ln&xgoUB~&NA(j7yyN??go4}O3Xh@hrA=4!g_3sW`WZQ54A)`(#d5`yaK2hX$rV)4b;Zm$FkDW6j}-&L#a-GBVeJ@BTxGa6;mP53^M`H0Aq}x9{Q3i z?T4~I!|(`~ws&!0Y>}XT`J2t?t?0|BW5!>*DBJHk z%J!PRq|w*k{)_zsr3+J`X0fbFKO%aJ|C1mky88F`c=I&{(+!Je+C1gO?~T|jHUAOxhH~R3 zJ$`)C5tT_T3lkE0A}BUK$f@bJnAQ^M74r{UT? z0THKLZ!JyoL{a_x7?sw$v}p@yILR@47i(|4$O)>U52k(}+u$4ymA7~zER6oji~jF{ zMg&1E^fmw$8hUynsDJK2vV&%7Hlv-{9KWs8v1B9aeo9;R#fP@4VX&0qy#fw zjBJS?1!3CJ%D}c$mB3NvheVigI00B;%xi!X9GN00F@F4Dt}~PwQe{}L*e8Ml)`GPRXe+1$;fRcPMy=fS{;&JH40=o?tmf z=ATM}lHlXhJ4yMvkg87O06_HU$f!3%tB>8J2@1VWTzd3~$B6u!8u3;cT>E2fVXO@n z`(e@}Bd*>8-`746MN&$@8gASWRQUFl;<^>lQmmbBrs4TUwq}scy*IFYo zh|m(0{@z~!9WLvs))u2~FQ3*dNEY#lp!~Ok^~zDZv@)mbDg#tnH7|H4CMf@X1vw2r zY`T02gL=+LVZ1O|xP^Z=et&x22Y07_Jab=dZg%L&!&=UM{|Q0y@BR`nr*$wBA*kcs zN8?<`t4ii<(=3@P<%gB?qWq}n5~%&u0(6$AiY+T%#2YP~ZGIc% zRKP-&uc*sgu-<$9!$6N$4JLO`7=nw}DdUxG?V%SVL5=Jnj5FZLBEV-vP$T=)Qhr4Z z_!PC^MR#(*%0=W>s|2eZN`b-E*(5WbvpF`>X0ph3sIE`}>?GW^ zNl^Uyl9{B(Y>uOG!iq~CGx*>btDG>Sl=#dvY_tAKb{E}}PQm(2Io9C#PaA@I)I-%}^kTa1UfQE+ z5|8mO`oYm7MTfxQ&QysSyS-qGdW;2c#h02d)n_9s$nJib|7w4o&(LGtdpTSGkgwu*1eLB09UrQ<(d|5LPuma$N%PhsQnl)vD&a~bO zhrJ;EqeYLN-EOr0hkv-}5xf2P&)(yH6?*VJL{L&XD1u-L+H~Sf)WdCBOu=tvPt{sm ze-A8EC#XI>JVH$Qp8YXliYf6ri>vL|Y6S)&(>Vfe*s{dBYCkASgw6^k!yLhG6QO4j zfZ2zwCP08ONl*oPY)m>O=xE(w6mM{L`w`NkX>WH3_4Xx9y%>xXOR99`r?mt{q=&lT zgGUqgBzn|s$>W!%v_DuZP@r)FAbRZTv{vscUtwexR&OFKM)3V6p#g;hKe)R?|xbd)GesTYn%`{6K3V5b$rAGjwdQ~e@#Y>V=-(OML+n@uRo zCMZ*V91W{Cm8|P5MCE~?K=l~dw0@gU1eK{T$3%}dU5<$!QMw!xJu-7SCVE6>jL9V_ zwa@rr(W5h$PZd29aw(=y1jV8+$3%%w9E{Z<#LoQl1ER+xLVB~el*vBl$4QS{Bw~e0 zUX?Mx(b8{Q&fD;DD`o?hj&`<9m{)qd;{aY=`Z2g}I@l`snPD*$zQB)_9v?Y8w}n>L z9Tf}s0a79-xyU2qF3Q(cWE)>N9i~Q!s4X_^nqv47(xWQv-Dlh_kskv+UUIb<_9s$G z&j$}a-6p)`nEt#A^89=vDC68F`K{0|uM6KY6~%y7=CGS&GJaXg@4>FWPXr~LkA@iuI25FJ|dV#Je~XGaH^030pR4mIU18^q3GYQ`RpZ96V&As!-gQ z7fGgzI&9A+KTvu!Xb&i+D2pVmTTCVrj$dSksmho^#(?5-&8NU))cI{jhhNi`+fW`0-%dDF=o)RaQvf*tUySz96; z#y%)9s&Lr6EQ1RQKM_=9K5J_IKq>L8qm?2qLs#v?Zfza+iZ8W{KmRiSn|>eu9K0Sb z{0q;^e_ft_%@WW0xN7nxJb(}U@TZc+EEZLrt}wJY$boB%8-g9dpGXNu(;jp)v^>EU z%o_{^+sLwI-KIl`p`95oL|}W)PXtx3gZ41)?IZAsp!jtNG~0_SOos9kLG|lBkeKoU zCQ<+t@_g^$e1Vl$;)dwBuq*JwBzr$*@`UgpX6q}=VUJIlNv`xmB~KDZ-B|pXC^10V z=a-YyDY%XexkNZ#hK@BsvF^R~Q;E9T1(tSxA}G@xa_56#1eUyh+${ZjIzid)(B{WGZH9C_=%v-_a5k` zTvt31x`0nlvi@-*&&0u)!h=!OO_E}VZZI@l z!y!L9f^>R_&di=(-Tm~HTI4w20Tu&64f_yNDsMF1>BaVxO?^#+QX2?L*`Ep93zeWo z{eBilTBm6EF!{<=sTXs-!MIWYI7;00*ip2B-R6f)x(hb!C<@butWa~@VlttOWu{o1 zmK#w8%;f*i-a^@1nzK*nQK_pG`?qWa_HUO83A0>bL^i>QJM0tMqbA@&$el!q)X^S) z^OA(6dYtQ!TuD-5`?N#yi}E1{RH5sRyT$%vj&qVgeZE&5iTV; zXkihgsQtEsb_Ue|e*YDNXQsvI3APV_k4SBZxc@urVf4eI$4w8cUDjZ|nX0uABiNnB zmJF`%A=nR~4|1UQ5*U0T*aDyr$%u=!%1hX{4j{k_lyJ+_xEMlXjRaNx58yT8c;R7V zf@=SLRKfPc&2;|PX}xKd`s-`SLG$mgU;oLz{(rwmHJo)(&eOsvHiqOX5LEde6^(1( zTP42_8|vySTDo?0HLUmACsI8Del~V`46IA$H zrUmX!u8pV-@M}KM4TT>%J<@X&I+kmo)vb6AcY(y+j1~C1cFT9sZWsZr4JWH~o%-o4 zsfGidA#eetjo?|m!J8Uhz+N|C$H2${t2b>xu(75=uj?%e_dthD{R2XeP#ql*s~@qJ zG8qgCYr6yc;nL$%CvO3OIm8+Oksi4!c9M2(Xn7%vT`n6qcbY7-iB+@C_jd4kKX!Wb>6|4#dCKW=sxa8L z2OB(-q_s)uH!~f2MpJANFh=eqRjsGokLtbht4Zmo1ZDjLZ&tHJjYSIwk#*Fn3$sQE zb_EC<5B1Unprc2-4roFSFFB~#>9ek6(uAphky7mM*VP;gzAmLd9!W~LzYhw&yxUmy z@7mrGdiHb}))kA{3^PAaO8hBs_Gb7VWuY?MhE%QZP}^!HEe44LY%S!v;^oGFz!Gc$ z;A-ENKn`=*Soso(c9e@ZY~_ z$yTs{MHP_S@l2}2!JtZ8-*Ky^(5zTR?Qd4Lplt~tS6al(dq+N#>V5FWP$}`M5SH0O z9?N3+*eAyMVcBEew9-aZS~LNt)ibG<2}6B?vNbtGu}v#k=)a<^L_aJ_gzMBQPeh^* z;6$(K8P8t%4)YfL2q}@OQwW{b`B43O&;9C%rh73EPT2(HD?F3xptYcd$}-ODSKJ7JD~|lqKiL5t~-ny?qf({Q3{I zjnyC9yAO$szx#31V^chBQ?Miat32)6?($@d-DMNZKgr7)j6@(KLKBZKWxAEM`V7yk zE1u_=qXxJ6y3sephS#P$tD)T^6hK9f01uo_N=$4#ovIWf-n3`1%iPzFA7-DlbBiIwp4dzOa(Fey zGr@)q{qgu#@SMMhs?Cj15mr1_HG3)KYbKJl(en4>BulyaHB+te%Z7zgJznN2<05Ru z-L_S)zZjLR&l6=Fo=LTGI7UTVD+IN&bf=0SQ-oAwhGV8kp5hIxeL=y#0aEQ5j!l|# z?xY2liown7GDhLM#oi$5GpSw;M=_e3cXKTHAyJ}ONB5wfyo}q0kuNp1voiVv&|Aq~ z_@r7icxH4&nr8MFjUJC$tk%U$cRy^ZZmwevktsV7sm2IzV)Bz}Jn%+)EvXI!<5_fF z1(EgiWzT~pRh~(8AD9487g_TvVYN^Jei@RT3A$CA#1n)P7%pqjtb$^7b_3xVOw!X%^aj=b2;^fCKZlmry@Q zo$!OC#AU`HtwVcS8~JCFV*evhy&R`j!>Y?VHLXgAbL$6AiPM}|vin6JCPri8kH5@+ z#ZUEPr9^K|og3DX+2)@P3K881pvP0!Mx;5KVygar(^R9e_sXbAg{!~L)%#n*!k6!z}1xw4M3T^>Bc2jVz z!TnHaQ=-;FDR~`l7~HK@1BO^00E`j|3XrRIxvL|cYClqX9LR!+%z@crbM+(PjGdI| zxWVT7l;s@mNSry7_@Xn{GOp0Wx8EwTQ{?JiD_7Igl_^Ss4`c>To*$ihb&GV+#aUr)&hObCU5}dr=jb|Mvv4SnLWkB+dVxKl=SB@8R~V`Ken1HcYE0&vg==@g_;@mNxJ}_2XxPirq&RzJrFEs@BpxSotk< zRfbOF6W`0!+Mi+aea{3Hz4wO$?*B7zQDRU>Z(uN_fy(Q3-s$LsBD@uY>af`|$W%tU zX|3LbdiAYsm2Y&o5)l2Fct$gc&9`(Dz<%?_O2lcY2MPV6u1g@c7xouN6O{fwTDxLh zhqk@3yZb|wl%Gk-fS*|9nb6Hs?E>!~R!+$gpzDaZA2KCE_LCq};%Y}ByMxG{S|Kcp zpb+?;5ooMhoq_C3+qQ8mQ%#A7@Jy}hlEL4~Q-wAK&=r_|FL;7t;8Vb3S#!Yvaf4Yb zd+E&BaBosdGbw@a6H6Rbc5H)~HVA;XHJ)~0Wmby0RiR_+*n-E(qP5|luvUG~1VzM; z8E9>uR$T4Mu<546&JKb**xBF=JM=)4+3|}HcA51LB6Sy9w;(!2P}o1VX%g5e;+deh z_z+?zl8;m9j`r5w)X$Nh@hp?CuzTp5UH!XNsqVj3XXNZh4*laqi3bK5wM_{|KytvK z^<$+(06o5Oqj?cv%n?)`KLTnjF1Kz{1nK9o1O><^gPgUW(w+<}o@V$WFMd+0srs3eKKTgT8w5cJN|5&ecV2L3Ss%8uuOe6dOi-qLZ!B8X z=ED_x8TQWeQwoBj1ecc17V4|)`f!Eh?Ptf6`+S0H1fH27x0 z**ENv0u$2f9TGMj0Jwl=?+ctYq9Aj!>&qsLwO{W3o_AX389fnp)G) z%frgs%zhb!TLeBQq2uu3bn{g-WPwn}!a$=jE9h`}a$5gRMZwU zW)=LpQovr;NY;V}9SD7~q!W+?&VqNAEJO_)Lg-5%r7P6OB!yBAFD^J9y2VHPA@jXmOlxxBS>S zv8{*~xdom^gNGbL-k~#*HBUM;tu($|Qy?KjD<7LFl!-RduERaw1bS;dd7a7O3xvwi z1q&Rjrh}JUrR4xbn$n@(o2(HF?w&Ja3oIDmpUNewV8FX&T*mG0i1$&%+ks&R^U^~? z>~w!$p2v!lBCT0ShY{Yc7lKS^mxoqEy)W4!Ht>7FCs7=CwRoYcI@0Hxl7gF%M@pZntY{ktHBB`IV_kVje{J07|ibU^s^kV}9Kaq{}Eo|y7h^`^|prj=%_Aw!L zMxk;zK4N&inI&@4J{|(_wB#9Sx^0=u&#O2*+s+x-2FF>~+ABS;d59KJ|3KxYaWcu% za$)jlf`S>x18K_kU3vAVgS1T=ANa!sSX)XF#kAQG`bE?S*ZEe}{J6xWhBP1t{)0bc zhy_&{EyhAj&inHk=LIG>K-!?kg0kjQP4Pwj2miy%CDeKB@^xkq?(bF!eQf^87eQEh z>pBi<`k1J3`X8HbdSoiAD4`O1#7z8-FEeeVIgAoRw7|r!1x$OJ+|5G}_r#~<{kwtU zvU*ggI7a$S8r!f@IeZ>?8GPWa`r242F8g*02D~k9^Xdd${*}70)~YHPKyDL-tU!_$ zMtX%1^6J>Yc;BhllgrPQ`!kcueso>`NR_}4i+eA*;3I>ft1`;v)otc|0L>GMIt@F! zje|0AGjJ11O5ITR%$ND>0ZbSn-ZQ04#@^LEAV+>sO8_ha&8c?EKE8{)W4`-ClS^FT zJ%6Pxxf*N(Rn4Fd6}wBCnB`WRwdR`=|4nte_{dfGMa}l^&_LsQ?u>CCV_qyDqT z05+)8k6c}esq!&^FeFW#mT zbsO$u!dv_o)M<0JT9dm(td~OqTMYm2w+Ds~7(*c=@Ftl_l~j*Lw$-{(9fxEak|r+m znXZCII^6DolfWTb`W2smHoxJV#w>KRu58Jw+wh zIxX(CTC+cCzi3LLI(KVO`F}5*ex8v~GTv?JJA)<8Tx^+oIYb%=ST}O|fgBGPe{=Vx zGX(l*vb1@3t;fEElE`h=4p7B_9gaRs4ZHU{cic@^fp8R+1Lj7el>ccHW9oV*#WLzE zSs`oiP8J$81_$YgGunWs({4IDG4T@yCX8ZO0fKE|wl)x@LioX{q7bMBC?b|!my0$l z3pDE6n$qv-&}A$D|0+}eeZY6)wm?W}F77b@Rdziyy@2_zhiyfz^Y_U|4i25+8j<}fln9=}MVZ%4h&5T-G3S?`xXeJF{&tjJ4t;xb$MsaAgV#a*0Op{c zD(7;lt3f0whZ%_9Hog6%C5VjYQF&>vivniOtcudS_PNdXHX{`G^c^gp(=?q5jxRV9 z>h>i5`zQ0oJ`Xa{wyFB2={}mu+a>XFVP;)c+0CIL1km=*V9YDuD)&N}xa^dH2M11L z#C`*>)M8Zmm*8M^1;o3ir(Nxc%5rWjl~V?#>){|qwC0mdZ3!-zV`BEDL5)>*hv2N| zrD%h_MU}XqOEWn@jg{y|oER&dbhd&6UI8r6;6FK!KM(4uf(`6<5ZM`V9-?wg0INBCpMOxef6>zo zWMPjT{YCB?$a=kX5fKI|x~1qB+S+?3i6`@^--d>A$F8oBOuPLp&9;6;*^oD%Uf4`(cDK#R>ysOjbI^bhk|W`r`nb@ghbWtn341;8 zye)Q&&GrrN0eT;8^y%NZFutA*$6)QX?JM*pv z)fc2mUm1If$}zvwHOWxW3wuMas6uN3Yu)?4$j{w*#>%n~VD(|g{l z&FUwFKt;m>A}!8~e;+(~Hkp zMhe*EZo0bcYd^2teTG3Y+=5L$HuSJbAN>^3Q#3NSF4mxY-cbQ%VcBw`+;*KwV(8Tg z10yh!JoxvqEhHr*1RrK>!={~t(=O2u>c!{`-0(AkW(hs?W=0%@%8gyW;SKm_(WC3< zR4V>Vo6kH4yH9hCpSQ}j(kF?QEkq?(owNrFpF=un#2()Au+Pdry`o<_LB-v&760T`&H7vqHqUO$YeAM^L$#E0GvtyR#?}LJ@^=U>~Yp) z4fbl;?!Ocri|<>*H4@ebHigDrJnhPMOdke1oP-C#tuadiIi!JA2|3QaFDe|Zm_aCM zyJUjES7wMlL~KP8z#Z1xlc5AM!9zucN~Jl)^A~OZnuxq6Rt?*aj5q%oRz-iFZ@qN zxr>}(r&FYCLeJ8I)8BksW-fBlTiNibWS5(4kx6m}H?Ab|$WFL65RAclOqug)IDTsH z2TrB?O=7$U-%bi;^~e6wg54)fjo4)i+7x6F=39H8bV%!uZLQMr`+)Ai`7P^iixb`~ z0OnbHDg^1XWB-1AVjJW6?4o3F6L%J3gQ?TzV5mJ>WFa1UhJx7@V;UDPC?qLM9^5a4 z&A|~WYAu|XH8pBgv{XUhRr6>{fxx1F3f|PC$L9-W@iLzf>y&Pc35W?Uw1noBN#lal zWj1Mp3U7fQ-6JlUId7Zq3pmLEvtq)m!&8fX#5!z)Sa(KkOw}I?qCVG>CFjLTGZej| zt+K?y+8xR+OE12=^y8*cQ!LoVnxND~|6DQwbPCoyv55MGF4vy^kh^Dbc|dp2lKoq5 zUTRFGQo~yo0xGeuxig03zxi{;B^#szEEqIj31S{nrLw=JQGu}D9LNOm=ZOB0$r6-E z-{^5lCyx1W0x zBi+jQ760mnU6|a!=OCo~K_7f4N1VuJxtSAp-j&64BxB|e%8`DqI2la? z@geGge>HG8uIq|(+s{y?lyUvVX#dJJc3~X-BYaSv&7p+>7?bc`>!rr&z2Qd@M2-bH`0 zd>MU~x4S*b>)s$BN_XjpdWelpXXMRQuJ1aUXrOf{VV^XYlToY_=2IJO2GYHgmE1yL z_s%eV)fi3E063v(O z{E86#V;bLFd9}m%unbj_l%G1_IW$XC103VJO_3wZSf6c z-kxs|+4Nr+o1PJePqSwvk*pT!XDX<05u+rMYGZqm32J8gF!8oqAeZ=n6Kl_j8RU!OMPZQ+?LGD99SzPn-H3g88#i;Sg`8W&UcO8ka)R#vX)_lt_-;%M1Mh9T z5;gtpy`*e$f2%orumeCO?gFs=|caj?>h` z@~Jfj32}=n1|Qow>1M0{(;UNMKN(;ejs+j;W1BNvTUBq;FrcGeC|3CNeY{~w*WPcf z5-+F#`-WP&*Q^#s{)tHY zPkAYz8p7KAonfhH^r$8voi(>&UqS^na8zOPbx)7P2|e^+Ts(kJo$Fkg3bId{lJEI1 zM_jp(aJ2_GCsqn&4U;H*RqC8}_ko6f^z;*uHU@d*St5b=GHWD7zl74o$!0X7U9=-yFp}+)6$GlcO_nztu1e z*S-Ca!tX(~(VW|7A$9Y@!MF7axEGsRtzDzhT6RmYJVUR!)r&ChOka6qKAGJtkWdA7 z$K-Abpc!bYzPpxZgDoJtU*Ar7Ee8aP)4-^`NaA+)z(*RF3Z8>Y$Zan7*qBHO)?EXl zp3m2v%Omc>NB~~aFcI-!MK{Z7Xo+|Dvi3)_&OXvG+{)E-viS4p1S^3C-yDb9gJ<5G&37XZU;e) zoPdZi6Avzl#-K01-}hNLN;iu+v-u(t_y*0qYSExmEGKULMTmv&elSC-fuhm0IKj?N zmtWlcll%L0nmFFciG2=15~GxG_?3ZLsvR2zwUk2l`Ng7HQTeLvgj+z(19yUup{=38 z(ISHg>A3ss@a^T7^>H^eD*^2A^fTvR`JKmdFF{j{K==0}v$prgwtAJIgG|eZsY3xT zw7@1O@+6%ugHH^gbjtUBhqAmj$5}xalI5ob!bI4EZpocF&=f2P{MCj@qpI?$&q5U} z9TXoW$F_w8Wk&fC908duT#*(ErE%*1-sZ-5&FLx{Kl27emh_ea$3VAGl$^78kZF8N zvtM`eYJicyp1_!MNfG?;esW_SLY_zkq)IFN_)J0lXeA}1@_Yo65|W9|kQVKVZJgcL zxGd@`7M&yM88*qBahqnzo)u{)i2~*>WBK7PWKqcL{3k0XmDQe566wx1Ow{74uqrI8h-IZIBrE@QaTsxG$Lt}{~Y_@}}iuQBoy zjI`)ShYBcD#gWhMOoDKhPXiEXZz}f<&VjPT5FhB z6_2B$9CDU^psu zk^Gt&xG7TJJAASgPndW|Ci>L{t{m1AZhoXI#cK`KJ#!;u%Kl%xV1*sDx+(V=!Z;+< zU%;BA6plu}uyYn1W#tyzSw%VYH#w{u(+x%wWw`w^>o1jmR_S5glw9{09^Iboj1l(# z?Bo}yjuL&*mnUR@tC_)%hn|Q7KlHO8zXnNVvW>|;HO|}eeaZ~a)%J_c@oU~QGPJMV zU1ljk%;IsAm794pc`PtTDPgk8t;4IV4smp3dYyv1&p}lB@G4GPocPU3+zb z+(3xMO)jk}GO>}BL-}z8n@nl!Qbr$5{{Zf#cOMe*tkc(3N})GPW4WqK9%_RO;AYk@z2~83Fm#4!He;p98nYX9TG!&Vb!tcc$rm$x)sjfBgYN&4EbMV4H zOTXs5PYv(7i-*5T5gU%NHAp<^*&Mh`>4*x5@o_D-+4HKJo z#k)d{PjuPcZ|;xc%5*MJgE8-0{S_XRn~+IMj_(!fYs*Pn0s`R)Fl8z(l3TfZ5(l|N zQY%AG3b*)2%JEGu0ZB$V{VF5A?jnV8${yK$=Lv!pvJ&ajtcL%B_AamE0Du?HA^20YS`5$*#ISbFiXoF9z^Kjmto}2yv1~D?!vVyZu zYc}cGtE9J&pp9rx$Gpj~kI!{g%gy(8+xOMwQd+v*vuS6Y6)>Y7*(oA)+~DudNT}Di zx#7g;f&lha9RAu1^C@)4TYrX%6$0sE??Do@4x`}x8c_0#jGRLTebui)p+Y?4!};&F*2H^7FgL7-sDpqI?IC$G_xP$giN)6@3-e!ddFW?7Y4l;gR(Vl) zxQCehs@VV&bS3v$hGG(TG*KODMwfJAz=RvOf&NswprZ4ZAY4~6cL3OIijVgd9avd& zZP*y)&B0hn=6NAlsq9Dg?#TL!e(Asnesz1hJU?^EHQX`6he@m}{&rq^L@?<8o+GLZ z^0D$9?3*=zdQW#e&*tH(NGjbHs&9Rk*?JtQGP+!jU5u`K2 zmABpf*}v$K!(8yaPA3(Ja(aa#zIxXC{ozda^K%)Yb^EuVT=2U6{ON(&JBKB%(K0Cf z5U_XSiOX*JD^3jU7hOQVC#0b{lqz#u`*zrVJQ=<*VZBY1rDB4iaQsX}5LMk~Ky1!% z`<6)XA}2D~0U(<5vD3RCK!CQQG0YWVsp8Cw!*i?Go@RaBQjBAl)zw>h8RS zgJq&mL0i@K&g&+jX{~q!mF@u;!(`6#mGZpTH=d3&? z5U+h-1oivAMQX|~XXP%iz|1z$)sp)7m`mMMF^7RNzvExKPP$SG$4TtsJO|F73LwEP z-Wm}J-H{jo=V!m*H<*&}_AMCo=}1@^ue+!^tYW-#JJ1SXu|5M>bNi~tGI+ZNg3*U? z)*}%|8`rH=upBVoQ5~Cs71jxm06gr+v}{zh51<92HbM3fa9TafG;2Im*9~}R+z^Z@ z1(IoeG*B=GSI+Yn$j9qOm|fu;Vbc+)E?!@+2oagbkmpY=5|ZcLFh37?&AFx&7jVh~ z=zej1mG8O?e6=CfHrxH;mwSGt0PltMTU+K@ErNNHxQkckj$snj%{wk{d7GWxr-SL- z4ji!{^jjC|vu5?XT}b(yZ-&)#V)&E6K}`k%`wP0F;4mc{DqR{YA+H6$MDBtdesMs< znUHdCvtX?aoS*sB{Eq<*l$rF`56vfIiuvo!c`R4es5K~t7rKZRPsGX1O-P4PkC;ID zI2JT1yUf>BX8z4%d1lFGWBt&f)R49aV0&NNgGE;L4Jq~4zH_M-Nh8G;1;hw0%}Er< zE>h%iFfaK^6{w_qV@VR;yHC?ko8T9nEPg^VP0uo-8iOVm%H>3h9VG>9@(-}Ago?(* zBbfp_ae-ruZTBBCq)=uWva7l4`Kn3Ck93NNbFySN2tfQi5B88dA4t^YkBs_>-Lzf@ z!-Aozi)btJBTx3BTViMr{REHqwv5kX;l~p&kAss56~zU~oW2I_O15enWsU|p)0QZ? zS-&RY<{Efn2xbL4Op~M%Z@~|7NHQLD4})K#`V2^Rhbyl270o;a&7Xe52vLj6)ldys zwWMY^&O~0+#X0)bjVKms3P1Wkl6cQYjKqXzx-ToDwta@4`QmcJ#`8!Dku0?ltIN?I zg7e#+=S+4|)68~8bT2S`zK_3Kzf!zAEbpqi9QJ2Rpnvt<-RdR}>og7!qpC`Gop%oM zy4;g(#BAw#i~qlfys8&g-1y}Z-`E<^CMZ4`fpLXjoeER)MJH7fsZNE)#@>gnm!W-* zV{2lip}OzK#iY(K1i3)4S!kimtgrh2*us&L^PxhYMPiXbi-^OSg% z`mJT@OAAh`>DRaZc6SoNuj*t`_vIMFSP7V-`q1BjraC69*`+2{!JgsW;qJl*Ew#;B zBqK+oprElKrSkR;-HNu%_Juv4kFdL%@8xihF>q2Q4e%wS?$s6CgOksmvcfrUN_Amb zCDd)=G{hZV>3-b|cYA(h>wY~CTkC$kG<$zVcZ=Q-x`t(EUA~z0e%~Wd4?DQM(Z3;g zMZGhu)ezeIyu74I?LP=EZjW{jKMHP-wv7m53?Du?^?J}(JX-yZYBMqLTfXM&eUlg8 z!F2GZraAJd$$aCnWEQ4hJKtdW;! z^6u=h+mK+z8o=TIp;+Sc?ONr}NZCxYdk&e@CWM*?M;pR#>#B|NHsiD!in>gh1EZSK z-Z$IuyZjEc+%~#FqnO2Cfm`aDit@eqJ(VBl4C-0;7Oz2jD(B_{L3lh~8QboOv*@hz zT|677XpdXCrW4oPoeWx&jX$tc2ZXGO9J$ky+mD8iNU8MhJPq7vl6owVsTuD5oufi! z^5&w`aQR;`OUQ5X>*fA`=kL1Q)_^wC`1(`%V63rBYBxUk|B=G$qyo%s;dF#x9j6M; zx%~&CkzVMsF>wGi617;U-jgO@6zjDnG59%cEnADsCK|f#I9T!%vwbQoBXsisKTCV&5qvAxz#gmn-$#h? zbB$JbwQs}0NgR&FH1C>YsGmwteY5sM&a}IrbVffVbp*pitVldQ7=NOF2V1Q4X7I%) zv)EkjvgH8M!_gx25tQ3rW8vSu4rczS6pHKHEyL4%fKl4-Ia|refuf7BBC)uzzs?>2 zuy8Q?^X4lA<~I8rNQSaxBCN(5?hw?GJCO6FGr`@jDEGYTz(Oal>t*5{02r6Z(mKl6 z+p_d->G-saJ(?44h1sE>8bTyc+jMd>8Vhv*1BvDC_lxL@&0wLS?T;Ap*&5K{>gTE5 zk`p-Jkp8D_-_iU$25RA;QLuUU3u>q_6$2;%^ zLacVuA!6P77#5m+{ArjMg%+tVLL ztbP(JS-x_4LlPl>aZiz0egs=$+AlbTj&TBBD-ot(=L;F}$^D zqH(`6fp1Gy&qIgb`{rmp{_LS#sk@F_?~e%Rb|&E6km7Nln>1B0aqQ_&6IJJ^2dV8L zR!$2zMB+wNTI-TQeDlqDer$}HC6dVvXX@u@o+%WMmhOa>a?>KW$ebF3u(#ygW#v_J zTlii5tG8?g6kCZj%S=;x*s_Q|tBR`bQ|Eqw+rk}FI>EeiSgM$3zZ+UqEV^OE%Yzs_@~{b9 z7eL7-um}u^%?)DLV9{VM`?Kj960~R5fI##XqksPf0kyCyIL86L6PBZ0%Z-=DjcZ`H z52yl5jayrzc9i%gKYy4zDt})2EVt*FK3Whxf{eu^g}5S`QOsiBH;1B8*rX3RQefIx z(c18!52=RBKpq0%TM>kp)=4{(u2gJl!0YSfjPoxwqOQb9C8n$5+3eWnrMfqfQn z^a~c8Ys%(L`oZ&LE;+*_BtG`IP>Lxn**0fPtgM?x%#0KPg|D#JOdoAm^dvbTT_#x*f=+<% z8l>5NMKyt~rny5suV|^iC@*$sPc0yiuEWJroSqEl8E z$l=FH#S<&VyxRV$K|?->OuP|xU`|k`uKH=MYbl(VLByj+u22LgVOXwGCEedNhNC|x zkH9)ll*N+$i*np2HBSiPwQ;%>%nb-n-@ESHZ*gWC^;^(_0qiX>d}4`N$dJrU15^c- z**f`@HT?nGxjcR|_YNO}?qqFR^GgTL_FdTNQCjlRYQ!ta$c`LBz2P+4a75Nkt_<^W!Kw#PtFm!T#mw zz?>Z9;(wmH@nYsQy7s*ILUVCq4;g@o&Vn_W14GN64fcCyhJ?kJ-q5_b5e&#Y5qBX*pyh#Gl_YqY?zJ8}s%H27ITZ zqT=I#x>OwAjn}$)SpnzapEYJ}6=1pnA0p!8E5;!OV@P}ak^8zF0h3GH<|y;07&SsnFG#@F6dwZ9)jl$z1Kj2q23xK2D#AX zYnD!duz5K=C^oL*Z}fxJ^}hrcKUr50$ZDI*FCe1}P;IKQal9KSn&t5_Ub{b8L2|a|d8aInWVm4T{%_I}&{4~iXxD_LW0ES@GQ1SLe$Qdxv;=A=1@)@A132z5I z#J0?`_~vt77&~Sx9=YNrrI@}vW5YQ|P4=o_Hg8i~Jc~c4fbSA2{H}!;D(K z3F>t}vEJt6Y21e#a@Z}dPOLkK8akMpZ3+)~^LjWWw@52|;+&DM?hnzO(u(p+izgZz zKC>-fcYp5(RQB#g9v2>E3U8jblx#yK5~H}?e*bb9KNWu`tYW_%+&KQmXvHSqK2*q< z_LX;sh#CVI6MX6qe|+d`XhIagz4x3`WPoc zkME#|jO31#oXTx}b$@diXtNl_Vfo{c4wa0+r<>i^+owZC<5YrgB!pL{r`t~15p|Q` z{33m$7^uD#sSYbDFbPa_E7`yLVST)~3VfHY;L;Qn9|~K!ZOMCCD&Dn*tGcDMX-7M~1Qyu)T48z5N9oq)pDI zKbF35dp}mYvRamL(vNbBB>KcSuflm<$q})JDi>Sv<6)0D;4cHHLTtZwM5$8X(WMMV z3s?z06sx~H!5rqr$G9=!-qu&7s#&(J-+4T@Vi^Nr+3P~*WldF_h8_?;>Z;*TdeuTF zzY3x;9BWz4Ty2$F$6Y~rIraPYX!C-h516$HU@jLO%5pLUD#h6gGpE78OT^wWD;u@7d}BD?KvX8vRiUq2 zE>@z&=WcOt314HiqR6F+mqQ+R5n45S4Ue|YxAF|v(l9TxnCw!WXGV@Vlb1=<*q?cE z1U=U%ip*Jj`xrx3W%%}eMK>^L{cMl-e^z1^ziFjyFd!gmav-2@|Ek3H4z3nP_J7sf z3yrhrJr=|-)jW@@194*lbj`*IU;6;= z^t%`C^vaO2S`GDJHDyFdvz#66n9YITtOgen_+xU6Xq3XOV!>kkHw&Ugzu&bs_LNHi`PT?5sgnVQTO6vqg142 zju6<}K}{-!em^C{-Uho{ z>#JQ-e_d2htLA6cly~l>OekPwg4P^KUqS5E&kb329^;0=(pO<6hrc^d0%>osHh)9D zM*@!sDc$*g7axuYqqWWK>8$7e*my&)8|d2my9UBgx2gkk>>O@{iCh5-9nvY&ikD*} z*7vu2)=_#FBh=-0vgpXBrI_((zjdMnl{3gWC#*JBP39NLmx_d#pMBUrA|0kXS<_6rQv5$> zHC(TOa*ThiaM62gBh&KoP34n4M}ySSLdM~7RT`V(?siB}X>Kb=2BXrZ%uJ8k5#y<) ziDx9#GNH>NK_{CcmrbmfHZB|t*%j0$ZeUEM+dlmYZ~jHLcIh*v6dQ?F%*gCAANHO~ zQN}zod+W<-8%6GkhW@3al;zN}IVqs%zB?TYCq|zbDr%+O(p{l!Jmv>%uC8jzTytKe z!XD3BS{}vprswPc2w5@w!)*lUpxcF#zO;+syeDt`EDT-i*(TS0Cxg{Rn!Dxeq<&F# zOJ_v0;RbPXTP7aeKt*~1%zFF|#&Dx`e|8d_l zIA5DBT1#QgC($gy&HMz?j zO#E7cb4mP@*9F_l&gCt|_Oe^U>0Iox%e%vG{uBKclkMV)GuwCm)A*q_L(9P-7l&(J zVEs>smtDv7zDu!ggC@$Dn1XlU>hiN^ z`ff(tpKJ&lL2|aT`#{F3-&@9Sn>4LOoVX(CuW*ygMlU0?R-V7yT`s-fCsfwhjVc^T zJp42J&wSS-rHkV^@2~BQA6A)MUNze*+gRw31g!MbdwXm_3?WqBR^Xg=B9+7T@ zQTv!B%eh)Ggx`;9hx;%GFFJO4!mbIm6dzTfMcqE$Nux$Mn#xslg}ag}Pmg#9eBE7H zNnh-0Zp-u)&|i9(L`JA|6%2F>E~kKyN(uvf#Gv@8VjxNi@A)e5YIT7(Xo6dTE?pbV7jeU~mF_fPiWP;MvIZgrJdulAxIR#%%$7Dsa6_SBL~) zVL~w=vuCa``CK;;L$FeW!~9T)&;)$_wtTT-EAU8Sf{4JvQLoZIwarl8{Y!*EW>jAWY=paBquz*z8&d9=^mgcX0W}KuI2t6EMHL{VeROtW+eZ@+RURhInnTHibs>3_t5$b-crDiGnckz3e*t0hK1|w$})Cb__s{S-02|WcICV&?0jiMt2;)*0;zDPgle9w&8~vGLW5roF5AancQYlZ+%Mgk zbcLaF%fiqk)-^BS|1+a1a=gVQz(7D00NV`#kkS8ZxBarVHvijPQ@Ao;r$hVzuq_-H zFGg`D5f22-)-}>K)h7Hgh^@4D5aNw+u$udPh(F-4$B6KZ+v2?3Y$vUZUc#X;M;H~S z+*hsAi!0GCEUhLsxvaK?C0W2aV=4yP}(C5RB+JNZGjZ^DJzH&|NCAoSHO*2 zt%Fi8RKy=kmmihNAT;^W#TuteLr}}o>~|u?iU*lRFVd3tZ2HzQQMHGm3@1|`F6^UM zmgle0abhl!20{Khy_euY2E11Hp3VY%Tl;uOqJeT1R0oLm!Sh zT{)x{PMPb))hgloXe$A%lb=y3CoUu;L(Y`BJY@F^)+oo2^cEug=5g_w`eZGT^d&NA zO2P<5Qr)aWnC`=3soMN4Mv?sjC=0wva5rIz|yXe`^SA z90{CJJ*-2baJpO!=DAtkgDz~Ei7<<4uBiS{@atg0D{FgCrF+29MQhwK)~Ek!oacY$ zwQv_(4G*BedH}lx1&~)wL2D}qBP$18C083Gd+ooJcu;9vrk@V+J#l22!s)~p)XXhc zD;LtM=V$s*nC`8Wl?E@lk{giriph?J{zk(Xe4$~N7 zuYDo>sOjEzgR*>b<(8ku#L-h3Tvm^w40o^^^|IVqX5o41z9m!dcS2v`SnjAEopMAD z5pxM?Eme12PsLGQw4cuK7#30kn4m&MQxb56cxX|PwC-Y~N->rWdA~0(ia5$+;L+uD z4%zk@78=QOVGgEj!v|9MR9Apv>g|4JYR8h`GDK{*k3vACg@?gy79hqdO4_t<(I<6r zMoWQ(P9zFu{Y-Vgh0c}j@H=hZSyqr(6#5e*)}u0$rjlXF!_4zdn$KW zdyWTY=AtS`kdp)kK?VKKP)=l6S}YOpCMN+KB4GRX&j;|9fq)FH4dm>sZR~0FZEXH} zx&M^zk>yE)`Rhu6?jikK6p;D=_y2ck18X~@|4lp`(Nr=G0w7KBuj2eSf)DUJ02I(V zIhYt(8vSce|GxqFF(lR?jY9w}HIV;35dALz-(jf#YTo|)u=IaLsaGTc85jWq^4Eq2 zBKkK3AoT%;Ux4^`Bl&+({#CX9KKL8!?~3)$*YeNt@xL*Bd{HtX{{i@)(egi0{%N59 z7Ygu7&fh5iG1vbo`p+KiKcahukpI1Z`={VPdx-xCju-vclmEL>`KRzdTcZC6=al>{ q{Qqc|{)zL?TK*rLh*HS^t-xiyZv$AAA~zZ3o&nWLUmx|%KsU}Cjp?3~^CvL&R* zZI}N2eg;*|FAEMPEYL~*Qa{P{gVi5P1FPas0=q0td7RCrBmpR%mb1-hd%)wN<86>bhcn_0+8<>^G#Jryw%+g?E=3oV} zrW+SAWnh?T&&;3F!{o<0!oYZ2yirkz4Z$>5& zW_XH;-0uFm>i|%z7!v~nH?mQT%F`8un5Do**$M&O&NDqyh*=KIuLAO!AMi3y<71ZA jMmKTkL+J>4Mh1oi76t}k6cf)(zbC}3#wH^GbUFh70N(9> delta 710 zcmZo)#?!Tohd02RnMH(wfq{eJDUawx-UFOKDl$bs%8qN|HM#nD@52TnNB4WZte&;x z?lGQN`H&g`?k3iw+b7(~J^GB_bII-P=Bs138y!48r}*9bc?I5yGY$CS=5Bo8#BFD} z!mnEGjoRJz1j%D@ZyXEfA8qM-cFp3bbImTuc@&uSX|z_iFrG5r41k(~7Hh z1-c4ry)Gaz`<0z86>bhU=Ndk8<>^M#Jryw%u;1z z=3oV}rW0LQrq)2kAXO{k9OZ8k@WTGf*`E;iv1{ diff --git a/spreadsheet/macrofree/waf_checklist.es.xlsx b/spreadsheet/macrofree/waf_checklist.es.xlsx index f6fbf1d2ccc47b2d8bc5cea5556d36bae7f2b73c..569330a1618101f002033accb19a2a316f1db1ad 100644 GIT binary patch delta 705 zcmdnq871WoT>5ew;j4ug-=yge7)9qT+C_H z^|_o*J41Ilmo!~kP_`iTMA9Lb;^e*4B<9z7&kcz$;-2#SXH%BLO^+#GI8^eKmML!v z6uwmZJCDJn%ZXizhwYS+TmAV+mi33{GdCNneqT5@sP=w(t>Kd-WjFg*)3-0Q$@F!| z6j>5_Q)8ix$CiCn+ZZQVZ8P1rM7+v!-G9*qo{xkY+1Xcrd9p{GzyI~}EsreIRnl9| zU(ZqO+BrklzJJZ?pT+^Vm)+g+Uoc%IUg(^AQenBH4dW`KxOI~mUkC26kEwqya!qc_ z>*R2Ilt9|d$#k5J85m5>mpR%mb1-hd%)vBy5lCQr=4vKBJ20#2CDUDIFe~aU69+4Z zH9hqc(=)J;-)E+aj9?+9uS_q&LVVwt{2@XK-rF4!_Kh<;#VPzFXQ3^XuCPH*_ZWCT{UO7Z^gRm=RDaW9TO)hWMh?oML@F5Q(O7dj3zK!|kSb|74N_Tek+p7n*+JCzGZE k$RkT1N=L{uGB6~tFfa(C82s<+birRts%(DWfp#(g0Bdal3IG5A delta 693 zcmdn_g?rBzZr%WIW)=|!1_lm>r#zw)c@J;`smOmW%>TG1UX!bj_daYOa&*7f%j#K6 z?jGZbl@F;A;BI0)x_!c(+@sIq~)=P6n!GY$&tD8SgxUzArnd-hvrwjkCXE5sYjR&IEe-*gHUi{qt z;%xp~e{NjmM+v9RY)r@5n1LbHe1W6=0te&v3mi<77l8z}r>$n3$CIbU6Oa+i`VDx><#88o=UtCg|lUl4- zk(+~NU*vZ8*IfsIO2wEM7`RciMojnr$s`4KaL!Mlqa3Gq{A7{?^H&1-%%WeJrt5!Y alE(1DN1!Yd1+dW&i+`Z~VpEdJu*^#hIg_*W{DqbH*=2o

vT#+g37HFC7F_wH zr6hizG=o>r3y0=|4w1)R)SGrcDE(2KP_XQY;g;Z4?|-k+Z;#12@}m0lAFCohaV(q(|hm zZuG~Zlj5)YjkC?_S+iE(iv2BL==jN0vuk3+Jt6&uU0u^(yBtUpdFS`}{hw{Z?74Ms zeo3Q*(PmDj<81t(P&#p98IR#HMdFW0siy-<6rQ`430?9}dRte>j+SzhMR{ z+rH~7(+dYMYpEG?A`6(sY0b>R3SvzcabSK17W(VJe320>bkT|VC0J;$GqXQLh~Jgj z8WA(ogI$@;z)E{unWY(jOkd&3tOVwt1@R9}f9cAsE)R0zsu$-PRyi;*h<;#VPzJ^_ z3^XvVoUZT2Yy?)szRdK$9t#75JRbvt1WW~xZfKk`y}^xH9c=O{H)d&@A6Co^6*>CF zC6zg;#d;OFIRV~`Od`zi^b@(={dLy?pjI&^1_o|qqZpZ|GrBWNfsK-L2Ric2bSrme xIWRvO$Y(y_#610>6SK57x{*sCN=L{uGB6|nT_}uV+c{6R9Nq8rvU=8% zyT^E9Tp@f3&6V*)@x!&NaJax5dd zR9o`5>@LFuCTDi8k`FV|MC#)=G0yo^&&P9aip`HQudlW9zaE{?-K+6$Mf|gJCVu54Uurn>La>B7J38H_r;BP^nBEJ=U9x1u6v-X$${OV^e~ zH8(GaYER4A_|Ilz+Gp_vMw{+#`!6Wou_n+@+9|T|xW-47eBYZ zIGg|0pBq>CQNn36E7Nf{=4U*j&F4AV&vP(tKhMGRA-xE5iE4piTNd1Xs0u?KO-|R_@{HbGFv0!VYVypyiX(oDxVrf)D~7M=dvm01uh%J0T3&A4{D zwi~k%n4bXTGtV$%p1#qHS<)-On~_O`8IlZu&WubI=RNX(g@Hj=lYxO3W($x8T4cq{ zP?4iwTvC~nTC7)*n}eox`a_UK?9>0cF-w6hl5z*~KTJ1sXO>e08NE8LNN)?!s9q)p o1}PMyk2o<;zw5*-J$-^ZGY?qre30G^(|5ZwtFbY-G6Piu0J5p|Q2+n{ diff --git a/spreadsheet/macrofree/waf_checklist.ko.xlsx b/spreadsheet/macrofree/waf_checklist.ko.xlsx index 98c36845a765f66e9f94d38235bc11d315f52417..b80471d5d62e030c41eb4a2294f9e40e1abedc2b 100644 GIT binary patch delta 721 zcmdmWooCy19^L?NW)=|!1_lm>;uf)qyazaeRHUBXQbD$f*W~KYW*s&VXo)}iL+|va z$pS5poujKXOhu$JUix~>K62%k-xjBxz$AABFzZ3o&*`uEP?8aAj3-2icDW1#VpbMoumCb2jlkd986a)F#}a>KYyF) zkR6ycMT*&x12bVh~wA|qI6fg1BmuuzXWvp+=Wo(8iuB2uO+ zX)>FEl}2kaOEdnMUarZk1m@2H@|h2DFia2BViuWxPLo+s9^}aK0-nDub_@)nAD9@F zf$XEvVFDmbN)A$IMWX zqhDN7nUh+qSCN|&;LXS+!VFJAk=xy0cO3v~6=Pyx;6^rz@zV4QTFg>lquv6IV%$BQ zQ=3^1%-7Ney1ieGdHM!5W@&A7BbPpuj*w?$U`PPEP#DF?>gj#j%xY|>HJE|I0NmX8 AWB>pF delta 716 zcmdmXooCl|9^L?NW)=|!1_lm>XFQ@4c@J;`sYtq~)=P6n!GY$&tD8SgxUzArnd-hvrwjkCXE5sYj2bV7ysA|qI6jvDhzuuz9Ovp+=WmIkvmA|9s8X)>G1gQ8`lEAN|` zYzz!ciVO_Gz&L|}2F5?ri#3^*6hMl+{u!(|c8Q6>@vR7h1WW~xZfHElF@3%iv*`3w zn#_V=tM6$tOEVst{!5eD2+Y^lVwPrZmtvm2K#EyXJHVTfNrV}mHX>8Sd5=6`VPMeJ zWMJS$Hkk4B^od%`GGHS%0F7Y0HvNnivlN*B63BPhufohwk)vOpUzDAcpP#K)k(+~V z`0BVKy)8gPdzly*q)-f>tj0WjjT*D`^muJ%9;uf)qyazaeROA-dKNs02UX!aon|0Vgpe6q3553cq zCQslx-oEWiK$eEdg-f$1n0K!H+PvlH$=l(Dvg(Sha;C<=-*)Iu6+Tr}@%38caWSV& z*XMFN?F`-JT+(!DLD_=T6G?|$ij((FlbB!UJvSu2hq*RE+=*=9=20PZuRFQS=Jw(&)jUR`hDTtpxXQCwT4fUl-=xKP2axICezm; zQ)Ef#O^t;%9$WTRZDX8dwas+f67ed_b^k>dcs>$pWM^Of<;fm#{{Gj?w>+{;S4nR< ze?3RBYv&AI`~Eene;NneUUqlOf5CK>c%gIdNrmN(HjJx`;?_-Od>y#MKBoS;$Thhw zuam>=Q37c*C)05@=8_h%=F1%ImpK@>U*=$1yA&j_y?GsznFE-$=N;2MW-x2+CngS7 z5NrC1?@Z6YLKA;5U1S6crT$`i2^I?c&E(I>3=I3}i~lfLBO+n?^FK^xU~z@NOwx=$ zr`!BxQUYsD1o00~ul>uUE)O(4^6{nDw|>|&Fo=F&Vo(M~C=4_(7EeF?m&r&Gq-edU z_pQ~;3=F2+3=9%56+pV7am_oX>1Wn`wIDZzhrHng5vt*e3pA0?GmaFgyj< delta 719 zcmezKkNf{WZr%WIW)=|!1_lm>XFQ@4c@J;`smSiB2bOY8ye3y4?|s-n`pbo+!mxksPzdoH=X-F$WIcB6yG=M=wtKd-<$ai#%Z+}w>1oVe{Q zSNK({y-~Z{o*;QF?u}#N{G%;>&#qY&(>{wYFxqr?+kZjvjx~XP(oT_u$1@6DZJ1XX#jSg6cV%%wz4)B^ z=hx)6{M@)&9wnSMvoRfKV+Mv)^97Ff3mlBwFK{reT?!J|-ms3z%mK{W`HtxxGnh5& z6B7q3h&6rbccy1xp}rqX7a74qNxzt0f`$BkGxBtG6m>4Q@^ovU>b5e`- zDspqs?c47Dy6XT?s~8gl1JE=$XkeWEorxj7C^e^8Uk^m0X`H?uXgp)f^wa;C4Mh1oi76t}kxUoPtGP+C;_|K%qHsue{N(KPFfD6L_ diff --git a/spreadsheet/macrofree/waf_checklist.zh-Hant.xlsx b/spreadsheet/macrofree/waf_checklist.zh-Hant.xlsx index e18d5ea7f607f04ba180e9fbd2bf401fed4534f5..3bddb50bf5999f580d75ebb87217ff66f06e7599 100644 GIT binary patch delta 682 zcmeynnCItW9^L?NW)=|!1_lm>k`}RvyazaeRHRPJ+^cL8ugTSWXCF2YX!+muG4|SF zPmV($7wXzhk>cXr@rTG9TfoPlymtEtOE7m*)4E_rItl!H!6 zzT8)1&M@W3g+?}E=4Gr$>!;_itUo-Tx!G8~f8pHV+WX?QmQR9|yYA0^etn@$mT$)) zj}x!GJoRilGHU;(FsJxtW#_c6|B@B+U%BDbB_TO~KC_=s_DucGfBX2Jw3a{@jil4M zu^)?0iofnRex3G@=}Oqv-QVmVF-XMy)EjM}&-F^AZdjDHt$KAGN ze^J9|Gbht=HfCTbHDBgvzs$k7{W1rW^mdTI_K*9S_#MG4W=3XF7BEYim6?MT#G03wiku@=jaxpW+7p3MD z>+6BY0B=Sn5oUN|nrvn<%;T%Z8srRkl5%$i{5EPW^)A=RBelc@J;`smQ+GyPaGUugTTNdmlCsIlABLW%aBj zZ;$cB%7@ela5u3Y-9F(??$Kxbo=a|TH(wpQ-SFV?ImPeZ&nwVQoN2%pH+SO$Cw9A= ztK+KG-dNpjO^`em_r{@c{?V4cXU8m#I@j#d-4;{xQTM@|394ZNJDxN?Ru;H9bB3RX zX4;a!Wq&y)Fgf#cm3)|yCQ?6tGvl03^?W_&=G^(6=f`_^0`Jio-Mt$BGUDzX`?TV+ zU4gE`T5Zi41qYf7zi$3G!DQoFGtqq)R%iZQ&tTN)9bpj>v0VN6-inHx`IoHJEnQm{ z)m*%!sx7uArdBR8{B!yOqfNI<{tJ4$glR0-UASgP@|Hac^B77+^{*Gp&+^=1FCJ6> z{F>a>*U8uIQNn36E7Nf{W?)D)pXX>l&%wC;JO`8Xc96jKxBHp+9YL(E|CvQuz(V4z z%p9yB)^sH<=4W6bZf@p_j9{VrJj^e_LZ^9|{UJiK{LI#fXqcYJ&uj)(I*XrKn(@!{ zZT!qiVE%0&pZORE!}JLP%p%iy1(*fF!ioYwWlyHt3NRbV11*i5{hD|7BW4B$c^(D^ z31CdaKttoV>3sss>QNv?sp7mx9|qVR%V8Z9R1>w%AC|9R$?5!p%u--S=?F4QGcj>b_Y`E71q);X1(>h# gFi(Ha!z|5@X6E#bKv~8^)6WVrtFa0310Bx*004vP2LJ#7 diff --git a/workbooks/alz_checklist.en_counters_workbook.json b/workbooks/alz_checklist.en_counters_workbook.json index 99aa9164..77a5ac64 100644 --- a/workbooks/alz_checklist.en_counters_workbook.json +++ b/workbooks/alz_checklist.en_counters_workbook.json @@ -1181,7 +1181,7 @@ "style": "tabs", "links": [ { - "id": "b9a8a80d-446b-44d6-a82e-6ab9a16ac232", + "id": "89027e4e-be80-4bde-b198-de577f8d9f95", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Network Topology and Connectivity ({Tab0Success:value}/{Tab0Total:value})", @@ -1190,7 +1190,7 @@ "style": "primary" }, { - "id": "c3d42c92-7218-4d8b-892b-c0f93058cf6e", + "id": "84c4f4d4-16f6-4aba-b5cb-1f64d600d88e", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Security ({Tab1Success:value}/{Tab1Total:value})", @@ -1199,7 +1199,7 @@ "style": "primary" }, { - "id": "4f0fd7fb-fbfa-403c-9daf-35ba25c98876", + "id": "029c3b7b-5228-4da4-8d14-594764a4d248", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Resource Organization ({Tab2Success:value}/{Tab2Total:value})", diff --git a/workbooks/alz_checklist.en_counters_workbook_template.json b/workbooks/alz_checklist.en_counters_workbook_template.json index 2a9b1bbb..30002c0b 100644 --- a/workbooks/alz_checklist.en_counters_workbook_template.json +++ b/workbooks/alz_checklist.en_counters_workbook_template.json @@ -41,7 +41,7 @@ "dependsOn": [], "properties": { "displayName": "[parameters('workbookDisplayName')]", - "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"value::all\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query12Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query13Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query14Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query15Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query16Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query17Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query18Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query19Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query20Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query21Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query22Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query23Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query24Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query25Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query25FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query25Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query26Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query26FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query26Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query27Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query27FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query27Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query28Stats\",\n \"type\": 1,\n \"query\": \"ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query28FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query28Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query29Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query29FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query29Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}+{Query24Stats:$.Success}+{Query25Stats:$.Success}+{Query26Stats:$.Success}+{Query27Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}+{Query24Stats:$.Total}+{Query25Stats:$.Total}+{Query26Stats:$.Total}+{Query27Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query28Stats:$.Success}+{Query29Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query28Stats:$.Total}+{Query29Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookTotal\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}+{Query24Stats:$.Total}+{Query25Stats:$.Total}+{Query26Stats:$.Total}+{Query27Stats:$.Total}+{Query28Stats:$.Total}+{Query29Stats:$.Total}+{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookSuccess\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}+{Query24Stats:$.Success}+{Query25Stats:$.Success}+{Query26Stats:$.Success}+{Query27Stats:$.Success}+{Query28Stats:$.Success}+{Query29Stats:$.Success}+{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookPercent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{WorkbookSuccess}/{WorkbookTotal})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"InvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"50\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"WorkbookPercent\\\\\\\": \\\\\\\"{WorkbookPercent}\\\\\\\", \\\\\\\"SubTitle\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 4,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"WorkbookPercent\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"SubTitle\",\n \"formatter\": 1\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"ProgressTile\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"b9a8a80d-446b-44d6-a82e-6ab9a16ac232\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Network Topology and Connectivity ({Tab0Success:value}/{Tab0Total:value})\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Network Topology and Connectivity\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"c3d42c92-7218-4d8b-892b-c0f93058cf6e\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Security ({Tab1Success:value}/{Tab1Total:value})\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Security\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"4f0fd7fb-fbfa-403c-9daf-35ba25c98876\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Resource Organization ({Tab2Success:value}/{Tab2Total:value})\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Resource Organization\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Network Topology and Connectivity\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium to enable additional security features. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules) for further information.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext23\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query23\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext24\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query24\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext25\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query25\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this.\"\n },\n \"name\": \"querytext26\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query26\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext27\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query27\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Security\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets. Check [this link](https://learn.microsoft.com/azure/key-vault/general/overview-throttling) for further information.. [This training](https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext28\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query28\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management). Check [this link](https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs) for further information.\"\n },\n \"name\": \"querytext29\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query29\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Resource Organization\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enforce reasonably flat management group hierarchy with no more than four levels. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups) for further information.. [This training](https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enforce no subscriptions are placed under the root management group. Check [this link](https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group) for further information.. [This training](https://learn.microsoft.com/azure/governance/management-groups/overview) can help to educate yourself on this.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure tags are used for billing and cost management. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", + "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"value::all\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query12Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query13Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query14Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query15Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query16Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query17Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query18Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query19Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query20Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query21Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query22Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query23Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query24Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query25Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query25FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query25Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query26Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query26FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query26Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query27Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query27FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query27Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query28Stats\",\n \"type\": 1,\n \"query\": \"ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query28FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query28Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query29Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query29FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query29Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}+{Query24Stats:$.Success}+{Query25Stats:$.Success}+{Query26Stats:$.Success}+{Query27Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}+{Query24Stats:$.Total}+{Query25Stats:$.Total}+{Query26Stats:$.Total}+{Query27Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query28Stats:$.Success}+{Query29Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query28Stats:$.Total}+{Query29Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookTotal\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}+{Query19Stats:$.Total}+{Query20Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}+{Query24Stats:$.Total}+{Query25Stats:$.Total}+{Query26Stats:$.Total}+{Query27Stats:$.Total}+{Query28Stats:$.Total}+{Query29Stats:$.Total}+{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookSuccess\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}+{Query19Stats:$.Success}+{Query20Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}+{Query24Stats:$.Success}+{Query25Stats:$.Success}+{Query26Stats:$.Success}+{Query27Stats:$.Success}+{Query28Stats:$.Success}+{Query29Stats:$.Success}+{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookPercent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{WorkbookSuccess}/{WorkbookTotal})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"InvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"50\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"WorkbookPercent\\\\\\\": \\\\\\\"{WorkbookPercent}\\\\\\\", \\\\\\\"SubTitle\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 4,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"WorkbookPercent\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"SubTitle\",\n \"formatter\": 1\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"ProgressTile\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"89027e4e-be80-4bde-b198-de577f8d9f95\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Network Topology and Connectivity ({Tab0Success:value}/{Tab0Total:value})\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Network Topology and Connectivity\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"84c4f4d4-16f6-4aba-b5cb-1f64d600d88e\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Security ({Tab1Success:value}/{Tab1Total:value})\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Security\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"029c3b7b-5228-4da4-8d14-594764a4d248\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Resource Organization ({Tab2Success:value}/{Tab2Total:value})\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Resource Organization\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Network Topology and Connectivity\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium to enable additional security features. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules) for further information.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext23\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query23\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext24\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query24\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext25\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query25\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this.\"\n },\n \"name\": \"querytext26\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query26\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext27\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query27\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Security\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets. Check [this link](https://learn.microsoft.com/azure/key-vault/general/overview-throttling) for further information.. [This training](https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext28\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query28\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management). Check [this link](https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs) for further information.\"\n },\n \"name\": \"querytext29\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query29\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Resource Organization\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enforce reasonably flat management group hierarchy with no more than four levels. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups) for further information.. [This training](https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enforce no subscriptions are placed under the root management group. Check [this link](https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group) for further information.. [This training](https://learn.microsoft.com/azure/governance/management-groups/overview) can help to educate yourself on this.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure tags are used for billing and cost management. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", "version": "1.0", "sourceId": "[parameters('workbookSourceId')]", "category": "[parameters('workbookType')]" diff --git a/workbooks/alz_checklist.en_network_counters.json b/workbooks/alz_checklist.en_network_counters.json index 013b64cc..c20295a8 100644 --- a/workbooks/alz_checklist.en_network_counters.json +++ b/workbooks/alz_checklist.en_network_counters.json @@ -777,7 +777,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}" + "resultVal": "{Query19Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}" } } ] @@ -796,7 +796,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}" + "resultVal": "{Query19Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}" } } ] @@ -834,7 +834,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query6Stats:$.Success}" + "resultVal": "{Query20Stats:$.Success}" } } ] @@ -853,7 +853,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query6Stats:$.Total}" + "resultVal": "{Query20Stats:$.Total}" } } ] @@ -891,7 +891,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query24Stats:$.Success}" + "resultVal": "{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}" } } ] @@ -910,7 +910,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query24Stats:$.Total}" + "resultVal": "{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}" } } ] @@ -948,7 +948,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}" + "resultVal": "{Query4Stats:$.Success}+{Query5Stats:$.Success}" } } ] @@ -967,7 +967,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}" + "resultVal": "{Query4Stats:$.Total}+{Query5Stats:$.Total}" } } ] @@ -1005,7 +1005,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}" + "resultVal": "{Query6Stats:$.Success}" } } ] @@ -1024,7 +1024,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}" + "resultVal": "{Query6Stats:$.Total}" } } ] @@ -1062,7 +1062,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query20Stats:$.Success}" + "resultVal": "{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}" } } ] @@ -1081,7 +1081,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query20Stats:$.Total}" + "resultVal": "{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}" } } ] @@ -1119,7 +1119,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query19Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}" + "resultVal": "{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}" } } ] @@ -1138,7 +1138,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query19Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}" + "resultVal": "{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}" } } ] @@ -1176,7 +1176,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query4Stats:$.Success}+{Query5Stats:$.Success}" + "resultVal": "{Query24Stats:$.Success}" } } ] @@ -1195,7 +1195,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query4Stats:$.Total}+{Query5Stats:$.Total}" + "resultVal": "{Query24Stats:$.Total}" } } ] @@ -1233,7 +1233,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query6Stats:$.Total}+{Query24Stats:$.Total}+{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}+{Query20Stats:$.Total}+{Query19Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}" + "resultVal": "{Query19Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}+{Query20Stats:$.Total}+{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}+{Query24Stats:$.Total}" } } ] @@ -1252,7 +1252,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query6Stats:$.Success}+{Query24Stats:$.Success}+{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}+{Query20Stats:$.Success}+{Query19Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}" + "resultVal": "{Query19Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}+{Query20Stats:$.Success}+{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}+{Query24Stats:$.Success}" } } ] @@ -1326,76 +1326,76 @@ "style": "tabs", "links": [ { - "id": "837533be-5b93-4c5f-9b65-177f58cd1969", + "id": "79f944b4-c87b-4401-9fe2-e7b62ca70120", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Hybrid ({Tab0Success:value}/{Tab0Total:value})", + "linkLabel": "Segmentation ({Tab0Success:value}/{Tab0Total:value})", "subTarget": "tab0", - "preText": "Hybrid", - "style": "primary" - }, - { - "id": "5dc9fd8b-f87a-433f-8a57-efb317a39747", - "cellValue": "VisibleTab", - "linkTarget": "parameter", - "linkLabel": "Internet ({Tab1Success:value}/{Tab1Total:value})", - "subTarget": "tab1", - "preText": "Internet", - "style": "primary" - }, - { - "id": "0596744c-dd02-40ea-b6be-88b382219cf1", - "cellValue": "VisibleTab", - "linkTarget": "parameter", - "linkLabel": "Virtual WAN ({Tab2Success:value}/{Tab2Total:value})", - "subTarget": "tab2", - "preText": "Virtual WAN", - "style": "primary" - }, - { - "id": "0d4af09e-cdc5-4d69-b3e1-40d9e1414430", - "cellValue": "VisibleTab", - "linkTarget": "parameter", - "linkLabel": "Hub and spoke ({Tab3Success:value}/{Tab3Total:value})", - "subTarget": "tab3", - "preText": "Hub and spoke", - "style": "primary" - }, - { - "id": "dfdfdbba-de36-4fd7-84b9-c9c60263bdd4", - "cellValue": "VisibleTab", - "linkTarget": "parameter", - "linkLabel": "Firewall ({Tab4Success:value}/{Tab4Total:value})", - "subTarget": "tab4", - "preText": "Firewall", - "style": "primary" - }, - { - "id": "036ddd82-18b7-4714-bb72-2e6a1564f2d7", - "cellValue": "VisibleTab", - "linkTarget": "parameter", - "linkLabel": "PaaS ({Tab5Success:value}/{Tab5Total:value})", - "subTarget": "tab5", - "preText": "PaaS", - "style": "primary" - }, - { - "id": "b90e20da-a794-419e-ae3e-3f825dc108c4", - "cellValue": "VisibleTab", - "linkTarget": "parameter", - "linkLabel": "Segmentation ({Tab6Success:value}/{Tab6Total:value})", - "subTarget": "tab6", "preText": "Segmentation", "style": "primary" }, { - "id": "c4279e7f-bde1-40a0-9f79-46bfbd091349", + "id": "548c2b25-408f-4ad2-a3f9-733df322a25b", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "IP plan ({Tab7Success:value}/{Tab7Total:value})", - "subTarget": "tab7", + "linkLabel": "PaaS ({Tab1Success:value}/{Tab1Total:value})", + "subTarget": "tab1", + "preText": "PaaS", + "style": "primary" + }, + { + "id": "e63b33c0-7afd-484c-a03e-f428de1fca1f", + "cellValue": "VisibleTab", + "linkTarget": "parameter", + "linkLabel": "Hub and spoke ({Tab2Success:value}/{Tab2Total:value})", + "subTarget": "tab2", + "preText": "Hub and spoke", + "style": "primary" + }, + { + "id": "fbdd0abd-3e4f-4a83-a47f-1c34e62147a8", + "cellValue": "VisibleTab", + "linkTarget": "parameter", + "linkLabel": "IP plan ({Tab3Success:value}/{Tab3Total:value})", + "subTarget": "tab3", "preText": "IP plan", "style": "primary" + }, + { + "id": "3b3fefcc-dd33-4d4f-803f-c1b49b2a1463", + "cellValue": "VisibleTab", + "linkTarget": "parameter", + "linkLabel": "Internet ({Tab4Success:value}/{Tab4Total:value})", + "subTarget": "tab4", + "preText": "Internet", + "style": "primary" + }, + { + "id": "a31964ec-0ba4-4848-aaa0-07241d5d0a58", + "cellValue": "VisibleTab", + "linkTarget": "parameter", + "linkLabel": "Hybrid ({Tab5Success:value}/{Tab5Total:value})", + "subTarget": "tab5", + "preText": "Hybrid", + "style": "primary" + }, + { + "id": "62f86a79-3837-4f05-abe4-4bea5e669101", + "cellValue": "VisibleTab", + "linkTarget": "parameter", + "linkLabel": "Firewall ({Tab6Success:value}/{Tab6Total:value})", + "subTarget": "tab6", + "preText": "Firewall", + "style": "primary" + }, + { + "id": "0803a4ad-8488-4663-ac2d-660b43a6c83f", + "cellValue": "VisibleTab", + "linkTarget": "parameter", + "linkLabel": "Virtual WAN ({Tab7Success:value}/{Tab7Total:value})", + "subTarget": "tab7", + "preText": "Virtual WAN", + "style": "primary" } ] }, @@ -1410,10 +1410,864 @@ { "type": 1, "content": { - "json": "## Hybrid" + "json": "## Segmentation" }, "name": "tab0title" }, + { + "type": 1, + "content": { + "json": "Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this." + }, + "name": "querytext19" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query19" + }, + { + "type": 1, + "content": { + "json": "Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information." + }, + "name": "querytext21" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query21" + }, + { + "type": 1, + "content": { + "json": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information." + }, + "name": "querytext22" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query22" + }, + { + "type": 1, + "content": { + "json": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this." + }, + "name": "querytext23" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query23" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab0" + }, + "name": "tab0" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## PaaS" + }, + "name": "tab1title" + }, + { + "type": 1, + "content": { + "json": "Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this." + }, + "name": "querytext20" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query20" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab1" + }, + "name": "tab1" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Hub and spoke" + }, + "name": "tab2title" + }, + { + "type": 1, + "content": { + "json": "If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this." + }, + "name": "querytext0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query0" + }, + { + "type": 1, + "content": { + "json": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." + }, + "name": "querytext1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query1" + }, + { + "type": 1, + "content": { + "json": "Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." + }, + "name": "querytext2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query2" + }, + { + "type": 1, + "content": { + "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." + }, + "name": "querytext3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query3" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab2" + }, + "name": "tab2" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## IP plan" + }, + "name": "tab3title" + }, + { + "type": 1, + "content": { + "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + }, + "name": "querytext4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query4" + }, + { + "type": 1, + "content": { + "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + }, + "name": "querytext5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query5" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab3" + }, + "name": "tab3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Internet" + }, + "name": "tab4title" + }, + { + "type": 1, + "content": { + "json": "Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this." + }, + "name": "querytext6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query6" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab4" + }, + "name": "tab4" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Hybrid" + }, + "name": "tab5title" + }, { "type": 1, "content": { @@ -1853,447 +2707,9 @@ "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", - "value": "tab0" + "value": "tab5" }, - "name": "tab0" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## Internet" - }, - "name": "tab1title" - }, - { - "type": 1, - "content": { - "json": "Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this." - }, - "name": "querytext6" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query6" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab1" - }, - "name": "tab1" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## Virtual WAN" - }, - "name": "tab2title" - }, - { - "type": 1, - "content": { - "json": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this." - }, - "name": "querytext24" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query24" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab2" - }, - "name": "tab2" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## Hub and spoke" - }, - "name": "tab3title" - }, - { - "type": 1, - "content": { - "json": "If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this." - }, - "name": "querytext0" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query0" - }, - { - "type": 1, - "content": { - "json": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." - }, - "name": "querytext1" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query1" - }, - { - "type": 1, - "content": { - "json": "Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." - }, - "name": "querytext2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query2" - }, - { - "type": 1, - "content": { - "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." - }, - "name": "querytext3" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query3" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab3" - }, - "name": "tab3" + "name": "tab5" }, { "type": 12, @@ -2306,7 +2722,7 @@ "content": { "json": "## Firewall" }, - "name": "tab4title" + "name": "tab6title" }, { "type": 1, @@ -2620,360 +3036,6 @@ } ] }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab4" - }, - "name": "tab4" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## PaaS" - }, - "name": "tab5title" - }, - { - "type": 1, - "content": { - "json": "Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this." - }, - "name": "querytext20" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query20" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab5" - }, - "name": "tab5" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## Segmentation" - }, - "name": "tab6title" - }, - { - "type": 1, - "content": { - "json": "Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this." - }, - "name": "querytext19" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query19" - }, - { - "type": 1, - "content": { - "json": "Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information." - }, - "name": "querytext21" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query21" - }, - { - "type": 1, - "content": { - "json": "Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information." - }, - "name": "querytext22" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query22" - }, - { - "type": 1, - "content": { - "json": "Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this." - }, - "name": "querytext23" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query23" - } - ] - }, "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", @@ -2990,22 +3052,22 @@ { "type": 1, "content": { - "json": "## IP plan" + "json": "## Virtual WAN" }, "name": "tab7title" }, { "type": 1, "content": { - "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + "json": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this." }, - "name": "querytext4" + "name": "querytext24" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -3054,69 +3116,7 @@ ] } }, - "name": "query4" - }, - { - "type": 1, - "content": { - "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." - }, - "name": "querytext5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query5" + "name": "query24" } ] }, diff --git a/workbooks/alz_checklist.en_network_counters_template.json b/workbooks/alz_checklist.en_network_counters_template.json index 76073af8..3460cbba 100644 --- a/workbooks/alz_checklist.en_network_counters_template.json +++ b/workbooks/alz_checklist.en_network_counters_template.json @@ -41,7 +41,7 @@ "dependsOn": [], "properties": { "displayName": "[parameters('workbookDisplayName')]", - "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"value::all\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query12Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query13Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query14Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query15Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query16Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query17Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query18Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query19Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query20Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query21Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query22Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query23Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query24Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query6Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query6Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query24Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query24Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab3Success}/{Tab3Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab4Success}/{Tab4Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query20Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query20Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab5Success}/{Tab5Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query19Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query19Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab6Success}/{Tab6Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Success}+{Query5Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Total}+{Query5Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab7Success}/{Tab7Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookTotal\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query6Stats:$.Total}+{Query24Stats:$.Total}+{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}+{Query20Stats:$.Total}+{Query19Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookSuccess\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query6Stats:$.Success}+{Query24Stats:$.Success}+{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}+{Query20Stats:$.Success}+{Query19Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookPercent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{WorkbookSuccess}/{WorkbookTotal})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"InvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"50\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"WorkbookPercent\\\\\\\": \\\\\\\"{WorkbookPercent}\\\\\\\", \\\\\\\"SubTitle\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 4,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"WorkbookPercent\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"SubTitle\",\n \"formatter\": 1\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"ProgressTile\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"837533be-5b93-4c5f-9b65-177f58cd1969\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid ({Tab0Success:value}/{Tab0Total:value})\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"5dc9fd8b-f87a-433f-8a57-efb317a39747\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet ({Tab1Success:value}/{Tab1Total:value})\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"0596744c-dd02-40ea-b6be-88b382219cf1\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN ({Tab2Success:value}/{Tab2Total:value})\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"0d4af09e-cdc5-4d69-b3e1-40d9e1414430\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke ({Tab3Success:value}/{Tab3Total:value})\",\n \"subTarget\": \"tab3\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"dfdfdbba-de36-4fd7-84b9-c9c60263bdd4\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Firewall ({Tab4Success:value}/{Tab4Total:value})\",\n \"subTarget\": \"tab4\",\n \"preText\": \"Firewall\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"036ddd82-18b7-4714-bb72-2e6a1564f2d7\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS ({Tab5Success:value}/{Tab5Total:value})\",\n \"subTarget\": \"tab5\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"b90e20da-a794-419e-ae3e-3f825dc108c4\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation ({Tab6Success:value}/{Tab6Total:value})\",\n \"subTarget\": \"tab6\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"c4279e7f-bde1-40a0-9f79-46bfbd091349\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan ({Tab7Success:value}/{Tab7Total:value})\",\n \"subTarget\": \"tab7\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext24\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query24\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"name\": \"tab3title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Firewall\"\n },\n \"name\": \"tab4title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium to enable additional security features. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"name\": \"tab5title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"name\": \"tab6title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this.\"\n },\n \"name\": \"querytext23\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query23\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"name\": \"tab7title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab7\"\n },\n \"name\": \"tab7\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", + "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"value::all\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query12Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query13Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query14Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query15Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query16Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query17Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query18Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query19Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query20Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query21Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query22Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query23Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query24Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query19Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query19Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query20Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query20Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Success}+{Query5Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Total}+{Query5Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab3Success}/{Tab3Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query6Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query6Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab4Success}/{Tab4Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab5Success}/{Tab5Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab6Success}/{Tab6Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query24Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query24Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab7Success}/{Tab7Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookTotal\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query19Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}+{Query20Stats:$.Total}+{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}+{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}+{Query24Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookSuccess\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query19Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}+{Query20Stats:$.Success}+{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}+{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}+{Query24Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookPercent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{WorkbookSuccess}/{WorkbookTotal})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"InvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"50\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"WorkbookPercent\\\\\\\": \\\\\\\"{WorkbookPercent}\\\\\\\", \\\\\\\"SubTitle\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 4,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"WorkbookPercent\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"SubTitle\",\n \"formatter\": 1\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"ProgressTile\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"79f944b4-c87b-4401-9fe2-e7b62ca70120\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation ({Tab0Success:value}/{Tab0Total:value})\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"548c2b25-408f-4ad2-a3f9-733df322a25b\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS ({Tab1Success:value}/{Tab1Total:value})\",\n \"subTarget\": \"tab1\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"e63b33c0-7afd-484c-a03e-f428de1fca1f\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke ({Tab2Success:value}/{Tab2Total:value})\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"fbdd0abd-3e4f-4a83-a47f-1c34e62147a8\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan ({Tab3Success:value}/{Tab3Total:value})\",\n \"subTarget\": \"tab3\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"3b3fefcc-dd33-4d4f-803f-c1b49b2a1463\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet ({Tab4Success:value}/{Tab4Total:value})\",\n \"subTarget\": \"tab4\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"a31964ec-0ba4-4848-aaa0-07241d5d0a58\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid ({Tab5Success:value}/{Tab5Total:value})\",\n \"subTarget\": \"tab5\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"62f86a79-3837-4f05-abe4-4bea5e669101\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Firewall ({Tab6Success:value}/{Tab6Total:value})\",\n \"subTarget\": \"tab6\",\n \"preText\": \"Firewall\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"0803a4ad-8488-4663-ac2d-660b43a6c83f\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN ({Tab7Success:value}/{Tab7Total:value})\",\n \"subTarget\": \"tab7\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this.\"\n },\n \"name\": \"querytext23\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query23\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"name\": \"tab3title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"name\": \"tab4title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"name\": \"tab5title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Firewall\"\n },\n \"name\": \"tab6title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium to enable additional security features. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"name\": \"tab7title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext24\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query24\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab7\"\n },\n \"name\": \"tab7\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", "version": "1.0", "sourceId": "[parameters('workbookSourceId')]", "category": "[parameters('workbookType')]" diff --git a/workbooks/alz_checklist.en_network_tabcounters.json b/workbooks/alz_checklist.en_network_tabcounters.json index ddd4dd15..fbfc6511 100644 --- a/workbooks/alz_checklist.en_network_tabcounters.json +++ b/workbooks/alz_checklist.en_network_tabcounters.json @@ -70,16 +70,16 @@ "style": "tabs", "links": [ { - "id": "7805f86c-78a2-4fda-8668-43b3face6628", + "id": "588872c2-aeb6-4166-8b01-689a64aa3c67", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "IP plan", + "linkLabel": "PaaS", "subTarget": "tab0", - "preText": "IP plan", + "preText": "PaaS", "style": "primary" }, { - "id": "1a0ccac4-d44a-4b4d-a099-f93f0495f222", + "id": "06fbe4eb-04bd-4d76-9c0e-ea1b0b95654c", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Firewall", @@ -88,16 +88,16 @@ "style": "primary" }, { - "id": "44cb3f36-1888-473b-85e7-03fdb03b4600", + "id": "3c22811c-3485-40dc-8b8f-8278e1283e66", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Virtual WAN", + "linkLabel": "IP plan", "subTarget": "tab2", - "preText": "Virtual WAN", + "preText": "IP plan", "style": "primary" }, { - "id": "cb3adcaf-fdfc-4089-9886-593ab0380124", + "id": "472ed1ed-844d-4c25-b074-9b9118c01660", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Segmentation", @@ -106,25 +106,25 @@ "style": "primary" }, { - "id": "c8f6c488-a153-4f29-bf54-29a7c9820bea", + "id": "d44dbaa9-d68d-4d4e-8f41-0d18bdea7de2", + "cellValue": "VisibleTab", + "linkTarget": "parameter", + "linkLabel": "Virtual WAN", + "subTarget": "tab4", + "preText": "Virtual WAN", + "style": "primary" + }, + { + "id": "aa466b4e-2544-46a1-a17b-2e47a3d9b4c3", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Internet", - "subTarget": "tab4", + "subTarget": "tab5", "preText": "Internet", "style": "primary" }, { - "id": "4f840f20-a07e-4b15-b059-bda09ca13c4c", - "cellValue": "VisibleTab", - "linkTarget": "parameter", - "linkLabel": "Hybrid", - "subTarget": "tab5", - "preText": "Hybrid", - "style": "primary" - }, - { - "id": "9a952cc6-a8dc-4473-8e3e-c5fa5991cb7e", + "id": "b92de80c-6ace-41c7-bfee-f76ef6ac75e0", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Hub and spoke", @@ -133,12 +133,12 @@ "style": "primary" }, { - "id": "276045c1-085c-4ab9-8f0e-a5988f027911", + "id": "a7b3b845-af6d-47cd-a165-d6eaec6f279b", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "PaaS", + "linkLabel": "Hybrid", "subTarget": "tab7", - "preText": "PaaS", + "preText": "Hybrid", "style": "primary" } ] @@ -162,9 +162,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query4Stats", + "name": "Query20Stats", "type": 1, - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -178,37 +178,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query4FullyCompliant", + "name": "Query20FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query4Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query5Stats", - "type": 1, - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query5FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query5Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query20Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -229,7 +201,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query4Stats:$.Success}+{Query5Stats:$.Success}" + "resultVal": "{Query20Stats:$.Success}" } } ] @@ -248,7 +220,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query4Stats:$.Total}+{Query5Stats:$.Total}" + "resultVal": "{Query20Stats:$.Total}" } } ] @@ -282,7 +254,7 @@ { "type": 1, "content": { - "json": "## IP plan" + "json": "## PaaS" }, "customWidth": "50", "name": "tab0title" @@ -323,15 +295,15 @@ { "type": 1, "content": { - "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + "json": "Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this." }, - "name": "querytext4" + "name": "querytext20" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -380,69 +352,7 @@ ] } }, - "name": "query4" - }, - { - "type": 1, - "content": { - "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." - }, - "name": "querytext5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query5" + "name": "query20" } ] }, @@ -1048,9 +958,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query24Stats", + "name": "Query4Stats", "type": 1, - "query": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -1064,9 +974,37 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query24FullyCompliant", + "name": "Query4FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query24Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query4Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query5Stats", + "type": 1, + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query5FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query5Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -1087,7 +1025,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query24Stats:$.Success}" + "resultVal": "{Query4Stats:$.Success}+{Query5Stats:$.Success}" } } ] @@ -1106,7 +1044,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query24Stats:$.Total}" + "resultVal": "{Query4Stats:$.Total}+{Query5Stats:$.Total}" } } ] @@ -1140,7 +1078,7 @@ { "type": 1, "content": { - "json": "## Virtual WAN" + "json": "## IP plan" }, "customWidth": "50", "name": "tab2title" @@ -1181,15 +1119,15 @@ { "type": 1, "content": { - "json": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this." + "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." }, - "name": "querytext24" + "name": "querytext4" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1238,7 +1176,69 @@ ] } }, - "name": "query24" + "name": "query4" + }, + { + "type": 1, + "content": { + "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + }, + "name": "querytext5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query5" } ] }, @@ -1754,9 +1754,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query6Stats", + "name": "Query24Stats", "type": 1, - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -1770,9 +1770,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query6FullyCompliant", + "name": "Query24FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query6Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query24Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -1793,7 +1793,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query6Stats:$.Success}" + "resultVal": "{Query24Stats:$.Success}" } } ] @@ -1812,7 +1812,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query6Stats:$.Total}" + "resultVal": "{Query24Stats:$.Total}" } } ] @@ -1846,7 +1846,7 @@ { "type": 1, "content": { - "json": "## Internet" + "json": "## Virtual WAN" }, "customWidth": "50", "name": "tab4title" @@ -1884,6 +1884,224 @@ "customWidth": "50", "name": "TabPercentTile" }, + { + "type": 1, + "content": { + "json": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this." + }, + "name": "querytext24" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query24" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab4" + }, + "name": "tab4" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "crossComponentResources": [ + "{Subscription}" + ], + "parameters": [ + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query6Stats", + "type": 1, + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query6FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query6Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Tab5Success", + "type": 1, + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "criteriaData": [ + { + "criteriaContext": { + "operator": "Default", + "resultValType": "expression", + "resultVal": "{Query6Stats:$.Success}" + } + } + ] + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Tab5Total", + "type": 1, + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "criteriaData": [ + { + "criteriaContext": { + "operator": "Default", + "resultValType": "expression", + "resultVal": "{Query6Stats:$.Total}" + } + } + ] + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Tab5Percent", + "type": 1, + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "criteriaData": [ + { + "criteriaContext": { + "operator": "Default", + "resultValType": "expression", + "resultVal": "round(100*{Tab5Success}/{Tab5Total})" + } + } + ] + } + ], + "style": "pills", + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + "name": "TabInvisibleParameters" + }, + { + "type": 1, + "content": { + "json": "## Internet" + }, + "customWidth": "50", + "name": "tab5title" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"Column1\\\": \\\"{Tab5Percent}\\\", \\\"Column2\\\": \\\"Percent of successful checks\\\"}\",\"transformers\":null}", + "size": 3, + "queryType": 8, + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Column1", + "formatter": 4, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "redGreen" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + "subtitleContent": { + "columnMatch": "Column2" + }, + "showBorder": true + } + }, + "customWidth": "50", + "name": "TabPercentTile" + }, { "type": 1, "content": { @@ -1948,764 +2166,6 @@ } ] }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab4" - }, - "name": "tab4" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 9, - "content": { - "version": "KqlParameterItem/1.0", - "crossComponentResources": [ - "{Subscription}" - ], - "parameters": [ - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query7Stats", - "type": 1, - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query7FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query7Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query8Stats", - "type": 1, - "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query8FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query8Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query9Stats", - "type": 1, - "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query9FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query9Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query10Stats", - "type": 1, - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query10FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query10Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query11Stats", - "type": 1, - "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query11FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query11Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query12Stats", - "type": 1, - "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query12FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query12Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query13Stats", - "type": 1, - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", - "crossComponentResources": [ - "{Subscription}" - ], - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Query13FullyCompliant", - "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query13Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "queryType": 8 - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Tab5Success", - "type": 1, - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "criteriaData": [ - { - "criteriaContext": { - "operator": "Default", - "resultValType": "expression", - "resultVal": "{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}" - } - } - ] - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Tab5Total", - "type": 1, - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "criteriaData": [ - { - "criteriaContext": { - "operator": "Default", - "resultValType": "expression", - "resultVal": "{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}" - } - } - ] - }, - { - "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", - "version": "KqlParameterItem/1.0", - "name": "Tab5Percent", - "type": 1, - "isHiddenWhenLocked": true, - "timeContext": { - "durationMs": 86400000 - }, - "criteriaData": [ - { - "criteriaContext": { - "operator": "Default", - "resultValType": "expression", - "resultVal": "round(100*{Tab5Success}/{Tab5Total})" - } - } - ] - } - ], - "style": "pills", - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" - }, - "name": "TabInvisibleParameters" - }, - { - "type": 1, - "content": { - "json": "## Hybrid" - }, - "customWidth": "50", - "name": "tab5title" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"Column1\\\": \\\"{Tab5Percent}\\\", \\\"Column2\\\": \\\"Percent of successful checks\\\"}\",\"transformers\":null}", - "size": 3, - "queryType": 8, - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "Column1", - "formatter": 4, - "formatOptions": { - "min": 0, - "max": 100, - "palette": "redGreen" - }, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - "subtitleContent": { - "columnMatch": "Column2" - }, - "showBorder": true - } - }, - "customWidth": "50", - "name": "TabPercentTile" - }, - { - "type": 1, - "content": { - "json": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." - }, - "name": "querytext7" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query7" - }, - { - "type": 1, - "content": { - "json": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this." - }, - "name": "querytext8" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query8" - }, - { - "type": 1, - "content": { - "json": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this." - }, - "name": "querytext9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query9" - }, - { - "type": 1, - "content": { - "json": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." - }, - "name": "querytext10" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query10" - }, - { - "type": 1, - "content": { - "json": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this." - }, - "name": "querytext11" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query11" - }, - { - "type": 1, - "content": { - "json": "Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." - }, - "name": "querytext12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query12" - }, - { - "type": 1, - "content": { - "json": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information." - }, - "name": "querytext13" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query13" - } - ] - }, "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", @@ -3218,9 +2678,9 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query20Stats", + "name": "Query7Stats", "type": 1, - "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", "crossComponentResources": [ "{Subscription}" ], @@ -3234,9 +2694,177 @@ { "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", "version": "KqlParameterItem/1.0", - "name": "Query20FullyCompliant", + "name": "Query7FullyCompliant", "type": 1, - "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query20Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query7Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query8Stats", + "type": 1, + "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query8FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query8Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query9Stats", + "type": 1, + "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query9FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query9Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query10Stats", + "type": 1, + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query10FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query10Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query11Stats", + "type": 1, + "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query11FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query11Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query12Stats", + "type": 1, + "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query12FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query12Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 8 + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query13Stats", + "type": 1, + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())", + "crossComponentResources": [ + "{Subscription}" + ], + "isHiddenWhenLocked": true, + "timeContext": { + "durationMs": 86400000 + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources" + }, + { + "id": "daf05c62-1d5b-4325-b241-d7ee468f23eb", + "version": "KqlParameterItem/1.0", + "name": "Query13FullyCompliant", + "type": 1, + "query": "{\"version\":\"1.0.0\",\"content\":\"{\\\"value\\\": \\\"{Query13Stats:$.FullyCompliant}\\\"}\",\"transformers\":null}", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 @@ -3257,7 +2885,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query20Stats:$.Success}" + "resultVal": "{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}" } } ] @@ -3276,7 +2904,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query20Stats:$.Total}" + "resultVal": "{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}" } } ] @@ -3310,7 +2938,7 @@ { "type": 1, "content": { - "json": "## PaaS" + "json": "## Hybrid" }, "customWidth": "50", "name": "tab7title" @@ -3351,15 +2979,15 @@ { "type": 1, "content": { - "json": "Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this." + "json": "Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." }, - "name": "querytext20" + "name": "querytext7" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 4, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -3408,7 +3036,379 @@ ] } }, - "name": "query20" + "name": "query7" + }, + { + "type": 1, + "content": { + "json": "Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this." + }, + "name": "querytext8" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query8" + }, + { + "type": 1, + "content": { + "json": "Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this." + }, + "name": "querytext9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query9" + }, + { + "type": 1, + "content": { + "json": "Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." + }, + "name": "querytext10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query10" + }, + { + "type": 1, + "content": { + "json": "Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this." + }, + "name": "querytext11" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query11" + }, + { + "type": 1, + "content": { + "json": "Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this." + }, + "name": "querytext12" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query12" + }, + { + "type": 1, + "content": { + "json": "If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information." + }, + "name": "querytext13" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query13" } ] }, diff --git a/workbooks/alz_checklist.en_network_tabcounters_template.json b/workbooks/alz_checklist.en_network_tabcounters_template.json index 0ec2c742..4d56c47c 100644 --- a/workbooks/alz_checklist.en_network_tabcounters_template.json +++ b/workbooks/alz_checklist.en_network_tabcounters_template.json @@ -41,7 +41,7 @@ "dependsOn": [], "properties": { "displayName": "[parameters('workbookDisplayName')]", - "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"7805f86c-78a2-4fda-8668-43b3face6628\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan\",\n \"subTarget\": \"tab0\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"1a0ccac4-d44a-4b4d-a099-f93f0495f222\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Firewall\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Firewall\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"44cb3f36-1888-473b-85e7-03fdb03b4600\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"cb3adcaf-fdfc-4089-9886-593ab0380124\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation\",\n \"subTarget\": \"tab3\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"c8f6c488-a153-4f29-bf54-29a7c9820bea\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet\",\n \"subTarget\": \"tab4\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"4f840f20-a07e-4b15-b059-bda09ca13c4c\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid\",\n \"subTarget\": \"tab5\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"9a952cc6-a8dc-4473-8e3e-c5fa5991cb7e\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke\",\n \"subTarget\": \"tab6\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"276045c1-085c-4ab9-8f0e-a5988f027911\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS\",\n \"subTarget\": \"tab7\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Success}+{Query5Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Total}+{Query5Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab0title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab0Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query14Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query15Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query16Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query17Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query18Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Firewall\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab1title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab1Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium to enable additional security features. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query24Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query24Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query24Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab2title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab2Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext24\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query24\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query19Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query21Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query22Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query23Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query19Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query19Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab3Success}/{Tab3Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab3title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab3Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this.\"\n },\n \"name\": \"querytext23\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query23\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query6Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query6Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab4Success}/{Tab4Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab4title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab4Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query12Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query13Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab5Success}/{Tab5Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab5title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab5Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab6Success}/{Tab6Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab6title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab6Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query20Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query20Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query20Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab7Success}/{Tab7Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab7title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab7Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab7\"\n },\n \"name\": \"tab7\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", + "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"588872c2-aeb6-4166-8b01-689a64aa3c67\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS\",\n \"subTarget\": \"tab0\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"06fbe4eb-04bd-4d76-9c0e-ea1b0b95654c\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Firewall\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Firewall\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"3c22811c-3485-40dc-8b8f-8278e1283e66\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan\",\n \"subTarget\": \"tab2\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"472ed1ed-844d-4c25-b074-9b9118c01660\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation\",\n \"subTarget\": \"tab3\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"d44dbaa9-d68d-4d4e-8f41-0d18bdea7de2\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN\",\n \"subTarget\": \"tab4\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"aa466b4e-2544-46a1-a17b-2e47a3d9b4c3\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet\",\n \"subTarget\": \"tab5\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"b92de80c-6ace-41c7-bfee-f76ef6ac75e0\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke\",\n \"subTarget\": \"tab6\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"a7b3b845-af6d-47cd-a165-d6eaec6f279b\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid\",\n \"subTarget\": \"tab7\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query20FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query20Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query20Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query20Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab0title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab0Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query14FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query14Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query15FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query15Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query16FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query16Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query17FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query17Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query18FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query18Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query14Stats:$.Success}+{Query15Stats:$.Success}+{Query16Stats:$.Success}+{Query17Stats:$.Success}+{Query18Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query14Stats:$.Total}+{Query15Stats:$.Total}+{Query16Stats:$.Total}+{Query17Stats:$.Total}+{Query18Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Firewall\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab1title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab1Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium to enable additional security features. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Success}+{Query5Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query4Stats:$.Total}+{Query5Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab2title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab2Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query19FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query19Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query21FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query21Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query22FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query22Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query23FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query23Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query19Stats:$.Success}+{Query21Stats:$.Success}+{Query22Stats:$.Success}+{Query23Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query19Stats:$.Total}+{Query21Stats:$.Total}+{Query22Stats:$.Total}+{Query23Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab3Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab3Success}/{Tab3Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab3title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab3Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this.\"\n },\n \"name\": \"querytext23\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query23\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query24FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query24Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query24Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query24Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab4Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab4Success}/{Tab4Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab4title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab4Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext24\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query24\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query6Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query6Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab5Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab5Success}/{Tab5Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab5title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab5Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query1Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query1Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab6Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab6Success}/{Tab6Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab6title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab6Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2)| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query12FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query12Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation))| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query13FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query13Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query7Stats:$.Success}+{Query8Stats:$.Success}+{Query9Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query12Stats:$.Success}+{Query13Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query7Stats:$.Total}+{Query8Stats:$.Total}+{Query9Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query12Stats:$.Total}+{Query13Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab7Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab7Success}/{Tab7Total})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"TabInvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"customWidth\": \"50\",\n \"name\": \"tab7title\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"Column1\\\\\\\": \\\\\\\"{Tab7Percent}\\\\\\\", \\\\\\\"Column2\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 3,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"Column1\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n },\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"Column2\"\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"TabPercentTile\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab7\"\n },\n \"name\": \"tab7\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", "version": "1.0", "sourceId": "[parameters('workbookSourceId')]", "category": "[parameters('workbookType')]" diff --git a/workbooks/alz_checklist.en_network_workbook.json b/workbooks/alz_checklist.en_network_workbook.json index 37f607c6..82810dae 100644 --- a/workbooks/alz_checklist.en_network_workbook.json +++ b/workbooks/alz_checklist.en_network_workbook.json @@ -70,43 +70,43 @@ "style": "tabs", "links": [ { - "id": "cca9fff1-1d71-4a4e-9d2b-c4318b59b13a", + "id": "a3fc8334-4cee-42f9-9167-14d365668b13", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Hybrid", + "linkLabel": "Virtual WAN", "subTarget": "tab0", - "preText": "Hybrid", + "preText": "Virtual WAN", "style": "primary" }, { - "id": "4fea0413-ad63-4820-86b1-6734015c35e9", + "id": "6575ba7d-f29d-4583-882d-f5d3b301b6e9", + "cellValue": "VisibleTab", + "linkTarget": "parameter", + "linkLabel": "IP plan", + "subTarget": "tab1", + "preText": "IP plan", + "style": "primary" + }, + { + "id": "e76d450a-1cac-428b-a4c6-353a40704e20", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Hub and spoke", - "subTarget": "tab1", + "subTarget": "tab2", "preText": "Hub and spoke", "style": "primary" }, { - "id": "99692d9b-3bec-4338-a642-08a2a58fe376", + "id": "6400bf01-330b-4926-a1cb-883c4efce062", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Internet", - "subTarget": "tab2", - "preText": "Internet", - "style": "primary" - }, - { - "id": "2d8d85da-064d-4664-92ab-26ec671b57d2", - "cellValue": "VisibleTab", - "linkTarget": "parameter", - "linkLabel": "Segmentation", + "linkLabel": "Hybrid", "subTarget": "tab3", - "preText": "Segmentation", + "preText": "Hybrid", "style": "primary" }, { - "id": "ea1be232-bdb7-4488-a86d-1114f6bbadc1", + "id": "6be6e728-8b9f-40f4-89b2-cdf57637b57b", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "PaaS", @@ -115,30 +115,30 @@ "style": "primary" }, { - "id": "31c70286-e5b7-4cf7-8bc9-bef47ae63815", + "id": "e968bdcd-92e5-4f07-a5b5-3a757bdc7dd2", + "cellValue": "VisibleTab", + "linkTarget": "parameter", + "linkLabel": "Internet", + "subTarget": "tab5", + "preText": "Internet", + "style": "primary" + }, + { + "id": "dcc15dc6-955f-4e4a-9f18-9723ffdddac4", + "cellValue": "VisibleTab", + "linkTarget": "parameter", + "linkLabel": "Segmentation", + "subTarget": "tab6", + "preText": "Segmentation", + "style": "primary" + }, + { + "id": "9accdea3-5527-4a43-9fa4-58f78f9b8c27", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Firewall", - "subTarget": "tab5", - "preText": "Firewall", - "style": "primary" - }, - { - "id": "cd8ed180-fe22-455c-8c06-1fde47855a67", - "cellValue": "VisibleTab", - "linkTarget": "parameter", - "linkLabel": "Virtual WAN", - "subTarget": "tab6", - "preText": "Virtual WAN", - "style": "primary" - }, - { - "id": "0f0780d7-1639-4a52-a4e1-5e36fafc9700", - "cellValue": "VisibleTab", - "linkTarget": "parameter", - "linkLabel": "IP plan", "subTarget": "tab7", - "preText": "IP plan", + "preText": "Firewall", "style": "primary" } ] @@ -154,10 +154,510 @@ { "type": 1, "content": { - "json": "## Hybrid" + "json": "## Virtual WAN" }, "name": "tab0title" }, + { + "type": 1, + "content": { + "json": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this." + }, + "name": "querytext24" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 0, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query24" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab0" + }, + "name": "tab0" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## IP plan" + }, + "name": "tab1title" + }, + { + "type": 1, + "content": { + "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + }, + "name": "querytext4" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 0, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query4" + }, + { + "type": 1, + "content": { + "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." + }, + "name": "querytext5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 0, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query5" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab1" + }, + "name": "tab1" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Hub and spoke" + }, + "name": "tab2title" + }, + { + "type": 1, + "content": { + "json": "If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this." + }, + "name": "querytext0" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 0, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query0" + }, + { + "type": 1, + "content": { + "json": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." + }, + "name": "querytext1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 0, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query1" + }, + { + "type": 1, + "content": { + "json": "Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." + }, + "name": "querytext2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 0, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query2" + }, + { + "type": 1, + "content": { + "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." + }, + "name": "querytext3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 0, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query3" + } + ] + }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab2" + }, + "name": "tab2" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Hybrid" + }, + "name": "tab3title" + }, { "type": 1, "content": { @@ -597,9 +1097,9 @@ "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", - "value": "tab0" + "value": "tab3" }, - "name": "tab0" + "name": "tab3" }, { "type": 12, @@ -610,22 +1110,22 @@ { "type": 1, "content": { - "json": "## Hub and spoke" + "json": "## PaaS" }, - "name": "tab1title" + "name": "tab4title" }, { "type": 1, "content": { - "json": "If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this." + "json": "Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this." }, - "name": "querytext0" + "name": "querytext20" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", "size": 0, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -674,202 +1174,16 @@ ] } }, - "name": "query0" - }, - { - "type": 1, - "content": { - "json": "If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." - }, - "name": "querytext1" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 0, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query1" - }, - { - "type": 1, - "content": { - "json": "Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." - }, - "name": "querytext2" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 0, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query2" - }, - { - "type": 1, - "content": { - "json": "Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this." - }, - "name": "querytext3" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 0, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query3" + "name": "query20" } ] }, "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", - "value": "tab1" + "value": "tab4" }, - "name": "tab1" + "name": "tab4" }, { "type": 12, @@ -882,7 +1196,7 @@ "content": { "json": "## Internet" }, - "name": "tab2title" + "name": "tab5title" }, { "type": 1, @@ -951,9 +1265,9 @@ "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", - "value": "tab2" + "value": "tab5" }, - "name": "tab2" + "name": "tab5" }, { "type": 12, @@ -966,7 +1280,7 @@ "content": { "json": "## Segmentation" }, - "name": "tab3title" + "name": "tab6title" }, { "type": 1, @@ -1221,93 +1535,9 @@ "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", - "value": "tab3" + "value": "tab6" }, - "name": "tab3" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## PaaS" - }, - "name": "tab4title" - }, - { - "type": 1, - "content": { - "json": "Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this." - }, - "name": "querytext20" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 0, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query20" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab4" - }, - "name": "tab4" + "name": "tab6" }, { "type": 12, @@ -1320,7 +1550,7 @@ "content": { "json": "## Firewall" }, - "name": "tab5title" + "name": "tab7title" }, { "type": 1, @@ -1634,236 +1864,6 @@ } ] }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab5" - }, - "name": "tab5" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## Virtual WAN" - }, - "name": "tab6title" - }, - { - "type": 1, - "content": { - "json": "For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this." - }, - "name": "querytext24" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 0, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query24" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab6" - }, - "name": "tab6" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## IP plan" - }, - "name": "tab7title" - }, - { - "type": 1, - "content": { - "json": "Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." - }, - "name": "querytext4" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 0, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query4" - }, - { - "type": 1, - "content": { - "json": "Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this." - }, - "name": "querytext5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 0, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query5" - } - ] - }, "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", diff --git a/workbooks/alz_checklist.en_network_workbook_template.json b/workbooks/alz_checklist.en_network_workbook_template.json index bcd99de5..0da7a457 100644 --- a/workbooks/alz_checklist.en_network_workbook_template.json +++ b/workbooks/alz_checklist.en_network_workbook_template.json @@ -41,7 +41,7 @@ "dependsOn": [], "properties": { "displayName": "[parameters('workbookDisplayName')]", - "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"cca9fff1-1d71-4a4e-9d2b-c4318b59b13a\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"4fea0413-ad63-4820-86b1-6734015c35e9\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"99692d9b-3bec-4338-a642-08a2a58fe376\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"2d8d85da-064d-4664-92ab-26ec671b57d2\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation\",\n \"subTarget\": \"tab3\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"ea1be232-bdb7-4488-a86d-1114f6bbadc1\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS\",\n \"subTarget\": \"tab4\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"31c70286-e5b7-4cf7-8bc9-bef47ae63815\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Firewall\",\n \"subTarget\": \"tab5\",\n \"preText\": \"Firewall\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"cd8ed180-fe22-455c-8c06-1fde47855a67\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN\",\n \"subTarget\": \"tab6\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"0f0780d7-1639-4a52-a4e1-5e36fafc9700\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan\",\n \"subTarget\": \"tab7\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"name\": \"tab3title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this.\"\n },\n \"name\": \"querytext23\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query23\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"name\": \"tab4title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Firewall\"\n },\n \"name\": \"tab5title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium to enable additional security features. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"name\": \"tab6title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext24\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query24\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"name\": \"tab7title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab7\"\n },\n \"name\": \"tab7\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", + "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"a3fc8334-4cee-42f9-9167-14d365668b13\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Virtual WAN\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Virtual WAN\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"6575ba7d-f29d-4583-882d-f5d3b301b6e9\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"IP plan\",\n \"subTarget\": \"tab1\",\n \"preText\": \"IP plan\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"e76d450a-1cac-428b-a4c6-353a40704e20\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hub and spoke\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Hub and spoke\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"6400bf01-330b-4926-a1cb-883c4efce062\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Hybrid\",\n \"subTarget\": \"tab3\",\n \"preText\": \"Hybrid\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"6be6e728-8b9f-40f4-89b2-cdf57637b57b\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"PaaS\",\n \"subTarget\": \"tab4\",\n \"preText\": \"PaaS\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"e968bdcd-92e5-4f07-a5b5-3a757bdc7dd2\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Internet\",\n \"subTarget\": \"tab5\",\n \"preText\": \"Internet\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"dcc15dc6-955f-4e4a-9f18-9723ffdddac4\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Segmentation\",\n \"subTarget\": \"tab6\",\n \"preText\": \"Segmentation\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"9accdea3-5527-4a43-9fa4-58f78f9b8c27\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Firewall\",\n \"subTarget\": \"tab7\",\n \"preText\": \"Firewall\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Virtual WAN\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext24\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query24\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## IP plan\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hub and spoke\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Hybrid\"\n },\n \"name\": \"tab3title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab3\"\n },\n \"name\": \"tab3\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## PaaS\"\n },\n \"name\": \"tab4title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab4\"\n },\n \"name\": \"tab4\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Internet\"\n },\n \"name\": \"tab5title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab5\"\n },\n \"name\": \"tab5\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Segmentation\"\n },\n \"name\": \"tab6title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this.\"\n },\n \"name\": \"querytext23\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query23\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab6\"\n },\n \"name\": \"tab6\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Firewall\"\n },\n \"name\": \"tab7title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium to enable additional security features. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab7\"\n },\n \"name\": \"tab7\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", "version": "1.0", "sourceId": "[parameters('workbookSourceId')]", "category": "[parameters('workbookType')]" diff --git a/workbooks/alz_checklist.en_workbook.json b/workbooks/alz_checklist.en_workbook.json index 1e7c11e5..7225007e 100644 --- a/workbooks/alz_checklist.en_workbook.json +++ b/workbooks/alz_checklist.en_workbook.json @@ -70,7 +70,7 @@ "style": "tabs", "links": [ { - "id": "20a95a37-9690-4a3e-8858-886426c5f678", + "id": "c230dd3f-1eee-4253-ae12-f4012d17a03a", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Network Topology and Connectivity", @@ -79,7 +79,7 @@ "style": "primary" }, { - "id": "d04103e1-e9fe-4637-ab63-762983378681", + "id": "b41ada8a-3132-4c87-9660-80e9a20a1f6e", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Security", @@ -88,7 +88,7 @@ "style": "primary" }, { - "id": "8fe23de9-dcb6-4a2f-87f4-be4d39534046", + "id": "49380510-9f1e-4180-8b43-610691c0e96c", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Resource Organization", diff --git a/workbooks/alz_checklist.en_workbook_template.json b/workbooks/alz_checklist.en_workbook_template.json index 57bc0ee3..f668b511 100644 --- a/workbooks/alz_checklist.en_workbook_template.json +++ b/workbooks/alz_checklist.en_workbook_template.json @@ -41,7 +41,7 @@ "dependsOn": [], "properties": { "displayName": "[parameters('workbookDisplayName')]", - "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"20a95a37-9690-4a3e-8858-886426c5f678\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Network Topology and Connectivity\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Network Topology and Connectivity\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"d04103e1-e9fe-4637-ab63-762983378681\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Security\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Security\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"8fe23de9-dcb6-4a2f-87f4-be4d39534046\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Resource Organization\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Resource Organization\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Network Topology and Connectivity\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium to enable additional security features. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules) for further information.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext23\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query23\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext24\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query24\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext25\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query25\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this.\"\n },\n \"name\": \"querytext26\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query26\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext27\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query27\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Security\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets. Check [this link](https://learn.microsoft.com/azure/key-vault/general/overview-throttling) for further information.. [This training](https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext28\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query28\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management). Check [this link](https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs) for further information.\"\n },\n \"name\": \"querytext29\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query29\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Resource Organization\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enforce reasonably flat management group hierarchy with no more than four levels. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups) for further information.. [This training](https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enforce no subscriptions are placed under the root management group. Check [this link](https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group) for further information.. [This training](https://learn.microsoft.com/azure/governance/management-groups/overview) can help to educate yourself on this.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure tags are used for billing and cost management. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", + "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Landing Zone Review\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"c230dd3f-1eee-4253-ae12-f4012d17a03a\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Network Topology and Connectivity\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Network Topology and Connectivity\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"b41ada8a-3132-4c87-9660-80e9a20a1f6e\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Security\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Security\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"49380510-9f1e-4180-8b43-610691c0e96c\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Resource Organization\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Resource Organization\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Network Topology and Connectivity\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If using Route Server, use a /27 prefix for the Route Server subnet. Check [this link](https://learn.microsoft.com/azure/route-server/quickstart-configure-route-server-portal#create-a-route-server-1) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-route-server/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'RouteServerSubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you have more than 400 spoke networks in a region, deploy an additional hub to bypass VNet peering limits (500) and the maximum number of prefixes that can be advertised via ExpressRoute (1000). Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | summarize peeringcount = count() by id | extend compliant = (peeringcount < 450) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Limit the number of routes per route table to 400. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#azure-resource-manager-virtual-networking-limits) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/routetables' | mvexpand properties.routes | summarize routeCount = count() by id | extend compliant = (routeCount < 360) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use the setting 'Allow traffic to remote virtual network' when configuring VNet peerings. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering) for further information.. [This training](https://learn.microsoft.com/training/modules/hub-and-spoke-network-architecture/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | project id, peeringName=properties_virtualNetworkPeerings.name, compliant = (properties_virtualNetworkPeerings.properties.allowVirtualNetworkAccess == True) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use IP addresses from the address allocation ranges for private internets (RFC 1918). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | project name, id, location, resourceGroup, subscriptionId, cidr = addressPrefix | extend compliant = (cidr matches regex @'^(10\\\\.|172\\\\.(1[6-9]|2[0-9]|3[01])\\\\.|192\\\\.168\\\\.)') | project id, compliant, cidr | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that IP address space isn't wasted, don't create unnecessarily large virtual networks (for example /16). Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-addressing) for further information.. [This training](https://learn.microsoft.com/learn/paths/architect-network-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/virtualnetworks' | extend addressSpace = todynamic(properties.addressSpace) | extend addressPrefix = todynamic(properties.addressSpace.addressPrefixes) | mvexpand addressSpace | mvexpand addressPrefix | extend addressMask = split(addressPrefix,'/')[1] | extend compliant = addressMask > 16 | project name, id, subscriptionId, resourceGroup, addressPrefix, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Bastion in a subnet /26 or larger. Check [this link](https://learn.microsoft.com/azure/bastion/bastion-faq#subnet) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-bastion/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureBastionSubnet' | extend compliant = (subnetPrefixLength <= 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Select the right SKU for the ExpressRoute/VPN gateways based on bandwidth and performance requirements. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways?source=recommendations#gwsku) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier !in ('Basic', 'Standard')| project name, id, subscriptionId, resourceGroup, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure that you're using unlimited-data ExpressRoute circuits only if you reach the bandwidth that justifies their cost. Check [this link](https://learn.microsoft.com/azure/expressroute/plan-manage-cost) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/expressroutecircuits' | extend compliant = (tolower(sku.family) == 'metereddata' or tolower(sku.tier) == 'local') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Leverage the Local SKU of ExpressRoute to reduce the cost of your circuits, if your circuit peering location supports your Azure regions for the Local SKU. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-faqs#expressroute-local) for further information.. [This training](https://learn.microsoft.com/training/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext12\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project id, gwid=tostring(properties.virtualNetworkGateway1.id), circuitid=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitid=tostring(id), circuitsku=sku.tier) on circuitid | project id=gwid, compliant = (circuitsku == 'Local') | summarize compliant=max(compliant) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query12\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy a zone-redundant ExpressRoute gateway in the supported Azure regions. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-about-virtual-network-gateways) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext13\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.network/virtualnetworkgateways'| where properties.gatewayType =~ 'vpn' or properties.gatewayType == 'ExpressRoute'| extend SKUName = properties.sku.name, SKUTier = properties.sku.tier, Type = properties.gatewayType| extend compliant = SKUTier contains 'AZ'| project name, id, subscriptionId, resourceGroup, Type, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query13\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use zone-redundant VPN gateways to connect branches or remote locations to Azure (where available). Check [this link](https://learn.microsoft.com/azure/vpn-gateway/create-zone-redundant-vnet-gateway) for further information.. [This training](https://learn.microsoft.com/training/modules/intro-to-azure-vpn-gateway/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext14\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworkgateways' | where properties.gatewayType == 'Vpn' | extend compliant = (tolower(properties.sku.name) contains 'az') | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query14\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use ExpressRoute circuits from different peering locations for redundancy. Check [this link](https://learn.microsoft.com/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering#need-for-redundant-connectivity-solution) for further information.. [This training](https://learn.microsoft.com/learn/modules/design-implement-azure-expressroute/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext15\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/connections' | where properties.connectionType == 'ExpressRoute' | project cxId=id, gwId=tostring(properties.virtualNetworkGateway1.id), circuitId=tostring(properties.peer.id) | join (resources | where type=='microsoft.network/expressroutecircuits' | project circuitId=tostring(id), circuitLocation=tostring(properties.serviceProviderProperties.peeringLocation)) on circuitId | distinct gwId, circuitLocation | summarize countErLocations=count() by id=gwId | extend compliant = (countErLocations >= 2) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query15\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you are using a route table in the GatewaySubnet, make sure that gateway routes are propagated. Check [this link](https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub) for further information.\"\n },\n \"name\": \"querytext16\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,resourceGroup,name,subnetName=tostring(subnets.name),routeTableId=tostring(subnets.properties.routeTable.id) | where subnetName == 'GatewaySubnet' | join kind=leftouter (Resources | where type == 'microsoft.network/routetables' | project routeTableName=name,routeTableId=id, disableBgpRoutePropagation=properties.disableBgpRoutePropagation) on routeTableId | project id,compliant = (disableBgpRoutePropagation == False or isnull(disableBgpRoutePropagation)) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query16\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use application rules to filter outbound traffic on destination host name for supported protocols. Use FQDN-based network rules and Azure Firewall with DNS proxy to filter egress traffic to the Internet over other protocols. Check [this link](https://learn.microsoft.com/azure/firewall/fqdn-filtering-network-rules) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext17\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.dnsSettings.enableProxy == true) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query17\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure Firewall Premium to enable additional security features. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext18\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.sku.tier == 'Premium') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query18\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall Threat Intelligence mode to Alert and Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps-signature-rules) for further information.\"\n },\n \"name\": \"querytext19\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.threatIntelMode == 'Deny') | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query19\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure Azure Firewall IDPS mode to Deny for additional protection. Check [this link](https://learn.microsoft.com/azure/firewall/premium-features#idps) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext20\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/firewallpolicies' | extend compliant = (properties.intrusionDetection.mode == 'Deny') | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query20\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For subnets in VNets not connected to Virtual WAN, attach a route table so that Internet traffic is redirected to Azure Firewall or a Network Virtual Appliance. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for further information.\"\n },\n \"name\": \"querytext21\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets=properties.subnets | mv-expand subnets | project id,name,subnetId=tostring(subnets.id), subnetName=tostring(subnets.name),subnetRT=subnets.properties.routeTable.id | where not (subnetName in ('GatewaySubnet', 'AzureFirewallSubnet', 'RouteServerSubnet', 'AzureBastionSubnet')) | extend hasRT = isnotnull(subnetRT) | distinct id, hasRT, subnetId | join kind=fullouter (resources | where type == 'microsoft.network/virtualnetworks' | mvexpand properties.virtualNetworkPeerings | extend isVWAN=(tolower(split(properties_virtualNetworkPeerings.name, '_')[0]) == 'remotevnettohubpeering') | mv-expand properties.subnets | project id, isVWAN, name, subnetId=tostring(properties_subnets.id), subnetName=tostring(properties_subnets.name) | summarize PeeredToVWAN=max(isVWAN) by id, subnetId | project id, subnetId, isVWANpeer = (PeeredToVWAN == true)) on subnetId | project id=iff(isnotempty(id), id, id1), subnetId=iff(isnotempty(subnetId), subnetId, subnetId1), hasRT, isVWANpeer | extend compliant = (hasRT==true or isVWANpeer==true) | distinct id, subnetId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query21\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use a /26 prefix for your Azure Firewall subnets. Check [this link](https://learn.microsoft.com/azure/firewall/firewall-faq#why-does-azure-firewall-need-a--26-subnet-size) for further information.. [This training](https://learn.microsoft.com/training/modules/introduction-azure-firewall/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext22\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'AzureFirewallSubnet' | extend compliant = (subnetPrefixLength == 26) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query22\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't enable virtual network service endpoints by default on all subnets. Check [this link](https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-network-security/?source=learn) can help to educate yourself on this.\"\n },\n \"name\": \"querytext23\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/virtualnetworks' | project id,resourceGroup,name,subnets = properties.subnets | mv-expand subnets | project id = subnets.id, resourceGroup, VNet = name, serviceEndpoints = subnets.properties.serviceEndpoints, compliant = (isnull(subnets.properties.serviceEndpoints) or array_length(subnets.properties.serviceEndpoints) == 0) | order by compliant asc | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query23\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use at least a /27 prefix for your Gateway subnets. Check [this link](https://learn.microsoft.com/azure/expressroute/expressroute-howto-add-gateway-resource-manager#add-a-gateway) for further information.\"\n },\n \"name\": \"querytext24\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | project id, subnetName = subnets.name, subnetPrefix = subnets.properties.addressPrefix | extend subnetPrefixLength = split(subnetPrefix, '/')[1] | where subnetName == 'GatewaySubnet' | extend compliant = (subnetPrefixLength <= 27) | distinct id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query24\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Don't rely on the NSG inbound default rules using the VirtualNetwork service tag to limit connectivity. Check [this link](https://learn.microsoft.com/azure/virtual-network/service-tags-overview#available-service-tags) for further information.\"\n },\n \"name\": \"querytext25\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/networksecuritygroups' | mvexpand properties.securityRules | project id,name,ruleAction=properties_securityRules.properties.access,rulePriority=properties_securityRules.properties.priority,ruleDst=properties_securityRules.properties.destinationAddressPrefix,ruleSrc=properties_securityRules.properties.sourceAddressPrefix,ruleProt=properties_securityRules.properties.protocol,ruleDirection=properties_securityRules.properties.direction,rulePort=properties_securityRules.properties.destinationPortRange | summarize StarDenies=countif(ruleAction=='Deny' and ruleDst=='*' and ruleSrc=='*' and ruleProt=='*' and rulePort=='*') by id,tostring(ruleDirection) | where ruleDirection == 'Inbound' | project id,compliant=(StarDenies>0) | union (resources | where type=='microsoft.network/networksecuritygroups' | where array_length(properties.securityRules)==0 | extend compliant=false | project id,compliant) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query25\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Do not implement more than 900 NSG rules per NSG, due to the limit of 1000 rules. Check [this link](https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits) for further information.. [This training](https://learn.microsoft.com/azure/virtual-network/network-security-group-how-it-works) can help to educate yourself on this.\"\n },\n \"name\": \"querytext26\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/networksecuritygroups' | project id, rules = array_length(properties.securityRules) | project id, compliant = (rules < 900) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query26\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"For outbound Internet traffic protection and filtering, deploy Azure Firewall in secured hubs. Check [this link](https://learn.microsoft.com/azure/virtual-wan/howto-firewall) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-networking-infrastructure/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext27\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/virtualhubs' | extend compliant = isnotnull(properties.azureFirewall.id) | project id, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query27\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Security\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use different Azure Key Vaults for different applications and regions to avoid transaction scale limits and restrict access to secrets. Check [this link](https://learn.microsoft.com/azure/key-vault/general/overview-throttling) for further information.. [This training](https://learn.microsoft.com/training/modules/configure-and-manage-azure-key-vault/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext28\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"ResourceContainers | where type=='microsoft.resources/subscriptions'| parse id with '/subscriptions/' SubscriptionID| project subscriptionId, SubscriptionName = name| join kind=leftouter (Resources| where type == 'microsoft.keyvault/vaults'| project id, name, subscriptionId) on subscriptionId| join kind= leftouter (Resources| where type == 'microsoft.keyvault/vaults'| summarize ResourceCount = count() by subscriptionId) on subscriptionId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query28\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Centralized threat detection with correlated logs - consolidate security data in a central location where it can be correlated across various services via SIEM (security information and event management). Check [this link](https://learn.microsoft.com/en-us/azure/well-architected/security/monitor-threats#centralized-threat-detection-with-correlated-logs) for further information.\"\n },\n \"name\": \"querytext29\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources| where type == 'microsoft.operationalinsights/workspaces'| extend wsid = properties.customerId| project workspaceResourceId = tolower(id), name, wsid| join (resources| where type == 'microsoft.operationsmanagement/solutions'| where name has 'SecurityInsights'| extend workspaceResourceId = tostring(tolower(properties.workspaceResourceId))| project workspaceResourceId | summarize ResourceCount = count() by workspaceResourceId) on workspaceResourceId| extend RCount = iff(isnull(ResourceCount), 0, ResourceCount)| project-away ResourceCount| extend compliant = (RCount <> 0) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query29\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Resource Organization\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enforce reasonably flat management group hierarchy with no more than four levels. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/landing-zone/design-area/resource-org-management-groups) for further information.. [This training](https://learn.microsoft.com/learn/modules/azure-architecture-fundamentals/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant =( array_length(mgmtChain) <= 4 and array_length(mgmtChain) > 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enforce no subscriptions are placed under the root management group. Check [this link](https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group) for further information.. [This training](https://learn.microsoft.com/azure/governance/management-groups/overview) can help to educate yourself on this.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resourcecontainers| where type == 'microsoft.resources/subscriptions'| extend ManagementGroup = tostring(tags),mgmtChain = properties.managementGroupAncestorsChain| extend compliant = (array_length(mgmtChain) > 1) | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure tags are used for billing and cost management. Check [this link](https://learn.microsoft.com/azure/cloud-adoption-framework/ready/azure-best-practices/track-costs) for further information.. [This training](https://learn.microsoft.com/learn/paths/implement-resource-mgmt-security/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | extend compliant = isnotnull(['tags']) | project name, id, subscriptionId, resourceGroup, tags, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 0,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", "version": "1.0", "sourceId": "[parameters('workbookSourceId')]", "category": "[parameters('workbookType')]" diff --git a/workbooks/appdelivery_checklist.en_network_counters_workbook.json b/workbooks/appdelivery_checklist.en_network_counters_workbook.json index c546e902..7d1eb95f 100644 --- a/workbooks/appdelivery_checklist.en_network_counters_workbook.json +++ b/workbooks/appdelivery_checklist.en_network_counters_workbook.json @@ -413,7 +413,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query9Stats:$.Success}" + "resultVal": "{Query0Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}" } } ] @@ -432,7 +432,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query9Stats:$.Total}" + "resultVal": "{Query0Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}" } } ] @@ -470,7 +470,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query0Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}" + "resultVal": "{Query1Stats:$.Success}+{Query8Stats:$.Success}" } } ] @@ -489,7 +489,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query0Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}" + "resultVal": "{Query1Stats:$.Total}+{Query8Stats:$.Total}" } } ] @@ -527,7 +527,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query1Stats:$.Success}+{Query8Stats:$.Success}" + "resultVal": "{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query9Stats:$.Success}" } } ] @@ -546,7 +546,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query1Stats:$.Total}+{Query8Stats:$.Total}" + "resultVal": "{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query9Stats:$.Total}" } } ] @@ -584,7 +584,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query9Stats:$.Total}+{Query0Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query1Stats:$.Total}+{Query8Stats:$.Total}" + "resultVal": "{Query0Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query1Stats:$.Total}+{Query8Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query9Stats:$.Total}" } } ] @@ -603,7 +603,7 @@ "criteriaContext": { "operator": "Default", "resultValType": "expression", - "resultVal": "{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query9Stats:$.Success}+{Query0Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query1Stats:$.Success}+{Query8Stats:$.Success}" + "resultVal": "{Query0Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query1Stats:$.Success}+{Query8Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query9Stats:$.Success}" } } ] @@ -677,306 +677,36 @@ "style": "tabs", "links": [ { - "id": "7deb8fc6-809f-4a49-9e43-a416fc3455df", + "id": "bdb4b4a4-8f93-4bc8-be0a-1162a7be880b", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Front Door ({Tab0Success:value}/{Tab0Total:value})", + "linkLabel": "App Gateway ({Tab0Success:value}/{Tab0Total:value})", "subTarget": "tab0", - "preText": "Front Door", - "style": "primary" - }, - { - "id": "135692b9-81ff-41f1-a362-e2a186a40ed4", - "cellValue": "VisibleTab", - "linkTarget": "parameter", - "linkLabel": "App Gateway ({Tab1Success:value}/{Tab1Total:value})", - "subTarget": "tab1", "preText": "App Gateway", "style": "primary" }, { - "id": "d89692d9-1fa7-4c55-846f-ccd47a243139", + "id": "2458c677-bb2a-45ad-bf45-07f85dfce6ae", "cellValue": "VisibleTab", "linkTarget": "parameter", - "linkLabel": "Load Balancer ({Tab2Success:value}/{Tab2Total:value})", - "subTarget": "tab2", + "linkLabel": "Load Balancer ({Tab1Success:value}/{Tab1Total:value})", + "subTarget": "tab1", "preText": "Load Balancer", "style": "primary" + }, + { + "id": "b23e130f-5c36-4b2e-88c5-e09d97a8f411", + "cellValue": "VisibleTab", + "linkTarget": "parameter", + "linkLabel": "Front Door ({Tab2Success:value}/{Tab2Total:value})", + "subTarget": "tab2", + "preText": "Front Door", + "style": "primary" } ] }, "name": "Tabs" }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "## Front Door" - }, - "name": "tab0title" - }, - { - "type": 1, - "content": { - "json": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information." - }, - "name": "querytext5" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query5" - }, - { - "type": 1, - "content": { - "json": "Disable health probes when there is only one origin in an Azure Front Door origin group. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group) for further information." - }, - "name": "querytext6" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query6" - }, - { - "type": 1, - "content": { - "json": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes) for further information." - }, - "name": "querytext7" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query7" - }, - { - "type": 1, - "content": { - "json": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates) for further information." - }, - "name": "querytext9" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", - "size": 4, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "id", - "formatter": 0, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "compliant", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "1", - "representation": "success", - "text": "Success" - }, - { - "operator": "==", - "thresholdValue": "0", - "representation": "failed", - "text": "Failed" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "unknown", - "text": "Unknown" - } - ] - } - } - ] - } - }, - "name": "query9" - } - ] - }, - "conditionalVisibility": { - "parameterName": "VisibleTab", - "comparison": "isEqualTo", - "value": "tab0" - }, - "name": "tab0" - }, { "type": 12, "content": { @@ -988,7 +718,7 @@ "content": { "json": "## App Gateway" }, - "name": "tab1title" + "name": "tab0title" }, { "type": 1, @@ -1367,9 +1097,9 @@ "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", - "value": "tab1" + "value": "tab0" }, - "name": "tab1" + "name": "tab0" }, { "type": 12, @@ -1382,7 +1112,7 @@ "content": { "json": "## Load Balancer" }, - "name": "tab2title" + "name": "tab1title" }, { "type": 1, @@ -1510,6 +1240,276 @@ } ] }, + "conditionalVisibility": { + "parameterName": "VisibleTab", + "comparison": "isEqualTo", + "value": "tab1" + }, + "name": "tab1" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Front Door" + }, + "name": "tab2title" + }, + { + "type": 1, + "content": { + "json": "Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information." + }, + "name": "querytext5" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query5" + }, + { + "type": 1, + "content": { + "json": "Disable health probes when there is only one origin in an Azure Front Door origin group. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group) for further information." + }, + "name": "querytext6" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query6" + }, + { + "type": 1, + "content": { + "json": "Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes) for further information." + }, + "name": "querytext7" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query7" + }, + { + "type": 1, + "content": { + "json": "Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates) for further information." + }, + "name": "querytext9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed", + "size": 4, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "id", + "formatter": 0, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "compliant", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "1", + "representation": "success", + "text": "Success" + }, + { + "operator": "==", + "thresholdValue": "0", + "representation": "failed", + "text": "Failed" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "unknown", + "text": "Unknown" + } + ] + } + } + ] + } + }, + "name": "query9" + } + ] + }, "conditionalVisibility": { "parameterName": "VisibleTab", "comparison": "isEqualTo", diff --git a/workbooks/appdelivery_checklist.en_network_counters_workbook_template.json b/workbooks/appdelivery_checklist.en_network_counters_workbook_template.json index ff4d468d..5185c876 100644 --- a/workbooks/appdelivery_checklist.en_network_counters_workbook_template.json +++ b/workbooks/appdelivery_checklist.en_network_counters_workbook_template.json @@ -41,7 +41,7 @@ "dependsOn": [], "properties": { "displayName": "[parameters('workbookDisplayName')]", - "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"value::all\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query9Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query9Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query1Stats:$.Success}+{Query8Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query1Stats:$.Total}+{Query8Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookTotal\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query9Stats:$.Total}+{Query0Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query1Stats:$.Total}+{Query8Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookSuccess\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query9Stats:$.Success}+{Query0Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query1Stats:$.Success}+{Query8Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookPercent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{WorkbookSuccess}/{WorkbookTotal})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"InvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Application Delivery Networking - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"50\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"WorkbookPercent\\\\\\\": \\\\\\\"{WorkbookPercent}\\\\\\\", \\\\\\\"SubTitle\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 4,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"WorkbookPercent\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"SubTitle\",\n \"formatter\": 1\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"ProgressTile\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"7deb8fc6-809f-4a49-9e43-a416fc3455df\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Front Door ({Tab0Success:value}/{Tab0Total:value})\",\n \"subTarget\": \"tab0\",\n \"preText\": \"Front Door\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"135692b9-81ff-41f1-a362-e2a186a40ed4\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"App Gateway ({Tab1Success:value}/{Tab1Total:value})\",\n \"subTarget\": \"tab1\",\n \"preText\": \"App Gateway\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"d89692d9-1fa7-4c55-846f-ccd47a243139\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Load Balancer ({Tab2Success:value}/{Tab2Total:value})\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Load Balancer\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Front Door\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Disable health probes when there is only one origin in an Azure Front Door origin group. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group) for further information.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes) for further information.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates) for further information.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## App Gateway\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure you are using Application Gateway v2 SKU. Check [this link](https://learn.microsoft.com/azure/application-gateway/overview-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24. Check [this link](https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure autoscaling with a minimum amount of instances of two. Check [this link](https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy Application Gateway across Availability Zones. Check [this link](https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection) for further information.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy your WAF policy for Application Gateway in 'Prevention' mode. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Load Balancer\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure you are using the Standard SKU for your Azure Load Balancers. Check [this link](https://learn.microsoft.com/azure/load-balancer/load-balancer-overview) for further information.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard') | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability. Check [this link](https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity) for further information.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", + "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"crossComponentResources\": [\n \"value::all\"\n ],\n \"parameters\": [\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query0FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query0Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard')| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query1FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query1Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query2FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query2Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query3FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query3Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4Stats\",\n \"type\": 1,\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query4FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query4Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query5FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query5Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6Stats\",\n \"type\": 1,\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query6FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query6Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7Stats\",\n \"type\": 1,\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query7FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query7Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8Stats\",\n \"type\": 1,\n \"query\": \"resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query8FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query8Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9Stats\",\n \"type\": 1,\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query9FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query9Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query10FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query10Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11Stats\",\n \"type\": 1,\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode| summarize Total = count(), Success = countif(compliant==1), Failed = countif(compliant==0) | extend SuccessPercent = iff(Total==0, 100, 100*toint(Success)/toint(Total)) | extend FullyCompliant = iff(SuccessPercent == 100, 'Yes', 'No') | project Query1Stats=tostring(pack_all())\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Query11FullyCompliant\",\n \"type\": 1,\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": \\\\\\\"{Query11Stats:$.FullyCompliant}\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"queryType\": 8\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab0Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab0Success}/{Tab0Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query1Stats:$.Success}+{Query8Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query1Stats:$.Total}+{Query8Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab1Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab1Success}/{Tab1Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Success\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query9Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Total\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query9Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Tab2Percent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{Tab2Success}/{Tab2Total})\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookTotal\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Total}+{Query2Stats:$.Total}+{Query3Stats:$.Total}+{Query4Stats:$.Total}+{Query10Stats:$.Total}+{Query11Stats:$.Total}+{Query1Stats:$.Total}+{Query8Stats:$.Total}+{Query5Stats:$.Total}+{Query6Stats:$.Total}+{Query7Stats:$.Total}+{Query9Stats:$.Total}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookSuccess\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"{Query0Stats:$.Success}+{Query2Stats:$.Success}+{Query3Stats:$.Success}+{Query4Stats:$.Success}+{Query10Stats:$.Success}+{Query11Stats:$.Success}+{Query1Stats:$.Success}+{Query8Stats:$.Success}+{Query5Stats:$.Success}+{Query6Stats:$.Success}+{Query7Stats:$.Success}+{Query9Stats:$.Success}\"\n }\n }\n ]\n },\n {\n \"id\": \"daf05c62-1d5b-4325-b241-d7ee468f23eb\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"WorkbookPercent\",\n \"type\": 1,\n \"isHiddenWhenLocked\": true,\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"criteriaData\": [\n {\n \"criteriaContext\": {\n \"operator\": \"Default\",\n \"resultValType\": \"expression\",\n \"resultVal\": \"round(100*{WorkbookSuccess}/{WorkbookTotal})\"\n }\n }\n ]\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\"\n },\n \"name\": \"InvisibleParameters\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Application Delivery Networking - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"50\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"WorkbookPercent\\\\\\\": \\\\\\\"{WorkbookPercent}\\\\\\\", \\\\\\\"SubTitle\\\\\\\": \\\\\\\"Percent of successful checks\\\\\\\"}\\\",\\\"transformers\\\":null}\",\n \"size\": 4,\n \"queryType\": 8,\n \"visualization\": \"tiles\",\n \"tileSettings\": {\n \"titleContent\": {\n \"columnMatch\": \"WorkbookPercent\",\n \"formatter\": 4,\n \"formatOptions\": {\n \"min\": 0,\n \"max\": 100,\n \"palette\": \"redGreen\"\n }\n },\n \"subtitleContent\": {\n \"columnMatch\": \"SubTitle\",\n \"formatter\": 1\n },\n \"showBorder\": true\n }\n },\n \"customWidth\": \"50\",\n \"name\": \"ProgressTile\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"bdb4b4a4-8f93-4bc8-be0a-1162a7be880b\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"App Gateway ({Tab0Success:value}/{Tab0Total:value})\",\n \"subTarget\": \"tab0\",\n \"preText\": \"App Gateway\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"2458c677-bb2a-45ad-bf45-07f85dfce6ae\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Load Balancer ({Tab1Success:value}/{Tab1Total:value})\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Load Balancer\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"b23e130f-5c36-4b2e-88c5-e09d97a8f411\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Front Door ({Tab2Success:value}/{Tab2Total:value})\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Front Door\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## App Gateway\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure you are using Application Gateway v2 SKU. Check [this link](https://learn.microsoft.com/azure/application-gateway/overview-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24. Check [this link](https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure autoscaling with a minimum amount of instances of two. Check [this link](https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy Application Gateway across Availability Zones. Check [this link](https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection) for further information.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy your WAF policy for Application Gateway in 'Prevention' mode. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Load Balancer\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure you are using the Standard SKU for your Azure Load Balancers. Check [this link](https://learn.microsoft.com/azure/load-balancer/load-balancer-overview) for further information.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard') | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability. Check [this link](https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity) for further information.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Front Door\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Disable health probes when there is only one origin in an Azure Front Door origin group. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group) for further information.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes) for further information.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates) for further information.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", "version": "1.0", "sourceId": "[parameters('workbookSourceId')]", "category": "[parameters('workbookType')]" diff --git a/workbooks/appdelivery_checklist.en_network_workbook.json b/workbooks/appdelivery_checklist.en_network_workbook.json index f78f4791..7a1e702f 100644 --- a/workbooks/appdelivery_checklist.en_network_workbook.json +++ b/workbooks/appdelivery_checklist.en_network_workbook.json @@ -70,7 +70,7 @@ "style": "tabs", "links": [ { - "id": "e4fcfb6e-ceb5-40ff-9e71-89557bc50692", + "id": "a5fc4567-0086-4cde-be79-39dbe05d9fe1", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "App Gateway", @@ -79,7 +79,7 @@ "style": "primary" }, { - "id": "3f16815c-7a34-4e36-a7bc-1fb6bcffdab7", + "id": "914f6a22-b6e8-4ee1-ad43-8ef7c8227081", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Load Balancer", @@ -88,7 +88,7 @@ "style": "primary" }, { - "id": "6df8f5d1-178e-451e-a93b-1f1ccbcaeb6f", + "id": "99c96fa2-e843-4355-9d30-c214fbb9cafe", "cellValue": "VisibleTab", "linkTarget": "parameter", "linkLabel": "Front Door", diff --git a/workbooks/appdelivery_checklist.en_network_workbook_template.json b/workbooks/appdelivery_checklist.en_network_workbook_template.json index d06972e1..c6a9d34d 100644 --- a/workbooks/appdelivery_checklist.en_network_workbook_template.json +++ b/workbooks/appdelivery_checklist.en_network_workbook_template.json @@ -41,7 +41,7 @@ "dependsOn": [], "properties": { "displayName": "[parameters('workbookDisplayName')]", - "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Application Delivery Networking - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"e4fcfb6e-ceb5-40ff-9e71-89557bc50692\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"App Gateway\",\n \"subTarget\": \"tab0\",\n \"preText\": \"App Gateway\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"3f16815c-7a34-4e36-a7bc-1fb6bcffdab7\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Load Balancer\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Load Balancer\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"6df8f5d1-178e-451e-a93b-1f1ccbcaeb6f\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Front Door\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Front Door\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## App Gateway\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure you are using Application Gateway v2 SKU. Check [this link](https://learn.microsoft.com/azure/application-gateway/overview-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24. Check [this link](https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure autoscaling with a minimum amount of instances of two. Check [this link](https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy Application Gateway across Availability Zones. Check [this link](https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection) for further information.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy your WAF policy for Application Gateway in 'Prevention' mode. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Load Balancer\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure you are using the Standard SKU for your Azure Load Balancers. Check [this link](https://learn.microsoft.com/azure/load-balancer/load-balancer-overview) for further information.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard') | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability. Check [this link](https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity) for further information.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Front Door\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Disable health probes when there is only one origin in an Azure Front Door origin group. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group) for further information.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes) for further information.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates) for further information.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", + "serializedData": "{\n \"version\": \"Notebook/1.0\",\n \"items\": [\n {\n \"type\": 9,\n \"content\": {\n \"version\": \"KqlParameterItem/1.0\",\n \"parameters\": [\n {\n \"id\": \"497a107e-dde8-433e-b263-35ac8e8f7834\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"Subscription\",\n \"type\": 6,\n \"multiSelect\": true,\n \"quote\": \"'\",\n \"delimiter\": \",\",\n \"typeSettings\": {\n \"additionalResourceOptions\": [\n \"value::all\"\n ],\n \"includeAll\": true,\n \"showDefault\": false\n },\n \"timeContext\": {\n \"durationMs\": 86400000\n },\n \"value\": [\n \"value::all\"\n ]\n },\n {\n \"id\": \"844e4f4e-df51-4e3c-8eaf-0dc78b92c721\",\n \"version\": \"KqlParameterItem/1.0\",\n \"name\": \"OnlyFailed\",\n \"label\": \"Only show failed\",\n \"type\": 2,\n \"typeSettings\": {\n \"additionalResourceOptions\": [],\n \"showDefault\": false\n },\n \"jsonData\": \"[\\r\\n { \\\"value\\\":true, \\\"label\\\":\\\"True\\\" },\\r\\n { \\\"value\\\":false, \\\"label\\\":\\\"False\\\", \\\"selected\\\":true }\\r\\n]\"\n }\n ],\n \"style\": \"pills\",\n \"queryType\": 0,\n \"resourceType\": \"microsoft.operationalinsights/workspaces\"\n },\n \"name\": \"WorkbookSelectors\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"If you set \\\"Only show failed\\\" to \\\"Yes\\\", the different queries will only show items that have failed their compliance checks.\",\n \"style\": \"info\"\n },\n \"name\": \"InfoBox\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Azure Application Delivery Networking - Network\\n\\n---\\n\\nThis workbook has been automatically generated out of the checklists in the [Azure Review Checklists repo](https://github.com/Azure/review-checklists). This repo contains best practices and recommendations around generic Landing Zones as well as specific services such as Azure Virtual Desktop, Azure Kubernetes Service or Azure VMware Solution, to name a few. This repository of best practices is curated by Azure engineers, but open to anybody to contribute.\\n\\nIf you see a problem in the queries that are part of this workbook, please open a Github issue [here](https://github.com/Azure/review-checklists/issues/new).\"\n },\n \"customWidth\": \"100\",\n \"name\": \"MarkdownHeader\"\n },\n {\n \"type\": 11,\n \"content\": {\n \"version\": \"LinkItem/1.0\",\n \"style\": \"tabs\",\n \"links\": [\n {\n \"id\": \"a5fc4567-0086-4cde-be79-39dbe05d9fe1\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"App Gateway\",\n \"subTarget\": \"tab0\",\n \"preText\": \"App Gateway\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"914f6a22-b6e8-4ee1-ad43-8ef7c8227081\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Load Balancer\",\n \"subTarget\": \"tab1\",\n \"preText\": \"Load Balancer\",\n \"style\": \"primary\"\n },\n {\n \"id\": \"99c96fa2-e843-4355-9d30-c214fbb9cafe\",\n \"cellValue\": \"VisibleTab\",\n \"linkTarget\": \"parameter\",\n \"linkLabel\": \"Front Door\",\n \"subTarget\": \"tab2\",\n \"preText\": \"Front Door\",\n \"style\": \"primary\"\n }\n ]\n },\n \"name\": \"Tabs\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## App Gateway\"\n },\n \"name\": \"tab0title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure you are using Application Gateway v2 SKU. Check [this link](https://learn.microsoft.com/azure/application-gateway/overview-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext0\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/applicationgateways' | project id, compliant = properties.sku.name in ('Standard_v2', 'WAF_v2') | project id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query0\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Your Application Gateways v2 should be deployed in subnets with IP prefixes equal or larger than /24. Check [this link](https://learn.microsoft.com/azure/application-gateway/configuration-infrastructure#size-of-the-subnet) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext2\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/applicationgateways' | extend subnetId = tostring(properties.gatewayIPConfigurations[0].properties.subnet.id) | project id, subnetId | join (resources | where type=='microsoft.network/virtualnetworks' | project id,subnets=properties.subnets | mv-expand subnets | mv-expand subnets.properties.addressPrefixes | project id, subnetId = tostring(subnets.id), prefix1 = subnets.properties.addressPrefix, prefix2 = subnets.properties.addressPrefixes | mv-expand prefix2 | extend prefix = iff(isnotnull(prefix1), prefix1, prefix2) | extend subnetPrefixLength = split(prefix, '/')[1])on subnetId | extend compliant = (subnetPrefixLength <= 24 or subnetPrefixLength == 64) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query2\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Configure autoscaling with a minimum amount of instances of two. Check [this link](https://learn.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext3\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(properties.autoscaleConfiguration) and properties.autoscaleConfiguration.minCapacity >= 2) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query3\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy Application Gateway across Availability Zones. Check [this link](https://learn.microsoft.com/azure/reliability/migrate-app-gateway-v2) for further information.. [This training](https://learn.microsoft.com/learn/paths/secure-application-delivery/) can help to educate yourself on this.\"\n },\n \"name\": \"querytext4\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type =~ 'microsoft.network/applicationGateways' | extend compliant = (isnotnull(zones) and array_length(zones) > 1) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query4\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Enable the Azure Application Gateway WAF bot protection rule set. The bot rules detect good and bad bots. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/ag/bot-protection) for further information.\"\n },\n \"name\": \"querytext10\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/applicationgatewaywebapplicationfirewallpolicies' | mv-expand properties.managedRules.managedRuleSets | project id, rulesettype = properties_managedRules_managedRuleSets.ruleSetType | extend compliant1 = (rulesettype == 'Microsoft_BotManagerRuleSet') | project id, compliant1 | summarize compliant = max(compliant1) by id | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query10\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy your WAF policy for Application Gateway in 'Prevention' mode. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information.\"\n },\n \"name\": \"querytext11\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query11\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab0\"\n },\n \"name\": \"tab0\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Load Balancer\"\n },\n \"name\": \"tab1title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Ensure you are using the Standard SKU for your Azure Load Balancers. Check [this link](https://learn.microsoft.com/azure/load-balancer/load-balancer-overview) for further information.\"\n },\n \"name\": \"querytext1\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/loadbalancers' | project id, compliant=(tolower(sku.name) == 'standard') | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query1\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use Azure NAT Gateway instead of Load Balancer outbound rules for better SNAT scalability. Check [this link](https://learn.microsoft.com/azure/nat-gateway/nat-overview#outbound-connectivity) for further information.\"\n },\n \"name\": \"querytext8\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type=='microsoft.network/loadbalancers' | extend countOutRules=array_length(properties.outboundRules) | extend compliant = (countOutRules == 0) | distinct id,compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query8\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab1\"\n },\n \"name\": \"tab1\"\n },\n {\n \"type\": 12,\n \"content\": {\n \"version\": \"NotebookGroup/1.0\",\n \"groupType\": \"editable\",\n \"items\": [\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"## Front Door\"\n },\n \"name\": \"tab2title\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Deploy your WAF policy for Front Door in 'Prevention' mode' so that Web Application Firewall takes appropriate action to allow or deny traffic. Check [this link](https://learn.microsoft.com/azure/web-application-firewall/afds/waf-front-door-policy-settings) for further information.\"\n },\n \"name\": \"querytext5\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"resources | where type == 'microsoft.network/frontdoorwebapplicationfirewallpolicies' | project policyName=name, policyId=id,policySku=sku.name, links=properties.securityPolicyLinks, enabledState=properties.policySettings.enabledState, mode=properties.policySettings.mode | mvexpand links | extend securityPolicy=links.id | extend securityPolicyParts=split(securityPolicy, '/') | extend profileId=strcat_array(array_slice(securityPolicyParts, 0, -3), '/') | project id=profileId, compliant=((enabledState=='Enabled') and (mode=='Prevention')), enabledState, mode | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query5\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Disable health probes when there is only one origin in an Azure Front Door origin group. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#disable-health-probes-when-theres-only-one-origin-in-an-origin-group) for further information.\"\n },\n \"name\": \"querytext6\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups/origins' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups')) | extend originGroupId = substring(id, 0, indexof(id, '/origins')) | join kind=inner (cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend originGroupName = name | extend hasHealthProbe = isnotnull(properties.healthProbeSettings)) on $left.originGroupId == $right.id | summarize numberOrigins = count() by originGroupId, subscriptionId, frontDoorId, hasHealthProbe, originGroupName | extend compliant = not(numberOrigins == 1 and hasHealthProbe) | project id = frontDoorId, compliant | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query6\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use HEAD health probes with Azure Front Door, to reduce the traffic that Front Door sends to your application. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-head-health-probes) for further information.\"\n },\n \"name\": \"querytext7\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/origingroups' | extend frontDoorId = substring(id, 0, indexof(id, '/origingroups/')) | extend compliant = (isnull(properties['healthProbeSettings']['probeRequestType']) or toupper(properties['healthProbeSettings']['probeRequestType']) == 'HEAD') | project compliant, id=frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query7\"\n },\n {\n \"type\": 1,\n \"content\": {\n \"json\": \"Use managed TLS certificates with Azure Front Door. Reduce operational cost and risk of outages due to certificate renewals. Check [this link](https://learn.microsoft.com/azure/frontdoor/best-practices#use-managed-tls-certificates) for further information.\"\n },\n \"name\": \"querytext9\"\n },\n {\n \"type\": 3,\n \"content\": {\n \"version\": \"KqlItem/1.0\",\n \"query\": \"cdnresources | where type =~ 'microsoft.cdn/profiles/customdomains' | extend frontDoorId = substring(id, 0, indexof(id, '/customdomains')) | extend compliant = (isnull(properties['tlsSettings']['certificateType']) or tolower(properties['tlsSettings']['certificateType']) =~ 'customercertificate') | project compliant, id = frontDoorId | extend onlyFailed = {OnlyFailed:label} | where compliant == 0 or not (onlyFailed == 1) | project-away onlyFailed\",\n \"size\": 4,\n \"queryType\": 1,\n \"resourceType\": \"microsoft.resourcegraph/resources\",\n \"crossComponentResources\": [\n \"{Subscription}\"\n ],\n \"gridSettings\": {\n \"formatters\": [\n {\n \"columnMatch\": \"id\",\n \"formatter\": 0,\n \"numberFormat\": {\n \"unit\": 0,\n \"options\": {\n \"style\": \"decimal\"\n }\n }\n },\n {\n \"columnMatch\": \"compliant\",\n \"formatter\": 18,\n \"formatOptions\": {\n \"thresholdsOptions\": \"icons\",\n \"thresholdsGrid\": [\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"1\",\n \"representation\": \"success\",\n \"text\": \"Success\"\n },\n {\n \"operator\": \"==\",\n \"thresholdValue\": \"0\",\n \"representation\": \"failed\",\n \"text\": \"Failed\"\n },\n {\n \"operator\": \"Default\",\n \"thresholdValue\": null,\n \"representation\": \"unknown\",\n \"text\": \"Unknown\"\n }\n ]\n }\n }\n ]\n }\n },\n \"name\": \"query9\"\n }\n ]\n },\n \"conditionalVisibility\": {\n \"parameterName\": \"VisibleTab\",\n \"comparison\": \"isEqualTo\",\n \"value\": \"tab2\"\n },\n \"name\": \"tab2\"\n }\n ],\n \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"\n}", "version": "1.0", "sourceId": "[parameters('workbookSourceId')]", "category": "[parameters('workbookType')]"