From b628a3d0a994d9d8fdd4553f94c09114c41cb52d Mon Sep 17 00:00:00 2001 From: krzysztofstaszalek Date: Fri, 8 May 2026 15:28:07 +0200 Subject: [PATCH 1/5] EPP Changes to be committed for 2605 Client release: modified: docs/endpointprotector/admin/cap_module/capai.md modified: docs/endpointprotector/admin/cap_module/newoutlook.md modified: docs/endpointprotector/index.md modified: docs/endpointprotector/install/migrationprocedure/clientupgradediagram.webp modified: docs/endpointprotector/install/migrationprocedure/faq.md modified: docs/endpointprotector/install/migrationprocedure/migrationguide.md --- .../admin/cap_module/capai.md | 2 +- .../admin/cap_module/newoutlook.md | 17 +++++++++++++---- docs/endpointprotector/index.md | 2 +- .../clientupgradediagram.webp | Bin 26336 -> 25530 bytes .../install/migrationprocedure/faq.md | 4 ++-- .../migrationprocedure/migrationguide.md | 12 ++++++------ 6 files changed, 23 insertions(+), 14 deletions(-) diff --git a/docs/endpointprotector/admin/cap_module/capai.md b/docs/endpointprotector/admin/cap_module/capai.md index 4d56537566..8ef3b28d28 100644 --- a/docs/endpointprotector/admin/cap_module/capai.md +++ b/docs/endpointprotector/admin/cap_module/capai.md @@ -23,7 +23,7 @@ By implementing these controls, organizations can protect sensitive information ## AI Interaction Visibility and Control in Netwrix Endpoint Protector: Data Loss Prevention for LLMs -Endpoint Protector extends Data Loss Prevention to the most widely used AI technologies — including ChatGPT, Microsoft Copilot, Google Gemini, DeepSeek, X Grok, Claude, Meta AI, and Perplexity — ensuring secure and compliant use across your organization. Coverage includes the embedded Microsoft Copilot add-in in Windows 11, New Outlook, New Teams, and Edge. Endpoint Protector also provides visibility and control over ChatGPT and Copilot native clients. +Endpoint Protector extends Data Loss Prevention to the most widely used AI technologies — including ChatGPT, Microsoft Copilot, Google Gemini, DeepSeek, X Grok, Claude, Meta AI, and Perplexity — ensuring secure and compliant use across your organization. Coverage includes the embedded Microsoft Copilot add-in in Windows 11, New Outlook, New Teams, and Edge. Endpoint Protector also provides visibility and control over ChatGPT, Claude and Copilot native clients. ## Configure Netwrix EPP to Monitor AI Prompt Transactions diff --git a/docs/endpointprotector/admin/cap_module/newoutlook.md b/docs/endpointprotector/admin/cap_module/newoutlook.md index cf96149b7d..9d83826291 100644 --- a/docs/endpointprotector/admin/cap_module/newoutlook.md +++ b/docs/endpointprotector/admin/cap_module/newoutlook.md @@ -26,7 +26,8 @@ When you install an add-in in Outlook.com, it will also appear in other versions The EPP Client will also enforce the Content Aware Policies on those accounts when accessed through Outlook on the Web, with no additional configuration needed. The Outlook interface doesn't display the add-in. -To obtain the Outlook add-in manifest and validator files, visit the latest announcements on the Netwrix community portal or contact Netwrix Global Services & Support. +To obtain the Outlook add-in manifest and validator files, visit [Netwrix My Products portal](https://customer.netwrix.com/sign_in.html?rf=my_products.html).\ +Customer portal access is required to download the EPP content*. See also announcements on the Netwrix community portal or contact Netwrix Global Services & Support. ## Requirements @@ -35,10 +36,13 @@ To ensure full configuration and functionality of the EPP Microsoft New Outlook 1. Update EPP Clients\ Ensure that all Endpoint Protector (EPP) Clients are updated to at least version 5.9.4.3. This version is necessary to support the features and capabilities of the new add-in. -2. Deploy configured Microsoft Outlook Add-in (manifest.xml)\ +2. Download the latest New Outlook add-in from the [Netwrix My Products portal](https://customer.netwrix.com/sign_in.html?rf=my_products.html).\ +Customer portal access is required to download the EPP content*. + +3. Deploy configured Microsoft Outlook Add-in (manifest.xml)\ Configure and deploy the Microsoft Outlook add-in and assign it to the relevant user accounts. This can be managed centrally via the Microsoft 365 Admin Center or manually on individual user accounts. -3. Host Validation Part and Icons\ +4. Host Validation Part and Icons\ The Endpoint Protector add-in requires certain files to be hosted by the customer and accessible from the internet. This includes: - **mainpage.html** - Needs to be hosted; this is the entry point of the add-in. @@ -67,9 +71,14 @@ Ensure that a standard Endpoint Protector (EPP) Content Aware Protection (CAP) p Ensure that the setting under Content Aware Protection → Deep Packet Inspection called "Block Unsupported Protocols in New Outlook" is turned off. This setting is no longer needed if the EPP add-in is in use. :::note -On macOS, an EPP certificate is used to ensure secure communication between the add-in and the EppClient. Refer to the existing User Manual chapter for [detailed instructions](./deeppacket#dpi-certi%EF%AC%81cate-on-macos). If you have configured the DPI certificate on macOS, you can ignore this note. +On macOS, an EPP certificate is used to ensure secure communication between the add-in and the EppClient. Refer to the existing User Manual chapter for [detailed instructions](./deeppacket#dpi-certificate-on-macos). If you have configured the DPI certificate on macOS, you can ignore this note. +::: + +:::warning Important +Ensure these URLs are correctly hosted on your server and accessible via the internet to enable required functionalities for the add-in. ::: + ## Pre-configuring add-in (manifest.xml) At the core of any Office Add-in is the manifest file (.xml). This file acts as the blueprint for the add-in, containing: diff --git a/docs/endpointprotector/index.md b/docs/endpointprotector/index.md index 87254c1462..1aa076a2ae 100644 --- a/docs/endpointprotector/index.md +++ b/docs/endpointprotector/index.md @@ -37,7 +37,7 @@ safeguard critical business data. ### Support Status Overview - **Current EPP Server Version (2604)**: Full active support with new features, security updates, and comprehensive technical assistance -- **Current EPP Client & EE Version (2602)**: Full active support with new features, security updates, and comprehensive technical assistance +- **Current EPP Client & EE Version (2605)**: Full active support with new features, security updates, and comprehensive technical assistance - **Previous Versions (5.9.4.2 and earlier)**: All previous versions transition to discontinued support ### What This Means diff --git a/docs/endpointprotector/install/migrationprocedure/clientupgradediagram.webp b/docs/endpointprotector/install/migrationprocedure/clientupgradediagram.webp index fd9e8f85ff48740e6b512fde7b15d2d79147d526..c57d0112b3ec790f0efa6bbb069def6cb088fdca 100644 GIT binary patch literal 25530 zcmcGVV{oKxx9>YPCz;r`ZQIGjwrx)`aVEBH+nLz5ZQFh3dG}kj-@WU6I#s8u`~Gls z*SfD-`2Vi8?rLQzaq)U%06<+#Sn-DkA`2)@y>OMjTxD7>Ln1~n{&w`l_=hL(Jq-MSc=ovM*2(5fci<sAG} z>&;*8*X`9j#|v@&-q+>(oYOq2o1@Tm?4U#>CWb_`ZlZz?BvSG5s(WKOmwyM}izMeM`hlTU-riYM|}NEgQWl%?r&TY2)cT)ufs)^+{S!|KK;N zFF2Y_#^VYt1M@G)R2PJ~S8_0bqkj2$zH|N5#6?EFBu~%|>5nvObjLsE)D)=h(>ODC z;E6gQwo?t7q*Ho5Wr1si7VIP3+iNeP)kHyG4Z50v2oY|stPjQ|qHB(J!)TS3grh3( z$HO+|JTs0lKksoD_1<75%g#TFXyFXV-C%uKj=#BdiYS&Q{^Dmb952Ebl&`-8g4S3^(GNlCQ}dIbFt zssqV-8ny_H(lDw6)%`Mtq$aNb)yn!&R;5-Ox&hAIrV-QTz7#@zK+hZtMNC}O9dN-w(`YOpeR*({|Lvg!auBviB0oR5xz$FVO#*X z2C(LjS8o!A4~oCZo%w*tigVH-rDR8+yFnd~8Yo-Y%fLawvCD?MIt9uY+L z8uPDWSnYI*4tCzfb@Vfz`GC1?mEE}rLua1V4gK%4u$y&949J#tH7p^BDN+H6MJp4 z%N`4pJYov%#$S$1=0vCkuySBWZ0 ztzv|YoaY_{OUOBEAt~yVku}2~AW?3Tc^Mg7dTj=nHZU z6AmH?{q8x<3dx3HXp+ajy4g%6rnVBUx!KnFOT`~is+ty_CL8xp&-HuQ= zQ+ZB`1|htTA|R*77R-(iQhylKo)(7XcnIAC?%?umT3AON+dwHB?=QhGOo9Ti94XOy>80AwaXU6RuWU5cE#Mm0tkf zCn^3g-+{ET*kK%EiAo1Mf%WO1P_b>}DsXQ2}W-vwb+pP2BYtlEC&2kFW& zjKR@)P>)4_tRC=?t=LxbAj`X}T^E~{E?Rc!&8xbven5}w`{;h|a+?K0tA42#@ypD- z)~i#O3TiTzD~{7=Lj0@yvPYiow~y@pO}+-6P^Rk z!|81m-(7*fWpT_9A=D6bXqLn3o&af)$?h&8ky^7erh=|()ycYh$ggAR>9XxuOZsn+ zWT;=oInZa4OkKmL3lQO_z+~dp36p!lp%{RibcG6D7ae-qb56VC)o!rZCVLlqc57Rv z^yg$(ILX}W2&hjw>y`O+k5Ns!erCo1%~ys6!UhVvb&{;&)Jm-Zd#H;}5L=USUG1$c z*VQVz%TYzu*1m&)dmbopI^78+UjW8gd$WrAiIYanRIDj1DS)C&(^=zjoPi`(iw&7$ z(UZD<3vj*Sdd3~|Snv7GE8O)e(tNU`Uz5Jydj7~>&I=GWpz!t4)!q5(z5IF)jP(5L z0tJ3!fR-8LMpsg=dJAVQ^}FUfHYb+w$_W5)LZ$76l5K$#@PlJYo^&c38XqFEf7NSk z0A*5>!IY+yvSOwiz9J`3Zyq#|%e-$wfJ|?O1*z48IJ}=rL>**SRWM)nJJJ% zPU~3iJSK)x&6k6(2T0X{g0Zmtk}a0Y1vlfNnPF5I5H5Y1Qz!gU>ZGdqy;t@EZN&g0 zU`zX_IelR4FFOd7idIvNhL?1+h0>bKhU)kI_UTn;`e z7}wbtWlp0k+f`H+c4LUbW(4OYfD>s^u*iN@6xCU)uCcnu1wBoW)F zHpQ)gv|)0%CmpRJmJLfC!Xn2MnGW%G5HA5Rqm6%|ry^mcL3b=$n7lx(w|HKJmGVS4 zS$@^0mOj{ZLn-lT&Q>*O4JYRGz#UC5?Wyl8)Ayoahc~ej5zX{+A&?Z|;fPLp78gsw zbdMT6+*cTZG$e4ugjE1dux3s;6^c58^4B@9p-q0~`?qzOkb5nl`G>YGs4X&SW<~8Qq#P|JQNzHk+Nb`6LU_Tg+toYfWrLH!1D5rreL}a6(nIwf5r9q=PZl8 zqXaS3qHJs^m)t9`GJ8W?Yw#VJHn#%lt)S#$6(bT7FG#;X_ruyj_n>xN0UjXMpi|mB zib#y0gJ-7C;p=S99Hr&w_3O5~*;gO}>!}ngrmbT>^^%1qJlxX#p6r=e$ZK1jB8CvZ z@E-$Mi?kVv&5gaf?!CQJ?V50Qc-Il$5fjCJyCBH}N^LGgpd7f0(_vaATg~a=ZIPbj zzd}g(H6H@vDW*D&CdNUK*SPb*RABkqdC893vZGHAr#{@Z)S4H6xWO7<0E|F?W^6HH zaDvDtC*e+<0@UIPJ|F>Cvw_y2t$df9uG`=4M~MUL?NeYdj5vRE0-$Z1lq{bsb7zd{ z9i`V=|FP$vfV&AKmhEK)1WbbC?SRLggFP$lOXz?qu|Xi8e?PJugFejnPl6PInV^US zhh0w^V4a z-nS}%DOFKr)*EL}60pW}|2?A*bGjMxYYtFp1|1^e7WHA&gL`P#fvMc#H*;7@j|ZN< zrs{oVOpfJfhjUwl{G4w9)lEWaF7!K@cz75EsJ%`pxUe8Sy7N^Sji++YAMh)YD$SMA zgSj)2vZ1d1IEjT-ug5QB&6yiA{u@bu{^{)BHGX<`U1``hNl)_f+1&l_ufVsjYyYQm zOjaHZyFp403`M&nq2Kh`r7y76ylS&WLo(kwfhp$&hjGvEJsKGQ?+2?6+^+|nB<=L$ zw>GQnd+En}HF?YG^JAY6f&SkFeu=3IDHY24gcS_u*a5Agw@18E!j0 zO3@c5Y_cM>n`_8&98*K`2J19lo~0?YINw+pKax8kTWWcIvMky7Hl6Ms+MpA%Ts+zJ zN1F}qHbKC@hQa=8%k}F6Xr%X|@RcBd6_A_;;%@)9HPBoMOh|Hdcaj3;pJbv5G)mtU z#jcnt{bdIoE+@@<8Lc@Co(QEt)?y}@&Upe69R0GTiv@FB!x)|BG8V=WY(5mvPCYKA z{m{f~G}!S!Ey9sJaW>FzY9Y9iQ5&R=ZB>5j24?SMrC)|m6JMK%ObCop)&;@v^?+5NJ`erW`U{9FC0&U;s|EE-%(W|vh9*aCT@tnAL=*|TLC zvv=k9L8+oUbk^AB5N6)7koW0JKeUSU)Ie}({=j$qJ$p?nuj2B3c0bQiWgy+v$Q+Mn z3s1!;3y`4*m=nBHaw3scfQf1HxDrZ%g||?OIh*h%g;%JOK83SG381Mzdx?m`-o|r4pR>yryq_-lBZSDc>b@^%!EUUyghCw8Dr% zF#>Pc(spNS!U-<4O)j2HuI)9*KQ7Myeks+%>xX0ksXW`C3-%ZqxFDsq&_I0Mfp7NS zog>J{hG?`VKp!QeY`omCm>+3vLm)`=MEj&?Q|~*L&!2gl?>dNGhh`^tGjmxfZ}H)gIal zaT0eyf-EoejmD|2qz=i81;;V`aC683?xq1A5W7Gh=bavzs9C~G)gp;R@W-R?rrn(5 z25$;3$mft5nDxUo@)F^yoriB>4&+~YZ}FE74sx5%!S6>_>21AjeQi+%ppVF`&j{){ z!(&}-(X9h_YZ`e?`YR49iV44*M4%K&rl1n$+~fe8L4UU{SyKlVW=V3J*7@7M9`w|~ zr35Yod0teZ1kjMyhXqg8t1HMysN)jg+yW2bV3zAGq_eEB3B;yg$;LG5_WDsy=Bx&U{pKCt&ml%Z|V1+8WW@c(r zn|nMwmL(!HEBpe1zBAgju4;9i*M+f@;G}QA%V0*`NSHaH9F+$a9%UgiheL+F#Il-t z-3`g@hmTj~a&%x$;hq`ohabRVRD!DJwi-tTIK3fRTtlAkfsdctzz_S`|L=Uc%K?g9 zY3Hguy~9kyGV#ANcjY?hXI+_qCg;@Dz3275rmB{FeHiD3ys&b{HIDg!G|fS+vijI1 z>ol^|yhE@GR%v>IiXu3AIhCTk4Qo5$t(2k>+J2_8qI(u^Uzlt67vU^J^p5a;7u4`& z=7mu&wDyD~7klJ%m&Z7s{7z_PI3nH=jg0ZY8J?iQ)KQ@fh4sLIvJPr}a0d^vCLJ~yo zEEN>Va#V48A~;xJdiA}D@V!(>{3=Lvf)UkX5*ssxdL}x=00a;kF4g8s6(D&bI&v@! za)QSE3W6DiC`LW~VWNzs{1jS>C5Im9XER+0&1!rakR@xOSoVB?QA$RZqR`2GMAGGX zU&QJoLH2-+)>SX9OvA@A8Cx$PI%yD#jy%1gB+WJoF3K!G7k6%|mNo7O^1Z+idl*sh zai@HyX!Y~;lN)AN5qv72lP0j9kE!qiNr?rs5aNefwu^LjDWW^keFA80@)|*`u3WV{ zxdGXB;3(`47;-f_7yWB~6ut z_HnRi61S-hL&D3CXu+PhdT!KoudJu&uu5@1e@>DCwwZ7B-%qa*{nTsOQRdRS7wI`8KL#PFU z_dr45?K4FiQwXNv1Zf4{8}ZW7ERl`o0QD!}fTMrsuy+Kn)7M5b7Y1#s6qB2UAlN07 zo3kiKG_7~4Vky`KxS;0${?$M8ss=7{z~7lQ;hii1aKi(V1wuUo>Hx}5g%&29mq&!6 znG}Et8eG@nN8+=$&q0I)wI{sHo(^6C8*`kJ#1OjfuhH~}vBz52v_HGMIB#XQ^JZ4(kq0c(K^Pf0*+p#O&U zyZJlP`_>L{qNf}<{Q-Qn2f6}#J|(V!v+9ooPdzOJw_n0N#s2=l^LKY3@Br*91qd`i zdfNtm2JorBQGN8>hCYoC<(%rT0IPt0U$a1!MPPq7&+GMm%d`IH_7y)>UCi9}J$@(< z?k(xj|D0gmf85{hv*iQsgW@#@&Uf`I@|Eod;stnfeFj_xng}#}ZF`3TU0>C9T?@a; z-vYgs?+7k)wty4BrZ3?8^!f8!&Exhu!#NQ6CHdk0X8yQ6fpo5KKrjeQ0tSCAzej$_ z0FOVW%lrrYx9(ux2%Z^MVgd*bd**=Sz;GZRu;!x%2yBd5=~)5>0BL~MAIpC&^&kqc zeT{xCe?Yx4tlHNq9OO(1j00_e1VG~t0wC}+$64URx8-ZWANVZ%83vqv{gMr!Nvi=V z@bl&?&;t|yc=8tSgp7W@c#8Hwz`0+&#J<7iIBr;D+hMhzHgB})W zrJ0K$B(*^`H66AbFx$hIJ=4|hG7|uU|F0XG0rO>sY87C1Mu`dV$m%16vrymiIeuHx zq~qBkVCx8RJo(vm1VrktQGsHOvrx`!d)oyo!#MwI*9;Sy3Kn#N|JpsXvz|<1bJ#d` z7;~Z62-%mF?+5?p{AZDR@1k;-A5mmVJp0?NOUm|>c;3dA5^QtrIyENx#NQ2d%ovR@ zUk0C1@$2PL_)n*xzZYB0X2G3V!Y$;{^VC%>mkH~5C}`Ix`-KkH{Q9E^85x=6Tb+w3 z(?J4lNPiJU6x>nI7=n5>c9cP3`P8wMy43$4{%V+@tIbaM4<~PS!dQ*&|3?_c6wpow zVJil8QMrRx3GZD~Klqvd> zSriMC6RxE<1cFq|t=q#m&D|7J;5`nO^F{kkJBhnf57LYEi__ts&Hefuyk#~|?J~Dc$?(6=nul;odzM8XGv8!X zr^<2ZKqjqeIf?uN79Q{Y&*)^dBwP_5V~<&I{Qh(`qWg^`)ef64Q1>J1l!<^-uL#D0 ziTlT_0V$M;buu4|Y&wF9z@gs=3o#Z8-i_FPmqa@jgVw2+_3_3iE-Zt$D_zY0DyjqM zn2jgrcRIn@9XdGe>{v=c)Mk~Pb5@{%g)RzMpzs0jb9j9J;d(|S`*InRtHjp(J)}egiZ~YdEVasq< z(cAqoMyFW~^NS4!XImX%&-FU_J_9uag&P5{e4SfEi?2TPI5E0nTLVW$lv&HX(Y$>1 zPxAC!G=UrpuHh2GZqc_PO&HXqmo}rBbN2;fVTxV7vNjHX&PCRoU{J z&l%KUhhpT!Pn2py$)nq~%CpySNtmD53S!$6-tka@KpRY!VspGeUqf}ItI$${t%tFo zF&;}kpCT|k`(oYcLH&*NPUF$bsYyp{Z3t?_NZ-FJDZr@zj_Z~gjI}C(@qg&edp`Fa z)G9YMx3$Sh>1kC$enIi*e=1g`V0#h`Q6He%?7vhkDnL2;w^bC)Z{)Cu2k-&$oC5y0 zh8r3@rjBG1nWwHq9L>PU=;B$jWqN-`h5~*$j{=CgP={3OpYbfV)c!*YB6Emb3v^Y4 zg1q96D7Ts^|K#j{%IEWI5kTdaI_f`nR2ZX*?eY7?ewiT|OyCGt7B)(HraD%m5^USH zbpi+;F=EZ>$LFPaLL$!orzHIYe&6`!rT-&*Qz=8uY;O%297W&4nuJ>BO%S$$e5PEo z#e}WYDjh&?U0H*f2HIHb17EN#$Oe08pe9ZR5Jy9 zwKum=lg;z}5$DS!p$eK4r^O+ShN3UGXXKK+oDWnehG_rkWs2)ThiTtT9HLz#1hp=S z3`&n^B}mD5TYmkc7}kkOX82DF<9LUPi&&IWlk-qcnbkbvy&4G`ophhnyTx|)bmZSW zX7A-xeT+QDd)$BlS@}%InkgnaFVCTV+f2uvIJ*K5m{6A|5~YiY!XNwZnqDK>@&hwp z-q>#$3PJa%_(vv zUlZYH{-UPs7Eu~X2aAP5wk=2lKF7yW_Bh-3Y2xsRu?&)~!*XoK4lT|={JNOp!_wyU zZVr)f#i5bEnUK16@42#hPW3Np1}PI^RIGASS%`CZ7M)1{7oh%+rEB>diS?M)@54jjtNf=w+hqUK4SzxKKbNBal^Xxyzkj1V zd$Jes1yuk0*7}A>yWLoM6NRpSH^%bTue0Oz=|LfI_YI0!d4ugMkp#M{s<{)az ztQeF$`wP&ehK?vqo$6f~HGRsy39QA@DTSttJ@GvFFMg{|=4rnBLl8jU=M)&%x8jM`@0Ub) z%l>r3PyJvhO(3V|MVcRW)l@KfXEpqukbkG9Nel|A9lufysm!5qyg-rKB;?wVBxuOkj<;)-CxC&?$UMP_{7GlQgz5}Y>>HY^dVDQ1G^0@NxAsg$U zw{zHz;)WLOTc9^$(8$FR)9p^uZLj=!Po2C=qfGO+&?lZ+ZEqMFrhs3YWkc&ZkXy_} z5iGPQ*mh;AwBg9#7FzL&gckEOo2w`}+~u7p_1UVJ;x0b$dU;uIkY}@(3#*iln5%z$ z)|{?t-0|fxlCf`X6$-_FCqU2hWf8T|3@@G(payp!nxgY)mF=flYa9y5yDovLZ9f&` zaW8B?$#4SQcXd3R1iMhCz9i{fq z|BlmOB4{v8)86Ib{UMbreoJ%$(`78Jt zT5W3|w01dX-Ccn z;Nz4v|B?R^zT*{w?Rym!-s+algwm8FI{Wye8ezfDT|_s@y~;6g*kqABt{%;0rs+M= ztw~Ny)(Y|XKlm+{6D8?ybCZ$n@2SSeftP2J(%0a#i*syIx>)tTAzoz9y#$a~C0j8H z+|jZF3SFBcnLg#%hx(m_LT%`;jM{u%$69ntoymVzmb+!(!5F@)E^q4Uoi1uhZ#zeH zgD1fmt6TDW7N68_qDD);SCF~7nud31Mk4)i9?vgMa+dbbj*(7lDSjf@Tsw^ z?LOaf5SgB!F#GZ-S+${)QoeK4hCycvT?y8xwn1!AIS>Ox5KqnFC_j+tm-!H)Z~2)} z0JRAkq-V2`DJE~?Xz(ESxR&bF^xP$QATK?7)Ir!e_i89UxIpRiDLmV9Shh8!i*COH zoS~fyI2>gV^AdXOIgfJ`7C`+5M4kJiYoGk5Xo2SRbZ8Y`6NV4$d&(jj-*q%-G@NB-s&n6XoKs%Tz2F#V&JNLr`=gk1_B~(kmgC;7;+pP77S@YDvdly{P8FxlX@)p#QZ!~21Snm z6Cb-8TePeH08JoV1%1xg4#XIZ-WD(NjC@N#sqzg%>FFg~*z$5dHX0%SBc(eu4Fg@PH@|QiIv?cvw zYIei7aVobDfdvk@dy*#wPzXi4*aR^y#gvin;+aRd^u;+^RRWUBwtBj%*auay0VD~sJt>#_KRIu5u-Y!(Iy-p!$Dwgx4R{e+gkvVjVgYo8j;GTZeXG>z!zeQg?d_2K=m>QoZ9%;%i?Dx!hY@UJo>f zU%Zk@kZmyi9(USuAI~h5@fk`@K=iWB=g$XtL%5 zycJVj1K$N*9-%E!qCb%|JYqp<&<9jx_||nBHtxw08lrqz#u}n+1pI;KwO1UJp9!%$ z3P@F%sI}76~`q_t~utLxb&=qIpEpil<6ouzBF-9CkzoIz8-g&HqLz5uT zw;Ws(t$+J?nE_xe#_`RJ!v~^LrYk1c-P!XEH;9d*cJY*P2CW_>DaKH=ql>?uKu*TM zNc>0ZBj{I4n;%6<8O3D2vG%-?clerVI+dF31Y3F#C~sFsXD^_iT)`0Wfk^+6pe z=*@rFjSv!Z=(CMXA19ytK5RK#@M<`+uu5CsD{evb-Qi-#`zqU052WC*)Op7Xexkua z9HEM%A5sar*UuFk=F-R zNX_S>#*X1;Dha)(Q!<~NGTMTX6xylgNj^P*X(Wj891>`(!2o*F<6FE2?#~_nMe0@5 z?TZJ`NN~M?mhqYhiWG`j;s*}zlEzd9pWJXHBYQDaP0-gmOs?i6XL7n7f!6RSTyy`O zY4c%yy!?VwQeB~Bo=mvgs0$5v6n{F0pL-Tx+UcoQfhf9TmtafTvru@Dx~H^IwX4Fl zZcj#IkAG;Z#rh7!e?e2p{2XX1IP(SfOv97$4YRoS$8M^sYD;(dlBm7~Av-?DXW7Qt7z3glN55 zmBAl~#0S~XTHRxyh;oG4f+3n=VmiVPBDs%8L*&7rm818W6Vtpge#qf+&?^doimVaW z?hEXoZHmvHuzz=IQ3MMUWXVjR0Io~54XnhNf{aiY|Hu% zQ%_ecOIUl6T&q6l^Ur$#-&<5G4;~6f>pCY54(db5rII}%uxr6;sz{l`WusEM#K)}; zrpsepaZI?;kMn@4X~9?Ec~s8V6|QkyXyKcls=^)5pRt1>U{cpp9>}I7Zejxf;K}_5 zFOT)=7=Hx28x%bX=;$)9z{o99+GGa`4ZQ;rrnX=MLPoqPNmf+_cl%G!&Q{`qjKvB6KMGRgn>sGp1hf#D+&)mX2K+PoJwJPB6VWFG6N_U_H} znDwl{Dh$bkr=cX9+Z==~xezgaXLc?^yUHq;jz;wy6zPKEfFaJ<8nH@aEq-scu?bao zA_)EhMbvX#Wc}C+@AY+@+$OTU2my6`aNP~Xt&>$W7blD0n`nTjEY`PIzuqXLh$XGTf1Ym`dDBTb_z;_+Nlj3y6jw&KJWw%FAP^>+X#Q8rOEM48?(Wk z!a2DZ7Ds&sKp6LIr@=9BI$h=9ehw=5nxVfFIco`1V=f9@%9Uj>LZ;UcoG$WM^x4o^ zAPj^F+!l|cwf6N{6S}1>lETfUq^=T<(%d7+Idk*Q%`%}m$eDN%ZHxbMIV_~pk4_a4 ziM0`Uavp>XTB*Rr%Tq;Kz!b_-`trRcZ`OaR5i|`ua^QIq~H2WI5QhQwPaOk zyz>(fF)R~$|LQXzxq`@%{6^0PqhoF~xD!m&hYTH-Jv)#0#6SqR{YVQQCrftd{UrD) z(otAL_8WaPen6LtRtRECHlyYW^RnD)YKV3TK0X`-MGkFnno2@O?P7ScUr-P{H{ zXxjVS=_@24g$>-5!SbuMOw^ z<(y+RT<9arzvT>pXgibX;&Q_Ty~uMfhmj+Ia$@%t_K$UiM_lC<7gaPRrP6Q7Z8t70mFgR?=lZ}q%=^U+~xDR-NdPCsX??vprO z7=#VcJx*V?acImv6!+(-U7)mJSyg1)e88hQmi->U6w>RtqA(8!L{y(y(eS37g0eGcHkLWV=f{$4TI@#Z@h5%zjs3YAnX5I|a@-AM z1`o5pmqOeM$)%I3lSnCk)FZa8KS@y&c!Pcl4mVzxd^Leb-@e4soWdl_enP5y2(bsr zyiUO`yV~}sh3PM1=m|NH*~Xhuls#=R)7M`Um?1pyLt#prLYj0(Y}yBDZEwirSUg@c zS1V-|y<(yTmsD;~#oMl!>)!cx5cvFd8z%Lw3qH-m95oH=+0Lx*qNk$0W#!;q-Y7xV zfH(?*MuM_BcWI~t`KAoFMDXiW`rRm6BoXH%Ue`t%)0ysGK5TLb?R(Cpo4yRn3Vsx9 z$y=PUMltowuaDaSwC|!&Ny^SP=s1P=K{NEkk-MePbM10ypvh9N#Zv8{7epeqw{JWH z5U&H{e}KUe$=c|)ngfvEYtAo$Uo&qim$PJF>dG-G7bU>)!qIvS2$hfy3`S- z(4jwa&@$do`RI*$Vi=0rURg2o<#Uzsn?PL8gAn6!&Vq^ov1E~k5MUbBPU-XB`XThO zV~6MoN}S2Fn5xQ?bw~cR4$^@RDnS<7B74g)E|#YPO1C`X87#0!{Lf3|PaJ;srzSqbj)pUD~$HND={ zEHF6|NC?TQ2ljx<u9Nfbuo>zuKFf;Dm%hB&_435#qA~aVVv#6N`if;0< z<;O#>*Ebfoww$7;!?;|_UU%_!FYm}5aaEwwt^(Gd+on=izv5$Y|E!GeinX?|XFHEH zbYdEbcAgu$wp`SNVYr6);wk!V5|E?OIA}RLrH>?4O6rdMQT~O2gBlViSc&PzxhKnu zuwNs!$w3{`j?7E;mQL5E#0lXcv^RqCX03s2ldAi*p|wBt=_@d9n7w^%K`b3|$q6BD zAr$0}RgR6Ew)N3<vBf(lx1Uz8l z#E#UZkb7c@d8c`{VTIf74G#wV1N;gHxYE+8eeuc3>q)EVR#=)P%pnVL)qteTifzrv zEdS$DK9qNCpk^d##k%Cq3oRa?F-#}gS6b4YVma!nWzGAUfeRKXzn3hRWgPqv+mK<6 z_|6O-Y)ST|M|_$)#)gH#3s=9=w%Y9W`YTi!5^SK{HId^Qylj&3r6yAT!+bQ=j0I)h zIBC>}on*^!3 zMF(OVRF}o`5Lw`~%^?U7)N|INC`?|9;|^D}sGPt9Yg^0O9Lhu;?A=qN-}u01{AbQKMAl=Y5w9R)o?D3781TBEr~CSmp@YN)Nu z<*Qjtk=tZ>yI?KDDQcTJni`y*e`zk|+)h7r72XLuc6UjJhQnua(K^4X88khu;~KJ1 zz2VLyvm3qFwws3|oU;%Yo#qRew{KAdn@lXD6W@65bbY!j|Eb6PXGUg7gB!+U97>1* z%ix4;pB4|i(>sOS)ETW79>RRjj2;Rrzn_vc5B}QRpv_{-RBSdWz=BZ9`llCpu*_s? z!w#bO%%4L~_+4tN9zPu`I42`ZbIsCU?cPheV0rgsB3J(QlMiv+DuYIBk)wikCBHPwnJoe7;ylI1FNgzF*~<85Q#$fg+9C&=9By4=1!t$Z*Bz z0P1?{J>i_gKeEL$Iu-|YfFxaO5{r=+c}-;B7YMtTzw>8|U_4|pmQYvwgBQasAp~Wz z+)@p}a-u=hk8&Plj8MT{1(LuL{iW>(hHc{ZattO_ll`gsGognBER#DZ?4N}kZ`f4c*Z#;Ko}XHrw1fo}Cid=Ew%; zlg6UJT)VN%SRk*16I30L4wH%*>$_&#rPT$H+^440`)si_Y5tYaus!V1Qy<>oE8X+1oR25M82q` z;`J|$y!gGo(8geOPf{=jIwKN0jpPCe?zf=WpPlPVa4Z&d`VqRGS;DTnl?L1Z>}kow zZ2Afgn{LoiCI$mVC<0U0d&sJ9NlCmVeXs-SU12^yAwZ!OX`8r48s&YWiApbjjQhks zbgb6$lNe-;Z*Q&dnZV$8EVT6+R(sQfu!A^Hyisx138X)Y&UdcVL`$@}W`u3gjb-q# zGo&h4CL}VX9&}EPOZT z@n!hN5Isn56VWR0&8?(&EFs)vPra~dmMdEp?@DL?hbw?!2=eh=9Nm4hh~8S=y`pN9 ze$121$>qW-gp`j!3SW{+>qz=rdQKesb$I7dnr%ndOYKmwgDyG6_z+^P2nA|BNQyRz z#YScDU7j!((j+n$Fz9^)i9*mA5QQ+<_Mx2QjZgB{nCgw{nsd>zJKXYYs12jjh^rnI zl$s9n87w{<(c_k9STtTBlb|X)y${8MT@?ddow#hmFTrz`b33fXe)WFFb>?rR3zCs+ zf`fl?&1v)P;ZC5A2JXX%7J=$(cJo1Ul=0;o+NoJQ_IrEY%CZ5#yx@^7NF`rGgD2V- z3`*Lg$iPnP;peBMjqaJe9@?KqC`Rz^@6jG?7t=sZs*8n3)gT%uAMcqZ3Rr-BzHKxF z@Hq;km_YQ|wC7&mvA#ve4p)(b-r*eeDNVpiuK&!#ALzJZvShW1Yb^4G4z{iaz?p4Pob&$>8VF5$9{ z!nz{wpVJEuS4NNP0vLI#NZTR16?JgY-v>s%gX;Uers(-{i6lNenKTS~N- zPfXNoS00B{Ur`GvL##cd3^@jcMm9rOU{KWF(Dzowbf+gG=$cn5LG#PjR$1a%(ubt2 zhZL74Vg~Bh-|XzM!i;OwliDL>t$cf0?afVj7~_7;F^yD6Wu97K>kJU7XvaQVs*y8x zG;4NM$_|PUKw8^Bwk+M!^yPo3@6-({5<0N($HW+_qRIQNa`qLduw!i*+&`Pdl?sX4 zJkx=mjzNoIpo!|>ix89V1NshHgOK*o(6wM5ZRahDiO>5{!OXg#5Uh(7z9efnbUAOW zU8fXfXX{d2%|9sa(azciR~?6IROeOcjkN)nZBMXvbHFg(jqPDAE9L{A42KaG;06(Q zlCjfi7UeNmKFg7%e(ZtY3 zG*f%W4HAFkecAZzx%j51pcE-MsQygdoKV-==5IOL%DB71RIHiHmTC>eV!r-BmP#arpJ(%{^!!LJ+to>zkT8gx~M9} zX7ALvN(H9{R=q<67dxFsb;(vM!-mUxzuD4izM(ZuIsAm)n@I};??@^wLpJ1a z#;5?W4?#7k7xZZQreNo=&y0^s5_+p;qiEYSJKW`$iRZ&|es$(#nB#5bx9q~W_#u_j< z{`X)RbK$2>03fRdOH9xl0)>WW%`$)@8**ju*Ke<4nW6aYb+E%Nm>Fujd7H-5S+@I^ zr-wG6Bhj}}F5fmLz|oP_7n>u;HlI|_x|JZMWWCIzgbrZPyN<32`^jnH|B z_e`y!2snpN<7M&Iqase#)NvgplO^&`5W;)AI_DGkvLggHNR_gSTpi)8bs(@lK3U!|GBDMcjO1AMYDGN%YSa#H-;28m{no-{5CKJt(fgsOp!W z@@b>Yo78}FJ1XKaLnl>iV}5VLSF1N?JNk9hE#3h8wAPaU!iT6e2aPDADR5>f!x}pA zN7zD9X2*$MCt-sr*qqetw`SwLin!>Qk;#)87G*B^rBASatU1kM)&ybgfjwlkJPF0+ zeovX>zN*suOxD%1I=z4eUszT;ZpX*^YR z^dgdfz@u<3#b+o=@4n}^k(CRwVpf(=Kq0c&^39Hxd+k8e%lZ9wXU09JD2m0T+$M?b z0l%5nXqcS?jmMqmM8D=$t z?@G(Vuz~9DnCwIAjdth40-CLsq|mW*MMNQm8>&s*qDQ6ufWNUsO!oM)#-$FoC~fC3BCC+~Q?{$VV+|Y)Ma7H%(djQW zcnm&7iW$%MjrY>b>nt&Set7xdA^}J}eErQud#e-2Cu3>ysnnNPFSn4NI2H`l7@%D| zR2YbP;?ns>131u_YnyEM(?9P*`Jc*oA&gV0?N!Yq&LsJ@iJMXHk~6~bR_e<0e~&_4 zUacA}R`YW?0sPV^?xh(kB^_EMnLFpsk7EwqMJG!oU>>LNCH^$@e!*h~u0mPp z{2su#wZ7$V{Dw`h5I9eI1EN1ox37G?qK32=2pq7Th8Rk2b2l>5UtJF-VShQ zud)j=Y09SRSmzxBW9I;3f$Ie+XDN>mk{clDj@yp$=X!_F5{d6n6-2B{g_(c~3O^Po z$f{)>wwNTUNycT2<>&S0VwY=Lkmf{`O!OMX4yi27ori8iC*E?nH0f*6E;wG%UyP=o zYn_jOJaDmPdpwc)X6-i8v8KU{38ul_!K#b`CV_C|tt>OL8u@9Z?N`Frb~`O0?=B~} zK#g3Hn1Ins{NtY;kklLm)`}IS>0B$bgxa|o>m9J4sJF1!fQ^LAC%E@3QyOn9L@x{T zO`&{unHG+XB2{ojmb6p_BvgwJ11<0klLOT4QGKWOrA0`_V)%pwQWUb^Yu&O~y!fG& z$i${IugUuz&);W%tva7XbsguHF8xmq!OIKm=rxRVY8>3keo-k3%A`4yz&f9KWCrj- z(1ixsVCVkeEG}|&vixIv(`C~%MZWrN>i?W~s=3~fLD;F}<-goQ|Kgd8b61QPID^}p z41@=n60XGDSrh4Vu{5g>bo|&v~CbXnkgt$tRKGKhB1|q>$J&;eGTTr!Zkz zB$w`u6Azk(>R}8pi74LBzb?@T45e!ta4V>q4a)+SmW<(qjO(6w?R;=}S-1=MuDc|S zw(z+-lms9V5M-MoZ)L)3?_I+4N%P|gz6Y66uxG?CX{Y@}Xyf+Cw;Ouf&+>g-v%HoQ z#&e-;m;&$Wn;d@>@`rG0oF%n_Lw%xF5aX&~cR9BBb-94aH1Aa>c=e+=Z)t&CC7bo= z19Llf%mx$NvwhN^mrkPQ3nm8Ld0YpBSclwVC10X0D46VeC&~E%uAtVYuzM88X1}lJ z7VFo$U(fL1TTQ%f3(klVwQOE8B`Li~o>Sl3mzuUMPOCbVjd6cCB$} zb{J9d@?ugiWosRANu(ub3-|9O-T@MM67k`W3mViX29uM!3Q6zlLUw z*DummzH$Fj60P4EF4P1f$xbCqRoslYRv)&A3U@YX3M>KL^d^z zxA>emB`w0TTdNAa|tA_M)L|8ii z`Q3?^S$(mgBkgf3(u$9Ch?YXV&~^Rdp}fZ>?vW5X{8&h=9WZIOJ&YLZPHy0bY@f*U zcM#_6(b%jyY4f(#N*cSMru)21Ywk4q4r}1c@e*vEZCxBVkOO~TJN!)j&s;ymDx{XZM`#h0dJG~g$-0?@dUWT& z2`&l)kdw=K)ZfTw!8a{+tW}1sm2*M`i*yLK8cDR^`m`KG=7G5Euwt$fw9R-Qou=ch zfgTF>@aF%U>1ciR5thvTUGPQjD6UZSqpuiYR&p-*kqIzdg0;uEJ#@un!y`%(MaSH| z!R`-mdwQaW9u7bF#R%Ze`g#ZY`rG0Kia2(`TX!>J1)BV{6F`$p908hOJ52AR@217W zwNdU+W1BdD^*VtS(GNr)YbHMYG_ z-^kNz6>;Qa{poIg#XzCEm==_$;Y~9&1`?66FuC~#<~?u6vE-f{*7^hGmx1?6`|!br z{jx+%C60B3A925Zu!j%AF@Udy^ITIjw~^bca^b-%juIJPJ^&0YT(`DUh^wCSVO@m9 zQZY#GOmFi6yk2K0_IPa(GuQ1%d zfohL?qc_2kZT7Vq|X70(W6FLKds`iw6xYR?uhDy=Zlh2}Ml z+D%w>mAk(^Z=@eT0s#Jue4jOZHH!)aQ~XMO7BJaLD7OO7<_qKii9MqwzHxvcun>}sr1gvEfe6X#pKB9T z;0T`xnPaY*wmNA+`X;VQtfKQpIYg5Y|_sPN8b_i0}8&Jefgo*4f7`zULAA*sR2GxwZaR+ffZG>fMp-50;YgB^nJQ) zb=&RHyBfHq$cLRz>{2kO;z-&60000002WTf2kJ1U z^qh!6k;J&>?};$P5Tur1tD(l@O(@N2A;|=WddbOk>~slz7$3%HHDqaM*w9+SY};y0 zQm^y_q~SMrbC}voK&X8BcmRzh(LxS|ADwDgz^YT1!z0+_40gpg22hNUbqNLH7U=UT z`NHo>1zeM|WGUJ{=&zV^q~1TyXfS{t@!)nx2SYOH%-#AC?*_wECVdFKYi9aM&F`qP z88DpPBc#ow==QZ2gFgNM`0<9_CUfDu75;xT*jY7P3x9VEea>8;>ZSa=`hgU*gOuNQ zB<77|!(TkHIAdB(^vk_)P@SyC!<4-)Uym?bjVWK!dzK4IZyLK=u7-5x$wH{`JnK+6 zS3Ja{U{T+(sOd*;wT#2mHk%#WlhS%@Y8p`}BA^NHX3bUk89@;nPJr<4(9)2KD=o0o z)ii2CSKEo5K&?2bSKdRrK^gmA;$ys7Q=_eO)_|E4 z%zM%KPG5=zLVX?Qrx!k(rezO@vfI)}f&Ak0S*Lt}988v-P7_*p*5G!It}=EwuR~Ej z^E{T5VD;6Yeji_%Sa!8823}(e4kphUQtmc0aNU_n(|rm8p(`yMOu?))@JCgZH&r^I?mC{|7ML=#4OQWN( z{xTRWxH@95)(Sy4W&gl(hTP96&- znhjunY<>{I<{DIp@A&Zob1uAr6K$gVTsYv|ouD8LIXu4k$JYi`4V3}=TO7fD-;0av z7Rl#ligdhVjP(a6(6|d0KZO5c)bkFciW-w<`v(swip|7s94w)j^R!kXwBF`_-K>jX z2D!cx^&+0Oi5@wy00T0K+#gmb?*$~GimwyV3^!1m4>g&%Z}#Jt5)Y|}2AAr?PW00i zZ>OG_wFXxe*>%U>V_fMasE!eSWBk6gok;v;9lvhP)d(e6Z~CdiZNa$ruhh6#0w6wI zifmMpJ{|BGlPyU*GRp4u8*ZvY`kD2N!jzMmz!%i0QjtyJiu=hh@;8@ctqMd!>Q0GM zoxkO$n~=Atc$a$o5$lzmJ3DE-fwl{15T4_`=)GaV|46x~Q%9R<@@WPxK?W?+XfV6mA{lkdgk;`b)mb4Z*gQ1#5x<-Uj9MGmN{c zlZj*7Azk`+AiG$b`zct2s7@|(&piCA{WaEsRd#Q^6Pe220}d0?FOuedS8Q0PG(V6|A`Zq|B{+h07t88t?hJ<3M3IcYq?^k>Wv@Fm;#OPTo4jV*x-Dh zc24i0jT!BKrJPVPGq459cSR;pS3l=0SjcAvj#wj3z+=_6K`p9C7^VUfaZIp^u+3^` zfduUZA^)&4^}Yu|dlXF=LCjsJ9ntA24nqVq?r?6qOb9xuw6r#8S7fv5(i}95s1{vn z?xax}GDzYi<%-y}l};iXT3sM3OCbn!A;xk@Ky6}Ud!>NROne>J@NRTM<6W@&x3!1g z5_oY$y1g_=`R-eOV{5m?uuY79NM0(vAQ0ju1_rwS<>gEK^QEZB*lsJ+0-RgoOy@Vu zguh+%`_Kn*wRmX=o-MXTOpy>3C@HA=$}@0VA5fNopVnPAtkBt?sbZrGZuM9-wSa(( za}ihZxifA4yWq-y`PY_$#fYwd1!DAYfq57~c=+duEcxq&54&X_9%OdBhEW|R15rZM z(fp>S1=V^LH@aEK3Vh6(pXG5+aYQ!vu$p!WL=F0n2SLPQ$x(n+4eVV}N975{c2ULd zZEGYUKZ(sb6djmm`Vf0sgPEGRgn?JbNAlFaCTOz%KQa{v2!u}{;0W2kOOPm0P6NaX zB&NZ%ym%7;DeBwYedOgdmGk1J9=~GDv$!jB27TX;8O^5T=<_qcQHwv(!LLmJW`3tZ z9FlS}zL&YnmOv)LYmTB0b)5mg1AbQ`F79k#`it4-r#;P>ex|sL#H=;=%@68QfeWMg z+AvYu7C(jS61xX7u~{N9(`wFl<4?M z=Eld4X6mtCD!@3snYJZOYV6W{`aZ*YJENa4VZ@x6!EIcjon1LHTAKb)?=*0%p4VS< z$y00^3@u~w^wai$gz#Z-N%t7nT@e{Z8xfX7*4bTZJ!L&CdQ-p1SM1no_H4{QxGp8D z%Oh}kc;GD{eIVkQM&FQJk7&z}0uu6{H)G7yqrF)7<;I#nlhJrY?SKZEr#^p^1r~)`+>=lMQU8umlV$$3ASFsC5Unr5BUp7C=2B)iZmE{xCx_R> zc@GsSI%}&GZfJC1E5504j%%fC?1`mR@5-ueM1qaYCLa845a(~wQ2)b1o|K!w#)wil zciyU@IGQnd37tI{G+vlR)-BnNi^#EVT`9rX!yY2z_AoiqOWVq@yE^kn- z77>}M1K^)e9>7j>?%-vrRD85nW*R+^?RcB%kN?W8MjMz|(!NYg1|KEf|G#1gJpDBj zpi(K)uGdu8(U$lFg?OZYo;U*UuS<=00Fv)UNNPW0UX~NSwc$?jFL^7lD&}oZHxoxS z)=b)Gf1Qu}H8IZeVk~00tTXRa`(`VBSWQ10d0se~tNmvtN(F5-o4UDrRe|s>L0&m6 zY`OB~Vo@qyRMy7JdtaAC_%y)RzLzev4r>IEsur31XYTPRCP>{TXpt#2<-)RQQZ7vb z+p^ts5KE@*H3+YAdhe`K%#er53mK*OlqjS5QhCjA6e_@c+1}XkkOm+oU@wfpP@Opm zQQ!BpVu!$YXhS^94PJCR98>9Y80JkrfUj7Gl1cXd6y+(JHnV0JGu9fW8<;7ay8qYI zw7Wy{hJ9RY7rs@X#j8lI7f`Hnq?kF;qN^$l3#Bt{-EC1q%kOLU1y@Vc4(3|=I{%(M zJd6U;Awp)g!3HSf00i93BO(brEC6WhhvjVH`ihFA*S>N8b5+d8f?al#)-=4oHCM@7 zWeIunMGVe{f4tHK{+duEO1mcOI}(~zHDeXr%Z>p{^&`=Voaz7~0JJZ{`$ z_ibtuJuco)=3jY^pAQ#^kj+W+hzS+Q=~bX6P#p3{%D6++?FSTQ zV!I+-uup9E>YKlG&ivR69SjXq##!$}9fiXtnkAl~ugreVxpHWe5u7Y)7x;l~O}==Y zv>K6Da_FzU{OYvCfT+RZwy=D6G^lJvhn6;tnnK=4eY|fb>Uzw+uY
    3k=d%p=ZN zvf<-w^7tE^1~4j$K$oB5!5zm#PRe((KFST% zyx#W*_;1D z)~lqv-ZWK__`HZH!%f(AMvjJ#5l1=2^_0j!Hn$r`m|06gU$3gg@_f=ths))tQ1 z9f2R6f>Po&!N7mU4F-VZHy@VlyINa04(L5FG%X$fVwSt2r1*ysL=(-6a*IT{M^Esz z6Gtkl1;_yIt+xvRP$SKBgd=)2ryRYtogq(kT=u)Cvxt0m{-E)f+F(&IEy zUY}7@4*T<90Aj|Kh}l@Kg_Gz&dpP`qO55O6fU-}yXmpW%jSF@M^rf(o!{6p%mKq&3 zv_oT<#9tAsgqw{H{$APa8Wd@j%A+?uGM<4emn-NMK~5~o{=zJwyAv}0V*2l)ZP)Q7 z7FI9DkMJ9@P<(H45M1VnbC4rK1{03wS{HTe0EwqP$ZsFkCOkghs3OOVB+PR=C2BIQ zoIN+)Wahjv!_QAstnnE_!Wyw7Tr$>76hyS6=@#claZ!Slj*gC&ROL@A*3zpsG9uN8 zOcS1^sGp}EbejpINBJjyK}8s{ClJKoRsZ1t0NMqApnB7xMMOhZjc0W=*D8B1*x;uj zD#MC#1iTEiTB!lxy%Z1i;xGUJ1@1Z z-3;4FQs(vW?KiK7X|i$tFT=qqY6mGOIO%l&AaU)Is;&utc*@pZW1W~DKz0gm*4_H& zBSHSw{6x^uGz9LPl2g@1<*r!BsUF{z1TWkm%-PI|dISxy`{+FfzTSu!7Jp?s%PA;o zde#6F@=E6rL0@&Vu2GyBS~#)L#B4Td;k+) zs^&Cqb=Xg?s?uH;ht@C>&kNLe(TG}J)~E#b>l-DU6*>o2{KvBkYv|iQrYt}p4hFE? z4X;ZF^YBq~?5^D>q48MrJ_v_+g8{XnVSd`dw?mq|{+u=ZpdvT%9|eu0sE3?32v$=S zESYfN(dXGOSV4YWV&==MbFwjr_gv~6^87N|O4$tI=~i-ikt`!4+pHOvmq>x_<-hcVi64vSSZZGxlci(>EhX| zj&B0KZA_yORHqAx;XDA7T$*%ExgMR7^61?zpV-DO$hs+_ZpoEWsfj~ep>v08>4l;6 zz>{eSNN7jD+BSk!!O{1eEG!#$4n=y(sc5-Q`&pp?)_?Uy6lF9alO|!4P|pLe!>|#o z@0{g+e=F}3S@V4)uR&yEM}1z&f4QdAL(`}ouO3pMY1QK!a0+l{6ea9R(AO&vQ5mjh zlEbyD)CH)$_yjVpyr+gnb8e^}ZpA&M|A~CRtDWK*OUHk|Rc2cS0Edx*`5fEnx%=8l zoMOPm@G9dCZs^!IM^R3RfRlF{O~5FvpLJdHgQKELd*`6NP+W)#6C=JKt@H>;@iaSD z00SJagVoAN0W}wr=a<*;zIWMASP3ocg;L04%$7cvPoDvs+~)u2_dclvGL_-9*Fs*k zcUjTFq9+~@3?qqXo{!QUG zj=1npogu>mq~lF$Rxqk}3|(RyI0w3q!$QZ`1EfpAtSgfINSO>ZyMs<&-v=DBzL6)kA2&n`riY9$Iu=YL~Lqu z3IM8R8%iHY`=zTcT^Vl3Z`jA4|MNZ_d^%PC)kyuqEEnEeehYPALMnA3-k+KiFD*|E)qsqKpdyj8FkCED-X{w_A%0D)P&czNtKY3XWp~k>}JpIDJ7( zL7SCg|LDnPi@?q%*H}AdvFLIn`=OqqPl~7gp{{!_AG!w5}OZ zVLSH)B!a83UY*biuBs5}8~cG?%WwS0mDZ%l{lx=TJY2ok^P|!3K|#6b-bzjG*u5eN zsWWO}wFHoV3MD<^Gf~jS-PQd~@hYd5rrVX%eLYqWr@M3z!{6*r8nU!1Ni(Pi}+hD|7+5iKP z5(lo?09%jT8(0zRggwYEz2^XNPQG(j0NT&F!R$RjoB(QNDunMrrchzumJo|HHUnyo z;&j+9$ov^{tFV$?@*Q6chzx%y*fRuIBe4VJ4-{S(URsO2a0VOOg79%5;Wfo)ZJf|A zjM@&*ZJ^Xq6JDb#5(&`_;E$n^lk2Kx;_FM~8c(8Rz#KNh>G0um4ci%Jyv6vieX^6! zxhSg>E=>xyUe*9dVeg7L>JddEXH!Uq;&}Ubf}iV_{O(3}+Tc0AUyU^d^b<)MD9Jtq zY?;D7TdaZVkqK5`uGHzLXy;3ur*B8MttQupeA zN()wenNkcoCx;V>Gs`LSWe`%*KkA$|Cj2Ma{1iVNG z_qo>dogOR#qlf2~^{CX77xSEayeGwrb*jk&oYHWb9-%q#O0jRL{NO`r-g)>j(tcXh z9CVP>i8{c=N}vA?x)ZFevWjL)sK?6$Cw`d>{L-GT;fE-EAEVq}?FsU@;bTv(-MCY^`wzuV ze0Wy+^-1*`-wmGQZ1gyj00001=5z@246P4WE1tlqBZJo2y$4cDfwzw;U`2$74k z#VzsYcLf1Z*r}K5fHQh~m9w)=Oj~x>qmN6UOj!T`001{c01Bb~g#3nnLf%6l08Iqy AO8@`> literal 26336 zcmagF1CV4**RI{RZQHhO+qP}aw9RQx+qP}Hd)l_m`saB+z2Euc#Hke(6}78&#*WN& z-&d~OxmBbkB-Si|fHcKLlr)sMv|xaMfRO&aXF-7UL4btil%x_dfPjGU!0k7rpacJW z+yIIF_|syKW!13g3gO5!V0zhJTQTezOLz3G-{Z@3qeDF1{L~WL1bFg7{^svy;#c;$ zc`_CYFaZh;>fsIRi3l2Mi6xVcqs%SDTz{WYetNdrXi3)DXvqPb0h@q`{Sam{p_n#+ zah>YdGuZ1%S6o9T7EU^>vxnd?X&_pmgOMCexerFL{0aE+Kj9m}z@DLmfb%+#rc;^y zs-mh+F(hJ&efTTZ1=S|v==(_aRqUq*y)LL08;6 zU1!RIBFolWZYDF@x8?cuWn^U6ECJ!pExWs?rBtB*hPcVjH6=sD!dpAK zqJIn-3ggd&BcQLWECfGTc?);kr|dcQLwIl?=}anfvvqC{Zw~TdG z?O_}$XcqF(naQNQh7d#cav0?3I#4+&H4fR)f-Kr~$pQG5m(FeG%NQQ+CCS!r3l1K* zJnKt@n3^>Fl+Y|J3DWBZAenm5Fx$S!;Fzs@#kex67E~mhwqad&L?U)TH*brUSVw;I zDs;xkPVl)+{jC!nod<5V`xfvif8wy>Sg_dh8uZV`pYzv(rpA*4Vdpk)-woEsFqF73 zd*+S&b(wsx(wL|Dw4peNlDE6~FGzLUbAG40Awb!vVM7mvktf^aYWws_A95CuLvaU& zoUXMZCkhDl`3jitkIT$s4ef>ny5D#gf?ROMZ(kFYmv(lI{rx zeo|(Fp1SVTZ;}PP&|NGZGWW|qj>xg=E6B%Dd2QM;5ZB~iMUl!3tS*V#=d zx0~fTfq{4z5EIzkQ!-FpP1=3c!goz(mEdL{vMEBLS*hz#n`c2|SiI6?op1}EUg-)w zRD*qL8#wc(eBVdKqm~^B$lWsQ;)N1SN^GGl%$Wf)`(7wMb%B5#WjQAx8iGB?en`D) z-SA-I(p|n=gb)y^02w5(UZ;XP+fRm2XrISpcLyLf*WC+yfW}sl$QzEDZ(PVO{1%SF z`>DEX9K4NDEqt3(;h!YpHkfDBCLt?nFuhPCNW5yO*{|EpEPPx{!DXx_FL+T`D9QU1 zCO%bGw!#r4aA4rKn;W-Rwc7E#P%y7?o3o%$2zNIS7VW(l;;pV*1j_5Xy&#fJ0)}i_ zHDoKeJs2Vis}7lG66(2zMH{QQL^+tR3amD5=l+C|X|Qm3*){Sk%v@n7unMYnIk(7~ z$K5D_PjG}t2)z($m0bbi`##-5lI~rE0ueZRc_H$_lqS%FFk)CTj`uh~u24hzn%gCX zes)rslGnId4E!xr2#f`*TWXxrm=LD%)G;k2l}6h-9^d@wc`sP6-~ca9DxgRgkZemhoMp+%`om+@O&hbW8!-gm~46GgT!+45^0CO}^_x z!QjkJM?*}AaV(HjKL;5TNGsD%Tbg~ZbG8brMey;B<3BOYsQFXZ_^1#RPem=X&KWz2 zHWR37(dS#d#QP)R%e}3Ft$^y@j(Ql&J0!6V zW6x(5eGe)9_L?!TkJqbJzvzv_B($LvxqrYy*I;1U^lfmg@-lx>Kj9nh)DCQ^3mIxOq5H1H8@x zvLb~VgSOK#j!NJrVmG;i>`t&yMKO#djjeSp#OENp}@D=Cc z$(+YDX;PHJ2a_Zv6vC%vNhf1S(`uame+jN9Z_>D)CQ*vLSlzn*cTy8iu+(y8RfaJ_ zu7H5S>_R6@4$TD*xilf8C3$>O3lllsA1_q`NzegWD3C^zqUvc%{ERaLVRB*ISO||I zS$$yHHPP<4M5v&J%eY|jwH5q1IggRE2QeBG+2FBjB65@U?L{hO{o9-)*Jkf$8?WmU z1;LWG*~YH8UnjFq^PlauxxJXE->BaYIeXBTkx*8G^5A-b1GxOSmecT5lw@{oKtQ(% zTDF}7mpOI=TKbPoVgvX>WYKNLHWh-G;j zGB_l1FTj3iYpUo~f!*Q>BXeH)NYQneCTK(63N9SSpI#2jeF&NNL9uWE5U6=FPOk|- z#P1KJo#US?c~Go|a34ed)ZvByXfWTLyNQN~?MH7r{OJ5)WiiwNELj;xi4VS^$HiX{ z&)CnqG(e=TP=Lrl=0*4#%Mnsv@wqhN)3TGGn`?T-6 z*SE1SanKhiNZ5m?->O-{c1bnDB1{f?)6QrHGvFmJGbPk*@n&fb#@$0iR22!m zEo!v8#_mKeAPQpqONaf*4~3zn@R}JHhy7-wLp1pcIOCz7$p&S1d(~~W^|-4lk5-fW z;Og=S*w5yao_(afAT};gGv3|~f8i>RSWbXakTHeLmEi=PCP8rDQMc&GQhw3UW?Xh@ ztpJYMTBly!Z8zF8Yrx0z^IIFaSE=+Jwl~4X=Iyaub?~ctT%PiP+USK#3R49Y z6J^@${)EWR3NG>tR^78(zV{Ghm})^#rs3rFGXD=xYj{Tao_dBf|7Uw5=lhxd{h8qU ziA47FoyJi(0=$3h_=QIKb7o+kVCnm4;Bm(-3NNN_vXQxB-8 ze!;J(k*(4t%d7$e0fOF z)~gl}vrtyYbNSQSG-*?Ej%njNbeQW)8os5Nzw2=kG{g+1G*E`#i2dC;JTC&vj=(fT&eolcNP0$iA9*U zomM9In0&D|&BzD8K-~wSL3P9$gy}``*}%9&HQk*__ZKr7TRo~7u48(ebVsiFP?d?H zmzm|O72v9@&c&lkY|-t^EG*B?tb**CLsmmfma(AEl-#HUofRw1B96IO}*ihS1xmv5!EZN^ezZ?nhr4yBkaW8vI17GHG&@uQq9DI~1@j0(Z5oFl~Xga5PB+t~~GI@uqK`qmGM(Tz&@;|})AX5Q-GQhq6 zNjAEwRm-@DovcT|GT(^=j1jc`f^_O{?Y+&3cj}72>vxTi=DQPp;z~PxRHv0HRg}3< z(WIp$t&<~EbgsTK#k8(levJfYWRJLYP9**A#Z9}G_UO|tOuaWZl6B98gJcj~lL!Bh z*us(LW>&J%wMtz~W>q-f7w1+^%e!4%!`ywAZ!jtaCS>g~8uo>VZ}fiKavfyRz^ah9 zvA*pVb8b$Jw2rT3FL1$TJn@_>5qTbx=UjU+M3z@M-KaU}%IW^j-0#6X8R7k{M>w6= zdHm+fyeGIPxI>xSmm3lEyr|Z<9D=K)qr9!d&PF+6uI6=<@n);ECBD$G7n>VSqs59IVBILP0Bboz1u~^Ots1ueco?S7n>h0)4`PU1Z^@p6r~nQ)57OP zesTv372iDfh6BI^!{A(TJ4)dVtnCej}TkL9S8`N=WWjxeKJ{-^m3PiB?@xkN6B6** zw;6{NNa|uRmf5(B)iLt6gA%-HuCj+UjuO+=Ai_dCvrtTy)E@tZtB~8|U!LmcDI{S++*S4NG${&AX>Z8)MeN60A{@4OH zPlc2G&y;oAP_#J8Y~&s^Ic8P!a#<^>jNb?ik#KrM?V(Y=Cqc+G$-;}R?Rw;9814hg z;B4~<-^%2cDW~JO4?zR%8#65G>|sXcD4k>-k*MOYE_I_WBCUF*k?haowZB+l%V;co zv*_NJrPo{V>s(_v7!GU9`4E=C-Eq%OSg~EqJQy`QhnZ!0EFss)^Sf89|m*+et z5A*bt_`SBCkoEv>t3hSEppH&&#lft4?J)S=1wXdLN)dk~^AD_a#*DCc0C)if+qo z!DPCQvNK>;cr{@qE@dJy-|yv$8CtW3%}x`Uz3Eo}qHELsFS{vwM;GVyYE?aDBeRMw zv?cyw2(0`d-QB)ZZiy_VX=murmc@9~lx|0PWu*T>ehwilN94(2K ztZX;eLkmv7&M4XJT4L<+y<9BI#=OJP<=7ml>AhA>b$SUbC2s08_nUZ+U2%HCjoGKM zxJ=VC3(VHkCROr(1 z0br^FNvqK^6?5#0Vj0Co^YWX*~y2VJ)yh{pc7Zm zy3G#*zC2y(Ps-1eKoG>;fswCRRbmNcPSCJtoq!0^+xHU{y=~CQePuP1fM@wL_Bj&L{$WPfoa%NIP7}X7UYU*`5e*84pwE@mFI-tlIOB3!afr$)*hOG!3T}yIP0)+yVu2Z< z14=IM6<)xM*ze^kgEj1Q!0`XwDg9a&J%x zQQA_GDZBfjs2JzV_L&puG$eyr)eeGJinn_Jq1mfHPwOs3*ZttFag4r?ga4nXicltB z$cJ49Ln)^ZaMc{R{P^zpM$NDp=cw#AJ<9T5`v-$sJ(omXQ&E&L9ux(OVqfhOBL5{pG*U;j@?_W-q&BQr<+vETP`@`wK*zR8Q&i! z73bfcTNy->cLEs0;=s$RShpIBtynxgK99A7FK>Y1&%6Ju>6-<>GQl6)@su4Ves7Zf zp2go%xS!9GQc^&G;<&ZAOh4V;Uf9@Fk&^i zaKIv38$FG!IjfP3jGuaVuAiXhsq7+lnL9gyq=A92^BlcbJ6pXbfvw*setm0zZh-xl z=U49;>{Ac%r{gCh8G=5*@$2HH_G5M0@Ui!*ckp}VGx>7^K=}YT1%1N(ihmJ&*l84$ z2wV-A_!#@H|89Jy{jBXHJQiFHyb6r}dVRA2fPV*m+}x~=D_-R72<`-W0!RU?r=V}E z&x&uoc>w0#%fNfz=s;%xB_MAT^)3Dx@fDB44vV7581`PHHzLg#* zKF5C%UVdW(@@|u-dXIXU_$R-y9}muURsbDIdeR?DOab21Fn3VwH?~Sj#&-C}%o8GS6zP!wD)j&JI z&OPH{-n?Mlw_%{c2hca`XZ%Ot^X!J=O)sFw;(KQg`ib${@KJEZ4+uc@o%n6~ar18Y zX}Bv0_$m(Q{x1Bae5-u}90>vdx3A`Jmd~?KhI;@{!0_KrSbc~6On)nV-MQ*L61)KT z0|0=^>j%JWi{T%^Z-Wy+{myHk;IvT(o%Y<~rT^uYn^t3f>DtG7$7#K#sABy~qx-zc zOjw@jjm1U5a1Ok{==Sugcr*`=KRpU%87eO*R6J^WR_=hg<@n_EtT9XD;nDF)U556( z%Y*BhT-6)5cl*WEF7k5{-GR^t`@w&-0)2+>>xqxDT`KqMz8+Q+2TU2>GLc*0rCs;v zKmP$)dBLhZM_iQi&*kLpftGn~@Ji>Z@aF-Ip1;$2N;D9Hz8o~4X_np2DYx=#Vmlqw zL=3{EAYU!$lj6giaoSZnGh8++v}Hq!{)P}U`RBrGN!;cb_7{bENK}O$o1l;;-ETyk zaA%+&lMpz4yZXo~B&u3H_3sRz+A;qG)5408Rv;?2w4M&J7t<#wS3bQm+9Di3B@@6% z)9bZvBezk!M#_WF>&X??#)n_U6t0GvEs#R?8Qocr;Mo+dd@ha~cOeRhK6eRQ+~1qv zdxB6&n|&e|F!@0sVq~j#x0ruCB!${p|s{C*Mj$^xtCf={T#>cu{()J3?TT zviC)yXbXZ_#Sj7qg|4`SNHIT0hgwK7q+tF+^kh$3b1YA4?h`a1dN}X)P-c za3p*R1`fW^sd*^7Pi}e}y0#Xczl@Rh|7}3-wAAIdStRIWq_O@EvO)@+a{o!DxST;v z8f#D2*dO5`y_O*v7yWH9rmjWDoY_@=>5{)VT+dHxw=nI`|;r2hiYt&ZvnV+8y+57#D31Eyy?6aora zNqa}(lUDw08~>1u{J-VeCHW&Uspz<+idB_k*QkBQmj^yFh`zX18}@BiJeKM@P$ zD;zqY3*cftq;Qpv;=PeQE>uFMvb}a3JTIz?cwLTzYxnI|Z7P~Anf)OHJ(a8CBpI5yRdY!SO29OL?tdiuz~zu z88V$p;LW*#f7g<6JK95;kF7=~_+guappJ7mPWgWehX8=qy1E%-#%9z*jQ1AM_pG0l zt-b87ky30FF!yhHF&L|sxhoEileT2UxO649l0g?E_LPd!eN|#~*p-b^G;XbIC~SKFmrXBXM1Z>X zT>Rr1hpAy;=th2T*;n=Cp%~W*IxqbX%gB&X!pwF2*;9#Wu#CpT$l2ZaK}KFRLJ(6_ z+9x1}|2Ter{!AwLrj8Znkc{%0bJz^m5snI`tft361v)lC0QJdPKiQ_(3xFX2uyNuq zLS*zwxe+AfN8{?dPv(2Nb9iMmt9X+$wLGMsQ;hES67?NY7P-1x5$MPXE-iTYeziQR zR&;u^{f`NW;oK|PN7D(K6nJS}GUruu{l}R6r&j&t-x4t|qW;<^*ak+n@koWd6UmP> z#U3?z=mr_`muty76qq3K_A)TrfaP(hld0s)KZX3+16bhjvh&U)n{$D)6*vi@|4uXG z0>#8yzJKFg`>X966%cB6>3^yJzo6!e@qa??^}n_ncj~0=j`|jmIUL)mh5Zxhi>Z?xwcDtoI%09c9cPh=6^q4?=Y<4S2@%w(! z6&*K=%;SuB>L%V!f&rpbt9X9@NwMrR85^0A?X2GZ*SK&8*s{57LFFGrG~B<<{5LFw z(ywLU=NN-aAN=jX+ty6UXZoln>Hls+ARYSuf%}p|!!NsQ^BI*^KtY(WPnJs?`~NvB zi0{s-`7bX011mBhpzkjeqQCng{(12RD%oidx10;8mPJhLr)(_TF2}Onk`wS7UwOv( zigbm&DE0zqKI@~ui5IYs_f)Bt53UCt1D}8=Wbb#O{eI%b_zg$C%~ywL=OrDQ41J!i z^wZ6byD*ysxY-(|S*eJjceWLjYa?@Vut8hDx1|csV@m1_9mcK2z1AMNxDdTs0`a-A8?ubDrmQ zDhCD+$CWyvCJTjABms*8XWO4icfUf@nDXhcAE*p4SK06cH-MpwXOj7Y%Z2L*`kRe$ z*A95>J0F`ai4V$Z<{6Ut{QyDqCZLWW{|;>k&1oZOsEbKkqG7PrFX&T`G!tr%jFP_K z5R>9@0?~+(!!aMps=tXT_csW*;OdVEANiiE4HQwk?Qkh6(iiu%Ud26w)wSW|--C!0 zZXAPXUW22ez6ab!%C~^b{j>Mu$}_!J-i;zZ81kq0(;2>Ae{4j`=E2Lj^>-DWVMW95R}xMP;Cx1 zBycv73(^2+tZ6e;OzAC84xZEM-lje@!ha&yfG*b&I}GKFpjqZ` zEYJVIWTr%rl+=fye&~)g%%zpnst+`S{yrvA3t^~rV%g1I+(2)8NA6yrCv!C=*w#k)l+KB(&E>wJd3s@mJ6bBoQ>qn1>d! zt*E{yKV5~jVZ;hmBdm4#VYwXi$Dn?>*O-7trHR9UBVEx#?@nD#lcR^0RbJAK6kscSB2bd|3p7dteV8jpSx zX@Ki24*=(*L&$(3c9hR$gl~NaC=KGda{=@yyk8xVaaTR@u(t!k8OU=d_a^NI$%A?d z|GS8lCoM_~>cA=bg!?mTD8<@F-A9?L%rl{QfKoNXoS8Q)DtldxVsz7j^Zr@@5bkYC zH~h zFC%vxQ2ot3vf<~kt@8Nb({{eq$+i5LI-k_9U#>|w<gEneMb~B1#*7E$d2ubwIz!chq7tdRx{gApk`SA(N*;3XU?WDo3)IlS| zn^m@9T{4qI=+636*goM#42f>56*PMHnTDa>rx;!Q^JJY?8|xUcAe8xzI9!c@y>5L| z+(R1h)*5p1bxVzvbEh`bNye|sj4$l>YWlWl?Btw8Lbd*s)2>yPrMsZu8HXT`US8tn3&>IGYdf-V(} z77^K=MH=2amOrhx%Jg&8@`C^#ZR~%1{Mr5HJ3{ufoc+ftu>AE1jvOqT6auC;mkdh*fO0?EtR#UnI zjXZa00{beKzf3TKzRvrTub#E3^EGt2hsNc|A0v=*W-!v-ELcFtkE7yH5h%`Sv+sBl zp$4&tMZ0GHpE(+XmL{GI4?!Y0TU=6JYrkg{ACcBElq0CHLvrY9r6JA~r#h)aLJv!{5(ywbN>H>3Q zjqbtqwdOE`b`>55*ov*PykJ!QW%K^VkL@&by#2h{)kMRmHpbL*%cD$sG0C@%;|U|g zN_9$b!8qO@8^4$9NX*BYC7|DLj)hNkfLbF6jionBA!W*=ZeE-Qc!GWgxDR%E9Vc5l zAKYo-ch8Csp-l<0#*FRQx=!R`BUiE%94v&GKMVfks#hl<1s?6yUnZJi>e-tpP^4 zyOSl`w%$gVXFlz?olO%*+|Le%>eK!gm_mt8TXT`)DE(}OzmZQv{`l=PpUEHZn z_}iX$+54FPh_TwZaqy~k)b{btk2ocy4x#ft5&K=C2jUNSDIO9 z9UGE6JEVR~F00P#cT61{h>Xk9y)+uz(2Yh`pUPiAf9wN8)bM+ zM2teAIrpp3lO|o#X>&RNYj>GMLP|y1(J$s{pz0}*9XpnAH*FdOQZ#ca!v44ssl2K} zky9i|*66g}NY(0dEY{4IzeEE8O-#uh#sv9<$7@qL&=gJ1=wABRNBj_`fe-h*u5T(| zQ82XSPC#iF`9}M3^F2qfC#XPdS(KdbDRrlrt^Ec?`W3`1tO|?16bfRqTdQ=q&R_DC z4S9HuRs}bM6;Bs&DMQ;@+YEAvG8V$eaP~-K-hAnxb5^70Yku-tD9oSLg&sF>olYO zHEf8h+zdNfM@(D*#3w!c*c@b3hz_tZB&Qj0_bc@+dMEHrBT;=r$^vVTer%8Z<_0LT(=z}tQx zfHxlS?M`f+degaSFZu~Tk$)5x*smtqI#I{|u($EKWLfP8iV0+leO{Vadu_`|M}eM zO~d4WFoa@1+I!G@0x4e!jj17L{jth`8QGY6Xvf2f39M936Ns9e*dfm$9ZGrLWd&PEN8nIRrN#Zz$U_9?3aNTH24KyhyI*&nQ; zpI^9|w6gBIGvjKA|Kh_-$hHhzJz1Qg;Jxy)(C!gNH))hUS-x8k+N^t=W}>{x=;u5? z%}!QhUU@-;^+0XqTq4VTU1j*{^nYLBTF1c#`@K5(X-&I_*UyXGP3Vdnuupy``~i{U z889c`HH?<)l6DMCRhO&`G#1n%-ky!SVVC%W3q^|JLy#Ea*$PpN1-v|lET)A2=(k-q zXB|UT0`au5wFcZL-WIdzs=r*@hV?urIlVxJvJT1U_o7*$@0_ojCiVBy(txcgt}deB zd_;JkC)2i!6(C}Co%R8~Iu~O87UIdijA**)lNt?}jZw7^v~#&hN?COD`MmoEgIq&H zog>kIiz02*BGjPu+p3O_w7+5bwd|$sMk7g7L4K>PfxnZDBn{|W0ElVAQZ;)%gzy*) zVp~Z?`IR~>4HVRJ#Qzi85Pnp-X-uO-w0rP7d$RKAX3<<8ID)OHz>pLNZ+Gq)bH~~# za!;HpDK=o{{8${ABFO_l1P@4pLF36ILSk{nH;zgvGvP2K16T7j1&=P7W2Y*0`kANn z(*Hcjv+;m*cfl+zjqd%sLq&rX@d5bw*qrS0P555U%K#_t>X?4NFy{K;#{x{shXyo^ zsd@q`izLIh022ZqN2SKR{q@0Itg8)+GkkM`dmb>(bUgY^33GPVuOTYG>0uB6$iuRa z(){-xUiJ=_%N>0ahMZPe`ZUc&V5^bW%6)ajj$r;ND?P4sYQDL|(`MTelIN`5cZ>w* zBc@Gj2np}R-krkQ>H~%kC;(gkrS>(dZ%F^7Vl|R%qMOi6B+bViV6~Q|bk}IM zDv2q;^!L{6AemdOMNr}9{9}KG7o119mZU*RQ7%KD?D!J#IPl-*>_%}vfT{0AjR%?U zV8sz(zWoyU2-fT9#E9ilS%?he->0qui?uG;KtyV0zSk-Q+}j2PyZ=lEaY{^#ez3BD z7ja$J+Culv*|$(MqzASBu+Cf~G(y!`B>F05Yui`$*NOTGx<(9>Nfq;iKC%^*40j^l zY(*BBqjE|uH|;fvatF}ftLly)QpsEaZuZL=9HBm47)kT3b`x#p6`%A!mj{g^r2hg6 zBLxY1IZioj>K?Mu=Z7ySu{3CfX0u(TB>Hil$gnjV^z&J^3$yB06!Gtdi`u>W@hET* z&g}hC=`mFskhaMXE9!fkFi}@2!b$W^4on0Q>@_eTXolq2EaPbmHNIRI>P|I@pL}bO zzp=QOTTX&~Fc6fZ9Q;nw!c(zvg`|igR7CYGX-3`RSsUm69DijEWfY&ID|U$wq%X3| zwRpx;+YU656?K!1k-!wjE>8ammsPtLAtVw!IK^5+9oU8JfuqM4z4vPflVj{!b!dMZP@cQ${Q>pu7AA_s3w zoJ>BrAeIcLBnB2?iY-&|!|?rA1i6XOU}n{{H4;i!GXT$CV*US z+1@LUtfw2yO2PV*`iK9`{DitYSpo1?$(HS0UctbKr0V?~#&rIIcH)qA&lV=i2~U?< z>oVmZg$r8iW2n3OWDKgz^g`M==~wqO4VhD}rsr`jgn_bm1}ut_?+q?IXeb7m-bH%( z(btjFbM*I)euHnDz(H6+Z$#Z;y5M4wp!`+ihet^WPY)Td$&wC2Jv@+B0v%u7^`IFU z0%w?aKg@o9)-cM)YH3gKFK@FHf280T#$wA>oYP?S_dVhssCXnoFnF`I_qpX_&?1cp z-}7E{(ObQMB{s3>@LU#)+})Y0Hi*k|wVxS_-kbzd0TZh)i^~x+QRHSD5AWpDXajeqsGJLM_%=ktG+ z$4@yj@n4Y>`se>l*mnIEmNn8c4$AIVa~tve^Z>jRsaMO}Ptr7#GY7;ZgGYjbB1wLr)_s{sI^4 zI7prNlH(W~r1T`v>TdFsg3thR8;#f>@UT;suuP8(_lid41G55A!mEs@%_NhVF*m@o zq9OY6G+lT(2@6nPtFpvea+m{|1k>IJCnwAbVpd4g| z=z?Xp(YhskuE?^@^lI}WxmmxY77QnrOO+Ru42^NzOnQ`C?$kJN{$GpJQ`ChObb4hkRsQeC(M z0p3QTwL>Vbl{KbkqhS&VH#trQ2)C(fr9;{ND*L-E9UT(ME71nB*hc)-+`3>_*9|Ou zR^D5np0;}QR+J!;Iq-Sc^8F1BKZdvA2^~g8Ce($OonHQ*Q3Q(ZucDH^3&FJOrr&r> zU##fiJQT!+f=bT1qOBaq!mpV}za+~zxNPhl(j9r4^nvICGIEXBqV#ruN*4QlP+a}W z-EciHEadW6Kh?S_mnZkhs1==KaE?e*kah;y_~o8W>*UciVB%EYj;H>*7w1OG?+Lc-@HV>^EKb&BmG*y)?>N;$AT`BtDe#2La*gzl+@)bsZy8Jk*+08$7 ze3X_~(7F)hKU(+jCI?ZKL+;M0DA8*_E8Zg2HxF_dI-8j^w`zea|JL?}b=@|W8EH5{ z^_y4zwg`EZVktUMp`nsBK`%g(`U5G!wl<-aIjGNJzmhW4{Rg8VhdKs9UEdw`95C5H zHcBQ1^kvC}O4n$4{F)@4%Hf+xzUrwLF2=3$ou3PeS$Szb=*cA-%Nn>v^`5xUsJl90 zaWF4vz3Filx*-tm;8$HPdaG>mtQ9_$7&qjwQF zXqW7RnWE^&&w@u|eQCVmAnM?z&-Jx=0@F1Gtm$XKLN*s|r7G^J&=*9jDz(6&UONZV z^j0H}d{CU0uaY05ir2vrnyO!Tu0^)VOPp1a9V$Z9jq!Ddbup#FusViVL1i3?urFvg zL)UG>4^^N>(2Bf9*XIIYG5HO`Bvc1_b|vGe(*c9*t4>e z*=)CBWd6r`4O*}4FWz_9?$yJdXoO0!UGj7Nra28bP&Y{}Zy0OC-8xd(4& zX{sPhzUHc(({Gu5|G6h#OTtoqu9G4(hp1E9K`OfT02>elnGer4>rgms|9V|a39cs< z@CL0^t)s6btW_59184B&w4>Nn_mau==hFC5@038@^on=t5}nkW{k9x%EzPfo*xk5R?7~m{JWE3ri z$J~0}cF%su-P4&`D~c|8#-Taf*2switZwpaXrGsjr6#$vP)eoxlx^Vv3UVB7t8V?H z`KIW_S$17z+eIZ@B<|(*v~Rm3y>2J;V#hiOB6=Ik8MzWyz z&y$6RaaJ(^i-T>Dy6k2@Ob|s9;Trm>A(8Pudl(X7XgzIn*n~Fs7@SatqV02uQ7bbZ z+!NfdI}mXQE%~OU%%BX?Y*j`1;ApH)Fd9{EqWV=FL4N(>r%PbxewQiqX(*o+wD_Fp z1>m;#9_ZpFlkLi3EFCW2w&9djMI7>~TG1bzCIOq+-i>FU zHEogE190rvvTQG5aWi zbV=*B4XrhG9u`zkY;$?J^UOTI-FVxuVs!OFea3*t) zA(=&W^beBPk_KaPcv29O06oX zDPl2D>M&A>pI?3b0as8%jaHt^Il)t`d8}owTVJ`9`cd{Yg;NI`fBW zeD)S0;Ha<+Wt{WHVnbOM*B36jSW0Z?i(lf3HS4QdgccK%F|yGl;E1v!dTc7{H(k=y zig^8$`pS*CVQRi!@m4ZQRrOO?fC7RW4O-|Al9SKIQloMA%FQodWtBn}jFQ~0 z&3rr~J&mp)lymR*nh@u(IpT$Qu-_jWH8DdYPLeaSHoc!T?l4S<k~@|yg? zn@rPqWs!uA7mu8V5$l5yIHhzAInZJ5qRU@;pSZiAhgW?B4o1Z}~=|oa&(xEf7v&ushh^ z!E#6`r-86w9aUjH--;Q~|Lh63eWFlFOfn764#+0dQ8lFn&Zq#N`G}UP>%(ZIRA1Ic zV$&~x29t$2Hr^vST37_vtrqVCA&CM&wQ%3H4XOXX0Qn>a+j_nZBGC~Sgm(^U<633T%*WMqB4-t>)Ns6um##}O!yn3T%cWu9Jfcjal;|o;aK2tRqR|H zH)7H}VItG3&tE>;+MzeM!FqWA2p)y1)|9CXlA--a*-F>#&a2czu3xozqrG4k_-|zD z_(yPF>}Cw54*{A2+8TaBuT(u$&4p2LdsRgmNTL6$^Sp6{FuKGX4Jq!A&kwzfOv~?H z4t7#HJT&R+T3&#a)F&*97b-_46NKJ%d`n-`SLOhJZ+{J-Y(wGId+m;Px+_=f|b*a0vu63t2ONF>g)I_AC7(bZ?jS>8!;Z04pt=cLyy)Q zZ@!RCTc0cY?$v`dW~YshU6aXZ=Ni;Yy0~Ff;wFl*%SjhR`XlqI9wABN^~@_FyU76x zVvt10q4L0{ZQ}-&c93L%%mHe5FeFbHWncr&=Ha;&RhchYLAcy(mc1(*RemeEnMMlc zoSt{{ZfAWDfdy0J@8sIbHKW?}JHwXK1cquhhwIWyJAp%_K~FF-N{BQ(v+Sw3*j?uc zI>nYk*ONYcoXJZ*Byj;>LpE1&p;ts0N#m#4-H?Sq5k;WV@H3blw0<}jxn2((OwvL-vqU`3d|K*b`8_JrMuSHgRXkl z3j_1iEJJvj-`d((#zuwooX_KSt7zb03u6p=H=i5lwfMaB;)Cee^h9MVJjJo8%(1x`-`=+l#E(SXS51Wp> zh85Ti8)BxPza=R|1 zVAFmL7Mli7Azs*-l(g@F|DkFZXB2za;6}z>slK#^c*#kKfdy6tx7mEnV} zPri5^Y@)-waMN1_6`K?wCX0mCji z#0}rflt<_jXw3Igp@kC1#EKMSoOnP$v7!`iKsaRf(<7gA^jyB)D(nH@`?V>*Q0+dq zJ)LAB7rZh@9F-f#wMV8upev!eLmx_Og=WBpHD3ZKw(sK-ZfUH1_b^!xuq8hw00f*Fd>=rQRAZ{ zTL$S@*QW?Qv9RL8a|!wG*|RCS#PgwT78|>vgYeSHZm+(u3)Y6wY}o1fdh!8ZNE(yKqpHl5 z<;p^g_G1@ks0>n%tiz9IOGFH~Ed?Ulu42pRv`h(amPt1aEv${UVmUeGSS~~S_qNu; z+r1e??)xi&!k^bv!K3NhxFY&w2g{Ac2xPfm5z}Ij0hv0Spy0Ty?rBpXXjo`?2e>!5 zVfysnXVg|aMOy`gd)`haWOUuXS?+3?lCz`DM~et6pO++BIjS>9=(ety_bx@%cZp78 zM*~(XJHXtys+a+mZru~G6Ch-U$Bpe%!j)yTBHL{ude&$pMd~mNn88{8E?&5q+N3-> z>YyNJec$HhA5CCL_1@T{h3SswZU`w&O4M7Mi7<|u;i$Obn)M*7x?&lTQN3GvIV!yo2BUW(-L#C{*PCE6{E6vqlJ38;9gAX!jw{k=PkaX*N ztK%W7nSdzkUDqoGTK9zRoJRg=+ogorQZOas@(A1uS;en+0(6 zgwoNQnBa*H*jbz9Q}xxb>pY22FTHE0QR%FlI>ti1&R>%~s+xL+B&^4OdpKADi!I?~ z!M~XEsy+Y||MhPT7n$VTAWMt+xpe*5dsqoN%!E*Z{)Q-7DXg5Ah04Aqtxpv5haG$dt8<1ty+wL9)|{bQ}$r-ixd08Kf^qO@oB4yecXXkgkz&Sc8Nhv3rP_@57U72ulZ8W|apU%yW zIw&N|9wR^z_zBZLKtKh zAK&i~n>_^It-)bm%>@D#l2m7Sv7NWWWFF6&>6_rfr!#=uDeHx18V~hlyUsNV)V8>U zJ1_%#vvK9S^blsdX<7wIU4S3P9Te8A7;uDBSTjr;Auyca=b(Msd;mP8Aavv=aT)-U`0zkTkS7Rl-Qisz zw$H^-Sr9HnXOsb)fZTH`FmLcXtInOl_<;ml?~sBRNNc{6f`@@nP8e{aAXLvKYy$p4 zo47_`%`j|)!gGV3f%j?f0P>K5(~z0OXaY;)&ws;+_Y@%FO;VlFZM*v&q5)5Y$cE^d zHQ6I9yFgU12JLTZ>7fbb(nsi&5qPG5RR4OJ&;_AexE0Pws~L@-t@h)Cp7+?{+ZX{> ze*@wGUyQ64KpjPC;W;xz3D;P1U2`h^J=+!epz&B_?NnltLj z;iw$jY-;#X6L+ErCH4A%Gz{R#rHVJCCe9NGk>;48q_+i3wR;b8LgO<9tsER4uV3*eym=YI|=5F#OHJdz>k=c9F@Zh9<%DVxW26b z5VVPS4sll&)uGu64*u60vr_@PJYGRy=xEvZ000000000000I8E44ZfJF!gZSTlqb0 zT_@cu&9NF%5L;)0MQ#oh(5b=EMSa_VHXr)ara?l6n<*+<*!{t;d1L;Y>ZyMXo%N@G ziv9&q!^e(7f;AK@&M0QpBMAi%yfkIIwlnPBZTIO=cP9^n#uL;HYki5T?Qkns#fa7h z1HDDie_m&(29(3vQz0?scWnEU2Q4e0$-AG>=t{AH={Bk+B(FcuGi zQ`TY{`+a(>RLMy*r~dKK$wUBMtawVNfDu}*FliJCDQ|sp)ppAEVH-~-+~Ts)Qd{Fwbj5aJ6Arpj!yoC;H6 z5{WNhb`B~dqTbuwlQXO0|DF?`P!0X^bfaJ+hujDWEJk@}614hNCQ*p)SDQ(;ZKT zN@eL%ANY0Y=zW{QAEAxhGHD?KrLf96s{$)|6I>g8{mE&yyu=kuNNu1BZV*2-bnbk& z#hqSV_GpM(-YqsBakvl6Rm-?~I?VB63h`O=8;@1xaJWV!n=tP&Eoxa`00Z3ljdmIj z=fclX#;-GjSvR3*PT8#k=TLl)bb$#=0tXSpA&jd@$#HIb+2Q9N6UYepsSrj1446k^xnK-nCrU_%VEm(}o^6>v zzc)%XW8{d0{mj39Xtt(l{SI;)GkNLd-siMV#=JAK)s*jsZ@YY=9CsF_b)jfRPp+8; zNtv`4i%F>W|Q4{^qk@ z1oT*C)LhKBgXYlGGMx9ao^lg8l4o;lJULZ#%yu{RkMbtCVy29O$(!j!?UJchL0%RO zrx$dc4JPYTc^tyb6EJvm%>(LHv<_`nw!GCr!7imF8qtbd9fn!pc`k}V=1E_pul6;^ zJ0{WO2U~9;+~&7(*&gG`1hu57`GOV6#^cO1Z3P#=@l52+j{a`4z7#H(k=~5wF=!`l zBN$eBN$%&Wdr!*NKM*iudpLmuKl4lc4DD1GL}d3?%uiqS>ZrrGgdJ^R8n_mf0E^v%?pjb2a#3)wb9>= zJowvF)yq7d-3w3Qt?e$2O7-4ZfA^hU-n&F?2aEH)MzB(4c(WHLO3jT8B8Qn|V}^zn zgybh&Hh+j{TCgj2TAS;DR(hO*uT-9#A6jQCkn>&<-7euB%B!@2n96zbbb>;AhS!pZgl=-3Q%(-(Ri76r;xf+1pEXV!4o?vY_Ea z`_Xg@;NPB^AC(I{+Zo89H}qof%kem=68H{I=2+4t2k8m33XqdU!X1S^HPhl1Bg;w;(7s0MBYx(!)rga&|Dgr-AKac8E$}St%Y1Ts;}Wj;vty$3kI41 zA4Hldp$kyPfM9c66J6p_l=IbH1`o-#bx2WNKS`gzgMqct(Yzp{kf2Wd6+gS^7UbgT z@GzL|=HLloG*w5G;Vaysve+jqcMn2z!|ZczwyA`D1!Hij_kR{h;a<;3Hzj&tOZZY$ z!lAuF#^@5Fd%FRR_P*GL^rSpSiLx?t?o%4+Z0UHFyc724}dSA{z&~r&e36`e7xlK zJy)|70S4u#+HB%<*Sr7ps*Ihcf4Oj5_yTdQyggb3JMRlLU!#s;(V^_hy+-B%<++QE zV#c4Y7pP^|B`$ZcnsCn`fQus*K{OTnTOoyee8NUwk&nbfcLvXf3InpWP|&xonnS?C zZ8QZi#TtOsj4YD20PJcY5)5Le|af zNb`CDv9Ql~;Z7C%$03cw9nPZy%kMR&#zt|LmZ5_*OdlGpDoN)-kWmT$mv4a=a`YBG z{z-wtS=jw!6pZW89!}q=^;n|%8;-Z1h&!Mgt&`Kb@O_N-v8Q4e{f!D<->aA%7GGsU zG5d8tk6zx`#w(Y!vxHXw0F26iD~XqL{on8R8Dv48WqDUz+o!{di{#b^{p z4*5Ucd@1%W-+m|#raHHi%wZBh%_}fn%mkYA3h{W`il7DeG}?9xAv+5)|)N{M$ zU<(SzO0fT-fhmFMfI&rm!a_o08DmY?Lb?;sB&>N}6_ z4=_=jAS!XSx`#Q)_ELKQ-~wz_#95j*bRg5|UFy_rGzBol8i3V|H#<{aFHe%k7g52w zWAWKVN3*r~*tUPzIrRe2p-w#FVux3E+ia^ZTOCA|Em^u@!$v^t%I4ddC~0}x2C4C9qktDwAA3wg`ZO$0bLIU|;RL4~6Z$$9j5+i! zcc-rlp>E!f)DM4Pe6W5KQ3u{1N$?4^X|WghV!#2Ngc&&KhlF$tWGp4M&PsBa7pWAv zCb0 z2k7!4Xnfv!{x73FGE1&Z@g71Q#WQKQLIaAI>8y`u^R;t&9VEbOxW{ zP6|n`u^NlB@sn5DEJTNaSk{8&L5$?`-LosTqdN>_gs ze17D%AT8inte$SP#sK}Th$M0Z)rnaoZQrA7u#*5y7{!BXNVpV+1{swcsu|*lc{}Ih zbMiUypnB*r=AATIER#z7f9t{Rd8?{W*0^Z#Sa1|~c}*D9*yUlwBg>$DKSX!|>xYk3 z#@e{L-t+nn5pA+!4Fr9s4LNsYUj6647j16iql|rXD~pEMu1!=vqUSi9=V|bD=d^+ZT?3VrIuJ7`U zQ#nL;Ec9qb`&V7(`+y;{DIGE()n>usF4^@rZ{_d#xui`k4L|AcYI2orEtu1LFl)D# z^AZj*9E0rm>SdCze>oD-MhRwt(DMl~{~|-TUIaE<+(+HjeFLd4u=55zXtGBJiI0Ar zT{ec2xt?Fk98yossM8^@XTu&js->v+%3d!ORLI>m#FxBH3pw5<$g>3p7>8X)E{W#kN#Gx@>#s>Jf#6Hln7 zj%>-J-+wit;4Go`cSCIt=WqkUN8sY&^AnODFoKJRt(&Ou94mRc7;29e2)s6mAP4(I zy@MddM*;2yH>DsJZZ-_AW|v0z0%T~bBxk&MBX|oxD_jcg-!$=L>O{k7s`rM+^-xT~OXMOt(&2D_tt$wfVhn z#-0fyw;!xN)5TJYt=oN(IAH$QQ*`s!rL5Q${VpF|uvvy?5aIGn2|RK->bsi!?-9*< z`$oo8_L(>Ij!!sii*cj1TV4$fp`4`NcY=maY$9fiJIuMe)r1s;r%c<$#NPqsm>NWJ zF~GnEaLDAf4>3rbx@PFSR6($Wuiv`Lv0Mu1O3G^YN#*+pKB?A^d?@8a_COmRzC+nRzM}| zw~rwPay}6|*nug8ekDh!)k~K`<4St3<;;b0Qxkm1(X)3GACi`8L9iSFN&AcL)p&{& z^BdnSr8nuU>?@PH@-=_f5t$}8Vp+wVdcO;SLK)X%jdkB{K6R&)|2JdP0=8<;?H2AN z$IKWY?$TYKYF=1oh(Ld5duFN<@YkEsZ*1|_32hzO(UTU2S_*UIiAQFm2&wMsdKP66 zyxJ4{e-lq3V%hVC?%eX8MUhIct5Vk@@8x1TyzFaQ221*goL7>dK{P+q^f z_DhQr`B6%I5sL-69d1`_Bh8e4yKR^=={F9d1M=(=;QW5;4I=>YQpJADjZs;W+cSYo zo-J>ofsy#$(pPf*y2$QT-|U%N%&fjw*?Y*K-(Rx!{gu=K0g)fgc6yp#s>B1l-FrmR zU3@a~Xj8=4NPpbHsWzYJjDMenc#+vy@~~w^zQNQ6Y%E*Hct~;}JoJo9PsI@R&2*FY zmioe+Wamna0Aa%x`ahQjyb&{OCb%cmBi12G#KXAWk+C@=4`NSn9$$e}u?m$_Pb*^l zp^@?eNz9i8j}(SWy3^SR2ud?Y3$Asw>d(b3{7mFkHUp(xDe9h^eG3I)Er2li! zVg;RO?=EnVQypG#QNp9x{5+GB{E5(un$%xgLLA+ zbo;tk-4LC=M^)g6j>To#F7wqO$dOJ4HjSL5qr3HPvH*i{qDf`U@u0kLB$ct%2#**$ z#o5#%?7SbQEAR7O%aNCOwuS*n41HbE;dfU~ZH|@Wt$t#fBOe|fz7Q}bdjl>cy!2j% zq|ev%F?WH@W}kAA`)uSpX zUW-b*;=j#f#C4)CagExNF9!7cJ9Y@?RMYoUoW~of_TvI4Ld^tHpjTvY{qeu3zu=y0 zXGIfLgleb=shi;w*Wy{M4|VCR$MDQ9DC+BEgRbiJrX!0nCVW^}@#z4f6wt))tk*OY zIMr*Nm@b4jqAR3$<@A^2fh7^e;7|lrF zD*P{O&@l{T*-w*_VUF*H4Srb9DU4nvh2Daz=7i>JKEz*Om<{l1|q^0>eX3o&3GHLx|@e9UNBEHGm7G6 ziV%jaFsd^Bw#~AQW-dLQ^=VpzSJy0u_dxj%Gl-vUK<@5*b00cJ1zq`9KSQBh7IeksQQdw#t1?1V>NE^1+(oFE=CGfJlj0CZDBv zDiRkDQPwrW$x^IZX*=N`hDpIpgP z3!}sED))PCokn$Uik;f>Z#iB}PqNqmt)j5wrjMeJ{*i3qT%xhsuK!0@0lvpOb0ubM z>n6|N2~uweZ8N$(nvpq=wn`$!%*>-X%zuPG;&jXs@9%ZS(yB4q@^^o!cTgiwUaIGs zewI8ydI`B*2=pR~_bLmok*H{cK_*&(P%$Cnzr6DN-FbCb%Ix3W*dBno z&eqWJqM&qr$t_ObPJwqnxEKxMOYM^NK$!&Ld_%y;W7f<%lRxb7V@J*7`pl9g6Gag( ze41f2VVz3Q8K-TmHIrl}GLl&fm#>pmHZv8V)w#Aw5hvRrrl_Yd47JE@<+fJ9S9XOz zlN0Q-oUj%qPFBGF+k=B<_|x=kBo@9(YfkHzZL1hdUQ_ub2Fo0|II5ie6`&57u5_e2~ zA^auSufg2gKllXzqM914V!T!&@5xA-zsEc;z#Nq_*8u?{3lS>jD0P)@6+#>Cii)|( zO)+EF6@ksxxuf1DDI>00L{SBM_Cs^*@LlW6X-^Ij$)3EP2~&IS!W1 zN8o}0000TcCe7Zk&YsbC>T+Dy90W?wd%ZGOL!<|x#o~<2v{29@b1Ako8aZX_e#_v& pY1e6Pbedor(ELC*q4 Date: Fri, 8 May 2026 13:48:00 +0000 Subject: [PATCH 2/5] fix(vale): auto-fix style issues (Vale + Dale) --- .../admin/cap_module/capai.md | 34 +++++------ .../admin/cap_module/newoutlook.md | 56 +++++++++---------- docs/endpointprotector/index.md | 2 +- .../install/migrationprocedure/faq.md | 34 +++++------ .../migrationprocedure/migrationguide.md | 56 +++++++++---------- 5 files changed, 91 insertions(+), 91 deletions(-) diff --git a/docs/endpointprotector/admin/cap_module/capai.md b/docs/endpointprotector/admin/cap_module/capai.md index 8ef3b28d28..f3a06f411e 100644 --- a/docs/endpointprotector/admin/cap_module/capai.md +++ b/docs/endpointprotector/admin/cap_module/capai.md @@ -14,8 +14,8 @@ As artificial intelligence tools become increasingly integrated into everyday bu This new functionality enables businesses to maintain precise control over information exchanges with popular AI chat applications. By incorporating Data Loss Prevention for LLMs, EPP enhances security by: -- Granting administrators the ability to manage who can interact with AI prompts through web applications. -- Offering tools to oversee the management of sensitive content, whether it is typed directly or attached as a file. +- Letting administrators manage who can interact with AI prompts through web applications. +- Offering tools to oversee sensitive content, whether typed directly or attached as a file. **Benefits** @@ -23,7 +23,7 @@ By implementing these controls, organizations can protect sensitive information ## AI Interaction Visibility and Control in Netwrix Endpoint Protector: Data Loss Prevention for LLMs -Endpoint Protector extends Data Loss Prevention to the most widely used AI technologies — including ChatGPT, Microsoft Copilot, Google Gemini, DeepSeek, X Grok, Claude, Meta AI, and Perplexity — ensuring secure and compliant use across your organization. Coverage includes the embedded Microsoft Copilot add-in in Windows 11, New Outlook, New Teams, and Edge. Endpoint Protector also provides visibility and control over ChatGPT, Claude and Copilot native clients. +Endpoint Protector extends Data Loss Prevention to the most widely used AI technologies — including ChatGPT, Microsoft Copilot, Google Gemini, DeepSeek, X Grok, Claude, Meta AI, and Perplexity — ensuring secure and compliant use across your organization. Coverage includes the embedded Microsoft Copilot add-in in Windows 11, New Outlook, New Teams, and Edge. Endpoint Protector also provides visibility and control over ChatGPT, Claude, and Copilot native clients. ## Configure Netwrix EPP to Monitor AI Prompt Transactions @@ -31,14 +31,14 @@ To monitor or control AI prompts with EPP, you need to meet the following prereq - use latest EPP Server version - use latest EPP Client version -- CAP license with the Content Aware Protection (CAP) module enabled -- DPI (Deep Packet Inspection) module enabled +- Content Aware Protection (CAP) license with the CAP module enabled +- Deep Packet Inspection (DPI) module enabled If you meet all of the preceding requirements, most of the setup is already complete. This is because any existing web browser monitor/control policy will automatically apply to user interactions with supported AI chat applications, enforcing your policy definitions when violations occur. ## Use Case Example -### I. Simple CAP Policy Triggering on Credit Card Detection +### Example 1: Simple CAP Policy Triggering on Credit Card Detection To configure a CAP policy for this purpose: @@ -46,11 +46,11 @@ To configure a CAP policy for this purpose: ![Define base CAP policy settings](capai_usecase01_01.webp) -2. Define CAP application exit points by selecting the web browsers you want to monitor or control. ensure the relevant browsers are checked so the policy applies when users interact with AI chat applications through these browsers. +2. Define CAP application exit points by selecting the web browsers you want to monitor or control. Ensure you check the relevant browsers so the policy applies when users interact with AI chat applications through these browsers. ![Define CAP application exit points](capai_usecase01_02.webp) -3. Define CAP Policy Denylists for this use case by selecting the necessary credit card patterns. Ensure that the appropriate patterns are checked so that the policy will detect and block any attempts to submit credit card information through AI chat applications. +3. Define CAP Policy Denylists for this use case by selecting the necessary credit card patterns. Ensure you check the appropriate patterns so the policy detects and blocks any attempts to submit credit card information through AI chat applications. ![Define CAP Policy Denylists](capai_usecase01_03.webp) @@ -68,11 +68,11 @@ To configure a CAP policy for this purpose: The test covers several AI platforms: Copilot, ChatGPT, Google Gemini, DeepSeek, and X Grok. - **Responsiveness Check** – Verified that each AI model was actively responding, ensuring the interaction was genuine and not a simulated or dummy web transaction triggered by the URL.​ - - **Data Leakage Simulation** – Credit card (CC) patterns were submitted to each AI platform to request validation. Sample data was generated using an AI engine. The CAP policy was configured to automatically block any transaction containing CC data. - - **Cross-Engine Validation** – Repeated the same procedure across all mentioned AI engines to confirm consistent behavior and validate DLP enforcement.​ + - **Data Leakage Simulation** – The test submitted credit card (CC) patterns to each AI platform for validation. An AI engine generated the sample data. The CAP policy automatically blocks any transaction containing CC data. + - **Cross-Engine Validation** – The test repeated the same procedure across all mentioned AI engines to confirm consistent behavior and validate DLP enforcement.​ - **Conclusion** – The demonstration confirms that **Netwrix EPP DLP integrates seamlessly with AI tools such as Copilot, ChatGPT, Google Gemini, DeepSeek, and X Grok** to **prevent data leakage, enforce compliance, and ensure secure information handling at the endpoint level**, while maintaining a positive user experience. -### II. Contextual CAP Policy Triggering on PII patterns in combination for Copilot web & apps +### Example 2: Contextual CAP Policy Triggering on PII patterns in combination for Copilot web & apps To configure a CAP policy for this purpose: @@ -80,7 +80,7 @@ To configure a CAP policy for this purpose: ![Define base CAP policy settings](capai_usecase01_01.webp) -2. Define CAP application exit points by selecting the web browsers you want to monitor or control. ensure the relevant browsers are checked so the policy applies when users interact with AI chat applications through these browsers. +2. Define CAP application exit points by selecting the web browsers you want to monitor or control. Ensure you check the relevant browsers so the policy applies when users interact with AI chat applications through these browsers. :::tip For Copilot plugins in New Outlook, Teams, or Windows 11 25H2, also verify the in-app definitions for Outlook and Teams when configuring policies. @@ -88,7 +88,7 @@ For Copilot plugins in New Outlook, Teams, or Windows 11 25H2, also verify the i ![Define CAP application exit points](capai_usecase01_02.webp) -3. Define Policy Denylists for this use case by selecting the necessary credit card patterns. Ensure that the appropriate patterns are checked so that the policy will detect and block any attempts to submit credit card information through AI chat applications. +3. Define Policy Denylists for this use case by selecting the necessary credit card patterns. Ensure you check the appropriate patterns so the policy detects and blocks any attempts to submit credit card information through AI chat applications. ![Define CAP Policy Denylists](capai_usecase02_01.webp) @@ -111,12 +111,12 @@ You can use contextual rules to create complex pattern definitions for more accu The test begins with verifying **Copilot’s functionality** to ensure proper operation. - • **Initial HR Scenario** – An HR use case is simulated, where employment contract templates without sensitive data are enhanced using Copilot to improve formatting and presentation quality. + • **Initial HR Scenario** – The test simulates an HR use case in which Copilot enhances employment contract templates without sensitive data to improve formatting and presentation quality. - • **Data Leakage Prevention Test** – A realistic dataset containing sensitive HR information from a CRM system is introduced. When this data is processed through Copilot, the Netwrix DLP solution detects the presence of personal data and automatically blocks the transaction, preventing unauthorized disclosure. + • **Data Leakage Prevention Test** – The test introduces a realistic dataset containing sensitive HR information from a CRM system. When Copilot processes this data, the Netwrix DLP solution detects personal data and automatically blocks the transaction, preventing unauthorized disclosure. - • **Microsoft Teams Scenario** – The same test is conducted using Copilot integrated with Microsoft Teams. The DLP system again identifies sensitive information and stops the operation, confirming consistent protection within collaboration environments. + • **Microsoft Teams Scenario** – The test runs the same scenario using Copilot integrated with Microsoft Teams. The DLP system again identifies sensitive information and stops the operation, confirming consistent protection within collaboration environments. - • **Outlook Scenario** – The procedure is repeated in Microsoft’s new Outlook with Copilot Agent. Despite the platform change, the DLP system maintains the same behavior, successfully blocking data transmission. + • **Outlook Scenario** – The test repeats the procedure in Microsoft’s new Outlook with Copilot Agent. Despite the platform change, the DLP system maintains the same behavior, successfully blocking data transmission. • **Conclusion** – The demonstration confirms that **Netwrix EPP DLP** integrates seamlessly with AI tools such as Copilot to **prevent data leakage**, **enforce compliance**, and **ensure secure information handling** across Microsoft 365 applications. diff --git a/docs/endpointprotector/admin/cap_module/newoutlook.md b/docs/endpointprotector/admin/cap_module/newoutlook.md index 9d83826291..f1b4011bfb 100644 --- a/docs/endpointprotector/admin/cap_module/newoutlook.md +++ b/docs/endpointprotector/admin/cap_module/newoutlook.md @@ -6,9 +6,9 @@ sidebar_position: 50 # Content Aware Protection for New Outlook -Starting from Endpoint Protector Clients version 5.9.4.3, New Outlook can be fully managed as a Content Aware Protection Exit Point via the Microsoft 365 Web Add-in. Unlike COM add-ins for classic Outlook, which are installed directly on individual endpoints, Microsoft Web Add-ins need to be deployed centrally using the Microsoft 365 Admin Center or manually within the user account in Outlook application. +Starting from Endpoint Protector Clients version 5.9.4.3, you can fully manage New Outlook as a Content Aware Protection Exit Point via the Microsoft 365 Web Add-in. Unlike COM add-ins for classic Outlook, which install directly on individual endpoints, you must deploy Microsoft Web Add-ins centrally using the Microsoft 365 Admin Center or manually within the user account in the Outlook application. -Microsoft 365 Web Add-ins are associated with user accounts rather than computers or devices. Once an add-in is deployed to a user account, every device that the user employs to access that account will have the add-in available. This means it can't be restricted to just one device, such as the user's Mac computer only. +Microsoft 365 Web Add-ins associate with user accounts rather than computers or devices. Once you deploy an add-in to a user account, every device the user employs to access that account has the add-in available. This means you can't restrict it to just one device, such as the user's Mac computer only. For detailed instructions and more information, refer to the official documentation available through Microsoft and Endpoint Protector resources: - [Microsoft resources](https://learn.microsoft.com/en-us/office/dev/add-ins/overview/office-add-ins) @@ -19,37 +19,37 @@ Both Netwrix and Microsoft recommend deploying the add-in in phases, starting wi ::: :::warning Important -Configure the policy correctly so that the add-in is deployed selectively, rather than to all users—especially those who don't require it. The JavaScript variable configuration also allows the add-in to remain inactive or non-obtrusive unless the EPP agent is running on a device. This ensures that the add-in doesn't block operations unnecessarily if the agent isn't active. Refer to the dedicated subchapter [Default Behavior of New Outlook Add-in and EPP Client](#default-behavior-of-new-outlook-add-in-and-epp-client). +Configure the policy correctly to deploy the add-in selectively, rather than to all users—especially those who don't require it. The JavaScript variable configuration also allows the add-in to remain inactive or non-obtrusive unless the EPP agent is running on a device. This ensures that the add-in doesn't block operations unnecessarily if the agent isn't active. Refer to the dedicated subchapter [Default Behavior of New Outlook Add-in and EPP Client](#default-behavior-of-new-outlook-add-in-and-epp-client). ::: -When you install an add-in in Outlook.com, it will also appear in other versions of Outlook. For example, if you install an add-in in Outlook.com, you will see it when you open the desktop version of Outlook. +When you install an add-in in Outlook.com, it also appears in other versions of Outlook. For example, if you install an add-in in Outlook.com, you'll see it when you open the desktop version of Outlook. -The EPP Client will also enforce the Content Aware Policies on those accounts when accessed through Outlook on the Web, with no additional configuration needed. The Outlook interface doesn't display the add-in. +The EPP Client also enforces Content Aware Policies on those accounts when users access them through Outlook on the Web, and requires no additional configuration. The Outlook interface doesn't display the add-in. To obtain the Outlook add-in manifest and validator files, visit [Netwrix My Products portal](https://customer.netwrix.com/sign_in.html?rf=my_products.html).\ -Customer portal access is required to download the EPP content*. See also announcements on the Netwrix community portal or contact Netwrix Global Services & Support. +You need customer portal access to download the EPP content*. See also announcements on the Netwrix community portal or contact Netwrix Global Services & Support. ## Requirements -To ensure full configuration and functionality of the EPP Microsoft New Outlook add-in, three dependencies must be addressed collectively: +To ensure full configuration and functionality of the EPP Microsoft New Outlook add-in, you must address three dependencies collectively: 1. Update EPP Clients\ -Ensure that all Endpoint Protector (EPP) Clients are updated to at least version 5.9.4.3. This version is necessary to support the features and capabilities of the new add-in. +Ensure that all Endpoint Protector (EPP) Clients run at least version 5.9.4.3. This version is necessary to support the features of the new add-in. 2. Download the latest New Outlook add-in from the [Netwrix My Products portal](https://customer.netwrix.com/sign_in.html?rf=my_products.html).\ -Customer portal access is required to download the EPP content*. +You need customer portal access to download the EPP content*. 3. Deploy configured Microsoft Outlook Add-in (manifest.xml)\ -Configure and deploy the Microsoft Outlook add-in and assign it to the relevant user accounts. This can be managed centrally via the Microsoft 365 Admin Center or manually on individual user accounts. +Configure and deploy the Microsoft Outlook add-in and assign it to the relevant user accounts. You can manage this centrally via the Microsoft 365 Admin Center or manually on individual user accounts. 4. Host Validation Part and Icons\ -The Endpoint Protector add-in requires certain files to be hosted by the customer and accessible from the internet. This includes: +The Endpoint Protector add-in requires the customer to host certain files and make them accessible from the internet. This includes: - - **mainpage.html** - Needs to be hosted; this is the entry point of the add-in. + - **mainpage.html** - You must host this file; this is the entry point of the add-in. - **validator.js** - The script that performs the necessary functions for the add-in. - - **main_64.png, main_128.png** - These icons are also required by Microsoft; otherwise, the add-in can't be validated by Microsoft admin center. + - **main_64.png, main_128.png** - Microsoft also requires these icons; otherwise, the Microsoft admin center can't validate the add-in. - Hosting the above ensures that the add-in can communicate appropriately with the EPP system to enable its functionalities. + Hosting these files ensures that the add-in can communicate appropriately with the EPP system to enable its functionalities. You are responsible for hosting these files. Host them at a publicly reachable URL. The URL of each hosted file must match the value configured in the manifest. The following chapters describe each requirement. @@ -65,17 +65,17 @@ The Endpoint Protector add-in requires certain files to be hosted by the custome ::: 4. Standard EPP Content Aware Protection Policy\ -Ensure that a standard Endpoint Protector (EPP) Content Aware Protection (CAP) policy is set up with the appropriate Outlook definition. +Set up a standard Endpoint Protector (EPP) Content Aware Protection (CAP) policy with the appropriate Outlook definition. 5. Deep Packet Inspection Setting\ -Ensure that the setting under Content Aware Protection → Deep Packet Inspection called "Block Unsupported Protocols in New Outlook" is turned off. This setting is no longer needed if the EPP add-in is in use. +Turn off the setting under Content Aware Protection → Deep Packet Inspection called "Block Unsupported Protocols in New Outlook". The EPP add-in makes this setting unnecessary. :::note On macOS, an EPP certificate is used to ensure secure communication between the add-in and the EppClient. Refer to the existing User Manual chapter for [detailed instructions](./deeppacket#dpi-certificate-on-macos). If you have configured the DPI certificate on macOS, you can ignore this note. ::: :::warning Important -Ensure these URLs are correctly hosted on your server and accessible via the internet to enable required functionalities for the add-in. +Host these URLs correctly on your server and ensure they're accessible via the internet to enable required functionalities for the add-in. ::: @@ -90,10 +90,10 @@ At the core of any Office Add-in is the manifest file (.xml). This file acts as In short, the manifest tells Outlook how to integrate and run the add-in. If the manifest is missing or incorrect, the add-in won't function properly. -To configure the EPP add-in for Outlook accounts, update the provided template in the places listed below. All these places are marked with the comment ``. +To configure the EPP add-in for Outlook accounts, update the provided template in the following places. The comment `` marks each place. 1. Define icons location\ -This is required by the Microsoft add-in validator. Replace the placeholder URLs with the actual URLs for the icon files. +The Microsoft add-in validator requires this. Replace the placeholder URLs with the actual URLs for the icon files. ```xml @@ -111,7 +111,7 @@ This is required by the Microsoft add-in validator. Replace the placeholder URLs www.example.com ``` - ensure that you add every domain in the URLs of the hosted files to the `` list: + Ensure that you add every domain in the URLs of the hosted files to the `` list: - If the same domain is used for all URLs, it only needs to be added once. - Extend the existing list by adding your domain at the end between the `` tags, and before the closing `` tag. @@ -141,19 +141,19 @@ This is required by the Microsoft add-in validator. Replace the placeholder URLs ``` :::warning Important -Ensure these URLs are correctly hosted on your server and accessible via the internet to enable required functionalities for the add-in. +Host these URLs correctly on your server and ensure they're accessible via the internet to enable required functionalities for the add-in. ::: ## Default Behavior of New Outlook Add-in and EPP Client -The default behavior of the New Outlook add-in and EPP Client will align with the EPP Content Aware Protection (CAP) policy defined for email and Outlook actions. This includes capabilities such as reporting, blocking, and other egress channel controls when specific conditions are met. +The default behavior of the New Outlook add-in and EPP Client aligns with the EPP Content Aware Protection (CAP) policy defined for email and Outlook actions. This includes capabilities such as reporting, blocking, and other egress channel controls when specific conditions match. -However, the add-in has a predefined, hardcoded behavior when it can't communicate with the EPP Client, assuming the EPP Client isn't present. In this scenario, it is configured to allow sending messages. For customers who want to enforce a restrictive policy that blocks the option to send out emails, this option is available. +However, the add-in has a predefined, hardcoded behavior when it can't communicate with the EPP Client, assuming the EPP Client isn't present. In this scenario, it allows sending messages. For customers who want to enforce a restrictive policy that blocks the option to send out emails, this option is available. **To change that:** 1. Edit hosted **validator.js** file. -2. In first line edit value: +2. In the first line, edit the value: ```javascript const DEFAULT_ACTION = true; // true = Allow, false = block ``` @@ -183,7 +183,7 @@ This prompt supports only one language locale. ## Manual Deployment Method -The manual deployment method isn't recommended because it must be repeated for each user account. This method is intended for pilot phases, troubleshooting, or feature PoCs. +Netwrix doesn't recommend the manual deployment method because you must repeat it for each user account. Use this method for pilot phases, troubleshooting, or feature proofs of concept (PoCs). This option is only available if your organization lets users add custom add-ins. @@ -199,7 +199,7 @@ Refer to official Microsoft KB article: [Use add-ins in Outlook](https://support ![Custom addin file selection](mscustomaddin.webp "Custom addin file selection") 6. Select the XML file for the add-in. 7. Select **Open** to install the add-in. -8. After making changes, allow some time for them to propagate. According to Microsoft, this process can take anywhere from a few minutes to up to 24 hours. +8. After making changes, allow some time for them to propagate. According to Microsoft, this process can take anywhere from a few minutes to 24 hours. ## Central Deployment Method @@ -214,9 +214,9 @@ The central deployment method allows administrators to deploy the EPP New Outloo ![Choose Upload custom apps](msaddincustomappselect.webp "Choose Upload custom apps") 5. Under **Upload Apps to Deploy**, choose the **App type** of **Office Add-in**, choose **Upload manifest file (.xml) from device**, and click **Choose File**.\ ![Upload Apps to Deploy](msaddincentraladdinfileselect.webp "Upload Apps to Deploy") -6. After selecting the file and clicking **Next**, under **Add users**, choose **Specific users/groups** and use the search box to populate the search box with the groups you want.\ +6. After selecting the file and clicking **Next**, under **Add users**, choose **Specific users/groups** and use the search box to find the groups you want.\ ![Specific users/groups selector](msaddinspecifictargetuser.webp "Specific users/groups selector") 7. When the list appears under **To be added**, click **Next** and then click **Accept Permissions**. Review the needed permissions and click **Accept**. 8. Ensure to keep **Deployment Method** as **Fixed (Default)**. 9. Click **Next** and then **Finish deployment**. -10. After making changes, allow some time for them to propagate. According to Microsoft, this process can take anywhere from a few minutes to up to 24 hours. +10. After making changes, allow some time for them to propagate. According to Microsoft, this process can take anywhere from a few minutes to 24 hours. diff --git a/docs/endpointprotector/index.md b/docs/endpointprotector/index.md index 1aa076a2ae..f42e842c0d 100644 --- a/docs/endpointprotector/index.md +++ b/docs/endpointprotector/index.md @@ -54,5 +54,5 @@ For detailed information about the support policies and recommended upgrade path ## Getting Started -The subsequent sections will detail the deployment, setup, and configuration steps necessary to +The following sections detail the deployment, setup, and configuration steps necessary to implement Endpoint Protector and begin protecting your endpoints against data breaches effectively. diff --git a/docs/endpointprotector/install/migrationprocedure/faq.md b/docs/endpointprotector/install/migrationprocedure/faq.md index 060404d52e..3c047cc74f 100644 --- a/docs/endpointprotector/install/migrationprocedure/faq.md +++ b/docs/endpointprotector/install/migrationprocedure/faq.md @@ -38,13 +38,13 @@ This most commonly occurs with large backups or under-resourced VMs. 2. Verify the backup file isn't corrupted — re-download from the source server. 3. Verify the backup was created on 5.9.4.2 (not another version). 4. Try increasing PHP upload limits temporarily (see [Backup File Exceeds 200 MB Import Limit](troubleshooting#backup-file-exceeds-200-mb-import-limit)). -5. If none of the above resolves it, contact Netwrix Support with the server logs from `/var/log/epp/`. +5. If none of these steps resolves it, contact Netwrix Support with the server logs from `/var/log/epp/`. --- ## Network/IP Settings Not Saving on the New 2510 Server -The IP configuration page fails to save if **only one DNS field is filled**. This is a known product issue affecting 2509 and early 2510 builds. +The IP configuration page fails to save if **you fill only one DNS field**. This is a known product issue affecting 2509 and early 2510 builds. **Workaround:** Fill both the Primary and Secondary DNS fields. Use `8.8.8.8` (Primary) and `8.8.4.4` (Secondary) if you don't have a secondary internal DNS server. @@ -102,7 +102,7 @@ You may need to refresh Entra ID / SSO application registrations after migration 4. Check the **Device Control → Computers** page and sort by **Last Seen**. 5. If clients were on 5.9.4.1 or older and you didn't deploy 5.9.4.3 first, they can't receive the 2605 client package directly — deploy 5.9.4.3 first via your software distribution tool before upgrading to 2605. See [Phase 3 — Uploading EPP & EE Client Packages](migrationguide#phase-3--uploading-epp--ee-client-packages) for the full client upgrade path. 6. Verify that firewall rules allow HTTPS connections on the configured EPP communication port. -7. Consider reinstalling the EPP Client if it appears to be corrupted. +7. Consider reinstalling the EPP Client if it appears corrupted. --- @@ -113,8 +113,8 @@ This is a known issue after migration to 2510/2601. **Steps:** 1. Navigate to **System Maintenance → Audit Log Backups**. 2. If a job has been running more than 4 hours, attempt to cancel it from the UI. -3. If the cancel option is unresponsive, contact Netwrix Support — a backend intervention may be required to reset the job state. -4. Don't start new Audit Log Backup jobs until the stuck job is resolved. +3. If the cancel option is unresponsive, contact Netwrix Support — you may need a backend intervention to reset the job state. +4. Don't start new Audit Log Backup jobs until you resolve the stuck job. --- @@ -141,7 +141,7 @@ This can occur after migration due to backend indexing activity on the newly res **Steps:** 1. Verify Content Aware Protection policies are active (**Content Aware Protection → Policies**). 2. Check that the CAP Dashboard shows recent activity. -3. Generate a test transfer that should be detected and confirm whether it appears in CAP logs. +3. Generate a test transfer that the system should detect and confirm whether it appears in CAP logs. 4. If policies are active but the server isn't generating or sending reports, contact Netwrix Support — this is a known post-migration defect. --- @@ -164,7 +164,7 @@ This is a known product defect on 2601. **Steps:** 1. Don't repeatedly attempt to apply backend updates if the server crashes on the first attempt. 2. Take a VM snapshot before any retry. -3. Contact Netwrix Support immediately — a targeted fix is required. +3. Contact Netwrix Support immediately — you need a targeted fix. --- @@ -218,33 +218,33 @@ Approximate time estimates based on real migration experience: | **Total end-to-end** | **~4–8 hours active work + 24h stabilization window** | :::tip -Plan for a full business day of active migration work, plus a 24-hour monitoring period before the environment is considered fully stable. +Plan for a full business day of active migration work, plus a 24-hour monitoring period before you consider the environment fully stable. ::: --- ## Running the Old 5.9.4.2 Server Alongside the New 2510 Server -**Yes, and it is recommended** — at least temporarily. The old server: +**Yes, and Netwrix recommends it** — at least temporarily. The old server: - Retains all historical event logs and file shadows (not migrated to 2510). -- Serves as your rollback if critical issues are discovered post-migration. -- Can be consulted for compliance or forensic purposes if any applicable regulation requires retention of historical data. +- Serves as your rollback if you discover critical issues post-migration. +- Provides a source for compliance or forensic purposes if any applicable regulation requires retention of historical data. :::tip -Keep the old server **offline** after the new 2510/2604 environment is validated. Activate access to it only on demand (e.g. for a compliance review or rollback). Leaving it online unnecessarily increases the attack surface, particularly given that 5.9.4.2 no longer receives security patches. +Keep the old server **offline** after you validate the new 2510/2604 environment. Activate access to it only on demand (e.g. for a compliance review or rollback). Leaving it online unnecessarily increases the attack surface, particularly given that 5.9.4.2 no longer receives security patches. ::: Decommission the old server only after: -1. All endpoints are successfully communicating with 2510. -2. All integrations are verified. -3. Compliance and retention requirements for historical logs are satisfied (export or confirmed in SIEM). -4. A full post-migration backup has been created on 2510 and stored securely. +1. All endpoints successfully communicate with 2510. +2. You verified all integrations. +3. You satisfied compliance and retention requirements for historical logs (exported or confirmed in SIEM). +4. You created a full post-migration backup on 2510 and stored it securely. --- ## Reverting from 2510 or a Later Version to a 5.x Server -The migration from 5.x to 2510 is one-way — there is no supported downgrade path. If critical issues are discovered after migration, the only supported rollback method is restoring the pre-migration VM snapshot of your 5.9.4.2 server. This is why keeping the old server VM alive and taking a snapshot before migration is mandatory. +The migration from 5.x to 2510 is one-way — there is no supported downgrade path. If you discover critical issues after migration, the only supported rollback method is restoring the pre-migration VM snapshot of your 5.9.4.2 server. This is why keeping the old server VM alive and taking a snapshot before migration is mandatory. Contact Netwrix Support before attempting any rollback. diff --git a/docs/endpointprotector/install/migrationprocedure/migrationguide.md b/docs/endpointprotector/install/migrationprocedure/migrationguide.md index 86460840f3..af79a78184 100644 --- a/docs/endpointprotector/install/migrationprocedure/migrationguide.md +++ b/docs/endpointprotector/install/migrationprocedure/migrationguide.md @@ -34,7 +34,7 @@ The complete migration process follows this sequence: ![EPP Server Migration — end-to-end process diagram](eppmigrationdiagram.webp) :::warning -The server does not accept backups from versions **other than 5.9.4.2**. The intermediate upgrade step to 5.9.4.2 is **mandatory** — skipping it will result in a failed restoration. +The server doesn't accept backups from versions **other than 5.9.4.2**. The intermediate upgrade step to 5.9.4.2 is **mandatory** — skipping it will result in a failed restoration. ::: :::warning @@ -74,7 +74,7 @@ Always verify your source server version before creating the migration backup. ### New EPP Client and Server versioning -Starting with the 2509 EPP Server release in October 2025, a new versioning scheme has been introduced. For details, see [Unified EPP Clients and Server Versioning](/docs/endpointprotector/install/overview.md). +Starting with the 2509 EPP Server release in October 2025, Netwrix introduced a new versioning scheme. For details, see [Unified EPP Clients and Server Versioning](/docs/endpointprotector/install/overview.md). :::tip Netwrix recommends the migration upgrade path to the 2510 image with 2604 patch for any environment still on legacy 5.x versions. Use in-place upgrades within the 5.x series only as an intermediate step to reach 5.9.4.2. @@ -129,7 +129,7 @@ Confirm hypervisor version compatibility **before** scheduling a migration maint ::: :::note -The hypervisor recommendations above reflect the best available guidance based on the EPP image format and known compatibility. However, hypervisor provisioning, configuration, and ongoing maintenance fall outside the scope of Netwrix support. Netwrix can't assist with hypervisor-side issues — customers are responsible for their own virtualisation infrastructure. +The preceding hypervisor recommendations reflect the best available guidance based on the EPP image format and known compatibility. However, hypervisor provisioning, configuration, and ongoing maintenance fall outside the scope of Netwrix support. Netwrix can't assist with hypervisor-side issues — customers are responsible for their own virtualisation infrastructure. ::: ### System Resource Assessment @@ -169,7 +169,7 @@ Plan a maintenance window that accounts for the following: - Post-migration verification: **30–60 minutes** - Client package uploads: **10–20 minutes** -These times are based on laboratory test results and may vary in your environment depending on several factors, including hardware assigned to the appliance. +These times reflect laboratory test results and may vary in your environment depending on several factors, including hardware assigned to the appliance. **During the upgrade window, the following will be unavailable:** - EPP/EE client communication with the server @@ -177,15 +177,15 @@ These times are based on laboratory test results and may vary in your environmen - File Shadow and log generation :::tip -EPP clients continue logging events locally during server downtime. All queued events are delivered to the server once communication is restored. No endpoint data is lost. +EPP clients continue logging events locally during server downtime. The server receives all queued events once communication resumes. No endpoint data is lost. ::: :::tip -In large enterprise environments with a high number of active EPP clients, Netwrix recommends **temporarily disabling client communications** before starting the upgrade. This prevents clients from sending EPP logs to the server during the process, allowing the server to focus on the upgrade and ensuring no logs are left unprocessed in the queue. Client communications can be disabled in several ways: +In large enterprise environments with a high number of active EPP clients, Netwrix recommends **temporarily disabling client communications** before starting the upgrade. This prevents clients from sending EPP logs to the server during the process, allowing the server to focus on the upgrade and ensuring no logs remain unprocessed in the queue. Client communications can be disabled in several ways: - Blocking the EPP communication port on the perimeter or host-based firewall - Blocking the port at the virtual machine network stack level (vSwitch port group policy, NSX rule, or equivalent) -Re-enable communications after the upgraded server has been verified and is ready to accept traffic. +Re-enable communications after you verify the upgraded server and it's ready to accept traffic. ::: ### VM Snapshot and Backup @@ -199,7 +199,7 @@ VM backup and snapshot management is the full responsibility of the customer's a **Step 1 — Create a VM snapshot** on your hypervisor (VMware, Hyper-V, ESXi, AWS, Azure, etc.). :::warning -In AWS, snapshots are queued and not taken instantly. Verify the snapshot is in **"completed"** status before proceeding. +In AWS, the system queues snapshots and doesn't take them instantly. Verify the snapshot is in **"completed"** status before proceeding. ::: :::tip @@ -232,7 +232,7 @@ The System Configuration Backup doesn't include logs and file shadows. If you ne - Retain the old server VM after migration for log access. :::tip -If your organization has compliance requirements for data retention (e.g., GDPR, HIPAA, SOX), never decommission the old server until you have confirmed that log retention requirements are met by an alternative solution (SIEM, external export). +If your organization has compliance requirements for data retention (e.g., GDPR, HIPAA, SOX), never decommission the old server until you have confirmed that an alternative solution (SIEM, external export) meets log retention requirements. ::: ### Pre-Migration Checklist Summary @@ -369,7 +369,7 @@ If using Enforced Encryption and you change the IP/FQDN, every user with an EE-p ### Deploying the 2510 Base Image :::tip -Both the **2509** and **2510** base images can be upgraded directly to 2602. The **2510 image is recommended** for new deployments — it includes improvements to disk sizing (320 GB) and resolves DHCP/DNS configuration issues present in 2509. If you already have a 2509 image available, it is fully supported and reaches 2602 without any intermediate image migration. +You can upgrade both the **2509** and **2510** base images directly to 2602. **Netwrix recommends the 2510 image** for new deployments — it includes improvements to disk sizing (320 GB) and resolves DHCP/DNS configuration issues present in 2509. If you already have a 2509 image available, Netwrix fully supports it and you can reach 2602 without any intermediate image migration. ::: 1. Download the Endpoint Protector **2510** VM image from the [My Products portal on netwrix.com](https://customer.netwrix.com/sign_in.html?rf=my_products.html), or request it from your account team. @@ -382,7 +382,7 @@ Both the **2509** and **2510** base images can be upgraded directly to 2602. The - Configure DNS :::note -⚠️ **Known Issue:** IP network settings may not save correctly if only one DNS field is filled. **Workaround:** Fill **both** DNS fields. Use for example Google's public DNS (`8.8.8.8` and `8.8.4.4`) as a secondary if you don't have a second internal DNS server. +⚠️ **Known Issue:** IP network settings may not save correctly if you fill only one DNS field. **Workaround:** Fill **both** DNS fields. Use for example Google's public DNS (`8.8.8.8` and `8.8.4.4`) as a secondary if you don't have a second internal DNS server. ::: ![2510 Network Configuration — IP, subnet, gateway, both DNS fields filled](2510_network_config.webp) @@ -391,7 +391,7 @@ Both the **2509** and **2510** base images can be upgraded directly to 2602. The ### Temporarily Disabling Client Communications -Immediately after the new VM is provisioned and reachable, disable client communications before performing any further configuration. This prevents endpoints from discovering and connecting to the new server while it is still being prepared. +Immediately after you provision the new VM and it's reachable, disable client communications before performing any further configuration. This prevents endpoints from discovering and connecting to the new server while you're still preparing it. 1. Log in to the new server console. 2. Navigate to **System Configuration → System Settings**. @@ -403,8 +403,8 @@ Disabling client communications prevents endpoints from registering with an inco ### Activate trial license on a newly deployed image -To be able to upgrade a clean appliance, at least a Trial license should be activated. Go to **System Configuration** → **Licensing** and choose **Free Trial**. The proper license will be imported in a later step, after the upgrade and backup restore process. -If activated successfully, you should see a green banner at the top. +To upgrade a clean appliance, activate at least a Trial license. Go to **System Configuration** → **Licensing** and choose **Free Trial**. You'll import the proper license in a later step, after the upgrade and backup restore process. +After successful activation, you should see a green banner at the top. ![EPP License Trial activation](licensetrialactivation.webp) @@ -424,14 +424,14 @@ With the license active, upgrade the fresh 2510 image to the current latest patc For air-gapped environments, follow the same procedure using the 2604 cumulative patch file — this is the same patch used for online environments. ::: -3. After each patch, refresh browser and verify the version in **Appliance → Server Information** before applying the next. +3. After each patch, refresh the browser and verify the version in **Appliance → Server Information** before applying the next. 4. Once on 2604, confirm the server is stable and all services are running before proceeding to the backup restore. ![Appliance → Server Information — version 2604 after patching](server_info_2602.webp) ### Restoring the 5.9.4.2 Backup onto 2604 -The 5.9.4.2 backup is restored onto the fully patched 2604 server. The backup format is compatible with all versions in the new image series (2510 through 2604 and later). +Restore the 5.9.4.2 backup onto the fully patched 2604 server. The backup format is compatible with all versions in the new image series (2510 through 2604 and later). 1. Log in to the **2604 server console**. 2. Navigate to **System Maintenance → System Backup v2**. @@ -451,7 +451,7 @@ The 5.9.4.2 backup is restored onto the fully patched 2604 server. The backup fo ![System Backup list — Ready to download status confirming successful restore](backup_ready_restored.webp) -9. After few minutes, click **Reload** above the status column to refresh progress. If the console becomes unresponsive, refresh the browser — this is normal during application restart. +9. After a few minutes, click **Reload** above the status column to refresh progress. If the console becomes unresponsive, refresh the browser — this is normal during application restart. :::tip @@ -471,7 +471,7 @@ Large backups on under-resourced VMs can cause **server unresponsiveness or a 50 1. Navigate to **System Configuration → System Licensing → Import License**. 2. Upload the license file that contains the `php_els` field. 3. After import, go to **Appliance → Server Information**. -4. Confirm that **"ELS for PHP = Active"** is displayed before continuing. +4. Confirm that **"ELS for PHP = Active"** appears before continuing. You can validate the php_els component status in Appliance → Server Information. ![Appliance → Server Information — license](server_info_license.webp) @@ -492,12 +492,12 @@ If ELS for PHP is **not Active**, stop and resolve this before proceeding. The s The new 2509/2510 server and further EPP Server patches don't include client packages by default. You must upload them manually. -If you are using an external tool to manage your packages, you can ignore this section unless you are a Netwrix Enforced Encryption (EasyLock) customer — in that case, you need to follow the instructions below. +If you are using an external tool to manage your packages, you can ignore this section unless you are a Netwrix Enforced Encryption (EasyLock) customer — in that case, follow the instructions in this section. Download the Endpoint Protector Clients from the [My Products portal on netwrix.com](https://customer.netwrix.com/sign_in.html?rf=my_products.html), or request them from your account team. :::note -The EPP Server Client Upgrade feature doesn't support Linux client upgrades — Linux clients must be upgraded manually by administrators. +The EPP Server Client Upgrade feature doesn't support Linux client upgrades — administrators must upgrade Linux clients manually. ::: The average size of EPP Clients update is: @@ -542,7 +542,7 @@ The packages you need to upload depend on your current EPP client population and ### Upload Procedure -The client update mechanism controls how EPP clients are distributed and updated from the server. For a full description of available settings and options, see [Client Update Mechanism](/docs/endpointprotector/admin/systemconfiguration/systemsettings#client-update-mechanism). +The client update mechanism controls how the server distributes and updates EPP clients. For a full description of available settings and options, see [Client Update Mechanism](/docs/endpointprotector/admin/systemconfiguration/systemsettings#client-update-mechanism). 1. Navigate to **System Configuration → Client Software**. 2. Use the upload function to add each client package and its corresponding checksum file. @@ -550,18 +550,18 @@ The client update mechanism controls how EPP clients are distributed and updated ![System Configuration → Client Software — uploaded client versions](../../admin/systemconfiguration/ClientSoftwareUpdatePage.webp) :::warning -Upload **both** EE clients for Windows and macOS if both operating systems are in use in your organization. Missing even one platform's EE client can break encryption enforcement on that platform. +Upload **both** EE clients for Windows and macOS if your organization uses both operating systems. Missing even one platform's EE client can break encryption enforcement on that platform. ::: ### Obsolete OS limitations -As defined in the [Client Supportability Statement](/docs/endpointprotector/supportability/client-supportability.md), obsolete and discontinued operating systems aren't supported by the latest EPP Client versions. If continued use of the EPP Client on an unsupported operating system is required, the last available Client version compatible with that operating system must be used. While such Client versions may retain the ability to communicate with the EPP Server, they are no longer covered under the standard support agreement. Netwrix provides no warranty, guarantee, or obligation for EPP Client functionality on unsupported operating systems. Netwrix provides support in such cases on a best-effort basis only. For example, the last EPP Client version for obsolete operating systems such as Windows XP, Windows 7, and Windows 8 is 5.9.4.0 release one (6.2.4.2000). +As defined in the [Client Supportability Statement](/docs/endpointprotector/supportability/client-supportability.md), the latest EPP Client versions don't support obsolete and discontinued operating systems. If you must continue using the EPP Client on an unsupported operating system, use the last available Client version compatible with that operating system. While such Client versions may retain the ability to communicate with the EPP Server, the standard support agreement no longer covers them. Netwrix provides no warranty, guarantee, or obligation for EPP Client functionality on unsupported operating systems. Netwrix provides support in such cases on a best-effort basis only. For example, the last EPP Client version for obsolete operating systems such as Windows XP, Windows 7, and Windows 8 is 5.9.4.0 release one (6.2.4.2000). --- ## Post-Migration Verification -Complete all items in this checklist after the migration is finished. +Complete all items in this checklist after you finish the migration. ### Server Health Check @@ -641,7 +641,7 @@ Re-import and reconfigure each active integration before proceeding to verificat #### Post-Migration Integration Verification -Once reconfigured, verify each integration is functioning: +After reconfiguration, verify each integration is functioning: | Integration | How to Verify | |---|---| @@ -657,7 +657,7 @@ If an integration fails verification, use the steps below: **SMTP / Email alerts not firing:** 1. Navigate to **System Configuration → System Settings → Email Configuration**. -2. Re-enter SMTP credentials — passwords aren't always restored from backup. +2. Re-enter SMTP credentials — the backup doesn't always restore passwords. 3. Use the test email function and check server logs if delivery fails. 4. Verify firewall allows outbound on the configured SMTP port (25, 465, or 587). @@ -672,7 +672,7 @@ AD Sync may appear to complete successfully but only import a partial set of use **Entra ID / SSO / SCIM not working:** 1. Navigate to **System Configuration → SSO / Single Sign-On**. -2. Re-enter tenant ID, client ID, and client secret — these aren't restored from backup. +2. Re-enter tenant ID, client ID, and client secret — the backup doesn't restore these. 3. Verify the redirect URI registered in Azure AD matches the new server address. 4. Perform a test SSO login in an incognito window. 5. If SCIM provisioning is broken, re-generate the SCIM token in the EPP console and update it in Entra ID. @@ -680,7 +680,7 @@ AD Sync may appear to complete successfully but only import a partial set of use **SIEM / Syslog events not forwarding:** 1. Reconfigure the SIEM destination IP, port, and protocol. 2. Generate a test event and confirm it reaches the SIEM receiver. -3. If events still don't appear, contact Netwrix Support — a server-side script may be required to restart the syslog forwarding service. +3. If events still don't appear, contact Netwrix Support — you may need a server-side script to restart the syslog forwarding service. **AWS / S3 file shadows unreachable:** 1. Navigate to **System Configuration → File Shadow Repository**. From e03c1d4885361479fee4f1099823b5ecd2d0c800 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 8 May 2026 15:28:57 +0000 Subject: [PATCH 3/5] fix(vale): auto-fix style issues (Vale + Dale) --- docs/endpointprotector/admin/cap_module/newoutlook.md | 8 ++++---- docs/endpointprotector/install/migrationprocedure/faq.md | 2 +- .../install/migrationprocedure/migrationguide.md | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/endpointprotector/admin/cap_module/newoutlook.md b/docs/endpointprotector/admin/cap_module/newoutlook.md index f1b4011bfb..d876a44ead 100644 --- a/docs/endpointprotector/admin/cap_module/newoutlook.md +++ b/docs/endpointprotector/admin/cap_module/newoutlook.md @@ -8,7 +8,7 @@ sidebar_position: 50 Starting from Endpoint Protector Clients version 5.9.4.3, you can fully manage New Outlook as a Content Aware Protection Exit Point via the Microsoft 365 Web Add-in. Unlike COM add-ins for classic Outlook, which install directly on individual endpoints, you must deploy Microsoft Web Add-ins centrally using the Microsoft 365 Admin Center or manually within the user account in the Outlook application. -Microsoft 365 Web Add-ins associate with user accounts rather than computers or devices. Once you deploy an add-in to a user account, every device the user employs to access that account has the add-in available. This means you can't restrict it to just one device, such as the user's Mac computer only. +Microsoft 365 Web Add-ins associate with user accounts rather than computers or devices. After you deploy an add-in to a user account, every device the user employs to access that account has the add-in available. This means you can't restrict it to just one device, such as the user's Mac computer only. For detailed instructions and more information, refer to the official documentation available through Microsoft and Endpoint Protector resources: - [Microsoft resources](https://learn.microsoft.com/en-us/office/dev/add-ins/overview/office-add-ins) @@ -160,12 +160,12 @@ However, the add-in has a predefined, hardcoded behavior when it can't communica 3. Change the value from `true` to `false`. :::warning Important -Use this option carefully and ensure it is aligned with your rollout plan to avoid interruptions in essential business email communication. +Use this option carefully and align it with your rollout plan to avoid interruptions in essential business email communication. ::: ## Default Blocking Message of New Outlook Add-in -There is also an option to replace the add-in default message in the tooltip prompt in the email editor window in New Outlook with a custom one. +You can also replace the add-in default message in the tooltip prompt in the email editor window in New Outlook with a custom one. **To change that:** @@ -217,6 +217,6 @@ The central deployment method allows administrators to deploy the EPP New Outloo 6. After selecting the file and clicking **Next**, under **Add users**, choose **Specific users/groups** and use the search box to find the groups you want.\ ![Specific users/groups selector](msaddinspecifictargetuser.webp "Specific users/groups selector") 7. When the list appears under **To be added**, click **Next** and then click **Accept Permissions**. Review the needed permissions and click **Accept**. -8. Ensure to keep **Deployment Method** as **Fixed (Default)**. +8. Keep **Deployment Method** as **Fixed (Default)**. 9. Click **Next** and then **Finish deployment**. 10. After making changes, allow some time for them to propagate. According to Microsoft, this process can take anywhere from a few minutes to 24 hours. diff --git a/docs/endpointprotector/install/migrationprocedure/faq.md b/docs/endpointprotector/install/migrationprocedure/faq.md index 3c047cc74f..a5df173599 100644 --- a/docs/endpointprotector/install/migrationprocedure/faq.md +++ b/docs/endpointprotector/install/migrationprocedure/faq.md @@ -6,7 +6,7 @@ sidebar_position: 30 # Frequently Asked Questions -This page covers the most common questions and issues encountered during EPP server migrations. +This page covers the most common questions and issues you may encounter during EPP server migrations. --- diff --git a/docs/endpointprotector/install/migrationprocedure/migrationguide.md b/docs/endpointprotector/install/migrationprocedure/migrationguide.md index af79a78184..d26e671924 100644 --- a/docs/endpointprotector/install/migrationprocedure/migrationguide.md +++ b/docs/endpointprotector/install/migrationprocedure/migrationguide.md @@ -363,7 +363,7 @@ Always use the **same IP/FQDN** option. The operational complexity and user impa | High server load | Certificate regeneration for all endpoints creates a burst load spike | :::warning -If using Enforced Encryption and you change the IP/FQDN, every user with an EE-protected drive must decrypt their drive and re-encrypt it after reconnecting to the new server. This can be a major operational disruption in large organizations. This is strongly discouraged. +If using Enforced Encryption and you change the IP/FQDN, every user with an EE-protected drive must decrypt their drive and re-encrypt it after reconnecting to the new server. This can be a major operational disruption in large organizations. Netwrix strongly discourages this. ::: ### Deploying the 2510 Base Image @@ -653,7 +653,7 @@ After reconfiguration, verify each integration is functioning: #### Troubleshooting Failed Integrations -If an integration fails verification, use the steps below: +If an integration fails verification, use the following steps: **SMTP / Email alerts not firing:** 1. Navigate to **System Configuration → System Settings → Email Configuration**. From c8691af22fff55748b61d63c4e0e4307f8c20194 Mon Sep 17 00:00:00 2001 From: Florian Berger Date: Mon, 11 May 2026 12:47:55 +0200 Subject: [PATCH 4/5] Password Secure: Release 26.5.1 (#881) --- .../versionhistory/version_26.5.1.34120.md | 21 +++++++++++++ .../versionhistory/version_history.md | 2 ++ docs/passwordsecure/current/msp_system.md | 30 ++++++++----------- 3 files changed, 36 insertions(+), 17 deletions(-) create mode 100644 docs/passwordsecure/current/introduction/versionhistory/version_26.5.1.34120.md diff --git a/docs/passwordsecure/current/introduction/versionhistory/version_26.5.1.34120.md b/docs/passwordsecure/current/introduction/versionhistory/version_26.5.1.34120.md new file mode 100644 index 0000000000..086f9d9ec4 --- /dev/null +++ b/docs/passwordsecure/current/introduction/versionhistory/version_26.5.1.34120.md @@ -0,0 +1,21 @@ +--- +title: "Version 26.5.1.34120" +description: "List of all changes introduced in Netwrix Password Secure version 26.5.1" +sidebar_position: 8 +--- + +## New + +### Web application: Basic view +- You can now import passwords from a CSV file in the basic view of the web application. + +## Improved + +### Web application: Advanced view +- The web app no longer displays the file path of a document in the documents list, as you can't use the path from the web. The file path now appears only in the document preview area. + + +## Fixed +### Windows application +- Fixed heavy performance issues when using the Windows application. +- Fixed an issue that prevented Active Directory and Entra ID profile permissions from loading in the Windows application. diff --git a/docs/passwordsecure/current/introduction/versionhistory/version_history.md b/docs/passwordsecure/current/introduction/versionhistory/version_history.md index 9369db1883..2f61307fa1 100644 --- a/docs/passwordsecure/current/introduction/versionhistory/version_history.md +++ b/docs/passwordsecure/current/introduction/versionhistory/version_history.md @@ -8,5 +8,7 @@ sidebar_position: 30 The following sections contain the previously released versions and their changelogs. +- [Version 26.5.1.34120](/docs/passwordsecure/current/introduction/versionhistory/version_26.5.1.34120.md) +- [Version 26.4.10.34111](/docs/passwordsecure/current/introduction/versionhistory/version_26.4.10.34111.md) - [Version 26.3.101.34065](/docs/passwordsecure/current/introduction/versionhistory/version_26.3.101.34065.md) - [Version 26.3.100.34058](/docs/passwordsecure/current/introduction/versionhistory/version_26.3.100.34058.md) diff --git a/docs/passwordsecure/current/msp_system.md b/docs/passwordsecure/current/msp_system.md index e119bbbc2e..8a4ac3b14d 100644 --- a/docs/passwordsecure/current/msp_system.md +++ b/docs/passwordsecure/current/msp_system.md @@ -6,11 +6,11 @@ sidebar_position: 30 # MSP System -To ensure optimal operation, you should make the following hardware resources available: +To ensure optimal operation, provide the following hardware resources: ## Microsoft SQL Server -The following system requirements are the minimum system requirements and should manage around 10 +The following minimum system requirements should manage around 10 customers with less than 20 users each. - Windows Server 2019 (or newer) @@ -19,42 +19,38 @@ customers with less than 20 users each. - 16 GB RAM - min. 100 GB HDD -**CAUTION:** That using a SQL Server with Express edition isn't recommended because of -diverse limitations there. +**CAUTION:** Don't use SQL Server Express edition because of its limitations. -If your customer's count is growing over time, you should add every 200 users a minimum of at least: +If your customer count grows, for every additional 200 users add at least: - 2 CPU’s - 8 GB RAM ## Application Server -The following system requirements are the minimum system requirements and should manage around 10 +The following minimum system requirements should manage around 10 customers with 20 users each. -- Windows Server 2016 (or newer) +- Windows Server 2019 (or newer) - 4 CPU’s - 16 GB RAM - min. 50 GB HDD - .NET Framework 4.8 -If your customer's count is growing over time, you should add every 200 users a minimum of at least: +If your customer count grows, for every additional 200 users add at least: - 1 CPU - 4 GB RAM RECOMMENDED:, you should use an application server to handle a max of about 100 -customers. So if you reach 100 customers, you should set up a second Application Server or use some -sort of load balancing between the application servers. +customers. If you reach 100 customers, you should set up a second Application Server or use load balancing between the application servers. -**CAUTION:** Every additional 1000 users an additional Web-Endpoint - incl. loadbalancing - is -recommended +**CAUTION:** Add a Web-Endpoint (including load balancing) for every additional 1000 users. -**CAUTION:** Every additional 100 customers/1000 users an additional Application Server - incl. -loadbalancing - is recommended. +**CAUTION:** Add an Application Server (including load balancing) for every additional 100 customers or 1000 users. :::note Individual variables - like the number of passwords per user - will affect -performance. Especially for MSP-Systems it is required to monitor performance continuously, and add -additional resources on demand. -::: +performance. Especially for Managed Service Provider (MSP) systems, you must monitor performance continuously and add +resources on demand. +::: \ No newline at end of file From b8c237996f5d0716f6dc0cf9061f5fedfa8c4cbc Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Mon, 11 May 2026 13:20:24 +0000 Subject: [PATCH 5/5] fix(vale): auto-fix style issues (Vale + Dale) --- docs/endpointprotector/admin/cap_module/capai.md | 2 +- docs/endpointprotector/admin/cap_module/newoutlook.md | 6 +++--- docs/endpointprotector/index.md | 10 +++++----- .../install/migrationprocedure/faq.md | 6 +++--- .../install/migrationprocedure/migrationguide.md | 10 +++++----- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/docs/endpointprotector/admin/cap_module/capai.md b/docs/endpointprotector/admin/cap_module/capai.md index f3a06f411e..dc32800d75 100644 --- a/docs/endpointprotector/admin/cap_module/capai.md +++ b/docs/endpointprotector/admin/cap_module/capai.md @@ -15,7 +15,7 @@ As artificial intelligence tools become increasingly integrated into everyday bu This new functionality enables businesses to maintain precise control over information exchanges with popular AI chat applications. By incorporating Data Loss Prevention for LLMs, EPP enhances security by: - Letting administrators manage who can interact with AI prompts through web applications. -- Offering tools to oversee sensitive content, whether typed directly or attached as a file. +- Offering tools to oversee sensitive content, whether users type it directly or attach it as a file. **Benefits** diff --git a/docs/endpointprotector/admin/cap_module/newoutlook.md b/docs/endpointprotector/admin/cap_module/newoutlook.md index d876a44ead..6e1a0a29b6 100644 --- a/docs/endpointprotector/admin/cap_module/newoutlook.md +++ b/docs/endpointprotector/admin/cap_module/newoutlook.md @@ -51,7 +51,7 @@ The Endpoint Protector add-in requires the customer to host certain files and ma Hosting these files ensures that the add-in can communicate appropriately with the EPP system to enable its functionalities. - You are responsible for hosting these files. Host them at a publicly reachable URL. The URL of each hosted file must match the value configured in the manifest. The following chapters describe each requirement. + You are responsible for hosting these files. Host them at a publicly reachable URL. The URL of each hosted file must match the value you configure in the manifest. The following chapters describe each requirement. :::warning Important Any downtime affecting the hosted files (mainpage.html, validator.js) will prevent users with the add-in assigned from sending any emails. @@ -71,7 +71,7 @@ Set up a standard Endpoint Protector (EPP) Content Aware Protection (CAP) policy Turn off the setting under Content Aware Protection → Deep Packet Inspection called "Block Unsupported Protocols in New Outlook". The EPP add-in makes this setting unnecessary. :::note -On macOS, an EPP certificate is used to ensure secure communication between the add-in and the EppClient. Refer to the existing User Manual chapter for [detailed instructions](./deeppacket#dpi-certificate-on-macos). If you have configured the DPI certificate on macOS, you can ignore this note. +On macOS, an EPP certificate ensures secure communication between the add-in and the EppClient. Refer to the existing User Manual chapter for [detailed instructions](./deeppacket#dpi-certificate-on-macos). If you have configured the DPI certificate on macOS, you can ignore this note. ::: :::warning Important @@ -112,7 +112,7 @@ The Microsoft add-in validator requires this. Replace the placeholder URLs with ``` Ensure that you add every domain in the URLs of the hosted files to the `` list: - - If the same domain is used for all URLs, it only needs to be added once. + - If all URLs use the same domain, you only need to add it once. - Extend the existing list by adding your domain at the end between the `` tags, and before the closing `` tag. 3. Define the validator location\ diff --git a/docs/endpointprotector/index.md b/docs/endpointprotector/index.md index f42e842c0d..d66f67d5a4 100644 --- a/docs/endpointprotector/index.md +++ b/docs/endpointprotector/index.md @@ -6,8 +6,8 @@ sidebar_position: 1 # Netwrix Endpoint Protector -Netwrix Endpoint Protector is a comprehensive Data Loss Prevention (DLP) solution designed to -safeguard endpoint systems from data ex-filtration and loss. Portable storage devices and internet +Netwrix Endpoint Protector is a comprehensive Data Loss Prevention (DLP) solution that safeguards +endpoint systems from data ex-filtration and loss. Portable storage devices and internet connectivity are ubiquitous, making data theft and accidental loss a persistent risk. Traditional network security measures often struggle to prevent data breaches originating from @@ -25,8 +25,8 @@ HIPAA, and GDPR through predefined discovery patterns and response strategies. I organizational needs, from protecting intellectual property and client lists to ensuring compliance with industry-specific regulations. -With Endpoint Protector, administrators gain a centralized, web-based interface for seamless -management and enforcement of security policies across all endpoints. Whether preventing accidental +With Endpoint Protector, administrators gain a centralized, web-based interface for management +and enforcement of security policies across all endpoints. Whether preventing accidental data leakage or mitigating risks from insider threats, Endpoint Protector offers essential tools to safeguard critical business data. @@ -46,7 +46,7 @@ safeguard critical business data. **Limited Support** provides best-effort assistance for existing functionality and critical security updates only—no new features or non-critical bug fixes. -**Discontinued Support** means no updates, patches, or technical support assistance will be available. +**Discontinued Support** means Netwrix provides no updates, patches, or technical support assistance. ### Stay Protected diff --git a/docs/endpointprotector/install/migrationprocedure/faq.md b/docs/endpointprotector/install/migrationprocedure/faq.md index a5df173599..ea32db34d5 100644 --- a/docs/endpointprotector/install/migrationprocedure/faq.md +++ b/docs/endpointprotector/install/migrationprocedure/faq.md @@ -25,7 +25,7 @@ Attempting to restore a backup from 5.7.x, 5.8.x, 5.9.x, or 5.9.4.1 onto 2510 wi ## Restoring a 2509 Backup onto a 2510 Server -Netwrix supports this. Restoring a 2509 configuration backup onto a 2510 server migrates the configuration — the OS remains 2510. Once patched to 2604, the result is functionally equivalent to a native 2510-based deployment at 2604. The only practical difference is disk sizing, as the 2509 base image has a smaller default disk allocation than 2510. If disk capacity is sufficient, this path is fully valid. +Netwrix supports this. Restoring a 2509 configuration backup onto a 2510 server migrates the configuration — the OS remains 2510. Once you patch it to 2604, the result is functionally equivalent to a native 2510-based deployment at 2604. The only practical difference is disk sizing, as the 2509 base image has a smaller default disk allocation than 2510. If disk capacity is sufficient, this path is fully valid. --- @@ -83,7 +83,7 @@ You may need to refresh Entra ID / SSO application registrations after migration **Steps:** 1. Navigate to **System Configuration → SSO**. -2. Verify Tenant ID, Client ID, and Client Secret are correctly populated. +2. Verify Tenant ID, Client ID, and Client Secret are correct. 3. Test login in an incognito browser window. 4. If the issue persists, re-register the EPP application in your Azure AD / Entra ID tenant. @@ -182,7 +182,7 @@ Air-gapped activation requires an **Offline Activation Patch** specific to 2510. ## ELS for PHP Installation Failing -This can occur in some migration paths when the license isn't correctly recognized. +This can occur in some migration paths when EPP doesn't correctly recognize the license. **Steps:** 1. Verify your license file contains the `"php_els":""` field. If this field is missing, your license doesn't include ELS for PHP entitlement — contact Netwrix Support or your account team to request a refreshed license before proceeding. diff --git a/docs/endpointprotector/install/migrationprocedure/migrationguide.md b/docs/endpointprotector/install/migrationprocedure/migrationguide.md index d26e671924..51b9d5f99a 100644 --- a/docs/endpointprotector/install/migrationprocedure/migrationguide.md +++ b/docs/endpointprotector/install/migrationprocedure/migrationguide.md @@ -211,7 +211,7 @@ Keep the VM snapshot active until you have fully validated the new 2510 environm 1. Log in to Endpoint Protector Console. 2. Navigate to **System Maintenance → System Backup**. 3. Click **Create**, enter a name and description (include the date and version, e.g., `pre-upgrade-5942-2026-04-20`), click **Save**. -4. **Save the System Backup Key** displayed in the prompt — you need this key for restoration and can't recover it if lost. +4. **Save the System Backup Key** that appears in the prompt — you need this key for restoration and can't recover it if lost. 5. Wait for the status to show **"Ready to download"**, then download the backup file. ![System Maintenance → System Backup — backup creation wizard](backup_wizard.webp) @@ -359,7 +359,7 @@ Always use the **same IP/FQDN** option. The operational complexity and user impa | DPI certificate trust broken | Content Aware Protection and DPI will fail until certificates regenerated | | CAP policy disruption | All Content Aware Protection rules break | | EE drives locked | Users must manually decrypt and re-encrypt every protected drive | -| Root CA redistribution | New root CA must be pushed to all endpoints via GPO/MDM | +| Root CA redistribution | You must push the new root CA to all endpoints via GPO/MDM | | High server load | Certificate regeneration for all endpoints creates a burst load spike | :::warning @@ -421,7 +421,7 @@ With the license active, upgrade the fresh 2510 image to the current latest patc ![System Configuration → Software Update — patch upload and version progression](../../admin/systemconfiguration/softwareupdate.webp) :::tip -For air-gapped environments, follow the same procedure using the 2604 cumulative patch file — this is the same patch used for online environments. +For air-gapped environments, follow the same procedure using the 2604 cumulative patch file — this is the same patch as for online environments. ::: 3. After each patch, refresh the browser and verify the version in **Appliance → Server Information** before applying the next. @@ -613,7 +613,7 @@ Generate deliberate test events on a known test machine for each active module. If using Deep Packet Inspection or Content Aware Protection: -1. Verify the root CA certificate is trusted on endpoints. +1. Verify endpoints trust the root CA certificate. 2. Test a known-blocked transfer to confirm CAP policy is active. 3. If endpoints don't trust the certificates, and you used a **different IP/FQDN**, you may need to push the new root CA via GPO or MDM. @@ -725,7 +725,7 @@ If using EPP's built-in upgrade: 3. Select target computers carefully. :::warning -EPP's built-in upgrade is rate-limited to **50 machines per hour**. For large deployments, plan accordingly or use external deployment tools. +EPP's built-in upgrade limits the rate to **50 machines per hour**. For large deployments, plan accordingly or use external deployment tools. ::: :::tip