From 8bcf3b71428be426adc028c6a987f2eaf0e1625d Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Fri, 22 May 2026 10:34:32 +0200 Subject: [PATCH 01/21] Fix logo file. The logo was not showing in Firefox because it had embedded base64 encoded PNG data that was formatted with whitespace that isn't strictly allowed. Replaced with an actual vector version of the logo. --- packages/wiz/img/wiz-logo.svg | 99 +++-------------------------------- 1 file changed, 6 insertions(+), 93 deletions(-) diff --git a/packages/wiz/img/wiz-logo.svg b/packages/wiz/img/wiz-logo.svg index fdb4edb168b..8b11aff8a6f 100644 --- a/packages/wiz/img/wiz-logo.svg +++ b/packages/wiz/img/wiz-logo.svg @@ -1,94 +1,7 @@ - - - + + Wiz logo + + + + From 33acc296d731ebde577b1f0ed5d88f04962ac756 Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Fri, 22 May 2026 11:45:48 +0200 Subject: [PATCH 02/21] Set the right User-Agent header. This is a workaround for https://github.com/elastic/beats/issues/50867. --- .../wiz/data_stream/audit/agent/stream/cel.yml.hbs | 11 ++++++++--- .../agent/stream/cel.yml.hbs | 11 ++++++++--- .../agent/stream/cel.yml.hbs | 11 ++++++++--- .../wiz/data_stream/issue/agent/stream/cel.yml.hbs | 11 ++++++++--- .../vulnerability/agent/stream/cel.yml.hbs | 11 ++++++++--- 5 files changed, 40 insertions(+), 15 deletions(-) diff --git a/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs index d7ae779c360..c1593ef51db 100644 --- a/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs @@ -59,9 +59,9 @@ max_executions: {{max_executions}} {{/if}} program: | state.with( - post_request( + request( + "POST", state.url.trim_right("/") + "/graphql", - "application/json", { "query": state.query, "variables": { @@ -77,7 +77,12 @@ program: | } } }.encode_json() - ).do_request().as(resp, resp.StatusCode == 200 ? + ).with({ + "Header": { + "Content-Type": ["application/json"], + "User-Agent": [useragent], + }, + }).do_request().as(resp, resp.StatusCode == 200 ? bytes(resp.Body).decode_json().as(body, body.?data.auditLogEntries.nodes.orValue(null) != null ? { "events": body.data.auditLogEntries.nodes.map(e, { diff --git a/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs index e60b63f25df..792812f2c42 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs @@ -80,9 +80,9 @@ max_executions: {{max_executions}} {{/if}} program: | state.with( - post_request( + request( + "POST", state.url.trim_right("/") + "/graphql", - "application/json", { "query": state.query, "variables": { @@ -98,7 +98,12 @@ program: | } } }.encode_json() - ).do_request().as(resp, resp.StatusCode == 200 ? + ).with({ + "Header": { + "Content-Type": ["application/json"], + "User-Agent": [useragent], + }, + }).do_request().as(resp, resp.StatusCode == 200 ? bytes(resp.Body).decode_json().as(body, body.?data.configurationFindings.nodes.orValue(null) != null ? { "events": body.data.configurationFindings.nodes.map(e, { diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs index dafec9f5756..8a37241f280 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs @@ -81,9 +81,9 @@ max_executions: {{max_executions}} {{/if}} program: | state.with( - post_request( + request( + "POST", state.url.trim_right("/") + "/graphql", - "application/json", { "query": state.query, "variables": { @@ -95,7 +95,12 @@ program: | } } }.encode_json() - ).do_request().as(resp, resp.StatusCode == 200 ? + ).with({ + "Header": { + "Content-Type": ["application/json"], + "User-Agent": [useragent], + }, + }).do_request().as(resp, resp.StatusCode == 200 ? resp.Body.decode_json().as(body, body.?data.configurationFindings.nodes.orValue(null) != null ? { "events": body.data.configurationFindings.nodes.map(e, { diff --git a/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs index 42afdc8944b..f54b8135198 100644 --- a/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs @@ -148,9 +148,9 @@ max_executions: {{max_executions}} {{/if}} program: | state.with( - post_request( + request( + "POST", state.url.trim_right("/") + "/graphql", - "application/json", { "query": state.query, "variables": { @@ -166,7 +166,12 @@ program: | } } }.encode_json() - ).do_request().as(resp, resp.StatusCode == 200 ? + ).with({ + "Header": { + "Content-Type": ["application/json"], + "User-Agent": [useragent], + }, + }).do_request().as(resp, resp.StatusCode == 200 ? bytes(resp.Body).decode_json().as(body, body.?data.issues.nodes.orValue(null) != null ? { "events": body.data.issues.nodes.map(e, { diff --git a/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs index 02420c62ff5..065b3442ee6 100644 --- a/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs @@ -138,9 +138,9 @@ max_executions: {{max_executions}} {{/if}} program: | state.with( - post_request( + request( + "POST", state.url.trim_right("/") + "/graphql", - "application/json", { "query": state.query, "variables": { @@ -157,7 +157,12 @@ program: | } } }.encode_json() - ).do_request().as(resp, resp.StatusCode == 200 ? + ).with({ + "Header": { + "Content-Type": ["application/json"], + "User-Agent": [useragent], + }, + }).do_request().as(resp, resp.StatusCode == 200 ? bytes(resp.Body).decode_json().as(body, body.?data.vulnerabilityFindings.nodes.orValue(null) != null ? { "events": body.data.vulnerabilityFindings.nodes.map(e, { From df492e17e3dedea6b78f02e738cfd78d24e3518d Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Fri, 22 May 2026 12:07:40 +0200 Subject: [PATCH 03/21] Don't use the demo env URL as a default value. --- packages/wiz/manifest.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/packages/wiz/manifest.yml b/packages/wiz/manifest.yml index 7bfd133924a..9b4f52afd47 100644 --- a/packages/wiz/manifest.yml +++ b/packages/wiz/manifest.yml @@ -87,8 +87,7 @@ policy_templates: - name: url type: text title: URL - description: Base URL of the Wiz API. Default URL given is for the demo environment. - default: https://api.us17.app.wiz.io + description: Base URL of your tenant-specific Wiz API endpoint, for example `https://api.somedc.app.wiz.io`. required: true show_user: true - name: token_url From 621ef5397767ec836b49e2499aa6ee58315a002d Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Fri, 22 May 2026 14:46:43 +0200 Subject: [PATCH 04/21] Make cloud_configuration_finding_full_posture's 24h interval configurable as an advanced options. May be helpful for debugging or workarounds. --- .../_dev/test/policy/test-default.expected | 163 ++++++++++++++++++ .../_dev/test/policy/test-default.yml | 6 + .../agent/stream/cel.yml.hbs | 2 +- .../manifest.yml | 8 + 4 files changed, 178 insertions(+), 1 deletion(-) create mode 100644 packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected create mode 100644 packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.yml diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected new file mode 100644 index 00000000000..94ab5ccba53 --- /dev/null +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected @@ -0,0 +1,163 @@ +inputs: + - data_stream: + namespace: ep + meta: + package: + name: wiz + name: test-default-wiz + streams: + - auth.oauth2: + client.id: test-client-id + client.secret: ${SECRET_0} + endpoint_params: + audience: wiz-api + grant_type: client_credentials + token_url: https://auth.app.wiz.io/oauth/token + config_version: 2 + data_stream: + dataset: wiz.cloud_configuration_finding_full_posture + interval: 24h + max_executions: 1000 + program: | + state.with( + request( + "POST", + state.url.trim_right("/") + "/graphql", + { + "query": state.query, + "variables": { + "first": state.batch_size, + "after": state.?end_cursor.value.orValue(null), + "filterBy": { + "includeDeleted": false, + "status": ["OPEN", "RESOLVED"] + } + } + }.encode_json() + ).with({ + "Header": { + "Content-Type": ["application/json"], + "User-Agent": [useragent], + }, + }).do_request().as(resp, resp.StatusCode == 200 ? + resp.Body.decode_json().as(body, body.?data.configurationFindings.nodes.orValue(null) != null ? + { + "events": body.data.configurationFindings.nodes.map(e, { + "message": e.encode_json(), + }), + "end_cursor": { + ?"value": body.?data.configurationFindings.pageInfo.hasNextPage.orValue(false) ? + body.?data.configurationFindings.pageInfo.endCursor + : + optional.none() + }, + "want_more": body.?data.configurationFindings.pageInfo.hasNextPage.orValue(false), + } + : + { + "events": [], + "want_more": false, + } + ) + : + { + "events": { + "error": { + "code": string(resp.StatusCode), + "id": string(resp.Status), + "message": "POST " + state.url.trim_right("/") + "/graphql:" + ( + size(resp.Body) != 0 ? + string(resp.Body) + : + string(resp.Status) + ' (' + string(resp.StatusCode) + ')' + ), + }, + }, + "want_more": false, + } + ) + ) + publisher_pipeline.disable_host: true + redact: + fields: null + resource.ssl: null + resource.timeout: 30s + resource.tracer: + enabled: false + filename: ../../logs/cel/http-request-trace-*.ndjson + maxbackups: 5 + resource.url: https://api.example.app.wiz.io + state: + batch_size: 500 + query: |- + query CloudConfigurationFindingsPage($filterBy: ConfigurationFindingFilters $first: Int $after: String $orderBy: ConfigurationFindingOrder){ + configurationFindings(filterBy: $filterBy first: $first after: $after orderBy: $orderBy) { + nodes { + id + name + analyzedAt + severity + result + remediation + status + resource { + id + providerId + name + nativeType + type + region + cloudPlatform + subscription { + id + name + externalId + cloudProvider + } + tags { + key + value + } + } + rule { + id + shortId + name + description + remediationInstructions + } + evidence { + currentValue + expectedValue + configurationPath + cloudConfigurationLink + } + } + pageInfo { + hasNextPage + endCursor + } + } + } + want_more: false + tags: + - forwarded + - wiz-cloud_configuration_finding_full_posture + type: cel + use_output: default +output_permissions: + default: + _elastic_agent_checks: + cluster: + - monitor + _elastic_agent_monitoring: + indices: [] + uuid-for-permissions-on-related-indices: + indices: + - names: + - logs-wiz.cloud_configuration_finding_full_posture-ep + privileges: + - auto_configure + - create_doc +secret_references: + - {} diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.yml b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.yml new file mode 100644 index 00000000000..32177fa3c26 --- /dev/null +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.yml @@ -0,0 +1,6 @@ +vars: + client_id: test-client-id + client_secret: test-client-secret + url: https://api.example.app.wiz.io +data_stream: + vars: diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs index 8a37241f280..919b208cee6 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs @@ -1,5 +1,5 @@ config_version: 2 -interval: 24h +interval: {{interval}} resource.tracer: enabled: {{enable_request_tracer}} filename: "../../logs/cel/http-request-trace-*.ndjson" diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/manifest.yml b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/manifest.yml index ac266f2a48a..714abe7f01f 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/manifest.yml +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/manifest.yml @@ -78,3 +78,11 @@ streams: description: >- Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: interval + type: text + title: Interval + description: Do not modify. The duration between runs of full posture synchronization. + multi: false + required: true + show_user: false + default: 24h From 7bfabfeb69c5b34a30578f98b798f1fe17214e03 Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Fri, 22 May 2026 15:06:12 +0200 Subject: [PATCH 05/21] Use updatedAt rather than analyzedAt in queries for cloud configuration finding data. The `analyzedAt` field remains and is mapped in the same way, but the `updatedAt` field is added and that's what's used for query filtering, as recommended by Wiz. --- .../config-cloud_configuration_finding.yml | 4 +- ...oud_configuration_finding_full_posture.yml | 2 + .../test-cloud-configuration-finding.log | 14 +++---- ...ud-configuration-finding.log-expected.json | 35 +++++++++------- .../agent/stream/cel.yml.hbs | 5 ++- .../elasticsearch/ingest_pipeline/default.yml | 11 +++++ .../fields/fields.yml | 2 + .../sample_event.json | 3 +- ...oud-configuration-finding-full-posture.log | 14 +++---- ...ion-finding-full-posture.log-expected.json | 42 ++++++++++++------- .../_dev/test/policy/test-default.expected | 1 + .../agent/stream/cel.yml.hbs | 1 + .../elasticsearch/ingest_pipeline/default.yml | 11 +++++ .../fields/fields.yml | 2 + .../sample_event.json | 3 +- packages/wiz/docs/README.md | 8 +++- .../fields/fields.yml | 2 + 17 files changed, 110 insertions(+), 50 deletions(-) diff --git a/packages/wiz/_dev/deploy/docker/files/config-cloud_configuration_finding.yml b/packages/wiz/_dev/deploy/docker/files/config-cloud_configuration_finding.yml index 008793fc332..7bc869f03bf 100644 --- a/packages/wiz/_dev/deploy/docker/files/config-cloud_configuration_finding.yml +++ b/packages/wiz/_dev/deploy/docker/files/config-cloud_configuration_finding.yml @@ -20,7 +20,7 @@ rules: Content-Type: - application/json body: | - {"data": {"configurationFindings": {"nodes": [{"analyzedAt":"2024-08-07T12:55:52.012378Z","id":"1243196d-a365-589a-a8aa-13817c9877b2","remediation":null,"resource":{"id":"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea","name":"Root user","nativeType":"rootUser","providerId":"arn:aws:iam::998231069301:root","region":null,"cloudPlatform":"EKS","subscription":{"cloudProvider":"AWS","externalId":"998231069301","id":"94e76baa-85fd-5928-b829-1669a2ca9660","name":"wiz-integrations"},"tags":[],"type":"USER_ACCOUNT"},"result":"PASS","rule":{"description":"This rule checks if the AWS Root Account has access keys. \nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\n>**Note** \nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.","id":"563ed717-4fb6-47fd-929e-9c794e201d0a","name":"Root account access keys should not exist","remediationInstructions":"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \n1. Use the following command to list the Root user's access keys. \nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \n```\naws iam list-access-keys\n```\n2. Use the following command to delete the access key(s). \n```\naws iam delete-access-key /\n --access-key-id \n```\n>**Note** \nOnce an access key is removed, any application using it will not work until a new one is configured for it.","shortId":"IAM-006"},"severity":"MEDIUM"}],"pageInfo": {"hasNextPage": true,"endCursor": "eyJmaWVsZHMiOlt7IkZpZWxkIjoiVGltZXN0YW1wIiwiVmFsdWUiOiIyMDIzLTA5LTA0VDExOjE5OjM3LjgwMTU0MVoifV19"}}}} + {"data": {"configurationFindings": {"nodes": [{"analyzedAt":"2024-08-07T12:55:52.012378Z","updatedAt":"2024-08-07T12:55:52.012378Z","id":"1243196d-a365-589a-a8aa-13817c9877b2","remediation":null,"resource":{"id":"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea","name":"Root user","nativeType":"rootUser","providerId":"arn:aws:iam::998231069301:root","region":null,"cloudPlatform":"EKS","subscription":{"cloudProvider":"AWS","externalId":"998231069301","id":"94e76baa-85fd-5928-b829-1669a2ca9660","name":"wiz-integrations"},"tags":[],"type":"USER_ACCOUNT"},"result":"PASS","rule":{"description":"This rule checks if the AWS Root Account has access keys. \nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\n>**Note** \nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.","id":"563ed717-4fb6-47fd-929e-9c794e201d0a","name":"Root account access keys should not exist","remediationInstructions":"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \n1. Use the following command to list the Root user's access keys. \nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \n```\naws iam list-access-keys\n```\n2. Use the following command to delete the access key(s). \n```\naws iam delete-access-key /\n --access-key-id \n```\n>**Note** \nOnce an access key is removed, any application using it will not work until a new one is configured for it.","shortId":"IAM-006"},"severity":"MEDIUM"}],"pageInfo": {"hasNextPage": true,"endCursor": "eyJmaWVsZHMiOlt7IkZpZWxkIjoiVGltZXN0YW1wIiwiVmFsdWUiOiIyMDIzLTA5LTA0VDExOjE5OjM3LjgwMTU0MVoifV19"}}}} - path: /graphql methods: ['POST'] request_headers: @@ -33,4 +33,4 @@ rules: Content-Type: - application/json body: |- - {"data": {"configurationFindings": {"nodes": [{"analyzedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-vm","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"PASS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate\n```","shortId":"VirtualMachines-021"},"severity":"LOW","evidence":{"cloudConfigurationLink":"https://learn.microsoft.com/en-us/azure/virtual-machines/states-billing","configurationPath":null,"currentValue":"The VM is stopped(allocated) since 2024-08-15","expectedValue":"The VM should be used or deallocated"}}],"pageInfo": {"hasNextPage": false,"endCursor": "eMJmaWVsZIkZpZWxkIjoiVGltZXN0YW1wIiwiVmFsdWUiOiIyMDIzLTA5LTA0VDExOjE5OjM3LjgwMTU0MVoifV19"}}}} + {"data": {"configurationFindings": {"nodes": [{"analyzedAt":"2024-08-15T11:41:17.517926Z","updatedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-vm","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"PASS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate\n```","shortId":"VirtualMachines-021"},"severity":"LOW","evidence":{"cloudConfigurationLink":"https://learn.microsoft.com/en-us/azure/virtual-machines/states-billing","configurationPath":null,"currentValue":"The VM is stopped(allocated) since 2024-08-15","expectedValue":"The VM should be used or deallocated"}}],"pageInfo": {"hasNextPage": false,"endCursor": "eMJmaWVsZIkZpZWxkIjoiVGltZXN0YW1wIiwiVmFsdWUiOiIyMDIzLTA5LTA0VDExOjE5OjM3LjgwMTU0MVoifV19"}}}} diff --git a/packages/wiz/_dev/deploy/docker/files/config-cloud_configuration_finding_full_posture.yml b/packages/wiz/_dev/deploy/docker/files/config-cloud_configuration_finding_full_posture.yml index 12d25aaf9e0..f30f175a35d 100644 --- a/packages/wiz/_dev/deploy/docker/files/config-cloud_configuration_finding_full_posture.yml +++ b/packages/wiz/_dev/deploy/docker/files/config-cloud_configuration_finding_full_posture.yml @@ -27,6 +27,7 @@ rules: "nodes": [ { "analyzedAt": "2024-08-07T12:55:52.012378Z", + "updatedAt": "2024-08-07T12:55:52.012378Z", "id": "1243196d-a365-589a-a8aa-13817c9877b2", "remediation": null, "resource": { @@ -83,6 +84,7 @@ rules: "nodes": [ { "analyzedAt": "2024-08-15T11:41:17.517926Z", + "updatedAt": "2024-08-15T11:41:17.517926Z", "id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae", "remediation": null, "resource": { diff --git a/packages/wiz/data_stream/cloud_configuration_finding/_dev/test/pipeline/test-cloud-configuration-finding.log b/packages/wiz/data_stream/cloud_configuration_finding/_dev/test/pipeline/test-cloud-configuration-finding.log index 28c8516df89..4271fd05649 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/_dev/test/pipeline/test-cloud-configuration-finding.log +++ b/packages/wiz/data_stream/cloud_configuration_finding/_dev/test/pipeline/test-cloud-configuration-finding.log @@ -1,7 +1,7 @@ -{"id":"bdeba988-f41b-55e6-9b99-96b8d3dc67d4","targetExternalId":"k8s/pod/da99fd668e64c2def251b1d48b7b69ad3129638787a0f9144a993fe30fd4554f/default/cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx","targetObjectProviderUniqueId":"cd971d74-92db-495c-8244-82da9a988fd0","firstSeenAt":"2023-06-12T11:38:07.900129Z","analyzedAt":"2023-06-12T11:38:07.900129Z","severity":"LOW","result":"FAIL","status":"OPEN","remediation":"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n","resource":{"id":"0e814bb7-29e8-5c15-be9c-8da42c67ee99","providerId":"provider-id-0e814bb7-29e8-5c15-be9c-8da42c67ee99","name":"cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx","nativeType":"Pod","type":"POD","region":null,"subscription":{"id":"a3a3cc43-1dfd-50f1-882e-692840d4a891","name":"Wiz - DEV Outpost","externalId":"cfd132be-3bc7-4f86-8efd-ed53ae498fec","cloudProvider":"Azure"},"projects":null,"tags":[{"key":"pod-template-hash","value":"8bc677d64"},{"key":"app.kubernetes.io/name","value":"azure-cluster-autoscaler"},{"key":"app.kubernetes.io/instance","value":"cluster-autoscaler"}]},"rule":{"id":"73553de7-f2ad-4ffb-b425-c69815033530","shortId":"Pod-32","graphId":"99ffeef7-75df-5c88-9265-5ab50ffbc2b9","name":"Pod should run containers with authorized additional capabilities (PSS Restricted)","description":"This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). \nThis rule checks whether the pod is running containers with authorized additional capabilities. \nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`. \nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass. \nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.","remediationInstructions":"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n","functionAsControl":false},"securitySubCategories":[{"id":"wsct-id-5206","title":"Container Security","category":{"id":"wct-id-423","name":"9 Container Security","framework":{"id":"wf-id-1","name":"Wiz"}}},{"id":"wsct-id-8176","title":"5.1 Containers should not run with additional capabilities","category":{"id":"wct-id-1295","name":"5 Capabilities","framework":{"id":"wf-id-57","name":"Kubernetes Pod Security Standards (Restricted)"}}},{"id":"wsct-id-8344","title":"Cluster misconfiguration","category":{"id":"wct-id-1169","name":"2 Container & Kubernetes Security","framework":{"id":"wf-id-53","name":"Wiz Detailed"}}}]} -{"analyzedAt":"2024-08-07T12:55:52.012378Z","id":"1243196d-a365-589a-a8aa-13817c9877b2","remediation":null,"resource":{"id":"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea","name":"Root user","nativeType":"rootUser","providerId":"arn:aws:iam::998231069301:root","region":null,"cloudPlatform":"EKS","subscription":{"cloudProvider":"AWS","externalId":"998231069301","id":"94e76baa-85fd-5928-b829-1669a2ca9660","name":"wiz-integrations"},"tags":[],"type":"USER_ACCOUNT"},"result":"PASS","rule":{"description":"This rule checks if the AWS Root Account has access keys. \nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\n>**Note** \nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.","id":"563ed717-4fb6-47fd-929e-9c794e201d0a","name":"Root account access keys should not exist","remediationInstructions":"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \n1. Use the following command to list the Root user's access keys. \nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \n```\naws iam list-access-keys\n```\n2. Use the following command to delete the access key(s). \n```\naws iam delete-access-key /\n --access-key-id \n```\n>**Note** \nOnce an access key is removed, any application using it will not work until a new one is configured for it.","shortId":"IAM-006"},"severity":"MEDIUM"} -{"analyzedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-vm","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"PASS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW","evidence":{"cloudConfigurationLink":"https://learn.microsoft.com/en-us/azure/virtual-machines/states-billing","configurationPath":null,"currentValue":"The VM is stopped(allocated) since 2024-08-15","expectedValue":"The VM should be used or deallocated"}} -{"analyzedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} -{"analyzedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} -{"analyzedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae-empty-provider-id","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} -{"analyzedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae-missing-provider-id","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} \ No newline at end of file +{"id":"bdeba988-f41b-55e6-9b99-96b8d3dc67d4","targetExternalId":"k8s/pod/da99fd668e64c2def251b1d48b7b69ad3129638787a0f9144a993fe30fd4554f/default/cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx","targetObjectProviderUniqueId":"cd971d74-92db-495c-8244-82da9a988fd0","firstSeenAt":"2023-06-12T11:38:07.900129Z","analyzedAt":"2023-06-12T11:38:07.900129Z","updatedAt":"2023-06-12T11:38:07.900129Z","severity":"LOW","result":"FAIL","status":"OPEN","remediation":"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n","resource":{"id":"0e814bb7-29e8-5c15-be9c-8da42c67ee99","providerId":"provider-id-0e814bb7-29e8-5c15-be9c-8da42c67ee99","name":"cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx","nativeType":"Pod","type":"POD","region":null,"subscription":{"id":"a3a3cc43-1dfd-50f1-882e-692840d4a891","name":"Wiz - DEV Outpost","externalId":"cfd132be-3bc7-4f86-8efd-ed53ae498fec","cloudProvider":"Azure"},"projects":null,"tags":[{"key":"pod-template-hash","value":"8bc677d64"},{"key":"app.kubernetes.io/name","value":"azure-cluster-autoscaler"},{"key":"app.kubernetes.io/instance","value":"cluster-autoscaler"}]},"rule":{"id":"73553de7-f2ad-4ffb-b425-c69815033530","shortId":"Pod-32","graphId":"99ffeef7-75df-5c88-9265-5ab50ffbc2b9","name":"Pod should run containers with authorized additional capabilities (PSS Restricted)","description":"This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). \nThis rule checks whether the pod is running containers with authorized additional capabilities. \nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`. \nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass. \nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.","remediationInstructions":"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n","functionAsControl":false},"securitySubCategories":[{"id":"wsct-id-5206","title":"Container Security","category":{"id":"wct-id-423","name":"9 Container Security","framework":{"id":"wf-id-1","name":"Wiz"}}},{"id":"wsct-id-8176","title":"5.1 Containers should not run with additional capabilities","category":{"id":"wct-id-1295","name":"5 Capabilities","framework":{"id":"wf-id-57","name":"Kubernetes Pod Security Standards (Restricted)"}}},{"id":"wsct-id-8344","title":"Cluster misconfiguration","category":{"id":"wct-id-1169","name":"2 Container & Kubernetes Security","framework":{"id":"wf-id-53","name":"Wiz Detailed"}}}]} +{"analyzedAt":"2024-08-07T12:55:52.012378Z","updatedAt":"2024-08-07T12:55:52.012378Z","id":"1243196d-a365-589a-a8aa-13817c9877b2","remediation":null,"resource":{"id":"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea","name":"Root user","nativeType":"rootUser","providerId":"arn:aws:iam::998231069301:root","region":null,"cloudPlatform":"EKS","subscription":{"cloudProvider":"AWS","externalId":"998231069301","id":"94e76baa-85fd-5928-b829-1669a2ca9660","name":"wiz-integrations"},"tags":[],"type":"USER_ACCOUNT"},"result":"PASS","rule":{"description":"This rule checks if the AWS Root Account has access keys. \nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\n>**Note** \nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.","id":"563ed717-4fb6-47fd-929e-9c794e201d0a","name":"Root account access keys should not exist","remediationInstructions":"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \n1. Use the following command to list the Root user's access keys. \nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \n```\naws iam list-access-keys\n```\n2. Use the following command to delete the access key(s). \n```\naws iam delete-access-key /\n --access-key-id \n```\n>**Note** \nOnce an access key is removed, any application using it will not work until a new one is configured for it.","shortId":"IAM-006"},"severity":"MEDIUM"} +{"analyzedAt":"2024-08-15T11:41:17.517926Z","updatedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-vm","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"PASS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW","evidence":{"cloudConfigurationLink":"https://learn.microsoft.com/en-us/azure/virtual-machines/states-billing","configurationPath":null,"currentValue":"The VM is stopped(allocated) since 2024-08-15","expectedValue":"The VM should be used or deallocated"}} +{"analyzedAt":"2024-08-15T11:41:17.517926Z","updatedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} +{"analyzedAt":"2024-08-15T11:41:17.517926Z","updatedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} +{"analyzedAt":"2024-08-15T11:41:17.517926Z","updatedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae-empty-provider-id","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} +{"analyzedAt":"2024-08-15T11:41:17.517926Z","updatedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae-missing-provider-id","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} diff --git a/packages/wiz/data_stream/cloud_configuration_finding/_dev/test/pipeline/test-cloud-configuration-finding.log-expected.json b/packages/wiz/data_stream/cloud_configuration_finding/_dev/test/pipeline/test-cloud-configuration-finding.log-expected.json index 301044ecb3b..1f7501ddf50 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/_dev/test/pipeline/test-cloud-configuration-finding.log-expected.json +++ b/packages/wiz/data_stream/cloud_configuration_finding/_dev/test/pipeline/test-cloud-configuration-finding.log-expected.json @@ -19,7 +19,7 @@ "created": "2023-06-12T11:38:07.900Z", "id": "bdeba988-f41b-55e6-9b99-96b8d3dc67d4", "kind": "state", - "original": "{\"id\":\"bdeba988-f41b-55e6-9b99-96b8d3dc67d4\",\"targetExternalId\":\"k8s/pod/da99fd668e64c2def251b1d48b7b69ad3129638787a0f9144a993fe30fd4554f/default/cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx\",\"targetObjectProviderUniqueId\":\"cd971d74-92db-495c-8244-82da9a988fd0\",\"firstSeenAt\":\"2023-06-12T11:38:07.900129Z\",\"analyzedAt\":\"2023-06-12T11:38:07.900129Z\",\"severity\":\"LOW\",\"result\":\"FAIL\",\"status\":\"OPEN\",\"remediation\":\"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \\r\\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \\r\\n* `securityContext.capabilities.drop` key is set to `ALL`. \\r\\n\",\"resource\":{\"id\":\"0e814bb7-29e8-5c15-be9c-8da42c67ee99\",\"providerId\":\"provider-id-0e814bb7-29e8-5c15-be9c-8da42c67ee99\",\"name\":\"cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx\",\"nativeType\":\"Pod\",\"type\":\"POD\",\"region\":null,\"subscription\":{\"id\":\"a3a3cc43-1dfd-50f1-882e-692840d4a891\",\"name\":\"Wiz - DEV Outpost\",\"externalId\":\"cfd132be-3bc7-4f86-8efd-ed53ae498fec\",\"cloudProvider\":\"Azure\"},\"projects\":null,\"tags\":[{\"key\":\"pod-template-hash\",\"value\":\"8bc677d64\"},{\"key\":\"app.kubernetes.io/name\",\"value\":\"azure-cluster-autoscaler\"},{\"key\":\"app.kubernetes.io/instance\",\"value\":\"cluster-autoscaler\"}]},\"rule\":{\"id\":\"73553de7-f2ad-4ffb-b425-c69815033530\",\"shortId\":\"Pod-32\",\"graphId\":\"99ffeef7-75df-5c88-9265-5ab50ffbc2b9\",\"name\":\"Pod should run containers with authorized additional capabilities (PSS Restricted)\",\"description\":\"This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). \\nThis rule checks whether the pod is running containers with authorized additional capabilities. \\nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`. \\nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass. \\nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.\",\"remediationInstructions\":\"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \\r\\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \\r\\n* `securityContext.capabilities.drop` key is set to `ALL`. \\r\\n\",\"functionAsControl\":false},\"securitySubCategories\":[{\"id\":\"wsct-id-5206\",\"title\":\"Container Security\",\"category\":{\"id\":\"wct-id-423\",\"name\":\"9 Container Security\",\"framework\":{\"id\":\"wf-id-1\",\"name\":\"Wiz\"}}},{\"id\":\"wsct-id-8176\",\"title\":\"5.1 Containers should not run with additional capabilities\",\"category\":{\"id\":\"wct-id-1295\",\"name\":\"5 Capabilities\",\"framework\":{\"id\":\"wf-id-57\",\"name\":\"Kubernetes Pod Security Standards (Restricted)\"}}},{\"id\":\"wsct-id-8344\",\"title\":\"Cluster misconfiguration\",\"category\":{\"id\":\"wct-id-1169\",\"name\":\"2 Container & Kubernetes Security\",\"framework\":{\"id\":\"wf-id-53\",\"name\":\"Wiz Detailed\"}}}]}", + "original": "{\"id\":\"bdeba988-f41b-55e6-9b99-96b8d3dc67d4\",\"targetExternalId\":\"k8s/pod/da99fd668e64c2def251b1d48b7b69ad3129638787a0f9144a993fe30fd4554f/default/cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx\",\"targetObjectProviderUniqueId\":\"cd971d74-92db-495c-8244-82da9a988fd0\",\"firstSeenAt\":\"2023-06-12T11:38:07.900129Z\",\"analyzedAt\":\"2023-06-12T11:38:07.900129Z\",\"updatedAt\":\"2023-06-12T11:38:07.900129Z\",\"severity\":\"LOW\",\"result\":\"FAIL\",\"status\":\"OPEN\",\"remediation\":\"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \\r\\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \\r\\n* `securityContext.capabilities.drop` key is set to `ALL`. \\r\\n\",\"resource\":{\"id\":\"0e814bb7-29e8-5c15-be9c-8da42c67ee99\",\"providerId\":\"provider-id-0e814bb7-29e8-5c15-be9c-8da42c67ee99\",\"name\":\"cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx\",\"nativeType\":\"Pod\",\"type\":\"POD\",\"region\":null,\"subscription\":{\"id\":\"a3a3cc43-1dfd-50f1-882e-692840d4a891\",\"name\":\"Wiz - DEV Outpost\",\"externalId\":\"cfd132be-3bc7-4f86-8efd-ed53ae498fec\",\"cloudProvider\":\"Azure\"},\"projects\":null,\"tags\":[{\"key\":\"pod-template-hash\",\"value\":\"8bc677d64\"},{\"key\":\"app.kubernetes.io/name\",\"value\":\"azure-cluster-autoscaler\"},{\"key\":\"app.kubernetes.io/instance\",\"value\":\"cluster-autoscaler\"}]},\"rule\":{\"id\":\"73553de7-f2ad-4ffb-b425-c69815033530\",\"shortId\":\"Pod-32\",\"graphId\":\"99ffeef7-75df-5c88-9265-5ab50ffbc2b9\",\"name\":\"Pod should run containers with authorized additional capabilities (PSS Restricted)\",\"description\":\"This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). \\nThis rule checks whether the pod is running containers with authorized additional capabilities. \\nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`. \\nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass. \\nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.\",\"remediationInstructions\":\"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \\r\\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \\r\\n* `securityContext.capabilities.drop` key is set to `ALL`. \\r\\n\",\"functionAsControl\":false},\"securitySubCategories\":[{\"id\":\"wsct-id-5206\",\"title\":\"Container Security\",\"category\":{\"id\":\"wct-id-423\",\"name\":\"9 Container Security\",\"framework\":{\"id\":\"wf-id-1\",\"name\":\"Wiz\"}}},{\"id\":\"wsct-id-8176\",\"title\":\"5.1 Containers should not run with additional capabilities\",\"category\":{\"id\":\"wct-id-1295\",\"name\":\"5 Capabilities\",\"framework\":{\"id\":\"wf-id-57\",\"name\":\"Kubernetes Pod Security Standards (Restricted)\"}}},{\"id\":\"wsct-id-8344\",\"title\":\"Cluster misconfiguration\",\"category\":{\"id\":\"wct-id-1169\",\"name\":\"2 Container & Kubernetes Security\",\"framework\":{\"id\":\"wf-id-53\",\"name\":\"Wiz Detailed\"}}}]}", "outcome": "failure", "type": [ "info" @@ -73,7 +73,8 @@ "name": "Pod should run containers with authorized additional capabilities (PSS Restricted)", "remediation_instructions": "Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n", "short_id": "Pod-32" - } + }, + "updated_at": "2023-06-12T11:38:07.900Z" } } }, @@ -99,7 +100,7 @@ "created": "2024-08-07T12:55:52.012Z", "id": "1243196d-a365-589a-a8aa-13817c9877b2", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"cloudPlatform\":\"EKS\",\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the AWS Root Account has access keys. \\nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \\nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\\n>**Note** \\nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \\n1. Use the following command to list the Root user's access keys. \\nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \\n```\\naws iam list-access-keys\\n```\\n2. Use the following command to delete the access key(s). \\n```\\naws iam delete-access-key /\\n --access-key-id \\n```\\n>**Note** \\nOnce an access key is removed, any application using it will not work until a new one is configured for it.\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", + "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"updatedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"cloudPlatform\":\"EKS\",\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the AWS Root Account has access keys. \\nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \\nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\\n>**Note** \\nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \\n1. Use the following command to list the Root user's access keys. \\nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \\n```\\naws iam list-access-keys\\n```\\n2. Use the following command to delete the access key(s). \\n```\\naws iam delete-access-key /\\n --access-key-id \\n```\\n>**Note** \\nOnce an access key is removed, any application using it will not work until a new one is configured for it.\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", "outcome": "success", "type": [ "info" @@ -158,7 +159,8 @@ "name": "Root account access keys should not exist", "remediation_instructions": "Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \n1. Use the following command to list the Root user's access keys. \nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \n```\naws iam list-access-keys\n```\n2. Use the following command to delete the access key(s). \n```\naws iam delete-access-key /\n --access-key-id \n```\n>**Note** \nOnce an access key is removed, any application using it will not work until a new one is configured for it.", "short_id": "IAM-006" - } + }, + "updated_at": "2024-08-07T12:55:52.012Z" } } }, @@ -182,7 +184,7 @@ "created": "2024-08-15T11:41:17.517Z", "id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-vm\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\",\"evidence\":{\"cloudConfigurationLink\":\"https://learn.microsoft.com/en-us/azure/virtual-machines/states-billing\",\"configurationPath\":null,\"currentValue\":\"The VM is stopped(allocated) since 2024-08-15\",\"expectedValue\":\"The VM should be used or deallocated\"}}", + "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"updatedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-vm\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\",\"evidence\":{\"cloudConfigurationLink\":\"https://learn.microsoft.com/en-us/azure/virtual-machines/states-billing\",\"configurationPath\":null,\"currentValue\":\"The VM is stopped(allocated) since 2024-08-15\",\"expectedValue\":\"The VM should be used or deallocated\"}}", "outcome": "success", "type": [ "info" @@ -251,7 +253,8 @@ "name": "Virtual Machine should not be stopped (allocated) for more than a week", "remediation_instructions": "Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```", "short_id": "VirtualMachines-021" - } + }, + "updated_at": "2024-08-15T11:41:17.517Z" } } }, @@ -275,7 +278,7 @@ "created": "2024-08-15T11:41:17.517Z", "id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", + "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"updatedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", "outcome": "unknown", "type": [ "info" @@ -333,7 +336,8 @@ "name": "Virtual Machine should not be stopped (allocated) for more than a week", "remediation_instructions": "Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```", "short_id": "VirtualMachines-021" - } + }, + "updated_at": "2024-08-15T11:41:17.517Z" } } }, @@ -357,7 +361,7 @@ "created": "2024-08-15T11:41:17.517Z", "id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", + "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"updatedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", "outcome": "unknown", "type": [ "info" @@ -415,7 +419,8 @@ "name": "Virtual Machine should not be stopped (allocated) for more than a week", "remediation_instructions": "Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```", "short_id": "VirtualMachines-021" - } + }, + "updated_at": "2024-08-15T11:41:17.517Z" } } }, @@ -439,7 +444,7 @@ "created": "2024-08-15T11:41:17.517Z", "id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae-empty-provider-id", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae-empty-provider-id\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", + "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"updatedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae-empty-provider-id\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", "outcome": "unknown", "type": [ "info" @@ -496,7 +501,8 @@ "name": "Virtual Machine should not be stopped (allocated) for more than a week", "remediation_instructions": "Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```", "short_id": "VirtualMachines-021" - } + }, + "updated_at": "2024-08-15T11:41:17.517Z" } } }, @@ -520,7 +526,7 @@ "created": "2024-08-15T11:41:17.517Z", "id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae-missing-provider-id", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae-missing-provider-id\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", + "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"updatedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae-missing-provider-id\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", "outcome": "unknown", "type": [ "info" @@ -577,7 +583,8 @@ "name": "Virtual Machine should not be stopped (allocated) for more than a week", "remediation_instructions": "Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```", "short_id": "VirtualMachines-021" - } + }, + "updated_at": "2024-08-15T11:41:17.517Z" } } } diff --git a/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs index 792812f2c42..4f88ef5f4c0 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs @@ -33,6 +33,7 @@ state: nodes { id analyzedAt + updatedAt severity result remediation @@ -89,7 +90,7 @@ program: | "first": state.batch_size, "after": state.?end_cursor.value.orValue(null), "filterBy": { - "analyzedAt": { + "updatedAt": { "after": state.want_more ? state.?cursor.first_timestamp.orValue(null) : @@ -111,7 +112,7 @@ program: | }), "cursor": { ?"last_timestamp": body.data.configurationFindings.nodes.size() > 0 ? - optional.of(body.data.configurationFindings.nodes.map(e, timestamp(e.analyzedAt)).max().as(last, + optional.of(body.data.configurationFindings.nodes.map(e, timestamp(e.updatedAt)).max().as(last, has(state.?cursor.last_timestamp) && last < timestamp(state.cursor.last_timestamp) ? state.cursor.last_timestamp : diff --git a/packages/wiz/data_stream/cloud_configuration_finding/elasticsearch/ingest_pipeline/default.yml b/packages/wiz/data_stream/cloud_configuration_finding/elasticsearch/ingest_pipeline/default.yml index 9c22f035c90..28f9f4557fc 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/elasticsearch/ingest_pipeline/default.yml +++ b/packages/wiz/data_stream/cloud_configuration_finding/elasticsearch/ingest_pipeline/default.yml @@ -115,6 +115,17 @@ processors: tag: set_event_created copy_from: wiz.cloud_configuration_finding.analyzed_at ignore_empty_value: true + - date: + field: json.updatedAt + target_field: wiz.cloud_configuration_finding.updated_at + tag: date_set_updatedat + formats: + - ISO8601 + if: ctx.json?.updatedAt != null && ctx.json.updatedAt != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.id tag: rename_id diff --git a/packages/wiz/data_stream/cloud_configuration_finding/fields/fields.yml b/packages/wiz/data_stream/cloud_configuration_finding/fields/fields.yml index eea63ef4778..c150922fe82 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/fields/fields.yml +++ b/packages/wiz/data_stream/cloud_configuration_finding/fields/fields.yml @@ -3,6 +3,8 @@ fields: - name: analyzed_at type: date + - name: updated_at + type: date - name: resource type: group fields: diff --git a/packages/wiz/data_stream/cloud_configuration_finding/sample_event.json b/packages/wiz/data_stream/cloud_configuration_finding/sample_event.json index e928c9e134d..ad8f6a104a5 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/sample_event.json +++ b/packages/wiz/data_stream/cloud_configuration_finding/sample_event.json @@ -40,7 +40,7 @@ "id": "1243196d-a365-589a-a8aa-13817c9877b2", "ingested": "2025-04-22T09:54:52Z", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"cloudPlatform\":\"EKS\",\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the AWS Root Account has access keys. \\nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \\nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\\n\\u003e**Note** \\nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \\n1. Use the following command to list the Root user's access keys. \\nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \\n```\\naws iam list-access-keys\\n```\\n2. Use the following command to delete the access key(s). \\n```\\naws iam delete-access-key /\\n --access-key-id \\u003cvalue\\u003e\\n```\\n\\u003e**Note** \\nOnce an access key is removed, any application using it will not work until a new one is configured for it.\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", + "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"updatedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"cloudPlatform\":\"EKS\",\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the AWS Root Account has access keys. \\nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \\nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\\n\\u003e**Note** \\nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \\n1. Use the following command to list the Root user's access keys. \\nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \\n```\\naws iam list-access-keys\\n```\\n2. Use the following command to delete the access key(s). \\n```\\naws iam delete-access-key /\\n --access-key-id \\u003cvalue\\u003e\\n```\\n\\u003e**Note** \\nOnce an access key is removed, any application using it will not work until a new one is configured for it.\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", "outcome": "success", "type": [ "info" @@ -83,6 +83,7 @@ "wiz": { "cloud_configuration_finding": { "analyzed_at": "2024-08-07T12:55:52.012Z", + "updated_at": "2024-08-07T12:55:52.012Z", "id": "1243196d-a365-589a-a8aa-13817c9877b2", "resource": { "cloud_platform": "EKS", diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/pipeline/test-cloud-configuration-finding-full-posture.log b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/pipeline/test-cloud-configuration-finding-full-posture.log index 28c8516df89..4271fd05649 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/pipeline/test-cloud-configuration-finding-full-posture.log +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/pipeline/test-cloud-configuration-finding-full-posture.log @@ -1,7 +1,7 @@ -{"id":"bdeba988-f41b-55e6-9b99-96b8d3dc67d4","targetExternalId":"k8s/pod/da99fd668e64c2def251b1d48b7b69ad3129638787a0f9144a993fe30fd4554f/default/cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx","targetObjectProviderUniqueId":"cd971d74-92db-495c-8244-82da9a988fd0","firstSeenAt":"2023-06-12T11:38:07.900129Z","analyzedAt":"2023-06-12T11:38:07.900129Z","severity":"LOW","result":"FAIL","status":"OPEN","remediation":"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n","resource":{"id":"0e814bb7-29e8-5c15-be9c-8da42c67ee99","providerId":"provider-id-0e814bb7-29e8-5c15-be9c-8da42c67ee99","name":"cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx","nativeType":"Pod","type":"POD","region":null,"subscription":{"id":"a3a3cc43-1dfd-50f1-882e-692840d4a891","name":"Wiz - DEV Outpost","externalId":"cfd132be-3bc7-4f86-8efd-ed53ae498fec","cloudProvider":"Azure"},"projects":null,"tags":[{"key":"pod-template-hash","value":"8bc677d64"},{"key":"app.kubernetes.io/name","value":"azure-cluster-autoscaler"},{"key":"app.kubernetes.io/instance","value":"cluster-autoscaler"}]},"rule":{"id":"73553de7-f2ad-4ffb-b425-c69815033530","shortId":"Pod-32","graphId":"99ffeef7-75df-5c88-9265-5ab50ffbc2b9","name":"Pod should run containers with authorized additional capabilities (PSS Restricted)","description":"This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). \nThis rule checks whether the pod is running containers with authorized additional capabilities. \nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`. \nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass. \nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.","remediationInstructions":"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n","functionAsControl":false},"securitySubCategories":[{"id":"wsct-id-5206","title":"Container Security","category":{"id":"wct-id-423","name":"9 Container Security","framework":{"id":"wf-id-1","name":"Wiz"}}},{"id":"wsct-id-8176","title":"5.1 Containers should not run with additional capabilities","category":{"id":"wct-id-1295","name":"5 Capabilities","framework":{"id":"wf-id-57","name":"Kubernetes Pod Security Standards (Restricted)"}}},{"id":"wsct-id-8344","title":"Cluster misconfiguration","category":{"id":"wct-id-1169","name":"2 Container & Kubernetes Security","framework":{"id":"wf-id-53","name":"Wiz Detailed"}}}]} -{"analyzedAt":"2024-08-07T12:55:52.012378Z","id":"1243196d-a365-589a-a8aa-13817c9877b2","remediation":null,"resource":{"id":"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea","name":"Root user","nativeType":"rootUser","providerId":"arn:aws:iam::998231069301:root","region":null,"cloudPlatform":"EKS","subscription":{"cloudProvider":"AWS","externalId":"998231069301","id":"94e76baa-85fd-5928-b829-1669a2ca9660","name":"wiz-integrations"},"tags":[],"type":"USER_ACCOUNT"},"result":"PASS","rule":{"description":"This rule checks if the AWS Root Account has access keys. \nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\n>**Note** \nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.","id":"563ed717-4fb6-47fd-929e-9c794e201d0a","name":"Root account access keys should not exist","remediationInstructions":"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \n1. Use the following command to list the Root user's access keys. \nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \n```\naws iam list-access-keys\n```\n2. Use the following command to delete the access key(s). \n```\naws iam delete-access-key /\n --access-key-id \n```\n>**Note** \nOnce an access key is removed, any application using it will not work until a new one is configured for it.","shortId":"IAM-006"},"severity":"MEDIUM"} -{"analyzedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-vm","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"PASS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW","evidence":{"cloudConfigurationLink":"https://learn.microsoft.com/en-us/azure/virtual-machines/states-billing","configurationPath":null,"currentValue":"The VM is stopped(allocated) since 2024-08-15","expectedValue":"The VM should be used or deallocated"}} -{"analyzedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} -{"analyzedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} -{"analyzedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae-empty-provider-id","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} -{"analyzedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae-missing-provider-id","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} \ No newline at end of file +{"id":"bdeba988-f41b-55e6-9b99-96b8d3dc67d4","targetExternalId":"k8s/pod/da99fd668e64c2def251b1d48b7b69ad3129638787a0f9144a993fe30fd4554f/default/cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx","targetObjectProviderUniqueId":"cd971d74-92db-495c-8244-82da9a988fd0","firstSeenAt":"2023-06-12T11:38:07.900129Z","analyzedAt":"2023-06-12T11:38:07.900129Z","updatedAt":"2023-06-12T11:38:07.900129Z","severity":"LOW","result":"FAIL","status":"OPEN","remediation":"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n","resource":{"id":"0e814bb7-29e8-5c15-be9c-8da42c67ee99","providerId":"provider-id-0e814bb7-29e8-5c15-be9c-8da42c67ee99","name":"cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx","nativeType":"Pod","type":"POD","region":null,"subscription":{"id":"a3a3cc43-1dfd-50f1-882e-692840d4a891","name":"Wiz - DEV Outpost","externalId":"cfd132be-3bc7-4f86-8efd-ed53ae498fec","cloudProvider":"Azure"},"projects":null,"tags":[{"key":"pod-template-hash","value":"8bc677d64"},{"key":"app.kubernetes.io/name","value":"azure-cluster-autoscaler"},{"key":"app.kubernetes.io/instance","value":"cluster-autoscaler"}]},"rule":{"id":"73553de7-f2ad-4ffb-b425-c69815033530","shortId":"Pod-32","graphId":"99ffeef7-75df-5c88-9265-5ab50ffbc2b9","name":"Pod should run containers with authorized additional capabilities (PSS Restricted)","description":"This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). \nThis rule checks whether the pod is running containers with authorized additional capabilities. \nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`. \nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass. \nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.","remediationInstructions":"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n","functionAsControl":false},"securitySubCategories":[{"id":"wsct-id-5206","title":"Container Security","category":{"id":"wct-id-423","name":"9 Container Security","framework":{"id":"wf-id-1","name":"Wiz"}}},{"id":"wsct-id-8176","title":"5.1 Containers should not run with additional capabilities","category":{"id":"wct-id-1295","name":"5 Capabilities","framework":{"id":"wf-id-57","name":"Kubernetes Pod Security Standards (Restricted)"}}},{"id":"wsct-id-8344","title":"Cluster misconfiguration","category":{"id":"wct-id-1169","name":"2 Container & Kubernetes Security","framework":{"id":"wf-id-53","name":"Wiz Detailed"}}}]} +{"analyzedAt":"2024-08-07T12:55:52.012378Z","updatedAt":"2024-08-07T12:55:52.012378Z","id":"1243196d-a365-589a-a8aa-13817c9877b2","remediation":null,"resource":{"id":"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea","name":"Root user","nativeType":"rootUser","providerId":"arn:aws:iam::998231069301:root","region":null,"cloudPlatform":"EKS","subscription":{"cloudProvider":"AWS","externalId":"998231069301","id":"94e76baa-85fd-5928-b829-1669a2ca9660","name":"wiz-integrations"},"tags":[],"type":"USER_ACCOUNT"},"result":"PASS","rule":{"description":"This rule checks if the AWS Root Account has access keys. \nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\n>**Note** \nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.","id":"563ed717-4fb6-47fd-929e-9c794e201d0a","name":"Root account access keys should not exist","remediationInstructions":"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \n1. Use the following command to list the Root user's access keys. \nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \n```\naws iam list-access-keys\n```\n2. Use the following command to delete the access key(s). \n```\naws iam delete-access-key /\n --access-key-id \n```\n>**Note** \nOnce an access key is removed, any application using it will not work until a new one is configured for it.","shortId":"IAM-006"},"severity":"MEDIUM"} +{"analyzedAt":"2024-08-15T11:41:17.517926Z","updatedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-vm","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"PASS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW","evidence":{"cloudConfigurationLink":"https://learn.microsoft.com/en-us/azure/virtual-machines/states-billing","configurationPath":null,"currentValue":"The VM is stopped(allocated) since 2024-08-15","expectedValue":"The VM should be used or deallocated"}} +{"analyzedAt":"2024-08-15T11:41:17.517926Z","updatedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} +{"analyzedAt":"2024-08-15T11:41:17.517926Z","updatedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"80045425-a0a9-4457-82c2-2c5f47419d83","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} +{"analyzedAt":"2024-08-15T11:41:17.517926Z","updatedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae-empty-provider-id","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","providerId":"","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} +{"analyzedAt":"2024-08-15T11:41:17.517926Z","updatedAt":"2024-08-15T11:41:17.517926Z","id":"6fe49e83-2f3a-5b62-99de-beae16c7bfae-missing-provider-id","remediation":null,"resource":{"id":"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f","name":"annam-VM","nativeType":"Microsoft.Compute/virtualMachines","region":"eastus","subscription":{"cloudProvider":"Azure","externalId":"434f3cbb-30f2-4bc0-8bba-cb080280652b","id":"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db","name":"partner integrations"},"tags":[],"type":"VIRTUAL_MACHINE"},"result":"IN_PROGRESS","rule":{"description":"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.","id":"56c8890d-ad68-4659-9414-fb0ed7258c31","name":"Virtual Machine should not be stopped (allocated) for more than a week","remediationInstructions":"Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```","shortId":"VirtualMachines-021"},"severity":"LOW"} diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/pipeline/test-cloud-configuration-finding-full-posture.log-expected.json b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/pipeline/test-cloud-configuration-finding-full-posture.log-expected.json index 2933675bb84..957a3ef821f 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/pipeline/test-cloud-configuration-finding-full-posture.log-expected.json +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/pipeline/test-cloud-configuration-finding-full-posture.log-expected.json @@ -1,6 +1,7 @@ { "expected": [ { + "@timestamp": "2026-05-22T13:03:10.863717174Z", "cloud": { "account": { "id": "cfd132be-3bc7-4f86-8efd-ed53ae498fec", @@ -18,7 +19,7 @@ "created": "2023-06-12T11:38:07.900Z", "id": "bdeba988-f41b-55e6-9b99-96b8d3dc67d4", "kind": "state", - "original": "{\"id\":\"bdeba988-f41b-55e6-9b99-96b8d3dc67d4\",\"targetExternalId\":\"k8s/pod/da99fd668e64c2def251b1d48b7b69ad3129638787a0f9144a993fe30fd4554f/default/cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx\",\"targetObjectProviderUniqueId\":\"cd971d74-92db-495c-8244-82da9a988fd0\",\"firstSeenAt\":\"2023-06-12T11:38:07.900129Z\",\"analyzedAt\":\"2023-06-12T11:38:07.900129Z\",\"severity\":\"LOW\",\"result\":\"FAIL\",\"status\":\"OPEN\",\"remediation\":\"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \\r\\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \\r\\n* `securityContext.capabilities.drop` key is set to `ALL`. \\r\\n\",\"resource\":{\"id\":\"0e814bb7-29e8-5c15-be9c-8da42c67ee99\",\"providerId\":\"provider-id-0e814bb7-29e8-5c15-be9c-8da42c67ee99\",\"name\":\"cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx\",\"nativeType\":\"Pod\",\"type\":\"POD\",\"region\":null,\"subscription\":{\"id\":\"a3a3cc43-1dfd-50f1-882e-692840d4a891\",\"name\":\"Wiz - DEV Outpost\",\"externalId\":\"cfd132be-3bc7-4f86-8efd-ed53ae498fec\",\"cloudProvider\":\"Azure\"},\"projects\":null,\"tags\":[{\"key\":\"pod-template-hash\",\"value\":\"8bc677d64\"},{\"key\":\"app.kubernetes.io/name\",\"value\":\"azure-cluster-autoscaler\"},{\"key\":\"app.kubernetes.io/instance\",\"value\":\"cluster-autoscaler\"}]},\"rule\":{\"id\":\"73553de7-f2ad-4ffb-b425-c69815033530\",\"shortId\":\"Pod-32\",\"graphId\":\"99ffeef7-75df-5c88-9265-5ab50ffbc2b9\",\"name\":\"Pod should run containers with authorized additional capabilities (PSS Restricted)\",\"description\":\"This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). \\nThis rule checks whether the pod is running containers with authorized additional capabilities. \\nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`. \\nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass. \\nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.\",\"remediationInstructions\":\"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \\r\\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \\r\\n* `securityContext.capabilities.drop` key is set to `ALL`. \\r\\n\",\"functionAsControl\":false},\"securitySubCategories\":[{\"id\":\"wsct-id-5206\",\"title\":\"Container Security\",\"category\":{\"id\":\"wct-id-423\",\"name\":\"9 Container Security\",\"framework\":{\"id\":\"wf-id-1\",\"name\":\"Wiz\"}}},{\"id\":\"wsct-id-8176\",\"title\":\"5.1 Containers should not run with additional capabilities\",\"category\":{\"id\":\"wct-id-1295\",\"name\":\"5 Capabilities\",\"framework\":{\"id\":\"wf-id-57\",\"name\":\"Kubernetes Pod Security Standards (Restricted)\"}}},{\"id\":\"wsct-id-8344\",\"title\":\"Cluster misconfiguration\",\"category\":{\"id\":\"wct-id-1169\",\"name\":\"2 Container & Kubernetes Security\",\"framework\":{\"id\":\"wf-id-53\",\"name\":\"Wiz Detailed\"}}}]}", + "original": "{\"id\":\"bdeba988-f41b-55e6-9b99-96b8d3dc67d4\",\"targetExternalId\":\"k8s/pod/da99fd668e64c2def251b1d48b7b69ad3129638787a0f9144a993fe30fd4554f/default/cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx\",\"targetObjectProviderUniqueId\":\"cd971d74-92db-495c-8244-82da9a988fd0\",\"firstSeenAt\":\"2023-06-12T11:38:07.900129Z\",\"analyzedAt\":\"2023-06-12T11:38:07.900129Z\",\"updatedAt\":\"2023-06-12T11:38:07.900129Z\",\"severity\":\"LOW\",\"result\":\"FAIL\",\"status\":\"OPEN\",\"remediation\":\"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \\r\\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \\r\\n* `securityContext.capabilities.drop` key is set to `ALL`. \\r\\n\",\"resource\":{\"id\":\"0e814bb7-29e8-5c15-be9c-8da42c67ee99\",\"providerId\":\"provider-id-0e814bb7-29e8-5c15-be9c-8da42c67ee99\",\"name\":\"cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx\",\"nativeType\":\"Pod\",\"type\":\"POD\",\"region\":null,\"subscription\":{\"id\":\"a3a3cc43-1dfd-50f1-882e-692840d4a891\",\"name\":\"Wiz - DEV Outpost\",\"externalId\":\"cfd132be-3bc7-4f86-8efd-ed53ae498fec\",\"cloudProvider\":\"Azure\"},\"projects\":null,\"tags\":[{\"key\":\"pod-template-hash\",\"value\":\"8bc677d64\"},{\"key\":\"app.kubernetes.io/name\",\"value\":\"azure-cluster-autoscaler\"},{\"key\":\"app.kubernetes.io/instance\",\"value\":\"cluster-autoscaler\"}]},\"rule\":{\"id\":\"73553de7-f2ad-4ffb-b425-c69815033530\",\"shortId\":\"Pod-32\",\"graphId\":\"99ffeef7-75df-5c88-9265-5ab50ffbc2b9\",\"name\":\"Pod should run containers with authorized additional capabilities (PSS Restricted)\",\"description\":\"This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). \\nThis rule checks whether the pod is running containers with authorized additional capabilities. \\nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`. \\nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass. \\nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.\",\"remediationInstructions\":\"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \\r\\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \\r\\n* `securityContext.capabilities.drop` key is set to `ALL`. \\r\\n\",\"functionAsControl\":false},\"securitySubCategories\":[{\"id\":\"wsct-id-5206\",\"title\":\"Container Security\",\"category\":{\"id\":\"wct-id-423\",\"name\":\"9 Container Security\",\"framework\":{\"id\":\"wf-id-1\",\"name\":\"Wiz\"}}},{\"id\":\"wsct-id-8176\",\"title\":\"5.1 Containers should not run with additional capabilities\",\"category\":{\"id\":\"wct-id-1295\",\"name\":\"5 Capabilities\",\"framework\":{\"id\":\"wf-id-57\",\"name\":\"Kubernetes Pod Security Standards (Restricted)\"}}},{\"id\":\"wsct-id-8344\",\"title\":\"Cluster misconfiguration\",\"category\":{\"id\":\"wct-id-1169\",\"name\":\"2 Container & Kubernetes Security\",\"framework\":{\"id\":\"wf-id-53\",\"name\":\"Wiz Detailed\"}}}]}", "outcome": "failure", "type": [ "info" @@ -71,11 +72,13 @@ "remediation_instructions": "Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} . \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n", "short_id": "Pod-32" }, - "status": "OPEN" + "status": "OPEN", + "updated_at": "2023-06-12T11:38:07.900Z" } } }, { + "@timestamp": "2026-05-22T13:03:10.863733312Z", "cloud": { "account": { "id": "998231069301", @@ -96,7 +99,7 @@ "created": "2024-08-07T12:55:52.012Z", "id": "1243196d-a365-589a-a8aa-13817c9877b2", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"cloudPlatform\":\"EKS\",\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the AWS Root Account has access keys. \\nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \\nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\\n>**Note** \\nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \\n1. Use the following command to list the Root user's access keys. \\nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \\n```\\naws iam list-access-keys\\n```\\n2. Use the following command to delete the access key(s). \\n```\\naws iam delete-access-key /\\n --access-key-id \\n```\\n>**Note** \\nOnce an access key is removed, any application using it will not work until a new one is configured for it.\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", + "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"updatedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"cloudPlatform\":\"EKS\",\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the AWS Root Account has access keys. \\nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \\nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\\n>**Note** \\nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \\n1. Use the following command to list the Root user's access keys. \\nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \\n```\\naws iam list-access-keys\\n```\\n2. Use the following command to delete the access key(s). \\n```\\naws iam delete-access-key /\\n --access-key-id \\n```\\n>**Note** \\nOnce an access key is removed, any application using it will not work until a new one is configured for it.\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", "outcome": "success", "type": [ "info" @@ -153,11 +156,13 @@ "name": "Root account access keys should not exist", "remediation_instructions": "Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \n1. Use the following command to list the Root user's access keys. \nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \n```\naws iam list-access-keys\n```\n2. Use the following command to delete the access key(s). \n```\naws iam delete-access-key /\n --access-key-id \n```\n>**Note** \nOnce an access key is removed, any application using it will not work until a new one is configured for it.", "short_id": "IAM-006" - } + }, + "updated_at": "2024-08-07T12:55:52.012Z" } } }, { + "@timestamp": "2026-05-22T13:03:10.863737107Z", "cloud": { "account": { "id": "434f3cbb-30f2-4bc0-8bba-cb080280652b", @@ -176,7 +181,7 @@ "created": "2024-08-15T11:41:17.517Z", "id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-vm\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\",\"evidence\":{\"cloudConfigurationLink\":\"https://learn.microsoft.com/en-us/azure/virtual-machines/states-billing\",\"configurationPath\":null,\"currentValue\":\"The VM is stopped(allocated) since 2024-08-15\",\"expectedValue\":\"The VM should be used or deallocated\"}}", + "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"updatedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-vm\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\",\"evidence\":{\"cloudConfigurationLink\":\"https://learn.microsoft.com/en-us/azure/virtual-machines/states-billing\",\"configurationPath\":null,\"currentValue\":\"The VM is stopped(allocated) since 2024-08-15\",\"expectedValue\":\"The VM should be used or deallocated\"}}", "outcome": "success", "type": [ "info" @@ -243,11 +248,13 @@ "name": "Virtual Machine should not be stopped (allocated) for more than a week", "remediation_instructions": "Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```", "short_id": "VirtualMachines-021" - } + }, + "updated_at": "2024-08-15T11:41:17.517Z" } } }, { + "@timestamp": "2026-05-22T13:03:10.863740181Z", "cloud": { "account": { "id": "434f3cbb-30f2-4bc0-8bba-cb080280652b", @@ -266,7 +273,7 @@ "created": "2024-08-15T11:41:17.517Z", "id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", + "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"updatedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", "outcome": "unknown", "type": [ "info" @@ -322,11 +329,13 @@ "name": "Virtual Machine should not be stopped (allocated) for more than a week", "remediation_instructions": "Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```", "short_id": "VirtualMachines-021" - } + }, + "updated_at": "2024-08-15T11:41:17.517Z" } } }, { + "@timestamp": "2026-05-22T13:03:10.863743149Z", "cloud": { "account": { "id": "434f3cbb-30f2-4bc0-8bba-cb080280652b", @@ -345,7 +354,7 @@ "created": "2024-08-15T11:41:17.517Z", "id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", + "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"updatedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"80045425-a0a9-4457-82c2-2c5f47419d83\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", "outcome": "unknown", "type": [ "info" @@ -401,11 +410,13 @@ "name": "Virtual Machine should not be stopped (allocated) for more than a week", "remediation_instructions": "Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```", "short_id": "VirtualMachines-021" - } + }, + "updated_at": "2024-08-15T11:41:17.517Z" } } }, { + "@timestamp": "2026-05-22T13:03:10.863746126Z", "cloud": { "account": { "id": "434f3cbb-30f2-4bc0-8bba-cb080280652b", @@ -424,7 +435,7 @@ "created": "2024-08-15T11:41:17.517Z", "id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae-empty-provider-id", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae-empty-provider-id\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", + "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"updatedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae-empty-provider-id\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"providerId\":\"\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", "outcome": "unknown", "type": [ "info" @@ -479,11 +490,13 @@ "name": "Virtual Machine should not be stopped (allocated) for more than a week", "remediation_instructions": "Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```", "short_id": "VirtualMachines-021" - } + }, + "updated_at": "2024-08-15T11:41:17.517Z" } } }, { + "@timestamp": "2026-05-22T13:03:10.863749018Z", "cloud": { "account": { "id": "434f3cbb-30f2-4bc0-8bba-cb080280652b", @@ -502,7 +515,7 @@ "created": "2024-08-15T11:41:17.517Z", "id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae-missing-provider-id", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae-missing-provider-id\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", + "original": "{\"analyzedAt\":\"2024-08-15T11:41:17.517926Z\",\"updatedAt\":\"2024-08-15T11:41:17.517926Z\",\"id\":\"6fe49e83-2f3a-5b62-99de-beae16c7bfae-missing-provider-id\",\"remediation\":null,\"resource\":{\"id\":\"8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f\",\"name\":\"annam-VM\",\"nativeType\":\"Microsoft.Compute/virtualMachines\",\"region\":\"eastus\",\"subscription\":{\"cloudProvider\":\"Azure\",\"externalId\":\"434f3cbb-30f2-4bc0-8bba-cb080280652b\",\"id\":\"064ecbb5-19ee-540d-b9f5-99c3a4e2d0db\",\"name\":\"partner integrations\"},\"tags\":[],\"type\":\"VIRTUAL_MACHINE\"},\"result\":\"IN_PROGRESS\",\"rule\":{\"description\":\"This rule checks if the Virtual Machine (VM) is stopped (and not deallocated) for at least a week. \\nThis rule fails if `code: PowerState/stopped` and the timestamp was more than 7 days ago. \\nWhen you are logged in to the operating system of an Azure VM, you can issue a command to shut down the server (or via Azure CLI). This will kick you out of the OS and stop all processes but will maintain the allocated hardware (including the IP addresses currently assigned). If you find the VM in the Azure console, you will see the state listed as `Stopped`. The biggest thing you need to know about this state is that **you are still being charged by the hour for this instance**. \\nFor cost optimization and management purposes, it is recommended to deallocate (charges no longer apply) VMs that have been stopped for more than a week.\",\"id\":\"56c8890d-ad68-4659-9414-fb0ed7258c31\",\"name\":\"Virtual Machine should not be stopped (allocated) for more than a week\",\"remediationInstructions\":\"Perform the following command to deallocate the VM via Azure CLI:\\n```\\naz vm deallocate \\\\\\n\\t--ids {{vmId}}\\n```\",\"shortId\":\"VirtualMachines-021\"},\"severity\":\"LOW\"}", "outcome": "unknown", "type": [ "info" @@ -557,7 +570,8 @@ "name": "Virtual Machine should not be stopped (allocated) for more than a week", "remediation_instructions": "Perform the following command to deallocate the VM via Azure CLI:\n```\naz vm deallocate \\\n\t--ids {{vmId}}\n```", "short_id": "VirtualMachines-021" - } + }, + "updated_at": "2024-08-15T11:41:17.517Z" } } } diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected index 94ab5ccba53..f53e7238c5c 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected @@ -96,6 +96,7 @@ inputs: id name analyzedAt + updatedAt severity result remediation diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs index 919b208cee6..01cfa942326 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs @@ -33,6 +33,7 @@ state: id name analyzedAt + updatedAt severity result remediation diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/elasticsearch/ingest_pipeline/default.yml b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/elasticsearch/ingest_pipeline/default.yml index bd2723e422d..1abe4db5046 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/elasticsearch/ingest_pipeline/default.yml +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/elasticsearch/ingest_pipeline/default.yml @@ -115,6 +115,17 @@ processors: tag: set_event_created copy_from: wiz.cloud_configuration_finding_full_posture.analyzed_at ignore_empty_value: true + - date: + field: json.updatedAt + target_field: wiz.cloud_configuration_finding_full_posture.updated_at + tag: date_set_updatedat + formats: + - ISO8601 + if: ctx.json?.updatedAt != null && ctx.json.updatedAt != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.id tag: rename_id diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/fields.yml b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/fields.yml index 5df98192fcf..61224cdca53 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/fields.yml +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/fields.yml @@ -3,6 +3,8 @@ fields: - name: analyzed_at type: date + - name: updated_at + type: date - name: status type: keyword - name: name diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/sample_event.json b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/sample_event.json index d0f3f08c5b9..c019599ab67 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/sample_event.json +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/sample_event.json @@ -40,7 +40,7 @@ "id": "1243196d-a365-589a-a8aa-13817c9877b2", "ingested": "2025-04-22T09:55:55Z", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"cloudPlatform\":\"EKS\",\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"description\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"instructions\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", + "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"updatedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"cloudPlatform\":\"EKS\",\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"description\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"instructions\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", "outcome": "success", "type": [ "info" @@ -81,6 +81,7 @@ "wiz": { "cloud_configuration_finding_full_posture": { "analyzed_at": "2024-08-07T12:55:52.012Z", + "updated_at": "2024-08-07T12:55:52.012Z", "id": "1243196d-a365-589a-a8aa-13817c9877b2", "resource": { "cloud_platform": "EKS", diff --git a/packages/wiz/docs/README.md b/packages/wiz/docs/README.md index 07502ef2506..ae7de1eab4d 100644 --- a/packages/wiz/docs/README.md +++ b/packages/wiz/docs/README.md @@ -298,7 +298,7 @@ An example event for `cloud_configuration_finding` looks as following: "id": "1243196d-a365-589a-a8aa-13817c9877b2", "ingested": "2025-04-22T09:54:52Z", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"cloudPlatform\":\"EKS\",\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the AWS Root Account has access keys. \\nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \\nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\\n\\u003e**Note** \\nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \\n1. Use the following command to list the Root user's access keys. \\nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \\n```\\naws iam list-access-keys\\n```\\n2. Use the following command to delete the access key(s). \\n```\\naws iam delete-access-key /\\n --access-key-id \\u003cvalue\\u003e\\n```\\n\\u003e**Note** \\nOnce an access key is removed, any application using it will not work until a new one is configured for it.\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", + "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"updatedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"cloudPlatform\":\"EKS\",\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the AWS Root Account has access keys. \\nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \\nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\\n\\u003e**Note** \\nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \\n1. Use the following command to list the Root user's access keys. \\nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \\n```\\naws iam list-access-keys\\n```\\n2. Use the following command to delete the access key(s). \\n```\\naws iam delete-access-key /\\n --access-key-id \\u003cvalue\\u003e\\n```\\n\\u003e**Note** \\nOnce an access key is removed, any application using it will not work until a new one is configured for it.\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", "outcome": "success", "type": [ "info" @@ -341,6 +341,7 @@ An example event for `cloud_configuration_finding` looks as following: "wiz": { "cloud_configuration_finding": { "analyzed_at": "2024-08-07T12:55:52.012Z", + "updated_at": "2024-08-07T12:55:52.012Z", "id": "1243196d-a365-589a-a8aa-13817c9877b2", "resource": { "cloud_platform": "EKS", @@ -413,6 +414,7 @@ An example event for `cloud_configuration_finding` looks as following: | wiz.cloud_configuration_finding.rule.name | | keyword | | wiz.cloud_configuration_finding.rule.remediation_instructions | | text | | wiz.cloud_configuration_finding.rule.short_id | | keyword | +| wiz.cloud_configuration_finding.updated_at | | date | ### Cloud configuration finding full posture @@ -466,7 +468,7 @@ An example event for `cloud_configuration_finding_full_posture` looks as followi "id": "1243196d-a365-589a-a8aa-13817c9877b2", "ingested": "2025-04-22T09:55:55Z", "kind": "state", - "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"cloudPlatform\":\"EKS\",\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"description\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"instructions\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", + "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"updatedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"cloudPlatform\":\"EKS\",\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"description\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"instructions\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}", "outcome": "success", "type": [ "info" @@ -507,6 +509,7 @@ An example event for `cloud_configuration_finding_full_posture` looks as followi "wiz": { "cloud_configuration_finding_full_posture": { "analyzed_at": "2024-08-07T12:55:52.012Z", + "updated_at": "2024-08-07T12:55:52.012Z", "id": "1243196d-a365-589a-a8aa-13817c9877b2", "resource": { "cloud_platform": "EKS", @@ -581,6 +584,7 @@ An example event for `cloud_configuration_finding_full_posture` looks as followi | wiz.cloud_configuration_finding_full_posture.rule.remediation_instructions | | text | | wiz.cloud_configuration_finding_full_posture.rule.short_id | | keyword | | wiz.cloud_configuration_finding_full_posture.status | | keyword | +| wiz.cloud_configuration_finding_full_posture.updated_at | | date | ### Defend diff --git a/packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/fields.yml b/packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/fields.yml index 5df98192fcf..61224cdca53 100644 --- a/packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/fields.yml +++ b/packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/fields.yml @@ -3,6 +3,8 @@ fields: - name: analyzed_at type: date + - name: updated_at + type: date - name: status type: keyword - name: name From 14f0d2e59c43ce8068625a4425e58bf145fd5047 Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Mon, 25 May 2026 11:52:57 +0200 Subject: [PATCH 06/21] Tolerate URLs with a `/graphql` path (or `/graphql/`). We expect just the base: `https://api.somedc.app.wiz.io`. Wiz provides an "API Endpoint" with the path: `https://api.somedc.app.wiz.io/graphql`, so that should work too. Better URL cleaning. --- packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs | 2 +- .../cloud_configuration_finding/agent/stream/cel.yml.hbs | 2 +- .../_dev/test/policy/test-default.expected | 4 ++-- .../agent/stream/cel.yml.hbs | 4 ++-- packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs | 2 +- .../wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs index c1593ef51db..c8127efe4ff 100644 --- a/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs @@ -61,7 +61,7 @@ program: | state.with( request( "POST", - state.url.trim_right("/") + "/graphql", + state.url.trim_right("/").trim_suffix("/graphql") + "/graphql", { "query": state.query, "variables": { diff --git a/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs index 4f88ef5f4c0..984c7c7f8a6 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs @@ -83,7 +83,7 @@ program: | state.with( request( "POST", - state.url.trim_right("/") + "/graphql", + state.url.trim_right("/").trim_suffix("/graphql") + "/graphql", { "query": state.query, "variables": { diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected index f53e7238c5c..f82486d485d 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected @@ -22,7 +22,7 @@ inputs: state.with( request( "POST", - state.url.trim_right("/") + "/graphql", + state.url.trim_right("/").trim_suffix("/graphql") + "/graphql", { "query": state.query, "variables": { @@ -65,7 +65,7 @@ inputs: "error": { "code": string(resp.StatusCode), "id": string(resp.Status), - "message": "POST " + state.url.trim_right("/") + "/graphql:" + ( + "message": "POST " + state.url.trim_right("/").trim_suffix("/graphql") + "/graphql:" + ( size(resp.Body) != 0 ? string(resp.Body) : diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs index 01cfa942326..0086dff7e8d 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs @@ -84,7 +84,7 @@ program: | state.with( request( "POST", - state.url.trim_right("/") + "/graphql", + state.url.trim_right("/").trim_suffix("/graphql") + "/graphql", { "query": state.query, "variables": { @@ -127,7 +127,7 @@ program: | "error": { "code": string(resp.StatusCode), "id": string(resp.Status), - "message": "POST " + state.url.trim_right("/") + "/graphql:" + ( + "message": "POST " + state.url.trim_right("/").trim_suffix("/graphql") + "/graphql:" + ( size(resp.Body) != 0 ? string(resp.Body) : diff --git a/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs index f54b8135198..8dad616339e 100644 --- a/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs @@ -150,7 +150,7 @@ program: | state.with( request( "POST", - state.url.trim_right("/") + "/graphql", + state.url.trim_right("/").trim_suffix("/graphql") + "/graphql", { "query": state.query, "variables": { diff --git a/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs index 065b3442ee6..91028a869b8 100644 --- a/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs @@ -140,7 +140,7 @@ program: | state.with( request( "POST", - state.url.trim_right("/") + "/graphql", + state.url.trim_right("/").trim_suffix("/graphql") + "/graphql", { "query": state.query, "variables": { From a67020cf2187b14e5736fa8227405689f88dad33 Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Mon, 25 May 2026 12:20:34 +0200 Subject: [PATCH 07/21] Set a static request rate of 0.5 rps per data stream, increase retries. Testing shows that 5 rps should be okay (4 rps is fine for 10s, 8 rps occasionally returns 429). We have 5 data streams using the GraphQL API. Four run frequently (by default every 5 mins), one is a daily sync. Setting a request rate limit of 0.5 rps for each data stream means we should never exceed 2.5 rps in total, and never reach the rate limit. The only feedback from the server about the rate limit is that it responds with 429, with retry-after / reset information, once the limit has been exceeded. If a 429 response is received, the input will retry the request, respecting the retry-after period. We set a conservative static rate because the different data streams are unable to coordinate on the client side, and they receive no request budget feedback from the server side until its too late. We don't expect retries, but since they are possible due to rate limiting rather than just request or server errors, the maximum number of retry attempts is raised from 5 to 10. --- .../data_stream/audit/agent/stream/cel.yml.hbs | 2 ++ packages/wiz/data_stream/audit/manifest.yml | 16 ++++++++++++++++ .../agent/stream/cel.yml.hbs | 2 ++ .../cloud_configuration_finding/manifest.yml | 16 ++++++++++++++++ .../_dev/test/policy/test-default.expected | 2 ++ .../agent/stream/cel.yml.hbs | 2 ++ .../manifest.yml | 16 ++++++++++++++++ .../data_stream/issue/agent/stream/cel.yml.hbs | 2 ++ packages/wiz/data_stream/issue/manifest.yml | 16 ++++++++++++++++ .../vulnerability/agent/stream/cel.yml.hbs | 2 ++ .../wiz/data_stream/vulnerability/manifest.yml | 16 ++++++++++++++++ 11 files changed, 92 insertions(+) diff --git a/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs index c8127efe4ff..82ae0655cb6 100644 --- a/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs @@ -13,6 +13,8 @@ resource.ssl: {{ssl}} {{#if http_client_timeout}} resource.timeout: {{http_client_timeout}} {{/if}} +resource.rate_limit.limit: {{resource_rate_limit_limit}} +resource.retry.max_attempts: {{resource_retry_max_attempts}} resource.url: {{url}} auth.oauth2: client.id: {{client_id}} diff --git a/packages/wiz/data_stream/audit/manifest.yml b/packages/wiz/data_stream/audit/manifest.yml index 39b216fecea..d5330159f5c 100644 --- a/packages/wiz/data_stream/audit/manifest.yml +++ b/packages/wiz/data_stream/audit/manifest.yml @@ -39,6 +39,22 @@ streams: required: true show_user: false default: 30s + - name: resource_rate_limit_limit + type: text + title: Resource Rate Limit + description: The maximum request rate for the HTTP client, in requests per second. + multi: false + required: false + show_user: false + default: "0.5" + - name: resource_retry_max_attempts + type: text + title: Resource Retry Max Attempts + description: Maximum number of retries for the HTTP client. + multi: false + required: false + show_user: false + default: "10" - name: max_executions type: integer title: Maximum Pages Per Interval diff --git a/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs index 984c7c7f8a6..f1806d882e8 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/cloud_configuration_finding/agent/stream/cel.yml.hbs @@ -13,6 +13,8 @@ resource.ssl: {{ssl}} {{#if http_client_timeout}} resource.timeout: {{http_client_timeout}} {{/if}} +resource.rate_limit.limit: {{resource_rate_limit_limit}} +resource.retry.max_attempts: {{resource_retry_max_attempts}} resource.url: {{url}} auth.oauth2: client.id: {{client_id}} diff --git a/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml b/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml index 3f2f2a9da43..704ef0f0cb7 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml +++ b/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml @@ -39,6 +39,22 @@ streams: required: true show_user: false default: 30s + - name: resource_rate_limit_limit + type: text + title: Resource Rate Limit + description: The maximum request rate for the HTTP client, in requests per second. + multi: false + required: false + show_user: false + default: "0.5" + - name: resource_retry_max_attempts + type: text + title: Resource Retry Max Attempts + description: Maximum number of retries for the HTTP client. + multi: false + required: false + show_user: false + default: "10" - name: max_executions type: integer title: Maximum Pages Per Interval diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected index f82486d485d..83acf7d0939 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/_dev/test/policy/test-default.expected @@ -80,6 +80,8 @@ inputs: publisher_pipeline.disable_host: true redact: fields: null + resource.rate_limit.limit: 0.5 + resource.retry.max_attempts: 10 resource.ssl: null resource.timeout: 30s resource.tracer: diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs index 0086dff7e8d..f76fc2c5479 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/agent/stream/cel.yml.hbs @@ -13,6 +13,8 @@ resource.ssl: {{ssl}} {{#if http_client_timeout}} resource.timeout: {{http_client_timeout}} {{/if}} +resource.rate_limit.limit: {{resource_rate_limit_limit}} +resource.retry.max_attempts: {{resource_retry_max_attempts}} resource.url: {{url}} auth.oauth2: client.id: {{client_id}} diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/manifest.yml b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/manifest.yml index 714abe7f01f..0204e1aa648 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/manifest.yml +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/manifest.yml @@ -23,6 +23,22 @@ streams: required: true show_user: false default: 30s + - name: resource_rate_limit_limit + type: text + title: Resource Rate Limit + description: The maximum request rate for the HTTP client, in requests per second. + multi: false + required: false + show_user: false + default: "0.5" + - name: resource_retry_max_attempts + type: text + title: Resource Retry Max Attempts + description: Maximum number of retries for the HTTP client. + multi: false + required: false + show_user: false + default: "10" - name: max_executions type: integer title: Maximum Pages Per Interval diff --git a/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs index 8dad616339e..11344833763 100644 --- a/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/issue/agent/stream/cel.yml.hbs @@ -13,6 +13,8 @@ resource.ssl: {{ssl}} {{#if http_client_timeout}} resource.timeout: {{http_client_timeout}} {{/if}} +resource.rate_limit.limit: {{resource_rate_limit_limit}} +resource.retry.max_attempts: {{resource_retry_max_attempts}} resource.url: {{url}} auth.oauth2: client.id: {{client_id}} diff --git a/packages/wiz/data_stream/issue/manifest.yml b/packages/wiz/data_stream/issue/manifest.yml index 4e173369baa..0abd423d018 100644 --- a/packages/wiz/data_stream/issue/manifest.yml +++ b/packages/wiz/data_stream/issue/manifest.yml @@ -39,6 +39,22 @@ streams: required: true show_user: false default: 30s + - name: resource_rate_limit_limit + type: text + title: Resource Rate Limit + description: The maximum request rate for the HTTP client, in requests per second. + multi: false + required: false + show_user: false + default: "0.5" + - name: resource_retry_max_attempts + type: text + title: Resource Retry Max Attempts + description: Maximum number of retries for the HTTP client. + multi: false + required: false + show_user: false + default: "10" - name: max_executions type: integer title: Maximum Pages Per Interval diff --git a/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs b/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs index 91028a869b8..568c376d3ea 100644 --- a/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs +++ b/packages/wiz/data_stream/vulnerability/agent/stream/cel.yml.hbs @@ -13,6 +13,8 @@ resource.ssl: {{ssl}} {{#if http_client_timeout}} resource.timeout: {{http_client_timeout}} {{/if}} +resource.rate_limit.limit: {{resource_rate_limit_limit}} +resource.retry.max_attempts: {{resource_retry_max_attempts}} resource.url: {{url}} auth.oauth2: client.id: {{client_id}} diff --git a/packages/wiz/data_stream/vulnerability/manifest.yml b/packages/wiz/data_stream/vulnerability/manifest.yml index 56627c84fdf..441d0753e3b 100644 --- a/packages/wiz/data_stream/vulnerability/manifest.yml +++ b/packages/wiz/data_stream/vulnerability/manifest.yml @@ -49,6 +49,22 @@ streams: required: true show_user: false default: 30s + - name: resource_rate_limit_limit + type: text + title: Resource Rate Limit + description: The maximum request rate for the HTTP client, in requests per second. + multi: false + required: false + show_user: false + default: "0.5" + - name: resource_retry_max_attempts + type: text + title: Resource Retry Max Attempts + description: Maximum number of retries for the HTTP client. + multi: false + required: false + show_user: false + default: "10" - name: max_executions type: integer title: Maximum Pages Per Interval From 8a9023808b76927ad3330ac98c0629d90be5cdae Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Mon, 25 May 2026 12:23:36 +0200 Subject: [PATCH 08/21] Make Token URL a non-advanced setting. Since apparently it can vary, and will be provided by Wiz along with the API Endpoint and credentials. --- packages/wiz/manifest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/wiz/manifest.yml b/packages/wiz/manifest.yml index 9b4f52afd47..9e93582d86e 100644 --- a/packages/wiz/manifest.yml +++ b/packages/wiz/manifest.yml @@ -96,7 +96,7 @@ policy_templates: description: Token URL of Wiz. default: https://auth.app.wiz.io/oauth/token required: true - show_user: false + show_user: true secret: false - name: proxy_url type: text From d91824f92b2dbd7a1b2918b3e7ecbcd586efa39e Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Mon, 25 May 2026 12:31:46 +0200 Subject: [PATCH 09/21] Tell the user the interval setting 'must be 5m or longer'. --- packages/wiz/data_stream/audit/manifest.yml | 2 +- .../wiz/data_stream/cloud_configuration_finding/manifest.yml | 2 +- packages/wiz/data_stream/issue/manifest.yml | 2 +- packages/wiz/data_stream/vulnerability/manifest.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/wiz/data_stream/audit/manifest.yml b/packages/wiz/data_stream/audit/manifest.yml index d5330159f5c..f327ca83a7c 100644 --- a/packages/wiz/data_stream/audit/manifest.yml +++ b/packages/wiz/data_stream/audit/manifest.yml @@ -18,7 +18,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Wiz API. Supported units for this parameter are h/m/s. + description: Duration between requests to the Wiz API. Must be 5m or longer. Supported units for this parameter are h/m/s. default: 5m multi: false required: true diff --git a/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml b/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml index 704ef0f0cb7..d7ff48311c6 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml +++ b/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml @@ -18,7 +18,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Wiz API. Supported units for this parameter are h/m/s. + description: Duration between requests to the Wiz API. Must be 5m or longer. Supported units for this parameter are h/m/s. default: 5m multi: false required: true diff --git a/packages/wiz/data_stream/issue/manifest.yml b/packages/wiz/data_stream/issue/manifest.yml index 0abd423d018..3c8ecca8406 100644 --- a/packages/wiz/data_stream/issue/manifest.yml +++ b/packages/wiz/data_stream/issue/manifest.yml @@ -18,7 +18,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Wiz API. Supported units for this parameter are h/m/s. + description: Duration between requests to the Wiz API. Must be 5m or longer. Supported units for this parameter are h/m/s. default: 5m multi: false required: true diff --git a/packages/wiz/data_stream/vulnerability/manifest.yml b/packages/wiz/data_stream/vulnerability/manifest.yml index 441d0753e3b..3ae400be89c 100644 --- a/packages/wiz/data_stream/vulnerability/manifest.yml +++ b/packages/wiz/data_stream/vulnerability/manifest.yml @@ -28,7 +28,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Wiz API. Supported units for this parameter are h/m/s. + description: Duration between requests to the Wiz API. Must be 5m or longer. Supported units for this parameter are h/m/s. default: 5m multi: false required: true From 78e0820a82cd4773c3d58e80db0ef3a07809a45d Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Mon, 25 May 2026 15:08:39 +0200 Subject: [PATCH 10/21] Add a screenshot of the 'config UI' (policy editor UI). This was specifically requested by Wiz. --- packages/wiz/img/wiz-policy-editor-ui.png | Bin 0 -> 299575 bytes packages/wiz/manifest.yml | 4 ++++ 2 files changed, 4 insertions(+) create mode 100644 packages/wiz/img/wiz-policy-editor-ui.png diff --git a/packages/wiz/img/wiz-policy-editor-ui.png b/packages/wiz/img/wiz-policy-editor-ui.png new file mode 100644 index 0000000000000000000000000000000000000000..ca80bd346185fb09ec293ee79be7c8227cc878cb GIT binary patch literal 299575 zcmd?RWmKF?(>5AN2*DE)+>_uI2<{Tx-Q9w_ySoK<2!p!}?hxFa!QCAOhcl7=e0kP+ z_xG;z`~17tOi%aSC0AEpRW-rVl0r!E*znJuJwp-^{v!MA*~^q?&tMl`y@Y%sN<$j= z>>1%RkuSXRPMQacFi!F_=rAj2AG}}jqAo1r`81kZlbvOb#`9TQhBh|V`md=jEG{lG z^1PCK$G61AoF)PtourTYe!uD1y-cDs^=^5U?(_bU`(WiJ)d~tSytEheyUb@WWIRy+ z^7w_PElfx5#bh1A|7FmxS-eQv%7bZN{L4K5S;+ep!Y8wkPk4@i|J$-ZhilJv&HQg; zGI{)9Fqs4rBiLpCx1D@4TQmLN#z+%(KqIES7w^F%|5u6p*$F1oDdYb(hU~QtRDi^r z-1Uh6yO1GMBBoqp|4~FDPg@^3>o`Cp{9{A}2@5s~?|&)hi{Q%C{*2RE7uwMg?FU=T zBe6eUdwD}=!;7IzOYzwxfKv_-|6X*lgs1&3)O$=X9WjNSw*Fzy&a0x zc54(m@9v7gEj#I?`qvDv=U?1EJOIg4`aGXMlAmM@4Ngk2^1c13mY2Vcfe;mXSW>b# zo|95Cor9WaqDL4vxbeRgk^4?KiV!LUgVKjmscao6&u0BcejTW3->p zFyd9d56NdV5|PVqIrnlDV(j|m!o?bk&s%G)9xk9f&RosetGq^oKh!6M+9>@kp)YY>Kp^AfbKN~ocGy3g{s=Y2CS@8;iY0sFw=3PlgoB!- z1~Wg|dHjLNb*Y25EKrs3$0?8}>{W`Hnb{~n=J{la9D+)vzMsE8D?X=7kZ+)*_9f`@ zpkzRa=GT;6%1~%bhx4AFx`!j*X8&dKJZ=~(uHfrO_?1gJi0Qu4;DM3YdV-PQjCm(y zSoBfHX7SWLT*OlH>*}PDhA^5$n*%w08@ZayEPGyHTnT5f*#Ypg=SBQwC+E_7^E`ju zG6(h3o%uAy{g#d#*i7a0%4b(Nwhbe`Z019IPm$L$Y#S3Z7YP+y=*Jvu@E{x_7Asn< z#bR*oeD}m3y&%3_fmP~EtwZ}84O-%!EmwI`I;STd$Q5NRj0uX<=HCr@=z}%{5!Ro zja9kO9DPm{g#yJwowXdL)^G+bN<396QjyVHZLpnU@5~4HH$(Ku(5Y&AM?Tzi*5inB z>dcXUJmpjHGw!-%zi8O3zl9kKcf#o!J9gIg)4FwmUNm22#XdU^R@`Tjf;oj z)rqeu1L66*zkwmh4r)% z@nkCB{B?U@iIba4phyJTH1Br~vqGg>rtU~AsN=c7mB#IW>fSrV&#*YNLuT;T zN4|4IH33=xd$#KhP++_{+v*vbaqSh7U@}8Nh2@pv;h_CKb9;D7ZA&}Vdx!pGH70%t z3Rzw3Sf{eOa_PdZYW~IraW4Y(8=t?A4W2=Ch@mFBd$O?q+~Be(4+fKhcp_Bzp$#@; z_|$QkPU{u_gc4Iy(g#z2L)Co_xrptVh;{H|9BPC+)25Cu9;Ij}2|GJG?i^|GTnNI+ zq8<5c@L@cYcl|u(%G|P`Mrx$3WvYiF_943ioe8&`IWB`)p*VO3mN1QGG({IrWI#LL!r8{p>a!;O`DUj)kau5im)Iiy3#PhEpjwO~ zr)nc(@*wu2jp~iR*qCX)f4sWB9*)-t*1q>EaJo9;90Z_gPWfStwb87wJMj11qA*ts z?5Fo3q|nz*3V=Ek5Yqx=<~g|R=P*8;wjQo{ z*3+D<7So->6sKw{9#Fu)bMQ_`sI|UJ*50p{ovUVkslZepOBUdX{<0cvP^sMSUgs3< zlA_l921AA3NOxA>X9numiNHhJhEnQA{l_tXVHu$z0>s1zTews4V8~uq!BA0C%Z%r+ zK+rdYN`>AyrrCBIKO%#}|1GKH>O`It-5s>P1GO51K%|96^`^6h$f@u$7w3tlPi}n4 zyx6RMz=C4m=v+m<%naSbkg@vH^*A6-!WdpjP%yzoaHw-O{1{&|Fb@L-voVEtUdVWM z@}$uPbGitn2?VPZ)AwGBVm3S<;YqI`$86vlV?FP^;~2m|NWIx*F*B55Q?P>7j6Uai zq`)s=hk}0duu_PR{&lPgu2886+E!)aF|t9zq5v1O$X?(|LG2_8MRRdYDp;RvO+RJoEE|xvKX{!?@Sir*92M zG`xO@#hWghc1=dp8^F)b&aON@z=Gb{ZuSQw?JH)AUN$&g?9d(P_>c8bVlzHy(t_It zp0d#ulXMeRl)ry1Y8Tet*AD6QcR?hGtYxXvXSsjiO1|fi!DgB<GH=2@kkR<-fM; zM9Ls&o~CKbbr<=VZ-|mgiJygV)@zTucqh@(&M)-7+Ed>_clI3?=dTl-@Cfe9hVT9g z_sh)Od%S|Bs1oIR!6H!w%Qb9f6E7`~qoDOO{n57Nz_yW*5$*Cqg~Ckhb-^qPZoAn} zbq!nsi){AN8WfQ|5{W^9DEQcJ_vK7f8VwAfY72kOGp|0_NE8xQ5|lHbm&xLkIamP;++{3&sD?~T3~oudO|D~I?I^$$HdJ;RGcM{7FS(mGy+lAv=Ip`CNzxsUe_YBG}vua_5kDQpVv&eIK$kL6K6bUXPyj@S*B$XKwF~wboB4u$F3@MJd%_ zd-AI^5M2$7NIPBaoM{h(9QTGJsn94WQum;egm&$Qa^oQo;|Uo2VAA^8NV0QcLd+-E zL{>rp=`E>5cMPc%BA16U4!s#YoL(KQ44PGy(NI@1qiKbyW3S~!Cufj1&PIRI+r>u5 z&U~5d)0He^K9T2A=97kqDPe1C-G79N`5~%f4of20EpWX@YV9JaoB;F2U0ch!ynwjD z?l3s55iGca9p*lQpA}>E3&*U#5XyY_Q?4+3L$#STTXX2y5sGo7qnUKu;ucMHzIJpJ zp=iz~42;>OG<+{w)S@@nq{B$BFN{))K|7kMW1F-s7E7xnh|p&;W$q_=HhSFQAA0(D z$bMl*6%nQwp_6{p-cy@+efxsT^hrh~#<(N*dr4p$h)bj{;dbYY?jVVou8z z(2FWHyzn&Is7I8D?#w_L~zy(H0a4#_Se-N&qqC`?l1J&fKyzEGB^w(@3K~ zu}Pw8rsIgkwG4<}qs2zSwUDDatEG+IO&enpBZF8}VKSW~viH*#r|Xx95%-@U-$m@b z{PKbqSQs}}E+W?Cb|dO(OmS~H)>NR_TV*#V8ivcM`NV#Scgc2xzkcj5_Q_}|gDxQ3 zB2D!h(LFN84ZHsBB%E*>8(K2(D<#Uc%g%P4=Ll06K09w=Ex4^?84>BwCX??wqLzkl zt32J|rJENLKJ%&(Nm3wOQSyPTK99E`Cz8#CzXa=m2P|oywok;z0(v52Q1MH=?GBL0 z^$AC2NoGMnUuUlFj}YzYg*h_d!`r0*R9$pQlYnpq!1%5_)XKVTXX%eY)W^B4b}C~D zMD=s@trPxMRq)Pq32cP06KeG7c_eqHQKT0CqW$!Nb0WRDV)-&GQp(<>X)%gcrT(y= zx!NO=BX&&Q;3$a1oz+BGEPL5=AHm2N_U-h}iJno3`wGe-C{t^>T+8ctxm757&EPU{ zzQLHf(s0NJE++RSLe}I<5nMbvxt3?tssQQyJf+QVtq%KmM~pVle+3F6ZHXwQdq~3t zaz+)#=hIff6be*jCA*WSc{HmQMNFR<%qY}qs8rpTQ5Rh=d=e7!z*e23S^S^$w!}Av z;}Cv?V#F{4s5YQ{)s!nt&@^G3^$Lb#NF6OE3*^-B9fT?4WYcFW^kCgK3yAqaI|a0G zd($PMZq8?Ibivt*EgtvRaL)X-a!=)c79PzmuuZ{33AC-a%NR4Inm<7HPisRd%r240 z-1lA|MZWc>EaZG$Y(N^%k$8UTxEvfqTH$Grl4*5Cx{e(r7k)M2Rr- z>j`XQu37Jn__6vS&_L1>uvbihi;KD*Ttqqj(1=`Xu{4g1A)C@AVH2LhY&qsp2KqFe zFQZY|uTlN5s9CqV5gaoMG>Y_ar{O=g-_~Ly@_f8+FXdP0SZs2hAS-gaIqQRsEj%;i z0ygCiTJ3|)&7yB!mc-I;fb2=_<7Z5=kFkXRtr?q06LRNO zsL+M^SS{kW&s@5m;Thk{Dc@rr#Bg>iQ&u*lR@3{wmeg0nbge6REYm{+a#&$ZPcu1D zTp2Ysfk(9JGM6Q{i&SsXz6Cm-ZPOCka`+RA#hc9Q4@N;Quysu9j(?2K0j}&3mBiaeD_;8)ntk! z`F)q{3amD+qut3=-=Ac8mot38VX7B}IeLJ-svhkcql4RZuh!Ejnhq)%#{ES)$OU&a>5H{FoI6Ou#{?HO(!cdSlb7>wh*& z?LE=}+^-&h;HQbi_q*|y!!`d<)b!bG#S+zW)R@%|g1gW0(3lKjTlJ_~Bs6%Nu}*C6gm+Q2dQY0tUT1tnkcFX5YW)_8<)Z@+%$y`p3YXI*tVS^b zo8r}JRED#QtIo&~CuqcEsxbH+YAGT@n(B(^9;wG8iQ^amm9$9rcETU+1xbFV;$ zN%y|!4|(XB^^L7j`vYF%IikioOWdItrt>=;Q71=0cmbR3Vd66HTjhEa#)ZwtrFutZ zWghf&rLpe*U^>LC%=Ka zL3(g{7`+tnZ#kmX>i=GK1)MoTsK;jBag5k9=p3dVvy}|sf zucP^_TO&!{dS@Ovj?2q@O)b%#u-PK(#~WhpT2?zJW3O;9&(k?ONLPOmfoono=egly z_2-dfYAveeMdY$|nc$U$WZ*t9qfE0xS*^#oT`TlrUZu~mcUzKRECdaF$bCJ;IO(`Y z8c8tfL!tl#1W?o|H`~yaYBolcF5Z3pforY`9OcsUcs$74e4*DZG0x@c(TpDB$wL>z z78R_zy&HALwByrNP=%#$SXjPWvQMq9Nf0HHXp+cbrdp}XitcRC9T1omD6toSTV&u{ z9o%$sGo_hWFA2-#H=aF14|jiV=9lLz_>N#NAdr?DrV*@=hI@K(Zy1Kh-KQOsxla?0 z#r($e0q=xZe3Z`mo=oLSb9_y{$|&tEUy&L7@y4FA8mB9=?e@?_h9Cxd7y&m_ z?eW5x2bayptCBOlwJwoco*y!gnmBBBpUeQD55?#nU{uVh5)HMEV%s{J_E3vziz!k3 zuf35=?zbk~<3qLJz zV=6t&SG+mKl*xTkwdrD1 z#S(b1Di*sTLp-%s#B)>-rtP8md<}0qG|UF$Cvp4$xL1YpUUQ8`wEEuytr6i;+}xVz z%&uR#Kb-`~5-T*j*gG$d^vqQm0rd(|gx->hx0Px%0-&v{z*Xo&DV;g`aMrl^#pB0; z;KS;@oX6)cUlyTqkn4!53L!l-g?hbEglY zg?=hkp+Vcp7zH?+UhIvb9nJ#<>qDk|fhO?Ru5+kDD2G!^q;V8##Iu!9-KtpU>5H>^ zwywXjISp-eZ$=TI3t-I!UHpgBHq2Wuo3xp+%hgO86HzuA) zVDVQ){PO)HIU+p-z;lwX1aI%#38W>XdL{Q2^?Fa-9&oqgBkA?!d~4~PXRD3p(Zk$g zaa}V4aG45#Dd4H<09v=vvon~mINJC9EF=L>fkkcWaBcf|-Z8b3lyLou9OvRbKAv?Q zA6B4Nw6i6!T&w%exG+)-*!Y1TM1q6S0kt;3bH=k)zkuz^}Jcg$5 zx6jt=K^D%S!F$AfC%stGky|uQBJFR;8)#zbbTw>VK%x2lfu*`!1aD+`TCtScNn6L* zz}s4{Tl+E@I8I|##svW@%_3U?CNuaxrRH40NNghBc^b3X^09o=3=ZS>5n`@gag>TL z*{cgJ_C~XOd37dk5VkMNVC`Qos_H%Wl;a&0d$5kX!-G4tL(_Rn8rGTg*@*a~+M9y~ za=Dz2(RSaHZ7t7rz@P-i7WMVHRDmWu;wSrgi6k}&igcf=&QfYLvmCJmJ`}himOlxK zQ{GJN_IqXEJ;6QKS4_nc%{+yiCva{CW0JW)_^Gr1Ax;AzodCU_YGE8k9>7-C1#IswCW)oLY(g!v*o$Jg9vp zi-|$NV4|aS>w7FmMWge8LrHPe?+_mGXY5yWTV7nKhGY!&?X!@BG5ZX{lj&0oZ_Jp# z1OniDhfw+;9NQ$uZiBrJ#PsEV2#j7Dp^}LEk;jmlOtA+7*n||~?7k_QQxICmfX#V@ zh*h5FsZ<%R21qzKfI-R9bNUZFms_8W$Mq{8C7=&?Glw-irhKp$?_I!04+`@&s*I+h zuJzbEXQs@D7ZhfqX(VU?NI0i)GFKLh)$repCvsd=1>1dKHrqoSDr=%yEe1fmg$<&> z&vMiwVOSC=47|apKQgCd;Z5@oLxksBJRVv+))kvw7$*~eu9J*Kq&f1lfWjh(z2F^0 zwLUSu9!cj6gr}W+MQwKbPz!Y?AaN_5m#x}WVDd==6LqOs5td$HHkMzr69xf|55!=c zdFw$M4+KmynkC%a-)Y$=6U~&mQol4;$!nZtusPuMytj~^y~wGcG25H*O!mayhd55o^BDH&r-?+aYrGH(HU&Hp4=tu=VA+K#SD z<_Fkj*R1tQMOc3G{N})P?yWG4ln%C$g^PqT|-jhT>%k zobChBpR$l7@!7pv9-g9VcG-ai;zgG9cK! zBX?-N8lD!oWg#CK;Rwk@i{&|Oy^a<#!cC>I`ZVq}YusD2VzY|75K?S$XLJ%tTMYJl`3Z1k*r<$M}!6cDvu&zp3g`q{!RLhrAoEKhg|JxP6lqFv8onq$+%+^qV0mNnIs!i_%RpyB}4TqCS zrQQzF&qm|?&S_LL~J?u0<5 z(F7ei;W&Q#y-7hNI1`@$iQVzMPVJ?@dpr*DqX0#xx_%sF&l30%V z!TVNpYE-v`;>T!KX_eC{Dk{?@vMmN06B>=|tA{(3dlUAFK#Au-$YtOBriEj*Xr@em zk@)H>Qi>h*p2boV`M&g0tk)R~K9>{Ws+v~5D7#(<$yA8b89)Tp%>(axhw^A^ctVvS zfQb(t7zUTZ2j4JRZz!HYafsf5oMOjYQW)z(bVUTP7K4_4dcA~$bK9`t@P~S>Bgt&} z$l>5bur%=gu<%FvbUzttXX4dCGz*er4utW3y$=(B{D>56(7bxYdFSs$T^OE@O%Vle zES|x}JN?-q;WEC*O)eCBsz`V3dTgApEX-r^fWz5F=f}7|CbI`UIxW(U`l*I*116(x z5Xa8lXUS9!;>8Kowbf1`)I@`*nnR6E+Z|DrPGj9zEwL}4oj6POS4koAAtwvE0yxbO zdPn=}sAR`#98qWi8afA_eCX6D>Ba2X8mp>$eUQ}4CXrcaw*cy&BJb4Guhsq81!P=(x{sK5tIx$CL z56@AWyMV&DlVjmD<(VF+h_opR-r?M9xwemLl8!0N0hXS`lQ`fSuMU2IfTq3@LjIp!!3Uoy%w%Du z%`fDMK?x-XAsDpCQ<`H@j4AJB=K#Z;Ivq}_@ik76Xu)zdZ>be2#=h(E8>tL={O0KaC14gKBEIyhisC8@SkwmMdW>Z zX`;u|x@1MJLDyAevQ%6FK1ZXR@w;|a*f{N3c~c3tipsHR@s2Fil|^ZM1W`K;oSkj< zf2CGcNUYJ@wlFtL^VlO4JGw_1QhP*Uwp^SZsgWo`uf)HI%u-D}tNiDVXeX=z5kr84 zrH19|*=-xF9TJ-}3rRcK}93N2O8eSI5h5?Y6_|z32%V z{h4d|q%5w>%#av$E@}NX(e5lqN=zN0a@NU-6mqn#n&;g;eD{pk-Pkz=wFaOwp~Wb& zLO32jms`bfoXXe9qP!WLjuWaY`A>=^vNGwtrMC(OF`%X4VM*1!$pEq7wcZ5gTDO}x zirEYK(Tl6^#9Ei1m;`3+4o);bip9T+A(84yb%rW&`5ivBeS*^Ct}CQn%agz=14g89 z8bQ&hHv!^|iom)zXPfPjmARRFQd(KE5-Q7v`8C}GpPr|`3fU_cF%H9Jg+AUq&OUuh zx;G;%yMK~TyI^is+=-Y1$;bgpBqs7KwTu%m%1g81-CkZC=as--8W>D$QY!f<5EsxM zz#{JiLJ~J$saGc<1`>isNrB>jABrcd@f`<^A~wN3E?IA{+W2g=oAIMmJYtC|u%lZ7 z$NI`*g-yDo#gd%*RCHyg)O+(`k1PM~4M;ed0WJUqhh|?HFR;*IEc{^3HdATj2oh#& zLy~ma*&hTWFp1)f?3DUj(RwNP#?b_li5i>wE!ngF{k zWc-YH&Csmu#KW=!!Cy-@ty~Qolzu@&(vwoQdeEIpN%+7Xl>eSEMj5{omBS+o7>)y-MnALJD zI07QGfZ+nZxZy<)0kHTk-O-~4V$<9EP_7qq%*vW9?&aR(I7Q^7wDCbin(IYM%6l_V ztr6vTZ_Hwq;Yeq!v01j!WN0uBgy%ZdB>YaGZaPy~8fUZ}FF-yO^O?d*#*>sz1Wp2*cl=) zoP`vmk-)ulG2JIli=}u2v@G~WQy%-I05zDPGXXT6A&$MxFZqz;lL9YGzCo!qjY2>t zD!RhSh=8W9KN$Nax^ZBU@%<9~*eROM;xGFqO=&4QNr2Odsu*HxT)0s)p@D(0XIlfI&^DTj z$%g%e3|g1$Ko5l(EzdY67g{TEA5mJ`B+s$$y~&J}TSFOTFtH|X%az3aag>w@S!G=w z^*z6Hn>^mvWSK1}GAKW|+;0&T3TGJMc)u)HrEF|)y!siOE0c`YN})`~>wXK6P&LW0 zweMt-d4I4}uW~m-F}2sm&o#dna69aFSeT>S;6|J~l6WprrcAAqNs$uL7#o;YJ+Vxx zF?-vGEtkS%IWnZe+ao9x;)Rc-P?S$k4lSp!Y z68kfyQM6t*x|hkGIn86z{N#0zLLA7+9mJy#IfMGA#m5n@Z^Ln9PftWFL4Z?72(SOr zu>vPMC3w zgZiWF;n%4NxgM$1Smx-I)hqH*IT%GGfQHtQdcC%3%B!QJBh^n;wlfy){*s3vU{@1K zgTp=%uhL2jQF}s^=tiLe#lZ3qIWPnbEu_Fch-1TDbTkXPxId1<^!y?=>foDvWyx|m zxw0uIBtkcWOIEG5AfDn#`p7b$Z7F1AZ0rrmKL}GUuSrvfD}1t(oc;u=HlS=Go|W!Q zEEjPsn`)M6k1L#Qu-m1VXB~?5TtHg{IL5(%5VL;+d@6_b3$9 z*sBRycJ2d^@qB3KcXmB8$RX*bk%$IIbo4C{Y%+umHJ);8$SORWblw_Hc~Za;c_jE< zrYTL>@+#k+ULJ?@@?ArgX?B3o+qtWQRlJPWpJijO6JAU~}_&V-42HLLCYPcAcoU4<09)`<>*?jky3nRJL z2=4HQH<=ROTb=ZSd)sfr0{2OGlEpdmlQwmpi@oVU=XZmT+?a)&8<=?6!bR=n*236$ zc|Id|Gc3(cL46}=IXZH|Yd=2ef?nuzxl{4IZB?nH;&7W;=^7vhJw_-dMR$-8h!PWc z5qRzqNzLJhk6I_(SMh+d-u>V+7GpLEvsREH@|V~%o?jON8{6I#$jwMEBMLB>$@VCC z5>8@725uyK?p%jHHYi+9^lye%d(x^GizgC?P?XDVM(pigJD)#I6X@-2Sm&!`V-Kgb zdKprK1bbuIWgtnDpfYHgn|5HSd=2<;QNwjqd#l*_)JItXrvU5#$)b-dee!o$g%sR$ z2~Ths06^ahc=W=Gue#n;dYOpigUBUQm^2WcvHoGjejfI(gZi%yDpqe0l0a2vQEH)bopp3`3Pr{EO5_z~ z`65*j(~=BgF~gGPo11ftob!IH)Nim@BfY+Ud%WY8tg@T5k%I=mz0uNLhH!TPyQnpuc!>77s^{W`rO9%RX#UwE% zOU-?t+<3(c3X&py&t!@0#NQ7oOKx$yIe{>wJ99;~9*0D1Kh^TPuq%80AVcgD@3GhbR19 zLLysxTUR3Une+E~gHuwV;|wl$MIYkJ<%Y6%1wFdtBIi_8HywAh! zg`ZfkE+{ggOgTKRXhw8Db{_=7Eqr<^Qt}R!gk7w40a7G#F=j%GT?VPwaA=#uF;4mz zCD5i$J~|IKaT^dF?`BDISND@lIeeV~hl4y!xHMcZ+B*XyJ9Jl$f0^S7HY)<%yjgJQ$>7IM(W(RktI`Eaui+`5R#IFyE&g{M%o3-m~IwY?Or5R)j6G3 zdbn>UGR)9!ucZ#a%u!$~0dx;87eKYR7Bdkze~K~zhUI3v%Za8(k*%5ySPVpqg50?x zfp3z=br#pp+Q9?*YFGlOV4*o1;QOhk)5zt!Y#`Nr4vvw5jv=}QN8RXhY7l3r5F~3>!v5Df9t(BG6o{CDowucHq2e@c|xyb;>1&p6b{aA`l zGl8UVv$2X*zU8Y*N)&oeq__^c#L0iss49y%-@aENQzOx)j+`meT2Gf}X6?IIC`y6$ z*SMGuRGb4a?SOLLHrPGx7O^U;&9~82_}1j#tbPyz-q`#ybDqqfMc&}4ladaS2~C*D zpXG>ujQMrUPsx%jA`SchvhEJl-W6F4V+5sOR6viB<9hq4gp7@u{U{kqiivz#$dd0% z!k!zslglgSYd*zo%Ai7#!PDb)!;_o)ms{mukOPmU=~c8;zBG}7kJ!JSRPfE8%+PRW z3sjLvbCU7n6guh!X0Q$L%^w3LAh}N2RvdO07Ws^R+CU1@CMOZsuDJRcU&qiHJ@Az6+j8LFRJCXHK>Ja+6GBs%ys7N(?ulPpKbwLC7XR#+$2*bwr~BSLTKy)rUaJ$@-sB3$kv|(|B7k;EX@aLQE+Hs`{f0MHE;lGRXnVa8T!6zf^<-T zP+m>ShO!RcM^y-2#Ak7syjf=%^9=83q3yY4ne_G~tGSE#a5{oH$e|5O=ZHr9lkGFqTYIzOmJ!tv(ANc=y=vKi%6m7UnFdXqq(R}E_>CI&H zaVB0bf)74?+1S6qzltagyc?Q$16rO<`%Y{o8zUM=LHrVVCp09kU+*mYPI(iIxV;Qp zohznq;muarEnNhV%ui!OYPj49HJ^9HcBNiO{|%9^4S=lkXpU+*+p-VBY)^C98Cs%in`kLHXGEfJ}qCUdA-oR-{ zk(%g_vy;1ftXi!mp7hBA9b=0KiIiHM$NN^R^J#NAb)0{?8iH&f7!z)zoBj`E|5AT6 zWPPykskPBBTL>b81`lIp7N#AfO?388<0~>jp-B-mFRy3!xHdVu24U1nu6LfpF6(!X z;WN3%6m5w7;o)UIN|%}$<8oWWx3sj#*uBJ$|8p+I`lCSIL@(88A^~`#RBlhYfT6I7 zKfmdshIC0;?|Yn?{I;TGm~W&~0l2J{>l=M?*VlBnw=06@24{BvLC&9{ggta&VS!V{ z`#PITHqBNKy#1{axIcv%x-ri>b7$>pS$?Gt(}nO~ttJo_!qKw;*ywQ?f+kUMiEp#?>)l^BzQAPqQF`}d?yv5H|G4nq z-i%4yR!%Osh%6cKUuyWnfc*87E*gmJD)v3BYyOtb|9hM?p&%Tj?@p%HH|Fm*{V)Ce z@vI6lFCDpq2CY=;zwP{QxBCM;K{AkrGu_F<75)F=%fDZN=KxiE_Fdx$;yW3R-H2ZS~a3A zX8H9cl|y%9ncE3yfEL^6%|l*4)lAw(=)QxaCme)< z-N`^4!Q6jQTuh~7U;txkYC1bV|D)l?w&P!v7ZeULmyUW<$0m-kl{0d6uoD6C6?0h$ zXU!(9cl9)rjE&nOulxPI_55NAlw2%D3U~$Gkf$X!SX&3*NxgNXEypN5Y97l-NO< zLZQ`KrWYMF`nTy^;Z;O2F)=-d^?!v?uQ!m5^R?StUJA}t31va&?O>{yp{{<3rWZDh zYXjunkwL}4C%diNkcWx<&|PZhGs$z@&Oupn>N#|9QTe9QIY#0n&>xCHySn+q!G-Qv z0lUgbA3}&gn3=W(4&fy2!E|~fp}!pNuSaj?pT|M$JaA=~->%7;PStX2nH6EhlYAoS zBJ~JA<76egOeC_;SD@_K{4R`3Rhs5S3wUjO?i;ZfyxM$z0e-lcWE1+oAnKPd5V$8Z zVWdfKi%_C{uZz9vzDFwMed!!3;Pe#b(6o8v>&Ru@2;B|Prn}HK%foQeo0X&uXc5-C zu0|!P_KuM|!{ic^jQp2_szUDP^jFlI(P>VPbS{)Wvcd?>Mma@E7jbs01$o6&`s4g( z+RMUThZoSRbCSn6&9C%MjTI1@tBvJ))+kpd{{>`U+rmJ?xnyR~ED;!wgKO>>d|H6- z9PTVU!PAa}aq-aLszyt^NZH}RTdC`miy)5KT2yWJW*+C7i95xzj#>Ami`|LtBZQTM zf198G=lm2~vVDLA&%JBSU-Ks&F5_-)zuJBAh_;t_(PZ?|Y%Pc#`ln22=Ok&5no6_x zMIr6z2@E6rf2r^PJicCr1OWavJxItY5os@8BBOAG#1ThvV6D72r3HRPWa;C^q0?2J zopb?vINjdrnAi3TstX*<+5I?WPpsO0X;?$;&tZ(G_oK^S=rhhgwEz+jsjXZZ?bKhq zxSbx3%%w@Xm}xz_a1R4nK~bw$W-1*v-DYIeZ%1T2viZ;`*k*st-Pmc`A@eBshA^Z~ zFI2A)uRm>7UGd5RU#@z>^>UAqL?WpGuh!^l7?O1oshe2?ci>Irj_{UXE65be2TRuy ze72y6G#mIrIz%5#aJ00v#4}h?jK=|j=ebCooJMBzgd~~-kPr+^vF7$ai&r<4r`k`V z0_MXGM>ulI-qZ^l16VE(=p*hI4hK-EAD@wgzo5@$P9&u9lSmon>KgSNSv@8gc(2s} zc&X(oZ^@#+sB+MB@j?i8W-7zv7)^!Og4abWoz;}_5QP{#Z1I7t%+tBEYnk3s3y$)50W>N}dE2M@krGiOfgcM6;x^`x zD+^$sNr1iC{SHNEWa&Amph&*d3x0FJ&y_m&RSJX=_uHhLes9qKE?+f=uWozNyxd_? zP`$wojsN8(vs1>-tW^hK*Xmnlvw2E9X!pH~y9}#RfP_rJfZm@V^`CI!&%xMb1c~Fa z7TmKtbGdJy#r4DB9|lv7R|2?^>?H9m2wVCDDDT_x?TW$^hiJWr8)bbd z6lHd*HNe6Cv9ed`vSNO9_52N22A7^u>z=TQQTBtR0^_2+D=l{s)aR<59tiM#n3uHd zubwNHMGK~v=NUhokzCbGB=5+zl0xl&SwUch1l1=Ez{U77BpplCEpGQr%Bvp^-e_MKhUc6m1F$lDa;C3n})FpVyuoq> ziTGqtZnuqi;t7l-JC9Y$qZe~{V64}wca(SgpKiCLSUs(TKX080ST^#c;&4Jp8R6_Y zchnR%F%7>JpwHy@$5ka8H@oFpuy)PkmKwS@rfU*;^Kd$CR{|K~hoKgWTQdC4f&xmw|s9zy=&?ECM-cx(TCfap~%5uWDqNU>qQ&DJi&Ua zrO`qB@-7{CM&#P>wVa}xSeUkyac8LuPB&GBi7C`?xICa%9b72W$hch;wl1X6Y(eEv zz^#Xgv&ox2u;BI#-1-dG;aPNJ;C9Ai;IlU6#^+-7n^UC&zCMmM5oroFAiVwg+-}w z@3G);2je0mgY&g&nH0-32uyG|?R{jjN#Bdbi+?3CzewkHoB-`j6=*znJX-p3IPVxe zNppA5(hNO0SXw%pT?F(a-Yjly)Ib8$3(fp`*YSRHo z#Jns~WAuf;a5z}-#bLG_Xju}bK@&%#jE%P4@Cghg6^ul}&u7lp!Vw642k+o+g1pzn z?s(ijRm5EFDY<&!cP1+m&#r`Q9ua`~W$UuDoSfd}KV7Q-2XTL2Rk9Gih|St<4LZjx z`Mwu`Prh&>!W;akGf`m6v&_qrQOZ+N_;QGq$xp)LEXOVU-ne?&H1D{j?R#hKSoIeY zxYV=tQ%V#wj`L@pA}62AJ)ky(ck@g9FV@m((ZvB0$-+Lt;^j3AJ*aT@>8+RD{aTdo zgZ=m$X}Niy;__rTs$yOU?4C+Pry$uB8(B6(YFfs7tyTM7_{dR7zrYx;GU;tA+<(yN zK|!TK8;p9lebm|o4JT?xG-W?in+Uw4kX*FyIdI6SJ~t4yxKfy9aPL7obV=^T4K=dv zxPdJL3@w>6BrpcM%nau(@}n`~HD2Q0jFSq4eoI;B$nMI& zrQS%7>raPnWhQ&I=pw<7gD!Z;w+q?Hk?^(MWgpIic--YQLS*%5q1>kWo94kX@Mi<| zW=O_kEx)*Nx_O=!mQ&IWnAROfLK`ktX@r8*O7gAp!DLN4vAN$;Ej794p`waESyyPiAKLI$S|yCc2yWTFkQ`vo(FX>ZWyC!U-V!RLd`A}mC|3CsIs#{{@bK=D`XM1o8{v-`+9xx=yDN% zqry$~wJ+0TjCOA+`tQ5%YmvusqzK$j9{m_Z%p^b_!|x6+xWt^4?JpeO4W+89)fV)8 zTX#BK4fW@ao0!&@ol?PZk^j-u%&gy>yFa^B`|{ho8YBe@-&sL%iL~gxbfD-wC*n7{grnatabjubS3Mv9hRe>N~DM7lT zbRyC_h;$M_dJTvmASfU$KqyM@Jqf)ky@nDX6p>y+@AWL)?cMvhpZDiE-}OCzxL^S* zYmGU^9OWMK9$`$4(YE0qd8J89%*SNBvMG;>FJqV-E@=-r5QeW@p2Ly9yUyHav$K38 z>=Cv#ry7vrmzAKb&Zenc7fo%DHcq8F)H!k+UNqa%dP0k-Z{Xa|28vv%Hw=Ye?3g-K?Sbc8M&I0|XU%Tc^CAaLV zqT*|(rSl7)46G?JrWDMZX)VrfiaKk06n2MXg(<5&JxU?gYq^7b&SfUYx!Qe2?PH%@ zea7@IqG7ul{DI11o1!Ln++6rU^q$v{SiFiht`c`7wDha8%k`4g% zBV!QTUl3BAbKGm?=X~V8F~g~wC>9==L8km!^$bPIl?3XEw-EOoI^TVpoxJ!GOO8=Z zj3;AfLRCPW*CvjwPL;iG_43_)H-JAvNpSh!(#C?*6ebX3wMlu%Nb*bWIZB0JjrAy> zNWn5-Y#;kCCdX1!fsZz4uUQoCoKeA_^~hv!V0sq)h|L7{jmMZVYgV3d@c~88i8jXb zxeL&tDX+TqQCl(N#lCTKTs>*SKs*8sM@#ubYWleYRsv1Cy9|qcA#53!sKI(JyUGlC znOABqBm25k<;#pPBcITstb}uFYQ1+eDV3o*0G9^PNE;iZ?FHT4x8Hq|2jBJE*v&T5 znnHlRSD5Z+37J+5NIXXkKtY7F73y8d5OLtphBNmJiaVLEp|3&JYI7h5AFwgY?f0-s zf_NiYsliQqkk5F~Jo8!WXH-$|6}^7t?t=NfjahBU=iLuHrd*6WBkD2=GWFwQm0ND? zn$?CDSagRfX%nkW%T3pm)1Nj& zl>NS>1%^tj+Sw1N($H0s7#>KCKp|pV_8;ksB^KnlQ)p&AecTv0>3rX?ZTdbtvTs-> z)!$00_q0xGNhl}ixR?jBU%P!MK5s)%VZ6<3SJQUGAud0 zK3o)`SBSFVXFACLps#5dUi?Ht*X{7qt+1gdC|XschWYc_0UIU<;ywm9@4%veRGBX8 zvpViXlIgqe-GUF!7ICQ)E()Xg3o1RtEf)FbwZ}8rn4K+LcU1@CVozHejco^l8I%W0 zGzU6j%O|sZRa{NtvpJ-?8baxK+8nc6(>^tf9;N!;(f3=*v)WM7t_MyR$`02vKmK4D z=|jL6;l!-qNyl*a`qoxuwrEOoHIXdIgb$EMkpsuS`kN3^j`myA0Q6>}xrcmiQ^h?+ zHe4Go^%lI565BiocAFsPWQ!|%wRYW)ls+R7V~Lw35IF4*wZ<0|QRVgkik-VrREOJP zYz$6(bGWzuNp|ww{t<9u?n5>f%$?Jkrc;!LP5RolwaAtkzaksdEqTpxC@RAGEHs$~`Z)8o998%Hazn|yJ<;%-<3(69Rf2b&z<$sbfCNG{_~2ivT(@DT z$>8oyI7WWQ%tS+KUzTWcn6_)!1@liSgk*lueV zFh`ju;>u~Y%>)a#%x(@29d52#+ir+Qh+PwN2)A&zUHR&++7hl^GY}yZZJi6EVJBIl z)079o8K5taHFIpCX!T|sIsRMINuCbDhO5n{KMLo~>X-b1xQK~lEUK%mjf7jjl5b&^ zid(NPtN%n!r)&YM&Q)NQEY!S4o?du*_{SU+$uwR$G6)bn!yA>4`rCIFc175)vHLChuo@c&ao_|zBBwIx9OeE7gqXK@UDzauznXtDx zq%xF$H|(L%_x2(CQdYyLEb2BS3&OJlL8 zb?n^^LBZ!m54$CXt!1ZuA20&d6|C!J`yKs;8s(1U0rTOzi@#*1#x9pvHEhOfpnjPx z&MAyw|G+4u)|r{_sr-!XP|InFR5caSsTzEJVCoU(Yg5A&$dA-#rqbE zCLQ`HY&Jv6hi}Xm3Bw)2zRJqpU``pDFWe1jN;F(AM&}Ow9yntE*p1FRB>Fr{tJ#!Bq$v>0NORKn$?9O%P6j zAgR^Z)VkT+->A=vgvzA>6l9Z`Ic8J0p-lbxIy5KNgYQ*YRic3wsfljC4?4!j&Y=K( z4WHF|Jh*8QXJdIMBFns}s03U8d7(e+w(ZOFgq^Hd`Hq$K$n4d%wa3;MeX(h>KDo+~ z6k`B&z`n&nu%6w~%EVNJZhg}FbHB$pn6jGcN!~bCWUy2>)+daq4-#>axXbN+{BeL$Q-@9q#)yfXKU;(%wQq z)s?Tvb{c!7Ndg=uzc*-@i=SLQ2iLf;bqSd!1R9b3vU){fNQ~Rhz_MUICJC+&E7w=) zQp*)jB}(wU_^Y;XmhHE1*OrE>$V4lg2edCWZq!Ac_J8gN0rEgVMW=xM@I>A& zCTE^cZFmqB33h(V18NfHHaLWTqfDsYia;e~-7bT#Zd>$-H`sVJW|$}L5c1g$Z$)Rp z^>@tzD|9&Y(3e8!MIXPtWb!RSB&MX!JvCQ2QbbGnkOK<&>R(sDDmG%G&-hayt`>7O zAgaJ(?C>q93e6yV+?CQqGXDZ7fyM1+lV>>D2bol*K+G5{&xE5=-=b%f)7i>G8P&ee zB|g6_Y@~|n3Nl3O^*czEF9)Ezg6475ksBKks9aT&3ZPn2*V}s<;A4kZ)iRYI55xu@ z3cXYkbXK858ir>wxzheiRsJj$@IIoT_bwId_CIyOPSbCvwH8~m{V_p44tt^m~)@uthy zkJcA? r;7iz(kKT;KjKEhrn*a$+)g>9cCTtLORHaDFehotOc#*p_YI43XGWykQ zcB*in`l0K;Jo^{bAGORFVnv3e$qzw2ZsRkv%^{?jSmf_$1!Pm*JZ6)~<$eKN|6367 zA-m`ACK1VogS_MQ4$Y}C+;aZMLm-p@@p`{2KwF75ngCcn?8J-AK zuaA(7B_3WGjl+Mve+Jz}Qh5iEPJ@12p|OyqEbRUEYH%0L=2< z-KnXKe7cj)J3C)7Vr=LXTFQ83VT_i&!92URw$XG&z{caSy_Qw(b@J*b;PwG++pbEx z5A%-e2(ZT`sScH#H#?|&q=@d~B|zD$X*+mX64a2>cdlN?*yal*zM<;*Hds>9jPk8FoYytIO4{lk7#wwiatmQ+N!FPRksy$ba zcVp_pEo73H?g4KlbNW`>JVEy7)z5@mBF(Iz9gp!G8(o{?Gw$&AY(DM~&Qj z7XB|_*&ibM@_(-=+qp&^wnE;KPsW|D*;CZ(4=CnJxR~UYg^S1OLOgg@3;xJ2A_9Lo zQu*-C=@lhlPqJcOIT4fk<8S^Hqwtwxs^$Dcaj)acUS6ip)|Qty-u!P0a+bKgz5Ru? zHEA&!y?z+)9xp8L_SDHx1=&NEEb!PQS(U5}5mxx_-M}}>DKgid1_s={rY>})5P-IoW)7>C20SPz7EHpbi`rk(8`T?)G%Gc~h< zOMbr)UAX=FU%ot*JaYw^bD~$~HhKwJ@}Pp1ZS0aR?|=A*+ussj`zZ|P6twhZlU_s~ zF8bwOd-ThhvseG^OH$Em3b0;{ZCmWXmz=Z=5B67te}A0YuU~r+-6=-W8ispS6!ZV5 z=K$U)ErQ;V9CPMB{?(&TL_O9cl~$2G$#?!u2){|^TmCPG;WaN|A^#$(-~Q_A-A998 zI{x#Wt`_`as8Z{&6!0JK1l&jTzxVl9&Ak0z`TYMye}cZH_y5rg@L%2jug(6SXR{*T ziM-+}nH0Z#V9g}|3jdPt+bjK3r{yiJ^txbPiI%_f7U0u%6~E=HAW}C&)p#=8JTvz_ z_Ft7P3EAoIbB-}Xcj6-KHLPW#R4=BgPbjS0X3}04Hr;%+MR!d&M7zpB``I`f-aP`L zYjIuj%bhv$pSwtptG8k6XWl^o_v!7g^zGYxo3iC9+q}~Jt;{XEv{&)p7erZ77MdNe z3#ebtTzh#=_V}sp-h3^qR@s4XMCVaTyN!~<%cmifc}8d5&Fa%$1YsF|>JGgxUIi1+ zH0lGcxAs?x3#Q!;(~VXwy{@0X1YUy-pt(6M!oQG|q0a<4%OeEwCJwo8lxsAj&bxKw zoo9i$W%&7oKmLil0_ur;AxbW*We#Vry6_Q`p14Z}lIgM@Wr?xdAhl#Btav?-r7aZ) z?}aZ?ggKL#T<#y;(s54N>oZ{T@=L*{Jat;E(5g9Pe1cex91lrA>=qiy?0Hz23{w`bd}Jd|;5nhw0a@*;ERR${tv2>5y8K~AVqp{PJFTVsUd`iXT=M(IYmn$j zHEl!-bI&pI5o%|bc+X+LNegq5GQux>qbo*xU$uiunJ1)xwUV*x_@@!bS?SjWtPg`X z-vDm=Y2fQ~5N)A+jcJd^7h^Y5@SZ!_9@Q@sX>TcODTCfmZV5#lc`C4Z9w%3BNw{Th z$e9W{EysHB7-dH^M{1k$vjPkxqviG*V-Fq=((LtWK_6YwE|;dRiG_&e?^U88vqN~3 zZ(*bA4EfWtj5MTi5lY!)GF`1*GXA)Y<{o>E={8Q!uKYa;b)<=UkK-XwaZImqJ(Vihx;g|47QvF;vOTx2u`ayf9laI^5 z+g9(Eqt&NA@6ed0^#(J}GI{N%+<`vqzghK|&sRuzofFC(KNKP6O0-vI9}}v7X-glZ zVKWwGCED6n#xB4NN0uqC4VCa5C2L5ad&1yCKC%sI!Q(dJg;28Q@n6RySiU!wpapFw zVvWst70*@28)!##$`0Nr5q=%~(?Ib;A`mg{9uCp~RuZ7<9S}X#XWE#bmNF_PXlV*g zy6~o`8;4#s{t3!3cuQS>J?u*GBzZz-Ij8Hm_HB<$Rb-Rg#wR z$gp@yj8;RYOR%c)b_`z_ucJf^dj3=Us2h{&pem1|Wz2B5`yk(#FNDG60#cvXu#X{~ ztMxD>sN%yj?AbzQt1uT|NXQ_(ZT{|09F0gdU~nNTgLWps1KlJs|EB8kO>SOeYv@(} zsKeeqXUnL?=PyBYPfjgb5fn^wH+_-GF&YJt!m-`k3Nrbabfn%qO@lFpV(jkV&F`0Z zp0Fl1q!lAv_T$!TjhdM0$+}C?H%#(+ z#|dfc7Sh>+6uJ3Sod3+gRdVBg&M+S7YjJf;^K+ zed&M~OCXhsRNe@;_=%$wI0p4;Jq4mLcq8wcnb}Vhmp3ec5sApVNdPKwSFiTk!z)<{ z23bJUn{Ly%?OfcZPNlpjACx)1#!aOt`j#Y$#4IXAemZpUL9z~faaLQ(rp`v1N&Wqt za`AJiGJ9#`!w|1s3UEv+!gz39l&5Yfy)G>3YcCI+&^CLmi3d^&=mNXfE8*>@z%$cd@)m!l zUu4RZ`plu`aP*1o%eb>Ybqg1sUOZEucJD#EF4NC{|9jH&08qPYlXCe#TkJosJ&FK) zS>W}CcFCVKkHAXtN*aXs~3p?05Ot+ zUA--su13E8>BUslci+R9p))cM?RH6Rr(4xxYF-r{!dDq&k>C%NN`;k7&*JWR#1{z= zOr}In#kMVtpzU|#WKC7=PEa)D^vCArdLxO!{Sy+`-fKR)z1@df0YR#~$jFaGh)D}doPb5)AJXXs9X z_E`Exb7^4%9?i*GmDwd{=t&6X!Zoc7n6K1|1Bvfnyt6}fIuTJ&U9 z5uAh;&9I2%C)JAs$@v@x)vZo=fF4@jn`o~=WXxyqlkzmR-Tvk+{FD3>+nA>z^hb~5 zD4X6V5dlp>5odh-hVf+U&3`@T><86K5IkuBEVY1=r!}LX+=T}<%uPpkte6wf_Ue+vWZsYmn)ph@1 z*Y5j`o|7Te4zz~-gIE^BdVe!_V{6GguN5XDbm z{ku>1_Ll-uy3e;RJv)247`0Sq4CLkn_gz6Ny*y6sv(*kX5ms;LesLAfe8I2?5KX1Z z_A0{2GI@O+(n2w5%)6}`8EjNsx+S9uZL6GGd@Su+!a~`yW&%SfZmG*3XA|7PQ|z2t zn(5YzWggRV86EPK+6w!d%hVAMJ_I~d&)-uLa&#ga6WdEEt5n3x0 zyXoM)`W{cfV^TdE(u!=xy`RrUf;+-_T-P7UUKRK3?n03Mqqa&f4!G+k8-=pFz?*z4 zq+CV$Cj5GbM}D4I_?LBXXq{M8^(!uo>Oh@W$+K4ltaY`j9TL6-Tx*zQoex?N+N#W# z=eMoD*8c!zVncbg|7vCBJNZf6MZuhV+;d7!43f5cWj)UQ7(NGm)2% zC$p4Y8Z4w=n0;gxuCQwtczCoU9tPH<&eYqWW7R?T{VG1Y>Pty>IF-D5(bsw8bfg1t zz7^p}0}ecZ#v=^b+7`}@M2IqPu^$bKc?S^dZf=&8>b$j=Erd-(h7_|ac$ zT3EFZ*s~oyhi~u{oFHk5XHRcZ*>`H>xFz=TJ?35E=JI?4WKjxLA59z%cfVCE7aX747c+QjQ_ z!9l_8%5K-L{o+bp8Sro*u581k`^7<#52rTYN1*rCtr9VeTDiN}k#oU@FkR2x^6fEP z#CrW`iNUzJdjdT!ewlfO9(lf{?d?@epeT*-n-JsiBY>to#VDN~ZD5&EVl=yg9+y;StqQpCTI8|xm%?CLQBXgi z?e5LjncIbAs+Mq%%dM>6+vOv#dmy;otGFEq24Qw|ZIR z_c!P1o8eTEq;lqK=E2~}ZS!Cnv%j0W$g|V@qSxGx6WDeioh9Me8+VMUSdM*ffqZ!S zY*p#k-2kjPg4>Vm;--)XiXeVJ?yx?yy7wo5-3IK_-B00Ri+w$pkMArRbJn zm9wU@?=)Su`Q=7T(>mX4o0^SkS}~74!r~3qur@M#v%zJwdzXIZ_@_+8oiDz&j7*9N zBWS#O_HhEOuv0yuqQoL0LW{S?_TUh|QjGveE%Do1z55i_iSEd<>E0G$D?Z~_2CTYs zl3vcmXqyuY4K2(v3kIIpc9P@qz)mKkOEmXwBrq@sO2;YPd)?Q5mNV4A3(wUQk{BxN zY>hnN%T(Jh_>wJ|s+y_6?B;L~+BNRjP20qwl9uAIGWB?9(TkKW zOdi37w0{SZz0MN#K8B}tgLoY|n^BqqkZHA7FM&&)2(cXcMY;nydfdRY%d2``GPo5t zHa(%9(2{i|g(U6}3w}9uGv=7UfwAT>mErD9hfjxBS(m&V@_5G}o`9+z#PpiAw)Ts+ z0&HK?GabnFsqjpb?VL>de96QOU{p~{Ctbx3cyg!vH1+jS>o4t*YBebqMNEZl>4 zMzDs99KiHhEgH3Q;T8!AD@l?DQD=_a{2TyYnYD2gG$c-NBmYYvg^DthBG+DG8_RTC z6{u^*y%Et+c;z3C`ypUd^%t9$Pc=yO>cdyNQ5?JT4L zER&^@xOlzZT4^5!+;&IFEgs9h-GXv-warL|cVFICFdhwzRfrPEF7?WzvDEC&vy#Wa zFCb^Mc4nGC8ksb<59uEPOmb{+cjw|O4sR&5OA~4nL=UElCz6d1w&M-QXn?^H#cw{( zK*Ymcb)>+!(4LCT94e=8_%QR znZmc(P4!vr&2{W5r)uiTejM~nd-_zj5_8>c|8Cir?5`r#G6NfH=@AK?`dIz|@JUgB zx_rxl1O2V7ug_g~s@w*a&fx&s5gRRT4T82YeH$W33vJIlmi&>M#?Ql z(~@C_<6YGb+}u^WZ!Xgek6Ym*vj=1lc~w>ib2v=J4Q}->1mXHLS8ValFIq269e1$~ zQe&kL8b*oIU%aL4oV~wzP_|wc<2b{aff6>mV&%TGaF;taM%0ksW^$!GKk5~&nQ1?# zX2HXIyvV3nyU-6vbcFbc$edHGlVN!0GIspN6`4b;GP{{j!-jq2Es1v$1nL}H5;vFqR2a?^TdmKkZ_-zbTa9ng#$x;mXef(Cs*Q@(>UtaJovPRV${uAT- zmJ9?rAnB+B^t6Z<=De2#~ksd1mD58@3oJ=f(Utqb|XgLlz#wr z&;9jRYxP6wvf1NkD+CB4UMOlEL}9Kf^$DIlASW7% zw+9^k)JE4iH%_nZNnqg9M6Y$Vu3a-&(9RS=l%_g?;jK52S^*{jv~_=GgoUh7gXi7k zwrIeGt>@1TJD3iaK41j$i-TfWAAW0ZUx@Sa$VWwCC#oyyzgq3Xb_AwZ^N_e+WAa9X!+`Cv~!2jTzo$%XT)w)=*gA$ zGh{NL2k~P)UfZK4ElB3H2+upun$_Bm)?zmk>{zF2Dh6clXNs+tQY4QExg5(DRZJ?n;>buL!b&u~xrUtTbxTL7B!lnb#scE^M2urVs-S?Kd%!@Qm!aEx^d2k8QcS3L;SX82}PPK=tNqa^YO!4ILTZne>A~K(4 zFzUwUSHYW5@VxfJOqJ9KM(L0}yXNQkO+qh3pHrW2idSzV%{|0(z-zq9y@~Uo11tka zpuHXiUVMbI!Lg~1Q}2SIV~sht9GfOx=Q)xqW==}aMRW?M$i>v(^sx`MpHg5@X~Zbf z+PU>tBt+H(k0D7TZ(H+eiE)%I2|Mt9E65xyE;KRU=$=O2#n%H%2%N8o;fJ&N#wo8< z|7y~cWP(nglV`2cUJ+Q;js=+8!<088HJFsX``Ufqm4zC*RlI22J1g=Q^3j#Us}Z)2 z>os1|+zFMz^=qMxtuwTw643GYJyX5}Q0gs!&A&U%k%{N9IF8kvV0C{j$C|JWb*5Pk zehLQ0FSl)P9$i6}e3=-7AHb8M*S8#c5UWnP^6A^k)rU~AEhCK5{d&->ComY537FjW z0QyaYm5N(8G|_XI$?L?vd2(-FA?)$51bNB@jyUQS&leRdp>^=oSD&dwx3kam9sscx z+|xlyN00X)-(v_Tp}(ET2ffLuS*n?)5Cak@QBRk5ui37^&L!_#Cx#^6m#vQ7{Lr+~ zY-9>B9)6BXfgGghmcEi5$kX9wSI^lN(m(ctbjHu;w8DmpVzs1gr$)-`?b;Ni<1OoD ztZI(SA+cZ^D|gtH!&pA+dy1lw1N-_%n;2;ACqs1Cn{zzlU2&Fp4VT7_@dDYz;-My#IZ|2A?Vr(wi%Vm4DhJ+!$WNGD= zST2W_;!paY$l_huKBre4-*@&)k@+Z+LS>VhTF;i6&OA=dZ*Ac&rR}6(=6i#EKM=n& z+33X_4#L-*9r!?~Kec_bFQ37{5Sv6RnG~8UbXdhpRjT)m4=8ho+h#g+BnbHvP4#=l z?Qm+yn9GLM-p+XO=W6avB|FPck(~0C5)88xa-CXS~UDq z@!}IgI{hq6AXJj;RB68sHGa)TWu1VkcomVRr;bAb+abXu2H&ODvF)>m3NCP@sls> zd94AZ(Mk;-|DzY+i61Fq#q8w8;vB0c4wXgiF{m0$SDbhSOhCR1V^#5c4)>z~_h+l< zEc9p7wLUk?MOlq&p>4?Ys(X8Ed+u_#y*@sUOt{=t+*$pj%JavUN2=F>f|Fcw2kP$Y zT1M9U_FMe7?r(VxrQhkeF4to=DMLXnK_}?Q?VF{_6l`85GF#-nzqceNn~REC0tSih zE$1IiypF*vmv6>;JoqwyrPoHFcf|)bCO2ns;j^KyeFYGrN4Qr75)|HfbVY~3k_qxf z77Rj2X|shv{v)W%QMQXB1Q&=!%s6!{6T^U*Xnd^~F-^6yok{J48Km(JrV5aqpBL@_+uQwbGIo4`$vTbE}9V)SR)*tE0T~w+#Hz?Oh<@ ztP@C;20Z-j3?gl=6;xFEbnKoNYP$2L%7WT^7OR?4hD%?0R<_feAZ+~Q@%&z8UN#ko zjmD@6&XvfT4Q3cmWMYc4zt{BCkUKPYZuq(QrXnaaOp0t_YZo5_gu!{!gS2pr6;8{6 zj=BQu+=)rzo+oG*hv1tBa%;-qsl_)Oq`WaGu}v2@-3n7Gu;fhPAwP~#u{FouhRCKO17fL+=K-=9vu$%nO<3adzAGdLCXxIy62{25lFM zBl#@up)3bhEtPZk-O#LK!-Ye!EBagxb;&;ykvH4` zg5#m$c8WB;;ks`=%p6m=aI6rNaxuAODCl$BV`kU8v2hg+C&iylw3?hH7uGsE@= zBBp_92U=pIO-gUL=cp#l`~ic6^P0RdZV7A2ZDR1$WI8%eiV_XOD7)FjQuU;_lUU%= zptTA&1?m@L7GG{L%WIVALBDdr0^5!DWUZ~LUDoX8`^{eC^K2&@Bd6tOwTh)d&-S%J z3eijG4v!5UfjzHcQ($(_?R<@#8TIO%$3A3F+g{AKlf|>zPShW*_VpMxDdJ@$i?@T* zDVGW|fx`|(mi^lJ1{8nlP?oAE<5f8f{0#+oUPz#P>_d9mnS^t$P7s5oMG{XOrMdYU zuC8WUv^ZF?KxZDCAFE}z^JJv@=zQB7VtE)@v3cE27*h*CO1}iovZ?<96mrYq(>8;B zWk$lTM_W7-)w-MqP7714f^LVU6n4ke_LvwtblqX_2+5Hi(q3lqQ18=Z8hn==+z~6P z=tqh=;f&+4fJGZF)jm#a8F3{U$&)vGlB-{Kzb}W+rVA70-M9WeA@*DtwL&?Vvm>L% z;2+gC?{6eP3&?l`{b{Z16A3L35c&;?7~sQOlG@0A4U^qGi88*(4lDOmnc4!IO&w0V z8>+o2H3fwXiQ5wG@auVq`oDn9=KAWFJ6M>^yk|xG3mOev$TA+dRHT#mRfo0e?$_3U zCOUt{BpC z;=Qq?ze;s4)If@qfy3+A@wsI`sh(Jyt%6N)w*&HpA7pHwO(`jQbH1PdsuccoK{6AC z+$@FU6`Pv#h=pP6;9_o(SHGvF;weGui4LI<@ssZZCUU$wwh1w)o9Y`k)b{`bi8U(U zjuwY_b$N~*2EmS9gO+#}ljwvTWcXm~>7sK0FL3h%o+G@Lb$U**I4}rzsn9pU=sc%U z#`I;v@RF9wbPJ1$zXwIa>_HnhOB=!fPH?(e5As?Dqa^`b_$yyO1OSuuuAtM-Snut0nedMiB*tc_t_Gb_^edBTT!Tlbf^f%PIXFcu; z$y?0i4DmQFT<*CoB0_lV4-qm_H483BpIw`5TQ?E+b+t%nwOj}ukKRHT8F$cPrCkzi z>eKG~zq#_4Xo2ql?FBSBKH{`E?j3MV^JsDF`6A!El3SnrJ?XBIsKSjrUs^stt(O+_ z-BU?GEYzVh=&;tR=bC&}V>iE0r3GoZE{WJPRac4Ayk<{#yt$C;n;?EvY7Nzp>(co} zbz^h^n=>zMNRRCedgTQ)RWY!)hi@0vQ5n1s&+M(S$0r%Ld{@quW40KsMB$wc-qYUg zn)U+s%?djmb20E+PM~wE3k*tKGS!N@P*p0EoO`9NjQQyd35cHHU|>WR3&6-+#F?0p zO4Jm5tWfg)<$e6*O|UD;wR)pjA@ah<4W^$G(NF5m z{SjFGhNX6&M%K^d{7)n6FBe80Xg%KppR~qo?6g)=G+&c%M9ITCEVIV8a%cq|@%xoa zL4~PZ{_iB>eK7^HK3QuUD>Z{08ux-#xu^yDjx)oaA}(hdJ#ByMI@b?mV5B?@B zL5M;<_Ed?tMcDaXv?2ZW=*~jxxEF&RzBBK=zA-&}JNZsQ-HZWRE+~pHQr#bB63G_j z%&wBk-GbmqAh#T)7}YX!Qgum=#g{8=Ee=GPu&c+|y_6ma{+!xd;v0*h1cW)9AEf{r z%Bni8o#7kIYcnPc3Qi@Nt8)@wvhu>f^0d-&U9?=b?pJf_U5n5ObD>`exN&sZ7C?z6 z6|>!eFr+u!UF}idlf+Rf8HT6FJPMv%)Rq)1G7GvK>fcxGYoXaWV62V-O%55f~zhvrx*j)d!po2 zhlRc0k>odL2x>5?D}2k&FTr&F-|;>bLN zs;Da%Xmaa`C<5cG30r*)G+-b(I7Mqs-QOcfYM6Y^ZByz6fd&b-myy2#o<`ya+&L)B z;TmBu(|^v!2iogyGQCc0=%;Okccj!aXhi`bufuwuMW%Lc8bRpQEvz{66`HIE&7c+e6$)IA_6@cS z(yon;c92&B+duZ)H>Z6iw9;;;eTsJ_A2oa~N{ss`6-h3mm(Cxv`HdiL5K$969=77f zQB+DmPdJ)0s@3cy4C~ofaKXacqOu6)z^P&*NizS4dc73Y z%@9_7(8ejUVW^ToXGd*B)YQ#-jplR1q6gT%}gz*8qJDvwcU-5@wUG z8206zMAsunfKL1e3`X#&0Cd%Ayjq2t-@*bqQt+5AQzt!2`UDtYDQ7}Hm&kJ`4%(I= zn!VL7h*=dG_k}!m9hv)qj{d2IUm(iKy_>5y$ zj|3)45NAs7STD)VfB3yfL3qF)jeXskH!t7k#{iVlHmc~yIK@!j5v_>u?fg$zD%LzkkDtE|e#>utuuWGmz*!6} z&(j9b_9xZY+PslPwdwWgHftnQ=3o?~BGM_NTV|K*Fh9_?{SXDMV*EhEe_>1SQy0cb zVsNU9`#S#b-BNV`Bzh^BvFb;^)LErkU`xg6v$KkpJ8tfo+oj$hnO^TO8Td5Xn5mq)sa@28Cl+Z3 zvgj_gqzE|cQ$4Co?S27fmB#n$D?`O;#xEs%P!+TgpGs%Tfx-lm3iZ4ZsB&++W?K|z z_7r+Of?UORg1oM)P*kT!AiZepNHsxhvL4V2Ag1jqog=Y_+b-u`;pdeDDsJ72 zU>)=^TZg#yq9YRMJ(2~Ixm}0yX+%%o2J9Fd?G)x#2jeZ@U#g~!SgAAm-34arc_qWsY3teFeKd!#H{SC-N^AqAz zRa-QU#99lwszYOnX9kzeG~^V`o&aO9TV@eofU31R=-Exq4xN%M;U6`FD?8()RNVSu z>l9hTdEv>(A6|M&enXuIV&>1Oy;=o8SIvmLFXM=w>dwKn>2D$SgAN-r5DV-k`QB)b z;Y=>_Pc04A^{k9=tKs zw2td6tctqZ7v}2(!C7MYkscPsvxm2R{4Zlh`4pFRXCx0~49W}9Yda=TZ@M*d+rphwYi~=S z*JM2+Q@?F`-bNbHNk}z*_x-!YfZ9_4O22a&5{kNSAw=DGT&uXQ3|P^ zSEEmt05ysX@BDEU7=jL{k){c%l1@WjtV*lQFK%xqhhXZIx=BkzFXo{-!>!3AZZpQ_ zPevC7#pTOi=iLCgZ^M+!RWB}nE$xi$rZgYiyd6Bf@(?a)8#s5eG`yK4kxamzILIZ7;hDGJnX(+Qi5hKR=$*kORS8BMO}7(1cK`FAYWWwQD*nJ^b& zBvhVCr>N>_pI7=pvuiT1*>NOsP*n2?*gC3)l)i+BO0=nD9@`qkeIwMepG|(4Pf@!< zAbT;v+EHD*Dku8k1avOp!^)-LHWZAAxPvFGrfneDFqd>01F9 z)@VVY7>H=E>-k#)2%FuA$Si`}AS(KSk=#rB54U(tA`ZL67_~2{`G^|C)^uU)6MZ4o z7ybe2UeyJf*uJ@8Y5qifYM-#(H(f&TOfSw`n;``4K{5MVzW$pzf}H=OsPbdY=skh| z_4j)J@X4RQ@xFb*+@cm3s#LMHsW6sqvJ~Cr^XhE*{|p6AgM!A?5*i?f^Ydx{8(&gSw8?%;xk4CVN z-c%KLR)b^y#7^(OYv}2d*6O`3cvnI6XC(9Onw6i<6W_A0A-}R@#Tj~f6D3i`_Y3>C1~~ZA;Vw4 z2>~h*@u54GI0O`zM=Y87q(U)8ITh!FrHcQvZ~yli!c{fEJtZwP+mHTHRH$WSD*y@; z*i3uHo+7sii~cP2uz^Gm+61masz2Z1kGSkTaGd6UoY<~qWLd3&AX9aA#O&6-GuL#9 znzl!;8#a_HFIG`|uC$T<@gaYP7T>slbHRGvfBw8Ga|sys@fd(RQ9#$#NP0Kx>1(pJ{1dw7U)dMA4~qn^SInR&B_~6j{(4)aAB)QIiK5RaC;VRfx z=by6u`?h|T14wA^(+U4QKlrCWfcudB_dfrW%3l)s|42R=weiBvOm3TVF9t6>bwr*f z-as3AsQ}Q&a*gW3CWfQ?h~Ad#8N(k6`D3>V2m`<{CA+~gbD+cP2C>ufFk?2(IszC2 z){0uhF{`!SSg+scl56>%FO#GBfblR42t^CpDs-#5=o;4CTV^i@98h@LkO)6GiAYb7V+3fTLwDCECFcZ7R{ENR ztgmf^J=DT74Uo*IvJbSbQ;5rD&s<^BE9blBb|{^@adiGTqGz%u%F?FVT0e(sb8*uK zIrOqa$1#e{CJKR*qulx-FESEDOBO%PRPkd`3DW#KisRmlOwz#|>vit^j9Vq1x;3)Z z@q&u_T!(K`TzMizc3}F82_G^{osZl&>OszHqwZwQ0ZQbl@I_GAg9eqybYV@*Ft_fm z8lZwdXQTD$fOsqI(?5IJWloP`@L7_c=2~Y#1@p58ChL7M%1OIz%DL-{pXCPT4T3{r zR#75I?vOtBllWTFZw>mvh(w!eCH2-QuH^=L*mZjE^G8KP-^4Tb%g%G9oTw&OaUt_8(54AKZs%Cga6k)bz1`1f`QG7=yDBko}J7jx9RK1e_Fy~Zo>tfQ=9EH2%R#OQk{_C)+{!T z!*%zBX$c)LT7-Qm@|YF^DD;v}85OgtwVoB3wY}V$j#is)Pbo%P4rFjFf?;9v;~n93 zM-?)ME<0xG^RwBwW2W@3Lv~h3Sxu}>4J#6S0`fZC!l-#FBGa`P4B(;-5evffMe&n2 z>G0ri8?z2X&50NjYTR93-{VeAe;2n7x@En8amttVDB}Mi?>)ns?6$Sh*DfkH5Tt_$ zh=3?1bWju!5D-v$kzPWPZm23vrFSVIDqVUBp#~L@8d`t=0fMv;T7W>11j6^Q_P6$4 zulw8Uob&6P>pK6Ehe@7U#vF5$d)!mnL%AzOyz$xBjf|U*FXL7^Edc1<@cQmlz`|<% z`Jd92O-2>3>Chk4qp#m93E~hnXAAj_T)p>w+TKez=t`CX*uKc3^oxhq^5%74QJ0`i z3#2o&Hyt7UtmRsFO7gh{O}Usg6Y*Np(oKzYv3fh*uaB-E;MIW~XPRk=<;WW(t;b$l z!z_fU=H_~VtM5fsMXC4zYIGu&51Z<_BwtYvcAGtS zCL|%Z%}t7HX2o^zRkduAz8@TAp5jNVj87B~e*v6s_vt3P9m}t_SBfRFz0g$q>9=`X z*jn5|6(qLW0dKK!!HjwSV35+#d6&55Sk%_M{qHh?@Rz%}=2PqYkXz zuZ~kAf$Lj4{QJ6-Z{L9iT#(4)!KEDEgVD)|Sh}`Sn(0^e{5S$Sh;y$Mp|(FuxNPx# z3ii>~#(dJn&u%*$)XGVPWGkt$DCqo3A_aZ!81N{u&E|t@6{66=NF%~;QP5%8LDPcN zir<~0J*kR1K{b=1{lQaz02^k0F#?r7(jDQ|N0mOpZ$kNvSfsschRaE@@`q-Mrq_bL z2a{JJ#cdWYq(oipl862yhs%sX3o4{pQ8>HUioEMs-FPxGKy`Vv?8;Ca(nx#b(ed}p z0%gg<9z?$BSv&ANaCg}d+(t;~iHz@lE*-aa&lnx<zc@t$;r;(aR7*w{Vx!1imh=ic(j>(+dr=ICSEXg%LUiuYpPOIab?!J)UT5zX7P zUWt-k{Btk0N6VD`q_9O6 zM_fZu+j|DAEHdJeFMli%dS(*416B%2caYAn9M%h_{0Ic76svkprZw;<_8E9fSayu8 zTdYqViVvod@}7Jw$u|w2;%SV2m}wBBe4Nn|b`5inI@cd6HksVq6HgPYRy9+sw+eO# z(VE&RC@1XKO1ks`twSe#EJ}gF&w24d%$K{n8`q;;^1QzKlI3id_D8ytiNTi9Q%87*5pAR?dP(jbfgw-EMgbfMj;*UFBhW;r9PysbO$039p|qzbDd(~ zz)D@(d-zufOv&8}eXLm&`SDg!FL6kdKP-xqx1mIQK}giR;ReS9D1~tm(X}o$U?>Dd zHQKFQT)A{}8+W(a&!EhhNS+*{{oeY+#Qt^y2$1`8ud*`&rqhPjeaj3T3Pp}EQd){J zmgsAC-5Y6o0^Kf^C^1C)e_wN4k=hqVBQu3inZrqwizTyw-+X*9DA@*3l$5Vl@J=H^R`Df+Velx z70>A&+-~>8WQUfpDD~wX#B#{-1ZjQxELt7KEMj}URMdv~j44&#i}kp*JY6C_9q}R^LW89~;Sbxu8+&k6 zTO25*G4h+yDjtXky&B9HAE#Vkze7ODy3#L?)+nMYr|O)d>f=lv-)1-oMuRy(flZP< z>O@i3?CvGwYR}&2LXZes_({cv=4m!6`M_$5jrExE+Fm^=ZaS?AvX1&V1OoRd zgQqHH`Cp$Ca+x^nupA{O&G~OjmFpvpjRrTg)DpxOO{$$6yd9lR?M-a^z5GO1bcsWj z^(tr&%$AMEx$Sebd}jrD@Q_V28P6$;x@amut57h?T(9?C_lqkd&?h3l&0-J+1r`+v|yy!s7f8#s~o zenkTw<(tdLL{y}_$j4b^KV`PXuyqKq(EG$frFqPiT(3C?1ijgH!UQK`l54)&X=pp4 znS1KJ91!*wr4gJ#5gMtzEV<+mQPCj!%x$|*NQrd}I$4D39`Tx7+_63ie)oJ@aG;_K z-Va|n6!2QS1LDI?7>7J3PO3&zG!j3iU*k$=o=1WdI*3n-#G50oJPa@v)#DJ=^!XXz zx9lk)qLP=|Cw|8)ZVphzal60E^Se@d4D+lG0z`jvtc{|uqkBsk7A6<_aURlv^B?Kh zmFSYX`yTskNxC>=DiL(QvlINZj8*Wy!zaU~ z@qJhdsRYn0u^vutZ%d+CVCQ^(19xlm=-8`H#UC>-?e}qkGg_nkzJ?*CP{PV0SC&3r zTNDI(RTL-5`_=Znq4HXbI}Rr1Hv0_B^h;kS4{pB?l@H>d_q#ctE+L+vxHcpTab;TN)e6cz)$nF>~Rq(=w5dI119NWQ;isvam~skLXy>>KrTV;$xIRh#&v zezl3-htPnuJnI0N^X_B`gHda*Zvbfcp5&vEaqCL!cJK3<`;|ku>Suy_@3J2n@#(hi z|FS;uUon=WPj4Or%IgE8{lz1SnUnmNJA3mLPpEyYdMJpB`sO!zQP#8fX1$$;5Zq<@ z8>P=Ji0QzL`f4ay?W-l;!dSwxl^<%p(KG5gO3^LT>Is92<$XO)pJ|2(&#+Ujd(IzC z8m=jMhSgyW*r$Ej6WT}FFOG4A&|H7iCmGZ$bxb^jU0QddRt*o1U(>%>p%rOi;HWp; z#Ek%F|KL9;4ix#kI2pLJ4(|5nPz>yylO$Xah0Te3pfSBm? zGBg#e><-6q>R^mKOI#OL>ilJqWkNN*$!CX+tz0}Xgn5lO9H_!EiMT`%`~{(z!PMYvy9>`&5M~a= z{?298J)1nf>plkMG;B__n%82dbBf3CR^Xq=yGVT?M)-@Jx$hisW>uVI2ZQSGs1keU z8tju0X_Z$vK!n~aB69^%BaI*^^i%a+0O98J>XWz-t5hJ4?Dn2bAQm3+-dxUSIr;*J zqPAN)3$w`$9Slq(MJybC=UtfqsUkv4w$|U=y~$#N+yF4dyOi2pi}u(Ud92e`UeV>` z%8!p4s4}**jGCz+NHKuwd&P#lUJY0!mCr4&Ip|uhg3rGEmi!LuHzNv;;SotM+O1XU z|KK$?fA*R;e{NZfEd~e&-^7%er-5MPDvg4aTLxn*WI}4>@Kxua z-slVoCt&?Ap(VM8(mkeulw-9fX1&|3`{`n5_PD&L;LTQjg6%-X;3%sfP&-7?bwxcX z_50f5lycI?t-&BUJ9JJ;=BX)O5zu~XFF34{R(f@&3^1;y4YM5sR{DSS!%W9)-*O)) zV20lLhd};g34$!@Ua8ln2lx|dN~L-q3{gP_jrNk@=s&q>E&(h<=vFEItSdm+?(&UK zA+ET3>iw1SdLK|?U&Bk+^Gv08L%t)sGqjR#4Kj>s-p4=fsB9*WRGNlBWOXj;tCnZ% zcvLum2%2U=>BV49h0RBApB8)tw>Wx*Y3cVi2!$N%#F_4a=-a&MuXXsAttiXLju>lE z(zbj>jawVSx7jhYI$eKXS8%$_MB)Otgyqg9@K|p3lh{mSBde4qk^{Ru3b{G*cr6gX z>dFPZIsDDHte8dYCS8AT{)l~(Lx$LU)-ZnWdZ`wP zl@|v#Z+~){PZ&jhSWVYL#)6G@;d24zYz5_X{9d;GH|Tp;AN^x#t`Vwnwv|DV_Q(3ec2i+#wc-Dxb0r-C~9U?fMkD5y^Vlbet4m zIXc}vRHt(0&(8?yjU;Dz(_CE!^D~o$X;lDT*4?hycPei~v){BDo`p4FFw*|*?EiR- zv9Qz&_Wf*T&9K$F+4w_faUZ_|WZC;MOY?o05@w+DN}Wu%g)G;0s$gc};S-rO9v}G* zno)f$^$2GlbuVcFNUGF^^vkCvTwvj& z+}Ht-kd&%M z1qy8H9lLJ#pnes>8mBGM4!tR;{9bDZ{a_&=u*HLsge*VV+rdDG5DsU6s$z?<O<&y^Somq>YhXW>Ae8qyGK*|W3<7<{{1edYnSdmns;=5sD7kE#q& z)nL4mqxdP9L%UCJL%M^o@9NkW@bUK8Ydx~3)kSvvZ0z-4xo~v&(Pzpl9Qw`?&(6WyKBcmHOVFRAUfTOX5%HbGyipAC zwG;7yR$S-5?}Dw;?F=dq|It8Z6&7vY$Z9$mWpnGVEH^07svjv@4EE1acIrwLwCR-8 zg5FaL2JMbHg!&sDUUVMUhaO}qnA&5N+A2u1f5zzE9mVLRP5qCcQ*ZhI8JU!971UW@ zH4ub{^iJ>ukU8SL2}4GrZt%8bP>}9k`&ieg=9G0gW1@h5L2|2FY!?LLJ!m(yIo=}pK`t|y6H8h=^c!E$Gmd6wVtwv|2OQc0-K zij;bw7Y9NM(g+llD2!THbG}b)Mz<{WQ@!s9-8E^kN-{%wKA%9i-4;|xrcqXAl*E2l zSB{!+H(c!0s*WA`2}5+dR=4z30l2&*3&0PQ75X*uC7jQF+UyJXDPhdn5z!GA9e!Rx zG#$Y6IrN(7gGXH@M1Sj>fSSB-(*fRN^EEcTIPTvQ;2 zs)>2M?EaR+izQ#)m`8o%QQ-I<)dI+a`W5b!->^pUE9i8XsP`-FM$h+VKku__x&_7@ z^xu}jeAW_w&n6XXhj$;FCs2ShVxPqj!*vb5EcGhvC=A9ZXg1K~9e2kRDDY>!4=OZ8 zXNb)ASI^4Y17b7nC8*Dzly;6O{*}j^$(vfgl)hAVV3#@m zLymuA&|$ZbE?iQ2m`eL*d8QOs*Rx3LPLqnmi23JiBLa3-(22gHZaNNQ7YN;B{RNN2C&XcZG_ER`E>w`ROwbMfW2)r;@=-s zl9vwo^|s`m_}=Wt_zD~9A`jT_6lH&0AueDylWM(vQ{C=uyYeYm($c*znYd|KsmJO- zZTb!tjDU%@jI%BiTIg9XrrtJwbd~>=GEJgooZ|j*nvK=gDbxN3_~6N*X^6moJ2wpg z`{g^u3t)M?{|(@*`P}Tkrn<7Qw6lUKg{xZJeG}W)`R>|^#rxZ8XgyWU)Y3#)$R1E$ z*y3m}eKS>AR8iDUgE?vGF#Jk`>!UC&%531?SD&iyO(%z$>nMqo(%aYU(2J#u;TxNP zB*(SP?J9`%Czs0EDW?qcGZs7BKXjd};T!e^d`6kF=j9$F8T5{+I5UGTK2N6o3G7$KM7BO?4!fpoJR%uZ4g^M@#`F2 z&OfNP?R`Jdj)fucV`Fr;|;p~SIPESj)5)z-kg6SSK z;=}s?D?|H_Pd5Nz6toT^a2%!1W|WSZgBMEZV6ru?AG%I3zF_C%R*VduKgGUcB4Ek?lhFVB7rDEEEUZfU=SAgz6cR8Gq#y4wpgGchDC9i<(l_WW z5|6{7sG&05x;gi4*{kDE{$XANzO;ZKi6EyNe%S2pxy~oJBI^^B!7`? z-2d=1{|1+e{0B*qgx-{M2-*pVYUAMXZJ$3zG>DT}G z^#7bR`p|)>IFnOYD;>*~w>us6`b9@K!=nd`C-eNSJ(nD;^uz-m6-M2JgFkHm!D_VEtsSj9LO&x?uYdA^%Xy?$N!&m>Gw;31+v!a z`0$5O`N!8Vt*jG&Jo@8nB@=M+OL7SPpI`G&%mR>-zWC=1{eAx008okGsCUW#B>}k1 z-~aE=U%dF&{Qyw~Mc*~;}K zPlmU>T4Dz-6u9a6=2=ls;nnt<_df z{4Fv5->^LUK(OscxsJ>c4b~sK`oF$%e+OD!jn3fsw^)o{N1j7)Q1_L8+lmf=btJzS zUOoHo`gQh*ooi!7Klb0YdVCjXbu!0Z?GNGk+t>TQ0l;IpCCu~D-yZ+5O!wact@y4> z${ppH{>Pd4p#wR8jwD zuHXN?U~e`6Gx=PL;=;TCvE#rW-kbzlY20=8{X4k$j~<5ogFbjiQ0?Egy7>_x8Gfr< z&HF!36#x_ae^s>3n$3LMB)utbWBqdx!iw&fZFl|H?vxe=y3bt$Xe{N%Lq`Pw{#g$U z>!aV@$jHA-$K`n7`F*pd>wswdtIXY>0aoWtX65O>FZBK206s3<9p`Ba#6~87CZDH5 zYB-Ob{Bgu9+bj36^^bt}*~h?h?mHGo9yc(vyUUid|HK0P=PYx-1VsHC%IJ^X%pC~y z{s+QcM(pI}v#vmsfpsMlKqXiK*e=FJj^1B?Y{io|f#;W*MUNb+e-+cqb-)N`>`VR& z4fYSgy?jKH{0oa<2Ph@OYJnz>yIiGef4#ZO38#wnaius78?O*r# ze=zEbkN%-y&RQPr@-@@g3&&0>A3<+xsBxpbukU{ZsuIH?XT1IdsvJ9lF1NKu9T^$_ zD$OU4Mq9@M{!^BLYe@8elSR}3;QVJ1pvlC6+RByt+`UJ0))Xou|99zq^BPcc$7g5T z0fG6OIyinb+R13iKL-255a@9rHI?__UvCD06@b(Ot+tZ%IPm5pvTCdo&=uP_Z^QW#P@K}A6R8CV9xFmUtIh<0pERY zZs7Urx>xsrxBjcvc=HVy?Qtm^`acG{0nlfj!yy+s|G&5e{{JfWVR~agEQ7Be2qUyM zsY%P9d~^{iFAxRdOk@bLj1Sn#OG^wF`~LQR$w_5G0|bD1swakl150ExQZBy}c=NQu zz75S&%>u0Sw*mkiDsZHiE@uH^_kCQn<|tzR^5m?Xi$4{PnU6{-{xX6}lq`;h%6CCf zUOI|=dEN5DTBfzpzR+y*27sdP@J_30$Spy=+_Ux5*v0@vjX$zzdzJbn`PIhvc&8RD zP5s>oS;%be6V}~?z=H)t&*gc#F29Gzik>54<+nFl@2v-KEwoXdzvYalbBF>o^a>cl?=jSoh4yPjYgxoLxR3x=|;&f z#s-Ph-JY#HnC9LGop(V$f8vJsOEg3$awVPL5dQm=-!`Bt5-jx9Tq8VrKcEV$=OC2`!a3md^43xT=#0^>i z$A~bnEbsFQWVC@Tt^Vfs#mrz6QVzRx1rEG9{zV6R7+mIIL+sbff5I1+EVQzZz$)!q zjIzCJ;gaSi25r2F(CT{FC;QAjyKW6uJjLVCpPj-y;TNwY@iMT<(+;TT$|)J~TI(1o z&U;QJZ@tR_6wynDEVU<@FEA)j8TrjKk-f3)D#Yw@EZqt|>$CSh7^qX)tV6mrT>REEqOIxGDb z1-U_F4Zw9fyMmDdlw;ATl7ApX?BFU^e&ypjwU}+gX%Wa0FCTzMi znKxa|A-4CUl#~S`NU}A5P9Rn@lBsmQuaTH|(Y#T1jf`i+5G84S<8^LQ7L^R&e@+Hx zhh0@c#6oXsWk_sUw;1wD%CW~uCR6wru^MBHADUG&0R?{#@J9I}EEcZ=pKVV8BLCr> zm6V8->*PE~7vs+E`-Mv_Pn#iEg%3!Cx8YmgKRwtY&phxXi6CC-k+R1 z*LXSmHQOKHtZo64jm5Kio3gwP{)Fwo}^FDsZ>*9L-ll2iuibZK)(zf|Vv5WLeWzRfKL3)k()ci|}X)9$^_g$`_ zMnnF<79C%9MG=DDO|-57OP*mk8+0f*`{hk%n+^rP0(sw_g(@Q^BiY5y&7D>GD?wEH1$8AYg6rkUzt!m z&9Ga-MTsg(k$qoX)oho#r?yD6IZyS$_3k8#iDcvh4dyO(!qYEuzWwK0CWD_%n%VI$_LAVfg+}&Jg;Payyll2nDv*w1Hkt?qUQwB2&aWVEpd}3tb3YE>B?w1SvjcKn3u3F(dTyC=t?#==0{lhKvxkWBz>&x7#N~#|(T(G2 z@EWKe)k(k6qeL}}We30s?p}}UJA@v`$ijIQvgU+bJh9nhftL_AW6j`#RF!OQQz`e< zB>z&urxo#D^tVd!ers=ZqCk=gOgJ8}GP>o6EuvCP_40;V!M(B z+ACl3AU6Co?2ge)vL{qJ<<@d9l3>#8dB$+*E5cpMRNZz`$@uS1|kVklN8D5y^-jj=5vbRon=RWn83R{gclscHJoq`cig*+#4 z9&R<0rX?R4?(}8IYON2v>|3lp=gm?srHb!AFv<_wuO#b)J;USZ3C%JDgkxsOB)Pza zc94Af);OPEMDo^tC+JQk0tUp1s1y(Krye(Vj&p?oLtu5IFCkSD!LYT<$Shs8AE1{2|oL+I$r78C~REQnU2c`_j6AB zwl7Rv@AOeJjb-;t3Z9-UU+YSjOPln^x>D+Ytv9SLPB=?pLxzx*ufNNCE%b>XmK28y zbVLo9O7&Mjo=_TbQzK>D{*{LD!J3~o-B7Hk_s;Y-K%JK8jk&xkMUTHtaL|a&l7YUq z0rFv6_|Hm`Hv^<6WHKjf&@*e36HSmPlJWD0{b$Y}Pb1(54J`wC%ma23^)6Xvhu$h% zdrzqTxp;m8u3z3o$-Zs)`E6gG5l~fx;)ReF8K{BlL$%OVbbUha4^GzcBG}0J8g`54 z3WjWwuFExpq@W+1FY7H^G{+oDQtnC|N-FJt>VUV=UAJ5cf~@CIHIrY`)@q5D4mKmb z9Y=l=sx?d$K}Eqz6up+Tn>y*rqlYzjCMvqzto>F71_gNyR&lQ}47bh8fjjc(vGP(s z)Rz28pZ6Gc{wAQI+%nd`FGG_A7^{f-UGS#O6L}h4bO+Poeq?ra=7m2wZaez3S^5`XDw17iu7az22;I+V|* zL*oIxE=`u4HXOXH-jyX8CHzsYUqT-wA^|!kad&>D z+BU}Z0=5)m(&#~Of9nnCdOII1`DB&Dp1vA0+;Ork{Uh>0QV&UUTq{Cr1*3^J5NXzF z#VTeDhx~L(n+mJSgKOuz>d3a_@iOWyaUp7r28Nq-c@O3`?m6YJs0C`^+@z5Q87U#A zLgj>;WiW z06V$Or;$k{Zze{{U*Op8PHKgc#ng5j)_0dMIt7`amOdat{2Zhz)|`e-{O88qyz9+N zL?@QCl+F*B_&IW|In%nAAaBzPB*Lygoim`PodB z1t(O>$~wiz27mQ(*Ty?A&5Uh*jyQjfSSMe#AjI)m-(lOtVLLhIOI2QP0Is|Ij80E~ zGw0CjrL88LIV4uV(naoTj^DXXE!M5ES;3rLkLtr8tmk3f7irp_4o?UtHJM(Gi!Ek0 z4^fjWb7$Aap}rHd#E&;>eIg>nm-th-OA7kt)jOHgX0$@B7^37(6dp?pCvu;n6C zzsve}Dnog6rte76Fi|EmOt<`lfDk6?JqL5I15kQ*_lb=#3g4 zW;ZJ#hJ- zQ;Q#`f0e1Ub^wS;HUq48&q$G7(Tu-$n7pEo@f8Wo*EZ+i^J*mB{r2JjDniaBzoxl& zR#fIdD-;yfK*k?OzXr((m~9G=mg!RNerF>tEz!G1iFnk5PJ2#?K3}w=ulH9K^J;WQ zU<^X+wp~sVFX2K2+?%OoyT|Cj@5T@J(K;rxzExgR@GB=n&s>aV)E-+=y~OoPzS9ck zN3O@adtkNu>vyurDxcXzL&)QulfEd^$N9bK^CMC??_eejxo)py(~z?d8TtfzcaYA6 zh}`8Q@?0AA!c*OmKC1j*}5f*APyFGT%M9ysvq?u zqSZ7~8z%c}Uuj%z8ER>nEX}bA+(BT;ZRCKuAY3(ZnQ6klI}mcR23lU4DdD4v^+P9k z*49BTQN=1@Du$~4C_fX#>A@ZKCss*pN>pqcjnkhp?jTVS*xe|19-uyT=8M_+^|t$Y zu|M^m-G^i`+u^fBnWg?nSR)Vt_jGR;Itsjp0o7O2f7Ld6Z zp^2H|1KnMx^2$tvLGT^t&Z^bwJZq^!c_~QAGxf}Tl#gY(=C2!4Y7_es&0W983t-*P zM4a&Mm29`%C>^eis4?YQ%$cSIk$czmVSAM3Qw9o+-YGWzyja!Oxtg#$6R0*uP|$Q) z-DC#I^W`u1$|`?%M@TJ?ke^1}R(P&!`td$Z5f=@ZSdj~4bBkdwdtuSgK;!D#q1GX- zX?a7^dI5JDQ?KPbnes64RbuHax$SF!Ut0I3CpgLQ_O(G>B^InR$hO-TE zNW1VCU1lIh5?r$Qv^mo&Na_{K_0%+Gw?=EMUo$N)OFrO1ZHpQIr#n>%YCAv6k|N>r zGs!>wR9p?GpK$%uH{7R9T$_FAZ%c_Dhu_Au7IOwwM3aA4ze}oHj8y^Kdqx60x-zNBUzt# zuTG4xyq|;U#HGut_r#drDOe&0vFtSL{VXnDmIS9oP!q~MKp)z=E%OGhFo2f7k75gX z-4!#$WQMH9P^37A{={@x;Oy?k#ie%%i}Y-e@(0D+CcEDQLUYw{NPkjACSpGC6dN1H zeIs@6eSbxlhIkAbGAX~%S5j%9*RAo+_%AytnK@6_3)>A`J0zYv)LNU(o%9*v&*mV5 zXC-Fsg1Xl{j9b{)*TEO=j6HHHhnFJHFiK{B2beYEK#%%mO7PI(jSmLX8heCK7KNdGQf0PK~j zteP3daE$RWPO0=#Uoxbo#DdF2%{j5T;B?cp5@0tOTrb4k3r1fF&wg2FH;0Eun?M|% znbP+6pewO4*;PZ0(CucYg+qA^^ZCcFVR0gWZod-xGT;D+DdfebJ_-avy&`f(7$W>e zeuZHE+G%S-@fD_7{OA?J6qWq`S!}O+=;1+lIccJ-i?2pF?^IlNyFLij=fozsWGp;c zz0qv$Ad>er3cFia?z<;t7_g>TRH+^OzxSpCxPJSW`0D0DTTa5NUnmI ztI@`;?&KGZOoXW5zZM*=s^j+Hz@9d5%4y*wYSIs=9dgG1j&Z0^>6@I;;lv7O;NB zjZSoYBE`%em3t8TgYCw^=DCmiU%fU~WhjWOQ9Vd)(}vLl!ba!9UYYPW!B2ME$n`B8 zyA7E{o&F6t35o(O&7Lx0HT5y9I%Y%{-iKdv^`79FZwGiW75VsSs~1?MIBZ@6!P9GX z?aQeT7ndBfXLT1vs}emmYnoswvyH|*fB6IKP95{br8&qU#liag=|bOX`2wC;hxZe~ zmbFa2BGcYancNjulWEwXd3PEA#U|2_o~);HM(iigfYmcJS)ma%T4A5V&H7YQqmaA5 zLu^UI?)-M@*{m;io3j1mSEmTV+3_gLv3YwXn(vIL3q|{3#iHy7C*{z_rU&R(9C^v2>ggJ2E0Js z@=Q=-cX!YPyU?HrvK!zva#&sx5He@+SZA@sIt><9in~LnwyOrYJL0&~)=e}@vQyKX zbMhu!EH0j(;2aQGSCFci6L+b)8g!-SH)O(*x4Oz%{eHk>o;#SI_sgjUH)_HZ*=LN8 zPa!hF#pP_ffEqa-wUnA>5rPtQa>lD7+1%=8zh5#%SfEV$9@j0Yg2q<>9}QP;m(zzF z7;Kx9yjjEd53RspK4yy__+Zy#OZpj8rRF}tC11#=a0m_UBBc|K42t}!4y@tWd@Zqm zWzvKk{GPRLtX3iCh7GHXZJy5><(@&Pb0)S=)y}l;_uMiO-iE_#FS)#Vr%*S?qV9yf z>FguR0Kjp0pYsmiYd)&AxhzvPFdF){u2u@X?p?}*dy5L;uSm% z>7VL@cWH2`nN4P4kY!!j6;9i^?-LeJzz2wnrtYa1Dfb_66Ll>kXnhX?4(CVi-?JWn z+D{SPS;YZHCH`_(n{l9WxJgYr-Mvb*FP~hPv`Qnlr~k1 zxJ|dx%3J~EaPI(h<=q4BpsPN8{8GW$Lk+Z8w1yG#pggUGcxo{CuZ^A~A{gtNv!{Uc z`8P?RI;(+yb@iyU^rgV%uU1JM&~QaI370C$E?dncG$pcf@9OF$M;)i;!gGTP@8#|G zPp0SD<;nwGoF_kM-7$N1SeaQ9F3C+8LWYvO16%Q#@1{yB3R+7gl257AnEGR$3F+>% z%Th=+~|aG2m#H4cl>Z&CP5#j7NHdhmqGWMIN~zx23{ZQ+rKJGUJ>vkpm?M-KUtwS z#hG(|7D{SEK$#tcUpI`i#5_P92{Cs+XpPyf)%<0<-VnOA zu@m&ABd=mBoK&b(s9qo)3kaTBscv6(VD9OR6bQoJqDBx9!SbPni(VEHm}_t&0Q@#GXPa^4dhakRK;u(;DW819{MAuAWXuJ-5->#un0L#!qV; zGz~Sz*$(SDNjk4+ZR0b$dJZfx@B4^e6IX#)&^?h*d(wi6xy$;ORoNfkqW^hj=R>%u zz5%W~K6AAB_et6>bk)~1X{KT#U%Tij^>z!aYm*iA?*pf@Y9rY=2X#e{4k9c8Wk9AbgTV&N{ab_v)6O z6ZR=x=A?dPq}1JreX)QEZ<&0aasd}l;Aq`_z?4=Y_%yW86$m!# zw(^^b@++PHReJmZSJ1a^OrnO+ea6wNA8P^pEEUc_+H&(hVULCY?IYpqR+Y!m`RaE3 zGdoB{!LuI)vgC=z!?Tr+mzGRU?OGta2*#A1Aayb!x6c45g(HZ|`WHrMJ6h_quE^ic zZl~R?*}4m0mS6th*QuKmlCDZH21UL}!5*EMo*D*?hwbYMw#5-P#3rRNQ|-Pr#Zr2o z;^!Ed(r!y#3w-hO;(1hXImBIgZQ!abM-5|axmbu>AG?$ke5w|UqpcE%1lcbxOOd=b z!le!ik6fy38@udtS|{%S8EW(>dwgs)NHZxBvM|yu1@W`-65bi854UCmskjhNaWL6p zGi-Bwx|zIbmF;XQk%^9uz)8^bFo5I*W0w& z6UYQPuY#n#(hurGAw9=w{u{~i`_q1gVOnmn3eF*Yzc>Ayl)RFXhyQX~B<;S!|M*&( z11({lVpICNJeix%ry6CL)p zNmwM}V7yQwGpWL^u{PnNQ#-zAo&(A&m=9R8%cGxj<~vjLadZA}hTDGG`D`0;bfI7R+K$sex295D5g=I+~DaRqB!x;q;9j8yjpMaY%+Za(cX&oW;(J?t?^ykjoQB5hmImy#&< zDQJSeQL-2#Ep=MKOJ$7yvxT{3JdiVa)IeuPD##sP!^%Gw)HCB$u#w87G>;jo*H_K|0Xr@&GEIF$eJjG*P_``3NH zvssq|a~}+z0ishQKFFK>v+j%oZN%N4^IYx;eR0lbpRIeI^(Oz|D=M;^9$i=9d^zT= zs)-**Ci2%?*gFX}*_!b8rG6Ij>jFn1!0O234JhTl{=jf8Q}3|n^e}KL1WoS|0i2Vch2KV-v7plY8G-He z93{j+*J9;u%0yb|-I{_~7u-Lih9<*0C~9HK_3W zlpO2i)cU?Wuw%!}c6qaT-Nvb#`=}{nNs5?)?WngoQ#8 zZl?Zmhf5CKjnk=2kGu!Hy5FiItk8_~@da8LCFL+?!QbBK-O=lrA)DB8WGYXNs((+# z_`dVhw)h4!hus3dOVt?};dyvFvOl@_>Ga;AJK>?AoaD30-Kj=d;;$H4XKeMOX5??L z50vbfSHX>fIe20gy=|kL2yZQl){>&a`PJ^pilieqVw#K#J#R4K-HwO#T!3b-^s)pk zbuR3Fs{@qqQP%c54Qn}8qoJvH@zsG(kkanRu9rITD=etNC}K&HXSQ&t(A5t}+Xi1E ze#*-hx9gpUCXEm-acGUH;*~^z#4S)+9rTZ|)y@$3bF<;SJMziR+W~$0_0!fQVL$Qt+XwG%zm&XrYz%{e~`@i?<^;>H(AVG2%*OCYz z^ayB{HF^3#V_KRrXwY(WkxF;0TTgVpCv9LB?i;gj5-~n7;U*zEtHR)d#v}jpV>eMRpl~7 zQ@(V}g>l&uoEQ({b@e9$y%1~uV?nbn&W$y`_lBk~p8Y13ynSr9gE>2h1HIqb9-_tC7FGo;d=x5{pe zuf?6jzGW%S+Sm``LKz^nQtM)ss}-PxGj8O%l%IS|l?r`{TXB-mg@_n4st0xSZWrIe zh?yOlr84N#Pz}Nwsk%FqxP!%T(c^JT=_pUw42vj|zETn@=v^Jbh3Bk1Cw8=vKV&W5 z`FsccJp+gE{f^}-PP=XwiP3&a*lvY>q_tDZa=)a{LS+}6?FAyozsp^>!+?ul0UI>V zo8_X-gFRoWQB5KnypNvvIQXpike78^?PR0Xh&qfuXkehvd4rVtk=fDQntC;XcK^g^ ziQfM9ebp(3ioj#TT>A>hu>Z{>NW)7d_-&rqS!DF>cXYm4)j) zVXB~GO_;x`ap!wWwOOv>wsLK9`TEOKLdSK#mOAX-@ov+Iz@R9j!FsrS@IXnE!HCVv zg1VMVE(QwQ_*6pF2NvxKqfBFxRla(&vsR`6XE$wKYj%W`Bzte!hI*;NT#7KC_J}A{ zf@IzHI2C@MVE;%A(1?mfuES(1T zA$zO&cm;QqT~JUyh=AKwqsPvUkyIqGDN31LUbqsZEA)qHa&5u8Jc{-9^bKD2Y^c5+ znsQ&Vxk%OHQk{wO&V;BonU3ftWkd$o0_4p?Fn54hUbQW;NrkJqHKAQk_X*$wQ3`aa z{$+b?S~3%ikdg99Ps#W&=kjSLE_?Z*TopLPLCk5C^KA;{<6xV8Ti2b12d|#auQ{#$ zDP>YNr%AeuQobCmuw2^wm^S5<3R38&&-;LamxJXf{r$rn`AKN@Jm?rJnXoaC$4 z*&7sgThs*8AL?)lkR!gZ+SP&EK0`e7I&TKva>O+Ox&)Rbn{{DnRW&lu0_8Lx{%H+U3R_e zqf7blnthBz47deILj`3UJ7)V@LmbBpC=lsVpPs56U}(hFB)v%@JTThKfcwp)s3B!a z`6Ogkd(~64*tprMDAZ6r#Xdnt^37l`%eVMGK$7Bq{T1$7Hdjh@{G32KPXX!U|#B zHudc8d6y2e;R%CE%@Si(BHZM;(jLm5<8|sSgq(<{Z9_d4H`HRJ;FeT^6TJ&!eUE^d;ehvdMO|(W0Puj_1XCm*!J>z$bw6qsKx*zg(ZP z6vNW*kuzK%p=Ffjla~%*5=}J=+9>OVV2!WUXI%Z$&M3X|Rg8gn;A67LG@h;7=h?3O z+yttXxHpi7q{+n6Dmf@gqS#=z5Gp=2K5<9q+v?IR%<6PNl=!M$#x1Xng=Uhvec`3a zUS#$h_}#^JEkFH;^>cRJA2nTZA%~crOV*Q%*JF|sqMg~)i}y-jH2YiC-HR>_)ii6Q zv%mg{QXl|%N{W=qX|i`#AUzsiEogZE;uLAw;( z9VM*k)DLc{FAzH{K3hI-?~w9s1TBtss4ULD-!$TKtds9zOm7w=bsH{AO_jvwobWZ` zbpr)Ie-=4eY=9tKzAI_ZHDnP03={z@-9!qTCV)17KEc_`+8JN2nO%02FnE&nm@jLK zx`GM1ZU|a2n;Vi4V__I3eX>wFSmICprL1tMHLh( z`3VA1X1UKI;&i0OcfJoPk0q%t~*t-(gJt;F=53CHzmErZMXy<(<(O zk45s;<G6u;J#0|lBn1v^zB=$0sBd};J}xFv*ID$B>eeP?byhfL1F`{neh}!e zQ)X#U0Cw<>7UWr!Bx?Ur4EcX=`<1{6!Bj{`?^6&4JAJsReC%CDTGajvyORBQM+6S|n5usYuHlpd0aZl_g?F%OC z5F1y`-FweYn4#O4(L5$msgf|o!_6uBym)gOUPS#<3KAEYd^<#n$u__OwGGk7rfv31 zi#Uyr7t~QYAFW3|Z}hq8Qkzux^_Q}iyIzZZ!oSkXuZ2`Ekd^SdHNoD<%fa;BDl}@W zPDs<5uJ5ZT~bsz68U zJF(X`RTO_ObDI?bi@Onxq9TcW8c@&H5xo#|f*4--TJ{j8B~?Eir&+98Gr(Tf`(3ZEsN&4q|ZK~?m+_M@%lm+w={B)($> zX!@$Td~WiCCg5i3PQ{HDOLu%rlY~i;^z_*sR!0E8WgVYoK1G&P*y+5#n}=MQ|0s8_ z1iMALb^Z>vZs!qyYbZa4=n!;tA=FAQZ75t?tS?m*KHS7wOr5`RdH(t8$)C9Yw-lG{ z5rgN$dE}Duu2R(pn-myP3>$mjbL7in;?5CUuNq=2bc^<;lepuFJ)GJLYXyPIDv7}hil#%>9MF)HSM z45te2$g_VCc~65&d<(C-WAbQf`iv|D(`07AU=5KeNK%@B_{nvpR!Pm3>)VYhOtD8@) zR@wWmi^%n4D=YJ&w^qm7WYKK4F}LLGIjw2V>)jjH$Ew5uK%0UZi4ZJ${TD(od~c~+ z99F(z6N^Zd8>9(iyhJayZn>wDNU@SVluI2H1F=24KVH}-iJ-4s?kSG+<`+#(E+>;5 zD=oGfwGs_|?3D{Zykmt%of!PB#T4T6HRko9cuq%lV@~dVSX~YD(6M5@oG1OC*FAhl z!l0uiZT4F3bI|@p&TP4q>Z1o24vTd7ELN#HhSsXcF`&3zu~g9|x}hFh7?xwRCOe*z z?9)~OsSbUsn~Uc7KwszdTek z?H`unn7$^TxxKepb7Oq+my0-5gqLlrF znzctAfI4^QRtNibyz+y|(0&#CPxz4PV0eiL)K+?W1CegHkDd4O3b^EtGTQQT=x@A( z@WBL$bemNA8%Brf*Bw`*Pj_|CPrJHLZPqpe#T-p~oTsJ=1r~rI-`o2fCbE4@n_>?T zfYDsq$=Fg8u3NlQ2Ph4D!7i7b6-e~?l0gwVK#g90c>Y1Jxwu;|)0=nHO8s6>ZXJBQ zES$K(EC85k!@}$a{dlxWZ6@Y*6hd3|9i#bPG`RV2UT4KAQntR6(F7k1@seBU3o8Z* zp<~j#3v7k&@^x|)`znR3&3zvn*c^FEI_}O#f+&%L$a@t;O}WX|4MTGblKEWy^Bun~ zdcCWf0AK}A7=4;QBpD;-@#1EhT0)2R=r-9_ha54S&EeRh4NetuWDCGEw!)mF-KKsI zA)S}UI`}7Fo~`thXr^BjM~&o|?dJN~h}rIVCJYJn36$6^yTNP_ev_G;UbiQd7m4q< z7BK>B-myywc(v4M!w~V9i1BH0cT~Hxc>{4qp;1ayIl{1g{?&My#p>K>iEer@U$Neo zT4~+&Oj&0A*&Cor^GT>CLasYLOjZQyJHh39xrJ_%(tVea zN(+-1d>;wXrXT8XJ6!#hggt>NDDQAUCGr8BB67SVpKDtvD06;@`sDS<>+J81Qf(E! z;s{)N3iJBfzA`1or545bJo6CEw_gO39($!N!|hjyMAGJ?)XWd^aWzKvhl_N$iVdTo zQtpmN7$o~$A6NyiM?atrYvF?WXPswA!^1L+2O<v2Tt-{3VjAAYPszUq~Z9TeC5`u|pW5B3hSGR{Peb zL%g72F~a&6%NHo?CJ-)+s635L5dziTAiIqUuTM?`68-kg_ta2kH(Ioc)0!>ajS&9! z(}bb6tMH7r#VMoS@}Pe1i?5W<@SBhEK%agTFp4i`;aq%+PYMFVuUuGeiY|7{3DlB%zP^5?i?nm{OR3+!vY;vt!b_r}vNR@vD1&mzQOe!O~;;!h^VmzS+q}CMWfcOd@VO899R1C^F~^ektxx`qeGK| zwwOVa`41Q(j*TQ}icYq!&vPGWuoIi=%y>8GwR_%SHto|jUE|qeawuO*51b+e#ohD- zY++V7Bq0wHiMX9!{|uF9j|yV&uUj9*7gDF(vTYO&iDEVC=O`%IeMhWX9(5O=#X)@A zwkPaeG_!tKeZj$=*_u7E%8;-K4$f2MRze86tNBMdt<&hc1Wf9?^KEOjLoYb@IFiV} zcn3b5Is49H5FV*gda*H{k^ur(D!1<8KRGdf`lFVz=fbsUI!A6Dl=E#6vO5KSkAcw3 zjj$fW?R5ut7nuLjGiBi|k{^F&PBh)x?(}zEoL8Iyn`FYxKo*X+cKWR0vBhrbLj!bI07euF+7_K799D7+u}`w3$t^uZg;50t$O~~ zVNa@DQW~sd%ZuGF`OxoW8{t>XN*S@EQB~V6Kdr!{r-3x|0qmacXju3B#K~SUNNnB! zs}87vk}V3`7*@IZ+5Z!(fBFcdmO)t|Ovy&K%atH(BI%1Th?~Oa$}l?sexv}-=U6Nc z+1_;C3P+SR!HF+3_V8ATgs50+@##3Nmku2loxi5nY*wiSlW=D5Nhw5#6Wpa&scfaz z8v!8Z`Jr($>mfLsYjt3MsP01P#AIH@B!dqIX&6NS-{3pCs?_d}Q-lze*1;@WLi!*F zsrXDeFaoZFM$3IC@@#*Oz>kCdbyHzmx%rx{ObhEOheazUvI2MQg14Y$yv)_PXwETN zOrb538^+=@Y(8$kY)QNWnChJ9yu#J}5{!~n%wLT&P^*AOr3JuV4HB@;pG48e&7BJf zmPq3~vK!y}HxK)EeNI~Gyr>~S~s37+EBu9}B z#*aZd^yBe|Ta-Vei*c7*Dqtiat>CTtoD|7&jxVnPCWxcq6aWKt+dcgVzORP@t5n>} zAIJ7dyKPtIC(nnYx~3y#*05Vlq+By$^c3Q}sb7R7m8=2UD{p;zLd80+Do0p423gF9 z@f2EYs{DrC{17^t=ONx6LCscK-OuzrmN8+PWegi~0NNgSTRSi4Xk3~T_sY+w$IeF! zqa%9;9Oav&gzHPdX#&`MPsNuE+hP0-JUIm_9Paf*{fX`J!rh7-x#t{~>&hy7jmDfQ z6o(+}l*R?ju}TMEwuYa(%$*+esV(^xpQLcDHcTEC)O9WD5EP`8)SoXBqK`_o(^pJW znsVEGB+;lA^9#e^01;YT?rzE;!h#LNmpk)N5*oBI8ly~IvLyPwrOt3aoo`}Cc+T8p zB){3Po)t&~;D}KKw6;k?b{46273ly`kNdZq>_;MQw_f9GBIe3Y{}AQ7h73A6;0B5} z6=pSkz__J@JvTuao02s#hm&eqqHj5cOZc0s^Z(XJMVYMUCVnlEZ!@ohw(} zfij6B1iD7R0y%)tprMBbh}+LVA^SIAYY+NIG8ekLR~1=kQ>!Jtexj+X;H_*TBYCQQ*wSIfd&yzv5wm>~@neH4nD7#!(YZG{dw76fg_r3z%D{`+z^or;5c3UDl{rsZ&kFnn9{uy%o zz3&Kk+I{54f7Ol0pqrLo3Gyv|3v2vaQ#VW@@KO2yh=BatNBU)f*>0Z*-o zMgYIAX>5;({nyQcz#8LKVTh&X|Bm;6$NMu*`TsBV{?6&YaM3TM`y0dj&Oh%#FMMha zgqPw!dVKx9EEyRP8(5Ps$$yKy|6|$T<;Cwj@_+dIR|)X@R(|E|-%0^~mkz(|3=<0o zaW>iUx-|Hq7fN{#=^va3n-&6d`Z z-b(pg@&52!@!OU=qxNSmsT&KT2@>r%QjB_L5=&>?=H9xNW2ChIu&MrfgIUnAPpsCp zI}{|TKHXX8uu_~lpT$r~zS_^|(|yavhFwpROnM^jd38jW==Ot;L_eE6{wkUOw7x*e z7E;JQYPul)YjFHL$eFM#l#nQkEh z6U97>KA&~Ei{^ybw~^4t;w6al(dQgJKOjuq&BLFyE`g%`CeZ&@8((FB^190%Dfr@w z$2J~^%j$cZmT~&KriS)a*9`2JiOTT<#f6sl+k}5aJepcZR^$KuwZDGykU@4$Eh9;(15v!pn_bIi z5+T87LiLl@G|!1iS`&m7Aq^^F6jcn*k2?OCa{kvh|6c9UG4N#HH-s1>C#(Iy$>h|o z`9A8f9^=be%@_b$WBiC&kA?pu$NSf9ZX?|n^XVSYxKrR!*k=)wiwI#BJ5Bk>A_558 zK#$+ezn}8E(Yy_;a7zZ{DrAo=l$VTX_7|NvEjRnvOifQ840n{{`7^uA6FJW;_onP# z^vr;%=my31(|n@Q%xSvaQ3~;{<@Kzt^+iNH4zI>+m+5kp3PRsDZ-yVCG?1&5=m*Vd zHrgMEhG(>o1N6zgLbc(p-Ti)P@2xN1+o9))OM7UOPVE=xD5;8_t9@I8u=&%q0*o2* zH{Buyl(XfV+zcCMu5Xz#^2B2D#xtIP7G#%cYCcnq8AV|a}n zEK5Ga*Ep-u>w-9BcDDEaP z7n=;5neR=Lp5+f@%F@5a@Ui<3mJ_&v^bEL=@A90%;zyHXm8=LGyvpK4|Fld~j-sv$ ze=>sGwK!)gqKtsSw)cl#M^s+#W{2>tGV@_o)iNl9XgFov>V|*Ey%>lI1sa~~sx>y+ zk~^LKq-{nibWm~8sB%#yTOp5*^e!>c&ux#Fo5FlZ9qIaZ@>Gjno7EP{)ROEOi1Wh| z+%>l*7we8D$U}H`EowK(U$ZX`E#^CK!Ww-p(K@G>r={av(={_mAREZGuD?;K$8Ds) zjGX-~@Da`CSU2SE>FOJqvf}YZ&V?YVUG+f-y=tklYMBw^QWxC1E}=b=#`r1AtFR}c zvrceNml@E}X+COvGtfpNl7^3rEn6v)Tvc_et-1_exIU~^A$o2==od8B7Rw$Y5zoOe z)fn!{vzb#@poBPp&5#Ro))aj%QtCF_sqZkGbZ%=Bm9HH)?W;_x1%35*>Jwxp64hd* z7a1dh;nnTYEC%ym!Z2EoEmPoFVZTL_e_DH(r{GPJrhSM&UIWM+FY(J)U2bdh-TinU zR-dBji!rFxOpvvOsoN`zm6=U;%hl;m(!Ngz*@zCfP=Hwb>nz=)&B;(PD@TI9Y&{lq z!fLHZyJp)I=fm|#EDCXvvG3mwOel1|-Bp5~&Nc_^wvf6TI({a4P8i=jNX|FR@3j6& zJ>zmu51$laNtoHxQvbq~&|~E6{AhZ2SgS=aeO)i};O2(VKhFP$DsbO5XdMp&fE8Vd zsa!PY$-}&hhgT4IL4m&6`FKmAjS63$B9w;IH2g&E!ha9aU}PH*(V9TnHSSk^HP(5l zXg5-KFN!|YZ7|tUeq|&nFI6&j2(d@1SYX+{u0qY$9meBmRm5xz0FXgP<;}Jq>c#3e z#!JZaW6{SB=%1Ci=SshDz4Juo&Y@1((WjtdanPxxmX$3II(ySI=ucVnw}lUq86a%0 zonhVjGi=Z3TCSyeaVC&U7{{%_jIXkGE6b+Co!nrS7V1=C#kaC8bEsU=IqfgbhfpVA zGb30ThI89~lp-EKQP;b?INw$F60=$#alaZ(~HFfOuK?7 zr?KV>KfVZp4s429uXilb7slFl=2{9K3gIw~Sk;8QXP?3{@*JI&Ug{vOm|iS_GahWv zmklm{ z&0x(=9AJyaZ|)QxLGw{jQ|qGUL0im=)k!$#lrV(X(SR~qwE&E&STt`QGUaY+d39Vl5$3mzb z+Zf)jMqA>2_iI2Z?qFq7kZGn=<$92kJEl9g|F`wnDChU@x<#?Fr zSoBuN@M1#6xJM^Dh)EmUU6IT0T?qQ!GBAI)pXdJTl_~N?H>sfN84JuCkFH$3EpX); z=DRC@{pfTP6EgD+`TLv3YxtDvX=(-TH>!MUZKlGk3s(9{%u7@4P>o}_%bUNZuiqi> zOJi`SRi_)>#j!}Cl8(>JSnsV1$TU7xQb^rWt;P7>5|S`L3c5ck<`gdjz*zC=N@py) zu&qLcoX`=OT@+pP%23|8(+84;YbSe4DWI!ttGg-}l*@hQu|l3=fCDG1U}tC9Gh$vl z^|h9vd$FJ$7nKHUEEc5B=^#cdGV2kIz9tG6N^i1I8gGpqCK!{%Cf}G21WAuq0PGsi z#uyuIYncU^V_=qtKgGAvN>MZ}i|vnJ_=F!gN9le4sA)oURRNNQtDtj4$^-H$G?FY( z(x3ZGF%SU`{V>2d`(#DbyJI!(8TYDJ35I|`bDqX{mprCQ~ zM*vKCo&qZ}ic->em1^;ke0t#i?1FdwgOXq~; z=4c5_wbVF;%`E@5$z=A;W?b>>R_`ipMp4~8Bm}g>t(fC|pzKnDl6eB-{94WO2BQFtmqz0%=;*+R9w4QQa~G9NvR5#`Z>`Mbx_Mj zZw6i(X2;S_SZJe2V7ftfLJt3ug>?dqYUjMWbE4ZQk)80~|KW(gnd5Wfm9LZ&M9ANv z%8y=LqU|?!TO9aPYgE_(JcathQ$A)GwZ`pz<$Nd5-6CPgvc}FV4LVwU>r_(^WjjpY zYtrB39H0nK-kPU{t(r{NyJ9;dB9b$@FE&Ebs^VhmeMa^cyB;9O&(+d{k1nX?a#L?p zx@9jBv)esjgUU#sS5#DB;LzvSQGL|MTV{d&g$1~hO7u`>#AYd&9fwv{*o5aCagcVn zF)=voaG8mf*6z=nrD;rzN2DE|PjCODH>E`tAwuyAQ_K5?Smn1Ci)RWMW`b3h5q%Ld z7>=Ckd?e(AIHbp+RrTb6 z_Cxc{DCU_X#O5AJ?LE|i9@kw3Ej5%1K+_1`0TYW)&b!CjRR$4#4tKuyC38uYu9dM#AyES(Ir`W>mVSHD3$Nm;lj1l4rjJ(t}8)0?sav@-{D&^|Pl1on|_c>}4 zd))agQgrT{w4By#du$`h(WFP ziPpYmGL(;pkU5YIA!Ks#%@sh+j3$7flMEzGs8tMbQ7EAe=1eQQb~ZPAZJrozZRklP zzV)-z{~o7dBHGGV=ZwiHlsU>l)EQoYX_=W>`tBVDw7fJhPl#jwFZ>VkXq!L9d^z1momJcFv-Mb^YQq)1{bH)XSFmbB{)ZJW zMfMi$aWJY9vNKjEbGUcH?4FxecZ8K0kH&f5!(ZOAsYSus@=6^wo34EU45~vsNSZh- z>fYw`+!oQ7`w+_o45cg7dBO+Atgd4X{&WkrlN6K3wkAH3oiUK~P;&26>t6VEouy*U z$uU;T_lH)N)mvi{9dn2+~d>a{bV%WZ>LpgW*2#cma_2JTg64&c6X5?(+@6TKBh+#w9IGmuIPA5b~ zIj}Ykyc+EBw|(%pG!#&~5-C|p{-=5?)8i{WICT!#@9EQ)pM)|QNq%^ZyAr!7I%dBt zp;oaWqcuzO_@12&tghb$V@s>VrJ3d+O})yhCmTn6p~03mHd`@IqC{WfV0cT=Cs?NO zTj#*=^=v5WsvuPSH3a=3t0yj_X8K{t>o%-Xo3?B2b5%|U1d;SwDr*Oco|4pZX;fNT zS_eD;8 ziG`RaNx^GOLXEs7tI5>8b{7mUYE@KQ_}wqwTP@LN9;nKErJOuZiD5T?LGF!S)LN$_ zt{qPCEsJndGM+Vlbs&GGJG)TLvS?!R`oTe>x8w<0bsNQA1jO>}VYX61@X$f_>pamV zM)lWPCBh>Ee;Qd%=z-M2sz?cVMzAv1}%8^4;IKS>I+{RYS` z7vE{IAiHuEfyH5SgpHG6KmHhAZZl$2WKG!~`ZQVSG~F?5y1~6;d-)JRMwS+@03XEe z0kzzd16#K%Qzc4Tc{){(S3W5_(aC=G+^uwedx@`9fu*_xj1Nd8qn4uUMhA>>Ua|Cv zrA1mP@Kfcd`FI!jO{t+=PU{>yZoDx;w6T?6MUC7q&XU9wjC%lcmIe3Ujpb0Ddnaim zn8)O#`EKv>OQdM{frgmo#k3)>S{GbD+ zDztefC=}4sgEc$~>1Zil=}L>4<%>zRCTB(JjYgl42r4bI)6;{T(-^Z6-9YpP&P3i= z#XL>%Iw$AMVP8zL+A|_5iH`!V8|{%fuk&Bv4wrolM(5|VA zy65ftPu0qEXWe}=0P@I4!S3nON^c#S?beXcT4^m031fIh=~LNc8K4oKYEAL%?+((& zJbnQSAoy}O;qr$Y<7_sWS(KBnsb4!KKR@WQ!1$9o{_ah4Z80AXrc)7rUZzo>O?9LQv z#v%zdeWvaPU4@QMMcB*0@mpombheXQl)%4U+wz_k+NV(;)L0eITiw15;-9NcWEm9S zstkAJ2smCjPt$6i76~HCAJ8gF0GJ9ZIuVaVPFP3*A$ZUCy>&vfB4iO*Y4yj&vA{4AjJAgB<1-=?QrCiFRCQgSL{c zBkXc!K7l(?JW2BofAJqGnMfTp68|9m%o_zb5e=UO3Nlz{KeNOVw7$c-W8@J1QgNfd ze1p50*<#W+hcVFftjB#d;?6}>#N5IU;2r(gx>}dCw_B`U%LD79JHQ;r(#AeAI`@_w zC>x*7rWK^OoNd~l_dCQ2jM2ufv0}sXvGXQS^5LxE=>LF%F(~++0K)6E|EWD9=M^cx z8?!N&V*|-l1yv!gx_19eqe#~Clys+>64N!|b~tUuS#;Ih+0I;s&8%~C#0k3b$Uw3J z;aG`5!BARdb!YQvbUd#+gVvITBFl{d^w_|%J5QmrYaj~!iGa^p{BC3CwL>a z?CUFWSE-=YEBD_2i_#GXO4#f+(r1M*Z11Nqrs3Or)t{g0VDknoKk#-r)lKu1h38Er zlq_|1=>w&*a@;;pHYre42hjqzHC`Hc4wRbp5=PI_ zV~@|-&8AWzrd*iaLIQc(ADmdNnq;hSJw)EnSAM136dAW8HbUH!cGn=_gFY)WykPWY zwvTg3U^N<&qn+=seX6y#R$*SM-^q2b0E8>i6U71*5tBQjohFfVvTj}v+=yvB_ZjX_*y5NTOR#5Vh(8>ug5ob1Nr$6pB{7jr*V7}$@AQp z%asRYojfPzCz&7Dtzchw48;~2Iy!EO%<;zAZS5q(<7*a3UUtWy=k5CAF_KV-$3(P8 z(h3eXG3yW&-WaMh*3HPE0#js#ZYdMJ-nKII!=}P=Cc(*YvNZ{~lv>|nMKW?*p&xf! zM=ZTcaU6qhUCvakt2m&wP{gp!#zg2>POp^O6I7ERA$I62=~TnzyL1V-l+QiVq@yi< z8FkBhO2aR#M$1`^~-xniRL^pzHnHJA7gw zYml5SNgxZNj9EUnwSk3dnKA9}>~plZyE`Tl($wdu&KAL}hw4aNKh>j6ZZwljv3k7k zCHZaSAvR=3$bp(Se`@bR!ih)-X@Gyz(Qds&{9}BDJh|v>rJTn(c{Z_tr-i3oI57W1 z(OtQ!fTZDD$UCxow7uHFs4}^~)3SxRVH)>J$|glb-yeIF`X$060EOZ6bE(j`X#>~E zg#%wrRTSL35GK;bySBk?Gc+b|BH)gJ3`%P36T?0KlT$wL0Da0i75DZfusc4W((zt; z$K*ATCa0(=Qr%?h!r^|2z#L=ja;BfGpOXw}(iF!a;Y&^6cb99qw{ccvF^Hzr@RZ*5 z)W+t`^kz?&!QPzv!77_0;<&Z0l!VvmrJfip8MwB_2jj!TFn?Ueyt408JVl@zC+dQ! zo6GW}e^D>N)SwWaX$dC<@HNrv#076e>GDJ@CcZ`hPmz&!-UBi#Q}z9X&+J7?(&a>s zD{I3As{yqwvKhe})S_Wcy9ag7N8uuu9{W3U4RxPbkM=z>Hc%zvnc>eSPuWGrW{v5gB(SI6;m=?O=$-z7|4++7O zKVAb9d1Rw+R;)~fyGPOw5gEoeg|_A>aQWji#j!Ddu#SED%xL%ZEX}9shU-%;vL|7B#~rI156IW3kt&$3O#-&2 zOs+B$wUGYvbMEa)%i>39w6#P7&cy!hK=D)w6#}9Bo4~W_;k$QtXvAftE$BujL6jpv49IB819k( zd!+bp%klFUq^KG3e9M9S)Bc@D(66pn|9$IMZz}^09$uzvsrgffKLL;Nro684FaG7v z`~LtIvnssPY=OL$W#CGABCh?5ME$An3Zt%kr8H@qtwrtv`U*S-UGi4-wg0ja6tLL* z8*Kj>l0aI6l25&_gRcrCfPGBh z{e27nAmn#t;8Ik?ahJTnF5U=&$3P94dvN~CMmRo!#ZY2p?xG;Mjt}gklJQ@})gR|# z0xqREimnR{`2ybHF{3@YiM0P^BNorVV)r0P5APvg$`$OxLhHZK(UogMNJ^tuiNizg z0v-97q&5Mi|FV%EZ;%8HeZfS8e5q3;LD&D|;{ISi%#mrZgmGxk2RSwQB^|w#{h2=+rfgl-=M%zb5c-{>nWl+!%rBv;k znYRRdZ&}l%VNpZ*8lp@(O@)4LqjFT54Q`UQt8B^6N1OdUWY@Dq=e)}Yc=!KRwvLp6 zwQJ(}Y=9bl_s;Sf7^Vs5w2sOi&ZR|(7J96AonDxHFqGX=O|M{AhC;b{Wraj;rugs|&Xpy2IykdGSHN zD~7&%ZGBw=02+F#y+Pi^bh2EdK8i+9EL*cK`*g1}wnDC@YjVDUMfa67;%Kwj;nL#8 zuc!EzjKfp~L3OX8=$1;dD;_cwm;{aK&p-I|eiag*=fPOsdJa+sk!#6q&l}GUC45AO6Lk1|Tvr0HS*`U@3{* z{1-Z)y6nEDYc;rqhKGl@*$W70hqqCc^s|4$hK#O!>@`JxDoOEOj*3#gsw6UHOBc=J zrHXQw2wVwJG=H$w;bX9jratO9(l2@A{jSbOa)IV`60K6cm8ng=qPn&z7mH*J=;?>n9Bre!+$3v(75WJJ-& zv>(w(mUP#8&Pd7fHV?|xyez{UPsLM^=XJJ;|o!c^(4Ix#Xe$l^I8Aoj z$0{q5pI=9Crgnf_eU@trgB8B|1#j^0*7ry`lJVn7_wON@Q|JZ}HFS2NdnotdvIo4I z-F$BatXI1~cXaRNCuZRS^Y5RSj5^Y7BS1#^Upn}ac1M~Ra3Aia?$XR$KFL2tKjeY*Z6&-7!ZW>%jLK4e+~F(kaj!X zs*Tk0-Eeyyv7_Tgzq1QK9D?>Q3e1&vf(xk&oyAw4Fsd#0nkP2!v4bdfRDm*u*6`g} zhn0GoLE}Ee5$S$#_|XV52jhiKIFv~1hGYT(`A3=B@*jjHSGH$TNu=KIvmFo{qni_n21vf5qx|to8=LWYi-#nQ ztZRwooIXHEB-@~pPI=|4^D$o7J8(JfKA^|(_?)ldJl{$h6t}nK;~;8%B+T}c62nl(0V50)}_h6%6oDMqz))mJoLM|K}l>s0M z?;mz^o*r%xYT)6>xbocU0g=RoZjRj9)f76F5}EH0nf4VSmR?FAuCaWuHoVK5CLWmz z0!%&VMO*zuvMWtG^W~Q31T->_5)?<83R?Ve#9egiDLA>g`)g0oRsh}Z9>1&CzStjS zX^$-^pb_bzOAv6K7*j~U3#B*~_%2T@j z^k|6QXgl#@-uj5dae61}DlvQfR$2gF>!qD7y#yW*!yx)GEz?o<6&HD1ZEsmi)JZb?U*A3ZG10HCio3 zrTn|LYhx>A@p6;)1#udeUd0lmo#qw}F!L*$!jop@eVzW^V5LH?O#EUee1#FJ%1GmnibMA(WJVy>sk3^w!BM5g znU8(&!uSG(5luNADs&<@+vK;>hGr?=uF%|%vlM?ECCB4pQE>NG z6*@6Q?w0igD{U;tqj3;{c5!XmCL5?#!9JNLQr9?kSB?RlTJawxKL@A#Ojv*&q<{7w z4x03MBEc|Ghk-PQT&m=5u+uh1g6%D0H+rqB>?af`X=&IE_V+d~5ovcXTsy=w;&B_c zPR!Nfd8#s{3rKbYu866XI%KI!Mdh$+XrTEu_(b~VxB*Oq7)!b&Wg14A$>7J1F|)~X zxc6O>SCRzm5$=Lj$;au+P7&_>)qY19%hO61dCOyYRC&{dq9!9}dI2WMk3Y3EX>EVv zH;+2wyd-`I@&+4Id-i_A5!CYSj5Gt-9idh%-<}T-j~s1JR~G3|`7-9l!NlwJJEFXt z?6xQy3cr}HSNgF6=pX@`)u*%fjdym00zB_v_ibx`XgkVa3?kxHJS|!A+|hZe=l@{W z^^Dzov(~Fr?zJet-zYp2WVT^Z-@=L+o?U&YskyZ}XtIC2qf^8<$TsVm8j+445AXoCD`OuZzU_==$awzY z#)aYy%Q=%MdL_{d_AP4Li*-?VZS1WNO_6*P4&jFbMwi~26C_g&PA5_~oB9?Vj$bE@_V%}MZ3<_J}3#3^dw?rz9HeE8%L_LvsLL&SJ zT?u`b8EG2K$7fE*Q^<5QL>$7K5Qo$q6}wXoB~5%DwWS8M_j@dqi=Qvt)r^^w*6rd6+r=MX;A5s?vN1a z2I&$B>26Tz6lpfyT_Ro54bt6Ro8C0PwfUZN?zv;UcZ~NB89w`|^{hG9Tr)m%PCB)c zVZco{zB2W9WJr`^ZH?YIv{8{bwK55nnX3jVJOYAV-Fn@_YX)A8QTCguc*MMp-?+M_ ztM0sK@qT=#pASCVo%*E#@PG;#wqprLR+RoG0E?R$3aRX3GI>t4_|9UcLbWy9o5(&X zx|AjrcEELUhr8I3d`*FPYx}hXDtFlaLhix{fx2HsZgN+RC82`+8HS2Btx#JX_udf06xKw#E)_-2=J#X>Eh`1H`BB6I5OaBw&&eQQHO<3zXg+V5XZfBd^q(EeF@3=&_iQ1*d%W(X8 zx;;{dicXT)P&+!S1EHXMB9|vU4wH_u>US0FcWKNrc?ac=lb`w;#>yQuYr=6k`)Mg| ztJWLUKxj=3`QWF^_1ow>%_@}wRk7-jzl0wMR=xwF|8XCdYB$LyIslu zUCuJfwL9tZ49v6|%%1nS?6x-DOTaOZYnVOaDmDSaA&@{B$CiOI)^_Zgw*cVI0VY9r znd{YMs00&A%BhPp)CHe-t%dq#dkGU z>fCC5&JC6;+HL!4F)`f`m2p~0Un_X4U4)U;2(-*Oh)u9;2P7>akV zxki`fxg1ln8BD%#2|4nOYY$%U&DTMjA2#lzyglQI7)&BO*}brPM=2eCGWGrnNwuhJZs#)tfN#?ix$We$L-5;L8?w_| zw(_szx%DGI8%3`B?b!A$Yc5?gI9guPLi&&)=ZW>C*x_HB{`614gZ>T9hl)Dkv17b; zmvLH(;iNjYy+6qL_ZF_4;#<5E7<^h(-4Y<~p>77=Z=YCOMp*L@?LSr+md}Kv*SG1B1 zm{U@%*m-Os2-_x0?Af|vf_;1-U5w@2xg5VaBsbA)qA{|mhjJcbxpd8~k+ZVk0Z_D2 zy_<7h2j10~QG|E<8%+ouJ~ASHVPv=IPne`8Kx)A0wd5Vl)dk>rx*&3m8 zJ=!d8;wN|5(A$YYef6Nvw+?P^|Hrs<1O{U_V>a@A&`B>@$mBWX2|B*)Gu+#om{QBh z^ctkdeNRaM15k-wD`2FRb)F*iv~EYwsJ6+%Qsbj30&3<(X#k`Qs2kl%rpuXmNBs3w zh|sb>p`;pXJxcQXYi$69yWH@@x#{WL#Kpqby{Wb3Lv5L!9Rdk_EMuRvX z^;`YY94+RI9^-ob;xk-ty7J$g;SGX`E#E{`<1lQ$2W3Z8295iYWjd4r{*35aD1uOs zYqsG_-L)e>r{~k2%2~EnN}by6s;7(Rxzp(_((1`S=#rkG5zvNjSZ&*>AP~S=+wjqI zUzvm}!b6u3WJpvKla>b-uOod?uQ(2ZQo1Oz5qsEYlXj%N>EHeuHC4xW99w7lv*!|Q z4%5#scpEEn_m{TyZf`pELuvFQkDRnQ%@r@3tV*aFaJ@L~VJ^cPsoWptP-xeT6C6QH z+BC|3jUbA{bPRvfc-GIEz01Lf^%GHm`;VN03zB()n20wk?M+9zZYqcVTgTKx2hP)7 z{g@$fxFG(F;?q$IXhFkfdc;N(ORuh214Dqu{@`(-<*_-!9xEOZx(yNe3J^1aH+JR2 zr-YoVZq6lSp4E1T*EAQ$Dg_gYCG#Xl&S<#Pzb#~HY}Yey4B~6YmW?G@Im{CT3~@s- zAR%@u6l;E{#BVs!Q&=2$4msPSv++5`3bn(5HS*dkO3+K7tj1Np%*9y~zh(0oq#C8G z$V7s@dU@@!3wj_SrzIwoHH$4vQOXXvI#rc}nA=vGv92vN_6DC)xJKE4^x3>pum}#? zNOhC394Vd~TRX=1op99~2~4Hf0b-*p96@(Yat_Ijj+NE5pVfy~N?F~xjAEU3Jy$|- z@Z_zQosP=|5nR-1vt9)@ArGd#X%cYhv0vsFi@NFoK9`FHm4Y!$ z!k)V#+C>3Qvr%u)i`$C3vud8+L2zBE`Q=v-%LlUWHJU72>nTaYC8qx}7F9?V z2$T2rE&xa@8VMi$*^8dnXI?!FjYRT7p8DP}>z){f0>12$&IcNe1}dqbzIen>+nPGw zs^Xq)RUO&U-ye``oKi43`V-mx;Q+J-SI3-UZJwUv9X}z^Ksy61sa7%V+hdct>F6V9 z+2EX;vLbzVXVWp0_IXu^j$Rrhy9_AJ<)e$`SJaPVL>$Fnv}p=%jK%WJ(t*#P-Q(ajVF10)8OV1i-67v zFmCS2VM%p=*ZVb5=SROkIm_VKFIpYs<}({l|Gk}aMLEA>dfeeqUMp>CG3}U1%*#LK zbzCmXS*(qTBd;&^;r#n-8=|yPplCmLnet@YhH{ML@LtJ!L#p~z+nCPp_VPdw3?JWV zx$-feuaJFWZ2}j8AsA21CfW3UOd5Z9gpbeq=|yx5`zq8Bt=Gj=J zs}dKyn#d47r@id){k=8lAAocpb}mC7W-dEP{v3_ze-T|U`a|j#hfY;AguLPWn;(^p z-bj zYNmjTdRWK%$piL6WYILRXu&rg)(?w%QXN$x~rP7yEU@{8~PQF1*qb zH117l`q7JW_|uitSIdW^cUFzhf6CH!Vhytw@ zP&HMR6EMTIfalA0NW?;eldfm5ThHp@Q3BYdF;;v+(Cfo0;= z`S?68rB&Y_HYgQqnQ{-9{4JIK>EQKjdH01iJzQEq=NmHi`L6=VHhc;%RnB@>m`pq~}*v*Zc4 z`g|r`xtairXlow1qrMZsI-KzZiv`xVHxwy?m1^xxf!JL4liBUpCkaow6KD&ya7qs3ioKP7os zcK}K`R;wyUth1acbHT6sj}8S;0Pv_NPuWXc_?nXe2kUd__4b-KPh>W)eS@FKwYhQi z#R-VrbX2*hwbfau3r!uj$&@j*7c^|gLd_hPYs_rkN9g2UG9W*t>5_o%$+lJx)7&U;U05<*7$gBZpQ(yz3WMPHt-{)iq<-RySxuCnbzKC@9x(K|xz@hC3 zd3TQu^|nCf;^mI`rNm`xW0RJv@M=nRV~Ftn6;E-&1OK#y1jDE1sX90y-w7}HSCU5| z`QpZgc*%S{l`)=i5H|BGkdZe)5c`MwU(E3y`CuW7Nw;a3X+am8Nmd$#kfTrm+WPK( zRu*5vryr{~9Gd)xj0a%Jp`eK`b0MIx#7U z!O0*I`JdU=BmbHr=&`kuBNs(xNw3VM-i4h5$5-g>fWeu2_zeld2ZswD{|P}f@n0Ab zz1I)xMgLZjHm2v(m@S$cYo~jtsN=BMvsiiG6SyF^S9LZBp3qUg2H%a7oXFxLf-*c-%fefrNM-l~G*GR1$%BVi4|)E@>P6r+Q)Wal7U`#6QY z7@o{X)&>rIU-C0P|L4BaY7pNEj$HP+=LtOu@Cwy$?WXV-PQvrz2otgG;k5G30d%|B;QROePiE2!IC9B1xu)X-Je~@kK!YtO;0G5J4<4cc7*F?7HZ~$W(z#d)r>UbE z^IQ0-TX5G>Hk|%1P~Z>vCeiVNT+gQ&y3j;pK3V#n$n=_goGa&04c$Zh_TtzdF7l2M zt71K;`7*zvy#m#?<3*a_pWp)r$D~;eFdKk5I)N|T2D|VGK)SRK%_ObabQ6}KVQuHu z-;5l%HWNh3iMG}Y`7Vj$L}6@9<#2{Z$}dJYZl0Eh^+YK%07K+&p+Rm8uJgq<>M1Ep z@^q!y2VmK#5H8DB;yQ`@ZX5SS9a+VQ1j)(GhB|Mg^I}fGtw-OGa*0Thfgi+b6|h>=XI^a6(b1a{&01) z0rtr46R8-_xGy(T%{b;N&3{|7wRQYWswVWe$NH0gzL7Nj{>b{Co5{jgLpHl3>mtU@9b=e4>l*YZz4&4cdRAZaOVfN_cqI^UO^14C+&#zV z0A{^PQ(*fDL*0Rb!cayc!W<8XQ&m1vk3e3-YeR2&X z)k~U(Yh4L}`6@J03a`Y66FSjJ1^%vE)NS>gYM$I&p-U!Ge|7)R1DyMAuvNt9+P2`>64TbtaQ-C% zk|I55O;Vo2rio652fIf~R(5G~aVZj;+~CpjpugqYf`sFrBe|tj<_Da$SYoU&>$z8BB98b-CUQ#K{JiY=A zc6|JLkl%l^E$`TNV7Wb1=JC;5<}k(F=nuZ!b-yQrp9gj7)BoJm=K3E%b7YpC#(aa- zwt6S5mRXa(C2$mqWl;4URfQz4-?YNCezqa!hU6-b5J84F{9SDvs}479=q zzfpYY%1}c(bbDp0*F++`HYh@C-a=xLcI4QadcQQ_2v&N5dVKhvqz#7>7HkO{!_PdD zY1V1Uc7u`r%{^qzlj(gDMWx2k@crg+g$lsN-!Znfq4P&0W#lPRVxjx4bRn&xw+qPC zd!Y#mt@$rX&b&S=SP}|?t#rqcqk5blM4$!uA1bup@*rN?ryne7ucoCmxo0h9A#}4{Rgaz?V;WsLMjKxjHLK znUxdS+r8*zv-)ec%)Rb^q2G45;^K9>&Jap8E9K`j%SFA|@blIC05X#Ex}FKgT^^z9 zyFbJNx&8#DWp|~_Bh>Z5!Oz(flM>tNwQ&*Rere@1m-0in&J(zu@UyVd|I`TTw%ypS zPU3^ilS=odb>N2$gA`nx&o5DIPkuv;Za@m_Y530dNNK+p!!Wy-zb~i;=f`nZ+Cr%2 z{AlCvr*5{_sKQf!Bp&H1ycW-XWqCoPF-m>(OON_|(f@*o68r8hS;{{wF$zIsuy{X; z$H=zEoY3E$Z@uM}Rv*Q~2>_7j8H6;Jc25rCBVh^{G?CsC#bO}H*fW!$Sq|vd3-2#G z3F#m6aY@7n0r;JbNvzzAm!p}5IPXrhU24Sz_qPCHVnK1pEZ zSwYBS&_7-MY)4T_EcF6c0$b><9hY9v@a!>0lEsm7J8cNov$b{8V6pnPy_d6%3;Lpy~GTWvX#k&dw zf}$IGdFJuy>BG5&?k;Q74COxqI7=rAA0#w6qiSD52|`K7n$wF8HfC`L43@l^qTl;d`Y zwMMP#*`WM~44(%?Le?+R*eI&E<{B8XaQ?)WO~?;)rm5|$pN<~e_;!EymovHU@-*9Q zMX&3Wix=mwt;l}9rPym&V?Z6|+&tST15h#?h3=sRulzz1guB}Wv@A5)S-ARVH)dXG z<*L;MUFsBbZOwUAxc?aVO2&zX0;W*vwdjK^W!(cCl5~yYpVgeS(M;swD|#ElYddV_ z@=o}Z)+>wFv#Z=~UyX(IvD{pq6HqNo6u1$F-nwUgZKZtSpOye{5i9FJ+{$QH@L6nw3a5Ae*8KkC z_RT95YG_hT z;-Xy*?qih9;@U>+ncVA_mpOzS#CS`yKi78F8dd6>l7`1EXUSoT%Y%NH9H8B5^et9e zjsMe@Xz!TtjfF3qVkR9;6V6kLS%cRubn1maTxHR+!UM0Y&PFlJ-hKiwl{rrW4ZlM{ zjM<}P-FkH0OM9;Z^b449)qHENGP0VwzJInZ*_)PZbW%aZ23T~Us5oA4J6t`^ zmLsC2V+b+r`TiGUdFibno7(g#WS&i3dDwdFxxWAsTFMV8VVRe6De2-@n#dUy+|N{p zTRY{}6b%7l!q`$lCC&Z2E_WE>D>QTsjsmI2N9$1w8q!I%_DP|qSC~WFq-3rtB<~4&C2*_#oNd1C=CEc*3$noMlHFrhTwKa zn5WX63Z1S6th_Ow-bmnia8=FnwSc4p4f^GPAczpgDTcC_b?WF$l4_Vv@M*e@Jo`mJ zeudnqTeAtRnud?hofldEyLao-TdR|7go6qM3Wwu`HWnAQ8_6P{#4wpobEXCo>*z`9 zOVHk$yS~}SLPO>z>P=z|9>0nW_CFLC#Yw>Ah-a}(jy$(n>5}9Vk)k{Dh?nw-tCb3~ zk?)YIrBV5`+Z-)j+lh}NaI%+?;X~Q8(Jucnm5?L;h+Byka{eoAimPyG?JZ(~*1SO$d$c-PvMRq%+^9j450R;>y~VlU5}H4oPtkbiP$Iav|?c_2;%)IU*7 zsL0Eciq!!r9=@UXDIQM|fb~f39VP{L=RAeydyqd0@4Y{eMQ{VP;q%NBc=SsPITWY0 z%lPo1>gn!=$s&bz2JtMO&c!p1F2p~t7Wu1p424r5O$+S+`(B3&woRz+&5d+3IKM8)%D^sbn^Aaufpx6(m+_mQuc0D ztJI)rWm-nIqHx(RAya>Lh^`&C=-OnbTrvhJp}Y|mRE_=1ysZL%7O~|KcT}k|GDI35 z)-E;i$+|NQO)b#~`>S|k{gfE{RS zrjMh4ukhf~g3D7|m_HULD z-Q>SLvRUheGelSx9cK@PWDSqvJf1d?bock1gjZhfV?Gwro`C%biNl{MK! zF0lqz^i)68ZN;mzyL^-!*(9+UC+A_t!Tx2Z3Rab3MTle!{d?`Y>mpbB-OG~nk4^;R zCA#GMgUzs20EPMXbY?}7rA&9$_gQSN(nd1qS-Hd?N)8+lVRS&_wb{UZ4fnjHf&*mO zy_-#*Opgf!{fw1_(63PUramc8zKPjQc-zxeDq(0v*{|sn%Ud9Sc8~NV^Mei4?0Kl| zI@rlQlEKK;+)%ZZ!}L7wkLFF9<`{9yv3aa^^eONZ1cOs0MsT}4EUMEfe7P8tb3JVw zZPN2t@igCQNO4yGWo58X@HzBLH!Tm^%bJB+Dah7NMxH(v5>7o|`sbB~97^dVs_*h>qM%}0 z$a$hVyE)6zW%lG2NU}aUFs{j}Pqh-e8-!;KqYaexh zD{oE4<~@8b;-CUl#!|~a!GHVS(stojLEX6DAV==w%{_eI8RgcY}ZawDJk#uH^OgoFK z0X~OED9mIT>2JN70-=ILtBQ=)TpM}px&Teb>>IV>xpdQCxWTFUG)BD%3Le3O4M=RC zTg-!j>t3fdu{4lQs2Wpr0r9Mvh)ZjC)Ufnp{!p}8a8`Fz2Tby+7!j0YY@zg(x%MnR zShN;%iWki)XG|?sLe8v~q%HYqrtr(g_X$$4R=&70D#kA zJgD0<#GLvWcwaiS7FBK2YLwi)1{rma zcl$Cep;r#KEjR>%`J^CASAp@SVrJ*9gXMzO9Fsq3A{v2!gt;xr_u3%-Ae|-`@f-gT zDz!4JpX($%TJ0?h>m|yKKF$vci8ZJv>fG1-UP2We7HHNS=12Tsqh+8m@;_{FH7EDd z$H@jGnq{wBjJ~}sv?zN}M^Zvm%-5jg%I1sdSN2u~`y=gcA5IBb!aQ$JR9YzwJ8v}T zL%ZIo{O&QLcIa8%ei<9+BH*z8us@Mc%M;CcUM^q|32KzFE7x%o|JI1a10!1QnuimV z4m457=o)&Hp4+w3AtixE$R3(57Fx)7*fn7~l1Hk7Jw~a*p6_B0eWoN}48%U4WpdTL z0ZG*7o>K?tZ|_}uI*4pi&4*{P#iw|wI(0Vw&ZaVGs#uf(#--(O>2fo|&g;3&$DrP* zvwzibWlt0OT^Q|oFdj{=-@25VWh&eSca;gr{c)|P--RHs00SjqB4EF0^hX>AJu2qx z1P@u_fP-jsXXk80{$pPKSJ+6M{aS6I&T7Mfa|wTiH=GyG`^E|;u-++=Z_hWdHefV; z2i18*SdC>d@Ajn-kxtS;b=zT(CScmuRaW70OrWmP%aB^SwL5h@DpTL&Q1E%Q!c@fJ z0X)Hb&>)<3u47|$!6E?_gu&e5awZJ!V?SKSehv4r>)nUPP~pF)2{k9TP$q|+LL7fi z+-BG|CD6x@C_E~AJ_xL&fLKk*pIqdpo5LE6u(tlm(!lVwhIkH(IR-jKmP|RB`l_L? ztyF8}PM{u2Os|2>)yc&(R6K+z=SD`-@%Levfwy(8k+)b&;p;l$*Qp+pad}Z6>0{M0 ztpyH;=;@Q{tkri*?8P79hPEl1tFK--?h61ojGIDsh$)R`Oo(mxn|)5CN5DbDa*pa* zyuHQgOjHx_Bis4!!{Md!%}%Mqw=o5U^cWoYZm4zumSShx(my?~(H}hs&xA*GM-{qTw5H~+6&T(&Ydl2@I zKTG(BFOp;3mLD*u_E7G>hPJm|ab!tGgdA=3lEaR;srO%_;ho^D7d9O^lQi+&96Wm}=&{3Yv1kuEpt*jB2?95ta1AK(~ zB7doKI15^ISP`CC}&ys@#_1p@+;9xgD!nj$qu|AL&SAH9V869GR@GOpy zBb1mkkWuG4e7sOcxXuZhL8D~+V`D&OG(%jl2K{5n{G7>VslpM7dhMs;X?&2h0E+PD zsf7CVg_s#pSk~E+&d4r7t=GKTWZLr^kAhE{i0~w z-KD%2<&E)1Q?IWLD~0*;N{y{q$)x7SMR4q^PeIhA32G&Z;|s&C_0PxPzVYeP8J0(j z9tu6tjM+~<^qgLh=M_G8K99Thyy&JS7GN|E>(g+;W%}FUcFE^<_EW2+E&%BljTnWL z`h_)D>e>5P)&@dfs3fyRv(5XzVfX-i@!Ble?Zss<< zbo&hR!38C`p3msb754`%4Cw3ov{yewNmm3cSF1oLa6=8qrz-Vb6@X6!r?BgIXAz{$`q=<mY4q=GwZ#_8W2^1xwb5Hfv=G)BKj~8vGyGDNm)X2;$>C~I9)~D#lyW%`tsEK&} zMH^U}2 zJm^{gk1V0k$=<6Pm0(~~E1DJuA%5$^(Mgq^v`M;_;5Ml@&U|eG%*jXG;yz1j} zxlGqWiGalsa97~faPcDDj|o)sDblV|*ewB-f`ch!CW_RvX%BQ{baaq%mGcbP?7JQ? z5ceCMG`inN%0Mc!@eJ?>C}jw`JPz1250}N-F=GRzhs7p8Vd9~|Q6zeJfMUA_2}2Ta zis8a@UohU^SFrQ8cm}3y@8TVl3^bg1D)3F0czt@kQ#LUp`U_`p!#<`WR@tDkVi^oK z!RBGiQ;0KZmg^}*;nXZT&v=k=+n1le!DKbphRs@tlvb^{;!o+;nT3_ve0tFzv~WV+ zM37-;GV6Woh226KS#A9mK1FqKfCJu$k1X6}P#OTDkil=4@AI(DL5-0}i$Qc(P$>)y z^Tk`SW=!C)n`kY&51@lC8KDCgT)(Jl;4R8yeSn%h8NddpJ6b>HY z;AP+ZCltR4*rJ62jshe*0slqew+oE`Z%+dl9VO~y_vilve2HYi>sw`Lp1`pK&H8Zs z*Y2o+9{lmwz)RL5bN>L)s~NC(WC%HY_})UfU@o!EvI!9HYgEAC)9i`D`~W_R_h4pO z5>Sxtzf%_s=#1BCllvcRfRGv-l!N@wVDaGRSd=!Y;OCCPd*iJFSnof>1^yX=V*jp1 z)C@23^ImC5=>EQ^`rwG158=LE%2z#52nRc4vKqb)zWx9ZDQv}~YQ}%w)_erUMQ;_v zdOv1w2QYK$ojAt#Lk4%IPL) zKQx|#^}BTel9aoCuM_Wl=0C=8zCuJ9Ri z4K73K|Go6uduKTr%YGJR-U|In7e0`KbszdfMqehridC=WoO- z9Qz`0wG34hE|PHVXuYoyngpM$!e1PHmH0C!2??2|S)}#R6XF zG~S->aBfe#y#(C`-b0UU-Oh;9fKK-&&rR! z59f};`ZcSAk{g`GzF#>g=pNU=yerMIR;urQB(`vO+gP{DUOU@7pLg>QPfo}AQaLn= z{GCRzEgvFWhIRDLUVb%sI&PQWHc`-6!pnn^q4@;Q+Rh=pX%a{tO_ z1e?jvNF^>F=kqsW0WZG-gaU;ZTpgNzwE;~#*+3~$Y}ckq`55*?Q)t~UMvKqm4AW&# zQ26>dAmWvLSYdpwMsztgh3%UnZfCmn96x7|x$LBJQf5QZoMDRD+>a3tpY(fOpVRC| zq$y{A!pLWwFQ_<$@U5})R$0lav*xJjl5)7xiiKjv*E*O{TxHaVX4dE{wYrX(93GvX zoOiPZkuVV8(EbRfjbV~lvOhauaTIVsvdC4G)7`YY9(4gJcGUb{7eTMYgG9OQK4oi+ z(aN76Fm9U)x?hVzs`fzP1FN4UP$uRHcnBPA^xFL3&qC8(s?3bz2s~mQTun6`I4BJ2 z6PTR%sDFGvxR?}3>hm5hAZ*5&Kf`6q8N7Cyzy@jqd_#Hx=i+w?t#0>>8}HrVD?`M{ z9efkQReFBC_H1v?OZpKNBb&Rt+$q8tG1QIC^imiAHUx0`QXsbh6#HSxTvAr^jT!TE z(~9Mpfn9@x;k73OlI^o7U0Kj-nlw!4d>*o_8;lt(0Di$(<|Tc7ZZjqnKso@DwZAvIUr35+9S2*t2ci*kOEBp+q#=0l zbl+N!ph7?eNQu_>av7@)Q__vzcDF2~k9R9hAc;CgODnn{T)h zx^Z=oZxuj8+PP{7*}4epfag@`qTBNVA$8=cH~<2vkOgoi^80@NN$u zoSbMFQeTp#4wF&LrBl-4`Mv~8NH^EJCuEb+f4>_?g?pM<~6d8i*@yFFoWV)FOX#5`iT)t$aem5QNViKX0F z$x?)2N5O-=bXO|L55sQ)MXdyLy+UW@zo=JOdk&Z%l?uAOEWUa)koSOBVp((@iNWNb zE>Ry}tNL?QQK1Wc5#L z_C@e*v`aqb_Rb*EWa|rUoUB3R{Pb@>9??Fv85Kr>oVbICtZCC4OwhPj1LtYToms#f zYo^6Xg(-lzWO>Y}o}u7tKW5jP{3sDinRR5Pe>vu1Ia@CB zBXmf5p0&PS(*UN-kCIU)S?F64}mtwWh>OThewhlh&JdD4Dm z-D2x>>H|&Ax8I*b5yzD|iB(Zm^>u#duPKjd3bFsx`OYxo1aW#*ln}c&h3MB1pMCRh zEI?Sa^Wk!w6H{h(C!fW-;L%!_C#I%~)SOD1qA?DwQFr1y5&>uGn=5;kD$Ds=(DOcl zR%G-lb%9+?m1A$pNnV5Pi{84~7gsGM<7)=~I(L(fbjYurEtBE_P*d9WAR;B@WP5ym zJ`{~eF7LFcxbJnIkZq5yoe?bg`#LB*fjF+gxo0P@Lb|PMcgdqoej1!Vewlg0n=ef7 zf5Wp^Pa`?ERbsbQdg33vLqZJ8msia- zOQ#uG@5xPT=o>frqTJqTMf-t(HN7M+KfdtWPmp9L`TjTmtSS!I^WB*#K5--*P}N02 z)3E`6nee#0RAS-o-A?wqebO{qcHoaBC+4l-NI^n}*oy_B)lPd138Ub2t(?qUrdynx z$kojxFr2*PK38&kyGm_7tl7O~Eo{XdM=p{;wsLO#r>R_3CDeoev-gFTKV5CPREg4J zC2;fMtlpezO=i+rf79JDNx!|7`!u;}B}08`TIF5(_RaC)Qh!syIAjk|kaWJ2L}w~F zjc!~vh2LtSaZq)N&9*D&onP97K5*r;xXTZ|m{dj#7f#m+pJ)z*Eoy5pZSSp#-~ap zklrIjslx^=D2#$Wq0OCKr58LaP^Kkb-2pj>u~16cN;RzQ{CC>OCRgmHbsyD+9d_8G zO1rlfh^vS29_`OHF`<+2t9ljR2sWSky0D7h({vDX=#ChV?!EG_F&0#KVMTpPr3=B?! z%T|7|Pz5SfH1?f^?h>Hv%*2+}SyQeDr(?jm;9;y>Et+$2`TK>Of&_ab^@AQtamGv6 z2L6P3PiQ7j%Fb|B0p+974*W5WAlDgzxkMm>RR+f`>iS)uSUrm^WZQUr^VTvhZ{OD5 zGNw@+Rwm{v&J*XZFanhXkUSahvmH`aWrqC-{`UqmG`Hus_lI zBT02m-_2Ky33udG)MKdiA7W|o)Fs#Q3@O-gfT5Ca7vX{6uW4maUo!izdL8PLPd#x1 z_E$nGZXUxH&CmFG9h}u{H+m=${XL8-&7PA?ZbNt-38{fYGqrrn_ow^ciARh&jg&TH z=nC?4t6%5_-QjJ82VV^FzL{0In@f15ZZP=rZH6ek58BgTz(kBg-h%(Xw9z|9g`(*GcA5AmL#* zuDIx^s*;GRjAK0DBg6Cj!gCq=Q#7eJW3YdCC+)l6W7?Osb{qQzzB2iWd&m0w=#cC@ zC$Vr{HKEg8PT_nt#+-p-T5?@4SnxC@V;B!oexW>->`HRT~fL7jTC z=&&WOMV7CofT)Mem#d6nC1teEe^ zw+y=uj=c_SNBRb|ik zZjlA=XsG0pBJ>g6;=)@srYdxOXnSX_)Gd+L> zz)JSY7K1reJHeQ1cVG)=c*^TYnp#;vr(gNk&XHe4V?*vLlFvNun{nTJ zlbu6Xv&J>!`j>UhCIbn8?q>>rV`0*Ic+-DYNeYY67^4H;T$S%ygo+ehy_J7QH0!nN z?Zq^z%s)W~D^F7dG9;~tH*YT`)0L zqoA8>oK@j3LmrQWZe=-JPtl+(lul=o@MyY6-fApIgsq|SYp2({co=k!`DxKFKo-3m zrSPx$LDUh*G^Z{fYqyNIf+!ob^^Y6Gn^%-G5&(LEMp{>o4^0wB}*iEspbjOxN%nQ zoRqw4NJ^eJllS6Cl{1!zIk{7@v%6Ez7jFL5lNXIlG+{COd7yTCs4{xfuF-t2B>q?> zpo;RtWTsdDHcB%9!X^}9m_9wPZ6^Mml#`N@!l&9K$gjGvnL!Sg6zG6B|4<=AG$MD~ zKP^4)E+v4_pEaRnCS?PDR`mt&YP8V4eFERL`XA1}nBW<^n}egO5K zDM6Dhg|F@GSVExg;dF6+6U}_hhF*;mw6Pv0i$$Z8nR+p8^m{H=z)PHyIB~ORR%hH^ zEDRJ5Pr1q*RO!haz#HCEfk$mBdk33tD8x|KBI{jjb5kC<=L(mit`pwexH+-Rq;s3; zBSY*zrd7H3LU`+V45=cO3lsEmFjQbq+(@T4s(rq`{=&7U-FVTOy(^Z#JEK|b?Qm{m|~zKCU3jA&8!!@ zVJrnL-*Tbx%fOLqW+O&%K_q5@(`7Y^w?nnEy03DjwY-|iru_MAO)w?fXcNilmHqmz z3;Ti_t#^-w*ZwD!hH4EJW{xjf6W1D<|FFP4AN=!2s0}pi6)O~!69vuqq_{T37DM%^asX>{(w_vB4^ zhFkJhvvDiMhm<`twoTP|eKULG6n1T7d);QLQgqUm=%7;ID%PDur}-l-vB_FOWtd)B zzZv=1<^Qqw)=^b`+vBJrh=L-LqLiexlG2Ja98loUAxKCo-Jt>kQipD7ICOUiDh<*l z-Hmkf)&}qWe*E0ed+(3;8*jY0V>lS=xc6Q$*IaYWp4#}r@EnEji)_(Wm&)G!l2j=+ z3;tPc*=bVR|JjT~C8Gqr*WJ_f9{*@5rKK3SyA-`_9W+5IG){ao9_-$e@9@iE+2x=Z zR(5@Cv%J1U^j=i-o7R4sj17@og9%gOodIweE}nv%bN3Hb3_3L);_FbuUn^DWQ+pGy z+@LWSVB2?09WV&OK;3az_)MGWK&!@XN=^yCqww(T>=~KHYzo8db}kc1!M7KJ-&D!X znYT`te*EaSvg4Uwrv{aa@0Z)2xo5ng&#W)=p;y3Ak4$FxX7#enxlt3hYN;iqG`cq9 z-7Fckl7H52o}mZE?Hxsr)!qYz@>5>IWxZOP10Haa|FVtXV3)}PvB9}y`x9s@i`K~l zm7m+AKqZ{KSlsRWVF4L0zTYCpxsdViKjYxYZ~9s5hk;Vh(?C`gI7KP5JFGyFGFKUV z5<7`khR{DvbcOA-00&zt`vNLv7y8lvz#?c!I2azu&`<{TObC#w96LCtja$Y+O$d<5 z44mA|_ijlMh1S~yHo1gt#wB6D$FDPS(>`+&| zpVk>eSlj3V%J@>yy+{sJ$W~X3<;5R@$)>1XNK^k_)%i~bFbkEp@H@BwRuej)b|>Nc zZj%3i+c_8q0f%l!1bt2h!NXld-{9^5=Yo3ZH5jejl?&H~DsZx*2G@j$Oqf)$Nn{;`gK%@X@fI2gQAcaad{&%t&D zdl0-&_{ZTV^Z*1kOFm1ZgIC`GhUcrJ`+qJ5`g9EkBy107Jb}0-0?;n_q4N;$ABV4! z23y@q5V8n;<_}h6$MRQb|9h5C>NLRMYlsvr&`q5XXcMU3@O<}A!@Gq82-*+5VeN-Q_?giwCLGhp^DDjueL$8TKfDPc$h9#g6x{NAk>a z(aEP;MSP!asi|kjHiJrXt3Swd?7XZ}Wl|i&?f6vFag_r^5Bc?GDLyUGYo9@+N$(%X zmRs)SSOIlc`1ZUBtuwj{Gn_sw%tFtH*Aa8z{M^`;fi3c4A#Z>#pqSeL&Z6GN7a-fX zaanCJgj!0!85H9FS!pW^lFLwm5}-jKqNO=x+%*(fq1AL)qq)q3s*wd5@YYf)$&d#! z0d%kCi06iJ8?lDh?fYtCTpkcY`!>m#r+aWWlG`9bfl)~a6d|RPjpqx^=G|>N^c$I3 zEgcI%e8coI67Df*54W6WkxUC1D;!Tda@g1iQlQsjRdDv$(Wy_(!>|y94vIb4vA9xD z6bqovwPHXN(woaJU!0p(jKTWU64SBp&chwfX{X(lNT;)g09M_FH_d_ftFtuA8QVts zJRHxn!la`WJ)SEwOJYLBB7bx^EFOH`i%vH6N|B2T^#uKXt1sz+cwg{VBo< zVj3hu9=i7=+2V0>I~V%0P?=afdT>sSNuh1M?E4iPY^!@7pnD$hz@zgm#?JG1OUi5J ztZ>-5=OZxkV57tuWU&fLXb^3of$MG0G~?Qz>NmI_O3|S&TabKbzwYfx{AW>h6U3008vKLJ*ns}mZJ40<&Roy*gej0l?l5| zDHwhQ9ZS5zYB5=MJx(sgf_j;eo)Qq8c-(#CIj7?G1&PJJ>IO^80l_CfD$ici$s<1w z$(e8UYp~9*f9o#NCW+h};48O2@=unC6&g!d(f~F{oi#GfLpAQVo1dz4J#QLG0!KT& z&G^FEFDK~TbJcTm#sQ=U&28nFdLz61o6q5Vppu&ESh^Yv#GAgZ$vIl$w#1oeS~^9r$g5%h5Sczg4R z2Y{cDdf7`jF4dn!l=3vz2n&68Bt*qR>7-`l^nDnO$>HqYB7*J}kKxeDO$iXSn>Ajf zae8c=v#qENA7;<^I)3Ioj4*dUblyQYZBOzdD>x7t4{wrkIv=#lZf<;eW;iT<;zG*e zzvwu2oU&;+u#3<{lP$@klbXA+X|u&e9punIrI)GOg@Ch~Jip~l#*#xUV4?oq=_H9= zaZ+wl$iAH)w{Pe<2$qm@mxr;Dfe?vm^G{bHVsPtned@;ZIU=x=Pf#%dbG?DGVRvy? zs6W_9%xm5)-d!C|uUnK~>?$n19-az2(a>ZeezWT(aFjlzmi<-nkwS@+9=FX(S(b9m z;0M`Tq(nRprA;Vzv0(gqfer!Lo>^F(rpQh>&>!I;mN$AK+ct5kM$h1;u ztuT~aTlV@3pXFGHne*XpxRy(77CnMT5~K`kH}Eg%!u+Y^gl~jTrz(jo%)`VfL<_;pUBg9Fs(lPV?h6_s*-X z+VtT_1;*)(UxmG#4j{H4K^i*}_2l(bvY_7cT4n^R2~;4!;MqOd>XdPerXm1U8i z=0x6N#FF{fh+nKmugxVQ$m6QXMoV*4O~+GH_)V62Cp7@GA6+i0r0V>$xYp@MMI=TD z3Njj!f9mPgqO<99v55JM>RCpwMN>>=Penpt{!@kl$rIEg?5|y1f0GmdU*3<4; z>@jHLueiJ1czt@+`R1L+!X7ULM=}dcItTETK~=9$#%+YJW_?*|!|uPoD!$yGU9Z<} z2Td1S{be%Jq-FPAOKLN+V6j63K9r0?PQnR0wG8`okL{s27o=t1{c{f8yJThUkdmXRg=Fr(TWgWB72rHc4;aJ~t2LS~H` zdJsGmY>7lH4Hw_D*xXi;2xIr&UMJajb_LL%Er|ZC18(79EQ;+FDmIYp>S@T-ty0g~ ziHTwq7K~`40Yh?Ln>E%@X^`Z)2wf!DCGG);AHdK_EY0cx5l*J#`SPHwDLrrRc&XWl zKJr6_^(td5ud~VetJzwq-Z0tA2JcbL-JelA$04%0F`}oCru!gAn_jIx$U(jNGY+8h=Z&k(7_wK8a{l4$|w19xXpED-@B(f zQ|)N}dp3jj;f*^?DN^Zd(Ma@|q3z{$wwaOq_wUs!!R4<~`!@Qk@PYRU^j-|TzUnqEQ|=>R0s^aqbYtcesP zSXijs!Mnh*T&jr&CJu+&89bSbyhJAlgiF!^p9&;RnbJC!7KTscBYAdMh_(*I3rAzk z(6LBEK&~^1Ac|Zm_u~WI1fHbk&d$!7_MbBNihXhkp*cF;ebOb_`wmv?6eNNN4<_zK zE&WWoj_bniE>oxvBlhGutOzXWiawmzrIW7+SE%fNyY=4LtH_I%_j0fmV}3fHG-NRC16h^u|@-piHA zbj+051M{j0gOM?VqG{k_;e2agXGJ7iu*t~6j+|PrUQ1xV%jlrFtK$5^w;-V9!`iR5 z??>Ub+^w=Ym~lSh=rBp*dKz0gvrcApubL3f>38qUm**8rNmUQ)L?`}eYWuz#7O8;D zARZ~ptqVOPJ(gxlYX{>hCnH|IQL7EPY*7;X%^7c?E3)nh5lm~IZB^>Eu9b{rO@ZYlU!ehpr*aFQ zv3|4Fik)tC5Ah_io8iH#oEM z^EjFiAN-cq@~wHjJ|stCW~|k$f)8GEdl>^fLwio4#!1DJSs}C~G|o|UT_CVoPKgpKIhaH~Q@C(Ytr?C$# zN~S>;U7PjNz}_WQl51#K(c2taE?dDrK@w_^rQp>&Wc!Fsvmj=8YnsN0)S*>I?69c$ z_Z74P4bz0ZIE-?f^uqXElE)Nm^NbYi_2Mqa3rf<)b(sgL$I^l7X-3MLafCzVnQG`pWW5=yk>`}!@?hCgx~Lqv?P?K zHt@7EOcpKPM6ey5l`{2#V)De@@aMHMk#vAF3F*y{6K}Z6K`mC&w!3(Ez)#@Z-{U`e zlq}k}DVOQ+ZN8qS8n*PC9ZaQQkHv_9_{akNj+ciJV`;U_p`Z!w;>^#dQ5;&FW@Fml zV_0mlb{yXb4V51Ov4^(W=@UM(IgkviA%Suy#TIJgfOeSj)vFisteY(0Lk_k# z+3W#-@*W5)cQ(qPai5U?1Y2D17ljTDcAFM>2)^CrBZ8iQE>R%q6&Ez!m4NK+z`?a9 z1Pyde3u16~<_rN+Jox}vRgr7Fw=Sk|K9B$TQ%4ISkWOSI6$(&CgJtE`UT!1%-TQ@z z2aN-@_P~`>-We7LQQB6}r;0w^o!>Y31u^)yD60u(Ib$u=@&THdReo>czkC7aAr%h8 zpWR+81i<5eg|PkaDO}8`ObST)8U@?FfK(|1y-Bl>@0aKQIQ#}HxI|gho~OPCuRaFq zgQ@C^b=Ntft^KTKadC0k96a+rY#n!`ZD~92f{_86LlV#XE_H#hF9B@oySLuZTh@pF zXP{!nwF8t8I2p(%iu%&$>wFIZ#SAO6%z4f??g@Dj%3)`U=sD))g9b&MXx#BX~sQI%6&+LD~}RYoU;upsWm18Ei-c0C%c$iTYiD zh0>jEo<(9)*J;|n^a=!YkWea|Su3b01EJ>n`4cwuU*v575ZW}!S1uld+I?D-q8~55 zF9eS|B;THEH=hVYQpYyNh7MU=d%3wsfH$+<$;$>(Swx3H2ZgscUEY zUadeM1%vs>2)!k`V37W*ow$tp323lbP{5N3Uhq~;VSgJQ&_pSNjrAgo&p20++QkBD zF~CHJ3n6ZmB6wsR9_9@#;eTI~1zs`;i#p!{QWmh5Us6ryt4ss)k4c>p0zc|3K^vr^ zy~BMmuP@M^(w^f2p9uI~UeV_*w1e7&z|*(#K0kyGVW3@bjPvNpd1t6GV3ih8KA7h) zqX3hpdq?Qj2u*qt01eN7kPia@_u~Ty>k;$i7eFi11fB1sZl7<~1S#11y|QiwFo%~S zpv{nj@d{d}I&}5wJgoO#S_Qq|eauZb47RfnIGhwpc$E0KEYKU7%`Tngkl9ZW*9Qm6=2& zHnbnb;E`r!k@OAl$W8{Rg2SOBym1+HN~WxvdNF-A==;K6X|QS78+PDPfR+#qSpT)h zOkn=(_~**DI0n!zH*Rb?hZFWSW}sZuTm$H-v7DkmUj!=OQ_vr-qW7cok-%+2 zGj>h@|H7Q^=Yg%c#UdaN9SH0V9`H`CnjFmsFdMsU@MwUU2^Tt4ap0^>rGODoouF$3 zogk9#ywiO^k%BuJIdCB);)BlWba>!(Xq7Tx{@k!{9uU;#0Wj>>h96m6%6)Dn_&zNQZyNFsst2f!XY9LN9k=rZ|8YRB34=+?qq1BII5)fkpwSWM z+d~2+_6rEtsXHw%j?SBE(D^cK@%H)7^Mhw=Z&Q>YEbswsMRok|&^pT?^7-wv6?8{} zjY9=<6(JW0_|JO>0$_lqz*XovehjfvF}O;E8m&?xy?WN0@*MC;JYLW6e zF#ekQUi>5d4#q`KPtnXqYbf(|ghL0H(5WtbiN~M|?8Lb32809mO{S8yl_*S z{+>|LTp1QR1kFT~a$E>R~AD47qr9VsLUd`JVEZfCT`cs}L7|8at3 zhSL7%AqqFQ0B}YR7V6nd|NheXZ0Z5oqazNqM+L)UcY%{~yBdY>pJk_YXu)H}diu}? zX+XF3Z$s4IJN~Z$_y2JQTo-6@-Ce0OzU*|Mtf3pa1nP_`l*^;I@aMUUBk#O<+5`t$E6BohtITm~;VM zW#}sGZf%%=c3}WwVZR4yUQnpK#JW$}2Fc64s|5uHdd(5+C9PijTT#=SW63bY{kJCE z0?3@I-QiZUUnf3E-DaBvLytaJ;E9KC%yKCo`@APKlj;!Inr%(>NS5zgnG_h#4JSc# z>aPc-jM9S)4&L=A2YkPILWp#@Lw*O<(jRjnimeG5n9+Qj@GfRz=U!*NEF(TXRH^5@ zPLH5@!5FRzzq^xr?6`qgw1nlh$nh9=hwsV`Zp$TNv+V1wzBN4Aq8a*;=7ZN6^HrV8 zc!cOc=hxH7ZOymMQG9EewjCgY{lCvbnFIg^W#I*tTCQty;jqgZX7SC~Z0l3YN~hxOK;nBU z114u&&aH+-)f;Xr{I*g$BEF2pn`vRW)uw;C8M8a=bQ!QIr?ffH4W2aAhqJZXyOM^a0#-j zszZ2Smk#(~FJ|I~bDs9e1U{-2n%sJ1rMldtLf)BBxx-#i%xP84aoJ%+(Sdbg+euj# zf7Xu%N3GcT?O>jP#c9c*&Akpwi-QizqexhaClkk)_KdC_>4l_c309+X z;xza!S#qJuzI&PvwPmI$7H39TBZZX|tYZpb^mEe8mc3h6J=(!%JqE}Y`s(Y7io|79 zl<>!W2|9|nj~Dx;JTxf@R>Ezi3=l|rxt3wdaQK3SuxCw>tV8C6*j}_On!sWCYOnL7 zBvAsA^u_#D5;-ZvcfTB=!r*R;sjC@LydHO@^tmk-{iW5d6=X7vg?I`Vz3(aw-EP%A zYF=iY@jIsB>(RvAQxA+Jk!-!^(KFnT`j!5MQ6|bm{u*nsoQT4RF}m0nE+!h%{#xY> zf*D7i?c*$hRT{z=sZzQfuQ5nDnFgITjRG{N@fDu;Yqn3X_#JiI_M0`wQRJ8`sP%nt zFLB&VgT1UTiJ-6R5lDkyv$Yc@!TnmSG;efLbXevzlodE5i9i0q&eepE?%t8&v`M;er7_&HOIXBk}D;>+Hg8rG=fHsdvIVt~1(B zVI`MEjI`ItZl4Q%>;;Gm!M*)k6F32BO-QTkZd^zp?$0sGfSXhR(!U#@lPBxP2Sv1|oNWZigHmnFLi>V+J zX)~|qSoI;skTT}YgzL4Yn zsOsxof0+C@LGL3Any= zMmyKa^b^-mqzUBGE>^aO7SJo_dr*((KBiyo4KthVGvL@vK@ihTMY4U~RuOV^nVR?w$64UM$WpAI+^kroGq8E$6!%!=;ALysqhOy1jpbdM*V*fBsOL zv4Lxq&vNt*#|3MfaC;x-akrvEznJF=ogYsCEn_`H2idor>Bf6=ERRdFJ?VzfP~8d-RfmC+$dOj~h`?EgiAFPFUvABu5LQQI)x z_DMJ0W*(CpS-6>PI*zsB6)HB{FkaGhqgW(9rwzj;V2##pu;_FFUg)fuuzkJV(m#V~ zr@-m3)C!3hjhPm{&;wtHqJOc+Y`g@>cT1Dc^Frh2hKs`UdWqMuG)u{V!h_>=cYtx4 zkncL&F5wx1FJl^=$Q?^e-;|fqps_bRTM@p(PxBPriJu*v9y*VEnb%mE3U~GSI3MQF`pS=_6~_ZN>*A`$I&vK zOe;Meu{w_8#-vw5?z8Gm)7cx>JJ2P)iz}Hej9~k;tt^w__zWXDF5QT{I(EWeen7A3 z-U0Qi?!nC@R+X~(ciiz3@jXR*KbZ>sG%<=rVsm~VgSbM6JvRz?j2F|3=)zT8>?+gW zYSx?~6i$z|aH9aG1+za0nJb?V_foS~C`&1=F-|KvgZR59_?{F#D7h9q_M z>S(OjX?Kyb16|ak{2>CCH-pJX2UdqNMCBW9R+(|nM7fw>udBu{CSS?1=k194oGj9O zV{<#>V^06uk^%|a)Y7wih5K&hvglG73U_whF)SSVT9`^+MeWAdQuFscw(1MP^2RU_ zr+PNtWROeIeX{WR^~}4I)Bv4GoYt2+*3P5~;vhC+z9j1Xnr#VEuEKg;)*>@7$2^u# zPRm22VyHefAF1=Yl;_G)CoHW^MIu{aXYe`xa}i&hX7#lBAFdr{k)Jz?d~g;ya9f;@ z*0m4z158tg>BU;yw!*C@*k6y44q5JoEvCf{ADZhXp&*`{qNhi*Y4@az+)9DO7~OFZ zj=9FvVX1i9lq-zq#=76kUjooxWB3saKpI+7;3P7WfZ3P_$*@3KC^S*ujt=}UFD)9~ zjj~1q1oroxmBss9^e>lT9Rm=bs!{HiLM&w*B;6V^e7C#k;|Gw%%FSWPc8NTaIhDxiAaDYaph*8 zAQQu1&4B02`SXv^eb6fgBlEc~8j7iqSMq;*A)x%5FTUvYr8AiAa_()ASshFU7?1Gu zg?Rq#>_TP&q8v6@jvWW|^Z&E)4Q1~WB>&|L@ZVU6|3Jb2*T*{iZAJf8mHiIHnE>^a zO=AcWUqPX|zlrC0OB=f>m_zT*+MMD!z52r(cn6h_+61Ekul(E%2qLO~5)KOB&_efa z!k!V3KkPU_y(Tl-3;*`c#m@~UK!wIt&GmthE&$Q#B+SmD-z4_Wey^cJcH1X&x54cG z@KN~lHE1GLkO|0fAS@CxO#wR(jV2V4`k(Lp|0>w$&)vQD-vjXb000~7??CmxV*kZq z_-`cI|4or-|4&BFF&s`NZVNU2^=dk`&aq(2QnFSL-hk1XiJ;j?_V#UMpT=Nm>r1(p%sX-WEgIC9faKLv2}^CCg(`TL&D_sVsC+>Xm}N zufcoEp!m~2ZnsWg&)z)d(7g(QND7UQ&ZLFMA(yy%cOk_Rqa7_s3pa9@FIb@kM^+AN zh&mvS57WX?*PdovkDnZNw?7!fM|z|#6KXmxcI&C+*_9WW^|k3acLyDz=4e*a`$d-o z;?l~r)LlMF1~HRA_a3sW95lw$G*8@bpa$7>Sxtw@5D%ZCu*6WyUpS6lx~zq*TymCZ z!v9tS=c^A5%r`~JHDC#|N8kTqBR&8l4V|>pdC;kyr(4dtEp^INHm1Qcpx&D%eY@yfQ*B$sd(IF zulmM4ffgslY6tj%;nd#K8iCnP!|rM^mMxWcsK4~~I@TiGnI zROL9dR}>g@YFf6hMD`@V?xJ8`959LvVU~YUokrW9M=UOXLD4)jfUR157BaFHm32Ii0+^rh=dJKxI z5b5n8XPM)#kes_Jk#8VTTux>6>XAvCBNez73sa^$({dE$^54QsrSuTDTJ*x2f>2KR zda{q3W($DAwS2Sh9)ikjTgf?DY;3@=#pb|h=>9?FE0v5`LF@GSA8VydnfpA@+0)IQ z&f18B-PIncVdwp)A1w#q>?i0qIJG(>?!V8{*fI|^zQ<)R)t^27Qo#2fSI){vA%9c9 z9hqylh<MrC3 zAt)U=BacU@K!yvm*BP1)Ck3--EhFnyWHS|V)KX1aNJPsEOga+`CsPpGI0K@*U=!fu zZt4jX2p+&4r0i{{?2=QlWIstYJ&&AZ_~S58&_cRn)b6EFnk08{=9`q5ub&9=@E-#6 zqz9~&lrQW9iGIWz!zHg2s<$xzSYxyBooR%LgS z12i*@N~;j&Sl+0B?Z=WK7=!N~0y?LU$zL5h)~(k%8{2=mPXUDbg&4}aa-AK60KI~j zlZk{m@i|%D_=^6+z93X!prwEP^a{Ej2p=tY+oQk3%on=UhisX6dXgehNU)oINN~(1 zwmIKvVAl0zgiJoQrA@_h=2O&OgIE9+h#-Q(w-54Gj}XeHtqbXBIU5qmLW3H-oY5_0 zYR0>Y3@X(Q*#`qI&W;&10(RPH0|@HYnRyUi+~9Sq732=40%4ePsa6t(<2l*79Wjd@ zB_%9NdmLKs6q_59&$h-EI0{Tt?#NNAPvjXkmcW+EC009^hO^V8V>w5UD|fri6gaty z@zfzlN^QMNlyC01fhe@*?_J%)oJrEdkql_|vR$P3@q&ayh z0>3-o!iH$1D)8jsoGa(60OThi$0{YasKpWh94ls0x_jW4xK`qwEjH>+C4wJ> zeKJ*44qK~Scyq5hoPYjAB6=o`CL^-GDu0?eQ%{n6S8UE6Art_t^9`<6yEH{HH`Ic7{#*1RxH4Ft2y{+e#w zbeI%kwe7gEHB?lqFCL!5-zG@NqN$)S6K{0N&8Xc|!NEZF%yS!So=9#GFRHkkWPP|; z?JoV<(cXJAbd~g%mvQSB$R)Yd2Dd>z-i$L*O2=#XPH%XKqq%H77ar2tIi}XQ%N5xX zal4*Y9drvW@iXp^gOp-fKkYGFlEf~DzN$bzfVYI)_k_g<9LUuW^L8Y_+9Dq5EyV}7 zA68|Za5$%0t#yy8D<%p*>I#)CdGk=IgSfz|`Q3a4NHkDnGwNX2%}$Q$PbL_*GF};+ zx2We^H*l`dp%DJu*`~p2a_U0Vm+oezq#ck{GBrV6ZZjZ@oRhi#OGmWW3sxaC|Fy3& z701XILn0@0b>C{DC{N11$FKI#d|l@mLF=wOSF&>IS2=Q1p&^^4it8L!TE3Nv4+n-o zTCSRy3LC8@0&ymunM20`Ztuj?D^7c#qiF29S2w=#%IW@~D9;wkq9DSN=q`JtyBgFg zCj{4HQiQVs6X`cc7V*(sMXBxdpk&c81tUILy~#MtP3043`#m3)8}cr21EobI^NAD5 zKA+vOFegbRy$CB!7>8I6DtBRXfB)TN75?Qbn{R5D8JvJHcx~@!J**54P3T_~V zw~1mw6=*%_b@LoMLx%S0apg-rkdss0t)eQU!R^&e%7P~zFEDpw!g1(z88Wh#9!y)% zORMGzrCU&jNqkBVYL7@1@u%wHjA!i}`%#L#9;eWUU)W@e~IPo|^Qt z6mKj%Sezm8rUr7k!pv+V29DSBXh2`*prR*_P=29nTDhXHbtpGZ60&?N4pl`>?T3OG zoIUhtGH}JpLaK(WU?r5G{hmaY^4ZzqGo@;Fo*xIVmZS~0G#Sz=VrpL|6d8_uQIFT#j44R+;_q}cddp(rhxXP%ay+eMAAM+>AeZTwWPjH6 zbQg(m=4@n^L!*i5UTnqb_x9+ytzYAQ!BHH@X3v}VW|gexI_o`r+vm+W%;^uMks$Mo z=bb5&!7_=voJRUN1AUJ&m6+Mi)N6F$Aj3_%Zb!(A&ACr0F2 zH;H)Ezq^uQ&!Oeqz;rT`%hwUn>;L4I*U`mi{ZJ*5|sD4fx|jchT`|4(-N@F}U=#N$EllQa||PUt-Y+9Ffpdt*V{pkkgjZx&R_LX&EV* zF$jqTi#*nV2_PL%;9E@1w87ZbqN?m13z1J+j@(Kx(GJE^+r`Q-T@tysC(zpvC!<|x^#pVv{Y}w5-3UDyX z|01P;2Iq5xzu4eDIuHyEi8W|t>Kk9u3|(agw_>ovG|H*t&bq%|ip^>7oC$+L{HqaB z*?9M2X%CH()XcQGbncTJMpLyr9SX+X&$D66-I2Zhp5NM1&Qr%d<0;H&n91H8^`T^~ zb~ZHJcTnAmfgv%n&SFN9I*ggXu=_nyY06_@kUpvQTj zl>ZDCfyC2}7~t>_bKEPd9j4@tV0z=w_gSKrKyaR$rWgqi)Rj1^{T7y~87>vh+?qI> zIlDS{Gj>VNJZKMyA#P9SAFp9ogx(kZn`8>QSqlmB(5Y z#26G<2QtX4>q;z|)xG9!595Zmwlo@!g`UGvC$EUO*@I8Kwlh(7YtE@RBOy{?InV+ zz2bUk8J@1pcg7bP1ca;RM&#?_LW%P zrk{LTwJxx57OeyjJkHRe`dGYKil&2(j^dJLwbNLhvAJL?X=@}yyv1=dF%?zZM#8QUWb4-@bSB^9J+MEQP;Ss8&^`UaB2Ry zO;GkVDA^l^Ur3$2vx>1;DcI_tzH+6M;ma%2k#|&kqSjg|Li7C5${s?6m|_g0N^wbD zBe_f8Qm+ie%TES5HdVhiGWXA(+Y0DeW9VE!E4|II>3aXHs6?2UPQW3zM(Y{r0XJ1_ znLB%abC?UGH*C(%R}Hyc<}8Z!(D5UzdT59nd$K`&DW7gXhhHBHg&h0SHB|ikjJ}E^_UW>>Sr(S9 zRPTCf!VLS=!qK>s$GpsI6&Co^NMNcX@&(n&$A;5e?iI|Pey(9X1|3~Hjppex_8Ql4 z#(ff=ynOI=-zMJ4%x=T%j;gFcv0Jhj)`x!k@O;mfAj7_tZd^tY_YNla8wo;&`36ibKS~TEmt@(StyVUBzL!D}})>XrEPo8<#^$x%zTa(y4M5njSsY{&QqDy4o39~x@ycYai-Cx_}a zuFJ;~iEZoj5MwC~n4DfG3(~wZBYGy4d{mmK9cjCO#S!WFvxz^&d97xF3bt2~LKtnb z*oYXUIvdS**O0&Wc&~4^aebk~H-Mfh0q+@M2>(}_<|JzF*tJJ$*Ar-`w3|Qu%FsTY z31JND(4HHx_}FkWOt&lNvDba|ft=4lj~|#Cz3Z7&V^I(nxhCU6?RWI#66zCjJ8ZW> zJidOSLU8P^&7r>Y87w+EbhL=J?LqeW+!mm+FBX>)e9ZWL)<7#==#u z8dsJA*Ed<@-Fa@1=5uV$(YaE4Cu#?e0j^Jvp!P6__sx51Z?o#Pi1U`17Ay&5=teXe z9+!0~BssuOs&xyVT>Y0X0E=c-a@LS##yE9AS2gc|DNb}MEMDT7m*0jpW0cglyqZtX zzE7+D@*UKDQ2()EZne_3NV|c?hk%J*U*RU5*vIy=2$Eh`u>MsFTy{_O()c*fWbqO@y0onPw&J259r9p1W=Z0kxi z77WtaMe*pNNUYIF>8+GqXE&?ru;(y0bR@6k#rb zTRn62ZKWZ1eAew~$?~uikOT->BN@&t^38YgtJ?L}!GTw9HLHD@VK2t`DjssmIpIck zCriMl8~wZIMcxn2jF^4@H`dif#lUbBS8w`~QCtM5hEco#Jv-=#egr3 z8;!AX*4-E&iKuxmv|tdY3s*sj-;L_SBwd95;YHdpC7Q;GG;bkJExpe3R+UK4$}H|V+Rp-@9#i+4Lp zz0u*t3w=g2j_bv*b3RTe*l#|y8Q_0EF+=#H3>_6<+q>JBKf=De&VK~QzT`e3MV|f< zRv?rirj@9cTcc8}+@kA`|hVm zNgN&%fCjzE+9a9LcAMLDwS&zo zLRsSz=P8Sz7(uz?857nw^c-eC-8^sHotTcf5&Jw_C^<_wQJd%$?eIVV*tuE z;7?_N+%Teus&YJwqq0&1nPgsXCcj1AdX_+=#7sD=8C2jjL_x1iUh6_C;0>b)VShas zvg@!azoVfc)%|mbElX8tJOQ7bjbeO)jO-*StX&4$k} z{xc?8B(sL9QFqz>l=+jG5KB9W8fv;4Zx~37lAQQWBU?wK(gt>yO>*81q4R*#dTG#~ zLiE$u1nM)nPJ14#XAj;*Yr7BX;_EA*TwJ&>QB>0_l4E!myC(|9>eH+DH~bJbqn|~0 z937{rvO*I?bEg^2i9aL>yiD+;1zgWk>KDF!yyHn4kZD5oQrwKT`B!g( zuxiwE+DaT2AHQL#9TgMRL3P5bDhyLp7~1#AQhW39`eg-L*>uxd43j;&3RB1|b%Je} z#JU%(vT`$BWR%WaWQh*V9^pj)e4I6AgOzJ=ck|)EXA-N;G2;rJBE}S7vTs@PZE_tn zmLsP3y@X7f?%!_bZps>p>&JkpstFD)DtcRLKYdf+$-MNB7cF(Z;pw7MuU#L1rji(H z+SeBiKRnV(c%yFcE+S6Z@B@xQe@ZTI-Z&5&Dl=qwu`R5S;AT2`a6^LyXUTLoYcWJ1 zR^|;NMi{{&*1Ak}zrm)EoErVW)836rc(^3{UTC41&o$IS{Z6=`)M*@1oVsYga2#Wi&`W;aX?>YtX1YP)$DoIfNS zy;(`a>HRQumI{YZ?%n<`_(|qK&I@mZUT)U6-tB2xsdfdbVS?zA1r zTL!YoKp)jdT%AT7Mo{HSc&M|Zt=v*?MwQjYoB<6W7RrW9Y(m7qyYr{oiHSTR&~hWC~tAC3UsLbN3O*kmi>@v&=3(TA1>1~2#EBke=&U9qBKH7Ix>&KsL=~24Ng1^}1H7=JpC3eVIEXwNf5c z=3jpNVqQej>9f407(53Ge%&dzX5|c~4dC}BA75V}-q^z9vzu%Xp4NLh(EQ-E(`*=8 z<)>CIxfe+%7guDJl<*J{XL~LNAmLc>R@e+oZ(2T=$YYgj7@!?Pwd<* zF_+&d@r!)EoeS5;jgm_h&tS(>Bbw;mgj&Rn7PwiE13#wgy^S32b8i#z<~|(DUikv) zr16$@R8L|7U&2%@G-&~mmzaG1k(7n~Xr!ks-+R9_k(G8H)Qv=2>h;8YKTxDrNvr8n z(kqI=&^FPau{2xlQ}ZQdkHVZpDO6+6-k)#GXS8?Ybx7M+#fTRQ#N!XomXI573ms`t z!|AKUid8Ju$R3k0)<37m7IdK;&gx%4^(P53s;R9V0v^GjqS$!--8!U*a51s^s=crJ zTa<_W>GN+~lwT*el3PY}ekJP<$DG_QTSp4;-0BYN_2O~8&Y|y*;|%JmiB#m}H#xF2 zJS6(9%A*n!5*>9(%}Du}H;}^HMX`Jkxa_>+`Qpq&tP|1oG=$BLQbL>GOS-&F(PRiV zIA%v6uP1fKwG^iGwuj&UIoWHCq6MLk1{P(-^uiLL~H^D z(R(LJZP}CE3ivAg{Bm`@e`0d$7))7iQZ-!v3?eVP%H^(4p^bdFvxlayNNGoh(~lb6 zc>5F5VcwL%H)hL z^SQM~e_EWcJB`|U_7=UU$y_ITloXyt6yLgvku+?!Ij>u;Ln@RTgU=@_pa)D~KnWf7 z$zxd7(#^qof(ZL91;>+H;ZH@9bvaGB#@El~Yx$l5*G*mW6*iMW_t~ucNFgm*fNA1Y zTLm+`!&si}s~e*F+V8#|1}r{LhG)cO*AGI|M`}b7$w*^qymh{eh=xm^x9j<$5^XHr zsBNvk_3#-Cj4dDSpRKdY3dXlt3dQ@WlrQ5W@Pt`O;FIcC3m%_##C#s?`x#v0O~CIp zd5J|6v7GQ0<5VYMWyO+4?rm*##Za{rgVAhWZHTeKMZuzY?@!^z zQLW^1sa-Sg)_RWQYdw3gtce3h%Jm8}8aX0ySV3mL^8LKtX|Y zF7@o!Ts5U(bROrAeYGqhR_nL>y(-qHy0g}+R0b!Z9LoYF%(QE3hB0#8B}E*E0vzE? zfY0D_+a=^F6c?Idp&ib|E@N`no$Hs&t(#FZL}04Gsi07y#`n;3(|`Uo=ddy`^D4SA zowdFKy0zc=zC6Z#h9QvI{!mW3oR2C9@6DJ$xN!XRH1hal`7D&QJqk*sH$W6e5horKIhX@>OJ z)_gdrFX>frk?C}q`%C>XKi{(UfN0wE)8}l1{MhikF1Hev%k46s)t{d$V$UjPSx2I} zqIXG&c|JzlSh|oCTX;zuB~S?sR#^{JA+3$pZNj8i_kDDBo`Rm)HP9W+;DQ-nXS**b z9$hFs8$qp-u-2QXXZH*lpNEgtcoR>GSTm8^CE@s`px4C8a#5SlAGwEG0vlyr(>R4! zRjeQTgypMh)Tdp%2KV2b1FT=-y;kyi5+S%>+~X(g=d=mZ5lxp{(bK5;%w6_5ILcN5 zG*`JMOccrwp3)KQT4w$rjYjcJ!1Vg#^{fjt;sP$rkmnE_Dg1}9*WusTk>k%7Tb#(a zaIvFj9-a`LNxt9}fJY}i=rw_?974wjS-{eMJe}s<~{ZU#!k)4MRh= zR+tD}C$=P|(V!L%^z&`;@f#DX8nW-7eqG(c!zz@Dl9X;WKi?`_CE{K=aJ;WFm2trr z>o%YEBa~Ry$ZnZ*%|Z{2L`YX(_~R-nTK1sF70TviklIP&`)CT0WRI>DQGzf00$Sfa zKY3!)ZmKG-CZexPhU{rXl<#g=n^!ouQLCO6UkRV(jwj)>t-~XdKV^bIK{V*c{T?A< z>VlCZZ|g-mpKK(aAEnVx#suT7hly@KqsqvGg*v#^sd}1fGhyCwY{2|A2*OWb5D0_= z8;_uOV8Y)>B6``^18Z6a&@^9 z<85?HXVh+y-8ev_l300)$zUl<9mPt9{PTfzIGjf#y9Gy^-R>)g?#T=Yw`_(;g~=vg zR}!5uV~RV~Z*~Qyoa3c?gHrOKFP+jx&&~MB;&Gi4|ds8YF0MKcnB*M~nZAZXJjPyYqGdcrIA<_naenHz&*2#TF!5gX^2U5M=We zdkYaR3_>hZ|1nj+C+yF(EkN$+$Q@|9^}GNmNemPvk-)|s{tZt4ncBa#e?th+Jk*qQ z@n7hr0Ssz9OdQAMgMV)G&;PqG@I!xJ#kdC({Qgr6@cV%{1affy+~#lpzXDBk^}iW_ z?%adLa|gRXSovY#{l6CMH|_n?--K|`WL;gU2Lak75G-f2_kZa3U+*Zv0bKHoIKb{L zl!V=(B%IRrO&UDN1oW;QU%$U(g&*^~sZm|7G&;!6pQP zCKPJY62E|z9`LlM%Y7(t`JX@U7yv!)2x9L-x7Vi!p!v$10QbN2v45LJM2 z6FLc>IKk5;4F8!Beyzoh;60u2h97Af(2-dXg64PzOpKWSKF&XPEM9^p2_|ou@S!&t zg`uX-!+#}#|C#?!4S?9na8xP~q2ogq055w$_sAROzl;{-1rq{I!s#fp9zdI{L5aWd z-$>wpdiTG?|G&ilPt^9m#Q(pX{~zS=|25}-Lx}$KYQM>_rJW8qX0ZI9F@GQohSl)+ zyF}o?0J6BRA}$6I%A%Elq64q?;E!lZ2>AvIHX3wA7}}gnSUO&v;gd;5e4&=76y7UT zlLfZIh$pCzAyB!+lJe3l({QZEa3o!yK=rHcvr6-EZ;(VEeL?!=4a2JjhpQ+v^?DJY z29xgEn-YTBDVZ#WL(+*;thvBFe4mHM=JDUz{Q^6XA=m9l_E6j4%@-i@sYK{-9{my# zfay1)9~@0d^{Q5+fy%Qo*B=ilWtIeNcBgDX8TAKxT`}&8#i~M~B*JIpY}}3~F=OTv zBCN*p*%PJjFQ!81ut0UB?7aB~m)<4QsMaiyOkLLZ3(@9ai?Ge+ksfPtS0v3)gy^#A zGnlP^Xso|U1{NJmmOJc=S?K*YZ-8Qo`K4lT9CU(8_XiL;zXtJ+0%m{SE#>-Qz|i)1 zvEjfs*O3ZQlF@K=^TDA+nF%q`R*_9(=)NGZTVB z{P4>i-xhWI1^K7{Ch`}gfZ}n1A;R)Y@&!u(IY?3*d>pu&>~@FAX*BSmH^WJc1 zC6`5a;GWS;jeDJvKqAN-KXiyeu?dD3!K`n$HCTwK*BdA3QZ&nKw8A)5y?@VPcUnp& zT__c#m6!E7Gu%Jk zj(^oY|4GgH{t4(m>#8f$_Irc=k;a=Vxy&a^ZQ=-M#GVML5xiPvd1}><+5*vTLdd^< z*cEa--KsQ7x5~5<(vE6$xspW0rdLSzLcouUW68_k7jKu%az?t@ueUGC&XGyG9#pnq z{-un3vWFpN@mpX4XsOXeN>Yfggf&~NKjeIGmO`oe2$NjmX`V*@BQFFj|0r4wNdjKi z3{y2Wi`$G5$5JYxz^C#RBHE|+Z;yCH6M-8b$0GGJ)KtTLty_Z|AUv-b5z2qD+8y69 zJyC!a-{^KHNhO<^U83DGup6&biu5nq7G45WC)6T*f&$%m*B;>NE@k7XX@O?ByHH4? zM3dVc+bcrRDjvNd%D(Z?x&8-5a>bmpUv1T9o8HaYbba9|Y%D|};E^p2!y4INZ1zg` zxT?ZEWwtmFnQ9PTH`$skFHi3H^c<@G--D&aFc?c?HJz^V06Y*9YxHk&bm#^2d$}Gk2);2PSqO z`E(VW(cgIBn-r)4NI5Y`1*HpETCm0McTa0J^d{AR`OuS490$%g;5QBO#PWGR$#uQ^ zd5AG;JQ4PS_g3wO=l$i!t|UmbF@IO5oW9}Y(WuR87whFW?GT-gV8}znmBs3@?X8x* z-Dx-9y3-APyPt9tL0KL?AyzRNl^=L{?LOjket);9qc^&aKDGZdbarbUK0NDK?YPeQ zIX~Qa=D}ji@D3;9=2>F>)_R&Cg6vfl9jIF7D`Xl_-(}tYnhVtau(HCUQvXzEXC}P2 z3o3OPv&(Dnua8S}lHos{pYq}6D&iUb&sAk+JHMk5-l3=tvi zlPAZoC)G@*wkt!n*bVqXZZWCb14$Z`>c9tnAWZacPysp-ZA1mGt}7 z&a-ezl`>LHRN(#Ljb}4IXNv-Leg_MlVQdyR-O46w)H)`r*4n2rXf@)FMjm`3Hj4GW zsCT;~Vl|wL0&bIcc1dmi*cprbS2Sq94YAK$?(F9CvbQjT8?*K2EZ{H%)}CY+2%X9W z2RBw$E0d?HjrqCj><<-8wuTBR=(HMTy*k1f9b}6%>$9dTEIUQ%IjuJmA;3qwB!FJM zdsEMTGQXZxP}n(1%0R+mHY3px!RRo=ktbU#E3Nf1kl=6DUqTYt^4VHC5~$GIz_{#w z!Qpm`&T2fV$%`MIFv;O8L)8_^P16=aFuudWp#D_?$UddibDcJSQ3&p6IxPIsU@Y^x z;b0inmg7`KuHoV5XD4gDYIP3BY)H>JHTS=4%~d`igM|4GWr-Jh7C4>1kRIQAkyp&9 z%{Tm$sqQsCJ^f@P<4SzF=$3!DXlog$!8cU3%XJ=(X(_eZmD!C$OkcP?Zl0IC3b`^; zprH&kZ0o8Nf{9o&!F_4+#B?I3n}7^C2Lx3Pgb?r=ERjl$h8VdWJ?&~+7WgHE0GU~@ zn;A{k(Yf5+Cbr~}r?vW_mrA=SxG3p&MTCwOX-bB5^j9Z9s?Fz#0Q)`J9%mq9>$KmK zMIJl{el6tG>Q4yRwC^e>tB+#~O!8P)-AEDPr&zHjLrA(LKC3cdM% zBF^-c>3jYTq5Ru455G{ZcV&jeaP-D6QUV_ zT9hF-b-IQajT)vEmpgB&-z0$QS$rCGr=xCJAf({aF0X~M#{O6(_h?R*6XNY?{^Bvid8xcGpa$vp@35a`%N+zojWeiKF1K5l)4gdeKS6N9OTOsW z%nfaUirzs(8Ibh7V#P`;MlEfLzfK8J~LO1LI^L@|3V`eU&uZN)0PlaiR z8PA*7U81wa)Nmn+fIYrV8VE6(!alk50&|hsfl) zo%|sX-0}1=x;u=pC;ShLlKrN0=kF!H7i(VYjb|P;z*p~<&m1qF&oKtEjI|l~N5DoTxN(Skd^xk9P?W?p4JT@?>% z!DN}MH7|*N{0ieW%W*x!u64CDlZ!N3q@pldo;@*=C-~lIN+4QIpv$J8lg0iP{nR>K z$TrtDKTDSq4~s_CR|uKl9n0-ykg8=&*7L16a<-ex)A;$i^9-!~u_LvMriR|}N_oqp zjp4{`+_{DvLRW;!S7;T#LaK8T1uv71tZNm{sZ3rCy8MT%382~C`u4Q?Z&Gs06dcV^N?i;5DBB5Ah8i1@wb z6%-59#oxDYHgDIi^au@S1&+=K5d4dx^^ePIAE=JC=&K05^DPw~z?~bbrH&TBpOJQm zk-fd0Et(iMlr7cG8ShHX9In~B`B50KCj7CzBfhH+N7TmA(LxCW#$Rt)aPZ9{? zA5E>~XhGESMd|&lk<ay?1`=SeXZZe>?HN$3z5Ny?_2qtcRV-i`HJQ#GVjT8N7*PHBiuqVexs()NWpD580@e*+gDW;_8Qwys}#1u-zN$P`k|p zC!+Jdii30Z(z}MsbzPhZs`d6+QpvpWiTX>e@P=c7qK-Zh);o`T{tE_-2UUnWl;Hw@ zeZK=@C&D!jAAMXV1{7cCQKVigX+HN=p;>ZAnTbj~NLsdEJZG}pOpWE|m1{-===%Qq z#{wIwYw3|Op+LVpfO-{7LQ(`40B4o2c4e+}S%2Y$j2}0n#!3cMjE(8@{R+!rHuUkx zh?UN;A%8tqvn6;CFq(37qp{hqD(~4?*ZD)y?_S}%h$gJFmE*DJ5z`0$&P#by1=zP)||Ubn+LR~YzTrXA4YIot_ydI;$Sp0taUxFZ^P9P1Z9=u<=-ZxHo z%GAx%SN`an=w3_Joicx3_)X^VwQlro{W$@pWRJl|v}PIXhs)5_1kODGd)y;T|K(eF zYyu_;#_8bz@1G(5BygW^avL7TDW)=t_<;#{=biCWx<9_uPrPV9Z*Sll?hf3S+Jf)< zg!3{9GDES1g$+PfoRH2Papkx*+&Y( zy)56wmK^EgKYo!uDXa_YkPF{a4?jH-qPCm(@ z|GZs>bGbV5(rNcyi#Tq{_&xqWzWg2q^5z}Xu{S~U=@z;_2p7O^K;RhLfQPO&3=r&DZ}>xk|7@La^I(`q z_8A7hiRhaonDU?7`8Sn8 z4?51HE$toXINy;0!dCpu$NJZkFi;laF4&CvyBCnSsvq{Sg<8v-$Q@o zaOwTl@5zz`9-HuCIx2ElD4ZoJ4!xqMBYyS?u39m9|ySwc7Kw`4HIC+klJ zVW2b4@fr*Oxk=zD;UB7025#K&(VRc-dBQJXjuBQKzB&Ij#81${6PnmOg!bDV_^{;O zg$g%8zk+UqJ1F7v%2oW9o$m<16zsHM6+&P7i3I9!_Rasy1l>%ZctICd`ri!V{dp-Y zG3dqG;vG==fX0jFOM_uke|vMq4%oogNq6^)o9F5^u+a{W+N&{Jv%aMS^ZcR?3+S-$ z_BOD7QAY%rfqQL1eSfilB3Kw%6I>31r?X!je6Shf3X_MScGOwI!wTc|7minZ+_t+z z?p+a7dexj-P)oc|Ljas>%>wFxbeV2vj_RnGkV_JWgMXdfF8}UywPLd2DmYxn;?j=C zWq6oPA@HrE>1eGA~&f0s-O36;1Vg`a5&4 z9jHPA>$*1|_dMIFFH0eREOhMcO;E7OzjfW&NTrp^g~g!h$z^BozO>$U zn|&~b3B&NJ>J*dHij=@dA=iqITAq=>c5g;=l(}O8SVSz^OY&T{TTeP~V>UTs!$=_o zThnDl!ohgy4}pyCRja1r^E`;)b$eknTJ}sZ8WKq=Kf+!2Z)vA$9*~B z0nRQIOtDu}^zP@_7uJvdQdwYy&CNLMshB$N-6-3+guvA&rv+$p{fllSdw z>Rr_^6uFimzvb+WiNo-fy}1N{?&V%`ck9T8ym&EEWlEDLof=qYcQ^OIXfBOTFyvWc zS52+#W1f-Os`oeqE4-P{Xz?;66J>eVESIwf;#jw-q~>NKxYa&fo^IoSYQ*ukuGa#7 zjGIH5r4Fv+#j}LxRf$wOt&eE~YxDS*xt-3+r7fd{f}aXp9IXyk=eAFk;S1`yr|Ps> z(dONdqDig1b2!^EoNIj)54YTcbiBqO>oYEw9heQW&sO_#%FK7@*ka!=44O0I z^Ed}?jTC+NxkJkp3d*B}xfQG`01?VgqA>u~3>tsM-r#y1#b!3c2Vm>WTI;Om@bKJD zr`aUJ!C`8fvJr8DO<-FMWd*5GNlY+SSbV1?;}H#Q7);Z1s&lzQj-=Q4ESo7I%AnOC zyW6FyR`ae(rhc_cX?dRHppm-!ijqE(QbvIL`Is*RxCBzkA!>4aGn~0f{YAI6yCz26 zs->MX>V;@TH%>_)me6_`0~OR#&Ak7>M<%N0?tN%3D)-_(rGw_n41$y@gTmH0+vg>h@3wPqO$$-SC~^vwzXh_Fv}FP8Xy^zl-*7*v z&@TDlODf5z``wm8zy%?9T4NLa?Bzk~o$b_D!^$?MAE^bt(&EuQ=^~*v=dL%Gk+>`- zsh(M>{FnL0=F0cJ@GpQ$O)|$Hf=+h*oHE2lx#Vjs?r+WJ$M;&B&eoA|yB&W1&>xp) zU+OD8(BPzHCpD|jKB#l^y`*Qo{q%XoyITopROr?=e7zbtfBg30h4f^)IZFIhbqA6g zG22aNV`=q-Zg6Bl@?+2U9mwpL6H~U4P34jKBUur-vO^Pt{HLbAG-6|w{BZUSi2LT) zI6z$#ri)|G0*3h3wm(Le!*SI}rnnQp;Xcg=(znAozK6Ta|`w@;%B$Cd9avT->@+$mFOy#<{Lz<|AE@RAYFa zVt#j;HUcj26YwOge)sSZh5ez~P$yekmZ@M*A(fOBoap$)$ryWTd&|>~D!V^n^=2e- zHW5D;J;1+e4+nWT z3};l!F3aK7BbU2pUYoZ~R;T2UIJOWYc^ct1g!SWO$tM75y+cF7XZ5PHGe}LkpX~1j z%=)v;CaD2F4^ZJalcHZ!`fd(i9%*>~ff1hDP(RqUZT``j5maGv~ea3*^Wd*^`Yk}b%DZ#m01KZmyb>o z_!%@CS5PhBa}|5HXs?6szx7vc9E6u9a+u5eiyd`E!Tt>CYSE6I8 zb34g7v^f|+v$HOc9q+|Y>V9ilrYp*!t0I@~IFeQ+f~&%u-%O8MZdY|QSFfA=@-|B%@ojfhVHy*y-HP6L zlp=^E76ty%ba>|)(@n;?>Kj5+!*gKc`jSh;bS=$sk|AKztA9ahjn8Gesxl{S9SeL` zzBw@%j%RcbKY3#)X%fd_8E54dh|4Olt7m=u^W=irrzxIa^9p4M42@Des%NBJSRWih z@sN4S4T2*Bwe9UXpGA?1q7Rp49{-54b?G1?pSIr+3Q}pMmCZqt~UV{WeIj>XGe8B^=6& zJc}^&%cJD^yAq6iN`-ty6|duROriel+PG;P;2TRD+ry^z6B1p$N_K3$ajaf1GoxGSYk}hMB^}uG9j_E16+8XP-4Jne}^?8-4}? zZ(gqb`m-t;ouJp|=aW?I@7G?R?hC;8Q>2B|tiP}^5rG9-eY>!G8Qthc` ztC+@Syt>_+Y5N^z^%g$qkE(SxjYjOk0TD%UTG$`Q}j>Oojx~Q z4-OLItFPGayjTPJGJn0jsbaF|&!HRI1S8`5Ma_*-r+bMXQq9-_`8zv3nJGFP!cuF+e;YR(? z$p+lWkt2|vvkza|(nKKYFa&74xbejG&phnD zFwoa*?eGlx_XrEX7dNP#TC-Q1)0Z%k!QC~BSWk6+uU@>3U_VrvVDV@W*U$Ia`4iQp`yvRV-_!bPWNAokH>!6GZvP%@9-o<}@-{X;prOpf~P z^~X!2dF7Ga$#ULAkg?JYA|Qw+(5j+WFe8kSL9gaK&%bw-= z*VsQod6tP6PW-`s>4sPj^A%=D$wZy&tkr3K&-yoak}lh)Af28qq?NaGn*3s#mNVWt zE`PBRm8hoyLJ@godX!Nr1e26Iq1*e~^jUFcSU3#5}|PyLoEqQ{AwzD8$?F^-vmw(q1+^H zsVHB|?0WSu3IVs^`~~lrAZngU;cEi3R@S&|Jg#DWxSqs%lnc5cX>|s81zIhCbW1)v zalIeDoi@qyF|4$`&&RXWIc@I_ozCa@r%D{MjpUG-WHZHtA~SnE4^OL=Y1r_29fIxl zI8*S{7D+tQ3+}q#L{ittl1h5g>8)@`VHsuWkB?neF{sxGg=hCujE8yM3HNIL6$_B7 zO2&S3ij~hk_??8pusP=z?=vYWyfDrSYq~XJL3Nbki%&%e)lF8r*vO{GfoaE!TAex% zb460`!fM55L39;kb)wDE2`7+_h?$F=Y#)3^V&Ivn`0GaGvp)z1T)STX6pgRmO?^+% zpU3VBBtRBlW+Y|Y{6>=f^<-Vps}16Q;XTm^#ut&)GQMRW`ck$GKf5nN3}wl(%@S2* z<0W4h1$yg^ji7Cfe~LR_e4lN2p5$>7(LyRZkzk_2eB>A*V=j9o->3Ce?3EosN{1V- zf^j^TtrhjYVnP@hB%=wkCQXE(DG>GDDP)`Z+4?z?|6R0)f+FjFmAOp zgZnpgY%>(6#!6Wi0ZPN^9a5Aaup)v&i7ijMDg!rMafIWzURuXYzxQ(YBuWFrQl~?H zJBGL44Q?x|--B#$;=m!2hZI&b(mxY`;~bYfdNa@2_R|8QiwEPY_o;+Va`4t(!qrAn z7w~!xok>O`_kx2b(<`#&PxTFrs! z=}GUeE>qF6{c-!q;@kSYjqrQmO!m&of(G&e*uef;R^+mGCPglT?U8&tL>%eY~u?L4&F(bRle?TMV0z^ zd)AXy$QYewDbJY6x7%=9?Aj{NejdKJW8x-+cY4ZdB#$lAE?uC^q`*4gnzc8}b!eU0 zeMlmB+bdo0@fq2Q5vRL^V9b5m>m(hx-iXfkoDzDn<^6;0L28C8IhKy00?nE{s|^WE z{9M@a=i5zEq*4mO36m%N^~Rh2@^$j?TO+lJGWBKAWN_2KFe}4xI(?QRU~EYf=Q@6& zmsAxvKBRiGF&P5#|LCoVjF2%`pG&=S8_}AxqADMmhIk* zeOkq?^YL4k=>~4$-)yTKaj#p@7vh@g?F5B92@Rl;lPu#%zp?vx08^B~D}Bi|37Q~X z3TsX658ZV;3B7w@JD$Yv`~}PV(fM{B?@m*jxm@sjd)XmUzY*-jBP6eQ|#YXK5w+F};D7R$#3<=<3WMd#%*gCz?w+nXxVz!GT0j zAahpJM?vcaw=E}H#tFeo&7ew1_oFR)>$GlD>}RB;@>D!5AzjCzEhoeJ46*@Pwm-<6 zKG-IEet!1KFbbX2AG<4`4;LZ)3gyLde5RK2ldg^Q2^RZBF)oKonA)-h!obx9xA8d- zu@mas;sw&hy+`Fa6x!YhI6eH@EuN{z(M3Q}W|yDf?F=O|FGVodCZ!el;`fva2Jw;T z=1}DJb^C!Km(wCbrCF9ZN798`9s9`xojGDFe^ip?o*14W$8OD5cr;Xm*{Ow%>sVdjNOzia|Y&$~gHf zvvMAPZLELF1!JZyYtH47EPbE3+*f7oAv`={-;WOXDM;H&ANgsJAELp6I8J{os+HXo z$l8-aWdno`qUP6}?EWiQM}@vWr@jiRo$mM}iulv%gpUBkgNaVP zBBJqdUXhCU>l56O=tO+(7=DdBwd}09LPCew74u;2K|HyvK5}>^Mc?CaM^6Ztg#4!YIcKyDtHrk7XdTV_epHCDek@wUMwLYzM0fRFwlNz-4k${b9%Rd}wPD z0SA~k9pz!C{u~sBK4Hdb|$56E>YMJm?)A1-e+pwWOd!2$j_!X zkI6iW@f!3-il^z&4B1PBax-%4s~iy-_PqYS?^zIAw+;!xr)Z|H4quacCU{<9_&`c^ zyyRnq3xCwm9P$hc4C1mrmmbZ-nk0(}PHsUab(mYp^i}<;RmtSM@HL~1J_{zMBG)VF z8lzOS8Ey^~A-2Uid#Wq`O-5*a$eawcnyApRmz-Yk%P#pfnD4aS{ zT|K^ACxAx7Ox5cL^j@__>9=*X(>Xu>e?aaCFCz=l;#Z`b#IM#a4=CfNv#}6Si04Gm z4#^aIHdgwU#DBQ8T>pqKeBcd9Ax(hen~{m~#}+DPrsk1P8Q}Q3QO91Nb=tI zn~#6>{!F$d33mkI)@(h>NaeY7o>n#j)+IY!Fz4XvN-W|?u@W4Q!FWR^9bD!EZ^;FZ zA`$;=%-wg>4Gu1=V}o5~k@sLN1g?Fg^gyF(XLL{+Kz* zZzvm*xo`eGY?L-mBlGb3wa6e~BU*Y*#%ARV*JJ13QZXVar)wMNC1N)xB$FFjKQG8` zbrt1|&?*`Vdgcj=j}Lv~!B;V<+6kr&qVZROTd`J57(N~6gL((6PixOi`!;d!Yf zE6FU!1cGdgb+?Ot7a~($Z8)9EE!)%N3sSaD=AkT8{nbY?JQ`Kgkuz6IUO#COTLM^^__Sx3Itt$6x(x^0um>&!Yrf||!-{aLDZ;O+Y6!X2KWu5TfHCP?jxE`#_~+H&BCpUJi_%I@~=5%cvhO zuC=nB?65u8Ve6Un!^rOC@c{Y1mS(iGdt5)%`8b_z^%s42s`%W-L3M^2pP>PNL2-4~ zD(d>o$C|3s-g8BHYiPA8+KE&vW<}emb&ua6xJ^3>q)xMvCy zo|v2!o8jVBPbN;YZ6(xp}-VSDCJ{gMeQzcJkhokPs} zBPTo#xleuK6x(Wb&mE!^xh=c-thmoaCZplby#NW2IguFFkMaEm%nm4gHJ_@gjUVw!5qm8uE08*Abi} z71|K8B7AOF?^YQWBLnk2t@E=QGN1k*MBG7ZbZ{F=MY9=;9yaDAPJNm^#N%?f%`l&} z9d0h^P7j_grcaQb3ZD3P`#e}W@cU`b@kVYS5g<6kI|kG$Ge37vx5xJfDpUfL2@Q(v zlYaV4kOtG=B~<(BD8Czedr zPS2)(D~>oy`MK>OvJAVWjhnfT_pBpII_(Z&eh1N6g{8m6WN0#T3o(6O$-JSkBd#p^|tlxSe;kt)0^WChRSN=lK1%nO#4NMg)Sg172Q1kSV8;c$`Uz6? zR$D^2?_tGy2ZSh*O+w8ZqC*!k2{^4KzH;O?IRlCT5O@qyLNuW#-AKsd<28oHk?%#o z2B;UC>tn|($!Oe>v*cgtTu$?Z?ZhVye$4qT%EP2Z=Q5TIO-R#bVC>Xb!s9lkUV%XU3M(jmOR6>(zf|j=+a@u%-ij-P)fn0wY&@Os1<+78g`@cMv zP}L-dzp2t$HA0?M3R=0RhWwND`;_ccZsRi#H$RBCHQQ|RQS9UUabGy~`(WZ;nWH(J z?7qzuj~MCvK@Uy-Y08+j=b{{@~t*Y$PqD;@)Up~sjy`5 zwg##ayy4sqt6R3^#BrXw_4ap-vu)(VO#a5E--Q+E`X~!UlJl7P2b()@{K`cW;)&N-*7h57uFVG~%d@Bt zMQPSr$>-M$yFb$TLBjg;q~_mJ!$qaOlDIURiqN9f4pnWe&-iiPGs(QJ@-<&)We4MJ z6ZZNn%{LvltFt{>p!?SX9qiZyT_PqV=+yxk;U(P*dC+>$tO-bttw=)qRI{M za_e~mI$>)1XVg) zTJ9WPCv|AvvurE}#a66DI;)Km!>pCX;OVFYVFNm7$B=i7cNV_%lYULBfn~K6ZIAU> z*U0v^oOlr{m4D`vgTDSUTz?3JO*&O&NQp1fRbKdpZ*lO#q1#EVkr2^VUTaJ-7y3bV zXP*z=z1(VkV6?ily3JxZ^}2z-)5gTZTWY1mU5b`Iy{BWKQeSm2VM4dt-X}A-aFQK0 z-go6)8NJV%KLLA@RgJHOTsR7~@xlEpJ87!GHX;(A@y>9Ha#a)b#nzJnd8`Ca+J%K5(v3e@Se@ zs%tOV=v;f6x&XMnYsmra-j|;VyqnC3&0*O>UEF=4WWnU{hS3}{#OVnNzqI&8skSTt zZCO9&c7^wxOEF+5}E?F1>BZ*U4ZSA1?|P4``rb9SEm&W;WK%H6}8Mkd42b`}v!7F3k!9`||1 zeT74>xm0VPfk|7FrRNil&1JD$7exIvV};ImDxWsXK+$r!_0}G_ zN#Su1jZ*PVXgM@6h+2O6*)7k;K3V2Bk_Pe6jAL zj?(u&oA?r{lwvIPNPJt}S~whb%n=)fJo`x2%q~e8Aw7H4tv@xQFR5N& z+-ych`>^rgyLkHLC}oH^8#2SO7ncqGkBd)7vcUy)UwpF2w3|OtzfOtxgdT5_Sj}NZ zuURLA&a*!iG`*AaG1H1@v{0pUshs>Gn^Y-!1wBmqi=}dfL=;D;6%N+gj08wtS!KnH z@3}+LuM(huOl(QvmqOXxr)YO6vO&WS(vR9^^|2Y6gUA8QIQ|*Gr<8(cF`RHwz7V?U zQ$NFVM63rIg$6^I(%m9WL7P z_C1snp$j3O10MZAevc2U&a_g7!1W&ismjQlKs|K=(i{duJQ? z(93QIH%~$Q|FHL!QB`$aqjrFTf`AApB7F!2=~N^RoreaIl192gLIeb)rMo$RbfX~M z-64JGICR~$@p<0wdB6MKJI4KU$GBtMA28NFd#{>nuDNEdIc+oO9BYk+CTZ1FQbqCD z?-=1=G28lC5}5qndhi@aYj2H9gbYEku;G>@h)F|L2cpEF$h|j$H_d}x1${a03wgpK z&CX8j6%LsCWRWVm^Z2q;iO)t1iVTQ!yTZNHEas&Tb!^r~v(?_tHU+-@$sT>S_ftTq zKwFzYVTPLq#hkJ@Zr6mu^P2%a11~u5)Vi$QDAq}Qwf(Z(qPawq&$Vw5ITqGtH@IqW zRBvUVd+vKga^e(r zc^wjoCbDH2Z(khO5`4PZhk5c6iXg!lwS=MxM z?pEbkH@Madw6uRNcXmAE>*^=bTYJlH=4F<0AuYH;<*qq%7>y|4lHDs`9rzj}ChdDm zZoXAPZtBS?w?n2rzi+s=xQj-K&SMIAlu|7L1$JnT(ZS~Lu;>>!T_CO>BSzB-tZpuz zJsNOEoVeeO23HUJvlSI-o4TSO^zrEZWlQ;51FnoA$4zi(3*RO>p<^_0M)D0{=S0*j zz=3YE`4v3__5CDIecuNysMate+C`1}Pu7`&JB<$EC2P1V@pye3L`E*&!#Z~<`Y&#( zEdrdYo6G($RXQ3e?Fc-Y&U%OkrBwT5o_$_zIw8ouUM|1*^#MF{8oPpRT zaao6=_ra#+Pt%%dpLinut}nh*_01>bSoQm_!uo}YyE-Hdgot2)e7GGOvRNzI(~VB% zWo_WQ5ahVHG8S;rd7bb0YR|_rs?XO`JJf?n;5%y7t1ad{BOXV+h|Jrl;EZ8}naHaL z_k|+n&-4N3%}ukgruNb24x@zwMKTf;B9HKI?>5yVwDEfy{NhP&A5z;l78L+3DTcp3 zEvt_mRltjSG9&UNWa@K=;0RG-xrJY>Mm1ajVkJ(t-}bcHfEnSP-1iw>8im#e@};JC zpWXE0)&{BK5{p;ZdYLuGfFFuXdVmRs;%9=`MQ+l;1!G!`s$27&YjySsY2B7KKB7t$ zqs7@P*jB~GxHmgbu8XltwU`2TaJ&W|B5%kw5g2XJ-UBM?_fzrd)zV&zv^WPRr^q&J zA9(b3TlyqDnIj0RdDC$Fv#LXU`eGsH<5>6WL#dbvjmao zJZSY52kDeEgaak%WcSFyC5{tvR(K_F4p{hBSakm8M5V+k?rb(MhSBV&duow)!`lxp zeK1=aD7aXR2ES=KJn#HSwG-9k-r@psnem63e>vP)l(D`mpfxIB9IS7?J}$T_J)V6O z(D)REk)JRYbeh|DG1^{5!<(n=O4Ir`gMGNm}T!RFX!eS;tOrut+gL-(@wG2@6SPK)UsMM z(~~I!E2MuTTbw{i^{lxO*>LkKM>@$*xmXX_UFAGK$2c8L2tVR$t#8hpSNskqIzAt% z#6HOIWm%uaeu|!afKsP%e}EEn*!X<+vY-LkXDd{7vKuu4=B>|4{3-Ad4Z4H`vg+F+ zROs-!SiYVlt+4Q(dwXQm5)yFe?O{UkstiG;N+G!$i zH3+`Z!Q?8KBM_WFR1mhJGt&A*{Ks^L*I7+^6LMmg_2XfGxCDy=|6Cc`4n4F>Y+e!@ zH;EATmbicQYrO3`zVi)vtFa~2{;yy3GuTyFuDxmSXFQV!8+jh!f^tqLYjl#!<;P@ zt!?gVTFX)$rE?&bsg+x@qA&NBoeLhNdc^MX)zeTzv9O<~mENif1*WHnLyI1ZLg%4x zTF$R4k@a^;EV$JxehKK)HLzOsz~JZ-Q_h3lpTSrjSlP8g1KAC^8O$6>qaYK^IWsWm zSZchARZ-~ALiStC4Nny)BTsrwP(S!Jk7CG3T*ehtuPo>3%O?KlNv6^n3#@F%h|j+~ z&Nh|%QuPKRTXxczC%qcI+cbH)yc)}~EFRZ15D7m_S+9jD&1jEXE;!Tk(b`sv!p#nC zf7j{uu(XEKRNq;~Q!z~Z+ZSM8FJ+8*c|h(a_7mo(3i!o%Uo|cl*-pJGCpI5Q4U>5B z!H>OkchA{DS2}e&bwG1y@ji*2>Eux%N2$2$Eg~D;z8A#>l4ghUDdw+QVwo#J^3u_9 zRdMCoOhhjSg9);Wkt_Y|irSEjnPp1pO5Y+GYCzT6ke5BaJ}e(@CU`J;93Qnun-x#b zSFGNXM$Z>n&Sb}LTTG%S#F4cStbs~X+yuds>vA4+TMFHj)E^KH`K%Sfn+G?ulrOLA zGhC@A?bC287=(SdSZH1-GUF8QuVvd?<1;QvYmesgR*A()aA7Tt{%YvPIVKvf3Ko5& z%4*lvyU<2Gmd#Tl?l_*Nj@XM?yAAUynUx&vVz9kV`kk z1?lztN76bJ87sdqCoT&Qhe~f(5rEXSpIt#>_XD;?C@U|273MwG1}^)ms%~|ykoDD` zSt{KTU+V>d<>{|)TT*%7nkwZ9Ewz4WzVQHH-Ugq=swbTS%p8Q?phzm&r%k}38-&?g z%sXxV2ASh-N28s&T#gh5v%b#cj555*`$C)B+1s-?{$^ZdWBkxhZ{8bA4Q=BPU{raO z;9P>it6?%W>Zz%fH~fjA;;u7qcM?Um&VF3=LhWK#gz9K@zbIwKj)iDA^`rSn3C>^L zPe(NkDS&+=_)Q)|&y&$1qyo#hw=-v1@8ar7ru%K@c&y?q1OpXIzaeAw5g;95+75no zngfK=9P-VJN<3+`d8JZ)E=R=Kx07#V&@0O}I_S!YHzKccRJ#l2iDHylNO-Z(%x6;h zeY3wepxI?4R?R6KPm?BaxB6)1P@gC|jH4%ZWNy=ZfPQ9taO2ozS7@YYjjH^^X_|6u z^5UqF^?C#rXZk=iU!sQ< zM~@VUlndR7zOlEKRstWR0`42nRYOsD`t;F*ii=C!>`#7;bY-1Ias8NW;*?F`sL+&L>8y`loE?|AkUA3KXVO&y0PeHD7ZhOJ|Qxb{GeqSUw1* zk!z%QLx6J<`;eXSr;GK%aMht^#@a+l2J%*V)Q+dqRzVv(Zh?)b#O=(kN|1Bz;{hJ2 zv9G4tL(rNeC^lzr zy)bHtRBaTa$C;t9A=H08%n95!LcbnW5kVNP31Rr|f(eA-?hv89#l^V$;p158Mzbw! zP}HMhprhn{z)Jq8i+PpG2zuL(KE*J#fH(c^&<9~Ua;=aq36s1>Ulr;p^IoSEUgS*P zBI6%^z}Q}O4K$zc3DUVzwDMEk16iQEK$>a$!HB^%nuO9-BA(yQ@F;R04pnOP(U%J+ zX%frhsr`o06^R>F6fMCNyBx%o0nzy_i)jUl*q`%TvfG3g0o*RDf|TSVS>t!`FJCie z;2+l6x&31kq>+0J5{K_)FeiU;{Rl3#w%E1}HJ^D1&n@_?2D6$NTBp6zveXO2ig(&A zSShO?3<;B{;jFCIR`ZmYl%aC)fzo4=z8?NX2j!|>eFmD1S7DX~!~YJ3@9)>u4fTA@ zNfP8#T@-C~gC-LX)^B^Hm+3jkj63}lq!g#T4jOrT6_kh`L_Q^R18oiqfeNgtdI~ld?2N(D;6- zgM)AVQxWu$k_KpZnxO9cUZ3t>^iyACN;BXZNSPBtp zu+pBvi`9Qs(gbasrWHX$Ae|-z!|p2UrG=&-2+A;o7w=QhfGIwyu>~`A2UNaA`qk}9 zdY8u6_DCktq&Ge|`2H89S(5bma}m>t3L0f5-OcjvFGw%i^}c>9`Wqeuy}Q?LMLVT8 zKYjXiW^r+m>*_o5i)p;TFSB0>AFm;zHt0+7*(&6|7^fS*(`~hC8+BPqDYDG|CnDw- z!#}72fZiDTb{~S%>)|<~km<^KBi(^fAXzICw8X+3-LVbNKR&ZS4^Qb?a8KRedG&6{Bs zfeg1^DQ*2?D_oJv=qX{Um2w|op%1^gdA?eilVESE1k4AQs-z`@kP^Vy&5iBWwd>b? zGzQQjY3LKPP__qOc%j*u;(%qtCGUWeEh4}Y7FbwUm6`!$Qsr_801@7vCX^zo%~8Gw zR9kGS559L~ne~UsKp#)iCJ3admYRuu<;+F}wG$ppQJB$_p9+DMdq)FsNsRq5l(?@7 zWJPa@&cd_TWHULGSzuHnlcTyD7D^-gd3LHPUAmKY`e{K`wj-;{940ewmku~ zXqT=Ck^0ou9#MTiI`<$Cdzs0R>|+3J_+ha1TLKjH+rjSP0-JD(+FnOXZarpXJ`+cf zTxy-zVyXGVAvjAjRmx+EWD@;rh_&QuxH%+5WUEyKcXs`wZNIr??W>YdxK7^u7?Q2k z7f&lPTB99tvUjZ6J6{~pUf2*%NB3&kqcbr%O(fySsFAZcE9)(7>Pf+h?MUUm8+v16 z0R5ss%v*whK|Oe^biG-w!B3ZHkwD}?u@Zc@ESMo9DMcbTnvml(;j@Gav54RSXbogyS znxAMh@s~mu)Dgh(0+@gP{gMXc@zdLJfZez3lEFr2L#+Mg6~<@fIXA}5JZ$&41lQcD zJwTMK57Ru6B+*5zv)82wKWU+>zqxy7f{jP%I=wbk=X2Pn8)*A_?iEA8!C9C1Pio=W z_{TH#i+MpEn3`1aN#SQ%eN7}C;Ns__{QQ)1RCQ=U$) z8@s0hEqjaG)7eyb{itkhCv)QdspUe10!TW9GP93f9 zyY3D}991~($9*AY>&O}I)f^hSS-8;BAQqwUxxfD8ICttSRBF+MW;9>=V^vbeE{ha$ z@94Dal<7k|S5SbT8H8B>00{J00}jZ!6+AsB@Vgrz3ETb#_Xb!UBAIpXkfcm%tS66P z>Yg;81;5Zf>dwy;>~r{CM|kR{!IE+{1g?EEi+-i|7l$z?h{PPEgtGVIZkxZu2WsAfxD9IFKSIK))qJG~TGyJ^Jt>hy=&3Cot4bF;472x@gtm?@` z9y$!?qtJZ%y2DHRDcary^C;PddY<$#was~3CN1=(man|A>?L<&a*l#oB@83euT;6Y z!D#8)D7aitCp>MAdJ~6m0|~y`Fczcz;f>T6r^dhi`=|uCmxe3;!qBf~xL~#=z8o87 zI$9yKcc_}=YS%`L5DQ<3$HfZtI&dDbTDu_qLm8Cm)Mg#Vs&5-o^j<1%P_L;fpCM*N zH4@MtY9NpkI-Ow-CtFUk;<2gnLM9&R=R8?pYYdrJU(}JLp`yekOY#{UVtty?P+nVtiy5y~SH@N!g=N~Eq^r!;sgnrn&fe(QF)kCa zc(E`pMVp=K;ZG7rBloq_MH#HI2)2eQ2NV^EvJg%IzSA2>&ynC zrE>OWbfG_bezl!apJyoB^HX3Xt<-~7#@K#*n;>;g<6eDU37L(}eJNrGRcYyb^b)f; zpff*>lhYMhPy-V8kC$>L^0oSCiv1_ei~ThghcskiRdIK0kJFHRk%hVFK_`dnVTAFV z`i4zXmEyxiRt+jUyv`^EZ5nwy8(;t^cU}xYFP~MIi9i33L`fD9rEqg@h{v}Jfryd< zY`X@mQLjEWihj;YI*E}a^vgqLiCB0jt<_k$hj&2huYEnZw@nxPuz;e&`PHjeOok`N zNnP9kpXgP~CBu;?uXydu+e?Hb8Y5YShQ&tX$ks`!V& z^jYnTO^kMs{?V?X^Hb-f`|H<5XFsuY9LgW{p1X*fG%04h)qsam2bqa;{wFw-<5uP~<8T*e{W(sz5Y!({S4F>%h7 zNSfuE71=x+7I-q^g~{kqAvt`8Q8@6Fgu%G?=U1%Hadbyz+_{|`S=sADV~hR|*#@q? zRDgvkB>Kg#o>&L2PS`dZe- z%DBb$_Y4ItKS#+_UzcHW+^JA2u#2Y%IO5gtoRT_mx&98mU5RF~_{>QlW`a!5vp3Z3 z*DHR#4773Wz_$9|=s85j)d3^CDr?XPWP%dF*=_r8H?bHmk8bI5IIg?roND=vSKCT$ z&$T|Kj~Wa)IedIgB0%h>P`qpLubf_Z7*lG0rm|o#r34w^t*{7KQOAn8lceAVsY15H zdW)ybRdR)_&?Loc&ZSOB;`8IsYuWUh7CK#7?%Db&DHvaqDy)W6@(>*>(a00YSl(oW zdTNmGyjV7J)ll>uU#)rI`9Ygmfh5R09k~-M9~+4-Q<3S<`7qJFDLh5|!njwH>q0AX z%4KsB`dP(Io>cSkt{O?91I^5C&#KopV9l89S4rW~tkz4VyM&TQzrQ~_`s89#pGHz( zhoVI#y=EbC|L{i^`M1-~=04zY#Zn2W028GGn5e;dwrqd&-Um)&T4l23A5D|8Uminr zlHsFkXG}<#;YzQ7cVJ6wrR{u=Fq2pqhLqU6ukP#8o$rNzE&sAE_#(+J-GTJ zcQ5P z$M!e$T&3L}XjW4So`Su>)tH!Y! zO-Ym~LD3m!sV5hVzT1TtS{r~6)`l#o$A|FKor=*Kd9%JpBdLl5xnubf6*ZHMIouuK zR3B?hCVIqXpLTfFzoPhYOj|mml&6G4^awWJnHr@(A!$np1@lHv;@dpi#&1Xy>(2=3 zSjDBXM)4zQQSL*}mpQ8HXpAW?+x1pvtxgUrm^;y<%B+%k^<;$n3NL3#nYBP+xY28G zxATm!K{Fduqw<=br+=T8q%~l-%!ozpLlC+RgyB%P1AIFct&r=!`~=X6%7$?*^WHm% zC3*k*^>$sMe|@pj%$z~w!KCnlfSGfg#&CX%zxu5qd9}Kv7$6Q-<+q2oUo?)QUXz27$|LchVQ3}br*>PWP0F*VS1Cy%E0p4h?{+6g-_(mreTZN8986)N_XP3`SlDEEuF zGDlS0G5NE;iQ>EKyTX}FsHts}|GZq=rNkuT6Ny`ZcRT~|xl^OEN$*5#8 z-`chJ6bna&Y1*D=mf%%UmG>i@B!~uBRd-M;qs2tMu1nVpj^9}pUokFJt8fxb6ISxa zd-#x?=P2OTey59>ZSXipp?9uvYZQy0@#uEQwM@&~n0!G~XlCnW`NS?``KhsddvCRJ z2MH$qR_bE;b0Bx%q24%cc#LG_jid;MR4l}qg`t2@)*tCxt~2%VnO+;W^V*?yJTTI{ zE5vA(iq(E-lN!dmD4plvYX>}5)F=b(sd{Z!_98L|OhL$qu>MS0_y`k4ip!eeLXMEP zVmcOM6!W953=?~1{Z`VB0mNs{YnApp;oC9PB%1cTd?fW4w%b7fxdOT}Y{ z^-t>b_+cMS70=t{GvyH=>^bc*)?)=e%$8J@RExBYqo~bwI!npaS;O3ArAmiXk&eR~ zf6E5b*+36bqoUjhX=ywG-2{nNE@5H+pU!=siaV4+Hu;<1Or}J+m4~l!10Busc*@mn z)OcS1;p?jkpTCOWcynk|8&9d-jYc!$rn`_I4lI)hU&1XRA)#LSDrTlS2!zxA;}dba z7tRa%daC96sxO}}@|_l}U@Lz&tVXYIRm`NrTxD2%pJN>Q|P zF1GVh!z!bVRX9k_1MJcIj+bA=>*zs!Efl9hw%TBS=g9o9@AohaYcwr~y6R~FkS@tc zMtO;rQ;)ZLEjz?7mD|)Kis>g2gd7>^BQ@sX7(CY1yQcwS`?Z_6*W165d{h|DhkJ+n z5A3&Qz7-3EiR?PhdG1R*LEEeE55%aH>m?H_*mxXOJq2nNX05()#+ooD!`u?-9m&+V zg{fUuXDqh0t+u>czsFML>G8q9XLX@LU$wciteT*tX7h7W}>b=v$PKenL}9 zeHs^Sv+@2rF+8<};8R-jURW2}uxN(X%FmehsMCyC$o+4LvWyZiWl^}c(9x?w56T1c z$vc0T6Hi>FgAR-Gq)xWw9QW|0+>AO(k}t&ai3)+aYXZ?d+1~(TNopcrwkf|=N7>DO z+NF%zK{Rzc4rUbw+hk$yl04b2bR^7b&E{9b!ynD`c z+MjmA(Wu8cpL&MUcWMw%RlZuu{&ahGV7KD0*q)V_k=tC-!*#ZAV4uG4AuXag)=yh7 zZxun-PPlo-{>&c_#@#)sl#}2VxAwK)DGF) zrvXg`yujHen~^Wu{hK?J>~#-?0pB9Su(n7WGA;qpJYL6h*Bx?pa;1uFlN;9e7FVP8 zeiIkhQRVgL$H!ZJl zk)ieThd%M)PzLo!KAoh1v7NZ&tBTIw{p0#*8VN2m+(4hH z2dODx?DfFd>In4pBZcc_y)^ z?Y!boLd)I*`y_N1r5m^NW;msk684R+bcwztM*TkDxMp4naxCA#n`4n?wRkpNQ@4D1 z<$ZCg>MsRWnT~+wI!cormCC`yz)vK{Gj$qSH8Zcq)Oa+B z5#i-bV3#vOik4X+G|T>SH@#fr9a%->LC^jjg{Pg#w7+^3fzUr`DmkvE=zVe0VOp z)`$@AFWUS|9Egj08sq+uxR?sWMa6J`$v;+sY58fuQ?@n5JEtN-(9AGSGL780krci; zsU-Kb1^*{lRv;UkUZ;-eXTXARUR7`d6h|WU%cvwEN_57fWrxCqi6yp}j^$j&z7Ip$ z!D&t?1vKWjhp?;PQmy)Cf7U+ISsz-Cl&7sKH!Hbfyx;3_PkSXGw!nUjQ8o{Ohxa}Q zkvQVvCZ*YFSSZ}(&!H(QRqOzZA3bBp61z$7zcM7PN``O0RPr*5vD7rHo2K1fEFiiL z=n9OcvXCgrQ%lLo)o}z;$U!kyS6+hl%uy(;O-rsd6dU=@FE5{l_Nr^KAgLB^?dQMn z@Y3ZWzy+yU&M-hq_H4k;R#iAzK}NNtziO?26M=QUp*ez)FvqaVf0BxypQ z#&_Ua^|rmcn$aFqB9lxDc#@`U$1G zmJ~q6@Cp@Qy2_@Ots@YkbmQ;~Bii?=21pVP3 zj}22L3?qPhMQ7loO|HL+kG#lrHK2Gj_g$j{V?%{99Hxu}(34JQjhw9w@i?YhdK08< z&SH1owy@zCD=|K5?|PHx>rkTX3{O6)*(v3lbHvNoMd%+at#!XE@SpU4;>y5gHW?hA zg^U>~^sUA4OTvt{;!~tPzia3~?(o6dPD!11kx*bt0qsxYzjl;|N`+AqUlMOl`k3E$_Hx=I%C?Pa7O z#t7DBcg$wPp= z&7fIY>N5S#?M(T^BKd4J1}iTad99EeeNR7WgeBHzf1SS95>4ejf?x!SiZAIf81O~N z9x@4f!fFyhJW`M~K(ZDySf@N}B^QgG!pO(Rhii%_3(H#0`0+IQ=m&3B8*p#98bQ%E z*qT>){_=5o|HCMjEc(Npc~*%Aa-ef*iRmI}nR1N}UsoR!yFBm-fWjpZ>mjSjVUOoi zPMvP81dXSuO%DfHoK{~JN3~DI6hGKIvgpAWDcYrqe4bUCA{oYnR@FM*8H=l(OXk3g zWqq<$p3k<%W&SIs)_NPQ43B#0^8ltMa@}~h-H~j^0-x1HM)lM=u`|j+%w$S2gMYGH z5kQq=;Wt@v(%SUzSu(@6S0vo11V(|QqBMFbFNun^j63Lkb>M}O#i}02&t_0fV2nVh5m+q?*vrt8zi#-y}JJ>P1At>q*{6zK#y-B6Eh~B zNA5q~|5u%9Z7@n+g!Cr}N!Wqz`<=#r{LalS9rVXdAyx??j29@=$=|8?7n}FbI&OhL zDm_$sMTiA@p9UwBkNtlzyFfMKAj?81-5R8dzz5|5=@&~F{}D*M5F4p|U6&o|of%AM z0kWC@*EIfB`v1WE|G@lz4l~P?N!br-u6d6~9PjV)nVQBd{88wbzao_(3wpDBF1nh2 z2G2S3!i2b(A2wjimcTf!0^2$l#AttC{z7>1V(7Y6z7^y1Z*DC^m>maD8;rQ!KjnH; ze7u@l+AxG|!3qA69aL$!|FsD^&CS3uu>Fa)NBEE0OO2rWRo{f;&s@GAkozQ{2)_#X znMl}!*c%Et^C0s*4sc|l`Mqk-40hi=Gcb-Vp$@-4gZ)f!ndIenU5zT~9h?hZO9^8s z0e8buBtAoCZ1js-Jc?@yt>=t2r|&r$id2Mx*ybf=t*g@#7EnE^&C zY;QpPr#m~yZA;Nq12XB5-V+9mvtQX}2jyuB(3*xUb;X6VjvxRqg9A5o7ywdN3`4nJJjmwJONt=h&$E)}NI& z2a|kpp#=TgokLI)!mMEch=$1kDhLpHfYsQJlI@YX0MWH1X!7Boi7pzTBL{sZzU#(= z`t$(9fBY-e04mdhG9vTZDb(jZe$sXD_<=3uI@H9+18_F^@)=Ef0>F@`01M{pvlP}`XI@wUmO6MR^XwJJ6c%fC2DozPkbG*B^o!loxgX z*FIoU0Op5p2nnx&%J-09`bBTXp$%$R3ov1S=>a~J`7g7fUk!91d?x_V zt0s|x${N5+ZH^^1Df!P9e***FIrR70E-L+#|8TnrhR^+3tPes&1u)wj+1p2dPICTn z@M^|%NrL{`jT^1tHrHHwyleO~VXWxf#V$>L+E7Nu`L>7<;HYKSXTAgjdmcDhw0siO zZw3Go1JhLvkA3yb&20j-x{CPFc!BNHZ2%@UY7^&;_zxbC$GdQ<>UBg>{CxUTw#;0M zMn3;*`R^Zz9t9hD&Xn($ds7RGjK&Z+RFcNn4~4+a(VzmevZhF`hqh}DX!l)1qX0B= zTL5-@#p)$`Xb~=5k%3m>>;&ZTa<^LThj+&FQF+|B8w_$Ka*?37b=!1@Ki`*4c>5~y z@aN57UT4m!CM{2}Ue;i28j4JuUjWR10fvnRVayGoqFn@lzwLnEBm`OT9lcgxr0ZGG zJPaY~hu=XVmnQz8^X?TOZ-fpa<0BHLNh6O(^tYFi1K*4+17%!lN1F)3Ac_PTnso+pO z!Tib!y&T73x!CG5a1NaF;6X`(3h|mDQ7ne!BCaz>y&z*}%QB16+*pI3f?Fs@5r=vR zXREsAimMV;rd&GK=_L4{qP&B@y$oBEpf9@^GZ?>e<|FiVFwV^wFy=*L1L%y(2V^Kj zSM=3|s|6r3g>F=J;BpSD*brLf$vBU zTOIWqD3>@z78#Gwsy)Y9e3f+rgMh{`YGi+CQY89#E<{SFefUE#tpaVPd}h+MNz70r z?LEvpcS18aYGD44*erw}d-jKm0eu(CeFNY!8)+}JE2pnR zC?ZW>abYrpE*s>!a|c3Sxw%F5VvNN>Nrqm1y&K_nIet(7I5Wx~ z=YEpFtT}i+>3Z%wl6!?&e`paC{~Kd1dd3gi`FMT8aXS>F0Oa&xC^mFh%wmXmUVa-; zbI2KWMO4TeqS;Ddp&ESsy`e?hfY|X|haS}n+`5*8V{SW)o>$at;o7(p`e*?7(LU+G z*k7*q#%`NV6rhk==Vr2LU-GU?Ymu7_!{$BU|Aa+IW-?Y|95(Yc|XL+wQwV8}I z=W7YnJFkHZ4zjB)GlndKB+8|x{&O86Z0KW7_MIIuI#gdevu35kE=W(vtvr~cp8UGV zNS4&~GOGKxf&qvEyTn{Eg-azVdwM2_{DKi2EX6}n?XVx5ezs=2vKSWuR-+}fB}8Yr z2xYM{C~^3qDd7EBuIw7&;UXH4F`lcHH!_f@8rHET7QWrXek2u@|$tjbd%JXW$k zl@rJt4sO4J)L%a%iVKZzton~qK zv+~6^d3L=KFmO|f)L;#aVH z?#F(cUqX}_l901s=ZF!bAgq7?%1KQ(p z6AIv%*Niski`jcxk&p6ct7v%^$W12TjrG0VDfJn&T3Wc45XY4Nzu{Q{b)-L-!R&b| z-0_IzvC4hR)q@v>vFe?~9J<{JAA90P=5Cps?bn{e8@~|Nm8Z*Of2lJ~CfJKfANG_0 znIS@XYR?%0v&>VKzQ0S{0C!9TTO;z`cKVI(4`~!DOkOK~Z4iK#hDFmVW^Q+@Q7aVa zydN%d7}%Fh;J=){({P^^srG$5#!sg%O(r?ngo{$EuXKtb=!JGuYZu=sHHZW3knu#u zOM=rJrkqvucYP32lSVO5BSfqIQ`Fiz8i1c3wYLymV9=+B0vBk}4wd>vkl$hIhuKD;*F_hf z|8N<}8KqXQC_1E?;gC9dtgj^p4rmH$Y9*}Isl}IeBc-mj7z&Ttv;%o4+al<3ox_7` z&=?dX4j@L2?B42`L^y*wEuefsAd6#5iVtoF4@e6b0fJhK##J4rXn7nZjxAMB?9kf_ zn7}gf8vJU*r1(zdM@yWQRZ2}sD*S;X1Kg~bKz*zN2~j&_#VDC(*4kMs_o-EiB_}B< ze`{s}aD|#;Ikiwrmy8XTGb|o#k7VwM;Iv(*<0#ONAm*^}oJ>CEvTMFK^4+;IMdElW zQsLwhWD&d#c=FJ0yy;VbC;TUX#cc>=HhTrI1qV=0npcPR9DnV1Jb>~kT)vcRMz7s>HY^pD-F{cAM1B5DR&!O$rl4}$v?7(*hEUC2W zQb#z5o?cGO%JP0#1dEuR6vU#JS)?p}0m~!P$g^2`TbF+a)h7n>$B3VonvUt6?R2nJ zwy5$rGy}FI)!q-^VsrXcrg~-g1DJ}qi&CwIi(+;X@qP@*mHa51{t`%aXMnh#DjB8{ z?o|4wnjt7h>AU#$T<7ddV~bRiiN)W~gfh&H;<&dCaC?&knNbNxBqJ;cB)KYxrRP*> z_g$wYcx0Sa!6ci_WE5>4xWt^{kP(Fv^OosQEqb{q#!<5{2p86dz(foVm>IXGWKeb^ z0H?RT%=abe_QgF_KqZD-w}}6MY!G)77}A6f7vo*C!kEuPG;P*HjfQgJB~1lz0lX?J z)Hoa%ezZtSGD*_`Z#cuQ+A=~*QC;wUJEf&yWk^$EDWx<9_+R+-XJ||m{a$XRB)M^y zi1+ng=3bl}%nzNF{W${5k@wuGW@&BljMrZFs%9KlAK<S_jZz7Sw9S!r1Xpu4Pp zi}oMNE^~G!9?eH+&MgH!n~7lm{(xFqx;284YQ8mGLG|X*7^Y_rnE4QdC+aOr&mla4 z0X$LqzI6`*f;wn)Qi0LokGg?h9z3>VU$B2>5Hpx&*rN!ZNcX_+-%DrVp!~xKK%gp3 z9vUfN8b7`VKuw~Uxp7em6Jq-_9$H~H$NCaHsE|;P*$LQ#RsvOfbFjY0_^x* z14tdgPkII+bXOGH1wjB;MgDccj0z0Y&V7O9FOYhGO5CJ77#BU2f}YC#gFitHia`QW z1-BIzXwEzk^yElv0F3~=feNqi+bkx9HEqr{U z|BP-E1H8(k#*Ky4Cie~$fdV@dTGL_3P42O^UMRpSOYljw)TK`s{Qa~X01vN%i7;fD2WY5xN0M*8h~nCmDf2 zd&;77?a%bt0hGRBUX&++{$x&KASn+#@vj2-zcXtJ0cE!#Fk5?x%q6H@&}$D+S_z8% zx_j~PPyPDzD=>WQnckP+yMJT30Cv~{pqCN#Lh1-Wk^z((;#tffl?M*wlKgbno(;UY zCj|z*b*;nbul2kMtrY(Pbl(avXFyY9K}2yETF-Fk3Xzrl5=4}yAA?@^*?a%e@FO6W z?ls=hh3U`@@-500{qO|(ZUU4i)%hGC;Fdvi#lgKm4)6*OywZ@Ns8ah4pdCwVT&PrOiJdQQfk;z`iFBHl&wNgQ@xf)`LEPoS!Xm?S zG8&H{q@#l_3r5OzgKJv+KPb?_*HqtpuoUH0Y%PA&n_u{4HQq z{!kfQ9Za~gjumY>RZjo$SMmQ;?mR_7c!Ofk1VZ_G>qF=@?#m4At~_Sa)p5W z7G%szNXe=MG?*;~sfp03>2?gZ&$vEZ>|%7c$cx-6>(gLExgtPz81VLk<2bypf)uDg zWeW3_aIlsW>E9j7i>k-c@pi}A>ps6&hhTIn#aW^*>Fr^%20tX1-W#IbooG;FW z%kJM-x%_z{{`&>MRNto$OaJiVZ?yo3FbTYKA=veR0lg5spkq!zY15(zYlAdcAD@Fh z#s4UT!PQgn!q%__+&KN=0)F4i=6D8OY+MB$>O_b#OM(*)=;lL^ZC%rl^81<-uzI#M zVYHfq3J6f4gqF<%I=79XqdnV#SqW6g1{Ks{U1fhN$oz<|OB0K@s)OpCFECm(mGfoN z6&3AE^CuVhgsxF~)CegX|9L#zvdaVwMBoRQUQ7_In6D51{vR#mTa(LXw?RVnaXOD1 zfuT-^JFVa{9%28K%{fC;;5j`m<(FWL`8E}zs7VL{kMEfa4_mD-lN=ttaf`t!({=d9 zBOpo>L6yuM%&HvY=(OJ{(GpB!88dc!jDK6lXJYj6pRK7R2WA;%ou~*ctSVTD@m4sr z*}zE2Gu%KFg`3#K!9!ftG$dR#WQ;Z4Dj)!{PCInp*K*PMspUd@NY_Gpuv)nVWd;Q! zL=tCINg1^I=A&(OTSx1+M*?PphZ%$B+JalH&YKU37Wl>x&CjY02}02{A&m}7fF((r zeFbesh&?HZzj6r-g9PmJRcYPEi_6Jx2`-!6igwsrWrT-Ngl)|VvD1Tm*UsdY;a`|^ zHZPTinGEICwg8pse4g{oxjp1qFomTajcV?fqW6<;m~>kot~uI0=3Bt#mb56D!i0YMD23~X*pCn#H93=x2+BOJ361&4JHkR+c&2tdRCjUm|ll%FZo@u_!ZZM`>NOFi9Md3(a5xWJ&s>3FS< zeP|6Z!%PnC*GBTS3j0ceDa0t9kE_CoI)HVblvL) zaBPPThaWdUiItj3;DQCp_lFiU3`7hy=%W-x$x_4)3g(gZW=EHps1u}DT)*ipk~evE zE<)2raI7;waYJNnl%;N>Y3JaD>%pPV+D71eSJWE|0rC2@$C$QlwvJ~(_IaUUv|f*6 zQXf2U(&U|R5qIHq7&&qDI*FVM^R;gubU0Eu9^x?ITO_bgG?t9)&wBHvLUj1SGX_&= z+ugebj?Q0J&_*+cEH@rx%x^B}@YpRovEi4_qvSLS%QWfMhr2@)KwO;sfE8VHwxDXi zQBBA&z^l+2x;>z{L+*TJmAJpd?b80l#YOG#`poLSH>``Jk_t%w2MWi!gW=jt=K}?l z(!CK_QIEQYDUZ7}LK+(iBk9rM>m2k_^WuzR6$lLV7IeJ}9(%_mjRz54c!0uo`M7!= zWkhD#eK1abQg?_$`A??Hw*&d8nxkJk`+R4i(+O{J$*ngg1u^iOH;Nd%v7X4l;&~sC zh#Vdtw}nV8Bje6^oXBs48Sk!&S%ADu5%EjonI2Uq+nE0~fz#_aTl?PGU4m6z1NjC` zL1MiY3s}m--(%$IzflxLN|ip2_)hDoGF0e0*BRRCbPD#9>`HY9Q;Gcx`!keU;(qSI z?3XHD+X%W9gpBB7z}YJ2DXEs6F|6&+Y4O)R{Qn6t6zbE$U_;*uL*7|(jLk4q*ht16 z3CB6sm{^s19lJ#KQs^%C`z#o72R_;Hj*tI#a^?2%@iR&=%%Oq&%+X)|vgu37O!=>V zn@d>5lmaG0lx$Y@0XFbUs~x2;y(%zQA0g^>Trv5{?6^m4yN!!QeVJ7&L`-}fB8Q~Y zZ@_l?a{>ClZKr(0VRQ>se2ZD_DZ@rBABRx!(jYP-lulULO2Wp@K zilU$hN+}^BNK2P=DJe(@64KqRgb31|(jC%`(v6gKN_RJlJLkf4_WSOA_POV|AMdlj z@T|pJYyRgPbBr-Z{$}F5)%u~zxXtg?`+iO2bp38RnVKgjtKq3dAU?I2 z-(I(5GN5Fzi|L~}3ir{IXH>?DnOhGmYzbr-HDT3gmpYe}-5FwIu8TQ?e+_ipXE&id?^Hap9ZrWH>mI^#( zLv{y|*wcx+kp;)%Q#T*gGO1sJgMztxeNX8VL|*C2(3~*a;d6~pP?al$_LR|=_89{H z3oiwMeoR0VFIJ?sftotjQl}58ovVS9wevLxm{UDp)vuRXE*H1C8x7@0RE`xq_(KHA z8g6Ao^6wczg*vj+1-1k9!tQ4b3J;Ep??iq7L_y?Iqh} zSbN*1Y3`DKoA|iBzK1ZEz!M*NG?szm&t*wyUDoC%K_g@O7#{UJC>Q0K=}6(3`v9E2 zLtmS3Af@FyGtfF`A$HUC`H)IQPj(>CttP>GfL*ao#p+ z;R?n&X*T$s6xdv}lSc0QcgBF#5HGPaENC0qi=ve;Ue2%teFW46GmC*43x{_trQl_#fO2*t@&^;%Euea=UQXQ>!-P^48~a zW7z_Yz=a=te5p+cgmU9NFE!}OyJF=?^8HcKOpXFhwbIxc0 z@fY+qZ>=--3JS7Ql7H9^Zou}|;DTrP-%A9M3`?^Mu71|+j6Te_>tO3X8#7&ex~*!r z$(jy&0E4$b{$nb1r-X5^-Ip`WcswMX`(c1oF@6Y%*C~nGoa~*X4=Gq-MlFs-8R`79 z4n0+ZP9kyiy5bdg?YPxtvKDPH0q5pb0pn&h^}+>U`2y#Xj9oT@4r$vA3ILP8SH~Qu zxhI(_iT9L^jOV-5Rsao}zo3JKJo^FhJWJXIWPP%oj<%wUC#GD?>qbk2VicU91r2Ifv zqBvP+5=;j~CCJ$2qP`)gb5QOAG++?9RNG9842a1-7bM+~nx=I;-U~MHJ1rrV^}(Ce zh6k!Q%IIxoTeDK&=Jh2T!vB;2gUO+y+6P80kj5qo_%Arp9E6}#vyRFDt7!h_7`npE z5q<4E4t<|`Zx9Zte0E-I1577aH=-JDiw4!=Z7@Z@ydGp2z~u^1HPkOr%HcX}V2fjK zZQ*%Z@^9|_C~VF!dNm9^oxjIxZh(on_xqyvn0o2&DdKyq9jK%?)IhzwGS zLZQ(w%esK9Z}R-G0ke>xM#y7rU`G{;87<)GCUHR0 zj;VE#=LHB6+yjwzi}^MDGW-1;&1QeDc+bXTxbty1d1iwa+$1jp$;Ci_KAE*X{(l?% zE?Qs{sNdkRLASe93ha(!Xd&{1cH!Z>UdnFJ^SkUJCJ{(z25YvA9$$RN_h!=xPEzlZ zJVw-=<)=G+goK*H>j-WRz(T{+N!)N}b-?~}{1(lGuahAY%iUx<_xgCEQ8;chySt%? zeecfLU9fY7h?_b>H0}lk71^c@fx9Fe4#{+5c zYJm&kpk?RQ2YH$T0MOc(kYsz=`xv0l{inHKYz_^G)@CrM<0WZ6X6V5ilo<5 zyJFLp`)oJ2_R`LtEQ~mxxkEoYeyL<@>80G~*`Ad-%8< z8XqcuAp|H+Y+Qe)-o$4mBXnX^SQ^NoDbkn6I6Ycrx7Pf*f!34G|3D;^I=wx1Ke=+l zfWfx%t4`C}v`O?h^S-x$*>L4sxu_D#^4&+w`$ZyoWSanc7Rs{rN zMb238ynJi~O0RF4%Oa@!PkM={l-^sE4x|(?V|7?@%NofO5Dl@Bj@9q4|LTE30fP`! z0|x$=4!6==h~h?m?ys>wiR(BMCG#P`){0W2Q6dAlmjQy7`Xaxw6iFsqnG_3*f&gMx z%g7k}=eW4Ikt6I8kMS5p05+}sYd!hghq_q9n=$dflQa(LrHjQyT7v1S4vvqT_CjuP z&bRksflh|aKHNBAaF;-`>8Vou>FYA>sw^2|ZKvH`7PjJBr$=!BkgDu@bwD@&aZC0{ ziB?^Tp>&ysVoNkd;z;A#nupU+(Fn>nIm%FT>)ue^bx_t)NFMa1D9Dlf5-k9!*(a29dv5DCn#_UR7NuAQ1w%WSSzhB9N~?P z9vd~_6}iu#EgsG-$FDBiG8^n@>b}fP8IqPRi7z?RKi0_n$yKvqAX9Y7By*_Mbh;*U zlR2}jP_82#l#@h+==EpF`fuqqeEr?S&2qP|tNnIS!=!6n6Ny&qjCA^FuXLv1U32d` z{u-SkrEKfP9xXt1PuummZ0^=Bc4sX7J7G5YX&jlCG@2-@)8;e>%aj!i?GI0fznJkG zqJ;z08QuP@0MiNU$vg+f(HtP6%a4Yx;N6m%mQ( z6hVG`*bP-A@F42evh^xL1+On#m&>8%A?8=UPwvuL3s^mc>iB4AXs?Ltcq7i-hgA(< zJMR+PJraq2{;k(3TeYOSFqc1GnzFDth$_`qXt3=Y=i6RE%YIhjE2KPC>u>IQXuX<$ zRpc0-TxPj?)G>G20pDg;o^XMX6H($&WD`;Ov%Cy8yJLYe8#}L~w>6*8?4^^%b!)$# zInqzKX-VMy3Z0>RJyfNWi++_kQjT+opiS>m>LLSo2)Q>0aaY<#tD3v9Z$a)u$G)zK za?3YY{i4%~!}U|S4!YDEzw$@j;*KT%g4Y)~Er8x8XBpa?keo@9h`tI=2-fY=;=Ymc z{@gcpDDTUqfaQq6f@tR04X=Lrjxwv3!*M(mSUig58b#5Z&b(Lm7L97JD=guDd&U-x zo78D&w|E%3bdtrFpdjannAN~#O3Fo}%g-dr3_v$B$|y@{8Wl6NPE+_Qa3ku{rJRhf zOOo%m-;|s^a$Xrr{qR*Xkl1n9bM7OR;}@efa4C-}S>>_%`^jXrgkx}H+5o-5TUxAG zfKXwU8OdaMd@u{XaXd#j(TmpS&3z;5{mb5~LDi>3LuzUXdUnMVtgOSrp!IU%thF=S7v zLaE-(X;_%|^qoengHFzbo>E@?SGQXDcGv9$CP$2|7!BQG{Ep^-#Jph>JihMnzyUg) zI$~|#q0Tk|E`T^HP~ZO&fdgzPASNIA?6+Le5=l8#1^@zJ_LO_yKf7BT-?6Zvo~DG` zQ!apIY1NH2S9j#x85=~P!tOR+puTN&XxJ4uS7+38?Ib69C~3Vv)44ePF3Gi0;V z@M+PRKYH0opQ7xc#9-3L2)epsPp1th@hj2=vNrS%UyXj(+?BSwUgLvHFKk}KC#?2u zOwc$5J(6Clov15g^#cCD;dLCX(HY#H3L$bVZQZtQ9NGwf$_%P}!=1TI%=a^sTzYa6 z=-USZMRwZl^^5dhtyx+ES%c7~5;9W@_Vq4T-N}hSKL}0B-n!KHnGoOKP}Xw%v`KC2 z*Mr=aSnj=+1kyIG(hS#}H}!cG1{G}2`iNWgb1ReN1!gVTWEGB( z@-;ge_75Ueaw!Pg`-!zd%q1`5ZS^r2%=^Uf?sr?sSlj> z6rhSgyKE=%uB(%>0&_=f$;-XWZM#5(J((Z>`ma^?o>Hf$1?A)`p1Z#5XIb*|3wL=x z9#?5q185A1+f<3%GXp<*Z#^i<$ZpFK?P6gQ9WG4Qn%vkl1BEJRz7Gc+chz>5zQm5H z;&AWow&(%a`t=?9efEmz7?~p75x;zc2Bo55QpHlCwejnWuAkm5*MQhh`9ud^zx{jf z@3()CV*zY?)}qL^h~xqU09JIYa0o#geW+0H|0BeX&3@uuQO5jyOhtc2vZP+}hg$*%^4?ZSu}96vd?z*rQ%ri8`I|V-z^KDT2?hoETHv@SFpYCDLqZ9 z7P=OBWH&XWEy=ml)q-Bsk#uw6VVD!y>+Gw2>fu!8JwwXBM$W$Aam#`BfcOtRJ8lw^ z&et~@N`e2}Am@)n6EF-|1v^7cI=Pl7689xhL3m-3H`m~k zO_`l`5aRoU+7*c}OZ`r1U$7|xBktbMahN0oc*UE1Re^dl2WJJ=gfFFKNAQ|hSm&SI z=RpHk6enn+yuc=*_?q_issJy^V^%MeyY5t9@Ay1Hy(93Fm&EJEU9Z58!kve)j$cP2 z;yo857GI8?=9a8gbVV#>m^)S2jVtYzb=i)rsL3i)MskKS7N#5Sy`nSH&bQ_1 zW`GdtRh(Fm_+45=YwvgMFFO@0#%jBpw@_Af?M9H`E@5zl`COFaw>8ss?^z0i9!{_E zv$xSIk&>6=!o@HJt4eZXIWdSW{m543dn9ue$v!#OxjoCVw|~IAyD%zGuTz~b6+z&N z9yM)8h8Fd3Hm=YfOEG7NDO5N3Q z9g%$(#Txa3Lj$e?oLA_%wPY%_lKZ)~na=yKFJDzrT21s)6K%4}CY5PC<4Z74DM;)3 zuAX4e7((?%RM3~eIIK^9ueol`7N65f`DO$Wv08Q1Y_0qCp2T%bc4N*7OJzkt+6cwk zm0$XES@R30LcS41D(r>dVkmRo6&%{;M6;6cA6e`Pl~cdjOmI)u-aQN5^geX6Qz{k@ z>+Yq&QX%NDv{4dV--%$@ntAsn_xPv%)($pX{XQZ?a<)Rp|^P`vzh_oBl4@LSK~6*$$OV&5qf3>Q`yz zKl6Gl>+dp`g>^HyDn<01JxwgJ8A6YE_aQT_Z9y*Q^|+P8KJ}W{f7JpA6m_4m$Hz#F za|EfnOU!qQgb`d${xVeewC2#)glH0!4v?umF~fkz)*;xg&fMFNVN~o6Ec<-VM}v&I zxVXGSaR88m^^7FA+nYMlJ9{6BM_z<^j_B=?MzTA*j$IQ`b6Ga6%3D0}3ep}bd}XGO zh)TBW{|wT?^iLVZ0<)E?B-x@IUFfxi*X0J2>?w7HUSeStVn4g6(D$rK4h5rm-1dyW zTQWsSn>)o|C_j8H;Bmf5w{(HeINjo4amZ@VaN(?R#e~#Tti51LMe)vPPO9GaE$c8E zrmaGc2 zxw8%5eqAh!RyMyzZ{_?9LyP<2nLCD>C9C*Nlxf&GrbgEZtz$lrVWMDMZcGE_v8xR% z8}s%KIyaR~3SB_>EhcY`W&8BRJ%P6gcRPVoXV1WFUnRN2%)+{i-6sd&2{KtMep@W4 zE}802_6`%*5mvQbaE+WxKF0XfH-dxMc2?Hh{|Y?au*!oKEP`dzTDLb7XL&!@Hj~Cg z%SV-__(~$ej{3*&8IFEnL=_Kn##^lqkyFT|JmY=I`v6fITHb5!bY$ywl0T#HKvs*c zElw_1iMKV3>fQSC;*~1IN!H?p?kZ3D+~YboNgV?h=|m*~3b}-EdjK9XoEntUN`v)$ zfy1c7xsAzu6PvlLk<)(dR{p?>WpJa#UN9Z)*>YdT+|8^?fK#PJ#|a2mnXY4?7TmAz z6owWj6&fnV9KtTH6Sn*_a*<0oWUWdJukSe5n?`$((dOXEkWT1xAKQhVPZ)#<+RD#I z_G+B=VeJIMjuJZZR@)~vnxVbkb~aedi-*^p70JBs(UuUa%l972_fz98*v0PbBY=DV zXSd4thl6zsW)8ftdiKBEOqj~~m1GmZ_wA@@k9xx#1%?9W!ERxGx&fm2&1nn;FF-f| z_6BZTb6G^jC*49^Y5-y#p9Vcrnfijl5;Jj%`>^C^QUSDbX18<|CAaM!+QlDxod%}QeqO&A5Af3EtWn|Uw-$vv4 z&I^8YlkzG*B=ZS?D4Y>erhy1R&p|Gzg(BqbL*#N%NdV?Q#ioZcoB|IKbR=90<|M&q zJkLN}=tFu}6`b@1AhTCcBS+534DMK~O}Rj1ejRSq#W?WUp-K?23y$PM^atTtdyoAlZ43(@DT|J`|u@* z-#Blh1q~Efez5iw6Y^KUD;;f6>3JLO?9{Cby-?9$qQd&+JWBE)xa?ZEwiU5<6u1k3 z)9OD$dcFWnCo(A55fsQA-3!ojC{rIC=>^}ZgG?0mJuS^UaQ)HX8K!qkk^^~Dae!}CMfvi%8i0_1^ zWw3B@5*x5{s_X~Ta~bfr0pry_Fgx!*{|@D&Gm;(3zz-0gL{H(`hgrQ#FvCam-sn$e z>H^$Cm-eT~?R9|d=M17Wkett9>a}}T-2{-*#Tb0c;dis#ITM(GDxn~(jPLi6Z!3X{ z*^>Xf4TlRW7E`nihztl`YR?lJ5 z!FMuxWRSnzAZYmO-~bUw8&l~2h}5IO=Pf|?al(lB18xJWPh-z1_7ZY!vK}2oS0I`K zW1*G&4uU@cI0DS>;_3JQl&Sw^vjm)KD;FZ(Ah-7b zI@CJB%BWB%3&92?w$)9-4VVDmI&2KcJZFMQ6fg&JSywvbTN|KaX0oy8k>?E%HtgZu zcROGTE(%~es&uAzprBm1L=2V89W4!i1kJa*2?WsPElIok4cV?jt?^N8@; z=vifnnp{gX87m(u3Lq!N+rCjqPE?@9WnLbZ!R9SYDB$0po8v$>1=0d3gQ|5l@%X2@ z%oM^q$;7vCYjs=egsUt~y|?UoSn|*Tlk_9wtBZ=q%rz4u=`0&zXWtlbW^#zzX6CZe zb0dzt?-~VqkeUz286V6iG2&GSB3Mo3nX6xU<+Y^W5)JqD&Z7{&-c|_Le;*K%1F7jz zpj7Y#L_C5U#8VF$P$>N|sR6p59;wqk1bS34A=^_wr%L(Iq8j#Jyg3urwHCBF0a9`0 z{E?A41zNcw(S+IdaJfcvH|Jd-tv(*^ue>~2 zs_=f5z9H?F@2(SPPixjWX>g@U!#qFF`a9ja>rbsKqipTd)TJEEqHPqYyNn1(ObL21 z-E)B@(I)@s&?i^AO#XZgFIl$p=WrK;O|&f-5vuXs?+`zRI4s2*#7%v!VX!|sge zL>Nqk)|s6(Ps}80Hzdui4$Y>-UQhU9K9eYrG&^RSi(667^>*dDrWn;@r*YzW8s&Va zI`OAl+LCu^g$C&Dj)<#rRCT8NwRRHh2)G|rtWTp8v2<;``kZD3n7X&WQ(8tyVLT2Fo3TsHVAd(`N&RbOvOzto)& zIDX%h2ov6*#3N!(2vuPz;L0Dn^J|cWcmO+Hs%@7*3I`_YC!S}uDJv(OFubY7gbw8+T}Y{B#|MRxF6VY&L$HRrAMO9sQ1{VS<GyR z5s$om^;K#Cv*e(G%z1_>8T!SYRY6uqM8e5fK|V(ET-KQap0CPNIdsi{`HmuMLe|Gs zI>rHfWS9qwA!d6IrQT7;aeMdKIJ+C1?gv*DUo}+A9U{jg>#+NlRi)bg`xxU|^7w*W zPns-^?NSa${{DiZt>e;F_Fp1WVTGysgFE{_WCFWT*t03epQN^r3w{*G)XryC9NHvk z38itz{jFH0zaZTb&Q@l@(5d~2{wIp%v0q%s>}uPCI!03u3BUUTvm?IEzp;KrB>(DZ z=E2Gt3w<0j)9Sw!X_}eo;TY1tFdn5j@vWf8_DHZLlsS1Znu3-h$bS9)o57@Q87U0j zz5;*Twx%|#HmRsvEu->U$sf@4GJIbXANvfcjZqEK=?yC8O?1s2ic(FK(AamBTH|v) zZn%ngbazW9bZ>t)td6`(Y{VFmKNWK|GRIyu*JIqLt#>Brh06Q z`wT;a(LqtG+>!(TDB==X(m{Gh%-#T%H9-)%F>TnIw!<)SV$%q>Q5X#abIWk&z9?^j z!Yk74<0>)^#r{pz7XKqrg{FmuiWl>nhcW;W+bf!&>0s>WqqOr1uAyR z=!A69p!NqPnNKgLMXPzKlTz#2c{-F^Ayvq{^*e59g<%As_SDrPDl|GMY>bjFw60O_Pj6`@>+JKl^KFE zspb@~29*r@2H;mwiTUnOXwAnn(A#!69hy&w44EDjW<9(3Qv~aNhjV(?>f0Wi-B*`U z!;-H)loXG$NQmgVt%%Qmfs9rnAXVKP&%sJxjPjGksi8PHkT@pV{}I5bDgZYLOLEN zM%^tEn=+(tYc*U|q!@nsdFM>POiNs=j#@hfrHw1M8|!Xy zx=U~yv5`FGI#dC!fZER_!Yca(`jJ`esEU&P8IJ#ZbPS4dTt~iDk>DwrBSEReQaGot z27$Z8WP&~2qL}sSPu-XFVc1OEy4YEVwD zmhyf~X;?(A(L%aPovo2=pz;oL!$7ypU?Ep%RhaTUKdIOHm&I1|Df{+yM!>zXR&*V- z;XB6Fi#K{_4;cHDjXtCbiOvV2b*y6oNnx9}`@MzDtox-noX2RmAUW6erUe?O!a!td zXa4e+p%HFAkYAwCN6?AgOsUphTN83gO9G_%V9%rgteWo`M=y9jUfb-!~1Eq@j(v$I7RqIqQ z4-~xoO0Cdt`ynu%))85SLa3F_;=`Q-{WB2?1{*IG8l!MU=C!tvVwC; zSgnHbMW;_|r%$vg^Y?((_>M^oOPUdHfpK5T`)zO5i(^>&vpK)_w(%}3ZSLsQM7bEp ztt>0ZInhnYC?h4HHl=gIC~*ItQCLxmZ%O27)XvY&taSZ-u`hf>GmX^gt6dtv@|hFY z4IJsxy*Ab#a-Z|ps+~P^!wIzh&n$#?I?$pXm7j{fzgrXU3KMW^-)lMD81ZH)Ql!~bW14$U%b#4HLl`!F%dg{PE*!C( z@liRVez!E!(?PACDprIMxnF|O5n4n`d)Q8IfyW$tzi@CowE#Cx)jUhl%xFKL00`l6 zd#sT23a9#hp&D z-D1=@I92UXEWb`WtQ)$+uCX^$X`MOk$#!zzhqP(f7PEe=R$3Wn;7^+SZ zhTTXHY~$Bf{0^KJOqDfpzrnqb9?1{_vdVD8F?X^4?5`Ew*$_&WHW};Ffko{8^)yzY zeeWKBk;{?VT1L+V!vxsV6FelKtv|okqR(!9GwN;5$~~_C~>Y_o6el_WckEqm%>WORLXVn{Zi4ON9kj^x-N^K%~qvm zBrtyCDHwEl4(pZfw*7jX5HF`&U@U7~u#!aeyw}x!%TK?(JbGrBlUzK{rlgcDM&l9i zgxli~{;^L$i+Pye4;Wxn1)i*}M1vQ!G8aH_$K7c4{vYTSx+@?#N9^MwMx^}&+W>b! z+J~y6T0ZAy{9C^k-Ti^L1w*AwWP4S0^_7s30LTs5|DmlCVH(hK3LQFyL#Oh!v z%f$&0>p1KTq=G>d5Fjvs)~*7P!}@w~p6-{$>Yl0syRPv^*5lEyv@0=>xn!o^V65w; zv|Tk~#8)xJckc)cD5FpES!Q(dbLj#s<{;U61zN;HVBW0x)HmRbwHweIH|8w+(~W)} zuXD1Q7@<(_71J)O>2eyOx@+7){jNRsZ5aci#7)gc!DWaTGZvgHQ;G`O@GPkZft2Y8 z7_|6Ls2{{P{uAo|PpBUp;(rbG&vypa*_-@VEr41exXZ`0KRO)7FkN_T&`BgBUr472 zlybKx;E@3R2| z==zkBFk;OIKv^g(^qT-K4tR&TL1MBuDo`eFj&q>lo7><lwgRHYA8VAZ`lkE3pq*8_PUDb~JbZ~kATLXQ8KoVSf z&D^%M=v;Yv9#94oW50+I9vFTWLY;ni%bxM@W++lg62lY&UxP*(9ElI8ygQUl^H7tX z$5j9NiU`EtQ%cIUt8UOqT1)?4aZ;XN))-h2bMlVrO8P55N|LLm%Aoq!_xT{?Z zrWp^Wd0WXQ1xD=QGye96=PwBr*SFx9x>9jz6q(QX=V`ibfW!&<#4tSrAj@|UoUgC@ z=fVDrjQ}}@tuX2Vm~(mvXgl*&;~Dn9(h_`H3!~cY=&crz#t`#{5kb>H*uj24-?+x(udUGVJ{p(!+GtK`{^ZyHPy7_%?B9!u9CG2kBCKlF-PpZ@Ta8IF& zb3#eGBlhucE`rBQ`lC2puiMYdHU4OuOR$y#Q`-n8wo#xOE=7!<_mx~!Lnk3Ipj4W% z0%bRa(d^ce@;ORRqgadsE?qGSDl^v>1r0@LQ4WekIZ)^P5p^CEpj-src1M6_j~B5( zXUz0R<3gJh)h(BYuQnx3&+}J>=ZXq5XWtVT zv_N)_1E|sFOjZVD-zKV>YrTgAgzfeC64kmjThqFsZrqaS$M^{7n&^J4@lz?hie zhc3^|v49@SY75@fs&w5P1AogtDrSpxVW{qLA)jW+v5&Hc#m(2(mwYSfVmgk;C*lKjLbk(oauo2FH=SZ zu=iM9FddBf&*|hh#fYaNnWGRjI*>xmnF4^O=9#ON=@l_LC8bAm+DqP}38yU?i#&_W z6Y0|5Zq=usjY{t+@89mp*4H^!WQ%$_vb2C zIE%+G)^VoJuTdmlvn8n>zhQM2pahcxxV=D~SR-P9Ihe=2T{tt|8B>uIhz8n7B_4U- zLlD_+&6s*h0Ce1d%DK2i0+k92Gix4Ft5JvZ8>Ie7K`ktI<5+IZ0uOV24-W>+^J%%o zeaBG~5A=$2qItk)4v(@-`6=I zkG+5V0R|Sx6 zk3f&N<;rW^`;bpu*1^0Sj9c$QP1gjrk~N3q2F$<%rhI`m_;vB;tCn!$DiW46W>%zO zeBqMh?b5g927UzWG^_<$b82oTqOb15kN#TlMKlN|`y=PVKGN>y`EGp)3XS8nn<6Pb zxFiCfv8yYdDV&#YeHXd}$Po6f$xm$Uq2i*+Rscm9tWt^wC0jE)=yb?S6t02cxOiq@ zA|C9|^A|i}PuLvyDi`%yC;e~J-9WArCFkzXwG<0o>EUEmR^-Okf=eeTPW0Pvz{L?8 zOcVdn^bRODA97GH_9VYMtlXfWU_h3ENl%U*Zkz4x=(dD1nZNGzLz?8MFF^gnv={u{ zKfCa6_p2|1&b#7I5wytCBTQ5Y*S0X)wwi0VM8-#1`OGh!-(5(g3g*5!J*^4#IU}Gp zUxCs2C(s^b-(Lw+X0P4DxlMb$@XAk|Owr0!_Jh%|K*@Y(oN{vMG6}Y5%V7{`} z2>L*P3-I1r-bgDlXQgisXRKg=M& z!FR}DH>uJ2kx~Wg!1Q0`oEIbTY{0ysPFD=_Je-Ey$4%P_nVwG(kT^KAX%K!w3uapB zHqChcAU;^$i1NAq{Hm3IR0y$x#{|geYlE7g+tgsB9}PN7$bD6Z<64nw@xfIO!WfdF zZUp2~lP|Em2wvCpFXzEu%8OtfTyvN|8f20GH5vt6NaPI(D0~p{LYA`OIhed_Js>UV zxIY#Axi8ptGY7BxMBtHsAML^=URY3NcCi%cAMpUvUeGY70xKqZ4c7G|aK0M(6VwAx zR@kziqI?cZ!wo(|n9gQ^&s?wom7-tYMZ&QiyawND`l<{OJir`?z@o3*j(dYNUg|*s zA%&`PG(4=`KzY%BhuX%0nA*42OiV0h4OL^65qHJ*G(>k4A0E>WEeIyNE~f7kdB-W}1GA;DrAmBG!eMIE)~w1D;I)e;=^;gidjzX6)ASg*E}NKLh|aFL$eCCfKL6Z0EWkGDz> z2|{R8M345D1Jb?;4sQoPq2_uR2uMt<$b1$0fFv+kz-!=uEG2ph_ULB@PU3m}>!jT! z&<^5sy33+Fk`v^Ee_V}SR%KF1T%^}8-;*pw&aZ*O>6)c{dQ~F1CGks=Vu4V?Sh2$T zMYF9L3R`^>?wT7q)Ad~vgFDHUEE;LpPfViJ)~1rY?=Y*p`I6Y=E7Eq4RyZO*Imy06 z(u-0diBrm}cDjxjR+I&5z55BajOPQ8r91VFo^Zo|g0loY+l~$Z^#b_;ALN|fSQ)IA ziR2uY=0cbRV}na7hFf+CoMZ`{S6%`13%Xl@x4_pNT$)KSKfQ&g4-J=$5QvC_-TPb` z$e<1mr5E7e!dYzQ=a#3!MKufN#U3?h!$A^;j%pztaNBf3!{_GA+`_<`YDH6o|h2wZdtlLSo99+4uUKKyBlwdrV$D41py1v!HGSLcfn3LWI)NYM# zKTQTEQKF;K*t&DLV@P8Qp>s|cXh#zBx??RI6{hANWmMiByPtY!dpuCln&`*Os6rz3 z;&_EcCbey$o3N!FHz;v6>Nj3psUNrhhby@j_=`@@)f|}ww4+EbTCWa2U2K0yDPO4& zYg_ED*%sLlixu~6xyti~ZPVJ_5MutL*MtS7bE$-tCQ~28!#5&SayGu#oQdWrmnE(7 z-x@T^PCLHXpS}O-)OLw6eRerFwbcuYe72LlO*pJ`RcmB#mELUT^-#W+wBy%RJyBzk+Rvy&KW!PXtz0?oZF;}xbNvi&gyx#4QN+2f6^ zwpFeEB_@LP{vxq!wi`c=IT4+`+cT@?rYi59yj=JJ4?UDd^?-*C3e?jVnnxkV9BMJp zGkH|sPtS#YBgTccHbq0g8v;2bix#z-t$;q0>9!VTx5JeJ)4)a)Jm;Jf*JqX=+>0y<5kv8+zJ-;AeQakW4*L*8V$x<8+Ert5Dtf$y(t}At2+_Q z^$SCZnf7{k21!zJs%DYT(sg?q^WV+W98P|`CGp-ODn@F1uA{wLX=rA-rPtsSmgOS9 z%GPRxjuHSX;ND#x2$4;x7IRXh6bn10G`3iuxtX%JIzlVOJ=S_v3FARu5H^KO^NB6D zNJd|}=4@*}NaiI9buh&lYAsnREwQ9g4Hf7FxnIB6l1nAu>Vn`*77Y<4AUxQf?`kXP zs-kA^IC#LEr88eSB)lD=kS1$bg zi~#7f@9-WiC!X2B^K%MCZh`8qjH_=7(E!H5RyE;5C;i7_JJ zLhR)=>29LM!}*cHuX;NRxA%sBH#t)R^bghQsO@ZwlAWJ8fkEPveSOryQJHk)l7Ce+W1SJA?1 z@}nbGr#vnQc-%Btl?bjPq3O?5DB@t68b(1!ZsnJ`kZS?9#@ zqIm!1pH2JI@L#Q=$(j!gT5_u&K8jyMm#HjFAzFO|{7 zr5^9wXX1vHF1)>%hvA*75zSvsQOD0lmpxCh6MfdTZ zv4!$QSE?swj)EVPuMz5LmfI)^Kkj8Ruln6Yh$Fnua@4vp^>HT0%(}b|!?cw$KrFy{ldFs9Ad8CiC1rN(I)a#TVUdyz%U?Fg3D_8#MP z(M=73)oR|{n(+pjTg|~U%NZTBJ4-Zf3=x&cHPYL!MM*D=wpsL)D@E8 zV(1*NDpz4pS^dOny%w!#XOecR(oQM&&DE3cOuFte<8wRJ#%9I`>!;TraLjlDT%NLtu99Or!;xZs zi^FOLoz6kAlV{GMD&yUEnQdi&4lT^VBKN7%zMoq?{DVuX-0!u4=T)mr`Rou{E<&BX z&Pa0On(f&3NY(}mQcEUcRhoi6b@s(E9T$VK@-YiD$H{7+)W`)|CTfF$oFIeod^xgk zNk$BXTx~pAo*_Sl?Cqagr;L?7JWq@3iblt0a=An3w9it&mP96F*f;CMNd>0M=rkwMk`Lys|G1{_ zZKYJ^I|%x!`CiR${hD+#%U#U)yu1PKJUdpdw=@JPeJo(yM8CY!2(%9>3hb(T);S6r zb^h8^06ycoYhpLJGlS*Va-Eg~->?%8rHXypc};7F!?lzxeYnI~0FQa2@F2kKp%Dth!VT?~K&>r1Pb2z+j_P9lR?Dp8(_6Ni4GOv7Ji)CfQI~0F zZH$hiQ7?JdBw1lB3#vPxt01x+4$XR!w?mRQ?hFql#r4x9EooDfhKr3iJdCsA>CbvK z=4O&Bc-(J2(GdpVIt51x(tU?;GR#8I*R&AIgg;NqXjCgnKwN0!pnaK3MolVKFAUKZ z%H(|A!8#j2^S^FF#GRKH9<6-?2MZSmn}q z`i4UtoZCVJQ6G;!U5y5JFS4{@jZalqr$)Xn`PF8q%FssiD`;T2YNdalYi=7mZoW42 zfytf!y9Z4467)3VSB<7rRc?2_G1D39=_c!GJW*DgTfS~HFr{=vor!jv>&ze;SXiBi zC4gJelRxVn$ZD=VGL+;=^ReXJyd*r$j<>JfJkjS5O*`JnQZ4wkVs9RW7LcR7+_mf6 zVh(H}H77b=qe?oz;{vvO81ciECkcJo$1cb7-uIps^ZvMRK9Qinp0N`Ku9^zdo#?Ct zP0`vbpe8W<_l~yH_S`86r~Pga?`8Wa&X1I(O&q{)#eM$%lgiQRTE$u+x0Lu`(!deo zn6Ukh$vbhJSE~DtjlTG_%V)zxcqt32LgnP$wO4AI>!r9XXxmbAXsZuCTl$sj1RZt6 zG7QjQrN)TZy%+wK(y?r|b3hmI-YLiP*N*>CO!>KVzi-%M17aZ}Afc4B5`(k? zN`sQp(%mt1h@dFljkI*<5CTevG(#%g1I*A2Jo^HF>pkb(_qx~ftoNUHt@ruI!wreD*uGy_Zwj3(palBX_bo*I*(s_sq zD(~>;{Hmo43`>0v6mA?xG>_wA;o9|HqMhoBpZOYyt}RF5*}&-^Oy5?KQ)5=bf^Zc7 z+#KjM22py;xnFCanS=gQ3*hC=W^rUxqAX((!-WzhXvT0I3M#U7#BP@+9b)=f^^0+C zWk?+}k)*LS?2e<&^#DV0C|3{u`cwjsy=p9nn_OR-3^Tq|g#tXY)Fgr&A7?;%3*6;K4-R`--&4>;mr+*BK9Pp3L;wh zM~kC7NO)~gu|%E4zbU^#u@yU261E!bx)`zoUVrWW&yLzF0WADGL&3kd!f@`Dq8Ghy zOxgp2jLASU#4KKkU1DP9;bZ<2AxU~`(M=;c5;my=lVW_T(vEb6tkA9T5?S%TZ29?1 z7f4eBF^GGw?zF{u1{>PZHPf(M+~ogwqzP!8?>)Stbkp4cm9L znK8VU(%WP5aTnNz0LWxvU4|N4b(!IZROPKfF<$@XSnS70CJn%XKoM2rgdTldXq|ch z+pr=dxmPD>;-9NoJ9PYY-c2#RO66`*5sp}j18fO({ABn(|ADYdHAZ=?Hd4^T-D%6u z0CwMwY_zJ(VvWLpH7#UaAAOfaT`w{x?$KBUDp{mZ49g0#PQT)ciy^WXUcF}CgBBf&HSHi2h<>Y zcQm0}|1PIQ{KC8T2*!gWB_bAeU?XcG)kG1ZDdg4HRJ-Gm>84TFajFaITN1xKf3fjl zTKw!0v3ht+Fuz#9ZkOXK~YeFHn$d6{l}D2(|9L`^RR zB$7ft%HO*^fulNgK7<6e-_I%V+gGrqp{(HQ_e^q-kK?@h6oNxUZfn~COUx6BZo6i+ zl|c^A2jK8CmNUHv_tzUV28?h%=)+=N>HbOyKg>)0@44how)^J);vi!NP(h?t>8I6t~fEk z=ArxrF^LQ-#6uze_dvGti$j4Sr!i&9n;`4xX9$IQ0IDmnlZ4Xc{2@r?zju-U0=6h^ zOVr0x{;7Z7jq;`*7#Jmy=NNRmzrgh1Qo<^rknuaH9EZti{S-*^pJ}CwM_{0{6w3Kf z7w}W4lig2ITM80s5G2xT?Q^HW&zo0Mz)){)R&jz?0C==ubkje6v_XH1K`&>we~%A( zxdiZXaGChCeBZN2KsY`^5%*4E;XT2$Y~F_?^*219zr*|hL)+mzVwWs<6B&>43_3F0Jm@nT6?LNZ0eTKsD8v>Cy<}`rZ0#ERsH=*|gFQj??@R<7% z0H@4E(ATuLn?Zvuy!8~mUIQ@;+AMV5h1u#n1Q(q<24vwLOG$ow@FxKfEi(5Y5aONcrpKP zAmlmwt$`|(?}ZIQfd*g~%A_bti$^ zI9dLPfmEm!sD_W((!HmUazS$Y$3K5h`23@3|J3aH$3Gh&XZ1Y{3Y`8EBjTSo1oJ`- zt&|2^hzgl97M|k?vzo3r&b8Hom zP~Jg0wTf%y0qN;KMhJaugz9QsO*=ZFFDsz**@gf1j#u|UmZ?pvSRDeZvHVqU z)qi)#n^z$grpJtr`XT+{1H0*_`oG`#Os1aoVCf#wbl5`*^mn9$|1wUm#~^lyTk?*L z47|iQKuk{117-QZZGKY~8lv2nxc0C{1ntpJYQq`jg_Z}i9sst(8>4y}x+@cTd9$sF zoTEML%!tSv4x#On(=5DznGqHInUl z*=ak?j*!pn88NKgw(UxP6Y_37$YP{aagvx@W?8^0iSJd;r^AKJp7@Yq#Px6(s{lPz zp>pE37sI#xMwniwj?|Ca{lqra|32D}ukTBsLXP@ztfU6oO)6?=91Sy8C@9x!4{s=# z61AM)9&To4oAw}>#cJ2qa!;(--j-J@u(a9!?s5HoxSy6(1Q|$-1!NPZStJ}zyWpIH zCjs#l0UZlu#=ig^8Lkkj4XtO{kVLNWC)lZ z^hOqwla3PKCeQN)_&s~%>KM{`x!xv%{&70B0?A3)6{H;L*UtWwN=-z0E95pZTF z^6-(y$y%E=w$5eYm%lhK--WJheOTTwYn$@{b-*@xs?4 zk}n`)^S|HONvcoe8M{neP`WiylBKPhNp2~TpgO2G+KEaRU4Vu1DhC=pBLQ7e0wyiW zQJTWDRd=P+L^j8;J8qZ^Ie%TK62S8bj5ZtAuFBYs3j9SS+W#Ql2tQO+ii)00Y6EtWsrN5Ii2V> z!!GsS+)fZ)RBR6m=Y(7fwM%)YO_EA+JE6(aw!KCEOkMVFtkZB^M$Lr}fuTZ|wnPsn z0ySJjwC?S$ZhZnclN#5LT*PSOteypgQcFL4fg7XWvMl(PCq19(LZ!|e&wl&8I%GxI z;lVQh+tx?KIy}mt5{5ZR`ar2WK@hNa(MC)uVIlbN$SWqt6}hqQue`rkWsr8*-(gj4 zbi~w@tKGwPbI@@X-l#Eb8aQhRxHe2OfFMGzaTle(GGo-t5TsUlfXmegq{uk zV4@6XJ-j>2dHkkcywtSGK20h{Xwn@Wu;Q-I68*#ty#^mzEX5Jt8V{ByAw`_8nA8y* zcKOCD*Tr|?AbzFtTL>#tUf#}7L& zPmoB8Ms;iNxlqK!!b3PfJ|L#Va81sMwSFVbpXAU_Lvzaky}HmoU|Ag~~B^*6p7xW#+sN zRRvRDCb9EQ2Pjl_=EKFQWQ*DlB8L&C;=Ps4nNv5`-sQ+`T9l+M_SmHETh#SszsN0{ z|5Isw5h|p3vo#JKaaRGQto*s6D#Ej4#{KTboyFDB5?O)AtjXJRP6?`tYgY~2cEgyC z^s6{5RkbYYo&=e(yS(@3lq}>wv19N3BD5Q_WWaM5ySk$m%}0Jny1C~BiHn+?BsNBlsS{KOja(|lX|P2KiIo9rkNM-Nv#?~tKwE{C;sdv}7jM(+ZjWfLvF*RsHyrkYo* z^nlyCv_WD(SSz~#>*nps(ZEyyD~uzyyiJPhEKlbaQ+HIs2~+?1ZS7Zb6Ya0P0T#p} zE^^ZSL>EyL#nKebt^2aqN~gQ#QeVBOi@0Uv;inZ6lD7$LhnDt>0d&&e?nIqi!HA~RLQO9(hoD?vYIjOyrhK@a1x-qPGqG|8I zmf2`=m#;dBoH3c5MOa2B$Md(>Z6`!mxl8J`CC11F z2ek^jA|;#E+B@-BFK~{u4Ip)HcDgAvqAN+Hc|s(88_dW{Xl2jxbA2t!RmKCZ;qRmu%zX^SGhsrlEFhrdKWIdx4JD>kdG-|x>Xr?c{!=~Z=MG{JW zb4@*jrqD8;wOeoYbFYN*o zEOSA*#qZ;qy2q#i-9ipaIW38ZM>YXaaWp}S z;~gUndPANv^_CPG##uG=L+4jXfjjA?Tpe$#A~7!eK6GhT4Ql41uax@}Hhy6T)28|1 zqgaQ?7_7T8{cs(P+3wP-Q>u=n)$d}=MDVH0k7}D7=(m>-vX^2zZm$s| zx?JlmS`+$pi8+7uKQVorq4Dy{4YDHJ;p^Y0I@zbPCh&?)x{?e|$}G+4;sxZN@W!QR zzVR-2WzqG8)+371Cw=>6 zL^N6ZRRTA>o#EmB#QiR_0o)apjkIgAhfcjVOU8{Ed-q4_Gs$!{q>1EC8c>q@B?@s4 zgzGSu4@>v#{rK@kWMhj=t#U=p0E@`NmDu!qWh+0+YSheh_bn!c5EoM~ziBIA2|@OZ zpUlT?ji6#zeuAvPF0I#$&+4ro}Pg_xc95+kkDtY1Dqc3qBw}qEOpjTMo+?ZX)MT7%pmo9AIANolnl$alt)T! zhc!zqWib44w*h&pVrJ#LhZ=Xy7I}5ef7vNl$%T&DSsB4)1WQETcFYG55WY=-`p-Rm(Fnx64Pic|A@F-u3Q9hZ$Va_4=CT3jc-%Vk!zq zX>Y)E5nh3$ve(bv4_rPL%*UnyT~#gkO(hU+XTZ&=ak+0$k!b8q>1T07jQaDi#LOvn z&Y^WyH+RfWRH`r2s8gy&n6sNkG4t}R;oaW2dQxltAdr{0s_*VyFX*@w_~f@fh}9y> zHQ5q0Uf)=w?B|aoH+SST`!vH#f+?i`%R_h?J#Ni%W`_L(?G@@*5plIR>*WI>LLI!g zQby2b-cM6)SCHzEa3D@lV)w?0fV?vBFX5M?*J(kSLRGN`$Pn@psed>gJBS154im4d z3p$DkbGnYD%*Q1amiU2{-o`{9HHCf0vy8FBVbn0lmuj1KKqY-`aV;?nw6G~)#rDU} zZDKxFnMFDD8@2eX_fM0+)mbZax0dT3IS})sr!{x?t;wo01J`feNz%t)N_gn-&yx%m zFl)K;3nyA4J8Sh~xFp{i8zR3xNowEVLLkWO+e&Y=$g(9cX-FF?m;`AECz6wD97yj5 z5BJbd6-E-e}@&J~j&6XyCB0jj8EtkH(>LBB6#13jpK(S}M%c zG?-4#`Pi*?Jm_ECP5oFIF%8lZ04~?ZxJP%msoLly_O-MTo!kXs0*f2?3FZ#>_spicPz#PHfSpYSaAJK^$#qAZ+;D_QN#1^7s+Tu zmGrx%I>fRxebtU|=#FRa$!B>$T$b7*KZ4m;?l*7IF)X>5A|N=-t6nz9GvB>EwdHQY zKb!ER{IGkQf3pD8dV1*+UoX)CaPP(4)hiX2W4hK%C*b-8 zxB2;M!A4Rk>7il1+tf?6bYSBWh!kX4b{9TSS*x+?5}bdExrDxfceg{=Age6SqUL$| z+KB#zOKYB4s#!Js`~n?sm#TO&6y|*#v`Pg1bHYS+?UqfeJwC;{d6>kmlj6@9bZNXr z4c9hF!o+$qKb_tDFh2DXApWsI1SHBWWF!%N@(}(&R9gwQ-ZE3mBkpKGHll z@NrBPYWrT>ZVk|ve4h-0z44a?IA+5#RBQe@cBq8V-DS-4``gAA4sv;pLyuJijt>E{KpTWbAfgRKstKPpPZ7xwd!j7#sW`-=>_ z!+V(|E9K@-O26|}6o{;R{mi{9TNiB-)z?phv7?|LPM*pMlD?9#j+cgplRat5NH+*7 z#7T0alI5R#W%23u9aExEca$zUiQJ-1^y`8p9?_`x1CIv@=l36)Z2^^>>A%iu-&Zfo z6}=&o^a3lhBB1=bDTC91_!Ty8`wKEvJW49wBJ#nwZk_G~PaUX^LC^EX0@I?&b|PsR zL|&*-_*LUBGg+C(ZXff;m<&M4+1{I%tmXBTN2ho+-;BZ0C6jY?1`3lNL3qYj6j;ve zqi4Yv)j`B+EED!TxK5;C_m^8JYM!xUn2g_9oz{IbK!w~gZt1=_BVi}rp?Ln;RRJOO_%{dF`5Pq0Kv4P8^TCsDN?UCOrI@yf!u}ydv0pZ{|%5&l(&lUIv z#d~7(suhpfyn4Ci;rN-$vCrgo&HF%ogajc9VBYU^6fh1W*CTA^iTey6zxXt}F1d`( zIFwx*ukA^cuMvAN=6BZ~=PCXbyCp=EXdtq-h67{Ae`6Cstv4UUn;3mf;53w?%$V}? zy)hhElDbl%xH8*>qXn8@`3#~Ec4QY8!#tG1c4Q4&Q8!wg;V0f6E+d=M-nj~J_d6u zh`h+S$#%Cb{=xfBp?N13k=wZ9Y?AX%iH0Zk1(UTW3-=G>OK!L%mGn$bE!0*!uc7%? zR8~rcHZ_NjYj;&4j!ClL*xKLS&I8Y6o9^Sc6=>A5ICaJTWPWb{x#o*@n1x^#p_!zI zx^7QyM+AEu{^q;Oy}z-60um!>gbD}oz8Z7wcf)WCA|4ygU@N3`7IwN;QJFc6dLy$N zxGSiefLA!&^{hk48>q9uQ+hiHG(bJ+p??$xIt`QaI7bNRG&_8++;a27pF z1L=?#B%G{JCNu>w4bm^KI~F3g#cY z7|Nfb<`+Di4M_}=xe<`WCmBj3{g89gm4CnjVcRnk=+y3i$>#Xz#eSu+cZ+#DUDC;q z+{`LG_uvL>^?}|=O169mH!5U5|LfLl?b&Gd5a7k?dmhg~DGh&+9qIu8J$*IT=aj`w z8RGr(Z9f3hgV>hl*CzNv;@3iiJJuIxzAjY8Trd=LPFAnJw?C5hWCeOsC5UJ0 zzAx=QRU<86-v4yq!+2E-mh19*0!Z!g?)sl@{@_ABDD}cEse0N)cgnw&=^J>~-@PGr z-mpg_7>SN-pTu6FQCfWyx|?-hu1tY$KZxxy`%lX=1Nj>dGxxw5_&`b#%V zXAc76wrm;}(rtdQvAOL$9MgQaw>h^x{7KR;g>}sE{&Tq;1613)AB=O0MFgN5MUGx$ zS`kFm_V}My^p2G+P^gsJMcn7Lmb*#g^Ul7@!sLg<93lRh z>B@4H!$*pAdB+4Dj?y~SFsb*SI*Lp;`%yXB#O;4Qilvr~#3Tzay(t!Q*W5*vS`57^ zHfX!Ie6&mcSm+axllZ4PxyOyWM`gM}Oo!G1@lTypZ_|oV?xXpc2cn2z&2$d!(pdv%K=VKe4>Ucn!Td?{*{+ z9v>aT0To8=Mq;B|b?P?a98%%5VdF1-t%*YH4<%04K# zh%?>sZ8D*0}#k{VB7ZDjk8@~BmCQ- z>2SJXy=5m63S^=_YlZN_*GHZ$f*jlq6E*gohH%>cXXRF+1T`cpvYunt)F}CPh^F(& zD4>pnFDpdk&Ufs1iw3rh;Piu@^XjeD{wnj4w6TubExEt4jt!i+ZFg#}5eq!m`SFQn zdqt7!w*2O(6?K21@n&&S+OuQBG=H38yCZo+=HkCZ zR_5{7*mu__!a&2;$g}57U++p!mL;`(yww!gFyVs1v&ZUaOn^cI8_aurHeA9^I{U7B z+kLz6b%AGF{87r9?AjBYCD@7h{f@OBbw!%4=n|13^AWSdSSlB#C|y2ROy#xvJTeE{ zdkWJnK}5+e*JG+y1szLk6ld_Acw||4;qne-tp*#K&@oy4v<$!g3!BX0%#H;4G- z`W{3Kk&N^e78B)bvu+HTINVyduo^MO^Nh7PZ>B6?jRnq4r+4(_4G)K+V)*2$XLD?} zmpNn1T-T#FdAiN|ta4lm9)!-c<;vAbSy!3QzZnzPZtORpsGHd-D9)U3OxVXQkT=;h z9+g|xNdq~&A{4VUGFP2E=Ee(gO@i|l=V zRvN-CR5c=s7lmtSUU|r}{vXf`6r^)g(OjoG2adHnbMnuw{L#5+Pxs9l_*8ugp-7-) zQ^fV8-6;5Ewn^QW9#cVbHk}kuIU^BDBd(Lpw_0Mx$}c+ru4m(p4V^ABUbf zMrHG|Q34fqZi>Ngt37K7v&UbfcxP}ACXwhUKcx%&68d4h0;Aw^6iSwHK8OjytuIdG3+bi z7usF`+S-Ev53!yeLF>yw)nv)tSyW~R+HNJE#(8eS5FDw^Lb%oQF7>4xG)&wrrn0_3D{}Kb4e{YT_ z+GRQ0>w$_!rc5L``MR#bdODr z6p&Re^%MEbi|J|;itNurbQ$^bt}bp5TKQ=o_t$NIfCx9=?xF;(S}#8Y1pr~T^P2ch zb_j&(Aj4>(aU?QBw*CuTJuIV}Q;`pzK=|;$Nm*W7u0bK(D8i2l^gNVjA!C`m(N(&1 zGU5ftO>;SkWL;6?yXm?W$2)iyd7gdCpRVjuM6+T~@ES1AZ;z`ivb}lSw?aD1=kJd# zZXc}@EU;IlEB9ZdcqGCwSbFEF90aZKut` zP8K6g!AaqmCa$c@X>!mo7K(18Q!l?Y$v-AlnC2C)lw+hAXmOIM)y~_T{M(0j#-`@T z`gDg-A7FTh&q5ZJzu;itR(kZ+3rYJVOijDL(2@?xNygFI|5ov&w~!N&Ro*YbtDzr2 zI%HqRI2$8Pl4}wX-rX>xnHc@~W4E%A+t4fV;Q^p#ol_Ln`eiCq8Up4lT5;Jg@@xi7 zzJF16MCT_j{S28x?f}z8WV*#x!)GB-+X!0Gi+5Ah{}_M2NP(eO_v8i!st?=%6bxa? zPR3_;jh7f9hzR#g_SzZ=Y2w`eZtMR0aB4?>YJ_!^w+#E}4QT%8%V73Ewg*ea^hu6# zWSQxII6ky)qMhJjQ5)*)&Nqg%r(!DtS+|mi!!P739l;nLxsc>?kX%G99xA4DV%dTC zB4`I9p?f=BU&TWRU|37O=RFC1$4kV5&NAVN&(nWLSw$Gic zp*@j`8a7FSOFIUms`woE-(O=?_a#d9mpr_wx%jJ_vT3XL*#pBsy7;jpW0z{hF}eij zn8K_&{;-aOc3OOCoo0XSVXIcjoFqHRwv$HMC))C43(WbA8Dq3&2aBLnMYijO$O2>O z{!iOcnFIkwI+=tb!)h!BeYqszm;6>OcZYbzuxPkQO&1?b~isN{58QKRS|Glqbs=p zdrR`j_}ivJ{%SX?zdb2`-j=wD5b4BurbU>uIS(ehqSFEHgEt4?sonLwWgv+#3nGIV zf0N6XdSZxx-Dgu<+CHjT6CPVMej3cCZes=b1@%Na- zXFcp?-5{Wq+W3iR8hvTGv9Y=3&uvQoRlD_aW3^~bE{2II@0zVTUQ~Yglyv32(qj4= z>q~Bij>+DWIi{})f^FvmgA()X2jUO=d*7!7uCVH6FPvMt>q~OG3J{cyc#L5(F^i+L zBPz-y>fGIRedZY0QTd=n>cUq~)mn#CCXTUo>BuX^0N$oD`ezsl9deo)_Sl7MGPTN;|PU z+0y?k$tPd66~-+p#u!lzH`Z@V|Gp!shfP7aWGc-sSf`6lB^!LMY1~p>N*NMo6t`33 z#P`ME!Sh!4e!ORRq2;t$)RX}#G$ej((a?zQ(5-R{I?sPndVPmcZZWygxTo$yidvE) zhuUWCn_ntb#@)d&{2oH^0jvkt%6=;uX{CIC2X$jRt0Y&Esvs@S@nBYS-@RGLk4P|| z|3r)x-fVxkLsn(A8CvVH|EUc0yNK_9d2W7axE4oM(<^A|xC4$&n&{D|5LQ{EGr%sWh(`3Lq8^JI&Z}00OPMte;n$x$ zi0dp5p5U!0j<5mfhmjVwz9S`F82^V@Hyg8COIPFU@aorV>moCy7nSSGo>bZH=0DLe z$^Jeq@tJnpJAgH}$i;+ZJcd;?vvIkH+4g$0uLFP;t1$Fm8po`j1Wa5mvB+yL#{p({ z4&jw+#HI{Xc%${+?=(%w?MRyn4`#X%jcTL^>&$8upA!+=zg_HCr%eB|ect2*+vn?< zZZ)u;!F~zC8wwVhzQC~r!Rp~l7`%}xJdfbo!;^@^`TJ?BNVYNaZA>n8-nBl~@tnHN zSbRrJA45nHfuUFwh{kXW1H_z=w*G~fg&Pu~-*M7g886L!$@nQ1w?GITTedicWBmMh^6u2+pdxCXaKdWW>F8OFb5$5$ns~jIc!9=;>UT*b^p8CF5 z%dJHOx7lA_bAbi>k`c3~xfoqV6Jd=QYGG|HU7ac-&&x>%NQt7CV`nmMGv=1OYeb0V zh~15?GuvCc(fgD7L)OiH?%`MF&rmYm=G%>=!xjXQ_+;F@bN2@dl)Dsu5Lz9t=Huvc zFiAvHdLiZV+Jt*5XKcSKz@(E(-ULRo7jcv_n7s4nYL6;z@Ih#Y)xD_*iZ?HZkCmXb zp9U0`ba4|+i zT-=zWf>8dr4nf*5O#FK+cr#Nff#arA_n zA-+S%w*DW^jA!3KVB!U+3Ud6-YdhDiUTGVI^8c9lCv5TT3wZvewpIi#u$-=so4tV1zRS+=FSzn z<$!DyTw-k;kG=4z|z>toc?<#P%o(W;0?OV2t@v#fsvfIn)LS=#`{i7?qu z+a7+#jwqIE@NbGagQ3!K6|LEX9n`XknT@qm@?5SXl`%{jaZQaPBI6p#$W&lhA^rH${27nw+0jtL z03NBRNdi5^RTwN5u6Zxbv&Hhu*h{nauplfRWK4G49N1I9)Xx0QxL!LE0F?8r$FoOFJp1I#^ZRwoD_R-BRqMY412g8$!R*&zRW2oS*$0XevGh`%n4Gf zyg!p_mP%yPQTr((yS?1pqwUD4B<)oL5l$RmajenbfMC5uK{t}K9d9CJQ>OrkH~G>S z1|FzK44jg=Ok>k2}GPR5xej#1r{c3JaGev4?W0 z24sip+$EVE?6M0Hpvzl)A2))=V!X0E0EC%4b^+cL0BX@khF%ICGaFj~xibK!6B*25 zEY}f^%0#-nbUO@Ca88{To^cv4Tmo$CTM{9m0QZFuS?Qjq*A^O6NH3J*`@b)6F!E1P zkEl-W?CT%i4HVUu8chxm!vZLHB>>}yPE%Z#e4Xv&iSdVS zn0o9Jw@-ImH(!i3qcR$^*2lKzYA>TC3KF%RHf8Ww4u*PNI6%74N*`HSBK+A*sau*)#rxEXUcS#>UVrp;#>L=BTcR%!|}Im{u>nt$?&t0-8enf zMSf`^R4Iy%yD5X!#V+h6KIw?du;s|3GLzx3PlTEf z4jmunC>5Zzk!Go9rCi&~E})i)A2|km9}jbUUH-TAS=|Q$(haHU;kysRZZzQDK%SXTPnD)s7*`MYZ z=bc3seA1zc-S56wR1<4putl!Kq1Bm6CaOvWkdMmYQQe5wcQUImRj* zbj33i)X9y&kk!(>F#uG_ZuO^(YPr$;wYa;?@r?D@a&hOKW!)YV)l#d(@1Kd3N6S%< z`ZIe<$7YsbPR?tiwQ5QQ$10%z`;iZB-D0lUC$W(taPE?f7)r(nbC>Zw zzb&T<@*VZ8DXEb=>;|158Z$u9Uu-i}e-0q%u{rfQ(raX=xkdgT${t#jEUFKsYNiw(L|jrTO&miG1G`wK}I z(!apNpN^qJFiFeJ~zA`C=o0k{J{m0?e! z;0Fqm|I`A6VGmD2?mf|IU3}fNcGuOpYSaeAtS|LV&%i?IdgP0zKhVI!ZQe`UFAqeH z6zOoAgVjK@Hs&^c%ajDlkN#)YynX^h@eLWY*PN2Nexqg=fxh(eymOV=OzzqQ%yN;7 zO0Od8rNm7^uRE--rK%m4j4sgCW-H~;#KA0Y;m2`Qas%k6aAxJ#-SOO}70CXz9Xrz6 zI=A}bUE{^@;ql$gmacTOn7;A=ckGq+pW00{40}JVAA39F^0cEZl`!j7`Q7;q^s zg-Q$dK$<(ON9q#UnXZ1*Jr5;%3vy1inv z+pQrU$KwO?nd~XjR)VL8CE>#jViS53kvPEr~SMEzM#Af$^{<&6{8FpEU%%~(?Rxchi7~C zM*KIBng;cK=ujr(+W=)TaDgO)=Il9q)K*YT$aU^hnrv7oF5QioK8W1o*9y?VIsst} zR7tV{f@@({ZW{k_GAM5SWd39^UagxQ8@eYJw0QZmJ&Q~*sTF2dWzfpTOiJ^%98NExdG%r-*oS^~ za#FoG=XDMY8uwS5;o|8}+@aD4xO}@Ov^Uj*0NK`9mi}At)i+`A;!L=Zo}H3)ybUEj zqgjT+8<#p2PFuYxN1xWYo-nhGe#O*f$0DX8&Y+cTXL0-k%(8NzSM zXD}AK82SUK0FSQ@hJwFivhjl->4gj<^Ie&jVOudQZBf zr?f^(q0R^auSJGQp0U)BJL3qCwhN$^9t>ts9(Q_}b6c5;OBv0ZBA?EqsY?K#%jqT&|j<v6ksN(LA{jNbRDp!HP>G>YGp9S5XVQziQEi~@WVD77yzCz6FP&wO$R(Sj+ zLt0HT<-4EWvyWfs*a&l!a;Pi^^B>r+4B_sKu4`c;O^5S4l(8<(>AcBR8$PwILwRFq z!XJ9lUVILc5>weMIvOiSJ%pfR{ANUfTd_`6R`#~xHnD(CDU%vc4`YL_2oK>XsuMDj zhmRL~XY`vptBOtLra#)XIkB4VhKxA2N`ndGO0L8QW8Sy`{uYcD@r9P%dk8%{@uuJ( zCl<0o{q76ci7eMmyaFIY^i@gigl1dWH7aVrZ%~_b&dE@wjVNqm%+)k5RohLpLC>2n z4Oe_n9t{#pO~j2;&vR?c_}F=I_a)e%=93Pr3 z529_6wT4MdPZr20s+}Yg-DwL-+0>HsdlI{L>JzdUkcGc1-s%#=>^!N(qMr%ueQ_%6 z!JGBatlKyE^0a)Bl;dl`(f05Zo8_cXmHkRNvTl`rztCE^ZFjt+A#v<@_quI@CQt^)^ zfKR8L)XVljcT8;NNWF^!W1qdV_J1Mi3N*prI&unL9& zAOHRGRwLg2kJq5m^?;gqf9)O;b9fgdJrZjU+B^DcoCw5YImDw)XF$Y&&0!o~Y(0Yl z%^bwyaV&WXk4|E1&@yCxWW42WLz{s=J{xp=X=s`q*5ZOrl>MrO{9eYsgf0~uccU5t!f9C4VdW)0m42N>*0l0{BlptJj({^`V zBZk8`dt!346Il|`#z0dOdI=v_~WgCwvMpLEevK^v(MK%3Ap|L>0bZv@)?Ab3!w z78dbHQJqDrhPvOdv*JtuTmV1Sw=FC964ZfKj4R8R`AzJ*dgpD1P<}NS(y}p` z+jb$YFweL2v37)JApEQKBwtm!SdsGVQ57EBCIU4FfQ;wIlX|<+DIDKN%4~z|zbfT@ zn&tRCcIa2NGCanruRPAs@TiGCsDWs-`;$C5FT`WT$7L0fxcqfCk`vK;M z`Oh>rVzb7Xy?MAs!F4i0u450eu2@BBvFPVJt4Py#&H8dhLflIOSsH~?=>So=tzTA9 zza>q(DY}<{S}|6^K~2OmKK<^p&is|vf2*nT5(B#XiNiz_3hRjg2qgIdBpTEu149bf za=-iv#Tl)AukW`Lw?55Qx=+YAy6`a(IeXQtl+E}P&aL}{Pf1ufEXMmTE2fIxD7ils zW2HB~hnoE`hi6`y9_9XkyZ@q$edi7wAk3F1nPY9^@^Y;%g7zE`Op_WEl_s#OWd!Fj ze)CxR3eiqapp^tF;j#56{JwVWBrzWMhq; z80U)PE3~fSOaMTw5Zmjy2I0FH3|7qc@0d%S!@T?&_*`pi?W;BItM~^1?D7_Vmk@KRnO<;rVcVnIBB7bFKfXe;&umfXncXL667w1~qIcP)Eh`Am$Bg zRZ$}F&D87HiaB-O1a}5ZzTF~Yux6L%vk+peGvfCM7l-x`m zzqc&06H&#$syWs$YjTKPz2RF~*KWvX9)m2QA1<17LiciHoHFpm2O-y<^H}VgzuEi$ zp^K=Y|0$vU^!p6Tax*^dyHcL^Q(J~n zF;hl`zAS83e|4-G^4*dgaii_3+2?Hg6zee^Pf!A;Z_E@9vTgSuh8M7g41C6c)RSA~oKg)DiTl_X|y z&B+Hdrv|3~x?}nZPI56#B_jN>URE*v(9`1=MwQ$uUnO{X%zd}aFYMzQHl`3K@-y6S7v9Vb7LyvpN9JJ52B?wp){r*i2=eyboxHpe-&wc}F{3s~bEX`>DW2qBD`E>3kS?wIo_^s|()h53- zcyS(q@WvREo_b0a^|jwe35{)G!6hHVH!X)sZ?|pST7O|P_EJT=M3v8{RyW&T3~iP~ zK`qsl=-;N|N$z2#X(`bLxL%a2s~vjXk+PdK$x}Qdw8HRS2SVe0`y!AYoBdI9>jJN2 z4eE82-A4Xv%ZRWFwJs(k{$rGZd4OSp-~q#;X+xXFNV?=C3*Dz0NtxR@AQ!W4>KHnK zfUZwS!Yqn9Hb1jS$_x&mZ1IdViW-|#MT=)zi`#jf5r0}%aA@|(pQS(tAOfT62;x_e zdEg9uC zaI2tBaE#GUx+ezfEXb8*y)x0U)1Ea3PkZvI<{33ZV1(yPneuL+d2a?+ec?8laiLWy zGtRR8IZaxsZ6~xU~DK?jHEey`t1*K|28$^x|I7wPUeZ@Q=r;&cb7VJ;ut0RGI!mc*K7&O z$*OcyB0~PTzk7T@K-P>UuZAO2>V9ip<_WrmsB`|g*91|~V{X)ZOHJPOqiaY>45b=4 z2(AGCW}bYhZDpKO_Z%w-LY8F0+thH!+AUJm#x>)KiIQ%e!ABH`{u^$6=13m9lQfsN zyE+M`Wr)*)z&(yIx5*W(xXsn6eeGIsV2&{7{fu~jd9`p%60Ghh)=kLFF_bNTr>HxZ`S zdGr;!577cjDrf^s?&M^!4Gd0ipNdr-C@q}PxAleH&A;D4Tp^Zzi5YGad3WR#y=`Kb z=Mq&9bA3f-pZjaKapH@F-4unpbtg!O;*@a-c9qzh1ay8Jc!UG-R$G(a*LRl2Kp$yY zm!%!i$zL|JH)tq1Ne2*aN^X^Ukhuaj{VfSd?w@em`Jbb0Y2@F^*uOUk&=w@(#12^H zr9K~BBuY{EnO1nw$9(5|^HR`GQ!-9W*KfDh7Rjb{udF4-%!oEhSdog(zR1ws1ftLJ znhLVWAh=$w<)}AW`{0@M&N9#%td_GU-((q&fQpY~TQd)z+Gd@F#f6T6+dN z!G$zF8zwQ*+oAedAA9*u{m2?)N9MVz>7Lc3Yb&@R3AD(^I>?5IL7Yr{m&f&umZ?}C zxGDQf>_&ha%o}opNsPbz9k{{n03GT#&iG6FZm`U2)*$rAZyJ5SV@kR1B^^dR=Bzem zfq{^b`lD8h^d*A4acV3fX3?jB>egdQYKJf;S=*v|1{R|1=F51LO_RPd zps|^D198B+Stb=gnc$0bvm@X?lW+Ciu>v+AhslHuA&A?S=iU+k9;Xwof5L9`@a$3> z-<2x^-*;LN<%>#wa zVVvnXopf}$?wle%UK%w$P)2+Lf1yG9wW+9AO~7E=AlV2aF(B zLOG>&fsy?i%Jnd2=}Wa$bk;b-f+_gq37XU}A>+f*5)Lbdl5S%!c})s*f6_04xIYMF zmwAzUuZ=%4Bri{P6g`~0PIIsB6-^fb_B99JL4IkK&`*g5p48splt@Q}K^U*M$pw9$TRQ@Uua|#r6x=SEgvT%zNew?=7<)ZuqI)E6FvAk(+^)78C#*+B>c!m1DJsxb#a(Y-e0tsN z=*f$sQ8!pev#WNB6x7d%1iOwlDKCyC9zKrFGOMtiWwfz~K!$qsn!qNF^A z@{{hBd1l51c)*!g4ZBWaH%7(A$1gn&2A7;#?Jee~8%^WggI_yLLQbFyphCE}f(w4@ z^C3~LoloGfSC(I>Mn~guQ&&HHxY&1IiaYmur3voNMF~fwBr6<8xp6Z=WGXLLGUUpt zPDvc@evUByBNuhp(o2raZdiYD(!|9?d9P1&;-o`TV+xN$dfXBLDJ-|g)VDliB23R@ zf7!^9@5gPFWRaYdUPYL9fmHb!X{k(Oe!^R!`h-j|uUTE4o~Um-4e|4(Mr8`M6}c%P zO%alL#z8Y(3(N+MFdCNov{ou^=Z#WsEyqW_1P37h>VxeAQ5pxNmrsCdjlZ2**S>=| z5yfDf$h|#J!7i)*`qSN0R|^6%^;OW~g%D4UPWB?+ z^ZM}u6A$r%)3uyO$3EQ-kbq_Iit8x@oa`pr&fZm&knqV}D1tLoVq*=dqkqK__E=8^ z@hA3}4_Pb@9~6VPHKt<6rV~rt(kMQBZx#626cwZ+hZw5!aSW^C2inw}T~VQ=gECL8 zln4C6PD|@Z*w@ZLQIg!i31<)!`OW;d6M(P%AQXIgC*|6e{zonV7X1l8=Kd|o6Hhra)PmGxh%kXRO=fE_Vb0@_zvkPF*psT`d3(54HA3fkgCdqtJI z&mpj(VV56N?}BgNrGf_d9STJeOhmLntNa<(~3eQ7(s4R3Q z?eziZ6GzaO5{)mfpppHHS_DQ1CA-D~aex$Ae$dBO8|(xp=-AvE_$S;+`8fE^10wkS z`qsHtg?$%PKZuyQqC*+>0-woH^eB|`K^JswzJaRppLds2LCtXk(Y!~F|0?hHhA1)@ zu?71$1B^fb<7y&a`}@AI=WPb3W`VE4>bx7kN*>TmD-{QP`a{_#Dw zy(R)VoyQ5LC4t+qsVY%5S1Aa`vGll-UHMzSwqE_yjl!3U^;2vgHTLr5h2jxnt-BD+hZ@8 zpgBJS#ZLw4PVIG^t6Aw zoCSp_yUo0N5&M1+TXh`@mEK#qJfLwzT3Fbg9=6}=z62pL{!1v=+aKC}5~&n>?f=J% zGbF`EXl?(i6#u==(~3YwT8D`a(BuD}Wb^M|d~nSII$}HhML^okF^CTOw|MX1ee9~e zIsWVA8XI&N92Cxm9-nLk_DF`^18_Y3^^HIO`d$Sdzax!%c>?SjXDFQg`<_zpA20ta zhz@&O{jZn*jTE5WGZUa%`l5`#=r=&ZX=oTq%XMz{LDhupO;wb4N2XsbqPc|uV!)Q& zJcR;v?$Mz9>4@Lt&h}-Myl; z2gGoufYec?W%j@=?}eG-^tN|q9{5e&+pAKaP4~~1 zy-8n#&Y@G9CrzO^z6|7(;Zo_{&(dL;q~JHLyzE6D%xCPWw8AwT&OLS~_c!+Bf-Dr} zE${i78GCn1wCD(cc_`^G^CBL;lV-E>$Ob8G=LwbOF{a>Zu(a}-5m6t43M~P1&2x6e z1?y8W_vcVNcH-&!C2@;(P&M5sPiHT&Pjq+pf$EJ9P;u_V3hAb028oe+y((q=y{F7n z12yqi9siojYt=`g{q3wh0WoNNhk+wj^FX1;NGsPop)5Zy-eQ>3uWwMe^t22X%SpmrGh*sichGiDqvK%F~mH5ys*y+f!kS zsTL3IFr`O?#>}?!9T&UO5jv>&m7Cp5;gsG-PBL&-lopB@_pt}0=D@mfL--anE>(Xy z6e+55ucyGKjM2DEpINn&mu@txC(mgonHj;3JaP+=sz$yA*(ahL1HIYtlDPCAWrb{s zl6I;evN+UZ_zwAcAb+HAs-36#swZ}-vk*X31awsr9`IUsyYJMnwen4w%()ez!_%0O=v=IinG zxC%3zWj?P-p7zGd+P5Q|Ag9uE`Yx!#8*Qu66}2Hoe;M2*R)vhBwIWi@!%v=-m<{Ty zCW*ODuOhi^sL~PF=>u>_cph(fzVUV$?oDKta#i1;re}Y=;VyKbqjvn3?CtK{KAf98y9g>zrjCa30J2RZrh~Y@O4L6 z6?Ldt)?zZDOekhe^mB|-EARz=0eDb!CzGvqx*D!h=}Uv}vw`>+{UdpTFXx$*->6 z1q6zYi1>#uPd4avTQ|Z-V#-TK0FDlv;`W9+Y`R3MM?MZC7_;H}gpjq-3z_I9TVNjio>(S6_BZxv0`w~zSqg+r#brw-Iy37phW?L&K>Lb~1FDYBLgH%q;;)O#aPsbArjpr#U^fL_wpvy;Y zpid3l2f(YeqJT?pSG$o*mw!R6>m(l=B35@L|5>m`5+X&yv5l9;UeTXHcIE~+UVHhD zgrl{E}-s=0gsw_oHH-12K?fPbh1X{Jx**1`QG%dO)XA zOzTO`28UiXE6{&rFJBDb)1+Cx4?{HyGYbo}4jMLXzUc;=8o*QY7^oV$Sc1tF2vq?2 zg{n_W5`d!QkUD4j7CO4D*bLj)u*eBUV?7b;&o@gvXG*^b+MR)YFR<#8D?=pc57>)+ z163<&76drkx z@nVjw$Wf!Cv)2p@jJPK-Wn_%{{G5KEFEPidDq>2)QI$`mh|QMgQ;RXKDUZ2R`PV^- z5SevMNn5=gBRAxTNi&`R&^Y*>R~p7UdE-VHHFU4OoMaZrC#cgfwrTt3)AoI464GkM z1B^yf-SWOHY1XfU(qlGQ+h@5-Zql#&9LVb0|A<(2n&n^;Kz{V6c3P520`6oLZkqE^ zVtvK5TwBRH901UfdGfp$gm01k_Vjyj!}a~9N~G_-m*JXaUIjZuBdav=WsBG=&ID|E zJFl5_r9hy30klB=Rpx$_I$c|jTPRiKTwH!oQassxt-*yP;TwuT(VfB87tfs!UCE9(w9_U53n7rTovh^84#togaO73gm7+N4$`Uf6fS?sexh#5?DGeGk6(Us9^U zh5Gx!h`?=wQo^QMr&pkcaGLsr)(7G3AY`IvVjg0rE&b!UmMD(?6-smsJJoXV^Qn`{ zwewZ@VE$~C9~aYS0^D#H-zdmWM^ln7M4OP1GQPty`%u7pVt9Z8Yrp)kT0W4=0|B7( zthd3xUf7?3a@Kbbbyg|*Y!LN%OvmHG%*!ts_7YIOPxJ9hLnrY^zqmCtY&@-D1YIw_ zd4>wjR3WxkNc(FdSzJNWm+ND2ki@k>&D=q(NIb03__Epa%D3f^Qxy;6W0pZe~LzC3-0#5 zof$t8gP6EzfQAJ%yr%UVNetARUJ1$Few;r63{4VP@Y9^9(JiAG)M@I$KNNkvT z-1(&B)!-9R-Iv2(t)gYR=%iw zQPq=Vy6E%#f;6_^ZJuH9ZUM0;Tpdr-(5j#}iq`YPjIJ768)QqwZJXrH6ffN^HZ5YV zu1EFU+)tFfgPfKtKMu4QCseuFVorF}^Y5*XCHqTqJNId#FfH zXJF9(_I-N0zgx7IFM}yM!#4}5`pM~#;u3$gbl;6w&3eq9LVH}YPe%KP?z=u=Nx$Xj zi%fU)>aw<#=z~_vcGbVaBWu=M_P8jYeEm$ z22>3F7dIv~7&h#$L>3PC`?Nh_mPf08WZsdptc~k^nx~p_Pcu|sw=lL;QFUB{bFpP} z38>Js+efjDlave}KMs1RZp1ie_>fG*o!dS{P*!a44{*H-mE#&sXknRJi5E|5k|XKK zCc2A%3NJzv56f)~V#i7jyWD$zS7-G8!g@9 zVxS~^mU5;U>xVV}vY8bre=-4th7)l=Vto1f0=)+qe<3GcCWUOb{Zy85v9q+9nBXTMGTA_Wr>x2(?M!lTyC0~ba} zFY)katJ`&t^Ku=02*JKjhGd!cy?&6g2q6c&woA+fL8iZ#DuItaR)^38;gV`jA=G5^ z8VJLvk(ewsj9yRL$ds=@gCPwQ#z~f_f1$Aga=B4yr9w0#m9eJ#3>%cko<8?DczJL}8I7_x%@N zP$y*t8u#rO)?z=VpT#p{jT&8Ox9*i>5_(|Vf&6AwRvW?w86!kC5j3sGV0-;x38PPd z{3gUOsIj4Ab7bw^ePp-pA(F@Bf(G8APB7>80iA#-B~c6MpqZj+vO$mGC(Jl|VSKI_ z;C84@lu%z2nFvDIm-S}bmGb85DFp=>w$h2GcYI{ocCaSc#g^}wOUf0;QkR*;_nZ@k z`=-~Q62IElQHDgA3oshwt6JL>pYD-M@z*Z3PTtdl?^hs7?*|?2l1-XXK^7 zNDphHVxZ;`Woi2`nNzq>pLE>yzOn~{>qn6!Eg>5ESN^!y{<_?0`DvxHW)Arp363eK zp~K3k<|0>;af=wOYzf>Mqo-D?7w?EiEd}+BAU0OZ)1OJ*=Xt&(>!%@(mY?$QGGW|w zqDD8$#1GQBOK#-PC%P5IC$7dtBe(VOPi_gIRg*YPGhoGezN@h3m{C22EI*Ey_w^^M zsM3p>Z{r^JF0uURDPq0AUPYO7{R4dC-lw6J@{h6{TX;mq3*byqq3L9NjZPWL8wNmV z!JU3uM$s)Zv#;bEcive|OhoL{Jmu2VdDh~| z;(aOZ+2T;0^uYiMK>*=+>=@*Icx!uP{| z7S7GhBute>sXH~XYkS3D-G)pjDf(T*Cwbr?m*XQ^rMn9=liO|I;3WMvfBj45x9|~i z>9U7ZiD#+k#iPWG`zWX%if(~C!dDWOI<Qq3Jtx%Aan;jYHL3QV!RIq$bEN38<38IZp}oSP3d2+C zhdBRIUCsbx=+M&_B%sJmD}+nrOJJz@MSyo21e%9fXPl4VAH^=mmTYCJv6OxvKrUxkA>UC_?&!eJePpTX^MA9}&y{T|r z`_pfSDc(4$z}Rk{p;g4ZL7q;1bLW~Wed>);hFRYWt1m@rV}7W|#n23G2kj8u$jx$o z*~^B0gn)$Y;Q-XERccaOx|)RI4SJ=HjtAyD(T=v7sjq9W>&7iis;mY_*0-qEbAIb}M)X2;Jy#3;>)`zoq4 zROq0<%TD&;fQgPYaFf`(;zNqyVSm0fd82N*KYxx;)V_@ zH$&~ersDjDo}4$2ox6SmX(z%#Eqst#DR9tTH;nqjB~ru}lr5H`-@Bb^HeS02W0Fvi z*D#%5@a?b$r-lVhaUQ9X3)R@>7`Ej%icJ+xYSdcvsozn5Ri7O}7sMoVK^VNd;syC9a z8|oww7fa4hG!kP%lMuG2-s2fg_EjJUMLVpvHLlT0c&hs)5R$s45da*uo!hhdck#$g z{~ojTxipQUUT)2ekWB&D_iuKyo;`un$O?i3c6sQX)H-_!?CARt9?N!8lLTfUvL$bg ztYh2k1usO+a$*jgKl(R6m*p9d6Y}Ex9?g~+1VV&4UZ1n?Cv#T#KJtaZwO#i&m>6}) zIMvk}tN{ImH|IxPeP^%H(fzHFA5db+QTjc4`f?2re(BSHIseOudXNp-F1?|`%zy5( zht*&IeQTM3pZmr0^QsD2H|N1aIqXaxZncKJOgADS^i>l z|MM$*H$He7gn*mkr|RBAk$FMz+^5f9MEvFS`*W9rmRL@JK3G=&)P-6#hIYEg=7|C_P;w=Z8i291pVpGNk_39~=YWKet075lw} z4?OX76!?)=dP~LM`v+2Z5ljTpK$N9)Hap z>gVeJ!~pIO7{KvfUC}X+#&iJc^NC;5{@Y+6@qXtAPxr#R?y*8V2Ev!I7yA95Ss~;g zRtT%(jqXstAw)NsUlgnVE~@{w`CoZf|39#nDwj>JcDCbezrg>#@v1LSB(y{gUP${A zxA*oVaE#0=Lu)v2kFV)P^SOWCeH>u-**_XDf_9%SgbRTYU;SI$>dy^*t-1>Aqb-Mu z7_j-*fH@zL$S>3WkIoj19RUT<5x`Sr>{z+ktO1)}v@~2N z>fub}Q(uf}GOEcnJ1d{9_hDgIJr|))CnB@56QVIu;5c)ngh4vt9G9NHYnsMZH_;h_ zqxp{&w+gnm579^nWE)>&=?6FM5A0&YsaYWf9gNco{>KYkin~9%&d?h#ZKl`Bic}4t zz@Kr< ->v8YwgEb}axZI#-G8Y%d)=6G1qYdc`L$pOdAAsN zK1V{4NljHMXQ@7LCeKk}T zZhkywE+EAZrK>)t6R~ygkM)DJQDMuPo20=-8ra~pDXAyrgW6@cvF3G(HPN_fCPDl_^=r?v!uL?Rlu}H3h4<*;>W*l zO;oFrOH^*hI^Al&QVi*Hf6P|`q>aW*)w~Dy$S=rmf_+)H7n-2bP6|oh+L>82iCQ2z zszo)@vd#>O*b<_>Np333NaD?jSZanUPQO*g*D>v!s$f-KcF%k*XHw{E%4Ix8LF%r2 zC5u_#M2xOIj}Uh2T|FycCbOAevUpw-`8OJ}Hij zD)Afhe3}Ea;*t!;?%BKmF)91E)qNZpXwA<7bVCkJGsZgT-noec&S^GaWnE|PE?lb{>t%QP7N`M=AI`#7vF&gP5X zmV&&XJi#< z`7sB97oy`smvY4sr$%EZaU>{;MpwjO8$eP`>Q6P=RP!OtY2w9k-Arx6x*#$A(DMQ| zj~0gy)cQ`Qo8okOYzd6&1`=^?ed1`cK zoAMDaT)8aa*#8<~EUpR=TW3m)NF9a7n&}4FStl5T@9>+H+hcXS_Kh^aV`Y}toPrO&(aPfcbw=~f)RGuTlqQe=)Ft_LcsNA}9&70arKa2nf zm9Z~2a-`P6it_Ej5QW|eipnv9sozK@mVC6t^V30MQ?bCUtMNL@Q5rAQqq@Q)urawz zLIO`|R7l$F7@HSfOz9l$D*-9D!bJqMC7QPVRxzqkp$q!MzS@mVNNB|X}TDB5z-S~~P(DN)wJ8fmkQ){ZjiT6X-7QYBqvuK9GJl#xZ zr#G*o;Pgj6Q1up>-i~bo1*q2F8Z2)kWXO1nn|~d0$8G`;9i62fH#_JuYJ~LFm%Rvy zMtRpXxU3IrTNd+Gd+yy1ruD^ckF+kPM6c{`AI(&>vC3y)tDYtk6RlQxt^>DVy0}|! zvnzZS^uG!#s&@SIGeNA|G3}nPCP6@7T>(HG9zzqcD<4V z&<&tkf)HW?_rn`vf{2Yx0;uEN`CM~i*`VOeOx-b})v6M?HlHXc03Rwipf&fkNr=hL zvi&o2S~t<*j&6an0zm1EQ%B1gBiS{%X*m740DTRPx$CR)>ibYyo@hENY6ex9^73bz zdF$=qR|+*)vx=jQPHHH%lwc?2uxUfYXjdw}9b?*eDs_1M#QgU^92->KHKaYs4?4oa5JR;Q!7HkbeVfB@SH|Q|cCd7sPB#8okK&$3#=C$hH94PluYmDTwkrxm8bRE`N z9`)`0e1^Z=h6p#hd{r~}&0n9+Mx805q+qqR~cD@~Ba*$zru7lsip~3BXEAu}YSU#>yHn198|f+X%RxE$pZU4Mu*MS%*F506f(@>o zEptV!o2$)+J}tWT6=wOR?)Iye)d8n2t|`%1_B8ABRXB0SEv>nKJ!V*J|6Cm{qtJ#? za|punr4IU*K>#`eEbz9BY$S#|=3RPLf$#3X1Bcsa%Yz>Q&HHHRsEN%OaP-dIc?kT` z+VU@=BUXI?xuQ#aZk7- z&=dz92J5CvT8TyP+%9GXYs^S_qK4~lH$eaJ_p!yryg!!FtX`{Zg`}P6Wp*jDGw^o@Fhwc7gpFpZTX}IjZpv+zLbC z&fVvF?|N(zYOp9CJ&~x`GV2=LF!MS=J?@IuYjIyS6mO)AkLyvx7R{q4b2l|f33@=a zLYfDeUgnABi#927ZLHc&ctb_|p<6tov`gw&sF_<4w8E)9K&Rn>dB7?=a&XRycA)d@gkts~qRj z6|C~_t+J~gHK9h+i~4Hjp*`KUH{AWKuZ;3k-tSe?b5^ry&pBgdjd$XKcc0r@3;b!F zpV%mo=h$+uEIpuyssp2zR#ZgAJ(r}X@oMls6B`_m4i+v=h*j&$jRx&Va^34))blMV zN1SQ^%teC&rwu_2txm)GOQ@c(!X zQ2pQdL`SoyB4O#RtY22a#vH4T#zulWx%0~o96&rTxRiwf4Q!XQ_QYR4m}CfznCf*2 z1>_qYfTp10;F+r3;T5=Q6id-ZA9JfGlo1ETUESvY`%XVUA zz{&&N54yM8Qg1WPs~j$?A+_%|CSyK~WF9H3b)Q*b^lNC;tCHSU2dc95d`%*|WzCb7 zRj|aD87drB#PHnPo1Q@S-C=%FN zS@|;+`hzk)skh_1Fh2QSkDq7&(C63V2?A_@;1PMg1+6lvo8G+Rq+`9BP*HSWyKnI+ z?$zKhHxT|z^~1;7>8c(KsSbduIVplevrtbZB51=*HOf~AMBNSYTssVG0H&^|*5=YI z7rA`k^Nt-N-e5V39?7M13)VZLQRW41zrb_bL)^U+K7&KQ?P1^T%YIG>PGQ_E#XBq>N4;DbR!v%|II7)wST(Ggt6U*s5U&0(f8qM<5>h@0XwHk+ z7GrDT{PDJTrBi;#NP~1y8J&50QV$=~GWN&hkB_uJti>p;o?MvZ(VO-Lwhdcf(Keq* zn&t`N9iZC@3!El4e8ZpW8-p=aumVQWC9WX~NzGN=4E>6%zTOFq_?7$OpJ&RoFr&g|XVg2`!MbVap*a0qn!}(6N%yN=i=Em}p-E$ASFJ#Tuj5kz%ddX)la^Y!Jrw z)w|3-Ch5}`Zod_BD@tvQ(QK4U9C(_~oUpL?(Px45?u_tyeKxxtK}p`=0|5;Tu>0#j z7cEz|=FNiyhSb*-0>w9(Y?KoTJJZ0@(#8eq;3I{su62u&QHpJ8Ll$)6-P7y38&$H2 zw_a}5Y<*ZKg;S%A3g8ZAzJsXw;akB{s2d?+%JIG$@Z;5aHfE9SW9GwE`uPvPWty^D z>~d99%ZHp)tF3EEO@di=Pi}k7h!v_j%#_O8)O{m2H?>Bt*li>iDmI1BBdnAM^sn)tkCt;)*eKjeCq28W+uj%0BYs<|lcX*$-rR@lsQN zI(FHdTk_t@`E=v#^!2Va7-ol|uz65P!e*mc5`w-iaT|B627y7}w4RV;K9cB~&jP+# zyt=2%tIDL@Tct75=h8QEUtnoOFbBqR7n%ii%rfZBWAbi~)5^fxA}Tink^Vbhx>iI0 zP*$WH_PRsw%O2!am&@xvHeHZ&yPGzQ(w^7pD|*xcqsbMq`?~p=2T`%-{XvD~v9sc^ z-!N{Kp4+88P9L&TmEWirA%_@hFOC^xKHsW z2cO;dU6{nGyV6|EbbO;E%=Vmhw8}LgoWt&d6Kb_oSJ|(9dReCx<5%X|*6(xtCejXR zVD4TaI|TSSMmu7cF^c(E+wfO)x1ENMxyfz4iz)AUpCD`3LY}f|?w)s@?soBMD|mjt zeIp=dwdpzy8{@IFMy6$e_jI+8*SJzOD^?as1t4Kdy%3zt1+!NaUz|Sy$_`FXwJX%N z*cmkGl(;qk9hlO?Kdh0XUIm~DMdNjB;RnyE{gDgMkW{Or{x(uswc_q|qayF|H=Vvm zPck7}t?Ka6e0?)YO(+3A>dB5kYa&PHTY86sAD0=#LyMT2-(IRH*Um(WigSS4HFulm zSNBTu|J4EL3{t-EHr#uwvK$Jr`E~KHH7thra~W%v>L;Z>)EP^4vFYRLBAime>r0Fd z2#lKX@=Ll}zYrW_%Fo@}(C8a!*(kIhKX0k=regEt+h{*BelBSnq5K6R8vN6D*K2q=2lmLQkkvMq{4ir5^fZi%Mt)ST zR$+hI?j#QZZ{2;QmiDM#Sr3!Tt5Df$l*Uf9W4e>-YL`!fqQkK@ClW ze48L-;r;7)pV>k&53}DKp+$1@Db$@SN&~W?k1{QY62=ve6}^#IL5l?rp! z^E|wOdX09>Z;DAd2r+O;v9XekXsg0FM%>&y3J6{J2mDq%RtV=0cK zlquS8J6)?v*tz|A>pwytEV0nIDHHl2|DG0bxSfmY)pE;r>msYBaP2lESD;eHf_JOb zu!mPMb}Ot%VFfssR^HoGP1J1es=VvS`;VqLh1t(9IRy+pvcMwPy{GN2ek!SE4uT^o zhcuD0eydPDBb!y-lBYms9rctda9~>egYP$45$G&N-6asd*Xcr_vuI5*MtPwtXC4)x zgLK1USA4a63VbJnN6M)W>MpzXTO+gs4t}`1RCBDlU7ljZ*E7Jo4IPze` z37_LC9Y1|iT%YwH{|84cODHt*W3heEs%V8q9>1aGMrPmSZz4+bH`ZBojTH9~Nh7qY zA)2`(55F~eDur@ZvS{{K@B){5q%_WH&!v8Q>&aOO7b+Fhx(aZqhXB|F*842Q$Nyuo z0cUO`6jGLyl-Q%>0q_i5lPx6>#5yE-cIVMakCK4RqJE*MRIk~=R~db-zXJXT5C8le z#^-XcUU)OKPHfwx0EIyC>1l*GK#O!%4J?Yw8RcyoD zR(Ptz7UN0>KB#U7ce+f#)8Cn)H9`sc`Q||b`!Ch&^Z|sHJAjMO>4@yUaqF|-{@dQV z*FK=n)`dG5R{+NXBr||gA3@F*68VJ{5%Oz44*h{z@p{FlGC#E$Vp5t@dDsU4d@~s& z08+HIoTNO*o-uh^7hv&oLPq3%I{RH~>^{bZ#KC&a_&49uwKrP)W3E8+`oN1y2Dsn| z3DN>|?U)q;rQrR&0scL+f(%6q2p(47_Ga$bRhp~5KMPVdYF|hv?8}#U;p#S-4j*?Z zbNp1~nZ2Ztn-B&_%@Y%-^K$@`frDtydTXEO@4*Kkmn>D6y|T4`Nn-c~FCHrmr7W~U z*en1QbswAMp)$aO2zA%y-yaAEXi?&mt05%wLy*j!wSI?6+)wvFGUsbt-WTpOIdFJQ z0MzKco?C(yNQJ&&2kB#j5Ga4khx%^lxVZpYFnRJ*6dE}owF9;Z{`mRlm-Yq%3NAUA z4nxlg0-JHmE;9z~|Fv8&N6Z3pI(ts?eabCkZ4OAOUi%0>BJ%UmKqm+jaE<;I%K8+}$6qDc z(Fwf|VN;E~10X{iI4YB)5~_*$gNXw!nhNd!64MYcUqK?O)BaBP-xHtU2&8tRL*Zv<#K4 z^gd8N^oZlt{g9G_oKiJd!^Oa;q3FyvM5QI__JaZI%i(#XY{s(^w=dE;*1Q8$2f?Jp zthkFnFZ>O=`rr+c)9a+qW=rYHS%9H}I+Icr?Z_yf<8Y?;2g$NMRBviDEj@qq3sRBo z#)hc&`)W5p#UyO-K6xqb44_G9LS?IFXCWT-d(F4$32%>6td#7+l{FdON`>7B30K+u zWTmd${gvSG<0oyN{k$saYf+4K<6Ak^dSc7zXS`qwH6TZ%_O{S0g!6+F?1I+43`BV0 z*7@iSv?LwD-g0F?M4GRaF=P8CBXC0*4m|%Kdv6&RRrkFQi-7_nDk4gV2!fK*(g-3A z(hbrL(lMkcC@9@20)xcR-KBK*&`J&6H84E;;QhUS-~0E!|F53s<@1IQFlWx$XUE!m zt#z&If|2=S%O2nM7@p8gw>^z3Mba?%m%W$avYv_v=G|jU5!dVUe(9Th`vhJo}+$p+m{%)0|`}fj-CnJoqECpQ|6X$7Yhkp6R{w*85Dt`{G6nT?HV! z6VG0-k;J&mT|JS_j`2(?YE{X+f{}LU@h^DuSScV*4&OTXo*6bGc0rs zP;2;+F1q9V*!79>myulUaBTePs3Mb|wsPClxiJ$Ao)c_;nclza?3Mf3Wcibb8I|+7 zodoRY9E!gA5VDD_U_J-%N##N&-32n~Ele^o*bCo#@3DT(#=n?AURf4W>Mj+{S#r9k zypxQMi{3d{pANT6mlA)Zh+pW4wkC~O!f>SPJ~8jHe{6~LnhCkiW%WC$GpubL-*Nmh zk;SkLU^-!v7`cIvMwb-tYoK?l<#nZy?3rmV`!3#QQ<2vE;IOysi0Ydc0h&c0OzVrB zCTWg3R_k_a&1~RewTs&V!v;$xx@{hcKZXjd?A0qzoMU-*h;0`@5~bJ?%~W-!Seg@? zUVc9tiO|^b2ilJPrF0IfV`-Q0+-2|wiXBt1g=_}hL_rko=~$7VnFp9HjqpBQcN5L6 z$fwGkNK~zehP-mxYXR4?HZPbwiknLCY6_^bpl%h!pjptJV@t>8=YeG~=n?I< zN6O^9J`ou$^Ct3%{KX^t0nQ`z27iBrhg1e-5H<&I=SGPJ)20TWRbwWQWgO>j;cU?S z^&Tg^_`V6qlUfdiWcNf;f%5X%*lM{kj;TtI4E)^U$Fm@EmadV$ZFexGT@@YXmvSl- zL!@Bw5-~HtLc|y*_)vThfcD9GhKqk#SPxtKl5wTzrd(7gG-ToSn*G+9$g2x6 z_f2~OV)^6*aw@;zsQZFF1$BT`wm9S67G(1NJNJ*}40g^6kw^<@dw&3-B=zuach8!N z_An9hU0)q;-l?xMvCncXYO>H0?sFQm0VeSP^-zkNQnRNPA*_X)l? zvcya}Q4c))0#r^xG7Hu9sQ;DC?*%K?^>~SG4D3tV8;r@NpSgN%1mPwU;{?-@89Q^u zf*XA%G5ESXWfo@ipLcs%oY02(_)%mAgY|~Jo6Pf6im3VThW*b_CIcD;Ar=1E=9J`= zhz~qJzmTfB9hh1iwAzv73IItv2~C08k=?orG6%1D+~>-#qio&{q!IWI0Ef8!CLv9! z#ZJCLEX>FQUJ^PIZ zeAG4^W;9mF;s|7kIUj3{cGW>EY{TOr5IcxYHtBk78PI*z8wMR1bpYGOoM_;W*Wkbi zs*8Y|bTcIQ{3HoM2Jy3Z4_Sgvm#=a=W8Up9O&o90o}GOzB}a>=ygN#huldS+LoR{O zD(lUwR$iH@kYA#>e4Lhc33-ewAV7I%4pYaVMuVKP9?X}UJN%@${mE56uR(Z*KYjO7 z*~UaDICK4qk-X2}NWzIqQqquM?<{taig=Pz^D|%m_nH8IgA5p5GR84>YI>!ax_Ys^ zY@c9k!FAmD+GmUx!`URM(raX6h3m@at=&44 zbl64;r%SeSY9aoK7C#VrEDn>%p1DYIK388ZI8f@& zbI`KZRARjLYCzKVRei0DhG<4l1hxpt9kUB#jY=Ivbejp2EtXU7rVR&sq9sm}K zWkJh17jDPn&+htJsboE|*+B{ZLP|I|upQzSw&pX%?mbBS5^$ z>BX7z!c+}<+qwu4mB>GGMJIBl8+DXY`pIbXl!f1-`WdtDj_wkCE&eo5DennTa0f)IW9WP@L(C~z?N2GY!yP108 zh8;i1XbPNeq>zKYY&fXJ?XV|u>7kjV@2~|t9%~!eyX*Hh*$_$=)9H2WW?Eu8PjsF% z&ze^;Bi>pZ=@_`KkMSAT!F3c?O6Z(=X!zM*deEtIDq^XM2$1f4;d>^CSDmM7suzx} zXy1j=_Mz`^|2^)jeh4fjpa)}MFV9mbfwS9SO4+~ba2{AZ9lu|ro8_=xZvY%uUS@xN=Wph=-cMv<)V^Es;^%k45pOZU zGUu}wV+Q*V`n_|lR-8q&gWrCTVd7I=zZUNhq|vaqIv_W8_dU{0j=s4+9ab(krbKvq z{TbTKqkoTz@TJG2JeBMxk)01zf~WwA7SMKDEz!w+EonZIvrMW>(%EQoW#Sg+7cy=Y zWdU8F$LNFQ8uTVxz~mACYJe2JXjN#WR?r{4@# zT|dHaj9fx_as}MR7O)PaDy z1P^shYV=OjV!O6pc(-;_%EhB(mX%_8?1PQl&q~(dh5Cb|8>^mbB!hda{jXT#`G1i4 zgW0fLveMtO${$5-tB>kWF^bW+dHk~suV|Cgr}ajB6r(03zuSH|fuJcRV1mBU*q6RS zYxm|1>!{(q=+>_vcpR3jN% zn|?BK4vL5Jsn;9UCO((pw3=cP!FGtejPpyd^h=WGYu{Xmo-BIH_IGo^NIyCV^9u&D zJBig84I?xgf~W7)wzAm9Oh@`>iC~qn&VnB2l7&s*)>F zGM6UycKFdZq9dM$ebQk|qsq|>2ZzThz}J1+xtUN_BPk@ONcO4l$^mGz2E8Goi1j_RhU8y0|ZmM|Ve} z5ZhZViRr>03j1p`Gae>c4Ch43Cc@f#DNoa1e$wA}PEqD0=fpZXnErxi_l3eUhCw$7 z{mN5!Ctf#~C>%<-oIpf%)5#YWz-EJiP7re0U0Prz+CVGO1O=3f9~*QAZt>GBwSwcy zTf#IMUo)2eyF{t(rdUSif1-I%oaU8s*PX`-S~Dm}m`foYJ5@Zxofy^Q^u=V6(sg;`Po__wi)=4+KNamv5~YjDAH%AP+mQigOB>1Yi(mbW#9tF^JSLY}ev6x#Mop-42g1J~5{R1J(K;!wm> zw@$v8JPBJ$oz*D6L4GrOo#!)Pt&9)I5ZylLuKA{??04NP-R?&rO}Xp68>m^y(X>T! zJ_n_Rt}~e%82gv&lXWH=ng}~r*PpA&gon>Jd-P(_9k-7bds!-M8uJqtL_OC?lslz5 z&XBRFBRo%SCaF%0IKvma5>58C4(>;7;Km1kW>@4>8 zz5KZdh?mn>UVlBo6&zy>DOY*_zl1ErtvaPTEJKfoqXeaR?o({ z*Pz7J*VCze*VS(QMAU37r(h26uFCtlY{8MzcRR$4C6VUDG91bQa}x6(etk&a?l8KT zRX~lJtZ^z403u=+&@oyLk;YDv~=ma9S|jxTBc%Z zO*E>>^v)k-+|K0ugGzezW`ufK#7g4$Z3?VJ5B1v`U%(%nsGqq{yp-29@mFDS+&D=& zja2!z#x<*RAWPv_ZldwM_2jmX_??fR^HHM(gvJ}`oC{urtgR-=_+hl2f)B5`Kc|Zk zCUqiHoUhbB5{BUdL^RX0XlQ)hfuL)f|K0FRXzvY%!oRnm%9_8!zsHI7HXUBknQRMf zF|!^QkqbxU7YSe0%UyW{NCJ7Cb*8-Pz5tGly~R}j_zQb|S)Cp5+YSKj5qyn;$KmBq zPZk{k(;=2WU>;!xeZ2M)ClZvEfF)CX=@Rxp?KlPlxceYU3a!zLgo z_#5u{s~2ms+A~NRG_aB8W@tVN2uf~yb_5%qVJ;~E&~P9B>_rOb1U90RefO6)KwVl| z{1}4*#dY9(afBwU2idy%WGF6fRuW4Og5L-bDVb*CCp^INNrrbv5oHgLpJq9D(N7kc z?L?6~+2qutt&i%JVnNMA`4jL&vyG|K{@t~^lv7WoqB?;rJ!lB=$h(2_kex6H`TxQ> z?>;Eh=rtS{`v{biLXY11#pakt+)D?K%;sus=OCS%W;0oHci6~|Zm)YHio39Le8d7W z57(-oQ)~Y87rFB@=fj(xAegy14lqL?o<9!SU2XN_9<)KW#oyMrS^U`13b)!0#K{ zysyrg=Dmdg9X?GG&UqtkpzlXT>L-Bj3pIoNOR9H@hjMfBnkc`kc4sCdkpipV`{7g1gT^mQJU} z{rb7IF;qRwLEHTYPX5nwUvJ=8Z;}1mx%I?lEB3rf-@6C$@L-aDT9<2TO<2{Qo9;5B=m5&e38D>7d0=F`4UK|Ej z0sk0;93t8Od?HkTdT}IIH=49;T^z*DCcW6!q5FW#o}V*O<0O5g!s!wWnSmzr%}oz5 zYo>J#jG^4wHPA&^(4~L?`tjT4X?qA@k`?c6p&pA5jTGBO2rHVcnkQMw{?x-*RvOAP z3O#gyCf-e`#|fYgd=nb`2)c>4E)GZU*4)X4!h80kXV85-z1^8y2@gwXUqEYM z|Grj;9U5#xzA|XReN%uE7bO+M|MGBfsDy~fbyvD9fgzRyYvIIU_IyM5-?s$$dr0B_ zO6vra^Y~~DX4aAp);a|0_&=KJy#ZF?(K?cq4SFSzxcuY~DP*6|rGNgIfS%5zo(sv# zyMzGSc$E=bEnwQXTfT_B0Sy-rnE$j0HROL^2HyAoi+h4xx$SoGF6l|d z?)rWx5Q})!+H5^p$!NuU5U$ci(gE@qqGM@$wc#e6;a0p(QVX9^>1$VQ#E>(gjufK6Iicy*}$So2SH_p;szkDxV%5fO;i z|F9!9Bx$5wTT9D-DKIK04CDnmfGtS32@VFbPPAG{Vus1j4fcgW_Ea7EA z!US%@ejZ3={gwct&8k@YyKRCXkB1)KXy+o#=l}&stCcT@ZC4K^VyoU{t_r%Stxs0b z-XF*akEXAFaUXjb1h+xgP^ z0YoeD$@bIlxM1#Q?kZ$@k5}?q@;Dyn?B0Lg?kCMSW%jT~;8f`)oNRLp#9e?b1;Ua_ z-Iifo&NpB|^cM3^^#*3CT8w%>+HU9K2(ZO&a>^`6gzDd!3OuQ?NOs@alVf!dB6fYG z!w0*Mzl(Gvf7A2;KiYo2mE`RamPlR5VsZ!75M5;Wo)_jZm(5gIVS0f7!Tt*Y=i}+3 zZ#`C_!bj(s7Enk7^u+Tz&m1e*t+X_8=e;-;)(Mq~$1n#EKrSrcGYOKuv5XoBT2K<7 zPuGuMfql7*b@UvX$q*K0Dqr&R`Q~x~YveK?i>2G)qqAZh?I}B}+j`Ff^V=L5Y_7#G zbe_quSBodoRRH|W05)By?d2Qs3EDmJpm675Eh|>@lK8cUkD63`)AwoA%=ev6z2ClF zTtD5O=L)wRny~Mgi&|Eu8`adV^AzE6pm?$-;4W5Z(sBEK8G#+Xhv)t(|Dkx~P~#8! z`Cs!L3Uy9<;&mCk%;KYSvf860 zCypRdmfn-UUEw~T<$&U7F0E>h;wU07PrSfxj_E0%{M$eGgTDKSy>PRV79TTfRQ&}(s?mWa@) zGB7IBMY+x$gT#O!ugCDk3V>rY?2c%dq8bm6z1TfnXcc`@=@5xv4{ZbE`(lwc>LGv-Yo0Tl@!G zkz_n}3^R)yx(LJEgLkJJAb1o_ls(b`Qk{>L+YJ>`R`Irlw}dGLZnIK-149x`D}5&8%yTnITa+FW)`KKMN6ryQ^8cl23y67r&?7dA5Y&@yv?MVl2i zb$hJZ$bW);jiCsnq(EoQX9-*D$^!R@NF8C&1Ky|Hg(jieup6TrH~DurPSMGprOL05%g9Fu zx2my|9o%lU!Dyu%UPP64H;lp=#cadjGO46JkH0x+V!qt7gHZgr zYlhHH$|$^AFmTt~-t$Pt;iRqe0A8BKpqZsskI>fk54Zce|zt^>sH zUOGXc(D$ZobQhlUmPkttvNdyLc9h@m3tc z?yp~x=m~Bwo?FCnfCy}3%+UhykDHqSCqdJrLGbDvBjPRe@^a&CU=ojNeOqF@7oQeo zNIZ4jJR^>{N&*}~8MFwP?DKC6+mNfVXFR^{@6py7O+pyk6TIwQL==b4btWavcv zuefogZ=-XyLT$QqSU`e^aMR9xHY{>~-mM0iH~L0q@o->}dt0SRW1p=-H(+HiOPPsS zADtJnfM5=fjupz5uOV?d%W9$t>A#Q?htts>=`q#<`p2d zWTsW;mnIY5p2TK$%!iIucpUit&}D_^%e@`ME^108EY2xV11psoed(%gFkU=+KFRi& z%O|6snl10)Tb*pxNIn8mPHPS8ZfBKd#1< ztl0p?C7F6Pzc0r~z8##-9rYg=59!3MKzz7^P05VE-?ee4RhFI&_99{hF4CJTp5m35 zX}RMuf$X7dm1ka8aaN}{mYD0xtd@5%61Qo?1i7rZQu44uVWpq2I;cD0(b(C-4(Lo40`DN{;VDx)yw|a2AcOz00g!`KWSngm6J; zzC9v;+A2tB*cMB*2~Gj;Wc6`0COt_PPZ}&f8Gkfj++C)uh^+0kB}YtUnb5%t<2SyD zz<;EuBr3DPe9Sg8{Ie}WIHYKHoRzx#if{;<%Y5W#N`lOWX`<9EPI-?`vMJI^U27dZ z7rS-ybIk_QqMWC43^uqe*7LSo;8y!E8js4sZ;{4$GKUU*hxsPqQo*-r&t2;B7hvV! zf7gPzzW#}>@)kP0LZ%m98*!4?Jy*Aa3Uu`NbSgciwXfS}^9%;xUG3-jN++6a?6!~Y z#J*1Axm1@kZAlkc?Di`v^Yc>gnj)z*`LjsrW9H)$x>U^#z5c3kG5DT3ZpJ0&;cu%! znHv4X%R&4)>v1!gGA*_Hy6Y>WyN`?4>%O6D-a9RIzz|EQ@l=E>vD>+#&O}KttnCKIzPd<6-sJ7h#wpIRpM-~?sspE&hEU|)CBh>oq&}IF^{dpYJFjf zmX5iQpTzD{ZppIz*b=9eL+RoT?pPF>Mb@eKoj@&Tso3r%W3gn0ZgB8ghcW-Is6&}R zQ(7fXW^w%QNVQ%nfc<*TAo#3DE$B?OXNg-%CM084uPg{5 ztR;&-8I<_^aiXBLUeD12+RP5MO>{I`tYuFI7Q_BJxE3M=Ejc75fMvfVcxX@ho#*GbAzvc;>U*y#GraIfo-Cj7@+Oq1 z4D2PFHo|8wRb5fqH7%KaO=yUJnC1~emuce_V?B~tVFp{gChefh;?cd=yJ+i|=|sko z534_Tm;1p_6@S{L3l$SY#tU>9gTpCLt71%MeeiLsO1-941ed)$t8B^9&WHvF6mh`i zlePE71X0+I20u^V)KaZWSPXcwQRA8T_Jx>NWL`M2-{Bv*bCdh zS@NcZs5u(xo?-uSUml6o-{M4d{GMyW;OXuzgM57{);lUol7lts0UgHLOrgyCa|;@o z+w~{9go;DwniJCE*dUzEj}Q+%gIn&8taC)U0(_5P(X$g>_jv+-p;we+1)V-1%? zzP&svMaRP>Tf(69;($6o!8 zL#I4F+eHczJM)Je`mdccYB{S>+^wY-v(+%7u5{ zW<;98f78l}f#hwwhBX^v$APaQSq34@?Yb;oug0Fx%ju?ZC5`A+4}YR2fJ(76*JXgZ z-5IMpCGTWKi1+Z^bJ&#M*TpQ;;EN<&VP27b@_p!|k0z^mNc!yCfmbDoK~haAK{Vn+ zl5tlLC|V=#@2ooeJvdH)ONVNK@?e!7z<2N^O(wA)!<1HMkMHY9rafL3(M%JAw~;c< zNGdHF=C^^i)d^m1@+*(|z2njQ(`gLrLBsLX7{w@5_k>`&&BmeYAv$2EuIb zh2TKHoUXAysG#vkJ3cTcp4&$n%Qmqf?v7UP*^DpCjBlYHux84{XH6RSB-E9zyWitH z^|DEwA$sD&{GBcCf;$hxDvXnR;f{h)__~B*yHdvU8zy?;>st}jTV6waZn@T|IZKL1r;{`TG_SKw zEJb_H4m|sbmo&^W7|F<$$z;K5eny#CIx+B8>>#u6*~86Sd^4X+jl!ucajh5~y}nJ4 z*s#B_TzP1K^S~X&%+Y)T8xa`un#rFW`7S=|t}tC}Z142`v89IIyP27WcwWFmxyS|Q zFbZqNkr|r2G+w!Z@XH&YwMZWXkmiW?1zy921YO?~1P?ei+&Ma~%A|Q>O*bZUf%v|^ zUq4GX(vXQ=JaVww2=f&;f zXHLcK79dG`I|9AQz>az83F4N}c zZDz=Flz@yu%b965)kW2}D7-U%_E=R;D5lBnwMo9}l>ywPaAazjnnZT5l7 zn!}gfA63|vK~3tTgf1SAT0v3oeHb|sJ^_))$)>ik6pOUvp&FZu6oJvXg+xY`wQkp0 z)@~)Yg-d0{@!OJ#CHtgW;ys75&0JQyot_%UmfTr9#mn%zOsxTvhiRMuLfSrd&v%2_ zQ1g*rVbrlZYKrI7&6AAUaKOnP87ABEZSCgJtAlX6;(!6~7rrmGrA*Kfz_a@>*eD}H ziSKr)tZzU_`rtu76_F#X3GC7~=hs8P{(@xtU_MrV`&PmEF0!kuTFCP%3JYOQybN zhBPj+?`gn_j6_Dg9$#`i{2q%ibRaYMDZ}0)|AS`|Ne?~G4bqG(a9^C4?W`b!BmxW)pCRQv2;&Z-K%ozBMgh9-Z?*8aC9|DxI-1eI zuek!3nF9Vx8q8m1|3mqMpc<3gF~g?5(iS=Q;M;Tc4Na`>on@u{5(n@5l0P_HCWzmy z)s}g^t)N~M9DpO43v|9g#;+`rd=@8uAwJ*=K8v}E*BCY~a@l;+&mVosOtVs*W_L_K zOVoiN+z^f!1UYdlHTaMyfWQ^Zj1a-eXLts})`_Y{!b=a(K*LbcOj&As5q2Evq$?<$ zWOOmPESF!t;5zyc z+0UdMHwf@m-NST;&wZ~_1#3#-hhfJRv~a+ds;!0P@K1`{O?=JxGiSs6WGV^bFpNu{ z!t-FqI^Ed0%Tz>}zV5rQy3sxa!rR4kiv!vM*?+SYymQhKNvWNy@>aVtw@BRW{Jy z9-%NkyW`<{W;vB1Jzip1Xw{PB4F)UErwJrDSEcMH6(zEX0GO{;meHm6>j;^^v1XNE zyBJ*fQK_pf`AM%Nx!CL7LNm&R?>GA&zPeO^w~$^@>IKULrG*E!3rpo?DvS)zn7cOO z+OJHGXXvb{u1dXaDdr&llH~EHs5fgIWSe{&f15&QKskcv5)*(f`qigGOI~wi9%?6Zh_j??C!2_;J1GCX z49QGqQrSz+_?ruGoWjBwZ$*0BLB-%!WKkQ7tX0MRmiHEwBMLJj+2*@8^ez@<^>E~{ z-HEeeLigAfx7DfZ!s->YGpRy-O;_>kz-#eKBULos63I*@ICg$ohocDu|3l z557*TJaRd_QZNR)AA~CDX*dRt&6df~WpR`u8m={Nj|qdok>Z!_8gDf zd;12~qjLRIEau`VE;cNWWEB9Q+p z)l@A40ua2zpXARmc;}4%6cqnbA`iai^BT0(g%7%cAOPuX`-&R>NsFIvj{o)JWjK^v zZ?Fd-W1)w1pef%J;$i3Ej{n`#8C`JT!<0;Q-UZMQ2x}lmoMiSlO~jeO2GiG^tSNyY zK?f>)+>Z_)*&l_4y?aRc@yR0^eeaJB&e?C?VP4$2l9r~ZA$mDIElor+t!nDjlJ6k# z{(9%cCtmyCu&F)WS}obt(=oKp2#;WL&7ZvfpIP$o26&@i7h=Vrc5OkNv(r@dJAba& zWc0BZ$?d40O%|_UeVk^!mQ{c({~)E(7QkTvGSsB~b&FM?hG<)@#%nYlapn;yoye{0 zx4%KQZja&8%hD=;E03({YtOctUD%@Pb?$wVsWLC0sgz=whCf=g@il=PCMy~JgalO) zn)ubeM);^d3_y5WW#>2k(?B0@FmZ4XDd7;iq&G-c7eP}LYPc}&M6HLWanG4N?pz1s z2fT$6FAl@GMTNpcUxlhy>81wc&s|>nc|Lok<2q~B7J8}!qHYG6$?MYp!2%R-%&#}1 zite^gi^;W)=ao5}meA@AAg3`Q^s2d%Lz2PG=CG3^W7RyJ@O^D;@fN2%$@Qyt$M&k! zbb14$Tj6s)XnS$Qa$oXdfaBbf?R}PIy!$Nq*`QppHSg4v??0*3o1|cL3sPG7p;l8s zXpAkaZ?1nP%AvQA<$Iv>IPuh=MJ_7%)$YDz@HbLU*K`(7&w)4B<3X14@rEM>!$$3C z;aoYh=I2*$+X^`f0rc4Hw7-a@l7RT{Y2pK5DR-VwNeDu76z~DZ$2|D+jLSjZRgy_f zVnOX+!QuGhi^Yk6An z${_Qd*Ne`Y5X{r)VCoX9!SJI#G_72cbbACHjU31KwbC$yUvm_5i@ILUlZzO#1BvJx zdE1780pMVgzekZP`lbsQ)J0B z3EZPc6FhM87+z{aD(n>C{&L|%?}oD)>_4h{8K@Oxz{Wva>EJuOGRCs$9midS)R6_m@(R!4m6)GZcfiuH`3SJYY_K`@19bcG6* zojraUMjPE?p;CI_6yznF7-eSc+5l=pq`rYdr7N0EZY7}361K{b{Q2~!qji6p#9UJf z|5|dMPL(mbVm6o&s`a-xOmhV!KoyTx#YSynuz97T&!`0vlMgfGk|TE)Dk2{+(sOji zpk~WU-AhB4>>M&M{J(LZs^(yZI%9QL)r{L?UYIL+D78n^6YbwhS?EbM79i)_Ewdae z9q8T?YmW-S-ZPhccNs@(5moMWw0Gxze_6PN&cw6naOzKl9hLa;tAaxuBd23V+k+Kw zH&l#At*6cQqQ}F*9l;ZaYV80ybXrTC?roarRu9My^I}Fo=-_GBJ?m`!UBYLIx zO+OK2&LG~Pg}?j(AF3I%(KO~BQaCI* zX4bRptuj3OR*s27WKLxXSNwO!oJC2yS1>@jYQmsx_9Ym0IcOGT42d_w)C+obc; zNBsEM?;PrN>sNi&iC0Zx^HCL+h%KR=~oCjNeK4c+b?P z2j@PgnHpiFCwGcCsF9Oidab)1^LTMTe*R*~yA___-AJD2(FYj286qbCyToGjgr!( z%1Ycz3)FG9u*ULjvsq%E^7Ga`9xF7C0;lUX?-U9tRG8=&Th}75VMkIWGqsUyDNWwm zXeRBbAb!8mH_XntWD7;joDnBWJ2?BvBy==fl*4|4rR{u#-^?z=PAXmcFcO@<^CG!y zIm6Luf+HX4we->5tWyV;S#gKMV7`1g%&9AmPfsLKiH1x&-!MJr$hC%Vx;n+MD@ds;SPTMY-Hi<&s(ee2Gh1xyg4{=2cj3qneMmw)cD|nba(H=$Y zW@;_(6Cck7%Xqb`5@twslO0HAFUF0&k-gOUMYFVRMu1$qArjk;yb3=G$OXsR_qPRU z!{!H=X^_tp7xM(p0`uVFXfEAd^kdvhi_zgpf9;FjWniZ&N=XWe6K6jNoj)^{;Rz(%bdwSTg%KRI&Kl4CCPO)FSI!f=ITIaXj&v$gyLgUPx)WL#Dsw zuh{Jsf*;fqq|22#IZb~L0kkLR`S*`BCKW0gn{pS-LJCb$ zboWQm{ODM09xj=g1*M?LXAO!~vZwQ3R5eGJX=v}jyu_VJSD*XSj(F^?IS|e`+K&aJ zjk6GgZaXE5+6VF`_%iKLOvabuwY}DghSa)KBCQi)_~CcENF+b$fA}%U>IT~O*(J5ffiAPh;Qy z{>K!B$*5}RNH$Hk*h^Qs3^$h%QQ;3FKNCB~zi-t9hpkH(2##AW97z)j@2w+;G3tvu z)gL-!%8!DmCG1)l3pWDBgElGuvk%U+fPK)D&xIXQliGxiIf_ra&(Cy1^#@n@@Z*J< zNHc1Ve^lp;;6`G>`(FjOHq!8$oNx_DE4Mg3Rd|xD{YqK{7cqBj;~FUd+WU-rolQoX zm`8rJU%G8mgYEu?J{Tl6y;LpVx~K_1K}mI&uM(2lrL!tak}z2v*+);dh&APcJvabc6Cv|BSS6x@l&eP7A$LHM3Ew!u2y0J( z|M*J;Pe~S1GKuAPEt}Ns^{BM7D-^QvC0W^_IBvymUD|-4&9u@|A6Lf>|WDk3<@Z>JFiE9V0RlR`npPRW)=Ow68SwBl(k6GBS;3CVwr)U*>-OhCw`E? zJ!I3`U~k2VTI6<0V|~8;e6@ORzQx8Y>tHA0B1UiV!*8`JHzUoi41cDLk)ktne;JxL zj9U>KJvL`%Z{-+6Xl)ib+8T^8iGDelg*c(%qsP3atg5CwuYH3MUN;%QNHnna?*csA zI}Ly*`|h9IeSVO*9OGRTed>RMf(U`UR$-zD4kwZsL<*qoEU>fHqK*$GE^r?{t;%xE zq0L6PPYrL3hh;S}rwj-1$**@NGupDPA4oInCqwe>xq7{vGiMl%;zR>5LXz z&NKJVuBon9GD(CrJD~*S0BSsZn$xmWYTBqLsY@lME3T>;!&aCt5xpuEzaUE#YQHor zg<6+bahm#oFT0nPuQ!ml!quL|u_COD7Ui<+|Ed(NGIdNpwh*=~XRVrSY8Kjh5V?Z0$e`(e_E52|Lg4MA`{I&D@mkIANL;Ukm9!Qy@$DBPWJ z%H+~sKzJ--^{1@SJ0(-{V~|DD>y+urd>Xc3l-SKp!xrjlG8+A0>p!J75HK2k{YI|E zd+fgyH7SX8M$-&ZJC;ykAA%zoQI)dvNntVRR~-pxo&9Nn`&eYu7S^{~v=_5-w+|=2 z7}$vBTbHWtxA1mQnu~_3d@&0FPk5Q-m`b~G%XSMy|<#o zCY8mnzww)i;qAeN$ttk}Dz_44wl+^2l`4wYN=-D{NXB!Ep)HI6UJp%7+hg=TMWKhO z<-5!Ht%C^7>01h^=2xET=0<2$JG8COrq0T~gb0HI87%uB|Hi(4sag~ z+7cBXu%&dx*oNzax^V$XT@POE8*w3-YorKj-6XBT{W3wrtze5e3dOEaK2f`;>Ny|r z)f~p2JNsAVOY{tE3hDMIbFOunUc5fZCVp_&?gm)m2=_kkH{oMqSt?&7OL6J5^uh($ zpwWPr>3TI>HlgoIlJ@Tm^EOMb#EHsMavvS?2lZd=X_@wO?{UOf<8h<0ljQcyjkyVMO+S@7h$1LBt{v3ip z8G#otPSRJPqd4U1y?Yaa`YT;{%|)~xC*IA`jDD=JQuk*UJ;4IJfaaOk7OoXQ0vwqzx{8Y>pzeE)9x8Y;B?uv+3AAY)cb=A-A$jF{<|<27DSfy z=8~i{)H-LV_aSEQ|LL2*fBQ=&y#gwFnGpdO3b5Z}{~tlVzpn#>cmblz%EwCQg{in4qQs8K(SvWxq-g1)?Tu4E3J?`CqKK<`+2zf(3<*0W*IrK`2pj>0; z|AGRqhLGiq>gy1){18Hx6X0XZ{428jVLj-Xid;%Z`_0^v9LJ5IzR-FZ$W8KbM?Pr$4P^w&-yH7%Nqt41(F|H%I zb%rxvQ?^$sr{@;B;uYZ1Pf-&Ez7bF4CompOuVm)S_DJVa`!+gS55(Gj1QHvq^<<~J zv=xHF2BWcR+nO{f=V1PW6&%8J%>$k7PByuY)>)Cc-B`B$DM3uRbaxUzJ>a~Jiq>&| zkp$bn4-?Q+)aoKh`U8PIUrpZ5;JvC>Iwql>NQPYdPkLW({V^lW0YWZ%ipLJ9wAZum z6iTJ<$Fi9ut&Z2}YSe62UnlETrIEwv2%Ng-0G5AM9oHk#rz$z$`G(3vSEs#%%ttbr zCBkVU7ib;=!p;KxY)D-JZ=vfpetJT_#HDn)NO}pN>y)NBBHKS()6MGIu5`5Nd#k@# z!eG42BugCoKLcTpP!DVIc1M!a~f`;lS$fua#0H2?xC;%N6qxLWM( ziSsh3KjzWL1xjrkP=3XNEaL(6f;OFmf9BFhdLQ5?O%U)sq*rAK1*qIHp^SC|j>o~7 z)EYI*V&m-2Fiywii7r1WMH;yX)^w@yo#9yAjD?;OhbzjmqwJ<{1U32R$pp^|RpJCr za|Uy@6@Pkgzv@olrvD)s5t^f3)LvPVE#o-EsBS~|Emy08PB}}dFuE(gPDsb%6wYpW znC8CS=l@>D_Wxn;J;R#Zx^_`@VL?SyL>8bFr3g}_OGiNvLQ$%8k=~_u5EW2Csu1bY zLX+NWP*8dcy@Y_25USJ&A#mmcu6M2X{m%K$b?sk!U;A4>Txh~mW*KA5F~)u00+#NO zMf}TN8$fVH-aCiDKX0h}l1kQJ@aWTvq9>*Tlw212W4N1r=R6;7CwR!@CYIanpnd1K zY;uV1;v>6Q!3wfmy{c5jUDubn#g?r4fBt{R zmW8#!VRTA87t=N8OI^^57J-% zyTE0~sqDEe5~usJdt&$Jk-jryFrDL~t@?mjz_2F6s!Yd~tuFeuR_ybf7wAR#Fu)(c zXF56EqfehoM)--mdgv1MJ*k|gex;hMPX2!x?%1ub3r+@cV}IqC8kU(RTD zjgUJwC<#dey!=S9Y3{Nwvc7I+7OpdLU$vxe^nYQb zaDADxXuL>!oPcCI5s$r+r;d___tHL#X(ZSZPtl4{3c_Z~Yzc_|EQ8KN^!g|v6DND*lXG6|d*Oa$z#OM{$yy`X>X;Ni-pQ$$^gf)4BOLdaw8Nrt zCYa5n-_*1KT*(O7g#Ee|04X1H(N00D@X_^tQu@;(+O{F&FSD`8zVsPG>MNs%=MzX( z=NiMt8E|2SddQ)Bk+@478Q~(<=Zk}!!mjIvRjjr&08}r(g#LI)bPE;{44`@S;ZE3Y zSa}C^*7JAFYIcyt`2_?Tq6)$;E<-E&88F&xS1%q)W7WSp{%{l1Z!__nL^(->Gg}p~!__uWt9nB5 zI!Ss%+2YXb!fbmak975mCHllejP@CDv}+21e(xm!gR-4D70U%(>+bCX*rfaEu=y1Q{tY-R{27b3`Y63v8$dzlE9)pu|tNL)yU6>{U|S-NZYz z#syHhbsXg)FjRMaf27aUa_6oJeYkpft0ss}`1|W|Xd4{CndxupK%E6(W&Cr_q`aXh z41eY)G`9@U;p#_M+#%#(4LTv&Z;Jh<6Mh1@a2Hj(!)r`3gLsSkiz8IHZ#WI+&HMQy zi$gl$F|ZzrINKnG4sho;l3+XkD#5lMKKWyaA~NoXPIwcR*lFhp^=@pbR{nngf(7 zm_&k~_eEVxuN|5w|3dKBjw31oKWIO}BT^H=uSj)(r+;SGavgf*WawHujH&*Iw>jeu zy(Q0YDuE`D%u^F1KNbcZ#(zLm0vC!ru0U@FH8-p=cRN8(0|pHQvxs4#+0eslOhC5^ zz3p~*27{;ssN@0!p?50+*S^yJY5X^pfICDbAm>eYgk1#lgShpZN?-_F-B;ZEFns?B zj?%4s|DqD02lKsW^ugkgu^gfj;30+p#(6TGxB(KT*Ll6fIF>9}zr0D3>4ogR}cK=~uBVKXXW^#rFat$=LyI|jZ zff$^Z_+IQot_PqCPJX-72T@djdA{_F$p2!g=j#6T9#?y-J6l{DLAAZjU7B zfZS9E9$`FwLk4<}F39dAB%D56ZVZzG{vQLC>ImmQ5DDaMLx%4og5g~9CpP>*BS2+t z9iQLFn>S@cBHv=XE%$|WfMx_25Yr5Y0{R@S0(Rr?dnz#;`Yc)ndeOY5Fj$ZqrrfXl z$lbgEi>^rzn&Ov$orBH&dtB0u7g86&{yVug+2?ZjkS{2}<8Lll+qciQ!N=%Q_SA_S@x&m?6g^A#UZ<}fDGih9<%`j>G0lfUFY>krYYZB`fWJy5w zjIA+noBXc*@5zAH)clwOGqkSl!8Gm*J}ZUN4{rj&NbvVm{*Kn^DWUuSfEBd&rZuPA zp_?7+}&F_icNeG+xBThMSB=%t*4veJ!;=d+f;yQZmz< zZ|WRG*g*6iuO#K&&wX3`Z0Cghhg%V0ZM__a?^p=}>vz@;Nl+VY6C{+kH?m=JI1!Nb z35h#>)B!Z<0!_pUjr-3AM$0W#>uinOYG>T|m!u!Bl}gN2qC==rHC)!i^VDEs(l_TP zMz%(PkXpJ5<{q!{u3LU#+u}trXgf(YU?BtL`^JI+T9ww|<%?un4?P_Qq8&jOrI;S= zRvC>3TBE4)dw9puQp@1IJ5I&6kraZQdOu$QD%jBhMY4FHop@8frWU(vgG0@3?`Es9 zw)x=Ag00|p=?}Mr6u8p~=cl-<&@lfi(jbAn+{N>}`Vjf}#WOU=?E{pOefBdHV|meB z0dl|+^}P*+R-Xa%JnY;;kb&@406R4^@YVOji1i;v0IXOEl4q9%6D9rbNgOPl%YK|2 z_krWFnEHm-<`S!@>(U2HH6-BS4D+9jh0N12u&qx{enK%rLwpTbQv}qNaFGPs%XeCw z4{_KG7SI*Z)h;j^ejApm6{Ml;dm65{mzhiLfYNJ(mVpn9M#xijwA@x2JZ;I*(@sE7 zo6qfb__XriY2mW3%Auzctb zgfbrHsAs1GU4-?~TyFW@O`IN3(z?f&F%MDqPeK};1-*{Ohid|?HE+9z78jwhAV6!v zzU}&N`^)V=3>ISUvKX{Mq!=o}S6^D!;y{Bd36xKL9wu2Q2U!|mBqRM1@rR4&9wV?w zR~i*r!8QC}K+fikQ91?q=!G1(I314zlD?IPOy_^uKVK1_sI3m;r(eL3M`6eruS2Ut z3_7uYd`AII;{midF-2*!M_c&DkQ~_1UU(hWA0GT+QlI7m=13`(;$cQPqzYg+tRsf!mg^krX38V zmzmxWF z=3g%wTGcX{P1`g$=zVf6|!5(_)7ndqsm#abR;=N+i)<5s~q~1Kd#3kU%c%-2({71OO z{2ZL3g?Cn|q1_Ig!Q)3;iCu^O_E&iWAPbSnjVm@$Y(}Pedu3T%hlUuEyeMjG?Sx(f z1I53c4k;Q(W5s}x0>tv8MJRJLf{_*cF$O+u~ zBdz1n#{Vy0eh%iLsRNq5e?L4NO$W4se@~1G7@{?jZez&eR6@}o%r@z7Y0SUB2uQG? z)A^8l9|+gaK(g-)*WIfRF~Nz*FZ4!?Kp23bo(E=AWEs1dx8B|1Lf~KAO03N zl)hH-7cJj}_9}D(9_oL-@!zBHziXif?2Xm5X48g36}{`=^cw->k2K#=ax#_WXhoJ< zsy6GIgVsWg7!KW=`XaSlma3WSI-=i0lR5C|N}QcZIoLAu=f))0{Oe!I%9pW+DP){A zH6{bxE8Xc2zto}%eL0833k;E5*Q+l?)_OR~*9hqZcn(fRB)7f_*l3>?$Z7dU!!VCs zcQ{@W?gttj8GS?*K+anlt%5WM9G*@-F&x^eRgzdA)F(T#)+mB6p=!gc|93k}*k~Fa z4LUdhSoIzX9W}Tta8uTg4X6ly2$S2c%GIY6XNqGLCQ=K23I>!uym4+0ej}^#`yaTG zagIZVg7&JCnpn-xf^qRj5!c0&(4P3M0$u>7cVEP@^r*<_Uvn}6p0bSbl;=%XVTJT4 zC|LI+GTQwjqYn0NUmvZ%0UE6~M9?vkZf#U^8Ef;G>h!xu0mH11Fwq3P04TGb6_hcS z1H_ciPo1=?B3*yRo09OzZ}cBV1=t_xTI_xfU;)Bv_Q(m|QGCxipj6DVTys7=blD(! zoP5R^-A-%NNA7eLBKk~sA`IqZmxjyaWc{|wh$|u2`jsM?sy41y1GOUOC5a~!9vcr@ z&0l7XZ1{aRvEv9cqR{*{bJul`9w%f{O6FwXx1-IblP;AthQlvyFYBVxjr0jSKtOI5 z>w;|OM(#7BMe7;0OHAIm4yPk2XkrGuYDe|;&roMIn+?yjimd^n)9H7~ra+=^W=kvS z+yGWRTlL|(N$WG-4|>qy0{DCtu#I+_?({%;jfNU9k`r6AE5EH*hLn3W38ZRCEsze*gOn>1iHF$k17UNV^0}y zms?z3a02}I;j70f?hm{Lul6NQQ-N%0U@E^YgRKwS2KrxTi%CaLu-U|kIMpZY;zP)` zA;l-KyU)mgbs=?4V;4Hty#`^=GlkzK=PW^G5alcPF(Np= zfw#14?%zOuJg7FfO|jXN^WM=E)>eMq@2w__4%2T7WsU$94l(tr7wFt$ z7gHVG!td@WP}0SK&cNv9xs%>)A6hdM0vy-fJKLr%#8C)lJdDuO%-3eEut&$-2v~3J zd!HO$YUUx19j)_E~kPD^bgFVZL3~Iju2kbEqRVi8mhJt*hC5mAmgrfxkb7n*e zeFzV1TbvOv@03&wQf&f!VI)BJKM6bRcSc}pTvy>TZz)FJMFnnI#kQ4riCG2nU3lzr z#(wF>LWKnERqIZ$R*QtfwjSFeG%mYgWS0|!D=;} z^> z@E@J%!rn7kWX}#e(POJJVX}eZfj)OMx9P=}b}M_M$};ARDVLH3Dr5QlVy_>3U{h^r z%m|hzKF?WkR+OYBykC?Mk(0PK+Go0!6Mx_&BocGI# zK&$|jGWOI1GzV!ti0CT$@!(wi>K8l0b#D}hR%VcIrgDN9vwi*cp1yG!25TwFQQ4mH zOFAHZ3pN!*17*LGh?t7$q*e|;{6G_K&TC9wl}Tl#S_^b23Pt&a2UBs6^e|Po&u8#s z&={e8Hg2(@C+{THhqpRFN)!g4XiQh#;Vo`bw-zyqVnv#Qmip*b^A0Mq;?0(1{Be(M z9P6^G&!x_&aCgSraswKE2fVSuhGTnl;?I0p6C0zd=v^Oe3Q3QpBAHi0ov>WP^^2=p zpi6U>UM+i9D*xL0yV#rUiW>dh$bGxp+OX(b?A?NS^i%6EllE4s323*mI}*PmMrjZ+ zlBe8-V!5B@;AcNN@zLKrlotMP3|1D-Edhmtkx98f7*q^;te!gTv}q7jH4UG$@^Rzw zu|1aknTD}cdtorPlBSW74J_#J&UQ7-`aWk`A4nNrvBID1!+rC#n-I4+#V`X@;(Xr9 zu3f%BWeIw_T4RX@!cXt}zny!qMPY{f+{`ZdOcc?Le0D#WD#@pf zZ4G3)`CxvgF>qZ$vI=sYvujBo=Z{(QAHxk~NSk0%&b``BQ7!m4*sh=GK%cUaQ23H1Ej@@M1QCQpG2#S7QP_ z;9Q2~l*-zC=Df&&u&VE^r19(VIYn?C{%DdpHx2B5(KKsD^^R}<9i)p~=RpCCb3w1a zXAnJwTeTa;5QjgBryTo%D!WA9AP=QdR` zedlD6(QZRAe;zl~8hB#&2C_0c&dS1INhIjhm1_Es`qyr5^RS;c{ph14(4$rCFlWQ~ z{JNla7|TO;yZc4G$v&p+w2rVu9SyyTyY9d2sX^x;wHbSXYK8)?oSf$J`#-lb&eQgM zQ*UH~Ptk`)e`T>ii5JP9U$Xk+jlmxhccN9ImxFgs!ZhP@KKr0n-fQM#Eq)DD4c)Qq z{hadQmgaC;xlHrD0#Z@eh%M0~Qlv=i)2RS++Oe~w*dC%ysls=V@=%GYqFCq~?*yy^GeT za8<4x3zjo%F>m`g5t!8lcr|PX-F{l=4rCfV8NQh+9#6+Vm3Io>#pC;fKVs|#w**E; ztmwH=m+1xNT1lzHsM)iwE9?uy#8`P>_=K^I$9I4M%&rf|n z<4r$L8PjfrX1BQMZN|juuE- z{qY~Km8$Vire5wWrEQ6(Q)<$m$4%|#^%bGsA+d1+mBB*n$eI;jJo-IV^6yMyHaMqc zswO}Q$0H#^ayq4>a~ea4lnl39Sq?%!bN_L^&Dk2gIEnR24;<2?-BlRKY!M57l3x>f zw(Z(Fuj9)NTBr?8$a%RVPk$8GzR$%903DW3(kLl+Uyh)IH%Kv^g>`n8CoZ`K)sqat z^El&$&Tb9qj67=LFv80$H+Nh%eYLdisWUZsjfJ*w;P&oI;(h|Y3J}C7WW;BGwtRM? z=Kjfb1u6;}T=5HOMU9uIsBnGgo7Mdjll9ka{}eJCcPr<;h4V9dx4}V%q!}nMz3nPy z33I+Su1_&iQhHViKkg8t<2;&6IAKW{0O3|Y<5b<)_Q&j7s=75w&g(Fia3pIEW|e7X z>fK>{bLz~Fl14b!>Q%>VLC|CI{=h8GhTlmgx7C@ApKJ+)`BW?R{xuixT`yIYgV&t% za9$NfX+~LOJOWFt5XYmYkq+w;mTNKhd^VN82EwNbOvDt+(>UwFwn)Vp75^aa?@p)aAOsQD)|{mx^KU<10p< zXZv-#*>1t+c~kLgZfvf z56un=fA2x`uq3Y(si1rb$xB&=RCrCb)?2PlftIBa=WcP!aZN!>fp4Q2!N5_#13tV- zKu9k08qIe2jU*3o*usU4PmLJGMD7~*mEQ_d`oqhu@c4VDCe7jW0iJ3Mti||s_Ul`! zw~#<4eBhKA)QmkP8&NYS8^@pB0o#$WYh)4EhIgO<%_APQknCGBK)3tV5RUB=*V?}$ zv0COeFaemJ@_Q~E!+z81>o z#wbcNTr;q5$MmbOk;>gMzmGDWUWnRhpp#|Ug z$n=iO4WACA0=*K^n!f_XKvP8kG4wTAJg`Cdn;Bl4{PwDbX7P33oMTJZ4+5S}*T-5l zD&_&5YK|E_HzBRk-3Q2I9p(%TuS?ef{ajhJV)+6VDW1vyX5d}zu1ii$&T(K`x)Z7r z#XMBOwa*uW@>AYeVe687Swmn&R3}~;p3z_T$vOLL3!pGZnvP=m%)3X#2b{YsA8D2= z@+{`csk6r?+!=T1ugZ${Rvx~BUb`U5b$e*f3Mr?9ri=%@>Ar5S<_uGhI@ubaQh`C* z?04uyw+fx;x}Nl0K3WFP*e_1B>-(^M);Iw&1CGm_{MHkfH&EM!wZ_{m4xxYpw`Ia7 z=*IbYXKK;9?hQuvpiR?l{ zdT^7)J9pFjXtpr-Y>JTu@jpcEq){sAltnN*$qw!HJ(t&~iLFC!{<*%7Wx2>tO3qWFm$kotw^_(cxUny@d$@`g)RC;I>n!$G0)-5J9o3Kj*(-i1 zEVSqT)8dez{n!a35|CZdxt7@@e!!D_?&3EBJp75mQ?O9`0IC>0@kqt?JqPg`b6Y{ zr{HfdcUk^f?K4u_SNrE6dqH(sjsiemb{ep0bxyFJn?(+0U@zReQ+$zy13~!FKTUw0O9IKYu6LV&I8dqHX5#ldf8Y$pahZ`=-wIE@5E`J zY4pM=EMcT1R@kvA@X091MlJOzWW7~0lV8yjz8{dxh`dVEHb0?VP;SLCvf9a>t<+QI zwR(K49zZ4TwEv`x=rhwUUsd`PBkXj_WBJ>hou5{zicSCm)}-NC8e(mj3D9^d9A62H zy5`$9s0Oxp>eFN#iPN8{gY$g?$0Qdnds-^B;I1)_rD1&ZJ(cm2r~~1kzyvG0?Ve+W z!6Rey->#~}u6~nF+1G)$^^13k)NjOXg(?p_172#r?|jR2Hr3=2HPWlOP72rvI*}pg z^ILp*w@?gsZHBLm*vD%6Sq|&%PerPBa(HC06bMZ9qEihI~~$yN?g_pjT!uO1QW`aKAm*61`g`_HeHcy`dUhULF=R)_st z`%43V^#UMX>On;4zd&I#ivIj%rGK4&v8Gv0o~&22PeY^a zKYJ%-47nB~-4~UZWn_R{+U-6i_cWLu4mO$^aPH%5AF36An)QcpfaXY_Q!?(3d@ku| zxyMvKfWT{xf?3sFY>z3WfQ_)leMGr^X{5J@W2`CNLHIYx{2~pDRy8JgBnyX? z4SPx?Gi+g7H&sJ~=Gj8AWto+_qlSETP06a*TViI>5gKTm20Oi5Slm=W82lm2ZBLpf{6`NY9Z*Au&$mhN%#(YdqRc)1ZpQK zk6y9_f>uP1VhnGcSs-ctg;)kXv@?=hz=eGg96}i*5->w{EG9`7IiaC@K6)Snb5Kc| zbf2sB&&0Js>(U%GX_mZS&>7m*uPR8989`U{cw}aiSp-=#<;(W#H#S2IDg^yT!1+PN zK5TE=^3f6nE*gI_fmoklx>{GGszfDjdj zlyZj!3kDYOWuD$?9Vl)ZdRxPXg+vdb~31|066P7AIlB?Er9gZwBy z_|HYRzb1J2n`N3Z(hlZM6BS>be1hadzXthm~7w?8#ZGO*^kt^d+v4aw&B` zdMYk$W`IizU8}|XgI;C1-03$AdmmCYUcLE{0LAr?c88eMkKeeYJsE}^ZZ%?xE=6WX zrL1uQhK^a3R6S`F=2t>E<`^^X1P6J_qbRYO}R1rEC;OP>0?A-KT zD?xnm;H1+U#WD^9jrcY@PMO|3zQrMQy`rPbNFPFZ?U?B&_54SgfXRY0mKRZi56x># zECIwTAU9_UBAN`V3^^tz#QCCuYe;1GruMnn)il!Cd?~s~PtKsfmh)7D%DiIwT|0|A5IGhk2C3^p6*UcN zx9bM@FY7B~+^|qW@wXYxzp5sNpnSZu^|RL<+I@T=f7+dJ_uSz|JMMS!Ih7#i-<&BW zluUp^I{a+d2UnNO)lZLAv%fYLFBa4l`wSV#$MROGXFpP=E6^Ts>B?x=GFb@OLF7PG z?A$81W4Lbut-KG3b8)Wr07IM!%jY!Q3fAXkSNncmHEkgc;h6D(=#^QVK3no$2A+vx zUXys2E+Px>@ygsd=F#<90c5`~tz7iR6K$$&Mt`lJQ>p3FE?=jr*)+h1+7EY^CWmRT zao6DK!j*K(VSq9|!?`smeJ!dCNIx*qC8x342}Nr<&2dNFlnaw@yTUdzh5EKs?5pe& zT8}ETN(b7EQO_Hj!OV*S2TpH0%dd|6|SM3ps;Jv*=8eE z#M7Y<0sDUXW1>zmfWcnkO3U=g2TVeI^``pxUeh0t{JIkDfXjRNMR;=b4gkjj#BgV2 zMg`t?{>#hlxNxV1AmL!sA`jBlYY&326yBR8<5T7{=Pt$?)H@DneiE>JBDWr3fpqGu z-in{ewa*NqX(tcd3^!?wY-{z~FM};EkJcGpW>RDbI5!iW+2MoAge_XN1OJqv@XfKf zMV(=`k~_E5cH>|}MP(OMsq7LHcZPN|=E^;BK#**^errKJ3Mftl#HDqq0_|-0gjBPB zW5D_ETG-?+%$^5*xS7g8$y`^F!-i|$zDBvuLxTSAl2Kw*mma59dAiNm8k|(@f;^$Z zAhNb>7_l0Bk48W0T2o9>nKhUF}%#I zY!V~UVSSr{FCEF+zvs9=*)eOL?5k?_aVH0r z->mH2oLBMvO?;tV?2m0xNsrNMqF7M)utQ=+01eBo*T(FSnhD68Y)|)@jkK(G+T#E> z$WpS4uZ0&1?PMP6^xKDJK@Lu&coW(xXFwZLlk;KK4!}D}z5?EW1rEL`m0)uk1?3IZ ztrs4aVh-!%>rK-GGevD-!=cs;4&Pp1=N2P;AU(Yz#C;Dx>SJxd$2}Vy+i(vq=5;Xb z;5b$*V?SD%&!iI5QE#$uypil^Kga>%@-LCm#ou4kcMI9yf`S~MIp!TVHS9wuK~7cP z)$XgWoTDAZYV&6_yXm`!YuMO}GKN2`EHujdr4c~1km5psfn#T1A?|BNd%3u&(%tms zozd5H`0*%N1KX{T_8Y}co3m?KD#%D#mUQ;DN0)?+4d_&oB)S7hX-wu*mbI;4=I_pF z@2cwj5s=Q(Q*DxjDQdn*O9zncje%+lgkCJgl4LTkzqI29O6QLpk8^N&s5s`TM&>a1 znuHkW%Ver}SF^Ep9_c;%Ztsry+iPOZO@TpE%YY(cIQ`ytr%swt_$Dl-fXAqV28T(j zOIL~)Q3s#2{eyakMG^KC{%7B(r*))l26j88bDJG9`8AKk z`c*la!2xB_sOh?|PR+!2nOvq&r-X8>zEeMGd@73DeB2LHIS}}9OX*F9(e!5z*sKc0 z{^rtNOxZ8%ZeLNqB&(m5%gvyQ^d76urdb+JDq&qSmlEhobANuAiO;8hHHvjepKstr z!N(o}xosPkN7@{KP5<#(%8r}e;^>CJm&To!-%z76`HTnpC2kk5<{6|hrkygjHSp*P zal1cO(2~EgNyz`ARItAaBQ<_J7UBiCl}zGDuL+!4SYKJ3^3>yz_#@EQ=5ufyrg$B3 zcDW-uzV&*OZv(9zsn&=IMW2Et zuPlF#uCqfavK>5^r#)+ROJpHx&2^=MpWsD#XKMHq-wH*2yk)aCHqvSS*W!8z$ha2M zzvm}>&QMN7h4@{!7B(H#qn$+VjBZ5iUv-4K$U$KE-?pAJm<*@GdR$h7)#D`fF&b4V z`cF36J!5SRUR(f$hkCsMsnp8s&lVO24WdC@j{&7p{ly`xR}u6?l~Z_}#VcwoM4PgK z;*Tba-_%a@ybw{*ajq|X;I3r;uaQ75bZ5Iac6LM5zTU#1Yc4brp?Nuv|M(DCl%KfM zwwUWQ)8~VqiUXpT;`jz7!zR&YsPuvf4@3e(=ALJ$`OqXyY1&(WadW@2IJ5d2!Fd<0$&f;LJ z@;RX1T@+Pa=>L3qx)7H)$eHml#e2KnRWc+0kJ)e7_|ZZhn-@4c>bfo5i6)euX#Qsoq@VqsW= z#*XzkvJ9D`uPIBLmxHAGO(L?o+6nFyj&# zvJ{wT`GVG)!d2QMMy=Yy86);5tRBP!j&$+3&zP&WtIJp(%a$9OXv{F%dZ*e+V&XYJ z;j}Bdq~g_$KG}ZyDE4xP#JrCmiFyB9z)5oPm!E(5mls@00v5kA5!LC^S*97zxNJ~^ zDm-9D2C}T=7;Yl>hold3eeyz3%wIN7dbUgx0C9VM2Y6^+&yUF z5Ndp)e&o-c19qu|a&O}DdAA);6q} zn2`O<1Fe26Kn!$ZF@a7jYq)ivwDhM=Gd8)rtln8B@{ecBI%0VPb=G;7)`NPhlvmMx z>SO`e4E1$X8#&3spatU87^sw_MbJ7BJCKJS2xASJ4K1_ z`!Q+ZFt-IfLOCxd-&CQDoQ8``pxeopR*P8L1p+ck>uSA8=?7=4UpCC|u{c8Vfsj3d z#N4@WJ`jZ(`Tm3&@Q#JS4vPvGfASo6GwK7HXdU|;2go3KK)RBrjGFzv8Q{_)4X+ki z$FDsyisB-~2zDN5N#b^N-lP#CWM*fbOg`&;`7{7A?Fe|Ki!BL`7inmikrst}2}TP= zGwYaMTz9W%m!ilK;ElfM2ILpJdO`mGeOokXU68sW;DFi?sU^1QqX%;?kj3)bponhH ztI6Tb$JF!@gf43I)&# z#`-iQkyB)S^BwLVe619#7jh{;>G3ig&@Hp73^VtxsAp&JZOoDG`1B>4?R=+p_4rn6 zHqzE%Cfs`6Y_&vE&^Gvv&ATp_q(G%hKK26)wS{bg^{X_s@2_nIh&_#o?w@2X8OfAK zVrUFx0ey*q_4@^kw&$Ih6t6g(W3mysTS`PtRhH2npVC524iOY2h}FJnpLI%~x-Ji&NLLPTdI9frX1dUo??o3r~W zR7;hexbb!b{t!MBtPFav0#0$(RoB|GOYciIp|CD|?a4rlqgld!u$I|OCB88gwkh14 zZs}yQS}&bqFlpVA3i}S)qVmrlJh#bWF96dvTgQLbJzx8eA)j&1v`m;yz-P~%C>QRJ z+li+i29*~Kx1AC%4Wo}E8aiw90CG!&y90t6wPgz~~9M_MM~?$#ZR z+b&AX4?xq+^Nq^~U+(W@08*cP!Zt0h&RMDss^vmUz>njqC_&RZHgHw{og(&Sxdu5} zZ9%*Q`+j9jt$!(uV*5G%C8p1G6A{;TCGX1H`RCYc6MMmj6ir|eJ+gSTiq~U|?;2R~ zksBs{bjI-Lr>Z92*L-gIyrz$Xl#2IHGD2cVmrF!|Qj)j*fJdOVs&el8(Q-@E5%H?7 zzEuKhRuZtPA_H?0#!Fp-LU^1wQVZqr=BPVzNQ!E=NV;m0^uW6yO)l8J8j$afLgJZh zP(1Wcw=dB06vkU)GUvg~?3t%?52{H0`!9;=fL?zyU<+=FM17as^{|3vMT+5v9e$)LQ(XL(F^S=<+%~jyNPS|USg={%Ql*5oh^f*F6 z4$i3f@m5L)4`@(<2p8XI}%5X6Rn4T|p7dELuQ5lf4 zu+0Z1TsVR`76RtERGMSBbN!&mG&J&hmU;|zWVX$eS!xdX9fI9j5T5-o)l(aX&JV1RN*VMcUOf<++ZL- zk#3V6w8X1dt(Qn=b!kKx2rzl!>V^F1#ktrNe<7xNqg-<1eGFE{S!)aB50o1Npng-( z_ha(w1=luBUQ?{?{kLSa6>S+XEgRfBk?UVr ziSzK!XVmeTPMMxr0a+xRhmHm>T773}v<~wbc}vh8b*zip9JHOebuEl$;0qrSsBj*a zGz1@%8Fp1-c{Hp=%+u^Fe` zWd9U=0CDsoTIwry@j9(DB$j0z6Pmk;p-Unvx8pY@bZoOR7#N&;j2P^U;nTOelUmps z%T1$*OQ?6*h?((a2qH>Y7p|=Q1a_;Zx-holkp1cgXlvXT^c6FEd7cmBkV*5{z7og- z#2Ve7lx8U%=-$BkG^~(Cf8(If!VCe4)R<=v&P|k=AjU4N{my9mLNq&auO2{-4JmR#87Z+|GBFGbds4%34^X%(< zixQ{okt%qlyJUFC25s}zK}di^+^9K=*oOkfWw z{+1@c_(o9*f2G&QbUTjuQ+|BL7w6W@oanY#pP)8b*X-`SI@WuUtk_?QK^AY0gtEhX z7=9=5e_jGlPfvX&4sr_aY5?LEUp@Z+&bl=T$`NN*)-v$`S_0ku9&e8`q=kHxiuoH2 zam?QxJm|aA&UA-R*fQ{jdchmNn@j%V+y9?1(f@MYS_o%s`qb{QDEAT+<+wvm*#4JW zL%+sw2ZAU%>ERAF%mK#mE$QFokiV-Y;HUo~fBGM8vj5>G`(NNDTRCag8F!OSH9cIX z%*tJ{)VFbU9h*Fs{>`bA`EjZYoniCaqa?uLS%V}8n1D~A97Kq`;65;&JcmRAAeDQ~ ze{GueVVHr>eV1Em2u0O2SpnQcS(HgjIOB7X#o45UyAG-fFJW(WH%nJS9R_oV2(0bjKSO#O+@|!rq+-Nid^1ScP-9? z^XTMtVDeTg9kq^3*AHnxmH6%o7gL5p^ar4E-&TzoZ1?{oPJsmZS1-Wn2a@rU_AyX- zLn3Yt-kl&}jL5Ue(ZxE1jUnyO_QeD0f@R+O!t$Wj)jagTITab8)Lrg=PcvVSv&38p zjxwWjJUVqj=I6gd*iODy$}{wO;JLMAM)00()5zA(Oj??#lY{u4tcLPE;NS9eE0_Qp zaLw!rrki}s!O)rNOxbahQl zd4PBQjq{LU&@NlnR;O&50Gu>J#D6q`hlaGS%s)k}1@eqc*0wHncz@GD5OeNbUF zU}cF$BobrGv*LxV%QshtOAYOzm@RP4yUT zG7_H+Gkm`cFLqlsXpOiTw7H+2*`Ke`Cp;_cgl!#OW%)=Lwa?9Fm(+SJv5an?C=rEZ zX)~?!Hf|Zze(XpVZTIMOoA5C-I}p{9_2Ij(!*73eVRvyigx6ZqX8xjfy>|wOZvB1G z>TQ`@xmkruv)O5L+}*Uq3Y@*t!rdOj@%(^sPVry9+W!gQFTAoC^MMxHl5}8={K)=Y zQQ1C2LItsrX&{u68I#H8ZxMR5!*EEhTqw zSi=mn_X~i2&T^#KC7wgCaySrn6S)lkCYL_tspX4eumzQnGR`zj{AEaJH~B>kvF{rwM(BTwfjU%EcY3* z5I2KuZ)R!eTMy>LL8*866E;(xBJp16DRXcti}IXHh-6MKKXnf;?^!W@n%8>!T5I&} zO!Wc-4Z+WtTU1;IrAALIjMQBDns>Jr+6Hp9OczR#N{`?VHS?Z;&KI+2W*A()X1gF5 zAkfNu?{y`L+LLX}baA%BIZL}3L8)bNk#=EJ!#h9DHgo>W@(Ow*`iBaZ4ucT{P1fHAXE+ zM!gqXYCkksy|>ZL;j#Lv3pJZYK3f;MI+~2G_kp!(eYVQ6E*@R@5Q|97oc5xR`;_VL zE#z97r#M<>T`|sQB)9hL!R&hUZB>K~bM~Y9guUH%rc8W$L8;L3Zdo<)vI+I=rIKhR zouU%Qog2E>XYcBiT5&E8+J*ylmWRDJ0um{;ZwC4?<|&;~t5Q&^a^8vDtFVgAvqDMV zwk<`qUUDVTn<>F|jqCtQith%ngM3CWH?me{HJnr&0+wioYi8Re0^Os8F<~v48 zTsg>E2lKS2uH`C}#W^nY;~q64>}5m4V>syoxI%jt#(HmNWM>zn6h5JA@CptT9VV>_ zBS~s$n&N8Wu2PzLde6R=E&&a-mCxum1+r~ghGCJ%iG<;c7QH{1*R6ttY%iuqE3Je~ zor%{$4lBrd3-@aAf@cF8Zv^Ne&QegZLWf!& z5LC07<igXToX$@Q{MAu z8LF@-|7q?SHTtp@YCNiR3Sm1qYa*1E5a>-YiAl{-u~ZQgYz z-x{a=D>Rs-26m$RE-yqFd@&E$kJPR8JHkh9;VaX{@g${tryVE-l@7cDy@#`NZMP7d zn9ZJ_a?)X99_zz{9$xt6sO2%YwvvqGq5(nATGWbwcC}4a2+{S!jt5)KYUGM#Iw#JV zoK@V}z+w8E070URmvG1Syr2!r$wh^QtfaIqq1=_QlewCq*-7Ji4ej<&cMvBbOVcr* zG5~8rWu^I#Fcr>WNm!shSS5OMMkt*=#w{1imH?wS~fhLNG zHqtc%gk>^&dwc0IBaI6U{;#Ia#yjg>KbYLtM~FXF6z=+azBp1TD|>ed^tCP5xBvVhwxyNgg>(J3423KJZ!<Ejdou z1>3W~rh%cDqP+Z8x3CKO4~Fi>5T5IjJlg{6Fk{bySqy+wLnO3W%tvNC>Ee zz)P1jiU>n0sibswx2S+c$IytBL&wmmNH;^b)R03nz%X$3h;M!0`#bBLwaz;0{Biul zHOjD`z3*r5d*69o=65~!P{k<`!ukK$3r zC^q3&tNJfHtpEh|G<8Kqc#1bA+WE&o@Y$Gz!jFBTx8v9pPKDw*mBDixVRu1O}J;h<)w>7xsx>{H8;HCtGaQ^?`;Evk97d-$zzf;bJ{@LS6pxtnu;ru9kP!l=fw9Aaq2uFSZu2k%c-F%gn6gyX-9ko|VeoIzzzTRGK;<{g!Q&71B(;yW*MQ0k)UkdE$eic^!c2YpE zkRXHe2?UEwBj#EoaG;a(U5R4=1C|X3fx9Yh_XKqy7TV!23rT(7cxNEs!)b@%sdyy5 zUv} zAi0SJ2+?OD$zl^^dWSenFW(=^Fx|Ssxi%Sp1exU4!@uqD&p047-e>q3IC(t+R0%4N zh>+kybyBe~ z+KW2eweVaWMP!`ZeOELGZMy!!!%Ch2=k)z?*8ExkZq$2i+q?kWgx`S)M;16fJ^k?= zdAgGg9f!p&(U1^Y@jRK4)mEdu;K*v6o+{=FIWF-l^Zej!aTw4 z`@3LnNtfm>#4TT!XK?ntKV4L0?)1)4xx|f~S$BMU4K=lh7H2y}CV%*uwW6DT>K8t>8n$M-?q=2T@_|YaA;x$XHpbqZ^lbkn zucfv|U%J9dp`|c^ko#6-&a*1WXl+mbtRWBG-!;x7fX$`yoyzeipGO;Rd@sTn@J?{+ zp&@Ir(i~5$JE*@qTS3LU)YvpXa(k__Ru&jGdo3krFU`!(-c`x$4j&SR@9qy@JVinM z^~+aqs8^d!+PLiQTL-Y&@9E(&;=_eX(PK@om1$5q4+&E*RWZ3z=NmkN*D7PzaGW~DhZeu zaw&Ll8u}X!zteB@aq?V@6eTfKp#Swko9ql)@u6N(416Vb*NU{H3(ZtojBc! zBw^e&L$6w$zETBN2xtUtw#Knv)+xoZ+ty5W{qM=_f^~Ps4rI1{*_F6W(y>w25ZxLj z?BkcWb|H>3{(VN)EV`Xv0PTBNIIM5}tgOy~NR7QGpvx&r? zM+GN8Hz2>a0t-YycoLB~9d&S(^VeY#Vch8YILqyWO~2gih_6`dLkhaUBdPrm5d;bz zg}1RM+n<lE{%?Vmn*NMRDOTwFC5*23VLwO$8;`h?g0_b^P>Om(=OR-g5dS^Xo-l zQVFTx^PwcWpX-qsYNQY=VIgnl8^WmZ+Lg^q%fh6Rb$4aJWn~nVz-zgu9mYG7*6NsK z+l}nn75p1qJJ^M|{qH0B_@^{+sHkwgJB+6%L?Y&#tWU9YX|i+vL&(|8RoKh}dS%Dks^ z&BI|HKf*=4(;OVRe(6!E>Hb}e@{h3^hc={7ns&E+*hAP+x>oerz8r9|#PfHO>0!S4 zf8aJfHUJk(%3NFM*1P5({y)$DufHzu;zU$O(1Cm0TRYsH#kBBCe>{3uU;7~=eIn%i z{IJ@TOpQP-@nYpKFZ?+5JjeDDi<~j+%qqFj*V@BwcjN=a(9<3D^Kf3S z0jAUEArDR}Fk^6$16BGa>cOwKaRU!(D;`>^65MulRxC^?*$RS9w@o4oXE*nPJt<58 z@f5-Sm1GdAAI#C=K+iIU3zb;PX7ocOy-Aq<_KcSjJ0Q^b{@C*SMKG|R9oT99@u9zr z(6@VdDz4g5d5(&05QHuVcL__r0a|lRED` zxBiD!wu*Gxd;C36X>%?G-sP>=mRZj7j&}d;R85t`6gr7sK2qi?J%o`^B`vCB#8EaV z+#Tn(gq{7W_QzF<+ud}1IN1fo5#w&ar?@Dq^PV=SbNKsrer=dx+$A-p5re_mZy#|M z_dkr3za;l466~f&t=u@Ak;_527u9RPiMxhQ2m1Tq2C?9)ziU0Q`AJd(OxN#@{~`DJ zf5NUk)$6}BKTg7rfYB=z`THzRoAu%>d`dO~m48R9j|N|DEIK#uf?I|LcuOMxf$`|_ zQ`{?LXfMY-fER~w{P@FH)qh+3<+sM*tA$n%Dt=N4MFEj^|LMg1bFTk0k$z*gTUd3c z;9b>1-m{s>0s)d4oFA}KD$3Utp?IgV zMj&ZN%nb)4`SPVJ&ev`ha)bh3a2^Oi_xLwE4EO=S&z7yf!tcFvY#9!UjyJcrBUDVg zMmP?LZ?v$k=~~>#MnU7>QQ(o%ibb;55XeQz8mB$1=nEIqv4DO>?!<1-cZ?8keHC6y z5V$c>`=k!#D0u@kmVtr|=*1;OWyx>S!HJR9!h13i1bm`5_M0LLmL^5@4!#W0Eln;d zv?j7vY3cqDWUlmA(EE6kDLsju#o1ErQnz(0K)5rWNn_?-ZujZktGSX#HFw&sRfr>4 z9OU2<$I%FHDzWy8?FwG9rYNZU@<)Ha(ya>g$`V_;f96ln5Z@=gBTB|mz+NBreyT8aPH|fx%(pA=%z`)=wcqI$$XcuR4Xi1>1X6kig3gCI zX^M%;7OJ^sSx#*uau&mmJ^L0_0?jD{_BDr>A{a?5pVMkIPhtZ*9E9N~bLS`rv)PN0 zY*E0khvX$FwaT%@KZ~F6Bpo%KuwO*Bw4``zi%CB4bpvjBEI^I2nyS#SnW|+~GVY`g zS{?}f?7w|d7v>(28JE=w2y2BWG;&9-eF>Tb+2PL7j)+9hy$`iW)+i1(5EL%UCmepv zLC;$AscQB*`@y3Vu`YW;`Xs{9*oM>QBS@vjpD`RZ4VIvz4q5wl_i8~M+Vo> zkIj-3ZP+gSq)Grck0P)+?C`c6aJL*I&^e87)C^7m{4bO6bg8o@kJ@-c3pB;@gK)vpMdovRYvDj)UR-=-GB6JiqZuF&0bApI-smMv)r*Bu>=Gwv( zbgf2u0-kD`r|a#oKdV*_*jZn=sK>kCGi1rvp|I`0`6@q z3Db_8FLvu$UCfkG?KR(;31a@2niVFggf)Y$pK5ii76FpuQ2vqaYq<49zt20L)wx54IWwU^3o*6 z(S3bQ1F)}(n4n10;tz@g?oSBUnb&y@atwOLNn|!l+m48z7o|q)(fQiIG_v3G^-a$& z^U*F%)TCm!7wyH{b&4}`;{-w@nZw(gI)#mc4~lfL4o2O}7Y}*y%_fQpb2)`vX5jLi z=nQAX&8N=r-$%(9dgCwI>Hk2jB1wAy=7vtZV}1Z+=Ek?PYtA(wrhH==x=cA-gK28tJLn6QJ{zRRc)}*t z8E5w8iny*9+566jVkCPDXah9r7IfQx_NCjVXT_i2R#fk7qBB*gtl{=iG|$&;0wXl) zkbnpvk&j3E>3xh2XMB;PQd~444H;Va7^~-uu;3^!Sjr=G05_yQ9*ml?TGRmT*Jqml zsP~n_*vDSiX$@uNvHVyrXYb6|CsMCVb#-XY`K9VpPK60_0T z;eM}Py=RPAp-y!@v-%(Ry}Z|jvx{EgE%U)OAJmn*P>;T1O(vX*0~PZcfvf_eN@vfL zxKRhHd#;Z8eh-lLFnbFHywy}PYa^~L>R%V36QI?yXmUls8gxKY0-E`q)Nka8Xe5`m8p?} zTzjnab#?KW>EH7Rg@vm7`sT+Ud!vg9Nf5)+ef9};b`SzDu{HvIO4;%%TO~W|9Y!p_ zLO}eDP{_#;-quVyYoG0g%+d*jNo#4gtC-4Z3)P`@_Err!Nh@_=L+_QAPOb89s$A9) zwI)nrKUJDJpB8gAp|Dmd);=XXdN%5$Y03N(7MnbnMioB_kP3YV;b#cYA zp)wSJ1y6oRsX<<%6}@fPbYhUT?m^%|>W#*(Gs?&tO45-CJ6YErelFwb5w-b7gYDRF zdvoWVLisFe^t=u&NhDtjNL++rqkIOPmbrS=cg&m-bs6Cn*(2vyRJJQ-IF*Z)hHdo|2V5j<{M{_&7{i}^%$ezSy)Ks zTV}nmL%gynu2_0o;TwL)=z-v++~0bmjWzk~cJ`U6mdzGb(w>MhtJ39TtL`S)H^K(k zM)6Qb{_PGU@Fj$uf>v9J#bAAUE!dWuM~&@84RB1K1(h|)7rk;*ndGhjHjf$juhO8wi_bE5pbEAc%J zG*w8p@?np9=~}OZn>9jQ5C+}$X2j)RGvXi()FcAY`I@E+m4oUe=1+Q3yPv3-_cwV| z3hh)p&EGPXB{(c8weFXtCutZbp?*aif6Q${=_VBXX|`f}l_0T7c-!UrBB=3jvJQ_K z^uyWmi&r&ot5+HozG%q!v@V`I*_Wylzp%GX`Nkp!z{o!zd#F4{Gs&sn29*@!$|WKL z*~N-&-G0kAJ4p!B<@H!%dA_mKf@X7Dym0`~hi@^<&s#sbxINXZYP?kZWxyJh=iRg0 zYiEu`oz3V(6873XmE0y?@Xq+UglHrlljX#UAlkmaY!2mUj^mG(%B>P>J``Cgrrzjb zDMXldfhzJ_tgcP=2Me6y7b$U1cIH#J1L|^}#8piAb-b|nX{}y;1aM!H`i*cTDs*wU zOasDS|Cc{6;s@#`4yO}c!WltY*akATAeeQQT9SaApD$0Z!7EH_u8=j8Q|;;IN!e6r z=~iFOvrD(cY|tvq+g60d(sG7KXz8c{E1;Y4YwEFn2cKbFB;P%wG+KguX~qz&t}GvG zGrAocx;y~Y8dljMM&L7=Sqzq=3>^`o4%BE@^rYxW)p~(-Hqhd_S|$DS*dZNt0rSOT z`|V3rq`fMP`@KZ5u_x?BzNB))aAS(KblvEG;MSNa(FALP6 z`?2DKo=P- zRB~CKMnJR)@ykqAdK`5?2aB|kU}`QZ4DTvieR^2#kr?mvfDR(>t%`}0<^dXc+Ffd+y`a8|V_%ui zYF7@n7l>3qdcAumE+7AkRd3rnY=%EHwFrXb@tVUQ(|v-5Q;L;CYe=!rZHisPQPQbV zQo)|YmAa!@))P%HMi-+5tas$20 zKa^CC^>%=V(?em}mgCb;yE^e*YC4Ox^9NI1Y#ywC9l&tBFh->1TQq%}XjOYV&4#UmORp-<_yQ zGN_ZOUMrl-=+a}2A1`z;O_)Z>txF=abFn)Y@`7~h(OKDryf^!M+;^bZ1oTRmXG3DQ zqU+!r$J6WRLOzIqxt((t#RbdGf?%0J{T;4fIq30g7nFw6a#tRQU>bd%YE`Oo^|GXx zpLCGdo%eBBzm0vR*YJtRST6R47r+cRjrUgJrS9QK+a;b7B#v(7R?$afJ@?*jbWp6C z>ash*BvqEtkC>eKI6`c_0mvvHQkZG#3D!Ou+|z#@5F7>o;bbQ?)jHP6T9u2* zBh?vq*C$#_yAT{vyFDya-q^#Su{AHJ(tJzV1S zSKyJCDC$&oD-l@hR*vU@mrP8FXFOz4SXKpR=iCPkihPEJ56FjG3)#7AUc8U`I64O~ zB^sLNs@f{aJ0%=X&TS#N(0U`49o)B@uOo_9$q-peCn6r>-Jh+`Y4PQ9Fn?^$$Q3qD zB3!C;_CS0y zP4WAd0n4HJ{3SCO@=Z$co?jRn=p*yh!R1c8F+t=`qDd~NNzA5?FUwmmiohN+HA&nEG}pIx`I|S z49Qx}A}1kAG*dq>FI&B`gtI%6K#>w8SLlwxh_xDq*Z3yo^a5q>4ek~+{Q zw(8qz#OF0QZ$~f3huym6AqggU!P5AF+|~$rs@2WDFSIb^>J-eYNumpOBry-=OP zyfLzrgICyoB-%4Kj?YQmYMkdf{Yi%|Jpk9|evpzs$BE%K56u`*^|%lEN;7LZ1pKbs-nv+6$b?z*-U*q% zf>1_4GUemRTE}M8hYU|W^QyiK{-CHI@<&UF?*pu@cq?KA|RZQE@kC8wCN~)DX zQ^i~Cg$jEdrP(Xp=}gXNUE#Ni@LGr+Du9sYzKs(yOd^SKQW7Gmb_!u5xmQxuYX8P$ z9(DhL?PK)VVJm(aQwPshN<~r^8ysz6XM3L{2O3i|1+Uy`a2>0{PF`3m=IIx>|0~Bb zeFoIYkkWDEYJx6L;PS^9A};aMI}+@>BfOMz-e>YZ>8sEpf^(i?<4VJW?i!t$P+~SC z{(dGoB%CFxO?H=M{s-}$Pbmh-q_gQ&uu24f_$hM|7!rfKc26iB1Hs0934*hi|4dL6 z>eWvaEWt+%<+L_(pO;Ay#EHI!e+#?Q%^@|mX?lP|8&H#Pr;EH<|a5rWi{F&=8sCx-cJBlrJ zZM!cP`@+fgrZjQwa6VbBaQ~n`F*GN-7|Ai}=MX1a1ouxZjh%DTp2o#K3r1G56GxCA z|0wILmIReV!h^9@0N0TN*CVlY{^i);I!69Vt8vO5H)o_0$NdElve?6)3U-Bgeu`kE;5uh)^a3t4J7$;>k&`a*! znvR)27c_a>?#GNVE&%K>GiMG{%MI_(Rg)qhJyCBH)l#PH&t16jZLZFw74&}0@9uHn zdmiUhe3)M>ROy4wX4?d{LcS6o?IGnW9OmP^_H8hBT<#VL(~N)(;0gr@QgrEoAdEt# zs}HNTf3E z`uXx8OU;qa^2#< z!G{{)Do8q>vzq**#eFFugQt;yAhUi(k3eXCLO?efkczauygelolyyDbA)R{<4Ok1J z%y|~t{3M&{b&uRiXJF>3LLisJg28~YU=ZsyUjFD_b4~DO0NC!lm=Bk03$j6~(F3%$uKxMcVIFHrF=@m*p z)u8R=a^Dj_FF}jXk-zIcvQW#X-&6=q^X@+zpdg@N$J_EoBwg-$#IhPo3l@VmM!lMM zSpCktG`1p1MRX3pT!&2J;(kxE)DVZ^_w4UH-<=|OUT0oq)E*}|{4@1M#u&u^KwXT? zN$qkCN{`X4%?gjKS@#L6dcMGqCL#(0yqnTbij58^pO;!BUOd{lE9~mp)XOO)nUVQ{ zycF#{g|3xP64Fx6lx3!^Ms%^)Bqt{?)-2XO9s<$bGCbAP4Mt4i&vQ={4wSeMPZKAB=J7`##tm){Xzij&jF1Rg{fC0h&B&(Y-X7wGnQtfbVhKXvJ|&i_(SU}l6&;b$;!Y+a2x3xA_RYxhky*>(A+kA;LQ!ae zPK^&;Kj>V=?#j1*?wdLA2syaSUx970`=jQRZW>pfpnG!RH*kz6amYU;*&U)ki(1?w z>QnhWq!g%X+PcOr-Q@4ofmznw=s1dI_KrtP7Nw@;O z?g~fw8pUw>cdr2ma{XwLci9eVvX?-}!_2uGIwc>Oa@KPco5t(4G+-N3-Fqy>te*B# z)U*X^m<}JQYUw5DNwnvc?+ukjE?&qTj9X4-Mw~>2Nn-Bj=g$VZb~BR9@Wx=$w4^f| z2iH93Fv%y8-59FW$dHd9(TK4vb5u7who&YVAMZ#id&F-udHbw~tIK4=a!I_E84@%X z2UCpSN9~(QjR5pZ5VOimknH03^tK+W&^X-jIw^#a@w+23iO{F#9H_82xT+{GpK3~= zS>9d&lHxLmjrmnLZA1L#2B0ReFIolhPq-8DIOW=2VpWE*<}EFXYXwE-OYcjH##Jf3 zO<00n5l{iLQ~NY%-cPlFDc&(nOJ*LN}iDBQ#)bQO%Z(i<6EePCfJ=)G6% zbv*CNou(&XYBt+-pE4syyZ9-=?$S)cj3VMHs%qUAnjh$6F*Ya|yb+)vSx0HBIWiv_ zozd2A|3#-vDIkU=Yp;|cg(kSbyyNY$-$iXUBfGDiXz>#U0{Ka|T`6SyV9uD;L%5*+ zrTFp95t~=(>8wL-2iwr^L#oxHZqueiw?AbY-g%>7Q^z3qlY|v_t8RDz&6@9v{~I`~ zwxA+oD?n|5=I80HhSVnlu#@TDnuu34xC9*FP!PSrk2S>${xrbmixq8NU326bE-;@f zi;!=*Dy_+9xiRbvYU^gl%a*>wcuEzf$dh+NfkJPaXVtLYn7cnt(F}qn7@j3Dg)3M1 z=iB3Xo>&Uz_AGC0z8EV~8Y5W#@vdO$JQ@GN0j5>!mhP6@@U?!^_2Y)Ym8e05^hcWy z_XK-b?(2AdW3)ZQ|DpS*j_D?T1DHNego1vW6Lbr>T83&qLmZ4g?rqagvsfKkwFoHJ zSV+OF_HOo-I)S`pgjkK39ZD_jM6Aqn{Q=-ND;p_helX4N5g6PCjG$=042ydT%aMD1 z9>>!^46RwK6>sS|3nl{9I<|6g5gSI&j}Z~PL}G$>{M=V;XJu14!-?=Y+$jofi+D(M z-A(mYTA=W(*)Y6Km4Au)R$u_L=E%+fdCgfheyskULmyEVh+1Bmc|Eu9sx3_{(cD^z zM8H%`(=~=%6Y{6@v%cV5uZyT5HRW`9ecwENL`a=tM6ceS=S&;pM4-j4X72FvvNr1k za(VqZ@m##VH*LHxD2so%{S^5+Fa(m%e&VYK%=A+0BfLr>c3ESxWXV%;;7SyT@v$cn zl6`g*{8w1q(PzI;09NZ&99O!xW!tTvUXojxgqc1fD89^Sqkt>py0&5!hw>ejuSNZ< zu5k1AOG{`7Qx%6wJ-^4{`pdhIy*ZALNz>J~2{L9FQp~fC6nYh0>BSR5sff|~S1$m0^&B%ajoVT^=8>Xi84lf;!zA<<=kDysUcR0}~r(qPjnXO&;Q5B{N z8hmRQ>l9-3_l#NSK+bk~aZtsJ7fO*983t;o0)p)a&vprX69ywzYQzi;Vex%$~te)5|9G!1-2f zkn>$7JGHw9J-Svlp4UBk<>mE1D0R`sYYvzINzlT#Xu$Kgk znztM`HlA*xx1rjC#UrI2BgMvr5@!IY^|m#cjeH_kH-S8;yp~*K)JOzwKT;bB#l;DPm?{9 zy#2+j2Y}1q(MY8?bYFC%3_U)eDtPV)Is+QRT0l~ERdjE4YtL|7(3~YcL;hq){l59i zSJ|di{fT8imY9dcI7GEOsm<8cEkCdM^bF-%d1g%2-Dbs6?_8%&UTVaF&19wI<4fME zBXeCq6))DIyW^@J4aQ15L4WEiX^Z5lu}&56vf~(2?@qL2j9JTf3Vw@>I=)nb~`P2814M!CZ5%Kq5ppx%q&a`c{iuwcMVu+60glpS=yFV`32g4(-AyuSvLs8_+$ z$kT=9Hy_b;#{cYZZ3|0fG6qq4LXM+1yOv9me#{_iZXLuf?U@l-El>qg*xD>D$VCaQ8a3zs9slYDx#4TdJ=Zo|L8VQ}P=Ox; z@E_A09vld=##8&L^vGsz;49`ZWsC@RhvNbmJed@6T5XWLN&F zb%cH0*LoX|Kw)#HG2%XyL(k{SnTX@`ln9y!XPL0E*+dLk(Vy40>%W6#`bpqnLUap! z*<*z7a{ucze|qS7S;=_E9h=?3pCFQqSW_%(7fdCS=J4=v^d;n^?>FWUXY{J7O~EA#oxeiowruZ~V$VyY((>NF=>EzOElGOV-}=Y8}4+P?C; z$rQR(Q5sIKM*#`tDx+^xrfcdTuT`vz>`x;-qL;!RK`o5z6}>BIQ21iXk?vr0mH%`!&ENOo;qP$I_oi8#kN?!(|S&$E}CQ z>*1W+by^ z@Rgcy5!V{_r!M~cr)h{^!dZ2>qsS#uL3+d6(*t;!9SkfkoFf@2JwcciUj|D!+}L^q=AZGCO!&cKWSi# zi4gvM3IDiYb?<_a_~bf+9)AX*I(h>~=Kr)|{J!AsX-(fe8ev?l8d>R}@gGNJ2d1Rk z@0T|~gI5Gnf#Oe3_`hzWze*msG=U}Yn1eRrUo9!z#<_q4j(Y~bPksgsMjv;a!PQLs zV@Lh*Prqk47C+(}VOnop!0LN#ATgK!!|VL3fZqd0oFR}ehW-y1@&&ipmmu+9CoJY* z^8^3N$$6V4hISoUWoXXIU`4_k33&j|@cvzPQ^LRAE*p4$9nXtoJ2jn+_BtqLW*sMp zQ88K{FP>3)qkvopi9(!Qj7k%HKgK*IR;V(=puq614|&0f7|os-iW%Z)X~3ZA(Nu=? zl2OpRvo|UpU%a}3uDMGdeR7BSgKBiz$oub~V$UbB=&O9x5n}w81-NBOj5;mNr9;Oc zyKyB9jtjp#AW^qQN(`&yV~^r<^e}oKA2RD?|i`RGe7yGMO; zB6R@b=D3#gBEzv8u^SUN1>Iiwrgg7>;EmB!hmqqoj?$B>J?eX?ku_AV`&>24K$cv5X?|Ob zZEd)YaG9r3$Ht{C6ee+gw`{Vo!D^xiGU-*aW+*9ymj^7CVMzpSc4s+N-5`QcnDa7YpkPv&2e(lgGIPG^;t`4;8 z?6k*-IJ{yXGa3De!V&TfuGCsX+}wz6V^&d%QYJztu|kT;Nw&)i=g;+uT5Z)hXqGy& zGcpsYIRr#n_@c-41@{~UAX<4aqntspCie6Hc{@TSKmr5!f3e|go-VP+L)R#TJ<_!6 zd^+!_W@)PtTs;03ph#PD5}c!1A@X<{NDQW#&h4<>M3On>N$W#@Ytl`NKSz)C*3|0d zyV`dh!YKoc+7h03#jvC&RBXx2R`Sh_R}}lPQ)s_T>qdQt)WsL@rdIdX23d_&`WG;_ z7&I;vKx~~|>nOu3RYl#i%tJWEGpaB{ky_HFGF>hW3@W(-t1Gl|L>0x3wP7kM;t{G! zLt(FUPA>jjJQttUd$wcHcVo;@@h{X+bkW3c{@m@#-J?g*ziZNoR=Ier+OTTmvg?H$ zEAr=PG2NQ-7&ySFbJWrUnhoPue%cPrs*5>#RgW3tZs;&6QoAMUM%y|*1Ef8EI^ z7L9j~s1-nu8I2}K7;o8%pRZJZ^@ebskF2)evgaAMNgF+sLnrdw_CgCOSyQVHqOaTj zepmKX!8;Oi_5^W`?S+nTh`4+xCWA#TB<3=|xj&+4fa=kD=1eie_ioTZd5owi^DeA# z;lBZExV{~0w)ynL;A{;@>{TGZdhg$1xRqL+dn}*Wu-|eT` zwAO2FPnIzd*I3ND6|#baQh+P>+L&D4c*Xo+?pTq@F42Kahk!$GPApCG4h3DOR?R&f zVdu!}?KCCnZIR3$I-bKjO7pYT(qB1}erf6!fcl&bELXdpi9SHA`?h6WZ#QaRQ0Rln zxl)Kayg53W{VsvNqFmBvX4L9B(m zwk$(-DcE?iMSOn;l}Ji-W9eBU#bW1nrjq5xAGOk3&W0q^Rn=O?5`KQ%nwzSnz_Qx| zH)myjPU%e#d#_fETsnRGoi>4xzX z*M+xR9$%fxHf7L{%L%XTBX+4SC%o!^AKSC=!>*!mUEKX}<(7lN7T64y72g$N9x00> zBpl#0berL6cDj=5=#HHHxtTV-HJ@j#4pEUJwn0&nsbf_GkCj+IDpKUHjFGp$9vfnS zM0OA{K#Uo$b1Nb4Kuu z!VkvN=+WO5Hc;YzEtmIyKwGz*T20fuxRMoF04`ztX++LE zV?+fK0zie^h6y9)MvCU=R!0y;rbFzl(7I0~MT0rI%(O0E?Ma!A2QEkS%v!b8*sCXB z4z}tfQofZ2#g)Pk+fGVp;IuAbkE-loBebm9_p_2fs%F!$S-xFVPta-OWk-yd8o%xM z^q{w|@DFKbjoQy70{zYQM?%Jx*VvU+;{@`Un1X2?DLkqtHqW{v-rQKOGoF1+HfLPg zMc$Rn^FxEU7{GAD)KjCq1RXx&kDrI>&mt9e$DVk?P_*7JUPVjoC1Xe_S%Tt3IBe@C zySl{FQa$r0KYJ4Gu1vJQQJ^y3J7REnapGf+SU!;8AZC`Z=!5(3V66%qZS)D_cW6}7 zLJ0;RLXG#=j8zOd_WDVI^azUFfB-p642cawJ(EgFhV80oA=bJA;? z^*U?S(cbIvM31}68b7`*SXz#*a1p1`kdA(w$l&}=b5G+3VZ4iv_SZL(82YKeI+;;Z zs=)mm-4RZeOWv5ci7FXZ*i1}!9xIheY|mnzc^NuC?cS5G0ko8_jBK&7M&=uSjv^$U zU7aWD4$k|U-0Hpq>Pl<0gB>WcsD6B5Nb&V>t!CGj#0XFM7-bbACv1E0`m&uV%_VXY z4W}buV8p&)sv~s2@gbkkt53~}!F?)rn)&BB&GR6wFpq=OMmyY63mN}{v-TQQwPv^x+r6QV8tn-Y z4R-c;qcPeHwxNz=5y^p401KDm{)WM-vKHZ`>pjsFkPJ)CV<5%SJev*lL8rgyj#cU( z<(iHoo&yb-|L`V${3#(i7sx zs=8jVT*8YUZ3!bhYfk_U*cHw1F&ncubb|&N=8$29NOKD61ynTb6 z@t~c(Xipa$n+^(uQ7GXo?|nqW1jYrQU0jiR{URB4lyoIWKWnbm@a8M^;kmX%>Ek2M z(&rJkKo6*GOjd^0UNurdqSv&Zj_QdQk3o#LVswtC>7Ja>>cv-wq=(uTL)I^bED!sc zyPSLJ*reX8Di=ElR%xi&1rh`~DoClzlD+AN>9&?q9=UJnDZ`%;x~DuhL{7>d9){wj z>DFK%aw^sW2E&)B?)x)X^%e3h#_?cik-X=9#Ku)e_`-E3#JJUbx7WINkA07vi;TL% zyFJ*f9c=bj^>}rK z#P0UyCPxneXE!s?r6 z6Klw-3wMwXVWl!1Sx(+j(~TCf{TNn-3~38Sbq{l<%Op#82h)sIi5f~Kg{SU8UR^Vv z|F)GpKOBSaQpkSE?^EYbCrs(S4D4Knn1kaJC(^r9Rm| z4q`1zl{Vkx8IVqIPA>R5lAAgve?e8}YDPD^6ow-VpP6Ua@z$BxW5*>zrnQQ^U`fNN zP}Y?Ux#%Vx`T3``p6}O7wu`dSjx)aNr6N3gp}Aj#cGgxLjImRUFPBa6zI5$XpBKn) zOX{|uD!Z#}HO&HvOZ~!g@4aQ7hF1$E#AqQsP+c+cz%+(1LyYrlziCJwSx1t>Z8d)X zg&#Jc`259KRislu5T(^sZ7MlsJFT62-52g5sQ4%Mev<^Q~0=#Uy>`oCr`doI)%=}%^7hp2Lsr*(#eHG=uP%u4 zdi7mqF_Q`|?AClDS}d}*#xv$gH{6fNPCiylt}E6elRRFaP&|=y zNr3EgWb~*SYn(-LHn*pr`t4hs`cH`f@h4#O+M^bH)IefglF5dCDAcC*#VD)Pr$Eh- z)_WsQbT>*vuPk>5FTmu`QR9qq7T|}8gH^8_ydy+*kneU<4MDe&-2u#2l{Q(?7V6CF z2^s2qY+5CgVy>c@*~X07W`^M!w))-pa9vXX zvppHT%cXp_{Yzd0qi>$r#$2{=Yat`u(9+npd!rzAJ}=TJW2VL4tlY(VMTD8(tc1i> zQGxc3smUcMwRK%+hx4RMQf8Eb)+C47>+<4Gaqy&Nvxgh)UNB* znT@qIz9U2Tx@UaLiXXjKKGt&kdl2ykXz+3>{)1JmyO;pp$d7z_0%}%%;;g~P!w@eQ4yf`J4fhWNp|T;a z#dmKMl;oR<|1D&3M};mYN0DR7{xJ#4>=^yRJ(^wDtif;b*~pwl zpXS8CX6~iZN(ia+aQ`QDzT&b0L8RPxjji|Bx3*2P1Iv5~Y}-wW`>m>hQN@`1<`+_> zdkW0!r}g`KR)?;QU*Y_?^a3;WHI9`GXXe#VsN-0s%59-zPBvO_II!916cKlHslH zffa4h)R7`nsPBS^#rd1#Dd;08tN>AXH&wA9U$nL;b=^DSkv8WSmez1w? z&V5(ZN2?L|^JoqoqcI90mf0OwE-ui$c*N&)VM*pWJWgcStIV#Xm-v2dow=U-cF*IA z$|XG&9o`YulYN7KTMK8-wtnv=gQfR4lNbtI&x7(;=87Cv0=C32YvD`xgr62t8DPN@mPmo zaKr2*H|CK-)E#f~QE&fXdAFhQ^=k+syF3^w>+)i_utyZM%5?8M6~7>B1yLmQPI4FV zo)6r?TpHaMULxuTw%bI)TPqal0O03fFlm1gj{*2wx$(|b@DTZV#9d$qt zs04B%j9Mew(c)MeG^9_|e=rtn6-+D4LcwhWzug3OHlpAM1RX$x>e=qgkh9f{ zcXn`ZOaA~h8tPi><+jqSai}2dJCgrxnqx?wVPr5j-l+H0K^MQNha^BfKuwkfKh4yY zq~NxC^N~jI;c?Pl=I@%dO{??83Lu=4i})R=!jaG){4Kph)Z#94Tw3Bh>uM&)pyvBg z<@reUu(hc&rNbTCdu++JFEkg@BO!GPg&2G_nEFKNr~lF0na4x9e-FF`r3GJW5>ZjO z;Zh^AFKI9;W=xhb$=D~kwqimH5weRhmdci~i)I*1am65HH)GE>GnSh*WBWaB_ukj* zzFyovfAin-n&){w%lVx1`h3pwKIe44zJ4%cglll#X|%K($T%2wr_FaZAraNEQn0cb zSxoPu#I5vqejBR3>VPcnR9qdl@R*slow{P{oFR0H#~bPZyc{kSDe}$34cG#gX)}I# zPlje2M}fqd%QNq24~_488CAtKbA zxTOS}cs*ecqV+S3(2Yj>&e(z$?kP1v5PMa-dgp>0eBRJuUR2X}l9a)#9B@EIZA-Lb zV>mrl93uE03B3nifNHO|g#bk<0ZIZmINnQ&$3HwS-FFW^qp009sB|c^E9qdXxtG;d zfrLXELg$9pH7lw#3qp4S14rl72Dovm)E@s}4eVl{nC?}-R|%x-1zBQ~l)=7uH8LlT z6(o-~v|8DwlDMbe;ngC)1s;GuEz%Ti<3IwdcibP z#z;t;4*6g1Q8u_oWttNMA>7<{x@2#ye~!N^Y<4}zFC zzHM{w=+@{-u!8+6V0v*OGU$0SJ|!2~8WVeceecIo#uj~7uT*p>wtKw3| zR_Pdn=AtOII#(vu2b*YS-`Ax|Vp~E;SQv6h{WxV&(1UNO zNt!8^W<;gp$DD#5=HXKw6)jaTJy+ftrZ~Z3GU}ud6J&63^<- z!v~IqK>S`GJi8?U-#Q#)%4kU&X2JMmua{_yfBYlSSfpC<6G_rvE|BKP#AjV%Ownx; zx%y9~hGf{r!6Fr&bLneOINQl49e(5#k7^)Wz7`$-@_c-;yfQ^rUf8ffa}%3&9y}M?G&Uqwsyv zWOX$1(Y7q5^U-liTSWsCYNUg&Wn}0eK90qysh*HHEyOK z&6)}{f+ecu7lUu0x~AJQ%~SmpS;+KIxB49UO=FX!jbQ#iWW`g5-11sKtIC<*&Xet} ze85CcVkLC1VK2=dl{WiOh3G>CyGmU3X~fKz#nEJ-4;A5ZK(3LJHG%+0rSf!ER~v1_ zwoVe&;B%GP*0pBOa$H3SaD}{!zKul6TSx?l^T)BupN`kAEy}H>nxSTfZLK^sKf0vC zONR|PeGl8l6>3ozZG{C+WyRf{Z%fF}LMoW`YJciq?wsfw(7=~A-Dry3(obdb%V02Y z!THB7Z>Jm)wv4p*!;orObZM(ZlXY2`%NLAawvL}yWWW~Y~# zN|wBTKu5)ChfpN*&i7mv0}&6#?kwf*&vJ;!jfJj}Drfs%63p8Z8+5JdT`eB<0|7?`D2pV{(`2M5=&yTW)g^==ApwUscv zT)_Ex>3!+_n~;j!9{XTO;9%Hg0dxucOlGEwL{i1|`t734{27tkh$?94J1agZL9wBE z$KYamfKJse->k%=@3Ms@9_HC(FW-8qDJ6ByBvnj_ZM!04~Q-)mKj8`mAgI5%VF%Sd*2 z9i#2K3sW&?O((F96OA!9cU*!O(H>r!UhF*^`bPBt;q>FwRY9r!lIgLf6Eckw-D7`z z>BXHu`X9eJ%Oyglwy;4+fm>kKO2pME3Ks4HjFENY;_0*J1-X^@ZEAw`2}R)=54wVm zyw!O=Hs2P9o?u`ZlwsDPre(hMdJ-zy<&BVdZ{+M{N5CcjaxNbLhW#H1!2~h`l>JbR zcP*#YN9p!wd$oge160fE9=T1PNjN99LB#t|-L`C8+Wo*dmAMD*8?w@i?w72;emjl* zo@U*rc0*0k-mGA$t1VNJ=&f$5R;7qt%;i0b^J@OI`OFn3lN}LY4{bEP{+0_30(Ga!)d}-aGi?DKx~#Nq+{%w~xTM*WR~q*@J*8f8Rg0ZN zR|@#UQsrS3wS&S73D9qXaF{XfobJ#*Siy%nK@h#dW}w08^?QX>N#6wu72)OgKVH}W$y2*QaVtYuPoP>{zPNmIG zLT!St4r)w0x84h@^w2kd*W+55MGd{ta84H8@r)@yODhjFU?@8|)kH*v62+O&&|mEs zD3W+>WszI8P`8CjjmLM>AT+JYB0KlJcdfj&!lD-eoY^?>KHB{UKY9R!eOZQkhtcl ztr^Idt(VsXBsPKZ9gEI?ViS;+d+gLgNxnt74#&zYc0_5I2v!nSa7s$vRxFPk;=YXT z;Olr|*3gQ8CY`)s0mW2y=G>s*1&r+H^07XS;m%QRgP7!%C-e?qN|a`PA~^kJOgB@R z8VvDkd0QU_ZmT(s)neS$3u;MI(VY+$%f8!&N0%y`>gN{aVQxMuw0wzy3w)6-lKq=vx>Jnu*ll-HH9-Wel^Kr`QHI8RCtTscuBTcEs{rVviz9K$x z#=%Xr&k^Rf?IjhP;|nzq{6%YPVl){%%to80D~q07OtxlCT%`#AsN|pfV-4X+67|$I zDL8R)^lD8)QmEM&J=LuARY8U&Yxx6ANU}`aU@8X49alsnjCYmZQ6c*lDqfMtZZzkq z+=xBfsfv3nSyBvcyVXV?S3V1EUwHOAz8aiP3Z+Ix#^zmfB}qyH+^JX9Fr7(z;c+xZKp#vrN!280<4LQV1 z2N=lWXt-+GV9+Z#*EVYItE2CPb9;Z8$)oo0V!AfFujVeh;vFU?+K}Cg`2IIqA*nVS zT6roYdp4pN9Ku~$ol?kQ*px*ZS?ggs;oXTm?&pD^hX+(h&kmUR?@i6m%X8WQ@xgg} z00lqKD#!)(;*Xn_s>{}NeY*)#E2lkiMW-#{N=zdN7O&hsULT$1{%Z@4?W2Q=v~P# z;iTQ1CV#R4rX>KVA~U3xopu)hWlU#!6#hzzx(hkr2=r3LD*ihUj|6&5daoJad58v( z7cpFc!yE2fkBjLNcNcH%Ijksi;Eu1XMfx0&06!?{ zGIb^gAiPu({)6yJxp?z+n+$l$>i7OSMX>`>sai{vXC7yWC7r#HzHu*8j-BwtT_?sp zTgx*2Kx|R7H5k|3i>(95vZw?tz(L^Qp(Fd^xaR1RHy=nP^*_kAl#3%VmkHzaE0C%M z{s$}V5h0IhNA=P*GFzP);sm+$-zb)xIP2P`*L%vakf)LN$8*#LOA9qmfin+1*cI$5 zUq0qaa!Xq`D-4;7Z7lFaRLa##B`zpl*WAlbQUa{g{U>VGD{Jr_WqjC_Uv ziZ!Tv3oCz@aGiE0pyy8wEVN5DW3o7$G@%898f-Cd}zIyvFob%TQw7b z96c5BiJ$h={+*{+cg)oMroH!`0tWtgYy?;b>!#+B|GWtU7>J71ty0z9rSh{|AF}{4 z%l#MZ2|WF=8fb3-6KL^g4%NQ}_U}0W@~N5vV*Y Date: Mon, 25 May 2026 16:53:13 +0200 Subject: [PATCH 11/21] README: Clearer information about transforms and using their outputs. --- packages/wiz/_dev/build/docs/README.md | 14 ++++++++------ packages/wiz/docs/README.md | 14 ++++++++------ 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/packages/wiz/_dev/build/docs/README.md b/packages/wiz/_dev/build/docs/README.md index f5e292f3180..71b1964c18b 100644 --- a/packages/wiz/_dev/build/docs/README.md +++ b/packages/wiz/_dev/build/docs/README.md @@ -98,16 +98,18 @@ Agentless deployments are only supported in Elastic Serverless and Elastic Cloud - Vulnerability data is fetched for the previous day. - Custom headers are not supported in this integration. Only the standard Authorization header (for example, Bearer token) is used for API requests. -### Troubleshooting +### Transforms -The transforms used in the Wiz integration depend on the presence of the `event.ingested` field to function correctly. +The Wiz integration creates transforms to support [CDR](https://www.elastic.co/what-is/cloud-detection-response), for the following data streams: -When using Fleet-managed Elastic Agents, the `.fleet_final_pipeline-1` is automatically executed and ensures that the `event.ingested` field is added to all events. +| Data stream name | Transform destination alias | +|-------------------------------------------------------|-------------------------------------------------| +| `logs-wiz.vulnerability-*` | `security_solution-wiz.vulnerability_latest` | +| `logs-wiz.cloud_configuration_finding_full_posture-*` | `security_solution-wiz.misconfiguration_latest` | -However, when using standalone Elastic Agents, this pipeline is not applied, and the `event.ingested` field is not automatically added. +The source data streams contain historical events and are suitable for most uses, while the aliased transform destination indexes provide a view of the current state of Wiz findings to support Elastic Security CDR workflows. The dashboards included in the Wiz integration use the source data streams. -📌 Action Required (for standalone agents): -You must manually add the `event.ingested` field, preferably via a custom ingest pipeline (e.g., using the @custom pipeline). +The transforms use `event.ingested` as their sync field. Fleet-managed Elastic Agents add this field automatically but for other setups this field might need to be added separately. ## Logs reference diff --git a/packages/wiz/docs/README.md b/packages/wiz/docs/README.md index ae7de1eab4d..344ebdab3eb 100644 --- a/packages/wiz/docs/README.md +++ b/packages/wiz/docs/README.md @@ -98,16 +98,18 @@ Agentless deployments are only supported in Elastic Serverless and Elastic Cloud - Vulnerability data is fetched for the previous day. - Custom headers are not supported in this integration. Only the standard Authorization header (for example, Bearer token) is used for API requests. -### Troubleshooting +### Transforms -The transforms used in the Wiz integration depend on the presence of the `event.ingested` field to function correctly. +The Wiz integration creates transforms to support [CDR](https://www.elastic.co/what-is/cloud-detection-response), for the following data streams: -When using Fleet-managed Elastic Agents, the `.fleet_final_pipeline-1` is automatically executed and ensures that the `event.ingested` field is added to all events. +| Data stream name | Transform destination alias | +|-------------------------------------------------------|-------------------------------------------------| +| `logs-wiz.vulnerability-*` | `security_solution-wiz.vulnerability_latest` | +| `logs-wiz.cloud_configuration_finding_full_posture-*` | `security_solution-wiz.misconfiguration_latest` | -However, when using standalone Elastic Agents, this pipeline is not applied, and the `event.ingested` field is not automatically added. +The source data streams contain historical events and are suitable for most uses, while the aliased transform destination indexes provide a view of the current state of Wiz findings to support Elastic Security CDR workflows. The dashboards included in the Wiz integration use the source data streams. -📌 Action Required (for standalone agents): -You must manually add the `event.ingested` field, preferably via a custom ingest pipeline (e.g., using the @custom pipeline). +The transforms use `event.ingested` as their sync field. Fleet-managed Elastic Agents add this field automatically but for other setups this field might need to be added separately. ## Logs reference From 5f879f8d95fa8d7211591958e492de27d32bce81 Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Tue, 26 May 2026 09:39:42 +0200 Subject: [PATCH 12/21] Add a labels.is_transform_source field for source and destination for data that has a transform. --- .../fields/is-transform-source-true.yml | 4 ++++ .../vulnerability/fields/is-transform-source-true.yml | 4 ++++ packages/wiz/docs/README.md | 2 ++ .../fields/is-transform-source-false.yml | 4 ++++ .../fields/is-transform-source-false.yml | 4 ++++ 5 files changed, 18 insertions(+) create mode 100644 packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/is-transform-source-true.yml create mode 100644 packages/wiz/data_stream/vulnerability/fields/is-transform-source-true.yml create mode 100644 packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/is-transform-source-false.yml create mode 100644 packages/wiz/elasticsearch/transform/latest_cdr_vulnerabilities/fields/is-transform-source-false.yml diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/is-transform-source-true.yml b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/is-transform-source-true.yml new file mode 100644 index 00000000000..fd4766eacd5 --- /dev/null +++ b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/is-transform-source-true.yml @@ -0,0 +1,4 @@ +- name: labels.is_transform_source + type: constant_keyword + description: Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. + value: "true" diff --git a/packages/wiz/data_stream/vulnerability/fields/is-transform-source-true.yml b/packages/wiz/data_stream/vulnerability/fields/is-transform-source-true.yml new file mode 100644 index 00000000000..fd4766eacd5 --- /dev/null +++ b/packages/wiz/data_stream/vulnerability/fields/is-transform-source-true.yml @@ -0,0 +1,4 @@ +- name: labels.is_transform_source + type: constant_keyword + description: Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. + value: "true" diff --git a/packages/wiz/docs/README.md b/packages/wiz/docs/README.md index 344ebdab3eb..cb24ba89770 100644 --- a/packages/wiz/docs/README.md +++ b/packages/wiz/docs/README.md @@ -550,6 +550,7 @@ An example event for `cloud_configuration_finding_full_posture` looks as followi | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword | | input.type | Type of filebeat input. | keyword | +| labels.is_transform_source | Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. | constant_keyword | | log.offset | Log offset. | long | | resource.id | | keyword | | resource.name | | keyword | @@ -1518,6 +1519,7 @@ An example event for `vulnerability` looks as following: | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword | | input.type | Type of filebeat input. | keyword | +| labels.is_transform_source | Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. | constant_keyword | | log.offset | Log offset. | long | | package.fixed_version | | keyword | | resource.id | | keyword | diff --git a/packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/is-transform-source-false.yml b/packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/is-transform-source-false.yml new file mode 100644 index 00000000000..490a079e7a7 --- /dev/null +++ b/packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/is-transform-source-false.yml @@ -0,0 +1,4 @@ +- name: labels.is_transform_source + type: constant_keyword + description: Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. + value: "false" diff --git a/packages/wiz/elasticsearch/transform/latest_cdr_vulnerabilities/fields/is-transform-source-false.yml b/packages/wiz/elasticsearch/transform/latest_cdr_vulnerabilities/fields/is-transform-source-false.yml new file mode 100644 index 00000000000..490a079e7a7 --- /dev/null +++ b/packages/wiz/elasticsearch/transform/latest_cdr_vulnerabilities/fields/is-transform-source-false.yml @@ -0,0 +1,4 @@ +- name: labels.is_transform_source + type: constant_keyword + description: Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. + value: "false" From 960a6808ab13966de8dcc2ccfa3255e02c266363 Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Tue, 26 May 2026 10:38:34 +0200 Subject: [PATCH 13/21] Revert "Add a labels.is_transform_source field for source and destination for data that has a transform." This reverts commit 166ea075774515ed3bade16d678318cedf9529b9. --- .../fields/is-transform-source-true.yml | 4 ---- .../vulnerability/fields/is-transform-source-true.yml | 4 ---- packages/wiz/docs/README.md | 2 -- .../fields/is-transform-source-false.yml | 4 ---- .../fields/is-transform-source-false.yml | 4 ---- 5 files changed, 18 deletions(-) delete mode 100644 packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/is-transform-source-true.yml delete mode 100644 packages/wiz/data_stream/vulnerability/fields/is-transform-source-true.yml delete mode 100644 packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/is-transform-source-false.yml delete mode 100644 packages/wiz/elasticsearch/transform/latest_cdr_vulnerabilities/fields/is-transform-source-false.yml diff --git a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/is-transform-source-true.yml b/packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/is-transform-source-true.yml deleted file mode 100644 index fd4766eacd5..00000000000 --- a/packages/wiz/data_stream/cloud_configuration_finding_full_posture/fields/is-transform-source-true.yml +++ /dev/null @@ -1,4 +0,0 @@ -- name: labels.is_transform_source - type: constant_keyword - description: Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. - value: "true" diff --git a/packages/wiz/data_stream/vulnerability/fields/is-transform-source-true.yml b/packages/wiz/data_stream/vulnerability/fields/is-transform-source-true.yml deleted file mode 100644 index fd4766eacd5..00000000000 --- a/packages/wiz/data_stream/vulnerability/fields/is-transform-source-true.yml +++ /dev/null @@ -1,4 +0,0 @@ -- name: labels.is_transform_source - type: constant_keyword - description: Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. - value: "true" diff --git a/packages/wiz/docs/README.md b/packages/wiz/docs/README.md index cb24ba89770..344ebdab3eb 100644 --- a/packages/wiz/docs/README.md +++ b/packages/wiz/docs/README.md @@ -550,7 +550,6 @@ An example event for `cloud_configuration_finding_full_posture` looks as followi | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword | | input.type | Type of filebeat input. | keyword | -| labels.is_transform_source | Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. | constant_keyword | | log.offset | Log offset. | long | | resource.id | | keyword | | resource.name | | keyword | @@ -1519,7 +1518,6 @@ An example event for `vulnerability` looks as following: | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword | | input.type | Type of filebeat input. | keyword | -| labels.is_transform_source | Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. | constant_keyword | | log.offset | Log offset. | long | | package.fixed_version | | keyword | | resource.id | | keyword | diff --git a/packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/is-transform-source-false.yml b/packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/is-transform-source-false.yml deleted file mode 100644 index 490a079e7a7..00000000000 --- a/packages/wiz/elasticsearch/transform/latest_cdr_misconfigurations/fields/is-transform-source-false.yml +++ /dev/null @@ -1,4 +0,0 @@ -- name: labels.is_transform_source - type: constant_keyword - description: Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. - value: "false" diff --git a/packages/wiz/elasticsearch/transform/latest_cdr_vulnerabilities/fields/is-transform-source-false.yml b/packages/wiz/elasticsearch/transform/latest_cdr_vulnerabilities/fields/is-transform-source-false.yml deleted file mode 100644 index 490a079e7a7..00000000000 --- a/packages/wiz/elasticsearch/transform/latest_cdr_vulnerabilities/fields/is-transform-source-false.yml +++ /dev/null @@ -1,4 +0,0 @@ -- name: labels.is_transform_source - type: constant_keyword - description: Distinguishes between documents that are a source for a transform and documents that are an output of a transform, to facilitate easier filtering. - value: "false" From fc8189b3226478ca1e5f150bb5bb62db71147d2f Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Tue, 26 May 2026 10:04:12 +0200 Subject: [PATCH 14/21] Dashboards: no-op export. --- ...-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json | 11 ++- ...-726802c0-4007-48b9-bae5-09daa69d4368.json | 10 ++- ...-927c36f0-6358-11ee-a265-c3569aa0cebf.json | 74 +++++++++++-------- ...-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json | 10 ++- ...-d8f91a20-6363-11ee-a265-c3569aa0cebf.json | 10 ++- ...-f71321c0-a641-4411-a33e-f39569c2c7be.json | 12 +-- .../tag/wiz-security-solution-default.json | 13 ++++ 7 files changed, 90 insertions(+), 50 deletions(-) create mode 100644 packages/wiz/kibana/tag/wiz-security-solution-default.json diff --git a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json index fc0d8397a8a..017e03bc15f 100644 --- a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json +++ b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json @@ -2798,9 +2798,8 @@ "version": 3 }, "coreMigrationVersion": "8.8.0", - "created_at": "2025-04-21T10:47:33.605Z", + "created_at": "2026-05-26T06:30:27.699Z", "id": "wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a", - "managed": false, "references": [ { "id": "logs-*", @@ -2911,9 +2910,13 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "wiz-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" } ], "type": "dashboard", - "typeMigrationVersion": "10.2.0", - "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" + "typeMigrationVersion": "10.3.0" } \ No newline at end of file diff --git a/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json b/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json index d159ef944c6..12e46fb3e6c 100644 --- a/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json +++ b/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json @@ -852,9 +852,8 @@ "version": 1 }, "coreMigrationVersion": "8.8.0", - "created_at": "2024-08-23T14:46:23.733Z", + "created_at": "2026-05-26T06:30:26.431Z", "id": "wiz-726802c0-4007-48b9-bae5-09daa69d4368", - "managed": false, "references": [ { "id": "logs-*", @@ -900,8 +899,13 @@ "id": "logs-*", "name": "e684aa2c-8963-4cae-a04e-74b00b662a33:9582928b-35f7-49a2-90cd-aab0dc84b52a", "type": "index-pattern" + }, + { + "id": "wiz-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" } ], "type": "dashboard", - "typeMigrationVersion": "8.9.0" + "typeMigrationVersion": "10.3.0" } \ No newline at end of file diff --git a/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json b/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json index 540b85f8756..100aae841fe 100644 --- a/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json +++ b/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json @@ -1,5 +1,17 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "twoLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, "description": "", "kibanaSavedObjectMeta": { "searchSourceJSON": { @@ -43,7 +55,8 @@ "title": "", "type": "markdown", "uiState": {} - } + }, + "title": "Table of Contents" }, "gridData": { "h": 23, @@ -53,9 +66,7 @@ "y": 0 }, "panelIndex": "727bcd3b-a463-4e53-b37c-e4d5b2f21109", - "title": "Table of Contents", - "type": "visualization", - "version": "8.10.1" + "type": "visualization" }, { "embeddableConfig": { @@ -278,7 +289,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Top 10 Vulnerable Asset Details [Logs Wiz]" }, "gridData": { "h": 11, @@ -288,9 +300,7 @@ "y": 12 }, "panelIndex": "2051bd2b-1eec-4089-b4fb-577795cacfa2", - "title": "Top 10 Vulnerable Asset Details [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -483,7 +493,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Top 10 Vulnerability Details [Logs Wiz]" }, "gridData": { "h": 12, @@ -493,9 +504,7 @@ "y": 0 }, "panelIndex": "f3eb2e36-296f-4004-96da-cbb7b028b304", - "title": "Top 10 Vulnerability Details [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -638,7 +647,8 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Vulnerability by Impact Score [Logs Wiz]" }, "gridData": { "h": 15, @@ -648,9 +658,7 @@ "y": 23 }, "panelIndex": "06724fb1-c688-4fb8-994f-46fdda85f4df", - "title": "Vulnerability by Impact Score [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -825,7 +833,8 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Vulnerability over Time [Logs Wiz]" }, "gridData": { "h": 15, @@ -835,9 +844,7 @@ "y": 23 }, "panelIndex": "847c81d1-f4af-4251-a36b-d78b84ca73b0", - "title": "Vulnerability over Time [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -975,7 +982,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Vulnerability by Status [Logs Wiz]" }, "gridData": { "h": 15, @@ -985,9 +993,7 @@ "y": 38 }, "panelIndex": "5431537a-7121-454f-9311-539c6c4f49b1", - "title": "Vulnerability by Status [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -1125,7 +1131,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Vulnerability by Detection Method [Logs Wiz]" }, "gridData": { "h": 15, @@ -1135,20 +1142,22 @@ "y": 38 }, "panelIndex": "949d4086-94e4-4d90-a590-7a373ce0ee36", - "title": "Vulnerability by Detection Method [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" } ], "timeRestore": false, "title": "[Logs Wiz] Vulnerability", - "version": 1 + "version": 3 }, "coreMigrationVersion": "8.8.0", - "created_at": "2023-10-13T10:53:15.400Z", + "created_at": "2026-05-26T06:30:28.696Z", "id": "wiz-927c36f0-6358-11ee-a265-c3569aa0cebf", - "managed": false, "references": [ + { + "id": "wiz-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" + }, { "id": "logs-*", "name": "2051bd2b-1eec-4089-b4fb-577795cacfa2:indexpattern-datasource-layer-0d257928-266c-4ccd-8810-bf6605fc84aa", @@ -1211,5 +1220,6 @@ } ], "type": "dashboard", - "typeMigrationVersion": "8.9.0" + "typeMigrationVersion": "10.3.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json b/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json index 0773d282db4..94eb0925685 100644 --- a/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json +++ b/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json @@ -794,9 +794,8 @@ "version": 1 }, "coreMigrationVersion": "8.8.0", - "created_at": "2023-10-13T11:16:54.626Z", + "created_at": "2026-05-26T06:30:29.707Z", "id": "wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273", - "managed": false, "references": [ { "id": "logs-*", @@ -842,8 +841,13 @@ "id": "logs-*", "name": "5f4a4c50-2b75-49e8-997e-996ed535715e:68046879-96c5-4615-950e-e40001e3bb9b", "type": "index-pattern" + }, + { + "id": "wiz-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" } ], "type": "dashboard", - "typeMigrationVersion": "8.9.0" + "typeMigrationVersion": "10.3.0" } \ No newline at end of file diff --git a/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json b/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json index 6ee96ee0c91..bbe46b17282 100644 --- a/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json +++ b/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json @@ -847,9 +847,8 @@ "version": 1 }, "coreMigrationVersion": "8.8.0", - "created_at": "2023-10-13T11:15:13.241Z", + "created_at": "2026-05-26T06:30:26.689Z", "id": "wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf", - "managed": false, "references": [ { "id": "logs-*", @@ -895,8 +894,13 @@ "id": "logs-*", "name": "bf85ce23-6dd3-4fc3-ad47-c9ae021c13f9:bb0be760-abd3-4359-a9fe-3efe5b0e4ef0", "type": "index-pattern" + }, + { + "id": "wiz-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" } ], "type": "dashboard", - "typeMigrationVersion": "8.9.0" + "typeMigrationVersion": "10.3.0" } \ No newline at end of file diff --git a/packages/wiz/kibana/search/wiz-f71321c0-a641-4411-a33e-f39569c2c7be.json b/packages/wiz/kibana/search/wiz-f71321c0-a641-4411-a33e-f39569c2c7be.json index cbe434cb82e..01f20ed7060 100644 --- a/packages/wiz/kibana/search/wiz-f71321c0-a641-4411-a33e-f39569c2c7be.json +++ b/packages/wiz/kibana/search/wiz-f71321c0-a641-4411-a33e-f39569c2c7be.json @@ -36,18 +36,20 @@ "title": "Detection Essential Details [Logs Wiz]" }, "coreMigrationVersion": "8.8.0", - "created_at": "2025-04-21T06:50:17.258Z", - "created_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", + "created_at": "2026-05-26T06:29:22.739Z", "id": "wiz-f71321c0-a641-4411-a33e-f39569c2c7be", - "managed": false, "references": [ { "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "wiz-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" } ], "type": "search", - "typeMigrationVersion": "10.5.0", - "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" + "typeMigrationVersion": "10.5.0" } \ No newline at end of file diff --git a/packages/wiz/kibana/tag/wiz-security-solution-default.json b/packages/wiz/kibana/tag/wiz-security-solution-default.json new file mode 100644 index 00000000000..601d720619e --- /dev/null +++ b/packages/wiz/kibana/tag/wiz-security-solution-default.json @@ -0,0 +1,13 @@ +{ + "attributes": { + "color": "#FEC514", + "description": "Tag defined in package-spec", + "name": "Security Solution" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-05-25T12:59:42.987Z", + "id": "wiz-security-solution-default", + "references": [], + "type": "tag", + "typeMigrationVersion": "8.0.0" +} \ No newline at end of file From 75246f0c81a1055793b4c131569a695e77897b90 Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Tue, 26 May 2026 10:50:56 +0200 Subject: [PATCH 15/21] Dashboards: use panel-level filters. --- ...-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json | 3272 ++++++++++------- ...-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json | 141 +- ...-d8f91a20-6363-11ee-a265-c3569aa0cebf.json | 141 +- ...-f661536e-81c2-455b-9a4f-9840d910c318.json | 85 + ...-f71321c0-a641-4411-a33e-f39569c2c7be.json | 55 - packages/wiz/validation.yml | 1 - 6 files changed, 2306 insertions(+), 1389 deletions(-) create mode 100644 packages/wiz/kibana/search/wiz-f661536e-81c2-455b-9a4f-9840d910c318.json delete mode 100644 packages/wiz/kibana/search/wiz-f71321c0-a641-4411-a33e-f39569c2c7be.json diff --git a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json index 017e03bc15f..a1180dd7d47 100644 --- a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json +++ b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json @@ -14,6 +14,7 @@ "explicitInput": { "dataViewId": "logs-*", "exclude": true, + "existsSelected": false, "fieldName": "event.action", "searchTechnique": "prefix", "selectedOptions": [], @@ -54,6 +55,7 @@ "existsSelected": false, "fieldName": "event.provider", "searchTechnique": "prefix", + "selectedOptions": [], "sort": { "by": "_count", "direction": "desc" @@ -71,30 +73,7 @@ "description": "This dashboard shows Detection Logs collected by the Wiz Defend integration.", "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "wiz.defend" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "wiz.defend" - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -109,13 +88,58 @@ "useMargins": true }, "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Wiz**\n\nWiz Defend\n\n[Wiz Cloud Configuration Finding](#/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368)\n\n[Wiz Vulnerability](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf)\n\n[Wiz Issue](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf)\n\n[Wiz Audit](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273)\n\n**Overview**\n\nThis dashboard provides visibility into detection events, enabling effective threat monitoring across cloud and container environments. It features a Control Panel for filtering by severity and trigger type, and includes visualizations such as detections over time, top cloud accounts, containers, and resource types with highest detections. It highlights trends by MITRE tactics and techniques, actor types, and trigger types through pie and bar charts, while a geographic map displays actor IP distribution. A table details triggering events, and additional tables showcase top threats, rules, and common malicious commands, supporting deeper investigation and response.\n\n[**Integrations Page**](/app/integrations/detail/wiz/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 35, + "i": "ced2a470-d1c8-4d56-9f70-e8d3aa6d81c4", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "ced2a470-d1c8-4d56-9f70-e8d3aa6d81c4", + "type": "visualization" + }, { "embeddableConfig": { "attributes": { "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-d5419375-833b-4eeb-8119-6950d64230d9", + "name": "indexpattern-datasource-layer-53610d78-e92c-427d-bfcf-374a2135f8e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e51064e9-6f6d-4b9e-b51b-bd7761849547", "type": "index-pattern" } ], @@ -123,41 +147,28 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "d5419375-833b-4eeb-8119-6950d64230d9": { + "53610d78-e92c-427d-bfcf-374a2135f8e3": { "columnOrder": [ - "ae333c2a-5a00-4008-89a6-969caf914e83", - "c6d798c8-accb-4ae1-975b-652a8eed2d07" + "2a335dea-e98d-4537-9d8b-5b305747306d", + "bcf37841-f643-449b-8367-7d53656c7da1" ], "columns": { - "ae333c2a-5a00-4008-89a6-969caf914e83": { + "2a335dea-e98d-4537-9d8b-5b305747306d": { "customLabel": true, - "dataType": "string", + "dataType": "date", "isBucketed": true, - "label": "Trigger Rule Names", - "operationType": "terms", + "label": "Detection Timestamp", + "operationType": "date_histogram", "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "c6d798c8-accb-4ae1-975b-652a8eed2d07", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 10 + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" }, - "scale": "ordinal", - "sourceField": "rule.name" + "scale": "interval", + "sourceField": "wiz.defend.created_at" }, - "c6d798c8-accb-4ae1-975b-652a8eed2d07": { + "bcf37841-f643-449b-8367-7d53656c7da1": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -176,80 +187,161 @@ "sourceField": "wiz.defend.id" } }, - "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e51064e9-6f6d-4b9e-b51b-bd7761849547", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "columns": [ - { - "alignment": "center", - "columnId": "c6d798c8-accb-4ae1-975b-652a8eed2d07", - "isMetric": true, - "isTransposed": false - }, + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "alignment": "center", - "columnId": "ae333c2a-5a00-4008-89a6-969caf914e83", - "isMetric": false, - "isTransposed": false + "accessors": [ + "bcf37841-f643-449b-8367-7d53656c7da1" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rules": [ + { + "type": "other" + } + ], + "touched": false + } + ] + }, + "layerId": "53610d78-e92c-427d-bfcf-374a2135f8e3", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "2a335dea-e98d-4537-9d8b-5b305747306d" } ], - "layerId": "d5419375-833b-4eeb-8119-6950d64230d9", - "layerType": "data" + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsXY" }, "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e51064e9-6f6d-4b9e-b51b-bd7761849547", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Detections over Time [Logs Wiz]" }, "gridData": { "h": 15, - "i": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc", - "w": 24, - "x": 24, - "y": 123 + "i": "cc20569b-60f2-4fc0-93cc-1152902c76a0", + "w": 40, + "x": 8, + "y": 0 }, - "panelIndex": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc", - "title": "Top 10 Trigger Rules with Highest Detections [Logs Wiz]", + "panelIndex": "cc20569b-60f2-4fc0-93cc-1152902c76a0", "type": "lens" }, { @@ -258,7 +350,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", + "name": "indexpattern-datasource-layer-f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1fe68821-6dda-4f6b-b47d-9cd824fef43d", "type": "index-pattern" } ], @@ -266,22 +363,21 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde": { + "f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c": { "columnOrder": [ - "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa", - "601214c5-35bf-44dd-8d1f-2e8a0334ee44" + "d4e3a535-a7cf-48ca-b284-ad56d5794f16", + "a6cebce0-c3fb-457b-832b-a0356ad54c2a" ], "columns": { - "601214c5-35bf-44dd-8d1f-2e8a0334ee44": { + "a6cebce0-c3fb-457b-832b-a0356ad54c2a": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "unique_count", "params": { - "emptyAsNull": true, + "emptyAsNull": false, "format": { "id": "number", "params": { @@ -290,13 +386,13 @@ } }, "scale": "ratio", - "sourceField": "event.id" + "sourceField": "wiz.defend.id" }, - "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa": { + "d4e3a535-a7cf-48ca-b284-ad56d5794f16": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Commands", + "label": "MITRE Techniques", "operationType": "terms", "params": { "exclude": [], @@ -305,94 +401,176 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "601214c5-35bf-44dd-8d1f-2e8a0334ee44", + "columnId": "a6cebce0-c3fb-457b-832b-a0356ad54c2a", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, + "otherBucket": true, "parentFormat": { "id": "terms" }, "size": 10 }, "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.command" + "sourceField": "threat.technique.id" } }, - "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1fe68821-6dda-4f6b-b47d-9cd824fef43d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "columns": [ - { - "alignment": "center", - "columnId": "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa", - "isMetric": false, - "isTransposed": false - }, + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "alignment": "center", - "columnId": "601214c5-35bf-44dd-8d1f-2e8a0334ee44", - "isMetric": true, - "isTransposed": false - } - ], - "layerId": "f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", - "layerType": "data" - } - }, - "title": "", + "accessors": [ + "a6cebce0-c3fb-457b-832b-a0356ad54c2a" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rules": [ + { + "type": "other" + } + ], + "touched": false + } + ] + }, + "layerId": "f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "d4e3a535-a7cf-48ca-b284-ad56d5794f16" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsXY" }, "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1fe68821-6dda-4f6b-b47d-9cd824fef43d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Detections by MITRE Techniques [Logs Wiz]" }, "gridData": { - "h": 15, - "i": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb", - "w": 24, - "x": 0, - "y": 123 + "h": 10, + "i": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e", + "w": 20, + "x": 8, + "y": 15 }, - "panelIndex": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb", - "title": "Top 10 Common Malicious Commands", + "panelIndex": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e", "type": "lens" }, { @@ -401,7 +579,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-d2b4912e-3ced-49ac-aa99-2969720e2f1f", + "name": "indexpattern-datasource-layer-65bbc691-ab9f-40f0-8258-66f28c54eeff", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e967ce57-1163-4382-ba57-bd40b7bacad3", "type": "index-pattern" } ], @@ -409,38 +592,18 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "d2b4912e-3ced-49ac-aa99-2969720e2f1f": { + "65bbc691-ab9f-40f0-8258-66f28c54eeff": { "columnOrder": [ - "68141a00-8b12-4f48-810a-1ff8b3eeabf7", - "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6", - "484781b7-7d30-4ad1-8b17-8e8e6abf9e40" + "08ae64da-5722-4701-b325-0d76a2e0d46b", + "09e064d7-68b4-4ee8-92b8-f71499245cd1" ], "columns": { - "484781b7-7d30-4ad1-8b17-8e8e6abf9e40": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "wiz.defend.id" - }, - "68141a00-8b12-4f48-810a-1ff8b3eeabf7": { + "08ae64da-5722-4701-b325-0d76a2e0d46b": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Container Name", + "label": "MITRE Tactic", "operationType": "terms", "params": { "exclude": [], @@ -449,153 +612,20 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", + "columnId": "09e064d7-68b4-4ee8-92b8-f71499245cd1", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, + "otherBucket": true, "parentFormat": { "id": "terms" }, "size": 10 }, "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.container.name" + "sourceField": "threat.tactic.id" }, - "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Container ID", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.container.id" - } - }, - "ignoreGlobalFilters": false, - "incompleteColumns": {}, - "indexPatternId": "logs-*", - "sampling": 1 - } - } - }, - "indexpattern": { - "currentIndexPatternId": "logs-*", - "layers": {} - }, - "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "alignment": "center", - "columnId": "68141a00-8b12-4f48-810a-1ff8b3eeabf7", - "isMetric": false, - "isTransposed": false - }, - { - "alignment": "center", - "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", - "isMetric": true, - "isTransposed": false - }, - { - "alignment": "center", - "columnId": "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6", - "isMetric": false, - "isTransposed": false - } - ], - "layerId": "d2b4912e-3ced-49ac-aa99-2969720e2f1f", - "layerType": "data", - "rowHeight": "auto", - "rowHeightLines": -1 - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false - }, - "gridData": { - "h": 15, - "i": "427510cc-fc9e-4691-9fac-4d5a3e377700", - "w": 24, - "x": 0, - "y": 108 - }, - "panelIndex": "427510cc-fc9e-4691-9fac-4d5a3e377700", - "title": "Top 10 Containers with Highest Detections [Logs Wiz]", - "type": "lens" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-76037f8d-37f5-405c-9974-6afefd777737", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "currentIndexPatternId": "logs-*", - "layers": { - "76037f8d-37f5-405c-9974-6afefd777737": { - "columnOrder": [ - "c645c311-34c1-415f-b5cf-2db750c4d709", - "226bbb04-3506-47e0-89e0-c4467ec25bef" - ], - "columns": { - "226bbb04-3506-47e0-89e0-c4467ec25bef": { + "09e064d7-68b4-4ee8-92b8-f71499245cd1": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -612,110 +642,163 @@ }, "scale": "ratio", "sourceField": "wiz.defend.id" - }, - "c645c311-34c1-415f-b5cf-2db750c4d709": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Resource Types", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "226bbb04-3506-47e0-89e0-c4467ec25bef", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.resources.type" } }, - "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e967ce57-1163-4382-ba57-bd40b7bacad3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "columns": [ - { - "alignment": "center", - "columnId": "c645c311-34c1-415f-b5cf-2db750c4d709", - "isMetric": false, - "isTransposed": false - }, + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "alignment": "center", - "columnId": "226bbb04-3506-47e0-89e0-c4467ec25bef", - "isMetric": true, - "isTransposed": false + "accessors": [ + "09e064d7-68b4-4ee8-92b8-f71499245cd1" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rules": [ + { + "type": "other" + } + ], + "touched": false + } + ] + }, + "layerId": "65bbc691-ab9f-40f0-8258-66f28c54eeff", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "08ae64da-5722-4701-b325-0d76a2e0d46b" } ], - "layerId": "76037f8d-37f5-405c-9974-6afefd777737", - "layerType": "data", - "rowHeight": "auto", - "rowHeightLines": -1 + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsXY" }, "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e967ce57-1163-4382-ba57-bd40b7bacad3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Detections by MITRE Tactic [Logs Wiz]" }, "gridData": { - "h": 15, - "i": "dc38a316-4a46-4c12-81d2-e78c90d1ceed", - "w": 24, - "x": 24, - "y": 108 + "h": 10, + "i": "1a0212e1-6df2-4187-8bb0-029f04f196d1", + "w": 20, + "x": 28, + "y": 15 }, - "panelIndex": "dc38a316-4a46-4c12-81d2-e78c90d1ceed", - "title": "Top 10 Resource Types with Highest Detections [Logs Wiz]", + "panelIndex": "1a0212e1-6df2-4187-8bb0-029f04f196d1", "type": "lens" }, { @@ -724,7 +807,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-c1458332-407f-40dc-85ca-3c69a75f6153", + "name": "indexpattern-datasource-layer-2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", "type": "index-pattern" } ], @@ -732,20 +820,18 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "c1458332-407f-40dc-85ca-3c69a75f6153": { + "2e38c3a3-9cb3-42f0-8264-5c0de2b7d151": { "columnOrder": [ - "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e", - "3f0dc38a-9424-4a96-8ac2-fd9de5aad734", - "466b3487-b5e1-461d-8b18-2d274ae72d05" + "442a0743-a4e1-4ab0-893b-ee248d2a2bf2", + "acb81f97-78f9-4aaf-903c-06ac7d34cf99" ], "columns": { - "3f0dc38a-9424-4a96-8ac2-fd9de5aad734": { + "442a0743-a4e1-4ab0-893b-ee248d2a2bf2": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Threat URL", + "label": "Affected Resource Types", "operationType": "terms", "params": { "exclude": [], @@ -754,20 +840,20 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", + "columnId": "acb81f97-78f9-4aaf-903c-06ac7d34cf99", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, + "otherBucket": true, "parentFormat": { "id": "terms" }, "size": 10 }, "scale": "ordinal", - "sourceField": "threat.indicator.reference" + "sourceField": "wiz.defend.triggering_event.resources.type" }, - "466b3487-b5e1-461d-8b18-2d274ae72d05": { + "acb81f97-78f9-4aaf-903c-06ac7d34cf99": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -783,119 +869,164 @@ } }, "scale": "ratio", - "sourceField": "wiz.defend.id" - }, - "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Threat ID", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "threat.indicator.id" + "sourceField": "event.id" } }, - "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "columns": [ - { - "alignment": "center", - "columnId": "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e", - "isMetric": false, - "isTransposed": false - }, - { - "alignment": "center", - "columnId": "3f0dc38a-9424-4a96-8ac2-fd9de5aad734", - "isMetric": false, - "isTransposed": false - }, + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "alignment": "center", - "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", - "isMetric": true, - "isTransposed": false + "accessors": [ + "acb81f97-78f9-4aaf-903c-06ac7d34cf99" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rules": [ + { + "type": "other" + } + ], + "touched": false + } + ] + }, + "layerId": "2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "442a0743-a4e1-4ab0-893b-ee248d2a2bf2" } ], - "headerRowHeight": "custom", - "headerRowHeightLines": 3, - "layerId": "c1458332-407f-40dc-85ca-3c69a75f6153", - "layerType": "data", - "rowHeight": "auto", - "rowHeightLines": -1 + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsXY" }, "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Affected Resources by Type [Logs Wiz]" }, "gridData": { - "h": 15, - "i": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44", - "w": 24, - "x": 0, - "y": 138 + "h": 10, + "i": "5249b0f0-30ea-472f-99e7-ebd31a239802", + "w": 40, + "x": 8, + "y": 25 }, - "panelIndex": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44", - "title": "Top 10 Detected Threats [Logs Wiz]", + "panelIndex": "5249b0f0-30ea-472f-99e7-ebd31a239802", "type": "lens" }, { @@ -904,7 +1035,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-5d7b131e-a2dc-453a-897a-c384a62a3fc6", + "name": "indexpattern-datasource-layer-6be8a450-9cac-43cb-a7e1-3b5b3f504af4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "12099fd9-f20a-4e2a-91d1-1b8aac061cad", "type": "index-pattern" } ], @@ -912,52 +1048,45 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "5d7b131e-a2dc-453a-897a-c384a62a3fc6": { + "6be8a450-9cac-43cb-a7e1-3b5b3f504af4": { "columnOrder": [ - "06e6d10f-51b4-458b-b70b-ace175849baf", - "9663e831-b7ed-474f-b699-34b54039c383", - "052b1acc-59b8-43f9-b9f6-d627732628a9" + "c462537a-e3f3-4542-9f21-c0cdb590f6ef", + "0f5de969-06b2-4d1a-9877-c174e448940a", + "d9b10eed-3ab7-4bda-b924-9406edf2306d" ], "columns": { - "052b1acc-59b8-43f9-b9f6-d627732628a9": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "event.id" - }, - "06e6d10f-51b4-458b-b70b-ace175849baf": { + "0f5de969-06b2-4d1a-9877-c174e448940a": { "customLabel": true, - "dataType": "date", + "dataType": "string", "isBucketed": true, - "label": "Triggering Event Time", - "operationType": "date_histogram", + "label": "Cloud Account ID", + "operationType": "terms", "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 }, - "scale": "interval", - "sourceField": "@timestamp" + "scale": "ordinal", + "sourceField": "wiz.defend.triggering_event.resources.cloud_account.id" }, - "9663e831-b7ed-474f-b699-34b54039c383": { + "c462537a-e3f3-4542-9f21-c0cdb590f6ef": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Triggering Event Source", + "label": "Cloud Platform", "operationType": "terms", "params": { "exclude": [], @@ -966,7 +1095,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "052b1acc-59b8-43f9-b9f6-d627732628a9", + "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", "type": "column" }, "orderDirection": "desc", @@ -974,36 +1103,67 @@ "parentFormat": { "id": "terms" }, - "secondaryFields": [], - "size": 20 + "size": 10 }, "scale": "ordinal", - "sourceField": "event.provider" + "sourceField": "wiz.defend.triggering_event.resources.cloud_account.cloud_platform" + }, + "d9b10eed-3ab7-4bda-b924-9406edf2306d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "wiz.defend.id" } }, "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "12099fd9-f20a-4e2a-91d1-1b8aac061cad", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", @@ -1013,25 +1173,29 @@ "columns": [ { "alignment": "center", - "columnId": "052b1acc-59b8-43f9-b9f6-d627732628a9", - "isMetric": true, + "columnId": "c462537a-e3f3-4542-9f21-c0cdb590f6ef", + "isMetric": false, "isTransposed": false }, { "alignment": "center", - "columnId": "06e6d10f-51b4-458b-b70b-ace175849baf", - "isMetric": false, + "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", + "isMetric": true, "isTransposed": false }, { "alignment": "center", - "columnId": "9663e831-b7ed-474f-b699-34b54039c383", + "columnId": "0f5de969-06b2-4d1a-9877-c174e448940a", "isMetric": false, "isTransposed": false } ], - "layerId": "5d7b131e-a2dc-453a-897a-c384a62a3fc6", - "layerType": "data" + "headerRowHeight": "custom", + "headerRowHeightLines": 3, + "layerId": "6be8a450-9cac-43cb-a7e1-3b5b3f504af4", + "layerType": "data", + "rowHeight": "auto", + "rowHeightLines": -1 } }, "title": "", @@ -1043,46 +1207,48 @@ "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "12099fd9-f20a-4e2a-91d1-1b8aac061cad", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false - }, - "gridData": { - "h": 15, - "i": "77df9a6b-af9e-412f-a916-fc83bd7c3194", - "w": 24, - "x": 24, - "y": 138 - }, - "panelIndex": "77df9a6b-af9e-412f-a916-fc83bd7c3194", - "title": "Detection Triggering Event Details [Logs Wiz]", - "type": "lens" - }, - { - "embeddableConfig": { - "description": "", - "enhancements": { - "dynamicActions": { - "events": [] - } - } + "syncTooltips": false, + "title": "Top 10 Cloud Accounts with Highest Detections [Logs Wiz]" }, "gridData": { - "h": 14, - "i": "bb78eccf-6271-4494-a767-bb65bf1cbdc0", + "h": 12, + "i": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518", "w": 48, "x": 0, - "y": 153 + "y": 35 }, - "panelIndex": "bb78eccf-6271-4494-a767-bb65bf1cbdc0", - "panelRefName": "panel_bb78eccf-6271-4494-a767-bb65bf1cbdc0", - "title": "Detection Essential Details [Logs Wiz]", - "type": "search" + "panelIndex": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518", + "type": "lens" }, { "embeddableConfig": { @@ -1090,7 +1256,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-53610d78-e92c-427d-bfcf-374a2135f8e3", + "name": "indexpattern-datasource-layer-a954312a-b2e7-4160-8c32-42fdbaa7c639", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "38a738be-567c-4797-b05f-ad81ae8860f3", "type": "index-pattern" } ], @@ -1098,96 +1269,98 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "53610d78-e92c-427d-bfcf-374a2135f8e3": { + "a954312a-b2e7-4160-8c32-42fdbaa7c639": { "columnOrder": [ - "2a335dea-e98d-4537-9d8b-5b305747306d", - "bcf37841-f643-449b-8367-7d53656c7da1" + "cd325623-f160-42ec-92c2-029282ad3708", + "aac53614-9481-4184-a12b-ce05ec5924ce" ], "columns": { - "2a335dea-e98d-4537-9d8b-5b305747306d": { - "customLabel": true, - "dataType": "date", - "isBucketed": true, - "label": "Detection Timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "wiz.defend.created_at" - }, - "bcf37841-f643-449b-8367-7d53656c7da1": { + "aac53614-9481-4184-a12b-ce05ec5924ce": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "unique_count", "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } + "emptyAsNull": false }, "scale": "ratio", - "sourceField": "wiz.defend.id" + "sourceField": "event.id" + }, + "cd325623-f160-42ec-92c2-029282ad3708": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Detection Event Source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "aac53614-9481-4184-a12b-ce05ec5924ce", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.provider" } }, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "38a738be-567c-4797-b05f-ad81ae8860f3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "Linear", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, "layers": [ { - "accessors": [ - "bcf37841-f643-449b-8367-7d53656c7da1" - ], + "categoryDisplay": "default", "colorMapping": { "assignments": [], "colorMode": { @@ -1199,62 +1372,84 @@ "color": { "type": "loop" }, - "rule": { - "type": "other" - }, + "rules": [ + { + "type": "other" + } + ], "touched": false } ] }, - "layerId": "53610d78-e92c-427d-bfcf-374a2135f8e3", + "emptySizeRatio": 0, + "layerId": "a954312a-b2e7-4160-8c32-42fdbaa7c639", "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "xAccessor": "2a335dea-e98d-4537-9d8b-5b305747306d" + "legendDisplay": "show", + "legendSize": "xlarge", + "metrics": [ + "aac53614-9481-4184-a12b-ce05ec5924ce" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "cd325623-f160-42ec-92c2-029282ad3708" + ], + "truncateLegend": false } ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false - }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" + "shape": "donut" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsPie" }, "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "38a738be-567c-4797-b05f-ad81ae8860f3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Detection Source Distribution [Logs Wiz]" }, "gridData": { - "h": 15, - "i": "cc20569b-60f2-4fc0-93cc-1152902c76a0", - "w": 40, - "x": 8, - "y": 0 + "h": 18, + "i": "d1455288-89ba-4146-b530-dda7f9663bbc", + "w": 26, + "x": 0, + "y": 47 }, - "panelIndex": "cc20569b-60f2-4fc0-93cc-1152902c76a0", - "title": "Detections over Time [Logs Wiz]", + "panelIndex": "d1455288-89ba-4146-b530-dda7f9663bbc", "type": "lens" }, { @@ -1263,7 +1458,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-65bbc691-ab9f-40f0-8258-66f28c54eeff", + "name": "indexpattern-datasource-layer-9722040c-5b00-410c-a720-87bfb162c84a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ae446cbc-21c9-4c28-9188-8745078e3f68", "type": "index-pattern" } ], @@ -1272,17 +1472,29 @@ "datasourceStates": { "formBased": { "layers": { - "65bbc691-ab9f-40f0-8258-66f28c54eeff": { + "9722040c-5b00-410c-a720-87bfb162c84a": { "columnOrder": [ - "08ae64da-5722-4701-b325-0d76a2e0d46b", - "09e064d7-68b4-4ee8-92b8-f71499245cd1" + "e22cefb5-f7de-422d-a95b-4a2f3f552eec", + "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7" ], "columns": { - "08ae64da-5722-4701-b325-0d76a2e0d46b": { + "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "wiz.defend.id" + }, + "e22cefb5-f7de-422d-a95b-4a2f3f552eec": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "MITRE Tactic", + "label": "Triggering Types", "operationType": "terms", "params": { "exclude": [], @@ -1291,7 +1503,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "09e064d7-68b4-4ee8-92b8-f71499245cd1", + "columnId": "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7", "type": "column" }, "orderDirection": "desc", @@ -1299,28 +1511,10 @@ "parentFormat": { "id": "terms" }, - "size": 10 + "size": 5 }, "scale": "ordinal", - "sourceField": "threat.tactic.id" - }, - "09e064d7-68b4-4ee8-92b8-f71499245cd1": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "wiz.defend.id" + "sourceField": "event.action" } }, "incompleteColumns": {}, @@ -1335,34 +1529,39 @@ "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ae446cbc-21c9-4c28-9188-8745078e3f68", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "Linear", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, "layers": [ { - "accessors": [ - "09e064d7-68b4-4ee8-92b8-f71499245cd1" - ], + "categoryDisplay": "default", "colorMapping": { "assignments": [], "colorMode": { @@ -1374,62 +1573,83 @@ "color": { "type": "loop" }, - "rule": { - "type": "other" - }, + "rules": [ + { + "type": "other" + } + ], "touched": false } ] }, - "layerId": "65bbc691-ab9f-40f0-8258-66f28c54eeff", + "emptySizeRatio": 0, + "layerId": "9722040c-5b00-410c-a720-87bfb162c84a", "layerType": "data", - "position": "top", - "seriesType": "bar_horizontal_stacked", - "showGridlines": false, - "xAccessor": "08ae64da-5722-4701-b325-0d76a2e0d46b" + "legendDisplay": "show", + "metrics": [ + "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "e22cefb5-f7de-422d-a95b-4a2f3f552eec" + ], + "truncateLegend": false } ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" + "shape": "donut" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsPie" }, "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ae446cbc-21c9-4c28-9188-8745078e3f68", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Detections by Trigger Type [Logs Wiz]" }, "gridData": { - "h": 10, - "i": "1a0212e1-6df2-4187-8bb0-029f04f196d1", - "w": 20, - "x": 28, - "y": 15 + "h": 18, + "i": "ace8bb17-267f-4942-9748-17f9f10749e0", + "w": 22, + "x": 26, + "y": 47 }, - "panelIndex": "1a0212e1-6df2-4187-8bb0-029f04f196d1", - "title": "Detections by MITRE Tactic [Logs Wiz]", + "panelIndex": "ace8bb17-267f-4942-9748-17f9f10749e0", "type": "lens" }, { @@ -1438,7 +1658,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", + "name": "indexpattern-datasource-layer-84a5677b-c5e3-4940-8c67-7576961e2f79", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "777e84d3-528b-4286-9354-551204c418e8", "type": "index-pattern" } ], @@ -1446,37 +1671,18 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c": { + "84a5677b-c5e3-4940-8c67-7576961e2f79": { "columnOrder": [ - "d4e3a535-a7cf-48ca-b284-ad56d5794f16", - "a6cebce0-c3fb-457b-832b-a0356ad54c2a" + "53ccfb54-7eaa-49da-99b1-912239fea452", + "72f83e5b-995e-44a3-8165-cdbffbe48c55" ], "columns": { - "a6cebce0-c3fb-457b-832b-a0356ad54c2a": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "wiz.defend.id" - }, - "d4e3a535-a7cf-48ca-b284-ad56d5794f16": { + "53ccfb54-7eaa-49da-99b1-912239fea452": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "MITRE Techniques", + "label": "Severity", "operationType": "terms", "params": { "exclude": [], @@ -1485,7 +1691,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "a6cebce0-c3fb-457b-832b-a0356ad54c2a", + "columnId": "72f83e5b-995e-44a3-8165-cdbffbe48c55", "type": "column" }, "orderDirection": "desc", @@ -1493,61 +1699,75 @@ "parentFormat": { "id": "terms" }, - "size": 10 + "size": 5 }, "scale": "ordinal", - "sourceField": "threat.technique.id" + "sourceField": "wiz.defend.severity" + }, + "72f83e5b-995e-44a3-8165-cdbffbe48c55": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "wiz.defend.id" } }, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "777e84d3-528b-4286-9354-551204c418e8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "Linear", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, "layers": [ { - "accessors": [ - "a6cebce0-c3fb-457b-832b-a0356ad54c2a" - ], + "categoryDisplay": "default", "colorMapping": { "assignments": [], "colorMode": { @@ -1559,104 +1779,84 @@ "color": { "type": "loop" }, - "rule": { - "type": "other" - }, + "rules": [ + { + "type": "other" + } + ], "touched": false } ] }, - "layerId": "f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", + "emptySizeRatio": 0, + "layerId": "84a5677b-c5e3-4940-8c67-7576961e2f79", "layerType": "data", - "position": "top", - "seriesType": "bar_horizontal_stacked", - "showGridlines": false, - "xAccessor": "d4e3a535-a7cf-48ca-b284-ad56d5794f16" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false, - "showSingleSeries": false - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false - }, - "gridData": { - "h": 10, - "i": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e", - "w": 20, - "x": 8, - "y": 15 - }, - "panelIndex": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e", - "title": "Detections by MITRE Techniques [Logs Wiz]", - "type": "lens" - }, - { - "embeddableConfig": { + "legendDisplay": "show", + "metrics": [ + "72f83e5b-995e-44a3-8165-cdbffbe48c55" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "53ccfb54-7eaa-49da-99b1-912239fea452" + ], + "truncateLegend": false + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, "enhancements": { "dynamicActions": { "events": [] } }, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "777e84d3-528b-4286-9354-551204c418e8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" } } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "**Navigation**\n\n**Wiz**\n\nWiz Defend\n\n[Wiz Cloud Configuration Finding](#/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368)\n\n[Wiz Vulnerability](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf)\n\n[Wiz Issue](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf)\n\n[Wiz Audit](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273)\n\n**Overview**\n\nThis dashboard provides visibility into detection events, enabling effective threat monitoring across cloud and container environments. It features a Control Panel for filtering by severity and trigger type, and includes visualizations such as detections over time, top cloud accounts, containers, and resource types with highest detections. It highlights trends by MITRE tactics and techniques, actor types, and trigger types through pie and bar charts, while a geographic map displays actor IP distribution. A table details triggering events, and additional tables showcase top threats, rules, and common malicious commands, supporting deeper investigation and response.\n\n[**Integrations Page**](/app/integrations/detail/wiz/overview)", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "title": "Detections by Severity [Logs Wiz]" }, "gridData": { - "h": 35, - "i": "ced2a470-d1c8-4d56-9f70-e8d3aa6d81c4", - "w": 8, + "h": 18, + "i": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c", + "w": 26, "x": 0, - "y": 0 + "y": 65 }, - "panelIndex": "ced2a470-d1c8-4d56-9f70-e8d3aa6d81c4", - "type": "visualization" + "panelIndex": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c", + "type": "lens" }, { "embeddableConfig": { @@ -1666,13 +1866,17 @@ "id": "logs-*", "name": "indexpattern-datasource-layer-a7a27126-b5e1-48de-9cc0-c71a01b1a1e6", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b490fb92-e24a-4835-8efb-9c185a528006", + "type": "index-pattern" } ], "state": { "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { "a7a27126-b5e1-48de-9cc0-c71a01b1a1e6": { "columnOrder": [ @@ -1726,27 +1930,41 @@ } }, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b490fb92-e24a-4835-8efb-9c185a528006", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", @@ -1767,9 +1985,11 @@ "color": { "type": "loop" }, - "rule": { - "type": "other" - }, + "rules": [ + { + "type": "other" + } + ], "touched": false } ] @@ -1802,14 +2022,38 @@ "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b490fb92-e24a-4835-8efb-9c185a528006", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Detections by Actor Type [Logs Wiz]" }, "gridData": { "h": 18, @@ -1819,7 +2063,6 @@ "y": 65 }, "panelIndex": "4ce47b03-10cc-4fe3-9de3-c239e5184334", - "title": "Detections by Actor Type [Logs Wiz]", "type": "lens" }, { @@ -1828,7 +2071,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-a954312a-b2e7-4160-8c32-42fdbaa7c639", + "name": "indexpattern-datasource-layer-f9c7cfa2-0061-466f-8909-040b89ecd361", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "26a8762b-bd10-43a6-b632-1fc52b649c46", "type": "index-pattern" } ], @@ -1836,15 +2084,14 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "a954312a-b2e7-4160-8c32-42fdbaa7c639": { + "f9c7cfa2-0061-466f-8909-040b89ecd361": { "columnOrder": [ - "cd325623-f160-42ec-92c2-029282ad3708", - "aac53614-9481-4184-a12b-ce05ec5924ce" + "dff56fec-70cc-4d6d-8a79-5c2794322a5a", + "9e564606-3929-45ec-91ac-71dbacc739e3" ], "columns": { - "aac53614-9481-4184-a12b-ce05ec5924ce": { + "9e564606-3929-45ec-91ac-71dbacc739e3": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -1856,11 +2103,11 @@ "scale": "ratio", "sourceField": "event.id" }, - "cd325623-f160-42ec-92c2-029282ad3708": { + "dff56fec-70cc-4d6d-8a79-5c2794322a5a": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Detection Event Source", + "label": "Country ISO Code", "operationType": "terms", "params": { "exclude": [], @@ -1869,7 +2116,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "aac53614-9481-4184-a12b-ce05ec5924ce", + "columnId": "9e564606-3929-45ec-91ac-71dbacc739e3", "type": "column" }, "orderDirection": "desc", @@ -1881,104 +2128,327 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "event.provider" + "sourceField": "source.geo.country_iso_code" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "26a8762b-bd10-43a6-b632-1fc52b649c46", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "f9c7cfa2-0061-466f-8909-040b89ecd361", + "layerType": "data", + "regionAccessor": "dff56fec-70cc-4d6d-8a79-5c2794322a5a", + "valueAccessor": "9e564606-3929-45ec-91ac-71dbacc739e3" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsChoropleth" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "26a8762b-bd10-43a6-b632-1fc52b649c46", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "title": "Detections by Actor IP [Logs Wiz]" + }, + "gridData": { + "h": 25, + "i": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7", + "w": 48, + "x": 0, + "y": 83 + }, + "panelIndex": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d2b4912e-3ced-49ac-aa99-2969720e2f1f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d2b4912e-3ced-49ac-aa99-2969720e2f1f": { + "columnOrder": [ + "68141a00-8b12-4f48-810a-1ff8b3eeabf7", + "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6", + "484781b7-7d30-4ad1-8b17-8e8e6abf9e40" + ], + "columns": { + "484781b7-7d30-4ad1-8b17-8e8e6abf9e40": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "wiz.defend.id" + }, + "68141a00-8b12-4f48-810a-1ff8b3eeabf7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Container Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.container.name" + }, + "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Container ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.container.id" } }, + "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "emptySizeRatio": 0, - "layerId": "a954312a-b2e7-4160-8c32-42fdbaa7c639", - "layerType": "data", - "legendDisplay": "show", - "legendSize": "xlarge", - "metrics": [ - "aac53614-9481-4184-a12b-ce05ec5924ce" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "cd325623-f160-42ec-92c2-029282ad3708" - ], - "truncateLegend": false + "alignment": "center", + "columnId": "68141a00-8b12-4f48-810a-1ff8b3eeabf7", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6", + "isMetric": false, + "isTransposed": false } ], - "shape": "donut" + "layerId": "d2b4912e-3ced-49ac-aa99-2969720e2f1f", + "layerType": "data", + "rowHeight": "auto", + "rowHeightLines": -1 } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsDatatable" }, "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Top 10 Containers with Highest Detections [Logs Wiz]" }, "gridData": { - "h": 18, - "i": "d1455288-89ba-4146-b530-dda7f9663bbc", - "w": 26, + "h": 15, + "i": "427510cc-fc9e-4691-9fac-4d5a3e377700", + "w": 24, "x": 0, - "y": 47 + "y": 108 }, - "panelIndex": "d1455288-89ba-4146-b530-dda7f9663bbc", - "title": "Detection Source Distribution [Logs Wiz]", + "panelIndex": "427510cc-fc9e-4691-9fac-4d5a3e377700", "type": "lens" }, { @@ -1987,7 +2457,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-9722040c-5b00-410c-a720-87bfb162c84a", + "name": "indexpattern-datasource-layer-76037f8d-37f5-405c-9974-6afefd777737", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", "type": "index-pattern" } ], @@ -1995,31 +2470,36 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "9722040c-5b00-410c-a720-87bfb162c84a": { + "76037f8d-37f5-405c-9974-6afefd777737": { "columnOrder": [ - "e22cefb5-f7de-422d-a95b-4a2f3f552eec", - "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7" + "c645c311-34c1-415f-b5cf-2db750c4d709", + "226bbb04-3506-47e0-89e0-c4467ec25bef" ], "columns": { - "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7": { + "226bbb04-3506-47e0-89e0-c4467ec25bef": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "unique_count", "params": { - "emptyAsNull": false + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } }, "scale": "ratio", "sourceField": "wiz.defend.id" }, - "e22cefb5-f7de-422d-a95b-4a2f3f552eec": { + "c645c311-34c1-415f-b5cf-2db750c4d709": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Triggering Types", + "label": "Resource Types", "operationType": "terms", "params": { "exclude": [], @@ -2028,114 +2508,133 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7", + "columnId": "226bbb04-3506-47e0-89e0-c4467ec25bef", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "event.action" + "sourceField": "wiz.defend.triggering_event.resources.type" } }, + "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "emptySizeRatio": 0, - "layerId": "9722040c-5b00-410c-a720-87bfb162c84a", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "e22cefb5-f7de-422d-a95b-4a2f3f552eec" - ], - "truncateLegend": false + "alignment": "center", + "columnId": "c645c311-34c1-415f-b5cf-2db750c4d709", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "226bbb04-3506-47e0-89e0-c4467ec25bef", + "isMetric": true, + "isTransposed": false } ], - "shape": "donut" + "layerId": "76037f8d-37f5-405c-9974-6afefd777737", + "layerType": "data", + "rowHeight": "auto", + "rowHeightLines": -1 } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsDatatable" }, "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Top 10 Resource Types with Highest Detections [Logs Wiz]" }, "gridData": { - "h": 18, - "i": "ace8bb17-267f-4942-9748-17f9f10749e0", - "w": 22, - "x": 26, - "y": 47 + "h": 15, + "i": "dc38a316-4a46-4c12-81d2-e78c90d1ceed", + "w": 24, + "x": 24, + "y": 108 }, - "panelIndex": "ace8bb17-267f-4942-9748-17f9f10749e0", - "title": "Detections by Trigger Type [Logs Wiz]", + "panelIndex": "dc38a316-4a46-4c12-81d2-e78c90d1ceed", "type": "lens" }, { @@ -2144,7 +2643,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-84a5677b-c5e3-4940-8c67-7576961e2f79", + "name": "indexpattern-datasource-layer-f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7e48aaab-bddd-4e61-b73d-44dfa9464bd8", "type": "index-pattern" } ], @@ -2152,19 +2656,36 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "84a5677b-c5e3-4940-8c67-7576961e2f79": { + "f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde": { "columnOrder": [ - "53ccfb54-7eaa-49da-99b1-912239fea452", - "72f83e5b-995e-44a3-8165-cdbffbe48c55" + "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa", + "601214c5-35bf-44dd-8d1f-2e8a0334ee44" ], "columns": { - "53ccfb54-7eaa-49da-99b1-912239fea452": { + "601214c5-35bf-44dd-8d1f-2e8a0334ee44": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "event.id" + }, + "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Severity", + "label": "Commands", "operationType": "terms", "params": { "exclude": [], @@ -2173,132 +2694,131 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "72f83e5b-995e-44a3-8165-cdbffbe48c55", + "columnId": "601214c5-35bf-44dd-8d1f-2e8a0334ee44", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "wiz.defend.severity" - }, - "72f83e5b-995e-44a3-8165-cdbffbe48c55": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "wiz.defend.id" + "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.command" } }, + "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7e48aaab-bddd-4e61-b73d-44dfa9464bd8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "emptySizeRatio": 0, - "layerId": "84a5677b-c5e3-4940-8c67-7576961e2f79", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "72f83e5b-995e-44a3-8165-cdbffbe48c55" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "53ccfb54-7eaa-49da-99b1-912239fea452" - ], - "truncateLegend": false + "alignment": "center", + "columnId": "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "601214c5-35bf-44dd-8d1f-2e8a0334ee44", + "isMetric": true, + "isTransposed": false } ], - "shape": "donut" + "layerId": "f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", + "layerType": "data" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsDatatable" }, "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7e48aaab-bddd-4e61-b73d-44dfa9464bd8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Top 10 Common Malicious Commands" }, "gridData": { - "h": 18, - "i": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c", - "w": 26, + "h": 15, + "i": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb", + "w": 24, "x": 0, - "y": 65 + "y": 123 }, - "panelIndex": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c", - "title": "Detections by Severity [Logs Wiz]", + "panelIndex": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb", "type": "lens" }, { @@ -2307,7 +2827,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", + "name": "indexpattern-datasource-layer-d5419375-833b-4eeb-8119-6950d64230d9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dd22aafe-d388-43b7-9646-0403aaee81a7", "type": "index-pattern" } ], @@ -2315,19 +2840,18 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "2e38c3a3-9cb3-42f0-8264-5c0de2b7d151": { + "d5419375-833b-4eeb-8119-6950d64230d9": { "columnOrder": [ - "442a0743-a4e1-4ab0-893b-ee248d2a2bf2", - "acb81f97-78f9-4aaf-903c-06ac7d34cf99" + "ae333c2a-5a00-4008-89a6-969caf914e83", + "c6d798c8-accb-4ae1-975b-652a8eed2d07" ], "columns": { - "442a0743-a4e1-4ab0-893b-ee248d2a2bf2": { + "ae333c2a-5a00-4008-89a6-969caf914e83": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Affected Resource Types", + "label": "Trigger Rule Names", "operationType": "terms", "params": { "exclude": [], @@ -2336,7 +2860,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "acb81f97-78f9-4aaf-903c-06ac7d34cf99", + "columnId": "c6d798c8-accb-4ae1-975b-652a8eed2d07", "type": "column" }, "orderDirection": "desc", @@ -2347,9 +2871,9 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.resources.type" + "sourceField": "rule.name" }, - "acb81f97-78f9-4aaf-903c-06ac7d34cf99": { + "c6d798c8-accb-4ae1-975b-652a8eed2d07": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -2365,125 +2889,120 @@ } }, "scale": "ratio", - "sourceField": "event.id" + "sourceField": "wiz.defend.id" } }, + "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "dd22aafe-d388-43b7-9646-0403aaee81a7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "Linear", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ + "columns": [ { - "accessors": [ - "acb81f97-78f9-4aaf-903c-06ac7d34cf99" - ], - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rule": { - "type": "other" - }, - "touched": false - } - ] - }, - "layerId": "2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", - "layerType": "data", - "position": "top", - "seriesType": "bar_horizontal_stacked", - "showGridlines": false, - "xAccessor": "442a0743-a4e1-4ab0-893b-ee248d2a2bf2" + "alignment": "center", + "columnId": "c6d798c8-accb-4ae1-975b-652a8eed2d07", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "ae333c2a-5a00-4008-89a6-969caf914e83", + "isMetric": false, + "isTransposed": false } ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": true - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" + "layerId": "d5419375-833b-4eeb-8119-6950d64230d9", + "layerType": "data" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsDatatable" }, "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "dd22aafe-d388-43b7-9646-0403aaee81a7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Top 10 Trigger Rules with Highest Detections [Logs Wiz]" }, "gridData": { - "h": 10, - "i": "5249b0f0-30ea-472f-99e7-ebd31a239802", - "w": 40, - "x": 8, - "y": 25 + "h": 15, + "i": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc", + "w": 24, + "x": 24, + "y": 123 }, - "panelIndex": "5249b0f0-30ea-472f-99e7-ebd31a239802", - "title": "Affected Resources by Type [Logs Wiz]", + "panelIndex": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc", "type": "lens" }, { @@ -2492,7 +3011,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-6be8a450-9cac-43cb-a7e1-3b5b3f504af4", + "name": "indexpattern-datasource-layer-c1458332-407f-40dc-85ca-3c69a75f6153", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", "type": "index-pattern" } ], @@ -2500,20 +3024,19 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "6be8a450-9cac-43cb-a7e1-3b5b3f504af4": { + "c1458332-407f-40dc-85ca-3c69a75f6153": { "columnOrder": [ - "c462537a-e3f3-4542-9f21-c0cdb590f6ef", - "0f5de969-06b2-4d1a-9877-c174e448940a", - "d9b10eed-3ab7-4bda-b924-9406edf2306d" + "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e", + "3f0dc38a-9424-4a96-8ac2-fd9de5aad734", + "466b3487-b5e1-461d-8b18-2d274ae72d05" ], "columns": { - "0f5de969-06b2-4d1a-9877-c174e448940a": { + "3f0dc38a-9424-4a96-8ac2-fd9de5aad734": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Cloud Account ID", + "label": "Threat URL", "operationType": "terms", "params": { "exclude": [], @@ -2522,7 +3045,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", + "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", "type": "column" }, "orderDirection": "desc", @@ -2533,13 +3056,31 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.resources.cloud_account.id" + "sourceField": "threat.indicator.reference" }, - "c462537a-e3f3-4542-9f21-c0cdb590f6ef": { + "466b3487-b5e1-461d-8b18-2d274ae72d05": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "wiz.defend.id" + }, + "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Cloud Platform", + "label": "Threat ID", "operationType": "terms", "params": { "exclude": [], @@ -2548,7 +3089,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", + "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", "type": "column" }, "orderDirection": "desc", @@ -2559,50 +3100,46 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.resources.cloud_account.cloud_platform" - }, - "d9b10eed-3ab7-4bda-b924-9406edf2306d": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "wiz.defend.id" + "sourceField": "threat.indicator.id" } }, "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", @@ -2612,26 +3149,26 @@ "columns": [ { "alignment": "center", - "columnId": "c462537a-e3f3-4542-9f21-c0cdb590f6ef", + "columnId": "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e", "isMetric": false, "isTransposed": false }, { "alignment": "center", - "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", - "isMetric": true, + "columnId": "3f0dc38a-9424-4a96-8ac2-fd9de5aad734", + "isMetric": false, "isTransposed": false }, { "alignment": "center", - "columnId": "0f5de969-06b2-4d1a-9877-c174e448940a", - "isMetric": false, + "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", + "isMetric": true, "isTransposed": false } ], "headerRowHeight": "custom", "headerRowHeightLines": 3, - "layerId": "6be8a450-9cac-43cb-a7e1-3b5b3f504af4", + "layerId": "c1458332-407f-40dc-85ca-3c69a75f6153", "layerType": "data", "rowHeight": "auto", "rowHeightLines": -1 @@ -2646,24 +3183,47 @@ "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Top 10 Detected Threats [Logs Wiz]" }, "gridData": { - "h": 12, - "i": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518", - "w": 48, + "h": 15, + "i": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44", + "w": 24, "x": 0, - "y": 35 + "y": 138 }, - "panelIndex": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518", - "title": "Top 10 Cloud Accounts with Highest Detections [Logs Wiz]", + "panelIndex": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44", "type": "lens" }, { @@ -2672,7 +3232,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-f9c7cfa2-0061-466f-8909-040b89ecd361", + "name": "indexpattern-datasource-layer-5d7b131e-a2dc-453a-897a-c384a62a3fc6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cd797741-fccc-48de-879a-37abf3c5f1eb", "type": "index-pattern" } ], @@ -2680,31 +3245,51 @@ "adHocDataViews": {}, "datasourceStates": { "formBased": { - "currentIndexPatternId": "logs-*", "layers": { - "f9c7cfa2-0061-466f-8909-040b89ecd361": { + "5d7b131e-a2dc-453a-897a-c384a62a3fc6": { "columnOrder": [ - "dff56fec-70cc-4d6d-8a79-5c2794322a5a", - "9e564606-3929-45ec-91ac-71dbacc739e3" + "06e6d10f-51b4-458b-b70b-ace175849baf", + "9663e831-b7ed-474f-b699-34b54039c383", + "052b1acc-59b8-43f9-b9f6-d627732628a9" ], "columns": { - "9e564606-3929-45ec-91ac-71dbacc739e3": { + "052b1acc-59b8-43f9-b9f6-d627732628a9": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "unique_count", "params": { - "emptyAsNull": false + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } }, "scale": "ratio", "sourceField": "event.id" }, - "dff56fec-70cc-4d6d-8a79-5c2794322a5a": { + "06e6d10f-51b4-458b-b70b-ace175849baf": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Triggering Event Time", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9663e831-b7ed-474f-b699-34b54039c383": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Country ISO Code", + "label": "Triggering Event Source", "operationType": "terms", "params": { "exclude": [], @@ -2713,84 +3298,161 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "9e564606-3929-45ec-91ac-71dbacc739e3", + "columnId": "052b1acc-59b8-43f9-b9f6-d627732628a9", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, "secondaryFields": [], - "size": 5 + "size": 20 }, "scale": "ordinal", - "sourceField": "source.geo.country_iso_code" + "sourceField": "event.provider" } }, "ignoreGlobalFilters": false, "incompleteColumns": {}, - "indexPatternId": "logs-*", "sampling": 1 } } }, "indexpattern": { - "currentIndexPatternId": "logs-*", "layers": {} }, "textBased": { - "indexPatternRefs": [ - { - "id": "logs-*", - "timeField": "@timestamp", - "title": "logs-*" - } - ], "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "cd797741-fccc-48de-879a-37abf3c5f1eb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layerId": "f9c7cfa2-0061-466f-8909-040b89ecd361", - "layerType": "data", - "regionAccessor": "dff56fec-70cc-4d6d-8a79-5c2794322a5a", - "valueAccessor": "9e564606-3929-45ec-91ac-71dbacc739e3" + "columns": [ + { + "alignment": "center", + "columnId": "052b1acc-59b8-43f9-b9f6-d627732628a9", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "06e6d10f-51b4-458b-b70b-ace175849baf", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "9663e831-b7ed-474f-b699-34b54039c383", + "isMetric": false, + "isTransposed": false + } + ], + "layerId": "5d7b131e-a2dc-453a-897a-c384a62a3fc6", + "layerType": "data" } }, "title": "", "type": "lens", - "visualizationType": "lnsChoropleth" + "visualizationType": "lnsDatatable" }, "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "cd797741-fccc-48de-879a-37abf3c5f1eb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, - "syncTooltips": false + "syncTooltips": false, + "title": "Detection Triggering Event Details [Logs Wiz]" }, "gridData": { - "h": 25, - "i": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7", + "h": 15, + "i": "77df9a6b-af9e-412f-a916-fc83bd7c3194", + "w": 24, + "x": 24, + "y": 138 + }, + "panelIndex": "77df9a6b-af9e-412f-a916-fc83bd7c3194", + "type": "lens" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedObjectId": "f661536e-81c2-455b-9a4f-9840d910c318", + "title": "Detection Essential Details [Logs Wiz]" + }, + "gridData": { + "h": 15, + "i": "022a726e-0fc7-4cee-8fe8-42bd959353e2", "w": 48, "x": 0, - "y": 83 + "y": 153 }, - "panelIndex": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7", - "title": "Detections by Actor IP [Logs Wiz]", - "type": "lens" + "panelIndex": "022a726e-0fc7-4cee-8fe8-42bd959353e2", + "panelRefName": "panel_022a726e-0fc7-4cee-8fe8-42bd959353e2", + "type": "search" } ], "timeRestore": false, @@ -2801,74 +3463,79 @@ "created_at": "2026-05-26T06:30:27.699Z", "id": "wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a", "references": [ + { + "id": "wiz-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" + }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "cc20569b-60f2-4fc0-93cc-1152902c76a0:indexpattern-datasource-layer-53610d78-e92c-427d-bfcf-374a2135f8e3", "type": "index-pattern" }, { - "id": "wiz-f71321c0-a641-4411-a33e-f39569c2c7be", - "name": "bb78eccf-6271-4494-a767-bb65bf1cbdc0:panel_bb78eccf-6271-4494-a767-bb65bf1cbdc0", - "type": "search" + "id": "logs-*", + "name": "cc20569b-60f2-4fc0-93cc-1152902c76a0:e51064e9-6f6d-4b9e-b51b-bd7761849547", + "type": "index-pattern" }, { "id": "logs-*", - "name": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc:indexpattern-datasource-layer-d5419375-833b-4eeb-8119-6950d64230d9", + "name": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e:indexpattern-datasource-layer-f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", "type": "index-pattern" }, { "id": "logs-*", - "name": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb:indexpattern-datasource-layer-f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", + "name": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e:1fe68821-6dda-4f6b-b47d-9cd824fef43d", "type": "index-pattern" }, { "id": "logs-*", - "name": "427510cc-fc9e-4691-9fac-4d5a3e377700:indexpattern-datasource-layer-d2b4912e-3ced-49ac-aa99-2969720e2f1f", + "name": "1a0212e1-6df2-4187-8bb0-029f04f196d1:indexpattern-datasource-layer-65bbc691-ab9f-40f0-8258-66f28c54eeff", "type": "index-pattern" }, { "id": "logs-*", - "name": "dc38a316-4a46-4c12-81d2-e78c90d1ceed:indexpattern-datasource-layer-76037f8d-37f5-405c-9974-6afefd777737", + "name": "1a0212e1-6df2-4187-8bb0-029f04f196d1:e967ce57-1163-4382-ba57-bd40b7bacad3", "type": "index-pattern" }, { "id": "logs-*", - "name": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44:indexpattern-datasource-layer-c1458332-407f-40dc-85ca-3c69a75f6153", + "name": "5249b0f0-30ea-472f-99e7-ebd31a239802:indexpattern-datasource-layer-2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", "type": "index-pattern" }, { "id": "logs-*", - "name": "77df9a6b-af9e-412f-a916-fc83bd7c3194:indexpattern-datasource-layer-5d7b131e-a2dc-453a-897a-c384a62a3fc6", + "name": "5249b0f0-30ea-472f-99e7-ebd31a239802:26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", "type": "index-pattern" }, { "id": "logs-*", - "name": "cc20569b-60f2-4fc0-93cc-1152902c76a0:indexpattern-datasource-layer-53610d78-e92c-427d-bfcf-374a2135f8e3", + "name": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518:indexpattern-datasource-layer-6be8a450-9cac-43cb-a7e1-3b5b3f504af4", "type": "index-pattern" }, { "id": "logs-*", - "name": "1a0212e1-6df2-4187-8bb0-029f04f196d1:indexpattern-datasource-layer-65bbc691-ab9f-40f0-8258-66f28c54eeff", + "name": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518:12099fd9-f20a-4e2a-91d1-1b8aac061cad", "type": "index-pattern" }, { "id": "logs-*", - "name": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e:indexpattern-datasource-layer-f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", + "name": "d1455288-89ba-4146-b530-dda7f9663bbc:indexpattern-datasource-layer-a954312a-b2e7-4160-8c32-42fdbaa7c639", "type": "index-pattern" }, { "id": "logs-*", - "name": "4ce47b03-10cc-4fe3-9de3-c239e5184334:indexpattern-datasource-layer-a7a27126-b5e1-48de-9cc0-c71a01b1a1e6", + "name": "d1455288-89ba-4146-b530-dda7f9663bbc:38a738be-567c-4797-b05f-ad81ae8860f3", "type": "index-pattern" }, { "id": "logs-*", - "name": "d1455288-89ba-4146-b530-dda7f9663bbc:indexpattern-datasource-layer-a954312a-b2e7-4160-8c32-42fdbaa7c639", + "name": "ace8bb17-267f-4942-9748-17f9f10749e0:indexpattern-datasource-layer-9722040c-5b00-410c-a720-87bfb162c84a", "type": "index-pattern" }, { "id": "logs-*", - "name": "ace8bb17-267f-4942-9748-17f9f10749e0:indexpattern-datasource-layer-9722040c-5b00-410c-a720-87bfb162c84a", + "name": "ace8bb17-267f-4942-9748-17f9f10749e0:ae446cbc-21c9-4c28-9188-8745078e3f68", "type": "index-pattern" }, { @@ -2878,12 +3545,17 @@ }, { "id": "logs-*", - "name": "5249b0f0-30ea-472f-99e7-ebd31a239802:indexpattern-datasource-layer-2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", + "name": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c:777e84d3-528b-4286-9354-551204c418e8", "type": "index-pattern" }, { "id": "logs-*", - "name": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518:indexpattern-datasource-layer-6be8a450-9cac-43cb-a7e1-3b5b3f504af4", + "name": "4ce47b03-10cc-4fe3-9de3-c239e5184334:indexpattern-datasource-layer-a7a27126-b5e1-48de-9cc0-c71a01b1a1e6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4ce47b03-10cc-4fe3-9de3-c239e5184334:b490fb92-e24a-4835-8efb-9c185a528006", "type": "index-pattern" }, { @@ -2893,30 +3565,96 @@ }, { "id": "logs-*", - "name": "controlGroup_ae2b0313-95e1-4ecc-8ddf-04549f7871ba:optionsListDataView", + "name": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7:26a8762b-bd10-43a6-b632-1fc52b649c46", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_8e5f0dbe-44b1-4df2-867c-74e248c27f38:optionsListDataView", + "name": "427510cc-fc9e-4691-9fac-4d5a3e377700:indexpattern-datasource-layer-d2b4912e-3ced-49ac-aa99-2969720e2f1f", "type": "index-pattern" }, { "id": "logs-*", - "name": "controlGroup_c4086230-8937-4b90-8e90-6c94e34b48b8:optionsListDataView", + "name": "427510cc-fc9e-4691-9fac-4d5a3e377700:e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "dc38a316-4a46-4c12-81d2-e78c90d1ceed:indexpattern-datasource-layer-76037f8d-37f5-405c-9974-6afefd777737", "type": "index-pattern" }, { - "id": "wiz-security-solution-default", - "name": "tag-ref-security-solution-default", - "type": "tag" + "id": "logs-*", + "name": "dc38a316-4a46-4c12-81d2-e78c90d1ceed:a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb:indexpattern-datasource-layer-f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb:7e48aaab-bddd-4e61-b73d-44dfa9464bd8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc:indexpattern-datasource-layer-d5419375-833b-4eeb-8119-6950d64230d9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc:dd22aafe-d388-43b7-9646-0403aaee81a7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44:indexpattern-datasource-layer-c1458332-407f-40dc-85ca-3c69a75f6153", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44:e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "77df9a6b-af9e-412f-a916-fc83bd7c3194:indexpattern-datasource-layer-5d7b131e-a2dc-453a-897a-c384a62a3fc6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "77df9a6b-af9e-412f-a916-fc83bd7c3194:cd797741-fccc-48de-879a-37abf3c5f1eb", + "type": "index-pattern" + }, + { + "id": "wiz-f661536e-81c2-455b-9a4f-9840d910c318", + "name": "022a726e-0fc7-4cee-8fe8-42bd959353e2:panel_022a726e-0fc7-4cee-8fe8-42bd959353e2", + "type": "search" + }, + { + "id": "wiz-f661536e-81c2-455b-9a4f-9840d910c318", + "name": "022a726e-0fc7-4cee-8fe8-42bd959353e2:panel_022a726e-0fc7-4cee-8fe8-42bd959353e2", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_ae2b0313-95e1-4ecc-8ddf-04549f7871ba:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_8e5f0dbe-44b1-4df2-867c-74e248c27f38:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_c4086230-8937-4b90-8e90-6c94e34b48b8:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard", - "typeMigrationVersion": "10.3.0" + "typeMigrationVersion": "10.3.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json b/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json index 94eb0925685..a01b88e1271 100644 --- a/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json +++ b/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json @@ -1,5 +1,17 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, "description": "", "kibanaSavedObjectMeta": { "searchSourceJSON": { @@ -43,7 +55,8 @@ "title": "", "type": "markdown", "uiState": {} - } + }, + "title": "Table of Contents" }, "gridData": { "h": 23, @@ -53,9 +66,7 @@ "y": 0 }, "panelIndex": "0f27302b-3efb-4712-a3cf-fa26a7fc6bd1", - "title": "Table of Contents", - "type": "visualization", - "version": "8.10.1" + "type": "visualization" }, { "embeddableConfig": { @@ -185,7 +196,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Top 10 Source IP [Logs Wiz]" }, "gridData": { "h": 11, @@ -195,9 +207,7 @@ "y": 0 }, "panelIndex": "955f380d-4b48-416f-8fa3-41dd6c0df91c", - "title": "Top 10 Source IP [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -334,7 +344,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Audit by User [Logs Wiz]" }, "gridData": { "h": 11, @@ -344,9 +355,7 @@ "y": 0 }, "panelIndex": "28d1a83b-3558-473c-948c-8157eee46509", - "title": "Audit by User [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -357,6 +366,11 @@ "id": "logs-*", "name": "indexpattern-datasource-layer-2ef70662-f7d5-4917-bff4-c212ecf7ad19", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "249b6030-1923-46a8-afcd-02911d27bea8", + "type": "index-pattern" } ], "state": { @@ -423,7 +437,30 @@ "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "249b6030-1923-46a8-afcd-02911d27bea8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.audit" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", @@ -455,8 +492,44 @@ "type": "lens", "visualizationType": "lnsPie" }, - "enhancements": {}, - "hidePanelTitles": false + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "249b6030-1923-46a8-afcd-02911d27bea8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.audit" + } + } + } + ], + "hidePanelTitles": false, + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "title": "Audit by Status [Logs Wiz]" }, "gridData": { "h": 12, @@ -466,9 +539,7 @@ "y": 11 }, "panelIndex": "38992b4f-7a75-4641-afc9-4cede93fbe04", - "title": "Audit by Status [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -605,7 +676,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Audit by Action [Logs Wiz]" }, "gridData": { "h": 12, @@ -615,9 +687,7 @@ "y": 11 }, "panelIndex": "892360c9-2be8-4e1e-a93e-e70a9d2aa8fc", - "title": "Audit by Action [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -774,7 +844,8 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Action over Time [Logs Wiz]" }, "gridData": { "h": 11, @@ -784,19 +855,22 @@ "y": 23 }, "panelIndex": "5f4a4c50-2b75-49e8-997e-996ed535715e", - "title": "Action over Time [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" } ], "timeRestore": false, "title": "[Logs Wiz] Audit", - "version": 1 + "version": 3 }, "coreMigrationVersion": "8.8.0", "created_at": "2026-05-26T06:30:29.707Z", "id": "wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273", "references": [ + { + "id": "wiz-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" + }, { "id": "logs-*", "name": "955f380d-4b48-416f-8fa3-41dd6c0df91c:indexpattern-datasource-layer-6f8238aa-59ea-4672-a656-4b302e00407e", @@ -822,6 +896,11 @@ "name": "38992b4f-7a75-4641-afc9-4cede93fbe04:indexpattern-datasource-layer-2ef70662-f7d5-4917-bff4-c212ecf7ad19", "type": "index-pattern" }, + { + "id": "logs-*", + "name": "38992b4f-7a75-4641-afc9-4cede93fbe04:249b6030-1923-46a8-afcd-02911d27bea8", + "type": "index-pattern" + }, { "id": "logs-*", "name": "892360c9-2be8-4e1e-a93e-e70a9d2aa8fc:indexpattern-datasource-layer-eda794c9-092a-4564-805e-f3d834f2084d", @@ -841,13 +920,9 @@ "id": "logs-*", "name": "5f4a4c50-2b75-49e8-997e-996ed535715e:68046879-96c5-4615-950e-e40001e3bb9b", "type": "index-pattern" - }, - { - "id": "wiz-security-solution-default", - "name": "tag-ref-security-solution-default", - "type": "tag" } ], "type": "dashboard", - "typeMigrationVersion": "10.3.0" + "typeMigrationVersion": "10.3.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json b/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json index bbe46b17282..b337fe6b008 100644 --- a/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json +++ b/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json @@ -1,5 +1,17 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, "description": "", "kibanaSavedObjectMeta": { "searchSourceJSON": { @@ -43,7 +55,8 @@ "title": "", "type": "markdown", "uiState": {} - } + }, + "title": "Table of Contents" }, "gridData": { "h": 25, @@ -53,9 +66,7 @@ "y": 0 }, "panelIndex": "508e0ce7-ae93-4889-ac6f-061b181855da", - "title": "Table of Contents", - "type": "visualization", - "version": "8.10.1" + "type": "visualization" }, { "embeddableConfig": { @@ -235,7 +246,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Top 10 Issue Details [Logs Wiz]" }, "gridData": { "h": 12, @@ -245,9 +257,7 @@ "y": 0 }, "panelIndex": "4486be35-cdb7-4f57-bc5a-790877de1a13", - "title": "Top 10 Issue Details [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -385,7 +395,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Issue by Severity [Logs Wiz]" }, "gridData": { "h": 12, @@ -395,9 +406,7 @@ "y": 0 }, "panelIndex": "209d9dd1-b157-467f-8595-6a1411ea9b82", - "title": "Issue by Severity [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -408,6 +417,11 @@ "id": "logs-*", "name": "indexpattern-datasource-layer-f0588491-4a9d-43fe-a5c5-37f78ee2ef67", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8a59c578-ef56-4009-b626-6ca362a82071", + "type": "index-pattern" } ], "state": { @@ -473,7 +487,30 @@ "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "8a59c578-ef56-4009-b626-6ca362a82071", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.issue" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.issue" + } + } + } + ], "internalReferences": [], "query": { "language": "kuery", @@ -505,8 +542,44 @@ "type": "lens", "visualizationType": "lnsPie" }, - "enhancements": {}, - "hidePanelTitles": false + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "8a59c578-ef56-4009-b626-6ca362a82071", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.issue" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.issue" + } + } + } + ], + "hidePanelTitles": false, + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "title": "Issue by Status [Logs Wiz]" }, "gridData": { "h": 13, @@ -516,9 +589,7 @@ "y": 12 }, "panelIndex": "2b7e3f1c-c156-48b8-9c32-f4afc4d1508f", - "title": "Issue by Status [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -658,7 +729,8 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Issue by Entity Type [Logs Wiz]" }, "gridData": { "h": 13, @@ -668,9 +740,7 @@ "y": 12 }, "panelIndex": "136424c9-2f71-4dcc-81ce-87b8ed61612a", - "title": "Issue by Entity Type [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" }, { "embeddableConfig": { @@ -827,7 +897,8 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Issue over Time [Logs Wiz]" }, "gridData": { "h": 14, @@ -837,19 +908,22 @@ "y": 25 }, "panelIndex": "bf85ce23-6dd3-4fc3-ad47-c9ae021c13f9", - "title": "Issue over Time [Logs Wiz]", - "type": "lens", - "version": "8.10.1" + "type": "lens" } ], "timeRestore": false, "title": "[Logs Wiz] Issue", - "version": 1 + "version": 3 }, "coreMigrationVersion": "8.8.0", "created_at": "2026-05-26T06:30:26.689Z", "id": "wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf", "references": [ + { + "id": "wiz-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" + }, { "id": "logs-*", "name": "4486be35-cdb7-4f57-bc5a-790877de1a13:indexpattern-datasource-layer-9c8d8751-85f6-4236-83e4-4b5bfafffb15", @@ -875,6 +949,11 @@ "name": "2b7e3f1c-c156-48b8-9c32-f4afc4d1508f:indexpattern-datasource-layer-f0588491-4a9d-43fe-a5c5-37f78ee2ef67", "type": "index-pattern" }, + { + "id": "logs-*", + "name": "2b7e3f1c-c156-48b8-9c32-f4afc4d1508f:8a59c578-ef56-4009-b626-6ca362a82071", + "type": "index-pattern" + }, { "id": "logs-*", "name": "136424c9-2f71-4dcc-81ce-87b8ed61612a:indexpattern-datasource-layer-c967e601-e1f7-41ce-bbad-83fe21431b07", @@ -894,13 +973,9 @@ "id": "logs-*", "name": "bf85ce23-6dd3-4fc3-ad47-c9ae021c13f9:bb0be760-abd3-4359-a9fe-3efe5b0e4ef0", "type": "index-pattern" - }, - { - "id": "wiz-security-solution-default", - "name": "tag-ref-security-solution-default", - "type": "tag" } ], "type": "dashboard", - "typeMigrationVersion": "10.3.0" + "typeMigrationVersion": "10.3.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } \ No newline at end of file diff --git a/packages/wiz/kibana/search/wiz-f661536e-81c2-455b-9a4f-9840d910c318.json b/packages/wiz/kibana/search/wiz-f661536e-81c2-455b-9a4f-9840d910c318.json new file mode 100644 index 00000000000..03aea4c99b0 --- /dev/null +++ b/packages/wiz/kibana/search/wiz-f661536e-81c2-455b-9a4f-9840d910c318.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "columns": [ + "rule.name", + "rule.id", + "event.action", + "threat.indicator.id", + "threat.indicator.reference", + "wiz.defend.created_at", + "wiz.defend.severity", + "event.reference", + "threat.tactic.id", + "threat.technique.id" + ], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "[Logs Wiz] Detection Essential Details" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-05-26T08:33:23.090Z", + "created_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", + "id": "wiz-f661536e-81c2-455b-9a4f-9840d910c318", + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "wiz-security-solution-default", + "name": "tag-ref-security-solution-default", + "type": "tag" + } + ], + "type": "search", + "typeMigrationVersion": "10.5.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" +} \ No newline at end of file diff --git a/packages/wiz/kibana/search/wiz-f71321c0-a641-4411-a33e-f39569c2c7be.json b/packages/wiz/kibana/search/wiz-f71321c0-a641-4411-a33e-f39569c2c7be.json deleted file mode 100644 index 01f20ed7060..00000000000 --- a/packages/wiz/kibana/search/wiz-f71321c0-a641-4411-a33e-f39569c2c7be.json +++ /dev/null @@ -1,55 +0,0 @@ -{ - "attributes": { - "columns": [ - "rule.name", - "rule.id", - "event.action", - "threat.indicator.id", - "threat.indicator.reference", - "wiz.defend.created_at", - "wiz.defend.severity", - "event.reference", - "threat.tactic.id", - "threat.technique.id" - ], - "description": "", - "grid": {}, - "hideChart": false, - "isTextBasedQuery": false, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "timeRestore": false, - "title": "Detection Essential Details [Logs Wiz]" - }, - "coreMigrationVersion": "8.8.0", - "created_at": "2026-05-26T06:29:22.739Z", - "id": "wiz-f71321c0-a641-4411-a33e-f39569c2c7be", - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "wiz-security-solution-default", - "name": "tag-ref-security-solution-default", - "type": "tag" - } - ], - "type": "search", - "typeMigrationVersion": "10.5.0" -} \ No newline at end of file diff --git a/packages/wiz/validation.yml b/packages/wiz/validation.yml index c7bf004b676..1189aa63c89 100644 --- a/packages/wiz/validation.yml +++ b/packages/wiz/validation.yml @@ -1,4 +1,3 @@ errors: exclude_checks: - - SVR00002 # Mandatory filters in dashboards - SVR00004 # References in dashboards. From 62374d2491619aad7cc010d95e1563a86fad333b Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Tue, 26 May 2026 10:57:30 +0200 Subject: [PATCH 16/21] Dashboards: Remove duplicated search reference. --- .../wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json index a1180dd7d47..62b0eb6e794 100644 --- a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json +++ b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json @@ -3633,11 +3633,6 @@ "name": "022a726e-0fc7-4cee-8fe8-42bd959353e2:panel_022a726e-0fc7-4cee-8fe8-42bd959353e2", "type": "search" }, - { - "id": "wiz-f661536e-81c2-455b-9a4f-9840d910c318", - "name": "022a726e-0fc7-4cee-8fe8-42bd959353e2:panel_022a726e-0fc7-4cee-8fe8-42bd959353e2", - "type": "search" - }, { "id": "logs-*", "name": "controlGroup_ae2b0313-95e1-4ecc-8ddf-04549f7871ba:optionsListDataView", @@ -3657,4 +3652,4 @@ "type": "dashboard", "typeMigrationVersion": "10.3.0", "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" -} \ No newline at end of file +} From 7d72a4ddf11941b719be839e62d11c4b01854ebb Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Tue, 26 May 2026 11:00:51 +0200 Subject: [PATCH 17/21] Dashboards: Remove redundant tag references. --- .../wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json | 5 ----- .../wiz-726802c0-4007-48b9-bae5-09daa69d4368.json | 7 +------ .../wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json | 7 +------ .../wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json | 7 +------ .../wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json | 7 +------ .../wiz-f661536e-81c2-455b-9a4f-9840d910c318.json | 7 +------ .../kibana/tag/wiz-security-solution-default.json | 13 ------------- 7 files changed, 5 insertions(+), 48 deletions(-) delete mode 100644 packages/wiz/kibana/tag/wiz-security-solution-default.json diff --git a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json index 62b0eb6e794..4774acd1ebc 100644 --- a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json +++ b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json @@ -3463,11 +3463,6 @@ "created_at": "2026-05-26T06:30:27.699Z", "id": "wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a", "references": [ - { - "id": "wiz-security-solution-default", - "name": "tag-ref-security-solution-default", - "type": "tag" - }, { "id": "logs-*", "name": "cc20569b-60f2-4fc0-93cc-1152902c76a0:indexpattern-datasource-layer-53610d78-e92c-427d-bfcf-374a2135f8e3", diff --git a/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json b/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json index 12e46fb3e6c..1589f724f10 100644 --- a/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json +++ b/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json @@ -899,13 +899,8 @@ "id": "logs-*", "name": "e684aa2c-8963-4cae-a04e-74b00b662a33:9582928b-35f7-49a2-90cd-aab0dc84b52a", "type": "index-pattern" - }, - { - "id": "wiz-security-solution-default", - "name": "tag-ref-security-solution-default", - "type": "tag" } ], "type": "dashboard", "typeMigrationVersion": "10.3.0" -} \ No newline at end of file +} diff --git a/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json b/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json index 100aae841fe..b9617656323 100644 --- a/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json +++ b/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json @@ -1153,11 +1153,6 @@ "created_at": "2026-05-26T06:30:28.696Z", "id": "wiz-927c36f0-6358-11ee-a265-c3569aa0cebf", "references": [ - { - "id": "wiz-security-solution-default", - "name": "tag-ref-security-solution-default", - "type": "tag" - }, { "id": "logs-*", "name": "2051bd2b-1eec-4089-b4fb-577795cacfa2:indexpattern-datasource-layer-0d257928-266c-4ccd-8810-bf6605fc84aa", @@ -1222,4 +1217,4 @@ "type": "dashboard", "typeMigrationVersion": "10.3.0", "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" -} \ No newline at end of file +} diff --git a/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json b/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json index a01b88e1271..df5982e9fdb 100644 --- a/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json +++ b/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json @@ -866,11 +866,6 @@ "created_at": "2026-05-26T06:30:29.707Z", "id": "wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273", "references": [ - { - "id": "wiz-security-solution-default", - "name": "tag-ref-security-solution-default", - "type": "tag" - }, { "id": "logs-*", "name": "955f380d-4b48-416f-8fa3-41dd6c0df91c:indexpattern-datasource-layer-6f8238aa-59ea-4672-a656-4b302e00407e", @@ -925,4 +920,4 @@ "type": "dashboard", "typeMigrationVersion": "10.3.0", "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" -} \ No newline at end of file +} diff --git a/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json b/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json index b337fe6b008..92d7643343c 100644 --- a/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json +++ b/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json @@ -919,11 +919,6 @@ "created_at": "2026-05-26T06:30:26.689Z", "id": "wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf", "references": [ - { - "id": "wiz-security-solution-default", - "name": "tag-ref-security-solution-default", - "type": "tag" - }, { "id": "logs-*", "name": "4486be35-cdb7-4f57-bc5a-790877de1a13:indexpattern-datasource-layer-9c8d8751-85f6-4236-83e4-4b5bfafffb15", @@ -978,4 +973,4 @@ "type": "dashboard", "typeMigrationVersion": "10.3.0", "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" -} \ No newline at end of file +} diff --git a/packages/wiz/kibana/search/wiz-f661536e-81c2-455b-9a4f-9840d910c318.json b/packages/wiz/kibana/search/wiz-f661536e-81c2-455b-9a4f-9840d910c318.json index 03aea4c99b0..8dac94abf4c 100644 --- a/packages/wiz/kibana/search/wiz-f661536e-81c2-455b-9a4f-9840d910c318.json +++ b/packages/wiz/kibana/search/wiz-f661536e-81c2-455b-9a4f-9840d910c318.json @@ -72,14 +72,9 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" - }, - { - "id": "wiz-security-solution-default", - "name": "tag-ref-security-solution-default", - "type": "tag" } ], "type": "search", "typeMigrationVersion": "10.5.0", "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" -} \ No newline at end of file +} diff --git a/packages/wiz/kibana/tag/wiz-security-solution-default.json b/packages/wiz/kibana/tag/wiz-security-solution-default.json deleted file mode 100644 index 601d720619e..00000000000 --- a/packages/wiz/kibana/tag/wiz-security-solution-default.json +++ /dev/null @@ -1,13 +0,0 @@ -{ - "attributes": { - "color": "#FEC514", - "description": "Tag defined in package-spec", - "name": "Security Solution" - }, - "coreMigrationVersion": "8.8.0", - "created_at": "2026-05-25T12:59:42.987Z", - "id": "wiz-security-solution-default", - "references": [], - "type": "tag", - "typeMigrationVersion": "8.0.0" -} \ No newline at end of file From 3eac3dafeacdc2ced617d923f2312e4d90f17af6 Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Tue, 26 May 2026 11:09:44 +0200 Subject: [PATCH 18/21] Dashboards: Remove Defend dashboard description for consistency, etc. --- .../dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json index 4774acd1ebc..aaec316577f 100644 --- a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json +++ b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json @@ -70,7 +70,7 @@ }, "showApplySelections": false }, - "description": "This dashboard shows Detection Logs collected by the Wiz Defend integration.", + "description": "", "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], From fcc5d4350cb8a72ead050c2e8687bdd9f4a6e487 Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Tue, 26 May 2026 11:57:12 +0200 Subject: [PATCH 19/21] Dashboards: Fix nav/overview panel formatting. --- ...-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json | 2266 +++++++++-------- ...-726802c0-4007-48b9-bae5-09daa69d4368.json | 50 +- ...-927c36f0-6358-11ee-a265-c3569aa0cebf.json | 13 +- ...-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json | 561 ++-- ...-d8f91a20-6363-11ee-a265-c3569aa0cebf.json | 13 +- 5 files changed, 1466 insertions(+), 1437 deletions(-) diff --git a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json index aaec316577f..68c1f6e642f 100644 --- a/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json +++ b/packages/wiz/kibana/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a.json @@ -88,58 +88,18 @@ "useMargins": true }, "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "**Navigation**\n\n**Wiz**\n\nWiz Defend\n\n[Wiz Cloud Configuration Finding](#/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368)\n\n[Wiz Vulnerability](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf)\n\n[Wiz Issue](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf)\n\n[Wiz Audit](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273)\n\n**Overview**\n\nThis dashboard provides visibility into detection events, enabling effective threat monitoring across cloud and container environments. It features a Control Panel for filtering by severity and trigger type, and includes visualizations such as detections over time, top cloud accounts, containers, and resource types with highest detections. It highlights trends by MITRE tactics and techniques, actor types, and trigger types through pie and bar charts, while a geographic map displays actor IP distribution. A table details triggering events, and additional tables showcase top threats, rules, and common malicious commands, supporting deeper investigation and response.\n\n[**Integrations Page**](/app/integrations/detail/wiz/overview)", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } - }, - "gridData": { - "h": 35, - "i": "ced2a470-d1c8-4d56-9f70-e8d3aa6d81c4", - "w": 8, - "x": 0, - "y": 0 - }, - "panelIndex": "ced2a470-d1c8-4d56-9f70-e8d3aa6d81c4", - "type": "visualization" - }, { "embeddableConfig": { "attributes": { "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-53610d78-e92c-427d-bfcf-374a2135f8e3", + "name": "indexpattern-datasource-layer-6be8a450-9cac-43cb-a7e1-3b5b3f504af4", "type": "index-pattern" }, { "id": "logs-*", - "name": "e51064e9-6f6d-4b9e-b51b-bd7761849547", + "name": "12099fd9-f20a-4e2a-91d1-1b8aac061cad", "type": "index-pattern" } ], @@ -148,27 +108,66 @@ "datasourceStates": { "formBased": { "layers": { - "53610d78-e92c-427d-bfcf-374a2135f8e3": { + "6be8a450-9cac-43cb-a7e1-3b5b3f504af4": { "columnOrder": [ - "2a335dea-e98d-4537-9d8b-5b305747306d", - "bcf37841-f643-449b-8367-7d53656c7da1" + "c462537a-e3f3-4542-9f21-c0cdb590f6ef", + "0f5de969-06b2-4d1a-9877-c174e448940a", + "d9b10eed-3ab7-4bda-b924-9406edf2306d" ], "columns": { - "2a335dea-e98d-4537-9d8b-5b305747306d": { + "0f5de969-06b2-4d1a-9877-c174e448940a": { "customLabel": true, - "dataType": "date", + "dataType": "string", "isBucketed": true, - "label": "Detection Timestamp", - "operationType": "date_histogram", + "label": "Cloud Account ID", + "operationType": "terms", "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 }, - "scale": "interval", - "sourceField": "wiz.defend.created_at" + "scale": "ordinal", + "sourceField": "wiz.defend.triggering_event.resources.cloud_account.id" }, - "bcf37841-f643-449b-8367-7d53656c7da1": { + "c462537a-e3f3-4542-9f21-c0cdb590f6ef": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Cloud Platform", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "wiz.defend.triggering_event.resources.cloud_account.cloud_platform" + }, + "d9b10eed-3ab7-4bda-b924-9406edf2306d": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -187,6 +186,7 @@ "sourceField": "wiz.defend.id" } }, + "ignoreGlobalFilters": false, "incompleteColumns": {}, "sampling": 1 } @@ -208,7 +208,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "e51064e9-6f6d-4b9e-b51b-bd7761849547", + "index": "12099fd9-f20a-4e2a-91d1-1b8aac061cad", "key": "data_stream.dataset", "negate": false, "params": { @@ -229,72 +229,37 @@ "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "Linear", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ + "columns": [ { - "accessors": [ - "bcf37841-f643-449b-8367-7d53656c7da1" - ], - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rules": [ - { - "type": "other" - } - ], - "touched": false - } - ] - }, - "layerId": "53610d78-e92c-427d-bfcf-374a2135f8e3", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "xAccessor": "2a335dea-e98d-4537-9d8b-5b305747306d" + "alignment": "center", + "columnId": "c462537a-e3f3-4542-9f21-c0cdb590f6ef", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "0f5de969-06b2-4d1a-9877-c174e448940a", + "isMetric": false, + "isTransposed": false } ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false - }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" + "headerRowHeight": "custom", + "headerRowHeightLines": 3, + "layerId": "6be8a450-9cac-43cb-a7e1-3b5b3f504af4", + "layerType": "data", + "rowHeight": "auto", + "rowHeightLines": -1 } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsDatatable" }, "enhancements": { "dynamicActions": { @@ -310,7 +275,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "e51064e9-6f6d-4b9e-b51b-bd7761849547", + "index": "12099fd9-f20a-4e2a-91d1-1b8aac061cad", "key": "data_stream.dataset", "negate": false, "params": { @@ -332,16 +297,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Detections over Time [Logs Wiz]" + "title": "Top 10 Cloud Accounts with Highest Detections [Logs Wiz]" }, "gridData": { - "h": 15, - "i": "cc20569b-60f2-4fc0-93cc-1152902c76a0", - "w": 40, - "x": 8, - "y": 0 + "h": 12, + "i": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518", + "w": 48, + "x": 0, + "y": 35 }, - "panelIndex": "cc20569b-60f2-4fc0-93cc-1152902c76a0", + "panelIndex": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518", "type": "lens" }, { @@ -350,12 +315,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", + "name": "indexpattern-datasource-layer-a954312a-b2e7-4160-8c32-42fdbaa7c639", "type": "index-pattern" }, { "id": "logs-*", - "name": "1fe68821-6dda-4f6b-b47d-9cd824fef43d", + "name": "38a738be-567c-4797-b05f-ad81ae8860f3", "type": "index-pattern" } ], @@ -364,35 +329,29 @@ "datasourceStates": { "formBased": { "layers": { - "f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c": { + "a954312a-b2e7-4160-8c32-42fdbaa7c639": { "columnOrder": [ - "d4e3a535-a7cf-48ca-b284-ad56d5794f16", - "a6cebce0-c3fb-457b-832b-a0356ad54c2a" + "cd325623-f160-42ec-92c2-029282ad3708", + "aac53614-9481-4184-a12b-ce05ec5924ce" ], "columns": { - "a6cebce0-c3fb-457b-832b-a0356ad54c2a": { + "aac53614-9481-4184-a12b-ce05ec5924ce": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "unique_count", "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } + "emptyAsNull": false }, "scale": "ratio", - "sourceField": "wiz.defend.id" + "sourceField": "event.id" }, - "d4e3a535-a7cf-48ca-b284-ad56d5794f16": { + "cd325623-f160-42ec-92c2-029282ad3708": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "MITRE Techniques", + "label": "Detection Event Source", "operationType": "terms", "params": { "exclude": [], @@ -401,7 +360,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "a6cebce0-c3fb-457b-832b-a0356ad54c2a", + "columnId": "aac53614-9481-4184-a12b-ce05ec5924ce", "type": "column" }, "orderDirection": "desc", @@ -409,10 +368,11 @@ "parentFormat": { "id": "terms" }, - "size": 10 + "secondaryFields": [], + "size": 5 }, "scale": "ordinal", - "sourceField": "threat.technique.id" + "sourceField": "event.provider" } }, "incompleteColumns": {}, @@ -436,7 +396,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "1fe68821-6dda-4f6b-b47d-9cd824fef43d", + "index": "38a738be-567c-4797-b05f-ad81ae8860f3", "key": "data_stream.dataset", "negate": false, "params": { @@ -457,27 +417,9 @@ "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "Linear", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, "layers": [ { - "accessors": [ - "a6cebce0-c3fb-457b-832b-a0356ad54c2a" - ], + "categoryDisplay": "default", "colorMapping": { "assignments": [], "colorMode": { @@ -498,32 +440,28 @@ } ] }, - "layerId": "f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", + "emptySizeRatio": 0, + "layerId": "a954312a-b2e7-4160-8c32-42fdbaa7c639", "layerType": "data", - "position": "top", - "seriesType": "bar_horizontal_stacked", - "showGridlines": false, - "xAccessor": "d4e3a535-a7cf-48ca-b284-ad56d5794f16" + "legendDisplay": "show", + "legendSize": "xlarge", + "metrics": [ + "aac53614-9481-4184-a12b-ce05ec5924ce" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "cd325623-f160-42ec-92c2-029282ad3708" + ], + "truncateLegend": false } ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false, - "showSingleSeries": false - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" + "shape": "donut" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsPie" }, "enhancements": { "dynamicActions": { @@ -539,7 +477,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "1fe68821-6dda-4f6b-b47d-9cd824fef43d", + "index": "38a738be-567c-4797-b05f-ad81ae8860f3", "key": "data_stream.dataset", "negate": false, "params": { @@ -561,16 +499,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Detections by MITRE Techniques [Logs Wiz]" + "title": "Detection Source Distribution [Logs Wiz]" }, "gridData": { - "h": 10, - "i": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e", - "w": 20, - "x": 8, - "y": 15 + "h": 18, + "i": "d1455288-89ba-4146-b530-dda7f9663bbc", + "w": 26, + "x": 0, + "y": 47 }, - "panelIndex": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e", + "panelIndex": "d1455288-89ba-4146-b530-dda7f9663bbc", "type": "lens" }, { @@ -579,12 +517,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-65bbc691-ab9f-40f0-8258-66f28c54eeff", + "name": "indexpattern-datasource-layer-9722040c-5b00-410c-a720-87bfb162c84a", "type": "index-pattern" }, { "id": "logs-*", - "name": "e967ce57-1163-4382-ba57-bd40b7bacad3", + "name": "ae446cbc-21c9-4c28-9188-8745078e3f68", "type": "index-pattern" } ], @@ -593,17 +531,29 @@ "datasourceStates": { "formBased": { "layers": { - "65bbc691-ab9f-40f0-8258-66f28c54eeff": { + "9722040c-5b00-410c-a720-87bfb162c84a": { "columnOrder": [ - "08ae64da-5722-4701-b325-0d76a2e0d46b", - "09e064d7-68b4-4ee8-92b8-f71499245cd1" + "e22cefb5-f7de-422d-a95b-4a2f3f552eec", + "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7" ], "columns": { - "08ae64da-5722-4701-b325-0d76a2e0d46b": { + "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "wiz.defend.id" + }, + "e22cefb5-f7de-422d-a95b-4a2f3f552eec": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "MITRE Tactic", + "label": "Triggering Types", "operationType": "terms", "params": { "exclude": [], @@ -612,7 +562,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "09e064d7-68b4-4ee8-92b8-f71499245cd1", + "columnId": "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7", "type": "column" }, "orderDirection": "desc", @@ -620,28 +570,10 @@ "parentFormat": { "id": "terms" }, - "size": 10 + "size": 5 }, "scale": "ordinal", - "sourceField": "threat.tactic.id" - }, - "09e064d7-68b4-4ee8-92b8-f71499245cd1": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "wiz.defend.id" + "sourceField": "event.action" } }, "incompleteColumns": {}, @@ -665,7 +597,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "e967ce57-1163-4382-ba57-bd40b7bacad3", + "index": "ae446cbc-21c9-4c28-9188-8745078e3f68", "key": "data_stream.dataset", "negate": false, "params": { @@ -686,27 +618,9 @@ "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "Linear", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, "layers": [ { - "accessors": [ - "09e064d7-68b4-4ee8-92b8-f71499245cd1" - ], + "categoryDisplay": "default", "colorMapping": { "assignments": [], "colorMode": { @@ -727,31 +641,27 @@ } ] }, - "layerId": "65bbc691-ab9f-40f0-8258-66f28c54eeff", + "emptySizeRatio": 0, + "layerId": "9722040c-5b00-410c-a720-87bfb162c84a", "layerType": "data", - "position": "top", - "seriesType": "bar_horizontal_stacked", - "showGridlines": false, - "xAccessor": "08ae64da-5722-4701-b325-0d76a2e0d46b" + "legendDisplay": "show", + "metrics": [ + "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "e22cefb5-f7de-422d-a95b-4a2f3f552eec" + ], + "truncateLegend": false } ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": false - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" + "shape": "donut" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsPie" }, "enhancements": { "dynamicActions": { @@ -767,7 +677,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "e967ce57-1163-4382-ba57-bd40b7bacad3", + "index": "ae446cbc-21c9-4c28-9188-8745078e3f68", "key": "data_stream.dataset", "negate": false, "params": { @@ -789,16 +699,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Detections by MITRE Tactic [Logs Wiz]" + "title": "Detections by Trigger Type [Logs Wiz]" }, "gridData": { - "h": 10, - "i": "1a0212e1-6df2-4187-8bb0-029f04f196d1", - "w": 20, - "x": 28, - "y": 15 + "h": 18, + "i": "ace8bb17-267f-4942-9748-17f9f10749e0", + "w": 22, + "x": 26, + "y": 47 }, - "panelIndex": "1a0212e1-6df2-4187-8bb0-029f04f196d1", + "panelIndex": "ace8bb17-267f-4942-9748-17f9f10749e0", "type": "lens" }, { @@ -807,12 +717,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", + "name": "indexpattern-datasource-layer-84a5677b-c5e3-4940-8c67-7576961e2f79", "type": "index-pattern" }, { "id": "logs-*", - "name": "26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", + "name": "777e84d3-528b-4286-9354-551204c418e8", "type": "index-pattern" } ], @@ -821,17 +731,17 @@ "datasourceStates": { "formBased": { "layers": { - "2e38c3a3-9cb3-42f0-8264-5c0de2b7d151": { + "84a5677b-c5e3-4940-8c67-7576961e2f79": { "columnOrder": [ - "442a0743-a4e1-4ab0-893b-ee248d2a2bf2", - "acb81f97-78f9-4aaf-903c-06ac7d34cf99" + "53ccfb54-7eaa-49da-99b1-912239fea452", + "72f83e5b-995e-44a3-8165-cdbffbe48c55" ], "columns": { - "442a0743-a4e1-4ab0-893b-ee248d2a2bf2": { + "53ccfb54-7eaa-49da-99b1-912239fea452": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Affected Resource Types", + "label": "Severity", "operationType": "terms", "params": { "exclude": [], @@ -840,7 +750,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "acb81f97-78f9-4aaf-903c-06ac7d34cf99", + "columnId": "72f83e5b-995e-44a3-8165-cdbffbe48c55", "type": "column" }, "orderDirection": "desc", @@ -848,12 +758,12 @@ "parentFormat": { "id": "terms" }, - "size": 10 + "size": 5 }, "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.resources.type" + "sourceField": "wiz.defend.severity" }, - "acb81f97-78f9-4aaf-903c-06ac7d34cf99": { + "72f83e5b-995e-44a3-8165-cdbffbe48c55": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -869,7 +779,7 @@ } }, "scale": "ratio", - "sourceField": "event.id" + "sourceField": "wiz.defend.id" } }, "incompleteColumns": {}, @@ -893,7 +803,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", + "index": "777e84d3-528b-4286-9354-551204c418e8", "key": "data_stream.dataset", "negate": false, "params": { @@ -914,27 +824,9 @@ "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "Linear", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, "layers": [ { - "accessors": [ - "acb81f97-78f9-4aaf-903c-06ac7d34cf99" - ], + "categoryDisplay": "default", "colorMapping": { "assignments": [], "colorMode": { @@ -955,31 +847,27 @@ } ] }, - "layerId": "2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", + "emptySizeRatio": 0, + "layerId": "84a5677b-c5e3-4940-8c67-7576961e2f79", "layerType": "data", - "position": "top", - "seriesType": "bar_horizontal_stacked", - "showGridlines": false, - "xAccessor": "442a0743-a4e1-4ab0-893b-ee248d2a2bf2" + "legendDisplay": "show", + "metrics": [ + "72f83e5b-995e-44a3-8165-cdbffbe48c55" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "53ccfb54-7eaa-49da-99b1-912239fea452" + ], + "truncateLegend": false } ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": true - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" + "shape": "donut" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsPie" }, "enhancements": { "dynamicActions": { @@ -995,7 +883,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", + "index": "777e84d3-528b-4286-9354-551204c418e8", "key": "data_stream.dataset", "negate": false, "params": { @@ -1017,16 +905,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Affected Resources by Type [Logs Wiz]" + "title": "Detections by Severity [Logs Wiz]" }, "gridData": { - "h": 10, - "i": "5249b0f0-30ea-472f-99e7-ebd31a239802", - "w": 40, - "x": 8, - "y": 25 + "h": 18, + "i": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c", + "w": 26, + "x": 0, + "y": 65 }, - "panelIndex": "5249b0f0-30ea-472f-99e7-ebd31a239802", + "panelIndex": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c", "type": "lens" }, { @@ -1035,12 +923,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-6be8a450-9cac-43cb-a7e1-3b5b3f504af4", + "name": "indexpattern-datasource-layer-a7a27126-b5e1-48de-9cc0-c71a01b1a1e6", "type": "index-pattern" }, { "id": "logs-*", - "name": "12099fd9-f20a-4e2a-91d1-1b8aac061cad", + "name": "b490fb92-e24a-4835-8efb-9c185a528006", "type": "index-pattern" } ], @@ -1049,44 +937,17 @@ "datasourceStates": { "formBased": { "layers": { - "6be8a450-9cac-43cb-a7e1-3b5b3f504af4": { + "a7a27126-b5e1-48de-9cc0-c71a01b1a1e6": { "columnOrder": [ - "c462537a-e3f3-4542-9f21-c0cdb590f6ef", - "0f5de969-06b2-4d1a-9877-c174e448940a", - "d9b10eed-3ab7-4bda-b924-9406edf2306d" + "6cfe7580-3c96-467d-95d9-a205dfe98731", + "c0c347fa-83ea-4150-8e00-e7abb037a687" ], "columns": { - "0f5de969-06b2-4d1a-9877-c174e448940a": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Cloud Account ID", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.resources.cloud_account.id" - }, - "c462537a-e3f3-4542-9f21-c0cdb590f6ef": { + "6cfe7580-3c96-467d-95d9-a205dfe98731": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Cloud Platform", + "label": "Actor Type", "operationType": "terms", "params": { "exclude": [], @@ -1095,20 +956,20 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", + "columnId": "c0c347fa-83ea-4150-8e00-e7abb037a687", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, + "otherBucket": true, "parentFormat": { "id": "terms" }, - "size": 10 + "size": 5 }, "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.resources.cloud_account.cloud_platform" + "sourceField": "wiz.defend.triggering_event.actor.type" }, - "d9b10eed-3ab7-4bda-b924-9406edf2306d": { + "c0c347fa-83ea-4150-8e00-e7abb037a687": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -1124,10 +985,9 @@ } }, "scale": "ratio", - "sourceField": "wiz.defend.id" + "sourceField": "event.id" } }, - "ignoreGlobalFilters": false, "incompleteColumns": {}, "sampling": 1 } @@ -1149,7 +1009,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "12099fd9-f20a-4e2a-91d1-1b8aac061cad", + "index": "b490fb92-e24a-4835-8efb-9c185a528006", "key": "data_stream.dataset", "negate": false, "params": { @@ -1170,37 +1030,51 @@ "query": "" }, "visualization": { - "columns": [ - { - "alignment": "center", - "columnId": "c462537a-e3f3-4542-9f21-c0cdb590f6ef", - "isMetric": false, - "isTransposed": false - }, - { - "alignment": "center", - "columnId": "d9b10eed-3ab7-4bda-b924-9406edf2306d", - "isMetric": true, - "isTransposed": false - }, + "layers": [ { - "alignment": "center", - "columnId": "0f5de969-06b2-4d1a-9877-c174e448940a", - "isMetric": false, - "isTransposed": false + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rules": [ + { + "type": "other" + } + ], + "touched": false + } + ] + }, + "emptySizeRatio": 0, + "layerId": "a7a27126-b5e1-48de-9cc0-c71a01b1a1e6", + "layerType": "data", + "legendDisplay": "show", + "legendSize": "large", + "metrics": [ + "c0c347fa-83ea-4150-8e00-e7abb037a687" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "6cfe7580-3c96-467d-95d9-a205dfe98731" + ], + "truncateLegend": false } ], - "headerRowHeight": "custom", - "headerRowHeightLines": 3, - "layerId": "6be8a450-9cac-43cb-a7e1-3b5b3f504af4", - "layerType": "data", - "rowHeight": "auto", - "rowHeightLines": -1 + "shape": "donut" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsPie" }, "enhancements": { "dynamicActions": { @@ -1216,7 +1090,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "12099fd9-f20a-4e2a-91d1-1b8aac061cad", + "index": "b490fb92-e24a-4835-8efb-9c185a528006", "key": "data_stream.dataset", "negate": false, "params": { @@ -1238,16 +1112,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Top 10 Cloud Accounts with Highest Detections [Logs Wiz]" + "title": "Detections by Actor Type [Logs Wiz]" }, "gridData": { - "h": 12, - "i": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518", - "w": 48, - "x": 0, - "y": 35 + "h": 18, + "i": "4ce47b03-10cc-4fe3-9de3-c239e5184334", + "w": 22, + "x": 26, + "y": 65 }, - "panelIndex": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518", + "panelIndex": "4ce47b03-10cc-4fe3-9de3-c239e5184334", "type": "lens" }, { @@ -1256,12 +1130,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-a954312a-b2e7-4160-8c32-42fdbaa7c639", + "name": "indexpattern-datasource-layer-f9c7cfa2-0061-466f-8909-040b89ecd361", "type": "index-pattern" }, { "id": "logs-*", - "name": "38a738be-567c-4797-b05f-ad81ae8860f3", + "name": "26a8762b-bd10-43a6-b632-1fc52b649c46", "type": "index-pattern" } ], @@ -1270,13 +1144,13 @@ "datasourceStates": { "formBased": { "layers": { - "a954312a-b2e7-4160-8c32-42fdbaa7c639": { + "f9c7cfa2-0061-466f-8909-040b89ecd361": { "columnOrder": [ - "cd325623-f160-42ec-92c2-029282ad3708", - "aac53614-9481-4184-a12b-ce05ec5924ce" + "dff56fec-70cc-4d6d-8a79-5c2794322a5a", + "9e564606-3929-45ec-91ac-71dbacc739e3" ], "columns": { - "aac53614-9481-4184-a12b-ce05ec5924ce": { + "9e564606-3929-45ec-91ac-71dbacc739e3": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -1288,11 +1162,11 @@ "scale": "ratio", "sourceField": "event.id" }, - "cd325623-f160-42ec-92c2-029282ad3708": { + "dff56fec-70cc-4d6d-8a79-5c2794322a5a": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Detection Event Source", + "label": "Country ISO Code", "operationType": "terms", "params": { "exclude": [], @@ -1301,7 +1175,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "aac53614-9481-4184-a12b-ce05ec5924ce", + "columnId": "9e564606-3929-45ec-91ac-71dbacc739e3", "type": "column" }, "orderDirection": "desc", @@ -1313,9 +1187,10 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "event.provider" + "sourceField": "source.geo.country_iso_code" } }, + "ignoreGlobalFilters": false, "incompleteColumns": {}, "sampling": 1 } @@ -1337,7 +1212,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "38a738be-567c-4797-b05f-ad81ae8860f3", + "index": "26a8762b-bd10-43a6-b632-1fc52b649c46", "key": "data_stream.dataset", "negate": false, "params": { @@ -1358,51 +1233,15 @@ "query": "" }, "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rules": [ - { - "type": "other" - } - ], - "touched": false - } - ] - }, - "emptySizeRatio": 0, - "layerId": "a954312a-b2e7-4160-8c32-42fdbaa7c639", - "layerType": "data", - "legendDisplay": "show", - "legendSize": "xlarge", - "metrics": [ - "aac53614-9481-4184-a12b-ce05ec5924ce" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "cd325623-f160-42ec-92c2-029282ad3708" - ], - "truncateLegend": false - } - ], - "shape": "donut" + "layerId": "f9c7cfa2-0061-466f-8909-040b89ecd361", + "layerType": "data", + "regionAccessor": "dff56fec-70cc-4d6d-8a79-5c2794322a5a", + "valueAccessor": "9e564606-3929-45ec-91ac-71dbacc739e3" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsChoropleth" }, "enhancements": { "dynamicActions": { @@ -1418,7 +1257,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "38a738be-567c-4797-b05f-ad81ae8860f3", + "index": "26a8762b-bd10-43a6-b632-1fc52b649c46", "key": "data_stream.dataset", "negate": false, "params": { @@ -1440,16 +1279,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Detection Source Distribution [Logs Wiz]" + "title": "Detections by Actor IP [Logs Wiz]" }, "gridData": { - "h": 18, - "i": "d1455288-89ba-4146-b530-dda7f9663bbc", - "w": 26, + "h": 25, + "i": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7", + "w": 48, "x": 0, - "y": 47 + "y": 83 }, - "panelIndex": "d1455288-89ba-4146-b530-dda7f9663bbc", + "panelIndex": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7", "type": "lens" }, { @@ -1458,12 +1297,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-9722040c-5b00-410c-a720-87bfb162c84a", + "name": "indexpattern-datasource-layer-d2b4912e-3ced-49ac-aa99-2969720e2f1f", "type": "index-pattern" }, { "id": "logs-*", - "name": "ae446cbc-21c9-4c28-9188-8745078e3f68", + "name": "e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", "type": "index-pattern" } ], @@ -1472,29 +1311,36 @@ "datasourceStates": { "formBased": { "layers": { - "9722040c-5b00-410c-a720-87bfb162c84a": { + "d2b4912e-3ced-49ac-aa99-2969720e2f1f": { "columnOrder": [ - "e22cefb5-f7de-422d-a95b-4a2f3f552eec", - "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7" + "68141a00-8b12-4f48-810a-1ff8b3eeabf7", + "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6", + "484781b7-7d30-4ad1-8b17-8e8e6abf9e40" ], "columns": { - "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7": { + "484781b7-7d30-4ad1-8b17-8e8e6abf9e40": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "unique_count", "params": { - "emptyAsNull": false + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } }, "scale": "ratio", "sourceField": "wiz.defend.id" }, - "e22cefb5-f7de-422d-a95b-4a2f3f552eec": { + "68141a00-8b12-4f48-810a-1ff8b3eeabf7": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Triggering Types", + "label": "Container Name", "operationType": "terms", "params": { "exclude": [], @@ -1503,20 +1349,47 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7", + "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "event.action" + "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.container.name" + }, + "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Container ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.container.id" } }, + "ignoreGlobalFilters": false, "incompleteColumns": {}, "sampling": 1 } @@ -1538,7 +1411,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "ae446cbc-21c9-4c28-9188-8745078e3f68", + "index": "e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", "key": "data_stream.dataset", "negate": false, "params": { @@ -1559,50 +1432,35 @@ "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rules": [ - { - "type": "other" - } - ], - "touched": false - } - ] - }, - "emptySizeRatio": 0, - "layerId": "9722040c-5b00-410c-a720-87bfb162c84a", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "b9ce961a-78c3-4ee7-8296-ad5c67db3eb7" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "e22cefb5-f7de-422d-a95b-4a2f3f552eec" - ], - "truncateLegend": false + "alignment": "center", + "columnId": "68141a00-8b12-4f48-810a-1ff8b3eeabf7", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6", + "isMetric": false, + "isTransposed": false } ], - "shape": "donut" + "layerId": "d2b4912e-3ced-49ac-aa99-2969720e2f1f", + "layerType": "data", + "rowHeight": "auto", + "rowHeightLines": -1 } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsDatatable" }, "enhancements": { "dynamicActions": { @@ -1618,7 +1476,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "ae446cbc-21c9-4c28-9188-8745078e3f68", + "index": "e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", "key": "data_stream.dataset", "negate": false, "params": { @@ -1640,16 +1498,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Detections by Trigger Type [Logs Wiz]" + "title": "Top 10 Containers with Highest Detections [Logs Wiz]" }, "gridData": { - "h": 18, - "i": "ace8bb17-267f-4942-9748-17f9f10749e0", - "w": 22, - "x": 26, - "y": 47 + "h": 15, + "i": "427510cc-fc9e-4691-9fac-4d5a3e377700", + "w": 24, + "x": 0, + "y": 108 }, - "panelIndex": "ace8bb17-267f-4942-9748-17f9f10749e0", + "panelIndex": "427510cc-fc9e-4691-9fac-4d5a3e377700", "type": "lens" }, { @@ -1658,12 +1516,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-84a5677b-c5e3-4940-8c67-7576961e2f79", + "name": "indexpattern-datasource-layer-76037f8d-37f5-405c-9974-6afefd777737", "type": "index-pattern" }, { "id": "logs-*", - "name": "777e84d3-528b-4286-9354-551204c418e8", + "name": "a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", "type": "index-pattern" } ], @@ -1672,17 +1530,35 @@ "datasourceStates": { "formBased": { "layers": { - "84a5677b-c5e3-4940-8c67-7576961e2f79": { + "76037f8d-37f5-405c-9974-6afefd777737": { "columnOrder": [ - "53ccfb54-7eaa-49da-99b1-912239fea452", - "72f83e5b-995e-44a3-8165-cdbffbe48c55" + "c645c311-34c1-415f-b5cf-2db750c4d709", + "226bbb04-3506-47e0-89e0-c4467ec25bef" ], "columns": { - "53ccfb54-7eaa-49da-99b1-912239fea452": { + "226bbb04-3506-47e0-89e0-c4467ec25bef": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "wiz.defend.id" + }, + "c645c311-34c1-415f-b5cf-2db750c4d709": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Severity", + "label": "Resource Types", "operationType": "terms", "params": { "exclude": [], @@ -1691,38 +1567,21 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "72f83e5b-995e-44a3-8165-cdbffbe48c55", + "columnId": "226bbb04-3506-47e0-89e0-c4467ec25bef", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "wiz.defend.severity" - }, - "72f83e5b-995e-44a3-8165-cdbffbe48c55": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "wiz.defend.id" + "sourceField": "wiz.defend.triggering_event.resources.type" } }, + "ignoreGlobalFilters": false, "incompleteColumns": {}, "sampling": 1 } @@ -1744,7 +1603,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "777e84d3-528b-4286-9354-551204c418e8", + "index": "a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", "key": "data_stream.dataset", "negate": false, "params": { @@ -1765,50 +1624,29 @@ "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rules": [ - { - "type": "other" - } - ], - "touched": false - } - ] - }, - "emptySizeRatio": 0, - "layerId": "84a5677b-c5e3-4940-8c67-7576961e2f79", - "layerType": "data", - "legendDisplay": "show", - "metrics": [ - "72f83e5b-995e-44a3-8165-cdbffbe48c55" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "53ccfb54-7eaa-49da-99b1-912239fea452" - ], - "truncateLegend": false + "alignment": "center", + "columnId": "c645c311-34c1-415f-b5cf-2db750c4d709", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "226bbb04-3506-47e0-89e0-c4467ec25bef", + "isMetric": true, + "isTransposed": false } ], - "shape": "donut" + "layerId": "76037f8d-37f5-405c-9974-6afefd777737", + "layerType": "data", + "rowHeight": "auto", + "rowHeightLines": -1 } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsDatatable" }, "enhancements": { "dynamicActions": { @@ -1824,7 +1662,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "777e84d3-528b-4286-9354-551204c418e8", + "index": "a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", "key": "data_stream.dataset", "negate": false, "params": { @@ -1846,16 +1684,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Detections by Severity [Logs Wiz]" + "title": "Top 10 Resource Types with Highest Detections [Logs Wiz]" }, "gridData": { - "h": 18, - "i": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c", - "w": 26, - "x": 0, - "y": 65 + "h": 15, + "i": "dc38a316-4a46-4c12-81d2-e78c90d1ceed", + "w": 24, + "x": 24, + "y": 108 }, - "panelIndex": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c", + "panelIndex": "dc38a316-4a46-4c12-81d2-e78c90d1ceed", "type": "lens" }, { @@ -1864,12 +1702,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-a7a27126-b5e1-48de-9cc0-c71a01b1a1e6", + "name": "indexpattern-datasource-layer-f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", "type": "index-pattern" }, { "id": "logs-*", - "name": "b490fb92-e24a-4835-8efb-9c185a528006", + "name": "7e48aaab-bddd-4e61-b73d-44dfa9464bd8", "type": "index-pattern" } ], @@ -1878,57 +1716,58 @@ "datasourceStates": { "formBased": { "layers": { - "a7a27126-b5e1-48de-9cc0-c71a01b1a1e6": { + "f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde": { "columnOrder": [ - "6cfe7580-3c96-467d-95d9-a205dfe98731", - "c0c347fa-83ea-4150-8e00-e7abb037a687" + "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa", + "601214c5-35bf-44dd-8d1f-2e8a0334ee44" ], "columns": { - "6cfe7580-3c96-467d-95d9-a205dfe98731": { + "601214c5-35bf-44dd-8d1f-2e8a0334ee44": { "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Actor Type", - "operationType": "terms", + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", "params": { - "exclude": [], + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "event.id" + }, + "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Commands", + "operationType": "terms", + "params": { + "exclude": [], "excludeIsRegex": false, "include": [], "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "c0c347fa-83ea-4150-8e00-e7abb037a687", + "columnId": "601214c5-35bf-44dd-8d1f-2e8a0334ee44", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.actor.type" - }, - "c0c347fa-83ea-4150-8e00-e7abb037a687": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "event.id" + "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.command" } }, + "ignoreGlobalFilters": false, "incompleteColumns": {}, "sampling": 1 } @@ -1950,7 +1789,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "b490fb92-e24a-4835-8efb-9c185a528006", + "index": "7e48aaab-bddd-4e61-b73d-44dfa9464bd8", "key": "data_stream.dataset", "negate": false, "params": { @@ -1971,51 +1810,27 @@ "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "colorMapping": { - "assignments": [], - "colorMode": { - "type": "categorical" - }, - "paletteId": "eui_amsterdam_color_blind", - "specialAssignments": [ - { - "color": { - "type": "loop" - }, - "rules": [ - { - "type": "other" - } - ], - "touched": false - } - ] - }, - "emptySizeRatio": 0, - "layerId": "a7a27126-b5e1-48de-9cc0-c71a01b1a1e6", - "layerType": "data", - "legendDisplay": "show", - "legendSize": "large", - "metrics": [ - "c0c347fa-83ea-4150-8e00-e7abb037a687" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "6cfe7580-3c96-467d-95d9-a205dfe98731" - ], - "truncateLegend": false + "alignment": "center", + "columnId": "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "601214c5-35bf-44dd-8d1f-2e8a0334ee44", + "isMetric": true, + "isTransposed": false } ], - "shape": "donut" + "layerId": "f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", + "layerType": "data" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsDatatable" }, "enhancements": { "dynamicActions": { @@ -2031,7 +1846,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "b490fb92-e24a-4835-8efb-9c185a528006", + "index": "7e48aaab-bddd-4e61-b73d-44dfa9464bd8", "key": "data_stream.dataset", "negate": false, "params": { @@ -2053,16 +1868,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Detections by Actor Type [Logs Wiz]" + "title": "Top 10 Common Malicious Commands" }, "gridData": { - "h": 18, - "i": "4ce47b03-10cc-4fe3-9de3-c239e5184334", - "w": 22, - "x": 26, - "y": 65 + "h": 15, + "i": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb", + "w": 24, + "x": 0, + "y": 123 }, - "panelIndex": "4ce47b03-10cc-4fe3-9de3-c239e5184334", + "panelIndex": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb", "type": "lens" }, { @@ -2071,12 +1886,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-f9c7cfa2-0061-466f-8909-040b89ecd361", + "name": "indexpattern-datasource-layer-d5419375-833b-4eeb-8119-6950d64230d9", "type": "index-pattern" }, { "id": "logs-*", - "name": "26a8762b-bd10-43a6-b632-1fc52b649c46", + "name": "dd22aafe-d388-43b7-9646-0403aaee81a7", "type": "index-pattern" } ], @@ -2085,29 +1900,17 @@ "datasourceStates": { "formBased": { "layers": { - "f9c7cfa2-0061-466f-8909-040b89ecd361": { + "d5419375-833b-4eeb-8119-6950d64230d9": { "columnOrder": [ - "dff56fec-70cc-4d6d-8a79-5c2794322a5a", - "9e564606-3929-45ec-91ac-71dbacc739e3" + "ae333c2a-5a00-4008-89a6-969caf914e83", + "c6d798c8-accb-4ae1-975b-652a8eed2d07" ], "columns": { - "9e564606-3929-45ec-91ac-71dbacc739e3": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "event.id" - }, - "dff56fec-70cc-4d6d-8a79-5c2794322a5a": { + "ae333c2a-5a00-4008-89a6-969caf914e83": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Country ISO Code", + "label": "Trigger Rule Names", "operationType": "terms", "params": { "exclude": [], @@ -2116,7 +1919,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "9e564606-3929-45ec-91ac-71dbacc739e3", + "columnId": "c6d798c8-accb-4ae1-975b-652a8eed2d07", "type": "column" }, "orderDirection": "desc", @@ -2124,11 +1927,28 @@ "parentFormat": { "id": "terms" }, - "secondaryFields": [], - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "source.geo.country_iso_code" + "sourceField": "rule.name" + }, + "c6d798c8-accb-4ae1-975b-652a8eed2d07": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "wiz.defend.id" } }, "ignoreGlobalFilters": false, @@ -2153,7 +1973,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "26a8762b-bd10-43a6-b632-1fc52b649c46", + "index": "dd22aafe-d388-43b7-9646-0403aaee81a7", "key": "data_stream.dataset", "negate": false, "params": { @@ -2174,15 +1994,27 @@ "query": "" }, "visualization": { - "layerId": "f9c7cfa2-0061-466f-8909-040b89ecd361", - "layerType": "data", - "regionAccessor": "dff56fec-70cc-4d6d-8a79-5c2794322a5a", - "valueAccessor": "9e564606-3929-45ec-91ac-71dbacc739e3" + "columns": [ + { + "alignment": "center", + "columnId": "c6d798c8-accb-4ae1-975b-652a8eed2d07", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "ae333c2a-5a00-4008-89a6-969caf914e83", + "isMetric": false, + "isTransposed": false + } + ], + "layerId": "d5419375-833b-4eeb-8119-6950d64230d9", + "layerType": "data" } }, "title": "", "type": "lens", - "visualizationType": "lnsChoropleth" + "visualizationType": "lnsDatatable" }, "enhancements": { "dynamicActions": { @@ -2198,7 +2030,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "26a8762b-bd10-43a6-b632-1fc52b649c46", + "index": "dd22aafe-d388-43b7-9646-0403aaee81a7", "key": "data_stream.dataset", "negate": false, "params": { @@ -2220,16 +2052,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Detections by Actor IP [Logs Wiz]" + "title": "Top 10 Trigger Rules with Highest Detections [Logs Wiz]" }, "gridData": { - "h": 25, - "i": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7", - "w": 48, - "x": 0, - "y": 83 + "h": 15, + "i": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc", + "w": 24, + "x": 24, + "y": 123 }, - "panelIndex": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7", + "panelIndex": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc", "type": "lens" }, { @@ -2238,12 +2070,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-d2b4912e-3ced-49ac-aa99-2969720e2f1f", + "name": "indexpattern-datasource-layer-c1458332-407f-40dc-85ca-3c69a75f6153", "type": "index-pattern" }, { "id": "logs-*", - "name": "e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", + "name": "e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", "type": "index-pattern" } ], @@ -2252,14 +2084,40 @@ "datasourceStates": { "formBased": { "layers": { - "d2b4912e-3ced-49ac-aa99-2969720e2f1f": { + "c1458332-407f-40dc-85ca-3c69a75f6153": { "columnOrder": [ - "68141a00-8b12-4f48-810a-1ff8b3eeabf7", - "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6", - "484781b7-7d30-4ad1-8b17-8e8e6abf9e40" + "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e", + "3f0dc38a-9424-4a96-8ac2-fd9de5aad734", + "466b3487-b5e1-461d-8b18-2d274ae72d05" ], "columns": { - "484781b7-7d30-4ad1-8b17-8e8e6abf9e40": { + "3f0dc38a-9424-4a96-8ac2-fd9de5aad734": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Threat URL", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "threat.indicator.reference" + }, + "466b3487-b5e1-461d-8b18-2d274ae72d05": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -2277,11 +2135,11 @@ "scale": "ratio", "sourceField": "wiz.defend.id" }, - "68141a00-8b12-4f48-810a-1ff8b3eeabf7": { + "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Container Name", + "label": "Threat ID", "operationType": "terms", "params": { "exclude": [], @@ -2290,7 +2148,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", + "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", "type": "column" }, "orderDirection": "desc", @@ -2301,33 +2159,7 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.container.name" - }, - "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Container ID", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.container.id" + "sourceField": "threat.indicator.id" } }, "ignoreGlobalFilters": false, @@ -2352,7 +2184,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", + "index": "e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", "key": "data_stream.dataset", "negate": false, "params": { @@ -2376,24 +2208,26 @@ "columns": [ { "alignment": "center", - "columnId": "68141a00-8b12-4f48-810a-1ff8b3eeabf7", + "columnId": "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e", "isMetric": false, "isTransposed": false }, { "alignment": "center", - "columnId": "484781b7-7d30-4ad1-8b17-8e8e6abf9e40", - "isMetric": true, + "columnId": "3f0dc38a-9424-4a96-8ac2-fd9de5aad734", + "isMetric": false, "isTransposed": false }, { "alignment": "center", - "columnId": "cd2fa083-75b3-49a8-a3bc-2f59146d8fa6", - "isMetric": false, + "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", + "isMetric": true, "isTransposed": false } ], - "layerId": "d2b4912e-3ced-49ac-aa99-2969720e2f1f", + "headerRowHeight": "custom", + "headerRowHeightLines": 3, + "layerId": "c1458332-407f-40dc-85ca-3c69a75f6153", "layerType": "data", "rowHeight": "auto", "rowHeightLines": -1 @@ -2417,7 +2251,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", + "index": "e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", "key": "data_stream.dataset", "negate": false, "params": { @@ -2439,16 +2273,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Top 10 Containers with Highest Detections [Logs Wiz]" + "title": "Top 10 Detected Threats [Logs Wiz]" }, "gridData": { "h": 15, - "i": "427510cc-fc9e-4691-9fac-4d5a3e377700", + "i": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44", "w": 24, "x": 0, - "y": 108 + "y": 138 }, - "panelIndex": "427510cc-fc9e-4691-9fac-4d5a3e377700", + "panelIndex": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44", "type": "lens" }, { @@ -2457,12 +2291,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-76037f8d-37f5-405c-9974-6afefd777737", + "name": "indexpattern-datasource-layer-5d7b131e-a2dc-453a-897a-c384a62a3fc6", "type": "index-pattern" }, { "id": "logs-*", - "name": "a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", + "name": "cd797741-fccc-48de-879a-37abf3c5f1eb", "type": "index-pattern" } ], @@ -2471,13 +2305,14 @@ "datasourceStates": { "formBased": { "layers": { - "76037f8d-37f5-405c-9974-6afefd777737": { + "5d7b131e-a2dc-453a-897a-c384a62a3fc6": { "columnOrder": [ - "c645c311-34c1-415f-b5cf-2db750c4d709", - "226bbb04-3506-47e0-89e0-c4467ec25bef" + "06e6d10f-51b4-458b-b70b-ace175849baf", + "9663e831-b7ed-474f-b699-34b54039c383", + "052b1acc-59b8-43f9-b9f6-d627732628a9" ], "columns": { - "226bbb04-3506-47e0-89e0-c4467ec25bef": { + "052b1acc-59b8-43f9-b9f6-d627732628a9": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -2493,13 +2328,27 @@ } }, "scale": "ratio", - "sourceField": "wiz.defend.id" + "sourceField": "event.id" }, - "c645c311-34c1-415f-b5cf-2db750c4d709": { + "06e6d10f-51b4-458b-b70b-ace175849baf": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Triggering Event Time", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9663e831-b7ed-474f-b699-34b54039c383": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Resource Types", + "label": "Triggering Event Source", "operationType": "terms", "params": { "exclude": [], @@ -2508,7 +2357,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "226bbb04-3506-47e0-89e0-c4467ec25bef", + "columnId": "052b1acc-59b8-43f9-b9f6-d627732628a9", "type": "column" }, "orderDirection": "desc", @@ -2516,10 +2365,11 @@ "parentFormat": { "id": "terms" }, - "size": 10 + "secondaryFields": [], + "size": 20 }, "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.resources.type" + "sourceField": "event.provider" } }, "ignoreGlobalFilters": false, @@ -2544,7 +2394,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", + "index": "cd797741-fccc-48de-879a-37abf3c5f1eb", "key": "data_stream.dataset", "negate": false, "params": { @@ -2568,21 +2418,25 @@ "columns": [ { "alignment": "center", - "columnId": "c645c311-34c1-415f-b5cf-2db750c4d709", + "columnId": "052b1acc-59b8-43f9-b9f6-d627732628a9", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "06e6d10f-51b4-458b-b70b-ace175849baf", "isMetric": false, "isTransposed": false }, { "alignment": "center", - "columnId": "226bbb04-3506-47e0-89e0-c4467ec25bef", - "isMetric": true, + "columnId": "9663e831-b7ed-474f-b699-34b54039c383", + "isMetric": false, "isTransposed": false } ], - "layerId": "76037f8d-37f5-405c-9974-6afefd777737", - "layerType": "data", - "rowHeight": "auto", - "rowHeightLines": -1 + "layerId": "5d7b131e-a2dc-453a-897a-c384a62a3fc6", + "layerType": "data" } }, "title": "", @@ -2603,7 +2457,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", + "index": "cd797741-fccc-48de-879a-37abf3c5f1eb", "key": "data_stream.dataset", "negate": false, "params": { @@ -2625,30 +2479,52 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Top 10 Resource Types with Highest Detections [Logs Wiz]" + "title": "Detection Triggering Event Details [Logs Wiz]" }, "gridData": { "h": 15, - "i": "dc38a316-4a46-4c12-81d2-e78c90d1ceed", + "i": "77df9a6b-af9e-412f-a916-fc83bd7c3194", "w": 24, "x": 24, - "y": 108 + "y": 138 }, - "panelIndex": "dc38a316-4a46-4c12-81d2-e78c90d1ceed", + "panelIndex": "77df9a6b-af9e-412f-a916-fc83bd7c3194", "type": "lens" }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedObjectId": "wiz-f661536e-81c2-455b-9a4f-9840d910c318", + "title": "Detection Essential Details [Logs Wiz]" + }, + "gridData": { + "h": 15, + "i": "022a726e-0fc7-4cee-8fe8-42bd959353e2", + "w": 48, + "x": 0, + "y": 153 + }, + "panelIndex": "022a726e-0fc7-4cee-8fe8-42bd959353e2", + "panelRefName": "panel_022a726e-0fc7-4cee-8fe8-42bd959353e2", + "type": "search" + }, { "embeddableConfig": { "attributes": { "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", + "name": "indexpattern-datasource-layer-53610d78-e92c-427d-bfcf-374a2135f8e3", "type": "index-pattern" }, { "id": "logs-*", - "name": "7e48aaab-bddd-4e61-b73d-44dfa9464bd8", + "name": "e51064e9-6f6d-4b9e-b51b-bd7761849547", "type": "index-pattern" } ], @@ -2657,20 +2533,34 @@ "datasourceStates": { "formBased": { "layers": { - "f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde": { + "53610d78-e92c-427d-bfcf-374a2135f8e3": { "columnOrder": [ - "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa", - "601214c5-35bf-44dd-8d1f-2e8a0334ee44" + "2a335dea-e98d-4537-9d8b-5b305747306d", + "bcf37841-f643-449b-8367-7d53656c7da1" ], "columns": { - "601214c5-35bf-44dd-8d1f-2e8a0334ee44": { + "2a335dea-e98d-4537-9d8b-5b305747306d": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Detection Timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "wiz.defend.created_at" + }, + "bcf37841-f643-449b-8367-7d53656c7da1": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "unique_count", "params": { - "emptyAsNull": true, + "emptyAsNull": false, "format": { "id": "number", "params": { @@ -2679,36 +2569,9 @@ } }, "scale": "ratio", - "sourceField": "event.id" - }, - "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Commands", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "601214c5-35bf-44dd-8d1f-2e8a0334ee44", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "wiz.defend.triggering_event.runtime_details.process_tree.command" + "sourceField": "wiz.defend.id" } }, - "ignoreGlobalFilters": false, "incompleteColumns": {}, "sampling": 1 } @@ -2730,7 +2593,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "7e48aaab-bddd-4e61-b73d-44dfa9464bd8", + "index": "e51064e9-6f6d-4b9e-b51b-bd7761849547", "key": "data_stream.dataset", "negate": false, "params": { @@ -2751,74 +2614,119 @@ "query": "" }, "visualization": { - "columns": [ - { - "alignment": "center", - "columnId": "8f6d58e5-7ebc-44f8-a34e-af340ae9beaa", - "isMetric": false, - "isTransposed": false - }, - { - "alignment": "center", - "columnId": "601214c5-35bf-44dd-8d1f-2e8a0334ee44", - "isMetric": true, - "isTransposed": false - } - ], - "layerId": "f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": { - "dynamicActions": { - "events": [] - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "7e48aaab-bddd-4e61-b73d-44dfa9464bd8", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "wiz.defend" + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "wiz.defend" - } - } - } - ], - "query": { + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "bcf37841-f643-449b-8367-7d53656c7da1" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rules": [ + { + "type": "other" + } + ], + "touched": false + } + ] + }, + "layerId": "53610d78-e92c-427d-bfcf-374a2135f8e3", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "2a335dea-e98d-4537-9d8b-5b305747306d" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e51064e9-6f6d-4b9e-b51b-bd7761849547", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.defend" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.defend" + } + } + } + ], + "query": { "language": "kuery", "query": "" }, "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Top 10 Common Malicious Commands" + "title": "Detections over Time [Logs Wiz]" }, "gridData": { "h": 15, - "i": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb", - "w": 24, - "x": 0, - "y": 123 + "i": "cc20569b-60f2-4fc0-93cc-1152902c76a0", + "w": 34, + "x": 14, + "y": 0 }, - "panelIndex": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb", + "panelIndex": "cc20569b-60f2-4fc0-93cc-1152902c76a0", "type": "lens" }, { @@ -2827,12 +2735,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-d5419375-833b-4eeb-8119-6950d64230d9", + "name": "indexpattern-datasource-layer-f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", "type": "index-pattern" }, { "id": "logs-*", - "name": "dd22aafe-d388-43b7-9646-0403aaee81a7", + "name": "1fe68821-6dda-4f6b-b47d-9cd824fef43d", "type": "index-pattern" } ], @@ -2841,17 +2749,35 @@ "datasourceStates": { "formBased": { "layers": { - "d5419375-833b-4eeb-8119-6950d64230d9": { + "f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c": { "columnOrder": [ - "ae333c2a-5a00-4008-89a6-969caf914e83", - "c6d798c8-accb-4ae1-975b-652a8eed2d07" + "d4e3a535-a7cf-48ca-b284-ad56d5794f16", + "a6cebce0-c3fb-457b-832b-a0356ad54c2a" ], "columns": { - "ae333c2a-5a00-4008-89a6-969caf914e83": { + "a6cebce0-c3fb-457b-832b-a0356ad54c2a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "wiz.defend.id" + }, + "d4e3a535-a7cf-48ca-b284-ad56d5794f16": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Trigger Rule Names", + "label": "MITRE Techniques", "operationType": "terms", "params": { "exclude": [], @@ -2860,7 +2786,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "c6d798c8-accb-4ae1-975b-652a8eed2d07", + "columnId": "a6cebce0-c3fb-457b-832b-a0356ad54c2a", "type": "column" }, "orderDirection": "desc", @@ -2871,28 +2797,9 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "rule.name" - }, - "c6d798c8-accb-4ae1-975b-652a8eed2d07": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "wiz.defend.id" + "sourceField": "threat.technique.id" } }, - "ignoreGlobalFilters": false, "incompleteColumns": {}, "sampling": 1 } @@ -2914,7 +2821,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "dd22aafe-d388-43b7-9646-0403aaee81a7", + "index": "1fe68821-6dda-4f6b-b47d-9cd824fef43d", "key": "data_stream.dataset", "negate": false, "params": { @@ -2935,27 +2842,73 @@ "query": "" }, "visualization": { - "columns": [ - { - "alignment": "center", - "columnId": "c6d798c8-accb-4ae1-975b-652a8eed2d07", - "isMetric": true, - "isTransposed": false - }, + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "alignment": "center", - "columnId": "ae333c2a-5a00-4008-89a6-969caf914e83", - "isMetric": false, - "isTransposed": false + "accessors": [ + "a6cebce0-c3fb-457b-832b-a0356ad54c2a" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rules": [ + { + "type": "other" + } + ], + "touched": false + } + ] + }, + "layerId": "f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "d4e3a535-a7cf-48ca-b284-ad56d5794f16" } ], - "layerId": "d5419375-833b-4eeb-8119-6950d64230d9", - "layerType": "data" + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsXY" }, "enhancements": { "dynamicActions": { @@ -2971,7 +2924,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "dd22aafe-d388-43b7-9646-0403aaee81a7", + "index": "1fe68821-6dda-4f6b-b47d-9cd824fef43d", "key": "data_stream.dataset", "negate": false, "params": { @@ -2993,16 +2946,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Top 10 Trigger Rules with Highest Detections [Logs Wiz]" + "title": "Detections by MITRE Techniques [Logs Wiz]" }, "gridData": { - "h": 15, - "i": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc", - "w": 24, - "x": 24, - "y": 123 + "h": 10, + "i": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e", + "w": 17, + "x": 14, + "y": 15 }, - "panelIndex": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc", + "panelIndex": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e", "type": "lens" }, { @@ -3011,12 +2964,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-c1458332-407f-40dc-85ca-3c69a75f6153", + "name": "indexpattern-datasource-layer-65bbc691-ab9f-40f0-8258-66f28c54eeff", "type": "index-pattern" }, { "id": "logs-*", - "name": "e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", + "name": "e967ce57-1163-4382-ba57-bd40b7bacad3", "type": "index-pattern" } ], @@ -3025,18 +2978,17 @@ "datasourceStates": { "formBased": { "layers": { - "c1458332-407f-40dc-85ca-3c69a75f6153": { + "65bbc691-ab9f-40f0-8258-66f28c54eeff": { "columnOrder": [ - "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e", - "3f0dc38a-9424-4a96-8ac2-fd9de5aad734", - "466b3487-b5e1-461d-8b18-2d274ae72d05" + "08ae64da-5722-4701-b325-0d76a2e0d46b", + "09e064d7-68b4-4ee8-92b8-f71499245cd1" ], "columns": { - "3f0dc38a-9424-4a96-8ac2-fd9de5aad734": { + "08ae64da-5722-4701-b325-0d76a2e0d46b": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Threat URL", + "label": "MITRE Tactic", "operationType": "terms", "params": { "exclude": [], @@ -3045,20 +2997,20 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", + "columnId": "09e064d7-68b4-4ee8-92b8-f71499245cd1", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, + "otherBucket": true, "parentFormat": { "id": "terms" }, "size": 10 }, "scale": "ordinal", - "sourceField": "threat.indicator.reference" + "sourceField": "threat.tactic.id" }, - "466b3487-b5e1-461d-8b18-2d274ae72d05": { + "09e064d7-68b4-4ee8-92b8-f71499245cd1": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -3075,35 +3027,8 @@ }, "scale": "ratio", "sourceField": "wiz.defend.id" - }, - "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Threat ID", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "threat.indicator.id" } }, - "ignoreGlobalFilters": false, "incompleteColumns": {}, "sampling": 1 } @@ -3125,7 +3050,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", + "index": "e967ce57-1163-4382-ba57-bd40b7bacad3", "key": "data_stream.dataset", "negate": false, "params": { @@ -3146,37 +3071,72 @@ "query": "" }, "visualization": { - "columns": [ - { - "alignment": "center", - "columnId": "b7f34afc-6ea7-4604-902a-5dbf3e5a7f4e", - "isMetric": false, - "isTransposed": false - }, - { - "alignment": "center", - "columnId": "3f0dc38a-9424-4a96-8ac2-fd9de5aad734", - "isMetric": false, - "isTransposed": false - }, + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "alignment": "center", - "columnId": "466b3487-b5e1-461d-8b18-2d274ae72d05", - "isMetric": true, - "isTransposed": false + "accessors": [ + "09e064d7-68b4-4ee8-92b8-f71499245cd1" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rules": [ + { + "type": "other" + } + ], + "touched": false + } + ] + }, + "layerId": "65bbc691-ab9f-40f0-8258-66f28c54eeff", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "08ae64da-5722-4701-b325-0d76a2e0d46b" } ], - "headerRowHeight": "custom", - "headerRowHeightLines": 3, - "layerId": "c1458332-407f-40dc-85ca-3c69a75f6153", - "layerType": "data", - "rowHeight": "auto", - "rowHeightLines": -1 + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsXY" }, "enhancements": { "dynamicActions": { @@ -3192,7 +3152,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", + "index": "e967ce57-1163-4382-ba57-bd40b7bacad3", "key": "data_stream.dataset", "negate": false, "params": { @@ -3214,16 +3174,16 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Top 10 Detected Threats [Logs Wiz]" + "title": "Detections by MITRE Tactic [Logs Wiz]" }, "gridData": { - "h": 15, - "i": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44", - "w": 24, - "x": 0, - "y": 138 + "h": 10, + "i": "1a0212e1-6df2-4187-8bb0-029f04f196d1", + "w": 17, + "x": 31, + "y": 15 }, - "panelIndex": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44", + "panelIndex": "1a0212e1-6df2-4187-8bb0-029f04f196d1", "type": "lens" }, { @@ -3232,64 +3192,31 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-5d7b131e-a2dc-453a-897a-c384a62a3fc6", + "name": "indexpattern-datasource-layer-2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", "type": "index-pattern" }, - { - "id": "logs-*", - "name": "cd797741-fccc-48de-879a-37abf3c5f1eb", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "5d7b131e-a2dc-453a-897a-c384a62a3fc6": { - "columnOrder": [ - "06e6d10f-51b4-458b-b70b-ace175849baf", - "9663e831-b7ed-474f-b699-34b54039c383", - "052b1acc-59b8-43f9-b9f6-d627732628a9" - ], - "columns": { - "052b1acc-59b8-43f9-b9f6-d627732628a9": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": false, - "format": { - "id": "number", - "params": { - "decimals": 0 - } - } - }, - "scale": "ratio", - "sourceField": "event.id" - }, - "06e6d10f-51b4-458b-b70b-ace175849baf": { - "customLabel": true, - "dataType": "date", - "isBucketed": true, - "label": "Triggering Event Time", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "9663e831-b7ed-474f-b699-34b54039c383": { + { + "id": "logs-*", + "name": "26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2e38c3a3-9cb3-42f0-8264-5c0de2b7d151": { + "columnOrder": [ + "442a0743-a4e1-4ab0-893b-ee248d2a2bf2", + "acb81f97-78f9-4aaf-903c-06ac7d34cf99" + ], + "columns": { + "442a0743-a4e1-4ab0-893b-ee248d2a2bf2": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Triggering Event Source", + "label": "Affected Resource Types", "operationType": "terms", "params": { "exclude": [], @@ -3298,22 +3225,38 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "052b1acc-59b8-43f9-b9f6-d627732628a9", + "columnId": "acb81f97-78f9-4aaf-903c-06ac7d34cf99", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, + "otherBucket": true, "parentFormat": { "id": "terms" }, - "secondaryFields": [], - "size": 20 + "size": 10 }, "scale": "ordinal", - "sourceField": "event.provider" + "sourceField": "wiz.defend.triggering_event.resources.type" + }, + "acb81f97-78f9-4aaf-903c-06ac7d34cf99": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "event.id" } }, - "ignoreGlobalFilters": false, "incompleteColumns": {}, "sampling": 1 } @@ -3335,7 +3278,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "cd797741-fccc-48de-879a-37abf3c5f1eb", + "index": "26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", "key": "data_stream.dataset", "negate": false, "params": { @@ -3356,33 +3299,72 @@ "query": "" }, "visualization": { - "columns": [ - { - "alignment": "center", - "columnId": "052b1acc-59b8-43f9-b9f6-d627732628a9", - "isMetric": true, - "isTransposed": false - }, - { - "alignment": "center", - "columnId": "06e6d10f-51b4-458b-b70b-ace175849baf", - "isMetric": false, - "isTransposed": false - }, + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "alignment": "center", - "columnId": "9663e831-b7ed-474f-b699-34b54039c383", - "isMetric": false, - "isTransposed": false + "accessors": [ + "acb81f97-78f9-4aaf-903c-06ac7d34cf99" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rules": [ + { + "type": "other" + } + ], + "touched": false + } + ] + }, + "layerId": "2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "442a0743-a4e1-4ab0-893b-ee248d2a2bf2" } ], - "layerId": "5d7b131e-a2dc-453a-897a-c384a62a3fc6", - "layerType": "data" + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsXY" }, "enhancements": { "dynamicActions": { @@ -3398,7 +3380,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "cd797741-fccc-48de-879a-37abf3c5f1eb", + "index": "26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", "key": "data_stream.dataset", "negate": false, "params": { @@ -3420,39 +3402,56 @@ "syncColors": false, "syncCursor": true, "syncTooltips": false, - "title": "Detection Triggering Event Details [Logs Wiz]" + "title": "Affected Resources by Type [Logs Wiz]" }, "gridData": { - "h": 15, - "i": "77df9a6b-af9e-412f-a916-fc83bd7c3194", - "w": 24, - "x": 24, - "y": 138 + "h": 10, + "i": "5249b0f0-30ea-472f-99e7-ebd31a239802", + "w": 34, + "x": 14, + "y": 25 }, - "panelIndex": "77df9a6b-af9e-412f-a916-fc83bd7c3194", + "panelIndex": "5249b0f0-30ea-472f-99e7-ebd31a239802", "type": "lens" }, { "embeddableConfig": { - "description": "", "enhancements": { "dynamicActions": { "events": [] } }, - "savedObjectId": "f661536e-81c2-455b-9a4f-9840d910c318", - "title": "Detection Essential Details [Logs Wiz]" + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "#### Navigation\n\n[Wiz Audit Dashboard](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273) \n[Wiz Cloud Configuration Finding Dashboard](#/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368) \n**Wiz Defend Dashboard** \n[Wiz Issue Dashboard](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf) \n[Wiz Vulnerability Dashboard](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf) \n\n[Integration Page](/app/integrations/detail/wiz/overview)\n\n#### Dashboard Overview\n\nThis dashboard provides visibility into detection events, enabling effective threat monitoring across cloud and container environments. It features a Control Panel for filtering by severity and trigger type, and includes visualizations such as detections over time, top cloud accounts, containers, and resource types with highest detections. It highlights trends by MITRE tactics and techniques, actor types, and trigger types through pie and bar charts, while a geographic map displays actor IP distribution. A table details triggering events, and additional tables showcase top threats, rules, and common malicious commands, supporting deeper investigation and response.", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } }, "gridData": { - "h": 15, - "i": "022a726e-0fc7-4cee-8fe8-42bd959353e2", - "w": 48, + "h": 35, + "i": "ced2a470-d1c8-4d56-9f70-e8d3aa6d81c4", + "w": 14, "x": 0, - "y": 153 + "y": 0 }, - "panelIndex": "022a726e-0fc7-4cee-8fe8-42bd959353e2", - "panelRefName": "panel_022a726e-0fc7-4cee-8fe8-42bd959353e2", - "type": "search" + "panelIndex": "ced2a470-d1c8-4d56-9f70-e8d3aa6d81c4", + "type": "visualization" } ], "timeRestore": false, @@ -3460,173 +3459,178 @@ "version": 3 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-05-26T06:30:27.699Z", + "created_at": "2026-05-26T09:08:18.772Z", "id": "wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a", "references": [ { "id": "logs-*", - "name": "cc20569b-60f2-4fc0-93cc-1152902c76a0:indexpattern-datasource-layer-53610d78-e92c-427d-bfcf-374a2135f8e3", + "name": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518:indexpattern-datasource-layer-6be8a450-9cac-43cb-a7e1-3b5b3f504af4", "type": "index-pattern" }, { "id": "logs-*", - "name": "cc20569b-60f2-4fc0-93cc-1152902c76a0:e51064e9-6f6d-4b9e-b51b-bd7761849547", + "name": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518:12099fd9-f20a-4e2a-91d1-1b8aac061cad", "type": "index-pattern" }, { "id": "logs-*", - "name": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e:indexpattern-datasource-layer-f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", + "name": "d1455288-89ba-4146-b530-dda7f9663bbc:indexpattern-datasource-layer-a954312a-b2e7-4160-8c32-42fdbaa7c639", "type": "index-pattern" }, { "id": "logs-*", - "name": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e:1fe68821-6dda-4f6b-b47d-9cd824fef43d", + "name": "d1455288-89ba-4146-b530-dda7f9663bbc:38a738be-567c-4797-b05f-ad81ae8860f3", "type": "index-pattern" }, { "id": "logs-*", - "name": "1a0212e1-6df2-4187-8bb0-029f04f196d1:indexpattern-datasource-layer-65bbc691-ab9f-40f0-8258-66f28c54eeff", + "name": "ace8bb17-267f-4942-9748-17f9f10749e0:indexpattern-datasource-layer-9722040c-5b00-410c-a720-87bfb162c84a", "type": "index-pattern" }, { "id": "logs-*", - "name": "1a0212e1-6df2-4187-8bb0-029f04f196d1:e967ce57-1163-4382-ba57-bd40b7bacad3", + "name": "ace8bb17-267f-4942-9748-17f9f10749e0:ae446cbc-21c9-4c28-9188-8745078e3f68", "type": "index-pattern" }, { "id": "logs-*", - "name": "5249b0f0-30ea-472f-99e7-ebd31a239802:indexpattern-datasource-layer-2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", + "name": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c:indexpattern-datasource-layer-84a5677b-c5e3-4940-8c67-7576961e2f79", "type": "index-pattern" }, { "id": "logs-*", - "name": "5249b0f0-30ea-472f-99e7-ebd31a239802:26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", + "name": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c:777e84d3-528b-4286-9354-551204c418e8", "type": "index-pattern" }, { "id": "logs-*", - "name": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518:indexpattern-datasource-layer-6be8a450-9cac-43cb-a7e1-3b5b3f504af4", + "name": "4ce47b03-10cc-4fe3-9de3-c239e5184334:indexpattern-datasource-layer-a7a27126-b5e1-48de-9cc0-c71a01b1a1e6", "type": "index-pattern" }, { "id": "logs-*", - "name": "0246d4ce-3dda-4e9f-bc69-7122fc6aa518:12099fd9-f20a-4e2a-91d1-1b8aac061cad", + "name": "4ce47b03-10cc-4fe3-9de3-c239e5184334:b490fb92-e24a-4835-8efb-9c185a528006", "type": "index-pattern" }, { "id": "logs-*", - "name": "d1455288-89ba-4146-b530-dda7f9663bbc:indexpattern-datasource-layer-a954312a-b2e7-4160-8c32-42fdbaa7c639", + "name": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7:indexpattern-datasource-layer-f9c7cfa2-0061-466f-8909-040b89ecd361", "type": "index-pattern" }, { "id": "logs-*", - "name": "d1455288-89ba-4146-b530-dda7f9663bbc:38a738be-567c-4797-b05f-ad81ae8860f3", + "name": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7:26a8762b-bd10-43a6-b632-1fc52b649c46", "type": "index-pattern" }, { "id": "logs-*", - "name": "ace8bb17-267f-4942-9748-17f9f10749e0:indexpattern-datasource-layer-9722040c-5b00-410c-a720-87bfb162c84a", + "name": "427510cc-fc9e-4691-9fac-4d5a3e377700:indexpattern-datasource-layer-d2b4912e-3ced-49ac-aa99-2969720e2f1f", "type": "index-pattern" }, { "id": "logs-*", - "name": "ace8bb17-267f-4942-9748-17f9f10749e0:ae446cbc-21c9-4c28-9188-8745078e3f68", + "name": "427510cc-fc9e-4691-9fac-4d5a3e377700:e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", "type": "index-pattern" }, { "id": "logs-*", - "name": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c:indexpattern-datasource-layer-84a5677b-c5e3-4940-8c67-7576961e2f79", + "name": "dc38a316-4a46-4c12-81d2-e78c90d1ceed:indexpattern-datasource-layer-76037f8d-37f5-405c-9974-6afefd777737", "type": "index-pattern" }, { "id": "logs-*", - "name": "9afe8b96-eb6a-44e6-97e7-15c766d26a1c:777e84d3-528b-4286-9354-551204c418e8", + "name": "dc38a316-4a46-4c12-81d2-e78c90d1ceed:a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", "type": "index-pattern" }, { "id": "logs-*", - "name": "4ce47b03-10cc-4fe3-9de3-c239e5184334:indexpattern-datasource-layer-a7a27126-b5e1-48de-9cc0-c71a01b1a1e6", + "name": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb:indexpattern-datasource-layer-f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", "type": "index-pattern" }, { "id": "logs-*", - "name": "4ce47b03-10cc-4fe3-9de3-c239e5184334:b490fb92-e24a-4835-8efb-9c185a528006", + "name": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb:7e48aaab-bddd-4e61-b73d-44dfa9464bd8", "type": "index-pattern" }, { "id": "logs-*", - "name": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7:indexpattern-datasource-layer-f9c7cfa2-0061-466f-8909-040b89ecd361", + "name": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc:indexpattern-datasource-layer-d5419375-833b-4eeb-8119-6950d64230d9", "type": "index-pattern" }, { "id": "logs-*", - "name": "8aa3eb20-a518-455e-aa8e-1fb39ba0e2e7:26a8762b-bd10-43a6-b632-1fc52b649c46", + "name": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc:dd22aafe-d388-43b7-9646-0403aaee81a7", "type": "index-pattern" }, { "id": "logs-*", - "name": "427510cc-fc9e-4691-9fac-4d5a3e377700:indexpattern-datasource-layer-d2b4912e-3ced-49ac-aa99-2969720e2f1f", + "name": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44:indexpattern-datasource-layer-c1458332-407f-40dc-85ca-3c69a75f6153", "type": "index-pattern" }, { "id": "logs-*", - "name": "427510cc-fc9e-4691-9fac-4d5a3e377700:e25a34ad-eee8-44a1-89f8-7d7808d9a1d9", + "name": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44:e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", "type": "index-pattern" }, { "id": "logs-*", - "name": "dc38a316-4a46-4c12-81d2-e78c90d1ceed:indexpattern-datasource-layer-76037f8d-37f5-405c-9974-6afefd777737", + "name": "77df9a6b-af9e-412f-a916-fc83bd7c3194:indexpattern-datasource-layer-5d7b131e-a2dc-453a-897a-c384a62a3fc6", "type": "index-pattern" }, { "id": "logs-*", - "name": "dc38a316-4a46-4c12-81d2-e78c90d1ceed:a12cdeed-01c1-4d8d-a6e6-82d0e29666c9", + "name": "77df9a6b-af9e-412f-a916-fc83bd7c3194:cd797741-fccc-48de-879a-37abf3c5f1eb", "type": "index-pattern" }, { - "id": "logs-*", - "name": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb:indexpattern-datasource-layer-f3c8e76c-8dbe-44bf-a4c0-1953cf2dffde", - "type": "index-pattern" + "id": "wiz-f661536e-81c2-455b-9a4f-9840d910c318", + "name": "022a726e-0fc7-4cee-8fe8-42bd959353e2:panel_022a726e-0fc7-4cee-8fe8-42bd959353e2", + "type": "search" + }, + { + "id": "wiz-f661536e-81c2-455b-9a4f-9840d910c318", + "name": "022a726e-0fc7-4cee-8fe8-42bd959353e2:panel_022a726e-0fc7-4cee-8fe8-42bd959353e2", + "type": "search" }, { "id": "logs-*", - "name": "2d6af0b4-36e2-46ad-b5a8-ceacef6219cb:7e48aaab-bddd-4e61-b73d-44dfa9464bd8", + "name": "cc20569b-60f2-4fc0-93cc-1152902c76a0:indexpattern-datasource-layer-53610d78-e92c-427d-bfcf-374a2135f8e3", "type": "index-pattern" }, { "id": "logs-*", - "name": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc:indexpattern-datasource-layer-d5419375-833b-4eeb-8119-6950d64230d9", + "name": "cc20569b-60f2-4fc0-93cc-1152902c76a0:e51064e9-6f6d-4b9e-b51b-bd7761849547", "type": "index-pattern" }, { "id": "logs-*", - "name": "dc2bc10a-8f52-4242-81b2-515c18ad2ccc:dd22aafe-d388-43b7-9646-0403aaee81a7", + "name": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e:indexpattern-datasource-layer-f9a84bcb-a0e2-40a5-82d0-f8bd1fb49e4c", "type": "index-pattern" }, { "id": "logs-*", - "name": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44:indexpattern-datasource-layer-c1458332-407f-40dc-85ca-3c69a75f6153", + "name": "69a3edc2-dc12-454a-af9f-8eb3fbfb191e:1fe68821-6dda-4f6b-b47d-9cd824fef43d", "type": "index-pattern" }, { "id": "logs-*", - "name": "ee5926f1-4f4c-4ff2-beb0-afa71c199d44:e0a3af3d-69e3-444b-addc-44cf5a0bf2ff", + "name": "1a0212e1-6df2-4187-8bb0-029f04f196d1:indexpattern-datasource-layer-65bbc691-ab9f-40f0-8258-66f28c54eeff", "type": "index-pattern" }, { "id": "logs-*", - "name": "77df9a6b-af9e-412f-a916-fc83bd7c3194:indexpattern-datasource-layer-5d7b131e-a2dc-453a-897a-c384a62a3fc6", + "name": "1a0212e1-6df2-4187-8bb0-029f04f196d1:e967ce57-1163-4382-ba57-bd40b7bacad3", "type": "index-pattern" }, { "id": "logs-*", - "name": "77df9a6b-af9e-412f-a916-fc83bd7c3194:cd797741-fccc-48de-879a-37abf3c5f1eb", + "name": "5249b0f0-30ea-472f-99e7-ebd31a239802:indexpattern-datasource-layer-2e38c3a3-9cb3-42f0-8264-5c0de2b7d151", "type": "index-pattern" }, { - "id": "wiz-f661536e-81c2-455b-9a4f-9840d910c318", - "name": "022a726e-0fc7-4cee-8fe8-42bd959353e2:panel_022a726e-0fc7-4cee-8fe8-42bd959353e2", - "type": "search" + "id": "logs-*", + "name": "5249b0f0-30ea-472f-99e7-ebd31a239802:26fb3668-5b3d-4a0d-bf8b-a5a1697b0ac6", + "type": "index-pattern" }, { "id": "logs-*", diff --git a/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json b/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json index 1589f724f10..9d9dc245fa7 100644 --- a/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json +++ b/packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json @@ -1,5 +1,17 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, "description": "", "kibanaSavedObjectMeta": { "searchSourceJSON": { @@ -20,8 +32,12 @@ "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hidePanelTitles": true, "savedVis": { "data": { "aggs": [], @@ -34,16 +50,16 @@ } }, "description": "", - "id": "", "params": { "fontSize": 12, - "markdown": "Navigation\n\nWiz Cloud Configuration Finding\n\n[Wiz Vulnerability](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf)\n\n[Wiz Issue](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf)\n\n[Wiz Defend](#/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a)\n\n[Wiz Audit](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273)\n\n[Integration Page](/app/integrations/detail/wiz/overview)\n\nOverview\n\nThis dashboard shows the Cloud Configuration Findings overview related to the Wiz Integration.\n\nThis dashboard provides general statistics and shows the detection of ingested cloud configuration findings.\n\nIt provides information about findings and assets. It also displays the distribution of findings according to evaluation results and contains details regarding the count of findings over time.", + "markdown": "#### Navigation\n\n[Wiz Audit Dashboard](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273) \n**Wiz Cloud Configuration Finding Dashboard** \n[Wiz Defend Dashboard](#/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a) \n[Wiz Issue Dashboard](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf) \n[Wiz Vulnerability Dashboard](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf) \n\n[Integration Page](/app/integrations/detail/wiz/overview)\n\n#### Dashboard Overview\n\nThis dashboard shows the Cloud Configuration Findings overview related to the Wiz Integration.\n\nThis dashboard provides general statistics and shows the detection of ingested cloud configuration findings.\n\nIt provides information about findings and assets. It also displays the distribution of findings according to evaluation results and contains details regarding the count of findings over time.", "openLinksInNewTab": false }, "title": "", "type": "markdown", "uiState": {} - } + }, + "title": "Table of Contents" }, "gridData": { "h": 23, @@ -53,7 +69,6 @@ "y": 0 }, "panelIndex": "94a743d5-faba-431e-b382-1fc7315b7e3e", - "title": "Table of Contents", "type": "visualization" }, { @@ -245,7 +260,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Top 10 Cloud Configuration Findings [Logs Wiz]" }, "gridData": { "h": 12, @@ -255,7 +271,6 @@ "y": 0 }, "panelIndex": "044ff952-a6d8-4fc2-a49f-8013448a5b2d", - "title": "Top 10 Cloud Configuration Findings [Logs Wiz]", "type": "lens" }, { @@ -470,7 +485,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Top 10 resources with Cloud Configuration Findings [Logs Wiz]" }, "gridData": { "h": 11, @@ -480,7 +496,6 @@ "y": 12 }, "panelIndex": "42f119fc-4f83-48fa-964d-2ba1255bdd3b", - "title": "Top 10 resources with Cloud Configuration Findings [Logs Wiz]", "type": "lens" }, { @@ -684,7 +699,8 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Findings over Time [Logs Wiz]" }, "gridData": { "h": 15, @@ -694,7 +710,6 @@ "y": 23 }, "panelIndex": "083792d4-85c6-436b-ab41-60c74996826c", - "title": "Findings over Time [Logs Wiz]", "type": "lens" }, { @@ -833,7 +848,8 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "title": "Vulnerability by Status [Logs Wiz]" }, "gridData": { "h": 15, @@ -843,16 +859,15 @@ "y": 23 }, "panelIndex": "e684aa2c-8963-4cae-a04e-74b00b662a33", - "title": "Vulnerability by Status [Logs Wiz]", "type": "lens" } ], "timeRestore": false, "title": "[Logs Wiz] Cloud Configuration Finding", - "version": 1 + "version": 3 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-05-26T06:30:26.431Z", + "created_at": "2026-05-26T09:08:17.746Z", "id": "wiz-726802c0-4007-48b9-bae5-09daa69d4368", "references": [ { @@ -902,5 +917,6 @@ } ], "type": "dashboard", - "typeMigrationVersion": "10.3.0" + "typeMigrationVersion": "10.3.0", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0" } diff --git a/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json b/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json index b9617656323..ebd665b166b 100644 --- a/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json +++ b/packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json @@ -32,8 +32,12 @@ "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hidePanelTitles": true, "savedVis": { "data": { "aggs": [], @@ -46,10 +50,9 @@ } }, "description": "", - "id": "", "params": { "fontSize": 12, - "markdown": "Navigation\n\nWiz Vulnerability\n\n[Wiz Cloud Configuration Finding](#/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368)\n\n[Wiz Defend](#/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a)\n\n[Wiz Audit](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273)\n\n[Wiz Issue](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf)\n\n[Integration Page](/app/integrations/detail/wiz-0.2.0/overview)\n\nOverview\n\nThis dashboard shows Vulnerability overview related to the Wiz Integration.\n\nThis dashboard is made to provide general statistics and show the detection of ingested vulnerabilities.\n\nIt provides information about vulnerability and vulnerability assets. It also displays the distribution of vulnerabilities according to detection method and status. It also contains details regarding count of vulnerabilities over time.", + "markdown": "#### Navigation\n\n[Wiz Audit Dashboard](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273) \n[Wiz Cloud Configuration Finding Dashboard](#/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368) \n[Wiz Defend Dashboard](#/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a) \n[Wiz Issue Dashboard](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf) \n**Wiz Vulnerability Dashboard** \n\n[Integration Page](/app/integrations/detail/wiz/overview)\n\n#### Dashboard Overview\n\nThis dashboard shows Vulnerability overview related to the Wiz Integration.\n\nThis dashboard is made to provide general statistics and show the detection of ingested vulnerabilities.\n\nIt provides information about vulnerability and vulnerability assets. It also displays the distribution of vulnerabilities according to detection method and status. It also contains details regarding count of vulnerabilities over time.\n", "openLinksInNewTab": false }, "title": "", @@ -1150,7 +1153,7 @@ "version": 3 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-05-26T06:30:28.696Z", + "created_at": "2026-05-26T09:08:15.734Z", "id": "wiz-927c36f0-6358-11ee-a265-c3569aa0cebf", "references": [ { diff --git a/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json b/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json index df5982e9fdb..d558e5d3f9f 100644 --- a/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json +++ b/packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json @@ -30,44 +30,6 @@ "useMargins": true }, "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "Navigation\n\nWiz Audit\n\n[Wiz Cloud Configuration Finding](#/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368)\n\n[Wiz Vulnerability](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf)\n\n[Wiz Issue](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf)\n\n[Wiz Defend](#/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a)\n\nOverview\n\nThis dashboard shows an Audit overview related to the Wiz Integration.\n\nThis dashboard is made to provide general statistics and show the detection of ingested audit data.\n\nIt provides information about audit data by user. It also displays the actions performed on time and the status of those actions in the pie chart. It displays the top 10 source IPs with their count.", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - }, - "title": "Table of Contents" - }, - "gridData": { - "h": 23, - "i": "0f27302b-3efb-4712-a3cf-fa26a7fc6bd1", - "w": 15, - "x": 0, - "y": 0 - }, - "panelIndex": "0f27302b-3efb-4712-a3cf-fa26a7fc6bd1", - "type": "visualization" - }, { "embeddableConfig": { "attributes": { @@ -75,12 +37,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-6f8238aa-59ea-4672-a656-4b302e00407e", + "name": "indexpattern-datasource-layer-95235e2f-1057-46ba-90d6-474002b2555d", "type": "index-pattern" }, { "id": "logs-*", - "name": "cbfca3e7-f41f-4b16-b399-846ca16aae6d", + "name": "e5711963-4101-4e46-a9e9-63d9a3c62352", "type": "index-pattern" } ], @@ -89,17 +51,29 @@ "datasourceStates": { "formBased": { "layers": { - "6f8238aa-59ea-4672-a656-4b302e00407e": { + "95235e2f-1057-46ba-90d6-474002b2555d": { "columnOrder": [ - "314b70c3-3bd6-4b5d-8e50-4c8f343fbd81", - "668d4789-ec89-4e37-80f2-78aa42845886" + "d41001f7-0425-40fc-ab1c-95341b43e4d2", + "41c3bf84-939e-4f4c-9c4a-ef1d61cde9d7" ], "columns": { - "314b70c3-3bd6-4b5d-8e50-4c8f343fbd81": { + "41c3bf84-939e-4f4c-9c4a-ef1d61cde9d7": { "customLabel": true, - "dataType": "ip", + "dataType": "number", + "isBucketed": false, + "label": "Event ID", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "event.id" + }, + "d41001f7-0425-40fc-ab1c-95341b43e4d2": { + "customLabel": true, + "dataType": "string", "isBucketed": true, - "label": "Source IP", + "label": "Top 5 User ID", "operationType": "terms", "params": { "exclude": [], @@ -108,30 +82,18 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "668d4789-ec89-4e37-80f2-78aa42845886", + "columnId": "41c3bf84-939e-4f4c-9c4a-ef1d61cde9d7", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, + "otherBucket": true, "parentFormat": { "id": "terms" }, - "size": 10 + "size": 5 }, "scale": "ordinal", - "sourceField": "source.ip" - }, - "668d4789-ec89-4e37-80f2-78aa42845886": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "___records___" + "sourceField": "user.id" } }, "ignoreGlobalFilters": false, @@ -156,7 +118,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "cbfca3e7-f41f-4b16-b399-846ca16aae6d", + "index": "e5711963-4101-4e46-a9e9-63d9a3c62352", "key": "data_stream.dataset", "negate": false, "params": { @@ -177,36 +139,43 @@ "query": "" }, "visualization": { - "columns": [ - { - "columnId": "314b70c3-3bd6-4b5d-8e50-4c8f343fbd81", - "isTransposed": false - }, + "layers": [ { - "columnId": "668d4789-ec89-4e37-80f2-78aa42845886", - "isTransposed": false + "categoryDisplay": "default", + "layerId": "95235e2f-1057-46ba-90d6-474002b2555d", + "layerType": "data", + "legendDisplay": "show", + "legendSize": "large", + "metrics": [ + "41c3bf84-939e-4f4c-9c4a-ef1d61cde9d7" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "d41001f7-0425-40fc-ab1c-95341b43e4d2" + ], + "truncateLegend": false } ], - "layerId": "6f8238aa-59ea-4672-a656-4b302e00407e", - "layerType": "data" + "shape": "pie" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsPie" }, "enhancements": {}, "hidePanelTitles": false, - "title": "Top 10 Source IP [Logs Wiz]" + "title": "Audit by User [Logs Wiz]" }, "gridData": { "h": 11, - "i": "955f380d-4b48-416f-8fa3-41dd6c0df91c", - "w": 15, - "x": 15, + "i": "28d1a83b-3558-473c-948c-8157eee46509", + "w": 18, + "x": 30, "y": 0 }, - "panelIndex": "955f380d-4b48-416f-8fa3-41dd6c0df91c", + "panelIndex": "28d1a83b-3558-473c-948c-8157eee46509", "type": "lens" }, { @@ -216,12 +185,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-95235e2f-1057-46ba-90d6-474002b2555d", + "name": "indexpattern-datasource-layer-eda794c9-092a-4564-805e-f3d834f2084d", "type": "index-pattern" }, { "id": "logs-*", - "name": "e5711963-4101-4e46-a9e9-63d9a3c62352", + "name": "0bfdde77-b622-4820-b63e-accae3b4f4c5", "type": "index-pattern" } ], @@ -230,13 +199,13 @@ "datasourceStates": { "formBased": { "layers": { - "95235e2f-1057-46ba-90d6-474002b2555d": { + "eda794c9-092a-4564-805e-f3d834f2084d": { "columnOrder": [ - "d41001f7-0425-40fc-ab1c-95341b43e4d2", - "41c3bf84-939e-4f4c-9c4a-ef1d61cde9d7" + "dc749dcf-16fb-4055-9b3a-34260393f125", + "6a8fa0a7-9369-41c2-b228-6f31418aeff7" ], "columns": { - "41c3bf84-939e-4f4c-9c4a-ef1d61cde9d7": { + "6a8fa0a7-9369-41c2-b228-6f31418aeff7": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -248,11 +217,11 @@ "scale": "ratio", "sourceField": "event.id" }, - "d41001f7-0425-40fc-ab1c-95341b43e4d2": { + "dc749dcf-16fb-4055-9b3a-34260393f125": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Top 5 User ID", + "label": "Top 5 Event Action", "operationType": "terms", "params": { "exclude": [], @@ -261,7 +230,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "41c3bf84-939e-4f4c-9c4a-ef1d61cde9d7", + "columnId": "6a8fa0a7-9369-41c2-b228-6f31418aeff7", "type": "column" }, "orderDirection": "desc", @@ -272,7 +241,7 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "user.id" + "sourceField": "event.action" } }, "ignoreGlobalFilters": false, @@ -297,7 +266,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "e5711963-4101-4e46-a9e9-63d9a3c62352", + "index": "0bfdde77-b622-4820-b63e-accae3b4f4c5", "key": "data_stream.dataset", "negate": false, "params": { @@ -321,17 +290,17 @@ "layers": [ { "categoryDisplay": "default", - "layerId": "95235e2f-1057-46ba-90d6-474002b2555d", + "layerId": "eda794c9-092a-4564-805e-f3d834f2084d", "layerType": "data", "legendDisplay": "show", "legendSize": "large", "metrics": [ - "41c3bf84-939e-4f4c-9c4a-ef1d61cde9d7" + "6a8fa0a7-9369-41c2-b228-6f31418aeff7" ], "nestedLegend": false, "numberDisplay": "percent", "primaryGroups": [ - "d41001f7-0425-40fc-ab1c-95341b43e4d2" + "dc749dcf-16fb-4055-9b3a-34260393f125" ], "truncateLegend": false } @@ -345,16 +314,16 @@ }, "enhancements": {}, "hidePanelTitles": false, - "title": "Audit by User [Logs Wiz]" + "title": "Audit by Action [Logs Wiz]" }, "gridData": { - "h": 11, - "i": "28d1a83b-3558-473c-948c-8157eee46509", + "h": 12, + "i": "892360c9-2be8-4e1e-a93e-e70a9d2aa8fc", "w": 18, "x": 30, - "y": 0 + "y": 11 }, - "panelIndex": "28d1a83b-3558-473c-948c-8157eee46509", + "panelIndex": "892360c9-2be8-4e1e-a93e-e70a9d2aa8fc", "type": "lens" }, { @@ -364,12 +333,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-2ef70662-f7d5-4917-bff4-c212ecf7ad19", + "name": "indexpattern-datasource-layer-c4705a46-4a7c-484e-acae-35aa9de658f0", "type": "index-pattern" }, { "id": "logs-*", - "name": "249b6030-1923-46a8-afcd-02911d27bea8", + "name": "68046879-96c5-4615-950e-e40001e3bb9b", "type": "index-pattern" } ], @@ -378,17 +347,32 @@ "datasourceStates": { "formBased": { "layers": { - "2ef70662-f7d5-4917-bff4-c212ecf7ad19": { + "c4705a46-4a7c-484e-acae-35aa9de658f0": { "columnOrder": [ - "042dcb66-1d9e-49d9-bda3-f42b9ab2770a", - "d1fcb2cb-ae75-4473-ae21-1830e116feba" + "30ee1d33-c798-4a40-b94c-093b93598375", + "263cfa15-045b-44c1-9601-fa6d36ecf6b1", + "d1e9fc29-3890-413a-956c-ee38f8171fd0" ], "columns": { - "042dcb66-1d9e-49d9-bda3-f42b9ab2770a": { + "263cfa15-045b-44c1-9601-fa6d36ecf6b1": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "30ee1d33-c798-4a40-b94c-093b93598375": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Top 5 Wiz Audit Status", + "label": "Top 10 Event Action", "operationType": "terms", "params": { "exclude": [], @@ -397,7 +381,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "d1fcb2cb-ae75-4473-ae21-1830e116feba", + "columnId": "d1e9fc29-3890-413a-956c-ee38f8171fd0", "type": "column" }, "orderDirection": "desc", @@ -405,17 +389,16 @@ "parentFormat": { "id": "terms" }, - "secondaryFields": [], - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "wiz.audit.status" + "sourceField": "event.action" }, - "d1fcb2cb-ae75-4473-ae21-1830e116feba": { + "d1e9fc29-3890-413a-956c-ee38f8171fd0": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Event ID", + "label": "Count", "operationType": "count", "params": { "emptyAsNull": false @@ -446,7 +429,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "249b6030-1923-46a8-afcd-02911d27bea8", + "index": "68046879-96c5-4615-950e-e40001e3bb9b", "key": "data_stream.dataset", "negate": false, "params": { @@ -469,77 +452,88 @@ "visualization": { "layers": [ { - "categoryDisplay": "default", - "layerId": "2ef70662-f7d5-4917-bff4-c212ecf7ad19", - "layerType": "data", - "legendDisplay": "show", - "legendSize": "large", - "metrics": [ - "d1fcb2cb-ae75-4473-ae21-1830e116feba" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "042dcb66-1d9e-49d9-bda3-f42b9ab2770a" + "accessors": [ + "d1e9fc29-3890-413a-956c-ee38f8171fd0" ], - "truncateLegend": false + "layerId": "c4705a46-4a7c-484e-acae-35aa9de658f0", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "30ee1d33-c798-4a40-b94c-093b93598375", + "xAccessor": "263cfa15-045b-44c1-9601-fa6d36ecf6b1" } ], - "shape": "pie" + "legend": { + "isVisible": true, + "legendSize": "large", + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsXY" }, + "enhancements": {}, + "hidePanelTitles": false, + "title": "Action over Time [Logs Wiz]" + }, + "gridData": { + "h": 11, + "i": "5f4a4c50-2b75-49e8-997e-996ed535715e", + "w": 48, + "x": 0, + "y": 23 + }, + "panelIndex": "5f4a4c50-2b75-49e8-997e-996ed535715e", + "type": "lens" + }, + { + "embeddableConfig": { "enhancements": { "dynamicActions": { "events": [] } }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "field": "data_stream.dataset", - "index": "249b6030-1923-46a8-afcd-02911d27bea8", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "wiz.audit" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "wiz.audit" + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" } } - } - ], - "hidePanelTitles": false, - "query": { - "language": "kuery", - "query": "" + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "#### Navigation\n\n**Wiz Audit Dashboard** \n[Wiz Cloud Configuration Finding Dashboard](#/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368) \n[Wiz Defend Dashboard](#/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a) \n[Wiz Issue Dashboard](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf) \n[Wiz Vulnerability Dashboard](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf) \n\n[Integration Page](/app/integrations/detail/wiz/overview)\n\n#### Dashboard Overview\n\nThis dashboard shows an Audit overview related to the Wiz Integration.\n\nThis dashboard is made to provide general statistics and show the detection of ingested audit data.\n\nIt provides information about audit data by user. It also displays the actions performed on time and the status of those actions in the pie chart. It displays the top 10 source IPs with their count.", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} }, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false, - "title": "Audit by Status [Logs Wiz]" + "title": "Table of Contents" }, "gridData": { - "h": 12, - "i": "38992b4f-7a75-4641-afc9-4cede93fbe04", - "w": 15, - "x": 15, - "y": 11 + "h": 23, + "i": "0f27302b-3efb-4712-a3cf-fa26a7fc6bd1", + "w": 14, + "x": 0, + "y": 0 }, - "panelIndex": "38992b4f-7a75-4641-afc9-4cede93fbe04", - "type": "lens" + "panelIndex": "0f27302b-3efb-4712-a3cf-fa26a7fc6bd1", + "type": "visualization" }, { "embeddableConfig": { @@ -548,12 +542,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-eda794c9-092a-4564-805e-f3d834f2084d", + "name": "indexpattern-datasource-layer-6f8238aa-59ea-4672-a656-4b302e00407e", "type": "index-pattern" }, { "id": "logs-*", - "name": "0bfdde77-b622-4820-b63e-accae3b4f4c5", + "name": "cbfca3e7-f41f-4b16-b399-846ca16aae6d", "type": "index-pattern" } ], @@ -562,29 +556,17 @@ "datasourceStates": { "formBased": { "layers": { - "eda794c9-092a-4564-805e-f3d834f2084d": { + "6f8238aa-59ea-4672-a656-4b302e00407e": { "columnOrder": [ - "dc749dcf-16fb-4055-9b3a-34260393f125", - "6a8fa0a7-9369-41c2-b228-6f31418aeff7" + "314b70c3-3bd6-4b5d-8e50-4c8f343fbd81", + "668d4789-ec89-4e37-80f2-78aa42845886" ], "columns": { - "6a8fa0a7-9369-41c2-b228-6f31418aeff7": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Event ID", - "operationType": "count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "event.id" - }, - "dc749dcf-16fb-4055-9b3a-34260393f125": { + "314b70c3-3bd6-4b5d-8e50-4c8f343fbd81": { "customLabel": true, - "dataType": "string", + "dataType": "ip", "isBucketed": true, - "label": "Top 5 Event Action", + "label": "Source IP", "operationType": "terms", "params": { "exclude": [], @@ -593,18 +575,30 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "6a8fa0a7-9369-41c2-b228-6f31418aeff7", + "columnId": "668d4789-ec89-4e37-80f2-78aa42845886", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "event.action" + "sourceField": "source.ip" + }, + "668d4789-ec89-4e37-80f2-78aa42845886": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" } }, "ignoreGlobalFilters": false, @@ -629,7 +623,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "0bfdde77-b622-4820-b63e-accae3b4f4c5", + "index": "cbfca3e7-f41f-4b16-b399-846ca16aae6d", "key": "data_stream.dataset", "negate": false, "params": { @@ -650,43 +644,36 @@ "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "layerId": "eda794c9-092a-4564-805e-f3d834f2084d", - "layerType": "data", - "legendDisplay": "show", - "legendSize": "large", - "metrics": [ - "6a8fa0a7-9369-41c2-b228-6f31418aeff7" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "dc749dcf-16fb-4055-9b3a-34260393f125" - ], - "truncateLegend": false + "columnId": "314b70c3-3bd6-4b5d-8e50-4c8f343fbd81", + "isTransposed": false + }, + { + "columnId": "668d4789-ec89-4e37-80f2-78aa42845886", + "isTransposed": false } ], - "shape": "pie" + "layerId": "6f8238aa-59ea-4672-a656-4b302e00407e", + "layerType": "data" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsDatatable" }, "enhancements": {}, "hidePanelTitles": false, - "title": "Audit by Action [Logs Wiz]" + "title": "Top 10 Source IP [Logs Wiz]" }, "gridData": { - "h": 12, - "i": "892360c9-2be8-4e1e-a93e-e70a9d2aa8fc", - "w": 18, - "x": 30, - "y": 11 + "h": 11, + "i": "955f380d-4b48-416f-8fa3-41dd6c0df91c", + "w": 16, + "x": 14, + "y": 0 }, - "panelIndex": "892360c9-2be8-4e1e-a93e-e70a9d2aa8fc", + "panelIndex": "955f380d-4b48-416f-8fa3-41dd6c0df91c", "type": "lens" }, { @@ -696,12 +683,12 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-c4705a46-4a7c-484e-acae-35aa9de658f0", + "name": "indexpattern-datasource-layer-2ef70662-f7d5-4917-bff4-c212ecf7ad19", "type": "index-pattern" }, { "id": "logs-*", - "name": "68046879-96c5-4615-950e-e40001e3bb9b", + "name": "249b6030-1923-46a8-afcd-02911d27bea8", "type": "index-pattern" } ], @@ -710,32 +697,17 @@ "datasourceStates": { "formBased": { "layers": { - "c4705a46-4a7c-484e-acae-35aa9de658f0": { + "2ef70662-f7d5-4917-bff4-c212ecf7ad19": { "columnOrder": [ - "30ee1d33-c798-4a40-b94c-093b93598375", - "263cfa15-045b-44c1-9601-fa6d36ecf6b1", - "d1e9fc29-3890-413a-956c-ee38f8171fd0" + "042dcb66-1d9e-49d9-bda3-f42b9ab2770a", + "d1fcb2cb-ae75-4473-ae21-1830e116feba" ], "columns": { - "263cfa15-045b-44c1-9601-fa6d36ecf6b1": { - "customLabel": true, - "dataType": "date", - "isBucketed": true, - "label": "Timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "30ee1d33-c798-4a40-b94c-093b93598375": { + "042dcb66-1d9e-49d9-bda3-f42b9ab2770a": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Top 10 Event Action", + "label": "Top 5 Wiz Audit Status", "operationType": "terms", "params": { "exclude": [], @@ -744,7 +716,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "d1e9fc29-3890-413a-956c-ee38f8171fd0", + "columnId": "d1fcb2cb-ae75-4473-ae21-1830e116feba", "type": "column" }, "orderDirection": "desc", @@ -752,16 +724,17 @@ "parentFormat": { "id": "terms" }, - "size": 10 + "secondaryFields": [], + "size": 5 }, "scale": "ordinal", - "sourceField": "event.action" + "sourceField": "wiz.audit.status" }, - "d1e9fc29-3890-413a-956c-ee38f8171fd0": { + "d1fcb2cb-ae75-4473-ae21-1830e116feba": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count", + "label": "Event ID", "operationType": "count", "params": { "emptyAsNull": false @@ -792,7 +765,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "68046879-96c5-4615-950e-e40001e3bb9b", + "index": "249b6030-1923-46a8-afcd-02911d27bea8", "key": "data_stream.dataset", "negate": false, "params": { @@ -815,46 +788,76 @@ "visualization": { "layers": [ { - "accessors": [ - "d1e9fc29-3890-413a-956c-ee38f8171fd0" - ], - "layerId": "c4705a46-4a7c-484e-acae-35aa9de658f0", + "categoryDisplay": "default", + "layerId": "2ef70662-f7d5-4917-bff4-c212ecf7ad19", "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "30ee1d33-c798-4a40-b94c-093b93598375", - "xAccessor": "263cfa15-045b-44c1-9601-fa6d36ecf6b1" + "legendDisplay": "show", + "legendSize": "large", + "metrics": [ + "d1fcb2cb-ae75-4473-ae21-1830e116feba" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "042dcb66-1d9e-49d9-bda3-f42b9ab2770a" + ], + "truncateLegend": false } ], - "legend": { - "isVisible": true, - "legendSize": "large", - "position": "right", - "shouldTruncate": false, - "showSingleSeries": true - }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", - "valueLabels": "hide" + "shape": "pie" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsPie" }, - "enhancements": {}, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "249b6030-1923-46a8-afcd-02911d27bea8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "wiz.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "wiz.audit" + } + } + } + ], "hidePanelTitles": false, - "title": "Action over Time [Logs Wiz]" + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "title": "Audit by Status [Logs Wiz]" }, "gridData": { - "h": 11, - "i": "5f4a4c50-2b75-49e8-997e-996ed535715e", - "w": 48, - "x": 0, - "y": 23 + "h": 12, + "i": "38992b4f-7a75-4641-afc9-4cede93fbe04", + "w": 16, + "x": 14, + "y": 11 }, - "panelIndex": "5f4a4c50-2b75-49e8-997e-996ed535715e", + "panelIndex": "38992b4f-7a75-4641-afc9-4cede93fbe04", "type": "lens" } ], @@ -863,57 +866,57 @@ "version": 3 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-05-26T06:30:29.707Z", + "created_at": "2026-05-26T09:08:16.743Z", "id": "wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273", "references": [ { "id": "logs-*", - "name": "955f380d-4b48-416f-8fa3-41dd6c0df91c:indexpattern-datasource-layer-6f8238aa-59ea-4672-a656-4b302e00407e", + "name": "28d1a83b-3558-473c-948c-8157eee46509:indexpattern-datasource-layer-95235e2f-1057-46ba-90d6-474002b2555d", "type": "index-pattern" }, { "id": "logs-*", - "name": "955f380d-4b48-416f-8fa3-41dd6c0df91c:cbfca3e7-f41f-4b16-b399-846ca16aae6d", + "name": "28d1a83b-3558-473c-948c-8157eee46509:e5711963-4101-4e46-a9e9-63d9a3c62352", "type": "index-pattern" }, { "id": "logs-*", - "name": "28d1a83b-3558-473c-948c-8157eee46509:indexpattern-datasource-layer-95235e2f-1057-46ba-90d6-474002b2555d", + "name": "892360c9-2be8-4e1e-a93e-e70a9d2aa8fc:indexpattern-datasource-layer-eda794c9-092a-4564-805e-f3d834f2084d", "type": "index-pattern" }, { "id": "logs-*", - "name": "28d1a83b-3558-473c-948c-8157eee46509:e5711963-4101-4e46-a9e9-63d9a3c62352", + "name": "892360c9-2be8-4e1e-a93e-e70a9d2aa8fc:0bfdde77-b622-4820-b63e-accae3b4f4c5", "type": "index-pattern" }, { "id": "logs-*", - "name": "38992b4f-7a75-4641-afc9-4cede93fbe04:indexpattern-datasource-layer-2ef70662-f7d5-4917-bff4-c212ecf7ad19", + "name": "5f4a4c50-2b75-49e8-997e-996ed535715e:indexpattern-datasource-layer-c4705a46-4a7c-484e-acae-35aa9de658f0", "type": "index-pattern" }, { "id": "logs-*", - "name": "38992b4f-7a75-4641-afc9-4cede93fbe04:249b6030-1923-46a8-afcd-02911d27bea8", + "name": "5f4a4c50-2b75-49e8-997e-996ed535715e:68046879-96c5-4615-950e-e40001e3bb9b", "type": "index-pattern" }, { "id": "logs-*", - "name": "892360c9-2be8-4e1e-a93e-e70a9d2aa8fc:indexpattern-datasource-layer-eda794c9-092a-4564-805e-f3d834f2084d", + "name": "955f380d-4b48-416f-8fa3-41dd6c0df91c:indexpattern-datasource-layer-6f8238aa-59ea-4672-a656-4b302e00407e", "type": "index-pattern" }, { "id": "logs-*", - "name": "892360c9-2be8-4e1e-a93e-e70a9d2aa8fc:0bfdde77-b622-4820-b63e-accae3b4f4c5", + "name": "955f380d-4b48-416f-8fa3-41dd6c0df91c:cbfca3e7-f41f-4b16-b399-846ca16aae6d", "type": "index-pattern" }, { "id": "logs-*", - "name": "5f4a4c50-2b75-49e8-997e-996ed535715e:indexpattern-datasource-layer-c4705a46-4a7c-484e-acae-35aa9de658f0", + "name": "38992b4f-7a75-4641-afc9-4cede93fbe04:indexpattern-datasource-layer-2ef70662-f7d5-4917-bff4-c212ecf7ad19", "type": "index-pattern" }, { "id": "logs-*", - "name": "5f4a4c50-2b75-49e8-997e-996ed535715e:68046879-96c5-4615-950e-e40001e3bb9b", + "name": "38992b4f-7a75-4641-afc9-4cede93fbe04:249b6030-1923-46a8-afcd-02911d27bea8", "type": "index-pattern" } ], diff --git a/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json b/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json index 92d7643343c..f2e25801883 100644 --- a/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json +++ b/packages/wiz/kibana/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf.json @@ -32,8 +32,12 @@ "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hidePanelTitles": true, "savedVis": { "data": { "aggs": [], @@ -46,10 +50,9 @@ } }, "description": "", - "id": "", "params": { "fontSize": 12, - "markdown": "Navigation\n\nWiz Issue\n\n[Wiz Vulnerability](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf)\n\n[Wiz Cloud Configuration Finding](#/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368)\n\n[Wiz Defend](#/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a)\n\n[Wiz Audit](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273)\n\n[Integration Page](/app/integrations/detail/wiz-0.2.0/overview)\n\nOverview\n\nThis dashboard shows Issue overview related to the Wiz Integration.\n\nThis dashboard is made to provide general statistics and show the detection of ingested issues.\n\nIt provides information about issue data. It also displays the distribution of issues according to status, severity and entity type. It also contains details regarding count of issues over time.", + "markdown": "#### Navigation\n\n[Wiz Audit Dashboard](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273) \n[Wiz Cloud Configuration Finding Dashboard](#/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368) \n[Wiz Defend Dashboard](#/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a) \n**Wiz Issue Dashboard** \n[Wiz Vulnerability Dashboard](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf) \n\n[Integration Page](/app/integrations/detail/wiz/overview)\n\n#### Dashboard Overview\n\nThis dashboard shows Issue overview related to the Wiz Integration.\n\nThis dashboard is made to provide general statistics and show the detection of ingested issues.\n\nIt provides information about issue data. It also displays the distribution of issues according to status, severity and entity type. It also contains details regarding count of issues over time.", "openLinksInNewTab": false }, "title": "", @@ -916,7 +919,7 @@ "version": 3 }, "coreMigrationVersion": "8.8.0", - "created_at": "2026-05-26T06:30:26.689Z", + "created_at": "2026-05-26T09:08:15.617Z", "id": "wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf", "references": [ { From f4ab85950e7ff0ba4d58445e5e6a356a2fcd6d44 Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Tue, 26 May 2026 12:32:28 +0200 Subject: [PATCH 20/21] Version bump, changelog entry. --- packages/wiz/changelog.yml | 26 ++++++++++++++++++++++++++ packages/wiz/manifest.yml | 2 +- 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/packages/wiz/changelog.yml b/packages/wiz/changelog.yml index 93d880b71ed..3619cfce31a 100644 --- a/packages/wiz/changelog.yml +++ b/packages/wiz/changelog.yml @@ -1,4 +1,30 @@ # newer versions go on top +- version: "4.3.0" + changes: + - description: | + Server interaction fix: Set the right User-Agent header value. + type: bugfix + link: https://github.com/elastic/integrations/pull/19203 + - description: | + Server interaction fix: use `updatedAt` rather than `analyzedAt` in queries for cloud configuration finding data. + type: bugfix + link: https://github.com/elastic/integrations/pull/19203 + - description: | + Server interaction improvements: Set a static request rate of 0.5 rps per data stream, increase retries. + type: enhancement + link: https://github.com/elastic/integrations/pull/19203 + - description: | + Settings improvements: Clear the URL default value, tolerate URLs with a `/graphql` path, make `cloud_configuration_finding_full_posture`'s 24h interval an advanced option for potential use in debugging or workarounds, make Token URL a non-advanced settings since it can vary, inform the user the interval settings must be 5m or longer. + type: enhancement + link: https://github.com/elastic/integrations/pull/19203 + - description: | + Dashboard improvements: Use panel-level filters, fix the navigation/overview panel formatting. + type: enhancement + link: https://github.com/elastic/integrations/pull/19203 + - description: | + Documentation improvements: Explain transforms better in the README, chang to a vector logo file, add a screenshot of the config UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/19203 - version: "4.2.0" changes: - description: Add timestamp range filter and storage tier exclusion to latest transform source queries to reduce scan scope and improve performance. diff --git a/packages/wiz/manifest.yml b/packages/wiz/manifest.yml index e7eec7fd465..c7526a59223 100644 --- a/packages/wiz/manifest.yml +++ b/packages/wiz/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.3.2 name: wiz title: Wiz -version: "4.2.0" +version: "4.3.0" description: Collect logs from Wiz with Elastic Agent. type: integration categories: From 13fa74fa1e45a7ed5a6a49ded0ccda4c9787fa91 Mon Sep 17 00:00:00 2001 From: Chris Berkhout Date: Wed, 27 May 2026 11:04:21 +0200 Subject: [PATCH 21/21] Fix typo in manifest title. --- .../wiz/data_stream/cloud_configuration_finding/manifest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml b/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml index d7ff48311c6..a9da25ac092 100644 --- a/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml +++ b/packages/wiz/data_stream/cloud_configuration_finding/manifest.yml @@ -1,4 +1,4 @@ -title: Collet Cloud Configuration Finding logs from Wiz. +title: Collect Cloud Configuration Finding logs from Wiz. type: logs streams: - input: cel